@seams/wallet 0.6.2 → 0.7.3

package/dist/esm/SeamsWeb/operations/auth/scheduleLinkedDevicePresignaturePrefill.js

@@ -0,0 +1,64 @@
+import { deriveEvmFamilyEcdsaKeyHandle } from "../../../core/signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
+import { routerAbMpcMaterialActivationRefToWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { parseEcdsaKeyHandle } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
+import { MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS } from "../../../core/signingEngine/workerManager/ecdsaPresignLifecycle.js";
+import { resolveLinkedEcdsaHolderRuntimeV1 } from "../../../core/signingEngine/session/material/linkedEcdsaHolderRuntime.js";
+import { emitSigningSessionFlowTrace } from "../../../core/signingEngine/session/operationState/trace.js";
+import { buildRouterAbEcdsaDerivationSigningMaterialRef } from "../../../core/signingEngine/routerAb/ecdsaDerivation/signingMaterialRef.js";
+import { scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill } from "../../../core/signingEngine/routerAb/ecdsaDerivation/presignaturePool.js";
+import { createLinkedHolderClientSigningMaterialSource } from "../../../core/signingEngine/flows/signEvmFamily/signers/ecdsaDerivationClientSigningMaterialSource.js";
+//#region src/SeamsWeb/operations/auth/scheduleLinkedDevicePresignaturePrefill.ts
+async function scheduleLinkedDevicePresignaturePrefill(args) {
+	try {
+		const scope = args.runtime.activationReceipt.normalSigning.scope;
+		const material = buildRouterAbEcdsaDerivationSigningMaterialRef({ routerAbState: args.runtime.activationReceipt.normalSigning });
+		const keyHandle = await deriveEvmFamilyEcdsaKeyHandle({
+			ecdsaThresholdKeyId: scope.ecdsa_threshold_key_id,
+			signingRootId: scope.signing_root_id,
+			signingRootVersion: scope.signing_root_version
+		});
+		if (resolveLinkedEcdsaHolderRuntimeV1(args.runtime) !== args.runtime) return;
+		const result = scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill({
+			relayerUrl: args.relayerUrl,
+			keyHandle: parseEcdsaKeyHandle(keyHandle),
+			ecdsaThresholdKeyId: material.ecdsaThresholdKeyId,
+			clientVerifyingShareB64u: material.clientVerifier33B64u,
+			clientSigningMaterial: createLinkedHolderClientSigningMaterialSource(args.runtime.holderHandleId),
+			thresholdEcdsaPublicKeyB64u: material.thresholdVerifier33B64u,
+			relayerVerifyingShareB64u: material.serverVerifier33B64u,
+			credential: {
+				kind: "wallet_session_opaque",
+				walletSessionToken: args.operationCredential.token
+			},
+			authorization: {
+				kind: "reusable_wallet_session",
+				wallet_session_id: args.operationCredential.walletSessionId
+			},
+			materialActivation: routerAbMpcMaterialActivationRefToWire(args.runtime.materialActivation),
+			routerAbEcdsaDerivationPoolFill: {
+				kind: "router_ab_ecdsa_derivation_signing_worker_pool",
+				scope,
+				ceremonyExpiresAtMs: args.expiresAtMs,
+				materialExpiresAtMs: Date.now() + MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS
+			},
+			workerCtx: args.workerCtx
+		});
+		emitSigningSessionFlowTrace("evm-family", {
+			event: "ecdsa_linked_device_prefill",
+			scheduled: result.scheduled,
+			reason: result.reason,
+			depth: result.depth,
+			targetDepth: result.targetDepth
+		});
+	} catch {
+		emitSigningSessionFlowTrace("evm-family", {
+			event: "ecdsa_linked_device_prefill",
+			scheduled: false,
+			reason: "unexpected_error"
+		});
+	}
+}
+//#endregion
+export { scheduleLinkedDevicePresignaturePrefill };
+
+//# sourceMappingURL=scheduleLinkedDevicePresignaturePrefill.js.map

package/dist/esm/SeamsWeb/operations/auth/walletAuth.js

@@ -1,4 +1,3 @@
-import { WalletSessionStatusReadScope } from "../../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { SIGNER_AUTH_METHODS } from "../../../shared-ts/src/utils/signerDomain.js";
 import { toWalletId } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { toError } from "../../../shared-ts/src/utils/errors.js";
@@ -122,7 +121,7 @@ async function getRecentUnlocksDomain(deps) {
 	}
 	return await getRecentUnlocks(deps.getContext());
 }
-async function prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps, args) {
+async function prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps, args, statusReads) {
 	if (deps.walletIframe.shouldUseWalletIframe()) return await (await deps.walletIframe.requireRouter(args.walletSession.walletId)).prefillRouterAbEcdsaDerivationPresignaturePool({
 		walletSession: args.walletSession,
 		options: {
@@ -135,7 +134,7 @@ async function prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps, args)
 		walletId,
 		chainTarget: args.chainTarget,
 		...typeof args.waitForPoolReady === "boolean" ? { waitForPoolReady: args.waitForPoolReady } : {}
-	}, new WalletSessionStatusReadScope());
+	}, statusReads);
 }
 //#endregion
 export { getRecentUnlocksDomain, getWalletSessionDomain, hasPasskeyCredentialDomain, lockDomain, logoutDomain, prefillRouterAbEcdsaDerivationPresignaturePoolDomain, unlockDomain };

package/dist/esm/SeamsWeb/operations/auth/walletUnlockEcdsaSubject.js

@@ -1,7 +1,7 @@
 import { IndexedDbEcdsaCapabilityManifestStore } from "../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
 //#region src/SeamsWeb/operations/auth/walletUnlockEcdsaSubject.ts
 const ecdsaCapabilityManifestStore = new IndexedDbEcdsaCapabilityManifestStore();
-async function listEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
+async function resolveEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
 	const resolved = await ecdsaCapabilityManifestStore.listActiveWalletCapabilitySubjects(walletId);
 	if (resolved.kind === "persistence_unavailable") return {
 		kind: "failed",
@@ -24,9 +24,6 @@ async function listEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
 		subjects
 	};
 }
-async function resolveEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
-	return await listEvmFamilyEcdsaWalletUnlockSubjects(walletId);
-}
 async function resolveEcdsaActivationJournalSelectors(walletId) {
 	return await ecdsaCapabilityManifestStore.listWalletActivationJournalSelectors(walletId);
 }

package/dist/esm/SeamsWeb/operations/auth/walletUnlockSubject.js

@@ -1,5 +1,5 @@
-import { parseNearEd25519SigningKeyId } from "../../../shared-ts/src/utils/registrationIntent.js";
 import { toAccountId } from "../../../core/types/accountIds.js";
+import { parseNearEd25519SigningKeyId } from "../../../shared-ts/src/utils/registrationIds.js";
 import { toWalletId } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { parseSignerSlot } from "../../../shared-ts/src/utils/signerSlot.js";
 import { IndexedDBManager } from "../../../core/indexedDB/index.js";

package/dist/esm/SeamsWeb/operations/authMethods/addAuthMethodSourceClaim.js

@@ -2,7 +2,7 @@ import { walletSessionAuthorizations } from "../../../core/indexedDB/seamsWallet
 import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 //#region src/SeamsWeb/operations/authMethods/addAuthMethodSourceClaim.ts
 /**
-* Refactor 109C: the source claim a same-device addition puts in its intent.
+* The source claim a same-device addition puts in its intent.
 *
 * The intent digest is what the fresh source proof signs, so every identity the
 * proof is meant to bind has to be inside it. The server resolves the true

package/dist/esm/SeamsWeb/operations/authMethods/emailOtp/addEmailOtp.js

@@ -1,12 +1,13 @@
 import { parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
-import { computeAddAuthMethodIntentDigestB64u, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { requestWalletCustodyCeremonyOperation } from "../../../../core/signingEngine/walletCustody/ceremonyStepRunner.js";
 import { redactCredentialExtensionOutputs } from "../../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { toError } from "../../../../shared-ts/src/utils/errors.js";
+import { computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
-import { copyWalletCustodyEcdsaContinuityToAuthMethod } from "../../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
+import { copyWalletCustodyEcdsaContinuityToAuthMethod } from "../../../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js";
 import { createWalletAddAuthMethodIntent, requestAddAuthMethodEmailOtpChallenge } from "../../../../core/rpcClients/relayer/walletRegistration.js";
 import { passkeyCredentialIdB64uFromAuthentication, requirePasskeyPrfFirstB64u } from "../passkey/ecdsaBootstrap.js";
 import { resolveManagedRuntimeScopeBootstrap } from "../../../../core/config/managedRuntimeScope.js";

package/dist/esm/SeamsWeb/operations/authMethods/emailOtp/challenge.js

@@ -1,7 +1,7 @@
 import { joinNormalizedUrl } from "../../../../shared-ts/src/utils/normalize.js";
 import { requireTrimmedString, toOptionalTrimmedNonEmptyString } from "../../../../shared-ts/src/utils/validation.js";
-import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseEmailOtpChallengeDelivery } from "../../../../core/signingEngine/session/emailOtp/challengeDelivery.js";
 import { buildEmailOtpRoutePlan } from "../../../../core/signingEngine/stepUpConfirmation/otpPrompt/authLane.js";
 import { parseEmailOtpUnlockEd25519Identity, parseEmailOtpUnlockEd25519Selection } from "../../../../core/signingEngine/session/emailOtp/publicTypes.js";

package/dist/esm/SeamsWeb/operations/authMethods/emailOtp/googleEmailOtpWalletAuthFlow.js

@@ -1,4 +1,4 @@
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { walletSessionRefFromSession } from "../../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { DEFAULT_UNLOCK_REMAINING_USES } from "../../../../core/signingEngine/threshold/sessionPolicy.js";
 import { listConfiguredThresholdEcdsaPublicationTargets, listThresholdEcdsaProvisionTargets } from "../../session/thresholdEcdsaProvisioning.js";

package/dist/esm/SeamsWeb/operations/authMethods/emailOtp/localEmailOtpProjection.js

@@ -1,6 +1,6 @@
 import { parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { isEmailOtpWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
 //#region src/SeamsWeb/operations/authMethods/emailOtp/localEmailOtpProjection.ts
 /**

package/dist/esm/SeamsWeb/operations/authMethods/emailOtp/registrationOffer.js

@@ -1,5 +1,5 @@
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { requireRecord, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 //#region src/SeamsWeb/operations/authMethods/emailOtp/registrationOffer.ts
 const OTP_ONLY_FORBIDDEN_FIELDS = [
 	"delivery",
@@ -21,15 +21,6 @@ const SECRET_MATERIAL_FIELDS = [
 	"bootstrapMaterial",
 	"clientSecret32"
 ];
-function requireRecord(value, label) {
-	if (!isPlainObject(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-function requireString(value, label) {
-	const normalized = typeof value === "string" ? value.trim() : "";
-	if (!normalized) throw new Error(`${label} is required`);
-	return normalized;
-}
 function requireTimestampMs(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive integer timestamp`);
 	return value;
@@ -39,10 +30,10 @@ function rejectFields(record, fields, label) {
 	if (forbiddenField) throw new Error(`${label} must not include ${forbiddenField}`);
 }
 function parseOfferId(value) {
-	return requireString(value, "offerId");
+	return requireTrimmedString(value, "offerId");
 }
 function parseCandidateId(value, label = "candidateId") {
-	return requireString(value, label);
+	return requireTrimmedString(value, label);
 }
 function parseCandidate(value) {
 	const record = requireRecord(value, "registration candidate");
@@ -50,7 +41,7 @@ function parseCandidate(value) {
 	rejectFields(record, SECRET_MATERIAL_FIELDS, "registration candidate");
 	return {
 		candidateId: parseCandidateId(record.candidateId),
-		walletId: walletIdFromString(requireString(record.walletId, "candidate.walletId"))
+		walletId: walletIdFromString(requireTrimmedString(record.walletId, "candidate.walletId"))
 	};
 }
 function parseGoogleEmailOtpRegistrationOffer(value) {
@@ -67,7 +58,7 @@ function parseGoogleEmailOtpRegistrationOffer(value) {
 		kind: "google_email_otp_registration_offer_v1",
 		offerId: parseOfferId(record.offerId),
 		expiresAtMs: requireTimestampMs(record.expiresAtMs, "expiresAtMs"),
-		emailHint: requireString(record.emailHint, "emailHint"),
+		emailHint: requireTrimmedString(record.emailHint, "emailHint"),
 		candidates: [firstCandidate, ...remainingCandidates],
 		selectedCandidateId
 	};

package/dist/esm/SeamsWeb/operations/authMethods/emailOtp/walletActivation.js

@@ -1,6 +1,6 @@
-import { isActiveRecoveredWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { buildEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { toAccountId } from "../../../../core/types/accountIds.js";
+import { buildEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { isActiveRecoveredWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
 //#region src/SeamsWeb/operations/authMethods/emailOtp/walletActivation.ts
 async function persistVerifiedEmailOtpAuthorityAfterUnlock(args) {

package/dist/esm/SeamsWeb/operations/authMethods/passkey/addPasskey.js

@@ -1,12 +1,13 @@
 import { parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
-import { computeAddAuthMethodIntentDigestB64u, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { requestWalletCustodyCeremonyOperation } from "../../../../core/signingEngine/walletCustody/ceremonyStepRunner.js";
 import { redactCredentialExtensionOutputs } from "../../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { toError } from "../../../../shared-ts/src/utils/errors.js";
+import { computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
-import { copyWalletCustodyEcdsaContinuityToAuthMethod } from "../../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
+import { copyWalletCustodyEcdsaContinuityToAuthMethod } from "../../../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js";
 import { createWalletAddAuthMethodIntent, requestAddAuthMethodEmailOtpChallenge } from "../../../../core/rpcClients/relayer/walletRegistration.js";
 import { readUnlockedWalletEd25519ExportRootCapabilityV1 } from "../../../../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";
 import { passkeyCredentialIdB64uFromAuthentication, requirePasskeyPrfFirstB64u } from "./ecdsaBootstrap.js";
@@ -134,7 +135,7 @@ async function addPasskeyWalletAuthMethodInternal(args) {
 	}
 }
 /**
-* Refactor 109C's `email_otp_to_passkey` branch.
+* The `email_otp_to_passkey` addition branch.
 *
 * The Email OTP method that already unlocks this wallet authorizes adding a
 * passkey. Three things stay exactly as they are in the Passkey-source branch,

package/dist/esm/SeamsWeb/operations/authMethods/passkey/exactPasskeyAuthority.js

@@ -0,0 +1,34 @@
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
+//#region src/SeamsWeb/operations/authMethods/passkey/exactPasskeyAuthority.ts
+/**
+* The wallet's one active passkey method for this credential. The local
+* auth-method store is the one source that names a wallet's methods: a method
+* id derived from the credential is not the id the wallet registered it under.
+*/
+async function exactPasskeyWalletAuthMethodForCredential(args) {
+	const matches = (await IndexedDBManager.listWalletAuthMethodsV2ForWallet(String(args.walletId))).filter((record) => record.kind === "passkey" && record.status === "active" && record.walletId === args.walletId && String(record.rpId) === args.rpId && String(record.credentialIdB64u) === args.credentialIdB64u);
+	const [record] = matches;
+	if (matches.length !== 1 || !record) throw new Error("passkey authority requires one exact active V2 auth method");
+	return record;
+}
+/** The authority reference of the wallet's active passkey method for this credential. */
+async function exactPasskeyWalletAuthAuthorityRefForCredential(args) {
+	const record = await exactPasskeyWalletAuthMethodForCredential(args);
+	return await walletAuthAuthorityRef({ authority: {
+		walletId: record.walletId,
+		factor: {
+			kind: "passkey",
+			credentialIdB64u: record.credentialIdB64u
+		},
+		verifier: {
+			kind: "webauthn",
+			rpId: record.rpId
+		},
+		bindingId: record.walletAuthMethodId
+	} });
+}
+//#endregion
+export { exactPasskeyWalletAuthAuthorityRefForCredential, exactPasskeyWalletAuthMethodForCredential };
+
+//# sourceMappingURL=exactPasskeyAuthority.js.map

package/dist/esm/SeamsWeb/operations/authMethods/passkey/localPasskeyProjection.js

@@ -1,6 +1,6 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
-import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
 //#region src/SeamsWeb/operations/authMethods/passkey/localPasskeyProjection.ts
 /**
@@ -43,8 +43,8 @@ async function persistFinalizedPasskeyAuthMethodV1(args) {
 	await IndexedDBManager.upsertWalletAuthMethod(localPasskeyAuthMethodFromFinalizeV1(args));
 }
 /**
-* Refactor 109C: the full local install for a passkey added to a wallet that
-* registered with another family.
+* The full local install for a passkey added to a wallet that registered with
+* another family.
 *
 * Three records, and unlock needs all of them. It reads the profile, then the
 * profile's authenticators, then keeps only those whose credential belongs to
@@ -111,45 +111,7 @@ function localPasskeyAuthMethodFromSyncV2(args) {
 async function persistSyncedPasskeyAuthMethodV2(args) {
 	await IndexedDBManager.upsertWalletAuthMethodV2(localPasskeyAuthMethodFromSyncV2(args));
 }
-async function retireOtherLocalPasskeys(walletId, rpId, replacementCredentialIdB64u) {
-	const methods = await IndexedDBManager.listWalletAuthMethodsForWallet(String(walletId));
-	const nowMs = Date.now();
-	for (const method of methods) {
-		if (method.kind !== "passkey" || method.status !== "active" || method.rpId !== rpId || method.credentialIdB64u === replacementCredentialIdB64u) continue;
-		await IndexedDBManager.upsertWalletAuthMethod({
-			...method,
-			status: "revoked",
-			updatedAtMs: nowMs
-		});
-	}
-}
-/** Rebuilds the local identity required by exact-wallet login after recovery. */
-async function persistRecoveredPasskeyAuthMethodProjectionV1(input) {
-	const authMethod = localPasskeyAuthMethodFromFinalizeV1({
-		walletId: input.authMethod.walletId,
-		rpId: input.authMethod.rpId,
-		credentialIdB64u: input.authMethod.credentialIdB64u,
-		credentialPublicKeyB64u: input.authMethod.credentialPublicKeyB64u,
-		counter: input.authMethod.counter
-	});
-	const passkeyCredential = {
-		id: input.credential.id,
-		rawId: input.credential.rawId
-	};
-	await IndexedDBManager.persistRecoveredWalletAuthority({
-		authority: input.authority,
-		authMethod: input.authMethod,
-		recoveredAtMs: Date.now()
-	});
-	if (input.kind === "wallet_only") await IndexedDBManager.upsertProfile({
-		profileId: String(input.authMethod.walletId),
-		defaultSignerSlot: input.signerSlot,
-		passkeyCredential
-	});
-	await retireOtherLocalPasskeys(input.authMethod.walletId, authMethod.rpId, authMethod.credentialIdB64u);
-	await IndexedDBManager.upsertWalletAuthMethod(authMethod);
-}
 //#endregion
-export { localPasskeyAuthMethodFromFinalizeV1, localPasskeyAuthMethodFromSyncV2, persistAddedCrossFamilyPasskeyV1, persistFinalizedPasskeyAuthMethodV1, persistRecoveredPasskeyAuthMethodProjectionV1, persistSyncedPasskeyAuthMethodV2 };
+export { persistAddedCrossFamilyPasskeyV1, persistFinalizedPasskeyAuthMethodV1 };
 
 //# sourceMappingURL=localPasskeyProjection.js.map

package/dist/esm/SeamsWeb/operations/authMethods/revokeAuthMethod.js

@@ -1,9 +1,10 @@
 import { parseWalletAuthMethodId, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { computeWalletAuthMethodRevokeOperationFingerprintV1, parseWalletAuthMethodRecordV2, walletIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
 import { WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../shared-ts/src/utils/emailOtpDomain.js";
 import { WALLET_AUTH_METHODS } from "../../../shared-ts/src/utils/signerDomain.js";
+import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { redactCredentialExtensionOutputs } from "../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
+import { computeWalletAuthMethodRevokeOperationFingerprintV1, parseWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { toError } from "../../../shared-ts/src/utils/errors.js";
 import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { revokeWalletAuthMethod } from "../../../core/rpcClients/relayer/walletRegistration.js";
@@ -11,7 +12,7 @@ import { passkeyCredentialIdB64uFromAuthentication } from "./passkey/ecdsaBootst
 import { requestEmailOtpChallenge } from "./emailOtp/challenge.js";
 //#region src/SeamsWeb/operations/authMethods/revokeAuthMethod.ts
 /**
-* Refactor 109C: remove one auth method using a different active one.
+* Remove one auth method using a different active one.
 *
 * The inverse of the two addition branches, and the reason they are safe to
 * offer: a wallet that can gain a second way in must be able to lose one it no

package/dist/esm/SeamsWeb/operations/devices/deviceLinkingAuthorityInstallation.js

@@ -1,8 +1,8 @@
 import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1 } from "../../../shared-ts/src/device-linking/walletSessionCredentialDelivery.js";
-import { encodeWalletSignerActivationSetV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildEmailOtpWalletAuthAuthority } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { encodeWalletSignerActivationSetV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
+import { assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1 } from "../../../shared-ts/src/device-linking/walletSessionCredentialDelivery.js";
 import { computeWalletSessionInstallationReceiptDigestB64u } from "../../../shared-ts/src/device-linking/digests.js";
 import "../../../shared-ts/src/device-linking/index.js";
 import { LINKED_DEVICE_COMMITTED_RESUME_APP_STATE_PREFIX_V1, LINKED_DEVICE_PENDING_ACK_APP_STATE_PREFIX_V1, buildDeviceLinkingCommittedResumeV1, buildDeviceLinkingPendingAcknowledgementV1, committedResumeAppStateKeyV1, compareDeviceLinkingCommittedResumeV1, parseDeviceLinkingCommittedResumeV1, parseDeviceLinkingPendingAcknowledgementV1, pendingAcknowledgementAppStateKeyV1 } from "./deviceLinkingResume.js";

package/dist/esm/SeamsWeb/operations/devices/deviceLinkingEd25519ExportRoot.js

@@ -1,7 +1,7 @@
 import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision } from "../../../shared-ts/src/passkey-custody/primitives.js";
-import { LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1, buildLinkedDeviceEd25519ExportRootTransferBindingV1, parseLinkedDeviceEd25519ExportRootRecipientPublicKeyB64u, parseLinkedDeviceEd25519ExportRootRecipientV1, serializeLinkedDeviceEd25519ExportRootTransferBindingV1 } from "../../../shared-ts/src/device-linking/ed25519ExportRoot.js";
 import { buildActiveEnvelopeLifecycle, buildPasskeyCustodyEnvelopeRecord, custodyEnvelopeBindingJsonV1, parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
+import { LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1, buildLinkedDeviceEd25519ExportRootTransferBindingV1, parseLinkedDeviceEd25519ExportRootRecipientPublicKeyB64u, parseLinkedDeviceEd25519ExportRootRecipientV1, serializeLinkedDeviceEd25519ExportRootTransferBindingV1 } from "../../../shared-ts/src/device-linking/ed25519ExportRoot.js";
 //#region src/SeamsWeb/operations/devices/deviceLinkingEd25519ExportRoot.ts
 /** Browser-side adapter for the Ed25519 Yao Client export-root relay. */
 function buildDeviceLinkingEd25519ExportRootReplacementEnvelopeV1(input) {

package/dist/esm/SeamsWeb/operations/devices/deviceLinkingHttpTransport.js

@@ -1,13 +1,15 @@
 import { parseLinkDeviceSessionId } from "../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { sha256Bytes } from "../../../shared-ts/src/utils/digests.js";
+import { sha256DigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
+import { secureRandomBase64Url } from "../../../shared-ts/src/utils/secureRandomId.js";
 import { parseLinkedDeviceEd25519ExportRootPackageV1 } from "../../../shared-ts/src/device-linking/ed25519ExportRoot.js";
 import { parseCommittedAuthorityPackagesV1 } from "../../../shared-ts/src/device-linking/committedSignerPackages.js";
-import { parseActivateInstalledAuthorityResultV1, parseLinkSessionProjectionV1, parseLinkSessionTransportEventV1, parseLinkedDeviceApprovalDeliveryV1, parseLinkedDeviceEmailOtpChallengeResendRequestV1, parseLinkedDeviceEmailOtpChallengeResultV1, parseLinkedDeviceEmailOtpChallengeStartRequestV1, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, parseLinkedDeviceEmailOtpVerificationResultV1, parseLinkedDeviceTargetCredentialRegistrationResultV1, parseLinkedDeviceTargetPreparationRequestV1, parseLinkedDeviceTargetPreparationV1, parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1, parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/parsers.js";
-import { secureRandomBase64Url } from "../../../shared-ts/src/utils/secureRandomId.js";
+import { parseLinkSessionProjectionV1, parseLinkSessionTransportEventV1, parseLinkedDeviceApprovalDeliveryV1, parseLinkedDeviceEmailOtpChallengeResendRequestV1, parseLinkedDeviceEmailOtpChallengeResultV1, parseLinkedDeviceEmailOtpChallengeStartRequestV1, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, parseLinkedDeviceEmailOtpVerificationResultV1, parseLinkedDeviceTargetCredentialRegistrationResultV1, parseLinkedDeviceTargetPreparationRequestV1, parseLinkedDeviceTargetPreparationV1 } from "../../../shared-ts/src/device-linking/parsers.js";
+import { parseActivateInstalledAuthorityResultV1, parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1 } from "../../../shared-ts/src/device-linking/authorityActivation.js";
 import { LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, computeLinkedDevicePublicKeyDigestV1 } from "../../../shared-ts/src/device-linking/requestProof.js";
 import "../../../shared-ts/src/device-linking/index.js";
+import { hasExactKeys } from "../../../shared-ts/src/utils/exactKeys.js";
 //#region src/SeamsWeb/operations/devices/deviceLinkingHttpTransport.ts
 const LINKED_DEVICE_SESSION_HTTP_BASE_PATH_V1 = "/wallet/device-linking/v1/sessions";
 const LINKED_DEVICE_POLL_MAX_DELAY_MS = 4e3;
@@ -316,7 +318,7 @@ async function requestDeviceV1(input) {
 	const publishableKey = input.options.publishableKey.trim();
 	const projectEnvironmentId = input.options.projectEnvironmentId.trim();
 	if (!publishableKey || !projectEnvironmentId) throw new Error("linked-device Passkey ceremony requires registration API credentials");
-	const bodyDigestB64u = parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeRequestBodyV1(input.body))));
+	const bodyDigestB64u = await sha256DigestB64u(encodeRequestBodyV1(input.body));
 	const issuedAtMs = input.options.nowMs();
 	if (!Number.isSafeInteger(issuedAtMs) || issuedAtMs <= 0) throw new Error("linked-device request clock is invalid");
 	const expiresAtMs = issuedAtMs + LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1;
@@ -424,7 +426,7 @@ async function createPollingSubscriptionV1(input) {
 function parseSessionMutationEnvelopeV1(raw) {
 	const record = asPlainDeviceLinkingResponse(raw);
 	if (record === null) throw new Error("linked-device response must be an object");
-	if (!hasExactKeys(record, SESSION_MUTATION_RESPONSE_FIELDS)) throw new Error("linked-device response contains invalid fields");
+	if (!hasExactResponseKeys(record, SESSION_MUTATION_RESPONSE_FIELDS)) throw new Error("linked-device response contains invalid fields");
 	if (record.ok !== true) throw new Error("linked-device response outcome is invalid");
 	switch (record.outcome) {
 		case "applied": return {
@@ -443,7 +445,7 @@ function parseSessionMutationEnvelopeV1(raw) {
 function parseTargetCredentialRegistrationResponseV1(raw) {
 	const record = asPlainDeviceLinkingResponse(raw);
 	if (record === null) throw new Error("linked-device target credential response must be an object");
-	if (!hasExactKeys(record, TARGET_CREDENTIAL_RESPONSE_FIELDS)) throw new Error("linked-device target credential response contains invalid fields");
+	if (!hasExactResponseKeys(record, TARGET_CREDENTIAL_RESPONSE_FIELDS)) throw new Error("linked-device target credential response contains invalid fields");
 	if (record.ok !== true) throw new Error("linked-device target credential response outcome is invalid");
 	switch (record.outcome) {
 		case "applied": return parseTargetCredentialRegistrationResponseBranch(record, "applied");
@@ -461,20 +463,20 @@ function parseTargetCredentialRegistrationResponseBranch(record, outcome) {
 function parseHttpFailureMessageV1(response) {
 	const record = asPlainDeviceLinkingResponse(response.body);
 	if (record === null || record.ok !== false) return `linked-device request failed with HTTP ${response.status}`;
-	if (hasExactKeys(record, CODED_FAILURE_RESPONSE_FIELDS) && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
-	if (hasExactKeys(record, OUTCOME_FAILURE_RESPONSE_FIELDS) && typeof record.outcome === "string" && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
+	if (hasExactResponseKeys(record, CODED_FAILURE_RESPONSE_FIELDS) && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
+	if (hasExactResponseKeys(record, OUTCOME_FAILURE_RESPONSE_FIELDS) && typeof record.outcome === "string" && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
 	switch (record.outcome) {
 		case "conflict":
-			if (hasExactKeys(record, SESSION_CONFLICT_FAILURE_FIELDS)) return "linked-device request failed: conflict";
+			if (hasExactResponseKeys(record, SESSION_CONFLICT_FAILURE_FIELDS)) return "linked-device request failed: conflict";
 			break;
 		case "expired":
-			if (hasExactKeys(record, SESSION_EXPIRED_FAILURE_FIELDS)) return "linked-device request failed: expired";
+			if (hasExactResponseKeys(record, SESSION_EXPIRED_FAILURE_FIELDS)) return "linked-device request failed: expired";
 			break;
 		case "invalid_state":
-			if (hasExactKeys(record, SESSION_INVALID_STATE_FAILURE_FIELDS)) return "linked-device request failed: invalid_state";
+			if (hasExactResponseKeys(record, SESSION_INVALID_STATE_FAILURE_FIELDS)) return "linked-device request failed: invalid_state";
 			break;
 		case "integrity_error":
-			if (hasExactKeys(record, SESSION_INTEGRITY_FAILURE_FIELDS)) return "linked-device request failed: integrity_error";
+			if (hasExactResponseKeys(record, SESSION_INTEGRITY_FAILURE_FIELDS)) return "linked-device request failed: integrity_error";
 			break;
 		default: break;
 	}
@@ -492,11 +494,9 @@ function isPlainDeviceLinkingResponse(value) {
 		return false;
 	}
 }
-function hasExactKeys(record, expectedKeys) {
+function hasExactResponseKeys(record, expectedKeys) {
 	try {
-		const actualKeys = Object.keys(record).sort();
-		const expected = [...expectedKeys].sort();
-		return actualKeys.length === expected.length && actualKeys.every((key, index) => key === expected[index]);
+		return hasExactKeys(record, expectedKeys);
 	} catch {
 		return false;
 	}

package/dist/esm/SeamsWeb/operations/devices/deviceLinkingOwnerTransport.js

@@ -1,6 +1,6 @@
 import { parseLinkDeviceSessionId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../../shared-ts/src/device-linking/sourceContribution.js";
 import { parseLinkedDeviceEd25519ExportRootRecipientV1 } from "../../../shared-ts/src/device-linking/ed25519ExportRoot.js";
+import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../../shared-ts/src/device-linking/sourceContribution.js";
 import { parseLinkSessionProjectionV1, parseLinkedDeviceApprovalResultV1, parseLinkedDeviceEmailOtpBaseFactorResolutionResultV1, parseLinkedDeviceSessionClaimV1 } from "../../../shared-ts/src/device-linking/parsers.js";
 import "../../../shared-ts/src/device-linking/index.js";
 import { LINKED_DEVICE_SESSION_HTTP_BASE_PATH_V1 } from "./deviceLinkingHttpTransport.js";

package/dist/esm/SeamsWeb/operations/devices/deviceLinkingResume.js

@@ -2,7 +2,8 @@ import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseWalletAut
 import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { encodeWalletSignerActivationSetV1, parseWalletSignerActivationSetV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
-import { parseLocalAuthorityActivationFinalAckV1 } from "../../../shared-ts/src/device-linking/parsers.js";
+import { parseLocalAuthorityActivationFinalAckV1 } from "../../../shared-ts/src/device-linking/authorityActivation.js";
+import { hasExactKeys } from "../../../shared-ts/src/utils/exactKeys.js";
 //#region src/SeamsWeb/operations/devices/deviceLinkingResume.ts
 const LINKED_DEVICE_COMMITTED_RESUME_KIND_V1 = "linked_device_committed_resume_v1";
 const LINKED_DEVICE_PENDING_ACK_KIND_V1 = "linked_device_pending_ack_v1";
@@ -39,7 +40,7 @@ function buildDeviceLinkingPendingAcknowledgementV1(acknowledgement) {
 }
 function parseDeviceLinkingPendingAcknowledgementV1(raw) {
 	const record = asPlainDeviceLinkingResumeRecord(raw);
-	if (record === null || !hasExactKeys(record, PENDING_ACKNOWLEDGEMENT_FIELDS) || record.kind !== "linked_device_pending_ack_v1") return null;
+	if (record === null || !hasExactKeys(record, PENDING_ACKNOWLEDGEMENT_FIELDS) || record.kind !== LINKED_DEVICE_PENDING_ACK_KIND_V1) return null;
 	try {
 		return {
 			kind: LINKED_DEVICE_PENDING_ACK_KIND_V1,
@@ -131,7 +132,7 @@ function compareDeviceLinkingCommittedResumeV1(input) {
 }
 function parseDeviceLinkingCommittedResumeV1(raw) {
 	const record = asPlainDeviceLinkingResumeRecord(raw);
-	if (record === null || !hasExactKeys(record, COMMITTED_RESUME_FIELDS) || record.kind !== "linked_device_committed_resume_v1") return null;
+	if (record === null || !hasExactKeys(record, COMMITTED_RESUME_FIELDS) || record.kind !== LINKED_DEVICE_COMMITTED_RESUME_KIND_V1) return null;
 	const linkSessionId = parseLinkDeviceSessionId(record.linkSessionId);
 	const walletId = parseWalletId(record.walletId);
 	const enrollmentId = parseLinkedDeviceEnrollmentId(record.enrollmentId);
@@ -203,11 +204,6 @@ function isPlainDeviceLinkingResumeRecord(value) {
 		return false;
 	}
 }
-function hasExactKeys(record, expectedKeys) {
-	const actual = Object.keys(record).sort();
-	const expected = [...expectedKeys].sort();
-	return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
-}
 function sameSignerActivations(left, right) {
 	const leftBytes = encodeWalletSignerActivationSetV1(left);
 	const rightBytes = encodeWalletSignerActivationSetV1(right);