@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/core/indexedDB/seamsWalletDB/signerOutboxRows.js

@@ -0,0 +1,90 @@
+import { normalizeTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
+import { normalizeIndexedDbAccountAddress, normalizeIndexedDbChainIdKey, parseStoredNonEmptyString, signerChainTargetKey } from "../normalization.js";
+import { sanitizePayload } from "../keyMaterialEnvelope.js";
+//#region src/core/indexedDB/seamsWalletDB/signerOutboxRows.ts
+function signerOutboxRow(record) {
+	const opId = normalizeTrimmedString(record.opId || "");
+	const idempotencyKey = normalizeTrimmedString(record.idempotencyKey || "");
+	const chainIdKey = normalizeIndexedDbChainIdKey(record.chainIdKey);
+	const accountAddress = normalizeIndexedDbAccountAddress(record.accountAddress);
+	const signerId = normalizeTrimmedString(record.signerId || "");
+	if (!opId || !idempotencyKey || !chainIdKey || !accountAddress || !signerId) throw new Error("[SeamsWalletDB] signer op requires opId, idempotencyKey, chainIdKey, accountAddress, and signerId");
+	return {
+		op_id: opId,
+		idempotency_key: idempotencyKey,
+		status: record.status,
+		next_attempt_at: record.nextAttemptAt,
+		wallet_id: normalizeTrimmedString(String(record.payload?.profileId || "")),
+		chain_target_key: signerChainTargetKey({
+			chainIdKey,
+			accountAddress
+		}),
+		updated_at: record.updatedAt,
+		record: {
+			...record,
+			opId,
+			idempotencyKey,
+			chainIdKey,
+			accountAddress,
+			signerId
+		}
+	};
+}
+function parseStoredSignerOutboxRecord(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const opId = parseStoredNonEmptyString(Reflect.get(value, "opId"));
+	const idempotencyKey = parseStoredNonEmptyString(Reflect.get(value, "idempotencyKey"));
+	const opType = parseStoredNonEmptyString(Reflect.get(value, "opType"));
+	const chainIdKey = normalizeIndexedDbChainIdKey(Reflect.get(value, "chainIdKey"));
+	const accountAddress = normalizeIndexedDbAccountAddress(Reflect.get(value, "accountAddress"));
+	const signerId = parseStoredNonEmptyString(Reflect.get(value, "signerId"));
+	const status = Reflect.get(value, "status");
+	const attemptCount = Reflect.get(value, "attemptCount");
+	const nextAttemptAt = Reflect.get(value, "nextAttemptAt");
+	const createdAt = Reflect.get(value, "createdAt");
+	const updatedAt = Reflect.get(value, "updatedAt");
+	if (!opId || !idempotencyKey || !opType || !chainIdKey || !accountAddress || !signerId || status !== "queued" && status !== "submitted" && status !== "confirmed" && status !== "failed" && status !== "dead-letter" || !Number.isSafeInteger(attemptCount) || Number(attemptCount) < 0 || !Number.isSafeInteger(nextAttemptAt) || Number(nextAttemptAt) < 0 || !Number.isSafeInteger(createdAt) || Number(createdAt) < 0 || !Number.isSafeInteger(updatedAt) || Number(updatedAt) < 0) return null;
+	const payloadRaw = Reflect.get(value, "payload");
+	const payload = sanitizePayload(payloadRaw);
+	if (payloadRaw !== void 0 && (payloadRaw === null || typeof payloadRaw !== "object" || Array.isArray(payloadRaw))) return null;
+	const lastError = Reflect.get(value, "lastError");
+	const txHash = Reflect.get(value, "txHash");
+	if (lastError !== void 0 && typeof lastError !== "string" || txHash !== void 0 && typeof txHash !== "string") return null;
+	return {
+		opId,
+		idempotencyKey,
+		opType,
+		chainIdKey,
+		accountAddress,
+		signerId,
+		status,
+		attemptCount: Number(attemptCount),
+		nextAttemptAt: Number(nextAttemptAt),
+		createdAt: Number(createdAt),
+		updatedAt: Number(updatedAt),
+		...payload === void 0 ? {} : { payload },
+		...lastError === void 0 ? {} : { lastError },
+		...txHash === void 0 ? {} : { txHash }
+	};
+}
+function parseSignerOutboxRow(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = parseStoredSignerOutboxRecord(Reflect.get(value, "record"));
+	if (!record) return null;
+	if (Reflect.get(value, "op_id") !== record.opId) return null;
+	if (Reflect.get(value, "idempotency_key") !== record.idempotencyKey) return null;
+	if (Reflect.get(value, "status") !== record.status) return null;
+	if (Reflect.get(value, "next_attempt_at") !== record.nextAttemptAt) return null;
+	if (Reflect.get(value, "chain_target_key") !== signerChainTargetKey({
+		chainIdKey: record.chainIdKey,
+		accountAddress: record.accountAddress
+	})) return null;
+	const payloadProfileId = normalizeTrimmedString(String(record.payload && Reflect.get(record.payload, "profileId") ? Reflect.get(record.payload, "profileId") : ""));
+	if (Reflect.get(value, "wallet_id") !== payloadProfileId) return null;
+	if (Reflect.get(value, "updated_at") !== record.updatedAt) return null;
+	return record;
+}
+//#endregion
+export { parseSignerOutboxRow, signerOutboxRow };
+
+//# sourceMappingURL=signerOutboxRows.js.map

package/dist/esm/core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js

@@ -1,22 +1,19 @@
 import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u, parseIsoTimestamp } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { buildVerifiedEcdsaPublicFacts, toEvmFamilyEcdsaKeyHandle, toParticipantId } from "../../signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
 import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
+import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import { parseEcdsaKeyHandle, parseEcdsaRelayerKeyId } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
-import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRoleLocalBindingDigest, parseEcdsaRoleLocalDurableMaterialRef, parseEcdsaThresholdKeyId } from "../../signingEngine/session/keyMaterialBrands.js";
-import { parseWalletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseEcdsaCapabilityManifestId, parseEcdsaCapabilityManifestRevision, parseEvmFamilyEcdsaSignerId } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
+import { parseWalletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { parseEcdsaKeyHandle, parseEcdsaRelayerKeyId } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
+import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRoleLocalBindingDigest, parseEcdsaRoleLocalDurableMaterialRef, parseEcdsaThresholdKeyId } from "../../signingEngine/session/keyMaterialBrands.js";
+import { buildVerifiedEcdsaPublicFacts, toEvmFamilyEcdsaKeyHandle, toParticipantId } from "../../signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
 import { buildEcdsaRoleLocalPublicFacts } from "../../signingEngine/session/persistence/ecdsaRoleLocalRecords.js";
 import { buildEcdsaActivationBinding, buildEcdsaCapabilityScope, buildEcdsaManifestIdentity, buildEcdsaRoleLocalMaterialBinding, buildPreparedEvmFamilySigner } from "../../signingEngine/session/material/ecdsaCapabilityManifest.js";
-import { seamsWalletDB } from "../singletons.js";
-import { ecdsaRegisteredPublicFactsMatch, ecdsaRoleLocalMaterialBindingsMatch, ecdsaRoleLocalPublicFactsMatch } from "./ecdsaCapabilityManifestRecords.js";
-import { IndexedDbEcdsaCapabilityManifestStore, importCommittedActivation, prepareImportedWalletCustodyEcdsaContinuity } from "./ecdsaCapabilityManifestStore.js";
-import { SeamsWalletRepositories } from "./repositories.js";
+import { prepareImportedWalletCustodyEcdsaContinuity } from "./ecdsaCapabilityManifestStore.js";
 //#region src/core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.ts
 function buildWalletCustodyEcdsaContinuityImportInput(input) {
 	const authority = parseWalletAuthAuthorityRef(input.authority);
@@ -110,89 +107,7 @@ function buildWalletCustodyEcdsaContinuityImportInput(input) {
 async function prepareWalletCustodyEcdsaContinuity(input) {
 	return prepareImportedWalletCustodyEcdsaContinuity(buildWalletCustodyEcdsaContinuityImportInput(input));
 }
-async function importWalletCustodyEcdsaContinuity(input) {
-	return await importCommittedActivation(input.store, buildWalletCustodyEcdsaContinuityImportInput(input), (prepared) => input.store.persistPreparedWalletCustodyEcdsaContinuity(prepared));
-}
-async function assertSharedWalletAuthorityMembership(input) {
-	const repositories = new SeamsWalletRepositories(seamsWalletDB);
-	for (const walletAuthMethodId of input.walletAuthMethodIds) {
-		const authMethod = await repositories.getWalletAuthMethodV2(String(walletAuthMethodId));
-		if (!authMethod || authMethod.status !== "active" || authMethod.walletId !== input.walletId || authMethod.walletAuthorityId !== input.walletAuthorityId) throw new Error(`ECDSA custody continuity method ${String(walletAuthMethodId)} is not an active member of the wallet authority`);
-	}
-}
-/**
-* Give an added auth method its own encrypted access projection over the
-* activation the wallet already has. The activation is not re-created and the
-* source credential's authority is not widened; only a second method-bound
-* record over the same material appears.
-*
-* The membership check is the whole safety argument. Copying access to a method
-* on another wallet authority would hand that credential custody it was never
-* granted, so both methods are read back and required to be active members of
-* the exact same authority before anything is opened.
-*/
-async function copyWalletCustodyEcdsaContinuityToAuthMethod(input) {
-	if (input.targetAuthority.walletId !== input.walletId || input.targetAuthority.walletAuthMethodId === input.sourceWalletAuthMethodId) throw new Error("ECDSA custody continuity target is invalid");
-	await assertSharedWalletAuthorityMembership({
-		walletId: input.walletId,
-		walletAuthorityId: input.walletAuthorityId,
-		walletAuthMethodIds: [input.sourceWalletAuthMethodId, input.targetAuthority.walletAuthMethodId]
-	});
-	const store = new IndexedDbEcdsaCapabilityManifestStore();
-	const listed = await store.listActiveWalletCapabilitySubjects(input.walletId);
-	if (listed.kind !== "resolved") throw new Error(`ECDSA custody continuity inventory is ${listed.kind}`);
-	if (listed.subjects.length === 0) return;
-	const sources = listed.subjects.filter((subject) => subject.authority.walletAuthMethodId === input.sourceWalletAuthMethodId);
-	if (sources.length === 0) throw new Error(`ECDSA custody continuity found no active capability for source method ${String(input.sourceWalletAuthMethodId)} among [${listed.subjects.map((subject) => String(subject.authority.walletAuthMethodId)).join(", ")}]`);
-	for (const source of sources) {
-		const sourceLookup = await store.lookup(source);
-		if (sourceLookup.kind !== "active") throw new Error(`ECDSA custody continuity source is ${sourceLookup.kind}`);
-		const targetSelector = {
-			capability: source.capability,
-			authority: input.targetAuthority
-		};
-		const targetLookup = await store.lookup(targetSelector);
-		if (targetLookup.kind === "active") {
-			const targetMaterial = targetLookup.manifest.durableMaterial;
-			const sourceMaterial = sourceLookup.manifest.durableMaterial;
-			if (targetMaterial.activationDigest !== sourceMaterial.activationDigest || targetMaterial.bindingDigest !== sourceMaterial.bindingDigest || targetMaterial.roleLocalBinding.ecdsaThresholdKeyId !== sourceMaterial.roleLocalBinding.ecdsaThresholdKeyId || !ecdsaRoleLocalMaterialBindingsMatch(targetMaterial.roleLocalBinding, sourceMaterial.roleLocalBinding) || !ecdsaRoleLocalPublicFactsMatch(targetMaterial.roleLocalPublicFacts, sourceMaterial.roleLocalPublicFacts) || !ecdsaRegisteredPublicFactsMatch(targetLookup.manifest.signer.registeredPublicFacts, sourceLookup.manifest.signer.registeredPublicFacts)) throw new Error("ECDSA custody continuity target conflicts with source material");
-			continue;
-		}
-		if (targetLookup.kind !== "missing") throw new Error(`ECDSA custody continuity target is ${targetLookup.kind}`);
-		const opened = await store.openActiveMaterialLookup(sourceLookup);
-		if (opened.kind !== "active") throw new Error(`ECDSA custody continuity material is ${opened.kind}`);
-		const manifest = opened.manifest;
-		const publicFacts = manifest.durableMaterial.roleLocalPublicFacts;
-		const imported = await importWalletCustodyEcdsaContinuity({
-			store,
-			authority: input.targetAuthority,
-			chainTargets: manifest.signer.scope.targetMemberships,
-			walletId: String(input.walletId),
-			keyHandle: publicFacts.keyHandle,
-			ecdsaThresholdKeyId: String(publicFacts.ecdsaThresholdKeyId),
-			signingRootId: String(publicFacts.signingRootId),
-			signingRootVersion: String(publicFacts.signingRootVersion),
-			relayerKeyId: String(manifest.durableMaterial.roleLocalBinding.relayerKeyId),
-			participantIds: publicFacts.participantIds,
-			publicCapability: publicFacts.publicCapability,
-			activationReceipt: manifest.activation.serverActivation.serverActivationReceipt.protocolReceipt,
-			runtimePolicyScope: manifest.durableMaterial.runtimePolicyScope,
-			readyStateBlobB64u: opened.readyStateBlobB64u,
-			publicFacts: {
-				contextBinding32B64u: publicFacts.contextBinding32B64u,
-				derivationClientSharePublicKey33B64u: publicFacts.derivationClientSharePublicKey33B64u,
-				clientVerifyingShare33B64u: publicFacts.publicCapability.public_identity.derivation_client_share_public_key33_b64u,
-				relayerPublicKey33B64u: publicFacts.relayerPublicKey33B64u,
-				groupPublicKey33B64u: publicFacts.groupPublicKey33B64u,
-				ethereumAddress: publicFacts.ethereumAddress,
-				clientShareRetryCounter: publicFacts.publicCapability.public_identity.client_share_retry_counter,
-				relayerShareRetryCounter: publicFacts.publicCapability.public_identity.server_share_retry_counter
-			}
-		});
-		if (imported.kind !== "committed") throw new Error(`ECDSA custody continuity import is ${imported.kind}`);
-	}
-}
 //#endregion
-export { copyWalletCustodyEcdsaContinuityToAuthMethod, importWalletCustodyEcdsaContinuity, prepareWalletCustodyEcdsaContinuity };
+export { prepareWalletCustodyEcdsaContinuity };
 
 //# sourceMappingURL=walletCustodyEcdsaContinuity.js.map

package/dist/esm/core/indexedDB/seamsWalletDB/walletOwnershipGeneration.js

@@ -0,0 +1,43 @@
+import { requireRecord } from "../../../shared-ts/src/utils/validation.js";
+import { SEAMS_WALLET_INDEXES, SEAMS_WALLET_STORES } from "../schemaNames.js";
+import { seamsWalletDB } from "../singletons.js";
+import { parseSealedAvailableClientPresignatureRow } from "./ecdsaClientPresignatures.js";
+//#region src/core/indexedDB/seamsWalletDB/walletOwnershipGeneration.ts
+async function readOwnershipGeneration(context, walletId) {
+	const raw = await context.store(SEAMS_WALLET_STORES.appState).get(`wallet_ownership_generation:${walletId}`);
+	if (raw === void 0) return 1;
+	const generation = requireRecord(raw, "Wallet ownership generation").value;
+	if (typeof generation !== "number" || !Number.isSafeInteger(generation) || generation < 1) throw new Error("Stored wallet ownership generation is invalid");
+	return generation;
+}
+async function assertWalletOwnershipGeneration(context, walletId, generation) {
+	if (await readOwnershipGeneration(context, walletId) !== generation) throw new Error("Wallet ownership generation requires fresh authentication");
+}
+async function acceptWalletOwnershipGeneration(context, walletId, generation) {
+	const current = await readOwnershipGeneration(context, walletId);
+	if (generation < current) throw new Error("Wallet session belongs to an obsolete ownership generation");
+	if (generation === current) return;
+	await context.store(SEAMS_WALLET_STORES.appState).put({
+		key: `wallet_ownership_generation:${walletId}`,
+		value: generation
+	});
+	let cursor = await context.store(SEAMS_WALLET_STORES.ecdsaClientPresignatures).index(SEAMS_WALLET_INDEXES.walletId).openCursor(walletId);
+	while (cursor) {
+		let obsolete = true;
+		try {
+			obsolete = parseSealedAvailableClientPresignatureRow(cursor.value).pool_identity.ownershipGeneration < generation;
+		} catch {}
+		if (obsolete) await cursor.delete();
+		cursor = await cursor.continue();
+	}
+}
+async function assertCurrentWalletOwnershipGeneration(walletId, generation) {
+	await seamsWalletDB.runTransaction([SEAMS_WALLET_STORES.appState], "readonly", assertGenerationInTransaction.bind(null, walletId, generation));
+}
+function assertGenerationInTransaction(walletId, generation, context) {
+	return assertWalletOwnershipGeneration(context, walletId, generation);
+}
+//#endregion
+export { acceptWalletOwnershipGeneration, assertCurrentWalletOwnershipGeneration };
+
+//# sourceMappingURL=walletOwnershipGeneration.js.map

package/dist/esm/core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js

@@ -4,6 +4,7 @@ import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitive
 import { activeWalletSessionV1RecordsEqual, parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { SEAMS_WALLET_INDEXES, SEAMS_WALLET_STORES } from "../schemaNames.js";
 import { seamsWalletDB } from "../singletons.js";
+import { acceptWalletOwnershipGeneration } from "./walletOwnershipGeneration.js";
 //#region src/core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.ts
 const WALLET_SESSION_AUTHORIZATION_RECORD_VERSION_V6 = "wallet_session_authorization_v6";
 var WalletSessionAuthorizationUpgradeRequiredError = class extends Error {
@@ -116,21 +117,6 @@ function storedWalletSessionRowKey(value) {
 	if (typeof key !== "string") throw new Error("Stored Wallet Session authorization key is invalid");
 	return key;
 }
-async function settleAbortedTransaction(transaction) {
-	try {
-		await transaction.done;
-	} catch {}
-}
-function walletSessionStoreForTransaction(tx, _name) {
-	return tx.objectStore(STORE);
-}
-function walletSessionTransactionContext(db, tx) {
-	return {
-		db,
-		tx,
-		store: walletSessionStoreForTransaction.bind(null, tx)
-	};
-}
 function walletCapabilitySubjectKey(subject) {
 	switch (subject.kind) {
 		case "sign":
@@ -354,7 +340,9 @@ async function replaceExactActiveWalletSessionAuthorizationInTransaction(args) {
 	const incoming = parseExactWalletSessionRecord(args.active);
 	if (!incoming || incoming.kind !== "active_wallet_session_v1") throw new Error("Active Wallet Session v1 is invalid");
 	const operationCredential = parseWalletSessionOperationCredentialV1(args.operationCredential);
+	await acceptWalletOwnershipGeneration(args.ctx, incoming.walletId, operationCredential.ownershipGeneration);
 	const incomingRow = toStoredExactWalletSessionAuthorizationRowV6(incoming, operationCredential);
+	let requiresWrite = true;
 	const store = args.ctx.store(STORE);
 	const rows = await store.index(SEAMS_WALLET_INDEXES.walletId).getAll(incoming.walletId);
 	for (const raw of rows) {
@@ -368,14 +356,19 @@ async function replaceExactActiveWalletSessionAuthorizationInTransaction(args) {
 		const parsedCurrent = parseStoredExactWalletSessionAuthorizationRowV6(raw);
 		if (!parsedCurrent) throw new Error("Stored Wallet Session authorization v6 is corrupt");
 		const current = parsedCurrent.record;
+		if (parsedCurrent.operationCredential.walletSessionId === operationCredential.walletSessionId && (parsedCurrent.operationCredential.token !== operationCredential.token || parsedCurrent.operationCredential.ownershipGeneration !== operationCredential.ownershipGeneration)) throw new Error("Stored Wallet Session conflicts with the issued operation credential");
+		if (parsedCurrent.operationCredential.ownershipGeneration < operationCredential.ownershipGeneration) {
+			await store.delete(parsedCurrent.physicalKey);
+			continue;
+		}
 		if (current.kind !== "active_wallet_session_v1" || current.authorityId !== incoming.authorityId || current.authMethodId !== incoming.authMethodId) continue;
 		if (current.authorizationId === incoming.authorizationId && parsedCurrent.operationCredential.walletSessionId === operationCredential.walletSessionId) {
-			if (parsedCurrent.operationCredential.token !== operationCredential.token) throw new Error("Stored Wallet Session conflicts with the issued operation credential");
+			requiresWrite = !activeWalletSessionV1RecordsEqual(current, incoming);
 			continue;
 		}
 		await store.delete(parsedCurrent.physicalKey);
 	}
-	await store.put(incomingRow);
+	if (requiresWrite) await store.put(incomingRow);
 	return incoming;
 }
 async function readExactActiveWalletSessionForScopeInTransaction(args) {
@@ -429,62 +422,11 @@ var WalletSessionAuthorizationRepository = class {
 			if (field === "kind" || field === "capabilitySubjects") continue;
 			if (expected[field] !== incoming[field]) throw new Error("Wallet Session refresh changed its exact identity");
 		}
-		const operationCredential = parseWalletSessionOperationCredentialV1(input.operationCredential);
-		const incomingRow = toStoredExactWalletSessionAuthorizationRowV6(incoming, operationCredential);
-		const tx = (await this.manager.getDB()).transaction(STORE, "readwrite");
-		const store = tx.objectStore(STORE);
-		try {
-			const raw = await store.get(operationCredential.walletSessionId);
-			if (raw === void 0) {
-				await tx.done;
-				return "superseded";
-			}
-			const current = parseStoredExactWalletSessionAuthorizationRowV6(raw);
-			if (!current) throw new Error("Stored Wallet Session authorization v6 is corrupt");
-			if (!activeWalletSessionV1RecordsEqual(current.record, expected) || current.operationCredential.token !== operationCredential.token) {
-				await tx.done;
-				return "superseded";
-			}
-			await store.put(incomingRow);
-			await tx.done;
-			return "updated";
-		} catch (error) {
-			try {
-				tx.abort();
-			} catch {}
-			await settleAbortedTransaction(tx);
-			throw error;
-		}
+		const incomingRow = toStoredExactWalletSessionAuthorizationRowV6(incoming, parseWalletSessionOperationCredentialV1(input.operationCredential));
+		return this.manager.runTransaction([STORE], "readwrite", refreshExactSessionInTransaction.bind(null, expected, incomingRow));
 	}
 	async readExact(walletSessionId) {
-		const tx = (await this.manager.getDB()).transaction(STORE, "readwrite");
-		const store = tx.objectStore(STORE);
-		try {
-			const raw = await store.get(walletSessionId);
-			if (raw === void 0) {
-				await tx.done;
-				return null;
-			}
-			switch (classifyWalletSessionAuthorizationRow(raw).kind) {
-				case "future": throw new WalletSessionAuthorizationUpgradeRequiredError("Wallet Session authorization requires a newer client");
-				case "legacy":
-					await store.delete(storedWalletSessionRowKey(raw));
-					await tx.done;
-					return null;
-				case "current": break;
-				case "unknown": throw new Error("Stored Wallet Session authorization v6 is corrupt");
-			}
-			const parsed = parseStoredExactWalletSessionAuthorizationRowV6(raw);
-			if (!parsed) throw new Error("Stored Wallet Session authorization v6 is corrupt");
-			await tx.done;
-			return parsed.record;
-		} catch (error) {
-			try {
-				tx.abort();
-			} catch {}
-			await settleAbortedTransaction(tx);
-			throw error;
-		}
+		return this.manager.runTransaction([STORE], "readwrite", readExactSessionInTransaction.bind(null, walletSessionId));
 	}
 	async readExactWithOperationCredential(input) {
 		const read = await this.readExactActiveForWallet(input);
@@ -498,105 +440,109 @@ var WalletSessionAuthorizationRepository = class {
 	}
 	async readExactActiveForWallet(input) {
 		try {
-			const db = await this.manager.getDB();
-			const tx = db.transaction(STORE, "readwrite");
-			try {
-				const result = await readExactActiveWalletSessionForScopeInTransaction({
-					ctx: walletSessionTransactionContext(db, tx),
-					...input
-				});
-				if (result.kind === "corrupt") {
-					try {
-						tx.abort();
-					} catch {}
-					await settleAbortedTransaction(tx);
-					return result;
-				}
-				await tx.done;
-				return result;
-			} catch {
-				try {
-					tx.abort();
-				} catch {}
-				await settleAbortedTransaction(tx);
-				return { kind: "persistence_unavailable" };
-			}
-		} catch {
+			return await this.manager.runTransaction([STORE], "readwrite", readExactActiveSessionInTransaction.bind(null, input));
+		} catch (error) {
+			if (error instanceof CorruptWalletSessionAuthorizationError) return { kind: "corrupt" };
 			return { kind: "persistence_unavailable" };
 		}
 	}
 	async retireExactActiveForWallet(args) {
 		if (!isNonNegativeSafeInteger(args.retiredAtMs)) throw new Error("Wallet Session v1 retirement time is invalid");
-		const tx = (await this.manager.getDB()).transaction(STORE, "readwrite");
-		const store = tx.objectStore(STORE);
-		const retired = [];
-		try {
-			const rows = await store.index(SEAMS_WALLET_INDEXES.walletId).getAll(args.walletId);
-			for (const raw of rows) {
-				const classification = classifyWalletSessionAuthorizationRow(raw);
-				if (classification.kind === "future") continue;
-				if (classification.kind === "legacy") {
-					await store.delete(storedWalletSessionRowKey(raw));
-					continue;
-				}
-				if (classification.kind !== "current") continue;
-				const parsedCurrent = parseStoredExactWalletSessionAuthorizationRowV6(raw);
-				if (!parsedCurrent) {
-					tx.abort();
-					throw new Error("Stored Wallet Session authorization v6 is corrupt");
-				}
-				const current = parsedCurrent.record;
-				if (current.kind !== "active_wallet_session_v1") continue;
-				const next = retireWalletSessionV1({
-					active: current,
-					reason: args.reason,
-					retiredAtMs: args.retiredAtMs
-				});
-				await store.delete(parsedCurrent.physicalKey);
-				retired.push(next);
-			}
-			await tx.done;
-			return retired;
-		} catch (error) {
-			try {
-				tx.abort();
-			} catch {}
-			await settleAbortedTransaction(tx);
-			throw error;
-		}
+		return this.manager.runTransaction([STORE], "readwrite", retireExactSessionsInTransaction.bind(null, args));
 	}
 	async replaceExactActive(args) {
-		const db = await this.manager.getDB();
-		const tx = db.transaction(STORE, "readwrite");
-		try {
-			const incoming = await replaceExactActiveWalletSessionAuthorizationInTransaction({
-				ctx: walletSessionTransactionContext(db, tx),
-				active: args.active,
-				operationCredential: args.operationCredential
-			});
-			await tx.done;
-			return incoming;
-		} catch (error) {
-			try {
-				tx.abort();
-			} catch {}
-			await settleAbortedTransaction(tx);
-			throw error;
-		}
+		return this.manager.runTransaction([
+			STORE,
+			SEAMS_WALLET_STORES.appState,
+			SEAMS_WALLET_STORES.ecdsaClientPresignatures
+		], "readwrite", replaceExactSessionInTransaction.bind(null, args));
 	}
 	async clearWallet(walletId) {
-		const db = await this.manager.getDB();
-		const keys = await db.getAllKeysFromIndex(STORE, SEAMS_WALLET_INDEXES.walletId, walletId);
-		if (keys.length === 0) return;
-		const tx = db.transaction(STORE, "readwrite");
-		const store = tx.objectStore(STORE);
-		for (const key of keys) await store.delete(key);
-		await tx.done;
+		await this.manager.runTransaction([STORE], "readwrite", clearWalletSessionsInTransaction.bind(null, walletId));
 	}
 	async clearAll() {
-		await (await this.manager.getDB()).clear(STORE);
+		await this.manager.runTransaction([STORE], "readwrite", clearAllSessionsInTransaction);
 	}
 };
+var CorruptWalletSessionAuthorizationError = class extends Error {};
+async function refreshExactSessionInTransaction(expected, incomingRow, context) {
+	const store = context.store(STORE);
+	const operationCredential = incomingRow.operation_credential;
+	const raw = await store.get(operationCredential.walletSessionId);
+	if (raw === void 0) return "superseded";
+	const current = parseStoredExactWalletSessionAuthorizationRowV6(raw);
+	if (!current) throw new Error("Stored Wallet Session authorization v6 is corrupt");
+	if (!activeWalletSessionV1RecordsEqual(current.record, expected) || current.operationCredential.token !== operationCredential.token) return "superseded";
+	await store.put(incomingRow);
+	return "updated";
+}
+async function readExactSessionInTransaction(walletSessionId, context) {
+	const store = context.store(STORE);
+	const raw = await store.get(walletSessionId);
+	if (raw === void 0) return null;
+	switch (classifyWalletSessionAuthorizationRow(raw).kind) {
+		case "future": throw new WalletSessionAuthorizationUpgradeRequiredError("Wallet Session authorization requires a newer client");
+		case "legacy":
+			await store.delete(storedWalletSessionRowKey(raw));
+			return null;
+		case "current": break;
+		case "unknown": throw new Error("Stored Wallet Session authorization v6 is corrupt");
+	}
+	const parsed = parseStoredExactWalletSessionAuthorizationRowV6(raw);
+	if (!parsed) throw new Error("Stored Wallet Session authorization v6 is corrupt");
+	return parsed.record;
+}
+async function readExactActiveSessionInTransaction(input, ctx) {
+	const result = await readExactActiveWalletSessionForScopeInTransaction({
+		ctx,
+		walletId: input.walletId,
+		authorityId: input.authorityId,
+		authMethodId: input.authMethodId
+	});
+	if (result.kind === "corrupt") throw new CorruptWalletSessionAuthorizationError("Stored Wallet Session authorization v6 is corrupt");
+	return result;
+}
+async function retireExactSessionsInTransaction(args, context) {
+	const store = context.store(STORE);
+	const retired = [];
+	const rows = await store.index(SEAMS_WALLET_INDEXES.walletId).getAll(args.walletId);
+	for (const raw of rows) {
+		const classification = classifyWalletSessionAuthorizationRow(raw);
+		if (classification.kind === "future") continue;
+		if (classification.kind === "legacy") {
+			await store.delete(storedWalletSessionRowKey(raw));
+			continue;
+		}
+		if (classification.kind !== "current") continue;
+		const parsedCurrent = parseStoredExactWalletSessionAuthorizationRowV6(raw);
+		if (!parsedCurrent) throw new Error("Stored Wallet Session authorization v6 is corrupt");
+		const current = parsedCurrent.record;
+		if (current.kind !== "active_wallet_session_v1") continue;
+		const next = retireWalletSessionV1({
+			active: current,
+			reason: args.reason,
+			retiredAtMs: args.retiredAtMs
+		});
+		await store.delete(parsedCurrent.physicalKey);
+		retired.push(next);
+	}
+	return retired;
+}
+function replaceExactSessionInTransaction(args, ctx) {
+	return replaceExactActiveWalletSessionAuthorizationInTransaction({
+		ctx,
+		active: args.active,
+		operationCredential: args.operationCredential
+	});
+}
+async function clearWalletSessionsInTransaction(walletId, context) {
+	const store = context.store(STORE);
+	const keys = await store.index(SEAMS_WALLET_INDEXES.walletId).getAllKeys(walletId);
+	for (const key of keys) await store.delete(key);
+}
+function clearAllSessionsInTransaction(context) {
+	return context.store(STORE).clear();
+}
 const walletSessionAuthorizations = new WalletSessionAuthorizationRepository();
 //#endregion
 export { WALLET_SESSION_AUTHORIZATION_RECORD_VERSION_V6, WalletSessionAuthorizationRepository, WalletSessionAuthorizationUpgradeRequiredError, parseStoredExactWalletSessionAuthorizationRowV6, readExactActiveWalletSessionForScopeInTransaction, replaceExactActiveWalletSessionAuthorizationInTransaction, retireWalletSessionV1, toStoredExactWalletSessionAuthorizationRowV6, walletSessionAuthorizations };

package/dist/esm/core/indexedDB/unifiedIndexedDBManager.js

@@ -1,9 +1,9 @@
 import { normalizeTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import { SIGNER_KINDS } from "../../shared-ts/src/utils/signerDomain.js";
 import { seamsWalletDB } from "./singletons.js";
+import { RegistrationSetupRepository } from "./seamsWalletDB/registrationSetup.js";
 import { normalizeLastUserScope } from "./normalization.js";
 import { SeamsWalletRepositories } from "./seamsWalletDB/repositories.js";
-import { RegistrationSetupRepository } from "./seamsWalletDB/registrationSetup.js";
 //#region src/core/indexedDB/unifiedIndexedDBManager.ts
 const DEFAULT_STALE_PENDING_SIGNER_MS = 1440 * 6e4;
 const KEY_MATERIAL_SIGNER_KINDS = new Set(Object.values(SIGNER_KINDS));
@@ -347,6 +347,7 @@ var UnifiedIndexedDBManager = class {
 			accountId: args.walletId,
 			data: { preferences: updatedPreferences }
 		});
+		return updatedPreferences;
 	}
 	async deleteProfileData(profileId, args) {
 		await this.seamsWalletRepositories.deleteProfileData(profileId, this.lastUserScope);

package/dist/esm/core/indexedDB/walletCustodyEd25519MaterialRecord.js

@@ -55,6 +55,6 @@ function buildWalletCustodyEd25519MaterialRecordV1(input) {
 	};
 }
 //#endregion
-export { WALLET_CUSTODY_ED25519_MATERIAL_ALGORITHM, WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND, assertWalletCustodyEd25519MaterialBindingV1, buildWalletCustodyEd25519MaterialRecordV1 };
+export { WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND, buildWalletCustodyEd25519MaterialRecordV1 };
 
 //# sourceMappingURL=walletCustodyEd25519MaterialRecord.js.map