From 86db36bf8a67714309e87c6372a5b2d213628724 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Fri, 6 Mar 2026 02:18:42 +0530
Subject: [PATCH 01/71] feat: use multisig sdk instead of the base http client

---
 package.json                           |   2 +
 src/lib/miden-chain/constants.ts       |   2 +
 src/lib/miden/activity/transactions.ts |  75 ++++++++++
 src/lib/miden/front/psm-manager.ts     |  60 ++++++++
 src/lib/miden/psm/account.ts           |  68 ++++++++++
 src/lib/miden/psm/index.ts             | 181 +++++++++++++++++++++++++
 src/lib/miden/psm/signer.ts            |  43 ++++++
 yarn.lock                              |  49 +++++--
 8 files changed, 465 insertions(+), 15 deletions(-)
 create mode 100644 src/lib/miden/front/psm-manager.ts
 create mode 100644 src/lib/miden/psm/account.ts
 create mode 100644 src/lib/miden/psm/index.ts
 create mode 100644 src/lib/miden/psm/signer.ts

diff --git a/package.json b/package.json
index 37963547a..4e8826741 100644
--- a/package.json
+++ b/package.json
@@ -83,6 +83,8 @@
     "@miden-sdk/miden-sdk": "^0.13.0",
     "@newhighsco/storybook-addon-svgr": "^2.0.7",
     "@noble/hashes": "^1.4.0",
+    "@openzeppelin/miden-multisig-client": "^0.13.0",
+    "@openzeppelin/psm-client": "^0.13.0",
     "@peculiar/webcrypto": "1.1.6",
     "@radix-ui/react-slot": "^1.2.3",
     "@segment/analytics-node": "^2.3.0",
diff --git a/src/lib/miden-chain/constants.ts b/src/lib/miden-chain/constants.ts
index 7bfb00e26..850feab48 100644
--- a/src/lib/miden-chain/constants.ts
+++ b/src/lib/miden-chain/constants.ts
@@ -61,3 +61,5 @@ export enum MidenTokens {
 export const TOKEN_MAPPING = {
   [MidenTokens.Miden]: { faucetId: 'mtst1aqmat9m63ctdsgz6xcyzpuprpulwk9vg_qruqqypuyph' }
 };
+
+export const DEFAULT_PSM_ENDPOINT = 'https://psm-stg.openzeppelin.com';
diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index 53f735af8..b15b7379b 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -5,6 +5,7 @@ import {
   NoteFilter,
   NoteFilterTypes,
   NoteId,
+  TransactionRequest,
   TransactionResult
 } from '@miden-sdk/miden-sdk';
 import { liveQuery } from 'dexie';
@@ -12,6 +13,7 @@ import { liveQuery } from 'dexie';
 import { consumeNoteId } from 'lib/miden-worker/consumeNoteId';
 import { sendTransaction } from 'lib/miden-worker/sendTransaction';
 import { submitTransaction } from 'lib/miden-worker/submitTransaction';
+import { getOrCreateMultisigService, isPsmAccount } from 'lib/miden/front/psm-manager';
 import * as Repo from 'lib/miden/repo';
 import { isExtension, isMobile } from 'lib/platform';
 import { u8ToB64 } from 'lib/shared/helpers';
@@ -598,6 +600,18 @@ export const generateTransaction = async (
   await updateTransactionStatus(transaction.id, ITransactionStatus.GeneratingTransaction, {
     processingStartedAt: Math.floor(Date.now() / 1000) // seconds
   });
+<<<<<<< HEAD
+=======
+  console.log('Generating transaction', {
+    txId: transaction.id,
+    type: transaction.type,
+    accountId: transaction.accountId
+  });
+  // Route PSM accounts through PSM service
+  if (isPsmAccount(transaction.accountId)) {
+    await generatePsmTransaction(transaction, signCallback);
+    return;
+  }
 
   // Process transaction
   let result: TransactionResult;
@@ -667,6 +681,67 @@ export const generateTransaction = async (
   }
 };
 
+/**
+ * Generate a transaction for a PSM account using the MultisigService.
+ * Routes the transaction through MultisigService proposal methods.
+ */
+const generatePsmTransaction = async (
+  transaction: ITransaction,
+  signCallback: (publicKey: string, signingInputs: string) => Promise<Uint8Array>
+): Promise<void> => {
+  const multisigService = await getOrCreateMultisigService(transaction.accountId, signCallback);
+
+  let proposalResult;
+
+  switch (transaction.type) {
+    case 'send': {
+      const sendTx = transaction as SendTransaction;
+      proposalResult = await multisigService.createSendProposal(
+        sendTx.secondaryAccountId,
+        sendTx.faucetId,
+        BigInt(sendTx.amount)
+      );
+      break;
+    }
+    case 'consume': {
+      const consumeTx = transaction as ConsumeTransaction;
+      proposalResult = await multisigService.createConsumeNotesProposal([consumeTx.noteId]);
+      break;
+    }
+    case 'execute':
+    default: {
+      // For custom transactions, get TransactionSummary and create a custom proposal
+      const summaryBytes = await withWasmClientLock(async () => {
+        const midenClient = await getMidenClient();
+        const txRequest = TransactionRequest.deserialize(transaction.requestBytes!);
+        return (
+          await midenClient.webClient.executeForSummary(accountIdStringToSdk(transaction.accountId), txRequest)
+        ).serialize();
+      });
+      proposalResult = await multisigService.createCustomProposal(summaryBytes);
+      break;
+    }
+  }
+
+  // Get the proposal commitment for signing and execution
+  const proposalCommitment = proposalResult.proposal.commitment;
+  console.log('Transaction proposal created with commitment:', proposalCommitment);
+
+  // Sign and execute the proposal
+  await multisigService.signAndExecuteProposal(proposalCommitment);
+
+  await multisigService.sync();
+  // Determine display message based on transaction type
+  const displayMessage =
+    transaction.type === 'send' ? 'Sent' : transaction.type === 'consume' ? 'Received' : 'Completed';
+
+  // Update transaction as completed
+  await updateTransactionStatus(transaction.id, ITransactionStatus.Completed, {
+    displayMessage,
+    completedAt: Math.floor(Date.now() / 1000)
+  });
+};
+
 export const cancelTransaction = async (transaction: Transaction, error: any) => {
   // Cancel the transaction
   await Repo.transactions.where({ id: transaction.id }).modify(dbTx => {
diff --git a/src/lib/miden/front/psm-manager.ts b/src/lib/miden/front/psm-manager.ts
new file mode 100644
index 000000000..3ef47b129
--- /dev/null
+++ b/src/lib/miden/front/psm-manager.ts
@@ -0,0 +1,60 @@
+import { MultisigService } from 'lib/miden/psm';
+import { useWalletStore } from 'lib/store';
+import { WalletType } from 'screens/onboarding/types';
+
+import { MULTISIG_SLOT_NAMES } from '../psm/account';
+import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
+/**
+ * Get or create a MultisigService for the given account (lazy initialization).
+ * Services are cached in memory and reused for subsequent calls.
+ */
+export async function getOrCreateMultisigService(
+  accountPublicKey: string,
+  signCallback: (publicKey: string, signingInputs: string) => Promise<Uint8Array>
+): Promise<MultisigService> {
+  // Verify this is a PSM account using Zustand store
+  const accounts = useWalletStore.getState().accounts;
+  const account = accounts.find(acc => acc.publicKey === accountPublicKey);
+  if (!account || account.type !== WalletType.Psm) {
+    throw new Error('Account is not a PSM account');
+  }
+
+  // Get the Account object and WebClient from Miden client
+  const { sdkAccount } = await withWasmClientLock(async () => {
+    const midenClient = await getMidenClient();
+    const sdkAccount = await midenClient.getAccount(accountPublicKey);
+    return { sdkAccount };
+  });
+
+  if (!sdkAccount) {
+    throw new Error('Account not found in local storage');
+  }
+
+  const mapEntries = sdkAccount.storage().getMapEntries(MULTISIG_SLOT_NAMES.SIGNER_PUBLIC_KEYS);
+  if (!mapEntries) {
+    throw new Error('No signer public keys found in account storage');
+  }
+
+  const commitment = mapEntries[0].value.slice(2);
+  if (!commitment) {
+    throw new Error('Commitment not found in account storage');
+  }
+
+  // Get the actual public key from the public key commitment
+  const publicKey = await useWalletStore.getState().getPublicKeyForCommitment(commitment);
+
+  // Initialize MultisigService with the account, public key, commitment, sign function, and webClient
+  const service = await MultisigService.init(sdkAccount, `0x${publicKey}`, `0x${commitment}`, signCallback);
+
+  return service;
+}
+
+/**
+ * Check if an account is a PSM account and has completed at least one transaction.
+ * PSM routing only applies after the first transaction.
+ */
+export function isPsmAccount(accountPublicKey: string): boolean {
+  const accounts = useWalletStore.getState().accounts;
+  const account = accounts.find(acc => acc.publicKey === accountPublicKey);
+  return account?.type === WalletType.Psm;
+}
diff --git a/src/lib/miden/psm/account.ts b/src/lib/miden/psm/account.ts
new file mode 100644
index 000000000..268ac6515
--- /dev/null
+++ b/src/lib/miden/psm/account.ts
@@ -0,0 +1,68 @@
+import { Account, AuthSecretKey, WebClient } from '@miden-sdk/miden-sdk';
+import { createMultisigAccount, MultisigClient } from '@openzeppelin/miden-multisig-client';
+
+import { DEFAULT_PSM_ENDPOINT } from 'lib/miden-chain/constants';
+import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
+
+import { fetchFromStorage } from '../front';
+
+// Re-export the slot names from the package for reading account state
+export const MULTISIG_SLOT_NAMES = {
+  THRESHOLD_CONFIG: 'openzeppelin::multisig::threshold_config',
+  SIGNER_PUBLIC_KEYS: 'openzeppelin::multisig::signer_public_keys',
+  EXECUTED_TRANSACTIONS: 'openzeppelin::multisig::executed_transactions',
+  PROCEDURE_THRESHOLDS: 'openzeppelin::multisig::procedure_thresholds'
+} as const;
+
+/**
+ * Create a PSM (Private State Manager) account using the MultisigClient.
+ *
+ * This creates a 1-of-1 multisig account with PSM signature verification enabled.
+ * The account is registered with the PSM backend and the secret key is stored locally.
+ *
+ * @param webClient - The Miden WebClient instance
+ * @param seed - Optional seed for key derivation (random if not provided)
+ * @returns The created Account
+ */
+export async function createPsmAccount(webClient: WebClient, seed?: Uint8Array): Promise<Account> {
+  if (!seed) {
+    seed = crypto.getRandomValues(new Uint8Array(32));
+  }
+
+  try {
+    // Generate the signer secret key from seed
+    const sk = AuthSecretKey.rpoFalconWithRNG(seed);
+    const signerCommitment = sk.publicKey().toCommitment();
+
+    // Get PSM endpoint and initialize client
+    const psmEndpoint = (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) || DEFAULT_PSM_ENDPOINT;
+    const client = new MultisigClient(webClient, { psmEndpoint });
+    const { psmCommitment, psmPublicKey } = await client.initialize('falcon');
+
+    console.log('Creating PSM account with PSM commitment:', psmCommitment);
+
+    // Create the multisig account using the package utility
+    const { account } = await createMultisigAccount(webClient, {
+      threshold: 1,
+      signerCommitments: [signerCommitment.toHex()],
+      psmCommitment,
+      psmPublicKey,
+      psmEnabled: true,
+      storageMode: 'public',
+      signatureScheme: 'falcon'
+    });
+
+    // Sync state with the node
+    await webClient.syncState();
+
+    // Store the secret key in WebStore for signing
+    await webClient.addAccountSecretKeyToWebStore(account.id(), sk);
+
+    console.log('PSM account created:', account.id().toString());
+
+    return account;
+  } catch (e) {
+    console.error('Error creating PSM account:', e);
+    throw new Error('Failed to create PSM account');
+  }
+}
diff --git a/src/lib/miden/psm/index.ts b/src/lib/miden/psm/index.ts
new file mode 100644
index 000000000..7639f84e0
--- /dev/null
+++ b/src/lib/miden/psm/index.ts
@@ -0,0 +1,181 @@
+import { Account, WebClient } from '@miden-sdk/miden-sdk';
+import {
+  AccountInspector,
+  Multisig,
+  MultisigClient,
+  MultisigConfig,
+  PsmHttpClient,
+  type ProposalMetadata,
+  type TransactionProposal,
+  type TransactionProposalResult
+} from '@openzeppelin/miden-multisig-client';
+
+import { DEFAULT_PSM_ENDPOINT } from 'lib/miden-chain/constants';
+import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
+import { u8ToB64 } from 'lib/shared/helpers';
+import { useWalletStore } from 'lib/store';
+
+import { fetchFromStorage } from '../front';
+import { accountIdStringToSdk } from '../sdk/helpers';
+import { MidenClientInterface } from '../sdk/miden-client-interface';
+import { WalletSigner, type SignWordFunction } from './signer';
+
+const MAX_SYNC_RETRIES = 20;
+
+/**
+ * MultisigService wraps the MultisigClient and Multisig classes from
+ * @openzeppelin/miden-multisig-client to provide a simplified interface
+ * for PSM account operations.
+ */
+export class MultisigService {
+  multisig: Multisig;
+  client: MultisigClient;
+  syncRetryCount: number = 0;
+
+  constructor(multisig: Multisig, client: MultisigClient) {
+    this.multisig = multisig;
+    this.client = client;
+  }
+
+  /**
+   * Initialize a MultisigService for an existing PSM account.
+   */
+  static async init(
+    account: Account,
+    publicKey: string,
+    signerCommitment: string,
+    signCallback?: (publicKey: string, signingInputs: string) => Promise<Uint8Array>
+  ): Promise<MultisigService> {
+    try {
+      const signer = new WalletSigner(publicKey, signerCommitment, useWalletStore.getState().signWord);
+      const psmEndpoint = (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) || DEFAULT_PSM_ENDPOINT;
+
+      const webClient = (
+        await MidenClientInterface.create(
+          signCallback
+            ? {
+                signCallback: async (publicKey: Uint8Array, signingInputs: Uint8Array) => {
+                  const keyString = Buffer.from(publicKey).toString('hex');
+                  const signingInputsString = Buffer.from(signingInputs).toString('hex');
+                  return await signCallback(keyString, signingInputsString);
+                }
+              }
+            : {}
+        )
+      ).webClient;
+
+      const client = new MultisigClient(webClient, { psmEndpoint });
+      const { psmCommitment } = await client.initialize('falcon');
+
+      // Load the existing multisig account
+      let multisig: Multisig;
+      if (account.isNew()) {
+        console.log('Creating new Multisig for account:', account.id().toString());
+        const config: MultisigConfig = {
+          threshold: 1,
+          signerCommitments: [signerCommitment],
+          psmCommitment: psmCommitment,
+          psmEnabled: true
+        };
+        const psmClient = new PsmHttpClient(psmEndpoint);
+        psmClient.setSigner(signer);
+        multisig = new Multisig(account, config, psmClient, signer, webClient);
+        await multisig.registerOnPsm();
+      } else {
+        multisig = await client.load(account.id().toString(), signer);
+      }
+      return new MultisigService(multisig, client);
+    } catch (error) {
+      console.log('Error initializing MultisigService:', error);
+      throw error;
+    }
+  }
+
+  /**
+   * Get the account ID for this multisig.
+   */
+  get accountId(): string {
+    return this.multisig.accountId;
+  }
+
+  /**
+   * Create a send (P2ID) transaction proposal.
+   */
+  async createSendProposal(recipientId: string, faucetId: string, amount: bigint): Promise<TransactionProposalResult> {
+    return this.multisig.createSendProposal(
+      accountIdStringToSdk(recipientId).toString(),
+      accountIdStringToSdk(faucetId).toString(),
+      amount
+    );
+  }
+
+  /**
+   * Create a consume notes transaction proposal.
+   */
+  async createConsumeNotesProposal(noteIds: string[]): Promise<TransactionProposalResult> {
+    return this.multisig.createConsumeNotesProposal(noteIds);
+  }
+
+  /**
+   * Create a custom transaction proposal from a TransactionSummary.
+   * This is used for 'execute' type transactions.
+   */
+  async createCustomProposal(summaryBytes: Uint8Array): Promise<TransactionProposalResult> {
+    const txSummaryBase64 = u8ToB64(summaryBytes);
+
+    // Sync state to ensure we have the latest nonce
+    await this.multisig.syncState();
+    const account = this.multisig.account;
+    if (!account) {
+      throw new Error('Account not found in MultisigService');
+    }
+    const nonce = Number(account.nonce().asInt()) + 2;
+
+    // Create metadata for unknown/custom proposal type
+    const metadata: ProposalMetadata = {
+      proposalType: 'unknown',
+      description: 'Custom transaction'
+    };
+
+    const proposal = await this.multisig.createProposal(nonce, txSummaryBase64, metadata);
+    const proposals = await this.multisig.syncTransactionProposals();
+
+    return { proposal, proposals };
+  }
+
+  async signAndExecuteProposal(commitment: string): Promise<void> {
+    await this.multisig.signTransactionProposal(commitment);
+    await this.multisig.executeTransactionProposal(commitment);
+  }
+
+  async sync(): Promise<void> {
+    try {
+      await this.multisig.syncAll();
+      this.syncRetryCount = 0; // Reset retry count on successful sync
+    } catch (error) {
+      const isNonceTooLow =
+        error instanceof Error && error.message.includes('nonce') && error.message.includes('too low');
+
+      if (isNonceTooLow) {
+        console.warn('Nonce is too low, local state is ahead of on chain state, retrying sync...', this.syncRetryCount);
+
+        if (this.syncRetryCount < MAX_SYNC_RETRIES) {
+          this.syncRetryCount++;
+          await new Promise(resolve => setTimeout(resolve, 3000)); // Wait before retrying
+          await this.sync();
+        } else {
+          console.error('Max sync retries reached. Please check your account state and try again.');
+        }
+      } else {
+        throw error; // Rethrow if it's a different error
+      }
+    }
+  }
+
+  async getConsumableNotes() {
+    return this.multisig.getConsumableNotes();
+  }
+}
+
+// Re-export types that may be needed by consumers
+export type { TransactionProposal, TransactionProposalResult, ProposalMetadata };
diff --git a/src/lib/miden/psm/signer.ts b/src/lib/miden/psm/signer.ts
new file mode 100644
index 000000000..bcd69f218
--- /dev/null
+++ b/src/lib/miden/psm/signer.ts
@@ -0,0 +1,43 @@
+import { AccountId, Felt, FeltArray, Rpo256, Word } from '@miden-sdk/miden-sdk';
+import { SignatureScheme, Signer } from '@openzeppelin/psm-client';
+
+export type SignWordFunction = (publicKey: string, wordHex: string) => Promise<string>;
+
+export class WalletSigner implements Signer {
+  readonly commitment: string;
+  readonly publicKey: string;
+  readonly scheme: SignatureScheme = 'falcon';
+  private signWordFn: SignWordFunction;
+  readonly commitmentForStorageRetrieval: string;
+
+  constructor(publicKey: string, commitment: string, signWordFn: SignWordFunction) {
+    this.publicKey = publicKey;
+    this.commitment = commitment;
+    this.commitmentForStorageRetrieval = commitment.slice(2);
+    this.signWordFn = signWordFn;
+  }
+
+  async signAccountIdWithTimestamp(accountId: string, timestamp: number): Promise<string> {
+    const digest = WalletSigner.computeAccountDigest(accountId, timestamp);
+    console.log('Signing account digest for storage retrieval', accountId);
+    const sig = await this.signWordFn(this.commitmentForStorageRetrieval, digest.toHex());
+    return sig;
+  }
+
+  async signCommitment(commitmentHex: string): Promise<string> {
+    const paddedHex = commitmentHex.startsWith('0x') ? commitmentHex : `0x${commitmentHex}`;
+    const sig = await this.signWordFn(this.commitmentForStorageRetrieval, paddedHex);
+    return sig;
+  }
+
+  static computeAccountDigest(accountId: string, timestamp: number): Word {
+    const paddedHex = accountId.startsWith('0x') ? accountId : `0x${accountId}`;
+    const parsedAccountId = AccountId.fromHex(paddedHex);
+    const prefix = parsedAccountId.prefix();
+    const suffix = parsedAccountId.suffix();
+
+    const feltArray = new FeltArray([prefix, suffix, new Felt(BigInt(timestamp)), new Felt(BigInt(0))]);
+
+    return Rpo256.hashElements(feltArray);
+  }
+}
diff --git a/yarn.lock b/yarn.lock
index ced4d6a26..5aac77837 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2195,6 +2195,11 @@
   resolved "https://registry.yarnpkg.com/@noble/hashes/-/hashes-1.8.0.tgz#cee43d801fcef9644b11b8194857695acd5f815a"
   integrity sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==
 
+"@noble/hashes@^2.0.1":
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/@noble/hashes/-/hashes-2.0.1.tgz#fc1a928061d1232b0a52bb754393c37a5216c89e"
+  integrity sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw==
+
 "@nodelib/fs.scandir@2.1.5":
   version "2.1.5"
   resolved "https://registry.yarnpkg.com/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz#7619c2eb21b25483f6d167548b4cfd5a7488c3d5"
@@ -2216,6 +2221,20 @@
     "@nodelib/fs.scandir" "2.1.5"
     fastq "^1.6.0"
 
+"@openzeppelin/miden-multisig-client@^0.13.0":
+  version "0.13.0"
+  resolved "https://registry.yarnpkg.com/@openzeppelin/miden-multisig-client/-/miden-multisig-client-0.13.0.tgz#e33ab86a774f976efa0a576dcd806bdac60e548d"
+  integrity sha512-b0wxXCM6iSWlKLKb0QzG15z4+UeqKGv4920Gvk6jn1ofeth1uy8Q8pTdDICe/L1UvwUsgqLhicEADUKkB+KOiw==
+  dependencies:
+    "@miden-sdk/miden-sdk" "^0.13.0"
+    "@noble/hashes" "^2.0.1"
+    "@openzeppelin/psm-client" "^0.13.0"
+
+"@openzeppelin/psm-client@^0.13.0":
+  version "0.13.0"
+  resolved "https://registry.yarnpkg.com/@openzeppelin/psm-client/-/psm-client-0.13.0.tgz#fe4df2282ddede6af451fdfe728e5733bf85f4c0"
+  integrity sha512-pf/b5CpWfVDbYBSXCDxyuRgbgrKNCB8Y/Bw9U2vW3DteUmfGdsCeCX+PprwVbTvNo1thfja1NzbEfkAvO9XLIw==
+
 "@peculiar/asn1-schema@^2.0.27", "@peculiar/asn1-schema@^2.3.13":
   version "2.6.0"
   resolved "https://registry.yarnpkg.com/@peculiar/asn1-schema/-/asn1-schema-2.6.0.tgz#0dca1601d5b0fed2a72fed7a5f1d0d7dbe3a6f82"
@@ -7066,13 +7085,13 @@ fraction.js@^5.3.4:
   resolved "https://registry.yarnpkg.com/fraction.js/-/fraction.js-5.3.4.tgz#8c0fcc6a9908262df4ed197427bdeef563e0699a"
   integrity sha512-1X1NTtiJphryn/uLQz3whtY6jK3fTqoE3ohKs0tT+Ujr1W59oopxmoEh7Lu5p6vBaPbgoM0bzveAW4Qi5RyWDQ==
 
-framer-motion@^12.35.2:
-  version "12.35.2"
-  resolved "https://registry.yarnpkg.com/framer-motion/-/framer-motion-12.35.2.tgz#add40fe8cdb8eb553feb9dd17525c93b51e6f67c"
-  integrity sha512-dhfuEMaNo0hc+AEqyHiIfiJRNb9U9UQutE9FoKm5pjf7CMitp9xPEF1iWZihR1q86LBmo6EJ7S8cN8QXEy49AA==
+framer-motion@^12.9.2:
+  version "12.29.0"
+  resolved "https://registry.yarnpkg.com/framer-motion/-/framer-motion-12.29.0.tgz#f031407c6025f96e9425de3da039b73c368b4153"
+  integrity sha512-1gEFGXHYV2BD42ZPTFmSU9buehppU+bCuOnHU0AD18DKh9j4DuTx47MvqY5ax+NNWRtK32qIcJf1UxKo1WwjWg==
   dependencies:
-    motion-dom "^12.35.2"
-    motion-utils "^12.29.2"
+    motion-dom "^12.29.0"
+    motion-utils "^12.27.2"
     tslib "^2.4.0"
 
 front-matter@^4.0.2:
@@ -9473,17 +9492,17 @@ mkdirp@^1.0.3:
   resolved "https://registry.yarnpkg.com/mkdirp/-/mkdirp-1.0.4.tgz#3eb5ed62622756d79a5f0e2a221dfebad75c2f7e"
   integrity sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==
 
-motion-dom@^12.35.2:
-  version "12.35.2"
-  resolved "https://registry.yarnpkg.com/motion-dom/-/motion-dom-12.35.2.tgz#489b9eb7206dbac3d6087aae584f08e78c16cfbd"
-  integrity sha512-pWXFMTwvGDbx1Fe9YL5HZebv2NhvGBzRtiNUv58aoK7+XrsuaydQ0JGRKK2r+bTKlwgSWwWxHbP5249Qr/BNpg==
+motion-dom@^12.29.0:
+  version "12.29.0"
+  resolved "https://registry.yarnpkg.com/motion-dom/-/motion-dom-12.29.0.tgz#93ba293d15df5edc9f3fd43225a5b59c26997a5c"
+  integrity sha512-3eiz9bb32yvY8Q6XNM4AwkSOBPgU//EIKTZwsSWgA9uzbPBhZJeScCVcBuwwYVqhfamewpv7ZNmVKTGp5qnzkA==
   dependencies:
-    motion-utils "^12.29.2"
+    motion-utils "^12.27.2"
 
-motion-utils@^12.29.2:
-  version "12.29.2"
-  resolved "https://registry.yarnpkg.com/motion-utils/-/motion-utils-12.29.2.tgz#8fdd28babe042c2456b078ab33b32daa3bf5938b"
-  integrity sha512-G3kc34H2cX2gI63RqU+cZq+zWRRPSsNIOjpdl9TN4AQwC4sgwYPl/Q/Obf/d53nOm569T0fYK+tcoSV50BWx8A==
+motion-utils@^12.27.2:
+  version "12.27.2"
+  resolved "https://registry.yarnpkg.com/motion-utils/-/motion-utils-12.27.2.tgz#cd3038236ae2dc3d643bdb272ed831fd6d8ab616"
+  integrity sha512-B55gcoL85Mcdt2IEStY5EEAsrMSVE2sI14xQ/uAdPL+mfQxhKKFaEag9JmfxedJOR4vZpBGoPeC/Gm13I/4g5Q==
 
 ms@2.0.0:
   version "2.0.0"

From b8a46a28d5e7b673cb705c37460efa4b3166d307 Mon Sep 17 00:00:00 2001
From: Wiktor Starczewski <poszerny@gmail.com>
Date: Wed, 11 Mar 2026 15:18:49 +0100
Subject: [PATCH 02/71] fix: address PSM integration review findings (#155)

- Remove secret key logging from vault.getPublicKeyForCommitment
- Fix broken conditional in autoSync (dangling no-op if)
- Add error handling to generatePsmTransaction (cancel on failure)
- Throw on max sync retries instead of silently succeeding
- Remove unused imports (PsmHttpClient, ProposalMetadata, AccountInspector, WebClient)
- Fix misleading comments in psm-manager
- Document nonce +2 offset in createCustomProposal
---
 src/lib/miden/activity/transactions.ts |  6 +++++-
 src/lib/miden/back/vault.ts            | 25 +++++++++++++++++++++++++
 src/lib/miden/front/psm-manager.ts     |  6 ++----
 src/lib/miden/psm/index.ts             |  6 +++---
 4 files changed, 35 insertions(+), 8 deletions(-)

diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index b15b7379b..40fe554f3 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -609,7 +609,11 @@ export const generateTransaction = async (
   });
   // Route PSM accounts through PSM service
   if (isPsmAccount(transaction.accountId)) {
-    await generatePsmTransaction(transaction, signCallback);
+    try {
+      await generatePsmTransaction(transaction, signCallback);
+    } catch (error) {
+      await cancelTransaction(transaction, error);
+    }
     return;
   }
 
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index b0b0b9b51..fd36b0ee7 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -503,6 +503,31 @@ export class Vault {
     return Buffer.from(signature.serialize()).toString('hex');
   }
 
+  async signWord(publicKey: string, wordHex: string): Promise<string> {
+    const word = Word.fromHex(wordHex);
+    const secretKey = await fetchAndDecryptOneWithLegacyFallBack<string>(
+      accAuthSecretKeyStrgKey(publicKey),
+      this.vaultKey
+    );
+    let secretKeyBytes = new Uint8Array(Buffer.from(secretKey, 'hex'));
+    const wasmSecretKey = AuthSecretKey.deserialize(secretKeyBytes);
+    const signature = wasmSecretKey.sign(word);
+    return `0x${Buffer.from(signature.serialize().slice(1)).toString('hex')}`;
+  }
+
+  async getPublicKeyForCommitment(pkc: string): Promise<string> {
+    try {
+      const sk = await fetchAndDecryptOneWithLegacyFallBack<string>(accAuthSecretKeyStrgKey(pkc), this.vaultKey);
+      let secretKeyBytes = new Uint8Array(Buffer.from(sk, 'hex'));
+      const wasmSecretKey = AuthSecretKey.deserialize(secretKeyBytes);
+      // Skip first byte (type prefix) from serialized public key
+      return Buffer.from(wasmSecretKey.publicKey().serialize().slice(1)).toString('hex');
+    } catch (e) {
+      console.error('Error in getPublicKeyForCommitment', e);
+      throw new PublicError('Failed to get public key for commitment');
+    }
+  }
+
   async getAuthSecretKey(key: string) {
     const secretKey = await fetchAndDecryptOneWithLegacyFallBack<string>(accAuthSecretKeyStrgKey(key), this.vaultKey);
     return secretKey;
diff --git a/src/lib/miden/front/psm-manager.ts b/src/lib/miden/front/psm-manager.ts
index 3ef47b129..f77ecfa23 100644
--- a/src/lib/miden/front/psm-manager.ts
+++ b/src/lib/miden/front/psm-manager.ts
@@ -5,8 +5,7 @@ import { WalletType } from 'screens/onboarding/types';
 import { MULTISIG_SLOT_NAMES } from '../psm/account';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 /**
- * Get or create a MultisigService for the given account (lazy initialization).
- * Services are cached in memory and reused for subsequent calls.
+ * Create a MultisigService for the given PSM account.
  */
 export async function getOrCreateMultisigService(
   accountPublicKey: string,
@@ -50,8 +49,7 @@ export async function getOrCreateMultisigService(
 }
 
 /**
- * Check if an account is a PSM account and has completed at least one transaction.
- * PSM routing only applies after the first transaction.
+ * Check if an account is a PSM account.
  */
 export function isPsmAccount(accountPublicKey: string): boolean {
   const accounts = useWalletStore.getState().accounts;
diff --git a/src/lib/miden/psm/index.ts b/src/lib/miden/psm/index.ts
index 7639f84e0..d058b222f 100644
--- a/src/lib/miden/psm/index.ts
+++ b/src/lib/miden/psm/index.ts
@@ -1,6 +1,5 @@
-import { Account, WebClient } from '@miden-sdk/miden-sdk';
+import { Account } from '@miden-sdk/miden-sdk';
 import {
-  AccountInspector,
   Multisig,
   MultisigClient,
   MultisigConfig,
@@ -129,6 +128,7 @@ export class MultisigService {
     if (!account) {
       throw new Error('Account not found in MultisigService');
     }
+    // +2 accounts for the current nonce plus the proposal execution incrementing nonce
     const nonce = Number(account.nonce().asInt()) + 2;
 
     // Create metadata for unknown/custom proposal type
@@ -164,7 +164,7 @@ export class MultisigService {
           await new Promise(resolve => setTimeout(resolve, 3000)); // Wait before retrying
           await this.sync();
         } else {
-          console.error('Max sync retries reached. Please check your account state and try again.');
+          throw new Error('Max sync retries reached: local state is ahead of on-chain state');
         }
       } else {
         throw error; // Rethrow if it's a different error

From 08ab29e8e07ca3a19d7d2ef1f999c9692aabb8c6 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Thu, 12 Mar 2026 22:48:03 +0800
Subject: [PATCH 03/71] feat: use the new `createTransactionProposalRequest`
 method for creating and TransactionRequest object and proceeding normally

---
 package.json                           |  2 +-
 src/lib/miden-chain/constants.ts       |  2 +-
 src/lib/miden/activity/transactions.ts | 44 ++++++++++++++++++++------
 src/lib/miden/psm/index.ts             |  7 +++-
 yarn.lock                              | 15 ++++++---
 5 files changed, 52 insertions(+), 18 deletions(-)

diff --git a/package.json b/package.json
index 4e8826741..1d2cf1a44 100644
--- a/package.json
+++ b/package.json
@@ -83,7 +83,7 @@
     "@miden-sdk/miden-sdk": "^0.13.0",
     "@newhighsco/storybook-addon-svgr": "^2.0.7",
     "@noble/hashes": "^1.4.0",
-    "@openzeppelin/miden-multisig-client": "^0.13.0",
+    "@openzeppelin/miden-multisig-client": "^0.13.1",
     "@openzeppelin/psm-client": "^0.13.0",
     "@peculiar/webcrypto": "1.1.6",
     "@radix-ui/react-slot": "^1.2.3",
diff --git a/src/lib/miden-chain/constants.ts b/src/lib/miden-chain/constants.ts
index 850feab48..c5cd74e70 100644
--- a/src/lib/miden-chain/constants.ts
+++ b/src/lib/miden-chain/constants.ts
@@ -62,4 +62,4 @@ export const TOKEN_MAPPING = {
   [MidenTokens.Miden]: { faucetId: 'mtst1aqmat9m63ctdsgz6xcyzpuprpulwk9vg_qruqqypuyph' }
 };
 
-export const DEFAULT_PSM_ENDPOINT = 'https://psm-stg.openzeppelin.com';
+export const DEFAULT_PSM_ENDPOINT = 'http://localhost:3000';
diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index 40fe554f3..a9e0f1453 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -729,21 +729,45 @@ const generatePsmTransaction = async (
 
   // Get the proposal commitment for signing and execution
   const proposalCommitment = proposalResult.proposal.commitment;
-  console.log('Transaction proposal created with commitment:', proposalCommitment);
 
   // Sign and execute the proposal
-  await multisigService.signAndExecuteProposal(proposalCommitment);
+  const tr = await multisigService.signAndCreateTransactionRequest(proposalCommitment);
 
-  await multisigService.sync();
-  // Determine display message based on transaction type
-  const displayMessage =
-    transaction.type === 'send' ? 'Sent' : transaction.type === 'consume' ? 'Received' : 'Completed';
+  const options: MidenClientCreateOptions = {
+    signCallback: async (publicKey: Uint8Array, signingInputs: Uint8Array) => {
+      const keyString = Buffer.from(publicKey).toString('hex');
+      const signingInputsString = Buffer.from(signingInputs).toString('hex');
+      return await signCallback(keyString, signingInputsString);
+    }
+  };
 
-  // Update transaction as completed
-  await updateTransactionStatus(transaction.id, ITransactionStatus.Completed, {
-    displayMessage,
-    completedAt: Math.floor(Date.now() / 1000)
+  // Wrap WASM client operations in a lock to prevent concurrent access
+  const transactionResultBytes = await withWasmClientLock(async () => {
+    const midenClient = await getMidenClient(options);
+    return await midenClient.newTransaction(transaction.accountId, tr.serialize());
   });
+
+  const transactionResult = TransactionResult.deserialize(transactionResultBytes);
+
+  await withWasmClientLock(async () => {
+    const midenClient = await getMidenClient();
+    await midenClient.submitTransaction(transactionResultBytes, transaction.delegateTransaction);
+  });
+
+  switch (transaction.type) {
+    case 'send':
+      await completeSendTransaction(transaction as SendTransaction, transactionResult);
+      break;
+    case 'consume':
+      await completeConsumeTransaction(transaction.id, transactionResult);
+      break;
+    case 'execute':
+    default:
+      await completeCustomTransaction(transaction, transactionResult);
+      break;
+  }
+
+  await multisigService.sync();
 };
 
 export const cancelTransaction = async (transaction: Transaction, error: any) => {
diff --git a/src/lib/miden/psm/index.ts b/src/lib/miden/psm/index.ts
index d058b222f..677420803 100644
--- a/src/lib/miden/psm/index.ts
+++ b/src/lib/miden/psm/index.ts
@@ -1,4 +1,4 @@
-import { Account } from '@miden-sdk/miden-sdk';
+import { Account, TransactionRequest } from '@miden-sdk/miden-sdk';
 import {
   Multisig,
   MultisigClient,
@@ -148,6 +148,11 @@ export class MultisigService {
     await this.multisig.executeTransactionProposal(commitment);
   }
 
+  async signAndCreateTransactionRequest(commitment: string): Promise<TransactionRequest> {
+    await this.multisig.signTransactionProposal(commitment);
+    return await this.multisig.createTransactionProposalRequest(commitment);
+  }
+
   async sync(): Promise<void> {
     try {
       await this.multisig.syncAll();
diff --git a/yarn.lock b/yarn.lock
index 5aac77837..1028ff611 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2221,20 +2221,25 @@
     "@nodelib/fs.scandir" "2.1.5"
     fastq "^1.6.0"
 
-"@openzeppelin/miden-multisig-client@^0.13.0":
-  version "0.13.0"
-  resolved "https://registry.yarnpkg.com/@openzeppelin/miden-multisig-client/-/miden-multisig-client-0.13.0.tgz#e33ab86a774f976efa0a576dcd806bdac60e548d"
-  integrity sha512-b0wxXCM6iSWlKLKb0QzG15z4+UeqKGv4920Gvk6jn1ofeth1uy8Q8pTdDICe/L1UvwUsgqLhicEADUKkB+KOiw==
+"@openzeppelin/miden-multisig-client@^0.13.1":
+  version "0.13.1"
+  resolved "https://registry.yarnpkg.com/@openzeppelin/miden-multisig-client/-/miden-multisig-client-0.13.1.tgz#da78637e0fb1397a5ba264a4a849ec9bfb094708"
+  integrity sha512-+potgpQgl4VE5CsXwqPyDuEHM0UY6ZvSATY8LBn0+3ZW8t4udIdLmsr7DzKDoUly6GSQWy8zNveCss/Buj/T8w==
   dependencies:
     "@miden-sdk/miden-sdk" "^0.13.0"
     "@noble/hashes" "^2.0.1"
-    "@openzeppelin/psm-client" "^0.13.0"
+    "@openzeppelin/psm-client" "^0.13.1"
 
 "@openzeppelin/psm-client@^0.13.0":
   version "0.13.0"
   resolved "https://registry.yarnpkg.com/@openzeppelin/psm-client/-/psm-client-0.13.0.tgz#fe4df2282ddede6af451fdfe728e5733bf85f4c0"
   integrity sha512-pf/b5CpWfVDbYBSXCDxyuRgbgrKNCB8Y/Bw9U2vW3DteUmfGdsCeCX+PprwVbTvNo1thfja1NzbEfkAvO9XLIw==
 
+"@openzeppelin/psm-client@^0.13.1":
+  version "0.13.1"
+  resolved "https://registry.yarnpkg.com/@openzeppelin/psm-client/-/psm-client-0.13.1.tgz#c7131e3eb9286edb3e156fc6847e17140d0a63f6"
+  integrity sha512-uUVw7qI7MtW3SUemX0a2JActTjCXojRPtIYPF7OQC7eIu01H9fpY/yqo8DBgQvkUS1wOssPueVVqVBqZEy6PHA==
+
 "@peculiar/asn1-schema@^2.0.27", "@peculiar/asn1-schema@^2.3.13":
   version "2.6.0"
   resolved "https://registry.yarnpkg.com/@peculiar/asn1-schema/-/asn1-schema-2.6.0.tgz#0dca1601d5b0fed2a72fed7a5f1d0d7dbe3a6f82"

From 0009fb73175df0469d9dfc71a3d21ecddf0493f4 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Sat, 14 Mar 2026 00:11:54 +0530
Subject: [PATCH 04/71] chore: use deployed psm url

---
 src/lib/miden-chain/constants.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/miden-chain/constants.ts b/src/lib/miden-chain/constants.ts
index c5cd74e70..850feab48 100644
--- a/src/lib/miden-chain/constants.ts
+++ b/src/lib/miden-chain/constants.ts
@@ -62,4 +62,4 @@ export const TOKEN_MAPPING = {
   [MidenTokens.Miden]: { faucetId: 'mtst1aqmat9m63ctdsgz6xcyzpuprpulwk9vg_qruqqypuyph' }
 };
 
-export const DEFAULT_PSM_ENDPOINT = 'http://localhost:3000';
+export const DEFAULT_PSM_ENDPOINT = 'https://psm-stg.openzeppelin.com';

From 08346ab68b4bd84fccac8c0ba2a3a5dbeab7bbe4 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Mon, 16 Mar 2026 21:04:03 +0530
Subject: [PATCH 05/71] feat: add a option to choose recovery type during
 onboarding

---
 public/_locales/en/en.json                    |  7 ++
 src/app/pages/Welcome.tsx                     | 20 ++++-
 src/lib/miden/back/actions.ts                 |  4 +-
 src/lib/miden/back/main.ts                    |  2 +-
 src/lib/miden/back/vault.ts                   | 15 ++--
 src/lib/miden/front/client.ts                 |  4 +-
 src/lib/shared/types.ts                       |  1 +
 src/lib/store/index.ts                        |  3 +-
 src/lib/store/types.ts                        |  8 +-
 .../SelectRecoveryMethod.tsx                  | 73 +++++++++++++++++++
 src/screens/onboarding/navigator.tsx          | 10 ++-
 src/screens/onboarding/types.ts               |  8 ++
 12 files changed, 139 insertions(+), 16 deletions(-)
 create mode 100644 src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx

diff --git a/public/_locales/en/en.json b/public/_locales/en/en.json
index 86520a47d..61a3d9c93 100644
--- a/public/_locales/en/en.json
+++ b/public/_locales/en/en.json
@@ -410,6 +410,13 @@
   "chooseYourAccountType": "Choose Your Account Type",
   "chooseAccountTypeDescription": "Select how you want to interact with the blockchain -- on-chain or off-chain.",
   "canAddMultipleAccountsLater": "You can add and manage multiple account types later within the wallet.",
+  "chooseRecoveryMethod": "Set Up Account Recovery",
+  "chooseRecoveryMethodDescription": "Choose how you want to recover your account if you lose access.",
+  "guardianRecovery": "Guardian",
+  "guardianRecoveryDescription": "Recommended. Guardian-based recovery for your account.",
+  "fullyPrivateRecovery": "Fully Private",
+  "fullyPrivateRecoveryDescription": "Local only. No recovery — losing your device can permanently lose funds.",
+  "default": "Default",
   "transactionFile": "Transaction file",
   "verificationFailed": "Verification Failed",
   "transactionVerifiedSuccessfully": "The transaction has been successfully verified. You can now claim your tokens.",
diff --git a/src/app/pages/Welcome.tsx b/src/app/pages/Welcome.tsx
index a562f5de0..f21a1fcb8 100644
--- a/src/app/pages/Welcome.tsx
+++ b/src/app/pages/Welcome.tsx
@@ -13,7 +13,7 @@ import { useWalletStore } from 'lib/store';
 import { fetchStateFromBackend } from 'lib/store/hooks/useIntercomSync';
 import { navigate, useLocation } from 'lib/woozie';
 import { OnboardingFlow } from 'screens/onboarding/navigator';
-import { ImportType, OnboardingAction, OnboardingStep, OnboardingType } from 'screens/onboarding/types';
+import { ImportType, OnboardingAction, OnboardingStep, OnboardingType, WalletType } from 'screens/onboarding/types';
 
 /**
  * Check if hardware security is available for vault key protection.
@@ -71,6 +71,7 @@ const Welcome: FC = () => {
   const [onboardingType, setOnboardingType] = useState<OnboardingType | null>(null);
   const [importType, setImportType] = useState<ImportType | null>(null);
   const [password, setPassword] = useState<string | null>(null);
+  const [walletType, setWalletType] = useState<WalletType>(WalletType.Psm);
   const [importedWithFile, setImportedWithFile] = useState(false);
   const [isLoading, setIsLoading] = useState(false);
   const [useBiometric, setUseBiometric] = useState(true);
@@ -94,14 +95,14 @@ const Welcome: FC = () => {
       // For hardware-only wallets, pass undefined as password
       const actualPassword = password === '__HARDWARE_ONLY__' ? undefined : password;
       if (!importedWithFile) {
-        await registerWallet(actualPassword, seedPhraseFormatted, onboardingType === OnboardingType.Import);
+        await registerWallet(walletType, actualPassword, seedPhraseFormatted, onboardingType === OnboardingType.Import);
       } else {
         await importWalletFromClient(actualPassword, seedPhraseFormatted);
       }
     } else {
       throw new Error('Missing password or seed phrase');
     }
-  }, [password, seedPhrase, importedWithFile, registerWallet, onboardingType, importWalletFromClient]);
+  }, [password, seedPhrase, importedWithFile, registerWallet, onboardingType, importWalletFromClient, walletType]);
 
   const onAction = async (action: OnboardingAction) => {
     let eventCategory = AnalyticsEventCategory.ButtonPress;
@@ -180,6 +181,14 @@ const Welcome: FC = () => {
         setPassword(action.payload.password);
         eventCategory = AnalyticsEventCategory.FormSubmit;
         // Hardware protection is automatically set up in Vault.spawn() when available
+        if (onboardingType === OnboardingType.Create) {
+          navigate('/#select-recovery-method');
+        } else {
+          navigate('/#confirmation');
+        }
+        break;
+      case 'select-recovery-method':
+        setWalletType(action.payload);
         navigate('/#confirmation');
         break;
       case 'confirmation':
@@ -231,6 +240,8 @@ const Welcome: FC = () => {
               navigate('/#import-from-seed');
             }
           }
+        } else if (step === OnboardingStep.SelectRecoveryMethod) {
+          navigate('/#create-password');
         } else if (step === OnboardingStep.ImportFromFile || step === OnboardingStep.ImportFromSeed) {
           navigate('/#select-import-type');
         }
@@ -271,6 +282,9 @@ const Welcome: FC = () => {
       case '#create-password':
         setStep(OnboardingStep.CreatePassword);
         break;
+      case '#select-recovery-method':
+        setStep(OnboardingStep.SelectRecoveryMethod);
+        break;
       case '#confirmation':
         if (!password) {
           navigate('/');
diff --git a/src/lib/miden/back/actions.ts b/src/lib/miden/back/actions.ts
index 7e182ecd3..a21605136 100644
--- a/src/lib/miden/back/actions.ts
+++ b/src/lib/miden/back/actions.ts
@@ -73,13 +73,13 @@ export async function isDAppEnabled() {
   return bools.every(Boolean);
 }
 
-export function registerNewWallet(password?: string, mnemonic?: string, ownMnemonic?: boolean) {
+export function registerNewWallet(walletType: WalletType, password?: string, mnemonic?: string, ownMnemonic?: boolean) {
   return withInited(async () => {
     console.log('[Actions.registerNewWallet] Starting...');
     // Password may be undefined for hardware-only wallets (mobile/desktop with Secure Enclave)
     // Vault.spawn() will handle this by using hardware protection instead
     // spawn() returns the vault directly, avoiding a second biometric prompt from unlock()
-    const vault = await Vault.spawn(password ?? '', mnemonic, ownMnemonic);
+    const vault = await Vault.spawn(walletType, password ?? '', mnemonic, ownMnemonic);
     console.log('[Actions.registerNewWallet] Vault.spawn completed, initializing state...');
     const accounts = await vault.fetchAccounts();
     const settings = await vault.fetchSettings();
diff --git a/src/lib/miden/back/main.ts b/src/lib/miden/back/main.ts
index 4c5f798b7..998d4ab4b 100644
--- a/src/lib/miden/back/main.ts
+++ b/src/lib/miden/back/main.ts
@@ -102,7 +102,7 @@ async function processRequest(req: WalletRequest, port: Runtime.Port): Promise<W
         state
       };
     case WalletMessageType.NewWalletRequest:
-      await Actions.registerNewWallet(req.password, req.mnemonic, req.ownMnemonic);
+      await Actions.registerNewWallet(req.walletType, req.password, req.mnemonic, req.ownMnemonic);
       return { type: WalletMessageType.NewWalletResponse };
     case WalletMessageType.ImportFromClientRequest:
       await Actions.registerImportedWallet(req.password, req.mnemonic);
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index fd36b0ee7..6fda90fbc 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -185,7 +185,12 @@ export class Vault {
     return passKey;
   }
 
-  static async spawn(password: string, mnemonic?: string, ownMnemonic?: boolean): Promise<Vault> {
+  static async spawn(
+    walletType: WalletType,
+    password: string,
+    mnemonic?: string,
+    ownMnemonic?: boolean
+  ): Promise<Vault> {
     return withError('Failed to create wallet', async (): Promise<Vault> => {
       // Generate random vault key (256-bit)
       const vaultKeyBytes = Passworder.generateVaultKey();
@@ -233,7 +238,7 @@ export class Vault {
         insertKeyCallback
       };
       const hdAccIndex = 0;
-      const walletSeed = deriveClientSeed(WalletType.OnChain, mnemonic, 0);
+      const walletSeed = deriveClientSeed(walletType, mnemonic, 0);
 
       // Wrap WASM client operations in a lock to prevent concurrent access
       const accPublicKey = await withWasmClientLock(async () => {
@@ -243,12 +248,12 @@ export class Vault {
             return await midenClient.importPublicMidenWalletFromSeed(walletSeed);
           } catch (e) {
             console.error('Failed to import wallet from seed in spawn, creating new wallet instead', e);
-            return await midenClient.createMidenWallet(WalletType.OnChain, walletSeed);
+            return await midenClient.createMidenWallet(walletType, walletSeed);
           }
         } else {
           // Sync to chain tip BEFORE creating first account (no accounts = no tags = fast sync)
           await midenClient.syncState();
-          return await midenClient.createMidenWallet(WalletType.OnChain, walletSeed);
+          return await midenClient.createMidenWallet(walletType, walletSeed);
         }
       });
 
@@ -256,7 +261,7 @@ export class Vault {
         publicKey: accPublicKey,
         name: 'Miden Account 1',
         isPublic: true,
-        type: WalletType.OnChain,
+        type: walletType,
         hdIndex: hdAccIndex
       };
       const newAccounts = [initialAccount];
diff --git a/src/lib/miden/front/client.ts b/src/lib/miden/front/client.ts
index 3339a7f9e..6c1b0fb5c 100644
--- a/src/lib/miden/front/client.ts
+++ b/src/lib/miden/front/client.ts
@@ -96,8 +96,8 @@ export const [MidenContextProvider, useMidenContext] = constate(() => {
 
   // Wrap store actions in useCallback for stable references
   const registerWallet = useCallback(
-    async (password: string | undefined, mnemonic?: string, ownMnemonic?: boolean) => {
-      await storeRegisterWallet(password, mnemonic, ownMnemonic);
+    async (walletType: WalletType, password: string | undefined, mnemonic: string, ownMnemonic: boolean) => {
+      await storeRegisterWallet(walletType, password, mnemonic, ownMnemonic);
     },
     [storeRegisterWallet]
   );
diff --git a/src/lib/shared/types.ts b/src/lib/shared/types.ts
index 11fa530f8..f38996447 100644
--- a/src/lib/shared/types.ts
+++ b/src/lib/shared/types.ts
@@ -288,6 +288,7 @@ export interface NewWalletRequest extends WalletMessageBase {
   password?: string; // Optional for hardware-only wallets (mobile/desktop with Secure Enclave)
   mnemonic?: string;
   ownMnemonic?: boolean;
+  walletType: WalletType;
 }
 
 export interface NewWalletResponse extends WalletMessageBase {
diff --git a/src/lib/store/index.ts b/src/lib/store/index.ts
index 0e5155184..a9d2de601 100644
--- a/src/lib/store/index.ts
+++ b/src/lib/store/index.ts
@@ -122,9 +122,10 @@ export const useWalletStore = create<WalletStore>()(
     },
 
     // Auth actions
-    registerWallet: async (password, mnemonic, ownMnemonic) => {
+    registerWallet: async (walletType, password, mnemonic, ownMnemonic) => {
       const res = await request({
         type: WalletMessageType.NewWalletRequest,
+        walletType,
         password,
         mnemonic,
         ownMnemonic
diff --git a/src/lib/store/types.ts b/src/lib/store/types.ts
index def6bee5d..1b8d9454d 100644
--- a/src/lib/store/types.ts
+++ b/src/lib/store/types.ts
@@ -98,7 +98,12 @@ export interface WalletActions {
   syncFromBackend: (state: MidenState) => void;
 
   // Auth actions
-  registerWallet: (password: string | undefined, mnemonic?: string, ownMnemonic?: boolean) => Promise<void>;
+  registerWallet: (
+    walletType: WalletType,
+    password: string | undefined,
+    mnemonic: string,
+    ownMnemonic: boolean
+  ) => Promise<void>;
   importWalletFromClient: (password: string | undefined, mnemonic: string) => Promise<void>;
   unlock: (password?: string) => Promise<void>;
 
@@ -115,6 +120,7 @@ export interface WalletActions {
   signData: (publicKey: string, signingInputs: string) => Promise<string>;
   signTransaction: (publicKey: string, signingInputs: string) => Promise<Uint8Array>;
   getAuthSecretKey: (key: string) => Promise<string>;
+  getPublicKeyForCommitment: (publicKeyCommitment: string) => Promise<string>;
 
   // DApp actions
   getDAppPayload: (id: string) => Promise<any>;
diff --git a/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx b/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx
new file mode 100644
index 000000000..32cb5cc94
--- /dev/null
+++ b/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx
@@ -0,0 +1,73 @@
+import React, { useMemo } from 'react';
+
+import classNames from 'clsx';
+import { useTranslation } from 'react-i18next';
+
+import { ReactComponent as ArrowRightIcon } from 'app/icons/arrow-right.svg';
+
+import { WalletType } from '../types';
+
+export interface SelectRecoveryMethodScreenProps extends Omit<React.ButtonHTMLAttributes<HTMLDivElement>, 'onSubmit'> {
+  onSubmit?: (payload: WalletType) => void;
+}
+
+type RecoveryOption = {
+  id: WalletType;
+  title: string;
+  description: string;
+  isDefault?: boolean;
+  isLast?: boolean;
+};
+
+export const SelectRecoveryMethodScreen = ({ onSubmit, ...props }: SelectRecoveryMethodScreenProps) => {
+  const { t } = useTranslation();
+  const options: RecoveryOption[] = useMemo(
+    () => [
+      {
+        id: WalletType.Psm,
+        title: t('guardianRecovery'),
+        description: t('guardianRecoveryDescription'),
+        isDefault: true
+      },
+      {
+        id: WalletType.OffChain,
+        title: t('fullyPrivateRecovery'),
+        description: t('fullyPrivateRecoveryDescription'),
+        isLast: true
+      }
+    ],
+    [t]
+  );
+
+  return (
+    <div className="flex-1 flex flex-col items-center bg-transparent pt-6 h-full" {...props}>
+      <div className="flex flex-col items-center">
+        <h1 className="font-semibold text-2xl lh-title">{t('chooseRecoveryMethod')}</h1>
+        <p className="text-base text-center lh-title">{t('chooseRecoveryMethodDescription')}</p>
+      </div>
+      {options.map(option => (
+        <div
+          key={option.id}
+          className={classNames('flex flex-col border p-4 rounded-lg cursor-pointer', {
+            'mb-2': !option.isLast,
+            'mb-8': option.isLast
+          })}
+          onClick={() => onSubmit?.(option.id)}
+        >
+          <div className="flex flex-row justify-between items-center">
+            <div className="flex items-center gap-2">
+              <h2 className="font-medium text-base">{option.title}</h2>
+              {option.isDefault && (
+                <span className="bg-pure-black text-pure-white text-xs font-medium px-2 py-0.5 rounded-full">
+                  {t('default')}
+                </span>
+              )}
+            </div>
+            <ArrowRightIcon fill="currentColor" height={'20px'} width={'20px'} />
+          </div>
+          <p className="text-grey-600">{option.description}</p>
+        </div>
+      ))}
+    </div>
+  );
+};
diff --git a/src/screens/onboarding/navigator.tsx b/src/screens/onboarding/navigator.tsx
index ab2f86ca9..6c95410d1 100644
--- a/src/screens/onboarding/navigator.tsx
+++ b/src/screens/onboarding/navigator.tsx
@@ -15,6 +15,7 @@ import { ConfirmationScreen } from './common/Confirmation';
 import { CreatePasswordScreen } from './common/CreatePassword';
 import { WelcomeScreen } from './common/Welcome';
 import { BackUpSeedPhraseScreen } from './create-wallet-flow/BackUpSeedPhrase';
+import { SelectRecoveryMethodScreen } from './create-wallet-flow/SelectRecoveryMethod';
 import { SelectTransactionTypeScreen } from './create-wallet-flow/SelectTransactionType';
 import { VerifySeedPhraseScreen } from './create-wallet-flow/VerifySeedPhrase';
 import { ImportSeedPhraseScreen } from './import-wallet-flow/ImportSeedPhrase';
@@ -54,6 +55,8 @@ const Header: React.FC<{
     currentStep = 3;
   } else if (step === OnboardingStep.ImportFromSeed || step === OnboardingStep.ImportFromFile) {
     currentStep = 2;
+  } else if (step === OnboardingStep.SelectRecoveryMethod) {
+    currentStep = 4;
   } else if (step === OnboardingStep.Confirmation) {
     currentStep = 4;
   }
@@ -61,7 +64,7 @@ const Header: React.FC<{
   return (
     <div className="w-full flex items-center px-4 pt-8">
       <div className="flex-1 flex justify-center">
-        <ProgressIndicator currentStep={currentStep || 1} steps={3} className={currentStep ? '' : 'opacity-0'} />
+        <ProgressIndicator currentStep={currentStep || 1} steps={4} className={currentStep ? '' : 'opacity-0'} />
       </div>
     </div>
   );
@@ -141,6 +144,9 @@ export const OnboardingFlow: FC<OnboardingFlowProps> = ({
     const onCreatePasswordSubmit = (password: string) =>
       onForwardAction?.({ id: 'create-password-submit', payload: { password, enableBiometric: false } });
 
+    const onSelectRecoveryMethodSubmit = (walletType: WalletType) =>
+      onForwardAction?.({ id: 'select-recovery-method', payload: walletType });
+
     const onSelectTransactionTypeSubmit = () =>
       onForwardAction?.({ id: 'select-transaction-type', payload: 'private' });
 
@@ -178,6 +184,8 @@ export const OnboardingFlow: FC<OnboardingFlowProps> = ({
         return <ImportWalletFileScreen onSubmit={onImportFileSubmit} />;
       case OnboardingStep.CreatePassword:
         return <CreatePasswordScreen onSubmit={onCreatePasswordSubmit} />;
+      case OnboardingStep.SelectRecoveryMethod:
+        return <SelectRecoveryMethodScreen onSubmit={onSelectRecoveryMethodSubmit} />;
       case OnboardingStep.SelectTransactionType:
         return <SelectTransactionTypeScreen onSubmit={onSelectTransactionTypeSubmit} />;
       case OnboardingStep.Confirmation:
diff --git a/src/screens/onboarding/types.ts b/src/screens/onboarding/types.ts
index cf94367a0..fa66b5ce5 100644
--- a/src/screens/onboarding/types.ts
+++ b/src/screens/onboarding/types.ts
@@ -24,6 +24,7 @@ export enum OnboardingStep {
   CreatePassword = 'create-password',
   BiometricSetup = 'biometric-setup',
   SelectTransactionType = 'select-transaction-type',
+  SelectRecoveryMethod = 'select-recovery-method',
   Confirmation = 'confirmation'
 }
 export type OnboardingActionId =
@@ -37,6 +38,7 @@ export type OnboardingActionId =
   | 'create-password-submit'
   | 'biometric-setup-submit'
   | 'select-transaction-type'
+  | 'select-recovery-method'
   | 'confirmation'
   | 'import-from-file'
   | 'import-from-seed';
@@ -80,6 +82,11 @@ export type SelectTransactionTypeAction = {
   payload: string;
 };
 
+export type SelectRecoveryMethodAction = {
+  id: 'select-recovery-method';
+  payload: WalletType;
+};
+
 export type ConfirmationAction = {
   id: 'confirmation';
 };
@@ -116,6 +123,7 @@ export type OnboardingAction =
   | CreatePasswordSubmitAction
   | BiometricSetupSubmitAction
   | SelectTransactionTypeAction
+  | SelectRecoveryMethodAction
   | ConfirmationAction
   | ImportSeedPhraseSubmitAction
   | BackAction

From 71d821299fd723305f85edb8b5eb4945c456d40c Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Thu, 19 Mar 2026 13:00:17 +0530
Subject: [PATCH 06/71] chore: merge conflicts

---
 src/lib/miden/activity/transactions.ts |  4 +---
 yarn.lock                              | 30 +++++++++++++-------------
 2 files changed, 16 insertions(+), 18 deletions(-)

diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index a9e0f1453..7a5fad37e 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -30,7 +30,7 @@ import {
   TransactionOutput
 } from '../db/types';
 import { toNoteTypeString } from '../helpers';
-import { getBech32AddressFromAccountId } from '../sdk/helpers';
+import { accountIdStringToSdk, getBech32AddressFromAccountId } from '../sdk/helpers';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 import { MidenClientCreateOptions } from '../sdk/miden-client-interface';
 import { ConsumableNote, NoteTypeEnum, NoteType as NoteTypeString } from '../types';
@@ -600,8 +600,6 @@ export const generateTransaction = async (
   await updateTransactionStatus(transaction.id, ITransactionStatus.GeneratingTransaction, {
     processingStartedAt: Math.floor(Date.now() / 1000) // seconds
   });
-<<<<<<< HEAD
-=======
   console.log('Generating transaction', {
     txId: transaction.id,
     type: transaction.type,
diff --git a/yarn.lock b/yarn.lock
index 1028ff611..0a908ce1a 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -7090,13 +7090,13 @@ fraction.js@^5.3.4:
   resolved "https://registry.yarnpkg.com/fraction.js/-/fraction.js-5.3.4.tgz#8c0fcc6a9908262df4ed197427bdeef563e0699a"
   integrity sha512-1X1NTtiJphryn/uLQz3whtY6jK3fTqoE3ohKs0tT+Ujr1W59oopxmoEh7Lu5p6vBaPbgoM0bzveAW4Qi5RyWDQ==
 
-framer-motion@^12.9.2:
-  version "12.29.0"
-  resolved "https://registry.yarnpkg.com/framer-motion/-/framer-motion-12.29.0.tgz#f031407c6025f96e9425de3da039b73c368b4153"
-  integrity sha512-1gEFGXHYV2BD42ZPTFmSU9buehppU+bCuOnHU0AD18DKh9j4DuTx47MvqY5ax+NNWRtK32qIcJf1UxKo1WwjWg==
+framer-motion@^12.35.2:
+  version "12.38.0"
+  resolved "https://registry.yarnpkg.com/framer-motion/-/framer-motion-12.38.0.tgz#cf28e072a95942881ca4e33fd33be41192fd146b"
+  integrity sha512-rFYkY/pigbcswl1XQSb7q424kSTQ8q6eAC+YUsSKooHQYuLdzdHjrt6uxUC+PRAO++q5IS7+TamgIw1AphxR+g==
   dependencies:
-    motion-dom "^12.29.0"
-    motion-utils "^12.27.2"
+    motion-dom "^12.38.0"
+    motion-utils "^12.36.0"
     tslib "^2.4.0"
 
 front-matter@^4.0.2:
@@ -9497,17 +9497,17 @@ mkdirp@^1.0.3:
   resolved "https://registry.yarnpkg.com/mkdirp/-/mkdirp-1.0.4.tgz#3eb5ed62622756d79a5f0e2a221dfebad75c2f7e"
   integrity sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==
 
-motion-dom@^12.29.0:
-  version "12.29.0"
-  resolved "https://registry.yarnpkg.com/motion-dom/-/motion-dom-12.29.0.tgz#93ba293d15df5edc9f3fd43225a5b59c26997a5c"
-  integrity sha512-3eiz9bb32yvY8Q6XNM4AwkSOBPgU//EIKTZwsSWgA9uzbPBhZJeScCVcBuwwYVqhfamewpv7ZNmVKTGp5qnzkA==
+motion-dom@^12.38.0:
+  version "12.38.0"
+  resolved "https://registry.yarnpkg.com/motion-dom/-/motion-dom-12.38.0.tgz#9ef3253ea0fb28b6757588327073848d940e9aab"
+  integrity sha512-pdkHLD8QYRp8VfiNLb8xIBJis1byQ9gPT3Jnh2jqfFtAsWUA3dEepDlsWe/xMpO8McV+VdpKVcp+E+TGJEtOoA==
   dependencies:
-    motion-utils "^12.27.2"
+    motion-utils "^12.36.0"
 
-motion-utils@^12.27.2:
-  version "12.27.2"
-  resolved "https://registry.yarnpkg.com/motion-utils/-/motion-utils-12.27.2.tgz#cd3038236ae2dc3d643bdb272ed831fd6d8ab616"
-  integrity sha512-B55gcoL85Mcdt2IEStY5EEAsrMSVE2sI14xQ/uAdPL+mfQxhKKFaEag9JmfxedJOR4vZpBGoPeC/Gm13I/4g5Q==
+motion-utils@^12.36.0:
+  version "12.36.0"
+  resolved "https://registry.yarnpkg.com/motion-utils/-/motion-utils-12.36.0.tgz#cff2df2a28c3fe53a3de7e0103ba7f73ff7d77a7"
+  integrity sha512-eHWisygbiwVvf6PZ1vhaHCLamvkSbPIeAYxWUuL3a2PD/TROgE7FvfHWTIH4vMl798QLfMw15nRqIaRDXTlYRg==
 
 ms@2.0.0:
   version "2.0.0"

From 2b00a3e93049d28b632560615bd62d62ef8203fb Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Thu, 19 Mar 2026 14:33:04 +0530
Subject: [PATCH 07/71] feat: make onboarding screen for gaurdian aligned with
 the rest of the app

---
 public/_locales/en/en.json                    |  4 +-
 src/lib/miden/back/actions.ts                 |  8 +++
 src/lib/miden/back/main.ts                    |  1 +
 src/lib/miden/back/vault.ts                   |  4 ++
 src/lib/miden/sdk/miden-client-interface.ts   |  6 ++
 src/lib/settings/constants.ts                 |  2 +
 src/lib/store/index.ts                        |  1 +
 src/lib/store/types.ts                        |  1 -
 .../SelectRecoveryMethod.tsx                  | 64 +++++++++++--------
 src/screens/onboarding/types.ts               |  1 +
 10 files changed, 64 insertions(+), 28 deletions(-)

diff --git a/public/_locales/en/en.json b/public/_locales/en/en.json
index 61a3d9c93..bd5fadbc0 100644
--- a/public/_locales/en/en.json
+++ b/public/_locales/en/en.json
@@ -413,9 +413,9 @@
   "chooseRecoveryMethod": "Set Up Account Recovery",
   "chooseRecoveryMethodDescription": "Choose how you want to recover your account if you lose access.",
   "guardianRecovery": "Guardian",
-  "guardianRecoveryDescription": "Recommended. Guardian-based recovery for your account.",
+  "guardianRecoveryDescription": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state.",
   "fullyPrivateRecovery": "Fully Private",
-  "fullyPrivateRecoveryDescription": "Local only. No recovery — losing your device can permanently lose funds.",
+  "fullyPrivateRecoveryDescription": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds.",
   "default": "Default",
   "transactionFile": "Transaction file",
   "verificationFailed": "Verification Failed",
diff --git a/src/lib/miden/back/actions.ts b/src/lib/miden/back/actions.ts
index a21605136..af9a8c713 100644
--- a/src/lib/miden/back/actions.ts
+++ b/src/lib/miden/back/actions.ts
@@ -74,6 +74,14 @@ export async function isDAppEnabled() {
 }
 
 export function registerNewWallet(walletType: WalletType, password?: string, mnemonic?: string, ownMnemonic?: boolean) {
+  console.log(
+    '[Actions.registerNewWallet] Called with walletType:',
+    walletType,
+    'mnemonic provided:',
+    Boolean(mnemonic),
+    'ownMnemonic flag:',
+    ownMnemonic
+  );
   return withInited(async () => {
     console.log('[Actions.registerNewWallet] Starting...');
     // Password may be undefined for hardware-only wallets (mobile/desktop with Secure Enclave)
diff --git a/src/lib/miden/back/main.ts b/src/lib/miden/back/main.ts
index 998d4ab4b..7b1db767e 100644
--- a/src/lib/miden/back/main.ts
+++ b/src/lib/miden/back/main.ts
@@ -102,6 +102,7 @@ async function processRequest(req: WalletRequest, port: Runtime.Port): Promise<W
         state
       };
     case WalletMessageType.NewWalletRequest:
+      console.log('[Background] NewWalletRequest received with walletType:', req.walletType);
       await Actions.registerNewWallet(req.walletType, req.password, req.mnemonic, req.ownMnemonic);
       return { type: WalletMessageType.NewWalletResponse };
     case WalletMessageType.ImportFromClientRequest:
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index 6fda90fbc..c8c9eff81 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -191,6 +191,7 @@ export class Vault {
     mnemonic?: string,
     ownMnemonic?: boolean
   ): Promise<Vault> {
+    console.log('Spawning new vault with wallet type', walletType);
     return withError('Failed to create wallet', async (): Promise<Vault> => {
       // Generate random vault key (256-bit)
       const vaultKeyBytes = Passworder.generateVaultKey();
@@ -633,6 +634,8 @@ function getMainDerivationPath(walletType: WalletType, accIndex: number) {
     walletTypeIndex = 0;
   } else if (walletType === WalletType.OffChain) {
     walletTypeIndex = 1;
+  } else if (walletType === WalletType.Psm) {
+    walletTypeIndex = 2;
   } else {
     throw new Error('Invalid wallet type');
   }
@@ -665,6 +668,7 @@ async function withError<T>(errMessage: string, factory: (doThrow: () => void) =
       throw new Error('<stub>');
     });
   } catch (err: any) {
+    console.log('Error in vault operation', err);
     throw err instanceof PublicError ? err : new PublicError(errMessage);
   }
 }
diff --git a/src/lib/miden/sdk/miden-client-interface.ts b/src/lib/miden/sdk/miden-client-interface.ts
index 48e25f423..71cbf8d3b 100644
--- a/src/lib/miden/sdk/miden-client-interface.ts
+++ b/src/lib/miden/sdk/miden-client-interface.ts
@@ -28,6 +28,7 @@ import { WalletType } from 'screens/onboarding/types';
 
 import { ConsumeTransaction, SendTransaction } from '../db/types';
 import { toNoteType } from '../helpers';
+import { createPsmAccount } from '../psm/account';
 import { NoteExportType } from './constants';
 import { accountIdStringToSdk, getBech32AddressFromAccountId } from './helpers';
 
@@ -108,6 +109,11 @@ export class MidenClientInterface {
   }
 
   async createMidenWallet(walletType: WalletType, seed?: Uint8Array): Promise<string> {
+    if (walletType === WalletType.Psm) {
+      const account = await createPsmAccount(this.webClient, seed);
+      return getBech32AddressFromAccountId(account.id());
+    }
+
     // Create a new wallet
     const accountStorageMode =
       walletType === WalletType.OnChain ? AccountStorageMode.public() : AccountStorageMode.private();
diff --git a/src/lib/settings/constants.ts b/src/lib/settings/constants.ts
index 47a2dd9fb..a289693f0 100644
--- a/src/lib/settings/constants.ts
+++ b/src/lib/settings/constants.ts
@@ -12,3 +12,5 @@ export const DEFAULT_HAPTIC_FEEDBACK = true;
 
 export const THEME_STORAGE_KEY = 'theme_setting';
 export const DEFAULT_THEME: 'light' | 'dark' = 'light';
+
+export const PSM_URL_STORAGE_KEY = 'psm_url_setting';
diff --git a/src/lib/store/index.ts b/src/lib/store/index.ts
index a9d2de601..1e4e05fb6 100644
--- a/src/lib/store/index.ts
+++ b/src/lib/store/index.ts
@@ -123,6 +123,7 @@ export const useWalletStore = create<WalletStore>()(
 
     // Auth actions
     registerWallet: async (walletType, password, mnemonic, ownMnemonic) => {
+      console.log('[WalletStore] registerWallet called with walletType:', walletType);
       const res = await request({
         type: WalletMessageType.NewWalletRequest,
         walletType,
diff --git a/src/lib/store/types.ts b/src/lib/store/types.ts
index 1b8d9454d..1ad471191 100644
--- a/src/lib/store/types.ts
+++ b/src/lib/store/types.ts
@@ -120,7 +120,6 @@ export interface WalletActions {
   signData: (publicKey: string, signingInputs: string) => Promise<string>;
   signTransaction: (publicKey: string, signingInputs: string) => Promise<Uint8Array>;
   getAuthSecretKey: (key: string) => Promise<string>;
-  getPublicKeyForCommitment: (publicKeyCommitment: string) => Promise<string>;
 
   // DApp actions
   getDAppPayload: (id: string) => Promise<any>;
diff --git a/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx b/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx
index 32cb5cc94..0d667ce4a 100644
--- a/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx
+++ b/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx
@@ -3,7 +3,8 @@ import React, { useMemo } from 'react';
 import classNames from 'clsx';
 import { useTranslation } from 'react-i18next';
 
-import { ReactComponent as ArrowRightIcon } from 'app/icons/arrow-right.svg';
+import { Button } from 'components/Button';
+import { Badge } from 'lib/ui/badge';
 
 import { WalletType } from '../types';
 
@@ -38,36 +39,49 @@ export const SelectRecoveryMethodScreen = ({ onSubmit, ...props }: SelectRecover
     ],
     [t]
   );
+  const [selected, setSelected] = React.useState<WalletType>(options.find(o => o.isDefault)?.id || options[0].id);
+
+  const handleContinue = () => {
+    onSubmit?.(selected);
+  };
 
   return (
-    <div className="flex-1 flex flex-col items-center bg-transparent pt-6 h-full" {...props}>
-      <div className="flex flex-col items-center">
+    <div
+      className="flex-1 flex flex-col items-center bg-transparent pt-6 h-full px-4 text-heading-gray gap-6"
+      {...props}
+    >
+      <div className="flex flex-col items-center gap-2">
         <h1 className="font-semibold text-2xl lh-title">{t('chooseRecoveryMethod')}</h1>
-        <p className="text-base text-center lh-title">{t('chooseRecoveryMethodDescription')}</p>
+        <p className="text-xs text-center lh-title px-4">{t('chooseRecoveryMethodDescription')}</p>
       </div>
-      {options.map(option => (
-        <div
-          key={option.id}
-          className={classNames('flex flex-col border p-4 rounded-lg cursor-pointer', {
-            'mb-2': !option.isLast,
-            'mb-8': option.isLast
-          })}
-          onClick={() => onSubmit?.(option.id)}
-        >
-          <div className="flex flex-row justify-between items-center">
-            <div className="flex items-center gap-2">
-              <h2 className="font-medium text-base">{option.title}</h2>
-              {option.isDefault && (
-                <span className="bg-pure-black text-pure-white text-xs font-medium px-2 py-0.5 rounded-full">
-                  {t('default')}
-                </span>
-              )}
+      <div className="flex flex-col">
+        {options.map(option => (
+          <div
+            key={option.id}
+            className={classNames('flex flex-col p-4 rounded-lg cursor-pointer bg-white', {
+              'mb-2': !option.isLast,
+              'mb-8': option.isLast,
+              'opacity-50': selected !== option.id
+            })}
+            onClick={() => setSelected(option.id)}
+          >
+            <div className="flex flex-row justify-between items-center">
+              <div className="flex items-center gap-2">
+                <h2 className="font-medium text-base">{option.title}</h2>
+                {option.isDefault && (
+                  <Badge variant={'default'} className="bg-primary-500 text-white">
+                    {t('default')}
+                  </Badge>
+                )}
+              </div>
             </div>
-            <ArrowRightIcon fill="currentColor" height={'20px'} width={'20px'} />
+            <p className="text-grey-600">{option.description}</p>
           </div>
-          <p className="text-grey-600">{option.description}</p>
-        </div>
-      ))}
+        ))}
+      </div>
+      <div className="flex flex-col gap-2 self-center w-full mt-auto">
+        <Button title={t('continue')} onClick={handleContinue} className="text-base" />
+      </div>
     </div>
   );
 };
diff --git a/src/screens/onboarding/types.ts b/src/screens/onboarding/types.ts
index fa66b5ce5..6c37dad5e 100644
--- a/src/screens/onboarding/types.ts
+++ b/src/screens/onboarding/types.ts
@@ -5,6 +5,7 @@ export enum OnboardingType {
 
 export enum WalletType {
   OffChain = 'off-chain',
+  Psm = 'psm',
   OnChain = 'on-chain'
 }
 

From c015b4492505c6edbb8609602746676d3d8798c7 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Thu, 19 Mar 2026 14:34:19 +0530
Subject: [PATCH 08/71] chore: changelog

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e92df717a..251f0fbb4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@
 * [FIX][all] Removed stale "Download Generated Files" button and output notes storage. The `useExportNotes` hook, `registerOutputNote`, and related storage key were unused dead code. Simplifies the transaction completion screen and its auto-close logic. (#160)
 * [FIX][all] Removed the "Upload File" button and drag-and-drop note import from the Receive page. The freed space is now used by the notes list, making it taller. (#161)
 * [FEATURE][all] Complete UI revamp across the wallet.
+* [FEATURE][all] Integrate gaurdian for private state management for the wallet.
 
 ---
 

From 405bfd032537a0ee54a7462462c9f2382b31e693 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Thu, 19 Mar 2026 09:06:31 +0000
Subject: [PATCH 09/71] chore: update translation files

---
 public/_locales/de/messages.json    | 28 ++++++++++++++++++++++++++++
 public/_locales/en/messages.json    | 28 ++++++++++++++++++++++++++++
 public/_locales/en_GB/messages.json | 28 ++++++++++++++++++++++++++++
 public/_locales/es/messages.json    | 28 ++++++++++++++++++++++++++++
 public/_locales/fr/messages.json    | 28 ++++++++++++++++++++++++++++
 public/_locales/ja/messages.json    | 28 ++++++++++++++++++++++++++++
 public/_locales/ko/messages.json    | 28 ++++++++++++++++++++++++++++
 public/_locales/pl/messages.json    | 28 ++++++++++++++++++++++++++++
 public/_locales/pt/messages.json    | 28 ++++++++++++++++++++++++++++
 public/_locales/ru/messages.json    | 28 ++++++++++++++++++++++++++++
 public/_locales/tr/messages.json    | 28 ++++++++++++++++++++++++++++
 public/_locales/uk/messages.json    | 28 ++++++++++++++++++++++++++++
 public/_locales/zh_CN/messages.json | 28 ++++++++++++++++++++++++++++
 public/_locales/zh_TW/messages.json | 28 ++++++++++++++++++++++++++++
 14 files changed, 392 insertions(+)

diff --git a/public/_locales/de/messages.json b/public/_locales/de/messages.json
index a1f3a6b92..245af893e 100644
--- a/public/_locales/de/messages.json
+++ b/public/_locales/de/messages.json
@@ -1779,6 +1779,34 @@
     "message": "Sie können später im Wallet mehrere Kontotypen hinzufügen und verwalten.",
     "englishSource": "You can add and manage multiple account types later within the wallet."
   },
+  "chooseRecoveryMethod": {
+    "message": "Richten Sie die Kontowiederherstellung ein",
+    "englishSource": "Set Up Account Recovery"
+  },
+  "chooseRecoveryMethodDescription": {
+    "message": "Wählen Sie aus, wie Sie Ihr Konto wiederherstellen möchten, wenn Sie den Zugriff verlieren.",
+    "englishSource": "Choose how you want to recover your account if you lose access."
+  },
+  "guardianRecovery": {
+    "message": "Wächter",
+    "englishSource": "Guardian"
+  },
+  "guardianRecoveryDescription": {
+    "message": "Empfohlen. Wächterbasierte Wiederherstellung für Ihr Konto, aber der Wächterbetreiber kann Ihren Status sehen.",
+    "englishSource": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state."
+  },
+  "fullyPrivateRecovery": {
+    "message": "Völlig privat",
+    "englishSource": "Fully Private"
+  },
+  "fullyPrivateRecoveryDescription": {
+    "message": "Nur lokal, niemand außer Ihnen sieht Ihren Status, aber keine Wiederherstellung. Der Verlust Ihres Geräts führt zum dauerhaften Verlust Ihres Geldes.",
+    "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
+  },
+  "default": {
+    "message": "Standard",
+    "englishSource": "Default"
+  },
   "transactionFile": {
     "message": "Transaktionsdatei",
     "englishSource": "Transaction file"
diff --git a/public/_locales/en/messages.json b/public/_locales/en/messages.json
index 284d8c44b..ba2324ca5 100644
--- a/public/_locales/en/messages.json
+++ b/public/_locales/en/messages.json
@@ -1743,6 +1743,34 @@
     "message": "You can add and manage multiple account types later within the wallet.",
     "englishSource": "You can add and manage multiple account types later within the wallet."
   },
+  "chooseRecoveryMethod": {
+    "message": "Set Up Account Recovery",
+    "englishSource": "Set Up Account Recovery"
+  },
+  "chooseRecoveryMethodDescription": {
+    "message": "Choose how you want to recover your account if you lose access.",
+    "englishSource": "Choose how you want to recover your account if you lose access."
+  },
+  "guardianRecovery": {
+    "message": "Guardian",
+    "englishSource": "Guardian"
+  },
+  "guardianRecoveryDescription": {
+    "message": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state.",
+    "englishSource": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state."
+  },
+  "fullyPrivateRecovery": {
+    "message": "Fully Private",
+    "englishSource": "Fully Private"
+  },
+  "fullyPrivateRecoveryDescription": {
+    "message": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds.",
+    "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
+  },
+  "default": {
+    "message": "Default",
+    "englishSource": "Default"
+  },
   "transactionFile": {
     "message": "Transaction file",
     "englishSource": "Transaction file"
diff --git a/public/_locales/en_GB/messages.json b/public/_locales/en_GB/messages.json
index 050ae19fd..792610bd5 100644
--- a/public/_locales/en_GB/messages.json
+++ b/public/_locales/en_GB/messages.json
@@ -1807,6 +1807,34 @@
     "message": "You can add and manage multiple account types later within the wallet.",
     "englishSource": "You can add and manage multiple account types later within the wallet."
   },
+  "chooseRecoveryMethod": {
+    "message": "Set Up Account Recovery",
+    "englishSource": "Set Up Account Recovery"
+  },
+  "chooseRecoveryMethodDescription": {
+    "message": "Choose how you want to recover your account if you lose access.",
+    "englishSource": "Choose how you want to recover your account if you lose access."
+  },
+  "guardianRecovery": {
+    "message": "Guardian",
+    "englishSource": "Guardian"
+  },
+  "guardianRecoveryDescription": {
+    "message": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state.",
+    "englishSource": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state."
+  },
+  "fullyPrivateRecovery": {
+    "message": "Fully Private",
+    "englishSource": "Fully Private"
+  },
+  "fullyPrivateRecoveryDescription": {
+    "message": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds.",
+    "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
+  },
+  "default": {
+    "message": "Default",
+    "englishSource": "Default"
+  },
   "transactionFile": {
     "message": "Transaction file",
     "englishSource": "Transaction file"
diff --git a/public/_locales/es/messages.json b/public/_locales/es/messages.json
index dbec36472..0762a10ad 100644
--- a/public/_locales/es/messages.json
+++ b/public/_locales/es/messages.json
@@ -1716,6 +1716,34 @@
     "message": "Puede agregar y administrar varios tipos de cuentas más adelante dentro de la billetera.",
     "englishSource": "You can add and manage multiple account types later within the wallet."
   },
+  "chooseRecoveryMethod": {
+    "message": "Configurar la recuperación de la cuenta",
+    "englishSource": "Set Up Account Recovery"
+  },
+  "chooseRecoveryMethodDescription": {
+    "message": "Elija cómo desea recuperar su cuenta si pierde el acceso.",
+    "englishSource": "Choose how you want to recover your account if you lose access."
+  },
+  "guardianRecovery": {
+    "message": "Guardián",
+    "englishSource": "Guardian"
+  },
+  "guardianRecoveryDescription": {
+    "message": "Recomendado. Recuperación basada en Guardian para su cuenta, pero el operador Gaurdian puede ver su estado.",
+    "englishSource": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state."
+  },
+  "fullyPrivateRecovery": {
+    "message": "Totalmente privado",
+    "englishSource": "Fully Private"
+  },
+  "fullyPrivateRecoveryDescription": {
+    "message": "Solo local, nadie ve su estado excepto usted, pero no hay recuperación; perder su dispositivo resultará en la pérdida permanente de sus fondos.",
+    "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
+  },
+  "default": {
+    "message": "Por defecto",
+    "englishSource": "Default"
+  },
   "transactionFile": {
     "message": "archivo de transacción",
     "englishSource": "Transaction file"
diff --git a/public/_locales/fr/messages.json b/public/_locales/fr/messages.json
index 22f231f66..4a817a5cd 100644
--- a/public/_locales/fr/messages.json
+++ b/public/_locales/fr/messages.json
@@ -1778,6 +1778,34 @@
     "message": "Vous pouvez ajouter et gérer plusieurs types de comptes ultérieurement dans le portefeuille.",
     "englishSource": "You can add and manage multiple account types later within the wallet."
   },
+  "chooseRecoveryMethod": {
+    "message": "Configurer la récupération de compte",
+    "englishSource": "Set Up Account Recovery"
+  },
+  "chooseRecoveryMethodDescription": {
+    "message": "Choisissez comment vous souhaitez récupérer votre compte si vous perdez l'accès.",
+    "englishSource": "Choose how you want to recover your account if you lose access."
+  },
+  "guardianRecovery": {
+    "message": "Tuteur",
+    "englishSource": "Guardian"
+  },
+  "guardianRecoveryDescription": {
+    "message": "Recommandé. Récupération basée sur le tuteur pour votre compte, mais l'opérateur gardien peut voir votre état.",
+    "englishSource": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state."
+  },
+  "fullyPrivateRecovery": {
+    "message": "Entièrement privé",
+    "englishSource": "Fully Private"
+  },
+  "fullyPrivateRecoveryDescription": {
+    "message": "Local uniquement, personne ne voit votre état sauf vous mais pas de récupération, la perte de votre appareil entraînera une perte permanente de vos fonds.",
+    "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
+  },
+  "default": {
+    "message": "Défaut",
+    "englishSource": "Default"
+  },
   "transactionFile": {
     "message": "Fichier de transactions",
     "englishSource": "Transaction file"
diff --git a/public/_locales/ja/messages.json b/public/_locales/ja/messages.json
index 61086cda5..e3c8c7afe 100644
--- a/public/_locales/ja/messages.json
+++ b/public/_locales/ja/messages.json
@@ -1779,6 +1779,34 @@
     "message": "後からウォレット内で複数のアカウント タイプを追加および管理できます。",
     "englishSource": "You can add and manage multiple account types later within the wallet."
   },
+  "chooseRecoveryMethod": {
+    "message": "アカウント回復のセットアップ",
+    "englishSource": "Set Up Account Recovery"
+  },
+  "chooseRecoveryMethodDescription": {
+    "message": "アクセスできなくなった場合にアカウントを回復する方法を選択します。",
+    "englishSource": "Choose how you want to recover your account if you lose access."
+  },
+  "guardianRecovery": {
+    "message": "ガーディアン",
+    "englishSource": "Guardian"
+  },
+  "guardianRecoveryDescription": {
+    "message": "推奨。アカウントは Guardian ベースで回復されますが、Guurdian オペレーターはお客様の状態を確認できます。",
+    "englishSource": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state."
+  },
+  "fullyPrivateRecovery": {
+    "message": "完全プライベート",
+    "englishSource": "Fully Private"
+  },
+  "fullyPrivateRecoveryDescription": {
+    "message": "ローカルのみ、あなた以外の誰もあなたの状態を見ることはできませんが、回復はできません。デバイスを失うと資金が永久に失われます。",
+    "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
+  },
+  "default": {
+    "message": "デフォルト",
+    "englishSource": "Default"
+  },
   "transactionFile": {
     "message": "トランザクションファイル",
     "englishSource": "Transaction file"
diff --git a/public/_locales/ko/messages.json b/public/_locales/ko/messages.json
index 8e9335dd0..7742924ad 100644
--- a/public/_locales/ko/messages.json
+++ b/public/_locales/ko/messages.json
@@ -1779,6 +1779,34 @@
     "message": "나중에 지갑 내에서 여러 계정 유형을 추가하고 관리할 수 있습니다.",
     "englishSource": "You can add and manage multiple account types later within the wallet."
   },
+  "chooseRecoveryMethod": {
+    "message": "계정 복구 설정",
+    "englishSource": "Set Up Account Recovery"
+  },
+  "chooseRecoveryMethodDescription": {
+    "message": "액세스 권한을 상실한 경우 계정을 복구할 방법을 선택하세요.",
+    "englishSource": "Choose how you want to recover your account if you lose access."
+  },
+  "guardianRecovery": {
+    "message": "보호자",
+    "englishSource": "Guardian"
+  },
+  "guardianRecoveryDescription": {
+    "message": "추천합니다. 귀하의 계정에 대한 보호자 기반 복구가 가능하지만 보호자 운영자는 귀하의 상태를 볼 수 있습니다.",
+    "englishSource": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state."
+  },
+  "fullyPrivateRecovery": {
+    "message": "완전 비공개",
+    "englishSource": "Fully Private"
+  },
+  "fullyPrivateRecoveryDescription": {
+    "message": "로컬에서만 가능하며 귀하 외에는 누구도 귀하의 상태를 볼 수 없지만 복구할 수는 없습니다. 장치를 분실하면 자금이 영구적으로 손실됩니다.",
+    "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
+  },
+  "default": {
+    "message": "기본",
+    "englishSource": "Default"
+  },
   "transactionFile": {
     "message": "거래 파일",
     "englishSource": "Transaction file"
diff --git a/public/_locales/pl/messages.json b/public/_locales/pl/messages.json
index 398de2bbf..2766db6ae 100644
--- a/public/_locales/pl/messages.json
+++ b/public/_locales/pl/messages.json
@@ -1716,6 +1716,34 @@
     "message": "Możesz później dodać wiele typów kont i zarządzać nimi w portfelu.",
     "englishSource": "You can add and manage multiple account types later within the wallet."
   },
+  "chooseRecoveryMethod": {
+    "message": "Skonfiguruj odzyskiwanie konta",
+    "englishSource": "Set Up Account Recovery"
+  },
+  "chooseRecoveryMethodDescription": {
+    "message": "Wybierz sposób odzyskania konta w przypadku utraty dostępu.",
+    "englishSource": "Choose how you want to recover your account if you lose access."
+  },
+  "guardianRecovery": {
+    "message": "Opiekun",
+    "englishSource": "Guardian"
+  },
+  "guardianRecoveryDescription": {
+    "message": "Zalecony. Odzyskiwanie konta na podstawie opiekuna, ale operator strażnika może zobaczyć Twój stan.",
+    "englishSource": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state."
+  },
+  "fullyPrivateRecovery": {
+    "message": "Całkowicie prywatny",
+    "englishSource": "Fully Private"
+  },
+  "fullyPrivateRecoveryDescription": {
+    "message": "Tylko lokalnie, nikt poza Tobą nie widzi Twojego stanu, ale nie ma możliwości odzyskania urządzenia. Utrata urządzenia spowoduje trwałą utratę środków.",
+    "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
+  },
+  "default": {
+    "message": "Domyślny",
+    "englishSource": "Default"
+  },
   "transactionFile": {
     "message": "Plik transakcyjny",
     "englishSource": "Transaction file"
diff --git a/public/_locales/pt/messages.json b/public/_locales/pt/messages.json
index 66b7ea903..3fbd65334 100644
--- a/public/_locales/pt/messages.json
+++ b/public/_locales/pt/messages.json
@@ -1777,6 +1777,34 @@
     "message": "Você pode adicionar e gerenciar vários tipos de contas posteriormente na carteira.",
     "englishSource": "You can add and manage multiple account types later within the wallet."
   },
+  "chooseRecoveryMethod": {
+    "message": "Configurar recuperação de conta",
+    "englishSource": "Set Up Account Recovery"
+  },
+  "chooseRecoveryMethodDescription": {
+    "message": "Escolha como deseja recuperar sua conta caso perca o acesso.",
+    "englishSource": "Choose how you want to recover your account if you lose access."
+  },
+  "guardianRecovery": {
+    "message": "Guardião",
+    "englishSource": "Guardian"
+  },
+  "guardianRecoveryDescription": {
+    "message": "Recomendado. Recuperação baseada no guardião para sua conta, mas o operador gaurdiano pode ver seu estado.",
+    "englishSource": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state."
+  },
+  "fullyPrivateRecovery": {
+    "message": "Totalmente privado",
+    "englishSource": "Fully Private"
+  },
+  "fullyPrivateRecoveryDescription": {
+    "message": "Somente local, ninguém vê seu estado, exceto você, mas não há recuperação. A perda do seu dispositivo resultará na perda permanente de seus fundos.",
+    "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
+  },
+  "default": {
+    "message": "Padrão",
+    "englishSource": "Default"
+  },
   "transactionFile": {
     "message": "Arquivo de transação",
     "englishSource": "Transaction file"
diff --git a/public/_locales/ru/messages.json b/public/_locales/ru/messages.json
index 9181f65af..7c827c3f2 100644
--- a/public/_locales/ru/messages.json
+++ b/public/_locales/ru/messages.json
@@ -1780,6 +1780,34 @@
     "message": "Позже вы сможете добавлять и управлять несколькими типами учетных записей в кошельке.",
     "englishSource": "You can add and manage multiple account types later within the wallet."
   },
+  "chooseRecoveryMethod": {
+    "message": "Настройка восстановления учетной записи",
+    "englishSource": "Set Up Account Recovery"
+  },
+  "chooseRecoveryMethodDescription": {
+    "message": "Выберите, как вы хотите восстановить свою учетную запись, если вы потеряете доступ.",
+    "englishSource": "Choose how you want to recover your account if you lose access."
+  },
+  "guardianRecovery": {
+    "message": "Хранитель",
+    "englishSource": "Guardian"
+  },
+  "guardianRecoveryDescription": {
+    "message": "Рекомендуется. Восстановление вашей учетной записи на основе Guardian, но оператор Guardian может видеть ваше состояние.",
+    "englishSource": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state."
+  },
+  "fullyPrivateRecovery": {
+    "message": "Полностью приватный",
+    "englishSource": "Fully Private"
+  },
+  "fullyPrivateRecoveryDescription": {
+    "message": "Только локально, никто, кроме вас, не видит ваше состояние, но восстановления нет, потеря устройства приведет к безвозвратной потере ваших средств.",
+    "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
+  },
+  "default": {
+    "message": "По умолчанию",
+    "englishSource": "Default"
+  },
   "transactionFile": {
     "message": "Файл транзакции",
     "englishSource": "Transaction file"
diff --git a/public/_locales/tr/messages.json b/public/_locales/tr/messages.json
index 34ec8776f..fb2a71940 100644
--- a/public/_locales/tr/messages.json
+++ b/public/_locales/tr/messages.json
@@ -1779,6 +1779,34 @@
     "message": "Daha sonra cüzdanın içine birden fazla hesap türü ekleyebilir ve yönetebilirsiniz.",
     "englishSource": "You can add and manage multiple account types later within the wallet."
   },
+  "chooseRecoveryMethod": {
+    "message": "Hesap Kurtarmayı Ayarlayın",
+    "englishSource": "Set Up Account Recovery"
+  },
+  "chooseRecoveryMethodDescription": {
+    "message": "Erişiminizi kaybederseniz hesabınızı nasıl kurtarmak istediğinizi seçin.",
+    "englishSource": "Choose how you want to recover your account if you lose access."
+  },
+  "guardianRecovery": {
+    "message": "Gardiyan",
+    "englishSource": "Guardian"
+  },
+  "guardianRecoveryDescription": {
+    "message": "Tavsiye edilen. Hesabınız için koruyucu tabanlı kurtarma ancak gaurdian operatörü durumunuzu görebilir.",
+    "englishSource": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state."
+  },
+  "fullyPrivateRecovery": {
+    "message": "Tamamen Özel",
+    "englishSource": "Fully Private"
+  },
+  "fullyPrivateRecoveryDescription": {
+    "message": "Yalnızca yerel, durumunuzu sizden başka kimse göremez ancak iyileşme olmaz, cihazınızı kaybetmek, paranızın kalıcı olarak kaybolmasına neden olur.",
+    "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
+  },
+  "default": {
+    "message": "Varsayılan",
+    "englishSource": "Default"
+  },
   "transactionFile": {
     "message": "İşlem dosyası",
     "englishSource": "Transaction file"
diff --git a/public/_locales/uk/messages.json b/public/_locales/uk/messages.json
index 54363d53e..edd4f4332 100644
--- a/public/_locales/uk/messages.json
+++ b/public/_locales/uk/messages.json
@@ -1780,6 +1780,34 @@
     "message": "Пізніше в гаманці можна додати кілька типів облікових записів і керувати ними.",
     "englishSource": "You can add and manage multiple account types later within the wallet."
   },
+  "chooseRecoveryMethod": {
+    "message": "Налаштувати відновлення облікового запису",
+    "englishSource": "Set Up Account Recovery"
+  },
+  "chooseRecoveryMethodDescription": {
+    "message": "Виберіть спосіб відновлення облікового запису, якщо ви втратите доступ.",
+    "englishSource": "Choose how you want to recover your account if you lose access."
+  },
+  "guardianRecovery": {
+    "message": "Опікун",
+    "englishSource": "Guardian"
+  },
+  "guardianRecoveryDescription": {
+    "message": "Рекомендовано. Відновлення вашого облікового запису на основі опікуна, але оператор-охоронець може бачити ваш стан.",
+    "englishSource": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state."
+  },
+  "fullyPrivateRecovery": {
+    "message": "Повністю приватний",
+    "englishSource": "Fully Private"
+  },
+  "fullyPrivateRecoveryDescription": {
+    "message": "Лише локально, ніхто не бачить ваш стан, крім вас, але відновлення не відбувається, втрата пристрою призведе до остаточної втрати ваших коштів.",
+    "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
+  },
+  "default": {
+    "message": "За замовчуванням",
+    "englishSource": "Default"
+  },
   "transactionFile": {
     "message": "Файл транзакцій",
     "englishSource": "Transaction file"
diff --git a/public/_locales/zh_CN/messages.json b/public/_locales/zh_CN/messages.json
index df6f9bc14..2310f8da4 100644
--- a/public/_locales/zh_CN/messages.json
+++ b/public/_locales/zh_CN/messages.json
@@ -1779,6 +1779,34 @@
     "message": "您可以稍后在钱包中添加和管理多个帐户类型。",
     "englishSource": "You can add and manage multiple account types later within the wallet."
   },
+  "chooseRecoveryMethod": {
+    "message": "设置帐户恢复",
+    "englishSource": "Set Up Account Recovery"
+  },
+  "chooseRecoveryMethodDescription": {
+    "message": "选择在失去访问权限时恢复帐户的方式。",
+    "englishSource": "Choose how you want to recover your account if you lose access."
+  },
+  "guardianRecovery": {
+    "message": "监护人",
+    "englishSource": "Guardian"
+  },
+  "guardianRecoveryDescription": {
+    "message": "受到推崇的。基于监护人的帐户恢复，但监护人操作员可以看到您的状态。",
+    "englishSource": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state."
+  },
+  "fullyPrivateRecovery": {
+    "message": "完全私人",
+    "englishSource": "Fully Private"
+  },
+  "fullyPrivateRecoveryDescription": {
+    "message": "仅限本地，除了您之外没有人看到您的状态，但无法恢复，丢失您的设备将导致您的资金永久丢失。",
+    "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
+  },
+  "default": {
+    "message": "默认",
+    "englishSource": "Default"
+  },
   "transactionFile": {
     "message": "交易文件",
     "englishSource": "Transaction file"
diff --git a/public/_locales/zh_TW/messages.json b/public/_locales/zh_TW/messages.json
index bce09bb6f..1ea7b633e 100644
--- a/public/_locales/zh_TW/messages.json
+++ b/public/_locales/zh_TW/messages.json
@@ -1779,6 +1779,34 @@
     "message": "您可以稍后在钱包中添加和管理多个帐户类型。",
     "englishSource": "You can add and manage multiple account types later within the wallet."
   },
+  "chooseRecoveryMethod": {
+    "message": "设置帐户恢复",
+    "englishSource": "Set Up Account Recovery"
+  },
+  "chooseRecoveryMethodDescription": {
+    "message": "选择在失去访问权限时恢复帐户的方式。",
+    "englishSource": "Choose how you want to recover your account if you lose access."
+  },
+  "guardianRecovery": {
+    "message": "监护人",
+    "englishSource": "Guardian"
+  },
+  "guardianRecoveryDescription": {
+    "message": "受到推崇的。基于监护人的帐户恢复，但监护人操作员可以看到您的状态。",
+    "englishSource": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state."
+  },
+  "fullyPrivateRecovery": {
+    "message": "完全私人",
+    "englishSource": "Fully Private"
+  },
+  "fullyPrivateRecoveryDescription": {
+    "message": "仅限本地，除了您之外没有人看到您的状态，但无法恢复，丢失您的设备将导致您的资金永久丢失。",
+    "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
+  },
+  "default": {
+    "message": "默认",
+    "englishSource": "Default"
+  },
   "transactionFile": {
     "message": "交易文件",
     "englishSource": "Transaction file"

From ed288d9a75c33a5f4cf7570f0f7afa33fedb38f8 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Thu, 19 Mar 2026 21:38:31 +0530
Subject: [PATCH 10/71] feat: add psm account provider to properly handle
 service worker transaction processing

---
 src/lib/miden/activity/transactions.ts      | 30 ++++---
 src/lib/miden/back/actions.ts               | 12 +++
 src/lib/miden/back/main.ts                  | 12 +++
 src/lib/miden/back/transaction-processor.ts | 25 +++++-
 src/lib/miden/front/autoSync.ts             | 10 +++
 src/lib/miden/front/psm-manager.ts          | 87 ++++++++++++++++++---
 src/lib/miden/psm/index.ts                  | 19 +----
 src/lib/shared/types.ts                     | 29 +++++++
 src/lib/store/index.ts                      | 19 +++++
 src/lib/store/types.ts                      |  2 +
 10 files changed, 206 insertions(+), 39 deletions(-)

diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index 7a5fad37e..5c755db13 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -13,7 +13,7 @@ import { liveQuery } from 'dexie';
 import { consumeNoteId } from 'lib/miden-worker/consumeNoteId';
 import { sendTransaction } from 'lib/miden-worker/sendTransaction';
 import { submitTransaction } from 'lib/miden-worker/submitTransaction';
-import { getOrCreateMultisigService, isPsmAccount } from 'lib/miden/front/psm-manager';
+import { getOrCreateMultisigService, isPsmAccount, type PsmAccountProvider } from 'lib/miden/front/psm-manager';
 import * as Repo from 'lib/miden/repo';
 import { isExtension, isMobile } from 'lib/platform';
 import { u8ToB64 } from 'lib/shared/helpers';
@@ -584,7 +584,8 @@ export const verifyStuckTransactionsFromNode = async (): Promise<number> => {
 export const generateTransaction = async (
   transaction: Transaction,
   signCallback: (publicKey: string, signingInputs: string) => Promise<Uint8Array>,
-  useWorker: boolean = true
+  useWorker: boolean = true,
+  psmProvider?: PsmAccountProvider
 ) => {
   // Sync state first to ensure we have latest account state
   // Separate lock acquisition to avoid holding lock during network call
@@ -606,9 +607,9 @@ export const generateTransaction = async (
     accountId: transaction.accountId
   });
   // Route PSM accounts through PSM service
-  if (isPsmAccount(transaction.accountId)) {
+  if (await isPsmAccount(transaction.accountId, psmProvider)) {
     try {
-      await generatePsmTransaction(transaction, signCallback);
+      await generatePsmTransaction(transaction, signCallback, psmProvider);
     } catch (error) {
       await cancelTransaction(transaction, error);
     }
@@ -689,9 +690,11 @@ export const generateTransaction = async (
  */
 const generatePsmTransaction = async (
   transaction: ITransaction,
-  signCallback: (publicKey: string, signingInputs: string) => Promise<Uint8Array>
+  signCallback: (publicKey: string, signingInputs: string) => Promise<Uint8Array>,
+  psmProvider?: PsmAccountProvider
 ): Promise<void> => {
-  const multisigService = await getOrCreateMultisigService(transaction.accountId, signCallback);
+  console.log('Generating PSM transaction');
+  const multisigService = await getOrCreateMultisigService(transaction.accountId, psmProvider);
 
   let proposalResult;
 
@@ -792,7 +795,8 @@ export const getTransactionById = async (id: string) => {
 
 export const generateTransactionsLoop = async (
   signCallback: (publicKey: string, signingInputs: string) => Promise<Uint8Array>,
-  useWorker: boolean = true
+  useWorker: boolean = true,
+  psmProvider?: PsmAccountProvider
 ): Promise<boolean | void> => {
   await cancelStuckTransactions();
   await cancelStaleQueuedTransactions();
@@ -818,7 +822,7 @@ export const generateTransactionsLoop = async (
 
   // Call safely to cancel transaction and unlock records if something goes wrong
   try {
-    await generateTransaction(nextTransaction, signCallback, useWorker);
+    await generateTransaction(nextTransaction, signCallback, useWorker, psmProvider);
     return true;
   } catch (e) {
     logger.warning('Failed to generate transaction', e);
@@ -831,13 +835,14 @@ export const generateTransactionsLoop = async (
 
 export const safeGenerateTransactionsLoop = async (
   signCallback: (publicKey: string, signingInputs: string) => Promise<Uint8Array>,
-  useWorker: boolean = true
+  useWorker: boolean = true,
+  psmProvider?: PsmAccountProvider
 ) => {
   return navigator.locks
     .request(`generate-transactions-loop`, { ifAvailable: true }, async lock => {
       if (!lock) return;
 
-      const result = await generateTransactionsLoop(signCallback, useWorker);
+      const result = await generateTransactionsLoop(signCallback, useWorker, psmProvider);
       if (result === false) {
         return false;
       }
@@ -859,7 +864,8 @@ export const safeGenerateTransactionsLoop = async (
  */
 export const startBackgroundTransactionProcessing = (
   signCallback: (publicKey: string, signingInputs: string) => Promise<Uint8Array>,
-  useWorker: boolean = false
+  useWorker: boolean = false,
+  psmProvider?: PsmAccountProvider
 ) => {
   // Process transactions in a loop until none are left
   const processLoop = async () => {
@@ -869,7 +875,7 @@ export const startBackgroundTransactionProcessing = (
 
     while (hasMore && attempts < maxAttempts) {
       attempts++;
-      await safeGenerateTransactionsLoop(signCallback, useWorker);
+      await safeGenerateTransactionsLoop(signCallback, useWorker, psmProvider);
 
       // Check if there are more transactions to process
       const remaining = await getAllUncompletedTransactions();
diff --git a/src/lib/miden/back/actions.ts b/src/lib/miden/back/actions.ts
index af9a8c713..6148ea2ee 100644
--- a/src/lib/miden/back/actions.ts
+++ b/src/lib/miden/back/actions.ts
@@ -208,6 +208,18 @@ export function signTransaction(publicKey: string, signingInputs: string) {
   });
 }
 
+export function signWord(publicKey: string, wordHex: string) {
+  return withUnlocked(async ({ vault }) => {
+    return await vault.signWord(publicKey, wordHex);
+  });
+}
+
+export function getPublicKeyForCommitment(commitment: string) {
+  return withUnlocked(async ({ vault }) => {
+    return await vault.getPublicKeyForCommitment(commitment);
+  });
+}
+
 export function getAuthSecretKey(key: string) {
   return withUnlocked(async ({ vault }) => {
     return await vault.getAuthSecretKey(key);
diff --git a/src/lib/miden/back/main.ts b/src/lib/miden/back/main.ts
index 7b1db767e..c4a631e37 100644
--- a/src/lib/miden/back/main.ts
+++ b/src/lib/miden/back/main.ts
@@ -183,6 +183,18 @@ async function processRequest(req: WalletRequest, port: Runtime.Port): Promise<W
         type: WalletMessageType.SignTransactionResponse,
         signature
       };
+    case WalletMessageType.SignWordRequest:
+      const wordSignature = await Actions.signWord(req.publicKey, req.wordHex);
+      return {
+        type: WalletMessageType.SignWordResponse,
+        signature: wordSignature
+      };
+    case WalletMessageType.GetPublicKeyForCommitmentRequest:
+      const commitmentPublicKey = await Actions.getPublicKeyForCommitment(req.commitment);
+      return {
+        type: WalletMessageType.GetPublicKeyForCommitmentResponse,
+        publicKey: commitmentPublicKey
+      };
     case WalletMessageType.GetAuthSecretKeyRequest:
       const key = await Actions.getAuthSecretKey(req.key);
       return {
diff --git a/src/lib/miden/back/transaction-processor.ts b/src/lib/miden/back/transaction-processor.ts
index 4754f4551..e15f081b2 100644
--- a/src/lib/miden/back/transaction-processor.ts
+++ b/src/lib/miden/back/transaction-processor.ts
@@ -1,6 +1,7 @@
 import browser from 'webextension-polyfill';
 
 import { getAllUncompletedTransactions, hasQueuedTransactions, safeGenerateTransactionsLoop } from 'lib/miden/activity';
+import { type PsmAccountProvider } from 'lib/miden/front/psm-manager';
 import { WalletMessageType } from 'lib/shared/types';
 
 import { getIntercom } from './defaults';
@@ -20,6 +21,28 @@ async function swSignCallback(publicKey: string, signingInputs: string): Promise
   });
 }
 
+/**
+ * Vault-backed PSM account provider for service worker context.
+ * Uses the Vault directly instead of the Zustand store.
+ */
+const vaultPsmProvider: PsmAccountProvider = {
+  getAccounts: async () => {
+    return withUnlocked(async ({ vault }) => {
+      return await vault.fetchAccounts();
+    });
+  },
+  getPublicKeyForCommitment: async (commitment: string) => {
+    return withUnlocked(async ({ vault }) => {
+      return await vault.getPublicKeyForCommitment(commitment);
+    });
+  },
+  signWord: async (publicKey: string, wordHex: string) => {
+    return withUnlocked(async ({ vault }) => {
+      return await vault.signWord(publicKey, wordHex);
+    });
+  }
+};
+
 /**
  * Start processing queued transactions in the service worker.
  * Deduplicates via isProcessing flag + navigator.locks in safeGenerateTransactionsLoop.
@@ -38,7 +61,7 @@ export async function startTransactionProcessing(): Promise<void> {
     while (attempts < maxAttempts) {
       attempts++;
       console.log('[TransactionProcessor] Loop attempt', attempts);
-      const result = await safeGenerateTransactionsLoop(swSignCallback, false);
+      const result = await safeGenerateTransactionsLoop(swSignCallback, false, vaultPsmProvider);
       console.log('[TransactionProcessor] Loop result:', result);
 
       // Broadcast progress so popup UI can update
diff --git a/src/lib/miden/front/autoSync.ts b/src/lib/miden/front/autoSync.ts
index 54f659598..0af2d55d8 100644
--- a/src/lib/miden/front/autoSync.ts
+++ b/src/lib/miden/front/autoSync.ts
@@ -3,6 +3,7 @@ import { WalletState, WalletStatus } from 'lib/shared/types';
 import { useWalletStore } from 'lib/store';
 
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
+import { syncPsmAccounts } from './psm-manager';
 
 const sleep = (ms: number) => new Promise(r => setTimeout(r, ms));
 
@@ -98,6 +99,7 @@ export class Sync {
             syncDebugInfo.lastError = 'getMidenClient returned null';
             return null;
           }
+          console.log('[AutoSync] Starting sync with Miden client...');
           const syncSummary = await client.syncState();
           return syncSummary.blockNum();
         });
@@ -109,6 +111,14 @@ export class Sync {
         }
         syncDebugInfo.syncCount++;
         syncDebugInfo.lastSyncTime = new Date().toLocaleTimeString();
+
+        // Sync PSM state after chain sync (runs outside WASM lock — HTTP calls only)
+        try {
+          console.log('[AutoSync] Syncing PSM accounts...');
+          await syncPsmAccounts();
+        } catch (psmError) {
+          console.error('[AutoSync] PSM sync error:', psmError);
+        }
       } catch (error) {
         console.error('[AutoSync] Error during sync:', error);
         syncDebugInfo.lastError = String(error);
diff --git a/src/lib/miden/front/psm-manager.ts b/src/lib/miden/front/psm-manager.ts
index f77ecfa23..81e66aa0f 100644
--- a/src/lib/miden/front/psm-manager.ts
+++ b/src/lib/miden/front/psm-manager.ts
@@ -1,24 +1,56 @@
 import { MultisigService } from 'lib/miden/psm';
+import { WalletAccount } from 'lib/shared/types';
 import { useWalletStore } from 'lib/store';
 import { WalletType } from 'screens/onboarding/types';
 
 import { MULTISIG_SLOT_NAMES } from '../psm/account';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
+
+// Cache MultisigService instances to avoid re-initialization on every sync cycle
+const psmServiceCache = new Map<string, MultisigService>();
+
+/**
+ * Callbacks for resolving account data.
+ * Allows psm-manager to work in both frontend (Zustand) and service worker (Vault) contexts.
+ */
+export interface PsmAccountProvider {
+  getAccounts: () => Promise<WalletAccount[]>;
+  getPublicKeyForCommitment: (commitment: string) => Promise<string>;
+  signWord: (publicKey: string, wordHex: string) => Promise<string>;
+}
+
+/**
+ * Default provider that uses the Zustand store (frontend context).
+ */
+const zustandProvider: PsmAccountProvider = {
+  getAccounts: async () => useWalletStore.getState().accounts,
+  getPublicKeyForCommitment: (commitment: string) => useWalletStore.getState().getPublicKeyForCommitment(commitment),
+  signWord: (publicKey: string, wordHex: string) => useWalletStore.getState().signWord(publicKey, wordHex)
+};
+
 /**
  * Create a MultisigService for the given PSM account.
+ * Returns a cached instance if available.
  */
 export async function getOrCreateMultisigService(
   accountPublicKey: string,
-  signCallback: (publicKey: string, signingInputs: string) => Promise<Uint8Array>
+  provider: PsmAccountProvider = zustandProvider
 ): Promise<MultisigService> {
-  // Verify this is a PSM account using Zustand store
-  const accounts = useWalletStore.getState().accounts;
+  console.log(`[PSM Manager] Getting/creating MultisigService for account: ${accountPublicKey}`);
+  // Return cached instance if available
+  const cached = psmServiceCache.get(accountPublicKey);
+  if (cached) {
+    return cached;
+  }
+
+  // Verify this is a PSM account
+  const accounts = await provider.getAccounts();
   const account = accounts.find(acc => acc.publicKey === accountPublicKey);
   if (!account || account.type !== WalletType.Psm) {
     throw new Error('Account is not a PSM account');
   }
 
-  // Get the Account object and WebClient from Miden client
+  // Get the Account object from Miden client
   const { sdkAccount } = await withWasmClientLock(async () => {
     const midenClient = await getMidenClient();
     const sdkAccount = await midenClient.getAccount(accountPublicKey);
@@ -38,12 +70,15 @@ export async function getOrCreateMultisigService(
   if (!commitment) {
     throw new Error('Commitment not found in account storage');
   }
-
+  console.log('[PSM Manager] Retrieved commitment from account storage:', commitment);
   // Get the actual public key from the public key commitment
-  const publicKey = await useWalletStore.getState().getPublicKeyForCommitment(commitment);
+  const publicKey = await provider.getPublicKeyForCommitment(commitment);
+  console.log('[PSM Manager] Retrieved public key for commitment:', publicKey);
+  // Initialize MultisigService with the account, public key, commitment, and signWord function
+  const service = await MultisigService.init(sdkAccount, `0x${publicKey}`, `0x${commitment}`, provider.signWord);
 
-  // Initialize MultisigService with the account, public key, commitment, sign function, and webClient
-  const service = await MultisigService.init(sdkAccount, `0x${publicKey}`, `0x${commitment}`, signCallback);
+  // Cache for future use
+  psmServiceCache.set(accountPublicKey, service);
 
   return service;
 }
@@ -51,8 +86,40 @@ export async function getOrCreateMultisigService(
 /**
  * Check if an account is a PSM account.
  */
-export function isPsmAccount(accountPublicKey: string): boolean {
-  const accounts = useWalletStore.getState().accounts;
+export async function isPsmAccount(
+  accountPublicKey: string,
+  provider: PsmAccountProvider = zustandProvider
+): Promise<boolean> {
+  console.log(`[PSM Manager] Checking if account is PSM: ${accountPublicKey}`);
+  const accounts = await provider.getAccounts();
+  console.log('[PSM Manager] Retrieved accounts from provider:', accounts);
   const account = accounts.find(acc => acc.publicKey === accountPublicKey);
   return account?.type === WalletType.Psm;
 }
+
+/**
+ * Sync PSM state for all PSM accounts.
+ * Called from AutoSync after chain state sync (frontend context only).
+ */
+export async function syncPsmAccounts(): Promise<void> {
+  const accounts = await zustandProvider.getAccounts();
+  const psmAccounts = accounts.filter(acc => acc.type === WalletType.Psm);
+
+  if (psmAccounts.length === 0) return;
+
+  for (const account of psmAccounts) {
+    try {
+      const service = await getOrCreateMultisigService(account.publicKey);
+      await service.sync();
+    } catch (error) {
+      console.error(`[PSM Sync] Error syncing PSM account ${account.publicKey}:`, error);
+    }
+  }
+}
+
+/**
+ * Clear the PSM service cache. Call on logout/lock.
+ */
+export function clearPsmCache(): void {
+  psmServiceCache.clear();
+}
diff --git a/src/lib/miden/psm/index.ts b/src/lib/miden/psm/index.ts
index 677420803..165e9f0fd 100644
--- a/src/lib/miden/psm/index.ts
+++ b/src/lib/miden/psm/index.ts
@@ -12,7 +12,6 @@ import {
 import { DEFAULT_PSM_ENDPOINT } from 'lib/miden-chain/constants';
 import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { u8ToB64 } from 'lib/shared/helpers';
-import { useWalletStore } from 'lib/store';
 
 import { fetchFromStorage } from '../front';
 import { accountIdStringToSdk } from '../sdk/helpers';
@@ -43,25 +42,13 @@ export class MultisigService {
     account: Account,
     publicKey: string,
     signerCommitment: string,
-    signCallback?: (publicKey: string, signingInputs: string) => Promise<Uint8Array>
+    signWordFn: SignWordFunction
   ): Promise<MultisigService> {
     try {
-      const signer = new WalletSigner(publicKey, signerCommitment, useWalletStore.getState().signWord);
+      const signer = new WalletSigner(publicKey, signerCommitment, signWordFn);
       const psmEndpoint = (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) || DEFAULT_PSM_ENDPOINT;
 
-      const webClient = (
-        await MidenClientInterface.create(
-          signCallback
-            ? {
-                signCallback: async (publicKey: Uint8Array, signingInputs: Uint8Array) => {
-                  const keyString = Buffer.from(publicKey).toString('hex');
-                  const signingInputsString = Buffer.from(signingInputs).toString('hex');
-                  return await signCallback(keyString, signingInputsString);
-                }
-              }
-            : {}
-        )
-      ).webClient;
+      const webClient = (await MidenClientInterface.create({})).webClient;
 
       const client = new MultisigClient(webClient, { psmEndpoint });
       const { psmCommitment } = await client.initialize('falcon');
diff --git a/src/lib/shared/types.ts b/src/lib/shared/types.ts
index f38996447..3da432b7b 100644
--- a/src/lib/shared/types.ts
+++ b/src/lib/shared/types.ts
@@ -56,6 +56,10 @@ export enum WalletMessageType {
   SignDataResponse = 'SIGN_DATA_RESPONSE',
   SignTransactionRequest = 'SIGN_TRANSACTION_REQUEST',
   SignTransactionResponse = 'SIGN_TRANSACTION_RESPONSE',
+  SignWordRequest = 'SIGN_WORD_REQUEST',
+  SignWordResponse = 'SIGN_WORD_RESPONSE',
+  GetPublicKeyForCommitmentRequest = 'GET_PUBLIC_KEY_FOR_COMMITMENT_REQUEST',
+  GetPublicKeyForCommitmentResponse = 'GET_PUBLIC_KEY_FOR_COMMITMENT_RESPONSE',
   GetAuthSecretKeyRequest = 'GET_AUTH_SECRET_KEY_REQUEST',
   GetAuthSecretKeyResponse = 'GET_AUTH_SECRET_KEY_RESPONSE',
   SubmitTransactionRequest = 'SUBMIT_TRANSACTION_REQUEST',
@@ -468,6 +472,27 @@ export interface SignTransactionResponse extends WalletMessageBase {
   signature: string;
 }
 
+export interface SignWordRequest extends WalletMessageBase {
+  type: WalletMessageType.SignWordRequest;
+  publicKey: string;
+  wordHex: string;
+}
+
+export interface SignWordResponse extends WalletMessageBase {
+  type: WalletMessageType.SignWordResponse;
+  signature: string;
+}
+
+export interface GetPublicKeyForCommitmentRequest extends WalletMessageBase {
+  type: WalletMessageType.GetPublicKeyForCommitmentRequest;
+  commitment: string;
+}
+
+export interface GetPublicKeyForCommitmentResponse extends WalletMessageBase {
+  type: WalletMessageType.GetPublicKeyForCommitmentResponse;
+  publicKey: string;
+}
+
 export interface GetAuthSecretKeyRequest extends WalletMessageBase {
   type: WalletMessageType.GetAuthSecretKeyRequest;
   key: string;
@@ -666,6 +691,8 @@ export type WalletRequest =
   | UpdateSettingsRequest
   | SignDataRequest
   | SignTransactionRequest
+  | SignWordRequest
+  | GetPublicKeyForCommitmentRequest
   | GetAuthSecretKeyRequest
   | PageRequest
   | DAppGetPayloadRequest
@@ -714,6 +741,8 @@ export type WalletResponse =
   | UpdateSettingsResponse
   | SignDataResponse
   | SignTransactionResponse
+  | SignWordResponse
+  | GetPublicKeyForCommitmentResponse
   | GetAuthSecretKeyResponse
   | PageResponse
   //   | DAppGetPayloadResponse
diff --git a/src/lib/store/index.ts b/src/lib/store/index.ts
index 1e4e05fb6..6efd1eee5 100644
--- a/src/lib/store/index.ts
+++ b/src/lib/store/index.ts
@@ -265,6 +265,25 @@ export const useWalletStore = create<WalletStore>()(
       return new Uint8Array(Buffer.from(signatureAsHex, 'hex'));
     },
 
+    signWord: async (publicKey, wordHex) => {
+      const res = await request({
+        type: WalletMessageType.SignWordRequest,
+        publicKey,
+        wordHex
+      });
+      assertResponse(res.type === WalletMessageType.SignWordResponse);
+      return res.signature;
+    },
+
+    getPublicKeyForCommitment: async commitment => {
+      const res = await request({
+        type: WalletMessageType.GetPublicKeyForCommitmentRequest,
+        commitment
+      });
+      assertResponse(res.type === WalletMessageType.GetPublicKeyForCommitmentResponse);
+      return res.publicKey;
+    },
+
     getAuthSecretKey: async key => {
       const res = await request({
         type: WalletMessageType.GetAuthSecretKeyRequest,
diff --git a/src/lib/store/types.ts b/src/lib/store/types.ts
index 1ad471191..b2caa0c5b 100644
--- a/src/lib/store/types.ts
+++ b/src/lib/store/types.ts
@@ -119,6 +119,8 @@ export interface WalletActions {
   // Signing actions
   signData: (publicKey: string, signingInputs: string) => Promise<string>;
   signTransaction: (publicKey: string, signingInputs: string) => Promise<Uint8Array>;
+  signWord: (publicKey: string, wordHex: string) => Promise<string>;
+  getPublicKeyForCommitment: (commitment: string) => Promise<string>;
   getAuthSecretKey: (key: string) => Promise<string>;
 
   // DApp actions

From bca5958ac1b24106899b926ab321daa6cafab369 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Fri, 20 Mar 2026 19:10:24 +0530
Subject: [PATCH 11/71] feat: add account recovery flow for gaurdian backed
 accounts

---
 public/_locales/en/en.json                    |  2 ++
 src/app/pages/Welcome.tsx                     | 16 +++++-----
 src/lib/miden/back/vault.ts                   | 20 ++++++++++--
 src/lib/miden/front/psm-manager.ts            | 17 ++--------
 src/lib/miden/psm/account.ts                  | 23 +++++++++++++-
 src/lib/miden/psm/index.ts                    | 28 ++++++++++++++++-
 src/lib/miden/sdk/miden-client-interface.ts   | 28 ++++++++++++++++-
 .../SelectRecoveryMethod.tsx                  | 20 +++++++-----
 src/screens/onboarding/navigator.tsx          | 31 ++++++++++++++++---
 9 files changed, 146 insertions(+), 39 deletions(-)

diff --git a/public/_locales/en/en.json b/public/_locales/en/en.json
index bd5fadbc0..1695e394b 100644
--- a/public/_locales/en/en.json
+++ b/public/_locales/en/en.json
@@ -416,6 +416,8 @@
   "guardianRecoveryDescription": "Recommended. Guardian-based recovery for your account but gaurdian operator can see your state.",
   "fullyPrivateRecovery": "Fully Private",
   "fullyPrivateRecoveryDescription": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds.",
+  "publicAccountRecovery": "Public",
+  "publicAccountRecoveryDescription": "Recover a public on-chain account.",
   "default": "Default",
   "transactionFile": "Transaction file",
   "verificationFailed": "Verification Failed",
diff --git a/src/app/pages/Welcome.tsx b/src/app/pages/Welcome.tsx
index f21a1fcb8..5fb0bdabb 100644
--- a/src/app/pages/Welcome.tsx
+++ b/src/app/pages/Welcome.tsx
@@ -148,9 +148,9 @@ const Welcome: FC = () => {
         {
           const hardwareAvailable = await checkHardwareSecurityAvailable();
           if (hardwareAvailable) {
-            // Hardware-only mode: skip password, go directly to confirmation
+            // Hardware-only mode: skip password, go to recovery method selection
             setPassword('__HARDWARE_ONLY__');
-            navigate('/#confirmation');
+            navigate('/#select-recovery-method');
           } else {
             navigate('/#create-password');
           }
@@ -181,11 +181,7 @@ const Welcome: FC = () => {
         setPassword(action.payload.password);
         eventCategory = AnalyticsEventCategory.FormSubmit;
         // Hardware protection is automatically set up in Vault.spawn() when available
-        if (onboardingType === OnboardingType.Create) {
-          navigate('/#select-recovery-method');
-        } else {
-          navigate('/#confirmation');
-        }
+        navigate('/#select-recovery-method');
         break;
       case 'select-recovery-method':
         setWalletType(action.payload);
@@ -241,7 +237,11 @@ const Welcome: FC = () => {
             }
           }
         } else if (step === OnboardingStep.SelectRecoveryMethod) {
-          navigate('/#create-password');
+          if (onboardingType === OnboardingType.Import && password === '__HARDWARE_ONLY__') {
+            navigate('/#import-from-seed');
+          } else {
+            navigate('/#create-password');
+          }
         } else if (step === OnboardingStep.ImportFromFile || step === OnboardingStep.ImportFromSeed) {
           navigate('/#select-import-type');
         }
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index c8c9eff81..d5e33e7a4 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -241,12 +241,28 @@ export class Vault {
       const hdAccIndex = 0;
       const walletSeed = deriveClientSeed(walletType, mnemonic, 0);
 
+      // Helper to sign words using the vault key (needed for PSM import)
+      const signWordFn = async (pk: string, wordHex: string) => {
+        const word = Word.fromHex(wordHex);
+        const secretKey = await fetchAndDecryptOneWithLegacyFallBack<string>(accAuthSecretKeyStrgKey(pk), vaultKey);
+        const wasmSecretKey = AuthSecretKey.deserialize(new Uint8Array(Buffer.from(secretKey, 'hex')));
+        const signature = wasmSecretKey.sign(word);
+        return `0x${Buffer.from(signature.serialize().slice(1)).toString('hex')}`;
+      };
+
+      // Helper to get public key from commitment (needed for PSM import)
+      const getPublicKeyForCommitment = async (pkc: string) => {
+        const sk = await fetchAndDecryptOneWithLegacyFallBack<string>(accAuthSecretKeyStrgKey(pkc), vaultKey);
+        const wasmSecretKey = AuthSecretKey.deserialize(new Uint8Array(Buffer.from(sk, 'hex')));
+        return Buffer.from(wasmSecretKey.publicKey().serialize().slice(1)).toString('hex');
+      };
+
       // Wrap WASM client operations in a lock to prevent concurrent access
       const accPublicKey = await withWasmClientLock(async () => {
         const midenClient = await getMidenClient(options);
         if (ownMnemonic && midenClient.network !== 'mock') {
           try {
-            return await midenClient.importPublicMidenWalletFromSeed(walletSeed);
+            return await midenClient.importAccountBySeed(walletType, walletSeed, signWordFn, getPublicKeyForCommitment);
           } catch (e) {
             console.error('Failed to import wallet from seed in spawn, creating new wallet instead', e);
             return await midenClient.createMidenWallet(walletType, walletSeed);
@@ -261,7 +277,7 @@ export class Vault {
       const initialAccount: WalletAccount = {
         publicKey: accPublicKey,
         name: 'Miden Account 1',
-        isPublic: true,
+        isPublic: walletType === WalletType.OnChain,
         type: walletType,
         hdIndex: hdAccIndex
       };
diff --git a/src/lib/miden/front/psm-manager.ts b/src/lib/miden/front/psm-manager.ts
index 81e66aa0f..37eb13b59 100644
--- a/src/lib/miden/front/psm-manager.ts
+++ b/src/lib/miden/front/psm-manager.ts
@@ -3,7 +3,7 @@ import { WalletAccount } from 'lib/shared/types';
 import { useWalletStore } from 'lib/store';
 import { WalletType } from 'screens/onboarding/types';
 
-import { MULTISIG_SLOT_NAMES } from '../psm/account';
+import { getSignerDetailsFromAccount } from '../psm/account';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 
 // Cache MultisigService instances to avoid re-initialization on every sync cycle
@@ -61,19 +61,8 @@ export async function getOrCreateMultisigService(
     throw new Error('Account not found in local storage');
   }
 
-  const mapEntries = sdkAccount.storage().getMapEntries(MULTISIG_SLOT_NAMES.SIGNER_PUBLIC_KEYS);
-  if (!mapEntries) {
-    throw new Error('No signer public keys found in account storage');
-  }
-
-  const commitment = mapEntries[0].value.slice(2);
-  if (!commitment) {
-    throw new Error('Commitment not found in account storage');
-  }
-  console.log('[PSM Manager] Retrieved commitment from account storage:', commitment);
-  // Get the actual public key from the public key commitment
-  const publicKey = await provider.getPublicKeyForCommitment(commitment);
-  console.log('[PSM Manager] Retrieved public key for commitment:', publicKey);
+  const { commitment, publicKey } = await getSignerDetailsFromAccount(sdkAccount, provider.getPublicKeyForCommitment);
+  console.log('[PSM Manager] Retrieved signer details - commitment:', commitment, 'publicKey:', publicKey);
   // Initialize MultisigService with the account, public key, commitment, and signWord function
   const service = await MultisigService.init(sdkAccount, `0x${publicKey}`, `0x${commitment}`, provider.signWord);
 
diff --git a/src/lib/miden/psm/account.ts b/src/lib/miden/psm/account.ts
index 268ac6515..0250e7fa1 100644
--- a/src/lib/miden/psm/account.ts
+++ b/src/lib/miden/psm/account.ts
@@ -14,6 +14,27 @@ export const MULTISIG_SLOT_NAMES = {
   PROCEDURE_THRESHOLDS: 'openzeppelin::multisig::procedure_thresholds'
 } as const;
 
+/**
+ * Extract signer commitment and public key from a PSM account's storage.
+ */
+export async function getSignerDetailsFromAccount(
+  account: Account,
+  getPublicKeyForCommitment: (commitment: string) => Promise<string>
+): Promise<{ commitment: string; publicKey: string }> {
+  const mapEntries = account.storage().getMapEntries(MULTISIG_SLOT_NAMES.SIGNER_PUBLIC_KEYS);
+  if (!mapEntries) {
+    throw new Error('No signer public keys found in account storage');
+  }
+
+  const commitment = mapEntries[0].value.slice(2);
+  if (!commitment) {
+    throw new Error('Commitment not found in account storage');
+  }
+
+  const publicKey = await getPublicKeyForCommitment(commitment);
+  return { commitment, publicKey };
+}
+
 /**
  * Create a PSM (Private State Manager) account using the MultisigClient.
  *
@@ -48,7 +69,7 @@ export async function createPsmAccount(webClient: WebClient, seed?: Uint8Array):
       psmCommitment,
       psmPublicKey,
       psmEnabled: true,
-      storageMode: 'public',
+      storageMode: 'private',
       signatureScheme: 'falcon'
     });
 
diff --git a/src/lib/miden/psm/index.ts b/src/lib/miden/psm/index.ts
index 165e9f0fd..57021ed59 100644
--- a/src/lib/miden/psm/index.ts
+++ b/src/lib/miden/psm/index.ts
@@ -1,4 +1,4 @@
-import { Account, TransactionRequest } from '@miden-sdk/miden-sdk';
+import { Account, TransactionRequest, WebClient } from '@miden-sdk/miden-sdk';
 import {
   Multisig,
   MultisigClient,
@@ -77,6 +77,32 @@ export class MultisigService {
     }
   }
 
+  static async importAccountFromPsm(
+    publicKey: string,
+    signerCommitment: string,
+    signWordFn: SignWordFunction,
+    accountId: string,
+    webClient: WebClient
+  ) {
+    const psmEndpoint = (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) || DEFAULT_PSM_ENDPOINT;
+    const psm = new PsmHttpClient(psmEndpoint);
+    const signer = new WalletSigner(publicKey, signerCommitment, signWordFn);
+    psm.setSigner(signer);
+    try {
+      const { stateJson } = await psm.getState(accountId);
+      const accountBase64 = stateJson.data;
+      const binaryString = atob(accountBase64);
+      const accountBytes = new Uint8Array(binaryString.length);
+      for (let i = 0; i < binaryString.length; i++) {
+        accountBytes[i] = binaryString.charCodeAt(i);
+      }
+      const account = Account.deserialize(accountBytes);
+      await webClient.newAccount(account, true);
+    } catch (error) {
+      console.log('Error fetching account state from PSM:', error);
+    }
+  }
+
   /**
    * Get the account ID for this multisig.
    */
diff --git a/src/lib/miden/sdk/miden-client-interface.ts b/src/lib/miden/sdk/miden-client-interface.ts
index 71cbf8d3b..37858067b 100644
--- a/src/lib/miden/sdk/miden-client-interface.ts
+++ b/src/lib/miden/sdk/miden-client-interface.ts
@@ -28,7 +28,9 @@ import { WalletType } from 'screens/onboarding/types';
 
 import { ConsumeTransaction, SendTransaction } from '../db/types';
 import { toNoteType } from '../helpers';
-import { createPsmAccount } from '../psm/account';
+import { createPsmAccount, getSignerDetailsFromAccount } from '../psm/account';
+import { MultisigService } from '../psm/index';
+import { SignWordFunction } from '../psm/signer';
 import { NoteExportType } from './constants';
 import { accountIdStringToSdk, getBech32AddressFromAccountId } from './helpers';
 
@@ -138,6 +140,30 @@ export class MidenClientInterface {
     return getBech32AddressFromAccountId(account.id());
   }
 
+  async importAccountBySeed(
+    walletType: WalletType,
+    seed: Uint8Array,
+    signWordFn: SignWordFunction,
+    getPublicKeyForCommitment: (commitment: string) => Promise<string>
+  ): Promise<string> {
+    if (walletType === WalletType.Psm) {
+      const account = await createPsmAccount(this.webClient, seed);
+      console.log('[MidenClientInterface] Imported PSM account from seed with ID:', account.id().toString());
+      const accountId = account.id().toString();
+      const { commitment, publicKey } = await getSignerDetailsFromAccount(account, getPublicKeyForCommitment);
+      await MultisigService.importAccountFromPsm(
+        `0x${publicKey}`,
+        `0x${commitment}`,
+        signWordFn,
+        accountId,
+        this.webClient
+      );
+      return getBech32AddressFromAccountId(account.id());
+    }
+
+    return await this.importPublicMidenWalletFromSeed(seed);
+  }
+
   // TODO: is this method even used?
   async consumeTransaction(accountId: string, listOfNoteIds: string[], delegateTransaction?: boolean) {
     const notes = await this.getNotesByIds(listOfNoteIds);
diff --git a/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx b/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx
index 0d667ce4a..0a137b1d2 100644
--- a/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx
+++ b/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx
@@ -8,11 +8,7 @@ import { Badge } from 'lib/ui/badge';
 
 import { WalletType } from '../types';
 
-export interface SelectRecoveryMethodScreenProps extends Omit<React.ButtonHTMLAttributes<HTMLDivElement>, 'onSubmit'> {
-  onSubmit?: (payload: WalletType) => void;
-}
-
-type RecoveryOption = {
+export type RecoveryOption = {
   id: WalletType;
   title: string;
   description: string;
@@ -20,9 +16,18 @@ type RecoveryOption = {
   isLast?: boolean;
 };
 
-export const SelectRecoveryMethodScreen = ({ onSubmit, ...props }: SelectRecoveryMethodScreenProps) => {
+export interface SelectRecoveryMethodScreenProps extends Omit<React.ButtonHTMLAttributes<HTMLDivElement>, 'onSubmit'> {
+  onSubmit?: (payload: WalletType) => void;
+  options?: RecoveryOption[];
+}
+
+export const SelectRecoveryMethodScreen = ({
+  onSubmit,
+  options: optionsProp,
+  ...props
+}: SelectRecoveryMethodScreenProps) => {
   const { t } = useTranslation();
-  const options: RecoveryOption[] = useMemo(
+  const defaultOptions: RecoveryOption[] = useMemo(
     () => [
       {
         id: WalletType.Psm,
@@ -39,6 +44,7 @@ export const SelectRecoveryMethodScreen = ({ onSubmit, ...props }: SelectRecover
     ],
     [t]
   );
+  const options = optionsProp || defaultOptions;
   const [selected, setSelected] = React.useState<WalletType>(options.find(o => o.isDefault)?.id || options[0].id);
 
   const handleContinue = () => {
diff --git a/src/screens/onboarding/navigator.tsx b/src/screens/onboarding/navigator.tsx
index 6c95410d1..fb259e0a2 100644
--- a/src/screens/onboarding/navigator.tsx
+++ b/src/screens/onboarding/navigator.tsx
@@ -2,7 +2,6 @@ import React, { FC, useCallback, useState } from 'react';
 
 import classNames from 'clsx';
 import { AnimatePresence, motion } from 'framer-motion';
-
 import { useTranslation } from 'react-i18next';
 
 import { IconName } from 'app/icons/v2';
@@ -15,7 +14,7 @@ import { ConfirmationScreen } from './common/Confirmation';
 import { CreatePasswordScreen } from './common/CreatePassword';
 import { WelcomeScreen } from './common/Welcome';
 import { BackUpSeedPhraseScreen } from './create-wallet-flow/BackUpSeedPhrase';
-import { SelectRecoveryMethodScreen } from './create-wallet-flow/SelectRecoveryMethod';
+import { RecoveryOption, SelectRecoveryMethodScreen } from './create-wallet-flow/SelectRecoveryMethod';
 import { SelectTransactionTypeScreen } from './create-wallet-flow/SelectTransactionType';
 import { VerifySeedPhraseScreen } from './create-wallet-flow/VerifySeedPhrase';
 import { ImportSeedPhraseScreen } from './import-wallet-flow/ImportSeedPhrase';
@@ -184,8 +183,28 @@ export const OnboardingFlow: FC<OnboardingFlowProps> = ({
         return <ImportWalletFileScreen onSubmit={onImportFileSubmit} />;
       case OnboardingStep.CreatePassword:
         return <CreatePasswordScreen onSubmit={onCreatePasswordSubmit} />;
-      case OnboardingStep.SelectRecoveryMethod:
-        return <SelectRecoveryMethodScreen onSubmit={onSelectRecoveryMethodSubmit} />;
+      case OnboardingStep.SelectRecoveryMethod: {
+        const importRecoveryOptions: RecoveryOption[] = [
+          {
+            id: WalletType.Psm,
+            title: t('guardianRecovery'),
+            description: t('guardianRecoveryDescription'),
+            isDefault: true
+          },
+          {
+            id: WalletType.OnChain,
+            title: t('publicAccountRecovery'),
+            description: t('publicAccountRecoveryDescription'),
+            isLast: true
+          }
+        ];
+        return (
+          <SelectRecoveryMethodScreen
+            onSubmit={onSelectRecoveryMethodSubmit}
+            options={onboardingType === OnboardingType.Import ? importRecoveryOptions : undefined}
+          />
+        );
+      }
       case OnboardingStep.SelectTransactionType:
         return <SelectTransactionTypeScreen onSubmit={onSelectTransactionTypeSubmit} />;
       case OnboardingStep.Confirmation:
@@ -212,7 +231,9 @@ export const OnboardingFlow: FC<OnboardingFlowProps> = ({
     isHardwareSecurityAvailable,
     onBiometricChange,
     biometricAttempts,
-    biometricError
+    biometricError,
+    onboardingType,
+    t
   ]);
 
   const onBack = () => {

From d7a5a4ffbd86a875d2c3f7728747c6320399ef39 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Mon, 23 Mar 2026 20:50:45 +0530
Subject: [PATCH 12/71] feat: wip

---
 package.json                           |  4 +-
 src/lib/miden-chain/constants.ts       |  4 +-
 src/lib/miden/activity/transactions.ts | 75 +++++++++++++-------------
 src/lib/miden/psm/account.ts           | 41 +++++++-------
 src/lib/miden/psm/digest.ts            | 61 +++++++++++++++++++++
 src/lib/miden/psm/index.ts             | 60 ++++++++-------------
 src/lib/miden/psm/signer.ts            | 34 +++++-------
 test/state-helpers.ts                  |  8 +--
 yarn.lock                              | 39 +++++++-------
 9 files changed, 184 insertions(+), 142 deletions(-)
 create mode 100644 src/lib/miden/psm/digest.ts

diff --git a/package.json b/package.json
index 1d2cf1a44..76562166e 100644
--- a/package.json
+++ b/package.json
@@ -83,8 +83,8 @@
     "@miden-sdk/miden-sdk": "^0.13.0",
     "@newhighsco/storybook-addon-svgr": "^2.0.7",
     "@noble/hashes": "^1.4.0",
-    "@openzeppelin/miden-multisig-client": "^0.13.1",
-    "@openzeppelin/psm-client": "^0.13.0",
+    "@openzeppelin/guardian-client": "^0.13.3",
+    "@openzeppelin/miden-multisig-client": "^0.13.3",
     "@peculiar/webcrypto": "1.1.6",
     "@radix-ui/react-slot": "^1.2.3",
     "@segment/analytics-node": "^2.3.0",
diff --git a/src/lib/miden-chain/constants.ts b/src/lib/miden-chain/constants.ts
index 850feab48..332674384 100644
--- a/src/lib/miden-chain/constants.ts
+++ b/src/lib/miden-chain/constants.ts
@@ -34,7 +34,7 @@ export const MIDEN_FAUCET_ENDPOINTS = new Map<string, string>([
 ]);
 
 export const MIDEN_NOTE_TRANSPORT_LAYER_ENDPOINTS = new Map<string, string>([
-  [MIDEN_NETWORK_NAME.TESTNET, 'https://transport.miden.io'],
+  [MIDEN_NETWORK_NAME.TESTNET, 'http://127.0.0.1:57292'],
   [MIDEN_NETWORK_NAME.LOCALNET, 'http://127.0.0.1:57292']
 ]);
 
@@ -62,4 +62,4 @@ export const TOKEN_MAPPING = {
   [MidenTokens.Miden]: { faucetId: 'mtst1aqmat9m63ctdsgz6xcyzpuprpulwk9vg_qruqqypuyph' }
 };
 
-export const DEFAULT_PSM_ENDPOINT = 'https://psm-stg.openzeppelin.com';
+export const DEFAULT_PSM_ENDPOINT = 'http://localhost:3000';
diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index 5c755db13..b5166c723 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -8,6 +8,7 @@ import {
   TransactionRequest,
   TransactionResult
 } from '@miden-sdk/miden-sdk';
+import { type Proposal } from '@openzeppelin/miden-multisig-client';
 import { liveQuery } from 'dexie';
 
 import { consumeNoteId } from 'lib/miden-worker/consumeNoteId';
@@ -696,7 +697,7 @@ const generatePsmTransaction = async (
   console.log('Generating PSM transaction');
   const multisigService = await getOrCreateMultisigService(transaction.accountId, psmProvider);
 
-  let proposalResult;
+  let proposalResult: Proposal;
 
   switch (transaction.type) {
     case 'send': {
@@ -729,44 +730,44 @@ const generatePsmTransaction = async (
   }
 
   // Get the proposal commitment for signing and execution
-  const proposalCommitment = proposalResult.proposal.commitment;
+  await multisigService.signAndExecuteProposal(proposalResult.id);
 
   // Sign and execute the proposal
-  const tr = await multisigService.signAndCreateTransactionRequest(proposalCommitment);
-
-  const options: MidenClientCreateOptions = {
-    signCallback: async (publicKey: Uint8Array, signingInputs: Uint8Array) => {
-      const keyString = Buffer.from(publicKey).toString('hex');
-      const signingInputsString = Buffer.from(signingInputs).toString('hex');
-      return await signCallback(keyString, signingInputsString);
-    }
-  };
-
-  // Wrap WASM client operations in a lock to prevent concurrent access
-  const transactionResultBytes = await withWasmClientLock(async () => {
-    const midenClient = await getMidenClient(options);
-    return await midenClient.newTransaction(transaction.accountId, tr.serialize());
-  });
-
-  const transactionResult = TransactionResult.deserialize(transactionResultBytes);
-
-  await withWasmClientLock(async () => {
-    const midenClient = await getMidenClient();
-    await midenClient.submitTransaction(transactionResultBytes, transaction.delegateTransaction);
-  });
-
-  switch (transaction.type) {
-    case 'send':
-      await completeSendTransaction(transaction as SendTransaction, transactionResult);
-      break;
-    case 'consume':
-      await completeConsumeTransaction(transaction.id, transactionResult);
-      break;
-    case 'execute':
-    default:
-      await completeCustomTransaction(transaction, transactionResult);
-      break;
-  }
+  // const tr = await multisigService.signAndCreateTransactionRequest(proposalCommitment);
+
+  // const options: MidenClientCreateOptions = {
+  //   signCallback: async (publicKey: Uint8Array, signingInputs: Uint8Array) => {
+  //     const keyString = Buffer.from(publicKey).toString('hex');
+  //     const signingInputsString = Buffer.from(signingInputs).toString('hex');
+  //     return await signCallback(keyString, signingInputsString);
+  //   }
+  // };
+
+  // // Wrap WASM client operations in a lock to prevent concurrent access
+  // const transactionResultBytes = await withWasmClientLock(async () => {
+  //   const midenClient = await getMidenClient(options);
+  //   return await midenClient.newTransaction(transaction.accountId, tr.serialize());
+  // });
+
+  // const transactionResult = TransactionResult.deserialize(transactionResultBytes);
+
+  // await withWasmClientLock(async () => {
+  //   const midenClient = await getMidenClient();
+  //   await midenClient.submitTransaction(transactionResultBytes, transaction.delegateTransaction);
+  // });
+
+  // switch (transaction.type) {
+  //   case 'send':
+  //     await completeSendTransaction(transaction as SendTransaction, transactionResult);
+  //     break;
+  //   case 'consume':
+  //     await completeConsumeTransaction(transaction.id, transactionResult);
+  //     break;
+  //   case 'execute':
+  //   default:
+  //     await completeCustomTransaction(transaction, transactionResult);
+  //     break;
+  // }
 
   await multisigService.sync();
 };
diff --git a/src/lib/miden/psm/account.ts b/src/lib/miden/psm/account.ts
index 0250e7fa1..51ee9e8d7 100644
--- a/src/lib/miden/psm/account.ts
+++ b/src/lib/miden/psm/account.ts
@@ -1,5 +1,5 @@
 import { Account, AuthSecretKey, WebClient } from '@miden-sdk/miden-sdk';
-import { createMultisigAccount, MultisigClient } from '@openzeppelin/miden-multisig-client';
+import { FalconSigner, MultisigClient } from '@openzeppelin/miden-multisig-client';
 
 import { DEFAULT_PSM_ENDPOINT } from 'lib/miden-chain/constants';
 import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
@@ -56,32 +56,33 @@ export async function createPsmAccount(webClient: WebClient, seed?: Uint8Array):
     const signerCommitment = sk.publicKey().toCommitment();
 
     // Get PSM endpoint and initialize client
-    const psmEndpoint = (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) || DEFAULT_PSM_ENDPOINT;
-    const client = new MultisigClient(webClient, { psmEndpoint });
-    const { psmCommitment, psmPublicKey } = await client.initialize('falcon');
-
-    console.log('Creating PSM account with PSM commitment:', psmCommitment);
-
+    const guardianEndpoint = (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) || DEFAULT_PSM_ENDPOINT;
+    const client = new MultisigClient(webClient, { guardianEndpoint });
+    const { commitment, pubkey } = await client.guardianClient.getPubkey();
     // Create the multisig account using the package utility
-    const { account } = await createMultisigAccount(webClient, {
-      threshold: 1,
-      signerCommitments: [signerCommitment.toHex()],
-      psmCommitment,
-      psmPublicKey,
-      psmEnabled: true,
-      storageMode: 'private',
-      signatureScheme: 'falcon'
-    });
-
+    const multisig = await client.create(
+      {
+        threshold: 1,
+        signerCommitments: [signerCommitment.toHex()],
+        guardianCommitment: commitment,
+        guardianPublicKey: pubkey,
+        guardianEnabled: true,
+        storageMode: 'private',
+        signatureScheme: 'falcon',
+        seed
+      },
+      new FalconSigner(sk)
+    );
+    await multisig.registerOnGuardian();
     // Sync state with the node
     await webClient.syncState();
 
     // Store the secret key in WebStore for signing
-    await webClient.addAccountSecretKeyToWebStore(account.id(), sk);
+    await webClient.addAccountSecretKeyToWebStore(multisig.account.id(), sk);
 
-    console.log('PSM account created:', account.id().toString());
+    console.log('PSM account created:', multisig.account.id().toString());
 
-    return account;
+    return multisig.account;
   } catch (e) {
     console.error('Error creating PSM account:', e);
     throw new Error('Failed to create PSM account');
diff --git a/src/lib/miden/psm/digest.ts b/src/lib/miden/psm/digest.ts
new file mode 100644
index 000000000..9a8fab4e9
--- /dev/null
+++ b/src/lib/miden/psm/digest.ts
@@ -0,0 +1,61 @@
+import { AccountId, Felt, FeltArray, Rpo256, Word } from '@miden-sdk/miden-sdk';
+import type { RequestAuthPayload } from '@openzeppelin/guardian-client';
+
+export class AuthDigest {
+  static fromAccountIdWithTimestamp(accountId: string, timestamp: number): Word {
+    const paddedHex = accountId.startsWith('0x') ? accountId : `0x${accountId}`;
+    const parsedAccountId = AccountId.fromHex(paddedHex);
+    const prefix = parsedAccountId.prefix();
+    const suffix = parsedAccountId.suffix();
+
+    const feltArray = new FeltArray([prefix, suffix, new Felt(BigInt(timestamp)), new Felt(0n)]);
+
+    return Rpo256.hashElements(feltArray);
+  }
+
+  static fromRequest(accountId: string, timestamp: number, requestPayload: RequestAuthPayload): Word {
+    return AuthDigest.fromAccountIdTimestampAndPayloadWord(
+      accountId,
+      timestamp,
+      AuthDigest.payloadWordFromBytes(requestPayload.toBytes())
+    );
+  }
+
+  private static fromAccountIdTimestampAndPayloadWord(accountId: string, timestamp: number, payloadWord: Word): Word {
+    const paddedHex = accountId.startsWith('0x') ? accountId : `0x${accountId}`;
+    const parsedAccountId = AccountId.fromHex(paddedHex);
+    const prefix = parsedAccountId.prefix();
+    const suffix = parsedAccountId.suffix();
+
+    const feltArray = new FeltArray([prefix, suffix, new Felt(BigInt(timestamp)), ...payloadWord.toFelts()]);
+
+    return Rpo256.hashElements(feltArray);
+  }
+
+  static fromCommitmentHex(commitmentHex: string): Word {
+    const paddedHex = commitmentHex.startsWith('0x') ? commitmentHex : `0x${commitmentHex}`;
+    const cleanHex = paddedHex.slice(2).padStart(64, '0');
+    return Word.fromHex(`0x${cleanHex}`);
+  }
+
+  private static emptyPayloadWord(): Word {
+    return Word.fromHex(`0x${'0'.repeat(64)}`);
+  }
+
+  private static payloadWordFromBytes(bytes: Uint8Array): Word {
+    if (bytes.length === 0) {
+      return AuthDigest.emptyPayloadWord();
+    }
+
+    const payloadElements: Felt[] = [];
+    for (let i = 0; i < bytes.length; i += 8) {
+      let packed = 0n;
+      for (let j = 0; j < 8 && i + j < bytes.length; j += 1) {
+        packed |= BigInt(bytes[i + j]) << (8n * BigInt(j));
+      }
+      payloadElements.push(new Felt(packed));
+    }
+
+    return Rpo256.hashElements(new FeltArray(payloadElements));
+  }
+}
diff --git a/src/lib/miden/psm/index.ts b/src/lib/miden/psm/index.ts
index 57021ed59..c49f49ffb 100644
--- a/src/lib/miden/psm/index.ts
+++ b/src/lib/miden/psm/index.ts
@@ -3,10 +3,10 @@ import {
   Multisig,
   MultisigClient,
   MultisigConfig,
-  PsmHttpClient,
+  GuardianHttpClient,
   type ProposalMetadata,
   type TransactionProposal,
-  type TransactionProposalResult
+  type Proposal
 } from '@openzeppelin/miden-multisig-client';
 
 import { DEFAULT_PSM_ENDPOINT } from 'lib/miden-chain/constants';
@@ -46,30 +46,13 @@ export class MultisigService {
   ): Promise<MultisigService> {
     try {
       const signer = new WalletSigner(publicKey, signerCommitment, signWordFn);
-      const psmEndpoint = (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) || DEFAULT_PSM_ENDPOINT;
+      const guardianEndpoint = (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) || DEFAULT_PSM_ENDPOINT;
 
       const webClient = (await MidenClientInterface.create({})).webClient;
 
-      const client = new MultisigClient(webClient, { psmEndpoint });
-      const { psmCommitment } = await client.initialize('falcon');
-
-      // Load the existing multisig account
-      let multisig: Multisig;
-      if (account.isNew()) {
-        console.log('Creating new Multisig for account:', account.id().toString());
-        const config: MultisigConfig = {
-          threshold: 1,
-          signerCommitments: [signerCommitment],
-          psmCommitment: psmCommitment,
-          psmEnabled: true
-        };
-        const psmClient = new PsmHttpClient(psmEndpoint);
-        psmClient.setSigner(signer);
-        multisig = new Multisig(account, config, psmClient, signer, webClient);
-        await multisig.registerOnPsm();
-      } else {
-        multisig = await client.load(account.id().toString(), signer);
-      }
+      const client = new MultisigClient(webClient, { guardianEndpoint });
+      const multisig = await client.load(account.id().toString(), signer);
+
       return new MultisigService(multisig, client);
     } catch (error) {
       console.log('Error initializing MultisigService:', error);
@@ -85,7 +68,7 @@ export class MultisigService {
     webClient: WebClient
   ) {
     const psmEndpoint = (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) || DEFAULT_PSM_ENDPOINT;
-    const psm = new PsmHttpClient(psmEndpoint);
+    const psm = new GuardianHttpClient(psmEndpoint);
     const signer = new WalletSigner(publicKey, signerCommitment, signWordFn);
     psm.setSigner(signer);
     try {
@@ -113,8 +96,8 @@ export class MultisigService {
   /**
    * Create a send (P2ID) transaction proposal.
    */
-  async createSendProposal(recipientId: string, faucetId: string, amount: bigint): Promise<TransactionProposalResult> {
-    return this.multisig.createSendProposal(
+  async createSendProposal(recipientId: string, faucetId: string, amount: bigint): Promise<Proposal> {
+    return this.multisig.createP2idProposal(
       accountIdStringToSdk(recipientId).toString(),
       accountIdStringToSdk(faucetId).toString(),
       amount
@@ -124,7 +107,7 @@ export class MultisigService {
   /**
    * Create a consume notes transaction proposal.
    */
-  async createConsumeNotesProposal(noteIds: string[]): Promise<TransactionProposalResult> {
+  async createConsumeNotesProposal(noteIds: string[]): Promise<Proposal> {
     return this.multisig.createConsumeNotesProposal(noteIds);
   }
 
@@ -132,7 +115,7 @@ export class MultisigService {
    * Create a custom transaction proposal from a TransactionSummary.
    * This is used for 'execute' type transactions.
    */
-  async createCustomProposal(summaryBytes: Uint8Array): Promise<TransactionProposalResult> {
+  async createCustomProposal(summaryBytes: Uint8Array): Promise<Proposal> {
     const txSummaryBase64 = u8ToB64(summaryBytes);
 
     // Sync state to ensure we have the latest nonce
@@ -151,24 +134,23 @@ export class MultisigService {
     };
 
     const proposal = await this.multisig.createProposal(nonce, txSummaryBase64, metadata);
-    const proposals = await this.multisig.syncTransactionProposals();
 
-    return { proposal, proposals };
+    return proposal;
   }
 
-  async signAndExecuteProposal(commitment: string): Promise<void> {
-    await this.multisig.signTransactionProposal(commitment);
-    await this.multisig.executeTransactionProposal(commitment);
+  async signAndExecuteProposal(id: string): Promise<void> {
+    await this.multisig.signProposal(id);
+    await this.multisig.executeProposal(id);
   }
 
-  async signAndCreateTransactionRequest(commitment: string): Promise<TransactionRequest> {
-    await this.multisig.signTransactionProposal(commitment);
-    return await this.multisig.createTransactionProposalRequest(commitment);
-  }
+  // async signAndCreateTransactionRequest(id: string): Promise<TransactionRequest> {
+  //   await this.multisig.signProposal(id);
+  //   return await this.multisig.
+  // }
 
   async sync(): Promise<void> {
     try {
-      await this.multisig.syncAll();
+      await this.multisig.syncState();
       this.syncRetryCount = 0; // Reset retry count on successful sync
     } catch (error) {
       const isNonceTooLow =
@@ -196,4 +178,4 @@ export class MultisigService {
 }
 
 // Re-export types that may be needed by consumers
-export type { TransactionProposal, TransactionProposalResult, ProposalMetadata };
+export type { TransactionProposal, ProposalMetadata };
diff --git a/src/lib/miden/psm/signer.ts b/src/lib/miden/psm/signer.ts
index bcd69f218..807f18faa 100644
--- a/src/lib/miden/psm/signer.ts
+++ b/src/lib/miden/psm/signer.ts
@@ -1,43 +1,35 @@
-import { AccountId, Felt, FeltArray, Rpo256, Word } from '@miden-sdk/miden-sdk';
-import { SignatureScheme, Signer } from '@openzeppelin/psm-client';
+import { RequestAuthPayload, SignatureScheme, Signer } from '@openzeppelin/guardian-client';
 
+import { AuthDigest } from './digest';
 export type SignWordFunction = (publicKey: string, wordHex: string) => Promise<string>;
 
 export class WalletSigner implements Signer {
   readonly commitment: string;
   readonly publicKey: string;
   readonly scheme: SignatureScheme = 'falcon';
-  private signWordFn: SignWordFunction;
-  readonly commitmentForStorageRetrieval: string;
+  private signWordFn: (wordHex: string) => Promise<string>;
 
   constructor(publicKey: string, commitment: string, signWordFn: SignWordFunction) {
     this.publicKey = publicKey;
     this.commitment = commitment;
-    this.commitmentForStorageRetrieval = commitment.slice(2);
-    this.signWordFn = signWordFn;
+    this.signWordFn = (wordHex: string) => signWordFn(commitment.slice(2), wordHex);
   }
 
   async signAccountIdWithTimestamp(accountId: string, timestamp: number): Promise<string> {
-    const digest = WalletSigner.computeAccountDigest(accountId, timestamp);
-    console.log('Signing account digest for storage retrieval', accountId);
-    const sig = await this.signWordFn(this.commitmentForStorageRetrieval, digest.toHex());
+    const digest = AuthDigest.fromAccountIdWithTimestamp(accountId, timestamp);
+    const sig = await this.signWordFn(digest.toHex());
+    console.log('Signature for accountId and timestamp:', sig);
     return sig;
   }
 
+  async signRequest(accountId: string, timestamp: number, requestPayload: RequestAuthPayload): Promise<string> {
+    const digest = AuthDigest.fromRequest(accountId, timestamp, requestPayload);
+    return this.signWordFn(digest.toHex());
+  }
+
   async signCommitment(commitmentHex: string): Promise<string> {
     const paddedHex = commitmentHex.startsWith('0x') ? commitmentHex : `0x${commitmentHex}`;
-    const sig = await this.signWordFn(this.commitmentForStorageRetrieval, paddedHex);
+    const sig = await this.signWordFn(paddedHex);
     return sig;
   }
-
-  static computeAccountDigest(accountId: string, timestamp: number): Word {
-    const paddedHex = accountId.startsWith('0x') ? accountId : `0x${accountId}`;
-    const parsedAccountId = AccountId.fromHex(paddedHex);
-    const prefix = parsedAccountId.prefix();
-    const suffix = parsedAccountId.suffix();
-
-    const feltArray = new FeltArray([prefix, suffix, new Felt(BigInt(timestamp)), new Felt(BigInt(0))]);
-
-    return Rpo256.hashElements(feltArray);
-  }
 }
diff --git a/test/state-helpers.ts b/test/state-helpers.ts
index b0d790cbe..093a49c97 100644
--- a/test/state-helpers.ts
+++ b/test/state-helpers.ts
@@ -1,6 +1,7 @@
-import { WalletMessageType, WalletStatus, GetStateResponse } from 'lib/shared/types';
-import { request } from 'lib/miden/front/client';
 import { IntercomClient } from 'lib/intercom';
+import { request } from 'lib/miden/front/client';
+import { WalletMessageType, WalletStatus, GetStateResponse } from 'lib/shared/types';
+import { WalletType } from 'screens/onboarding/types';
 
 export const PASSWORD = 'pw';
 export const MNEMONIC = 'test test test test test test test test test test test test';
@@ -50,7 +51,8 @@ export async function ensureWalletReady() {
           type: WalletMessageType.NewWalletRequest,
           password: PASSWORD,
           mnemonic: MNEMONIC,
-          ownMnemonic: true
+          ownMnemonic: true,
+          walletType: WalletType.OffChain
         })
       );
       return getState();
diff --git a/yarn.lock b/yarn.lock
index 0a908ce1a..11db2b9a8 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2155,7 +2155,7 @@
   dependencies:
     "@types/mdx" "^2.0.0"
 
-"@miden-sdk/miden-sdk@^0.13.0":
+"@miden-sdk/miden-sdk@0.13.0", "@miden-sdk/miden-sdk@^0.13.0":
   version "0.13.0"
   resolved "https://registry.yarnpkg.com/@miden-sdk/miden-sdk/-/miden-sdk-0.13.0.tgz#df7f639f90931d279761a62bb513374366d755e4"
   integrity sha512-N0qUCZW9Dvk3Oqj37IrGmm0b0v3Nq5qHsX3BtQIzZIwDXKXKPBxy/0lO40oCwDtwI8AfriZQyMLbJR81Fo4Vpg==
@@ -2190,7 +2190,14 @@
     "@svgr/webpack" "8.1.0"
     new-url-loader "0.1.1"
 
-"@noble/hashes@^1.4.0":
+"@noble/curves@^1.9.7":
+  version "1.9.7"
+  resolved "https://registry.yarnpkg.com/@noble/curves/-/curves-1.9.7.tgz#79d04b4758a43e4bca2cbdc62e7771352fa6b951"
+  integrity sha512-gbKGcRUYIjA3/zCCNaWDciTMFI0dCkvou3TL8Zmy5Nc7sJ47a0jtOeZoTaMxkuqRo9cRhjOdZJXegxYE5FN/xw==
+  dependencies:
+    "@noble/hashes" "1.8.0"
+
+"@noble/hashes@1.8.0", "@noble/hashes@^1.4.0":
   version "1.8.0"
   resolved "https://registry.yarnpkg.com/@noble/hashes/-/hashes-1.8.0.tgz#cee43d801fcef9644b11b8194857695acd5f815a"
   integrity sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==
@@ -2221,24 +2228,20 @@
     "@nodelib/fs.scandir" "2.1.5"
     fastq "^1.6.0"
 
-"@openzeppelin/miden-multisig-client@^0.13.1":
-  version "0.13.1"
-  resolved "https://registry.yarnpkg.com/@openzeppelin/miden-multisig-client/-/miden-multisig-client-0.13.1.tgz#da78637e0fb1397a5ba264a4a849ec9bfb094708"
-  integrity sha512-+potgpQgl4VE5CsXwqPyDuEHM0UY6ZvSATY8LBn0+3ZW8t4udIdLmsr7DzKDoUly6GSQWy8zNveCss/Buj/T8w==
+"@openzeppelin/guardian-client@^0.13.3":
+  version "0.13.3"
+  resolved "https://registry.yarnpkg.com/@openzeppelin/guardian-client/-/guardian-client-0.13.3.tgz#49f56d59c1aa20593cc201992ddbeaadd45b010c"
+  integrity sha512-YypaFbTh6WR5xjhn4hFRDUqvDDCHoMhf+cIsbpBF/t1AD3rpw1FkpkLaEYXSF7YQG42yYMKxtv+voX2XjihKTg==
+
+"@openzeppelin/miden-multisig-client@^0.13.3":
+  version "0.13.3"
+  resolved "https://registry.yarnpkg.com/@openzeppelin/miden-multisig-client/-/miden-multisig-client-0.13.3.tgz#1adf757a3d6dcc16ec1b1ffb5b7dacb8715d9fd6"
+  integrity sha512-Jolr9VREpv6xxLm639Cx8relQu6Bf2WipSLGRpw85M11IgbYZ0E0aSpLkEJ2YwUfvW6QZ+3ItVVIVdS2nz/0Fg==
   dependencies:
-    "@miden-sdk/miden-sdk" "^0.13.0"
+    "@miden-sdk/miden-sdk" "0.13.0"
+    "@noble/curves" "^1.9.7"
     "@noble/hashes" "^2.0.1"
-    "@openzeppelin/psm-client" "^0.13.1"
-
-"@openzeppelin/psm-client@^0.13.0":
-  version "0.13.0"
-  resolved "https://registry.yarnpkg.com/@openzeppelin/psm-client/-/psm-client-0.13.0.tgz#fe4df2282ddede6af451fdfe728e5733bf85f4c0"
-  integrity sha512-pf/b5CpWfVDbYBSXCDxyuRgbgrKNCB8Y/Bw9U2vW3DteUmfGdsCeCX+PprwVbTvNo1thfja1NzbEfkAvO9XLIw==
-
-"@openzeppelin/psm-client@^0.13.1":
-  version "0.13.1"
-  resolved "https://registry.yarnpkg.com/@openzeppelin/psm-client/-/psm-client-0.13.1.tgz#c7131e3eb9286edb3e156fc6847e17140d0a63f6"
-  integrity sha512-uUVw7qI7MtW3SUemX0a2JActTjCXojRPtIYPF7OQC7eIu01H9fpY/yqo8DBgQvkUS1wOssPueVVqVBqZEy6PHA==
+    "@openzeppelin/guardian-client" "^0.13.3"
 
 "@peculiar/asn1-schema@^2.0.27", "@peculiar/asn1-schema@^2.3.13":
   version "2.6.0"

From 39eba6bda1ce53b3673fe96202a5f496aad3301a Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Tue, 24 Mar 2026 22:35:36 +0530
Subject: [PATCH 13/71] chore: bump up versions

---
 package.json                           |  4 +-
 src/lib/miden-chain/constants.ts       |  4 +-
 src/lib/miden/activity/transactions.ts | 73 ++++++++++++--------------
 src/lib/miden/psm/index.ts             |  8 +--
 yarn.lock                              | 18 +++----
 5 files changed, 52 insertions(+), 55 deletions(-)

diff --git a/package.json b/package.json
index 76562166e..586a1d3e4 100644
--- a/package.json
+++ b/package.json
@@ -83,8 +83,8 @@
     "@miden-sdk/miden-sdk": "^0.13.0",
     "@newhighsco/storybook-addon-svgr": "^2.0.7",
     "@noble/hashes": "^1.4.0",
-    "@openzeppelin/guardian-client": "^0.13.3",
-    "@openzeppelin/miden-multisig-client": "^0.13.3",
+    "@openzeppelin/guardian-client": "^0.13.4",
+    "@openzeppelin/miden-multisig-client": "^0.13.4",
     "@peculiar/webcrypto": "1.1.6",
     "@radix-ui/react-slot": "^1.2.3",
     "@segment/analytics-node": "^2.3.0",
diff --git a/src/lib/miden-chain/constants.ts b/src/lib/miden-chain/constants.ts
index 332674384..850feab48 100644
--- a/src/lib/miden-chain/constants.ts
+++ b/src/lib/miden-chain/constants.ts
@@ -34,7 +34,7 @@ export const MIDEN_FAUCET_ENDPOINTS = new Map<string, string>([
 ]);
 
 export const MIDEN_NOTE_TRANSPORT_LAYER_ENDPOINTS = new Map<string, string>([
-  [MIDEN_NETWORK_NAME.TESTNET, 'http://127.0.0.1:57292'],
+  [MIDEN_NETWORK_NAME.TESTNET, 'https://transport.miden.io'],
   [MIDEN_NETWORK_NAME.LOCALNET, 'http://127.0.0.1:57292']
 ]);
 
@@ -62,4 +62,4 @@ export const TOKEN_MAPPING = {
   [MidenTokens.Miden]: { faucetId: 'mtst1aqmat9m63ctdsgz6xcyzpuprpulwk9vg_qruqqypuyph' }
 };
 
-export const DEFAULT_PSM_ENDPOINT = 'http://localhost:3000';
+export const DEFAULT_PSM_ENDPOINT = 'https://psm-stg.openzeppelin.com';
diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index b5166c723..ec1e8dda8 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -729,45 +729,42 @@ const generatePsmTransaction = async (
     }
   }
 
-  // Get the proposal commitment for signing and execution
-  await multisigService.signAndExecuteProposal(proposalResult.id);
-
   // Sign and execute the proposal
-  // const tr = await multisigService.signAndCreateTransactionRequest(proposalCommitment);
-
-  // const options: MidenClientCreateOptions = {
-  //   signCallback: async (publicKey: Uint8Array, signingInputs: Uint8Array) => {
-  //     const keyString = Buffer.from(publicKey).toString('hex');
-  //     const signingInputsString = Buffer.from(signingInputs).toString('hex');
-  //     return await signCallback(keyString, signingInputsString);
-  //   }
-  // };
-
-  // // Wrap WASM client operations in a lock to prevent concurrent access
-  // const transactionResultBytes = await withWasmClientLock(async () => {
-  //   const midenClient = await getMidenClient(options);
-  //   return await midenClient.newTransaction(transaction.accountId, tr.serialize());
-  // });
-
-  // const transactionResult = TransactionResult.deserialize(transactionResultBytes);
-
-  // await withWasmClientLock(async () => {
-  //   const midenClient = await getMidenClient();
-  //   await midenClient.submitTransaction(transactionResultBytes, transaction.delegateTransaction);
-  // });
-
-  // switch (transaction.type) {
-  //   case 'send':
-  //     await completeSendTransaction(transaction as SendTransaction, transactionResult);
-  //     break;
-  //   case 'consume':
-  //     await completeConsumeTransaction(transaction.id, transactionResult);
-  //     break;
-  //   case 'execute':
-  //   default:
-  //     await completeCustomTransaction(transaction, transactionResult);
-  //     break;
-  // }
+  const tr = await multisigService.signAndCreateTransactionRequest(proposalResult.id);
+
+  const options: MidenClientCreateOptions = {
+    signCallback: async (publicKey: Uint8Array, signingInputs: Uint8Array) => {
+      const keyString = Buffer.from(publicKey).toString('hex');
+      const signingInputsString = Buffer.from(signingInputs).toString('hex');
+      return await signCallback(keyString, signingInputsString);
+    }
+  };
+
+  // Wrap WASM client operations in a lock to prevent concurrent access
+  const transactionResultBytes = await withWasmClientLock(async () => {
+    const midenClient = await getMidenClient(options);
+    return await midenClient.newTransaction(transaction.accountId, tr.serialize());
+  });
+
+  const transactionResult = TransactionResult.deserialize(transactionResultBytes);
+
+  await withWasmClientLock(async () => {
+    const midenClient = await getMidenClient();
+    await midenClient.submitTransaction(transactionResultBytes, transaction.delegateTransaction);
+  });
+
+  switch (transaction.type) {
+    case 'send':
+      await completeSendTransaction(transaction as SendTransaction, transactionResult);
+      break;
+    case 'consume':
+      await completeConsumeTransaction(transaction.id, transactionResult);
+      break;
+    case 'execute':
+    default:
+      await completeCustomTransaction(transaction, transactionResult);
+      break;
+  }
 
   await multisigService.sync();
 };
diff --git a/src/lib/miden/psm/index.ts b/src/lib/miden/psm/index.ts
index c49f49ffb..3f2a7161c 100644
--- a/src/lib/miden/psm/index.ts
+++ b/src/lib/miden/psm/index.ts
@@ -143,10 +143,10 @@ export class MultisigService {
     await this.multisig.executeProposal(id);
   }
 
-  // async signAndCreateTransactionRequest(id: string): Promise<TransactionRequest> {
-  //   await this.multisig.signProposal(id);
-  //   return await this.multisig.
-  // }
+  async signAndCreateTransactionRequest(id: string): Promise<TransactionRequest> {
+    await this.multisig.signProposal(id);
+    return await this.multisig.createTransactionProposalRequest(id);
+  }
 
   async sync(): Promise<void> {
     try {
diff --git a/yarn.lock b/yarn.lock
index 11db2b9a8..36fa35281 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2228,20 +2228,20 @@
     "@nodelib/fs.scandir" "2.1.5"
     fastq "^1.6.0"
 
-"@openzeppelin/guardian-client@^0.13.3":
-  version "0.13.3"
-  resolved "https://registry.yarnpkg.com/@openzeppelin/guardian-client/-/guardian-client-0.13.3.tgz#49f56d59c1aa20593cc201992ddbeaadd45b010c"
-  integrity sha512-YypaFbTh6WR5xjhn4hFRDUqvDDCHoMhf+cIsbpBF/t1AD3rpw1FkpkLaEYXSF7YQG42yYMKxtv+voX2XjihKTg==
+"@openzeppelin/guardian-client@^0.13.4":
+  version "0.13.4"
+  resolved "https://registry.yarnpkg.com/@openzeppelin/guardian-client/-/guardian-client-0.13.4.tgz#7e1f419e14437ee329c1484df7050b84a51f3b9d"
+  integrity sha512-YMmeBfTOXy2DklfmLW4L7A2OAnzfxGgBZTDXi5XJUKY00E91xfdFkkK3Cgde2ydmFDdy5MYxtF/cyROv5ikJBQ==
 
-"@openzeppelin/miden-multisig-client@^0.13.3":
-  version "0.13.3"
-  resolved "https://registry.yarnpkg.com/@openzeppelin/miden-multisig-client/-/miden-multisig-client-0.13.3.tgz#1adf757a3d6dcc16ec1b1ffb5b7dacb8715d9fd6"
-  integrity sha512-Jolr9VREpv6xxLm639Cx8relQu6Bf2WipSLGRpw85M11IgbYZ0E0aSpLkEJ2YwUfvW6QZ+3ItVVIVdS2nz/0Fg==
+"@openzeppelin/miden-multisig-client@^0.13.4":
+  version "0.13.4"
+  resolved "https://registry.yarnpkg.com/@openzeppelin/miden-multisig-client/-/miden-multisig-client-0.13.4.tgz#41a5431b03d32939012c388ead208271d204d889"
+  integrity sha512-A4BhB5Rc3Y/wqsBPKe4nEmQE2ZnnwVoVRpyROp5+qg0jx3XFrjqn3e5CKZz0hC1b5ybb1d2RdTGLLmpIZshekA==
   dependencies:
     "@miden-sdk/miden-sdk" "0.13.0"
     "@noble/curves" "^1.9.7"
     "@noble/hashes" "^2.0.1"
-    "@openzeppelin/guardian-client" "^0.13.3"
+    "@openzeppelin/guardian-client" "^0.13.4"
 
 "@peculiar/asn1-schema@^2.0.27", "@peculiar/asn1-schema@^2.3.13":
   version "2.6.0"

From 2c31050c7aaed38cb03079c887614dd41b43f03d Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Thu, 26 Mar 2026 01:55:58 +0530
Subject: [PATCH 14/71] fix: move psm sync to frontend

---
 src/lib/miden/front/autoSync.ts       | 11 +++++++++--
 src/lib/miden/front/useSyncTrigger.ts | 24 ++++++++++++++++++++++--
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/src/lib/miden/front/autoSync.ts b/src/lib/miden/front/autoSync.ts
index 0af2d55d8..ac72107e7 100644
--- a/src/lib/miden/front/autoSync.ts
+++ b/src/lib/miden/front/autoSync.ts
@@ -1,6 +1,7 @@
 import { isMobile } from 'lib/platform';
 import { WalletState, WalletStatus } from 'lib/shared/types';
 import { useWalletStore } from 'lib/store';
+import { WalletType } from 'screens/onboarding/types';
 
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 import { syncPsmAccounts } from './psm-manager';
@@ -114,8 +115,14 @@ export class Sync {
 
         // Sync PSM state after chain sync (runs outside WASM lock — HTTP calls only)
         try {
-          console.log('[AutoSync] Syncing PSM accounts...');
-          await syncPsmAccounts();
+          const psmAccountKeys = useWalletStore
+            .getState()
+            .accounts.filter(acc => acc.type === WalletType.Psm)
+            .map(acc => acc.publicKey);
+          if (psmAccountKeys.length > 0) {
+            console.log('[AutoSync] Syncing PSM accounts...');
+            await syncPsmAccounts(psmAccountKeys);
+          }
         } catch (psmError) {
           console.error('[AutoSync] PSM sync error:', psmError);
         }
diff --git a/src/lib/miden/front/useSyncTrigger.ts b/src/lib/miden/front/useSyncTrigger.ts
index 3e92da571..059fff63f 100644
--- a/src/lib/miden/front/useSyncTrigger.ts
+++ b/src/lib/miden/front/useSyncTrigger.ts
@@ -3,14 +3,34 @@ import { useEffect } from 'react';
 import { isExtension } from 'lib/platform';
 import { WalletMessageType, WalletStatus } from 'lib/shared/types';
 import { getIntercom, useWalletStore } from 'lib/store';
+import { WalletType } from 'screens/onboarding/types';
+
+import { syncPsmAccounts } from './psm-manager';
 
 const SYNC_INTERVAL_MS = 3_000;
 
+function triggerSync(intercom: ReturnType<typeof getIntercom>) {
+  intercom
+    .request({ type: WalletMessageType.SyncRequest })
+    .then(() => {
+      // PSM sync runs in the frontend where the wallet is unlocked and signWord is available
+      const psmAccountKeys = useWalletStore
+        .getState()
+        .accounts.filter(acc => acc.type === WalletType.Psm)
+        .map(acc => acc.publicKey);
+      if (psmAccountKeys.length > 0) {
+        syncPsmAccounts().catch(() => {});
+      }
+    })
+    .catch(() => {});
+}
+
 /**
  * On extension only: sends SyncRequest to the service worker every 3s.
  *
  * The service worker runs syncState() on its warm WASM client and broadcasts
  * SyncCompleted with notes + balances data. The frontend reads from Zustand only.
+ * After each chain sync, PSM accounts are synced in the frontend context.
  */
 export function useSyncTrigger() {
   const status = useWalletStore(s => s.status);
@@ -22,11 +42,11 @@ export function useSyncTrigger() {
     const intercom = getIntercom();
 
     const timer = setInterval(() => {
-      intercom.request({ type: WalletMessageType.SyncRequest }).catch(() => {});
+      triggerSync(intercom);
     }, SYNC_INTERVAL_MS);
 
     // Fire immediately
-    intercom.request({ type: WalletMessageType.SyncRequest }).catch(() => {});
+    triggerSync(intercom);
 
     return () => clearInterval(timer);
   }, [status]);

From 8950d2029cbe67f5b29cd6d43166574d1f376183 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Wed, 25 Mar 2026 20:31:09 +0000
Subject: [PATCH 15/71] chore: update translation files

---
 public/_locales/de/messages.json    | 8 ++++++++
 public/_locales/en/messages.json    | 8 ++++++++
 public/_locales/en_GB/messages.json | 8 ++++++++
 public/_locales/es/messages.json    | 8 ++++++++
 public/_locales/fr/messages.json    | 8 ++++++++
 public/_locales/ja/messages.json    | 8 ++++++++
 public/_locales/ko/messages.json    | 8 ++++++++
 public/_locales/pl/messages.json    | 8 ++++++++
 public/_locales/pt/messages.json    | 8 ++++++++
 public/_locales/ru/messages.json    | 8 ++++++++
 public/_locales/tr/messages.json    | 8 ++++++++
 public/_locales/uk/messages.json    | 8 ++++++++
 public/_locales/zh_CN/messages.json | 8 ++++++++
 public/_locales/zh_TW/messages.json | 8 ++++++++
 14 files changed, 112 insertions(+)

diff --git a/public/_locales/de/messages.json b/public/_locales/de/messages.json
index 245af893e..3afdb0d52 100644
--- a/public/_locales/de/messages.json
+++ b/public/_locales/de/messages.json
@@ -1803,6 +1803,14 @@
     "message": "Nur lokal, niemand außer Ihnen sieht Ihren Status, aber keine Wiederherstellung. Der Verlust Ihres Geräts führt zum dauerhaften Verlust Ihres Geldes.",
     "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
   },
+  "publicAccountRecovery": {
+    "message": "Öffentlich",
+    "englishSource": "Public"
+  },
+  "publicAccountRecoveryDescription": {
+    "message": "Stellen Sie ein öffentliches On-Chain-Konto wieder her.",
+    "englishSource": "Recover a public on-chain account."
+  },
   "default": {
     "message": "Standard",
     "englishSource": "Default"
diff --git a/public/_locales/en/messages.json b/public/_locales/en/messages.json
index ba2324ca5..627d998f1 100644
--- a/public/_locales/en/messages.json
+++ b/public/_locales/en/messages.json
@@ -1767,6 +1767,14 @@
     "message": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds.",
     "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
   },
+  "publicAccountRecovery": {
+    "message": "Public",
+    "englishSource": "Public"
+  },
+  "publicAccountRecoveryDescription": {
+    "message": "Recover a public on-chain account.",
+    "englishSource": "Recover a public on-chain account."
+  },
   "default": {
     "message": "Default",
     "englishSource": "Default"
diff --git a/public/_locales/en_GB/messages.json b/public/_locales/en_GB/messages.json
index 792610bd5..1f0730eb3 100644
--- a/public/_locales/en_GB/messages.json
+++ b/public/_locales/en_GB/messages.json
@@ -1831,6 +1831,14 @@
     "message": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds.",
     "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
   },
+  "publicAccountRecovery": {
+    "message": "Public",
+    "englishSource": "Public"
+  },
+  "publicAccountRecoveryDescription": {
+    "message": "Recover a public on-chain account.",
+    "englishSource": "Recover a public on-chain account."
+  },
   "default": {
     "message": "Default",
     "englishSource": "Default"
diff --git a/public/_locales/es/messages.json b/public/_locales/es/messages.json
index 0762a10ad..d6d90044f 100644
--- a/public/_locales/es/messages.json
+++ b/public/_locales/es/messages.json
@@ -1740,6 +1740,14 @@
     "message": "Solo local, nadie ve su estado excepto usted, pero no hay recuperación; perder su dispositivo resultará en la pérdida permanente de sus fondos.",
     "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
   },
+  "publicAccountRecovery": {
+    "message": "Público",
+    "englishSource": "Public"
+  },
+  "publicAccountRecoveryDescription": {
+    "message": "Recuperar una cuenta pública en cadena.",
+    "englishSource": "Recover a public on-chain account."
+  },
   "default": {
     "message": "Por defecto",
     "englishSource": "Default"
diff --git a/public/_locales/fr/messages.json b/public/_locales/fr/messages.json
index 4a817a5cd..2fa46fddd 100644
--- a/public/_locales/fr/messages.json
+++ b/public/_locales/fr/messages.json
@@ -1802,6 +1802,14 @@
     "message": "Local uniquement, personne ne voit votre état sauf vous mais pas de récupération, la perte de votre appareil entraînera une perte permanente de vos fonds.",
     "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
   },
+  "publicAccountRecovery": {
+    "message": "Publique",
+    "englishSource": "Public"
+  },
+  "publicAccountRecoveryDescription": {
+    "message": "Récupérez un compte public en chaîne.",
+    "englishSource": "Recover a public on-chain account."
+  },
   "default": {
     "message": "Défaut",
     "englishSource": "Default"
diff --git a/public/_locales/ja/messages.json b/public/_locales/ja/messages.json
index e3c8c7afe..a1eddb313 100644
--- a/public/_locales/ja/messages.json
+++ b/public/_locales/ja/messages.json
@@ -1803,6 +1803,14 @@
     "message": "ローカルのみ、あなた以外の誰もあなたの状態を見ることはできませんが、回復はできません。デバイスを失うと資金が永久に失われます。",
     "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
   },
+  "publicAccountRecovery": {
+    "message": "公共",
+    "englishSource": "Public"
+  },
+  "publicAccountRecoveryDescription": {
+    "message": "公開オンチェーン アカウントを回復します。",
+    "englishSource": "Recover a public on-chain account."
+  },
   "default": {
     "message": "デフォルト",
     "englishSource": "Default"
diff --git a/public/_locales/ko/messages.json b/public/_locales/ko/messages.json
index 7742924ad..541b2b152 100644
--- a/public/_locales/ko/messages.json
+++ b/public/_locales/ko/messages.json
@@ -1803,6 +1803,14 @@
     "message": "로컬에서만 가능하며 귀하 외에는 누구도 귀하의 상태를 볼 수 없지만 복구할 수는 없습니다. 장치를 분실하면 자금이 영구적으로 손실됩니다.",
     "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
   },
+  "publicAccountRecovery": {
+    "message": "공공의",
+    "englishSource": "Public"
+  },
+  "publicAccountRecoveryDescription": {
+    "message": "공개 온체인 계정을 복구하세요.",
+    "englishSource": "Recover a public on-chain account."
+  },
   "default": {
     "message": "기본",
     "englishSource": "Default"
diff --git a/public/_locales/pl/messages.json b/public/_locales/pl/messages.json
index 2766db6ae..11b7e2ebd 100644
--- a/public/_locales/pl/messages.json
+++ b/public/_locales/pl/messages.json
@@ -1740,6 +1740,14 @@
     "message": "Tylko lokalnie, nikt poza Tobą nie widzi Twojego stanu, ale nie ma możliwości odzyskania urządzenia. Utrata urządzenia spowoduje trwałą utratę środków.",
     "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
   },
+  "publicAccountRecovery": {
+    "message": "Publiczny",
+    "englishSource": "Public"
+  },
+  "publicAccountRecoveryDescription": {
+    "message": "Odzyskaj publiczne konto w sieci.",
+    "englishSource": "Recover a public on-chain account."
+  },
   "default": {
     "message": "Domyślny",
     "englishSource": "Default"
diff --git a/public/_locales/pt/messages.json b/public/_locales/pt/messages.json
index 3fbd65334..afd6377aa 100644
--- a/public/_locales/pt/messages.json
+++ b/public/_locales/pt/messages.json
@@ -1801,6 +1801,14 @@
     "message": "Somente local, ninguém vê seu estado, exceto você, mas não há recuperação. A perda do seu dispositivo resultará na perda permanente de seus fundos.",
     "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
   },
+  "publicAccountRecovery": {
+    "message": "Público",
+    "englishSource": "Public"
+  },
+  "publicAccountRecoveryDescription": {
+    "message": "Recupere uma conta pública na rede.",
+    "englishSource": "Recover a public on-chain account."
+  },
   "default": {
     "message": "Padrão",
     "englishSource": "Default"
diff --git a/public/_locales/ru/messages.json b/public/_locales/ru/messages.json
index 7c827c3f2..ca7aa2841 100644
--- a/public/_locales/ru/messages.json
+++ b/public/_locales/ru/messages.json
@@ -1804,6 +1804,14 @@
     "message": "Только локально, никто, кроме вас, не видит ваше состояние, но восстановления нет, потеря устройства приведет к безвозвратной потере ваших средств.",
     "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
   },
+  "publicAccountRecovery": {
+    "message": "Общественный",
+    "englishSource": "Public"
+  },
+  "publicAccountRecoveryDescription": {
+    "message": "Восстановите общедоступную учетную запись в сети.",
+    "englishSource": "Recover a public on-chain account."
+  },
   "default": {
     "message": "По умолчанию",
     "englishSource": "Default"
diff --git a/public/_locales/tr/messages.json b/public/_locales/tr/messages.json
index fb2a71940..6958e3ff8 100644
--- a/public/_locales/tr/messages.json
+++ b/public/_locales/tr/messages.json
@@ -1803,6 +1803,14 @@
     "message": "Yalnızca yerel, durumunuzu sizden başka kimse göremez ancak iyileşme olmaz, cihazınızı kaybetmek, paranızın kalıcı olarak kaybolmasına neden olur.",
     "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
   },
+  "publicAccountRecovery": {
+    "message": "Halk",
+    "englishSource": "Public"
+  },
+  "publicAccountRecoveryDescription": {
+    "message": "Herkese açık bir zincir içi hesabı kurtarın.",
+    "englishSource": "Recover a public on-chain account."
+  },
   "default": {
     "message": "Varsayılan",
     "englishSource": "Default"
diff --git a/public/_locales/uk/messages.json b/public/_locales/uk/messages.json
index edd4f4332..803fdcd98 100644
--- a/public/_locales/uk/messages.json
+++ b/public/_locales/uk/messages.json
@@ -1804,6 +1804,14 @@
     "message": "Лише локально, ніхто не бачить ваш стан, крім вас, але відновлення не відбувається, втрата пристрою призведе до остаточної втрати ваших коштів.",
     "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
   },
+  "publicAccountRecovery": {
+    "message": "Громадський",
+    "englishSource": "Public"
+  },
+  "publicAccountRecoveryDescription": {
+    "message": "Відновіть загальнодоступний обліковий запис у мережі.",
+    "englishSource": "Recover a public on-chain account."
+  },
   "default": {
     "message": "За замовчуванням",
     "englishSource": "Default"
diff --git a/public/_locales/zh_CN/messages.json b/public/_locales/zh_CN/messages.json
index 2310f8da4..38ee03ca1 100644
--- a/public/_locales/zh_CN/messages.json
+++ b/public/_locales/zh_CN/messages.json
@@ -1803,6 +1803,14 @@
     "message": "仅限本地，除了您之外没有人看到您的状态，但无法恢复，丢失您的设备将导致您的资金永久丢失。",
     "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
   },
+  "publicAccountRecovery": {
+    "message": "民众",
+    "englishSource": "Public"
+  },
+  "publicAccountRecoveryDescription": {
+    "message": "恢复公共链上账户。",
+    "englishSource": "Recover a public on-chain account."
+  },
   "default": {
     "message": "默认",
     "englishSource": "Default"
diff --git a/public/_locales/zh_TW/messages.json b/public/_locales/zh_TW/messages.json
index 1ea7b633e..5df86fbaa 100644
--- a/public/_locales/zh_TW/messages.json
+++ b/public/_locales/zh_TW/messages.json
@@ -1803,6 +1803,14 @@
     "message": "仅限本地，除了您之外没有人看到您的状态，但无法恢复，丢失您的设备将导致您的资金永久丢失。",
     "englishSource": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds."
   },
+  "publicAccountRecovery": {
+    "message": "民众",
+    "englishSource": "Public"
+  },
+  "publicAccountRecoveryDescription": {
+    "message": "恢复公共链上账户。",
+    "englishSource": "Recover a public on-chain account."
+  },
   "default": {
     "message": "默认",
     "englishSource": "Default"

From 79074fe8782efbf6ccd34292a43a593063861fff Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Sun, 19 Apr 2026 10:03:42 +0530
Subject: [PATCH 16/71] feat: bump up deps, make guardian work on mobile, make
 sync work for imported accounts

---
 CLAUDE.md                                   | 1283 ++-----------------
 package.json                                |   12 +-
 src/lib/intercom/mobile-adapter.ts          |   71 +-
 src/lib/miden-chain/constants.ts            |    2 +-
 src/lib/miden/activity/transactions.ts      |   61 +-
 src/lib/miden/psm/account.ts                |   22 +-
 src/lib/miden/psm/digest.ts                 |    2 +-
 src/lib/miden/psm/index.ts                  |   36 +-
 src/lib/miden/sdk/helpers.ts                |    4 +
 src/lib/miden/sdk/miden-client-interface.ts |   30 +-
 src/lib/miden/sdk/miden-client.ts           |   10 +-
 vite.extension.config.ts                    |   99 +-
 yarn.lock                                   |   37 +-
 13 files changed, 333 insertions(+), 1336 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 01e2db2a2..8bf19a6d1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,1240 +1,181 @@
 # CLAUDE.md
 
-This file provides guidance for Claude Code when working on this repository.
+Guidance for Claude Code. **Self-maintaining:** update proactively when you learn a gotcha, pattern, or debugging trick worth keeping.
 
-**Self-maintaining document:** Proactively update this file when you learn something worth remembering - new patterns, gotchas, debugging techniques, or project-specific knowledge. Don't wait to be asked.
+## Project
 
-## Project Overview
+Miden Wallet: Chrome/Firefox extension + iOS/Android (Capacitor) + macOS (Tauri). React + Zustand frontend; service-worker backend (Effector store + vault). Backend is source of truth; frontend syncs via intercom port messaging.
 
-Miden Wallet is a browser extension wallet for the Miden blockchain, also available as a mobile app for iOS and Android. The browser version is built as a Chrome/Firefox extension with a React frontend and a service worker backend. The mobile app uses Capacitor to wrap the web app in a native shell.
-
-## Architecture
-
-```
-┌─────────────────────────────────────────────────────────┐
-│                    Browser Extension                     │
-├─────────────────────────┬───────────────────────────────┤
-│   Frontend (Popup/Tab)  │   Backend (Service Worker)    │
-│                         │                               │
-│   React + Zustand       │   Effector Store              │
-│   - UI Components       │   - Vault (secure storage)    │
-│   - State management    │   - Wallet operations         │
-│                         │                               │
-│         ◄──── Intercom (Port messaging) ────►           │
-└─────────────────────────┴───────────────────────────────┘
-```
-
-**Key principle:** Backend is the source of truth. Frontend syncs via intercom messaging.
-
-## Key Directories
+## Layout
 
 ```
 src/
 ├── lib/
-│   ├── store/           # Zustand store (frontend state)
-│   ├── miden/
-│   │   ├── back/        # Backend: Effector store, vault, actions
-│   │   ├── front/       # Frontend: hooks, providers, client
-│   │   └── sdk/         # Miden SDK integration
-│   ├── intercom/        # Port-based messaging between frontend/backend
-│   └── shared/types.ts  # Shared type definitions
-├── app/                 # React app entry, pages, templates
-├── screens/             # Screen components (onboarding, send, etc.)
-└── workers/             # Background service worker entry
+│   ├── store/           # Zustand (frontend)
+│   ├── miden/{back,front,sdk,psm}
+│   ├── intercom/        # port messaging
+│   ├── platform/        # isMobile/isIOS/isAndroid/isExtension
+│   ├── mobile/          # haptics, back-handler
+│   ├── woozie/          # router (navigate, goBack, useLocation, <Link>)
+│   └── shared/types.ts
+├── app/ | screens/ | workers/
+src-tauri/               # desktop
+playwright/e2e/          # E2E harness (chrome + ios)
 ```
 
-## Key Modules
-
-Quick reference for commonly needed utilities:
-
-| Module | Path | Exports |
-|--------|------|---------|
-| Platform detection | `lib/platform` | `isMobile()`, `isIOS()`, `isAndroid()`, `isExtension()` |
-| Haptic feedback | `lib/mobile/haptics` | `hapticLight()`, `hapticMedium()`, `hapticSelection()` |
-| Mobile back handler | `lib/mobile/back-handler` | `initMobileBackHandler()`, `useMobileBackHandler()` |
-| Navigation (Woozie) | `lib/woozie` | `navigate()`, `goBack()`, `useLocation()`, `<Link>` |
-| App environment | `app/env` | `useAppEnv()`, `registerBackHandler()`, `onBack()` |
-
 ## Commands
 
 ```bash
-yarn install          # Install dependencies
-yarn build            # Build extension (outputs to dist/)
-yarn dev              # Development build with watch
-yarn test             # Run Jest tests
-yarn lint             # ESLint
-yarn format           # Prettier
+yarn dev | build | test | lint | format
+yarn build:devnet        # network-specific extension build
+yarn mobile:ios:run[:devnet]     # iOS simulator (iPhone 17 default)
+yarn mobile:android
+yarn tauri dev
+yarn test:e2e:blockchain:{testnet,devnet,localhost}
+yarn test:e2e:mobile:{devnet,testnet}
 ```
 
-**IMPORTANT:** Always run `yarn lint` and `yarn format` before `yarn build`. The build will fail on lint/prettier errors.
-
-## Version Bumping
-
-**CRITICAL:** The extension manifest version is controlled by `package.json`'s `version` field, NOT by `public/manifest.json`. The webpack build (`webpack.public.config.js:69-70`) overrides the manifest version with `pkg.version` from `package.json` during the copy transform.
+Node >=22 for Capacitor/Tauri: `source ~/.nvm/nvm.sh && nvm use 22`.
 
-When bumping the version:
-1. Update **both** `package.json` (`"version": "X.Y.Z"`) and `public/manifest.json` (`"version": "X.Y.Z"`) to keep them in sync
-2. Clear webpack cache: `rm -rf node_modules/.cache/webpack`
-3. Build: `yarn build:devnet` (or whichever build target)
-4. **Verify** the output manifest has the correct version: `grep '"version"' dist/chrome_unpacked/manifest.json`
+Lint/format only before commit or when asked — not every build.
 
-If the output still shows the old version, the webpack filesystem cache is stale — delete `node_modules/.cache/webpack` and `dist/` and rebuild.
-
-## Mobile Development
-
-**IMPORTANT:** Always use these yarn scripts for mobile development. Do not run Capacitor or Xcode commands directly.
-
-**IMPORTANT:** When testing mobile changes, always build and run the simulator yourself. Never tell the user to build/test changes themselves - do it for them.
-
-**iOS Simulator:** Always use **iPhone 17** as the default simulator for testing.
-
-**Node version:** Capacitor CLI requires Node >= 22. Use nvm to switch:
-```bash
-source ~/.nvm/nvm.sh && nvm use 22 && yarn mobile:ios:run
-# or for Android:
-source ~/.nvm/nvm.sh && nvm use 22 && yarn mobile:android
-```
-
-### iOS
-
-```bash
-yarn mobile:ios                  # Build, sync, and open in Xcode
-yarn mobile:ios:run              # Build and run on iOS Simulator (default network)
-yarn mobile:ios:run:devnet       # Same but explicitly targets devnet
-yarn mobile:ios:build            # Build for iOS Simulator only
-yarn mobile:ios:build:devnet     # Same, devnet
-yarn mobile:ios:faceid           # Fix FaceID enrollment on simulator
-```
+## Version bumps
 
-`MIDEN_NETWORK` is baked into the bundle at compile time, so network selection happens at build, not runtime. The `:devnet` variants just set `MIDEN_NETWORK=devnet` for you.
-
-### Android
-
-```bash
-yarn mobile:android              # Build, sync, and open in Android Studio
-yarn mobile:android:fingerprint  # Trigger fingerprint auth on emulator
-```
-
-### Build Only
-
-```bash
-yarn build:mobile         # Production build for mobile (outputs to dist/mobile/)
-yarn build:mobile:dev     # Development build for mobile
-yarn mobile:sync          # Build and sync with Capacitor (no IDE open)
-```
-
-### Release Builds
-
-```bash
-# Android
-yarn mobile:android:keystore     # Generate release keystore (one-time)
-yarn mobile:android:release      # Build AAB for Play Store
-yarn mobile:android:release:apk  # Build APK for direct distribution
-
-# iOS
-yarn mobile:ios:release          # Build release archive
-yarn mobile:ios:export           # Export IPA for App Store
-```
-
-See `STORE_LISTING.md` for full app store submission checklist and instructions.
-
-### Build Output Locations
-
-**Android APKs/AABs** are output to `android/app/build/outputs/`:
-```
-android/app/build/outputs/
-├── apk/
-│   ├── debug/app-debug.apk       # Debug APK (yarn mobile:sync && cd android && ./gradlew assembleDebug)
-│   └── release/app-release.apk   # Release APK (yarn mobile:android:release:apk)
-└── bundle/
-    └── release/app-release.aab   # Release AAB (yarn mobile:android:release)
-```
-
-**iOS archives** are output to `ios/App/build/`:
-```
-ios/App/build/
-├── MidenWallet.xcarchive         # Release archive (yarn mobile:ios:release)
-└── export/                       # Exported IPA (yarn mobile:ios:export)
-```
+Extension manifest version comes from `package.json`, NOT `public/manifest.json` (webpack overrides it at `webpack.public.config.js:69-70`). Update **both** to keep in sync, then `rm -rf node_modules/.cache/webpack dist/` if the old version sticks.
 
-### Workflow
-
-1. Make code changes in `src/`
-2. Run `yarn mobile:ios:run` to build and test on iOS Simulator
-3. Or run `yarn mobile:ios` to open in Xcode for debugging
-
-The mobile app shares the same React codebase as the browser extension. Mobile-specific code uses `isMobile()` checks from `lib/platform`.
-
-### Skip Onboarding (Mobile Testing)
-
-To skip the entire onboarding UI (seed phrase, verification, password) and jump directly to the "Your wallet is ready → Get started" screen, use one of these methods:
-
-**Method 1: URL parameter** — After the app launches on the welcome screen, navigate via CDP:
-```bash
-node /tmp/cdp-eval 'window.location.search = "?__test_skip_onboarding=1"'
-```
-
-**Method 2: JS global** — Set the global before the component mounts:
-```bash
-node /tmp/cdp-eval 'window.__TEST_SKIP_ONBOARDING = true; window.location.reload()'
-```
-
-Both methods auto-generate a random seed phrase, set password to `password1`, and navigate to the confirmation screen. From there, tapping "Get started" (or triggering it via CDP) runs `registerWallet()` which initializes the WASM Worker and creates the wallet.
-
-To also auto-trigger "Get started" (full end-to-end skip):
-```bash
-# Wait a moment for the confirmation screen to render, then click
-node /tmp/cdp-eval 'document.querySelector("button")?.click(); "clicked"'
-```
-
-The bypass is in `src/app/pages/Welcome.tsx`. It only activates when `__test_skip_onboarding=1` is in the URL or `window.__TEST_SKIP_ONBOARDING` is set — zero impact on production.
-
-### Platform-Specific Changes
-
-**CRITICAL:** This app builds for three platforms: Chrome extension, iOS, and Android. When fixing bugs or adding features:
-
-1. **Isolate platform-specific fixes** - If a bug only affects iOS, wrap the fix with platform detection (e.g., `if (isIOS()) { ... }`). Don't apply iOS fixes globally unless they genuinely apply to all platforms.
-2. **Test across platforms** - Changes to shared code can break other platforms unexpectedly.
-3. **Use platform detection** - `isMobile()`, `isIOS()`, `isAndroid()` from `lib/platform` for conditional logic.
-
-### Haptic Feedback
-
-**IMPORTANT:** When adding new tappable components (buttons, links, toggles, list items, etc.), always add haptic feedback for mobile users.
-
-```typescript
-import { hapticLight, hapticMedium, hapticSelection } from 'lib/mobile/haptics';
-
-// Use hapticLight() for button taps, navigation links, card clicks
-// Use hapticMedium() for toggles, checkboxes, radio buttons
-// Use hapticSelection() for tab changes, footer navigation
-```
-
-The haptic functions automatically check `isMobile()` and the user's haptic feedback setting - no need to wrap in conditionals.
-
-Components that already have haptics (for reference):
-- `components/Button.tsx`, `app/atoms/Button.tsx` - buttons
-- `lib/woozie/Link.tsx` - navigation links
-- `components/Toggle.tsx`, `app/atoms/ToggleSwitch.tsx` - toggles
-- `components/TabBar.tsx`, `app/atoms/TabSwitcher.tsx` - tabs
-- `components/FooterIconWrapper.tsx` - footer navigation
-- `components/CardItem.tsx`, `components/ListItem.tsx` - tappable items
-- `components/Chip.tsx`, `components/CircleButton.tsx` - misc buttons
-- `app/atoms/Checkbox.tsx`, `components/RadioButton.tsx` - form controls
-
-### Known iOS-Specific Issues
-
-- **WASM/WebWorker behavior** - iOS Safari has different WebWorker/WASM memory handling than Android/Chrome
-- **IndexedDB quirks** - Safari's IndexedDB implementation has known limitations (e.g., doesn't work in private browsing, stricter storage quotas)
-- **Memory pressure** - iOS is more aggressive about limiting memory; watch for OOM issues with multiple WASM worker instances
-
-### File Downloads on Mobile
-
-**The standard web download approach does NOT work on mobile:**
-```typescript
-// This works on desktop but NOT on iOS/Android WebView
-const a = document.createElement('a');
-a.href = URL.createObjectURL(blob);
-a.download = 'file.json';
-a.click();  // Does nothing on mobile!
-```
-
-**Use Capacitor Filesystem + Share plugins instead:**
-```typescript
-import { Directory, Encoding, Filesystem } from '@capacitor/filesystem';
-import { Share } from '@capacitor/share';
-import { isMobile } from 'lib/platform';
-
-if (isMobile()) {
-  // Write to cache, then share
-  const result = await Filesystem.writeFile({
-    path: 'file.json',
-    data: fileContent,
-    directory: Directory.Cache,
-    encoding: Encoding.UTF8
-  });
-  await Share.share({ url: result.uri });
-} else {
-  // Standard web download for desktop
-}
-```
-
-### Adding/Removing Capacitor Plugins
-
-When **adding** new Capacitor plugins:
-
-1. Install: `yarn add @capacitor/plugin-name`
-2. Sync: `yarn mobile:sync` (updates iOS and Android native projects)
-3. **Add ProGuard rules** for Android release builds in `android/app/proguard-rules.pro`:
-   ```
-   -keep class com.capacitorjs.plugins.pluginname.** { *; }
-   ```
-4. Check if iOS needs Info.plist permissions (most plugins document this)
-
-When **removing** Capacitor plugins:
-
-1. Uninstall: `yarn remove @capacitor/plugin-name`
-2. Sync: `yarn mobile:sync` (updates iOS and Android native projects)
-3. **Remove ProGuard rules** from `android/app/proguard-rules.pro` for the removed plugin
-
-### Native Navbar Overlay (iOS + Android)
-
-The mobile wallet hides the React footer and renders its bottom nav as a native floating pill on both iOS and Android. The pill has a main row (Home / Activity / Browser), an optional secondary row (Send / Receive / Settings), and a compact mode with a primary action button (e.g. Continue in the Send flow).
-
-**iOS**: `MidenNavbarOverlayWindow` in `packages/dapp-browser/ios/Sources/InAppBrowserPlugin/WKWebViewController.swift` — a dedicated `UIWindow` at `.normal + 200` that sits above the Capacitor host window AND every dApp WKWebView window. UIWindow z-order is automatic.
-
-**Android**: `packages/dapp-browser/android/src/main/java/ee/forgr/capacitor_inappbrowser/navbar/` — a two-instance architecture:
-- `NavbarState` + `NavbarStateHolder` — immutable state + observer pattern
-- `NavbarOverlayManager` — coordinator that lazily creates the Activity-scoped `NavbarView`, spawns a fresh Dialog-scoped `NavbarView` when a `WebViewDialog` shows (via `OnShowListener`), and detaches it on dismiss. Arbitrates which instance is visible via a simple stack-top rule.
-- `NavbarView` — the actual FrameLayout hierarchy: shadowWrap → blurContainer → outerVStack → [secondaryRow, contentStack[navStack, actionButton]]
-- `NavbarButton`, `NavbarSecondaryButton`, `NavbarActionButton` — individual button views with platform-matched styling
-
-**Why two instances on Android**: Android sub-windows (`TYPE_APPLICATION_PANEL`) stack with their parent window's token, so a view attached to the Activity would be covered by a Dialog. Instead of fighting z-order, we give the Activity one navbar view and each WebViewDialog its own, both observing the same state holder. Exactly one instance is visible at any time, picked by which window is frontmost.
-
-**Plugin methods** (iOS + Android, same signatures):
-- `showNativeNavbar({items, activeId})` — show pill with 3 main-row items
-- `hideNativeNavbar()` — hide pill entirely
-- `setNativeNavbarActive({id})` — update active main-row pill without rebuild
-- `setNavbarSecondaryRow({items, activeId})` — populate or clear secondary row; empty items collapses the row via spring animation
-- `setNavbarAction({label, enabled})` — enter compact mode with a primary action pill
-- `clearNavbarAction()` — exit compact mode, restore default nav row layout
-- `morphNavbarOut()` / `morphNavbarIn()` — slide pill off-screen for drawer presentations
-
-**Events** (JS listens via `InAppBrowser.addListener`):
-- `nativeNavbarTap` → `{id}` when a main-row button is tapped
-- `nativeNavbarSecondaryTap` → `{id}` when a secondary-row button is tapped
-- `nativeNavbarActionTap` → `{}` when the compact-mode action button is tapped
-
-**Wallet JS wiring** lives in `src/app/providers/DappBrowserProvider.tsx` — two effects watching `location.pathname` drive the main and secondary rows; a third watches the confirmation store for drawer morph-out.
-
-**Gotchas**:
-- `MATCH_PARENT` children in `WRAP_CONTENT` FrameLayouts inflate the parent to ancestor AT_MOST. Use background drawables instead of child views for active-state pills (learned the hard way — `NavbarButton` used to do this and produced 1878px-tall buttons). See commit `64145d74` in the navbar checkin.
-- `NavbarButton` is pinned to 60dp via `setMinimumHeight` so compact mode can't grow the toolbar. Also mirrored on iOS as `NavbarButton.buttonHeight = 60`.
-- On Android, `Dialog.getWindow().setLayout(MATCH_PARENT, MATCH_PARENT)` must be called AFTER `setContentView()`. Otherwise the default `wrap_content` wins and the Dialog is a tiny centered blob.
-- Android's `setRenderEffect(createBlurEffect(...))` blurs the view's own content, NOT what's behind it. There's no clean backdrop blur primitive for a decor-view child. We use a solid translucent pill and accept the platform difference.
-- Shadow elevation must be on the view with the background drawable (blurContainer), not a wrapper without an outline — or the shadow just doesn't render.
-
-### Debugging iOS Issues
-
-**Debug UI components:** When adding debug panels to the UI, ensure all text is **selectable** (use `select-text` or `user-select: text`) so the user can copy/paste error messages instead of retyping them.
-
-**IMPORTANT:** Do NOT use `console.log` for iOS debugging - those logs go to Safari Web Inspector which Claude Code cannot access.
-
-**Instead, use native iOS logging that can be read via CLI:**
-```bash
-# Stream logs from running simulator (filter for webkit/app logs)
-xcrun simctl spawn booted log stream --predicate 'process == "App"' --level debug
-
-# Or capture to file for later analysis
-xcrun simctl spawn booted log stream --predicate 'process == "App"' > ios_logs.txt &
-```
-
-**For JavaScript code, use Capacitor's native logging or write to a debug file** that can be read from the simulator's file system.
-
-**Alternative: Safari Web Inspector (manual, last resort):**
-1. Run the app in simulator: `yarn mobile:ios:run`
-2. Open Safari on Mac → Develop menu → Simulator → select the app
-3. Console tab shows JavaScript logs
-
-### CDP Bridge for iOS WebView Debugging
-
-Use the `inspect` CLI (`@inspectdotdev/cli`) + a persistent-connection daemon to evaluate JavaScript in the Capacitor WKWebView from Claude Code. This gives you access to DOM, computed styles, console output, and error state — much more powerful than screenshots alone.
-
-**Known issue:** The inspect bridge has a single-use bug — after a WebSocket client disconnects, subsequent connections get no responses. The workaround is a persistent-connection daemon that holds ONE WebSocket open and routes all requests through it.
-
-**Bringup recipe (run once per session):**
-
-```bash
-# 1. Kill old bridges and free ports
-pkill -9 -f "inspect" 2>/dev/null
-pkill -9 -f "cdp-daemon" 2>/dev/null
-lsof -ti:9221,9222,9333 | xargs kill -9 2>/dev/null
-
-# 2. Reset webinspectord
-xcrun simctl spawn booted launchctl kill 9 user/501/com.apple.webinspectord
-
-# 3. Relaunch the app (re-registers WebView with fresh webinspectord)
-xcrun simctl terminate booted com.miden.wallet
-xcrun simctl launch booted com.miden.wallet
-sleep 2
-
-# 4. Start inspect bridge (wait ~5s for it to discover devices)
-source ~/.nvm/nvm.sh && nvm use 22
-nohup inspect --no-telemetry > /tmp/inspect.log 2>&1 &
-sleep 5
-
-# 5. Start CDP daemon (holds persistent WS, routes evals through it)
-nohup node /tmp/cdp-daemon.mjs > /tmp/cdp-daemon.log 2>&1 &
-sleep 3
-
-# 6. Smoke test — should print "2"
-node /tmp/cdp-eval '1+1'
-```
-
-**Usage after bringup:**
-```bash
-# Evaluate any JS in the WebView
-node /tmp/cdp-eval 'document.title'
-node /tmp/cdp-eval 'JSON.stringify(window.__cdp_errors)'
-
-# Set up an error trap to catch async failures
-node /tmp/cdp-eval 'window.__cdp_errors = []; window.addEventListener("error", e => window.__cdp_errors.push(e.message)); window.addEventListener("unhandledrejection", e => window.__cdp_errors.push("REJECTION: " + (e.reason?.message || e.reason))); "trap set"'
-```
-
-**Recovery when it stops working:**
-- Smoke test fails → restart from step 2 (webinspectord reset)
-- Bridge sees `[]` on `/json` → restart from step 3 (app crashed)
-- After `yarn mobile:ios:run` rebuild → restart from step 4 (PID changed)
-- Nothing works → quit Simulator.app entirely (`osascript -e 'tell application "Simulator" to quit'`), cold-boot, restart from step 1
-
-**Files:** `/tmp/cdp-daemon.mjs` (persistent WS daemon), `/tmp/cdp-eval` (one-shot client). If missing, recreate from the memory file at `~/.claude/projects/-Users-celrisen-miden-miden-wallet/memory/cdp-bridge-single-use-bug.md`.
-
-### Verifying Mobile UI Fixes
-
-**IMPORTANT:** When fixing mobile UI issues (layout, spacing, safe areas, etc.), always verify the fix by taking screenshots from the simulator and analyzing them visually. Do not rely solely on code inspection.
-
-**Workflow for UI fixes:**
-1. Build and run on simulator: `yarn mobile:ios:run`
-2. Take a screenshot: `xcrun simctl io booted screenshot /tmp/screenshot.png`
-3. Read the screenshot file to visually verify the fix
-4. If authentication is needed, trigger FaceID: `xcrun simctl spawn booted notifyutil -p com.apple.BiometricKit_Sim.fingerTouch.match`
-5. Wait briefly and take another screenshot: `sleep 2 && xcrun simctl io booted screenshot /tmp/screenshot2.png`
-
-**Example verification flow:**
-```bash
-# Build and launch
-source ~/.nvm/nvm.sh && nvm use 22 && yarn mobile:ios:run
-
-# Take screenshot after app loads
-xcrun simctl io booted screenshot /tmp/ios-test.png
-
-# Authenticate if needed (for locked wallet)
-xcrun simctl spawn booted notifyutil -p com.apple.BiometricKit_Sim.fingerTouch.match
-
-# Wait and capture main screen
-sleep 2 && xcrun simctl io booted screenshot /tmp/ios-main.png
-```
-
-**Common iOS layout issues and fixes:**
-- **Grey bar at bottom:** Usually caused by `100dvh` height not accounting for safe areas. Use `100%` instead and ensure `mobile.html` body has proper safe area padding.
-- **Content cut off:** Check if containers have `overflow: hidden` without proper height constraints.
-- **Safe area gaps:** Ensure `public/mobile.html` has `padding: env(safe-area-inset-*)` on body, and body background color matches app background (white).
-
-## Tailwind theme tokens
-
-**CRITICAL:** In `tailwind.config.ts`, many Tailwind color tokens are mapped to CSS custom properties defined in `src/main.css` (`:root` for light, `.dark` for dark). These tokens **already auto-flip** with the active theme — do NOT add `dark:` variants on top, because that overrides the auto-flip with a *worse* value.
-
-Tokens that auto-flip:
-- `text-black` → `var(--color-text-primary)` → `#000` / `#fff`
-- `bg-white` → `var(--color-surface)` → `#fff` / `#3f3f3f99` (translucent)
-- `bg-gray-25` → `var(--color-surface-secondary)` → `#f9f9f9` / `#2a2a2a`
-- `bg-gray-50` → `var(--color-surface-tertiary)` → `#f3f3f3` / `#333333`
-- `bg-gray-100` → `var(--color-hover-bg)` → `#e1dbdb` / `#ffffff0d`
-- `text-heading-gray` → `var(--color-text-secondary)` → `#484848` / `#fff`
-
-**Gotcha:** Writing `text-black dark:text-white` makes `text-white` win in dark — but `white` is mapped to `var(--color-surface)` = `#3f3f3f99` (translucent dark grey). So the explicit `dark:` variant makes the label **less** readable than `text-black` alone.
-
-When to add `dark:` variants:
-- The base class points to a **fixed** palette color — the custom `grey.*` palette in `src/utils/tailwind-colors.js` is NOT theme-aware. Prefer `bg-gray-*` (spelled with `a`) over `bg-grey-*`.
-- You need dark-mode-specific contrast in kind — e.g. `dark:bg-pure-white/15` on a TabPicker active pill, where `bg-white` alone is too subtle in dark. `pure-white` / `pure-black` are literal hex (not remapped).
-- SVG `fill={...}` on `<Icon>` takes a literal JS color — Tailwind `dark:` variants don't reach prop values. Read `document.documentElement.classList.contains('dark')` at render time and pass the resolved color.
-
-Quick check before adding `dark:`: grep `tailwind.config.ts` for the base token name. If it maps to `var(--color-...)`, don't override.
-
-## Desktop Development (Tauri)
-
-The desktop app uses Tauri to wrap the web app in a native macOS window.
-
-### Commands
-
-```bash
-yarn build:desktop        # Production build for desktop (outputs to dist/desktop/)
-yarn build:desktop:dev    # Development build for desktop
-yarn tauri dev            # Build and run desktop app in dev mode
-yarn tauri build          # Build release desktop app
-```
-
-**Node version:** Requires Node >= 22. Use nvm to switch:
-```bash
-source ~/.nvm/nvm.sh && nvm use 22 && yarn tauri dev
-```
-
-### Key Directories
-
-```
-src-tauri/
-├── src/
-│   ├── main.rs           # Tauri app entry point
-│   ├── dapp_browser.rs   # dApp browser window and wallet API
-│   └── lib.rs            # Command registration
-├── scripts/
-│   └── dapp-injection.js # Wallet API injected into dApp pages
-├── capabilities/         # Tauri permission capabilities
-└── tauri.conf.json       # Tauri configuration
-
-src/lib/desktop/
-├── dapp-browser.ts                   # TypeScript bindings for Tauri commands
-├── DesktopDappHandler.tsx            # Handles wallet requests from dApps
-└── DesktopDappConfirmationModal.tsx  # Manages confirmation overlay in dApp WebView
-```
-
-### Clearing App State (macOS)
-
-To completely reset the desktop app state (useful for testing fresh installs or debugging):
-
-```bash
-# Clear all wallet data (IndexedDB, localStorage, WebKit caches)
-rm -rf ~/Library/WebKit/com.miden.wallet
-rm -rf ~/Library/WebKit/miden-wallet
-
-# Optional: Also clear Application Support and Caches
-rm -rf ~/Library/Application\ Support/com.miden.wallet
-rm -rf ~/Library/Caches/com.miden.wallet
-```
-
-**Important:** The WebKit directories contain the actual IndexedDB/localStorage data. The Application Support directory may be empty or contain minimal data.
-
-After clearing, restart the app with `yarn tauri dev` to see the onboarding screen.
-
-### dApp Browser Architecture
-
-The desktop app includes a separate browser window for dApps:
-
-```
-┌─────────────────────────────────────────────────────────────┐
-│                    Desktop App Architecture                  │
-├─────────────────────────────────────────────────────────────┤
-│  Main Window (wallet UI)     │  dApp Browser Window          │
-│  - React app                 │  - External dApp webpage      │
-│  - DesktopDappHandler        │  - Injected window.midenWallet│
-│  - Confirmation modal logic  │  - URL interception for msgs  │
-│                              │                               │
-│         ◄──── Tauri Events (dapp-wallet-request) ────►      │
-└─────────────────────────────────────────────────────────────┘
-```
-
-**Communication flow:**
-1. dApp calls `window.midenWallet.connect()` or other methods
-2. Injection script encodes request as base64 and navigates to `https://miden-wallet-request/{payload}`
-3. Tauri's `on_navigation` callback intercepts this URL
-4. Request is emitted to main window via Tauri event
-5. `DesktopDappHandler` processes and shows confirmation overlay in dApp window
-6. Response flows back via similar URL interception pattern
-
-## Code Style (Prettier)
-
-This project uses Prettier for code formatting. Always write code that conforms to Prettier rules:
-
-- **Line length:** Max 120 characters. Break long lines, especially `console.log` statements with multiple arguments
-- **Multi-argument calls:** When function calls exceed line length, put each argument on its own line:
-  ```typescript
-  // Good
-  console.log(
-    '[Component] message:',
-    value1,
-    'key2:',
-    value2
-  );
-
-  // Bad - will fail prettier
-  console.log('[Component] message:', value1, 'key2:', value2, 'key3:', value3);
-  ```
-- **Trailing commas:** Use trailing commas in multi-line arrays/objects
-- **Semicolons:** Always use semicolons
-- **Quotes:** Single quotes for strings
-
-Run `yarn format` to auto-fix formatting issues if needed.
-
-## State Management
-
-- **Backend:** Effector store in `src/lib/miden/back/store.ts`
-- **Frontend:** Zustand store in `src/lib/store/index.ts`
-- **Sync:** `WalletStoreProvider` subscribes to `StateUpdated` broadcasts
-
-Frontend hooks that use Zustand:
-- `useMidenContext()` - main wallet state and actions
-- `useAllBalances()` - token balances with polling
-- `useAllTokensBaseMetadata()` - asset metadata cache
-
-## Intercom Messaging
-
-Frontend ↔ Backend communication uses `IntercomClient`/`IntercomServer`:
-
-```typescript
-// Frontend request
-const res = await intercom.request({ type: WalletMessageType.EditAccountRequest, ... });
-
-// Backend broadcasts state changes
-intercom.broadcast({ type: WalletMessageType.StateUpdated });
-```
-
-Message types defined in `src/lib/shared/types.ts`.
-
-## Navigation Architecture
-
-**IMPORTANT - Maintain this section:** When adding new screens, routes, or modifying navigation flows, update the route maps and flow documentation below. This ensures mobile back button handling stays correct and future developers understand the navigation structure.
-
-The app uses **two separate navigation systems**:
-
-### 1. Woozie (Global Page Navigation)
-
-Custom lightweight router in `src/lib/woozie/`. Uses History API with hash-based URLs (`USE_LOCATION_HASH_AS_URL = true`).
-
-**Key exports:**
-- `navigate(path)` - Navigate to a route
-- `goBack()` - Go back in history (`window.history.go(-1)`)
-- `useLocation()` - Get current `pathname`, `historyPosition`, etc.
-- `<Link to="/path">` - Declarative navigation with haptic feedback
-
-**History tracking:**
-- `historyPosition` tracks position in navigation stack (0 = first page in session)
-- Used to determine if back navigation is available
-
-### 2. Navigator (Internal Step Navigation)
-
-Component-based navigator in `src/components/Navigator.tsx` for multi-step flows.
-
-**Used by:**
-- `SendManager` (`src/screens/send-flow/SendManager.tsx`)
-- `EncryptedFileManager` (`src/screens/encrypted-file-flow/EncryptedFileManager.tsx`)
-
-**Key exports:**
-- `useNavigator()` - Returns `{ navigateTo, goBack, cardStack, activeRoute }`
-- `cardStack` - Array of visited routes (step history)
-- `goBack()` - Pops from cardStack (only works if `cardStack.length > 1`)
-
-### Route Map
-
-**Tab Pages** (with persistent footer, via `TabLayout`):
-| Route | Component | Back Behavior |
-|-------|-----------|---------------|
-| `/` | Explore (Home) | Minimize app (Android) / Nothing (iOS) |
-| `/history/:programId?` | AllHistory | → Home |
-| `/settings/:tabSlug?` | Settings | Sub-tab → Settings main → Home |
-| `/browser` | Browser | → Home |
-
-**Settings Sub-Tabs** (`/settings/:tabSlug`):
-| Tab Slug | Component | Notes |
-|----------|-----------|-------|
-| `general-settings` | GeneralSettings | Theme, analytics, haptics |
-| `language` | LanguageSettings | App language selection |
-| `address-book` | AddressBook | Saved contacts |
-| `reveal-seed-phrase` | RevealSeedPhrase | Only shown for non-public accounts |
-| `edit-miden-faucet-id` | EditMidenFaucetId | Hidden from menu |
-| `encrypted-wallet-file` | EncryptedFileFlow | Opens as full dialog (see flow below) |
-| `advanced-settings` | AdvancedSettings | Developer options |
-| `dapps` | DAppSettings | Authorized dApps management |
-| `about` | About | Version info, links |
-| `networks` | NetworksSettings | Hidden from menu |
-
-**Full-Screen Pages** (slide animation, via `FullScreenPage` or `PageLayout`):
-| Route | Component | Back Behavior |
-|-------|-----------|---------------|
-| `/send` | SendFlow | See Send Flow below |
-| `/receive` | Receive | → Home |
-| `/faucet` | Faucet | → Home |
-| `/get-tokens` | GetTokens | → Home |
-| `/select-account` | SelectAccount | → Home |
-| `/create-account` | CreateAccount | → Previous |
-| `/edit-name` | EditAccountName | → Previous |
-| `/import-account/:tabSlug?` | ImportAccount | → Previous |
-| `/history-details/:transactionId` | HistoryDetails | → History |
-| `/token-history/:tokenId` | TokenHistory | → Home |
-| `/manage-assets/:assetType?` | ManageAssets | → Home |
-| `/encrypted-wallet-file` | EncryptedFileFlow | See Encrypted Flow below |
-| `/generating-transaction` | GeneratingTransaction | (Modal - no back) |
-| `/consuming-note/:noteId` | ConsumingNote | (Processing - no back) |
-| `/import-note-pending/:noteId` | ImportNotePending | → Home |
-| `/import-note-success` | ImportNoteSuccess | → Home |
-| `/import-note-failure` | ImportNoteFailure | → Home |
-
-**Onboarding/Auth Routes** (catch-all when locked):
-- `/reset-required`, `/reset-wallet`, `/forgot-password`, `/forgot-password-info`
-
-### Send Flow Steps (Internal Navigator)
-
-Route: `/send` → `SendManager` with internal step navigation:
-
-| Step | Component | Back Behavior |
-|------|-----------|---------------|
-| 1. SelectToken | Token picker | → Close flow (Home) |
-| 2. SelectRecipient | Address input | → SelectToken |
-| 3. AccountsList | Modal overlay | → Dismiss (stays on SelectRecipient) |
-| 4. SelectAmount | Amount input | → SelectRecipient |
-| 5. ReviewTransaction | Confirm details | → SelectAmount |
-| 6. GeneratingTransaction | Processing | (No back) |
-| 7. TransactionInitiated | Success | → Home |
-
-### Encrypted File Flow Steps (Internal Navigator)
-
-Route: `/encrypted-wallet-file` → `EncryptedFileManager`:
-
-| Step | Component | Back Behavior |
-|------|-----------|---------------|
-| 1. CreatePassword | Password setup | → Close flow (Settings) |
-| 2. ConfirmPassword | Confirm password | → CreatePassword |
-| 3. ExportFile | Download file | → ConfirmPassword |
-
-### Onboarding Flow (State-Based Navigation)
-
-**IMPORTANT:** Unlike SendManager/EncryptedFileManager, the onboarding flow does NOT use the Navigator component. It uses hash-based URLs (`/#step-name`) with React state to track the current step.
-
-Route: `/` (when wallet is locked/new) → `Welcome.tsx` with hash-based steps:
-
-| Hash | Step | Back Behavior |
-|------|------|---------------|
-| (none) | Welcome | Minimize app (Android) / Nothing (iOS) |
-| `#backup-seed-phrase` | BackupSeedPhrase | → Welcome |
-| `#verify-seed-phrase` | VerifySeedPhrase | → BackupSeedPhrase |
-| `#select-import-type` | SelectImportType | → Welcome |
-| `#import-from-seed` | ImportFromSeed | → SelectImportType |
-| `#import-from-file` | ImportFromFile | → SelectImportType |
-| `#create-password` | CreatePassword | → Previous step (depends on flow) |
-| `#confirmation` | Confirmation | (No back while loading) |
-
-**Navigation pattern:**
-- Steps navigate via `navigate('/#step-name')` which updates the URL hash
-- `useEffect` watches the hash and updates `step` state accordingly
-- Back navigation calls `onAction({ id: 'back' })` which has switch logic for each step
-- Mobile back handler in `Welcome.tsx` triggers this same `onAction({ id: 'back' })`
-
-**Forgot Password Flow** (`/forgot-password` → `ForgotPassword.tsx`) uses the same pattern with `ForgotPasswordStep` enum.
-
-### Back Handler System
-
-**Global handler** in `src/app/env.ts`:
-- `registerBackHandler(handler)` - Register a back handler (returns unregister function)
-- `onBack()` - Calls the current handler
-- Stack-based: handlers can be layered (modals on top of pages)
-
-**PageLayout** (`src/app/layouts/PageLayout.tsx`) registers default handler:
-```typescript
-// If history available, go back; otherwise go home
-if (historyPosition > 0) {
-  goBack();
-} else if (!inHome) {
-  navigate('/', HistoryAction.Replace);
-}
-```
-
-### Mobile Back Button
-
-**IMPORTANT:** Hardware back button on Android and swipe-back on iOS require `@capacitor/app` plugin and explicit handling. Without it, back gestures close the app instead of navigating.
-
-Back handlers must be registered for:
-1. Global navigation (MobileBackBridge component)
-2. Navigator-based flows (SendManager, EncryptedFileManager)
-3. State-based flows (Welcome/onboarding, ForgotPassword)
-4. Modals/dialogs that should close on back
-
-## Code Patterns
-
-### Adding a new wallet action
-
-1. Add message types to `src/lib/shared/types.ts`
-2. Add handler in `src/lib/miden/back/actions.ts`
-3. Register handler in `src/lib/miden/back/main.ts`
-4. Add action to Zustand store in `src/lib/store/index.ts`
-5. Expose via `useMidenContext()` in `src/lib/miden/front/client.ts`
-
-### Optimistic updates
-
-```typescript
-// In store action
-editSomething: async (id, value) => {
-  const prev = get().items;
-  set({ items: /* optimistic value */ });
-  try {
-    await request({ ... });
-  } catch (error) {
-    set({ items: prev }); // Rollback
-    throw error;
-  }
-}
-```
-
-## Balance Loading Architecture
-
-The wallet uses an IndexedDB-first pattern for instant UI updates:
-
-```
-┌─────────────────────────────────────────────────────────────┐
-│                    Balance Loading Flow                      │
-├─────────────────────────────────────────────────────────────┤
-│  1. fetchBalances() → getAccount() → IndexedDB (instant)    │
-│  2. AutoSync (1s interval) → syncState() → Miden Node       │
-│  3. syncState updates IndexedDB → next fetchBalances sees it│
-└─────────────────────────────────────────────────────────────┘
-```
-
-- `fetchBalances` in `src/lib/store/utils/fetchBalances.ts` reads from IndexedDB via `getAccount()` - it does NOT call `syncState()`
-- `AutoSync` class in `src/lib/miden/front/sync.ts` handles background network sync separately
-- This separation allows showing cached balances instantly while syncing in background
-
-**Important distinction:**
-- `getAccount(accountId)` - reads balance from IndexedDB (local cache)
-- `syncState()` - syncs with Miden node and updates IndexedDB
-- `importAccountById(assetId)` - imports **asset/token metadata**, not account balances
-
-## WASM Client Concurrency
-
-**CRITICAL:** The Miden WASM client cannot handle concurrent access. Concurrent calls cause:
-```
-Error: recursive use of an object detected which would lead to unsafe aliasing in rust
-```
-
-**Always wrap WASM client operations in `withWasmClientLock`:**
+## Critical gotchas
 
+### WASM client concurrency
+Miden WASM client is single-threaded. Concurrent calls throw `recursive use of an object ... unsafe aliasing`. **Always** wrap in `withWasmClientLock`:
 ```typescript
 import { getMidenClient, withWasmClientLock } from 'lib/miden/sdk/miden-client';
-
-// CORRECT - always use the lock
-const result = await withWasmClientLock(async () => {
-  const midenClient = await getMidenClient();
-  return midenClient.someOperation();
-});
-
-// WRONG - direct access without lock causes concurrency errors
-const midenClient = await getMidenClient();
-const result = await midenClient.someOperation();
+await withWasmClientLock(async () => (await getMidenClient()).someOp());
 ```
 
-**This applies everywhere**, including:
-- Transaction workers in `src/workers/` (consumeNoteId.ts, sendTransaction.ts, submitTransaction.ts)
-- Backend operations in `src/lib/miden/back/`
-- Frontend hooks in `src/lib/miden/front/`
-- Any new code that accesses `getMidenClient()`
+### Tailwind auto-flipping tokens
+Many tokens in `tailwind.config.ts` map to CSS vars in `src/main.css` and auto-flip with theme. Do NOT add `dark:` variants on these — it overrides the auto-flip with a worse value:
+- `text-black`, `bg-white`, `bg-gray-25/50/100`, `text-heading-gray`
 
-The lock ensures only one WASM operation runs at a time across the entire app, preventing AutoSync, dApp requests, and user operations from conflicting.
+Add `dark:` only on fixed-palette colors (`grey.*` custom palette, `pure-white`, `pure-black`) or SVG `fill={...}` props (check `document.documentElement.classList.contains('dark')` at render).
 
-## Testing
+### i18n required
+All user-facing text must use `t('key')` or `<T id="key" />`. CI blocks non-i18n strings (`yarn lint:i18n`). Add new keys to `public/_locales/en/en.json` (flat format). Placeholders: `$name$`.
 
-- Unit tests in `*.test.ts` files alongside source
-- Tests use Jest + React Testing Library
-- Mock `lib/intercom` for frontend tests
-- Wrap components with `WalletStoreProvider` + `MidenContextProvider`
+### Platform isolation
+Wrap platform-specific fixes with `isIOS()`/`isAndroid()`/`isMobile()` from `lib/platform`. Don't apply iOS fixes globally.
 
-### Jest Mock Gotchas
+### Haptics on tappable components
+Add `hapticLight()` (taps), `hapticMedium()` (toggles), `hapticSelection()` (tabs) from `lib/mobile/haptics`. Auto-checks `isMobile()` and user setting.
 
-**Module path resolution:** Mock paths must match how the source file imports the module:
-```typescript
-// If actions.ts imports: import { Vault } from 'lib/miden/back/vault';
-// Then mock with the same path:
-jest.mock('lib/miden/back/vault', () => ({ ... }));
-// NOT: jest.mock('./vault', ...) - this won't work
-```
+### Mobile file downloads
+`<a download>` does nothing in WebView. Use `Filesystem.writeFile` + `Share.share` from `@capacitor/{filesystem,share}` when `isMobile()`.
 
-**jsdom limitations:** `window.location.reload` cannot be mocked in jsdom. Use try-catch:
-```typescript
-try {
-  functionThatCallsReload();
-} catch {
-  // reload throws in jsdom, expected
-}
-```
+### Balance loading
+`fetchBalances` reads IndexedDB via `getAccount()` (instant). `AutoSync` (1s interval) calls `syncState()` separately to update IndexedDB. Don't call `syncState()` from the UI path.
 
-**React test cleanup:** Prevent test pollution by cleaning up React roots:
-```typescript
-afterEach(() => {
-  testRoot.unmount();
-});
-```
+## Adding a wallet action
 
-## E2E Blockchain Test Harness
+1. Message type in `src/lib/shared/types.ts`
+2. Handler in `src/lib/miden/back/actions.ts`, register in `back/main.ts`
+3. Store action in `src/lib/store/index.ts`
+4. Expose via `useMidenContext()` in `src/lib/miden/front/client.ts`
 
-End-to-end tests that exercise real wallet operations against a live Miden network (testnet, devnet, or localhost). Uses Playwright to automate two Chrome extension instances and `miden-client` CLI to deploy a faucet and mint tokens.
+## Navigation
 
-### Quick Start
+Two systems:
+- **Woozie** (`src/lib/woozie/`) — hash-based global router. `navigate`, `goBack`, `useLocation`, `<Link>`.
+- **Navigator** (`src/components/Navigator.tsx`) — internal step flows (`SendManager`, `EncryptedFileManager`). `useNavigator()` → `{navigateTo, goBack, cardStack}`.
 
-```bash
-# Build + run against a specific network (default testnet)
-yarn test:e2e:blockchain:testnet
-yarn test:e2e:blockchain:devnet
-yarn test:e2e:blockchain:localhost
-
-# Subsequent runs (skip rebuild if no code changes)
-E2E_NETWORK=devnet yarn test:e2e:blockchain:run
-
-# Build only (no test run) — picks up E2E_NETWORK if set, else testnet
-yarn test:e2e:blockchain:build
-
-# Raw form (equivalent to the :<network> shortcuts)
-E2E_NETWORK=testnet yarn test:e2e:blockchain
-```
-
-The `:<network>` scripts set both `E2E_NETWORK` (which endpoints the harness + miden-client CLI use) AND propagate `MIDEN_NETWORK` through to the extension build (which network the wallet connects to). Running with a mismatched pair — e.g. harness on devnet but wallet built for testnet — silently fails because notes land on one network and the wallet listens on the other.
-
-The harness auto-installs `miden-client-cli` from crates.io on first run, version-matched to the wallet's `@miden-sdk/miden-sdk` package. Requires Rust toolchain (`cargo`).
-
-### Directory Layout
-
-```
-playwright/e2e/
-  config/environments.ts       # Network endpoints per E2E_NETWORK
-  harness/                     # Observability layer (types, timeline, capture, reports)
-  helpers/
-    miden-cli.ts               # miden-client CLI wrapper (init, deploy faucet, mint)
-    wallet-page.ts             # Page Object Model for wallet UI automation
-  fixtures/two-wallets.ts      # Playwright fixture: 2 Chrome instances + observability
-  tests/*.spec.ts              # Test specs
-playwright.e2e.config.ts       # Playwright config (5 min timeout, traces always on)
-```
+Onboarding (`Welcome.tsx`) and `ForgotPassword.tsx` use hash-based state (`/#step-name`), NOT Navigator.
 
-### Environment Selection
+Back handlers (`src/app/env.ts`): `registerBackHandler` is stack-based. `PageLayout` registers a default that calls `goBack()` if `historyPosition > 0` else navigates home. Mobile hardware/swipe back requires `@capacitor/app` + explicit handlers — must be registered for global nav (`MobileBackBridge`), Navigator flows, state-based flows, and modals.
 
-`E2E_NETWORK` controls both:
-- which RPC/prover/transport endpoints the harness + `miden-client` CLI use (via `playwright/e2e/config/environments.ts`)
-- which network the extension build bakes into its bundle (piped through to `MIDEN_NETWORK` at build time in `test:e2e:blockchain:build`)
+When adding screens/routes, keep this section accurate so mobile back stays correct.
 
-Use the dedicated scripts to avoid mismatches:
+## Mobile testing
 
+### Skip onboarding
 ```bash
-yarn test:e2e:blockchain:testnet    # default
-yarn test:e2e:blockchain:devnet
-yarn test:e2e:blockchain:localhost  # requires a local Miden node on :57291
-```
-
-Or set `E2E_NETWORK` explicitly with the generic script:
-
-```bash
-E2E_NETWORK=devnet yarn test:e2e:blockchain
-```
-
-### Test Specs
-
-| Spec | What it tests |
-|------|---------------|
-| `wallet-lifecycle.spec.ts` | Create, lock, unlock wallets |
-| `mint-and-balance.spec.ts` | Deploy faucet via CLI, mint tokens, verify balance in UI |
-| `send-public.spec.ts` | Send public note A->B, B syncs and claims |
-| `send-private.spec.ts` | Send private note A->B via transport layer |
-| `multi-claim.spec.ts` | Mint 3 notes, batch claim |
-| `multi-account.spec.ts` | Multiple accounts, switch, send between own accounts |
-
-### Agentic Debug Mode
-
-**For AI agents running this as a verification loop.** On test failure, browsers stay open so the agent can inspect live state and hot-reload fixes.
-
-```bash
-# Run with agentic mode
-E2E_AGENTIC=true E2E_NETWORK=testnet yarn test:e2e:blockchain:run
-
-# Or use the shortcut script
-yarn test:e2e:blockchain:agentic
+node /tmp/cdp-eval 'window.__TEST_SKIP_ONBOARDING = true; window.location.reload()'
 ```
+Bypass lives in `Welcome.tsx`, only active when flag/query param set.
 
-#### On Failure: What Happens
-
-1. **Browsers stay open** -- Both Chrome instances remain alive with full wallet state (IndexedDB, service worker, vault)
-2. **`test-results/debug-session.json`** is written with connection details:
-   ```json
-   {
-     "wallets": {
-       "A": { "extensionId": "abc...", "fullpageUrl": "chrome-extension://abc.../fullpage.html", "cdpUrl": "ws://...", "userDataDir": "/tmp/..." },
-       "B": { "extensionId": "def...", "fullpageUrl": "chrome-extension://def.../fullpage.html", "cdpUrl": "ws://...", "userDataDir": "/tmp/..." }
-     },
-     "midenCliWorkDir": "/tmp/miden-cli-...",
-     "reportPath": "test-results/run-.../tests/.../report.json"
-   }
-   ```
-3. **`report.json`** contains structured failure diagnosis (see "Reading Failure Reports" below)
-4. **Auto-cleanup** after 10 min (configurable via `E2E_AGENTIC_TIMEOUT`)
-
-#### Agent Investigation Workflow
-
-After a test failure in agentic mode:
-
-1. **Read the failure report:**
-   ```bash
-   cat test-results/run-<latest>/tests/<test-name>/report.json
-   ```
-   Key fields: `failureCategory`, `failedAtStep`, `diagnosticHints`, `stateAtFailure`, `browserErrors`
-
-2. **Take fresh screenshots of live wallets:**
-   Use CDP or Playwright's still-alive connection to screenshot the current state.
-
-3. **Query wallet state via the exposed Zustand store:**
-   ```typescript
-   // In page.evaluate() on an open wallet page:
-   const store = (window as any).__TEST_STORE__;
-   const state = store.getState();
-   // state.status, state.accounts, state.balances, state.currentAccount
-   ```
-
-4. **Trigger a sync manually:**
-   ```typescript
-   // In page.evaluate():
-   const intercom = (window as any).__TEST_INTERCOM__;
-   intercom.request({ type: 'SYNC_REQUEST' });
-   ```
-
-5. **Run miden-client commands against the preserved state:**
-   ```bash
-   cd <midenCliWorkDir>   # from debug-session.json
-   miden-client account --list
-   miden-client sync
-   miden-client notes --list
-   ```
-
-6. **Navigate the wallet UI** to different pages to investigate visually.
-
-#### Hot-Reload: Fix Code and Push to Live Browsers
-
-The agent can modify wallet source code, rebuild, and reload into the still-open browsers **without losing wallet state**:
-
+### iOS debugging
+`console.log` goes to Safari Web Inspector — Claude cannot read it. Use:
 ```bash
-# 1. Fix the bug in source code
-# 2. Rebuild the extension
-yarn test:e2e:blockchain:build
-
-# 3. Reload the extension in each open Chrome instance
-#    (via page.evaluate on the extension's fullpage tab)
-```
-
-```typescript
-// In page.evaluate() on the wallet's fullpage tab:
-chrome.runtime.reload();
-// Extension reloads from updated dist/chrome_unpacked/
-// IndexedDB + vault data PERSIST (tied to extension origin)
-// Service worker restarts, in-memory Zustand state resets
-```
-
-After `chrome.runtime.reload()`, extension pages unload. Re-open the fullpage tab:
-```
-chrome-extension://<extensionId>/fullpage.html
+xcrun simctl spawn booted log stream --predicate 'process == "App"'
 ```
-The wallet initializes from IndexedDB -- same accounts, same keys, same balances. The agent can now test the fix against the exact wallet state that caused the failure.
-
-### Reading Failure Reports
-
-The `report.json` is designed for machine consumption. Key fields for an AI agent:
-
-```typescript
-{
-  failureCategory: string,     // "timeout_waiting_for_sync" | "ui_element_not_found" | etc.
-  diagnosticHints: string[],   // Pre-computed suggestions, e.g., "NETWORK: 3 RPC requests failed"
-  failedAtStep: {
-    index: number,             // Which test step failed (0-based)
-    name: string,              // "sync_wallet_b"
-    lastAction: string         // What was happening when it failed
-  },
-  stateAtFailure: {
-    walletA: { status, balances, claimableNotes, currentUrl },
-    walletB: { status, balances, claimableNotes, currentUrl }
-  },
-  browserErrors: [...],        // JS errors from both extension instances
-  failedNetworkRequests: [...], // Failed RPC calls
-  recentEvents: [...],         // Last 50 timeline events before failure
-  timing: {
-    wasTimeout: boolean,       // Did we hit the test timeout?
-    slowestSteps: [...]        // Which steps were unusually slow?
-  }
-}
-```
-
-**Diagnosis flowchart:**
-- `wasTimeout: true` + `failedAtStep.name` contains "sync" -> Blockchain sync issue, check network
-- `browserErrors` contains "recursive use of an object" -> WASM concurrency bug
-- `failedNetworkRequests` not empty -> Node/RPC connectivity issue
-- `failureCategory === 'ui_element_not_found'` -> UI changed, update selectors in `wallet-page.ts`
-- `failureCategory === 'cli_command_failed'` -> Check `recentCliCommands` for stderr
-
-### Observability Artifacts
-
-Every test run produces structured artifacts in `test-results/run-<timestamp>/tests/<test-name>/`:
-
-| File | Purpose |
-|------|---------|
-| `report.json` | Primary diagnostic document (read this first) |
-| `timeline.ndjson` | Chronological event stream (every action, assertion, CLI call, console log) |
-| `checkpoints.json` | Step-by-step pass/fail with assertion details |
-| `state-snapshots/` | Wallet Zustand state at each checkpoint |
-| `cli/` | miden-client CLI invocations with full stdout/stderr |
-| `browser/wallet-{a,b}-console.ndjson` | Browser console output from both extensions |
-| `screenshots/` | Screenshots at checkpoints + on failure |
-| `traces/wallet-{a,b}.zip` | Playwright traces (open with `npx playwright show-trace`) |
-| `video/` | Video recordings (only on failure) |
-
-### Source Modifications for E2E
-
-The E2E build (`MIDEN_E2E_TEST=true`) exposes test hooks on `window`:
-
-- `window.__TEST_STORE__` -- Zustand store (`useWalletStore`) for reading wallet state via `page.evaluate()`
-- `window.__TEST_INTERCOM__` -- Intercom client instance for sending `SyncRequest` and other messages to the service worker
-
-These are only present when built with `MIDEN_E2E_TEST=true` and have zero impact on production builds.
-
-### Custom Faucet Token Discovery
-
-The E2E harness deploys its own faucet via `miden-client new-account --account-type fungible-faucet`. Tokens from this custom faucet appear in the wallet because:
-- The wallet fetches ALL fungible assets from the account vault (no `TOKEN_MAPPING` whitelist)
-- Token metadata (symbol, decimals) is fetched from the RPC node as long as the faucet is deployed with `--storage-mode public`
-- Custom tokens show with their proper symbol (e.g., "TST") in the UI, are selectable in the send flow, and have correct decimal formatting
-
-## E2E iOS Simulator Test Harness
-
-Mirror of the Chrome E2E suite, but driving two iPhone 17 / iPhone 17 Pro simulators in parallel against the iOS app. Same 7 specs, ported to `playwright/e2e/ios/tests/*.ios.spec.ts`.
-
-### Quick Start
+For live DOM/JS eval: use the CDP bridge via `inspect` + persistent-connection daemon (`/tmp/cdp-daemon.mjs` + `/tmp/cdp-eval`). Bringup recipe in `~/.claude/projects/-Users-celrisen-miden-miden-wallet/memory/cdp-bridge-single-use-bug.md`. Key steps: kill bridges, reset `com.apple.webinspectord`, relaunch app, start `inspect`, start daemon, smoke-test with `node /tmp/cdp-eval '1+1'`.
 
+### Verifying UI fixes
+Always screenshot to verify:
 ```bash
-yarn test:e2e:mobile:devnet      # build app + run full iOS suite on devnet
-yarn test:e2e:mobile:testnet     # same on testnet
-yarn test:e2e:mobile:run         # skip rebuild (re-run only)
-yarn test:e2e:mobile:build       # build app only
+xcrun simctl io booted screenshot /tmp/shot.png
+xcrun simctl spawn booted notifyutil -p com.apple.BiometricKit_Sim.fingerTouch.match  # FaceID
 ```
 
-The first run boots two simulators (iPhone 17 + iPhone 17 Pro), creating them if absent. UDIDs persist at `test-results-ios/.device-pair.json` so subsequent runs reuse the same booted devices — saves ~30s per run.
+### Common iOS layout issues
+- Grey bar at bottom → `100dvh` doesn't account for safe areas. Use `100%` + `env(safe-area-inset-*)` padding on `mobile.html` body.
+- Debug UI text should be `select-text` so errors are copyable.
 
-### Architecture
+### Native navbar overlay
+Mobile hides React footer and renders bottom nav as native pill (iOS: `MidenNavbarOverlayWindow` `UIWindow`; Android: two-instance `NavbarOverlayManager` with Activity-scoped + Dialog-scoped `NavbarView`). Plugin methods: `showNativeNavbar`, `setNavbarSecondaryRow`, `setNavbarAction`, `morphNavbar{Out,In}`. Events: `nativeNavbarTap`, `nativeNavbarSecondaryTap`, `nativeNavbarActionTap`. Wiring: `src/app/providers/DappBrowserProvider.tsx`. Android gotchas: don't use `MATCH_PARENT` children in `WRAP_CONTENT` parents (1878px buttons); `Dialog.setLayout` must follow `setContentView`; shadow must be on the view owning the background drawable.
 
+### Adding Capacitor plugins
+`yarn add @capacitor/<name> && yarn mobile:sync`. Add ProGuard rules to `android/app/proguard-rules.pro`:
 ```
-playwright/e2e/ios/
-  helpers/
-    simulator-control.ts   # xcrun simctl wrapper (boot, install, launch, terminate)
-    cdp-bridge.ts          # WebKit Inspector bridge via appium-remote-debugger
-    ios-wallet-page.ts     # WalletPage interface impl backed by CDP + simctl
-  fixtures/
-    two-simulators.ts      # Playwright fixture; same shape as two-wallets
-    global-setup.ts        # asserts App.app, reserves+boots device pair
-    global-teardown.ts     # no-op (devices stay booted between runs)
-  tests/
-    *.ios.spec.ts          # ported specs (one-line import change from Chrome)
+-keep class com.capacitorjs.plugins.<name>.** { *; }
 ```
+Remove rules when uninstalling.
 
-The `WalletPage` interface in `playwright/e2e/helpers/wallet-page.ts` is shared between Chrome and iOS — same method signatures, different impls. The harness (`playwright/e2e/harness/`) is platform-neutral and is reused wholesale; per-wallet `SnapshotCaps` closures supplied by the fixture absorb platform-specific bits (page.evaluate, service-worker queries on Chrome; CdpSession.evaluate on iOS).
-
-### CDP Bridge (appium-remote-debugger)
-
-`remotedebug-ios-webkit-adapter` does NOT work on simulators (it wraps libimobiledevice which is USB-only). We use `appium-remote-debugger` instead, which talks the WebKit Inspector Protocol directly over the per-simulator UNIX socket at `/private/tmp/com.apple.launchd.<RANDOM>/com.apple.webinspectord_sim.socket`.
-
-The socket path is discovered per-boot via:
-```bash
-xcrun simctl spawn <udid> launchctl print user/501 | grep RWI_LISTEN_SOCKET
-```
-
-`CdpBridge.connect({ udid, bundleId })` resolves the socket, calls `selectApp(null, 5, true)` with `additionalBundleIds: ['*']` to find the app's WebView page, then `selectPage(appKey, pageNum)`. Returns a `CdpSession` that wraps `executeAtom('execute_script', [body, []])` for repeated evaluation.
-
-### Per-Test Isolation
-
-Boot is amortized across runs (devices stay booted). Per-test, the fixture does:
-1. `terminate` the app (if running)
-2. `uninstall` it (wipes IndexedDB + Preferences sandbox)
-3. `install` the freshly-built `.app`
-4. `launch` with `MIDEN_E2E_TEST=true`
-5. Connect CDP and construct `IosWalletPage`
-
-Total ~5s per wallet — much cheaper than the ~30s `simctl erase` would cost.
-
-### Onboarding Bypass
-
-Mirroring the wallet's official test hook (`Welcome.tsx`), iOS spec wallets skip seed-phrase backup/verify by setting `window.__TEST_SKIP_ONBOARDING = true` + `?__test_skip_onboarding=1` and tapping "Get started". This is what `IosWalletPage.createNewWallet` does. Specs that need a real seed phrase should use `importWallet()`.
-
-### Reading iOS Failure Reports
-
-Same artifact tree as Chrome, output to `test-results-ios/run-<timestamp>/tests/<test>/`. The `WalletSnapshot.platform` discriminator is `'ios'` (vs `'chrome'`); `serviceWorkerStatus` and `extensionId` are omitted. `runtimeInfo.kind === 'ios'` in the run manifest. All consumers (`failure-report.ts`, `diagnostic-hints.ts`) handle both platforms.
+## Desktop (Tauri)
 
-### Known Limitations
+- `src-tauri/src/{main,dapp_browser,lib}.rs`, `scripts/dapp-injection.js`
+- Clear state: `rm -rf ~/Library/WebKit/{com.miden.wallet,miden-wallet}`
+- dApp flow: inject encodes base64 request → navigate `https://miden-wallet-request/{payload}` → Tauri `on_navigation` intercepts → event to main window → `DesktopDappHandler` confirms → response via same URL-intercept pattern.
 
-- Headless mode is not available — Simulator.app must be running. The harness boots devices but does not control the GUI window. CI runners need a graphical session.
-- The CDP bridge picks the first WebKit page on the inspector. The wallet uses one WebView, so this is fine; if a future build adds a dApp browser WebView, `CdpBridge.connect` needs a target-disambiguation parameter.
-- `simctl` does NOT support keyboard input from outside the simulator. The iOS POM dispatches React-compatible `input`/`change` events directly via DOM rather than typing into native fields. For native iOS sheets / system dialogs this won't work — only WebView content is reachable.
+## E2E
 
-### Empirical Status (2026-04-14)
+### Chrome blockchain harness
+Two Chrome instances + `miden-client` CLI against live network. `E2E_NETWORK` controls both harness endpoints AND `MIDEN_NETWORK` baked into the bundle — use the `:<network>` scripts to keep them matched. Auto-installs `miden-client-cli` from crates.io, version-matched to `@miden-sdk/miden-sdk`. Requires `cargo`. Specs: `wallet-lifecycle`, `mint-and-balance`, `send-{public,private}`, `multi-{claim,account}` in `playwright/e2e/tests/`.
 
-**7/7 iOS specs pass on devnet in ~9 min wall clock.** Per-spec timing:
+**Agentic mode** (`E2E_AGENTIC=true` or `yarn test:e2e:blockchain:agentic`): on failure, browsers stay open 10 min; `test-results/debug-session.json` has connection info; `report.json` has `failureCategory`, `diagnosticHints`, `stateAtFailure`, `browserErrors`. Hot-reload via `chrome.runtime.reload()` preserves IndexedDB/vault.
 
-| Spec | Duration |
-|---|---|
-| mint-and-balance | 1.7m |
-| multi-account | 1.2m |
-| multi-claim | 1.4m |
-| send-private | 1.8–2.4m |
-| send-public | 1.7m |
-| wallet-lifecycle (2 tests) | 42s total |
+### iOS simulator harness
+Mirror suite in `playwright/e2e/ios/` against iPhone 17 + iPhone 17 Pro. CDP via `appium-remote-debugger` (simulator-compatible, unlike `remotedebug-ios-webkit-adapter`) over `RWI_LISTEN_SOCKET`. Per-test: terminate/uninstall/install/launch (~5s vs 30s for `simctl erase`). 7/7 specs pass on devnet in ~9 min.
 
-### Key product/test patterns the iOS port uncovered
+iOS-specific product notes:
+- Native navbar CTAs ("Claim All", "Continue") live in `UIWindow` outside WebView — CDP can't see them. `src/lib/dapp-browser/use-native-navbar-action.ts` exposes `globalThis.__TEST_TRIGGER_NAVBAR_ACTION__()` gated on `MIDEN_E2E_TEST=true && isMobile()`. Only wallet source change the iOS harness needed.
+- No `SYNC_REQUEST` on mobile (SW-only); `useSyncTrigger` auto-syncs every 3s, so sleep suffices.
+- No mobile reload trick — mobile `claimAllNotes` skips the `location.reload()` Chrome does (mobile has no SW holding the unlock, so reload drops decryption key).
+- Don't read WASM client from CDP — deadlocks against `useSyncTrigger`'s 30–60s lock hold.
 
-- **Native navbar actions need a JS test hook.** The wallet hoists primary-CTA buttons ("Claim All", "Continue" in Send, etc.) to the native iOS navbar overlay (`MidenNavbarOverlayWindow`) via `useNativeNavbarAction`. That overlay lives in a separate `UIWindow` outside the WebView — CDP can't see it and `xcrun simctl` can't do coordinate taps, so a small test hook in `src/lib/dapp-browser/use-native-navbar-action.ts` exposes `globalThis.__TEST_TRIGGER_NAVBAR_ACTION__()` (gated on `MIDEN_E2E_TEST=true && isMobile()`). `IosWalletPage.triggerNavbarAction` polls + calls it. This is the ONLY wallet source-code change the iOS harness needed.
-- **Mobile auto-consume is identical to Chrome** (`Explore.tsx → autoConsumeMidenNotes`, gated to the well-known MIDEN faucet on both). The difference Chrome tests rely on is purely in `getBalance` reading `chrome.storage.local.miden_sync_data.notes` to count pending custom-faucet notes; mobile has no equivalent, so iOS specs call `walletX.claimAllNotes()` explicitly between mint and balance-verify. This is the honest user flow on mobile anyway.
-- **Reload kills mobile session.** Chrome's `claimAllNotes` does a `location.reload()` first to get a fresh Dexie handle — safe on Chrome because the SW holds the vault unlock in a separate context. On mobile there's no SW; a reload drops the in-memory decryption key and bounces back to the password screen. iOS `claimAllNotes` skips the reload.
-- **`useSyncTrigger` auto-syncs every 3s on mobile.** No need for iOS `triggerSync` to send `SYNC_REQUEST` — a sleep suffices. (The intercom `SYNC_REQUEST` handler doesn't exist on mobile anyway; it's a Chrome SW-only message.)
-- **`execute_script` vs `execute_async_script`.** Appium's sync atom fails silently on multi-statement bodies if you wrap them in `return (...)` — pass the body verbatim (with an explicit `return`). Promise-returning code must use the async atom with an explicit callback call; add an outer JS timeout to avoid waiting forever when the script never invokes the callback.
+### E2E test hooks
+`MIDEN_E2E_TEST=true` exposes `window.__TEST_STORE__` (Zustand) and `window.__TEST_INTERCOM__`. Zero production impact.
 
-### Why WASM-client access from CDP is off-limits
-
-Tempting to read `getConsumableNotes(address)` directly to mirror Chrome's "pending notes count toward balance" semantics. **Don't.** Any WASM client call must go through `withWasmClientLock`, but `useSyncTrigger` holds the lock for 30–60s on simulator while syncing; a concurrent read deadlocks, and skipping the lock violates the "recursive use of an object" invariant. Claim explicitly via the UI path instead.
-
-## Internationalization (i18n)
-
-**IMPORTANT:** All user-facing text in React components MUST be internationalized. Never use hardcoded strings for UI text - always use `t('key')` or the `<T id="key" />` component. CI will block PRs with non-i18n'd strings (enforced by `yarn lint:i18n`).
-
-When adding new translatable strings, add them to `public/_locales/en/en.json`, NOT `messages.json`.
-
-- `en.json` - Flat format source file (`"key": "value"`). The translation script reads from this file.
-- `messages.json` - Chrome extension format (`"key": { "message": "value", "englishSource": "value" }`). Auto-generated.
-
-### Adding new i18n strings
-
-1. Add the key to `public/_locales/en/en.json` in flat format:
-   ```json
-   "myNewKey": "My new translatable string"
-   ```
-
-2. Use in React components with `useTranslation` hook:
-   ```typescript
-   import { useTranslation } from 'react-i18next';
-
-   const { t } = useTranslation();
-   return <span>{t('myNewKey')}</span>;
-   ```
-
-3. CI will auto-translate to other languages via `yarn createTranslationFile`
-
-### Placeholders in translations
-
-Use `$placeholder$` format for dynamic values:
-```json
-"greeting": "Hello $name$, you have $count$ messages"
-```
-
-## Transaction Processing
-
-### Background Transaction Processing
-
-For operations that should happen silently (like auto-consume), use `startBackgroundTransactionProcessing`:
-
-```typescript
-import { startBackgroundTransactionProcessing } from 'lib/miden/activity';
-import { useMidenContext } from 'lib/miden/front';
-
-const { signTransaction } = useMidenContext();
+## Testing
 
-// Queue transactions first
-await initiateConsumeTransaction(accountPublicKey, note, isDelegatedProvingEnabled);
+Jest + RTL. Mock `lib/intercom` for frontend tests; wrap with `WalletStoreProvider` + `MidenContextProvider`.
 
-// Then process silently in background (no modal/tab)
-startBackgroundTransactionProcessing(signTransaction);
-```
+Gotchas:
+- `jest.mock()` path must match the import path used in source (e.g., `'lib/miden/back/vault'`, not `'./vault'`).
+- `window.location.reload` can't be mocked in jsdom — wrap calls in try/catch.
+- `afterEach(() => testRoot.unmount())` to prevent React cross-test pollution.
 
-This is preferred over `openLoadingFullPage()` for automatic operations because:
-- Doesn't interrupt the user with a modal (mobile) or new tab (desktop)
-- Polls every 5 seconds for up to 5 minutes
-- Works on both mobile and desktop
+## Code style
 
-### Transaction States
+Prettier: 120 cols, single quotes, semicolons, trailing commas. Break long `console.log`s across lines. `yarn format` to fix.
 
-Transactions flow through these states in `ITransactionStatus`:
-1. `Queued` (0) - Initial state when transaction is created
-2. `GeneratingTransaction` (1) - Being processed
-3. `Completed` (2) - Successfully finished
-4. `Failed` (3) - Error occurred
+No `any`, no `as`. Use concrete types.
 
-## Important Notes
+## Conventions
 
-- **Never push without explicit request.** Creating commits is fine, but never run `git push` unless the user explicitly asks.
-- **Keep commit messages short.** Use single-line messages (e.g., "fix: add missing i18n keys").
-- Uses yarn, not npm (yarn.lock is the lockfile)
-- Browser extension APIs via `webextension-polyfill`
-- Miden SDK is a WASM module (`@miden-sdk/miden-sdk`)
-- Sensitive data (vault, keys) stays in backend only
-- Frontend receives sanitized state via `toFront()` in backend store
+- Commit messages: single-line, short. Never sign commits (no `Co-Authored-By`).
+- Never `git push` without explicit request.
+- Stay within requested scope — don't modify files beyond the task.
+- Update `CHANGELOG.md` one-liner per PR/task (not per fix).
+- When adding a new intercom message type, also update `src/lib/intercom/mobile-adapter.ts`.
+- Optimistic updates: snapshot prev, apply, rollback on catch.
+- Background auto-ops: use `startBackgroundTransactionProcessing` (polls 5s × 5min, no modal) instead of `openLoadingFullPage`.
+- Transaction states (`ITransactionStatus`): Queued(0) → GeneratingTransaction(1) → Completed(2) / Failed(3).
+- Frontend receives sanitized state via `toFront()`; sensitive data (vault, keys) stays backend-only.
diff --git a/package.json b/package.json
index ea8a1b66a..d4dfb52a6 100644
--- a/package.json
+++ b/package.json
@@ -7,9 +7,9 @@
   },
   "scripts": {
     "start": "yarn watch:src",
-    "dev": "rimraf ./dist && concurrently yarn:watch:*",
+    "dev": "rimraf ./dist && cross-env TARGET_BROWSER=chrome MODE_ENV=development NODE_ENV=development yarn build:bg && concurrently -n bg,ext -c blue,green \"cross-env TARGET_BROWSER=chrome MODE_ENV=development NODE_ENV=development vite build --config vite.background.config.ts --watch\" \"cross-env TARGET_BROWSER=chrome MANIFEST_VERSION=3 MODE_ENV=development NODE_ENV=development vite build --config vite.extension.config.ts --watch\"",
     "dev-clean": "rimraf node_modules && yarn cache clean && yarn install && yarn dev",
-    "watch:src": "echo 'Use vite dev instead'",
+    "watch:src": "vite run --config vite.extension.config.ts",
     "watch:dist": "mv3-hot-reload",
     "build": "yarn build:extension && yarn build:mobile",
     "build:extension": "cross-env TARGET_BROWSER=chrome yarn build:bg && cross-env TARGET_BROWSER=chrome MANIFEST_VERSION=3 yarn build:ext",
@@ -80,7 +80,7 @@
     "desktop:build": "yarn build:desktop && yarn tauri build",
     "desktop:reset": "rm -rf ~/Library/WebKit/com.miden.wallet ~/Library/Caches/com.miden.wallet ~/Library/Application\\ Support/com.miden.wallet",
     "build:devnet": "rimraf ./dist && yarn clear:webpack-cache && cross-env MIDEN_NETWORK=devnet DISABLE_TS_CHECKER=true NODE_ENV=development MODE_ENV=production MANIFEST_VERSION=3 webpack",
-    "dev:devnet": "cross-env MIDEN_NETWORK=devnet DISABLE_TS_CHECKER=true NODE_ENV=development MODE_ENV=development MANIFEST_VERSION=3 webpack --watch --progress",
+    "dev:devnet": "cross-env MIDEN_NETWORK=devnet yarn dev",
     "build:desktop:devnet": "rimraf ./dist/desktop && cross-env MIDEN_NETWORK=devnet DISABLE_TS_CHECKER=true NODE_ENV=development MODE_ENV=production webpack --config webpack.desktop.config.js",
     "tauri": "tauri"
   },
@@ -104,13 +104,13 @@
     "@dicebear/avatars-jdenticon-sprites": "4.2.5",
     "@floating-ui/react": "^0.27.16",
     "@hookform/resolvers": "^3.9.0",
-    "@miden-sdk/miden-sdk": "0.14.1",
+    "@miden-sdk/miden-sdk": "^0.14.3",
     "@miden-sdk/react": "0.14.1",
     "@miden/dapp-browser": "link:./packages/dapp-browser",
     "@newhighsco/storybook-addon-svgr": "^2.0.7",
     "@noble/hashes": "^1.4.0",
-    "@openzeppelin/guardian-client": "^0.13.4",
-    "@openzeppelin/miden-multisig-client": "^0.13.4",
+    "@openzeppelin/guardian-client": "^0.14.3",
+    "@openzeppelin/miden-multisig-client": "^0.14.3",
     "@peculiar/webcrypto": "1.1.6",
     "@radix-ui/react-slot": "^1.2.3",
     "@segment/analytics-node": "^2.3.0",
diff --git a/src/lib/intercom/mobile-adapter.ts b/src/lib/intercom/mobile-adapter.ts
index 5b8bf8891..4c786bcea 100644
--- a/src/lib/intercom/mobile-adapter.ts
+++ b/src/lib/intercom/mobile-adapter.ts
@@ -59,23 +59,24 @@ export class MobileIntercomAdapter {
    */
   private async processRequest(req: WalletRequest): Promise<WalletResponse | void> {
     switch (req?.type) {
-      case WalletMessageType.GetStateRequest:
+      case WalletMessageType.GetStateRequest: {
         const state = await Actions.getFrontState();
         return {
           type: WalletMessageType.GetStateResponse,
           state
         };
+      }
 
       case WalletMessageType.NewWalletRequest:
-        await Actions.registerNewWallet((req as any).password, (req as any).mnemonic, (req as any).ownMnemonic);
+        await Actions.registerNewWallet(req.walletType, req.password, req.mnemonic, req.ownMnemonic);
         return { type: WalletMessageType.NewWalletResponse };
 
       case WalletMessageType.ImportFromClientRequest:
-        await Actions.registerImportedWallet((req as any).password, (req as any).mnemonic);
+        await Actions.registerImportedWallet(req.password, req.mnemonic);
         return { type: WalletMessageType.ImportFromClientResponse };
 
       case WalletMessageType.UnlockRequest:
-        await Actions.unlock((req as any).password);
+        await Actions.unlock(req.password);
         return { type: WalletMessageType.UnlockResponse };
 
       case WalletMessageType.LockRequest:
@@ -83,76 +84,97 @@ export class MobileIntercomAdapter {
         return { type: WalletMessageType.LockResponse };
 
       case WalletMessageType.CreateAccountRequest:
-        await Actions.createHDAccount((req as any).walletType, (req as any).name);
+        await Actions.createHDAccount(req.walletType, req.name);
         return { type: WalletMessageType.CreateAccountResponse };
 
       case WalletMessageType.UpdateCurrentAccountRequest:
-        await Actions.updateCurrentAccount((req as any).accountPublicKey);
+        await Actions.updateCurrentAccount(req.accountPublicKey);
         return { type: WalletMessageType.UpdateCurrentAccountResponse };
 
-      case WalletMessageType.RevealMnemonicRequest:
-        const mnemonic = await Actions.revealMnemonic((req as any).password);
+      case WalletMessageType.RevealMnemonicRequest: {
+        const mnemonic = await Actions.revealMnemonic(req.password);
         return {
           type: WalletMessageType.RevealMnemonicResponse,
           mnemonic
         };
+      }
 
       case WalletMessageType.RemoveAccountRequest:
-        await Actions.removeAccount((req as any).accountPublicKey, (req as any).password);
+        await Actions.removeAccount(req.accountPublicKey, req.password);
         return {
           type: WalletMessageType.RemoveAccountResponse
         };
 
       case WalletMessageType.EditAccountRequest:
-        await Actions.editAccount((req as any).accountPublicKey, (req as any).name);
+        await Actions.editAccount(req.accountPublicKey, req.name);
         return {
           type: WalletMessageType.EditAccountResponse
         };
 
       case WalletMessageType.ImportAccountRequest:
-        await Actions.importAccount((req as any).privateKey, (req as any).encPassword);
+        await Actions.importAccount(req.privateKey, req.encPassword);
         return {
           type: WalletMessageType.ImportAccountResponse
         };
 
       case WalletMessageType.UpdateSettingsRequest:
-        await Actions.updateSettings((req as any).settings);
+        await Actions.updateSettings(req.settings);
         return {
           type: WalletMessageType.UpdateSettingsResponse
         };
 
-      case WalletMessageType.SignTransactionRequest:
-        const signature = await Actions.signTransaction((req as any).publicKey, (req as any).signingInputs);
+      case WalletMessageType.SignTransactionRequest: {
+        const signature = await Actions.signTransaction(req.publicKey, req.signingInputs);
         return {
           type: WalletMessageType.SignTransactionResponse,
           signature
         };
+      }
+
+      case WalletMessageType.SignWordRequest: {
+        const wordSignature = await Actions.signWord(req.publicKey, req.wordHex);
+        return {
+          type: WalletMessageType.SignWordResponse,
+          signature: wordSignature
+        };
+      }
 
-      case WalletMessageType.GetAuthSecretKeyRequest:
-        const key = await Actions.getAuthSecretKey((req as any).key);
+      case WalletMessageType.GetPublicKeyForCommitmentRequest: {
+        const publicKey = await Actions.getPublicKeyForCommitment(req.commitment);
+        return {
+          type: WalletMessageType.GetPublicKeyForCommitmentResponse,
+          publicKey
+        };
+      }
+
+      case WalletMessageType.GetAuthSecretKeyRequest: {
+        const key = await Actions.getAuthSecretKey(req.key);
         return {
           type: WalletMessageType.GetAuthSecretKeyResponse,
           key
         };
+      }
 
-      case MidenMessageType.DAppGetAllSessionsRequest:
+      case MidenMessageType.DAppGetAllSessionsRequest: {
         const allSessions = await Actions.getAllDAppSessions();
         return {
           type: MidenMessageType.DAppGetAllSessionsResponse,
           sessions: allSessions
         };
+      }
 
-      case MidenMessageType.DAppRemoveSessionRequest:
-        const sessions = await Actions.removeDAppSession((req as any).origin);
+      case MidenMessageType.DAppRemoveSessionRequest: {
+        const sessions = await Actions.removeDAppSession(req.origin);
         return {
           type: MidenMessageType.DAppRemoveSessionResponse,
           sessions
         };
+      }
 
-      case MidenMessageType.PageRequest:
+      case MidenMessageType.PageRequest: {
         const dAppEnabled = await Actions.isDAppEnabled();
         if (dAppEnabled) {
-          if ((req as any).payload === 'PING') {
+          if (req.payload === 'PING') {
             return {
               type: MidenMessageType.PageResponse,
               payload: 'PONG'
@@ -160,11 +182,7 @@ export class MobileIntercomAdapter {
           }
           // PR-4 chunk 8: thread the multi-instance session id through if
           // present so confirmation prompts route to the right session.
-          const resPayload = await Actions.processDApp(
-            (req as any).origin,
-            (req as any).payload,
-            (req as any).sessionId
-          );
+          const resPayload = await Actions.processDApp(req.origin, req.payload, req.sessionId);
           return {
             type: MidenMessageType.PageResponse,
             /* c8 ignore next -- dApp response nullish fallback, mobile-only */
@@ -172,6 +190,7 @@ export class MobileIntercomAdapter {
           };
         }
         break;
+      }
 
       default:
         console.warn('MobileIntercomAdapter: Unknown request type', req?.type);
diff --git a/src/lib/miden-chain/constants.ts b/src/lib/miden-chain/constants.ts
index dc6dc2f78..0a734c4a3 100644
--- a/src/lib/miden-chain/constants.ts
+++ b/src/lib/miden-chain/constants.ts
@@ -72,7 +72,7 @@ export const TOKEN_MAPPING = {
   [MidenTokens.Miden]: { faucetId: 'mtst1aqmat9m63ctdsgz6xcyzpuprpulwk9vg_qruqqypuyph' }
 };
 
-export const DEFAULT_PSM_ENDPOINT = 'https://psm-stg.openzeppelin.com';
+export const DEFAULT_PSM_ENDPOINT = 'https://guardian-stg.openzeppelin.com';
 
 /**
  * Returns the SDK NetworkId for the current DEFAULT_NETWORK.
diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index 1912649c0..c7fe1da0a 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -1,13 +1,4 @@
-import {
-  Address,
-  InputNoteState,
-  Note,
-  NoteFilter,
-  NoteFilterTypes,
-  NoteId,
-  TransactionRequest,
-  TransactionResult
-} from '@miden-sdk/miden-sdk';
+import { InputNoteState, Note, TransactionProver, TransactionResult } from '@miden-sdk/miden-sdk';
 import { type Proposal } from '@openzeppelin/miden-multisig-client';
 import { liveQuery } from 'dexie';
 
@@ -28,7 +19,7 @@ import {
   TransactionOutput
 } from '../db/types';
 import { toNoteTypeString } from '../helpers';
-import { accountIdStringToSdk, getBech32AddressFromAccountId } from '../sdk/helpers';
+import { getBech32AddressFromAccountId } from '../sdk/helpers';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 import { MidenClientCreateOptions } from '../sdk/miden-client-interface';
 import { ConsumableNote, NoteTypeEnum, NoteType as NoteTypeString } from '../types';
@@ -694,18 +685,21 @@ const generatePsmTransaction = async (
       proposalResult = await multisigService.createConsumeNotesProposal([consumeTx.noteId]);
       break;
     }
-    case 'execute':
+    // case 'execute':
+    // default: {
+    // // For custom transactions, get TransactionSummary and create a custom proposal
+    // const summaryBytes = await withWasmClientLock(async () => {
+    //   const midenClient = await getMidenClient();
+    //   const txRequest = TransactionRequest.deserialize(transaction.requestBytes!);
+    //   return (
+    //     await midenClient.client.transactions.preview(accountIdStringToSdk(transaction.accountId), txRequest)
+    //   ).serialize();
+    // });
+    // proposalResult = await multisigService.createCustomProposal(summaryBytes);
+    // break;
+    // }
     default: {
-      // For custom transactions, get TransactionSummary and create a custom proposal
-      const summaryBytes = await withWasmClientLock(async () => {
-        const midenClient = await getMidenClient();
-        const txRequest = TransactionRequest.deserialize(transaction.requestBytes!);
-        return (
-          await midenClient.webClient.executeForSummary(accountIdStringToSdk(transaction.accountId), txRequest)
-        ).serialize();
-      });
-      proposalResult = await multisigService.createCustomProposal(summaryBytes);
-      break;
+      throw new Error(`Unsupported transaction type for PSM account: ${transaction.type}`);
     }
   }
 
@@ -720,17 +714,12 @@ const generatePsmTransaction = async (
     }
   };
 
-  // Wrap WASM client operations in a lock to prevent concurrent access
-  const transactionResultBytes = await withWasmClientLock(async () => {
+  const transactionResult = await withWasmClientLock(async () => {
     const midenClient = await getMidenClient(options);
-    return await midenClient.newTransaction(transaction.accountId, tr.serialize());
-  });
-
-  const transactionResult = TransactionResult.deserialize(transactionResultBytes);
-
-  await withWasmClientLock(async () => {
-    const midenClient = await getMidenClient();
-    await midenClient.submitTransaction(transactionResultBytes, transaction.delegateTransaction);
+    const { result } = await midenClient.client.transactions.submit(transaction.accountId, tr, {
+      prover: !transaction.delegateTransaction ? TransactionProver.newLocalProver() : undefined
+    });
+    return result;
   });
 
   switch (transaction.type) {
@@ -740,10 +729,10 @@ const generatePsmTransaction = async (
     case 'consume':
       await completeConsumeTransaction(transaction.id, transactionResult);
       break;
-    case 'execute':
-    default:
-      await completeCustomTransaction(transaction, transactionResult);
-      break;
+    // case 'execute':
+    // default:
+    //   await completeCustomTransaction(transaction, transactionResult);
+    //   break;
   }
 
   await multisigService.sync();
diff --git a/src/lib/miden/psm/account.ts b/src/lib/miden/psm/account.ts
index 51ee9e8d7..022180bda 100644
--- a/src/lib/miden/psm/account.ts
+++ b/src/lib/miden/psm/account.ts
@@ -1,4 +1,4 @@
-import { Account, AuthSecretKey, WebClient } from '@miden-sdk/miden-sdk';
+import { Account, AuthSecretKey, MidenClient } from '@miden-sdk/miden-sdk';
 import { FalconSigner, MultisigClient } from '@openzeppelin/miden-multisig-client';
 
 import { DEFAULT_PSM_ENDPOINT } from 'lib/miden-chain/constants';
@@ -26,6 +26,10 @@ export async function getSignerDetailsFromAccount(
     throw new Error('No signer public keys found in account storage');
   }
 
+  if (!mapEntries[0]) {
+    throw new Error('No signer commitments found in account storage');
+  }
+
   const commitment = mapEntries[0].value.slice(2);
   if (!commitment) {
     throw new Error('Commitment not found in account storage');
@@ -45,7 +49,11 @@ export async function getSignerDetailsFromAccount(
  * @param seed - Optional seed for key derivation (random if not provided)
  * @returns The created Account
  */
-export async function createPsmAccount(webClient: WebClient, seed?: Uint8Array): Promise<Account> {
+export async function createPsmAccount(
+  webClient: MidenClient,
+  seed?: Uint8Array,
+  skipRegistration: boolean = false
+): Promise<Account> {
   if (!seed) {
     seed = crypto.getRandomValues(new Uint8Array(32));
   }
@@ -73,17 +81,21 @@ export async function createPsmAccount(webClient: WebClient, seed?: Uint8Array):
       },
       new FalconSigner(sk)
     );
-    await multisig.registerOnGuardian();
+
+    if (!skipRegistration) {
+      await multisig.registerOnGuardian();
+    }
     // Sync state with the node
-    await webClient.syncState();
+    await webClient.sync();
 
     // Store the secret key in WebStore for signing
-    await webClient.addAccountSecretKeyToWebStore(multisig.account.id(), sk);
+    await webClient.keystore.insert(multisig.account.id(), sk);
 
     console.log('PSM account created:', multisig.account.id().toString());
 
     return multisig.account;
   } catch (e) {
+    console.log(e);
     console.error('Error creating PSM account:', e);
     throw new Error('Failed to create PSM account');
   }
diff --git a/src/lib/miden/psm/digest.ts b/src/lib/miden/psm/digest.ts
index 9a8fab4e9..c6f79540b 100644
--- a/src/lib/miden/psm/digest.ts
+++ b/src/lib/miden/psm/digest.ts
@@ -51,7 +51,7 @@ export class AuthDigest {
     for (let i = 0; i < bytes.length; i += 8) {
       let packed = 0n;
       for (let j = 0; j < 8 && i + j < bytes.length; j += 1) {
-        packed |= BigInt(bytes[i + j]) << (8n * BigInt(j));
+        packed |= BigInt(bytes[i + j]!) << (8n * BigInt(j));
       }
       payloadElements.push(new Felt(packed));
     }
diff --git a/src/lib/miden/psm/index.ts b/src/lib/miden/psm/index.ts
index 3f2a7161c..b088cced7 100644
--- a/src/lib/miden/psm/index.ts
+++ b/src/lib/miden/psm/index.ts
@@ -1,8 +1,7 @@
-import { Account, TransactionRequest, WebClient } from '@miden-sdk/miden-sdk';
+import { Account, MidenClient, TransactionRequest, WebClient } from '@miden-sdk/miden-sdk';
 import {
   Multisig,
   MultisigClient,
-  MultisigConfig,
   GuardianHttpClient,
   type ProposalMetadata,
   type TransactionProposal,
@@ -13,8 +12,9 @@ import { DEFAULT_PSM_ENDPOINT } from 'lib/miden-chain/constants';
 import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { u8ToB64 } from 'lib/shared/helpers';
 
-import { fetchFromStorage } from '../front';
+import { fetchFromStorage, putToStorage } from '../front';
 import { accountIdStringToSdk } from '../sdk/helpers';
+import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 import { MidenClientInterface } from '../sdk/miden-client-interface';
 import { WalletSigner, type SignWordFunction } from './signer';
 
@@ -48,7 +48,7 @@ export class MultisigService {
       const signer = new WalletSigner(publicKey, signerCommitment, signWordFn);
       const guardianEndpoint = (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) || DEFAULT_PSM_ENDPOINT;
 
-      const webClient = (await MidenClientInterface.create({})).webClient;
+      const webClient = (await MidenClientInterface.create({})).client;
 
       const client = new MultisigClient(webClient, { guardianEndpoint });
       const multisig = await client.load(account.id().toString(), signer);
@@ -65,7 +65,7 @@ export class MultisigService {
     signerCommitment: string,
     signWordFn: SignWordFunction,
     accountId: string,
-    webClient: WebClient
+    webClient: MidenClient
   ) {
     const psmEndpoint = (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) || DEFAULT_PSM_ENDPOINT;
     const psm = new GuardianHttpClient(psmEndpoint);
@@ -80,7 +80,7 @@ export class MultisigService {
         accountBytes[i] = binaryString.charCodeAt(i);
       }
       const account = Account.deserialize(accountBytes);
-      await webClient.newAccount(account, true);
+      await webClient.accounts.insert({ account, overwrite: true });
     } catch (error) {
       console.log('Error fetching account state from PSM:', error);
     }
@@ -150,9 +150,26 @@ export class MultisigService {
 
   async sync(): Promise<void> {
     try {
-      await this.multisig.syncState();
+      const { accountId, commitment } = await this.multisig.syncState();
+      console.log('Successfully synced multisig state for account', accountId);
+      console.log('Current commitment:', commitment);
+      const account = await withWasmClientLock(async () => {
+        const client = await getMidenClient();
+        if (!client) throw new Error('WASM client not available');
+        const acc = await client.getAccount(accountId);
+        console.log(
+          acc
+            ?.vault()
+            .fungibleAssets()
+            .map((a: any) => a.amount().toString())
+        );
+        if (!acc) throw new Error('Account not found in WASM client after sync');
+        return acc;
+      });
+      console.log('Account commitment from WASM client:', account.to_commitment().toHex());
       this.syncRetryCount = 0; // Reset retry count on successful sync
     } catch (error) {
+      console.log('[PSM] sync error ', error);
       const isNonceTooLow =
         error instanceof Error && error.message.includes('nonce') && error.message.includes('too low');
 
@@ -175,6 +192,11 @@ export class MultisigService {
   async getConsumableNotes() {
     return this.multisig.getConsumableNotes();
   }
+
+  // async switchGuardian(newGuardianEndpoint: string) {
+  //   await putToStorage(PSM_URL_STORAGE_KEY, newGuardianEndpoint);
+  //   await this.multisig.createSwitchGuardianProposal()
+  // }
 }
 
 // Re-export types that may be needed by consumers
diff --git a/src/lib/miden/sdk/helpers.ts b/src/lib/miden/sdk/helpers.ts
index f781374e3..508b0d169 100644
--- a/src/lib/miden/sdk/helpers.ts
+++ b/src/lib/miden/sdk/helpers.ts
@@ -6,3 +6,7 @@ export function getBech32AddressFromAccountId(accountId: AccountId): string {
   const accountAddress = Address.fromAccountId(accountId, 'BasicWallet');
   return accountAddress.toBech32(getNetworkId());
 }
+
+export function accountIdStringToSdk(accountIdStr: string): AccountId {
+  return Address.fromBech32(accountIdStr).accountId();
+}
diff --git a/src/lib/miden/sdk/miden-client-interface.ts b/src/lib/miden/sdk/miden-client-interface.ts
index 7860f95b6..9765f8575 100644
--- a/src/lib/miden/sdk/miden-client-interface.ts
+++ b/src/lib/miden/sdk/miden-client-interface.ts
@@ -132,18 +132,24 @@ export class MidenClientInterface {
     getPublicKeyForCommitment: (commitment: string) => Promise<string>
   ): Promise<string> {
     if (walletType === WalletType.Psm) {
-      const account = await createPsmAccount(this.client, seed);
-      console.log('[MidenClientInterface] Imported PSM account from seed with ID:', account.id().toString());
-      const accountId = account.id().toString();
-      const { commitment, publicKey } = await getSignerDetailsFromAccount(account, getPublicKeyForCommitment);
-      await MultisigService.importAccountFromPsm(
-        `0x${publicKey}`,
-        `0x${commitment}`,
-        signWordFn,
-        accountId,
-        this.client
-      );
-      return getBech32AddressFromAccountId(account.id());
+      console.log('Importing PSM account from seed');
+      try {
+        const account = await createPsmAccount(this.client, seed, true);
+        console.log('[MidenClientInterface] Imported PSM account from seed with ID:', account.id().toString());
+        const accountId = account.id().toString();
+        const { commitment, publicKey } = await getSignerDetailsFromAccount(account, getPublicKeyForCommitment);
+        await MultisigService.importAccountFromPsm(
+          `0x${publicKey}`,
+          `0x${commitment}`,
+          signWordFn,
+          accountId,
+          this.client
+        );
+        return getBech32AddressFromAccountId(account.id());
+      } catch (error) {
+        console.log(error);
+        throw new Error('Failed to import PSM account from seed');
+      }
     }
 
     return await this.importPublicMidenWalletFromSeed(seed);
diff --git a/src/lib/miden/sdk/miden-client.ts b/src/lib/miden/sdk/miden-client.ts
index a56f1d89c..36eb574c2 100644
--- a/src/lib/miden/sdk/miden-client.ts
+++ b/src/lib/miden/sdk/miden-client.ts
@@ -204,7 +204,13 @@ const midenClientSingleton = new MidenClientSingleton();
  */
 export async function getMidenClient(options?: MidenClientCreateOptions): Promise<MidenClientInterface> {
   if (options) {
-    return await midenClientSingleton.getInstanceWithOptions(options);
+    console.time('Creating MidenClient with options');
+    const client = await midenClientSingleton.getInstanceWithOptions(options);
+    console.timeEnd('Creating MidenClient with options');
+    return client;
   }
-  return await midenClientSingleton.getInstance();
+  console.time('Getting MidenClient instance');
+  const client = await midenClientSingleton.getInstance();
+  console.timeEnd('Getting MidenClient instance');
+  return client;
 }
diff --git a/vite.extension.config.ts b/vite.extension.config.ts
index 7f7d74f6a..11dc05fa6 100644
--- a/vite.extension.config.ts
+++ b/vite.extension.config.ts
@@ -6,14 +6,14 @@
  *
  * Replaces webpack.config.js entirely for the extension build.
  */
-import { resolve, join, sep } from 'path';
+import tailwindcss from '@tailwindcss/vite';
+import react from '@vitejs/plugin-react-swc';
 import { readFileSync, existsSync, mkdirSync, writeFileSync, cpSync, readdirSync, statSync } from 'fs';
+import { resolve, join, sep } from 'path';
+import { defineConfig, type Plugin } from 'vite';
 import { nodePolyfills } from 'vite-plugin-node-polyfills';
 // vite-plugin-svgr doesn't work with Vite 8's Rolldown -- use custom plugin
 import wasm from 'vite-plugin-wasm';
-import tailwindcss from '@tailwindcss/vite';
-import react from '@vitejs/plugin-react-swc';
-import { defineConfig, type Plugin } from 'vite';
 
 const pkg = require('./package.json');
 const TARGET_BROWSER = process.env.TARGET_BROWSER ?? 'chrome';
@@ -115,7 +115,7 @@ function copyPublicAssets(outDir: string): Plugin {
         cpSync(sdkWasm, join(nestedDir, 'miden_client_web.wasm'));
         cpSync(sdkWasm, join(assetsDir, 'miden_client_web.wasm'));
       }
-    },
+    }
   };
 }
 
@@ -143,7 +143,7 @@ function swPatches(): Plugin {
           chunk.code = chunk.code.replace(/^await /gm, '/* tla-stripped */ ');
         }
       }
-    },
+    }
   };
 }
 
@@ -158,7 +158,7 @@ function svgStubForBackground(): Plugin {
       if (id.endsWith('.svg') && this.getModuleInfo?.(id)?.isEntry === false) {
         return 'export const ReactComponent = () => null; export default "";';
       }
-    },
+    }
   };
 }
 
@@ -173,7 +173,7 @@ const sharedAlias = {
   components: resolve(__dirname, 'src/components'),
   screens: resolve(__dirname, 'src/screens'),
   utils: resolve(__dirname, 'src/utils'),
-  stories: resolve(__dirname, 'src/stories'),
+  stories: resolve(__dirname, 'src/stories')
 };
 
 const sharedDefine = {
@@ -183,7 +183,7 @@ const sharedDefine = {
   'process.env.MIDEN_NETWORK': JSON.stringify(process.env.MIDEN_NETWORK ?? ''),
   'process.env.MIDEN_E2E_TEST': JSON.stringify(process.env.MIDEN_E2E_TEST ?? 'false'),
   'process.env.NODE_ENV': JSON.stringify(process.env.NODE_ENV ?? 'development'),
-  'process.env.MODE_ENV': JSON.stringify(process.env.MODE_ENV ?? 'development'),
+  'process.env.MODE_ENV': JSON.stringify(process.env.MODE_ENV ?? 'development')
 };
 
 export default defineConfig({
@@ -208,20 +208,24 @@ export default defineConfig({
         const { readFileSync } = await import('fs');
         const svgContent = readFileSync(filePath, 'utf8');
         const { transform } = await import('@svgr/core');
-        const jsxCode = await transform(svgContent, {
-          plugins: ['@svgr/plugin-jsx'],
-          exportType: 'named',
-          namedExport: 'ReactComponent',
-          jsxRuntime: 'automatic',
-          prettier: false,
-          svgo: false,
-          titleProp: true,
-          ref: true,
-        }, { filePath });
+        const jsxCode = await transform(
+          svgContent,
+          {
+            plugins: ['@svgr/plugin-jsx'],
+            exportType: 'named',
+            namedExport: 'ReactComponent',
+            jsxRuntime: 'automatic',
+            prettier: false,
+            svgo: false,
+            titleProp: true,
+            ref: true
+          },
+          { filePath }
+        );
         const code = jsxCode + '\nexport default "";';
         // Return as JSX so Vite/Rolldown transforms it to JS
         return { code, moduleType: 'jsx' };
-      },
+      }
     } satisfies Plugin,
     wasm(),
     // Polyfill Node built-ins used by crypto/stream libraries (readable-stream uses util.debuglog)
@@ -229,20 +233,19 @@ export default defineConfig({
     // to avoid injecting fake document/window that break React's CSS animation detection.
     nodePolyfills({
       include: ['util', 'stream', 'assert', 'buffer', 'process'],
-      globals: { Buffer: false, process: false },
+      globals: { Buffer: false, process: false }
     }),
     // Extension HTML fixes
     {
       name: 'extension-html-fixes',
       enforce: 'post',
       transformIndexHtml(html) {
-        return html
-          .replace(/ crossorigin/g, '')
-          // Inject process global via external script (inline scripts blocked by CSP)
-          .replace(
-            '<script type="module"',
-            '<script src="/globals.js"></script>\n    <script type="module"'
-          );
+        return (
+          html
+            .replace(/ crossorigin/g, '')
+            // Inject process global via external script (inline scripts blocked by CSP)
+            .replace('<script type="module"', '<script src="/globals.js"></script>\n    <script type="module"')
+        );
       },
       // Inject global React + Buffer for CJS dependencies that expect them.
       // Rolldown's CJS-to-ESM interop scopes `var React = require_react()` inside
@@ -257,9 +260,9 @@ export default defineConfig({
             'var React = $1; globalThis.React = globalThis.React || React;'
           );
         }
-      },
+      }
     } satisfies Plugin,
-    copyPublicAssets(resolve(__dirname, OUTPUT_DIR)),
+    copyPublicAssets(resolve(__dirname, OUTPUT_DIR))
   ],
 
   // Disable Vite's built-in public dir handling -- our copyPublicAssets plugin
@@ -284,12 +287,12 @@ export default defineConfig({
         sidepanel: resolve(__dirname, 'sidepanel.html'),
         // Content scripts (need to be standalone JS files)
         contentScript: resolve(__dirname, 'src/contentScript.ts'),
-        addToWindow: resolve(__dirname, 'src/addToWindow.ts'),
+        addToWindow: resolve(__dirname, 'src/addToWindow.ts')
         // NOTE: background is built separately via vite.background.config.ts
         // because it needs inlineDynamicImports (import() is banned in SWs)
       },
       output: {
-        entryFileNames: (chunkInfo) => {
+        entryFileNames: chunkInfo => {
           // Content scripts and background need fixed names
           if (chunkInfo.name === 'contentScript') return 'contentScript.js';
           if (chunkInfo.name === 'addToWindow') return 'addToWindow.js';
@@ -297,7 +300,14 @@ export default defineConfig({
           return '[name].js';
         },
         chunkFileNames: 'chunks/[name].[hash].js',
-        assetFileNames: (assetInfo) => {
+        manualChunks(id) {
+          // Force the wasm-bindgen glue into a single shared chunk so static
+          // and dynamic imports (via `sdk-wasm-loader`) resolve to the same
+          // `class Account` / `class WebClient` — otherwise Rolldown duplicates
+          // the module per chunk and `_assertClass` fails across them.
+          if (id.includes('@miden-sdk/miden-sdk/dist/Cargo-')) return 'miden-sdk-wasm';
+        },
+        assetFileNames: assetInfo => {
           if (assetInfo.names?.[0]?.endsWith('.wasm')) {
             return 'static/wasm/[name].[hash][extname]';
           }
@@ -305,13 +315,13 @@ export default defineConfig({
             return 'static/styles/[name][extname]';
           }
           return 'static/media/[name].[hash][extname]';
-        },
-      },
-    },
+        }
+      }
+    }
   },
 
   worker: {
-    format: 'es',
+    format: 'es'
   },
 
   resolve: {
@@ -328,11 +338,8 @@ export default defineConfig({
       // virtual specifier through to the wasm-loader file directly so
       // `ensureSdkWasmReady` can call it without tripping Rolldown's
       // exports-map enforcement. See lib/miden-chain/constants.ts.
-      'sdk-wasm-loader': resolve(
-        __dirname,
-        'node_modules/@miden-sdk/miden-sdk/dist/wasm.js'
-      ),
-    },
+      'sdk-wasm-loader': resolve(__dirname, 'node_modules/@miden-sdk/miden-sdk/dist/wasm.js')
+    }
   },
 
   define: {
@@ -340,12 +347,12 @@ export default defineConfig({
     // Provide process.browser for libraries that check it
     'process.browser': 'true',
     // Global process object for compatibility
-    'global': 'globalThis',
+    global: 'globalThis'
   },
 
   css: {
     modules: {
-      generateScopedName: '[path][name]__[local]--[hash:base64:5]',
-    },
-  },
+      generateScopedName: '[path][name]__[local]--[hash:base64:5]'
+    }
+  }
 });
diff --git a/yarn.lock b/yarn.lock
index bcb06f222..7cb9228c0 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2272,19 +2272,10 @@
   dependencies:
     "@types/mdx" "^2.0.0"
 
-"@miden-sdk/miden-sdk@0.13.0":
-  version "0.13.0"
-  resolved "https://registry.yarnpkg.com/@miden-sdk/miden-sdk/-/miden-sdk-0.13.0.tgz#df7f639f90931d279761a62bb513374366d755e4"
-  integrity sha512-N0qUCZW9Dvk3Oqj37IrGmm0b0v3Nq5qHsX3BtQIzZIwDXKXKPBxy/0lO40oCwDtwI8AfriZQyMLbJR81Fo4Vpg==
-  dependencies:
-    "@rollup/plugin-typescript" "^12.3.0"
-    dexie "^4.0.1"
-    glob "^11.0.0"
-
-"@miden-sdk/miden-sdk@0.14.1":
-  version "0.14.1"
-  resolved "https://registry.yarnpkg.com/@miden-sdk/miden-sdk/-/miden-sdk-0.14.1.tgz#d5c3b1c1f4590076a289b44dd4e63495ee2e0825"
-  integrity sha512-ACa/UhHZ19WZSgqwrYtBp1Rqe97P+QKzkIf0/fAASQkpKI3UDAZaAJUqS5ADhHn+EhONYoYZg7XG7XFnpi5aTw==
+"@miden-sdk/miden-sdk@0.14.3", "@miden-sdk/miden-sdk@^0.14.3":
+  version "0.14.3"
+  resolved "https://registry.yarnpkg.com/@miden-sdk/miden-sdk/-/miden-sdk-0.14.3.tgz#9b3e1466309b92a957eb92628e28141d0b773696"
+  integrity sha512-b/dY0qn9/crxjkotpkPjf+Mm5Gl04+8EYgm0c4M2Iz4A+IQWDDka9lWUt/pV7fLx+UeZCfeFMuphkHP9vqLzUg==
   dependencies:
     "@rollup/plugin-typescript" "^12.3.0"
     dexie "^4.0.1"
@@ -2377,20 +2368,20 @@
     "@nodelib/fs.scandir" "2.1.5"
     fastq "^1.6.0"
 
-"@openzeppelin/guardian-client@^0.13.4":
-  version "0.13.4"
-  resolved "https://registry.yarnpkg.com/@openzeppelin/guardian-client/-/guardian-client-0.13.4.tgz#7e1f419e14437ee329c1484df7050b84a51f3b9d"
-  integrity sha512-YMmeBfTOXy2DklfmLW4L7A2OAnzfxGgBZTDXi5XJUKY00E91xfdFkkK3Cgde2ydmFDdy5MYxtF/cyROv5ikJBQ==
+"@openzeppelin/guardian-client@^0.14.3":
+  version "0.14.3"
+  resolved "https://registry.yarnpkg.com/@openzeppelin/guardian-client/-/guardian-client-0.14.3.tgz#7aa4602ac99aab174e4764dafa1dfd600522d9c5"
+  integrity sha512-t1HW2LxB0YWB4JZB0L1O3Ue3+/VFipmtumHbgnQeWloflym3bg6dWV75zZkcPyLACURJliT3LIhdg/3w0tcA5Q==
 
-"@openzeppelin/miden-multisig-client@^0.13.4":
-  version "0.13.4"
-  resolved "https://registry.yarnpkg.com/@openzeppelin/miden-multisig-client/-/miden-multisig-client-0.13.4.tgz#41a5431b03d32939012c388ead208271d204d889"
-  integrity sha512-A4BhB5Rc3Y/wqsBPKe4nEmQE2ZnnwVoVRpyROp5+qg0jx3XFrjqn3e5CKZz0hC1b5ybb1d2RdTGLLmpIZshekA==
+"@openzeppelin/miden-multisig-client@^0.14.3":
+  version "0.14.3"
+  resolved "https://registry.yarnpkg.com/@openzeppelin/miden-multisig-client/-/miden-multisig-client-0.14.3.tgz#f738f4ec80362a66fbd3e56cb6432d463852c682"
+  integrity sha512-kVBpEAU0cuAshVOGQ3RD+cFODxVr7dnipi1n7x2FCFmGTWktT8di441ZmPd3/qid1GEoG0Y8UaqrX+6v2YxCDw==
   dependencies:
-    "@miden-sdk/miden-sdk" "0.13.0"
+    "@miden-sdk/miden-sdk" "0.14.3"
     "@noble/curves" "^1.9.7"
     "@noble/hashes" "^2.0.1"
-    "@openzeppelin/guardian-client" "^0.13.4"
+    "@openzeppelin/guardian-client" "^0.14.3"
 
 "@oxc-project/types@=0.124.0":
   version "0.124.0"

From 2a7b723fb3e6c26e712bd06fe86c1816a1962554 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Mon, 20 Apr 2026 12:05:37 +0530
Subject: [PATCH 17/71] chore: drop verbose debug logs in intercom and
 miden-client

---
 src/lib/intercom/client.ts        |  4 ----
 src/lib/intercom/server.ts        | 11 -----------
 src/lib/miden/sdk/miden-client.ts |  4 ----
 3 files changed, 19 deletions(-)

diff --git a/src/lib/intercom/client.ts b/src/lib/intercom/client.ts
index 25715d5f5..896a4107a 100644
--- a/src/lib/intercom/client.ts
+++ b/src/lib/intercom/client.ts
@@ -132,19 +132,15 @@ export class IntercomClient implements IIntercomClient {
   private portReady: Promise<void>;
 
   constructor() {
-    console.log('[IntercomClient] Creating extension intercom client');
     this.reqId = 0;
     this.portReady = this.initPort();
   }
 
   private async initPort() {
     try {
-      console.log('[IntercomClient] Initializing port...');
       const browser = await getBrowser();
       this.port = this.buildPort(browser);
-      console.log('[IntercomClient] Port initialized successfully');
     } /* c8 ignore start -- port init errors untestable with mock getBrowser */ catch (error) {
-      console.error('[IntercomClient] Failed to initialize port:', error);
       throw error;
     } /* c8 ignore stop */
   }
diff --git a/src/lib/intercom/server.ts b/src/lib/intercom/server.ts
index 9df30a688..b126b36ac 100644
--- a/src/lib/intercom/server.ts
+++ b/src/lib/intercom/server.ts
@@ -75,17 +75,6 @@ export class IntercomServer {
 
   private handleMessage(msg: any, port: Runtime.Port) {
     if (port.sender?.id === browser.runtime.id && msg?.type === MessageType.Req) {
-      const reqType = msg?.data?.type;
-      if (reqType && reqType !== 'GET_STATE_REQUEST' && reqType !== 'SYNC_REQUEST') {
-        console.log(
-          '[IntercomServer] handleMessage:',
-          reqType,
-          'handlers:',
-          this.reqHandlers.length,
-          'initialized:',
-          this.initializedHandlers
-        );
-      }
       // If no request handler registered yet, respond with a default "Idle" state
       // for GetStateRequest so the UI can render (onboarding/unlock screen).
       // Other messages are queued for replay when the handler is registered.
diff --git a/src/lib/miden/sdk/miden-client.ts b/src/lib/miden/sdk/miden-client.ts
index 36eb574c2..8a9ee943b 100644
--- a/src/lib/miden/sdk/miden-client.ts
+++ b/src/lib/miden/sdk/miden-client.ts
@@ -204,13 +204,9 @@ const midenClientSingleton = new MidenClientSingleton();
  */
 export async function getMidenClient(options?: MidenClientCreateOptions): Promise<MidenClientInterface> {
   if (options) {
-    console.time('Creating MidenClient with options');
     const client = await midenClientSingleton.getInstanceWithOptions(options);
-    console.timeEnd('Creating MidenClient with options');
     return client;
   }
-  console.time('Getting MidenClient instance');
   const client = await midenClientSingleton.getInstance();
-  console.timeEnd('Getting MidenClient instance');
   return client;
 }

From cf19fe36df514980e30875b438c2d2392e9cfa61 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Mon, 20 Apr 2026 12:05:42 +0530
Subject: [PATCH 18/71] feat: guardian switch transaction for PSM accounts

---
 CHANGELOG.md                           |   1 +
 public/_locales/en/en.json             |   9 ++
 src/app/pages/Settings.tsx             |  45 +++++--
 src/app/templates/GuardianSettings.tsx | 172 +++++++++++++++++++++++++
 src/lib/miden/activity/transactions.ts |  97 +++++++++++++-
 src/lib/miden/db/types.ts              |  29 ++++-
 src/lib/miden/front/psm-manager.ts     |  22 +++-
 src/lib/miden/psm/index.ts             |  85 ++++++++----
 8 files changed, 421 insertions(+), 39 deletions(-)
 create mode 100644 src/app/templates/GuardianSettings.tsx

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 902fe98a0..445aa3e45 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 ### Features
 
+* [FEATURE][all] Guardian switch for PSM accounts. Settings → Guardian Settings lets the user point a PSM account at a new guardian endpoint; the switch is a signed on-chain proposal that waits for inclusion, registers the post-switch account state with the new guardian, then flips the cached `PSM_URL_STORAGE_KEY` so subsequent syncs hit the new endpoint. The frontend cache self-heals when the stored endpoint drifts, so the popup stops syncing against the old guardian across the SW/frontend realm boundary.
 * [FEATURE][all] Per-stage label in the transaction progress modal. Each observable phase boundary (`syncing`, `sending`, `confirming`, `delivering`) writes a stage marker during tx processing, and the modal renders a stage-specific title + description instead of a single opaque "Generating Transaction" for the whole 3-8s spinner window. Send-type sub-label varies by tx type (claim / execute / send), and the batch subtitle surfaces a remaining-count when more than one tx is in flight.
 
 ---
diff --git a/public/_locales/en/en.json b/public/_locales/en/en.json
index 58077eb2e..75fa15a11 100644
--- a/public/_locales/en/en.json
+++ b/public/_locales/en/en.json
@@ -357,6 +357,15 @@
   "importWithEncryptedWalletFileDescription": "Upload your encrypted wallet file to securely import your account. Your data remains private, with only hashed information stored on-chain",
   "twitter": "X (Twitter)",
   "encryptedWalletFile": "Encrypted Wallet File",
+  "guardianSettings": "Guardian Settings",
+  "currentGuardianEndpoint": "Current Guardian",
+  "newGuardianEndpoint": "New Guardian Endpoint",
+  "switchGuardian": "Switch Guardian",
+  "switchGuardianDescription": "Point your PSM account at a new guardian endpoint. The switch is signed as an on-chain proposal.",
+  "switchingGuardian": "Switching guardian...",
+  "guardianSwitched": "Guardian switched successfully.",
+  "guardianEndpointUnchanged": "That's already your current guardian.",
+  "invalidUrl": "Enter a valid URL starting with http:// or https://",
   "encryptedWalletFileDescription": "Enter your password to access your Encrypted Wallet File.",
   "encryptedWalletFileDescriptionHardware": "Unlock with your passcode to access your Encrypted Wallet File.",
   "encryptedWalletFileConfirmation": "I will not share my Encrypted Wallet File with anyone, including Miden Wallet.",
diff --git a/src/app/pages/Settings.tsx b/src/app/pages/Settings.tsx
index be2cb7829..d1b93fce2 100644
--- a/src/app/pages/Settings.tsx
+++ b/src/app/pages/Settings.tsx
@@ -29,6 +29,7 @@ import DAppDrawerSettings from 'app/templates/DAppDrawerSettings';
 import DAppSettings from 'app/templates/DAppSettings';
 import EditMidenFaucetId from 'app/templates/EditMidenFaucetId';
 import GeneralSettings from 'app/templates/GeneralSettings';
+import GuardianSettings from 'app/templates/GuardianSettings';
 import LanguageSettings from 'app/templates/LanguageSettings';
 import MenuItem from 'app/templates/MenuItem';
 import RevealSeedPhraseFlow from 'app/templates/RevealSeedPhrase';
@@ -38,9 +39,11 @@ import { getCurrentLocale } from 'lib/i18n/core';
 import { DEFAULT_NETWORK, MIDEN_NETWORK_NAME } from 'lib/miden-chain/constants';
 import { hapticLight, hapticMedium } from 'lib/mobile/haptics';
 import { isMobile } from 'lib/platform';
+import { useWalletStore } from 'lib/store';
 import { Drawer, DrawerContent, DrawerHeader, DrawerTitle } from 'lib/ui/drawer';
 import { goBack, navigate } from 'lib/woozie';
 import { EncryptedFileFlow } from 'screens/encrypted-file-flow/EncryptedFileManager';
+import { WalletType } from 'screens/onboarding/types';
 
 import pkg from '../../../package.json';
 import AdvancedSettings from './AdvancedSettings';
@@ -92,6 +95,7 @@ type Tab = {
   linksOutsideOfWallet?: boolean;
   isDrawer?: boolean;
   onClick?: () => void;
+  psmOnly?: boolean;
 };
 
 type TabGroup = {
@@ -147,6 +151,14 @@ const TAB_GROUPS: TabGroup[] = [
         Component: EncryptedFileFlow,
         testID: SettingsSelectors.EncryptedWalletFile,
         hasOwnLayout: true
+      },
+      {
+        slug: 'guardian-settings',
+        titleI18nKey: 'guardianSettings',
+        Icon: SettingsIcon,
+        Component: GuardianSettings,
+        isDrawer: true,
+        psmOnly: true
       }
     ]
   },
@@ -216,15 +228,30 @@ const HIDDEN_TABS: Tab[] = [
   }
 ];
 
-// Flat list of all tabs for route lookup
-const ALL_TABS: Tab[] = [...TAB_GROUPS.flatMap(g => g.tabs), ...HIDDEN_TABS];
-
-// Collect all drawer tabs for rendering
-const DRAWER_TABS = TAB_GROUPS.flatMap(g => g.tabs).filter(t => t.isDrawer);
-
 const Settings: FC<SettingsProps> = ({ tabSlug }) => {
   const { t } = useTranslation();
-  const activeTab = useMemo(() => ALL_TABS.find(tab => tab.slug === tabSlug && !tab.isDrawer) || null, [tabSlug]);
+  const currentAccountType = useWalletStore(s => s.currentAccount?.type);
+  const isPsmAccount = currentAccountType === WalletType.Psm;
+
+  // Filter tabs that are gated to PSM accounts. Non-PSM users don't see
+  // the Guardian Settings entry at all (menu, drawer, or routable page).
+  const tabGroups = useMemo(
+    () =>
+      TAB_GROUPS.map(group => ({
+        ...group,
+        tabs: group.tabs.filter(tab => !tab.psmOnly || isPsmAccount)
+      })).filter(group => group.tabs.length > 0),
+    [isPsmAccount]
+  );
+
+  const allTabs = useMemo(
+    () => [...tabGroups.flatMap(g => g.tabs), ...HIDDEN_TABS.filter(tab => !tab.psmOnly || isPsmAccount)],
+    [tabGroups, isPsmAccount]
+  );
+
+  const drawerTabs = useMemo(() => tabGroups.flatMap(g => g.tabs).filter(t => t.isDrawer), [tabGroups]);
+
+  const activeTab = useMemo(() => allTabs.find(tab => tab.slug === tabSlug && !tab.isDrawer) || null, [allTabs, tabSlug]);
   const languageLabel = getCurrentLanguageLabel();
   const [openDrawer, setOpenDrawer] = useState<string | null>(null);
   const [showSeedWarning, setShowSeedWarning] = useState(false);
@@ -314,7 +341,7 @@ const Settings: FC<SettingsProps> = ({ tabSlug }) => {
           // this, opting out of the body gutter via data-edge-to-edge
           // would leave the bottom row permanently hidden behind the pill.
           <div className="flex flex-col w-full pt-4 pb-[88px] gap-8 text-heading-gray px-4">
-            {TAB_GROUPS.map(group => (
+            {tabGroups.map(group => (
               <div key={group.titleI18nKey}>
                 <h3 className="font-medium pb-4 text-base text-[#868686]">{t(group.titleI18nKey)}</h3>
                 <div className="overflow-hidden flex flex-col gap-6">
@@ -356,7 +383,7 @@ const Settings: FC<SettingsProps> = ({ tabSlug }) => {
         )}
       </div>
 
-      {DRAWER_TABS.map(tab => (
+      {drawerTabs.map(tab => (
         <Drawer key={tab.slug} open={openDrawer === tab.slug} onOpenChange={open => !open && setOpenDrawer(null)}>
           <DrawerContent>
             <DrawerHeader>
diff --git a/src/app/templates/GuardianSettings.tsx b/src/app/templates/GuardianSettings.tsx
new file mode 100644
index 000000000..8969c6159
--- /dev/null
+++ b/src/app/templates/GuardianSettings.tsx
@@ -0,0 +1,172 @@
+import React, { FC, useCallback, useEffect, useState } from 'react';
+
+import { SubmitHandler, useForm } from 'react-hook-form';
+import { useTranslation } from 'react-i18next';
+
+import FormField from 'app/atoms/FormField';
+import FormSubmitButton from 'app/atoms/FormSubmitButton';
+import { DEFAULT_PSM_ENDPOINT } from 'lib/miden-chain/constants';
+import {
+  initiateSwitchGuardianTransaction,
+  requestSWTransactionProcessing,
+  waitForTransactionCompletion
+} from 'lib/miden/activity';
+import { fetchFromStorage, onStorageChanged } from 'lib/miden/front';
+import { isExtension } from 'lib/platform';
+import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
+import { isDelegateProofEnabled } from 'lib/settings/helpers';
+import { useWalletStore } from 'lib/store';
+
+type FormData = {
+  guardianEndpoint: string;
+};
+
+const URL_PATTERN = /^https?:\/\/.+/i;
+
+type Props = {
+  onClose?: () => void;
+};
+
+const GuardianSettings: FC<Props> = ({ onClose }) => {
+  const { t } = useTranslation();
+  const { endpoint: currentEndpoint, refresh: refreshCurrentEndpoint } = useCurrentGuardianEndpoint();
+  const [submitSuccess, setSubmitSuccess] = useState(false);
+
+  const {
+    register,
+    handleSubmit,
+    setError,
+    clearErrors,
+    reset,
+    formState: { errors, isSubmitting }
+  } = useForm<FormData>({ defaultValues: { guardianEndpoint: '' } });
+
+  const currentAccount = useWalletStore(s => s.currentAccount);
+
+  const onSubmit = useCallback<SubmitHandler<FormData>>(
+    async ({ guardianEndpoint }) => {
+      if (isSubmitting || !currentAccount) return;
+      const trimmed = guardianEndpoint.trim();
+      if (trimmed === currentEndpoint) {
+        setError('guardianEndpoint', { type: 'manual', message: t('guardianEndpointUnchanged') });
+        return;
+      }
+
+      clearErrors();
+      setSubmitSuccess(false);
+
+      try {
+        const txId = await initiateSwitchGuardianTransaction(
+          currentAccount.publicKey,
+          trimmed,
+          isDelegateProofEnabled()
+        );
+        useWalletStore.getState().openTransactionModal();
+        if (isExtension()) requestSWTransactionProcessing();
+
+        const result = await waitForTransactionCompletion(txId);
+        if ('errorMessage' in result) {
+          setError('guardianEndpoint', { type: 'manual', message: result.errorMessage });
+          return;
+        }
+
+        setSubmitSuccess(true);
+        reset({ guardianEndpoint: '' });
+        // Pull the new endpoint back from storage so the "Current guardian"
+        // display reflects the switch on platforms without storage-change events.
+        refreshCurrentEndpoint();
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        setError('guardianEndpoint', { type: 'manual', message });
+      }
+    },
+    [clearErrors, currentAccount, currentEndpoint, isSubmitting, refreshCurrentEndpoint, reset, setError, t]
+  );
+
+  return (
+    <div className="w-full max-w-sm p-2 mx-auto">
+      <div className="mb-4">
+        <p className="text-sm text-heading-gray font-medium mb-1">{t('currentGuardianEndpoint')}</p>
+        <p className="text-sm text-black break-all select-text">{currentEndpoint || t('loading')}</p>
+      </div>
+
+      <form onSubmit={handleSubmit(onSubmit)}>
+        <FormField
+          {...register('guardianEndpoint', {
+            required: t('required'),
+            pattern: { value: URL_PATTERN, message: t('invalidUrl') }
+          })}
+          label={t('newGuardianEndpoint')}
+          labelDescription={t('switchGuardianDescription')}
+          id="guardian-endpoint"
+          type="text"
+          placeholder="https://"
+          errorCaption={errors.guardianEndpoint?.message}
+          containerClassName="mb-4"
+          onChange={() => {
+            clearErrors();
+            if (submitSuccess) setSubmitSuccess(false);
+          }}
+        />
+
+        <FormSubmitButton
+          className="capitalize w-full justify-center mt-6"
+          loading={isSubmitting}
+          disabled={!currentAccount}
+          style={{
+            fontSize: '18px',
+            lineHeight: '24px',
+            paddingLeft: '0.5rem',
+            paddingRight: '0.5rem',
+            paddingTop: '12px',
+            paddingBottom: '12px'
+          }}
+        >
+          {t('switchGuardian')}
+        </FormSubmitButton>
+
+        {submitSuccess && (
+          <div className="mt-4 text-green-600 text-sm font-medium" onAnimationEnd={() => onClose?.()}>
+            {t('guardianSwitched')}
+          </div>
+        )}
+      </form>
+    </div>
+  );
+};
+
+export default GuardianSettings;
+
+function useCurrentGuardianEndpoint(): { endpoint: string; refresh: () => void } {
+  const [endpoint, setEndpoint] = useState<string>('');
+  const [nonce, setNonce] = useState(0);
+  const refresh = useCallback(() => setNonce(n => n + 1), []);
+
+  useEffect(() => {
+    let cancelled = false;
+    fetchFromStorage<string>(PSM_URL_STORAGE_KEY)
+      .then(stored => {
+        if (cancelled) return;
+        setEndpoint(stored || DEFAULT_PSM_ENDPOINT);
+      })
+      .catch(() => {
+        if (cancelled) return;
+        setEndpoint(DEFAULT_PSM_ENDPOINT);
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [nonce]);
+
+  // Extension builds get storage-change events for free; on mobile/desktop this
+  // is a no-op and the explicit refresh() call after switch handles the update.
+  useEffect(
+    () =>
+      onStorageChanged<string>(PSM_URL_STORAGE_KEY, next => {
+        setEndpoint(next || DEFAULT_PSM_ENDPOINT);
+      }),
+    []
+  );
+
+  return { endpoint, refresh };
+}
diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index fd2468749..048ae6227 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -2,9 +2,16 @@ import { InputNoteState, Note, TransactionProver, TransactionResult } from '@mid
 import { type Proposal } from '@openzeppelin/miden-multisig-client';
 import { liveQuery } from 'dexie';
 
-import { getOrCreateMultisigService, isPsmAccount, type PsmAccountProvider } from 'lib/miden/front/psm-manager';
+import {
+  clearPsmServiceFor,
+  getOrCreateMultisigService,
+  isPsmAccount,
+  type PsmAccountProvider
+} from 'lib/miden/front/psm-manager';
+import { MultisigService } from 'lib/miden/psm';
 import * as Repo from 'lib/miden/repo';
 import { isExtension, isMobile } from 'lib/platform';
+import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { u8ToB64 } from 'lib/shared/helpers';
 import { WalletMessageType } from 'lib/shared/types';
 import { getIntercom } from 'lib/store';
@@ -16,9 +23,11 @@ import {
   ITransactionStage,
   ITransactionStatus,
   SendTransaction,
+  SwitchGuardianTransaction,
   Transaction,
   TransactionOutput
 } from '../db/types';
+import { putToStorage } from '../front';
 import { toNoteTypeString } from '../helpers';
 import { getBech32AddressFromAccountId } from '../sdk/helpers';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
@@ -274,6 +283,61 @@ export const initiateSendTransaction = async (
   return dbTransaction.id;
 };
 
+/**
+ * Queue a switch-guardian transaction for a PSM account. The local
+ * `PSM_URL_STORAGE_KEY` is NOT updated here — it's written only after
+ * the on-chain proposal lands, in `completeSwitchGuardianTransaction`.
+ */
+export const initiateSwitchGuardianTransaction = async (
+  accountId: string,
+  newGuardianEndpoint: string,
+  delegateTransaction?: boolean,
+  psmProvider?: PsmAccountProvider
+): Promise<string> => {
+  if (!(await isPsmAccount(accountId, psmProvider))) {
+    throw new Error('Switch guardian is only supported for PSM accounts');
+  }
+  const dbTransaction = new SwitchGuardianTransaction(accountId, newGuardianEndpoint, delegateTransaction);
+  await Repo.transactions.add(dbTransaction);
+  return dbTransaction.id;
+};
+
+export const completeSwitchGuardianTransaction = async (
+  tx: SwitchGuardianTransaction,
+  result: TransactionResult,
+  multisigService: MultisigService
+) => {
+  try {
+    const executedTx = result.executedTransaction();
+    const { newGuardianEndpoint } = tx.extraInputs;
+
+    // Mirror upstream `multisig.executeProposal`'s post-submit block for
+    // switch_guardian proposals: register on the new guardian with the
+    // updated account state before anything else touches the local cache
+    // or storage. If this throws, storage + status stay untouched so the
+    // user can retry.
+    await multisigService.finalizeGuardianSwitch(newGuardianEndpoint);
+
+    await putToStorage(PSM_URL_STORAGE_KEY, newGuardianEndpoint);
+    clearPsmServiceFor(tx.accountId);
+
+    await updateTransactionStatus(tx.id, ITransactionStatus.Completed, {
+      displayMessage: 'Guardian switched',
+      transactionId: executedTx.id().toHex(),
+      completedAt: Math.floor(Date.now() / 1000), // seconds
+      resultBytes: result.serialize()
+    });
+  } catch (error) {
+    console.error('Error completing switch guardian transaction:', error);
+    await updateTransactionStatus(tx.id, ITransactionStatus.Failed, {
+      displayMessage: 'Failed to switch guardian',
+      completedAt: Math.floor(Date.now() / 1000), // seconds
+      resultBytes: result.serialize(),
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+};
+
 const extractFullNote = (result: TransactionResult): Note | undefined => {
   try {
     const outputNotes = result.executedTransaction().outputNotes().notes();
@@ -707,6 +771,12 @@ const generatePsmTransaction = async (
       proposalResult = await multisigService.createConsumeNotesProposal([consumeTx.noteId]);
       break;
     }
+    case 'switch-guardian': {
+      const sgTx = transaction as SwitchGuardianTransaction;
+      const { proposal } = await multisigService.createSwitchGuardianProposal(sgTx.extraInputs.newGuardianEndpoint);
+      proposalResult = proposal;
+      break;
+    }
     // case 'execute':
     // default: {
     // // For custom transactions, get TransactionSummary and create a custom proposal
@@ -727,7 +797,7 @@ const generatePsmTransaction = async (
 
   // Sign and execute the proposal
   const tr = await multisigService.signAndCreateTransactionRequest(proposalResult.id);
-
+  console.log('Created transaction request from proposal, submitting to Miden client');
   const options: MidenClientCreateOptions = {
     signCallback: async (publicKey: Uint8Array, signingInputs: Uint8Array) => {
       const keyString = Buffer.from(publicKey).toString('hex');
@@ -738,12 +808,25 @@ const generatePsmTransaction = async (
 
   const transactionResult = await withWasmClientLock(async () => {
     const midenClient = await getMidenClient(options);
+    console.log('Submitting transaction request to Miden client');
     const { result } = await midenClient.client.transactions.submit(transaction.accountId, tr, {
       prover: !transaction.delegateTransaction ? TransactionProver.newLocalProver() : undefined
     });
+    console.log('Transaction request submitted, waiting for result');
     return result;
   });
 
+  // For switch-guardian, the new guardian must be seeded with the POST-switch
+  // account state. submit() returns after submission, not after inclusion, so
+  // without this wait finalizeGuardianSwitch would serialize the pre-switch
+  // account and register that stale state with the new guardian.
+  if (transaction.type === 'switch-guardian') {
+    await withWasmClientLock(async () => {
+      const midenClient = await getMidenClient();
+      await midenClient.waitForTransactionCommit(transactionResult.executedTransaction().id().toHex());
+    });
+  }
+
   switch (transaction.type) {
     case 'send':
       await completeSendTransaction(transaction as SendTransaction, transactionResult);
@@ -751,12 +834,20 @@ const generatePsmTransaction = async (
     case 'consume':
       await completeConsumeTransaction(transaction.id, transactionResult);
       break;
+    case 'switch-guardian':
+      console.log('Completing switch guardian transaction');
+      await completeSwitchGuardianTransaction(
+        transaction as SwitchGuardianTransaction,
+        transactionResult,
+        multisigService
+      );
+      break;
     // case 'execute':
     // default:
     //   await completeCustomTransaction(transaction, transactionResult);
     //   break;
   }
-
+  console.log('Transaction generation complete, syncing multisig service');
   await multisigService.sync();
 };
 
diff --git a/src/lib/miden/db/types.ts b/src/lib/miden/db/types.ts
index aa2809768..ab450b87b 100644
--- a/src/lib/miden/db/types.ts
+++ b/src/lib/miden/db/types.ts
@@ -15,7 +15,7 @@ export enum ITransactionStatus {
 }
 
 export type ITransactionIcon = 'SEND' | 'RECEIVE' | 'SWAP' | 'FAILED' | 'MINT' | 'DEFAULT';
-export type ITransactionType = 'send' | 'consume' | 'execute';
+export type ITransactionType = 'send' | 'consume' | 'execute' | 'switch-guardian';
 
 /**
  * Sub-phase of a transaction while `status === GeneratingTransaction` (or
@@ -188,6 +188,33 @@ export class ConsumeTransaction implements ITransaction {
   }
 }
 
+export class SwitchGuardianTransaction implements ITransaction {
+  id: string;
+  type: ITransactionType;
+  accountId: string;
+  transactionId?: string;
+  status: ITransactionStatus;
+  initiatedAt: number;
+  processingStartedAt?: number;
+  completedAt?: number;
+  displayMessage?: string;
+  displayIcon: ITransactionIcon;
+  extraInputs: { newGuardianEndpoint: string };
+  delegateTransaction?: boolean | undefined;
+
+  constructor(accountId: string, newGuardianEndpoint: string, delegateTransaction?: boolean) {
+    this.id = uuid();
+    this.type = 'switch-guardian';
+    this.accountId = accountId;
+    this.status = ITransactionStatus.Queued;
+    this.initiatedAt = Math.floor(Date.now() / 1000); // seconds
+    this.displayIcon = 'DEFAULT';
+    this.displayMessage = 'Switching guardian';
+    this.extraInputs = { newGuardianEndpoint };
+    this.delegateTransaction = delegateTransaction;
+  }
+}
+
 export function formatTransactionStatus(status: ITransactionStatus): string {
   const words = ITransactionStatus[status].split(/(?=[A-Z])/);
   return words.join(' ');
diff --git a/src/lib/miden/front/psm-manager.ts b/src/lib/miden/front/psm-manager.ts
index 37eb13b59..21874b667 100644
--- a/src/lib/miden/front/psm-manager.ts
+++ b/src/lib/miden/front/psm-manager.ts
@@ -1,10 +1,13 @@
+import { DEFAULT_PSM_ENDPOINT } from 'lib/miden-chain/constants';
 import { MultisigService } from 'lib/miden/psm';
+import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { WalletAccount } from 'lib/shared/types';
 import { useWalletStore } from 'lib/store';
 import { WalletType } from 'screens/onboarding/types';
 
 import { getSignerDetailsFromAccount } from '../psm/account';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
+import { fetchFromStorage } from './storage';
 
 // Cache MultisigService instances to avoid re-initialization on every sync cycle
 const psmServiceCache = new Map<string, MultisigService>();
@@ -37,10 +40,16 @@ export async function getOrCreateMultisigService(
   provider: PsmAccountProvider = zustandProvider
 ): Promise<MultisigService> {
   console.log(`[PSM Manager] Getting/creating MultisigService for account: ${accountPublicKey}`);
-  // Return cached instance if available
+  // Return cached instance if its endpoint still matches storage. In the
+  // extension build, `clearPsmServiceFor` from the SW realm doesn't reach
+  // the frontend's own copy of this Map, so a guardian switch would leave
+  // the popup syncing against the old guardian indefinitely. Re-check
+  // PSM_URL_STORAGE_KEY here and evict on drift.
   const cached = psmServiceCache.get(accountPublicKey);
   if (cached) {
-    return cached;
+    const currentEndpoint = (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) || DEFAULT_PSM_ENDPOINT;
+    if (cached.guardianEndpoint === currentEndpoint) return cached;
+    psmServiceCache.delete(accountPublicKey);
   }
 
   // Verify this is a PSM account
@@ -112,3 +121,12 @@ export async function syncPsmAccounts(): Promise<void> {
 export function clearPsmCache(): void {
   psmServiceCache.clear();
 }
+
+/**
+ * Drop a single account's cached MultisigService so the next access
+ * reinitializes it — used after a guardian switch where the cached
+ * instance still points at the old endpoint.
+ */
+export function clearPsmServiceFor(accountPublicKey: string): void {
+  psmServiceCache.delete(accountPublicKey);
+}
diff --git a/src/lib/miden/psm/index.ts b/src/lib/miden/psm/index.ts
index b088cced7..387eeb521 100644
--- a/src/lib/miden/psm/index.ts
+++ b/src/lib/miden/psm/index.ts
@@ -12,7 +12,7 @@ import { DEFAULT_PSM_ENDPOINT } from 'lib/miden-chain/constants';
 import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { u8ToB64 } from 'lib/shared/helpers';
 
-import { fetchFromStorage, putToStorage } from '../front';
+import { fetchFromStorage } from '../front';
 import { accountIdStringToSdk } from '../sdk/helpers';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 import { MidenClientInterface } from '../sdk/miden-client-interface';
@@ -28,11 +28,13 @@ const MAX_SYNC_RETRIES = 20;
 export class MultisigService {
   multisig: Multisig;
   client: MultisigClient;
+  guardianEndpoint: string;
   syncRetryCount: number = 0;
 
-  constructor(multisig: Multisig, client: MultisigClient) {
+  constructor(multisig: Multisig, client: MultisigClient, guardianEndpoint: string) {
     this.multisig = multisig;
     this.client = client;
+    this.guardianEndpoint = guardianEndpoint;
   }
 
   /**
@@ -53,7 +55,7 @@ export class MultisigService {
       const client = new MultisigClient(webClient, { guardianEndpoint });
       const multisig = await client.load(account.id().toString(), signer);
 
-      return new MultisigService(multisig, client);
+      return new MultisigService(multisig, client, guardianEndpoint);
     } catch (error) {
       console.log('Error initializing MultisigService:', error);
       throw error;
@@ -150,23 +152,7 @@ export class MultisigService {
 
   async sync(): Promise<void> {
     try {
-      const { accountId, commitment } = await this.multisig.syncState();
-      console.log('Successfully synced multisig state for account', accountId);
-      console.log('Current commitment:', commitment);
-      const account = await withWasmClientLock(async () => {
-        const client = await getMidenClient();
-        if (!client) throw new Error('WASM client not available');
-        const acc = await client.getAccount(accountId);
-        console.log(
-          acc
-            ?.vault()
-            .fungibleAssets()
-            .map((a: any) => a.amount().toString())
-        );
-        if (!acc) throw new Error('Account not found in WASM client after sync');
-        return acc;
-      });
-      console.log('Account commitment from WASM client:', account.to_commitment().toHex());
+      await this.multisig.syncState();
       this.syncRetryCount = 0; // Reset retry count on successful sync
     } catch (error) {
       console.log('[PSM] sync error ', error);
@@ -193,10 +179,61 @@ export class MultisigService {
     return this.multisig.getConsumableNotes();
   }
 
-  // async switchGuardian(newGuardianEndpoint: string) {
-  //   await putToStorage(PSM_URL_STORAGE_KEY, newGuardianEndpoint);
-  //   await this.multisig.createSwitchGuardianProposal()
-  // }
+  /**
+   * Build a switch-guardian proposal pointing at `newGuardianEndpoint`.
+   * Caller is responsible for signing/submitting the proposal AND for
+   * calling `finalizeGuardianSwitch` + persisting the endpoint only
+   * after the on-chain switch commits.
+   */
+  async createSwitchGuardianProposal(
+    newGuardianEndpoint: string
+  ): Promise<{ proposal: Proposal; newEndpoint: string }> {
+    try {
+      const newGuardian = new GuardianHttpClient(newGuardianEndpoint);
+      const { commitment } = await newGuardian.getPubkey();
+      const proposal = await this.multisig.createSwitchGuardianProposal(newGuardianEndpoint, commitment);
+      await this.multisig.createProposal(proposal.nonce, proposal.txSummary, proposal.metadata);
+      console.log('Created switch-guardian proposal with new endpoint:', newGuardianEndpoint);
+      return { proposal, newEndpoint: newGuardianEndpoint };
+    } catch (error) {
+      console.log('Error creating switch-guardian proposal:', error);
+      throw error;
+    }
+  }
+
+  /**
+   * Post-submit finalization for a switch-guardian proposal. Mirrors the
+   * block that upstream's `multisig.executeProposal` runs when it detects
+   * a `switch_guardian` metadata type. Must be called AFTER the on-chain
+   * switch lands — `client.load(...)` against the new guardian will fail
+   * until `registerOnGuardian` succeeds.
+   */
+  async finalizeGuardianSwitch(newGuardianEndpoint: string): Promise<void> {
+    try {
+      console.log('Finalizing guardian switch to new endpoint:', newGuardianEndpoint);
+      const updatedStateBase64 = await withWasmClientLock(async () => {
+        const client = await getMidenClient();
+        await client.syncState();
+        const account = await client.getAccount(this.accountId);
+        if (!account) {
+          throw new Error(`Updated account ${this.accountId} is missing from local client`);
+        }
+        return u8ToB64(account.serialize());
+      });
+
+      const nextGuardian = new GuardianHttpClient(newGuardianEndpoint);
+      const { commitment } = await nextGuardian.getPubkey();
+
+      this.multisig.setGuardianClient(nextGuardian);
+      this.multisig.guardianPublicKey = commitment;
+      this.guardianEndpoint = newGuardianEndpoint;
+
+      await this.multisig.registerOnGuardian(updatedStateBase64);
+    } catch (error) {
+      console.log('Error finalizing guardian switch:', error);
+      throw error;
+    }
+  }
 }
 
 // Re-export types that may be needed by consumers

From 0f301536e55032e1d6a6ad141f1bbfc5d47db5b5 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Tue, 21 Apr 2026 05:44:18 +0530
Subject: [PATCH 19/71] feat: per-stage label for PSM/guardian transactions

---
 CHANGELOG.md                                  |  2 +-
 public/_locales/en/en.json                    |  9 +++++
 public/_locales/en/messages.json              | 36 +++++++++++++++++++
 src/lib/miden/activity/transactions.ts        |  9 +++++
 src/lib/miden/db/types.ts                     | 22 +++++++++---
 .../GeneratingTransaction.test.tsx            | 10 ++++++
 .../GeneratingTransaction.tsx                 | 19 +++++++---
 7 files changed, 97 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 445aa3e45..4fa214e29 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,7 @@
 ### Features
 
 * [FEATURE][all] Guardian switch for PSM accounts. Settings → Guardian Settings lets the user point a PSM account at a new guardian endpoint; the switch is a signed on-chain proposal that waits for inclusion, registers the post-switch account state with the new guardian, then flips the cached `PSM_URL_STORAGE_KEY` so subsequent syncs hit the new endpoint. The frontend cache self-heals when the stored endpoint drifts, so the popup stops syncing against the old guardian across the SW/frontend realm boundary.
-* [FEATURE][all] Per-stage label in the transaction progress modal. Each observable phase boundary (`syncing`, `sending`, `confirming`, `delivering`) writes a stage marker during tx processing, and the modal renders a stage-specific title + description instead of a single opaque "Generating Transaction" for the whole 3-8s spinner window. Send-type sub-label varies by tx type (claim / execute / send), and the batch subtitle surfaces a remaining-count when more than one tx is in flight.
+* [FEATURE][all] Per-stage label in the transaction progress modal. Each observable phase boundary (`syncing`, `sending`, `confirming`, `delivering`) writes a stage marker during tx processing, and the modal renders a stage-specific title + description instead of a single opaque "Generating Transaction" for the whole 3-8s spinner window. Send-type sub-label varies by tx type (claim / execute / send), and the batch subtitle surfaces a remaining-count when more than one tx is in flight. PSM/guardian-backed accounts also now surface their own phase boundaries (`creating-proposal`, `signing-proposal`, `submitting`, `registering-guardian`) so guardian-sign / submit / on-chain-confirm / guardian-re-register all render distinct labels instead of a single opaque spinner — switch-guardian in particular now walks the user through every step.
 
 ---
 
diff --git a/public/_locales/en/en.json b/public/_locales/en/en.json
index 75fa15a11..4f23afe4a 100644
--- a/public/_locales/en/en.json
+++ b/public/_locales/en/en.json
@@ -92,8 +92,17 @@
   "transactionStageSendingDescription": "Building and proving your transaction.",
   "transactionStageClaiming": "Claiming note",
   "transactionStageExecuting": "Executing transaction",
+  "transactionStageSwitching": "Switching guardian",
+  "transactionStageCreatingProposal": "Creating proposal",
+  "transactionStageCreatingProposalDescription": "Building the transaction proposal for your guardian.",
+  "transactionStageSigningProposal": "Signing with guardian",
+  "transactionStageSigningProposalDescription": "Your guardian is signing the proposal.",
+  "transactionStageSubmitting": "Submitting transaction",
+  "transactionStageSubmittingDescription": "Sending your signed transaction to the network.",
   "transactionStageConfirming": "Confirming on chain",
   "transactionStageConfirmingDescription": "Waiting for network confirmation.",
+  "transactionStageRegisteringGuardian": "Registering with guardian",
+  "transactionStageRegisteringGuardianDescription": "Registering your account state with the new guardian.",
   "transactionStageDelivering": "Delivering note",
   "transactionStageDeliveringDescription": "Securely sending the note to the recipient.",
   "transactionsRemainingInBatch": "$count$ transactions in progress",
diff --git a/public/_locales/en/messages.json b/public/_locales/en/messages.json
index 49a8837db..fbaf16e7e 100644
--- a/public/_locales/en/messages.json
+++ b/public/_locales/en/messages.json
@@ -406,6 +406,34 @@
     "message": "Executing transaction",
     "englishSource": "Executing transaction"
   },
+  "transactionStageSwitching": {
+    "message": "Switching guardian",
+    "englishSource": "Switching guardian"
+  },
+  "transactionStageCreatingProposal": {
+    "message": "Creating proposal",
+    "englishSource": "Creating proposal"
+  },
+  "transactionStageCreatingProposalDescription": {
+    "message": "Building the transaction proposal for your guardian.",
+    "englishSource": "Building the transaction proposal for your guardian."
+  },
+  "transactionStageSigningProposal": {
+    "message": "Signing with guardian",
+    "englishSource": "Signing with guardian"
+  },
+  "transactionStageSigningProposalDescription": {
+    "message": "Your guardian is signing the proposal.",
+    "englishSource": "Your guardian is signing the proposal."
+  },
+  "transactionStageSubmitting": {
+    "message": "Submitting transaction",
+    "englishSource": "Submitting transaction"
+  },
+  "transactionStageSubmittingDescription": {
+    "message": "Sending your signed transaction to the network.",
+    "englishSource": "Sending your signed transaction to the network."
+  },
   "transactionStageConfirming": {
     "message": "Confirming on chain",
     "englishSource": "Confirming on chain"
@@ -414,6 +442,14 @@
     "message": "Waiting for network confirmation.",
     "englishSource": "Waiting for network confirmation."
   },
+  "transactionStageRegisteringGuardian": {
+    "message": "Registering with guardian",
+    "englishSource": "Registering with guardian"
+  },
+  "transactionStageRegisteringGuardianDescription": {
+    "message": "Registering your account state with the new guardian.",
+    "englishSource": "Registering your account state with the new guardian."
+  },
   "transactionStageDelivering": {
     "message": "Delivering note",
     "englishSource": "Delivering note"
diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index 048ae6227..d666c2853 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -316,6 +316,7 @@ export const completeSwitchGuardianTransaction = async (
     // updated account state before anything else touches the local cache
     // or storage. If this throws, storage + status stay untouched so the
     // user can retry.
+    await setTransactionStage(tx.id, 'registering-guardian');
     await multisigService.finalizeGuardianSwitch(newGuardianEndpoint);
 
     await putToStorage(PSM_URL_STORAGE_KEY, newGuardianEndpoint);
@@ -752,6 +753,11 @@ const generatePsmTransaction = async (
   psmProvider?: PsmAccountProvider
 ): Promise<void> => {
   console.log('Generating PSM transaction');
+  // Set the stage eagerly — `getOrCreateMultisigService` and the subsequent
+  // `createXxxProposal` call can both hit the guardian over the network,
+  // so surfacing "Creating proposal" immediately is more honest than
+  // leaving the label stuck on "Sending transaction".
+  await setTransactionStage(transaction.id, 'creating-proposal');
   const multisigService = await getOrCreateMultisigService(transaction.accountId, psmProvider);
 
   let proposalResult: Proposal;
@@ -796,6 +802,7 @@ const generatePsmTransaction = async (
   }
 
   // Sign and execute the proposal
+  await setTransactionStage(transaction.id, 'signing-proposal');
   const tr = await multisigService.signAndCreateTransactionRequest(proposalResult.id);
   console.log('Created transaction request from proposal, submitting to Miden client');
   const options: MidenClientCreateOptions = {
@@ -806,6 +813,7 @@ const generatePsmTransaction = async (
     }
   };
 
+  await setTransactionStage(transaction.id, 'submitting');
   const transactionResult = await withWasmClientLock(async () => {
     const midenClient = await getMidenClient(options);
     console.log('Submitting transaction request to Miden client');
@@ -821,6 +829,7 @@ const generatePsmTransaction = async (
   // without this wait finalizeGuardianSwitch would serialize the pre-switch
   // account and register that stale state with the new guardian.
   if (transaction.type === 'switch-guardian') {
+    await setTransactionStage(transaction.id, 'confirming');
     await withWasmClientLock(async () => {
       const midenClient = await getMidenClient();
       await midenClient.waitForTransactionCommit(transactionResult.executedTransaction().id().toHex());
diff --git a/src/lib/miden/db/types.ts b/src/lib/miden/db/types.ts
index ab450b87b..2eeb8c13a 100644
--- a/src/lib/miden/db/types.ts
+++ b/src/lib/miden/db/types.ts
@@ -22,12 +22,24 @@ export type ITransactionType = 'send' | 'consume' | 'execute' | 'switch-guardian
  * still `Queued` during the initial sync). Drives the modal's per-stage
  * label so users see what the wallet is actually doing during the 3-8s
  * spinner window. Not all stages apply to all tx types:
- *   - syncing    : all types, before `syncState()`
- *   - sending    : all types, during the SDK execute→prove→submit→apply
- *   - confirming : send-private only, during `waitForTransactionCommit`
- *   - delivering : send-private only, during `sendPrivateNote`
+ *   - syncing              : all types, before `syncState()`
+ *   - sending              : non-PSM types, during the SDK execute→prove→submit→apply
+ *   - creating-proposal    : PSM only, while building the multisig proposal
+ *   - signing-proposal     : PSM only, while the guardian signs the proposal
+ *   - submitting           : PSM only, while the signed tx is submitted to the network
+ *   - confirming           : send-private + switch-guardian, during `waitForTransactionCommit`
+ *   - registering-guardian : switch-guardian only, during post-commit guardian re-registration
+ *   - delivering           : send-private only, during `sendPrivateNote`
  */
-export type ITransactionStage = 'syncing' | 'sending' | 'confirming' | 'delivering';
+export type ITransactionStage =
+  | 'syncing'
+  | 'sending'
+  | 'creating-proposal'
+  | 'signing-proposal'
+  | 'submitting'
+  | 'confirming'
+  | 'registering-guardian'
+  | 'delivering';
 
 export interface ITransaction {
   id: string;
diff --git a/src/screens/generating-transaction/GeneratingTransaction.test.tsx b/src/screens/generating-transaction/GeneratingTransaction.test.tsx
index d5ab43fe8..da009cb23 100644
--- a/src/screens/generating-transaction/GeneratingTransaction.test.tsx
+++ b/src/screens/generating-transaction/GeneratingTransaction.test.tsx
@@ -168,7 +168,17 @@ describe('GeneratingTransaction stage + state rendering', () => {
     ['sending', 'send', 'transactionStageSending', 'transactionStageSendingDescription'],
     ['sending', 'consume', 'transactionStageClaiming', 'transactionStageSendingDescription'],
     ['sending', 'execute', 'transactionStageExecuting', 'transactionStageSendingDescription'],
+    ['sending', 'switch-guardian', 'transactionStageSwitching', 'transactionStageSendingDescription'],
+    ['creating-proposal', 'send', 'transactionStageCreatingProposal', 'transactionStageCreatingProposalDescription'],
+    ['signing-proposal', 'send', 'transactionStageSigningProposal', 'transactionStageSigningProposalDescription'],
+    ['submitting', 'send', 'transactionStageSubmitting', 'transactionStageSubmittingDescription'],
     ['confirming', undefined, 'transactionStageConfirming', 'transactionStageConfirmingDescription'],
+    [
+      'registering-guardian',
+      'switch-guardian',
+      'transactionStageRegisteringGuardian',
+      'transactionStageRegisteringGuardianDescription'
+    ],
     ['delivering', undefined, 'transactionStageDelivering', 'transactionStageDeliveringDescription']
   ])('renders stage %s (type=%s) with correct labels', async (stage, type, titleKey, descKey) => {
     const { container, root } = await renderInto(
diff --git a/src/screens/generating-transaction/GeneratingTransaction.tsx b/src/screens/generating-transaction/GeneratingTransaction.tsx
index 238110148..c4b398aa5 100644
--- a/src/screens/generating-transaction/GeneratingTransaction.tsx
+++ b/src/screens/generating-transaction/GeneratingTransaction.tsx
@@ -272,26 +272,37 @@ export const GeneratingTransaction: React.FC<GeneratingTransactionProps> = ({
 
   /**
    * Stage label picks up the tx type so a claim flow reads "Claiming
-   * note" instead of "Sending transaction" during the SDK call. All other
-   * stages (syncing / confirming / delivering) are type-neutral — they
-   * either describe network state (syncing, confirming) or only apply to
-   * one type (delivering → private send only).
+   * note" instead of "Sending transaction" during the SDK call. Other
+   * stages are type-neutral — they either describe network state
+   * (syncing, confirming), only apply to one type (delivering → private
+   * send only; registering-guardian → switch-guardian only), or describe
+   * PSM-specific phases that are the same action regardless of what the
+   * proposal does (creating-proposal / signing-proposal / submitting).
    */
   const stageTitleKey = useCallback((stage?: ITransactionStage, type?: ITransactionType): string => {
     if (!stage) return 'generatingTransaction';
     if (stage === 'syncing') return 'transactionStageSyncing';
+    if (stage === 'creating-proposal') return 'transactionStageCreatingProposal';
+    if (stage === 'signing-proposal') return 'transactionStageSigningProposal';
+    if (stage === 'submitting') return 'transactionStageSubmitting';
     if (stage === 'confirming') return 'transactionStageConfirming';
+    if (stage === 'registering-guardian') return 'transactionStageRegisteringGuardian';
     if (stage === 'delivering') return 'transactionStageDelivering';
     // stage === 'sending' — only this one varies by type
     if (type === 'consume') return 'transactionStageClaiming';
     if (type === 'execute') return 'transactionStageExecuting';
+    if (type === 'switch-guardian') return 'transactionStageSwitching';
     return 'transactionStageSending';
   }, []);
 
   const stageDescriptionKey = useCallback((stage?: ITransactionStage): string => {
     if (!stage) return 'generatingTransactionDescription';
     if (stage === 'syncing') return 'transactionStageSyncingDescription';
+    if (stage === 'creating-proposal') return 'transactionStageCreatingProposalDescription';
+    if (stage === 'signing-proposal') return 'transactionStageSigningProposalDescription';
+    if (stage === 'submitting') return 'transactionStageSubmittingDescription';
     if (stage === 'confirming') return 'transactionStageConfirmingDescription';
+    if (stage === 'registering-guardian') return 'transactionStageRegisteringGuardianDescription';
     if (stage === 'delivering') return 'transactionStageDeliveringDescription';
     return 'transactionStageSendingDescription';
   }, []);

From 93216a6f32df4c217eae7cb6e6080797f060a0e8 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Tue, 21 Apr 2026 16:37:10 +0530
Subject: [PATCH 20/71] feat: account lists badge

---
 public/_locales/en/en.json             |  1 +
 src/components/CardItem.tsx            |  2 +-
 src/screens/send-flow/AccountsList.tsx |  7 ++
 src/screens/send-flow/SendManager.tsx  | 11 ++--
 src/screens/send-flow/types.ts         |  1 +
 vite.background.config.ts              | 90 +++++++++++++-------------
 yarn.lock                              |  2 +-
 7 files changed, 63 insertions(+), 51 deletions(-)

diff --git a/public/_locales/en/en.json b/public/_locales/en/en.json
index 4f23afe4a..27bc7ceb1 100644
--- a/public/_locales/en/en.json
+++ b/public/_locales/en/en.json
@@ -366,6 +366,7 @@
   "importWithEncryptedWalletFileDescription": "Upload your encrypted wallet file to securely import your account. Your data remains private, with only hashed information stored on-chain",
   "twitter": "X (Twitter)",
   "encryptedWalletFile": "Encrypted Wallet File",
+  "guardianBadge": "Guardian",
   "guardianSettings": "Guardian Settings",
   "currentGuardianEndpoint": "Current Guardian",
   "newGuardianEndpoint": "New Guardian Endpoint",
diff --git a/src/components/CardItem.tsx b/src/components/CardItem.tsx
index 9dc2c5be5..833e6093e 100644
--- a/src/components/CardItem.tsx
+++ b/src/components/CardItem.tsx
@@ -15,7 +15,7 @@ export interface CardItemProps extends React.ComponentProps<'div'> {
   iconRight?: React.ReactNode | IconName;
   title?: string;
   subtitle?: string;
-  titleRight?: string;
+  titleRight?: React.ReactNode;
   subtitleRight?: string;
   hoverable?: boolean;
   titleClassName?: string;
diff --git a/src/screens/send-flow/AccountsList.tsx b/src/screens/send-flow/AccountsList.tsx
index e2d9e1784..a3b827179 100644
--- a/src/screens/send-flow/AccountsList.tsx
+++ b/src/screens/send-flow/AccountsList.tsx
@@ -48,6 +48,13 @@ export const AccountsList: React.FC<AccountsListProps> = ({
               subtitle={`${t(c.contactType)} · ${truncateAddress(c.id)}`}
               iconLeft={<Avatar image="/misc/avatars/miden-orange.png" size="lg" />}
               iconRight={c.id === recipientAccountId ? IconName.CheckboxCircleFill : undefined}
+              titleRight={
+                c.isGuardian ? (
+                  <span className="text-xs font-medium px-2 py-0.5 rounded-full text-[#CC5200] bg-[#FFF3EB]">
+                    {t('guardianBadge')}
+                  </span>
+                ) : undefined
+              }
               onClick={() => onSelectContact(c)}
               hoverable={true}
             />
diff --git a/src/screens/send-flow/SendManager.tsx b/src/screens/send-flow/SendManager.tsx
index 17b3d3ae0..f15da9dfe 100644
--- a/src/screens/send-flow/SendManager.tsx
+++ b/src/screens/send-flow/SendManager.tsx
@@ -1,11 +1,8 @@
 import React, { ChangeEvent, useCallback, useEffect, useMemo, useState } from 'react';
 
 import { yupResolver } from '@hookform/resolvers/yup';
-import classNames from 'clsx';
-import { SubmitHandler, useForm } from 'react-hook-form';
-import * as yup from 'yup';
-
 import { useAppEnv } from 'app/env';
+import classNames from 'clsx';
 import { Navigator, NavigatorProvider, Route, useNavigator } from 'components/Navigator';
 import { stringToBigInt } from 'lib/i18n/numbers';
 import {
@@ -21,8 +18,11 @@ import { isExtension, isMobile } from 'lib/platform';
 import { isDelegateProofEnabled } from 'lib/settings/helpers';
 import { useWalletStore } from 'lib/store';
 import { navigate, useLocation } from 'lib/woozie';
+import { SubmitHandler, useForm } from 'react-hook-form';
 import { isValidMidenAddress } from 'utils/miden';
+import * as yup from 'yup';
 
+import { WalletType } from '../onboarding/types';
 import { AccountsList } from './AccountsList';
 import { ReviewTransaction } from './ReviewTransaction';
 import { SelectToken } from './SelectToken';
@@ -94,7 +94,8 @@ export const SendManager: React.FC<SendManagerProps> = ({ preselectedTokenId })
         id: contact.publicKey,
         name: contact.name,
         isOwned: true,
-        contactType: contact.isPublic ? ('public' as const) : ('private' as const)
+        contactType: contact.isPublic ? ('public' as const) : ('private' as const),
+        isGuardian: contact.type === WalletType.Psm
       }));
 
     const externalContacts: Contact[] = addressBookContacts
diff --git a/src/screens/send-flow/types.ts b/src/screens/send-flow/types.ts
index b7d0a1bcd..c73bc4f55 100644
--- a/src/screens/send-flow/types.ts
+++ b/src/screens/send-flow/types.ts
@@ -53,6 +53,7 @@ export type Contact = {
   name: string;
   isOwned: boolean;
   contactType: 'public' | 'private' | 'external';
+  isGuardian?: boolean;
 };
 
 export enum UIFeeType {
diff --git a/vite.background.config.ts b/vite.background.config.ts
index a970da29f..99041e627 100644
--- a/vite.background.config.ts
+++ b/vite.background.config.ts
@@ -1,7 +1,7 @@
 import { resolve } from 'path';
+import { defineConfig, type Plugin } from 'vite';
 import { nodePolyfills } from 'vite-plugin-node-polyfills';
 import wasm from 'vite-plugin-wasm';
-import { defineConfig, type Plugin } from 'vite';
 
 const pkg = require('./package.json');
 const TARGET_BROWSER = process.env.TARGET_BROWSER ?? 'chrome';
@@ -19,7 +19,7 @@ export default defineConfig({
         if (id.endsWith('.css') || id.endsWith('.scss')) {
           return 'export default {};';
         }
-      },
+      }
     } satisfies Plugin,
     // Stub React and frontend-only modules to prevent DOM/browser API access
     // in the service worker. The backend code transitively imports these
@@ -37,7 +37,7 @@ export default defineConfig({
           'react-day-picker',
           'react-qr-code',
           'qr-scanner',
-          '@nicolo-ribaudo/chokidar-2',
+          '@nicolo-ribaudo/chokidar-2'
         ];
         if (stubModules.some(m => source === m || source.startsWith(m + '/'))) {
           return '\0stub:' + source;
@@ -47,7 +47,7 @@ export default defineConfig({
         if (id.startsWith('\0stub:')) {
           return 'export default {}; export const useTranslation = () => ({ t: (k) => k, i18n: {} });';
         }
-      },
+      }
     } satisfies Plugin,
     // Patch the output for service worker compatibility:
     // 1. Replace document/window refs in Vite's preload helper with SW-safe versions
@@ -94,17 +94,14 @@ export default defineConfig({
             /var init_transactions = __esmMin\(\(async \(\) => \{([\s\S]*?)\}\)\);/,
             (match, body) => {
               let counter = 0;
-              const instrumented = body.replace(
-                /(?:await )?(init_\w+\(\))/g,
-                (m, call) => {
-                  counter++;
-                  const hasAwait = m.startsWith('await ');
-                  if (hasAwait) {
-                    return `console.log("[init_transactions] ${counter}: await ${call}..."); await ${call}; console.log("[init_transactions] ${counter}: ${call} done")`;
-                  }
-                  return `console.log("[init_transactions] ${counter}: ${call}"); ${call}`;
+              const instrumented = body.replace(/(?:await )?(init_\w+\(\))/g, (m, call) => {
+                counter++;
+                const hasAwait = m.startsWith('await ');
+                if (hasAwait) {
+                  return `console.log("[init_transactions] ${counter}: await ${call}..."); await ${call}; console.log("[init_transactions] ${counter}: ${call} done")`;
                 }
-              );
+                return `console.log("[init_transactions] ${counter}: ${call}"); ${call}`;
+              });
               return `var init_transactions = __esmMin((async () => {${instrumented}}));`;
             }
           );
@@ -142,7 +139,7 @@ export default defineConfig({
             '  event.notification.close();',
             '  event.waitUntil(self.clients.openWindow(chrome.runtime.getURL("fullpage.html#/receive")));',
             '});',
-            '',
+            ''
           ].join('\n');
           chunk.code = swListeners + 'var __vitePreload = function(fn) { return fn(); };\n' + chunk.code;
 
@@ -158,40 +155,45 @@ export default defineConfig({
           // init_activity imports the frontend Zustand store which has a deep
           // dependency chain that hangs in SW context. Similarly init_transaction_processor
           // depends on init_activity. We run these fire-and-forget after core inits.
-          const coreInits = uniqueInits.filter(c =>
-            !c.includes('init_actions') && !c.includes('init_transaction_processor')
+          const coreInits = uniqueInits.filter(
+            c => !c.includes('init_actions') && !c.includes('init_transaction_processor')
           );
-          const extendedInits = uniqueInits.filter(c =>
-            c.includes('init_actions') || c.includes('init_transaction_processor')
+          const extendedInits = uniqueInits.filter(
+            c => c.includes('init_actions') || c.includes('init_transaction_processor')
           );
           if (coreInits.length > 0) {
             // Create a Promise that resolves when core inits are done.
             // Define __initsReady at MODULE SCOPE so processRequest can access it.
             const coreInitBlock = coreInits.map(c => `  await ${c};`).join('\n');
-            const extendedInitBlock = extendedInits.map(c =>
-              `    ${c}.catch(function(e) { console.warn("[SW-init] ${c.replace('()', '')} error:", e?.message || e); })`
-            ).join(',\n');
+            const extendedInitBlock = extendedInits
+              .map(
+                c =>
+                  `    ${c}.catch(function(e) { console.warn("[SW-init] ${c.replace('()', '')} error:", e?.message || e); })`
+              )
+              .join(',\n');
             chunk.code = chunk.code.replace(
               /async function processRequest/,
               [
                 '// Phase 1: Core module inits (must complete for wallet operations)',
                 'var __initsReady = (async function() {',
                 coreInitBlock,
-                '  await init();',  // Actions.init() - sets state.inited
+                '  await init();', // Actions.init() - sets state.inited
                 '  // Phase 2: Extended inits (may hang due to frontend module deps)',
                 '  // Run fire-and-forget with a 30s timeout',
-                extendedInitBlock.length > 0 ? [
-                  '  Promise.race([',
-                  '    Promise.all([',
-                  extendedInitBlock,
-                  '    ]),',
-                  '    new Promise(function(r) { setTimeout(r, 30000); })',
-                  '  ]).then(function() { console.log("[SW-init] Extended inits completed"); })',
-                  '   .catch(function() {});',
-                ].join('\n') : '',
+                extendedInitBlock.length > 0
+                  ? [
+                      '  Promise.race([',
+                      '    Promise.all([',
+                      extendedInitBlock,
+                      '    ]),',
+                      '    new Promise(function(r) { setTimeout(r, 30000); })',
+                      '  ]).then(function() { console.log("[SW-init] Extended inits completed"); })',
+                      '   .catch(function() {});'
+                    ].join('\n')
+                  : '',
                 '})();',
                 '',
-                'async function processRequest',
+                'async function processRequest'
               ].join('\n')
             );
             // processRequest awaits inits for any request except GetStateRequest/SyncRequest
@@ -202,13 +204,13 @@ export default defineConfig({
             );
           }
         }
-      },
+      }
     } satisfies Plugin,
     wasm(),
     nodePolyfills({
       include: ['buffer', 'stream', 'assert', 'process', 'util'],
-      globals: { Buffer: true, process: true },
-    }),
+      globals: { Buffer: true, process: true }
+    })
   ],
 
   build: {
@@ -223,17 +225,17 @@ export default defineConfig({
         // reliably in all environments (Playwright's Chrome for Testing).
         inlineDynamicImports: true,
         assetFileNames: 'static/wasm/[name].[hash][extname]',
-        format: 'es',
-      },
+        format: 'es'
+      }
     },
     sourcemap: process.env.MODE_ENV !== 'production',
     target: 'es2022',
     minify: process.env.MODE_ENV === 'production',
-    modulePreload: { polyfill: false }, // No polyfill -- service workers don't have `document`
+    modulePreload: { polyfill: false } // No polyfill -- service workers don't have `document`
   },
 
   worker: {
-    format: 'es', // Workers need ESM for top-level await support
+    format: 'es' // Workers need ESM for top-level await support
   },
 
   resolve: {
@@ -243,8 +245,8 @@ export default defineConfig({
       shared: resolve(__dirname, 'src/shared'),
       components: resolve(__dirname, 'src/components'),
       screens: resolve(__dirname, 'src/screens'),
-      utils: resolve(__dirname, 'src/utils'),
-    },
+      utils: resolve(__dirname, 'src/utils')
+    }
   },
 
   define: {
@@ -254,6 +256,6 @@ export default defineConfig({
     'process.env.MIDEN_NETWORK': JSON.stringify(process.env.MIDEN_NETWORK ?? ''),
     'process.env.MIDEN_E2E_TEST': JSON.stringify(process.env.MIDEN_E2E_TEST ?? 'false'),
     'process.env.NODE_ENV': JSON.stringify(process.env.NODE_ENV ?? 'development'),
-    'process.env.MODE_ENV': JSON.stringify(process.env.MODE_ENV ?? 'development'),
-  },
+    'process.env.MODE_ENV': JSON.stringify(process.env.MODE_ENV ?? 'development')
+  }
 });
diff --git a/yarn.lock b/yarn.lock
index 1c9fe2c52..a91664573 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2272,7 +2272,7 @@
   dependencies:
     "@types/mdx" "^2.0.0"
 
-"@miden-sdk/miden-sdk@0.14.4":
+"@miden-sdk/miden-sdk@0.14.3", "@miden-sdk/miden-sdk@0.14.4":
   version "0.14.4"
   resolved "https://registry.yarnpkg.com/@miden-sdk/miden-sdk/-/miden-sdk-0.14.4.tgz#be7496e6d2622b7f478768972f9896536db154cb"
   integrity sha512-Qt+3NfGRCyHP5zcD+m9bBqQz01zuAwZRUBkls09mi+tOPVT17sFWKLglQEtKdr3gPAFHLwz2Ja4Hp4adUKfLuA==

From 4ef5ccae794599cfa528e2f0e75b7769ef989280 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Thu, 23 Apr 2026 08:22:14 +0530
Subject: [PATCH 21/71] feat: import-recovery-method screen with custom
 guardian URL for PSM imports

---
 CHANGELOG.md                                  |   4 +
 public/_locales/en/en.json                    |   8 +
 src/app/pages/Welcome.tsx                     |  37 ++++-
 src/lib/miden/back/vault.ts                   |  37 ++++-
 src/lib/miden/psm/account.ts                  |  15 +-
 src/lib/miden/sdk/miden-client-interface.ts   |  19 ++-
 .../ImportRecoveryMethod.tsx                  | 150 ++++++++++++++++++
 src/screens/onboarding/navigator.tsx          |  35 ++--
 src/screens/onboarding/types.ts               |   8 +
 9 files changed, 276 insertions(+), 37 deletions(-)
 create mode 100644 src/screens/onboarding/import-wallet-flow/ImportRecoveryMethod.tsx

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 46857e14f..e2695aa44 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 ## 1.14.4 (TBD)
 
+### Features
+
+* [FEATURE][all] Dedicated import-recovery-method screen for PSM wallet imports. Seed-phrase import now shows a screen with a collapsible guardian URL input (default: `DEFAULT_PSM_ENDPOINT`) and an "import public account" fallback; the chosen URL is persisted to `PSM_URL_STORAGE_KEY`. On guardian lookup failure the user is bounced back to the same screen with an inline "account not found on guardian" error — previously `Vault.spawn` swallowed the error and fell back to `createMidenWallet`, silently creating a fresh account under the same seed. PSM account ID is now derived against `DEFAULT_PSM_ENDPOINT` (matching creation-time identity) while the live state fetch targets the user's custom URL, which supports importing accounts whose guardian was switched post-creation. `Vault.spawn` also preserves `PSM_URL_STORAGE_KEY` across its pre-spawn `clearStorage()` so the URL the frontend just wrote survives the wipe.
+
 ### Fixes
 
 * [FIX][all] Encrypted-wallet-file import now restores secret keys for every imported account, not just the first. The decrypted wallet payload carries the full `WalletAccount[]` (with `hdIndex` and `type` per account), and `Vault.spawnFromMidenClient` re-derives each auth key from the mnemonic and inserts it into the new keystore via `client.keystore.insert`. Previously the imported miden-client DB came over without keystore entries, so signing broke for any non-default account.
diff --git a/public/_locales/en/en.json b/public/_locales/en/en.json
index 27bc7ceb1..7a430f358 100644
--- a/public/_locales/en/en.json
+++ b/public/_locales/en/en.json
@@ -448,6 +448,14 @@
   "fullyPrivateRecoveryDescription": "Local only, no one sees your state except you but no recovery, losing your device will result in permanent loss of your funds.",
   "publicAccountRecovery": "Public",
   "publicAccountRecoveryDescription": "Recover a public on-chain account.",
+  "importRecoveryMethodTitle": "How would you like to recover this wallet?",
+  "importViaGuardian": "Import via Guardian",
+  "importViaGuardianDescription": "Use a guardian to recover and co-sign for this account.",
+  "importPublicAccount": "Import public account",
+  "importPublicAccountDescription": "Import the public account derived from your seed phrase.",
+  "guardianEndpoint": "Guardian URL",
+  "useDifferentGuardian": "Use a different guardian",
+  "guardianAccountNotFound": "We couldn't find your account on this guardian. Check the URL or import as a public account instead.",
   "default": "Default",
   "transactionFile": "Transaction file",
   "verificationFailed": "Verification Failed",
diff --git a/src/app/pages/Welcome.tsx b/src/app/pages/Welcome.tsx
index 5cb24d9a6..de8c4ff9c 100644
--- a/src/app/pages/Welcome.tsx
+++ b/src/app/pages/Welcome.tsx
@@ -6,8 +6,10 @@ import wordslist from 'bip39/src/wordlists/english.json';
 import { formatMnemonic } from 'app/defaults';
 import { AnalyticsEventCategory, useAnalytics } from 'lib/analytics';
 import { useMidenContext } from 'lib/miden/front';
+import { putToStorage } from 'lib/miden/front/storage';
 import { useMobileBackHandler } from 'lib/mobile/useMobileBackHandler';
 import { isDesktop, isMobile } from 'lib/platform';
+import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { WalletStatus, WalletAccount } from 'lib/shared/types';
 import { useWalletStore } from 'lib/store';
 import { fetchStateFromBackend } from 'lib/store/hooks/useIntercomSync';
@@ -78,6 +80,7 @@ const Welcome: FC = () => {
   const [isHardwareSecurityAvailable, setIsHardwareSecurityAvailable] = useState(false);
   const [biometricAttempts, setBiometricAttempts] = useState(0);
   const [biometricError, setBiometricError] = useState<string | null>(null);
+  const [guardianLookupError, setGuardianLookupError] = useState(false);
   const [importedWalletAccounts, setImportedWalletAccounts] = useState<WalletAccount[]>([]);
   const { registerWallet, importWalletFromClient } = useMidenContext();
   const { trackEvent } = useAnalytics();
@@ -195,7 +198,7 @@ const Welcome: FC = () => {
           if (hardwareAvailable) {
             // Hardware-only mode: skip password, go to recovery method selection
             setPassword('__HARDWARE_ONLY__');
-            navigate('/#select-recovery-method');
+            navigate('/#import-select-recovery-method');
           } else {
             navigate('/#create-password');
           }
@@ -226,12 +229,25 @@ const Welcome: FC = () => {
         setPassword(action.payload.password);
         eventCategory = AnalyticsEventCategory.FormSubmit;
         // Hardware protection is automatically set up in Vault.spawn() when available
-        navigate('/#select-recovery-method');
+        if (onboardingType === OnboardingType.Import && importType === ImportType.SeedPhrase) {
+          navigate('/#import-select-recovery-method');
+        } else {
+          navigate('/#select-recovery-method');
+        }
         break;
       case 'select-recovery-method':
         setWalletType(action.payload);
         navigate('/#confirmation');
         break;
+      case 'import-select-recovery-method':
+        setWalletType(action.payload.walletType);
+        if (action.payload.walletType === WalletType.Psm && action.payload.guardianEndpoint) {
+          console.log('Putting guardian endpoint to storage:', action.payload.guardianEndpoint);
+          await putToStorage(PSM_URL_STORAGE_KEY, action.payload.guardianEndpoint);
+        }
+        setGuardianLookupError(false);
+        navigate('/#confirmation');
+        break;
       case 'confirmation':
         try {
           setIsLoading(true);
@@ -246,8 +262,11 @@ const Welcome: FC = () => {
         } catch (error) {
           console.error('[Welcome] Confirmation flow failed:', error);
           setIsLoading(false);
-          // Track biometric attempts for hardware-only mode
-          if (password === '__HARDWARE_ONLY__') {
+          if (onboardingType === OnboardingType.Import && walletType === WalletType.Psm) {
+            setGuardianLookupError(true);
+            navigate('/#import-select-recovery-method');
+          } else if (password === '__HARDWARE_ONLY__') {
+            // Track biometric attempts for hardware-only mode
             const newAttempts = biometricAttempts + 1;
             setBiometricAttempts(newAttempts);
             setBiometricError(error instanceof Error ? error.message : 'Biometric authentication failed');
@@ -287,6 +306,12 @@ const Welcome: FC = () => {
           } else {
             navigate('/#create-password');
           }
+        } else if (step === OnboardingStep.ImportSelectRecoveryMethod) {
+          if (password === '__HARDWARE_ONLY__') {
+            navigate('/#import-from-seed');
+          } else {
+            navigate('/#create-password');
+          }
         } else if (step === OnboardingStep.ImportFromFile || step === OnboardingStep.ImportFromSeed) {
           navigate('/#select-import-type');
         }
@@ -330,6 +355,9 @@ const Welcome: FC = () => {
       case '#select-recovery-method':
         setStep(OnboardingStep.SelectRecoveryMethod);
         break;
+      case '#import-select-recovery-method':
+        setStep(OnboardingStep.ImportSelectRecoveryMethod);
+        break;
       case '#confirmation':
         if (!password) {
           navigate('/');
@@ -369,6 +397,7 @@ const Welcome: FC = () => {
       isHardwareSecurityAvailable={isHardwareSecurityAvailable}
       biometricAttempts={biometricAttempts}
       biometricError={biometricError}
+      guardianLookupError={guardianLookupError}
       onBiometricChange={setUseBiometric}
       onAction={onAction}
     />
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index 3cf0f3f68..aa14253c2 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -15,11 +15,13 @@ import {
 import * as Passworder from 'lib/miden/passworder';
 import { clearStorage } from 'lib/miden/reset';
 import { isDesktop, isMobile } from 'lib/platform';
+import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { b64ToU8, u8ToB64 } from 'lib/shared/helpers';
 import { WalletAccount, WalletSettings } from 'lib/shared/types';
 import { WalletType } from 'screens/onboarding/types';
 
 import { compareAccountIds } from '../activity/utils';
+import { fetchFromStorage, putToStorage } from '../front/storage';
 import { getBech32AddressFromAccountId } from '../sdk/helpers';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 import { MidenClientCreateOptions } from '../sdk/miden-client-interface';
@@ -217,9 +219,19 @@ export class Vault {
         mnemonic = Bip39.generateMnemonic(128);
       }
 
-      // Clear storage before any inserts to avoid wiping newly inserted keys later
+      // Clear storage before any inserts to avoid wiping newly inserted keys later.
+      // clearStorage wipes the entire platform key-value store, which would also
+      // erase the guardian URL that the onboarding flow just wrote for a PSM import.
+      // Snapshot it and restore after the wipe so downstream reads
+      // (createPsmAccount / importAccountFromPsm) see the caller's choice.
+      // TODO: thread guardianEndpoint as an explicit arg through registerWallet → spawn
+      // instead of round-tripping through storage.
       console.log('[Vault.spawn] Step 3: clearing storage...');
+      const preservedPsmUrl = await fetchFromStorage<string>(PSM_URL_STORAGE_KEY);
       await clearStorage();
+      if (preservedPsmUrl) {
+        await putToStorage(PSM_URL_STORAGE_KEY, preservedPsmUrl);
+      }
       console.log('[Vault.spawn] Step 4: storage cleared');
 
       // Determine security model: hardware-only or password-based
@@ -275,6 +287,13 @@ export class Vault {
             console.log('[Vault.spawn] Step 8a: importing wallet from seed...');
             return await midenClient.importAccountBySeed(walletType, walletSeed, signWordFn, getPublicKeyForCommitment);
           } catch (e) {
+            // PSM imports must not silently fall back: a failure here means the guardian lookup
+            // failed, and creating a fresh local account would leave the user with the wrong
+            // balance under their seed. Propagate so the UI can let them fix the URL or switch
+            // to public-account import.
+            if (walletType === WalletType.Psm) {
+              throw e;
+            }
             console.error('Failed to import wallet from seed in spawn, creating new wallet instead', e);
             return await midenClient.createMidenWallet(walletType, walletSeed);
           }
@@ -290,7 +309,7 @@ export class Vault {
       const initialAccount: WalletAccount = {
         publicKey: accPublicKey,
         name: 'Miden Account 1',
-        isPublic: walletType === WalletType.OnChain,
+        isPublic: false,
         type: walletType,
         hdIndex: hdAccIndex
       };
@@ -401,12 +420,15 @@ export class Vault {
 
   async createHDAccount(walletType: WalletType, name?: string): Promise<WalletAccount[]> {
     return withError('Failed to create account', async () => {
+      console.log('[Vault.createHDAccount] Step 1: start, walletType =', walletType);
       const [mnemonic, allAccounts] = await Promise.all([
         fetchAndDecryptOneWithLegacyFallBack<string>(mnemonicStrgKey, this.vaultKey),
         this.fetchAccounts()
       ]);
+      console.log('[Vault.createHDAccount] Step 2: mnemonic + accounts loaded, count =', allAccounts.length);
 
       const isOwnMnemonic = await this.isOwnMnemonic();
+      console.log('[Vault.createHDAccount] Step 3: isOwnMnemonic =', isOwnMnemonic);
 
       let hdAccIndex;
       let accounts;
@@ -416,26 +438,35 @@ export class Vault {
         accounts = allAccounts.filter(acc => !acc.isPublic);
       }
       hdAccIndex = accounts.length;
+      console.log('[Vault.createHDAccount] Step 4: hdAccIndex =', hdAccIndex);
 
       const walletSeed = deriveClientSeed(walletType, mnemonic, hdAccIndex);
       const options: MidenClientCreateOptions = {
         insertKeyCallback: insertKeyCallbackWrapper(this.vaultKey)
       };
+      console.log('[Vault.createHDAccount] Step 5: seed derived, acquiring WASM lock');
 
       // Wrap WASM client operations in a lock to prevent concurrent access
       const walletId = await withWasmClientLock(async () => {
+        console.log('[Vault.createHDAccount] Step 6: WASM lock acquired, getting client');
         const midenClient = await getMidenClient(options);
+        console.log('[Vault.createHDAccount] Step 7: client ready, network =', midenClient.network);
         if (isOwnMnemonic && walletType === WalletType.OnChain) {
           try {
+            console.log('[Vault.createHDAccount] Step 8a: importPublicMidenWalletFromSeed');
             return await midenClient.importPublicMidenWalletFromSeed(walletSeed);
           } catch (e) {
             console.warn('Failed to import wallet from seed, creating new wallet instead', e);
             return await midenClient.createMidenWallet(walletType, walletSeed);
           }
         } else {
-          return await midenClient.createMidenWallet(walletType, walletSeed);
+          console.log('[Vault.createHDAccount] Step 8b: createMidenWallet');
+          const id = await midenClient.createMidenWallet(walletType, walletSeed);
+          console.log('[Vault.createHDAccount] Step 9: createMidenWallet returned', id);
+          return id;
         }
       });
+      console.log('[Vault.createHDAccount] Step 10: walletId =', walletId);
 
       const accName = name || getNewAccountName(allAccounts);
 
diff --git a/src/lib/miden/psm/account.ts b/src/lib/miden/psm/account.ts
index 022180bda..be8fb94bf 100644
--- a/src/lib/miden/psm/account.ts
+++ b/src/lib/miden/psm/account.ts
@@ -4,7 +4,7 @@ import { FalconSigner, MultisigClient } from '@openzeppelin/miden-multisig-clien
 import { DEFAULT_PSM_ENDPOINT } from 'lib/miden-chain/constants';
 import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
 
-import { fetchFromStorage } from '../front';
+import { fetchFromStorage } from '../front/storage';
 
 // Re-export the slot names from the package for reading account state
 export const MULTISIG_SLOT_NAMES = {
@@ -47,12 +47,19 @@ export async function getSignerDetailsFromAccount(
  *
  * @param webClient - The Miden WebClient instance
  * @param seed - Optional seed for key derivation (random if not provided)
+ * @param skipRegistration - Skip guardian registration (used by the import path)
+ * @param guardianEndpointOverride - Force a specific guardian URL for pubkey derivation.
+ *   Account ID is a content hash that includes the guardian pubkey baked into storage,
+ *   so the import flow passes `DEFAULT_PSM_ENDPOINT` to reproduce the ID the account
+ *   originally had; the user's custom URL is used by `importAccountFromPsm` for the
+ *   live state fetch only.
  * @returns The created Account
  */
 export async function createPsmAccount(
   webClient: MidenClient,
   seed?: Uint8Array,
-  skipRegistration: boolean = false
+  skipRegistration: boolean = false,
+  guardianEndpointOverride?: string
 ): Promise<Account> {
   if (!seed) {
     seed = crypto.getRandomValues(new Uint8Array(32));
@@ -64,7 +71,9 @@ export async function createPsmAccount(
     const signerCommitment = sk.publicKey().toCommitment();
 
     // Get PSM endpoint and initialize client
-    const guardianEndpoint = (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) || DEFAULT_PSM_ENDPOINT;
+    const guardianEndpoint =
+      guardianEndpointOverride ?? (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) ?? DEFAULT_PSM_ENDPOINT;
+    console.log('Using PSM endpoint:', guardianEndpoint);
     const client = new MultisigClient(webClient, { guardianEndpoint });
     const { commitment, pubkey } = await client.guardianClient.getPubkey();
     // Create the multisig account using the package utility
diff --git a/src/lib/miden/sdk/miden-client-interface.ts b/src/lib/miden/sdk/miden-client-interface.ts
index f7eb0589b..b123c717b 100644
--- a/src/lib/miden/sdk/miden-client-interface.ts
+++ b/src/lib/miden/sdk/miden-client-interface.ts
@@ -27,9 +27,11 @@ import { isMobile } from 'lib/platform';
 import { WalletType } from 'screens/onboarding/types';
 
 import { ConsumeTransaction, SendTransaction } from '../db/types';
-import { createPsmAccount, getSignerDetailsFromAccount } from '../psm/account';
-import { MultisigService } from '../psm/index';
-import { SignWordFunction } from '../psm/signer';
+// PSM helpers are dynamic-imported inside the methods that use them to avoid
+// a module init cycle: miden-client-interface → psm/index → sdk/miden-client →
+// miden-client-interface. Static imports here deadlock init_psm_manager in the
+// SW bundle (both sides' __esmMin wrappers await each other).
+import type { SignWordFunction } from '../psm/signer';
 import { NoteExportType } from './constants';
 import { getBech32AddressFromAccountId } from './helpers';
 
@@ -102,6 +104,7 @@ export class MidenClientInterface {
 
   async createMidenWallet(walletType: WalletType, seed?: Uint8Array): Promise<string> {
     if (walletType === WalletType.Psm) {
+      const { createPsmAccount } = await import('../psm/account');
       const account = await createPsmAccount(this.client, seed);
       return getBech32AddressFromAccountId(account.id());
     }
@@ -132,9 +135,15 @@ export class MidenClientInterface {
     getPublicKeyForCommitment: (commitment: string) => Promise<string>
   ): Promise<string> {
     if (walletType === WalletType.Psm) {
-      console.log('Importing PSM account from seed');
+      console.log('Importing PSM account from seed', seed);
       try {
-        const account = await createPsmAccount(this.client, seed, true);
+        const [{ createPsmAccount, getSignerDetailsFromAccount }, { MultisigService }, { DEFAULT_PSM_ENDPOINT }] =
+          await Promise.all([import('../psm/account'), import('../psm/index'), import('lib/miden-chain/constants')]);
+        // Derive the account ID against the default guardian so it matches the ID
+        // the account had at creation time. The user's custom guardian URL (persisted
+        // in PSM_URL_STORAGE_KEY) is picked up later by importAccountFromPsm for the
+        // live state fetch.
+        const account = await createPsmAccount(this.client, seed, true, DEFAULT_PSM_ENDPOINT);
         console.log('[MidenClientInterface] Imported PSM account from seed with ID:', account.id().toString());
         const accountId = account.id().toString();
         const { commitment, publicKey } = await getSignerDetailsFromAccount(account, getPublicKeyForCommitment);
diff --git a/src/screens/onboarding/import-wallet-flow/ImportRecoveryMethod.tsx b/src/screens/onboarding/import-wallet-flow/ImportRecoveryMethod.tsx
new file mode 100644
index 000000000..e4b2f5638
--- /dev/null
+++ b/src/screens/onboarding/import-wallet-flow/ImportRecoveryMethod.tsx
@@ -0,0 +1,150 @@
+import React, { useMemo, useState } from 'react';
+
+import classNames from 'clsx';
+import { useTranslation } from 'react-i18next';
+
+import { Icon, IconName } from 'app/icons/v2';
+import { Button } from 'components/Button';
+import { Input } from 'components/Input';
+import { DEFAULT_PSM_ENDPOINT } from 'lib/miden-chain/constants';
+import { Badge } from 'lib/ui/badge';
+
+import { WalletType } from '../types';
+
+export interface ImportRecoveryMethodScreenProps {
+  isError?: boolean;
+  onSubmit: (payload: { walletType: WalletType; guardianEndpoint?: string }) => void;
+}
+
+export const ImportRecoveryMethodScreen: React.FC<ImportRecoveryMethodScreenProps> = ({ isError, onSubmit }) => {
+  const { t } = useTranslation();
+
+  const [selected, setSelected] = useState<WalletType>(WalletType.Psm);
+  const [endpointInput, setEndpointInput] = useState<string>(DEFAULT_PSM_ENDPOINT);
+  const [isCustomizing, setIsCustomizing] = useState(false);
+  const [dirty, setDirty] = useState(false);
+
+  const showError = Boolean(isError) && !dirty && selected === WalletType.Psm;
+
+  const trimmedEndpoint = endpointInput.trim();
+  const canContinue = selected === WalletType.OnChain || (selected === WalletType.Psm && trimmedEndpoint.length > 0);
+
+  const handleContinue = () => {
+    console.log('Continue with selection:', { selected, trimmedEndpoint });
+    if (selected === WalletType.OnChain) {
+      onSubmit({ walletType: WalletType.OnChain });
+      return;
+    }
+    onSubmit({ walletType: WalletType.Psm, guardianEndpoint: trimmedEndpoint });
+  };
+
+  const handleSelectPsm = () => {
+    setSelected(WalletType.Psm);
+    setDirty(true);
+  };
+
+  const handleSelectOnChain = () => {
+    setSelected(WalletType.OnChain);
+    setDirty(true);
+    setIsCustomizing(false);
+  };
+
+  const handleToggleCustom = () => {
+    setIsCustomizing(prev => !prev);
+    setDirty(true);
+  };
+
+  const options = useMemo(
+    () => [
+      {
+        id: WalletType.Psm,
+        title: t('importViaGuardian'),
+        description: t('importViaGuardianDescription'),
+        isDefault: true,
+        onSelect: handleSelectPsm
+      },
+      {
+        id: WalletType.OnChain,
+        title: t('importPublicAccount'),
+        description: t('importPublicAccountDescription'),
+        onSelect: handleSelectOnChain
+      }
+    ],
+    [t]
+  );
+
+  return (
+    <div
+      className="flex-1 flex flex-col items-center bg-transparent pt-6 h-full px-4 text-heading-gray gap-6"
+      data-testid="import-recovery-method"
+    >
+      <div className="flex flex-col items-center gap-2">
+        <h1 className="font-semibold text-2xl lh-title">{t('importRecoveryMethodTitle')}</h1>
+        <p className="text-xs text-center lh-title px-4">{t('chooseRecoveryMethodDescription')}</p>
+      </div>
+
+      <div className="flex flex-col w-full">
+        {options.map(option => {
+          const isSelected = selected === option.id;
+          const isPsm = option.id === WalletType.Psm;
+          return (
+            <div
+              key={option.id}
+              className={classNames('flex flex-col p-4 rounded-lg cursor-pointer bg-white mb-2', {
+                'opacity-50': !isSelected
+              })}
+              onClick={option.onSelect}
+            >
+              <div className="flex flex-row justify-between items-center">
+                <div className="flex items-center gap-2">
+                  <h2 className="font-medium text-base">{option.title}</h2>
+                  {option.isDefault && (
+                    <Badge variant={'default'} className="bg-primary-500 text-white">
+                      {t('default')}
+                    </Badge>
+                  )}
+                </div>
+              </div>
+              <p className="text-grey-600 text-sm">{option.description}</p>
+
+              {isPsm && isSelected && (
+                <div className="mt-4 flex flex-col gap-2" onClick={e => e.stopPropagation()}>
+                  {!isCustomizing && (
+                    <div className="flex flex-col gap-1">
+                      <span className="text-xs text-grey-600">{t('guardianEndpoint')}</span>
+                      <span className="text-sm font-mono break-all">{endpointInput}</span>
+                    </div>
+                  )}
+                  <button
+                    type="button"
+                    onClick={handleToggleCustom}
+                    className="flex items-center gap-1 text-sm text-primary-500 font-medium self-start"
+                  >
+                    <span>{t('useDifferentGuardian')}</span>
+                    <Icon name={isCustomizing ? IconName.ChevronUp : IconName.ChevronDown} size="sm" />
+                  </button>
+                  {isCustomizing && (
+                    <Input
+                      id="guardian-endpoint-input"
+                      value={endpointInput}
+                      placeholder={DEFAULT_PSM_ENDPOINT}
+                      onChange={event => {
+                        setEndpointInput(event.target.value);
+                        setDirty(true);
+                      }}
+                    />
+                  )}
+                  {showError && <p className="text-red-500 text-xs mt-1">{t('guardianAccountNotFound')}</p>}
+                </div>
+              )}
+            </div>
+          );
+        })}
+      </div>
+
+      <div className="flex flex-col gap-2 self-center w-full mt-auto">
+        <Button title={t('continue')} onClick={handleContinue} disabled={!canContinue} className="text-base" />
+      </div>
+    </div>
+  );
+};
diff --git a/src/screens/onboarding/navigator.tsx b/src/screens/onboarding/navigator.tsx
index b1655a82a..32ecdb638 100644
--- a/src/screens/onboarding/navigator.tsx
+++ b/src/screens/onboarding/navigator.tsx
@@ -13,9 +13,10 @@ import { ConfirmationScreen } from './common/Confirmation';
 import { CreatePasswordScreen } from './common/CreatePassword';
 import { WelcomeScreen } from './common/Welcome';
 import { BackUpSeedPhraseScreen } from './create-wallet-flow/BackUpSeedPhrase';
-import { RecoveryOption, SelectRecoveryMethodScreen } from './create-wallet-flow/SelectRecoveryMethod';
+import { SelectRecoveryMethodScreen } from './create-wallet-flow/SelectRecoveryMethod';
 import { SelectTransactionTypeScreen } from './create-wallet-flow/SelectTransactionType';
 import { VerifySeedPhraseScreen } from './create-wallet-flow/VerifySeedPhrase';
+import { ImportRecoveryMethodScreen } from './import-wallet-flow/ImportRecoveryMethod';
 import { ImportSeedPhraseScreen } from './import-wallet-flow/ImportSeedPhrase';
 import { ImportWalletFileScreen } from './import-wallet-flow/ImportWalletFile';
 import { SelectImportTypeScreen } from './import-wallet-flow/SelectImportType';
@@ -32,6 +33,7 @@ export interface OnboardingFlowProps {
   isHardwareSecurityAvailable?: boolean;
   biometricAttempts?: number;
   biometricError?: string | null;
+  guardianLookupError?: boolean;
   onBiometricChange?: (value: boolean) => void;
   onAction?: (action: OnboardingAction) => void;
 }
@@ -55,6 +57,8 @@ const Header: React.FC<{
     currentStep = 2;
   } else if (step === OnboardingStep.SelectRecoveryMethod) {
     currentStep = 4;
+  } else if (step === OnboardingStep.ImportSelectRecoveryMethod) {
+    currentStep = 4;
   } else if (step === OnboardingStep.Confirmation) {
     currentStep = 4;
   }
@@ -78,6 +82,7 @@ export const OnboardingFlow: FC<OnboardingFlowProps> = ({
   isHardwareSecurityAvailable = false,
   biometricAttempts = 0,
   biometricError = null,
+  guardianLookupError = false,
   onBiometricChange,
   onAction
 }) => {
@@ -181,28 +186,15 @@ export const OnboardingFlow: FC<OnboardingFlowProps> = ({
         return <ImportWalletFileScreen onSubmit={onImportFileSubmit} />;
       case OnboardingStep.CreatePassword:
         return <CreatePasswordScreen onSubmit={onCreatePasswordSubmit} />;
-      case OnboardingStep.SelectRecoveryMethod: {
-        const importRecoveryOptions: RecoveryOption[] = [
-          {
-            id: WalletType.Psm,
-            title: t('guardianRecovery'),
-            description: t('guardianRecoveryDescription'),
-            isDefault: true
-          },
-          {
-            id: WalletType.OnChain,
-            title: t('publicAccountRecovery'),
-            description: t('publicAccountRecoveryDescription'),
-            isLast: true
-          }
-        ];
+      case OnboardingStep.SelectRecoveryMethod:
+        return <SelectRecoveryMethodScreen onSubmit={onSelectRecoveryMethodSubmit} />;
+      case OnboardingStep.ImportSelectRecoveryMethod:
         return (
-          <SelectRecoveryMethodScreen
-            onSubmit={onSelectRecoveryMethodSubmit}
-            options={onboardingType === OnboardingType.Import ? importRecoveryOptions : undefined}
+          <ImportRecoveryMethodScreen
+            isError={guardianLookupError}
+            onSubmit={payload => onForwardAction?.({ id: 'import-select-recovery-method', payload })}
           />
         );
-      }
       case OnboardingStep.SelectTransactionType:
         return <SelectTransactionTypeScreen onSubmit={onSelectTransactionTypeSubmit} />;
       case OnboardingStep.Confirmation:
@@ -230,8 +222,7 @@ export const OnboardingFlow: FC<OnboardingFlowProps> = ({
     onBiometricChange,
     biometricAttempts,
     biometricError,
-    onboardingType,
-    t
+    guardianLookupError
   ]);
 
   const onBack = () => {
diff --git a/src/screens/onboarding/types.ts b/src/screens/onboarding/types.ts
index 777ab0d2f..6ae46ddcf 100644
--- a/src/screens/onboarding/types.ts
+++ b/src/screens/onboarding/types.ts
@@ -28,6 +28,7 @@ export enum OnboardingStep {
   BiometricSetup = 'biometric-setup',
   SelectTransactionType = 'select-transaction-type',
   SelectRecoveryMethod = 'select-recovery-method',
+  ImportSelectRecoveryMethod = 'import-select-recovery-method',
   Confirmation = 'confirmation'
 }
 export type OnboardingActionId =
@@ -42,6 +43,7 @@ export type OnboardingActionId =
   | 'biometric-setup-submit'
   | 'select-transaction-type'
   | 'select-recovery-method'
+  | 'import-select-recovery-method'
   | 'confirmation'
   | 'import-from-file'
   | 'import-from-seed';
@@ -90,6 +92,11 @@ export type SelectRecoveryMethodAction = {
   payload: WalletType;
 };
 
+export type ImportSelectRecoveryMethodAction = {
+  id: 'import-select-recovery-method';
+  payload: { walletType: WalletType; guardianEndpoint?: string };
+};
+
 export type ConfirmationAction = {
   id: 'confirmation';
 };
@@ -128,6 +135,7 @@ export type OnboardingAction =
   | BiometricSetupSubmitAction
   | SelectTransactionTypeAction
   | SelectRecoveryMethodAction
+  | ImportSelectRecoveryMethodAction
   | ConfirmationAction
   | ImportSeedPhraseSubmitAction
   | BackAction

From b5a5617715e7c94b0e634d14a0afeb06f05d4f07 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Thu, 23 Apr 2026 08:22:26 +0530
Subject: [PATCH 22/71] fix: readable text in dark mode on onboarding import
 screens

---
 CHANGELOG.md                                               | 1 +
 .../onboarding/import-wallet-flow/ImportSeedPhrase.tsx     | 7 ++++++-
 .../onboarding/import-wallet-flow/ImportWalletFile.tsx     | 2 +-
 .../onboarding/import-wallet-flow/SelectImportType.tsx     | 2 +-
 4 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e2695aa44..1eb123143 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@
 
 ### Fixes
 
+* [FIX][all] Onboarding import screens (`ImportSeedPhrase`, `ImportWalletFile`, `SelectImportType`) render readable text in dark mode. Root containers now include `text-heading-gray` so child `<h1>`/`<p>` elements inherit a theme-aware color instead of falling back to the user-agent default (black), which was illegible on the dark app background.
 * [FIX][all] Encrypted-wallet-file import now restores secret keys for every imported account, not just the first. The decrypted wallet payload carries the full `WalletAccount[]` (with `hdIndex` and `type` per account), and `Vault.spawnFromMidenClient` re-derives each auth key from the mnemonic and inserts it into the new keystore via `client.keystore.insert`. Previously the imported miden-client DB came over without keystore entries, so signing broke for any non-default account.
 * [FIX][all] Encrypted wallet file export now includes wallet account metadata alongside the miden-client/wallet DB dumps, so import can preserve account names and HD indices instead of falling back to generic "Miden Account N" labels.
 * [FIX][all] Encrypted-file password screen consolidates the hardware-vs-password branching around a single `hasHardwareProtector` check — hardware-only vaults skip password entry entirely, password-protected vaults keep the attempt/lockout flow.
diff --git a/src/screens/onboarding/import-wallet-flow/ImportSeedPhrase.tsx b/src/screens/onboarding/import-wallet-flow/ImportSeedPhrase.tsx
index 4cd84a06d..192172dc8 100644
--- a/src/screens/onboarding/import-wallet-flow/ImportSeedPhrase.tsx
+++ b/src/screens/onboarding/import-wallet-flow/ImportSeedPhrase.tsx
@@ -54,7 +54,12 @@ export const ImportSeedPhraseScreen: React.FC<ImportSeedPhraseScreenProps> = ({
 
   return (
     <div
-      className={classNames('flex-1', 'flex flex-col justify-start items-center', 'bg-app-bg px-4 pt-6', className)}
+      className={classNames(
+        'flex-1',
+        'flex flex-col justify-start items-center',
+        'bg-app-bg text-heading-gray px-4 pt-6',
+        className
+      )}
       data-testid="import-seed-phrase"
     >
       <h1 className="text-2xl font-semibold">{t('importWallet')}</h1>
diff --git a/src/screens/onboarding/import-wallet-flow/ImportWalletFile.tsx b/src/screens/onboarding/import-wallet-flow/ImportWalletFile.tsx
index 012cfba97..7eae7c9b2 100644
--- a/src/screens/onboarding/import-wallet-flow/ImportWalletFile.tsx
+++ b/src/screens/onboarding/import-wallet-flow/ImportWalletFile.tsx
@@ -167,7 +167,7 @@ export const ImportWalletFileScreen: React.FC<ImportWalletFileScreenProps> = ({
       className={classNames(
         'flex-1 h-full',
         'flex flex-col justify-content items-center gap-y-2',
-        'bg-app-bg px-4 pt-6',
+        'bg-app-bg text-heading-gray px-4 pt-6',
         className
       )}
       onSubmit={handleSubmit(handleImportSubmit)}
diff --git a/src/screens/onboarding/import-wallet-flow/SelectImportType.tsx b/src/screens/onboarding/import-wallet-flow/SelectImportType.tsx
index 3f2d3c1ba..d2aefce66 100644
--- a/src/screens/onboarding/import-wallet-flow/SelectImportType.tsx
+++ b/src/screens/onboarding/import-wallet-flow/SelectImportType.tsx
@@ -39,7 +39,7 @@ export const SelectImportTypeScreen = ({ onSubmit }: SelectImportTypeScreenProps
 
   return (
     <div
-      className="flex-1 flex flex-col items-center bg-transparent px-4 pt-6 overflow-y-auto"
+      className="flex-1 flex flex-col items-center bg-transparent text-heading-gray px-4 pt-6 overflow-y-auto"
       data-testid="import-select-type"
     >
       <div className="flex flex-col items-center pb-6">

From c68fe819c3f0b5bdb72d6d025b90187ebdf534f8 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Thu, 23 Apr 2026 16:56:34 +0530
Subject: [PATCH 23/71] refactor: rename psm to guardian

---
 CHANGELOG.md                                  |   6 +-
 public/_locales/en/en.json                    |   2 +-
 src/app/pages/Explore.tsx                     |   3 +-
 .../pages/ForgotPassword/ForgotPassword.tsx   |   2 +-
 src/app/pages/SelectAccount.tsx               |   7 +-
 src/app/pages/Settings.tsx                    |  16 +--
 src/app/pages/Welcome.tsx                     |  10 +-
 src/app/templates/GuardianSettings.tsx        |  18 +--
 src/components/TransactionProgressModal.tsx   |   5 +-
 src/lib/miden-chain/constants.ts              |   2 +-
 .../activity/transactions.extended.test.ts    |  12 +-
 src/lib/miden/activity/transactions.test.ts   |   6 +-
 src/lib/miden/activity/transactions.ts        |  60 ++++----
 src/lib/miden/back/actions.test.ts            |   8 +-
 src/lib/miden/back/transaction-processor.ts   |   8 +-
 src/lib/miden/back/vault.ts                   |  22 +--
 src/lib/miden/db/types.ts                     |   8 +-
 src/lib/miden/front/guardian-manager.ts       | 102 ++++++++++++++
 src/lib/miden/front/guardian-sync.ts          |  36 +++++
 src/lib/miden/front/psm-manager.ts            | 132 ------------------
 src/lib/miden/front/useSyncTrigger.ts         |  24 ++--
 src/lib/miden/{psm => guardian}/account.ts    |  30 ++--
 src/lib/miden/{psm => guardian}/digest.ts     |   0
 src/lib/miden/{psm => guardian}/index.ts      |  29 ++--
 src/lib/miden/{psm => guardian}/signer.ts     |   0
 src/lib/miden/sdk/miden-client-interface.ts   |  39 +++---
 src/lib/settings/constants.ts                 |   2 +-
 src/lib/store/index.test.ts                   |   8 +-
 src/lib/store/index.ts                        |   8 ++
 .../GeneratingTransaction.tsx                 |   5 +-
 .../SelectRecoveryMethod.tsx                  |   2 +-
 .../ImportRecoveryMethod.tsx                  |  26 ++--
 src/screens/onboarding/types.ts               |   2 +-
 src/screens/send-flow/SendManager.tsx         |   2 +-
 34 files changed, 342 insertions(+), 300 deletions(-)
 create mode 100644 src/lib/miden/front/guardian-manager.ts
 create mode 100644 src/lib/miden/front/guardian-sync.ts
 delete mode 100644 src/lib/miden/front/psm-manager.ts
 rename src/lib/miden/{psm => guardian}/account.ts (76%)
 rename src/lib/miden/{psm => guardian}/digest.ts (100%)
 rename src/lib/miden/{psm => guardian}/index.ts (88%)
 rename src/lib/miden/{psm => guardian}/signer.ts (100%)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 237436159..ea3c7c8c3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,7 @@
 
 ### Features
 
-* [FEATURE][all] Dedicated import-recovery-method screen for PSM wallet imports. Seed-phrase import now shows a screen with a collapsible guardian URL input (default: `DEFAULT_PSM_ENDPOINT`) and an "import public account" fallback; the chosen URL is persisted to `PSM_URL_STORAGE_KEY`. On guardian lookup failure the user is bounced back to the same screen with an inline "account not found on guardian" error — previously `Vault.spawn` swallowed the error and fell back to `createMidenWallet`, silently creating a fresh account under the same seed. PSM account ID is now derived against `DEFAULT_PSM_ENDPOINT` (matching creation-time identity) while the live state fetch targets the user's custom URL, which supports importing accounts whose guardian was switched post-creation. `Vault.spawn` also preserves `PSM_URL_STORAGE_KEY` across its pre-spawn `clearStorage()` so the URL the frontend just wrote survives the wipe.
+* [FEATURE][all] Guardian integration. Adds Guardian-backed accounts (1-of-1 multisig with on-chain Guardian signature verification), onboarding create/import flows with a dedicated recovery-method screen that accepts a custom guardian URL, Settings → Guardian Settings with an on-chain switch-guardian proposal that re-registers post-switch state with the new endpoint, service-worker routing for Guardian transaction signing via `MultisigService`, frontend Guardian sync outside the WASM lock, and per-stage progress labels (`creating-proposal`, `signing-proposal`, `submitting`, `registering-guardian`) in the transaction modal.
 * [FEATURE][all] Transaction-complete modal now surfaces a **View on Midenscan** action alongside **Done**. Desktop / extension opens the explorer in a new tab; mobile opens it as a native `InAppBrowser` overlay so dismissing the overlay returns the user to the completion screen with no state loss. URL resolved per-network via a new `MIDEN_EXPLORER_ENDPOINTS` map (testnet / devnet); localnet has no explorer → button hidden. The on-chain tx hash is plumbed through `SendManager.onSubmit` → `lastCompletedTxHash` in the Zustand store, cleared at the start of each send so the button never points at a stale hash. (#203)
 * [UX][all] Transaction-complete modal no longer auto-closes 3 s after success — user now dismisses explicitly, giving time to read the confirmation and tap **View on Midenscan**. (#203)
 
@@ -26,8 +26,7 @@
 
 ### Features
 
-* [FEATURE][all] Guardian switch for PSM accounts. Settings → Guardian Settings lets the user point a PSM account at a new guardian endpoint; the switch is a signed on-chain proposal that waits for inclusion, registers the post-switch account state with the new guardian, then flips the cached `PSM_URL_STORAGE_KEY` so subsequent syncs hit the new endpoint. The frontend cache self-heals when the stored endpoint drifts, so the popup stops syncing against the old guardian across the SW/frontend realm boundary.
-* [FEATURE][all] Per-stage label in the transaction progress modal. Each observable phase boundary (`syncing`, `sending`, `confirming`, `delivering`) writes a stage marker during tx processing, and the modal renders a stage-specific title + description instead of a single opaque "Generating Transaction" for the whole 3-8s spinner window. Send-type sub-label varies by tx type (claim / execute / send), and the batch subtitle surfaces a remaining-count when more than one tx is in flight. PSM/guardian-backed accounts also now surface their own phase boundaries (`creating-proposal`, `signing-proposal`, `submitting`, `registering-guardian`) so guardian-sign / submit / on-chain-confirm / guardian-re-register all render distinct labels instead of a single opaque spinner — switch-guardian in particular now walks the user through every step.
+* [FEATURE][all] Per-stage label in the transaction progress modal. Each observable phase boundary (`syncing`, `sending`, `confirming`, `delivering`) writes a stage marker during tx processing, and the modal renders a stage-specific title + description instead of a single opaque "Generating Transaction" for the whole 3-8s spinner window. Send-type sub-label varies by tx type (claim / execute / send), and the batch subtitle surfaces a remaining-count when more than one tx is in flight.
 
 ---
 
@@ -81,7 +80,6 @@
 * [FIX][all] Removed stale "Download Generated Files" button and output notes storage. The `useExportNotes` hook, `registerOutputNote`, and related storage key were unused dead code. Simplifies the transaction completion screen and its auto-close logic. (#160)
 * [FIX][all] Removed the "Upload File" button and drag-and-drop note import from the Receive page. The freed space is now used by the notes list, making it taller. (#161)
 * [FEATURE][all] Complete UI revamp across the wallet.
-* [FEATURE][all] Integrate gaurdian for private state management for the wallet.
 
 ---
 
diff --git a/public/_locales/en/en.json b/public/_locales/en/en.json
index 822546919..6b5de88ca 100644
--- a/public/_locales/en/en.json
+++ b/public/_locales/en/en.json
@@ -371,7 +371,7 @@
   "currentGuardianEndpoint": "Current Guardian",
   "newGuardianEndpoint": "New Guardian Endpoint",
   "switchGuardian": "Switch Guardian",
-  "switchGuardianDescription": "Point your PSM account at a new guardian endpoint. The switch is signed as an on-chain proposal.",
+  "switchGuardianDescription": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal.",
   "switchingGuardian": "Switching guardian...",
   "guardianSwitched": "Guardian switched successfully.",
   "guardianEndpointUnchanged": "That's already your current guardian.",
diff --git a/src/app/pages/Explore.tsx b/src/app/pages/Explore.tsx
index 5b61c90a7..4cb6ee970 100644
--- a/src/app/pages/Explore.tsx
+++ b/src/app/pages/Explore.tsx
@@ -14,6 +14,7 @@ import {
 } from 'lib/miden/activity';
 import { setFaucetIdSetting, useAccount, useMidenContext } from 'lib/miden/front';
 import { useClaimableNotes } from 'lib/miden/front/claimable-notes';
+import { zustandProvider } from 'lib/miden/front/guardian-sync';
 import { MIDEN_NETWORK_NAME, MIDEN_FAUCET_ENDPOINTS } from 'lib/miden-chain/constants';
 import { isExtension } from 'lib/platform';
 import { isAutoConsumeEnabled, isDelegateProofEnabled } from 'lib/settings/helpers';
@@ -73,7 +74,7 @@ const Explore: FC = () => {
       requestSWTransactionProcessing();
     } else {
       // Process auto-consume transactions silently in the background (no modal/tab)
-      startBackgroundTransactionProcessing(signTransaction);
+      startBackgroundTransactionProcessing(signTransaction, false, zustandProvider);
     }
   }, [
     midenNotes,
diff --git a/src/app/pages/ForgotPassword/ForgotPassword.tsx b/src/app/pages/ForgotPassword/ForgotPassword.tsx
index fc9ea7423..0596bee50 100644
--- a/src/app/pages/ForgotPassword/ForgotPassword.tsx
+++ b/src/app/pages/ForgotPassword/ForgotPassword.tsx
@@ -31,7 +31,7 @@ const ForgotPassword: FC = () => {
       if (!importedWithFile) {
         try {
           await registerWallet(
-            WalletType.Psm,
+            WalletType.Guardian,
             password,
             seedPhraseFormatted,
             onboardingType === OnboardingType.Import // might be able to leverage ownMnemonic to determine whther to attempt imports in general
diff --git a/src/app/pages/SelectAccount.tsx b/src/app/pages/SelectAccount.tsx
index b6553fef4..41398b188 100644
--- a/src/app/pages/SelectAccount.tsx
+++ b/src/app/pages/SelectAccount.tsx
@@ -9,7 +9,9 @@ import { Button, ButtonVariant } from 'components/Button';
 import { NavigationHeader } from 'components/NavigationHeader';
 import { useAccount, useAllAccounts, useMidenContext } from 'lib/miden/front';
 import { isMobile } from 'lib/platform';
+import { Badge } from 'lib/ui/badge';
 import { navigate, useLocation } from 'lib/woozie';
+import { WalletType } from 'screens/onboarding/types';
 import { truncateAddress } from 'utils/string';
 
 const SelectAccount: FC = () => {
@@ -69,7 +71,10 @@ const SelectAccount: FC = () => {
                       <Name className="font-semibold leading-none text-xl">{acc.name}</Name>
                       <div className="flex w-full items-start">
                         <span>
-                          {acc.isPublic ? t('public') : t('private')} • {truncateAddress(acc.publicKey, true, 8)}
+                          {acc.isPublic ? t('public') : t('private')} • {truncateAddress(acc.publicKey, true, 8)} •{' '}
+                          {acc.type === WalletType.Guardian ? (
+                            <span className="bg-primary-500 text-xs rounded-xl p-0.5 px-1">Guardian Protected</span>
+                          ) : null}
                         </span>
                       </div>
                     </div>
diff --git a/src/app/pages/Settings.tsx b/src/app/pages/Settings.tsx
index a256df620..f8c01fc54 100644
--- a/src/app/pages/Settings.tsx
+++ b/src/app/pages/Settings.tsx
@@ -95,7 +95,7 @@ type Tab = {
   linksOutsideOfWallet?: boolean;
   isDrawer?: boolean;
   onClick?: () => void;
-  psmOnly?: boolean;
+  guardianOnly?: boolean;
 };
 
 type TabGroup = {
@@ -158,7 +158,7 @@ const TAB_GROUPS: TabGroup[] = [
         Icon: SettingsIcon,
         Component: GuardianSettings,
         isDrawer: true,
-        psmOnly: true
+        guardianOnly: true
       }
     ]
   },
@@ -231,22 +231,22 @@ const HIDDEN_TABS: Tab[] = [
 const Settings: FC<SettingsProps> = ({ tabSlug }) => {
   const { t } = useTranslation();
   const currentAccountType = useWalletStore(s => s.currentAccount?.type);
-  const isPsmAccount = currentAccountType === WalletType.Psm;
+  const isGuardianAccount = currentAccountType === WalletType.Guardian;
 
-  // Filter tabs that are gated to PSM accounts. Non-PSM users don't see
+  // Filter tabs that are gated to Guardian accounts. Non-Guardian users don't see
   // the Guardian Settings entry at all (menu, drawer, or routable page).
   const tabGroups = useMemo(
     () =>
       TAB_GROUPS.map(group => ({
         ...group,
-        tabs: group.tabs.filter(tab => !tab.psmOnly || isPsmAccount)
+        tabs: group.tabs.filter(tab => !tab.guardianOnly || isGuardianAccount)
       })).filter(group => group.tabs.length > 0),
-    [isPsmAccount]
+    [isGuardianAccount]
   );
 
   const allTabs = useMemo(
-    () => [...tabGroups.flatMap(g => g.tabs), ...HIDDEN_TABS.filter(tab => !tab.psmOnly || isPsmAccount)],
-    [tabGroups, isPsmAccount]
+    () => [...tabGroups.flatMap(g => g.tabs), ...HIDDEN_TABS.filter(tab => !tab.guardianOnly || isGuardianAccount)],
+    [tabGroups, isGuardianAccount]
   );
 
   const drawerTabs = useMemo(() => tabGroups.flatMap(g => g.tabs).filter(t => t.isDrawer), [tabGroups]);
diff --git a/src/app/pages/Welcome.tsx b/src/app/pages/Welcome.tsx
index b5b889587..e118a850b 100644
--- a/src/app/pages/Welcome.tsx
+++ b/src/app/pages/Welcome.tsx
@@ -9,7 +9,7 @@ import { useMidenContext } from 'lib/miden/front';
 import { putToStorage } from 'lib/miden/front/storage';
 import { useMobileBackHandler } from 'lib/mobile/useMobileBackHandler';
 import { isDesktop, isMobile } from 'lib/platform';
-import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
+import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { WalletStatus, WalletAccount } from 'lib/shared/types';
 import { useWalletStore } from 'lib/store';
 import { fetchStateFromBackend } from 'lib/store/hooks/useIntercomSync';
@@ -73,7 +73,7 @@ const Welcome: FC = () => {
   const [onboardingType, setOnboardingType] = useState<OnboardingType | null>(null);
   const [importType, setImportType] = useState<ImportType | null>(null);
   const [password, setPassword] = useState<string | null>(null);
-  const [walletType, setWalletType] = useState<WalletType>(WalletType.Psm);
+  const [walletType, setWalletType] = useState<WalletType>(WalletType.Guardian);
   const [importedWithFile, setImportedWithFile] = useState(false);
   const [isLoading, setIsLoading] = useState(false);
   const [useBiometric, setUseBiometric] = useState(true);
@@ -241,9 +241,9 @@ const Welcome: FC = () => {
         break;
       case 'import-select-recovery-method':
         setWalletType(action.payload.walletType);
-        if (action.payload.walletType === WalletType.Psm && action.payload.guardianEndpoint) {
+        if (action.payload.walletType === WalletType.Guardian && action.payload.guardianEndpoint) {
           console.log('Putting guardian endpoint to storage:', action.payload.guardianEndpoint);
-          await putToStorage(PSM_URL_STORAGE_KEY, action.payload.guardianEndpoint);
+          await putToStorage(GUARDIAN_URL_STORAGE_KEY, action.payload.guardianEndpoint);
         }
         setGuardianLookupError(false);
         navigate('/#confirmation');
@@ -262,7 +262,7 @@ const Welcome: FC = () => {
         } catch (error) {
           console.error('[Welcome] Confirmation flow failed:', error);
           setIsLoading(false);
-          if (onboardingType === OnboardingType.Import && walletType === WalletType.Psm) {
+          if (onboardingType === OnboardingType.Import && walletType === WalletType.Guardian) {
             setGuardianLookupError(true);
             navigate('/#import-select-recovery-method');
           } else if (password === '__HARDWARE_ONLY__') {
diff --git a/src/app/templates/GuardianSettings.tsx b/src/app/templates/GuardianSettings.tsx
index 8969c6159..97e9c3273 100644
--- a/src/app/templates/GuardianSettings.tsx
+++ b/src/app/templates/GuardianSettings.tsx
@@ -5,15 +5,16 @@ import { useTranslation } from 'react-i18next';
 
 import FormField from 'app/atoms/FormField';
 import FormSubmitButton from 'app/atoms/FormSubmitButton';
-import { DEFAULT_PSM_ENDPOINT } from 'lib/miden-chain/constants';
+import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
 import {
   initiateSwitchGuardianTransaction,
   requestSWTransactionProcessing,
   waitForTransactionCompletion
 } from 'lib/miden/activity';
 import { fetchFromStorage, onStorageChanged } from 'lib/miden/front';
+import { zustandProvider } from 'lib/miden/front/guardian-sync';
 import { isExtension } from 'lib/platform';
-import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
+import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { isDelegateProofEnabled } from 'lib/settings/helpers';
 import { useWalletStore } from 'lib/store';
 
@@ -59,7 +60,8 @@ const GuardianSettings: FC<Props> = ({ onClose }) => {
         const txId = await initiateSwitchGuardianTransaction(
           currentAccount.publicKey,
           trimmed,
-          isDelegateProofEnabled()
+          isDelegateProofEnabled(),
+          zustandProvider
         );
         useWalletStore.getState().openTransactionModal();
         if (isExtension()) requestSWTransactionProcessing();
@@ -144,14 +146,14 @@ function useCurrentGuardianEndpoint(): { endpoint: string; refresh: () => void }
 
   useEffect(() => {
     let cancelled = false;
-    fetchFromStorage<string>(PSM_URL_STORAGE_KEY)
+    fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)
       .then(stored => {
         if (cancelled) return;
-        setEndpoint(stored || DEFAULT_PSM_ENDPOINT);
+        setEndpoint(stored || DEFAULT_GUARDIAN_ENDPOINT);
       })
       .catch(() => {
         if (cancelled) return;
-        setEndpoint(DEFAULT_PSM_ENDPOINT);
+        setEndpoint(DEFAULT_GUARDIAN_ENDPOINT);
       });
     return () => {
       cancelled = true;
@@ -162,8 +164,8 @@ function useCurrentGuardianEndpoint(): { endpoint: string; refresh: () => void }
   // is a no-op and the explicit refresh() call after switch handles the update.
   useEffect(
     () =>
-      onStorageChanged<string>(PSM_URL_STORAGE_KEY, next => {
-        setEndpoint(next || DEFAULT_PSM_ENDPOINT);
+      onStorageChanged<string>(GUARDIAN_URL_STORAGE_KEY, next => {
+        setEndpoint(next || DEFAULT_GUARDIAN_ENDPOINT);
       }),
     []
   );
diff --git a/src/components/TransactionProgressModal.tsx b/src/components/TransactionProgressModal.tsx
index b7d6f6a2f..f455ac6e8 100644
--- a/src/components/TransactionProgressModal.tsx
+++ b/src/components/TransactionProgressModal.tsx
@@ -14,6 +14,7 @@ import {
 } from 'lib/miden/activity';
 import { ITransactionStatus } from 'lib/miden/db/types';
 import { useMidenContext } from 'lib/miden/front';
+import { zustandProvider } from 'lib/miden/front/guardian-sync';
 import { getExplorerTxUrl } from 'lib/miden-chain/constants';
 import { openExternalUrl } from 'lib/mobile/external-browser';
 import { useHideNavbarWhileOpen } from 'lib/mobile/useHideNavbarWhileOpen';
@@ -58,7 +59,7 @@ export const TransactionProgressModal: FC = () => {
       if (isExtension()) {
         requestSWTransactionProcessing();
       } else {
-        startBackgroundTransactionProcessing(signTransaction);
+        startBackgroundTransactionProcessing(signTransaction, false, zustandProvider);
       }
     };
 
@@ -101,7 +102,7 @@ export const TransactionProgressModal: FC = () => {
     }
 
     try {
-      const success = await dbTransactionsLoop(signTransaction);
+      const success = await dbTransactionsLoop(signTransaction, false, zustandProvider);
       if (success === false) {
         // A transaction failed, but check if there are more to process
         const hasMore = await hasQueuedTransactions();
diff --git a/src/lib/miden-chain/constants.ts b/src/lib/miden-chain/constants.ts
index 69e82333d..37512b4e5 100644
--- a/src/lib/miden-chain/constants.ts
+++ b/src/lib/miden-chain/constants.ts
@@ -89,7 +89,7 @@ export const MIDEN_NETWORKS: MidenNetwork[] = [
   { rpcBaseURL: 'http://localhost:57291', id: MIDEN_NETWORK_NAME.LOCALNET, name: 'Localnet', autoSync: true }
 ];
 
-export const DEFAULT_PSM_ENDPOINT = 'https://guardian-stg.openzeppelin.com';
+export const DEFAULT_GUARDIAN_ENDPOINT = 'https://guardian-stg.openzeppelin.com';
 
 /**
  * Returns the SDK NetworkId for the current DEFAULT_NETWORK.
diff --git a/src/lib/miden/activity/transactions.extended.test.ts b/src/lib/miden/activity/transactions.extended.test.ts
index 288c22e32..b1bd31aa5 100644
--- a/src/lib/miden/activity/transactions.extended.test.ts
+++ b/src/lib/miden/activity/transactions.extended.test.ts
@@ -313,16 +313,22 @@ describe('verifyStuckTransactionsFromNode', () => {
   });
 });
 
+const mockGuardianProvider = {
+  getAccounts: jest.fn(async () => []),
+  getPublicKeyForCommitment: jest.fn(async () => ''),
+  signWord: jest.fn(async () => '')
+};
+
 describe('safeGenerateTransactionsLoop', () => {
   it('returns true when there are no queued transactions', async () => {
     const sign = jest.fn();
-    const result = await safeGenerateTransactionsLoop(sign);
+    const result = await safeGenerateTransactionsLoop(sign, false, mockGuardianProvider);
     expect(result).toBe(true);
   });
 
   it('returns undefined when navigator.locks.request reports the lock is unavailable', async () => {
     installNavigatorLocksMock(null); // null lock means "not available"
-    const result = await safeGenerateTransactionsLoop(jest.fn());
+    const result = await safeGenerateTransactionsLoop(jest.fn(), false, mockGuardianProvider);
     expect(result).toBeUndefined();
   });
 });
@@ -331,7 +337,7 @@ describe('startBackgroundTransactionProcessing', () => {
   it('schedules a background loop and returns synchronously', () => {
     // We just verify it returns without throwing — the actual background work
     // happens in a fire-and-forget Promise we don't await.
-    expect(() => startBackgroundTransactionProcessing(jest.fn())).not.toThrow();
+    expect(() => startBackgroundTransactionProcessing(jest.fn(), false, mockGuardianProvider)).not.toThrow();
   });
 });
 
diff --git a/src/lib/miden/activity/transactions.test.ts b/src/lib/miden/activity/transactions.test.ts
index a057fe479..f7647440e 100644
--- a/src/lib/miden/activity/transactions.test.ts
+++ b/src/lib/miden/activity/transactions.test.ts
@@ -605,7 +605,11 @@ describe('transactions utilities', () => {
       } as any;
 
       try {
-        await generateTransaction(transaction, signCallback);
+        await generateTransaction(transaction, signCallback, false, {
+          getAccounts: async () => [],
+          getPublicKeyForCommitment: async () => '',
+          signWord: async () => ''
+        });
       } catch {
         // Expected to fail on TransactionResult.deserialize — that's fine
       }
diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index 6f579d600..f52324df0 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -3,15 +3,15 @@ import { type Proposal } from '@openzeppelin/miden-multisig-client';
 import { liveQuery } from 'dexie';
 
 import {
-  clearPsmServiceFor,
+  clearGuardianServiceFor,
   getOrCreateMultisigService,
-  isPsmAccount,
-  type PsmAccountProvider
-} from 'lib/miden/front/psm-manager';
-import { MultisigService } from 'lib/miden/psm';
+  isGuardianAccount,
+  type GuardianAccountProvider
+} from 'lib/miden/front/guardian-manager';
+import { MultisigService } from 'lib/miden/guardian';
 import * as Repo from 'lib/miden/repo';
 import { isExtension, isMobile } from 'lib/platform';
-import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
+import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { u8ToB64 } from 'lib/shared/helpers';
 import { WalletMessageType } from 'lib/shared/types';
 import { getIntercom } from 'lib/store';
@@ -292,18 +292,18 @@ export const initiateSendTransaction = async (
 };
 
 /**
- * Queue a switch-guardian transaction for a PSM account. The local
- * `PSM_URL_STORAGE_KEY` is NOT updated here — it's written only after
+ * Queue a switch-guardian transaction for a Guardian account. The local
+ * `GUARDIAN_URL_STORAGE_KEY` is NOT updated here — it's written only after
  * the on-chain proposal lands, in `completeSwitchGuardianTransaction`.
  */
 export const initiateSwitchGuardianTransaction = async (
   accountId: string,
   newGuardianEndpoint: string,
-  delegateTransaction?: boolean,
-  psmProvider?: PsmAccountProvider
+  delegateTransaction: boolean | undefined,
+  guardianProvider: GuardianAccountProvider
 ): Promise<string> => {
-  if (!(await isPsmAccount(accountId, psmProvider))) {
-    throw new Error('Switch guardian is only supported for PSM accounts');
+  if (!(await isGuardianAccount(accountId, guardianProvider))) {
+    throw new Error('Switch guardian is only supported for Guardian accounts');
   }
   const dbTransaction = new SwitchGuardianTransaction(accountId, newGuardianEndpoint, delegateTransaction);
   await Repo.transactions.add(dbTransaction);
@@ -327,8 +327,8 @@ export const completeSwitchGuardianTransaction = async (
     await setTransactionStage(tx.id, 'registering-guardian');
     await multisigService.finalizeGuardianSwitch(newGuardianEndpoint);
 
-    await putToStorage(PSM_URL_STORAGE_KEY, newGuardianEndpoint);
-    clearPsmServiceFor(tx.accountId);
+    await putToStorage(GUARDIAN_URL_STORAGE_KEY, newGuardianEndpoint);
+    clearGuardianServiceFor(tx.accountId);
 
     await updateTransactionStatus(tx.id, ITransactionStatus.Completed, {
       displayMessage: 'Guardian switched',
@@ -678,7 +678,7 @@ export const generateTransaction = async (
   transaction: Transaction,
   signCallback: (publicKey: string, signingInputs: string) => Promise<Uint8Array>,
   _useWorker: boolean = true,
-  psmProvider?: PsmAccountProvider
+  guardianProvider: GuardianAccountProvider
 ) => {
   // Sync state first to ensure we have latest account state
   // Separate lock acquisition to avoid holding lock during network call
@@ -701,10 +701,10 @@ export const generateTransaction = async (
     type: transaction.type,
     accountId: transaction.accountId
   });
-  // Route PSM accounts through PSM service
-  if (await isPsmAccount(transaction.accountId, psmProvider)) {
+  // Route Guardian accounts through Guardian service
+  if (await isGuardianAccount(transaction.accountId, guardianProvider)) {
     try {
-      await generatePsmTransaction(transaction, signCallback, psmProvider);
+      await generateGuardianTransaction(transaction, signCallback, guardianProvider);
     } catch (error) {
       await cancelTransaction(transaction, error);
     }
@@ -752,21 +752,21 @@ export const generateTransaction = async (
 };
 
 /**
- * Generate a transaction for a PSM account using the MultisigService.
+ * Generate a transaction for a Guardian account using the MultisigService.
  * Routes the transaction through MultisigService proposal methods.
  */
-const generatePsmTransaction = async (
+const generateGuardianTransaction = async (
   transaction: ITransaction,
   signCallback: (publicKey: string, signingInputs: string) => Promise<Uint8Array>,
-  psmProvider?: PsmAccountProvider
+  guardianProvider: GuardianAccountProvider
 ): Promise<void> => {
-  console.log('Generating PSM transaction');
+  console.log('Generating Guardian transaction');
   // Set the stage eagerly — `getOrCreateMultisigService` and the subsequent
   // `createXxxProposal` call can both hit the guardian over the network,
   // so surfacing "Creating proposal" immediately is more honest than
   // leaving the label stuck on "Sending transaction".
   await setTransactionStage(transaction.id, 'creating-proposal');
-  const multisigService = await getOrCreateMultisigService(transaction.accountId, psmProvider);
+  const multisigService = await getOrCreateMultisigService(transaction.accountId, guardianProvider);
 
   let proposalResult: Proposal;
 
@@ -805,7 +805,7 @@ const generatePsmTransaction = async (
     // break;
     // }
     default: {
-      throw new Error(`Unsupported transaction type for PSM account: ${transaction.type}`);
+      throw new Error(`Unsupported transaction type for Guardian account: ${transaction.type}`);
     }
   }
 
@@ -893,7 +893,7 @@ export const getTransactionById = async (id: string) => {
 export const generateTransactionsLoop = async (
   signCallback: (publicKey: string, signingInputs: string) => Promise<Uint8Array>,
   useWorker: boolean = true,
-  psmProvider?: PsmAccountProvider
+  guardianProvider: GuardianAccountProvider
 ): Promise<boolean | void> => {
   await cancelStuckTransactions();
   await cancelStaleQueuedTransactions();
@@ -920,7 +920,7 @@ export const generateTransactionsLoop = async (
 
   // Call safely to cancel transaction and unlock records if something goes wrong
   try {
-    await generateTransaction(nextTransaction, signCallback, useWorker, psmProvider);
+    await generateTransaction(nextTransaction, signCallback, useWorker, guardianProvider);
     return true;
   } catch (e) {
     logger.warning('Failed to generate transaction', e);
@@ -934,13 +934,13 @@ export const generateTransactionsLoop = async (
 export const safeGenerateTransactionsLoop = async (
   signCallback: (publicKey: string, signingInputs: string) => Promise<Uint8Array>,
   useWorker: boolean = true,
-  psmProvider?: PsmAccountProvider
+  guardianProvider: GuardianAccountProvider
 ) => {
   return navigator.locks
     .request(`generate-transactions-loop`, { ifAvailable: true }, async lock => {
       if (!lock) return;
 
-      const result = await generateTransactionsLoop(signCallback, useWorker, psmProvider);
+      const result = await generateTransactionsLoop(signCallback, useWorker, guardianProvider);
       if (result === false) {
         return false;
       }
@@ -963,7 +963,7 @@ export const safeGenerateTransactionsLoop = async (
 export const startBackgroundTransactionProcessing = (
   signCallback: (publicKey: string, signingInputs: string) => Promise<Uint8Array>,
   useWorker: boolean = false,
-  psmProvider?: PsmAccountProvider
+  guardianProvider: GuardianAccountProvider
 ) => {
   // Process transactions in a loop until none are left
   const processLoop = async () => {
@@ -973,7 +973,7 @@ export const startBackgroundTransactionProcessing = (
 
     while (hasMore && attempts < maxAttempts) {
       attempts++;
-      await safeGenerateTransactionsLoop(signCallback, useWorker, psmProvider);
+      await safeGenerateTransactionsLoop(signCallback, useWorker, guardianProvider);
 
       // Check if there are more transactions to process
       const remaining = await getAllUncompletedTransactions();
diff --git a/src/lib/miden/back/actions.test.ts b/src/lib/miden/back/actions.test.ts
index 52f25d7a5..17dda7ead 100644
--- a/src/lib/miden/back/actions.test.ts
+++ b/src/lib/miden/back/actions.test.ts
@@ -259,9 +259,9 @@ describe('actions', () => {
       };
       Vault.spawn.mockResolvedValueOnce(mockVaultInstance);
 
-      await registerNewWallet(WalletType.Psm, 'password123', 'mnemonic words', true);
+      await registerNewWallet(WalletType.Guardian, 'password123', 'mnemonic words', true);
 
-      expect(Vault.spawn).toHaveBeenCalledWith(WalletType.Psm, 'password123', 'mnemonic words', true);
+      expect(Vault.spawn).toHaveBeenCalledWith(WalletType.Guardian, 'password123', 'mnemonic words', true);
       expect(mockVaultInstance.fetchAccounts).toHaveBeenCalled();
       expect(mockUnlocked).toHaveBeenCalled();
     });
@@ -278,9 +278,9 @@ describe('actions', () => {
       };
       Vault.spawn.mockResolvedValueOnce(mockVaultInstance);
 
-      await registerNewWallet(WalletType.Psm, undefined, 'mnemonic words', true);
+      await registerNewWallet(WalletType.Guardian, undefined, 'mnemonic words', true);
 
-      expect(Vault.spawn).toHaveBeenCalledWith(WalletType.Psm, '', 'mnemonic words', true);
+      expect(Vault.spawn).toHaveBeenCalledWith(WalletType.Guardian, '', 'mnemonic words', true);
     });
   });
 
diff --git a/src/lib/miden/back/transaction-processor.ts b/src/lib/miden/back/transaction-processor.ts
index 349530abf..799b787b3 100644
--- a/src/lib/miden/back/transaction-processor.ts
+++ b/src/lib/miden/back/transaction-processor.ts
@@ -8,7 +8,7 @@ import {
   hasQueuedTransactions,
   safeGenerateTransactionsLoop
 } from 'lib/miden/activity/transactions';
-import { type PsmAccountProvider } from 'lib/miden/front/psm-manager';
+import { type GuardianAccountProvider } from 'lib/miden/front/guardian-manager';
 import { WalletMessageType } from 'lib/shared/types';
 
 import { getIntercom } from './defaults';
@@ -50,10 +50,10 @@ async function swSignCallback(publicKey: string, signingInputs: string): Promise
 }
 
 /**
- * Vault-backed PSM account provider for service worker context.
+ * Vault-backed Guardian account provider for service worker context.
  * Uses the Vault directly instead of the Zustand store.
  */
-const vaultPsmProvider: PsmAccountProvider = {
+const vaultGuardianProvider: GuardianAccountProvider = {
   getAccounts: async () => {
     return withUnlocked(async ({ vault }) => {
       return await vault.fetchAccounts();
@@ -118,7 +118,7 @@ export async function startTransactionProcessing(): Promise<void> {
     while (attempts < maxAttempts) {
       attempts++;
       console.log('[TransactionProcessor] Loop attempt', attempts);
-      const result = await safeGenerateTransactionsLoop(swSignCallback, false, vaultPsmProvider);
+      const result = await safeGenerateTransactionsLoop(swSignCallback, false, vaultGuardianProvider);
       console.log('[TransactionProcessor] Loop result:', result);
 
       // Broadcast progress so popup UI can update
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index aa14253c2..796e21664 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -15,7 +15,7 @@ import {
 import * as Passworder from 'lib/miden/passworder';
 import { clearStorage } from 'lib/miden/reset';
 import { isDesktop, isMobile } from 'lib/platform';
-import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
+import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { b64ToU8, u8ToB64 } from 'lib/shared/helpers';
 import { WalletAccount, WalletSettings } from 'lib/shared/types';
 import { WalletType } from 'screens/onboarding/types';
@@ -221,16 +221,16 @@ export class Vault {
 
       // Clear storage before any inserts to avoid wiping newly inserted keys later.
       // clearStorage wipes the entire platform key-value store, which would also
-      // erase the guardian URL that the onboarding flow just wrote for a PSM import.
+      // erase the guardian URL that the onboarding flow just wrote for a Guardian import.
       // Snapshot it and restore after the wipe so downstream reads
-      // (createPsmAccount / importAccountFromPsm) see the caller's choice.
+      // (createGuardianAccount / importAccountFromGuardian) see the caller's choice.
       // TODO: thread guardianEndpoint as an explicit arg through registerWallet → spawn
       // instead of round-tripping through storage.
       console.log('[Vault.spawn] Step 3: clearing storage...');
-      const preservedPsmUrl = await fetchFromStorage<string>(PSM_URL_STORAGE_KEY);
+      const preservedGuardianUrl = await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY);
       await clearStorage();
-      if (preservedPsmUrl) {
-        await putToStorage(PSM_URL_STORAGE_KEY, preservedPsmUrl);
+      if (preservedGuardianUrl) {
+        await putToStorage(GUARDIAN_URL_STORAGE_KEY, preservedGuardianUrl);
       }
       console.log('[Vault.spawn] Step 4: storage cleared');
 
@@ -260,7 +260,7 @@ export class Vault {
       const hdAccIndex = 0;
       const walletSeed = deriveClientSeed(walletType, mnemonic, 0);
 
-      // Helper to sign words using the vault key (needed for PSM import)
+      // Helper to sign words using the vault key (needed for Guardian import)
       const signWordFn = async (pk: string, wordHex: string) => {
         const word = Word.fromHex(wordHex);
         const secretKey = await fetchAndDecryptOneWithLegacyFallBack<string>(accAuthSecretKeyStrgKey(pk), vaultKey);
@@ -269,7 +269,7 @@ export class Vault {
         return `0x${Buffer.from(signature.serialize().slice(1)).toString('hex')}`;
       };
 
-      // Helper to get public key from commitment (needed for PSM import)
+      // Helper to get public key from commitment (needed for Guardian import)
       const getPublicKeyForCommitment = async (pkc: string) => {
         const sk = await fetchAndDecryptOneWithLegacyFallBack<string>(accAuthSecretKeyStrgKey(pkc), vaultKey);
         const wasmSecretKey = AuthSecretKey.deserialize(new Uint8Array(Buffer.from(sk, 'hex')));
@@ -287,11 +287,11 @@ export class Vault {
             console.log('[Vault.spawn] Step 8a: importing wallet from seed...');
             return await midenClient.importAccountBySeed(walletType, walletSeed, signWordFn, getPublicKeyForCommitment);
           } catch (e) {
-            // PSM imports must not silently fall back: a failure here means the guardian lookup
+            // Guardian imports must not silently fall back: a failure here means the guardian lookup
             // failed, and creating a fresh local account would leave the user with the wrong
             // balance under their seed. Propagate so the UI can let them fix the URL or switch
             // to public-account import.
-            if (walletType === WalletType.Psm) {
+            if (walletType === WalletType.Guardian) {
               throw e;
             }
             console.error('Failed to import wallet from seed in spawn, creating new wallet instead', e);
@@ -690,7 +690,7 @@ function getMainDerivationPath(walletType: WalletType, accIndex: number) {
     walletTypeIndex = 0;
   } else if (walletType === WalletType.OffChain) {
     walletTypeIndex = 1;
-  } else if (walletType === WalletType.Psm) {
+  } else if (walletType === WalletType.Guardian) {
     walletTypeIndex = 2;
   } else {
     throw new Error('Invalid wallet type');
diff --git a/src/lib/miden/db/types.ts b/src/lib/miden/db/types.ts
index 2eeb8c13a..783f20803 100644
--- a/src/lib/miden/db/types.ts
+++ b/src/lib/miden/db/types.ts
@@ -23,10 +23,10 @@ export type ITransactionType = 'send' | 'consume' | 'execute' | 'switch-guardian
  * label so users see what the wallet is actually doing during the 3-8s
  * spinner window. Not all stages apply to all tx types:
  *   - syncing              : all types, before `syncState()`
- *   - sending              : non-PSM types, during the SDK execute→prove→submit→apply
- *   - creating-proposal    : PSM only, while building the multisig proposal
- *   - signing-proposal     : PSM only, while the guardian signs the proposal
- *   - submitting           : PSM only, while the signed tx is submitted to the network
+ *   - sending              : non-Guardian types, during the SDK execute→prove→submit→apply
+ *   - creating-proposal    : Guardian only, while building the multisig proposal
+ *   - signing-proposal     : Guardian only, while the guardian signs the proposal
+ *   - submitting           : Guardian only, while the signed tx is submitted to the network
  *   - confirming           : send-private + switch-guardian, during `waitForTransactionCommit`
  *   - registering-guardian : switch-guardian only, during post-commit guardian re-registration
  *   - delivering           : send-private only, during `sendPrivateNote`
diff --git a/src/lib/miden/front/guardian-manager.ts b/src/lib/miden/front/guardian-manager.ts
new file mode 100644
index 000000000..97177d41f
--- /dev/null
+++ b/src/lib/miden/front/guardian-manager.ts
@@ -0,0 +1,102 @@
+import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
+import { MultisigService } from 'lib/miden/guardian';
+import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
+import { WalletAccount } from 'lib/shared/types';
+import { WalletType } from 'screens/onboarding/types';
+
+import { getSignerDetailsFromAccount } from '../guardian/account';
+import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
+import { fetchFromStorage } from './storage';
+
+// Cache MultisigService instances to avoid re-initialization on every sync cycle
+const guardianServiceCache = new Map<string, MultisigService>();
+
+/**
+ * Callbacks for resolving account data.
+ * Allows guardian-manager to work in both frontend (Zustand) and service worker (Vault) contexts.
+ *
+ * NOTE: This module must stay SW-safe — don't import `lib/store` here.
+ * The Zustand-backed default provider lives in `./guardian-sync.ts` (frontend-only).
+ */
+export interface GuardianAccountProvider {
+  getAccounts: () => Promise<WalletAccount[]>;
+  getPublicKeyForCommitment: (commitment: string) => Promise<string>;
+  signWord: (publicKey: string, wordHex: string) => Promise<string>;
+}
+
+/**
+ * Create a MultisigService for the given Guardian account.
+ * Returns a cached instance if available.
+ */
+export async function getOrCreateMultisigService(
+  accountPublicKey: string,
+  provider: GuardianAccountProvider
+): Promise<MultisigService> {
+  console.log(`[Guardian Manager] Getting/creating MultisigService for account: ${accountPublicKey}`);
+  // Return cached instance if its endpoint still matches storage. In the
+  // extension build, `clearGuardianServiceFor` from the SW realm doesn't reach
+  // the frontend's own copy of this Map, so a guardian switch would leave
+  // the popup syncing against the old guardian indefinitely. Re-check
+  // GUARDIAN_URL_STORAGE_KEY here and evict on drift.
+  const cached = guardianServiceCache.get(accountPublicKey);
+  if (cached) {
+    const currentEndpoint = (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
+    if (cached.guardianEndpoint === currentEndpoint) return cached;
+    guardianServiceCache.delete(accountPublicKey);
+  }
+
+  // Verify this is a Guardian account
+  const accounts = await provider.getAccounts();
+  const account = accounts.find(acc => acc.publicKey === accountPublicKey);
+  if (!account || account.type !== WalletType.Guardian) {
+    throw new Error('Account is not a Guardian account');
+  }
+
+  // Get the Account object from Miden client
+  const { sdkAccount } = await withWasmClientLock(async () => {
+    const midenClient = await getMidenClient();
+    const sdkAccount = await midenClient.getAccount(accountPublicKey);
+    return { sdkAccount };
+  });
+
+  if (!sdkAccount) {
+    throw new Error('Account not found in local storage');
+  }
+
+  const { commitment, publicKey } = await getSignerDetailsFromAccount(sdkAccount, provider.getPublicKeyForCommitment);
+  console.log('[Guardian Manager] Retrieved signer details - commitment:', commitment, 'publicKey:', publicKey);
+  // Initialize MultisigService with the account, public key, commitment, and signWord function
+  const service = await MultisigService.init(sdkAccount, `0x${publicKey}`, `0x${commitment}`, provider.signWord);
+
+  // Cache for future use
+  guardianServiceCache.set(accountPublicKey, service);
+
+  return service;
+}
+
+/**
+ * Check if an account is a Guardian account.
+ */
+export async function isGuardianAccount(accountPublicKey: string, provider: GuardianAccountProvider): Promise<boolean> {
+  console.log(`[Guardian Manager] Checking if account is Guardian: ${accountPublicKey}`);
+  const accounts = await provider.getAccounts();
+  console.log('[Guardian Manager] Retrieved accounts from provider:', accounts);
+  const account = accounts.find(acc => acc.publicKey === accountPublicKey);
+  return account?.type === WalletType.Guardian;
+}
+
+/**
+ * Clear the Guardian service cache. Call on logout/lock.
+ */
+export function clearGuardianCache(): void {
+  guardianServiceCache.clear();
+}
+
+/**
+ * Drop a single account's cached MultisigService so the next access
+ * reinitializes it — used after a guardian switch where the cached
+ * instance still points at the old endpoint.
+ */
+export function clearGuardianServiceFor(accountPublicKey: string): void {
+  guardianServiceCache.delete(accountPublicKey);
+}
diff --git a/src/lib/miden/front/guardian-sync.ts b/src/lib/miden/front/guardian-sync.ts
new file mode 100644
index 000000000..dd1814939
--- /dev/null
+++ b/src/lib/miden/front/guardian-sync.ts
@@ -0,0 +1,36 @@
+import { useWalletStore } from 'lib/store';
+import { WalletType } from 'screens/onboarding/types';
+
+import { getOrCreateMultisigService, type GuardianAccountProvider } from './guardian-manager';
+
+/**
+ * Default GuardianAccountProvider backed by the Zustand store. Frontend-only —
+ * the SW has no access to Zustand and must supply its own provider instead.
+ * Kept in this file (not `guardian-manager.ts`) so backend code that imports the
+ * manager doesn't drag `lib/store` into the SW init chain.
+ */
+export const zustandProvider: GuardianAccountProvider = {
+  getAccounts: async () => useWalletStore.getState().accounts,
+  getPublicKeyForCommitment: (commitment: string) => useWalletStore.getState().getPublicKeyForCommitment(commitment),
+  signWord: (publicKey: string, wordHex: string) => useWalletStore.getState().signWord(publicKey, wordHex)
+};
+
+/**
+ * Sync Guardian state for all Guardian accounts. Called from AutoSync after chain
+ * state sync (frontend context only — uses the Zustand-backed provider).
+ */
+export async function syncGuardianAccounts(): Promise<void> {
+  const accounts = await zustandProvider.getAccounts();
+  const guardianAccounts = accounts.filter(acc => acc.type === WalletType.Guardian);
+
+  if (guardianAccounts.length === 0) return;
+
+  for (const account of guardianAccounts) {
+    try {
+      const service = await getOrCreateMultisigService(account.publicKey, zustandProvider);
+      await service.sync();
+    } catch (error) {
+      console.error(`[Guardian Sync] Error syncing Guardian account ${account.publicKey}:`, error);
+    }
+  }
+}
diff --git a/src/lib/miden/front/psm-manager.ts b/src/lib/miden/front/psm-manager.ts
deleted file mode 100644
index 21874b667..000000000
--- a/src/lib/miden/front/psm-manager.ts
+++ /dev/null
@@ -1,132 +0,0 @@
-import { DEFAULT_PSM_ENDPOINT } from 'lib/miden-chain/constants';
-import { MultisigService } from 'lib/miden/psm';
-import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
-import { WalletAccount } from 'lib/shared/types';
-import { useWalletStore } from 'lib/store';
-import { WalletType } from 'screens/onboarding/types';
-
-import { getSignerDetailsFromAccount } from '../psm/account';
-import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
-import { fetchFromStorage } from './storage';
-
-// Cache MultisigService instances to avoid re-initialization on every sync cycle
-const psmServiceCache = new Map<string, MultisigService>();
-
-/**
- * Callbacks for resolving account data.
- * Allows psm-manager to work in both frontend (Zustand) and service worker (Vault) contexts.
- */
-export interface PsmAccountProvider {
-  getAccounts: () => Promise<WalletAccount[]>;
-  getPublicKeyForCommitment: (commitment: string) => Promise<string>;
-  signWord: (publicKey: string, wordHex: string) => Promise<string>;
-}
-
-/**
- * Default provider that uses the Zustand store (frontend context).
- */
-const zustandProvider: PsmAccountProvider = {
-  getAccounts: async () => useWalletStore.getState().accounts,
-  getPublicKeyForCommitment: (commitment: string) => useWalletStore.getState().getPublicKeyForCommitment(commitment),
-  signWord: (publicKey: string, wordHex: string) => useWalletStore.getState().signWord(publicKey, wordHex)
-};
-
-/**
- * Create a MultisigService for the given PSM account.
- * Returns a cached instance if available.
- */
-export async function getOrCreateMultisigService(
-  accountPublicKey: string,
-  provider: PsmAccountProvider = zustandProvider
-): Promise<MultisigService> {
-  console.log(`[PSM Manager] Getting/creating MultisigService for account: ${accountPublicKey}`);
-  // Return cached instance if its endpoint still matches storage. In the
-  // extension build, `clearPsmServiceFor` from the SW realm doesn't reach
-  // the frontend's own copy of this Map, so a guardian switch would leave
-  // the popup syncing against the old guardian indefinitely. Re-check
-  // PSM_URL_STORAGE_KEY here and evict on drift.
-  const cached = psmServiceCache.get(accountPublicKey);
-  if (cached) {
-    const currentEndpoint = (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) || DEFAULT_PSM_ENDPOINT;
-    if (cached.guardianEndpoint === currentEndpoint) return cached;
-    psmServiceCache.delete(accountPublicKey);
-  }
-
-  // Verify this is a PSM account
-  const accounts = await provider.getAccounts();
-  const account = accounts.find(acc => acc.publicKey === accountPublicKey);
-  if (!account || account.type !== WalletType.Psm) {
-    throw new Error('Account is not a PSM account');
-  }
-
-  // Get the Account object from Miden client
-  const { sdkAccount } = await withWasmClientLock(async () => {
-    const midenClient = await getMidenClient();
-    const sdkAccount = await midenClient.getAccount(accountPublicKey);
-    return { sdkAccount };
-  });
-
-  if (!sdkAccount) {
-    throw new Error('Account not found in local storage');
-  }
-
-  const { commitment, publicKey } = await getSignerDetailsFromAccount(sdkAccount, provider.getPublicKeyForCommitment);
-  console.log('[PSM Manager] Retrieved signer details - commitment:', commitment, 'publicKey:', publicKey);
-  // Initialize MultisigService with the account, public key, commitment, and signWord function
-  const service = await MultisigService.init(sdkAccount, `0x${publicKey}`, `0x${commitment}`, provider.signWord);
-
-  // Cache for future use
-  psmServiceCache.set(accountPublicKey, service);
-
-  return service;
-}
-
-/**
- * Check if an account is a PSM account.
- */
-export async function isPsmAccount(
-  accountPublicKey: string,
-  provider: PsmAccountProvider = zustandProvider
-): Promise<boolean> {
-  console.log(`[PSM Manager] Checking if account is PSM: ${accountPublicKey}`);
-  const accounts = await provider.getAccounts();
-  console.log('[PSM Manager] Retrieved accounts from provider:', accounts);
-  const account = accounts.find(acc => acc.publicKey === accountPublicKey);
-  return account?.type === WalletType.Psm;
-}
-
-/**
- * Sync PSM state for all PSM accounts.
- * Called from AutoSync after chain state sync (frontend context only).
- */
-export async function syncPsmAccounts(): Promise<void> {
-  const accounts = await zustandProvider.getAccounts();
-  const psmAccounts = accounts.filter(acc => acc.type === WalletType.Psm);
-
-  if (psmAccounts.length === 0) return;
-
-  for (const account of psmAccounts) {
-    try {
-      const service = await getOrCreateMultisigService(account.publicKey);
-      await service.sync();
-    } catch (error) {
-      console.error(`[PSM Sync] Error syncing PSM account ${account.publicKey}:`, error);
-    }
-  }
-}
-
-/**
- * Clear the PSM service cache. Call on logout/lock.
- */
-export function clearPsmCache(): void {
-  psmServiceCache.clear();
-}
-
-/**
- * Drop a single account's cached MultisigService so the next access
- * reinitializes it — used after a guardian switch where the cached
- * instance still points at the old endpoint.
- */
-export function clearPsmServiceFor(accountPublicKey: string): void {
-  psmServiceCache.delete(accountPublicKey);
-}
diff --git a/src/lib/miden/front/useSyncTrigger.ts b/src/lib/miden/front/useSyncTrigger.ts
index d843a0530..2ade98382 100644
--- a/src/lib/miden/front/useSyncTrigger.ts
+++ b/src/lib/miden/front/useSyncTrigger.ts
@@ -6,7 +6,7 @@ import { WalletMessageType, WalletStatus } from 'lib/shared/types';
 import { getIntercom, useWalletStore } from 'lib/store';
 import { WalletType } from 'screens/onboarding/types';
 
-import { syncPsmAccounts } from './psm-manager';
+import { syncGuardianAccounts } from './guardian-sync';
 
 const SYNC_INTERVAL_MS = 3_000;
 
@@ -14,13 +14,13 @@ function triggerSync(intercom: ReturnType<typeof getIntercom>) {
   intercom
     .request({ type: WalletMessageType.SyncRequest })
     .then(() => {
-      // PSM sync runs in the frontend where the wallet is unlocked and signWord is available
-      const psmAccountKeys = useWalletStore
+      // Guardian sync runs in the frontend where the wallet is unlocked and signWord is available
+      const guardianAccountKeys = useWalletStore
         .getState()
-        .accounts.filter(acc => acc.type === WalletType.Psm)
+        .accounts.filter(acc => acc.type === WalletType.Guardian)
         .map(acc => acc.publicKey);
-      if (psmAccountKeys.length > 0) {
-        syncPsmAccounts().catch(() => {});
+      if (guardianAccountKeys.length > 0) {
+        syncGuardianAccounts().catch(() => {});
       }
     })
     .catch(() => {});
@@ -36,7 +36,7 @@ function triggerSync(intercom: ReturnType<typeof getIntercom>) {
  *   when the zustand balance/sync state was handed off to the React SDK.
  *   Without this, nothing polls on mobile and the UI never sees new notes.
  *
- * After each chain sync, PSM accounts are synced in the frontend context
+ * After each chain sync, Guardian accounts are synced in the frontend context
  * (where the wallet is unlocked and signWord is available).
  */
 export function useSyncTrigger() {
@@ -76,13 +76,13 @@ export function useSyncTrigger() {
             await client.syncState();
           });
 
-          // PSM sync runs outside the WASM lock — HTTP calls only.
-          const psmAccountKeys = useWalletStore
+          // Guardian sync runs outside the WASM lock — HTTP calls only.
+          const guardianAccountKeys = useWalletStore
             .getState()
-            .accounts.filter(acc => acc.type === WalletType.Psm)
+            .accounts.filter(acc => acc.type === WalletType.Guardian)
             .map(acc => acc.publicKey);
-          if (psmAccountKeys.length > 0) {
-            await syncPsmAccounts().catch(() => {});
+          if (guardianAccountKeys.length > 0) {
+            await syncGuardianAccounts().catch(() => {});
           }
         } catch (error) {
           console.warn('[useSyncTrigger] sync error:', error);
diff --git a/src/lib/miden/psm/account.ts b/src/lib/miden/guardian/account.ts
similarity index 76%
rename from src/lib/miden/psm/account.ts
rename to src/lib/miden/guardian/account.ts
index be8fb94bf..0b61ec23b 100644
--- a/src/lib/miden/psm/account.ts
+++ b/src/lib/miden/guardian/account.ts
@@ -1,8 +1,8 @@
 import { Account, AuthSecretKey, MidenClient } from '@miden-sdk/miden-sdk';
 import { FalconSigner, MultisigClient } from '@openzeppelin/miden-multisig-client';
 
-import { DEFAULT_PSM_ENDPOINT } from 'lib/miden-chain/constants';
-import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
+import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
+import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
 
 import { fetchFromStorage } from '../front/storage';
 
@@ -15,7 +15,7 @@ export const MULTISIG_SLOT_NAMES = {
 } as const;
 
 /**
- * Extract signer commitment and public key from a PSM account's storage.
+ * Extract signer commitment and public key from a Guardian account's storage.
  */
 export async function getSignerDetailsFromAccount(
   account: Account,
@@ -40,22 +40,22 @@ export async function getSignerDetailsFromAccount(
 }
 
 /**
- * Create a PSM (Private State Manager) account using the MultisigClient.
+ * Create a Guardian (Private State Manager) account using the MultisigClient.
  *
- * This creates a 1-of-1 multisig account with PSM signature verification enabled.
- * The account is registered with the PSM backend and the secret key is stored locally.
+ * This creates a 1-of-1 multisig account with Guardian signature verification enabled.
+ * The account is registered with the Guardian backend and the secret key is stored locally.
  *
  * @param webClient - The Miden WebClient instance
  * @param seed - Optional seed for key derivation (random if not provided)
  * @param skipRegistration - Skip guardian registration (used by the import path)
  * @param guardianEndpointOverride - Force a specific guardian URL for pubkey derivation.
  *   Account ID is a content hash that includes the guardian pubkey baked into storage,
- *   so the import flow passes `DEFAULT_PSM_ENDPOINT` to reproduce the ID the account
- *   originally had; the user's custom URL is used by `importAccountFromPsm` for the
+ *   so the import flow passes `DEFAULT_GUARDIAN_ENDPOINT` to reproduce the ID the account
+ *   originally had; the user's custom URL is used by `importAccountFromGuardian` for the
  *   live state fetch only.
  * @returns The created Account
  */
-export async function createPsmAccount(
+export async function createGuardianAccount(
   webClient: MidenClient,
   seed?: Uint8Array,
   skipRegistration: boolean = false,
@@ -70,10 +70,10 @@ export async function createPsmAccount(
     const sk = AuthSecretKey.rpoFalconWithRNG(seed);
     const signerCommitment = sk.publicKey().toCommitment();
 
-    // Get PSM endpoint and initialize client
+    // Get Guardian endpoint and initialize client
     const guardianEndpoint =
-      guardianEndpointOverride ?? (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) ?? DEFAULT_PSM_ENDPOINT;
-    console.log('Using PSM endpoint:', guardianEndpoint);
+      guardianEndpointOverride ?? (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) ?? DEFAULT_GUARDIAN_ENDPOINT;
+    console.log('Using Guardian endpoint:', guardianEndpoint);
     const client = new MultisigClient(webClient, { guardianEndpoint });
     const { commitment, pubkey } = await client.guardianClient.getPubkey();
     // Create the multisig account using the package utility
@@ -100,12 +100,12 @@ export async function createPsmAccount(
     // Store the secret key in WebStore for signing
     await webClient.keystore.insert(multisig.account.id(), sk);
 
-    console.log('PSM account created:', multisig.account.id().toString());
+    console.log('Guardian account created:', multisig.account.id().toString());
 
     return multisig.account;
   } catch (e) {
     console.log(e);
-    console.error('Error creating PSM account:', e);
-    throw new Error('Failed to create PSM account');
+    console.error('Error creating Guardian account:', e);
+    throw new Error('Failed to create Guardian account');
   }
 }
diff --git a/src/lib/miden/psm/digest.ts b/src/lib/miden/guardian/digest.ts
similarity index 100%
rename from src/lib/miden/psm/digest.ts
rename to src/lib/miden/guardian/digest.ts
diff --git a/src/lib/miden/psm/index.ts b/src/lib/miden/guardian/index.ts
similarity index 88%
rename from src/lib/miden/psm/index.ts
rename to src/lib/miden/guardian/index.ts
index 73f7b626c..42be8aad9 100644
--- a/src/lib/miden/psm/index.ts
+++ b/src/lib/miden/guardian/index.ts
@@ -8,11 +8,11 @@ import {
   type Proposal
 } from '@openzeppelin/miden-multisig-client';
 
-import { DEFAULT_PSM_ENDPOINT } from 'lib/miden-chain/constants';
-import { PSM_URL_STORAGE_KEY } from 'lib/settings/constants';
+import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
+import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { u8ToB64 } from 'lib/shared/helpers';
 
-import { fetchFromStorage } from '../front';
+import { fetchFromStorage } from '../front/storage';
 import { accountIdStringToSdk } from '../sdk/helpers';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 import { MidenClientInterface } from '../sdk/miden-client-interface';
@@ -23,7 +23,7 @@ const MAX_SYNC_RETRIES = 20;
 /**
  * MultisigService wraps the MultisigClient and Multisig classes from
  * @openzeppelin/miden-multisig-client to provide a simplified interface
- * for PSM account operations.
+ * for Guardian account operations.
  */
 export class MultisigService {
   multisig: Multisig;
@@ -38,7 +38,7 @@ export class MultisigService {
   }
 
   /**
-   * Initialize a MultisigService for an existing PSM account.
+   * Initialize a MultisigService for an existing Guardian account.
    */
   static async init(
     account: Account,
@@ -48,7 +48,7 @@ export class MultisigService {
   ): Promise<MultisigService> {
     try {
       const signer = new WalletSigner(publicKey, signerCommitment, signWordFn);
-      const guardianEndpoint = (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) || DEFAULT_PSM_ENDPOINT;
+      const guardianEndpoint = (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
 
       const webClient = (await MidenClientInterface.create({})).client;
 
@@ -62,19 +62,21 @@ export class MultisigService {
     }
   }
 
-  static async importAccountFromPsm(
+  static async importAccountFromGuardian(
     publicKey: string,
     signerCommitment: string,
     signWordFn: SignWordFunction,
     accountId: string,
     webClient: MidenClient
   ) {
-    const psmEndpoint = (await fetchFromStorage<string>(PSM_URL_STORAGE_KEY)) || DEFAULT_PSM_ENDPOINT;
-    const psm = new GuardianHttpClient(psmEndpoint);
+    console.log('Importing account from Guardian with accountId:', accountId);
+    const guardianEndpoint = (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
+    console.log('Using Guardian endpoint:', guardianEndpoint);
+    const guardian = new GuardianHttpClient(guardianEndpoint);
     const signer = new WalletSigner(publicKey, signerCommitment, signWordFn);
-    psm.setSigner(signer);
+    guardian.setSigner(signer);
     try {
-      const { stateJson } = await psm.getState(accountId);
+      const { stateJson } = await guardian.getState(accountId);
       const accountBase64 = stateJson.data;
       const binaryString = atob(accountBase64);
       const accountBytes = new Uint8Array(binaryString.length);
@@ -84,7 +86,8 @@ export class MultisigService {
       const account = Account.deserialize(accountBytes);
       await webClient.accounts.insert({ account, overwrite: true });
     } catch (error) {
-      console.log('Error fetching account state from PSM:', error);
+      console.log('Error fetching account state from Guardian:', error);
+      throw error;
     }
   }
 
@@ -155,7 +158,7 @@ export class MultisigService {
       await this.multisig.syncState();
       this.syncRetryCount = 0; // Reset retry count on successful sync
     } catch (error) {
-      console.log('[PSM] sync error ', error);
+      console.log('[Guardian] sync error ', error);
       const isNonceTooLow =
         error instanceof Error && error.message.includes('nonce') && error.message.includes('too low');
 
diff --git a/src/lib/miden/psm/signer.ts b/src/lib/miden/guardian/signer.ts
similarity index 100%
rename from src/lib/miden/psm/signer.ts
rename to src/lib/miden/guardian/signer.ts
diff --git a/src/lib/miden/sdk/miden-client-interface.ts b/src/lib/miden/sdk/miden-client-interface.ts
index 921129b33..6c997f4ca 100644
--- a/src/lib/miden/sdk/miden-client-interface.ts
+++ b/src/lib/miden/sdk/miden-client-interface.ts
@@ -27,11 +27,11 @@ import { isMobile } from 'lib/platform';
 import { WalletType } from 'screens/onboarding/types';
 
 import { ConsumeTransaction, SendTransaction } from '../db/types';
-// PSM helpers are dynamic-imported inside the methods that use them to avoid
-// a module init cycle: miden-client-interface → psm/index → sdk/miden-client →
-// miden-client-interface. Static imports here deadlock init_psm_manager in the
+// Guardian helpers are dynamic-imported inside the methods that use them to avoid
+// a module init cycle: miden-client-interface → guardian/index → sdk/miden-client →
+// miden-client-interface. Static imports here deadlock init_guardian_manager in the
 // SW bundle (both sides' __esmMin wrappers await each other).
-import type { SignWordFunction } from '../psm/signer';
+import type { SignWordFunction } from '../guardian/signer';
 import { NoteExportType } from './constants';
 import { getBech32AddressFromAccountId } from './helpers';
 
@@ -103,9 +103,9 @@ export class MidenClientInterface {
   }
 
   async createMidenWallet(walletType: WalletType, seed?: Uint8Array): Promise<string> {
-    if (walletType === WalletType.Psm) {
-      const { createPsmAccount } = await import('../psm/account');
-      const account = await createPsmAccount(this.client, seed);
+    if (walletType === WalletType.Guardian) {
+      const { createGuardianAccount } = await import('../guardian/account');
+      const account = await createGuardianAccount(this.client, seed);
       return getBech32AddressFromAccountId(account.id());
     }
 
@@ -134,20 +134,27 @@ export class MidenClientInterface {
     signWordFn: SignWordFunction,
     getPublicKeyForCommitment: (commitment: string) => Promise<string>
   ): Promise<string> {
-    if (walletType === WalletType.Psm) {
-      console.log('Importing PSM account from seed', seed);
+    if (walletType === WalletType.Guardian) {
+      console.log('Importing Guardian account from seed', seed);
       try {
-        const [{ createPsmAccount, getSignerDetailsFromAccount }, { MultisigService }, { DEFAULT_PSM_ENDPOINT }] =
-          await Promise.all([import('../psm/account'), import('../psm/index'), import('lib/miden-chain/constants')]);
+        const [
+          { createGuardianAccount, getSignerDetailsFromAccount },
+          { MultisigService },
+          { DEFAULT_GUARDIAN_ENDPOINT }
+        ] = await Promise.all([
+          import('../guardian/account'),
+          import('../guardian/index'),
+          import('lib/miden-chain/constants')
+        ]);
         // Derive the account ID against the default guardian so it matches the ID
         // the account had at creation time. The user's custom guardian URL (persisted
-        // in PSM_URL_STORAGE_KEY) is picked up later by importAccountFromPsm for the
+        // in GUARDIAN_URL_STORAGE_KEY) is picked up later by importAccountFromGuardian for the
         // live state fetch.
-        const account = await createPsmAccount(this.client, seed, true, DEFAULT_PSM_ENDPOINT);
-        console.log('[MidenClientInterface] Imported PSM account from seed with ID:', account.id().toString());
+        const account = await createGuardianAccount(this.client, seed, true, DEFAULT_GUARDIAN_ENDPOINT);
+        console.log('[MidenClientInterface] Imported Guardian account from seed with ID:', account.id().toString());
         const accountId = account.id().toString();
         const { commitment, publicKey } = await getSignerDetailsFromAccount(account, getPublicKeyForCommitment);
-        await MultisigService.importAccountFromPsm(
+        await MultisigService.importAccountFromGuardian(
           `0x${publicKey}`,
           `0x${commitment}`,
           signWordFn,
@@ -157,7 +164,7 @@ export class MidenClientInterface {
         return getBech32AddressFromAccountId(account.id());
       } catch (error) {
         console.log(error);
-        throw new Error('Failed to import PSM account from seed');
+        throw new Error('Failed to import Guardian account from seed');
       }
     }
 
diff --git a/src/lib/settings/constants.ts b/src/lib/settings/constants.ts
index 819544b10..7d269bfe4 100644
--- a/src/lib/settings/constants.ts
+++ b/src/lib/settings/constants.ts
@@ -15,4 +15,4 @@ export type ThemeSetting = 'light' | 'dark' | 'system';
 export type ResolvedTheme = 'light' | 'dark';
 export const DEFAULT_THEME: ThemeSetting = 'system';
 
-export const PSM_URL_STORAGE_KEY = 'psm_url_setting';
+export const GUARDIAN_URL_STORAGE_KEY = 'guardian_url_setting';
diff --git a/src/lib/store/index.test.ts b/src/lib/store/index.test.ts
index 5d3641b4d..705622684 100644
--- a/src/lib/store/index.test.ts
+++ b/src/lib/store/index.test.ts
@@ -279,11 +279,11 @@ describe('useWalletStore', () => {
       mockRequest.mockResolvedValueOnce({ type: WalletMessageType.NewWalletResponse });
 
       const { registerWallet } = useWalletStore.getState();
-      await registerWallet(WalletType.Psm, 'password123', 'mnemonic words', true);
+      await registerWallet(WalletType.Guardian, 'password123', 'mnemonic words', true);
 
       expect(mockRequest).toHaveBeenCalledWith({
         type: WalletMessageType.NewWalletRequest,
-        walletType: WalletType.Psm,
+        walletType: WalletType.Guardian,
         password: 'password123',
         mnemonic: 'mnemonic words',
         ownMnemonic: true
@@ -684,7 +684,7 @@ describe('useWalletStore', () => {
   describe('registerWallet / importWalletFromClient / unlock', () => {
     it('registerWallet sends NewWalletRequest', async () => {
       mockRequest.mockResolvedValueOnce({ type: WalletMessageType.NewWalletResponse });
-      await useWalletStore.getState().registerWallet(WalletType.Psm, 'pw', 'mnemonic-12', false);
+      await useWalletStore.getState().registerWallet(WalletType.Guardian, 'pw', 'mnemonic-12', false);
       expect(mockRequest).toHaveBeenCalledWith(
         expect.objectContaining({ type: WalletMessageType.NewWalletRequest, password: 'pw' })
       );
@@ -692,7 +692,7 @@ describe('useWalletStore', () => {
 
     it('registerWallet throws on invalid response', async () => {
       mockRequest.mockResolvedValueOnce({ type: 'wrong' });
-      await expect(useWalletStore.getState().registerWallet(WalletType.Psm, 'pw', 'm', false)).rejects.toThrow();
+      await expect(useWalletStore.getState().registerWallet(WalletType.Guardian, 'pw', 'm', false)).rejects.toThrow();
     });
 
     it('importWalletFromClient sends ImportFromClientRequest', async () => {
diff --git a/src/lib/store/index.ts b/src/lib/store/index.ts
index 5c1a072a9..8f606282d 100644
--- a/src/lib/store/index.ts
+++ b/src/lib/store/index.ts
@@ -163,6 +163,14 @@ export const useWalletStore = create<WalletStore>()(
         name
       });
       assertResponse(res.type === WalletMessageType.CreateAccountResponse);
+
+      // Pull fresh state right away. The StateUpdated broadcast is advisory and can
+      // race the CreateAccount response (extension port reconnect, SW waking, etc.),
+      // leaving consumers that await createAccount — notably CreateAccount.tsx's
+      // length-diff effect — looking at a stale accounts array.
+      const stateRes = await request({ type: WalletMessageType.GetStateRequest });
+      assertResponse(stateRes.type === WalletMessageType.GetStateResponse);
+      get().syncFromBackend(stateRes.state);
     },
 
     updateCurrentAccount: async accountPublicKey => {
diff --git a/src/screens/generating-transaction/GeneratingTransaction.tsx b/src/screens/generating-transaction/GeneratingTransaction.tsx
index 45170eeca..7f0f5bb28 100644
--- a/src/screens/generating-transaction/GeneratingTransaction.tsx
+++ b/src/screens/generating-transaction/GeneratingTransaction.tsx
@@ -15,6 +15,7 @@ import {
 } from 'lib/miden/activity';
 import { ITransactionStage, ITransactionStatus, ITransactionType } from 'lib/miden/db/types';
 import { useMidenContext } from 'lib/miden/front';
+import { zustandProvider } from 'lib/miden/front/guardian-sync';
 import { getExplorerTxUrl } from 'lib/miden-chain/constants';
 import { openExternalUrl } from 'lib/mobile/external-browser';
 import { isExtension, isMobile } from 'lib/platform';
@@ -133,7 +134,7 @@ export const GeneratingTransactionPage: FC<GeneratingTransactionPageProps> = ({
   const generateTransaction = useCallback(async () => {
     setHasStartedProcessing(true);
     try {
-      const success = await dbTransactionsLoop(signTransaction);
+      const success = await dbTransactionsLoop(signTransaction, false, zustandProvider);
       // Don't stop on failure - continue processing remaining transactions
       // The failed transaction is already marked as Failed in IndexedDB
       if (success === false) {
@@ -293,7 +294,7 @@ export const GeneratingTransaction: React.FC<GeneratingTransactionProps> = ({
    * stages are type-neutral — they either describe network state
    * (syncing, confirming), only apply to one type (delivering → private
    * send only; registering-guardian → switch-guardian only), or describe
-   * PSM-specific phases that are the same action regardless of what the
+   * Guardian-specific phases that are the same action regardless of what the
    * proposal does (creating-proposal / signing-proposal / submitting).
    */
   const stageTitleKey = useCallback((stage?: ITransactionStage, type?: ITransactionType): string => {
diff --git a/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx b/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx
index 0a137b1d2..2d4375461 100644
--- a/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx
+++ b/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx
@@ -30,7 +30,7 @@ export const SelectRecoveryMethodScreen = ({
   const defaultOptions: RecoveryOption[] = useMemo(
     () => [
       {
-        id: WalletType.Psm,
+        id: WalletType.Guardian,
         title: t('guardianRecovery'),
         description: t('guardianRecoveryDescription'),
         isDefault: true
diff --git a/src/screens/onboarding/import-wallet-flow/ImportRecoveryMethod.tsx b/src/screens/onboarding/import-wallet-flow/ImportRecoveryMethod.tsx
index e4b2f5638..8dc1212f7 100644
--- a/src/screens/onboarding/import-wallet-flow/ImportRecoveryMethod.tsx
+++ b/src/screens/onboarding/import-wallet-flow/ImportRecoveryMethod.tsx
@@ -6,7 +6,7 @@ import { useTranslation } from 'react-i18next';
 import { Icon, IconName } from 'app/icons/v2';
 import { Button } from 'components/Button';
 import { Input } from 'components/Input';
-import { DEFAULT_PSM_ENDPOINT } from 'lib/miden-chain/constants';
+import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
 import { Badge } from 'lib/ui/badge';
 
 import { WalletType } from '../types';
@@ -19,15 +19,15 @@ export interface ImportRecoveryMethodScreenProps {
 export const ImportRecoveryMethodScreen: React.FC<ImportRecoveryMethodScreenProps> = ({ isError, onSubmit }) => {
   const { t } = useTranslation();
 
-  const [selected, setSelected] = useState<WalletType>(WalletType.Psm);
-  const [endpointInput, setEndpointInput] = useState<string>(DEFAULT_PSM_ENDPOINT);
+  const [selected, setSelected] = useState<WalletType>(WalletType.Guardian);
+  const [endpointInput, setEndpointInput] = useState<string>(DEFAULT_GUARDIAN_ENDPOINT);
   const [isCustomizing, setIsCustomizing] = useState(false);
   const [dirty, setDirty] = useState(false);
 
-  const showError = Boolean(isError) && !dirty && selected === WalletType.Psm;
+  const showError = Boolean(isError) && !dirty && selected === WalletType.Guardian;
 
   const trimmedEndpoint = endpointInput.trim();
-  const canContinue = selected === WalletType.OnChain || (selected === WalletType.Psm && trimmedEndpoint.length > 0);
+  const canContinue = selected === WalletType.OnChain || (selected === WalletType.Guardian && trimmedEndpoint.length > 0);
 
   const handleContinue = () => {
     console.log('Continue with selection:', { selected, trimmedEndpoint });
@@ -35,11 +35,11 @@ export const ImportRecoveryMethodScreen: React.FC<ImportRecoveryMethodScreenProp
       onSubmit({ walletType: WalletType.OnChain });
       return;
     }
-    onSubmit({ walletType: WalletType.Psm, guardianEndpoint: trimmedEndpoint });
+    onSubmit({ walletType: WalletType.Guardian, guardianEndpoint: trimmedEndpoint });
   };
 
-  const handleSelectPsm = () => {
-    setSelected(WalletType.Psm);
+  const handleSelectGuardian = () => {
+    setSelected(WalletType.Guardian);
     setDirty(true);
   };
 
@@ -57,11 +57,11 @@ export const ImportRecoveryMethodScreen: React.FC<ImportRecoveryMethodScreenProp
   const options = useMemo(
     () => [
       {
-        id: WalletType.Psm,
+        id: WalletType.Guardian,
         title: t('importViaGuardian'),
         description: t('importViaGuardianDescription'),
         isDefault: true,
-        onSelect: handleSelectPsm
+        onSelect: handleSelectGuardian
       },
       {
         id: WalletType.OnChain,
@@ -86,7 +86,7 @@ export const ImportRecoveryMethodScreen: React.FC<ImportRecoveryMethodScreenProp
       <div className="flex flex-col w-full">
         {options.map(option => {
           const isSelected = selected === option.id;
-          const isPsm = option.id === WalletType.Psm;
+          const isGuardian = option.id === WalletType.Guardian;
           return (
             <div
               key={option.id}
@@ -107,7 +107,7 @@ export const ImportRecoveryMethodScreen: React.FC<ImportRecoveryMethodScreenProp
               </div>
               <p className="text-grey-600 text-sm">{option.description}</p>
 
-              {isPsm && isSelected && (
+              {isGuardian && isSelected && (
                 <div className="mt-4 flex flex-col gap-2" onClick={e => e.stopPropagation()}>
                   {!isCustomizing && (
                     <div className="flex flex-col gap-1">
@@ -127,7 +127,7 @@ export const ImportRecoveryMethodScreen: React.FC<ImportRecoveryMethodScreenProp
                     <Input
                       id="guardian-endpoint-input"
                       value={endpointInput}
-                      placeholder={DEFAULT_PSM_ENDPOINT}
+                      placeholder={DEFAULT_GUARDIAN_ENDPOINT}
                       onChange={event => {
                         setEndpointInput(event.target.value);
                         setDirty(true);
diff --git a/src/screens/onboarding/types.ts b/src/screens/onboarding/types.ts
index 6ae46ddcf..0ed81b600 100644
--- a/src/screens/onboarding/types.ts
+++ b/src/screens/onboarding/types.ts
@@ -7,7 +7,7 @@ export enum OnboardingType {
 
 export enum WalletType {
   OffChain = 'off-chain',
-  Psm = 'psm',
+  Guardian = 'guardian',
   OnChain = 'on-chain'
 }
 
diff --git a/src/screens/send-flow/SendManager.tsx b/src/screens/send-flow/SendManager.tsx
index c778d919a..f856f1241 100644
--- a/src/screens/send-flow/SendManager.tsx
+++ b/src/screens/send-flow/SendManager.tsx
@@ -95,7 +95,7 @@ export const SendManager: React.FC<SendManagerProps> = ({ preselectedTokenId })
         name: contact.name,
         isOwned: true,
         contactType: contact.isPublic ? ('public' as const) : ('private' as const),
-        isGuardian: contact.type === WalletType.Psm
+        isGuardian: contact.type === WalletType.Guardian
       }));
 
     const externalContacts: Contact[] = addressBookContacts

From 13b8d83843195390ef491aa4e93569ca17f37390 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Thu, 23 Apr 2026 11:33:37 +0000
Subject: [PATCH 24/71] chore: update translation files

---
 public/_locales/de/messages.json    | 108 ++++++++++++++++++++++++++++
 public/_locales/en/messages.json    |  72 +++++++++++++++++++
 public/_locales/en_GB/messages.json | 108 ++++++++++++++++++++++++++++
 public/_locales/es/messages.json    | 108 ++++++++++++++++++++++++++++
 public/_locales/fr/messages.json    | 108 ++++++++++++++++++++++++++++
 public/_locales/ja/messages.json    | 108 ++++++++++++++++++++++++++++
 public/_locales/ko/messages.json    | 108 ++++++++++++++++++++++++++++
 public/_locales/pl/messages.json    | 108 ++++++++++++++++++++++++++++
 public/_locales/pt/messages.json    | 108 ++++++++++++++++++++++++++++
 public/_locales/ru/messages.json    | 108 ++++++++++++++++++++++++++++
 public/_locales/tr/messages.json    | 108 ++++++++++++++++++++++++++++
 public/_locales/uk/messages.json    | 108 ++++++++++++++++++++++++++++
 public/_locales/zh_CN/messages.json | 108 ++++++++++++++++++++++++++++
 public/_locales/zh_TW/messages.json | 108 ++++++++++++++++++++++++++++
 14 files changed, 1476 insertions(+)

diff --git a/public/_locales/de/messages.json b/public/_locales/de/messages.json
index a93cbbbe5..b21042b4d 100644
--- a/public/_locales/de/messages.json
+++ b/public/_locales/de/messages.json
@@ -422,6 +422,34 @@
     "message": "Transaktion wird ausgeführt",
     "englishSource": "Executing transaction"
   },
+  "transactionStageSwitching": {
+    "message": "Vormund wechseln",
+    "englishSource": "Switching guardian"
+  },
+  "transactionStageCreatingProposal": {
+    "message": "Angebot erstellen",
+    "englishSource": "Creating proposal"
+  },
+  "transactionStageCreatingProposalDescription": {
+    "message": "Erstellen Sie den Transaktionsvorschlag für Ihren Vormund.",
+    "englishSource": "Building the transaction proposal for your guardian."
+  },
+  "transactionStageSigningProposal": {
+    "message": "Unterzeichnung mit Vormund",
+    "englishSource": "Signing with guardian"
+  },
+  "transactionStageSigningProposalDescription": {
+    "message": "Ihr Vormund unterzeichnet den Vorschlag.",
+    "englishSource": "Your guardian is signing the proposal."
+  },
+  "transactionStageSubmitting": {
+    "message": "Transaktion wird übermittelt",
+    "englishSource": "Submitting transaction"
+  },
+  "transactionStageSubmittingDescription": {
+    "message": "Senden Sie Ihre signierte Transaktion an das Netzwerk.",
+    "englishSource": "Sending your signed transaction to the network."
+  },
   "transactionStageConfirming": {
     "message": "Bestätigung an der Kette",
     "englishSource": "Confirming on chain"
@@ -430,6 +458,14 @@
     "message": "Warten auf Netzwerkbestätigung.",
     "englishSource": "Waiting for network confirmation."
   },
+  "transactionStageRegisteringGuardian": {
+    "message": "Anmeldung beim Erziehungsberechtigten",
+    "englishSource": "Registering with guardian"
+  },
+  "transactionStageRegisteringGuardianDescription": {
+    "message": "Registrieren Sie Ihren Kontostatus beim neuen Vormund.",
+    "englishSource": "Registering your account state with the new guardian."
+  },
   "transactionStageDelivering": {
     "message": "Lieferung von note",
     "englishSource": "Delivering note"
@@ -1562,6 +1598,46 @@
     "message": "Verschlüsselte Wallet-Datei",
     "englishSource": "Encrypted Wallet File"
   },
+  "guardianBadge": {
+    "message": "Wächter",
+    "englishSource": "Guardian"
+  },
+  "guardianSettings": {
+    "message": "Wächtereinstellungen",
+    "englishSource": "Guardian Settings"
+  },
+  "currentGuardianEndpoint": {
+    "message": "Aktueller Wächter",
+    "englishSource": "Current Guardian"
+  },
+  "newGuardianEndpoint": {
+    "message": "Neuer Guardian-Endpunkt",
+    "englishSource": "New Guardian Endpoint"
+  },
+  "switchGuardian": {
+    "message": "Wächter wechseln",
+    "englishSource": "Switch Guardian"
+  },
+  "switchGuardianDescription": {
+    "message": "Richten Sie Ihr Guardian-Konto auf einen neuen Guardian-Endpunkt. Der Wechsel wird als On-Chain-Vorschlag signiert.",
+    "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
+  },
+  "switchingGuardian": {
+    "message": "Vormund wechseln...",
+    "englishSource": "Switching guardian..."
+  },
+  "guardianSwitched": {
+    "message": "Guardian hat erfolgreich gewechselt.",
+    "englishSource": "Guardian switched successfully."
+  },
+  "guardianEndpointUnchanged": {
+    "message": "Das ist bereits Ihr aktueller Vormund.",
+    "englishSource": "That's already your current guardian."
+  },
+  "invalidUrl": {
+    "message": "Geben Sie eine gültige URL ein, die mit http:// oder https:// beginnt.",
+    "englishSource": "Enter a valid URL starting with http:// or https://"
+  },
   "encryptedWalletFileDescription": {
     "message": "Geben Sie Ihr Passwort ein, um auf Ihre verschlüsselte Wallet-Datei zuzugreifen.",
     "englishSource": "Enter your password to access your Encrypted Wallet File."
@@ -1860,6 +1936,38 @@
     "message": "Stellen Sie ein öffentliches On-Chain-Konto wieder her.",
     "englishSource": "Recover a public on-chain account."
   },
+  "importRecoveryMethodTitle": {
+    "message": "Wie möchten Sie diese Brieftasche wiederherstellen?",
+    "englishSource": "How would you like to recover this wallet?"
+  },
+  "importViaGuardian": {
+    "message": "Import über Guardian",
+    "englishSource": "Import via Guardian"
+  },
+  "importViaGuardianDescription": {
+    "message": "Beauftragen Sie einen Erziehungsberechtigten mit der Wiederherstellung und Mitunterzeichnung dieses Kontos.",
+    "englishSource": "Use a guardian to recover and co-sign for this account."
+  },
+  "importPublicAccount": {
+    "message": "Öffentliches Konto importieren",
+    "englishSource": "Import public account"
+  },
+  "importPublicAccountDescription": {
+    "message": "Importieren Sie das von Ihrem seed phrase abgeleitete öffentliche Konto.",
+    "englishSource": "Import the public account derived from your seed phrase."
+  },
+  "guardianEndpoint": {
+    "message": "Guardian-URL",
+    "englishSource": "Guardian URL"
+  },
+  "useDifferentGuardian": {
+    "message": "Verwenden Sie einen anderen Vormund",
+    "englishSource": "Use a different guardian"
+  },
+  "guardianAccountNotFound": {
+    "message": "Wir konnten Ihr Konto bei diesem Guardian nicht finden. Überprüfen Sie die URL oder importieren Sie stattdessen als öffentliches Konto.",
+    "englishSource": "We couldn't find your account on this guardian. Check the URL or import as a public account instead."
+  },
   "default": {
     "message": "Standard",
     "englishSource": "Default"
diff --git a/public/_locales/en/messages.json b/public/_locales/en/messages.json
index af6f7f41a..5bfae0229 100644
--- a/public/_locales/en/messages.json
+++ b/public/_locales/en/messages.json
@@ -1567,6 +1567,46 @@
     "message": "Encrypted Wallet File",
     "englishSource": "Encrypted Wallet File"
   },
+  "guardianBadge": {
+    "message": "Guardian",
+    "englishSource": "Guardian"
+  },
+  "guardianSettings": {
+    "message": "Guardian Settings",
+    "englishSource": "Guardian Settings"
+  },
+  "currentGuardianEndpoint": {
+    "message": "Current Guardian",
+    "englishSource": "Current Guardian"
+  },
+  "newGuardianEndpoint": {
+    "message": "New Guardian Endpoint",
+    "englishSource": "New Guardian Endpoint"
+  },
+  "switchGuardian": {
+    "message": "Switch Guardian",
+    "englishSource": "Switch Guardian"
+  },
+  "switchGuardianDescription": {
+    "message": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal.",
+    "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
+  },
+  "switchingGuardian": {
+    "message": "Switching guardian...",
+    "englishSource": "Switching guardian..."
+  },
+  "guardianSwitched": {
+    "message": "Guardian switched successfully.",
+    "englishSource": "Guardian switched successfully."
+  },
+  "guardianEndpointUnchanged": {
+    "message": "That's already your current guardian.",
+    "englishSource": "That's already your current guardian."
+  },
+  "invalidUrl": {
+    "message": "Enter a valid URL starting with http:// or https://",
+    "englishSource": "Enter a valid URL starting with http:// or https://"
+  },
   "encryptedWalletFileDescription": {
     "message": "Enter your password to access your Encrypted Wallet File.",
     "englishSource": "Enter your password to access your Encrypted Wallet File."
@@ -1860,6 +1900,38 @@
     "message": "Recover a public on-chain account.",
     "englishSource": "Recover a public on-chain account."
   },
+  "importRecoveryMethodTitle": {
+    "message": "How would you like to recover this wallet?",
+    "englishSource": "How would you like to recover this wallet?"
+  },
+  "importViaGuardian": {
+    "message": "Import via Guardian",
+    "englishSource": "Import via Guardian"
+  },
+  "importViaGuardianDescription": {
+    "message": "Use a guardian to recover and co-sign for this account.",
+    "englishSource": "Use a guardian to recover and co-sign for this account."
+  },
+  "importPublicAccount": {
+    "message": "Import public account",
+    "englishSource": "Import public account"
+  },
+  "importPublicAccountDescription": {
+    "message": "Import the public account derived from your seed phrase.",
+    "englishSource": "Import the public account derived from your seed phrase."
+  },
+  "guardianEndpoint": {
+    "message": "Guardian URL",
+    "englishSource": "Guardian URL"
+  },
+  "useDifferentGuardian": {
+    "message": "Use a different guardian",
+    "englishSource": "Use a different guardian"
+  },
+  "guardianAccountNotFound": {
+    "message": "We couldn't find your account on this guardian. Check the URL or import as a public account instead.",
+    "englishSource": "We couldn't find your account on this guardian. Check the URL or import as a public account instead."
+  },
   "default": {
     "message": "Default",
     "englishSource": "Default"
diff --git a/public/_locales/en_GB/messages.json b/public/_locales/en_GB/messages.json
index a77ede4da..35717cb67 100644
--- a/public/_locales/en_GB/messages.json
+++ b/public/_locales/en_GB/messages.json
@@ -422,6 +422,34 @@
     "message": "Executing transaction",
     "englishSource": "Executing transaction"
   },
+  "transactionStageSwitching": {
+    "message": "Switching guardian",
+    "englishSource": "Switching guardian"
+  },
+  "transactionStageCreatingProposal": {
+    "message": "Creating proposal",
+    "englishSource": "Creating proposal"
+  },
+  "transactionStageCreatingProposalDescription": {
+    "message": "Building the transaction proposal for your guardian.",
+    "englishSource": "Building the transaction proposal for your guardian."
+  },
+  "transactionStageSigningProposal": {
+    "message": "Signing with guardian",
+    "englishSource": "Signing with guardian"
+  },
+  "transactionStageSigningProposalDescription": {
+    "message": "Your guardian is signing the proposal.",
+    "englishSource": "Your guardian is signing the proposal."
+  },
+  "transactionStageSubmitting": {
+    "message": "Submitting transaction",
+    "englishSource": "Submitting transaction"
+  },
+  "transactionStageSubmittingDescription": {
+    "message": "Sending your signed transaction to the network.",
+    "englishSource": "Sending your signed transaction to the network."
+  },
   "transactionStageConfirming": {
     "message": "Confirming on chain",
     "englishSource": "Confirming on chain"
@@ -430,6 +458,14 @@
     "message": "Waiting for network confirmation.",
     "englishSource": "Waiting for network confirmation."
   },
+  "transactionStageRegisteringGuardian": {
+    "message": "Registering with guardian",
+    "englishSource": "Registering with guardian"
+  },
+  "transactionStageRegisteringGuardianDescription": {
+    "message": "Registering your account state with the new guardian.",
+    "englishSource": "Registering your account state with the new guardian."
+  },
   "transactionStageDelivering": {
     "message": "Delivering note",
     "englishSource": "Delivering note"
@@ -1590,6 +1626,46 @@
     "message": "Encrypted Wallet File",
     "englishSource": "Encrypted Wallet File"
   },
+  "guardianBadge": {
+    "message": "Guardian",
+    "englishSource": "Guardian"
+  },
+  "guardianSettings": {
+    "message": "Guardian Settings",
+    "englishSource": "Guardian Settings"
+  },
+  "currentGuardianEndpoint": {
+    "message": "Current Guardian",
+    "englishSource": "Current Guardian"
+  },
+  "newGuardianEndpoint": {
+    "message": "New Guardian Endpoint",
+    "englishSource": "New Guardian Endpoint"
+  },
+  "switchGuardian": {
+    "message": "Switch Guardian",
+    "englishSource": "Switch Guardian"
+  },
+  "switchGuardianDescription": {
+    "message": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal.",
+    "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
+  },
+  "switchingGuardian": {
+    "message": "Switching guardian...",
+    "englishSource": "Switching guardian..."
+  },
+  "guardianSwitched": {
+    "message": "Guardian switched successfully.",
+    "englishSource": "Guardian switched successfully."
+  },
+  "guardianEndpointUnchanged": {
+    "message": "That's already your current guardian.",
+    "englishSource": "That's already your current guardian."
+  },
+  "invalidUrl": {
+    "message": "Enter a valid URL starting with http:// or https://",
+    "englishSource": "Enter a valid URL starting with http:// or https://"
+  },
   "encryptedWalletFileDescription": {
     "message": "Enter your password to access your Encrypted Wallet File.",
     "englishSource": "Enter your password to access your Encrypted Wallet File."
@@ -1888,6 +1964,38 @@
     "message": "Recover a public on-chain account.",
     "englishSource": "Recover a public on-chain account."
   },
+  "importRecoveryMethodTitle": {
+    "message": "How would you like to recover this wallet?",
+    "englishSource": "How would you like to recover this wallet?"
+  },
+  "importViaGuardian": {
+    "message": "Import via Guardian",
+    "englishSource": "Import via Guardian"
+  },
+  "importViaGuardianDescription": {
+    "message": "Use a guardian to recover and co-sign for this account.",
+    "englishSource": "Use a guardian to recover and co-sign for this account."
+  },
+  "importPublicAccount": {
+    "message": "Import public account",
+    "englishSource": "Import public account"
+  },
+  "importPublicAccountDescription": {
+    "message": "Import the public account derived from your seed phrase.",
+    "englishSource": "Import the public account derived from your seed phrase."
+  },
+  "guardianEndpoint": {
+    "message": "Guardian URL",
+    "englishSource": "Guardian URL"
+  },
+  "useDifferentGuardian": {
+    "message": "Use a different guardian",
+    "englishSource": "Use a different guardian"
+  },
+  "guardianAccountNotFound": {
+    "message": "We couldn't find your account on this guardian. Check the URL or import as a public account instead.",
+    "englishSource": "We couldn't find your account on this guardian. Check the URL or import as a public account instead."
+  },
   "default": {
     "message": "Default",
     "englishSource": "Default"
diff --git a/public/_locales/es/messages.json b/public/_locales/es/messages.json
index 2c9be56f5..b5bb44ead 100644
--- a/public/_locales/es/messages.json
+++ b/public/_locales/es/messages.json
@@ -406,6 +406,34 @@
     "message": "Ejecutando transacción",
     "englishSource": "Executing transaction"
   },
+  "transactionStageSwitching": {
+    "message": "Cambio de guardián",
+    "englishSource": "Switching guardian"
+  },
+  "transactionStageCreatingProposal": {
+    "message": "Creando propuesta",
+    "englishSource": "Creating proposal"
+  },
+  "transactionStageCreatingProposalDescription": {
+    "message": "Construyendo la propuesta de transacción para su tutor.",
+    "englishSource": "Building the transaction proposal for your guardian."
+  },
+  "transactionStageSigningProposal": {
+    "message": "Firma con tutor",
+    "englishSource": "Signing with guardian"
+  },
+  "transactionStageSigningProposalDescription": {
+    "message": "Su tutor firma la propuesta.",
+    "englishSource": "Your guardian is signing the proposal."
+  },
+  "transactionStageSubmitting": {
+    "message": "Presentando transacción",
+    "englishSource": "Submitting transaction"
+  },
+  "transactionStageSubmittingDescription": {
+    "message": "Envío de su transacción firmada a la red.",
+    "englishSource": "Sending your signed transaction to the network."
+  },
   "transactionStageConfirming": {
     "message": "Confirmando en cadena",
     "englishSource": "Confirming on chain"
@@ -414,6 +442,14 @@
     "message": "Esperando confirmación de red.",
     "englishSource": "Waiting for network confirmation."
   },
+  "transactionStageRegisteringGuardian": {
+    "message": "Registrarse con tutor",
+    "englishSource": "Registering with guardian"
+  },
+  "transactionStageRegisteringGuardianDescription": {
+    "message": "Registrar el estado de su cuenta con el nuevo tutor.",
+    "englishSource": "Registering your account state with the new guardian."
+  },
   "transactionStageDelivering": {
     "message": "Entregando note",
     "englishSource": "Delivering note"
@@ -1504,6 +1540,46 @@
     "message": "Archivo de billetera cifrado",
     "englishSource": "Encrypted Wallet File"
   },
+  "guardianBadge": {
+    "message": "Guardián",
+    "englishSource": "Guardian"
+  },
+  "guardianSettings": {
+    "message": "Configuración del guardián",
+    "englishSource": "Guardian Settings"
+  },
+  "currentGuardianEndpoint": {
+    "message": "Tutor actual",
+    "englishSource": "Current Guardian"
+  },
+  "newGuardianEndpoint": {
+    "message": "Nuevo punto final de Guardian",
+    "englishSource": "New Guardian Endpoint"
+  },
+  "switchGuardian": {
+    "message": "Cambiar guardián",
+    "englishSource": "Switch Guardian"
+  },
+  "switchGuardianDescription": {
+    "message": "Apunte su cuenta de Guardian a un nuevo punto final de Guardian. El cambio está firmado como una propuesta en cadena.",
+    "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
+  },
+  "switchingGuardian": {
+    "message": "Cambiando de guardián...",
+    "englishSource": "Switching guardian..."
+  },
+  "guardianSwitched": {
+    "message": "Guardian cambió con éxito.",
+    "englishSource": "Guardian switched successfully."
+  },
+  "guardianEndpointUnchanged": {
+    "message": "Ese ya es tu tutor actual.",
+    "englishSource": "That's already your current guardian."
+  },
+  "invalidUrl": {
+    "message": "Introduzca una URL válida que comience con http:// o https://",
+    "englishSource": "Enter a valid URL starting with http:// or https://"
+  },
   "encryptedWalletFileDescription": {
     "message": "Ingrese su contraseña para acceder a su archivo de billetera cifrado.",
     "englishSource": "Enter your password to access your Encrypted Wallet File."
@@ -1797,6 +1873,38 @@
     "message": "Recuperar una cuenta pública en cadena.",
     "englishSource": "Recover a public on-chain account."
   },
+  "importRecoveryMethodTitle": {
+    "message": "¿Cómo le gustaría recuperar esta billetera?",
+    "englishSource": "How would you like to recover this wallet?"
+  },
+  "importViaGuardian": {
+    "message": "Importar a través de Guardian",
+    "englishSource": "Import via Guardian"
+  },
+  "importViaGuardianDescription": {
+    "message": "Utilice un tutor para recuperar y firmar conjuntamente esta cuenta.",
+    "englishSource": "Use a guardian to recover and co-sign for this account."
+  },
+  "importPublicAccount": {
+    "message": "Importar cuenta pública",
+    "englishSource": "Import public account"
+  },
+  "importPublicAccountDescription": {
+    "message": "Importe la cuenta pública derivada de su seed phrase.",
+    "englishSource": "Import the public account derived from your seed phrase."
+  },
+  "guardianEndpoint": {
+    "message": "URL del guardián",
+    "englishSource": "Guardian URL"
+  },
+  "useDifferentGuardian": {
+    "message": "Utilice un tutor diferente",
+    "englishSource": "Use a different guardian"
+  },
+  "guardianAccountNotFound": {
+    "message": "No pudimos encontrar su cuenta en este guardián. En su lugar, verifique la URL o importe como una cuenta pública.",
+    "englishSource": "We couldn't find your account on this guardian. Check the URL or import as a public account instead."
+  },
   "default": {
     "message": "Por defecto",
     "englishSource": "Default"
diff --git a/public/_locales/fr/messages.json b/public/_locales/fr/messages.json
index 80ca34ad4..2e9c5fb1a 100644
--- a/public/_locales/fr/messages.json
+++ b/public/_locales/fr/messages.json
@@ -422,6 +422,34 @@
     "message": "Exécution de la transaction",
     "englishSource": "Executing transaction"
   },
+  "transactionStageSwitching": {
+    "message": "Changer de tuteur",
+    "englishSource": "Switching guardian"
+  },
+  "transactionStageCreatingProposal": {
+    "message": "Création d'une proposition",
+    "englishSource": "Creating proposal"
+  },
+  "transactionStageCreatingProposalDescription": {
+    "message": "Construire la proposition de transaction pour votre tuteur.",
+    "englishSource": "Building the transaction proposal for your guardian."
+  },
+  "transactionStageSigningProposal": {
+    "message": "Signature avec tuteur",
+    "englishSource": "Signing with guardian"
+  },
+  "transactionStageSigningProposalDescription": {
+    "message": "Votre tuteur signe la proposition.",
+    "englishSource": "Your guardian is signing the proposal."
+  },
+  "transactionStageSubmitting": {
+    "message": "Soumission de la transaction",
+    "englishSource": "Submitting transaction"
+  },
+  "transactionStageSubmittingDescription": {
+    "message": "Envoi de votre transaction signée au réseau.",
+    "englishSource": "Sending your signed transaction to the network."
+  },
   "transactionStageConfirming": {
     "message": "Confirmation en chaîne",
     "englishSource": "Confirming on chain"
@@ -430,6 +458,14 @@
     "message": "En attente de confirmation du réseau.",
     "englishSource": "Waiting for network confirmation."
   },
+  "transactionStageRegisteringGuardian": {
+    "message": "Inscription auprès du tuteur",
+    "englishSource": "Registering with guardian"
+  },
+  "transactionStageRegisteringGuardianDescription": {
+    "message": "Enregistrement de l'état de votre compte auprès du nouveau tuteur.",
+    "englishSource": "Registering your account state with the new guardian."
+  },
   "transactionStageDelivering": {
     "message": "Livraison de note",
     "englishSource": "Delivering note"
@@ -1561,6 +1597,46 @@
     "message": "Fichier de portefeuille crypté",
     "englishSource": "Encrypted Wallet File"
   },
+  "guardianBadge": {
+    "message": "Tuteur",
+    "englishSource": "Guardian"
+  },
+  "guardianSettings": {
+    "message": "Paramètres du tuteur",
+    "englishSource": "Guardian Settings"
+  },
+  "currentGuardianEndpoint": {
+    "message": "Tuteur actuel",
+    "englishSource": "Current Guardian"
+  },
+  "newGuardianEndpoint": {
+    "message": "Nouveau point de terminaison Guardian",
+    "englishSource": "New Guardian Endpoint"
+  },
+  "switchGuardian": {
+    "message": "Changer de gardien",
+    "englishSource": "Switch Guardian"
+  },
+  "switchGuardianDescription": {
+    "message": "Pointez votre compte Guardian vers un nouveau point de terminaison Guardian. Le changement est signé comme une proposition en chaîne.",
+    "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
+  },
+  "switchingGuardian": {
+    "message": "Changer de tuteur...",
+    "englishSource": "Switching guardian..."
+  },
+  "guardianSwitched": {
+    "message": "Le gardien a changé avec succès.",
+    "englishSource": "Guardian switched successfully."
+  },
+  "guardianEndpointUnchanged": {
+    "message": "C'est déjà votre tuteur actuel.",
+    "englishSource": "That's already your current guardian."
+  },
+  "invalidUrl": {
+    "message": "Saisissez une URL valide commençant par http:// ou https://",
+    "englishSource": "Enter a valid URL starting with http:// or https://"
+  },
   "encryptedWalletFileDescription": {
     "message": "Entrez votre mot de passe pour accéder à votre fichier de portefeuille crypté.",
     "englishSource": "Enter your password to access your Encrypted Wallet File."
@@ -1859,6 +1935,38 @@
     "message": "Récupérez un compte public en chaîne.",
     "englishSource": "Recover a public on-chain account."
   },
+  "importRecoveryMethodTitle": {
+    "message": "Comment souhaiteriez-vous récupérer ce portefeuille ?",
+    "englishSource": "How would you like to recover this wallet?"
+  },
+  "importViaGuardian": {
+    "message": "Importer via Guardian",
+    "englishSource": "Import via Guardian"
+  },
+  "importViaGuardianDescription": {
+    "message": "Utilisez un tuteur pour récupérer et co-signer ce compte.",
+    "englishSource": "Use a guardian to recover and co-sign for this account."
+  },
+  "importPublicAccount": {
+    "message": "Importer un compte public",
+    "englishSource": "Import public account"
+  },
+  "importPublicAccountDescription": {
+    "message": "Importez le compte public dérivé de votre seed phrase.",
+    "englishSource": "Import the public account derived from your seed phrase."
+  },
+  "guardianEndpoint": {
+    "message": "URL du tuteur",
+    "englishSource": "Guardian URL"
+  },
+  "useDifferentGuardian": {
+    "message": "Utiliser un autre tuteur",
+    "englishSource": "Use a different guardian"
+  },
+  "guardianAccountNotFound": {
+    "message": "Nous n'avons pas trouvé votre compte sur ce tuteur. Vérifiez l'URL ou importez plutôt en tant que compte public.",
+    "englishSource": "We couldn't find your account on this guardian. Check the URL or import as a public account instead."
+  },
   "default": {
     "message": "Défaut",
     "englishSource": "Default"
diff --git a/public/_locales/ja/messages.json b/public/_locales/ja/messages.json
index e5f9370ad..d06515c35 100644
--- a/public/_locales/ja/messages.json
+++ b/public/_locales/ja/messages.json
@@ -422,6 +422,34 @@
     "message": "トランザクションの実行中",
     "englishSource": "Executing transaction"
   },
+  "transactionStageSwitching": {
+    "message": "ガーディアンの切り替え",
+    "englishSource": "Switching guardian"
+  },
+  "transactionStageCreatingProposal": {
+    "message": "提案書の作成",
+    "englishSource": "Creating proposal"
+  },
+  "transactionStageCreatingProposalDescription": {
+    "message": "保護者向けの取引提案書を作成します。",
+    "englishSource": "Building the transaction proposal for your guardian."
+  },
+  "transactionStageSigningProposal": {
+    "message": "保護者とのサイン",
+    "englishSource": "Signing with guardian"
+  },
+  "transactionStageSigningProposalDescription": {
+    "message": "あなたの保護者が提案書に署名しています。",
+    "englishSource": "Your guardian is signing the proposal."
+  },
+  "transactionStageSubmitting": {
+    "message": "トランザクションの送信",
+    "englishSource": "Submitting transaction"
+  },
+  "transactionStageSubmittingDescription": {
+    "message": "署名されたトランザクションをネットワークに送信します。",
+    "englishSource": "Sending your signed transaction to the network."
+  },
   "transactionStageConfirming": {
     "message": "チェーンで確認中",
     "englishSource": "Confirming on chain"
@@ -430,6 +458,14 @@
     "message": "ネットワークの確認を待っています。",
     "englishSource": "Waiting for network confirmation."
   },
+  "transactionStageRegisteringGuardian": {
+    "message": "保護者への登録",
+    "englishSource": "Registering with guardian"
+  },
+  "transactionStageRegisteringGuardianDescription": {
+    "message": "新しい保護者にアカウントの状態を登録します。",
+    "englishSource": "Registering your account state with the new guardian."
+  },
   "transactionStageDelivering": {
     "message": "note を配信中",
     "englishSource": "Delivering note"
@@ -1562,6 +1598,46 @@
     "message": "暗号化されたウォレットファイル",
     "englishSource": "Encrypted Wallet File"
   },
+  "guardianBadge": {
+    "message": "ガーディアン",
+    "englishSource": "Guardian"
+  },
+  "guardianSettings": {
+    "message": "ガーディアンの設定",
+    "englishSource": "Guardian Settings"
+  },
+  "currentGuardianEndpoint": {
+    "message": "現在のガーディアン",
+    "englishSource": "Current Guardian"
+  },
+  "newGuardianEndpoint": {
+    "message": "新しいガーディアン エンドポイント",
+    "englishSource": "New Guardian Endpoint"
+  },
+  "switchGuardian": {
+    "message": "スイッチガーディアン",
+    "englishSource": "Switch Guardian"
+  },
+  "switchGuardianDescription": {
+    "message": "Guardian アカウントを新しいガーディアン エンドポイントに向けます。スイッチはオンチェーン プロポーザルとして署名されます。",
+    "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
+  },
+  "switchingGuardian": {
+    "message": "守護者を切り替えます...",
+    "englishSource": "Switching guardian..."
+  },
+  "guardianSwitched": {
+    "message": "ガーディアンが正常に切り替わりました。",
+    "englishSource": "Guardian switched successfully."
+  },
+  "guardianEndpointUnchanged": {
+    "message": "それはすでにあなたの現在の保護者です。",
+    "englishSource": "That's already your current guardian."
+  },
+  "invalidUrl": {
+    "message": "http:// または https:// で始まる有効な URL を入力してください",
+    "englishSource": "Enter a valid URL starting with http:// or https://"
+  },
   "encryptedWalletFileDescription": {
     "message": "パスワードを入力して、暗号化されたウォレット ファイルにアクセスします。",
     "englishSource": "Enter your password to access your Encrypted Wallet File."
@@ -1860,6 +1936,38 @@
     "message": "公開オンチェーン アカウントを回復します。",
     "englishSource": "Recover a public on-chain account."
   },
+  "importRecoveryMethodTitle": {
+    "message": "このウォレットをどのように復元しますか?",
+    "englishSource": "How would you like to recover this wallet?"
+  },
+  "importViaGuardian": {
+    "message": "Guardian 経由でインポートする",
+    "englishSource": "Import via Guardian"
+  },
+  "importViaGuardianDescription": {
+    "message": "保護者を使用してこのアカウントを回復し、共同署名してください。",
+    "englishSource": "Use a guardian to recover and co-sign for this account."
+  },
+  "importPublicAccount": {
+    "message": "パブリックアカウントをインポートする",
+    "englishSource": "Import public account"
+  },
+  "importPublicAccountDescription": {
+    "message": "seed phrase から派生した公開アカウントをインポートします。",
+    "englishSource": "Import the public account derived from your seed phrase."
+  },
+  "guardianEndpoint": {
+    "message": "ガーディアンのURL",
+    "englishSource": "Guardian URL"
+  },
+  "useDifferentGuardian": {
+    "message": "別のガーディアンを使用する",
+    "englishSource": "Use a different guardian"
+  },
+  "guardianAccountNotFound": {
+    "message": "このガーディアンであなたのアカウントが見つかりませんでした。 URL を確認するか、代わりにパブリック アカウントとしてインポートしてください。",
+    "englishSource": "We couldn't find your account on this guardian. Check the URL or import as a public account instead."
+  },
   "default": {
     "message": "デフォルト",
     "englishSource": "Default"
diff --git a/public/_locales/ko/messages.json b/public/_locales/ko/messages.json
index 104063f1a..e6ec479a9 100644
--- a/public/_locales/ko/messages.json
+++ b/public/_locales/ko/messages.json
@@ -422,6 +422,34 @@
     "message": "거래 실행 중",
     "englishSource": "Executing transaction"
   },
+  "transactionStageSwitching": {
+    "message": "보호자 전환",
+    "englishSource": "Switching guardian"
+  },
+  "transactionStageCreatingProposal": {
+    "message": "제안서 작성",
+    "englishSource": "Creating proposal"
+  },
+  "transactionStageCreatingProposalDescription": {
+    "message": "보호자를 위한 거래 제안서를 작성하세요.",
+    "englishSource": "Building the transaction proposal for your guardian."
+  },
+  "transactionStageSigningProposal": {
+    "message": "보호자와 서명",
+    "englishSource": "Signing with guardian"
+  },
+  "transactionStageSigningProposalDescription": {
+    "message": "보호자가 제안에 서명하고 있습니다.",
+    "englishSource": "Your guardian is signing the proposal."
+  },
+  "transactionStageSubmitting": {
+    "message": "거래 제출 중",
+    "englishSource": "Submitting transaction"
+  },
+  "transactionStageSubmittingDescription": {
+    "message": "서명된 거래를 네트워크로 보냅니다.",
+    "englishSource": "Sending your signed transaction to the network."
+  },
   "transactionStageConfirming": {
     "message": "체인에서 확인 중",
     "englishSource": "Confirming on chain"
@@ -430,6 +458,14 @@
     "message": "네트워크 확인을 기다리는 중입니다.",
     "englishSource": "Waiting for network confirmation."
   },
+  "transactionStageRegisteringGuardian": {
+    "message": "보호자 등록 중",
+    "englishSource": "Registering with guardian"
+  },
+  "transactionStageRegisteringGuardianDescription": {
+    "message": "새로운 보호자에게 계정 상태를 등록합니다.",
+    "englishSource": "Registering your account state with the new guardian."
+  },
   "transactionStageDelivering": {
     "message": "note 배달 중",
     "englishSource": "Delivering note"
@@ -1562,6 +1598,46 @@
     "message": "암호화된 지갑 파일",
     "englishSource": "Encrypted Wallet File"
   },
+  "guardianBadge": {
+    "message": "보호자",
+    "englishSource": "Guardian"
+  },
+  "guardianSettings": {
+    "message": "보호자 설정",
+    "englishSource": "Guardian Settings"
+  },
+  "currentGuardianEndpoint": {
+    "message": "현재 보호자",
+    "englishSource": "Current Guardian"
+  },
+  "newGuardianEndpoint": {
+    "message": "새로운 Guardian 엔드포인트",
+    "englishSource": "New Guardian Endpoint"
+  },
+  "switchGuardian": {
+    "message": "스위치 가디언",
+    "englishSource": "Switch Guardian"
+  },
+  "switchGuardianDescription": {
+    "message": "Guardian 계정을 새로운 Guardian 엔드포인트로 지정하세요. 스위치는 온체인 제안으로 서명됩니다.",
+    "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
+  },
+  "switchingGuardian": {
+    "message": "보호자를 바꾸는 중...",
+    "englishSource": "Switching guardian..."
+  },
+  "guardianSwitched": {
+    "message": "Guardian이 성공적으로 전환되었습니다.",
+    "englishSource": "Guardian switched successfully."
+  },
+  "guardianEndpointUnchanged": {
+    "message": "그 사람은 이미 현재 보호자입니다.",
+    "englishSource": "That's already your current guardian."
+  },
+  "invalidUrl": {
+    "message": "http:// 또는 https://로 시작하는 유효한 URL을 입력하세요.",
+    "englishSource": "Enter a valid URL starting with http:// or https://"
+  },
   "encryptedWalletFileDescription": {
     "message": "암호화된 지갑 파일에 접근하려면 비밀번호를 입력하세요.",
     "englishSource": "Enter your password to access your Encrypted Wallet File."
@@ -1860,6 +1936,38 @@
     "message": "공개 온체인 계정을 복구하세요.",
     "englishSource": "Recover a public on-chain account."
   },
+  "importRecoveryMethodTitle": {
+    "message": "이 지갑을 어떻게 복구하시겠습니까?",
+    "englishSource": "How would you like to recover this wallet?"
+  },
+  "importViaGuardian": {
+    "message": "Guardian을 통해 가져오기",
+    "englishSource": "Import via Guardian"
+  },
+  "importViaGuardianDescription": {
+    "message": "보호자를 통해 이 계정을 복구하고 공동 서명하세요.",
+    "englishSource": "Use a guardian to recover and co-sign for this account."
+  },
+  "importPublicAccount": {
+    "message": "공개 계정 가져오기",
+    "englishSource": "Import public account"
+  },
+  "importPublicAccountDescription": {
+    "message": "seed phrase에서 파생된 공개 계정을 가져옵니다.",
+    "englishSource": "Import the public account derived from your seed phrase."
+  },
+  "guardianEndpoint": {
+    "message": "보호자 URL",
+    "englishSource": "Guardian URL"
+  },
+  "useDifferentGuardian": {
+    "message": "다른 보호자를 사용하세요",
+    "englishSource": "Use a different guardian"
+  },
+  "guardianAccountNotFound": {
+    "message": "이 보호자에서 귀하의 계정을 찾을 수 없습니다. 대신 URL을 확인하거나 공개 계정으로 가져오세요.",
+    "englishSource": "We couldn't find your account on this guardian. Check the URL or import as a public account instead."
+  },
   "default": {
     "message": "기본",
     "englishSource": "Default"
diff --git a/public/_locales/pl/messages.json b/public/_locales/pl/messages.json
index 447662f25..f71f9ee88 100644
--- a/public/_locales/pl/messages.json
+++ b/public/_locales/pl/messages.json
@@ -406,6 +406,34 @@
     "message": "Wykonywanie transakcji",
     "englishSource": "Executing transaction"
   },
+  "transactionStageSwitching": {
+    "message": "Zmiana opiekuna",
+    "englishSource": "Switching guardian"
+  },
+  "transactionStageCreatingProposal": {
+    "message": "Tworzenie propozycji",
+    "englishSource": "Creating proposal"
+  },
+  "transactionStageCreatingProposalDescription": {
+    "message": "Budowanie propozycji transakcji dla Twojego opiekuna.",
+    "englishSource": "Building the transaction proposal for your guardian."
+  },
+  "transactionStageSigningProposal": {
+    "message": "Podpisanie z opiekunem",
+    "englishSource": "Signing with guardian"
+  },
+  "transactionStageSigningProposalDescription": {
+    "message": "Twój opiekun podpisuje propozycję.",
+    "englishSource": "Your guardian is signing the proposal."
+  },
+  "transactionStageSubmitting": {
+    "message": "Przesyłanie transakcji",
+    "englishSource": "Submitting transaction"
+  },
+  "transactionStageSubmittingDescription": {
+    "message": "Wysyłanie podpisanej transakcji do sieci.",
+    "englishSource": "Sending your signed transaction to the network."
+  },
   "transactionStageConfirming": {
     "message": "Potwierdzam na łańcuszku",
     "englishSource": "Confirming on chain"
@@ -414,6 +442,14 @@
     "message": "Czekam na potwierdzenie sieci.",
     "englishSource": "Waiting for network confirmation."
   },
+  "transactionStageRegisteringGuardian": {
+    "message": "Rejestracja u opiekuna",
+    "englishSource": "Registering with guardian"
+  },
+  "transactionStageRegisteringGuardianDescription": {
+    "message": "Rejestracja stanu konta u nowego opiekuna.",
+    "englishSource": "Registering your account state with the new guardian."
+  },
   "transactionStageDelivering": {
     "message": "Dostarczanie note",
     "englishSource": "Delivering note"
@@ -1504,6 +1540,46 @@
     "message": "Zaszyfrowany plik portfela",
     "englishSource": "Encrypted Wallet File"
   },
+  "guardianBadge": {
+    "message": "Opiekun",
+    "englishSource": "Guardian"
+  },
+  "guardianSettings": {
+    "message": "Ustawienia strażnika",
+    "englishSource": "Guardian Settings"
+  },
+  "currentGuardianEndpoint": {
+    "message": "Obecny Strażnik",
+    "englishSource": "Current Guardian"
+  },
+  "newGuardianEndpoint": {
+    "message": "Nowy punkt końcowy Guardiana",
+    "englishSource": "New Guardian Endpoint"
+  },
+  "switchGuardian": {
+    "message": "Przełącz Guardiana",
+    "englishSource": "Switch Guardian"
+  },
+  "switchGuardianDescription": {
+    "message": "Skieruj swoje konto Guardiana na nowy punkt końcowy opiekuna. Przełącznik jest podpisany jako propozycja on-chain.",
+    "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
+  },
+  "switchingGuardian": {
+    "message": "Zmiana opiekuna...",
+    "englishSource": "Switching guardian..."
+  },
+  "guardianSwitched": {
+    "message": "Guardian przełączył się pomyślnie.",
+    "englishSource": "Guardian switched successfully."
+  },
+  "guardianEndpointUnchanged": {
+    "message": "To już twój obecny opiekun.",
+    "englishSource": "That's already your current guardian."
+  },
+  "invalidUrl": {
+    "message": "Wprowadź prawidłowy adres URL zaczynający się od http:// lub https://",
+    "englishSource": "Enter a valid URL starting with http:// or https://"
+  },
   "encryptedWalletFileDescription": {
     "message": "Wprowadź hasło, aby uzyskać dostęp do zaszyfrowanego pliku portfela.",
     "englishSource": "Enter your password to access your Encrypted Wallet File."
@@ -1797,6 +1873,38 @@
     "message": "Odzyskaj publiczne konto w sieci.",
     "englishSource": "Recover a public on-chain account."
   },
+  "importRecoveryMethodTitle": {
+    "message": "Jak chcesz odzyskać ten portfel?",
+    "englishSource": "How would you like to recover this wallet?"
+  },
+  "importViaGuardian": {
+    "message": "Importuj przez Guardiana",
+    "englishSource": "Import via Guardian"
+  },
+  "importViaGuardianDescription": {
+    "message": "Użyj opiekuna, aby odzyskać konto i podpisać się na tym koncie.",
+    "englishSource": "Use a guardian to recover and co-sign for this account."
+  },
+  "importPublicAccount": {
+    "message": "Importuj konto publiczne",
+    "englishSource": "Import public account"
+  },
+  "importPublicAccountDescription": {
+    "message": "Zaimportuj konto publiczne pochodzące z Twojego seed phrase.",
+    "englishSource": "Import the public account derived from your seed phrase."
+  },
+  "guardianEndpoint": {
+    "message": "Adres URL opiekuna",
+    "englishSource": "Guardian URL"
+  },
+  "useDifferentGuardian": {
+    "message": "Użyj innego opiekuna",
+    "englishSource": "Use a different guardian"
+  },
+  "guardianAccountNotFound": {
+    "message": "Nie znaleźliśmy Twojego konta na tym opiekunie. Zamiast tego sprawdź adres URL lub zaimportuj jako konto publiczne.",
+    "englishSource": "We couldn't find your account on this guardian. Check the URL or import as a public account instead."
+  },
   "default": {
     "message": "Domyślny",
     "englishSource": "Default"
diff --git a/public/_locales/pt/messages.json b/public/_locales/pt/messages.json
index 872c7fe4a..25e3ef644 100644
--- a/public/_locales/pt/messages.json
+++ b/public/_locales/pt/messages.json
@@ -422,6 +422,34 @@
     "message": "Executando transação",
     "englishSource": "Executing transaction"
   },
+  "transactionStageSwitching": {
+    "message": "Trocando de guardião",
+    "englishSource": "Switching guardian"
+  },
+  "transactionStageCreatingProposal": {
+    "message": "Criando proposta",
+    "englishSource": "Creating proposal"
+  },
+  "transactionStageCreatingProposalDescription": {
+    "message": "Construindo a proposta de transação para seu responsável.",
+    "englishSource": "Building the transaction proposal for your guardian."
+  },
+  "transactionStageSigningProposal": {
+    "message": "Assinando com o responsável",
+    "englishSource": "Signing with guardian"
+  },
+  "transactionStageSigningProposalDescription": {
+    "message": "Seu tutor está assinando a proposta.",
+    "englishSource": "Your guardian is signing the proposal."
+  },
+  "transactionStageSubmitting": {
+    "message": "Enviando transação",
+    "englishSource": "Submitting transaction"
+  },
+  "transactionStageSubmittingDescription": {
+    "message": "Enviando sua transação assinada para a rede.",
+    "englishSource": "Sending your signed transaction to the network."
+  },
   "transactionStageConfirming": {
     "message": "Confirmando na cadeia",
     "englishSource": "Confirming on chain"
@@ -430,6 +458,14 @@
     "message": "Aguardando confirmação da rede.",
     "englishSource": "Waiting for network confirmation."
   },
+  "transactionStageRegisteringGuardian": {
+    "message": "Registrando-se com o responsável",
+    "englishSource": "Registering with guardian"
+  },
+  "transactionStageRegisteringGuardianDescription": {
+    "message": "Registrando o estado da sua conta com o novo guardião.",
+    "englishSource": "Registering your account state with the new guardian."
+  },
   "transactionStageDelivering": {
     "message": "Entregando note",
     "englishSource": "Delivering note"
@@ -1560,6 +1596,46 @@
     "message": "Arquivo de carteira criptografado",
     "englishSource": "Encrypted Wallet File"
   },
+  "guardianBadge": {
+    "message": "Guardião",
+    "englishSource": "Guardian"
+  },
+  "guardianSettings": {
+    "message": "Configurações do Guardião",
+    "englishSource": "Guardian Settings"
+  },
+  "currentGuardianEndpoint": {
+    "message": "Guardião Atual",
+    "englishSource": "Current Guardian"
+  },
+  "newGuardianEndpoint": {
+    "message": "Novo endpoint do Guardian",
+    "englishSource": "New Guardian Endpoint"
+  },
+  "switchGuardian": {
+    "message": "Trocar Guardião",
+    "englishSource": "Switch Guardian"
+  },
+  "switchGuardianDescription": {
+    "message": "Aponte sua conta do Guardian para um novo endpoint do Guardian. A mudança é assinada como uma proposta on-chain.",
+    "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
+  },
+  "switchingGuardian": {
+    "message": "Trocando de guardião...",
+    "englishSource": "Switching guardian..."
+  },
+  "guardianSwitched": {
+    "message": "Guardião trocado com sucesso.",
+    "englishSource": "Guardian switched successfully."
+  },
+  "guardianEndpointUnchanged": {
+    "message": "Esse já é seu guardião atual.",
+    "englishSource": "That's already your current guardian."
+  },
+  "invalidUrl": {
+    "message": "Insira um URL válido começando com http:// ou https://",
+    "englishSource": "Enter a valid URL starting with http:// or https://"
+  },
   "encryptedWalletFileDescription": {
     "message": "Digite sua senha para acessar seu arquivo criptografado da carteira.",
     "englishSource": "Enter your password to access your Encrypted Wallet File."
@@ -1858,6 +1934,38 @@
     "message": "Recupere uma conta pública na rede.",
     "englishSource": "Recover a public on-chain account."
   },
+  "importRecoveryMethodTitle": {
+    "message": "Como você gostaria de recuperar esta carteira?",
+    "englishSource": "How would you like to recover this wallet?"
+  },
+  "importViaGuardian": {
+    "message": "Importar via Guardian",
+    "englishSource": "Import via Guardian"
+  },
+  "importViaGuardianDescription": {
+    "message": "Use um responsável para recuperar e assinar esta conta.",
+    "englishSource": "Use a guardian to recover and co-sign for this account."
+  },
+  "importPublicAccount": {
+    "message": "Importar conta pública",
+    "englishSource": "Import public account"
+  },
+  "importPublicAccountDescription": {
+    "message": "Importe a conta pública derivada do seu seed phrase.",
+    "englishSource": "Import the public account derived from your seed phrase."
+  },
+  "guardianEndpoint": {
+    "message": "URL do Guardião",
+    "englishSource": "Guardian URL"
+  },
+  "useDifferentGuardian": {
+    "message": "Use um guardião diferente",
+    "englishSource": "Use a different guardian"
+  },
+  "guardianAccountNotFound": {
+    "message": "Não foi possível encontrar sua conta neste responsável. Verifique o URL ou importe como uma conta pública.",
+    "englishSource": "We couldn't find your account on this guardian. Check the URL or import as a public account instead."
+  },
   "default": {
     "message": "Padrão",
     "englishSource": "Default"
diff --git a/public/_locales/ru/messages.json b/public/_locales/ru/messages.json
index d3c987c0c..bf683ae3d 100644
--- a/public/_locales/ru/messages.json
+++ b/public/_locales/ru/messages.json
@@ -422,6 +422,34 @@
     "message": "Выполнение транзакции",
     "englishSource": "Executing transaction"
   },
+  "transactionStageSwitching": {
+    "message": "Переключение опекуна",
+    "englishSource": "Switching guardian"
+  },
+  "transactionStageCreatingProposal": {
+    "message": "Создание предложения",
+    "englishSource": "Creating proposal"
+  },
+  "transactionStageCreatingProposalDescription": {
+    "message": "Составление предложения по сделке для вашего опекуна.",
+    "englishSource": "Building the transaction proposal for your guardian."
+  },
+  "transactionStageSigningProposal": {
+    "message": "Подписание с опекуном",
+    "englishSource": "Signing with guardian"
+  },
+  "transactionStageSigningProposalDescription": {
+    "message": "Ваш опекун подписывает предложение.",
+    "englishSource": "Your guardian is signing the proposal."
+  },
+  "transactionStageSubmitting": {
+    "message": "Отправка транзакции",
+    "englishSource": "Submitting transaction"
+  },
+  "transactionStageSubmittingDescription": {
+    "message": "Отправка подписанной транзакции в сеть.",
+    "englishSource": "Sending your signed transaction to the network."
+  },
   "transactionStageConfirming": {
     "message": "Подтверждение в цепочке",
     "englishSource": "Confirming on chain"
@@ -430,6 +458,14 @@
     "message": "Ожидание подтверждения сети.",
     "englishSource": "Waiting for network confirmation."
   },
+  "transactionStageRegisteringGuardian": {
+    "message": "Регистрация у опекуна",
+    "englishSource": "Registering with guardian"
+  },
+  "transactionStageRegisteringGuardianDescription": {
+    "message": "Регистрация состояния вашей учетной записи у нового опекуна.",
+    "englishSource": "Registering your account state with the new guardian."
+  },
   "transactionStageDelivering": {
     "message": "Доставка note",
     "englishSource": "Delivering note"
@@ -1563,6 +1599,46 @@
     "message": "Зашифрованный файл кошелька",
     "englishSource": "Encrypted Wallet File"
   },
+  "guardianBadge": {
+    "message": "Хранитель",
+    "englishSource": "Guardian"
+  },
+  "guardianSettings": {
+    "message": "Настройки стража",
+    "englishSource": "Guardian Settings"
+  },
+  "currentGuardianEndpoint": {
+    "message": "Текущий страж",
+    "englishSource": "Current Guardian"
+  },
+  "newGuardianEndpoint": {
+    "message": "Новая конечная точка Стража",
+    "englishSource": "New Guardian Endpoint"
+  },
+  "switchGuardian": {
+    "message": "Переключить стража",
+    "englishSource": "Switch Guardian"
+  },
+  "switchGuardianDescription": {
+    "message": "Направьте свою учетную запись Guardian на новую конечную точку Guardian. Переключатель подписывается как предложение в цепочке.",
+    "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
+  },
+  "switchingGuardian": {
+    "message": "Смена опекуна...",
+    "englishSource": "Switching guardian..."
+  },
+  "guardianSwitched": {
+    "message": "Guardian успешно переключился.",
+    "englishSource": "Guardian switched successfully."
+  },
+  "guardianEndpointUnchanged": {
+    "message": "Это уже ваш нынешний опекун.",
+    "englishSource": "That's already your current guardian."
+  },
+  "invalidUrl": {
+    "message": "Введите действительный URL-адрес, начинающийся с http:// или https://.",
+    "englishSource": "Enter a valid URL starting with http:// or https://"
+  },
   "encryptedWalletFileDescription": {
     "message": "Введите свой пароль для доступа к вашему зашифрованному файлу кошелька.",
     "englishSource": "Enter your password to access your Encrypted Wallet File."
@@ -1861,6 +1937,38 @@
     "message": "Восстановите общедоступную учетную запись в сети.",
     "englishSource": "Recover a public on-chain account."
   },
+  "importRecoveryMethodTitle": {
+    "message": "Как бы вы хотели восстановить этот кошелек?",
+    "englishSource": "How would you like to recover this wallet?"
+  },
+  "importViaGuardian": {
+    "message": "Импорт через Guardian",
+    "englishSource": "Import via Guardian"
+  },
+  "importViaGuardianDescription": {
+    "message": "Используйте опекуна для восстановления и совместного подписания этой учетной записи.",
+    "englishSource": "Use a guardian to recover and co-sign for this account."
+  },
+  "importPublicAccount": {
+    "message": "Импортировать общедоступный аккаунт",
+    "englishSource": "Import public account"
+  },
+  "importPublicAccountDescription": {
+    "message": "Импортируйте общедоступную учетную запись, полученную из вашего seed phrase.",
+    "englishSource": "Import the public account derived from your seed phrase."
+  },
+  "guardianEndpoint": {
+    "message": "URL-адрес хранителя",
+    "englishSource": "Guardian URL"
+  },
+  "useDifferentGuardian": {
+    "message": "Используйте другого опекуна",
+    "englishSource": "Use a different guardian"
+  },
+  "guardianAccountNotFound": {
+    "message": "Нам не удалось найти вашу учетную запись на этом опекуне. Вместо этого проверьте URL-адрес или импортируйте его как общедоступную учетную запись.",
+    "englishSource": "We couldn't find your account on this guardian. Check the URL or import as a public account instead."
+  },
   "default": {
     "message": "По умолчанию",
     "englishSource": "Default"
diff --git a/public/_locales/tr/messages.json b/public/_locales/tr/messages.json
index 97522d4f5..aa3d8a2cb 100644
--- a/public/_locales/tr/messages.json
+++ b/public/_locales/tr/messages.json
@@ -422,6 +422,34 @@
     "message": "İşlem yürütülüyor",
     "englishSource": "Executing transaction"
   },
+  "transactionStageSwitching": {
+    "message": "Vasi değiştiriliyor",
+    "englishSource": "Switching guardian"
+  },
+  "transactionStageCreatingProposal": {
+    "message": "Teklif oluşturuluyor",
+    "englishSource": "Creating proposal"
+  },
+  "transactionStageCreatingProposalDescription": {
+    "message": "Vasiniz için işlem teklifini oluşturmak.",
+    "englishSource": "Building the transaction proposal for your guardian."
+  },
+  "transactionStageSigningProposal": {
+    "message": "Vasi ile imza atmak",
+    "englishSource": "Signing with guardian"
+  },
+  "transactionStageSigningProposalDescription": {
+    "message": "Vasiniz teklifi imzalıyor.",
+    "englishSource": "Your guardian is signing the proposal."
+  },
+  "transactionStageSubmitting": {
+    "message": "İşlem gönderiliyor",
+    "englishSource": "Submitting transaction"
+  },
+  "transactionStageSubmittingDescription": {
+    "message": "İmzalı işleminiz ağa gönderiliyor.",
+    "englishSource": "Sending your signed transaction to the network."
+  },
   "transactionStageConfirming": {
     "message": "Zincirde onaylanıyor",
     "englishSource": "Confirming on chain"
@@ -430,6 +458,14 @@
     "message": "Ağ onayı bekleniyor.",
     "englishSource": "Waiting for network confirmation."
   },
+  "transactionStageRegisteringGuardian": {
+    "message": "Vasiye kaydolmak",
+    "englishSource": "Registering with guardian"
+  },
+  "transactionStageRegisteringGuardianDescription": {
+    "message": "Hesap durumunuz yeni vasiye kaydediliyor.",
+    "englishSource": "Registering your account state with the new guardian."
+  },
   "transactionStageDelivering": {
     "message": "note teslim ediliyor",
     "englishSource": "Delivering note"
@@ -1562,6 +1598,46 @@
     "message": "Şifreli Cüzdan Dosyası",
     "englishSource": "Encrypted Wallet File"
   },
+  "guardianBadge": {
+    "message": "Gardiyan",
+    "englishSource": "Guardian"
+  },
+  "guardianSettings": {
+    "message": "Gözetmen Ayarları",
+    "englishSource": "Guardian Settings"
+  },
+  "currentGuardianEndpoint": {
+    "message": "Mevcut Gardiyan",
+    "englishSource": "Current Guardian"
+  },
+  "newGuardianEndpoint": {
+    "message": "Yeni Guardian Uç Noktası",
+    "englishSource": "New Guardian Endpoint"
+  },
+  "switchGuardian": {
+    "message": "Anahtar Koruması",
+    "englishSource": "Switch Guardian"
+  },
+  "switchGuardianDescription": {
+    "message": "Guardian hesabınızı yeni bir koruyucu uç noktasına yönlendirin. Anahtar, zincir içi bir teklif olarak imzalandı.",
+    "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
+  },
+  "switchingGuardian": {
+    "message": "Vasi değiştiriliyor...",
+    "englishSource": "Switching guardian..."
+  },
+  "guardianSwitched": {
+    "message": "Guardian başarıyla geçiş yaptı.",
+    "englishSource": "Guardian switched successfully."
+  },
+  "guardianEndpointUnchanged": {
+    "message": "Bu zaten sizin şu anki vasiniz.",
+    "englishSource": "That's already your current guardian."
+  },
+  "invalidUrl": {
+    "message": "http:// veya https:// ile başlayan geçerli bir URL girin",
+    "englishSource": "Enter a valid URL starting with http:// or https://"
+  },
   "encryptedWalletFileDescription": {
     "message": "Şifreli Cüzdan Dosyanıza erişmek için şifrenizi girin.",
     "englishSource": "Enter your password to access your Encrypted Wallet File."
@@ -1860,6 +1936,38 @@
     "message": "Herkese açık bir zincir içi hesabı kurtarın.",
     "englishSource": "Recover a public on-chain account."
   },
+  "importRecoveryMethodTitle": {
+    "message": "Bu cüzdanı nasıl kurtarmak istersiniz?",
+    "englishSource": "How would you like to recover this wallet?"
+  },
+  "importViaGuardian": {
+    "message": "Guardian aracılığıyla içe aktar",
+    "englishSource": "Import via Guardian"
+  },
+  "importViaGuardianDescription": {
+    "message": "Bu hesabı kurtarmak ve birlikte imza atmak için bir veli kullanın.",
+    "englishSource": "Use a guardian to recover and co-sign for this account."
+  },
+  "importPublicAccount": {
+    "message": "Herkese açık hesabı içe aktar",
+    "englishSource": "Import public account"
+  },
+  "importPublicAccountDescription": {
+    "message": "seed phrase hesabınızdan türetilen genel hesabı içe aktarın.",
+    "englishSource": "Import the public account derived from your seed phrase."
+  },
+  "guardianEndpoint": {
+    "message": "Veli URL'si",
+    "englishSource": "Guardian URL"
+  },
+  "useDifferentGuardian": {
+    "message": "Farklı bir veli kullan",
+    "englishSource": "Use a different guardian"
+  },
+  "guardianAccountNotFound": {
+    "message": "Bu velide hesabınızı bulamadık. URL'yi kontrol edin veya bunun yerine herkese açık bir hesap olarak içe aktarın.",
+    "englishSource": "We couldn't find your account on this guardian. Check the URL or import as a public account instead."
+  },
   "default": {
     "message": "Varsayılan",
     "englishSource": "Default"
diff --git a/public/_locales/uk/messages.json b/public/_locales/uk/messages.json
index f14adef1c..e777f5888 100644
--- a/public/_locales/uk/messages.json
+++ b/public/_locales/uk/messages.json
@@ -422,6 +422,34 @@
     "message": "Виконання транзакції",
     "englishSource": "Executing transaction"
   },
+  "transactionStageSwitching": {
+    "message": "Зміна опікуна",
+    "englishSource": "Switching guardian"
+  },
+  "transactionStageCreatingProposal": {
+    "message": "Створення пропозиції",
+    "englishSource": "Creating proposal"
+  },
+  "transactionStageCreatingProposalDescription": {
+    "message": "Створення пропозиції транзакції для вашого опікуна.",
+    "englishSource": "Building the transaction proposal for your guardian."
+  },
+  "transactionStageSigningProposal": {
+    "message": "Підписання з опікуном",
+    "englishSource": "Signing with guardian"
+  },
+  "transactionStageSigningProposalDescription": {
+    "message": "Ваш опікун підписує пропозицію.",
+    "englishSource": "Your guardian is signing the proposal."
+  },
+  "transactionStageSubmitting": {
+    "message": "Подання транзакції",
+    "englishSource": "Submitting transaction"
+  },
+  "transactionStageSubmittingDescription": {
+    "message": "Надсилання підписаної транзакції в мережу.",
+    "englishSource": "Sending your signed transaction to the network."
+  },
   "transactionStageConfirming": {
     "message": "Підтвердження по ланцюжку",
     "englishSource": "Confirming on chain"
@@ -430,6 +458,14 @@
     "message": "Очікування підтвердження мережі.",
     "englishSource": "Waiting for network confirmation."
   },
+  "transactionStageRegisteringGuardian": {
+    "message": "Реєстрація в опікуна",
+    "englishSource": "Registering with guardian"
+  },
+  "transactionStageRegisteringGuardianDescription": {
+    "message": "Реєстрація стану вашого облікового запису у нового опікуна.",
+    "englishSource": "Registering your account state with the new guardian."
+  },
   "transactionStageDelivering": {
     "message": "Доставка note",
     "englishSource": "Delivering note"
@@ -1563,6 +1599,46 @@
     "message": "Зашифрований файл гаманця",
     "englishSource": "Encrypted Wallet File"
   },
+  "guardianBadge": {
+    "message": "Опікун",
+    "englishSource": "Guardian"
+  },
+  "guardianSettings": {
+    "message": "Налаштування опікуна",
+    "englishSource": "Guardian Settings"
+  },
+  "currentGuardianEndpoint": {
+    "message": "Поточний опікун",
+    "englishSource": "Current Guardian"
+  },
+  "newGuardianEndpoint": {
+    "message": "Нова кінцева точка Guardian",
+    "englishSource": "New Guardian Endpoint"
+  },
+  "switchGuardian": {
+    "message": "Switch Guardian",
+    "englishSource": "Switch Guardian"
+  },
+  "switchGuardianDescription": {
+    "message": "Направте свій обліковий запис Guardian на нову кінцеву точку опікуна. Комутатор підписаний як пропозиція в ланцюжку.",
+    "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
+  },
+  "switchingGuardian": {
+    "message": "Зміна опікуна...",
+    "englishSource": "Switching guardian..."
+  },
+  "guardianSwitched": {
+    "message": "Опікун перейшов успішно.",
+    "englishSource": "Guardian switched successfully."
+  },
+  "guardianEndpointUnchanged": {
+    "message": "Це вже ваш поточний опікун.",
+    "englishSource": "That's already your current guardian."
+  },
+  "invalidUrl": {
+    "message": "Введіть дійсну URL-адресу, яка починається з http:// або https://",
+    "englishSource": "Enter a valid URL starting with http:// or https://"
+  },
   "encryptedWalletFileDescription": {
     "message": "Введіть свій пароль, щоб отримати доступ до зашифрованого файлу гаманця.",
     "englishSource": "Enter your password to access your Encrypted Wallet File."
@@ -1861,6 +1937,38 @@
     "message": "Відновіть загальнодоступний обліковий запис у мережі.",
     "englishSource": "Recover a public on-chain account."
   },
+  "importRecoveryMethodTitle": {
+    "message": "Як би ви хотіли відновити цей гаманець?",
+    "englishSource": "How would you like to recover this wallet?"
+  },
+  "importViaGuardian": {
+    "message": "Імпортувати через Guardian",
+    "englishSource": "Import via Guardian"
+  },
+  "importViaGuardianDescription": {
+    "message": "Скористайтеся опікуном, щоб відновити та підписати цей обліковий запис.",
+    "englishSource": "Use a guardian to recover and co-sign for this account."
+  },
+  "importPublicAccount": {
+    "message": "Імпорт публічного облікового запису",
+    "englishSource": "Import public account"
+  },
+  "importPublicAccountDescription": {
+    "message": "Імпортуйте публічний обліковий запис, отриманий із вашого seed phrase.",
+    "englishSource": "Import the public account derived from your seed phrase."
+  },
+  "guardianEndpoint": {
+    "message": "URL-адреса опікуна",
+    "englishSource": "Guardian URL"
+  },
+  "useDifferentGuardian": {
+    "message": "Використовуйте іншого опікуна",
+    "englishSource": "Use a different guardian"
+  },
+  "guardianAccountNotFound": {
+    "message": "Нам не вдалося знайти ваш обліковий запис у цього опікуна. Перевірте URL-адресу або імпортуйте як публічний обліковий запис.",
+    "englishSource": "We couldn't find your account on this guardian. Check the URL or import as a public account instead."
+  },
   "default": {
     "message": "За замовчуванням",
     "englishSource": "Default"
diff --git a/public/_locales/zh_CN/messages.json b/public/_locales/zh_CN/messages.json
index 11a8b807e..d292ec280 100644
--- a/public/_locales/zh_CN/messages.json
+++ b/public/_locales/zh_CN/messages.json
@@ -422,6 +422,34 @@
     "message": "执行交易",
     "englishSource": "Executing transaction"
   },
+  "transactionStageSwitching": {
+    "message": "切换监护人",
+    "englishSource": "Switching guardian"
+  },
+  "transactionStageCreatingProposal": {
+    "message": "创建提案",
+    "englishSource": "Creating proposal"
+  },
+  "transactionStageCreatingProposalDescription": {
+    "message": "为您的监护人制定交易建议。",
+    "englishSource": "Building the transaction proposal for your guardian."
+  },
+  "transactionStageSigningProposal": {
+    "message": "与监护人签字",
+    "englishSource": "Signing with guardian"
+  },
+  "transactionStageSigningProposalDescription": {
+    "message": "您的监护人正在签署该提案。",
+    "englishSource": "Your guardian is signing the proposal."
+  },
+  "transactionStageSubmitting": {
+    "message": "提交交易",
+    "englishSource": "Submitting transaction"
+  },
+  "transactionStageSubmittingDescription": {
+    "message": "将您签名的交易发送到网络。",
+    "englishSource": "Sending your signed transaction to the network."
+  },
   "transactionStageConfirming": {
     "message": "链上确认",
     "englishSource": "Confirming on chain"
@@ -430,6 +458,14 @@
     "message": "等待网络确认。",
     "englishSource": "Waiting for network confirmation."
   },
+  "transactionStageRegisteringGuardian": {
+    "message": "与监护人一起登记",
+    "englishSource": "Registering with guardian"
+  },
+  "transactionStageRegisteringGuardianDescription": {
+    "message": "向新监护人注册您的帐户状态。",
+    "englishSource": "Registering your account state with the new guardian."
+  },
   "transactionStageDelivering": {
     "message": "正在传送note",
     "englishSource": "Delivering note"
@@ -1562,6 +1598,46 @@
     "message": "加密钱包文件",
     "englishSource": "Encrypted Wallet File"
   },
+  "guardianBadge": {
+    "message": "监护人",
+    "englishSource": "Guardian"
+  },
+  "guardianSettings": {
+    "message": "监护人设置",
+    "englishSource": "Guardian Settings"
+  },
+  "currentGuardianEndpoint": {
+    "message": "现任监护人",
+    "englishSource": "Current Guardian"
+  },
+  "newGuardianEndpoint": {
+    "message": "新的守护者端点",
+    "englishSource": "New Guardian Endpoint"
+  },
+  "switchGuardian": {
+    "message": "开关守护者",
+    "englishSource": "Switch Guardian"
+  },
+  "switchGuardianDescription": {
+    "message": "将您的监护人帐户指向新的监护人端点。该切换被签署为链上提案。",
+    "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
+  },
+  "switchingGuardian": {
+    "message": "切换监护人...",
+    "englishSource": "Switching guardian..."
+  },
+  "guardianSwitched": {
+    "message": "守护者切换成功。",
+    "englishSource": "Guardian switched successfully."
+  },
+  "guardianEndpointUnchanged": {
+    "message": "那已经是你现在的监护人了。",
+    "englishSource": "That's already your current guardian."
+  },
+  "invalidUrl": {
+    "message": "输入以 http:// 或 https:// 开头的有效 URL",
+    "englishSource": "Enter a valid URL starting with http:// or https://"
+  },
   "encryptedWalletFileDescription": {
     "message": "输入您的密码以访问您的加密钱包文件。",
     "englishSource": "Enter your password to access your Encrypted Wallet File."
@@ -1860,6 +1936,38 @@
     "message": "恢复公共链上账户。",
     "englishSource": "Recover a public on-chain account."
   },
+  "importRecoveryMethodTitle": {
+    "message": "您想如何找回这个钱包？",
+    "englishSource": "How would you like to recover this wallet?"
+  },
+  "importViaGuardian": {
+    "message": "通过 Guardian 导入",
+    "englishSource": "Import via Guardian"
+  },
+  "importViaGuardianDescription": {
+    "message": "使用监护人来恢复并共同签署此帐户。",
+    "englishSource": "Use a guardian to recover and co-sign for this account."
+  },
+  "importPublicAccount": {
+    "message": "导入公众号",
+    "englishSource": "Import public account"
+  },
+  "importPublicAccountDescription": {
+    "message": "导入从您的 seed phrase 派生的公共帐户。",
+    "englishSource": "Import the public account derived from your seed phrase."
+  },
+  "guardianEndpoint": {
+    "message": "监护人网址",
+    "englishSource": "Guardian URL"
+  },
+  "useDifferentGuardian": {
+    "message": "使用不同的监护人",
+    "englishSource": "Use a different guardian"
+  },
+  "guardianAccountNotFound": {
+    "message": "我们在该监护人上找不到您的帐户。请检查 URL 或导入为公共帐户。",
+    "englishSource": "We couldn't find your account on this guardian. Check the URL or import as a public account instead."
+  },
   "default": {
     "message": "默认",
     "englishSource": "Default"
diff --git a/public/_locales/zh_TW/messages.json b/public/_locales/zh_TW/messages.json
index a3c83acf2..092e39b6d 100644
--- a/public/_locales/zh_TW/messages.json
+++ b/public/_locales/zh_TW/messages.json
@@ -422,6 +422,34 @@
     "message": "执行交易",
     "englishSource": "Executing transaction"
   },
+  "transactionStageSwitching": {
+    "message": "切换监护人",
+    "englishSource": "Switching guardian"
+  },
+  "transactionStageCreatingProposal": {
+    "message": "创建提案",
+    "englishSource": "Creating proposal"
+  },
+  "transactionStageCreatingProposalDescription": {
+    "message": "为您的监护人制定交易建议。",
+    "englishSource": "Building the transaction proposal for your guardian."
+  },
+  "transactionStageSigningProposal": {
+    "message": "与监护人签字",
+    "englishSource": "Signing with guardian"
+  },
+  "transactionStageSigningProposalDescription": {
+    "message": "您的监护人正在签署该提案。",
+    "englishSource": "Your guardian is signing the proposal."
+  },
+  "transactionStageSubmitting": {
+    "message": "提交交易",
+    "englishSource": "Submitting transaction"
+  },
+  "transactionStageSubmittingDescription": {
+    "message": "将您签名的交易发送到网络。",
+    "englishSource": "Sending your signed transaction to the network."
+  },
   "transactionStageConfirming": {
     "message": "链上确认",
     "englishSource": "Confirming on chain"
@@ -430,6 +458,14 @@
     "message": "等待网络确认。",
     "englishSource": "Waiting for network confirmation."
   },
+  "transactionStageRegisteringGuardian": {
+    "message": "与监护人一起登记",
+    "englishSource": "Registering with guardian"
+  },
+  "transactionStageRegisteringGuardianDescription": {
+    "message": "向新监护人注册您的帐户状态。",
+    "englishSource": "Registering your account state with the new guardian."
+  },
   "transactionStageDelivering": {
     "message": "正在传送note",
     "englishSource": "Delivering note"
@@ -1562,6 +1598,46 @@
     "message": "加密钱包文件",
     "englishSource": "Encrypted Wallet File"
   },
+  "guardianBadge": {
+    "message": "监护人",
+    "englishSource": "Guardian"
+  },
+  "guardianSettings": {
+    "message": "监护人设置",
+    "englishSource": "Guardian Settings"
+  },
+  "currentGuardianEndpoint": {
+    "message": "现任监护人",
+    "englishSource": "Current Guardian"
+  },
+  "newGuardianEndpoint": {
+    "message": "新的守护者端点",
+    "englishSource": "New Guardian Endpoint"
+  },
+  "switchGuardian": {
+    "message": "开关守护者",
+    "englishSource": "Switch Guardian"
+  },
+  "switchGuardianDescription": {
+    "message": "将您的监护人帐户指向新的监护人端点。该切换被签署为链上提案。",
+    "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
+  },
+  "switchingGuardian": {
+    "message": "切换监护人...",
+    "englishSource": "Switching guardian..."
+  },
+  "guardianSwitched": {
+    "message": "守护者切换成功。",
+    "englishSource": "Guardian switched successfully."
+  },
+  "guardianEndpointUnchanged": {
+    "message": "那已经是你现在的监护人了。",
+    "englishSource": "That's already your current guardian."
+  },
+  "invalidUrl": {
+    "message": "输入以 http:// 或 https:// 开头的有效 URL",
+    "englishSource": "Enter a valid URL starting with http:// or https://"
+  },
   "encryptedWalletFileDescription": {
     "message": "输入您的密码以访问您的加密钱包文件。",
     "englishSource": "Enter your password to access your Encrypted Wallet File."
@@ -1860,6 +1936,38 @@
     "message": "恢复公共链上账户。",
     "englishSource": "Recover a public on-chain account."
   },
+  "importRecoveryMethodTitle": {
+    "message": "您想如何找回这个钱包？",
+    "englishSource": "How would you like to recover this wallet?"
+  },
+  "importViaGuardian": {
+    "message": "通过 Guardian 导入",
+    "englishSource": "Import via Guardian"
+  },
+  "importViaGuardianDescription": {
+    "message": "使用监护人来恢复并共同签署此帐户。",
+    "englishSource": "Use a guardian to recover and co-sign for this account."
+  },
+  "importPublicAccount": {
+    "message": "导入公众号",
+    "englishSource": "Import public account"
+  },
+  "importPublicAccountDescription": {
+    "message": "导入从您的 seed phrase 派生的公共帐户。",
+    "englishSource": "Import the public account derived from your seed phrase."
+  },
+  "guardianEndpoint": {
+    "message": "监护人网址",
+    "englishSource": "Guardian URL"
+  },
+  "useDifferentGuardian": {
+    "message": "使用不同的监护人",
+    "englishSource": "Use a different guardian"
+  },
+  "guardianAccountNotFound": {
+    "message": "我们在该监护人上找不到您的帐户。请检查 URL 或导入为公共帐户。",
+    "englishSource": "We couldn't find your account on this guardian. Check the URL or import as a public account instead."
+  },
   "default": {
     "message": "默认",
     "englishSource": "Default"

From 68e8c2ca49ae03b3c0087589a43a49173d61b6e0 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Thu, 23 Apr 2026 17:59:41 +0530
Subject: [PATCH 25/71] test: mock openzeppelin packages and update test
 signatures after merge

---
 __mocks__/@openzeppelin/guardian-client.ts    | 19 ++++++
 .../@openzeppelin/miden-multisig-client.ts    | 64 +++++++++++++++++++
 jest.config.ts                                |  4 +-
 src/lib/intercom/mobile-adapter.test.ts       |  3 +-
 src/lib/miden/activity/transactions.test.ts   | 13 +++-
 src/lib/miden/back/main.test.ts               |  3 +-
 src/lib/miden/back/vault.test.ts              |  4 ++
 src/lib/store/index.test.ts                   |  9 +++
 8 files changed, 113 insertions(+), 6 deletions(-)
 create mode 100644 __mocks__/@openzeppelin/guardian-client.ts
 create mode 100644 __mocks__/@openzeppelin/miden-multisig-client.ts

diff --git a/__mocks__/@openzeppelin/guardian-client.ts b/__mocks__/@openzeppelin/guardian-client.ts
new file mode 100644
index 000000000..607da0407
--- /dev/null
+++ b/__mocks__/@openzeppelin/guardian-client.ts
@@ -0,0 +1,19 @@
+/**
+ * Automatic mock for @openzeppelin/guardian-client.
+ *
+ * ESM package pulled in transitively by guardian/signer.ts and guardian/digest.ts.
+ */
+
+export class GuardianHttpClient {
+  constructor(..._args: unknown[]) {}
+  setSigner = jest.fn();
+  getState = jest.fn();
+  getPubkey = jest.fn();
+}
+
+export class GuardianHttpError extends Error {}
+
+export class RequestAuthPayload {
+  constructor(..._args: unknown[]) {}
+  toWord = jest.fn(() => new Uint8Array(32));
+}
diff --git a/__mocks__/@openzeppelin/miden-multisig-client.ts b/__mocks__/@openzeppelin/miden-multisig-client.ts
new file mode 100644
index 000000000..5fccf4855
--- /dev/null
+++ b/__mocks__/@openzeppelin/miden-multisig-client.ts
@@ -0,0 +1,64 @@
+/**
+ * Automatic mock for @openzeppelin/miden-multisig-client.
+ *
+ * The real package is ESM (type: "module") and pulls in WASM-bound classes
+ * that jsdom can't exec. Tests don't exercise the multisig flow — they just
+ * need the module to load when guardian/front code is transitively imported.
+ */
+
+export class MultisigClient {
+  constructor(..._args: unknown[]) {}
+  load = jest.fn();
+}
+
+export class Multisig {
+  accountId = '';
+  account = null;
+  createP2idProposal = jest.fn();
+  createConsumeNotesProposal = jest.fn();
+  createProposal = jest.fn();
+  createTransactionProposalRequest = jest.fn();
+  signProposal = jest.fn();
+  executeProposal = jest.fn();
+  syncState = jest.fn();
+  nonce = jest.fn(() => ({ asInt: () => 0n }));
+}
+
+export class AccountInspector {
+  constructor(..._args: unknown[]) {}
+}
+
+export class GuardianHttpClient {
+  constructor(..._args: unknown[]) {}
+  setSigner = jest.fn();
+  getState = jest.fn();
+  getPubkey = jest.fn();
+}
+
+export class GuardianHttpError extends Error {}
+
+export class FalconSigner {
+  constructor(..._args: unknown[]) {}
+}
+
+export class EcdsaSigner {
+  constructor(..._args: unknown[]) {}
+}
+
+export class ParaSigner {
+  constructor(..._args: unknown[]) {}
+}
+
+export class MidenWalletSigner {
+  constructor(..._args: unknown[]) {}
+}
+
+export const createMultisigAccount = jest.fn();
+export const validateMultisigConfig = jest.fn();
+export const buildMultisigStorageSlots = jest.fn();
+export const buildGuardianStorageSlots = jest.fn();
+export const storageLayoutBuilder = jest.fn();
+
+export class StorageLayoutBuilder {
+  constructor(..._args: unknown[]) {}
+}
diff --git a/jest.config.ts b/jest.config.ts
index 59ecf5270..ea661d79c 100644
--- a/jest.config.ts
+++ b/jest.config.ts
@@ -52,7 +52,9 @@ export default {
     // Match both the eager default (`@miden-sdk/miden-sdk`) and the lazy
     // subpath (`@miden-sdk/miden-sdk/lazy`) — tests mock them identically.
     '^@miden-sdk/miden-sdk(/lazy)?$': '<rootDir>/__mocks__/wasmMock.js',
-    '^@miden-sdk/react(/lazy)?$': '<rootDir>/__mocks__/@miden-sdk/react.ts'
+    '^@miden-sdk/react(/lazy)?$': '<rootDir>/__mocks__/@miden-sdk/react.ts',
+    '^@openzeppelin/miden-multisig-client$': '<rootDir>/__mocks__/@openzeppelin/miden-multisig-client.ts',
+    '^@openzeppelin/guardian-client$': '<rootDir>/__mocks__/@openzeppelin/guardian-client.ts'
   },
   testEnvironment: 'jsdom',
   transform: {
diff --git a/src/lib/intercom/mobile-adapter.test.ts b/src/lib/intercom/mobile-adapter.test.ts
index 0558efea8..92cf52a34 100644
--- a/src/lib/intercom/mobile-adapter.test.ts
+++ b/src/lib/intercom/mobile-adapter.test.ts
@@ -81,12 +81,13 @@ describe('MobileIntercomAdapter', () => {
     it('handles NewWalletRequest', async () => {
       const response = await adapter.request({
         type: WalletMessageType.NewWalletRequest,
+        walletType: 'on-chain',
         password: 'test123',
         mnemonic: 'word1 word2 word3',
         ownMnemonic: false
       } as any);
 
-      expect(Actions.registerNewWallet).toHaveBeenCalledWith('test123', 'word1 word2 word3', false);
+      expect(Actions.registerNewWallet).toHaveBeenCalledWith('on-chain', 'test123', 'word1 word2 word3', false);
       expect(response).toEqual({ type: WalletMessageType.NewWalletResponse });
     });
 
diff --git a/src/lib/miden/activity/transactions.test.ts b/src/lib/miden/activity/transactions.test.ts
index f7647440e..53cf2f655 100644
--- a/src/lib/miden/activity/transactions.test.ts
+++ b/src/lib/miden/activity/transactions.test.ts
@@ -738,6 +738,13 @@ describe('Transaction resilience: network outage recovery (isolated)', () => {
     });
 
     const signCallback = jest.fn(async () => new Uint8Array());
+    // Guardian provider stub — test accounts are non-Guardian, so getAccounts()
+    // returns an empty list and the isGuardianAccount check short-circuits.
+    const guardianProvider = {
+      getAccounts: async () => [],
+      getPublicKeyForCommitment: async () => '',
+      signWord: async () => ''
+    };
 
     // ---- Phase 1: Network up, transaction succeeds ----
     networkUp = true;
@@ -752,7 +759,7 @@ describe('Transaction resilience: network outage recovery (isolated)', () => {
       requestBytes: new Uint8Array([1])
     });
 
-    const result1 = await generateTransactionsLoop(signCallback);
+    const result1 = await generateTransactionsLoop(signCallback, false, guardianProvider);
 
     expect(result1).toBe(true);
     const tx1 = txStore.find((t: any) => t.id === 'tx-1');
@@ -775,7 +782,7 @@ describe('Transaction resilience: network outage recovery (isolated)', () => {
       requestBytes: new Uint8Array([2])
     });
 
-    const result2 = await generateTransactionsLoop(signCallback);
+    const result2 = await generateTransactionsLoop(signCallback, false, guardianProvider);
 
     // generateTransactionsLoop catches the error and cancels the tx
     expect(result2).toBe(false);
@@ -799,7 +806,7 @@ describe('Transaction resilience: network outage recovery (isolated)', () => {
       requestBytes: new Uint8Array([3])
     });
 
-    const result3 = await generateTransactionsLoop(signCallback);
+    const result3 = await generateTransactionsLoop(signCallback, false, guardianProvider);
 
     expect(result3).toBe(true);
     const tx3 = txStore.find((t: any) => t.id === 'tx-3');
diff --git a/src/lib/miden/back/main.test.ts b/src/lib/miden/back/main.test.ts
index d03deb2e1..1db7002d2 100644
--- a/src/lib/miden/back/main.test.ts
+++ b/src/lib/miden/back/main.test.ts
@@ -233,11 +233,12 @@ describe('processRequest', () => {
   it('NewWalletRequest delegates to registerNewWallet', async () => {
     const res = await dispatch({
       type: WalletMessageType.NewWalletRequest,
+      walletType: 'on-chain',
       password: 'pw',
       mnemonic: 'm',
       ownMnemonic: false
     });
-    expect(Actions.registerNewWallet).toHaveBeenCalledWith('pw', 'm', false);
+    expect(Actions.registerNewWallet).toHaveBeenCalledWith('on-chain', 'pw', 'm', false);
     expect(res.type).toBe(WalletMessageType.NewWalletResponse);
   });
 
diff --git a/src/lib/miden/back/vault.test.ts b/src/lib/miden/back/vault.test.ts
index 7d98495ce..6b9418e2f 100644
--- a/src/lib/miden/back/vault.test.ts
+++ b/src/lib/miden/back/vault.test.ts
@@ -41,6 +41,10 @@ const mockGetMidenClient = jest.fn(async (_options?: any) => ({
   createMidenWallet: (...args: unknown[]) => mockCreateMidenWallet(...(args as [any, Uint8Array])),
   importPublicMidenWalletFromSeed: (...args: unknown[]) =>
     mockImportPublicMidenWalletFromSeed(...(args as [Uint8Array])),
+  // Mirror the production dispatch: for non-Guardian types, delegate to
+  // importPublicMidenWalletFromSeed so existing tests keep asserting on it.
+  importAccountBySeed: async (_walletType: any, seed: Uint8Array) =>
+    mockImportPublicMidenWalletFromSeed(seed),
   getAccounts: () => mockGetAccounts(),
   getAccount: (id: string) => mockGetAccount(id),
   syncState: () => mockSyncState(),
diff --git a/src/lib/store/index.test.ts b/src/lib/store/index.test.ts
index 705622684..d3d835444 100644
--- a/src/lib/store/index.test.ts
+++ b/src/lib/store/index.test.ts
@@ -327,6 +327,11 @@ describe('useWalletStore', () => {
   describe('Account actions', () => {
     it('createAccount sends correct request', async () => {
       mockRequest.mockResolvedValueOnce({ type: WalletMessageType.CreateAccountResponse });
+      // createAccount now pulls fresh state right after the create response lands.
+      mockRequest.mockResolvedValueOnce({
+        type: WalletMessageType.GetStateResponse,
+        state: { status: WalletStatus.Idle, accounts: [], networks: {}, settings: {}, ownMnemonic: false }
+      });
 
       const { createAccount } = useWalletStore.getState();
       await createAccount(WalletType.OnChain, 'My Account');
@@ -713,6 +718,10 @@ describe('useWalletStore', () => {
   describe('createAccount', () => {
     it('sends CreateAccountRequest with walletType and name', async () => {
       mockRequest.mockResolvedValueOnce({ type: WalletMessageType.CreateAccountResponse });
+      mockRequest.mockResolvedValueOnce({
+        type: WalletMessageType.GetStateResponse,
+        state: { status: WalletStatus.Idle, accounts: [], networks: {}, settings: {}, ownMnemonic: false }
+      });
       await useWalletStore.getState().createAccount(WalletType.OnChain, 'My Account');
       expect(mockRequest).toHaveBeenCalledWith(
         expect.objectContaining({

From 38c4557a413c1f8c790ea8777cb20cf3561d93bc Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Thu, 23 Apr 2026 18:10:36 +0530
Subject: [PATCH 26/71] chore: fix lint warnings for CI --max-warnings 0

---
 src/app/ConfirmPage.tsx                                    | 2 +-
 src/app/hooks/useMidenFaucetId.ts                          | 2 +-
 src/app/layouts/PageLayout.tsx                             | 2 +-
 src/app/pages/Explore.tsx                                  | 2 +-
 src/app/pages/Faucet.tsx                                   | 2 +-
 src/app/pages/GetTokens.tsx                                | 2 +-
 src/app/pages/SelectAccount.tsx                            | 1 -
 src/app/pages/Settings.tsx                                 | 7 +++++--
 src/app/pages/Unlock.tsx                                   | 2 +-
 src/app/templates/About.tsx                                | 2 +-
 src/app/templates/history/transactionUtils.ts              | 2 +-
 src/components/TransactionProgressModal.tsx                | 2 +-
 src/components/explore/ActionButtons.tsx                   | 2 +-
 src/lib/miden/activity/helpers.test.ts                     | 2 +-
 src/lib/miden/activity/helpers.ts                          | 2 +-
 src/lib/miden/assets/utils.test.ts                         | 2 +-
 src/lib/miden/assets/utils.ts                              | 2 +-
 src/lib/miden/back/dapp.ts                                 | 6 +++---
 src/lib/miden/back/main.ts                                 | 2 +-
 src/lib/miden/back/sync-manager.ts                         | 4 ++--
 src/lib/miden/back/vault.test.ts                           | 3 +--
 src/lib/miden/front/provider.tsx                           | 4 ++--
 src/lib/miden/front/ready.tsx                              | 2 +-
 src/lib/miden/guardian/account.ts                          | 4 +++-
 src/lib/miden/metadata/fetch.ts                            | 2 +-
 src/lib/miden/reset.ts                                     | 2 +-
 src/lib/miden/sdk/miden-client-interface.ts                | 2 +-
 .../generating-transaction/GeneratingTransaction.tsx       | 2 +-
 .../onboarding/create-wallet-flow/SelectRecoveryMethod.tsx | 2 +-
 .../onboarding/import-wallet-flow/ImportRecoveryMethod.tsx | 3 ++-
 src/screens/send-flow/SendManager.tsx                      | 7 ++++---
 src/utils/colors.ts                                        | 2 +-
 32 files changed, 45 insertions(+), 40 deletions(-)

diff --git a/src/app/ConfirmPage.tsx b/src/app/ConfirmPage.tsx
index b186caae1..bb76cf927 100644
--- a/src/app/ConfirmPage.tsx
+++ b/src/app/ConfirmPage.tsx
@@ -13,10 +13,10 @@ import ContentContainer from 'app/layouts/ContentContainer';
 import Unlock from 'app/pages/Unlock';
 import { Button, ButtonVariant } from 'components/Button';
 import { CustomRpsContext } from 'lib/analytics';
+import { getNetworkId } from 'lib/miden-chain/constants';
 import { AssetMetadata, MIDEN_METADATA, useAccount, useMidenContext } from 'lib/miden/front';
 import { getTokenMetadata } from 'lib/miden/metadata/utils';
 import { MidenDAppPayload } from 'lib/miden/types';
-import { getNetworkId } from 'lib/miden-chain/constants';
 import { isDelegateProofEnabled } from 'lib/settings/helpers';
 import { formatAmount } from 'lib/shared/format';
 import { b64ToU8 } from 'lib/shared/helpers';
diff --git a/src/app/hooks/useMidenFaucetId.ts b/src/app/hooks/useMidenFaucetId.ts
index 79a4c780f..d050a8a28 100644
--- a/src/app/hooks/useMidenFaucetId.ts
+++ b/src/app/hooks/useMidenFaucetId.ts
@@ -1,7 +1,7 @@
 import { useEffect, useState } from 'react';
 
-import { getFaucetIdSetting } from 'lib/miden/assets';
 import { getNativeAssetIdSync, onNativeAssetChanged } from 'lib/miden-chain/native-asset';
+import { getFaucetIdSetting } from 'lib/miden/assets';
 
 /**
  * Returns the current MIDEN native-asset faucet ID.
diff --git a/src/app/layouts/PageLayout.tsx b/src/app/layouts/PageLayout.tsx
index 7b2fb0e27..b95be8505 100644
--- a/src/app/layouts/PageLayout.tsx
+++ b/src/app/layouts/PageLayout.tsx
@@ -14,8 +14,8 @@ import { isDesktop, isMobile } from 'lib/platform';
 import { PropsWithChildren } from 'lib/props-with-children';
 import { goBack, HistoryAction, navigate, useLocation } from 'lib/woozie';
 
-import { PageLayoutSelectors } from './PageLayout.selectors';
 import { useOnboardingProgress } from '../hooks/useOnboardingProgress';
+import { PageLayoutSelectors } from './PageLayout.selectors';
 import { ChangelogOverlay } from './PageLayout/ChangelogOverlay/ChangelogOverlay';
 
 interface PageLayoutProps extends PropsWithChildren, ToolbarProps {
diff --git a/src/app/pages/Explore.tsx b/src/app/pages/Explore.tsx
index 4cb6ee970..7e5b76654 100644
--- a/src/app/pages/Explore.tsx
+++ b/src/app/pages/Explore.tsx
@@ -7,6 +7,7 @@ import Header from 'app/layouts/PageLayout/Header';
 import { ConnectivityIssueBanner } from 'components/ConnectivityIssueBanner';
 import { ActionButtons } from 'components/explore/ActionButtons';
 import { PriceChangeBadge } from 'components/explore/PriceChangeBadge';
+import { MIDEN_NETWORK_NAME, MIDEN_FAUCET_ENDPOINTS } from 'lib/miden-chain/constants';
 import {
   initiateConsumeTransaction,
   requestSWTransactionProcessing,
@@ -15,7 +16,6 @@ import {
 import { setFaucetIdSetting, useAccount, useMidenContext } from 'lib/miden/front';
 import { useClaimableNotes } from 'lib/miden/front/claimable-notes';
 import { zustandProvider } from 'lib/miden/front/guardian-sync';
-import { MIDEN_NETWORK_NAME, MIDEN_FAUCET_ENDPOINTS } from 'lib/miden-chain/constants';
 import { isExtension } from 'lib/platform';
 import { isAutoConsumeEnabled, isDelegateProofEnabled } from 'lib/settings/helpers';
 import { navigate } from 'lib/woozie';
diff --git a/src/app/pages/Faucet.tsx b/src/app/pages/Faucet.tsx
index f951d006c..3c13fdce4 100644
--- a/src/app/pages/Faucet.tsx
+++ b/src/app/pages/Faucet.tsx
@@ -7,8 +7,8 @@ import { ReactComponent as FaucetIcon } from 'app/icons/faucet-new.svg';
 import { Button } from 'components/Button';
 import { NavigationHeader } from 'components/NavigationHeader';
 import { AnalyticsEventCategory, useAnalytics } from 'lib/analytics';
-import { useAccount, useNetwork } from 'lib/miden/front';
 import { getFaucetUrl } from 'lib/miden-chain/faucet';
+import { useAccount, useNetwork } from 'lib/miden/front';
 import { openFaucetWebview } from 'lib/mobile/faucet-webview';
 import { isMobile } from 'lib/platform';
 import { goBack } from 'lib/woozie';
diff --git a/src/app/pages/GetTokens.tsx b/src/app/pages/GetTokens.tsx
index 1169da54f..b51b6992c 100644
--- a/src/app/pages/GetTokens.tsx
+++ b/src/app/pages/GetTokens.tsx
@@ -7,8 +7,8 @@ import { IconName } from 'app/icons/v2';
 import PageLayout from 'app/layouts/PageLayout';
 import { Button, ButtonVariant } from 'components/Button';
 import { Message } from 'components/Message';
-import { useNetwork } from 'lib/miden/front';
 import { getFaucetUrl } from 'lib/miden-chain/faucet';
+import { useNetwork } from 'lib/miden/front';
 import { openFaucetWebview } from 'lib/mobile/faucet-webview';
 import { navigate } from 'lib/woozie';
 
diff --git a/src/app/pages/SelectAccount.tsx b/src/app/pages/SelectAccount.tsx
index 41398b188..ffcb3e713 100644
--- a/src/app/pages/SelectAccount.tsx
+++ b/src/app/pages/SelectAccount.tsx
@@ -9,7 +9,6 @@ import { Button, ButtonVariant } from 'components/Button';
 import { NavigationHeader } from 'components/NavigationHeader';
 import { useAccount, useAllAccounts, useMidenContext } from 'lib/miden/front';
 import { isMobile } from 'lib/platform';
-import { Badge } from 'lib/ui/badge';
 import { navigate, useLocation } from 'lib/woozie';
 import { WalletType } from 'screens/onboarding/types';
 import { truncateAddress } from 'utils/string';
diff --git a/src/app/pages/Settings.tsx b/src/app/pages/Settings.tsx
index f8c01fc54..30f13c62e 100644
--- a/src/app/pages/Settings.tsx
+++ b/src/app/pages/Settings.tsx
@@ -45,10 +45,10 @@ import { goBack, navigate } from 'lib/woozie';
 import { EncryptedFileFlow } from 'screens/encrypted-file-flow/EncryptedFileManager';
 import { WalletType } from 'screens/onboarding/types';
 
+import pkg from '../../../package.json';
 import AdvancedSettings from './AdvancedSettings';
 import NetworksSettings from './Networks';
 import { SettingsSelectors } from './Settings.selectors';
-import pkg from '../../../package.json';
 
 const isDevnet = DEFAULT_NETWORK === MIDEN_NETWORK_NAME.DEVNET;
 const AddressBookIcon = isDevnet ? AddressBookIconDevnet : AddressBookIconOrange;
@@ -251,7 +251,10 @@ const Settings: FC<SettingsProps> = ({ tabSlug }) => {
 
   const drawerTabs = useMemo(() => tabGroups.flatMap(g => g.tabs).filter(t => t.isDrawer), [tabGroups]);
 
-  const activeTab = useMemo(() => allTabs.find(tab => tab.slug === tabSlug && !tab.isDrawer) || null, [allTabs, tabSlug]);
+  const activeTab = useMemo(
+    () => allTabs.find(tab => tab.slug === tabSlug && !tab.isDrawer) || null,
+    [allTabs, tabSlug]
+  );
   const languageLabel = getCurrentLanguageLabel();
   const [openDrawer, setOpenDrawer] = useState<string | null>(null);
   const [showSeedWarning, setShowSeedWarning] = useState(false);
diff --git a/src/app/pages/Unlock.tsx b/src/app/pages/Unlock.tsx
index 5cc0ccf7b..ca428fdeb 100644
--- a/src/app/pages/Unlock.tsx
+++ b/src/app/pages/Unlock.tsx
@@ -17,9 +17,9 @@ import LogoVerticalTitleDevnet from 'app/misc/logo-vertical-title-devnet.svg?url
 import LogoVerticalTitle from 'app/misc/logo-vertical-title.svg?url';
 import { Button, ButtonVariant } from 'components/Button';
 import { useFormAnalytics } from 'lib/analytics';
+import { DEFAULT_NETWORK, MIDEN_NETWORK_NAME } from 'lib/miden-chain/constants';
 import { useLocalStorage, useMidenContext } from 'lib/miden/front';
 import { MidenSharedStorageKey } from 'lib/miden/types';
-import { DEFAULT_NETWORK, MIDEN_NETWORK_NAME } from 'lib/miden-chain/constants';
 import { isDesktop, isExtension, isMobile } from 'lib/platform';
 import { navigate } from 'lib/woozie';
 
diff --git a/src/app/templates/About.tsx b/src/app/templates/About.tsx
index 4d2b5ccb0..cde8a2869 100644
--- a/src/app/templates/About.tsx
+++ b/src/app/templates/About.tsx
@@ -4,8 +4,8 @@ import { useTranslation } from 'react-i18next';
 
 import Logo from 'app/atoms/Logo';
 
-import MenuItem from './MenuItem';
 import pkg from '../../../package.json';
+import MenuItem from './MenuItem';
 
 const About: FC = () => {
   const { t } = useTranslation();
diff --git a/src/app/templates/history/transactionUtils.ts b/src/app/templates/history/transactionUtils.ts
index 5f4e20f8c..0a7d8a208 100644
--- a/src/app/templates/history/transactionUtils.ts
+++ b/src/app/templates/history/transactionUtils.ts
@@ -1,8 +1,8 @@
 import { format } from 'date-fns';
 
 import { getDateFnsLocale } from 'lib/i18n';
-import { ITransactionType } from 'lib/miden/db/types';
 import { getNativeAssetIdSync } from 'lib/miden-chain/native-asset';
+import { ITransactionType } from 'lib/miden/db/types';
 
 import { IHistoryEntry } from './IHistoryEntry';
 
diff --git a/src/components/TransactionProgressModal.tsx b/src/components/TransactionProgressModal.tsx
index f455ac6e8..7e0a5ac60 100644
--- a/src/components/TransactionProgressModal.tsx
+++ b/src/components/TransactionProgressModal.tsx
@@ -5,6 +5,7 @@ import { createPortal } from 'react-dom';
 import { useTranslation } from 'react-i18next';
 import Modal from 'react-modal';
 
+import { getExplorerTxUrl } from 'lib/miden-chain/constants';
 import {
   hasQueuedTransactions,
   requestSWTransactionProcessing,
@@ -15,7 +16,6 @@ import {
 import { ITransactionStatus } from 'lib/miden/db/types';
 import { useMidenContext } from 'lib/miden/front';
 import { zustandProvider } from 'lib/miden/front/guardian-sync';
-import { getExplorerTxUrl } from 'lib/miden-chain/constants';
 import { openExternalUrl } from 'lib/mobile/external-browser';
 import { useHideNavbarWhileOpen } from 'lib/mobile/useHideNavbarWhileOpen';
 import { isExtension } from 'lib/platform';
diff --git a/src/components/explore/ActionButtons.tsx b/src/components/explore/ActionButtons.tsx
index 7c0c8a89e..892704bfe 100644
--- a/src/components/explore/ActionButtons.tsx
+++ b/src/components/explore/ActionButtons.tsx
@@ -8,8 +8,8 @@ import { ReactComponent as ReceiveIcon } from 'app/icons/receive-new.svg';
 import { ReactComponent as SendIcon } from 'app/icons/send-new.svg';
 import { ExploreSelectors } from 'app/pages/Explore.selectors';
 import { TestIDProps } from 'lib/analytics';
-import { useNetwork } from 'lib/miden/front';
 import { getFaucetUrl } from 'lib/miden-chain/faucet';
+import { useNetwork } from 'lib/miden/front';
 import { openFaucetWebview } from 'lib/mobile/faucet-webview';
 import { hapticLight } from 'lib/mobile/haptics';
 import { isMobile } from 'lib/platform';
diff --git a/src/lib/miden/activity/helpers.test.ts b/src/lib/miden/activity/helpers.test.ts
index 5e4ae5a31..64dadb9f6 100644
--- a/src/lib/miden/activity/helpers.test.ts
+++ b/src/lib/miden/activity/helpers.test.ts
@@ -1,7 +1,7 @@
 import BigNumber from 'bignumber.js';
 
-import { isPositiveNumber, toTokenId, tryParseTokenTransfers, interpretTransactionResult } from './helpers';
 import { ITransaction } from '../db/types';
+import { isPositiveNumber, toTokenId, tryParseTokenTransfers, interpretTransactionResult } from './helpers';
 
 // Mock the SDK helper
 jest.mock('../sdk/helpers', () => ({
diff --git a/src/lib/miden/activity/helpers.ts b/src/lib/miden/activity/helpers.ts
index b5e712862..88ee80b96 100644
--- a/src/lib/miden/activity/helpers.ts
+++ b/src/lib/miden/activity/helpers.ts
@@ -1,9 +1,9 @@
 import { TransactionResult } from '@miden-sdk/miden-sdk/lazy';
 import BigNumber from 'bignumber.js';
 
-import { compareAccountIds } from './utils';
 import { ITransaction } from '../db/types';
 import { getBech32AddressFromAccountId } from '../sdk/helpers';
+import { compareAccountIds } from './utils';
 
 export function tryParseTokenTransfers(
   parameters: any,
diff --git a/src/lib/miden/assets/utils.test.ts b/src/lib/miden/assets/utils.test.ts
index eeb613f6f..32b99d521 100644
--- a/src/lib/miden/assets/utils.test.ts
+++ b/src/lib/miden/assets/utils.test.ts
@@ -1,7 +1,7 @@
 import BigNumber from 'bignumber.js';
 
-import { fetchFromStorage } from 'lib/miden/front';
 import { getNativeAssetId } from 'lib/miden-chain/native-asset';
+import { fetchFromStorage } from 'lib/miden/front';
 
 import { FAUCET_ID_STORAGE_KEY } from './constants';
 import {
diff --git a/src/lib/miden/assets/utils.ts b/src/lib/miden/assets/utils.ts
index 20ab24bfd..764365b3d 100644
--- a/src/lib/miden/assets/utils.ts
+++ b/src/lib/miden/assets/utils.ts
@@ -2,8 +2,8 @@ import { useMemo, useState } from 'react';
 
 import BigNumber from 'bignumber.js';
 
-import { fetchFromStorage, searchAssets, useAllTokensBaseMetadata } from 'lib/miden/front';
 import { getNativeAssetId } from 'lib/miden-chain/native-asset';
+import { fetchFromStorage, searchAssets, useAllTokensBaseMetadata } from 'lib/miden/front';
 
 import { FAUCET_ID_STORAGE_KEY } from './constants';
 import { Asset, Token, FA2Token } from './types';
diff --git a/src/lib/miden/back/dapp.ts b/src/lib/miden/back/dapp.ts
index 70de8f577..73fc6914f 100644
--- a/src/lib/miden/back/dapp.ts
+++ b/src/lib/miden/back/dapp.ts
@@ -40,6 +40,7 @@ import {
 } from 'lib/adapter/types';
 import { dappConfirmationStore } from 'lib/dapp-browser/confirmation-store';
 import { formatBigInt } from 'lib/i18n/numbers';
+import { getNetworkId } from 'lib/miden-chain/constants';
 import { intercom } from 'lib/miden/back/defaults';
 import { Vault } from 'lib/miden/back/vault';
 import { MIDEN_METADATA } from 'lib/miden/metadata';
@@ -53,7 +54,6 @@ import {
   MidenMessageType,
   MidenRequest
 } from 'lib/miden/types';
-import { getNetworkId } from 'lib/miden-chain/constants';
 import { isDesktop, isExtension } from 'lib/platform';
 import { getStorageProvider } from 'lib/platform/storage-adapter';
 import { b64ToU8, u8ToB64 } from 'lib/shared/helpers';
@@ -61,8 +61,6 @@ import { WalletStatus } from 'lib/shared/types';
 import { capitalizeFirstLetter, truncateAddress } from 'utils/string';
 
 import { queueNoteImport } from '../activity';
-import { store, withUnlocked } from './store';
-import { startTransactionProcessing } from './transaction-processor';
 import {
   initiateSendTransaction,
   requestCustomTransaction,
@@ -71,6 +69,8 @@ import {
 } from '../activity/transactions';
 import { getBech32AddressFromAccountId } from '../sdk/helpers';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
+import { store, withUnlocked } from './store';
+import { startTransactionProcessing } from './transaction-processor';
 
 /**
  * Starts background transaction processing using the unified SW
diff --git a/src/lib/miden/back/main.ts b/src/lib/miden/back/main.ts
index e8a07354f..905ba8519 100644
--- a/src/lib/miden/back/main.ts
+++ b/src/lib/miden/back/main.ts
@@ -1,11 +1,11 @@
 import { Runtime } from 'webextension-polyfill';
 
+import { primeNativeAssetId } from 'lib/miden-chain/native-asset';
 import * as Actions from 'lib/miden/back/actions';
 import { intercom } from 'lib/miden/back/defaults';
 import { store, toFront } from 'lib/miden/back/store';
 import { doSync } from 'lib/miden/back/sync-manager';
 import { startTransactionProcessing } from 'lib/miden/back/transaction-processor';
-import { primeNativeAssetId } from 'lib/miden-chain/native-asset';
 import { SerializedInputNoteDetail, WalletMessageType, WalletRequest, WalletResponse } from 'lib/shared/types';
 
 import { NoteExportType } from '../sdk/constants';
diff --git a/src/lib/miden/back/sync-manager.ts b/src/lib/miden/back/sync-manager.ts
index e9a7b84f1..bfe00ed2d 100644
--- a/src/lib/miden/back/sync-manager.ts
+++ b/src/lib/miden/back/sync-manager.ts
@@ -5,11 +5,11 @@ import { SerializedConsumableNote, SerializedVaultAsset, SyncData, WalletMessage
 
 import { toNoteTypeString } from '../helpers';
 import { fetchTokenMetadata } from '../metadata';
+import { getBech32AddressFromAccountId } from '../sdk/helpers';
+import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 import { getIntercom } from './defaults';
 import { mergeAndPersistSeenNoteIds } from './note-checker-storage';
 import { Vault } from './vault';
-import { getBech32AddressFromAccountId } from '../sdk/helpers';
-import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 
 const ALARM_NAME = 'miden-sync';
 const SYNC_TIMEOUT_MS = 25_000;
diff --git a/src/lib/miden/back/vault.test.ts b/src/lib/miden/back/vault.test.ts
index 6b9418e2f..30dd1d12a 100644
--- a/src/lib/miden/back/vault.test.ts
+++ b/src/lib/miden/back/vault.test.ts
@@ -43,8 +43,7 @@ const mockGetMidenClient = jest.fn(async (_options?: any) => ({
     mockImportPublicMidenWalletFromSeed(...(args as [Uint8Array])),
   // Mirror the production dispatch: for non-Guardian types, delegate to
   // importPublicMidenWalletFromSeed so existing tests keep asserting on it.
-  importAccountBySeed: async (_walletType: any, seed: Uint8Array) =>
-    mockImportPublicMidenWalletFromSeed(seed),
+  importAccountBySeed: async (_walletType: any, seed: Uint8Array) => mockImportPublicMidenWalletFromSeed(seed),
   getAccounts: () => mockGetAccounts(),
   getAccount: (id: string) => mockGetAccount(id),
   syncState: () => mockSyncState(),
diff --git a/src/lib/miden/front/provider.tsx b/src/lib/miden/front/provider.tsx
index 22e2b6ffd..02f6416c3 100644
--- a/src/lib/miden/front/provider.tsx
+++ b/src/lib/miden/front/provider.tsx
@@ -3,16 +3,16 @@ import React, { FC, useEffect, useMemo } from 'react';
 import { NoteToastProvider } from 'components/NoteToastProvider';
 import { TransactionProgressModal } from 'components/TransactionProgressModal';
 import { FiatCurrencyProvider } from 'lib/fiat-curency';
-import { MidenContextProvider, useMidenContext } from 'lib/miden/front/client';
 import { primeNativeAssetId } from 'lib/miden-chain/native-asset';
+import { MidenContextProvider, useMidenContext } from 'lib/miden/front/client';
 import { isExtension } from 'lib/platform';
 import { PriceProvider } from 'lib/prices';
 import { PropsWithChildren } from 'lib/props-with-children';
 import { WalletStoreProvider } from 'lib/store/WalletStoreProvider';
 
+import { getMidenClient } from '../sdk/miden-client';
 import { TokensMetadataProvider } from './assets';
 import { useSyncTrigger } from './useSyncTrigger';
-import { getMidenClient } from '../sdk/miden-client';
 
 // Pre-create the modal container to avoid flash when first opening
 if (typeof document !== 'undefined' && document.body) {
diff --git a/src/lib/miden/front/ready.tsx b/src/lib/miden/front/ready.tsx
index 663a49dd7..ff9b4d409 100644
--- a/src/lib/miden/front/ready.tsx
+++ b/src/lib/miden/front/ready.tsx
@@ -1,7 +1,7 @@
 import React, { useCallback, useEffect, useLayoutEffect, useMemo, useRef } from 'react';
 
-import { usePassiveStorage } from 'lib/miden/front/storage';
 import { DEFAULT_NETWORK, NETWORK_STORAGE_ID } from 'lib/miden-chain/constants';
+import { usePassiveStorage } from 'lib/miden/front/storage';
 import { useWalletStore } from 'lib/store';
 
 import { MidenNetwork } from '../types';
diff --git a/src/lib/miden/guardian/account.ts b/src/lib/miden/guardian/account.ts
index 0b61ec23b..1d958eebf 100644
--- a/src/lib/miden/guardian/account.ts
+++ b/src/lib/miden/guardian/account.ts
@@ -72,7 +72,9 @@ export async function createGuardianAccount(
 
     // Get Guardian endpoint and initialize client
     const guardianEndpoint =
-      guardianEndpointOverride ?? (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) ?? DEFAULT_GUARDIAN_ENDPOINT;
+      guardianEndpointOverride ??
+      (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) ??
+      DEFAULT_GUARDIAN_ENDPOINT;
     console.log('Using Guardian endpoint:', guardianEndpoint);
     const client = new MultisigClient(webClient, { guardianEndpoint });
     const { commitment, pubkey } = await client.guardianClient.getPubkey();
diff --git a/src/lib/miden/metadata/fetch.ts b/src/lib/miden/metadata/fetch.ts
index eba273a49..ef8c1c997 100644
--- a/src/lib/miden/metadata/fetch.ts
+++ b/src/lib/miden/metadata/fetch.ts
@@ -1,8 +1,8 @@
 import { Address, BasicFungibleFaucetComponent, RpcClient } from '@miden-sdk/miden-sdk/lazy';
 
+import { ensureSdkWasmReady, getRpcEndpoint } from 'lib/miden-chain/constants';
 import { isMidenAsset } from 'lib/miden/assets';
 import { fetchFromStorage } from 'lib/miden/front/storage';
-import { ensureSdkWasmReady, getRpcEndpoint } from 'lib/miden-chain/constants';
 
 import { DEFAULT_TOKEN_METADATA, getAssetUrl, MIDEN_METADATA } from './defaults';
 import { AssetMetadata, DetailedAssetMetdata } from './types';
diff --git a/src/lib/miden/reset.ts b/src/lib/miden/reset.ts
index 4b06cbe31..f8437bb30 100644
--- a/src/lib/miden/reset.ts
+++ b/src/lib/miden/reset.ts
@@ -1,5 +1,5 @@
-import * as Repo from 'lib/miden/repo';
 import { resetNativeAssetCache } from 'lib/miden-chain/native-asset';
+import * as Repo from 'lib/miden/repo';
 import { isDesktop, isExtension, isMobile } from 'lib/platform';
 
 async function clearPlatformKeyValueStorage(): Promise<void> {
diff --git a/src/lib/miden/sdk/miden-client-interface.ts b/src/lib/miden/sdk/miden-client-interface.ts
index 6c997f4ca..39b68993f 100644
--- a/src/lib/miden/sdk/miden-client-interface.ts
+++ b/src/lib/miden/sdk/miden-client-interface.ts
@@ -16,13 +16,13 @@ import {
   TransactionResult
 } from '@miden-sdk/miden-sdk/lazy';
 
-import { addConnectivityIssue } from 'lib/miden/activity/connectivity-issues';
 import {
   DEFAULT_NETWORK,
   MIDEN_NETWORK_ENDPOINTS,
   MIDEN_PROVING_ENDPOINTS,
   getNoteTransportUrl
 } from 'lib/miden-chain/constants';
+import { addConnectivityIssue } from 'lib/miden/activity/connectivity-issues';
 import { isMobile } from 'lib/platform';
 import { WalletType } from 'screens/onboarding/types';
 
diff --git a/src/screens/generating-transaction/GeneratingTransaction.tsx b/src/screens/generating-transaction/GeneratingTransaction.tsx
index 7f0f5bb28..27b652b6a 100644
--- a/src/screens/generating-transaction/GeneratingTransaction.tsx
+++ b/src/screens/generating-transaction/GeneratingTransaction.tsx
@@ -8,6 +8,7 @@ import { useTranslation } from 'react-i18next';
 import { Icon, IconName } from 'app/icons/v2';
 import { Alert, AlertVariant } from 'components/Alert';
 import { useAnalytics } from 'lib/analytics';
+import { getExplorerTxUrl } from 'lib/miden-chain/constants';
 import {
   safeGenerateTransactionsLoop as dbTransactionsLoop,
   getAllUncompletedTransactions,
@@ -16,7 +17,6 @@ import {
 import { ITransactionStage, ITransactionStatus, ITransactionType } from 'lib/miden/db/types';
 import { useMidenContext } from 'lib/miden/front';
 import { zustandProvider } from 'lib/miden/front/guardian-sync';
-import { getExplorerTxUrl } from 'lib/miden-chain/constants';
 import { openExternalUrl } from 'lib/mobile/external-browser';
 import { isExtension, isMobile } from 'lib/platform';
 import { isAutoCloseEnabled } from 'lib/settings/helpers';
diff --git a/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx b/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx
index 2d4375461..b3f569b08 100644
--- a/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx
+++ b/src/screens/onboarding/create-wallet-flow/SelectRecoveryMethod.tsx
@@ -45,7 +45,7 @@ export const SelectRecoveryMethodScreen = ({
     [t]
   );
   const options = optionsProp || defaultOptions;
-  const [selected, setSelected] = React.useState<WalletType>(options.find(o => o.isDefault)?.id || options[0].id);
+  const [selected, setSelected] = React.useState<WalletType>(options.find(o => o.isDefault)?.id || options[0]!.id);
 
   const handleContinue = () => {
     onSubmit?.(selected);
diff --git a/src/screens/onboarding/import-wallet-flow/ImportRecoveryMethod.tsx b/src/screens/onboarding/import-wallet-flow/ImportRecoveryMethod.tsx
index 8dc1212f7..e865e81d3 100644
--- a/src/screens/onboarding/import-wallet-flow/ImportRecoveryMethod.tsx
+++ b/src/screens/onboarding/import-wallet-flow/ImportRecoveryMethod.tsx
@@ -27,7 +27,8 @@ export const ImportRecoveryMethodScreen: React.FC<ImportRecoveryMethodScreenProp
   const showError = Boolean(isError) && !dirty && selected === WalletType.Guardian;
 
   const trimmedEndpoint = endpointInput.trim();
-  const canContinue = selected === WalletType.OnChain || (selected === WalletType.Guardian && trimmedEndpoint.length > 0);
+  const canContinue =
+    selected === WalletType.OnChain || (selected === WalletType.Guardian && trimmedEndpoint.length > 0);
 
   const handleContinue = () => {
     console.log('Continue with selection:', { selected, trimmedEndpoint });
diff --git a/src/screens/send-flow/SendManager.tsx b/src/screens/send-flow/SendManager.tsx
index f856f1241..13302988c 100644
--- a/src/screens/send-flow/SendManager.tsx
+++ b/src/screens/send-flow/SendManager.tsx
@@ -1,8 +1,11 @@
 import React, { ChangeEvent, useCallback, useEffect, useMemo, useState } from 'react';
 
 import { yupResolver } from '@hookform/resolvers/yup';
-import { useAppEnv } from 'app/env';
 import classNames from 'clsx';
+import { SubmitHandler, useForm } from 'react-hook-form';
+import * as yup from 'yup';
+
+import { useAppEnv } from 'app/env';
 import { Navigator, NavigatorProvider, Route, useNavigator } from 'components/Navigator';
 import { stringToBigInt } from 'lib/i18n/numbers';
 import {
@@ -18,9 +21,7 @@ import { isExtension, isMobile } from 'lib/platform';
 import { isDelegateProofEnabled } from 'lib/settings/helpers';
 import { useWalletStore } from 'lib/store';
 import { navigate, useLocation } from 'lib/woozie';
-import { SubmitHandler, useForm } from 'react-hook-form';
 import { isValidMidenAddress } from 'utils/miden';
-import * as yup from 'yup';
 
 import { WalletType } from '../onboarding/types';
 import { AccountsList } from './AccountsList';
diff --git a/src/utils/colors.ts b/src/utils/colors.ts
index 34294ff88..b05c27a25 100644
--- a/src/utils/colors.ts
+++ b/src/utils/colors.ts
@@ -1,7 +1,7 @@
 import { includes } from 'lodash';
 
-import colors from './tailwind-colors';
 import { ColorCode, Colors } from '../types/colors';
+import colors from './tailwind-colors';
 
 const _colors = colors as Colors;
 

From 5114335212a6f8a2731927d0dc68d88105721afb Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Thu, 23 Apr 2026 18:21:01 +0530
Subject: [PATCH 27/71] chore: reorder imports to match CI lint rules (patched
 eslint-plugin-import)

---
 src/app/ConfirmPage.tsx                                     | 2 +-
 src/app/hooks/useMidenFaucetId.ts                           | 2 +-
 src/app/layouts/PageLayout.tsx                              | 2 +-
 src/app/pages/Explore.tsx                                   | 2 +-
 src/app/pages/Faucet.tsx                                    | 2 +-
 src/app/pages/GetTokens.tsx                                 | 2 +-
 src/app/pages/Settings.tsx                                  | 2 +-
 src/app/pages/Unlock.tsx                                    | 2 +-
 src/app/templates/About.tsx                                 | 2 +-
 src/app/templates/GuardianSettings.tsx                      | 2 +-
 src/app/templates/history/transactionUtils.ts               | 2 +-
 src/components/TransactionProgressModal.tsx                 | 2 +-
 src/components/explore/ActionButtons.tsx                    | 2 +-
 src/lib/miden/activity/helpers.test.ts                      | 2 +-
 src/lib/miden/activity/helpers.ts                           | 2 +-
 src/lib/miden/assets/utils.test.ts                          | 2 +-
 src/lib/miden/assets/utils.ts                               | 2 +-
 src/lib/miden/back/dapp.ts                                  | 6 +++---
 src/lib/miden/back/main.ts                                  | 2 +-
 src/lib/miden/back/sync-manager.ts                          | 4 ++--
 src/lib/miden/front/guardian-manager.ts                     | 4 ++--
 src/lib/miden/front/provider.tsx                            | 4 ++--
 src/lib/miden/front/ready.tsx                               | 2 +-
 src/lib/miden/guardian/index.ts                             | 2 +-
 src/lib/miden/metadata/fetch.ts                             | 2 +-
 src/lib/miden/reset.ts                                      | 2 +-
 src/lib/miden/sdk/miden-client-interface.ts                 | 6 +++---
 .../generating-transaction/GeneratingTransaction.tsx        | 2 +-
 src/screens/send-flow/SendManager.tsx                       | 2 +-
 src/utils/colors.ts                                         | 2 +-
 30 files changed, 37 insertions(+), 37 deletions(-)

diff --git a/src/app/ConfirmPage.tsx b/src/app/ConfirmPage.tsx
index bb76cf927..b186caae1 100644
--- a/src/app/ConfirmPage.tsx
+++ b/src/app/ConfirmPage.tsx
@@ -13,10 +13,10 @@ import ContentContainer from 'app/layouts/ContentContainer';
 import Unlock from 'app/pages/Unlock';
 import { Button, ButtonVariant } from 'components/Button';
 import { CustomRpsContext } from 'lib/analytics';
-import { getNetworkId } from 'lib/miden-chain/constants';
 import { AssetMetadata, MIDEN_METADATA, useAccount, useMidenContext } from 'lib/miden/front';
 import { getTokenMetadata } from 'lib/miden/metadata/utils';
 import { MidenDAppPayload } from 'lib/miden/types';
+import { getNetworkId } from 'lib/miden-chain/constants';
 import { isDelegateProofEnabled } from 'lib/settings/helpers';
 import { formatAmount } from 'lib/shared/format';
 import { b64ToU8 } from 'lib/shared/helpers';
diff --git a/src/app/hooks/useMidenFaucetId.ts b/src/app/hooks/useMidenFaucetId.ts
index d050a8a28..79a4c780f 100644
--- a/src/app/hooks/useMidenFaucetId.ts
+++ b/src/app/hooks/useMidenFaucetId.ts
@@ -1,7 +1,7 @@
 import { useEffect, useState } from 'react';
 
-import { getNativeAssetIdSync, onNativeAssetChanged } from 'lib/miden-chain/native-asset';
 import { getFaucetIdSetting } from 'lib/miden/assets';
+import { getNativeAssetIdSync, onNativeAssetChanged } from 'lib/miden-chain/native-asset';
 
 /**
  * Returns the current MIDEN native-asset faucet ID.
diff --git a/src/app/layouts/PageLayout.tsx b/src/app/layouts/PageLayout.tsx
index b95be8505..7b2fb0e27 100644
--- a/src/app/layouts/PageLayout.tsx
+++ b/src/app/layouts/PageLayout.tsx
@@ -14,8 +14,8 @@ import { isDesktop, isMobile } from 'lib/platform';
 import { PropsWithChildren } from 'lib/props-with-children';
 import { goBack, HistoryAction, navigate, useLocation } from 'lib/woozie';
 
-import { useOnboardingProgress } from '../hooks/useOnboardingProgress';
 import { PageLayoutSelectors } from './PageLayout.selectors';
+import { useOnboardingProgress } from '../hooks/useOnboardingProgress';
 import { ChangelogOverlay } from './PageLayout/ChangelogOverlay/ChangelogOverlay';
 
 interface PageLayoutProps extends PropsWithChildren, ToolbarProps {
diff --git a/src/app/pages/Explore.tsx b/src/app/pages/Explore.tsx
index 7e5b76654..4cb6ee970 100644
--- a/src/app/pages/Explore.tsx
+++ b/src/app/pages/Explore.tsx
@@ -7,7 +7,6 @@ import Header from 'app/layouts/PageLayout/Header';
 import { ConnectivityIssueBanner } from 'components/ConnectivityIssueBanner';
 import { ActionButtons } from 'components/explore/ActionButtons';
 import { PriceChangeBadge } from 'components/explore/PriceChangeBadge';
-import { MIDEN_NETWORK_NAME, MIDEN_FAUCET_ENDPOINTS } from 'lib/miden-chain/constants';
 import {
   initiateConsumeTransaction,
   requestSWTransactionProcessing,
@@ -16,6 +15,7 @@ import {
 import { setFaucetIdSetting, useAccount, useMidenContext } from 'lib/miden/front';
 import { useClaimableNotes } from 'lib/miden/front/claimable-notes';
 import { zustandProvider } from 'lib/miden/front/guardian-sync';
+import { MIDEN_NETWORK_NAME, MIDEN_FAUCET_ENDPOINTS } from 'lib/miden-chain/constants';
 import { isExtension } from 'lib/platform';
 import { isAutoConsumeEnabled, isDelegateProofEnabled } from 'lib/settings/helpers';
 import { navigate } from 'lib/woozie';
diff --git a/src/app/pages/Faucet.tsx b/src/app/pages/Faucet.tsx
index 3c13fdce4..f951d006c 100644
--- a/src/app/pages/Faucet.tsx
+++ b/src/app/pages/Faucet.tsx
@@ -7,8 +7,8 @@ import { ReactComponent as FaucetIcon } from 'app/icons/faucet-new.svg';
 import { Button } from 'components/Button';
 import { NavigationHeader } from 'components/NavigationHeader';
 import { AnalyticsEventCategory, useAnalytics } from 'lib/analytics';
-import { getFaucetUrl } from 'lib/miden-chain/faucet';
 import { useAccount, useNetwork } from 'lib/miden/front';
+import { getFaucetUrl } from 'lib/miden-chain/faucet';
 import { openFaucetWebview } from 'lib/mobile/faucet-webview';
 import { isMobile } from 'lib/platform';
 import { goBack } from 'lib/woozie';
diff --git a/src/app/pages/GetTokens.tsx b/src/app/pages/GetTokens.tsx
index b51b6992c..1169da54f 100644
--- a/src/app/pages/GetTokens.tsx
+++ b/src/app/pages/GetTokens.tsx
@@ -7,8 +7,8 @@ import { IconName } from 'app/icons/v2';
 import PageLayout from 'app/layouts/PageLayout';
 import { Button, ButtonVariant } from 'components/Button';
 import { Message } from 'components/Message';
-import { getFaucetUrl } from 'lib/miden-chain/faucet';
 import { useNetwork } from 'lib/miden/front';
+import { getFaucetUrl } from 'lib/miden-chain/faucet';
 import { openFaucetWebview } from 'lib/mobile/faucet-webview';
 import { navigate } from 'lib/woozie';
 
diff --git a/src/app/pages/Settings.tsx b/src/app/pages/Settings.tsx
index 30f13c62e..39dc6e3dd 100644
--- a/src/app/pages/Settings.tsx
+++ b/src/app/pages/Settings.tsx
@@ -45,10 +45,10 @@ import { goBack, navigate } from 'lib/woozie';
 import { EncryptedFileFlow } from 'screens/encrypted-file-flow/EncryptedFileManager';
 import { WalletType } from 'screens/onboarding/types';
 
-import pkg from '../../../package.json';
 import AdvancedSettings from './AdvancedSettings';
 import NetworksSettings from './Networks';
 import { SettingsSelectors } from './Settings.selectors';
+import pkg from '../../../package.json';
 
 const isDevnet = DEFAULT_NETWORK === MIDEN_NETWORK_NAME.DEVNET;
 const AddressBookIcon = isDevnet ? AddressBookIconDevnet : AddressBookIconOrange;
diff --git a/src/app/pages/Unlock.tsx b/src/app/pages/Unlock.tsx
index ca428fdeb..5cc0ccf7b 100644
--- a/src/app/pages/Unlock.tsx
+++ b/src/app/pages/Unlock.tsx
@@ -17,9 +17,9 @@ import LogoVerticalTitleDevnet from 'app/misc/logo-vertical-title-devnet.svg?url
 import LogoVerticalTitle from 'app/misc/logo-vertical-title.svg?url';
 import { Button, ButtonVariant } from 'components/Button';
 import { useFormAnalytics } from 'lib/analytics';
-import { DEFAULT_NETWORK, MIDEN_NETWORK_NAME } from 'lib/miden-chain/constants';
 import { useLocalStorage, useMidenContext } from 'lib/miden/front';
 import { MidenSharedStorageKey } from 'lib/miden/types';
+import { DEFAULT_NETWORK, MIDEN_NETWORK_NAME } from 'lib/miden-chain/constants';
 import { isDesktop, isExtension, isMobile } from 'lib/platform';
 import { navigate } from 'lib/woozie';
 
diff --git a/src/app/templates/About.tsx b/src/app/templates/About.tsx
index cde8a2869..4d2b5ccb0 100644
--- a/src/app/templates/About.tsx
+++ b/src/app/templates/About.tsx
@@ -4,8 +4,8 @@ import { useTranslation } from 'react-i18next';
 
 import Logo from 'app/atoms/Logo';
 
-import pkg from '../../../package.json';
 import MenuItem from './MenuItem';
+import pkg from '../../../package.json';
 
 const About: FC = () => {
   const { t } = useTranslation();
diff --git a/src/app/templates/GuardianSettings.tsx b/src/app/templates/GuardianSettings.tsx
index 97e9c3273..07142569c 100644
--- a/src/app/templates/GuardianSettings.tsx
+++ b/src/app/templates/GuardianSettings.tsx
@@ -5,7 +5,6 @@ import { useTranslation } from 'react-i18next';
 
 import FormField from 'app/atoms/FormField';
 import FormSubmitButton from 'app/atoms/FormSubmitButton';
-import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
 import {
   initiateSwitchGuardianTransaction,
   requestSWTransactionProcessing,
@@ -13,6 +12,7 @@ import {
 } from 'lib/miden/activity';
 import { fetchFromStorage, onStorageChanged } from 'lib/miden/front';
 import { zustandProvider } from 'lib/miden/front/guardian-sync';
+import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
 import { isExtension } from 'lib/platform';
 import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { isDelegateProofEnabled } from 'lib/settings/helpers';
diff --git a/src/app/templates/history/transactionUtils.ts b/src/app/templates/history/transactionUtils.ts
index 0a7d8a208..5f4e20f8c 100644
--- a/src/app/templates/history/transactionUtils.ts
+++ b/src/app/templates/history/transactionUtils.ts
@@ -1,8 +1,8 @@
 import { format } from 'date-fns';
 
 import { getDateFnsLocale } from 'lib/i18n';
-import { getNativeAssetIdSync } from 'lib/miden-chain/native-asset';
 import { ITransactionType } from 'lib/miden/db/types';
+import { getNativeAssetIdSync } from 'lib/miden-chain/native-asset';
 
 import { IHistoryEntry } from './IHistoryEntry';
 
diff --git a/src/components/TransactionProgressModal.tsx b/src/components/TransactionProgressModal.tsx
index 7e0a5ac60..f455ac6e8 100644
--- a/src/components/TransactionProgressModal.tsx
+++ b/src/components/TransactionProgressModal.tsx
@@ -5,7 +5,6 @@ import { createPortal } from 'react-dom';
 import { useTranslation } from 'react-i18next';
 import Modal from 'react-modal';
 
-import { getExplorerTxUrl } from 'lib/miden-chain/constants';
 import {
   hasQueuedTransactions,
   requestSWTransactionProcessing,
@@ -16,6 +15,7 @@ import {
 import { ITransactionStatus } from 'lib/miden/db/types';
 import { useMidenContext } from 'lib/miden/front';
 import { zustandProvider } from 'lib/miden/front/guardian-sync';
+import { getExplorerTxUrl } from 'lib/miden-chain/constants';
 import { openExternalUrl } from 'lib/mobile/external-browser';
 import { useHideNavbarWhileOpen } from 'lib/mobile/useHideNavbarWhileOpen';
 import { isExtension } from 'lib/platform';
diff --git a/src/components/explore/ActionButtons.tsx b/src/components/explore/ActionButtons.tsx
index 892704bfe..7c0c8a89e 100644
--- a/src/components/explore/ActionButtons.tsx
+++ b/src/components/explore/ActionButtons.tsx
@@ -8,8 +8,8 @@ import { ReactComponent as ReceiveIcon } from 'app/icons/receive-new.svg';
 import { ReactComponent as SendIcon } from 'app/icons/send-new.svg';
 import { ExploreSelectors } from 'app/pages/Explore.selectors';
 import { TestIDProps } from 'lib/analytics';
-import { getFaucetUrl } from 'lib/miden-chain/faucet';
 import { useNetwork } from 'lib/miden/front';
+import { getFaucetUrl } from 'lib/miden-chain/faucet';
 import { openFaucetWebview } from 'lib/mobile/faucet-webview';
 import { hapticLight } from 'lib/mobile/haptics';
 import { isMobile } from 'lib/platform';
diff --git a/src/lib/miden/activity/helpers.test.ts b/src/lib/miden/activity/helpers.test.ts
index 64dadb9f6..5e4ae5a31 100644
--- a/src/lib/miden/activity/helpers.test.ts
+++ b/src/lib/miden/activity/helpers.test.ts
@@ -1,7 +1,7 @@
 import BigNumber from 'bignumber.js';
 
-import { ITransaction } from '../db/types';
 import { isPositiveNumber, toTokenId, tryParseTokenTransfers, interpretTransactionResult } from './helpers';
+import { ITransaction } from '../db/types';
 
 // Mock the SDK helper
 jest.mock('../sdk/helpers', () => ({
diff --git a/src/lib/miden/activity/helpers.ts b/src/lib/miden/activity/helpers.ts
index 88ee80b96..b5e712862 100644
--- a/src/lib/miden/activity/helpers.ts
+++ b/src/lib/miden/activity/helpers.ts
@@ -1,9 +1,9 @@
 import { TransactionResult } from '@miden-sdk/miden-sdk/lazy';
 import BigNumber from 'bignumber.js';
 
+import { compareAccountIds } from './utils';
 import { ITransaction } from '../db/types';
 import { getBech32AddressFromAccountId } from '../sdk/helpers';
-import { compareAccountIds } from './utils';
 
 export function tryParseTokenTransfers(
   parameters: any,
diff --git a/src/lib/miden/assets/utils.test.ts b/src/lib/miden/assets/utils.test.ts
index 32b99d521..eeb613f6f 100644
--- a/src/lib/miden/assets/utils.test.ts
+++ b/src/lib/miden/assets/utils.test.ts
@@ -1,7 +1,7 @@
 import BigNumber from 'bignumber.js';
 
-import { getNativeAssetId } from 'lib/miden-chain/native-asset';
 import { fetchFromStorage } from 'lib/miden/front';
+import { getNativeAssetId } from 'lib/miden-chain/native-asset';
 
 import { FAUCET_ID_STORAGE_KEY } from './constants';
 import {
diff --git a/src/lib/miden/assets/utils.ts b/src/lib/miden/assets/utils.ts
index 764365b3d..20ab24bfd 100644
--- a/src/lib/miden/assets/utils.ts
+++ b/src/lib/miden/assets/utils.ts
@@ -2,8 +2,8 @@ import { useMemo, useState } from 'react';
 
 import BigNumber from 'bignumber.js';
 
-import { getNativeAssetId } from 'lib/miden-chain/native-asset';
 import { fetchFromStorage, searchAssets, useAllTokensBaseMetadata } from 'lib/miden/front';
+import { getNativeAssetId } from 'lib/miden-chain/native-asset';
 
 import { FAUCET_ID_STORAGE_KEY } from './constants';
 import { Asset, Token, FA2Token } from './types';
diff --git a/src/lib/miden/back/dapp.ts b/src/lib/miden/back/dapp.ts
index 73fc6914f..70de8f577 100644
--- a/src/lib/miden/back/dapp.ts
+++ b/src/lib/miden/back/dapp.ts
@@ -40,7 +40,6 @@ import {
 } from 'lib/adapter/types';
 import { dappConfirmationStore } from 'lib/dapp-browser/confirmation-store';
 import { formatBigInt } from 'lib/i18n/numbers';
-import { getNetworkId } from 'lib/miden-chain/constants';
 import { intercom } from 'lib/miden/back/defaults';
 import { Vault } from 'lib/miden/back/vault';
 import { MIDEN_METADATA } from 'lib/miden/metadata';
@@ -54,6 +53,7 @@ import {
   MidenMessageType,
   MidenRequest
 } from 'lib/miden/types';
+import { getNetworkId } from 'lib/miden-chain/constants';
 import { isDesktop, isExtension } from 'lib/platform';
 import { getStorageProvider } from 'lib/platform/storage-adapter';
 import { b64ToU8, u8ToB64 } from 'lib/shared/helpers';
@@ -61,6 +61,8 @@ import { WalletStatus } from 'lib/shared/types';
 import { capitalizeFirstLetter, truncateAddress } from 'utils/string';
 
 import { queueNoteImport } from '../activity';
+import { store, withUnlocked } from './store';
+import { startTransactionProcessing } from './transaction-processor';
 import {
   initiateSendTransaction,
   requestCustomTransaction,
@@ -69,8 +71,6 @@ import {
 } from '../activity/transactions';
 import { getBech32AddressFromAccountId } from '../sdk/helpers';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
-import { store, withUnlocked } from './store';
-import { startTransactionProcessing } from './transaction-processor';
 
 /**
  * Starts background transaction processing using the unified SW
diff --git a/src/lib/miden/back/main.ts b/src/lib/miden/back/main.ts
index 905ba8519..e8a07354f 100644
--- a/src/lib/miden/back/main.ts
+++ b/src/lib/miden/back/main.ts
@@ -1,11 +1,11 @@
 import { Runtime } from 'webextension-polyfill';
 
-import { primeNativeAssetId } from 'lib/miden-chain/native-asset';
 import * as Actions from 'lib/miden/back/actions';
 import { intercom } from 'lib/miden/back/defaults';
 import { store, toFront } from 'lib/miden/back/store';
 import { doSync } from 'lib/miden/back/sync-manager';
 import { startTransactionProcessing } from 'lib/miden/back/transaction-processor';
+import { primeNativeAssetId } from 'lib/miden-chain/native-asset';
 import { SerializedInputNoteDetail, WalletMessageType, WalletRequest, WalletResponse } from 'lib/shared/types';
 
 import { NoteExportType } from '../sdk/constants';
diff --git a/src/lib/miden/back/sync-manager.ts b/src/lib/miden/back/sync-manager.ts
index bfe00ed2d..e9a7b84f1 100644
--- a/src/lib/miden/back/sync-manager.ts
+++ b/src/lib/miden/back/sync-manager.ts
@@ -5,11 +5,11 @@ import { SerializedConsumableNote, SerializedVaultAsset, SyncData, WalletMessage
 
 import { toNoteTypeString } from '../helpers';
 import { fetchTokenMetadata } from '../metadata';
-import { getBech32AddressFromAccountId } from '../sdk/helpers';
-import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 import { getIntercom } from './defaults';
 import { mergeAndPersistSeenNoteIds } from './note-checker-storage';
 import { Vault } from './vault';
+import { getBech32AddressFromAccountId } from '../sdk/helpers';
+import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 
 const ALARM_NAME = 'miden-sync';
 const SYNC_TIMEOUT_MS = 25_000;
diff --git a/src/lib/miden/front/guardian-manager.ts b/src/lib/miden/front/guardian-manager.ts
index 97177d41f..76db57c05 100644
--- a/src/lib/miden/front/guardian-manager.ts
+++ b/src/lib/miden/front/guardian-manager.ts
@@ -1,12 +1,12 @@
-import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
 import { MultisigService } from 'lib/miden/guardian';
+import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
 import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { WalletAccount } from 'lib/shared/types';
 import { WalletType } from 'screens/onboarding/types';
 
+import { fetchFromStorage } from './storage';
 import { getSignerDetailsFromAccount } from '../guardian/account';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
-import { fetchFromStorage } from './storage';
 
 // Cache MultisigService instances to avoid re-initialization on every sync cycle
 const guardianServiceCache = new Map<string, MultisigService>();
diff --git a/src/lib/miden/front/provider.tsx b/src/lib/miden/front/provider.tsx
index 02f6416c3..22e2b6ffd 100644
--- a/src/lib/miden/front/provider.tsx
+++ b/src/lib/miden/front/provider.tsx
@@ -3,16 +3,16 @@ import React, { FC, useEffect, useMemo } from 'react';
 import { NoteToastProvider } from 'components/NoteToastProvider';
 import { TransactionProgressModal } from 'components/TransactionProgressModal';
 import { FiatCurrencyProvider } from 'lib/fiat-curency';
-import { primeNativeAssetId } from 'lib/miden-chain/native-asset';
 import { MidenContextProvider, useMidenContext } from 'lib/miden/front/client';
+import { primeNativeAssetId } from 'lib/miden-chain/native-asset';
 import { isExtension } from 'lib/platform';
 import { PriceProvider } from 'lib/prices';
 import { PropsWithChildren } from 'lib/props-with-children';
 import { WalletStoreProvider } from 'lib/store/WalletStoreProvider';
 
-import { getMidenClient } from '../sdk/miden-client';
 import { TokensMetadataProvider } from './assets';
 import { useSyncTrigger } from './useSyncTrigger';
+import { getMidenClient } from '../sdk/miden-client';
 
 // Pre-create the modal container to avoid flash when first opening
 if (typeof document !== 'undefined' && document.body) {
diff --git a/src/lib/miden/front/ready.tsx b/src/lib/miden/front/ready.tsx
index ff9b4d409..663a49dd7 100644
--- a/src/lib/miden/front/ready.tsx
+++ b/src/lib/miden/front/ready.tsx
@@ -1,7 +1,7 @@
 import React, { useCallback, useEffect, useLayoutEffect, useMemo, useRef } from 'react';
 
-import { DEFAULT_NETWORK, NETWORK_STORAGE_ID } from 'lib/miden-chain/constants';
 import { usePassiveStorage } from 'lib/miden/front/storage';
+import { DEFAULT_NETWORK, NETWORK_STORAGE_ID } from 'lib/miden-chain/constants';
 import { useWalletStore } from 'lib/store';
 
 import { MidenNetwork } from '../types';
diff --git a/src/lib/miden/guardian/index.ts b/src/lib/miden/guardian/index.ts
index 42be8aad9..fa4866d4b 100644
--- a/src/lib/miden/guardian/index.ts
+++ b/src/lib/miden/guardian/index.ts
@@ -12,11 +12,11 @@ import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
 import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { u8ToB64 } from 'lib/shared/helpers';
 
+import { WalletSigner, type SignWordFunction } from './signer';
 import { fetchFromStorage } from '../front/storage';
 import { accountIdStringToSdk } from '../sdk/helpers';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 import { MidenClientInterface } from '../sdk/miden-client-interface';
-import { WalletSigner, type SignWordFunction } from './signer';
 
 const MAX_SYNC_RETRIES = 20;
 
diff --git a/src/lib/miden/metadata/fetch.ts b/src/lib/miden/metadata/fetch.ts
index ef8c1c997..eba273a49 100644
--- a/src/lib/miden/metadata/fetch.ts
+++ b/src/lib/miden/metadata/fetch.ts
@@ -1,8 +1,8 @@
 import { Address, BasicFungibleFaucetComponent, RpcClient } from '@miden-sdk/miden-sdk/lazy';
 
-import { ensureSdkWasmReady, getRpcEndpoint } from 'lib/miden-chain/constants';
 import { isMidenAsset } from 'lib/miden/assets';
 import { fetchFromStorage } from 'lib/miden/front/storage';
+import { ensureSdkWasmReady, getRpcEndpoint } from 'lib/miden-chain/constants';
 
 import { DEFAULT_TOKEN_METADATA, getAssetUrl, MIDEN_METADATA } from './defaults';
 import { AssetMetadata, DetailedAssetMetdata } from './types';
diff --git a/src/lib/miden/reset.ts b/src/lib/miden/reset.ts
index f8437bb30..4b06cbe31 100644
--- a/src/lib/miden/reset.ts
+++ b/src/lib/miden/reset.ts
@@ -1,5 +1,5 @@
-import { resetNativeAssetCache } from 'lib/miden-chain/native-asset';
 import * as Repo from 'lib/miden/repo';
+import { resetNativeAssetCache } from 'lib/miden-chain/native-asset';
 import { isDesktop, isExtension, isMobile } from 'lib/platform';
 
 async function clearPlatformKeyValueStorage(): Promise<void> {
diff --git a/src/lib/miden/sdk/miden-client-interface.ts b/src/lib/miden/sdk/miden-client-interface.ts
index 39b68993f..831c9d749 100644
--- a/src/lib/miden/sdk/miden-client-interface.ts
+++ b/src/lib/miden/sdk/miden-client-interface.ts
@@ -16,24 +16,24 @@ import {
   TransactionResult
 } from '@miden-sdk/miden-sdk/lazy';
 
+import { addConnectivityIssue } from 'lib/miden/activity/connectivity-issues';
 import {
   DEFAULT_NETWORK,
   MIDEN_NETWORK_ENDPOINTS,
   MIDEN_PROVING_ENDPOINTS,
   getNoteTransportUrl
 } from 'lib/miden-chain/constants';
-import { addConnectivityIssue } from 'lib/miden/activity/connectivity-issues';
 import { isMobile } from 'lib/platform';
 import { WalletType } from 'screens/onboarding/types';
 
+import { NoteExportType } from './constants';
+import { getBech32AddressFromAccountId } from './helpers';
 import { ConsumeTransaction, SendTransaction } from '../db/types';
 // Guardian helpers are dynamic-imported inside the methods that use them to avoid
 // a module init cycle: miden-client-interface → guardian/index → sdk/miden-client →
 // miden-client-interface. Static imports here deadlock init_guardian_manager in the
 // SW bundle (both sides' __esmMin wrappers await each other).
 import type { SignWordFunction } from '../guardian/signer';
-import { NoteExportType } from './constants';
-import { getBech32AddressFromAccountId } from './helpers';
 
 export type MidenClientCreateOptions = {
   seed?: Uint8Array;
diff --git a/src/screens/generating-transaction/GeneratingTransaction.tsx b/src/screens/generating-transaction/GeneratingTransaction.tsx
index 27b652b6a..7f0f5bb28 100644
--- a/src/screens/generating-transaction/GeneratingTransaction.tsx
+++ b/src/screens/generating-transaction/GeneratingTransaction.tsx
@@ -8,7 +8,6 @@ import { useTranslation } from 'react-i18next';
 import { Icon, IconName } from 'app/icons/v2';
 import { Alert, AlertVariant } from 'components/Alert';
 import { useAnalytics } from 'lib/analytics';
-import { getExplorerTxUrl } from 'lib/miden-chain/constants';
 import {
   safeGenerateTransactionsLoop as dbTransactionsLoop,
   getAllUncompletedTransactions,
@@ -17,6 +16,7 @@ import {
 import { ITransactionStage, ITransactionStatus, ITransactionType } from 'lib/miden/db/types';
 import { useMidenContext } from 'lib/miden/front';
 import { zustandProvider } from 'lib/miden/front/guardian-sync';
+import { getExplorerTxUrl } from 'lib/miden-chain/constants';
 import { openExternalUrl } from 'lib/mobile/external-browser';
 import { isExtension, isMobile } from 'lib/platform';
 import { isAutoCloseEnabled } from 'lib/settings/helpers';
diff --git a/src/screens/send-flow/SendManager.tsx b/src/screens/send-flow/SendManager.tsx
index 13302988c..92ecaf465 100644
--- a/src/screens/send-flow/SendManager.tsx
+++ b/src/screens/send-flow/SendManager.tsx
@@ -23,12 +23,12 @@ import { useWalletStore } from 'lib/store';
 import { navigate, useLocation } from 'lib/woozie';
 import { isValidMidenAddress } from 'utils/miden';
 
-import { WalletType } from '../onboarding/types';
 import { AccountsList } from './AccountsList';
 import { ReviewTransaction } from './ReviewTransaction';
 import { SelectToken } from './SelectToken';
 import { SendDetails } from './SendDetails';
 import { Contact, SendFlowAction, SendFlowActionId, SendFlowForm, SendFlowStep, UIToken } from './types';
+import { WalletType } from '../onboarding/types';
 
 const ROUTES: Route[] = [
   {
diff --git a/src/utils/colors.ts b/src/utils/colors.ts
index b05c27a25..34294ff88 100644
--- a/src/utils/colors.ts
+++ b/src/utils/colors.ts
@@ -1,7 +1,7 @@
 import { includes } from 'lodash';
 
-import { ColorCode, Colors } from '../types/colors';
 import colors from './tailwind-colors';
+import { ColorCode, Colors } from '../types/colors';
 
 const _colors = colors as Colors;
 

From 780df88e9f1640077345669440078a091f05ba8a Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Thu, 23 Apr 2026 21:32:03 +0530
Subject: [PATCH 28/71] test: add guardian tests to meet 95% coverage
 thresholds

---
 .../activity/connectivity-issues.test.ts      |  54 +++
 .../activity/transactions.guardian.test.ts    | 364 +++++++++++++++
 src/lib/miden/back/vault.test.ts              |  34 ++
 src/lib/miden/front/guardian-manager.test.ts  | 212 +++++++++
 src/lib/miden/front/guardian-sync.test.ts     | 102 +++++
 src/lib/miden/front/useSyncTrigger.test.tsx   | 210 +++++++++
 src/lib/miden/guardian/account.test.ts        | 215 +++++++++
 src/lib/miden/guardian/digest.test.ts         | 153 +++++++
 src/lib/miden/guardian/index.test.ts          | 424 ++++++++++++++++++
 src/lib/miden/guardian/signer.test.ts         |  72 +++
 .../miden/sdk/miden-client-interface.test.ts  | 278 ++++++++++++
 src/lib/store/index.test.ts                   |  47 ++
 12 files changed, 2165 insertions(+)
 create mode 100644 src/lib/miden/activity/transactions.guardian.test.ts
 create mode 100644 src/lib/miden/front/guardian-manager.test.ts
 create mode 100644 src/lib/miden/front/guardian-sync.test.ts
 create mode 100644 src/lib/miden/front/useSyncTrigger.test.tsx
 create mode 100644 src/lib/miden/guardian/account.test.ts
 create mode 100644 src/lib/miden/guardian/digest.test.ts
 create mode 100644 src/lib/miden/guardian/index.test.ts
 create mode 100644 src/lib/miden/guardian/signer.test.ts

diff --git a/src/lib/miden/activity/connectivity-issues.test.ts b/src/lib/miden/activity/connectivity-issues.test.ts
index 9f9a2a0b7..734e0d2e4 100644
--- a/src/lib/miden/activity/connectivity-issues.test.ts
+++ b/src/lib/miden/activity/connectivity-issues.test.ts
@@ -19,6 +19,8 @@ jest.mock('lib/platform/storage-adapter', () => ({
   })
 }));
 
+import { act, renderHook } from '@testing-library/react';
+
 import { addConnectivityIssue, sendConnectivityIssue } from './connectivity-issues';
 
 beforeEach(() => {
@@ -50,3 +52,55 @@ describe('sendConnectivityIssue', () => {
     );
   });
 });
+
+// useConnectivityIssues is a thin wrapper around useStorage; exercising it
+// via useStorage's real suspense path is flaky with @testing-library/react.
+// Stub useStorage at the module level and drive the hook through that — we
+// only need to prove the wrapper forwards state + dismisses correctly.
+describe('useConnectivityIssues', () => {
+  // eslint-disable-next-line @typescript-eslint/no-var-requires
+  const conn = require('./connectivity-issues');
+
+  // We re-import the module under a mock of useStorage so the hook is
+  // covered without the suspense machinery.
+  let useHook: typeof conn.useConnectivityIssues;
+  let setStored: (v: boolean) => void;
+  let storedValue = false;
+  let setValue: jest.Mock;
+
+  beforeEach(() => {
+    jest.resetModules();
+    setValue = jest.fn(async (v: boolean) => {
+      storedValue = v;
+    });
+    setStored = (v: boolean) => {
+      storedValue = v;
+    };
+    jest.doMock('../front', () => ({
+      useStorage: jest.fn(() => [storedValue, setValue]),
+      putToStorage: jest.fn(async () => {})
+    }));
+    // Re-require after mocking so the hook picks up the stubbed useStorage.
+    const reloaded = require('./connectivity-issues');
+    useHook = reloaded.useConnectivityIssues;
+  });
+
+  it('returns the stored flag and dispatches false on dismiss', () => {
+    setStored(true);
+    const { result } = renderHook(() => useHook());
+
+    const [value, dismiss] = result.current;
+    expect(value).toBe(true);
+
+    act(() => {
+      dismiss();
+    });
+    expect(setValue).toHaveBeenCalledWith(false);
+  });
+
+  it('returns the default false when nothing is stored', () => {
+    setStored(false);
+    const { result } = renderHook(() => useHook());
+    expect(result.current[0]).toBe(false);
+  });
+});
diff --git a/src/lib/miden/activity/transactions.guardian.test.ts b/src/lib/miden/activity/transactions.guardian.test.ts
new file mode 100644
index 000000000..3360fcee3
--- /dev/null
+++ b/src/lib/miden/activity/transactions.guardian.test.ts
@@ -0,0 +1,364 @@
+/**
+ * Guardian-specific paths through lib/miden/activity/transactions.ts:
+ *   - initiateSwitchGuardianTransaction — rejects non-Guardian accounts,
+ *     otherwise enqueues a SwitchGuardianTransaction row.
+ *   - completeSwitchGuardianTransaction — registers the post-switch state
+ *     with the new guardian, flips the stored URL, evicts the cached
+ *     MultisigService, and marks the tx Completed. Failure path marks
+ *     Failed without touching storage.
+ *   - generateTransaction — routes a Guardian-typed account through the
+ *     Guardian flow (createSendProposal → signAndCreateTransactionRequest
+ *     → submit → completeSendTransaction).
+ */
+
+import {
+  completeSwitchGuardianTransaction,
+  generateTransaction,
+  initiateSwitchGuardianTransaction
+} from './transactions';
+import { ITransactionStatus, SwitchGuardianTransaction } from '../db/types';
+
+const txStore: Array<Record<string, unknown>> = [];
+const putToStorage = jest.fn(async () => {});
+
+jest.mock('lib/miden/repo', () => ({
+  db: { transaction: async (_mode: string, _t: unknown, cb: () => unknown) => cb() },
+  transactions: {
+    add: jest.fn(async (tx: Record<string, unknown>) => {
+      txStore.push({ ...tx });
+    }),
+    where: jest.fn((query: { id: string }) => ({
+      modify: jest.fn(async (fn: (tx: Record<string, unknown>) => void) => {
+        const row = txStore.find(r => r.id === query.id);
+        if (row) fn(row);
+      }),
+      first: jest.fn(async () => txStore.find(r => r.id === query.id))
+    })),
+    filter: jest.fn(() => ({ toArray: jest.fn(async () => []) }))
+  }
+}));
+
+// transactions.ts imports putToStorage from '../front' (the barrel), not directly from './storage'.
+jest.mock('../front', () => ({
+  putToStorage: (...a: unknown[]) => putToStorage(...a),
+  fetchFromStorage: jest.fn(),
+  onStorageChanged: jest.fn()
+}));
+
+jest.mock('lib/settings/constants', () => ({
+  GUARDIAN_URL_STORAGE_KEY: 'guardian_url_setting'
+}));
+
+const mockIsGuardianAccount = jest.fn();
+const mockGetOrCreateMultisigService = jest.fn();
+const mockClearGuardianServiceFor = jest.fn();
+// transactions.ts imports via 'lib/miden/front/guardian-manager' (aliased).
+jest.mock('lib/miden/front/guardian-manager', () => ({
+  isGuardianAccount: (...a: unknown[]) => mockIsGuardianAccount(...a),
+  getOrCreateMultisigService: (...a: unknown[]) => mockGetOrCreateMultisigService(...a),
+  clearGuardianServiceFor: (...a: unknown[]) => mockClearGuardianServiceFor(...a)
+}));
+
+const mockWithWasmClientLock = jest.fn(async (fn: () => Promise<unknown>) => fn());
+const mockGetMidenClient = jest.fn();
+// Match the relative path used by transactions.ts so the mock intercepts.
+jest.mock('../sdk/miden-client', () => ({
+  withWasmClientLock: (...a: unknown[]) => mockWithWasmClientLock(...(a as [() => Promise<unknown>])),
+  getMidenClient: (...a: unknown[]) => mockGetMidenClient(...a)
+}));
+
+jest.mock('lib/intercom', () => ({
+  getIntercom: () => ({ broadcast: jest.fn(), request: jest.fn() })
+}));
+
+jest.mock('lib/store', () => ({
+  useWalletStore: { getState: () => ({ accounts: [], setLastCompletedTxHash: jest.fn() }) }
+}));
+
+jest.mock('lib/miden/sdk/helpers', () => ({
+  accountIdStringToSdk: (id: string) => ({ toString: () => `sdk-${id}` })
+}));
+
+jest.mock('@miden-sdk/miden-sdk/lazy', () => {
+  const actual = jest.requireActual('../../../../__mocks__/wasmMock.js');
+  return {
+    ...actual,
+    TransactionProver: { newLocalProver: jest.fn(() => 'local-prover') }
+  };
+});
+
+jest.mock('shared/logger', () => ({
+  logger: { warning: jest.fn(), error: jest.fn(), info: jest.fn() }
+}));
+
+const makeResult = () => ({
+  executedTransaction: () => ({
+    id: () => ({ toHex: () => 'exec-tx-hash' }),
+    outputNotes: () => ({ notes: () => [] }),
+    inputNotes: () => ({ notes: () => [] })
+  }),
+  serialize: () => new Uint8Array([9, 9, 9])
+});
+
+const makeGuardianProvider = (isGuardian: boolean) => {
+  mockIsGuardianAccount.mockResolvedValue(isGuardian);
+  return {
+    getAccounts: async () => [],
+    getPublicKeyForCommitment: async () => 'pk',
+    signWord: async () => 'sig'
+  };
+};
+
+describe('initiateSwitchGuardianTransaction', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    txStore.length = 0;
+  });
+
+  it('queues a SwitchGuardianTransaction row when the account is Guardian', async () => {
+    const provider = makeGuardianProvider(true);
+
+    const id = await initiateSwitchGuardianTransaction('acc-1', 'https://new.guardian', false, provider);
+
+    expect(id).toBeDefined();
+    expect(txStore).toHaveLength(1);
+    const row = txStore[0] as Record<string, unknown>;
+    expect(row.accountId).toBe('acc-1');
+    expect(row.type).toBe('switch-guardian');
+    const extra = row.extraInputs as Record<string, unknown>;
+    expect(extra.newGuardianEndpoint).toBe('https://new.guardian');
+  });
+
+  it('throws when the target account is not a Guardian account', async () => {
+    const provider = makeGuardianProvider(false);
+
+    await expect(initiateSwitchGuardianTransaction('acc-public', 'https://new', false, provider)).rejects.toThrow(
+      'Switch guardian is only supported for Guardian accounts'
+    );
+    expect(txStore).toHaveLength(0);
+  });
+});
+
+describe('completeSwitchGuardianTransaction', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    txStore.length = 0;
+  });
+
+  it('registers state with the new guardian, persists the URL, and marks the row Completed', async () => {
+    const tx = new SwitchGuardianTransaction('acc-1', 'https://new.guardian', false);
+    txStore.push({ id: tx.id, status: ITransactionStatus.GeneratingTransaction });
+
+    const multisigService = {
+      finalizeGuardianSwitch: jest.fn(async () => {})
+    };
+
+    await completeSwitchGuardianTransaction(tx, makeResult() as never, multisigService as never);
+
+    expect(multisigService.finalizeGuardianSwitch).toHaveBeenCalledWith('https://new.guardian');
+    expect(putToStorage).toHaveBeenCalledWith('guardian_url_setting', 'https://new.guardian');
+    expect(mockClearGuardianServiceFor).toHaveBeenCalledWith('acc-1');
+
+    const row = txStore.find(r => r.id === tx.id) as Record<string, unknown>;
+    expect(row.status).toBe(ITransactionStatus.Completed);
+    expect(row.displayMessage).toBe('Guardian switched');
+  });
+
+  it('marks the row Failed and skips the storage flip when registration throws', async () => {
+    const tx = new SwitchGuardianTransaction('acc-1', 'https://new.guardian', false);
+    txStore.push({ id: tx.id, status: ITransactionStatus.GeneratingTransaction });
+
+    const multisigService = {
+      finalizeGuardianSwitch: jest.fn(async () => {
+        throw new Error('register failed');
+      })
+    };
+
+    await completeSwitchGuardianTransaction(tx, makeResult() as never, multisigService as never);
+
+    // The URL was NOT persisted because the guardian rejected the new state.
+    expect(putToStorage).not.toHaveBeenCalled();
+    const row = txStore.find(r => r.id === tx.id) as Record<string, unknown>;
+    expect(row.status).toBe(ITransactionStatus.Failed);
+    expect(row.displayMessage).toBe('Failed to switch guardian');
+    expect(row.error).toBe('register failed');
+  });
+});
+
+describe('generateTransaction — Guardian routing', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    txStore.length = 0;
+  });
+
+  it('Guardian send: builds a proposal, signs it, submits the request, and completes the row', async () => {
+    const txId = 'send-guardian-1';
+    const result = makeResult();
+    txStore.push({
+      id: txId,
+      type: 'send',
+      accountId: 'guardian-acc',
+      status: ITransactionStatus.Queued,
+      displayMessage: 'Queued',
+      displayIcon: 'DEFAULT',
+      secondaryAccountId: 'recipient',
+      faucetId: 'faucet',
+      amount: '1000',
+      delegateTransaction: false,
+      initiatedAt: Math.floor(Date.now() / 1000)
+    });
+
+    const multisigService = {
+      createSendProposal: jest.fn(async () => ({ id: 'prop-1' })),
+      signAndCreateTransactionRequest: jest.fn(async () => ({ serialize: () => new Uint8Array([1]) })),
+      sync: jest.fn(async () => {})
+    };
+    mockGetOrCreateMultisigService.mockResolvedValue(multisigService);
+
+    // The pre-guardian sync call uses midenClient.syncState() directly; the
+    // post-proposal submit goes via midenClient.client.transactions.submit(..).
+    mockGetMidenClient.mockResolvedValue({
+      syncState: jest.fn(async () => {}),
+      client: {
+        transactions: {
+          submit: jest.fn(async () => ({ result }))
+        }
+      }
+    });
+
+    const provider = makeGuardianProvider(true);
+    const signCallback = jest.fn(async () => new Uint8Array([2]));
+
+    await generateTransaction(
+      {
+        id: txId,
+        type: 'send',
+        accountId: 'guardian-acc',
+        secondaryAccountId: 'recipient',
+        faucetId: 'faucet',
+        amount: '1000',
+        delegateTransaction: false
+      } as never,
+      signCallback,
+      false,
+      provider
+    );
+
+    expect(multisigService.createSendProposal).toHaveBeenCalledWith('recipient', 'faucet', 1000n);
+    expect(multisigService.signAndCreateTransactionRequest).toHaveBeenCalledWith('prop-1');
+    expect(multisigService.sync).toHaveBeenCalled();
+  });
+
+  it('Guardian consume: builds a consume-notes proposal off the noteId', async () => {
+    const txId = 'consume-guardian-1';
+    const result = makeResult();
+    const multisigService = {
+      createConsumeNotesProposal: jest.fn(async () => ({ id: 'prop-consume' })),
+      signAndCreateTransactionRequest: jest.fn(async () => ({ serialize: () => new Uint8Array([1]) })),
+      sync: jest.fn(async () => {})
+    };
+    mockGetOrCreateMultisigService.mockResolvedValue(multisigService);
+    mockGetMidenClient.mockResolvedValue({
+      syncState: jest.fn(async () => {}),
+      client: { transactions: { submit: jest.fn(async () => ({ result })) } }
+    });
+    txStore.push({
+      id: txId,
+      type: 'consume',
+      accountId: 'guardian-acc',
+      status: ITransactionStatus.Queued,
+      noteId: 'note-xyz'
+    });
+
+    await generateTransaction(
+      {
+        id: txId,
+        type: 'consume',
+        accountId: 'guardian-acc',
+        noteId: 'note-xyz',
+        delegateTransaction: false
+      } as never,
+      jest.fn(async () => new Uint8Array([1])),
+      false,
+      makeGuardianProvider(true)
+    );
+
+    expect(multisigService.createConsumeNotesProposal).toHaveBeenCalledWith(['note-xyz']);
+  });
+
+  it('Guardian switch-guardian: waits for chain inclusion before finalizing the switch', async () => {
+    const txId = 'switch-guardian-1';
+    const result = makeResult();
+    txStore.push({
+      id: txId,
+      type: 'switch-guardian',
+      accountId: 'guardian-acc',
+      status: ITransactionStatus.Queued,
+      extraInputs: { newGuardianEndpoint: 'https://new.guardian' }
+    });
+
+    const multisigService = {
+      createSwitchGuardianProposal: jest.fn(async () => ({
+        proposal: { id: 'prop-switch' },
+        newEndpoint: 'https://new.guardian'
+      })),
+      signAndCreateTransactionRequest: jest.fn(async () => ({ serialize: () => new Uint8Array([1]) })),
+      finalizeGuardianSwitch: jest.fn(async () => {}),
+      sync: jest.fn(async () => {})
+    };
+    mockGetOrCreateMultisigService.mockResolvedValue(multisigService);
+
+    const waitForTransactionCommit = jest.fn(async () => {});
+    mockGetMidenClient.mockResolvedValue({
+      syncState: jest.fn(async () => {}),
+      waitForTransactionCommit,
+      client: { transactions: { submit: jest.fn(async () => ({ result })) } }
+    });
+
+    await generateTransaction(
+      {
+        id: txId,
+        type: 'switch-guardian',
+        accountId: 'guardian-acc',
+        extraInputs: { newGuardianEndpoint: 'https://new.guardian' },
+        delegateTransaction: false
+      } as never,
+      jest.fn(async () => new Uint8Array([1])),
+      false,
+      makeGuardianProvider(true)
+    );
+
+    // The switch-guardian path must build the proposal via createSwitchGuardianProposal,
+    // wait for on-chain inclusion, and then finalize the switch (registering post-switch state).
+    expect(multisigService.createSwitchGuardianProposal).toHaveBeenCalledWith('https://new.guardian');
+    expect(waitForTransactionCommit).toHaveBeenCalledWith('exec-tx-hash');
+    expect(multisigService.finalizeGuardianSwitch).toHaveBeenCalledWith('https://new.guardian');
+  });
+
+  it('Guardian: unsupported transaction type cancels the transaction', async () => {
+    const txId = 'unsupported-guardian';
+    txStore.push({
+      id: txId,
+      type: 'execute',
+      accountId: 'guardian-acc',
+      status: ITransactionStatus.Queued
+    });
+    mockGetMidenClient.mockResolvedValue({
+      syncState: jest.fn(async () => {}),
+      client: { transactions: { submit: jest.fn() } }
+    });
+    mockGetOrCreateMultisigService.mockResolvedValue({});
+
+    // generateGuardianTransaction throws on 'execute'; generateTransaction
+    // swallows it via cancelTransaction and marks the row Failed.
+    await generateTransaction(
+      { id: txId, type: 'execute', accountId: 'guardian-acc', delegateTransaction: false } as never,
+      jest.fn(),
+      false,
+      makeGuardianProvider(true)
+    );
+
+    const row = txStore.find(r => r.id === txId) as Record<string, unknown>;
+    expect(row.status).toBe(ITransactionStatus.Failed);
+  });
+});
diff --git a/src/lib/miden/back/vault.test.ts b/src/lib/miden/back/vault.test.ts
index 30dd1d12a..6e7242a79 100644
--- a/src/lib/miden/back/vault.test.ts
+++ b/src/lib/miden/back/vault.test.ts
@@ -839,6 +839,40 @@ describe('Vault hardware branches', () => {
     await expect(vlt.createHDAccount('invalid' as any)).rejects.toThrow();
   });
 
+  it('Vault.spawn propagates importAccountBySeed failures for Guardian imports (no silent fallback)', async () => {
+    // The Guardian import path must NOT fall back to createMidenWallet — otherwise
+    // a silently-recreated account would leave the user with an empty balance
+    // under their seed. The branch rethrows, wrapped as a PublicError by withError.
+    (isDesktop as jest.Mock).mockReturnValue(false);
+    (isMobile as jest.Mock).mockReturnValue(false);
+    mockMidenClient.importPublicMidenWalletFromSeed.mockRejectedValueOnce(new Error('guardian lookup failed'));
+
+    await expect(Vault.spawn(WalletType.Guardian, 'pw-guardian-fail', VALID_MNEMONIC, true)).rejects.toThrow(
+      PublicError
+    );
+
+    // createMidenWallet must NOT be called as a fallback — Guardian rethrows.
+    expect(mockMidenClient.createMidenWallet).not.toHaveBeenCalledWith(WalletType.Guardian, expect.anything());
+  });
+
+  it('createHDAccount supports WalletType.Guardian (derivation index 2)', async () => {
+    (isDesktop as jest.Mock).mockReturnValue(false);
+    (isMobile as jest.Mock).mockReturnValue(false);
+    const vlt = await Vault.spawn(WalletType.OnChain, 'pw-guardian-test');
+    // Guardian resolves to the third branch inside getMainDerivationPath (walletTypeIndex=2);
+    // createMidenWallet is stubbed to return a predictable account id.
+    mockMidenClient.createMidenWallet.mockResolvedValueOnce('guardian-acc-1');
+    await expect(vlt.createHDAccount(WalletType.Guardian, 'Guardian 1')).resolves.toBeTruthy();
+  });
+
+  it('createHDAccount supports WalletType.OffChain (derivation index 1)', async () => {
+    (isDesktop as jest.Mock).mockReturnValue(false);
+    (isMobile as jest.Mock).mockReturnValue(false);
+    const vlt = await Vault.spawn(WalletType.OnChain, 'pw-offchain-test');
+    mockMidenClient.createMidenWallet.mockResolvedValueOnce('off-acc-1');
+    await expect(vlt.createHDAccount(WalletType.OffChain, 'Off 1')).resolves.toBeTruthy();
+  });
+
   it('getHardwareVaultKey on desktop decrypts via desktop secure-storage', async () => {
     (isDesktop as jest.Mock).mockReturnValue(true);
     (isMobile as jest.Mock).mockReturnValue(false);
diff --git a/src/lib/miden/front/guardian-manager.test.ts b/src/lib/miden/front/guardian-manager.test.ts
new file mode 100644
index 000000000..0b90bfdda
--- /dev/null
+++ b/src/lib/miden/front/guardian-manager.test.ts
@@ -0,0 +1,212 @@
+/**
+ * Coverage for getOrCreateMultisigService + isGuardianAccount + cache helpers.
+ * Every external dependency (MultisigService, WASM client, storage) is stubbed
+ * so these tests stay deterministic and don't touch real SDK/wasm.
+ */
+
+import { WalletType } from 'screens/onboarding/types';
+
+import {
+  clearGuardianCache,
+  clearGuardianServiceFor,
+  getOrCreateMultisigService,
+  isGuardianAccount,
+  type GuardianAccountProvider
+} from './guardian-manager';
+
+const mockFetchFromStorage = jest.fn();
+jest.mock('./storage', () => ({
+  fetchFromStorage: (...args: unknown[]) => mockFetchFromStorage(...args)
+}));
+
+const mockGetSignerDetailsFromAccount = jest.fn();
+jest.mock('../guardian/account', () => ({
+  getSignerDetailsFromAccount: (...args: unknown[]) => mockGetSignerDetailsFromAccount(...args)
+}));
+
+const mockGetAccount = jest.fn();
+const mockGetMidenClient = jest.fn(async () => ({ getAccount: mockGetAccount }));
+jest.mock('../sdk/miden-client', () => ({
+  getMidenClient: (...args: unknown[]) => mockGetMidenClient(...args),
+  withWasmClientLock: async <T>(fn: () => Promise<T>) => fn()
+}));
+
+const mockMultisigServiceInit = jest.fn();
+jest.mock('lib/miden/guardian', () => ({
+  MultisigService: {
+    init: (...args: unknown[]) => mockMultisigServiceInit(...args)
+  }
+}));
+
+jest.mock('lib/miden-chain/constants', () => ({
+  DEFAULT_GUARDIAN_ENDPOINT: 'https://default.guardian.test'
+}));
+
+jest.mock('lib/settings/constants', () => ({
+  GUARDIAN_URL_STORAGE_KEY: 'guardian_url_setting'
+}));
+
+const GUARDIAN_PK = 'guardian-pk';
+const OTHER_PK = 'other-pk';
+
+const guardianAccount = { publicKey: GUARDIAN_PK, type: WalletType.Guardian, name: 'Guardian', hdIndex: 0 };
+const onChainAccount = { publicKey: OTHER_PK, type: WalletType.OnChain, name: 'Public', hdIndex: 1 };
+
+const makeProvider = (accounts: unknown[]): GuardianAccountProvider => ({
+  getAccounts: jest.fn(async () => accounts as never),
+  getPublicKeyForCommitment: jest.fn(async () => 'pk-for-commitment'),
+  signWord: jest.fn(async () => 'signature')
+});
+
+describe('guardian-manager', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    clearGuardianCache();
+    mockFetchFromStorage.mockResolvedValue('https://default.guardian.test');
+    mockGetSignerDetailsFromAccount.mockResolvedValue({ commitment: 'abc', publicKey: 'def' });
+    mockGetAccount.mockResolvedValue({ id: () => ({ toString: () => 'acc-id' }) });
+  });
+
+  describe('getOrCreateMultisigService', () => {
+    it('creates, caches, and returns a MultisigService for a Guardian account', async () => {
+      const service = { guardianEndpoint: 'https://default.guardian.test', tag: 'first' };
+      mockMultisigServiceInit.mockResolvedValueOnce(service);
+      const provider = makeProvider([guardianAccount]);
+
+      const result = await getOrCreateMultisigService(GUARDIAN_PK, provider);
+
+      expect(result).toBe(service);
+      expect(mockMultisigServiceInit).toHaveBeenCalledWith(expect.anything(), '0xdef', '0xabc', provider.signWord);
+      // Second call for the same account returns the cached instance without
+      // re-initializing the service.
+      mockMultisigServiceInit.mockClear();
+      const second = await getOrCreateMultisigService(GUARDIAN_PK, provider);
+      expect(second).toBe(service);
+      expect(mockMultisigServiceInit).not.toHaveBeenCalled();
+    });
+
+    it('falls back to DEFAULT_GUARDIAN_ENDPOINT when storage is empty on the cache-drift re-check', async () => {
+      // First call seeds the cache with a service pinned to the default endpoint.
+      const service = { guardianEndpoint: 'https://default.guardian.test', tag: 'cached' };
+      mockMultisigServiceInit.mockResolvedValueOnce(service);
+      const provider = makeProvider([guardianAccount]);
+      await getOrCreateMultisigService(GUARDIAN_PK, provider);
+
+      // Second call: storage returns `undefined`, so the re-check computes the
+      // default endpoint via the `|| DEFAULT_GUARDIAN_ENDPOINT` fallback and
+      // the cached instance stays valid.
+      mockFetchFromStorage.mockResolvedValueOnce(undefined);
+      mockMultisigServiceInit.mockClear();
+
+      const second = await getOrCreateMultisigService(GUARDIAN_PK, provider);
+
+      expect(second).toBe(service);
+      expect(mockMultisigServiceInit).not.toHaveBeenCalled();
+    });
+
+    it('evicts the cached service and reinitializes when the stored guardian URL drifts', async () => {
+      const firstService = { guardianEndpoint: 'https://default.guardian.test', tag: 'first' };
+      const secondService = { guardianEndpoint: 'https://new.guardian.test', tag: 'second' };
+      mockMultisigServiceInit.mockResolvedValueOnce(firstService).mockResolvedValueOnce(secondService);
+      const provider = makeProvider([guardianAccount]);
+
+      await getOrCreateMultisigService(GUARDIAN_PK, provider);
+      // User switched guardian — storage now returns a new URL.
+      mockFetchFromStorage.mockResolvedValueOnce('https://new.guardian.test');
+
+      const result = await getOrCreateMultisigService(GUARDIAN_PK, provider);
+
+      expect(result).toBe(secondService);
+      expect(mockMultisigServiceInit).toHaveBeenCalledTimes(2);
+    });
+
+    it('throws when the account is not of type Guardian', async () => {
+      const provider = makeProvider([onChainAccount]);
+
+      await expect(getOrCreateMultisigService(OTHER_PK, provider)).rejects.toThrow('Account is not a Guardian account');
+    });
+
+    it('throws when the public key is unknown to the provider', async () => {
+      const provider = makeProvider([guardianAccount]);
+
+      await expect(getOrCreateMultisigService('missing-pk', provider)).rejects.toThrow(
+        'Account is not a Guardian account'
+      );
+    });
+
+    it('throws when the SDK has no record of the account', async () => {
+      mockGetAccount.mockResolvedValueOnce(null);
+      const provider = makeProvider([guardianAccount]);
+
+      await expect(getOrCreateMultisigService(GUARDIAN_PK, provider)).rejects.toThrow(
+        'Account not found in local storage'
+      );
+    });
+  });
+
+  describe('isGuardianAccount', () => {
+    it('returns true for a Guardian-typed account', async () => {
+      const provider = makeProvider([guardianAccount, onChainAccount]);
+
+      await expect(isGuardianAccount(GUARDIAN_PK, provider)).resolves.toBe(true);
+    });
+
+    it('returns false for a non-Guardian account', async () => {
+      const provider = makeProvider([guardianAccount, onChainAccount]);
+
+      await expect(isGuardianAccount(OTHER_PK, provider)).resolves.toBe(false);
+    });
+
+    it('returns false for an unknown public key', async () => {
+      const provider = makeProvider([guardianAccount]);
+
+      await expect(isGuardianAccount('ghost', provider)).resolves.toBe(false);
+    });
+  });
+
+  describe('cache helpers', () => {
+    it('clearGuardianServiceFor drops only the matching entry', async () => {
+      const svcA = { guardianEndpoint: 'https://default.guardian.test', id: 'A' };
+      const svcB = { guardianEndpoint: 'https://default.guardian.test', id: 'B' };
+      mockMultisigServiceInit.mockResolvedValueOnce(svcA).mockResolvedValueOnce(svcB);
+      const providerA = makeProvider([{ ...guardianAccount, publicKey: 'A' }]);
+      const providerB = makeProvider([{ ...guardianAccount, publicKey: 'B' }]);
+
+      await getOrCreateMultisigService('A', providerA);
+      await getOrCreateMultisigService('B', providerB);
+
+      clearGuardianServiceFor('A');
+
+      // B is still cached; A must reinitialize.
+      mockMultisigServiceInit.mockClear();
+      await getOrCreateMultisigService('B', providerB);
+      expect(mockMultisigServiceInit).not.toHaveBeenCalled();
+
+      mockMultisigServiceInit.mockResolvedValueOnce({ guardianEndpoint: 'https://default.guardian.test', id: 'A2' });
+      await getOrCreateMultisigService('A', providerA);
+      expect(mockMultisigServiceInit).toHaveBeenCalledTimes(1);
+    });
+
+    it('clearGuardianCache wipes every entry', async () => {
+      mockMultisigServiceInit
+        .mockResolvedValueOnce({ guardianEndpoint: 'https://default.guardian.test' })
+        .mockResolvedValueOnce({ guardianEndpoint: 'https://default.guardian.test' });
+      const providerA = makeProvider([{ ...guardianAccount, publicKey: 'A' }]);
+      const providerB = makeProvider([{ ...guardianAccount, publicKey: 'B' }]);
+
+      await getOrCreateMultisigService('A', providerA);
+      await getOrCreateMultisigService('B', providerB);
+
+      clearGuardianCache();
+
+      mockMultisigServiceInit.mockClear();
+      mockMultisigServiceInit
+        .mockResolvedValueOnce({ guardianEndpoint: 'https://default.guardian.test' })
+        .mockResolvedValueOnce({ guardianEndpoint: 'https://default.guardian.test' });
+
+      await getOrCreateMultisigService('A', providerA);
+      await getOrCreateMultisigService('B', providerB);
+      expect(mockMultisigServiceInit).toHaveBeenCalledTimes(2);
+    });
+  });
+});
diff --git a/src/lib/miden/front/guardian-sync.test.ts b/src/lib/miden/front/guardian-sync.test.ts
new file mode 100644
index 000000000..c3089b021
--- /dev/null
+++ b/src/lib/miden/front/guardian-sync.test.ts
@@ -0,0 +1,102 @@
+/**
+ * zustandProvider + syncGuardianAccounts — the default provider exposes the
+ * store API, and the syncGuardianAccounts driver pulls from it, skips non-
+ * Guardian accounts, and swallows per-account errors so one bad account
+ * can't block the whole sync cycle.
+ */
+
+import { WalletType } from 'screens/onboarding/types';
+
+import { syncGuardianAccounts, zustandProvider } from './guardian-sync';
+
+const storeState: {
+  accounts: Array<{ publicKey: string; type: WalletType }>;
+  getPublicKeyForCommitment: jest.Mock;
+  signWord: jest.Mock;
+} = {
+  accounts: [],
+  getPublicKeyForCommitment: jest.fn(),
+  signWord: jest.fn()
+};
+
+jest.mock('lib/store', () => ({
+  useWalletStore: {
+    getState: () => storeState
+  }
+}));
+
+const mockGetOrCreateMultisigService = jest.fn();
+jest.mock('./guardian-manager', () => ({
+  getOrCreateMultisigService: (...args: unknown[]) => mockGetOrCreateMultisigService(...args)
+}));
+
+describe('zustandProvider', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    storeState.accounts = [];
+    storeState.getPublicKeyForCommitment.mockResolvedValue('pk');
+    storeState.signWord.mockResolvedValue('sig');
+  });
+
+  it('getAccounts returns the current store accounts', async () => {
+    storeState.accounts = [
+      { publicKey: 'a', type: WalletType.Guardian },
+      { publicKey: 'b', type: WalletType.OnChain }
+    ];
+    await expect(zustandProvider.getAccounts()).resolves.toEqual(storeState.accounts);
+  });
+
+  it('getPublicKeyForCommitment delegates to the store', async () => {
+    await zustandProvider.getPublicKeyForCommitment('commitment-x');
+    expect(storeState.getPublicKeyForCommitment).toHaveBeenCalledWith('commitment-x');
+  });
+
+  it('signWord delegates to the store', async () => {
+    await zustandProvider.signWord('pub', '0xhex');
+    expect(storeState.signWord).toHaveBeenCalledWith('pub', '0xhex');
+  });
+});
+
+describe('syncGuardianAccounts', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    storeState.accounts = [];
+  });
+
+  it('is a no-op when no Guardian accounts are present', async () => {
+    storeState.accounts = [{ publicKey: 'pub', type: WalletType.OnChain }];
+
+    await syncGuardianAccounts();
+
+    expect(mockGetOrCreateMultisigService).not.toHaveBeenCalled();
+  });
+
+  it('calls service.sync for every Guardian account', async () => {
+    storeState.accounts = [
+      { publicKey: 'guardian-1', type: WalletType.Guardian },
+      { publicKey: 'public-1', type: WalletType.OnChain },
+      { publicKey: 'guardian-2', type: WalletType.Guardian }
+    ];
+    const sync = jest.fn(async () => {});
+    mockGetOrCreateMultisigService.mockResolvedValue({ sync });
+
+    await syncGuardianAccounts();
+
+    expect(mockGetOrCreateMultisigService).toHaveBeenCalledTimes(2);
+    expect(mockGetOrCreateMultisigService).toHaveBeenNthCalledWith(1, 'guardian-1', zustandProvider);
+    expect(mockGetOrCreateMultisigService).toHaveBeenNthCalledWith(2, 'guardian-2', zustandProvider);
+    expect(sync).toHaveBeenCalledTimes(2);
+  });
+
+  it('continues syncing remaining accounts when one throws', async () => {
+    storeState.accounts = [
+      { publicKey: 'guardian-bad', type: WalletType.Guardian },
+      { publicKey: 'guardian-good', type: WalletType.Guardian }
+    ];
+    const goodSync = jest.fn(async () => {});
+    mockGetOrCreateMultisigService.mockRejectedValueOnce(new Error('boom')).mockResolvedValueOnce({ sync: goodSync });
+
+    await expect(syncGuardianAccounts()).resolves.toBeUndefined();
+    expect(goodSync).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/src/lib/miden/front/useSyncTrigger.test.tsx b/src/lib/miden/front/useSyncTrigger.test.tsx
new file mode 100644
index 000000000..68fafb273
--- /dev/null
+++ b/src/lib/miden/front/useSyncTrigger.test.tsx
@@ -0,0 +1,210 @@
+/**
+ * useSyncTrigger — the 3s chain-sync loop. Two branches:
+ *   - Extension: posts SyncRequest to the SW, then runs Guardian sync
+ *     in the frontend context.
+ *   - Mobile/desktop: calls client.syncState() directly under the WASM
+ *     lock, then Guardian sync outside the lock.
+ *
+ * The hook's React surface is small — most of the logic lives in the
+ * effect body. We exercise both branches, the status gating, and the
+ * Guardian sync skip.
+ */
+
+import React from 'react';
+
+import { act, render, waitFor } from '@testing-library/react';
+
+import { WalletStatus } from 'lib/shared/types';
+import { WalletType } from 'screens/onboarding/types';
+
+import { useSyncTrigger } from './useSyncTrigger';
+
+const storeState: {
+  status: WalletStatus;
+  accounts: Array<{ publicKey: string; type: WalletType }>;
+  isTransactionModalOpen: boolean;
+  setSyncStatus: jest.Mock;
+} = {
+  status: WalletStatus.Ready,
+  accounts: [],
+  isTransactionModalOpen: false,
+  setSyncStatus: jest.fn()
+};
+
+const mockIntercomRequest = jest.fn(async () => ({ type: 'ok' }));
+const mockGetIntercom = jest.fn(() => ({ request: mockIntercomRequest }));
+
+jest.mock('lib/store', () => {
+  // Zustand selector mock — reads the live storeState reference so test
+  // mutations are reflected inside the component.
+  const hook = (selector: (s: unknown) => unknown) => selector(storeState);
+  (hook as unknown as { getState: () => unknown }).getState = () => storeState;
+  return {
+    useWalletStore: hook,
+    getIntercom: (...args: unknown[]) => mockGetIntercom(...args)
+  };
+});
+
+const mockSyncState = jest.fn(async () => {});
+const mockGetMidenClient = jest.fn(async () => ({ syncState: mockSyncState }));
+jest.mock('lib/miden/sdk/miden-client', () => ({
+  getMidenClient: (...args: unknown[]) => mockGetMidenClient(...args),
+  // In .tsx `<T>` parses as JSX — the trailing comma disambiguates it as a generic.
+  withWasmClientLock: async <T,>(fn: () => Promise<T>) => fn()
+}));
+
+const mockIsExtension = jest.fn(() => false);
+const mockIsMobile = jest.fn(() => false);
+jest.mock('lib/platform', () => ({
+  isExtension: (...args: unknown[]) => mockIsExtension(...args),
+  isMobile: (...args: unknown[]) => mockIsMobile(...args)
+}));
+
+const mockSyncGuardianAccounts = jest.fn(async () => {});
+jest.mock('./guardian-sync', () => ({
+  syncGuardianAccounts: (...args: unknown[]) => mockSyncGuardianAccounts(...args)
+}));
+
+const HookHost: React.FC = () => {
+  useSyncTrigger();
+  return null;
+};
+
+const flush = () => new Promise(res => setTimeout(res, 0));
+
+describe('useSyncTrigger', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    storeState.status = WalletStatus.Ready;
+    storeState.accounts = [];
+    storeState.isTransactionModalOpen = false;
+    mockIsExtension.mockReturnValue(false);
+    mockIsMobile.mockReturnValue(false);
+  });
+
+  it('does nothing when wallet status is not Ready', () => {
+    storeState.status = WalletStatus.Locked;
+    render(<HookHost />);
+    expect(mockIntercomRequest).not.toHaveBeenCalled();
+    expect(mockSyncState).not.toHaveBeenCalled();
+  });
+
+  it('extension: requests SyncRequest from the SW and skips Guardian sync when no Guardian accounts', async () => {
+    mockIsExtension.mockReturnValue(true);
+
+    const { unmount } = render(<HookHost />);
+
+    await waitFor(() => expect(mockIntercomRequest).toHaveBeenCalled());
+    await flush();
+    expect(mockSyncGuardianAccounts).not.toHaveBeenCalled();
+    unmount();
+  });
+
+  it('extension: runs Guardian sync after chain sync when Guardian accounts exist', async () => {
+    mockIsExtension.mockReturnValue(true);
+    storeState.accounts = [{ publicKey: 'g1', type: WalletType.Guardian }];
+
+    const { unmount } = render(<HookHost />);
+
+    await waitFor(() => expect(mockSyncGuardianAccounts).toHaveBeenCalledTimes(1));
+    unmount();
+  });
+
+  it('extension: swallows Guardian sync errors so the chain-sync loop keeps running', async () => {
+    mockIsExtension.mockReturnValue(true);
+    storeState.accounts = [{ publicKey: 'g1', type: WalletType.Guardian }];
+    mockSyncGuardianAccounts.mockRejectedValueOnce(new Error('guardian unreachable'));
+
+    const { unmount } = render(<HookHost />);
+
+    await waitFor(() => expect(mockSyncGuardianAccounts).toHaveBeenCalled());
+    unmount();
+  });
+
+  it('mobile/desktop: drives syncState directly and flips the store sync flag', async () => {
+    const { unmount } = render(<HookHost />);
+
+    await waitFor(() => expect(mockSyncState).toHaveBeenCalled());
+    // Flips sync status on and off around the call.
+    expect(storeState.setSyncStatus).toHaveBeenCalledWith(true);
+    await waitFor(() => expect(storeState.setSyncStatus).toHaveBeenCalledWith(false));
+    unmount();
+  });
+
+  it('mobile/desktop: runs Guardian sync after chain sync when Guardian accounts exist', async () => {
+    storeState.accounts = [{ publicKey: 'g1', type: WalletType.Guardian }];
+
+    const { unmount } = render(<HookHost />);
+
+    await waitFor(() => expect(mockSyncGuardianAccounts).toHaveBeenCalled());
+    unmount();
+  });
+
+  it('mobile/desktop: skips sync while the mobile transaction modal is open', async () => {
+    mockIsMobile.mockReturnValue(true);
+    storeState.isTransactionModalOpen = true;
+
+    const { unmount } = render(<HookHost />);
+
+    await flush();
+    expect(mockSyncState).not.toHaveBeenCalled();
+    unmount();
+  });
+
+  it('mobile/desktop: warns and recovers when syncState throws', async () => {
+    const warn = jest.spyOn(console, 'warn').mockImplementation(() => {});
+    mockSyncState.mockRejectedValueOnce(new Error('offline'));
+
+    const { unmount } = render(<HookHost />);
+
+    await waitFor(() => expect(warn).toHaveBeenCalled());
+    // setSyncStatus(false) still runs in finally so the header spinner clears.
+    await waitFor(() => expect(storeState.setSyncStatus).toHaveBeenCalledWith(false));
+    warn.mockRestore();
+    unmount();
+  });
+
+  it('mobile/desktop: bails out of runAndSchedule when unmount fires before the first tick', async () => {
+    // Make the WASM lock wait until we explicitly resolve it, so we can
+    // unmount between runAndSchedule starting and completing. The `cancelled`
+    // flag then short-circuits the inner `if (!client || cancelled) return` branch.
+    let releaseLock!: () => void;
+    const lockGate = new Promise<void>(resolve => {
+      releaseLock = resolve;
+    });
+    mockGetMidenClient.mockImplementationOnce(async () => {
+      await lockGate;
+      return { syncState: mockSyncState };
+    });
+
+    const { unmount } = render(<HookHost />);
+    // Unmount before the lock releases, flipping `cancelled = true`.
+    unmount();
+    releaseLock();
+
+    // Let any pending microtasks drain — syncState must not run because the
+    // inner cancel guard short-circuits.
+    await flush();
+    expect(mockSyncState).not.toHaveBeenCalled();
+  });
+
+  it('extension: clears the interval on unmount', async () => {
+    jest.useFakeTimers();
+    mockIsExtension.mockReturnValue(true);
+
+    const { unmount } = render(<HookHost />);
+    // initial tick
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    unmount();
+    // Advance past the interval — no new requests after unmount.
+    const callsBefore = mockIntercomRequest.mock.calls.length;
+    act(() => {
+      jest.advanceTimersByTime(10_000);
+    });
+    expect(mockIntercomRequest.mock.calls.length).toBe(callsBefore);
+    jest.useRealTimers();
+  });
+});
diff --git a/src/lib/miden/guardian/account.test.ts b/src/lib/miden/guardian/account.test.ts
new file mode 100644
index 000000000..d5ea87c6f
--- /dev/null
+++ b/src/lib/miden/guardian/account.test.ts
@@ -0,0 +1,215 @@
+/**
+ * guardian/account — getSignerDetailsFromAccount reads the first signer
+ * commitment out of the multisig storage slot; createGuardianAccount drives
+ * MultisigClient.create + guardian registration + keystore insertion.
+ *
+ * All external collaborators are stubbed; we don't exec any real WASM.
+ */
+
+import { createGuardianAccount, getSignerDetailsFromAccount, MULTISIG_SLOT_NAMES } from './account';
+
+const mockFetchFromStorage = jest.fn();
+jest.mock('../front/storage', () => ({
+  fetchFromStorage: (...args: unknown[]) => mockFetchFromStorage(...args)
+}));
+
+jest.mock('lib/miden-chain/constants', () => ({
+  DEFAULT_GUARDIAN_ENDPOINT: 'https://default.guardian.test'
+}));
+
+jest.mock('lib/settings/constants', () => ({
+  GUARDIAN_URL_STORAGE_KEY: 'guardian_url_setting'
+}));
+
+// AuthSecretKey.rpoFalconWithRNG + commitment calls need a predictable stub.
+const mockAuthSecretKeyRpo = jest.fn();
+jest.mock('@miden-sdk/miden-sdk/lazy', () => {
+  const actual = jest.requireActual('../../../../__mocks__/wasmMock.js');
+  return {
+    ...actual,
+    AuthSecretKey: { rpoFalconWithRNG: (seed: unknown) => mockAuthSecretKeyRpo(seed) }
+  };
+});
+jest.mock('@miden-sdk/miden-sdk', () => {
+  const actual = jest.requireActual('../../../../__mocks__/wasmMock.js');
+  return {
+    ...actual,
+    AuthSecretKey: { rpoFalconWithRNG: (seed: unknown) => mockAuthSecretKeyRpo(seed) }
+  };
+});
+
+// Guardian SDK stubs — keep per-test knobs for getPubkey + client.create.
+const multisigClientConfig: {
+  create: jest.Mock;
+  getPubkey: jest.Mock;
+} = {
+  create: jest.fn(),
+  getPubkey: jest.fn()
+};
+
+jest.mock('@openzeppelin/miden-multisig-client', () => ({
+  MultisigClient: jest.fn().mockImplementation(() => ({
+    create: (...a: unknown[]) => multisigClientConfig.create(...a),
+    guardianClient: {
+      getPubkey: (...a: unknown[]) => multisigClientConfig.getPubkey(...a)
+    }
+  })),
+  FalconSigner: jest.fn().mockImplementation((sk: unknown) => ({ sk }))
+}));
+
+describe('getSignerDetailsFromAccount', () => {
+  const getPublicKeyForCommitment = jest.fn();
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    getPublicKeyForCommitment.mockResolvedValue('derived-pubkey');
+  });
+
+  const makeAccount = (entries: unknown) => ({
+    storage: () => ({ getMapEntries: jest.fn(() => entries) })
+  });
+
+  it('reads the first signer commitment and resolves the matching public key', async () => {
+    const account = makeAccount([{ value: '0xcommit-first' }, { value: '0xcommit-second' }]);
+
+    const result = await getSignerDetailsFromAccount(account as never, getPublicKeyForCommitment);
+
+    expect(result).toEqual({ commitment: 'commit-first', publicKey: 'derived-pubkey' });
+    expect(getPublicKeyForCommitment).toHaveBeenCalledWith('commit-first');
+  });
+
+  it('throws when the signer-public-keys slot is missing', async () => {
+    const account = makeAccount(undefined);
+
+    await expect(getSignerDetailsFromAccount(account as never, getPublicKeyForCommitment)).rejects.toThrow(
+      'No signer public keys found in account storage'
+    );
+  });
+
+  it('throws when the slot is present but empty', async () => {
+    const account = makeAccount([]);
+
+    await expect(getSignerDetailsFromAccount(account as never, getPublicKeyForCommitment)).rejects.toThrow(
+      'No signer commitments found in account storage'
+    );
+  });
+
+  it('throws when the stored value has no bytes after the 0x prefix', async () => {
+    // `.slice(2)` on '0x' yields an empty string — the `if (!commitment)` guard
+    // rejects instead of handing an empty hash to getPublicKeyForCommitment.
+    const account = makeAccount([{ value: '0x' }]);
+
+    await expect(getSignerDetailsFromAccount(account as never, getPublicKeyForCommitment)).rejects.toThrow(
+      'Commitment not found in account storage'
+    );
+    expect(getPublicKeyForCommitment).not.toHaveBeenCalled();
+  });
+
+  it('exposes the multisig storage slot names', () => {
+    expect(MULTISIG_SLOT_NAMES.SIGNER_PUBLIC_KEYS).toBe('openzeppelin::multisig::signer_public_keys');
+  });
+});
+
+describe('createGuardianAccount', () => {
+  const makeMultisig = () => ({
+    account: { id: () => ({ toString: () => 'guardian-acc-id' }) },
+    registerOnGuardian: jest.fn(async () => {})
+  });
+
+  const makeWebClient = () => ({
+    sync: jest.fn(async () => {}),
+    keystore: { insert: jest.fn(async () => {}) }
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockAuthSecretKeyRpo.mockReturnValue({
+      publicKey: () => ({ toCommitment: () => ({ toHex: () => '0xsigner-commit' }) })
+    });
+    multisigClientConfig.getPubkey.mockResolvedValue({ commitment: 'g-commit', pubkey: 'g-pubkey' });
+    mockFetchFromStorage.mockResolvedValue(undefined);
+  });
+
+  it('creates a 1-of-1 multisig, registers with the guardian, syncs, and persists the signer key', async () => {
+    const webClient = makeWebClient();
+    const multisig = makeMultisig();
+    multisigClientConfig.create.mockResolvedValueOnce(multisig);
+
+    const seed = new Uint8Array([1, 2, 3, 4]);
+    const account = await createGuardianAccount(webClient as never, seed);
+
+    expect(mockAuthSecretKeyRpo).toHaveBeenCalledWith(seed);
+    expect(multisigClientConfig.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        threshold: 1,
+        signerCommitments: ['0xsigner-commit'],
+        guardianCommitment: 'g-commit',
+        guardianPublicKey: 'g-pubkey',
+        guardianEnabled: true,
+        storageMode: 'private',
+        signatureScheme: 'falcon',
+        seed
+      }),
+      expect.anything()
+    );
+    expect(multisig.registerOnGuardian).toHaveBeenCalled();
+    expect(webClient.sync).toHaveBeenCalled();
+    expect(webClient.keystore.insert).toHaveBeenCalled();
+    expect(account).toBe(multisig.account);
+  });
+
+  it('generates a random seed when none is provided', async () => {
+    const webClient = makeWebClient();
+    multisigClientConfig.create.mockResolvedValueOnce(makeMultisig());
+
+    await createGuardianAccount(webClient as never);
+
+    // rpoFalconWithRNG was still called with a 32-byte Uint8Array.
+    const seedArg = mockAuthSecretKeyRpo.mock.calls[0]?.[0];
+    expect(seedArg).toBeInstanceOf(Uint8Array);
+    expect((seedArg as Uint8Array).length).toBe(32);
+  });
+
+  it('skips guardian registration when skipRegistration=true (import path)', async () => {
+    const webClient = makeWebClient();
+    const multisig = makeMultisig();
+    multisigClientConfig.create.mockResolvedValueOnce(multisig);
+
+    await createGuardianAccount(webClient as never, new Uint8Array(32), true);
+
+    expect(multisig.registerOnGuardian).not.toHaveBeenCalled();
+  });
+
+  it('uses the stored guardian URL when no override is supplied', async () => {
+    mockFetchFromStorage.mockResolvedValueOnce('https://stored.guardian');
+    const webClient = makeWebClient();
+    multisigClientConfig.create.mockResolvedValueOnce(makeMultisig());
+
+    await createGuardianAccount(webClient as never, new Uint8Array(32));
+
+    // When storage yields a URL, create still succeeds — the URL propagation
+    // goes through MultisigClient's constructor which we stubbed, so the
+    // useful signal is that fetchFromStorage was consulted.
+    expect(mockFetchFromStorage).toHaveBeenCalledWith('guardian_url_setting');
+  });
+
+  it('prefers the explicit override over storage and default', async () => {
+    mockFetchFromStorage.mockResolvedValueOnce('https://stored.guardian');
+    const webClient = makeWebClient();
+    multisigClientConfig.create.mockResolvedValueOnce(makeMultisig());
+
+    await createGuardianAccount(webClient as never, new Uint8Array(32), false, 'https://override.guardian');
+
+    // Override short-circuits the storage lookup entirely.
+    expect(mockFetchFromStorage).not.toHaveBeenCalled();
+  });
+
+  it('wraps underlying errors in a readable message', async () => {
+    const webClient = makeWebClient();
+    multisigClientConfig.create.mockRejectedValueOnce(new Error('wasm exploded'));
+
+    await expect(createGuardianAccount(webClient as never, new Uint8Array(32))).rejects.toThrow(
+      'Failed to create Guardian account'
+    );
+  });
+});
diff --git a/src/lib/miden/guardian/digest.test.ts b/src/lib/miden/guardian/digest.test.ts
new file mode 100644
index 000000000..0170ffb69
--- /dev/null
+++ b/src/lib/miden/guardian/digest.test.ts
@@ -0,0 +1,153 @@
+/**
+ * AuthDigest is a thin wrapper over the WASM-provided Felt / FeltArray /
+ * Rpo256 / AccountId / Word primitives. The tests stub all of those so
+ * we can assert the wrapper's behavior without running the real WASM.
+ *
+ * What we assert:
+ *   - fromAccountIdWithTimestamp parses "0x"-prefixed and bare hex, and
+ *     builds the Felt array [prefix, suffix, timestamp, 0].
+ *   - fromRequest delegates to the private payload-word builder and
+ *     forwards the resulting Felt array to Rpo256.hashElements.
+ *   - fromCommitmentHex pads to 32 bytes of hex regardless of input.
+ *   - empty-bytes and non-empty-bytes payload paths both produce Words.
+ */
+
+import { AuthDigest } from './digest';
+
+const accountIdFromHex = jest.fn();
+const rpoHashElements = jest.fn();
+const wordFromHex = jest.fn();
+const feltCtor = jest.fn();
+const feltArrayCtor = jest.fn();
+
+jest.mock('@miden-sdk/miden-sdk', () => {
+  class FeltStub {
+    value: bigint;
+    constructor(v: bigint) {
+      this.value = v;
+      feltCtor(v);
+    }
+  }
+  class FeltArrayStub {
+    elements: unknown[];
+    constructor(els: unknown[]) {
+      this.elements = els;
+      feltArrayCtor(els);
+    }
+  }
+  return {
+    AccountId: { fromHex: (...a: unknown[]) => accountIdFromHex(...a) },
+    Felt: FeltStub,
+    FeltArray: FeltArrayStub,
+    Rpo256: { hashElements: (...a: unknown[]) => rpoHashElements(...a) },
+    Word: { fromHex: (...a: unknown[]) => wordFromHex(...a) }
+  };
+});
+// The stubs above identify Felt instances by their `.value` bigint.
+type FeltLike = { value: bigint };
+
+describe('AuthDigest', () => {
+  const makeParsedAccount = (prefix: unknown, suffix: unknown) => ({
+    prefix: () => prefix,
+    suffix: () => suffix
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('fromAccountIdWithTimestamp', () => {
+    it('parses a 0x-prefixed account id and hashes [prefix, suffix, ts, 0]', () => {
+      accountIdFromHex.mockReturnValueOnce(makeParsedAccount('PREFIX', 'SUFFIX'));
+      rpoHashElements.mockReturnValueOnce('digest-word');
+
+      const out = AuthDigest.fromAccountIdWithTimestamp('0xabcdef', 42);
+
+      expect(accountIdFromHex).toHaveBeenCalledWith('0xabcdef');
+      const feltArrayArg = feltArrayCtor.mock.calls[0]?.[0] as FeltLike[];
+      expect(feltArrayArg).toHaveLength(4);
+      expect(feltArrayArg[0]).toBe('PREFIX');
+      expect(feltArrayArg[1]).toBe('SUFFIX');
+      expect(feltArrayArg[2]?.value).toBe(42n);
+      expect(feltArrayArg[3]?.value).toBe(0n);
+      expect(rpoHashElements).toHaveBeenCalled();
+      expect(out).toBe('digest-word');
+    });
+
+    it('adds the 0x prefix when the input is missing it', () => {
+      accountIdFromHex.mockReturnValueOnce(makeParsedAccount(0n, 0n));
+      rpoHashElements.mockReturnValueOnce('w');
+
+      AuthDigest.fromAccountIdWithTimestamp('abcdef', 1);
+
+      expect(accountIdFromHex).toHaveBeenCalledWith('0xabcdef');
+    });
+  });
+
+  describe('fromRequest', () => {
+    it('hashes the payload bytes into a Word, then folds it into the digest', () => {
+      // Two calls to hashElements: one for the payload, one for the final
+      // [prefix, suffix, ts, ...payloadWord] array.
+      accountIdFromHex.mockReturnValueOnce(makeParsedAccount('P', 'S'));
+      const payloadWord = { toFelts: () => ['f1', 'f2', 'f3', 'f4'] };
+      rpoHashElements.mockReturnValueOnce(payloadWord).mockReturnValueOnce('final-digest');
+
+      const requestPayload = { toBytes: () => new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8, 9]) } as never;
+      const out = AuthDigest.fromRequest('0xface', 100, requestPayload);
+
+      expect(out).toBe('final-digest');
+      // Final FeltArray contains 7 entries: [P, S, tsFelt, ...4 payload felts]
+      const finalFeltArrayArg = feltArrayCtor.mock.calls[1]?.[0] as unknown[];
+      expect(finalFeltArrayArg?.length).toBe(7);
+      expect(finalFeltArrayArg?.[0]).toBe('P');
+      expect(finalFeltArrayArg?.[1]).toBe('S');
+      expect(finalFeltArrayArg?.[3]).toBe('f1');
+    });
+
+    it('adds the 0x prefix to the account id when the caller passes bare hex', () => {
+      // Exercises the false branch of the 0x-prefix ternary inside the
+      // private `fromAccountIdTimestampAndPayloadWord` path.
+      accountIdFromHex.mockReturnValueOnce(makeParsedAccount('P', 'S'));
+      const payloadWord = { toFelts: () => ['f1', 'f2', 'f3', 'f4'] };
+      rpoHashElements.mockReturnValueOnce(payloadWord).mockReturnValueOnce('final');
+
+      const requestPayload = { toBytes: () => new Uint8Array([1, 2, 3]) } as never;
+      AuthDigest.fromRequest('bare-no-prefix', 50, requestPayload);
+
+      expect(accountIdFromHex).toHaveBeenCalledWith('0xbare-no-prefix');
+    });
+
+    it('short-circuits to the empty-payload Word when toBytes() returns an empty array', () => {
+      accountIdFromHex.mockReturnValueOnce(makeParsedAccount('P', 'S'));
+      // Empty-payload path: Word.fromHex called once with 64 zero hex chars,
+      // and the result is used directly (no extra hashElements call for the payload).
+      const emptyWord = { toFelts: () => ['e1', 'e2', 'e3', 'e4'] };
+      wordFromHex.mockReturnValueOnce(emptyWord);
+      rpoHashElements.mockReturnValueOnce('final');
+
+      const requestPayload = { toBytes: () => new Uint8Array() } as never;
+
+      AuthDigest.fromRequest('0xabc', 1, requestPayload);
+
+      expect(wordFromHex).toHaveBeenCalledWith('0x' + '0'.repeat(64));
+    });
+  });
+
+  describe('fromCommitmentHex', () => {
+    it('pads short hex to 32 bytes when building the Word', () => {
+      wordFromHex.mockReturnValueOnce('word');
+
+      AuthDigest.fromCommitmentHex('0xabc');
+
+      expect(wordFromHex).toHaveBeenCalledWith('0x' + 'abc'.padStart(64, '0'));
+    });
+
+    it('adds the 0x prefix when the caller forgot it', () => {
+      wordFromHex.mockReturnValueOnce('word');
+
+      AuthDigest.fromCommitmentHex('deadbeef');
+
+      expect(wordFromHex).toHaveBeenCalledWith('0x' + 'deadbeef'.padStart(64, '0'));
+    });
+  });
+});
diff --git a/src/lib/miden/guardian/index.test.ts b/src/lib/miden/guardian/index.test.ts
new file mode 100644
index 000000000..e6ff97340
--- /dev/null
+++ b/src/lib/miden/guardian/index.test.ts
@@ -0,0 +1,424 @@
+/**
+ * MultisigService — wraps MultisigClient/Multisig/GuardianHttpClient into a
+ * narrower surface used by the wallet. These tests cover:
+ *   - constructor / accountId getter
+ *   - proposal builders (send, consume, custom)
+ *   - signAndExecute / signAndCreateTransactionRequest
+ *   - sync retry on "nonce too low", including exhaustion
+ *   - importAccountFromGuardian happy + error path
+ *   - createSwitchGuardianProposal + finalizeGuardianSwitch
+ *
+ * All external collaborators are stubbed to keep tests hermetic.
+ */
+
+import { MultisigService } from './index';
+
+const mockFetchFromStorage = jest.fn();
+jest.mock('../front/storage', () => ({
+  fetchFromStorage: (...args: unknown[]) => mockFetchFromStorage(...args)
+}));
+
+jest.mock('lib/miden-chain/constants', () => ({
+  DEFAULT_GUARDIAN_ENDPOINT: 'https://default.guardian.test'
+}));
+
+jest.mock('lib/settings/constants', () => ({
+  GUARDIAN_URL_STORAGE_KEY: 'guardian_url_setting'
+}));
+
+jest.mock('lib/shared/helpers', () => ({
+  u8ToB64: jest.fn(() => 'base64-bytes')
+}));
+
+// Keep accountIdStringToSdk simple — we only assert it was called with the
+// inputs we passed; the real implementation parses bech32 which needs WASM.
+const mockAccountIdStringToSdk = jest.fn((id: string) => ({ toString: () => `sdk(${id})` }));
+jest.mock('../sdk/helpers', () => ({
+  accountIdStringToSdk: (...args: unknown[]) => mockAccountIdStringToSdk(...(args as [string]))
+}));
+
+const mockGetAccount = jest.fn();
+const mockSyncState = jest.fn(async () => {});
+const mockMidenClient = {
+  getAccount: (...args: unknown[]) => mockGetAccount(...args),
+  syncState: () => mockSyncState()
+};
+jest.mock('../sdk/miden-client', () => ({
+  getMidenClient: async () => mockMidenClient,
+  withWasmClientLock: async <T>(fn: () => Promise<T>) => fn()
+}));
+
+const mockInterfaceClient = { accounts: { insert: jest.fn(async () => {}) } };
+jest.mock('../sdk/miden-client-interface', () => ({
+  MidenClientInterface: {
+    create: jest.fn(async () => ({ client: mockInterfaceClient }))
+  }
+}));
+
+// Guardian SDK stubs — each constructor pulls from a per-test config so the
+// same `new GuardianHttpClient(...)` call can return different behavior per
+// test without juggling prototypes.
+const guardianConfig: {
+  getPubkey: jest.Mock;
+  getState: jest.Mock;
+  setSigner: jest.Mock;
+} = {
+  getPubkey: jest.fn(),
+  getState: jest.fn(),
+  setSigner: jest.fn()
+};
+const multisigClientConfig: { load: jest.Mock } = {
+  load: jest.fn()
+};
+
+jest.mock('@openzeppelin/miden-multisig-client', () => ({
+  GuardianHttpClient: jest.fn().mockImplementation(() => ({
+    getPubkey: (...a: unknown[]) => guardianConfig.getPubkey(...a),
+    getState: (...a: unknown[]) => guardianConfig.getState(...a),
+    setSigner: (...a: unknown[]) => guardianConfig.setSigner(...a)
+  })),
+  MultisigClient: jest.fn().mockImplementation(() => ({
+    load: (...a: unknown[]) => multisigClientConfig.load(...a)
+  }))
+}));
+
+// atob is globally available on Node 16+ but jsdom stubs can vary — provide
+// a deterministic polyfill for these tests.
+if (typeof global.atob === 'undefined') {
+  global.atob = (str: string) => Buffer.from(str, 'base64').toString('binary');
+}
+
+// Augment the existing wasmMock with the one bit we need: Account.deserialize.
+const mockAccountDeserialize = jest.fn();
+jest.mock('@miden-sdk/miden-sdk/lazy', () => {
+  const actual = jest.requireActual('../../../../__mocks__/wasmMock.js');
+  return {
+    ...actual,
+    Account: {
+      ...(actual.Account ?? {}),
+      deserialize: (...args: unknown[]) => mockAccountDeserialize(...args)
+    }
+  };
+});
+jest.mock('@miden-sdk/miden-sdk', () => {
+  const actual = jest.requireActual('../../../../__mocks__/wasmMock.js');
+  return {
+    ...actual,
+    Account: {
+      ...(actual.Account ?? {}),
+      deserialize: (...args: unknown[]) => mockAccountDeserialize(...args)
+    }
+  };
+});
+
+const makeMultisig = (overrides: Partial<Record<string, unknown>> = {}) => ({
+  accountId: 'acc-id',
+  account: {
+    nonce: () => ({ asInt: () => 5n })
+  },
+  createP2idProposal: jest.fn(async () => ({ kind: 'p2id' })),
+  createConsumeNotesProposal: jest.fn(async () => ({ kind: 'consume' })),
+  createProposal: jest.fn(async () => ({ kind: 'custom' })),
+  createTransactionProposalRequest: jest.fn(async () => 'tx-req'),
+  signProposal: jest.fn(async () => {}),
+  executeProposal: jest.fn(async () => {}),
+  syncState: jest.fn(async () => {}),
+  getConsumableNotes: jest.fn(async () => ['note-a']),
+  createSwitchGuardianProposal: jest.fn(async () => ({
+    nonce: 7,
+    txSummary: 'txs-b64',
+    metadata: { proposalType: 'switch-guardian' }
+  })),
+  setGuardianClient: jest.fn(),
+  registerOnGuardian: jest.fn(async () => {}),
+  guardianPublicKey: 'old-pubkey',
+  ...overrides
+});
+
+describe('MultisigService', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockFetchFromStorage.mockResolvedValue('https://stored.guardian.test');
+  });
+
+  describe('constructor + getters', () => {
+    it('accountId delegates to the wrapped Multisig', () => {
+      const multisig = makeMultisig();
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+      expect(service.accountId).toBe('acc-id');
+      expect(service.guardianEndpoint).toBe('https://x');
+    });
+  });
+
+  describe('proposal builders', () => {
+    it('createSendProposal normalizes recipient+faucet ids through accountIdStringToSdk', async () => {
+      const multisig = makeMultisig();
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+
+      const proposal = await service.createSendProposal('rec', 'fauc', 1000n);
+
+      expect(multisig.createP2idProposal).toHaveBeenCalledWith('sdk(rec)', 'sdk(fauc)', 1000n);
+      expect(proposal).toEqual({ kind: 'p2id' });
+    });
+
+    it('createConsumeNotesProposal forwards note ids untouched', async () => {
+      const multisig = makeMultisig();
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+
+      const proposal = await service.createConsumeNotesProposal(['n1', 'n2']);
+
+      expect(multisig.createConsumeNotesProposal).toHaveBeenCalledWith(['n1', 'n2']);
+      expect(proposal).toEqual({ kind: 'consume' });
+    });
+
+    it('createCustomProposal syncs state, reads the nonce+2, and tags metadata as unknown', async () => {
+      const multisig = makeMultisig();
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+
+      await service.createCustomProposal(new Uint8Array([1, 2, 3]));
+
+      expect(multisig.syncState).toHaveBeenCalled();
+      // Nonce was 5; createCustomProposal passes nonce+2 = 7.
+      expect(multisig.createProposal).toHaveBeenCalledWith(7, 'base64-bytes', {
+        proposalType: 'unknown',
+        description: 'Custom transaction'
+      });
+    });
+
+    it('createCustomProposal throws when the wrapped Multisig has no account', async () => {
+      const multisig = makeMultisig({ account: null });
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+
+      await expect(service.createCustomProposal(new Uint8Array())).rejects.toThrow(
+        'Account not found in MultisigService'
+      );
+    });
+  });
+
+  describe('signing helpers', () => {
+    it('signAndExecuteProposal signs then executes a given proposal', async () => {
+      const multisig = makeMultisig();
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+
+      await service.signAndExecuteProposal('p-1');
+
+      expect(multisig.signProposal).toHaveBeenCalledWith('p-1');
+      expect(multisig.executeProposal).toHaveBeenCalledWith('p-1');
+    });
+
+    it('signAndCreateTransactionRequest signs then returns the request payload', async () => {
+      const multisig = makeMultisig();
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+
+      const tx = await service.signAndCreateTransactionRequest('p-2');
+
+      expect(multisig.signProposal).toHaveBeenCalledWith('p-2');
+      expect(multisig.createTransactionProposalRequest).toHaveBeenCalledWith('p-2');
+      expect(tx).toBe('tx-req');
+    });
+
+    it('getConsumableNotes forwards to the wrapped Multisig', async () => {
+      const multisig = makeMultisig();
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+
+      await expect(service.getConsumableNotes()).resolves.toEqual(['note-a']);
+    });
+  });
+
+  describe('sync retry logic', () => {
+    it('resets retry count after a successful sync', async () => {
+      const multisig = makeMultisig();
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+      service.syncRetryCount = 4;
+
+      await service.sync();
+
+      expect(service.syncRetryCount).toBe(0);
+    });
+
+    it('rethrows immediately for non-nonce errors', async () => {
+      const multisig = makeMultisig({ syncState: jest.fn(async () => Promise.reject(new Error('network down'))) });
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+
+      await expect(service.sync()).rejects.toThrow('network down');
+    });
+
+    it('throws "Max sync retries reached" after MAX_SYNC_RETRIES consecutive nonce-too-low failures', async () => {
+      const origSetTimeout = global.setTimeout;
+      (global as unknown as { setTimeout: typeof setTimeout }).setTimeout = ((fn: () => void) => {
+        fn();
+        return 0 as unknown as ReturnType<typeof setTimeout>;
+      }) as typeof setTimeout;
+
+      const nonceErr = new Error('nonce is too low');
+      const syncState = jest.fn(async () => {
+        throw nonceErr;
+      });
+      const multisig = makeMultisig({ syncState });
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+
+      try {
+        await expect(service.sync()).rejects.toThrow('Max sync retries reached');
+        // 20 retries + the initial attempt = 21 calls.
+        expect(syncState).toHaveBeenCalledTimes(21);
+      } finally {
+        (global as unknown as { setTimeout: typeof setTimeout }).setTimeout = origSetTimeout;
+      }
+    });
+
+    it('increments the retry counter on a nonce-too-low error', async () => {
+      // Short-circuit the wait between retries so the test doesn't sit on a real 3s timer.
+      const origSetTimeout = global.setTimeout;
+      (global as unknown as { setTimeout: typeof setTimeout }).setTimeout = ((fn: () => void) => {
+        fn();
+        return 0 as unknown as ReturnType<typeof setTimeout>;
+      }) as typeof setTimeout;
+
+      const multisig = makeMultisig({
+        syncState: jest.fn().mockRejectedValueOnce(new Error('nonce is too low')).mockResolvedValueOnce(undefined)
+      });
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+
+      try {
+        await service.sync();
+        // After the retry succeeds, the counter resets to 0 again.
+        expect(service.syncRetryCount).toBe(0);
+        expect(multisig.syncState).toHaveBeenCalledTimes(2);
+      } finally {
+        (global as unknown as { setTimeout: typeof setTimeout }).setTimeout = origSetTimeout;
+      }
+    });
+  });
+
+  describe('importAccountFromGuardian', () => {
+    const signWordFn = jest.fn(async () => 'sig');
+
+    beforeEach(() => {
+      guardianConfig.setSigner.mockReset();
+      guardianConfig.getState.mockReset();
+    });
+
+    it('fetches state, base64-decodes into Account, and inserts into the webClient', async () => {
+      const webClient = {
+        accounts: { insert: jest.fn(async () => {}) }
+      };
+      const stateBase64 = Buffer.from('hello').toString('base64');
+      guardianConfig.getState.mockResolvedValueOnce({ stateJson: { data: stateBase64 } });
+      const fakeAccount = { id: () => ({ toString: () => 'acc' }) };
+      mockAccountDeserialize.mockReturnValueOnce(fakeAccount);
+
+      await MultisigService.importAccountFromGuardian('pub', 'commit', signWordFn, 'acc-id', webClient as never);
+
+      expect(guardianConfig.setSigner).toHaveBeenCalled();
+      expect(mockAccountDeserialize).toHaveBeenCalled();
+      expect(webClient.accounts.insert).toHaveBeenCalledWith({ account: fakeAccount, overwrite: true });
+    });
+
+    it('re-throws when the guardian state fetch fails', async () => {
+      const webClient = { accounts: { insert: jest.fn() } };
+      guardianConfig.getState.mockRejectedValueOnce(new Error('404'));
+
+      await expect(
+        MultisigService.importAccountFromGuardian('pub', 'commit', signWordFn, 'acc-id', webClient as never)
+      ).rejects.toThrow('404');
+      expect(webClient.accounts.insert).not.toHaveBeenCalled();
+    });
+
+    it('falls back to DEFAULT_GUARDIAN_ENDPOINT when storage has no URL', async () => {
+      // Exercises the `|| DEFAULT_GUARDIAN_ENDPOINT` branch on the endpoint lookup.
+      const webClient = { accounts: { insert: jest.fn(async () => {}) } };
+      mockFetchFromStorage.mockResolvedValueOnce(undefined);
+      const stateBase64 = Buffer.from('hi').toString('base64');
+      guardianConfig.getState.mockResolvedValueOnce({ stateJson: { data: stateBase64 } });
+      mockAccountDeserialize.mockReturnValueOnce({ id: () => ({ toString: () => 'x' }) });
+
+      await MultisigService.importAccountFromGuardian('pub', 'commit', signWordFn, 'acc-id', webClient as never);
+
+      expect(webClient.accounts.insert).toHaveBeenCalled();
+    });
+  });
+
+  describe('init', () => {
+    it('loads the Multisig for an existing account and returns a configured service', async () => {
+      const account = { id: () => ({ toString: () => 'acc-id' }) } as never;
+      const loaded = makeMultisig();
+      multisigClientConfig.load.mockResolvedValueOnce(loaded);
+
+      const svc = await MultisigService.init(account, 'pub', 'commit', async () => 'sig');
+
+      expect(svc).toBeInstanceOf(MultisigService);
+      expect(svc.multisig).toBe(loaded);
+    });
+
+    it('re-throws when MultisigClient.load rejects', async () => {
+      const account = { id: () => ({ toString: () => 'acc-id' }) } as never;
+      multisigClientConfig.load.mockRejectedValueOnce(new Error('load failed'));
+
+      await expect(MultisigService.init(account, 'pub', 'commit', async () => 'sig')).rejects.toThrow('load failed');
+    });
+
+    it('falls back to DEFAULT_GUARDIAN_ENDPOINT when storage has no URL', async () => {
+      // Hits the `|| DEFAULT_GUARDIAN_ENDPOINT` branch on the endpoint lookup.
+      const account = { id: () => ({ toString: () => 'acc-id' }) } as never;
+      const loaded = makeMultisig();
+      multisigClientConfig.load.mockResolvedValueOnce(loaded);
+      mockFetchFromStorage.mockResolvedValueOnce(undefined);
+
+      const svc = await MultisigService.init(account, 'pub', 'commit', async () => 'sig');
+
+      expect(svc.guardianEndpoint).toBe('https://default.guardian.test');
+    });
+  });
+
+  describe('guardian switch', () => {
+    it('createSwitchGuardianProposal consults the new guardian for its commitment and builds the proposal', async () => {
+      const multisig = makeMultisig();
+      const service = new MultisigService(multisig as never, {} as never, 'https://old');
+      guardianConfig.getPubkey.mockResolvedValueOnce({ commitment: 'new-commit', pubkey: 'new-pubkey' });
+
+      const { newEndpoint } = await service.createSwitchGuardianProposal('https://new');
+
+      expect(newEndpoint).toBe('https://new');
+      expect(multisig.createSwitchGuardianProposal).toHaveBeenCalledWith('https://new', 'new-commit');
+      expect(multisig.createProposal).toHaveBeenCalledWith(
+        7,
+        'txs-b64',
+        expect.objectContaining({ proposalType: 'switch-guardian' })
+      );
+    });
+
+    it('createSwitchGuardianProposal re-throws when the new guardian fetch fails', async () => {
+      const multisig = makeMultisig();
+      const service = new MultisigService(multisig as never, {} as never, 'https://old');
+      guardianConfig.getPubkey.mockRejectedValueOnce(new Error('unreachable'));
+
+      await expect(service.createSwitchGuardianProposal('https://new')).rejects.toThrow('unreachable');
+    });
+
+    it('finalizeGuardianSwitch serializes post-switch state and re-registers with the new guardian', async () => {
+      const multisig = makeMultisig();
+      const service = new MultisigService(multisig as never, {} as never, 'https://old');
+      mockGetAccount.mockResolvedValueOnce({ serialize: () => new Uint8Array([1]) });
+      guardianConfig.getPubkey.mockResolvedValueOnce({ commitment: 'new-commit', pubkey: 'new-pubkey' });
+
+      await service.finalizeGuardianSwitch('https://new');
+
+      expect(mockSyncState).toHaveBeenCalled();
+      expect(multisig.setGuardianClient).toHaveBeenCalled();
+      expect(multisig.guardianPublicKey).toBe('new-commit');
+      expect(service.guardianEndpoint).toBe('https://new');
+      expect(multisig.registerOnGuardian).toHaveBeenCalledWith('base64-bytes');
+    });
+
+    it('finalizeGuardianSwitch throws when the SDK has no record of the switched account', async () => {
+      const multisig = makeMultisig();
+      const service = new MultisigService(multisig as never, {} as never, 'https://old');
+      mockGetAccount.mockResolvedValueOnce(null);
+
+      await expect(service.finalizeGuardianSwitch('https://new')).rejects.toThrow(
+        `Updated account acc-id is missing from local client`
+      );
+      expect(multisig.registerOnGuardian).not.toHaveBeenCalled();
+    });
+  });
+});
diff --git a/src/lib/miden/guardian/signer.test.ts b/src/lib/miden/guardian/signer.test.ts
new file mode 100644
index 000000000..ec3237b26
--- /dev/null
+++ b/src/lib/miden/guardian/signer.test.ts
@@ -0,0 +1,72 @@
+/**
+ * WalletSigner wires the signWord callback to the Guardian signature flow.
+ * We stub AuthDigest so the tests don't depend on the WASM hashing primitives.
+ */
+
+import { WalletSigner } from './signer';
+
+const mockFromAccountIdWithTimestamp = jest.fn();
+const mockFromRequest = jest.fn();
+
+jest.mock('./digest', () => ({
+  AuthDigest: {
+    fromAccountIdWithTimestamp: (...args: unknown[]) => mockFromAccountIdWithTimestamp(...args),
+    fromRequest: (...args: unknown[]) => mockFromRequest(...args)
+  }
+}));
+
+describe('WalletSigner', () => {
+  const publicKey = '0xabc';
+  const commitment = '0xdead';
+  const accountId = '0x1234';
+  const timestamp = 1_700_000_000;
+
+  let signWordFn: jest.Mock;
+  let signer: WalletSigner;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    signWordFn = jest.fn(async () => '0xsig');
+    signer = new WalletSigner(publicKey, commitment, signWordFn);
+  });
+
+  it('exposes the configured public key, commitment, and falcon scheme', () => {
+    expect(signer.publicKey).toBe(publicKey);
+    expect(signer.commitment).toBe(commitment);
+    expect(signer.scheme).toBe('falcon');
+  });
+
+  it('signAccountIdWithTimestamp hashes and delegates to signWord with commitment stripped of 0x', async () => {
+    mockFromAccountIdWithTimestamp.mockReturnValueOnce({ toHex: () => '0xdigest1' });
+
+    const sig = await signer.signAccountIdWithTimestamp(accountId, timestamp);
+
+    expect(mockFromAccountIdWithTimestamp).toHaveBeenCalledWith(accountId, timestamp);
+    // signWordFn sees the commitment *without* leading 0x — this is what the guardian expects.
+    expect(signWordFn).toHaveBeenCalledWith('dead', '0xdigest1');
+    expect(sig).toBe('0xsig');
+  });
+
+  it('signRequest hashes the payload via AuthDigest.fromRequest and signs the digest', async () => {
+    mockFromRequest.mockReturnValueOnce({ toHex: () => '0xdigest2' });
+    const payload = { toBytes: () => new Uint8Array() } as never;
+
+    const sig = await signer.signRequest(accountId, timestamp, payload);
+
+    expect(mockFromRequest).toHaveBeenCalledWith(accountId, timestamp, payload);
+    expect(signWordFn).toHaveBeenCalledWith('dead', '0xdigest2');
+    expect(sig).toBe('0xsig');
+  });
+
+  it('signCommitment forwards the hex through signWord, adding the 0x prefix when missing', async () => {
+    await signer.signCommitment('cafecafe');
+
+    expect(signWordFn).toHaveBeenCalledWith('dead', '0xcafecafe');
+  });
+
+  it('signCommitment preserves an existing 0x prefix instead of double-prefixing', async () => {
+    await signer.signCommitment('0xcafecafe');
+
+    expect(signWordFn).toHaveBeenCalledWith('dead', '0xcafecafe');
+  });
+});
diff --git a/src/lib/miden/sdk/miden-client-interface.test.ts b/src/lib/miden/sdk/miden-client-interface.test.ts
index a4d754503..d914f7d8a 100644
--- a/src/lib/miden/sdk/miden-client-interface.test.ts
+++ b/src/lib/miden/sdk/miden-client-interface.test.ts
@@ -374,6 +374,255 @@ describe('MidenClientInterface', () => {
     expect(fakeMidenClient.transactions.consume).toHaveBeenCalled();
   });
 
+  describe('miscellaneous branches', () => {
+    it('create() returns a mock-network client when MIDEN_USE_MOCK_CLIENT=true', async () => {
+      const fakeMockClient = buildFakeMidenClient();
+      const createMock = jest.fn(async () => fakeMockClient);
+
+      jest.doMock('@miden-sdk/miden-sdk/lazy', () => ({
+        MidenClient: { create: jest.fn(), createMock },
+        NoteFile: { deserialize: jest.fn(() => ({})) },
+        AccountFile: { deserialize: jest.fn(() => ({})) },
+        TransactionRequest: { deserialize: jest.fn(() => ({})) },
+        TransactionProver: {
+          newRemoteProver: jest.fn(() => 'remote'),
+          newLocalProver: jest.fn(() => 'local')
+        },
+        NoteExportFormat: { Id: 'Id', Full: 'Full', Details: 'Details' },
+        exportStore: jest.fn(async () => '{}'),
+        importStore: jest.fn()
+      }));
+      jest.doMock('lib/miden-chain/constants', () => ({
+        MIDEN_NETWORK_ENDPOINTS: new Map([['localnet', 'rpc']]),
+        MIDEN_PROVING_ENDPOINTS: new Map(),
+        getNoteTransportUrl: () => undefined,
+        DEFAULT_NETWORK: 'localnet',
+        MIDEN_NETWORK_NAME: { LOCALNET: 'localnet', DEVNET: 'devnet', TESTNET: 'testnet' }
+      }));
+      jest.doMock('./helpers', () => ({ getBech32AddressFromAccountId: (id: any) => String(id) }));
+      jest.doMock('lib/miden/activity/connectivity-issues', () => ({ addConnectivityIssue: jest.fn() }));
+
+      const prev = process.env.MIDEN_USE_MOCK_CLIENT;
+      process.env.MIDEN_USE_MOCK_CLIENT = 'true';
+      try {
+        const { MidenClientInterface } = await import('./miden-client-interface');
+        const client = await MidenClientInterface.create({ seed: new Uint8Array([1, 2, 3]) });
+        expect(client.network).toBe('mock');
+        expect(createMock).toHaveBeenCalledWith({ seed: expect.any(Uint8Array) });
+      } finally {
+        process.env.MIDEN_USE_MOCK_CLIENT = prev;
+      }
+    });
+
+    it('create() omits keystore when no keystore callbacks are provided', async () => {
+      const fakeMidenClient = buildFakeMidenClient();
+      const createReal = jest.fn(async () => fakeMidenClient);
+
+      jest.doMock('@miden-sdk/miden-sdk/lazy', () => ({
+        MidenClient: { create: createReal, createMock: jest.fn() },
+        NoteFile: { deserialize: jest.fn(() => ({})) },
+        AccountFile: { deserialize: jest.fn(() => ({})) },
+        TransactionRequest: { deserialize: jest.fn(() => ({})) },
+        TransactionProver: {
+          newRemoteProver: jest.fn(() => 'remote'),
+          newLocalProver: jest.fn(() => 'local')
+        },
+        NoteExportFormat: { Id: 'Id', Full: 'Full', Details: 'Details' },
+        exportStore: jest.fn(async () => '{}'),
+        importStore: jest.fn()
+      }));
+      jest.doMock('lib/miden-chain/constants', () => ({
+        MIDEN_NETWORK_ENDPOINTS: new Map([['localnet', 'rpc']]),
+        MIDEN_PROVING_ENDPOINTS: new Map(),
+        getNoteTransportUrl: () => undefined,
+        DEFAULT_NETWORK: 'localnet',
+        MIDEN_NETWORK_NAME: { LOCALNET: 'localnet', DEVNET: 'devnet', TESTNET: 'testnet' }
+      }));
+      jest.doMock('./helpers', () => ({ getBech32AddressFromAccountId: (id: any) => String(id) }));
+      jest.doMock('lib/miden/activity/connectivity-issues', () => ({ addConnectivityIssue: jest.fn() }));
+
+      const { MidenClientInterface } = await import('./miden-client-interface');
+      await MidenClientInterface.create({}); // no callbacks → hasKeystore=false → keystore: undefined
+
+      expect(createReal).toHaveBeenCalledWith(
+        expect.objectContaining({
+          keystore: undefined
+        })
+      );
+    });
+
+    it('createMidenWallet routes a Guardian wallet type to createGuardianAccount', async () => {
+      const fakeMidenClient = buildFakeMidenClient();
+      const createGuardianAccount = jest.fn(async () => ({
+        id: () => ({ toString: () => 'guardian-id' })
+      }));
+
+      jest.doMock('./helpers', () => ({
+        getBech32AddressFromAccountId: (id: any) => (typeof id === 'function' ? id().toString() : String(id))
+      }));
+      jest.doMock('screens/onboarding/types', () => ({
+        WalletType: { OnChain: 'on-chain', OffChain: 'off-chain', Guardian: 'guardian' }
+      }));
+      jest.doMock('../guardian/account', () => ({
+        createGuardianAccount,
+        getSignerDetailsFromAccount: jest.fn()
+      }));
+      jest.doMock('lib/miden/activity/connectivity-issues', () => ({
+        addConnectivityIssue: jest.fn()
+      }));
+
+      const { MidenClientInterface } = await import('./miden-client-interface');
+      const client = MidenClientInterface.fromClient(fakeMidenClient as any, 'testnet');
+
+      const result = await client.createMidenWallet('guardian' as any, new Uint8Array([9]));
+
+      expect(createGuardianAccount).toHaveBeenCalledWith(fakeMidenClient, expect.any(Uint8Array));
+      expect(result).toBe('guardian-id');
+    });
+
+    it('getInputNote delegates to client.notes.get and returns its result', async () => {
+      const fakeMidenClient = buildFakeMidenClient({
+        notes: { get: jest.fn(async () => 'fetched-note') }
+      });
+
+      jest.doMock('lib/miden/activity/connectivity-issues', () => ({ addConnectivityIssue: jest.fn() }));
+
+      const { MidenClientInterface } = await import('./miden-client-interface');
+      const client = MidenClientInterface.fromClient(fakeMidenClient as any, 'testnet');
+
+      await expect(client.getInputNote('note-xyz')).resolves.toBe('fetched-note' as never);
+      expect(fakeMidenClient.notes.get).toHaveBeenCalledWith('note-xyz');
+    });
+  });
+
+  describe('importAccountBySeed', () => {
+    it('falls through to importPublicMidenWalletFromSeed for non-Guardian accounts', async () => {
+      const fakeMidenClient = buildFakeMidenClient({
+        accounts: {
+          import: jest.fn(async () => ({ id: () => 'public-acc-id' }))
+        }
+      });
+
+      jest.doMock('./helpers', () => ({
+        getBech32AddressFromAccountId: (id: any) => String(id)
+      }));
+      jest.doMock('screens/onboarding/types', () => ({
+        WalletType: { OnChain: 'on-chain', OffChain: 'off-chain', Guardian: 'guardian' }
+      }));
+      jest.doMock('lib/miden/activity/connectivity-issues', () => ({
+        addConnectivityIssue: jest.fn()
+      }));
+
+      const { MidenClientInterface } = await import('./miden-client-interface');
+      const client = MidenClientInterface.fromClient(fakeMidenClient as any, 'testnet');
+
+      const result = await client.importAccountBySeed(
+        'on-chain' as any,
+        new Uint8Array([1, 2, 3]),
+        jest.fn(async () => '0xsig'),
+        jest.fn(async () => 'pk')
+      );
+
+      expect(result).toBe('public-acc-id');
+      expect(fakeMidenClient.accounts.import).toHaveBeenCalledWith({ seed: expect.any(Uint8Array) });
+    });
+
+    it('Guardian path: creates the account locally and re-hydrates state from the guardian', async () => {
+      const fakeMidenClient = buildFakeMidenClient();
+      const createGuardianAccount = jest.fn(async () => ({
+        id: () => ({ toString: () => 'guardian-acc-id' })
+      }));
+      const getSignerDetailsFromAccount = jest.fn(async () => ({ commitment: 'abc', publicKey: 'def' }));
+      const importAccountFromGuardian = jest.fn(async () => {});
+
+      jest.doMock('./helpers', () => ({
+        getBech32AddressFromAccountId: (id: any) => (typeof id === 'function' ? id().toString() : String(id))
+      }));
+      jest.doMock('screens/onboarding/types', () => ({
+        WalletType: { OnChain: 'on-chain', OffChain: 'off-chain', Guardian: 'guardian' }
+      }));
+      jest.doMock('../guardian/account', () => ({
+        createGuardianAccount,
+        getSignerDetailsFromAccount
+      }));
+      jest.doMock('../guardian/index', () => ({
+        MultisigService: { importAccountFromGuardian }
+      }));
+      jest.doMock('lib/miden-chain/constants', () => ({
+        DEFAULT_GUARDIAN_ENDPOINT: 'https://default.guardian.test'
+      }));
+      jest.doMock('lib/miden/activity/connectivity-issues', () => ({
+        addConnectivityIssue: jest.fn()
+      }));
+
+      const { MidenClientInterface } = await import('./miden-client-interface');
+      const client = MidenClientInterface.fromClient(fakeMidenClient as any, 'testnet');
+
+      const signWordFn = jest.fn(async () => '0xsig');
+      const getPublicKeyForCommitment = jest.fn(async () => 'pk');
+      const result = await client.importAccountBySeed(
+        'guardian' as any,
+        new Uint8Array([1, 2, 3, 4]),
+        signWordFn,
+        getPublicKeyForCommitment
+      );
+
+      expect(createGuardianAccount).toHaveBeenCalledWith(
+        fakeMidenClient,
+        expect.any(Uint8Array),
+        true,
+        'https://default.guardian.test'
+      );
+      expect(getSignerDetailsFromAccount).toHaveBeenCalled();
+      expect(importAccountFromGuardian).toHaveBeenCalledWith(
+        '0xdef',
+        '0xabc',
+        signWordFn,
+        'guardian-acc-id',
+        fakeMidenClient
+      );
+      expect(result).toBe('guardian-acc-id');
+    });
+
+    it('Guardian path: wraps underlying errors in a "Failed to import Guardian account from seed" message', async () => {
+      const fakeMidenClient = buildFakeMidenClient();
+
+      jest.doMock('./helpers', () => ({
+        getBech32AddressFromAccountId: (id: any) => String(id)
+      }));
+      jest.doMock('screens/onboarding/types', () => ({
+        WalletType: { OnChain: 'on-chain', OffChain: 'off-chain', Guardian: 'guardian' }
+      }));
+      jest.doMock('../guardian/account', () => ({
+        createGuardianAccount: jest.fn(async () => {
+          throw new Error('guardian down');
+        }),
+        getSignerDetailsFromAccount: jest.fn()
+      }));
+      jest.doMock('../guardian/index', () => ({
+        MultisigService: { importAccountFromGuardian: jest.fn() }
+      }));
+      jest.doMock('lib/miden-chain/constants', () => ({
+        DEFAULT_GUARDIAN_ENDPOINT: 'https://default.guardian.test'
+      }));
+      jest.doMock('lib/miden/activity/connectivity-issues', () => ({
+        addConnectivityIssue: jest.fn()
+      }));
+
+      const { MidenClientInterface } = await import('./miden-client-interface');
+      const client = MidenClientInterface.fromClient(fakeMidenClient as any, 'testnet');
+
+      await expect(
+        client.importAccountBySeed(
+          'guardian' as any,
+          new Uint8Array([1]),
+          jest.fn(async () => '0xsig'),
+          jest.fn(async () => 'pk')
+        )
+      ).rejects.toThrow('Failed to import Guardian account from seed');
+    });
+  });
+
   describe('withProverFallback connectivity-issue classification', () => {
     // Build a client that fails the first (delegate) call with a provided error and
     // succeeds the second (local-prover) call. Returns the addConnectivityIssue spy so
@@ -416,6 +665,35 @@ describe('MidenClientInterface', () => {
       expect(addConnectivityIssue).not.toHaveBeenCalled();
     });
 
+    it('rethrows immediately without local-prover retry when delegateTransaction=false', async () => {
+      // shouldDelegate=false → the local-prover-fallback branch is skipped and
+      // the error bubbles straight through the `throw err` line.
+      const addConnectivityIssue = jest.fn();
+      const consume = jest.fn().mockRejectedValueOnce(new Error('prover unreachable'));
+      const fakeMidenClient = buildFakeMidenClient({ transactions: { consume } });
+
+      jest.doMock('@miden-sdk/miden-sdk', () => ({
+        TransactionProver: { newLocalProver: jest.fn(() => 'local') }
+      }));
+      jest.doMock('lib/miden/activity/connectivity-issues', () => ({ addConnectivityIssue }));
+
+      const { MidenClientInterface } = await import('./miden-client-interface');
+      const client = MidenClientInterface.fromClient(fakeMidenClient as any, 'testnet');
+
+      await expect(
+        client.consumeNoteId({
+          accountId: 'acc-id',
+          noteId: 'note-1',
+          type: 'consume',
+          delegateTransaction: false
+        } as any)
+      ).rejects.toThrow('prover unreachable');
+
+      // Called once (no local-prover retry) and banner untouched.
+      expect(consume).toHaveBeenCalledTimes(1);
+      expect(addConnectivityIssue).not.toHaveBeenCalled();
+    });
+
     it('does NOT mark connectivity issue for "invalid transaction request"', async () => {
       const { addConnectivityIssue } = await runDelegateFailureCase(
         new Error('invalid transaction request: something else went wrong')
diff --git a/src/lib/store/index.test.ts b/src/lib/store/index.test.ts
index d3d835444..490769721 100644
--- a/src/lib/store/index.test.ts
+++ b/src/lib/store/index.test.ts
@@ -396,6 +396,53 @@ describe('useWalletStore', () => {
 
       expect(result).toBe('secret-key-123');
     });
+
+    it('signWord posts a SignWordRequest and returns the signature string', async () => {
+      mockRequest.mockResolvedValueOnce({
+        type: WalletMessageType.SignWordResponse,
+        signature: '0xword-sig'
+      });
+
+      const { signWord } = useWalletStore.getState();
+      const result = await signWord('pub-key', '0xword-hex');
+
+      expect(mockRequest).toHaveBeenCalledWith({
+        type: WalletMessageType.SignWordRequest,
+        publicKey: 'pub-key',
+        wordHex: '0xword-hex'
+      });
+      expect(result).toBe('0xword-sig');
+    });
+
+    it('signWord throws on a type-mismatched response', async () => {
+      mockRequest.mockResolvedValueOnce({ type: 'WrongType' });
+
+      const { signWord } = useWalletStore.getState();
+      await expect(signWord('pk', 'word')).rejects.toThrow('Invalid response');
+    });
+
+    it('getPublicKeyForCommitment posts a GetPublicKeyForCommitmentRequest and returns the pubkey', async () => {
+      mockRequest.mockResolvedValueOnce({
+        type: WalletMessageType.GetPublicKeyForCommitmentResponse,
+        publicKey: 'derived-pub-key'
+      });
+
+      const { getPublicKeyForCommitment } = useWalletStore.getState();
+      const result = await getPublicKeyForCommitment('commit-hash');
+
+      expect(mockRequest).toHaveBeenCalledWith({
+        type: WalletMessageType.GetPublicKeyForCommitmentRequest,
+        commitment: 'commit-hash'
+      });
+      expect(result).toBe('derived-pub-key');
+    });
+
+    it('getPublicKeyForCommitment throws on a type-mismatched response', async () => {
+      mockRequest.mockResolvedValueOnce({ type: 'WrongType' });
+
+      const { getPublicKeyForCommitment } = useWalletStore.getState();
+      await expect(getPublicKeyForCommitment('x')).rejects.toThrow('Invalid response');
+    });
   });
 
   describe('Asset actions', () => {

From f08b13e6886c29d2129015a4d1e5bc7647ff53cc Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Thu, 23 Apr 2026 22:54:23 +0530
Subject: [PATCH 29/71] fix: pre-build content scripts in dev + onboarding
 recovery-method step in playwright

---
 package.json                                  |  2 +-
 playwright/e2e/helpers/wallet-page.ts         | 33 +++++++++++++++++++
 playwright/e2e/ios/helpers/ios-wallet-page.ts |  6 ++++
 playwright/tests/popup-smoke.spec.ts          | 10 ++++++
 .../activity/transactions.guardian.test.ts    |  2 +-
 src/lib/miden/front/guardian-manager.test.ts  |  2 +-
 src/lib/miden/front/useSyncTrigger.test.tsx   | 12 +++----
 7 files changed, 58 insertions(+), 9 deletions(-)

diff --git a/package.json b/package.json
index 709336726..00f069984 100644
--- a/package.json
+++ b/package.json
@@ -8,7 +8,7 @@
   "scripts": {
     "postinstall": "rimraf node_modules/@miden-sdk/react/node_modules && patch-package",
     "start": "yarn watch:src",
-    "dev": "rimraf ./dist && cross-env TARGET_BROWSER=chrome MODE_ENV=development NODE_ENV=development yarn build:bg && concurrently -n bg,ext -c blue,green \"cross-env TARGET_BROWSER=chrome MODE_ENV=development NODE_ENV=development vite build --config vite.background.config.ts --watch\" \"cross-env TARGET_BROWSER=chrome MANIFEST_VERSION=3 MODE_ENV=development NODE_ENV=development vite build --config vite.extension.config.ts --watch\"",
+    "dev": "rimraf ./dist && cross-env TARGET_BROWSER=chrome MODE_ENV=development NODE_ENV=development yarn build:bg && cross-env TARGET_BROWSER=chrome MODE_ENV=development NODE_ENV=development yarn build:cs && concurrently -n bg,ext -c blue,green \"cross-env TARGET_BROWSER=chrome MODE_ENV=development NODE_ENV=development vite build --config vite.background.config.ts --watch\" \"cross-env TARGET_BROWSER=chrome MANIFEST_VERSION=3 MODE_ENV=development NODE_ENV=development vite build --config vite.extension.config.ts --watch\"",
     "dev-clean": "rimraf node_modules && yarn cache clean && yarn install && yarn dev",
     "watch:src": "vite run --config vite.extension.config.ts",
     "watch:dist": "mv3-hot-reload",
diff --git a/playwright/e2e/helpers/wallet-page.ts b/playwright/e2e/helpers/wallet-page.ts
index bdb68a306..8f113e868 100644
--- a/playwright/e2e/helpers/wallet-page.ts
+++ b/playwright/e2e/helpers/wallet-page.ts
@@ -218,6 +218,11 @@ export class ChromeWalletPage implements ChromeWalletPageApi {
     await this.page.locator('input[placeholder="Enter password again"]').first().fill(password);
     await this.page.getByRole('button', { name: /continue/i }).click();
 
+    // Recovery method step. The create flow now forks into "Guardian" (the
+    // default) and "Fully Private" (off-chain). Guardian needs a live backend
+    // we don't stand up in E2E, so pick Fully Private.
+    await this.selectCreateRecoveryMethod();
+
     // Wait for "Your wallet is ready" confirmation screen.
     // Note: this text appears IMMEDIATELY when the confirmation page renders,
     // BEFORE the wallet is actually created. The actual creation happens when
@@ -364,6 +369,10 @@ export class ChromeWalletPage implements ChromeWalletPageApi {
     await this.page.locator('input[placeholder="Enter password again"]').first().fill(password);
     await this.page.getByRole('button', { name: /continue/i }).click();
 
+    // Recovery method step for seed-phrase imports. Picks "Import public
+    // account" so we don't need a guardian backend.
+    await this.selectImportRecoveryMethod();
+
     // Confirmation
     await expect(this.page.getByText(/your wallet is ready/i)).toBeVisible();
     await this.page.getByRole('button', { name: /get started/i }).click();
@@ -373,6 +382,30 @@ export class ChromeWalletPage implements ChromeWalletPageApi {
     return { address };
   }
 
+  /**
+   * Pick "Fully Private" on the create-wallet recovery-method screen and
+   * click Continue. Guardian-backed accounts need a live guardian endpoint
+   * which isn't part of the E2E harness.
+   */
+  private async selectCreateRecoveryMethod(): Promise<void> {
+    const heading = this.page.getByRole('heading', { name: /set up account recovery/i });
+    await heading.waitFor({ timeout: 15_000 });
+    // Click the "Fully Private" card to switch selection away from the Guardian default.
+    await this.page.getByText(/fully private/i).first().click();
+    await this.page.getByRole('button', { name: /continue/i }).click();
+  }
+
+  /**
+   * Pick "Import public account" on the import-recovery-method screen and
+   * click Continue.
+   */
+  private async selectImportRecoveryMethod(): Promise<void> {
+    const screen = this.page.getByTestId('import-recovery-method');
+    await screen.waitFor({ timeout: 15_000 });
+    await screen.getByText(/import public account/i).click();
+    await this.page.getByRole('button', { name: /continue/i }).click();
+  }
+
   // ── Address ───────────────────────────────────────────────────────────────
 
   /**
diff --git a/playwright/e2e/ios/helpers/ios-wallet-page.ts b/playwright/e2e/ios/helpers/ios-wallet-page.ts
index ce81fc75b..1847a0cea 100644
--- a/playwright/e2e/ios/helpers/ios-wallet-page.ts
+++ b/playwright/e2e/ios/helpers/ios-wallet-page.ts
@@ -180,6 +180,12 @@ export class IosWalletPage implements WalletPage {
     await this.fillInputByPlaceholder('Enter password again', password);
     await this.clickByText('button', /continue/i);
 
+    // Import-recovery-method step: pick "Import public account" so we don't
+    // need a guardian backend.
+    await this.pollForSelector('[data-testid="import-recovery-method"]', 15_000);
+    await this.clickByText('*', /import public account/i);
+    await this.clickByText('button', /continue/i);
+
     await this.pollForCondition(
       `var bd = document.body; return bd && /your wallet is ready/i.test(bd.textContent || '');`,
       120_000
diff --git a/playwright/tests/popup-smoke.spec.ts b/playwright/tests/popup-smoke.spec.ts
index 760af9ebb..c347516cd 100644
--- a/playwright/tests/popup-smoke.spec.ts
+++ b/playwright/tests/popup-smoke.spec.ts
@@ -73,6 +73,11 @@ test.describe('Fullpage UI', () => {
     await page.locator('input[placeholder="Enter password again"]').first().fill('Password123!');
     await page.getByRole('button', { name: /continue/i }).click();
 
+    // Recovery method step — pick "Fully Private" to avoid the guardian backend.
+    await page.getByRole('heading', { name: /set up account recovery/i }).waitFor({ timeout: 15000 });
+    await page.getByText(/fully private/i).first().click();
+    await page.getByRole('button', { name: /continue/i }).click();
+
     // Complete onboarding and verify we reach the Explore page
     await expect(page.getByText(/your wallet is ready/i)).toBeVisible();
     await page.getByRole('button', { name: /get started/i }).click();
@@ -112,6 +117,11 @@ test.describe('Fullpage UI', () => {
     await page.locator('input[placeholder="Enter password again"]').first().fill('Password123!');
     await page.getByRole('button', { name: /continue/i }).click();
 
+    // Import-recovery-method step — pick "Import public account".
+    await page.getByTestId('import-recovery-method').waitFor({ timeout: 15000 });
+    await page.getByText(/import public account/i).click();
+    await page.getByRole('button', { name: /continue/i }).click();
+
     await expect(page.getByText(/your wallet is ready/i)).toBeVisible();
 
     // Complete onboarding and verify we reach the Explore page
diff --git a/src/lib/miden/activity/transactions.guardian.test.ts b/src/lib/miden/activity/transactions.guardian.test.ts
index 3360fcee3..baea7a8bf 100644
--- a/src/lib/miden/activity/transactions.guardian.test.ts
+++ b/src/lib/miden/activity/transactions.guardian.test.ts
@@ -19,7 +19,7 @@ import {
 import { ITransactionStatus, SwitchGuardianTransaction } from '../db/types';
 
 const txStore: Array<Record<string, unknown>> = [];
-const putToStorage = jest.fn(async () => {});
+const putToStorage = jest.fn(async (..._args: unknown[]) => {});
 
 jest.mock('lib/miden/repo', () => ({
   db: { transaction: async (_mode: string, _t: unknown, cb: () => unknown) => cb() },
diff --git a/src/lib/miden/front/guardian-manager.test.ts b/src/lib/miden/front/guardian-manager.test.ts
index 0b90bfdda..f8a9448d5 100644
--- a/src/lib/miden/front/guardian-manager.test.ts
+++ b/src/lib/miden/front/guardian-manager.test.ts
@@ -25,7 +25,7 @@ jest.mock('../guardian/account', () => ({
 }));
 
 const mockGetAccount = jest.fn();
-const mockGetMidenClient = jest.fn(async () => ({ getAccount: mockGetAccount }));
+const mockGetMidenClient = jest.fn(async (..._args: unknown[]) => ({ getAccount: mockGetAccount }));
 jest.mock('../sdk/miden-client', () => ({
   getMidenClient: (...args: unknown[]) => mockGetMidenClient(...args),
   withWasmClientLock: async <T>(fn: () => Promise<T>) => fn()
diff --git a/src/lib/miden/front/useSyncTrigger.test.tsx b/src/lib/miden/front/useSyncTrigger.test.tsx
index 68fafb273..6fe6d4f6e 100644
--- a/src/lib/miden/front/useSyncTrigger.test.tsx
+++ b/src/lib/miden/front/useSyncTrigger.test.tsx
@@ -32,7 +32,7 @@ const storeState: {
 };
 
 const mockIntercomRequest = jest.fn(async () => ({ type: 'ok' }));
-const mockGetIntercom = jest.fn(() => ({ request: mockIntercomRequest }));
+const mockGetIntercom = jest.fn((..._args: unknown[]) => ({ request: mockIntercomRequest }));
 
 jest.mock('lib/store', () => {
   // Zustand selector mock — reads the live storeState reference so test
@@ -45,22 +45,22 @@ jest.mock('lib/store', () => {
   };
 });
 
-const mockSyncState = jest.fn(async () => {});
-const mockGetMidenClient = jest.fn(async () => ({ syncState: mockSyncState }));
+const mockSyncState = jest.fn(async (..._args: unknown[]) => {});
+const mockGetMidenClient = jest.fn(async (..._args: unknown[]) => ({ syncState: mockSyncState }));
 jest.mock('lib/miden/sdk/miden-client', () => ({
   getMidenClient: (...args: unknown[]) => mockGetMidenClient(...args),
   // In .tsx `<T>` parses as JSX — the trailing comma disambiguates it as a generic.
   withWasmClientLock: async <T,>(fn: () => Promise<T>) => fn()
 }));
 
-const mockIsExtension = jest.fn(() => false);
-const mockIsMobile = jest.fn(() => false);
+const mockIsExtension = jest.fn((..._args: unknown[]) => false);
+const mockIsMobile = jest.fn((..._args: unknown[]) => false);
 jest.mock('lib/platform', () => ({
   isExtension: (...args: unknown[]) => mockIsExtension(...args),
   isMobile: (...args: unknown[]) => mockIsMobile(...args)
 }));
 
-const mockSyncGuardianAccounts = jest.fn(async () => {});
+const mockSyncGuardianAccounts = jest.fn(async (..._args: unknown[]) => {});
 jest.mock('./guardian-sync', () => ({
   syncGuardianAccounts: (...args: unknown[]) => mockSyncGuardianAccounts(...args)
 }));

From 5dc8d3ab7fadc9381d8650684c770714fd82733e Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Thu, 23 Apr 2026 23:09:16 +0530
Subject: [PATCH 30/71] fix(sw): use @miden-sdk/miden-sdk/lazy to avoid TLA
 crash in background bundle

---
 src/lib/miden/guardian/account.ts |  2 +-
 src/lib/miden/guardian/digest.ts  |  2 +-
 src/lib/miden/guardian/index.ts   |  2 +-
 vite.background.config.ts         | 24 ++++++++++++++++--------
 4 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/src/lib/miden/guardian/account.ts b/src/lib/miden/guardian/account.ts
index 1d958eebf..389bbdbc1 100644
--- a/src/lib/miden/guardian/account.ts
+++ b/src/lib/miden/guardian/account.ts
@@ -1,4 +1,4 @@
-import { Account, AuthSecretKey, MidenClient } from '@miden-sdk/miden-sdk';
+import { Account, AuthSecretKey, MidenClient } from '@miden-sdk/miden-sdk/lazy';
 import { FalconSigner, MultisigClient } from '@openzeppelin/miden-multisig-client';
 
 import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
diff --git a/src/lib/miden/guardian/digest.ts b/src/lib/miden/guardian/digest.ts
index c6f79540b..7042c3a60 100644
--- a/src/lib/miden/guardian/digest.ts
+++ b/src/lib/miden/guardian/digest.ts
@@ -1,4 +1,4 @@
-import { AccountId, Felt, FeltArray, Rpo256, Word } from '@miden-sdk/miden-sdk';
+import { AccountId, Felt, FeltArray, Rpo256, Word } from '@miden-sdk/miden-sdk/lazy';
 import type { RequestAuthPayload } from '@openzeppelin/guardian-client';
 
 export class AuthDigest {
diff --git a/src/lib/miden/guardian/index.ts b/src/lib/miden/guardian/index.ts
index fa4866d4b..bc56b63ec 100644
--- a/src/lib/miden/guardian/index.ts
+++ b/src/lib/miden/guardian/index.ts
@@ -1,4 +1,4 @@
-import { Account, MidenClient, TransactionRequest } from '@miden-sdk/miden-sdk';
+import { Account, MidenClient, TransactionRequest } from '@miden-sdk/miden-sdk/lazy';
 import {
   Multisig,
   MultisigClient,
diff --git a/vite.background.config.ts b/vite.background.config.ts
index 47273aac3..dc9cd23c7 100644
--- a/vite.background.config.ts
+++ b/vite.background.config.ts
@@ -239,14 +239,22 @@ export default defineConfig({
   },
 
   resolve: {
-    alias: {
-      lib: resolve(__dirname, 'src/lib'),
-      app: resolve(__dirname, 'src/app'),
-      shared: resolve(__dirname, 'src/shared'),
-      components: resolve(__dirname, 'src/components'),
-      screens: resolve(__dirname, 'src/screens'),
-      utils: resolve(__dirname, 'src/utils')
-    }
+    alias: [
+      // Transitive imports through @openzeppelin/miden-multisig-client hit the
+      // EAGER @miden-sdk/miden-sdk entry, which has top-level `await loadWasm()`.
+      // The sw-patches TLA stripper below only catches `await` at column 0; the
+      // SDK's bundled factories emit indented `await init_*()` inside __esmMin
+      // wrappers, so the stripped output is a parse error. Force every resolver
+      // hit on the eager entry to the /lazy subpath (no TLA). Regex form so we
+      // don't accidentally double-rewrite `@miden-sdk/miden-sdk/lazy`.
+      { find: /^@miden-sdk\/miden-sdk$/, replacement: '@miden-sdk/miden-sdk/lazy' },
+      { find: 'lib', replacement: resolve(__dirname, 'src/lib') },
+      { find: 'app', replacement: resolve(__dirname, 'src/app') },
+      { find: 'shared', replacement: resolve(__dirname, 'src/shared') },
+      { find: 'components', replacement: resolve(__dirname, 'src/components') },
+      { find: 'screens', replacement: resolve(__dirname, 'src/screens') },
+      { find: 'utils', replacement: resolve(__dirname, 'src/utils') }
+    ]
   },
 
   define: {

From 143ff8b7ab8637a74cf4b0ffd992c0bf59abe044 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Wed, 6 May 2026 13:17:08 +0530
Subject: [PATCH 31/71] test: extend coverage for constants, vault,
 transactions

---
 src/lib/miden-chain/constants.test.ts         | 121 +++
 .../miden/activity/transactions.gaps.test.ts  | 746 ++++++++++++++++++
 src/lib/miden/back/vault.gaps.test.ts         | 420 ++++++++++
 3 files changed, 1287 insertions(+)
 create mode 100644 src/lib/miden/activity/transactions.gaps.test.ts
 create mode 100644 src/lib/miden/back/vault.gaps.test.ts

diff --git a/src/lib/miden-chain/constants.test.ts b/src/lib/miden-chain/constants.test.ts
index a49c8eff7..6ee2c1234 100644
--- a/src/lib/miden-chain/constants.test.ts
+++ b/src/lib/miden-chain/constants.test.ts
@@ -19,12 +19,19 @@ jest.mock('@miden-sdk/miden-sdk/lazy', () => ({
   }
 }));
 
+const ORIGINAL_ENV = process.env;
+
 describe('miden-chain/constants', () => {
   beforeEach(() => {
     jest.resetModules();
     mockEndpoint.mockReset();
     mockMidenClientReady.mockReset();
     mockMidenClientReady.mockReturnValue(Promise.resolve());
+    process.env = { ...ORIGINAL_ENV };
+  });
+
+  afterAll(() => {
+    process.env = ORIGINAL_ENV;
   });
 
   it('getNetworkId returns a NetworkId', () => {
@@ -62,4 +69,118 @@ describe('miden-chain/constants', () => {
       });
     });
   });
+
+  describe('getExplorerTxUrl', () => {
+    it('returns the explorer URL when the network has an entry', () => {
+      jest.isolateModules(() => {
+        const { getExplorerTxUrl, MIDEN_NETWORK_NAME } = require('./constants');
+        expect(getExplorerTxUrl('0xabc', MIDEN_NETWORK_NAME.TESTNET)).toBe('https://testnet.midenscan.com/tx/0xabc');
+      });
+    });
+
+    it('returns undefined when the network has no explorer mapping', () => {
+      jest.isolateModules(() => {
+        const { getExplorerTxUrl, MIDEN_NETWORK_NAME } = require('./constants');
+        expect(getExplorerTxUrl('0xabc', MIDEN_NETWORK_NAME.LOCALNET)).toBeUndefined();
+      });
+    });
+
+    it('falls back to DEFAULT_NETWORK when no network is provided', () => {
+      delete process.env.MIDEN_NETWORK;
+      jest.isolateModules(() => {
+        const { getExplorerTxUrl } = require('./constants');
+        expect(getExplorerTxUrl('0xabc')).toBe('https://testnet.midenscan.com/tx/0xabc');
+      });
+    });
+  });
+
+  describe('getNoteTransportUrl', () => {
+    it('returns the per-network endpoint when no override is set', () => {
+      delete process.env.MIDEN_NOTE_TRANSPORT_URL;
+      jest.isolateModules(() => {
+        const { getNoteTransportUrl, MIDEN_NETWORK_NAME } = require('./constants');
+        expect(getNoteTransportUrl(MIDEN_NETWORK_NAME.TESTNET)).toBe('https://transport.miden.io');
+      });
+    });
+
+    it('returns undefined for an unknown network when no override is set', () => {
+      delete process.env.MIDEN_NOTE_TRANSPORT_URL;
+      jest.isolateModules(() => {
+        const { getNoteTransportUrl } = require('./constants');
+        expect(getNoteTransportUrl('not-a-network')).toBeUndefined();
+      });
+    });
+
+    it('returns the build-time override when MIDEN_NOTE_TRANSPORT_URL is set', () => {
+      process.env.MIDEN_NOTE_TRANSPORT_URL = 'http://localhost:57292';
+      jest.isolateModules(() => {
+        const { getNoteTransportUrl, MIDEN_NETWORK_NAME } = require('./constants');
+        // Override wins regardless of network mapping.
+        expect(getNoteTransportUrl(MIDEN_NETWORK_NAME.TESTNET)).toBe('http://localhost:57292');
+        expect(getNoteTransportUrl('not-a-network')).toBe('http://localhost:57292');
+      });
+    });
+  });
+
+  describe('DEFAULT_NETWORK', () => {
+    it('falls back to TESTNET when MIDEN_NETWORK env is unset', () => {
+      delete process.env.MIDEN_NETWORK;
+      jest.isolateModules(() => {
+        const { DEFAULT_NETWORK, MIDEN_NETWORK_NAME } = require('./constants');
+        expect(DEFAULT_NETWORK).toBe(MIDEN_NETWORK_NAME.TESTNET);
+      });
+    });
+
+    it('honors MIDEN_NETWORK env when set', () => {
+      process.env.MIDEN_NETWORK = 'devnet';
+      jest.isolateModules(() => {
+        const { DEFAULT_NETWORK, MIDEN_NETWORK_NAME } = require('./constants');
+        expect(DEFAULT_NETWORK).toBe(MIDEN_NETWORK_NAME.DEVNET);
+      });
+    });
+  });
+
+  describe('DEFAULT_GUARDIAN_ENDPOINT', () => {
+    it('uses the network-specific endpoint when present', () => {
+      process.env.MIDEN_NETWORK = 'testnet';
+      jest.isolateModules(() => {
+        const { DEFAULT_GUARDIAN_ENDPOINT } = require('./constants');
+        expect(DEFAULT_GUARDIAN_ENDPOINT).toBe('https://guardian.openzeppelin.com');
+      });
+    });
+
+    it('falls back to the staging endpoint when the network has no mapping', () => {
+      process.env.MIDEN_NETWORK = 'localnet';
+      jest.isolateModules(() => {
+        const { DEFAULT_GUARDIAN_ENDPOINT } = require('./constants');
+        expect(DEFAULT_GUARDIAN_ENDPOINT).toBe('https://stg-guardian.openzeppelin.com');
+      });
+    });
+  });
+
+  describe('getNetworkId', () => {
+    it('returns testnet for TESTNET network', () => {
+      process.env.MIDEN_NETWORK = 'testnet';
+      jest.isolateModules(() => {
+        const { getNetworkId } = require('./constants');
+        expect(getNetworkId()).toEqual({ kind: 'testnet' });
+      });
+    });
+
+    it('returns testnet for LOCALNET network', () => {
+      process.env.MIDEN_NETWORK = 'localnet';
+      jest.isolateModules(() => {
+        const { getNetworkId } = require('./constants');
+        expect(getNetworkId()).toEqual({ kind: 'testnet' });
+      });
+    });
+
+    it('falls through to testnet for unknown networks', () => {
+      process.env.MIDEN_NETWORK = 'something-unknown';
+      jest.isolateModules(() => {
+        const { getNetworkId } = require('./constants');
+        expect(getNetworkId()).toEqual({ kind: 'testnet' });
+      });
+    });
+  });
 });
diff --git a/src/lib/miden/activity/transactions.gaps.test.ts b/src/lib/miden/activity/transactions.gaps.test.ts
new file mode 100644
index 000000000..bf968fb92
--- /dev/null
+++ b/src/lib/miden/activity/transactions.gaps.test.ts
@@ -0,0 +1,746 @@
+/**
+ * Gap-coverage tests for `lib/miden/activity/transactions.ts`.
+ *
+ * Targets branches not exercised by the other transactions test files:
+ *   - `getUncompletedTransactions` (queued+generating filter, tokenId filter)
+ *   - `waitForConsumeTx` abort signal firing AFTER subscribe
+ *   - `completeCustomTransaction` outer init-error path (withWasmClientLock rejects)
+ *   - `extractFullNote` outer try/catch (outputNotes throws)
+ *   - `generateTransactionsLoop` early-return when an in-progress tx exists
+ */
+
+import { ITransactionStatus } from '../db/types';
+import { NoteTypeEnum } from '../types';
+import {
+  completeCustomTransaction,
+  generateTransaction,
+  generateTransactionsLoop,
+  getUncompletedTransactions,
+  safeGenerateTransactionsLoop,
+  startBackgroundTransactionProcessing,
+  verifyStuckTransactionsFromNode,
+  waitForConsumeTx,
+  waitForTransactionCompletion
+} from './transactions';
+
+const _g = globalThis as any;
+_g.__txGapTest = {
+  rows: [] as any[],
+  liveQueryCallbacks: [] as Array<() => void>
+};
+const txStore: any[] = _g.__txGapTest.rows;
+
+jest.mock('lib/miden/repo', () => ({
+  db: {
+    transaction: (_mode: string, _table: unknown, cb: () => Promise<unknown>) => cb()
+  },
+  transactions: {
+    add: jest.fn(async (tx: any) => {
+      txStore.push({ ...tx });
+    }),
+    filter: jest.fn((fn: (tx: any) => boolean) => ({
+      toArray: jest.fn(async () => txStore.filter(fn))
+    })),
+    where: jest.fn((arg: any) => {
+      if (typeof arg === 'string') {
+        const field = arg;
+        return {
+          equals: (val: any) => ({
+            filter: (fn: (tx: any) => boolean) => ({
+              toArray: async () => txStore.filter(t => t[field] === val).filter(fn)
+            })
+          })
+        };
+      }
+      return {
+        first: jest.fn(async () => txStore.find(t => t.id === arg.id)),
+        modify: jest.fn(async (fn: (tx: any) => void) => {
+          const tx = txStore.find(t => t.id === arg.id);
+          if (tx) fn(tx);
+        })
+      };
+    })
+  }
+}));
+
+jest.mock('dexie', () => ({
+  liveQuery: jest.fn((cb: () => any) => ({
+    subscribe: (subscriber: any) => {
+      const dispatch = async () => {
+        try {
+          const value = await cb();
+          if (typeof subscriber === 'function') subscriber(value);
+          else if (subscriber?.next) subscriber.next(value);
+        } catch (err) {
+          if (subscriber?.error) subscriber.error(err);
+        }
+      };
+      // Defer the initial dispatch so tests have a window to abort first.
+      setTimeout(dispatch, 5);
+      return {
+        unsubscribe: jest.fn()
+      };
+    }
+  }))
+}));
+
+const mockSyncState = jest.fn(async () => {});
+const mockWaitForCommit = jest.fn(async () => {});
+const mockSendPrivateNote = jest.fn(async () => {});
+jest.mock('../sdk/miden-client', () => ({
+  getMidenClient: async () => ({
+    syncState: mockSyncState,
+    waitForTransactionCommit: mockWaitForCommit,
+    sendPrivateNote: mockSendPrivateNote
+  }),
+  withWasmClientLock: async <T>(fn: () => Promise<T>) => fn()
+}));
+
+jest.mock('./notes', () => ({
+  importAllNotes: jest.fn(),
+  queueNoteImport: jest.fn()
+}));
+
+jest.mock('./helpers', () => ({
+  interpretTransactionResult: jest.fn((tx: any) => ({ ...tx, displayMessage: 'Executed' }))
+}));
+
+jest.mock('lib/platform', () => ({
+  isMobile: () => false,
+  isExtension: () => true
+}));
+
+jest.mock('shared/logger', () => ({
+  logger: { warning: jest.fn(), error: jest.fn() }
+}));
+
+const _gh = globalThis as any;
+_gh.__noteTypeForTest = 'private';
+jest.mock('../helpers', () => ({
+  toNoteTypeString: () => (globalThis as any).__noteTypeForTest
+}));
+
+jest.mock('../sdk/helpers', () => ({
+  getBech32AddressFromAccountId: (x: any) => (typeof x === 'string' ? x : 'bech32-stub')
+}));
+
+const mockTransactionResultDeserialize = jest.fn();
+jest.mock('@miden-sdk/miden-sdk/lazy', () => {
+  const base = jest.requireActual('../../../../__mocks__/wasmMock.js');
+  return {
+    ...base,
+    TransactionResult: { deserialize: (...args: unknown[]) => mockTransactionResultDeserialize(...args) },
+    TransactionProver: { newLocalProver: jest.fn(() => ({ __proverMarker: true })) }
+  };
+});
+
+jest.mock('lib/store', () => ({
+  getIntercom: () => ({ request: jest.fn(() => Promise.resolve({})) })
+}));
+
+jest.mock('lib/miden/front/guardian-manager', () => ({
+  isGuardianAccount: jest.fn(async () => false),
+  getOrCreateMultisigService: jest.fn(),
+  clearGuardianServiceFor: jest.fn()
+}));
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  txStore.length = 0;
+  _gh.__noteTypeForTest = 'private';
+});
+
+describe('getUncompletedTransactions', () => {
+  it('returns Queued + GeneratingTransaction rows for the given account, sorted by initiatedAt', async () => {
+    txStore.push(
+      { id: 'q-late', status: ITransactionStatus.Queued, accountId: 'acc-1', initiatedAt: 200 },
+      { id: 'q-early', status: ITransactionStatus.Queued, accountId: 'acc-1', initiatedAt: 100 },
+      { id: 'gen', status: ITransactionStatus.GeneratingTransaction, accountId: 'acc-1', initiatedAt: 150 },
+      { id: 'completed', status: ITransactionStatus.Completed, accountId: 'acc-1', initiatedAt: 50 },
+      { id: 'other-acc', status: ITransactionStatus.Queued, accountId: 'acc-2', initiatedAt: 75 }
+    );
+
+    const result = await getUncompletedTransactions('acc-1');
+
+    expect(result.map(t => t.id)).toEqual(['q-early', 'gen', 'q-late']);
+  });
+
+  it('filters by tokenId (faucetId) when provided', async () => {
+    txStore.push(
+      { id: 'a', status: ITransactionStatus.Queued, accountId: 'acc-1', initiatedAt: 100, faucetId: 'f1' },
+      { id: 'b', status: ITransactionStatus.Queued, accountId: 'acc-1', initiatedAt: 200, faucetId: 'f2' }
+    );
+    const result = await getUncompletedTransactions('acc-1', 'f1');
+    expect(result.map(t => t.id)).toEqual(['a']);
+  });
+});
+
+describe('waitForConsumeTx', () => {
+  it('rejects with AbortError when the signal fires after subscription', async () => {
+    txStore.push({ id: 'tx-pending', status: ITransactionStatus.Queued });
+    const ctrl = new AbortController();
+    const p = waitForConsumeTx('tx-pending', ctrl.signal);
+    // Abort before liveQuery's first dispatch (deferred 5ms in our mock).
+    ctrl.abort();
+    await expect(p).rejects.toThrow(/Aborted/);
+  });
+});
+
+describe('completeCustomTransaction outer init-error path', () => {
+  it('logs and continues when withWasmClientLock itself rejects (catch on line 114)', async () => {
+    _gh.__noteTypeForTest = 'private';
+    txStore.push({
+      id: 'tx-cct',
+      type: 'execute',
+      accountId: 'acc-1',
+      secondaryAccountId: 'recipient',
+      status: ITransactionStatus.GeneratingTransaction,
+      initiatedAt: 100
+    });
+
+    // Force the OUTER lock acquisition itself to reject (vs. its inner cb).
+    const sdk = require('../sdk/miden-client');
+    const origLock = sdk.withWasmClientLock;
+    sdk.withWasmClientLock = async () => {
+      throw new Error('outer-lock-fail');
+    };
+
+    const errSpy = jest.spyOn(console, 'error').mockImplementation();
+    try {
+      const fakeNote = {
+        metadata: () => ({ noteType: () => 'private' }),
+        intoFull: () => ({ valid: true })
+      };
+      const txResult = {
+        executedTransaction: () => ({
+          id: () => ({ toHex: () => 'h' }),
+          outputNotes: () => ({ notes: () => [fakeNote] })
+        })
+      } as any;
+
+      await completeCustomTransaction(txStore[0]!, txResult);
+
+      // Even when the outer lock fails, the function still marks the tx complete
+      // (the per-note error is logged and the loop continues).
+      expect(txStore[0]!.status).toBe(ITransactionStatus.Completed);
+      expect(errSpy).toHaveBeenCalled();
+    } finally {
+      sdk.withWasmClientLock = origLock;
+      errSpy.mockRestore();
+    }
+  });
+});
+
+describe('extractFullNote intoFull-undefined branch', () => {
+  it('logs and returns undefined when intoFull() returns undefined for the first output note', async () => {
+    txStore.push({
+      id: 'tx-intoundef',
+      type: 'send',
+      accountId: 'acc-1',
+      noteType: NoteTypeEnum.Public,
+      status: ITransactionStatus.GeneratingTransaction,
+      initiatedAt: 100
+    });
+    const txResult = {
+      executedTransaction: () => ({
+        id: () => ({ toHex: () => 'h' }),
+        outputNotes: () => ({ notes: () => [{ intoFull: () => undefined }] })
+      }),
+      serialize: () => new Uint8Array([])
+    } as any;
+    const errSpy = jest.spyOn(console, 'error').mockImplementation();
+    try {
+      const { completeSendTransaction } = require('./transactions');
+      await completeSendTransaction(txStore[0], txResult);
+      expect(errSpy).toHaveBeenCalledWith('intoFull() returned undefined for first output note');
+      expect(txStore[0]!.status).toBe(ITransactionStatus.Completed);
+    } finally {
+      errSpy.mockRestore();
+    }
+  });
+});
+
+describe('extractFullNote outer try/catch', () => {
+  it('completes a public send when outputNotes() throws (extractFullNote returns undefined)', async () => {
+    _gh.__noteTypeForTest = 'public';
+    txStore.push({
+      id: 'tx-send',
+      type: 'send',
+      accountId: 'acc-1',
+      noteType: NoteTypeEnum.Public,
+      status: ITransactionStatus.GeneratingTransaction,
+      initiatedAt: 100
+    });
+    const txResult = {
+      executedTransaction: () => ({
+        id: () => ({ toHex: () => 'h' }),
+        outputNotes: () => {
+          throw new Error('outputNotes-explode');
+        }
+      }),
+      serialize: () => new Uint8Array([])
+    } as any;
+
+    const errSpy = jest.spyOn(console, 'error').mockImplementation();
+    try {
+      const { completeSendTransaction } = require('./transactions');
+      await completeSendTransaction(txStore[0], txResult);
+      expect(txStore[0]!.status).toBe(ITransactionStatus.Completed);
+      expect(errSpy).toHaveBeenCalledWith(
+        'Failed to extract full note from transaction result',
+        expect.objectContaining({ error: expect.any(Error) })
+      );
+    } finally {
+      errSpy.mockRestore();
+    }
+  });
+});
+
+describe('generateTransactionsLoop early returns', () => {
+  it('returns undefined when an in-progress transaction already exists', async () => {
+    txStore.push({
+      id: 'in-progress',
+      status: ITransactionStatus.GeneratingTransaction,
+      initiatedAt: 100,
+      processingStartedAt: Math.floor(Date.now() / 1000)
+    });
+    const guardianProvider: any = { getGuardianClient: async () => null };
+    const sign = jest.fn();
+    const result = await generateTransactionsLoop(sign, false, guardianProvider);
+    expect(result).toBeUndefined();
+    expect(sign).not.toHaveBeenCalled();
+  });
+
+  it('returns undefined when there are no queued or in-progress transactions', async () => {
+    const guardianProvider: any = { getGuardianClient: async () => null };
+    const result = await generateTransactionsLoop(jest.fn(), false, guardianProvider);
+    expect(result).toBeUndefined();
+  });
+});
+
+describe('waitForConsumeTx timeout', () => {
+  it('rejects with a timeout error when the underlying liveQuery never resolves', async () => {
+    jest.useFakeTimers();
+    try {
+      // Push a queued (non-terminal) row so the subscriber sees it but doesn't
+      // resolve/reject — only the timeout path can win.
+      txStore.push({ id: 'tx-pending', status: ITransactionStatus.Queued });
+      const promise = waitForConsumeTx('tx-pending');
+      // Catch the rejection synchronously so the unhandled-rejection guard
+      // doesn't fire while we advance fake timers.
+      const captured = promise.catch((err: unknown) => err);
+      jest.advanceTimersByTime(5 * 60_000 + 10);
+      const err = (await captured) as Error;
+      expect(err.message).toMatch(/timed out/i);
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+});
+
+describe('waitForTransactionCompletion', () => {
+  it('resolves with txHash + serialized output notes when the row goes Completed', async () => {
+    mockTransactionResultDeserialize.mockReturnValueOnce({
+      executedTransaction: () => ({
+        outputNotes: () => ({
+          notes: () => [
+            { intoFull: () => ({ serialize: () => new Uint8Array([0x01, 0x02]) }) },
+            { intoFull: () => undefined } // filtered out
+          ]
+        })
+      })
+    });
+    txStore.push({
+      id: 'tx-done',
+      status: ITransactionStatus.Completed,
+      transactionId: 'on-chain-hash',
+      resultBytes: new Uint8Array([9, 9, 9])
+    });
+    const result = await waitForTransactionCompletion('tx-done');
+    expect(result).toEqual({
+      txHash: 'on-chain-hash',
+      outputNotes: [Buffer.from([0x01, 0x02]).toString('base64')]
+    });
+  });
+
+  it('resolves with timed-out errorMessage when the timer fires before completion', async () => {
+    jest.useFakeTimers();
+    try {
+      txStore.push({ id: 'tx-stuck', status: ITransactionStatus.Queued });
+      const p = waitForTransactionCompletion('tx-stuck');
+      jest.advanceTimersByTime(5 * 60_000 + 10);
+      const result = await p;
+      expect(result).toEqual({ errorMessage: 'Transaction timed out' });
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+});
+
+describe('safeGenerateTransactionsLoop', () => {
+  // Fresh navigator.locks per test so mockImplementation in one doesn't leak.
+  const installNavigatorLocksMock = (impl: (..._args: any[]) => any) => {
+    const nav = (globalThis as any).navigator || {};
+    Object.defineProperty(nav, 'locks', {
+      value: { request: jest.fn(impl) },
+      writable: true,
+      configurable: true
+    });
+  };
+
+  it('returns false (catch path) when navigator.locks.request rejects', async () => {
+    installNavigatorLocksMock(() => Promise.reject(new Error('lock-blew-up')));
+    const result = await safeGenerateTransactionsLoop(jest.fn(), false, {} as any);
+    expect(result).toBe(false);
+  });
+
+  it('returns false when generateTransactionsLoop returns false (forwards through `if (result === false)`)', async () => {
+    // To make generateTransactionsLoop hit its catch branch and return false,
+    // we patch the Repo.transactions.where().modify path so the very first
+    // setTransactionStage call (inside generateTransaction) throws. Closure-
+    // captured jest.fn mocks haven't been cooperating with the mocked-module
+    // boundary, so we patch Repo directly which is also a top-level mock.
+    txStore.push({
+      id: 'fail-stage',
+      type: 'send',
+      accountId: 'acc-1',
+      secondaryAccountId: 'recipient',
+      status: ITransactionStatus.Queued,
+      initiatedAt: 1,
+      noteType: NoteTypeEnum.Public,
+      faucetId: 'f'
+    });
+    const Repo = require('lib/miden/repo');
+    const origWhere = Repo.transactions.where;
+    let triggered = 0;
+    Repo.transactions.where = jest.fn((arg: any) => {
+      if (typeof arg === 'object' && arg.id === 'fail-stage') {
+        triggered++;
+        // First .modify() call (setTransactionStage from generateTransaction)
+        // throws synchronously — generateTransaction throws, generateTransactionsLoop
+        // catches, returns false. After the first throw allow normal behaviour
+        // so the loop's own cancelTransaction call can still mark the row Failed.
+        if (triggered === 1) {
+          return {
+            first: jest.fn(async () => txStore.find(t => t.id === arg.id)),
+            modify: jest.fn(async () => {
+              throw new Error('stage-fail');
+            })
+          };
+        }
+      }
+      return origWhere(arg);
+    });
+    installNavigatorLocksMock((_n: string, _o: any, cb: any) => Promise.resolve(cb({})));
+    try {
+      const result = await safeGenerateTransactionsLoop(jest.fn(), false, {} as any);
+      expect(result).toBe(false);
+    } finally {
+      Repo.transactions.where = origWhere;
+    }
+  });
+});
+
+describe('startBackgroundTransactionProcessing', () => {
+  it('iterates the loop with a 5s wait when there are still uncompleted transactions', async () => {
+    jest.useFakeTimers();
+    // Make navigator.locks always unavailable on this test — safeGenerateTransactionsLoop
+    // returns undefined and the queued row stays Queued, so hasMore stays true on the
+    // first iteration and the 5s setTimeout fires.
+    const nav = (globalThis as any).navigator || {};
+    Object.defineProperty(nav, 'locks', {
+      value: { request: jest.fn(async (_n: string, _o: any, cb: any) => cb(null)) },
+      writable: true,
+      configurable: true
+    });
+
+    try {
+      txStore.push({
+        id: 'queued-then-drained',
+        status: ITransactionStatus.Queued,
+        initiatedAt: 1,
+        accountId: 'acc-1'
+      });
+      startBackgroundTransactionProcessing(jest.fn(), false, {} as any);
+
+      // Let the first iteration's synchronous portion run + the await on
+      // safeGenerateTransactionsLoop + getAllUncompletedTransactions flush.
+      await Promise.resolve();
+      await Promise.resolve();
+      await Promise.resolve();
+      await Promise.resolve();
+
+      // Drain the queue and advance past the 5s wait so the loop's second
+      // pass sees hasMore=false and exits cleanly. This drives the setTimeout
+      // branch (lines 1043-1045).
+      txStore.length = 0;
+      jest.advanceTimersByTime(5_000);
+      await Promise.resolve();
+      await Promise.resolve();
+      await Promise.resolve();
+      // No assertion needed beyond "didn't throw"; we exercised the hasMore + setTimeout branches.
+      expect(true).toBe(true);
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+
+  it('catches errors thrown by the inner processLoop (lines 1051-1052)', async () => {
+    // Force getAllUncompletedTransactions to throw so processLoop rejects, then
+    // assert that the unhandled rejection lands in the .catch on line 1050-1052.
+    const Repo = require('lib/miden/repo');
+    const origFilter = Repo.transactions.filter;
+    Repo.transactions.filter = jest.fn(() => ({
+      toArray: jest.fn(async () => {
+        throw new Error('background-loop-fail');
+      })
+    }));
+    const errSpy = jest.spyOn(console, 'error').mockImplementation();
+    // Lock is "unavailable" so safeGenerateTransactionsLoop short-circuits cleanly
+    // and the failure surfaces from getAllUncompletedTransactions inside processLoop.
+    const nav = (globalThis as any).navigator || {};
+    Object.defineProperty(nav, 'locks', {
+      value: { request: jest.fn(async (_n: string, _o: any, cb: any) => cb(null)) },
+      writable: true,
+      configurable: true
+    });
+    try {
+      startBackgroundTransactionProcessing(jest.fn(), false, {} as any);
+      // Drain enough microtasks for the inner await chain and the processLoop's
+      // own rejection-to-.catch transition.
+      for (let i = 0; i < 20; i++) {
+        await Promise.resolve();
+      }
+      expect(errSpy).toHaveBeenCalledWith('[BackgroundTxProcessor] Error:', expect.any(Error));
+    } finally {
+      Repo.transactions.filter = origFilter;
+      errSpy.mockRestore();
+    }
+  });
+});
+
+describe('verifyStuckTransactionsFromNode invalid + missing branches', () => {
+  it('cancels a consume tx whose note state is Invalid', async () => {
+    txStore.push({
+      id: 'tx-invalid',
+      type: 'consume',
+      noteId: 'note-bad',
+      status: ITransactionStatus.GeneratingTransaction,
+      initiatedAt: 1,
+      processingStartedAt: Math.floor(Date.now() / 1000)
+    });
+    // getInputNoteDetails is on the gap-test mock client. Patch it on the fly.
+    const sdk = require('../sdk/miden-client');
+    const origGetClient = sdk.getMidenClient;
+    sdk.getMidenClient = async () => ({
+      syncState: jest.fn(),
+      getInputNoteDetails: jest.fn(async () => [{ state: 'Invalid' }])
+    });
+    try {
+      const resolved = await verifyStuckTransactionsFromNode();
+      expect(resolved).toBe(1);
+      expect(txStore[0]!.status).toBe(ITransactionStatus.Failed);
+    } finally {
+      sdk.getMidenClient = origGetClient;
+    }
+  });
+
+  it('cancels a consume tx when note state is Unverified and processing time exceeds the grace window', async () => {
+    txStore.push({
+      id: 'tx-unverified',
+      type: 'consume',
+      noteId: 'note-unv',
+      status: ITransactionStatus.GeneratingTransaction,
+      initiatedAt: 1,
+      // 2 minutes ago — comfortably beyond MIN_PROCESSING_TIME_BEFORE_STUCK (60s).
+      processingStartedAt: Math.floor(Date.now() / 1000) - 120
+    });
+    const sdk = require('../sdk/miden-client');
+    const origGetClient = sdk.getMidenClient;
+    sdk.getMidenClient = async () => ({
+      getInputNoteDetails: jest.fn(async () => [{ state: 'Unverified' }])
+    });
+    try {
+      const resolved = await verifyStuckTransactionsFromNode();
+      expect(resolved).toBe(1);
+      expect(txStore[0]!.status).toBe(ITransactionStatus.Failed);
+    } finally {
+      sdk.getMidenClient = origGetClient;
+    }
+  });
+
+  it('skips when getInputNoteDetails returns an empty array (note: undefined)', async () => {
+    txStore.push({
+      id: 'tx-orphan',
+      type: 'consume',
+      noteId: 'note-x',
+      status: ITransactionStatus.GeneratingTransaction,
+      initiatedAt: 1,
+      processingStartedAt: Math.floor(Date.now() / 1000)
+    });
+    const sdk = require('../sdk/miden-client');
+    const origGetClient = sdk.getMidenClient;
+    sdk.getMidenClient = async () => ({
+      getInputNoteDetails: jest.fn(async () => [])
+    });
+    try {
+      const resolved = await verifyStuckTransactionsFromNode();
+      expect(resolved).toBe(0);
+      expect(txStore[0]!.status).toBe(ITransactionStatus.GeneratingTransaction);
+    } finally {
+      sdk.getMidenClient = origGetClient;
+    }
+  });
+});
+
+describe('generateTransaction execute + consume default switch arms', () => {
+  it('drives the execute branch and invokes the signCallback wrapper', async () => {
+    txStore.push({
+      id: 'tx-exec',
+      type: 'execute',
+      accountId: 'acc-1',
+      secondaryAccountId: 'recipient',
+      status: ITransactionStatus.Queued,
+      initiatedAt: 1,
+      requestBytes: new Uint8Array([1, 2, 3]),
+      delegateTransaction: false
+    });
+    const fakeResult = {
+      executedTransaction: () => ({
+        id: () => ({ toHex: () => 'exec-hash' }),
+        outputNotes: () => ({ notes: () => [] })
+      }),
+      serialize: () => new Uint8Array([])
+    };
+
+    // Capture the options.signCallback the WASM client receives so we can
+    // invoke it with byte buffers — that's the only way to exercise the
+    // hex-encoding wrapper inside generateTransaction (lines 775-779).
+    let capturedSignCallback: ((pk: Uint8Array, si: Uint8Array) => Promise<Uint8Array>) | null = null;
+    const sdk = require('../sdk/miden-client');
+    const origGetClient = sdk.getMidenClient;
+    sdk.getMidenClient = async (options?: any) => {
+      if (options?.signCallback) capturedSignCallback = options.signCallback;
+      return {
+        syncState: jest.fn(),
+        newTransaction: jest.fn(async () => fakeResult),
+        waitForTransactionCommit: jest.fn(),
+        sendPrivateNote: jest.fn()
+      };
+    };
+    _gh.__noteTypeForTest = 'public';
+    try {
+      const userSignCallback = jest.fn(async () => new Uint8Array([0xab, 0xcd]));
+      await generateTransaction(txStore[0] as any, userSignCallback, false, {} as any);
+      expect(txStore[0]!.status).toBe(ITransactionStatus.Completed);
+
+      // Drive the wrapper: it should hex-encode and forward to the user callback.
+      expect(capturedSignCallback).not.toBeNull();
+      const sig = await capturedSignCallback!(new Uint8Array([0x01, 0x02]), new Uint8Array([0x10, 0x20]));
+      expect(userSignCallback).toHaveBeenCalledWith('0102', '1020');
+      expect(sig).toEqual(new Uint8Array([0xab, 0xcd]));
+    } finally {
+      sdk.getMidenClient = origGetClient;
+    }
+  });
+
+  it('Guardian consume: completes through completeConsumeTransaction → break (outer switch line 913)', async () => {
+    txStore.push({
+      id: 'guardian-consume',
+      type: 'consume',
+      accountId: 'guardian-acc',
+      noteId: 'note-g',
+      status: ITransactionStatus.Queued,
+      initiatedAt: 1
+    });
+    // Build a TransactionResult-like object that completeConsumeTransaction
+    // can fully consume — input notes with sender/metadata/fungible-assets.
+    const fullResult = {
+      executedTransaction: () => ({
+        id: () => ({ toHex: () => 'guardian-consume-hash' }),
+        inputNotes: () => ({
+          notes: () => [
+            {
+              note: () => ({
+                metadata: () => ({ sender: () => 'sender-g', noteType: () => 0 }),
+                assets: () => ({
+                  fungibleAssets: () => [{ faucetId: () => 'f-g', amount: () => '7' }]
+                })
+              })
+            }
+          ]
+        })
+      }),
+      serialize: () => new Uint8Array([])
+    };
+    const guardianManager = require('lib/miden/front/guardian-manager');
+    guardianManager.isGuardianAccount.mockResolvedValueOnce(true);
+    const fakeMultisigService = {
+      createConsumeNotesProposal: jest.fn(async () => ({ id: 'proposal-1' })),
+      signAndCreateTransactionRequest: jest.fn(async () => ({ serialize: () => new Uint8Array([1]) })),
+      sync: jest.fn(async () => {})
+    };
+    guardianManager.getOrCreateMultisigService.mockResolvedValueOnce(fakeMultisigService);
+
+    const sdk = require('../sdk/miden-client');
+    const origGetClient = sdk.getMidenClient;
+    sdk.getMidenClient = async () => ({
+      syncState: jest.fn(async () => {}),
+      client: {
+        transactions: {
+          submit: jest.fn(async () => ({ result: fullResult }))
+        }
+      }
+    });
+    try {
+      await generateTransaction(txStore[0] as any, jest.fn(), false, {} as any);
+      // Reaching here without throwing means the `case 'consume': ... break;`
+      // arm at lines 911-913 in the outer switch ran.
+      expect(txStore[0]!.status).toBe(ITransactionStatus.Completed);
+      expect(fakeMultisigService.sync).toHaveBeenCalled();
+    } finally {
+      sdk.getMidenClient = origGetClient;
+    }
+  });
+
+  it('drives the consume branch (inner switch)', async () => {
+    txStore.push({
+      id: 'tx-consume',
+      type: 'consume',
+      accountId: 'acc-1',
+      noteId: 'n-1',
+      status: ITransactionStatus.Queued,
+      initiatedAt: 1
+    });
+    const fakeResult = {
+      executedTransaction: () => ({
+        id: () => ({ toHex: () => 'consume-hash' }),
+        inputNotes: () => ({
+          notes: () => [
+            {
+              note: () => ({
+                metadata: () => ({ sender: () => 'sender', noteType: () => 0 }),
+                assets: () => ({
+                  fungibleAssets: () => [{ faucetId: () => 'f', amount: () => '5' }]
+                })
+              })
+            }
+          ]
+        })
+      }),
+      serialize: () => new Uint8Array([])
+    };
+    const sdk = require('../sdk/miden-client');
+    const origGetClient = sdk.getMidenClient;
+    sdk.getMidenClient = async () => ({
+      syncState: jest.fn(),
+      consumeNoteId: jest.fn(async () => fakeResult)
+    });
+    try {
+      await generateTransaction(txStore[0] as any, jest.fn(), false, {} as any);
+      expect(txStore[0]!.status).toBe(ITransactionStatus.Completed);
+    } finally {
+      sdk.getMidenClient = origGetClient;
+    }
+  });
+});
diff --git a/src/lib/miden/back/vault.gaps.test.ts b/src/lib/miden/back/vault.gaps.test.ts
new file mode 100644
index 000000000..42e94a1b8
--- /dev/null
+++ b/src/lib/miden/back/vault.gaps.test.ts
@@ -0,0 +1,420 @@
+/**
+ * Gap-coverage tests for `lib/miden/back/vault.ts`.
+ *
+ * Focused on branches not exercised by `vault.test.ts`:
+ *   - instance `signWord`
+ *   - instance `getPublicKeyForCommitment` (success + error)
+ *   - `concatAccount` duplicate-publicKey throw via `createHDAccount`
+ *   - `pickFreshAccountName` walking past template collisions
+ *   - `tryHardwareUnlock` success path (returns a Vault)
+ */
+
+import * as Passworder from 'lib/miden/passworder';
+import { WalletType } from 'screens/onboarding/types';
+
+import { PublicError } from './defaults';
+import { encryptAndSaveMany, savePlain } from './safe-storage';
+import { Vault } from './vault';
+
+const memoryStore: Record<string, any> = {};
+jest.mock('lib/platform/storage-adapter', () => ({
+  getStorageProvider: jest.fn(() => ({
+    get: async (keys: string[]) => {
+      const out: Record<string, any> = {};
+      for (const k of keys) if (k in memoryStore) out[k] = memoryStore[k];
+      return out;
+    },
+    set: async (items: Record<string, any>) => {
+      Object.assign(memoryStore, items);
+    },
+    remove: async (keys: string[]) => {
+      for (const k of keys) delete memoryStore[k];
+    }
+  })),
+  StorageProvider: class {}
+}));
+
+const mockCreateMidenWallet = jest.fn(async (_type: any, _seed: Uint8Array) => 'acc-pub-key-1');
+const mockGetAccounts = jest.fn(async () => [] as any[]);
+const mockGetAccount = jest.fn(async (_id: string) => null as any);
+const mockSyncState = jest.fn(async () => {});
+const mockAccountsInsert = jest.fn(async (_options: any) => {});
+const mockKeystoreInsert = jest.fn(async (_id: any, _secretKey: any) => {});
+jest.mock('../sdk/miden-client', () => ({
+  getMidenClient: jest.fn(async (_options?: any) => ({
+    createMidenWallet: (...args: unknown[]) => mockCreateMidenWallet(...(args as [any, Uint8Array])),
+    importPublicMidenWalletFromSeed: async (_seed: Uint8Array) => 'acc-pub-key-imported',
+    importAccountBySeed: async (_walletType: any, _seed: Uint8Array) => 'acc-pub-key-imported',
+    getAccounts: () => mockGetAccounts(),
+    getAccount: (id: string) => mockGetAccount(id),
+    syncState: () => mockSyncState(),
+    network: 'devnet',
+    client: {
+      accounts: { insert: mockAccountsInsert },
+      keystore: { insert: mockKeystoreInsert }
+    }
+  })),
+  withWasmClientLock: async <T>(fn: () => Promise<T>) => fn(),
+  runWhenClientIdle: () => {}
+}));
+
+jest.mock('../sdk/helpers', () => ({
+  getBech32AddressFromAccountId: jest.fn((id: any) => (typeof id === 'string' ? id : 'bech32:unknown'))
+}));
+
+jest.mock('lib/miden/reset', () => ({
+  clearStorage: jest.fn(async () => {
+    for (const k of Object.keys(memoryStore)) delete memoryStore[k];
+  })
+}));
+
+jest.mock('lib/platform', () => ({
+  isExtension: jest.fn(() => true),
+  isDesktop: jest.fn(() => false),
+  isMobile: jest.fn(() => false),
+  isIOS: jest.fn(() => false),
+  isAndroid: jest.fn(() => false)
+}));
+
+jest.mock('lib/i18n', () => ({
+  getMessage: jest.fn((key: string, substitutions?: any) => {
+    if (key === 'defaultAccountName') {
+      return `Account ${substitutions?.accountNumber ?? ''}`;
+    }
+    return key;
+  })
+}));
+
+const mockSign = jest.fn(() => ({ serialize: jest.fn(() => new Uint8Array([0xff, 0xaa, 0xbb, 0xcc])) }));
+const mockPublicKey = jest.fn(() => ({ serialize: jest.fn(() => new Uint8Array([0xff, 0x11, 0x22, 0x33])) }));
+const mockAuthSecretKeyDeserialize = jest.fn((_bytes?: Uint8Array) => ({
+  sign: mockSign,
+  signData: jest.fn(() => ({ serialize: jest.fn(() => new Uint8Array([1, 2, 3])) })),
+  publicKey: mockPublicKey
+}));
+const mockWordFromHex = jest.fn(() => ({ __wordMarker: 'word' }));
+jest.mock('@miden-sdk/miden-sdk/lazy', () => {
+  const base = jest.requireActual('../../../../__mocks__/wasmMock.js');
+  return {
+    ...base,
+    AuthSecretKey: {
+      deserialize: (bytes: Uint8Array) => mockAuthSecretKeyDeserialize(bytes),
+      rpoFalconWithRNG: jest.fn(() => ({ __marker: 'rpo-falcon-secret' }))
+    },
+    SigningInputs: { deserialize: jest.fn(() => ({})) },
+    Word: { deserialize: jest.fn(() => ({})), fromHex: (h: string) => mockWordFromHex(h) },
+    AccountBuilder: jest.fn().mockImplementation(() => {
+      const built = {
+        account: {
+          id: () => ({ __marker: 'imported-account-id' }),
+          isFaucet: () => false,
+          isNetwork: () => false
+        }
+      };
+      const builder: any = {
+        accountType: jest.fn(() => builder),
+        storageMode: jest.fn(() => builder),
+        withAuthComponent: jest.fn(() => builder),
+        withBasicWalletComponent: jest.fn(() => builder),
+        build: jest.fn(() => built)
+      };
+      return builder;
+    }),
+    AccountComponent: { createAuthComponentFromSecretKey: jest.fn(() => ({ __marker: 'auth-component' })) },
+    AccountStorageMode: { public: jest.fn(() => 'public-mode'), private: jest.fn(() => 'private-mode') },
+    AccountType: { RegularAccountImmutableCode: 2 }
+  };
+});
+
+const { isDesktop, isMobile } = jest.requireMock('lib/platform');
+
+const VAULT_PREFIX = 'vault';
+const ck = (id: string) => `${VAULT_PREFIX}_${id}`;
+const keys = {
+  check: ck('check'),
+  mnemonic: ck('mnemonic'),
+  accPubKey: (pk: string) => `${ck('accpubkey')}_${pk}`,
+  accAuthSecretKey: (pk: string) => `${ck('accauthsecretkey')}_${pk}`,
+  currentAccPubKey: ck('curraccpubkey'),
+  accounts: ck('accounts'),
+  ownMnemonic: ck('ownmnemonic'),
+  vaultKeyPassword: 'vault_key_password',
+  vaultKeyHardware: 'vault_key_hardware'
+};
+
+const VALID_MNEMONIC = 'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about';
+
+async function seedVault(
+  password: string,
+  opts: {
+    accounts?: Array<{ publicKey: string; name: string; isPublic: boolean; type: WalletType }>;
+    currentPk?: string;
+  } = {}
+): Promise<Vault> {
+  const vaultKeyBytes = Passworder.generateVaultKey();
+  const vaultKey = await Passworder.importVaultKey(vaultKeyBytes);
+  const encryptedVaultKey = await Passworder.encryptVaultKeyWithPassword(vaultKeyBytes, password);
+  await savePlain(keys.vaultKeyPassword, encryptedVaultKey);
+
+  const accounts = opts.accounts ?? [
+    { publicKey: 'acc-pub-key-1', name: 'Miden Account 1', isPublic: true, type: WalletType.OnChain }
+  ];
+  const currentPk = opts.currentPk ?? (accounts.length > 0 ? accounts[0]!.publicKey : 'no-accounts');
+
+  const writes: [string, any][] = [
+    [keys.check, VALID_MNEMONIC],
+    [keys.mnemonic, VALID_MNEMONIC],
+    [keys.accounts, accounts]
+  ];
+  await encryptAndSaveMany(writes, vaultKey);
+  await savePlain(keys.currentAccPubKey, currentPk);
+  await savePlain(keys.ownMnemonic, false);
+
+  return new (Vault as any)(vaultKey);
+}
+
+beforeEach(() => {
+  for (const k of Object.keys(memoryStore)) delete memoryStore[k];
+  jest.clearAllMocks();
+  (isDesktop as jest.Mock).mockReturnValue(false);
+  (isMobile as jest.Mock).mockReturnValue(false);
+  mockAuthSecretKeyDeserialize.mockReturnValue({
+    sign: mockSign,
+    signData: jest.fn(() => ({ serialize: jest.fn(() => new Uint8Array([1, 2, 3])) })),
+    publicKey: mockPublicKey
+  } as any);
+});
+
+describe('Vault instance signWord', () => {
+  it('returns a 0x-prefixed hex signature derived from the stored secret', async () => {
+    const vault = await seedVault('pw');
+    const vaultKey = (vault as any).vaultKey as CryptoKey;
+    await encryptAndSaveMany([[keys.accAuthSecretKey('acc-pub-key-1'), '01020304']], vaultKey);
+
+    // Default mock sign() serialize returns [0xff, 0xaa, 0xbb, 0xcc].
+    // signWord slices off the leading byte → 'aabbcc'.
+    const sig = await vault.signWord('acc-pub-key-1', '0xdeadbeef');
+    expect(sig).toBe('0xaabbcc');
+    expect(mockWordFromHex).toHaveBeenCalledWith('0xdeadbeef');
+    expect(mockSign).toHaveBeenCalled();
+  });
+});
+
+describe('Vault instance getPublicKeyForCommitment', () => {
+  it('returns the hex public key (with the type-prefix byte stripped)', async () => {
+    const vault = await seedVault('pw');
+    const vaultKey = (vault as any).vaultKey as CryptoKey;
+    await encryptAndSaveMany([[keys.accAuthSecretKey('pkc-1'), 'aabbccdd']], vaultKey);
+
+    // publicKey().serialize() is mocked to [0xff, 0x11, 0x22, 0x33] → '112233'.
+    const pk = await vault.getPublicKeyForCommitment('pkc-1');
+    expect(pk).toBe('112233');
+  });
+
+  it('wraps missing-secret errors in a PublicError', async () => {
+    const vault = await seedVault('pw');
+    // No secret key stored under 'pkc-missing' → fetchAndDecryptOneWithLegacyFallBack throws.
+    await expect(vault.getPublicKeyForCommitment('pkc-missing')).rejects.toThrow(PublicError);
+  });
+});
+
+describe('Vault.createHDAccount: concatAccount duplicate guard', () => {
+  it('throws PublicError when the new account collides with an existing publicKey', async () => {
+    const vault = await seedVault('pw');
+    // Force createMidenWallet to return the same publicKey that's already in
+    // the seeded accounts list. concatAccount must reject the duplicate.
+    mockCreateMidenWallet.mockResolvedValueOnce('acc-pub-key-1');
+    await expect(vault.createHDAccount(WalletType.OnChain)).rejects.toThrow(PublicError);
+  });
+});
+
+describe('Vault.importAccountFromPrivateKey: pickFreshAccountName collision walk', () => {
+  const VALID_HEX = 'deadbeefcafebabe1234567890abcdefdeadbeefcafebabe1234567890abcdef';
+
+  it('skips past Account 1 / Account 2 to land on the next free template slot', async () => {
+    const vault = await seedVault('pw', {
+      accounts: [
+        { publicKey: 'acc-a', name: 'Account 1', isPublic: true, type: WalletType.OnChain },
+        { publicKey: 'acc-b', name: 'Account 2', isPublic: true, type: WalletType.OnChain }
+      ],
+      currentPk: 'acc-a'
+    });
+    const accounts = await vault.importAccountFromPrivateKey(VALID_HEX);
+    expect(accounts[2]!.name).toBe('Account 3');
+  });
+});
+
+describe('Vault.fetchAccounts: not-array throw', () => {
+  it('throws PublicError when the persisted accounts slot is not an array', async () => {
+    const vault = await seedVault('pw');
+    const vaultKey = (vault as any).vaultKey as CryptoKey;
+    // Overwrite the accounts slot with a non-array value — fetchAndDecryptOneWithLegacyFallBack
+    // will return the bogus shape and the Array.isArray guard must reject it.
+    await encryptAndSaveMany([[keys.accounts, { not: 'an-array' }]], vaultKey);
+    await expect(vault.fetchAccounts()).rejects.toThrow(PublicError);
+  });
+});
+
+describe('Vault.spawnFromMidenClient: error branches', () => {
+  it('throws PublicError when called with no password and no hardware available', async () => {
+    // Extension platform → isHardwareSecurityAvailableForVault returns false →
+    // spawnFromMidenClient hits `if (!password) throw 'Password is required...'`.
+    (isDesktop as jest.Mock).mockReturnValue(false);
+    (isMobile as jest.Mock).mockReturnValue(false);
+    await expect(Vault.spawnFromMidenClient('', VALID_MNEMONIC, [])).rejects.toThrow(PublicError);
+  });
+
+  it('throws PublicError when walletAccounts is empty after the WASM lock body', async () => {
+    // Password is provided, walletAccounts is [] — the empty-list branch must reject.
+    await expect(Vault.spawnFromMidenClient('pw', VALID_MNEMONIC, [])).rejects.toThrow(PublicError);
+  });
+});
+
+describe('Vault.spawn: preserved guardian URL', () => {
+  it('restores GUARDIAN_URL_STORAGE_KEY across the storage wipe', async () => {
+    const { putToStorage, fetchFromStorage } = await import('../front/storage');
+    const { GUARDIAN_URL_STORAGE_KEY } = await import('lib/settings/constants');
+    await putToStorage(GUARDIAN_URL_STORAGE_KEY, 'https://my-guardian.example');
+
+    await Vault.spawn(WalletType.OnChain, 'pw', VALID_MNEMONIC);
+
+    // The clearStorage wipe would normally drop everything; the spawn() guard
+    // explicitly re-puts GUARDIAN_URL_STORAGE_KEY when it was set before the wipe.
+    expect(await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)).toBe('https://my-guardian.example');
+  });
+});
+
+describe('Vault.spawn: Guardian import helpers', () => {
+  it('exercises signWordFn / getPublicKeyForCommitment when ownMnemonic + Guardian path runs', async () => {
+    // Wire the mocked client so its importAccountBySeed actually invokes the
+    // helpers we need to cover. Helpers read from the (post-callback) keystore,
+    // so we also have to make insertKeyCallback fire before invocation.
+    const sdk = require('../sdk/miden-client');
+    const origGetClient = sdk.getMidenClient;
+    sdk.getMidenClient = jest.fn(async (options: any) => ({
+      createMidenWallet: async (_t: any, _s: Uint8Array) => 'guardian-pk',
+      importAccountBySeed: async (
+        _walletType: any,
+        _seed: Uint8Array,
+        signWordFn: (pk: string, hex: string) => Promise<string>,
+        getPubKeyFn: (pkc: string) => Promise<string>
+      ) => {
+        // Simulate the WASM client persisting an auth-secret first, then asking
+        // the wallet to sign + look up its commitment public key — the two
+        // helper closures defined inside Vault.spawn.
+        await options.insertKeyCallback(new Uint8Array([0xaa, 0xbb]), new Uint8Array([0x01, 0x02, 0x03, 0x04]));
+        await signWordFn('aabb', '0xdeadbeef');
+        await getPubKeyFn('aabb');
+        return 'guardian-pk';
+      },
+      getAccounts: async () => [],
+      getAccount: async () => null,
+      syncState: async () => {},
+      network: 'devnet',
+      client: { accounts: { insert: jest.fn() }, keystore: { insert: jest.fn() } }
+    }));
+
+    try {
+      const vault = await Vault.spawn(WalletType.Guardian, 'pw', VALID_MNEMONIC, true);
+      expect(vault).toBeInstanceOf(Vault);
+    } finally {
+      sdk.getMidenClient = origGetClient;
+    }
+  });
+});
+
+describe('Vault.revealPrivateKey: not-found path', () => {
+  it('throws PublicError when the stored secret is empty/falsy after decrypt', async () => {
+    const vault = await seedVault('pw');
+    const vaultKey = (vault as any).vaultKey as CryptoKey;
+    // Persist an empty string under the expected slot. fetchAndDecryptOneWithLegacyFallBack
+    // returns the falsy value, so the `if (!secretKeyHex)` guard fires.
+    await encryptAndSaveMany([[keys.accAuthSecretKey('acc-empty'), '']], vaultKey);
+    await expect(Vault.revealPrivateKey('acc-empty', 'pw')).rejects.toThrow(PublicError);
+  });
+});
+
+// Hardware-success paths require mocking the dynamic-imported `lib/biometric`
+// module. The existing vault.test.ts uses jest.doMock with virtual:true; mirror
+// that pattern in an isolated describe so the module registration doesn't bleed
+// into the other tests above.
+describe('Vault hardware-backed unlock + reveal', () => {
+  let storedHardwareB64: string | null = null;
+
+  beforeAll(() => {
+    jest.doMock(
+      'lib/biometric',
+      () => ({
+        isHardwareSecurityAvailable: jest.fn(async () => true),
+        hasHardwareKey: jest.fn(async () => false),
+        generateHardwareKey: jest.fn(async () => {}),
+        encryptWithHardwareKey: jest.fn(async (b: string) => {
+          storedHardwareB64 = b;
+          return `enc(${b})`;
+        }),
+        decryptWithHardwareKey: jest.fn(async (encrypted: string) => {
+          // The vault stores the encrypted blob; decryption must round-trip
+          // back to the original base64 vault-key bytes.
+          if (encrypted.startsWith('enc(') && encrypted.endsWith(')')) {
+            return encrypted.slice(4, -1);
+          }
+          return storedHardwareB64 ?? '';
+        })
+      }),
+      { virtual: true }
+    );
+  });
+
+  afterAll(() => {
+    jest.dontMock('lib/biometric');
+  });
+
+  beforeEach(() => {
+    storedHardwareB64 = null;
+  });
+
+  it('tryHardwareUnlock returns a Vault instance when the hardware decrypt succeeds', async () => {
+    (isMobile as jest.Mock).mockReturnValue(true);
+    (isDesktop as jest.Mock).mockReturnValue(false);
+    // Spawn-without-password takes the hardware-only branch and stores the
+    // encrypted vault key under VAULT_KEY_HARDWARE_STORAGE_KEY.
+    await Vault.spawn(WalletType.OnChain, undefined as any, VALID_MNEMONIC);
+    const unlocked = await Vault.tryHardwareUnlock();
+    expect(unlocked).toBeInstanceOf(Vault);
+  });
+
+  it('revealPrivateKey without a password takes the hardware-vault-key branch', async () => {
+    (isMobile as jest.Mock).mockReturnValue(true);
+    (isDesktop as jest.Mock).mockReturnValue(false);
+    const vault = await Vault.spawn(WalletType.OnChain, undefined as any, VALID_MNEMONIC);
+    const vaultKey = (vault as any).vaultKey as CryptoKey;
+    await encryptAndSaveMany([[keys.accAuthSecretKey('pkc-hw'), '4242']], vaultKey);
+
+    const sk = await Vault.revealPrivateKey('pkc-hw');
+    expect(sk).toBe('4242');
+  });
+
+  it('Vault.setup() without a password returns the unlocked Vault when hardware unlock succeeds', async () => {
+    (isMobile as jest.Mock).mockReturnValue(true);
+    (isDesktop as jest.Mock).mockReturnValue(false);
+    // Spawn hardware-only first so the encrypted vault key is stored.
+    await Vault.spawn(WalletType.OnChain, undefined as any, VALID_MNEMONIC);
+    // Now setup() with no password drops into the `if (vault) return vault` arm.
+    const unlocked = await Vault.setup();
+    expect(unlocked).toBeInstanceOf(Vault);
+  });
+
+  it('spawnFromMidenClient throws when hardware is available but setupHardwareProtector reports failure', async () => {
+    (isMobile as jest.Mock).mockReturnValue(true);
+    (isDesktop as jest.Mock).mockReturnValue(false);
+    // Force the encryption step to throw on this call only so setupHardwareProtector
+    // returns false → spawnFromMidenClient hits its `Hardware security setup failed` branch.
+    const biometric = require('lib/biometric');
+    biometric.encryptWithHardwareKey.mockRejectedValueOnce(new Error('hw-encrypt-fail'));
+    await expect(
+      Vault.spawnFromMidenClient('', VALID_MNEMONIC, [
+        { publicKey: 'pk-1', name: 'A', isPublic: true, type: WalletType.OnChain, hdIndex: 0 }
+      ])
+    ).rejects.toThrow(PublicError);
+  });
+});

From cc9f4c3a41e8559f9ec43699e4771209a03dd1d0 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Wed, 6 May 2026 13:18:26 +0530
Subject: [PATCH 32/71] feat: per-network guardian endpoint map
 (testnet/devnet)

---
 src/lib/miden-chain/constants.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/lib/miden-chain/constants.ts b/src/lib/miden-chain/constants.ts
index 37512b4e5..720cdf68b 100644
--- a/src/lib/miden-chain/constants.ts
+++ b/src/lib/miden-chain/constants.ts
@@ -89,7 +89,13 @@ export const MIDEN_NETWORKS: MidenNetwork[] = [
   { rpcBaseURL: 'http://localhost:57291', id: MIDEN_NETWORK_NAME.LOCALNET, name: 'Localnet', autoSync: true }
 ];
 
-export const DEFAULT_GUARDIAN_ENDPOINT = 'https://guardian-stg.openzeppelin.com';
+export const MIDEN_GUARDIAN_ENDPOINTS = new Map<string, string>([
+  [MIDEN_NETWORK_NAME.TESTNET, 'https://guardian.openzeppelin.com'],
+  [MIDEN_NETWORK_NAME.DEVNET, 'https://stg-guardian.openzeppelin.com']
+]);
+
+export const DEFAULT_GUARDIAN_ENDPOINT =
+  MIDEN_GUARDIAN_ENDPOINTS.get(DEFAULT_NETWORK) ?? 'https://stg-guardian.openzeppelin.com';
 
 /**
  * Returns the SDK NetworkId for the current DEFAULT_NETWORK.

From bcecdf3bc6c49e97b804141f76fcaddf853335b9 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Wed, 6 May 2026 13:19:06 +0530
Subject: [PATCH 33/71] test: drop obsolete useConnectivityIssues hook tests

---
 .../activity/connectivity-issues.test.ts      | 53 -------------------
 1 file changed, 53 deletions(-)

diff --git a/src/lib/miden/activity/connectivity-issues.test.ts b/src/lib/miden/activity/connectivity-issues.test.ts
index 8f708669e..5e44da580 100644
--- a/src/lib/miden/activity/connectivity-issues.test.ts
+++ b/src/lib/miden/activity/connectivity-issues.test.ts
@@ -19,8 +19,6 @@ jest.mock('lib/platform/storage-adapter', () => ({
   })
 }));
 
-import { act, renderHook } from '@testing-library/react';
-
 import { addConnectivityIssue, sendConnectivityIssue } from './connectivity-issues';
 import { resetConnectivityState } from './connectivity-state';
 
@@ -63,54 +61,3 @@ describe('sendConnectivityIssue', () => {
   });
 });
 
-// useConnectivityIssues is a thin wrapper around useStorage; exercising it
-// via useStorage's real suspense path is flaky with @testing-library/react.
-// Stub useStorage at the module level and drive the hook through that — we
-// only need to prove the wrapper forwards state + dismisses correctly.
-describe('useConnectivityIssues', () => {
-  // eslint-disable-next-line @typescript-eslint/no-var-requires
-  const conn = require('./connectivity-issues');
-
-  // We re-import the module under a mock of useStorage so the hook is
-  // covered without the suspense machinery.
-  let useHook: typeof conn.useConnectivityIssues;
-  let setStored: (v: boolean) => void;
-  let storedValue = false;
-  let setValue: jest.Mock;
-
-  beforeEach(() => {
-    jest.resetModules();
-    setValue = jest.fn(async (v: boolean) => {
-      storedValue = v;
-    });
-    setStored = (v: boolean) => {
-      storedValue = v;
-    };
-    jest.doMock('../front', () => ({
-      useStorage: jest.fn(() => [storedValue, setValue]),
-      putToStorage: jest.fn(async () => {})
-    }));
-    // Re-require after mocking so the hook picks up the stubbed useStorage.
-    const reloaded = require('./connectivity-issues');
-    useHook = reloaded.useConnectivityIssues;
-  });
-
-  it('returns the stored flag and dispatches false on dismiss', () => {
-    setStored(true);
-    const { result } = renderHook(() => useHook());
-
-    const [value, dismiss] = result.current;
-    expect(value).toBe(true);
-
-    act(() => {
-      dismiss();
-    });
-    expect(setValue).toHaveBeenCalledWith(false);
-  });
-
-  it('returns the default false when nothing is stored', () => {
-    setStored(false);
-    const { result } = renderHook(() => useHook());
-    expect(result.current[0]).toBe(false);
-  });
-});

From a0e7b1cf3ef29088e7b21161abc3afefa67b8f83 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Wed, 6 May 2026 13:30:11 +0530
Subject: [PATCH 34/71] ci: lint

---
 src/lib/miden/activity/connectivity-issues.test.ts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/lib/miden/activity/connectivity-issues.test.ts b/src/lib/miden/activity/connectivity-issues.test.ts
index 5e44da580..ab692da53 100644
--- a/src/lib/miden/activity/connectivity-issues.test.ts
+++ b/src/lib/miden/activity/connectivity-issues.test.ts
@@ -60,4 +60,3 @@ describe('sendConnectivityIssue', () => {
     );
   });
 });
-

From 23d83318372b38e9a844c8440c055da4a7c78c39 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Wed, 6 May 2026 13:36:35 +0530
Subject: [PATCH 35/71] ci: tsc

---
 src/lib/miden/back/vault.gaps.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/miden/back/vault.gaps.test.ts b/src/lib/miden/back/vault.gaps.test.ts
index 42e94a1b8..131626d4d 100644
--- a/src/lib/miden/back/vault.gaps.test.ts
+++ b/src/lib/miden/back/vault.gaps.test.ts
@@ -92,7 +92,7 @@ const mockAuthSecretKeyDeserialize = jest.fn((_bytes?: Uint8Array) => ({
   signData: jest.fn(() => ({ serialize: jest.fn(() => new Uint8Array([1, 2, 3])) })),
   publicKey: mockPublicKey
 }));
-const mockWordFromHex = jest.fn(() => ({ __wordMarker: 'word' }));
+const mockWordFromHex = jest.fn((_hex: string) => ({ __wordMarker: 'word' }));
 jest.mock('@miden-sdk/miden-sdk/lazy', () => {
   const base = jest.requireActual('../../../../__mocks__/wasmMock.js');
   return {

From f052d41fa52eb6e34ea81e78e4552d571ec34672 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Fri, 1 May 2026 15:52:01 +0530
Subject: [PATCH 36/71] feat(guardian): switch default auth scheme to ECDSA

---
 .../@openzeppelin/miden-multisig-client.ts    |  4 ----
 src/lib/miden/back/vault.ts                   |  2 +-
 src/lib/miden/guardian/account.test.ts        | 20 +++++++++----------
 src/lib/miden/guardian/account.ts             |  8 ++++----
 src/lib/miden/guardian/signer.test.ts         |  4 ++--
 src/lib/miden/guardian/signer.ts              |  5 +++--
 6 files changed, 20 insertions(+), 23 deletions(-)

diff --git a/__mocks__/@openzeppelin/miden-multisig-client.ts b/__mocks__/@openzeppelin/miden-multisig-client.ts
index 5fccf4855..a5c1c0a6f 100644
--- a/__mocks__/@openzeppelin/miden-multisig-client.ts
+++ b/__mocks__/@openzeppelin/miden-multisig-client.ts
@@ -37,10 +37,6 @@ export class GuardianHttpClient {
 
 export class GuardianHttpError extends Error {}
 
-export class FalconSigner {
-  constructor(..._args: unknown[]) {}
-}
-
 export class EcdsaSigner {
   constructor(..._args: unknown[]) {}
 }
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index e750009e3..d678da476 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -411,7 +411,7 @@ export class Vault {
             continue;
           }
           const walletSeed = deriveClientSeed(walletAccount.type, mnemonic, walletAccount.hdIndex);
-          const secretKey = AuthSecretKey.rpoFalconWithRNG(walletSeed);
+          const secretKey = AuthSecretKey.ecdsaWithRNG(walletSeed);
           await midenClient.client.keystore.insert(account.id(), secretKey);
         }
       });
diff --git a/src/lib/miden/guardian/account.test.ts b/src/lib/miden/guardian/account.test.ts
index d5ea87c6f..c489167a8 100644
--- a/src/lib/miden/guardian/account.test.ts
+++ b/src/lib/miden/guardian/account.test.ts
@@ -21,20 +21,20 @@ jest.mock('lib/settings/constants', () => ({
   GUARDIAN_URL_STORAGE_KEY: 'guardian_url_setting'
 }));
 
-// AuthSecretKey.rpoFalconWithRNG + commitment calls need a predictable stub.
-const mockAuthSecretKeyRpo = jest.fn();
+// AuthSecretKey.ecdsaWithRNG + commitment calls need a predictable stub.
+const mockAuthSecretKeyEcdsa = jest.fn();
 jest.mock('@miden-sdk/miden-sdk/lazy', () => {
   const actual = jest.requireActual('../../../../__mocks__/wasmMock.js');
   return {
     ...actual,
-    AuthSecretKey: { rpoFalconWithRNG: (seed: unknown) => mockAuthSecretKeyRpo(seed) }
+    AuthSecretKey: { ecdsaWithRNG: (seed: unknown) => mockAuthSecretKeyEcdsa(seed) }
   };
 });
 jest.mock('@miden-sdk/miden-sdk', () => {
   const actual = jest.requireActual('../../../../__mocks__/wasmMock.js');
   return {
     ...actual,
-    AuthSecretKey: { rpoFalconWithRNG: (seed: unknown) => mockAuthSecretKeyRpo(seed) }
+    AuthSecretKey: { ecdsaWithRNG: (seed: unknown) => mockAuthSecretKeyEcdsa(seed) }
   };
 });
 
@@ -54,7 +54,7 @@ jest.mock('@openzeppelin/miden-multisig-client', () => ({
       getPubkey: (...a: unknown[]) => multisigClientConfig.getPubkey(...a)
     }
   })),
-  FalconSigner: jest.fn().mockImplementation((sk: unknown) => ({ sk }))
+  EcdsaSigner: jest.fn().mockImplementation((sk: unknown) => ({ sk }))
 }));
 
 describe('getSignerDetailsFromAccount', () => {
@@ -123,7 +123,7 @@ describe('createGuardianAccount', () => {
 
   beforeEach(() => {
     jest.clearAllMocks();
-    mockAuthSecretKeyRpo.mockReturnValue({
+    mockAuthSecretKeyEcdsa.mockReturnValue({
       publicKey: () => ({ toCommitment: () => ({ toHex: () => '0xsigner-commit' }) })
     });
     multisigClientConfig.getPubkey.mockResolvedValue({ commitment: 'g-commit', pubkey: 'g-pubkey' });
@@ -138,7 +138,7 @@ describe('createGuardianAccount', () => {
     const seed = new Uint8Array([1, 2, 3, 4]);
     const account = await createGuardianAccount(webClient as never, seed);
 
-    expect(mockAuthSecretKeyRpo).toHaveBeenCalledWith(seed);
+    expect(mockAuthSecretKeyEcdsa).toHaveBeenCalledWith(seed);
     expect(multisigClientConfig.create).toHaveBeenCalledWith(
       expect.objectContaining({
         threshold: 1,
@@ -147,7 +147,7 @@ describe('createGuardianAccount', () => {
         guardianPublicKey: 'g-pubkey',
         guardianEnabled: true,
         storageMode: 'private',
-        signatureScheme: 'falcon',
+        signatureScheme: 'ecdsa',
         seed
       }),
       expect.anything()
@@ -164,8 +164,8 @@ describe('createGuardianAccount', () => {
 
     await createGuardianAccount(webClient as never);
 
-    // rpoFalconWithRNG was still called with a 32-byte Uint8Array.
-    const seedArg = mockAuthSecretKeyRpo.mock.calls[0]?.[0];
+    // ecdsaWithRNG was still called with a 32-byte Uint8Array.
+    const seedArg = mockAuthSecretKeyEcdsa.mock.calls[0]?.[0];
     expect(seedArg).toBeInstanceOf(Uint8Array);
     expect((seedArg as Uint8Array).length).toBe(32);
   });
diff --git a/src/lib/miden/guardian/account.ts b/src/lib/miden/guardian/account.ts
index 389bbdbc1..77cf237c6 100644
--- a/src/lib/miden/guardian/account.ts
+++ b/src/lib/miden/guardian/account.ts
@@ -1,5 +1,5 @@
 import { Account, AuthSecretKey, MidenClient } from '@miden-sdk/miden-sdk/lazy';
-import { FalconSigner, MultisigClient } from '@openzeppelin/miden-multisig-client';
+import { EcdsaSigner, MultisigClient } from '@openzeppelin/miden-multisig-client';
 
 import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
 import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
@@ -67,7 +67,7 @@ export async function createGuardianAccount(
 
   try {
     // Generate the signer secret key from seed
-    const sk = AuthSecretKey.rpoFalconWithRNG(seed);
+    const sk = AuthSecretKey.ecdsaWithRNG(seed);
     const signerCommitment = sk.publicKey().toCommitment();
 
     // Get Guardian endpoint and initialize client
@@ -87,10 +87,10 @@ export async function createGuardianAccount(
         guardianPublicKey: pubkey,
         guardianEnabled: true,
         storageMode: 'private',
-        signatureScheme: 'falcon',
+        signatureScheme: 'ecdsa',
         seed
       },
-      new FalconSigner(sk)
+      new EcdsaSigner(sk)
     );
 
     if (!skipRegistration) {
diff --git a/src/lib/miden/guardian/signer.test.ts b/src/lib/miden/guardian/signer.test.ts
index ec3237b26..95281b17c 100644
--- a/src/lib/miden/guardian/signer.test.ts
+++ b/src/lib/miden/guardian/signer.test.ts
@@ -30,10 +30,10 @@ describe('WalletSigner', () => {
     signer = new WalletSigner(publicKey, commitment, signWordFn);
   });
 
-  it('exposes the configured public key, commitment, and falcon scheme', () => {
+  it('exposes the configured public key, commitment, and ecdsa scheme', () => {
     expect(signer.publicKey).toBe(publicKey);
     expect(signer.commitment).toBe(commitment);
-    expect(signer.scheme).toBe('falcon');
+    expect(signer.scheme).toBe('ecdsa');
   });
 
   it('signAccountIdWithTimestamp hashes and delegates to signWord with commitment stripped of 0x', async () => {
diff --git a/src/lib/miden/guardian/signer.ts b/src/lib/miden/guardian/signer.ts
index 807f18faa..96dbac395 100644
--- a/src/lib/miden/guardian/signer.ts
+++ b/src/lib/miden/guardian/signer.ts
@@ -6,12 +6,13 @@ export type SignWordFunction = (publicKey: string, wordHex: string) => Promise<s
 export class WalletSigner implements Signer {
   readonly commitment: string;
   readonly publicKey: string;
-  readonly scheme: SignatureScheme = 'falcon';
+  readonly scheme: SignatureScheme;
   private signWordFn: (wordHex: string) => Promise<string>;
 
-  constructor(publicKey: string, commitment: string, signWordFn: SignWordFunction) {
+  constructor(publicKey: string, commitment: string, signWordFn: SignWordFunction, scheme: SignatureScheme = 'ecdsa') {
     this.publicKey = publicKey;
     this.commitment = commitment;
+    this.scheme = scheme;
     this.signWordFn = (wordHex: string) => signWordFn(commitment.slice(2), wordHex);
   }
 

From ec0a4cdfe32d43612853d949748b0d6d8de44d6c Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Fri, 1 May 2026 23:22:53 +0530
Subject: [PATCH 37/71] feat(guardian): 3-key (hot+cold+guardian) account
 creation

---
 CHANGELOG.md                                  |   1 +
 src/lib/miden/back/vault.test.ts              |  48 ++++--
 src/lib/miden/back/vault.ts                   | 150 +++++++++++++-----
 src/lib/miden/guardian/account.test.ts        |  85 ++++++++--
 src/lib/miden/guardian/account.ts             | 109 +++++++++----
 .../miden/sdk/miden-client-interface.test.ts  |  87 ++++++++--
 src/lib/miden/sdk/miden-client-interface.ts   | 113 ++++++++-----
 src/lib/secure-hot-key/index.ts               |  36 +++++
 src/lib/secure-hot-key/jsFallback.ts          |  46 ++++++
 src/lib/secure-hot-key/nativePlugin.ts        |  22 +++
 src/lib/shared/types.ts                       |   5 +
 11 files changed, 561 insertions(+), 141 deletions(-)
 create mode 100644 src/lib/secure-hot-key/index.ts
 create mode 100644 src/lib/secure-hot-key/jsFallback.ts
 create mode 100644 src/lib/secure-hot-key/nativePlugin.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f9fcecc41..513a3110b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@
 ### Features
 
 <<<<<<< utk-psm-integration
+* [FEATURE][all] 3-key Guardian accounts. Guardian creation now provisions a hot ECDSA key (random, lives outside the WASM keystore behind a new `secure-hot-key` facade — extension/desktop use a JS fallback today; mobile native plugin lands in Phase 4) plus an HD-derived cold ECDSA key (kept in the SDK keystore for cold-routed flows) alongside the existing guardian co-signer. Threshold stays at 1 (hot OR cold + guardian); cold-only routing for `update_signers` / `update_guardian` / `update_procedure_threshold` is enforced client-side per the Phase 0 SDK reading. Storage adds `accColdSecretKeyStrgKey` and `WalletAccount.{hotPublicKey,coldPublicKey}` so role-aware `signWord` (Phase 3) can dispatch hot vs cold by storage entity. Hard cutover from the 1-of-1 Falcon scheme — pre-cutover Guardian accounts are unreachable from this build.
 * [FEATURE][all] Guardian integration. Adds Guardian-backed accounts (1-of-1 multisig with on-chain Guardian signature verification), onboarding create/import flows with a dedicated recovery-method screen that accepts a custom guardian URL, Settings → Guardian Settings with an on-chain switch-guardian proposal that re-registers post-switch state with the new endpoint, service-worker routing for Guardian transaction signing via `MultisigService`, frontend Guardian sync outside the WASM lock, and per-stage progress labels (`creating-proposal`, `signing-proposal`, `submitting`, `registering-guardian`) in the transaction modal.
 =======
 * [FEATURE][ci] **Linked Web SDK PR pattern.** Wallet PRs that depend on an unpublished `@miden-sdk/miden-sdk` or `@miden-sdk/react` change can now include `Web SDK PR: #N` in the description. CI's new `.github/actions/inject-linked-web-sdk-pr` action clones the linked web-sdk PR, builds the SDK packages from source, and rewrites `package.json` to consume them via `file:` deps — so the wallet PR's CI builds against the actual upstream change without requiring it to publish first. A separate `check-linked-web-sdk-pr.yml` workflow keeps a `linked-web-sdk-pr-ready` commit status pending until the linked PR is merged AND a web-sdk release tag covering its merge commit is published, with a 15-min cron re-evaluation so the gate auto-flips green without re-pushing. Local-dev parity via `scripts/dev-with-web-sdk-pr.sh` (with `--clear`); a new `lefthook.yml` pre-commit hook blocks committing the patched state. Mirrors web-sdk's existing `Client PR: #N` pattern. See "Linked Web SDK PR (cross-repo CI)" in CLAUDE.md for full details. (#231)
diff --git a/src/lib/miden/back/vault.test.ts b/src/lib/miden/back/vault.test.ts
index c91474415..6d9b170f0 100644
--- a/src/lib/miden/back/vault.test.ts
+++ b/src/lib/miden/back/vault.test.ts
@@ -34,6 +34,20 @@ jest.mock('lib/platform/storage-adapter', () => ({
 // ---------------------------------------------------------------------------
 const mockCreateMidenWallet = jest.fn(async (_type: any, _seed: Uint8Array) => 'acc-pub-key-1');
 const mockImportPublicMidenWalletFromSeed = jest.fn(async (_seed: Uint8Array) => 'acc-pub-key-imported');
+const GUARDIAN_KEYS_FIXTURE = {
+  hotPublicKey: 'hot-pub',
+  coldPublicKey: 'cold-pub',
+  hotCiphertext: 'hot-ct',
+  coldSecretKeyHex: 'cold-sk'
+};
+const mockCreateGuardianMidenWallet = jest.fn(async (_seed: Uint8Array) => ({
+  accountId: 'guardian-acc-1',
+  keys: GUARDIAN_KEYS_FIXTURE
+}));
+const mockImportGuardianAccountBySeed = jest.fn(async (_seed: Uint8Array, _signWord: any, _getPub: any) => ({
+  accountId: 'guardian-acc-imported',
+  keys: GUARDIAN_KEYS_FIXTURE
+}));
 const mockGetAccounts = jest.fn(async () => [] as any[]);
 const mockGetAccount = jest.fn(async (_id: string) => null as any);
 const mockSyncState = jest.fn(async () => {});
@@ -46,9 +60,12 @@ const mockGetMidenClient = jest.fn(async (_options?: any) => ({
   createMidenWallet: (...args: unknown[]) => mockCreateMidenWallet(...(args as [any, Uint8Array])),
   importPublicMidenWalletFromSeed: (...args: unknown[]) =>
     mockImportPublicMidenWalletFromSeed(...(args as [Uint8Array])),
-  // Mirror the production dispatch: for non-Guardian types, delegate to
-  // importPublicMidenWalletFromSeed so existing tests keep asserting on it.
+  // Non-Guardian: delegate to importPublicMidenWalletFromSeed so existing
+  // tests keep asserting on it.
   importAccountBySeed: async (_walletType: any, seed: Uint8Array) => mockImportPublicMidenWalletFromSeed(seed),
+  createGuardianMidenWallet: (...args: unknown[]) => mockCreateGuardianMidenWallet(...(args as [Uint8Array])),
+  importGuardianAccountBySeed: (...args: unknown[]) =>
+    mockImportGuardianAccountBySeed(...(args as [Uint8Array, any, any])),
   getAccounts: () => mockGetAccounts(),
   getAccount: (id: string) => mockGetAccount(id),
   syncState: () => mockSyncState(),
@@ -68,6 +85,8 @@ jest.mock('../sdk/miden-client', () => ({
 const mockMidenClient = {
   createMidenWallet: mockCreateMidenWallet,
   importPublicMidenWalletFromSeed: mockImportPublicMidenWalletFromSeed,
+  createGuardianMidenWallet: mockCreateGuardianMidenWallet,
+  importGuardianAccountBySeed: mockImportGuardianAccountBySeed,
   getAccounts: mockGetAccounts,
   getAccount: mockGetAccount,
   syncState: mockSyncState,
@@ -239,6 +258,14 @@ beforeEach(() => {
   (isDesktop as jest.Mock).mockReturnValue(false);
   (isMobile as jest.Mock).mockReturnValue(false);
   mockMidenClient.createMidenWallet.mockResolvedValue('acc-pub-key-1');
+  mockMidenClient.createGuardianMidenWallet.mockResolvedValue({
+    accountId: 'guardian-acc-1',
+    keys: GUARDIAN_KEYS_FIXTURE
+  });
+  mockMidenClient.importGuardianAccountBySeed.mockResolvedValue({
+    accountId: 'guardian-acc-imported',
+    keys: GUARDIAN_KEYS_FIXTURE
+  });
   mockMidenClient.getAccounts.mockResolvedValue([]);
   mockMidenClient.getAccount.mockResolvedValue(null);
   mockMidenClient.syncState.mockResolvedValue(undefined);
@@ -1047,20 +1074,20 @@ describe('Vault hardware branches', () => {
     await expect(vlt.createHDAccount('invalid' as any)).rejects.toThrow();
   });
 
-  it('Vault.spawn propagates importAccountBySeed failures for Guardian imports (no silent fallback)', async () => {
-    // The Guardian import path must NOT fall back to createMidenWallet — otherwise
+  it('Vault.spawn propagates importGuardianAccountBySeed failures (no silent fallback)', async () => {
+    // The Guardian import path must NOT fall back to createGuardianMidenWallet — otherwise
     // a silently-recreated account would leave the user with an empty balance
     // under their seed. The branch rethrows, wrapped as a PublicError by withError.
     (isDesktop as jest.Mock).mockReturnValue(false);
     (isMobile as jest.Mock).mockReturnValue(false);
-    mockMidenClient.importPublicMidenWalletFromSeed.mockRejectedValueOnce(new Error('guardian lookup failed'));
+    mockMidenClient.importGuardianAccountBySeed.mockRejectedValueOnce(new Error('guardian lookup failed'));
 
     await expect(Vault.spawn(WalletType.Guardian, 'pw-guardian-fail', VALID_MNEMONIC, true)).rejects.toThrow(
       PublicError
     );
 
-    // createMidenWallet must NOT be called as a fallback — Guardian rethrows.
-    expect(mockMidenClient.createMidenWallet).not.toHaveBeenCalledWith(WalletType.Guardian, expect.anything());
+    // createGuardianMidenWallet must NOT be called as a fallback — Guardian rethrows.
+    expect(mockMidenClient.createGuardianMidenWallet).not.toHaveBeenCalled();
   });
 
   it('createHDAccount supports WalletType.Guardian (derivation index 2)', async () => {
@@ -1068,8 +1095,11 @@ describe('Vault hardware branches', () => {
     (isMobile as jest.Mock).mockReturnValue(false);
     const vlt = await Vault.spawn(WalletType.OnChain, 'pw-guardian-test');
     // Guardian resolves to the third branch inside getMainDerivationPath (walletTypeIndex=2);
-    // createMidenWallet is stubbed to return a predictable account id.
-    mockMidenClient.createMidenWallet.mockResolvedValueOnce('guardian-acc-1');
+    // createGuardianMidenWallet is stubbed to return a predictable account id + keys.
+    mockMidenClient.createGuardianMidenWallet.mockResolvedValueOnce({
+      accountId: 'guardian-acc-1',
+      keys: GUARDIAN_KEYS_FIXTURE
+    });
     await expect(vlt.createHDAccount(WalletType.Guardian, 'Guardian 1')).resolves.toBeTruthy();
   });
 
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index d678da476..fb2949da6 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -30,6 +30,7 @@ import { WalletType } from 'screens/onboarding/types';
 
 import { compareAccountIds } from '../activity/utils';
 import { fetchFromStorage, putToStorage } from '../front/storage';
+import type { CreatedGuardianKeys } from '../guardian/account';
 import { getBech32AddressFromAccountId } from '../sdk/helpers';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 import { MidenClientCreateOptions } from '../sdk/miden-client-interface';
@@ -46,6 +47,7 @@ enum StorageEntity {
   MigrationLevel = 'migration',
   Mnemonic = 'mnemonic',
   AccAuthSecretKey = 'accauthsecretkey',
+  AccColdSecretKey = 'accouldsecretkey',
   AccAuthPubKey = 'accauthpubkey',
   AccPubKey = 'accpubkey',
   AccViewKey = 'accviewkey',
@@ -60,6 +62,9 @@ const checkStrgKey = createStorageKey(StorageEntity.Check);
 const mnemonicStrgKey = createStorageKey(StorageEntity.Mnemonic);
 const accPubKeyStrgKey = createDynamicStorageKey(StorageEntity.AccPubKey);
 const accAuthSecretKeyStrgKey = createDynamicStorageKey(StorageEntity.AccAuthSecretKey);
+// Mirror of cold-key blobs keyed by cold pubkey, separate from accAuthSecretKey
+// so role-aware signWord (Phase 3) can route hot vs cold by storage entity.
+const accColdSecretKeyStrgKey = createDynamicStorageKey(StorageEntity.AccColdSecretKey);
 const accAuthPubKeyStrgKey = createDynamicStorageKey(StorageEntity.AccAuthPubKey);
 const currentAccPubKeyStrgKey = createStorageKey(StorageEntity.CurrentAccPubKey);
 const accountsStrgKey = createStorageKey(StorageEntity.Accounts);
@@ -79,6 +84,27 @@ const insertKeyCallbackWrapper = (passKey: CryptoKey) => {
     );
   };
 };
+
+/**
+ * Persist the hot ciphertext + cold mirror produced by createGuardianAccount,
+ * wrapping each blob under the vault key. Cold is also already in the SDK
+ * keystore via the standard insertKeyCallback path; the mirror under
+ * accColdSecretKeyStrgKey lets role-aware signWord (Phase 3) route hot vs
+ * cold by storage entity without touching the WASM keystore.
+ *
+ * Storage keys use the unprefixed signer-commitment hex (matching the
+ * WalletSigner convention everywhere else in the codebase).
+ */
+async function persistGuardianKeys(vaultKey: CryptoKey, keys: CreatedGuardianKeys) {
+  await encryptAndSaveMany(
+    [
+      [accAuthPubKeyStrgKey(keys.hotPublicKey), keys.hotPublicKey],
+      [accAuthSecretKeyStrgKey(keys.hotPublicKey), keys.hotCiphertext],
+      [accColdSecretKeyStrgKey(keys.coldPublicKey), keys.coldSecretKeyHex]
+    ],
+    vaultKey
+  );
+}
 export class Vault {
   constructor(private vaultKey: CryptoKey) {}
 
@@ -286,40 +312,70 @@ export class Vault {
 
       // Wrap WASM client operations in a lock to prevent concurrent access
       console.log('[Vault.spawn] Step 5: acquiring WASM client lock...');
-      const accPublicKey = await withWasmClientLock(async () => {
-        console.log('[Vault.spawn] Step 6: getting miden client...');
-        const midenClient = await getMidenClient(options);
-        console.log('[Vault.spawn] Step 7: client ready, network:', midenClient.network, 'ownMnemonic:', ownMnemonic);
-        if (ownMnemonic && midenClient.network !== 'mock') {
-          try {
-            console.log('[Vault.spawn] Step 8a: importing wallet from seed...');
-            return await midenClient.importAccountBySeed(walletType, walletSeed, signWordFn, getPublicKeyForCommitment);
-          } catch (e) {
-            // Guardian imports must not silently fall back: a failure here means the guardian lookup
-            // failed, and creating a fresh local account would leave the user with the wrong
-            // balance under their seed. Propagate so the UI can let them fix the URL or switch
-            // to public-account import.
-            if (walletType === WalletType.Guardian) {
-              throw e;
+      const created = await withWasmClientLock(
+        async (): Promise<{
+          accountId: string;
+          guardianKeys?: CreatedGuardianKeys;
+        }> => {
+          console.log('[Vault.spawn] Step 6: getting miden client...');
+          const midenClient = await getMidenClient(options);
+          console.log('[Vault.spawn] Step 7: client ready, network:', midenClient.network, 'ownMnemonic:', ownMnemonic);
+
+          if (walletType === WalletType.Guardian) {
+            // Guardian: cold key derives from seed (HD-deterministic), hot is
+            // freshly generated via the secure-hot-key facade. Both branches
+            // surface the keys so vault can persist them under the vault envelope.
+            if (ownMnemonic && midenClient.network !== 'mock') {
+              console.log('[Vault.spawn] Step 8a: importing Guardian account from seed...');
+              const result = await midenClient.importGuardianAccountBySeed(
+                walletSeed,
+                signWordFn,
+                getPublicKeyForCommitment
+              );
+              return { accountId: result.accountId, guardianKeys: result.keys };
+            }
+            console.log('[Vault.spawn] Step 8b: syncing state then creating Guardian account...');
+            await midenClient.syncState();
+            const result = await midenClient.createGuardianMidenWallet(walletSeed);
+            return { accountId: result.accountId, guardianKeys: result.keys };
+          }
+
+          if (ownMnemonic && midenClient.network !== 'mock') {
+            try {
+              console.log('[Vault.spawn] Step 8a: importing wallet from seed...');
+              return {
+                accountId: await midenClient.importAccountBySeed(
+                  walletType,
+                  walletSeed,
+                  signWordFn,
+                  getPublicKeyForCommitment
+                )
+              };
+            } catch (e) {
+              console.error('Failed to import wallet from seed in spawn, creating new wallet instead', e);
+              return { accountId: await midenClient.createMidenWallet(walletType, walletSeed) };
             }
-            console.error('Failed to import wallet from seed in spawn, creating new wallet instead', e);
-            return await midenClient.createMidenWallet(walletType, walletSeed);
           }
-        } else {
           // Sync to chain tip BEFORE creating first account (no accounts = no tags = fast sync)
           console.log('[Vault.spawn] Step 8b: syncing state...');
           await midenClient.syncState();
           console.log('[Vault.spawn] Step 9: creating miden wallet...');
-          return await midenClient.createMidenWallet(walletType, walletSeed);
+          return { accountId: await midenClient.createMidenWallet(walletType, walletSeed) };
         }
-      });
+      );
+
+      const accPublicKey = created.accountId;
 
       const initialAccount: WalletAccount = {
         publicKey: accPublicKey,
         name: 'Miden Account 1',
         isPublic: false,
         type: walletType,
-        hdIndex: hdAccIndex
+        hdIndex: hdAccIndex,
+        ...(created.guardianKeys && {
+          hotPublicKey: created.guardianKeys.hotPublicKey,
+          coldPublicKey: created.guardianKeys.coldPublicKey
+        })
       };
       const newAccounts = [initialAccount];
 
@@ -332,6 +388,9 @@ export class Vault {
         ],
         vaultKey
       );
+      if (created.guardianKeys) {
+        await persistGuardianKeys(vaultKey, created.guardianKeys);
+      }
       await savePlain(currentAccPubKeyStrgKey, accPublicKey);
       await savePlain(ownMnemonicStrgKey, ownMnemonic ?? false);
 
@@ -479,25 +538,37 @@ export class Vault {
       console.log('[Vault.createHDAccount] Step 5: seed derived, acquiring WASM lock');
 
       // Wrap WASM client operations in a lock to prevent concurrent access
-      const walletId = await withWasmClientLock(async () => {
-        console.log('[Vault.createHDAccount] Step 6: WASM lock acquired, getting client');
-        const midenClient = await getMidenClient(options);
-        console.log('[Vault.createHDAccount] Step 7: client ready, network =', midenClient.network);
-        if (isOwnMnemonic && walletType === WalletType.OnChain) {
-          try {
-            console.log('[Vault.createHDAccount] Step 8a: importPublicMidenWalletFromSeed');
-            return await midenClient.importPublicMidenWalletFromSeed(walletSeed);
-          } catch (e) {
-            console.warn('Failed to import wallet from seed, creating new wallet instead', e);
-            return await midenClient.createMidenWallet(walletType, walletSeed);
+      const created = await withWasmClientLock(
+        async (): Promise<{
+          accountId: string;
+          guardianKeys?: CreatedGuardianKeys;
+        }> => {
+          console.log('[Vault.createHDAccount] Step 6: WASM lock acquired, getting client');
+          const midenClient = await getMidenClient(options);
+          console.log('[Vault.createHDAccount] Step 7: client ready, network =', midenClient.network);
+
+          if (walletType === WalletType.Guardian) {
+            console.log('[Vault.createHDAccount] Step 8: createGuardianMidenWallet');
+            const result = await midenClient.createGuardianMidenWallet(walletSeed);
+            return { accountId: result.accountId, guardianKeys: result.keys };
+          }
+
+          if (isOwnMnemonic && walletType === WalletType.OnChain) {
+            try {
+              console.log('[Vault.createHDAccount] Step 8a: importPublicMidenWalletFromSeed');
+              return { accountId: await midenClient.importPublicMidenWalletFromSeed(walletSeed) };
+            } catch (e) {
+              console.warn('Failed to import wallet from seed, creating new wallet instead', e);
+              return { accountId: await midenClient.createMidenWallet(walletType, walletSeed) };
+            }
           }
-        } else {
           console.log('[Vault.createHDAccount] Step 8b: createMidenWallet');
           const id = await midenClient.createMidenWallet(walletType, walletSeed);
           console.log('[Vault.createHDAccount] Step 9: createMidenWallet returned', id);
-          return id;
+          return { accountId: id };
         }
-      });
+      );
+      const walletId = created.accountId;
       console.log('[Vault.createHDAccount] Step 10: walletId =', walletId);
 
       const accName = name || getNewAccountName(allAccounts);
@@ -507,7 +578,11 @@ export class Vault {
         name: accName,
         publicKey: walletId,
         isPublic: walletType === WalletType.OnChain,
-        hdIndex: hdAccIndex
+        hdIndex: hdAccIndex,
+        ...(created.guardianKeys && {
+          hotPublicKey: created.guardianKeys.hotPublicKey,
+          coldPublicKey: created.guardianKeys.coldPublicKey
+        })
       };
 
       const newAllAcounts = concatAccount(allAccounts, newAccount);
@@ -520,6 +595,9 @@ export class Vault {
         ],
         this.vaultKey
       );
+      if (created.guardianKeys) {
+        await persistGuardianKeys(this.vaultKey, created.guardianKeys);
+      }
 
       return newAllAcounts;
     });
diff --git a/src/lib/miden/guardian/account.test.ts b/src/lib/miden/guardian/account.test.ts
index c489167a8..51fb78cb6 100644
--- a/src/lib/miden/guardian/account.test.ts
+++ b/src/lib/miden/guardian/account.test.ts
@@ -1,7 +1,8 @@
 /**
  * guardian/account — getSignerDetailsFromAccount reads the first signer
  * commitment out of the multisig storage slot; createGuardianAccount drives
- * MultisigClient.create + guardian registration + keystore insertion.
+ * MultisigClient.create + guardian registration + keystore insertion for
+ * the 3-key (hot + cold + guardian) layout.
  *
  * All external collaborators are stubbed; we don't exec any real WASM.
  */
@@ -21,23 +22,52 @@ jest.mock('lib/settings/constants', () => ({
   GUARDIAN_URL_STORAGE_KEY: 'guardian_url_setting'
 }));
 
-// AuthSecretKey.ecdsaWithRNG + commitment calls need a predictable stub.
-const mockAuthSecretKeyEcdsa = jest.fn();
+// AuthSecretKey.ecdsaWithRNG returns a deterministic stub keyed by the seed
+// so we can distinguish hot vs cold material. Each call mints a new "key"
+// object whose serialize/publicKey/etc are jest mocks the assertions can read.
+type StubKey = {
+  serialize: jest.Mock;
+  publicKey: jest.Mock;
+  __seedTag: string;
+};
+const stubKeyByTag: Record<string, StubKey> = {};
+const buildStubKey = (tag: string): StubKey => {
+  const key: StubKey = {
+    __seedTag: tag,
+    serialize: jest.fn(() => new Uint8Array([0xaa, ...Buffer.from(tag, 'utf-8')])),
+    publicKey: jest.fn(() => ({
+      serialize: jest.fn(() => new Uint8Array([0x01, ...Buffer.from(`pub-${tag}`, 'utf-8')])),
+      toCommitment: jest.fn(() => ({ toHex: () => `0xcommit-${tag}` }))
+    }))
+  };
+  stubKeyByTag[tag] = key;
+  return key;
+};
 jest.mock('@miden-sdk/miden-sdk/lazy', () => {
   const actual = jest.requireActual('../../../../__mocks__/wasmMock.js');
   return {
     ...actual,
-    AuthSecretKey: { ecdsaWithRNG: (seed: unknown) => mockAuthSecretKeyEcdsa(seed) }
+    AuthSecretKey: {
+      ecdsaWithRNG: jest.fn((seed: Uint8Array) => buildStubKey(`s${Array.from(seed).join('-')}`))
+    }
   };
 });
 jest.mock('@miden-sdk/miden-sdk', () => {
   const actual = jest.requireActual('../../../../__mocks__/wasmMock.js');
   return {
     ...actual,
-    AuthSecretKey: { ecdsaWithRNG: (seed: unknown) => mockAuthSecretKeyEcdsa(seed) }
+    AuthSecretKey: {
+      ecdsaWithRNG: jest.fn((seed: Uint8Array) => buildStubKey(`s${Array.from(seed).join('-')}`))
+    }
   };
 });
 
+// secure-hot-key facade — generateHotKey is the only entry createGuardianAccount uses.
+const mockGenerateHotKey = jest.fn();
+jest.mock('lib/secure-hot-key', () => ({
+  generateHotKey: (...a: unknown[]) => mockGenerateHotKey(...a)
+}));
+
 // Guardian SDK stubs — keep per-test knobs for getPubkey + client.create.
 const multisigClientConfig: {
   create: jest.Mock;
@@ -46,6 +76,7 @@ const multisigClientConfig: {
   create: jest.fn(),
   getPubkey: jest.fn()
 };
+const ecdsaSignerCtor = jest.fn();
 
 jest.mock('@openzeppelin/miden-multisig-client', () => ({
   MultisigClient: jest.fn().mockImplementation(() => ({
@@ -54,7 +85,10 @@ jest.mock('@openzeppelin/miden-multisig-client', () => ({
       getPubkey: (...a: unknown[]) => multisigClientConfig.getPubkey(...a)
     }
   })),
-  EcdsaSigner: jest.fn().mockImplementation((sk: unknown) => ({ sk }))
+  EcdsaSigner: jest.fn().mockImplementation((sk: unknown) => {
+    ecdsaSignerCtor(sk);
+    return { sk };
+  })
 }));
 
 describe('getSignerDetailsFromAccount', () => {
@@ -123,26 +157,30 @@ describe('createGuardianAccount', () => {
 
   beforeEach(() => {
     jest.clearAllMocks();
-    mockAuthSecretKeyEcdsa.mockReturnValue({
-      publicKey: () => ({ toCommitment: () => ({ toHex: () => '0xsigner-commit' }) })
-    });
     multisigClientConfig.getPubkey.mockResolvedValue({ commitment: 'g-commit', pubkey: 'g-pubkey' });
     mockFetchFromStorage.mockResolvedValue(undefined);
+    mockGenerateHotKey.mockResolvedValue({
+      ciphertext: 'hot-ciphertext-hex',
+      publicKeyHex: 'hot-pubkey-hex',
+      commitmentHex: '0xhot-commit'
+    });
   });
 
-  it('creates a 1-of-1 multisig, registers with the guardian, syncs, and persists the signer key', async () => {
+  it('creates a 2-of-N multisig with [hot, cold] commitments, registers, syncs, persists cold to keystore', async () => {
     const webClient = makeWebClient();
     const multisig = makeMultisig();
     multisigClientConfig.create.mockResolvedValueOnce(multisig);
 
     const seed = new Uint8Array([1, 2, 3, 4]);
-    const account = await createGuardianAccount(webClient as never, seed);
+    const result = await createGuardianAccount(webClient as never, seed);
 
-    expect(mockAuthSecretKeyEcdsa).toHaveBeenCalledWith(seed);
+    // Hot is generated via the secure-hot-key facade; cold is HD-derived from seed.
+    expect(mockGenerateHotKey).toHaveBeenCalledTimes(1);
     expect(multisigClientConfig.create).toHaveBeenCalledWith(
       expect.objectContaining({
         threshold: 1,
-        signerCommitments: ['0xsigner-commit'],
+        // Hot first, cold second — order is load-bearing for downstream role routing.
+        signerCommitments: ['0xhot-commit', '0xcommit-s1-2-3-4'],
         guardianCommitment: 'g-commit',
         guardianPublicKey: 'g-pubkey',
         guardianEnabled: true,
@@ -152,10 +190,22 @@ describe('createGuardianAccount', () => {
       }),
       expect.anything()
     );
+    // The deploy proposal is signed by cold (we hand the cold AuthSecretKey to EcdsaSigner).
+    expect(ecdsaSignerCtor).toHaveBeenCalledWith(stubKeyByTag['s1-2-3-4']);
     expect(multisig.registerOnGuardian).toHaveBeenCalled();
     expect(webClient.sync).toHaveBeenCalled();
-    expect(webClient.keystore.insert).toHaveBeenCalled();
-    expect(account).toBe(multisig.account);
+    // Only the cold key is inserted into the SDK keystore — hot lives outside.
+    expect(webClient.keystore.insert).toHaveBeenCalledTimes(1);
+    expect(webClient.keystore.insert).toHaveBeenCalledWith(expect.anything(), stubKeyByTag['s1-2-3-4']);
+
+    // The rich return shape exposes everything vault.ts needs to persist.
+    expect(result.account).toBe(multisig.account);
+    expect(result.keys).toEqual({
+      hotPublicKey: 'hot-pubkey-hex',
+      coldPublicKey: expect.any(String),
+      hotCiphertext: 'hot-ciphertext-hex',
+      coldSecretKeyHex: expect.any(String)
+    });
   });
 
   it('generates a random seed when none is provided', async () => {
@@ -164,8 +214,9 @@ describe('createGuardianAccount', () => {
 
     await createGuardianAccount(webClient as never);
 
-    // ecdsaWithRNG was still called with a 32-byte Uint8Array.
-    const seedArg = mockAuthSecretKeyEcdsa.mock.calls[0]?.[0];
+    // ecdsaWithRNG was still called with a 32-byte Uint8Array (cold-seed fallback).
+    const ecdsaCall = jest.requireMock('@miden-sdk/miden-sdk/lazy').AuthSecretKey.ecdsaWithRNG;
+    const seedArg = ecdsaCall.mock.calls[0]?.[0];
     expect(seedArg).toBeInstanceOf(Uint8Array);
     expect((seedArg as Uint8Array).length).toBe(32);
   });
diff --git a/src/lib/miden/guardian/account.ts b/src/lib/miden/guardian/account.ts
index 77cf237c6..637a8155d 100644
--- a/src/lib/miden/guardian/account.ts
+++ b/src/lib/miden/guardian/account.ts
@@ -1,7 +1,9 @@
 import { Account, AuthSecretKey, MidenClient } from '@miden-sdk/miden-sdk/lazy';
 import { EcdsaSigner, MultisigClient } from '@openzeppelin/miden-multisig-client';
+import { Buffer } from 'buffer';
 
 import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
+import * as secureHotKey from 'lib/secure-hot-key';
 import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
 
 import { fetchFromStorage } from '../front/storage';
@@ -14,6 +16,24 @@ export const MULTISIG_SLOT_NAMES = {
   PROCEDURE_THRESHOLDS: 'openzeppelin::multisig::procedure_thresholds'
 } as const;
 
+/**
+ * Material the wallet must persist after a Guardian account is created.
+ * Hot is held outside the SDK keystore (secure-hot-key facade); cold lives
+ * inside the SDK keystore *and* is mirrored to a separate vault entry so
+ * role-aware signWord (Phase 3) can route by storage entity.
+ */
+export interface CreatedGuardianKeys {
+  hotPublicKey: string; // serialize().slice(1) hex
+  coldPublicKey: string; // serialize().slice(1) hex
+  hotCiphertext: string; // opaque blob from the secure-hot-key facade
+  coldSecretKeyHex: string; // serialized AuthSecretKey hex (for cold-mirror storage)
+}
+
+export interface CreatedGuardianAccount {
+  account: Account;
+  keys: CreatedGuardianKeys;
+}
+
 /**
  * Extract signer commitment and public key from a Guardian account's storage.
  */
@@ -40,35 +60,48 @@ export async function getSignerDetailsFromAccount(
 }
 
 /**
- * Create a Guardian (Private State Manager) account using the MultisigClient.
- *
- * This creates a 1-of-1 multisig account with Guardian signature verification enabled.
- * The account is registered with the Guardian backend and the secret key is stored locally.
+ * Create a 3-key Guardian account: a random hot ECDSA key (held outside the
+ * WASM keystore, behind the secure-hot-key facade), an HD-derived cold ECDSA
+ * key (held inside the keystore, used for rotation/recovery), and the external
+ * guardian co-signer. Default threshold 1 — hot OR cold + guardian satisfies
+ * routine operations; cold-only routing for rotation procedures is enforced
+ * client-side (see Phase 0 in the migration plan).
  *
- * @param webClient - The Miden WebClient instance
- * @param seed - Optional seed for key derivation (random if not provided)
- * @param skipRegistration - Skip guardian registration (used by the import path)
- * @param guardianEndpointOverride - Force a specific guardian URL for pubkey derivation.
- *   Account ID is a content hash that includes the guardian pubkey baked into storage,
- *   so the import flow passes `DEFAULT_GUARDIAN_ENDPOINT` to reproduce the ID the account
- *   originally had; the user's custom URL is used by `importAccountFromGuardian` for the
- *   live state fetch only.
- * @returns The created Account
+ * @param webClient - The Miden WebClient instance.
+ * @param coldSeed - HD-derived seed for the cold key. Random if absent (only
+ *   appropriate for tests / non-recoverable flows).
+ * @param skipRegistration - Skip guardian registration (used by the import path).
+ * @param guardianEndpointOverride - Force a specific guardian URL for pubkey
+ *   derivation. Account ID is a content hash that includes the guardian pubkey
+ *   baked into storage, so the import flow passes `DEFAULT_GUARDIAN_ENDPOINT`
+ *   to reproduce the ID the account originally had.
  */
 export async function createGuardianAccount(
   webClient: MidenClient,
-  seed?: Uint8Array,
+  coldSeed?: Uint8Array,
   skipRegistration: boolean = false,
   guardianEndpointOverride?: string
-): Promise<Account> {
-  if (!seed) {
-    seed = crypto.getRandomValues(new Uint8Array(32));
+): Promise<CreatedGuardianAccount> {
+  if (!coldSeed) {
+    coldSeed = crypto.getRandomValues(new Uint8Array(32));
   }
 
   try {
-    // Generate the signer secret key from seed
-    const sk = AuthSecretKey.ecdsaWithRNG(seed);
-    const signerCommitment = sk.publicKey().toCommitment();
+    // Cold key — HD-derived, lives in SDK keystore, used for cold-routed flows
+    // (rotation, recovery). EcdsaSigner gets the cold AuthSecretKey directly so
+    // the create-time deploy proposal is signed by cold; the on-chain account
+    // therefore binds to the cold commitment via the deploy signature in
+    // addition to the storage-slot binding.
+    const coldSk = AuthSecretKey.ecdsaWithRNG(coldSeed);
+    const coldPublicKeyObj = coldSk.publicKey();
+    const coldCommitmentHex = coldPublicKeyObj.toCommitment().toHex();
+    const coldPublicKey = Buffer.from(coldPublicKeyObj.serialize().slice(1)).toString('hex');
+    const coldSecretKeyHex = Buffer.from(coldSk.serialize()).toString('hex');
+
+    // Hot key — random, held outside the SDK keystore. On extension/desktop
+    // this is the JS fallback (serialized AuthSecretKey hex); on mobile this
+    // will be ECIES-wrapped under SE/StrongBox once Phase 4 lands.
+    const hot = await secureHotKey.generateHotKey();
 
     // Get Guardian endpoint and initialize client
     const guardianEndpoint =
@@ -76,35 +109,49 @@ export async function createGuardianAccount(
       (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) ??
       DEFAULT_GUARDIAN_ENDPOINT;
     console.log('Using Guardian endpoint:', guardianEndpoint);
+
     const client = new MultisigClient(webClient, { guardianEndpoint });
-    const { commitment, pubkey } = await client.guardianClient.getPubkey();
-    // Create the multisig account using the package utility
+    const { commitment: guardianCommitment, pubkey: guardianPubkey } = await client.guardianClient.getPubkey();
+
+    // Signer order is [hot, cold] by convention — the migration plan diagrams
+    // and downstream role-routing code assume this layout.
     const multisig = await client.create(
       {
         threshold: 1,
-        signerCommitments: [signerCommitment.toHex()],
-        guardianCommitment: commitment,
-        guardianPublicKey: pubkey,
+        signerCommitments: [hot.commitmentHex, coldCommitmentHex],
+        guardianCommitment,
+        guardianPublicKey: guardianPubkey,
         guardianEnabled: true,
         storageMode: 'private',
         signatureScheme: 'ecdsa',
-        seed
+        seed: coldSeed
       },
-      new EcdsaSigner(sk)
+      new EcdsaSigner(coldSk)
     );
 
     if (!skipRegistration) {
       await multisig.registerOnGuardian();
     }
-    // Sync state with the node
     await webClient.sync();
 
-    // Store the secret key in WebStore for signing
-    await webClient.keystore.insert(multisig.account.id(), sk);
+    // Cold goes through the standard SDK keystore so the WASM client can sign
+    // with it on demand; the existing insertKeyCallback wraps it under the
+    // vault key and stores it at accAuthSecretKeyStrgKey(coldPublicKey).
+    // Hot is intentionally NOT inserted here — vault.ts persists the
+    // returned hot ciphertext separately under its own envelope.
+    await webClient.keystore.insert(multisig.account.id(), coldSk);
 
     console.log('Guardian account created:', multisig.account.id().toString());
 
-    return multisig.account;
+    return {
+      account: multisig.account,
+      keys: {
+        hotPublicKey: hot.publicKeyHex,
+        coldPublicKey,
+        hotCiphertext: hot.ciphertext,
+        coldSecretKeyHex
+      }
+    };
   } catch (e) {
     console.log(e);
     console.error('Error creating Guardian account:', e);
diff --git a/src/lib/miden/sdk/miden-client-interface.test.ts b/src/lib/miden/sdk/miden-client-interface.test.ts
index 9fa488f37..b6a6796d9 100644
--- a/src/lib/miden/sdk/miden-client-interface.test.ts
+++ b/src/lib/miden/sdk/miden-client-interface.test.ts
@@ -460,10 +460,42 @@ describe('MidenClientInterface', () => {
       );
     });
 
-    it('createMidenWallet routes a Guardian wallet type to createGuardianAccount', async () => {
+    it('createMidenWallet rejects Guardian wallet types — callers must use createGuardianMidenWallet', async () => {
+      // The 3-key migration moved Guardian creation to a dedicated entry point
+      // that returns the hot/cold key material the vault has to persist; the
+      // string-returning createMidenWallet path is fenced off so accidental
+      // reuse fails loudly.
       const fakeMidenClient = buildFakeMidenClient();
+
+      jest.doMock('./helpers', () => ({
+        getBech32AddressFromAccountId: (id: any) => (typeof id === 'function' ? id().toString() : String(id))
+      }));
+      jest.doMock('screens/onboarding/types', () => ({
+        WalletType: { OnChain: 'on-chain', OffChain: 'off-chain', Guardian: 'guardian' }
+      }));
+      jest.doMock('lib/miden/activity/connectivity-issues', () => ({
+        addConnectivityIssue: jest.fn()
+      }));
+
+      const { MidenClientInterface } = await import('./miden-client-interface');
+      const client = MidenClientInterface.fromClient(fakeMidenClient as any, 'testnet');
+
+      await expect(client.createMidenWallet('guardian' as any, new Uint8Array([9]))).rejects.toThrow(
+        'Guardian wallets must be created via createGuardianMidenWallet'
+      );
+    });
+
+    it('createGuardianMidenWallet returns accountId + hot/cold key material', async () => {
+      const fakeMidenClient = buildFakeMidenClient();
+      const keys = {
+        hotPublicKey: 'hot-pub',
+        coldPublicKey: 'cold-pub',
+        hotCiphertext: 'hot-ct',
+        coldSecretKeyHex: 'cold-sk'
+      };
       const createGuardianAccount = jest.fn(async () => ({
-        id: () => ({ toString: () => 'guardian-id' })
+        account: { id: () => ({ toString: () => 'guardian-id' }) },
+        keys
       }));
 
       jest.doMock('./helpers', () => ({
@@ -483,10 +515,10 @@ describe('MidenClientInterface', () => {
       const { MidenClientInterface } = await import('./miden-client-interface');
       const client = MidenClientInterface.fromClient(fakeMidenClient as any, 'testnet');
 
-      const result = await client.createMidenWallet('guardian' as any, new Uint8Array([9]));
+      const result = await client.createGuardianMidenWallet(new Uint8Array([9]));
 
       expect(createGuardianAccount).toHaveBeenCalledWith(fakeMidenClient, expect.any(Uint8Array));
-      expect(result).toBe('guardian-id');
+      expect(result).toEqual({ accountId: 'guardian-id', keys });
     });
 
     it('getInputNote delegates to client.notes.get and returns its result', async () => {
@@ -536,10 +568,43 @@ describe('MidenClientInterface', () => {
       expect(fakeMidenClient.accounts.import).toHaveBeenCalledWith({ seed: expect.any(Uint8Array) });
     });
 
-    it('Guardian path: creates the account locally and re-hydrates state from the guardian', async () => {
+    it('importAccountBySeed rejects Guardian wallet types — callers must use importGuardianAccountBySeed', async () => {
       const fakeMidenClient = buildFakeMidenClient();
+
+      jest.doMock('./helpers', () => ({
+        getBech32AddressFromAccountId: (id: any) => String(id)
+      }));
+      jest.doMock('screens/onboarding/types', () => ({
+        WalletType: { OnChain: 'on-chain', OffChain: 'off-chain', Guardian: 'guardian' }
+      }));
+      jest.doMock('lib/miden/activity/connectivity-issues', () => ({
+        addConnectivityIssue: jest.fn()
+      }));
+
+      const { MidenClientInterface } = await import('./miden-client-interface');
+      const client = MidenClientInterface.fromClient(fakeMidenClient as any, 'testnet');
+
+      await expect(
+        client.importAccountBySeed(
+          'guardian' as any,
+          new Uint8Array([1]),
+          jest.fn(async () => '0xsig'),
+          jest.fn(async () => 'pk')
+        )
+      ).rejects.toThrow('Guardian wallets must be imported via importGuardianAccountBySeed');
+    });
+
+    it('importGuardianAccountBySeed creates the account locally and re-hydrates state from the guardian', async () => {
+      const fakeMidenClient = buildFakeMidenClient();
+      const keys = {
+        hotPublicKey: 'hot-pub',
+        coldPublicKey: 'cold-pub',
+        hotCiphertext: 'hot-ct',
+        coldSecretKeyHex: 'cold-sk'
+      };
       const createGuardianAccount = jest.fn(async () => ({
-        id: () => ({ toString: () => 'guardian-acc-id' })
+        account: { id: () => ({ toString: () => 'guardian-acc-id' }) },
+        keys
       }));
       const getSignerDetailsFromAccount = jest.fn(async () => ({ commitment: 'abc', publicKey: 'def' }));
       const importAccountFromGuardian = jest.fn(async () => {});
@@ -569,8 +634,7 @@ describe('MidenClientInterface', () => {
 
       const signWordFn = jest.fn(async () => '0xsig');
       const getPublicKeyForCommitment = jest.fn(async () => 'pk');
-      const result = await client.importAccountBySeed(
-        'guardian' as any,
+      const result = await client.importGuardianAccountBySeed(
         new Uint8Array([1, 2, 3, 4]),
         signWordFn,
         getPublicKeyForCommitment
@@ -590,10 +654,10 @@ describe('MidenClientInterface', () => {
         'guardian-acc-id',
         fakeMidenClient
       );
-      expect(result).toBe('guardian-acc-id');
+      expect(result).toEqual({ accountId: 'guardian-acc-id', keys });
     });
 
-    it('Guardian path: wraps underlying errors in a "Failed to import Guardian account from seed" message', async () => {
+    it('importGuardianAccountBySeed: wraps underlying errors in a "Failed to import Guardian account from seed" message', async () => {
       const fakeMidenClient = buildFakeMidenClient();
 
       jest.doMock('./helpers', () => ({
@@ -622,8 +686,7 @@ describe('MidenClientInterface', () => {
       const client = MidenClientInterface.fromClient(fakeMidenClient as any, 'testnet');
 
       await expect(
-        client.importAccountBySeed(
-          'guardian' as any,
+        client.importGuardianAccountBySeed(
           new Uint8Array([1]),
           jest.fn(async () => '0xsig'),
           jest.fn(async () => 'pk')
diff --git a/src/lib/miden/sdk/miden-client-interface.ts b/src/lib/miden/sdk/miden-client-interface.ts
index 0624d3032..7b1173ba3 100644
--- a/src/lib/miden/sdk/miden-client-interface.ts
+++ b/src/lib/miden/sdk/miden-client-interface.ts
@@ -34,8 +34,14 @@ import { ConsumeTransaction, SendTransaction } from '../db/types';
 // a module init cycle: miden-client-interface → guardian/index → sdk/miden-client →
 // miden-client-interface. Static imports here deadlock init_guardian_manager in the
 // SW bundle (both sides' __esmMin wrappers await each other).
+import type { CreatedGuardianKeys } from '../guardian/account';
 import type { SignWordFunction } from '../guardian/signer';
 
+export interface GuardianAccountCreationResult {
+  accountId: string;
+  keys: CreatedGuardianKeys;
+}
+
 export type MidenClientCreateOptions = {
   seed?: Uint8Array;
   insertKeyCallback?: (key: Uint8Array, secretKey: Uint8Array) => void;
@@ -105,9 +111,11 @@ export class MidenClientInterface {
 
   async createMidenWallet(walletType: WalletType, seed?: Uint8Array): Promise<string> {
     if (walletType === WalletType.Guardian) {
-      const { createGuardianAccount } = await import('../guardian/account');
-      const account = await createGuardianAccount(this.client, seed);
-      return getBech32AddressFromAccountId(account.id());
+      // Guardian creation needs to surface the hot/cold keys produced inside
+      // createGuardianAccount so the vault can persist them. Callers must use
+      // createGuardianMidenWallet directly — this branch protects against the
+      // older string-returning API being relied on.
+      throw new Error('Guardian wallets must be created via createGuardianMidenWallet');
     }
 
     const isPublic = walletType === WalletType.OnChain;
@@ -118,6 +126,17 @@ export class MidenClientInterface {
     return getBech32AddressFromAccountId(wallet.id());
   }
 
+  /**
+   * Create a 3-key Guardian account. Returns the account ID alongside the hot
+   * ciphertext + cold secret-key bytes the wallet must persist (vault wraps
+   * both before writing them to storage).
+   */
+  async createGuardianMidenWallet(coldSeed?: Uint8Array): Promise<GuardianAccountCreationResult> {
+    const { createGuardianAccount } = await import('../guardian/account');
+    const { account, keys } = await createGuardianAccount(this.client, coldSeed);
+    return { accountId: getBech32AddressFromAccountId(account.id()), keys };
+  }
+
   async importMidenWallet(accountBytes: Uint8Array): Promise<string> {
     const accountFile = AccountFile.deserialize(accountBytes);
     const wallet: Account = await this.client.accounts.import({ file: accountFile });
@@ -132,46 +151,68 @@ export class MidenClientInterface {
   async importAccountBySeed(
     walletType: WalletType,
     seed: Uint8Array,
-    signWordFn: SignWordFunction,
-    getPublicKeyForCommitment: (commitment: string) => Promise<string>
+    _signWordFn: SignWordFunction,
+    _getPublicKeyForCommitment: (commitment: string) => Promise<string>
   ): Promise<string> {
     if (walletType === WalletType.Guardian) {
-      console.log('Importing Guardian account from seed', seed);
-      try {
-        const [
-          { createGuardianAccount, getSignerDetailsFromAccount },
-          { MultisigService },
-          { DEFAULT_GUARDIAN_ENDPOINT }
-        ] = await Promise.all([
-          import('../guardian/account'),
-          import('../guardian/index'),
-          import('lib/miden-chain/constants')
-        ]);
-        // Derive the account ID against the default guardian so it matches the ID
-        // the account had at creation time. The user's custom guardian URL (persisted
-        // in GUARDIAN_URL_STORAGE_KEY) is picked up later by importAccountFromGuardian for the
-        // live state fetch.
-        const account = await createGuardianAccount(this.client, seed, true, DEFAULT_GUARDIAN_ENDPOINT);
-        console.log('[MidenClientInterface] Imported Guardian account from seed with ID:', account.id().toString());
-        const accountId = account.id().toString();
-        const { commitment, publicKey } = await getSignerDetailsFromAccount(account, getPublicKeyForCommitment);
-        await MultisigService.importAccountFromGuardian(
-          `0x${publicKey}`,
-          `0x${commitment}`,
-          signWordFn,
-          accountId,
-          this.client
-        );
-        return getBech32AddressFromAccountId(account.id());
-      } catch (error) {
-        console.log(error);
-        throw new Error('Failed to import Guardian account from seed');
-      }
+      // Guardian import surfaces the hot/cold keys in addition to the account
+      // ID. Use importGuardianAccountBySeed.
+      throw new Error('Guardian wallets must be imported via importGuardianAccountBySeed');
     }
 
     return await this.importPublicMidenWalletFromSeed(seed);
   }
 
+  /**
+   * Import a Guardian account by seed.
+   *
+   * Caveat (3-key migration): the cold key is fully recoverable from the
+   * mnemonic, but the hot key is random and cannot be reconstructed. This
+   * method generates a fresh hot key, which means the locally-derived
+   * account ID won't match the one the user originally created — recovery
+   * after import requires a `replace_signer` proposal signed by cold +
+   * guardian to re-bind the new hot pubkey on-chain. Phase 8 of the
+   * migration plan covers that flow; until it lands, importing a Guardian
+   * account leaves the user with an empty fresh account under their seed.
+   */
+  async importGuardianAccountBySeed(
+    coldSeed: Uint8Array,
+    signWordFn: SignWordFunction,
+    getPublicKeyForCommitment: (commitment: string) => Promise<string>
+  ): Promise<GuardianAccountCreationResult> {
+    console.log('Importing Guardian account from seed', coldSeed);
+    try {
+      const [
+        { createGuardianAccount, getSignerDetailsFromAccount },
+        { MultisigService },
+        { DEFAULT_GUARDIAN_ENDPOINT }
+      ] = await Promise.all([
+        import('../guardian/account'),
+        import('../guardian/index'),
+        import('lib/miden-chain/constants')
+      ]);
+      // Derive the account ID against the default guardian so it matches the ID
+      // the account had at creation time. The user's custom guardian URL
+      // (persisted in GUARDIAN_URL_STORAGE_KEY) is picked up later by
+      // importAccountFromGuardian for the live state fetch.
+      const { account, keys } = await createGuardianAccount(this.client, coldSeed, true, DEFAULT_GUARDIAN_ENDPOINT);
+      const accountIdStr = account.id().toString();
+      console.log('[MidenClientInterface] Imported Guardian account from seed with ID:', accountIdStr);
+      const { commitment, publicKey } = await getSignerDetailsFromAccount(account, getPublicKeyForCommitment);
+      await MultisigService.importAccountFromGuardian(
+        `0x${publicKey}`,
+        `0x${commitment}`,
+        signWordFn,
+        accountIdStr,
+        this.client
+      );
+      return { accountId: getBech32AddressFromAccountId(account.id()), keys };
+    } catch (error) {
+      console.log(error);
+      throw new Error('Failed to import Guardian account from seed');
+    }
+  }
+
   async importNoteBytes(noteBytes: Uint8Array) {
     const noteFile = NoteFile.deserialize(noteBytes);
     return await this.client.notes.import(noteFile);
diff --git a/src/lib/secure-hot-key/index.ts b/src/lib/secure-hot-key/index.ts
new file mode 100644
index 000000000..923c5e281
--- /dev/null
+++ b/src/lib/secure-hot-key/index.ts
@@ -0,0 +1,36 @@
+/**
+ * Platform-abstraction facade for the Guardian "hot" signing key.
+ *
+ * Hot keys live outside the WASM keystore. On mobile (Phase 4) they will be
+ * ECIES-wrapped under a per-account P-256 key in Secure Enclave / StrongBox
+ * and unwrapped only inside a native plugin during a biometric prompt. On
+ * extension and desktop (Phase 5) the JS fallback serializes an
+ * `AuthSecretKey.ecdsaWithRNG(...)` blob and relies on the surrounding vault
+ * envelope for at-rest protection.
+ *
+ * Callers should never need to know which path executed: all three operations
+ * take/return strings.
+ */
+
+import { isMobile } from 'lib/platform';
+
+import * as jsFallback from './jsFallback';
+import * as nativePlugin from './nativePlugin';
+
+export type { GeneratedHotKey } from './jsFallback';
+
+function impl() {
+  return isMobile() ? nativePlugin : jsFallback;
+}
+
+export async function generateHotKey() {
+  return impl().generateHotKey();
+}
+
+export async function signHotDigest(ciphertext: string, wordHex: string): Promise<string> {
+  return impl().signHotDigest(ciphertext, wordHex);
+}
+
+export async function deleteHotKey(ciphertext: string): Promise<void> {
+  return impl().deleteHotKey(ciphertext);
+}
diff --git a/src/lib/secure-hot-key/jsFallback.ts b/src/lib/secure-hot-key/jsFallback.ts
new file mode 100644
index 000000000..d8a2d2f2a
--- /dev/null
+++ b/src/lib/secure-hot-key/jsFallback.ts
@@ -0,0 +1,46 @@
+/**
+ * JS fallback for the secure-hot-key facade. Used by extension and desktop
+ * (Tauri reuses this for now; desktop SE work deferred per Phase 4 scope).
+ *
+ * In this fallback the "ciphertext" is the serialized AuthSecretKey blob —
+ * the per-key wrap that mobile gets via Secure Enclave / StrongBox is replaced
+ * by the vault-key envelope the caller applies on top before persisting. This
+ * means hot-key isolation on extension is only as strong as the vault password
+ * (acknowledged in the migration plan, Risks §6).
+ */
+
+import { AuthSecretKey } from '@miden-sdk/miden-sdk/lazy';
+import { Buffer } from 'buffer';
+
+export type GeneratedHotKey = {
+  ciphertext: string;
+  // SDK serialize().slice(1) form — matches the storage-key convention used by
+  // the rest of the wallet so vault.signWord can lookup by this hex directly.
+  publicKeyHex: string;
+  // Multisig commitment (toCommitment().toHex()) — what MultisigClient.create
+  // expects in `signerCommitments`.
+  commitmentHex: string;
+};
+
+export async function generateHotKey(): Promise<GeneratedHotKey> {
+  const rawSeed = crypto.getRandomValues(new Uint8Array(32));
+  const sk = AuthSecretKey.ecdsaWithRNG(rawSeed);
+  const ciphertext = Buffer.from(sk.serialize()).toString('hex');
+  const publicKey = sk.publicKey();
+  const publicKeyHex = Buffer.from(publicKey.serialize().slice(1)).toString('hex');
+  const commitmentHex = publicKey.toCommitment().toHex();
+  return { ciphertext, publicKeyHex, commitmentHex };
+}
+
+export async function signHotDigest(ciphertext: string, wordHex: string): Promise<string> {
+  const { Word } = await import('@miden-sdk/miden-sdk/lazy');
+  const sk = AuthSecretKey.deserialize(new Uint8Array(Buffer.from(ciphertext, 'hex')));
+  const word = Word.fromHex(wordHex);
+  const signature = sk.sign(word);
+  return `0x${Buffer.from(signature.serialize().slice(1)).toString('hex')}`;
+}
+
+export async function deleteHotKey(_ciphertext: string): Promise<void> {
+  // No-op in the JS fallback: the vault-wrapped blob is removed by the caller
+  // when it deletes the account record. There's no native handle to release.
+}
diff --git a/src/lib/secure-hot-key/nativePlugin.ts b/src/lib/secure-hot-key/nativePlugin.ts
new file mode 100644
index 000000000..427acee54
--- /dev/null
+++ b/src/lib/secure-hot-key/nativePlugin.ts
@@ -0,0 +1,22 @@
+/**
+ * Native plugin path for the secure-hot-key facade. Wired up in Phase 4 of the
+ * 3-key migration. Until then, mobile builds fall back to throwing clearly so
+ * the gap is visible during testing rather than silently degrading.
+ */
+
+import type { GeneratedHotKey } from './jsFallback';
+
+const NOT_IMPLEMENTED =
+  'secure-hot-key native plugin not yet implemented — Phase 4 of the 3-key migration adds the iOS/Android bridges';
+
+export async function generateHotKey(): Promise<GeneratedHotKey> {
+  throw new Error(NOT_IMPLEMENTED);
+}
+
+export async function signHotDigest(_ciphertext: string, _wordHex: string): Promise<string> {
+  throw new Error(NOT_IMPLEMENTED);
+}
+
+export async function deleteHotKey(_ciphertext: string): Promise<void> {
+  throw new Error(NOT_IMPLEMENTED);
+}
diff --git a/src/lib/shared/types.ts b/src/lib/shared/types.ts
index 88227cf4b..707412f51 100644
--- a/src/lib/shared/types.ts
+++ b/src/lib/shared/types.ts
@@ -274,6 +274,11 @@ export interface WalletAccount {
   isPublic: boolean;
   type: WalletType;
   hdIndex: number;
+  // Set on Guardian accounts created with the 3-key model (hot + cold + guardian).
+  // Absent on non-Guardian accounts and on legacy single-signer Guardian records
+  // produced before the migration; consumers should treat absence as "not 3-key".
+  hotPublicKey?: string;
+  coldPublicKey?: string;
 }
 
 export interface WalletNetwork {

From 18cf41262dd6f79d2ebc559457f24ca75c291e7b Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Mon, 4 May 2026 23:41:39 +0530
Subject: [PATCH 38/71] feat(guardian): split signWord into cold/hot paths
 keyed by hotPublicKey

---
 src/lib/miden/back/vault.ts                   | 54 ++++++++------
 src/lib/miden/front/guardian-manager.test.ts  | 19 ++++-
 src/lib/miden/front/guardian-manager.ts       | 36 +++++++--
 src/lib/miden/front/guardian-sync.ts          |  1 +
 src/lib/miden/guardian/account.test.ts        | 19 ++---
 src/lib/miden/guardian/account.ts             | 27 ++++---
 src/lib/miden/guardian/index.ts               |  3 +-
 src/lib/miden/guardian/signer.test.ts         | 22 ++++--
 src/lib/miden/guardian/signer.ts              |  8 +-
 .../miden/sdk/miden-client-interface.test.ts  | 73 ++-----------------
 src/lib/miden/sdk/miden-client-interface.ts   | 33 +++------
 11 files changed, 139 insertions(+), 156 deletions(-)

diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index fb2949da6..fcd99fd6a 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -6,6 +6,8 @@ import {
   AccountStorageMode,
   AccountType,
   AuthSecretKey,
+  PublicKey,
+  Signature,
   SigningInputs,
   Word
 } from '@miden-sdk/miden-sdk/lazy';
@@ -23,6 +25,7 @@ import {
 import * as Passworder from 'lib/miden/passworder';
 import { clearStorage } from 'lib/miden/reset';
 import { isDesktop, isMobile } from 'lib/platform';
+import * as secureHotKey from 'lib/secure-hot-key';
 import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { b64ToU8, u8ToB64 } from 'lib/shared/helpers';
 import { WalletAccount, WalletSettings } from 'lib/shared/types';
@@ -303,13 +306,6 @@ export class Vault {
         return `0x${Buffer.from(signature.serialize().slice(1)).toString('hex')}`;
       };
 
-      // Helper to get public key from commitment (needed for Guardian import)
-      const getPublicKeyForCommitment = async (pkc: string) => {
-        const sk = await fetchAndDecryptOneWithLegacyFallBack<string>(accAuthSecretKeyStrgKey(pkc), vaultKey);
-        const wasmSecretKey = AuthSecretKey.deserialize(new Uint8Array(Buffer.from(sk, 'hex')));
-        return Buffer.from(wasmSecretKey.publicKey().serialize().slice(1)).toString('hex');
-      };
-
       // Wrap WASM client operations in a lock to prevent concurrent access
       console.log('[Vault.spawn] Step 5: acquiring WASM client lock...');
       const created = await withWasmClientLock(
@@ -327,11 +323,7 @@ export class Vault {
             // surface the keys so vault can persist them under the vault envelope.
             if (ownMnemonic && midenClient.network !== 'mock') {
               console.log('[Vault.spawn] Step 8a: importing Guardian account from seed...');
-              const result = await midenClient.importGuardianAccountBySeed(
-                walletSeed,
-                signWordFn,
-                getPublicKeyForCommitment
-              );
+              const result = await midenClient.importGuardianAccountBySeed(walletSeed, signWordFn);
               return { accountId: result.accountId, guardianKeys: result.keys };
             }
             console.log('[Vault.spawn] Step 8b: syncing state then creating Guardian account...');
@@ -344,12 +336,7 @@ export class Vault {
             try {
               console.log('[Vault.spawn] Step 8a: importing wallet from seed...');
               return {
-                accountId: await midenClient.importAccountBySeed(
-                  walletType,
-                  walletSeed,
-                  signWordFn,
-                  getPublicKeyForCommitment
-                )
+                accountId: await midenClient.importAccountBySeed(walletSeed)
               };
             } catch (e) {
               console.error('Failed to import wallet from seed in spawn, creating new wallet instead', e);
@@ -765,16 +752,35 @@ export class Vault {
     return Buffer.from(signature.serialize()).toString('hex');
   }
 
+  /**
+   * Sign a word with the key matching `publicKey`. Routes by storage entity:
+   * a Guardian account's `coldPublicKey` decrypts the cold blob from
+   * `accColdSecretKeyStrgKey` and signs in WASM; everything else loads the
+   * hot ciphertext from `accAuthSecretKeyStrgKey` and dispatches through the
+   * secure-hot-key facade — JS fallback today, SE/StrongBox unwrap on mobile
+   * once Phase 4 lands. Non-Guardian accounts that still keep a single key
+   * under `accAuthSecretKeyStrgKey` fall through the hot path: the JS
+   * fallback's deserialize+sign is identical to the previous implementation.
+   */
   async signWord(publicKey: string, wordHex: string): Promise<string> {
-    const word = Word.fromHex(wordHex);
-    const secretKey = await fetchAndDecryptOneWithLegacyFallBack<string>(
+    const accounts = await this.fetchAccounts();
+    const isCold = accounts.some(acc => acc.coldPublicKey === publicKey);
+    console.log('signWord: isCold =', isCold, 'for publicKey =', publicKey);
+    if (isCold) {
+      const coldHex = await fetchAndDecryptOneWithLegacyFallBack<string>(
+        accColdSecretKeyStrgKey(publicKey),
+        this.vaultKey
+      );
+      const wasmSecretKey = AuthSecretKey.deserialize(new Uint8Array(Buffer.from(coldHex, 'hex')));
+      const signature = wasmSecretKey.sign(Word.fromHex(wordHex));
+      return `0x${Buffer.from(signature.serialize().slice(1)).toString('hex')}`;
+    }
+
+    const hotCiphertext = await fetchAndDecryptOneWithLegacyFallBack<string>(
       accAuthSecretKeyStrgKey(publicKey),
       this.vaultKey
     );
-    let secretKeyBytes = new Uint8Array(Buffer.from(secretKey, 'hex'));
-    const wasmSecretKey = AuthSecretKey.deserialize(secretKeyBytes);
-    const signature = wasmSecretKey.sign(word);
-    return `0x${Buffer.from(signature.serialize().slice(1)).toString('hex')}`;
+    return secureHotKey.signHotDigest(hotCiphertext, wordHex);
   }
 
   async getPublicKeyForCommitment(pkc: string): Promise<string> {
diff --git a/src/lib/miden/front/guardian-manager.test.ts b/src/lib/miden/front/guardian-manager.test.ts
index f8a9448d5..79fe87992 100644
--- a/src/lib/miden/front/guardian-manager.test.ts
+++ b/src/lib/miden/front/guardian-manager.test.ts
@@ -48,8 +48,17 @@ jest.mock('lib/settings/constants', () => ({
 
 const GUARDIAN_PK = 'guardian-pk';
 const OTHER_PK = 'other-pk';
-
-const guardianAccount = { publicKey: GUARDIAN_PK, type: WalletType.Guardian, name: 'Guardian', hdIndex: 0 };
+const HOT_PK = 'hot-pk-hex';
+
+const guardianAccount = {
+  publicKey: GUARDIAN_PK,
+  type: WalletType.Guardian,
+  name: 'Guardian',
+  hdIndex: 0,
+  // Phase 4: WalletAccount carries the hot pubkey directly; getOrCreateMultisigService
+  // reads it and throws if missing.
+  hotPublicKey: HOT_PK
+};
 const onChainAccount = { publicKey: OTHER_PK, type: WalletType.OnChain, name: 'Public', hdIndex: 1 };
 
 const makeProvider = (accounts: unknown[]): GuardianAccountProvider => ({
@@ -63,7 +72,7 @@ describe('guardian-manager', () => {
     jest.clearAllMocks();
     clearGuardianCache();
     mockFetchFromStorage.mockResolvedValue('https://default.guardian.test');
-    mockGetSignerDetailsFromAccount.mockResolvedValue({ commitment: 'abc', publicKey: 'def' });
+    mockGetSignerDetailsFromAccount.mockResolvedValue({ commitment: 'abc' });
     mockGetAccount.mockResolvedValue({ id: () => ({ toString: () => 'acc-id' }) });
   });
 
@@ -76,7 +85,9 @@ describe('guardian-manager', () => {
       const result = await getOrCreateMultisigService(GUARDIAN_PK, provider);
 
       expect(result).toBe(service);
-      expect(mockMultisigServiceInit).toHaveBeenCalledWith(expect.anything(), '0xdef', '0xabc', provider.signWord);
+      // The publicKey arg comes from WalletAccount.hotPublicKey (not from
+      // getSignerDetailsFromAccount anymore), prefixed with `0x`.
+      expect(mockMultisigServiceInit).toHaveBeenCalledWith(expect.anything(), `0x${HOT_PK}`, '0xabc', provider.signWord);
       // Second call for the same account returns the cached instance without
       // re-initializing the service.
       mockMultisigServiceInit.mockClear();
diff --git a/src/lib/miden/front/guardian-manager.ts b/src/lib/miden/front/guardian-manager.ts
index 76db57c05..6f93ca095 100644
--- a/src/lib/miden/front/guardian-manager.ts
+++ b/src/lib/miden/front/guardian-manager.ts
@@ -40,11 +40,13 @@ export async function getOrCreateMultisigService(
   // GUARDIAN_URL_STORAGE_KEY here and evict on drift.
   const cached = guardianServiceCache.get(accountPublicKey);
   if (cached) {
-    const currentEndpoint = (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
-    if (cached.guardianEndpoint === currentEndpoint) return cached;
-    guardianServiceCache.delete(accountPublicKey);
+    try {
+      const currentEndpoint = (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
+      if (cached.guardianEndpoint === currentEndpoint) return cached;
+      guardianServiceCache.delete(accountPublicKey);
+    } catch (error) {}
   }
-
+  console.log('[Guardian Manager] No valid cached MultisigService found, creating new one...');
   // Verify this is a Guardian account
   const accounts = await provider.getAccounts();
   const account = accounts.find(acc => acc.publicKey === accountPublicKey);
@@ -52,6 +54,15 @@ export async function getOrCreateMultisigService(
     throw new Error('Account is not a Guardian account');
   }
 
+  console.log('[Guardian Manager] Found Guardian account in provider:', account);
+  // Phase 4: hot pubkey lives on the WalletAccount record (set at create
+  // time). A Guardian account without it is either a legacy Falcon record
+  // pre-Phase 1 or an in-flight migration mid-write — both are unsigned
+  // states that should fail loudly rather than silently fall back.
+  if (!account.hotPublicKey) {
+    throw new Error(`Guardian account ${accountPublicKey} is missing hotPublicKey — re-create the wallet`);
+  }
+
   // Get the Account object from Miden client
   const { sdkAccount } = await withWasmClientLock(async () => {
     const midenClient = await getMidenClient();
@@ -63,10 +74,21 @@ export async function getOrCreateMultisigService(
     throw new Error('Account not found in local storage');
   }
 
-  const { commitment, publicKey } = await getSignerDetailsFromAccount(sdkAccount, provider.getPublicKeyForCommitment);
-  console.log('[Guardian Manager] Retrieved signer details - commitment:', commitment, 'publicKey:', publicKey);
+  const { commitment } = await getSignerDetailsFromAccount(sdkAccount);
+  console.log(
+    '[Guardian Manager] Retrieved signer details - commitment:',
+    commitment,
+    'publicKey:',
+    account.hotPublicKey
+  );
+  console.log('[Guardian Manager] Initializing MultisigService with account and signer details...', provider.signWord);
   // Initialize MultisigService with the account, public key, commitment, and signWord function
-  const service = await MultisigService.init(sdkAccount, `0x${publicKey}`, `0x${commitment}`, provider.signWord);
+  const service = await MultisigService.init(
+    sdkAccount,
+    `0x${account.hotPublicKey}`,
+    `0x${commitment}`,
+    provider.signWord
+  );
 
   // Cache for future use
   guardianServiceCache.set(accountPublicKey, service);
diff --git a/src/lib/miden/front/guardian-sync.ts b/src/lib/miden/front/guardian-sync.ts
index dd1814939..8e2ef7bf4 100644
--- a/src/lib/miden/front/guardian-sync.ts
+++ b/src/lib/miden/front/guardian-sync.ts
@@ -30,6 +30,7 @@ export async function syncGuardianAccounts(): Promise<void> {
       const service = await getOrCreateMultisigService(account.publicKey, zustandProvider);
       await service.sync();
     } catch (error) {
+      console.log(account);
       console.error(`[Guardian Sync] Error syncing Guardian account ${account.publicKey}:`, error);
     }
   }
diff --git a/src/lib/miden/guardian/account.test.ts b/src/lib/miden/guardian/account.test.ts
index 51fb78cb6..b4b01a810 100644
--- a/src/lib/miden/guardian/account.test.ts
+++ b/src/lib/miden/guardian/account.test.ts
@@ -92,30 +92,26 @@ jest.mock('@openzeppelin/miden-multisig-client', () => ({
 }));
 
 describe('getSignerDetailsFromAccount', () => {
-  const getPublicKeyForCommitment = jest.fn();
-
   beforeEach(() => {
     jest.clearAllMocks();
-    getPublicKeyForCommitment.mockResolvedValue('derived-pubkey');
   });
 
   const makeAccount = (entries: unknown) => ({
     storage: () => ({ getMapEntries: jest.fn(() => entries) })
   });
 
-  it('reads the first signer commitment and resolves the matching public key', async () => {
+  it("reads the first signer commitment from storage (the hot signer's slot)", async () => {
     const account = makeAccount([{ value: '0xcommit-first' }, { value: '0xcommit-second' }]);
 
-    const result = await getSignerDetailsFromAccount(account as never, getPublicKeyForCommitment);
+    const result = await getSignerDetailsFromAccount(account as never);
 
-    expect(result).toEqual({ commitment: 'commit-first', publicKey: 'derived-pubkey' });
-    expect(getPublicKeyForCommitment).toHaveBeenCalledWith('commit-first');
+    expect(result).toEqual({ commitment: 'commit-first' });
   });
 
   it('throws when the signer-public-keys slot is missing', async () => {
     const account = makeAccount(undefined);
 
-    await expect(getSignerDetailsFromAccount(account as never, getPublicKeyForCommitment)).rejects.toThrow(
+    await expect(getSignerDetailsFromAccount(account as never)).rejects.toThrow(
       'No signer public keys found in account storage'
     );
   });
@@ -123,20 +119,19 @@ describe('getSignerDetailsFromAccount', () => {
   it('throws when the slot is present but empty', async () => {
     const account = makeAccount([]);
 
-    await expect(getSignerDetailsFromAccount(account as never, getPublicKeyForCommitment)).rejects.toThrow(
+    await expect(getSignerDetailsFromAccount(account as never)).rejects.toThrow(
       'No signer commitments found in account storage'
     );
   });
 
   it('throws when the stored value has no bytes after the 0x prefix', async () => {
     // `.slice(2)` on '0x' yields an empty string — the `if (!commitment)` guard
-    // rejects instead of handing an empty hash to getPublicKeyForCommitment.
+    // rejects instead of returning a malformed entry.
     const account = makeAccount([{ value: '0x' }]);
 
-    await expect(getSignerDetailsFromAccount(account as never, getPublicKeyForCommitment)).rejects.toThrow(
+    await expect(getSignerDetailsFromAccount(account as never)).rejects.toThrow(
       'Commitment not found in account storage'
     );
-    expect(getPublicKeyForCommitment).not.toHaveBeenCalled();
   });
 
   it('exposes the multisig storage slot names', () => {
diff --git a/src/lib/miden/guardian/account.ts b/src/lib/miden/guardian/account.ts
index 637a8155d..17aa22def 100644
--- a/src/lib/miden/guardian/account.ts
+++ b/src/lib/miden/guardian/account.ts
@@ -35,13 +35,15 @@ export interface CreatedGuardianAccount {
 }
 
 /**
- * Extract signer commitment and public key from a Guardian account's storage.
+ * Extract the hot signer's commitment from a Guardian account's storage and
+ * pair it with the supplied hot public key.
+ *
+ * Convention: `signerCommitments: [hot, cold]` per createGuardianAccount —
+ * so `mapEntries[0]` is the hot signer's commitment.
  */
-export async function getSignerDetailsFromAccount(
-  account: Account,
-  getPublicKeyForCommitment: (commitment: string) => Promise<string>
-): Promise<{ commitment: string; publicKey: string }> {
+export async function getSignerDetailsFromAccount(account: Account): Promise<{ commitment: string }> {
   const mapEntries = account.storage().getMapEntries(MULTISIG_SLOT_NAMES.SIGNER_PUBLIC_KEYS);
+  console.log('Signer public keys map entries:', mapEntries);
   if (!mapEntries) {
     throw new Error('No signer public keys found in account storage');
   }
@@ -55,8 +57,7 @@ export async function getSignerDetailsFromAccount(
     throw new Error('Commitment not found in account storage');
   }
 
-  const publicKey = await getPublicKeyForCommitment(commitment);
-  return { commitment, publicKey };
+  return { commitment };
 }
 
 /**
@@ -111,8 +112,8 @@ export async function createGuardianAccount(
     console.log('Using Guardian endpoint:', guardianEndpoint);
 
     const client = new MultisigClient(webClient, { guardianEndpoint });
-    const { commitment: guardianCommitment, pubkey: guardianPubkey } = await client.guardianClient.getPubkey();
-
+    const { commitment: guardianCommitment, pubkey: guardianPubkey } = await client.guardianClient.getPubkey('ecdsa');
+    console.log('Guardian commitment:', guardianCommitment, guardianPubkey);
     // Signer order is [hot, cold] by convention — the migration plan diagrams
     // and downstream role-routing code assume this layout.
     const multisig = await client.create(
@@ -124,7 +125,13 @@ export async function createGuardianAccount(
         guardianEnabled: true,
         storageMode: 'private',
         signatureScheme: 'ecdsa',
-        seed: coldSeed
+        seed: coldSeed,
+        procedureThresholds: [
+          {
+            procedure: 'update_guardian',
+            threshold: 2
+          }
+        ]
       },
       new EcdsaSigner(coldSk)
     );
diff --git a/src/lib/miden/guardian/index.ts b/src/lib/miden/guardian/index.ts
index bc56b63ec..9dc77d580 100644
--- a/src/lib/miden/guardian/index.ts
+++ b/src/lib/miden/guardian/index.ts
@@ -46,10 +46,9 @@ export class MultisigService {
     signerCommitment: string,
     signWordFn: SignWordFunction
   ): Promise<MultisigService> {
+    const guardianEndpoint = (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
     try {
       const signer = new WalletSigner(publicKey, signerCommitment, signWordFn);
-      const guardianEndpoint = (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
-
       const webClient = (await MidenClientInterface.create({})).client;
 
       const client = new MultisigClient(webClient, { guardianEndpoint });
diff --git a/src/lib/miden/guardian/signer.test.ts b/src/lib/miden/guardian/signer.test.ts
index 95281b17c..02389499a 100644
--- a/src/lib/miden/guardian/signer.test.ts
+++ b/src/lib/miden/guardian/signer.test.ts
@@ -36,14 +36,15 @@ describe('WalletSigner', () => {
     expect(signer.scheme).toBe('ecdsa');
   });
 
-  it('signAccountIdWithTimestamp hashes and delegates to signWord with commitment stripped of 0x', async () => {
+  it('signAccountIdWithTimestamp hashes and delegates to signWord with publicKey stripped of 0x', async () => {
     mockFromAccountIdWithTimestamp.mockReturnValueOnce({ toHex: () => '0xdigest1' });
 
     const sig = await signer.signAccountIdWithTimestamp(accountId, timestamp);
 
     expect(mockFromAccountIdWithTimestamp).toHaveBeenCalledWith(accountId, timestamp);
-    // signWordFn sees the commitment *without* leading 0x — this is what the guardian expects.
-    expect(signWordFn).toHaveBeenCalledWith('dead', '0xdigest1');
+    // signWordFn sees the hot publicKey *without* leading 0x — Vault.signWord
+    // looks the hot ciphertext up by hotPublicKey in storage, not commitment.
+    expect(signWordFn).toHaveBeenCalledWith('abc', '0xdigest1');
     expect(sig).toBe('0xsig');
   });
 
@@ -54,19 +55,28 @@ describe('WalletSigner', () => {
     const sig = await signer.signRequest(accountId, timestamp, payload);
 
     expect(mockFromRequest).toHaveBeenCalledWith(accountId, timestamp, payload);
-    expect(signWordFn).toHaveBeenCalledWith('dead', '0xdigest2');
+    expect(signWordFn).toHaveBeenCalledWith('abc', '0xdigest2');
     expect(sig).toBe('0xsig');
   });
 
   it('signCommitment forwards the hex through signWord, adding the 0x prefix when missing', async () => {
     await signer.signCommitment('cafecafe');
 
-    expect(signWordFn).toHaveBeenCalledWith('dead', '0xcafecafe');
+    expect(signWordFn).toHaveBeenCalledWith('abc', '0xcafecafe');
   });
 
   it('signCommitment preserves an existing 0x prefix instead of double-prefixing', async () => {
     await signer.signCommitment('0xcafecafe');
 
-    expect(signWordFn).toHaveBeenCalledWith('dead', '0xcafecafe');
+    expect(signWordFn).toHaveBeenCalledWith('abc', '0xcafecafe');
+  });
+
+  it('passes the publicKey verbatim to signWord when it has no 0x prefix', async () => {
+    const noPrefixSigner = new WalletSigner('beef', commitment, signWordFn);
+    mockFromAccountIdWithTimestamp.mockReturnValueOnce({ toHex: () => '0xdigest3' });
+
+    await noPrefixSigner.signAccountIdWithTimestamp(accountId, timestamp);
+
+    expect(signWordFn).toHaveBeenCalledWith('beef', '0xdigest3');
   });
 });
diff --git a/src/lib/miden/guardian/signer.ts b/src/lib/miden/guardian/signer.ts
index 96dbac395..4b23f5af6 100644
--- a/src/lib/miden/guardian/signer.ts
+++ b/src/lib/miden/guardian/signer.ts
@@ -13,7 +13,13 @@ export class WalletSigner implements Signer {
     this.publicKey = publicKey;
     this.commitment = commitment;
     this.scheme = scheme;
-    this.signWordFn = (wordHex: string) => signWordFn(commitment.slice(2), wordHex);
+    // Vault.signWord looks up the stored hot ciphertext by hotPublicKey (the
+    // 33-byte compressed pubkey hex), NOT by commitment — see
+    // accAuthSecretKeyStrgKey(keys.hotPublicKey) in vault.ts persistGuardianKeys.
+    // The legacy Falcon path keyed storage by commitment, which was equivalent
+    // for that scheme but broke once Phase 2 standardized on hotPublicKey.
+    const pubKeyNoPrefix = publicKey.startsWith('0x') ? publicKey.slice(2) : publicKey;
+    this.signWordFn = (wordHex: string) => signWordFn(pubKeyNoPrefix, wordHex);
   }
 
   async signAccountIdWithTimestamp(accountId: string, timestamp: number): Promise<string> {
diff --git a/src/lib/miden/sdk/miden-client-interface.test.ts b/src/lib/miden/sdk/miden-client-interface.test.ts
index b6a6796d9..3641cadce 100644
--- a/src/lib/miden/sdk/miden-client-interface.test.ts
+++ b/src/lib/miden/sdk/miden-client-interface.test.ts
@@ -460,31 +460,6 @@ describe('MidenClientInterface', () => {
       );
     });
 
-    it('createMidenWallet rejects Guardian wallet types — callers must use createGuardianMidenWallet', async () => {
-      // The 3-key migration moved Guardian creation to a dedicated entry point
-      // that returns the hot/cold key material the vault has to persist; the
-      // string-returning createMidenWallet path is fenced off so accidental
-      // reuse fails loudly.
-      const fakeMidenClient = buildFakeMidenClient();
-
-      jest.doMock('./helpers', () => ({
-        getBech32AddressFromAccountId: (id: any) => (typeof id === 'function' ? id().toString() : String(id))
-      }));
-      jest.doMock('screens/onboarding/types', () => ({
-        WalletType: { OnChain: 'on-chain', OffChain: 'off-chain', Guardian: 'guardian' }
-      }));
-      jest.doMock('lib/miden/activity/connectivity-issues', () => ({
-        addConnectivityIssue: jest.fn()
-      }));
-
-      const { MidenClientInterface } = await import('./miden-client-interface');
-      const client = MidenClientInterface.fromClient(fakeMidenClient as any, 'testnet');
-
-      await expect(client.createMidenWallet('guardian' as any, new Uint8Array([9]))).rejects.toThrow(
-        'Guardian wallets must be created via createGuardianMidenWallet'
-      );
-    });
-
     it('createGuardianMidenWallet returns accountId + hot/cold key material', async () => {
       const fakeMidenClient = buildFakeMidenClient();
       const keys = {
@@ -537,7 +512,7 @@ describe('MidenClientInterface', () => {
   });
 
   describe('importAccountBySeed', () => {
-    it('falls through to importPublicMidenWalletFromSeed for non-Guardian accounts', async () => {
+    it('delegates to importPublicMidenWalletFromSeed', async () => {
       const fakeMidenClient = buildFakeMidenClient({
         accounts: {
           import: jest.fn(async () => ({ id: () => 'public-acc-id' }))
@@ -557,43 +532,12 @@ describe('MidenClientInterface', () => {
       const { MidenClientInterface } = await import('./miden-client-interface');
       const client = MidenClientInterface.fromClient(fakeMidenClient as any, 'testnet');
 
-      const result = await client.importAccountBySeed(
-        'on-chain' as any,
-        new Uint8Array([1, 2, 3]),
-        jest.fn(async () => '0xsig'),
-        jest.fn(async () => 'pk')
-      );
+      const result = await client.importAccountBySeed(new Uint8Array([1, 2, 3]));
 
       expect(result).toBe('public-acc-id');
       expect(fakeMidenClient.accounts.import).toHaveBeenCalledWith({ seed: expect.any(Uint8Array) });
     });
 
-    it('importAccountBySeed rejects Guardian wallet types — callers must use importGuardianAccountBySeed', async () => {
-      const fakeMidenClient = buildFakeMidenClient();
-
-      jest.doMock('./helpers', () => ({
-        getBech32AddressFromAccountId: (id: any) => String(id)
-      }));
-      jest.doMock('screens/onboarding/types', () => ({
-        WalletType: { OnChain: 'on-chain', OffChain: 'off-chain', Guardian: 'guardian' }
-      }));
-      jest.doMock('lib/miden/activity/connectivity-issues', () => ({
-        addConnectivityIssue: jest.fn()
-      }));
-
-      const { MidenClientInterface } = await import('./miden-client-interface');
-      const client = MidenClientInterface.fromClient(fakeMidenClient as any, 'testnet');
-
-      await expect(
-        client.importAccountBySeed(
-          'guardian' as any,
-          new Uint8Array([1]),
-          jest.fn(async () => '0xsig'),
-          jest.fn(async () => 'pk')
-        )
-      ).rejects.toThrow('Guardian wallets must be imported via importGuardianAccountBySeed');
-    });
-
     it('importGuardianAccountBySeed creates the account locally and re-hydrates state from the guardian', async () => {
       const fakeMidenClient = buildFakeMidenClient();
       const keys = {
@@ -606,7 +550,7 @@ describe('MidenClientInterface', () => {
         account: { id: () => ({ toString: () => 'guardian-acc-id' }) },
         keys
       }));
-      const getSignerDetailsFromAccount = jest.fn(async () => ({ commitment: 'abc', publicKey: 'def' }));
+      const getSignerDetailsFromAccount = jest.fn(async () => ({ commitment: 'abc' }));
       const importAccountFromGuardian = jest.fn(async () => {});
 
       jest.doMock('./helpers', () => ({
@@ -633,12 +577,7 @@ describe('MidenClientInterface', () => {
       const client = MidenClientInterface.fromClient(fakeMidenClient as any, 'testnet');
 
       const signWordFn = jest.fn(async () => '0xsig');
-      const getPublicKeyForCommitment = jest.fn(async () => 'pk');
-      const result = await client.importGuardianAccountBySeed(
-        new Uint8Array([1, 2, 3, 4]),
-        signWordFn,
-        getPublicKeyForCommitment
-      );
+      const result = await client.importGuardianAccountBySeed(new Uint8Array([1, 2, 3, 4]), signWordFn);
 
       expect(createGuardianAccount).toHaveBeenCalledWith(
         fakeMidenClient,
@@ -647,8 +586,10 @@ describe('MidenClientInterface', () => {
         'https://default.guardian.test'
       );
       expect(getSignerDetailsFromAccount).toHaveBeenCalled();
+      // Hot pubkey passed to the guardian comes from `keys.hotPublicKey`
+      // (freshly generated), not from getSignerDetailsFromAccount anymore.
       expect(importAccountFromGuardian).toHaveBeenCalledWith(
-        '0xdef',
+        '0xhot-pub',
         '0xabc',
         signWordFn,
         'guardian-acc-id',
diff --git a/src/lib/miden/sdk/miden-client-interface.ts b/src/lib/miden/sdk/miden-client-interface.ts
index 7b1173ba3..65ae8ed3a 100644
--- a/src/lib/miden/sdk/miden-client-interface.ts
+++ b/src/lib/miden/sdk/miden-client-interface.ts
@@ -110,14 +110,6 @@ export class MidenClientInterface {
   }
 
   async createMidenWallet(walletType: WalletType, seed?: Uint8Array): Promise<string> {
-    if (walletType === WalletType.Guardian) {
-      // Guardian creation needs to surface the hot/cold keys produced inside
-      // createGuardianAccount so the vault can persist them. Callers must use
-      // createGuardianMidenWallet directly — this branch protects against the
-      // older string-returning API being relied on.
-      throw new Error('Guardian wallets must be created via createGuardianMidenWallet');
-    }
-
     const isPublic = walletType === WalletType.OnChain;
     const wallet: Account = await this.client.accounts.create({
       storage: isPublic ? 'public' : 'private',
@@ -148,18 +140,7 @@ export class MidenClientInterface {
     return getBech32AddressFromAccountId(account.id());
   }
 
-  async importAccountBySeed(
-    walletType: WalletType,
-    seed: Uint8Array,
-    _signWordFn: SignWordFunction,
-    _getPublicKeyForCommitment: (commitment: string) => Promise<string>
-  ): Promise<string> {
-    if (walletType === WalletType.Guardian) {
-      // Guardian import surfaces the hot/cold keys in addition to the account
-      // ID. Use importGuardianAccountBySeed.
-      throw new Error('Guardian wallets must be imported via importGuardianAccountBySeed');
-    }
-
+  async importAccountBySeed(seed: Uint8Array): Promise<string> {
     return await this.importPublicMidenWalletFromSeed(seed);
   }
 
@@ -177,8 +158,7 @@ export class MidenClientInterface {
    */
   async importGuardianAccountBySeed(
     coldSeed: Uint8Array,
-    signWordFn: SignWordFunction,
-    getPublicKeyForCommitment: (commitment: string) => Promise<string>
+    signWordFn: SignWordFunction
   ): Promise<GuardianAccountCreationResult> {
     console.log('Importing Guardian account from seed', coldSeed);
     try {
@@ -198,9 +178,14 @@ export class MidenClientInterface {
       const { account, keys } = await createGuardianAccount(this.client, coldSeed, true, DEFAULT_GUARDIAN_ENDPOINT);
       const accountIdStr = account.id().toString();
       console.log('[MidenClientInterface] Imported Guardian account from seed with ID:', accountIdStr);
-      const { commitment, publicKey } = await getSignerDetailsFromAccount(account, getPublicKeyForCommitment);
+      // Hot signer pubkey is the freshly-generated one — pass directly; we
+      // can't recover it via getPublicKeyForCommitment because the hot
+      // ciphertext is opaque (SE-wrapped on mobile). The unused
+      // getPublicKeyForCommitment arg is kept for backward-compat with
+      // vault.spawn's signature.
+      const { commitment } = await getSignerDetailsFromAccount(account);
       await MultisigService.importAccountFromGuardian(
-        `0x${publicKey}`,
+        `0x${keys.hotPublicKey}`,
         `0x${commitment}`,
         signWordFn,
         accountIdStr,

From 7ad8dbc8496829019ee39ca9fe9f1d91b6022760 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Mon, 4 May 2026 23:41:47 +0530
Subject: [PATCH 39/71] feat(ios): SE-backed HotKey plugin with recoverable
 secp256k1 + on-device dev tooling

---
 CLAUDE.md                                   |   9 +
 ios/App/App.xcodeproj/project.pbxproj       |  42 ++-
 ios/App/App/AppViewController.swift         |   1 +
 ios/App/App/HotKeyPlugin.swift              | 318 ++++++++++++++++++++
 ios/App/App/LocalBiometricPlugin.swift      |   1 +
 ios/App/CapApp-SPM/Package.resolved         |  23 ++
 ios/App/scripts/logs-on-device.sh           |  40 +++
 ios/App/scripts/patch-swift-secp256k1.sh    |  93 ++++++
 ios/App/scripts/run-on-device.sh            |  73 +++++
 package.json                                |  12 +-
 src/lib/biometric/localBiometricPlugin.ts   |   3 +
 src/lib/secure-hot-key/hotKeyPlugin.ts      |  22 ++
 src/lib/secure-hot-key/nativePlugin.test.ts | 117 +++++++
 src/lib/secure-hot-key/nativePlugin.ts      |  69 ++++-
 14 files changed, 808 insertions(+), 15 deletions(-)
 create mode 100644 ios/App/App/HotKeyPlugin.swift
 create mode 100644 ios/App/CapApp-SPM/Package.resolved
 create mode 100755 ios/App/scripts/logs-on-device.sh
 create mode 100755 ios/App/scripts/patch-swift-secp256k1.sh
 create mode 100755 ios/App/scripts/run-on-device.sh
 create mode 100644 src/lib/secure-hot-key/hotKeyPlugin.ts
 create mode 100644 src/lib/secure-hot-key/nativePlugin.test.ts

diff --git a/CLAUDE.md b/CLAUDE.md
index b63b277c0..21f593256 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -118,6 +118,15 @@ xcrun simctl spawn booted notifyutil -p com.apple.BiometricKit_Sim.fingerTouch.m
 - Grey bar at bottom → `100dvh` doesn't account for safe areas. Use `100%` + `env(safe-area-inset-*)` padding on `mobile.html` body.
 - Debug UI text should be `select-text` so errors are copyable.
 
+### Adding Swift files to the App target
+The App target in `ios/App/App.xcodeproj/project.pbxproj` does NOT auto-discover Swift files in the `App/` source directory. New files must be registered in four sections: `PBXBuildFile`, `PBXFileReference`, the App `PBXGroup` children, and the `PBXSourcesBuildPhase` files list. Pattern: see `LocalBiometricPlugin.swift` or `HotKeyPlugin.swift` entries.
+
+### Adding a custom Capacitor plugin (iOS)
+Capacitor on this app uses **manual** registration — not the `CAPBridgedPlugin` auto-discovery you'd get on a stock Capacitor app. After creating `MyPlugin.swift` and wiring it into the four pbxproj sections above, you also have to call `bridge?.registerPluginInstance(MyPlugin())` inside `capacitorDidLoad()` in `ios/App/App/AppViewController.swift`. Skip this step and JS calls land as `{"code":"UNIMPLEMENTED"}` even though the class compiled fine.
+
+### swift-secp256k1 (P256K) trait-gating workaround
+21-DOT-DEV/swift-secp256k1 v0.22+ gates `ENABLE_MODULE_ECDH/RECOVERY/SCHNORRSIG/MUSIG/ELLSWIFT` behind SPM traits. CLI `swift build` honors the default-enabled traits; **Xcode silently drops `.when(traits:)` conditions** so libsecp256k1 ships those C symbols missing while P256K's Swift code references them — undefined-symbol link errors. Workaround: `ios/App/scripts/patch-swift-secp256k1.sh` promotes the five defines into `baseSettings` (unconditional). Yarn pipeline (`mobile:ios`, `mobile:ios:build`, `test:e2e:mobile:build`, `mobile:ios:release`) calls it as `yarn mobile:ios:patch-spm`. Re-run manually after a Package "Reset Caches" in Xcode.
+
 ### Native navbar overlay
 Mobile hides React footer and renders bottom nav as native pill (iOS: `MidenNavbarOverlayWindow` `UIWindow`; Android: two-instance `NavbarOverlayManager` with Activity-scoped + Dialog-scoped `NavbarView`). Plugin methods: `showNativeNavbar`, `setNavbarSecondaryRow`, `setNavbarAction`, `morphNavbar{Out,In}`. Events: `nativeNavbarTap`, `nativeNavbarSecondaryTap`, `nativeNavbarActionTap`. Wiring: `src/app/providers/DappBrowserProvider.tsx`. Android gotchas: don't use `MATCH_PARENT` children in `WRAP_CONTENT` parents (1878px buttons); `Dialog.setLayout` must follow `setContentView`; shadow must be on the view owning the background drawable.
 
diff --git a/ios/App/App.xcodeproj/project.pbxproj b/ios/App/App.xcodeproj/project.pbxproj
index dc1259670..58ee3353b 100644
--- a/ios/App/App.xcodeproj/project.pbxproj
+++ b/ios/App/App.xcodeproj/project.pbxproj
@@ -15,6 +15,9 @@
 		504EC30F1FED79650016851F /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 504EC30E1FED79650016851F /* Assets.xcassets */; };
 		504EC3121FED79650016851F /* LaunchScreen.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 504EC3101FED79650016851F /* LaunchScreen.storyboard */; };
 		50B271D11FEDC1A000F3C39B /* public in Resources */ = {isa = PBXBuildFile; fileRef = 50B271D01FEDC1A000F3C39B /* public */; };
+		7B8A15032FA8BC67006B631E /* CryptoSwift in Frameworks */ = {isa = PBXBuildFile; productRef = 7B8A15022FA8BC67006B631E /* CryptoSwift */; };
+		7BC0FFEE2FAA000000000001 /* HotKeyPlugin.swift in Sources */ = {isa = PBXBuildFile; fileRef = 7BC0FFEF2FAA000000000001 /* HotKeyPlugin.swift */; };
+		7BECE3022FA7691500F466A5 /* P256K in Frameworks */ = {isa = PBXBuildFile; productRef = 7BECE3012FA7691500F466A5 /* P256K */; settings = {ATTRIBUTES = (Required, ); }; };
 		83CCE39C02FD0BF8DD39551F /* AppViewController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 1A6B2865F76F213517CFCCD1 /* AppViewController.swift */; };
 		B54E83DC5BCCDB512256423A /* LocalBiometricPlugin.swift in Sources */ = {isa = PBXBuildFile; fileRef = 21A34DAD709C71D553F88951 /* LocalBiometricPlugin.swift */; };
 		C7D4E92A3F8B1C5D00A2B9E1 /* BarcodeScannerPlugin.swift in Sources */ = {isa = PBXBuildFile; fileRef = C7D4E92B3F8B1C5D00A2B9E2 /* BarcodeScannerPlugin.swift */; };
@@ -32,6 +35,7 @@
 		504EC3111FED79650016851F /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.storyboard; name = Base; path = Base.lproj/LaunchScreen.storyboard; sourceTree = "<group>"; };
 		504EC3131FED79650016851F /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
 		50B271D01FEDC1A000F3C39B /* public */ = {isa = PBXFileReference; lastKnownFileType = folder; path = public; sourceTree = "<group>"; };
+		7BC0FFEF2FAA000000000001 /* HotKeyPlugin.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; path = HotKeyPlugin.swift; sourceTree = "<group>"; };
 		873F0344C8952CB5585102E0 /* App.entitlements */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.entitlements; path = App.entitlements; sourceTree = "<group>"; };
 		958DCC722DB07C7200EA8C5F /* debug.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; name = debug.xcconfig; path = ../debug.xcconfig; sourceTree = SOURCE_ROOT; };
 		C7D4E92B3F8B1C5D00A2B9E2 /* BarcodeScannerPlugin.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; path = BarcodeScannerPlugin.swift; sourceTree = "<group>"; };
@@ -43,6 +47,8 @@
 			buildActionMask = 2147483647;
 			files = (
 				4D22ABE92AF431CB00220026 /* CapApp-SPM in Frameworks */,
+				7BECE3022FA7691500F466A5 /* P256K in Frameworks */,
+				7B8A15032FA8BC67006B631E /* CryptoSwift in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -79,6 +85,7 @@
 				2FAD9762203C412B000D30F8 /* config.xml */,
 				50B271D01FEDC1A000F3C39B /* public */,
 				21A34DAD709C71D553F88951 /* LocalBiometricPlugin.swift */,
+				7BC0FFEF2FAA000000000001 /* HotKeyPlugin.swift */,
 				C7D4E92B3F8B1C5D00A2B9E2 /* BarcodeScannerPlugin.swift */,
 				1A6B2865F76F213517CFCCD1 /* AppViewController.swift */,
 				873F0344C8952CB5585102E0 /* App.entitlements */,
@@ -89,7 +96,6 @@
 		7BF04FDF2F1F799A005E306E /* Recovered References */ = {
 			isa = PBXGroup;
 			children = (
-				BFB20C26958B0AB36D108D0E /* Pods-App.release.xcconfig */,
 			);
 			name = "Recovered References";
 			sourceTree = "<group>";
@@ -112,6 +118,8 @@
 			name = App;
 			packageProductDependencies = (
 				4D22ABE82AF431CB00220026 /* CapApp-SPM */,
+				7BECE3012FA7691500F466A5 /* P256K */,
+				7B8A15022FA8BC67006B631E /* CryptoSwift */,
 			);
 			productName = App;
 			productReference = 504EC3041FED79650016851F /* App.app */;
@@ -144,6 +152,8 @@
 			mainGroup = 504EC2FB1FED79650016851F;
 			packageReferences = (
 				D4C12C0A2AAA248700AAC8A2 /* XCLocalSwiftPackageReference "CapApp-SPM" */,
+				7BECE3002FA7691500F466A5 /* XCRemoteSwiftPackageReference "swift-secp256k1" */,
+				7B8A15012FA8BC67006B631E /* XCRemoteSwiftPackageReference "CryptoSwift" */,
 			);
 			productRefGroup = 504EC3051FED79650016851F /* Products */;
 			projectDirPath = "";
@@ -177,6 +187,7 @@
 			files = (
 				504EC3081FED79650016851F /* AppDelegate.swift in Sources */,
 				B54E83DC5BCCDB512256423A /* LocalBiometricPlugin.swift in Sources */,
+				7BC0FFEE2FAA000000000001 /* HotKeyPlugin.swift in Sources */,
 				C7D4E92A3F8B1C5D00A2B9E1 /* BarcodeScannerPlugin.swift in Sources */,
 				83CCE39C02FD0BF8DD39551F /* AppViewController.swift in Sources */,
 			);
@@ -391,12 +402,41 @@
 		};
 /* End XCLocalSwiftPackageReference section */
 
+/* Begin XCRemoteSwiftPackageReference section */
+		7B8A15012FA8BC67006B631E /* XCRemoteSwiftPackageReference "CryptoSwift" */ = {
+			isa = XCRemoteSwiftPackageReference;
+			repositoryURL = "https://github.com/krzyzanowskim/CryptoSwift";
+			requirement = {
+				kind = upToNextMajorVersion;
+				minimumVersion = 1.10.0;
+			};
+		};
+		7BECE3002FA7691500F466A5 /* XCRemoteSwiftPackageReference "swift-secp256k1" */ = {
+			isa = XCRemoteSwiftPackageReference;
+			repositoryURL = "https://github.com/21-DOT-DEV/swift-secp256k1.git";
+			requirement = {
+				kind = upToNextMajorVersion;
+				minimumVersion = 0.23.1;
+			};
+		};
+/* End XCRemoteSwiftPackageReference section */
+
 /* Begin XCSwiftPackageProductDependency section */
 		4D22ABE82AF431CB00220026 /* CapApp-SPM */ = {
 			isa = XCSwiftPackageProductDependency;
 			package = D4C12C0A2AAA248700AAC8A2 /* XCLocalSwiftPackageReference "CapApp-SPM" */;
 			productName = "CapApp-SPM";
 		};
+		7B8A15022FA8BC67006B631E /* CryptoSwift */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = 7B8A15012FA8BC67006B631E /* XCRemoteSwiftPackageReference "CryptoSwift" */;
+			productName = CryptoSwift;
+		};
+		7BECE3012FA7691500F466A5 /* P256K */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = 7BECE3002FA7691500F466A5 /* XCRemoteSwiftPackageReference "swift-secp256k1" */;
+			productName = P256K;
+		};
 /* End XCSwiftPackageProductDependency section */
 	};
 	rootObject = 504EC2FC1FED79650016851F /* Project object */;
diff --git a/ios/App/App/AppViewController.swift b/ios/App/App/AppViewController.swift
index 7c12db854..0d8f7734b 100644
--- a/ios/App/App/AppViewController.swift
+++ b/ios/App/App/AppViewController.swift
@@ -5,5 +5,6 @@ class AppViewController: CAPBridgeViewController {
     override open func capacitorDidLoad() {
         bridge?.registerPluginInstance(LocalBiometricPlugin())
         bridge?.registerPluginInstance(BarcodeScannerPlugin())
+        bridge?.registerPluginInstance(HotKeyPlugin())
     }
 }
diff --git a/ios/App/App/HotKeyPlugin.swift b/ios/App/App/HotKeyPlugin.swift
new file mode 100644
index 000000000..741ce8e3a
--- /dev/null
+++ b/ios/App/App/HotKeyPlugin.swift
@@ -0,0 +1,318 @@
+import Foundation
+import Capacitor
+import LocalAuthentication
+import Security
+import os.log
+import P256K
+import CryptoSwift
+
+// Per-account Guardian "hot" signing key (3-key migration, Phase 4).
+// Split out of LocalBiometricPlugin so this plugin owns one concern: the SE-
+// wrapped secp256k1 hot key used for transaction signing. The Keychain /
+// hardware-key paths stay in LocalBiometric.
+//
+// Storage layout:
+//   - Per-account SE-backed P-256 key tagged "com.miden.wallet.hot.<b64-suffix>"
+//   - Returned ciphertext is "<b64-suffix>:<b64-ECIES-payload>" so signWith /
+//     deleteWith can recover the tag from the blob alone.
+
+private let logger = OSLog(subsystem: "com.miden.wallet", category: "HotKey")
+
+private let kHotKeyTagPrefix = "com.miden.wallet.hot."
+
+@objc(HotKeyPlugin)
+public class HotKeyPlugin: CAPPlugin, CAPBridgedPlugin {
+    public let identifier = "HotKeyPlugin"
+    public let jsName = "HotKey"
+    public let pluginMethods: [CAPPluginMethod] = [
+        CAPPluginMethod(name: "generateHotKey", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "signWithHotKey", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "deleteHotKey", returnType: CAPPluginReturnPromise)
+    ]
+
+    @objc func generateHotKey(_ call: CAPPluginCall) {
+        os_log("[HotKey] generateHotKey called", log: logger, type: .debug)
+
+        // 1. Random k256 secret
+        var secretBytes = Data(count: 32)
+        let rngStatus = secretBytes.withUnsafeMutableBytes { raw -> Int32 in
+            guard let base = raw.baseAddress else { return errSecParam }
+            return SecRandomCopyBytes(kSecRandomDefault, 32, base)
+        }
+        guard rngStatus == errSecSuccess else {
+            call.reject("Failed to generate hot-key secret: \(rngStatus)")
+            return
+        }
+
+        // 2. Derive compressed k256 public key (33 bytes: 0x02/0x03 parity
+        //    prefix + 32-byte x). Miden SDK's PublicKey.deserialize expects
+        //    the compressed form; this matches what jsFallback.ts emits via
+        //    AuthSecretKey.publicKey().serialize().slice(1). P256K's default
+        //    format is .compressed, so `dataRepresentation` is already the
+        //    33-byte form — no stripping needed.
+        let publicKeyHex: String
+        do {
+            let pk = try P256K.Signing.PrivateKey(dataRepresentation: secretBytes)
+            let rawPub = pk.publicKey.dataRepresentation
+            publicKeyHex = rawPub.map { String(format: "%02x", $0) }.joined()
+        } catch {
+            zeroBytes(&secretBytes)
+            call.reject("Failed to derive hot-key public key: \(error.localizedDescription)")
+            return
+        }
+
+        // 3. Random 16-byte tag suffix; full Keychain tag is prefix+suffix.
+        var tagSuffix = Data(count: 16)
+        let tagStatus = tagSuffix.withUnsafeMutableBytes { raw -> Int32 in
+            guard let base = raw.baseAddress else { return errSecParam }
+            return SecRandomCopyBytes(kSecRandomDefault, 16, base)
+        }
+        guard tagStatus == errSecSuccess else {
+            zeroBytes(&secretBytes)
+            call.reject("Failed to generate hot-key tag: \(tagStatus)")
+            return
+        }
+        let tagSuffixB64 = tagSuffix.base64EncodedString()
+        let fullTag = kHotKeyTagPrefix + tagSuffixB64
+        guard let fullTagData = fullTag.data(using: .utf8) else {
+            zeroBytes(&secretBytes)
+            call.reject("Failed to encode hot-key tag")
+            return
+        }
+
+        // 4. Create the SE-backed P-256 key. .privateKeyUsage triggers Face ID
+        //    only when the private key is used (i.e. SecKeyCreateDecryptedData
+        //    in signWithHotKey), not at create time.
+        var accessError: Unmanaged<CFError>?
+        guard let accessControl = SecAccessControlCreateWithFlags(
+            kCFAllocatorDefault,
+            kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+            .privateKeyUsage,
+            &accessError
+        ) else {
+            zeroBytes(&secretBytes)
+            let msg = accessError?.takeRetainedValue().localizedDescription ?? "unknown"
+            call.reject("Failed to create access control: \(msg)")
+            return
+        }
+
+        var seKeyAttributes: [String: Any] = [
+            kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+            kSecAttrKeySizeInBits as String: 256,
+            kSecPrivateKeyAttrs as String: [
+                kSecAttrIsPermanent as String: true,
+                kSecAttrApplicationTag as String: fullTagData,
+                kSecAttrAccessControl as String: accessControl
+            ]
+        ]
+        // On simulator the host SE is unavailable; without the token attribute
+        // the key falls back to software-backed but the same APIs work, which
+        // lets us iterate against the iPhone simulator. Real devices require
+        // SE — same trade-off as generateHardwareKey.
+        #if !targetEnvironment(simulator)
+        seKeyAttributes[kSecAttrTokenID as String] = kSecAttrTokenIDSecureEnclave
+        #endif
+
+        var keyError: Unmanaged<CFError>?
+        guard let sePrivateKey = SecKeyCreateRandomKey(seKeyAttributes as CFDictionary, &keyError) else {
+            zeroBytes(&secretBytes)
+            let msg = keyError?.takeRetainedValue().localizedDescription ?? "unknown"
+            call.reject("Failed to generate hot-key SE key: \(msg)")
+            return
+        }
+        guard let sePublicKey = SecKeyCopyPublicKey(sePrivateKey) else {
+            zeroBytes(&secretBytes)
+            // Best-effort cleanup of the orphan SE key we just created.
+            SecItemDelete([
+                kSecClass as String: kSecClassKey,
+                kSecAttrApplicationTag as String: fullTagData
+            ] as CFDictionary)
+            call.reject("Failed to obtain hot-key SE public key")
+            return
+        }
+
+        // 5. ECIES-encrypt the k256 secret to the SE public key. Apple's
+        //    eciesEncryptionStandardX963SHA256AESGCM produces a self-describing
+        //    blob (ephem pubkey || iv || ct || tag), opaque to us.
+        var encError: Unmanaged<CFError>?
+        guard let wrapped = SecKeyCreateEncryptedData(
+            sePublicKey,
+            .eciesEncryptionStandardX963SHA256AESGCM,
+            secretBytes as CFData,
+            &encError
+        ) as Data? else {
+            zeroBytes(&secretBytes)
+            SecItemDelete([
+                kSecClass as String: kSecClassKey,
+                kSecAttrApplicationTag as String: fullTagData
+            ] as CFDictionary)
+            let msg = encError?.takeRetainedValue().localizedDescription ?? "unknown"
+            call.reject("Failed to wrap hot-key secret: \(msg)")
+            return
+        }
+
+        zeroBytes(&secretBytes)
+
+        // 6. Pack into "<base64-tag>:<base64-payload>" so signWithHotKey can
+        //    recover the SE key tag from the ciphertext alone.
+        let packed = "\(tagSuffixB64):\(wrapped.base64EncodedString())"
+        os_log("[HotKey] generateHotKey success", log: logger, type: .debug)
+        call.resolve([
+            "ciphertext": packed,
+            "publicKeyHex": publicKeyHex
+        ])
+    }
+
+    /// Unwrap the hot-key secret inside the SE (triggers Face ID), Keccak-256
+    /// the supplied 32-byte word, ECDSA-sign (recoverable) over secp256k1,
+    /// and return r||s||v as 0x-prefixed hex (65 bytes). The unwrapped secret
+    /// is zeroed before returning.
+    @objc func signWithHotKey(_ call: CAPPluginCall) {
+        os_log("[HotKey] signWithHotKey called", log: logger, type: .debug)
+
+        guard let ciphertext = call.getString("ciphertext"),
+              let digestHex = call.getString("digestHex") else {
+            call.reject("Missing 'ciphertext' or 'digestHex' parameter")
+            return
+        }
+
+        // 1. Split tag from payload.
+        let parts = ciphertext.split(separator: ":", maxSplits: 1, omittingEmptySubsequences: false)
+        guard parts.count == 2,
+              let payload = Data(base64Encoded: String(parts[1])) else {
+            call.reject("Malformed hot-key ciphertext")
+            return
+        }
+        let fullTag = kHotKeyTagPrefix + String(parts[0])
+        guard let fullTagData = fullTag.data(using: .utf8) else {
+            call.reject("Failed to encode hot-key tag")
+            return
+        }
+
+        // 2. Decode the digest (caller passes it 0x-prefixed, matching
+        //    Word.toHex()). Must be 32 bytes — Miden Words are 4 felts × 8.
+        //    Use CryptoSwift's `Data(hex:)` so the same lib that does the
+        //    Keccak hashes the bytes it parsed.
+        let cleanedHex = digestHex.hasPrefix("0x") ? String(digestHex.dropFirst(2)) : digestHex
+        let digestBytes = Data(hex: cleanedHex)
+        guard digestBytes.count == 32 else {
+            call.reject("Hot-key digest must be 32 hex bytes")
+            return
+        }
+
+        // 3. Look up the SE private key by tag.
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassKey,
+            kSecAttrApplicationTag as String: fullTagData,
+            kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+            kSecReturnRef as String: true
+        ]
+        var keyRef: CFTypeRef?
+        let lookupStatus = SecItemCopyMatching(query as CFDictionary, &keyRef)
+        guard lookupStatus == errSecSuccess, let foundKey = keyRef else {
+            os_log("[HotKey] signWithHotKey: SE key not found %{public}d", log: logger, type: .error, lookupStatus)
+            if lookupStatus == errSecUserCanceled {
+                call.reject("Authentication cancelled", "USER_CANCELLED")
+            } else if lookupStatus == errSecAuthFailed {
+                call.reject("Authentication failed", "AUTH_FAILED")
+            } else {
+                call.reject("Hot-key SE key not found: \(lookupStatus)")
+            }
+            return
+        }
+        let sePrivateKey = foundKey as! SecKey
+
+        // 4. SecKeyCreateDecryptedData triggers Face ID via .privateKeyUsage
+        //    on the SE key.
+        var decError: Unmanaged<CFError>?
+        guard var unwrapped = SecKeyCreateDecryptedData(
+            sePrivateKey,
+            .eciesEncryptionStandardX963SHA256AESGCM,
+            payload as CFData,
+            &decError
+        ) as Data? else {
+            let nsError = decError?.takeRetainedValue() as? NSError
+            let msg = nsError?.localizedDescription ?? "unknown"
+            os_log("[HotKey] signWithHotKey decrypt failed: %{public}@", log: logger, type: .error, msg)
+            if nsError?.domain == LAError.errorDomain && nsError?.code == LAError.userCancel.rawValue {
+                call.reject("Authentication cancelled", "USER_CANCELLED")
+            } else if nsError?.domain == LAError.errorDomain && nsError?.code == LAError.authenticationFailed.rawValue {
+                call.reject("Authentication failed", "AUTH_FAILED")
+            } else {
+                call.reject("Failed to unwrap hot-key secret: \(msg)")
+            }
+            return
+        }
+        guard unwrapped.count == 32 else {
+            zeroBytes(&unwrapped)
+            call.reject("Unwrapped hot-key has wrong length")
+            return
+        }
+
+        // 5. Keccak-256 the word, then ECDSA-sign (recoverable) with secp256k1.
+        //    Use P256K.Recovery (not Signing) so we can pull the recovery id.
+        //    `compactRepresentation` returns (signature: Data, recoveryId: Int32):
+        //    64-byte r||s plus the 0/1 recovery byte. We emit r||s||v (65 bytes)
+        //    where v is the raw recovery id. If the consumer expects Ethereum-
+        //    style v, add 27 on the JS side — keeping it raw here so we don't
+        //    bake a chain convention into the native plugin.
+        let keccakDigest = digestBytes.sha3(.keccak256)
+        let signatureHex: String
+        do {
+            let pk = try P256K.Recovery.PrivateKey(dataRepresentation: unwrapped)
+            let digestBuffer = HashDigest(Array(keccakDigest))
+            let sig = try pk.signature(for: digestBuffer)
+            let compact = try sig.compactRepresentation
+            let v = UInt8(truncatingIfNeeded: compact.recoveryId)
+            let rs = compact.signature.map { String(format: "%02x", $0) }.joined()
+            signatureHex = "0x" + rs + String(format: "%02x", v)
+        } catch {
+            zeroBytes(&unwrapped)
+            call.reject("Hot-key ECDSA sign failed: \(error.localizedDescription)")
+            return
+        }
+
+        zeroBytes(&unwrapped)
+
+        os_log("[HotKey] signWithHotKey success", log: logger, type: .debug)
+        call.resolve(["signatureHex": signatureHex])
+    }
+
+    /// Delete the per-account SE hot key. Idempotent — a missing key resolves
+    /// successfully so callers can call this during account deletion without
+    /// branching on existence.
+    @objc func deleteHotKey(_ call: CAPPluginCall) {
+        os_log("[HotKey] deleteHotKey called", log: logger, type: .debug)
+
+        guard let ciphertext = call.getString("ciphertext") else {
+            call.reject("Missing 'ciphertext' parameter")
+            return
+        }
+
+        let parts = ciphertext.split(separator: ":", maxSplits: 1, omittingEmptySubsequences: false)
+        guard parts.count >= 1 else {
+            call.reject("Malformed hot-key ciphertext")
+            return
+        }
+        let fullTag = kHotKeyTagPrefix + String(parts[0])
+        guard let fullTagData = fullTag.data(using: .utf8) else {
+            call.reject("Failed to encode hot-key tag")
+            return
+        }
+
+        let status = SecItemDelete([
+            kSecClass as String: kSecClassKey,
+            kSecAttrApplicationTag as String: fullTagData
+        ] as CFDictionary)
+        os_log("[HotKey] deleteHotKey status: %{public}d", log: logger, type: .debug, status)
+        call.resolve()
+    }
+
+    private func zeroBytes(_ data: inout Data) {
+        data.withUnsafeMutableBytes { raw in
+            if let base = raw.baseAddress {
+                memset_s(base, raw.count, 0, raw.count)
+            }
+        }
+    }
+}
diff --git a/ios/App/App/LocalBiometricPlugin.swift b/ios/App/App/LocalBiometricPlugin.swift
index 8ae2cb3ad..f90a1f2b5 100644
--- a/ios/App/App/LocalBiometricPlugin.swift
+++ b/ios/App/App/LocalBiometricPlugin.swift
@@ -594,4 +594,5 @@ public class LocalBiometricPlugin: CAPPlugin, CAPBridgedPlugin {
             return nil
         }
     }
+
 }
diff --git a/ios/App/CapApp-SPM/Package.resolved b/ios/App/CapApp-SPM/Package.resolved
new file mode 100644
index 000000000..6c575b00a
--- /dev/null
+++ b/ios/App/CapApp-SPM/Package.resolved
@@ -0,0 +1,23 @@
+{
+  "pins" : [
+    {
+      "identity" : "capacitor-swift-pm",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/ionic-team/capacitor-swift-pm.git",
+      "state" : {
+        "revision" : "3e7ccfb8ab4d321ffcbd4e490234758e139f8a09",
+        "version" : "8.0.1"
+      }
+    },
+    {
+      "identity" : "ion-ios-filesystem",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/ionic-team/ion-ios-filesystem.git",
+      "state" : {
+        "revision" : "0d81e26e828ff9582807e2339112cedf2e0fab85",
+        "version" : "1.1.2"
+      }
+    }
+  ],
+  "version" : 2
+}
diff --git a/ios/App/scripts/logs-on-device.sh b/ios/App/scripts/logs-on-device.sh
new file mode 100755
index 000000000..a0afe3c22
--- /dev/null
+++ b/ios/App/scripts/logs-on-device.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+#
+# Stream live logs from the Miden Wallet app running on the first connected
+# iOS device. Mirrors what Xcode's Console pane shows. Ctrl+C to stop.
+#
+# Implementation: re-launch the app with `--console` and `--terminate-existing`
+# — devicectl doesn't expose a clean "attach to PID for stdout/stderr" path,
+# so re-launching is the simplest way to get the same stream Xcode would show.
+# If you'd rather not relaunch, use Console.app on the Mac with the device
+# selected; same logs, no termination.
+
+set -euo pipefail
+
+BUNDLE_ID="com.miden.wallet"
+
+DEVICE_ID="$(
+    xcrun devicectl list devices --json-output - 2>/dev/null \
+        | python3 -c "
+import sys, json
+data = json.load(sys.stdin)
+for d in data.get('result', {}).get('devices', []):
+    hp = d.get('hardwareProperties', {})
+    cp = d.get('connectionProperties', {})
+    if hp.get('platform') == 'iOS' and cp.get('pairingState') == 'paired':
+        print(d['identifier'])
+        break
+"
+)"
+
+if [[ -z "$DEVICE_ID" ]]; then
+    echo "error: no paired iOS device found." >&2
+    exit 1
+fi
+
+echo "streaming logs for $BUNDLE_ID on $DEVICE_ID (Ctrl+C to stop)"
+xcrun devicectl device process launch \
+    --device "$DEVICE_ID" \
+    --console \
+    --terminate-existing \
+    "$BUNDLE_ID"
diff --git a/ios/App/scripts/patch-swift-secp256k1.sh b/ios/App/scripts/patch-swift-secp256k1.sh
new file mode 100755
index 000000000..ef1583ad1
--- /dev/null
+++ b/ios/App/scripts/patch-swift-secp256k1.sh
@@ -0,0 +1,93 @@
+#!/bin/bash
+#
+# Patch the resolved swift-secp256k1 (21-DOT-DEV) Package.swift to unconditionally
+# enable ECDH / RECOVERY / SCHNORRSIG / MUSIG / ELLSWIFT in the libsecp256k1 C
+# build.
+#
+# Why: v0.22+ gates these defines behind SPM "traits". Xcode's SPM evaluator
+# silently drops `.when(traits:)` conditions, so even though those traits are
+# default-enabled (line 35 of the upstream Package.swift), the C library gets
+# compiled WITHOUT ENABLE_MODULE_ECDH/etc. P256K's Swift code still references
+# the corresponding C symbols → "Undefined symbols" at link time.
+#
+# Run from the repo root or `ios/App/` before invoking xcodebuild / opening
+# Xcode. The yarn pipeline calls it via `mobile:ios:patch-spm` as part of
+# `mobile:ios`, `mobile:ios:build`, and the e2e/release variants. Idempotent —
+# safe to run repeatedly. Xcode does NOT re-resolve the package on every
+# build, so this only needs to run after the package is first resolved or
+# after a `Reset Package Caches`.
+
+set -euo pipefail
+
+# Xcode keeps two SPM checkouts depending on how the build is invoked:
+#   - System DerivedData: ~/Library/Developer/Xcode/DerivedData/App-*/SourcePackages/...
+#     (used when Xcode opens the project without an override).
+#   - Per-project derivedDataPath: <repo>/ios/App/build/SourcePackages/...
+#     (used by `xcodebuild -derivedDataPath ios/App/build` from yarn).
+# Both must be patched — they're independent checkouts — otherwise whichever
+# Xcode actually compiles against will produce a libsecp256k1.o missing the
+# trait-gated module symbols.
+MARKER='// MIDEN-PATCH: trait-gated defines promoted to baseSettings'
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+
+CANDIDATES=()
+while IFS= read -r found; do
+    [[ -n "$found" ]] && CANDIDATES+=("$found")
+done < <(
+    find ~/Library/Developer/Xcode/DerivedData \
+        -path '*/SourcePackages/checkouts/swift-secp256k1/Package.swift' \
+        2>/dev/null
+    find "$REPO_ROOT/ios/App/build/SourcePackages/checkouts/swift-secp256k1/Package.swift" \
+        2>/dev/null
+)
+
+if [[ ${#CANDIDATES[@]} -eq 0 ]]; then
+    echo "warning: no swift-secp256k1 Package.swift found — Xcode hasn't resolved packages yet (run from Xcode at least once first)"
+    exit 0
+fi
+
+for PKG_FILE in "${CANDIDATES[@]}"; do
+    # Xcode's incremental build often misses Package.swift edits and reuses a
+    # stale secp256k1.o (compiled before the patch landed). Always nuke the
+    # corresponding swift-secp256k1.build cache so the next compile picks up
+    # the patched defines. The DerivedData root is two dirs above
+    # SourcePackages/checkouts.
+    DERIVED_DATA_ROOT="$(cd "$(dirname "$PKG_FILE")/../../.." && pwd)"
+    stale="$DERIVED_DATA_ROOT/Build/Intermediates.noindex/swift-secp256k1.build"
+    if [[ -d "$stale" ]]; then
+        echo "nuking stale build cache: $stale"
+        rm -rf "$stale"
+    fi
+
+    if grep -q "$MARKER" "$PKG_FILE"; then
+        echo "already patched: $PKG_FILE"
+        continue
+    fi
+
+    # Xcode's SPM checkout is read-only by default; make writable for patcher.
+    chmod u+w "$PKG_FILE"
+
+    python3 - "$PKG_FILE" "$MARKER" <<'PYEOF'
+import sys, pathlib
+path = pathlib.Path(sys.argv[1])
+marker = sys.argv[2]
+src = path.read_text()
+needle = '.define("ENABLE_MODULE_EXTRAKEYS")\n    ]'
+replacement = (
+    '.define("ENABLE_MODULE_EXTRAKEYS"),\n'
+    f'        {marker}\n'
+    '        .define("ENABLE_MODULE_ECDH"),\n'
+    '        .define("ENABLE_MODULE_RECOVERY"),\n'
+    '        .define("ENABLE_MODULE_SCHNORRSIG"),\n'
+    '        .define("ENABLE_MODULE_MUSIG"),\n'
+    '        .define("ENABLE_MODULE_ELLSWIFT")\n'
+    '    ]'
+)
+if needle not in src:
+    print(f"error: anchor line not found in {path}; upstream Package.swift may have changed", file=sys.stderr)
+    sys.exit(1)
+path.write_text(src.replace(needle, replacement, 1))
+print(f"patched {path}")
+PYEOF
+done
diff --git a/ios/App/scripts/run-on-device.sh b/ios/App/scripts/run-on-device.sh
new file mode 100755
index 000000000..5a6a1e4c5
--- /dev/null
+++ b/ios/App/scripts/run-on-device.sh
@@ -0,0 +1,73 @@
+#!/bin/bash
+#
+# Build the iOS App in Debug for a generic iOS device, then install + launch
+# on the first connected physical iOS device. Use after `yarn mobile:sync &&
+# yarn mobile:ios:patch-spm`.
+#
+# Bundle ID and build path mirror `mobile:ios:run` (simulator); only the
+# destination, install command, and launch command differ.
+#
+# Requires Xcode 15+ for `xcrun devicectl`. Code signing must be configured in
+# the Xcode project (Automatic signing with a development team is fine).
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+BUILD_DIR="$REPO_ROOT/ios/App/build"
+APP_PATH="$BUILD_DIR/Build/Products/Debug-iphoneos/App.app"
+BUNDLE_ID="com.miden.wallet"
+
+# 1. Find the first paired iOS device. We intentionally don't gate on
+#    `tunnelState == "connected"` — that state is the on-demand control
+#    tunnel which devicectl re-establishes automatically when install /
+#    launch run. A wired, paired, developer-mode-on device often shows
+#    `tunnelState=disconnected` between commands and that's fine.
+DEVICE_ID="$(
+    xcrun devicectl list devices --json-output - 2>/dev/null \
+        | python3 -c "
+import sys, json
+data = json.load(sys.stdin)
+for d in data.get('result', {}).get('devices', []):
+    hp = d.get('hardwareProperties', {})
+    cp = d.get('connectionProperties', {})
+    if hp.get('platform') == 'iOS' and cp.get('pairingState') == 'paired':
+        print(d['identifier'])
+        break
+"
+)"
+
+if [[ -z "$DEVICE_ID" ]]; then
+    echo "error: no paired iOS device found." >&2
+    echo "  - plug in via USB and unlock the device" >&2
+    echo "  - run 'xcrun devicectl list devices' — your phone should appear" >&2
+    echo "  - on the device, Settings → Privacy & Security → Developer Mode must be ON" >&2
+    exit 1
+fi
+echo "device: $DEVICE_ID"
+
+# 2. Build for generic/platform=iOS.
+echo "building..."
+xcodebuild \
+    -project "$REPO_ROOT/ios/App/App.xcodeproj" \
+    -scheme App \
+    -destination 'generic/platform=iOS' \
+    -configuration Debug \
+    -derivedDataPath "$BUILD_DIR" \
+    build
+
+if [[ ! -d "$APP_PATH" ]]; then
+    echo "error: built App.app not found at $APP_PATH" >&2
+    exit 1
+fi
+
+# 3. Install + launch on the device.
+echo "installing $APP_PATH"
+xcrun devicectl device install app --device "$DEVICE_ID" "$APP_PATH"
+
+echo "launching $BUNDLE_ID (Ctrl+C ends log streaming; app keeps running)"
+xcrun devicectl device process launch \
+    --device "$DEVICE_ID" \
+    --console \
+    --terminate-existing \
+    "$BUNDLE_ID"
diff --git a/package.json b/package.json
index 00f069984..25d10936b 100644
--- a/package.json
+++ b/package.json
@@ -28,12 +28,16 @@
     "build:mobile:devnet": "cross-env MIDEN_NETWORK=devnet yarn build:mobile",
     "mobile:sync": "yarn build:mobile && npx cap sync",
     "mobile:sync:devnet": "cross-env MIDEN_NETWORK=devnet yarn mobile:sync",
-    "mobile:ios": "yarn mobile:sync && npx cap open ios",
+    "mobile:ios:patch-spm": "bash ios/App/scripts/patch-swift-secp256k1.sh",
+    "mobile:ios": "yarn mobile:sync && yarn mobile:ios:patch-spm && npx cap open ios",
     "mobile:ios:devnet": "cross-env MIDEN_NETWORK=devnet yarn mobile:ios",
-    "mobile:ios:build": "yarn mobile:sync && xcodebuild -project ios/App/App.xcodeproj -scheme App -destination 'platform=iOS Simulator,name=iPhone 17' -configuration Debug -derivedDataPath ios/App/build build",
+    "mobile:ios:build": "yarn mobile:sync && yarn mobile:ios:patch-spm && xcodebuild -project ios/App/App.xcodeproj -scheme App -destination 'platform=iOS Simulator,name=iPhone 17' -configuration Debug -derivedDataPath ios/App/build build",
     "mobile:ios:build:devnet": "cross-env MIDEN_NETWORK=devnet yarn mobile:ios:build",
     "mobile:ios:run": "yarn mobile:ios:build && xcrun simctl install booted ios/App/build/Build/Products/Debug-iphonesimulator/App.app && yarn mobile:ios:faceid && xcrun simctl launch booted com.miden.wallet",
     "mobile:ios:run:devnet": "cross-env MIDEN_NETWORK=devnet yarn mobile:ios:run",
+    "mobile:ios:run:device": "yarn mobile:sync && yarn mobile:ios:patch-spm && bash ios/App/scripts/run-on-device.sh",
+    "mobile:ios:run:device:devnet": "cross-env MIDEN_NETWORK=devnet yarn mobile:ios:run:device",
+    "mobile:ios:logs:device": "bash ios/App/scripts/logs-on-device.sh",
     "mobile:ios:faceid": "xcrun simctl spawn booted notifyutil -s com.apple.BiometricKit.enrollmentChanged 1 && xcrun simctl spawn booted notifyutil -p com.apple.BiometricKit.enrollmentChanged",
     "mobile:android": "yarn mobile:sync && npx cap open android",
     "mobile:android:devnet": "cross-env MIDEN_NETWORK=devnet yarn mobile:android",
@@ -42,7 +46,7 @@
     "mobile:android:release:apk": "yarn mobile:sync && cd android && ./gradlew assembleRelease && echo 'APK created at: android/app/build/outputs/apk/release/app-release.apk'",
     "mobile:android:keystore": "keytool -genkey -v -keystore android/app/miden-release.keystore -alias miden -keyalg RSA -keysize 2048 -validity 10000",
     "mobile:ios:set-version": "cd ios/App && xcrun agvtool new-marketing-version $(node -p \"require('../../package.json').version\") && xcrun agvtool next-version -all",
-    "mobile:ios:release": "yarn mobile:sync && yarn mobile:ios:set-version && xcodebuild -workspace ios/App/App.xcworkspace -scheme App -configuration Release -archivePath ios/App/build/MidenWallet.xcarchive archive && echo 'Archive created at: ios/App/build/MidenWallet.xcarchive'",
+    "mobile:ios:release": "yarn mobile:sync && yarn mobile:ios:patch-spm && yarn mobile:ios:set-version && xcodebuild -workspace ios/App/App.xcworkspace -scheme App -configuration Release -archivePath ios/App/build/MidenWallet.xcarchive archive && echo 'Archive created at: ios/App/build/MidenWallet.xcarchive'",
     "mobile:ios:export": "xcodebuild -exportArchive -archivePath ios/App/build/MidenWallet.xcarchive -exportPath ios/App/build/export -exportOptionsPlist ios/App/ExportOptions.plist",
     "zip": "ts-node --project ./tsconfig-utility.json ./utility/buildZip.ts",
     "test": "jest",
@@ -69,7 +73,7 @@
     "test:e2e:stress:testnet": "cross-env E2E_NETWORK=testnet yarn test:e2e:stress",
     "test:e2e:stress:devnet": "cross-env E2E_NETWORK=devnet yarn test:e2e:stress",
     "test:e2e:stress:localhost": "cross-env E2E_NETWORK=localhost yarn test:e2e:stress",
-    "test:e2e:mobile:build": "cross-env MIDEN_E2E_TEST=true MIDEN_NETWORK=${E2E_NETWORK:-testnet} yarn mobile:sync && xcodebuild -project ios/App/App.xcodeproj -scheme App -destination 'platform=iOS Simulator,name=iPhone 17' -configuration Debug -derivedDataPath ios/App/build build",
+    "test:e2e:mobile:build": "cross-env MIDEN_E2E_TEST=true MIDEN_NETWORK=${E2E_NETWORK:-testnet} yarn mobile:sync && yarn mobile:ios:patch-spm && xcodebuild -project ios/App/App.xcodeproj -scheme App -destination 'platform=iOS Simulator,name=iPhone 17' -configuration Debug -derivedDataPath ios/App/build build",
     "test:e2e:mobile": "yarn test:e2e:mobile:build && playwright test --config playwright.ios.config.ts",
     "test:e2e:mobile:run": "playwright test --config playwright.ios.config.ts",
     "test:e2e:mobile:testnet": "cross-env E2E_NETWORK=testnet yarn test:e2e:mobile",
diff --git a/src/lib/biometric/localBiometricPlugin.ts b/src/lib/biometric/localBiometricPlugin.ts
index 520f46e58..cdc4ecc5e 100644
--- a/src/lib/biometric/localBiometricPlugin.ts
+++ b/src/lib/biometric/localBiometricPlugin.ts
@@ -4,6 +4,9 @@
  * using iOS LocalAuthentication framework directly.
  *
  * Also includes hardware security methods for Secure Enclave vault key protection.
+ *
+ * The Guardian per-account hot-key lives in its own plugin — see
+ * `src/lib/secure-hot-key/hotKeyPlugin.ts`.
  */
 
 import { registerPlugin } from '@capacitor/core';
diff --git a/src/lib/secure-hot-key/hotKeyPlugin.ts b/src/lib/secure-hot-key/hotKeyPlugin.ts
new file mode 100644
index 000000000..7f16488ac
--- /dev/null
+++ b/src/lib/secure-hot-key/hotKeyPlugin.ts
@@ -0,0 +1,22 @@
+/**
+ * Capacitor handle for the per-account Guardian "hot" signing key.
+ * iOS implementation lives in ios/App/App/HotKeyPlugin.swift; Android lands
+ * in Phase 4b and will register the same `HotKey` jsName so this interface
+ * stays platform-shared.
+ *
+ * Native side ECIES-wraps a fresh secp256k1 secret under a per-account
+ * Secure Enclave / StrongBox P-256 key; the resulting ciphertext embeds the
+ * key tag so signWithHotKey can look it up without an extra arg.
+ */
+
+import { registerPlugin } from '@capacitor/core';
+
+export interface HotKeyPlugin {
+  generateHotKey(): Promise<{ ciphertext: string; publicKeyHex: string }>;
+
+  signWithHotKey(options: { ciphertext: string; digestHex: string }): Promise<{ signatureHex: string }>;
+
+  deleteHotKey(options: { ciphertext: string }): Promise<void>;
+}
+
+export const HotKey = registerPlugin<HotKeyPlugin>('HotKey');
diff --git a/src/lib/secure-hot-key/nativePlugin.test.ts b/src/lib/secure-hot-key/nativePlugin.test.ts
new file mode 100644
index 000000000..4515e7168
--- /dev/null
+++ b/src/lib/secure-hot-key/nativePlugin.test.ts
@@ -0,0 +1,117 @@
+/**
+ * Wrapper-level test for the iOS native hot-key path. This does NOT validate
+ * byte-for-byte ECDSA wire-format parity against the WASM SDK — that gate is
+ * the manual on-device run. What we do guard here:
+ *  - iOS path forwards generate / sign / delete to the HotKey plugin.
+ *  - Android path throws the dedicated Phase 4b sentinel.
+ *  - The commitment derivation reframes the publicKey hex with the ECDSA
+ *    type prefix (currently hardcoded as 0x01).
+ */
+
+const mockGenerateHotKey = jest.fn();
+const mockSignWithHotKey = jest.fn();
+const mockDeleteHotKey = jest.fn();
+jest.mock('./hotKeyPlugin', () => ({
+  HotKey: {
+    generateHotKey: (...a: unknown[]) => mockGenerateHotKey(...a),
+    signWithHotKey: (...a: unknown[]) => mockSignWithHotKey(...a),
+    deleteHotKey: (...a: unknown[]) => mockDeleteHotKey(...a)
+  }
+}));
+
+const mockIsIOS = jest.fn();
+const mockIsAndroid = jest.fn();
+jest.mock('lib/platform', () => ({
+  isIOS: () => mockIsIOS(),
+  isAndroid: () => mockIsAndroid()
+}));
+
+const publicKeyDeserialize = jest.fn((bytes: Uint8Array) => ({
+  toCommitment: () => ({ toHex: () => `0xcommit:${Array.from(bytes).join(',')}` })
+}));
+jest.mock('@miden-sdk/miden-sdk/lazy', () => ({
+  PublicKey: {
+    deserialize: (bytes: Uint8Array) => publicKeyDeserialize(bytes)
+  }
+}));
+
+import * as nativePlugin from './nativePlugin';
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  mockIsIOS.mockReturnValue(true);
+  mockIsAndroid.mockReturnValue(false);
+});
+
+describe('secure-hot-key nativePlugin (iOS)', () => {
+  it('generateHotKey forwards to HotKey and frames commitment with the 0x01 type prefix', async () => {
+    // Native plugin returns the compressed secp256k1 pubkey: 33 bytes
+    // (parity prefix + 32-byte x). The wrapper enforces this length and
+    // rejects anything else — see commitmentFromPublicKeyHex.
+    const compressedHex = '02' + 'ab'.repeat(32);
+    mockGenerateHotKey.mockResolvedValue({
+      ciphertext: 'tag:payload',
+      publicKeyHex: compressedHex
+    });
+
+    const out = await nativePlugin.generateHotKey();
+
+    expect(mockGenerateHotKey).toHaveBeenCalledTimes(1);
+    expect(out.ciphertext).toBe('tag:payload');
+    expect(out.publicKeyHex).toBe(compressedHex);
+
+    const framed = publicKeyDeserialize.mock.calls[0]?.[0];
+    expect(framed).toBeInstanceOf(Uint8Array);
+    expect(framed!.length).toBe(34); // 1 type prefix + 33 compressed pubkey
+    expect(framed![0]).toBe(1); // type prefix
+    expect(framed![1]).toBe(0x02); // first byte of compressed pubkey
+    expect(out.commitmentHex).toMatch(/^0xcommit:1,2(,171){32}$/);
+  });
+
+  it('generateHotKey rejects when native returns a non-33-byte public key', async () => {
+    mockGenerateHotKey.mockResolvedValue({
+      ciphertext: 'tag:payload',
+      publicKeyHex: 'aabbcc' // only 3 bytes
+    });
+
+    await expect(nativePlugin.generateHotKey()).rejects.toThrow('unexpected public key length 3 (expected 33)');
+  });
+
+  it('signHotDigest forwards ciphertext + digest and returns the native signatureHex unchanged', async () => {
+    mockSignWithHotKey.mockResolvedValue({ signatureHex: '0xdeadbeef' });
+
+    const sig = await nativePlugin.signHotDigest('tag:payload', '0xfeedface');
+
+    expect(mockSignWithHotKey).toHaveBeenCalledWith({
+      ciphertext: 'tag:payload',
+      digestHex: '0xfeedface'
+    });
+    expect(sig).toBe('0xdeadbeef');
+  });
+
+  it('deleteHotKey forwards ciphertext to HotKey', async () => {
+    mockDeleteHotKey.mockResolvedValue(undefined);
+
+    await nativePlugin.deleteHotKey('tag:payload');
+
+    expect(mockDeleteHotKey).toHaveBeenCalledWith({ ciphertext: 'tag:payload' });
+  });
+});
+
+describe('secure-hot-key nativePlugin (Android)', () => {
+  beforeEach(() => {
+    mockIsIOS.mockReturnValue(false);
+    mockIsAndroid.mockReturnValue(true);
+  });
+
+  it.each([
+    ['generateHotKey', () => nativePlugin.generateHotKey()],
+    ['signHotDigest', () => nativePlugin.signHotDigest('tag:payload', '0x00')],
+    ['deleteHotKey', () => nativePlugin.deleteHotKey('tag:payload')]
+  ])('%s rejects with the Phase 4b sentinel', async (_name, op) => {
+    await expect(op()).rejects.toThrow('Phase 4b');
+    expect(mockGenerateHotKey).not.toHaveBeenCalled();
+    expect(mockSignWithHotKey).not.toHaveBeenCalled();
+    expect(mockDeleteHotKey).not.toHaveBeenCalled();
+  });
+});
diff --git a/src/lib/secure-hot-key/nativePlugin.ts b/src/lib/secure-hot-key/nativePlugin.ts
index 427acee54..3a5f528dd 100644
--- a/src/lib/secure-hot-key/nativePlugin.ts
+++ b/src/lib/secure-hot-key/nativePlugin.ts
@@ -1,22 +1,71 @@
 /**
- * Native plugin path for the secure-hot-key facade. Wired up in Phase 4 of the
- * 3-key migration. Until then, mobile builds fall back to throwing clearly so
- * the gap is visible during testing rather than silently degrading.
+ * Native plugin path for the secure-hot-key facade. iOS lands in Phase 4 of
+ * the 3-key migration (this commit); Android lands in Phase 4b and still
+ * throws so failures stay loud and traceable to that follow-up.
+ *
+ * Native side returns only ciphertext + raw k256 publicKeyHex (the SE blob
+ * embeds its own tag). The commitmentHex needed by MultisigClient.create is
+ * derived here via the SDK so the GeneratedHotKey shape matches jsFallback.
  */
 
+import { Buffer } from 'buffer';
+
+import { isAndroid, isIOS } from 'lib/platform';
+
+import { HotKey } from './hotKeyPlugin';
 import type { GeneratedHotKey } from './jsFallback';
 
-const NOT_IMPLEMENTED =
-  'secure-hot-key native plugin not yet implemented — Phase 4 of the 3-key migration adds the iOS/Android bridges';
+const ANDROID_NOT_IMPLEMENTED =
+  'secure-hot-key Android native plugin not yet implemented — Phase 4b of the 3-key migration adds the StrongBox bridge';
 
 export async function generateHotKey(): Promise<GeneratedHotKey> {
-  throw new Error(NOT_IMPLEMENTED);
+  if (isAndroid()) {
+    throw new Error(ANDROID_NOT_IMPLEMENTED);
+  }
+  if (!isIOS()) {
+    throw new Error('secure-hot-key native plugin invoked outside iOS/Android');
+  }
+
+  const { ciphertext, publicKeyHex } = await HotKey.generateHotKey();
+  const commitmentHex = await commitmentFromPublicKeyHex(publicKeyHex);
+  return { ciphertext, publicKeyHex, commitmentHex };
 }
 
-export async function signHotDigest(_ciphertext: string, _wordHex: string): Promise<string> {
-  throw new Error(NOT_IMPLEMENTED);
+export async function signHotDigest(ciphertext: string, wordHex: string): Promise<string> {
+  if (isAndroid()) {
+    throw new Error(ANDROID_NOT_IMPLEMENTED);
+  }
+  if (!isIOS()) {
+    throw new Error('secure-hot-key native plugin invoked outside iOS/Android');
+  }
+
+  const { signatureHex } = await HotKey.signWithHotKey({
+    ciphertext,
+    digestHex: wordHex
+  });
+  return signatureHex;
+}
+
+export async function deleteHotKey(ciphertext: string): Promise<void> {
+  if (isAndroid()) {
+    throw new Error(ANDROID_NOT_IMPLEMENTED);
+  }
+  if (!isIOS()) {
+    throw new Error('secure-hot-key native plugin invoked outside iOS/Android');
+  }
+
+  await HotKey.deleteHotKey({ ciphertext });
 }
 
-export async function deleteHotKey(_ciphertext: string): Promise<void> {
-  throw new Error(NOT_IMPLEMENTED);
+async function commitmentFromPublicKeyHex(publicKeyHex: string): Promise<string> {
+  const { PublicKey } = await import('@miden-sdk/miden-sdk/lazy');
+  const raw = Buffer.from(publicKeyHex, 'hex');
+  const framed = new Uint8Array(raw.length + 1);
+  console.log(`raw public key ${publicKeyHex} for commitment derivation`);
+  if (raw.length !== 33) {
+    throw new Error(`unexpected public key length ${raw.length} (expected 33)`);
+  }
+  framed[0] = 1; // uncompressed k256 pubkey tag
+  framed.set(raw, 1);
+  return PublicKey.deserialize(framed).toCommitment().toHex();
 }

From ab9fee598a7c0e008622434829dd8a1b143b10cd Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Mon, 4 May 2026 23:41:51 +0530
Subject: [PATCH 40/71] fix(mobile): drop inlineDynamicImports to avoid TLA
 wrapper crash in JSCore

---
 vite.mobile.config.ts | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/vite.mobile.config.ts b/vite.mobile.config.ts
index 683aa5983..50e0c1316 100644
--- a/vite.mobile.config.ts
+++ b/vite.mobile.config.ts
@@ -134,8 +134,13 @@ export default defineConfig({
       output: {
         entryFileNames: '[name].js',
         chunkFileNames: 'chunks/[name].[hash].js',
-        assetFileNames: 'static/[name].[hash][extname]',
-        inlineDynamicImports: true
+        assetFileNames: 'static/[name].[hash][extname]'
+        // NB: inlineDynamicImports was true here, but rolldown-vite (Vite 8)
+        // emits non-async arrow wrappers around inlined TLA-using modules
+        // (e.g. @miden-sdk/miden-sdk/lazy → `(()=>{ await _V() })`), which
+        // JavaScriptCore rejects with "SyntaxError: Unexpected identifier
+        // '_V'". Letting dynamic imports stay as real chunks keeps the TLA
+        // contained to module-level where the runtime supports it.
       }
     }
   },

From 973bd74f0d761d3ac8cfcaf93ee23132b71b473e Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Mon, 4 May 2026 23:57:46 +0530
Subject: [PATCH 41/71] feat(android): StrongBox-backed HotKey plugin with
 recoverable secp256k1

---
 CHANGELOG.md                                  |   2 +-
 android/.idea/deploymentTargetSelector.xml    |   1 +
 android/app/build.gradle                      |   4 +
 android/app/proguard-rules.pro                |   6 +
 .../java/com/miden/wallet/HotKeyPlugin.kt     | 495 ++++++++++++++++++
 .../java/com/miden/wallet/MainActivity.java   |   1 +
 src/lib/secure-hot-key/nativePlugin.test.ts   | 119 +++--
 src/lib/secure-hot-key/nativePlugin.ts        |  43 +-
 8 files changed, 592 insertions(+), 79 deletions(-)
 create mode 100644 android/app/src/main/java/com/miden/wallet/HotKeyPlugin.kt

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 513a3110b..230dc5c35 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,7 @@
 ### Features
 
 <<<<<<< utk-psm-integration
-* [FEATURE][all] 3-key Guardian accounts. Guardian creation now provisions a hot ECDSA key (random, lives outside the WASM keystore behind a new `secure-hot-key` facade — extension/desktop use a JS fallback today; mobile native plugin lands in Phase 4) plus an HD-derived cold ECDSA key (kept in the SDK keystore for cold-routed flows) alongside the existing guardian co-signer. Threshold stays at 1 (hot OR cold + guardian); cold-only routing for `update_signers` / `update_guardian` / `update_procedure_threshold` is enforced client-side per the Phase 0 SDK reading. Storage adds `accColdSecretKeyStrgKey` and `WalletAccount.{hotPublicKey,coldPublicKey}` so role-aware `signWord` (Phase 3) can dispatch hot vs cold by storage entity. Hard cutover from the 1-of-1 Falcon scheme — pre-cutover Guardian accounts are unreachable from this build.
+* [FEATURE][all] 3-key Guardian accounts. Guardian creation now provisions a hot ECDSA key (random, lives outside the WASM keystore behind a new `secure-hot-key` facade — extension/desktop use a JS fallback; iOS wraps the secret under a per-account Secure Enclave P-256 key via `HotKeyPlugin.swift`; Android wraps it under a per-account StrongBox-backed RSA-OAEP key via `HotKeyPlugin.kt` with biometric-gated unwrap, identical wire format on both platforms) plus an HD-derived cold ECDSA key (kept in the SDK keystore for cold-routed flows) alongside the existing guardian co-signer. Threshold stays at 1 (hot OR cold + guardian); cold-only routing for `update_signers` / `update_guardian` / `update_procedure_threshold` is enforced client-side per the Phase 0 SDK reading. Storage adds `accColdSecretKeyStrgKey` and `WalletAccount.{hotPublicKey,coldPublicKey}` so role-aware `signWord` (Phase 3) can dispatch hot vs cold by storage entity. Hard cutover from the 1-of-1 Falcon scheme — pre-cutover Guardian accounts are unreachable from this build.
 * [FEATURE][all] Guardian integration. Adds Guardian-backed accounts (1-of-1 multisig with on-chain Guardian signature verification), onboarding create/import flows with a dedicated recovery-method screen that accepts a custom guardian URL, Settings → Guardian Settings with an on-chain switch-guardian proposal that re-registers post-switch state with the new endpoint, service-worker routing for Guardian transaction signing via `MultisigService`, frontend Guardian sync outside the WASM lock, and per-stage progress labels (`creating-proposal`, `signing-proposal`, `submitting`, `registering-guardian`) in the transaction modal.
 =======
 * [FEATURE][ci] **Linked Web SDK PR pattern.** Wallet PRs that depend on an unpublished `@miden-sdk/miden-sdk` or `@miden-sdk/react` change can now include `Web SDK PR: #N` in the description. CI's new `.github/actions/inject-linked-web-sdk-pr` action clones the linked web-sdk PR, builds the SDK packages from source, and rewrites `package.json` to consume them via `file:` deps — so the wallet PR's CI builds against the actual upstream change without requiring it to publish first. A separate `check-linked-web-sdk-pr.yml` workflow keeps a `linked-web-sdk-pr-ready` commit status pending until the linked PR is merged AND a web-sdk release tag covering its merge commit is published, with a 15-min cron re-evaluation so the gate auto-flips green without re-pushing. Local-dev parity via `scripts/dev-with-web-sdk-pr.sh` (with `--clear`); a new `lefthook.yml` pre-commit hook blocks committing the patched state. Mirrors web-sdk's existing `Client PR: #N` pattern. See "Linked Web SDK PR (cross-repo CI)" in CLAUDE.md for full details. (#231)
diff --git a/android/.idea/deploymentTargetSelector.xml b/android/.idea/deploymentTargetSelector.xml
index b268ef36c..ca16a995c 100644
--- a/android/.idea/deploymentTargetSelector.xml
+++ b/android/.idea/deploymentTargetSelector.xml
@@ -4,6 +4,7 @@
     <selectionStates>
       <SelectionState runConfigName="app">
         <option name="selectionMode" value="DROPDOWN" />
+        <DialogSelection />
       </SelectionState>
     </selectionStates>
   </component>
diff --git a/android/app/build.gradle b/android/app/build.gradle
index 99c3b8e49..01b926e97 100644
--- a/android/app/build.gradle
+++ b/android/app/build.gradle
@@ -65,6 +65,10 @@ dependencies {
     implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
     // Biometric authentication for hardware security
     implementation 'androidx.biometric:biometric:1.1.0'
+    // secp256k1 ECDSA + Keccak-256 for the Guardian hot-key signing path
+    // (HotKeyPlugin). Keystore wraps the 32-byte k256 secret with RSA-OAEP;
+    // BouncyCastle handles everything outside the Keystore boundary.
+    implementation 'org.bouncycastle:bcprov-jdk18on:1.78.1'
 }
 
 apply from: 'capacitor.build.gradle'
diff --git a/android/app/proguard-rules.pro b/android/app/proguard-rules.pro
index 4c549e886..b2835525e 100644
--- a/android/app/proguard-rules.pro
+++ b/android/app/proguard-rules.pro
@@ -70,6 +70,12 @@
 -keep class com.niceforyou.capacitor.barcodescanner.** { *; }
 -keep class com.google.mlkit.vision.barcode.** { *; }
 
+# BouncyCastle (secp256k1 + Keccak-256) — used by HotKeyPlugin for the
+# Guardian hot-key signing path. Keep the low-level crypto + asn1 classes
+# we touch reflectively via JCE provider lookup paths.
+-keep class org.bouncycastle.** { *; }
+-keep class com.miden.wallet.HotKeyPlugin { *; }
+
 # Don't warn about missing classes in optional dependencies
 -dontwarn org.conscrypt.**
 -dontwarn org.bouncycastle.**
diff --git a/android/app/src/main/java/com/miden/wallet/HotKeyPlugin.kt b/android/app/src/main/java/com/miden/wallet/HotKeyPlugin.kt
new file mode 100644
index 000000000..51bfdb52b
--- /dev/null
+++ b/android/app/src/main/java/com/miden/wallet/HotKeyPlugin.kt
@@ -0,0 +1,495 @@
+package com.miden.wallet
+
+import android.os.Build
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyProperties
+import android.security.keystore.StrongBoxUnavailableException
+import android.util.Base64
+import android.util.Log
+import androidx.biometric.BiometricManager
+import androidx.biometric.BiometricPrompt
+import androidx.core.content.ContextCompat
+import androidx.fragment.app.FragmentActivity
+import com.getcapacitor.JSObject
+import com.getcapacitor.Plugin
+import com.getcapacitor.PluginCall
+import com.getcapacitor.PluginMethod
+import com.getcapacitor.annotation.CapacitorPlugin
+import org.bouncycastle.asn1.sec.SECNamedCurves
+import org.bouncycastle.crypto.digests.SHA256Digest
+import org.bouncycastle.crypto.params.ECDomainParameters
+import org.bouncycastle.crypto.params.ECPrivateKeyParameters
+import org.bouncycastle.crypto.signers.ECDSASigner
+import org.bouncycastle.crypto.signers.HMacDSAKCalculator
+import org.bouncycastle.jcajce.provider.digest.Keccak
+import org.bouncycastle.math.ec.ECAlgorithms
+import org.bouncycastle.math.ec.ECPoint
+import java.math.BigInteger
+import java.security.KeyPairGenerator
+import java.security.KeyStore
+import java.security.PrivateKey
+import java.security.PublicKey
+import java.security.SecureRandom
+import java.security.spec.MGF1ParameterSpec
+import javax.crypto.Cipher
+import javax.crypto.spec.OAEPParameterSpec
+import javax.crypto.spec.PSource
+
+// Per-account Guardian "hot" signing key (3-key migration, Phase 4b — Android
+// counterpart of ios/App/App/HotKeyPlugin.swift).
+//
+// Storage layout mirrors iOS so the JS facade stays platform-agnostic:
+//   - Per-account RSA-2048 key in Android Keystore aliased
+//     "com.miden.wallet.hot.<b64-suffix>", StrongBox-backed when available,
+//     auth-bound on the private key only (encrypt with the public key needs
+//     no auth, decrypt does — same shape as the iOS SE ECIES path).
+//   - Returned ciphertext is "<b64-suffix>:<b64-OAEP-payload>" so signWith /
+//     deleteWith can recover the alias from the blob alone.
+//
+// The k256 secret is wrapped with RSA-OAEP-SHA-256 because Android Keystore
+// can't do EC-encrypt directly; iOS uses ECIES (the SE-native primitive). The
+// wire format (`<suffix>:<payload>`) and signature format (`0x<r||s||v>`,
+// 65 bytes hex) are identical across both platforms.
+@CapacitorPlugin(name = "HotKey")
+class HotKeyPlugin : Plugin() {
+
+    companion object {
+        private const val TAG = "HotKey"
+        private const val ANDROID_KEYSTORE = "AndroidKeyStore"
+        private const val KEY_ALIAS_PREFIX = "com.miden.wallet.hot."
+        private const val OAEP_TRANSFORMATION = "RSA/ECB/OAEPWithSHA-256AndMGF1Padding"
+
+        // BC's secp256k1 domain parameters; reused by every sign call.
+        private val SECP256K1 = SECNamedCurves.getByName("secp256k1")
+        private val DOMAIN = ECDomainParameters(SECP256K1.curve, SECP256K1.g, SECP256K1.n, SECP256K1.h)
+        private val HALF_N: BigInteger = SECP256K1.n.shiftRight(1)
+    }
+
+    private var pendingCall: PluginCall? = null
+    private var pendingPayload: ByteArray? = null
+    private var pendingDigest: ByteArray? = null
+
+    @PluginMethod
+    fun generateHotKey(call: PluginCall) {
+        Log.d(TAG, "generateHotKey called")
+
+        val secretBytes = ByteArray(32)
+        var alias: String? = null
+        try {
+            // 1. Random k256 secret + compressed (33-byte: 0x02/0x03 || x) public key.
+            //    iOS returns the same 33-byte form; commitmentFromPublicKeyHex on the
+            //    JS side rejects anything else.
+            SecureRandom().nextBytes(secretBytes)
+            val publicKeyHex = derivePublicKeyHex(secretBytes)
+
+            // 2. 16-byte tag suffix → base64; full Keystore alias = prefix + suffix.
+            val tagSuffix = ByteArray(16)
+            SecureRandom().nextBytes(tagSuffix)
+            val tagSuffixB64 = Base64.encodeToString(tagSuffix, Base64.NO_WRAP)
+            alias = KEY_ALIAS_PREFIX + tagSuffixB64
+
+            // 3. Generate the per-account RSA wrapper key (StrongBox-preferred,
+            //    auth-bound private). Public-key encrypt below needs no auth.
+            val wrapperPub = generateKeystoreWrapperKey(alias)
+
+            // 4. RSA-OAEP-SHA-256 wrap the k256 secret. Same role as the iOS
+            //    eciesEncryptionStandardX963SHA256AESGCM blob — opaque to JS.
+            val cipher = Cipher.getInstance(OAEP_TRANSFORMATION)
+            cipher.init(Cipher.ENCRYPT_MODE, wrapperPub, oaepParams())
+            val wrapped = cipher.doFinal(secretBytes)
+
+            // 5. Pack into "<base64-tag>:<base64-payload>" so signWithHotKey can
+            //    recover the alias from the ciphertext alone.
+            val packed = tagSuffixB64 + ":" + Base64.encodeToString(wrapped, Base64.NO_WRAP)
+
+            val result = JSObject()
+            result.put("ciphertext", packed)
+            result.put("publicKeyHex", publicKeyHex)
+            Log.d(TAG, "generateHotKey success")
+            call.resolve(result)
+        } catch (e: Exception) {
+            Log.e(TAG, "generateHotKey failed: ${e.message}", e)
+            // Best-effort cleanup of the orphan Keystore key we may have just created.
+            alias?.let { deleteAliasQuietly(it) }
+            call.reject("Failed to generate hot key: ${e.message}")
+        } finally {
+            zero(secretBytes)
+        }
+    }
+
+    /// Unwrap the hot-key secret inside the Keystore (triggers BiometricPrompt),
+    /// Keccak-256 the supplied 32-byte word, ECDSA-sign (recoverable) over
+    /// secp256k1, and return r||s||v as 0x-prefixed hex (65 bytes). The
+    /// unwrapped secret is zeroed before returning.
+    @PluginMethod
+    fun signWithHotKey(call: PluginCall) {
+        Log.d(TAG, "signWithHotKey called")
+
+        val ciphertext = call.getString("ciphertext")
+        val digestHex = call.getString("digestHex")
+        if (ciphertext == null || digestHex == null) {
+            call.reject("Missing 'ciphertext' or 'digestHex' parameter")
+            return
+        }
+
+        try {
+            // 1. Split tag from payload.
+            val (alias, payload) = parseCiphertext(ciphertext)
+
+            // 2. Decode the digest (caller passes it 0x-prefixed, matching
+            //    Word.toHex()). Must be 32 bytes — Miden Words are 4 felts × 8.
+            val cleaned = if (digestHex.startsWith("0x")) digestHex.substring(2) else digestHex
+            val digestBytes = hexDecode(cleaned)
+            if (digestBytes.size != 32) {
+                call.reject("Hot-key digest must be 32 hex bytes")
+                return
+            }
+
+            // 3. Look up the Keystore wrapper private key by alias.
+            val keyStore = KeyStore.getInstance(ANDROID_KEYSTORE)
+            keyStore.load(null)
+            val privateKey = keyStore.getKey(alias, null) as? PrivateKey
+            if (privateKey == null) {
+                Log.e(TAG, "signWithHotKey: Keystore key not found at $alias")
+                call.reject("Hot-key Keystore key not found", "KEY_NOT_FOUND")
+                return
+            }
+
+            // 4. Initialize the OAEP cipher in DECRYPT_MODE; the actual doFinal
+            //    runs inside the BiometricPrompt callback, which is what gates
+            //    the unwrap on user presence (mirrors SecKeyCreateDecryptedData
+            //    on iOS).
+            val cipher = Cipher.getInstance(OAEP_TRANSFORMATION)
+            cipher.init(Cipher.DECRYPT_MODE, privateKey, oaepParams())
+
+            pendingCall = call
+            pendingPayload = payload
+            pendingDigest = digestBytes
+            promptForBiometric(cipher)
+        } catch (e: Exception) {
+            Log.e(TAG, "signWithHotKey failed: ${e.message}", e)
+            call.reject("Hot-key sign failed: ${e.message}")
+        }
+    }
+
+    /// Delete the per-account Keystore hot key. Idempotent — a missing alias
+    /// resolves successfully so callers can call this during account deletion
+    /// without branching on existence.
+    @PluginMethod
+    fun deleteHotKey(call: PluginCall) {
+        Log.d(TAG, "deleteHotKey called")
+
+        val ciphertext = call.getString("ciphertext")
+        if (ciphertext == null) {
+            call.reject("Missing 'ciphertext' parameter")
+            return
+        }
+
+        try {
+            val parts = ciphertext.split(":", limit = 2)
+            if (parts.isEmpty() || parts[0].isEmpty()) {
+                call.reject("Malformed hot-key ciphertext")
+                return
+            }
+            val alias = KEY_ALIAS_PREFIX + parts[0]
+            deleteAliasQuietly(alias)
+            Log.d(TAG, "deleteHotKey resolved")
+            call.resolve()
+        } catch (e: Exception) {
+            Log.e(TAG, "deleteHotKey failed: ${e.message}", e)
+            call.reject("Failed to delete hot key: ${e.message}")
+        }
+    }
+
+    // -- Biometric prompt + post-auth sign ------------------------------------
+
+    private fun promptForBiometric(cipher: Cipher) {
+        val activity = activity as? FragmentActivity
+        if (activity == null) {
+            failPending("Activity not available")
+            return
+        }
+
+        val executor = ContextCompat.getMainExecutor(context)
+        val callback = object : BiometricPrompt.AuthenticationCallback() {
+            override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
+                Log.d(TAG, "Biometric authentication succeeded for hot-key sign")
+                val cryptoCipher = result.cryptoObject?.cipher
+                val payload = pendingPayload
+                val digest = pendingDigest
+                val pendingCallLocal = pendingCall
+                pendingCall = null
+                pendingPayload = null
+                pendingDigest = null
+
+                if (cryptoCipher == null || payload == null || digest == null || pendingCallLocal == null) {
+                    pendingCallLocal?.reject("Cipher not available after authentication")
+                    return
+                }
+
+                var unwrapped: ByteArray? = null
+                try {
+                    unwrapped = cryptoCipher.doFinal(payload)
+                    if (unwrapped.size != 32) {
+                        pendingCallLocal.reject("Unwrapped hot-key has wrong length")
+                        return
+                    }
+                    val signatureHex = signRecoverable(unwrapped, digest)
+                    val res = JSObject()
+                    res.put("signatureHex", signatureHex)
+                    Log.d(TAG, "signWithHotKey success")
+                    pendingCallLocal.resolve(res)
+                } catch (e: Exception) {
+                    Log.e(TAG, "Hot-key sign post-auth failed: ${e.message}", e)
+                    pendingCallLocal.reject("Hot-key sign failed: ${e.message}")
+                } finally {
+                    unwrapped?.let { zero(it) }
+                }
+            }
+
+            override fun onAuthenticationError(errorCode: Int, errString: CharSequence) {
+                Log.e(TAG, "Biometric authentication error: $errorCode - $errString")
+                val pendingCallLocal = pendingCall
+                pendingCall = null
+                pendingPayload = null
+                pendingDigest = null
+                when (errorCode) {
+                    BiometricPrompt.ERROR_USER_CANCELED,
+                    BiometricPrompt.ERROR_NEGATIVE_BUTTON ->
+                        pendingCallLocal?.reject("Authentication cancelled", "USER_CANCELLED")
+                    else ->
+                        pendingCallLocal?.reject("Authentication failed: $errString", "AUTH_FAILED")
+                }
+            }
+
+            override fun onAuthenticationFailed() {
+                Log.d(TAG, "Biometric authentication failed (user can retry)")
+            }
+        }
+
+        // Match HardwareSecurityPlugin: biometric-strong OR device credential,
+        // no negative button (DEVICE_CREDENTIAL forbids it).
+        val promptInfo = BiometricPrompt.PromptInfo.Builder()
+            .setTitle("Miden Wallet")
+            .setSubtitle("Sign transaction")
+            .setAllowedAuthenticators(
+                BiometricManager.Authenticators.BIOMETRIC_STRONG or
+                    BiometricManager.Authenticators.DEVICE_CREDENTIAL
+            )
+            .build()
+
+        activity.runOnUiThread {
+            val biometricPrompt = BiometricPrompt(activity, executor, callback)
+            biometricPrompt.authenticate(promptInfo, BiometricPrompt.CryptoObject(cipher))
+        }
+    }
+
+    private fun failPending(msg: String) {
+        val pendingCallLocal = pendingCall
+        pendingCall = null
+        pendingPayload = null
+        pendingDigest = null
+        pendingCallLocal?.reject(msg)
+    }
+
+    // -- Keystore wrapper key -------------------------------------------------
+
+    private fun generateKeystoreWrapperKey(alias: String): PublicKey {
+        // StrongBox first when the hardware supports it; fall back to TEE on
+        // StrongBoxUnavailableException so older devices still work. Pattern
+        // intentionally tries StrongBox, catches the throw, rebuilds without
+        // the flag — same trade-off the iOS plugin makes when omitting
+        // kSecAttrTokenIDSecureEnclave on simulator.
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
+            try {
+                return generateRsaWrapperKey(alias, strongBox = true)
+            } catch (e: StrongBoxUnavailableException) {
+                Log.w(TAG, "StrongBox unavailable, falling back to TEE")
+                deleteAliasQuietly(alias) // partial init can leave a stale entry
+            }
+        }
+        return generateRsaWrapperKey(alias, strongBox = false)
+    }
+
+    private fun generateRsaWrapperKey(alias: String, strongBox: Boolean): PublicKey {
+        val gen = KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_RSA, ANDROID_KEYSTORE)
+        val builder = KeyGenParameterSpec.Builder(
+            alias,
+            KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
+        )
+            .setKeySize(2048)
+            .setDigests(KeyProperties.DIGEST_SHA256)
+            .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_OAEP)
+            .setUserAuthenticationRequired(true)
+
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+            // Android 11+: biometric-strong OR device credential, every-use auth.
+            builder.setUserAuthenticationParameters(
+                0,
+                KeyProperties.AUTH_BIOMETRIC_STRONG or KeyProperties.AUTH_DEVICE_CREDENTIAL
+            )
+        } else {
+            @Suppress("DEPRECATION")
+            builder.setUserAuthenticationValidityDurationSeconds(-1)
+        }
+
+        if (strongBox && Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
+            builder.setIsStrongBoxBacked(true)
+        }
+
+        gen.initialize(builder.build())
+        return gen.generateKeyPair().public
+    }
+
+    private fun deleteAliasQuietly(alias: String) {
+        try {
+            val keyStore = KeyStore.getInstance(ANDROID_KEYSTORE)
+            keyStore.load(null)
+            if (keyStore.containsAlias(alias)) {
+                keyStore.deleteEntry(alias)
+            }
+        } catch (e: Exception) {
+            Log.w(TAG, "deleteAliasQuietly($alias) ignored: ${e.message}")
+        }
+    }
+
+    // -- secp256k1 + Keccak-256 -----------------------------------------------
+
+    /**
+     * Compressed secp256k1 public key (33 bytes: 0x02/0x03 parity prefix +
+     * 32-byte x). Matches what iOS returns via `P256K.Signing.PrivateKey
+     * .publicKey.dataRepresentation`; the JS facade asserts `length === 33`.
+     */
+    private fun derivePublicKeyHex(secret: ByteArray): String {
+        val d = BigInteger(1, secret)
+        val q = SECP256K1.g.multiply(d).normalize()
+        return q.getEncoded(true).toHex()
+    }
+
+    /**
+     * Keccak-256 the 32-byte word, then ECDSA-sign (recoverable) with
+     * deterministic-k (RFC 6979) over secp256k1. Returns r||s||v as a
+     * 0x-prefixed hex string (65 bytes). Matches the iOS plugin which uses
+     * libsecp256k1's `secp256k1_ecdsa_sign_recoverable`. We canonicalize s
+     * to the low half of n so signatures are uniquely-encoded — the iOS
+     * libsecp256k1 path does the same internally.
+     */
+    private fun signRecoverable(secret: ByteArray, digestBytes: ByteArray): String {
+        val keccak = Keccak.Digest256()
+        val hash = keccak.digest(digestBytes)
+
+        val d = BigInteger(1, secret)
+        val signer = ECDSASigner(HMacDSAKCalculator(SHA256Digest()))
+        signer.init(true, ECPrivateKeyParameters(d, DOMAIN))
+        val rs = signer.generateSignature(hash)
+        val r = rs[0]
+        var s = rs[1]
+        if (s > HALF_N) s = SECP256K1.n.subtract(s)
+
+        val pubKey = SECP256K1.g.multiply(d).normalize()
+        val v = computeRecoveryId(r, s, hash, pubKey)
+
+        val sig = ByteArray(65)
+        System.arraycopy(toFixed32(r), 0, sig, 0, 32)
+        System.arraycopy(toFixed32(s), 0, sig, 32, 32)
+        sig[64] = v
+        return "0x" + sig.toHex()
+    }
+
+    private fun computeRecoveryId(r: BigInteger, s: BigInteger, hash: ByteArray, expected: ECPoint): Byte {
+        // For low-s canonical signatures with x < n there are at most 2
+        // candidates (recId 0 and 1). Try both, pick the one that recovers
+        // back to the signer's actual public key.
+        for (recId in 0..1) {
+            val recovered = recoverPubKey(r, s, hash, recId)
+            if (recovered != null && recovered.equals(expected)) {
+                return recId.toByte()
+            }
+        }
+        throw IllegalStateException("ECDSA recovery id derivation failed")
+    }
+
+    private fun recoverPubKey(r: BigInteger, s: BigInteger, hash: ByteArray, recId: Int): ECPoint? {
+        val n = SECP256K1.n
+        val curve = SECP256K1.curve
+        val prime = curve.field.characteristic
+        val i = BigInteger.valueOf((recId / 2).toLong())
+        val x = r.add(i.multiply(n))
+        if (x >= prime) return null
+        val R = decompressPoint(x, recId and 1 == 1) ?: return null
+        if (!R.multiply(n).isInfinity) return null
+        val e = BigInteger(1, hash)
+        val rInv = r.modInverse(n)
+        val srInv = rInv.multiply(s).mod(n)
+        val eInvrInv = rInv.multiply(n.subtract(e)).mod(n)
+        return ECAlgorithms.sumOfTwoMultiplies(SECP256K1.g, eInvrInv, R, srInv).normalize()
+    }
+
+    private fun decompressPoint(x: BigInteger, yOdd: Boolean): ECPoint? {
+        return try {
+            val enc = ByteArray(33)
+            enc[0] = if (yOdd) 0x03 else 0x02
+            val xb = toFixed32(x)
+            System.arraycopy(xb, 0, enc, 1, 32)
+            SECP256K1.curve.decodePoint(enc)
+        } catch (e: Exception) {
+            null
+        }
+    }
+
+    // -- Helpers ---------------------------------------------------------------
+
+    private fun parseCiphertext(ct: String): Pair<String, ByteArray> {
+        val parts = ct.split(":", limit = 2)
+        if (parts.size != 2 || parts[0].isEmpty()) {
+            throw IllegalArgumentException("Malformed hot-key ciphertext")
+        }
+        val alias = KEY_ALIAS_PREFIX + parts[0]
+        val payload = Base64.decode(parts[1], Base64.NO_WRAP)
+        return alias to payload
+    }
+
+    private fun oaepParams(): OAEPParameterSpec =
+        // Explicit OAEP params: Android Keystore's default MGF1 digest is
+        // SHA-1, which mismatches the SHA-256 main digest we set above.
+        // Spelling it out keeps encrypt and decrypt agreeing.
+        OAEPParameterSpec("SHA-256", "MGF1", MGF1ParameterSpec.SHA256, PSource.PSpecified.DEFAULT)
+
+    private fun toFixed32(v: BigInteger): ByteArray {
+        val raw = v.toByteArray()
+        if (raw.size == 32) return raw
+        if (raw.size == 33 && raw[0] == 0.toByte()) {
+            val out = ByteArray(32)
+            System.arraycopy(raw, 1, out, 0, 32)
+            return out
+        }
+        if (raw.size < 32) {
+            val out = ByteArray(32)
+            System.arraycopy(raw, 0, out, 32 - raw.size, raw.size)
+            return out
+        }
+        throw IllegalStateException("BigInteger too large for 32-byte fixed buffer: ${raw.size}")
+    }
+
+    private fun ByteArray.toHex(): String {
+        val sb = StringBuilder(size * 2)
+        for (b in this) sb.append(String.format("%02x", b))
+        return sb.toString()
+    }
+
+    private fun hexDecode(s: String): ByteArray {
+        if (s.length % 2 != 0) throw IllegalArgumentException("invalid hex length")
+        val out = ByteArray(s.length / 2)
+        for (i in out.indices) {
+            val hi = Character.digit(s[i * 2], 16)
+            val lo = Character.digit(s[i * 2 + 1], 16)
+            if (hi < 0 || lo < 0) throw IllegalArgumentException("invalid hex char")
+            out[i] = ((hi shl 4) + lo).toByte()
+        }
+        return out
+    }
+
+    private fun zero(b: ByteArray) {
+        for (i in b.indices) b[i] = 0
+    }
+}
diff --git a/android/app/src/main/java/com/miden/wallet/MainActivity.java b/android/app/src/main/java/com/miden/wallet/MainActivity.java
index 7eff59079..035eca7ec 100644
--- a/android/app/src/main/java/com/miden/wallet/MainActivity.java
+++ b/android/app/src/main/java/com/miden/wallet/MainActivity.java
@@ -17,6 +17,7 @@ public class MainActivity extends BridgeActivity {
     protected void onCreate(Bundle savedInstanceState) {
         // Register custom plugins before super.onCreate
         registerPlugin(HardwareSecurityPlugin.class);
+        registerPlugin(HotKeyPlugin.class);
 
         super.onCreate(savedInstanceState);
         setupStatusBar();
diff --git a/src/lib/secure-hot-key/nativePlugin.test.ts b/src/lib/secure-hot-key/nativePlugin.test.ts
index 4515e7168..2d4d308b2 100644
--- a/src/lib/secure-hot-key/nativePlugin.test.ts
+++ b/src/lib/secure-hot-key/nativePlugin.test.ts
@@ -1,9 +1,12 @@
 /**
- * Wrapper-level test for the iOS native hot-key path. This does NOT validate
+ * Wrapper-level test for the native hot-key path. This does NOT validate
  * byte-for-byte ECDSA wire-format parity against the WASM SDK — that gate is
  * the manual on-device run. What we do guard here:
- *  - iOS path forwards generate / sign / delete to the HotKey plugin.
- *  - Android path throws the dedicated Phase 4b sentinel.
+ *  - iOS and Android both forward generate / sign / delete to the HotKey
+ *    plugin (same wire format on both platforms, see HotKeyPlugin.swift /
+ *    HotKeyPlugin.kt).
+ *  - Calling outside iOS/Android (e.g. extension/desktop) throws so callers
+ *    can't accidentally hit a no-op native bridge instead of the JS fallback.
  *  - The commitment derivation reframes the publicKey hex with the ECDSA
  *    type prefix (currently hardcoded as 0x01).
  */
@@ -39,77 +42,89 @@ import * as nativePlugin from './nativePlugin';
 
 beforeEach(() => {
   jest.clearAllMocks();
-  mockIsIOS.mockReturnValue(true);
+  mockIsIOS.mockReturnValue(false);
   mockIsAndroid.mockReturnValue(false);
 });
 
-describe('secure-hot-key nativePlugin (iOS)', () => {
-  it('generateHotKey forwards to HotKey and frames commitment with the 0x01 type prefix', async () => {
-    // Native plugin returns the compressed secp256k1 pubkey: 33 bytes
-    // (parity prefix + 32-byte x). The wrapper enforces this length and
-    // rejects anything else — see commitmentFromPublicKeyHex.
-    const compressedHex = '02' + 'ab'.repeat(32);
-    mockGenerateHotKey.mockResolvedValue({
-      ciphertext: 'tag:payload',
-      publicKeyHex: compressedHex
+const sharedForwardingSpec = (label: 'iOS' | 'Android', setPlatform: () => void) => {
+  describe(`secure-hot-key nativePlugin (${label})`, () => {
+    beforeEach(setPlatform);
+
+    it('generateHotKey forwards to HotKey and frames commitment with the 0x01 type prefix', async () => {
+      // Native plugin returns the compressed secp256k1 pubkey: 33 bytes
+      // (parity prefix + 32-byte x). The wrapper enforces this length and
+      // rejects anything else — see commitmentFromPublicKeyHex.
+      const compressedHex = '02' + 'ab'.repeat(32);
+      mockGenerateHotKey.mockResolvedValue({
+        ciphertext: 'tag:payload',
+        publicKeyHex: compressedHex
+      });
+
+      const out = await nativePlugin.generateHotKey();
+
+      expect(mockGenerateHotKey).toHaveBeenCalledTimes(1);
+      expect(out.ciphertext).toBe('tag:payload');
+      expect(out.publicKeyHex).toBe(compressedHex);
+
+      const framed = publicKeyDeserialize.mock.calls[0]?.[0];
+      expect(framed).toBeInstanceOf(Uint8Array);
+      expect(framed!.length).toBe(34); // 1 type prefix + 33 compressed pubkey
+      expect(framed![0]).toBe(1); // type prefix
+      expect(framed![1]).toBe(0x02); // first byte of compressed pubkey
+      expect(out.commitmentHex).toMatch(/^0xcommit:1,2(,171){32}$/);
     });
 
-    const out = await nativePlugin.generateHotKey();
-
-    expect(mockGenerateHotKey).toHaveBeenCalledTimes(1);
-    expect(out.ciphertext).toBe('tag:payload');
-    expect(out.publicKeyHex).toBe(compressedHex);
-
-    const framed = publicKeyDeserialize.mock.calls[0]?.[0];
-    expect(framed).toBeInstanceOf(Uint8Array);
-    expect(framed!.length).toBe(34); // 1 type prefix + 33 compressed pubkey
-    expect(framed![0]).toBe(1); // type prefix
-    expect(framed![1]).toBe(0x02); // first byte of compressed pubkey
-    expect(out.commitmentHex).toMatch(/^0xcommit:1,2(,171){32}$/);
-  });
+    it('generateHotKey rejects when native returns a non-33-byte public key', async () => {
+      mockGenerateHotKey.mockResolvedValue({
+        ciphertext: 'tag:payload',
+        publicKeyHex: 'aabbcc' // only 3 bytes
+      });
 
-  it('generateHotKey rejects when native returns a non-33-byte public key', async () => {
-    mockGenerateHotKey.mockResolvedValue({
-      ciphertext: 'tag:payload',
-      publicKeyHex: 'aabbcc' // only 3 bytes
+      await expect(nativePlugin.generateHotKey()).rejects.toThrow('unexpected public key length 3 (expected 33)');
     });
 
-    await expect(nativePlugin.generateHotKey()).rejects.toThrow('unexpected public key length 3 (expected 33)');
-  });
-
-  it('signHotDigest forwards ciphertext + digest and returns the native signatureHex unchanged', async () => {
-    mockSignWithHotKey.mockResolvedValue({ signatureHex: '0xdeadbeef' });
+    it('signHotDigest forwards ciphertext + digest and returns the native signatureHex unchanged', async () => {
+      mockSignWithHotKey.mockResolvedValue({ signatureHex: '0xdeadbeef' });
 
-    const sig = await nativePlugin.signHotDigest('tag:payload', '0xfeedface');
+      const sig = await nativePlugin.signHotDigest('tag:payload', '0xfeedface');
 
-    expect(mockSignWithHotKey).toHaveBeenCalledWith({
-      ciphertext: 'tag:payload',
-      digestHex: '0xfeedface'
+      expect(mockSignWithHotKey).toHaveBeenCalledWith({
+        ciphertext: 'tag:payload',
+        digestHex: '0xfeedface'
+      });
+      expect(sig).toBe('0xdeadbeef');
     });
-    expect(sig).toBe('0xdeadbeef');
-  });
 
-  it('deleteHotKey forwards ciphertext to HotKey', async () => {
-    mockDeleteHotKey.mockResolvedValue(undefined);
+    it('deleteHotKey forwards ciphertext to HotKey', async () => {
+      mockDeleteHotKey.mockResolvedValue(undefined);
 
-    await nativePlugin.deleteHotKey('tag:payload');
+      await nativePlugin.deleteHotKey('tag:payload');
 
-    expect(mockDeleteHotKey).toHaveBeenCalledWith({ ciphertext: 'tag:payload' });
+      expect(mockDeleteHotKey).toHaveBeenCalledWith({ ciphertext: 'tag:payload' });
+    });
   });
+};
+
+sharedForwardingSpec('iOS', () => {
+  mockIsIOS.mockReturnValue(true);
+  mockIsAndroid.mockReturnValue(false);
 });
 
-describe('secure-hot-key nativePlugin (Android)', () => {
-  beforeEach(() => {
-    mockIsIOS.mockReturnValue(false);
-    mockIsAndroid.mockReturnValue(true);
-  });
+sharedForwardingSpec('Android', () => {
+  mockIsIOS.mockReturnValue(false);
+  mockIsAndroid.mockReturnValue(true);
+});
 
+describe('secure-hot-key nativePlugin (non-mobile guard)', () => {
+  // Off-mobile (extension/desktop) should never hit this module — secure-hot-key
+  // routes to jsFallback there. Belt-and-braces: every export throws so a
+  // misrouting is loud rather than a silent no-op.
   it.each([
     ['generateHotKey', () => nativePlugin.generateHotKey()],
     ['signHotDigest', () => nativePlugin.signHotDigest('tag:payload', '0x00')],
     ['deleteHotKey', () => nativePlugin.deleteHotKey('tag:payload')]
-  ])('%s rejects with the Phase 4b sentinel', async (_name, op) => {
-    await expect(op()).rejects.toThrow('Phase 4b');
+  ])('%s rejects when invoked outside iOS/Android', async (_name, op) => {
+    await expect(op()).rejects.toThrow('outside iOS/Android');
     expect(mockGenerateHotKey).not.toHaveBeenCalled();
     expect(mockSignWithHotKey).not.toHaveBeenCalled();
     expect(mockDeleteHotKey).not.toHaveBeenCalled();
diff --git a/src/lib/secure-hot-key/nativePlugin.ts b/src/lib/secure-hot-key/nativePlugin.ts
index 3a5f528dd..ff7e849dc 100644
--- a/src/lib/secure-hot-key/nativePlugin.ts
+++ b/src/lib/secure-hot-key/nativePlugin.ts
@@ -1,9 +1,13 @@
 /**
- * Native plugin path for the secure-hot-key facade. iOS lands in Phase 4 of
- * the 3-key migration (this commit); Android lands in Phase 4b and still
- * throws so failures stay loud and traceable to that follow-up.
+ * Native plugin path for the secure-hot-key facade. iOS landed in Phase 4a of
+ * the 3-key migration (Secure Enclave-wrapped k256 secret); Android landed in
+ * Phase 4b (Android Keystore RSA-OAEP-wrapped k256 secret, StrongBox-preferred).
+ * Both platforms register the same `HotKey` Capacitor plugin with an identical
+ * wire format: ciphertext is "<b64-tag>:<b64-payload>" and the signature is
+ * `0x<r||s||v>` (65 bytes hex), so this wrapper is platform-agnostic past the
+ * isMobile gate.
  *
- * Native side returns only ciphertext + raw k256 publicKeyHex (the SE blob
+ * Native side returns only ciphertext + raw k256 publicKeyHex (the wrap blob
  * embeds its own tag). The commitmentHex needed by MultisigClient.create is
  * derived here via the SDK so the GeneratedHotKey shape matches jsFallback.
  */
@@ -15,16 +19,14 @@ import { isAndroid, isIOS } from 'lib/platform';
 import { HotKey } from './hotKeyPlugin';
 import type { GeneratedHotKey } from './jsFallback';
 
-const ANDROID_NOT_IMPLEMENTED =
-  'secure-hot-key Android native plugin not yet implemented — Phase 4b of the 3-key migration adds the StrongBox bridge';
-
-export async function generateHotKey(): Promise<GeneratedHotKey> {
-  if (isAndroid()) {
-    throw new Error(ANDROID_NOT_IMPLEMENTED);
-  }
-  if (!isIOS()) {
+function assertMobile(): void {
+  if (!isIOS() && !isAndroid()) {
     throw new Error('secure-hot-key native plugin invoked outside iOS/Android');
   }
+}
+
+export async function generateHotKey(): Promise<GeneratedHotKey> {
+  assertMobile();
 
   const { ciphertext, publicKeyHex } = await HotKey.generateHotKey();
   const commitmentHex = await commitmentFromPublicKeyHex(publicKeyHex);
@@ -32,12 +34,7 @@ export async function generateHotKey(): Promise<GeneratedHotKey> {
 }
 
 export async function signHotDigest(ciphertext: string, wordHex: string): Promise<string> {
-  if (isAndroid()) {
-    throw new Error(ANDROID_NOT_IMPLEMENTED);
-  }
-  if (!isIOS()) {
-    throw new Error('secure-hot-key native plugin invoked outside iOS/Android');
-  }
+  assertMobile();
 
   const { signatureHex } = await HotKey.signWithHotKey({
     ciphertext,
@@ -47,12 +44,7 @@ export async function signHotDigest(ciphertext: string, wordHex: string): Promis
 }
 
 export async function deleteHotKey(ciphertext: string): Promise<void> {
-  if (isAndroid()) {
-    throw new Error(ANDROID_NOT_IMPLEMENTED);
-  }
-  if (!isIOS()) {
-    throw new Error('secure-hot-key native plugin invoked outside iOS/Android');
-  }
+  assertMobile();
 
   await HotKey.deleteHotKey({ ciphertext });
 }
@@ -61,11 +53,10 @@ async function commitmentFromPublicKeyHex(publicKeyHex: string): Promise<string>
   const { PublicKey } = await import('@miden-sdk/miden-sdk/lazy');
   const raw = Buffer.from(publicKeyHex, 'hex');
   const framed = new Uint8Array(raw.length + 1);
-  console.log(`raw public key ${publicKeyHex} for commitment derivation`);
   if (raw.length !== 33) {
     throw new Error(`unexpected public key length ${raw.length} (expected 33)`);
   }
-  framed[0] = 1; // uncompressed k256 pubkey tag
+  framed[0] = 1; // ECDSA k256 type prefix expected by PublicKey.deserialize
   framed.set(raw, 1);
   return PublicKey.deserialize(framed).toCommitment().toHex();
 }

From 375be347debdc2c728a7b8d78182083d61fc332f Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Tue, 5 May 2026 22:14:36 +0530
Subject: [PATCH 42/71] feat(guardian): replace-hot-key flow + cold co-signs
 switch_guardian

---
 CHANGELOG.md                                  |   1 +
 .../@openzeppelin/miden-multisig-client.ts    |  10 +
 public/_locales/en/en.json                    |   5 +
 src/app/templates/GuardianReplaceHotKey.tsx   | 102 +++++++++
 src/app/templates/GuardianSettings.tsx        |   5 +
 src/lib/intercom/mobile-adapter.ts            |  14 ++
 .../activity/transactions.guardian.test.ts    | 196 +++++++++++++++++-
 src/lib/miden/activity/transactions.ts        | 176 +++++++++++++++-
 src/lib/miden/back/actions.ts                 |  12 ++
 src/lib/miden/back/main.ts                    |  10 +
 src/lib/miden/back/transaction-processor.ts   |  10 +
 src/lib/miden/back/vault.ts                   |  65 +++++-
 src/lib/miden/db/types.ts                     |  36 +++-
 src/lib/miden/front/guardian-manager.test.ts  |   7 +-
 src/lib/miden/front/guardian-manager.ts       |   6 +
 src/lib/miden/front/guardian-sync.ts          |   6 +-
 src/lib/miden/guardian/account.ts             |   8 +-
 src/lib/miden/guardian/index.test.ts          | 146 ++++++++++++-
 src/lib/miden/guardian/index.ts               |  99 ++++++++-
 src/lib/secure-hot-key/nativePlugin.test.ts   |   4 +-
 src/lib/shared/types.ts                       |  29 +++
 src/lib/store/index.ts                        |  19 ++
 src/lib/store/types.ts                        |   2 +
 23 files changed, 937 insertions(+), 31 deletions(-)
 create mode 100644 src/app/templates/GuardianReplaceHotKey.tsx

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 230dc5c35..18c91f833 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@
 ### Features
 
 <<<<<<< utk-psm-integration
+* [FEATURE][all] 3-key Guardian: cold co-signs `switch_guardian` (on-chain threshold-2 satisfied via `procedureThresholds`) and a new Settings → Rotate Device Key flow lets users replace the hot signer in-place via a single cold-signed `update_signers` proposal, persisting the new ciphertext before submission and finalizing `WalletAccount.hotPublicKey` (plus releasing the old SE/StrongBox wrapper) only after on-chain inclusion.
 * [FEATURE][all] 3-key Guardian accounts. Guardian creation now provisions a hot ECDSA key (random, lives outside the WASM keystore behind a new `secure-hot-key` facade — extension/desktop use a JS fallback; iOS wraps the secret under a per-account Secure Enclave P-256 key via `HotKeyPlugin.swift`; Android wraps it under a per-account StrongBox-backed RSA-OAEP key via `HotKeyPlugin.kt` with biometric-gated unwrap, identical wire format on both platforms) plus an HD-derived cold ECDSA key (kept in the SDK keystore for cold-routed flows) alongside the existing guardian co-signer. Threshold stays at 1 (hot OR cold + guardian); cold-only routing for `update_signers` / `update_guardian` / `update_procedure_threshold` is enforced client-side per the Phase 0 SDK reading. Storage adds `accColdSecretKeyStrgKey` and `WalletAccount.{hotPublicKey,coldPublicKey}` so role-aware `signWord` (Phase 3) can dispatch hot vs cold by storage entity. Hard cutover from the 1-of-1 Falcon scheme — pre-cutover Guardian accounts are unreachable from this build.
 * [FEATURE][all] Guardian integration. Adds Guardian-backed accounts (1-of-1 multisig with on-chain Guardian signature verification), onboarding create/import flows with a dedicated recovery-method screen that accepts a custom guardian URL, Settings → Guardian Settings with an on-chain switch-guardian proposal that re-registers post-switch state with the new endpoint, service-worker routing for Guardian transaction signing via `MultisigService`, frontend Guardian sync outside the WASM lock, and per-stage progress labels (`creating-proposal`, `signing-proposal`, `submitting`, `registering-guardian`) in the transaction modal.
 =======
diff --git a/__mocks__/@openzeppelin/miden-multisig-client.ts b/__mocks__/@openzeppelin/miden-multisig-client.ts
index a5c1c0a6f..7907e9936 100644
--- a/__mocks__/@openzeppelin/miden-multisig-client.ts
+++ b/__mocks__/@openzeppelin/miden-multisig-client.ts
@@ -55,6 +55,16 @@ export const buildMultisigStorageSlots = jest.fn();
 export const buildGuardianStorageSlots = jest.fn();
 export const storageLayoutBuilder = jest.fn();
 
+// Update-signers + summary builders used by createReplaceHotKeyProposal. The
+// real implementations touch WASM; tests mock-or-spy as needed.
+export const buildUpdateSignersTransactionRequest = jest.fn(async () => ({
+  request: { kind: 'update-signers-request' },
+  salt: { toHex: () => 'salt-hex' }
+}));
+export const executeForSummary = jest.fn(async () => ({
+  serialize: () => new Uint8Array([0xab])
+}));
+
 export class StorageLayoutBuilder {
   constructor(..._args: unknown[]) {}
 }
diff --git a/public/_locales/en/en.json b/public/_locales/en/en.json
index 307167527..2aa4851fd 100644
--- a/public/_locales/en/en.json
+++ b/public/_locales/en/en.json
@@ -384,6 +384,11 @@
   "switchingGuardian": "Switching guardian...",
   "guardianSwitched": "Guardian switched successfully.",
   "guardianEndpointUnchanged": "That's already your current guardian.",
+  "replaceHotKey": "Rotate device key",
+  "replaceHotKeyDescription": "Generate a new device (hot) key and replace the current one on-chain. Useful if you suspect your device is compromised.",
+  "replaceHotKeyConfirmation": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?",
+  "confirmReplaceHotKey": "Confirm rotation",
+  "hotKeyRotated": "Device key rotated successfully.",
   "invalidUrl": "Enter a valid URL starting with http:// or https://",
   "encryptedWalletFileDescription": "Enter your password to access your Encrypted Wallet File.",
   "encryptedWalletFileDescriptionHardware": "Unlock with your passcode to access your Encrypted Wallet File.",
diff --git a/src/app/templates/GuardianReplaceHotKey.tsx b/src/app/templates/GuardianReplaceHotKey.tsx
new file mode 100644
index 000000000..c372e458e
--- /dev/null
+++ b/src/app/templates/GuardianReplaceHotKey.tsx
@@ -0,0 +1,102 @@
+import React, { FC, useCallback, useState } from 'react';
+
+import { useTranslation } from 'react-i18next';
+
+import FormSubmitButton from 'app/atoms/FormSubmitButton';
+import {
+  initiateReplaceHotKeyTransaction,
+  requestSWTransactionProcessing,
+  waitForTransactionCompletion
+} from 'lib/miden/activity';
+import { zustandProvider } from 'lib/miden/front/guardian-sync';
+import { isExtension } from 'lib/platform';
+import { isDelegateProofEnabled } from 'lib/settings/helpers';
+import { useWalletStore } from 'lib/store';
+
+type Props = {
+  onClose?: () => void;
+};
+
+/**
+ * Proactive hot-key rotation. Cold-signed (recovery key); the on-chain proposal
+ * swaps the hot signer commitment in-place via update_signers. The seed phrase
+ * is NOT required — the cold key derived at create time is already in the vault.
+ */
+const GuardianReplaceHotKey: FC<Props> = ({ onClose }) => {
+  const { t } = useTranslation();
+  const currentAccount = useWalletStore(s => s.currentAccount);
+
+  const [confirming, setConfirming] = useState(false);
+  const [submitting, setSubmitting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [success, setSuccess] = useState(false);
+
+  const onClick = useCallback(async () => {
+    if (!currentAccount) return;
+    if (!confirming) {
+      setConfirming(true);
+      return;
+    }
+    setSubmitting(true);
+    setError(null);
+    setSuccess(false);
+    try {
+      const txId = await initiateReplaceHotKeyTransaction(
+        currentAccount.publicKey,
+        isDelegateProofEnabled(),
+        zustandProvider
+      );
+      useWalletStore.getState().openTransactionModal();
+      if (isExtension()) requestSWTransactionProcessing();
+
+      const result = await waitForTransactionCompletion(txId);
+      if ('errorMessage' in result) {
+        setError(result.errorMessage);
+        return;
+      }
+      setSuccess(true);
+      setConfirming(false);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setSubmitting(false);
+    }
+  }, [confirming, currentAccount]);
+
+  return (
+    <div className="w-full pb-10">
+      <p className="text-sm text-heading-gray font-medium mb-1">{t('replaceHotKey')}</p>
+      <p className="text-xs text-heading-gray mb-3 select-text">{t('replaceHotKeyDescription')}</p>
+
+      {confirming && !success && (
+        <div className="text-xs text-heading-gray mb-3 select-text">{t('replaceHotKeyConfirmation')}</div>
+      )}
+
+      <FormSubmitButton
+        type="button"
+        onClick={onClick}
+        loading={submitting}
+        disabled={!currentAccount || submitting}
+        className="capitalize w-full justify-center"
+        style={{
+          fontSize: '16px',
+          lineHeight: '20px',
+          paddingTop: '10px',
+          paddingBottom: '10px'
+        }}
+      >
+        {confirming ? t('confirmReplaceHotKey') : t('replaceHotKey')}
+      </FormSubmitButton>
+
+      {error && <div className="mt-3 text-red-600 text-sm font-medium select-text">{error}</div>}
+
+      {success && (
+        <div className="mt-3 text-green-600 text-sm font-medium" onAnimationEnd={() => onClose?.()}>
+          {t('hotKeyRotated')}
+        </div>
+      )}
+    </div>
+  );
+};
+
+export default GuardianReplaceHotKey;
diff --git a/src/app/templates/GuardianSettings.tsx b/src/app/templates/GuardianSettings.tsx
index 07142569c..1181ba223 100644
--- a/src/app/templates/GuardianSettings.tsx
+++ b/src/app/templates/GuardianSettings.tsx
@@ -5,6 +5,7 @@ import { useTranslation } from 'react-i18next';
 
 import FormField from 'app/atoms/FormField';
 import FormSubmitButton from 'app/atoms/FormSubmitButton';
+import GuardianReplaceHotKey from 'app/templates/GuardianReplaceHotKey';
 import {
   initiateSwitchGuardianTransaction,
   requestSWTransactionProcessing,
@@ -133,6 +134,10 @@ const GuardianSettings: FC<Props> = ({ onClose }) => {
           </div>
         )}
       </form>
+
+      <hr className="my-6" />
+
+      <GuardianReplaceHotKey onClose={onClose} />
     </div>
   );
 };
diff --git a/src/lib/intercom/mobile-adapter.ts b/src/lib/intercom/mobile-adapter.ts
index d228b0cad..c5306a0ce 100644
--- a/src/lib/intercom/mobile-adapter.ts
+++ b/src/lib/intercom/mobile-adapter.ts
@@ -148,6 +148,20 @@ export class MobileIntercomAdapter {
         };
       }
 
+      case WalletMessageType.PersistNewHotKeyRequest: {
+        await Actions.persistNewHotKey(req.newHotPubKey, req.newHotCiphertext);
+        return {
+          type: WalletMessageType.PersistNewHotKeyResponse
+        };
+      }
+
+      case WalletMessageType.SwapHotKeyRequest: {
+        await Actions.swapHotKey(req.accountPublicKey, req.oldHotPubKey, req.newHotPubKey);
+        return {
+          type: WalletMessageType.SwapHotKeyResponse
+        };
+      }
+
       case WalletMessageType.GetPublicKeyForCommitmentRequest: {
         const publicKey = await Actions.getPublicKeyForCommitment(req.commitment);
         return {
diff --git a/src/lib/miden/activity/transactions.guardian.test.ts b/src/lib/miden/activity/transactions.guardian.test.ts
index baea7a8bf..bd8e125d1 100644
--- a/src/lib/miden/activity/transactions.guardian.test.ts
+++ b/src/lib/miden/activity/transactions.guardian.test.ts
@@ -12,11 +12,13 @@
  */
 
 import {
+  completeReplaceHotKeyTransaction,
   completeSwitchGuardianTransaction,
   generateTransaction,
+  initiateReplaceHotKeyTransaction,
   initiateSwitchGuardianTransaction
 } from './transactions';
-import { ITransactionStatus, SwitchGuardianTransaction } from '../db/types';
+import { ITransactionStatus, ReplaceHotKeyTransaction, SwitchGuardianTransaction } from '../db/types';
 
 const txStore: Array<Record<string, unknown>> = [];
 const putToStorage = jest.fn(async (..._args: unknown[]) => {});
@@ -59,6 +61,13 @@ jest.mock('lib/miden/front/guardian-manager', () => ({
   clearGuardianServiceFor: (...a: unknown[]) => mockClearGuardianServiceFor(...a)
 }));
 
+const mockBuildColdMultisigService = jest.fn();
+jest.mock('lib/miden/guardian', () => ({
+  MultisigService: {
+    buildColdMultisigService: (...a: unknown[]) => mockBuildColdMultisigService(...a)
+  }
+}));
+
 const mockWithWasmClientLock = jest.fn(async (fn: () => Promise<unknown>) => fn());
 const mockGetMidenClient = jest.fn();
 // Match the relative path used by transactions.ts so the mock intercepts.
@@ -286,7 +295,7 @@ describe('generateTransaction — Guardian routing', () => {
     expect(multisigService.createConsumeNotesProposal).toHaveBeenCalledWith(['note-xyz']);
   });
 
-  it('Guardian switch-guardian: waits for chain inclusion before finalizing the switch', async () => {
+  it('Guardian switch-guardian: cold co-signs before hot, waits for chain inclusion, finalizes switch', async () => {
     const txId = 'switch-guardian-1';
     const result = makeResult();
     txStore.push({
@@ -308,9 +317,20 @@ describe('generateTransaction — Guardian routing', () => {
     };
     mockGetOrCreateMultisigService.mockResolvedValue(multisigService);
 
+    const coldService = { signProposal: jest.fn(async () => {}) };
+    mockBuildColdMultisigService.mockResolvedValue(coldService);
+
+    const provider = {
+      getAccounts: async () => [{ publicKey: 'guardian-acc', coldPublicKey: 'cold-pub', hotPublicKey: 'hot-pub' }],
+      getPublicKeyForCommitment: async () => 'pk',
+      signWord: async () => 'sig'
+    };
+    mockIsGuardianAccount.mockResolvedValue(true);
+
     const waitForTransactionCommit = jest.fn(async () => {});
     mockGetMidenClient.mockResolvedValue({
       syncState: jest.fn(async () => {}),
+      getAccount: jest.fn(async () => ({ id: () => ({ toString: () => 'guardian-acc' }) })),
       waitForTransactionCommit,
       client: { transactions: { submit: jest.fn(async () => ({ result })) } }
     });
@@ -325,16 +345,84 @@ describe('generateTransaction — Guardian routing', () => {
       } as never,
       jest.fn(async () => new Uint8Array([1])),
       false,
-      makeGuardianProvider(true)
+      provider
     );
 
-    // The switch-guardian path must build the proposal via createSwitchGuardianProposal,
-    // wait for on-chain inclusion, and then finalize the switch (registering post-switch state).
+    // The switch-guardian path must build the proposal, cold co-signs first
+    // (threshold-2 satisfied on-chain), then hot signs + creates the request,
+    // then waits for inclusion and finalizes.
     expect(multisigService.createSwitchGuardianProposal).toHaveBeenCalledWith('https://new.guardian');
+    expect(mockBuildColdMultisigService).toHaveBeenCalled();
+    expect(coldService.signProposal).toHaveBeenCalledWith('prop-switch');
+    expect(multisigService.signAndCreateTransactionRequest).toHaveBeenCalledWith('prop-switch');
     expect(waitForTransactionCommit).toHaveBeenCalledWith('exec-tx-hash');
     expect(multisigService.finalizeGuardianSwitch).toHaveBeenCalledWith('https://new.guardian');
   });
 
+  it('Guardian replace-hot-key: cold-signs the in-place swap, persists new ciphertext pre-submit, waits for inclusion', async () => {
+    const txId = 'replace-hot-1';
+    const result = makeResult();
+    txStore.push({
+      id: txId,
+      type: 'replace-hot-key',
+      accountId: 'guardian-acc',
+      status: ITransactionStatus.Queued,
+      extraInputs: {}
+    });
+
+    const multisigService = {
+      // Hot service unused in replace-hot-key; signingService flips to cold.
+      sync: jest.fn(async () => {})
+    };
+    mockGetOrCreateMultisigService.mockResolvedValue(multisigService);
+
+    const coldService = {
+      createReplaceHotKeyProposal: jest.fn(async () => ({
+        proposal: { id: 'prop-replace' },
+        newHot: { ciphertext: 'new-cx', publicKeyHex: 'new-hot-pub', commitmentHex: '0xnewcommit' }
+      })),
+      signAndCreateTransactionRequest: jest.fn(async () => ({ serialize: () => new Uint8Array([1]) }))
+    };
+    mockBuildColdMultisigService.mockResolvedValue(coldService);
+
+    const persistNewHotKey = jest.fn(async () => {});
+    const provider = {
+      getAccounts: async () => [{ publicKey: 'guardian-acc', coldPublicKey: 'cold-pub', hotPublicKey: 'old-hot' }],
+      getPublicKeyForCommitment: async () => 'pk',
+      signWord: async () => 'sig',
+      persistNewHotKey,
+      swapHotKey: jest.fn(async () => {})
+    };
+    mockIsGuardianAccount.mockResolvedValue(true);
+
+    const waitForTransactionCommit = jest.fn(async () => {});
+    mockGetMidenClient.mockResolvedValue({
+      syncState: jest.fn(async () => {}),
+      getAccount: jest.fn(async () => ({ id: () => ({ toString: () => 'guardian-acc' }) })),
+      waitForTransactionCommit,
+      client: { transactions: { submit: jest.fn(async () => ({ result })) } }
+    });
+
+    const submittedRow = txStore.find(r => r.id === txId)!;
+
+    await generateTransaction(
+      { id: txId, type: 'replace-hot-key', accountId: 'guardian-acc', delegateTransaction: false } as never,
+      jest.fn(async () => new Uint8Array([1])),
+      false,
+      provider
+    );
+
+    expect(coldService.createReplaceHotKeyProposal).toHaveBeenCalled();
+    // Persist BEFORE submit so the new ciphertext is durable on crash.
+    expect(persistNewHotKey).toHaveBeenCalledWith('new-hot-pub', 'new-cx');
+    // Cold (signingService) drives signAndCreateTransactionRequest, NOT hot.
+    expect(coldService.signAndCreateTransactionRequest).toHaveBeenCalledWith('prop-replace');
+    // Persist newHotPublicKey on the transaction row so complete can find it.
+    expect((submittedRow.extraInputs as { newHotPublicKey?: string }).newHotPublicKey).toBe('new-hot-pub');
+    // Replace-hot-key shares the confirming wait with switch-guardian.
+    expect(waitForTransactionCommit).toHaveBeenCalledWith('exec-tx-hash');
+  });
+
   it('Guardian: unsupported transaction type cancels the transaction', async () => {
     const txId = 'unsupported-guardian';
     txStore.push({
@@ -362,3 +450,101 @@ describe('generateTransaction — Guardian routing', () => {
     expect(row.status).toBe(ITransactionStatus.Failed);
   });
 });
+
+describe('initiateReplaceHotKeyTransaction', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    txStore.length = 0;
+  });
+
+  it('queues a ReplaceHotKeyTransaction row when the account is Guardian', async () => {
+    const provider = makeGuardianProvider(true);
+    const id = await initiateReplaceHotKeyTransaction('acc-1', false, provider);
+
+    expect(id).toBeDefined();
+    expect(txStore).toHaveLength(1);
+    const row = txStore[0] as Record<string, unknown>;
+    expect(row.accountId).toBe('acc-1');
+    expect(row.type).toBe('replace-hot-key');
+    // extraInputs starts empty; populated during generateGuardianTransaction.
+    expect(row.extraInputs).toEqual({});
+  });
+
+  it('throws when the target account is not a Guardian account', async () => {
+    const provider = makeGuardianProvider(false);
+    await expect(initiateReplaceHotKeyTransaction('acc-public', false, provider)).rejects.toThrow(
+      'Replace hot key is only supported for Guardian accounts'
+    );
+    expect(txStore).toHaveLength(0);
+  });
+});
+
+describe('completeReplaceHotKeyTransaction', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    txStore.length = 0;
+  });
+
+  it('swaps WalletAccount.hotPublicKey via the provider, drops the cached service, and marks the row Completed', async () => {
+    const tx = new ReplaceHotKeyTransaction('acc-1', false);
+    tx.extraInputs = { newHotPublicKey: 'new-hot-pub' };
+    txStore.push({ id: tx.id, status: ITransactionStatus.GeneratingTransaction });
+
+    const swapHotKey = jest.fn(async () => {});
+    const provider = {
+      getAccounts: async () => [{ publicKey: 'acc-1', hotPublicKey: 'old-hot-pub', coldPublicKey: 'cold' }],
+      getPublicKeyForCommitment: async () => 'pk',
+      signWord: async () => 'sig',
+      swapHotKey
+    };
+
+    await completeReplaceHotKeyTransaction(tx, makeResult() as never, provider as never);
+
+    expect(swapHotKey).toHaveBeenCalledWith('acc-1', 'old-hot-pub', 'new-hot-pub');
+    expect(mockClearGuardianServiceFor).toHaveBeenCalledWith('acc-1');
+
+    const row = txStore.find(r => r.id === tx.id) as Record<string, unknown>;
+    expect(row.status).toBe(ITransactionStatus.Completed);
+    expect(row.displayMessage).toBe('Device key rotated');
+  });
+
+  it('skips the swap when the recorded new hot already matches the WalletAccount (idempotent retry)', async () => {
+    const tx = new ReplaceHotKeyTransaction('acc-1', false);
+    tx.extraInputs = { newHotPublicKey: 'already-rotated' };
+    txStore.push({ id: tx.id, status: ITransactionStatus.GeneratingTransaction });
+
+    const swapHotKey = jest.fn();
+    const provider = {
+      getAccounts: async () => [{ publicKey: 'acc-1', hotPublicKey: 'already-rotated', coldPublicKey: 'cold' }],
+      getPublicKeyForCommitment: async () => 'pk',
+      signWord: async () => 'sig',
+      swapHotKey
+    };
+
+    await completeReplaceHotKeyTransaction(tx, makeResult() as never, provider as never);
+
+    expect(swapHotKey).not.toHaveBeenCalled();
+    const row = txStore.find(r => r.id === tx.id) as Record<string, unknown>;
+    expect(row.status).toBe(ITransactionStatus.Completed);
+  });
+
+  it('marks the row Failed when extraInputs.newHotPublicKey is missing', async () => {
+    const tx = new ReplaceHotKeyTransaction('acc-1', false);
+    // intentionally leave extraInputs empty to simulate a corrupt/incomplete row
+    tx.extraInputs = {};
+    txStore.push({ id: tx.id, status: ITransactionStatus.GeneratingTransaction });
+
+    const provider = {
+      getAccounts: async () => [{ publicKey: 'acc-1', hotPublicKey: 'old-hot-pub', coldPublicKey: 'cold' }],
+      getPublicKeyForCommitment: async () => 'pk',
+      signWord: async () => 'sig',
+      swapHotKey: jest.fn()
+    };
+
+    await completeReplaceHotKeyTransaction(tx, makeResult() as never, provider as never);
+
+    const row = txStore.find(r => r.id === tx.id) as Record<string, unknown>;
+    expect(row.status).toBe(ITransactionStatus.Failed);
+    expect(row.displayMessage).toBe('Failed to rotate device key');
+  });
+});
diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index b4802736c..912d601b4 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -22,6 +22,7 @@ import {
   ITransaction,
   ITransactionStage,
   ITransactionStatus,
+  ReplaceHotKeyTransaction,
   SendTransaction,
   SwitchGuardianTransaction,
   Transaction,
@@ -370,6 +371,77 @@ export const initiateSwitchGuardianTransaction = async (
   return dbTransaction.id;
 };
 
+/**
+ * Queue a replace-hot-key transaction for a Guardian account. The new hot key
+ * is generated lazily inside `generateGuardianTransaction` (so the cold service
+ * + secureHotKey facade are only touched once we're actually processing the
+ * tx) and persisted to the vault BEFORE submission. Cold-signed; default
+ * `update_signers` threshold (1) means cold alone satisfies on-chain.
+ */
+export const initiateReplaceHotKeyTransaction = async (
+  accountId: string,
+  delegateTransaction: boolean | undefined,
+  guardianProvider: GuardianAccountProvider
+): Promise<string> => {
+  if (!(await isGuardianAccount(accountId, guardianProvider))) {
+    throw new Error('Replace hot key is only supported for Guardian accounts');
+  }
+  const dbTransaction = new ReplaceHotKeyTransaction(accountId, delegateTransaction);
+  await Repo.transactions.add(dbTransaction);
+  return dbTransaction.id;
+};
+
+export const completeReplaceHotKeyTransaction = async (
+  tx: ReplaceHotKeyTransaction,
+  result: TransactionResult,
+  guardianProvider: GuardianAccountProvider
+) => {
+  try {
+    const executedTx = result.executedTransaction();
+    const newHotPublicKey = tx.extraInputs?.newHotPublicKey;
+    if (!newHotPublicKey) {
+      throw new Error('Replace-hot-key tx is missing newHotPublicKey in extraInputs');
+    }
+
+    // Resolve the OLD hot pubkey from the WalletAccount snapshot taken before
+    // generateGuardianTransaction wrote the new hot ciphertext to vault. The
+    // record may already reflect the new key on a retry — guard accordingly.
+    const allAccounts = await guardianProvider.getAccounts();
+    const accountRecord = allAccounts.find(a => a.publicKey === tx.accountId);
+    if (!accountRecord) {
+      throw new Error(`Account ${tx.accountId} not found in provider during complete`);
+    }
+    const oldHotPublicKey = accountRecord.hotPublicKey;
+    if (!oldHotPublicKey) {
+      throw new Error(`Account ${tx.accountId} has no hotPublicKey to rotate`);
+    }
+
+    if (oldHotPublicKey !== newHotPublicKey) {
+      if (!guardianProvider.swapHotKey) {
+        throw new Error('swapHotKey not implemented in this provider');
+      }
+      await guardianProvider.swapHotKey(tx.accountId, oldHotPublicKey, newHotPublicKey);
+    }
+    // Drop the cached MultisigService — its bound hot signer is now stale.
+    clearGuardianServiceFor(tx.accountId);
+
+    await updateTransactionStatus(tx.id, ITransactionStatus.Completed, {
+      displayMessage: 'Device key rotated',
+      transactionId: executedTx.id().toHex(),
+      completedAt: Math.floor(Date.now() / 1000),
+      resultBytes: result.serialize()
+    });
+  } catch (error) {
+    console.error('Error completing replace-hot-key transaction:', error);
+    await updateTransactionStatus(tx.id, ITransactionStatus.Failed, {
+      displayMessage: 'Failed to rotate device key',
+      completedAt: Math.floor(Date.now() / 1000),
+      resultBytes: result.serialize(),
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+};
+
 export const completeSwitchGuardianTransaction = async (
   tx: SwitchGuardianTransaction,
   result: TransactionResult,
@@ -761,6 +833,7 @@ export const generateTransaction = async (
     type: transaction.type,
     accountId: transaction.accountId
   });
+
   // Route Guardian accounts through Guardian service
   if (await isGuardianAccount(transaction.accountId, guardianProvider)) {
     try {
@@ -829,6 +902,10 @@ const generateGuardianTransaction = async (
   const multisigService = await getOrCreateMultisigService(transaction.accountId, guardianProvider);
 
   let proposalResult: Proposal;
+  // The signing service for the FINAL signAndCreateTransactionRequest call.
+  // Defaults to hot. replace-hot-key flips it to a transient cold service
+  // because the hot key being replaced cannot itself authorize the rotation.
+  let signingService: MultisigService = multisigService;
 
   switch (transaction.type) {
     case 'send': {
@@ -851,6 +928,43 @@ const generateGuardianTransaction = async (
       proposalResult = proposal;
       break;
     }
+    case 'replace-hot-key': {
+      const walletAccount = (await guardianProvider.getAccounts()).find(a => a.publicKey === transaction.accountId);
+      if (!walletAccount) {
+        throw new Error(`Guardian account ${transaction.accountId} not found in provider`);
+      }
+      const sdkAccount = await withWasmClientLock(async () => {
+        const midenClient = await getMidenClient();
+        return midenClient.getAccount(transaction.accountId);
+      });
+      if (!sdkAccount) {
+        throw new Error(`Guardian account ${transaction.accountId} not found in local client`);
+      }
+      const coldService = await MultisigService.buildColdMultisigService(
+        sdkAccount,
+        walletAccount,
+        guardianProvider.signWord
+      );
+      const { proposal, newHot } = await coldService.createReplaceHotKeyProposal(sdkAccount);
+      if (!guardianProvider.persistNewHotKey) {
+        throw new Error('persistNewHotKey not implemented in this provider');
+      }
+      // Persist the new hot ciphertext BEFORE submitting. Old hot stays valid
+      // until the on-chain rotation lands so this is idempotent. If the app
+      // dies between submit and complete, the new ciphertext is on disk and
+      // complete reconciles against the on-chain state.
+      await guardianProvider.persistNewHotKey(newHot.publicKeyHex, newHot.ciphertext);
+      // Stash the new pubkey on the in-memory transaction AND in dexie so
+      // complete (which may run after a process restart) can find it.
+      const rTx = transaction as ReplaceHotKeyTransaction;
+      rTx.extraInputs = { ...(rTx.extraInputs ?? {}), newHotPublicKey: newHot.publicKeyHex };
+      await Repo.transactions.where({ id: transaction.id }).modify(t => {
+        t.extraInputs = rTx.extraInputs;
+      });
+      proposalResult = proposal;
+      signingService = coldService;
+      break;
+    }
     // case 'execute':
     // default: {
     // // For custom transactions, get TransactionSummary and create a custom proposal
@@ -871,10 +985,37 @@ const generateGuardianTransaction = async (
 
   // Sign and execute the proposal
   await setTransactionStage(transaction.id, 'signing-proposal');
-  const tr = await multisigService.signAndCreateTransactionRequest(proposalResult.id);
-  console.log('Created transaction request from proposal, submitting to Miden client');
+
+  // switch_guardian is on-chain threshold-2 (set at create time via
+  // procedureThresholds). Hot's signAndCreateTransactionRequest below
+  // contributes one sig; we add the cold sig here. Sigs accumulate on the
+  // Guardian server keyed by proposal id so order doesn't matter, and the
+  // transient cold service is dropped at scope exit.
+  if (transaction.type === 'switch-guardian') {
+    const walletAccount = (await guardianProvider.getAccounts()).find(a => a.publicKey === transaction.accountId);
+    if (!walletAccount) {
+      throw new Error(`Guardian account ${transaction.accountId} not found in provider`);
+    }
+    const sdkAccount = await withWasmClientLock(async () => {
+      const midenClient = await getMidenClient();
+      return midenClient.getAccount(transaction.accountId);
+    });
+    if (!sdkAccount) {
+      throw new Error(`Guardian account ${transaction.accountId} not found in local client`);
+    }
+    const coldService = await MultisigService.buildColdMultisigService(
+      sdkAccount,
+      walletAccount,
+      guardianProvider.signWord
+    );
+    await coldService.signProposal(proposalResult.id);
+  }
+
+  const tr = await signingService.signAndCreateTransactionRequest(proposalResult.id);
+  console.log('Created transaction request from proposal, submitting to Miden client', tr.authArg()?.toHex());
   const options: MidenClientCreateOptions = {
     signCallback: async (publicKey: Uint8Array, signingInputs: Uint8Array) => {
+      console.log('Signing transaction request with external callback');
       const keyString = Buffer.from(publicKey).toString('hex');
       const signingInputsString = Buffer.from(signingInputs).toString('hex');
       return await signCallback(keyString, signingInputsString);
@@ -883,20 +1024,27 @@ const generateGuardianTransaction = async (
 
   await setTransactionStage(transaction.id, 'submitting');
   const transactionResult = await withWasmClientLock(async () => {
-    const midenClient = await getMidenClient(options);
-    console.log('Submitting transaction request to Miden client');
-    const { result } = await midenClient.client.transactions.submit(transaction.accountId, tr, {
-      prover: !transaction.delegateTransaction ? TransactionProver.newLocalProver() : undefined
-    });
-    console.log('Transaction request submitted, waiting for result');
-    return result;
+    try {
+      const midenClient = await getMidenClient(options);
+      const { result } = await midenClient.client.transactions.submit(transaction.accountId, tr, {
+        prover: !transaction.delegateTransaction ? TransactionProver.newLocalProver() : undefined
+      });
+      return result;
+    } catch (error) {
+      console.error('Error during transaction submission or execution', { error });
+      throw error;
+    }
   });
 
   // For switch-guardian, the new guardian must be seeded with the POST-switch
   // account state. submit() returns after submission, not after inclusion, so
   // without this wait finalizeGuardianSwitch would serialize the pre-switch
   // account and register that stale state with the new guardian.
-  if (transaction.type === 'switch-guardian') {
+  // For replace-hot-key, we wait so the WalletAccount.hotPublicKey swap in
+  // complete only happens once the on-chain rotation is final — otherwise a
+  // resync could race with stale on-chain state and pick the wrong canonical
+  // hot pubkey.
+  if (transaction.type === 'switch-guardian' || transaction.type === 'replace-hot-key') {
     await setTransactionStage(transaction.id, 'confirming');
     await withWasmClientLock(async () => {
       const midenClient = await getMidenClient();
@@ -919,6 +1067,14 @@ const generateGuardianTransaction = async (
         multisigService
       );
       break;
+    case 'replace-hot-key':
+      console.log('Completing replace-hot-key transaction');
+      await completeReplaceHotKeyTransaction(
+        transaction as ReplaceHotKeyTransaction,
+        transactionResult,
+        guardianProvider
+      );
+      break;
     // case 'execute':
     // default:
     //   await completeCustomTransaction(transaction, transactionResult);
diff --git a/src/lib/miden/back/actions.ts b/src/lib/miden/back/actions.ts
index 9aa7979ea..9290bdccf 100644
--- a/src/lib/miden/back/actions.ts
+++ b/src/lib/miden/back/actions.ts
@@ -304,6 +304,18 @@ export function signWord(publicKey: string, wordHex: string) {
   });
 }
 
+export function persistNewHotKey(newHotPubKey: string, newHotCiphertext: string) {
+  return withUnlocked(async ({ vault }) => {
+    await vault.persistNewHotKey(newHotPubKey, newHotCiphertext);
+  });
+}
+
+export function swapHotKey(accountPublicKey: string, oldHotPubKey: string, newHotPubKey: string) {
+  return withUnlocked(async ({ vault }) => {
+    await vault.swapHotKey(accountPublicKey, oldHotPubKey, newHotPubKey);
+  });
+}
+
 export function getPublicKeyForCommitment(commitment: string) {
   return withUnlocked(async ({ vault }) => {
     return await vault.getPublicKeyForCommitment(commitment);
diff --git a/src/lib/miden/back/main.ts b/src/lib/miden/back/main.ts
index b6029e9fe..8afe0f595 100644
--- a/src/lib/miden/back/main.ts
+++ b/src/lib/miden/back/main.ts
@@ -213,6 +213,16 @@ async function processRequest(req: WalletRequest, _port: Runtime.Port): Promise<
         type: WalletMessageType.SignWordResponse,
         signature: wordSignature
       };
+    case WalletMessageType.PersistNewHotKeyRequest:
+      await Actions.persistNewHotKey(req.newHotPubKey, req.newHotCiphertext);
+      return {
+        type: WalletMessageType.PersistNewHotKeyResponse
+      };
+    case WalletMessageType.SwapHotKeyRequest:
+      await Actions.swapHotKey(req.accountPublicKey, req.oldHotPubKey, req.newHotPubKey);
+      return {
+        type: WalletMessageType.SwapHotKeyResponse
+      };
     case WalletMessageType.GetPublicKeyForCommitmentRequest:
       const commitmentPublicKey = await Actions.getPublicKeyForCommitment(req.commitment);
       return {
diff --git a/src/lib/miden/back/transaction-processor.ts b/src/lib/miden/back/transaction-processor.ts
index dbaa4d57d..c6aea57f4 100644
--- a/src/lib/miden/back/transaction-processor.ts
+++ b/src/lib/miden/back/transaction-processor.ts
@@ -77,6 +77,16 @@ const vaultGuardianProvider: GuardianAccountProvider = {
     return withUnlocked(async ({ vault }) => {
       return await vault.signWord(publicKey, wordHex);
     });
+  },
+  persistNewHotKey: async (newHotPubKey: string, newHotCiphertext: string) => {
+    return withUnlocked(async ({ vault }) => {
+      await vault.persistNewHotKey(newHotPubKey, newHotCiphertext);
+    });
+  },
+  swapHotKey: async (accountPublicKey: string, oldHotPubKey: string, newHotPubKey: string) => {
+    return withUnlocked(async ({ vault }) => {
+      await vault.swapHotKey(accountPublicKey, oldHotPubKey, newHotPubKey);
+    });
   }
 };
 
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index fcd99fd6a..f8d43f4ac 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -6,8 +6,6 @@ import {
   AccountStorageMode,
   AccountType,
   AuthSecretKey,
-  PublicKey,
-  Signature,
   SigningInputs,
   Word
 } from '@miden-sdk/miden-sdk/lazy';
@@ -20,6 +18,7 @@ import {
   fetchAndDecryptOneWithLegacyFallBack,
   getPlain,
   isStored,
+  removeMany,
   savePlain
 } from 'lib/miden/back/safe-storage';
 import * as Passworder from 'lib/miden/passworder';
@@ -77,6 +76,7 @@ const ownMnemonicStrgKey = createStorageKey(StorageEntity.OwnMnemonic);
 const insertKeyCallbackWrapper = (passKey: CryptoKey) => {
   return async (key: Uint8Array, secretKey: Uint8Array) => {
     const pubKeyHex = Buffer.from(key).toString('hex');
+    console.log('Inserting key with pubKeyHex', pubKeyHex);
     const secretKeyHex = Buffer.from(secretKey).toString('hex');
     await encryptAndSaveMany(
       [
@@ -703,6 +703,61 @@ export class Vault {
     });
   }
 
+  /**
+   * Persist a freshly-minted hot key blob produced by createReplaceHotKeyProposal.
+   * Called BEFORE the rotation tx is submitted so the new ciphertext is durable
+   * even if the app dies after submit but before complete — the on-chain account
+   * state determines which hotPublicKey is canonical, and `swapHotKey` (called
+   * from completeReplaceHotKeyTransaction) reconciles the WalletAccount pointer
+   * against it. Old hot stays valid until rotation lands so this is idempotent.
+   */
+  async persistNewHotKey(newHotPubKey: string, newHotCiphertext: string) {
+    return withError('Failed to persist new hot key', async () => {
+      await encryptAndSaveMany(
+        [
+          [accAuthPubKeyStrgKey(newHotPubKey), newHotPubKey],
+          [accAuthSecretKeyStrgKey(newHotPubKey), newHotCiphertext]
+        ],
+        this.vaultKey
+      );
+    });
+  }
+
+  /**
+   * Finalize a hot-key rotation: update WalletAccount.hotPublicKey for the
+   * Guardian account and remove the previous hot ciphertext. On mobile we also
+   * release the SE/StrongBox wrapper key for the old ciphertext via
+   * secureHotKey.deleteHotKey — best-effort, not fatal if it fails (the JS
+   * fallback's deleteHotKey is a no-op anyway).
+   */
+  async swapHotKey(accountPublicKey: string, oldHotPubKey: string, newHotPubKey: string) {
+    return withError('Failed to swap hot key', async () => {
+      const allAccounts = await this.fetchAccounts();
+      if (!allAccounts.some(acc => acc.publicKey === accountPublicKey)) {
+        throw new PublicError('Account not found');
+      }
+
+      try {
+        const oldCiphertext = await fetchAndDecryptOneWithLegacyFallBack<string>(
+          accAuthSecretKeyStrgKey(oldHotPubKey),
+          this.vaultKey
+        );
+        await secureHotKey.deleteHotKey(oldCiphertext);
+      } catch (e) {
+        console.warn('swapHotKey: failed to release old native key (non-fatal):', e);
+      }
+
+      const newAllAccounts = allAccounts.map(acc =>
+        acc.publicKey === accountPublicKey ? { ...acc, hotPublicKey: newHotPubKey } : acc
+      );
+      await encryptAndSaveMany([[accountsStrgKey, newAllAccounts]], this.vaultKey);
+      await removeMany([accAuthPubKeyStrgKey(oldHotPubKey), accAuthSecretKeyStrgKey(oldHotPubKey)]);
+
+      const currentAccount = await this.getCurrentAccount();
+      return { accounts: newAllAccounts, currentAccount };
+    });
+  }
+
   async updateSettings(settings: Partial<WalletSettings>) {
     return withError('Failed to update settings', async () => {
       const current = await this.fetchSettings();
@@ -741,6 +796,7 @@ export class Vault {
   }
 
   async signTransaction(publicKey: string, signingInputs: string): Promise<string> {
+    console.log('signTransaction: publicKey', publicKey);
     const secretKey = await fetchAndDecryptOneWithLegacyFallBack<string>(
       accAuthSecretKeyStrgKey(publicKey),
       this.vaultKey
@@ -771,8 +827,13 @@ export class Vault {
         accColdSecretKeyStrgKey(publicKey),
         this.vaultKey
       );
+      console.log('Sign word for cold key, got coldHex =', coldHex);
       const wasmSecretKey = AuthSecretKey.deserialize(new Uint8Array(Buffer.from(coldHex, 'hex')));
       const signature = wasmSecretKey.sign(Word.fromHex(wordHex));
+      console.log(
+        'Cold signature generated, signature.serialize() =',
+        Buffer.from(signature.serialize()).toString('hex')
+      );
       return `0x${Buffer.from(signature.serialize().slice(1)).toString('hex')}`;
     }
 
diff --git a/src/lib/miden/db/types.ts b/src/lib/miden/db/types.ts
index 783f20803..f138c40d8 100644
--- a/src/lib/miden/db/types.ts
+++ b/src/lib/miden/db/types.ts
@@ -15,7 +15,7 @@ export enum ITransactionStatus {
 }
 
 export type ITransactionIcon = 'SEND' | 'RECEIVE' | 'SWAP' | 'FAILED' | 'MINT' | 'DEFAULT';
-export type ITransactionType = 'send' | 'consume' | 'execute' | 'switch-guardian';
+export type ITransactionType = 'send' | 'consume' | 'execute' | 'switch-guardian' | 'replace-hot-key';
 
 /**
  * Sub-phase of a transaction while `status === GeneratingTransaction` (or
@@ -227,6 +227,40 @@ export class SwitchGuardianTransaction implements ITransaction {
   }
 }
 
+/**
+ * Proactive hot-key rotation for a Guardian account. Cold-signed (recovery key);
+ * the on-chain proposal swaps the hot signer commitment in-place via
+ * `update_signers`. extraInputs.newHotPublicKey is filled in during
+ * `generateGuardianTransaction` once the new key is minted, and consumed by
+ * `completeReplaceHotKeyTransaction` to swap the WalletAccount pointer.
+ */
+export class ReplaceHotKeyTransaction implements ITransaction {
+  id: string;
+  type: ITransactionType;
+  accountId: string;
+  transactionId?: string;
+  status: ITransactionStatus;
+  initiatedAt: number;
+  processingStartedAt?: number;
+  completedAt?: number;
+  displayMessage?: string;
+  displayIcon: ITransactionIcon;
+  extraInputs: { newHotPublicKey?: string };
+  delegateTransaction?: boolean | undefined;
+
+  constructor(accountId: string, delegateTransaction?: boolean) {
+    this.id = uuid();
+    this.type = 'replace-hot-key';
+    this.accountId = accountId;
+    this.status = ITransactionStatus.Queued;
+    this.initiatedAt = Math.floor(Date.now() / 1000);
+    this.displayIcon = 'DEFAULT';
+    this.displayMessage = 'Rotating device key';
+    this.extraInputs = {};
+    this.delegateTransaction = delegateTransaction;
+  }
+}
+
 export function formatTransactionStatus(status: ITransactionStatus): string {
   const words = ITransactionStatus[status].split(/(?=[A-Z])/);
   return words.join(' ');
diff --git a/src/lib/miden/front/guardian-manager.test.ts b/src/lib/miden/front/guardian-manager.test.ts
index 79fe87992..4a99e7641 100644
--- a/src/lib/miden/front/guardian-manager.test.ts
+++ b/src/lib/miden/front/guardian-manager.test.ts
@@ -87,7 +87,12 @@ describe('guardian-manager', () => {
       expect(result).toBe(service);
       // The publicKey arg comes from WalletAccount.hotPublicKey (not from
       // getSignerDetailsFromAccount anymore), prefixed with `0x`.
-      expect(mockMultisigServiceInit).toHaveBeenCalledWith(expect.anything(), `0x${HOT_PK}`, '0xabc', provider.signWord);
+      expect(mockMultisigServiceInit).toHaveBeenCalledWith(
+        expect.anything(),
+        `0x${HOT_PK}`,
+        '0xabc',
+        provider.signWord
+      );
       // Second call for the same account returns the cached instance without
       // re-initializing the service.
       mockMultisigServiceInit.mockClear();
diff --git a/src/lib/miden/front/guardian-manager.ts b/src/lib/miden/front/guardian-manager.ts
index 6f93ca095..6c49eacca 100644
--- a/src/lib/miden/front/guardian-manager.ts
+++ b/src/lib/miden/front/guardian-manager.ts
@@ -22,6 +22,12 @@ export interface GuardianAccountProvider {
   getAccounts: () => Promise<WalletAccount[]>;
   getPublicKeyForCommitment: (commitment: string) => Promise<string>;
   signWord: (publicKey: string, wordHex: string) => Promise<string>;
+  // Optional SW-only callbacks used by the proactive replace-hot-key flow.
+  // Frontend providers (zustandProvider) leave these undefined; the rotation
+  // path runs only inside the SW-side transaction processor where the
+  // vault-backed provider implements them.
+  persistNewHotKey?: (newHotPubKey: string, newHotCiphertext: string) => Promise<void>;
+  swapHotKey?: (accountPublicKey: string, oldHotPubKey: string, newHotPubKey: string) => Promise<void>;
 }
 
 /**
diff --git a/src/lib/miden/front/guardian-sync.ts b/src/lib/miden/front/guardian-sync.ts
index 8e2ef7bf4..ddd058b97 100644
--- a/src/lib/miden/front/guardian-sync.ts
+++ b/src/lib/miden/front/guardian-sync.ts
@@ -12,7 +12,11 @@ import { getOrCreateMultisigService, type GuardianAccountProvider } from './guar
 export const zustandProvider: GuardianAccountProvider = {
   getAccounts: async () => useWalletStore.getState().accounts,
   getPublicKeyForCommitment: (commitment: string) => useWalletStore.getState().getPublicKeyForCommitment(commitment),
-  signWord: (publicKey: string, wordHex: string) => useWalletStore.getState().signWord(publicKey, wordHex)
+  signWord: (publicKey: string, wordHex: string) => useWalletStore.getState().signWord(publicKey, wordHex),
+  persistNewHotKey: (newHotPubKey: string, newHotCiphertext: string) =>
+    useWalletStore.getState().persistNewHotKey(newHotPubKey, newHotCiphertext),
+  swapHotKey: (accountPublicKey: string, oldHotPubKey: string, newHotPubKey: string) =>
+    useWalletStore.getState().swapHotKey(accountPublicKey, oldHotPubKey, newHotPubKey)
 };
 
 /**
diff --git a/src/lib/miden/guardian/account.ts b/src/lib/miden/guardian/account.ts
index 17aa22def..4a06b8ac0 100644
--- a/src/lib/miden/guardian/account.ts
+++ b/src/lib/miden/guardian/account.ts
@@ -41,18 +41,20 @@ export interface CreatedGuardianAccount {
  * Convention: `signerCommitments: [hot, cold]` per createGuardianAccount —
  * so `mapEntries[0]` is the hot signer's commitment.
  */
-export async function getSignerDetailsFromAccount(account: Account): Promise<{ commitment: string }> {
+export async function getSignerDetailsFromAccount(account: Account, getCold = false): Promise<{ commitment: string }> {
   const mapEntries = account.storage().getMapEntries(MULTISIG_SLOT_NAMES.SIGNER_PUBLIC_KEYS);
   console.log('Signer public keys map entries:', mapEntries);
   if (!mapEntries) {
     throw new Error('No signer public keys found in account storage');
   }
 
-  if (!mapEntries[0]) {
+  const index = getCold ? 1 : 0;
+
+  if (!mapEntries[index]) {
     throw new Error('No signer commitments found in account storage');
   }
 
-  const commitment = mapEntries[0].value.slice(2);
+  const commitment = mapEntries[index].value.slice(2);
   if (!commitment) {
     throw new Error('Commitment not found in account storage');
   }
diff --git a/src/lib/miden/guardian/index.test.ts b/src/lib/miden/guardian/index.test.ts
index e6ff97340..426231ce4 100644
--- a/src/lib/miden/guardian/index.test.ts
+++ b/src/lib/miden/guardian/index.test.ts
@@ -39,9 +39,11 @@ jest.mock('../sdk/helpers', () => ({
 
 const mockGetAccount = jest.fn();
 const mockSyncState = jest.fn(async () => {});
+const mockRawWebClient = { kind: 'raw-web-client' };
 const mockMidenClient = {
   getAccount: (...args: unknown[]) => mockGetAccount(...args),
-  syncState: () => mockSyncState()
+  syncState: () => mockSyncState(),
+  client: mockRawWebClient
 };
 jest.mock('../sdk/miden-client', () => ({
   getMidenClient: async () => mockMidenClient,
@@ -71,6 +73,14 @@ const multisigClientConfig: { load: jest.Mock } = {
   load: jest.fn()
 };
 
+const mockBuildUpdateSignersTransactionRequest = jest.fn(async () => ({
+  request: { kind: 'request' },
+  salt: { toHex: () => 'salt-hex' }
+}));
+const mockExecuteForSummary = jest.fn(async () => ({
+  serialize: () => new Uint8Array([0xab])
+}));
+
 jest.mock('@openzeppelin/miden-multisig-client', () => ({
   GuardianHttpClient: jest.fn().mockImplementation(() => ({
     getPubkey: (...a: unknown[]) => guardianConfig.getPubkey(...a),
@@ -79,7 +89,23 @@ jest.mock('@openzeppelin/miden-multisig-client', () => ({
   })),
   MultisigClient: jest.fn().mockImplementation(() => ({
     load: (...a: unknown[]) => multisigClientConfig.load(...a)
-  }))
+  })),
+  buildUpdateSignersTransactionRequest: (...a: unknown[]) => mockBuildUpdateSignersTransactionRequest(...a),
+  executeForSummary: (...a: unknown[]) => mockExecuteForSummary(...a)
+}));
+
+const mockGenerateHotKey = jest.fn();
+const mockSignHotDigest = jest.fn();
+const mockDeleteHotKey = jest.fn();
+jest.mock('lib/secure-hot-key', () => ({
+  generateHotKey: (...a: unknown[]) => mockGenerateHotKey(...a),
+  signHotDigest: (...a: unknown[]) => mockSignHotDigest(...a),
+  deleteHotKey: (...a: unknown[]) => mockDeleteHotKey(...a)
+}));
+
+const mockGetSignerDetailsFromAccount = jest.fn();
+jest.mock('./account', () => ({
+  getSignerDetailsFromAccount: (...a: unknown[]) => mockGetSignerDetailsFromAccount(...a)
 }));
 
 // atob is globally available on Node 16+ but jsdom stubs can vary — provide
@@ -116,9 +142,11 @@ const makeMultisig = (overrides: Partial<Record<string, unknown>> = {}) => ({
   account: {
     nonce: () => ({ asInt: () => 5n })
   },
+  threshold: 1,
+  getEffectiveThreshold: jest.fn(() => 1),
   createP2idProposal: jest.fn(async () => ({ kind: 'p2id' })),
   createConsumeNotesProposal: jest.fn(async () => ({ kind: 'consume' })),
-  createProposal: jest.fn(async () => ({ kind: 'custom' })),
+  createProposal: jest.fn(async () => ({ kind: 'custom', id: 'proposal-id' })),
   createTransactionProposalRequest: jest.fn(async () => 'tx-req'),
   signProposal: jest.fn(async () => {}),
   executeProposal: jest.fn(async () => {}),
@@ -421,4 +449,116 @@ describe('MultisigService', () => {
       expect(multisig.registerOnGuardian).not.toHaveBeenCalled();
     });
   });
+
+  describe('signProposal pass-through', () => {
+    it('forwards signProposal to the wrapped Multisig and does not finalize the proposal', async () => {
+      const multisig = makeMultisig();
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+
+      await service.signProposal('p-3');
+
+      expect(multisig.signProposal).toHaveBeenCalledWith('p-3');
+      expect(multisig.executeProposal).not.toHaveBeenCalled();
+      expect(multisig.createTransactionProposalRequest).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('buildColdMultisigService', () => {
+    it('reads the cold commitment from on-chain via getSignerDetailsFromAccount(_, true) and inits a service with cold pubkey', async () => {
+      const account = { id: () => ({ toString: () => 'acc-id' }) } as never;
+      const walletAccount = { publicKey: 'acc-id', coldPublicKey: 'cold-pub' } as never;
+      const loaded = makeMultisig();
+      multisigClientConfig.load.mockResolvedValueOnce(loaded);
+      mockGetSignerDetailsFromAccount.mockResolvedValueOnce({ commitment: 'cold-commit-no-prefix' });
+
+      const signWordFn = jest.fn(async () => 'sig');
+      const svc = await MultisigService.buildColdMultisigService(account, walletAccount, signWordFn);
+
+      expect(mockGetSignerDetailsFromAccount).toHaveBeenCalledWith(account, true);
+      expect(svc).toBeInstanceOf(MultisigService);
+      // The service initialized via init forwards the COLD pubkey/commitment
+      // (each prefixed with 0x) to the WalletSigner. We can't introspect that
+      // directly here, so we assert load was called — proving init proceeded.
+      expect(multisigClientConfig.load).toHaveBeenCalledWith('acc-id', expect.anything());
+    });
+
+    it('throws when the WalletAccount has no coldPublicKey', async () => {
+      const account = { id: () => ({ toString: () => 'acc-id' }) } as never;
+      const walletAccount = { publicKey: 'acc-id' } as never; // missing coldPublicKey
+      const signWordFn = jest.fn(async () => 'sig');
+
+      await expect(MultisigService.buildColdMultisigService(account, walletAccount, signWordFn)).rejects.toThrow(
+        /missing coldPublicKey/
+      );
+      expect(multisigClientConfig.load).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('createReplaceHotKeyProposal', () => {
+    it('mints a fresh hot key and builds a single-proposal swap with target list [newHot, cold]', async () => {
+      const multisig = makeMultisig({ threshold: 1 });
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+      const account = { id: () => ({ toString: () => 'acc-id' }) } as never;
+
+      mockGenerateHotKey.mockResolvedValueOnce({
+        ciphertext: 'new-hot-cipher',
+        publicKeyHex: 'new-hot-pub',
+        commitmentHex: '0xnewhotcommit'
+      });
+      mockGetSignerDetailsFromAccount.mockResolvedValueOnce({ commitment: 'coldcommitnoprefix' });
+
+      const result = await service.createReplaceHotKeyProposal(account);
+
+      expect(mockGenerateHotKey).toHaveBeenCalled();
+      expect(mockGetSignerDetailsFromAccount).toHaveBeenCalledWith(account, true);
+      // Order preservation: newHot at index 0, cold at index 1.
+      expect(mockBuildUpdateSignersTransactionRequest).toHaveBeenCalledWith(
+        expect.anything(),
+        1,
+        ['0xnewhotcommit', '0xcoldcommitnoprefix'],
+        { signatureScheme: 'ecdsa' }
+      );
+      expect(mockExecuteForSummary).toHaveBeenCalledWith(expect.anything(), 'acc-id', { kind: 'request' });
+      // Proposal label is cosmetic; on-chain effect is dictated by targetSignerCommitments.
+      expect(multisig.createProposal).toHaveBeenCalledWith(
+        expect.any(Number),
+        'base64-bytes',
+        expect.objectContaining({
+          proposalType: 'add_signer',
+          targetThreshold: 1,
+          targetSignerCommitments: ['0xnewhotcommit', '0xcoldcommitnoprefix'],
+          saltHex: 'salt-hex'
+        })
+      );
+      expect(result.newHot).toEqual({
+        ciphertext: 'new-hot-cipher',
+        publicKeyHex: 'new-hot-pub',
+        commitmentHex: '0xnewhotcommit'
+      });
+      expect(result.proposal).toEqual({ kind: 'custom', id: 'proposal-id' });
+    });
+
+    it('handles secureHotKey commitments without 0x prefix by adding it', async () => {
+      // Defensive: not all commitment producers may prefix. We normalize.
+      const multisig = makeMultisig({ threshold: 1 });
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+      const account = { id: () => 'acc-id' } as never;
+
+      mockGenerateHotKey.mockResolvedValueOnce({
+        ciphertext: 'cx',
+        publicKeyHex: 'pk',
+        commitmentHex: 'newhotnoprefix' // intentionally unprefixed
+      });
+      mockGetSignerDetailsFromAccount.mockResolvedValueOnce({ commitment: 'coldnoprefix' });
+
+      await service.createReplaceHotKeyProposal(account);
+
+      expect(mockBuildUpdateSignersTransactionRequest).toHaveBeenCalledWith(
+        expect.anything(),
+        1,
+        ['0xnewhotnoprefix', '0xcoldnoprefix'],
+        { signatureScheme: 'ecdsa' }
+      );
+    });
+  });
 });
diff --git a/src/lib/miden/guardian/index.ts b/src/lib/miden/guardian/index.ts
index 9dc77d580..18ab99a10 100644
--- a/src/lib/miden/guardian/index.ts
+++ b/src/lib/miden/guardian/index.ts
@@ -3,15 +3,21 @@ import {
   Multisig,
   MultisigClient,
   GuardianHttpClient,
+  buildUpdateSignersTransactionRequest,
+  executeForSummary,
   type ProposalMetadata,
   type TransactionProposal,
   type Proposal
 } from '@openzeppelin/miden-multisig-client';
 
 import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
+import * as secureHotKey from 'lib/secure-hot-key';
+import type { GeneratedHotKey } from 'lib/secure-hot-key';
 import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { u8ToB64 } from 'lib/shared/helpers';
+import type { WalletAccount } from 'lib/shared/types';
 
+import { getSignerDetailsFromAccount } from './account';
 import { WalletSigner, type SignWordFunction } from './signer';
 import { fetchFromStorage } from '../front/storage';
 import { accountIdStringToSdk } from '../sdk/helpers';
@@ -61,6 +67,28 @@ export class MultisigService {
     }
   }
 
+  /**
+   * Build a transient cold-bound MultisigService for ops that must be cold-signed
+   * (switch_guardian co-sign and replace_hot_key). The cold commitment is read
+   * from on-chain storage via getSignerDetailsFromAccount(_, true) — order
+   * convention `[hot, cold]` is preserved across rotations because
+   * createReplaceHotKeyProposal uses an in-place swap target list.
+   *
+   * Caller is expected to drop the returned service immediately after use so
+   * cold key material doesn't outlive the operation.
+   */
+  static async buildColdMultisigService(
+    account: Account,
+    walletAccount: WalletAccount,
+    signWordFn: SignWordFunction
+  ): Promise<MultisigService> {
+    if (!walletAccount.coldPublicKey) {
+      throw new Error(`Guardian account ${walletAccount.publicKey} is missing coldPublicKey — re-create the wallet`);
+    }
+    const { commitment } = await getSignerDetailsFromAccount(account, true);
+    return MultisigService.init(account, `0x${walletAccount.coldPublicKey}`, `0x${commitment}`, signWordFn);
+  }
+
   static async importAccountFromGuardian(
     publicKey: string,
     signerCommitment: string,
@@ -136,19 +164,29 @@ export class MultisigService {
       proposalType: 'unknown',
       description: 'Custom transaction'
     };
-
     const proposal = await this.multisig.createProposal(nonce, txSummaryBase64, metadata);
 
     return proposal;
   }
 
+  /**
+   * Sign a proposal with this service's bound signer. Used by switch_guardian's
+   * cold co-sign path where cold contributes a signature without driving the
+   * follow-up createTransactionProposalRequest call (hot does that).
+   * Sigs accumulate on the Guardian server keyed by proposal id.
+   */
+  async signProposal(id: string): Promise<void> {
+    await this.multisig.signProposal(id);
+  }
+
   async signAndExecuteProposal(id: string): Promise<void> {
     await this.multisig.signProposal(id);
     await this.multisig.executeProposal(id);
   }
 
   async signAndCreateTransactionRequest(id: string): Promise<TransactionRequest> {
-    await this.multisig.signProposal(id);
+    const singedProposal = await this.multisig.signProposal(id);
+    console.log('Signed proposal, creating transaction request with id:', singedProposal.signatures);
     return await this.multisig.createTransactionProposalRequest(id);
   }
 
@@ -192,7 +230,7 @@ export class MultisigService {
   ): Promise<{ proposal: Proposal; newEndpoint: string }> {
     try {
       const newGuardian = new GuardianHttpClient(newGuardianEndpoint);
-      const { commitment } = await newGuardian.getPubkey();
+      const { commitment } = await newGuardian.getPubkey('ecdsa');
       const proposal = await this.multisig.createSwitchGuardianProposal(newGuardianEndpoint, commitment);
       await this.multisig.createProposal(proposal.nonce, proposal.txSummary, proposal.metadata);
       console.log('Created switch-guardian proposal with new endpoint:', newGuardianEndpoint);
@@ -203,6 +241,61 @@ export class MultisigService {
     }
   }
 
+  /**
+   * Build a proposal that replaces this account's hot signer in-place. Mints a
+   * fresh hot key via the secureHotKey facade and constructs an `update_signers`
+   * proposal whose target list is `[newHotCommit, coldCommit]` (preserving the
+   * `[hot, cold]` ordering convention so getSignerDetailsFromAccount keeps
+   * working post-rotation).
+   *
+   * Bypasses the SDK's createAddSignerProposal/createRemoveSignerProposal
+   * convenience wrappers (those compute different target lists). At execution
+   * time, multisig.ts's buildTransactionRequestFromMetadata treats all three
+   * `update_signers` variants identically and uses metadata.targetSignerCommitments
+   * directly — so labeling this as 'add_signer' is cosmetic.
+   *
+   * Sign + submit this proposal with a cold-bound MultisigService — replacing
+   * the hot key cannot itself require the hot key (recovery-friendly). Default
+   * threshold for update_signers is 1, so cold alone satisfies it.
+   *
+   * Caller is responsible for persisting `newHot.ciphertext` BEFORE submitting
+   * the resulting tx (see initiateReplaceHotKeyTransaction).
+   */
+  async createReplaceHotKeyProposal(account: Account): Promise<{ proposal: Proposal; newHot: GeneratedHotKey }> {
+    const newHot = await secureHotKey.generateHotKey();
+    const { commitment: coldCommitRaw } = await getSignerDetailsFromAccount(account, true);
+    const ensure0x = (h: string): string => (h.startsWith('0x') ? h : `0x${h}`);
+    const targetSignerCommitments = [ensure0x(newHot.commitmentHex), ensure0x(coldCommitRaw)];
+    const targetThreshold = this.multisig.threshold;
+
+    const webClient = (await getMidenClient()).client;
+    const { request, salt } = await withWasmClientLock(async () =>
+      buildUpdateSignersTransactionRequest(webClient, targetThreshold, targetSignerCommitments, {
+        signatureScheme: 'ecdsa'
+      })
+    );
+    const summary = await withWasmClientLock(async () => executeForSummary(webClient, this.accountId, request));
+    const summaryBase64 = u8ToB64(summary.serialize());
+    console.log(
+      'Executed transaction for summary',
+      summaryBase64,
+      'with target signer commitments',
+      targetSignerCommitments
+    );
+    const metadata: ProposalMetadata = {
+      proposalType: 'add_signer',
+      targetThreshold,
+      targetSignerCommitments,
+      saltHex: salt.toHex(),
+      requiredSignatures: this.multisig.getEffectiveThreshold('add_signer'),
+      description: 'Replace device (hot) signer'
+    };
+
+    const proposal = await this.multisig.createProposal(Date.now(), summaryBase64, metadata);
+    console.log('Created replace-hot-key proposal:', proposal.id);
+    return { proposal, newHot };
+  }
+
   /**
    * Post-submit finalization for a switch-guardian proposal. Mirrors the
    * block that upstream's `multisig.executeProposal` runs when it detects
diff --git a/src/lib/secure-hot-key/nativePlugin.test.ts b/src/lib/secure-hot-key/nativePlugin.test.ts
index 2d4d308b2..1116041f4 100644
--- a/src/lib/secure-hot-key/nativePlugin.test.ts
+++ b/src/lib/secure-hot-key/nativePlugin.test.ts
@@ -11,6 +11,8 @@
  *    type prefix (currently hardcoded as 0x01).
  */
 
+import * as nativePlugin from './nativePlugin';
+
 const mockGenerateHotKey = jest.fn();
 const mockSignWithHotKey = jest.fn();
 const mockDeleteHotKey = jest.fn();
@@ -38,8 +40,6 @@ jest.mock('@miden-sdk/miden-sdk/lazy', () => ({
   }
 }));
 
-import * as nativePlugin from './nativePlugin';
-
 beforeEach(() => {
   jest.clearAllMocks();
   mockIsIOS.mockReturnValue(false);
diff --git a/src/lib/shared/types.ts b/src/lib/shared/types.ts
index 707412f51..267244b57 100644
--- a/src/lib/shared/types.ts
+++ b/src/lib/shared/types.ts
@@ -58,6 +58,10 @@ export enum WalletMessageType {
   SignTransactionResponse = 'SIGN_TRANSACTION_RESPONSE',
   SignWordRequest = 'SIGN_WORD_REQUEST',
   SignWordResponse = 'SIGN_WORD_RESPONSE',
+  PersistNewHotKeyRequest = 'PERSIST_NEW_HOT_KEY_REQUEST',
+  PersistNewHotKeyResponse = 'PERSIST_NEW_HOT_KEY_RESPONSE',
+  SwapHotKeyRequest = 'SWAP_HOT_KEY_REQUEST',
+  SwapHotKeyResponse = 'SWAP_HOT_KEY_RESPONSE',
   GetPublicKeyForCommitmentRequest = 'GET_PUBLIC_KEY_FOR_COMMITMENT_REQUEST',
   GetPublicKeyForCommitmentResponse = 'GET_PUBLIC_KEY_FOR_COMMITMENT_RESPONSE',
   GetAuthSecretKeyRequest = 'GET_AUTH_SECRET_KEY_REQUEST',
@@ -489,6 +493,27 @@ export interface SignWordResponse extends WalletMessageBase {
   signature: string;
 }
 
+export interface PersistNewHotKeyRequest extends WalletMessageBase {
+  type: WalletMessageType.PersistNewHotKeyRequest;
+  newHotPubKey: string;
+  newHotCiphertext: string;
+}
+
+export interface PersistNewHotKeyResponse extends WalletMessageBase {
+  type: WalletMessageType.PersistNewHotKeyResponse;
+}
+
+export interface SwapHotKeyRequest extends WalletMessageBase {
+  type: WalletMessageType.SwapHotKeyRequest;
+  accountPublicKey: string;
+  oldHotPubKey: string;
+  newHotPubKey: string;
+}
+
+export interface SwapHotKeyResponse extends WalletMessageBase {
+  type: WalletMessageType.SwapHotKeyResponse;
+}
+
 export interface GetPublicKeyForCommitmentRequest extends WalletMessageBase {
   type: WalletMessageType.GetPublicKeyForCommitmentRequest;
   commitment: string;
@@ -699,6 +724,8 @@ export type WalletRequest =
   | SignDataRequest
   | SignTransactionRequest
   | SignWordRequest
+  | PersistNewHotKeyRequest
+  | SwapHotKeyRequest
   | GetPublicKeyForCommitmentRequest
   | GetAuthSecretKeyRequest
   | PageRequest
@@ -749,6 +776,8 @@ export type WalletResponse =
   | SignDataResponse
   | SignTransactionResponse
   | SignWordResponse
+  | PersistNewHotKeyResponse
+  | SwapHotKeyResponse
   | GetPublicKeyForCommitmentResponse
   | GetAuthSecretKeyResponse
   | PageResponse
diff --git a/src/lib/store/index.ts b/src/lib/store/index.ts
index 47214df9d..3765f6527 100644
--- a/src/lib/store/index.ts
+++ b/src/lib/store/index.ts
@@ -306,6 +306,25 @@ export const useWalletStore = create<WalletStore>()(
       return res.signature;
     },
 
+    persistNewHotKey: async (newHotPubKey, newHotCiphertext) => {
+      const res = await request({
+        type: WalletMessageType.PersistNewHotKeyRequest,
+        newHotPubKey,
+        newHotCiphertext
+      });
+      assertResponse(res.type === WalletMessageType.PersistNewHotKeyResponse);
+    },
+
+    swapHotKey: async (accountPublicKey, oldHotPubKey, newHotPubKey) => {
+      const res = await request({
+        type: WalletMessageType.SwapHotKeyRequest,
+        accountPublicKey,
+        oldHotPubKey,
+        newHotPubKey
+      });
+      assertResponse(res.type === WalletMessageType.SwapHotKeyResponse);
+    },
+
     getPublicKeyForCommitment: async commitment => {
       const res = await request({
         type: WalletMessageType.GetPublicKeyForCommitmentRequest,
diff --git a/src/lib/store/types.ts b/src/lib/store/types.ts
index 7ce3394f4..a56f1b100 100644
--- a/src/lib/store/types.ts
+++ b/src/lib/store/types.ts
@@ -145,6 +145,8 @@ export interface WalletActions {
   signData: (publicKey: string, signingInputs: string) => Promise<string>;
   signTransaction: (publicKey: string, signingInputs: string) => Promise<Uint8Array>;
   signWord: (publicKey: string, wordHex: string) => Promise<string>;
+  persistNewHotKey: (newHotPubKey: string, newHotCiphertext: string) => Promise<void>;
+  swapHotKey: (accountPublicKey: string, oldHotPubKey: string, newHotPubKey: string) => Promise<void>;
   getPublicKeyForCommitment: (commitment: string) => Promise<string>;
   getAuthSecretKey: (key: string) => Promise<string>;
 

From 49ca8794a80014fd67165c2ed4f898d2516329c0 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Tue, 5 May 2026 22:16:04 +0530
Subject: [PATCH 43/71] fix(guardian): refresh sync state and cache after
 hot-key rotation

---
 src/lib/miden/back/actions.ts           |  8 +++-
 src/lib/miden/front/guardian-manager.ts | 51 +++++++++++++++----------
 2 files changed, 37 insertions(+), 22 deletions(-)

diff --git a/src/lib/miden/back/actions.ts b/src/lib/miden/back/actions.ts
index 9290bdccf..7a51acaae 100644
--- a/src/lib/miden/back/actions.ts
+++ b/src/lib/miden/back/actions.ts
@@ -312,7 +312,13 @@ export function persistNewHotKey(newHotPubKey: string, newHotCiphertext: string)
 
 export function swapHotKey(accountPublicKey: string, oldHotPubKey: string, newHotPubKey: string) {
   return withUnlocked(async ({ vault }) => {
-    await vault.swapHotKey(accountPublicKey, oldHotPubKey, newHotPubKey);
+    const updated = await vault.swapHotKey(accountPublicKey, oldHotPubKey, newHotPubKey);
+    // Push the updated WalletAccount[] into the Effector store so the
+    // frontStore mapping fires StateUpdated. Without this, the popup's Zustand
+    // `accounts[i].hotPublicKey` stays at the pre-rotation value, the next
+    // sync cycle reads the stale pubkey, and `getOrCreateMultisigService`
+    // re-binds against the old hot key.
+    accountsUpdated(updated);
   });
 }
 
diff --git a/src/lib/miden/front/guardian-manager.ts b/src/lib/miden/front/guardian-manager.ts
index 6c49eacca..795318b15 100644
--- a/src/lib/miden/front/guardian-manager.ts
+++ b/src/lib/miden/front/guardian-manager.ts
@@ -8,8 +8,13 @@ import { fetchFromStorage } from './storage';
 import { getSignerDetailsFromAccount } from '../guardian/account';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 
-// Cache MultisigService instances to avoid re-initialization on every sync cycle
-const guardianServiceCache = new Map<string, MultisigService>();
+// Cache MultisigService instances to avoid re-initialization on every sync cycle.
+// `hotPublicKey` is recorded alongside so rotations are detected on next access:
+// the cached service is bound to a specific WalletSigner pubkey, and after a
+// replace-hot-key tx the WalletAccount.hotPublicKey changes — without the
+// drift check, the popup sync keeps signing with the rotated-out key.
+type CacheEntry = { service: MultisigService; hotPublicKey: string };
+const guardianServiceCache = new Map<string, CacheEntry>();
 
 /**
  * Callbacks for resolving account data.
@@ -39,28 +44,13 @@ export async function getOrCreateMultisigService(
   provider: GuardianAccountProvider
 ): Promise<MultisigService> {
   console.log(`[Guardian Manager] Getting/creating MultisigService for account: ${accountPublicKey}`);
-  // Return cached instance if its endpoint still matches storage. In the
-  // extension build, `clearGuardianServiceFor` from the SW realm doesn't reach
-  // the frontend's own copy of this Map, so a guardian switch would leave
-  // the popup syncing against the old guardian indefinitely. Re-check
-  // GUARDIAN_URL_STORAGE_KEY here and evict on drift.
-  const cached = guardianServiceCache.get(accountPublicKey);
-  if (cached) {
-    try {
-      const currentEndpoint = (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
-      if (cached.guardianEndpoint === currentEndpoint) return cached;
-      guardianServiceCache.delete(accountPublicKey);
-    } catch (error) {}
-  }
-  console.log('[Guardian Manager] No valid cached MultisigService found, creating new one...');
-  // Verify this is a Guardian account
+  // Resolve the WalletAccount upfront — needed for both the cache drift
+  // check (hotPublicKey can rotate) and any subsequent service init.
   const accounts = await provider.getAccounts();
   const account = accounts.find(acc => acc.publicKey === accountPublicKey);
   if (!account || account.type !== WalletType.Guardian) {
     throw new Error('Account is not a Guardian account');
   }
-
-  console.log('[Guardian Manager] Found Guardian account in provider:', account);
   // Phase 4: hot pubkey lives on the WalletAccount record (set at create
   // time). A Guardian account without it is either a legacy Falcon record
   // pre-Phase 1 or an in-flight migration mid-write — both are unsigned
@@ -68,6 +58,24 @@ export async function getOrCreateMultisigService(
   if (!account.hotPublicKey) {
     throw new Error(`Guardian account ${accountPublicKey} is missing hotPublicKey — re-create the wallet`);
   }
+  // Return cached instance if its endpoint AND bound hot pubkey still match.
+  // Two separate drift sources:
+  //   - guardian endpoint: switch_guardian rotates the URL; clearGuardianServiceFor
+  //     in the SW realm doesn't reach the popup's Map, so re-check storage here.
+  //   - hot pubkey: replace_hot_key rotates account.hotPublicKey; the cached
+  //     service is still bound to the previous WalletSigner.publicKey.
+  const cached = guardianServiceCache.get(accountPublicKey);
+  if (cached) {
+    try {
+      const currentEndpoint = (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
+      if (cached.service.guardianEndpoint === currentEndpoint && cached.hotPublicKey === account.hotPublicKey) {
+        return cached.service;
+      }
+      guardianServiceCache.delete(accountPublicKey);
+    } catch (error) {}
+  }
+  console.log('[Guardian Manager] No valid cached MultisigService found, creating new one...');
+  console.log('[Guardian Manager] Found Guardian account in provider:', account);
 
   // Get the Account object from Miden client
   const { sdkAccount } = await withWasmClientLock(async () => {
@@ -96,8 +104,9 @@ export async function getOrCreateMultisigService(
     provider.signWord
   );
 
-  // Cache for future use
-  guardianServiceCache.set(accountPublicKey, service);
+  // Cache for future use, tagged with the hot pubkey it was bound to so the
+  // next access can detect rotation and force a re-init.
+  guardianServiceCache.set(accountPublicKey, { service, hotPublicKey: account.hotPublicKey });
 
   return service;
 }

From d9048a7076c8eb055385390eaada3271bc8f4ab0 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Mon, 11 May 2026 15:32:41 +0530
Subject: [PATCH 44/71] chore(deps): bump
 @openzeppelin/{guardian,miden-multisig}-client to 0.14.5

---
 package.json |  4 ++--
 yarn.lock    | 18 +++++++++---------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/package.json b/package.json
index 25d10936b..355241f4f 100644
--- a/package.json
+++ b/package.json
@@ -122,8 +122,8 @@
     "@miden/dapp-browser": "link:./packages/dapp-browser",
     "@newhighsco/storybook-addon-svgr": "^2.0.7",
     "@noble/hashes": "^1.4.0",
-    "@openzeppelin/guardian-client": "^0.14.3",
-    "@openzeppelin/miden-multisig-client": "^0.14.3",
+    "@openzeppelin/guardian-client": "^0.14.5",
+    "@openzeppelin/miden-multisig-client": "^0.14.5",
     "@peculiar/webcrypto": "1.1.6",
     "@radix-ui/react-slot": "^1.2.3",
     "@segment/analytics-node": "^2.3.0",
diff --git a/yarn.lock b/yarn.lock
index b56214b7e..fb7b5aede 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2361,20 +2361,20 @@
   resolved "https://registry.yarnpkg.com/@nolyfill/is-core-module/-/is-core-module-1.0.39.tgz#3dc35ba0f1e66b403c00b39344f870298ebb1c8e"
   integrity sha512-nn5ozdjYQpUCZlWGuxcJY/KpxkWQs4DcbMCmKojjyrYDEAGy4Ce19NN4v5MduafTwJlbKc99UA8YhSVqq9yPZA==
 
-"@openzeppelin/guardian-client@^0.14.3":
-  version "0.14.3"
-  resolved "https://registry.yarnpkg.com/@openzeppelin/guardian-client/-/guardian-client-0.14.3.tgz#7aa4602ac99aab174e4764dafa1dfd600522d9c5"
-  integrity sha512-t1HW2LxB0YWB4JZB0L1O3Ue3+/VFipmtumHbgnQeWloflym3bg6dWV75zZkcPyLACURJliT3LIhdg/3w0tcA5Q==
+"@openzeppelin/guardian-client@^0.14.5":
+  version "0.14.5"
+  resolved "https://registry.yarnpkg.com/@openzeppelin/guardian-client/-/guardian-client-0.14.5.tgz#931e4e5e1fd7f23e1900b8af5a4d18b061679b60"
+  integrity sha512-onp82BBEH4Z/VeNOMn/uZXUMb5SU+AanTld2sv/2jQ9gfnlnW7Q2LlNg7E0jt5oinoZ0OcNJ8luNx8++O+6y0Q==
 
-"@openzeppelin/miden-multisig-client@^0.14.3":
-  version "0.14.3"
-  resolved "https://registry.yarnpkg.com/@openzeppelin/miden-multisig-client/-/miden-multisig-client-0.14.3.tgz#f738f4ec80362a66fbd3e56cb6432d463852c682"
-  integrity sha512-kVBpEAU0cuAshVOGQ3RD+cFODxVr7dnipi1n7x2FCFmGTWktT8di441ZmPd3/qid1GEoG0Y8UaqrX+6v2YxCDw==
+"@openzeppelin/miden-multisig-client@^0.14.5":
+  version "0.14.5"
+  resolved "https://registry.yarnpkg.com/@openzeppelin/miden-multisig-client/-/miden-multisig-client-0.14.5.tgz#0a4dddd9400d525437eada122bbd97df595e7767"
+  integrity sha512-3SCO1WU/PDgxM5zdBaoVpMH4U3VzAP69bl2korYBha2L9K+DKohhloR5qRAbUSyeCGlpB8k7lO+Fv5CuoXTUng==
   dependencies:
     "@miden-sdk/miden-sdk" "0.14.3"
     "@noble/curves" "^1.9.7"
     "@noble/hashes" "^2.0.1"
-    "@openzeppelin/guardian-client" "^0.14.3"
+    "@openzeppelin/guardian-client" "^0.14.5"
 
 "@oxc-project/types@=0.124.0":
   version "0.124.0"

From cee363ea543844b00b317659556df93f856b4c81 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Mon, 11 May 2026 15:32:46 +0530
Subject: [PATCH 45/71] feat(guardian): switch-guardian cold-signing
 confirmation + Phase 7 cleanup

---
 CHANGELOG.md                                  |  2 +-
 public/_locales/en/en.json                    |  2 +
 src/app/templates/GuardianSettings.tsx        | 21 ++++++++-
 .../miden/activity/transactions.gaps.test.ts  |  2 +-
 .../activity/transactions.guardian.test.ts    |  8 ++--
 src/lib/miden/back/vault.gaps.test.ts         | 44 ++++++++++++-------
 src/lib/miden/back/vault.test.ts              |  2 +-
 src/lib/miden/back/vault.ts                   |  2 +-
 src/lib/miden/front/guardian-manager.ts       |  8 ++--
 src/lib/miden/guardian/account.ts             |  5 ++-
 src/lib/miden/guardian/index.test.ts          |  2 +-
 src/lib/secure-hot-key/index.ts               | 12 ++---
 12 files changed, 72 insertions(+), 38 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 18c91f833..4c462d919 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,7 @@
 ### Features
 
 <<<<<<< utk-psm-integration
-* [FEATURE][all] 3-key Guardian: cold co-signs `switch_guardian` (on-chain threshold-2 satisfied via `procedureThresholds`) and a new Settings → Rotate Device Key flow lets users replace the hot signer in-place via a single cold-signed `update_signers` proposal, persisting the new ciphertext before submission and finalizing `WalletAccount.hotPublicKey` (plus releasing the old SE/StrongBox wrapper) only after on-chain inclusion.
+* [FEATURE][all] 3-key Guardian: cold co-signs `switch_guardian` (on-chain threshold-2 satisfied via `procedureThresholds`) and a new Settings → Rotate Device Key flow lets users replace the hot signer in-place via a single cold-signed `update_signers` proposal, persisting the new ciphertext before submission and finalizing `WalletAccount.hotPublicKey` (plus releasing the old SE/StrongBox wrapper) only after on-chain inclusion. Settings → Switch Guardian now requires an explicit confirmation step before initiating, mirroring the Rotate Device Key flow so the user acknowledges that the switch is cold-signed + guardian-co-signed.
 * [FEATURE][all] 3-key Guardian accounts. Guardian creation now provisions a hot ECDSA key (random, lives outside the WASM keystore behind a new `secure-hot-key` facade — extension/desktop use a JS fallback; iOS wraps the secret under a per-account Secure Enclave P-256 key via `HotKeyPlugin.swift`; Android wraps it under a per-account StrongBox-backed RSA-OAEP key via `HotKeyPlugin.kt` with biometric-gated unwrap, identical wire format on both platforms) plus an HD-derived cold ECDSA key (kept in the SDK keystore for cold-routed flows) alongside the existing guardian co-signer. Threshold stays at 1 (hot OR cold + guardian); cold-only routing for `update_signers` / `update_guardian` / `update_procedure_threshold` is enforced client-side per the Phase 0 SDK reading. Storage adds `accColdSecretKeyStrgKey` and `WalletAccount.{hotPublicKey,coldPublicKey}` so role-aware `signWord` (Phase 3) can dispatch hot vs cold by storage entity. Hard cutover from the 1-of-1 Falcon scheme — pre-cutover Guardian accounts are unreachable from this build.
 * [FEATURE][all] Guardian integration. Adds Guardian-backed accounts (1-of-1 multisig with on-chain Guardian signature verification), onboarding create/import flows with a dedicated recovery-method screen that accepts a custom guardian URL, Settings → Guardian Settings with an on-chain switch-guardian proposal that re-registers post-switch state with the new endpoint, service-worker routing for Guardian transaction signing via `MultisigService`, frontend Guardian sync outside the WASM lock, and per-stage progress labels (`creating-proposal`, `signing-proposal`, `submitting`, `registering-guardian`) in the transaction modal.
 =======
diff --git a/public/_locales/en/en.json b/public/_locales/en/en.json
index 2aa4851fd..9d428a1b4 100644
--- a/public/_locales/en/en.json
+++ b/public/_locales/en/en.json
@@ -381,6 +381,8 @@
   "newGuardianEndpoint": "New Guardian Endpoint",
   "switchGuardian": "Switch Guardian",
   "switchGuardianDescription": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal.",
+  "switchGuardianConfirmation": "This is signed with your recovery (cold) key and co-signed by your current guardian. Your funds and account stay the same. Continue?",
+  "confirmSwitchGuardian": "Confirm switch",
   "switchingGuardian": "Switching guardian...",
   "guardianSwitched": "Guardian switched successfully.",
   "guardianEndpointUnchanged": "That's already your current guardian.",
diff --git a/src/app/templates/GuardianSettings.tsx b/src/app/templates/GuardianSettings.tsx
index 1181ba223..5c1c2eb32 100644
--- a/src/app/templates/GuardianSettings.tsx
+++ b/src/app/templates/GuardianSettings.tsx
@@ -33,6 +33,10 @@ const GuardianSettings: FC<Props> = ({ onClose }) => {
   const { t } = useTranslation();
   const { endpoint: currentEndpoint, refresh: refreshCurrentEndpoint } = useCurrentGuardianEndpoint();
   const [submitSuccess, setSubmitSuccess] = useState(false);
+  // Two-stage submit: first click validates + enters confirming, second click fires the tx.
+  // Mirrors GuardianReplaceHotKey's cold-signing confirmation since switch_guardian also
+  // requires the cold key (co-signed by the current guardian).
+  const [confirming, setConfirming] = useState(false);
 
   const {
     register,
@@ -57,6 +61,11 @@ const GuardianSettings: FC<Props> = ({ onClose }) => {
       clearErrors();
       setSubmitSuccess(false);
 
+      if (!confirming) {
+        setConfirming(true);
+        return;
+      }
+
       try {
         const txId = await initiateSwitchGuardianTransaction(
           currentAccount.publicKey,
@@ -74,6 +83,7 @@ const GuardianSettings: FC<Props> = ({ onClose }) => {
         }
 
         setSubmitSuccess(true);
+        setConfirming(false);
         reset({ guardianEndpoint: '' });
         // Pull the new endpoint back from storage so the "Current guardian"
         // display reflects the switch on platforms without storage-change events.
@@ -83,7 +93,7 @@ const GuardianSettings: FC<Props> = ({ onClose }) => {
         setError('guardianEndpoint', { type: 'manual', message });
       }
     },
-    [clearErrors, currentAccount, currentEndpoint, isSubmitting, refreshCurrentEndpoint, reset, setError, t]
+    [clearErrors, confirming, currentAccount, currentEndpoint, isSubmitting, refreshCurrentEndpoint, reset, setError, t]
   );
 
   return (
@@ -109,9 +119,16 @@ const GuardianSettings: FC<Props> = ({ onClose }) => {
           onChange={() => {
             clearErrors();
             if (submitSuccess) setSubmitSuccess(false);
+            // Editing the endpoint after confirming invalidates the confirmation:
+            // drop back to the form-entry stage so the user re-acknowledges the new value.
+            if (confirming) setConfirming(false);
           }}
         />
 
+        {confirming && !isSubmitting && !submitSuccess && (
+          <div className="text-xs text-heading-gray mb-3 select-text">{t('switchGuardianConfirmation')}</div>
+        )}
+
         <FormSubmitButton
           className="capitalize w-full justify-center mt-6"
           loading={isSubmitting}
@@ -125,7 +142,7 @@ const GuardianSettings: FC<Props> = ({ onClose }) => {
             paddingBottom: '12px'
           }}
         >
-          {t('switchGuardian')}
+          {confirming ? t('confirmSwitchGuardian') : t('switchGuardian')}
         </FormSubmitButton>
 
         {submitSuccess && (
diff --git a/src/lib/miden/activity/transactions.gaps.test.ts b/src/lib/miden/activity/transactions.gaps.test.ts
index bf968fb92..442d5ada3 100644
--- a/src/lib/miden/activity/transactions.gaps.test.ts
+++ b/src/lib/miden/activity/transactions.gaps.test.ts
@@ -677,7 +677,7 @@ describe('generateTransaction execute + consume default switch arms', () => {
     guardianManager.isGuardianAccount.mockResolvedValueOnce(true);
     const fakeMultisigService = {
       createConsumeNotesProposal: jest.fn(async () => ({ id: 'proposal-1' })),
-      signAndCreateTransactionRequest: jest.fn(async () => ({ serialize: () => new Uint8Array([1]) })),
+      signAndCreateTransactionRequest: jest.fn(async () => ({ serialize: () => new Uint8Array([1]), authArg: () => undefined })),
       sync: jest.fn(async () => {})
     };
     guardianManager.getOrCreateMultisigService.mockResolvedValueOnce(fakeMultisigService);
diff --git a/src/lib/miden/activity/transactions.guardian.test.ts b/src/lib/miden/activity/transactions.guardian.test.ts
index bd8e125d1..f2a218d89 100644
--- a/src/lib/miden/activity/transactions.guardian.test.ts
+++ b/src/lib/miden/activity/transactions.guardian.test.ts
@@ -219,7 +219,7 @@ describe('generateTransaction — Guardian routing', () => {
 
     const multisigService = {
       createSendProposal: jest.fn(async () => ({ id: 'prop-1' })),
-      signAndCreateTransactionRequest: jest.fn(async () => ({ serialize: () => new Uint8Array([1]) })),
+      signAndCreateTransactionRequest: jest.fn(async () => ({ serialize: () => new Uint8Array([1]), authArg: () => undefined })),
       sync: jest.fn(async () => {})
     };
     mockGetOrCreateMultisigService.mockResolvedValue(multisigService);
@@ -263,7 +263,7 @@ describe('generateTransaction — Guardian routing', () => {
     const result = makeResult();
     const multisigService = {
       createConsumeNotesProposal: jest.fn(async () => ({ id: 'prop-consume' })),
-      signAndCreateTransactionRequest: jest.fn(async () => ({ serialize: () => new Uint8Array([1]) })),
+      signAndCreateTransactionRequest: jest.fn(async () => ({ serialize: () => new Uint8Array([1]), authArg: () => undefined })),
       sync: jest.fn(async () => {})
     };
     mockGetOrCreateMultisigService.mockResolvedValue(multisigService);
@@ -311,7 +311,7 @@ describe('generateTransaction — Guardian routing', () => {
         proposal: { id: 'prop-switch' },
         newEndpoint: 'https://new.guardian'
       })),
-      signAndCreateTransactionRequest: jest.fn(async () => ({ serialize: () => new Uint8Array([1]) })),
+      signAndCreateTransactionRequest: jest.fn(async () => ({ serialize: () => new Uint8Array([1]), authArg: () => undefined })),
       finalizeGuardianSwitch: jest.fn(async () => {}),
       sync: jest.fn(async () => {})
     };
@@ -381,7 +381,7 @@ describe('generateTransaction — Guardian routing', () => {
         proposal: { id: 'prop-replace' },
         newHot: { ciphertext: 'new-cx', publicKeyHex: 'new-hot-pub', commitmentHex: '0xnewcommit' }
       })),
-      signAndCreateTransactionRequest: jest.fn(async () => ({ serialize: () => new Uint8Array([1]) }))
+      signAndCreateTransactionRequest: jest.fn(async () => ({ serialize: () => new Uint8Array([1]), authArg: () => undefined }))
     };
     mockBuildColdMultisigService.mockResolvedValue(coldService);
 
diff --git a/src/lib/miden/back/vault.gaps.test.ts b/src/lib/miden/back/vault.gaps.test.ts
index 131626d4d..276e9031f 100644
--- a/src/lib/miden/back/vault.gaps.test.ts
+++ b/src/lib/miden/back/vault.gaps.test.ts
@@ -99,7 +99,7 @@ jest.mock('@miden-sdk/miden-sdk/lazy', () => {
     ...base,
     AuthSecretKey: {
       deserialize: (bytes: Uint8Array) => mockAuthSecretKeyDeserialize(bytes),
-      rpoFalconWithRNG: jest.fn(() => ({ __marker: 'rpo-falcon-secret' }))
+      ecdsaWithRNG: jest.fn(() => ({ __marker: 'ecdsa-secret' }))
     },
     SigningInputs: { deserialize: jest.fn(() => ({})) },
     Word: { deserialize: jest.fn(() => ({})), fromHex: (h: string) => mockWordFromHex(h) },
@@ -285,27 +285,41 @@ describe('Vault.spawn: preserved guardian URL', () => {
 });
 
 describe('Vault.spawn: Guardian import helpers', () => {
-  it('exercises signWordFn / getPublicKeyForCommitment when ownMnemonic + Guardian path runs', async () => {
-    // Wire the mocked client so its importAccountBySeed actually invokes the
-    // helpers we need to cover. Helpers read from the (post-callback) keystore,
-    // so we also have to make insertKeyCallback fire before invocation.
+  it('exercises the signWordFn helper when ownMnemonic + Guardian path runs', async () => {
+    // Wire the mocked client so its importGuardianAccountBySeed invokes the
+    // signWordFn helper closure defined inside Vault.spawn, and returns the
+    // 3-key Guardian shape (hot ciphertext + cold secret-key hex) so vault
+    // can call persistGuardianKeys without crashing.
     const sdk = require('../sdk/miden-client');
     const origGetClient = sdk.getMidenClient;
     sdk.getMidenClient = jest.fn(async (options: any) => ({
-      createMidenWallet: async (_t: any, _s: Uint8Array) => 'guardian-pk',
-      importAccountBySeed: async (
-        _walletType: any,
+      createGuardianMidenWallet: async (_seed: Uint8Array) => ({
+        accountId: 'guardian-pk',
+        keys: {
+          hotPublicKey: 'aa'.repeat(33),
+          hotCiphertext: 'cf'.repeat(64),
+          coldPublicKey: 'bb'.repeat(33),
+          coldSecretKeyHex: 'dd'.repeat(32)
+        }
+      }),
+      importGuardianAccountBySeed: async (
         _seed: Uint8Array,
-        signWordFn: (pk: string, hex: string) => Promise<string>,
-        getPubKeyFn: (pkc: string) => Promise<string>
+        signWordFn: (pk: string, hex: string) => Promise<string>
       ) => {
-        // Simulate the WASM client persisting an auth-secret first, then asking
-        // the wallet to sign + look up its commitment public key — the two
-        // helper closures defined inside Vault.spawn.
+        // Simulate the WASM client persisting an auth-secret via the
+        // insertKeyCallback that Vault.spawn passes to the SDK, then invoke
+        // signWordFn so the helper closure inside Vault.spawn gets exercised.
         await options.insertKeyCallback(new Uint8Array([0xaa, 0xbb]), new Uint8Array([0x01, 0x02, 0x03, 0x04]));
         await signWordFn('aabb', '0xdeadbeef');
-        await getPubKeyFn('aabb');
-        return 'guardian-pk';
+        return {
+          accountId: 'guardian-pk',
+          keys: {
+            hotPublicKey: 'aa'.repeat(33),
+            hotCiphertext: 'cf'.repeat(64),
+            coldPublicKey: 'bb'.repeat(33),
+            coldSecretKeyHex: 'dd'.repeat(32)
+          }
+        };
       },
       getAccounts: async () => [],
       getAccount: async () => null,
diff --git a/src/lib/miden/back/vault.test.ts b/src/lib/miden/back/vault.test.ts
index 6d9b170f0..e87f3645e 100644
--- a/src/lib/miden/back/vault.test.ts
+++ b/src/lib/miden/back/vault.test.ts
@@ -152,7 +152,7 @@ jest.mock('@miden-sdk/miden-sdk/lazy', () => {
     ...base,
     AuthSecretKey: {
       deserialize: (bytes: Uint8Array) => mockAuthSecretKeyDeserialize(bytes),
-      rpoFalconWithRNG: jest.fn(() => ({ __marker: 'rpo-falcon-secret' }))
+      ecdsaWithRNG: jest.fn(() => ({ __marker: 'ecdsa-secret' }))
     },
     SigningInputs: { deserialize: jest.fn(() => ({})) },
     Word: { deserialize: jest.fn(() => ({})) },
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index f8d43f4ac..016be49b3 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -450,7 +450,7 @@ export class Vault {
           }
           if (walletAccount.hdIndex < 0) {
             // Belt-and-suspenders: an imported account's key is NOT
-            // derivable from the mnemonic. Writing `rpoFalconWithRNG`
+            // derivable from the mnemonic. Writing `ecdsaWithRNG`
             // output into the keystore under its account id would
             // overwrite any preserved real secret with a garbage key
             // the vault can never sign with. Skip.
diff --git a/src/lib/miden/front/guardian-manager.ts b/src/lib/miden/front/guardian-manager.ts
index 795318b15..19b5b948c 100644
--- a/src/lib/miden/front/guardian-manager.ts
+++ b/src/lib/miden/front/guardian-manager.ts
@@ -51,10 +51,10 @@ export async function getOrCreateMultisigService(
   if (!account || account.type !== WalletType.Guardian) {
     throw new Error('Account is not a Guardian account');
   }
-  // Phase 4: hot pubkey lives on the WalletAccount record (set at create
-  // time). A Guardian account without it is either a legacy Falcon record
-  // pre-Phase 1 or an in-flight migration mid-write — both are unsigned
-  // states that should fail loudly rather than silently fall back.
+  // Hot pubkey lives on the WalletAccount record (set at create time). A
+  // Guardian account without it is either a legacy single-Falcon-key record
+  // (pre-migration) or an in-flight write that crashed mid-create — both are
+  // unsigned states that should fail loudly rather than silently fall back.
   if (!account.hotPublicKey) {
     throw new Error(`Guardian account ${accountPublicKey} is missing hotPublicKey — re-create the wallet`);
   }
diff --git a/src/lib/miden/guardian/account.ts b/src/lib/miden/guardian/account.ts
index 4a06b8ac0..912b2f846 100644
--- a/src/lib/miden/guardian/account.ts
+++ b/src/lib/miden/guardian/account.ts
@@ -102,8 +102,9 @@ export async function createGuardianAccount(
     const coldSecretKeyHex = Buffer.from(coldSk.serialize()).toString('hex');
 
     // Hot key — random, held outside the SDK keystore. On extension/desktop
-    // this is the JS fallback (serialized AuthSecretKey hex); on mobile this
-    // will be ECIES-wrapped under SE/StrongBox once Phase 4 lands.
+    // this is the JS fallback (serialized AuthSecretKey hex); on mobile it is
+    // wrapped under SE (iOS) or Keystore/StrongBox (Android) inside the native
+    // plugin and surfaces here only as opaque ciphertext.
     const hot = await secureHotKey.generateHotKey();
 
     // Get Guardian endpoint and initialize client
diff --git a/src/lib/miden/guardian/index.test.ts b/src/lib/miden/guardian/index.test.ts
index 426231ce4..2c95b9b79 100644
--- a/src/lib/miden/guardian/index.test.ts
+++ b/src/lib/miden/guardian/index.test.ts
@@ -148,7 +148,7 @@ const makeMultisig = (overrides: Partial<Record<string, unknown>> = {}) => ({
   createConsumeNotesProposal: jest.fn(async () => ({ kind: 'consume' })),
   createProposal: jest.fn(async () => ({ kind: 'custom', id: 'proposal-id' })),
   createTransactionProposalRequest: jest.fn(async () => 'tx-req'),
-  signProposal: jest.fn(async () => {}),
+  signProposal: jest.fn(async () => ({ signatures: [] })),
   executeProposal: jest.fn(async () => {}),
   syncState: jest.fn(async () => {}),
   getConsumableNotes: jest.fn(async () => ['note-a']),
diff --git a/src/lib/secure-hot-key/index.ts b/src/lib/secure-hot-key/index.ts
index 923c5e281..5cd276c5b 100644
--- a/src/lib/secure-hot-key/index.ts
+++ b/src/lib/secure-hot-key/index.ts
@@ -1,12 +1,12 @@
 /**
  * Platform-abstraction facade for the Guardian "hot" signing key.
  *
- * Hot keys live outside the WASM keystore. On mobile (Phase 4) they will be
- * ECIES-wrapped under a per-account P-256 key in Secure Enclave / StrongBox
- * and unwrapped only inside a native plugin during a biometric prompt. On
- * extension and desktop (Phase 5) the JS fallback serializes an
- * `AuthSecretKey.ecdsaWithRNG(...)` blob and relies on the surrounding vault
- * envelope for at-rest protection.
+ * Hot keys live outside the WASM keystore. On mobile, they are wrapped under
+ * a per-account hardware-backed key (iOS Secure Enclave via ECIES, Android
+ * Keystore/StrongBox via RSA-OAEP) and unwrapped only inside a native plugin
+ * during a biometric prompt. On extension and desktop, the JS fallback
+ * serializes an `AuthSecretKey.ecdsaWithRNG(...)` blob and relies on the
+ * surrounding vault envelope for at-rest protection.
  *
  * Callers should never need to know which path executed: all three operations
  * take/return strings.

From 731dc33136ba3cfbbf114f6a46658d10afe83632 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Tue, 12 May 2026 15:42:08 +0530
Subject: [PATCH 46/71] feat(guardian): defer post-recovery hot-key activation
 to a banner

---
 CHANGELOG.md                                  |   2 +-
 public/_locales/en/en.json                    |   5 +
 src/app/pages/Explore.tsx                     |   2 +
 src/app/templates/ActivateHotKeyBanner.tsx    |  73 +++++++
 src/lib/intercom/mobile-adapter.ts            |   2 +-
 .../activity/transactions.guardian.test.ts    |  21 +-
 src/lib/miden/activity/transactions.ts        |  53 +++--
 src/lib/miden/back/actions.ts                 |   4 +-
 src/lib/miden/back/main.ts                    |   2 +-
 src/lib/miden/back/transaction-processor.ts   |   4 +-
 src/lib/miden/back/vault.gaps.test.ts         |  42 ++--
 src/lib/miden/back/vault.test.ts              |  43 ++--
 src/lib/miden/back/vault.ts                   | 197 +++++++++++-------
 src/lib/miden/front/guardian-manager.ts       |   2 +-
 src/lib/miden/front/guardian-sync.test.ts     |  19 ++
 src/lib/miden/front/guardian-sync.ts          |  14 +-
 src/lib/miden/guardian/index.test.ts          |  52 +----
 src/lib/miden/guardian/index.ts               |  31 +--
 .../miden/sdk/miden-client-interface.test.ts  | 104 +--------
 src/lib/miden/sdk/miden-client-interface.ts   | 143 ++++++++-----
 src/lib/shared/types.ts                       |   6 +-
 src/lib/store/index.ts                        |   3 +-
 src/lib/store/types.ts                        |   2 +-
 .../create-wallet-flow/BackUpSeedPhrase.tsx   |   1 +
 24 files changed, 438 insertions(+), 389 deletions(-)
 create mode 100644 src/app/templates/ActivateHotKeyBanner.tsx

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4c462d919..26a911520 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,7 @@
 ### Features
 
 <<<<<<< utk-psm-integration
-* [FEATURE][all] 3-key Guardian: cold co-signs `switch_guardian` (on-chain threshold-2 satisfied via `procedureThresholds`) and a new Settings → Rotate Device Key flow lets users replace the hot signer in-place via a single cold-signed `update_signers` proposal, persisting the new ciphertext before submission and finalizing `WalletAccount.hotPublicKey` (plus releasing the old SE/StrongBox wrapper) only after on-chain inclusion. Settings → Switch Guardian now requires an explicit confirmation step before initiating, mirroring the Rotate Device Key flow so the user acknowledges that the switch is cold-signed + guardian-co-signed.
+* [FEATURE][all] 3-key Guardian: cold co-signs `switch_guardian` (on-chain threshold-2 satisfied via `procedureThresholds`) and a new Settings → Rotate Device Key flow lets users replace the hot signer in-place via a single cold-signed `update_signers` proposal, persisting the new ciphertext before submission and finalizing `WalletAccount.hotPublicKey` (plus releasing the old SE/StrongBox wrapper) only after on-chain inclusion. Settings → Switch Guardian now requires an explicit confirmation step before initiating, mirroring the Rotate Device Key flow so the user acknowledges that the switch is cold-signed + guardian-co-signed. Guardian import-by-seed does lookup + adopt only (`MultisigClient.recoverByKey` per HD index until first miss); each adopted account is flagged `requiresHotKeyRotation` and the home view surfaces an Activate Device Key banner with a one-click CTA that fires the same cold-signed `update_signers` rotation — the banner self-hides once `Vault.swapHotKey` lands. The `swapHotKey` message now carries only `newHotPubKey`; the vault resolves the previous hot from the persisted `WalletAccount`, so the initial post-recovery activation and subsequent rotations share one code path.
 * [FEATURE][all] 3-key Guardian accounts. Guardian creation now provisions a hot ECDSA key (random, lives outside the WASM keystore behind a new `secure-hot-key` facade — extension/desktop use a JS fallback; iOS wraps the secret under a per-account Secure Enclave P-256 key via `HotKeyPlugin.swift`; Android wraps it under a per-account StrongBox-backed RSA-OAEP key via `HotKeyPlugin.kt` with biometric-gated unwrap, identical wire format on both platforms) plus an HD-derived cold ECDSA key (kept in the SDK keystore for cold-routed flows) alongside the existing guardian co-signer. Threshold stays at 1 (hot OR cold + guardian); cold-only routing for `update_signers` / `update_guardian` / `update_procedure_threshold` is enforced client-side per the Phase 0 SDK reading. Storage adds `accColdSecretKeyStrgKey` and `WalletAccount.{hotPublicKey,coldPublicKey}` so role-aware `signWord` (Phase 3) can dispatch hot vs cold by storage entity. Hard cutover from the 1-of-1 Falcon scheme — pre-cutover Guardian accounts are unreachable from this build.
 * [FEATURE][all] Guardian integration. Adds Guardian-backed accounts (1-of-1 multisig with on-chain Guardian signature verification), onboarding create/import flows with a dedicated recovery-method screen that accepts a custom guardian URL, Settings → Guardian Settings with an on-chain switch-guardian proposal that re-registers post-switch state with the new endpoint, service-worker routing for Guardian transaction signing via `MultisigService`, frontend Guardian sync outside the WASM lock, and per-stage progress labels (`creating-proposal`, `signing-proposal`, `submitting`, `registering-guardian`) in the transaction modal.
 =======
diff --git a/public/_locales/en/en.json b/public/_locales/en/en.json
index 9d428a1b4..1cec13517 100644
--- a/public/_locales/en/en.json
+++ b/public/_locales/en/en.json
@@ -341,6 +341,7 @@
   "minimumCharsWithAtLeast": "Minimum 8 characters with at least 1 number",
   "backUpWalletInstructions": "Save these 12 words and store in a secure place.",
   "doNotShareWithAnywone": "Do not share with anyone.",
+  "seedPhraseRecoveryCaption": "Your seed phrase is your recovery key — used to rotate device keys, not for everyday transactions.",
   "select": "Select",
   "selected": "Selected",
   "additionalDownloads": "Additional Downloads",
@@ -391,6 +392,10 @@
   "replaceHotKeyConfirmation": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?",
   "confirmReplaceHotKey": "Confirm rotation",
   "hotKeyRotated": "Device key rotated successfully.",
+  "activateHotKeyBannerTitle": "Activate device key",
+  "activateHotKeyBannerBody": "Generate a device key for this recovered account. Required before sending.",
+  "activateHotKeyBannerCta": "Activate",
+  "activateHotKeyBannerError": "Failed to activate device key. Try again.",
   "invalidUrl": "Enter a valid URL starting with http:// or https://",
   "encryptedWalletFileDescription": "Enter your password to access your Encrypted Wallet File.",
   "encryptedWalletFileDescriptionHardware": "Unlock with your passcode to access your Encrypted Wallet File.",
diff --git a/src/app/pages/Explore.tsx b/src/app/pages/Explore.tsx
index 4cb6ee970..d0d16de7c 100644
--- a/src/app/pages/Explore.tsx
+++ b/src/app/pages/Explore.tsx
@@ -4,6 +4,7 @@ import classNames from 'clsx';
 
 import useMidenFaucetId from 'app/hooks/useMidenFaucetId';
 import Header from 'app/layouts/PageLayout/Header';
+import { ActivateHotKeyBanner } from 'app/templates/ActivateHotKeyBanner';
 import { ConnectivityIssueBanner } from 'components/ConnectivityIssueBanner';
 import { ActionButtons } from 'components/explore/ActionButtons';
 import { PriceChangeBadge } from 'components/explore/PriceChangeBadge';
@@ -138,6 +139,7 @@ const Explore: FC = () => {
     <div className="flex flex-col h-full overflow-hidden text-heading-gray font-geist">
       <div className="flex-shrink-0">
         <ConnectivityIssueBanner />
+        <ActivateHotKeyBanner />
         <Header />
         <div className={classNames('flex flex-col justify-start', 'pt-4 px-4')}>
           <div className="flex flex-col justify-center items-center pb-4">
diff --git a/src/app/templates/ActivateHotKeyBanner.tsx b/src/app/templates/ActivateHotKeyBanner.tsx
new file mode 100644
index 000000000..8d79f721c
--- /dev/null
+++ b/src/app/templates/ActivateHotKeyBanner.tsx
@@ -0,0 +1,73 @@
+import React, { FC, useCallback, useState } from 'react';
+
+import classNames from 'clsx';
+import { useTranslation } from 'react-i18next';
+
+import { Icon, IconName } from 'app/icons/v2';
+import { initiateReplaceHotKeyTransaction, requestSWTransactionProcessing } from 'lib/miden/activity';
+import { useAccount } from 'lib/miden/front';
+import { zustandProvider } from 'lib/miden/front/guardian-sync';
+import { hapticLight } from 'lib/mobile/haptics';
+import { isExtension } from 'lib/platform';
+import { isDelegateProofEnabled } from 'lib/settings/helpers';
+import { useWalletStore } from 'lib/store';
+
+interface Props {
+  className?: string;
+}
+
+/**
+ * Surfaces post-recovery: Guardian accounts adopted via seed-phrase lookup have
+ * no usable local hot key (the on-chain hot's secret is unrecoverable). The
+ * banner CTA fires a cold-signed `replace_signer` rotation that mints a fresh
+ * hot key and swaps it on-chain. `requiresHotKeyRotation` clears once
+ * `Vault.swapHotKey` lands, at which point the banner self-hides.
+ */
+export const ActivateHotKeyBanner: FC<Props> = ({ className }) => {
+  const { t } = useTranslation();
+  const account = useAccount();
+  const [submitting, setSubmitting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const onClick = useCallback(async () => {
+    if (submitting) return;
+    hapticLight();
+    setSubmitting(true);
+    setError(null);
+    try {
+      await initiateReplaceHotKeyTransaction(account.publicKey, isDelegateProofEnabled(), zustandProvider);
+      useWalletStore.getState().openTransactionModal();
+      if (isExtension()) requestSWTransactionProcessing();
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+      setSubmitting(false);
+    }
+  }, [account.publicKey, submitting]);
+
+  if (!account.requiresHotKeyRotation) return null;
+
+  return (
+    <div
+      className={classNames('min-h-14 flex items-center bg-white px-4 gap-x-2 py-2 rounded-t-3xl', className)}
+      data-testid="activate-hot-key-banner"
+    >
+      <div className="flex items-center">
+        <Icon name={IconName.InformationFill} size="md" fill="#5b8def" />
+      </div>
+      <div className="flex-1 flex flex-col justify-center items-start min-w-0">
+        <p className="text-black text-sm font-medium">{t('activateHotKeyBannerTitle')}</p>
+        <p className="text-gray-600 text-xs">{error ?? t('activateHotKeyBannerBody')}</p>
+      </div>
+      <button
+        type="button"
+        onClick={onClick}
+        disabled={submitting}
+        className="text-xs font-medium text-primary-500 px-2 py-1 rounded-md hover:bg-gray-100 disabled:opacity-50"
+      >
+        {t('activateHotKeyBannerCta')}
+      </button>
+    </div>
+  );
+};
+
+export default ActivateHotKeyBanner;
diff --git a/src/lib/intercom/mobile-adapter.ts b/src/lib/intercom/mobile-adapter.ts
index c5306a0ce..4fd66d403 100644
--- a/src/lib/intercom/mobile-adapter.ts
+++ b/src/lib/intercom/mobile-adapter.ts
@@ -156,7 +156,7 @@ export class MobileIntercomAdapter {
       }
 
       case WalletMessageType.SwapHotKeyRequest: {
-        await Actions.swapHotKey(req.accountPublicKey, req.oldHotPubKey, req.newHotPubKey);
+        await Actions.swapHotKey(req.accountPublicKey, req.newHotPubKey);
         return {
           type: WalletMessageType.SwapHotKeyResponse
         };
diff --git a/src/lib/miden/activity/transactions.guardian.test.ts b/src/lib/miden/activity/transactions.guardian.test.ts
index f2a218d89..bea2f3fc2 100644
--- a/src/lib/miden/activity/transactions.guardian.test.ts
+++ b/src/lib/miden/activity/transactions.guardian.test.ts
@@ -345,7 +345,7 @@ describe('generateTransaction — Guardian routing', () => {
       } as never,
       jest.fn(async () => new Uint8Array([1])),
       false,
-      provider
+      provider as never
     );
 
     // The switch-guardian path must build the proposal, cold co-signs first
@@ -354,6 +354,9 @@ describe('generateTransaction — Guardian routing', () => {
     expect(multisigService.createSwitchGuardianProposal).toHaveBeenCalledWith('https://new.guardian');
     expect(mockBuildColdMultisigService).toHaveBeenCalled();
     expect(coldService.signProposal).toHaveBeenCalledWith('prop-switch');
+    // After the multisigService/signingService consolidation, the hot service IS
+    // the only service for non-replace-hot-key types — it drives the final
+    // signAndCreateTransactionRequest.
     expect(multisigService.signAndCreateTransactionRequest).toHaveBeenCalledWith('prop-switch');
     expect(waitForTransactionCommit).toHaveBeenCalledWith('exec-tx-hash');
     expect(multisigService.finalizeGuardianSwitch).toHaveBeenCalledWith('https://new.guardian');
@@ -409,7 +412,7 @@ describe('generateTransaction — Guardian routing', () => {
       { id: txId, type: 'replace-hot-key', accountId: 'guardian-acc', delegateTransaction: false } as never,
       jest.fn(async () => new Uint8Array([1])),
       false,
-      provider
+      provider as never
     );
 
     expect(coldService.createReplaceHotKeyProposal).toHaveBeenCalled();
@@ -485,7 +488,7 @@ describe('completeReplaceHotKeyTransaction', () => {
     txStore.length = 0;
   });
 
-  it('swaps WalletAccount.hotPublicKey via the provider, drops the cached service, and marks the row Completed', async () => {
+  it('calls swapHotKey with the new hot pubkey, drops the cached service, and marks the row Completed', async () => {
     const tx = new ReplaceHotKeyTransaction('acc-1', false);
     tx.extraInputs = { newHotPublicKey: 'new-hot-pub' };
     txStore.push({ id: tx.id, status: ITransactionStatus.GeneratingTransaction });
@@ -500,7 +503,10 @@ describe('completeReplaceHotKeyTransaction', () => {
 
     await completeReplaceHotKeyTransaction(tx, makeResult() as never, provider as never);
 
-    expect(swapHotKey).toHaveBeenCalledWith('acc-1', 'old-hot-pub', 'new-hot-pub');
+    // The vault resolves the previous hot from the persisted WalletAccount —
+    // the caller passes only newHotPubKey. Vault.swapHotKey handles the
+    // idempotent case (old === new) internally.
+    expect(swapHotKey).toHaveBeenCalledWith('acc-1', 'new-hot-pub');
     expect(mockClearGuardianServiceFor).toHaveBeenCalledWith('acc-1');
 
     const row = txStore.find(r => r.id === tx.id) as Record<string, unknown>;
@@ -508,12 +514,12 @@ describe('completeReplaceHotKeyTransaction', () => {
     expect(row.displayMessage).toBe('Device key rotated');
   });
 
-  it('skips the swap when the recorded new hot already matches the WalletAccount (idempotent retry)', async () => {
+  it('still calls swapHotKey even when the row already reflects new hot (vault handles idempotency)', async () => {
     const tx = new ReplaceHotKeyTransaction('acc-1', false);
     tx.extraInputs = { newHotPublicKey: 'already-rotated' };
     txStore.push({ id: tx.id, status: ITransactionStatus.GeneratingTransaction });
 
-    const swapHotKey = jest.fn();
+    const swapHotKey = jest.fn(async () => {});
     const provider = {
       getAccounts: async () => [{ publicKey: 'acc-1', hotPublicKey: 'already-rotated', coldPublicKey: 'cold' }],
       getPublicKeyForCommitment: async () => 'pk',
@@ -523,7 +529,8 @@ describe('completeReplaceHotKeyTransaction', () => {
 
     await completeReplaceHotKeyTransaction(tx, makeResult() as never, provider as never);
 
-    expect(swapHotKey).not.toHaveBeenCalled();
+    // Idempotency moved into Vault.swapHotKey — the caller always invokes it.
+    expect(swapHotKey).toHaveBeenCalledWith('acc-1', 'already-rotated');
     const row = txStore.find(r => r.id === tx.id) as Record<string, unknown>;
     expect(row.status).toBe(ITransactionStatus.Completed);
   });
diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index 912d601b4..f488f85b0 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -403,25 +403,13 @@ export const completeReplaceHotKeyTransaction = async (
       throw new Error('Replace-hot-key tx is missing newHotPublicKey in extraInputs');
     }
 
-    // Resolve the OLD hot pubkey from the WalletAccount snapshot taken before
-    // generateGuardianTransaction wrote the new hot ciphertext to vault. The
-    // record may already reflect the new key on a retry — guard accordingly.
-    const allAccounts = await guardianProvider.getAccounts();
-    const accountRecord = allAccounts.find(a => a.publicKey === tx.accountId);
-    if (!accountRecord) {
-      throw new Error(`Account ${tx.accountId} not found in provider during complete`);
-    }
-    const oldHotPublicKey = accountRecord.hotPublicKey;
-    if (!oldHotPublicKey) {
-      throw new Error(`Account ${tx.accountId} has no hotPublicKey to rotate`);
-    }
-
-    if (oldHotPublicKey !== newHotPublicKey) {
-      if (!guardianProvider.swapHotKey) {
-        throw new Error('swapHotKey not implemented in this provider');
-      }
-      await guardianProvider.swapHotKey(tx.accountId, oldHotPublicKey, newHotPublicKey);
+    if (!guardianProvider.swapHotKey) {
+      throw new Error('swapHotKey not implemented in this provider');
     }
+    // Vault.swapHotKey resolves the previous hot pubkey from the persisted
+    // WalletAccount and is idempotent: if the record already reflects
+    // `newHotPublicKey` (retry), the cleanup branch is a no-op.
+    await guardianProvider.swapHotKey(tx.accountId, newHotPublicKey);
     // Drop the cached MultisigService — its bound hot signer is now stale.
     clearGuardianServiceFor(tx.accountId);
 
@@ -899,17 +887,25 @@ const generateGuardianTransaction = async (
   // so surfacing "Creating proposal" immediately is more honest than
   // leaving the label stuck on "Sending transaction".
   await setTransactionStage(transaction.id, 'creating-proposal');
-  const multisigService = await getOrCreateMultisigService(transaction.accountId, guardianProvider);
 
   let proposalResult: Proposal;
+  // Hot-bound MultisigService is needed for every transaction type EXCEPT
+  // replace-hot-key — that flow predates a usable local hot key (post-recovery
+  // initial activation) and operates cold-only via buildColdMultisigService.
+  // Lazy-loaded so post-recovery accounts (no hotPublicKey yet) can still
+  // execute the rotation that gives them one.
+  let multisigService: MultisigService | null = null;
   // The signing service for the FINAL signAndCreateTransactionRequest call.
-  // Defaults to hot. replace-hot-key flips it to a transient cold service
-  // because the hot key being replaced cannot itself authorize the rotation.
-  let signingService: MultisigService = multisigService;
+  // Defaults to the hot service. replace-hot-key flips it to a transient cold
+  // service because the hot key being replaced cannot itself authorize the
+  // rotation.
+  let signingService: MultisigService;
 
   switch (transaction.type) {
     case 'send': {
       const sendTx = transaction as SendTransaction;
+      multisigService = await getOrCreateMultisigService(transaction.accountId, guardianProvider);
+      signingService = multisigService;
       proposalResult = await multisigService.createSendProposal(
         sendTx.secondaryAccountId,
         sendTx.faucetId,
@@ -919,11 +915,15 @@ const generateGuardianTransaction = async (
     }
     case 'consume': {
       const consumeTx = transaction as ConsumeTransaction;
+      multisigService = await getOrCreateMultisigService(transaction.accountId, guardianProvider);
+      signingService = multisigService;
       proposalResult = await multisigService.createConsumeNotesProposal([consumeTx.noteId]);
       break;
     }
     case 'switch-guardian': {
       const sgTx = transaction as SwitchGuardianTransaction;
+      multisigService = await getOrCreateMultisigService(transaction.accountId, guardianProvider);
+      signingService = multisigService;
       const { proposal } = await multisigService.createSwitchGuardianProposal(sgTx.extraInputs.newGuardianEndpoint);
       proposalResult = proposal;
       break;
@@ -1061,6 +1061,9 @@ const generateGuardianTransaction = async (
       break;
     case 'switch-guardian':
       console.log('Completing switch guardian transaction');
+      if (!multisigService) {
+        throw new Error('multisigService missing during switch-guardian completion');
+      }
       await completeSwitchGuardianTransaction(
         transaction as SwitchGuardianTransaction,
         transactionResult,
@@ -1081,7 +1084,11 @@ const generateGuardianTransaction = async (
     //   break;
   }
   console.log('Transaction generation complete, syncing multisig service');
-  await multisigService.sync();
+  // replace-hot-key invalidated its cached service via clearGuardianServiceFor —
+  // the next consumer re-inits with the new hot pubkey. No sync needed here.
+  if (multisigService) {
+    await multisigService.sync();
+  }
 };
 
 export const cancelTransaction = async (transaction: Transaction, error: any) => {
diff --git a/src/lib/miden/back/actions.ts b/src/lib/miden/back/actions.ts
index 7a51acaae..87b8edd9c 100644
--- a/src/lib/miden/back/actions.ts
+++ b/src/lib/miden/back/actions.ts
@@ -310,9 +310,9 @@ export function persistNewHotKey(newHotPubKey: string, newHotCiphertext: string)
   });
 }
 
-export function swapHotKey(accountPublicKey: string, oldHotPubKey: string, newHotPubKey: string) {
+export function swapHotKey(accountPublicKey: string, newHotPubKey: string) {
   return withUnlocked(async ({ vault }) => {
-    const updated = await vault.swapHotKey(accountPublicKey, oldHotPubKey, newHotPubKey);
+    const updated = await vault.swapHotKey(accountPublicKey, newHotPubKey);
     // Push the updated WalletAccount[] into the Effector store so the
     // frontStore mapping fires StateUpdated. Without this, the popup's Zustand
     // `accounts[i].hotPublicKey` stays at the pre-rotation value, the next
diff --git a/src/lib/miden/back/main.ts b/src/lib/miden/back/main.ts
index 8afe0f595..76418af36 100644
--- a/src/lib/miden/back/main.ts
+++ b/src/lib/miden/back/main.ts
@@ -219,7 +219,7 @@ async function processRequest(req: WalletRequest, _port: Runtime.Port): Promise<
         type: WalletMessageType.PersistNewHotKeyResponse
       };
     case WalletMessageType.SwapHotKeyRequest:
-      await Actions.swapHotKey(req.accountPublicKey, req.oldHotPubKey, req.newHotPubKey);
+      await Actions.swapHotKey(req.accountPublicKey, req.newHotPubKey);
       return {
         type: WalletMessageType.SwapHotKeyResponse
       };
diff --git a/src/lib/miden/back/transaction-processor.ts b/src/lib/miden/back/transaction-processor.ts
index c6aea57f4..e8cab1290 100644
--- a/src/lib/miden/back/transaction-processor.ts
+++ b/src/lib/miden/back/transaction-processor.ts
@@ -83,9 +83,9 @@ const vaultGuardianProvider: GuardianAccountProvider = {
       await vault.persistNewHotKey(newHotPubKey, newHotCiphertext);
     });
   },
-  swapHotKey: async (accountPublicKey: string, oldHotPubKey: string, newHotPubKey: string) => {
+  swapHotKey: async (accountPublicKey: string, newHotPubKey: string) => {
     return withUnlocked(async ({ vault }) => {
-      await vault.swapHotKey(accountPublicKey, oldHotPubKey, newHotPubKey);
+      await vault.swapHotKey(accountPublicKey, newHotPubKey);
     });
   }
 };
diff --git a/src/lib/miden/back/vault.gaps.test.ts b/src/lib/miden/back/vault.gaps.test.ts
index 276e9031f..5503781b5 100644
--- a/src/lib/miden/back/vault.gaps.test.ts
+++ b/src/lib/miden/back/vault.gaps.test.ts
@@ -284,15 +284,24 @@ describe('Vault.spawn: preserved guardian URL', () => {
   });
 });
 
-describe('Vault.spawn: Guardian import helpers', () => {
-  it('exercises the signWordFn helper when ownMnemonic + Guardian path runs', async () => {
-    // Wire the mocked client so its importGuardianAccountBySeed invokes the
-    // signWordFn helper closure defined inside Vault.spawn, and returns the
-    // 3-key Guardian shape (hot ciphertext + cold secret-key hex) so vault
-    // can call persistGuardianKeys without crashing.
+describe('Vault.spawn: Guardian recovery (lookup + adopt)', () => {
+  it('persists every account returned by recoverGuardianAccountsBySeed with requiresHotKeyRotation=true', async () => {
+    // recoverGuardianAccountsBySeed adopts each on-chain account locally
+    // (no rotation — the user activates the hot key explicitly via the
+    // post-recovery banner). Vault.spawn must round-trip the array, persist
+    // only the cold mirror per account, and flag each WalletAccount with
+    // requiresHotKeyRotation so the banner picks it up.
     const sdk = require('../sdk/miden-client');
     const origGetClient = sdk.getMidenClient;
-    sdk.getMidenClient = jest.fn(async (options: any) => ({
+    sdk.getMidenClient = jest.fn(async (_options: any) => ({
+      recoverGuardianAccountsBySeed: async (_deriveColdSeed: any, _endpoint: string) => [
+        {
+          accountId: 'guardian-pk',
+          hdIndex: 0,
+          coldPublicKey: 'bb'.repeat(33),
+          coldSecretKeyHex: 'dd'.repeat(32)
+        }
+      ],
       createGuardianMidenWallet: async (_seed: Uint8Array) => ({
         accountId: 'guardian-pk',
         keys: {
@@ -302,25 +311,6 @@ describe('Vault.spawn: Guardian import helpers', () => {
           coldSecretKeyHex: 'dd'.repeat(32)
         }
       }),
-      importGuardianAccountBySeed: async (
-        _seed: Uint8Array,
-        signWordFn: (pk: string, hex: string) => Promise<string>
-      ) => {
-        // Simulate the WASM client persisting an auth-secret via the
-        // insertKeyCallback that Vault.spawn passes to the SDK, then invoke
-        // signWordFn so the helper closure inside Vault.spawn gets exercised.
-        await options.insertKeyCallback(new Uint8Array([0xaa, 0xbb]), new Uint8Array([0x01, 0x02, 0x03, 0x04]));
-        await signWordFn('aabb', '0xdeadbeef');
-        return {
-          accountId: 'guardian-pk',
-          keys: {
-            hotPublicKey: 'aa'.repeat(33),
-            hotCiphertext: 'cf'.repeat(64),
-            coldPublicKey: 'bb'.repeat(33),
-            coldSecretKeyHex: 'dd'.repeat(32)
-          }
-        };
-      },
       getAccounts: async () => [],
       getAccount: async () => null,
       syncState: async () => {},
diff --git a/src/lib/miden/back/vault.test.ts b/src/lib/miden/back/vault.test.ts
index e87f3645e..c05f3a380 100644
--- a/src/lib/miden/back/vault.test.ts
+++ b/src/lib/miden/back/vault.test.ts
@@ -44,10 +44,16 @@ const mockCreateGuardianMidenWallet = jest.fn(async (_seed: Uint8Array) => ({
   accountId: 'guardian-acc-1',
   keys: GUARDIAN_KEYS_FIXTURE
 }));
-const mockImportGuardianAccountBySeed = jest.fn(async (_seed: Uint8Array, _signWord: any, _getPub: any) => ({
-  accountId: 'guardian-acc-imported',
-  keys: GUARDIAN_KEYS_FIXTURE
-}));
+const mockRecoverGuardianAccountsBySeed = jest.fn(async (_deriveColdSeed: any, _endpoint: string) => [
+  {
+    accountId: 'guardian-acc-imported',
+    hdIndex: 0,
+    hotPublicKey: GUARDIAN_KEYS_FIXTURE.hotPublicKey,
+    coldPublicKey: GUARDIAN_KEYS_FIXTURE.coldPublicKey,
+    hotCiphertext: GUARDIAN_KEYS_FIXTURE.hotCiphertext,
+    coldSecretKeyHex: GUARDIAN_KEYS_FIXTURE.coldSecretKeyHex
+  }
+]);
 const mockGetAccounts = jest.fn(async () => [] as any[]);
 const mockGetAccount = jest.fn(async (_id: string) => null as any);
 const mockSyncState = jest.fn(async () => {});
@@ -64,8 +70,8 @@ const mockGetMidenClient = jest.fn(async (_options?: any) => ({
   // tests keep asserting on it.
   importAccountBySeed: async (_walletType: any, seed: Uint8Array) => mockImportPublicMidenWalletFromSeed(seed),
   createGuardianMidenWallet: (...args: unknown[]) => mockCreateGuardianMidenWallet(...(args as [Uint8Array])),
-  importGuardianAccountBySeed: (...args: unknown[]) =>
-    mockImportGuardianAccountBySeed(...(args as [Uint8Array, any, any])),
+  recoverGuardianAccountsBySeed: (...args: unknown[]) =>
+    mockRecoverGuardianAccountsBySeed(...(args as [any, string])),
   getAccounts: () => mockGetAccounts(),
   getAccount: (id: string) => mockGetAccount(id),
   syncState: () => mockSyncState(),
@@ -86,7 +92,7 @@ const mockMidenClient = {
   createMidenWallet: mockCreateMidenWallet,
   importPublicMidenWalletFromSeed: mockImportPublicMidenWalletFromSeed,
   createGuardianMidenWallet: mockCreateGuardianMidenWallet,
-  importGuardianAccountBySeed: mockImportGuardianAccountBySeed,
+  recoverGuardianAccountsBySeed: mockRecoverGuardianAccountsBySeed,
   getAccounts: mockGetAccounts,
   getAccount: mockGetAccount,
   syncState: mockSyncState,
@@ -262,10 +268,14 @@ beforeEach(() => {
     accountId: 'guardian-acc-1',
     keys: GUARDIAN_KEYS_FIXTURE
   });
-  mockMidenClient.importGuardianAccountBySeed.mockResolvedValue({
-    accountId: 'guardian-acc-imported',
-    keys: GUARDIAN_KEYS_FIXTURE
-  });
+  mockMidenClient.recoverGuardianAccountsBySeed.mockResolvedValue([
+    {
+      accountId: 'guardian-acc-imported',
+      hdIndex: 0,
+      coldPublicKey: GUARDIAN_KEYS_FIXTURE.coldPublicKey,
+      coldSecretKeyHex: GUARDIAN_KEYS_FIXTURE.coldSecretKeyHex
+    }
+  ]);
   mockMidenClient.getAccounts.mockResolvedValue([]);
   mockMidenClient.getAccount.mockResolvedValue(null);
   mockMidenClient.syncState.mockResolvedValue(undefined);
@@ -1074,13 +1084,14 @@ describe('Vault hardware branches', () => {
     await expect(vlt.createHDAccount('invalid' as any)).rejects.toThrow();
   });
 
-  it('Vault.spawn propagates importGuardianAccountBySeed failures (no silent fallback)', async () => {
-    // The Guardian import path must NOT fall back to createGuardianMidenWallet — otherwise
-    // a silently-recreated account would leave the user with an empty balance
-    // under their seed. The branch rethrows, wrapped as a PublicError by withError.
+  it('Vault.spawn propagates recoverGuardianAccountsBySeed failures (no silent fallback)', async () => {
+    // The Guardian recovery path must NOT fall back to createGuardianMidenWallet —
+    // otherwise a silently-recreated account would leave the user with an empty
+    // balance under their seed. The branch rethrows, wrapped as a PublicError by
+    // withError.
     (isDesktop as jest.Mock).mockReturnValue(false);
     (isMobile as jest.Mock).mockReturnValue(false);
-    mockMidenClient.importGuardianAccountBySeed.mockRejectedValueOnce(new Error('guardian lookup failed'));
+    mockMidenClient.recoverGuardianAccountsBySeed.mockRejectedValueOnce(new Error('guardian lookup failed'));
 
     await expect(Vault.spawn(WalletType.Guardian, 'pw-guardian-fail', VALID_MNEMONIC, true)).rejects.toThrow(
       PublicError
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index 016be49b3..8495721cb 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -21,6 +21,7 @@ import {
   removeMany,
   savePlain
 } from 'lib/miden/back/safe-storage';
+import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
 import * as Passworder from 'lib/miden/passworder';
 import { clearStorage } from 'lib/miden/reset';
 import { isDesktop, isMobile } from 'lib/platform';
@@ -108,6 +109,19 @@ async function persistGuardianKeys(vaultKey: CryptoKey, keys: CreatedGuardianKey
     vaultKey
   );
 }
+
+/**
+ * Persist only the cold mirror for a recovered Guardian account. No hot key
+ * is generated at recovery time — the user activates one explicitly via the
+ * post-recovery banner, which fires `initiateReplaceHotKeyTransaction`.
+ */
+async function persistRecoveredGuardianColdKey(
+  vaultKey: CryptoKey,
+  coldPublicKey: string,
+  coldSecretKeyHex: string
+) {
+  await encryptAndSaveMany([[accColdSecretKeyStrgKey(coldPublicKey), coldSecretKeyHex]], vaultKey);
+}
 export class Vault {
   constructor(private vaultKey: CryptoKey) {}
 
@@ -260,7 +274,7 @@ export class Vault {
       // clearStorage wipes the entire platform key-value store, which would also
       // erase the guardian URL that the onboarding flow just wrote for a Guardian import.
       // Snapshot it and restore after the wipe so downstream reads
-      // (createGuardianAccount / importAccountFromGuardian) see the caller's choice.
+      // (createGuardianAccount / recoverGuardianAccountsBySeed) see the caller's choice.
       // TODO: thread guardianEndpoint as an explicit arg through registerWallet → spawn
       // instead of round-tripping through storage.
       console.log('[Vault.spawn] Step 3: clearing storage...');
@@ -297,88 +311,102 @@ export class Vault {
       const hdAccIndex = 0;
       const walletSeed = deriveClientSeed(walletType, mnemonic, 0);
 
-      // Helper to sign words using the vault key (needed for Guardian import)
-      const signWordFn = async (pk: string, wordHex: string) => {
-        const word = Word.fromHex(wordHex);
-        const secretKey = await fetchAndDecryptOneWithLegacyFallBack<string>(accAuthSecretKeyStrgKey(pk), vaultKey);
-        const wasmSecretKey = AuthSecretKey.deserialize(new Uint8Array(Buffer.from(secretKey, 'hex')));
-        const signature = wasmSecretKey.sign(word);
-        return `0x${Buffer.from(signature.serialize().slice(1)).toString('hex')}`;
+      console.log('[Vault.spawn] Step 5: getting miden client...');
+      const midenClient = await getMidenClient(options);
+      console.log('[Vault.spawn] Step 6: client ready, network:', midenClient.network, 'ownMnemonic:', ownMnemonic);
+
+      // Guardian recovery (lookup + adopt per HD index) runs OUTSIDE the WASM
+      // client mutex because the orchestrator acquires the lock granularly per
+      // WASM op. Wrapping it under the outer lock would deadlock (the inner
+      // withWasmClientLock calls hit the non-reentrant mutex).
+      const isGuardianRecovery = walletType === WalletType.Guardian && ownMnemonic && midenClient.network !== 'mock';
+
+      type SpawnedAccount = {
+        accountId: string;
+        hdIndex: number;
+        guardianKeys?: CreatedGuardianKeys;
+        recoveredCold?: { coldPublicKey: string; coldSecretKeyHex: string };
       };
 
-      // Wrap WASM client operations in a lock to prevent concurrent access
-      console.log('[Vault.spawn] Step 5: acquiring WASM client lock...');
-      const created = await withWasmClientLock(
-        async (): Promise<{
-          accountId: string;
-          guardianKeys?: CreatedGuardianKeys;
-        }> => {
-          console.log('[Vault.spawn] Step 6: getting miden client...');
-          const midenClient = await getMidenClient(options);
-          console.log('[Vault.spawn] Step 7: client ready, network:', midenClient.network, 'ownMnemonic:', ownMnemonic);
+      let createdAccounts: SpawnedAccount[];
 
-          if (walletType === WalletType.Guardian) {
-            // Guardian: cold key derives from seed (HD-deterministic), hot is
-            // freshly generated via the secure-hot-key facade. Both branches
-            // surface the keys so vault can persist them under the vault envelope.
-            if (ownMnemonic && midenClient.network !== 'mock') {
-              console.log('[Vault.spawn] Step 8a: importing Guardian account from seed...');
-              const result = await midenClient.importGuardianAccountBySeed(walletSeed, signWordFn);
+      if (isGuardianRecovery) {
+        console.log('[Vault.spawn] Step 7a: recovering Guardian accounts (adopt only — rotation deferred)...');
+        const guardianEndpoint =
+          (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
+        const recovered = await midenClient.recoverGuardianAccountsBySeed(
+          (idx: number) => deriveClientSeed(WalletType.Guardian, mnemonic!, idx),
+          guardianEndpoint
+        );
+        createdAccounts = recovered.map(r => ({
+          accountId: r.accountId,
+          hdIndex: r.hdIndex,
+          recoveredCold: { coldPublicKey: r.coldPublicKey, coldSecretKeyHex: r.coldSecretKeyHex }
+        }));
+      } else {
+        console.log('[Vault.spawn] Step 7b: acquiring WASM client lock for create/import path...');
+        const created = await withWasmClientLock(
+          async (): Promise<{ accountId: string; guardianKeys?: CreatedGuardianKeys }> => {
+            if (walletType === WalletType.Guardian) {
+              console.log('[Vault.spawn] Step 8: syncing state then creating Guardian account...');
+              await midenClient.syncState();
+              const result = await midenClient.createGuardianMidenWallet(walletSeed);
               return { accountId: result.accountId, guardianKeys: result.keys };
             }
-            console.log('[Vault.spawn] Step 8b: syncing state then creating Guardian account...');
-            await midenClient.syncState();
-            const result = await midenClient.createGuardianMidenWallet(walletSeed);
-            return { accountId: result.accountId, guardianKeys: result.keys };
-          }
 
-          if (ownMnemonic && midenClient.network !== 'mock') {
-            try {
-              console.log('[Vault.spawn] Step 8a: importing wallet from seed...');
-              return {
-                accountId: await midenClient.importAccountBySeed(walletSeed)
-              };
-            } catch (e) {
-              console.error('Failed to import wallet from seed in spawn, creating new wallet instead', e);
-              return { accountId: await midenClient.createMidenWallet(walletType, walletSeed) };
+            if (ownMnemonic && midenClient.network !== 'mock') {
+              try {
+                console.log('[Vault.spawn] Step 8a: importing wallet from seed...');
+                return { accountId: await midenClient.importAccountBySeed(walletSeed) };
+              } catch (e) {
+                console.error('Failed to import wallet from seed in spawn, creating new wallet instead', e);
+                return { accountId: await midenClient.createMidenWallet(walletType, walletSeed) };
+              }
             }
+            // Sync to chain tip BEFORE creating first account (no accounts = no tags = fast sync)
+            console.log('[Vault.spawn] Step 8b: syncing state...');
+            await midenClient.syncState();
+            console.log('[Vault.spawn] Step 9: creating miden wallet...');
+            return { accountId: await midenClient.createMidenWallet(walletType, walletSeed) };
           }
-          // Sync to chain tip BEFORE creating first account (no accounts = no tags = fast sync)
-          console.log('[Vault.spawn] Step 8b: syncing state...');
-          await midenClient.syncState();
-          console.log('[Vault.spawn] Step 9: creating miden wallet...');
-          return { accountId: await midenClient.createMidenWallet(walletType, walletSeed) };
-        }
-      );
-
-      const accPublicKey = created.accountId;
+        );
+        createdAccounts = [{ accountId: created.accountId, hdIndex: hdAccIndex, guardianKeys: created.guardianKeys }];
+      }
 
-      const initialAccount: WalletAccount = {
-        publicKey: accPublicKey,
-        name: 'Miden Account 1',
+      const initialAccounts: WalletAccount[] = createdAccounts.map((c, idx) => ({
+        publicKey: c.accountId,
+        name: getMessage('defaultAccountName', { accountNumber: String(idx + 1) }),
         isPublic: false,
         type: walletType,
-        hdIndex: hdAccIndex,
-        ...(created.guardianKeys && {
-          hotPublicKey: created.guardianKeys.hotPublicKey,
-          coldPublicKey: created.guardianKeys.coldPublicKey
+        hdIndex: c.hdIndex,
+        ...(c.guardianKeys && {
+          hotPublicKey: c.guardianKeys.hotPublicKey,
+          coldPublicKey: c.guardianKeys.coldPublicKey
+        }),
+        ...(c.recoveredCold && {
+          coldPublicKey: c.recoveredCold.coldPublicKey,
+          requiresHotKeyRotation: true
         })
-      };
-      const newAccounts = [initialAccount];
+      }));
 
       await encryptAndSaveMany(
         [
           [checkStrgKey, generateCheck()],
           [mnemonicStrgKey, mnemonic],
-          [accPubKeyStrgKey(accPublicKey), accPublicKey],
-          [accountsStrgKey, newAccounts]
+          ...createdAccounts.map(c => [accPubKeyStrgKey(c.accountId), c.accountId] as [string, string]),
+          [accountsStrgKey, initialAccounts]
         ],
         vaultKey
       );
-      if (created.guardianKeys) {
-        await persistGuardianKeys(vaultKey, created.guardianKeys);
+      for (const c of createdAccounts) {
+        if (c.guardianKeys) {
+          await persistGuardianKeys(vaultKey, c.guardianKeys);
+        }
+        if (c.recoveredCold) {
+          await persistRecoveredGuardianColdKey(vaultKey, c.recoveredCold.coldPublicKey, c.recoveredCold.coldSecretKeyHex);
+        }
       }
-      await savePlain(currentAccPubKeyStrgKey, accPublicKey);
+      await savePlain(currentAccPubKeyStrgKey, initialAccounts[0]!.publicKey);
       await savePlain(ownMnemonicStrgKey, ownMnemonic ?? false);
 
       // Return the vault instance so caller doesn't need to call unlock() separately
@@ -724,34 +752,45 @@ export class Vault {
   }
 
   /**
-   * Finalize a hot-key rotation: update WalletAccount.hotPublicKey for the
-   * Guardian account and remove the previous hot ciphertext. On mobile we also
-   * release the SE/StrongBox wrapper key for the old ciphertext via
-   * secureHotKey.deleteHotKey — best-effort, not fatal if it fails (the JS
-   * fallback's deleteHotKey is a no-op anyway).
+   * Finalize a hot-key rotation: update WalletAccount.hotPublicKey to
+   * `newHotPubKey`, clear the `requiresHotKeyRotation` flag (set during
+   * recovery), and release any previously-persisted hot ciphertext. The old
+   * hot pubkey is read from the persisted WalletAccount — the caller doesn't
+   * pass it. For the post-recovery initial-activation case the record has no
+   * prior `hotPublicKey`, so the cleanup steps are skipped.
+   *
+   * On mobile we release the SE/StrongBox wrapper key for the old ciphertext
+   * via secureHotKey.deleteHotKey — best-effort, not fatal if it fails (the
+   * JS fallback's deleteHotKey is a no-op anyway).
    */
-  async swapHotKey(accountPublicKey: string, oldHotPubKey: string, newHotPubKey: string) {
+  async swapHotKey(accountPublicKey: string, newHotPubKey: string) {
     return withError('Failed to swap hot key', async () => {
       const allAccounts = await this.fetchAccounts();
-      if (!allAccounts.some(acc => acc.publicKey === accountPublicKey)) {
+      const account = allAccounts.find(acc => acc.publicKey === accountPublicKey);
+      if (!account) {
         throw new PublicError('Account not found');
       }
 
-      try {
-        const oldCiphertext = await fetchAndDecryptOneWithLegacyFallBack<string>(
-          accAuthSecretKeyStrgKey(oldHotPubKey),
-          this.vaultKey
-        );
-        await secureHotKey.deleteHotKey(oldCiphertext);
-      } catch (e) {
-        console.warn('swapHotKey: failed to release old native key (non-fatal):', e);
+      const oldHotPubKey = account.hotPublicKey;
+      if (oldHotPubKey && oldHotPubKey !== newHotPubKey) {
+        try {
+          const oldCiphertext = await fetchAndDecryptOneWithLegacyFallBack<string>(
+            accAuthSecretKeyStrgKey(oldHotPubKey),
+            this.vaultKey
+          );
+          await secureHotKey.deleteHotKey(oldCiphertext);
+        } catch (e) {
+          console.warn('swapHotKey: failed to release old native key (non-fatal):', e);
+        }
+        await removeMany([accAuthPubKeyStrgKey(oldHotPubKey), accAuthSecretKeyStrgKey(oldHotPubKey)]);
       }
 
       const newAllAccounts = allAccounts.map(acc =>
-        acc.publicKey === accountPublicKey ? { ...acc, hotPublicKey: newHotPubKey } : acc
+        acc.publicKey === accountPublicKey
+          ? { ...acc, hotPublicKey: newHotPubKey, requiresHotKeyRotation: false }
+          : acc
       );
       await encryptAndSaveMany([[accountsStrgKey, newAllAccounts]], this.vaultKey);
-      await removeMany([accAuthPubKeyStrgKey(oldHotPubKey), accAuthSecretKeyStrgKey(oldHotPubKey)]);
 
       const currentAccount = await this.getCurrentAccount();
       return { accounts: newAllAccounts, currentAccount };
diff --git a/src/lib/miden/front/guardian-manager.ts b/src/lib/miden/front/guardian-manager.ts
index 19b5b948c..e1af8fc87 100644
--- a/src/lib/miden/front/guardian-manager.ts
+++ b/src/lib/miden/front/guardian-manager.ts
@@ -32,7 +32,7 @@ export interface GuardianAccountProvider {
   // path runs only inside the SW-side transaction processor where the
   // vault-backed provider implements them.
   persistNewHotKey?: (newHotPubKey: string, newHotCiphertext: string) => Promise<void>;
-  swapHotKey?: (accountPublicKey: string, oldHotPubKey: string, newHotPubKey: string) => Promise<void>;
+  swapHotKey?: (accountPublicKey: string, newHotPubKey: string) => Promise<void>;
 }
 
 /**
diff --git a/src/lib/miden/front/guardian-sync.test.ts b/src/lib/miden/front/guardian-sync.test.ts
index c3089b021..353fd143f 100644
--- a/src/lib/miden/front/guardian-sync.test.ts
+++ b/src/lib/miden/front/guardian-sync.test.ts
@@ -99,4 +99,23 @@ describe('syncGuardianAccounts', () => {
     await expect(syncGuardianAccounts()).resolves.toBeUndefined();
     expect(goodSync).toHaveBeenCalledTimes(1);
   });
+
+  it('skips Guardian accounts that still require hot-key rotation (post-recovery, pre-activation)', async () => {
+    // Recovered accounts have requiresHotKeyRotation=true and no hotPublicKey
+    // until the Activate Device Key banner runs the cold-signed update_signers
+    // rotation. Sync would throw on the missing hotPublicKey gate inside
+    // getOrCreateMultisigService — skip them upstream so AutoSync stays quiet.
+    storeState.accounts = [
+      { publicKey: 'guardian-pending', type: WalletType.Guardian, requiresHotKeyRotation: true },
+      { publicKey: 'guardian-active', type: WalletType.Guardian }
+    ];
+    const sync = jest.fn(async () => {});
+    mockGetOrCreateMultisigService.mockResolvedValue({ sync });
+
+    await syncGuardianAccounts();
+
+    expect(mockGetOrCreateMultisigService).toHaveBeenCalledTimes(1);
+    expect(mockGetOrCreateMultisigService).toHaveBeenCalledWith('guardian-active', zustandProvider);
+    expect(sync).toHaveBeenCalledTimes(1);
+  });
 });
diff --git a/src/lib/miden/front/guardian-sync.ts b/src/lib/miden/front/guardian-sync.ts
index ddd058b97..fe1c34c8f 100644
--- a/src/lib/miden/front/guardian-sync.ts
+++ b/src/lib/miden/front/guardian-sync.ts
@@ -15,17 +15,25 @@ export const zustandProvider: GuardianAccountProvider = {
   signWord: (publicKey: string, wordHex: string) => useWalletStore.getState().signWord(publicKey, wordHex),
   persistNewHotKey: (newHotPubKey: string, newHotCiphertext: string) =>
     useWalletStore.getState().persistNewHotKey(newHotPubKey, newHotCiphertext),
-  swapHotKey: (accountPublicKey: string, oldHotPubKey: string, newHotPubKey: string) =>
-    useWalletStore.getState().swapHotKey(accountPublicKey, oldHotPubKey, newHotPubKey)
+  swapHotKey: (accountPublicKey: string, newHotPubKey: string) =>
+    useWalletStore.getState().swapHotKey(accountPublicKey, newHotPubKey)
 };
 
 /**
  * Sync Guardian state for all Guardian accounts. Called from AutoSync after chain
  * state sync (frontend context only — uses the Zustand-backed provider).
+ *
+ * Accounts flagged `requiresHotKeyRotation` (adopted via recovery, hot key not
+ * yet activated) are skipped — `getOrCreateMultisigService` binds against the
+ * hot signer and throws on missing `hotPublicKey`. The Activate Device Key
+ * banner is the user's path to flip that flag; once swapped, the next sync
+ * cycle picks the account up normally.
  */
 export async function syncGuardianAccounts(): Promise<void> {
   const accounts = await zustandProvider.getAccounts();
-  const guardianAccounts = accounts.filter(acc => acc.type === WalletType.Guardian);
+  const guardianAccounts = accounts.filter(
+    acc => acc.type === WalletType.Guardian && !acc.requiresHotKeyRotation
+  );
 
   if (guardianAccounts.length === 0) return;
 
diff --git a/src/lib/miden/guardian/index.test.ts b/src/lib/miden/guardian/index.test.ts
index 2c95b9b79..2b802411d 100644
--- a/src/lib/miden/guardian/index.test.ts
+++ b/src/lib/miden/guardian/index.test.ts
@@ -5,7 +5,6 @@
  *   - proposal builders (send, consume, custom)
  *   - signAndExecute / signAndCreateTransactionRequest
  *   - sync retry on "nonce too low", including exhaustion
- *   - importAccountFromGuardian happy + error path
  *   - createSwitchGuardianProposal + finalizeGuardianSwitch
  *
  * All external collaborators are stubbed to keep tests hermetic.
@@ -318,53 +317,10 @@ describe('MultisigService', () => {
     });
   });
 
-  describe('importAccountFromGuardian', () => {
-    const signWordFn = jest.fn(async () => 'sig');
-
-    beforeEach(() => {
-      guardianConfig.setSigner.mockReset();
-      guardianConfig.getState.mockReset();
-    });
-
-    it('fetches state, base64-decodes into Account, and inserts into the webClient', async () => {
-      const webClient = {
-        accounts: { insert: jest.fn(async () => {}) }
-      };
-      const stateBase64 = Buffer.from('hello').toString('base64');
-      guardianConfig.getState.mockResolvedValueOnce({ stateJson: { data: stateBase64 } });
-      const fakeAccount = { id: () => ({ toString: () => 'acc' }) };
-      mockAccountDeserialize.mockReturnValueOnce(fakeAccount);
-
-      await MultisigService.importAccountFromGuardian('pub', 'commit', signWordFn, 'acc-id', webClient as never);
-
-      expect(guardianConfig.setSigner).toHaveBeenCalled();
-      expect(mockAccountDeserialize).toHaveBeenCalled();
-      expect(webClient.accounts.insert).toHaveBeenCalledWith({ account: fakeAccount, overwrite: true });
-    });
-
-    it('re-throws when the guardian state fetch fails', async () => {
-      const webClient = { accounts: { insert: jest.fn() } };
-      guardianConfig.getState.mockRejectedValueOnce(new Error('404'));
-
-      await expect(
-        MultisigService.importAccountFromGuardian('pub', 'commit', signWordFn, 'acc-id', webClient as never)
-      ).rejects.toThrow('404');
-      expect(webClient.accounts.insert).not.toHaveBeenCalled();
-    });
-
-    it('falls back to DEFAULT_GUARDIAN_ENDPOINT when storage has no URL', async () => {
-      // Exercises the `|| DEFAULT_GUARDIAN_ENDPOINT` branch on the endpoint lookup.
-      const webClient = { accounts: { insert: jest.fn(async () => {}) } };
-      mockFetchFromStorage.mockResolvedValueOnce(undefined);
-      const stateBase64 = Buffer.from('hi').toString('base64');
-      guardianConfig.getState.mockResolvedValueOnce({ stateJson: { data: stateBase64 } });
-      mockAccountDeserialize.mockReturnValueOnce({ id: () => ({ toString: () => 'x' }) });
-
-      await MultisigService.importAccountFromGuardian('pub', 'commit', signWordFn, 'acc-id', webClient as never);
-
-      expect(webClient.accounts.insert).toHaveBeenCalled();
-    });
-  });
+  // importAccountFromGuardian was removed in Phase 8 — the recovery flow
+  // (lookup + adopt + cold-signed rotation) lives end-to-end in
+  // MidenClientInterface.recoverGuardianAccountsBySeed and no longer needs
+  // a separate guardian-state-fetch helper on MultisigService.
 
   describe('init', () => {
     it('loads the Multisig for an existing account and returns a configured service', async () => {
diff --git a/src/lib/miden/guardian/index.ts b/src/lib/miden/guardian/index.ts
index 18ab99a10..04b64d843 100644
--- a/src/lib/miden/guardian/index.ts
+++ b/src/lib/miden/guardian/index.ts
@@ -1,4 +1,4 @@
-import { Account, MidenClient, TransactionRequest } from '@miden-sdk/miden-sdk/lazy';
+import { Account, TransactionRequest } from '@miden-sdk/miden-sdk/lazy';
 import {
   Multisig,
   MultisigClient,
@@ -89,35 +89,6 @@ export class MultisigService {
     return MultisigService.init(account, `0x${walletAccount.coldPublicKey}`, `0x${commitment}`, signWordFn);
   }
 
-  static async importAccountFromGuardian(
-    publicKey: string,
-    signerCommitment: string,
-    signWordFn: SignWordFunction,
-    accountId: string,
-    webClient: MidenClient
-  ) {
-    console.log('Importing account from Guardian with accountId:', accountId);
-    const guardianEndpoint = (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
-    console.log('Using Guardian endpoint:', guardianEndpoint);
-    const guardian = new GuardianHttpClient(guardianEndpoint);
-    const signer = new WalletSigner(publicKey, signerCommitment, signWordFn);
-    guardian.setSigner(signer);
-    try {
-      const { stateJson } = await guardian.getState(accountId);
-      const accountBase64 = stateJson.data;
-      const binaryString = atob(accountBase64);
-      const accountBytes = new Uint8Array(binaryString.length);
-      for (let i = 0; i < binaryString.length; i++) {
-        accountBytes[i] = binaryString.charCodeAt(i);
-      }
-      const account = Account.deserialize(accountBytes);
-      await webClient.accounts.insert({ account, overwrite: true });
-    } catch (error) {
-      console.log('Error fetching account state from Guardian:', error);
-      throw error;
-    }
-  }
-
   /**
    * Get the account ID for this multisig.
    */
diff --git a/src/lib/miden/sdk/miden-client-interface.test.ts b/src/lib/miden/sdk/miden-client-interface.test.ts
index 3641cadce..ca9be711d 100644
--- a/src/lib/miden/sdk/miden-client-interface.test.ts
+++ b/src/lib/miden/sdk/miden-client-interface.test.ts
@@ -538,102 +538,14 @@ describe('MidenClientInterface', () => {
       expect(fakeMidenClient.accounts.import).toHaveBeenCalledWith({ seed: expect.any(Uint8Array) });
     });
 
-    it('importGuardianAccountBySeed creates the account locally and re-hydrates state from the guardian', async () => {
-      const fakeMidenClient = buildFakeMidenClient();
-      const keys = {
-        hotPublicKey: 'hot-pub',
-        coldPublicKey: 'cold-pub',
-        hotCiphertext: 'hot-ct',
-        coldSecretKeyHex: 'cold-sk'
-      };
-      const createGuardianAccount = jest.fn(async () => ({
-        account: { id: () => ({ toString: () => 'guardian-acc-id' }) },
-        keys
-      }));
-      const getSignerDetailsFromAccount = jest.fn(async () => ({ commitment: 'abc' }));
-      const importAccountFromGuardian = jest.fn(async () => {});
-
-      jest.doMock('./helpers', () => ({
-        getBech32AddressFromAccountId: (id: any) => (typeof id === 'function' ? id().toString() : String(id))
-      }));
-      jest.doMock('screens/onboarding/types', () => ({
-        WalletType: { OnChain: 'on-chain', OffChain: 'off-chain', Guardian: 'guardian' }
-      }));
-      jest.doMock('../guardian/account', () => ({
-        createGuardianAccount,
-        getSignerDetailsFromAccount
-      }));
-      jest.doMock('../guardian/index', () => ({
-        MultisigService: { importAccountFromGuardian }
-      }));
-      jest.doMock('lib/miden-chain/constants', () => ({
-        DEFAULT_GUARDIAN_ENDPOINT: 'https://default.guardian.test'
-      }));
-      jest.doMock('lib/miden/activity/connectivity-issues', () => ({
-        addConnectivityIssue: jest.fn()
-      }));
-
-      const { MidenClientInterface } = await import('./miden-client-interface');
-      const client = MidenClientInterface.fromClient(fakeMidenClient as any, 'testnet');
-
-      const signWordFn = jest.fn(async () => '0xsig');
-      const result = await client.importGuardianAccountBySeed(new Uint8Array([1, 2, 3, 4]), signWordFn);
-
-      expect(createGuardianAccount).toHaveBeenCalledWith(
-        fakeMidenClient,
-        expect.any(Uint8Array),
-        true,
-        'https://default.guardian.test'
-      );
-      expect(getSignerDetailsFromAccount).toHaveBeenCalled();
-      // Hot pubkey passed to the guardian comes from `keys.hotPublicKey`
-      // (freshly generated), not from getSignerDetailsFromAccount anymore.
-      expect(importAccountFromGuardian).toHaveBeenCalledWith(
-        '0xhot-pub',
-        '0xabc',
-        signWordFn,
-        'guardian-acc-id',
-        fakeMidenClient
-      );
-      expect(result).toEqual({ accountId: 'guardian-acc-id', keys });
-    });
-
-    it('importGuardianAccountBySeed: wraps underlying errors in a "Failed to import Guardian account from seed" message', async () => {
-      const fakeMidenClient = buildFakeMidenClient();
-
-      jest.doMock('./helpers', () => ({
-        getBech32AddressFromAccountId: (id: any) => String(id)
-      }));
-      jest.doMock('screens/onboarding/types', () => ({
-        WalletType: { OnChain: 'on-chain', OffChain: 'off-chain', Guardian: 'guardian' }
-      }));
-      jest.doMock('../guardian/account', () => ({
-        createGuardianAccount: jest.fn(async () => {
-          throw new Error('guardian down');
-        }),
-        getSignerDetailsFromAccount: jest.fn()
-      }));
-      jest.doMock('../guardian/index', () => ({
-        MultisigService: { importAccountFromGuardian: jest.fn() }
-      }));
-      jest.doMock('lib/miden-chain/constants', () => ({
-        DEFAULT_GUARDIAN_ENDPOINT: 'https://default.guardian.test'
-      }));
-      jest.doMock('lib/miden/activity/connectivity-issues', () => ({
-        addConnectivityIssue: jest.fn()
-      }));
-
-      const { MidenClientInterface } = await import('./miden-client-interface');
-      const client = MidenClientInterface.fromClient(fakeMidenClient as any, 'testnet');
-
-      await expect(
-        client.importGuardianAccountBySeed(
-          new Uint8Array([1]),
-          jest.fn(async () => '0xsig'),
-          jest.fn(async () => 'pk')
-        )
-      ).rejects.toThrow('Failed to import Guardian account from seed');
-    });
+    // importGuardianAccountBySeed was removed in Phase 8 — replaced by the
+    // atomic recoverGuardianAccountsBySeed orchestrator that does lookup +
+    // adopt + cold-signed `replace_signer` rotation in one step. The
+    // orchestrator's end-to-end behavior depends on the guardian SDK,
+    // secureHotKey facade, and on-chain proving — covered by the manual
+    // devnet smoke in the Phase 8 plan rather than a fully-mocked unit
+    // test. Phase 9 will add comprehensive coverage with a faked
+    // MultisigClient.
   });
 
   describe('withProverFallback connectivity-state categorization', () => {
diff --git a/src/lib/miden/sdk/miden-client-interface.ts b/src/lib/miden/sdk/miden-client-interface.ts
index 65ae8ed3a..3d94be302 100644
--- a/src/lib/miden/sdk/miden-client-interface.ts
+++ b/src/lib/miden/sdk/miden-client-interface.ts
@@ -1,6 +1,7 @@
 import {
   Account,
   AccountFile,
+  AuthSecretKey,
   exportStore,
   importStore,
   InputNoteRecord,
@@ -15,6 +16,7 @@ import {
   TransactionRequest,
   TransactionResult
 } from '@miden-sdk/miden-sdk/lazy';
+import { Buffer } from 'buffer';
 
 import { isLikelyNetworkError } from 'lib/miden/activity/connectivity-classify';
 import { clearConnectivityIssue, markConnectivityIssue } from 'lib/miden/activity/connectivity-state';
@@ -35,13 +37,32 @@ import { ConsumeTransaction, SendTransaction } from '../db/types';
 // miden-client-interface. Static imports here deadlock init_guardian_manager in the
 // SW bundle (both sides' __esmMin wrappers await each other).
 import type { CreatedGuardianKeys } from '../guardian/account';
-import type { SignWordFunction } from '../guardian/signer';
 
 export interface GuardianAccountCreationResult {
   accountId: string;
   keys: CreatedGuardianKeys;
 }
 
+/**
+ * One Guardian account discovered + adopted via lookup-based recovery. The
+ * orchestrator does NOT rotate the hot signer at recovery time — the on-chain
+ * hot pubkey's secret is unrecoverable, but the wallet defers replacement
+ * until the user explicitly opts in (via the post-recovery banner on the
+ * home view). Vault.spawn persists `coldSecretKeyHex` under
+ * `accColdSecretKeyStrgKey(coldPublicKey)` and writes the WalletAccount
+ * with `requiresHotKeyRotation: true` and no `hotPublicKey` — the rotation
+ * flow (initiateReplaceHotKeyTransaction) generates the fresh hot key when
+ * the user clicks the banner.
+ */
+export interface RecoveredGuardianAccount {
+  accountId: string;
+  hdIndex: number;
+  coldPublicKey: string;
+  coldSecretKeyHex: string;
+}
+
+const MAX_RECOVERY_HD_INDEX = 20;
+
 export type MidenClientCreateOptions = {
   seed?: Uint8Array;
   insertKeyCallback?: (key: Uint8Array, secretKey: Uint8Array) => void;
@@ -145,57 +166,81 @@ export class MidenClientInterface {
   }
 
   /**
-   * Import a Guardian account by seed.
+   * Discover and adopt all Guardian accounts authorized by the cold keys
+   * derived from `mnemonic` against `guardianEndpoint`. Iterates HD indices
+   * 0..MAX-1 and stops at the first miss (no accounts returned for that
+   * cold commitment).
    *
-   * Caveat (3-key migration): the cold key is fully recoverable from the
-   * mnemonic, but the hot key is random and cannot be reconstructed. This
-   * method generates a fresh hot key, which means the locally-derived
-   * account ID won't match the one the user originally created — recovery
-   * after import requires a `replace_signer` proposal signed by cold +
-   * guardian to re-bind the new hot pubkey on-chain. Phase 8 of the
-   * migration plan covers that flow; until it lands, importing a Guardian
-   * account leaves the user with an empty fresh account under their seed.
+   * Each match is adopted locally only: the on-chain Account state is
+   * decoded and inserted into the WASM client + the cold key registered in
+   * the keystore. The hot signer is NOT rotated here — the on-chain hot
+   * pubkey's secret is unrecoverable, but rotation is deferred to a
+   * user-triggered banner action on the home view (initiateReplaceHotKey).
+   * The persisted WalletAccount is flagged `requiresHotKeyRotation: true`
+   * and carries no `hotPublicKey` until the rotation completes.
+   *
+   * The orchestrator acquires the WASM client mutex granularly per op, so
+   * callers must NOT hold the outer lock.
+   *
+   * @param deriveColdSeed - Sync closure returning the HD-derived cold seed
+   *   for a given index. Supplied by Vault.spawn so the BIP-39 / HD-path
+   *   logic stays out of this module (avoids a vault → miden-client-interface
+   *   import cycle).
+   * @param guardianEndpoint - Operator the lookup is scoped to. Must match
+   *   the endpoint the account was originally registered with — account IDs
+   *   are content-hash bound to the guardian pubkey baked into storage.
    */
-  async importGuardianAccountBySeed(
-    coldSeed: Uint8Array,
-    signWordFn: SignWordFunction
-  ): Promise<GuardianAccountCreationResult> {
-    console.log('Importing Guardian account from seed', coldSeed);
-    try {
-      const [
-        { createGuardianAccount, getSignerDetailsFromAccount },
-        { MultisigService },
-        { DEFAULT_GUARDIAN_ENDPOINT }
-      ] = await Promise.all([
-        import('../guardian/account'),
-        import('../guardian/index'),
-        import('lib/miden-chain/constants')
-      ]);
-      // Derive the account ID against the default guardian so it matches the ID
-      // the account had at creation time. The user's custom guardian URL
-      // (persisted in GUARDIAN_URL_STORAGE_KEY) is picked up later by
-      // importAccountFromGuardian for the live state fetch.
-      const { account, keys } = await createGuardianAccount(this.client, coldSeed, true, DEFAULT_GUARDIAN_ENDPOINT);
-      const accountIdStr = account.id().toString();
-      console.log('[MidenClientInterface] Imported Guardian account from seed with ID:', accountIdStr);
-      // Hot signer pubkey is the freshly-generated one — pass directly; we
-      // can't recover it via getPublicKeyForCommitment because the hot
-      // ciphertext is opaque (SE-wrapped on mobile). The unused
-      // getPublicKeyForCommitment arg is kept for backward-compat with
-      // vault.spawn's signature.
-      const { commitment } = await getSignerDetailsFromAccount(account);
-      await MultisigService.importAccountFromGuardian(
-        `0x${keys.hotPublicKey}`,
-        `0x${commitment}`,
-        signWordFn,
-        accountIdStr,
-        this.client
-      );
-      return { accountId: getBech32AddressFromAccountId(account.id()), keys };
-    } catch (error) {
-      console.log(error);
-      throw new Error('Failed to import Guardian account from seed');
+  async recoverGuardianAccountsBySeed(
+    deriveColdSeed: (hdIndex: number) => Uint8Array,
+    guardianEndpoint: string
+  ): Promise<RecoveredGuardianAccount[]> {
+    const [{ withWasmClientLock }, { MultisigClient, EcdsaSigner }] = await Promise.all([
+      import('../sdk/miden-client'),
+      import('@openzeppelin/miden-multisig-client')
+    ]);
+
+    const recovered: RecoveredGuardianAccount[] = [];
+
+    for (let hdIndex = 0; hdIndex < MAX_RECOVERY_HD_INDEX; hdIndex++) {
+      const coldSeed = deriveColdSeed(hdIndex);
+      const coldSk = AuthSecretKey.ecdsaWithRNG(coldSeed);
+      const coldPublicKey = Buffer.from(coldSk.publicKey().serialize().slice(1)).toString('hex');
+      const coldSecretKeyHex = Buffer.from(coldSk.serialize()).toString('hex');
+
+      const lookupClient = new MultisigClient(this.client, { guardianEndpoint });
+      const lookupSigner = new EcdsaSigner(coldSk);
+      const matches = await lookupClient.recoverByKey(lookupSigner);
+
+      if (matches.length === 0) {
+        // First miss — assume no further accounts under this seed at this endpoint.
+        break;
+      }
+
+      for (const { state } of matches) {
+        // Decode the on-chain account state and adopt it locally so subsequent
+        // SDK calls (.load, executeForSummary) can resolve the account.
+        const accountBytes = new Uint8Array(Buffer.from(state.stateJson.data, 'base64'));
+        const bech32 = await withWasmClientLock(async () => {
+          const acc = Account.deserialize(accountBytes);
+          await this.client.accounts.insert({ account: acc, overwrite: true });
+          await this.client.keystore.insert(acc.id(), coldSk);
+          return getBech32AddressFromAccountId(acc.id());
+        });
+
+        recovered.push({
+          accountId: bech32,
+          hdIndex,
+          coldPublicKey,
+          coldSecretKeyHex
+        });
+      }
     }
+
+    if (recovered.length === 0) {
+      throw new Error('No Guardian accounts found at this guardian endpoint for this seed');
+    }
+
+    return recovered;
   }
 
   async importNoteBytes(noteBytes: Uint8Array) {
diff --git a/src/lib/shared/types.ts b/src/lib/shared/types.ts
index 267244b57..a2c9a5412 100644
--- a/src/lib/shared/types.ts
+++ b/src/lib/shared/types.ts
@@ -283,6 +283,11 @@ export interface WalletAccount {
   // produced before the migration; consumers should treat absence as "not 3-key".
   hotPublicKey?: string;
   coldPublicKey?: string;
+  // True for Guardian accounts adopted via seed-phrase recovery — the on-chain
+  // hot signer's secret is unrecoverable, so the wallet defers replacement to
+  // a user-triggered rotation (banner on the home view). Cleared by Vault.swapHotKey
+  // once the cold+guardian-signed update_signers tx lands on-chain.
+  requiresHotKeyRotation?: boolean;
 }
 
 export interface WalletNetwork {
@@ -506,7 +511,6 @@ export interface PersistNewHotKeyResponse extends WalletMessageBase {
 export interface SwapHotKeyRequest extends WalletMessageBase {
   type: WalletMessageType.SwapHotKeyRequest;
   accountPublicKey: string;
-  oldHotPubKey: string;
   newHotPubKey: string;
 }
 
diff --git a/src/lib/store/index.ts b/src/lib/store/index.ts
index 3765f6527..10c5e04d5 100644
--- a/src/lib/store/index.ts
+++ b/src/lib/store/index.ts
@@ -315,11 +315,10 @@ export const useWalletStore = create<WalletStore>()(
       assertResponse(res.type === WalletMessageType.PersistNewHotKeyResponse);
     },
 
-    swapHotKey: async (accountPublicKey, oldHotPubKey, newHotPubKey) => {
+    swapHotKey: async (accountPublicKey, newHotPubKey) => {
       const res = await request({
         type: WalletMessageType.SwapHotKeyRequest,
         accountPublicKey,
-        oldHotPubKey,
         newHotPubKey
       });
       assertResponse(res.type === WalletMessageType.SwapHotKeyResponse);
diff --git a/src/lib/store/types.ts b/src/lib/store/types.ts
index a56f1b100..06d398242 100644
--- a/src/lib/store/types.ts
+++ b/src/lib/store/types.ts
@@ -146,7 +146,7 @@ export interface WalletActions {
   signTransaction: (publicKey: string, signingInputs: string) => Promise<Uint8Array>;
   signWord: (publicKey: string, wordHex: string) => Promise<string>;
   persistNewHotKey: (newHotPubKey: string, newHotCiphertext: string) => Promise<void>;
-  swapHotKey: (accountPublicKey: string, oldHotPubKey: string, newHotPubKey: string) => Promise<void>;
+  swapHotKey: (accountPublicKey: string, newHotPubKey: string) => Promise<void>;
   getPublicKeyForCommitment: (commitment: string) => Promise<string>;
   getAuthSecretKey: (key: string) => Promise<string>;
 
diff --git a/src/screens/onboarding/create-wallet-flow/BackUpSeedPhrase.tsx b/src/screens/onboarding/create-wallet-flow/BackUpSeedPhrase.tsx
index 8140ceb56..7ae6577ee 100644
--- a/src/screens/onboarding/create-wallet-flow/BackUpSeedPhrase.tsx
+++ b/src/screens/onboarding/create-wallet-flow/BackUpSeedPhrase.tsx
@@ -52,6 +52,7 @@ export const BackUpSeedPhraseScreen: React.FC<BackUpSeedPhraseScreenProps> = ({
         <div className="text-[10px] text-center font-regular">
           <p>{t('backUpWalletInstructions')}</p>
           <p>{t('doNotShareWithAnywone')}</p>
+          <p>{t('seedPhraseRecoveryCaption')}</p>
         </div>
       </div>
 

From 42d6094f971ed2a580f4e9978331d61b0ffc978d Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Tue, 12 May 2026 15:42:29 +0530
Subject: [PATCH 47/71] refactor(guardian): collapse
 multisigService/signingService into one var in generateGuardianTransaction

---
 src/lib/miden/activity/transactions.ts | 64 +++++++++-----------------
 1 file changed, 23 insertions(+), 41 deletions(-)

diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index f488f85b0..76370b27f 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -889,24 +889,18 @@ const generateGuardianTransaction = async (
   await setTransactionStage(transaction.id, 'creating-proposal');
 
   let proposalResult: Proposal;
-  // Hot-bound MultisigService is needed for every transaction type EXCEPT
-  // replace-hot-key — that flow predates a usable local hot key (post-recovery
-  // initial activation) and operates cold-only via buildColdMultisigService.
-  // Lazy-loaded so post-recovery accounts (no hotPublicKey yet) can still
-  // execute the rotation that gives them one.
-  let multisigService: MultisigService | null = null;
-  // The signing service for the FINAL signAndCreateTransactionRequest call.
-  // Defaults to the hot service. replace-hot-key flips it to a transient cold
-  // service because the hot key being replaced cannot itself authorize the
-  // rotation.
-  let signingService: MultisigService;
+  // The service that creates the proposal AND issues the final
+  // signAndCreateTransactionRequest. Hot-bound for every type except
+  // replace-hot-key, which is cold-bound because the hot key being replaced
+  // cannot authorize its own rotation. The hot-bound path is also the only
+  // one cached by guardian-manager; the cold service here is transient.
+  let service: MultisigService;
 
   switch (transaction.type) {
     case 'send': {
       const sendTx = transaction as SendTransaction;
-      multisigService = await getOrCreateMultisigService(transaction.accountId, guardianProvider);
-      signingService = multisigService;
-      proposalResult = await multisigService.createSendProposal(
+      service = await getOrCreateMultisigService(transaction.accountId, guardianProvider);
+      proposalResult = await service.createSendProposal(
         sendTx.secondaryAccountId,
         sendTx.faucetId,
         BigInt(sendTx.amount)
@@ -915,16 +909,14 @@ const generateGuardianTransaction = async (
     }
     case 'consume': {
       const consumeTx = transaction as ConsumeTransaction;
-      multisigService = await getOrCreateMultisigService(transaction.accountId, guardianProvider);
-      signingService = multisigService;
-      proposalResult = await multisigService.createConsumeNotesProposal([consumeTx.noteId]);
+      service = await getOrCreateMultisigService(transaction.accountId, guardianProvider);
+      proposalResult = await service.createConsumeNotesProposal([consumeTx.noteId]);
       break;
     }
     case 'switch-guardian': {
       const sgTx = transaction as SwitchGuardianTransaction;
-      multisigService = await getOrCreateMultisigService(transaction.accountId, guardianProvider);
-      signingService = multisigService;
-      const { proposal } = await multisigService.createSwitchGuardianProposal(sgTx.extraInputs.newGuardianEndpoint);
+      service = await getOrCreateMultisigService(transaction.accountId, guardianProvider);
+      const { proposal } = await service.createSwitchGuardianProposal(sgTx.extraInputs.newGuardianEndpoint);
       proposalResult = proposal;
       break;
     }
@@ -940,12 +932,8 @@ const generateGuardianTransaction = async (
       if (!sdkAccount) {
         throw new Error(`Guardian account ${transaction.accountId} not found in local client`);
       }
-      const coldService = await MultisigService.buildColdMultisigService(
-        sdkAccount,
-        walletAccount,
-        guardianProvider.signWord
-      );
-      const { proposal, newHot } = await coldService.createReplaceHotKeyProposal(sdkAccount);
+      service = await MultisigService.buildColdMultisigService(sdkAccount, walletAccount, guardianProvider.signWord);
+      const { proposal, newHot } = await service.createReplaceHotKeyProposal(sdkAccount);
       if (!guardianProvider.persistNewHotKey) {
         throw new Error('persistNewHotKey not implemented in this provider');
       }
@@ -962,7 +950,6 @@ const generateGuardianTransaction = async (
         t.extraInputs = rTx.extraInputs;
       });
       proposalResult = proposal;
-      signingService = coldService;
       break;
     }
     // case 'execute':
@@ -1011,7 +998,7 @@ const generateGuardianTransaction = async (
     await coldService.signProposal(proposalResult.id);
   }
 
-  const tr = await signingService.signAndCreateTransactionRequest(proposalResult.id);
+  const tr = await service.signAndCreateTransactionRequest(proposalResult.id);
   console.log('Created transaction request from proposal, submitting to Miden client', tr.authArg()?.toHex());
   const options: MidenClientCreateOptions = {
     signCallback: async (publicKey: Uint8Array, signingInputs: Uint8Array) => {
@@ -1061,14 +1048,7 @@ const generateGuardianTransaction = async (
       break;
     case 'switch-guardian':
       console.log('Completing switch guardian transaction');
-      if (!multisigService) {
-        throw new Error('multisigService missing during switch-guardian completion');
-      }
-      await completeSwitchGuardianTransaction(
-        transaction as SwitchGuardianTransaction,
-        transactionResult,
-        multisigService
-      );
+      await completeSwitchGuardianTransaction(transaction as SwitchGuardianTransaction, transactionResult, service);
       break;
     case 'replace-hot-key':
       console.log('Completing replace-hot-key transaction');
@@ -1083,11 +1063,13 @@ const generateGuardianTransaction = async (
     //   await completeCustomTransaction(transaction, transactionResult);
     //   break;
   }
-  console.log('Transaction generation complete, syncing multisig service');
-  // replace-hot-key invalidated its cached service via clearGuardianServiceFor —
-  // the next consumer re-inits with the new hot pubkey. No sync needed here.
-  if (multisigService) {
-    await multisigService.sync();
+  // Sync the cached hot service so the next consumer sees post-tx state.
+  // Skip for replace-hot-key: that path's service is a transient cold one,
+  // and the cached hot service was invalidated in completeReplaceHotKeyTransaction
+  // via clearGuardianServiceFor — next access re-inits with the new hot pubkey.
+  if (transaction.type !== 'replace-hot-key') {
+    console.log('Transaction generation complete, syncing multisig service');
+    await service.sync();
   }
 };
 

From c65026748a586818ec3b7d33813139ad71d6cc01 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Tue, 12 May 2026 15:42:48 +0530
Subject: [PATCH 48/71] fix(guardian): fire accountsUpdated on SW-side
 swapHotKey so popups see rotated state

---
 src/lib/miden/back/transaction-processor.ts | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/lib/miden/back/transaction-processor.ts b/src/lib/miden/back/transaction-processor.ts
index e8cab1290..06e958f96 100644
--- a/src/lib/miden/back/transaction-processor.ts
+++ b/src/lib/miden/back/transaction-processor.ts
@@ -12,7 +12,7 @@ import { type GuardianAccountProvider } from 'lib/miden/front/guardian-manager';
 import { WalletMessageType } from 'lib/shared/types';
 
 import { getIntercom } from './defaults';
-import { withUnlocked } from './store';
+import { accountsUpdated, withUnlocked } from './store';
 
 // NOTE: `webextension-polyfill` throws at module load time when
 // `globalThis.chrome?.runtime?.id` is undefined (non-extension
@@ -84,8 +84,20 @@ const vaultGuardianProvider: GuardianAccountProvider = {
     });
   },
   swapHotKey: async (accountPublicKey: string, newHotPubKey: string) => {
+    // Fire `accountsUpdated` after the vault swap so the SW's Effector store
+    // reflects the new hotPublicKey. Without this, storage is correct but the
+    // Effector snapshot served via frontStore stays at the pre-rotation
+    // accounts array — every popup that pulls state then sees the OLD
+    // hotPublicKey, builds a MultisigService bound to it, and signWord trips
+    // "Some storage item not found" against the now-removed old ciphertext.
+    // SW reload masks the bug because the Effector store reinitializes from
+    // storage on boot. Mirrors what Actions.swapHotKey does for the
+    // intercom-driven path; we don't route through Actions.swapHotKey here
+    // because importing actions.ts drags webextension-polyfill into the
+    // transaction-processor's init chain.
     return withUnlocked(async ({ vault }) => {
-      await vault.swapHotKey(accountPublicKey, newHotPubKey);
+      const updated = await vault.swapHotKey(accountPublicKey, newHotPubKey);
+      accountsUpdated(updated);
     });
   }
 };

From f4b2f2f466ae9f9936e81abd43a9406e3734d487 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Tue, 12 May 2026 17:06:51 +0530
Subject: [PATCH 49/71] feat(guardian): reveal hot key + reshape reveal private
 key for 3-key accounts

---
 .../java/com/miden/wallet/HotKeyPlugin.kt     |  87 ++++++++--
 ios/App/App/HotKeyPlugin.swift                |  80 ++++++++-
 public/_locales/en/en.json                    |   9 +
 src/app/pages/Settings.selectors.ts           |   1 +
 src/app/pages/Settings.tsx                    |  37 ++++-
 src/app/templates/RevealSecret.tsx            | 135 +++++++++++++--
 src/lib/intercom/mobile-adapter.ts            |  18 ++
 src/lib/miden/back/actions.ts                 |   8 +
 src/lib/miden/back/main.ts                    |  16 ++
 src/lib/miden/back/vault.test.ts              | 154 +++++++++++++++++-
 src/lib/miden/back/vault.ts                   |  86 ++++++++--
 src/lib/miden/front/client.ts                 |  18 ++
 src/lib/miden/front/guardian-sync.test.ts     |   2 +-
 src/lib/secure-hot-key/hotKeyPlugin.ts        |   5 +
 src/lib/secure-hot-key/index.ts               |  11 ++
 src/lib/secure-hot-key/jsFallback.ts          |  11 ++
 src/lib/secure-hot-key/nativePlugin.test.ts   |  17 +-
 src/lib/secure-hot-key/nativePlugin.ts        |   7 +
 src/lib/shared/types.ts                       |  32 ++++
 src/lib/store/index.ts                        |  24 +++
 src/lib/store/types.ts                        |   5 +
 21 files changed, 715 insertions(+), 48 deletions(-)

diff --git a/android/app/src/main/java/com/miden/wallet/HotKeyPlugin.kt b/android/app/src/main/java/com/miden/wallet/HotKeyPlugin.kt
index 51bfdb52b..fede2f685 100644
--- a/android/app/src/main/java/com/miden/wallet/HotKeyPlugin.kt
+++ b/android/app/src/main/java/com/miden/wallet/HotKeyPlugin.kt
@@ -65,9 +65,12 @@ class HotKeyPlugin : Plugin() {
         private val HALF_N: BigInteger = SECP256K1.n.shiftRight(1)
     }
 
+    private enum class PendingOp { SIGN, REVEAL }
+
     private var pendingCall: PluginCall? = null
     private var pendingPayload: ByteArray? = null
     private var pendingDigest: ByteArray? = null
+    private var pendingOp: PendingOp? = null
 
     @PluginMethod
     fun generateHotKey(call: PluginCall) {
@@ -165,13 +168,54 @@ class HotKeyPlugin : Plugin() {
             pendingCall = call
             pendingPayload = payload
             pendingDigest = digestBytes
-            promptForBiometric(cipher)
+            pendingOp = PendingOp.SIGN
+            promptForBiometric(cipher, "Sign transaction")
         } catch (e: Exception) {
             Log.e(TAG, "signWithHotKey failed: ${e.message}", e)
             call.reject("Hot-key sign failed: ${e.message}")
         }
     }
 
+    /// Unwrap the hot-key secret inside the Keystore (triggers BiometricPrompt)
+    /// and return the raw 32-byte secp256k1 secret as hex. Used by Settings →
+    /// Reveal Hot Key. Same OAEP unwrap path as `signWithHotKey`, minus the
+    /// signing step. The unwrapped secret is zeroed before returning.
+    @PluginMethod
+    fun revealHotKey(call: PluginCall) {
+        Log.d(TAG, "revealHotKey called")
+
+        val ciphertext = call.getString("ciphertext")
+        if (ciphertext == null) {
+            call.reject("Missing 'ciphertext' parameter")
+            return
+        }
+
+        try {
+            val (alias, payload) = parseCiphertext(ciphertext)
+
+            val keyStore = KeyStore.getInstance(ANDROID_KEYSTORE)
+            keyStore.load(null)
+            val privateKey = keyStore.getKey(alias, null) as? PrivateKey
+            if (privateKey == null) {
+                Log.e(TAG, "revealHotKey: Keystore key not found at $alias")
+                call.reject("Hot-key Keystore key not found", "KEY_NOT_FOUND")
+                return
+            }
+
+            val cipher = Cipher.getInstance(OAEP_TRANSFORMATION)
+            cipher.init(Cipher.DECRYPT_MODE, privateKey, oaepParams())
+
+            pendingCall = call
+            pendingPayload = payload
+            pendingDigest = null
+            pendingOp = PendingOp.REVEAL
+            promptForBiometric(cipher, "Reveal device key")
+        } catch (e: Exception) {
+            Log.e(TAG, "revealHotKey failed: ${e.message}", e)
+            call.reject("Hot-key reveal failed: ${e.message}")
+        }
+    }
+
     /// Delete the per-account Keystore hot key. Idempotent — a missing alias
     /// resolves successfully so callers can call this during account deletion
     /// without branching on existence.
@@ -203,7 +247,7 @@ class HotKeyPlugin : Plugin() {
 
     // -- Biometric prompt + post-auth sign ------------------------------------
 
-    private fun promptForBiometric(cipher: Cipher) {
+    private fun promptForBiometric(cipher: Cipher, subtitle: String) {
         val activity = activity as? FragmentActivity
         if (activity == null) {
             failPending("Activity not available")
@@ -213,16 +257,18 @@ class HotKeyPlugin : Plugin() {
         val executor = ContextCompat.getMainExecutor(context)
         val callback = object : BiometricPrompt.AuthenticationCallback() {
             override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
-                Log.d(TAG, "Biometric authentication succeeded for hot-key sign")
+                Log.d(TAG, "Biometric authentication succeeded for hot-key op")
                 val cryptoCipher = result.cryptoObject?.cipher
                 val payload = pendingPayload
                 val digest = pendingDigest
+                val op = pendingOp
                 val pendingCallLocal = pendingCall
                 pendingCall = null
                 pendingPayload = null
                 pendingDigest = null
+                pendingOp = null
 
-                if (cryptoCipher == null || payload == null || digest == null || pendingCallLocal == null) {
+                if (cryptoCipher == null || payload == null || op == null || pendingCallLocal == null) {
                     pendingCallLocal?.reject("Cipher not available after authentication")
                     return
                 }
@@ -234,14 +280,29 @@ class HotKeyPlugin : Plugin() {
                         pendingCallLocal.reject("Unwrapped hot-key has wrong length")
                         return
                     }
-                    val signatureHex = signRecoverable(unwrapped, digest)
-                    val res = JSObject()
-                    res.put("signatureHex", signatureHex)
-                    Log.d(TAG, "signWithHotKey success")
-                    pendingCallLocal.resolve(res)
+                    when (op) {
+                        PendingOp.SIGN -> {
+                            if (digest == null) {
+                                pendingCallLocal.reject("Hot-key sign post-auth: missing digest")
+                                return
+                            }
+                            val signatureHex = signRecoverable(unwrapped, digest)
+                            val res = JSObject()
+                            res.put("signatureHex", signatureHex)
+                            Log.d(TAG, "signWithHotKey success")
+                            pendingCallLocal.resolve(res)
+                        }
+                        PendingOp.REVEAL -> {
+                            val secretKeyHex = unwrapped.toHex()
+                            val res = JSObject()
+                            res.put("secretKeyHex", secretKeyHex)
+                            Log.d(TAG, "revealHotKey success")
+                            pendingCallLocal.resolve(res)
+                        }
+                    }
                 } catch (e: Exception) {
-                    Log.e(TAG, "Hot-key sign post-auth failed: ${e.message}", e)
-                    pendingCallLocal.reject("Hot-key sign failed: ${e.message}")
+                    Log.e(TAG, "Hot-key post-auth failed: ${e.message}", e)
+                    pendingCallLocal.reject("Hot-key operation failed: ${e.message}")
                 } finally {
                     unwrapped?.let { zero(it) }
                 }
@@ -253,6 +314,7 @@ class HotKeyPlugin : Plugin() {
                 pendingCall = null
                 pendingPayload = null
                 pendingDigest = null
+                pendingOp = null
                 when (errorCode) {
                     BiometricPrompt.ERROR_USER_CANCELED,
                     BiometricPrompt.ERROR_NEGATIVE_BUTTON ->
@@ -271,7 +333,7 @@ class HotKeyPlugin : Plugin() {
         // no negative button (DEVICE_CREDENTIAL forbids it).
         val promptInfo = BiometricPrompt.PromptInfo.Builder()
             .setTitle("Miden Wallet")
-            .setSubtitle("Sign transaction")
+            .setSubtitle(subtitle)
             .setAllowedAuthenticators(
                 BiometricManager.Authenticators.BIOMETRIC_STRONG or
                     BiometricManager.Authenticators.DEVICE_CREDENTIAL
@@ -289,6 +351,7 @@ class HotKeyPlugin : Plugin() {
         pendingCall = null
         pendingPayload = null
         pendingDigest = null
+        pendingOp = null
         pendingCallLocal?.reject(msg)
     }
 
diff --git a/ios/App/App/HotKeyPlugin.swift b/ios/App/App/HotKeyPlugin.swift
index 741ce8e3a..7e243a97b 100644
--- a/ios/App/App/HotKeyPlugin.swift
+++ b/ios/App/App/HotKeyPlugin.swift
@@ -27,7 +27,8 @@ public class HotKeyPlugin: CAPPlugin, CAPBridgedPlugin {
     public let pluginMethods: [CAPPluginMethod] = [
         CAPPluginMethod(name: "generateHotKey", returnType: CAPPluginReturnPromise),
         CAPPluginMethod(name: "signWithHotKey", returnType: CAPPluginReturnPromise),
-        CAPPluginMethod(name: "deleteHotKey", returnType: CAPPluginReturnPromise)
+        CAPPluginMethod(name: "deleteHotKey", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "revealHotKey", returnType: CAPPluginReturnPromise)
     ]
 
     @objc func generateHotKey(_ call: CAPPluginCall) {
@@ -278,6 +279,83 @@ public class HotKeyPlugin: CAPPlugin, CAPBridgedPlugin {
         call.resolve(["signatureHex": signatureHex])
     }
 
+    /// Unwrap the hot-key secret inside the SE (triggers Face ID) and return
+    /// the raw 32-byte secp256k1 secret as hex. Used by Settings → Reveal Hot
+    /// Key. Same SE/ECIES unwrap path as `signWithHotKey`, minus the actual
+    /// signing step. The unwrapped secret is zeroed before returning.
+    @objc func revealHotKey(_ call: CAPPluginCall) {
+        os_log("[HotKey] revealHotKey called", log: logger, type: .debug)
+
+        guard let ciphertext = call.getString("ciphertext") else {
+            call.reject("Missing 'ciphertext' parameter")
+            return
+        }
+
+        let parts = ciphertext.split(separator: ":", maxSplits: 1, omittingEmptySubsequences: false)
+        guard parts.count == 2,
+              let payload = Data(base64Encoded: String(parts[1])) else {
+            call.reject("Malformed hot-key ciphertext")
+            return
+        }
+        let fullTag = kHotKeyTagPrefix + String(parts[0])
+        guard let fullTagData = fullTag.data(using: .utf8) else {
+            call.reject("Failed to encode hot-key tag")
+            return
+        }
+
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassKey,
+            kSecAttrApplicationTag as String: fullTagData,
+            kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+            kSecReturnRef as String: true
+        ]
+        var keyRef: CFTypeRef?
+        let lookupStatus = SecItemCopyMatching(query as CFDictionary, &keyRef)
+        guard lookupStatus == errSecSuccess, let foundKey = keyRef else {
+            os_log("[HotKey] revealHotKey: SE key not found %{public}d", log: logger, type: .error, lookupStatus)
+            if lookupStatus == errSecUserCanceled {
+                call.reject("Authentication cancelled", "USER_CANCELLED")
+            } else if lookupStatus == errSecAuthFailed {
+                call.reject("Authentication failed", "AUTH_FAILED")
+            } else {
+                call.reject("Hot-key SE key not found: \(lookupStatus)")
+            }
+            return
+        }
+        let sePrivateKey = foundKey as! SecKey
+
+        var decError: Unmanaged<CFError>?
+        guard var unwrapped = SecKeyCreateDecryptedData(
+            sePrivateKey,
+            .eciesEncryptionStandardX963SHA256AESGCM,
+            payload as CFData,
+            &decError
+        ) as Data? else {
+            let nsError = decError?.takeRetainedValue() as? NSError
+            let msg = nsError?.localizedDescription ?? "unknown"
+            os_log("[HotKey] revealHotKey decrypt failed: %{public}@", log: logger, type: .error, msg)
+            if nsError?.domain == LAError.errorDomain && nsError?.code == LAError.userCancel.rawValue {
+                call.reject("Authentication cancelled", "USER_CANCELLED")
+            } else if nsError?.domain == LAError.errorDomain && nsError?.code == LAError.authenticationFailed.rawValue {
+                call.reject("Authentication failed", "AUTH_FAILED")
+            } else {
+                call.reject("Failed to unwrap hot-key secret: \(msg)")
+            }
+            return
+        }
+        guard unwrapped.count == 32 else {
+            zeroBytes(&unwrapped)
+            call.reject("Unwrapped hot-key has wrong length")
+            return
+        }
+
+        let secretKeyHex = unwrapped.map { String(format: "%02x", $0) }.joined()
+        zeroBytes(&unwrapped)
+
+        os_log("[HotKey] revealHotKey success", log: logger, type: .debug)
+        call.resolve(["secretKeyHex": secretKeyHex])
+    }
+
     /// Delete the per-account SE hot key. Idempotent — a missing key resolves
     /// successfully so callers can call this during account deletion without
     /// branching on existence.
diff --git a/public/_locales/en/en.json b/public/_locales/en/en.json
index 1cec13517..990efb0c6 100644
--- a/public/_locales/en/en.json
+++ b/public/_locales/en/en.json
@@ -396,6 +396,15 @@
   "activateHotKeyBannerBody": "Generate a device key for this recovered account. Required before sending.",
   "activateHotKeyBannerCta": "Activate",
   "activateHotKeyBannerError": "Failed to activate device key. Try again.",
+  "revealHotKey": "Reveal device key",
+  "revealHotKeyDescription": "Your device (hot) key is rotatable from Settings → Rotate Device Key, so revealing it is lower-stakes than your seed phrase — but anyone who holds it can sign transactions until you rotate.",
+  "hotPrivateKey": "Device Private Key",
+  "hotPublicKeyLabel": "Device Public Key",
+  "coldPrivateKey": "Recovery (Cold) Private Key",
+  "coldPublicKeyLabel": "Recovery (Cold) Public Key",
+  "guardianKeysRevealDescription": "Your Guardian account is protected by three keys: a device (hot) key for routine signing, a recovery (cold) key derived from your seed phrase for account-management operations, and an external guardian co-signer. Below are your cold private key plus both public keys. To reveal the device private key, use Settings → Reveal Device Key.",
+  "hotKeyRevealWarningTitle": "Before you reveal your device key",
+  "hotKeyRevealWarningBody": "Anyone with this key can sign transactions until you rotate it. If the key is leaked, rotate it via Settings → Rotate Device Key.",
   "invalidUrl": "Enter a valid URL starting with http:// or https://",
   "encryptedWalletFileDescription": "Enter your password to access your Encrypted Wallet File.",
   "encryptedWalletFileDescriptionHardware": "Unlock with your passcode to access your Encrypted Wallet File.",
diff --git a/src/app/pages/Settings.selectors.ts b/src/app/pages/Settings.selectors.ts
index 59c952ccd..cfbb0b1c6 100644
--- a/src/app/pages/Settings.selectors.ts
+++ b/src/app/pages/Settings.selectors.ts
@@ -5,6 +5,7 @@ export enum SettingsSelectors {
   AddressBookButton = 'Settings/AddressBookButton',
   RevealViewKeyButton = 'Settings/RevealViewKeyButton',
   RevealPrivateKeyButton = 'Settings/RevealPrivateKeyButton',
+  RevealHotKeyButton = 'Settings/RevealHotKeyButton',
   RevealSeedPhraseButton = 'Settings/RevealSeedPhraseButton',
   DAppsButton = 'Settings/DAppsButton',
   NetworksButton = 'Settings/NetworksButton',
diff --git a/src/app/pages/Settings.tsx b/src/app/pages/Settings.tsx
index 5c7541f13..1a39cc79e 100644
--- a/src/app/pages/Settings.tsx
+++ b/src/app/pages/Settings.tsx
@@ -69,7 +69,13 @@ type SettingsProps = {
   tabSlug?: string | null;
 };
 
-const RevealPrivateKey: FC = () => <RevealSecret reveal="private-key" />;
+const RevealPrivateKey: FC = () => {
+  const currentAccountType = useWalletStore(s => s.currentAccount?.type);
+  const isGuardian = currentAccountType === WalletType.Guardian;
+  return <RevealSecret reveal={isGuardian ? 'guardian-keys' : 'private-key'} />;
+};
+
+const RevealHotKey: FC = () => <RevealSecret reveal="hot-key" />;
 
 const LANGUAGE_LABELS: Record<string, string> = {
   en: 'English',
@@ -102,6 +108,10 @@ type Tab = {
   isDrawer?: boolean;
   onClick?: () => void;
   guardianOnly?: boolean;
+  // Hide on Guardian accounts whose hot key is not yet activated (post-recovery,
+  // pre-banner-click). The corresponding Settings flow needs a `hotPublicKey`
+  // set on the WalletAccount or it'll fail immediately on the vault lookup.
+  requiresActivatedHotKey?: boolean;
 };
 
 type TabGroup = {
@@ -157,6 +167,15 @@ const TAB_GROUPS: TabGroup[] = [
         Component: RevealPrivateKey,
         testID: SettingsSelectors.RevealPrivateKeyButton
       },
+      {
+        slug: 'reveal-hot-key',
+        titleI18nKey: 'revealHotKey',
+        Icon: SecretKeyIcon,
+        Component: RevealHotKey,
+        testID: SettingsSelectors.RevealHotKeyButton,
+        guardianOnly: true,
+        requiresActivatedHotKey: true
+      },
       {
         slug: 'encrypted-wallet-file',
         titleI18nKey: 'encryptedWalletFile',
@@ -244,7 +263,15 @@ const HIDDEN_TABS: Tab[] = [
 const Settings: FC<SettingsProps> = ({ tabSlug }) => {
   const { t } = useTranslation();
   const currentAccountType = useWalletStore(s => s.currentAccount?.type);
+  const currentAccountHotPublicKey = useWalletStore(s => s.currentAccount?.hotPublicKey);
   const isGuardianAccount = currentAccountType === WalletType.Guardian;
+  const hasActivatedHotKey = Boolean(currentAccountHotPublicKey);
+
+  const tabIsVisible = (tab: Tab) => {
+    if (tab.guardianOnly && !isGuardianAccount) return false;
+    if (tab.requiresActivatedHotKey && !hasActivatedHotKey) return false;
+    return true;
+  };
 
   // Filter tabs that are gated to Guardian accounts. Non-Guardian users don't see
   // the Guardian Settings entry at all (menu, drawer, or routable page).
@@ -252,14 +279,14 @@ const Settings: FC<SettingsProps> = ({ tabSlug }) => {
     () =>
       TAB_GROUPS.map(group => ({
         ...group,
-        tabs: group.tabs.filter(tab => !tab.guardianOnly || isGuardianAccount)
+        tabs: group.tabs.filter(tabIsVisible)
       })).filter(group => group.tabs.length > 0),
-    [isGuardianAccount]
+    [isGuardianAccount, hasActivatedHotKey]
   );
 
   const allTabs = useMemo(
-    () => [...tabGroups.flatMap(g => g.tabs), ...HIDDEN_TABS.filter(tab => !tab.guardianOnly || isGuardianAccount)],
-    [tabGroups, isGuardianAccount]
+    () => [...tabGroups.flatMap(g => g.tabs), ...HIDDEN_TABS.filter(tabIsVisible)],
+    [tabGroups, isGuardianAccount, hasActivatedHotKey]
   );
 
   const drawerTabs = useMemo(() => tabGroups.flatMap(g => g.tabs).filter(t => t.isDrawer), [tabGroups]);
diff --git a/src/app/templates/RevealSecret.tsx b/src/app/templates/RevealSecret.tsx
index 68ba61443..186fadd91 100644
--- a/src/app/templates/RevealSecret.tsx
+++ b/src/app/templates/RevealSecret.tsx
@@ -10,6 +10,7 @@ import { Button, ButtonVariant } from 'components/Button';
 import { Vault } from 'lib/miden/back/vault';
 import { useAccount, useSecretState, useMidenContext } from 'lib/miden/front';
 import { getMidenClient, withWasmClientLock } from 'lib/miden/sdk/miden-client';
+import { useHideNavbarWhileOpen } from 'lib/mobile/useHideNavbarWhileOpen';
 import { isMobile } from 'lib/platform';
 import useCopyToClipboard from 'lib/ui/useCopyToClipboard';
 
@@ -20,12 +21,18 @@ type FormData = {
 };
 
 type RevealSecretProps = {
-  reveal: 'private-key' | 'seed-phrase';
+  reveal: 'private-key' | 'seed-phrase' | 'hot-key' | 'guardian-keys';
+};
+
+type GuardianKeysBundle = {
+  coldPrivateKey: string;
+  coldPublicKey: string;
+  hotPublicKey?: string;
 };
 
 const RevealSecret: FC<RevealSecretProps> = ({ reveal }) => {
   const { t } = useTranslation();
-  const { revealMnemonic, revealPrivateKey } = useMidenContext();
+  const { revealMnemonic, revealPrivateKey, revealHotKey, revealGuardianKeys } = useMidenContext();
   const account = useAccount();
   const { fieldRef: secretFieldRef } = useCopyToClipboard();
 
@@ -40,12 +47,21 @@ const RevealSecret: FC<RevealSecretProps> = ({ reveal }) => {
 
   const passwordValue = watch('password');
   const [secret, setSecret] = useSecretState();
+  const [guardianBundle, setGuardianBundle] = useState<GuardianKeysBundle | null>(null);
   const [hasHardwareProtector, setHasHardwareProtector] = useState<boolean | null>(null);
-  // Private-key reveals require the user to tick an "I understand"
-  // checkbox before the Continue button enables. The warning banner
-  // alone is passive; this gate forces one deliberate interaction
-  // before handing out a key the user can never rotate.
+  // The native iOS / Android navbar pill renders in a separate UIWindow / Dialog
+  // above the WebView, so any content at the bottom of this page (notably the
+  // Unlock button on hardware-protected wallets, where there's no password
+  // input to push the button up) gets z-covered and becomes unclickable.
+  // Morph the pill out while the reveal screen is mounted; restores on unmount.
+  useHideNavbarWhileOpen(true);
+  // Private-key + guardian-keys reveals require the user to tick an "I
+  // understand" checkbox before the Continue button enables. The warning
+  // banner alone is passive; this gate forces one deliberate interaction
+  // before handing out recovery material. Hot-key reveal skips the gate
+  // because hot keys rotate from Settings → Rotate Device Key.
   const [privateKeyAcknowledged, setPrivateKeyAcknowledged] = useState(false);
+  const requiresAcknowledge = reveal === 'private-key' || reveal === 'guardian-keys';
 
   useEffect(() => {
     Vault.hasHardwareProtector().then(setHasHardwareProtector);
@@ -53,7 +69,10 @@ const RevealSecret: FC<RevealSecretProps> = ({ reveal }) => {
 
   useEffect(() => {
     if (account.publicKey) {
-      return () => setSecret(null);
+      return () => {
+        setSecret(null);
+        setGuardianBundle(null);
+      };
     }
     return undefined;
   }, [account.publicKey, setSecret]);
@@ -84,14 +103,16 @@ const RevealSecret: FC<RevealSecretProps> = ({ reveal }) => {
       clearErrors('password');
       try {
         const unlockPassword = hasHardwareProtector ? undefined : password;
-        let secret: string;
         if (reveal === 'private-key') {
           const pubKeyCommitment = await getAccountPublicKeyCommitment(account.publicKey);
-          secret = await revealPrivateKey(pubKeyCommitment, unlockPassword);
+          setSecret(await revealPrivateKey(pubKeyCommitment, unlockPassword));
+        } else if (reveal === 'hot-key') {
+          setSecret(await revealHotKey(account.publicKey, unlockPassword));
+        } else if (reveal === 'guardian-keys') {
+          setGuardianBundle(await revealGuardianKeys(account.publicKey, unlockPassword));
         } else {
-          secret = await revealMnemonic(unlockPassword);
+          setSecret(await revealMnemonic(unlockPassword));
         }
-        setSecret(secret);
       } catch (err: any) {
         console.error(err);
 
@@ -107,6 +128,8 @@ const RevealSecret: FC<RevealSecretProps> = ({ reveal }) => {
       setError,
       revealMnemonic,
       revealPrivateKey,
+      revealHotKey,
+      revealGuardianKeys,
       setSecret,
       focusPasswordField,
       hasHardwareProtector,
@@ -149,10 +172,71 @@ const RevealSecret: FC<RevealSecretProps> = ({ reveal }) => {
             </div>
           )
         };
+
+      case 'hot-key':
+        return {
+          name: t('hotPrivateKey'),
+          accountBanner: null,
+          attention: null,
+          fieldDesc: <div className="text-heading-gray text-sm">{t('revealHotKeyDescription')}</div>
+        };
+
+      case 'guardian-keys':
+        return {
+          name: t('coldPrivateKey'),
+          accountBanner: null,
+          attention: null,
+          fieldDesc: <div className="text-heading-gray text-sm">{t('guardianKeysRevealDescription')}</div>
+        };
     }
   }, [reveal, t]);
 
   const mainContent = useMemo(() => {
+    if (guardianBundle) {
+      return (
+        <div className="pt-8 flex flex-col gap-6">
+          <FormField
+            ref={secretFieldRef}
+            secret
+            textarea
+            rows={3}
+            readOnly
+            label={t('coldPrivateKey')}
+            labelClassName="text-base/[20px] font-semibold text-heading-gray mb-0"
+            labelDescription={<div className="mb-3">{texts.fieldDesc}</div>}
+            id="reveal-guardian-cold-private"
+            spellCheck={false}
+            className="resize-none notranslate"
+            value={guardianBundle.coldPrivateKey}
+          />
+          <FormField
+            textarea
+            rows={2}
+            readOnly
+            label={t('coldPublicKeyLabel')}
+            labelClassName="text-base/[20px] font-semibold text-heading-gray mb-0"
+            id="reveal-guardian-cold-public"
+            spellCheck={false}
+            className="resize-none notranslate"
+            value={guardianBundle.coldPublicKey}
+          />
+          {guardianBundle.hotPublicKey && (
+            <FormField
+              textarea
+              rows={2}
+              readOnly
+              label={t('hotPublicKeyLabel')}
+              labelClassName="text-base/[20px] font-semibold text-heading-gray mb-0"
+              id="reveal-guardian-hot-public"
+              spellCheck={false}
+              className="resize-none notranslate"
+              value={guardianBundle.hotPublicKey}
+            />
+          )}
+        </div>
+      );
+    }
+
     if (secret) {
       return (
         <div className="pt-8">
@@ -209,9 +293,21 @@ const RevealSecret: FC<RevealSecretProps> = ({ reveal }) => {
         )}
       </form>
     );
-  }, [errors, onSubmit, register, secret, texts, clearErrors, secretFieldRef, t, hasHardwareProtector, handleSubmit]);
+  }, [
+    errors,
+    onSubmit,
+    register,
+    secret,
+    guardianBundle,
+    texts,
+    clearErrors,
+    secretFieldRef,
+    t,
+    hasHardwareProtector,
+    handleSubmit
+  ]);
 
-  const showButton = !secret;
+  const showButton = !secret && !guardianBundle;
 
   if (hasHardwareProtector === null) {
     return null;
@@ -221,7 +317,7 @@ const RevealSecret: FC<RevealSecretProps> = ({ reveal }) => {
     <div className="w-full max-w-sm mx-auto flex flex-col flex-1 min-h-0">
       {texts.accountBanner}
 
-      {reveal === 'private-key' && !secret && (
+      {requiresAcknowledge && showButton && (
         <>
           <Alert
             type="warn"
@@ -241,6 +337,15 @@ const RevealSecret: FC<RevealSecretProps> = ({ reveal }) => {
         </>
       )}
 
+      {reveal === 'hot-key' && showButton && (
+        <Alert
+          type="warn"
+          title={t('hotKeyRevealWarningTitle')}
+          description={<p>{t('hotKeyRevealWarningBody')}</p>}
+          className="mb-4 rounded-lg"
+        />
+      )}
+
       {mainContent}
 
       {showButton && (
@@ -251,7 +356,7 @@ const RevealSecret: FC<RevealSecretProps> = ({ reveal }) => {
             title={t(hasHardwareProtector ? 'unlock' : 'continue')}
             disabled={
               isSubmitting ||
-              (reveal === 'private-key' && !privateKeyAcknowledged) ||
+              (requiresAcknowledge && !privateKeyAcknowledged) ||
               (hasHardwareProtector ? false : !passwordValue)
             }
             isLoading={isSubmitting}
diff --git a/src/lib/intercom/mobile-adapter.ts b/src/lib/intercom/mobile-adapter.ts
index 4fd66d403..01b5884b3 100644
--- a/src/lib/intercom/mobile-adapter.ts
+++ b/src/lib/intercom/mobile-adapter.ts
@@ -106,6 +106,24 @@ export class MobileIntercomAdapter {
           privateKey: privateKey ?? ''
         };
 
+      case WalletMessageType.RevealHotKeyRequest: {
+        const hotPrivateKey = await Actions.revealHotKey(req.accountPublicKey, req.password);
+        return {
+          type: WalletMessageType.RevealHotKeyResponse,
+          hotPrivateKey: hotPrivateKey ?? ''
+        };
+      }
+
+      case WalletMessageType.RevealGuardianKeysRequest: {
+        const keys = await Actions.revealGuardianKeys(req.accountPublicKey, req.password);
+        return {
+          type: WalletMessageType.RevealGuardianKeysResponse,
+          coldPrivateKey: keys?.coldPrivateKey ?? '',
+          coldPublicKey: keys?.coldPublicKey ?? '',
+          hotPublicKey: keys?.hotPublicKey
+        };
+      }
+
       case WalletMessageType.RemoveAccountRequest:
         await Actions.removeAccount(req.accountPublicKey, req.password);
         return {
diff --git a/src/lib/miden/back/actions.ts b/src/lib/miden/back/actions.ts
index 87b8edd9c..c4651772e 100644
--- a/src/lib/miden/back/actions.ts
+++ b/src/lib/miden/back/actions.ts
@@ -239,6 +239,14 @@ export function revealPrivateKey(accPubKeyCommitment: string, password?: string)
   return withInited(() => Vault.revealPrivateKey(accPubKeyCommitment, password));
 }
 
+export function revealHotKey(accountPublicKey: string, password?: string) {
+  return withInited(() => Vault.revealHotKey(accountPublicKey, password));
+}
+
+export function revealGuardianKeys(accountPublicKey: string, password?: string) {
+  return withInited(() => Vault.revealGuardianKeys(accountPublicKey, password));
+}
+
 export function revealPublicKey(_accPublicKey: string) {}
 
 export function removeAccount(_accPublicKey: string, _password: string) {}
diff --git a/src/lib/miden/back/main.ts b/src/lib/miden/back/main.ts
index 76418af36..6aa8ca63a 100644
--- a/src/lib/miden/back/main.ts
+++ b/src/lib/miden/back/main.ts
@@ -164,6 +164,22 @@ async function processRequest(req: WalletRequest, _port: Runtime.Port): Promise<
         type: WalletMessageType.RevealPrivateKeyResponse,
         privateKey: privateKey ?? ''
       };
+    case WalletMessageType.RevealHotKeyRequest: {
+      const hotPrivateKey = await Actions.revealHotKey(req.accountPublicKey, req.password);
+      return {
+        type: WalletMessageType.RevealHotKeyResponse,
+        hotPrivateKey: hotPrivateKey ?? ''
+      };
+    }
+    case WalletMessageType.RevealGuardianKeysRequest: {
+      const keys = await Actions.revealGuardianKeys(req.accountPublicKey, req.password);
+      return {
+        type: WalletMessageType.RevealGuardianKeysResponse,
+        coldPrivateKey: keys?.coldPrivateKey ?? '',
+        coldPublicKey: keys?.coldPublicKey ?? '',
+        hotPublicKey: keys?.hotPublicKey
+      };
+    }
     case WalletMessageType.RevealMnemonicRequest:
       const mnemonic = await Actions.revealMnemonic(req.password);
       return {
diff --git a/src/lib/miden/back/vault.test.ts b/src/lib/miden/back/vault.test.ts
index c05f3a380..198eb318a 100644
--- a/src/lib/miden/back/vault.test.ts
+++ b/src/lib/miden/back/vault.test.ts
@@ -3,6 +3,7 @@
 // the real `safe-storage` code runs but writes/reads go to `memoryStore`.
 // ---------------------------------------------------------------------------
 import * as Passworder from 'lib/miden/passworder';
+import { WalletAccount } from 'lib/shared/types';
 import { WalletType } from 'screens/onboarding/types';
 
 import { PublicError } from './defaults';
@@ -48,9 +49,7 @@ const mockRecoverGuardianAccountsBySeed = jest.fn(async (_deriveColdSeed: any, _
   {
     accountId: 'guardian-acc-imported',
     hdIndex: 0,
-    hotPublicKey: GUARDIAN_KEYS_FIXTURE.hotPublicKey,
     coldPublicKey: GUARDIAN_KEYS_FIXTURE.coldPublicKey,
-    hotCiphertext: GUARDIAN_KEYS_FIXTURE.hotCiphertext,
     coldSecretKeyHex: GUARDIAN_KEYS_FIXTURE.coldSecretKeyHex
   }
 ]);
@@ -87,6 +86,18 @@ jest.mock('../sdk/miden-client', () => ({
   runWhenClientIdle: () => {}
 }));
 
+// Mock the secure-hot-key facade so reveal/swap paths don't try to deserialize
+// real AuthSecretKey blobs out of fake ciphertexts. Tests set the resolved
+// value per case via the captured mock fns.
+const mockRevealHotKey = jest.fn(async (_ciphertext: string) => 'reveal-stub');
+const mockDeleteHotKey = jest.fn(async (_ciphertext: string) => {});
+jest.mock('lib/secure-hot-key', () => ({
+  revealHotKey: (...a: unknown[]) => mockRevealHotKey(...(a as [string])),
+  deleteHotKey: (...a: unknown[]) => mockDeleteHotKey(...(a as [string])),
+  generateHotKey: jest.fn(),
+  signHotDigest: jest.fn()
+}));
+
 // Unified handle used by tests — matches the old mockMidenClient API.
 const mockMidenClient = {
   createMidenWallet: mockCreateMidenWallet,
@@ -206,6 +217,9 @@ const keys = {
   accPubKey: (pk: string) => `${ck('accpubkey')}_${pk}`,
   accAuthSecretKey: (pk: string) => `${ck('accauthsecretkey')}_${pk}`,
   accAuthPubKey: (pk: string) => `${ck('accauthpubkey')}_${pk}`,
+  // NOTE: the vault's StorageEntity.AccColdSecretKey value is 'accouldsecretkey'
+  // (typo preserved for storage compatibility with existing wallets).
+  accColdSecretKey: (pk: string) => `${ck('accouldsecretkey')}_${pk}`,
   currentAccPubKey: ck('curraccpubkey'),
   accounts: ck('accounts'),
   ownMnemonic: ck('ownmnemonic'),
@@ -595,6 +609,142 @@ describe('Vault.revealPrivateKey', () => {
   });
 });
 
+describe('Vault.revealHotKey', () => {
+  it('unwraps the hot ciphertext via the secure-hot-key facade and returns plaintext hex', async () => {
+    const vault = await seedVault('pw');
+    const vaultKey = (vault as any).vaultKey as CryptoKey;
+    // Persist a Guardian WalletAccount with hotPublicKey + the wrapped ciphertext
+    // exactly the way Vault.spawn's createGuardianMidenWallet path would.
+    const account: WalletAccount = {
+      publicKey: 'guardian-acc-1',
+      name: 'Guardian 1',
+      isPublic: false,
+      type: WalletType.Guardian,
+      hdIndex: 0,
+      hotPublicKey: 'hot-pub-hex',
+      coldPublicKey: 'cold-pub-hex'
+    };
+    await encryptAndSaveMany(
+      [
+        [keys.accounts, [account]],
+        [keys.accAuthSecretKey('hot-pub-hex'), 'OPAQUE_CIPHERTEXT']
+      ],
+      vaultKey
+    );
+    mockRevealHotKey.mockResolvedValueOnce('deadbeef');
+
+    const secret = await Vault.revealHotKey('guardian-acc-1', 'pw');
+
+    expect(mockRevealHotKey).toHaveBeenCalledWith('OPAQUE_CIPHERTEXT');
+    expect(secret).toBe('deadbeef');
+  });
+
+  it('rejects when the account is not a Guardian account', async () => {
+    const vault = await seedVault('pw');
+    const vaultKey = (vault as any).vaultKey as CryptoKey;
+    const account: WalletAccount = {
+      publicKey: 'acc-1',
+      name: 'OnChain 1',
+      isPublic: true,
+      type: WalletType.OnChain,
+      hdIndex: 0
+    };
+    await encryptAndSaveMany([[keys.accounts, [account]]], vaultKey);
+
+    await expect(Vault.revealHotKey('acc-1', 'pw')).rejects.toThrow(PublicError);
+  });
+
+  it('rejects when the Guardian account has no activated hot key (post-recovery, pre-banner)', async () => {
+    const vault = await seedVault('pw');
+    const vaultKey = (vault as any).vaultKey as CryptoKey;
+    const account: WalletAccount = {
+      publicKey: 'guardian-recovered',
+      name: 'Guardian Recovered',
+      isPublic: false,
+      type: WalletType.Guardian,
+      hdIndex: 0,
+      coldPublicKey: 'cold-pub-hex',
+      requiresHotKeyRotation: true
+    };
+    await encryptAndSaveMany([[keys.accounts, [account]]], vaultKey);
+
+    await expect(Vault.revealHotKey('guardian-recovered', 'pw')).rejects.toThrow(PublicError);
+  });
+});
+
+describe('Vault.revealGuardianKeys', () => {
+  it('returns coldPrivateKey + coldPublicKey + hotPublicKey for an activated Guardian account', async () => {
+    const vault = await seedVault('pw');
+    const vaultKey = (vault as any).vaultKey as CryptoKey;
+    const account: WalletAccount = {
+      publicKey: 'guardian-acc-1',
+      name: 'Guardian 1',
+      isPublic: false,
+      type: WalletType.Guardian,
+      hdIndex: 0,
+      hotPublicKey: 'hot-pub-hex',
+      coldPublicKey: 'cold-pub-hex'
+    };
+    await encryptAndSaveMany(
+      [
+        [keys.accounts, [account]],
+        [keys.accColdSecretKey('cold-pub-hex'), 'COLD_SECRET_HEX']
+      ],
+      vaultKey
+    );
+
+    const result = await Vault.revealGuardianKeys('guardian-acc-1', 'pw');
+
+    expect(result).toEqual({
+      coldPrivateKey: 'COLD_SECRET_HEX',
+      coldPublicKey: 'cold-pub-hex',
+      hotPublicKey: 'hot-pub-hex'
+    });
+  });
+
+  it('returns hotPublicKey undefined for a recovered Guardian account whose hot key is not yet activated', async () => {
+    const vault = await seedVault('pw');
+    const vaultKey = (vault as any).vaultKey as CryptoKey;
+    const account: WalletAccount = {
+      publicKey: 'guardian-recovered',
+      name: 'Guardian Recovered',
+      isPublic: false,
+      type: WalletType.Guardian,
+      hdIndex: 0,
+      coldPublicKey: 'cold-pub-hex',
+      requiresHotKeyRotation: true
+    };
+    await encryptAndSaveMany(
+      [
+        [keys.accounts, [account]],
+        [keys.accColdSecretKey('cold-pub-hex'), 'COLD_SECRET_HEX']
+      ],
+      vaultKey
+    );
+
+    const result = await Vault.revealGuardianKeys('guardian-recovered', 'pw');
+
+    expect(result.coldPrivateKey).toBe('COLD_SECRET_HEX');
+    expect(result.coldPublicKey).toBe('cold-pub-hex');
+    expect(result.hotPublicKey).toBeUndefined();
+  });
+
+  it('rejects when called on a non-Guardian account', async () => {
+    const vault = await seedVault('pw');
+    const vaultKey = (vault as any).vaultKey as CryptoKey;
+    const account: WalletAccount = {
+      publicKey: 'acc-1',
+      name: 'OnChain 1',
+      isPublic: true,
+      type: WalletType.OnChain,
+      hdIndex: 0
+    };
+    await encryptAndSaveMany([[keys.accounts, [account]]], vaultKey);
+
+    await expect(Vault.revealGuardianKeys('acc-1', 'pw')).rejects.toThrow(PublicError);
+  });
+});
+
 describe('Vault.createHDAccount', () => {
   it('appends a new on-chain account with a derived default name', async () => {
     const vault = await seedVault('pw');
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index 8495721cb..8278ec66f 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -21,9 +21,9 @@ import {
   removeMany,
   savePlain
 } from 'lib/miden/back/safe-storage';
-import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
 import * as Passworder from 'lib/miden/passworder';
 import { clearStorage } from 'lib/miden/reset';
+import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
 import { isDesktop, isMobile } from 'lib/platform';
 import * as secureHotKey from 'lib/secure-hot-key';
 import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
@@ -115,11 +115,7 @@ async function persistGuardianKeys(vaultKey: CryptoKey, keys: CreatedGuardianKey
  * is generated at recovery time — the user activates one explicitly via the
  * post-recovery banner, which fires `initiateReplaceHotKeyTransaction`.
  */
-async function persistRecoveredGuardianColdKey(
-  vaultKey: CryptoKey,
-  coldPublicKey: string,
-  coldSecretKeyHex: string
-) {
+async function persistRecoveredGuardianColdKey(vaultKey: CryptoKey, coldPublicKey: string, coldSecretKeyHex: string) {
   await encryptAndSaveMany([[accColdSecretKeyStrgKey(coldPublicKey), coldSecretKeyHex]], vaultKey);
 }
 export class Vault {
@@ -403,7 +399,11 @@ export class Vault {
           await persistGuardianKeys(vaultKey, c.guardianKeys);
         }
         if (c.recoveredCold) {
-          await persistRecoveredGuardianColdKey(vaultKey, c.recoveredCold.coldPublicKey, c.recoveredCold.coldSecretKeyHex);
+          await persistRecoveredGuardianColdKey(
+            vaultKey,
+            c.recoveredCold.coldPublicKey,
+            c.recoveredCold.coldSecretKeyHex
+          );
         }
       }
       await savePlain(currentAccPubKeyStrgKey, initialAccounts[0]!.publicKey);
@@ -786,9 +786,7 @@ export class Vault {
       }
 
       const newAllAccounts = allAccounts.map(acc =>
-        acc.publicKey === accountPublicKey
-          ? { ...acc, hotPublicKey: newHotPubKey, requiresHotKeyRotation: false }
-          : acc
+        acc.publicKey === accountPublicKey ? { ...acc, hotPublicKey: newHotPubKey, requiresHotKeyRotation: false } : acc
       );
       await encryptAndSaveMany([[accountsStrgKey, newAllAccounts]], this.vaultKey);
 
@@ -956,6 +954,74 @@ export class Vault {
     });
   }
 
+  /**
+   * Reveal the raw secp256k1 hot secret for a 3-key Guardian account. Unwraps
+   * the platform-specific ciphertext via the secure-hot-key facade — on mobile
+   * this triggers a biometric prompt (the password arg authenticates the vault
+   * BEFORE the SE/StrongBox unwrap fires). Returns 64-char hex.
+   *
+   * Looks up the account by bech32 publicKey (the WalletAccount.publicKey
+   * field). Throws on non-Guardian accounts and on Guardian accounts whose
+   * `hotPublicKey` is not yet set (post-recovery, pre-banner-activation).
+   */
+  static async revealHotKey(accountPublicKey: string, password?: string): Promise<string> {
+    const vaultKey = password ? await Vault.unlockWithPassword(password) : await Vault.getHardwareVaultKey();
+    return withError('Failed to reveal hot key', async () => {
+      const allAccounts = await fetchAndDecryptOneWithLegacyFallBack<WalletAccount[]>(accountsStrgKey, vaultKey);
+      const account = allAccounts?.find(a => a.publicKey === accountPublicKey);
+      if (!account) {
+        throw new PublicError('Account not found');
+      }
+      if (account.type !== WalletType.Guardian || !account.hotPublicKey) {
+        throw new PublicError('Hot key is only available for activated Guardian accounts');
+      }
+      const ciphertext = await fetchAndDecryptOneWithLegacyFallBack<string>(
+        accAuthSecretKeyStrgKey(account.hotPublicKey),
+        vaultKey
+      );
+      if (!ciphertext) {
+        throw new PublicError('Hot key ciphertext not found');
+      }
+      return await secureHotKey.revealHotKey(ciphertext);
+    });
+  }
+
+  /**
+   * Reveal the cold private key + both public keys for a 3-key Guardian
+   * account. Cold is the recovery material (HD-derived from the mnemonic and
+   * mirrored under `accColdSecretKey<coldPublicKey>` by `persistGuardianKeys`
+   * / `persistRecoveredGuardianColdKey`). The hot private is NOT included —
+   * use `revealHotKey` for that.
+   */
+  static async revealGuardianKeys(
+    accountPublicKey: string,
+    password?: string
+  ): Promise<{ coldPrivateKey: string; coldPublicKey: string; hotPublicKey?: string }> {
+    const vaultKey = password ? await Vault.unlockWithPassword(password) : await Vault.getHardwareVaultKey();
+    return withError('Failed to reveal guardian keys', async () => {
+      const allAccounts = await fetchAndDecryptOneWithLegacyFallBack<WalletAccount[]>(accountsStrgKey, vaultKey);
+      const account = allAccounts?.find(a => a.publicKey === accountPublicKey);
+      if (!account) {
+        throw new PublicError('Account not found');
+      }
+      if (account.type !== WalletType.Guardian || !account.coldPublicKey) {
+        throw new PublicError('Not a Guardian account');
+      }
+      const coldPrivateKey = await fetchAndDecryptOneWithLegacyFallBack<string>(
+        accColdSecretKeyStrgKey(account.coldPublicKey),
+        vaultKey
+      );
+      if (!coldPrivateKey) {
+        throw new PublicError('Cold key not found');
+      }
+      return {
+        coldPrivateKey,
+        coldPublicKey: account.coldPublicKey,
+        hotPublicKey: account.hotPublicKey
+      };
+    });
+  }
+
   async getCurrentAccount() {
     const currAccountPubkey = await getPlain<string>(currentAccPubKeyStrgKey);
     const allAccounts = await this.fetchAccounts();
diff --git a/src/lib/miden/front/client.ts b/src/lib/miden/front/client.ts
index 0bbba3cdf..f18dd20d5 100644
--- a/src/lib/miden/front/client.ts
+++ b/src/lib/miden/front/client.ts
@@ -48,6 +48,8 @@ export const [MidenContextProvider, useMidenContext] = constate(() => {
   const storeEditAccountName = useWalletStore(s => s.editAccountName);
   const storeRevealMnemonic = useWalletStore(s => s.revealMnemonic);
   const storeRevealPrivateKey = useWalletStore(s => s.revealPrivateKey);
+  const storeRevealHotKey = useWalletStore(s => s.revealHotKey);
+  const storeRevealGuardianKeys = useWalletStore(s => s.revealGuardianKeys);
   const storeImportAccount = useWalletStore(s => s.importAccount);
   const storeUpdateSettings = useWalletStore(s => s.updateSettings);
   const storeSignData = useWalletStore(s => s.signData);
@@ -146,6 +148,20 @@ export const [MidenContextProvider, useMidenContext] = constate(() => {
     [storeRevealPrivateKey]
   );
 
+  const revealHotKey = useCallback(
+    async (accountPublicKey: string, password?: string) => {
+      return storeRevealHotKey(accountPublicKey, password);
+    },
+    [storeRevealHotKey]
+  );
+
+  const revealGuardianKeys = useCallback(
+    async (accountPublicKey: string, password?: string) => {
+      return storeRevealGuardianKeys(accountPublicKey, password);
+    },
+    [storeRevealGuardianKeys]
+  );
+
   const importAccount = useCallback(
     async (privateKey: string, name?: string) => {
       return storeImportAccount(privateKey, name);
@@ -304,6 +320,8 @@ export const [MidenContextProvider, useMidenContext] = constate(() => {
     updateCurrentAccount,
     revealViewKey,
     revealPrivateKey,
+    revealHotKey,
+    revealGuardianKeys,
     revealMnemonic,
     removeAccount,
     editAccountName,
diff --git a/src/lib/miden/front/guardian-sync.test.ts b/src/lib/miden/front/guardian-sync.test.ts
index 353fd143f..ce7cec42c 100644
--- a/src/lib/miden/front/guardian-sync.test.ts
+++ b/src/lib/miden/front/guardian-sync.test.ts
@@ -10,7 +10,7 @@ import { WalletType } from 'screens/onboarding/types';
 import { syncGuardianAccounts, zustandProvider } from './guardian-sync';
 
 const storeState: {
-  accounts: Array<{ publicKey: string; type: WalletType }>;
+  accounts: Array<{ publicKey: string; type: WalletType; requiresHotKeyRotation?: boolean }>;
   getPublicKeyForCommitment: jest.Mock;
   signWord: jest.Mock;
 } = {
diff --git a/src/lib/secure-hot-key/hotKeyPlugin.ts b/src/lib/secure-hot-key/hotKeyPlugin.ts
index 7f16488ac..0bf9575da 100644
--- a/src/lib/secure-hot-key/hotKeyPlugin.ts
+++ b/src/lib/secure-hot-key/hotKeyPlugin.ts
@@ -17,6 +17,11 @@ export interface HotKeyPlugin {
   signWithHotKey(options: { ciphertext: string; digestHex: string }): Promise<{ signatureHex: string }>;
 
   deleteHotKey(options: { ciphertext: string }): Promise<void>;
+
+  // Unwraps the SE/StrongBox-wrapped secret and returns the raw 32-byte
+  // secp256k1 secret hex. Triggers a biometric prompt on both platforms,
+  // identical UX to `signWithHotKey`. Used by Settings → Reveal Hot Key.
+  revealHotKey(options: { ciphertext: string }): Promise<{ secretKeyHex: string }>;
 }
 
 export const HotKey = registerPlugin<HotKeyPlugin>('HotKey');
diff --git a/src/lib/secure-hot-key/index.ts b/src/lib/secure-hot-key/index.ts
index 5cd276c5b..7c111d797 100644
--- a/src/lib/secure-hot-key/index.ts
+++ b/src/lib/secure-hot-key/index.ts
@@ -34,3 +34,14 @@ export async function signHotDigest(ciphertext: string, wordHex: string): Promis
 export async function deleteHotKey(ciphertext: string): Promise<void> {
   return impl().deleteHotKey(ciphertext);
 }
+
+/**
+ * Unwrap the hot ciphertext and return the raw 32-byte secp256k1 secret hex.
+ * On mobile this fires a biometric prompt (same SE/StrongBox unwrap path as
+ * `signHotDigest`, minus the actual signing step). On extension/desktop the
+ * JS fallback decodes the serialized `AuthSecretKey` and strips the 1-byte
+ * scheme prefix so the format matches the native return.
+ */
+export async function revealHotKey(ciphertext: string): Promise<string> {
+  return impl().revealHotKey(ciphertext);
+}
diff --git a/src/lib/secure-hot-key/jsFallback.ts b/src/lib/secure-hot-key/jsFallback.ts
index d8a2d2f2a..66aa91eee 100644
--- a/src/lib/secure-hot-key/jsFallback.ts
+++ b/src/lib/secure-hot-key/jsFallback.ts
@@ -44,3 +44,14 @@ export async function deleteHotKey(_ciphertext: string): Promise<void> {
   // No-op in the JS fallback: the vault-wrapped blob is removed by the caller
   // when it deletes the account record. There's no native handle to release.
 }
+
+/**
+ * Decode the serialized AuthSecretKey ciphertext and return the raw 32-byte
+ * secp256k1 secret hex (drops the 1-byte scheme prefix). Matches the native
+ * plugins' return shape so the facade hands callers a platform-agnostic hex
+ * string.
+ */
+export async function revealHotKey(ciphertext: string): Promise<string> {
+  const sk = AuthSecretKey.deserialize(new Uint8Array(Buffer.from(ciphertext, 'hex')));
+  return Buffer.from(sk.serialize().slice(1)).toString('hex');
+}
diff --git a/src/lib/secure-hot-key/nativePlugin.test.ts b/src/lib/secure-hot-key/nativePlugin.test.ts
index 1116041f4..ce0383cc0 100644
--- a/src/lib/secure-hot-key/nativePlugin.test.ts
+++ b/src/lib/secure-hot-key/nativePlugin.test.ts
@@ -16,11 +16,13 @@ import * as nativePlugin from './nativePlugin';
 const mockGenerateHotKey = jest.fn();
 const mockSignWithHotKey = jest.fn();
 const mockDeleteHotKey = jest.fn();
+const mockRevealHotKey = jest.fn();
 jest.mock('./hotKeyPlugin', () => ({
   HotKey: {
     generateHotKey: (...a: unknown[]) => mockGenerateHotKey(...a),
     signWithHotKey: (...a: unknown[]) => mockSignWithHotKey(...a),
-    deleteHotKey: (...a: unknown[]) => mockDeleteHotKey(...a)
+    deleteHotKey: (...a: unknown[]) => mockDeleteHotKey(...a),
+    revealHotKey: (...a: unknown[]) => mockRevealHotKey(...a)
   }
 }));
 
@@ -102,6 +104,15 @@ const sharedForwardingSpec = (label: 'iOS' | 'Android', setPlatform: () => void)
 
       expect(mockDeleteHotKey).toHaveBeenCalledWith({ ciphertext: 'tag:payload' });
     });
+
+    it('revealHotKey forwards ciphertext and returns the native secretKeyHex unchanged', async () => {
+      mockRevealHotKey.mockResolvedValue({ secretKeyHex: 'aa'.repeat(32) });
+
+      const secret = await nativePlugin.revealHotKey('tag:payload');
+
+      expect(mockRevealHotKey).toHaveBeenCalledWith({ ciphertext: 'tag:payload' });
+      expect(secret).toBe('aa'.repeat(32));
+    });
   });
 };
 
@@ -122,11 +133,13 @@ describe('secure-hot-key nativePlugin (non-mobile guard)', () => {
   it.each([
     ['generateHotKey', () => nativePlugin.generateHotKey()],
     ['signHotDigest', () => nativePlugin.signHotDigest('tag:payload', '0x00')],
-    ['deleteHotKey', () => nativePlugin.deleteHotKey('tag:payload')]
+    ['deleteHotKey', () => nativePlugin.deleteHotKey('tag:payload')],
+    ['revealHotKey', () => nativePlugin.revealHotKey('tag:payload')]
   ])('%s rejects when invoked outside iOS/Android', async (_name, op) => {
     await expect(op()).rejects.toThrow('outside iOS/Android');
     expect(mockGenerateHotKey).not.toHaveBeenCalled();
     expect(mockSignWithHotKey).not.toHaveBeenCalled();
     expect(mockDeleteHotKey).not.toHaveBeenCalled();
+    expect(mockRevealHotKey).not.toHaveBeenCalled();
   });
 });
diff --git a/src/lib/secure-hot-key/nativePlugin.ts b/src/lib/secure-hot-key/nativePlugin.ts
index ff7e849dc..8436155d1 100644
--- a/src/lib/secure-hot-key/nativePlugin.ts
+++ b/src/lib/secure-hot-key/nativePlugin.ts
@@ -49,6 +49,13 @@ export async function deleteHotKey(ciphertext: string): Promise<void> {
   await HotKey.deleteHotKey({ ciphertext });
 }
 
+export async function revealHotKey(ciphertext: string): Promise<string> {
+  assertMobile();
+
+  const { secretKeyHex } = await HotKey.revealHotKey({ ciphertext });
+  return secretKeyHex;
+}
+
 async function commitmentFromPublicKeyHex(publicKeyHex: string): Promise<string> {
   const { PublicKey } = await import('@miden-sdk/miden-sdk/lazy');
   const raw = Buffer.from(publicKeyHex, 'hex');
diff --git a/src/lib/shared/types.ts b/src/lib/shared/types.ts
index a2c9a5412..2ad20ae15 100644
--- a/src/lib/shared/types.ts
+++ b/src/lib/shared/types.ts
@@ -38,6 +38,10 @@ export enum WalletMessageType {
   RevealViewKeyResponse = 'REVEAL_VIEW_KEY_RESPONSE',
   RevealPrivateKeyRequest = 'REVEAL_PRIVATE_KEY_REQUEST',
   RevealPrivateKeyResponse = 'REVEAL_PRIVATE_KEY_RESPONSE',
+  RevealHotKeyRequest = 'REVEAL_HOT_KEY_REQUEST',
+  RevealHotKeyResponse = 'REVEAL_HOT_KEY_RESPONSE',
+  RevealGuardianKeysRequest = 'REVEAL_GUARDIAN_KEYS_REQUEST',
+  RevealGuardianKeysResponse = 'REVEAL_GUARDIAN_KEYS_RESPONSE',
   RevealMnemonicRequest = 'REVEAL_MNEMONIC_REQUEST',
   RevealMnemonicResponse = 'REVEAL_MNEMONIC_RESPONSE',
   RemoveAccountRequest = 'REMOVE_ACCOUNT_REQUEST',
@@ -381,6 +385,30 @@ export interface RevealPrivateKeyResponse extends WalletMessageBase {
   privateKey: string;
 }
 
+export interface RevealHotKeyRequest extends WalletMessageBase {
+  type: WalletMessageType.RevealHotKeyRequest;
+  accountPublicKey: string;
+  password?: string;
+}
+
+export interface RevealHotKeyResponse extends WalletMessageBase {
+  type: WalletMessageType.RevealHotKeyResponse;
+  hotPrivateKey: string;
+}
+
+export interface RevealGuardianKeysRequest extends WalletMessageBase {
+  type: WalletMessageType.RevealGuardianKeysRequest;
+  accountPublicKey: string;
+  password?: string;
+}
+
+export interface RevealGuardianKeysResponse extends WalletMessageBase {
+  type: WalletMessageType.RevealGuardianKeysResponse;
+  coldPrivateKey: string;
+  coldPublicKey: string;
+  hotPublicKey?: string;
+}
+
 export interface RevealMnemonicRequest extends WalletMessageBase {
   type: WalletMessageType.RevealMnemonicRequest;
   password?: string;
@@ -717,6 +745,8 @@ export type WalletRequest =
   | RevealPublicKeyRequest
   | RevealViewKeyRequest
   | RevealPrivateKeyRequest
+  | RevealHotKeyRequest
+  | RevealGuardianKeysRequest
   | RevealMnemonicRequest
   | RemoveAccountRequest
   | EditAccountRequest
@@ -769,6 +799,8 @@ export type WalletResponse =
   | RevealPublicKeyResponse
   | RevealViewKeyResponse
   | RevealPrivateKeyResponse
+  | RevealHotKeyResponse
+  | RevealGuardianKeysResponse
   | RevealMnemonicResponse
   | RemoveAccountResponse
   | EditAccountResponse
diff --git a/src/lib/store/index.ts b/src/lib/store/index.ts
index 10c5e04d5..027d1c7e3 100644
--- a/src/lib/store/index.ts
+++ b/src/lib/store/index.ts
@@ -241,6 +241,30 @@ export const useWalletStore = create<WalletStore>()(
       return res.privateKey;
     },
 
+    revealHotKey: async (accountPublicKey, password) => {
+      const res = await request({
+        type: WalletMessageType.RevealHotKeyRequest,
+        accountPublicKey,
+        password
+      });
+      assertResponse(res.type === WalletMessageType.RevealHotKeyResponse);
+      return res.hotPrivateKey;
+    },
+
+    revealGuardianKeys: async (accountPublicKey, password) => {
+      const res = await request({
+        type: WalletMessageType.RevealGuardianKeysRequest,
+        accountPublicKey,
+        password
+      });
+      assertResponse(res.type === WalletMessageType.RevealGuardianKeysResponse);
+      return {
+        coldPrivateKey: res.coldPrivateKey,
+        coldPublicKey: res.coldPublicKey,
+        hotPublicKey: res.hotPublicKey
+      };
+    },
+
     importAccount: async (privateKey, name) => {
       const res = await request({
         type: WalletMessageType.ImportAccountRequest,
diff --git a/src/lib/store/types.ts b/src/lib/store/types.ts
index 06d398242..68d20992e 100644
--- a/src/lib/store/types.ts
+++ b/src/lib/store/types.ts
@@ -136,6 +136,11 @@ export interface WalletActions {
   editAccountName: (accountPublicKey: string, name: string) => Promise<void>;
   revealMnemonic: (password?: string) => Promise<string>;
   revealPrivateKey: (accountPublicKey: string, password?: string) => Promise<string>;
+  revealHotKey: (accountPublicKey: string, password?: string) => Promise<string>;
+  revealGuardianKeys: (
+    accountPublicKey: string,
+    password?: string
+  ) => Promise<{ coldPrivateKey: string; coldPublicKey: string; hotPublicKey?: string }>;
   importAccount: (privateKey: string, name?: string) => Promise<string>;
 
   // Settings actions

From 2129763cb0232f8ae0577d62a01ab37b01394115 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Tue, 12 May 2026 17:07:15 +0530
Subject: [PATCH 50/71] fix(guardian): pass 'ecdsa' scheme to
 nextGuardian.getPubkey in finalizeGuardianSwitch

---
 src/lib/miden/guardian/index.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/miden/guardian/index.ts b/src/lib/miden/guardian/index.ts
index 04b64d843..b6f2e665f 100644
--- a/src/lib/miden/guardian/index.ts
+++ b/src/lib/miden/guardian/index.ts
@@ -288,7 +288,7 @@ export class MultisigService {
       });
 
       const nextGuardian = new GuardianHttpClient(newGuardianEndpoint);
-      const { commitment } = await nextGuardian.getPubkey();
+      const { commitment } = await nextGuardian.getPubkey('ecdsa');
 
       this.multisig.setGuardianClient(nextGuardian);
       this.multisig.guardianPublicKey = commitment;

From 44a369db8e6c5895153cde44f0abd227ceb2489c Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Fri, 15 May 2026 00:44:54 +0530
Subject: [PATCH 51/71] feat: bump up package

---
 package.json |  4 ++--
 yarn.lock    | 22 +++++++++++-----------
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/package.json b/package.json
index 355241f4f..32288f47e 100644
--- a/package.json
+++ b/package.json
@@ -122,8 +122,8 @@
     "@miden/dapp-browser": "link:./packages/dapp-browser",
     "@newhighsco/storybook-addon-svgr": "^2.0.7",
     "@noble/hashes": "^1.4.0",
-    "@openzeppelin/guardian-client": "^0.14.5",
-    "@openzeppelin/miden-multisig-client": "^0.14.5",
+    "@openzeppelin/guardian-client": "0.14.6",
+    "@openzeppelin/miden-multisig-client": "0.14.6",
     "@peculiar/webcrypto": "1.1.6",
     "@radix-ui/react-slot": "^1.2.3",
     "@segment/analytics-node": "^2.3.0",
diff --git a/yarn.lock b/yarn.lock
index fb7b5aede..038fbc0ea 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2260,7 +2260,7 @@
   dependencies:
     "@types/mdx" "^2.0.0"
 
-"@miden-sdk/miden-sdk@0.14.3", "@miden-sdk/miden-sdk@0.14.4":
+"@miden-sdk/miden-sdk@0.14.4", "@miden-sdk/miden-sdk@0.14.5":
   version "0.14.4"
   resolved "https://registry.yarnpkg.com/@miden-sdk/miden-sdk/-/miden-sdk-0.14.4.tgz#be7496e6d2622b7f478768972f9896536db154cb"
   integrity sha512-Qt+3NfGRCyHP5zcD+m9bBqQz01zuAwZRUBkls09mi+tOPVT17sFWKLglQEtKdr3gPAFHLwz2Ja4Hp4adUKfLuA==
@@ -2361,20 +2361,20 @@
   resolved "https://registry.yarnpkg.com/@nolyfill/is-core-module/-/is-core-module-1.0.39.tgz#3dc35ba0f1e66b403c00b39344f870298ebb1c8e"
   integrity sha512-nn5ozdjYQpUCZlWGuxcJY/KpxkWQs4DcbMCmKojjyrYDEAGy4Ce19NN4v5MduafTwJlbKc99UA8YhSVqq9yPZA==
 
-"@openzeppelin/guardian-client@^0.14.5":
-  version "0.14.5"
-  resolved "https://registry.yarnpkg.com/@openzeppelin/guardian-client/-/guardian-client-0.14.5.tgz#931e4e5e1fd7f23e1900b8af5a4d18b061679b60"
-  integrity sha512-onp82BBEH4Z/VeNOMn/uZXUMb5SU+AanTld2sv/2jQ9gfnlnW7Q2LlNg7E0jt5oinoZ0OcNJ8luNx8++O+6y0Q==
+"@openzeppelin/guardian-client@0.14.6", "@openzeppelin/guardian-client@^0.14.6":
+  version "0.14.6"
+  resolved "https://registry.yarnpkg.com/@openzeppelin/guardian-client/-/guardian-client-0.14.6.tgz#7e7c25b0a1270aa304d40d4b4cf025603ef128b6"
+  integrity sha512-+obykBGEzTfdjODfdhyrdrlFL8A5SQ6rfeuUBGz0RJE2BAGN2jn6IcrJzKddUECW/3hrLukLCAuhqdzdW/KaPg==
 
-"@openzeppelin/miden-multisig-client@^0.14.5":
-  version "0.14.5"
-  resolved "https://registry.yarnpkg.com/@openzeppelin/miden-multisig-client/-/miden-multisig-client-0.14.5.tgz#0a4dddd9400d525437eada122bbd97df595e7767"
-  integrity sha512-3SCO1WU/PDgxM5zdBaoVpMH4U3VzAP69bl2korYBha2L9K+DKohhloR5qRAbUSyeCGlpB8k7lO+Fv5CuoXTUng==
+"@openzeppelin/miden-multisig-client@0.14.6":
+  version "0.14.6"
+  resolved "https://registry.yarnpkg.com/@openzeppelin/miden-multisig-client/-/miden-multisig-client-0.14.6.tgz#efddbea4b398ab7f44546dab86afeb3b5e582748"
+  integrity sha512-Ow0gwE2qUN3DDr1qnjRF+DV4dlBm+dqM+X/8hko9vdpKyP8ID5r7RN7Ui6gALFxiG7SlBZjoVD66LYFPHyyxwQ==
   dependencies:
-    "@miden-sdk/miden-sdk" "0.14.3"
+    "@miden-sdk/miden-sdk" "0.14.5"
     "@noble/curves" "^1.9.7"
     "@noble/hashes" "^2.0.1"
-    "@openzeppelin/guardian-client" "^0.14.5"
+    "@openzeppelin/guardian-client" "^0.14.6"
 
 "@oxc-project/types@=0.124.0":
   version "0.124.0"

From 57cd91e2547836f716a012c0582c2b29d44ae352 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Wed, 17 Jun 2026 22:21:57 +0530
Subject: [PATCH 52/71] chore: bump guardian packages to the latest

---
 package.json                      |  4 ++--
 src/lib/miden/guardian/account.ts |  5 ++---
 src/lib/miden/guardian/index.ts   |  2 +-
 yarn.lock                         | 22 +++++++++++-----------
 4 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/package.json b/package.json
index e3aadcab2..103a78ff0 100644
--- a/package.json
+++ b/package.json
@@ -130,8 +130,8 @@
     "@miden/native-prover": "link:./packages/native-prover",
     "@newhighsco/storybook-addon-svgr": "^2.0.7",
     "@noble/hashes": "^1.4.0",
-    "@openzeppelin/guardian-client": "^0.14.3",
-    "@openzeppelin/miden-multisig-client": "^0.14.3",
+    "@openzeppelin/guardian-client": "^0.14.9",
+    "@openzeppelin/miden-multisig-client": "^0.14.9",
     "@peculiar/webcrypto": "1.1.6",
     "@radix-ui/react-slot": "^1.2.3",
     "@segment/analytics-node": "^2.3.0",
diff --git a/src/lib/miden/guardian/account.ts b/src/lib/miden/guardian/account.ts
index 389bbdbc1..e9f896311 100644
--- a/src/lib/miden/guardian/account.ts
+++ b/src/lib/miden/guardian/account.ts
@@ -67,7 +67,7 @@ export async function createGuardianAccount(
 
   try {
     // Generate the signer secret key from seed
-    const sk = AuthSecretKey.rpoFalconWithRNG(seed);
+    const sk = AuthSecretKey.ecdsaWithRNG(seed);
     const signerCommitment = sk.publicKey().toCommitment();
 
     // Get Guardian endpoint and initialize client
@@ -75,9 +75,8 @@ export async function createGuardianAccount(
       guardianEndpointOverride ??
       (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) ??
       DEFAULT_GUARDIAN_ENDPOINT;
-    console.log('Using Guardian endpoint:', guardianEndpoint);
     const client = new MultisigClient(webClient, { guardianEndpoint });
-    const { commitment, pubkey } = await client.guardianClient.getPubkey();
+    const { commitment, pubkey } = await client.guardianClient.getPubkey('ecdsa');
     // Create the multisig account using the package utility
     const multisig = await client.create(
       {
diff --git a/src/lib/miden/guardian/index.ts b/src/lib/miden/guardian/index.ts
index bc56b63ec..2e23d4a03 100644
--- a/src/lib/miden/guardian/index.ts
+++ b/src/lib/miden/guardian/index.ts
@@ -225,7 +225,7 @@ export class MultisigService {
       });
 
       const nextGuardian = new GuardianHttpClient(newGuardianEndpoint);
-      const { commitment } = await nextGuardian.getPubkey();
+      const { commitment } = await nextGuardian.getPubkey('ecdsa');
 
       this.multisig.setGuardianClient(nextGuardian);
       this.multisig.guardianPublicKey = commitment;
diff --git a/yarn.lock b/yarn.lock
index 3843efe5b..36ab689f3 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2236,7 +2236,7 @@
   dependencies:
     "@types/mdx" "^2.0.0"
 
-"@miden-sdk/miden-sdk@0.14.3", "@miden-sdk/miden-sdk@0.15.0-alpha.7":
+"@miden-sdk/miden-sdk@0.14.5", "@miden-sdk/miden-sdk@0.15.0-alpha.7":
   version "0.15.0-alpha.7"
   resolved "https://registry.yarnpkg.com/@miden-sdk/miden-sdk/-/miden-sdk-0.15.0-alpha.7.tgz#13e77c072cf900ed45bd619c04bc74aa1a563534"
   integrity sha512-zqYAmjRbZHDOffV2M57suP6zFdtSnGLY9ACXTq9h/R29GHxqmUj5hE/kUoVUek1GN7KPQeC0hENmFiCwvuw0wg==
@@ -2350,20 +2350,20 @@
   resolved "https://registry.yarnpkg.com/@nolyfill/is-core-module/-/is-core-module-1.0.39.tgz#3dc35ba0f1e66b403c00b39344f870298ebb1c8e"
   integrity sha512-nn5ozdjYQpUCZlWGuxcJY/KpxkWQs4DcbMCmKojjyrYDEAGy4Ce19NN4v5MduafTwJlbKc99UA8YhSVqq9yPZA==
 
-"@openzeppelin/guardian-client@^0.14.3":
-  version "0.14.3"
-  resolved "https://registry.yarnpkg.com/@openzeppelin/guardian-client/-/guardian-client-0.14.3.tgz#7aa4602ac99aab174e4764dafa1dfd600522d9c5"
-  integrity sha512-t1HW2LxB0YWB4JZB0L1O3Ue3+/VFipmtumHbgnQeWloflym3bg6dWV75zZkcPyLACURJliT3LIhdg/3w0tcA5Q==
+"@openzeppelin/guardian-client@^0.14.9":
+  version "0.14.9"
+  resolved "https://registry.yarnpkg.com/@openzeppelin/guardian-client/-/guardian-client-0.14.9.tgz#2ce426c2e0ad2215c5b9b8bd37b99c0e4812ec55"
+  integrity sha512-6uSxWNG+eRjYrbWgu2myCpQXDkZufss2Ppyxzu0pCBax451k7GdRaFXu5IFBWNNtGxITPLA5l7yBJyglWpmNhQ==
 
-"@openzeppelin/miden-multisig-client@^0.14.3":
-  version "0.14.3"
-  resolved "https://registry.yarnpkg.com/@openzeppelin/miden-multisig-client/-/miden-multisig-client-0.14.3.tgz#f738f4ec80362a66fbd3e56cb6432d463852c682"
-  integrity sha512-kVBpEAU0cuAshVOGQ3RD+cFODxVr7dnipi1n7x2FCFmGTWktT8di441ZmPd3/qid1GEoG0Y8UaqrX+6v2YxCDw==
+"@openzeppelin/miden-multisig-client@^0.14.9":
+  version "0.14.9"
+  resolved "https://registry.yarnpkg.com/@openzeppelin/miden-multisig-client/-/miden-multisig-client-0.14.9.tgz#b2b04f38ef8ca2365bb5b3ff5b50d64d74d62001"
+  integrity sha512-WA7pbvpeRf8ykxnWQcpLkOXIrmGSbUbOli+/S4DmNtG/Tu/O3XepMXbErbbddf9Pxtnhf1SdXaBW1k6yFLb14g==
   dependencies:
-    "@miden-sdk/miden-sdk" "0.14.3"
+    "@miden-sdk/miden-sdk" "0.14.5"
     "@noble/curves" "^1.9.7"
     "@noble/hashes" "^2.0.1"
-    "@openzeppelin/guardian-client" "^0.14.3"
+    "@openzeppelin/guardian-client" "^0.14.9"
 
 "@oxc-project/types@=0.129.0":
   version "0.129.0"

From bd392b6f66584a31b5402582a5f2c8d955d76363 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Sat, 6 Jun 2026 15:22:49 +0530
Subject: [PATCH 53/71] fix: guardian sync memory leak from leaked per-init
 web-client workers

(cherry picked from commit 6ca538abbfc14788001459c628e0c17f1bb615d5)
---
 CHANGELOG.md                                 |  1 +
 src/lib/miden/front/guardian-manager.test.ts | 22 ++++++
 src/lib/miden/front/guardian-manager.ts      | 70 ++++++++++++++------
 src/lib/miden/guardian/index.ts              |  8 ++-
 4 files changed, 77 insertions(+), 24 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a50029ddf..e8364a978 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@
 
 ### Fixes
 
+* [FIX][all] Guardian sync no longer leaks per-init web-client workers. `MultisigService.init` now reuses the shared `getMidenClient()` singleton instead of a throwaway `MidenClientInterface.create({})` client, and `getOrCreateMultisigService` coalesces concurrent init calls with an in-flight promise map so 3s sync ticks cannot stampede slow or failed initialization.
 * [FIX][mobile] Wallet creation no longer panics the WASM client on iOS/Android (`RefCell already borrowed` → poisoned instance → claims and balances silently dead). On mobile the front-end and wallet back-end share one direct-path (`useWorker: false`) SDK client, and the front-end's balance polling overlapped the wallet-creation syncs; `@miden-sdk/miden-sdk@0.15.0-alpha.7` restores the SDK-side call serialization that makes those overlaps queue instead of panic ([web-sdk#184](https://github.com/0xMiden/web-sdk/pull/184)).
 * [FIX][extension] The offscreen prover document now constructs the SDK's raw wasm-bindgen `WebClient` (prover-only — `createClient()` is never called) instead of the worker-shim wrapper. The wrapper forwarded every prove to its own method worker — a WASM instance whose rayon pool the offscreen document never initialized — and its implicit worker INIT performed a network round-trip against the SDK's default RPC endpoint, making local proving silently dependent on that endpoint being reachable and version-compatible. Proves now run on the offscreen document's own thread pool with no implicit network access (so local proving works offline), completing in ~5–6 s on a 10-core machine. Requires `@miden-sdk/miden-sdk` ≥ `0.15.0-alpha.6` (the explicit-prover fix in [web-sdk#182](https://github.com/0xMiden/web-sdk/pull/182)). Root-cause analysis in [web-sdk#180](https://github.com/0xMiden/web-sdk/issues/180#issuecomment-4686218893).
 
diff --git a/src/lib/miden/front/guardian-manager.test.ts b/src/lib/miden/front/guardian-manager.test.ts
index f8a9448d5..b88e9fb2e 100644
--- a/src/lib/miden/front/guardian-manager.test.ts
+++ b/src/lib/miden/front/guardian-manager.test.ts
@@ -120,6 +120,28 @@ describe('guardian-manager', () => {
       expect(mockMultisigServiceInit).toHaveBeenCalledTimes(2);
     });
 
+    it('coalesces concurrent service initialization for the same account', async () => {
+      const service = { guardianEndpoint: 'https://default.guardian.test', tag: 'shared' };
+      let resolveInit!: (value: unknown) => void;
+      mockMultisigServiceInit.mockReturnValueOnce(
+        new Promise(resolve => {
+          resolveInit = resolve;
+        })
+      );
+      const provider = makeProvider([guardianAccount]);
+
+      const first = getOrCreateMultisigService(GUARDIAN_PK, provider);
+      const second = getOrCreateMultisigService(GUARDIAN_PK, provider);
+
+      await new Promise(resolve => setTimeout(resolve, 0));
+
+      expect(provider.getAccounts).toHaveBeenCalledTimes(1);
+      expect(mockMultisigServiceInit).toHaveBeenCalledTimes(1);
+
+      resolveInit(service);
+      await expect(Promise.all([first, second])).resolves.toEqual([service, service]);
+    });
+
     it('throws when the account is not of type Guardian', async () => {
       const provider = makeProvider([onChainAccount]);
 
diff --git a/src/lib/miden/front/guardian-manager.ts b/src/lib/miden/front/guardian-manager.ts
index 76db57c05..f0b1013d6 100644
--- a/src/lib/miden/front/guardian-manager.ts
+++ b/src/lib/miden/front/guardian-manager.ts
@@ -8,9 +8,14 @@ import { fetchFromStorage } from './storage';
 import { getSignerDetailsFromAccount } from '../guardian/account';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 
-// Cache MultisigService instances to avoid re-initialization on every sync cycle
+// Cache MultisigService instances to avoid re-initialization on every sync cycle.
 const guardianServiceCache = new Map<string, MultisigService>();
 
+// In-flight MultisigService.init promises, keyed by accountPublicKey. The
+// guardian sync runs every 3s and does not await previous ticks; without this,
+// each tick can start a fresh init before the resolved service reaches the cache.
+const guardianServiceInflight = new Map<string, Promise<MultisigService>>();
+
 /**
  * Callbacks for resolving account data.
  * Allows guardian-manager to work in both frontend (Zustand) and service worker (Vault) contexts.
@@ -45,33 +50,52 @@ export async function getOrCreateMultisigService(
     guardianServiceCache.delete(accountPublicKey);
   }
 
-  // Verify this is a Guardian account
-  const accounts = await provider.getAccounts();
-  const account = accounts.find(acc => acc.publicKey === accountPublicKey);
-  if (!account || account.type !== WalletType.Guardian) {
-    throw new Error('Account is not a Guardian account');
+  const inflight = guardianServiceInflight.get(accountPublicKey);
+  if (inflight) {
+    return inflight;
   }
 
-  // Get the Account object from Miden client
-  const { sdkAccount } = await withWasmClientLock(async () => {
-    const midenClient = await getMidenClient();
-    const sdkAccount = await midenClient.getAccount(accountPublicKey);
-    return { sdkAccount };
-  });
+  const initPromise = (async () => {
+    // Verify this is a Guardian account
+    const accounts = await provider.getAccounts();
+    const account = accounts.find(acc => acc.publicKey === accountPublicKey);
+    if (!account || account.type !== WalletType.Guardian) {
+      throw new Error('Account is not a Guardian account');
+    }
 
-  if (!sdkAccount) {
-    throw new Error('Account not found in local storage');
-  }
+    console.log('[Guardian Manager] No valid cached MultisigService found, creating new one...');
+    console.log('[Guardian Manager] Found Guardian account in provider:', account);
 
-  const { commitment, publicKey } = await getSignerDetailsFromAccount(sdkAccount, provider.getPublicKeyForCommitment);
-  console.log('[Guardian Manager] Retrieved signer details - commitment:', commitment, 'publicKey:', publicKey);
-  // Initialize MultisigService with the account, public key, commitment, and signWord function
-  const service = await MultisigService.init(sdkAccount, `0x${publicKey}`, `0x${commitment}`, provider.signWord);
+    // Get the Account object from Miden client
+    const { sdkAccount } = await withWasmClientLock(async () => {
+      const midenClient = await getMidenClient();
+      const sdkAccount = await midenClient.getAccount(accountPublicKey);
+      return { sdkAccount };
+    });
 
-  // Cache for future use
-  guardianServiceCache.set(accountPublicKey, service);
+    if (!sdkAccount) {
+      throw new Error('Account not found in local storage');
+    }
 
-  return service;
+    const { commitment, publicKey } = await getSignerDetailsFromAccount(sdkAccount, provider.getPublicKeyForCommitment);
+    console.log('[Guardian Manager] Retrieved signer details - commitment:', commitment, 'publicKey:', publicKey);
+    // Initialize MultisigService with the account, public key, commitment, and signWord function
+    const service = await MultisigService.init(sdkAccount, `0x${publicKey}`, `0x${commitment}`, provider.signWord);
+
+    // Cache for future use
+    guardianServiceCache.set(accountPublicKey, service);
+
+    return service;
+  })();
+
+  guardianServiceInflight.set(accountPublicKey, initPromise);
+  try {
+    return await initPromise;
+  } finally {
+    // Evict on settle (success or failure) so a failed init can be retried on
+    // the next sync tick while successful inits use guardianServiceCache.
+    guardianServiceInflight.delete(accountPublicKey);
+  }
 }
 
 /**
@@ -90,6 +114,7 @@ export async function isGuardianAccount(accountPublicKey: string, provider: Guar
  */
 export function clearGuardianCache(): void {
   guardianServiceCache.clear();
+  guardianServiceInflight.clear();
 }
 
 /**
@@ -99,4 +124,5 @@ export function clearGuardianCache(): void {
  */
 export function clearGuardianServiceFor(accountPublicKey: string): void {
   guardianServiceCache.delete(accountPublicKey);
+  guardianServiceInflight.delete(accountPublicKey);
 }
diff --git a/src/lib/miden/guardian/index.ts b/src/lib/miden/guardian/index.ts
index 2e23d4a03..6317e6190 100644
--- a/src/lib/miden/guardian/index.ts
+++ b/src/lib/miden/guardian/index.ts
@@ -16,7 +16,6 @@ import { WalletSigner, type SignWordFunction } from './signer';
 import { fetchFromStorage } from '../front/storage';
 import { accountIdStringToSdk } from '../sdk/helpers';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
-import { MidenClientInterface } from '../sdk/miden-client-interface';
 
 const MAX_SYNC_RETRIES = 20;
 
@@ -50,7 +49,12 @@ export class MultisigService {
       const signer = new WalletSigner(publicKey, signerCommitment, signWordFn);
       const guardianEndpoint = (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
 
-      const webClient = (await MidenClientInterface.create({})).client;
+      // Reuse the shared singleton client instead of spinning up a fresh
+      // WebClient (each new WebClient spawns a ~6MB web-client-methods-worker
+      // that is never terminated). Reusing the singleton also lets the multisig
+      // lib's rawClientCache WeakMap (keyed by this client instance) hit across
+      // every init, so at most ONE shared raw worker is created total.
+      const webClient = (await getMidenClient()).client;
 
       const client = new MultisigClient(webClient, { guardianEndpoint });
       const multisig = await client.load(account.id().toString(), signer);

From 8e512d4bbcee9fdaa59166bf1d78871be9b4a4d6 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Mon, 22 Jun 2026 16:21:00 +0530
Subject: [PATCH 54/71] fix: pin secp256k1 to 0.21.1 to prevent xcode errors

---
 CLAUDE.md                                |  3 -
 ios/App/App.xcodeproj/project.pbxproj    |  4 +-
 ios/App/scripts/patch-swift-secp256k1.sh | 93 ------------------------
 package.json                             | 11 ++-
 4 files changed, 7 insertions(+), 104 deletions(-)
 delete mode 100755 ios/App/scripts/patch-swift-secp256k1.sh

diff --git a/CLAUDE.md b/CLAUDE.md
index f6ea092e9..b6c360065 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -128,9 +128,6 @@ The App target in `ios/App/App.xcodeproj/project.pbxproj` does NOT auto-discover
 ### Adding a custom Capacitor plugin (iOS)
 Capacitor on this app uses **manual** registration — not the `CAPBridgedPlugin` auto-discovery you'd get on a stock Capacitor app. After creating `MyPlugin.swift` and wiring it into the four pbxproj sections above, you also have to call `bridge?.registerPluginInstance(MyPlugin())` inside `capacitorDidLoad()` in `ios/App/App/AppViewController.swift`. Skip this step and JS calls land as `{"code":"UNIMPLEMENTED"}` even though the class compiled fine.
 
-### swift-secp256k1 (P256K) trait-gating workaround
-21-DOT-DEV/swift-secp256k1 v0.22+ gates `ENABLE_MODULE_ECDH/RECOVERY/SCHNORRSIG/MUSIG/ELLSWIFT` behind SPM traits. CLI `swift build` honors the default-enabled traits; **Xcode silently drops `.when(traits:)` conditions** so libsecp256k1 ships those C symbols missing while P256K's Swift code references them — undefined-symbol link errors. Workaround: `ios/App/scripts/patch-swift-secp256k1.sh` promotes the five defines into `baseSettings` (unconditional). Yarn pipeline (`mobile:ios`, `mobile:ios:build`, `test:e2e:mobile:build`, `mobile:ios:release`) calls it as `yarn mobile:ios:patch-spm`. Re-run manually after a Package "Reset Caches" in Xcode.
-
 ### Native navbar overlay
 Mobile hides React footer and renders bottom nav as native pill (iOS: `MidenNavbarOverlayWindow` `UIWindow`; Android: two-instance `NavbarOverlayManager` with Activity-scoped + Dialog-scoped `NavbarView`). Plugin methods: `showNativeNavbar`, `setNavbarSecondaryRow`, `setNavbarAction`, `morphNavbar{Out,In}`. Events: `nativeNavbarTap`, `nativeNavbarSecondaryTap`, `nativeNavbarActionTap`. Wiring: `src/app/providers/DappBrowserProvider.tsx`. Android gotchas: don't use `MATCH_PARENT` children in `WRAP_CONTENT` parents (1878px buttons); `Dialog.setLayout` must follow `setContentView`; shadow must be on the view owning the background drawable.
 
diff --git a/ios/App/App.xcodeproj/project.pbxproj b/ios/App/App.xcodeproj/project.pbxproj
index 2df4bb066..86d9f7ac8 100644
--- a/ios/App/App.xcodeproj/project.pbxproj
+++ b/ios/App/App.xcodeproj/project.pbxproj
@@ -417,8 +417,8 @@
 			isa = XCRemoteSwiftPackageReference;
 			repositoryURL = "https://github.com/21-DOT-DEV/swift-secp256k1.git";
 			requirement = {
-				kind = upToNextMajorVersion;
-				minimumVersion = 0.23.1;
+				kind = upToNextMinorVersion;
+				minimumVersion = 0.21.1;
 			};
 		};
 /* End XCRemoteSwiftPackageReference section */
diff --git a/ios/App/scripts/patch-swift-secp256k1.sh b/ios/App/scripts/patch-swift-secp256k1.sh
deleted file mode 100755
index ef1583ad1..000000000
--- a/ios/App/scripts/patch-swift-secp256k1.sh
+++ /dev/null
@@ -1,93 +0,0 @@
-#!/bin/bash
-#
-# Patch the resolved swift-secp256k1 (21-DOT-DEV) Package.swift to unconditionally
-# enable ECDH / RECOVERY / SCHNORRSIG / MUSIG / ELLSWIFT in the libsecp256k1 C
-# build.
-#
-# Why: v0.22+ gates these defines behind SPM "traits". Xcode's SPM evaluator
-# silently drops `.when(traits:)` conditions, so even though those traits are
-# default-enabled (line 35 of the upstream Package.swift), the C library gets
-# compiled WITHOUT ENABLE_MODULE_ECDH/etc. P256K's Swift code still references
-# the corresponding C symbols → "Undefined symbols" at link time.
-#
-# Run from the repo root or `ios/App/` before invoking xcodebuild / opening
-# Xcode. The yarn pipeline calls it via `mobile:ios:patch-spm` as part of
-# `mobile:ios`, `mobile:ios:build`, and the e2e/release variants. Idempotent —
-# safe to run repeatedly. Xcode does NOT re-resolve the package on every
-# build, so this only needs to run after the package is first resolved or
-# after a `Reset Package Caches`.
-
-set -euo pipefail
-
-# Xcode keeps two SPM checkouts depending on how the build is invoked:
-#   - System DerivedData: ~/Library/Developer/Xcode/DerivedData/App-*/SourcePackages/...
-#     (used when Xcode opens the project without an override).
-#   - Per-project derivedDataPath: <repo>/ios/App/build/SourcePackages/...
-#     (used by `xcodebuild -derivedDataPath ios/App/build` from yarn).
-# Both must be patched — they're independent checkouts — otherwise whichever
-# Xcode actually compiles against will produce a libsecp256k1.o missing the
-# trait-gated module symbols.
-MARKER='// MIDEN-PATCH: trait-gated defines promoted to baseSettings'
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
-
-CANDIDATES=()
-while IFS= read -r found; do
-    [[ -n "$found" ]] && CANDIDATES+=("$found")
-done < <(
-    find ~/Library/Developer/Xcode/DerivedData \
-        -path '*/SourcePackages/checkouts/swift-secp256k1/Package.swift' \
-        2>/dev/null
-    find "$REPO_ROOT/ios/App/build/SourcePackages/checkouts/swift-secp256k1/Package.swift" \
-        2>/dev/null
-)
-
-if [[ ${#CANDIDATES[@]} -eq 0 ]]; then
-    echo "warning: no swift-secp256k1 Package.swift found — Xcode hasn't resolved packages yet (run from Xcode at least once first)"
-    exit 0
-fi
-
-for PKG_FILE in "${CANDIDATES[@]}"; do
-    # Xcode's incremental build often misses Package.swift edits and reuses a
-    # stale secp256k1.o (compiled before the patch landed). Always nuke the
-    # corresponding swift-secp256k1.build cache so the next compile picks up
-    # the patched defines. The DerivedData root is two dirs above
-    # SourcePackages/checkouts.
-    DERIVED_DATA_ROOT="$(cd "$(dirname "$PKG_FILE")/../../.." && pwd)"
-    stale="$DERIVED_DATA_ROOT/Build/Intermediates.noindex/swift-secp256k1.build"
-    if [[ -d "$stale" ]]; then
-        echo "nuking stale build cache: $stale"
-        rm -rf "$stale"
-    fi
-
-    if grep -q "$MARKER" "$PKG_FILE"; then
-        echo "already patched: $PKG_FILE"
-        continue
-    fi
-
-    # Xcode's SPM checkout is read-only by default; make writable for patcher.
-    chmod u+w "$PKG_FILE"
-
-    python3 - "$PKG_FILE" "$MARKER" <<'PYEOF'
-import sys, pathlib
-path = pathlib.Path(sys.argv[1])
-marker = sys.argv[2]
-src = path.read_text()
-needle = '.define("ENABLE_MODULE_EXTRAKEYS")\n    ]'
-replacement = (
-    '.define("ENABLE_MODULE_EXTRAKEYS"),\n'
-    f'        {marker}\n'
-    '        .define("ENABLE_MODULE_ECDH"),\n'
-    '        .define("ENABLE_MODULE_RECOVERY"),\n'
-    '        .define("ENABLE_MODULE_SCHNORRSIG"),\n'
-    '        .define("ENABLE_MODULE_MUSIG"),\n'
-    '        .define("ENABLE_MODULE_ELLSWIFT")\n'
-    '    ]'
-)
-if needle not in src:
-    print(f"error: anchor line not found in {path}; upstream Package.swift may have changed", file=sys.stderr)
-    sys.exit(1)
-path.write_text(src.replace(needle, replacement, 1))
-print(f"patched {path}")
-PYEOF
-done
diff --git a/package.json b/package.json
index 07965a492..bb2bde0f9 100644
--- a/package.json
+++ b/package.json
@@ -33,14 +33,13 @@
     "build:mobile:devnet": "cross-env MIDEN_NETWORK=devnet yarn build:mobile",
     "mobile:sync": "yarn build:mobile && npx cap sync",
     "mobile:sync:devnet": "cross-env MIDEN_NETWORK=devnet yarn mobile:sync",
-    "mobile:ios:patch-spm": "bash ios/App/scripts/patch-swift-secp256k1.sh",
-    "mobile:ios": "yarn mobile:sync && yarn mobile:ios:patch-spm && npx cap open ios",
+    "mobile:ios": "yarn mobile:sync && npx cap open ios",
     "mobile:ios:devnet": "cross-env MIDEN_NETWORK=devnet yarn mobile:ios",
-    "mobile:ios:build": "yarn mobile:sync && yarn mobile:ios:patch-spm && xcodebuild -project ios/App/App.xcodeproj -scheme App -destination 'platform=iOS Simulator,name=iPhone 17' -configuration Debug -derivedDataPath ios/App/build build",
+    "mobile:ios:build": "yarn mobile:sync && xcodebuild -project ios/App/App.xcodeproj -scheme App -destination 'platform=iOS Simulator,name=iPhone 17' -configuration Debug -derivedDataPath ios/App/build build",
     "mobile:ios:build:devnet": "cross-env MIDEN_NETWORK=devnet yarn mobile:ios:build",
     "mobile:ios:run": "yarn mobile:ios:build && xcrun simctl install booted ios/App/build/Build/Products/Debug-iphonesimulator/App.app && yarn mobile:ios:faceid && xcrun simctl launch booted com.miden.wallet",
     "mobile:ios:run:devnet": "cross-env MIDEN_NETWORK=devnet yarn mobile:ios:run",
-    "mobile:ios:run:device": "yarn mobile:sync && yarn mobile:ios:patch-spm && bash ios/App/scripts/run-on-device.sh",
+    "mobile:ios:run:device": "yarn mobile:sync && bash ios/App/scripts/run-on-device.sh",
     "mobile:ios:run:device:devnet": "cross-env MIDEN_NETWORK=devnet yarn mobile:ios:run:device",
     "mobile:ios:logs:device": "bash ios/App/scripts/logs-on-device.sh",
     "mobile:ios:faceid": "xcrun simctl spawn booted notifyutil -s com.apple.BiometricKit.enrollmentChanged 1 && xcrun simctl spawn booted notifyutil -p com.apple.BiometricKit.enrollmentChanged",
@@ -51,7 +50,7 @@
     "mobile:android:release:apk": "yarn mobile:sync && cd android && ./gradlew assembleRelease && echo 'APK created at: android/app/build/outputs/apk/release/app-release.apk'",
     "mobile:android:keystore": "keytool -genkey -v -keystore android/app/miden-release.keystore -alias miden -keyalg RSA -keysize 2048 -validity 10000",
     "mobile:ios:set-version": "cd ios/App && xcrun agvtool new-marketing-version $(node -p \"require('../../package.json').version\") && xcrun agvtool next-version -all",
-    "mobile:ios:release": "yarn mobile:sync && yarn mobile:ios:patch-spm && yarn mobile:ios:set-version && xcodebuild -workspace ios/App/App.xcworkspace -scheme App -configuration Release -archivePath ios/App/build/MidenWallet.xcarchive archive && echo 'Archive created at: ios/App/build/MidenWallet.xcarchive'",
+    "mobile:ios:release": "yarn mobile:sync && yarn mobile:ios:set-version && xcodebuild -workspace ios/App/App.xcworkspace -scheme App -configuration Release -archivePath ios/App/build/MidenWallet.xcarchive archive && echo 'Archive created at: ios/App/build/MidenWallet.xcarchive'",
     "mobile:ios:export": "xcodebuild -exportArchive -archivePath ios/App/build/MidenWallet.xcarchive -exportPath ios/App/build/export -exportOptionsPlist ios/App/ExportOptions.plist",
     "zip": "ts-node --project ./tsconfig-utility.json ./utility/buildZip.ts",
     "test": "jest",
@@ -78,7 +77,7 @@
     "test:e2e:stress:testnet": "cross-env E2E_NETWORK=testnet yarn test:e2e:stress",
     "test:e2e:stress:devnet": "cross-env E2E_NETWORK=devnet yarn test:e2e:stress",
     "test:e2e:stress:localhost": "cross-env E2E_NETWORK=localhost yarn test:e2e:stress",
-    "test:e2e:mobile:build": "cross-env MIDEN_E2E_TEST=true MIDEN_NETWORK=${E2E_NETWORK:-testnet} yarn mobile:sync && yarn mobile:ios:patch-spm && xcodebuild -project ios/App/App.xcodeproj -scheme App -destination 'platform=iOS Simulator,name=iPhone 17' -configuration Debug -derivedDataPath ios/App/build build",
+    "test:e2e:mobile:build": "cross-env MIDEN_E2E_TEST=true MIDEN_NETWORK=${E2E_NETWORK:-testnet} yarn mobile:sync && xcodebuild -project ios/App/App.xcodeproj -scheme App -destination 'platform=iOS Simulator,name=iPhone 17' -configuration Debug -derivedDataPath ios/App/build build",
     "test:e2e:mobile": "yarn test:e2e:mobile:build && playwright test --config playwright.ios.config.ts",
     "test:e2e:mobile:run": "playwright test --config playwright.ios.config.ts",
     "test:e2e:mobile:testnet": "cross-env E2E_NETWORK=testnet yarn test:e2e:mobile",

From a7e84fcb1db1311fdeefca799dc073afbe1d62ab Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Tue, 23 Jun 2026 11:58:40 +0000
Subject: [PATCH 55/71] chore: update translation files

---
 public/_locales/de/messages.json    | 86 ++++++++++++++++++++++++++++-
 public/_locales/en/messages.json    | 86 ++++++++++++++++++++++++++++-
 public/_locales/en_GB/messages.json | 86 ++++++++++++++++++++++++++++-
 public/_locales/es/messages.json    | 86 ++++++++++++++++++++++++++++-
 public/_locales/fr/messages.json    | 86 ++++++++++++++++++++++++++++-
 public/_locales/ja/messages.json    | 86 ++++++++++++++++++++++++++++-
 public/_locales/ko/messages.json    | 86 ++++++++++++++++++++++++++++-
 public/_locales/pl/messages.json    | 86 ++++++++++++++++++++++++++++-
 public/_locales/pt/messages.json    | 86 ++++++++++++++++++++++++++++-
 public/_locales/ru/messages.json    | 86 ++++++++++++++++++++++++++++-
 public/_locales/tr/messages.json    | 86 ++++++++++++++++++++++++++++-
 public/_locales/uk/messages.json    | 86 ++++++++++++++++++++++++++++-
 public/_locales/zh_CN/messages.json | 86 ++++++++++++++++++++++++++++-
 public/_locales/zh_TW/messages.json | 86 ++++++++++++++++++++++++++++-
 14 files changed, 1190 insertions(+), 14 deletions(-)

diff --git a/public/_locales/de/messages.json b/public/_locales/de/messages.json
index 5bc899b86..3369028b0 100644
--- a/public/_locales/de/messages.json
+++ b/public/_locales/de/messages.json
@@ -1490,6 +1490,10 @@
     "message": "Teilen Sie es nicht mit anderen.",
     "englishSource": "Do not share with anyone."
   },
+  "seedPhraseRecoveryCaption": {
+    "message": "Ihr seed phrase ist Ihr Wiederherstellungsschlüssel – er wird zum Rotieren von Geräteschlüsseln verwendet, nicht für alltägliche Transaktionen.",
+    "englishSource": "Your seed phrase is your recovery key — used to rotate device keys, not for everyday transactions."
+  },
   "select": {
     "message": "Auswählen",
     "note": "Onboarding",
@@ -1672,6 +1676,14 @@
     "message": "Richten Sie Ihr Guardian-Konto auf einen neuen Guardian-Endpunkt. Der Wechsel wird als On-Chain-Vorschlag signiert.",
     "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
   },
+  "switchGuardianConfirmation": {
+    "message": "Dies wird mit Ihrem Wiederherstellungsschlüssel (Kaltschlüssel) signiert und von Ihrem aktuellen Vormund mitunterzeichnet. Ihr Guthaben und Ihr Konto bleiben gleich. Weitermachen?",
+    "englishSource": "This is signed with your recovery (cold) key and co-signed by your current guardian. Your funds and account stay the same. Continue?"
+  },
+  "confirmSwitchGuardian": {
+    "message": "Wechsel bestätigen",
+    "englishSource": "Confirm switch"
+  },
   "switchingGuardian": {
     "message": "Vormund wechseln...",
     "englishSource": "Switching guardian..."
@@ -1684,6 +1696,78 @@
     "message": "Das ist bereits Ihr aktueller Vormund.",
     "englishSource": "That's already your current guardian."
   },
+  "replaceHotKey": {
+    "message": "Geräteschlüssel drehen",
+    "englishSource": "Rotate device key"
+  },
+  "replaceHotKeyDescription": {
+    "message": "Generieren Sie einen neuen Geräteschlüssel (Hotkey) und ersetzen Sie den aktuellen in der Kette. Nützlich, wenn Sie den Verdacht haben, dass Ihr Gerät kompromittiert ist.",
+    "englishSource": "Generate a new device (hot) key and replace the current one on-chain. Useful if you suspect your device is compromised."
+  },
+  "replaceHotKeyConfirmation": {
+    "message": "Dies wird mit Ihrem Wiederherstellungsschlüssel (Kaltschlüssel) signiert. Ihr seed phrase ist nicht erforderlich und Ihr Guthaben und Ihr Konto bleiben gleich. Weitermachen?",
+    "englishSource": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?"
+  },
+  "confirmReplaceHotKey": {
+    "message": "Drehung bestätigen",
+    "englishSource": "Confirm rotation"
+  },
+  "hotKeyRotated": {
+    "message": "Geräteschlüssel erfolgreich gedreht.",
+    "englishSource": "Device key rotated successfully."
+  },
+  "activateHotKeyBannerTitle": {
+    "message": "Geräteschlüssel aktivieren",
+    "englishSource": "Activate device key"
+  },
+  "activateHotKeyBannerBody": {
+    "message": "Generieren Sie einen Geräteschlüssel für dieses wiederhergestellte Konto. Vor dem Senden erforderlich.",
+    "englishSource": "Generate a device key for this recovered account. Required before sending."
+  },
+  "activateHotKeyBannerCta": {
+    "message": "Aktivieren",
+    "englishSource": "Activate"
+  },
+  "activateHotKeyBannerError": {
+    "message": "Der Geräteschlüssel konnte nicht aktiviert werden. Versuchen Sie es erneut.",
+    "englishSource": "Failed to activate device key. Try again."
+  },
+  "revealHotKey": {
+    "message": "Geräteschlüssel anzeigen",
+    "englishSource": "Reveal device key"
+  },
+  "revealHotKeyDescription": {
+    "message": "Ihr Geräteschlüssel (Hotkey) kann unter „Einstellungen“ → „Geräteschlüssel drehen“ gedreht werden. Es ist also weniger riskant, ihn zu enthüllen als Ihren seed phrase – aber jeder, der ihn besitzt, kann Transaktionen signieren, bis Sie ihn drehen.",
+    "englishSource": "Your device (hot) key is rotatable from Settings → Rotate Device Key, so revealing it is lower-stakes than your seed phrase — but anyone who holds it can sign transactions until you rotate."
+  },
+  "hotPrivateKey": {
+    "message": "Privater Geräteschlüssel",
+    "englishSource": "Device Private Key"
+  },
+  "hotPublicKeyLabel": {
+    "message": "Öffentlicher Geräteschlüssel",
+    "englishSource": "Device Public Key"
+  },
+  "coldPrivateKey": {
+    "message": "Privater Wiederherstellungsschlüssel (kalt).",
+    "englishSource": "Recovery (Cold) Private Key"
+  },
+  "coldPublicKeyLabel": {
+    "message": "Öffentlicher Wiederherstellungsschlüssel (kalt).",
+    "englishSource": "Recovery (Cold) Public Key"
+  },
+  "guardianKeysRevealDescription": {
+    "message": "Ihr Guardian-Konto ist durch drei Schlüssel geschützt: einen Geräteschlüssel (Hotschlüssel) für routinemäßige Signaturen, einen von Ihrem seed phrase abgeleiteten Wiederherstellungsschlüssel (Kaltschlüssel) für Kontoverwaltungsvorgänge und einen externen Guardian-Mitunterzeichner. Nachfolgend finden Sie Ihren kalten privaten Schlüssel sowie beide öffentlichen Schlüssel. Um den privaten Schlüssel des Geräts anzuzeigen, verwenden Sie Einstellungen → Geräteschlüssel anzeigen.",
+    "englishSource": "Your Guardian account is protected by three keys: a device (hot) key for routine signing, a recovery (cold) key derived from your seed phrase for account-management operations, and an external guardian co-signer. Below are your cold private key plus both public keys. To reveal the device private key, use Settings → Reveal Device Key."
+  },
+  "hotKeyRevealWarningTitle": {
+    "message": "Bevor Sie Ihren Geräteschlüssel preisgeben",
+    "englishSource": "Before you reveal your device key"
+  },
+  "hotKeyRevealWarningBody": {
+    "message": "Jeder mit diesem Schlüssel kann Transaktionen signieren, bis Sie ihn rotieren. Wenn der Schlüssel durchgesickert ist, drehen Sie ihn über Einstellungen → Geräteschlüssel drehen.",
+    "englishSource": "Anyone with this key can sign transactions until you rotate it. If the key is leaked, rotate it via Settings → Rotate Device Key."
+  },
   "invalidUrl": {
     "message": "Geben Sie eine gültige URL ein, die mit http:// oder https:// beginnt.",
     "englishSource": "Enter a valid URL starting with http:// or https://"
@@ -3086,4 +3170,4 @@
     "message": "Habe es",
     "englishSource": "Got it"
   }
-}
+}
\ No newline at end of file
diff --git a/public/_locales/en/messages.json b/public/_locales/en/messages.json
index 4cc6405e4..5bb7604b1 100644
--- a/public/_locales/en/messages.json
+++ b/public/_locales/en/messages.json
@@ -1477,6 +1477,10 @@
     "message": "Do not share with anyone.",
     "englishSource": "Do not share with anyone."
   },
+  "seedPhraseRecoveryCaption": {
+    "message": "Your seed phrase is your recovery key — used to rotate device keys, not for everyday transactions.",
+    "englishSource": "Your seed phrase is your recovery key — used to rotate device keys, not for everyday transactions."
+  },
   "select": {
     "message": "Select",
     "englishSource": "Select"
@@ -1641,6 +1645,14 @@
     "message": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal.",
     "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
   },
+  "switchGuardianConfirmation": {
+    "message": "This is signed with your recovery (cold) key and co-signed by your current guardian. Your funds and account stay the same. Continue?",
+    "englishSource": "This is signed with your recovery (cold) key and co-signed by your current guardian. Your funds and account stay the same. Continue?"
+  },
+  "confirmSwitchGuardian": {
+    "message": "Confirm switch",
+    "englishSource": "Confirm switch"
+  },
   "switchingGuardian": {
     "message": "Switching guardian...",
     "englishSource": "Switching guardian..."
@@ -1653,6 +1665,78 @@
     "message": "That's already your current guardian.",
     "englishSource": "That's already your current guardian."
   },
+  "replaceHotKey": {
+    "message": "Rotate device key",
+    "englishSource": "Rotate device key"
+  },
+  "replaceHotKeyDescription": {
+    "message": "Generate a new device (hot) key and replace the current one on-chain. Useful if you suspect your device is compromised.",
+    "englishSource": "Generate a new device (hot) key and replace the current one on-chain. Useful if you suspect your device is compromised."
+  },
+  "replaceHotKeyConfirmation": {
+    "message": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?",
+    "englishSource": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?"
+  },
+  "confirmReplaceHotKey": {
+    "message": "Confirm rotation",
+    "englishSource": "Confirm rotation"
+  },
+  "hotKeyRotated": {
+    "message": "Device key rotated successfully.",
+    "englishSource": "Device key rotated successfully."
+  },
+  "activateHotKeyBannerTitle": {
+    "message": "Activate device key",
+    "englishSource": "Activate device key"
+  },
+  "activateHotKeyBannerBody": {
+    "message": "Generate a device key for this recovered account. Required before sending.",
+    "englishSource": "Generate a device key for this recovered account. Required before sending."
+  },
+  "activateHotKeyBannerCta": {
+    "message": "Activate",
+    "englishSource": "Activate"
+  },
+  "activateHotKeyBannerError": {
+    "message": "Failed to activate device key. Try again.",
+    "englishSource": "Failed to activate device key. Try again."
+  },
+  "revealHotKey": {
+    "message": "Reveal device key",
+    "englishSource": "Reveal device key"
+  },
+  "revealHotKeyDescription": {
+    "message": "Your device (hot) key is rotatable from Settings → Rotate Device Key, so revealing it is lower-stakes than your seed phrase — but anyone who holds it can sign transactions until you rotate.",
+    "englishSource": "Your device (hot) key is rotatable from Settings → Rotate Device Key, so revealing it is lower-stakes than your seed phrase — but anyone who holds it can sign transactions until you rotate."
+  },
+  "hotPrivateKey": {
+    "message": "Device Private Key",
+    "englishSource": "Device Private Key"
+  },
+  "hotPublicKeyLabel": {
+    "message": "Device Public Key",
+    "englishSource": "Device Public Key"
+  },
+  "coldPrivateKey": {
+    "message": "Recovery (Cold) Private Key",
+    "englishSource": "Recovery (Cold) Private Key"
+  },
+  "coldPublicKeyLabel": {
+    "message": "Recovery (Cold) Public Key",
+    "englishSource": "Recovery (Cold) Public Key"
+  },
+  "guardianKeysRevealDescription": {
+    "message": "Your Guardian account is protected by three keys: a device (hot) key for routine signing, a recovery (cold) key derived from your seed phrase for account-management operations, and an external guardian co-signer. Below are your cold private key plus both public keys. To reveal the device private key, use Settings → Reveal Device Key.",
+    "englishSource": "Your Guardian account is protected by three keys: a device (hot) key for routine signing, a recovery (cold) key derived from your seed phrase for account-management operations, and an external guardian co-signer. Below are your cold private key plus both public keys. To reveal the device private key, use Settings → Reveal Device Key."
+  },
+  "hotKeyRevealWarningTitle": {
+    "message": "Before you reveal your device key",
+    "englishSource": "Before you reveal your device key"
+  },
+  "hotKeyRevealWarningBody": {
+    "message": "Anyone with this key can sign transactions until you rotate it. If the key is leaked, rotate it via Settings → Rotate Device Key.",
+    "englishSource": "Anyone with this key can sign transactions until you rotate it. If the key is leaked, rotate it via Settings → Rotate Device Key."
+  },
   "invalidUrl": {
     "message": "Enter a valid URL starting with http:// or https://",
     "englishSource": "Enter a valid URL starting with http:// or https://"
@@ -3050,4 +3134,4 @@
     "message": "Got it",
     "englishSource": "Got it"
   }
-}
+}
\ No newline at end of file
diff --git a/public/_locales/en_GB/messages.json b/public/_locales/en_GB/messages.json
index 5d42a44c5..af8c8130f 100644
--- a/public/_locales/en_GB/messages.json
+++ b/public/_locales/en_GB/messages.json
@@ -1517,6 +1517,10 @@
     "message": "Do not share with anyone.",
     "englishSource": "Do not share with anyone."
   },
+  "seedPhraseRecoveryCaption": {
+    "message": "Your seed phrase is your recovery key — used to rotate device keys, not for everyday transactions.",
+    "englishSource": "Your seed phrase is your recovery key — used to rotate device keys, not for everyday transactions."
+  },
   "select": {
     "message": "Select",
     "note": "Onboarding",
@@ -1700,6 +1704,14 @@
     "message": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal.",
     "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
   },
+  "switchGuardianConfirmation": {
+    "message": "This is signed with your recovery (cold) key and co-signed by your current guardian. Your funds and account stay the same. Continue?",
+    "englishSource": "This is signed with your recovery (cold) key and co-signed by your current guardian. Your funds and account stay the same. Continue?"
+  },
+  "confirmSwitchGuardian": {
+    "message": "Confirm switch",
+    "englishSource": "Confirm switch"
+  },
   "switchingGuardian": {
     "message": "Switching guardian...",
     "englishSource": "Switching guardian..."
@@ -1712,6 +1724,78 @@
     "message": "That's already your current guardian.",
     "englishSource": "That's already your current guardian."
   },
+  "replaceHotKey": {
+    "message": "Rotate device key",
+    "englishSource": "Rotate device key"
+  },
+  "replaceHotKeyDescription": {
+    "message": "Generate a new device (hot) key and replace the current one on-chain. Useful if you suspect your device is compromised.",
+    "englishSource": "Generate a new device (hot) key and replace the current one on-chain. Useful if you suspect your device is compromised."
+  },
+  "replaceHotKeyConfirmation": {
+    "message": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?",
+    "englishSource": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?"
+  },
+  "confirmReplaceHotKey": {
+    "message": "Confirm rotation",
+    "englishSource": "Confirm rotation"
+  },
+  "hotKeyRotated": {
+    "message": "Device key rotated successfully.",
+    "englishSource": "Device key rotated successfully."
+  },
+  "activateHotKeyBannerTitle": {
+    "message": "Activate device key",
+    "englishSource": "Activate device key"
+  },
+  "activateHotKeyBannerBody": {
+    "message": "Generate a device key for this recovered account. Required before sending.",
+    "englishSource": "Generate a device key for this recovered account. Required before sending."
+  },
+  "activateHotKeyBannerCta": {
+    "message": "Activate",
+    "englishSource": "Activate"
+  },
+  "activateHotKeyBannerError": {
+    "message": "Failed to activate device key. Try again.",
+    "englishSource": "Failed to activate device key. Try again."
+  },
+  "revealHotKey": {
+    "message": "Reveal device key",
+    "englishSource": "Reveal device key"
+  },
+  "revealHotKeyDescription": {
+    "message": "Your device (hot) key is rotatable from Settings → Rotate Device Key, so revealing it is lower-stakes than your seed phrase — but anyone who holds it can sign transactions until you rotate.",
+    "englishSource": "Your device (hot) key is rotatable from Settings → Rotate Device Key, so revealing it is lower-stakes than your seed phrase — but anyone who holds it can sign transactions until you rotate."
+  },
+  "hotPrivateKey": {
+    "message": "Device Private Key",
+    "englishSource": "Device Private Key"
+  },
+  "hotPublicKeyLabel": {
+    "message": "Device Public Key",
+    "englishSource": "Device Public Key"
+  },
+  "coldPrivateKey": {
+    "message": "Recovery (Cold) Private Key",
+    "englishSource": "Recovery (Cold) Private Key"
+  },
+  "coldPublicKeyLabel": {
+    "message": "Recovery (Cold) Public Key",
+    "englishSource": "Recovery (Cold) Public Key"
+  },
+  "guardianKeysRevealDescription": {
+    "message": "Your Guardian account is protected by three keys: a device (hot) key for routine signing, a recovery (cold) key derived from your seed phrase for account-management operations, and an external guardian co-signer. Below are your cold private key plus both public keys. To reveal the device private key, use Settings → Reveal Device Key.",
+    "englishSource": "Your Guardian account is protected by three keys: a device (hot) key for routine signing, a recovery (cold) key derived from your seed phrase for account-management operations, and an external guardian co-signer. Below are your cold private key plus both public keys. To reveal the device private key, use Settings → Reveal Device Key."
+  },
+  "hotKeyRevealWarningTitle": {
+    "message": "Before you reveal your device key",
+    "englishSource": "Before you reveal your device key"
+  },
+  "hotKeyRevealWarningBody": {
+    "message": "Anyone with this key can sign transactions until you rotate it. If the key is leaked, rotate it via Settings → Rotate Device Key.",
+    "englishSource": "Anyone with this key can sign transactions until you rotate it. If the key is leaked, rotate it via Settings → Rotate Device Key."
+  },
   "invalidUrl": {
     "message": "Enter a valid URL starting with http:// or https://",
     "englishSource": "Enter a valid URL starting with http:// or https://"
@@ -3114,4 +3198,4 @@
     "message": "Got it",
     "englishSource": "Got it"
   }
-}
+}
\ No newline at end of file
diff --git a/public/_locales/es/messages.json b/public/_locales/es/messages.json
index 987f444df..6aa0d7da4 100644
--- a/public/_locales/es/messages.json
+++ b/public/_locales/es/messages.json
@@ -1450,6 +1450,10 @@
     "message": "No compartir con nadie.",
     "englishSource": "Do not share with anyone."
   },
+  "seedPhraseRecoveryCaption": {
+    "message": "Su seed phrase es su clave de recuperación: se utiliza para rotar las claves del dispositivo, no para las transacciones diarias.",
+    "englishSource": "Your seed phrase is your recovery key — used to rotate device keys, not for everyday transactions."
+  },
   "select": {
     "message": "Seleccionar",
     "englishSource": "Select"
@@ -1614,6 +1618,14 @@
     "message": "Apunte su cuenta de Guardian a un nuevo punto final de Guardian. El cambio está firmado como una propuesta en cadena.",
     "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
   },
+  "switchGuardianConfirmation": {
+    "message": "Esto está firmado con su clave de recuperación (fría) y firmado conjuntamente por su tutor actual. Sus fondos y su cuenta permanecen igual. ¿Continuar?",
+    "englishSource": "This is signed with your recovery (cold) key and co-signed by your current guardian. Your funds and account stay the same. Continue?"
+  },
+  "confirmSwitchGuardian": {
+    "message": "Confirmar cambio",
+    "englishSource": "Confirm switch"
+  },
   "switchingGuardian": {
     "message": "Cambiando de guardián...",
     "englishSource": "Switching guardian..."
@@ -1626,6 +1638,78 @@
     "message": "Ese ya es tu tutor actual.",
     "englishSource": "That's already your current guardian."
   },
+  "replaceHotKey": {
+    "message": "Girar la tecla del dispositivo",
+    "englishSource": "Rotate device key"
+  },
+  "replaceHotKeyDescription": {
+    "message": "Genere una nueva clave (de acceso rápido) de dispositivo y reemplace la actual en la cadena. Útil si sospecha que su dispositivo está comprometido.",
+    "englishSource": "Generate a new device (hot) key and replace the current one on-chain. Useful if you suspect your device is compromised."
+  },
+  "replaceHotKeyConfirmation": {
+    "message": "Esto está firmado con su clave de recuperación (fría). Su seed phrase no es obligatorio y sus fondos y su cuenta siguen siendo los mismos. ¿Continuar?",
+    "englishSource": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?"
+  },
+  "confirmReplaceHotKey": {
+    "message": "Confirmar rotación",
+    "englishSource": "Confirm rotation"
+  },
+  "hotKeyRotated": {
+    "message": "La clave del dispositivo se giró correctamente.",
+    "englishSource": "Device key rotated successfully."
+  },
+  "activateHotKeyBannerTitle": {
+    "message": "Activar clave del dispositivo",
+    "englishSource": "Activate device key"
+  },
+  "activateHotKeyBannerBody": {
+    "message": "Genere una clave de dispositivo para esta cuenta recuperada. Requerido antes de enviar.",
+    "englishSource": "Generate a device key for this recovered account. Required before sending."
+  },
+  "activateHotKeyBannerCta": {
+    "message": "Activar",
+    "englishSource": "Activate"
+  },
+  "activateHotKeyBannerError": {
+    "message": "No se pudo activar la clave del dispositivo. Intentar otra vez.",
+    "englishSource": "Failed to activate device key. Try again."
+  },
+  "revealHotKey": {
+    "message": "Revelar clave del dispositivo",
+    "englishSource": "Reveal device key"
+  },
+  "revealHotKeyDescription": {
+    "message": "La tecla de acceso rápido de su dispositivo se puede girar desde Configuración → Rotar clave de dispositivo, por lo que revelarla es menos arriesgado que su seed phrase, pero cualquiera que la tenga puede firmar transacciones hasta que la rote.",
+    "englishSource": "Your device (hot) key is rotatable from Settings → Rotate Device Key, so revealing it is lower-stakes than your seed phrase — but anyone who holds it can sign transactions until you rotate."
+  },
+  "hotPrivateKey": {
+    "message": "Clave privada del dispositivo",
+    "englishSource": "Device Private Key"
+  },
+  "hotPublicKeyLabel": {
+    "message": "Clave pública del dispositivo",
+    "englishSource": "Device Public Key"
+  },
+  "coldPrivateKey": {
+    "message": "Clave privada de recuperación (en frío)",
+    "englishSource": "Recovery (Cold) Private Key"
+  },
+  "coldPublicKeyLabel": {
+    "message": "Clave pública de recuperación (en frío)",
+    "englishSource": "Recovery (Cold) Public Key"
+  },
+  "guardianKeysRevealDescription": {
+    "message": "Su cuenta de Guardian está protegida por tres claves: una clave de dispositivo (activa) para la firma de rutina, una clave de recuperación (fría) derivada de su seed phrase para operaciones de administración de cuentas y un cofirmante externo de Guardian. A continuación se muestra su clave privada fría más ambas claves públicas. Para revelar la clave privada del dispositivo, use Configuración → Revelar clave del dispositivo.",
+    "englishSource": "Your Guardian account is protected by three keys: a device (hot) key for routine signing, a recovery (cold) key derived from your seed phrase for account-management operations, and an external guardian co-signer. Below are your cold private key plus both public keys. To reveal the device private key, use Settings → Reveal Device Key."
+  },
+  "hotKeyRevealWarningTitle": {
+    "message": "Antes de revelar la clave de tu dispositivo",
+    "englishSource": "Before you reveal your device key"
+  },
+  "hotKeyRevealWarningBody": {
+    "message": "Cualquier persona con esta clave puede firmar transacciones hasta que la rotes. Si se filtra la clave, gírela a través de Configuración → Girar clave del dispositivo.",
+    "englishSource": "Anyone with this key can sign transactions until you rotate it. If the key is leaked, rotate it via Settings → Rotate Device Key."
+  },
   "invalidUrl": {
     "message": "Introduzca una URL válida que comience con http:// o https://",
     "englishSource": "Enter a valid URL starting with http:// or https://"
@@ -3011,4 +3095,4 @@
     "message": "Entiendo",
     "englishSource": "Got it"
   }
-}
+}
\ No newline at end of file
diff --git a/public/_locales/fr/messages.json b/public/_locales/fr/messages.json
index b588c28ad..df4a61bd3 100644
--- a/public/_locales/fr/messages.json
+++ b/public/_locales/fr/messages.json
@@ -1490,6 +1490,10 @@
     "message": "Ne partagez avec personne.",
     "englishSource": "Do not share with anyone."
   },
+  "seedPhraseRecoveryCaption": {
+    "message": "Votre seed phrase est votre clé de récupération : elle est utilisée pour alterner les clés de l'appareil, et non pour les transactions quotidiennes.",
+    "englishSource": "Your seed phrase is your recovery key — used to rotate device keys, not for everyday transactions."
+  },
   "select": {
     "message": "Sélectionner",
     "note": "Onboarding",
@@ -1671,6 +1675,14 @@
     "message": "Pointez votre compte Guardian vers un nouveau point de terminaison Guardian. Le changement est signé comme une proposition en chaîne.",
     "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
   },
+  "switchGuardianConfirmation": {
+    "message": "Celui-ci est signé avec votre clé de récupération (à froid) et co-signé par votre tuteur actuel. Vos fonds et votre compte restent les mêmes. Continuer?",
+    "englishSource": "This is signed with your recovery (cold) key and co-signed by your current guardian. Your funds and account stay the same. Continue?"
+  },
+  "confirmSwitchGuardian": {
+    "message": "Confirmer le changement",
+    "englishSource": "Confirm switch"
+  },
   "switchingGuardian": {
     "message": "Changer de tuteur...",
     "englishSource": "Switching guardian..."
@@ -1683,6 +1695,78 @@
     "message": "C'est déjà votre tuteur actuel.",
     "englishSource": "That's already your current guardian."
   },
+  "replaceHotKey": {
+    "message": "Faire pivoter la clé de l'appareil",
+    "englishSource": "Rotate device key"
+  },
+  "replaceHotKeyDescription": {
+    "message": "Générez une nouvelle touche (hot) de périphérique et remplacez celle actuelle sur la chaîne. Utile si vous pensez que votre appareil est compromis.",
+    "englishSource": "Generate a new device (hot) key and replace the current one on-chain. Useful if you suspect your device is compromised."
+  },
+  "replaceHotKeyConfirmation": {
+    "message": "Ceci est signé avec votre clé de récupération (à froid). Votre seed phrase n'est pas requis, et vos fonds et votre compte restent les mêmes. Continuer?",
+    "englishSource": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?"
+  },
+  "confirmReplaceHotKey": {
+    "message": "Confirmer la rotation",
+    "englishSource": "Confirm rotation"
+  },
+  "hotKeyRotated": {
+    "message": "La clé de l'appareil a été pivotée avec succès.",
+    "englishSource": "Device key rotated successfully."
+  },
+  "activateHotKeyBannerTitle": {
+    "message": "Activer la clé de l'appareil",
+    "englishSource": "Activate device key"
+  },
+  "activateHotKeyBannerBody": {
+    "message": "Générez une clé de périphérique pour ce compte récupéré. Obligatoire avant l'envoi.",
+    "englishSource": "Generate a device key for this recovered account. Required before sending."
+  },
+  "activateHotKeyBannerCta": {
+    "message": "Activer",
+    "englishSource": "Activate"
+  },
+  "activateHotKeyBannerError": {
+    "message": "Échec de l'activation de la clé de l'appareil. Essayer à nouveau.",
+    "englishSource": "Failed to activate device key. Try again."
+  },
+  "revealHotKey": {
+    "message": "Révéler la clé de l'appareil",
+    "englishSource": "Reveal device key"
+  },
+  "revealHotKeyDescription": {
+    "message": "La touche (raccourcie) de votre appareil peut être tournée depuis Paramètres → Rotation de la clé de l'appareil, ce qui révèle que ses enjeux sont inférieurs à ceux de votre seed phrase — mais toute personne qui la détient peut signer des transactions jusqu'à ce que vous effectuiez la rotation.",
+    "englishSource": "Your device (hot) key is rotatable from Settings → Rotate Device Key, so revealing it is lower-stakes than your seed phrase — but anyone who holds it can sign transactions until you rotate."
+  },
+  "hotPrivateKey": {
+    "message": "Clé privée de l'appareil",
+    "englishSource": "Device Private Key"
+  },
+  "hotPublicKeyLabel": {
+    "message": "Clé publique de l'appareil",
+    "englishSource": "Device Public Key"
+  },
+  "coldPrivateKey": {
+    "message": "Clé privée de récupération (à froid)",
+    "englishSource": "Recovery (Cold) Private Key"
+  },
+  "coldPublicKeyLabel": {
+    "message": "Clé publique de récupération (à froid)",
+    "englishSource": "Recovery (Cold) Public Key"
+  },
+  "guardianKeysRevealDescription": {
+    "message": "Votre compte Guardian est protégé par trois clés : une touche de périphérique (raccourcie) pour la signature de routine, une clé de récupération (à froid) dérivée de votre seed phrase pour les opérations de gestion de compte et un cosignataire tuteur externe. Vous trouverez ci-dessous votre clé privée froide ainsi que les deux clés publiques. Pour révéler la clé privée de l'appareil, utilisez Paramètres → Révéler la clé de l'appareil.",
+    "englishSource": "Your Guardian account is protected by three keys: a device (hot) key for routine signing, a recovery (cold) key derived from your seed phrase for account-management operations, and an external guardian co-signer. Below are your cold private key plus both public keys. To reveal the device private key, use Settings → Reveal Device Key."
+  },
+  "hotKeyRevealWarningTitle": {
+    "message": "Avant de révéler la clé de votre appareil",
+    "englishSource": "Before you reveal your device key"
+  },
+  "hotKeyRevealWarningBody": {
+    "message": "Toute personne possédant cette clé peut signer des transactions jusqu'à ce que vous la tourniez. Si la clé fuit, faites-la pivoter via Paramètres → Rotation de la clé de l'appareil.",
+    "englishSource": "Anyone with this key can sign transactions until you rotate it. If the key is leaked, rotate it via Settings → Rotate Device Key."
+  },
   "invalidUrl": {
     "message": "Saisissez une URL valide commençant par http:// ou https://",
     "englishSource": "Enter a valid URL starting with http:// or https://"
@@ -3073,4 +3157,4 @@
     "message": "J'ai compris",
     "englishSource": "Got it"
   }
-}
+}
\ No newline at end of file
diff --git a/public/_locales/ja/messages.json b/public/_locales/ja/messages.json
index 601b33fac..905b6b785 100644
--- a/public/_locales/ja/messages.json
+++ b/public/_locales/ja/messages.json
@@ -1490,6 +1490,10 @@
     "message": "誰とも共有しないでください。",
     "englishSource": "Do not share with anyone."
   },
+  "seedPhraseRecoveryCaption": {
+    "message": "seed phrase は回復キーです。日常のトランザクションではなく、デバイス キーをローテーションするために使用されます。",
+    "englishSource": "Your seed phrase is your recovery key — used to rotate device keys, not for everyday transactions."
+  },
   "select": {
     "message": "選択する",
     "note": "Onboarding",
@@ -1672,6 +1676,14 @@
     "message": "Guardian アカウントを新しいガーディアン エンドポイントに向けます。スイッチはオンチェーン プロポーザルとして署名されます。",
     "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
   },
+  "switchGuardianConfirmation": {
+    "message": "これは回復 (コールド) キーで署名され、現在の保護者によって共同署名されています。資金とアカウントはそのまま残ります。続く？",
+    "englishSource": "This is signed with your recovery (cold) key and co-signed by your current guardian. Your funds and account stay the same. Continue?"
+  },
+  "confirmSwitchGuardian": {
+    "message": "スイッチの確認",
+    "englishSource": "Confirm switch"
+  },
   "switchingGuardian": {
     "message": "守護者を切り替えます...",
     "englishSource": "Switching guardian..."
@@ -1684,6 +1696,78 @@
     "message": "それはすでにあなたの現在の保護者です。",
     "englishSource": "That's already your current guardian."
   },
+  "replaceHotKey": {
+    "message": "デバイスキーをローテーションする",
+    "englishSource": "Rotate device key"
+  },
+  "replaceHotKeyDescription": {
+    "message": "新しいデバイス (ホット) キーを生成し、オンチェーン上の現在のキーを置き換えます。デバイスが侵害されている疑いがある場合に役立ちます。",
+    "englishSource": "Generate a new device (hot) key and replace the current one on-chain. Useful if you suspect your device is compromised."
+  },
+  "replaceHotKeyConfirmation": {
+    "message": "これは回復 (コールド) キーで署名されています。 seed phrase は必要ありません。資金とアカウントは変わりません。続く？",
+    "englishSource": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?"
+  },
+  "confirmReplaceHotKey": {
+    "message": "回転確認",
+    "englishSource": "Confirm rotation"
+  },
+  "hotKeyRotated": {
+    "message": "デバイスキーが正常にローテーションされました。",
+    "englishSource": "Device key rotated successfully."
+  },
+  "activateHotKeyBannerTitle": {
+    "message": "デバイスキーをアクティブ化する",
+    "englishSource": "Activate device key"
+  },
+  "activateHotKeyBannerBody": {
+    "message": "この回復されたアカウントのデバイス キーを生成します。送信する前に必須です。",
+    "englishSource": "Generate a device key for this recovered account. Required before sending."
+  },
+  "activateHotKeyBannerCta": {
+    "message": "活性化",
+    "englishSource": "Activate"
+  },
+  "activateHotKeyBannerError": {
+    "message": "デバイスキーの有効化に失敗しました。もう一度やり直してください。",
+    "englishSource": "Failed to activate device key. Try again."
+  },
+  "revealHotKey": {
+    "message": "デバイスキーを明らかにする",
+    "englishSource": "Reveal device key"
+  },
+  "revealHotKeyDescription": {
+    "message": "デバイス (ホット) キーは [設定] → [デバイス キーの回転] で回転できるため、seed phrase よりも公開するリスクは低くなります。ただし、デバイス キーを保持している人は誰でも、あなたが回転するまでトランザクションに署名できます。",
+    "englishSource": "Your device (hot) key is rotatable from Settings → Rotate Device Key, so revealing it is lower-stakes than your seed phrase — but anyone who holds it can sign transactions until you rotate."
+  },
+  "hotPrivateKey": {
+    "message": "デバイスの秘密鍵",
+    "englishSource": "Device Private Key"
+  },
+  "hotPublicKeyLabel": {
+    "message": "デバイスの公開鍵",
+    "englishSource": "Device Public Key"
+  },
+  "coldPrivateKey": {
+    "message": "リカバリ (コールド) 秘密キー",
+    "englishSource": "Recovery (Cold) Private Key"
+  },
+  "coldPublicKeyLabel": {
+    "message": "リカバリ (コールド) 公開キー",
+    "englishSource": "Recovery (Cold) Public Key"
+  },
+  "guardianKeysRevealDescription": {
+    "message": "Guardian アカウントは、日常的な署名用のデバイス (ホット) キー、アカウント管理操作用の seed phrase から派生した回復 (コールド) キー、および外部ガーディアン共同署名者の 3 つのキーによって保護されています。以下は、コールド秘密キーと両方の公開キーです。デバイスの秘密キーを公開するには、[設定] → [デバイス キーの公開] を使用します。",
+    "englishSource": "Your Guardian account is protected by three keys: a device (hot) key for routine signing, a recovery (cold) key derived from your seed phrase for account-management operations, and an external guardian co-signer. Below are your cold private key plus both public keys. To reveal the device private key, use Settings → Reveal Device Key."
+  },
+  "hotKeyRevealWarningTitle": {
+    "message": "デバイスキーを公開する前に",
+    "englishSource": "Before you reveal your device key"
+  },
+  "hotKeyRevealWarningBody": {
+    "message": "このキーを持っている人は誰でも、キーをローテーションするまでトランザクションに署名できます。キーが漏洩した場合は、「設定」→「デバイス キーのローテーション」でキーをローテーションします。",
+    "englishSource": "Anyone with this key can sign transactions until you rotate it. If the key is leaked, rotate it via Settings → Rotate Device Key."
+  },
   "invalidUrl": {
     "message": "http:// または https:// で始まる有効な URL を入力してください",
     "englishSource": "Enter a valid URL starting with http:// or https://"
@@ -3086,4 +3170,4 @@
     "message": "わかった",
     "englishSource": "Got it"
   }
-}
+}
\ No newline at end of file
diff --git a/public/_locales/ko/messages.json b/public/_locales/ko/messages.json
index a31702a6f..70aa2bcbb 100644
--- a/public/_locales/ko/messages.json
+++ b/public/_locales/ko/messages.json
@@ -1490,6 +1490,10 @@
     "message": "누구와도 공유하지 마십시오.",
     "englishSource": "Do not share with anyone."
   },
+  "seedPhraseRecoveryCaption": {
+    "message": "seed phrase은 복구 키입니다. 일상적인 거래가 아닌 장치 키를 교체하는 데 사용됩니다.",
+    "englishSource": "Your seed phrase is your recovery key — used to rotate device keys, not for everyday transactions."
+  },
   "select": {
     "message": "선택",
     "note": "Onboarding",
@@ -1672,6 +1676,14 @@
     "message": "Guardian 계정을 새로운 Guardian 엔드포인트로 지정하세요. 스위치는 온체인 제안으로 서명됩니다.",
     "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
   },
+  "switchGuardianConfirmation": {
+    "message": "이는 복구(콜드) 키로 서명되며 현재 보호자가 공동 서명합니다. 귀하의 자금과 계좌는 동일하게 유지됩니다. 계속하다?",
+    "englishSource": "This is signed with your recovery (cold) key and co-signed by your current guardian. Your funds and account stay the same. Continue?"
+  },
+  "confirmSwitchGuardian": {
+    "message": "스위치 확인",
+    "englishSource": "Confirm switch"
+  },
   "switchingGuardian": {
     "message": "보호자를 바꾸는 중...",
     "englishSource": "Switching guardian..."
@@ -1684,6 +1696,78 @@
     "message": "그 사람은 이미 현재 보호자입니다.",
     "englishSource": "That's already your current guardian."
   },
+  "replaceHotKey": {
+    "message": "장치 키 회전",
+    "englishSource": "Rotate device key"
+  },
+  "replaceHotKeyDescription": {
+    "message": "새 장치(핫) 키를 생성하고 현재 온체인 키를 교체합니다. 장치가 손상된 것으로 의심되는 경우 유용합니다.",
+    "englishSource": "Generate a new device (hot) key and replace the current one on-chain. Useful if you suspect your device is compromised."
+  },
+  "replaceHotKeyConfirmation": {
+    "message": "이는 복구(콜드) 키로 서명됩니다. 귀하의 seed phrase은 필요하지 않으며 귀하의 자금과 계좌는 동일하게 유지됩니다. 계속하다?",
+    "englishSource": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?"
+  },
+  "confirmReplaceHotKey": {
+    "message": "순환 확인",
+    "englishSource": "Confirm rotation"
+  },
+  "hotKeyRotated": {
+    "message": "장치 키가 성공적으로 순환되었습니다.",
+    "englishSource": "Device key rotated successfully."
+  },
+  "activateHotKeyBannerTitle": {
+    "message": "장치 키 활성화",
+    "englishSource": "Activate device key"
+  },
+  "activateHotKeyBannerBody": {
+    "message": "복구된 계정에 대한 장치 키를 생성하세요. 보내기 전에 필요합니다.",
+    "englishSource": "Generate a device key for this recovered account. Required before sending."
+  },
+  "activateHotKeyBannerCta": {
+    "message": "활성화",
+    "englishSource": "Activate"
+  },
+  "activateHotKeyBannerError": {
+    "message": "장치 키를 활성화하지 못했습니다. 다시 시도해 보세요.",
+    "englishSource": "Failed to activate device key. Try again."
+  },
+  "revealHotKey": {
+    "message": "장치 키 공개",
+    "englishSource": "Reveal device key"
+  },
+  "revealHotKeyDescription": {
+    "message": "귀하의 장치(핫) 키는 설정 → 장치 키 회전에서 회전 가능하므로 이를 공개하는 것은 seed phrase보다 위험이 낮습니다. 하지만 키를 보유하고 있는 사람은 귀하가 회전할 때까지 거래에 서명할 수 있습니다.",
+    "englishSource": "Your device (hot) key is rotatable from Settings → Rotate Device Key, so revealing it is lower-stakes than your seed phrase — but anyone who holds it can sign transactions until you rotate."
+  },
+  "hotPrivateKey": {
+    "message": "장치 개인 키",
+    "englishSource": "Device Private Key"
+  },
+  "hotPublicKeyLabel": {
+    "message": "장치 공개 키",
+    "englishSource": "Device Public Key"
+  },
+  "coldPrivateKey": {
+    "message": "복구(콜드) 개인 키",
+    "englishSource": "Recovery (Cold) Private Key"
+  },
+  "coldPublicKeyLabel": {
+    "message": "복구(콜드) 공개 키",
+    "englishSource": "Recovery (Cold) Public Key"
+  },
+  "guardianKeysRevealDescription": {
+    "message": "귀하의 Guardian 계정은 정기 서명을 위한 장치(핫) 키, 계정 관리 작업을 위한 seed phrase에서 파생된 복구(콜드) 키, 외부 보호자 공동 서명자의 세 가지 키로 보호됩니다. 다음은 콜드 개인 키와 두 공개 키입니다. 장치 개인 키를 공개하려면 설정 → 장치 키 공개를 사용하세요.",
+    "englishSource": "Your Guardian account is protected by three keys: a device (hot) key for routine signing, a recovery (cold) key derived from your seed phrase for account-management operations, and an external guardian co-signer. Below are your cold private key plus both public keys. To reveal the device private key, use Settings → Reveal Device Key."
+  },
+  "hotKeyRevealWarningTitle": {
+    "message": "장치 키를 공개하기 전에",
+    "englishSource": "Before you reveal your device key"
+  },
+  "hotKeyRevealWarningBody": {
+    "message": "이 키를 가진 사람은 누구나 교체할 때까지 거래에 서명할 수 있습니다. 키가 유출된 경우 설정 → 기기 키 회전을 통해 키를 회전하세요.",
+    "englishSource": "Anyone with this key can sign transactions until you rotate it. If the key is leaked, rotate it via Settings → Rotate Device Key."
+  },
   "invalidUrl": {
     "message": "http:// 또는 https://로 시작하는 유효한 URL을 입력하세요.",
     "englishSource": "Enter a valid URL starting with http:// or https://"
@@ -3086,4 +3170,4 @@
     "message": "알았어요",
     "englishSource": "Got it"
   }
-}
+}
\ No newline at end of file
diff --git a/public/_locales/pl/messages.json b/public/_locales/pl/messages.json
index d02b92d44..2d0d541e9 100644
--- a/public/_locales/pl/messages.json
+++ b/public/_locales/pl/messages.json
@@ -1450,6 +1450,10 @@
     "message": "Nie udostępniaj nikomu.",
     "englishSource": "Do not share with anyone."
   },
+  "seedPhraseRecoveryCaption": {
+    "message": "Twój seed phrase to klucz odzyskiwania — używany do rotacji kluczy urządzenia, a nie do codziennych transakcji.",
+    "englishSource": "Your seed phrase is your recovery key — used to rotate device keys, not for everyday transactions."
+  },
   "select": {
     "message": "Wybierać",
     "englishSource": "Select"
@@ -1614,6 +1618,14 @@
     "message": "Skieruj swoje konto Guardiana na nowy punkt końcowy opiekuna. Przełącznik jest podpisany jako propozycja on-chain.",
     "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
   },
+  "switchGuardianConfirmation": {
+    "message": "Jest to podpisane Twoim (zimnym) kluczem odzyskiwania i podpisane przez Twojego obecnego opiekuna. Twoje środki i konto pozostają takie same. Kontynuować?",
+    "englishSource": "This is signed with your recovery (cold) key and co-signed by your current guardian. Your funds and account stay the same. Continue?"
+  },
+  "confirmSwitchGuardian": {
+    "message": "Potwierdź przełącznik",
+    "englishSource": "Confirm switch"
+  },
   "switchingGuardian": {
     "message": "Zmiana opiekuna...",
     "englishSource": "Switching guardian..."
@@ -1626,6 +1638,78 @@
     "message": "To już twój obecny opiekun.",
     "englishSource": "That's already your current guardian."
   },
+  "replaceHotKey": {
+    "message": "Obróć klucz urządzenia",
+    "englishSource": "Rotate device key"
+  },
+  "replaceHotKeyDescription": {
+    "message": "Wygeneruj nowy (gorący) klucz urządzenia i zastąp bieżący w łańcuchu. Przydatne, jeśli podejrzewasz, że Twoje urządzenie zostało naruszone.",
+    "englishSource": "Generate a new device (hot) key and replace the current one on-chain. Useful if you suspect your device is compromised."
+  },
+  "replaceHotKeyConfirmation": {
+    "message": "Jest to podpisane za pomocą klucza odzyskiwania (zimnego). Twój seed phrase nie jest wymagany, a Twoje środki i konto pozostają takie same. Kontynuować?",
+    "englishSource": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?"
+  },
+  "confirmReplaceHotKey": {
+    "message": "Potwierdź obrót",
+    "englishSource": "Confirm rotation"
+  },
+  "hotKeyRotated": {
+    "message": "Klucz urządzenia został pomyślnie obrócony.",
+    "englishSource": "Device key rotated successfully."
+  },
+  "activateHotKeyBannerTitle": {
+    "message": "Aktywuj klucz urządzenia",
+    "englishSource": "Activate device key"
+  },
+  "activateHotKeyBannerBody": {
+    "message": "Wygeneruj klucz urządzenia dla tego odzyskanego konta. Wymagane przed wysłaniem.",
+    "englishSource": "Generate a device key for this recovered account. Required before sending."
+  },
+  "activateHotKeyBannerCta": {
+    "message": "Aktywować",
+    "englishSource": "Activate"
+  },
+  "activateHotKeyBannerError": {
+    "message": "Nie udało się aktywować klucza urządzenia. Spróbuj ponownie.",
+    "englishSource": "Failed to activate device key. Try again."
+  },
+  "revealHotKey": {
+    "message": "Odkryj klucz urządzenia",
+    "englishSource": "Reveal device key"
+  },
+  "revealHotKeyDescription": {
+    "message": "Twój klucz urządzenia (gorący) można obracać, wybierając Ustawienia → Obróć klucz urządzenia, więc ujawnienie go jest obarczone niższą stawką niż klucz seed phrase — ale każdy, kto go trzyma, może podpisywać transakcje do czasu rotacji.",
+    "englishSource": "Your device (hot) key is rotatable from Settings → Rotate Device Key, so revealing it is lower-stakes than your seed phrase — but anyone who holds it can sign transactions until you rotate."
+  },
+  "hotPrivateKey": {
+    "message": "Klucz prywatny urządzenia",
+    "englishSource": "Device Private Key"
+  },
+  "hotPublicKeyLabel": {
+    "message": "Klucz publiczny urządzenia",
+    "englishSource": "Device Public Key"
+  },
+  "coldPrivateKey": {
+    "message": "Odzyskiwanie (zimnego) klucza prywatnego",
+    "englishSource": "Recovery (Cold) Private Key"
+  },
+  "coldPublicKeyLabel": {
+    "message": "Klucz publiczny odzyskiwania (zimny).",
+    "englishSource": "Recovery (Cold) Public Key"
+  },
+  "guardianKeysRevealDescription": {
+    "message": "Twoje konto Guardian jest chronione trzema kluczami: kluczem urządzenia (gorącym) do rutynowego podpisywania, kluczem odzyskiwania (zimnym) uzyskanym z Twojego seed phrase do operacji zarządzania kontem oraz współsygnatariuszem zewnętrznego opiekuna. Poniżej znajduje się Twój zimny klucz prywatny oraz oba klucze publiczne. Aby ujawnić klucz prywatny urządzenia, użyj opcji Ustawienia → Pokaż klucz urządzenia.",
+    "englishSource": "Your Guardian account is protected by three keys: a device (hot) key for routine signing, a recovery (cold) key derived from your seed phrase for account-management operations, and an external guardian co-signer. Below are your cold private key plus both public keys. To reveal the device private key, use Settings → Reveal Device Key."
+  },
+  "hotKeyRevealWarningTitle": {
+    "message": "Zanim ujawnisz klucz swojego urządzenia",
+    "englishSource": "Before you reveal your device key"
+  },
+  "hotKeyRevealWarningBody": {
+    "message": "Każda osoba posiadająca ten klucz może podpisywać transakcje, dopóki go nie obrócisz. Jeśli klucz wyciekł, obróć go, wybierając Ustawienia → Obróć klucz urządzenia.",
+    "englishSource": "Anyone with this key can sign transactions until you rotate it. If the key is leaked, rotate it via Settings → Rotate Device Key."
+  },
   "invalidUrl": {
     "message": "Wprowadź prawidłowy adres URL zaczynający się od http:// lub https://",
     "englishSource": "Enter a valid URL starting with http:// or https://"
@@ -3011,4 +3095,4 @@
     "message": "Rozumiem",
     "englishSource": "Got it"
   }
-}
+}
\ No newline at end of file
diff --git a/public/_locales/pt/messages.json b/public/_locales/pt/messages.json
index a2dd3d6b0..6d5341848 100644
--- a/public/_locales/pt/messages.json
+++ b/public/_locales/pt/messages.json
@@ -1489,6 +1489,10 @@
     "message": "Não compartilhe com ninguém.",
     "englishSource": "Do not share with anyone."
   },
+  "seedPhraseRecoveryCaption": {
+    "message": "Seu seed phrase é sua chave de recuperação — usada para alternar chaves de dispositivos, não para transações diárias.",
+    "englishSource": "Your seed phrase is your recovery key — used to rotate device keys, not for everyday transactions."
+  },
   "select": {
     "message": "Selecione",
     "note": "Onboarding",
@@ -1670,6 +1674,14 @@
     "message": "Aponte sua conta do Guardian para um novo endpoint do Guardian. A mudança é assinada como uma proposta on-chain.",
     "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
   },
+  "switchGuardianConfirmation": {
+    "message": "Este é assinado com sua chave de recuperação (fria) e co-assinado pelo seu responsável atual. Seus fundos e conta permanecem os mesmos. Continuar?",
+    "englishSource": "This is signed with your recovery (cold) key and co-signed by your current guardian. Your funds and account stay the same. Continue?"
+  },
+  "confirmSwitchGuardian": {
+    "message": "Confirmar mudança",
+    "englishSource": "Confirm switch"
+  },
   "switchingGuardian": {
     "message": "Trocando de guardião...",
     "englishSource": "Switching guardian..."
@@ -1682,6 +1694,78 @@
     "message": "Esse já é seu guardião atual.",
     "englishSource": "That's already your current guardian."
   },
+  "replaceHotKey": {
+    "message": "Girar tecla do dispositivo",
+    "englishSource": "Rotate device key"
+  },
+  "replaceHotKeyDescription": {
+    "message": "Gere uma nova chave de dispositivo (hot) e substitua a atual na cadeia. Útil se você suspeitar que seu dispositivo está comprometido.",
+    "englishSource": "Generate a new device (hot) key and replace the current one on-chain. Useful if you suspect your device is compromised."
+  },
+  "replaceHotKeyConfirmation": {
+    "message": "Isto é assinado com sua chave de recuperação (fria). Seu seed phrase não é necessário e seus fundos e conta permanecem os mesmos. Continuar?",
+    "englishSource": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?"
+  },
+  "confirmReplaceHotKey": {
+    "message": "Confirmar rotação",
+    "englishSource": "Confirm rotation"
+  },
+  "hotKeyRotated": {
+    "message": "Chave do dispositivo girada com sucesso.",
+    "englishSource": "Device key rotated successfully."
+  },
+  "activateHotKeyBannerTitle": {
+    "message": "Ativar chave do dispositivo",
+    "englishSource": "Activate device key"
+  },
+  "activateHotKeyBannerBody": {
+    "message": "Gere uma chave de dispositivo para esta conta recuperada. Obrigatório antes do envio.",
+    "englishSource": "Generate a device key for this recovered account. Required before sending."
+  },
+  "activateHotKeyBannerCta": {
+    "message": "Ativar",
+    "englishSource": "Activate"
+  },
+  "activateHotKeyBannerError": {
+    "message": "Falha ao ativar a chave do dispositivo. Tente novamente.",
+    "englishSource": "Failed to activate device key. Try again."
+  },
+  "revealHotKey": {
+    "message": "Revelar chave do dispositivo",
+    "englishSource": "Reveal device key"
+  },
+  "revealHotKeyDescription": {
+    "message": "A tecla (de atalho) do seu dispositivo pode ser girada em Configurações → Girar chave do dispositivo, portanto, revelá-la tem riscos mais baixos do que seu seed phrase - mas qualquer pessoa que a possua pode assinar transações até que você gire.",
+    "englishSource": "Your device (hot) key is rotatable from Settings → Rotate Device Key, so revealing it is lower-stakes than your seed phrase — but anyone who holds it can sign transactions until you rotate."
+  },
+  "hotPrivateKey": {
+    "message": "Chave privada do dispositivo",
+    "englishSource": "Device Private Key"
+  },
+  "hotPublicKeyLabel": {
+    "message": "Chave pública do dispositivo",
+    "englishSource": "Device Public Key"
+  },
+  "coldPrivateKey": {
+    "message": "Chave privada de recuperação (fria)",
+    "englishSource": "Recovery (Cold) Private Key"
+  },
+  "coldPublicKeyLabel": {
+    "message": "Chave pública de recuperação (fria)",
+    "englishSource": "Recovery (Cold) Public Key"
+  },
+  "guardianKeysRevealDescription": {
+    "message": "Sua conta Guardian é protegida por três chaves: uma chave de dispositivo (quente) para assinatura de rotina, uma chave de recuperação (fria) derivada de seu seed phrase para operações de gerenciamento de conta e um fiador guardião externo. Abaixo estão sua chave privada fria e ambas as chaves públicas. Para revelar a chave privada do dispositivo, use Configurações → Revelar chave do dispositivo.",
+    "englishSource": "Your Guardian account is protected by three keys: a device (hot) key for routine signing, a recovery (cold) key derived from your seed phrase for account-management operations, and an external guardian co-signer. Below are your cold private key plus both public keys. To reveal the device private key, use Settings → Reveal Device Key."
+  },
+  "hotKeyRevealWarningTitle": {
+    "message": "Antes de revelar a chave do seu dispositivo",
+    "englishSource": "Before you reveal your device key"
+  },
+  "hotKeyRevealWarningBody": {
+    "message": "Qualquer pessoa com esta chave pode assinar transações até que você a gire. Se a chave vazar, gire-a em Configurações → Girar chave do dispositivo.",
+    "englishSource": "Anyone with this key can sign transactions until you rotate it. If the key is leaked, rotate it via Settings → Rotate Device Key."
+  },
   "invalidUrl": {
     "message": "Insira um URL válido começando com http:// ou https://",
     "englishSource": "Enter a valid URL starting with http:// or https://"
@@ -3072,4 +3156,4 @@
     "message": "Entendi",
     "englishSource": "Got it"
   }
-}
+}
\ No newline at end of file
diff --git a/public/_locales/ru/messages.json b/public/_locales/ru/messages.json
index 085b755e1..e16a76b6e 100644
--- a/public/_locales/ru/messages.json
+++ b/public/_locales/ru/messages.json
@@ -1490,6 +1490,10 @@
     "message": "Не делитесь ни с кем.",
     "englishSource": "Do not share with anyone."
   },
+  "seedPhraseRecoveryCaption": {
+    "message": "Ваш seed phrase — это ваш ключ восстановления, который используется для смены ключей устройства, а не для повседневных транзакций.",
+    "englishSource": "Your seed phrase is your recovery key — used to rotate device keys, not for everyday transactions."
+  },
   "select": {
     "message": "Выбрать",
     "note": "Onboarding",
@@ -1673,6 +1677,14 @@
     "message": "Направьте свою учетную запись Guardian на новую конечную точку Guardian. Переключатель подписывается как предложение в цепочке.",
     "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
   },
+  "switchGuardianConfirmation": {
+    "message": "Он подписан вашим ключом восстановления (холодным) и подписан вашим нынешним опекуном. Ваши средства и счет останутся прежними. Продолжать?",
+    "englishSource": "This is signed with your recovery (cold) key and co-signed by your current guardian. Your funds and account stay the same. Continue?"
+  },
+  "confirmSwitchGuardian": {
+    "message": "Подтвердить переключение",
+    "englishSource": "Confirm switch"
+  },
   "switchingGuardian": {
     "message": "Смена опекуна...",
     "englishSource": "Switching guardian..."
@@ -1685,6 +1697,78 @@
     "message": "Это уже ваш нынешний опекун.",
     "englishSource": "That's already your current guardian."
   },
+  "replaceHotKey": {
+    "message": "Поворот ключа устройства",
+    "englishSource": "Rotate device key"
+  },
+  "replaceHotKeyDescription": {
+    "message": "Создайте новый (горячий) ключ устройства и замените текущий в цепочке. Полезно, если вы подозреваете, что ваше устройство взломано.",
+    "englishSource": "Generate a new device (hot) key and replace the current one on-chain. Useful if you suspect your device is compromised."
+  },
+  "replaceHotKeyConfirmation": {
+    "message": "Он подписан вашим ключом восстановления (холодным). Ваш seed phrase не требуется, а ваши средства и счет останутся прежними. Продолжать?",
+    "englishSource": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?"
+  },
+  "confirmReplaceHotKey": {
+    "message": "Подтвердить ротацию",
+    "englishSource": "Confirm rotation"
+  },
+  "hotKeyRotated": {
+    "message": "Ключ устройства успешно поменялся.",
+    "englishSource": "Device key rotated successfully."
+  },
+  "activateHotKeyBannerTitle": {
+    "message": "Активировать ключ устройства",
+    "englishSource": "Activate device key"
+  },
+  "activateHotKeyBannerBody": {
+    "message": "Создайте ключ устройства для этой восстановленной учетной записи. Обязательно перед отправкой.",
+    "englishSource": "Generate a device key for this recovered account. Required before sending."
+  },
+  "activateHotKeyBannerCta": {
+    "message": "Активировать",
+    "englishSource": "Activate"
+  },
+  "activateHotKeyBannerError": {
+    "message": "Не удалось активировать ключ устройства. Попробуйте еще раз.",
+    "englishSource": "Failed to activate device key. Try again."
+  },
+  "revealHotKey": {
+    "message": "Показать ключ устройства",
+    "englishSource": "Reveal device key"
+  },
+  "revealHotKeyDescription": {
+    "message": "(Горячую) клавишу вашего устройства можно менять в меню «Настройки» → «Поменять ключ устройства», поэтому ее раскрытие менее важно, чем ваш seed phrase — но любой, кто ее держит, может подписывать транзакции до тех пор, пока вы не поменяете ее.",
+    "englishSource": "Your device (hot) key is rotatable from Settings → Rotate Device Key, so revealing it is lower-stakes than your seed phrase — but anyone who holds it can sign transactions until you rotate."
+  },
+  "hotPrivateKey": {
+    "message": "Закрытый ключ устройства",
+    "englishSource": "Device Private Key"
+  },
+  "hotPublicKeyLabel": {
+    "message": "Открытый ключ устройства",
+    "englishSource": "Device Public Key"
+  },
+  "coldPrivateKey": {
+    "message": "Восстановление (холодного) закрытого ключа",
+    "englishSource": "Recovery (Cold) Private Key"
+  },
+  "coldPublicKeyLabel": {
+    "message": "Открытый ключ восстановления (холодный)",
+    "englishSource": "Recovery (Cold) Public Key"
+  },
+  "guardianKeysRevealDescription": {
+    "message": "Ваша учетная запись Guardian защищена тремя ключами: ключом устройства (горячим) для обычного подписания, ключом восстановления (холодным) ключом, полученным из вашего seed phrase для операций управления учетной записью, и внешним подписавшим лицом-опекуном. Ниже приведены ваш холодный закрытый ключ и оба открытых ключа. Чтобы раскрыть закрытый ключ устройства, выберите «Настройки» → «Показать ключ устройства».",
+    "englishSource": "Your Guardian account is protected by three keys: a device (hot) key for routine signing, a recovery (cold) key derived from your seed phrase for account-management operations, and an external guardian co-signer. Below are your cold private key plus both public keys. To reveal the device private key, use Settings → Reveal Device Key."
+  },
+  "hotKeyRevealWarningTitle": {
+    "message": "Прежде чем раскрыть ключ вашего устройства",
+    "englishSource": "Before you reveal your device key"
+  },
+  "hotKeyRevealWarningBody": {
+    "message": "Любой, у кого есть этот ключ, может подписывать транзакции, пока вы его не поменяете. Если ключ утек, поверните его через «Настройки» → «Повернуть ключ устройства».",
+    "englishSource": "Anyone with this key can sign transactions until you rotate it. If the key is leaked, rotate it via Settings → Rotate Device Key."
+  },
   "invalidUrl": {
     "message": "Введите действительный URL-адрес, начинающийся с http:// или https://.",
     "englishSource": "Enter a valid URL starting with http:// or https://"
@@ -3087,4 +3171,4 @@
     "message": "Понятно",
     "englishSource": "Got it"
   }
-}
+}
\ No newline at end of file
diff --git a/public/_locales/tr/messages.json b/public/_locales/tr/messages.json
index d063f8491..6f895d5a8 100644
--- a/public/_locales/tr/messages.json
+++ b/public/_locales/tr/messages.json
@@ -1490,6 +1490,10 @@
     "message": "Kimseyle paylaşmayın.",
     "englishSource": "Do not share with anyone."
   },
+  "seedPhraseRecoveryCaption": {
+    "message": "seed phrase kurtarma anahtarınızdır; günlük işlemler için değil, cihaz anahtarlarını döndürmek için kullanılır.",
+    "englishSource": "Your seed phrase is your recovery key — used to rotate device keys, not for everyday transactions."
+  },
   "select": {
     "message": "Seç",
     "noteeee": "Onboarding",
@@ -1672,6 +1676,14 @@
     "message": "Guardian hesabınızı yeni bir koruyucu uç noktasına yönlendirin. Anahtar, zincir içi bir teklif olarak imzalandı.",
     "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
   },
+  "switchGuardianConfirmation": {
+    "message": "Bu, kurtarma (soğuk) anahtarınızla imzalanır ve mevcut vasiniz tarafından da imzalanır. Paranız ve hesabınız aynı kalır. Devam etmek?",
+    "englishSource": "This is signed with your recovery (cold) key and co-signed by your current guardian. Your funds and account stay the same. Continue?"
+  },
+  "confirmSwitchGuardian": {
+    "message": "Anahtarı onayla",
+    "englishSource": "Confirm switch"
+  },
   "switchingGuardian": {
     "message": "Vasi değiştiriliyor...",
     "englishSource": "Switching guardian..."
@@ -1684,6 +1696,78 @@
     "message": "Bu zaten sizin şu anki vasiniz.",
     "englishSource": "That's already your current guardian."
   },
+  "replaceHotKey": {
+    "message": "Cihaz anahtarını döndür",
+    "englishSource": "Rotate device key"
+  },
+  "replaceHotKeyDescription": {
+    "message": "Yeni bir cihaz (geçiş) anahtarı oluşturun ve zincirdeki mevcut olanı değiştirin. Cihazınızın güvenliğinin ihlal edildiğinden şüpheleniyorsanız kullanışlıdır.",
+    "englishSource": "Generate a new device (hot) key and replace the current one on-chain. Useful if you suspect your device is compromised."
+  },
+  "replaceHotKeyConfirmation": {
+    "message": "Bu, kurtarma (soğuk) anahtarınızla imzalanır. seed phrase kodunuz gerekli değildir ve paranız ve hesabınız aynı kalır. Devam etmek?",
+    "englishSource": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?"
+  },
+  "confirmReplaceHotKey": {
+    "message": "Döndürmeyi onayla",
+    "englishSource": "Confirm rotation"
+  },
+  "hotKeyRotated": {
+    "message": "Cihaz anahtarı başarıyla döndürüldü.",
+    "englishSource": "Device key rotated successfully."
+  },
+  "activateHotKeyBannerTitle": {
+    "message": "Cihaz anahtarını etkinleştir",
+    "englishSource": "Activate device key"
+  },
+  "activateHotKeyBannerBody": {
+    "message": "Kurtarılan bu hesap için bir cihaz anahtarı oluşturun. Göndermeden önce gereklidir.",
+    "englishSource": "Generate a device key for this recovered account. Required before sending."
+  },
+  "activateHotKeyBannerCta": {
+    "message": "Etkinleştir",
+    "englishSource": "Activate"
+  },
+  "activateHotKeyBannerError": {
+    "message": "Cihaz anahtarı etkinleştirilemedi. Tekrar deneyin.",
+    "englishSource": "Failed to activate device key. Try again."
+  },
+  "revealHotKey": {
+    "message": "Cihaz anahtarını göster",
+    "englishSource": "Reveal device key"
+  },
+  "revealHotKeyDescription": {
+    "message": "Cihaz (geçiş) anahtarınız, Ayarlar → Cihaz Anahtarını Döndür seçeneğinden döndürülebilir; bu nedenle, bunun açığa çıkarılması seed phrase anahtarınızdan daha düşük risklidir; ancak onu tutan herkes, siz rotasyon yapana kadar işlemleri imzalayabilir.",
+    "englishSource": "Your device (hot) key is rotatable from Settings → Rotate Device Key, so revealing it is lower-stakes than your seed phrase — but anyone who holds it can sign transactions until you rotate."
+  },
+  "hotPrivateKey": {
+    "message": "Cihaz Özel Anahtarı",
+    "englishSource": "Device Private Key"
+  },
+  "hotPublicKeyLabel": {
+    "message": "Cihaz Genel Anahtarı",
+    "englishSource": "Device Public Key"
+  },
+  "coldPrivateKey": {
+    "message": "Kurtarma (Soğuk) Özel Anahtar",
+    "englishSource": "Recovery (Cold) Private Key"
+  },
+  "coldPublicKeyLabel": {
+    "message": "Kurtarma (Soğuk) Genel Anahtar",
+    "englishSource": "Recovery (Cold) Public Key"
+  },
+  "guardianKeysRevealDescription": {
+    "message": "Guardian hesabınız üç anahtarla korunur: rutin imzalama için bir cihaz (geçici) anahtar, hesap yönetimi işlemleri için seed phrase hesabınızdan türetilen bir kurtarma (soğuk) anahtar ve harici bir veli ortak imzalayan. Aşağıda soğuk özel anahtarınız ve her iki genel anahtarınız bulunmaktadır. Cihazın özel anahtarını ortaya çıkarmak için Ayarlar → Cihaz Anahtarını Göster seçeneğini kullanın.",
+    "englishSource": "Your Guardian account is protected by three keys: a device (hot) key for routine signing, a recovery (cold) key derived from your seed phrase for account-management operations, and an external guardian co-signer. Below are your cold private key plus both public keys. To reveal the device private key, use Settings → Reveal Device Key."
+  },
+  "hotKeyRevealWarningTitle": {
+    "message": "Cihaz anahtarınızı açıklamadan önce",
+    "englishSource": "Before you reveal your device key"
+  },
+  "hotKeyRevealWarningBody": {
+    "message": "Bu anahtara sahip olan herkes, siz onu değiştirene kadar işlemleri imzalayabilir. Anahtar sızdırılmışsa, Ayarlar → Cihaz Anahtarını Döndür seçeneğini kullanarak onu döndürün.",
+    "englishSource": "Anyone with this key can sign transactions until you rotate it. If the key is leaked, rotate it via Settings → Rotate Device Key."
+  },
   "invalidUrl": {
     "message": "http:// veya https:// ile başlayan geçerli bir URL girin",
     "englishSource": "Enter a valid URL starting with http:// or https://"
@@ -3074,4 +3158,4 @@
     "message": "Anladım",
     "englishSource": "Got it"
   }
-}
+}
\ No newline at end of file
diff --git a/public/_locales/uk/messages.json b/public/_locales/uk/messages.json
index 4ed211141..379d00061 100644
--- a/public/_locales/uk/messages.json
+++ b/public/_locales/uk/messages.json
@@ -1490,6 +1490,10 @@
     "message": "Ні з ким не діліться.",
     "englishSource": "Do not share with anyone."
   },
+  "seedPhraseRecoveryCaption": {
+    "message": "Ваш seed phrase є вашим ключем відновлення, який використовується для ротації ключів пристрою, а не для щоденних транзакцій.",
+    "englishSource": "Your seed phrase is your recovery key — used to rotate device keys, not for everyday transactions."
+  },
   "select": {
     "message": "Вибрати",
     "note": "Onboarding",
@@ -1673,6 +1677,14 @@
     "message": "Направте свій обліковий запис Guardian на нову кінцеву точку опікуна. Комутатор підписаний як пропозиція в ланцюжку.",
     "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
   },
+  "switchGuardianConfirmation": {
+    "message": "Це підписано вашим (холодним) ключем відновлення та підписано вашим поточним опікуном. Ваші кошти та рахунок залишаються без змін. Продовжити?",
+    "englishSource": "This is signed with your recovery (cold) key and co-signed by your current guardian. Your funds and account stay the same. Continue?"
+  },
+  "confirmSwitchGuardian": {
+    "message": "Підтвердьте перемикання",
+    "englishSource": "Confirm switch"
+  },
   "switchingGuardian": {
     "message": "Зміна опікуна...",
     "englishSource": "Switching guardian..."
@@ -1685,6 +1697,78 @@
     "message": "Це вже ваш поточний опікун.",
     "englishSource": "That's already your current guardian."
   },
+  "replaceHotKey": {
+    "message": "Поверніть клавішу пристрою",
+    "englishSource": "Rotate device key"
+  },
+  "replaceHotKeyDescription": {
+    "message": "Згенеруйте новий (гарячий) ключ пристрою та замініть поточний у мережі. Корисно, якщо ви підозрюєте, що ваш пристрій зламано.",
+    "englishSource": "Generate a new device (hot) key and replace the current one on-chain. Useful if you suspect your device is compromised."
+  },
+  "replaceHotKeyConfirmation": {
+    "message": "Це підписано вашим (холодним) ключем відновлення. Ваш seed phrase не потрібен, а ваші кошти та рахунок залишаються незмінними. Продовжити?",
+    "englishSource": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?"
+  },
+  "confirmReplaceHotKey": {
+    "message": "Підтвердити обертання",
+    "englishSource": "Confirm rotation"
+  },
+  "hotKeyRotated": {
+    "message": "Ключ пристрою успішно повернуто.",
+    "englishSource": "Device key rotated successfully."
+  },
+  "activateHotKeyBannerTitle": {
+    "message": "Активуйте ключ пристрою",
+    "englishSource": "Activate device key"
+  },
+  "activateHotKeyBannerBody": {
+    "message": "Згенеруйте ключ пристрою для цього відновленого облікового запису. Обов'язково перед відправкою.",
+    "englishSource": "Generate a device key for this recovered account. Required before sending."
+  },
+  "activateHotKeyBannerCta": {
+    "message": "активувати",
+    "englishSource": "Activate"
+  },
+  "activateHotKeyBannerError": {
+    "message": "Не вдалося активувати ключ пристрою. Спробуйте знову.",
+    "englishSource": "Failed to activate device key. Try again."
+  },
+  "revealHotKey": {
+    "message": "Розкрити ключ пристрою",
+    "englishSource": "Reveal device key"
+  },
+  "revealHotKeyDescription": {
+    "message": "Ваш (гарячий) ключ пристрою можна обертати в меню «Налаштування» → «Обертати ключ пристрою», тому його розкриття є нижчим, ніж ваш seed phrase — але будь-хто, хто його тримає, може підписувати транзакції, доки ви не повернете його.",
+    "englishSource": "Your device (hot) key is rotatable from Settings → Rotate Device Key, so revealing it is lower-stakes than your seed phrase — but anyone who holds it can sign transactions until you rotate."
+  },
+  "hotPrivateKey": {
+    "message": "Приватний ключ пристрою",
+    "englishSource": "Device Private Key"
+  },
+  "hotPublicKeyLabel": {
+    "message": "Відкритий ключ пристрою",
+    "englishSource": "Device Public Key"
+  },
+  "coldPrivateKey": {
+    "message": "Приватний ключ відновлення (холодний).",
+    "englishSource": "Recovery (Cold) Private Key"
+  },
+  "coldPublicKeyLabel": {
+    "message": "Відновлення (холодного) відкритого ключа",
+    "englishSource": "Recovery (Cold) Public Key"
+  },
+  "guardianKeysRevealDescription": {
+    "message": "Ваш обліковий запис опікуна захищено трьома ключами: ключем пристрою (гарячим) для звичайного підпису, ключем відновлення (холодним), отриманим із вашого seed phrase для операцій керування обліковим записом, і зовнішнім співпідписувачем опікуна. Нижче ваш холодний приватний ключ плюс обидва відкритих ключі. Щоб розкрити закритий ключ пристрою, скористайтеся Налаштуваннями → Відкрити ключ пристрою.",
+    "englishSource": "Your Guardian account is protected by three keys: a device (hot) key for routine signing, a recovery (cold) key derived from your seed phrase for account-management operations, and an external guardian co-signer. Below are your cold private key plus both public keys. To reveal the device private key, use Settings → Reveal Device Key."
+  },
+  "hotKeyRevealWarningTitle": {
+    "message": "Перш ніж відкрити ключ свого пристрою",
+    "englishSource": "Before you reveal your device key"
+  },
+  "hotKeyRevealWarningBody": {
+    "message": "Будь-хто з цим ключем може підписувати транзакції, доки ви його не повернете. Якщо ключ витік, поверніть його через Налаштування → Обернути ключ пристрою.",
+    "englishSource": "Anyone with this key can sign transactions until you rotate it. If the key is leaked, rotate it via Settings → Rotate Device Key."
+  },
   "invalidUrl": {
     "message": "Введіть дійсну URL-адресу, яка починається з http:// або https://",
     "englishSource": "Enter a valid URL starting with http:// or https://"
@@ -3087,4 +3171,4 @@
     "message": "зрозумів",
     "englishSource": "Got it"
   }
-}
+}
\ No newline at end of file
diff --git a/public/_locales/zh_CN/messages.json b/public/_locales/zh_CN/messages.json
index ad62aa19d..e59c345c9 100644
--- a/public/_locales/zh_CN/messages.json
+++ b/public/_locales/zh_CN/messages.json
@@ -1508,6 +1508,10 @@
     "message": "不要与任何人分享。",
     "englishSource": "Do not share with anyone."
   },
+  "seedPhraseRecoveryCaption": {
+    "message": "您的 seed phrase 是您的恢复密钥 — 用于轮换设备密钥，而不是用于日常交易。",
+    "englishSource": "Your seed phrase is your recovery key — used to rotate device keys, not for everyday transactions."
+  },
   "select": {
     "message": "选择",
     "note": "Onboarding",
@@ -1690,6 +1694,14 @@
     "message": "将您的监护人帐户指向新的监护人端点。该切换被签署为链上提案。",
     "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
   },
+  "switchGuardianConfirmation": {
+    "message": "该密钥使用您的恢复（冷）密钥进行签名，并由您当前的监护人共同签署。您的资金和账户保持不变。继续？",
+    "englishSource": "This is signed with your recovery (cold) key and co-signed by your current guardian. Your funds and account stay the same. Continue?"
+  },
+  "confirmSwitchGuardian": {
+    "message": "确认切换",
+    "englishSource": "Confirm switch"
+  },
   "switchingGuardian": {
     "message": "切换监护人...",
     "englishSource": "Switching guardian..."
@@ -1702,6 +1714,78 @@
     "message": "那已经是你现在的监护人了。",
     "englishSource": "That's already your current guardian."
   },
+  "replaceHotKey": {
+    "message": "旋转设备密钥",
+    "englishSource": "Rotate device key"
+  },
+  "replaceHotKeyDescription": {
+    "message": "生成一个新的设备（热）密钥并替换链上当前的设备密钥。如果您怀疑您的设备受到威胁，这很有用。",
+    "englishSource": "Generate a new device (hot) key and replace the current one on-chain. Useful if you suspect your device is compromised."
+  },
+  "replaceHotKeyConfirmation": {
+    "message": "这是用您的恢复（冷）密钥签名的。您的 seed phrase 不是必需的，您的资金和帐户保持不变。继续？",
+    "englishSource": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?"
+  },
+  "confirmReplaceHotKey": {
+    "message": "确认轮换",
+    "englishSource": "Confirm rotation"
+  },
+  "hotKeyRotated": {
+    "message": "设备密钥轮换成功。",
+    "englishSource": "Device key rotated successfully."
+  },
+  "activateHotKeyBannerTitle": {
+    "message": "激活设备密钥",
+    "englishSource": "Activate device key"
+  },
+  "activateHotKeyBannerBody": {
+    "message": "为该恢复的帐户生成设备密钥。发送前需要。",
+    "englishSource": "Generate a device key for this recovered account. Required before sending."
+  },
+  "activateHotKeyBannerCta": {
+    "message": "激活",
+    "englishSource": "Activate"
+  },
+  "activateHotKeyBannerError": {
+    "message": "无法激活设备密钥。再试一次。",
+    "englishSource": "Failed to activate device key. Try again."
+  },
+  "revealHotKey": {
+    "message": "显示设备密钥",
+    "englishSource": "Reveal device key"
+  },
+  "revealHotKeyDescription": {
+    "message": "您的设备（热）密钥可通过“设置”→“旋转设备密钥”进行旋转，因此暴露它的风险比您的 seed phrase 低 - 但持有它的任何人都可以签署交易，直到您旋转为止。",
+    "englishSource": "Your device (hot) key is rotatable from Settings → Rotate Device Key, so revealing it is lower-stakes than your seed phrase — but anyone who holds it can sign transactions until you rotate."
+  },
+  "hotPrivateKey": {
+    "message": "设备私钥",
+    "englishSource": "Device Private Key"
+  },
+  "hotPublicKeyLabel": {
+    "message": "设备公钥",
+    "englishSource": "Device Public Key"
+  },
+  "coldPrivateKey": {
+    "message": "恢复（冷）私钥",
+    "englishSource": "Recovery (Cold) Private Key"
+  },
+  "coldPublicKeyLabel": {
+    "message": "恢复（冷）公钥",
+    "englishSource": "Recovery (Cold) Public Key"
+  },
+  "guardianKeysRevealDescription": {
+    "message": "您的监护人帐户受到三个密钥的保护：用于例行签名的设备（热）密钥、从您的 seed phrase 派生的用于帐户管理操作的恢复（冷）密钥，以及外部监护人共同签名者。下面是您的冷私钥和两个公钥。要显示设备私钥，请使用“设置”→“显示设备密钥”。",
+    "englishSource": "Your Guardian account is protected by three keys: a device (hot) key for routine signing, a recovery (cold) key derived from your seed phrase for account-management operations, and an external guardian co-signer. Below are your cold private key plus both public keys. To reveal the device private key, use Settings → Reveal Device Key."
+  },
+  "hotKeyRevealWarningTitle": {
+    "message": "在透露您的设备密钥之前",
+    "englishSource": "Before you reveal your device key"
+  },
+  "hotKeyRevealWarningBody": {
+    "message": "拥有此密钥的任何人都可以签署交易，直到您轮换它为止。如果密钥泄漏，请通过“设置”→“轮换设备密钥”进行轮换。",
+    "englishSource": "Anyone with this key can sign transactions until you rotate it. If the key is leaked, rotate it via Settings → Rotate Device Key."
+  },
   "invalidUrl": {
     "message": "输入以 http:// 或 https:// 开头的有效 URL",
     "englishSource": "Enter a valid URL starting with http:// or https://"
@@ -3104,4 +3188,4 @@
     "message": "知道了",
     "englishSource": "Got it"
   }
-}
+}
\ No newline at end of file
diff --git a/public/_locales/zh_TW/messages.json b/public/_locales/zh_TW/messages.json
index 8f801c31b..4550dfb54 100644
--- a/public/_locales/zh_TW/messages.json
+++ b/public/_locales/zh_TW/messages.json
@@ -1499,6 +1499,10 @@
     "message": "不要与任何人分享。",
     "englishSource": "Do not share with anyone."
   },
+  "seedPhraseRecoveryCaption": {
+    "message": "您的 seed phrase 是您的恢复密钥 — 用于轮换设备密钥，而不是用于日常交易。",
+    "englishSource": "Your seed phrase is your recovery key — used to rotate device keys, not for everyday transactions."
+  },
   "select": {
     "message": "選擇",
     "note": "Onboarding",
@@ -1681,6 +1685,14 @@
     "message": "将您的监护人帐户指向新的监护人端点。该切换被签署为链上提案。",
     "englishSource": "Point your Guardian account at a new guardian endpoint. The switch is signed as an on-chain proposal."
   },
+  "switchGuardianConfirmation": {
+    "message": "该密钥使用您的恢复（冷）密钥进行签名，并由您当前的监护人共同签署。您的资金和账户保持不变。继续？",
+    "englishSource": "This is signed with your recovery (cold) key and co-signed by your current guardian. Your funds and account stay the same. Continue?"
+  },
+  "confirmSwitchGuardian": {
+    "message": "确认切换",
+    "englishSource": "Confirm switch"
+  },
   "switchingGuardian": {
     "message": "切换监护人...",
     "englishSource": "Switching guardian..."
@@ -1693,6 +1705,78 @@
     "message": "那已经是你现在的监护人了。",
     "englishSource": "That's already your current guardian."
   },
+  "replaceHotKey": {
+    "message": "旋转设备密钥",
+    "englishSource": "Rotate device key"
+  },
+  "replaceHotKeyDescription": {
+    "message": "生成一个新的设备（热）密钥并替换链上当前的设备密钥。如果您怀疑您的设备受到威胁，这很有用。",
+    "englishSource": "Generate a new device (hot) key and replace the current one on-chain. Useful if you suspect your device is compromised."
+  },
+  "replaceHotKeyConfirmation": {
+    "message": "这是用您的恢复（冷）密钥签名的。您的 seed phrase 不是必需的，您的资金和帐户保持不变。继续？",
+    "englishSource": "This is signed with your recovery (cold) key. Your seed phrase is not required, and your funds and account stay the same. Continue?"
+  },
+  "confirmReplaceHotKey": {
+    "message": "确认轮换",
+    "englishSource": "Confirm rotation"
+  },
+  "hotKeyRotated": {
+    "message": "设备密钥轮换成功。",
+    "englishSource": "Device key rotated successfully."
+  },
+  "activateHotKeyBannerTitle": {
+    "message": "激活设备密钥",
+    "englishSource": "Activate device key"
+  },
+  "activateHotKeyBannerBody": {
+    "message": "为该恢复的帐户生成设备密钥。发送前需要。",
+    "englishSource": "Generate a device key for this recovered account. Required before sending."
+  },
+  "activateHotKeyBannerCta": {
+    "message": "激活",
+    "englishSource": "Activate"
+  },
+  "activateHotKeyBannerError": {
+    "message": "无法激活设备密钥。再试一次。",
+    "englishSource": "Failed to activate device key. Try again."
+  },
+  "revealHotKey": {
+    "message": "显示设备密钥",
+    "englishSource": "Reveal device key"
+  },
+  "revealHotKeyDescription": {
+    "message": "您的设备（热）密钥可通过“设置”→“旋转设备密钥”进行旋转，因此暴露它的风险比您的 seed phrase 低 - 但持有它的任何人都可以签署交易，直到您旋转为止。",
+    "englishSource": "Your device (hot) key is rotatable from Settings → Rotate Device Key, so revealing it is lower-stakes than your seed phrase — but anyone who holds it can sign transactions until you rotate."
+  },
+  "hotPrivateKey": {
+    "message": "设备私钥",
+    "englishSource": "Device Private Key"
+  },
+  "hotPublicKeyLabel": {
+    "message": "设备公钥",
+    "englishSource": "Device Public Key"
+  },
+  "coldPrivateKey": {
+    "message": "恢复（冷）私钥",
+    "englishSource": "Recovery (Cold) Private Key"
+  },
+  "coldPublicKeyLabel": {
+    "message": "恢复（冷）公钥",
+    "englishSource": "Recovery (Cold) Public Key"
+  },
+  "guardianKeysRevealDescription": {
+    "message": "您的监护人帐户受到三个密钥的保护：用于例行签名的设备（热）密钥、从您的 seed phrase 派生的用于帐户管理操作的恢复（冷）密钥，以及外部监护人共同签名者。下面是您的冷私钥和两个公钥。要显示设备私钥，请使用“设置”→“显示设备密钥”。",
+    "englishSource": "Your Guardian account is protected by three keys: a device (hot) key for routine signing, a recovery (cold) key derived from your seed phrase for account-management operations, and an external guardian co-signer. Below are your cold private key plus both public keys. To reveal the device private key, use Settings → Reveal Device Key."
+  },
+  "hotKeyRevealWarningTitle": {
+    "message": "在透露您的设备密钥之前",
+    "englishSource": "Before you reveal your device key"
+  },
+  "hotKeyRevealWarningBody": {
+    "message": "拥有此密钥的任何人都可以签署交易，直到您轮换它为止。如果密钥泄漏，请通过“设置”→“轮换设备密钥”进行轮换。",
+    "englishSource": "Anyone with this key can sign transactions until you rotate it. If the key is leaked, rotate it via Settings → Rotate Device Key."
+  },
   "invalidUrl": {
     "message": "输入以 http:// 或 https:// 开头的有效 URL",
     "englishSource": "Enter a valid URL starting with http:// or https://"
@@ -3095,4 +3179,4 @@
     "message": "知道了",
     "englishSource": "Got it"
   }
-}
+}
\ No newline at end of file

From 59ea1808855e3131982f34d08e4f09c39d2dc31b Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Tue, 23 Jun 2026 17:51:20 +0530
Subject: [PATCH 56/71] test: for secure hot key facade and fix broken ones

---
 jest.config.ts                                |  2 +-
 src/app/pages/Settings.tsx                    | 17 ++--
 .../activity/transactions.branches.test.ts    |  8 ++
 .../miden/activity/transactions.gaps.test.ts  |  5 +-
 .../activity/transactions.guardian.test.ts    |  6 +-
 src/lib/miden/back/vault.test.ts              |  3 +-
 src/lib/miden/front/guardian-manager.ts       | 70 +++++++-------
 src/lib/miden/guardian/index.test.ts          |  4 +-
 src/lib/miden/sdk/miden-client-interface.ts   |  2 +-
 src/lib/secure-hot-key/hotKeyPlugin.test.ts   | 20 ++++
 src/lib/secure-hot-key/index.test.ts          | 94 +++++++++++++++++++
 src/lib/secure-hot-key/jsFallback.test.ts     | 85 +++++++++++++++++
 12 files changed, 265 insertions(+), 51 deletions(-)
 create mode 100644 src/lib/secure-hot-key/hotKeyPlugin.test.ts
 create mode 100644 src/lib/secure-hot-key/index.test.ts
 create mode 100644 src/lib/secure-hot-key/jsFallback.test.ts

diff --git a/jest.config.ts b/jest.config.ts
index 4babe2ac2..33503fc0f 100644
--- a/jest.config.ts
+++ b/jest.config.ts
@@ -70,7 +70,7 @@ export default {
   ],
   moduleFileExtensions: ['ts', 'tsx', 'js'],
   modulePathIgnorePatterns: ['<rootDir>/sdk-debug/'],
-  testPathIgnorePatterns: ['<rootDir>/playwright/', '<rootDir>/mobile-e2e/'],
+  testPathIgnorePatterns: ['<rootDir>/playwright/', '<rootDir>/mobile-e2e/', '<rootDir>/ios/App/build/'],
   setupFiles: ['dotenv/config', '@serh11p/jest-webextension-mock', 'fake-indexeddb/auto'],
   setupFilesAfterEnv: ['./jest.setup.js']
 };
diff --git a/src/app/pages/Settings.tsx b/src/app/pages/Settings.tsx
index 79dcd90e6..d8e43d404 100644
--- a/src/app/pages/Settings.tsx
+++ b/src/app/pages/Settings.tsx
@@ -268,11 +268,14 @@ const Settings: FC<SettingsProps> = ({ tabSlug }) => {
   const isGuardianAccount = currentAccountType === WalletType.Guardian;
   const hasActivatedHotKey = Boolean(currentAccountHotPublicKey);
 
-  const tabIsVisible = (tab: Tab) => {
-    if (tab.guardianOnly && !isGuardianAccount) return false;
-    if (tab.requiresActivatedHotKey && !hasActivatedHotKey) return false;
-    return true;
-  };
+  const tabIsVisible = useCallback(
+    (tab: Tab) => {
+      if (tab.guardianOnly && !isGuardianAccount) return false;
+      if (tab.requiresActivatedHotKey && !hasActivatedHotKey) return false;
+      return true;
+    },
+    [hasActivatedHotKey, isGuardianAccount]
+  );
 
   // Filter tabs that are gated to Guardian accounts. Non-Guardian users don't see
   // the Guardian Settings entry at all (menu, drawer, or routable page).
@@ -282,12 +285,12 @@ const Settings: FC<SettingsProps> = ({ tabSlug }) => {
         ...group,
         tabs: group.tabs.filter(tabIsVisible)
       })).filter(group => group.tabs.length > 0),
-    [isGuardianAccount, hasActivatedHotKey]
+    [tabIsVisible]
   );
 
   const allTabs = useMemo(
     () => [...tabGroups.flatMap(g => g.tabs), ...HIDDEN_TABS.filter(tabIsVisible)],
-    [tabGroups, isGuardianAccount, hasActivatedHotKey]
+    [tabGroups, tabIsVisible]
   );
 
   const drawerTabs = useMemo(() => tabGroups.flatMap(g => g.tabs).filter(t => t.isDrawer), [tabGroups]);
diff --git a/src/lib/miden/activity/transactions.branches.test.ts b/src/lib/miden/activity/transactions.branches.test.ts
index baf75c10e..bcd055133 100644
--- a/src/lib/miden/activity/transactions.branches.test.ts
+++ b/src/lib/miden/activity/transactions.branches.test.ts
@@ -167,8 +167,16 @@ Object.defineProperty(globalThis.navigator, 'locks', {
   configurable: true
 });
 
+const stubGuardianProvider = {
+  getAccounts: jest.fn(async () => []),
+  getPublicKeyForCommitment: jest.fn(async () => 'pk'),
+  signWord: jest.fn(async () => 'sig')
+};
+
 beforeEach(() => {
   jest.clearAllMocks();
+  mockLastAuthError.mockReset();
+  mockLastAuthError.mockImplementation((): unknown => null);
   txStore.length = 0;
   _g.__txBrTest.liveQueryCallbacks.length = 0;
 });
diff --git a/src/lib/miden/activity/transactions.gaps.test.ts b/src/lib/miden/activity/transactions.gaps.test.ts
index 442d5ada3..53f1fc26b 100644
--- a/src/lib/miden/activity/transactions.gaps.test.ts
+++ b/src/lib/miden/activity/transactions.gaps.test.ts
@@ -677,7 +677,10 @@ describe('generateTransaction execute + consume default switch arms', () => {
     guardianManager.isGuardianAccount.mockResolvedValueOnce(true);
     const fakeMultisigService = {
       createConsumeNotesProposal: jest.fn(async () => ({ id: 'proposal-1' })),
-      signAndCreateTransactionRequest: jest.fn(async () => ({ serialize: () => new Uint8Array([1]), authArg: () => undefined })),
+      signAndCreateTransactionRequest: jest.fn(async () => ({
+        serialize: () => new Uint8Array([1]),
+        authArg: () => undefined
+      })),
       sync: jest.fn(async () => {})
     };
     guardianManager.getOrCreateMultisigService.mockResolvedValueOnce(fakeMultisigService);
diff --git a/src/lib/miden/activity/transactions.guardian.test.ts b/src/lib/miden/activity/transactions.guardian.test.ts
index bd733f827..b8d41bc7b 100644
--- a/src/lib/miden/activity/transactions.guardian.test.ts
+++ b/src/lib/miden/activity/transactions.guardian.test.ts
@@ -257,7 +257,7 @@ describe('generateTransaction — Guardian routing', () => {
     );
 
     expect(multisigService.createSendProposal).toHaveBeenCalledWith('recipient', 'faucet', 1000n);
-    expect(multisigService.signAndCreateTransactionRequest).toHaveBeenCalledWith('prop-1');
+    expect(multisigService.signAndCreateTransactionRequest).toHaveBeenCalledWith('prop-1', undefined);
     expect(multisigService.sync).toHaveBeenCalled();
   });
 
@@ -366,7 +366,7 @@ describe('generateTransaction — Guardian routing', () => {
     // After the multisigService/signingService consolidation, the hot service IS
     // the only service for non-replace-hot-key types — it drives the final
     // signAndCreateTransactionRequest.
-    expect(multisigService.signAndCreateTransactionRequest).toHaveBeenCalledWith('prop-switch');
+    expect(multisigService.signAndCreateTransactionRequest).toHaveBeenCalledWith('prop-switch', undefined);
     expect(waitForTransactionCommit).toHaveBeenCalledWith('exec-tx-hash');
     expect(multisigService.finalizeGuardianSwitch).toHaveBeenCalledWith('https://new.guardian');
   });
@@ -431,7 +431,7 @@ describe('generateTransaction — Guardian routing', () => {
     // Persist BEFORE submit so the new ciphertext is durable on crash.
     expect(persistNewHotKey).toHaveBeenCalledWith('new-hot-pub', 'new-cx');
     // Cold (signingService) drives signAndCreateTransactionRequest, NOT hot.
-    expect(coldService.signAndCreateTransactionRequest).toHaveBeenCalledWith('prop-replace');
+    expect(coldService.signAndCreateTransactionRequest).toHaveBeenCalledWith('prop-replace', undefined);
     // Persist newHotPublicKey on the transaction row so complete can find it.
     expect((submittedRow.extraInputs as { newHotPublicKey?: string }).newHotPublicKey).toBe('new-hot-pub');
     // Replace-hot-key shares the confirming wait with switch-guardian.
diff --git a/src/lib/miden/back/vault.test.ts b/src/lib/miden/back/vault.test.ts
index 676fe4097..3410508f2 100644
--- a/src/lib/miden/back/vault.test.ts
+++ b/src/lib/miden/back/vault.test.ts
@@ -69,8 +69,7 @@ const mockGetMidenClient = jest.fn(async (_options?: any) => ({
   // tests keep asserting on it.
   importAccountBySeed: async (_walletType: any, seed: Uint8Array) => mockImportPublicMidenWalletFromSeed(seed),
   createGuardianMidenWallet: (...args: unknown[]) => mockCreateGuardianMidenWallet(...(args as [Uint8Array])),
-  recoverGuardianAccountsBySeed: (...args: unknown[]) =>
-    mockRecoverGuardianAccountsBySeed(...(args as [any, string])),
+  recoverGuardianAccountsBySeed: (...args: unknown[]) => mockRecoverGuardianAccountsBySeed(...(args as [any, string])),
   getAccounts: () => mockGetAccounts(),
   getAccount: (id: string) => mockGetAccount(id),
   syncState: () => mockSyncState(),
diff --git a/src/lib/miden/front/guardian-manager.ts b/src/lib/miden/front/guardian-manager.ts
index 92f4f30c3..1c6ee1057 100644
--- a/src/lib/miden/front/guardian-manager.ts
+++ b/src/lib/miden/front/guardian-manager.ts
@@ -49,38 +49,6 @@ export async function getOrCreateMultisigService(
   provider: GuardianAccountProvider
 ): Promise<MultisigService> {
   console.log(`[Guardian Manager] Getting/creating MultisigService for account: ${accountPublicKey}`);
-  // Resolve the WalletAccount upfront — needed for both the cache drift
-  // check (hotPublicKey can rotate) and the subsequent service init.
-  const accounts = await provider.getAccounts();
-  const account = accounts.find(acc => acc.publicKey === accountPublicKey);
-  if (!account || account.type !== WalletType.Guardian) {
-    throw new Error('Account is not a Guardian account');
-  }
-  // Hot pubkey lives on the WalletAccount record (set at create time). A
-  // Guardian account without it is either a legacy single-Falcon-key record
-  // (pre-migration) or an in-flight write that crashed mid-create — both are
-  // unsigned states that should fail loudly rather than silently fall back.
-  if (!account.hotPublicKey) {
-    throw new Error(`Guardian account ${accountPublicKey} is missing hotPublicKey — re-create the wallet`);
-  }
-  const hotPublicKey = account.hotPublicKey;
-
-  // Return cached instance if its endpoint AND bound hot pubkey still match.
-  // Two separate drift sources:
-  //   - guardian endpoint: switch_guardian rotates the URL; clearGuardianServiceFor
-  //     in the SW realm doesn't reach the popup's Map, so re-check storage here.
-  //   - hot pubkey: replace_hot_key rotates account.hotPublicKey; the cached
-  //     service is still bound to the previous WalletSigner.publicKey.
-  const cached = guardianServiceCache.get(accountPublicKey);
-  if (cached) {
-    try {
-      const currentEndpoint = (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
-      if (cached.service.guardianEndpoint === currentEndpoint && cached.hotPublicKey === hotPublicKey) {
-        return cached.service;
-      }
-      guardianServiceCache.delete(accountPublicKey);
-    } catch (error) {}
-  }
 
   // Coalesce concurrent inits: the guardian sync runs every 3s and does not
   // await previous ticks, so without this an in-flight init can start again
@@ -90,9 +58,43 @@ export async function getOrCreateMultisigService(
     return inflight;
   }
 
-  console.log('[Guardian Manager] No valid cached MultisigService found, creating new one...');
-
   const initPromise = (async () => {
+    // Resolve the WalletAccount upfront — needed for both the cache drift
+    // check (hotPublicKey can rotate) and the subsequent service init.
+    const accounts = await provider.getAccounts();
+    const account = accounts.find(acc => acc.publicKey === accountPublicKey);
+    if (!account || account.type !== WalletType.Guardian) {
+      throw new Error('Account is not a Guardian account');
+    }
+    // Hot pubkey lives on the WalletAccount record (set at create time). A
+    // Guardian account without it is either a legacy single-Falcon-key record
+    // (pre-migration) or an in-flight write that crashed mid-create — both are
+    // unsigned states that should fail loudly rather than silently fall back.
+    if (!account.hotPublicKey) {
+      throw new Error(`Guardian account ${accountPublicKey} is missing hotPublicKey — re-create the wallet`);
+    }
+    const hotPublicKey = account.hotPublicKey;
+
+    // Return cached instance if its endpoint AND bound hot pubkey still match.
+    // Two separate drift sources:
+    //   - guardian endpoint: switch_guardian rotates the URL; clearGuardianServiceFor
+    //     in the SW realm doesn't reach the popup's Map, so re-check storage here.
+    //   - hot pubkey: replace_hot_key rotates account.hotPublicKey; the cached
+    //     service is still bound to the previous WalletSigner.publicKey.
+    const cached = guardianServiceCache.get(accountPublicKey);
+    if (cached) {
+      try {
+        const currentEndpoint =
+          (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
+        if (cached.service.guardianEndpoint === currentEndpoint && cached.hotPublicKey === hotPublicKey) {
+          return cached.service;
+        }
+        guardianServiceCache.delete(accountPublicKey);
+      } catch (error) {}
+    }
+
+    console.log('[Guardian Manager] No valid cached MultisigService found, creating new one...');
+
     // Get the Account object from the Miden client.
     const { sdkAccount } = await withWasmClientLock(async () => {
       const midenClient = await getMidenClient();
diff --git a/src/lib/miden/guardian/index.test.ts b/src/lib/miden/guardian/index.test.ts
index c5575ca97..e5092f002 100644
--- a/src/lib/miden/guardian/index.test.ts
+++ b/src/lib/miden/guardian/index.test.ts
@@ -74,11 +74,11 @@ const multisigClientConfig: { load: jest.Mock } = {
   load: jest.fn()
 };
 
-const mockBuildUpdateSignersTransactionRequest = jest.fn(async () => ({
+const mockBuildUpdateSignersTransactionRequest = jest.fn(async (..._args: unknown[]) => ({
   request: { kind: 'request' },
   salt: { toHex: () => 'salt-hex' }
 }));
-const mockExecuteForSummary = jest.fn(async () => ({
+const mockExecuteForSummary = jest.fn(async (..._args: unknown[]) => ({
   serialize: () => new Uint8Array([0xab])
 }));
 
diff --git a/src/lib/miden/sdk/miden-client-interface.ts b/src/lib/miden/sdk/miden-client-interface.ts
index ac7873b9f..a88c5dd35 100644
--- a/src/lib/miden/sdk/miden-client-interface.ts
+++ b/src/lib/miden/sdk/miden-client-interface.ts
@@ -238,7 +238,7 @@ export class MidenClientInterface {
   async createMidenWallet(walletType: WalletType, seed?: Uint8Array, auth?: AuthScheme): Promise<string> {
     if (walletType === WalletType.Guardian) {
       const { createGuardianAccount } = await import('../guardian/account');
-      const account = await createGuardianAccount(this.client, seed);
+      const { account } = await createGuardianAccount(this.client, seed);
       return getBech32AddressFromAccountId(account.id());
     }
 
diff --git a/src/lib/secure-hot-key/hotKeyPlugin.test.ts b/src/lib/secure-hot-key/hotKeyPlugin.test.ts
new file mode 100644
index 000000000..96f2cbc3c
--- /dev/null
+++ b/src/lib/secure-hot-key/hotKeyPlugin.test.ts
@@ -0,0 +1,20 @@
+const mockPlugin = {
+  generateHotKey: jest.fn(),
+  signWithHotKey: jest.fn(),
+  deleteHotKey: jest.fn(),
+  revealHotKey: jest.fn()
+};
+const mockRegisterPlugin = jest.fn((_name: string) => mockPlugin);
+
+jest.mock('@capacitor/core', () => ({
+  registerPlugin: (name: string) => mockRegisterPlugin(name)
+}));
+
+describe('secure-hot-key hotKeyPlugin', () => {
+  it('registers the Capacitor HotKey plugin handle', async () => {
+    const { HotKey } = await import('./hotKeyPlugin');
+
+    expect(mockRegisterPlugin).toHaveBeenCalledWith('HotKey');
+    expect(HotKey).toBe(mockPlugin);
+  });
+});
diff --git a/src/lib/secure-hot-key/index.test.ts b/src/lib/secure-hot-key/index.test.ts
new file mode 100644
index 000000000..e4209ed61
--- /dev/null
+++ b/src/lib/secure-hot-key/index.test.ts
@@ -0,0 +1,94 @@
+import * as secureHotKey from './index';
+
+const mockIsMobile = jest.fn();
+jest.mock('lib/platform', () => ({
+  isMobile: () => mockIsMobile()
+}));
+
+const mockJsGenerateHotKey = jest.fn();
+const mockJsSignHotDigest = jest.fn();
+const mockJsDeleteHotKey = jest.fn();
+const mockJsRevealHotKey = jest.fn();
+jest.mock('./jsFallback', () => ({
+  generateHotKey: () => mockJsGenerateHotKey(),
+  signHotDigest: (ciphertext: string, wordHex: string) => mockJsSignHotDigest(ciphertext, wordHex),
+  deleteHotKey: (ciphertext: string) => mockJsDeleteHotKey(ciphertext),
+  revealHotKey: (ciphertext: string) => mockJsRevealHotKey(ciphertext)
+}));
+
+const mockNativeGenerateHotKey = jest.fn();
+const mockNativeSignHotDigest = jest.fn();
+const mockNativeDeleteHotKey = jest.fn();
+const mockNativeRevealHotKey = jest.fn();
+jest.mock('./nativePlugin', () => ({
+  generateHotKey: () => mockNativeGenerateHotKey(),
+  signHotDigest: (ciphertext: string, wordHex: string) => mockNativeSignHotDigest(ciphertext, wordHex),
+  deleteHotKey: (ciphertext: string) => mockNativeDeleteHotKey(ciphertext),
+  revealHotKey: (ciphertext: string) => mockNativeRevealHotKey(ciphertext)
+}));
+
+beforeEach(() => {
+  jest.clearAllMocks();
+});
+
+describe('secure-hot-key facade', () => {
+  it('routes every operation to the JS fallback off mobile', async () => {
+    mockIsMobile.mockReturnValue(false);
+    mockJsGenerateHotKey.mockResolvedValue({
+      ciphertext: 'js-ciphertext',
+      publicKeyHex: 'js-public',
+      commitmentHex: 'js-commitment'
+    });
+    mockJsSignHotDigest.mockResolvedValue('0xjs-signature');
+    mockJsDeleteHotKey.mockResolvedValue(undefined);
+    mockJsRevealHotKey.mockResolvedValue('js-secret');
+
+    await expect(secureHotKey.generateHotKey()).resolves.toEqual({
+      ciphertext: 'js-ciphertext',
+      publicKeyHex: 'js-public',
+      commitmentHex: 'js-commitment'
+    });
+    await expect(secureHotKey.signHotDigest('js-ciphertext', '0xword')).resolves.toBe('0xjs-signature');
+    await expect(secureHotKey.deleteHotKey('js-ciphertext')).resolves.toBeUndefined();
+    await expect(secureHotKey.revealHotKey('js-ciphertext')).resolves.toBe('js-secret');
+
+    expect(mockJsGenerateHotKey).toHaveBeenCalledTimes(1);
+    expect(mockJsSignHotDigest).toHaveBeenCalledWith('js-ciphertext', '0xword');
+    expect(mockJsDeleteHotKey).toHaveBeenCalledWith('js-ciphertext');
+    expect(mockJsRevealHotKey).toHaveBeenCalledWith('js-ciphertext');
+    expect(mockNativeGenerateHotKey).not.toHaveBeenCalled();
+    expect(mockNativeSignHotDigest).not.toHaveBeenCalled();
+    expect(mockNativeDeleteHotKey).not.toHaveBeenCalled();
+    expect(mockNativeRevealHotKey).not.toHaveBeenCalled();
+  });
+
+  it('routes every operation to the native plugin on mobile', async () => {
+    mockIsMobile.mockReturnValue(true);
+    mockNativeGenerateHotKey.mockResolvedValue({
+      ciphertext: 'native-ciphertext',
+      publicKeyHex: 'native-public',
+      commitmentHex: 'native-commitment'
+    });
+    mockNativeSignHotDigest.mockResolvedValue('0xnative-signature');
+    mockNativeDeleteHotKey.mockResolvedValue(undefined);
+    mockNativeRevealHotKey.mockResolvedValue('native-secret');
+
+    await expect(secureHotKey.generateHotKey()).resolves.toEqual({
+      ciphertext: 'native-ciphertext',
+      publicKeyHex: 'native-public',
+      commitmentHex: 'native-commitment'
+    });
+    await expect(secureHotKey.signHotDigest('native-ciphertext', '0xword')).resolves.toBe('0xnative-signature');
+    await expect(secureHotKey.deleteHotKey('native-ciphertext')).resolves.toBeUndefined();
+    await expect(secureHotKey.revealHotKey('native-ciphertext')).resolves.toBe('native-secret');
+
+    expect(mockNativeGenerateHotKey).toHaveBeenCalledTimes(1);
+    expect(mockNativeSignHotDigest).toHaveBeenCalledWith('native-ciphertext', '0xword');
+    expect(mockNativeDeleteHotKey).toHaveBeenCalledWith('native-ciphertext');
+    expect(mockNativeRevealHotKey).toHaveBeenCalledWith('native-ciphertext');
+    expect(mockJsGenerateHotKey).not.toHaveBeenCalled();
+    expect(mockJsSignHotDigest).not.toHaveBeenCalled();
+    expect(mockJsDeleteHotKey).not.toHaveBeenCalled();
+    expect(mockJsRevealHotKey).not.toHaveBeenCalled();
+  });
+});
diff --git a/src/lib/secure-hot-key/jsFallback.test.ts b/src/lib/secure-hot-key/jsFallback.test.ts
new file mode 100644
index 000000000..6953adc7d
--- /dev/null
+++ b/src/lib/secure-hot-key/jsFallback.test.ts
@@ -0,0 +1,85 @@
+import * as jsFallback from './jsFallback';
+
+const mockEcdsaWithRNG = jest.fn();
+const mockDeserialize = jest.fn();
+const mockWordFromHex = jest.fn();
+jest.mock('@miden-sdk/miden-sdk/lazy', () => ({
+  AuthSecretKey: {
+    ecdsaWithRNG: (seed: Uint8Array) => mockEcdsaWithRNG(seed),
+    deserialize: (bytes: Uint8Array) => mockDeserialize(bytes)
+  },
+  Word: {
+    fromHex: (hex: string) => mockWordFromHex(hex)
+  }
+}));
+
+beforeEach(() => {
+  jest.clearAllMocks();
+});
+
+describe('secure-hot-key jsFallback', () => {
+  it('generates an ECDSA hot key and returns ciphertext, public key, and commitment hex', async () => {
+    const randomSpy = jest.spyOn(crypto, 'getRandomValues').mockImplementation(array => {
+      (array as Uint8Array).fill(0x7a);
+      return array;
+    });
+    const publicKey = {
+      serialize: jest.fn(() => new Uint8Array([0x01, 0x02, ...new Array(32).fill(0xab)])),
+      toCommitment: jest.fn(() => ({ toHex: () => '0xcommitment' }))
+    };
+    const sk = {
+      serialize: jest.fn(() => new Uint8Array([0x01, ...new Array(32).fill(0xcd)])),
+      publicKey: jest.fn(() => publicKey)
+    };
+    mockEcdsaWithRNG.mockReturnValue(sk);
+
+    try {
+      const generated = await jsFallback.generateHotKey();
+
+      expect(mockEcdsaWithRNG).toHaveBeenCalledWith(new Uint8Array(32).fill(0x7a));
+      expect(generated).toEqual({
+        ciphertext: `01${'cd'.repeat(32)}`,
+        publicKeyHex: `02${'ab'.repeat(32)}`,
+        commitmentHex: '0xcommitment'
+      });
+      expect(sk.publicKey).toHaveBeenCalledTimes(1);
+      expect(publicKey.toCommitment).toHaveBeenCalledTimes(1);
+    } finally {
+      randomSpy.mockRestore();
+    }
+  });
+
+  it('signs a word using a serialized AuthSecretKey ciphertext', async () => {
+    const word = { tag: 'word' };
+    const signature = {
+      serialize: jest.fn(() => new Uint8Array([0x01, 0x11, 0x22, 0x33]))
+    };
+    const sk = {
+      sign: jest.fn(() => signature)
+    };
+    mockDeserialize.mockReturnValue(sk);
+    mockWordFromHex.mockReturnValue(word);
+
+    const signatureHex = await jsFallback.signHotDigest('0a0b0c', '0xword');
+
+    expect(mockDeserialize).toHaveBeenCalledWith(new Uint8Array([0x0a, 0x0b, 0x0c]));
+    expect(mockWordFromHex).toHaveBeenCalledWith('0xword');
+    expect(sk.sign).toHaveBeenCalledWith(word);
+    expect(signatureHex).toBe('0x112233');
+  });
+
+  it('deleteHotKey is a no-op for the JS fallback', async () => {
+    await expect(jsFallback.deleteHotKey('serialized-key')).resolves.toBeUndefined();
+  });
+
+  it('reveals the raw secret key bytes without the serialized scheme prefix', async () => {
+    mockDeserialize.mockReturnValue({
+      serialize: jest.fn(() => new Uint8Array([0x01, ...new Array(32).fill(0xef)]))
+    });
+
+    const secret = await jsFallback.revealHotKey('010203');
+
+    expect(mockDeserialize).toHaveBeenCalledWith(new Uint8Array([0x01, 0x02, 0x03]));
+    expect(secret).toBe('ef'.repeat(32));
+  });
+});

From 430c6fc93fd0fcda6bcfc268bf006460ee1f0687 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Tue, 23 Jun 2026 18:10:32 +0530
Subject: [PATCH 57/71] ci: coverage and lint

---
 src/app/defaults.test.tsx                 | 52 +++++++++++++++++
 src/app/pages/Explore/Tokens.test.tsx     | 70 ++++++++++++++++++++++-
 src/lib/miden/front/guardian-manager.ts   |  3 +-
 src/lib/miden/front/guardian-sync.test.ts | 18 +++++-
 src/lib/miden/sdk/helpers.test.ts         | 11 +++-
 5 files changed, 149 insertions(+), 5 deletions(-)
 create mode 100644 src/app/defaults.test.tsx

diff --git a/src/app/defaults.test.tsx b/src/app/defaults.test.tsx
new file mode 100644
index 000000000..0e5333787
--- /dev/null
+++ b/src/app/defaults.test.tsx
@@ -0,0 +1,52 @@
+/**
+ * app/defaults — pure helpers and the i18n-backed badge/caption surfaces.
+ * Covers formatMnemonic (newline → space + trim), the deprecated
+ * getAccountBadgeTitle constant, the useAccountBadgeTitle hook, and the
+ * MnemonicErrorCaption list.
+ */
+
+import React from 'react';
+
+import { render, renderHook } from '@testing-library/react';
+
+import { MnemonicErrorCaption, formatMnemonic, getAccountBadgeTitle, useAccountBadgeTitle } from './defaults';
+
+jest.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string) => key
+  })
+}));
+
+describe('app/defaults', () => {
+  describe('formatMnemonic', () => {
+    it('replaces newlines with spaces and trims surrounding whitespace', () => {
+      expect(formatMnemonic('  alpha\nbravo\ncharlie  ')).toBe('alpha bravo charlie');
+    });
+
+    it('leaves an already-clean single-line phrase untouched', () => {
+      expect(formatMnemonic('alpha bravo charlie')).toBe('alpha bravo charlie');
+    });
+  });
+
+  describe('getAccountBadgeTitle', () => {
+    it('returns the deprecated static "Imported" label', () => {
+      expect(getAccountBadgeTitle()).toBe('Imported');
+    });
+  });
+
+  describe('useAccountBadgeTitle', () => {
+    it('returns the translated imported-account label', () => {
+      const { result } = renderHook(() => useAccountBadgeTitle());
+      expect(result.current).toBe('importedAccount');
+    });
+  });
+
+  describe('MnemonicErrorCaption', () => {
+    it('renders the three mnemonic-constraint list items', () => {
+      const { getByText } = render(<MnemonicErrorCaption />);
+      expect(getByText('mnemonicWordsAmountConstraint')).toBeInTheDocument();
+      expect(getByText('mnemonicSpacingConstraint')).toBeInTheDocument();
+      expect(getByText('justValidPreGeneratedMnemonic')).toBeInTheDocument();
+    });
+  });
+});
diff --git a/src/app/pages/Explore/Tokens.test.tsx b/src/app/pages/Explore/Tokens.test.tsx
index 02ec3f9a0..edb920222 100644
--- a/src/app/pages/Explore/Tokens.test.tsx
+++ b/src/app/pages/Explore/Tokens.test.tsx
@@ -1,6 +1,6 @@
 import React from 'react';
 
-import { render, screen } from '@testing-library/react';
+import { fireEvent, render, screen } from '@testing-library/react';
 
 import Tokens from './Tokens';
 
@@ -35,11 +35,19 @@ jest.mock('components/TokenLogo', () => ({
   TokenLogo: () => <div data-testid="token-logo" />
 }));
 
+const mockGetTokenPrice = jest.fn();
+jest.mock('lib/prices', () => ({
+  getTokenPrice: (...args: unknown[]) => mockGetTokenPrice(...args)
+}));
+
 const mockUseAllBalances = jest.requireMock('lib/miden/front').useAllBalances;
 
 describe('Tokens', () => {
   beforeEach(() => {
     jest.clearAllMocks();
+    // Default to a positive 24h change (green branch). Individual tests
+    // override this to exercise the negative (red) branch.
+    mockGetTokenPrice.mockReturnValue({ price: 1, percentageChange24h: 1 });
   });
 
   it('renders even when no balances are loaded yet', () => {
@@ -133,4 +141,64 @@ describe('Tokens', () => {
 
     expect(container.querySelector('.animate-pulse')).not.toBeInTheDocument();
   });
+
+  it('falls back to the symbol when a token has no name', () => {
+    mockUseAllBalances.mockReturnValue({
+      data: [
+        {
+          tokenId: 'token-noname',
+          balance: 1,
+          // No `name` — title should fall back to the symbol.
+          metadata: { symbol: 'NONAME', decimals: 8 }
+        }
+      ],
+      isLoading: false
+    });
+
+    render(<Tokens />);
+
+    expect(screen.getByText('NONAME')).toBeInTheDocument();
+  });
+
+  it('renders a negative 24h price change (red branch)', () => {
+    mockGetTokenPrice.mockReturnValue({ price: 1, percentageChange24h: -3.5 });
+    mockUseAllBalances.mockReturnValue({
+      data: [{ tokenId: 'token-1', balance: 100, metadata: { symbol: 'TKN', name: 'Token', decimals: 8 } }],
+      isLoading: false
+    });
+
+    render(<Tokens />);
+
+    expect(screen.getByText('Token')).toBeInTheDocument();
+  });
+
+  it('filters the token list by the search query (name and symbol)', () => {
+    mockUseAllBalances.mockReturnValue({
+      data: [
+        // Including the MIDEN faucet in a multi-token list ensures the sort
+        // comparator actually runs and hits its `=== midenFaucetId` branch.
+        { tokenId: 'miden-faucet-id', balance: 0, metadata: { symbol: 'MIDEN', name: 'Miden', decimals: 8 } },
+        { tokenId: 'a', balance: 5, metadata: { symbol: 'AAA', name: 'Alpha', decimals: 8 } },
+        { tokenId: 'b', balance: 5, metadata: { symbol: 'BBB', decimals: 8 } }
+      ],
+      isLoading: false
+    });
+
+    render(<Tokens />);
+
+    // Both render before filtering.
+    expect(screen.getByText('Alpha')).toBeInTheDocument();
+    expect(screen.getByText('BBB')).toBeInTheDocument();
+
+    // Search by name — only the matching token survives.
+    fireEvent.change(screen.getByPlaceholderText('searchForToken'), { target: { value: 'alp' } });
+    expect(screen.getByText('Alpha')).toBeInTheDocument();
+    expect(screen.queryByText('BBB')).not.toBeInTheDocument();
+
+    // Search by symbol on the token that has no name (exercises the
+    // optional-chained name match short-circuit and the symbol branch).
+    fireEvent.change(screen.getByPlaceholderText('searchForToken'), { target: { value: 'bbb' } });
+    expect(screen.getByText('BBB')).toBeInTheDocument();
+    expect(screen.queryByText('Alpha')).not.toBeInTheDocument();
+  });
 });
diff --git a/src/lib/miden/front/guardian-manager.ts b/src/lib/miden/front/guardian-manager.ts
index 1c6ee1057..2c5782880 100644
--- a/src/lib/miden/front/guardian-manager.ts
+++ b/src/lib/miden/front/guardian-manager.ts
@@ -84,8 +84,7 @@ export async function getOrCreateMultisigService(
     const cached = guardianServiceCache.get(accountPublicKey);
     if (cached) {
       try {
-        const currentEndpoint =
-          (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
+        const currentEndpoint = (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
         if (cached.service.guardianEndpoint === currentEndpoint && cached.hotPublicKey === hotPublicKey) {
           return cached.service;
         }
diff --git a/src/lib/miden/front/guardian-sync.test.ts b/src/lib/miden/front/guardian-sync.test.ts
index ce7cec42c..229d666ce 100644
--- a/src/lib/miden/front/guardian-sync.test.ts
+++ b/src/lib/miden/front/guardian-sync.test.ts
@@ -13,10 +13,14 @@ const storeState: {
   accounts: Array<{ publicKey: string; type: WalletType; requiresHotKeyRotation?: boolean }>;
   getPublicKeyForCommitment: jest.Mock;
   signWord: jest.Mock;
+  persistNewHotKey: jest.Mock;
+  swapHotKey: jest.Mock;
 } = {
   accounts: [],
   getPublicKeyForCommitment: jest.fn(),
-  signWord: jest.fn()
+  signWord: jest.fn(),
+  persistNewHotKey: jest.fn(),
+  swapHotKey: jest.fn()
 };
 
 jest.mock('lib/store', () => ({
@@ -36,6 +40,8 @@ describe('zustandProvider', () => {
     storeState.accounts = [];
     storeState.getPublicKeyForCommitment.mockResolvedValue('pk');
     storeState.signWord.mockResolvedValue('sig');
+    storeState.persistNewHotKey.mockResolvedValue(undefined);
+    storeState.swapHotKey.mockResolvedValue(undefined);
   });
 
   it('getAccounts returns the current store accounts', async () => {
@@ -55,6 +61,16 @@ describe('zustandProvider', () => {
     await zustandProvider.signWord('pub', '0xhex');
     expect(storeState.signWord).toHaveBeenCalledWith('pub', '0xhex');
   });
+
+  it('persistNewHotKey delegates to the store', async () => {
+    await zustandProvider.persistNewHotKey('new-pub', 'new-ciphertext');
+    expect(storeState.persistNewHotKey).toHaveBeenCalledWith('new-pub', 'new-ciphertext');
+  });
+
+  it('swapHotKey delegates to the store', async () => {
+    await zustandProvider.swapHotKey('account-pub', 'new-hot-pub');
+    expect(storeState.swapHotKey).toHaveBeenCalledWith('account-pub', 'new-hot-pub');
+  });
 });
 
 describe('syncGuardianAccounts', () => {
diff --git a/src/lib/miden/sdk/helpers.test.ts b/src/lib/miden/sdk/helpers.test.ts
index 1515f7a69..4dc39dcfb 100644
--- a/src/lib/miden/sdk/helpers.test.ts
+++ b/src/lib/miden/sdk/helpers.test.ts
@@ -1,11 +1,14 @@
 import { Address } from '@miden-sdk/miden-sdk/lazy';
 
-import { getBech32AddressFromAccountId } from './helpers';
+import { accountIdStringToSdk, getBech32AddressFromAccountId } from './helpers';
 
 jest.mock('@miden-sdk/miden-sdk/lazy', () => ({
   Address: {
     fromAccountId: jest.fn((id: any) => ({
       toBech32: () => `bech32-${id}`
+    })),
+    fromBech32: jest.fn((str: any) => ({
+      accountId: () => `accountId-${str}`
     }))
   },
   NetworkId: { testnet: jest.fn(() => 'testnet'), devnet: jest.fn(() => 'devnet') }
@@ -21,4 +24,10 @@ describe('miden sdk helpers', () => {
     expect(Address.fromAccountId).toHaveBeenCalledWith('abc', 'BasicWallet');
     expect(res).toBe('bech32-abc');
   });
+
+  it('converts a bech32 string back to an AccountId', () => {
+    const res = accountIdStringToSdk('mtst1qabc');
+    expect(Address.fromBech32).toHaveBeenCalledWith('mtst1qabc');
+    expect(res).toBe('accountId-mtst1qabc');
+  });
 });

From 72e48ef2241e9a0f2176f2bf6659b0bc18c70bdd Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Tue, 23 Jun 2026 18:19:19 +0530
Subject: [PATCH 58/71] ci: tsc

---
 src/lib/miden/front/guardian-sync.test.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/lib/miden/front/guardian-sync.test.ts b/src/lib/miden/front/guardian-sync.test.ts
index 229d666ce..f8d20f0c4 100644
--- a/src/lib/miden/front/guardian-sync.test.ts
+++ b/src/lib/miden/front/guardian-sync.test.ts
@@ -63,12 +63,13 @@ describe('zustandProvider', () => {
   });
 
   it('persistNewHotKey delegates to the store', async () => {
-    await zustandProvider.persistNewHotKey('new-pub', 'new-ciphertext');
+    // Optional on the interface; the assertion below fails if it's missing.
+    await zustandProvider.persistNewHotKey?.('new-pub', 'new-ciphertext');
     expect(storeState.persistNewHotKey).toHaveBeenCalledWith('new-pub', 'new-ciphertext');
   });
 
   it('swapHotKey delegates to the store', async () => {
-    await zustandProvider.swapHotKey('account-pub', 'new-hot-pub');
+    await zustandProvider.swapHotKey?.('account-pub', 'new-hot-pub');
     expect(storeState.swapHotKey).toHaveBeenCalledWith('account-pub', 'new-hot-pub');
   });
 });

From 9ad6157dba516e003af603d51715c82dfbfb0ada Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Wed, 24 Jun 2026 17:42:48 +0530
Subject: [PATCH 59/71] chore: remove scripts and unneccesary changes

---
 ios/App/scripts/logs-on-device.sh         | 40 -------------
 ios/App/scripts/run-on-device.sh          | 73 -----------------------
 package.json                              |  3 -
 src-tauri/gen/schemas/acl-manifests.json  |  2 +-
 src-tauri/gen/schemas/desktop-schema.json | 60 +++++++++++++++++--
 src-tauri/gen/schemas/macOS-schema.json   | 60 +++++++++++++++++--
 src/lib/miden/back/vault.ts               |  2 -
 src/lib/miden/front/guardian-manager.ts   | 21 ++++---
 src/lib/miden/guardian/account.ts         |  1 -
 9 files changed, 122 insertions(+), 140 deletions(-)
 delete mode 100755 ios/App/scripts/logs-on-device.sh
 delete mode 100755 ios/App/scripts/run-on-device.sh

diff --git a/ios/App/scripts/logs-on-device.sh b/ios/App/scripts/logs-on-device.sh
deleted file mode 100755
index a0afe3c22..000000000
--- a/ios/App/scripts/logs-on-device.sh
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/bin/bash
-#
-# Stream live logs from the Miden Wallet app running on the first connected
-# iOS device. Mirrors what Xcode's Console pane shows. Ctrl+C to stop.
-#
-# Implementation: re-launch the app with `--console` and `--terminate-existing`
-# — devicectl doesn't expose a clean "attach to PID for stdout/stderr" path,
-# so re-launching is the simplest way to get the same stream Xcode would show.
-# If you'd rather not relaunch, use Console.app on the Mac with the device
-# selected; same logs, no termination.
-
-set -euo pipefail
-
-BUNDLE_ID="com.miden.wallet"
-
-DEVICE_ID="$(
-    xcrun devicectl list devices --json-output - 2>/dev/null \
-        | python3 -c "
-import sys, json
-data = json.load(sys.stdin)
-for d in data.get('result', {}).get('devices', []):
-    hp = d.get('hardwareProperties', {})
-    cp = d.get('connectionProperties', {})
-    if hp.get('platform') == 'iOS' and cp.get('pairingState') == 'paired':
-        print(d['identifier'])
-        break
-"
-)"
-
-if [[ -z "$DEVICE_ID" ]]; then
-    echo "error: no paired iOS device found." >&2
-    exit 1
-fi
-
-echo "streaming logs for $BUNDLE_ID on $DEVICE_ID (Ctrl+C to stop)"
-xcrun devicectl device process launch \
-    --device "$DEVICE_ID" \
-    --console \
-    --terminate-existing \
-    "$BUNDLE_ID"
diff --git a/ios/App/scripts/run-on-device.sh b/ios/App/scripts/run-on-device.sh
deleted file mode 100755
index 5a6a1e4c5..000000000
--- a/ios/App/scripts/run-on-device.sh
+++ /dev/null
@@ -1,73 +0,0 @@
-#!/bin/bash
-#
-# Build the iOS App in Debug for a generic iOS device, then install + launch
-# on the first connected physical iOS device. Use after `yarn mobile:sync &&
-# yarn mobile:ios:patch-spm`.
-#
-# Bundle ID and build path mirror `mobile:ios:run` (simulator); only the
-# destination, install command, and launch command differ.
-#
-# Requires Xcode 15+ for `xcrun devicectl`. Code signing must be configured in
-# the Xcode project (Automatic signing with a development team is fine).
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
-BUILD_DIR="$REPO_ROOT/ios/App/build"
-APP_PATH="$BUILD_DIR/Build/Products/Debug-iphoneos/App.app"
-BUNDLE_ID="com.miden.wallet"
-
-# 1. Find the first paired iOS device. We intentionally don't gate on
-#    `tunnelState == "connected"` — that state is the on-demand control
-#    tunnel which devicectl re-establishes automatically when install /
-#    launch run. A wired, paired, developer-mode-on device often shows
-#    `tunnelState=disconnected` between commands and that's fine.
-DEVICE_ID="$(
-    xcrun devicectl list devices --json-output - 2>/dev/null \
-        | python3 -c "
-import sys, json
-data = json.load(sys.stdin)
-for d in data.get('result', {}).get('devices', []):
-    hp = d.get('hardwareProperties', {})
-    cp = d.get('connectionProperties', {})
-    if hp.get('platform') == 'iOS' and cp.get('pairingState') == 'paired':
-        print(d['identifier'])
-        break
-"
-)"
-
-if [[ -z "$DEVICE_ID" ]]; then
-    echo "error: no paired iOS device found." >&2
-    echo "  - plug in via USB and unlock the device" >&2
-    echo "  - run 'xcrun devicectl list devices' — your phone should appear" >&2
-    echo "  - on the device, Settings → Privacy & Security → Developer Mode must be ON" >&2
-    exit 1
-fi
-echo "device: $DEVICE_ID"
-
-# 2. Build for generic/platform=iOS.
-echo "building..."
-xcodebuild \
-    -project "$REPO_ROOT/ios/App/App.xcodeproj" \
-    -scheme App \
-    -destination 'generic/platform=iOS' \
-    -configuration Debug \
-    -derivedDataPath "$BUILD_DIR" \
-    build
-
-if [[ ! -d "$APP_PATH" ]]; then
-    echo "error: built App.app not found at $APP_PATH" >&2
-    exit 1
-fi
-
-# 3. Install + launch on the device.
-echo "installing $APP_PATH"
-xcrun devicectl device install app --device "$DEVICE_ID" "$APP_PATH"
-
-echo "launching $BUNDLE_ID (Ctrl+C ends log streaming; app keeps running)"
-xcrun devicectl device process launch \
-    --device "$DEVICE_ID" \
-    --console \
-    --terminate-existing \
-    "$BUNDLE_ID"
diff --git a/package.json b/package.json
index 1492bad01..7fa567b1f 100644
--- a/package.json
+++ b/package.json
@@ -39,9 +39,6 @@
     "mobile:ios:build:devnet": "cross-env MIDEN_NETWORK=devnet yarn mobile:ios:build",
     "mobile:ios:run": "yarn mobile:ios:build && xcrun simctl install booted ios/App/build/Build/Products/Debug-iphonesimulator/App.app && yarn mobile:ios:faceid && xcrun simctl launch booted com.miden.wallet",
     "mobile:ios:run:devnet": "cross-env MIDEN_NETWORK=devnet yarn mobile:ios:run",
-    "mobile:ios:run:device": "yarn mobile:sync && bash ios/App/scripts/run-on-device.sh",
-    "mobile:ios:run:device:devnet": "cross-env MIDEN_NETWORK=devnet yarn mobile:ios:run:device",
-    "mobile:ios:logs:device": "bash ios/App/scripts/logs-on-device.sh",
     "mobile:ios:faceid": "xcrun simctl spawn booted notifyutil -s com.apple.BiometricKit.enrollmentChanged 1 && xcrun simctl spawn booted notifyutil -p com.apple.BiometricKit.enrollmentChanged",
     "mobile:android": "yarn mobile:sync && npx cap open android",
     "mobile:android:devnet": "cross-env MIDEN_NETWORK=devnet yarn mobile:android",
diff --git a/src-tauri/gen/schemas/acl-manifests.json b/src-tauri/gen/schemas/acl-manifests.json
index 86cdb1f5f..f43b85280 100644
--- a/src-tauri/gen/schemas/acl-manifests.json
+++ b/src-tauri/gen/schemas/acl-manifests.json
@@ -1 +1 @@
-{"core":{"default_permission":{"identifier":"default","description":"Default core plugins set.","permissions":["core:path:default","core:event:default","core:window:default","core:webview:default","core:app:default","core:image:default","core:resources:default","core:menu:default","core:tray:default"]},"permissions":{},"permission_sets":{},"global_scope_schema":null},"core:app":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-version","allow-name","allow-tauri-version","allow-identifier","allow-bundle-type","allow-register-listener","allow-remove-listener"]},"permissions":{"allow-app-hide":{"identifier":"allow-app-hide","description":"Enables the app_hide command without any pre-configured scope.","commands":{"allow":["app_hide"],"deny":[]}},"allow-app-show":{"identifier":"allow-app-show","description":"Enables the app_show command without any pre-configured scope.","commands":{"allow":["app_show"],"deny":[]}},"allow-bundle-type":{"identifier":"allow-bundle-type","description":"Enables the bundle_type command without any pre-configured scope.","commands":{"allow":["bundle_type"],"deny":[]}},"allow-default-window-icon":{"identifier":"allow-default-window-icon","description":"Enables the default_window_icon command without any pre-configured scope.","commands":{"allow":["default_window_icon"],"deny":[]}},"allow-fetch-data-store-identifiers":{"identifier":"allow-fetch-data-store-identifiers","description":"Enables the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":["fetch_data_store_identifiers"],"deny":[]}},"allow-identifier":{"identifier":"allow-identifier","description":"Enables the identifier command without any pre-configured scope.","commands":{"allow":["identifier"],"deny":[]}},"allow-name":{"identifier":"allow-name","description":"Enables the name command without any pre-configured scope.","commands":{"allow":["name"],"deny":[]}},"allow-register-listener":{"identifier":"allow-register-listener","description":"Enables the register_listener command without any pre-configured scope.","commands":{"allow":["register_listener"],"deny":[]}},"allow-remove-data-store":{"identifier":"allow-remove-data-store","description":"Enables the remove_data_store command without any pre-configured scope.","commands":{"allow":["remove_data_store"],"deny":[]}},"allow-remove-listener":{"identifier":"allow-remove-listener","description":"Enables the remove_listener command without any pre-configured scope.","commands":{"allow":["remove_listener"],"deny":[]}},"allow-set-app-theme":{"identifier":"allow-set-app-theme","description":"Enables the set_app_theme command without any pre-configured scope.","commands":{"allow":["set_app_theme"],"deny":[]}},"allow-set-dock-visibility":{"identifier":"allow-set-dock-visibility","description":"Enables the set_dock_visibility command without any pre-configured scope.","commands":{"allow":["set_dock_visibility"],"deny":[]}},"allow-tauri-version":{"identifier":"allow-tauri-version","description":"Enables the tauri_version command without any pre-configured scope.","commands":{"allow":["tauri_version"],"deny":[]}},"allow-version":{"identifier":"allow-version","description":"Enables the version command without any pre-configured scope.","commands":{"allow":["version"],"deny":[]}},"deny-app-hide":{"identifier":"deny-app-hide","description":"Denies the app_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["app_hide"]}},"deny-app-show":{"identifier":"deny-app-show","description":"Denies the app_show command without any pre-configured scope.","commands":{"allow":[],"deny":["app_show"]}},"deny-bundle-type":{"identifier":"deny-bundle-type","description":"Denies the bundle_type command without any pre-configured scope.","commands":{"allow":[],"deny":["bundle_type"]}},"deny-default-window-icon":{"identifier":"deny-default-window-icon","description":"Denies the default_window_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["default_window_icon"]}},"deny-fetch-data-store-identifiers":{"identifier":"deny-fetch-data-store-identifiers","description":"Denies the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":[],"deny":["fetch_data_store_identifiers"]}},"deny-identifier":{"identifier":"deny-identifier","description":"Denies the identifier command without any pre-configured scope.","commands":{"allow":[],"deny":["identifier"]}},"deny-name":{"identifier":"deny-name","description":"Denies the name command without any pre-configured scope.","commands":{"allow":[],"deny":["name"]}},"deny-register-listener":{"identifier":"deny-register-listener","description":"Denies the register_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["register_listener"]}},"deny-remove-data-store":{"identifier":"deny-remove-data-store","description":"Denies the remove_data_store command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_data_store"]}},"deny-remove-listener":{"identifier":"deny-remove-listener","description":"Denies the remove_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_listener"]}},"deny-set-app-theme":{"identifier":"deny-set-app-theme","description":"Denies the set_app_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_app_theme"]}},"deny-set-dock-visibility":{"identifier":"deny-set-dock-visibility","description":"Denies the set_dock_visibility command without any pre-configured scope.","commands":{"allow":[],"deny":["set_dock_visibility"]}},"deny-tauri-version":{"identifier":"deny-tauri-version","description":"Denies the tauri_version command without any pre-configured scope.","commands":{"allow":[],"deny":["tauri_version"]}},"deny-version":{"identifier":"deny-version","description":"Denies the version command without any pre-configured scope.","commands":{"allow":[],"deny":["version"]}}},"permission_sets":{},"global_scope_schema":null},"core:event":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-listen","allow-unlisten","allow-emit","allow-emit-to"]},"permissions":{"allow-emit":{"identifier":"allow-emit","description":"Enables the emit command without any pre-configured scope.","commands":{"allow":["emit"],"deny":[]}},"allow-emit-to":{"identifier":"allow-emit-to","description":"Enables the emit_to command without any pre-configured scope.","commands":{"allow":["emit_to"],"deny":[]}},"allow-listen":{"identifier":"allow-listen","description":"Enables the listen command without any pre-configured scope.","commands":{"allow":["listen"],"deny":[]}},"allow-unlisten":{"identifier":"allow-unlisten","description":"Enables the unlisten command without any pre-configured scope.","commands":{"allow":["unlisten"],"deny":[]}},"deny-emit":{"identifier":"deny-emit","description":"Denies the emit command without any pre-configured scope.","commands":{"allow":[],"deny":["emit"]}},"deny-emit-to":{"identifier":"deny-emit-to","description":"Denies the emit_to command without any pre-configured scope.","commands":{"allow":[],"deny":["emit_to"]}},"deny-listen":{"identifier":"deny-listen","description":"Denies the listen command without any pre-configured scope.","commands":{"allow":[],"deny":["listen"]}},"deny-unlisten":{"identifier":"deny-unlisten","description":"Denies the unlisten command without any pre-configured scope.","commands":{"allow":[],"deny":["unlisten"]}}},"permission_sets":{},"global_scope_schema":null},"core:image":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-from-bytes","allow-from-path","allow-rgba","allow-size"]},"permissions":{"allow-from-bytes":{"identifier":"allow-from-bytes","description":"Enables the from_bytes command without any pre-configured scope.","commands":{"allow":["from_bytes"],"deny":[]}},"allow-from-path":{"identifier":"allow-from-path","description":"Enables the from_path command without any pre-configured scope.","commands":{"allow":["from_path"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-rgba":{"identifier":"allow-rgba","description":"Enables the rgba command without any pre-configured scope.","commands":{"allow":["rgba"],"deny":[]}},"allow-size":{"identifier":"allow-size","description":"Enables the size command without any pre-configured scope.","commands":{"allow":["size"],"deny":[]}},"deny-from-bytes":{"identifier":"deny-from-bytes","description":"Denies the from_bytes command without any pre-configured scope.","commands":{"allow":[],"deny":["from_bytes"]}},"deny-from-path":{"identifier":"deny-from-path","description":"Denies the from_path command without any pre-configured scope.","commands":{"allow":[],"deny":["from_path"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-rgba":{"identifier":"deny-rgba","description":"Denies the rgba command without any pre-configured scope.","commands":{"allow":[],"deny":["rgba"]}},"deny-size":{"identifier":"deny-size","description":"Denies the size command without any pre-configured scope.","commands":{"allow":[],"deny":["size"]}}},"permission_sets":{},"global_scope_schema":null},"core:menu":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-append","allow-prepend","allow-insert","allow-remove","allow-remove-at","allow-items","allow-get","allow-popup","allow-create-default","allow-set-as-app-menu","allow-set-as-window-menu","allow-text","allow-set-text","allow-is-enabled","allow-set-enabled","allow-set-accelerator","allow-set-as-windows-menu-for-nsapp","allow-set-as-help-menu-for-nsapp","allow-is-checked","allow-set-checked","allow-set-icon"]},"permissions":{"allow-append":{"identifier":"allow-append","description":"Enables the append command without any pre-configured scope.","commands":{"allow":["append"],"deny":[]}},"allow-create-default":{"identifier":"allow-create-default","description":"Enables the create_default command without any pre-configured scope.","commands":{"allow":["create_default"],"deny":[]}},"allow-get":{"identifier":"allow-get","description":"Enables the get command without any pre-configured scope.","commands":{"allow":["get"],"deny":[]}},"allow-insert":{"identifier":"allow-insert","description":"Enables the insert command without any pre-configured scope.","commands":{"allow":["insert"],"deny":[]}},"allow-is-checked":{"identifier":"allow-is-checked","description":"Enables the is_checked command without any pre-configured scope.","commands":{"allow":["is_checked"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-items":{"identifier":"allow-items","description":"Enables the items command without any pre-configured scope.","commands":{"allow":["items"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-popup":{"identifier":"allow-popup","description":"Enables the popup command without any pre-configured scope.","commands":{"allow":["popup"],"deny":[]}},"allow-prepend":{"identifier":"allow-prepend","description":"Enables the prepend command without any pre-configured scope.","commands":{"allow":["prepend"],"deny":[]}},"allow-remove":{"identifier":"allow-remove","description":"Enables the remove command without any pre-configured scope.","commands":{"allow":["remove"],"deny":[]}},"allow-remove-at":{"identifier":"allow-remove-at","description":"Enables the remove_at command without any pre-configured scope.","commands":{"allow":["remove_at"],"deny":[]}},"allow-set-accelerator":{"identifier":"allow-set-accelerator","description":"Enables the set_accelerator command without any pre-configured scope.","commands":{"allow":["set_accelerator"],"deny":[]}},"allow-set-as-app-menu":{"identifier":"allow-set-as-app-menu","description":"Enables the set_as_app_menu command without any pre-configured scope.","commands":{"allow":["set_as_app_menu"],"deny":[]}},"allow-set-as-help-menu-for-nsapp":{"identifier":"allow-set-as-help-menu-for-nsapp","description":"Enables the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_help_menu_for_nsapp"],"deny":[]}},"allow-set-as-window-menu":{"identifier":"allow-set-as-window-menu","description":"Enables the set_as_window_menu command without any pre-configured scope.","commands":{"allow":["set_as_window_menu"],"deny":[]}},"allow-set-as-windows-menu-for-nsapp":{"identifier":"allow-set-as-windows-menu-for-nsapp","description":"Enables the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_windows_menu_for_nsapp"],"deny":[]}},"allow-set-checked":{"identifier":"allow-set-checked","description":"Enables the set_checked command without any pre-configured scope.","commands":{"allow":["set_checked"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-text":{"identifier":"allow-set-text","description":"Enables the set_text command without any pre-configured scope.","commands":{"allow":["set_text"],"deny":[]}},"allow-text":{"identifier":"allow-text","description":"Enables the text command without any pre-configured scope.","commands":{"allow":["text"],"deny":[]}},"deny-append":{"identifier":"deny-append","description":"Denies the append command without any pre-configured scope.","commands":{"allow":[],"deny":["append"]}},"deny-create-default":{"identifier":"deny-create-default","description":"Denies the create_default command without any pre-configured scope.","commands":{"allow":[],"deny":["create_default"]}},"deny-get":{"identifier":"deny-get","description":"Denies the get command without any pre-configured scope.","commands":{"allow":[],"deny":["get"]}},"deny-insert":{"identifier":"deny-insert","description":"Denies the insert command without any pre-configured scope.","commands":{"allow":[],"deny":["insert"]}},"deny-is-checked":{"identifier":"deny-is-checked","description":"Denies the is_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["is_checked"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-items":{"identifier":"deny-items","description":"Denies the items command without any pre-configured scope.","commands":{"allow":[],"deny":["items"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-popup":{"identifier":"deny-popup","description":"Denies the popup command without any pre-configured scope.","commands":{"allow":[],"deny":["popup"]}},"deny-prepend":{"identifier":"deny-prepend","description":"Denies the prepend command without any pre-configured scope.","commands":{"allow":[],"deny":["prepend"]}},"deny-remove":{"identifier":"deny-remove","description":"Denies the remove command without any pre-configured scope.","commands":{"allow":[],"deny":["remove"]}},"deny-remove-at":{"identifier":"deny-remove-at","description":"Denies the remove_at command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_at"]}},"deny-set-accelerator":{"identifier":"deny-set-accelerator","description":"Denies the set_accelerator command without any pre-configured scope.","commands":{"allow":[],"deny":["set_accelerator"]}},"deny-set-as-app-menu":{"identifier":"deny-set-as-app-menu","description":"Denies the set_as_app_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_app_menu"]}},"deny-set-as-help-menu-for-nsapp":{"identifier":"deny-set-as-help-menu-for-nsapp","description":"Denies the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_help_menu_for_nsapp"]}},"deny-set-as-window-menu":{"identifier":"deny-set-as-window-menu","description":"Denies the set_as_window_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_window_menu"]}},"deny-set-as-windows-menu-for-nsapp":{"identifier":"deny-set-as-windows-menu-for-nsapp","description":"Denies the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_windows_menu_for_nsapp"]}},"deny-set-checked":{"identifier":"deny-set-checked","description":"Denies the set_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["set_checked"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-text":{"identifier":"deny-set-text","description":"Denies the set_text command without any pre-configured scope.","commands":{"allow":[],"deny":["set_text"]}},"deny-text":{"identifier":"deny-text","description":"Denies the text command without any pre-configured scope.","commands":{"allow":[],"deny":["text"]}}},"permission_sets":{},"global_scope_schema":null},"core:path":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-resolve-directory","allow-resolve","allow-normalize","allow-join","allow-dirname","allow-extname","allow-basename","allow-is-absolute"]},"permissions":{"allow-basename":{"identifier":"allow-basename","description":"Enables the basename command without any pre-configured scope.","commands":{"allow":["basename"],"deny":[]}},"allow-dirname":{"identifier":"allow-dirname","description":"Enables the dirname command without any pre-configured scope.","commands":{"allow":["dirname"],"deny":[]}},"allow-extname":{"identifier":"allow-extname","description":"Enables the extname command without any pre-configured scope.","commands":{"allow":["extname"],"deny":[]}},"allow-is-absolute":{"identifier":"allow-is-absolute","description":"Enables the is_absolute command without any pre-configured scope.","commands":{"allow":["is_absolute"],"deny":[]}},"allow-join":{"identifier":"allow-join","description":"Enables the join command without any pre-configured scope.","commands":{"allow":["join"],"deny":[]}},"allow-normalize":{"identifier":"allow-normalize","description":"Enables the normalize command without any pre-configured scope.","commands":{"allow":["normalize"],"deny":[]}},"allow-resolve":{"identifier":"allow-resolve","description":"Enables the resolve command without any pre-configured scope.","commands":{"allow":["resolve"],"deny":[]}},"allow-resolve-directory":{"identifier":"allow-resolve-directory","description":"Enables the resolve_directory command without any pre-configured scope.","commands":{"allow":["resolve_directory"],"deny":[]}},"deny-basename":{"identifier":"deny-basename","description":"Denies the basename command without any pre-configured scope.","commands":{"allow":[],"deny":["basename"]}},"deny-dirname":{"identifier":"deny-dirname","description":"Denies the dirname command without any pre-configured scope.","commands":{"allow":[],"deny":["dirname"]}},"deny-extname":{"identifier":"deny-extname","description":"Denies the extname command without any pre-configured scope.","commands":{"allow":[],"deny":["extname"]}},"deny-is-absolute":{"identifier":"deny-is-absolute","description":"Denies the is_absolute command without any pre-configured scope.","commands":{"allow":[],"deny":["is_absolute"]}},"deny-join":{"identifier":"deny-join","description":"Denies the join command without any pre-configured scope.","commands":{"allow":[],"deny":["join"]}},"deny-normalize":{"identifier":"deny-normalize","description":"Denies the normalize command without any pre-configured scope.","commands":{"allow":[],"deny":["normalize"]}},"deny-resolve":{"identifier":"deny-resolve","description":"Denies the resolve command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve"]}},"deny-resolve-directory":{"identifier":"deny-resolve-directory","description":"Denies the resolve_directory command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve_directory"]}}},"permission_sets":{},"global_scope_schema":null},"core:resources":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-close"]},"permissions":{"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}}},"permission_sets":{},"global_scope_schema":null},"core:tray":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-get-by-id","allow-remove-by-id","allow-set-icon","allow-set-menu","allow-set-tooltip","allow-set-title","allow-set-visible","allow-set-temp-dir-path","allow-set-icon-as-template","allow-set-show-menu-on-left-click"]},"permissions":{"allow-get-by-id":{"identifier":"allow-get-by-id","description":"Enables the get_by_id command without any pre-configured scope.","commands":{"allow":["get_by_id"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-remove-by-id":{"identifier":"allow-remove-by-id","description":"Enables the remove_by_id command without any pre-configured scope.","commands":{"allow":["remove_by_id"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-icon-as-template":{"identifier":"allow-set-icon-as-template","description":"Enables the set_icon_as_template command without any pre-configured scope.","commands":{"allow":["set_icon_as_template"],"deny":[]}},"allow-set-menu":{"identifier":"allow-set-menu","description":"Enables the set_menu command without any pre-configured scope.","commands":{"allow":["set_menu"],"deny":[]}},"allow-set-show-menu-on-left-click":{"identifier":"allow-set-show-menu-on-left-click","description":"Enables the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":["set_show_menu_on_left_click"],"deny":[]}},"allow-set-temp-dir-path":{"identifier":"allow-set-temp-dir-path","description":"Enables the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":["set_temp_dir_path"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-tooltip":{"identifier":"allow-set-tooltip","description":"Enables the set_tooltip command without any pre-configured scope.","commands":{"allow":["set_tooltip"],"deny":[]}},"allow-set-visible":{"identifier":"allow-set-visible","description":"Enables the set_visible command without any pre-configured scope.","commands":{"allow":["set_visible"],"deny":[]}},"deny-get-by-id":{"identifier":"deny-get-by-id","description":"Denies the get_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["get_by_id"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-remove-by-id":{"identifier":"deny-remove-by-id","description":"Denies the remove_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_by_id"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-icon-as-template":{"identifier":"deny-set-icon-as-template","description":"Denies the set_icon_as_template command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon_as_template"]}},"deny-set-menu":{"identifier":"deny-set-menu","description":"Denies the set_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_menu"]}},"deny-set-show-menu-on-left-click":{"identifier":"deny-set-show-menu-on-left-click","description":"Denies the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":[],"deny":["set_show_menu_on_left_click"]}},"deny-set-temp-dir-path":{"identifier":"deny-set-temp-dir-path","description":"Denies the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":[],"deny":["set_temp_dir_path"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-tooltip":{"identifier":"deny-set-tooltip","description":"Denies the set_tooltip command without any pre-configured scope.","commands":{"allow":[],"deny":["set_tooltip"]}},"deny-set-visible":{"identifier":"deny-set-visible","description":"Denies the set_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible"]}}},"permission_sets":{},"global_scope_schema":null},"core:webview":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-webviews","allow-webview-position","allow-webview-size","allow-internal-toggle-devtools"]},"permissions":{"allow-clear-all-browsing-data":{"identifier":"allow-clear-all-browsing-data","description":"Enables the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":["clear_all_browsing_data"],"deny":[]}},"allow-create-webview":{"identifier":"allow-create-webview","description":"Enables the create_webview command without any pre-configured scope.","commands":{"allow":["create_webview"],"deny":[]}},"allow-create-webview-window":{"identifier":"allow-create-webview-window","description":"Enables the create_webview_window command without any pre-configured scope.","commands":{"allow":["create_webview_window"],"deny":[]}},"allow-get-all-webviews":{"identifier":"allow-get-all-webviews","description":"Enables the get_all_webviews command without any pre-configured scope.","commands":{"allow":["get_all_webviews"],"deny":[]}},"allow-internal-toggle-devtools":{"identifier":"allow-internal-toggle-devtools","description":"Enables the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":["internal_toggle_devtools"],"deny":[]}},"allow-print":{"identifier":"allow-print","description":"Enables the print command without any pre-configured scope.","commands":{"allow":["print"],"deny":[]}},"allow-reparent":{"identifier":"allow-reparent","description":"Enables the reparent command without any pre-configured scope.","commands":{"allow":["reparent"],"deny":[]}},"allow-set-webview-auto-resize":{"identifier":"allow-set-webview-auto-resize","description":"Enables the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":["set_webview_auto_resize"],"deny":[]}},"allow-set-webview-background-color":{"identifier":"allow-set-webview-background-color","description":"Enables the set_webview_background_color command without any pre-configured scope.","commands":{"allow":["set_webview_background_color"],"deny":[]}},"allow-set-webview-focus":{"identifier":"allow-set-webview-focus","description":"Enables the set_webview_focus command without any pre-configured scope.","commands":{"allow":["set_webview_focus"],"deny":[]}},"allow-set-webview-position":{"identifier":"allow-set-webview-position","description":"Enables the set_webview_position command without any pre-configured scope.","commands":{"allow":["set_webview_position"],"deny":[]}},"allow-set-webview-size":{"identifier":"allow-set-webview-size","description":"Enables the set_webview_size command without any pre-configured scope.","commands":{"allow":["set_webview_size"],"deny":[]}},"allow-set-webview-zoom":{"identifier":"allow-set-webview-zoom","description":"Enables the set_webview_zoom command without any pre-configured scope.","commands":{"allow":["set_webview_zoom"],"deny":[]}},"allow-webview-close":{"identifier":"allow-webview-close","description":"Enables the webview_close command without any pre-configured scope.","commands":{"allow":["webview_close"],"deny":[]}},"allow-webview-hide":{"identifier":"allow-webview-hide","description":"Enables the webview_hide command without any pre-configured scope.","commands":{"allow":["webview_hide"],"deny":[]}},"allow-webview-position":{"identifier":"allow-webview-position","description":"Enables the webview_position command without any pre-configured scope.","commands":{"allow":["webview_position"],"deny":[]}},"allow-webview-show":{"identifier":"allow-webview-show","description":"Enables the webview_show command without any pre-configured scope.","commands":{"allow":["webview_show"],"deny":[]}},"allow-webview-size":{"identifier":"allow-webview-size","description":"Enables the webview_size command without any pre-configured scope.","commands":{"allow":["webview_size"],"deny":[]}},"deny-clear-all-browsing-data":{"identifier":"deny-clear-all-browsing-data","description":"Denies the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":[],"deny":["clear_all_browsing_data"]}},"deny-create-webview":{"identifier":"deny-create-webview","description":"Denies the create_webview command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview"]}},"deny-create-webview-window":{"identifier":"deny-create-webview-window","description":"Denies the create_webview_window command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview_window"]}},"deny-get-all-webviews":{"identifier":"deny-get-all-webviews","description":"Denies the get_all_webviews command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_webviews"]}},"deny-internal-toggle-devtools":{"identifier":"deny-internal-toggle-devtools","description":"Denies the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_devtools"]}},"deny-print":{"identifier":"deny-print","description":"Denies the print command without any pre-configured scope.","commands":{"allow":[],"deny":["print"]}},"deny-reparent":{"identifier":"deny-reparent","description":"Denies the reparent command without any pre-configured scope.","commands":{"allow":[],"deny":["reparent"]}},"deny-set-webview-auto-resize":{"identifier":"deny-set-webview-auto-resize","description":"Denies the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_auto_resize"]}},"deny-set-webview-background-color":{"identifier":"deny-set-webview-background-color","description":"Denies the set_webview_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_background_color"]}},"deny-set-webview-focus":{"identifier":"deny-set-webview-focus","description":"Denies the set_webview_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_focus"]}},"deny-set-webview-position":{"identifier":"deny-set-webview-position","description":"Denies the set_webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_position"]}},"deny-set-webview-size":{"identifier":"deny-set-webview-size","description":"Denies the set_webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_size"]}},"deny-set-webview-zoom":{"identifier":"deny-set-webview-zoom","description":"Denies the set_webview_zoom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_zoom"]}},"deny-webview-close":{"identifier":"deny-webview-close","description":"Denies the webview_close command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_close"]}},"deny-webview-hide":{"identifier":"deny-webview-hide","description":"Denies the webview_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_hide"]}},"deny-webview-position":{"identifier":"deny-webview-position","description":"Denies the webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_position"]}},"deny-webview-show":{"identifier":"deny-webview-show","description":"Denies the webview_show command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_show"]}},"deny-webview-size":{"identifier":"deny-webview-size","description":"Denies the webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_size"]}}},"permission_sets":{},"global_scope_schema":null},"core:window":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-windows","allow-scale-factor","allow-inner-position","allow-outer-position","allow-inner-size","allow-outer-size","allow-is-fullscreen","allow-is-minimized","allow-is-maximized","allow-is-focused","allow-is-decorated","allow-is-resizable","allow-is-maximizable","allow-is-minimizable","allow-is-closable","allow-is-visible","allow-is-enabled","allow-title","allow-current-monitor","allow-primary-monitor","allow-monitor-from-point","allow-available-monitors","allow-cursor-position","allow-theme","allow-is-always-on-top","allow-internal-toggle-maximize"]},"permissions":{"allow-available-monitors":{"identifier":"allow-available-monitors","description":"Enables the available_monitors command without any pre-configured scope.","commands":{"allow":["available_monitors"],"deny":[]}},"allow-center":{"identifier":"allow-center","description":"Enables the center command without any pre-configured scope.","commands":{"allow":["center"],"deny":[]}},"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"allow-create":{"identifier":"allow-create","description":"Enables the create command without any pre-configured scope.","commands":{"allow":["create"],"deny":[]}},"allow-current-monitor":{"identifier":"allow-current-monitor","description":"Enables the current_monitor command without any pre-configured scope.","commands":{"allow":["current_monitor"],"deny":[]}},"allow-cursor-position":{"identifier":"allow-cursor-position","description":"Enables the cursor_position command without any pre-configured scope.","commands":{"allow":["cursor_position"],"deny":[]}},"allow-destroy":{"identifier":"allow-destroy","description":"Enables the destroy command without any pre-configured scope.","commands":{"allow":["destroy"],"deny":[]}},"allow-get-all-windows":{"identifier":"allow-get-all-windows","description":"Enables the get_all_windows command without any pre-configured scope.","commands":{"allow":["get_all_windows"],"deny":[]}},"allow-hide":{"identifier":"allow-hide","description":"Enables the hide command without any pre-configured scope.","commands":{"allow":["hide"],"deny":[]}},"allow-inner-position":{"identifier":"allow-inner-position","description":"Enables the inner_position command without any pre-configured scope.","commands":{"allow":["inner_position"],"deny":[]}},"allow-inner-size":{"identifier":"allow-inner-size","description":"Enables the inner_size command without any pre-configured scope.","commands":{"allow":["inner_size"],"deny":[]}},"allow-internal-toggle-maximize":{"identifier":"allow-internal-toggle-maximize","description":"Enables the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":["internal_toggle_maximize"],"deny":[]}},"allow-is-always-on-top":{"identifier":"allow-is-always-on-top","description":"Enables the is_always_on_top command without any pre-configured scope.","commands":{"allow":["is_always_on_top"],"deny":[]}},"allow-is-closable":{"identifier":"allow-is-closable","description":"Enables the is_closable command without any pre-configured scope.","commands":{"allow":["is_closable"],"deny":[]}},"allow-is-decorated":{"identifier":"allow-is-decorated","description":"Enables the is_decorated command without any pre-configured scope.","commands":{"allow":["is_decorated"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-is-focused":{"identifier":"allow-is-focused","description":"Enables the is_focused command without any pre-configured scope.","commands":{"allow":["is_focused"],"deny":[]}},"allow-is-fullscreen":{"identifier":"allow-is-fullscreen","description":"Enables the is_fullscreen command without any pre-configured scope.","commands":{"allow":["is_fullscreen"],"deny":[]}},"allow-is-maximizable":{"identifier":"allow-is-maximizable","description":"Enables the is_maximizable command without any pre-configured scope.","commands":{"allow":["is_maximizable"],"deny":[]}},"allow-is-maximized":{"identifier":"allow-is-maximized","description":"Enables the is_maximized command without any pre-configured scope.","commands":{"allow":["is_maximized"],"deny":[]}},"allow-is-minimizable":{"identifier":"allow-is-minimizable","description":"Enables the is_minimizable command without any pre-configured scope.","commands":{"allow":["is_minimizable"],"deny":[]}},"allow-is-minimized":{"identifier":"allow-is-minimized","description":"Enables the is_minimized command without any pre-configured scope.","commands":{"allow":["is_minimized"],"deny":[]}},"allow-is-resizable":{"identifier":"allow-is-resizable","description":"Enables the is_resizable command without any pre-configured scope.","commands":{"allow":["is_resizable"],"deny":[]}},"allow-is-visible":{"identifier":"allow-is-visible","description":"Enables the is_visible command without any pre-configured scope.","commands":{"allow":["is_visible"],"deny":[]}},"allow-maximize":{"identifier":"allow-maximize","description":"Enables the maximize command without any pre-configured scope.","commands":{"allow":["maximize"],"deny":[]}},"allow-minimize":{"identifier":"allow-minimize","description":"Enables the minimize command without any pre-configured scope.","commands":{"allow":["minimize"],"deny":[]}},"allow-monitor-from-point":{"identifier":"allow-monitor-from-point","description":"Enables the monitor_from_point command without any pre-configured scope.","commands":{"allow":["monitor_from_point"],"deny":[]}},"allow-outer-position":{"identifier":"allow-outer-position","description":"Enables the outer_position command without any pre-configured scope.","commands":{"allow":["outer_position"],"deny":[]}},"allow-outer-size":{"identifier":"allow-outer-size","description":"Enables the outer_size command without any pre-configured scope.","commands":{"allow":["outer_size"],"deny":[]}},"allow-primary-monitor":{"identifier":"allow-primary-monitor","description":"Enables the primary_monitor command without any pre-configured scope.","commands":{"allow":["primary_monitor"],"deny":[]}},"allow-request-user-attention":{"identifier":"allow-request-user-attention","description":"Enables the request_user_attention command without any pre-configured scope.","commands":{"allow":["request_user_attention"],"deny":[]}},"allow-scale-factor":{"identifier":"allow-scale-factor","description":"Enables the scale_factor command without any pre-configured scope.","commands":{"allow":["scale_factor"],"deny":[]}},"allow-set-always-on-bottom":{"identifier":"allow-set-always-on-bottom","description":"Enables the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":["set_always_on_bottom"],"deny":[]}},"allow-set-always-on-top":{"identifier":"allow-set-always-on-top","description":"Enables the set_always_on_top command without any pre-configured scope.","commands":{"allow":["set_always_on_top"],"deny":[]}},"allow-set-background-color":{"identifier":"allow-set-background-color","description":"Enables the set_background_color command without any pre-configured scope.","commands":{"allow":["set_background_color"],"deny":[]}},"allow-set-badge-count":{"identifier":"allow-set-badge-count","description":"Enables the set_badge_count command without any pre-configured scope.","commands":{"allow":["set_badge_count"],"deny":[]}},"allow-set-badge-label":{"identifier":"allow-set-badge-label","description":"Enables the set_badge_label command without any pre-configured scope.","commands":{"allow":["set_badge_label"],"deny":[]}},"allow-set-closable":{"identifier":"allow-set-closable","description":"Enables the set_closable command without any pre-configured scope.","commands":{"allow":["set_closable"],"deny":[]}},"allow-set-content-protected":{"identifier":"allow-set-content-protected","description":"Enables the set_content_protected command without any pre-configured scope.","commands":{"allow":["set_content_protected"],"deny":[]}},"allow-set-cursor-grab":{"identifier":"allow-set-cursor-grab","description":"Enables the set_cursor_grab command without any pre-configured scope.","commands":{"allow":["set_cursor_grab"],"deny":[]}},"allow-set-cursor-icon":{"identifier":"allow-set-cursor-icon","description":"Enables the set_cursor_icon command without any pre-configured scope.","commands":{"allow":["set_cursor_icon"],"deny":[]}},"allow-set-cursor-position":{"identifier":"allow-set-cursor-position","description":"Enables the set_cursor_position command without any pre-configured scope.","commands":{"allow":["set_cursor_position"],"deny":[]}},"allow-set-cursor-visible":{"identifier":"allow-set-cursor-visible","description":"Enables the set_cursor_visible command without any pre-configured scope.","commands":{"allow":["set_cursor_visible"],"deny":[]}},"allow-set-decorations":{"identifier":"allow-set-decorations","description":"Enables the set_decorations command without any pre-configured scope.","commands":{"allow":["set_decorations"],"deny":[]}},"allow-set-effects":{"identifier":"allow-set-effects","description":"Enables the set_effects command without any pre-configured scope.","commands":{"allow":["set_effects"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-focus":{"identifier":"allow-set-focus","description":"Enables the set_focus command without any pre-configured scope.","commands":{"allow":["set_focus"],"deny":[]}},"allow-set-focusable":{"identifier":"allow-set-focusable","description":"Enables the set_focusable command without any pre-configured scope.","commands":{"allow":["set_focusable"],"deny":[]}},"allow-set-fullscreen":{"identifier":"allow-set-fullscreen","description":"Enables the set_fullscreen command without any pre-configured scope.","commands":{"allow":["set_fullscreen"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-ignore-cursor-events":{"identifier":"allow-set-ignore-cursor-events","description":"Enables the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":["set_ignore_cursor_events"],"deny":[]}},"allow-set-max-size":{"identifier":"allow-set-max-size","description":"Enables the set_max_size command without any pre-configured scope.","commands":{"allow":["set_max_size"],"deny":[]}},"allow-set-maximizable":{"identifier":"allow-set-maximizable","description":"Enables the set_maximizable command without any pre-configured scope.","commands":{"allow":["set_maximizable"],"deny":[]}},"allow-set-min-size":{"identifier":"allow-set-min-size","description":"Enables the set_min_size command without any pre-configured scope.","commands":{"allow":["set_min_size"],"deny":[]}},"allow-set-minimizable":{"identifier":"allow-set-minimizable","description":"Enables the set_minimizable command without any pre-configured scope.","commands":{"allow":["set_minimizable"],"deny":[]}},"allow-set-overlay-icon":{"identifier":"allow-set-overlay-icon","description":"Enables the set_overlay_icon command without any pre-configured scope.","commands":{"allow":["set_overlay_icon"],"deny":[]}},"allow-set-position":{"identifier":"allow-set-position","description":"Enables the set_position command without any pre-configured scope.","commands":{"allow":["set_position"],"deny":[]}},"allow-set-progress-bar":{"identifier":"allow-set-progress-bar","description":"Enables the set_progress_bar command without any pre-configured scope.","commands":{"allow":["set_progress_bar"],"deny":[]}},"allow-set-resizable":{"identifier":"allow-set-resizable","description":"Enables the set_resizable command without any pre-configured scope.","commands":{"allow":["set_resizable"],"deny":[]}},"allow-set-shadow":{"identifier":"allow-set-shadow","description":"Enables the set_shadow command without any pre-configured scope.","commands":{"allow":["set_shadow"],"deny":[]}},"allow-set-simple-fullscreen":{"identifier":"allow-set-simple-fullscreen","description":"Enables the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":["set_simple_fullscreen"],"deny":[]}},"allow-set-size":{"identifier":"allow-set-size","description":"Enables the set_size command without any pre-configured scope.","commands":{"allow":["set_size"],"deny":[]}},"allow-set-size-constraints":{"identifier":"allow-set-size-constraints","description":"Enables the set_size_constraints command without any pre-configured scope.","commands":{"allow":["set_size_constraints"],"deny":[]}},"allow-set-skip-taskbar":{"identifier":"allow-set-skip-taskbar","description":"Enables the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":["set_skip_taskbar"],"deny":[]}},"allow-set-theme":{"identifier":"allow-set-theme","description":"Enables the set_theme command without any pre-configured scope.","commands":{"allow":["set_theme"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-title-bar-style":{"identifier":"allow-set-title-bar-style","description":"Enables the set_title_bar_style command without any pre-configured scope.","commands":{"allow":["set_title_bar_style"],"deny":[]}},"allow-set-visible-on-all-workspaces":{"identifier":"allow-set-visible-on-all-workspaces","description":"Enables the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":["set_visible_on_all_workspaces"],"deny":[]}},"allow-show":{"identifier":"allow-show","description":"Enables the show command without any pre-configured scope.","commands":{"allow":["show"],"deny":[]}},"allow-start-dragging":{"identifier":"allow-start-dragging","description":"Enables the start_dragging command without any pre-configured scope.","commands":{"allow":["start_dragging"],"deny":[]}},"allow-start-resize-dragging":{"identifier":"allow-start-resize-dragging","description":"Enables the start_resize_dragging command without any pre-configured scope.","commands":{"allow":["start_resize_dragging"],"deny":[]}},"allow-theme":{"identifier":"allow-theme","description":"Enables the theme command without any pre-configured scope.","commands":{"allow":["theme"],"deny":[]}},"allow-title":{"identifier":"allow-title","description":"Enables the title command without any pre-configured scope.","commands":{"allow":["title"],"deny":[]}},"allow-toggle-maximize":{"identifier":"allow-toggle-maximize","description":"Enables the toggle_maximize command without any pre-configured scope.","commands":{"allow":["toggle_maximize"],"deny":[]}},"allow-unmaximize":{"identifier":"allow-unmaximize","description":"Enables the unmaximize command without any pre-configured scope.","commands":{"allow":["unmaximize"],"deny":[]}},"allow-unminimize":{"identifier":"allow-unminimize","description":"Enables the unminimize command without any pre-configured scope.","commands":{"allow":["unminimize"],"deny":[]}},"deny-available-monitors":{"identifier":"deny-available-monitors","description":"Denies the available_monitors command without any pre-configured scope.","commands":{"allow":[],"deny":["available_monitors"]}},"deny-center":{"identifier":"deny-center","description":"Denies the center command without any pre-configured scope.","commands":{"allow":[],"deny":["center"]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}},"deny-create":{"identifier":"deny-create","description":"Denies the create command without any pre-configured scope.","commands":{"allow":[],"deny":["create"]}},"deny-current-monitor":{"identifier":"deny-current-monitor","description":"Denies the current_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["current_monitor"]}},"deny-cursor-position":{"identifier":"deny-cursor-position","description":"Denies the cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["cursor_position"]}},"deny-destroy":{"identifier":"deny-destroy","description":"Denies the destroy command without any pre-configured scope.","commands":{"allow":[],"deny":["destroy"]}},"deny-get-all-windows":{"identifier":"deny-get-all-windows","description":"Denies the get_all_windows command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_windows"]}},"deny-hide":{"identifier":"deny-hide","description":"Denies the hide command without any pre-configured scope.","commands":{"allow":[],"deny":["hide"]}},"deny-inner-position":{"identifier":"deny-inner-position","description":"Denies the inner_position command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_position"]}},"deny-inner-size":{"identifier":"deny-inner-size","description":"Denies the inner_size command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_size"]}},"deny-internal-toggle-maximize":{"identifier":"deny-internal-toggle-maximize","description":"Denies the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_maximize"]}},"deny-is-always-on-top":{"identifier":"deny-is-always-on-top","description":"Denies the is_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["is_always_on_top"]}},"deny-is-closable":{"identifier":"deny-is-closable","description":"Denies the is_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_closable"]}},"deny-is-decorated":{"identifier":"deny-is-decorated","description":"Denies the is_decorated command without any pre-configured scope.","commands":{"allow":[],"deny":["is_decorated"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-is-focused":{"identifier":"deny-is-focused","description":"Denies the is_focused command without any pre-configured scope.","commands":{"allow":[],"deny":["is_focused"]}},"deny-is-fullscreen":{"identifier":"deny-is-fullscreen","description":"Denies the is_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["is_fullscreen"]}},"deny-is-maximizable":{"identifier":"deny-is-maximizable","description":"Denies the is_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximizable"]}},"deny-is-maximized":{"identifier":"deny-is-maximized","description":"Denies the is_maximized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximized"]}},"deny-is-minimizable":{"identifier":"deny-is-minimizable","description":"Denies the is_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimizable"]}},"deny-is-minimized":{"identifier":"deny-is-minimized","description":"Denies the is_minimized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimized"]}},"deny-is-resizable":{"identifier":"deny-is-resizable","description":"Denies the is_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_resizable"]}},"deny-is-visible":{"identifier":"deny-is-visible","description":"Denies the is_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["is_visible"]}},"deny-maximize":{"identifier":"deny-maximize","description":"Denies the maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["maximize"]}},"deny-minimize":{"identifier":"deny-minimize","description":"Denies the minimize command without any pre-configured scope.","commands":{"allow":[],"deny":["minimize"]}},"deny-monitor-from-point":{"identifier":"deny-monitor-from-point","description":"Denies the monitor_from_point command without any pre-configured scope.","commands":{"allow":[],"deny":["monitor_from_point"]}},"deny-outer-position":{"identifier":"deny-outer-position","description":"Denies the outer_position command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_position"]}},"deny-outer-size":{"identifier":"deny-outer-size","description":"Denies the outer_size command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_size"]}},"deny-primary-monitor":{"identifier":"deny-primary-monitor","description":"Denies the primary_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["primary_monitor"]}},"deny-request-user-attention":{"identifier":"deny-request-user-attention","description":"Denies the request_user_attention command without any pre-configured scope.","commands":{"allow":[],"deny":["request_user_attention"]}},"deny-scale-factor":{"identifier":"deny-scale-factor","description":"Denies the scale_factor command without any pre-configured scope.","commands":{"allow":[],"deny":["scale_factor"]}},"deny-set-always-on-bottom":{"identifier":"deny-set-always-on-bottom","description":"Denies the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_bottom"]}},"deny-set-always-on-top":{"identifier":"deny-set-always-on-top","description":"Denies the set_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_top"]}},"deny-set-background-color":{"identifier":"deny-set-background-color","description":"Denies the set_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_background_color"]}},"deny-set-badge-count":{"identifier":"deny-set-badge-count","description":"Denies the set_badge_count command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_count"]}},"deny-set-badge-label":{"identifier":"deny-set-badge-label","description":"Denies the set_badge_label command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_label"]}},"deny-set-closable":{"identifier":"deny-set-closable","description":"Denies the set_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_closable"]}},"deny-set-content-protected":{"identifier":"deny-set-content-protected","description":"Denies the set_content_protected command without any pre-configured scope.","commands":{"allow":[],"deny":["set_content_protected"]}},"deny-set-cursor-grab":{"identifier":"deny-set-cursor-grab","description":"Denies the set_cursor_grab command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_grab"]}},"deny-set-cursor-icon":{"identifier":"deny-set-cursor-icon","description":"Denies the set_cursor_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_icon"]}},"deny-set-cursor-position":{"identifier":"deny-set-cursor-position","description":"Denies the set_cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_position"]}},"deny-set-cursor-visible":{"identifier":"deny-set-cursor-visible","description":"Denies the set_cursor_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_visible"]}},"deny-set-decorations":{"identifier":"deny-set-decorations","description":"Denies the set_decorations command without any pre-configured scope.","commands":{"allow":[],"deny":["set_decorations"]}},"deny-set-effects":{"identifier":"deny-set-effects","description":"Denies the set_effects command without any pre-configured scope.","commands":{"allow":[],"deny":["set_effects"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-focus":{"identifier":"deny-set-focus","description":"Denies the set_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focus"]}},"deny-set-focusable":{"identifier":"deny-set-focusable","description":"Denies the set_focusable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focusable"]}},"deny-set-fullscreen":{"identifier":"deny-set-fullscreen","description":"Denies the set_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_fullscreen"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-ignore-cursor-events":{"identifier":"deny-set-ignore-cursor-events","description":"Denies the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":[],"deny":["set_ignore_cursor_events"]}},"deny-set-max-size":{"identifier":"deny-set-max-size","description":"Denies the set_max_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_max_size"]}},"deny-set-maximizable":{"identifier":"deny-set-maximizable","description":"Denies the set_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_maximizable"]}},"deny-set-min-size":{"identifier":"deny-set-min-size","description":"Denies the set_min_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_min_size"]}},"deny-set-minimizable":{"identifier":"deny-set-minimizable","description":"Denies the set_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_minimizable"]}},"deny-set-overlay-icon":{"identifier":"deny-set-overlay-icon","description":"Denies the set_overlay_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_overlay_icon"]}},"deny-set-position":{"identifier":"deny-set-position","description":"Denies the set_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_position"]}},"deny-set-progress-bar":{"identifier":"deny-set-progress-bar","description":"Denies the set_progress_bar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_progress_bar"]}},"deny-set-resizable":{"identifier":"deny-set-resizable","description":"Denies the set_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_resizable"]}},"deny-set-shadow":{"identifier":"deny-set-shadow","description":"Denies the set_shadow command without any pre-configured scope.","commands":{"allow":[],"deny":["set_shadow"]}},"deny-set-simple-fullscreen":{"identifier":"deny-set-simple-fullscreen","description":"Denies the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_simple_fullscreen"]}},"deny-set-size":{"identifier":"deny-set-size","description":"Denies the set_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size"]}},"deny-set-size-constraints":{"identifier":"deny-set-size-constraints","description":"Denies the set_size_constraints command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size_constraints"]}},"deny-set-skip-taskbar":{"identifier":"deny-set-skip-taskbar","description":"Denies the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_skip_taskbar"]}},"deny-set-theme":{"identifier":"deny-set-theme","description":"Denies the set_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_theme"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-title-bar-style":{"identifier":"deny-set-title-bar-style","description":"Denies the set_title_bar_style command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title_bar_style"]}},"deny-set-visible-on-all-workspaces":{"identifier":"deny-set-visible-on-all-workspaces","description":"Denies the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible_on_all_workspaces"]}},"deny-show":{"identifier":"deny-show","description":"Denies the show command without any pre-configured scope.","commands":{"allow":[],"deny":["show"]}},"deny-start-dragging":{"identifier":"deny-start-dragging","description":"Denies the start_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_dragging"]}},"deny-start-resize-dragging":{"identifier":"deny-start-resize-dragging","description":"Denies the start_resize_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_resize_dragging"]}},"deny-theme":{"identifier":"deny-theme","description":"Denies the theme command without any pre-configured scope.","commands":{"allow":[],"deny":["theme"]}},"deny-title":{"identifier":"deny-title","description":"Denies the title command without any pre-configured scope.","commands":{"allow":[],"deny":["title"]}},"deny-toggle-maximize":{"identifier":"deny-toggle-maximize","description":"Denies the toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["toggle_maximize"]}},"deny-unmaximize":{"identifier":"deny-unmaximize","description":"Denies the unmaximize command without any pre-configured scope.","commands":{"allow":[],"deny":["unmaximize"]}},"deny-unminimize":{"identifier":"deny-unminimize","description":"Denies the unminimize command without any pre-configured scope.","commands":{"allow":[],"deny":["unminimize"]}}},"permission_sets":{},"global_scope_schema":null},"shell":{"default_permission":{"identifier":"default","description":"This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n","permissions":["allow-open"]},"permissions":{"allow-execute":{"identifier":"allow-execute","description":"Enables the execute command without any pre-configured scope.","commands":{"allow":["execute"],"deny":[]}},"allow-kill":{"identifier":"allow-kill","description":"Enables the kill command without any pre-configured scope.","commands":{"allow":["kill"],"deny":[]}},"allow-open":{"identifier":"allow-open","description":"Enables the open command without any pre-configured scope.","commands":{"allow":["open"],"deny":[]}},"allow-spawn":{"identifier":"allow-spawn","description":"Enables the spawn command without any pre-configured scope.","commands":{"allow":["spawn"],"deny":[]}},"allow-stdin-write":{"identifier":"allow-stdin-write","description":"Enables the stdin_write command without any pre-configured scope.","commands":{"allow":["stdin_write"],"deny":[]}},"deny-execute":{"identifier":"deny-execute","description":"Denies the execute command without any pre-configured scope.","commands":{"allow":[],"deny":["execute"]}},"deny-kill":{"identifier":"deny-kill","description":"Denies the kill command without any pre-configured scope.","commands":{"allow":[],"deny":["kill"]}},"deny-open":{"identifier":"deny-open","description":"Denies the open command without any pre-configured scope.","commands":{"allow":[],"deny":["open"]}},"deny-spawn":{"identifier":"deny-spawn","description":"Denies the spawn command without any pre-configured scope.","commands":{"allow":[],"deny":["spawn"]}},"deny-stdin-write":{"identifier":"deny-stdin-write","description":"Denies the stdin_write command without any pre-configured scope.","commands":{"allow":[],"deny":["stdin_write"]}}},"permission_sets":{},"global_scope_schema":{"$schema":"http://json-schema.org/draft-07/schema#","anyOf":[{"additionalProperties":false,"properties":{"args":{"allOf":[{"$ref":"#/definitions/ShellScopeEntryAllowedArgs"}],"description":"The allowed arguments for the command execution."},"cmd":{"description":"The command name. It can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.","type":"string"},"name":{"description":"The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.","type":"string"}},"required":["cmd","name"],"type":"object"},{"additionalProperties":false,"properties":{"args":{"allOf":[{"$ref":"#/definitions/ShellScopeEntryAllowedArgs"}],"description":"The allowed arguments for the command execution."},"name":{"description":"The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.","type":"string"},"sidecar":{"description":"If this command is a sidecar command.","type":"boolean"}},"required":["name","sidecar"],"type":"object"}],"definitions":{"ShellScopeEntryAllowedArg":{"anyOf":[{"description":"A non-configurable argument that is passed to the command in the order it was specified.","type":"string"},{"additionalProperties":false,"description":"A variable that is set while calling the command from the webview API.","properties":{"raw":{"default":false,"description":"Marks the validator as a raw regex, meaning the plugin should not make any modification at runtime.\n\nThis means the regex will not match on the entire string by default, which might be exploited if your regex allow unexpected input to be considered valid. When using this option, make sure your regex is correct.","type":"boolean"},"validator":{"description":"[regex] validator to require passed values to conform to an expected input.\n\nThis will require the argument value passed to this variable to match the `validator` regex before it will be executed.\n\nThe regex string is by default surrounded by `^...$` to match the full string. For example the `https?://\\w+` regex would be registered as `^https?://\\w+$`.\n\n[regex]: <https://docs.rs/regex/latest/regex/#syntax>","type":"string"}},"required":["validator"],"type":"object"}],"description":"A command argument allowed to be executed by the webview API."},"ShellScopeEntryAllowedArgs":{"anyOf":[{"description":"Use a simple boolean to allow all or disable all arguments to this command configuration.","type":"boolean"},{"description":"A specific set of [`ShellScopeEntryAllowedArg`] that are valid to call for the command configuration.","items":{"$ref":"#/definitions/ShellScopeEntryAllowedArg"},"type":"array"}],"description":"A set of command arguments allowed to be executed by the webview API.\n\nA value of `true` will allow any arguments to be passed to the command. `false` will disable all arguments. A list of [`ShellScopeEntryAllowedArg`] will set those arguments as the only valid arguments to be passed to the attached command configuration."}},"description":"Shell scope entry.","title":"ShellScopeEntry"}}}
\ No newline at end of file
+{"core":{"default_permission":{"identifier":"default","description":"Default core plugins set.","permissions":["core:path:default","core:event:default","core:window:default","core:webview:default","core:app:default","core:image:default","core:resources:default","core:menu:default","core:tray:default"]},"permissions":{},"permission_sets":{},"global_scope_schema":null},"core:app":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-version","allow-name","allow-tauri-version","allow-identifier","allow-bundle-type","allow-register-listener","allow-remove-listener","allow-supports-multiple-windows"]},"permissions":{"allow-app-hide":{"identifier":"allow-app-hide","description":"Enables the app_hide command without any pre-configured scope.","commands":{"allow":["app_hide"],"deny":[]}},"allow-app-show":{"identifier":"allow-app-show","description":"Enables the app_show command without any pre-configured scope.","commands":{"allow":["app_show"],"deny":[]}},"allow-bundle-type":{"identifier":"allow-bundle-type","description":"Enables the bundle_type command without any pre-configured scope.","commands":{"allow":["bundle_type"],"deny":[]}},"allow-default-window-icon":{"identifier":"allow-default-window-icon","description":"Enables the default_window_icon command without any pre-configured scope.","commands":{"allow":["default_window_icon"],"deny":[]}},"allow-fetch-data-store-identifiers":{"identifier":"allow-fetch-data-store-identifiers","description":"Enables the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":["fetch_data_store_identifiers"],"deny":[]}},"allow-identifier":{"identifier":"allow-identifier","description":"Enables the identifier command without any pre-configured scope.","commands":{"allow":["identifier"],"deny":[]}},"allow-name":{"identifier":"allow-name","description":"Enables the name command without any pre-configured scope.","commands":{"allow":["name"],"deny":[]}},"allow-register-listener":{"identifier":"allow-register-listener","description":"Enables the register_listener command without any pre-configured scope.","commands":{"allow":["register_listener"],"deny":[]}},"allow-remove-data-store":{"identifier":"allow-remove-data-store","description":"Enables the remove_data_store command without any pre-configured scope.","commands":{"allow":["remove_data_store"],"deny":[]}},"allow-remove-listener":{"identifier":"allow-remove-listener","description":"Enables the remove_listener command without any pre-configured scope.","commands":{"allow":["remove_listener"],"deny":[]}},"allow-set-app-theme":{"identifier":"allow-set-app-theme","description":"Enables the set_app_theme command without any pre-configured scope.","commands":{"allow":["set_app_theme"],"deny":[]}},"allow-set-dock-visibility":{"identifier":"allow-set-dock-visibility","description":"Enables the set_dock_visibility command without any pre-configured scope.","commands":{"allow":["set_dock_visibility"],"deny":[]}},"allow-supports-multiple-windows":{"identifier":"allow-supports-multiple-windows","description":"Enables the supports_multiple_windows command without any pre-configured scope.","commands":{"allow":["supports_multiple_windows"],"deny":[]}},"allow-tauri-version":{"identifier":"allow-tauri-version","description":"Enables the tauri_version command without any pre-configured scope.","commands":{"allow":["tauri_version"],"deny":[]}},"allow-version":{"identifier":"allow-version","description":"Enables the version command without any pre-configured scope.","commands":{"allow":["version"],"deny":[]}},"deny-app-hide":{"identifier":"deny-app-hide","description":"Denies the app_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["app_hide"]}},"deny-app-show":{"identifier":"deny-app-show","description":"Denies the app_show command without any pre-configured scope.","commands":{"allow":[],"deny":["app_show"]}},"deny-bundle-type":{"identifier":"deny-bundle-type","description":"Denies the bundle_type command without any pre-configured scope.","commands":{"allow":[],"deny":["bundle_type"]}},"deny-default-window-icon":{"identifier":"deny-default-window-icon","description":"Denies the default_window_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["default_window_icon"]}},"deny-fetch-data-store-identifiers":{"identifier":"deny-fetch-data-store-identifiers","description":"Denies the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":[],"deny":["fetch_data_store_identifiers"]}},"deny-identifier":{"identifier":"deny-identifier","description":"Denies the identifier command without any pre-configured scope.","commands":{"allow":[],"deny":["identifier"]}},"deny-name":{"identifier":"deny-name","description":"Denies the name command without any pre-configured scope.","commands":{"allow":[],"deny":["name"]}},"deny-register-listener":{"identifier":"deny-register-listener","description":"Denies the register_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["register_listener"]}},"deny-remove-data-store":{"identifier":"deny-remove-data-store","description":"Denies the remove_data_store command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_data_store"]}},"deny-remove-listener":{"identifier":"deny-remove-listener","description":"Denies the remove_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_listener"]}},"deny-set-app-theme":{"identifier":"deny-set-app-theme","description":"Denies the set_app_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_app_theme"]}},"deny-set-dock-visibility":{"identifier":"deny-set-dock-visibility","description":"Denies the set_dock_visibility command without any pre-configured scope.","commands":{"allow":[],"deny":["set_dock_visibility"]}},"deny-supports-multiple-windows":{"identifier":"deny-supports-multiple-windows","description":"Denies the supports_multiple_windows command without any pre-configured scope.","commands":{"allow":[],"deny":["supports_multiple_windows"]}},"deny-tauri-version":{"identifier":"deny-tauri-version","description":"Denies the tauri_version command without any pre-configured scope.","commands":{"allow":[],"deny":["tauri_version"]}},"deny-version":{"identifier":"deny-version","description":"Denies the version command without any pre-configured scope.","commands":{"allow":[],"deny":["version"]}}},"permission_sets":{},"global_scope_schema":null},"core:event":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-listen","allow-unlisten","allow-emit","allow-emit-to"]},"permissions":{"allow-emit":{"identifier":"allow-emit","description":"Enables the emit command without any pre-configured scope.","commands":{"allow":["emit"],"deny":[]}},"allow-emit-to":{"identifier":"allow-emit-to","description":"Enables the emit_to command without any pre-configured scope.","commands":{"allow":["emit_to"],"deny":[]}},"allow-listen":{"identifier":"allow-listen","description":"Enables the listen command without any pre-configured scope.","commands":{"allow":["listen"],"deny":[]}},"allow-unlisten":{"identifier":"allow-unlisten","description":"Enables the unlisten command without any pre-configured scope.","commands":{"allow":["unlisten"],"deny":[]}},"deny-emit":{"identifier":"deny-emit","description":"Denies the emit command without any pre-configured scope.","commands":{"allow":[],"deny":["emit"]}},"deny-emit-to":{"identifier":"deny-emit-to","description":"Denies the emit_to command without any pre-configured scope.","commands":{"allow":[],"deny":["emit_to"]}},"deny-listen":{"identifier":"deny-listen","description":"Denies the listen command without any pre-configured scope.","commands":{"allow":[],"deny":["listen"]}},"deny-unlisten":{"identifier":"deny-unlisten","description":"Denies the unlisten command without any pre-configured scope.","commands":{"allow":[],"deny":["unlisten"]}}},"permission_sets":{},"global_scope_schema":null},"core:image":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-from-bytes","allow-from-path","allow-rgba","allow-size"]},"permissions":{"allow-from-bytes":{"identifier":"allow-from-bytes","description":"Enables the from_bytes command without any pre-configured scope.","commands":{"allow":["from_bytes"],"deny":[]}},"allow-from-path":{"identifier":"allow-from-path","description":"Enables the from_path command without any pre-configured scope.","commands":{"allow":["from_path"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-rgba":{"identifier":"allow-rgba","description":"Enables the rgba command without any pre-configured scope.","commands":{"allow":["rgba"],"deny":[]}},"allow-size":{"identifier":"allow-size","description":"Enables the size command without any pre-configured scope.","commands":{"allow":["size"],"deny":[]}},"deny-from-bytes":{"identifier":"deny-from-bytes","description":"Denies the from_bytes command without any pre-configured scope.","commands":{"allow":[],"deny":["from_bytes"]}},"deny-from-path":{"identifier":"deny-from-path","description":"Denies the from_path command without any pre-configured scope.","commands":{"allow":[],"deny":["from_path"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-rgba":{"identifier":"deny-rgba","description":"Denies the rgba command without any pre-configured scope.","commands":{"allow":[],"deny":["rgba"]}},"deny-size":{"identifier":"deny-size","description":"Denies the size command without any pre-configured scope.","commands":{"allow":[],"deny":["size"]}}},"permission_sets":{},"global_scope_schema":null},"core:menu":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-append","allow-prepend","allow-insert","allow-remove","allow-remove-at","allow-items","allow-get","allow-popup","allow-create-default","allow-set-as-app-menu","allow-set-as-window-menu","allow-text","allow-set-text","allow-is-enabled","allow-set-enabled","allow-set-accelerator","allow-set-as-windows-menu-for-nsapp","allow-set-as-help-menu-for-nsapp","allow-is-checked","allow-set-checked","allow-set-icon"]},"permissions":{"allow-append":{"identifier":"allow-append","description":"Enables the append command without any pre-configured scope.","commands":{"allow":["append"],"deny":[]}},"allow-create-default":{"identifier":"allow-create-default","description":"Enables the create_default command without any pre-configured scope.","commands":{"allow":["create_default"],"deny":[]}},"allow-get":{"identifier":"allow-get","description":"Enables the get command without any pre-configured scope.","commands":{"allow":["get"],"deny":[]}},"allow-insert":{"identifier":"allow-insert","description":"Enables the insert command without any pre-configured scope.","commands":{"allow":["insert"],"deny":[]}},"allow-is-checked":{"identifier":"allow-is-checked","description":"Enables the is_checked command without any pre-configured scope.","commands":{"allow":["is_checked"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-items":{"identifier":"allow-items","description":"Enables the items command without any pre-configured scope.","commands":{"allow":["items"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-popup":{"identifier":"allow-popup","description":"Enables the popup command without any pre-configured scope.","commands":{"allow":["popup"],"deny":[]}},"allow-prepend":{"identifier":"allow-prepend","description":"Enables the prepend command without any pre-configured scope.","commands":{"allow":["prepend"],"deny":[]}},"allow-remove":{"identifier":"allow-remove","description":"Enables the remove command without any pre-configured scope.","commands":{"allow":["remove"],"deny":[]}},"allow-remove-at":{"identifier":"allow-remove-at","description":"Enables the remove_at command without any pre-configured scope.","commands":{"allow":["remove_at"],"deny":[]}},"allow-set-accelerator":{"identifier":"allow-set-accelerator","description":"Enables the set_accelerator command without any pre-configured scope.","commands":{"allow":["set_accelerator"],"deny":[]}},"allow-set-as-app-menu":{"identifier":"allow-set-as-app-menu","description":"Enables the set_as_app_menu command without any pre-configured scope.","commands":{"allow":["set_as_app_menu"],"deny":[]}},"allow-set-as-help-menu-for-nsapp":{"identifier":"allow-set-as-help-menu-for-nsapp","description":"Enables the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_help_menu_for_nsapp"],"deny":[]}},"allow-set-as-window-menu":{"identifier":"allow-set-as-window-menu","description":"Enables the set_as_window_menu command without any pre-configured scope.","commands":{"allow":["set_as_window_menu"],"deny":[]}},"allow-set-as-windows-menu-for-nsapp":{"identifier":"allow-set-as-windows-menu-for-nsapp","description":"Enables the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_windows_menu_for_nsapp"],"deny":[]}},"allow-set-checked":{"identifier":"allow-set-checked","description":"Enables the set_checked command without any pre-configured scope.","commands":{"allow":["set_checked"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-text":{"identifier":"allow-set-text","description":"Enables the set_text command without any pre-configured scope.","commands":{"allow":["set_text"],"deny":[]}},"allow-text":{"identifier":"allow-text","description":"Enables the text command without any pre-configured scope.","commands":{"allow":["text"],"deny":[]}},"deny-append":{"identifier":"deny-append","description":"Denies the append command without any pre-configured scope.","commands":{"allow":[],"deny":["append"]}},"deny-create-default":{"identifier":"deny-create-default","description":"Denies the create_default command without any pre-configured scope.","commands":{"allow":[],"deny":["create_default"]}},"deny-get":{"identifier":"deny-get","description":"Denies the get command without any pre-configured scope.","commands":{"allow":[],"deny":["get"]}},"deny-insert":{"identifier":"deny-insert","description":"Denies the insert command without any pre-configured scope.","commands":{"allow":[],"deny":["insert"]}},"deny-is-checked":{"identifier":"deny-is-checked","description":"Denies the is_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["is_checked"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-items":{"identifier":"deny-items","description":"Denies the items command without any pre-configured scope.","commands":{"allow":[],"deny":["items"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-popup":{"identifier":"deny-popup","description":"Denies the popup command without any pre-configured scope.","commands":{"allow":[],"deny":["popup"]}},"deny-prepend":{"identifier":"deny-prepend","description":"Denies the prepend command without any pre-configured scope.","commands":{"allow":[],"deny":["prepend"]}},"deny-remove":{"identifier":"deny-remove","description":"Denies the remove command without any pre-configured scope.","commands":{"allow":[],"deny":["remove"]}},"deny-remove-at":{"identifier":"deny-remove-at","description":"Denies the remove_at command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_at"]}},"deny-set-accelerator":{"identifier":"deny-set-accelerator","description":"Denies the set_accelerator command without any pre-configured scope.","commands":{"allow":[],"deny":["set_accelerator"]}},"deny-set-as-app-menu":{"identifier":"deny-set-as-app-menu","description":"Denies the set_as_app_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_app_menu"]}},"deny-set-as-help-menu-for-nsapp":{"identifier":"deny-set-as-help-menu-for-nsapp","description":"Denies the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_help_menu_for_nsapp"]}},"deny-set-as-window-menu":{"identifier":"deny-set-as-window-menu","description":"Denies the set_as_window_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_window_menu"]}},"deny-set-as-windows-menu-for-nsapp":{"identifier":"deny-set-as-windows-menu-for-nsapp","description":"Denies the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_windows_menu_for_nsapp"]}},"deny-set-checked":{"identifier":"deny-set-checked","description":"Denies the set_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["set_checked"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-text":{"identifier":"deny-set-text","description":"Denies the set_text command without any pre-configured scope.","commands":{"allow":[],"deny":["set_text"]}},"deny-text":{"identifier":"deny-text","description":"Denies the text command without any pre-configured scope.","commands":{"allow":[],"deny":["text"]}}},"permission_sets":{},"global_scope_schema":null},"core:path":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-resolve-directory","allow-resolve","allow-normalize","allow-join","allow-dirname","allow-extname","allow-basename","allow-is-absolute"]},"permissions":{"allow-basename":{"identifier":"allow-basename","description":"Enables the basename command without any pre-configured scope.","commands":{"allow":["basename"],"deny":[]}},"allow-dirname":{"identifier":"allow-dirname","description":"Enables the dirname command without any pre-configured scope.","commands":{"allow":["dirname"],"deny":[]}},"allow-extname":{"identifier":"allow-extname","description":"Enables the extname command without any pre-configured scope.","commands":{"allow":["extname"],"deny":[]}},"allow-is-absolute":{"identifier":"allow-is-absolute","description":"Enables the is_absolute command without any pre-configured scope.","commands":{"allow":["is_absolute"],"deny":[]}},"allow-join":{"identifier":"allow-join","description":"Enables the join command without any pre-configured scope.","commands":{"allow":["join"],"deny":[]}},"allow-normalize":{"identifier":"allow-normalize","description":"Enables the normalize command without any pre-configured scope.","commands":{"allow":["normalize"],"deny":[]}},"allow-resolve":{"identifier":"allow-resolve","description":"Enables the resolve command without any pre-configured scope.","commands":{"allow":["resolve"],"deny":[]}},"allow-resolve-directory":{"identifier":"allow-resolve-directory","description":"Enables the resolve_directory command without any pre-configured scope.","commands":{"allow":["resolve_directory"],"deny":[]}},"deny-basename":{"identifier":"deny-basename","description":"Denies the basename command without any pre-configured scope.","commands":{"allow":[],"deny":["basename"]}},"deny-dirname":{"identifier":"deny-dirname","description":"Denies the dirname command without any pre-configured scope.","commands":{"allow":[],"deny":["dirname"]}},"deny-extname":{"identifier":"deny-extname","description":"Denies the extname command without any pre-configured scope.","commands":{"allow":[],"deny":["extname"]}},"deny-is-absolute":{"identifier":"deny-is-absolute","description":"Denies the is_absolute command without any pre-configured scope.","commands":{"allow":[],"deny":["is_absolute"]}},"deny-join":{"identifier":"deny-join","description":"Denies the join command without any pre-configured scope.","commands":{"allow":[],"deny":["join"]}},"deny-normalize":{"identifier":"deny-normalize","description":"Denies the normalize command without any pre-configured scope.","commands":{"allow":[],"deny":["normalize"]}},"deny-resolve":{"identifier":"deny-resolve","description":"Denies the resolve command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve"]}},"deny-resolve-directory":{"identifier":"deny-resolve-directory","description":"Denies the resolve_directory command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve_directory"]}}},"permission_sets":{},"global_scope_schema":null},"core:resources":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-close"]},"permissions":{"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}}},"permission_sets":{},"global_scope_schema":null},"core:tray":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-get-by-id","allow-remove-by-id","allow-set-icon","allow-set-menu","allow-set-tooltip","allow-set-title","allow-set-visible","allow-set-temp-dir-path","allow-set-icon-as-template","allow-set-icon-with-as-template","allow-set-show-menu-on-left-click"]},"permissions":{"allow-get-by-id":{"identifier":"allow-get-by-id","description":"Enables the get_by_id command without any pre-configured scope.","commands":{"allow":["get_by_id"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-remove-by-id":{"identifier":"allow-remove-by-id","description":"Enables the remove_by_id command without any pre-configured scope.","commands":{"allow":["remove_by_id"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-icon-as-template":{"identifier":"allow-set-icon-as-template","description":"Enables the set_icon_as_template command without any pre-configured scope.","commands":{"allow":["set_icon_as_template"],"deny":[]}},"allow-set-icon-with-as-template":{"identifier":"allow-set-icon-with-as-template","description":"Enables the set_icon_with_as_template command without any pre-configured scope.","commands":{"allow":["set_icon_with_as_template"],"deny":[]}},"allow-set-menu":{"identifier":"allow-set-menu","description":"Enables the set_menu command without any pre-configured scope.","commands":{"allow":["set_menu"],"deny":[]}},"allow-set-show-menu-on-left-click":{"identifier":"allow-set-show-menu-on-left-click","description":"Enables the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":["set_show_menu_on_left_click"],"deny":[]}},"allow-set-temp-dir-path":{"identifier":"allow-set-temp-dir-path","description":"Enables the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":["set_temp_dir_path"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-tooltip":{"identifier":"allow-set-tooltip","description":"Enables the set_tooltip command without any pre-configured scope.","commands":{"allow":["set_tooltip"],"deny":[]}},"allow-set-visible":{"identifier":"allow-set-visible","description":"Enables the set_visible command without any pre-configured scope.","commands":{"allow":["set_visible"],"deny":[]}},"deny-get-by-id":{"identifier":"deny-get-by-id","description":"Denies the get_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["get_by_id"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-remove-by-id":{"identifier":"deny-remove-by-id","description":"Denies the remove_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_by_id"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-icon-as-template":{"identifier":"deny-set-icon-as-template","description":"Denies the set_icon_as_template command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon_as_template"]}},"deny-set-icon-with-as-template":{"identifier":"deny-set-icon-with-as-template","description":"Denies the set_icon_with_as_template command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon_with_as_template"]}},"deny-set-menu":{"identifier":"deny-set-menu","description":"Denies the set_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_menu"]}},"deny-set-show-menu-on-left-click":{"identifier":"deny-set-show-menu-on-left-click","description":"Denies the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":[],"deny":["set_show_menu_on_left_click"]}},"deny-set-temp-dir-path":{"identifier":"deny-set-temp-dir-path","description":"Denies the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":[],"deny":["set_temp_dir_path"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-tooltip":{"identifier":"deny-set-tooltip","description":"Denies the set_tooltip command without any pre-configured scope.","commands":{"allow":[],"deny":["set_tooltip"]}},"deny-set-visible":{"identifier":"deny-set-visible","description":"Denies the set_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible"]}}},"permission_sets":{},"global_scope_schema":null},"core:webview":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-webviews","allow-webview-position","allow-webview-size","allow-internal-toggle-devtools"]},"permissions":{"allow-clear-all-browsing-data":{"identifier":"allow-clear-all-browsing-data","description":"Enables the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":["clear_all_browsing_data"],"deny":[]}},"allow-create-webview":{"identifier":"allow-create-webview","description":"Enables the create_webview command without any pre-configured scope.","commands":{"allow":["create_webview"],"deny":[]}},"allow-create-webview-window":{"identifier":"allow-create-webview-window","description":"Enables the create_webview_window command without any pre-configured scope.","commands":{"allow":["create_webview_window"],"deny":[]}},"allow-get-all-webviews":{"identifier":"allow-get-all-webviews","description":"Enables the get_all_webviews command without any pre-configured scope.","commands":{"allow":["get_all_webviews"],"deny":[]}},"allow-internal-toggle-devtools":{"identifier":"allow-internal-toggle-devtools","description":"Enables the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":["internal_toggle_devtools"],"deny":[]}},"allow-print":{"identifier":"allow-print","description":"Enables the print command without any pre-configured scope.","commands":{"allow":["print"],"deny":[]}},"allow-reparent":{"identifier":"allow-reparent","description":"Enables the reparent command without any pre-configured scope.","commands":{"allow":["reparent"],"deny":[]}},"allow-set-webview-auto-resize":{"identifier":"allow-set-webview-auto-resize","description":"Enables the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":["set_webview_auto_resize"],"deny":[]}},"allow-set-webview-background-color":{"identifier":"allow-set-webview-background-color","description":"Enables the set_webview_background_color command without any pre-configured scope.","commands":{"allow":["set_webview_background_color"],"deny":[]}},"allow-set-webview-focus":{"identifier":"allow-set-webview-focus","description":"Enables the set_webview_focus command without any pre-configured scope.","commands":{"allow":["set_webview_focus"],"deny":[]}},"allow-set-webview-position":{"identifier":"allow-set-webview-position","description":"Enables the set_webview_position command without any pre-configured scope.","commands":{"allow":["set_webview_position"],"deny":[]}},"allow-set-webview-size":{"identifier":"allow-set-webview-size","description":"Enables the set_webview_size command without any pre-configured scope.","commands":{"allow":["set_webview_size"],"deny":[]}},"allow-set-webview-zoom":{"identifier":"allow-set-webview-zoom","description":"Enables the set_webview_zoom command without any pre-configured scope.","commands":{"allow":["set_webview_zoom"],"deny":[]}},"allow-webview-close":{"identifier":"allow-webview-close","description":"Enables the webview_close command without any pre-configured scope.","commands":{"allow":["webview_close"],"deny":[]}},"allow-webview-hide":{"identifier":"allow-webview-hide","description":"Enables the webview_hide command without any pre-configured scope.","commands":{"allow":["webview_hide"],"deny":[]}},"allow-webview-position":{"identifier":"allow-webview-position","description":"Enables the webview_position command without any pre-configured scope.","commands":{"allow":["webview_position"],"deny":[]}},"allow-webview-show":{"identifier":"allow-webview-show","description":"Enables the webview_show command without any pre-configured scope.","commands":{"allow":["webview_show"],"deny":[]}},"allow-webview-size":{"identifier":"allow-webview-size","description":"Enables the webview_size command without any pre-configured scope.","commands":{"allow":["webview_size"],"deny":[]}},"deny-clear-all-browsing-data":{"identifier":"deny-clear-all-browsing-data","description":"Denies the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":[],"deny":["clear_all_browsing_data"]}},"deny-create-webview":{"identifier":"deny-create-webview","description":"Denies the create_webview command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview"]}},"deny-create-webview-window":{"identifier":"deny-create-webview-window","description":"Denies the create_webview_window command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview_window"]}},"deny-get-all-webviews":{"identifier":"deny-get-all-webviews","description":"Denies the get_all_webviews command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_webviews"]}},"deny-internal-toggle-devtools":{"identifier":"deny-internal-toggle-devtools","description":"Denies the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_devtools"]}},"deny-print":{"identifier":"deny-print","description":"Denies the print command without any pre-configured scope.","commands":{"allow":[],"deny":["print"]}},"deny-reparent":{"identifier":"deny-reparent","description":"Denies the reparent command without any pre-configured scope.","commands":{"allow":[],"deny":["reparent"]}},"deny-set-webview-auto-resize":{"identifier":"deny-set-webview-auto-resize","description":"Denies the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_auto_resize"]}},"deny-set-webview-background-color":{"identifier":"deny-set-webview-background-color","description":"Denies the set_webview_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_background_color"]}},"deny-set-webview-focus":{"identifier":"deny-set-webview-focus","description":"Denies the set_webview_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_focus"]}},"deny-set-webview-position":{"identifier":"deny-set-webview-position","description":"Denies the set_webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_position"]}},"deny-set-webview-size":{"identifier":"deny-set-webview-size","description":"Denies the set_webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_size"]}},"deny-set-webview-zoom":{"identifier":"deny-set-webview-zoom","description":"Denies the set_webview_zoom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_zoom"]}},"deny-webview-close":{"identifier":"deny-webview-close","description":"Denies the webview_close command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_close"]}},"deny-webview-hide":{"identifier":"deny-webview-hide","description":"Denies the webview_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_hide"]}},"deny-webview-position":{"identifier":"deny-webview-position","description":"Denies the webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_position"]}},"deny-webview-show":{"identifier":"deny-webview-show","description":"Denies the webview_show command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_show"]}},"deny-webview-size":{"identifier":"deny-webview-size","description":"Denies the webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_size"]}}},"permission_sets":{},"global_scope_schema":null},"core:window":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-windows","allow-scale-factor","allow-inner-position","allow-outer-position","allow-inner-size","allow-outer-size","allow-is-fullscreen","allow-is-minimized","allow-is-maximized","allow-is-focused","allow-is-decorated","allow-is-resizable","allow-is-maximizable","allow-is-minimizable","allow-is-closable","allow-is-visible","allow-is-enabled","allow-title","allow-current-monitor","allow-primary-monitor","allow-monitor-from-point","allow-available-monitors","allow-cursor-position","allow-theme","allow-is-always-on-top","allow-activity-name","allow-scene-identifier","allow-internal-toggle-maximize"]},"permissions":{"allow-activity-name":{"identifier":"allow-activity-name","description":"Enables the activity_name command without any pre-configured scope.","commands":{"allow":["activity_name"],"deny":[]}},"allow-available-monitors":{"identifier":"allow-available-monitors","description":"Enables the available_monitors command without any pre-configured scope.","commands":{"allow":["available_monitors"],"deny":[]}},"allow-center":{"identifier":"allow-center","description":"Enables the center command without any pre-configured scope.","commands":{"allow":["center"],"deny":[]}},"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"allow-create":{"identifier":"allow-create","description":"Enables the create command without any pre-configured scope.","commands":{"allow":["create"],"deny":[]}},"allow-current-monitor":{"identifier":"allow-current-monitor","description":"Enables the current_monitor command without any pre-configured scope.","commands":{"allow":["current_monitor"],"deny":[]}},"allow-cursor-position":{"identifier":"allow-cursor-position","description":"Enables the cursor_position command without any pre-configured scope.","commands":{"allow":["cursor_position"],"deny":[]}},"allow-destroy":{"identifier":"allow-destroy","description":"Enables the destroy command without any pre-configured scope.","commands":{"allow":["destroy"],"deny":[]}},"allow-get-all-windows":{"identifier":"allow-get-all-windows","description":"Enables the get_all_windows command without any pre-configured scope.","commands":{"allow":["get_all_windows"],"deny":[]}},"allow-hide":{"identifier":"allow-hide","description":"Enables the hide command without any pre-configured scope.","commands":{"allow":["hide"],"deny":[]}},"allow-inner-position":{"identifier":"allow-inner-position","description":"Enables the inner_position command without any pre-configured scope.","commands":{"allow":["inner_position"],"deny":[]}},"allow-inner-size":{"identifier":"allow-inner-size","description":"Enables the inner_size command without any pre-configured scope.","commands":{"allow":["inner_size"],"deny":[]}},"allow-internal-toggle-maximize":{"identifier":"allow-internal-toggle-maximize","description":"Enables the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":["internal_toggle_maximize"],"deny":[]}},"allow-is-always-on-top":{"identifier":"allow-is-always-on-top","description":"Enables the is_always_on_top command without any pre-configured scope.","commands":{"allow":["is_always_on_top"],"deny":[]}},"allow-is-closable":{"identifier":"allow-is-closable","description":"Enables the is_closable command without any pre-configured scope.","commands":{"allow":["is_closable"],"deny":[]}},"allow-is-decorated":{"identifier":"allow-is-decorated","description":"Enables the is_decorated command without any pre-configured scope.","commands":{"allow":["is_decorated"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-is-focused":{"identifier":"allow-is-focused","description":"Enables the is_focused command without any pre-configured scope.","commands":{"allow":["is_focused"],"deny":[]}},"allow-is-fullscreen":{"identifier":"allow-is-fullscreen","description":"Enables the is_fullscreen command without any pre-configured scope.","commands":{"allow":["is_fullscreen"],"deny":[]}},"allow-is-maximizable":{"identifier":"allow-is-maximizable","description":"Enables the is_maximizable command without any pre-configured scope.","commands":{"allow":["is_maximizable"],"deny":[]}},"allow-is-maximized":{"identifier":"allow-is-maximized","description":"Enables the is_maximized command without any pre-configured scope.","commands":{"allow":["is_maximized"],"deny":[]}},"allow-is-minimizable":{"identifier":"allow-is-minimizable","description":"Enables the is_minimizable command without any pre-configured scope.","commands":{"allow":["is_minimizable"],"deny":[]}},"allow-is-minimized":{"identifier":"allow-is-minimized","description":"Enables the is_minimized command without any pre-configured scope.","commands":{"allow":["is_minimized"],"deny":[]}},"allow-is-resizable":{"identifier":"allow-is-resizable","description":"Enables the is_resizable command without any pre-configured scope.","commands":{"allow":["is_resizable"],"deny":[]}},"allow-is-visible":{"identifier":"allow-is-visible","description":"Enables the is_visible command without any pre-configured scope.","commands":{"allow":["is_visible"],"deny":[]}},"allow-maximize":{"identifier":"allow-maximize","description":"Enables the maximize command without any pre-configured scope.","commands":{"allow":["maximize"],"deny":[]}},"allow-minimize":{"identifier":"allow-minimize","description":"Enables the minimize command without any pre-configured scope.","commands":{"allow":["minimize"],"deny":[]}},"allow-monitor-from-point":{"identifier":"allow-monitor-from-point","description":"Enables the monitor_from_point command without any pre-configured scope.","commands":{"allow":["monitor_from_point"],"deny":[]}},"allow-outer-position":{"identifier":"allow-outer-position","description":"Enables the outer_position command without any pre-configured scope.","commands":{"allow":["outer_position"],"deny":[]}},"allow-outer-size":{"identifier":"allow-outer-size","description":"Enables the outer_size command without any pre-configured scope.","commands":{"allow":["outer_size"],"deny":[]}},"allow-primary-monitor":{"identifier":"allow-primary-monitor","description":"Enables the primary_monitor command without any pre-configured scope.","commands":{"allow":["primary_monitor"],"deny":[]}},"allow-request-user-attention":{"identifier":"allow-request-user-attention","description":"Enables the request_user_attention command without any pre-configured scope.","commands":{"allow":["request_user_attention"],"deny":[]}},"allow-scale-factor":{"identifier":"allow-scale-factor","description":"Enables the scale_factor command without any pre-configured scope.","commands":{"allow":["scale_factor"],"deny":[]}},"allow-scene-identifier":{"identifier":"allow-scene-identifier","description":"Enables the scene_identifier command without any pre-configured scope.","commands":{"allow":["scene_identifier"],"deny":[]}},"allow-set-always-on-bottom":{"identifier":"allow-set-always-on-bottom","description":"Enables the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":["set_always_on_bottom"],"deny":[]}},"allow-set-always-on-top":{"identifier":"allow-set-always-on-top","description":"Enables the set_always_on_top command without any pre-configured scope.","commands":{"allow":["set_always_on_top"],"deny":[]}},"allow-set-background-color":{"identifier":"allow-set-background-color","description":"Enables the set_background_color command without any pre-configured scope.","commands":{"allow":["set_background_color"],"deny":[]}},"allow-set-badge-count":{"identifier":"allow-set-badge-count","description":"Enables the set_badge_count command without any pre-configured scope.","commands":{"allow":["set_badge_count"],"deny":[]}},"allow-set-badge-label":{"identifier":"allow-set-badge-label","description":"Enables the set_badge_label command without any pre-configured scope.","commands":{"allow":["set_badge_label"],"deny":[]}},"allow-set-closable":{"identifier":"allow-set-closable","description":"Enables the set_closable command without any pre-configured scope.","commands":{"allow":["set_closable"],"deny":[]}},"allow-set-content-protected":{"identifier":"allow-set-content-protected","description":"Enables the set_content_protected command without any pre-configured scope.","commands":{"allow":["set_content_protected"],"deny":[]}},"allow-set-cursor-grab":{"identifier":"allow-set-cursor-grab","description":"Enables the set_cursor_grab command without any pre-configured scope.","commands":{"allow":["set_cursor_grab"],"deny":[]}},"allow-set-cursor-icon":{"identifier":"allow-set-cursor-icon","description":"Enables the set_cursor_icon command without any pre-configured scope.","commands":{"allow":["set_cursor_icon"],"deny":[]}},"allow-set-cursor-position":{"identifier":"allow-set-cursor-position","description":"Enables the set_cursor_position command without any pre-configured scope.","commands":{"allow":["set_cursor_position"],"deny":[]}},"allow-set-cursor-visible":{"identifier":"allow-set-cursor-visible","description":"Enables the set_cursor_visible command without any pre-configured scope.","commands":{"allow":["set_cursor_visible"],"deny":[]}},"allow-set-decorations":{"identifier":"allow-set-decorations","description":"Enables the set_decorations command without any pre-configured scope.","commands":{"allow":["set_decorations"],"deny":[]}},"allow-set-effects":{"identifier":"allow-set-effects","description":"Enables the set_effects command without any pre-configured scope.","commands":{"allow":["set_effects"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-focus":{"identifier":"allow-set-focus","description":"Enables the set_focus command without any pre-configured scope.","commands":{"allow":["set_focus"],"deny":[]}},"allow-set-focusable":{"identifier":"allow-set-focusable","description":"Enables the set_focusable command without any pre-configured scope.","commands":{"allow":["set_focusable"],"deny":[]}},"allow-set-fullscreen":{"identifier":"allow-set-fullscreen","description":"Enables the set_fullscreen command without any pre-configured scope.","commands":{"allow":["set_fullscreen"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-ignore-cursor-events":{"identifier":"allow-set-ignore-cursor-events","description":"Enables the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":["set_ignore_cursor_events"],"deny":[]}},"allow-set-max-size":{"identifier":"allow-set-max-size","description":"Enables the set_max_size command without any pre-configured scope.","commands":{"allow":["set_max_size"],"deny":[]}},"allow-set-maximizable":{"identifier":"allow-set-maximizable","description":"Enables the set_maximizable command without any pre-configured scope.","commands":{"allow":["set_maximizable"],"deny":[]}},"allow-set-min-size":{"identifier":"allow-set-min-size","description":"Enables the set_min_size command without any pre-configured scope.","commands":{"allow":["set_min_size"],"deny":[]}},"allow-set-minimizable":{"identifier":"allow-set-minimizable","description":"Enables the set_minimizable command without any pre-configured scope.","commands":{"allow":["set_minimizable"],"deny":[]}},"allow-set-overlay-icon":{"identifier":"allow-set-overlay-icon","description":"Enables the set_overlay_icon command without any pre-configured scope.","commands":{"allow":["set_overlay_icon"],"deny":[]}},"allow-set-position":{"identifier":"allow-set-position","description":"Enables the set_position command without any pre-configured scope.","commands":{"allow":["set_position"],"deny":[]}},"allow-set-progress-bar":{"identifier":"allow-set-progress-bar","description":"Enables the set_progress_bar command without any pre-configured scope.","commands":{"allow":["set_progress_bar"],"deny":[]}},"allow-set-resizable":{"identifier":"allow-set-resizable","description":"Enables the set_resizable command without any pre-configured scope.","commands":{"allow":["set_resizable"],"deny":[]}},"allow-set-shadow":{"identifier":"allow-set-shadow","description":"Enables the set_shadow command without any pre-configured scope.","commands":{"allow":["set_shadow"],"deny":[]}},"allow-set-simple-fullscreen":{"identifier":"allow-set-simple-fullscreen","description":"Enables the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":["set_simple_fullscreen"],"deny":[]}},"allow-set-size":{"identifier":"allow-set-size","description":"Enables the set_size command without any pre-configured scope.","commands":{"allow":["set_size"],"deny":[]}},"allow-set-size-constraints":{"identifier":"allow-set-size-constraints","description":"Enables the set_size_constraints command without any pre-configured scope.","commands":{"allow":["set_size_constraints"],"deny":[]}},"allow-set-skip-taskbar":{"identifier":"allow-set-skip-taskbar","description":"Enables the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":["set_skip_taskbar"],"deny":[]}},"allow-set-theme":{"identifier":"allow-set-theme","description":"Enables the set_theme command without any pre-configured scope.","commands":{"allow":["set_theme"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-title-bar-style":{"identifier":"allow-set-title-bar-style","description":"Enables the set_title_bar_style command without any pre-configured scope.","commands":{"allow":["set_title_bar_style"],"deny":[]}},"allow-set-visible-on-all-workspaces":{"identifier":"allow-set-visible-on-all-workspaces","description":"Enables the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":["set_visible_on_all_workspaces"],"deny":[]}},"allow-show":{"identifier":"allow-show","description":"Enables the show command without any pre-configured scope.","commands":{"allow":["show"],"deny":[]}},"allow-start-dragging":{"identifier":"allow-start-dragging","description":"Enables the start_dragging command without any pre-configured scope.","commands":{"allow":["start_dragging"],"deny":[]}},"allow-start-resize-dragging":{"identifier":"allow-start-resize-dragging","description":"Enables the start_resize_dragging command without any pre-configured scope.","commands":{"allow":["start_resize_dragging"],"deny":[]}},"allow-theme":{"identifier":"allow-theme","description":"Enables the theme command without any pre-configured scope.","commands":{"allow":["theme"],"deny":[]}},"allow-title":{"identifier":"allow-title","description":"Enables the title command without any pre-configured scope.","commands":{"allow":["title"],"deny":[]}},"allow-toggle-maximize":{"identifier":"allow-toggle-maximize","description":"Enables the toggle_maximize command without any pre-configured scope.","commands":{"allow":["toggle_maximize"],"deny":[]}},"allow-unmaximize":{"identifier":"allow-unmaximize","description":"Enables the unmaximize command without any pre-configured scope.","commands":{"allow":["unmaximize"],"deny":[]}},"allow-unminimize":{"identifier":"allow-unminimize","description":"Enables the unminimize command without any pre-configured scope.","commands":{"allow":["unminimize"],"deny":[]}},"deny-activity-name":{"identifier":"deny-activity-name","description":"Denies the activity_name command without any pre-configured scope.","commands":{"allow":[],"deny":["activity_name"]}},"deny-available-monitors":{"identifier":"deny-available-monitors","description":"Denies the available_monitors command without any pre-configured scope.","commands":{"allow":[],"deny":["available_monitors"]}},"deny-center":{"identifier":"deny-center","description":"Denies the center command without any pre-configured scope.","commands":{"allow":[],"deny":["center"]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}},"deny-create":{"identifier":"deny-create","description":"Denies the create command without any pre-configured scope.","commands":{"allow":[],"deny":["create"]}},"deny-current-monitor":{"identifier":"deny-current-monitor","description":"Denies the current_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["current_monitor"]}},"deny-cursor-position":{"identifier":"deny-cursor-position","description":"Denies the cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["cursor_position"]}},"deny-destroy":{"identifier":"deny-destroy","description":"Denies the destroy command without any pre-configured scope.","commands":{"allow":[],"deny":["destroy"]}},"deny-get-all-windows":{"identifier":"deny-get-all-windows","description":"Denies the get_all_windows command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_windows"]}},"deny-hide":{"identifier":"deny-hide","description":"Denies the hide command without any pre-configured scope.","commands":{"allow":[],"deny":["hide"]}},"deny-inner-position":{"identifier":"deny-inner-position","description":"Denies the inner_position command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_position"]}},"deny-inner-size":{"identifier":"deny-inner-size","description":"Denies the inner_size command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_size"]}},"deny-internal-toggle-maximize":{"identifier":"deny-internal-toggle-maximize","description":"Denies the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_maximize"]}},"deny-is-always-on-top":{"identifier":"deny-is-always-on-top","description":"Denies the is_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["is_always_on_top"]}},"deny-is-closable":{"identifier":"deny-is-closable","description":"Denies the is_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_closable"]}},"deny-is-decorated":{"identifier":"deny-is-decorated","description":"Denies the is_decorated command without any pre-configured scope.","commands":{"allow":[],"deny":["is_decorated"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-is-focused":{"identifier":"deny-is-focused","description":"Denies the is_focused command without any pre-configured scope.","commands":{"allow":[],"deny":["is_focused"]}},"deny-is-fullscreen":{"identifier":"deny-is-fullscreen","description":"Denies the is_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["is_fullscreen"]}},"deny-is-maximizable":{"identifier":"deny-is-maximizable","description":"Denies the is_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximizable"]}},"deny-is-maximized":{"identifier":"deny-is-maximized","description":"Denies the is_maximized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximized"]}},"deny-is-minimizable":{"identifier":"deny-is-minimizable","description":"Denies the is_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimizable"]}},"deny-is-minimized":{"identifier":"deny-is-minimized","description":"Denies the is_minimized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimized"]}},"deny-is-resizable":{"identifier":"deny-is-resizable","description":"Denies the is_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_resizable"]}},"deny-is-visible":{"identifier":"deny-is-visible","description":"Denies the is_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["is_visible"]}},"deny-maximize":{"identifier":"deny-maximize","description":"Denies the maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["maximize"]}},"deny-minimize":{"identifier":"deny-minimize","description":"Denies the minimize command without any pre-configured scope.","commands":{"allow":[],"deny":["minimize"]}},"deny-monitor-from-point":{"identifier":"deny-monitor-from-point","description":"Denies the monitor_from_point command without any pre-configured scope.","commands":{"allow":[],"deny":["monitor_from_point"]}},"deny-outer-position":{"identifier":"deny-outer-position","description":"Denies the outer_position command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_position"]}},"deny-outer-size":{"identifier":"deny-outer-size","description":"Denies the outer_size command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_size"]}},"deny-primary-monitor":{"identifier":"deny-primary-monitor","description":"Denies the primary_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["primary_monitor"]}},"deny-request-user-attention":{"identifier":"deny-request-user-attention","description":"Denies the request_user_attention command without any pre-configured scope.","commands":{"allow":[],"deny":["request_user_attention"]}},"deny-scale-factor":{"identifier":"deny-scale-factor","description":"Denies the scale_factor command without any pre-configured scope.","commands":{"allow":[],"deny":["scale_factor"]}},"deny-scene-identifier":{"identifier":"deny-scene-identifier","description":"Denies the scene_identifier command without any pre-configured scope.","commands":{"allow":[],"deny":["scene_identifier"]}},"deny-set-always-on-bottom":{"identifier":"deny-set-always-on-bottom","description":"Denies the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_bottom"]}},"deny-set-always-on-top":{"identifier":"deny-set-always-on-top","description":"Denies the set_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_top"]}},"deny-set-background-color":{"identifier":"deny-set-background-color","description":"Denies the set_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_background_color"]}},"deny-set-badge-count":{"identifier":"deny-set-badge-count","description":"Denies the set_badge_count command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_count"]}},"deny-set-badge-label":{"identifier":"deny-set-badge-label","description":"Denies the set_badge_label command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_label"]}},"deny-set-closable":{"identifier":"deny-set-closable","description":"Denies the set_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_closable"]}},"deny-set-content-protected":{"identifier":"deny-set-content-protected","description":"Denies the set_content_protected command without any pre-configured scope.","commands":{"allow":[],"deny":["set_content_protected"]}},"deny-set-cursor-grab":{"identifier":"deny-set-cursor-grab","description":"Denies the set_cursor_grab command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_grab"]}},"deny-set-cursor-icon":{"identifier":"deny-set-cursor-icon","description":"Denies the set_cursor_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_icon"]}},"deny-set-cursor-position":{"identifier":"deny-set-cursor-position","description":"Denies the set_cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_position"]}},"deny-set-cursor-visible":{"identifier":"deny-set-cursor-visible","description":"Denies the set_cursor_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_visible"]}},"deny-set-decorations":{"identifier":"deny-set-decorations","description":"Denies the set_decorations command without any pre-configured scope.","commands":{"allow":[],"deny":["set_decorations"]}},"deny-set-effects":{"identifier":"deny-set-effects","description":"Denies the set_effects command without any pre-configured scope.","commands":{"allow":[],"deny":["set_effects"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-focus":{"identifier":"deny-set-focus","description":"Denies the set_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focus"]}},"deny-set-focusable":{"identifier":"deny-set-focusable","description":"Denies the set_focusable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focusable"]}},"deny-set-fullscreen":{"identifier":"deny-set-fullscreen","description":"Denies the set_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_fullscreen"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-ignore-cursor-events":{"identifier":"deny-set-ignore-cursor-events","description":"Denies the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":[],"deny":["set_ignore_cursor_events"]}},"deny-set-max-size":{"identifier":"deny-set-max-size","description":"Denies the set_max_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_max_size"]}},"deny-set-maximizable":{"identifier":"deny-set-maximizable","description":"Denies the set_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_maximizable"]}},"deny-set-min-size":{"identifier":"deny-set-min-size","description":"Denies the set_min_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_min_size"]}},"deny-set-minimizable":{"identifier":"deny-set-minimizable","description":"Denies the set_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_minimizable"]}},"deny-set-overlay-icon":{"identifier":"deny-set-overlay-icon","description":"Denies the set_overlay_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_overlay_icon"]}},"deny-set-position":{"identifier":"deny-set-position","description":"Denies the set_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_position"]}},"deny-set-progress-bar":{"identifier":"deny-set-progress-bar","description":"Denies the set_progress_bar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_progress_bar"]}},"deny-set-resizable":{"identifier":"deny-set-resizable","description":"Denies the set_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_resizable"]}},"deny-set-shadow":{"identifier":"deny-set-shadow","description":"Denies the set_shadow command without any pre-configured scope.","commands":{"allow":[],"deny":["set_shadow"]}},"deny-set-simple-fullscreen":{"identifier":"deny-set-simple-fullscreen","description":"Denies the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_simple_fullscreen"]}},"deny-set-size":{"identifier":"deny-set-size","description":"Denies the set_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size"]}},"deny-set-size-constraints":{"identifier":"deny-set-size-constraints","description":"Denies the set_size_constraints command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size_constraints"]}},"deny-set-skip-taskbar":{"identifier":"deny-set-skip-taskbar","description":"Denies the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_skip_taskbar"]}},"deny-set-theme":{"identifier":"deny-set-theme","description":"Denies the set_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_theme"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-title-bar-style":{"identifier":"deny-set-title-bar-style","description":"Denies the set_title_bar_style command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title_bar_style"]}},"deny-set-visible-on-all-workspaces":{"identifier":"deny-set-visible-on-all-workspaces","description":"Denies the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible_on_all_workspaces"]}},"deny-show":{"identifier":"deny-show","description":"Denies the show command without any pre-configured scope.","commands":{"allow":[],"deny":["show"]}},"deny-start-dragging":{"identifier":"deny-start-dragging","description":"Denies the start_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_dragging"]}},"deny-start-resize-dragging":{"identifier":"deny-start-resize-dragging","description":"Denies the start_resize_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_resize_dragging"]}},"deny-theme":{"identifier":"deny-theme","description":"Denies the theme command without any pre-configured scope.","commands":{"allow":[],"deny":["theme"]}},"deny-title":{"identifier":"deny-title","description":"Denies the title command without any pre-configured scope.","commands":{"allow":[],"deny":["title"]}},"deny-toggle-maximize":{"identifier":"deny-toggle-maximize","description":"Denies the toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["toggle_maximize"]}},"deny-unmaximize":{"identifier":"deny-unmaximize","description":"Denies the unmaximize command without any pre-configured scope.","commands":{"allow":[],"deny":["unmaximize"]}},"deny-unminimize":{"identifier":"deny-unminimize","description":"Denies the unminimize command without any pre-configured scope.","commands":{"allow":[],"deny":["unminimize"]}}},"permission_sets":{},"global_scope_schema":null},"shell":{"default_permission":{"identifier":"default","description":"This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n","permissions":["allow-open"]},"permissions":{"allow-execute":{"identifier":"allow-execute","description":"Enables the execute command without any pre-configured scope.","commands":{"allow":["execute"],"deny":[]}},"allow-kill":{"identifier":"allow-kill","description":"Enables the kill command without any pre-configured scope.","commands":{"allow":["kill"],"deny":[]}},"allow-open":{"identifier":"allow-open","description":"Enables the open command without any pre-configured scope.","commands":{"allow":["open"],"deny":[]}},"allow-spawn":{"identifier":"allow-spawn","description":"Enables the spawn command without any pre-configured scope.","commands":{"allow":["spawn"],"deny":[]}},"allow-stdin-write":{"identifier":"allow-stdin-write","description":"Enables the stdin_write command without any pre-configured scope.","commands":{"allow":["stdin_write"],"deny":[]}},"deny-execute":{"identifier":"deny-execute","description":"Denies the execute command without any pre-configured scope.","commands":{"allow":[],"deny":["execute"]}},"deny-kill":{"identifier":"deny-kill","description":"Denies the kill command without any pre-configured scope.","commands":{"allow":[],"deny":["kill"]}},"deny-open":{"identifier":"deny-open","description":"Denies the open command without any pre-configured scope.","commands":{"allow":[],"deny":["open"]}},"deny-spawn":{"identifier":"deny-spawn","description":"Denies the spawn command without any pre-configured scope.","commands":{"allow":[],"deny":["spawn"]}},"deny-stdin-write":{"identifier":"deny-stdin-write","description":"Denies the stdin_write command without any pre-configured scope.","commands":{"allow":[],"deny":["stdin_write"]}}},"permission_sets":{},"global_scope_schema":{"$schema":"http://json-schema.org/draft-07/schema#","anyOf":[{"additionalProperties":false,"properties":{"args":{"allOf":[{"$ref":"#/definitions/ShellScopeEntryAllowedArgs"}],"description":"The allowed arguments for the command execution."},"cmd":{"description":"The command name. It can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.","type":"string"},"name":{"description":"The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.","type":"string"}},"required":["cmd","name"],"type":"object"},{"additionalProperties":false,"properties":{"args":{"allOf":[{"$ref":"#/definitions/ShellScopeEntryAllowedArgs"}],"description":"The allowed arguments for the command execution."},"name":{"description":"The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.","type":"string"},"sidecar":{"description":"If this command is a sidecar command.","type":"boolean"}},"required":["name","sidecar"],"type":"object"}],"definitions":{"ShellScopeEntryAllowedArg":{"anyOf":[{"description":"A non-configurable argument that is passed to the command in the order it was specified.","type":"string"},{"additionalProperties":false,"description":"A variable that is set while calling the command from the webview API.","properties":{"raw":{"default":false,"description":"Marks the validator as a raw regex, meaning the plugin should not make any modification at runtime.\n\nThis means the regex will not match on the entire string by default, which might be exploited if your regex allow unexpected input to be considered valid. When using this option, make sure your regex is correct.","type":"boolean"},"validator":{"description":"[regex] validator to require passed values to conform to an expected input.\n\nThis will require the argument value passed to this variable to match the `validator` regex before it will be executed.\n\nThe regex string is by default surrounded by `^...$` to match the full string. For example the `https?://\\w+` regex would be registered as `^https?://\\w+$`.\n\n[regex]: <https://docs.rs/regex/latest/regex/#syntax>","type":"string"}},"required":["validator"],"type":"object"}],"description":"A command argument allowed to be executed by the webview API."},"ShellScopeEntryAllowedArgs":{"anyOf":[{"description":"Use a simple boolean to allow all or disable all arguments to this command configuration.","type":"boolean"},{"description":"A specific set of [`ShellScopeEntryAllowedArg`] that are valid to call for the command configuration.","items":{"$ref":"#/definitions/ShellScopeEntryAllowedArg"},"type":"array"}],"description":"A set of command arguments allowed to be executed by the webview API.\n\nA value of `true` will allow any arguments to be passed to the command. `false` will disable all arguments. A list of [`ShellScopeEntryAllowedArg`] will set those arguments as the only valid arguments to be passed to the attached command configuration."}},"description":"Shell scope entry.","title":"ShellScopeEntry"}}}
\ No newline at end of file
diff --git a/src-tauri/gen/schemas/desktop-schema.json b/src-tauri/gen/schemas/desktop-schema.json
index f827fe175..d1e536142 100644
--- a/src-tauri/gen/schemas/desktop-schema.json
+++ b/src-tauri/gen/schemas/desktop-schema.json
@@ -393,10 +393,10 @@
           "markdownDescription": "Default core plugins set.\n#### This default permission set includes:\n\n- `core:path:default`\n- `core:event:default`\n- `core:window:default`\n- `core:webview:default`\n- `core:app:default`\n- `core:image:default`\n- `core:resources:default`\n- `core:menu:default`\n- `core:tray:default`"
         },
         {
-          "description": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-version`\n- `allow-name`\n- `allow-tauri-version`\n- `allow-identifier`\n- `allow-bundle-type`\n- `allow-register-listener`\n- `allow-remove-listener`",
+          "description": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-version`\n- `allow-name`\n- `allow-tauri-version`\n- `allow-identifier`\n- `allow-bundle-type`\n- `allow-register-listener`\n- `allow-remove-listener`\n- `allow-supports-multiple-windows`",
           "type": "string",
           "const": "core:app:default",
-          "markdownDescription": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-version`\n- `allow-name`\n- `allow-tauri-version`\n- `allow-identifier`\n- `allow-bundle-type`\n- `allow-register-listener`\n- `allow-remove-listener`"
+          "markdownDescription": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-version`\n- `allow-name`\n- `allow-tauri-version`\n- `allow-identifier`\n- `allow-bundle-type`\n- `allow-register-listener`\n- `allow-remove-listener`\n- `allow-supports-multiple-windows`"
         },
         {
           "description": "Enables the app_hide command without any pre-configured scope.",
@@ -470,6 +470,12 @@
           "const": "core:app:allow-set-dock-visibility",
           "markdownDescription": "Enables the set_dock_visibility command without any pre-configured scope."
         },
+        {
+          "description": "Enables the supports_multiple_windows command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-supports-multiple-windows",
+          "markdownDescription": "Enables the supports_multiple_windows command without any pre-configured scope."
+        },
         {
           "description": "Enables the tauri_version command without any pre-configured scope.",
           "type": "string",
@@ -554,6 +560,12 @@
           "const": "core:app:deny-set-dock-visibility",
           "markdownDescription": "Denies the set_dock_visibility command without any pre-configured scope."
         },
+        {
+          "description": "Denies the supports_multiple_windows command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-supports-multiple-windows",
+          "markdownDescription": "Denies the supports_multiple_windows command without any pre-configured scope."
+        },
         {
           "description": "Denies the tauri_version command without any pre-configured scope.",
           "type": "string",
@@ -1077,10 +1089,10 @@
           "markdownDescription": "Denies the close command without any pre-configured scope."
         },
         {
-          "description": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-get-by-id`\n- `allow-remove-by-id`\n- `allow-set-icon`\n- `allow-set-menu`\n- `allow-set-tooltip`\n- `allow-set-title`\n- `allow-set-visible`\n- `allow-set-temp-dir-path`\n- `allow-set-icon-as-template`\n- `allow-set-show-menu-on-left-click`",
+          "description": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-get-by-id`\n- `allow-remove-by-id`\n- `allow-set-icon`\n- `allow-set-menu`\n- `allow-set-tooltip`\n- `allow-set-title`\n- `allow-set-visible`\n- `allow-set-temp-dir-path`\n- `allow-set-icon-as-template`\n- `allow-set-icon-with-as-template`\n- `allow-set-show-menu-on-left-click`",
           "type": "string",
           "const": "core:tray:default",
-          "markdownDescription": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-get-by-id`\n- `allow-remove-by-id`\n- `allow-set-icon`\n- `allow-set-menu`\n- `allow-set-tooltip`\n- `allow-set-title`\n- `allow-set-visible`\n- `allow-set-temp-dir-path`\n- `allow-set-icon-as-template`\n- `allow-set-show-menu-on-left-click`"
+          "markdownDescription": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-get-by-id`\n- `allow-remove-by-id`\n- `allow-set-icon`\n- `allow-set-menu`\n- `allow-set-tooltip`\n- `allow-set-title`\n- `allow-set-visible`\n- `allow-set-temp-dir-path`\n- `allow-set-icon-as-template`\n- `allow-set-icon-with-as-template`\n- `allow-set-show-menu-on-left-click`"
         },
         {
           "description": "Enables the get_by_id command without any pre-configured scope.",
@@ -1112,6 +1124,12 @@
           "const": "core:tray:allow-set-icon-as-template",
           "markdownDescription": "Enables the set_icon_as_template command without any pre-configured scope."
         },
+        {
+          "description": "Enables the set_icon_with_as_template command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:allow-set-icon-with-as-template",
+          "markdownDescription": "Enables the set_icon_with_as_template command without any pre-configured scope."
+        },
         {
           "description": "Enables the set_menu command without any pre-configured scope.",
           "type": "string",
@@ -1178,6 +1196,12 @@
           "const": "core:tray:deny-set-icon-as-template",
           "markdownDescription": "Denies the set_icon_as_template command without any pre-configured scope."
         },
+        {
+          "description": "Denies the set_icon_with_as_template command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:deny-set-icon-with-as-template",
+          "markdownDescription": "Denies the set_icon_with_as_template command without any pre-configured scope."
+        },
         {
           "description": "Denies the set_menu command without any pre-configured scope.",
           "type": "string",
@@ -1437,10 +1461,16 @@
           "markdownDescription": "Denies the webview_size command without any pre-configured scope."
         },
         {
-          "description": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-get-all-windows`\n- `allow-scale-factor`\n- `allow-inner-position`\n- `allow-outer-position`\n- `allow-inner-size`\n- `allow-outer-size`\n- `allow-is-fullscreen`\n- `allow-is-minimized`\n- `allow-is-maximized`\n- `allow-is-focused`\n- `allow-is-decorated`\n- `allow-is-resizable`\n- `allow-is-maximizable`\n- `allow-is-minimizable`\n- `allow-is-closable`\n- `allow-is-visible`\n- `allow-is-enabled`\n- `allow-title`\n- `allow-current-monitor`\n- `allow-primary-monitor`\n- `allow-monitor-from-point`\n- `allow-available-monitors`\n- `allow-cursor-position`\n- `allow-theme`\n- `allow-is-always-on-top`\n- `allow-internal-toggle-maximize`",
+          "description": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-get-all-windows`\n- `allow-scale-factor`\n- `allow-inner-position`\n- `allow-outer-position`\n- `allow-inner-size`\n- `allow-outer-size`\n- `allow-is-fullscreen`\n- `allow-is-minimized`\n- `allow-is-maximized`\n- `allow-is-focused`\n- `allow-is-decorated`\n- `allow-is-resizable`\n- `allow-is-maximizable`\n- `allow-is-minimizable`\n- `allow-is-closable`\n- `allow-is-visible`\n- `allow-is-enabled`\n- `allow-title`\n- `allow-current-monitor`\n- `allow-primary-monitor`\n- `allow-monitor-from-point`\n- `allow-available-monitors`\n- `allow-cursor-position`\n- `allow-theme`\n- `allow-is-always-on-top`\n- `allow-activity-name`\n- `allow-scene-identifier`\n- `allow-internal-toggle-maximize`",
           "type": "string",
           "const": "core:window:default",
-          "markdownDescription": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-get-all-windows`\n- `allow-scale-factor`\n- `allow-inner-position`\n- `allow-outer-position`\n- `allow-inner-size`\n- `allow-outer-size`\n- `allow-is-fullscreen`\n- `allow-is-minimized`\n- `allow-is-maximized`\n- `allow-is-focused`\n- `allow-is-decorated`\n- `allow-is-resizable`\n- `allow-is-maximizable`\n- `allow-is-minimizable`\n- `allow-is-closable`\n- `allow-is-visible`\n- `allow-is-enabled`\n- `allow-title`\n- `allow-current-monitor`\n- `allow-primary-monitor`\n- `allow-monitor-from-point`\n- `allow-available-monitors`\n- `allow-cursor-position`\n- `allow-theme`\n- `allow-is-always-on-top`\n- `allow-internal-toggle-maximize`"
+          "markdownDescription": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-get-all-windows`\n- `allow-scale-factor`\n- `allow-inner-position`\n- `allow-outer-position`\n- `allow-inner-size`\n- `allow-outer-size`\n- `allow-is-fullscreen`\n- `allow-is-minimized`\n- `allow-is-maximized`\n- `allow-is-focused`\n- `allow-is-decorated`\n- `allow-is-resizable`\n- `allow-is-maximizable`\n- `allow-is-minimizable`\n- `allow-is-closable`\n- `allow-is-visible`\n- `allow-is-enabled`\n- `allow-title`\n- `allow-current-monitor`\n- `allow-primary-monitor`\n- `allow-monitor-from-point`\n- `allow-available-monitors`\n- `allow-cursor-position`\n- `allow-theme`\n- `allow-is-always-on-top`\n- `allow-activity-name`\n- `allow-scene-identifier`\n- `allow-internal-toggle-maximize`"
+        },
+        {
+          "description": "Enables the activity_name command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-activity-name",
+          "markdownDescription": "Enables the activity_name command without any pre-configured scope."
         },
         {
           "description": "Enables the available_monitors command without any pre-configured scope.",
@@ -1634,6 +1664,12 @@
           "const": "core:window:allow-scale-factor",
           "markdownDescription": "Enables the scale_factor command without any pre-configured scope."
         },
+        {
+          "description": "Enables the scene_identifier command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-scene-identifier",
+          "markdownDescription": "Enables the scene_identifier command without any pre-configured scope."
+        },
         {
           "description": "Enables the set_always_on_bottom command without any pre-configured scope.",
           "type": "string",
@@ -1898,6 +1934,12 @@
           "const": "core:window:allow-unminimize",
           "markdownDescription": "Enables the unminimize command without any pre-configured scope."
         },
+        {
+          "description": "Denies the activity_name command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-activity-name",
+          "markdownDescription": "Denies the activity_name command without any pre-configured scope."
+        },
         {
           "description": "Denies the available_monitors command without any pre-configured scope.",
           "type": "string",
@@ -2090,6 +2132,12 @@
           "const": "core:window:deny-scale-factor",
           "markdownDescription": "Denies the scale_factor command without any pre-configured scope."
         },
+        {
+          "description": "Denies the scene_identifier command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-scene-identifier",
+          "markdownDescription": "Denies the scene_identifier command without any pre-configured scope."
+        },
         {
           "description": "Denies the set_always_on_bottom command without any pre-configured scope.",
           "type": "string",
diff --git a/src-tauri/gen/schemas/macOS-schema.json b/src-tauri/gen/schemas/macOS-schema.json
index f827fe175..d1e536142 100644
--- a/src-tauri/gen/schemas/macOS-schema.json
+++ b/src-tauri/gen/schemas/macOS-schema.json
@@ -393,10 +393,10 @@
           "markdownDescription": "Default core plugins set.\n#### This default permission set includes:\n\n- `core:path:default`\n- `core:event:default`\n- `core:window:default`\n- `core:webview:default`\n- `core:app:default`\n- `core:image:default`\n- `core:resources:default`\n- `core:menu:default`\n- `core:tray:default`"
         },
         {
-          "description": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-version`\n- `allow-name`\n- `allow-tauri-version`\n- `allow-identifier`\n- `allow-bundle-type`\n- `allow-register-listener`\n- `allow-remove-listener`",
+          "description": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-version`\n- `allow-name`\n- `allow-tauri-version`\n- `allow-identifier`\n- `allow-bundle-type`\n- `allow-register-listener`\n- `allow-remove-listener`\n- `allow-supports-multiple-windows`",
           "type": "string",
           "const": "core:app:default",
-          "markdownDescription": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-version`\n- `allow-name`\n- `allow-tauri-version`\n- `allow-identifier`\n- `allow-bundle-type`\n- `allow-register-listener`\n- `allow-remove-listener`"
+          "markdownDescription": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-version`\n- `allow-name`\n- `allow-tauri-version`\n- `allow-identifier`\n- `allow-bundle-type`\n- `allow-register-listener`\n- `allow-remove-listener`\n- `allow-supports-multiple-windows`"
         },
         {
           "description": "Enables the app_hide command without any pre-configured scope.",
@@ -470,6 +470,12 @@
           "const": "core:app:allow-set-dock-visibility",
           "markdownDescription": "Enables the set_dock_visibility command without any pre-configured scope."
         },
+        {
+          "description": "Enables the supports_multiple_windows command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-supports-multiple-windows",
+          "markdownDescription": "Enables the supports_multiple_windows command without any pre-configured scope."
+        },
         {
           "description": "Enables the tauri_version command without any pre-configured scope.",
           "type": "string",
@@ -554,6 +560,12 @@
           "const": "core:app:deny-set-dock-visibility",
           "markdownDescription": "Denies the set_dock_visibility command without any pre-configured scope."
         },
+        {
+          "description": "Denies the supports_multiple_windows command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-supports-multiple-windows",
+          "markdownDescription": "Denies the supports_multiple_windows command without any pre-configured scope."
+        },
         {
           "description": "Denies the tauri_version command without any pre-configured scope.",
           "type": "string",
@@ -1077,10 +1089,10 @@
           "markdownDescription": "Denies the close command without any pre-configured scope."
         },
         {
-          "description": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-get-by-id`\n- `allow-remove-by-id`\n- `allow-set-icon`\n- `allow-set-menu`\n- `allow-set-tooltip`\n- `allow-set-title`\n- `allow-set-visible`\n- `allow-set-temp-dir-path`\n- `allow-set-icon-as-template`\n- `allow-set-show-menu-on-left-click`",
+          "description": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-get-by-id`\n- `allow-remove-by-id`\n- `allow-set-icon`\n- `allow-set-menu`\n- `allow-set-tooltip`\n- `allow-set-title`\n- `allow-set-visible`\n- `allow-set-temp-dir-path`\n- `allow-set-icon-as-template`\n- `allow-set-icon-with-as-template`\n- `allow-set-show-menu-on-left-click`",
           "type": "string",
           "const": "core:tray:default",
-          "markdownDescription": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-get-by-id`\n- `allow-remove-by-id`\n- `allow-set-icon`\n- `allow-set-menu`\n- `allow-set-tooltip`\n- `allow-set-title`\n- `allow-set-visible`\n- `allow-set-temp-dir-path`\n- `allow-set-icon-as-template`\n- `allow-set-show-menu-on-left-click`"
+          "markdownDescription": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-get-by-id`\n- `allow-remove-by-id`\n- `allow-set-icon`\n- `allow-set-menu`\n- `allow-set-tooltip`\n- `allow-set-title`\n- `allow-set-visible`\n- `allow-set-temp-dir-path`\n- `allow-set-icon-as-template`\n- `allow-set-icon-with-as-template`\n- `allow-set-show-menu-on-left-click`"
         },
         {
           "description": "Enables the get_by_id command without any pre-configured scope.",
@@ -1112,6 +1124,12 @@
           "const": "core:tray:allow-set-icon-as-template",
           "markdownDescription": "Enables the set_icon_as_template command without any pre-configured scope."
         },
+        {
+          "description": "Enables the set_icon_with_as_template command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:allow-set-icon-with-as-template",
+          "markdownDescription": "Enables the set_icon_with_as_template command without any pre-configured scope."
+        },
         {
           "description": "Enables the set_menu command without any pre-configured scope.",
           "type": "string",
@@ -1178,6 +1196,12 @@
           "const": "core:tray:deny-set-icon-as-template",
           "markdownDescription": "Denies the set_icon_as_template command without any pre-configured scope."
         },
+        {
+          "description": "Denies the set_icon_with_as_template command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:deny-set-icon-with-as-template",
+          "markdownDescription": "Denies the set_icon_with_as_template command without any pre-configured scope."
+        },
         {
           "description": "Denies the set_menu command without any pre-configured scope.",
           "type": "string",
@@ -1437,10 +1461,16 @@
           "markdownDescription": "Denies the webview_size command without any pre-configured scope."
         },
         {
-          "description": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-get-all-windows`\n- `allow-scale-factor`\n- `allow-inner-position`\n- `allow-outer-position`\n- `allow-inner-size`\n- `allow-outer-size`\n- `allow-is-fullscreen`\n- `allow-is-minimized`\n- `allow-is-maximized`\n- `allow-is-focused`\n- `allow-is-decorated`\n- `allow-is-resizable`\n- `allow-is-maximizable`\n- `allow-is-minimizable`\n- `allow-is-closable`\n- `allow-is-visible`\n- `allow-is-enabled`\n- `allow-title`\n- `allow-current-monitor`\n- `allow-primary-monitor`\n- `allow-monitor-from-point`\n- `allow-available-monitors`\n- `allow-cursor-position`\n- `allow-theme`\n- `allow-is-always-on-top`\n- `allow-internal-toggle-maximize`",
+          "description": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-get-all-windows`\n- `allow-scale-factor`\n- `allow-inner-position`\n- `allow-outer-position`\n- `allow-inner-size`\n- `allow-outer-size`\n- `allow-is-fullscreen`\n- `allow-is-minimized`\n- `allow-is-maximized`\n- `allow-is-focused`\n- `allow-is-decorated`\n- `allow-is-resizable`\n- `allow-is-maximizable`\n- `allow-is-minimizable`\n- `allow-is-closable`\n- `allow-is-visible`\n- `allow-is-enabled`\n- `allow-title`\n- `allow-current-monitor`\n- `allow-primary-monitor`\n- `allow-monitor-from-point`\n- `allow-available-monitors`\n- `allow-cursor-position`\n- `allow-theme`\n- `allow-is-always-on-top`\n- `allow-activity-name`\n- `allow-scene-identifier`\n- `allow-internal-toggle-maximize`",
           "type": "string",
           "const": "core:window:default",
-          "markdownDescription": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-get-all-windows`\n- `allow-scale-factor`\n- `allow-inner-position`\n- `allow-outer-position`\n- `allow-inner-size`\n- `allow-outer-size`\n- `allow-is-fullscreen`\n- `allow-is-minimized`\n- `allow-is-maximized`\n- `allow-is-focused`\n- `allow-is-decorated`\n- `allow-is-resizable`\n- `allow-is-maximizable`\n- `allow-is-minimizable`\n- `allow-is-closable`\n- `allow-is-visible`\n- `allow-is-enabled`\n- `allow-title`\n- `allow-current-monitor`\n- `allow-primary-monitor`\n- `allow-monitor-from-point`\n- `allow-available-monitors`\n- `allow-cursor-position`\n- `allow-theme`\n- `allow-is-always-on-top`\n- `allow-internal-toggle-maximize`"
+          "markdownDescription": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-get-all-windows`\n- `allow-scale-factor`\n- `allow-inner-position`\n- `allow-outer-position`\n- `allow-inner-size`\n- `allow-outer-size`\n- `allow-is-fullscreen`\n- `allow-is-minimized`\n- `allow-is-maximized`\n- `allow-is-focused`\n- `allow-is-decorated`\n- `allow-is-resizable`\n- `allow-is-maximizable`\n- `allow-is-minimizable`\n- `allow-is-closable`\n- `allow-is-visible`\n- `allow-is-enabled`\n- `allow-title`\n- `allow-current-monitor`\n- `allow-primary-monitor`\n- `allow-monitor-from-point`\n- `allow-available-monitors`\n- `allow-cursor-position`\n- `allow-theme`\n- `allow-is-always-on-top`\n- `allow-activity-name`\n- `allow-scene-identifier`\n- `allow-internal-toggle-maximize`"
+        },
+        {
+          "description": "Enables the activity_name command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-activity-name",
+          "markdownDescription": "Enables the activity_name command without any pre-configured scope."
         },
         {
           "description": "Enables the available_monitors command without any pre-configured scope.",
@@ -1634,6 +1664,12 @@
           "const": "core:window:allow-scale-factor",
           "markdownDescription": "Enables the scale_factor command without any pre-configured scope."
         },
+        {
+          "description": "Enables the scene_identifier command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-scene-identifier",
+          "markdownDescription": "Enables the scene_identifier command without any pre-configured scope."
+        },
         {
           "description": "Enables the set_always_on_bottom command without any pre-configured scope.",
           "type": "string",
@@ -1898,6 +1934,12 @@
           "const": "core:window:allow-unminimize",
           "markdownDescription": "Enables the unminimize command without any pre-configured scope."
         },
+        {
+          "description": "Denies the activity_name command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-activity-name",
+          "markdownDescription": "Denies the activity_name command without any pre-configured scope."
+        },
         {
           "description": "Denies the available_monitors command without any pre-configured scope.",
           "type": "string",
@@ -2090,6 +2132,12 @@
           "const": "core:window:deny-scale-factor",
           "markdownDescription": "Denies the scale_factor command without any pre-configured scope."
         },
+        {
+          "description": "Denies the scene_identifier command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-scene-identifier",
+          "markdownDescription": "Denies the scene_identifier command without any pre-configured scope."
+        },
         {
           "description": "Denies the set_always_on_bottom command without any pre-configured scope.",
           "type": "string",
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index 149571533..f906c7bd5 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -957,13 +957,11 @@ export class Vault {
   async signWord(publicKey: string, wordHex: string): Promise<string> {
     const accounts = await this.fetchAccounts();
     const isCold = accounts.some(acc => acc.coldPublicKey === publicKey);
-    console.log('signWord: isCold =', isCold, 'for publicKey =', publicKey);
     if (isCold) {
       const coldHex = await fetchAndDecryptOneWithLegacyFallBack<string>(
         accColdSecretKeyStrgKey(publicKey),
         this.vaultKey
       );
-      console.log('Sign word for cold key, got coldHex =', coldHex);
       const wasmSecretKey = AuthSecretKey.deserialize(new Uint8Array(Buffer.from(coldHex, 'hex')));
       const signature = wasmSecretKey.sign(Word.fromHex(wordHex));
       console.log(
diff --git a/src/lib/miden/front/guardian-manager.ts b/src/lib/miden/front/guardian-manager.ts
index 2c5782880..0302d9cc7 100644
--- a/src/lib/miden/front/guardian-manager.ts
+++ b/src/lib/miden/front/guardian-manager.ts
@@ -48,8 +48,17 @@ export async function getOrCreateMultisigService(
   accountPublicKey: string,
   provider: GuardianAccountProvider
 ): Promise<MultisigService> {
-  console.log(`[Guardian Manager] Getting/creating MultisigService for account: ${accountPublicKey}`);
-
+  // Return cached instance if its endpoint still matches storage. In the
+  // extension build, `clearGuardianServiceFor` from the SW realm doesn't reach
+  // the frontend's own copy of this Map, so a guardian switch would leave
+  // the popup syncing against the old guardian indefinitely. Re-check
+  // GUARDIAN_URL_STORAGE_KEY here and evict on drift.
+  const cached = guardianServiceCache.get(accountPublicKey);
+  if (cached) {
+    const currentEndpoint = (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
+    if (cached.service.guardianEndpoint === currentEndpoint) return cached.service;
+    guardianServiceCache.delete(accountPublicKey);
+  }
   // Coalesce concurrent inits: the guardian sync runs every 3s and does not
   // await previous ticks, so without this an in-flight init can start again
   // before its resolved service reaches the cache.
@@ -59,8 +68,7 @@ export async function getOrCreateMultisigService(
   }
 
   const initPromise = (async () => {
-    // Resolve the WalletAccount upfront — needed for both the cache drift
-    // check (hotPublicKey can rotate) and the subsequent service init.
+    // Verify this is a Guardian account
     const accounts = await provider.getAccounts();
     const account = accounts.find(acc => acc.publicKey === accountPublicKey);
     if (!account || account.type !== WalletType.Guardian) {
@@ -92,8 +100,6 @@ export async function getOrCreateMultisigService(
       } catch (error) {}
     }
 
-    console.log('[Guardian Manager] No valid cached MultisigService found, creating new one...');
-
     // Get the Account object from the Miden client.
     const { sdkAccount } = await withWasmClientLock(async () => {
       const midenClient = await getMidenClient();
@@ -108,6 +114,7 @@ export async function getOrCreateMultisigService(
     // Hot signer commitment lives at signer index 0 (order is [hot, cold]).
     const { commitment } = await getSignerDetailsFromAccount(sdkAccount);
     // Bind the service to the hot signer — the popup signs with the hot key.
+    console.log('creating guardian service', sdkAccount.id().toString());
     const service = await MultisigService.init(sdkAccount, `0x${hotPublicKey}`, `0x${commitment}`, provider.signWord);
 
     // Cache for future use, tagged with the hot pubkey it was bound to so the
@@ -131,9 +138,7 @@ export async function getOrCreateMultisigService(
  * Check if an account is a Guardian account.
  */
 export async function isGuardianAccount(accountPublicKey: string, provider: GuardianAccountProvider): Promise<boolean> {
-  console.log(`[Guardian Manager] Checking if account is Guardian: ${accountPublicKey}`);
   const accounts = await provider.getAccounts();
-  console.log('[Guardian Manager] Retrieved accounts from provider:', accounts);
   const account = accounts.find(acc => acc.publicKey === accountPublicKey);
   return account?.type === WalletType.Guardian;
 }
diff --git a/src/lib/miden/guardian/account.ts b/src/lib/miden/guardian/account.ts
index 5056e000d..a723e6257 100644
--- a/src/lib/miden/guardian/account.ts
+++ b/src/lib/miden/guardian/account.ts
@@ -43,7 +43,6 @@ export interface CreatedGuardianAccount {
  */
 export async function getSignerDetailsFromAccount(account: Account, getCold = false): Promise<{ commitment: string }> {
   const mapEntries = account.storage().getMapEntries(MULTISIG_SLOT_NAMES.SIGNER_PUBLIC_KEYS);
-  console.log('Signer public keys map entries:', mapEntries);
   if (!mapEntries) {
     throw new Error('No signer public keys found in account storage');
   }

From a7245c77c57ec586691fcd8c8bf7a8507ae57467 Mon Sep 17 00:00:00 2001
From: 0xnullifier <utkarsh382004@gmail.com>
Date: Wed, 24 Jun 2026 18:12:40 +0530
Subject: [PATCH 60/71] fix: restore bare miden-sdk mt/lazy alias in extension
 config to fix guardian sync wasm mismatch

---
 vite.extension.config.ts | 51 +++++++++++++++++++++-------------------
 1 file changed, 27 insertions(+), 24 deletions(-)

diff --git a/vite.extension.config.ts b/vite.extension.config.ts
index f09c70ded..a43f5d1b7 100644
--- a/vite.extension.config.ts
+++ b/vite.extension.config.ts
@@ -376,33 +376,36 @@ export default defineConfig({
     // than the real path (where peer packages like vite-plugin-node-polyfills
     // aren't installed).
     preserveSymlinks: true,
-    alias: {
-      ...sharedAlias,
-      // Chrome extension pages get cross-origin isolation from the
-      // manifest's declared COOP=`same-origin` + COEP=`require-corp`,
-      // so we use the multi-threaded SDK build for ~3-5× faster proving.
-      // Aliases the wallet's own `@miden-sdk/miden-sdk/lazy` imports to
-      // `/mt/lazy`. The wallet's `@miden-sdk/react/lazy` imports are
-      // not aliased — instead, vite catches their transitive SDK imports
-      // through this same alias, so the React-SDK bundle ends up wired
-      // to the MT WASM via the same path. Mobile (vite.mobile.config.ts)
-      // deliberately omits the alias because Capacitor / WKWebView /
-      // Android WebView don't expose cross-origin isolation — mobile
-      // uses delegated proving and the ST WASM is what loads.
+    // Array form (not object) so we can use anchored RegExp finds — a string
+    // alias for `@miden-sdk/miden-sdk` would prefix-match `/mt/lazy` and
+    // double-rewrite it. Mirrors vite.background.config.ts.
+    alias: [
+      // Path aliases (lib, app, …), spread from sharedAlias as array entries.
+      ...Object.entries(sharedAlias).map(([find, replacement]) => ({ find, replacement })),
+      // Chrome extension pages get cross-origin isolation from the manifest's
+      // declared COOP=`same-origin` + COEP=`require-corp`, so we use the
+      // multi-threaded SDK build for ~3-5× faster proving. The anchored regexes
+      // redirect the EXACT eager and single-threaded-lazy specifiers to
+      // `/mt/lazy` (without double-rewriting `/mt/lazy` itself).
       //
-      // Depends on `@miden-sdk/miden-sdk` ≥ 0.14.5 (web-sdk PR #134) for
-      // the `/mt/lazy` subpath. Wallet's pin is still 0.14.4 because
-      // 0.14.5 isn't published yet — bump after that PR ships and the
-      // build:chrome step turns green.
-      '@miden-sdk/miden-sdk/lazy': '@miden-sdk/miden-sdk/mt/lazy',
+      // The EAGER `@miden-sdk/miden-sdk` redirect is load-bearing for bundle
+      // size: @openzeppelin/miden-multisig-client imports the eager entry
+      // transitively, and without this redirect the front bundle resolves it to
+      // the default single-threaded build — pulling in a SECOND ~15M WASM
+      // alongside the MT one (the SW config already redirects it, but the front
+      // bundle did not). Mobile (vite.mobile.config.ts) deliberately omits this
+      // — Capacitor / WKWebView / Android WebView don't expose cross-origin
+      // isolation, so mobile uses delegated proving and the ST WASM.
+      { find: /^@miden-sdk\/miden-sdk$/, replacement: '@miden-sdk/miden-sdk/mt/lazy' },
+      { find: /^@miden-sdk\/miden-sdk\/lazy$/, replacement: '@miden-sdk/miden-sdk/mt/lazy' },
       // Ensure consistent React instance across all imports
-      react: resolve(__dirname, 'node_modules/react'),
-      'react-dom': resolve(__dirname, 'node_modules/react-dom'),
+      { find: 'react', replacement: resolve(__dirname, 'node_modules/react') },
+      { find: 'react-dom', replacement: resolve(__dirname, 'node_modules/react-dom') },
       // Node module polyfills for browser context
-      buffer: 'buffer',
-      stream: 'stream-browserify',
-      assert: 'assert'
-    }
+      { find: 'buffer', replacement: 'buffer' },
+      { find: 'stream', replacement: 'stream-browserify' },
+      { find: 'assert', replacement: 'assert' }
+    ]
   },
 
   define: {

From 605b750377b7f443f51607b369e7bd4a7f35a1cf Mon Sep 17 00:00:00 2001
From: Wiktor Starczewski <poszerny@gmail.com>
Date: Thu, 25 Jun 2026 16:25:22 +0200
Subject: [PATCH 61/71] fix(guardian): cold-sign background auto-consume to
 avoid biometric prompt

---
 src/app/pages/Explore.tsx                     |  4 +-
 .../activity/transactions.guardian.test.ts    | 62 +++++++++++++++++++
 src/lib/miden/activity/transactions.ts        | 39 +++++++++++-
 src/lib/miden/db/types.ts                     |  7 ++-
 4 files changed, 107 insertions(+), 5 deletions(-)

diff --git a/src/app/pages/Explore.tsx b/src/app/pages/Explore.tsx
index d0d16de7c..052afa4e8 100644
--- a/src/app/pages/Explore.tsx
+++ b/src/app/pages/Explore.tsx
@@ -65,7 +65,9 @@ const Explore: FC = () => {
     }
 
     const promises = notesToClaim.map(async note => {
-      await initiateConsumeTransaction(account.publicKey, note, isDelegatedProvingEnabled);
+      // `background: true` — this is a silent auto-consume, so on Guardian
+      // accounts it's cold-signed (no biometric prompt). See initiateConsumeTransaction.
+      await initiateConsumeTransaction(account.publicKey, note, isDelegatedProvingEnabled, true);
     });
     await Promise.all(promises);
     mutateClaimableNotes();
diff --git a/src/lib/miden/activity/transactions.guardian.test.ts b/src/lib/miden/activity/transactions.guardian.test.ts
index b8d41bc7b..7b6f6cb86 100644
--- a/src/lib/miden/activity/transactions.guardian.test.ts
+++ b/src/lib/miden/activity/transactions.guardian.test.ts
@@ -299,6 +299,68 @@ describe('generateTransaction — Guardian routing', () => {
     );
 
     expect(multisigService.createConsumeNotesProposal).toHaveBeenCalledWith(['note-xyz']);
+    // A user-initiated (non-background) consume stays hot-bound — no cold service built.
+    expect(mockBuildColdMultisigService).not.toHaveBeenCalled();
+  });
+
+  it('Guardian background/auto-consume: routes through the COLD key (no biometric prompt)', async () => {
+    const txId = 'consume-bg-1';
+    const result = makeResult();
+    const coldService = {
+      createConsumeNotesProposal: jest.fn(async () => ({ id: 'prop-consume-cold' })),
+      signAndCreateTransactionRequest: jest.fn(async () => ({
+        serialize: () => new Uint8Array([1]),
+        authArg: () => undefined
+      })),
+      sync: jest.fn(async () => {})
+    };
+    const hotService = {
+      createConsumeNotesProposal: jest.fn(async () => ({ id: 'prop-consume-hot' })),
+      signAndCreateTransactionRequest: jest.fn(async () => ({
+        serialize: () => new Uint8Array([1]),
+        authArg: () => undefined
+      })),
+      sync: jest.fn(async () => {})
+    };
+    mockGetOrCreateMultisigService.mockResolvedValue(hotService);
+    mockBuildColdMultisigService.mockResolvedValue(coldService);
+    mockGetMidenClient.mockResolvedValue({
+      syncState: jest.fn(async () => {}),
+      getAccount: jest.fn(async () => ({ id: () => ({ toString: () => 'guardian-acc' }) })),
+      client: { transactions: { submit: jest.fn(async () => ({ result })) } }
+    });
+    const provider = {
+      getAccounts: async () => [{ publicKey: 'guardian-acc', coldPublicKey: 'cold-pub', hotPublicKey: 'hot-pub' }],
+      getPublicKeyForCommitment: async () => 'pk',
+      signWord: async () => 'sig'
+    };
+    mockIsGuardianAccount.mockResolvedValue(true);
+    txStore.push({
+      id: txId,
+      type: 'consume',
+      accountId: 'guardian-acc',
+      status: ITransactionStatus.Queued,
+      noteId: 'note-bg'
+    });
+
+    await generateTransaction(
+      {
+        id: txId,
+        type: 'consume',
+        accountId: 'guardian-acc',
+        noteId: 'note-bg',
+        delegateTransaction: false,
+        background: true
+      } as never,
+      jest.fn(async () => new Uint8Array([1])),
+      false,
+      provider as never
+    );
+
+    // Cold service is built and signs the consume; the hot (biometric) service is not used.
+    expect(mockBuildColdMultisigService).toHaveBeenCalled();
+    expect(coldService.createConsumeNotesProposal).toHaveBeenCalledWith(['note-bg']);
+    expect(hotService.createConsumeNotesProposal).not.toHaveBeenCalled();
   });
 
   it('Guardian switch-guardian: cold co-signs before hot, waits for chain inclusion, finalizes switch', async () => {
diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index 6516495f7..2f464b786 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -189,9 +189,12 @@ export const initiateConsumeTransactionFromId = async (
 export const initiateConsumeTransaction = async (
   accountId: string,
   note: ConsumableNote,
-  delegateTransaction?: boolean
+  delegateTransaction?: boolean,
+  // Background/auto-consume: routed through the cold key on Guardian accounts so
+  // a silent claim doesn't trigger a biometric prompt (see generateGuardianTransaction).
+  background?: boolean
 ): Promise<string> => {
-  const dbTransaction = new ConsumeTransaction(accountId, note, delegateTransaction);
+  const dbTransaction = new ConsumeTransaction(accountId, note, delegateTransaction, background);
   // Dedup against all non-Failed consume txs for this noteId, including Completed ones.
   // Reason: getConsumableNotes() can still return a note for a short window after a local
   // consume completes (chain-sync lag). Without this, auto-consume polling creates a new
@@ -928,6 +931,29 @@ export const generateTransaction = async (
   }
 };
 
+/**
+ * Build a transient cold-bound MultisigService for `accountId`. Cold signing
+ * goes through the SDK keystore (not the SE/StrongBox-wrapped hot key), so it
+ * never triggers a biometric prompt — used for background/auto-consume.
+ */
+const buildColdServiceForAccount = async (
+  accountId: string,
+  guardianProvider: GuardianAccountProvider
+): Promise<MultisigService> => {
+  const walletAccount = (await guardianProvider.getAccounts()).find(a => a.publicKey === accountId);
+  if (!walletAccount) {
+    throw new Error(`Guardian account ${accountId} not found in provider`);
+  }
+  const sdkAccount = await withWasmClientLock(async () => {
+    const midenClient = await getMidenClient();
+    return midenClient.getAccount(accountId);
+  });
+  if (!sdkAccount) {
+    throw new Error(`Guardian account ${accountId} not found in local client`);
+  }
+  return MultisigService.buildColdMultisigService(sdkAccount, walletAccount, guardianProvider.signWord);
+};
+
 /**
  * Generate a transaction for a Guardian account using the MultisigService.
  * Routes the transaction through MultisigService proposal methods.
@@ -965,7 +991,14 @@ const generateGuardianTransaction = async (
     }
     case 'consume': {
       const consumeTx = transaction as ConsumeTransaction;
-      service = await getOrCreateMultisigService(transaction.accountId, guardianProvider);
+      // Background/auto-consume signs with the COLD key so it doesn't pop a
+      // biometric prompt: consuming a note is value-in (claims an incoming note
+      // into your own vault — it can't move funds out), so it needs no user
+      // presence, and threshold-1 means cold + guardian satisfies it on-chain.
+      // User-initiated claims stay hot-bound (tap-to-confirm biometric on mobile).
+      service = consumeTx.background
+        ? await buildColdServiceForAccount(transaction.accountId, guardianProvider)
+        : await getOrCreateMultisigService(transaction.accountId, guardianProvider);
       proposalResult = await service.createConsumeNotesProposal([consumeTx.noteId]);
       break;
     }
diff --git a/src/lib/miden/db/types.ts b/src/lib/miden/db/types.ts
index f138c40d8..fe4103f49 100644
--- a/src/lib/miden/db/types.ts
+++ b/src/lib/miden/db/types.ts
@@ -183,8 +183,12 @@ export class ConsumeTransaction implements ITransaction {
   displayMessage?: string;
   displayIcon: ITransactionIcon;
   delegateTransaction?: boolean;
+  // Background/auto-consume (vs. a user-initiated claim). Guardian accounts use
+  // this to route the signature through the cold key, avoiding a biometric
+  // prompt for a silent background claim — see generateGuardianTransaction.
+  background?: boolean;
 
-  constructor(accountId: string, note: ConsumableNote, delegateTransaction?: boolean) {
+  constructor(accountId: string, note: ConsumableNote, delegateTransaction?: boolean, background?: boolean) {
     this.id = uuid();
     this.type = 'consume';
     this.accountId = accountId;
@@ -197,6 +201,7 @@ export class ConsumeTransaction implements ITransaction {
     this.displayIcon = 'RECEIVE';
     this.displayMessage = 'Consuming';
     this.delegateTransaction = delegateTransaction;
+    this.background = background;
   }
 }
 

From 796278cfffce6cdeb0db7ab67cb1f0b1f2d6811a Mon Sep 17 00:00:00 2001
From: Wiktor Starczewski <poszerny@gmail.com>
Date: Thu, 25 Jun 2026 16:49:06 +0200
Subject: [PATCH 62/71] feat(guardian): migrate legacy single-key Guardian
 accounts to 3-key on unlock

---
 src/lib/miden/back/actions.test.ts |  2 +
 src/lib/miden/back/actions.ts      |  4 ++
 src/lib/miden/back/vault.test.ts   | 76 +++++++++++++++++++++++++++++-
 src/lib/miden/back/vault.ts        | 62 ++++++++++++++++++++++++
 4 files changed, 143 insertions(+), 1 deletion(-)

diff --git a/src/lib/miden/back/actions.test.ts b/src/lib/miden/back/actions.test.ts
index 637609ea8..605b8a8d6 100644
--- a/src/lib/miden/back/actions.test.ts
+++ b/src/lib/miden/back/actions.test.ts
@@ -234,6 +234,7 @@ describe('actions', () => {
     it('calls Vault.setup and unlocked with password', async () => {
       const { Vault } = jest.requireMock('lib/miden/back/vault');
       const mockVaultInstance = {
+        migrateLegacyGuardianAccounts: jest.fn().mockResolvedValue(undefined),
         fetchAccounts: jest.fn().mockResolvedValue([]),
         fetchSettings: jest.fn().mockResolvedValue({}),
         getCurrentAccount: jest.fn().mockResolvedValue(null),
@@ -244,6 +245,7 @@ describe('actions', () => {
       await unlock('password123');
 
       expect(Vault.setup).toHaveBeenCalledWith('password123');
+      expect(mockVaultInstance.migrateLegacyGuardianAccounts).toHaveBeenCalled();
       expect(mockVaultInstance.fetchAccounts).toHaveBeenCalled();
       expect(mockVaultInstance.fetchSettings).toHaveBeenCalled();
       expect(mockUnlocked).toHaveBeenCalled();
diff --git a/src/lib/miden/back/actions.ts b/src/lib/miden/back/actions.ts
index c4651772e..b81469c7d 100644
--- a/src/lib/miden/back/actions.ts
+++ b/src/lib/miden/back/actions.ts
@@ -187,6 +187,10 @@ export function unlock(password?: string) {
   return withInited(() =>
     getUnlockQueue().add(async () => {
       const vault = await Vault.setup(password);
+      // Bring any pre-3-key Guardian accounts into the 3-key model in place
+      // (best-effort, never throws) so they surface the Activate Device Key
+      // banner instead of being unreachable. See Vault.migrateLegacyGuardianAccounts.
+      await vault.migrateLegacyGuardianAccounts();
       const accounts = await vault.fetchAccounts();
       const settings = await vault.fetchSettings();
       const currentAccount = await vault.getCurrentAccount();
diff --git a/src/lib/miden/back/vault.test.ts b/src/lib/miden/back/vault.test.ts
index 3410508f2..bc241d636 100644
--- a/src/lib/miden/back/vault.test.ts
+++ b/src/lib/miden/back/vault.test.ts
@@ -7,7 +7,7 @@ import { WalletAccount } from 'lib/shared/types';
 import { WalletType } from 'screens/onboarding/types';
 
 import { PublicError } from './defaults';
-import { encryptAndSaveMany, savePlain } from './safe-storage';
+import { encryptAndSaveMany, fetchAndDecryptOneWithLegacyFallBack, savePlain } from './safe-storage';
 import { Vault } from './vault';
 
 const memoryStore: Record<string, any> = {};
@@ -1405,3 +1405,77 @@ describe('Vault hardware branches', () => {
     expect(true).toBe(true); // assert no-throw
   });
 });
+
+describe('Vault.migrateLegacyGuardianAccounts', () => {
+  const sdk = jest.requireMock('@miden-sdk/miden-sdk/lazy');
+
+  beforeEach(() => {
+    // Cold-key derivation is mocked to a fixed key; `deriveClientSeed` still runs
+    // real BIP-39 over VALID_MNEMONIC but the seed it produces is ignored here.
+    sdk.AuthSecretKey.ecdsaWithRNG.mockImplementation(() => ({
+      publicKey: () => ({ serialize: () => new Uint8Array([0x00, 0x02, 0x03, 0x04]) }),
+      serialize: () => new Uint8Array([0xab, 0xcd])
+    }));
+  });
+
+  const legacyGuardian = {
+    publicKey: 'guardian-legacy',
+    name: 'Guardian 1',
+    isPublic: true,
+    type: WalletType.Guardian,
+    hdIndex: 0
+  };
+  const normalAcc = { publicKey: 'normal-1', name: 'Acc', isPublic: true, type: WalletType.OnChain, hdIndex: 0 };
+  const already3Key = {
+    publicKey: 'guardian-3key',
+    name: 'Guardian 2',
+    isPublic: true,
+    type: WalletType.Guardian,
+    hdIndex: 1,
+    coldPublicKey: 'existing-cold',
+    hotPublicKey: 'existing-hot'
+  };
+
+  it('migrates a legacy single-key Guardian account to the 3-key model in place', async () => {
+    const vault = await seedVault('pw', { accounts: [legacyGuardian, normalAcc, already3Key] as any });
+    await vault.migrateLegacyGuardianAccounts();
+
+    const accounts = await vault.fetchAccounts();
+    const migrated = accounts.find(a => a.publicKey === 'guardian-legacy')!;
+    expect(migrated.coldPublicKey).toBe('020304'); // serialize().slice(1) of [00,02,03,04]
+    expect(migrated.requiresHotKeyRotation).toBe(true);
+    // The derived cold key is persisted into the cold slot.
+    const coldHex = await fetchAndDecryptOneWithLegacyFallBack(
+      keys.accColdSecretKey('020304'),
+      (vault as any).vaultKey
+    );
+    expect(coldHex).toBe('abcd');
+  });
+
+  it('leaves non-Guardian and already-3-key accounts untouched', async () => {
+    const vault = await seedVault('pw', { accounts: [legacyGuardian, normalAcc, already3Key] as any });
+    await vault.migrateLegacyGuardianAccounts();
+
+    const accounts = await vault.fetchAccounts();
+    const normal = accounts.find(a => a.publicKey === 'normal-1')!;
+    const threeKey = accounts.find(a => a.publicKey === 'guardian-3key')!;
+    expect(normal.coldPublicKey).toBeUndefined();
+    expect(normal.requiresHotKeyRotation).toBeUndefined();
+    expect(threeKey.coldPublicKey).toBe('existing-cold');
+    expect(threeKey.requiresHotKeyRotation).toBeUndefined();
+  });
+
+  it('is idempotent — a second run derives nothing', async () => {
+    const vault = await seedVault('pw', { accounts: [legacyGuardian] as any });
+    await vault.migrateLegacyGuardianAccounts();
+    sdk.AuthSecretKey.ecdsaWithRNG.mockClear();
+    await vault.migrateLegacyGuardianAccounts();
+    expect(sdk.AuthSecretKey.ecdsaWithRNG).not.toHaveBeenCalled();
+  });
+
+  it('never throws (best-effort) — a failure cannot block unlock', async () => {
+    const vault = await seedVault('pw', { accounts: [legacyGuardian] as any });
+    jest.spyOn(vault as any, 'fetchAccounts').mockRejectedValueOnce(new Error('boom'));
+    await expect(vault.migrateLegacyGuardianAccounts()).resolves.toBeUndefined();
+  });
+});
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index f906c7bd5..019c51dcd 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -894,6 +894,68 @@ export class Vault {
     });
   }
 
+  /**
+   * One-time, in-place migration of legacy single-signer Guardian accounts to
+   * the 3-key model. Called on every unlock; idempotent (a no-op once an
+   * account carries `coldPublicKey` or `requiresHotKeyRotation`).
+   *
+   * A pre-3-key Guardian account's on-chain signer is the HD key derived at its
+   * index — which is exactly what the 3-key model calls the *cold* key (both are
+   * `AuthSecretKey.ecdsaWithRNG(deriveClientSeed(Guardian, mnemonic, hdIndex))`).
+   * So migrating is purely local + offline: re-derive that key into the cold
+   * slot and flag the account `requiresHotKeyRotation`. The account then surfaces
+   * the Activate Device Key banner, and a single cold-signed `update_signers`
+   * installs the hardware-backed hot key — the same path a seed-recovered account
+   * takes. No funds move and nothing is destructive; routine use simply waits on
+   * that one activation.
+   *
+   * Best-effort by design: any failure is swallowed so a migration hiccup can
+   * never block unlock.
+   */
+  async migrateLegacyGuardianAccounts(): Promise<void> {
+    try {
+      const allAccounts = await this.fetchAccounts();
+      // Legacy = a Guardian record with neither the cold key nor the
+      // pending-rotation flag, i.e. created before the 3-key model.
+      const legacy = allAccounts.filter(
+        acc => acc.type === WalletType.Guardian && !acc.coldPublicKey && !acc.requiresHotKeyRotation
+      );
+      if (legacy.length === 0) return;
+
+      const mnemonic = await fetchAndDecryptOneWithLegacyFallBack<string>(mnemonicStrgKey, this.vaultKey);
+      if (!mnemonic) return; // can't derive the cold key without the seed — leave untouched
+
+      // accountId -> derived cold public key, for the records we successfully migrated.
+      const migrated = new Map<string, string>();
+      for (const acc of legacy) {
+        try {
+          const coldSeed = deriveClientSeed(WalletType.Guardian, mnemonic, acc.hdIndex);
+          const coldSk = AuthSecretKey.ecdsaWithRNG(coldSeed);
+          const coldPublicKey = Buffer.from(coldSk.publicKey().serialize().slice(1)).toString('hex');
+          const coldSecretKeyHex = Buffer.from(coldSk.serialize()).toString('hex');
+          await persistRecoveredGuardianColdKey(this.vaultKey, coldPublicKey, coldSecretKeyHex);
+          migrated.set(acc.publicKey, coldPublicKey);
+        } catch (e) {
+          console.warn('[Vault.migrateLegacyGuardianAccounts] skipped one account (non-fatal):', acc.publicKey, e);
+        }
+      }
+      if (migrated.size === 0) return;
+
+      const nextAccounts = allAccounts.map(acc =>
+        migrated.has(acc.publicKey)
+          ? { ...acc, coldPublicKey: migrated.get(acc.publicKey)!, requiresHotKeyRotation: true }
+          : acc
+      );
+      await encryptAndSaveMany([[accountsStrgKey, nextAccounts]], this.vaultKey);
+      console.log(
+        `[Vault.migrateLegacyGuardianAccounts] migrated ${migrated.size} legacy Guardian account(s) to 3-key (rotation pending)`
+      );
+    } catch (e) {
+      // Migration is best-effort — a failure must never block unlock.
+      console.warn('[Vault.migrateLegacyGuardianAccounts] failed (non-fatal):', e);
+    }
+  }
+
   async updateSettings(settings: Partial<WalletSettings>) {
     return withError('Failed to update settings', async () => {
       const current = await this.fetchSettings();

From a5dae27e03cd049a9b431f14090c931f5eb8f816 Mon Sep 17 00:00:00 2001
From: Wiktor Starczewski <poszerny@gmail.com>
Date: Thu, 25 Jun 2026 17:15:30 +0200
Subject: [PATCH 63/71] feat(guardian): set update_guardian procedure threshold
 after activation to harden migrated accounts

---
 .../activity/transactions.guardian.test.ts    |  96 +++++++++++++++++
 src/lib/miden/activity/transactions.ts        | 102 +++++++++++++++++-
 src/lib/miden/db/types.ts                     |  41 ++++++-
 src/lib/miden/guardian/index.ts               |  14 +++
 4 files changed, 250 insertions(+), 3 deletions(-)

diff --git a/src/lib/miden/activity/transactions.guardian.test.ts b/src/lib/miden/activity/transactions.guardian.test.ts
index 7b6f6cb86..b70a2576e 100644
--- a/src/lib/miden/activity/transactions.guardian.test.ts
+++ b/src/lib/miden/activity/transactions.guardian.test.ts
@@ -500,6 +500,55 @@ describe('generateTransaction — Guardian routing', () => {
     expect(waitForTransactionCommit).toHaveBeenCalledWith('exec-tx-hash');
   });
 
+  it('Guardian update-procedure-threshold: cold-signs the threshold update', async () => {
+    const txId = 'upt-1';
+    const result = makeResult();
+    const coldService = {
+      createUpdateProcedureThresholdProposal: jest.fn(async () => ({ id: 'prop-upt' })),
+      signAndCreateTransactionRequest: jest.fn(async () => ({
+        serialize: () => new Uint8Array([1]),
+        authArg: () => undefined
+      })),
+      sync: jest.fn(async () => {})
+    };
+    mockGetOrCreateMultisigService.mockResolvedValue({ sync: jest.fn(async () => {}) });
+    mockBuildColdMultisigService.mockResolvedValue(coldService);
+    mockGetMidenClient.mockResolvedValue({
+      syncState: jest.fn(async () => {}),
+      getAccount: jest.fn(async () => ({ id: () => ({ toString: () => 'guardian-acc' }) })),
+      client: { transactions: { submit: jest.fn(async () => ({ result })) } }
+    });
+    const provider = {
+      getAccounts: async () => [{ publicKey: 'guardian-acc', coldPublicKey: 'cold-pub', hotPublicKey: 'hot-pub' }],
+      getPublicKeyForCommitment: async () => 'pk',
+      signWord: async () => 'sig'
+    };
+    mockIsGuardianAccount.mockResolvedValue(true);
+    txStore.push({
+      id: txId,
+      type: 'update-procedure-threshold',
+      accountId: 'guardian-acc',
+      status: ITransactionStatus.Queued,
+      extraInputs: { procedure: 'update_guardian', threshold: 2 }
+    });
+
+    await generateTransaction(
+      {
+        id: txId,
+        type: 'update-procedure-threshold',
+        accountId: 'guardian-acc',
+        extraInputs: { procedure: 'update_guardian', threshold: 2 },
+        delegateTransaction: false
+      } as never,
+      jest.fn(async () => new Uint8Array([1])),
+      false,
+      provider as never
+    );
+
+    expect(mockBuildColdMultisigService).toHaveBeenCalled();
+    expect(coldService.createUpdateProcedureThresholdProposal).toHaveBeenCalledWith('update_guardian', 2);
+  });
+
   it('Guardian: unsupported transaction type cancels the transaction', async () => {
     const txId = 'unsupported-guardian';
     txStore.push({
@@ -588,6 +637,53 @@ describe('completeReplaceHotKeyTransaction', () => {
     expect(row.displayMessage).toBe('Device key rotated');
   });
 
+  it('enqueues a procedure-threshold hardening tx after rotation when update_guardian is unhardened', async () => {
+    const tx = new ReplaceHotKeyTransaction('acc-1', false);
+    tx.extraInputs = { newHotPublicKey: 'new-hot-pub' };
+    txStore.push({ id: tx.id, status: ITransactionStatus.GeneratingTransaction });
+
+    mockIsGuardianAccount.mockResolvedValue(true);
+    // Post-rotation service reports no update_guardian threshold → needs hardening.
+    mockGetOrCreateMultisigService.mockResolvedValue({
+      getProcedureThreshold: jest.fn(() => undefined),
+      sync: jest.fn(async () => {})
+    });
+    const provider = {
+      getAccounts: async () => [{ publicKey: 'acc-1', coldPublicKey: 'cold', hotPublicKey: 'old-hot-pub' }],
+      getPublicKeyForCommitment: async () => 'pk',
+      signWord: async () => 'sig',
+      swapHotKey: jest.fn(async () => {})
+    };
+
+    await completeReplaceHotKeyTransaction(tx, makeResult() as never, provider as never);
+
+    const upt = txStore.find(r => r.type === 'update-procedure-threshold') as Record<string, unknown>;
+    expect(upt).toBeDefined();
+    expect(upt.extraInputs).toEqual({ procedure: 'update_guardian', threshold: 2 });
+  });
+
+  it('does NOT enqueue hardening when update_guardian is already at threshold 2 (recovered/fresh account)', async () => {
+    const tx = new ReplaceHotKeyTransaction('acc-1', false);
+    tx.extraInputs = { newHotPublicKey: 'new-hot-pub' };
+    txStore.push({ id: tx.id, status: ITransactionStatus.GeneratingTransaction });
+
+    mockIsGuardianAccount.mockResolvedValue(true);
+    mockGetOrCreateMultisigService.mockResolvedValue({
+      getProcedureThreshold: jest.fn(() => 2),
+      sync: jest.fn(async () => {})
+    });
+    const provider = {
+      getAccounts: async () => [{ publicKey: 'acc-1', coldPublicKey: 'cold', hotPublicKey: 'old-hot-pub' }],
+      getPublicKeyForCommitment: async () => 'pk',
+      signWord: async () => 'sig',
+      swapHotKey: jest.fn(async () => {})
+    };
+
+    await completeReplaceHotKeyTransaction(tx, makeResult() as never, provider as never);
+
+    expect(txStore.find(r => r.type === 'update-procedure-threshold')).toBeUndefined();
+  });
+
   it('still calls swapHotKey even when the row already reflects new hot (vault handles idempotency)', async () => {
     const tx = new ReplaceHotKeyTransaction('acc-1', false);
     tx.extraInputs = { newHotPublicKey: 'already-rotated' };
diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index 2f464b786..514a7b887 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -26,7 +26,8 @@ import {
   SendTransaction,
   SwitchGuardianTransaction,
   Transaction,
-  TransactionOutput
+  TransactionOutput,
+  UpdateProcedureThresholdTransaction
 } from '../db/types';
 import { putToStorage } from '../front';
 import { toNoteTypeString } from '../helpers';
@@ -456,6 +457,12 @@ export const completeReplaceHotKeyTransaction = async (
       completedAt: Math.floor(Date.now() / 1000),
       resultBytes: result.serialize()
     });
+
+    // The account now has both signers on-chain, so bring it up to the same
+    // hardening a freshly-created 3-key account has (update_guardian threshold
+    // 2 — which the update_signers rotation above can't carry). Best-effort and
+    // idempotent; never affects the rotation's success.
+    await ensureGuardianProcedureThresholds(tx.accountId, tx.delegateTransaction, guardianProvider);
   } catch (error) {
     console.error('Error completing replace-hot-key transaction:', error);
     await updateTransactionStatus(tx.id, ITransactionStatus.Failed, {
@@ -467,6 +474,76 @@ export const completeReplaceHotKeyTransaction = async (
   }
 };
 
+// The on-chain hardening a freshly-created 3-key Guardian account gets (see
+// createGuardianAccount): changing the guardian requires both device keys.
+const GUARDIAN_PROCEDURE_HARDENING = { procedure: 'update_guardian', threshold: 2 } as const;
+
+/**
+ * Ensure a Guardian account carries the `update_guardian` threshold-2 hardening
+ * that fresh 3-key accounts have. Migrated legacy accounts lack it; recovered /
+ * fresh accounts already have it (so this no-ops). Enqueues a cold-signed
+ * `update_procedure_threshold` when missing. Best-effort — never throws.
+ */
+const ensureGuardianProcedureThresholds = async (
+  accountId: string,
+  delegateTransaction: boolean | undefined,
+  guardianProvider: GuardianAccountProvider
+): Promise<void> => {
+  try {
+    // Loading the service fetches the on-chain account config, including its
+    // procedure thresholds.
+    const service = await getOrCreateMultisigService(accountId, guardianProvider);
+    if (
+      service.getProcedureThreshold(GUARDIAN_PROCEDURE_HARDENING.procedure) === GUARDIAN_PROCEDURE_HARDENING.threshold
+    ) {
+      return;
+    }
+    await initiateUpdateProcedureThresholdTransaction(
+      accountId,
+      GUARDIAN_PROCEDURE_HARDENING.procedure,
+      GUARDIAN_PROCEDURE_HARDENING.threshold,
+      delegateTransaction,
+      guardianProvider
+    );
+    // Nudge the processor to pick up the freshly-queued tx. Dynamic import to
+    // avoid a static cycle with the activity barrel.
+    const { requestSWTransactionProcessing } = await import('lib/miden/activity');
+    requestSWTransactionProcessing();
+  } catch (e) {
+    console.warn('[guardian] procedure-threshold hardening skipped (non-fatal):', e);
+  }
+};
+
+export const initiateUpdateProcedureThresholdTransaction = async (
+  accountId: string,
+  procedure: string,
+  threshold: number,
+  delegateTransaction: boolean | undefined,
+  guardianProvider: GuardianAccountProvider
+): Promise<string> => {
+  if (!(await isGuardianAccount(accountId, guardianProvider))) {
+    throw new Error('update-procedure-threshold is only supported for Guardian accounts');
+  }
+  const dbTransaction = new UpdateProcedureThresholdTransaction(accountId, procedure, threshold, delegateTransaction);
+  await Repo.transactions.add(dbTransaction);
+  return dbTransaction.id;
+};
+
+export const completeUpdateProcedureThresholdTransaction = async (
+  tx: UpdateProcedureThresholdTransaction,
+  result: TransactionResult
+) => {
+  const executedTx = result.executedTransaction();
+  await updateTransactionStatus(tx.id, ITransactionStatus.Completed, {
+    displayMessage: 'Account secured',
+    transactionId: executedTx.id().toHex(),
+    completedAt: Math.floor(Date.now() / 1000),
+    resultBytes: result.serialize()
+  });
+  // The cached service's procedureThresholds are now stale — drop it.
+  clearGuardianServiceFor(tx.accountId);
+};
+
 export const completeSwitchGuardianTransaction = async (
   tx: SwitchGuardianTransaction,
   result: TransactionResult,
@@ -1041,6 +1118,17 @@ const generateGuardianTransaction = async (
       proposalResult = proposal;
       break;
     }
+    case 'update-procedure-threshold': {
+      // Cold-routed structural change (same class as switch-guardian /
+      // replace-hot-key): cold + guardian satisfies it on-chain.
+      const uptTx = transaction as UpdateProcedureThresholdTransaction;
+      service = await buildColdServiceForAccount(transaction.accountId, guardianProvider);
+      proposalResult = await service.createUpdateProcedureThresholdProposal(
+        uptTx.extraInputs.procedure,
+        uptTx.extraInputs.threshold
+      );
+      break;
+    }
     case 'execute':
     default: {
       // For custom transactions, build a custom proposal from the serialized request bytes.
@@ -1141,6 +1229,13 @@ const generateGuardianTransaction = async (
         guardianProvider
       );
       break;
+    case 'update-procedure-threshold':
+      console.log('Completing update-procedure-threshold transaction');
+      await completeUpdateProcedureThresholdTransaction(
+        transaction as UpdateProcedureThresholdTransaction,
+        transactionResult
+      );
+      break;
     case 'execute':
     default:
       await completeCustomTransaction(transaction, transactionResult);
@@ -1155,7 +1250,10 @@ const generateGuardianTransaction = async (
   // and the on-chain submit succeeded, so a sync failure here must NOT propagate
   // (it would flip a genuinely-successful transaction to Failed). The next sync
   // tick reconciles.
-  if (transaction.type !== 'replace-hot-key') {
+  // replace-hot-key and update-procedure-threshold both run on a transient cold
+  // service and invalidate the cached hot service in their completion handlers,
+  // so there's nothing useful to sync here.
+  if (transaction.type !== 'replace-hot-key' && transaction.type !== 'update-procedure-threshold') {
     try {
       console.log('Transaction generation complete, syncing multisig service');
       await service.sync();
diff --git a/src/lib/miden/db/types.ts b/src/lib/miden/db/types.ts
index fe4103f49..3e90afeeb 100644
--- a/src/lib/miden/db/types.ts
+++ b/src/lib/miden/db/types.ts
@@ -15,7 +15,13 @@ export enum ITransactionStatus {
 }
 
 export type ITransactionIcon = 'SEND' | 'RECEIVE' | 'SWAP' | 'FAILED' | 'MINT' | 'DEFAULT';
-export type ITransactionType = 'send' | 'consume' | 'execute' | 'switch-guardian' | 'replace-hot-key';
+export type ITransactionType =
+  | 'send'
+  | 'consume'
+  | 'execute'
+  | 'switch-guardian'
+  | 'replace-hot-key'
+  | 'update-procedure-threshold';
 
 /**
  * Sub-phase of a transaction while `status === GeneratingTransaction` (or
@@ -266,6 +272,39 @@ export class ReplaceHotKeyTransaction implements ITransaction {
   }
 }
 
+/**
+ * Sets an on-chain procedure threshold on a Guardian account (cold-signed).
+ * Used to bring migrated legacy accounts up to the same hardening a freshly
+ * created 3-key account gets — notably `update_guardian` at threshold 2 — which
+ * `update_signers` (the hot-key activation) cannot carry in the same tx.
+ */
+export class UpdateProcedureThresholdTransaction implements ITransaction {
+  id: string;
+  type: ITransactionType;
+  accountId: string;
+  transactionId?: string;
+  status: ITransactionStatus;
+  initiatedAt: number;
+  processingStartedAt?: number;
+  completedAt?: number;
+  displayMessage?: string;
+  displayIcon: ITransactionIcon;
+  extraInputs: { procedure: string; threshold: number };
+  delegateTransaction?: boolean | undefined;
+
+  constructor(accountId: string, procedure: string, threshold: number, delegateTransaction?: boolean) {
+    this.id = uuid();
+    this.type = 'update-procedure-threshold';
+    this.accountId = accountId;
+    this.status = ITransactionStatus.Queued;
+    this.initiatedAt = Math.floor(Date.now() / 1000);
+    this.displayIcon = 'DEFAULT';
+    this.displayMessage = 'Securing account';
+    this.extraInputs = { procedure, threshold };
+    this.delegateTransaction = delegateTransaction;
+  }
+}
+
 export function formatTransactionStatus(status: ITransactionStatus): string {
   const words = ITransactionStatus[status].split(/(?=[A-Z])/);
   return words.join(' ');
diff --git a/src/lib/miden/guardian/index.ts b/src/lib/miden/guardian/index.ts
index 883d6768d..1df69b14d 100644
--- a/src/lib/miden/guardian/index.ts
+++ b/src/lib/miden/guardian/index.ts
@@ -162,6 +162,20 @@ export class MultisigService {
     return withWasmClientLock(() => this.multisig.createConsumeNotesProposal(noteIds));
   }
 
+  /** Current on-chain threshold for `procedure`, or undefined if none is set. */
+  getProcedureThreshold(procedure: string): number | undefined {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    return (this.multisig as any).procedureThresholds?.get(procedure);
+  }
+
+  /** Create a proposal that sets `procedure`'s signature threshold to `threshold`. */
+  async createUpdateProcedureThresholdProposal(procedure: string, threshold: number): Promise<Proposal> {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    return withWasmClientLock(() =>
+      (this.multisig as any).createUpdateProcedureThresholdProposal(procedure, threshold)
+    );
+  }
+
   async signAndExecuteProposal(id: string): Promise<void> {
     // `signProposal` is signing + guardian HTTP (no shared-client access); only
     // `executeProposal` touches the WASM client and needs the mutex.

From d0052adb74e3dfe6afdba31c6aadf79d80f609b5 Mon Sep 17 00:00:00 2001
From: Wiktor Starczewski <poszerny@gmail.com>
Date: Thu, 25 Jun 2026 17:35:41 +0200
Subject: [PATCH 64/71] test(guardian): on-chain auth reader + assert 3-key
 auth structure in E2E harness

---
 playwright/e2e/helpers/wallet-page.ts         | 29 +++++++++++++++++++
 .../e2e/tests/guardian-send-consume.spec.ts   | 12 ++++++++
 src/lib/miden/guardian/index.test.ts          | 28 ++++++++++++++++++
 src/lib/miden/guardian/index.ts               | 22 ++++++++++++++
 src/lib/store/index.ts                        | 22 ++++++++++++++
 5 files changed, 113 insertions(+)

diff --git a/playwright/e2e/helpers/wallet-page.ts b/playwright/e2e/helpers/wallet-page.ts
index a38c3f31e..885cc31be 100644
--- a/playwright/e2e/helpers/wallet-page.ts
+++ b/playwright/e2e/helpers/wallet-page.ts
@@ -76,12 +76,25 @@ export interface ChromeWalletPageApi extends WalletPage, IdbDumpSource {
   }>;
   /** Full dump of chrome.storage.local — end-of-run forensic snapshot. */
   dumpChromeStorage(): Promise<Record<string, unknown>>;
+  /**
+   * On-chain auth structure of a Guardian account (overall threshold, signer
+   * commitments, per-procedure thresholds) — for asserting the 3-key shape
+   * (e.g. `update_guardian === 2`, two signers) which balance checks can't see.
+   */
+  getGuardianAuthInfo(accountPublicKey: string): Promise<GuardianAuthInfo>;
   // IndexedDB forensics (listIndexedDBStores / dumpIndexedDBStore) come from
   // IdbDumpSource — driven store-at-a-time by streamIndexedDBToFile so a long
   // run's dump can't OOM the page. This is where the Miden SDK keeps per-tx
   // commit status — the ground truth for "did this tx land?".
 }
 
+export interface GuardianAuthInfo {
+  threshold: number;
+  signerCommitments: string[];
+  procedureThresholds: Record<string, number>;
+  error?: string;
+}
+
 /**
  * Page Object Model for a single wallet extension instance.
  * Encapsulates all UI interactions, reusing selectors from popup-smoke.spec.ts.
@@ -627,6 +640,22 @@ export class ChromeWalletPage implements ChromeWalletPageApi {
     }
   }
 
+  async getGuardianAuthInfo(accountPublicKey: string): Promise<GuardianAuthInfo> {
+    return this.page.evaluate(async (pk: string) => {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const fn = (globalThis as any).__TEST_GUARDIAN_AUTH__;
+      if (!fn) {
+        return {
+          threshold: NaN,
+          signerCommitments: [],
+          procedureThresholds: {},
+          error: '__TEST_GUARDIAN_AUTH__ unavailable (needs MIDEN_E2E_TEST build)'
+        };
+      }
+      return await fn(pk);
+    }, accountPublicKey);
+  }
+
   /**
    * Enumerate every (db, store) on the extension origin — cheap, loads no row
    * data. Pairs with `dumpIndexedDBStore` so `streamIndexedDBToFile` can pull
diff --git a/playwright/e2e/tests/guardian-send-consume.spec.ts b/playwright/e2e/tests/guardian-send-consume.spec.ts
index 04d184aad..7902745e7 100644
--- a/playwright/e2e/tests/guardian-send-consume.spec.ts
+++ b/playwright/e2e/tests/guardian-send-consume.spec.ts
@@ -54,6 +54,18 @@ test.describe('Guardian account - consume + send', () => {
       }
     );
 
+    await steps.step('verify_guardian_auth_structure_a', async () => {
+      // First on-chain AUTH assertion in the harness (balance checks can't see
+      // this): a fresh 3-key Guardian account must carry two signers ([hot,
+      // cold]) and the `update_guardian` procedure hardened to threshold 2 —
+      // both set at creation. The same reader verifies the migrated/activated
+      // path in the (P1) migration spec.
+      const auth = await walletA.getGuardianAuthInfo(addressA!);
+      expect(auth.error, `guardian auth read failed: ${auth.error}`).toBeUndefined();
+      expect(auth.signerCommitments.length, 'fresh 3-key account should have 2 signers (hot, cold)').toBe(2);
+      expect(auth.procedureThresholds.update_guardian, 'update_guardian must be hardened to threshold 2').toBe(2);
+    });
+
     await steps.step(
       'consume_notes_guardian_a',
       async () => {
diff --git a/src/lib/miden/guardian/index.test.ts b/src/lib/miden/guardian/index.test.ts
index e5092f002..83eb6c5f5 100644
--- a/src/lib/miden/guardian/index.test.ts
+++ b/src/lib/miden/guardian/index.test.ts
@@ -177,6 +177,34 @@ describe('MultisigService', () => {
       expect(service.accountId).toBe('acc-id');
       expect(service.guardianEndpoint).toBe('https://x');
     });
+
+    it('getAuthInfo reports threshold, signer set, and procedure thresholds', () => {
+      const multisig = makeMultisig({
+        threshold: 1,
+        signerCommitments: ['0xhot', '0xcold'],
+        procedureThresholds: new Map<string, number>([['update_guardian', 2]])
+      });
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+      const auth = service.getAuthInfo();
+      expect(auth.threshold).toBe(1);
+      expect(auth.signerCommitments).toEqual(['0xhot', '0xcold']);
+      expect(auth.procedureThresholds).toEqual({ update_guardian: 2 });
+    });
+
+    it('getAuthInfo degrades gracefully when the multisig lacks fields', () => {
+      const multisig = makeMultisig(); // no signerCommitments / procedureThresholds
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+      const auth = service.getAuthInfo();
+      expect(auth.signerCommitments).toEqual([]);
+      expect(auth.procedureThresholds).toEqual({});
+    });
+
+    it('getProcedureThreshold reads the procedure map', () => {
+      const multisig = makeMultisig({ procedureThresholds: new Map<string, number>([['update_guardian', 2]]) });
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+      expect(service.getProcedureThreshold('update_guardian')).toBe(2);
+      expect(service.getProcedureThreshold('nope')).toBeUndefined();
+    });
   });
 
   describe('proposal builders', () => {
diff --git a/src/lib/miden/guardian/index.ts b/src/lib/miden/guardian/index.ts
index 1df69b14d..f213a9e3b 100644
--- a/src/lib/miden/guardian/index.ts
+++ b/src/lib/miden/guardian/index.ts
@@ -168,6 +168,28 @@ export class MultisigService {
     return (this.multisig as any).procedureThresholds?.get(procedure);
   }
 
+  /**
+   * The account's loaded on-chain auth structure: overall threshold, signer
+   * commitments, and per-procedure thresholds. Used by the E2E harness to
+   * assert the 3-key shape (e.g. that `update_guardian` is hardened to 2 and
+   * the signer set is `[hot, cold]`) — properties the balance-only checks miss.
+   */
+  getAuthInfo(): { threshold: number; signerCommitments: string[]; procedureThresholds: Record<string, number> } {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const m = this.multisig as any;
+    const procedureThresholds: Record<string, number> = {};
+    if (m.procedureThresholds instanceof Map) {
+      for (const [proc, threshold] of m.procedureThresholds.entries()) {
+        procedureThresholds[String(proc)] = threshold as number;
+      }
+    }
+    return {
+      threshold: typeof m.threshold === 'number' ? m.threshold : NaN,
+      signerCommitments: Array.isArray(m.signerCommitments) ? m.signerCommitments.map(String) : [],
+      procedureThresholds
+    };
+  }
+
   /** Create a proposal that sets `procedure`'s signature threshold to `threshold`. */
   async createUpdateProcedureThresholdProposal(procedure: string, threshold: number): Promise<Proposal> {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
diff --git a/src/lib/store/index.ts b/src/lib/store/index.ts
index 870ce7955..294aa1b75 100644
--- a/src/lib/store/index.ts
+++ b/src/lib/store/index.ts
@@ -720,4 +720,26 @@ if (process.env.MIDEN_E2E_TEST === 'true') {
       console.error('[E2E] Failed to expose __TEST_HEX_TO_BECH32_FAUCET__:', e);
     }
   })();
+
+  // Guardian on-chain auth structure (overall threshold + signer set + procedure
+  // thresholds) for E2E assertions — the harness's balance checks can't see the
+  // 3-key shape. Reads the cached front-end MultisigService; dynamic imports
+  // avoid a static cycle (guardian-sync pulls in this store module).
+  (globalThis as any).__TEST_GUARDIAN_AUTH__ = async (accountPublicKey: string) => {
+    try {
+      const [{ getOrCreateMultisigService }, { zustandProvider }] = await Promise.all([
+        import('lib/miden/front/guardian-manager'),
+        import('lib/miden/front/guardian-sync')
+      ]);
+      const service = await getOrCreateMultisigService(accountPublicKey, zustandProvider);
+      try {
+        await service.sync(); // refresh on-chain state before reading
+      } catch {
+        // best-effort — fall back to last-synced state
+      }
+      return service.getAuthInfo();
+    } catch (e) {
+      return { error: e instanceof Error ? e.message : String(e) };
+    }
+  };
 }

From 10a6bc1e8ba29e06b21c4b6d3a35b17286939259 Mon Sep 17 00:00:00 2001
From: Wiktor Starczewski <poszerny@gmail.com>
Date: Thu, 25 Jun 2026 18:18:45 +0200
Subject: [PATCH 65/71] test(guardian): extend on-chain auth reader to mobile
 (iOS + Android) E2E harness

---
 .../android/helpers/android-wallet-page.ts    | 36 +++++++++++++++++-
 playwright/e2e/helpers/wallet-page.ts         | 16 +++++---
 playwright/e2e/ios/helpers/ios-wallet-page.ts | 38 ++++++++++++++++++-
 .../tests/guardian-send-consume.ios.spec.ts   | 15 ++++++++
 src/lib/store/index.ts                        |  8 +++-
 5 files changed, 104 insertions(+), 9 deletions(-)

diff --git a/playwright/e2e/android/helpers/android-wallet-page.ts b/playwright/e2e/android/helpers/android-wallet-page.ts
index 8298e83b9..66454eb02 100644
--- a/playwright/e2e/android/helpers/android-wallet-page.ts
+++ b/playwright/e2e/android/helpers/android-wallet-page.ts
@@ -1,5 +1,5 @@
 import type { TimelineRecorder } from '../../harness/timeline-recorder';
-import type { WalletPage } from '../../helpers/wallet-page';
+import type { GuardianAuthInfo, WalletPage } from '../../helpers/wallet-page';
 
 import type { CdpSession } from './cdp-bridge';
 import type { EmulatorControl } from './emulator-control';
@@ -409,6 +409,40 @@ export class AndroidWalletPage implements WalletPage {
     );
   }
 
+  /**
+   * Read a Guardian account's on-chain auth structure (overall threshold,
+   * signer commitments, per-procedure thresholds). Same contract and body as
+   * the iOS POM — the __TEST_GUARDIAN_AUTH__ hook is async (awaits
+   * getOrCreateMultisigService + a time-bounded sync), so it runs under the
+   * async CDP atom whose callback convention matches iOS
+   * (`arguments[arguments.length - 1]`).
+   */
+  async getGuardianAuthInfo(accountPublicKey: string): Promise<GuardianAuthInfo> {
+    return this.cdp.evalAsync<GuardianAuthInfo>(
+      `var cb = arguments[arguments.length - 1];
+       var fn = globalThis.__TEST_GUARDIAN_AUTH__;
+       if (typeof fn !== 'function') {
+         cb({
+           threshold: NaN,
+           signerCommitments: [],
+           procedureThresholds: {},
+           error: '__TEST_GUARDIAN_AUTH__ unavailable (needs MIDEN_E2E_TEST build)'
+         });
+         return;
+       }
+       Promise.resolve(fn(${JSON.stringify(accountPublicKey)}))
+         .then(function (r) { cb(r); })
+         .catch(function (e) {
+           cb({
+             threshold: NaN,
+             signerCommitments: [],
+             procedureThresholds: {},
+             error: String(e && e.message ? e.message : e)
+           });
+         });`
+    );
+  }
+
   private async triggerNavbarAction(timeoutMs: number): Promise<void> {
     const start = Date.now();
     while (Date.now() - start < timeoutMs) {
diff --git a/playwright/e2e/helpers/wallet-page.ts b/playwright/e2e/helpers/wallet-page.ts
index 885cc31be..4a2069307 100644
--- a/playwright/e2e/helpers/wallet-page.ts
+++ b/playwright/e2e/helpers/wallet-page.ts
@@ -48,6 +48,14 @@ export interface WalletPage {
    * the change takes effect on the next render — no reload needed.
    */
   setDelegateProofEnabled(enabled: boolean): Promise<void>;
+  /**
+   * On-chain auth structure of a Guardian account (overall threshold, signer
+   * commitments, per-procedure thresholds) — for asserting the 3-key shape
+   * (e.g. `update_guardian === 2`, two signers) which balance checks can't see.
+   * Shared across Chrome (page.evaluate) and iOS (CDP evalAsync) so the same
+   * assertion runs on both platforms.
+   */
+  getGuardianAuthInfo(accountPublicKey: string): Promise<GuardianAuthInfo>;
 }
 
 /**
@@ -76,12 +84,8 @@ export interface ChromeWalletPageApi extends WalletPage, IdbDumpSource {
   }>;
   /** Full dump of chrome.storage.local — end-of-run forensic snapshot. */
   dumpChromeStorage(): Promise<Record<string, unknown>>;
-  /**
-   * On-chain auth structure of a Guardian account (overall threshold, signer
-   * commitments, per-procedure thresholds) — for asserting the 3-key shape
-   * (e.g. `update_guardian === 2`, two signers) which balance checks can't see.
-   */
-  getGuardianAuthInfo(accountPublicKey: string): Promise<GuardianAuthInfo>;
+  // getGuardianAuthInfo is declared on the shared WalletPage interface (above)
+  // so the iOS POM implements it too — the 3-key auth assertion runs on both.
   // IndexedDB forensics (listIndexedDBStores / dumpIndexedDBStore) come from
   // IdbDumpSource — driven store-at-a-time by streamIndexedDBToFile so a long
   // run's dump can't OOM the page. This is where the Miden SDK keeps per-tx
diff --git a/playwright/e2e/ios/helpers/ios-wallet-page.ts b/playwright/e2e/ios/helpers/ios-wallet-page.ts
index 7a98037d6..c3de28376 100644
--- a/playwright/e2e/ios/helpers/ios-wallet-page.ts
+++ b/playwright/e2e/ios/helpers/ios-wallet-page.ts
@@ -1,5 +1,5 @@
 import type { TimelineRecorder } from '../../harness/timeline-recorder';
-import type { WalletPage } from '../../helpers/wallet-page';
+import type { GuardianAuthInfo, WalletPage } from '../../helpers/wallet-page';
 
 import type { CdpSession } from './cdp-bridge';
 import type { SimulatorControl } from './simulator-control';
@@ -593,6 +593,42 @@ export class IosWalletPage implements WalletPage {
     );
   }
 
+  /**
+   * Read a Guardian account's on-chain auth structure (overall threshold,
+   * signer commitments, per-procedure thresholds). Calls the same
+   * __TEST_GUARDIAN_AUTH__ hook the Chrome POM uses, but over the async CDP
+   * atom: the hook awaits getOrCreateMultisigService + a best-effort
+   * (time-bounded) sync, so it returns a Promise and must run under
+   * execute_async_script. The hook itself caps its internal sync at 8s, so the
+   * 30s evalAsync budget is comfortable even when the background sync holds the
+   * WASM lock.
+   */
+  async getGuardianAuthInfo(accountPublicKey: string): Promise<GuardianAuthInfo> {
+    return this.cdp.evalAsync<GuardianAuthInfo>(
+      `var cb = arguments[arguments.length - 1];
+       var fn = globalThis.__TEST_GUARDIAN_AUTH__;
+       if (typeof fn !== 'function') {
+         cb({
+           threshold: NaN,
+           signerCommitments: [],
+           procedureThresholds: {},
+           error: '__TEST_GUARDIAN_AUTH__ unavailable (needs MIDEN_E2E_TEST build)'
+         });
+         return;
+       }
+       Promise.resolve(fn(${JSON.stringify(accountPublicKey)}))
+         .then(function (r) { cb(r); })
+         .catch(function (e) {
+           cb({
+             threshold: NaN,
+             signerCommitments: [],
+             procedureThresholds: {},
+             error: String(e && e.message ? e.message : e)
+           });
+         });`
+    );
+  }
+
   /**
    * Fire the currently-registered native navbar action on mobile. The
    * wallet's native iOS overlay (MidenNavbarOverlayWindow) lives in a
diff --git a/playwright/e2e/ios/tests/guardian-send-consume.ios.spec.ts b/playwright/e2e/ios/tests/guardian-send-consume.ios.spec.ts
index ca7244eb2..96513c869 100644
--- a/playwright/e2e/ios/tests/guardian-send-consume.ios.spec.ts
+++ b/playwright/e2e/ios/tests/guardian-send-consume.ios.spec.ts
@@ -69,6 +69,21 @@ test.describe('Guardian account - consume + send', () => {
       }
     );
 
+    await steps.step('verify_guardian_auth_structure_a', async () => {
+      // First on-chain AUTH assertion in the iOS harness (mirrors the Chrome
+      // spec): a 3-key Guardian account must carry two signers ([hot, cold])
+      // and the `update_guardian` procedure hardened to threshold 2 — both set
+      // at creation. Runs after the consume has committed the account so the
+      // cached MultisigService read reflects the on-chain shape. The read goes
+      // through the async CDP atom (the hook awaits a time-bounded sync), which
+      // CDP can see — unlike the native navbar, which is why this is a WebView
+      // read rather than a UI check.
+      const auth = await walletA.getGuardianAuthInfo(addressA!);
+      expect(auth.error, `guardian auth read failed: ${auth.error}`).toBeUndefined();
+      expect(auth.signerCommitments.length, 'fresh 3-key account should have 2 signers (hot, cold)').toBe(2);
+      expect(auth.procedureThresholds.update_guardian, 'update_guardian must be hardened to threshold 2').toBe(2);
+    });
+
     await steps.step(
       'send_guardian_a_to_b',
       async () => {
diff --git a/src/lib/store/index.ts b/src/lib/store/index.ts
index 294aa1b75..d607df5bf 100644
--- a/src/lib/store/index.ts
+++ b/src/lib/store/index.ts
@@ -733,7 +733,13 @@ if (process.env.MIDEN_E2E_TEST === 'true') {
       ]);
       const service = await getOrCreateMultisigService(accountPublicKey, zustandProvider);
       try {
-        await service.sync(); // refresh on-chain state before reading
+        // Best-effort refresh of on-chain state before reading. service.sync()
+        // takes the global WASM lock; on mobile the background sync can hold it
+        // for tens of seconds, which would blow the 30s execute_async_script
+        // budget the iOS bridge runs this under. Cap the wait — the auth
+        // structure (signers + procedure thresholds) is immutable during this
+        // assertion, so a slightly stale local read is still correct.
+        await Promise.race([service.sync(), new Promise<void>(resolve => setTimeout(resolve, 8_000))]);
       } catch {
         // best-effort — fall back to last-synced state
       }

From a22dfc3db1af79dbd622513957167ac6ef9ac2cb Mon Sep 17 00:00:00 2001
From: Wiktor Starczewski <poszerny@gmail.com>
Date: Fri, 26 Jun 2026 14:55:01 +0200
Subject: [PATCH 66/71] =?UTF-8?q?fix(guardian):=20address=20review=20?=
 =?UTF-8?q?=E2=80=94=20legacy=20activation,=20hot-key=20cache,=20log=20hyg?=
 =?UTF-8?q?iene?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 __mocks__/lib/miden/back/vault.ts            |  4 +++
 src/lib/miden/activity/transactions.ts       |  7 +++--
 src/lib/miden/back/vault.test.ts             | 20 +++++++++++++
 src/lib/miden/back/vault.ts                  | 13 ++++----
 src/lib/miden/front/guardian-manager.test.ts | 10 +++++++
 src/lib/miden/front/guardian-manager.ts      | 19 +++++-------
 src/lib/miden/guardian/account.test.ts       | 20 +++++++++++++
 src/lib/miden/guardian/account.ts            | 13 ++++++--
 src/lib/miden/guardian/index.ts              | 31 ++++++++++----------
 9 files changed, 98 insertions(+), 39 deletions(-)

diff --git a/__mocks__/lib/miden/back/vault.ts b/__mocks__/lib/miden/back/vault.ts
index f00fe9888..ee4cc118d 100644
--- a/__mocks__/lib/miden/back/vault.ts
+++ b/__mocks__/lib/miden/back/vault.ts
@@ -43,6 +43,10 @@ export class Vault {
     return state.accounts;
   }
 
+  // Best-effort on-unlock migration of legacy single-key Guardian accounts to
+  // the 3-key model — a no-op in the mock (no real accounts/keys to migrate).
+  async migrateLegacyGuardianAccounts() {}
+
   async fetchSettings() {
     return state.settings;
   }
diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index 3893921e9..b7d47c062 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -1180,11 +1180,14 @@ const generateGuardianTransaction = async (
       walletAccount,
       guardianProvider.signWord
     );
-    await coldService.signProposal(proposalResult.id);
+    // Wait out a transient 409 ConflictPendingDelta on the cold co-sign too —
+    // otherwise a prior delta mid-canonicalization fails the whole switch even
+    // though the hot proposal already landed.
+    await withGuardianConflictRetry(() => coldService.signProposal(proposalResult.id));
   }
 
   const tr = await service.signAndCreateTransactionRequest(proposalResult.id, transaction.requestBytes);
-  console.log('Created transaction request from proposal, submitting to Miden client', tr.authArg()?.toHex());
+  console.log('Created transaction request from proposal, submitting to Miden client');
   const options: MidenClientCreateOptions = {
     signCallback: async (publicKey: Uint8Array, signingInputs: Uint8Array) => {
       console.log('Signing transaction request with external callback');
diff --git a/src/lib/miden/back/vault.test.ts b/src/lib/miden/back/vault.test.ts
index bc241d636..5c05b1d23 100644
--- a/src/lib/miden/back/vault.test.ts
+++ b/src/lib/miden/back/vault.test.ts
@@ -1465,6 +1465,26 @@ describe('Vault.migrateLegacyGuardianAccounts', () => {
     expect(threeKey.requiresHotKeyRotation).toBeUndefined();
   });
 
+  it('skips imported Guardian accounts (hdIndex < 0) — they cannot be re-derived', async () => {
+    // Imported Guardian accounts are tagged hdIndex = -1; deriving a cold key
+    // from the mnemonic at a negative index would be wrong, so they're excluded.
+    const importedGuardian = {
+      publicKey: 'guardian-imported',
+      name: 'Guardian Imported',
+      isPublic: true,
+      type: WalletType.Guardian,
+      hdIndex: -1
+    };
+    const vault = await seedVault('pw', { accounts: [importedGuardian] as any });
+    sdk.AuthSecretKey.ecdsaWithRNG.mockClear();
+    await vault.migrateLegacyGuardianAccounts();
+
+    expect(sdk.AuthSecretKey.ecdsaWithRNG).not.toHaveBeenCalled();
+    const imported = (await vault.fetchAccounts()).find(a => a.publicKey === 'guardian-imported')!;
+    expect(imported.coldPublicKey).toBeUndefined();
+    expect(imported.requiresHotKeyRotation).toBeUndefined();
+  });
+
   it('is idempotent — a second run derives nothing', async () => {
     const vault = await seedVault('pw', { accounts: [legacyGuardian] as any });
     await vault.migrateLegacyGuardianAccounts();
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index 019c51dcd..7e8f869f3 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -132,7 +132,6 @@ const ownMnemonicStrgKey = createStorageKey(StorageEntity.OwnMnemonic);
 const insertKeyCallbackWrapper = (passKey: CryptoKey) => {
   return async (key: Uint8Array, secretKey: Uint8Array) => {
     const pubKeyHex = Buffer.from(key).toString('hex');
-    console.log('Inserting key with pubKeyHex', pubKeyHex);
     const secretKeyHex = Buffer.from(secretKey).toString('hex');
     await encryptAndSaveMany(
       [
@@ -916,9 +915,12 @@ export class Vault {
     try {
       const allAccounts = await this.fetchAccounts();
       // Legacy = a Guardian record with neither the cold key nor the
-      // pending-rotation flag, i.e. created before the 3-key model.
+      // pending-rotation flag, i.e. created before the 3-key model. Require a
+      // real HD index: imported Guardian accounts are tagged hdIndex = -1, and
+      // deriveClientSeed(..., -1) would derive the wrong cold key (or throw), so
+      // they can't be migrated by re-deriving from the mnemonic.
       const legacy = allAccounts.filter(
-        acc => acc.type === WalletType.Guardian && !acc.coldPublicKey && !acc.requiresHotKeyRotation
+        acc => acc.type === WalletType.Guardian && !acc.coldPublicKey && !acc.requiresHotKeyRotation && acc.hdIndex >= 0
       );
       if (legacy.length === 0) return;
 
@@ -994,7 +996,6 @@ export class Vault {
   }
 
   async signTransaction(publicKey: string, signingInputs: string): Promise<string> {
-    console.log('signTransaction: publicKey', publicKey);
     const secretKey = await fetchAndDecryptOneWithLegacyFallBack<string>(
       accAuthSecretKeyStrgKey(publicKey),
       this.vaultKey
@@ -1026,10 +1027,6 @@ export class Vault {
       );
       const wasmSecretKey = AuthSecretKey.deserialize(new Uint8Array(Buffer.from(coldHex, 'hex')));
       const signature = wasmSecretKey.sign(Word.fromHex(wordHex));
-      console.log(
-        'Cold signature generated, signature.serialize() =',
-        Buffer.from(signature.serialize()).toString('hex')
-      );
       return `0x${Buffer.from(signature.serialize().slice(1)).toString('hex')}`;
     }
 
diff --git a/src/lib/miden/front/guardian-manager.test.ts b/src/lib/miden/front/guardian-manager.test.ts
index 3da07fef8..2de925dd9 100644
--- a/src/lib/miden/front/guardian-manager.test.ts
+++ b/src/lib/miden/front/guardian-manager.test.ts
@@ -164,6 +164,16 @@ describe('guardian-manager', () => {
       await expect(getOrCreateMultisigService(OTHER_PK, provider)).rejects.toThrow('Account is not a Guardian account');
     });
 
+    it('throws loudly when a Guardian account is missing its hot pubkey', async () => {
+      // A Guardian record without hotPublicKey is a pre-migration/half-written
+      // state — fail rather than silently bind to a missing signer.
+      const { hotPublicKey, ...noHotKey } = guardianAccount;
+      void hotPublicKey;
+      const provider = makeProvider([noHotKey]);
+
+      await expect(getOrCreateMultisigService(GUARDIAN_PK, provider)).rejects.toThrow('missing hotPublicKey');
+    });
+
     it('throws when the public key is unknown to the provider', async () => {
       const provider = makeProvider([guardianAccount]);
 
diff --git a/src/lib/miden/front/guardian-manager.ts b/src/lib/miden/front/guardian-manager.ts
index 0bd1f3ffc..3d6a11dbe 100644
--- a/src/lib/miden/front/guardian-manager.ts
+++ b/src/lib/miden/front/guardian-manager.ts
@@ -49,17 +49,14 @@ export async function getOrCreateMultisigService(
   accountPublicKey: string,
   provider: GuardianAccountProvider
 ): Promise<MultisigService> {
-  // Return cached instance if its endpoint still matches storage. In the
-  // extension build, `clearGuardianServiceFor` from the SW realm doesn't reach
-  // the frontend's own copy of this Map, so a guardian switch would leave
-  // the popup syncing against the old guardian indefinitely. Re-check
-  // GUARDIAN_URL_STORAGE_KEY here and evict on drift.
-  const cached = guardianServiceCache.get(accountPublicKey);
-  if (cached) {
-    const currentEndpoint = (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
-    if (cached.service.guardianEndpoint === currentEndpoint) return cached.service;
-    guardianServiceCache.delete(accountPublicKey);
-  }
+  // NOTE: no endpoint-only fast-path here. The cache hit is served by the inner
+  // check below (after we resolve the account's current hotPublicKey), which
+  // compares BOTH the guardian endpoint AND the bound hot pubkey. An outer
+  // endpoint-only check returned the stale service after a replace_hot_key
+  // rotation (which doesn't touch the endpoint), so the popup kept signing with
+  // the rotated-out hot key — `clearGuardianServiceFor` runs in the SW realm and
+  // never evicts the popup's Map. getAccounts() is an in-memory store read, so
+  // routing cache hits through init is cheap.
   // Coalesce concurrent inits: the guardian sync runs every 3s and does not
   // await previous ticks, so without this an in-flight init can start again
   // before its resolved service reaches the cache.
diff --git a/src/lib/miden/guardian/account.test.ts b/src/lib/miden/guardian/account.test.ts
index b4b01a810..06e016df8 100644
--- a/src/lib/miden/guardian/account.test.ts
+++ b/src/lib/miden/guardian/account.test.ts
@@ -108,6 +108,26 @@ describe('getSignerDetailsFromAccount', () => {
     expect(result).toEqual({ commitment: 'commit-first' });
   });
 
+  it('reads the cold signer commitment from index 1 on a 3-key account', async () => {
+    const account = makeAccount([{ value: '0xcommit-hot' }, { value: '0xcommit-cold' }]);
+
+    const result = await getSignerDetailsFromAccount(account as never, true);
+
+    expect(result).toEqual({ commitment: 'commit-cold' });
+  });
+
+  it('reads the cold signer commitment from index 0 on a legacy single-signer account', async () => {
+    // Legacy Guardian accounts (feature #153) have a single on-chain signer —
+    // the cold/HD key — at index 0. The cold lookup must fall back to it rather
+    // than reading a non-existent index 1 (which would brick activation of a
+    // migrated account).
+    const account = makeAccount([{ value: '0xcommit-legacy-cold' }]);
+
+    const result = await getSignerDetailsFromAccount(account as never, true);
+
+    expect(result).toEqual({ commitment: 'commit-legacy-cold' });
+  });
+
   it('throws when the signer-public-keys slot is missing', async () => {
     const account = makeAccount(undefined);
 
diff --git a/src/lib/miden/guardian/account.ts b/src/lib/miden/guardian/account.ts
index a723e6257..91cb930ae 100644
--- a/src/lib/miden/guardian/account.ts
+++ b/src/lib/miden/guardian/account.ts
@@ -47,7 +47,13 @@ export async function getSignerDetailsFromAccount(account: Account, getCold = fa
     throw new Error('No signer public keys found in account storage');
   }
 
-  const index = getCold ? 1 : 0;
+  // New 3-key accounts store [hot, cold] (hot at index 0, cold at index 1).
+  // Legacy single-key Guardian accounts (feature #153) have only one on-chain
+  // signer — the cold/HD key — at index 0. So when reading the cold commitment,
+  // fall back to index 0 if there's a single signer; otherwise activating a
+  // migrated legacy account would read a non-existent index 1 and throw,
+  // bricking the account (it can neither activate nor cold-sign).
+  const index = getCold ? (mapEntries.length <= 1 ? 0 : 1) : 0;
 
   if (!mapEntries[index]) {
     throw new Error('No signer commitments found in account storage');
@@ -159,8 +165,9 @@ export async function createGuardianAccount(
       }
     };
   } catch (e) {
-    console.log(e);
     console.error('Error creating Guardian account:', e);
-    throw new Error('Failed to create Guardian account');
+    // Preserve the original cause so callers can distinguish guardian-unreachable
+    // from node/registration/WASM failures.
+    throw new Error('Failed to create Guardian account', { cause: e });
   }
 }
diff --git a/src/lib/miden/guardian/index.ts b/src/lib/miden/guardian/index.ts
index f213a9e3b..765d8068e 100644
--- a/src/lib/miden/guardian/index.ts
+++ b/src/lib/miden/guardian/index.ts
@@ -332,25 +332,26 @@ export class MultisigService {
     const targetSignerCommitments = [ensure0x(newHot.commitmentHex), ensure0x(coldCommitRaw)];
     const targetThreshold = this.multisig.threshold;
 
-    const webClient = (await getMidenClient()).client;
-    const { request, salt } = await withWasmClientLock(async () =>
-      buildUpdateSignersTransactionRequest(webClient, targetThreshold, targetSignerCommitments, {
-        signatureScheme: 'ecdsa'
-      })
-    );
-    const summary = await withWasmClientLock(async () => executeForSummary(webClient, this.accountId, request));
-    const summaryBase64 = u8ToB64(summary.serialize());
-    console.log(
-      'Executed transaction for summary',
-      summaryBase64,
-      'with target signer commitments',
-      targetSignerCommitments
-    );
+    // Keep getMidenClient() and both WASM ops inside a single lock scope — the
+    // WASM client is single-threaded, so resolving the client outside the lock
+    // (or splitting the build/execute into two lock windows) leaves a gap where
+    // another holder can run and trigger "recursive use ... unsafe aliasing".
+    const { summaryBase64, saltHex } = await withWasmClientLock(async () => {
+      const webClient = (await getMidenClient()).client;
+      const { request, salt } = await buildUpdateSignersTransactionRequest(
+        webClient,
+        targetThreshold,
+        targetSignerCommitments,
+        { signatureScheme: 'ecdsa' }
+      );
+      const summary = await executeForSummary(webClient, this.accountId, request);
+      return { summaryBase64: u8ToB64(summary.serialize()), saltHex: salt.toHex() };
+    });
     const metadata: ProposalMetadata = {
       proposalType: 'add_signer',
       targetThreshold,
       targetSignerCommitments,
-      saltHex: salt.toHex(),
+      saltHex,
       requiredSignatures: this.multisig.getEffectiveThreshold('add_signer'),
       description: 'Replace device (hot) signer'
     };

From 03d86ee6900114f27b7e08e4bd9135c2a2929215 Mon Sep 17 00:00:00 2001
From: Wiktor Starczewski <poszerny@gmail.com>
Date: Fri, 26 Jun 2026 15:36:01 +0200
Subject: [PATCH 67/71] test(guardian): cover proposal builders +
 procedure-threshold guard to clear coverage gate

---
 src/lib/miden/activity/transactions.test.ts | 17 +++++++++++
 src/lib/miden/guardian/index.test.ts        | 34 +++++++++++++++++++++
 2 files changed, 51 insertions(+)

diff --git a/src/lib/miden/activity/transactions.test.ts b/src/lib/miden/activity/transactions.test.ts
index d559278c5..bc0890198 100644
--- a/src/lib/miden/activity/transactions.test.ts
+++ b/src/lib/miden/activity/transactions.test.ts
@@ -14,6 +14,7 @@ import {
   initiateSendTransaction,
   initiateConsumeTransaction,
   initiateConsumeTransactionFromId,
+  initiateUpdateProcedureThresholdTransaction,
   cancelStuckTransactions,
   cancelStaleQueuedTransactions,
   generateTransaction,
@@ -609,6 +610,22 @@ describe('transactions utilities', () => {
     });
   });
 
+  describe('initiateUpdateProcedureThresholdTransaction', () => {
+    it('rejects when the account is not a Guardian account', async () => {
+      // Empty getAccounts() → isGuardianAccount short-circuits to false, so the
+      // procedure-threshold hardening tx is rejected up front.
+      const guardianProvider = {
+        getAccounts: async () => [],
+        getPublicKeyForCommitment: async () => '',
+        signWord: async () => ''
+      } as never;
+
+      await expect(
+        initiateUpdateProcedureThresholdTransaction('acc-x', 'update_guardian', 2, false, guardianProvider)
+      ).rejects.toThrow('only supported for Guardian accounts');
+    });
+  });
+
   describe('cancelStuckTransactions', () => {
     it('cancels transactions that exceed MAX_WAIT_BEFORE_CANCEL', async () => {
       const nowInSeconds = Math.floor(Date.now() / 1000);
diff --git a/src/lib/miden/guardian/index.test.ts b/src/lib/miden/guardian/index.test.ts
index 83eb6c5f5..3bd9df19f 100644
--- a/src/lib/miden/guardian/index.test.ts
+++ b/src/lib/miden/guardian/index.test.ts
@@ -227,6 +227,29 @@ describe('MultisigService', () => {
       expect(multisig.createConsumeNotesProposal).toHaveBeenCalledWith(['n1', 'n2']);
       expect(proposal).toEqual({ kind: 'consume' });
     });
+
+    it('createUpdateProcedureThresholdProposal forwards the procedure and threshold', async () => {
+      const createUpdateFn = jest.fn(async () => ({ kind: 'update-threshold' }));
+      const multisig = makeMultisig({ createUpdateProcedureThresholdProposal: createUpdateFn });
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+
+      const proposal = await service.createUpdateProcedureThresholdProposal('update_guardian', 2);
+
+      expect(createUpdateFn).toHaveBeenCalledWith('update_guardian', 2);
+      expect(proposal).toEqual({ kind: 'update-threshold' });
+    });
+
+    it('createCustomProposal forwards request bytes and proposal type', async () => {
+      const createCustomFn = jest.fn(async () => ({ kind: 'custom' }));
+      const multisig = makeMultisig({ createCustomProposal: createCustomFn });
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+      const bytes = new Uint8Array([1, 2, 3]);
+
+      const proposal = await service.createCustomProposal(bytes, 'my-type');
+
+      expect(createCustomFn).toHaveBeenCalledWith(bytes, 'my-type');
+      expect(proposal).toEqual({ kind: 'custom' });
+    });
   });
 
   describe('signing helpers', () => {
@@ -254,6 +277,17 @@ describe('MultisigService', () => {
       expect(tx).toBe('tx-req');
     });
 
+    it('signAndCreateTransactionRequest rejects a custom proposal with no request bytes', async () => {
+      const multisig = makeMultisig({
+        signProposal: jest.fn(async () => ({ metadata: { proposalType: 'custom' } }))
+      });
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+
+      await expect(service.signAndCreateTransactionRequest('p-custom')).rejects.toThrow(
+        'Request Bytes are required for custom execution'
+      );
+    });
+
     it('getConsumableNotes forwards to the wrapped Multisig', async () => {
       const multisig = makeMultisig();
       const service = new MultisigService(multisig as never, {} as never, 'https://x');

From 5229214d9aae8bbfea52dc38af0ecf546a57fbe2 Mon Sep 17 00:00:00 2001
From: Wiktor Starczewski <poszerny@gmail.com>
Date: Fri, 26 Jun 2026 16:55:35 +0200
Subject: [PATCH 68/71] =?UTF-8?q?fix(guardian):=20second-review=20fixes=20?=
 =?UTF-8?q?=E2=80=94=20signer-by-key=20routing,=20rotation=20safety,=20nat?=
 =?UTF-8?q?ive=20hardening?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../java/com/miden/wallet/HotKeyPlugin.kt     | 20 +++++
 ios/App/App/HotKeyPlugin.swift                | 21 ++++-
 jest.config.ts                                | 18 ++--
 src/lib/miden/activity/transactions.ts        | 21 ++++-
 src/lib/miden/back/actions.ts                 |  6 ++
 src/lib/miden/back/vault.ts                   | 17 ++--
 src/lib/miden/front/guardian-sync.test.ts     | 18 ++++
 src/lib/miden/front/guardian-sync.ts          | 13 +++
 src/lib/miden/guardian/account.test.ts        | 84 ++++++++++++-------
 src/lib/miden/guardian/account.ts             | 58 +++++++------
 src/lib/miden/sdk/miden-client-interface.ts   | 17 +++-
 11 files changed, 221 insertions(+), 72 deletions(-)

diff --git a/android/app/src/main/java/com/miden/wallet/HotKeyPlugin.kt b/android/app/src/main/java/com/miden/wallet/HotKeyPlugin.kt
index fede2f685..627c6f1c4 100644
--- a/android/app/src/main/java/com/miden/wallet/HotKeyPlugin.kt
+++ b/android/app/src/main/java/com/miden/wallet/HotKeyPlugin.kt
@@ -128,6 +128,14 @@ class HotKeyPlugin : Plugin() {
     fun signWithHotKey(call: PluginCall) {
         Log.d(TAG, "signWithHotKey called")
 
+        // The BiometricPrompt callback reads instance fields (pendingCall/
+        // pendingPayload/pendingDigest); a second concurrent call would clobber
+        // them, crossing signatures and responses. Reject while one is in flight.
+        if (pendingCall != null) {
+            call.reject("Another hot-key operation is in progress", "BIOMETRIC_BUSY")
+            return
+        }
+
         val ciphertext = call.getString("ciphertext")
         val digestHex = call.getString("digestHex")
         if (ciphertext == null || digestHex == null) {
@@ -184,6 +192,13 @@ class HotKeyPlugin : Plugin() {
     fun revealHotKey(call: PluginCall) {
         Log.d(TAG, "revealHotKey called")
 
+        // See signWithHotKey: reject while a biometric op is already in flight so
+        // the shared pending* fields aren't clobbered.
+        if (pendingCall != null) {
+            call.reject("Another hot-key operation is in progress", "BIOMETRIC_BUSY")
+            return
+        }
+
         val ciphertext = call.getString("ciphertext")
         if (ciphertext == null) {
             call.reject("Missing 'ciphertext' parameter")
@@ -392,6 +407,11 @@ class HotKeyPlugin : Plugin() {
                 KeyProperties.AUTH_BIOMETRIC_STRONG or KeyProperties.AUTH_DEVICE_CREDENTIAL
             )
         } else {
+            // Pre-Android-11: every-use auth, but BIOMETRIC_STRONG cannot be
+            // enforced here — on API 23–29 a non-FIDO-certified (BIOMETRIC_WEAK)
+            // fingerprint sensor can satisfy the guard. Key strength is therefore
+            // hardware-dependent on these older devices (StrongBox below still
+            // applies when present). `-1` = authentication required on every use.
             @Suppress("DEPRECATION")
             builder.setUserAuthenticationValidityDurationSeconds(-1)
         }
diff --git a/ios/App/App/HotKeyPlugin.swift b/ios/App/App/HotKeyPlugin.swift
index 7e243a97b..f34cb03a9 100644
--- a/ios/App/App/HotKeyPlugin.swift
+++ b/ios/App/App/HotKeyPlugin.swift
@@ -84,6 +84,14 @@ public class HotKeyPlugin: CAPPlugin, CAPBridgedPlugin {
         // 4. Create the SE-backed P-256 key. .privateKeyUsage triggers Face ID
         //    only when the private key is used (i.e. SecKeyCreateDecryptedData
         //    in signWithHotKey), not at create time.
+        //    THREAT MODEL: we intentionally do NOT add `.biometryCurrentSet`.
+        //    That flag would invalidate the SE key whenever the biometric
+        //    enrollment changes (a face/finger added or re-enrolled), forcing the
+        //    user to re-activate the hot key. We accept "any enrolled biometric
+        //    can sign" in exchange for not bricking the hot key on an enrollment
+        //    change; the key never leaves the Secure Enclave either way. Switch
+        //    to `.biometryCurrentSet` (with a re-activation migration) if a
+        //    stricter "enrollment change = re-activate" posture is required.
         var accessError: Unmanaged<CFError>?
         guard let accessControl = SecAccessControlCreateWithFlags(
             kCFAllocatorDefault,
@@ -221,7 +229,12 @@ public class HotKeyPlugin: CAPPlugin, CAPBridgedPlugin {
             }
             return
         }
-        let sePrivateKey = foundKey as! SecKey
+        // Conditional cast: a corrupted/foreign Keychain item at this tag would
+        // crash the app process on a force-cast.
+        guard let sePrivateKey = foundKey as? SecKey else {
+            call.reject("Hot-key Keychain item is not a SecKey")
+            return
+        }
 
         // 4. SecKeyCreateDecryptedData triggers Face ID via .privateKeyUsage
         //    on the SE key.
@@ -322,7 +335,11 @@ public class HotKeyPlugin: CAPPlugin, CAPBridgedPlugin {
             }
             return
         }
-        let sePrivateKey = foundKey as! SecKey
+        // Conditional cast: avoid crashing on a corrupted/foreign Keychain item.
+        guard let sePrivateKey = foundKey as? SecKey else {
+            call.reject("Hot-key Keychain item is not a SecKey")
+            return
+        }
 
         var decError: Unmanaged<CFError>?
         guard var unwrapped = SecKeyCreateDecryptedData(
diff --git a/jest.config.ts b/jest.config.ts
index 33503fc0f..94c4c56bb 100644
--- a/jest.config.ts
+++ b/jest.config.ts
@@ -65,12 +65,20 @@ export default {
   transform: {
     '.+\\.(ts|tsx|js|mjs)$': '@swc/jest'
   },
-  transformIgnorePatterns: [
-    '/node_modules/(?!(p-queue|p-timeout|eventemitter3|date-fns|dexie)/)'
-  ],
+  transformIgnorePatterns: ['/node_modules/(?!(p-queue|p-timeout|eventemitter3|date-fns|dexie)/)'],
   moduleFileExtensions: ['ts', 'tsx', 'js'],
-  modulePathIgnorePatterns: ['<rootDir>/sdk-debug/'],
-  testPathIgnorePatterns: ['<rootDir>/playwright/', '<rootDir>/mobile-e2e/', '<rootDir>/ios/App/build/'],
+  // Exclude git worktrees: they hold full copies of the repo, so without this a
+  // plain `jest` run discovers their stale test files and emits haste-map
+  // duplicate-mock collisions (spurious local failures). CI checks out clean, so
+  // this only matters for local runs.
+  modulePathIgnorePatterns: ['<rootDir>/sdk-debug/', '<rootDir>/.worktrees/', '<rootDir>/.claude/'],
+  testPathIgnorePatterns: [
+    '<rootDir>/playwright/',
+    '<rootDir>/mobile-e2e/',
+    '<rootDir>/ios/App/build/',
+    '<rootDir>/.worktrees/',
+    '<rootDir>/.claude/'
+  ],
   setupFiles: ['dotenv/config', '@serh11p/jest-webextension-mock', 'fake-indexeddb/auto'],
   setupFilesAfterEnv: ['./jest.setup.js']
 };
diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index b7d47c062..83c6c9028 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -484,8 +484,13 @@ const GUARDIAN_PROCEDURE_HARDENING = { procedure: 'update_guardian', threshold:
  * that fresh 3-key accounts have. Migrated legacy accounts lack it; recovered /
  * fresh accounts already have it (so this no-ops). Enqueues a cold-signed
  * `update_procedure_threshold` when missing. Best-effort — never throws.
+ *
+ * Idempotent (gated on the on-chain threshold already being 2), so besides the
+ * post-rotation call it's also invoked self-healingly from the guardian sync —
+ * closing the window where a migrated account is 3-key but `update_guardian` is
+ * still threshold-1 because the original hardening tx was dropped.
  */
-const ensureGuardianProcedureThresholds = async (
+export const ensureGuardianProcedureThresholds = async (
   accountId: string,
   delegateTransaction: boolean | undefined,
   guardianProvider: GuardianAccountProvider
@@ -1121,6 +1126,13 @@ const generateGuardianTransaction = async (
       // until the on-chain rotation lands so this is idempotent. If the app
       // dies between submit and complete, the new ciphertext is on disk and
       // complete reconciles against the on-chain state.
+      // KNOWN LEAK: if this rotation terminally fails (submit error → tx
+      // cancelled, never reconciled) and the user re-initiates, a fresh hardware
+      // key is minted while this one's SE/Keystore entry + ciphertext blob are
+      // left orphaned (inert). A blind delete-on-failure here is unsafe — the
+      // persist-before-submit design relies on this blob surviving for the
+      // reconcile path — so reaping orphaned pending keys belongs in a dedicated
+      // cleanup, not this hot path.
       await guardianProvider.persistNewHotKey(newHot.publicKeyHex, newHot.ciphertext);
       // Stash the new pubkey on the in-memory transaction AND in dexie so
       // complete (which may run after a process restart) can find it.
@@ -1144,7 +1156,12 @@ const generateGuardianTransaction = async (
     }
     case 'execute':
     default: {
-      // For custom transactions, build a custom proposal from the serialized request bytes.
+      // For custom transactions, build a custom proposal from the serialized
+      // request bytes. Hot-routed (threshold-1). A custom proposal that embeds a
+      // structural op (e.g. update_guardian / add_signer) cannot bypass the
+      // hardening: the on-chain `procedureThresholds` map enforces per-procedure
+      // thresholds (update_guardian = 2 → needs cold + guardian) during proof
+      // verification regardless of which key signed the proposal here.
       const requestBytes = transaction.requestBytes;
       if (!requestBytes) {
         throw new Error('Request Bytes not available for custom transaction');
diff --git a/src/lib/miden/back/actions.ts b/src/lib/miden/back/actions.ts
index b81469c7d..41174bc51 100644
--- a/src/lib/miden/back/actions.ts
+++ b/src/lib/miden/back/actions.ts
@@ -253,6 +253,12 @@ export function revealGuardianKeys(accountPublicKey: string, password?: string)
 
 export function revealPublicKey(_accPublicKey: string) {}
 
+// NOTE: account removal is not implemented (no-op since the aleo port). The
+// "Remove Account" UI therefore currently does nothing. When this is wired up,
+// it MUST, for Guardian accounts, release the hardware-backed hot key via
+// `secureHotKey.deleteHotKey(<hot ciphertext>)` and remove the cold-key blob
+// (`accColdSecretKeyStrgKey`) in addition to the account record/keys — otherwise
+// the SE/Keystore entry and cold key material outlive the deleted account.
 export function removeAccount(_accPublicKey: string, _password: string) {}
 
 export function editAccount(accPublicKey: string, name: string) {
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index 7e8f869f3..747b9877e 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -870,6 +870,18 @@ export class Vault {
       }
 
       const oldHotPubKey = account.hotPublicKey;
+
+      // Update the account pointer FIRST, so the new hot key is durable before we
+      // release the old one. The inverse order has a lockout window: if removing
+      // the old blobs succeeded but this write then threw, `hotPublicKey` would
+      // point at a deleted key and the account could never sign again.
+      const newAllAccounts = allAccounts.map(acc =>
+        acc.publicKey === accountPublicKey ? { ...acc, hotPublicKey: newHotPubKey, requiresHotKeyRotation: false } : acc
+      );
+      await encryptAndSaveMany([[accountsStrgKey, newAllAccounts]], this.vaultKey);
+
+      // Now best-effort release the old hot key. A crash here only orphans the
+      // old blobs (inert) — never a broken pointer.
       if (oldHotPubKey && oldHotPubKey !== newHotPubKey) {
         try {
           const oldCiphertext = await fetchAndDecryptOneWithLegacyFallBack<string>(
@@ -883,11 +895,6 @@ export class Vault {
         await removeMany([accAuthPubKeyStrgKey(oldHotPubKey), accAuthSecretKeyStrgKey(oldHotPubKey)]);
       }
 
-      const newAllAccounts = allAccounts.map(acc =>
-        acc.publicKey === accountPublicKey ? { ...acc, hotPublicKey: newHotPubKey, requiresHotKeyRotation: false } : acc
-      );
-      await encryptAndSaveMany([[accountsStrgKey, newAllAccounts]], this.vaultKey);
-
       const currentAccount = await this.getCurrentAccount();
       return { accounts: newAllAccounts, currentAccount };
     });
diff --git a/src/lib/miden/front/guardian-sync.test.ts b/src/lib/miden/front/guardian-sync.test.ts
index f8d20f0c4..1278f947e 100644
--- a/src/lib/miden/front/guardian-sync.test.ts
+++ b/src/lib/miden/front/guardian-sync.test.ts
@@ -34,6 +34,13 @@ jest.mock('./guardian-manager', () => ({
   getOrCreateMultisigService: (...args: unknown[]) => mockGetOrCreateMultisigService(...args)
 }));
 
+// The self-heal hook dynamic-imports this; stub it so the sync test stays focused
+// on sync behavior (the hardening itself is covered in the transactions suite).
+const mockEnsureGuardianProcedureThresholds = jest.fn();
+jest.mock('lib/miden/activity/transactions', () => ({
+  ensureGuardianProcedureThresholds: (...args: unknown[]) => mockEnsureGuardianProcedureThresholds(...args)
+}));
+
 describe('zustandProvider', () => {
   beforeEach(() => {
     jest.clearAllMocks();
@@ -105,6 +112,17 @@ describe('syncGuardianAccounts', () => {
     expect(sync).toHaveBeenCalledTimes(2);
   });
 
+  it('self-heals the update_guardian hardening once per account per session', async () => {
+    storeState.accounts = [{ publicKey: 'guardian-heal', type: WalletType.Guardian }];
+    mockGetOrCreateMultisigService.mockResolvedValue({ sync: jest.fn(async () => {}) });
+
+    await syncGuardianAccounts();
+    await syncGuardianAccounts(); // second pass — the session guard suppresses a re-check
+
+    expect(mockEnsureGuardianProcedureThresholds).toHaveBeenCalledTimes(1);
+    expect(mockEnsureGuardianProcedureThresholds).toHaveBeenCalledWith('guardian-heal', undefined, zustandProvider);
+  });
+
   it('continues syncing remaining accounts when one throws', async () => {
     storeState.accounts = [
       { publicKey: 'guardian-bad', type: WalletType.Guardian },
diff --git a/src/lib/miden/front/guardian-sync.ts b/src/lib/miden/front/guardian-sync.ts
index adf81312e..77d8bf2bd 100644
--- a/src/lib/miden/front/guardian-sync.ts
+++ b/src/lib/miden/front/guardian-sync.ts
@@ -29,6 +29,10 @@ export const zustandProvider: GuardianAccountProvider = {
  * banner is the user's path to flip that flag; once swapped, the next sync
  * cycle picks the account up normally.
  */
+// Accounts whose update_guardian hardening we've already verified this session,
+// so the self-heal check below runs at most once per account per session.
+const hardeningChecked = new Set<string>();
+
 export async function syncGuardianAccounts(): Promise<void> {
   const accounts = await zustandProvider.getAccounts();
   const guardianAccounts = accounts.filter(acc => acc.type === WalletType.Guardian && !acc.requiresHotKeyRotation);
@@ -39,6 +43,15 @@ export async function syncGuardianAccounts(): Promise<void> {
     try {
       const service = await getOrCreateMultisigService(account.publicKey, zustandProvider);
       await service.sync();
+
+      // Self-heal the update_guardian threshold-2 hardening: if a migrated
+      // account's original hardening tx was dropped, it would otherwise sit at
+      // threshold-1 indefinitely. Idempotent + best-effort; once per session.
+      if (!hardeningChecked.has(account.publicKey)) {
+        hardeningChecked.add(account.publicKey);
+        const { ensureGuardianProcedureThresholds } = await import('lib/miden/activity/transactions');
+        await ensureGuardianProcedureThresholds(account.publicKey, undefined, zustandProvider);
+      }
     } catch (error) {
       console.error(`[Guardian Sync] Error syncing Guardian account ${account.publicKey}:`, error);
     }
diff --git a/src/lib/miden/guardian/account.test.ts b/src/lib/miden/guardian/account.test.ts
index 06e016df8..1f89f7072 100644
--- a/src/lib/miden/guardian/account.test.ts
+++ b/src/lib/miden/guardian/account.test.ts
@@ -49,6 +49,14 @@ jest.mock('@miden-sdk/miden-sdk/lazy', () => {
     ...actual,
     AuthSecretKey: {
       ecdsaWithRNG: jest.fn((seed: Uint8Array) => buildStubKey(`s${Array.from(seed).join('-')}`))
+    },
+    // getSignerDetailsFromAccount builds `new Word(new BigUint64Array([i,0,0,0]))`
+    // as the signer map key; expose the index so the getMapItem mock can resolve it.
+    Word: class {
+      idx: number;
+      constructor(arr: BigUint64Array) {
+        this.idx = Number(arr?.[0] ?? 0n);
+      }
     }
   };
 });
@@ -58,6 +66,14 @@ jest.mock('@miden-sdk/miden-sdk', () => {
     ...actual,
     AuthSecretKey: {
       ecdsaWithRNG: jest.fn((seed: Uint8Array) => buildStubKey(`s${Array.from(seed).join('-')}`))
+    },
+    // getSignerDetailsFromAccount builds `new Word(new BigUint64Array([i,0,0,0]))`
+    // as the signer map key; expose the index so the getMapItem mock can resolve it.
+    Word: class {
+      idx: number;
+      constructor(arr: BigUint64Array) {
+        this.idx = Number(arr?.[0] ?? 0n);
+      }
     }
   };
 });
@@ -96,62 +112,70 @@ describe('getSignerDetailsFromAccount', () => {
     jest.clearAllMocks();
   });
 
-  const makeAccount = (entries: unknown) => ({
-    storage: () => ({ getMapEntries: jest.fn(() => entries) })
+  // Mock account whose storage().getMapItem resolves a signer commitment by the
+  // index encoded in the key word (the Word mock above sets `{ idx }`). This
+  // mirrors the real by-key read; positional order is irrelevant.
+  const makeAccount = (signersByIndex: Record<number, string>) => ({
+    storage: () => ({
+      getMapItem: jest.fn((_slot: string, key: { idx: number }) => {
+        const hex = signersByIndex[key.idx];
+        return hex === undefined ? undefined : { toHex: () => hex };
+      })
+    })
   });
 
-  it("reads the first signer commitment from storage (the hot signer's slot)", async () => {
-    const account = makeAccount([{ value: '0xcommit-first' }, { value: '0xcommit-second' }]);
+  it('reads the hot signer commitment from index 0', async () => {
+    const account = makeAccount({ 0: '0xcommit-hot', 1: '0xcommit-cold' });
 
-    const result = await getSignerDetailsFromAccount(account as never);
-
-    expect(result).toEqual({ commitment: 'commit-first' });
+    expect(await getSignerDetailsFromAccount(account as never)).toEqual({ commitment: 'commit-hot' });
   });
 
   it('reads the cold signer commitment from index 1 on a 3-key account', async () => {
-    const account = makeAccount([{ value: '0xcommit-hot' }, { value: '0xcommit-cold' }]);
-
-    const result = await getSignerDetailsFromAccount(account as never, true);
+    const account = makeAccount({ 0: '0xcommit-hot', 1: '0xcommit-cold' });
 
-    expect(result).toEqual({ commitment: 'commit-cold' });
+    expect(await getSignerDetailsFromAccount(account as never, true)).toEqual({ commitment: 'commit-cold' });
   });
 
   it('reads the cold signer commitment from index 0 on a legacy single-signer account', async () => {
     // Legacy Guardian accounts (feature #153) have a single on-chain signer —
-    // the cold/HD key — at index 0. The cold lookup must fall back to it rather
-    // than reading a non-existent index 1 (which would brick activation of a
-    // migrated account).
-    const account = makeAccount([{ value: '0xcommit-legacy-cold' }]);
+    // the cold/HD key — at index 0. The cold lookup falls back to it (index 1 is
+    // absent) rather than throwing, which would brick activation of a migrated
+    // account.
+    const account = makeAccount({ 0: '0xcommit-legacy-cold' });
+
+    expect(await getSignerDetailsFromAccount(account as never, true)).toEqual({ commitment: 'commit-legacy-cold' });
+  });
 
-    const result = await getSignerDetailsFromAccount(account as never, true);
+  it('reads commitments by signer-index key, independent of storage iteration order', async () => {
+    // Regression guard for the SMT-order bug: getMapItem(signerMapKey(i)) resolves
+    // hot=0 / cold=1 correctly regardless of getMapEntries iteration order. A
+    // positional read would bind the wrong signer for ~half of accounts.
+    const account = makeAccount({ 0: '0xhotC', 1: '0xcoldC' });
 
-    expect(result).toEqual({ commitment: 'commit-legacy-cold' });
+    expect(await getSignerDetailsFromAccount(account as never)).toEqual({ commitment: 'hotC' });
+    expect(await getSignerDetailsFromAccount(account as never, true)).toEqual({ commitment: 'coldC' });
   });
 
-  it('throws when the signer-public-keys slot is missing', async () => {
-    const account = makeAccount(undefined);
+  it('throws when there is no signer at index 0', async () => {
+    const account = makeAccount({});
 
     await expect(getSignerDetailsFromAccount(account as never)).rejects.toThrow(
-      'No signer public keys found in account storage'
+      'No signer commitment found in account storage'
     );
   });
 
-  it('throws when the slot is present but empty', async () => {
-    const account = makeAccount([]);
+  it('treats an empty-word entry (0x / all-zeros) as no signer', async () => {
+    const account = makeAccount({ 0: '0x' });
 
     await expect(getSignerDetailsFromAccount(account as never)).rejects.toThrow(
-      'No signer commitments found in account storage'
+      'No signer commitment found in account storage'
     );
   });
 
-  it('throws when the stored value has no bytes after the 0x prefix', async () => {
-    // `.slice(2)` on '0x' yields an empty string — the `if (!commitment)` guard
-    // rejects instead of returning a malformed entry.
-    const account = makeAccount([{ value: '0x' }]);
+  it('accepts a commitment hex without a 0x prefix', async () => {
+    const account = makeAccount({ 0: 'beefcafe' });
 
-    await expect(getSignerDetailsFromAccount(account as never)).rejects.toThrow(
-      'Commitment not found in account storage'
-    );
+    expect(await getSignerDetailsFromAccount(account as never)).toEqual({ commitment: 'beefcafe' });
   });
 
   it('exposes the multisig storage slot names', () => {
diff --git a/src/lib/miden/guardian/account.ts b/src/lib/miden/guardian/account.ts
index 91cb930ae..c0f372ee6 100644
--- a/src/lib/miden/guardian/account.ts
+++ b/src/lib/miden/guardian/account.ts
@@ -1,4 +1,4 @@
-import { Account, AuthSecretKey, MidenClient } from '@miden-sdk/miden-sdk/lazy';
+import { Account, AuthSecretKey, MidenClient, Word } from '@miden-sdk/miden-sdk/lazy';
 import { EcdsaSigner, MultisigClient } from '@openzeppelin/miden-multisig-client';
 import { Buffer } from 'buffer';
 
@@ -35,33 +35,43 @@ export interface CreatedGuardianAccount {
 }
 
 /**
- * Extract the hot signer's commitment from a Guardian account's storage and
- * pair it with the supplied hot public key.
+ * Signers live in the SIGNER_PUBLIC_KEYS storage map keyed by their index word
+ * (matching @openzeppelin/miden-multisig-client's `signerMapKey`). The hot
+ * signer is at index 0, the cold signer at index 1.
+ */
+const signerMapKey = (index: number): Word => new Word(new BigUint64Array([BigInt(index), 0n, 0n, 0n]));
+
+/**
+ * Read a signer's commitment from a Guardian account's storage.
  *
- * Convention: `signerCommitments: [hot, cold]` per createGuardianAccount —
- * so `mapEntries[0]` is the hot signer's commitment.
+ * 3-key accounts store `[hot@0, cold@1]`; legacy single-key Guardian accounts
+ * (feature #153) keep the cold/HD key alone at index 0. So for the cold lookup
+ * we read index 1 and fall back to index 0 — otherwise activating a migrated
+ * legacy account would read a non-existent index 1 and brick it.
+ *
+ * Commitments MUST be read BY KEY (`getMapItem(signerMapKey(i))`), not by
+ * `getMapEntries()[i]` array position: getMapEntries returns the storage SMT's
+ * iteration order (key-hash order), which is NOT the signer-index order, so a
+ * positional read binds the wrong signer for roughly half of all accounts. The
+ * SDK's own reader (multisig-client `AccountInspector.fromAccount`) reads by key
+ * for the same reason.
  */
 export async function getSignerDetailsFromAccount(account: Account, getCold = false): Promise<{ commitment: string }> {
-  const mapEntries = account.storage().getMapEntries(MULTISIG_SLOT_NAMES.SIGNER_PUBLIC_KEYS);
-  if (!mapEntries) {
-    throw new Error('No signer public keys found in account storage');
-  }
-
-  // New 3-key accounts store [hot, cold] (hot at index 0, cold at index 1).
-  // Legacy single-key Guardian accounts (feature #153) have only one on-chain
-  // signer — the cold/HD key — at index 0. So when reading the cold commitment,
-  // fall back to index 0 if there's a single signer; otherwise activating a
-  // migrated legacy account would read a non-existent index 1 and throw,
-  // bricking the account (it can neither activate nor cold-sign).
-  const index = getCold ? (mapEntries.length <= 1 ? 0 : 1) : 0;
-
-  if (!mapEntries[index]) {
-    throw new Error('No signer commitments found in account storage');
-  }
-
-  const commitment = mapEntries[index].value.slice(2);
+  const storage = account.storage();
+
+  const readSigner = (index: number): string | undefined => {
+    const value = storage.getMapItem(MULTISIG_SLOT_NAMES.SIGNER_PUBLIC_KEYS, signerMapKey(index));
+    if (!value) return undefined;
+    const hex = value.toHex();
+    const unprefixed = hex.startsWith('0x') ? hex.slice(2) : hex;
+    // An absent map entry reads back as the empty word (all zeros) in some SDK
+    // builds — treat that as "no signer at this index".
+    return /^0*$/.test(unprefixed) ? undefined : unprefixed;
+  };
+
+  const commitment = getCold ? (readSigner(1) ?? readSigner(0)) : readSigner(0);
   if (!commitment) {
-    throw new Error('Commitment not found in account storage');
+    throw new Error('No signer commitment found in account storage');
   }
 
   return { commitment };
diff --git a/src/lib/miden/sdk/miden-client-interface.ts b/src/lib/miden/sdk/miden-client-interface.ts
index a88c5dd35..6d8d9f93e 100644
--- a/src/lib/miden/sdk/miden-client-interface.ts
+++ b/src/lib/miden/sdk/miden-client-interface.ts
@@ -69,6 +69,10 @@ export interface RecoveredGuardianAccount {
 }
 
 const MAX_RECOVERY_HD_INDEX = 20;
+// Tolerate a few consecutive empty HD indices before concluding there are no
+// more accounts — handles a non-contiguous index set or a transient empty
+// guardian response, matching BIP-44 wallet gap-limit conventions.
+const RECOVERY_GAP_LIMIT = 3;
 
 // E2E-build only. The per-step prove-timing markers are useful for the
 // Playwright harness (it polls __PROVE_TIMINGS__ to drive its step
@@ -292,8 +296,8 @@ export class MidenClientInterface {
   /**
    * Discover and adopt all Guardian accounts authorized by the cold keys
    * derived from `mnemonic` against `guardianEndpoint`. Iterates HD indices
-   * 0..MAX-1 and stops at the first miss (no accounts returned for that
-   * cold commitment).
+   * 0..MAX-1 and stops after RECOVERY_GAP_LIMIT consecutive empty indices (so a
+   * small gap doesn't silently drop later accounts).
    *
    * Each match is adopted locally only: the on-chain Account state is
    * decoded and inserted into the WASM client + the cold key registered in
@@ -324,6 +328,7 @@ export class MidenClientInterface {
     ]);
 
     const recovered: RecoveredGuardianAccount[] = [];
+    let consecutiveMisses = 0;
 
     for (let hdIndex = 0; hdIndex < MAX_RECOVERY_HD_INDEX; hdIndex++) {
       const coldSeed = deriveColdSeed(hdIndex);
@@ -336,9 +341,13 @@ export class MidenClientInterface {
       const matches = await lookupClient.recoverByKey(lookupSigner);
 
       if (matches.length === 0) {
-        // First miss — assume no further accounts under this seed at this endpoint.
-        break;
+        // Tolerate a small gap before giving up, so a non-contiguous index or a
+        // transient empty guardian response doesn't silently drop later accounts.
+        consecutiveMisses++;
+        if (consecutiveMisses >= RECOVERY_GAP_LIMIT) break;
+        continue;
       }
+      consecutiveMisses = 0;
 
       for (const { state } of matches) {
         // Decode the on-chain account state and adopt it locally so subsequent

From 8ecfb48f0bde6029d4e7e6128bf7725e6c709890 Mon Sep 17 00:00:00 2001
From: Wiktor Starczewski <poszerny@gmail.com>
Date: Fri, 26 Jun 2026 17:46:48 +0200
Subject: [PATCH 69/71] fix(guardian): per-account endpoint + reconcile
 structural ops on apply-failure

---
 CHANGELOG.md                                  |   1 +
 .../activity/transactions.guardian.test.ts    | 217 +++++++++++++++++-
 src/lib/miden/activity/transactions.ts        |  96 ++++++--
 src/lib/miden/back/transaction-processor.ts   |   9 +
 src/lib/miden/back/vault.ts                   |  53 ++++-
 src/lib/miden/front/guardian-manager.test.ts  |  31 ++-
 src/lib/miden/front/guardian-manager.ts       |  34 +--
 src/lib/miden/front/guardian-sync.ts          |  17 +-
 src/lib/miden/guardian/account.test.ts        |  48 +++-
 src/lib/miden/guardian/account.ts             |  20 +-
 src/lib/miden/guardian/index.test.ts          |  30 ++-
 src/lib/miden/guardian/index.ts               |  18 +-
 src/lib/miden/sdk/miden-client-interface.ts   |   7 +-
 src/lib/shared/types.ts                       |   9 +
 14 files changed, 515 insertions(+), 75 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 50a68b9e8..e1b00d034 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 ### Fixes
 
+* [FIX][all] **Guardian operator endpoint is now tracked per account, and structural Guardian ops recover from a submit-then-local-apply failure.** Each Guardian account persists its own `guardianEndpoint` (set at create/recovery, updated on switch-guardian) instead of a single global setting, so two Guardian accounts on different operators no longer collide — older records without the field fall back to the legacy global value. Separately, when a `replace-hot-key` or `switch-guardian` transaction lands on chain but the local apply step throws, the wallet now runs the same finalization the happy path would (swapping the hot-key pointer, or re-registering on the new guardian and persisting its endpoint) instead of cancelling — which previously stranded the account signing with a rotated-out key or talking to the old guardian. (#227)
 * [FIX][all] **Guardian co-sign transactions are now serialized per account.** The Guardian co-signs one delta per account at a time, so concurrent same-account transactions (e.g. auto-consume racing a user claim, or rapid successive claims) made the Guardian's expected commitment diverge from on-chain — stalling its canonicalization for minutes and returning `409 ConflictPendingDelta` while a prior delta was still finalizing, which surfaced as a Guardian claim/send that never completes. Guardian transactions now take a per-account lock so at most one is ever in flight, and proposal creation waits out a transient `409` (a prior delta mid-canonicalization) instead of failing the transaction. (#297)
 
 ## 1.15.2 (2026-06-22)
diff --git a/src/lib/miden/activity/transactions.guardian.test.ts b/src/lib/miden/activity/transactions.guardian.test.ts
index b70a2576e..6f22ae084 100644
--- a/src/lib/miden/activity/transactions.guardian.test.ts
+++ b/src/lib/miden/activity/transactions.guardian.test.ts
@@ -154,18 +154,22 @@ describe('completeSwitchGuardianTransaction', () => {
     txStore.length = 0;
   });
 
-  it('registers state with the new guardian, persists the URL, and marks the row Completed', async () => {
+  it('registers state with the new guardian, persists the per-account endpoint, and marks the row Completed', async () => {
     const tx = new SwitchGuardianTransaction('acc-1', 'https://new.guardian', false);
     txStore.push({ id: tx.id, status: ITransactionStatus.GeneratingTransaction });
 
     const multisigService = {
       finalizeGuardianSwitch: jest.fn(async () => {})
     };
+    const setGuardianEndpoint = jest.fn(async () => {});
+    const provider = { ...makeGuardianProvider(true), setGuardianEndpoint };
 
-    await completeSwitchGuardianTransaction(tx, makeResult() as never, multisigService as never);
+    await completeSwitchGuardianTransaction(tx, makeResult() as never, multisigService as never, provider as never);
 
     expect(multisigService.finalizeGuardianSwitch).toHaveBeenCalledWith('https://new.guardian');
-    expect(putToStorage).toHaveBeenCalledWith('guardian_url_setting', 'https://new.guardian');
+    // Per-account endpoint write, NOT the legacy global key.
+    expect(setGuardianEndpoint).toHaveBeenCalledWith('acc-1', 'https://new.guardian');
+    expect(putToStorage).not.toHaveBeenCalled();
     expect(mockClearGuardianServiceFor).toHaveBeenCalledWith('acc-1');
 
     const row = txStore.find(r => r.id === tx.id) as Record<string, unknown>;
@@ -173,7 +177,7 @@ describe('completeSwitchGuardianTransaction', () => {
     expect(row.displayMessage).toBe('Guardian switched');
   });
 
-  it('marks the row Failed and skips the storage flip when registration throws', async () => {
+  it('marks the row Failed and skips the endpoint write when registration throws', async () => {
     const tx = new SwitchGuardianTransaction('acc-1', 'https://new.guardian', false);
     txStore.push({ id: tx.id, status: ITransactionStatus.GeneratingTransaction });
 
@@ -182,11 +186,13 @@ describe('completeSwitchGuardianTransaction', () => {
         throw new Error('register failed');
       })
     };
+    const setGuardianEndpoint = jest.fn(async () => {});
+    const provider = { ...makeGuardianProvider(true), setGuardianEndpoint };
 
-    await completeSwitchGuardianTransaction(tx, makeResult() as never, multisigService as never);
+    await completeSwitchGuardianTransaction(tx, makeResult() as never, multisigService as never, provider as never);
 
-    // The URL was NOT persisted because the guardian rejected the new state.
-    expect(putToStorage).not.toHaveBeenCalled();
+    // The endpoint was NOT persisted because the guardian rejected the new state.
+    expect(setGuardianEndpoint).not.toHaveBeenCalled();
     const row = txStore.find(r => r.id === tx.id) as Record<string, unknown>;
     expect(row.status).toBe(ITransactionStatus.Failed);
     expect(row.displayMessage).toBe('Failed to switch guardian');
@@ -575,6 +581,203 @@ describe('generateTransaction — Guardian routing', () => {
     const row = txStore.find(r => r.id === txId) as Record<string, unknown>;
     expect(row.status).toBe(ITransactionStatus.Failed);
   });
+
+  it('replace-hot-key apply-after-submit-failure reconciles the hot pointer instead of cancelling', async () => {
+    const txId = 'replace-apply-fail';
+    const coldService = {
+      createReplaceHotKeyProposal: jest.fn(async () => ({
+        proposal: { id: 'prop-replace' },
+        newHot: { ciphertext: 'new-cx', publicKeyHex: 'new-hot-pub', commitmentHex: '0xnewcommit' }
+      })),
+      signAndCreateTransactionRequest: jest.fn(async () => ({
+        serialize: () => new Uint8Array([1]),
+        authArg: () => undefined
+      }))
+    };
+    mockBuildColdMultisigService.mockResolvedValue(coldService);
+    // ensureGuardianProcedureThresholds (run inside completeReplaceHotKeyTransaction)
+    // re-reads via getOrCreateMultisigService; stub it already-hardened so it no-ops.
+    mockGetOrCreateMultisigService.mockResolvedValue({ getProcedureThreshold: () => 2 });
+
+    const swapHotKey = jest.fn(async () => {});
+    const provider = {
+      getAccounts: async () => [{ publicKey: 'guardian-acc', coldPublicKey: 'cold-pub', hotPublicKey: 'old-hot' }],
+      getPublicKeyForCommitment: async () => 'pk',
+      signWord: async () => 'sig',
+      persistNewHotKey: jest.fn(async () => {}),
+      swapHotKey
+    };
+    mockIsGuardianAccount.mockResolvedValue(true);
+
+    // The submit lands on chain but the LOCAL apply throws — the rotation is real.
+    const applyErr: Error & { errorCode?: string } = new Error('apply failed');
+    applyErr.errorCode = 'ApplyTransactionAfterSubmitFailed';
+    mockGetMidenClient.mockResolvedValue({
+      syncState: jest.fn(async () => {}),
+      getAccount: jest.fn(async () => ({ id: () => ({ toString: () => 'guardian-acc' }) })),
+      waitForTransactionCommit: jest.fn(async () => {}),
+      client: {
+        transactions: {
+          submit: jest.fn(async () => {
+            throw applyErr;
+          })
+        }
+      }
+    });
+
+    txStore.push({ id: txId, type: 'replace-hot-key', accountId: 'guardian-acc', status: ITransactionStatus.Queued });
+
+    await generateTransaction(
+      { id: txId, type: 'replace-hot-key', accountId: 'guardian-acc', delegateTransaction: false } as never,
+      jest.fn(async () => new Uint8Array([1])),
+      false,
+      provider as never
+    );
+
+    // The reconcile swapped the hot pointer; the tx is Completed, not cancelled/Failed.
+    expect(swapHotKey).toHaveBeenCalledWith('guardian-acc', 'new-hot-pub');
+    const row = txStore.find(r => r.id === txId) as Record<string, unknown>;
+    expect(row.status).toBe(ITransactionStatus.Completed);
+  });
+
+  it('switch-guardian apply-after-submit-failure re-registers + persists the endpoint instead of cancelling', async () => {
+    const txId = 'switch-apply-fail';
+    const finalizeGuardianSwitch = jest.fn(async () => {});
+    const service = {
+      createSwitchGuardianProposal: jest.fn(async () => ({
+        proposal: { id: 'prop-switch' },
+        newEndpoint: 'https://new.guardian'
+      })),
+      signAndCreateTransactionRequest: jest.fn(async () => ({
+        serialize: () => new Uint8Array([1]),
+        authArg: () => undefined
+      })),
+      finalizeGuardianSwitch,
+      sync: jest.fn(async () => {})
+    };
+    // Used for both the main proposal AND rebuilt in the reconcile for completion.
+    mockGetOrCreateMultisigService.mockResolvedValue(service);
+    // switch-guardian's cold co-sign uses a transient cold service.
+    mockBuildColdMultisigService.mockResolvedValue({ signProposal: jest.fn(async () => {}) });
+
+    const setGuardianEndpoint = jest.fn(async () => {});
+    const provider = {
+      getAccounts: async () => [{ publicKey: 'guardian-acc', coldPublicKey: 'cold-pub', hotPublicKey: 'hot-pub' }],
+      getPublicKeyForCommitment: async () => 'pk',
+      signWord: async () => 'sig',
+      setGuardianEndpoint
+    };
+    mockIsGuardianAccount.mockResolvedValue(true);
+
+    const applyErr: Error & { errorCode?: string } = new Error('apply failed');
+    applyErr.errorCode = 'ApplyTransactionAfterSubmitFailed';
+    mockGetMidenClient.mockResolvedValue({
+      syncState: jest.fn(async () => {}),
+      getAccount: jest.fn(async () => ({ id: () => ({ toString: () => 'guardian-acc' }) })),
+      waitForTransactionCommit: jest.fn(async () => {}),
+      client: {
+        transactions: {
+          submit: jest.fn(async () => {
+            throw applyErr;
+          })
+        }
+      }
+    });
+
+    txStore.push({
+      id: txId,
+      type: 'switch-guardian',
+      accountId: 'guardian-acc',
+      status: ITransactionStatus.Queued,
+      extraInputs: { newGuardianEndpoint: 'https://new.guardian' }
+    });
+
+    await generateTransaction(
+      {
+        id: txId,
+        type: 'switch-guardian',
+        accountId: 'guardian-acc',
+        extraInputs: { newGuardianEndpoint: 'https://new.guardian' },
+        delegateTransaction: false
+      } as never,
+      jest.fn(async () => new Uint8Array([1])),
+      false,
+      provider as never
+    );
+
+    // The reconcile re-registered on the new guardian and persisted the per-account endpoint.
+    expect(finalizeGuardianSwitch).toHaveBeenCalledWith('https://new.guardian');
+    expect(setGuardianEndpoint).toHaveBeenCalledWith('guardian-acc', 'https://new.guardian');
+    const row = txStore.find(r => r.id === txId) as Record<string, unknown>;
+    expect(row.status).toBe(ITransactionStatus.Completed);
+  });
+
+  it('cancels the tx when the structural apply-failure reconcile itself throws', async () => {
+    const txId = 'switch-reconcile-throws';
+    const service = {
+      createSwitchGuardianProposal: jest.fn(async () => ({
+        proposal: { id: 'prop-switch' },
+        newEndpoint: 'https://new.guardian'
+      })),
+      signAndCreateTransactionRequest: jest.fn(async () => ({
+        serialize: () => new Uint8Array([1]),
+        authArg: () => undefined
+      })),
+      sync: jest.fn(async () => {})
+    };
+    // First call serves the main proposal; the reconcile's rebuild rejects.
+    mockGetOrCreateMultisigService.mockResolvedValueOnce(service).mockRejectedValueOnce(new Error('rebuild failed'));
+    mockBuildColdMultisigService.mockResolvedValue({ signProposal: jest.fn(async () => {}) });
+
+    const provider = {
+      getAccounts: async () => [{ publicKey: 'guardian-acc', coldPublicKey: 'cold-pub', hotPublicKey: 'hot-pub' }],
+      getPublicKeyForCommitment: async () => 'pk',
+      signWord: async () => 'sig',
+      setGuardianEndpoint: jest.fn(async () => {})
+    };
+    mockIsGuardianAccount.mockResolvedValue(true);
+
+    const applyErr: Error & { errorCode?: string } = new Error('apply failed');
+    applyErr.errorCode = 'ApplyTransactionAfterSubmitFailed';
+    mockGetMidenClient.mockResolvedValue({
+      syncState: jest.fn(async () => {}),
+      getAccount: jest.fn(async () => ({ id: () => ({ toString: () => 'guardian-acc' }) })),
+      waitForTransactionCommit: jest.fn(async () => {}),
+      client: {
+        transactions: {
+          submit: jest.fn(async () => {
+            throw applyErr;
+          })
+        }
+      }
+    });
+
+    txStore.push({
+      id: txId,
+      type: 'switch-guardian',
+      accountId: 'guardian-acc',
+      status: ITransactionStatus.Queued,
+      extraInputs: { newGuardianEndpoint: 'https://new.guardian' }
+    });
+
+    await generateTransaction(
+      {
+        id: txId,
+        type: 'switch-guardian',
+        accountId: 'guardian-acc',
+        extraInputs: { newGuardianEndpoint: 'https://new.guardian' },
+        delegateTransaction: false
+      } as never,
+      jest.fn(async () => new Uint8Array([1])),
+      false,
+      provider as never
+    );
+
+    // Reconcile failed → fall through to cancelTransaction → row Failed.
+    expect(provider.setGuardianEndpoint).not.toHaveBeenCalled();
+    const row = txStore.find(r => r.id === txId) as Record<string, unknown>;
+    expect(row.status).toBe(ITransactionStatus.Failed);
+  });
 });
 
 describe('initiateReplaceHotKeyTransaction', () => {
diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index 83c6c9028..212a7577b 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -12,7 +12,6 @@ import { MultisigService } from 'lib/miden/guardian';
 import { withGuardianAccountLock, withGuardianConflictRetry } from 'lib/miden/guardian/serialize';
 import * as Repo from 'lib/miden/repo';
 import { isExtension, isMobile } from 'lib/platform';
-import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { u8ToB64 } from 'lib/shared/helpers';
 import { WalletMessageType } from 'lib/shared/types';
 import { getIntercom } from 'lib/store';
@@ -30,7 +29,6 @@ import {
   TransactionOutput,
   UpdateProcedureThresholdTransaction
 } from '../db/types';
-import { putToStorage } from '../front';
 import { toNoteTypeString } from '../helpers';
 import { getBech32AddressFromAccountId } from '../sdk/helpers';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
@@ -392,9 +390,9 @@ export const initiateSendTransaction = async (
 };
 
 /**
- * Queue a switch-guardian transaction for a Guardian account. The local
- * `GUARDIAN_URL_STORAGE_KEY` is NOT updated here — it's written only after
- * the on-chain proposal lands, in `completeSwitchGuardianTransaction`.
+ * Queue a switch-guardian transaction for a Guardian account. The per-account
+ * `guardianEndpoint` is NOT updated here — it's persisted only after the
+ * on-chain proposal lands, in `completeSwitchGuardianTransaction`.
  */
 export const initiateSwitchGuardianTransaction = async (
   accountId: string,
@@ -432,11 +430,10 @@ export const initiateReplaceHotKeyTransaction = async (
 
 export const completeReplaceHotKeyTransaction = async (
   tx: ReplaceHotKeyTransaction,
-  result: TransactionResult,
+  result: TransactionResult | undefined,
   guardianProvider: GuardianAccountProvider
 ) => {
   try {
-    const executedTx = result.executedTransaction();
     const newHotPublicKey = tx.extraInputs?.newHotPublicKey;
     if (!newHotPublicKey) {
       throw new Error('Replace-hot-key tx is missing newHotPublicKey in extraInputs');
@@ -454,9 +451,13 @@ export const completeReplaceHotKeyTransaction = async (
 
     await updateTransactionStatus(tx.id, ITransactionStatus.Completed, {
       displayMessage: 'Device key rotated',
-      transactionId: executedTx.id().toHex(),
       completedAt: Math.floor(Date.now() / 1000),
-      resultBytes: result.serialize()
+      // `result` is absent on the apply-after-submit-failed reconcile path: the
+      // rotation is already on chain, we just lack the local TransactionResult.
+      ...(result && {
+        transactionId: result.executedTransaction().id().toHex(),
+        resultBytes: result.serialize()
+      })
     });
 
     // The account now has both signers on-chain, so bring it up to the same
@@ -469,7 +470,7 @@ export const completeReplaceHotKeyTransaction = async (
     await updateTransactionStatus(tx.id, ITransactionStatus.Failed, {
       displayMessage: 'Failed to rotate device key',
       completedAt: Math.floor(Date.now() / 1000),
-      resultBytes: result.serialize(),
+      ...(result && { resultBytes: result.serialize() }),
       error: error instanceof Error ? error.message : String(error)
     });
   }
@@ -552,11 +553,11 @@ export const completeUpdateProcedureThresholdTransaction = async (
 
 export const completeSwitchGuardianTransaction = async (
   tx: SwitchGuardianTransaction,
-  result: TransactionResult,
-  multisigService: MultisigService
+  result: TransactionResult | undefined,
+  multisigService: MultisigService,
+  guardianProvider: GuardianAccountProvider
 ) => {
   try {
-    const executedTx = result.executedTransaction();
     const { newGuardianEndpoint } = tx.extraInputs;
 
     // Mirror upstream `multisig.executeProposal`'s post-submit block for
@@ -567,26 +568,57 @@ export const completeSwitchGuardianTransaction = async (
     await setTransactionStage(tx.id, 'registering-guardian');
     await multisigService.finalizeGuardianSwitch(newGuardianEndpoint);
 
-    await putToStorage(GUARDIAN_URL_STORAGE_KEY, newGuardianEndpoint);
+    // Persist the endpoint PER-ACCOUNT (not the legacy global key) so other
+    // Guardian accounts on different operators aren't clobbered. Backend
+    // providers implement setGuardianEndpoint; the optional-call guard keeps a
+    // frontend provider without it from throwing.
+    await guardianProvider.setGuardianEndpoint?.(tx.accountId, newGuardianEndpoint);
     clearGuardianServiceFor(tx.accountId);
 
     await updateTransactionStatus(tx.id, ITransactionStatus.Completed, {
       displayMessage: 'Guardian switched',
-      transactionId: executedTx.id().toHex(),
       completedAt: Math.floor(Date.now() / 1000), // seconds
-      resultBytes: result.serialize()
+      // `result` is absent on the apply-after-submit-failed reconcile path: the
+      // switch is already on chain, we just lack the local TransactionResult.
+      ...(result && {
+        transactionId: result.executedTransaction().id().toHex(),
+        resultBytes: result.serialize()
+      })
     });
   } catch (error) {
     console.error('Error completing switch guardian transaction:', error);
     await updateTransactionStatus(tx.id, ITransactionStatus.Failed, {
       displayMessage: 'Failed to switch guardian',
       completedAt: Math.floor(Date.now() / 1000), // seconds
-      resultBytes: result.serialize(),
+      ...(result && { resultBytes: result.serialize() }),
       error: error instanceof Error ? error.message : String(error)
     });
   }
 };
 
+/**
+ * Run the structural side effects a structural Guardian op needs after its
+ * submit landed on chain but the LOCAL apply failed (`ApplyTransactionAfterSubmitFailed`).
+ * Without this the generic apply-failure handler would mark the tx Completed and
+ * skip reconciliation, stranding the account.
+ *
+ * replace-hot-key → swap the vault hot pointer (idempotent).
+ * switch-guardian → rebuild a service to drive `finalizeGuardianSwitch` (which
+ *   re-syncs the post-switch account state itself) + persist the per-account
+ *   endpoint. Both completion handlers tolerate a missing TransactionResult.
+ */
+async function reconcileStructuralApplyFailure(
+  tx: ITransaction,
+  guardianProvider: GuardianAccountProvider
+): Promise<void> {
+  if (tx.type === 'replace-hot-key') {
+    await completeReplaceHotKeyTransaction(tx as ReplaceHotKeyTransaction, undefined, guardianProvider);
+    return;
+  }
+  const service = await getOrCreateMultisigService(tx.accountId, guardianProvider);
+  await completeSwitchGuardianTransaction(tx as SwitchGuardianTransaction, undefined, service, guardianProvider);
+}
+
 const extractFullNote = (result: TransactionResult): Note | undefined => {
   try {
     const outputNotes = result.executedTransaction().outputNotes().notes();
@@ -963,6 +995,24 @@ export const generateTransaction = async (
         generateGuardianTransaction(transaction, signCallback, guardianProvider)
       );
     } catch (error) {
+      // Submit-succeeded-but-local-apply-failed on a structural op (replace-hot-key
+      // / switch-guardian) is special: the change IS on chain, but the failure
+      // happened before generateGuardianTransaction's completion handler ran, so
+      // the vault hot pointer / guardian re-registration are un-reconciled. Cancelling
+      // would strand the account (signing with a rotated-out key, or talking to the
+      // old guardian). Run the same finalization the happy path would; only cancel if
+      // that reconcile itself fails.
+      if (
+        extractSdkErrorCode(error) === 'ApplyTransactionAfterSubmitFailed' &&
+        (transaction.type === 'replace-hot-key' || transaction.type === 'switch-guardian')
+      ) {
+        try {
+          await reconcileStructuralApplyFailure(transaction, guardianProvider);
+          return;
+        } catch (reconcileError) {
+          console.error('Structural-op apply-failure reconcile failed; cancelling', reconcileError);
+        }
+      }
       await cancelTransaction(transaction, error);
     }
     return;
@@ -1253,7 +1303,12 @@ const generateGuardianTransaction = async (
       break;
     case 'switch-guardian':
       console.log('Completing switch guardian transaction');
-      await completeSwitchGuardianTransaction(transaction as SwitchGuardianTransaction, transactionResult, service);
+      await completeSwitchGuardianTransaction(
+        transaction as SwitchGuardianTransaction,
+        transactionResult,
+        service,
+        guardianProvider
+      );
       break;
     case 'replace-hot-key':
       console.log('Completing replace-hot-key transaction');
@@ -1379,6 +1434,11 @@ export const generateTransactionsLoop = async (
       logger.warning('Transaction submitted but local apply failed; marking Completed, sync will reconcile');
       const tx = await Repo.transactions.where({ id: nextTransaction.id }).first();
       if (tx && tx.status !== ITransactionStatus.Completed) {
+        // Structural Guardian ops never reach here — they're routed through the
+        // guardian branch of `generateTransaction`, whose own catch handles the
+        // apply-after-submit-failed reconcile (see `reconcileStructuralApplyFailure`).
+        // This generic path covers send/consume, whose note states the next sync
+        // reconciles via ConsumedExternal.
         await updateTransactionStatus(tx.id, ITransactionStatus.Completed, {
           displayMessage: 'Completed',
           completedAt: Math.floor(Date.now() / 1000)
diff --git a/src/lib/miden/back/transaction-processor.ts b/src/lib/miden/back/transaction-processor.ts
index 06e958f96..06e365efe 100644
--- a/src/lib/miden/back/transaction-processor.ts
+++ b/src/lib/miden/back/transaction-processor.ts
@@ -99,6 +99,15 @@ const vaultGuardianProvider: GuardianAccountProvider = {
       const updated = await vault.swapHotKey(accountPublicKey, newHotPubKey);
       accountsUpdated(updated);
     });
+  },
+  setGuardianEndpoint: async (accountPublicKey: string, guardianEndpoint: string) => {
+    // Mirror swapHotKey: persist then `accountsUpdated` so the Effector store
+    // (and every popup pulling from it) reflects the new per-account endpoint.
+    // Otherwise the popup keeps resolving the old guardian for this account.
+    return withUnlocked(async ({ vault }) => {
+      const updated = await vault.setGuardianEndpoint(accountPublicKey, guardianEndpoint);
+      accountsUpdated(updated);
+    });
   }
 };
 
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index 747b9877e..f9cf08f15 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -376,6 +376,7 @@ export class Vault {
         hdIndex: number;
         authScheme: AuthScheme;
         guardianKeys?: CreatedGuardianKeys;
+        guardianEndpoint?: string;
         recoveredCold?: { coldPublicKey: string; coldSecretKeyHex: string };
       };
 
@@ -394,18 +395,31 @@ export class Vault {
           hdIndex: r.hdIndex,
           // Guardian accounts are always ECDSA under the 3-key model.
           authScheme: NEW_ACCOUNT_AUTH_SCHEME,
+          // Recovery is scoped to a single operator endpoint, so every adopted
+          // account is registered with the same `guardianEndpoint` we looked up against.
+          guardianEndpoint,
           recoveredCold: { coldPublicKey: r.coldPublicKey, coldSecretKeyHex: r.coldSecretKeyHex }
         }));
       } else {
         console.log('[Vault.spawn] Step 7b: acquiring WASM client lock for create/import path...');
         const created = await withWasmClientLock(
-          async (): Promise<{ accountId: string; accAuthScheme: AuthScheme; guardianKeys?: CreatedGuardianKeys }> => {
+          async (): Promise<{
+            accountId: string;
+            accAuthScheme: AuthScheme;
+            guardianKeys?: CreatedGuardianKeys;
+            guardianEndpoint?: string;
+          }> => {
             if (walletType === WalletType.Guardian) {
               console.log('[Vault.spawn] Step 8: syncing state then creating Guardian account...');
               await midenClient.syncState();
               const result = await midenClient.createGuardianMidenWallet(walletSeed);
               // Guardian accounts are always ECDSA under the 3-key model.
-              return { accountId: result.accountId, accAuthScheme: NEW_ACCOUNT_AUTH_SCHEME, guardianKeys: result.keys };
+              return {
+                accountId: result.accountId,
+                accAuthScheme: NEW_ACCOUNT_AUTH_SCHEME,
+                guardianKeys: result.keys,
+                guardianEndpoint: result.guardianEndpoint
+              };
             }
 
             if (ownMnemonic && midenClient.network !== 'mock') {
@@ -439,7 +453,8 @@ export class Vault {
             accountId: created.accountId,
             hdIndex: hdAccIndex,
             authScheme: created.accAuthScheme,
-            guardianKeys: created.guardianKeys
+            guardianKeys: created.guardianKeys,
+            guardianEndpoint: created.guardianEndpoint
           }
         ];
       }
@@ -451,6 +466,7 @@ export class Vault {
         type: walletType,
         hdIndex: c.hdIndex,
         authScheme: c.authScheme,
+        ...(c.guardianEndpoint && { guardianEndpoint: c.guardianEndpoint }),
         ...(c.guardianKeys && {
           hotPublicKey: c.guardianKeys.hotPublicKey,
           coldPublicKey: c.guardianKeys.coldPublicKey
@@ -645,6 +661,7 @@ export class Vault {
         async (): Promise<{
           accountId: string;
           guardianKeys?: CreatedGuardianKeys;
+          guardianEndpoint?: string;
         }> => {
           console.log('[Vault.createHDAccount] Step 6: WASM lock acquired, getting client');
           const midenClient = await getMidenClient(options);
@@ -653,7 +670,11 @@ export class Vault {
           if (walletType === WalletType.Guardian) {
             console.log('[Vault.createHDAccount] Step 8: createGuardianMidenWallet');
             const result = await midenClient.createGuardianMidenWallet(walletSeed);
-            return { accountId: result.accountId, guardianKeys: result.keys };
+            return {
+              accountId: result.accountId,
+              guardianKeys: result.keys,
+              guardianEndpoint: result.guardianEndpoint
+            };
           }
 
           if (isOwnMnemonic && walletType === WalletType.OnChain) {
@@ -683,6 +704,7 @@ export class Vault {
         isPublic: walletType === WalletType.OnChain,
         hdIndex: hdAccIndex,
         authScheme: newScheme,
+        ...(created.guardianEndpoint && { guardianEndpoint: created.guardianEndpoint }),
         ...(created.guardianKeys && {
           hotPublicKey: created.guardianKeys.hotPublicKey,
           coldPublicKey: created.guardianKeys.coldPublicKey
@@ -900,6 +922,29 @@ export class Vault {
     });
   }
 
+  /**
+   * Persist a per-account guardian endpoint after a switch-guardian lands, so
+   * runtime endpoint resolution (and the next service init) point at the new
+   * operator. Returns the updated accounts so the caller can broadcast
+   * `accountsUpdated` — without that the Effector snapshot keeps the stale
+   * endpoint and the popup rebuilds a service against the old guardian.
+   */
+  async setGuardianEndpoint(accountPublicKey: string, guardianEndpoint: string) {
+    return withError('Failed to set guardian endpoint', async () => {
+      const allAccounts = await this.fetchAccounts();
+      const account = allAccounts.find(acc => acc.publicKey === accountPublicKey);
+      if (!account) {
+        throw new PublicError('Account not found');
+      }
+      const newAllAccounts = allAccounts.map(acc =>
+        acc.publicKey === accountPublicKey ? { ...acc, guardianEndpoint } : acc
+      );
+      await encryptAndSaveMany([[accountsStrgKey, newAllAccounts]], this.vaultKey);
+      const currentAccount = await this.getCurrentAccount();
+      return { accounts: newAllAccounts, currentAccount };
+    });
+  }
+
   /**
    * One-time, in-place migration of legacy single-signer Guardian accounts to
    * the 3-key model. Called on every unlock; idempotent (a no-op once an
diff --git a/src/lib/miden/front/guardian-manager.test.ts b/src/lib/miden/front/guardian-manager.test.ts
index 2de925dd9..950cca436 100644
--- a/src/lib/miden/front/guardian-manager.test.ts
+++ b/src/lib/miden/front/guardian-manager.test.ts
@@ -21,7 +21,11 @@ jest.mock('./storage', () => ({
 
 const mockGetSignerDetailsFromAccount = jest.fn();
 jest.mock('../guardian/account', () => ({
-  getSignerDetailsFromAccount: (...args: unknown[]) => mockGetSignerDetailsFromAccount(...args)
+  getSignerDetailsFromAccount: (...args: unknown[]) => mockGetSignerDetailsFromAccount(...args),
+  // Mirror the real resolver: prefer the per-account endpoint, else the stored
+  // global key (driven by mockFetchFromStorage), else the default.
+  resolveGuardianEndpoint: async (acc: { guardianEndpoint?: string }) =>
+    acc.guardianEndpoint ?? (await mockFetchFromStorage('guardian_url_setting')) ?? 'https://default.guardian.test'
 }));
 
 const mockGetAccount = jest.fn();
@@ -91,7 +95,9 @@ describe('guardian-manager', () => {
         expect.anything(),
         `0x${HOT_PK}`,
         '0xabc',
-        provider.signWord
+        provider.signWord,
+        // The resolved per-account endpoint is now passed through to init.
+        'https://default.guardian.test'
       );
       // Second call for the same account returns the cached instance without
       // re-initializing the service.
@@ -136,6 +142,27 @@ describe('guardian-manager', () => {
       expect(mockMultisigServiceInit).toHaveBeenCalledTimes(2);
     });
 
+    it('uses the per-account guardianEndpoint over the global key (multi-account isolation)', async () => {
+      // Two Guardian accounts on different operators must not collide: the one
+      // carrying its own endpoint binds to it regardless of the global key.
+      const service = { guardianEndpoint: 'https://per-account.guardian', tag: 'isolated' };
+      mockMultisigServiceInit.mockResolvedValueOnce(service);
+      const provider = makeProvider([{ ...guardianAccount, guardianEndpoint: 'https://per-account.guardian' }]);
+
+      const result = await getOrCreateMultisigService(GUARDIAN_PK, provider);
+
+      expect(result).toBe(service);
+      expect(mockMultisigServiceInit).toHaveBeenCalledWith(
+        expect.anything(),
+        `0x${HOT_PK}`,
+        '0xabc',
+        provider.signWord,
+        'https://per-account.guardian'
+      );
+      // The per-account field short-circuits the global-key lookup.
+      expect(mockFetchFromStorage).not.toHaveBeenCalled();
+    });
+
     it('coalesces concurrent service initialization for the same account', async () => {
       const service = { guardianEndpoint: 'https://default.guardian.test', tag: 'shared' };
       let resolveInit!: (value: unknown) => void;
diff --git a/src/lib/miden/front/guardian-manager.ts b/src/lib/miden/front/guardian-manager.ts
index 3d6a11dbe..e767f4932 100644
--- a/src/lib/miden/front/guardian-manager.ts
+++ b/src/lib/miden/front/guardian-manager.ts
@@ -1,12 +1,9 @@
 import { MultisigService } from 'lib/miden/guardian';
 import { clearGuardianAccountLocks } from 'lib/miden/guardian/serialize';
-import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
-import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { WalletAccount } from 'lib/shared/types';
 import { WalletType } from 'screens/onboarding/types';
 
-import { fetchFromStorage } from './storage';
-import { getSignerDetailsFromAccount } from '../guardian/account';
+import { getSignerDetailsFromAccount, resolveGuardianEndpoint } from '../guardian/account';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 
 // Cache MultisigService instances to avoid re-initialization on every sync cycle.
@@ -39,6 +36,10 @@ export interface GuardianAccountProvider {
   // vault-backed provider implements them.
   persistNewHotKey?: (newHotPubKey: string, newHotCiphertext: string) => Promise<void>;
   swapHotKey?: (accountPublicKey: string, newHotPubKey: string) => Promise<void>;
+  // Persist a per-account guardian endpoint after a switch-guardian lands.
+  // SW-only (vault-backed); the frontend zustand provider leaves it undefined
+  // because guardian-switch completion runs exclusively in the backend processor.
+  setGuardianEndpoint?: (accountPublicKey: string, guardianEndpoint: string) => Promise<void>;
 }
 
 /**
@@ -80,22 +81,23 @@ export async function getOrCreateMultisigService(
       throw new Error(`Guardian account ${accountPublicKey} is missing hotPublicKey — re-create the wallet`);
     }
     const hotPublicKey = account.hotPublicKey;
+    // Per-account guardian endpoint (falls back to the legacy global key for
+    // records created before the field existed). Resolved once and reused for
+    // both the cache drift-check and the init binding below.
+    const currentEndpoint = await resolveGuardianEndpoint(account);
 
     // Return cached instance if its endpoint AND bound hot pubkey still match.
     // Two separate drift sources:
     //   - guardian endpoint: switch_guardian rotates the URL; clearGuardianServiceFor
-    //     in the SW realm doesn't reach the popup's Map, so re-check storage here.
+    //     in the SW realm doesn't reach the popup's Map, so re-check here.
     //   - hot pubkey: replace_hot_key rotates account.hotPublicKey; the cached
     //     service is still bound to the previous WalletSigner.publicKey.
     const cached = guardianServiceCache.get(accountPublicKey);
     if (cached) {
-      try {
-        const currentEndpoint = (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
-        if (cached.service.guardianEndpoint === currentEndpoint && cached.hotPublicKey === hotPublicKey) {
-          return cached.service;
-        }
-        guardianServiceCache.delete(accountPublicKey);
-      } catch (error) {}
+      if (cached.service.guardianEndpoint === currentEndpoint && cached.hotPublicKey === hotPublicKey) {
+        return cached.service;
+      }
+      guardianServiceCache.delete(accountPublicKey);
     }
 
     // Get the Account object from the Miden client.
@@ -113,7 +115,13 @@ export async function getOrCreateMultisigService(
     const { commitment } = await getSignerDetailsFromAccount(sdkAccount);
     // Bind the service to the hot signer — the popup signs with the hot key.
     console.log('creating guardian service', sdkAccount.id().toString());
-    const service = await MultisigService.init(sdkAccount, `0x${hotPublicKey}`, `0x${commitment}`, provider.signWord);
+    const service = await MultisigService.init(
+      sdkAccount,
+      `0x${hotPublicKey}`,
+      `0x${commitment}`,
+      provider.signWord,
+      currentEndpoint
+    );
 
     // Cache for future use, tagged with the hot pubkey it was bound to so the
     // next access can detect rotation and force a re-init.
diff --git a/src/lib/miden/front/guardian-sync.ts b/src/lib/miden/front/guardian-sync.ts
index 77d8bf2bd..e90c502c3 100644
--- a/src/lib/miden/front/guardian-sync.ts
+++ b/src/lib/miden/front/guardian-sync.ts
@@ -23,11 +23,18 @@ export const zustandProvider: GuardianAccountProvider = {
  * Sync Guardian state for all Guardian accounts. Called from AutoSync after chain
  * state sync (frontend context only — uses the Zustand-backed provider).
  *
- * Accounts flagged `requiresHotKeyRotation` (adopted via recovery, hot key not
- * yet activated) are skipped — `getOrCreateMultisigService` binds against the
- * hot signer and throws on missing `hotPublicKey`. The Activate Device Key
- * banner is the user's path to flip that flag; once swapped, the next sync
- * cycle picks the account up normally.
+ * Accounts flagged `requiresHotKeyRotation` (adopted via recovery or migrated
+ * from a legacy single-signer record, hot key not yet activated) are skipped —
+ * `getOrCreateMultisigService` binds against the hot signer and throws on
+ * missing `hotPublicKey`. The Activate Device Key banner is the user's path to
+ * flip that flag; once swapped, the next sync cycle picks the account up normally.
+ *
+ * This also means the `update_guardian` threshold-2 hardening is intentionally
+ * NOT applied to these accounts here, and that's correct: a pre-activation
+ * account has a single on-chain signer (cold), so a 2-of-N procedure threshold
+ * is unsatisfiable and would brick guardian changes. The hardening is applied
+ * at activation (`completeReplaceHotKeyTransaction`), once the hot signer makes
+ * the account 2-of-N. Don't "fix" this filter to harden pre-activation accounts.
  */
 // Accounts whose update_guardian hardening we've already verified this session,
 // so the self-heal check below runs at most once per account per session.
diff --git a/src/lib/miden/guardian/account.test.ts b/src/lib/miden/guardian/account.test.ts
index 1f89f7072..93e1a7595 100644
--- a/src/lib/miden/guardian/account.test.ts
+++ b/src/lib/miden/guardian/account.test.ts
@@ -7,7 +7,12 @@
  * All external collaborators are stubbed; we don't exec any real WASM.
  */
 
-import { createGuardianAccount, getSignerDetailsFromAccount, MULTISIG_SLOT_NAMES } from './account';
+import {
+  createGuardianAccount,
+  getSignerDetailsFromAccount,
+  MULTISIG_SLOT_NAMES,
+  resolveGuardianEndpoint
+} from './account';
 
 const mockFetchFromStorage = jest.fn();
 jest.mock('../front/storage', () => ({
@@ -245,6 +250,9 @@ describe('createGuardianAccount', () => {
       hotCiphertext: 'hot-ciphertext-hex',
       coldSecretKeyHex: expect.any(String)
     });
+    // Endpoint is returned so vault can persist it per-account. No stored URL
+    // here (beforeEach stubs undefined), so it falls back to the default.
+    expect(result.guardianEndpoint).toBe('https://default.guardian.test');
   });
 
   it('generates a random seed when none is provided', async () => {
@@ -275,12 +283,14 @@ describe('createGuardianAccount', () => {
     const webClient = makeWebClient();
     multisigClientConfig.create.mockResolvedValueOnce(makeMultisig());
 
-    await createGuardianAccount(webClient as never, new Uint8Array(32));
+    const result = await createGuardianAccount(webClient as never, new Uint8Array(32));
 
     // When storage yields a URL, create still succeeds — the URL propagation
     // goes through MultisigClient's constructor which we stubbed, so the
     // useful signal is that fetchFromStorage was consulted.
     expect(mockFetchFromStorage).toHaveBeenCalledWith('guardian_url_setting');
+    // And the stored URL is returned for per-account persistence.
+    expect(result.guardianEndpoint).toBe('https://stored.guardian');
   });
 
   it('prefers the explicit override over storage and default', async () => {
@@ -288,10 +298,16 @@ describe('createGuardianAccount', () => {
     const webClient = makeWebClient();
     multisigClientConfig.create.mockResolvedValueOnce(makeMultisig());
 
-    await createGuardianAccount(webClient as never, new Uint8Array(32), false, 'https://override.guardian');
+    const result = await createGuardianAccount(
+      webClient as never,
+      new Uint8Array(32),
+      false,
+      'https://override.guardian'
+    );
 
     // Override short-circuits the storage lookup entirely.
     expect(mockFetchFromStorage).not.toHaveBeenCalled();
+    expect(result.guardianEndpoint).toBe('https://override.guardian');
   });
 
   it('wraps underlying errors in a readable message', async () => {
@@ -303,3 +319,29 @@ describe('createGuardianAccount', () => {
     );
   });
 });
+
+describe('resolveGuardianEndpoint', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('prefers the per-account guardianEndpoint when present', async () => {
+    const endpoint = await resolveGuardianEndpoint({ guardianEndpoint: 'https://per-account.guardian' } as never);
+    expect(endpoint).toBe('https://per-account.guardian');
+    // The per-account field short-circuits the global-key lookup.
+    expect(mockFetchFromStorage).not.toHaveBeenCalled();
+  });
+
+  it('falls back to the legacy global key when the account has no endpoint', async () => {
+    mockFetchFromStorage.mockResolvedValueOnce('https://global.guardian');
+    const endpoint = await resolveGuardianEndpoint({} as never);
+    expect(mockFetchFromStorage).toHaveBeenCalledWith('guardian_url_setting');
+    expect(endpoint).toBe('https://global.guardian');
+  });
+
+  it('falls back to DEFAULT_GUARDIAN_ENDPOINT when neither field nor global key is set', async () => {
+    mockFetchFromStorage.mockResolvedValueOnce(undefined);
+    const endpoint = await resolveGuardianEndpoint({} as never);
+    expect(endpoint).toBe('https://default.guardian.test');
+  });
+});
diff --git a/src/lib/miden/guardian/account.ts b/src/lib/miden/guardian/account.ts
index c0f372ee6..8d885f69c 100644
--- a/src/lib/miden/guardian/account.ts
+++ b/src/lib/miden/guardian/account.ts
@@ -5,9 +5,23 @@ import { Buffer } from 'buffer';
 import { DEFAULT_GUARDIAN_ENDPOINT } from 'lib/miden-chain/constants';
 import * as secureHotKey from 'lib/secure-hot-key';
 import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
+import { WalletAccount } from 'lib/shared/types';
 
 import { fetchFromStorage } from '../front/storage';
 
+/**
+ * Resolve the guardian operator endpoint for a Guardian account.
+ *
+ * Prefers the per-account `guardianEndpoint` (set at create/recovery time and
+ * on switch-guardian) so accounts on different operators don't collide. Falls
+ * back to the legacy global `GUARDIAN_URL_STORAGE_KEY` for records created
+ * before the field existed, then to `DEFAULT_GUARDIAN_ENDPOINT`.
+ */
+export async function resolveGuardianEndpoint(account: WalletAccount): Promise<string> {
+  if (account.guardianEndpoint) return account.guardianEndpoint;
+  return (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
+}
+
 // Re-export the slot names from the package for reading account state
 export const MULTISIG_SLOT_NAMES = {
   THRESHOLD_CONFIG: 'openzeppelin::multisig::threshold_config',
@@ -32,6 +46,9 @@ export interface CreatedGuardianKeys {
 export interface CreatedGuardianAccount {
   account: Account;
   keys: CreatedGuardianKeys;
+  // The guardian operator endpoint this account was registered with — persisted
+  // onto the WalletAccount so runtime reads resolve per-account, not globally.
+  guardianEndpoint: string;
 }
 
 /**
@@ -172,7 +189,8 @@ export async function createGuardianAccount(
         coldPublicKey,
         hotCiphertext: hot.ciphertext,
         coldSecretKeyHex
-      }
+      },
+      guardianEndpoint
     };
   } catch (e) {
     console.error('Error creating Guardian account:', e);
diff --git a/src/lib/miden/guardian/index.test.ts b/src/lib/miden/guardian/index.test.ts
index 3bd9df19f..bdcde30b3 100644
--- a/src/lib/miden/guardian/index.test.ts
+++ b/src/lib/miden/guardian/index.test.ts
@@ -106,7 +106,11 @@ jest.mock('lib/secure-hot-key', () => ({
 
 const mockGetSignerDetailsFromAccount = jest.fn();
 jest.mock('./account', () => ({
-  getSignerDetailsFromAccount: (...a: unknown[]) => mockGetSignerDetailsFromAccount(...a)
+  getSignerDetailsFromAccount: (...a: unknown[]) => mockGetSignerDetailsFromAccount(...a),
+  // Resolve to the per-account endpoint, falling back to the stored value the
+  // fetchFromStorage mock returns — mirrors the real resolveGuardianEndpoint.
+  resolveGuardianEndpoint: async (acc: { guardianEndpoint?: string }) =>
+    acc.guardianEndpoint ?? 'https://stored.guardian.test'
 }));
 
 // atob is globally available on Node 16+ but jsdom stubs can vary — provide
@@ -422,34 +426,26 @@ describe('MultisigService', () => {
   });
 
   describe('init', () => {
-    it('loads the Multisig for an existing account and returns a configured service', async () => {
+    it('loads the Multisig for an existing account and binds the passed endpoint', async () => {
       const account = { id: () => ({ toString: () => 'acc-id' }) } as never;
       const loaded = makeMultisig();
       multisigClientConfig.load.mockResolvedValueOnce(loaded);
 
-      const svc = await MultisigService.init(account, 'pub', 'commit', async () => 'sig');
+      const svc = await MultisigService.init(account, 'pub', 'commit', async () => 'sig', 'https://acct.guardian');
 
       expect(svc).toBeInstanceOf(MultisigService);
       expect(svc.multisig).toBe(loaded);
+      // Endpoint is supplied by the caller (per-account), not read from storage.
+      expect(svc.guardianEndpoint).toBe('https://acct.guardian');
     });
 
     it('re-throws when MultisigClient.load rejects', async () => {
       const account = { id: () => ({ toString: () => 'acc-id' }) } as never;
       multisigClientConfig.load.mockRejectedValueOnce(new Error('load failed'));
 
-      await expect(MultisigService.init(account, 'pub', 'commit', async () => 'sig')).rejects.toThrow('load failed');
-    });
-
-    it('falls back to DEFAULT_GUARDIAN_ENDPOINT when storage has no URL', async () => {
-      // Hits the `|| DEFAULT_GUARDIAN_ENDPOINT` branch on the endpoint lookup.
-      const account = { id: () => ({ toString: () => 'acc-id' }) } as never;
-      const loaded = makeMultisig();
-      multisigClientConfig.load.mockResolvedValueOnce(loaded);
-      mockFetchFromStorage.mockResolvedValueOnce(undefined);
-
-      const svc = await MultisigService.init(account, 'pub', 'commit', async () => 'sig');
-
-      expect(svc.guardianEndpoint).toBe('https://default.guardian.test');
+      await expect(
+        MultisigService.init(account, 'pub', 'commit', async () => 'sig', 'https://acct.guardian')
+      ).rejects.toThrow('load failed');
     });
   });
 
@@ -580,6 +576,8 @@ describe('MultisigService', () => {
       // (each prefixed with 0x) to the WalletSigner. We can't introspect that
       // directly here, so we assert load was called — proving init proceeded.
       expect(multisigClientConfig.load).toHaveBeenCalledWith('acc-id', expect.anything());
+      // Endpoint is resolved per-account (here falling back to the stored value).
+      expect(svc.guardianEndpoint).toBe('https://stored.guardian.test');
     });
 
     it('throws when the WalletAccount has no coldPublicKey', async () => {
diff --git a/src/lib/miden/guardian/index.ts b/src/lib/miden/guardian/index.ts
index 765d8068e..71864f992 100644
--- a/src/lib/miden/guardian/index.ts
+++ b/src/lib/miden/guardian/index.ts
@@ -17,7 +17,7 @@ import { GUARDIAN_URL_STORAGE_KEY } from 'lib/settings/constants';
 import { b64ToU8, u8ToB64 } from 'lib/shared/helpers';
 import type { WalletAccount } from 'lib/shared/types';
 
-import { getSignerDetailsFromAccount } from './account';
+import { getSignerDetailsFromAccount, resolveGuardianEndpoint } from './account';
 import { WalletSigner, type SignWordFunction } from './signer';
 import { fetchFromStorage } from '../front/storage';
 import { accountIdStringToSdk } from '../sdk/helpers';
@@ -53,16 +53,19 @@ export class MultisigService {
 
   /**
    * Initialize a MultisigService for an existing Guardian account.
+   *
+   * `guardianEndpoint` is resolved per-account by the caller (see
+   * `resolveGuardianEndpoint`) so accounts on different operators don't collide.
    */
   static async init(
     account: Account,
     publicKey: string,
     signerCommitment: string,
-    signWordFn: SignWordFunction
+    signWordFn: SignWordFunction,
+    guardianEndpoint: string
   ): Promise<MultisigService> {
     try {
       const signer = new WalletSigner(publicKey, signerCommitment, signWordFn);
-      const guardianEndpoint = (await fetchFromStorage<string>(GUARDIAN_URL_STORAGE_KEY)) || DEFAULT_GUARDIAN_ENDPOINT;
 
       // Reuse the shared singleton client instead of spinning up a fresh
       // WebClient (each new WebClient spawns a ~6MB web-client-methods-worker
@@ -102,7 +105,14 @@ export class MultisigService {
       throw new Error(`Guardian account ${walletAccount.publicKey} is missing coldPublicKey — re-create the wallet`);
     }
     const { commitment } = await getSignerDetailsFromAccount(account, true);
-    return MultisigService.init(account, `0x${walletAccount.coldPublicKey}`, `0x${commitment}`, signWordFn);
+    const guardianEndpoint = await resolveGuardianEndpoint(walletAccount);
+    return MultisigService.init(
+      account,
+      `0x${walletAccount.coldPublicKey}`,
+      `0x${commitment}`,
+      signWordFn,
+      guardianEndpoint
+    );
   }
 
   static async importAccountFromGuardian(
diff --git a/src/lib/miden/sdk/miden-client-interface.ts b/src/lib/miden/sdk/miden-client-interface.ts
index 6d8d9f93e..e160c6fad 100644
--- a/src/lib/miden/sdk/miden-client-interface.ts
+++ b/src/lib/miden/sdk/miden-client-interface.ts
@@ -48,6 +48,9 @@ import type { CreatedGuardianKeys } from '../guardian/account';
 export interface GuardianAccountCreationResult {
   accountId: string;
   keys: CreatedGuardianKeys;
+  // Guardian operator endpoint the account was registered with — persisted onto
+  // the WalletAccount so runtime endpoint resolution is per-account.
+  guardianEndpoint: string;
 }
 
 /**
@@ -265,8 +268,8 @@ export class MidenClientInterface {
    */
   async createGuardianMidenWallet(coldSeed?: Uint8Array): Promise<GuardianAccountCreationResult> {
     const { createGuardianAccount } = await import('../guardian/account');
-    const { account, keys } = await createGuardianAccount(this.client, coldSeed);
-    return { accountId: getBech32AddressFromAccountId(account.id()), keys };
+    const { account, keys, guardianEndpoint } = await createGuardianAccount(this.client, coldSeed);
+    return { accountId: getBech32AddressFromAccountId(account.id()), keys, guardianEndpoint };
   }
 
   async importMidenWallet(accountBytes: Uint8Array): Promise<string> {
diff --git a/src/lib/shared/types.ts b/src/lib/shared/types.ts
index bba7a30ff..2d0120c35 100644
--- a/src/lib/shared/types.ts
+++ b/src/lib/shared/types.ts
@@ -350,6 +350,15 @@ export interface WalletAccount {
   // a user-triggered rotation (banner on the home view). Cleared by Vault.swapHotKey
   // once the cold+guardian-signed update_signers tx lands on-chain.
   requiresHotKeyRotation?: boolean;
+  /**
+   * Guardian operator endpoint this account is registered with. Set at create /
+   * recovery time and updated when the user switches guardians. Per-account so
+   * multiple Guardian accounts can live on different operators — absence means a
+   * record created before this field existed, in which case consumers fall back
+   * to the legacy global `GUARDIAN_URL_STORAGE_KEY` (see `resolveGuardianEndpoint`).
+   * Non-Guardian accounts leave this undefined.
+   */
+  guardianEndpoint?: string;
   /**
    * Auth scheme this account was created with. See {@link AuthScheme} for
    * the missing-on-read → `"falcon"` legacy interpretation.

From f45b6799d25426c174c9e1bdf5b7497b6401b5ad Mon Sep 17 00:00:00 2001
From: Wiktor Starczewski <poszerny@gmail.com>
Date: Fri, 26 Jun 2026 23:03:34 +0200
Subject: [PATCH 70/71] fix(guardian): only sync Guardian accounts that have a
 hot key

---
 CHANGELOG.md                              |  1 +
 src/lib/miden/front/guardian-sync.test.ts | 34 ++++++++++++++++++-----
 src/lib/miden/front/guardian-sync.ts      | 23 ++++++++++-----
 3 files changed, 44 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e1b00d034..e19de6d8e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 ### Fixes
 
+* [FIX][all] **Guardian sync no longer spams "missing hotPublicKey" errors for un-activated accounts.** `syncGuardianAccounts` now only syncs Guardian accounts that actually carry a hot key, instead of every account not flagged `requiresHotKeyRotation`. A legacy single-signer Guardian record that hasn't been migrated yet — e.g. in the brief window after a wallet upgrade (new code, old storage) and before the forced re-unlock runs the migration — has no hot key, so `getOrCreateMultisigService` threw on it every ~3s AutoSync tick. There's genuinely no hot-bound service to build for such accounts, so they're skipped; recovery still happens via the migration → Activate Device Key banner path on the next unlock. (#227)
 * [FIX][all] **Guardian operator endpoint is now tracked per account, and structural Guardian ops recover from a submit-then-local-apply failure.** Each Guardian account persists its own `guardianEndpoint` (set at create/recovery, updated on switch-guardian) instead of a single global setting, so two Guardian accounts on different operators no longer collide — older records without the field fall back to the legacy global value. Separately, when a `replace-hot-key` or `switch-guardian` transaction lands on chain but the local apply step throws, the wallet now runs the same finalization the happy path would (swapping the hot-key pointer, or re-registering on the new guardian and persisting its endpoint) instead of cancelling — which previously stranded the account signing with a rotated-out key or talking to the old guardian. (#227)
 * [FIX][all] **Guardian co-sign transactions are now serialized per account.** The Guardian co-signs one delta per account at a time, so concurrent same-account transactions (e.g. auto-consume racing a user claim, or rapid successive claims) made the Guardian's expected commitment diverge from on-chain — stalling its canonicalization for minutes and returning `409 ConflictPendingDelta` while a prior delta was still finalizing, which surfaced as a Guardian claim/send that never completes. Guardian transactions now take a per-account lock so at most one is ever in flight, and proposal creation waits out a transient `409` (a prior delta mid-canonicalization) instead of failing the transaction. (#297)
 
diff --git a/src/lib/miden/front/guardian-sync.test.ts b/src/lib/miden/front/guardian-sync.test.ts
index 1278f947e..24411eb7e 100644
--- a/src/lib/miden/front/guardian-sync.test.ts
+++ b/src/lib/miden/front/guardian-sync.test.ts
@@ -10,7 +10,7 @@ import { WalletType } from 'screens/onboarding/types';
 import { syncGuardianAccounts, zustandProvider } from './guardian-sync';
 
 const storeState: {
-  accounts: Array<{ publicKey: string; type: WalletType; requiresHotKeyRotation?: boolean }>;
+  accounts: Array<{ publicKey: string; type: WalletType; requiresHotKeyRotation?: boolean; hotPublicKey?: string }>;
   getPublicKeyForCommitment: jest.Mock;
   signWord: jest.Mock;
   persistNewHotKey: jest.Mock;
@@ -97,9 +97,9 @@ describe('syncGuardianAccounts', () => {
 
   it('calls service.sync for every Guardian account', async () => {
     storeState.accounts = [
-      { publicKey: 'guardian-1', type: WalletType.Guardian },
+      { publicKey: 'guardian-1', type: WalletType.Guardian, hotPublicKey: 'hot-1' },
       { publicKey: 'public-1', type: WalletType.OnChain },
-      { publicKey: 'guardian-2', type: WalletType.Guardian }
+      { publicKey: 'guardian-2', type: WalletType.Guardian, hotPublicKey: 'hot-2' }
     ];
     const sync = jest.fn(async () => {});
     mockGetOrCreateMultisigService.mockResolvedValue({ sync });
@@ -113,7 +113,7 @@ describe('syncGuardianAccounts', () => {
   });
 
   it('self-heals the update_guardian hardening once per account per session', async () => {
-    storeState.accounts = [{ publicKey: 'guardian-heal', type: WalletType.Guardian }];
+    storeState.accounts = [{ publicKey: 'guardian-heal', type: WalletType.Guardian, hotPublicKey: 'hot-heal' }];
     mockGetOrCreateMultisigService.mockResolvedValue({ sync: jest.fn(async () => {}) });
 
     await syncGuardianAccounts();
@@ -125,8 +125,8 @@ describe('syncGuardianAccounts', () => {
 
   it('continues syncing remaining accounts when one throws', async () => {
     storeState.accounts = [
-      { publicKey: 'guardian-bad', type: WalletType.Guardian },
-      { publicKey: 'guardian-good', type: WalletType.Guardian }
+      { publicKey: 'guardian-bad', type: WalletType.Guardian, hotPublicKey: 'hot-bad' },
+      { publicKey: 'guardian-good', type: WalletType.Guardian, hotPublicKey: 'hot-good' }
     ];
     const goodSync = jest.fn(async () => {});
     mockGetOrCreateMultisigService.mockRejectedValueOnce(new Error('boom')).mockResolvedValueOnce({ sync: goodSync });
@@ -142,7 +142,7 @@ describe('syncGuardianAccounts', () => {
     // getOrCreateMultisigService — skip them upstream so AutoSync stays quiet.
     storeState.accounts = [
       { publicKey: 'guardian-pending', type: WalletType.Guardian, requiresHotKeyRotation: true },
-      { publicKey: 'guardian-active', type: WalletType.Guardian }
+      { publicKey: 'guardian-active', type: WalletType.Guardian, hotPublicKey: 'hot-active' }
     ];
     const sync = jest.fn(async () => {});
     mockGetOrCreateMultisigService.mockResolvedValue({ sync });
@@ -153,4 +153,24 @@ describe('syncGuardianAccounts', () => {
     expect(mockGetOrCreateMultisigService).toHaveBeenCalledWith('guardian-active', zustandProvider);
     expect(sync).toHaveBeenCalledTimes(1);
   });
+
+  it('skips legacy Guardian accounts with no hot key (un-migrated / upgrade window)', async () => {
+    // A pre-3-key Guardian record carries neither hotPublicKey nor the
+    // requiresHotKeyRotation flag — e.g. right after a wallet upgrade and before
+    // the forced re-unlock runs migrateLegacyGuardianAccounts. getOrCreateMultisigService
+    // would throw "missing hotPublicKey" on it every cycle; skip it instead. The
+    // account is recovered by migration → Activate Device Key banner, not here.
+    storeState.accounts = [
+      { publicKey: 'guardian-legacy', type: WalletType.Guardian }, // no hotPublicKey, no rotation flag
+      { publicKey: 'guardian-active', type: WalletType.Guardian, hotPublicKey: 'hot-active' }
+    ];
+    const sync = jest.fn(async () => {});
+    mockGetOrCreateMultisigService.mockResolvedValue({ sync });
+
+    await expect(syncGuardianAccounts()).resolves.toBeUndefined();
+
+    // Only the active account is synced; the legacy one is skipped, no throw.
+    expect(mockGetOrCreateMultisigService).toHaveBeenCalledTimes(1);
+    expect(mockGetOrCreateMultisigService).toHaveBeenCalledWith('guardian-active', zustandProvider);
+  });
 });
diff --git a/src/lib/miden/front/guardian-sync.ts b/src/lib/miden/front/guardian-sync.ts
index e90c502c3..ee927476d 100644
--- a/src/lib/miden/front/guardian-sync.ts
+++ b/src/lib/miden/front/guardian-sync.ts
@@ -23,14 +23,23 @@ export const zustandProvider: GuardianAccountProvider = {
  * Sync Guardian state for all Guardian accounts. Called from AutoSync after chain
  * state sync (frontend context only — uses the Zustand-backed provider).
  *
- * Accounts flagged `requiresHotKeyRotation` (adopted via recovery or migrated
- * from a legacy single-signer record, hot key not yet activated) are skipped —
- * `getOrCreateMultisigService` binds against the hot signer and throws on
- * missing `hotPublicKey`. The Activate Device Key banner is the user's path to
- * flip that flag; once swapped, the next sync cycle picks the account up normally.
+ * Only Guardian accounts that actually carry a `hotPublicKey` are synced:
+ * `getOrCreateMultisigService` binds a service against the hot signer and throws
+ * without one. Every account lacking a hot key is skipped, which covers:
+ *   - rotation-pending accounts (`requiresHotKeyRotation`, adopted via recovery
+ *     or flagged by the legacy-Guardian migration) awaiting the Activate Device
+ *     Key banner, and
+ *   - legacy single-signer Guardian records that haven't been migrated yet —
+ *     e.g. the brief window after a wallet UPGRADE (new code, old storage) and
+ *     before the forced re-unlock runs `migrateLegacyGuardianAccounts`. Without
+ *     this guard those records made the frontend AutoSync throw "missing
+ *     hotPublicKey" every ~3s. Skipping them is correct, not a silence: there is
+ *     genuinely no hot-bound service to build, and recovery happens via the
+ *     migration → banner → activation path, not here.
+ * Once a hot key lands (`swapHotKey`), the next sync cycle picks the account up.
  *
  * This also means the `update_guardian` threshold-2 hardening is intentionally
- * NOT applied to these accounts here, and that's correct: a pre-activation
+ * NOT applied to hot-key-less accounts here, and that's correct: a pre-activation
  * account has a single on-chain signer (cold), so a 2-of-N procedure threshold
  * is unsatisfiable and would brick guardian changes. The hardening is applied
  * at activation (`completeReplaceHotKeyTransaction`), once the hot signer makes
@@ -42,7 +51,7 @@ const hardeningChecked = new Set<string>();
 
 export async function syncGuardianAccounts(): Promise<void> {
   const accounts = await zustandProvider.getAccounts();
-  const guardianAccounts = accounts.filter(acc => acc.type === WalletType.Guardian && !acc.requiresHotKeyRotation);
+  const guardianAccounts = accounts.filter(acc => acc.type === WalletType.Guardian && Boolean(acc.hotPublicKey));
 
   if (guardianAccounts.length === 0) return;
 

From 49bd9df361a8c203102062262a9f1689c93a2f41 Mon Sep 17 00:00:00 2001
From: Wiktor Starczewski <poszerny@gmail.com>
Date: Sat, 27 Jun 2026 00:43:16 +0200
Subject: [PATCH 71/71] fix(guardian): re-register rotated state on guardian
 after structural ops

---
 CHANGELOG.md                                  |   1 +
 .../activity/transactions.guardian.test.ts    | 119 +++++++++++++++++-
 src/lib/miden/activity/transactions.ts        |  54 +++++++-
 src/lib/miden/back/vault.test.ts              |  46 ++++++-
 src/lib/miden/back/vault.ts                   |  37 ++++++
 src/lib/miden/guardian/index.test.ts          |  54 ++++++++
 src/lib/miden/guardian/index.ts               |  77 ++++++++++--
 7 files changed, 372 insertions(+), 16 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e19de6d8e..bee04173a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 ### Fixes
 
+* [FIX][all] **Activating a device key on a migrated Guardian account no longer permanently breaks its sync.** After a structural rotation (`update_signers` for replace-hot-key, or the follow-up `update_procedure_threshold`), the wallet now pushes the new on-chain state back to the guardian. The OpenZeppelin multisig client only re-registers post-execution state on the guardian for `switch_guardian`; for the other structural ops it submitted the transaction on-chain but left the guardian serving the pre-rotation blob, so every subsequent ~3s guardian sync saw guardian-commitment ≠ on-chain and threw on `ensureSafeToOverwriteLocalState` — permanently, until a full reinstall. The re-registration runs before the hot-key pointer swap arms the sync, and the guardian sync now self-heals a lagging guardian by re-registering the current state once per run (which also recovers already-broken accounts without a reinstall). The legacy-Guardian migration additionally verifies the re-derived cold key matches the on-chain signer before flagging an account for activation. (#227)
 * [FIX][all] **Guardian sync no longer spams "missing hotPublicKey" errors for un-activated accounts.** `syncGuardianAccounts` now only syncs Guardian accounts that actually carry a hot key, instead of every account not flagged `requiresHotKeyRotation`. A legacy single-signer Guardian record that hasn't been migrated yet — e.g. in the brief window after a wallet upgrade (new code, old storage) and before the forced re-unlock runs the migration — has no hot key, so `getOrCreateMultisigService` threw on it every ~3s AutoSync tick. There's genuinely no hot-bound service to build for such accounts, so they're skipped; recovery still happens via the migration → Activate Device Key banner path on the next unlock. (#227)
 * [FIX][all] **Guardian operator endpoint is now tracked per account, and structural Guardian ops recover from a submit-then-local-apply failure.** Each Guardian account persists its own `guardianEndpoint` (set at create/recovery, updated on switch-guardian) instead of a single global setting, so two Guardian accounts on different operators no longer collide — older records without the field fall back to the legacy global value. Separately, when a `replace-hot-key` or `switch-guardian` transaction lands on chain but the local apply step throws, the wallet now runs the same finalization the happy path would (swapping the hot-key pointer, or re-registering on the new guardian and persisting its endpoint) instead of cancelling — which previously stranded the account signing with a rotated-out key or talking to the old guardian. (#227)
 * [FIX][all] **Guardian co-sign transactions are now serialized per account.** The Guardian co-signs one delta per account at a time, so concurrent same-account transactions (e.g. auto-consume racing a user claim, or rapid successive claims) made the Guardian's expected commitment diverge from on-chain — stalling its canonicalization for minutes and returning `409 ConflictPendingDelta` while a prior delta was still finalizing, which surfaced as a Guardian claim/send that never completes. Guardian transactions now take a per-account lock so at most one is ever in flight, and proposal creation waits out a transient `409` (a prior delta mid-canonicalization) instead of failing the transaction. (#297)
diff --git a/src/lib/miden/activity/transactions.guardian.test.ts b/src/lib/miden/activity/transactions.guardian.test.ts
index 6f22ae084..fe19ee237 100644
--- a/src/lib/miden/activity/transactions.guardian.test.ts
+++ b/src/lib/miden/activity/transactions.guardian.test.ts
@@ -14,11 +14,17 @@
 import {
   completeReplaceHotKeyTransaction,
   completeSwitchGuardianTransaction,
+  completeUpdateProcedureThresholdTransaction,
   generateTransaction,
   initiateReplaceHotKeyTransaction,
   initiateSwitchGuardianTransaction
 } from './transactions';
-import { ITransactionStatus, ReplaceHotKeyTransaction, SwitchGuardianTransaction } from '../db/types';
+import {
+  ITransactionStatus,
+  ReplaceHotKeyTransaction,
+  SwitchGuardianTransaction,
+  UpdateProcedureThresholdTransaction
+} from '../db/types';
 
 const txStore: Array<Record<string, unknown>> = [];
 const putToStorage = jest.fn(async (..._args: unknown[]) => {});
@@ -840,6 +846,71 @@ describe('completeReplaceHotKeyTransaction', () => {
     expect(row.displayMessage).toBe('Device key rotated');
   });
 
+  it('re-registers the rotated state on the guardian BEFORE swapping the hot pointer', async () => {
+    // The OZ lib doesn't push update_signers state to the guardian; we must, and
+    // before swapHotKey arms the 3s hot-sync — otherwise the guardian's stale blob
+    // makes every subsequent sync diverge.
+    const tx = new ReplaceHotKeyTransaction('acc-1', false);
+    tx.extraInputs = { newHotPublicKey: 'new-hot-pub' };
+    txStore.push({ id: tx.id, status: ITransactionStatus.GeneratingTransaction });
+
+    const order: string[] = [];
+    const reRegisterCurrentStateOnGuardian = jest.fn(async () => {
+      order.push('reregister');
+    });
+    const swapHotKey = jest.fn(async () => {
+      order.push('swap');
+    });
+    const provider = { ...makeGuardianProvider(true), swapHotKey };
+
+    await completeReplaceHotKeyTransaction(
+      tx,
+      makeResult() as never,
+      provider as never,
+      { reRegisterCurrentStateOnGuardian } as never
+    );
+
+    expect(reRegisterCurrentStateOnGuardian).toHaveBeenCalledTimes(1);
+    expect(swapHotKey).toHaveBeenCalledWith('acc-1', 'new-hot-pub');
+    expect(order).toEqual(['reregister', 'swap']);
+  });
+
+  it('still completes the rotation (best-effort) when the guardian re-registration fails', async () => {
+    const tx = new ReplaceHotKeyTransaction('acc-1', false);
+    tx.extraInputs = { newHotPublicKey: 'new-hot-pub' };
+    txStore.push({ id: tx.id, status: ITransactionStatus.GeneratingTransaction });
+
+    const swapHotKey = jest.fn(async () => {});
+    const provider = { ...makeGuardianProvider(true), swapHotKey };
+    const service = {
+      reRegisterCurrentStateOnGuardian: jest.fn(async () => {
+        throw new Error('guardian down');
+      })
+    };
+
+    await completeReplaceHotKeyTransaction(tx, makeResult() as never, provider as never, service as never);
+
+    expect(swapHotKey).toHaveBeenCalledWith('acc-1', 'new-hot-pub');
+    const row = txStore.find(r => r.id === tx.id) as Record<string, unknown>;
+    expect(row.status).toBe(ITransactionStatus.Completed);
+  });
+
+  it('marks the row Failed when the provider does not implement swapHotKey', async () => {
+    const tx = new ReplaceHotKeyTransaction('acc-1', false);
+    tx.extraInputs = { newHotPublicKey: 'new-hot-pub' };
+    txStore.push({ id: tx.id, status: ITransactionStatus.GeneratingTransaction });
+
+    // A provider without swapHotKey (e.g. the frontend zustand provider) cannot
+    // finalize a rotation — it must fail loudly rather than half-complete.
+    const provider = makeGuardianProvider(true);
+
+    await completeReplaceHotKeyTransaction(tx, makeResult() as never, provider as never);
+
+    const row = txStore.find(r => r.id === tx.id) as Record<string, unknown>;
+    expect(row.status).toBe(ITransactionStatus.Failed);
+    expect(row.error).toContain('swapHotKey not implemented');
+  });
+
   it('enqueues a procedure-threshold hardening tx after rotation when update_guardian is unhardened', async () => {
     const tx = new ReplaceHotKeyTransaction('acc-1', false);
     tx.extraInputs = { newHotPublicKey: 'new-hot-pub' };
@@ -928,3 +999,49 @@ describe('completeReplaceHotKeyTransaction', () => {
     expect(row.displayMessage).toBe('Failed to rotate device key');
   });
 });
+
+describe('completeUpdateProcedureThresholdTransaction', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    txStore.length = 0;
+  });
+
+  it('marks Completed, drops the cached service, and re-registers the new state on the guardian', async () => {
+    const tx = new UpdateProcedureThresholdTransaction('acc-1', 'update_guardian', 2, false);
+    txStore.push({ id: tx.id, status: ITransactionStatus.GeneratingTransaction });
+
+    const reRegisterCurrentStateOnGuardian = jest.fn(async () => {});
+
+    await completeUpdateProcedureThresholdTransaction(
+      tx,
+      makeResult() as never,
+      {
+        reRegisterCurrentStateOnGuardian
+      } as never
+    );
+
+    expect(reRegisterCurrentStateOnGuardian).toHaveBeenCalledTimes(1);
+    expect(mockClearGuardianServiceFor).toHaveBeenCalledWith('acc-1');
+    const row = txStore.find(r => r.id === tx.id) as Record<string, unknown>;
+    expect(row.status).toBe(ITransactionStatus.Completed);
+    expect(row.displayMessage).toBe('Account secured');
+  });
+
+  it('still completes (best-effort) when the guardian re-registration fails', async () => {
+    const tx = new UpdateProcedureThresholdTransaction('acc-1', 'update_guardian', 2, false);
+    txStore.push({ id: tx.id, status: ITransactionStatus.GeneratingTransaction });
+
+    await completeUpdateProcedureThresholdTransaction(
+      tx,
+      makeResult() as never,
+      {
+        reRegisterCurrentStateOnGuardian: jest.fn(async () => {
+          throw new Error('guardian down');
+        })
+      } as never
+    );
+
+    const row = txStore.find(r => r.id === tx.id) as Record<string, unknown>;
+    expect(row.status).toBe(ITransactionStatus.Completed);
+  });
+});
diff --git a/src/lib/miden/activity/transactions.ts b/src/lib/miden/activity/transactions.ts
index 212a7577b..36d64d619 100644
--- a/src/lib/miden/activity/transactions.ts
+++ b/src/lib/miden/activity/transactions.ts
@@ -431,7 +431,11 @@ export const initiateReplaceHotKeyTransaction = async (
 export const completeReplaceHotKeyTransaction = async (
   tx: ReplaceHotKeyTransaction,
   result: TransactionResult | undefined,
-  guardianProvider: GuardianAccountProvider
+  guardianProvider: GuardianAccountProvider,
+  // The cold MultisigService used to drive the rotation. Supplied on the normal
+  // path so we can push the rotated state to the guardian below; absent on the
+  // apply-after-submit-failed reconcile path (runSync self-heals that case).
+  service?: MultisigService
 ) => {
   try {
     const newHotPublicKey = tx.extraInputs?.newHotPublicKey;
@@ -442,6 +446,22 @@ export const completeReplaceHotKeyTransaction = async (
     if (!guardianProvider.swapHotKey) {
       throw new Error('swapHotKey not implemented in this provider');
     }
+
+    // The OZ lib submitted `update_signers` on-chain but did NOT re-register the
+    // rotated state on the guardian (it only does that for switch_guardian). Push
+    // it now — BEFORE `swapHotKey`, which sets `hotPublicKey` and thereby arms the
+    // ~3s guardian hot-sync. If we let the hot-sync start with the guardian's blob
+    // still pre-rotation, every tick throws on the guardian-vs-on-chain mismatch
+    // until a reinstall. Best-effort: an on-chain-successful rotation must not be
+    // failed by a guardian blip — runSync re-registers on a later tick if this slips.
+    if (service) {
+      try {
+        await service.reRegisterCurrentStateOnGuardian();
+      } catch (e) {
+        console.warn('Failed to re-register rotated state on guardian post-replace-hot-key (non-fatal):', e);
+      }
+    }
+
     // Vault.swapHotKey resolves the previous hot pubkey from the persisted
     // WalletAccount and is idempotent: if the record already reflects
     // `newHotPublicKey` (retry), the cleanup branch is a no-op.
@@ -538,7 +558,10 @@ export const initiateUpdateProcedureThresholdTransaction = async (
 
 export const completeUpdateProcedureThresholdTransaction = async (
   tx: UpdateProcedureThresholdTransaction,
-  result: TransactionResult
+  result: TransactionResult,
+  // The cold MultisigService used to drive the threshold change, so we can push
+  // the new state to the guardian (the OZ lib doesn't re-register it).
+  service?: MultisigService
 ) => {
   const executedTx = result.executedTransaction();
   await updateTransactionStatus(tx.id, ITransactionStatus.Completed, {
@@ -549,6 +572,18 @@ export const completeUpdateProcedureThresholdTransaction = async (
   });
   // The cached service's procedureThresholds are now stale — drop it.
   clearGuardianServiceFor(tx.accountId);
+
+  // Same gap as replace-hot-key: the OZ lib submitted `update_procedure_threshold`
+  // on-chain but never re-registered the new state on the guardian. Push it so the
+  // guardian's blob tracks the new threshold and the next sync doesn't diverge.
+  // Best-effort; runSync self-heals if this slips.
+  if (service) {
+    try {
+      await service.reRegisterCurrentStateOnGuardian();
+    } catch (e) {
+      console.warn('Failed to re-register state on guardian post-update-procedure-threshold (non-fatal):', e);
+    }
+  }
 };
 
 export const completeSwitchGuardianTransaction = async (
@@ -1286,7 +1321,14 @@ const generateGuardianTransaction = async (
   // complete only happens once the on-chain rotation is final — otherwise a
   // resync could race with stale on-chain state and pick the wrong canonical
   // hot pubkey.
-  if (transaction.type === 'switch-guardian' || transaction.type === 'replace-hot-key') {
+  // For update-procedure-threshold, we wait so the post-completion guardian
+  // re-registration serializes the COMMITTED post-threshold state — otherwise it
+  // could push a pre-threshold blob and leave the guardian diverged again.
+  if (
+    transaction.type === 'switch-guardian' ||
+    transaction.type === 'replace-hot-key' ||
+    transaction.type === 'update-procedure-threshold'
+  ) {
     await setTransactionStage(transaction.id, 'confirming');
     await withWasmClientLock(async () => {
       const midenClient = await getMidenClient();
@@ -1315,14 +1357,16 @@ const generateGuardianTransaction = async (
       await completeReplaceHotKeyTransaction(
         transaction as ReplaceHotKeyTransaction,
         transactionResult,
-        guardianProvider
+        guardianProvider,
+        service
       );
       break;
     case 'update-procedure-threshold':
       console.log('Completing update-procedure-threshold transaction');
       await completeUpdateProcedureThresholdTransaction(
         transaction as UpdateProcedureThresholdTransaction,
-        transactionResult
+        transactionResult,
+        service
       );
       break;
     case 'execute':
diff --git a/src/lib/miden/back/vault.test.ts b/src/lib/miden/back/vault.test.ts
index 5c05b1d23..fd5cee954 100644
--- a/src/lib/miden/back/vault.test.ts
+++ b/src/lib/miden/back/vault.test.ts
@@ -97,6 +97,14 @@ jest.mock('lib/secure-hot-key', () => ({
   signHotDigest: jest.fn()
 }));
 
+// migrateLegacyGuardianAccounts verifies the derived cold key against the
+// on-chain index-0 signer via getSignerDetailsFromAccount. Mock it so tests can
+// drive the match / mismatch branches.
+const mockGetSignerDetailsFromAccount = jest.fn();
+jest.mock('../guardian/account', () => ({
+  getSignerDetailsFromAccount: (...a: unknown[]) => mockGetSignerDetailsFromAccount(...a)
+}));
+
 // Unified handle used by tests — matches the old mockMidenClient API.
 const mockMidenClient = {
   createMidenWallet: mockCreateMidenWallet,
@@ -1412,10 +1420,20 @@ describe('Vault.migrateLegacyGuardianAccounts', () => {
   beforeEach(() => {
     // Cold-key derivation is mocked to a fixed key; `deriveClientSeed` still runs
     // real BIP-39 over VALID_MNEMONIC but the seed it produces is ignored here.
+    // The derived key's commitment is `0x020304` (the verification compares this
+    // against the on-chain index-0 signer below).
     sdk.AuthSecretKey.ecdsaWithRNG.mockImplementation(() => ({
-      publicKey: () => ({ serialize: () => new Uint8Array([0x00, 0x02, 0x03, 0x04]) }),
+      publicKey: () => ({
+        serialize: () => new Uint8Array([0x00, 0x02, 0x03, 0x04]),
+        toCommitment: () => ({ toHex: () => '0x020304' })
+      }),
       serialize: () => new Uint8Array([0xab, 0xcd])
     }));
+    // By default the on-chain account is present and its index-0 signer matches
+    // the derived cold commitment, so the legacy account migrates (verified).
+    mockGetAccount.mockResolvedValue({ id: () => ({ toString: () => 'guardian-legacy' }) });
+    mockGetSignerDetailsFromAccount.mockReset();
+    mockGetSignerDetailsFromAccount.mockResolvedValue({ commitment: '020304' });
   });
 
   const legacyGuardian = {
@@ -1493,6 +1511,32 @@ describe('Vault.migrateLegacyGuardianAccounts', () => {
     expect(sdk.AuthSecretKey.ecdsaWithRNG).not.toHaveBeenCalled();
   });
 
+  it('skips a legacy account whose derived cold key does NOT match the on-chain signer', async () => {
+    // The on-chain index-0 signer is some other commitment — installing the
+    // re-derived key + flagging rotation would arm an activation that can never
+    // authorize on-chain, so the account is left untouched.
+    mockGetSignerDetailsFromAccount.mockResolvedValue({ commitment: 'deadbeef' });
+    const vault = await seedVault('pw', { accounts: [legacyGuardian] as any });
+    await vault.migrateLegacyGuardianAccounts();
+
+    const acc = (await vault.fetchAccounts()).find(a => a.publicKey === 'guardian-legacy')!;
+    expect(acc.coldPublicKey).toBeUndefined();
+    expect(acc.requiresHotKeyRotation).toBeUndefined();
+  });
+
+  it('migrates unverified when the on-chain account is unavailable to verify against', async () => {
+    // Can't load the account (e.g. not synced yet) → can't confirm a mismatch →
+    // fall back to migrating so the account isn't permanently stuck. No regression.
+    mockGetAccount.mockResolvedValue(null);
+    const vault = await seedVault('pw', { accounts: [legacyGuardian] as any });
+    await vault.migrateLegacyGuardianAccounts();
+
+    const acc = (await vault.fetchAccounts()).find(a => a.publicKey === 'guardian-legacy')!;
+    expect(acc.coldPublicKey).toBe('020304');
+    expect(acc.requiresHotKeyRotation).toBe(true);
+    expect(mockGetSignerDetailsFromAccount).not.toHaveBeenCalled();
+  });
+
   it('never throws (best-effort) — a failure cannot block unlock', async () => {
     const vault = await seedVault('pw', { accounts: [legacyGuardian] as any });
     jest.spyOn(vault as any, 'fetchAccounts').mockRejectedValueOnce(new Error('boom'));
diff --git a/src/lib/miden/back/vault.ts b/src/lib/miden/back/vault.ts
index f9cf08f15..a495f2dce 100644
--- a/src/lib/miden/back/vault.ts
+++ b/src/lib/miden/back/vault.ts
@@ -33,6 +33,7 @@ import { WalletType } from 'screens/onboarding/types';
 import { compareAccountIds } from '../activity/utils';
 import { fetchFromStorage, putToStorage } from '../front/storage';
 import type { CreatedGuardianKeys } from '../guardian/account';
+import { getSignerDetailsFromAccount } from '../guardian/account';
 import { getBech32AddressFromAccountId } from '../sdk/helpers';
 import { getMidenClient, withWasmClientLock } from '../sdk/miden-client';
 import { MidenClientCreateOptions } from '../sdk/miden-client-interface';
@@ -980,6 +981,10 @@ export class Vault {
       if (!mnemonic) return; // can't derive the cold key without the seed — leave untouched
 
       // accountId -> derived cold public key, for the records we successfully migrated.
+      // Strip an optional `0x` and lower-case so commitments compare regardless
+      // of how each side formats its hex.
+      const normalizeCommitmentHex = (hex: string): string => (hex.startsWith('0x') ? hex.slice(2) : hex).toLowerCase();
+
       const migrated = new Map<string, string>();
       for (const acc of legacy) {
         try {
@@ -987,6 +992,38 @@ export class Vault {
           const coldSk = AuthSecretKey.ecdsaWithRNG(coldSeed);
           const coldPublicKey = Buffer.from(coldSk.publicKey().serialize().slice(1)).toString('hex');
           const coldSecretKeyHex = Buffer.from(coldSk.serialize()).toString('hex');
+
+          // Verify the derived cold key actually matches the account's on-chain
+          // signer BEFORE installing it. The derivation assumes the legacy signer
+          // was `ecdsaWithRNG(deriveClientSeed(Guardian, mnemonic, hdIndex))`; if
+          // that assumption is wrong for this account (a differently-derived or
+          // Falcon signer), installing the derived key + flagging rotation would
+          // let the user start an activation that can never authorize on-chain.
+          // Best-effort: only BLOCK on a confirmed mismatch; if the on-chain
+          // account can't be loaded/read, migrate unverified (no regression).
+          const coldCommitment = normalizeCommitmentHex(coldSk.publicKey().toCommitment().toHex());
+          try {
+            const sdkAccount = await withWasmClientLock(async () => (await getMidenClient()).getAccount(acc.publicKey));
+            if (sdkAccount) {
+              const { commitment: onChainSigner } = await getSignerDetailsFromAccount(sdkAccount, false);
+              if (normalizeCommitmentHex(onChainSigner) !== coldCommitment) {
+                console.warn(
+                  `[Vault.migrateLegacyGuardianAccounts] derived cold key does not match on-chain signer for ${acc.publicKey}; skipping (needs manual recovery)`
+                );
+                continue;
+              }
+            } else {
+              console.warn(
+                `[Vault.migrateLegacyGuardianAccounts] on-chain account unavailable to verify cold key for ${acc.publicKey}; migrating unverified`
+              );
+            }
+          } catch (verifyErr) {
+            console.warn(
+              `[Vault.migrateLegacyGuardianAccounts] cold-key verification failed for ${acc.publicKey} (migrating unverified):`,
+              verifyErr
+            );
+          }
+
           await persistRecoveredGuardianColdKey(this.vaultKey, coldPublicKey, coldSecretKeyHex);
           migrated.set(acc.publicKey, coldPublicKey);
         } catch (e) {
diff --git a/src/lib/miden/guardian/index.test.ts b/src/lib/miden/guardian/index.test.ts
index bdcde30b3..785d07029 100644
--- a/src/lib/miden/guardian/index.test.ts
+++ b/src/lib/miden/guardian/index.test.ts
@@ -363,6 +363,60 @@ describe('MultisigService', () => {
         (global as unknown as { setTimeout: typeof setTimeout }).setTimeout = origSetTimeout;
       }
     });
+
+    it('self-heals a lagging guardian: re-registers current state, then the retried sync succeeds', async () => {
+      // The OZ lib refuses to overwrite local state when the guardian's blob lags
+      // on-chain; once we push the current state to the guardian, the retry passes.
+      const syncState = jest
+        .fn()
+        .mockRejectedValueOnce(
+          new Error('Refusing to overwrite local state: incoming commitment does not match on-chain commitment')
+        )
+        .mockResolvedValueOnce(undefined);
+      const registerOnGuardian = jest.fn(async () => {});
+      const multisig = makeMultisig({ syncState, registerOnGuardian });
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+      mockGetAccount.mockResolvedValue({ serialize: () => new Uint8Array([1, 2, 3]) });
+
+      await service.sync();
+
+      expect(registerOnGuardian).toHaveBeenCalledTimes(1);
+      expect(syncState).toHaveBeenCalledTimes(2);
+    });
+
+    it('attempts the guardian realign only once per run, then propagates a persistent failure', async () => {
+      const syncState = jest.fn(async () => Promise.reject(new Error('Refusing to overwrite local state')));
+      const registerOnGuardian = jest.fn(async () => {});
+      const multisig = makeMultisig({ syncState, registerOnGuardian });
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+      mockGetAccount.mockResolvedValue({ serialize: () => new Uint8Array([1, 2, 3]) });
+
+      await expect(service.sync()).rejects.toThrow('Refusing to overwrite local state');
+      expect(registerOnGuardian).toHaveBeenCalledTimes(1); // not looped
+      expect(syncState).toHaveBeenCalledTimes(2); // initial + one retry after realign
+    });
+  });
+
+  describe('reRegisterCurrentStateOnGuardian', () => {
+    it('syncs, serializes the current account, and re-registers it on the guardian', async () => {
+      const registerOnGuardian = jest.fn(async () => {});
+      const multisig = makeMultisig({ registerOnGuardian });
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+      mockGetAccount.mockResolvedValue({ serialize: () => new Uint8Array([0xaa, 0xbb]) });
+
+      await service.reRegisterCurrentStateOnGuardian();
+
+      expect(mockSyncState).toHaveBeenCalled();
+      expect(registerOnGuardian).toHaveBeenCalledTimes(1);
+    });
+
+    it('throws when the account is missing from the local client', async () => {
+      const multisig = makeMultisig();
+      const service = new MultisigService(multisig as never, {} as never, 'https://x');
+      mockGetAccount.mockResolvedValue(null);
+
+      await expect(service.reRegisterCurrentStateOnGuardian()).rejects.toThrow('missing from local client');
+    });
   });
 
   describe('importAccountFromGuardian', () => {
diff --git a/src/lib/miden/guardian/index.ts b/src/lib/miden/guardian/index.ts
index 71864f992..930c16935 100644
--- a/src/lib/miden/guardian/index.ts
+++ b/src/lib/miden/guardian/index.ts
@@ -265,23 +265,54 @@ export class MultisigService {
     // around each `syncState` attempt and release during the back-off wait so
     // other client operations can proceed between retries.
     this.syncRetryCount = 0;
+    // The guardian-realign self-heal below runs at most once per sync run so a
+    // genuinely stuck guardian doesn't loop re-registering every tick.
+    let realignAttempted = false;
     for (;;) {
       try {
         await withWasmClientLock(() => this.multisig.syncState());
         this.syncRetryCount = 0; // Reset retry count on successful sync
         return;
       } catch (error) {
-        const isNonceTooLow =
-          error instanceof Error && error.message.includes('nonce') && error.message.includes('too low');
-        if (!isNonceTooLow) {
-          throw error; // Rethrow if it's a different error
+        const message = error instanceof Error ? error.message : String(error);
+        const isNonceTooLow = message.includes('nonce') && message.includes('too low');
+        if (isNonceTooLow) {
+          if (this.syncRetryCount >= MAX_SYNC_RETRIES) {
+            throw new Error('Max sync retries reached: local state is ahead of on-chain state');
+          }
+          this.syncRetryCount++;
+          console.warn(
+            'Nonce is too low, local state is ahead of on-chain state, retrying sync...',
+            this.syncRetryCount
+          );
+          await delay(SYNC_RETRY_DELAY_MS);
+          continue;
         }
-        if (this.syncRetryCount >= MAX_SYNC_RETRIES) {
-          throw new Error('Max sync retries reached: local state is ahead of on-chain state');
+
+        // `multisig.syncState` refuses to overwrite local state when the guardian's
+        // stored blob lags the on-chain account ("Refusing to overwrite local
+        // state ..." / commitment-mismatch). The OZ lib only re-registers
+        // structural rotations on the guardian for `switch_guardian`; after a
+        // replace-hot-key (`update_signers`) or `update_procedure_threshold` the
+        // guardian's blob is never updated, so it diverges from on-chain and this
+        // throws every ~3s AutoSync tick — forever, until a full reinstall. Self-heal
+        // once per run: push our current on-chain state up to the guardian (see
+        // `reRegisterCurrentStateOnGuardian`) so it realigns, then retry the sync.
+        // Best-effort: if the realign itself fails, fall through to the original error.
+        if (!realignAttempted) {
+          realignAttempted = true;
+          try {
+            console.warn(
+              'Guardian sync failed; realigning guardian to current on-chain state, then retrying:',
+              message
+            );
+            await this.reRegisterCurrentStateOnGuardian();
+            continue;
+          } catch (realignError) {
+            console.warn('Guardian re-registration during sync failed (non-fatal):', realignError);
+          }
         }
-        this.syncRetryCount++;
-        console.warn('Nonce is too low, local state is ahead of on-chain state, retrying sync...', this.syncRetryCount);
-        await delay(SYNC_RETRY_DELAY_MS);
+        throw error; // Rethrow if it's a different error (caller logs per-account)
       }
     }
   }
@@ -427,6 +458,34 @@ export class MultisigService {
     }
     throw new Error('Failed to register account on the new guardian after switching', { cause: lastError });
   }
+
+  /**
+   * Push this account's CURRENT on-chain state to its (unchanged) guardian, so the
+   * guardian's stored blob tracks structural rotations.
+   *
+   * Upstream `multisig.executeProposal` only re-registers the post-execution state
+   * on the guardian for `switch_guardian` proposals; for `update_signers`
+   * (replace-hot-key) and `update_procedure_threshold` it submits the tx on-chain
+   * but never updates the guardian. Without this push, the guardian's `getState`
+   * keeps serving the pre-rotation blob, so the next `multisig.syncState` sees
+   * guardian-commitment != on-chain-commitment and throws on
+   * `ensureSafeToOverwriteLocalState` every ~3s tick — permanently, until a full
+   * reinstall re-registers the account. Mirrors `finalizeGuardianSwitch`'s
+   * registration step but keeps the same guardian endpoint. Idempotent: if the
+   * guardian already has this state, re-registering is a no-op.
+   */
+  async reRegisterCurrentStateOnGuardian(): Promise<void> {
+    const updatedStateBase64 = await withWasmClientLock(async () => {
+      const client = await getMidenClient();
+      await client.syncState();
+      const account = await client.getAccount(this.accountId);
+      if (!account) {
+        throw new Error(`Account ${this.accountId} is missing from local client`);
+      }
+      return u8ToB64(account.serialize());
+    });
+    await this.registerOnGuardianWithRetry(updatedStateBase64);
+  }
 }
 
 // Re-export types that may be needed by consumers