@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/SeamsWeb/operations/auth/walletUnlockEcdsaSubject.js

@@ -1,7 +1,7 @@
 import { IndexedDbEcdsaCapabilityManifestStore } from "../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
 //#region src/SeamsWeb/operations/auth/walletUnlockEcdsaSubject.ts
 const ecdsaCapabilityManifestStore = new IndexedDbEcdsaCapabilityManifestStore();
-async function listEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
+async function resolveEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
 	const resolved = await ecdsaCapabilityManifestStore.listActiveWalletCapabilitySubjects(walletId);
 	if (resolved.kind === "persistence_unavailable") return {
 		kind: "failed",
@@ -24,9 +24,6 @@ async function listEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
 		subjects
 	};
 }
-async function resolveEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
-	return await listEvmFamilyEcdsaWalletUnlockSubjects(walletId);
-}
 async function resolveEcdsaActivationJournalSelectors(walletId) {
 	return await ecdsaCapabilityManifestStore.listWalletActivationJournalSelectors(walletId);
 }

package/dist/esm/SeamsWeb/operations/auth/walletUnlockSubject.js

@@ -196,10 +196,7 @@ async function resolveWalletIdForLastUsedProfile(profileId) {
 }
 function buildWalletUnlockSubjectSet(walletId, subjects) {
 	const first = subjects[0];
-	if (!first) return {
-		kind: "missing_requested_capability_subject",
-		walletId
-	};
+	if (!first) return { kind: "missing_requested_capability_subject" };
 	return {
 		kind: "resolved",
 		subjectSet: {
@@ -222,7 +219,6 @@ async function resolveWalletUnlockSubjectSet(args) {
 			const nearResolution = await resolveNearEd25519WalletUnlockSubjects(normalizedWalletId);
 			if (nearResolution.kind === "failed") return {
 				kind: "capability_subject_resolution_failed",
-				walletId: normalizedWalletId,
 				reason: nearResolution.reason
 			};
 			for (const subject of nearResolution.subjects) appendUniqueWalletUnlockSubject(subjects, subject);
@@ -235,7 +231,6 @@ async function resolveWalletUnlockSubjectSet(args) {
 	const ecdsaResolution = await resolveEvmFamilyEcdsaWalletUnlockSubjects(normalizedWalletId);
 	if (ecdsaResolution.kind === "failed") return {
 		kind: "capability_subject_resolution_failed",
-		walletId: normalizedWalletId,
 		reason: ecdsaResolution.reason
 	};
 	for (const subject of ecdsaResolution.subjects) appendUniqueWalletUnlockSubject(subjects, subject);
@@ -266,8 +261,7 @@ async function resolveWalletCapabilitySubjectResolution(walletId) {
 	if (subjectResolution.kind === "missing_requested_capability_subject") return {
 		kind: "no_session_for_wallet",
 		walletId: resolvedWalletId,
-		reason: "missing_requested_capability_subject",
-		source
+		reason: "missing_requested_capability_subject"
 	};
 	if (subjectResolution.kind === "capability_subject_resolution_failed") return {
 		kind: "unresolvable",

package/dist/esm/SeamsWeb/operations/authMethods/emailOtp/addEmailOtp.js

@@ -6,9 +6,9 @@ import { redactCredentialExtensionOutputs } from "../../../../core/signingEngine
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { toError } from "../../../../shared-ts/src/utils/errors.js";
 import { computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
 import { copyWalletCustodyEcdsaContinuityToAuthMethod } from "../../../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js";
 import { createWalletAddAuthMethodIntent, requestAddAuthMethodEmailOtpChallenge } from "../../../../core/rpcClients/relayer/walletRegistration.js";
+import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
 import { passkeyCredentialIdB64uFromAuthentication, requirePasskeyPrfFirstB64u } from "../passkey/ecdsaBootstrap.js";
 import { resolveManagedRuntimeScopeBootstrap } from "../../../../core/config/managedRuntimeScope.js";
 import { collectEmailOtpRegistrationAuthority } from "./registrationAuthority.js";

package/dist/esm/SeamsWeb/operations/authMethods/emailOtp/googleEmailOtpWalletAuthFlow.js

@@ -137,10 +137,8 @@ function resolveSessionState(input) {
 		candidates: resolution?.offer?.candidates,
 		selectedCandidateId: resolution?.offer?.selectedCandidateId
 	}) : void 0;
-	const resolvedWalletId = offer ? selectedGoogleEmailOtpRegistrationCandidate(offer).walletId : walletId;
 	return {
-		idToken: input.idToken,
-		walletId: resolvedWalletId,
+		walletId: offer ? selectedGoogleEmailOtpRegistrationCandidate(offer).walletId : walletId,
 		...offer ? { offer } : {},
 		providerSubject: requireProviderSubject(input.resolution),
 		emailHint,
@@ -320,14 +318,12 @@ function startGoogleEmailOtpRegistrationPrewarm(deps) {
 async function beginGoogleEmailOtpWalletAuth(deps, input) {
 	let sessionState;
 	try {
-		const resolution = await resolveGoogleEmailOtpProviderForAuthFlow({
-			deps,
-			input
-		});
 		sessionState = resolveSessionState({
-			idToken: input.idToken,
 			authInput: input,
-			resolution
+			resolution: await resolveGoogleEmailOtpProviderForAuthFlow({
+				deps,
+				input
+			})
 		});
 		sessionState = await selectLinkedEmailOtpWalletAuth({
 			deps,

package/dist/esm/SeamsWeb/operations/authMethods/passkey/addPasskey.js

@@ -6,9 +6,9 @@ import { redactCredentialExtensionOutputs } from "../../../../core/signingEngine
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { toError } from "../../../../shared-ts/src/utils/errors.js";
 import { computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
 import { copyWalletCustodyEcdsaContinuityToAuthMethod } from "../../../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js";
 import { createWalletAddAuthMethodIntent, requestAddAuthMethodEmailOtpChallenge } from "../../../../core/rpcClients/relayer/walletRegistration.js";
+import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
 import { readUnlockedWalletEd25519ExportRootCapabilityV1 } from "../../../../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";
 import { passkeyCredentialIdB64uFromAuthentication, requirePasskeyPrfFirstB64u } from "./ecdsaBootstrap.js";
 import { resolveManagedRuntimeScopeBootstrap } from "../../../../core/config/managedRuntimeScope.js";

package/dist/esm/SeamsWeb/operations/authMethods/revokeAuthMethod.js

@@ -6,8 +6,8 @@ import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds
 import { redactCredentialExtensionOutputs } from "../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
 import { computeWalletAuthMethodRevokeOperationFingerprintV1, parseWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { toError } from "../../../shared-ts/src/utils/errors.js";
-import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { revokeWalletAuthMethod } from "../../../core/rpcClients/relayer/walletRegistration.js";
+import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { passkeyCredentialIdB64uFromAuthentication } from "./passkey/ecdsaBootstrap.js";
 import { requestEmailOtpChallenge } from "./emailOtp/challenge.js";
 //#region src/SeamsWeb/operations/authMethods/revokeAuthMethod.ts

package/dist/esm/SeamsWeb/operations/devices/deviceLinkingHttpTransport.js

@@ -9,6 +9,7 @@ import { parseLinkSessionProjectionV1, parseLinkSessionTransportEventV1, parseLi
 import { parseActivateInstalledAuthorityResultV1, parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1 } from "../../../shared-ts/src/device-linking/authorityActivation.js";
 import { LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, computeLinkedDevicePublicKeyDigestV1 } from "../../../shared-ts/src/device-linking/requestProof.js";
 import "../../../shared-ts/src/device-linking/index.js";
+import { hasExactKeys } from "../../../shared-ts/src/utils/exactKeys.js";
 //#region src/SeamsWeb/operations/devices/deviceLinkingHttpTransport.ts
 const LINKED_DEVICE_SESSION_HTTP_BASE_PATH_V1 = "/wallet/device-linking/v1/sessions";
 const LINKED_DEVICE_POLL_MAX_DELAY_MS = 4e3;
@@ -425,7 +426,7 @@ async function createPollingSubscriptionV1(input) {
 function parseSessionMutationEnvelopeV1(raw) {
 	const record = asPlainDeviceLinkingResponse(raw);
 	if (record === null) throw new Error("linked-device response must be an object");
-	if (!hasExactKeys(record, SESSION_MUTATION_RESPONSE_FIELDS)) throw new Error("linked-device response contains invalid fields");
+	if (!hasExactResponseKeys(record, SESSION_MUTATION_RESPONSE_FIELDS)) throw new Error("linked-device response contains invalid fields");
 	if (record.ok !== true) throw new Error("linked-device response outcome is invalid");
 	switch (record.outcome) {
 		case "applied": return {
@@ -444,7 +445,7 @@ function parseSessionMutationEnvelopeV1(raw) {
 function parseTargetCredentialRegistrationResponseV1(raw) {
 	const record = asPlainDeviceLinkingResponse(raw);
 	if (record === null) throw new Error("linked-device target credential response must be an object");
-	if (!hasExactKeys(record, TARGET_CREDENTIAL_RESPONSE_FIELDS)) throw new Error("linked-device target credential response contains invalid fields");
+	if (!hasExactResponseKeys(record, TARGET_CREDENTIAL_RESPONSE_FIELDS)) throw new Error("linked-device target credential response contains invalid fields");
 	if (record.ok !== true) throw new Error("linked-device target credential response outcome is invalid");
 	switch (record.outcome) {
 		case "applied": return parseTargetCredentialRegistrationResponseBranch(record, "applied");
@@ -462,20 +463,20 @@ function parseTargetCredentialRegistrationResponseBranch(record, outcome) {
 function parseHttpFailureMessageV1(response) {
 	const record = asPlainDeviceLinkingResponse(response.body);
 	if (record === null || record.ok !== false) return `linked-device request failed with HTTP ${response.status}`;
-	if (hasExactKeys(record, CODED_FAILURE_RESPONSE_FIELDS) && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
-	if (hasExactKeys(record, OUTCOME_FAILURE_RESPONSE_FIELDS) && typeof record.outcome === "string" && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
+	if (hasExactResponseKeys(record, CODED_FAILURE_RESPONSE_FIELDS) && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
+	if (hasExactResponseKeys(record, OUTCOME_FAILURE_RESPONSE_FIELDS) && typeof record.outcome === "string" && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
 	switch (record.outcome) {
 		case "conflict":
-			if (hasExactKeys(record, SESSION_CONFLICT_FAILURE_FIELDS)) return "linked-device request failed: conflict";
+			if (hasExactResponseKeys(record, SESSION_CONFLICT_FAILURE_FIELDS)) return "linked-device request failed: conflict";
 			break;
 		case "expired":
-			if (hasExactKeys(record, SESSION_EXPIRED_FAILURE_FIELDS)) return "linked-device request failed: expired";
+			if (hasExactResponseKeys(record, SESSION_EXPIRED_FAILURE_FIELDS)) return "linked-device request failed: expired";
 			break;
 		case "invalid_state":
-			if (hasExactKeys(record, SESSION_INVALID_STATE_FAILURE_FIELDS)) return "linked-device request failed: invalid_state";
+			if (hasExactResponseKeys(record, SESSION_INVALID_STATE_FAILURE_FIELDS)) return "linked-device request failed: invalid_state";
 			break;
 		case "integrity_error":
-			if (hasExactKeys(record, SESSION_INTEGRITY_FAILURE_FIELDS)) return "linked-device request failed: integrity_error";
+			if (hasExactResponseKeys(record, SESSION_INTEGRITY_FAILURE_FIELDS)) return "linked-device request failed: integrity_error";
 			break;
 		default: break;
 	}
@@ -493,11 +494,9 @@ function isPlainDeviceLinkingResponse(value) {
 		return false;
 	}
 }
-function hasExactKeys(record, expectedKeys) {
+function hasExactResponseKeys(record, expectedKeys) {
 	try {
-		const actualKeys = Object.keys(record).sort();
-		const expected = [...expectedKeys].sort();
-		return actualKeys.length === expected.length && actualKeys.every((key, index) => key === expected[index]);
+		return hasExactKeys(record, expectedKeys);
 	} catch {
 		return false;
 	}

package/dist/esm/SeamsWeb/operations/devices/deviceLinkingResume.js

@@ -3,6 +3,7 @@ import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKi
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { encodeWalletSignerActivationSetV1, parseWalletSignerActivationSetV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
 import { parseLocalAuthorityActivationFinalAckV1 } from "../../../shared-ts/src/device-linking/authorityActivation.js";
+import { hasExactKeys } from "../../../shared-ts/src/utils/exactKeys.js";
 //#region src/SeamsWeb/operations/devices/deviceLinkingResume.ts
 const LINKED_DEVICE_COMMITTED_RESUME_KIND_V1 = "linked_device_committed_resume_v1";
 const LINKED_DEVICE_PENDING_ACK_KIND_V1 = "linked_device_pending_ack_v1";
@@ -186,10 +187,7 @@ async function replayPendingDeviceLinkingAcknowledgementsV1(input) {
 		await input.installation.clearPendingActivationAcknowledgementV1({ authorityId: acknowledgement.authorityId });
 		await input.installation.clearCommittedDeliveryResumeV1({ authorityId: acknowledgement.authorityId });
 	}
-	return {
-		kind: "replayed",
-		count: matchingAcknowledgements.length
-	};
+	return { kind: "replayed" };
 }
 function asPlainDeviceLinkingResumeRecord(value) {
 	return isPlainDeviceLinkingResumeRecord(value) ? value : null;
@@ -203,11 +201,6 @@ function isPlainDeviceLinkingResumeRecord(value) {
 		return false;
 	}
 }
-function hasExactKeys(record, expectedKeys) {
-	const actual = Object.keys(record).sort();
-	const expected = [...expectedKeys].sort();
-	return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
-}
 function sameSignerActivations(left, right) {
 	const leftBytes = encodeWalletSignerActivationSetV1(left);
 	const rightBytes = encodeWalletSignerActivationSetV1(right);

package/dist/esm/SeamsWeb/operations/devices/deviceLinkingWorkerChannels.js

@@ -5,27 +5,10 @@ import { parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/
 import { parseLinkDevicePublicKeyB64u, parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1, parseLinkedDeviceEmailOtpVerificationGrantV1 } from "../../../shared-ts/src/device-linking/parsers.js";
 import { parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1, parseLinkedDeviceWalletSessionCredentialDeliveryV1 } from "../../../shared-ts/src/device-linking/walletSessionCredentialDelivery.js";
 import "../../../shared-ts/src/device-linking/index.js";
+import { hasExactKeys } from "../../../shared-ts/src/utils/exactKeys.js";
 import { resolveWorkerUrl } from "../../../core/walletRuntimePaths/workers.js";
 import { createDeviceLinkingOrdinaryMaterialWorkerPortV1 } from "../../../core/signingEngine/workerManager/deviceLinkingPorts.js";
 //#region src/SeamsWeb/operations/devices/deviceLinkingWorkerChannels.ts
-function isDeviceLinkingKeyHandleRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "handleId|kind";
-}
-function isDeviceLinkingKeyCreateResultRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "deliveryRecipientPublicKey65B64u|devicePublicKeyB64u|handleId|linkPublicKeyB64u";
-}
-function isDeviceLinkingEmailOtpFactorReleaseResultRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "factorSecret|kind|verificationGrant";
-}
-function isDeviceLinkingRequestSignatureResultRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "signatureB64u";
-}
-function isDeviceLinkingWorkerSuccessFrameRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "id|ok|result" && "ok" in value && value.ok === true;
-}
-function isDeviceLinkingWorkerFailureFrameRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "error|id|ok" && "ok" in value && value.ok === false;
-}
 function nonEmpty(value, label) {
 	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error(`${label} is required`);
 	return value;
@@ -51,7 +34,7 @@ function parseFixedB64u(value, length, label) {
 	return encoded;
 }
 function parseHandle(value) {
-	if (!isDeviceLinkingKeyHandleRecordV1(value)) throw new Error("device-linking key handle has invalid fields");
+	if (!hasExactKeys(value, ["kind", "handleId"])) throw new Error("device-linking key handle has invalid fields");
 	const record = value;
 	if (record.kind !== "device_linking_key_material_handle_v1") throw new Error("device-linking key handle kind is invalid");
 	return {
@@ -60,7 +43,12 @@ function parseHandle(value) {
 	};
 }
 function parseCreateResult(value) {
-	if (!isDeviceLinkingKeyCreateResultRecordV1(value)) throw new Error("device-linking key create response has invalid fields");
+	if (!hasExactKeys(value, [
+		"handleId",
+		"linkPublicKeyB64u",
+		"devicePublicKeyB64u",
+		"deliveryRecipientPublicKey65B64u"
+	])) throw new Error("device-linking key create response has invalid fields");
 	const record = value;
 	return {
 		handle: {
@@ -73,7 +61,11 @@ function parseCreateResult(value) {
 	};
 }
 function parseEmailOtpFactorReleaseResult(value) {
-	if (!isDeviceLinkingEmailOtpFactorReleaseResultRecordV1(value)) throw new Error("device-linking Email OTP factor release response has invalid fields");
+	if (!hasExactKeys(value, [
+		"kind",
+		"verificationGrant",
+		"factorSecret"
+	])) throw new Error("device-linking Email OTP factor release response has invalid fields");
 	const record = value;
 	if (record.kind !== "device_linking_email_otp_factor_release_result_v1") throw new Error("device-linking Email OTP factor release response kind is invalid");
 	if (!(record.factorSecret instanceof ArrayBuffer) || record.factorSecret.byteLength !== 32) throw new Error("device-linking Email OTP factor release secret is invalid");
@@ -87,11 +79,15 @@ function parseWalletSessionCredentialDeliveryResult(value) {
 	return parseWalletSessionOperationCredentialV1(value);
 }
 function parseSignatureResult(value) {
-	if (!isDeviceLinkingRequestSignatureResultRecordV1(value)) throw new Error("device-linking request signature response has invalid fields");
+	if (!hasExactKeys(value, ["signatureB64u"])) throw new Error("device-linking request signature response has invalid fields");
 	return { signatureB64u: parseFixedB64u(value.signatureB64u, 64, "signatureB64u") };
 }
 function parseResponseFrame(value) {
-	if (isDeviceLinkingWorkerSuccessFrameRecordV1(value)) {
+	if (hasExactKeys(value, [
+		"id",
+		"ok",
+		"result"
+	]) && value.ok === true) {
 		const id = value.id;
 		if (typeof id !== "string" || id.trim() !== id || id.length === 0) return null;
 		return {
@@ -100,7 +96,11 @@ function parseResponseFrame(value) {
 			result: value.result
 		};
 	}
-	if (isDeviceLinkingWorkerFailureFrameRecordV1(value)) {
+	if (hasExactKeys(value, [
+		"id",
+		"ok",
+		"error"
+	]) && value.ok === false) {
 		const id = value.id;
 		if (typeof id !== "string" || id.trim() !== id || id.length === 0) return null;
 		if (typeof value.error !== "string" || !value.error.trim()) return null;

package/dist/esm/SeamsWeb/operations/devices/linkDeviceFlow.js

@@ -17,6 +17,7 @@ import { assertNeverEmailOtpTargetActivationState, assertNeverTargetCredentialAc
 //#region src/SeamsWeb/operations/devices/linkDeviceFlow.ts
 var LinkDeviceFlow = class {
 	constructor(options, ports, getAuthenticationContext = null) {
+		this.pendingActivationCompletion = null;
 		this.session = null;
 		this.keyMaterialHandle = null;
 		this.deliveryRecipientPublicKey65B64u = null;
@@ -217,7 +218,6 @@ var LinkDeviceFlow = class {
 	async resolveLinkIdentityV1(linkSessionId) {
 		const cached = this.targetCredentialRegistrationResult;
 		if (cached && cached.linkSessionId === linkSessionId) return {
-			walletId: cached.walletId,
 			enrollmentId: cached.enrollmentId,
 			deviceId: cached.deviceId
 		};
@@ -226,7 +226,6 @@ var LinkDeviceFlow = class {
 			deliveryRecipientPublicKey65B64u: this.requireDeliveryRecipientPublicKey65B64u()
 		});
 		return {
-			walletId: preparation.walletId,
 			enrollmentId: preparation.enrollmentId,
 			deviceId: preparation.deviceId
 		};
@@ -1008,15 +1007,6 @@ var LinkDeviceFlow = class {
 		const session = this.requireSessionV1();
 		const registration = this.targetCredentialRegistrationResult;
 		if (!registration || registration.walletId !== walletSession.walletId) throw new Error("linked-device activation identity is unavailable");
-		const activeSession = {
-			...session,
-			state: {
-				state: "active",
-				deviceId: state.deviceId,
-				authorityId: walletSession.authorityId,
-				activatedAtMs: walletSession.issuedAtMs
-			}
-		};
 		this.handledStates.add("provisioning");
 		this.handledStates.add("authority_pending_local_install");
 		this.handledStates.add("active");
@@ -1053,8 +1043,32 @@ var LinkDeviceFlow = class {
 			acknowledgedAtMs: Date.now()
 		};
 		await this.ports.authorityInstallation.persistPendingActivationAcknowledgementV1({ acknowledgement });
+		const completion = {
+			walletSession,
+			deviceId: state.deviceId,
+			runEpoch
+		};
+		this.pendingActivationCompletion = completion;
 		await this.sendActivationAcknowledgementV1(acknowledgement);
-		this.session = activeSession;
+		await this.completeAcknowledgedActivationV1(completion);
+	}
+	async completeAcknowledgedActivationV1(completion) {
+		this.assertCurrentRun(completion.runEpoch);
+		const { walletSession } = completion;
+		const session = this.requireSessionV1();
+		const registration = this.targetCredentialRegistrationResult;
+		const authenticationContext = this.getAuthenticationContext?.();
+		if (!registration || !authenticationContext) throw new Error("linked-device activation completion is unavailable");
+		this.session = {
+			linkSessionId: session.linkSessionId,
+			qrData: session.qrData,
+			state: {
+				state: "active",
+				deviceId: completion.deviceId,
+				authorityId: walletSession.authorityId,
+				activatedAtMs: walletSession.issuedAtMs
+			}
+		};
 		authenticationContext.signingEngine.setWalletAuthenticated(linkedDeviceWalletAuthenticationState(walletSession, registration));
 		await this.cleanupCompletedLocalResources();
 		logDevice2LinkingStageV1({
@@ -1227,12 +1241,22 @@ var LinkDeviceFlow = class {
 		if (!pending) return false;
 		const session = this.requireSessionV1();
 		if (pending.linkSessionId !== session.qrData.linkSessionId || pending.authorityId !== committed.authority.authorityId || pending.packageSetDigestB64u !== committed.packageSetDigestB64u) throw new Error("pending linked-device acknowledgement identity is inconsistent");
+		const completion = this.pendingActivationCompletion;
+		if (!completion || completion.walletSession.authorizationId !== pending.authorizationId) throw new Error("pending linked-device activation completion is unavailable");
 		await this.sendActivationAcknowledgementV1(pending);
+		await this.completeAcknowledgedActivationV1(completion);
 		return true;
 	}
 	async sendActivationAcknowledgementV1(acknowledgement) {
 		await this.closeSessionSubscriptionV1();
-		await this.requireAuthenticatedTransport().acknowledgeLocalAuthorityActivationV1({ acknowledgement });
+		const transport = this.requireAuthenticatedTransport();
+		const maximumAttempts = 3;
+		for (let attempt = 1; attempt <= maximumAttempts; attempt += 1) try {
+			await transport.acknowledgeLocalAuthorityActivationV1({ acknowledgement });
+			break;
+		} catch (error) {
+			if (classifyLinkedDeviceDeliveryFailureV1(error) || attempt === maximumAttempts) throw error;
+		}
 		await this.ports.authorityInstallation.clearPendingActivationAcknowledgementV1({ authorityId: acknowledgement.authorityId });
 		await this.ports.authorityInstallation.clearCommittedDeliveryResumeV1({ authorityId: acknowledgement.authorityId });
 	}
@@ -1288,6 +1312,7 @@ var LinkDeviceFlow = class {
 		}
 	}
 	clearRunActivationStateV1() {
+		this.pendingActivationCompletion = null;
 		this.clearTargetCredentialActivationState();
 		this.clearEmailOtpTargetActivationState();
 		this.resealedExportRoot = null;

package/dist/esm/SeamsWeb/operations/devices/scanDevice.js

@@ -379,6 +379,6 @@ async function waitForApprovalPollV1(attempt) {
 	await new Promise((resolve) => resolveApprovalPollV1(resolve, attempt));
 }
 //#endregion
-export { scanAndLinkDevice };
+export { scanAndLinkDevice, validateQrLinkedDeviceSessionPayloadV5 };
 
 //# sourceMappingURL=scanDevice.js.map

package/dist/esm/SeamsWeb/operations/near/signNEP413.js

@@ -1,6 +1,5 @@
 import { base64Encode } from "../../../shared-ts/src/utils/base64.js";
 import { SigningEventPhase } from "../../../core/types/sdkSentEvents.js";
-import "../../../shared-ts/src/utils/encoders.js";
 import { emitNearSigningEvent } from "./signingEventHelpers.js";
 import { resolveNearCommandSubject } from "./commandSubject.js";
 //#region src/SeamsWeb/operations/near/signNEP413.ts

package/dist/esm/SeamsWeb/operations/recovery/syncAccount.js

@@ -16,11 +16,11 @@ import { WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND } from "../../../core/indexedD
 import { replaceActiveWalletAuthorityEd25519MaterialActivationV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
 import { errorMessage } from "../../../shared-ts/src/utils/errors.js";
 import { walletSessionAuthorizations } from "../../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
-import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { nearEd25519YaoMaterialActivationFromMetadata } from "../../../core/signingEngine/session/material/nearEd25519YaoMaterialActivation.js";
 import { buildRecoveredWalletSessionState, parsePasskeyEd25519YaoSyncResponseV1, passkeyEd25519YaoLaneReferenceFromRecovery } from "../../../core/signingEngine/flows/recovery/passkeyEd25519YaoRecovery.js";
 import { persistPasskeyEd25519YaoSignerMaterialV1 } from "../../../core/signingEngine/session/passkey/ed25519YaoLocalMaterial.js";
 import { buildPasskeyEd25519RestoreMetadata, persistPasskeyEd25519YaoSessionForRefresh } from "../../../core/signingEngine/session/passkey/ed25519YaoSealedSession.js";
+import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { rememberPasskeyCustodySessionEnvelope } from "../../../core/signingEngine/session/passkey/passkeyCustodySessionCache.js";
 import { openOrRejoinWalletCustodyEd25519V1, openWalletCustodyEd25519ActiveClientV1, walletCustodyActivationFactsFromActiveClientMetadataV1, walletCustodyCacheEnvelopeFromRecordV1 } from "../../../core/signingEngine/walletCustody/openCustodyCache.js";
 import { joinCustodyWireFromEnvelopeRecord } from "../../../core/signingEngine/walletCustody/joinCustodyWire.js";
@@ -625,9 +625,7 @@ async function recoverPasskeyEd25519YaoForUnlockV1(input) {
 		return {
 			kind: "recovered",
 			recovery,
-			credential,
-			verifiedBinding,
-			ecdsaContinuity
+			verifiedBinding
 		};
 	} finally {
 		ownedFactorSecret.fill(0);

package/dist/esm/SeamsWeb/operations/recovery/walletRecovery.js

@@ -1,13 +1,12 @@
 import { parseEmailOtpChallengeId, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { sha256Bytes, sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
-import "../../../shared-ts/src/utils/encoders.js";
 import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
 import { decodeEmailOtpRecoveryKey } from "../../../shared-ts/src/utils/emailOtpRecoveryKey.js";
-import { parseRecoveryCodeReservationId } from "../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import "../../../shared-ts/src/wallet-recovery/recoveryCodes.js";
 import { buildEmailOtpEnvelopeFactor, buildPasskeyEnvelopeFactor } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
+import { parseRecoveryCodeReservationId } from "../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { finalizeWalletRecovery } from "../../../core/rpcClients/relayer/walletRecoveryFinalize.js";
 import { buildWalletRecoveryCeremonyCustodyJson, prepareWalletRecoveryWithCode } from "../../../core/rpcClients/relayer/walletRecoveryPrepare.js";

package/dist/esm/SeamsWeb/operations/recovery/walletRecoveryCommit.js

@@ -1,17 +1,16 @@
 import { parseEmailOtpProviderUserId, parseThresholdEd25519SessionId } from "../../../shared-ts/src/utils/domainIds.js";
-import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
 import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
+import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
 import { toAccountId } from "../../../core/types/accountIds.js";
-import "../../../shared-ts/src/utils/encoders.js";
-import { computeEcdsaDerivationRoleLocalRelayerKeyId } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { computeEcdsaDerivationRoleLocalRelayerKeyId } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { buildEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { buildEcdsaRoleLocalPublicFacts } from "../../../core/signingEngine/session/persistence/ecdsaRoleLocalRecords.js";
 import { sameWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { sameVerifiedActiveWalletAuthorityV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletRecoveryCommittedProjectionV1 } from "../../../shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js";
-import { IndexedDBManager } from "../../../core/indexedDB/index.js";
-import { buildEcdsaRoleLocalPublicFacts } from "../../../core/signingEngine/session/persistence/ecdsaRoleLocalRecords.js";
 import { prepareWalletCustodyEcdsaContinuity } from "../../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js";
+import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { prepareWalletRecoveryEmailOtpPublication, prepareWalletRecoveryPasskeyPublication } from "../../../core/signingEngine/flows/registration/accountLifecycle.js";
 import { finalizeWalletRecovery, replayWalletRecovery } from "../../../core/rpcClients/relayer/walletRecoveryFinalize.js";
 import { finalizeWalletRecoveryGoogleEmailOtp, replayWalletRecoveryGoogleEmailOtp } from "../../../core/rpcClients/relayer/walletRecoveryGoogleEmailOtp.js";

package/dist/esm/SeamsWeb/operations/recovery/walletRecoveryDurablePayload.js

@@ -5,12 +5,11 @@ import { rejectUnknownFields } from "../../../shared-ts/src/utils/exactRecord.js
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
 import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u } from "../../../shared-ts/src/passkey-custody/primitives.js";
-import "../../../shared-ts/src/utils/encoders.js";
 import { normalizeThresholdRuntimePolicyScope } from "../../../core/signingEngine/threshold/sessionPolicy.js";
-import { parseRecoveryCodeReservationId } from "../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
 import { parseRouterAbMpcMaterialActivationRef, routerAbMpcMaterialActivationRefToWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { parseRecoveryCodeReservationId } from "../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { parseWalletRecoveryEcdsaPossessionProofV1 } from "../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.js";
 import { WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND } from "../../../core/indexedDB/walletCustodyEd25519MaterialRecord.js";
 import { parseWalletRecoveryPreparationKeyManifest } from "../../../core/rpcClients/relayer/walletRecoveryPrepare.js";
@@ -81,9 +80,6 @@ function durableBase64Url(value, label, byteLength) {
 	if (byteLength !== void 0 && bytes.byteLength !== byteLength) throw new Error(label + " must decode to " + byteLength + " bytes");
 	return normalized;
 }
-function durableCompressedPublicKey(value, label) {
-	return parseSecp256k1CompressedPublicKeyB64u(value, label);
-}
 function durableSafeInteger(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(label + " must be a non-negative safe integer");
 	return value;
@@ -154,10 +150,10 @@ function parseWalletRecoveryDurableEcdsaPublicFacts(raw) {
 	if (!/^0x[0-9a-f]{40}$/.test(ethereumAddress)) throw new Error("recovery durable ECDSA ethereumAddress is invalid");
 	return {
 		contextBinding32B64u: parseDigestField(record.contextBinding32B64u, "recovery durable ECDSA context binding"),
-		derivationClientSharePublicKey33B64u: durableCompressedPublicKey(record.derivationClientSharePublicKey33B64u, "recovery durable ECDSA client share"),
-		clientVerifyingShare33B64u: durableCompressedPublicKey(record.clientVerifyingShare33B64u, "recovery durable ECDSA client verifying share"),
-		relayerPublicKey33B64u: durableCompressedPublicKey(record.relayerPublicKey33B64u, "recovery durable ECDSA relayer public key"),
-		groupPublicKey33B64u: durableCompressedPublicKey(record.groupPublicKey33B64u, "recovery durable ECDSA group public key"),
+		derivationClientSharePublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.derivationClientSharePublicKey33B64u, "recovery durable ECDSA client share"),
+		clientVerifyingShare33B64u: parseSecp256k1CompressedPublicKeyB64u(record.clientVerifyingShare33B64u, "recovery durable ECDSA client verifying share"),
+		relayerPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.relayerPublicKey33B64u, "recovery durable ECDSA relayer public key"),
+		groupPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.groupPublicKey33B64u, "recovery durable ECDSA group public key"),
 		ethereumAddress,
 		clientShareRetryCounter: durableSafeInteger(record.clientShareRetryCounter, "recovery durable ECDSA client-share retry counter"),
 		relayerShareRetryCounter: durableSafeInteger(record.relayerShareRetryCounter, "recovery durable ECDSA relayer-share retry counter")

package/dist/esm/SeamsWeb/operations/recovery/walletRecoveryRotation.js

@@ -2,10 +2,9 @@ import { joinNormalizedUrl } from "../../../shared-ts/src/utils/normalize.js";
 import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { SIGNING_SESSION_SEAL_GROUP_ID } from "../../../shared-ts/src/utils/signingSessionSeal.js";
 import { WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../shared-ts/src/utils/emailOtpDomain.js";
-import "../../../shared-ts/src/utils/encoders.js";
 import { redactCredentialExtensionOutputs } from "../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
-import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { computeWalletCustodyAdminChallengeDigest } from "../../../shared-ts/src/authorization/walletCustodyOperation.js";
+import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { buildEmailOtpRoutePlan } from "../../../core/signingEngine/stepUpConfirmation/otpPrompt/authLane.js";
 import { fetchPasskeyCustodyEnvelope } from "../../../core/rpcClients/relayer/passkeyCustodyEnvelope.js";
 import { passkeyCredentialIdB64uFromAuthentication, requirePasskeyPrfFirstB64u } from "../authMethods/passkey/ecdsaBootstrap.js";