@seams/wallet 0.7.1 → 0.7.3

package/THIRD_PARTY_NOTICES.md

@@ -5,7 +5,7 @@ distributed Seams Wallet SDK, server runtime, Wasm, strict Workers, and CLI.
 Dependency license expressions come from their package metadata. Packaged
 license and notice wording is reproduced below with normalized whitespace.
 
-Inventory: 522 dependency records (110 npm, 412 Cargo).
+Inventory: 518 dependency records (110 npm, 408 Cargo).
 
 ## Dependency inventory
 
@@ -26,7 +26,6 @@ Inventory: 522 dependency records (110 npm, 412 Cargo).
 | cargo | base64 | 0.23.1 | MIT OR Apache-2.0 | Marshall Pierce <marshall@mpierce.org> |
 | cargo | base64ct | 1.8.0 | Apache-2.0 OR MIT | RustCrypto Developers |
 | cargo | base64ct | 1.8.3 | Apache-2.0 OR MIT | RustCrypto Developers |
-| cargo | bincode | 1.3.3 | MIT | David Tolnay <dtolnay@gmail.com>; Francesco Mazzoli <f@mazzo.li>; Ty Overby <ty@pre-alpha.com>; Zoey Riordan <zoey@dos.cafe> |
 | cargo | bitflags | 2.13.0 | MIT OR Apache-2.0 | The Rust Project Developers |
 | cargo | bitflags | 2.13.1 | MIT OR Apache-2.0 | The Rust Project Developers |
 | cargo | block-buffer | 0.10.4 | MIT OR Apache-2.0 | RustCrypto Developers |
@@ -157,7 +156,6 @@ Inventory: 522 dependency records (110 npm, 412 Cargo).
 | cargo | hashbrown | 0.17.1 | MIT OR Apache-2.0 |  |
 | cargo | hashlink | 0.9.1 | MIT OR Apache-2.0 | kyren <kerriganw@gmail.com> |
 | cargo | heapless | 0.7.17 | MIT OR Apache-2.0 | Emil Fresk <emil.fresk@gmail.com>; Jorge Aparicio <jorge@japaric.io>; Per Lindgren <per.lindgren@ltu.se> |
-| cargo | hex-literal | 0.4.1 | MIT OR Apache-2.0 | RustCrypto Developers |
 | cargo | hex | 0.4.3 | MIT OR Apache-2.0 | KokaKiwi <kokakiwi@kokakiwi.net> |
 | cargo | hkdf | 0.12.4 | MIT OR Apache-2.0 | RustCrypto Developers |
 | cargo | hkdf | 0.13.0 | MIT OR Apache-2.0 | RustCrypto Developers |
@@ -251,8 +249,6 @@ Inventory: 522 dependency records (110 npm, 412 Cargo).
 | cargo | rand_core | 0.9.5 | MIT OR Apache-2.0 | The Rand Project Developers; The Rust Project Developers |
 | cargo | rfc6979 | 0.4.0 | Apache-2.0 OR MIT | RustCrypto Developers |
 | cargo | ring | 0.17.14 | Apache-2.0 AND ISC |  |
-| cargo | rmp-serde | 1.3.1 | MIT | Evgeny Safronov <division494@gmail.com> |
-| cargo | rmp | 0.8.15 | MIT | Evgeny Safronov <division494@gmail.com>; Kornel <kornel@geekhood.net> |
 | cargo | rusqlite | 0.32.1 | MIT | The rusqlite developers |
 | cargo | rustc_version | 0.4.1 | MIT OR Apache-2.0 |  |
 | cargo | rustls-native-certs | 0.8.4 | Apache-2.0 OR ISC OR MIT |  |
@@ -9739,37 +9735,6 @@ Applies to:
     DEALINGS IN THE SOFTWARE.
 
 
-### 90d7e062634054e6
-
-Packaged as: LICENSE.md
-
-Applies to:
-
-- cargo:bincode@1.3.3
-
-    The MIT License (MIT)
-
-    Copyright (c) 2014 Ty Overby
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to deal
-    in the Software without restriction, including without limitation the rights
-    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-    copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all
-    copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    SOFTWARE.
-
-
 ### 9117d922e6671255
 
 Packaged as: LICENSE-MIT
@@ -10033,38 +9998,6 @@ Applies to:
     THE SOFTWARE.
 
 
-### 979d35e1d1572891
-
-Packaged as: LICENSE
-
-Applies to:
-
-- cargo:rmp-serde@1.3.1
-- cargo:rmp@0.8.15
-
-    MIT License
-
-    Copyright (c) 2017 Evgeny Safronov
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to deal
-    in the Software without restriction, including without limitation the rights
-    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-    copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all
-    copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    SOFTWARE.
-
-
 ### 98181e7249d0c017
 
 Packaged as: LICENSE-MIT
@@ -11372,7 +11305,6 @@ Applies to:
 - cargo:ghash@0.5.1
 - cargo:hash2curve@0.14.0
 - cargo:hash2curve@0.14.0-rc.12
-- cargo:hex-literal@0.4.1
 - cargo:hkdf@0.12.4
 - cargo:hkdf@0.13.0
 - cargo:hmac@0.12.1
@@ -15147,42 +15079,6 @@ Applies to:
     DEALINGS IN THE SOFTWARE.
 
 
-### fbe7b9b51878efdf
-
-Packaged as: LICENSE-MIT
-
-Applies to:
-
-- cargo:hex-literal@0.4.1
-
-    Copyright (c) 2018 Artyom Pavlov
-    Copyright (c) 2018 The RustCrypto Project Developers
-
-    Permission is hereby granted, free of charge, to any
-    person obtaining a copy of this software and associated
-    documentation files (the "Software"), to deal in the
-    Software without restriction, including without
-    limitation the rights to use, copy, modify, merge,
-    publish, distribute, sublicense, and/or sell copies of
-    the Software, and to permit persons to whom the Software
-    is furnished to do so, subject to the following
-    conditions:
-
-    The above copyright notice and this permission notice
-    shall be included in all copies or substantial portions
-    of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
-    ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
-    TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
-    PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
-    SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-    CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-    OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
-    IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
-    DEALINGS IN THE SOFTWARE.
-
-
 ### fd80a26fbb3f644a
 
 Packaged as: LICENSE-MIT.md

package/dist/.build-inputs.sha256

@@ -1 +1 @@
-012e18a174e18cadb63450c89dce93355318d8cb8b75769ca27a6facd771cd83
+3cc408d97f9589145a26282262beee98f19671404d60cfe9373dbe147ef10de6

package/dist/esm/SeamsWeb/SeamsWeb.js

@@ -42,11 +42,12 @@ import { parseWalletIframeExactSessionIdentity } from "./walletIframe/shared/exa
 import { resolveBrowserWorkerWarmupPolicy } from "./assembly/browserWorkerWarmupPolicy.js";
 import { configureBrowserIndexedDB } from "./assembly/configureBrowserIndexedDB.js";
 import { createBrowserHostPlatformRuntime, createBrowserSigningRuntime } from "./assembly/createBrowserSigningRuntime.js";
+import { scheduleRestoredSessionPresignaturePrefills } from "./walletIframe/host/restoredSessionPresignaturePrefill.js";
 import { createBrowserSigningStores } from "./assembly/createBrowserSigningStores.js";
 import { initializeBrowserSigningRuntime } from "./assembly/initializeBrowserSigningRuntime.js";
 import { assertWalletRuntimePostconditions } from "../core/signingEngine/session/postconditions/runtimePostconditions.js";
 import { resolveExactLinkedEmailOtpAuthority, resolveLinkedDeviceEmailOtpAuthoritySelection, unlockLinkedDeviceEmailOtpWallet } from "./operations/auth/login.js";
-import { getWalletSessionDomain } from "./operations/auth/walletAuth.js";
+import { getWalletSessionDomain, prefillRouterAbEcdsaDerivationPresignaturePoolDomain } from "./operations/auth/walletAuth.js";
 import { LINKED_DEVICE_SESSION_HTTP_BASE_PATH_V1 } from "./operations/devices/deviceLinkingHttpTransport.js";
 import { createWalletIframeLinkedDeviceManagementPortV1 } from "./publicApi/devices.js";
 import { resolveConfiguredChainTarget } from "./publicApi/chainTargets.js";
@@ -620,6 +621,14 @@ var SeamsWeb = class {
 	async getWalletIframeExactSessionState() {
 		return await this.walletIframe.getExactSessionState();
 	}
+	/** @internal One wallet-host restore owns all configured-chain prefills. */
+	async prefillRestoredWalletSession(state) {
+		await scheduleRestoredSessionPresignaturePrefills({
+			state,
+			chainTargets: this.configuredChainTargets(),
+			prefill: prefillRouterAbEcdsaDerivationPresignaturePoolDomain.bind(null, this.getWalletAuthDeps())
+		});
+	}
 	async openHostedAuthMenu(request, anchorElement) {
 		return await this.walletIframe.openHostedAuthMenu(request, anchorElement);
 	}

package/dist/esm/SeamsWeb/operations/auth/login.js

@@ -61,6 +61,7 @@ import { passkeyCredentialIdB64uFromAuthentication, passkeyPrfFirstB64uFromCrede
 import { scheduleEcdsaSessionPresignaturePrefill } from "./scheduleEcdsaSessionPresignaturePrefill.js";
 import { resolveManagedRuntimeScopeBootstrap } from "../../../core/config/managedRuntimeScope.js";
 import { exactPasskeyWalletAuthAuthorityRefForCredential, exactPasskeyWalletAuthMethodForCredential } from "../authMethods/passkey/exactPasskeyAuthority.js";
+import { scheduleLinkedDevicePresignaturePrefill } from "./scheduleLinkedDevicePresignaturePrefill.js";
 import { createRouterAbNormalSigningPolicy } from "../session/thresholdWarmSessionBootstrap.js";
 import { assertWalletRuntimePostconditions } from "../../../core/signingEngine/session/postconditions/runtimePostconditions.js";
 import { buildConfiguredTargetKeyCompletion, collectConfiguredTargetThresholdEcdsaWarmKeys, configuredTargetThresholdEcdsaWarmKey, mergeCanonicalThresholdEcdsaWarmSessionContexts, parseActiveEcdsaSignerRecordForUnlock, planUnlockEcdsaWarmup, requireCompleteConfiguredTargetKeyContext } from "../../../core/signingEngine/session/passkey/unlockEcdsaWarmupPlanner.js";
@@ -1324,12 +1325,21 @@ async function activateLinkedDeviceSignerRuntimesAfterLink(args) {
 			...providerIdentity ? { providerIdentity } : {}
 		});
 		const ecdsaMaterial = linkedDeviceEcdsaMaterial(openedMaterials);
-		if (ecdsaMaterial) await activateLinkedDeviceEcdsaHolderRuntime({
-			context: args.context,
-			selection,
-			factorAuthority,
-			material: ecdsaMaterial
-		});
+		if (ecdsaMaterial) {
+			const { runtime } = await activateLinkedDeviceEcdsaHolderRuntime({
+				context: args.context,
+				selection,
+				factorAuthority,
+				material: ecdsaMaterial
+			});
+			scheduleLinkedDevicePresignaturePrefill({
+				runtime,
+				operationCredential: args.operationCredential,
+				expiresAtMs: args.walletSession.expiresAtMs,
+				relayerUrl,
+				workerCtx: args.context.signingEngine.getSignerWorkerContext()
+			});
+		}
 		const ed25519Material = linkedDeviceEd25519Material(openedMaterials);
 		if (ed25519Material) {
 			const session = await linkedDeviceEd25519SessionAfterLink({

package/dist/esm/SeamsWeb/operations/auth/scheduleLinkedDevicePresignaturePrefill.js

@@ -0,0 +1,64 @@
+import { deriveEvmFamilyEcdsaKeyHandle } from "../../../core/signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
+import { routerAbMpcMaterialActivationRefToWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { parseEcdsaKeyHandle } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
+import { MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS } from "../../../core/signingEngine/workerManager/ecdsaPresignLifecycle.js";
+import { resolveLinkedEcdsaHolderRuntimeV1 } from "../../../core/signingEngine/session/material/linkedEcdsaHolderRuntime.js";
+import { emitSigningSessionFlowTrace } from "../../../core/signingEngine/session/operationState/trace.js";
+import { buildRouterAbEcdsaDerivationSigningMaterialRef } from "../../../core/signingEngine/routerAb/ecdsaDerivation/signingMaterialRef.js";
+import { scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill } from "../../../core/signingEngine/routerAb/ecdsaDerivation/presignaturePool.js";
+import { createLinkedHolderClientSigningMaterialSource } from "../../../core/signingEngine/flows/signEvmFamily/signers/ecdsaDerivationClientSigningMaterialSource.js";
+//#region src/SeamsWeb/operations/auth/scheduleLinkedDevicePresignaturePrefill.ts
+async function scheduleLinkedDevicePresignaturePrefill(args) {
+	try {
+		const scope = args.runtime.activationReceipt.normalSigning.scope;
+		const material = buildRouterAbEcdsaDerivationSigningMaterialRef({ routerAbState: args.runtime.activationReceipt.normalSigning });
+		const keyHandle = await deriveEvmFamilyEcdsaKeyHandle({
+			ecdsaThresholdKeyId: scope.ecdsa_threshold_key_id,
+			signingRootId: scope.signing_root_id,
+			signingRootVersion: scope.signing_root_version
+		});
+		if (resolveLinkedEcdsaHolderRuntimeV1(args.runtime) !== args.runtime) return;
+		const result = scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill({
+			relayerUrl: args.relayerUrl,
+			keyHandle: parseEcdsaKeyHandle(keyHandle),
+			ecdsaThresholdKeyId: material.ecdsaThresholdKeyId,
+			clientVerifyingShareB64u: material.clientVerifier33B64u,
+			clientSigningMaterial: createLinkedHolderClientSigningMaterialSource(args.runtime.holderHandleId),
+			thresholdEcdsaPublicKeyB64u: material.thresholdVerifier33B64u,
+			relayerVerifyingShareB64u: material.serverVerifier33B64u,
+			credential: {
+				kind: "wallet_session_opaque",
+				walletSessionToken: args.operationCredential.token
+			},
+			authorization: {
+				kind: "reusable_wallet_session",
+				wallet_session_id: args.operationCredential.walletSessionId
+			},
+			materialActivation: routerAbMpcMaterialActivationRefToWire(args.runtime.materialActivation),
+			routerAbEcdsaDerivationPoolFill: {
+				kind: "router_ab_ecdsa_derivation_signing_worker_pool",
+				scope,
+				ceremonyExpiresAtMs: args.expiresAtMs,
+				materialExpiresAtMs: Date.now() + MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS
+			},
+			workerCtx: args.workerCtx
+		});
+		emitSigningSessionFlowTrace("evm-family", {
+			event: "ecdsa_linked_device_prefill",
+			scheduled: result.scheduled,
+			reason: result.reason,
+			depth: result.depth,
+			targetDepth: result.targetDepth
+		});
+	} catch {
+		emitSigningSessionFlowTrace("evm-family", {
+			event: "ecdsa_linked_device_prefill",
+			scheduled: false,
+			reason: "unexpected_error"
+		});
+	}
+}
+//#endregion
+export { scheduleLinkedDevicePresignaturePrefill };
+
+//# sourceMappingURL=scheduleLinkedDevicePresignaturePrefill.js.map

package/dist/esm/SeamsWeb/operations/auth/walletAuth.js

@@ -1,4 +1,3 @@
-import { WalletSessionStatusReadScope } from "../../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { SIGNER_AUTH_METHODS } from "../../../shared-ts/src/utils/signerDomain.js";
 import { toWalletId } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { toError } from "../../../shared-ts/src/utils/errors.js";
@@ -122,7 +121,7 @@ async function getRecentUnlocksDomain(deps) {
 	}
 	return await getRecentUnlocks(deps.getContext());
 }
-async function prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps, args) {
+async function prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps, args, statusReads) {
 	if (deps.walletIframe.shouldUseWalletIframe()) return await (await deps.walletIframe.requireRouter(args.walletSession.walletId)).prefillRouterAbEcdsaDerivationPresignaturePool({
 		walletSession: args.walletSession,
 		options: {
@@ -135,7 +134,7 @@ async function prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps, args)
 		walletId,
 		chainTarget: args.chainTarget,
 		...typeof args.waitForPoolReady === "boolean" ? { waitForPoolReady: args.waitForPoolReady } : {}
-	}, new WalletSessionStatusReadScope());
+	}, statusReads);
 }
 //#endregion
 export { getRecentUnlocksDomain, getWalletSessionDomain, hasPasskeyCredentialDomain, lockDomain, logoutDomain, prefillRouterAbEcdsaDerivationPresignaturePoolDomain, unlockDomain };

package/dist/esm/SeamsWeb/operations/auth/walletUnlockEcdsaSubject.js

@@ -1,7 +1,7 @@
 import { IndexedDbEcdsaCapabilityManifestStore } from "../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
 //#region src/SeamsWeb/operations/auth/walletUnlockEcdsaSubject.ts
 const ecdsaCapabilityManifestStore = new IndexedDbEcdsaCapabilityManifestStore();
-async function listEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
+async function resolveEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
 	const resolved = await ecdsaCapabilityManifestStore.listActiveWalletCapabilitySubjects(walletId);
 	if (resolved.kind === "persistence_unavailable") return {
 		kind: "failed",
@@ -24,9 +24,6 @@ async function listEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
 		subjects
 	};
 }
-async function resolveEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
-	return await listEvmFamilyEcdsaWalletUnlockSubjects(walletId);
-}
 async function resolveEcdsaActivationJournalSelectors(walletId) {
 	return await ecdsaCapabilityManifestStore.listWalletActivationJournalSelectors(walletId);
 }

package/dist/esm/SeamsWeb/operations/devices/deviceLinkingHttpTransport.js

@@ -9,6 +9,7 @@ import { parseLinkSessionProjectionV1, parseLinkSessionTransportEventV1, parseLi
 import { parseActivateInstalledAuthorityResultV1, parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1 } from "../../../shared-ts/src/device-linking/authorityActivation.js";
 import { LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, computeLinkedDevicePublicKeyDigestV1 } from "../../../shared-ts/src/device-linking/requestProof.js";
 import "../../../shared-ts/src/device-linking/index.js";
+import { hasExactKeys } from "../../../shared-ts/src/utils/exactKeys.js";
 //#region src/SeamsWeb/operations/devices/deviceLinkingHttpTransport.ts
 const LINKED_DEVICE_SESSION_HTTP_BASE_PATH_V1 = "/wallet/device-linking/v1/sessions";
 const LINKED_DEVICE_POLL_MAX_DELAY_MS = 4e3;
@@ -425,7 +426,7 @@ async function createPollingSubscriptionV1(input) {
 function parseSessionMutationEnvelopeV1(raw) {
 	const record = asPlainDeviceLinkingResponse(raw);
 	if (record === null) throw new Error("linked-device response must be an object");
-	if (!hasExactKeys(record, SESSION_MUTATION_RESPONSE_FIELDS)) throw new Error("linked-device response contains invalid fields");
+	if (!hasExactResponseKeys(record, SESSION_MUTATION_RESPONSE_FIELDS)) throw new Error("linked-device response contains invalid fields");
 	if (record.ok !== true) throw new Error("linked-device response outcome is invalid");
 	switch (record.outcome) {
 		case "applied": return {
@@ -444,7 +445,7 @@ function parseSessionMutationEnvelopeV1(raw) {
 function parseTargetCredentialRegistrationResponseV1(raw) {
 	const record = asPlainDeviceLinkingResponse(raw);
 	if (record === null) throw new Error("linked-device target credential response must be an object");
-	if (!hasExactKeys(record, TARGET_CREDENTIAL_RESPONSE_FIELDS)) throw new Error("linked-device target credential response contains invalid fields");
+	if (!hasExactResponseKeys(record, TARGET_CREDENTIAL_RESPONSE_FIELDS)) throw new Error("linked-device target credential response contains invalid fields");
 	if (record.ok !== true) throw new Error("linked-device target credential response outcome is invalid");
 	switch (record.outcome) {
 		case "applied": return parseTargetCredentialRegistrationResponseBranch(record, "applied");
@@ -462,20 +463,20 @@ function parseTargetCredentialRegistrationResponseBranch(record, outcome) {
 function parseHttpFailureMessageV1(response) {
 	const record = asPlainDeviceLinkingResponse(response.body);
 	if (record === null || record.ok !== false) return `linked-device request failed with HTTP ${response.status}`;
-	if (hasExactKeys(record, CODED_FAILURE_RESPONSE_FIELDS) && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
-	if (hasExactKeys(record, OUTCOME_FAILURE_RESPONSE_FIELDS) && typeof record.outcome === "string" && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
+	if (hasExactResponseKeys(record, CODED_FAILURE_RESPONSE_FIELDS) && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
+	if (hasExactResponseKeys(record, OUTCOME_FAILURE_RESPONSE_FIELDS) && typeof record.outcome === "string" && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
 	switch (record.outcome) {
 		case "conflict":
-			if (hasExactKeys(record, SESSION_CONFLICT_FAILURE_FIELDS)) return "linked-device request failed: conflict";
+			if (hasExactResponseKeys(record, SESSION_CONFLICT_FAILURE_FIELDS)) return "linked-device request failed: conflict";
 			break;
 		case "expired":
-			if (hasExactKeys(record, SESSION_EXPIRED_FAILURE_FIELDS)) return "linked-device request failed: expired";
+			if (hasExactResponseKeys(record, SESSION_EXPIRED_FAILURE_FIELDS)) return "linked-device request failed: expired";
 			break;
 		case "invalid_state":
-			if (hasExactKeys(record, SESSION_INVALID_STATE_FAILURE_FIELDS)) return "linked-device request failed: invalid_state";
+			if (hasExactResponseKeys(record, SESSION_INVALID_STATE_FAILURE_FIELDS)) return "linked-device request failed: invalid_state";
 			break;
 		case "integrity_error":
-			if (hasExactKeys(record, SESSION_INTEGRITY_FAILURE_FIELDS)) return "linked-device request failed: integrity_error";
+			if (hasExactResponseKeys(record, SESSION_INTEGRITY_FAILURE_FIELDS)) return "linked-device request failed: integrity_error";
 			break;
 		default: break;
 	}
@@ -493,11 +494,9 @@ function isPlainDeviceLinkingResponse(value) {
 		return false;
 	}
 }
-function hasExactKeys(record, expectedKeys) {
+function hasExactResponseKeys(record, expectedKeys) {
 	try {
-		const actualKeys = Object.keys(record).sort();
-		const expected = [...expectedKeys].sort();
-		return actualKeys.length === expected.length && actualKeys.every((key, index) => key === expected[index]);
+		return hasExactKeys(record, expectedKeys);
 	} catch {
 		return false;
 	}

package/dist/esm/SeamsWeb/operations/devices/deviceLinkingResume.js

@@ -3,6 +3,7 @@ import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKi
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { encodeWalletSignerActivationSetV1, parseWalletSignerActivationSetV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
 import { parseLocalAuthorityActivationFinalAckV1 } from "../../../shared-ts/src/device-linking/authorityActivation.js";
+import { hasExactKeys } from "../../../shared-ts/src/utils/exactKeys.js";
 //#region src/SeamsWeb/operations/devices/deviceLinkingResume.ts
 const LINKED_DEVICE_COMMITTED_RESUME_KIND_V1 = "linked_device_committed_resume_v1";
 const LINKED_DEVICE_PENDING_ACK_KIND_V1 = "linked_device_pending_ack_v1";
@@ -203,11 +204,6 @@ function isPlainDeviceLinkingResumeRecord(value) {
 		return false;
 	}
 }
-function hasExactKeys(record, expectedKeys) {
-	const actual = Object.keys(record).sort();
-	const expected = [...expectedKeys].sort();
-	return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
-}
 function sameSignerActivations(left, right) {
 	const leftBytes = encodeWalletSignerActivationSetV1(left);
 	const rightBytes = encodeWalletSignerActivationSetV1(right);

package/dist/esm/SeamsWeb/operations/devices/deviceLinkingWorkerChannels.js

@@ -5,27 +5,10 @@ import { parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/
 import { parseLinkDevicePublicKeyB64u, parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1, parseLinkedDeviceEmailOtpVerificationGrantV1 } from "../../../shared-ts/src/device-linking/parsers.js";
 import { parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1, parseLinkedDeviceWalletSessionCredentialDeliveryV1 } from "../../../shared-ts/src/device-linking/walletSessionCredentialDelivery.js";
 import "../../../shared-ts/src/device-linking/index.js";
+import { hasExactKeys } from "../../../shared-ts/src/utils/exactKeys.js";
 import { resolveWorkerUrl } from "../../../core/walletRuntimePaths/workers.js";
 import { createDeviceLinkingOrdinaryMaterialWorkerPortV1 } from "../../../core/signingEngine/workerManager/deviceLinkingPorts.js";
 //#region src/SeamsWeb/operations/devices/deviceLinkingWorkerChannels.ts
-function isDeviceLinkingKeyHandleRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "handleId|kind";
-}
-function isDeviceLinkingKeyCreateResultRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "deliveryRecipientPublicKey65B64u|devicePublicKeyB64u|handleId|linkPublicKeyB64u";
-}
-function isDeviceLinkingEmailOtpFactorReleaseResultRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "factorSecret|kind|verificationGrant";
-}
-function isDeviceLinkingRequestSignatureResultRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "signatureB64u";
-}
-function isDeviceLinkingWorkerSuccessFrameRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "id|ok|result" && "ok" in value && value.ok === true;
-}
-function isDeviceLinkingWorkerFailureFrameRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "error|id|ok" && "ok" in value && value.ok === false;
-}
 function nonEmpty(value, label) {
 	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error(`${label} is required`);
 	return value;
@@ -51,7 +34,7 @@ function parseFixedB64u(value, length, label) {
 	return encoded;
 }
 function parseHandle(value) {
-	if (!isDeviceLinkingKeyHandleRecordV1(value)) throw new Error("device-linking key handle has invalid fields");
+	if (!hasExactKeys(value, ["kind", "handleId"])) throw new Error("device-linking key handle has invalid fields");
 	const record = value;
 	if (record.kind !== "device_linking_key_material_handle_v1") throw new Error("device-linking key handle kind is invalid");
 	return {
@@ -60,7 +43,12 @@ function parseHandle(value) {
 	};
 }
 function parseCreateResult(value) {
-	if (!isDeviceLinkingKeyCreateResultRecordV1(value)) throw new Error("device-linking key create response has invalid fields");
+	if (!hasExactKeys(value, [
+		"handleId",
+		"linkPublicKeyB64u",
+		"devicePublicKeyB64u",
+		"deliveryRecipientPublicKey65B64u"
+	])) throw new Error("device-linking key create response has invalid fields");
 	const record = value;
 	return {
 		handle: {
@@ -73,7 +61,11 @@ function parseCreateResult(value) {
 	};
 }
 function parseEmailOtpFactorReleaseResult(value) {
-	if (!isDeviceLinkingEmailOtpFactorReleaseResultRecordV1(value)) throw new Error("device-linking Email OTP factor release response has invalid fields");
+	if (!hasExactKeys(value, [
+		"kind",
+		"verificationGrant",
+		"factorSecret"
+	])) throw new Error("device-linking Email OTP factor release response has invalid fields");
 	const record = value;
 	if (record.kind !== "device_linking_email_otp_factor_release_result_v1") throw new Error("device-linking Email OTP factor release response kind is invalid");
 	if (!(record.factorSecret instanceof ArrayBuffer) || record.factorSecret.byteLength !== 32) throw new Error("device-linking Email OTP factor release secret is invalid");
@@ -87,11 +79,15 @@ function parseWalletSessionCredentialDeliveryResult(value) {
 	return parseWalletSessionOperationCredentialV1(value);
 }
 function parseSignatureResult(value) {
-	if (!isDeviceLinkingRequestSignatureResultRecordV1(value)) throw new Error("device-linking request signature response has invalid fields");
+	if (!hasExactKeys(value, ["signatureB64u"])) throw new Error("device-linking request signature response has invalid fields");
 	return { signatureB64u: parseFixedB64u(value.signatureB64u, 64, "signatureB64u") };
 }
 function parseResponseFrame(value) {
-	if (isDeviceLinkingWorkerSuccessFrameRecordV1(value)) {
+	if (hasExactKeys(value, [
+		"id",
+		"ok",
+		"result"
+	]) && value.ok === true) {
 		const id = value.id;
 		if (typeof id !== "string" || id.trim() !== id || id.length === 0) return null;
 		return {
@@ -100,7 +96,11 @@ function parseResponseFrame(value) {
 			result: value.result
 		};
 	}
-	if (isDeviceLinkingWorkerFailureFrameRecordV1(value)) {
+	if (hasExactKeys(value, [
+		"id",
+		"ok",
+		"error"
+	]) && value.ok === false) {
 		const id = value.id;
 		if (typeof id !== "string" || id.trim() !== id || id.length === 0) return null;
 		if (typeof value.error !== "string" || !value.error.trim()) return null;

package/dist/esm/SeamsWeb/operations/recovery/walletRecoveryDurablePayload.js

@@ -81,9 +81,6 @@ function durableBase64Url(value, label, byteLength) {
 	if (byteLength !== void 0 && bytes.byteLength !== byteLength) throw new Error(label + " must decode to " + byteLength + " bytes");
 	return normalized;
 }
-function durableCompressedPublicKey(value, label) {
-	return parseSecp256k1CompressedPublicKeyB64u(value, label);
-}
 function durableSafeInteger(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(label + " must be a non-negative safe integer");
 	return value;
@@ -154,10 +151,10 @@ function parseWalletRecoveryDurableEcdsaPublicFacts(raw) {
 	if (!/^0x[0-9a-f]{40}$/.test(ethereumAddress)) throw new Error("recovery durable ECDSA ethereumAddress is invalid");
 	return {
 		contextBinding32B64u: parseDigestField(record.contextBinding32B64u, "recovery durable ECDSA context binding"),
-		derivationClientSharePublicKey33B64u: durableCompressedPublicKey(record.derivationClientSharePublicKey33B64u, "recovery durable ECDSA client share"),
-		clientVerifyingShare33B64u: durableCompressedPublicKey(record.clientVerifyingShare33B64u, "recovery durable ECDSA client verifying share"),
-		relayerPublicKey33B64u: durableCompressedPublicKey(record.relayerPublicKey33B64u, "recovery durable ECDSA relayer public key"),
-		groupPublicKey33B64u: durableCompressedPublicKey(record.groupPublicKey33B64u, "recovery durable ECDSA group public key"),
+		derivationClientSharePublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.derivationClientSharePublicKey33B64u, "recovery durable ECDSA client share"),
+		clientVerifyingShare33B64u: parseSecp256k1CompressedPublicKeyB64u(record.clientVerifyingShare33B64u, "recovery durable ECDSA client verifying share"),
+		relayerPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.relayerPublicKey33B64u, "recovery durable ECDSA relayer public key"),
+		groupPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.groupPublicKey33B64u, "recovery durable ECDSA group public key"),
 		ethereumAddress,
 		clientShareRetryCounter: durableSafeInteger(record.clientShareRetryCounter, "recovery durable ECDSA client-share retry counter"),
 		relayerShareRetryCounter: durableSafeInteger(record.relayerShareRetryCounter, "recovery durable ECDSA relayer-share retry counter")

package/dist/esm/SeamsWeb/operations/registration/pendingRegistrationRecovery.js

@@ -18,19 +18,13 @@ import { unlockPendingEcdsaRegistration } from "./pendingEcdsaRegistrationRecove
 //#region src/SeamsWeb/operations/registration/pendingRegistrationRecovery.ts
 const defaultPendingRegistrationRecoveryPorts = {
 	listPendingWalletRegistrationCommits,
-	completeWalletRegistrationNearProvisioning: completePendingWalletRegistrationNearProvisioning,
+	completeWalletRegistrationNearProvisioning,
 	publishPendingWalletRegistrationCommit
 };
 async function listPendingWalletRegistrationCommits() {
 	await IndexedDBManager.initialize();
 	return await IndexedDBManager.listPendingWalletRegistrationCommits();
 }
-async function completePendingWalletRegistrationNearProvisioning(input) {
-	return await completeWalletRegistrationNearProvisioning(input);
-}
-async function activatePendingWalletRegistration(input) {
-	return await activateWalletRegistration(input);
-}
 async function publishPendingWalletRegistrationCommit(input) {
 	return await IndexedDBManager.publishPendingWalletRegistrationCommit(input);
 }
@@ -325,7 +319,7 @@ async function resumePendingNearRegistrations(args) {
 	return results;
 }
 const defaultPendingEcdsaRegistrationRecoveryPorts = {
-	activateWalletRegistration: activatePendingWalletRegistration,
+	activateWalletRegistration,
 	publishPendingWalletRegistrationCommit,
 	unlockPendingEcdsaRegistration
 };

package/dist/esm/SeamsWeb/operations/tempo/executeEvmFamilyTransaction.js

@@ -369,7 +369,10 @@ async function executeEvmFamilyTransactionLifecycle(args) {
 			}
 		});
 		const rawTxHex = assertRawTxHexOrThrow(signedResult.rawTxHex);
-		args.lifecycle.onBroadcastStarted?.(signedResult);
+		args.lifecycle.onBroadcastStarted({
+			walletSession: args.input.walletSession,
+			signedResult
+		});
 		txHash = normalizeTxHashOrThrow(await client.request({
 			method: "eth_sendRawTransaction",
 			params: [rawTxHex]

package/dist/esm/SeamsWeb/publicApi/auth.js

@@ -1,3 +1,4 @@
+import { WalletSessionStatusReadScope } from "../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { getRecentUnlocksDomain, getWalletSessionDomain, hasPasskeyCredentialDomain, lockDomain, logoutDomain, prefillRouterAbEcdsaDerivationPresignaturePoolDomain, unlockDomain } from "../operations/auth/walletAuth.js";
 //#region src/SeamsWeb/publicApi/auth.ts
 function createAuthCapability(deps) {
@@ -8,7 +9,7 @@ function createAuthCapability(deps) {
 		getWalletSession: async (walletId) => await getWalletSessionDomain(deps.getWalletAuthDeps(), walletId),
 		getRecentUnlocks: async () => await getRecentUnlocksDomain(deps.getWalletAuthDeps()),
 		hasPasskeyCredential: async (walletId) => await hasPasskeyCredentialDomain(deps.getWalletAuthDeps(), walletId),
-		prefillRouterAbEcdsaDerivationPresignaturePool: async (args) => await prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps.getWalletAuthDeps(), args),
+		prefillRouterAbEcdsaDerivationPresignaturePool: async (args) => await prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps.getWalletAuthDeps(), args, new WalletSessionStatusReadScope()),
 		requestEmailOtpChallenge: deps.domain.requestEmailOtpChallenge,
 		requestEmailOtpSigningSessionChallenge: deps.domain.requestEmailOtpSigningSessionChallenge,
 		refreshEmailOtpSigningSession: deps.domain.refreshEmailOtpSigningSession,

package/dist/esm/SeamsWeb/publicApi/tempo.js

@@ -63,6 +63,11 @@ function createTempoSignerCapability(deps, transactionDispatch = { kind: "ordina
 		...args,
 		chainTarget: resolveTempoChainTarget(deps.configs.network.chains, args.chainTarget)
 	}));
+	const onBroadcastStarted = (args) => {
+		const walletIframe = deps.getWalletIframe();
+		if (!walletIframe.shouldUseWalletIframe()) return;
+		walletIframe.requireRouter(toWalletId(args.walletSession.walletId)).then((router) => router.notifyTransactionBroadcastStarted(args.signedResult)).catch(() => {});
+	};
 	const reportBroadcastAccepted = async (args) => {
 		const walletIframe = deps.getWalletIframe();
 		const walletId = toWalletId(args.walletSession.walletId);
@@ -178,6 +183,7 @@ function createTempoSignerCapability(deps, transactionDispatch = { kind: "ordina
 		}
 	};
 	const lifecycle = {
+		onBroadcastStarted,
 		signEvmFamily,
 		reportBroadcastAccepted,
 		reportBroadcastRejected,