@seams/wallet 0.6.2 → 0.7.1

package/dist/esm/SeamsWeb/operations/devices/linkDeviceFlowSupport.js

@@ -0,0 +1,143 @@
+import { parseLinkDeviceSessionId } from "../../../shared-ts/src/utils/domainIds.js";
+import { buildFullOwnerDelegatedWalletAuthorityV1 } from "../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { WALLET_AUTH_METHODS } from "../../../shared-ts/src/utils/signerDomain.js";
+import { LinkDeviceEventPhase } from "../../../core/types/sdkSentEvents.js";
+import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
+import { assertNeverLinkSessionStateV1 } from "../../../shared-ts/src/device-linking/contracts.js";
+import { buildQrLinkedDeviceSessionPayloadV5 } from "../../../shared-ts/src/device-linking/parsers.js";
+import "../../../shared-ts/src/device-linking/index.js";
+import { errorMessage } from "../../../shared-ts/src/utils/errors.js";
+import { DeviceLinkingError, DeviceLinkingErrorCode, normalizeLinkedDeviceTargetEmailAddressV1 } from "../../../core/types/linkDevice.js";
+import { nextLinkedDevicePollingDelayMsV1 } from "./deviceLinkingHttpTransport.js";
+//#region src/SeamsWeb/operations/devices/linkDeviceFlowSupport.ts
+function linkedDeviceWalletAuthenticationState(walletSession, registration) {
+	switch (registration.targetFactor.kind) {
+		case "verified_passkey_target_v1": return {
+			kind: "authenticated",
+			walletId: walletSession.walletId,
+			authMethod: WALLET_AUTH_METHODS.passkey
+		};
+		case "verified_email_otp_target_v1": return {
+			kind: "authenticated",
+			walletId: walletSession.walletId,
+			authMethod: WALLET_AUTH_METHODS.emailOtp
+		};
+		default: return registration.targetFactor;
+	}
+}
+function createLinkSessionId() {
+	const parsed = parseLinkDeviceSessionId(secureRandomId("link-session", 32));
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function createFlowId() {
+	return secureRandomId("link-flow", 16);
+}
+function notifyError(callback, error) {
+	try {
+		callback?.(error);
+	} catch {}
+}
+function logDevice2LinkingStageV1(input) {
+	console.info("[Device2Linking]", {
+		flowId: input.flowId,
+		linkSessionId: input.linkSessionId,
+		stage: input.stage,
+		...input.details
+	});
+}
+function logDevice2LinkingFailureV1(input) {
+	console.error("[Device2Linking] failed", {
+		flowId: input.flowId,
+		linkSessionId: input.linkSessionId,
+		state: input.state,
+		error: errorMessage(input.error)
+	});
+}
+function resolveSessionStateRetry(resolve, attempt) {
+	setTimeout(resolve, nextLinkedDevicePollingDelayMsV1(250, attempt));
+}
+async function waitForSessionStateRetry(attempt) {
+	await new Promise((resolve) => resolveSessionStateRetry(resolve, attempt));
+}
+function phaseForState(state) {
+	switch (state.state) {
+		case "displaying_qr":
+		case "expired":
+		case "cancelled": return LinkDeviceEventPhase.STEP_01_QR_PREPARE_STARTED;
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning":
+		case "authority_pending_local_install":
+		case "active": return LinkDeviceEventPhase.STEP_02_QR_SCAN_STARTED;
+		case "failed_before_commit": return LinkDeviceEventPhase.FAILED;
+		default: return assertNeverLinkSessionStateV1(state);
+	}
+}
+function errorForFailure(error, phase) {
+	if (error instanceof DeviceLinkingError) return error;
+	return new DeviceLinkingError(errorMessage(error) || "Device linking failed", DeviceLinkingErrorCode.REGISTRATION_FAILED, phase);
+}
+/**
+* These failures happen after the server has committed the linked authority.
+* The original delivery is intentionally abandoned; exact-method unlock uses
+* the durable local installation to obtain a successor Wallet Session.
+*/
+function classifyLinkedDeviceDeliveryFailureV1(error) {
+	const message = errorMessage(error).toLowerCase();
+	if (message.includes("device-linking key handle is unknown or discarded") || message.includes("recipient handle lost")) return "recipient_private_handle_lost";
+	if (message.includes("linked-device wallet session credential delivery is expired")) return "sealed_delivery_expired";
+	return null;
+}
+function linkedDeviceDeliveryRecoveryMessageV1(reason) {
+	switch (reason) {
+		case "recipient_private_handle_lost":
+		case "sealed_delivery_expired": return "The linked device is ready. Return to sign in and unlock the new method to finish setup.";
+		default: return reason;
+	}
+}
+var LinkDeviceFlowSupersededError = class extends Error {
+	constructor() {
+		super("Device-link flow was cancelled or reset");
+		this.name = "LinkDeviceFlowSupersededError";
+	}
+};
+async function generateQrCodeDataUrlV1(payload) {
+	let qrcode;
+	try {
+		qrcode = await import("qrcode");
+	} catch {
+		throw new DeviceLinkingError("Device-link QR generation requires the optional qrcode package", DeviceLinkingErrorCode.UNSUPPORTED, "generation");
+	}
+	return await qrcode.toDataURL(payload, {
+		errorCorrectionLevel: "M",
+		margin: 2
+	});
+}
+function buildDevice2QrSessionPayloadV1(input) {
+	const requestedPermission = buildFullOwnerDelegatedWalletAuthorityV1();
+	if (input.target.targetFactor.kind === "email_otp") return buildQrLinkedDeviceSessionPayloadV5({
+		linkSessionId: input.linkSessionId,
+		linkPublicKeyB64u: input.linkPublicKeyB64u,
+		devicePublicKeyB64u: input.devicePublicKeyB64u,
+		requestedPermission,
+		targetFactor: { kind: "email_otp" },
+		targetEmail: normalizeLinkedDeviceTargetEmailAddressV1(input.target.targetEmail),
+		issuedAtMs: input.issuedAtMs,
+		expiresAtMs: input.expiresAtMs
+	});
+	return buildQrLinkedDeviceSessionPayloadV5({
+		linkSessionId: input.linkSessionId,
+		linkPublicKeyB64u: input.linkPublicKeyB64u,
+		devicePublicKeyB64u: input.devicePublicKeyB64u,
+		requestedPermission,
+		targetFactor: { kind: "passkey_prf" },
+		issuedAtMs: input.issuedAtMs,
+		expiresAtMs: input.expiresAtMs
+	});
+}
+//#endregion
+export { LinkDeviceFlowSupersededError, buildDevice2QrSessionPayloadV1, classifyLinkedDeviceDeliveryFailureV1, createFlowId, createLinkSessionId, errorForFailure, generateQrCodeDataUrlV1, linkedDeviceDeliveryRecoveryMessageV1, linkedDeviceWalletAuthenticationState, logDevice2LinkingFailureV1, logDevice2LinkingStageV1, notifyError, phaseForState, waitForSessionStateRetry };
+
+//# sourceMappingURL=linkDeviceFlowSupport.js.map

package/dist/esm/SeamsWeb/operations/devices/linkDeviceTargetActivation.js

@@ -0,0 +1,119 @@
+import { parsePasskeyEnvelopeId } from "../../../shared-ts/src/utils/domainIds.js";
+import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
+//#region src/SeamsWeb/operations/devices/linkDeviceTargetActivation.ts
+function isPasskeyTargetPreparation(preparation) {
+	return preparation.targetFactor.kind === "passkey_prf";
+}
+function isEmailOtpTargetPreparation(preparation) {
+	return preparation.targetFactor.kind === "email_otp";
+}
+function emailOtpTargetActivationBaseContextV1(context) {
+	return {
+		event: context.event,
+		state: context.state,
+		runEpoch: context.runEpoch,
+		deviceId: context.deviceId,
+		preparation: context.preparation,
+		ordinarySignerMaterialRecipientRequests: context.ordinarySignerMaterialRecipientRequests,
+		exportRoot: context.exportRoot
+	};
+}
+function requireCompletedEmailOtpTargetActivationStateV1(state) {
+	if (state.kind !== "completed" || !state.factorSecret || typeof state.providerUserId !== "string") throw new Error("linked-device Email OTP factor runtime is unavailable");
+	return {
+		kind: "completed",
+		runEpoch: state.runEpoch,
+		enrollment: state.enrollment,
+		factorSecret: state.factorSecret,
+		providerUserId: state.providerUserId
+	};
+}
+function assertNeverEmailOtpTargetActivationState(value) {
+	throw new Error(`Unknown Email OTP target activation state: ${String(value)}`);
+}
+function assertNeverTargetCredentialActivationState(value) {
+	throw new Error(`Unknown target credential activation state: ${String(value)}`);
+}
+function resolvePostLinkActivationV1(input) {
+	switch (input.targetFactor.kind) {
+		case "verified_passkey_target_v1": {
+			const activation = input.targetCredentialActivationState;
+			if (activation.kind !== "factor_ready" || activation.runEpoch !== input.runEpoch) throw new Error("linked-device Passkey factor runtime is unavailable");
+			return {
+				factor: {
+					kind: "passkey",
+					walletId: input.walletId
+				},
+				factorSecret32: activation.factorSecret
+			};
+		}
+		case "verified_email_otp_target_v1": {
+			const activation = requireCompletedEmailOtpTargetActivationStateV1(input.emailOtpTargetActivationState);
+			if (activation.runEpoch !== input.runEpoch) throw new Error("linked-device Email OTP factor runtime is unavailable");
+			return {
+				factor: {
+					kind: "email_otp",
+					walletId: input.walletId,
+					walletAuthMethodId: input.walletAuthMethodId,
+					emailHashHex: input.targetFactor.authMethod.emailHashHex,
+					providerIdentity: {
+						provider: emailOtpProviderForLinkedEnrollment(activation.enrollment),
+						providerSubjectId: activation.providerUserId
+					}
+				},
+				factorSecret32: activation.factorSecret
+			};
+		}
+		default: return assertNeverVerifiedTargetFactor(input.targetFactor);
+	}
+}
+function assertNeverVerifiedTargetFactor(value) {
+	throw new Error(`Unknown verified target factor kind: ${String(value)}`);
+}
+function zeroizeLiveBytes(value) {
+	if (value.byteLength > 0) value.fill(0);
+}
+function emailOtpProviderForLinkedEnrollment(enrollment) {
+	return enrollment.kind === "existing_enrollment" ? "google" : "email";
+}
+function requireTargetRpIdV1(preparation) {
+	return preparation.passkeyCreationOptions.rpId;
+}
+function requireEmailOtpTargetPreparationV1(preparation) {
+	if (!isEmailOtpTargetPreparation(preparation)) throw new Error("linked-device Email OTP preparation is unavailable");
+	return preparation;
+}
+function createExportRootEnvelopeIdV1() {
+	const parsed = parsePasskeyEnvelopeId(secureRandomId("linked-device-ed25519-export-root-envelope", 24, "export-root envelope ids"));
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function createEmailOtpFactorSecretV1() {
+	return crypto.getRandomValues(new Uint8Array(32));
+}
+async function prepareNewEmailOtpEnrollmentMaterialV1(input) {
+	const disposableSecret = input.factorSecret.slice();
+	try {
+		const material = await input.context.signingEngine.prepareEmailOtpRegistrationEnrollmentMaterialInternal({
+			relayUrl: String(input.context.configs.network.relayer.url || "").trim(),
+			walletId: input.walletId,
+			userId: input.targetEmail,
+			clientSecret32: disposableSecret
+		});
+		if (material.emailOtpSessionHandle.kind !== "not_requested") throw new Error("Strict linked-device Email OTP enrollment received obsolete ECDSA material");
+		return {
+			enrollmentId: material.enrollmentId,
+			enrollment: material.emailOtpEnrollment
+		};
+	} finally {
+		zeroizeLiveBytes(disposableSecret);
+	}
+}
+function requireNewEmailOtpEnrollmentMaterialV1(value) {
+	if (!value) throw new Error("new linked-device Email OTP enrollment material is unavailable");
+	return value;
+}
+//#endregion
+export { assertNeverEmailOtpTargetActivationState, assertNeverTargetCredentialActivationState, createEmailOtpFactorSecretV1, createExportRootEnvelopeIdV1, emailOtpTargetActivationBaseContextV1, isEmailOtpTargetPreparation, isPasskeyTargetPreparation, prepareNewEmailOtpEnrollmentMaterialV1, requireCompletedEmailOtpTargetActivationStateV1, requireEmailOtpTargetPreparationV1, requireNewEmailOtpEnrollmentMaterialV1, requireTargetRpIdV1, resolvePostLinkActivationV1, zeroizeLiveBytes };
+
+//# sourceMappingURL=linkDeviceTargetActivation.js.map

package/dist/esm/SeamsWeb/operations/devices/scanDevice.js

@@ -1,5 +1,5 @@
-import { buildLinkedDeviceApprovalV1, buildLinkedDeviceSessionClaimRequestV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../../shared-ts/src/device-linking/parsers.js";
 import { LinkDeviceEventPhase, createLinkDeviceFlowEvent } from "../../../core/types/sdkSentEvents.js";
+import { buildLinkedDeviceApprovalV1, buildLinkedDeviceSessionClaimRequestV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../../shared-ts/src/device-linking/parsers.js";
 import "../../../shared-ts/src/device-linking/requestProof.js";
 import "../../../shared-ts/src/device-linking/index.js";
 import { errorMessage } from "../../../shared-ts/src/utils/errors.js";

package/dist/esm/SeamsWeb/operations/devices/walletHostComposition.js

@@ -1,6 +1,7 @@
-import { parseLinkedDeviceListRequestV1, parseLinkedDeviceListResultV1, parseLinkedDeviceRevokeRequestV1, parseLinkedDeviceRevokeResultV1 } from "../../../shared-ts/src/device-linking/parsers.js";
+import { parseLinkedDeviceListRequestV1, parseLinkedDeviceListResultV1, parseLinkedDeviceRevokeRequestV1, parseLinkedDeviceRevokeResultV1 } from "../../../shared-ts/src/device-linking/deviceManagement.js";
 import "../../../shared-ts/src/device-linking/index.js";
 import { createDeviceLinkingFlowPortsV1 } from "./deviceLinkingComposition.js";
+import { WalletHostOwnerRequestTransportError } from "./walletHostOwnerAuthority.js";
 //#region src/SeamsWeb/operations/devices/walletHostComposition.ts
 const LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1 = "/wallet/device-linking/v1/devices";
 const OWNER_WALLET_SESSION_REAUTH_REQUIRED = "owner_wallet_session_reauth_required";
@@ -44,7 +45,7 @@ function createWalletHostLinkedDeviceManagementPortV1(args) {
 				walletAuthMethodId,
 				requestedAtMs
 			});
-			return parseManagementRevokeResult(await args.request.request({
+			const send = async () => await args.request.request({
 				method: "POST",
 				canonicalPath: `${LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1}/${encodeURIComponent(String(walletAuthMethodId))}/revoke`,
 				body: {
@@ -52,7 +53,16 @@ function createWalletHostLinkedDeviceManagementPortV1(args) {
 					sourceProof
 				},
 				walletId
-			}));
+			});
+			let response;
+			try {
+				response = await send();
+			} catch (error) {
+				if (!(error instanceof WalletHostOwnerRequestTransportError)) throw error;
+				if (error.code !== "network_error") throw error;
+				response = await send();
+			}
+			return parseManagementRevokeResult(response);
 		}
 	};
 }

package/dist/esm/SeamsWeb/operations/devices/walletHostOwnerAuthority.js

@@ -1,13 +1,21 @@
 import { parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
 import { hasDelegatedWalletPermissionV1 } from "../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { awaitNearProvisioningInFlight } from "../../../core/signingEngine/flows/registration/nearProvisioningRegistry.js";
 import { parseExactAdministeredSignerManifestV1 } from "../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { parseLinkedDeviceOwnerAuthorizationRequestV1, parseLinkedDeviceOwnerAuthorizationSourceV1 } from "../../../shared-ts/src/device-linking/parsers.js";
-import { awaitNearProvisioningInFlight } from "../../../core/signingEngine/flows/registration/nearProvisioningRegistry.js";
 import { WalletSessionAuthorizationUpgradeRequiredError } from "../../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
 import { DeviceLinkingError, DeviceLinkingErrorCode } from "../../../core/types/linkDevice.js";
 //#region src/SeamsWeb/operations/devices/walletHostOwnerAuthority.ts
 const OWNER_AUTHORIZATION_PATH = "/wallet/device-linking/v1/owner-authorization";
+/** An owner request that received no answer: the network failed, or it timed out. */
+var WalletHostOwnerRequestTransportError = class extends Error {
+	constructor(code, message) {
+		super(`Owner Router request failed: ${message}`);
+		this.code = code;
+		this.name = "WalletHostOwnerRequestTransportError";
+	}
+};
 function createWalletHostOwnerAuthoritiesV1(input) {
 	const context = normalizeContext(input);
 	return {
@@ -25,7 +33,7 @@ function normalizeContext(input) {
 	};
 }
 /**
-* The R103 fail-closed preflight, exact result `wallet_unlock_required`.
+* The fail-closed preflight, exact result `wallet_unlock_required`.
 *
 * The locked and missing-session arms run before any network I/O. The
 * export-root arm runs after the stateless owner-authorization read, because
@@ -109,7 +117,7 @@ async function requestWithCredentialV1(context, walletSessionToken, input) {
 		headers: { authorization: `Bearer ${walletSessionToken}` },
 		...input.body === void 0 ? {} : { body: input.body }
 	});
-	if (!response.ok) throw new Error(`Owner Router request failed: ${response.message}`);
+	if (!response.ok) throw new WalletHostOwnerRequestTransportError(response.code, response.message);
 	return response.value;
 }
 function parseOwnerAuthorizationResponseV1(raw, session) {
@@ -178,6 +186,6 @@ function positiveSafeInteger(raw, label) {
 	return Number(raw);
 }
 //#endregion
-export { createWalletHostOwnerAuthoritiesV1 };
+export { WalletHostOwnerRequestTransportError, createWalletHostOwnerAuthoritiesV1 };
 
 //# sourceMappingURL=walletHostOwnerAuthority.js.map

package/dist/esm/SeamsWeb/operations/near/index.js

@@ -1,4 +1,4 @@
-import { implicitNearAccountProvisioning } from "../../../shared-ts/src/utils/registrationIntent.js";
+import { implicitNearAccountProvisioning } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
 import "./delegateAction.js";
 import { buildNearWalletRegistrationSignerSetSelection } from "../registration/registrationSignerSet.js";
 //#region src/SeamsWeb/operations/near/index.ts

package/dist/esm/SeamsWeb/operations/near/signNEP413.js

@@ -1,6 +1,6 @@
 import { base64Encode } from "../../../shared-ts/src/utils/base64.js";
-import "../../../shared-ts/src/utils/encoders.js";
 import { SigningEventPhase } from "../../../core/types/sdkSentEvents.js";
+import "../../../shared-ts/src/utils/encoders.js";
 import { emitNearSigningEvent } from "./signingEventHelpers.js";
 import { resolveNearCommandSubject } from "./commandSubject.js";
 //#region src/SeamsWeb/operations/near/signNEP413.ts

package/dist/esm/SeamsWeb/operations/recovery/accountSync.js

@@ -1,4 +1,4 @@
-import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
+import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { syncAccount } from "./syncAccount.js";
 //#region src/SeamsWeb/operations/recovery/accountSync.ts
 var AccountSyncDomain = class {

package/dist/esm/SeamsWeb/operations/recovery/recoveryWalletBinding.js

@@ -1,7 +1,7 @@
 import { parseWebAuthnCredentialIdB64u } from "../../../shared-ts/src/utils/domainIds.js";
-import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
 import { isObject } from "../../../shared-ts/src/utils/validation.js";
 import { toAccountId } from "../../../core/types/accountIds.js";
+import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 //#region src/SeamsWeb/operations/recovery/recoveryWalletBinding.ts
 function requireBindingString(raw, field, context) {
 	const value = String(raw[field] || "").trim();

package/dist/esm/SeamsWeb/operations/recovery/syncAccount.js

@@ -1,19 +1,19 @@
 import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { replaceActiveWalletAuthorityEd25519MaterialActivationV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
-import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { deriveEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
-import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { AccountSyncEventPhase, createAccountSyncFlowEvent } from "../../../core/types/sdkSentEvents.js";
+import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { thresholdEcdsaChainTargetKey } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { buildThresholdEd25519Participants2pV1 } from "../../../shared-ts/src/threshold/participants.js";
+import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
+import { deriveEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
 import "../../../shared-ts/src/signing-lanes/index.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { getPrfFirstB64uFromCredential, redactCredentialExtensionOutputs } from "../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
+import { parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND } from "../../../core/indexedDB/walletCustodyEd25519MaterialRecord.js";
+import { replaceActiveWalletAuthorityEd25519MaterialActivationV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
 import { errorMessage } from "../../../shared-ts/src/utils/errors.js";
 import { walletSessionAuthorizations } from "../../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
 import { IndexedDBManager } from "../../../core/indexedDB/index.js";

package/dist/esm/SeamsWeb/operations/recovery/walletRecoveryCommit.js

@@ -1,27 +1,23 @@
 import { parseEmailOtpProviderUserId, parseThresholdEd25519SessionId } from "../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
-import { walletAuthorityDigestsMatchV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
+import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
+import { toAccountId } from "../../../core/types/accountIds.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { sameWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { computeEcdsaDerivationRoleLocalRelayerKeyId } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { buildEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { toAccountId } from "../../../core/types/accountIds.js";
+import { sameWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { sameVerifiedActiveWalletAuthorityV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletRecoveryCommittedProjectionV1 } from "../../../shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js";
 import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { buildEcdsaRoleLocalPublicFacts } from "../../../core/signingEngine/session/persistence/ecdsaRoleLocalRecords.js";
-import { prepareWalletCustodyEcdsaContinuity } from "../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
+import { prepareWalletCustodyEcdsaContinuity } from "../../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js";
 import { prepareWalletRecoveryEmailOtpPublication, prepareWalletRecoveryPasskeyPublication } from "../../../core/signingEngine/flows/registration/accountLifecycle.js";
 import { finalizeWalletRecovery, replayWalletRecovery } from "../../../core/rpcClients/relayer/walletRecoveryFinalize.js";
 import { finalizeWalletRecoveryGoogleEmailOtp, replayWalletRecoveryGoogleEmailOtp } from "../../../core/rpcClients/relayer/walletRecoveryGoogleEmailOtp.js";
 import { durableEmailEnrollmentReference, isDurablePasskeyPayload, walletRecoveryDurablePayloadFromOperation } from "./walletRecoveryDurablePayload.js";
 import { awaitingPendingWalletRecoveryCommit, decryptWalletRecoveryDurablePayload, encryptWalletRecoveryDurablePayload, promotedPendingWalletRecoveryCommit, requireWalletRecoveryOperationId } from "./walletRecoveryJournal.js";
 //#region src/SeamsWeb/operations/recovery/walletRecoveryCommit.ts
-async function sameVerifiedActiveWalletAuthorityV1(left, right) {
-	const [leftVerified, rightVerified] = await Promise.all([walletAuthorityDigestsMatchV1(left), walletAuthorityDigestsMatchV1(right)]);
-	return leftVerified && rightVerified && left.authorityDigestB64u === right.authorityDigestB64u && left.signerActivationSetDigestB64u === right.signerActivationSetDigestB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs && left.activatedAtMs === right.activatedAtMs;
-}
 async function sameWalletRecoveryCommittedProjectionV1(left, right) {
 	if (left.version !== right.version || left.storeVersion !== right.storeVersion || left.walletId !== right.walletId || left.recoveryOperationId !== right.recoveryOperationId || left.targetDeviceId !== right.targetDeviceId || left.targetAuthorityId !== right.targetAuthorityId || left.targetWalletAuthMethodId !== right.targetWalletAuthMethodId || !await sameVerifiedActiveWalletAuthorityV1(left.authority, right.authority) || !sameWalletAuthMethodRecordV2(left.authMethod, right.authMethod)) return false;
 	if (left.kind !== right.kind) return false;

package/dist/esm/SeamsWeb/operations/recovery/walletRecoveryDurablePayload.js

@@ -1,14 +1,16 @@
 import { parseEmailOtpProviderUserId, parseThresholdEd25519SessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { requireRecord } from "../../../shared-ts/src/utils/validation.js";
+import { rejectUnknownFields } from "../../../shared-ts/src/utils/exactRecord.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
-import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, rejectUnknownFields, requireRecord } from "../../../shared-ts/src/passkey-custody/primitives.js";
+import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u } from "../../../shared-ts/src/passkey-custody/primitives.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { parseRouterAbMpcMaterialActivationRef, routerAbMpcMaterialActivationRefToWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { normalizeThresholdRuntimePolicyScope } from "../../../core/signingEngine/threshold/sessionPolicy.js";
 import { parseRecoveryCodeReservationId } from "../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
+import { parseRouterAbMpcMaterialActivationRef, routerAbMpcMaterialActivationRefToWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseWalletRecoveryEcdsaPossessionProofV1 } from "../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.js";
 import { WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND } from "../../../core/indexedDB/walletCustodyEd25519MaterialRecord.js";
 import { parseWalletRecoveryPreparationKeyManifest } from "../../../core/rpcClients/relayer/walletRecoveryPrepare.js";

package/dist/esm/SeamsWeb/operations/recovery/walletRecoveryRotation.js

@@ -1,8 +1,8 @@
-import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
-import "../../../shared-ts/src/utils/encoders.js";
 import { joinNormalizedUrl } from "../../../shared-ts/src/utils/normalize.js";
+import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { SIGNING_SESSION_SEAL_GROUP_ID } from "../../../shared-ts/src/utils/signingSessionSeal.js";
 import { WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../shared-ts/src/utils/emailOtpDomain.js";
+import "../../../shared-ts/src/utils/encoders.js";
 import { redactCredentialExtensionOutputs } from "../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
 import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { computeWalletCustodyAdminChallengeDigest } from "../../../shared-ts/src/authorization/walletCustodyOperation.js";

package/dist/esm/SeamsWeb/operations/registration/pendingEcdsaRegistrationRecovery.js

@@ -1,9 +1,43 @@
-import { parseEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseEcdsaRoleLocalMaterialHandle } from "../../../core/signingEngine/session/keyMaterialBrands.js";
-import { prepareWalletCustodyEcdsaContinuity } from "../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
+import { parseEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { buildEcdsaCapabilityScope } from "../../../core/signingEngine/session/material/ecdsaCapabilityManifest.js";
+import { ecdsaCapabilityScopesMatch, runtimePolicyScopesMatch } from "../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestRecords.js";
+import { IndexedDbEcdsaCapabilityManifestStore } from "../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
+import { prepareWalletCustodyEcdsaContinuity } from "../../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js";
 import { prepareWalletEcdsaRegistrationPublication } from "../../../core/signingEngine/flows/registration/accountLifecycle.js";
 import { pendingEcdsaActivateRequest, requireCommittedEcdsaRegistrationResponse, requireEcdsaProjection, requireResponseWalletKeys } from "./pendingEcdsaRegistrationRecoveryValidation.js";
 //#region src/SeamsWeb/operations/registration/pendingEcdsaRegistrationRecovery.ts
+async function prepareRegistrationContinuity(input) {
+	const store = new IndexedDbEcdsaCapabilityManifestStore();
+	const materialActivation = routerAbMpcMaterialActivationRefFromWire(input.activationReceipt.ecdsa_activation.material_activation);
+	const existing = await store.lookupByMaterialActivation({
+		walletId: input.authority.walletId,
+		authority: input.authority,
+		materialActivation
+	});
+	if (existing.kind === "missing") {
+		const prepared = await prepareWalletCustodyEcdsaContinuity(input);
+		return {
+			roleLocalMaterialRef: prepared.roleLocalMaterialRef,
+			publication: [prepared]
+		};
+	}
+	if (existing.kind !== "active") throw new Error(`Pending ECDSA registration continuity is ${existing.kind}`);
+	const manifest = existing.manifest;
+	const material = manifest.durableMaterial;
+	if (!sameRouterAbEcdsaRegistrationActivationReceiptV1(manifest.activation.serverActivation.serverActivationReceipt.protocolReceipt, input.activationReceipt) || !sameRouterAbEcdsaDerivationPublicCapabilityV1(material.roleLocalPublicFacts.publicCapability, input.publicCapability) || !ecdsaCapabilityScopesMatch(manifest.signer.scope, buildEcdsaCapabilityScope({ targetMemberships: input.chainTargets })) || material.roleLocalBinding.keyHandle !== input.keyHandle || material.roleLocalBinding.ecdsaThresholdKeyId !== input.ecdsaThresholdKeyId || material.roleLocalBinding.relayerKeyId !== input.relayerKeyId || material.bindingDigest !== input.publicFacts.contextBinding32B64u || manifest.signer.signingRootId !== input.signingRootId || manifest.signer.signingRootVersion !== input.signingRootVersion || !runtimePolicyScopesMatch(material.runtimePolicyScope, input.runtimePolicyScope)) throw new Error("Pending ECDSA registration conflicts with its restored activation");
+	return {
+		roleLocalMaterialRef: {
+			kind: "ecdsa_role_local_persisted_material_ref_v1",
+			durableMaterialRef: material.durableMaterialRef,
+			bindingDigest: material.bindingDigest,
+			materialActivation
+		},
+		publication: []
+	};
+}
 function nonEmptyWalletKeys(walletKeys) {
 	const first = walletKeys[0];
 	if (!first) throw new Error("ECDSA registration finalization returned no wallet keys");
@@ -60,7 +94,7 @@ function publicationInput(args) {
 			walletSession: args.session.session.wallet_session,
 			operationCredential: args.session.session.operation_credential
 		},
-		ecdsaContinuity: [args.ecdsaContinuity],
+		ecdsaContinuity: args.ecdsaContinuity,
 		registration: args.registration
 	};
 }
@@ -83,7 +117,7 @@ async function resumePendingEcdsaRegistration(args) {
 	const primaryKey = responseWalletKeys[0];
 	if (!primaryKey) throw new Error("ECDSA registration activation returned no primary key");
 	const authority = await walletAuthAuthorityRef({ authority: committed.authority });
-	const continuity = await prepareWalletCustodyEcdsaContinuity({
+	const continuity = await prepareRegistrationContinuity({
 		authority,
 		chainTargets: nonEmptyChainTargets(responseWalletKeys),
 		walletId: String(args.pending.walletId),
@@ -135,7 +169,7 @@ async function resumePendingEcdsaRegistration(args) {
 		response: committed,
 		registration,
 		session: unlocked.session,
-		ecdsaContinuity: continuity
+		ecdsaContinuity: continuity.publication
 	}));
 	return {
 		kind: "published",