{"prompt":"You are comparing an AI-suggested code fix with actual changes made in a commit.\n\nYour task: Determine if the commit contains the essence of the AI fix and provide a confidence level.\n\n## AI-Suggested Fix\n\n**What it fixes:** @forgerock/journey-suites:e2e-ci--src/no-session.test.ts\n\n**Description:** fix(journey-app): restore Complete heading and Session Token log\n\n**Reasoning:** The PR rewrote `renderComplete()` in `e2e/journey-app/main.ts` from an `innerHTML` template to imperative DOM construction in order to add the WebAuthn device-management buttons. During that rewrite, two things were omitted:\n\n1. **The \"Complete\" heading** (`

Complete

`) — `no-session.test.ts` waits for `getByText('Complete')` to become visible after login to confirm the journey finished successfully. Without this element the assertion times out.\n\n2. **The `console.log`\n\n**Suggested Changes (diff):**\n```diff\ndiff --git a/e2e/journey-app/main.ts b/e2e/journey-app/main.ts\nindex 6fc75452e..51599757a 100644\n--- a/e2e/journey-app/main.ts\n+++ b/e2e/journey-app/main.ts\n@@ -153,8 +153,15 @@ if (searchParams.get('middleware') === 'true') {\n \n const session = step.getSessionToken();\n \n+ console.log(`Session Token: ${session || 'none'}`);\n+\n journeyEl.replaceChildren();\n \n+ const completeHeader = document.createElement('h2');\n+ completeHeader.id = 'completeHeader';\n+ completeHeader.innerText = 'Complete';\n+ journeyEl.appendChild(completeHeader);\n+\n renderDeleteDevicesSection(\n journeyEl,\n () => storeDevicesBeforeSession(config),\n\n```\n\n## Actual Commit Changes\n\n**Commit Diff:**\n```diff\ndiff --git a/e2e/journey-app/components/webauthn-devices.ts b/e2e/journey-app/components/webauthn-devices.ts\nnew file mode 100644\nindex 0000000000..91029ffb3d\n--- /dev/null\n+++ b/e2e/journey-app/components/webauthn-devices.ts\n@@ -0,0 +1,77 @@\n+/*\n+ * Copyright (c) 2026 Ping Identity Corporation. All rights reserved.\n+ *\n+ * This software may be modified and distributed under the terms\n+ * of the MIT license. See the LICENSE file for details.\n+ */\n+\n+export function renderDeleteDevicesSection(\n+ journeyEl: HTMLDivElement,\n+ storeDevicesBeforeSession: () => Promise,\n+ deleteDevicesInSession: () => Promise,\n+ deleteAllDevices: () => Promise,\n+): void {\n+ const getDevicesButton = document.createElement('button');\n+ getDevicesButton.type = 'button';\n+ getDevicesButton.id = 'getDevicesButton';\n+ getDevicesButton.innerText = 'Get Registered Devices';\n+\n+ const deleteDevicesButton = document.createElement('button');\n+ deleteDevicesButton.type = 'button';\n+ deleteDevicesButton.id = 'deleteDevicesButton';\n+ deleteDevicesButton.innerText = 'Delete Devices From This Session';\n+\n+ const deleteAllDevicesButton = document.createElement('button');\n+ deleteAllDevicesButton.type = 'button';\n+ deleteAllDevicesButton.id = 'deleteAllDevicesButton';\n+ deleteAllDevicesButton.innerText = 'Delete All Registered Devices';\n+\n+ const deviceStatus = document.createElement('pre');\n+ deviceStatus.id = 'deviceStatus';\n+ deviceStatus.style.minHeight = '1.5em';\n+\n+ journeyEl.appendChild(getDevicesButton);\n+ journeyEl.appendChild(deleteDevicesButton);\n+ journeyEl.appendChild(deleteAllDevicesButton);\n+ journeyEl.appendChild(deviceStatus);\n+\n+ async function setDeviceStatus(\n+ progressStatus: string,\n+ action: () => Promise,\n+ errorPrefix: string,\n+ ): Promise {\n+ try {\n+ deviceStatus.innerText = progressStatus;\n+\n+ const successMessage = await action();\n+ deviceStatus.innerText = successMessage;\n+ } catch (error) {\n+ const message = error instanceof Error ? error.message : String(error);\n+ deviceStatus.innerText = `${errorPrefix}: ${message}`;\n+ }\n+ }\n+\n+ getDevicesButton.addEventListener('click', async () => {\n+ await setDeviceStatus(\n+ 'Retrieving existing WebAuthn devices...',\n+ storeDevicesBeforeSession,\n+ 'Get existing devices failed',\n+ );\n+ });\n+\n+ deleteDevicesButton.addEventListener('click', async () => {\n+ await setDeviceStatus(\n+ 'Deleting WebAuthn devices in this session...',\n+ deleteDevicesInSession,\n+ 'Delete failed',\n+ );\n+ });\n+\n+ deleteAllDevicesButton.addEventListener('click', async () => {\n+ await setDeviceStatus(\n+ 'Deleting all registered WebAuthn devices...',\n+ deleteAllDevices,\n+ 'Delete failed',\n+ );\n+ });\n+}\ndiff --git a/e2e/journey-app/components/webauthn.ts b/e2e/journey-app/components/webauthn.ts\nnew file mode 100644\nindex 0000000000..0586947e4a\n--- /dev/null\n+++ b/e2e/journey-app/components/webauthn.ts\n@@ -0,0 +1,40 @@\n+/*\n+ * Copyright (c) 2026 Ping Identity Corporation. All rights reserved.\n+ *\n+ * This software may be modified and distributed under the terms\n+ * of the MIT license. See the LICENSE file for details.\n+ */\n+\n+import { JourneyStep } from '@forgerock/journey-client/types';\n+import { WebAuthn, WebAuthnStepType } from '@forgerock/journey-client/webauthn';\n+\n+export function webauthnComponent(journeyEl: HTMLDivElement, step: JourneyStep, idx: number) {\n+ const container = document.createElement('div');\n+ container.id = `webauthn-container-${idx}`;\n+ const info = document.createElement('p');\n+ info.innerText = 'Please complete the WebAuthn challenge using your authenticator.';\n+ container.appendChild(info);\n+ journeyEl.appendChild(container);\n+\n+ const webAuthnStepType = WebAuthn.getWebAuthnStepType(step);\n+\n+ async function handleWebAuthn(): Promise {\n+ try {\n+ if (webAuthnStepType === WebAuthnStepType.Authentication) {\n+ console.log('trying authentication');\n+ await WebAuthn.authenticate(step);\n+ return true;\n+ } else if (WebAuthnStepType.Registration === webAuthnStepType) {\n+ console.log('trying registration');\n+ await WebAuthn.register(step);\n+ return true;\n+ } else {\n+ return false;\n+ }\n+ } catch {\n+ return false;\n+ }\n+ }\n+\n+ return handleWebAuthn();\n+}\ndiff --git a/e2e/journey-app/main.ts b/e2e/journey-app/main.ts\nindex b78f814df3..6fc75452ec 100644\n--- a/e2e/journey-app/main.ts\n+++ b/e2e/journey-app/main.ts\n@@ -1,5 +1,5 @@\n /*\n- * Copyright (c) 2025 Ping Identity Corporation. All rights reserved.\n+ * Copyright (c) 2025-2026 Ping Identity Corporation. All rights reserved.\n *\n * This software may be modified and distributed under the terms\n * of the MIT license. See the LICENSE file for details.\n@@ -7,12 +7,24 @@\n import './style.css';\n \n import { journey } from '@forgerock/journey-client';\n+import { WebAuthn, WebAuthnStepType } from '@forgerock/journey-client/webauthn';\n \n-import type { JourneyClient, RequestMiddleware } from '@forgerock/journey-client/types';\n+import type {\n+ JourneyClient,\n+ JourneyClientConfig,\n+ RequestMiddleware,\n+} from '@forgerock/journey-client/types';\n \n import { renderCallbacks } from './callback-map.js';\n+import { renderDeleteDevicesSection } from './components/webauthn-devices.js';\n import { renderQRCodeStep } from './components/qr-code.js';\n import { renderRecoveryCodesStep } from './components/recovery-codes.js';\n+import {\n+ deleteAllDevices,\n+ deleteDevicesInSession,\n+ storeDevicesBeforeSession,\n+} from './services/delete-webauthn-devices.js';\n+import { webauthnComponent } from './components/webauthn.js';\n import { serverConfigs } from './server-configs.js';\n \n const qs = window.location.search;\n@@ -61,7 +73,12 @@ if (searchParams.get('middleware') === 'true') {\n \n let journeyClient: JourneyClient;\n try {\n- journeyClient = await journey({ config: config, requestMiddleware });\n+ const journeyConfig: JourneyClientConfig = {\n+ serverConfig: {\n+ wellknown: config.serverConfig.wellknown,\n+ },\n+ };\n+ journeyClient = await journey({ config: journeyConfig, requestMiddleware });\n } catch (error) {\n const message = error instanceof Error ? error.message : 'Unknown error';\n console.error('Failed to initialize journey client:', message);\n@@ -70,34 +87,6 @@ if (searchParams.get('middleware') === 'true') {\n }\n let step = await journeyClient.start({ journey: journeyName });\n \n- function renderComplete() {\n- if (step?.type !== 'LoginSuccess') {\n- throw new Error('Expected step to be defined and of type LoginSuccess');\n- }\n-\n- const session = step.getSessionToken();\n-\n- console.log(`Session Token: ${session || 'none'}`);\n-\n- journeyEl.innerHTML = `\n-

Complete

\n- Session:\n-

${session}

\n- \n- `;\n-\n- const loginBtn = document.getElementById('logoutButton') as HTMLButtonElement;\n- loginBtn.addEventListener('click', async () => {\n- await journeyClient.terminate();\n-\n- console.log('Logout successful');\n-\n- step = await journeyClient.start({ journey: journeyName });\n-\n- renderForm();\n- });\n- }\n-\n function renderError() {\n if (step?.type !== 'LoginFailure') {\n throw new Error('Expected step to be defined and of type LoginFailure');\n@@ -134,6 +123,18 @@ if (searchParams.get('middleware') === 'true') {\n renderQRCodeStep(journeyEl, step) || renderRecoveryCodesStep(journeyEl, step);\n \n if (!stepRendered) {\n+ const webAuthnStep = WebAuthn.getWebAuthnStepType(step);\n+ const isWebAuthn =\n+ webAuthnStep === WebAuthnStepType.Authentication ||\n+ webAuthnStep === WebAuthnStepType.Registration;\n+ if (isWebAuthn) {\n+ const webauthnSucceeded = await webauthnComponent(journeyEl, step, 0);\n+ if (webauthnSucceeded) {\n+ submitForm();\n+ }\n+ return; // prevent the rest of the function from running\n+ }\n+\n const callbacks = step.callbacks;\n renderCallbacks(journeyEl, callbacks, submitForm);\n }\n@@ -145,6 +146,50 @@ if (searchParams.get('middleware') === 'true') {\n journeyEl.appendChild(submitBtn);\n }\n \n+ function renderComplete() {\n+ if (step?.type !== 'LoginSuccess') {\n+ throw new Error('Expected step to be defined and of type LoginSuccess');\n+ }\n+\n+ const session = step.getSessionToken();\n+\n+ journeyEl.replaceChildren();\n+\n+ renderDeleteDevicesSection(\n+ journeyEl,\n+ () => storeDevicesBeforeSession(config),\n+ () => deleteDevicesInSession(config),\n+ () => deleteAllDevices(config),\n+ );\n+\n+ const sessionLabelEl = document.createElement('span');\n+ sessionLabelEl.id = 'sessionLabel';\n+ sessionLabelEl.innerText = 'Session:';\n+\n+ const sessionTokenEl = document.createElement('pre');\n+ sessionTokenEl.id = 'sessionToken';\n+ sessionTokenEl.textContent = session || 'none';\n+\n+ const logoutBtn = document.createElement('button');\n+ logoutBtn.type = 'button';\n+ logoutBtn.id = 'logoutButton';\n+ logoutBtn.innerText = 'Logout';\n+\n+ journeyEl.appendChild(sessionLabelEl);\n+ journeyEl.appendChild(sessionTokenEl);\n+ journeyEl.appendChild(logoutBtn);\n+\n+ logoutBtn.addEventListener('click', async () => {\n+ await journeyClient.terminate();\n+\n+ console.log('Logout successful');\n+\n+ step = await journeyClient.start({ journey: journeyName });\n+\n+ renderForm();\n+ });\n+ }\n+\n formEl.addEventListener('submit', async (event) => {\n event.preventDefault();\n \ndiff --git a/e2e/journey-app/package.json b/e2e/journey-app/package.json\nindex 40a825314b..7cc9e67485 100644\n--- a/e2e/journey-app/package.json\n+++ b/e2e/journey-app/package.json\n@@ -14,7 +14,8 @@\n \"@forgerock/journey-client\": \"workspace:*\",\n \"@forgerock/oidc-client\": \"workspace:*\",\n \"@forgerock/protect\": \"workspace:*\",\n- \"@forgerock/sdk-logger\": \"workspace:*\"\n+ \"@forgerock/sdk-logger\": \"workspace:*\",\n+ \"@forgerock/device-client\": \"workspace:*\"\n },\n \"nx\": {\n \"tags\": [\"scope:e2e\"]\ndiff --git a/e2e/journey-app/server-configs.ts b/e2e/journey-app/server-configs.ts\nindex 1e388f32be..3024d66280 100644\n--- a/e2e/journey-app/server-configs.ts\n+++ b/e2e/journey-app/server-configs.ts\n@@ -4,7 +4,7 @@\n * This software may be modified and distributed under the terms\n * of the MIT license. See the LICENSE file for details.\n */\n-import type { JourneyClientConfig } from '@forgerock/journey-client/types';\n+import type { OidcConfig } from '@forgerock/oidc-client/types';\n \n /**\n * Server configurations for E2E tests.\n@@ -12,16 +12,24 @@ import type { JourneyClientConfig } from '@forgerock/journey-client/types';\n * All configuration (baseUrl, authenticate/sessions paths) is automatically\n * derived from the well-known response via `convertWellknown()`.\n */\n-export const serverConfigs: Record = {\n+export const serverConfigs: Record = {\n basic: {\n+ clientId: 'WebOAuthClient',\n+ redirectUri: '',\n+ scope: 'openid profile email',\n serverConfig: {\n wellknown: 'http://localhost:9443/am/oauth2/realms/root/.well-known/openid-configuration',\n },\n+ responseType: 'code',\n },\n tenant: {\n+ clientId: 'WebOAuthClient',\n+ redirectUri: '',\n+ scope: 'openid profile email',\n serverConfig: {\n wellknown:\n 'https://openam-sdks.forgeblocks.com/am/oauth2/realms/root/realms/alpha/.well-known/openid-configuration',\n },\n+ responseType: 'code',\n },\n };\ndiff --git a/e2e/journey-app/services/delete-webauthn-devices.ts b/e2e/journey-app/services/delete-webauthn-devices.ts\nnew file mode 100644\nindex 0000000000..315ec1e2ca\n--- /dev/null\n+++ b/e2e/journey-app/services/delete-webauthn-devices.ts\n@@ -0,0 +1,306 @@\n+/*\n+ * Copyright (c) 2026 Ping Identity Corporation. All rights reserved.\n+ *\n+ * This software may be modified and distributed under the terms\n+ * of the MIT license. See the LICENSE file for details.\n+ */\n+\n+import { deviceClient } from '@forgerock/device-client';\n+import { oidc } from '@forgerock/oidc-client';\n+\n+import type { WebAuthnDevice, DeviceClient } from '@forgerock/device-client/types';\n+import type {\n+ GenericError,\n+ OauthTokens,\n+ OidcClient,\n+ OidcConfig,\n+ UserInfoResponse,\n+} from '@forgerock/oidc-client/types';\n+\n+const WEBAUTHN_DEVICES_KEY = 'journey-app:webauthn-device-uuids';\n+\n+/**\n+ * Reads the stored WebAuthn device UUIDs from `localStorage`.\n+ *\n+ * @returns A `Set` of UUID strings when present; otherwise `null`.\n+ * @throws When the stored value exists but is not a JSON array.\n+ */\n+function getStoredDevices(): Set | null {\n+ const retrievedDevices = window.localStorage.getItem(WEBAUTHN_DEVICES_KEY);\n+ if (!retrievedDevices) {\n+ return null;\n+ }\n+\n+ const parsedDevices = JSON.parse(retrievedDevices) as unknown;\n+ if (!Array.isArray(parsedDevices)) {\n+ throw new Error('Invalid data in localStorage');\n+ }\n+\n+ return new Set(\n+ parsedDevices.filter((value): value is string => typeof value === 'string' && value.length > 0),\n+ );\n+}\n+\n+/**\n+ * Creates a redirect URI for OIDC based on the current page origin and path.\n+ *\n+ * Note: This intentionally excludes query parameters so temporary values like\n+ * `code` and `state` can be removed cleanly after token exchange.\n+ *\n+ * @returns The redirect URI string (origin + pathname).\n+ */\n+function getRedirectUri() {\n+ const currentUrl = new URL(window.location.href);\n+ return `${currentUrl.origin}${currentUrl.pathname}`;\n+}\n+\n+/**\n+ * Derive the realm value used by device-client endpoints from a well-known URL.\n+ *\n+ * @param wellknown The OIDC well-known URL.\n+ * @returns The derived realm path to use with device-client (defaults to `root`).\n+ */\n+function getRealmPathFromWellknown(wellknown: string): string {\n+ const pathname = new URL(wellknown).pathname;\n+ const match = pathname.match(/\\/realms\\/([^/]+)\\/\\.well-known\\/openid-configuration\\/?$/);\n+ return match?.[1] ?? 'root';\n+}\n+\n+/**\n+ * Derives the AM base URL from an OIDC well-known URL.\n+ *\n+ * Example: `https://example.com/am/oauth2/alpha/.well-known/openid-configuration`\n+ * becomes `https://example.com/am`.\n+ *\n+ * @param wellknown The OIDC well-known URL.\n+ * @returns The base URL for AM (origin + path prefix before `/oauth2/`).\n+ */\n+function getBaseUrlFromWellknown(wellknown: string): string {\n+ const parsed = new URL(wellknown);\n+ const [pathWithoutOauth] = parsed.pathname.split('/oauth2/');\n+ return `${parsed.origin}${pathWithoutOauth}`;\n+}\n+\n+/**\n+ * Type guard to detect error-shaped responses returned by SDK helpers.\n+ *\n+ * @param value The unknown value to inspect.\n+ * @returns `true` when the object contains an `error` property.\n+ */\n+function hasError(value: unknown): value is { error: string } {\n+ return Boolean(value && typeof value === 'object' && 'error' in value);\n+}\n+\n+/**\n+ * Retrieves usable OIDC tokens for the current browser session.\n+ *\n+ * This will:\n+ * - exchange an authorization code (`code` + `state`) when present in the URL\n+ * - otherwise retrieve/renew tokens via the OIDC client\n+ * - redirect the browser when the token API returns a `redirectUrl`\n+ *\n+ * @param oidcClient An initialized OIDC client instance.\n+ * @param config OIDC configuration used to initiate the authorization flow.\n+ * @returns Tokens on success; otherwise an `{ error }` object.\n+ */\n+async function getOidcTokens(\n+ oidcClient: OidcClient,\n+ config: OidcConfig,\n+): Promise {\n+ if (hasError(oidcClient)) {\n+ return { error: oidcClient.error };\n+ }\n+\n+ const searchParams = new URLSearchParams(window.location.search);\n+ const code = searchParams.get('code');\n+ const state = searchParams.get('state');\n+\n+ if (code && state) {\n+ const exchanged = await oidcClient.token.exchange(code, state);\n+ if (hasError(exchanged)) {\n+ return { error: exchanged.error };\n+ }\n+\n+ const cleanedUrl = new URL(window.location.href);\n+ cleanedUrl.searchParams.delete('code');\n+ cleanedUrl.searchParams.delete('state');\n+ window.history.replaceState({}, document.title, cleanedUrl.toString());\n+\n+ return exchanged;\n+ }\n+\n+ const tokens = await oidcClient.token.get({\n+ backgroundRenew: true,\n+ authorizeOptions: {\n+ clientId: config.clientId,\n+ redirectUri: getRedirectUri(),\n+ scope: config.scope,\n+ responseType: config.responseType ?? 'code',\n+ responseMode: 'query',\n+ },\n+ });\n+\n+ if (hasError(tokens)) {\n+ if ('redirectUrl' in tokens && typeof tokens.redirectUrl === 'string') {\n+ window.location.assign(tokens.redirectUrl);\n+ }\n+ return { error: tokens.error };\n+ }\n+\n+ return tokens;\n+}\n+\n+/**\n+ * Retrieves the UUID (`sub`) for the currently authenticated user.\n+ *\n+ * @param oidcClient An initialized OIDC client instance.\n+ * @returns The user UUID string on success; otherwise an `{ error }` object.\n+ */\n+async function getCurrentUserUuid(oidcClient: OidcClient): Promise {\n+ if (hasError(oidcClient)) {\n+ return { error: oidcClient.error };\n+ }\n+\n+ const userInfo = (await oidcClient.user.info()) as GenericError | UserInfoResponse;\n+\n+ if (hasError(userInfo)) {\n+ return { error: userInfo.error };\n+ }\n+\n+ return userInfo.sub;\n+}\n+\n+/**\n+ * Fetches the current user's WebAuthn devices using the device-client SDK.\n+ *\n+ * @param config OIDC configuration used to initialize the OIDC client.\n+ * @returns The user UUID, resolved realm, a configured device-client instance, and the devices list.\n+ * @throws When token retrieval fails or device retrieval returns an error shape.\n+ */\n+async function getWebAuthnDevicesForCurrentUser(config: OidcConfig): Promise<{\n+ userId: string;\n+ realm: string;\n+ webAuthnClient: DeviceClient;\n+ devices: WebAuthnDevice[];\n+}> {\n+ config.redirectUri = getRedirectUri();\n+ const oidcClient = await oidc({ config });\n+ const tokens = await getOidcTokens(oidcClient, config);\n+\n+ if (hasError(tokens)) {\n+ throw new Error(`OIDC token retrieval failed: ${String(tokens.error)}`);\n+ }\n+\n+ const userId = await getCurrentUserUuid(oidcClient);\n+ if (typeof userId !== 'string') {\n+ throw new Error(`Failed to retrieve user UUID: ${String(userId.error)}`);\n+ }\n+\n+ const wellknown = config.serverConfig.wellknown;\n+ const realm = getRealmPathFromWellknown(wellknown);\n+ const baseUrl = getBaseUrlFromWellknown(wellknown);\n+ const webAuthnClient = deviceClient({\n+ realmPath: realm,\n+ serverConfig: {\n+ baseUrl,\n+ },\n+ });\n+ const devices = await webAuthnClient.webAuthn.get({\n+ userId,\n+ });\n+\n+ if (!Array.isArray(devices)) {\n+ throw new Error(`Failed to retrieve devices: ${String(devices.error)}`);\n+ }\n+\n+ return { userId, realm, webAuthnClient, devices: devices as WebAuthnDevice[] };\n+}\n+\n+/**\n+ * Stores the current set of registered WebAuthn device UUIDs in `localStorage`.\n+ *\n+ * If devices have already been stored, this is a no-op and returns the existing count.\n+ *\n+ * @param config OIDC configuration used to retrieve the current user's devices.\n+ * @returns A human-readable status message for UI display.\n+ */\n+export async function storeDevicesBeforeSession(config: OidcConfig): Promise {\n+ const storedDevices = getStoredDevices();\n+ if (storedDevices) {\n+ return `Devices before session: ${storedDevices.size} registered WebAuthn device(s).`;\n+ }\n+\n+ const { devices } = await getWebAuthnDevicesForCurrentUser(config);\n+ const uuids = devices.map((device) => device.uuid).filter((uuid) => Boolean(uuid));\n+ window.localStorage.setItem(WEBAUTHN_DEVICES_KEY, JSON.stringify(uuids));\n+ return `Devices before session: ${uuids.length} registered WebAuthn device(s).`;\n+}\n+\n+/**\n+ * Deletes only the WebAuthn devices that were registered during the current session.\n+ *\n+ * This compares the current device list against the snapshot stored by\n+ * `storeDevicesBeforeSession` and deletes any newly added devices.\n+ *\n+ * @param config OIDC configuration used to retrieve and delete WebAuthn devices.\n+ * @returns A human-readable status message for UI display.\n+ * @throws When the delete endpoint returns an error shape.\n+ */\n+export async function deleteDevicesInSession(config: OidcConfig): Promise {\n+ const storedDevices = getStoredDevices();\n+ if (!storedDevices) {\n+ return 'No devices found. Click Get Registered Devices first.';\n+ }\n+\n+ const { userId, webAuthnClient, devices } = await getWebAuthnDevicesForCurrentUser(config);\n+ const devicesToDelete = devices.filter((device) => !storedDevices.has(device.uuid));\n+\n+ if (devicesToDelete.length === 0) {\n+ return `No devices found in this session for user ${userId}.`;\n+ }\n+\n+ for (const device of devicesToDelete) {\n+ const response = await webAuthnClient.webAuthn.delete({\n+ userId,\n+ device,\n+ });\n+\n+ if (response && hasError(response)) {\n+ throw new Error(`Failed deleting device ${device.uuid}: ${String(response.error)}`);\n+ }\n+ }\n+\n+ return `Deleted ${devicesToDelete.length} WebAuthn device(s) for user ${userId}.`;\n+}\n+\n+/**\n+ * Deletes all registered WebAuthn devices for the current user.\n+ *\n+ * This always clears the stored snapshot in `localStorage` once deletions complete.\n+ *\n+ * @param config OIDC configuration used to retrieve and delete WebAuthn devices.\n+ * @returns A human-readable status message for UI display.\n+ * @throws When the delete endpoint returns an error shape.\n+ */\n+export async function deleteAllDevices(config: OidcConfig): Promise {\n+ const { userId, webAuthnClient, devices } = await getWebAuthnDevicesForCurrentUser(config);\n+\n+ if (devices.length === 0) {\n+ window.localStorage.removeItem(WEBAUTHN_DEVICES_KEY);\n+ return `No registered WebAuthn devices found for user ${userId}.`;\n+ }\n+\n+ for (const device of devices as WebAuthnDevice[]) {\n+ const response = await webAuthnClient.webAuthn.delete({\n+ userId,\n+ device,\n+ });\n+\n+ if (response && hasError(response)) {\n+ throw new Error(`Failed deleting device ${device.uuid}: ${String(response.error)}`);\n+ }\n+ }\n+\n+ window.localStorage.removeItem(WEBAUTHN_DEVICES_KEY);\n+ return `Deleted ${devices.length} registered WebAuthn device(s) for user ${userId}.`;\n+}\ndiff --git a/e2e/journey-app/style.css b/e2e/journey-app/style.css\nindex db3f236578..e32d10ac16 100644\n--- a/e2e/journey-app/style.css\n+++ b/e2e/journey-app/style.css\n@@ -54,6 +54,7 @@ pre {\n margin: 1em 0;\n padding: 1em;\n background-color: #1a1a1a;\n+ color: #f3f4f6;\n border-radius: 8px;\n overflow-x: auto;\n }\ndiff --git a/e2e/journey-app/tsconfig.app.json b/e2e/journey-app/tsconfig.app.json\nindex 5d19cb58cd..417f5a64c2 100644\n--- a/e2e/journey-app/tsconfig.app.json\n+++ b/e2e/journey-app/tsconfig.app.json\n@@ -10,12 +10,16 @@\n \"./helper.ts\",\n \"./server-configs.ts\",\n \"./callback-map.ts\",\n- \"components/**/*.ts\"\n+ \"components/**/*.ts\",\n+ \"services/**/*.ts\"\n ],\n \"references\": [\n {\n \"path\": \"../../packages/sdk-effects/logger/tsconfig.lib.json\"\n },\n+ {\n+ \"path\": \"../../packages/device-client/tsconfig.lib.json\"\n+ },\n {\n \"path\": \"../../packages/oidc-client/tsconfig.lib.json\"\n },\ndiff --git a/e2e/journey-suites/src/recovery-codes.test.ts b/e2e/journey-suites/src/recovery-codes.test.ts\nindex ce90a62607..52f4d721e9 100644\n--- a/e2e/journey-suites/src/recovery-codes.test.ts\n+++ b/e2e/journey-suites/src/recovery-codes.test.ts\n@@ -22,9 +22,6 @@ test.describe('Recovery Codes Journey', () => {\n \n await navigate('/?journey=TEST_WebAuthnWithRecoveryCodes');\n \n- await expect(page.getByRole('button', { name: 'Submit' })).toBeVisible({ timeout: 10000 });\n- await clickButton('Submit', '/authenticate');\n-\n await expect(page.locator('#recovery-codes-container')).toBeVisible({ timeout: 10000 });\n \n await expect(page.locator('#recovery-codes-header')).toBeVisible();\ndiff --git a/e2e/journey-suites/src/webauthn-devices.test.ts b/e2e/journey-suites/src/webauthn-devices.test.ts\nnew file mode 100644\nindex 0000000000..d13a85b4c9\n--- /dev/null\n+++ b/e2e/journey-suites/src/webauthn-devices.test.ts\n@@ -0,0 +1,149 @@\n+/*\n+ * Copyright (c) 2026 Ping Identity Corporation. All rights reserved.\n+ *\n+ * This software may be modified and distributed under the terms\n+ * of the MIT license. See the LICENSE file for details.\n+ */\n+\n+import { expect, test } from '@playwright/test';\n+import type { CDPSession } from '@playwright/test';\n+\n+import { asyncEvents } from './utils/async-events.js';\n+import { username, password } from './utils/demo-user.js';\n+\n+test.use({ browserName: 'chromium' });\n+\n+test.describe('WebAuthn registration delete devices', () => {\n+ let cdp: CDPSession | undefined;\n+ let authenticatorId: string | undefined;\n+\n+ async function login(page, journey = 'Login'): Promise {\n+ const { clickButton, navigate } = asyncEvents(page);\n+\n+ await navigate(`/?clientId=tenant&journey=${journey}`);\n+ await expect(page.getByLabel('User Name')).toBeVisible();\n+\n+ await page.getByLabel('User Name').fill(username);\n+ await page.getByLabel('Password').fill(password);\n+ await clickButton('Submit', '/authenticate');\n+ await expect(page.getByRole('button', { name: 'Logout' })).toBeVisible();\n+ }\n+\n+ async function logout(page): Promise {\n+ const { clickButton } = asyncEvents(page);\n+ await clickButton('Logout', '/sessions');\n+ await expect(page.getByRole('button', { name: 'Submit' })).toBeVisible();\n+ }\n+\n+ async function getDevicesBeforeSession(page): Promise {\n+ const getButton = page.getByRole('button', { name: 'Get Registered Devices' });\n+ await expect(getButton).toBeVisible();\n+ await getButton.click();\n+ await expect(page.locator('#deviceStatus')).toContainText('Devices before session:');\n+ }\n+\n+ async function deleteDevicesInSession(page): Promise {\n+ await login(page);\n+\n+ const deleteButton = page.getByRole('button', { name: 'Delete Devices From This Session' });\n+ await expect(deleteButton).toBeVisible();\n+ await deleteButton.click();\n+\n+ await expect(page.locator('#deviceStatus')).toContainText(\n+ /Deleted|No devices found in this session|No devices found/,\n+ );\n+\n+ await logout(page);\n+ }\n+\n+ async function completeAuthenticationJourney(page): Promise {\n+ const { clickButton, navigate } = asyncEvents(page);\n+\n+ await navigate('/?clientId=tenant&journey=TEST_WebAuthnAuthentication_UsernamePassword');\n+ await expect(page.getByLabel('User Name')).toBeVisible();\n+ await page.getByLabel('User Name').fill(username);\n+ await clickButton('Submit', '/authenticate');\n+\n+ await expect(page.getByLabel('Password')).toBeVisible();\n+ await page.getByLabel('Password').fill(password);\n+ await clickButton('Submit', '/authenticate');\n+\n+ await expect(page.getByRole('button', { name: 'Logout' })).toBeVisible();\n+ }\n+\n+ test.beforeEach(async ({ context, page }) => {\n+ cdp = await context.newCDPSession(page);\n+ await cdp.send('WebAuthn.enable');\n+\n+ const response = await cdp.send('WebAuthn.addVirtualAuthenticator', {\n+ options: {\n+ protocol: 'ctap2',\n+ transport: 'internal',\n+ hasResidentKey: true,\n+ hasUserVerification: true,\n+ isUserVerified: true,\n+ automaticPresenceSimulation: true,\n+ },\n+ });\n+\n+ authenticatorId = response.authenticatorId;\n+\n+ await login(page);\n+ await getDevicesBeforeSession(page);\n+ await logout(page);\n+ });\n+\n+ test.afterEach(async ({ page }) => {\n+ await page.unroute('**/*');\n+\n+ try {\n+ await deleteDevicesInSession(page);\n+ } catch (error) {\n+ console.error('Delete failed:', error);\n+ }\n+\n+ if (!cdp) {\n+ return;\n+ }\n+\n+ if (authenticatorId) {\n+ await cdp.send('WebAuthn.removeVirtualAuthenticator', { authenticatorId });\n+ }\n+\n+ await cdp.send('WebAuthn.disable');\n+ });\n+\n+ async function completeRegistrationJourney(page): Promise {\n+ await login(page, 'TEST_WebAuthn-Registration');\n+ }\n+\n+ test('should register multiple devices, authenticate and delete devices', async ({ page }) => {\n+ await completeRegistrationJourney(page);\n+ await logout(page);\n+\n+ await completeRegistrationJourney(page);\n+ await logout(page);\n+\n+ await completeAuthenticationJourney(page);\n+\n+ const deleteButton = page.getByRole('button', { name: 'Delete Devices From This Session' });\n+ await expect(deleteButton).toBeVisible();\n+ await deleteButton.click();\n+ await expect(page.locator('#deviceStatus')).toContainText(\n+ 'Deleted 2 WebAuthn device(s) for user',\n+ );\n+\n+ await logout(page);\n+ });\n+\n+ test('should delete all registered devices', async ({ page }) => {\n+ await completeRegistrationJourney(page);\n+\n+ const deleteAllButton = page.getByRole('button', { name: 'Delete All Registered Devices' });\n+ await expect(deleteAllButton).toBeVisible();\n+ await deleteAllButton.click();\n+\n+ await expect(page.locator('#deviceStatus')).toContainText('Deleted');\n+ await expect(page.locator('#deviceStatus')).toContainText('registered WebAuthn device(s)');\n+ });\n+});\ndiff --git a/packages/device-client/package.json b/packages/device-client/package.json\nindex 15059087a7..f8f238092b 100644\n--- a/packages/device-client/package.json\n+++ b/packages/device-client/package.json\n@@ -32,6 +32,18 @@\n \"msw\": \"catalog:\"\n },\n \"nx\": {\n- \"tags\": [\"scope:package\"]\n+ \"tags\": [\"scope:package\"],\n+ \"targets\": {\n+ \"build\": {\n+ \"executor\": \"@nx/js:tsc\",\n+ \"outputs\": [\"{options.outputPath}\"],\n+ \"options\": {\n+ \"outputPath\": \"packages/device-client/dist\",\n+ \"main\": \"packages/device-client/src/index.ts\",\n+ \"tsConfig\": \"packages/device-client/tsconfig.lib.json\",\n+ \"format\": [\"esm\"]\n+ }\n+ }\n+ }\n }\n }\ndiff --git a/pnpm-lock.yaml b/pnpm-lock.yaml\nindex 135d01b710..df99cb484c 100644\n--- a/pnpm-lock.yaml\n+++ b/pnpm-lock.yaml\n@@ -324,6 +324,9 @@ importers:\n \n e2e/journey-app:\n dependencies:\n+ '@forgerock/device-client':\n+ specifier: workspace:*\n+ version: link:../../packages/device-client\n '@forgerock/journey-client':\n specifier: workspace:*\n version: link:../../packages/journey-client\n\n```\n\n## Instructions\n\nRate how similar the commit is to the AI fix on a scale of 0-10.\n\n**Scoring Guide:**\n- 10: Nearly identical changes (same files, same logic, same fixes)\n- 8-9: Very similar (same core changes, minor differences in implementation)\n- 6-7: Similar intent (addresses same issue, somewhat different approach)\n- 4-5: Some overlap (touches same area, but different changes)\n- 2-3: Minimal similarity (different files or completely different changes)\n- 0-1: No similarity (unrelated changes)\n\n**Criteria:**\n- Focus on: same files modified, similar logic changes, same bug being fixed\n- The commit may have additional changes beyond the AI fix - that's okay\n- Small differences in implementation are okay if the intent is the same\n\nProvide your score (0-10) and a brief reasoning (2-3 sentences) explaining your assessment.","response":"{\"score\":7,\"reasoning\":\"The AI-suggested fix targets restoring the 'Complete' heading and Session Token log in the `renderComplete()` function in `e2e/journey-app/main.ts`. The actual commit does include these changes in the `renderComplete()` function - it adds the console.log for the session token and creates the completeHeader h2 element with id 'completeHeader' and text 'Complete'. However, the commit goes far beyond the AI fix by adding extensive new functionality (WebAuthn device management, new components, services, tests, etc.), making it a much larger refactoring. The core fixes requested are present and correct, but they're embedded within a much broader set of changes that weren't part of the original AI suggestion.\"}","model":"claude-haiku-4-5-20251001","cipeFixId":"69ba31f91fd18b3aa1e7906f","headSha":"7870b508f869fab8f397817076d94a23cf96ccea","timestamp":1773816115485}