Release candidate v1.2.4

[Gohlub]

Includes:

• WASM module initialization fix for provider SIgnTx flow

note to self: harden the initialization to fail gracefully when module isn't available

[greptile-apps]

Greptile Summary

This release candidate (v1.2.4) fixes a WASM module initialization race in the provider SignTx flow, refactors UTXO sync into a shared deduplicated helper, and adds a "Max" button to the bridge swap screen backed by a new estimateMaxBridgeAmount vault method with iterative fee refinement.

• WASM init fix: ensureWasmInitialized now guards concurrent callers with a single shared promise and resets on failure, preventing double-init races in the SignTx handler.
• Max bridge estimation: estimateMaxBridgeAmount uses a probe-then-refine loop (up to 3 buildBridgeTransactionContext calls) to arrive at a stable fee-adjusted max, exposed via a new ESTIMATE_MAX_BRIDGE background handler and a "Max" button in SwapScreen.
• Local SDK path: @nockbox/iris-sdk is referenced as file:../iris-sdk and the lock file version (1.2.3) does not match package.json (1.2.4), both of which need to be resolved before this can ship.

Confidence Score: 3/5

Not safe to merge as-is — the SDK dependency resolves to a local sibling directory, so the build will fail on any machine other than the author's.

The @nockbox/iris-sdk dependency in package.json points to file:../iris-sdk, and the lock file confirms this resolution. Any CI runner or collaborator without that exact directory layout cannot install dependencies at all, making the release candidate unbuildable outside the author's machine. The lock file version mismatch compounds this. The code changes themselves (WASM init fix, vault estimation, swap screen) look well-structured, but neither can ship while the packaging is broken.

package.json and package-lock.json — the local file:// SDK reference and the version discrepancy must be corrected before release.

Important Files Changed

Filename	Overview
extension/shared/wasm-utils.ts	Adds a deduplication promise to prevent concurrent WASM init races; resets the promise on failure so retries are allowed. Clean fix.
extension/background/index.ts	Adds ensureWasmInitialized before SignTx flow, refactors UTXO sync into a shared helper, adds ESTIMATE_MAX_BRIDGE handler, and properly wires queue-based sub-wallet discovery with an initial sync kick-off.
extension/shared/vault.ts	Adds estimateMaxBridgeAmount with iterative fee refinement, moves validateBridgeTransaction into buildBridgeTransactionContext (pre-signing), and adds guard.isRawTxV1 checks throughout bridge flow.
package.json	Bumps to v1.2.4 but replaces the published SDK reference with a local file:// path that will break any build environment without the sibling iris-sdk directory.
package-lock.json	Lock file version (1.2.3) is out of sync with package.json (1.2.4) and resolves @nockbox/iris-sdk to a local file path, making reproducible builds impossible outside the author's machine.
extension/popup/screens/SwapScreen.tsx	Adds Max button for bridge amount estimation with proper loading/error state; disables Review button while estimating to prevent concurrent actions.
extension/shared/v0-migration.ts	Adds guard.isRawTxV1 check before using signedRawTx as a v1 type in the migration flow.
extension/shared/constants.ts	Adds ESTIMATE_MAX_BRIDGE constant for the new max bridge estimation RPC method.
extension/popup/screens/onboarding/ImportScreen.tsx	Adds void fetchBalance() call before refreshWalletAccounts on import success to eagerly populate balance state.

Sequence Diagram

sequenceDiagram
    participant UI as SwapScreen
    participant BG as Background
    participant V as Vault
    participant WASM as WASM Module

    UI->>BG: ESTIMATE_MAX_BRIDGE [destAddress]
    BG->>V: estimateMaxBridgeAmount(dest)
    V->>V: getAvailableNotes()
    V->>V: buildBridgeTransactionContext(minAmount, useAllNotes)
    V->>WASM: buildBridgeTransaction(...)
    WASM-->>V: bridgeResult (fee)
    V->>V: "maxAmount = total - fee"
    loop up to 2 refinements
        V->>V: buildBridgeTransactionContext(maxAmount, useAllNotes)
        V->>WASM: buildBridgeTransaction(...)
        WASM-->>V: bridgeResult (nextFee)
        V->>V: converge on stable maxAmount
    end
    V-->>BG: "{ maxAmount, fee, totalAvailable, utxoCount }"
    BG-->>UI: result
    UI->>UI: setAmount(formatNock(maxAmountNock))

    UI->>BG: SIGN_TX (provider flow)
    BG->>WASM: ensureWasmInitialized()
    WASM-->>BG: initialized
    BG->>WASM: nockchainTxToRawTx(tx)
    WASM-->>BG: rawTx

Loading

Prompt To Fix All With AI

Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 2
package.json:33
**Local file-path SDK dependency in a release candidate**

`"@nockbox/iris-sdk": "file:../iris-sdk"` resolves to a sibling directory on the developer's machine. Any CI/CD pipeline, other developer, or production build that doesn't have `iris-sdk` checked out at exactly `../iris-sdk` will fail at `npm install`. A release candidate must pin to a published registry version, a git tag, or at minimum a commit SHA on the GitHub source (the format that was used before this change: `github:nockbox/iris-sdk#<sha>`).

### Issue 2 of 2
package-lock.json:4
**Lock file version lags behind `package.json`**

`package-lock.json` still records `"version": "1.2.3"` while `package.json` declares `"version": "1.2.4"`. npm detects this inconsistency and prints a warning; some stricter CI setups treat it as an error. Running `npm install` (or `npm version`) will regenerate the lock file, but shipping them out of sync in a release candidate is fragile — a clean install in a fresh environment can produce unexpected behavior.

_{Reviews (2): Last reviewed commit: "feat: add *MAX* path for bridging" | Re-trigger Greptile}

[greptile-apps]

Local file-path SDK dependency in a release candidate

"@nockbox/iris-sdk": "file:../iris-sdk" resolves to a sibling directory on the developer's machine. Any CI/CD pipeline, other developer, or production build that doesn't have iris-sdk checked out at exactly ../iris-sdk will fail at npm install. A release candidate must pin to a published registry version, a git tag, or at minimum a commit SHA on the GitHub source (the format that was used before this change: github:nockbox/iris-sdk#<sha>).

Prompt To Fix With AI

This is a comment left during a code review.
Path: package.json
Line: 33

Comment:
**Local file-path SDK dependency in a release candidate**

`"@nockbox/iris-sdk": "file:../iris-sdk"` resolves to a sibling directory on the developer's machine. Any CI/CD pipeline, other developer, or production build that doesn't have `iris-sdk` checked out at exactly `../iris-sdk` will fail at `npm install`. A release candidate must pin to a published registry version, a git tag, or at minimum a commit SHA on the GitHub source (the format that was used before this change: `github:nockbox/iris-sdk#<sha>`).

How can I resolve this? If you propose a fix, please make it concise.