@seams/wallet 0.6.1 → 0.7.1

package/dist/esm/react/SeamsWeb/operations/devices/linkDeviceFlowSupport.js

@@ -0,0 +1,143 @@
+import { errorMessage } from "../../../shared-ts/src/utils/errors.js";
+import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
+import { parseLinkDeviceSessionId } from "../../../shared-ts/src/utils/domainIds.js";
+import { buildFullOwnerDelegatedWalletAuthorityV1 } from "../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { WALLET_AUTH_METHODS } from "../../../shared-ts/src/utils/signerDomain.js";
+import { assertNeverLinkSessionStateV1 } from "../../../shared-ts/src/device-linking/contracts.js";
+import { buildQrLinkedDeviceSessionPayloadV5 } from "../../../shared-ts/src/device-linking/parsers.js";
+import "../../../shared-ts/src/device-linking/index.js";
+import { LinkDeviceEventPhase } from "../../../core/types/sdkSentEvents.js";
+import { DeviceLinkingError, DeviceLinkingErrorCode, normalizeLinkedDeviceTargetEmailAddressV1 } from "../../../core/types/linkDevice.js";
+import { nextLinkedDevicePollingDelayMsV1 } from "./deviceLinkingHttpTransport.js";
+//#region src/SeamsWeb/operations/devices/linkDeviceFlowSupport.ts
+function linkedDeviceWalletAuthenticationState(walletSession, registration) {
+	switch (registration.targetFactor.kind) {
+		case "verified_passkey_target_v1": return {
+			kind: "authenticated",
+			walletId: walletSession.walletId,
+			authMethod: WALLET_AUTH_METHODS.passkey
+		};
+		case "verified_email_otp_target_v1": return {
+			kind: "authenticated",
+			walletId: walletSession.walletId,
+			authMethod: WALLET_AUTH_METHODS.emailOtp
+		};
+		default: return registration.targetFactor;
+	}
+}
+function createLinkSessionId() {
+	const parsed = parseLinkDeviceSessionId(secureRandomId("link-session", 32));
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function createFlowId() {
+	return secureRandomId("link-flow", 16);
+}
+function notifyError(callback, error) {
+	try {
+		callback?.(error);
+	} catch {}
+}
+function logDevice2LinkingStageV1(input) {
+	console.info("[Device2Linking]", {
+		flowId: input.flowId,
+		linkSessionId: input.linkSessionId,
+		stage: input.stage,
+		...input.details
+	});
+}
+function logDevice2LinkingFailureV1(input) {
+	console.error("[Device2Linking] failed", {
+		flowId: input.flowId,
+		linkSessionId: input.linkSessionId,
+		state: input.state,
+		error: errorMessage(input.error)
+	});
+}
+function resolveSessionStateRetry(resolve, attempt) {
+	setTimeout(resolve, nextLinkedDevicePollingDelayMsV1(250, attempt));
+}
+async function waitForSessionStateRetry(attempt) {
+	await new Promise((resolve) => resolveSessionStateRetry(resolve, attempt));
+}
+function phaseForState(state) {
+	switch (state.state) {
+		case "displaying_qr":
+		case "expired":
+		case "cancelled": return LinkDeviceEventPhase.STEP_01_QR_PREPARE_STARTED;
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning":
+		case "authority_pending_local_install":
+		case "active": return LinkDeviceEventPhase.STEP_02_QR_SCAN_STARTED;
+		case "failed_before_commit": return LinkDeviceEventPhase.FAILED;
+		default: return assertNeverLinkSessionStateV1(state);
+	}
+}
+function errorForFailure(error, phase) {
+	if (error instanceof DeviceLinkingError) return error;
+	return new DeviceLinkingError(errorMessage(error) || "Device linking failed", DeviceLinkingErrorCode.REGISTRATION_FAILED, phase);
+}
+/**
+* These failures happen after the server has committed the linked authority.
+* The original delivery is intentionally abandoned; exact-method unlock uses
+* the durable local installation to obtain a successor Wallet Session.
+*/
+function classifyLinkedDeviceDeliveryFailureV1(error) {
+	const message = errorMessage(error).toLowerCase();
+	if (message.includes("device-linking key handle is unknown or discarded") || message.includes("recipient handle lost")) return "recipient_private_handle_lost";
+	if (message.includes("linked-device wallet session credential delivery is expired")) return "sealed_delivery_expired";
+	return null;
+}
+function linkedDeviceDeliveryRecoveryMessageV1(reason) {
+	switch (reason) {
+		case "recipient_private_handle_lost":
+		case "sealed_delivery_expired": return "The linked device is ready. Return to sign in and unlock the new method to finish setup.";
+		default: return reason;
+	}
+}
+var LinkDeviceFlowSupersededError = class extends Error {
+	constructor() {
+		super("Device-link flow was cancelled or reset");
+		this.name = "LinkDeviceFlowSupersededError";
+	}
+};
+async function generateQrCodeDataUrlV1(payload) {
+	let qrcode;
+	try {
+		qrcode = await import("qrcode");
+	} catch {
+		throw new DeviceLinkingError("Device-link QR generation requires the optional qrcode package", DeviceLinkingErrorCode.UNSUPPORTED, "generation");
+	}
+	return await qrcode.toDataURL(payload, {
+		errorCorrectionLevel: "M",
+		margin: 2
+	});
+}
+function buildDevice2QrSessionPayloadV1(input) {
+	const requestedPermission = buildFullOwnerDelegatedWalletAuthorityV1();
+	if (input.target.targetFactor.kind === "email_otp") return buildQrLinkedDeviceSessionPayloadV5({
+		linkSessionId: input.linkSessionId,
+		linkPublicKeyB64u: input.linkPublicKeyB64u,
+		devicePublicKeyB64u: input.devicePublicKeyB64u,
+		requestedPermission,
+		targetFactor: { kind: "email_otp" },
+		targetEmail: normalizeLinkedDeviceTargetEmailAddressV1(input.target.targetEmail),
+		issuedAtMs: input.issuedAtMs,
+		expiresAtMs: input.expiresAtMs
+	});
+	return buildQrLinkedDeviceSessionPayloadV5({
+		linkSessionId: input.linkSessionId,
+		linkPublicKeyB64u: input.linkPublicKeyB64u,
+		devicePublicKeyB64u: input.devicePublicKeyB64u,
+		requestedPermission,
+		targetFactor: { kind: "passkey_prf" },
+		issuedAtMs: input.issuedAtMs,
+		expiresAtMs: input.expiresAtMs
+	});
+}
+//#endregion
+export { LinkDeviceFlowSupersededError, buildDevice2QrSessionPayloadV1, classifyLinkedDeviceDeliveryFailureV1, createFlowId, createLinkSessionId, errorForFailure, generateQrCodeDataUrlV1, linkedDeviceDeliveryRecoveryMessageV1, linkedDeviceWalletAuthenticationState, logDevice2LinkingFailureV1, logDevice2LinkingStageV1, notifyError, phaseForState, waitForSessionStateRetry };
+
+//# sourceMappingURL=linkDeviceFlowSupport.js.map

package/dist/esm/react/SeamsWeb/operations/devices/linkDeviceTargetActivation.js

@@ -0,0 +1,119 @@
+import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
+import { parsePasskeyEnvelopeId } from "../../../shared-ts/src/utils/domainIds.js";
+//#region src/SeamsWeb/operations/devices/linkDeviceTargetActivation.ts
+function isPasskeyTargetPreparation(preparation) {
+	return preparation.targetFactor.kind === "passkey_prf";
+}
+function isEmailOtpTargetPreparation(preparation) {
+	return preparation.targetFactor.kind === "email_otp";
+}
+function emailOtpTargetActivationBaseContextV1(context) {
+	return {
+		event: context.event,
+		state: context.state,
+		runEpoch: context.runEpoch,
+		deviceId: context.deviceId,
+		preparation: context.preparation,
+		ordinarySignerMaterialRecipientRequests: context.ordinarySignerMaterialRecipientRequests,
+		exportRoot: context.exportRoot
+	};
+}
+function requireCompletedEmailOtpTargetActivationStateV1(state) {
+	if (state.kind !== "completed" || !state.factorSecret || typeof state.providerUserId !== "string") throw new Error("linked-device Email OTP factor runtime is unavailable");
+	return {
+		kind: "completed",
+		runEpoch: state.runEpoch,
+		enrollment: state.enrollment,
+		factorSecret: state.factorSecret,
+		providerUserId: state.providerUserId
+	};
+}
+function assertNeverEmailOtpTargetActivationState(value) {
+	throw new Error(`Unknown Email OTP target activation state: ${String(value)}`);
+}
+function assertNeverTargetCredentialActivationState(value) {
+	throw new Error(`Unknown target credential activation state: ${String(value)}`);
+}
+function resolvePostLinkActivationV1(input) {
+	switch (input.targetFactor.kind) {
+		case "verified_passkey_target_v1": {
+			const activation = input.targetCredentialActivationState;
+			if (activation.kind !== "factor_ready" || activation.runEpoch !== input.runEpoch) throw new Error("linked-device Passkey factor runtime is unavailable");
+			return {
+				factor: {
+					kind: "passkey",
+					walletId: input.walletId
+				},
+				factorSecret32: activation.factorSecret
+			};
+		}
+		case "verified_email_otp_target_v1": {
+			const activation = requireCompletedEmailOtpTargetActivationStateV1(input.emailOtpTargetActivationState);
+			if (activation.runEpoch !== input.runEpoch) throw new Error("linked-device Email OTP factor runtime is unavailable");
+			return {
+				factor: {
+					kind: "email_otp",
+					walletId: input.walletId,
+					walletAuthMethodId: input.walletAuthMethodId,
+					emailHashHex: input.targetFactor.authMethod.emailHashHex,
+					providerIdentity: {
+						provider: emailOtpProviderForLinkedEnrollment(activation.enrollment),
+						providerSubjectId: activation.providerUserId
+					}
+				},
+				factorSecret32: activation.factorSecret
+			};
+		}
+		default: return assertNeverVerifiedTargetFactor(input.targetFactor);
+	}
+}
+function assertNeverVerifiedTargetFactor(value) {
+	throw new Error(`Unknown verified target factor kind: ${String(value)}`);
+}
+function zeroizeLiveBytes(value) {
+	if (value.byteLength > 0) value.fill(0);
+}
+function emailOtpProviderForLinkedEnrollment(enrollment) {
+	return enrollment.kind === "existing_enrollment" ? "google" : "email";
+}
+function requireTargetRpIdV1(preparation) {
+	return preparation.passkeyCreationOptions.rpId;
+}
+function requireEmailOtpTargetPreparationV1(preparation) {
+	if (!isEmailOtpTargetPreparation(preparation)) throw new Error("linked-device Email OTP preparation is unavailable");
+	return preparation;
+}
+function createExportRootEnvelopeIdV1() {
+	const parsed = parsePasskeyEnvelopeId(secureRandomId("linked-device-ed25519-export-root-envelope", 24, "export-root envelope ids"));
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function createEmailOtpFactorSecretV1() {
+	return crypto.getRandomValues(new Uint8Array(32));
+}
+async function prepareNewEmailOtpEnrollmentMaterialV1(input) {
+	const disposableSecret = input.factorSecret.slice();
+	try {
+		const material = await input.context.signingEngine.prepareEmailOtpRegistrationEnrollmentMaterialInternal({
+			relayUrl: String(input.context.configs.network.relayer.url || "").trim(),
+			walletId: input.walletId,
+			userId: input.targetEmail,
+			clientSecret32: disposableSecret
+		});
+		if (material.emailOtpSessionHandle.kind !== "not_requested") throw new Error("Strict linked-device Email OTP enrollment received obsolete ECDSA material");
+		return {
+			enrollmentId: material.enrollmentId,
+			enrollment: material.emailOtpEnrollment
+		};
+	} finally {
+		zeroizeLiveBytes(disposableSecret);
+	}
+}
+function requireNewEmailOtpEnrollmentMaterialV1(value) {
+	if (!value) throw new Error("new linked-device Email OTP enrollment material is unavailable");
+	return value;
+}
+//#endregion
+export { assertNeverEmailOtpTargetActivationState, assertNeverTargetCredentialActivationState, createEmailOtpFactorSecretV1, createExportRootEnvelopeIdV1, emailOtpTargetActivationBaseContextV1, isEmailOtpTargetPreparation, isPasskeyTargetPreparation, prepareNewEmailOtpEnrollmentMaterialV1, requireCompletedEmailOtpTargetActivationStateV1, requireEmailOtpTargetPreparationV1, requireNewEmailOtpEnrollmentMaterialV1, requireTargetRpIdV1, resolvePostLinkActivationV1, zeroizeLiveBytes };
+
+//# sourceMappingURL=linkDeviceTargetActivation.js.map

package/dist/esm/react/SeamsWeb/operations/devices/walletHostComposition.js

@@ -1,6 +1,7 @@
-import { parseLinkedDeviceListRequestV1, parseLinkedDeviceListResultV1, parseLinkedDeviceRevokeRequestV1, parseLinkedDeviceRevokeResultV1 } from "../../../shared-ts/src/device-linking/parsers.js";
+import { parseLinkedDeviceListRequestV1, parseLinkedDeviceListResultV1, parseLinkedDeviceRevokeRequestV1, parseLinkedDeviceRevokeResultV1 } from "../../../shared-ts/src/device-linking/deviceManagement.js";
 import "../../../shared-ts/src/device-linking/index.js";
 import { createDeviceLinkingFlowPortsV1 } from "./deviceLinkingComposition.js";
+import { WalletHostOwnerRequestTransportError } from "./walletHostOwnerAuthority.js";
 //#region src/SeamsWeb/operations/devices/walletHostComposition.ts
 const LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1 = "/wallet/device-linking/v1/devices";
 const OWNER_WALLET_SESSION_REAUTH_REQUIRED = "owner_wallet_session_reauth_required";
@@ -44,7 +45,7 @@ function createWalletHostLinkedDeviceManagementPortV1(args) {
 				walletAuthMethodId,
 				requestedAtMs
 			});
-			return parseManagementRevokeResult(await args.request.request({
+			const send = async () => await args.request.request({
 				method: "POST",
 				canonicalPath: `${LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1}/${encodeURIComponent(String(walletAuthMethodId))}/revoke`,
 				body: {
@@ -52,7 +53,16 @@ function createWalletHostLinkedDeviceManagementPortV1(args) {
 					sourceProof
 				},
 				walletId
-			}));
+			});
+			let response;
+			try {
+				response = await send();
+			} catch (error) {
+				if (!(error instanceof WalletHostOwnerRequestTransportError)) throw error;
+				if (error.code !== "network_error") throw error;
+				response = await send();
+			}
+			return parseManagementRevokeResult(response);
 		}
 	};
 }

package/dist/esm/react/SeamsWeb/operations/devices/walletHostOwnerAuthority.js

@@ -8,6 +8,14 @@ import { WalletSessionAuthorizationUpgradeRequiredError } from "../../../core/in
 import { DeviceLinkingError, DeviceLinkingErrorCode } from "../../../core/types/linkDevice.js";
 //#region src/SeamsWeb/operations/devices/walletHostOwnerAuthority.ts
 const OWNER_AUTHORIZATION_PATH = "/wallet/device-linking/v1/owner-authorization";
+/** An owner request that received no answer: the network failed, or it timed out. */
+var WalletHostOwnerRequestTransportError = class extends Error {
+	constructor(code, message) {
+		super(`Owner Router request failed: ${message}`);
+		this.code = code;
+		this.name = "WalletHostOwnerRequestTransportError";
+	}
+};
 function createWalletHostOwnerAuthoritiesV1(input) {
 	const context = normalizeContext(input);
 	return {
@@ -25,7 +33,7 @@ function normalizeContext(input) {
 	};
 }
 /**
-* The R103 fail-closed preflight, exact result `wallet_unlock_required`.
+* The fail-closed preflight, exact result `wallet_unlock_required`.
 *
 * The locked and missing-session arms run before any network I/O. The
 * export-root arm runs after the stateless owner-authorization read, because
@@ -109,7 +117,7 @@ async function requestWithCredentialV1(context, walletSessionToken, input) {
 		headers: { authorization: `Bearer ${walletSessionToken}` },
 		...input.body === void 0 ? {} : { body: input.body }
 	});
-	if (!response.ok) throw new Error(`Owner Router request failed: ${response.message}`);
+	if (!response.ok) throw new WalletHostOwnerRequestTransportError(response.code, response.message);
 	return response.value;
 }
 function parseOwnerAuthorizationResponseV1(raw, session) {
@@ -178,6 +186,6 @@ function positiveSafeInteger(raw, label) {
 	return Number(raw);
 }
 //#endregion
-export { createWalletHostOwnerAuthoritiesV1 };
+export { WalletHostOwnerRequestTransportError, createWalletHostOwnerAuthoritiesV1 };
 
 //# sourceMappingURL=walletHostOwnerAuthority.js.map

package/dist/esm/react/SeamsWeb/operations/near/index.js

@@ -1,4 +1,4 @@
-import { implicitNearAccountProvisioning } from "../../../shared-ts/src/utils/registrationIntent.js";
+import { implicitNearAccountProvisioning } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
 import "./delegateAction.js";
 import { buildNearWalletRegistrationSignerSetSelection } from "../registration/registrationSignerSet.js";
 //#region src/SeamsWeb/operations/near/index.ts

package/dist/esm/react/SeamsWeb/operations/recovery/accountSync.js

@@ -1,4 +1,4 @@
-import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
+import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { syncAccount } from "./syncAccount.js";
 //#region src/SeamsWeb/operations/recovery/accountSync.ts
 var AccountSyncDomain = class {

package/dist/esm/react/SeamsWeb/operations/recovery/recoveryWalletBinding.js

@@ -1,6 +1,6 @@
 import { isObject } from "../../../shared-ts/src/utils/validation.js";
 import { parseWebAuthnCredentialIdB64u } from "../../../shared-ts/src/utils/domainIds.js";
-import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
+import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { toAccountId } from "../../../core/types/accountIds.js";
 //#region src/SeamsWeb/operations/recovery/recoveryWalletBinding.ts
 function requireBindingString(raw, field, context) {

package/dist/esm/react/SeamsWeb/operations/recovery/syncAccount.js

@@ -1,18 +1,18 @@
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { errorMessage } from "../../../shared-ts/src/utils/errors.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { buildThresholdEd25519Participants2pV1 } from "../../../shared-ts/src/threshold/participants.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { getPrfFirstB64uFromCredential, redactCredentialExtensionOutputs } from "../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
 import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
-import { deriveEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { replaceActiveWalletAuthorityEd25519MaterialActivationV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
-import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
 import { parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { thresholdEcdsaChainTargetKey } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
+import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
+import { deriveEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
 import "../../../shared-ts/src/signing-lanes/index.js";
+import { thresholdEcdsaChainTargetKey } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
+import { replaceActiveWalletAuthorityEd25519MaterialActivationV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildRecoveredWalletSessionState, parsePasskeyEd25519YaoSyncResponseV1, passkeyEd25519YaoLaneReferenceFromRecovery } from "../../../core/signingEngine/flows/recovery/passkeyEd25519YaoRecovery.js";
 import { AccountSyncEventPhase, createAccountSyncFlowEvent } from "../../../core/types/sdkSentEvents.js";
 import { WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND } from "../../../core/indexedDB/walletCustodyEd25519MaterialRecord.js";

package/dist/esm/react/SeamsWeb/operations/recovery/walletRecoveryCommit.js

@@ -1,27 +1,23 @@
-import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
+import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import "../../../shared-ts/src/utils/encoders.js";
 import { parseEmailOtpProviderUserId, parseThresholdEd25519SessionId } from "../../../shared-ts/src/utils/domainIds.js";
-import { computeEcdsaDerivationRoleLocalRelayerKeyId } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { walletAuthorityDigestsMatchV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
-import { sameWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/registrationIntent.js";
 import { buildEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { computeEcdsaDerivationRoleLocalRelayerKeyId } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { toAccountId } from "../../../core/types/accountIds.js";
+import { sameWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { sameVerifiedActiveWalletAuthorityV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletRecoveryCommittedProjectionV1 } from "../../../shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js";
 import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { buildEcdsaRoleLocalPublicFacts } from "../../../core/signingEngine/session/persistence/ecdsaRoleLocalRecords.js";
-import { prepareWalletCustodyEcdsaContinuity } from "../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
+import { prepareWalletCustodyEcdsaContinuity } from "../../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js";
 import { prepareWalletRecoveryEmailOtpPublication, prepareWalletRecoveryPasskeyPublication } from "../../../core/signingEngine/flows/registration/accountLifecycle.js";
 import { finalizeWalletRecovery, replayWalletRecovery } from "../../../core/rpcClients/relayer/walletRecoveryFinalize.js";
 import { finalizeWalletRecoveryGoogleEmailOtp, replayWalletRecoveryGoogleEmailOtp } from "../../../core/rpcClients/relayer/walletRecoveryGoogleEmailOtp.js";
 import { durableEmailEnrollmentReference, isDurablePasskeyPayload } from "./walletRecoveryDurablePayload.js";
 import { decryptWalletRecoveryDurablePayload, promotedPendingWalletRecoveryCommit, requireWalletRecoveryOperationId } from "./walletRecoveryJournal.js";
 //#region src/SeamsWeb/operations/recovery/walletRecoveryCommit.ts
-async function sameVerifiedActiveWalletAuthorityV1(left, right) {
-	const [leftVerified, rightVerified] = await Promise.all([walletAuthorityDigestsMatchV1(left), walletAuthorityDigestsMatchV1(right)]);
-	return leftVerified && rightVerified && left.authorityDigestB64u === right.authorityDigestB64u && left.signerActivationSetDigestB64u === right.signerActivationSetDigestB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs && left.activatedAtMs === right.activatedAtMs;
-}
 async function sameWalletRecoveryCommittedProjectionV1(left, right) {
 	if (left.version !== right.version || left.storeVersion !== right.storeVersion || left.walletId !== right.walletId || left.recoveryOperationId !== right.recoveryOperationId || left.targetDeviceId !== right.targetDeviceId || left.targetAuthorityId !== right.targetAuthorityId || left.targetWalletAuthMethodId !== right.targetWalletAuthMethodId || !await sameVerifiedActiveWalletAuthorityV1(left.authority, right.authority) || !sameWalletAuthMethodRecordV2(left.authMethod, right.authMethod)) return false;
 	if (left.kind !== right.kind) return false;

package/dist/esm/react/SeamsWeb/operations/recovery/walletRecoveryDurablePayload.js

@@ -1,11 +1,13 @@
 import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
+import { requireRecord } from "../../../shared-ts/src/utils/validation.js";
 import { sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
 import "../../../shared-ts/src/utils/encoders.js";
 import { normalizeThresholdRuntimePolicyScope } from "../../../core/signingEngine/threshold/sessionPolicy.js";
 import { parseEmailOtpProviderUserId, parseThresholdEd25519SessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, rejectUnknownFields, requireRecord } from "../../../shared-ts/src/passkey-custody/primitives.js";
+import { rejectUnknownFields } from "../../../shared-ts/src/utils/exactRecord.js";
+import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u } from "../../../shared-ts/src/passkey-custody/primitives.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
 import { parseRecoveryCodeReservationId } from "../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";

package/dist/esm/react/SeamsWeb/operations/registration/pendingEcdsaRegistrationRecovery.js

@@ -1,9 +1,43 @@
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { parseEcdsaRoleLocalMaterialHandle } from "../../../core/signingEngine/session/keyMaterialBrands.js";
-import { prepareWalletCustodyEcdsaContinuity } from "../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
+import { buildEcdsaCapabilityScope } from "../../../core/signingEngine/session/material/ecdsaCapabilityManifest.js";
+import { ecdsaCapabilityScopesMatch, runtimePolicyScopesMatch } from "../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestRecords.js";
+import { IndexedDbEcdsaCapabilityManifestStore } from "../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
+import { prepareWalletCustodyEcdsaContinuity } from "../../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js";
 import { prepareWalletEcdsaRegistrationPublication } from "../../../core/signingEngine/flows/registration/accountLifecycle.js";
 import { pendingEcdsaActivateRequest, requireCommittedEcdsaRegistrationResponse, requireEcdsaProjection, requireResponseWalletKeys } from "./pendingEcdsaRegistrationRecoveryValidation.js";
 //#region src/SeamsWeb/operations/registration/pendingEcdsaRegistrationRecovery.ts
+async function prepareRegistrationContinuity(input) {
+	const store = new IndexedDbEcdsaCapabilityManifestStore();
+	const materialActivation = routerAbMpcMaterialActivationRefFromWire(input.activationReceipt.ecdsa_activation.material_activation);
+	const existing = await store.lookupByMaterialActivation({
+		walletId: input.authority.walletId,
+		authority: input.authority,
+		materialActivation
+	});
+	if (existing.kind === "missing") {
+		const prepared = await prepareWalletCustodyEcdsaContinuity(input);
+		return {
+			roleLocalMaterialRef: prepared.roleLocalMaterialRef,
+			publication: [prepared]
+		};
+	}
+	if (existing.kind !== "active") throw new Error(`Pending ECDSA registration continuity is ${existing.kind}`);
+	const manifest = existing.manifest;
+	const material = manifest.durableMaterial;
+	if (!sameRouterAbEcdsaRegistrationActivationReceiptV1(manifest.activation.serverActivation.serverActivationReceipt.protocolReceipt, input.activationReceipt) || !sameRouterAbEcdsaDerivationPublicCapabilityV1(material.roleLocalPublicFacts.publicCapability, input.publicCapability) || !ecdsaCapabilityScopesMatch(manifest.signer.scope, buildEcdsaCapabilityScope({ targetMemberships: input.chainTargets })) || material.roleLocalBinding.keyHandle !== input.keyHandle || material.roleLocalBinding.ecdsaThresholdKeyId !== input.ecdsaThresholdKeyId || material.roleLocalBinding.relayerKeyId !== input.relayerKeyId || material.bindingDigest !== input.publicFacts.contextBinding32B64u || manifest.signer.signingRootId !== input.signingRootId || manifest.signer.signingRootVersion !== input.signingRootVersion || !runtimePolicyScopesMatch(material.runtimePolicyScope, input.runtimePolicyScope)) throw new Error("Pending ECDSA registration conflicts with its restored activation");
+	return {
+		roleLocalMaterialRef: {
+			kind: "ecdsa_role_local_persisted_material_ref_v1",
+			durableMaterialRef: material.durableMaterialRef,
+			bindingDigest: material.bindingDigest,
+			materialActivation
+		},
+		publication: []
+	};
+}
 function nonEmptyWalletKeys(walletKeys) {
 	const first = walletKeys[0];
 	if (!first) throw new Error("ECDSA registration finalization returned no wallet keys");
@@ -60,7 +94,7 @@ function publicationInput(args) {
 			walletSession: args.session.session.wallet_session,
 			operationCredential: args.session.session.operation_credential
 		},
-		ecdsaContinuity: [args.ecdsaContinuity],
+		ecdsaContinuity: args.ecdsaContinuity,
 		registration: args.registration
 	};
 }
@@ -83,7 +117,7 @@ async function resumePendingEcdsaRegistration(args) {
 	const primaryKey = responseWalletKeys[0];
 	if (!primaryKey) throw new Error("ECDSA registration activation returned no primary key");
 	const authority = await walletAuthAuthorityRef({ authority: committed.authority });
-	const continuity = await prepareWalletCustodyEcdsaContinuity({
+	const continuity = await prepareRegistrationContinuity({
 		authority,
 		chainTargets: nonEmptyChainTargets(responseWalletKeys),
 		walletId: String(args.pending.walletId),
@@ -135,7 +169,7 @@ async function resumePendingEcdsaRegistration(args) {
 		response: committed,
 		registration,
 		session: unlocked.session,
-		ecdsaContinuity: continuity
+		ecdsaContinuity: continuity.publication
 	}));
 	return {
 		kind: "published",

package/dist/esm/react/SeamsWeb/operations/registration/pendingEcdsaRegistrationRecoveryUnlock.js

@@ -1,12 +1,13 @@
 import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { joinNormalizedUrl } from "../../../shared-ts/src/utils/normalize.js";
+import { requireNonEmptyString, requireRecord } from "../../../shared-ts/src/utils/validation.js";
 import { DEFAULT_THRESHOLD_SESSION_POLICY } from "../../../core/signingEngine/threshold/sessionPolicy.js";
 import { SIGNING_SESSION_SEAL_GROUP_ID } from "../../../shared-ts/src/utils/signingSessionSeal.js";
 import { parseThresholdEcdsaSessionId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseWalletSessionMintId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { thresholdEcdsaChainTargetKey, toWalletId } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../shared-ts/src/utils/emailOtpDomain.js";
+import { thresholdEcdsaChainTargetKey, toWalletId } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { verifyPasskeyWalletUnlock } from "../../../core/rpcClients/near/rpcCalls.js";
 import { WalletSessionStatusReadScope } from "../../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { joinCustodyJsonFromEstablishedCommitPayload } from "../../../core/signingEngine/walletCustody/registrationCeremony.js";
@@ -16,39 +17,6 @@ import { generateSessionId } from "../../../core/signingEngine/session/passkey/p
 import { requireEcdsaProjection } from "./pendingEcdsaRegistrationRecoveryValidation.js";
 import { passkeyCredentialIdB64uFromAuthentication, requirePasskeyPrfFirstB64u } from "../authMethods/passkey/ecdsaBootstrap.js";
 //#region src/SeamsWeb/operations/registration/pendingEcdsaRegistrationRecoveryUnlock.ts
-function decodePasskeyUnlockChallengeResponse(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) return {
-		kind: "error",
-		message: null
-	};
-	const fields = new Map(Object.entries(value));
-	const names = [...fields.keys()];
-	const successFields = new Set([
-		"ok",
-		"challengeId",
-		"challengeB64u"
-	]);
-	if (names.length === successFields.size && names.every((name) => successFields.has(name)) && fields.get("ok") === true) {
-		const challengeId = fields.get("challengeId");
-		const challengeB64u = fields.get("challengeB64u");
-		if (typeof challengeId === "string" && challengeId.trim() && typeof challengeB64u === "string" && challengeB64u.trim()) return {
-			kind: "success",
-			challengeId: challengeId.trim(),
-			challengeB64u: challengeB64u.trim()
-		};
-	}
-	if (names.every((name) => name === "ok" || name === "message")) {
-		const message = fields.get("message");
-		return {
-			kind: "error",
-			message: typeof message === "string" ? message : null
-		};
-	}
-	return {
-		kind: "error",
-		message: null
-	};
-}
 function requireParsedThresholdSessionId(value) {
 	const parsed = parseThresholdEcdsaSessionId(value);
 	if (!parsed.ok) throw new Error("ECDSA registration recovery could not create a session id");
@@ -82,9 +50,12 @@ async function requestPasskeyUnlockChallenge(args) {
 			rpId: args.rpId
 		})
 	});
-	const body = decodePasskeyUnlockChallengeResponse(await response.json().catch(() => ({})));
-	if (!response.ok || body.kind !== "success") throw new Error(body.kind === "error" && body.message ? body.message : `wallet/unlock/challenge failed (HTTP ${response.status})`);
-	return body;
+	const body = requireRecord(await response.json().catch(() => ({})), "Passkey unlock challenge response");
+	if (!response.ok || body.ok !== true) throw new Error(typeof body.message === "string" && body.message ? body.message : `wallet/unlock/challenge failed (HTTP ${response.status})`);
+	return {
+		challengeId: requireNonEmptyString(body.challengeId, "Passkey unlock challenge ID"),
+		challengeB64u: requireNonEmptyString(body.challengeB64u, "Passkey unlock challenge")
+	};
 }
 function isAuthenticatorTransport(value) {
 	return value === "ble" || value === "hybrid" || value === "internal" || value === "nfc" || value === "usb";
@@ -102,11 +73,19 @@ function assertIssuedEcdsaSessionMatchesRegistration(args) {
 }
 function assertCustodyContinuityMatchesRegistration(args) {
 	if (args.signers.length !== args.walletKeys.length) throw new Error("ECDSA registration unlock returned incomplete custody continuity");
-	args.signers.forEach((signer, index) => {
-		const walletKey = args.walletKeys[index];
+	const remainingTargets = /* @__PURE__ */ new Map();
+	for (const walletKey of args.walletKeys) {
+		const target = thresholdEcdsaChainTargetKey(walletKey.chainTarget);
+		if (remainingTargets.has(target)) throw new Error("ECDSA registration has duplicate custody targets");
+		remainingTargets.set(target, walletKey);
+	}
+	for (const signer of args.signers) {
+		const target = thresholdEcdsaChainTargetKey(signer.chainTarget);
+		const walletKey = remainingTargets.get(target);
 		if (!walletKey) throw new Error("ECDSA registration unlock returned an unknown target");
-		if (thresholdEcdsaChainTargetKey(signer.chainTarget) !== thresholdEcdsaChainTargetKey(walletKey.chainTarget) || signer.walletKey.walletId !== args.pending.walletId || signer.walletKey.keyHandle !== walletKey.keyHandle || signer.walletKey.ecdsaThresholdKeyId !== walletKey.ecdsaThresholdKeyId || signer.walletKey.signingRootId !== walletKey.signingRootId || signer.walletKey.signingRootVersion !== walletKey.signingRootVersion || signer.walletKey.relayerKeyId !== walletKey.relayerKeyId || signer.walletKey.contextBinding32B64u !== walletKey.contextBinding32B64u || signer.walletKey.derivationClientSharePublicKey33B64u !== walletKey.derivationClientSharePublicKey33B64u || !sameRouterAbEcdsaDerivationPublicCapabilityV1(signer.walletKey.publicCapability, walletKey.publicCapability) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(signer.activationReceipt, args.response.ecdsa.activation)) throw new Error("ECDSA registration unlock returned different custody continuity");
-	});
+		remainingTargets.delete(target);
+		if (signer.walletKey.walletId !== args.pending.walletId || signer.walletKey.keyHandle !== walletKey.keyHandle || signer.walletKey.ecdsaThresholdKeyId !== walletKey.ecdsaThresholdKeyId || signer.walletKey.signingRootId !== walletKey.signingRootId || signer.walletKey.signingRootVersion !== walletKey.signingRootVersion || signer.walletKey.relayerKeyId !== walletKey.relayerKeyId || signer.walletKey.contextBinding32B64u !== walletKey.contextBinding32B64u || signer.walletKey.derivationClientSharePublicKey33B64u !== walletKey.derivationClientSharePublicKey33B64u || !sameRouterAbEcdsaDerivationPublicCapabilityV1(signer.walletKey.publicCapability, walletKey.publicCapability) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(signer.activationReceipt, args.response.ecdsa.activation)) throw new Error("ECDSA registration unlock returned different custody continuity");
+	}
 }
 function zeroizeArrayBuffer(buffer) {
 	new Uint8Array(buffer).fill(0);

package/dist/esm/react/SeamsWeb/operations/registration/pendingEcdsaRegistrationRecoveryValidation.js

@@ -27,10 +27,10 @@ function samePendingEcdsaProjection(pending, response, walletKey) {
 	const projection = requireEcdsaProjection(response);
 	return response.walletId === pending.walletId && response.custodyKeyManifestDigestB64u === pending.localMaterial.custodyCommit.keyManifestDigestB64u && response.walletCustody?.status === "committed" && session.walletId === pending.walletId && session.walletSession.walletId === pending.walletId && session.walletSession.authMethodId === pending.walletAuthMethodId && session.tokens.kind === "evm_family_ecdsa" && projection.ecdsa.keyHandle === walletKey.keyHandle && projection.ecdsa.thresholdSessionId === response.ecdsa.bootstrap.thresholdSessionId && session.expiresAtMs === response.ecdsa.bootstrap.expiresAtMs && session.remainingUses === response.ecdsa.bootstrap.remainingUses;
 }
-function samePendingEcdsaClientActivationFacts(activation, expected) {
+function samePendingEcdsaClientActivationFacts(activation, walletKey, expected) {
 	const identity = activation.ecdsa_activation.public_identity;
 	return sameRouterAbEcdsaVerifiedClientActivationFactsV1({
-		registrationRequestDigestB64u: base64UrlEncode(Uint8Array.from(activation.activation_request_digest.bytes)),
+		registrationRequestDigestB64u: walletKey.publicCapability.registration_request_digest_b64u,
 		proofTranscriptDigestB64u: base64UrlEncode(Uint8Array.from(activation.transcript_digest.bytes)),
 		contextBinding32B64u: identity.context_binding_b64u,
 		derivationClientSharePublicKey33B64u: identity.derivation_client_share_public_key33_b64u,
@@ -107,7 +107,7 @@ function assertActivationFacts(pending, response, walletKey) {
 	const receipt = activation.ecdsa_activation;
 	const identity = receipt.public_identity;
 	const client = pending.localMaterial.ecdsa.clientActivation;
-	if (activation.activation_correlation_id !== pending.localMaterial.ecdsa.activationJournalId || !samePendingEcdsaClientActivationFacts(activation, client) || !samePendingEcdsaBootstrapPublicIdentity(response.ecdsa.bootstrap.publicIdentity, walletKey) || receipt.context.application_binding_digest_b64u !== response.ecdsa.bootstrap.applicationBindingDigestB64u || !samePendingEcdsaActivationPublicIdentity(identity, walletKey)) throw new Error("pending ECDSA activation facts mismatch");
+	if (activation.activation_correlation_id !== pending.localMaterial.ecdsa.activationJournalId || base64UrlEncode(Uint8Array.from(activation.activation_request_digest.bytes)) !== pending.localMaterial.ecdsa.activationRequestDigestB64u || !samePendingEcdsaClientActivationFacts(activation, walletKey, client) || !samePendingEcdsaBootstrapPublicIdentity(response.ecdsa.bootstrap.publicIdentity, walletKey) || receipt.context.application_binding_digest_b64u !== response.ecdsa.bootstrap.applicationBindingDigestB64u || !samePendingEcdsaActivationPublicIdentity(identity, walletKey)) throw new Error("pending ECDSA activation facts mismatch");
 	if (!samePendingEcdsaBootstrapKeyIdentity(response.ecdsa.bootstrap, walletKey)) throw new Error("pending ECDSA bootstrap changed committed key identity");
 }
 function assertProjectionEcdsaFacts(response) {