@seams/wallet 0.7.3 → 0.8.0

package/README.md

@@ -7,7 +7,7 @@ WebAuthn, cross-origin iframe isolation, and WASM-based cryptography.
 Strong fits include marketplaces, trading platforms, games, payout and
 remittance products, stablecoin accounts, rewards networks, and applications
 that sponsor or automate onchain operations. Read the
-[wallet vision](../../docs/vision.md) for the complete use-case boundary.
+wallet vision (`docs/vision.md`) for the complete use-case boundary.
 
 Featuring:
 
@@ -44,7 +44,7 @@ pnpm -C packages/wallet dev       # Watch mode
 **Test**:
 
 ```bash
-pnpm -C packages/wallet test           # Playwright tests
+pnpm test:wallet-browser               # Playwright tests
 pnpm -C packages/wallet run type-check # TypeScript validation
 ```
 
@@ -291,15 +291,14 @@ repo/
 │   ├── wallet-server/            # Server library source
 │   └── shared-ts/                # Shared TypeScript utils/types
 ├── crates/
-│   ├── signer-core/              # Shared signer core primitives
-│   └── seams-embedded/           # Embedded Rust SDK facade
+│   └── signer-core/              # Shared signer core primitives
 ├── wasm/                         # Rust WASM packages
 └── tests/                        # Playwright + unit tests
 ```
 
 ## License
 
-MIT License - see [LICENSE](../../LICENSE) for details.
+MIT License - see [LICENSE](../../LICENSE.md) for details.
 
 ## Support
 

package/THIRD_PARTY_NOTICES.md

@@ -5,7 +5,7 @@ distributed Seams Wallet SDK, server runtime, Wasm, strict Workers, and CLI.
 Dependency license expressions come from their package metadata. Packaged
 license and notice wording is reproduced below with normalized whitespace.
 
-Inventory: 518 dependency records (110 npm, 408 Cargo).
+Inventory: 515 dependency records (109 npm, 406 Cargo).
 
 ## Dependency inventory
 
@@ -350,7 +350,6 @@ Inventory: 518 dependency records (110 npm, 408 Cargo).
 | cargo | wasi | 0.11.1+wasi-snapshot-preview1 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | The Cranelift Project Developers |
 | cargo | wasip2 | 1.0.4+wasi-0.2.12 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT |  |
 | cargo | wasm-bindgen-backend | 0.2.100 | MIT OR Apache-2.0 | The wasm-bindgen Developers |
-| cargo | wasm-bindgen-futures | 0.4.50 | MIT OR Apache-2.0 | The wasm-bindgen Developers |
 | cargo | wasm-bindgen-futures | 0.4.73 | MIT OR Apache-2.0 | The wasm-bindgen Developers |
 | cargo | wasm-bindgen-macro-support | 0.2.100 | MIT OR Apache-2.0 | The wasm-bindgen Developers |
 | cargo | wasm-bindgen-macro-support | 0.2.108 | MIT OR Apache-2.0 | The wasm-bindgen Developers |
@@ -383,7 +382,6 @@ Inventory: 518 dependency records (110 npm, 408 Cargo).
 | cargo | wasm-bindgen | 0.2.123 | MIT OR Apache-2.0 | The wasm-bindgen Developers |
 | cargo | wasm-bindgen | 0.2.126 | MIT OR Apache-2.0 | The wasm-bindgen Developers |
 | cargo | wasm-bindgen | 0.2.128 | MIT OR Apache-2.0 | The wasm-bindgen Developers |
-| cargo | web-sys | 0.3.77 | MIT OR Apache-2.0 | The wasm-bindgen Developers |
 | cargo | webpki-root-certs | 1.0.9 | CDLA-Permissive-2.0 |  |
 | cargo | webpki-roots | 1.0.9 | CDLA-Permissive-2.0 |  |
 | cargo | winapi-util | 0.1.11 | Unlicense OR MIT | Andrew Gallant <jamslam@gmail.com> |
@@ -426,7 +424,6 @@ Inventory: 518 dependency records (110 npm, 408 Cargo).
 | npm | @noble/ciphers | 1.3.0 | MIT | Paul Miller (https://paulmillr.com) |
 | npm | @noble/curves | 1.9.1 | MIT | Paul Miller (https://paulmillr.com) |
 | npm | @noble/hashes | 1.8.0 | MIT | Paul Miller (https://paulmillr.com) |
-| npm | @noble/hashes | 2.0.1 | MIT | Paul Miller (https://paulmillr.com) |
 | npm | @peculiar/asn1-android | 2.6.0 | MIT | PeculiarVentures, LLC |
 | npm | @peculiar/asn1-cms | 2.6.0 | MIT | PeculiarVentures, LLC |
 | npm | @peculiar/asn1-csr | 2.6.0 | MIT | PeculiarVentures, LLC |
@@ -3815,7 +3812,6 @@ Applies to:
 
 - npm:@noble/curves@1.9.1
 - npm:@noble/hashes@1.8.0
-- npm:@noble/hashes@2.0.1
 - npm:@scure/base@1.2.6
 
     The MIT License (MIT)
@@ -4131,7 +4127,6 @@ Applies to:
 - cargo:openssl-probe@0.2.1
 - cargo:pkg-config@0.3.33
 - cargo:wasm-bindgen-backend@0.2.100
-- cargo:wasm-bindgen-futures@0.4.50
 - cargo:wasm-bindgen-futures@0.4.73
 - cargo:wasm-bindgen-macro-support@0.2.100
 - cargo:wasm-bindgen-macro-support@0.2.108
@@ -4164,7 +4159,6 @@ Applies to:
 - cargo:wasm-bindgen@0.2.123
 - cargo:wasm-bindgen@0.2.126
 - cargo:wasm-bindgen@0.2.128
-- cargo:web-sys@0.3.77
 
     Copyright (c) 2014 Alex Crichton
 
@@ -10441,7 +10435,6 @@ Applies to:
 - cargo:wasi@0.11.1+wasi-snapshot-preview1
 - cargo:wasip2@1.0.4+wasi-0.2.12
 - cargo:wasm-bindgen-backend@0.2.100
-- cargo:wasm-bindgen-futures@0.4.50
 - cargo:wasm-bindgen-futures@0.4.73
 - cargo:wasm-bindgen-macro-support@0.2.100
 - cargo:wasm-bindgen-macro-support@0.2.108
@@ -10474,7 +10467,6 @@ Applies to:
 - cargo:wasm-bindgen@0.2.123
 - cargo:wasm-bindgen@0.2.126
 - cargo:wasm-bindgen@0.2.128
-- cargo:web-sys@0.3.77
 - cargo:wit-bindgen@0.57.1
 
                                   Apache License

package/dist/.build-inputs.sha256

@@ -1 +1 @@
-3cc408d97f9589145a26282262beee98f19671404d60cfe9373dbe147ef10de6
+188f00b6c5d19248c0239a676e372a52d0a37751a2a56fdcf3ebd6ddb937f21c

package/dist/esm/SeamsWeb/SeamsWeb.js

@@ -11,17 +11,17 @@ import { configuredThresholdEcdsaChainTargets, nearAccountRefFromAccountId, thre
 import { parseExactEcdsaSigningLaneIdentity, parseExactEd25519ExportMaterialIdentity } from "../core/signingEngine/session/identity/exactSigningLaneIdentity.js";
 import { isRegistrationBenchmarkDiagnosticsEnabled } from "../core/signingEngine/walletCustody/ceremonyDriver.js";
 import { isEmailOtpWalletAuthAuthority, parseWalletAuthAuthorityRef } from "../shared-ts/src/utils/walletAuthAuthority.js";
+import { IndexedDbEcdsaCapabilityManifestStore } from "../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
 import { parseLinkedDeviceApprovalResultV1 } from "../shared-ts/src/device-linking/parsers.js";
 import "../shared-ts/src/device-linking/index.js";
 import { isUserCancellationError, toError } from "../shared-ts/src/utils/errors.js";
 import { cloneAuthenticatorOptions } from "../shared-ts/src/utils/authenticatorOptions.js";
 import { walletSessionAuthorizations } from "../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
-import { IndexedDBManager } from "../core/indexedDB/index.js";
-import { IndexedDbEcdsaCapabilityManifestStore } from "../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
 import { resolveLinkedEcdsaHolderRuntimeV1 } from "../core/signingEngine/session/material/linkedEcdsaHolderRuntime.js";
 import { MinimalNearClient } from "../core/rpcClients/near/NearClient.js";
 import { resolveAppearanceTheme, resolveThemePalette } from "../core/config/configHelpers.js";
 import { buildConfigsFromEnv } from "../core/config/defaultConfigs.js";
+import { IndexedDBManager } from "../core/indexedDB/index.js";
 import { activateEmailOtpWalletAfterUnlock, persistVerifiedEmailOtpAuthorityAfterUnlock, walletAuthAuthorityRefForVerifiedEmailOtpUnlock } from "./operations/authMethods/emailOtp/walletActivation.js";
 import { __isWalletIframeHostMode } from "../core/browser/walletIframe/host-mode.js";
 import { readUnlockedEd25519ExportRootLinkingCapabilityV1, walletCustodyCeremonyTransportFromWorkerContextV1 } from "../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";

package/dist/esm/SeamsWeb/assembly/browserSigningSurfaceAssembly.js

@@ -4,9 +4,8 @@ import { WALLET_AUTH_METHODS } from "../../shared-ts/src/utils/signerDomain.js";
 import { configuredThresholdEcdsaChainTargets, thresholdEcdsaChainTargetKey, toWalletId } from "../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { readEmailOtpProviderSubjectForWalletV1 } from "../../core/signingEngine/threshold/ed25519/yaoPublicCapabilityReferences.js";
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../shared-ts/src/utils/walletAuthAuthority.js";
-import { walletSessionAuthorizations } from "../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
-import { IndexedDBManager } from "../../core/indexedDB/index.js";
 import { IndexedDbEcdsaCapabilityManifestStore } from "../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
+import { walletSessionAuthorizations } from "../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
 import { emitSigningSessionFlowTrace } from "../../core/signingEngine/session/operationState/trace.js";
 import { withThresholdEd25519CommitQueue } from "../../core/signingEngine/threshold/ed25519/commitQueue.js";
 import { buildActiveNearEd25519WalletSessionAuthorization } from "../../core/signingEngine/session/material/nearEd25519YaoSigningPreparation.js";
@@ -14,6 +13,7 @@ import { listExactSealedSessionsForWallet } from "../../core/signingEngine/sessi
 import { ed25519SealedRuntimeAuthorityRef } from "../../core/signingEngine/session/warmCapabilities/ed25519SealedSessionRuntime.js";
 import { readOwnerWalletExecutionLaneProjectionV1 } from "../../core/rpcClients/relayer/ownerWalletExecutionLanePreflight.js";
 import { hydrateWalletExecutionLane } from "../../core/signingEngine/session/lanes/walletExecutionLaneHydration.js";
+import { IndexedDBManager } from "../../core/indexedDB/index.js";
 import { EvmFamilyEcdsaMaterialSupersededError } from "../../core/signingEngine/flows/signEvmFamily/signingFlow.js";
 import { authorizeEvmFamilyEcdsaSigningCapability, buildCanonicalEvmFamilyEcdsaSigningCapability, buildEcdsaPreprocessingCapability, buildExactEcdsaDirectCapabilityRuntime, signingAuthorizationFromPreprocessing } from "../../core/signingEngine/session/material/ecdsaSigningCapability.js";
 import { buildPersistedEcdsaRoleLocalMaterial } from "../../core/signingEngine/session/material/ecdsaRoleLocalMaterialResolver.js";

package/dist/esm/SeamsWeb/assembly/createBrowserRecoveryPublicDeps.js

@@ -1,6 +1,6 @@
 import { walletSessionAuthorizations } from "../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
-import { IndexedDBManager } from "../../core/indexedDB/index.js";
 import { withThresholdEd25519CommitQueue } from "../../core/signingEngine/threshold/ed25519/commitQueue.js";
+import { IndexedDBManager } from "../../core/indexedDB/index.js";
 import { withThresholdEcdsaSigningQueue } from "../../core/signingEngine/threshold/ecdsa/signingQueue.js";
 import { provisionPasskeyEcdsaExplicitExportSession } from "../../core/signingEngine/session/passkey/ecdsaSessionProvision.js";
 import { createRecoveryPublicDeps } from "../../core/signingEngine/assembly/ports/recovery.js";

package/dist/esm/SeamsWeb/assembly/createBrowserSigningStores.js

@@ -1,6 +1,6 @@
 import { IndexedDbEd25519YaoPublicCapabilityReferenceStore } from "../../core/signingEngine/threshold/ed25519/yaoPublicCapabilityReferences.js";
-import { createIndexedDBNonceLaneCoordinationStore } from "../../core/indexedDB/nonceLaneCoordinationStore.js";
 import { acquireSigningSessionRestoreLease, listEcdsaSealedSessionsForWallet, listExactSealedSessionsForWallet, readExactSealedSession, releaseSigningSessionRestoreLease, updateExactSealedSessionPolicy, writeExactSealedSession } from "../../core/signingEngine/session/persistence/sealedSessionStore.js";
+import { createIndexedDBNonceLaneCoordinationStore } from "../../core/indexedDB/nonceLaneCoordinationStore.js";
 //#region src/SeamsWeb/assembly/createBrowserSigningStores.ts
 function createBrowserSigningStores(indexedDB) {
 	return {

package/dist/esm/SeamsWeb/assembly/createBrowserWarmSessionPublicDeps.js

@@ -6,7 +6,6 @@ function createBrowserWarmSessionPublicDeps(args) {
 			seamsWebConfigs: args.seamsWebConfigs,
 			credentialStore: args.stores.recoveryAndDeviceLinking.credentialStore,
 			touchIdPrompt: args.touchIdPrompt,
-			touchConfirm: args.touchConfirm,
 			passkeyMpcSession: args.passkeyMpcSession,
 			warmSigning: args.warmSigning,
 			thresholdEcdsaBootstrapQueueByWallet: args.thresholdEcdsaBootstrapQueueByWallet,
@@ -17,7 +16,6 @@ function createBrowserWarmSessionPublicDeps(args) {
 		warmCapabilitiesPublicDeps: createWarmCapabilitiesPublicDeps({
 			seamsWebConfigs: args.seamsWebConfigs,
 			bootstrapStore: args.stores.walletProfileAndSignerRecords.ecdsaBootstrapStore,
-			touchConfirm: args.touchConfirm,
 			passkeyMpcSession: args.passkeyMpcSession,
 			warmSigning: args.warmSigning,
 			walletSessionActivationDeps: args.enginePorts.walletSessionActivationDeps,

package/dist/esm/SeamsWeb/operations/auth/login.js

@@ -1,13 +1,13 @@
 import { mpcMaterialActivationRefsEqual, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { joinNormalizedUrl } from "../../../shared-ts/src/utils/normalize.js";
-import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
-import { deriveImplicitNearAccountIdFromEd25519PublicKey } from "../../../shared-ts/src/utils/near.js";
 import { isObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { WalletSessionStatusReadScope } from "../../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { parseRouterAbEd25519NormalSigningState } from "../../../shared-ts/src/utils/signingSessionSeal.js";
+import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
+import { deriveImplicitNearAccountIdFromEd25519PublicKey } from "../../../shared-ts/src/utils/near.js";
 import { toAccountId } from "../../../core/types/accountIds.js";
 import { SIGNER_AUTH_METHODS } from "../../../shared-ts/src/utils/signerDomain.js";
 import { UnlockEventPhase, createUnlockFlowEvent } from "../../../core/types/sdkSentEvents.js";
@@ -34,7 +34,6 @@ import { openWalletAuthorityLinkedSignerMaterialV1 } from "../../../core/indexed
 import { getUserFriendlyErrorMessage, isUserCancellationError, toError } from "../../../shared-ts/src/utils/errors.js";
 import { computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u } from "../../../shared-ts/src/utils/ecdsaKeyFactsInventory.js";
 import { WalletSessionAuthorizationUpgradeRequiredError, walletSessionAuthorizations } from "../../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
-import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { installLinkedEcdsaHolderRuntimeV1, removeLinkedEcdsaHolderRuntimeV1, resolveLinkedEcdsaHolderRuntimeV1 } from "../../../core/signingEngine/session/material/linkedEcdsaHolderRuntime.js";
 import { fetchWalletEcdsaKeyFactsInventoryWithOperationCredential, fetchWalletEcdsaKeyFactsInventoryWithWebAuthn } from "../../../core/rpcClients/relayer/walletRegistration.js";
 import { ecdsaAvailableLaneForTarget, isConcreteAvailableSigningLane } from "../../../core/signingEngine/session/availability/availableSigningLanes.js";
@@ -42,6 +41,7 @@ import { buildRouterAbEd25519SigningWalletSession } from "../../../core/signingE
 import { buildPasskeyRouterAbEd25519WalletSessionState } from "../../../core/signingEngine/session/warmCapabilities/routerAbEd25519WalletSessionState.js";
 import { persistPasskeyEd25519YaoSignerMaterialV1 } from "../../../core/signingEngine/session/passkey/ed25519YaoLocalMaterial.js";
 import { buildPasskeyEd25519RestoreMetadata, persistPasskeyEd25519YaoSessionForRefresh } from "../../../core/signingEngine/session/passkey/ed25519YaoSealedSession.js";
+import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { getNearThresholdKeyMaterial } from "../../../core/accountData/near/keyMaterial.js";
 import { isEcdsaCredentialFreeSessionActivationAuthorization } from "../../../core/signingEngine/threshold/ecdsa/postRegistrationSessionActivation.js";
 import { exactWalletSessionAuthorityIdentity } from "../../../core/signingEngine/session/persistence/walletSessionAuthorizationProjection.js";
@@ -1965,12 +1965,10 @@ async function unlockInternal(context, subjectSet, options, _completion) {
 				identity: walletIdentity,
 				context: storedCanonicalEcdsaContext
 			});
-			const canFirstBootstrapThresholdEcdsa = Boolean(managedRuntimeScopeBootstrap);
 			const warmupPlan = resolveThresholdLoginWarmupPlan({
 				selection: warmupInput.selection,
 				selectedEcdsaTargets: warmupInput.selectedEcdsaTargets,
 				storedCanonicalEcdsaContext,
-				canFirstBootstrapThresholdEcdsa,
 				wantsEd25519Warmup: warmupInput.wantsEd25519Warmup
 			});
 			const passkeyExchangeEcdsaActivationForWarmup = completedPasskeyExchangeEcdsaActivation;
@@ -2036,7 +2034,7 @@ async function unlockInternal(context, subjectSet, options, _completion) {
 				participantIds,
 				ttlMs: signingSessionPolicy.ttlMs,
 				unlockRemainingUses: requireLoginUnlockSessionUses(signingSessionPolicy.unlockRemainingUses),
-				ecdsaContextResolution: warmupPlan.ecdsaContextResolution,
+				ecdsaContext: warmupPlan.ecdsaContext,
 				credentialState,
 				runtimeScopeBootstrapState,
 				signersToWarm: warmupPlan.signersToWarm,
@@ -2608,7 +2606,6 @@ async function stageMintedLoginEd25519WalletSessionAuthority(context, minted) {
 	context.sharedState.ed25519.expiresAtMs = minted.expiresAtMs;
 	context.sharedState.ed25519.remainingUses = minted.remainingUses;
 	context.sharedState.ed25519.runtimePolicyScope = minted.runtimePolicyScope;
-	if (context.ecdsaContextResolution.kind === "resolve_after_ed25519") context.sharedState.activeCanonicalEcdsaContext = await context.ecdsaContextResolution.resolveAfterEd25519(context.sharedState.ed25519);
 	context.authorityDeferred?.resolve(minted);
 }
 function rejectLoginWarmupEd25519Deferreds(authorityDeferred, error) {
@@ -3067,7 +3064,7 @@ async function primeThresholdLoginWarmSigners(args) {
 	const credential = args.credentialState.kind === "available" ? args.credentialState.credential : void 0;
 	const localPasskeyCredentialIdB64u = args.credentialState.localPasskeyCredentialIdB64u;
 	const runtimeScopeBootstrap = args.runtimeScopeBootstrapState.kind === "available" ? args.runtimeScopeBootstrapState.runtimeScopeBootstrap : null;
-	const initialCanonicalEcdsaContext = args.ecdsaContextResolution.kind === "pre_resolved" ? args.ecdsaContextResolution.context : args.ecdsaContextResolution.initialContext;
+	const initialCanonicalEcdsaContext = args.ecdsaContext;
 	const sharedState = {
 		activeCanonicalEcdsaContext: initialCanonicalEcdsaContext,
 		ed25519: {
@@ -3128,8 +3125,7 @@ async function primeThresholdLoginWarmSigners(args) {
 				remainingUses: unlockRemainingUses,
 				onWalletSessionAuthorityReady: stageMintedLoginEd25519WalletSessionAuthority.bind(void 0, {
 					sharedState,
-					authorityDeferred,
-					ecdsaContextResolution: args.ecdsaContextResolution
+					authorityDeferred
 				})
 			};
 			const commonEd25519ConnectArgs = ed25519ProvisioningIdentity.kind === "fresh_ed25519_provisioning" ? {
@@ -3598,45 +3594,24 @@ function resolveThresholdLoginWarmupPlan(args) {
 		context: args.storedCanonicalEcdsaContext,
 		configuredTargets: args.selectedEcdsaTargets
 	});
-	let ecdsaContextResolution;
-	let signersToWarm;
+	const ecdsaContext = requireCompleteConfiguredTargetKeyContext({
+		completion: configuredTargetKeyCompletion,
+		source: "stored ECDSA key facts"
+	});
+	let signersToWarm = resolveThresholdLoginWarmSigners({
+		selection: args.selection,
+		configuredEcdsaTargets: args.selectedEcdsaTargets,
+		canonicalEcdsaContext: ecdsaContext
+	});
+	if (args.wantsEd25519Warmup && !signersToWarm.includes("ed25519")) signersToWarm = ["ed25519", ...signersToWarm];
 	const ed25519DependsOnEcdsa = false;
-	let ecdsaDependsOnEd25519 = false;
-	if (configuredTargetKeyCompletion.kind === "missing_configured_target_keys" && args.selectedEcdsaTargets.length) {
-		const initialContext = {
-			ecdsaKeys: [],
-			...args.storedCanonicalEcdsaContext.runtimePolicyScope ? { runtimePolicyScope: args.storedCanonicalEcdsaContext.runtimePolicyScope } : {}
-		};
-		if (!args.canFirstBootstrapThresholdEcdsa) throw new Error(`[login] threshold ECDSA warm-up requires complete local key facts for ${configuredTargetKeyCompletion.missingTargets.join(", ")}; run explicit authenticated ECDSA key-facts inventory before unlock`);
-		signersToWarm = args.wantsEd25519Warmup ? ["ed25519", "ecdsa"] : ["ecdsa"];
-		ecdsaDependsOnEd25519 = args.wantsEd25519Warmup;
-		ecdsaContextResolution = {
-			kind: "first_bootstrap_missing_target_keys",
-			initialContext
-		};
-	} else {
-		const resolvedCanonicalEcdsaContext = requireCompleteConfiguredTargetKeyContext({
-			completion: configuredTargetKeyCompletion,
-			source: "stored ECDSA key facts"
-		});
-		ecdsaContextResolution = {
-			kind: "pre_resolved",
-			context: resolvedCanonicalEcdsaContext
-		};
-		signersToWarm = resolveThresholdLoginWarmSigners({
-			selection: args.selection,
-			configuredEcdsaTargets: args.selectedEcdsaTargets,
-			canonicalEcdsaContext: resolvedCanonicalEcdsaContext
-		});
-		if (args.wantsEd25519Warmup && !signersToWarm.includes("ed25519")) signersToWarm = ["ed25519", ...signersToWarm];
-		ecdsaDependsOnEd25519 = signersToWarm.includes("ed25519") && signersToWarm.includes("ecdsa");
-	}
+	const ecdsaDependsOnEd25519 = signersToWarm.includes("ed25519") && signersToWarm.includes("ecdsa");
 	if (!signersToWarm.length) throw new Error("[login] ECDSA unlock requested with no configured ECDSA targets");
 	return {
 		kind: "threshold_login_warmup_plan_ready",
 		storedCanonicalEcdsaContext: args.storedCanonicalEcdsaContext,
 		configuredTargetKeyCompletion,
-		ecdsaContextResolution,
+		ecdsaContext,
 		signersToWarm,
 		ed25519DependsOnEcdsa,
 		ecdsaDependsOnEd25519

package/dist/esm/SeamsWeb/operations/auth/walletUnlockSubject.js

@@ -196,10 +196,7 @@ async function resolveWalletIdForLastUsedProfile(profileId) {
 }
 function buildWalletUnlockSubjectSet(walletId, subjects) {
 	const first = subjects[0];
-	if (!first) return {
-		kind: "missing_requested_capability_subject",
-		walletId
-	};
+	if (!first) return { kind: "missing_requested_capability_subject" };
 	return {
 		kind: "resolved",
 		subjectSet: {
@@ -222,7 +219,6 @@ async function resolveWalletUnlockSubjectSet(args) {
 			const nearResolution = await resolveNearEd25519WalletUnlockSubjects(normalizedWalletId);
 			if (nearResolution.kind === "failed") return {
 				kind: "capability_subject_resolution_failed",
-				walletId: normalizedWalletId,
 				reason: nearResolution.reason
 			};
 			for (const subject of nearResolution.subjects) appendUniqueWalletUnlockSubject(subjects, subject);
@@ -235,7 +231,6 @@ async function resolveWalletUnlockSubjectSet(args) {
 	const ecdsaResolution = await resolveEvmFamilyEcdsaWalletUnlockSubjects(normalizedWalletId);
 	if (ecdsaResolution.kind === "failed") return {
 		kind: "capability_subject_resolution_failed",
-		walletId: normalizedWalletId,
 		reason: ecdsaResolution.reason
 	};
 	for (const subject of ecdsaResolution.subjects) appendUniqueWalletUnlockSubject(subjects, subject);
@@ -266,8 +261,7 @@ async function resolveWalletCapabilitySubjectResolution(walletId) {
 	if (subjectResolution.kind === "missing_requested_capability_subject") return {
 		kind: "no_session_for_wallet",
 		walletId: resolvedWalletId,
-		reason: "missing_requested_capability_subject",
-		source
+		reason: "missing_requested_capability_subject"
 	};
 	if (subjectResolution.kind === "capability_subject_resolution_failed") return {
 		kind: "unresolvable",

package/dist/esm/SeamsWeb/operations/authMethods/emailOtp/addEmailOtp.js

@@ -6,9 +6,9 @@ import { redactCredentialExtensionOutputs } from "../../../../core/signingEngine
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { toError } from "../../../../shared-ts/src/utils/errors.js";
 import { computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
 import { copyWalletCustodyEcdsaContinuityToAuthMethod } from "../../../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js";
 import { createWalletAddAuthMethodIntent, requestAddAuthMethodEmailOtpChallenge } from "../../../../core/rpcClients/relayer/walletRegistration.js";
+import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
 import { passkeyCredentialIdB64uFromAuthentication, requirePasskeyPrfFirstB64u } from "../passkey/ecdsaBootstrap.js";
 import { resolveManagedRuntimeScopeBootstrap } from "../../../../core/config/managedRuntimeScope.js";
 import { collectEmailOtpRegistrationAuthority } from "./registrationAuthority.js";

package/dist/esm/SeamsWeb/operations/authMethods/emailOtp/googleEmailOtpWalletAuthFlow.js

@@ -137,10 +137,8 @@ function resolveSessionState(input) {
 		candidates: resolution?.offer?.candidates,
 		selectedCandidateId: resolution?.offer?.selectedCandidateId
 	}) : void 0;
-	const resolvedWalletId = offer ? selectedGoogleEmailOtpRegistrationCandidate(offer).walletId : walletId;
 	return {
-		idToken: input.idToken,
-		walletId: resolvedWalletId,
+		walletId: offer ? selectedGoogleEmailOtpRegistrationCandidate(offer).walletId : walletId,
 		...offer ? { offer } : {},
 		providerSubject: requireProviderSubject(input.resolution),
 		emailHint,
@@ -320,14 +318,12 @@ function startGoogleEmailOtpRegistrationPrewarm(deps) {
 async function beginGoogleEmailOtpWalletAuth(deps, input) {
 	let sessionState;
 	try {
-		const resolution = await resolveGoogleEmailOtpProviderForAuthFlow({
-			deps,
-			input
-		});
 		sessionState = resolveSessionState({
-			idToken: input.idToken,
 			authInput: input,
-			resolution
+			resolution: await resolveGoogleEmailOtpProviderForAuthFlow({
+				deps,
+				input
+			})
 		});
 		sessionState = await selectLinkedEmailOtpWalletAuth({
 			deps,

package/dist/esm/SeamsWeb/operations/authMethods/passkey/addPasskey.js

@@ -6,9 +6,9 @@ import { redactCredentialExtensionOutputs } from "../../../../core/signingEngine
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { toError } from "../../../../shared-ts/src/utils/errors.js";
 import { computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
 import { copyWalletCustodyEcdsaContinuityToAuthMethod } from "../../../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js";
 import { createWalletAddAuthMethodIntent, requestAddAuthMethodEmailOtpChallenge } from "../../../../core/rpcClients/relayer/walletRegistration.js";
+import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
 import { readUnlockedWalletEd25519ExportRootCapabilityV1 } from "../../../../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";
 import { passkeyCredentialIdB64uFromAuthentication, requirePasskeyPrfFirstB64u } from "./ecdsaBootstrap.js";
 import { resolveManagedRuntimeScopeBootstrap } from "../../../../core/config/managedRuntimeScope.js";

package/dist/esm/SeamsWeb/operations/authMethods/revokeAuthMethod.js

@@ -6,8 +6,8 @@ import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds
 import { redactCredentialExtensionOutputs } from "../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
 import { computeWalletAuthMethodRevokeOperationFingerprintV1, parseWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { toError } from "../../../shared-ts/src/utils/errors.js";
-import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { revokeWalletAuthMethod } from "../../../core/rpcClients/relayer/walletRegistration.js";
+import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { passkeyCredentialIdB64uFromAuthentication } from "./passkey/ecdsaBootstrap.js";
 import { requestEmailOtpChallenge } from "./emailOtp/challenge.js";
 //#region src/SeamsWeb/operations/authMethods/revokeAuthMethod.ts

package/dist/esm/SeamsWeb/operations/devices/deviceLinkingResume.js

@@ -187,10 +187,7 @@ async function replayPendingDeviceLinkingAcknowledgementsV1(input) {
 		await input.installation.clearPendingActivationAcknowledgementV1({ authorityId: acknowledgement.authorityId });
 		await input.installation.clearCommittedDeliveryResumeV1({ authorityId: acknowledgement.authorityId });
 	}
-	return {
-		kind: "replayed",
-		count: matchingAcknowledgements.length
-	};
+	return { kind: "replayed" };
 }
 function asPlainDeviceLinkingResumeRecord(value) {
 	return isPlainDeviceLinkingResumeRecord(value) ? value : null;

package/dist/esm/SeamsWeb/operations/devices/linkDeviceFlow.js

@@ -17,6 +17,7 @@ import { assertNeverEmailOtpTargetActivationState, assertNeverTargetCredentialAc
 //#region src/SeamsWeb/operations/devices/linkDeviceFlow.ts
 var LinkDeviceFlow = class {
 	constructor(options, ports, getAuthenticationContext = null) {
+		this.pendingActivationCompletion = null;
 		this.session = null;
 		this.keyMaterialHandle = null;
 		this.deliveryRecipientPublicKey65B64u = null;
@@ -217,7 +218,6 @@ var LinkDeviceFlow = class {
 	async resolveLinkIdentityV1(linkSessionId) {
 		const cached = this.targetCredentialRegistrationResult;
 		if (cached && cached.linkSessionId === linkSessionId) return {
-			walletId: cached.walletId,
 			enrollmentId: cached.enrollmentId,
 			deviceId: cached.deviceId
 		};
@@ -226,7 +226,6 @@ var LinkDeviceFlow = class {
 			deliveryRecipientPublicKey65B64u: this.requireDeliveryRecipientPublicKey65B64u()
 		});
 		return {
-			walletId: preparation.walletId,
 			enrollmentId: preparation.enrollmentId,
 			deviceId: preparation.deviceId
 		};
@@ -1008,15 +1007,6 @@ var LinkDeviceFlow = class {
 		const session = this.requireSessionV1();
 		const registration = this.targetCredentialRegistrationResult;
 		if (!registration || registration.walletId !== walletSession.walletId) throw new Error("linked-device activation identity is unavailable");
-		const activeSession = {
-			...session,
-			state: {
-				state: "active",
-				deviceId: state.deviceId,
-				authorityId: walletSession.authorityId,
-				activatedAtMs: walletSession.issuedAtMs
-			}
-		};
 		this.handledStates.add("provisioning");
 		this.handledStates.add("authority_pending_local_install");
 		this.handledStates.add("active");
@@ -1053,8 +1043,32 @@ var LinkDeviceFlow = class {
 			acknowledgedAtMs: Date.now()
 		};
 		await this.ports.authorityInstallation.persistPendingActivationAcknowledgementV1({ acknowledgement });
+		const completion = {
+			walletSession,
+			deviceId: state.deviceId,
+			runEpoch
+		};
+		this.pendingActivationCompletion = completion;
 		await this.sendActivationAcknowledgementV1(acknowledgement);
-		this.session = activeSession;
+		await this.completeAcknowledgedActivationV1(completion);
+	}
+	async completeAcknowledgedActivationV1(completion) {
+		this.assertCurrentRun(completion.runEpoch);
+		const { walletSession } = completion;
+		const session = this.requireSessionV1();
+		const registration = this.targetCredentialRegistrationResult;
+		const authenticationContext = this.getAuthenticationContext?.();
+		if (!registration || !authenticationContext) throw new Error("linked-device activation completion is unavailable");
+		this.session = {
+			linkSessionId: session.linkSessionId,
+			qrData: session.qrData,
+			state: {
+				state: "active",
+				deviceId: completion.deviceId,
+				authorityId: walletSession.authorityId,
+				activatedAtMs: walletSession.issuedAtMs
+			}
+		};
 		authenticationContext.signingEngine.setWalletAuthenticated(linkedDeviceWalletAuthenticationState(walletSession, registration));
 		await this.cleanupCompletedLocalResources();
 		logDevice2LinkingStageV1({
@@ -1227,12 +1241,22 @@ var LinkDeviceFlow = class {
 		if (!pending) return false;
 		const session = this.requireSessionV1();
 		if (pending.linkSessionId !== session.qrData.linkSessionId || pending.authorityId !== committed.authority.authorityId || pending.packageSetDigestB64u !== committed.packageSetDigestB64u) throw new Error("pending linked-device acknowledgement identity is inconsistent");
+		const completion = this.pendingActivationCompletion;
+		if (!completion || completion.walletSession.authorizationId !== pending.authorizationId) throw new Error("pending linked-device activation completion is unavailable");
 		await this.sendActivationAcknowledgementV1(pending);
+		await this.completeAcknowledgedActivationV1(completion);
 		return true;
 	}
 	async sendActivationAcknowledgementV1(acknowledgement) {
 		await this.closeSessionSubscriptionV1();
-		await this.requireAuthenticatedTransport().acknowledgeLocalAuthorityActivationV1({ acknowledgement });
+		const transport = this.requireAuthenticatedTransport();
+		const maximumAttempts = 3;
+		for (let attempt = 1; attempt <= maximumAttempts; attempt += 1) try {
+			await transport.acknowledgeLocalAuthorityActivationV1({ acknowledgement });
+			break;
+		} catch (error) {
+			if (classifyLinkedDeviceDeliveryFailureV1(error) || attempt === maximumAttempts) throw error;
+		}
 		await this.ports.authorityInstallation.clearPendingActivationAcknowledgementV1({ authorityId: acknowledgement.authorityId });
 		await this.ports.authorityInstallation.clearCommittedDeliveryResumeV1({ authorityId: acknowledgement.authorityId });
 	}
@@ -1288,6 +1312,7 @@ var LinkDeviceFlow = class {
 		}
 	}
 	clearRunActivationStateV1() {
+		this.pendingActivationCompletion = null;
 		this.clearTargetCredentialActivationState();
 		this.clearEmailOtpTargetActivationState();
 		this.resealedExportRoot = null;

package/dist/esm/SeamsWeb/operations/devices/scanDevice.js

@@ -379,6 +379,6 @@ async function waitForApprovalPollV1(attempt) {
 	await new Promise((resolve) => resolveApprovalPollV1(resolve, attempt));
 }
 //#endregion
-export { scanAndLinkDevice };
+export { scanAndLinkDevice, validateQrLinkedDeviceSessionPayloadV5 };
 
 //# sourceMappingURL=scanDevice.js.map

package/dist/esm/SeamsWeb/operations/near/signNEP413.js

@@ -1,6 +1,5 @@
 import { base64Encode } from "../../../shared-ts/src/utils/base64.js";
 import { SigningEventPhase } from "../../../core/types/sdkSentEvents.js";
-import "../../../shared-ts/src/utils/encoders.js";
 import { emitNearSigningEvent } from "./signingEventHelpers.js";
 import { resolveNearCommandSubject } from "./commandSubject.js";
 //#region src/SeamsWeb/operations/near/signNEP413.ts

package/dist/esm/SeamsWeb/operations/recovery/syncAccount.js

@@ -16,11 +16,11 @@ import { WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND } from "../../../core/indexedD
 import { replaceActiveWalletAuthorityEd25519MaterialActivationV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
 import { errorMessage } from "../../../shared-ts/src/utils/errors.js";
 import { walletSessionAuthorizations } from "../../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
-import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { nearEd25519YaoMaterialActivationFromMetadata } from "../../../core/signingEngine/session/material/nearEd25519YaoMaterialActivation.js";
 import { buildRecoveredWalletSessionState, parsePasskeyEd25519YaoSyncResponseV1, passkeyEd25519YaoLaneReferenceFromRecovery } from "../../../core/signingEngine/flows/recovery/passkeyEd25519YaoRecovery.js";
 import { persistPasskeyEd25519YaoSignerMaterialV1 } from "../../../core/signingEngine/session/passkey/ed25519YaoLocalMaterial.js";
 import { buildPasskeyEd25519RestoreMetadata, persistPasskeyEd25519YaoSessionForRefresh } from "../../../core/signingEngine/session/passkey/ed25519YaoSealedSession.js";
+import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { rememberPasskeyCustodySessionEnvelope } from "../../../core/signingEngine/session/passkey/passkeyCustodySessionCache.js";
 import { openOrRejoinWalletCustodyEd25519V1, openWalletCustodyEd25519ActiveClientV1, walletCustodyActivationFactsFromActiveClientMetadataV1, walletCustodyCacheEnvelopeFromRecordV1 } from "../../../core/signingEngine/walletCustody/openCustodyCache.js";
 import { joinCustodyWireFromEnvelopeRecord } from "../../../core/signingEngine/walletCustody/joinCustodyWire.js";
@@ -625,9 +625,7 @@ async function recoverPasskeyEd25519YaoForUnlockV1(input) {
 		return {
 			kind: "recovered",
 			recovery,
-			credential,
-			verifiedBinding,
-			ecdsaContinuity
+			verifiedBinding
 		};
 	} finally {
 		ownedFactorSecret.fill(0);

package/dist/esm/SeamsWeb/operations/recovery/walletRecovery.js

@@ -1,13 +1,12 @@
 import { parseEmailOtpChallengeId, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { sha256Bytes, sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
-import "../../../shared-ts/src/utils/encoders.js";
 import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
 import { decodeEmailOtpRecoveryKey } from "../../../shared-ts/src/utils/emailOtpRecoveryKey.js";
-import { parseRecoveryCodeReservationId } from "../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import "../../../shared-ts/src/wallet-recovery/recoveryCodes.js";
 import { buildEmailOtpEnvelopeFactor, buildPasskeyEnvelopeFactor } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
+import { parseRecoveryCodeReservationId } from "../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { finalizeWalletRecovery } from "../../../core/rpcClients/relayer/walletRecoveryFinalize.js";
 import { buildWalletRecoveryCeremonyCustodyJson, prepareWalletRecoveryWithCode } from "../../../core/rpcClients/relayer/walletRecoveryPrepare.js";