@seams/wallet 0.6.2 → 0.7.1

package/dist/esm/react/SeamsWeb/operations/auth/login.js

@@ -1,7 +1,7 @@
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
 import { deriveImplicitNearAccountIdFromEd25519PublicKey } from "../../../shared-ts/src/utils/near.js";
 import { getUserFriendlyErrorMessage, isUserCancellationError, toError } from "../../../shared-ts/src/utils/errors.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
 import { joinNormalizedUrl } from "../../../shared-ts/src/utils/normalize.js";
 import { isObject } from "../../../shared-ts/src/utils/validation.js";
@@ -11,21 +11,21 @@ import { parseRouterAbEd25519NormalSigningState } from "../../../shared-ts/src/u
 import { mpcMaterialActivationRefsEqual, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { nearEd25519SigningKeyIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/parsers.js";
+import { parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { buildPasskeyWalletAuthAuthority, parseEmailOtpWalletAuthAuthority, parseWalletAuthAuthorityRef, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbServerIdentityV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { buildEmailOtpWalletAuthMethodBinding, buildPasskeyAuthScope, buildPasskeyWalletAuthMethodBinding, buildWalletIdentity, parseRpId } from "../../../shared-ts/src/utils/walletCapabilityBindings.js";
-import { thresholdEcdsaChainTargetKey } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { SIGNER_AUTH_METHODS } from "../../../shared-ts/src/utils/signerDomain.js";
+import { nearEd25519SigningKeyIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
+import { thresholdEcdsaChainTargetKey } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { buildBaseEvmFamilyEcdsaKeyIdentity, buildEvmFamilyEcdsaSessionLanePolicy, deriveEvmFamilySigningKeySlotId, evmFamilyEcdsaWalletKeyToIdentity, resolveThresholdSigningRootBindingFromRuntimePolicyScope, toEvmFamilyEcdsaKeyHandle, toRpId } from "../../../core/signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
+import { buildEmailOtpWalletAuthMethodBinding, buildPasskeyAuthScope, buildPasskeyWalletAuthMethodBinding, buildWalletIdentity, parseRpId } from "../../../shared-ts/src/utils/walletCapabilityBindings.js";
 import { exactEd25519SigningLaneIdentity, nearEd25519SignerBindingFromBoundaryFields } from "../../../core/signingEngine/session/identity/exactSigningLaneIdentity.js";
 import { parseSignerSlot } from "../../../shared-ts/src/utils/signerSlot.js";
 import { buildRouterAbEd25519SigningWalletSession } from "../../../core/signingEngine/session/routerAbSigningWalletSession.js";
 import { toAccountId } from "../../../core/types/accountIds.js";
 import { buildPasskeyRouterAbEd25519WalletSessionState } from "../../../core/signingEngine/session/warmCapabilities/routerAbEd25519WalletSessionState.js";
 import { isWalletCustodySeedBinding } from "../../../shared-ts/src/passkey-custody/custodySecretBinding.js";
+import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import "../../../shared-ts/src/device-linking/index.js";
 import { verifyPasskeyWalletUnlock } from "../../../core/rpcClients/near/rpcCalls.js";
 import { UnlockEventPhase, createUnlockFlowEvent } from "../../../core/types/sdkSentEvents.js";
@@ -60,6 +60,7 @@ import { joinCustodyWireFromEnvelopeRecord } from "../../../core/signingEngine/w
 import { passkeyCredentialIdB64uFromAuthentication, passkeyPrfFirstB64uFromCredential } from "../authMethods/passkey/ecdsaBootstrap.js";
 import { scheduleEcdsaSessionPresignaturePrefill } from "./scheduleEcdsaSessionPresignaturePrefill.js";
 import { resolveManagedRuntimeScopeBootstrap } from "../../../core/config/managedRuntimeScope.js";
+import { exactPasskeyWalletAuthAuthorityRefForCredential, exactPasskeyWalletAuthMethodForCredential } from "../authMethods/passkey/exactPasskeyAuthority.js";
 import { createRouterAbNormalSigningPolicy } from "../session/thresholdWarmSessionBootstrap.js";
 import { assertWalletRuntimePostconditions } from "../../../core/signingEngine/session/postconditions/runtimePostconditions.js";
 import { buildConfiguredTargetKeyCompletion, collectConfiguredTargetThresholdEcdsaWarmKeys, configuredTargetThresholdEcdsaWarmKey, mergeCanonicalThresholdEcdsaWarmSessionContexts, parseActiveEcdsaSignerRecordForUnlock, planUnlockEcdsaWarmup, requireCompleteConfiguredTargetKeyContext } from "../../../core/signingEngine/session/passkey/unlockEcdsaWarmupPlanner.js";
@@ -276,27 +277,6 @@ function walletAuthMethodBindingFromRecord(record) {
 		default: return null;
 	}
 }
-async function exactPasskeyWalletAuthMethodForCredential(args) {
-	const matches = (await IndexedDBManager.listWalletAuthMethodsV2ForWallet(String(args.walletId))).filter((record) => record.kind === "passkey" && record.status === "active" && record.walletId === args.walletId && String(record.rpId) === args.rpId && String(record.credentialIdB64u) === args.credentialIdB64u);
-	const [record] = matches;
-	if (matches.length !== 1 || !record) throw new Error("[login] passkey authority requires one exact active V2 auth method");
-	return record;
-}
-async function exactPasskeyWalletAuthAuthorityRefForCredential(args) {
-	const record = await exactPasskeyWalletAuthMethodForCredential(args);
-	return await walletAuthAuthorityRef({ authority: {
-		walletId: record.walletId,
-		factor: {
-			kind: "passkey",
-			credentialIdB64u: record.credentialIdB64u
-		},
-		verifier: {
-			kind: "webauthn",
-			rpId: record.rpId
-		},
-		bindingId: record.walletAuthMethodId
-	} });
-}
 function walletAuthAuthorityForSelectedPasskeyMethod(record) {
 	return {
 		walletId: record.walletId,
@@ -1377,7 +1357,7 @@ async function activateLinkedDeviceSignerRuntimesAfterLink(args) {
 				walletSessionId: String(args.operationCredential.walletSessionId),
 				expiresAtMs: args.walletSession.expiresAtMs
 			});
-			else if (isWalletCustodySeedBinding(selection.exportRoot.envelope.binding)) await establishUnlockedWalletEd25519ExportRootCapabilityV1(walletCustodyCeremonyTransportFromWorkerContextV1(args.context.signingEngine.getSignerWorkerContext()), {
+			else if (isWalletCustodySeedBinding(selection.exportRoot.envelope.binding) || selection.exportRoot.envelope.binding.kind === "ed25519_yao_client_root_v1") await establishUnlockedWalletEd25519ExportRootCapabilityV1(walletCustodyCeremonyTransportFromWorkerContextV1(args.context.signingEngine.getSignerWorkerContext()), {
 				existingEnvelope: selection.exportRoot.envelope,
 				existingFactorSecret: args.factorSecret32,
 				walletId: String(selection.walletId),
@@ -1593,7 +1573,7 @@ function pendingNearRegistrationMatchesAuthority(selection, activation, pending)
 	return pending.operation === "near_provisioning" && pending.phase === "joined" && pending.signerPlanKind === "near_ed25519_and_evm_family_ecdsa" && pending.walletId === selection.walletId && pending.walletAuthMethodId === selection.authMethod.walletAuthMethodId && mpcMaterialActivationRefsEqual(pending.localMaterial.ed25519.metadata.materialActivation, activation);
 }
 /**
-* R109C: install the Ed25519 runtime an owner authority's unlock just built.
+* Install the Ed25519 runtime an owner authority's unlock just built.
 *
 * Everything is checked against the authority and method that were selected,
 * before the handle is used: a session naming a different method, or a
@@ -1826,7 +1806,7 @@ async function unlockLinkedDeviceEmailOtpWallet(args) {
 		factorSecret32?.fill(0);
 	}
 }
-async function unlockInternal(context, subjectSet, options, completion) {
+async function unlockInternal(context, subjectSet, options, _completion) {
 	const { onEvent, onError, afterCall } = options || {};
 	const { signingEngine } = context;
 	const walletUnlockSelection = resolveLoginWalletUnlockSelectionForSubjectSet({
@@ -1975,10 +1955,6 @@ async function unlockInternal(context, subjectSet, options, completion) {
 				identity: walletIdentity,
 				context: storedCanonicalEcdsaContext
 			});
-			buildConfiguredTargetKeyCompletion({
-				context: storedCanonicalEcdsaContext,
-				configuredTargets: warmupInput.selectedEcdsaTargets
-			});
 			const canFirstBootstrapThresholdEcdsa = Boolean(managedRuntimeScopeBootstrap);
 			const warmupPlan = resolveThresholdLoginWarmupPlan({
 				selection: warmupInput.selection,

package/dist/esm/react/SeamsWeb/operations/auth/walletAuth.js

@@ -1,6 +1,6 @@
 import { toError } from "../../../shared-ts/src/utils/errors.js";
-import { toWalletId } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { SIGNER_AUTH_METHODS } from "../../../shared-ts/src/utils/signerDomain.js";
+import { toWalletId } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { WalletSessionStatusReadScope } from "../../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { resolveWalletUnlockSubjectSet } from "./walletUnlockSubject.js";

package/dist/esm/react/SeamsWeb/operations/auth/walletUnlockSubject.js

@@ -1,4 +1,4 @@
-import { parseNearEd25519SigningKeyId } from "../../../shared-ts/src/utils/registrationIntent.js";
+import { parseNearEd25519SigningKeyId } from "../../../shared-ts/src/utils/registrationIds.js";
 import { toWalletId } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { parseSignerSlot } from "../../../shared-ts/src/utils/signerSlot.js";
 import { toAccountId } from "../../../core/types/accountIds.js";

package/dist/esm/react/SeamsWeb/operations/authMethods/addAuthMethodSourceClaim.js

@@ -2,7 +2,7 @@ import { walletSessionAuthorizations } from "../../../core/indexedDB/seamsWallet
 import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 //#region src/SeamsWeb/operations/authMethods/addAuthMethodSourceClaim.ts
 /**
-* Refactor 109C: the source claim a same-device addition puts in its intent.
+* The source claim a same-device addition puts in its intent.
 *
 * The intent digest is what the fresh source proof signs, so every identity the
 * proof is meant to bind has to be inside it. The server resolves the true

package/dist/esm/react/SeamsWeb/operations/authMethods/emailOtp/addEmailOtp.js

@@ -1,12 +1,13 @@
-import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import { toError } from "../../../../shared-ts/src/utils/errors.js";
+import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import { redactCredentialExtensionOutputs } from "../../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
 import { parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { computeAddAuthMethodIntentDigestB64u, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { requestWalletCustodyCeremonyOperation } from "../../../../core/signingEngine/walletCustody/ceremonyStepRunner.js";
+import { computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
-import { copyWalletCustodyEcdsaContinuityToAuthMethod } from "../../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
+import { copyWalletCustodyEcdsaContinuityToAuthMethod } from "../../../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js";
 import { createWalletAddAuthMethodIntent, requestAddAuthMethodEmailOtpChallenge } from "../../../../core/rpcClients/relayer/walletRegistration.js";
 import { passkeyCredentialIdB64uFromAuthentication, requirePasskeyPrfFirstB64u } from "../passkey/ecdsaBootstrap.js";
 import { resolveManagedRuntimeScopeBootstrap } from "../../../../core/config/managedRuntimeScope.js";

package/dist/esm/react/SeamsWeb/operations/authMethods/emailOtp/googleEmailOtpWalletAuthFlow.js

@@ -1,5 +1,5 @@
 import { DEFAULT_UNLOCK_REMAINING_USES } from "../../../../core/signingEngine/threshold/sessionPolicy.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { walletSessionRefFromSession } from "../../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { listConfiguredThresholdEcdsaPublicationTargets, listThresholdEcdsaProvisionTargets } from "../../session/thresholdEcdsaProvisioning.js";
 import { buildNearWalletRegistrationSignerSetSelection } from "../../registration/registrationSignerSet.js";

package/dist/esm/react/SeamsWeb/operations/authMethods/emailOtp/localEmailOtpProjection.js

@@ -1,6 +1,6 @@
 import { parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { isEmailOtpWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
 //#region src/SeamsWeb/operations/authMethods/emailOtp/localEmailOtpProjection.ts
 /**

package/dist/esm/react/SeamsWeb/operations/authMethods/emailOtp/registrationOffer.js

@@ -1,5 +1,5 @@
-import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { requireRecord, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 //#region src/SeamsWeb/operations/authMethods/emailOtp/registrationOffer.ts
 const OTP_ONLY_FORBIDDEN_FIELDS = [
 	"delivery",
@@ -21,15 +21,6 @@ const SECRET_MATERIAL_FIELDS = [
 	"bootstrapMaterial",
 	"clientSecret32"
 ];
-function requireRecord(value, label) {
-	if (!isPlainObject(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-function requireString(value, label) {
-	const normalized = typeof value === "string" ? value.trim() : "";
-	if (!normalized) throw new Error(`${label} is required`);
-	return normalized;
-}
 function requireTimestampMs(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive integer timestamp`);
 	return value;
@@ -39,10 +30,10 @@ function rejectFields(record, fields, label) {
 	if (forbiddenField) throw new Error(`${label} must not include ${forbiddenField}`);
 }
 function parseOfferId(value) {
-	return requireString(value, "offerId");
+	return requireTrimmedString(value, "offerId");
 }
 function parseCandidateId(value, label = "candidateId") {
-	return requireString(value, label);
+	return requireTrimmedString(value, label);
 }
 function parseCandidate(value) {
 	const record = requireRecord(value, "registration candidate");
@@ -50,7 +41,7 @@ function parseCandidate(value) {
 	rejectFields(record, SECRET_MATERIAL_FIELDS, "registration candidate");
 	return {
 		candidateId: parseCandidateId(record.candidateId),
-		walletId: walletIdFromString(requireString(record.walletId, "candidate.walletId"))
+		walletId: walletIdFromString(requireTrimmedString(record.walletId, "candidate.walletId"))
 	};
 }
 function parseGoogleEmailOtpRegistrationOffer(value) {
@@ -67,7 +58,7 @@ function parseGoogleEmailOtpRegistrationOffer(value) {
 		kind: "google_email_otp_registration_offer_v1",
 		offerId: parseOfferId(record.offerId),
 		expiresAtMs: requireTimestampMs(record.expiresAtMs, "expiresAtMs"),
-		emailHint: requireString(record.emailHint, "emailHint"),
+		emailHint: requireTrimmedString(record.emailHint, "emailHint"),
 		candidates: [firstCandidate, ...remainingCandidates],
 		selectedCandidateId
 	};

package/dist/esm/react/SeamsWeb/operations/authMethods/emailOtp/walletActivation.js

@@ -1,6 +1,6 @@
-import { isActiveRecoveredWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { toAccountId } from "../../../../core/types/accountIds.js";
+import { isActiveRecoveredWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
 //#region src/SeamsWeb/operations/authMethods/emailOtp/walletActivation.ts
 async function persistVerifiedEmailOtpAuthorityAfterUnlock(args) {

package/dist/esm/react/SeamsWeb/operations/authMethods/passkey/addPasskey.js

@@ -1,12 +1,13 @@
-import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import { toError } from "../../../../shared-ts/src/utils/errors.js";
+import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import { redactCredentialExtensionOutputs } from "../../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
 import { parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { computeAddAuthMethodIntentDigestB64u, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { requestWalletCustodyCeremonyOperation } from "../../../../core/signingEngine/walletCustody/ceremonyStepRunner.js";
+import { computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
-import { copyWalletCustodyEcdsaContinuityToAuthMethod } from "../../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
+import { copyWalletCustodyEcdsaContinuityToAuthMethod } from "../../../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js";
 import { createWalletAddAuthMethodIntent, requestAddAuthMethodEmailOtpChallenge } from "../../../../core/rpcClients/relayer/walletRegistration.js";
 import { readUnlockedWalletEd25519ExportRootCapabilityV1 } from "../../../../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";
 import { passkeyCredentialIdB64uFromAuthentication, requirePasskeyPrfFirstB64u } from "./ecdsaBootstrap.js";
@@ -134,7 +135,7 @@ async function addPasskeyWalletAuthMethodInternal(args) {
 	}
 }
 /**
-* Refactor 109C's `email_otp_to_passkey` branch.
+* The `email_otp_to_passkey` addition branch.
 *
 * The Email OTP method that already unlocks this wallet authorizes adding a
 * passkey. Three things stay exactly as they are in the Passkey-source branch,

package/dist/esm/react/SeamsWeb/operations/authMethods/passkey/exactPasskeyAuthority.js

@@ -0,0 +1,34 @@
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
+//#region src/SeamsWeb/operations/authMethods/passkey/exactPasskeyAuthority.ts
+/**
+* The wallet's one active passkey method for this credential. The local
+* auth-method store is the one source that names a wallet's methods: a method
+* id derived from the credential is not the id the wallet registered it under.
+*/
+async function exactPasskeyWalletAuthMethodForCredential(args) {
+	const matches = (await IndexedDBManager.listWalletAuthMethodsV2ForWallet(String(args.walletId))).filter((record) => record.kind === "passkey" && record.status === "active" && record.walletId === args.walletId && String(record.rpId) === args.rpId && String(record.credentialIdB64u) === args.credentialIdB64u);
+	const [record] = matches;
+	if (matches.length !== 1 || !record) throw new Error("passkey authority requires one exact active V2 auth method");
+	return record;
+}
+/** The authority reference of the wallet's active passkey method for this credential. */
+async function exactPasskeyWalletAuthAuthorityRefForCredential(args) {
+	const record = await exactPasskeyWalletAuthMethodForCredential(args);
+	return await walletAuthAuthorityRef({ authority: {
+		walletId: record.walletId,
+		factor: {
+			kind: "passkey",
+			credentialIdB64u: record.credentialIdB64u
+		},
+		verifier: {
+			kind: "webauthn",
+			rpId: record.rpId
+		},
+		bindingId: record.walletAuthMethodId
+	} });
+}
+//#endregion
+export { exactPasskeyWalletAuthAuthorityRefForCredential, exactPasskeyWalletAuthMethodForCredential };
+
+//# sourceMappingURL=exactPasskeyAuthority.js.map

package/dist/esm/react/SeamsWeb/operations/authMethods/passkey/localPasskeyProjection.js

@@ -1,6 +1,6 @@
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
 //#region src/SeamsWeb/operations/authMethods/passkey/localPasskeyProjection.ts
 /**
@@ -43,8 +43,8 @@ async function persistFinalizedPasskeyAuthMethodV1(args) {
 	await IndexedDBManager.upsertWalletAuthMethod(localPasskeyAuthMethodFromFinalizeV1(args));
 }
 /**
-* Refactor 109C: the full local install for a passkey added to a wallet that
-* registered with another family.
+* The full local install for a passkey added to a wallet that registered with
+* another family.
 *
 * Three records, and unlock needs all of them. It reads the profile, then the
 * profile's authenticators, then keeps only those whose credential belongs to

package/dist/esm/react/SeamsWeb/operations/authMethods/revokeAuthMethod.js

@@ -2,16 +2,17 @@ import { toError } from "../../../shared-ts/src/utils/errors.js";
 import { redactCredentialExtensionOutputs } from "../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
 import { parseWalletAuthMethodId, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { computeWalletAuthMethodRevokeOperationFingerprintV1, parseWalletAuthMethodRecordV2, walletIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
 import { WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../shared-ts/src/utils/emailOtpDomain.js";
 import { WALLET_AUTH_METHODS } from "../../../shared-ts/src/utils/signerDomain.js";
+import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
+import { computeWalletAuthMethodRevokeOperationFingerprintV1, parseWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { revokeWalletAuthMethod } from "../../../core/rpcClients/relayer/walletRegistration.js";
 import { passkeyCredentialIdB64uFromAuthentication } from "./passkey/ecdsaBootstrap.js";
 import { requestEmailOtpChallenge } from "./emailOtp/challenge.js";
 //#region src/SeamsWeb/operations/authMethods/revokeAuthMethod.ts
 /**
-* Refactor 109C: remove one auth method using a different active one.
+* Remove one auth method using a different active one.
 *
 * The inverse of the two addition branches, and the reason they are safe to
 * offer: a wallet that can gain a second way in must be able to lose one it no

package/dist/esm/react/SeamsWeb/operations/devices/deviceLinkingAuthorityInstallation.js

@@ -1,8 +1,8 @@
 import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1 } from "../../../shared-ts/src/device-linking/walletSessionCredentialDelivery.js";
-import { encodeWalletSignerActivationSetV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildEmailOtpWalletAuthAuthority } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { encodeWalletSignerActivationSetV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
+import { assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1 } from "../../../shared-ts/src/device-linking/walletSessionCredentialDelivery.js";
 import { computeWalletSessionInstallationReceiptDigestB64u } from "../../../shared-ts/src/device-linking/digests.js";
 import "../../../shared-ts/src/device-linking/index.js";
 import { LINKED_DEVICE_COMMITTED_RESUME_APP_STATE_PREFIX_V1, LINKED_DEVICE_PENDING_ACK_APP_STATE_PREFIX_V1, buildDeviceLinkingCommittedResumeV1, buildDeviceLinkingPendingAcknowledgementV1, committedResumeAppStateKeyV1, compareDeviceLinkingCommittedResumeV1, parseDeviceLinkingCommittedResumeV1, parseDeviceLinkingPendingAcknowledgementV1, pendingAcknowledgementAppStateKeyV1 } from "./deviceLinkingResume.js";

package/dist/esm/react/SeamsWeb/operations/devices/deviceLinkingEd25519ExportRoot.js

@@ -1,7 +1,7 @@
 import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision } from "../../../shared-ts/src/passkey-custody/primitives.js";
-import { LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1, buildLinkedDeviceEd25519ExportRootTransferBindingV1, parseLinkedDeviceEd25519ExportRootRecipientPublicKeyB64u, parseLinkedDeviceEd25519ExportRootRecipientV1, serializeLinkedDeviceEd25519ExportRootTransferBindingV1 } from "../../../shared-ts/src/device-linking/ed25519ExportRoot.js";
 import { buildActiveEnvelopeLifecycle, buildPasskeyCustodyEnvelopeRecord, custodyEnvelopeBindingJsonV1, parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
+import { LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1, buildLinkedDeviceEd25519ExportRootTransferBindingV1, parseLinkedDeviceEd25519ExportRootRecipientPublicKeyB64u, parseLinkedDeviceEd25519ExportRootRecipientV1, serializeLinkedDeviceEd25519ExportRootTransferBindingV1 } from "../../../shared-ts/src/device-linking/ed25519ExportRoot.js";
 //#region src/SeamsWeb/operations/devices/deviceLinkingEd25519ExportRoot.ts
 /** Browser-side adapter for the Ed25519 Yao Client export-root relay. */
 function buildDeviceLinkingEd25519ExportRootReplacementEnvelopeV1(input) {

package/dist/esm/react/SeamsWeb/operations/devices/deviceLinkingHttpTransport.js

@@ -1,11 +1,12 @@
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { secureRandomBase64Url } from "../../../shared-ts/src/utils/secureRandomId.js";
-import { sha256Bytes } from "../../../shared-ts/src/utils/digests.js";
 import { parseLinkDeviceSessionId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { sha256DigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { parseLinkedDeviceEd25519ExportRootPackageV1 } from "../../../shared-ts/src/device-linking/ed25519ExportRoot.js";
 import { parseCommittedAuthorityPackagesV1 } from "../../../shared-ts/src/device-linking/committedSignerPackages.js";
-import { parseActivateInstalledAuthorityResultV1, parseLinkSessionProjectionV1, parseLinkSessionTransportEventV1, parseLinkedDeviceApprovalDeliveryV1, parseLinkedDeviceEmailOtpChallengeResendRequestV1, parseLinkedDeviceEmailOtpChallengeResultV1, parseLinkedDeviceEmailOtpChallengeStartRequestV1, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, parseLinkedDeviceEmailOtpVerificationResultV1, parseLinkedDeviceTargetCredentialRegistrationResultV1, parseLinkedDeviceTargetPreparationRequestV1, parseLinkedDeviceTargetPreparationV1, parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1, parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/parsers.js";
+import { parseLinkSessionProjectionV1, parseLinkSessionTransportEventV1, parseLinkedDeviceApprovalDeliveryV1, parseLinkedDeviceEmailOtpChallengeResendRequestV1, parseLinkedDeviceEmailOtpChallengeResultV1, parseLinkedDeviceEmailOtpChallengeStartRequestV1, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, parseLinkedDeviceEmailOtpVerificationResultV1, parseLinkedDeviceTargetCredentialRegistrationResultV1, parseLinkedDeviceTargetPreparationRequestV1, parseLinkedDeviceTargetPreparationV1 } from "../../../shared-ts/src/device-linking/parsers.js";
+import { parseActivateInstalledAuthorityResultV1, parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1 } from "../../../shared-ts/src/device-linking/authorityActivation.js";
 import { LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, computeLinkedDevicePublicKeyDigestV1 } from "../../../shared-ts/src/device-linking/requestProof.js";
 import "../../../shared-ts/src/device-linking/index.js";
 //#region src/SeamsWeb/operations/devices/deviceLinkingHttpTransport.ts
@@ -316,7 +317,7 @@ async function requestDeviceV1(input) {
 	const publishableKey = input.options.publishableKey.trim();
 	const projectEnvironmentId = input.options.projectEnvironmentId.trim();
 	if (!publishableKey || !projectEnvironmentId) throw new Error("linked-device Passkey ceremony requires registration API credentials");
-	const bodyDigestB64u = parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeRequestBodyV1(input.body))));
+	const bodyDigestB64u = await sha256DigestB64u(encodeRequestBodyV1(input.body));
 	const issuedAtMs = input.options.nowMs();
 	if (!Number.isSafeInteger(issuedAtMs) || issuedAtMs <= 0) throw new Error("linked-device request clock is invalid");
 	const expiresAtMs = issuedAtMs + LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1;

package/dist/esm/react/SeamsWeb/operations/devices/deviceLinkingOwnerTransport.js

@@ -1,6 +1,6 @@
 import { parseLinkDeviceSessionId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../../shared-ts/src/device-linking/sourceContribution.js";
 import { parseLinkedDeviceEd25519ExportRootRecipientV1 } from "../../../shared-ts/src/device-linking/ed25519ExportRoot.js";
+import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../../shared-ts/src/device-linking/sourceContribution.js";
 import { parseLinkSessionProjectionV1, parseLinkedDeviceApprovalResultV1, parseLinkedDeviceEmailOtpBaseFactorResolutionResultV1, parseLinkedDeviceSessionClaimV1 } from "../../../shared-ts/src/device-linking/parsers.js";
 import "../../../shared-ts/src/device-linking/index.js";
 import { LINKED_DEVICE_SESSION_HTTP_BASE_PATH_V1 } from "./deviceLinkingHttpTransport.js";

package/dist/esm/react/SeamsWeb/operations/devices/deviceLinkingResume.js

@@ -2,7 +2,7 @@ import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseWalletAut
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { encodeWalletSignerActivationSetV1, parseWalletSignerActivationSetV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
-import { parseLocalAuthorityActivationFinalAckV1 } from "../../../shared-ts/src/device-linking/parsers.js";
+import { parseLocalAuthorityActivationFinalAckV1 } from "../../../shared-ts/src/device-linking/authorityActivation.js";
 //#region src/SeamsWeb/operations/devices/deviceLinkingResume.ts
 const LINKED_DEVICE_COMMITTED_RESUME_KIND_V1 = "linked_device_committed_resume_v1";
 const LINKED_DEVICE_PENDING_ACK_KIND_V1 = "linked_device_pending_ack_v1";
@@ -39,7 +39,7 @@ function buildDeviceLinkingPendingAcknowledgementV1(acknowledgement) {
 }
 function parseDeviceLinkingPendingAcknowledgementV1(raw) {
 	const record = asPlainDeviceLinkingResumeRecord(raw);
-	if (record === null || !hasExactKeys(record, PENDING_ACKNOWLEDGEMENT_FIELDS) || record.kind !== "linked_device_pending_ack_v1") return null;
+	if (record === null || !hasExactKeys(record, PENDING_ACKNOWLEDGEMENT_FIELDS) || record.kind !== LINKED_DEVICE_PENDING_ACK_KIND_V1) return null;
 	try {
 		return {
 			kind: LINKED_DEVICE_PENDING_ACK_KIND_V1,
@@ -131,7 +131,7 @@ function compareDeviceLinkingCommittedResumeV1(input) {
 }
 function parseDeviceLinkingCommittedResumeV1(raw) {
 	const record = asPlainDeviceLinkingResumeRecord(raw);
-	if (record === null || !hasExactKeys(record, COMMITTED_RESUME_FIELDS) || record.kind !== "linked_device_committed_resume_v1") return null;
+	if (record === null || !hasExactKeys(record, COMMITTED_RESUME_FIELDS) || record.kind !== LINKED_DEVICE_COMMITTED_RESUME_KIND_V1) return null;
 	const linkSessionId = parseLinkDeviceSessionId(record.linkSessionId);
 	const walletId = parseWalletId(record.walletId);
 	const enrollmentId = parseLinkedDeviceEnrollmentId(record.enrollmentId);

package/dist/esm/react/SeamsWeb/operations/devices/deviceLinkingWorkerChannels.js

@@ -1,8 +1,9 @@
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
+import { parseLinkDevicePublicKeyB64u, parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1, parseLinkedDeviceEmailOtpVerificationGrantV1 } from "../../../shared-ts/src/device-linking/parsers.js";
 import { parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1, parseLinkedDeviceWalletSessionCredentialDeliveryV1 } from "../../../shared-ts/src/device-linking/walletSessionCredentialDelivery.js";
-import { parseLinkDevicePublicKeyB64u, parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1, parseLinkedDeviceEmailOtpVerificationGrantV1, parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/parsers.js";
 import "../../../shared-ts/src/device-linking/index.js";
 import { resolveWorkerUrl } from "../../../core/walletRuntimePaths/workers.js";
 import { createDeviceLinkingOrdinaryMaterialWorkerPortV1 } from "../../../core/signingEngine/workerManager/deviceLinkingPorts.js";