@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/SeamsWeb/operations/authMethods/emailOtp/registrationAuthority.js

@@ -1,62 +0,0 @@
-import { EMAIL_OTP_CHANNEL } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
-import { requestEmailOtpEnrollmentChallenge } from "./challenge.js";
-//#region src/SeamsWeb/operations/authMethods/emailOtp/registrationAuthority.ts
-function requireTrimmedField(value, label) {
-	const text = typeof value === "string" ? value.trim() : "";
-	if (!text) throw new Error(`${label} is required for Email OTP registration authority`);
-	return text;
-}
-async function collectEmailOtpRegistrationAuthority(args) {
-	const email = requireTrimmedField(args.authMethod.email, "email").toLowerCase();
-	const providerSubject = requireTrimmedField(args.authMethod.providerSubject, "providerSubject");
-	const relayUrl = requireTrimmedField(args.relayUrl, "relayUrl");
-	const walletId = requireTrimmedField(args.walletId, "walletId");
-	const registrationIntentDigestB64u = requireTrimmedField(args.registrationIntentDigestB64u, "registrationIntentDigestB64u");
-	if (args.authMethod.proofKind === "google_sso_registration") {
-		const registrationAttemptId = requireTrimmedField(args.authMethod.googleEmailOtpRegistrationAttemptId, "googleEmailOtpRegistrationAttemptId");
-		return {
-			kind: "email_otp",
-			proof: {
-				version: "email_otp_registration_proof_v1",
-				proofKind: "google_sso_registration",
-				providerSubject,
-				email,
-				googleEmailOtpRegistrationAttemptId: registrationAttemptId,
-				googleEmailOtpRegistrationOfferId: requireTrimmedField(args.authMethod.googleEmailOtpRegistrationOfferId, "googleEmailOtpRegistrationOfferId"),
-				googleEmailOtpRegistrationCandidateId: requireTrimmedField(args.authMethod.googleEmailOtpRegistrationCandidateId, "googleEmailOtpRegistrationCandidateId"),
-				registrationIntentDigestB64u
-			},
-			registrationAuthorityId: registrationAttemptId,
-			providerSubject,
-			email
-		};
-	}
-	const otpCode = requireTrimmedField(args.authMethod.otpCode, "otpCode");
-	const inputChallengeId = typeof args.authMethod.challengeId === "string" ? args.authMethod.challengeId.trim() : "";
-	const challenge = inputChallengeId ? null : await requestEmailOtpEnrollmentChallenge({
-		relayUrl,
-		walletId,
-		fetchImpl: args.fetchImpl
-	});
-	const challengeId = inputChallengeId || requireTrimmedField(challenge?.challengeId, "challengeId");
-	return {
-		kind: "email_otp",
-		proof: {
-			version: "email_otp_registration_proof_v1",
-			proofKind: "otp_challenge",
-			providerSubject,
-			email,
-			challengeId,
-			otpCode,
-			otpChannel: EMAIL_OTP_CHANNEL,
-			registrationIntentDigestB64u
-		},
-		registrationAuthorityId: challengeId,
-		providerSubject,
-		email
-	};
-}
-//#endregion
-export { collectEmailOtpRegistrationAuthority };
-
-//# sourceMappingURL=registrationAuthority.js.map

package/dist/esm/SeamsWeb/operations/authMethods/emailOtp/registrationOffer.js

@@ -1,69 +0,0 @@
-import { requireRecord, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-//#region src/SeamsWeb/operations/authMethods/emailOtp/registrationOffer.ts
-const OTP_ONLY_FORBIDDEN_FIELDS = [
-	"delivery",
-	"challengeId",
-	"otpCode",
-	"resend",
-	"webauthn",
-	"webauthnRegistration",
-	"webauthn_registration",
-	"authenticatorOptions",
-	"publicKey",
-	"passkey",
-	"passkeyPrfFirstB64u"
-];
-const SECRET_MATERIAL_FIELDS = [
-	"recoveryKeys",
-	"recoveryCodes",
-	"bootstrap",
-	"bootstrapMaterial",
-	"clientSecret32"
-];
-function requireTimestampMs(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive integer timestamp`);
-	return value;
-}
-function rejectFields(record, fields, label) {
-	const forbiddenField = fields.find((field) => Object.prototype.hasOwnProperty.call(record, field));
-	if (forbiddenField) throw new Error(`${label} must not include ${forbiddenField}`);
-}
-function parseOfferId(value) {
-	return requireTrimmedString(value, "offerId");
-}
-function parseCandidateId(value, label = "candidateId") {
-	return requireTrimmedString(value, label);
-}
-function parseCandidate(value) {
-	const record = requireRecord(value, "registration candidate");
-	rejectFields(record, OTP_ONLY_FORBIDDEN_FIELDS, "registration candidate");
-	rejectFields(record, SECRET_MATERIAL_FIELDS, "registration candidate");
-	return {
-		candidateId: parseCandidateId(record.candidateId),
-		walletId: walletIdFromString(requireTrimmedString(record.walletId, "candidate.walletId"))
-	};
-}
-function parseGoogleEmailOtpRegistrationOffer(value) {
-	const record = requireRecord(value, "Google Email OTP registration offer");
-	rejectFields(record, OTP_ONLY_FORBIDDEN_FIELDS, "Google Email OTP registration offer");
-	rejectFields(record, SECRET_MATERIAL_FIELDS, "Google Email OTP registration offer");
-	if (record.kind !== "google_email_otp_registration_offer_v1") throw new Error("registration offer kind must be google_email_otp_registration_offer_v1");
-	if (!Array.isArray(record.candidates) || record.candidates.length < 1) throw new Error("registration offer must include at least one candidate");
-	const candidates = record.candidates.map(parseCandidate);
-	const selectedCandidateId = parseCandidateId(record.selectedCandidateId, "selectedCandidateId");
-	if (!candidates.some((candidate) => candidate.candidateId === selectedCandidateId)) throw new Error("selectedCandidateId must refer to an offered candidate");
-	const [firstCandidate, ...remainingCandidates] = candidates;
-	return {
-		kind: "google_email_otp_registration_offer_v1",
-		offerId: parseOfferId(record.offerId),
-		expiresAtMs: requireTimestampMs(record.expiresAtMs, "expiresAtMs"),
-		emailHint: requireTrimmedString(record.emailHint, "emailHint"),
-		candidates: [firstCandidate, ...remainingCandidates],
-		selectedCandidateId
-	};
-}
-//#endregion
-export { parseGoogleEmailOtpRegistrationOffer };
-
-//# sourceMappingURL=registrationOffer.js.map

package/dist/esm/SeamsWeb/operations/authMethods/emailOtp/walletActivation.js

@@ -1,95 +0,0 @@
-import { toAccountId } from "../../../../core/types/accountIds.js";
-import { buildEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { isActiveRecoveredWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
-//#region src/SeamsWeb/operations/authMethods/emailOtp/walletActivation.ts
-async function persistVerifiedEmailOtpAuthorityAfterUnlock(args) {
-	const { authority, authMethod } = args.projection;
-	if (String(authority.walletId) !== args.walletId || String(authMethod.walletId) !== args.walletId || String(authMethod.walletAuthMethodId) !== args.walletAuthMethodId || String(authMethod.walletAuthorityId) !== String(authority.authorityId)) throw new Error("Verified Email OTP authority changed during wallet unlock");
-	switch (authority.provenance.kind) {
-		case "wallet_registration":
-			await IndexedDBManager.persistFoundingWalletAuthority({
-				authority,
-				authMethod
-			});
-			return;
-		case "wallet_recovery": {
-			if (!isActiveRecoveredWalletAuthorityV1(authority)) throw new Error("Recovered Email OTP authority provenance is invalid");
-			const local = await IndexedDBManager.resolveWalletAuthorityForMethod(args.walletId, args.walletAuthMethodId);
-			const mismatches = local.kind !== "resolved" ? [`resolution:${local.kind}`] : [
-				...String(local.authority.authorityId) !== String(authority.authorityId) ? ["authorityId"] : [],
-				...String(local.authority.authorityDigestB64u) !== String(authority.authorityDigestB64u) ? ["authorityDigest"] : [],
-				...local.authMethod.kind !== "email_otp" ? ["method.kind"] : [],
-				...local.authMethod.status !== "active" ? ["method.status"] : [],
-				...String(local.authMethod.walletAuthMethodId) !== String(authMethod.walletAuthMethodId) ? ["method.id"] : [],
-				...String(local.authMethod.walletAuthorityId) !== String(authMethod.walletAuthorityId) ? ["method.authorityId"] : [],
-				...local.authMethod.kind === "email_otp" && local.authMethod.emailHashHex !== authMethod.emailHashHex ? ["method.emailHash"] : []
-			];
-			if (mismatches.length > 0) throw new Error(`Verified recovered Email OTP authority is not installed on this device: ${mismatches.join(", ")}`);
-			return;
-		}
-		case "device_link": {
-			const local = await IndexedDBManager.resolveWalletAuthorityForMethod(args.walletId, args.walletAuthMethodId);
-			if (local.kind !== "resolved" || String(local.authority.authorityId) !== String(authority.authorityId) || String(local.authority.authorityDigestB64u) !== String(authority.authorityDigestB64u)) throw new Error("Verified linked Email OTP authority is not installed on this device");
-			return;
-		}
-	}
-	authority.provenance;
-}
-async function walletAuthAuthorityRefForVerifiedEmailOtpUnlock(args) {
-	const { authority, authMethod } = args.projection;
-	if (String(authority.walletId) !== args.walletId || String(authMethod.walletId) !== args.walletId || String(authMethod.walletAuthMethodId) !== args.walletAuthMethodId || String(authMethod.walletAuthorityId) !== String(authority.authorityId) || authMethod.emailHashHex !== args.emailHashHex) throw new Error("Verified Email OTP authority does not match the wallet unlock factor");
-	const base = buildEmailOtpWalletAuthAuthority({
-		walletId: args.walletId,
-		provider: args.providerSubject.startsWith("google:") ? "google" : "email",
-		providerUserId: args.providerSubject,
-		emailHashHex: args.emailHashHex
-	});
-	return await walletAuthAuthorityRef({ authority: {
-		walletId: base.walletId,
-		factor: base.factor,
-		verifier: base.verifier,
-		bindingId: authMethod.walletAuthMethodId
-	} });
-}
-function ignoreUserPreferenceReloadError() {}
-async function activateEmailOtpWalletAfterUnlock(deps, activation) {
-	switch (activation.kind) {
-		case "near_ed25519_wallet":
-			await deps.signingEngine.activateAuthenticatedWalletState({
-				walletId: activation.signer.account.wallet.walletId,
-				nearAccountId: toAccountId(activation.signer.account.nearAccountId),
-				signerSlot: activation.signer.signerSlot,
-				...deps.nearClient ? { nearClient: deps.nearClient } : {}
-			});
-			await deps.signingEngine.markSelectedEmailOtpWalletAuthorityUnlocked({
-				walletId: activation.signer.account.wallet.walletId,
-				walletAuthMethodId: activation.walletAuthMethodId
-			});
-			deps.signingEngine.setWalletAuthenticated({
-				kind: "authenticated",
-				walletId: activation.signer.account.wallet.walletId,
-				authMethod: "email_otp"
-			});
-			return;
-		case "evm_family_ecdsa_wallet": {
-			const preferences = deps.signingEngine.getUserPreferences();
-			preferences.setCurrentWallet(activation.walletId);
-			await preferences.reloadUserSettings().catch(ignoreUserPreferenceReloadError);
-			await deps.signingEngine.markSelectedEmailOtpWalletAuthorityUnlocked({
-				walletId: activation.walletId,
-				walletAuthMethodId: activation.walletAuthMethodId
-			});
-			deps.signingEngine.setWalletAuthenticated({
-				kind: "authenticated",
-				walletId: activation.walletId,
-				authMethod: "email_otp"
-			});
-			return;
-		}
-	}
-}
-//#endregion
-export { activateEmailOtpWalletAfterUnlock, persistVerifiedEmailOtpAuthorityAfterUnlock, walletAuthAuthorityRefForVerifiedEmailOtpUnlock };
-
-//# sourceMappingURL=walletActivation.js.map

package/dist/esm/SeamsWeb/operations/authMethods/passkey/addPasskey.js

@@ -1,260 +0,0 @@
-import { parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { requestWalletCustodyCeremonyOperation } from "../../../../core/signingEngine/walletCustody/ceremonyStepRunner.js";
-import { redactCredentialExtensionOutputs } from "../../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { toError } from "../../../../shared-ts/src/utils/errors.js";
-import { computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { copyWalletCustodyEcdsaContinuityToAuthMethod } from "../../../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js";
-import { createWalletAddAuthMethodIntent, requestAddAuthMethodEmailOtpChallenge } from "../../../../core/rpcClients/relayer/walletRegistration.js";
-import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
-import { readUnlockedWalletEd25519ExportRootCapabilityV1 } from "../../../../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";
-import { passkeyCredentialIdB64uFromAuthentication, requirePasskeyPrfFirstB64u } from "./ecdsaBootstrap.js";
-import { resolveManagedRuntimeScopeBootstrap } from "../../../../core/config/managedRuntimeScope.js";
-import { persistAddedCrossFamilyPasskeyV1, persistFinalizedPasskeyAuthMethodV1 } from "./localPasskeyProjection.js";
-import { linkWalletPasskeyCustody } from "../../../../core/signingEngine/walletCustody/passkeyLink.js";
-import { resolveAddAuthMethodSourceClaimV1 } from "../addAuthMethodSourceClaim.js";
-import { addAuthMethodSourcePasskeyAllowCredentials } from "../sourcePasskeyProof.js";
-//#region src/SeamsWeb/operations/authMethods/passkey/addPasskey.ts
-async function persistAddedPasskey(args) {
-	if (args.finalized.walletId !== args.walletId || args.finalized.rpId !== args.rpId || args.finalized.authMethod.kind !== "passkey" || args.finalized.authMethod.status !== "active") throw new Error("Wallet add-passkey finalize returned a mismatched auth method");
-	await persistFinalizedPasskeyAuthMethodV1({
-		walletId: args.finalized.walletId,
-		rpId: args.finalized.rpId,
-		credentialIdB64u: args.finalized.authMethod.credentialIdB64u,
-		credentialPublicKeyB64u: args.finalized.authMethod.credentialPublicKeyB64u,
-		counter: args.finalized.authMethod.counter
-	});
-	return {
-		ok: true,
-		walletId: args.finalized.walletId,
-		rpId: args.finalized.rpId,
-		walletAuthMethodId: args.walletAuthMethodId,
-		authMethod: {
-			kind: "passkey",
-			status: "active"
-		}
-	};
-}
-function walletCustodyWorkerTransport(context) {
-	const workerContext = context.signingEngine.getSignerWorkerContext();
-	return { requestOperation: requestWalletCustodyCeremonyOperation.bind(void 0, workerContext) };
-}
-async function addPasskeyWalletAuthMethodInternal(args) {
-	const relayerUrl = String(args.context.configs.network.relayer.url || "").trim();
-	if (!relayerUrl) throw new Error("registration.addPasskey requires relayer.url");
-	const managedRuntimeScope = resolveManagedRuntimeScopeBootstrap(args.context.configs);
-	if (!managedRuntimeScope) throw new Error("registration.addPasskey requires registration.publishableKey and registration.projectEnvironmentId");
-	const sourceClaim = await resolveAddAuthMethodSourceClaimV1(args.walletId);
-	if (sourceClaim.kind !== "resolved") throw new Error(`Wallet add-passkey requires a selected active source: ${sourceClaim.reason}`);
-	const intentResponse = await createWalletAddAuthMethodIntent({
-		relayerUrl,
-		walletId: args.walletId,
-		request: {
-			walletId: args.walletId,
-			rpId: args.rpId,
-			authMethod: {
-				kind: "passkey",
-				rpId: args.rpId
-			},
-			caller: {
-				caller: "same_device_addition",
-				source: sourceClaim.source
-			}
-		},
-		auth: {
-			publishableKey: managedRuntimeScope.publishableKey,
-			environmentId: managedRuntimeScope.projectEnvironmentId
-		}
-	});
-	if (await computeAddAuthMethodIntentDigestB64u(intentResponse.intent) !== intentResponse.addAuthMethodIntentDigestB64u) throw new Error("Add-auth-method intent digest mismatch");
-	if (intentResponse.intent.walletId !== args.walletId || intentResponse.intent.authMethod.kind !== "passkey" || intentResponse.intent.authMethod.rpId !== args.rpId) throw new Error("Add-auth-method intent identity changed");
-	const profile = await IndexedDBManager.getProfile(String(args.walletId));
-	if (!profile || !Number.isSafeInteger(profile.defaultSignerSlot) || profile.defaultSignerSlot < 1) throw new Error("Wallet add-passkey requires an initialized wallet profile");
-	if (sourceClaim.sourceAuthMethod.kind === "email_otp") return await addPasskeyFromEmailOtpSource({
-		context: args.context,
-		walletId: args.walletId,
-		rpId: args.rpId,
-		relayerUrl,
-		profile,
-		sourceWalletAuthorityId: sourceClaim.source.walletAuthorityId,
-		sourceWalletAuthMethodId: sourceClaim.source.walletAuthMethodId,
-		intentResponse,
-		...args.options ? { options: args.options } : {}
-	});
-	const allowCredentials = addAuthMethodSourcePasskeyAllowCredentials(sourceClaim.sourceAuthMethod);
-	const credential = await args.context.signingEngine.getAuthenticationCredentialsSerialized({
-		subjectId: String(args.walletId),
-		challengeB64u: intentResponse.addAuthMethodIntentDigestB64u,
-		allowCredentials,
-		includeSecondPrfOutput: false
-	});
-	const credentialIdB64u = passkeyCredentialIdB64uFromAuthentication(credential);
-	if (!credentialIdB64u || !allowCredentials.some((allowed) => allowed.id === credentialIdB64u)) throw new Error("Wallet add-passkey selected a credential outside the authorized wallet");
-	const existingFactorSecret = base64UrlDecode(requirePasskeyPrfFirstB64u(credential, "Wallet add-passkey custody linking"));
-	try {
-		const linked = await linkWalletPasskeyCustody({
-			relayerUrl,
-			walletId: args.walletId,
-			addAuthMethodIntentGrant: intentResponse.addAuthMethodIntentGrant,
-			addAuthMethodIntentDigestB64u: intentResponse.addAuthMethodIntentDigestB64u,
-			intent: intentResponse.intent,
-			auth: {
-				kind: "webauthn_assertion",
-				rpId: args.rpId,
-				credential: redactCredentialExtensionOutputs(credential),
-				expectedChallengeDigestB64u: intentResponse.addAuthMethodIntentDigestB64u
-			},
-			sealSource: {
-				kind: "factor_secret",
-				existingFactorSecret
-			},
-			walletAuthMethodId: intentResponse.intent.targetWalletAuthMethodId,
-			worker: walletCustodyWorkerTransport(args.context),
-			createRegistrationCredential: async (registration) => {
-				const confirmation = await args.context.signingEngine.requestRegistrationCredentialConfirmation({
-					walletId: String(args.walletId),
-					signerSlot: profile.defaultSignerSlot,
-					confirmerText: args.options?.confirmerText,
-					confirmationConfigOverride: args.options?.confirmationConfig,
-					registrationOptions: registration
-				});
-				if (!confirmation.confirmed) throw new Error("Wallet add-passkey registration was cancelled");
-				return confirmation.credential;
-			}
-		});
-		return await persistAddedPasskey({
-			walletId: args.walletId,
-			rpId: args.rpId,
-			walletAuthMethodId: intentResponse.intent.targetWalletAuthMethodId,
-			finalized: linked.finalized
-		});
-	} finally {
-		existingFactorSecret.fill(0);
-	}
-}
-/**
-* The `email_otp_to_passkey` addition branch.
-*
-* The Email OTP method that already unlocks this wallet authorizes adding a
-* passkey. Three things stay exactly as they are in the Passkey-source branch,
-* deliberately: the target method id comes from the same intent, the reseal and
-* finalize run through the same custody link, and the local installation is the
-* same projection. Only the source proof and the seed's door change.
-*
-* The Email source method and its Wallet Session stay selected — nothing here
-* re-selects, revokes, or re-mints them. Adding a way in does not change the
-* way you came in.
-*/
-async function addPasskeyFromEmailOtpSource(args) {
-	const capability = readUnlockedWalletEd25519ExportRootCapabilityV1(String(args.walletId));
-	if (!capability) throw new Error("Wallet add-passkey from an Email OTP source requires an unlocked wallet");
-	const sendSourceCode = async () => await requestAddAuthMethodEmailOtpChallenge({
-		relayerUrl: args.relayerUrl,
-		walletId: args.walletId,
-		addAuthMethodIntentGrant: args.intentResponse.addAuthMethodIntentGrant,
-		addAuthMethodIntentDigestB64u: args.intentResponse.addAuthMethodIntentDigestB64u
-	});
-	const sent = await sendSourceCode();
-	const confirmed = await args.context.signingEngine.requestEmailOtpEnrollmentConfirmation({
-		walletId: String(args.walletId),
-		emailAddress: sent.emailHint || "your email",
-		challengeId: sent.challengeId,
-		...sent.emailHint ? { emailHint: sent.emailHint } : {},
-		confirmerText: {
-			title: "Enter email code to add a passkey",
-			body: "This one-time code confirms you can add a new passkey to this wallet."
-		},
-		...args.options?.confirmationConfig ? { confirmationConfigOverride: args.options.confirmationConfig } : {},
-		onResend: sendSourceCode
-	});
-	const finalized = (await linkWalletPasskeyCustody({
-		relayerUrl: args.relayerUrl,
-		walletId: args.walletId,
-		addAuthMethodIntentGrant: args.intentResponse.addAuthMethodIntentGrant,
-		addAuthMethodIntentDigestB64u: args.intentResponse.addAuthMethodIntentDigestB64u,
-		intent: args.intentResponse.intent,
-		auth: {
-			kind: "email_otp",
-			challengeId: confirmed.challengeId,
-			otpCode: confirmed.otpCode,
-			expectedChallengeDigestB64u: args.intentResponse.addAuthMethodIntentDigestB64u
-		},
-		sealSource: {
-			kind: "unlocked_capability",
-			capability
-		},
-		walletAuthMethodId: args.intentResponse.intent.targetWalletAuthMethodId,
-		worker: walletCustodyWorkerTransport(args.context),
-		createRegistrationCredential: async (registration) => {
-			const confirmation = await args.context.signingEngine.requestRegistrationCredentialConfirmation({
-				walletId: String(args.walletId),
-				signerSlot: args.profile.defaultSignerSlot,
-				confirmerText: args.options?.confirmerText,
-				confirmationConfigOverride: args.options?.confirmationConfig,
-				registrationOptions: registration
-			});
-			if (!confirmation.confirmed) throw new Error("Wallet add-passkey registration was cancelled");
-			return confirmation.credential;
-		}
-	})).finalized;
-	if (finalized.walletId !== args.walletId || finalized.authMethod.kind !== "passkey" || finalized.authMethod.status !== "active") throw new Error("Wallet add-passkey finalize returned a mismatched auth method");
-	await persistAddedCrossFamilyPasskeyV1({
-		walletId: args.walletId,
-		walletAuthMethodId: args.intentResponse.intent.targetWalletAuthMethodId,
-		walletAuthorityId: args.sourceWalletAuthorityId,
-		rpId: String(args.rpId),
-		credentialIdB64u: finalized.authMethod.credentialIdB64u,
-		credentialPublicKeyB64u: finalized.authMethod.credentialPublicKeyB64u,
-		counter: finalized.authMethod.counter,
-		signerSlot: args.profile.defaultSignerSlot,
-		credential: {
-			id: finalized.authMethod.credentialIdB64u,
-			rawId: finalized.authMethod.credentialIdB64u
-		}
-	});
-	await copyWalletCustodyEcdsaContinuityToAuthMethod({
-		walletId: args.walletId,
-		walletAuthorityId: args.sourceWalletAuthorityId,
-		sourceWalletAuthMethodId: args.sourceWalletAuthMethodId,
-		targetAuthority: await walletAuthAuthorityRef({ authority: finalized.authority })
-	});
-	return {
-		ok: true,
-		walletId: args.walletId,
-		rpId: String(args.rpId),
-		walletAuthMethodId: args.intentResponse.intent.targetWalletAuthMethodId,
-		authMethod: {
-			kind: "passkey",
-			status: "active"
-		}
-	};
-}
-async function addPasskeyWalletAuthMethod(args) {
-	const walletId = walletIdFromString(String(args.walletId || "").trim());
-	const parsedRpId = parseWebAuthnRpId(String(args.rpId || "").trim());
-	if (!parsedRpId.ok) throw new Error(parsedRpId.error.message);
-	try {
-		const result = await addPasskeyWalletAuthMethodInternal({
-			context: args.context,
-			walletId,
-			rpId: parsedRpId.value,
-			options: args.options
-		});
-		await args.options?.afterCall?.(true, result);
-		return result;
-	} catch (error) {
-		const normalized = toError(error);
-		try {
-			args.options?.onError?.(normalized);
-		} finally {
-			await args.options?.afterCall?.(false);
-		}
-		throw normalized;
-	}
-}
-//#endregion
-export { addPasskeyWalletAuthMethod };
-
-//# sourceMappingURL=addPasskey.js.map

package/dist/esm/SeamsWeb/operations/authMethods/passkey/ecdsaBootstrap.js

@@ -1,17 +0,0 @@
-import { getPrfFirstB64uFromCredential } from "../../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
-//#region src/SeamsWeb/operations/authMethods/passkey/ecdsaBootstrap.ts
-function passkeyPrfFirstB64uFromCredential(credential) {
-	return String(getPrfFirstB64uFromCredential(credential) || "").trim();
-}
-function requirePasskeyPrfFirstB64u(credential, context) {
-	const prfFirstB64u = passkeyPrfFirstB64uFromCredential(credential);
-	if (!prfFirstB64u) throw new Error(`${context} requires PRF.first output from the passkey credential`);
-	return prfFirstB64u;
-}
-function passkeyCredentialIdB64uFromAuthentication(credential) {
-	return String(credential?.rawId || credential?.id || "").trim();
-}
-//#endregion
-export { passkeyCredentialIdB64uFromAuthentication, passkeyPrfFirstB64uFromCredential, requirePasskeyPrfFirstB64u };
-
-//# sourceMappingURL=ecdsaBootstrap.js.map

package/dist/esm/SeamsWeb/operations/authMethods/passkey/exactPasskeyAuthority.js

@@ -1,34 +0,0 @@
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
-//#region src/SeamsWeb/operations/authMethods/passkey/exactPasskeyAuthority.ts
-/**
-* The wallet's one active passkey method for this credential. The local
-* auth-method store is the one source that names a wallet's methods: a method
-* id derived from the credential is not the id the wallet registered it under.
-*/
-async function exactPasskeyWalletAuthMethodForCredential(args) {
-	const matches = (await IndexedDBManager.listWalletAuthMethodsV2ForWallet(String(args.walletId))).filter((record) => record.kind === "passkey" && record.status === "active" && record.walletId === args.walletId && String(record.rpId) === args.rpId && String(record.credentialIdB64u) === args.credentialIdB64u);
-	const [record] = matches;
-	if (matches.length !== 1 || !record) throw new Error("passkey authority requires one exact active V2 auth method");
-	return record;
-}
-/** The authority reference of the wallet's active passkey method for this credential. */
-async function exactPasskeyWalletAuthAuthorityRefForCredential(args) {
-	const record = await exactPasskeyWalletAuthMethodForCredential(args);
-	return await walletAuthAuthorityRef({ authority: {
-		walletId: record.walletId,
-		factor: {
-			kind: "passkey",
-			credentialIdB64u: record.credentialIdB64u
-		},
-		verifier: {
-			kind: "webauthn",
-			rpId: record.rpId
-		},
-		bindingId: record.walletAuthMethodId
-	} });
-}
-//#endregion
-export { exactPasskeyWalletAuthAuthorityRefForCredential, exactPasskeyWalletAuthMethodForCredential };
-
-//# sourceMappingURL=exactPasskeyAuthority.js.map

package/dist/esm/SeamsWeb/operations/authMethods/passkey/localUnlock.js

@@ -1,16 +0,0 @@
-import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-//#region src/SeamsWeb/operations/authMethods/passkey/localUnlock.ts
-function createLocalUnlockChallengeB64u() {
-	if (typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function") throw new Error("Secure random is unavailable for passkey wallet unlock");
-	const challenge = new Uint8Array(32);
-	crypto.getRandomValues(challenge);
-	return base64UrlEncode(challenge);
-}
-async function collectFreshLocalPasskeyUnlockCredential(args) {
-	if (args.currentCredential) return void 0;
-	return await args.collectCredentialForChallenge(createLocalUnlockChallengeB64u());
-}
-//#endregion
-export { collectFreshLocalPasskeyUnlockCredential, createLocalUnlockChallengeB64u };
-
-//# sourceMappingURL=localUnlock.js.map

package/dist/esm/SeamsWeb/operations/authMethods/passkey/loginAssertion.js

@@ -1,25 +0,0 @@
-//#region src/SeamsWeb/operations/authMethods/passkey/loginAssertion.ts
-async function collectPasskeyLoginAssertion(args) {
-	const allowCredentials = args.authenticators.map((authenticator) => {
-		const id = String(authenticator.credentialId || "").trim();
-		if (!id) return null;
-		return {
-			id,
-			type: "public-key",
-			transports: Array.isArray(authenticator.transports) ? authenticator.transports : []
-		};
-	}).filter((credential) => Boolean(credential));
-	args.onPromptStarted();
-	const credential = await args.signingEngine.getAuthenticationCredentialsSerialized({
-		subjectId: args.subjectId,
-		challengeB64u: args.challengeB64u,
-		allowCredentials,
-		includeSecondPrfOutput: false
-	});
-	args.onPromptSucceeded();
-	return credential;
-}
-//#endregion
-export { collectPasskeyLoginAssertion };
-
-//# sourceMappingURL=loginAssertion.js.map

package/dist/esm/SeamsWeb/operations/authMethods/passkey/registrationAuthority.js

@@ -1,84 +0,0 @@
-import { redactedPasskeyRegistrationCredential } from "../../../../core/signingEngine/webauthnAuth/credentials/helpers.js";
-import { requirePasskeyPrfFirstB64u } from "./ecdsaBootstrap.js";
-//#region src/SeamsWeb/operations/authMethods/passkey/registrationAuthority.ts
-function roundDurationMs(startedAt) {
-	return Math.max(0, Math.round(performance.now() - startedAt));
-}
-function zeroRegistrationConfirmationDiagnostics() {
-	return {
-		kind: "registration_confirmation_diagnostics_v1",
-		workerReadyMs: 0,
-		workerRequestRoundTripMs: 0,
-		workerResponseValidationMs: 0,
-		requestSetupMs: 0,
-		promptUserMs: 0,
-		promptElementDefineMs: 0,
-		promptMountMs: 0,
-		promptHostFirstUpdateMs: 0,
-		promptHostInteractiveMs: 0,
-		promptConfirmEventMs: 0,
-		promptDecisionWaitMs: 0,
-		credentialCreateStartMs: 0,
-		credentialCreateMs: 0,
-		credentialSerializeMs: 0,
-		duplicateRetryCount: 0,
-		mainThreadTotalMs: 0
-	};
-}
-function buildPasskeyRegistrationAuthorityMaterial(args) {
-	const prfExtractionStartedAt = performance.now();
-	const prfFirstB64u = requirePasskeyPrfFirstB64u(args.credential, "Passkey registration authority");
-	const prfExtractionMs = roundDurationMs(prfExtractionStartedAt);
-	const credentialRedactionStartedAt = performance.now();
-	const webauthnRegistration = redactedPasskeyRegistrationCredential(args.credential);
-	const credentialRedactionMs = roundDurationMs(credentialRedactionStartedAt);
-	return {
-		kind: "passkey",
-		credential: args.credential,
-		webauthnRegistration,
-		prfFirstB64u,
-		diagnostics: {
-			kind: "passkey_registration_authority_diagnostics_v1",
-			requestConfirmationMs: args.requestConfirmationMs,
-			prfExtractionMs,
-			credentialRedactionMs,
-			confirmationWorkerReadyMs: args.diagnostics.workerReadyMs,
-			confirmationWorkerRequestRoundTripMs: args.diagnostics.workerRequestRoundTripMs,
-			confirmationWorkerResponseValidationMs: args.diagnostics.workerResponseValidationMs,
-			confirmationRequestSetupMs: args.diagnostics.requestSetupMs,
-			confirmationPromptUserMs: args.diagnostics.promptUserMs,
-			confirmationPromptElementDefineMs: args.diagnostics.promptElementDefineMs,
-			confirmationPromptMountMs: args.diagnostics.promptMountMs,
-			confirmationPromptHostFirstUpdateMs: args.diagnostics.promptHostFirstUpdateMs,
-			confirmationPromptHostInteractiveMs: args.diagnostics.promptHostInteractiveMs,
-			confirmationPromptConfirmEventMs: args.diagnostics.promptConfirmEventMs,
-			confirmationPromptDecisionWaitMs: args.diagnostics.promptDecisionWaitMs,
-			confirmationCredentialCreateStartMs: args.diagnostics.credentialCreateStartMs,
-			confirmationCredentialCreateMs: args.diagnostics.credentialCreateMs,
-			confirmationCredentialSerializeMs: args.diagnostics.credentialSerializeMs,
-			confirmationDuplicateRetryCount: args.diagnostics.duplicateRetryCount,
-			confirmationMainThreadTotalMs: args.diagnostics.mainThreadTotalMs
-		}
-	};
-}
-async function collectPasskeyRegistrationAuthority(args) {
-	const requestConfirmationStartedAt = performance.now();
-	const registrationSession = await args.context.signingEngine.requestRegistrationCredentialConfirmation({
-		walletId: args.walletId,
-		signerSlot: args.signerSlot,
-		confirmerText: args.options.confirmerText,
-		confirmationConfigOverride: args.confirmationConfigOverride,
-		challengeB64u: args.registrationIntentDigestB64u
-	});
-	const requestConfirmationMs = roundDurationMs(requestConfirmationStartedAt);
-	const confirmationDiagnostics = registrationSession.registrationDiagnostics ?? zeroRegistrationConfirmationDiagnostics();
-	return buildPasskeyRegistrationAuthorityMaterial({
-		credential: registrationSession.credential,
-		diagnostics: confirmationDiagnostics,
-		requestConfirmationMs
-	});
-}
-//#endregion
-export { collectPasskeyRegistrationAuthority };
-
-//# sourceMappingURL=registrationAuthority.js.map