@seams/wallet-server 0.5.0

package/dist/esm/shared-ts/src/device-linking/parsers.js

@@ -0,0 +1,1412 @@
+import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcMaterialActivationRef, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
+import { parseDeviceId as parseDeviceId$1, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
+import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
+import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+import { parseEd25519PublicKeyB64u, parseUnixMs, rejectUnknownFields, requireRecord } from "../passkey-custody/primitives.js";
+import { parseDelegatedWalletAuthorityV1 } from "../authorization/delegatedAuthority.js";
+import { parseWalletAddAuthMethodRegistrationOptions } from "../utils/addAuthMethodRegistration.js";
+import "./walletSessionCredentialDelivery.js";
+import { parseWalletSignerActivationSetV1 } from "../authorization/walletAuthority.js";
+import "../utils/registrationIntent.js";
+import { requireRouterAbX25519PublicKey } from "../utils/routerAbPublicKeyset.js";
+import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1 } from "./sourceContribution.js";
+import "./committedSignerPackages.js";
+//#region ../shared-ts/src/device-linking/parsers.ts
+const QR_FIELDS = [
+	"version",
+	"purpose",
+	"linkSessionId",
+	"linkPublicKeyB64u",
+	"devicePublicKeyB64u",
+	"requestedPermission",
+	"targetFactor",
+	"issuedAtMs",
+	"expiresAtMs"
+];
+const QR_EMAIL_FIELDS = [...QR_FIELDS, "targetEmail"];
+const OWNER_AUTHORIZATION_REQUEST_FIELDS = ["payload", "requestedAtMs"];
+const CLAIM_REQUEST_FIELDS = ["kind", "payload"];
+const CLAIM_FIELDS = [
+	"kind",
+	"linkSessionId",
+	"walletId",
+	"enrollmentId",
+	"deviceId",
+	"devicePublicKeyB64u",
+	"targetFactor",
+	"sessionRevision",
+	"claimedAtMs",
+	"claimExpiresAtMs"
+];
+const OWNER_AUTH_WALLET_SESSION_FIELDS = [
+	"kind",
+	"walletSessionId",
+	"authorizationId"
+];
+const ENROLLMENT_FIELDS = [
+	"kind",
+	"linkSessionId",
+	"walletId",
+	"enrollmentId",
+	"deviceId",
+	"linkPublicKeyB64u",
+	"devicePublicKeyB64u",
+	"permission",
+	"targetFactor",
+	"ownerAuthorization",
+	"approvedAtMs",
+	"expiresAtMs"
+];
+const ENROLLMENT_FIELDS_WITH_SOURCE_CONTRIBUTION = [...ENROLLMENT_FIELDS, "sourceContribution"];
+const APPROVAL_DELIVERY_FIELDS = ["kind", "approval"];
+const CREDENTIAL_BASE_FIELDS = [
+	"kind",
+	"linkSessionId",
+	"walletId",
+	"enrollmentId",
+	"deviceId",
+	"walletAuthMethodId",
+	"targetFactor",
+	"targetPreparationDigestB64u",
+	"ordinarySignerMaterialRecipientRequests",
+	"registeredAtMs"
+];
+const PASSKEY_CREDENTIAL_FIELDS = [...CREDENTIAL_BASE_FIELDS, "webauthnRegistration"];
+const EMAIL_OTP_CREDENTIAL_FIELDS = [
+	...CREDENTIAL_BASE_FIELDS,
+	"targetEmail",
+	"emailOtpVerificationGrant"
+];
+const EMAIL_OTP_CREDENTIAL_NEW_FIELDS = [...EMAIL_OTP_CREDENTIAL_FIELDS, "emailOtpEnrollment"];
+const TARGET_PREPARATION_BASE_FIELDS = [
+	"kind",
+	"linkSessionId",
+	"walletId",
+	"enrollmentId",
+	"deviceId",
+	"deliveryRecipientPublicKey65B64u",
+	"walletAuthMethodId",
+	"ed25519ExportRoot",
+	"targetFactor",
+	"ordinarySignerMaterialRecipientRequirements",
+	"issuedAtMs",
+	"expiresAtMs"
+];
+const TARGET_PREPARATION_REQUEST_FIELDS = [
+	"kind",
+	"linkSessionId",
+	"deliveryRecipientPublicKey65B64u"
+];
+const TARGET_PREPARATION_PASSKEY_FIELDS = [
+	...TARGET_PREPARATION_BASE_FIELDS,
+	"passkeyCreationOptions",
+	"passkeyConfigurationDigestB64u"
+];
+const TARGET_PREPARATION_EMAIL_FIELDS = [
+	...TARGET_PREPARATION_BASE_FIELDS,
+	"targetEmail",
+	"enrollment",
+	"baseWalletAuthMethodId"
+];
+const TARGET_PREPARATION_EMAIL_NEW_FIELDS = [
+	...TARGET_PREPARATION_BASE_FIELDS,
+	"targetEmail",
+	"enrollment"
+];
+const EMAIL_OTP_VERIFICATION_GRANT_BASE_FIELDS = [
+	"kind",
+	"grantId",
+	"grantToken",
+	"challengeId",
+	"linkSessionId",
+	"walletId",
+	"enrollmentId",
+	"deviceId",
+	"targetPreparationDigestB64u",
+	"targetEmail",
+	"enrollment",
+	"emailHashHex",
+	"registrationAuthorityId",
+	"providerUserId",
+	"authorityDigestB64u",
+	"issuedAtMs",
+	"expiresAtMs"
+];
+const EMAIL_OTP_VERIFICATION_GRANT_FIELDS = [...EMAIL_OTP_VERIFICATION_GRANT_BASE_FIELDS, "baseWalletAuthMethodId"];
+const EMAIL_OTP_FACTOR_RELEASE_FIELDS = [
+	"kind",
+	"challengeId",
+	"enrollmentId",
+	"enrollmentSealKeyVersion",
+	"serverEphemeralPublicKey65B64u",
+	"nonce12B64u",
+	"ciphertextB64u"
+];
+const WEBAUTHN_REGISTRATION_FIELDS = [
+	"kind",
+	"credentialIdB64u",
+	"authenticatorAttachment",
+	"clientDataJsonB64u",
+	"attestationObjectB64u",
+	"transports"
+];
+const LINKED_DEVICE_LIST_REQUEST_FIELDS = [
+	"kind",
+	"walletId",
+	"limit",
+	"cursor"
+];
+const LINKED_DEVICE_REVOKE_REQUEST_FIELDS = [
+	"kind",
+	"walletId",
+	"walletAuthMethodId",
+	"requestedAtMs"
+];
+function exactRecord(raw, fields, label) {
+	const record = requireRecord(raw, label);
+	rejectUnknownFields(record, fields, label);
+	for (const field of fields) if (!Object.prototype.hasOwnProperty.call(record, field) || record[field] === void 0) throw new Error(`${label}.${field} is required`);
+	return record;
+}
+function parseId(parser, raw, label) {
+	const result = parser(raw);
+	if (result.ok) return result.value;
+	throw new Error(`${label} ${result.error.message}`);
+}
+function parseLinkedDeviceRevokeWalletAuthMethodId(raw, label) {
+	const value = parseId(parseWalletAuthMethodId, raw, label);
+	if (value.startsWith("wallet-authority:") || value.startsWith("authority:")) throw new Error(`${label} must identify a WalletAuthMethodId`);
+	return value;
+}
+function parseUnixTime(raw, label) {
+	try {
+		return parseUnixMs(raw, label);
+	} catch (error) {
+		throw new Error(error instanceof Error ? error.message : `${label} is invalid`);
+	}
+}
+function parseEmailHashHex(raw, label) {
+	if (typeof raw !== "string" || !/^[0-9a-f]{64}$/.test(raw)) throw new Error(`${label} must be 32 canonical lowercase hex bytes`);
+	return raw;
+}
+function parseNonEmptyToken(raw, label) {
+	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw) throw new Error(`${label} must be a non-empty canonical string`);
+	for (const character of raw) {
+		const code = character.charCodeAt(0);
+		if (/\s/.test(character) || code <= 31 || code === 127) throw new Error(`${label} must not contain whitespace or control characters`);
+	}
+	return raw;
+}
+function parseDigest(raw, label) {
+	try {
+		return parseDigestB64u(raw);
+	} catch (error) {
+		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
+	}
+}
+function parsePublicKey(raw, label) {
+	if (typeof raw !== "string" || raw.length === 0 || !/^[A-Za-z0-9_-]+$/.test(raw)) throw new Error(`${label} must be canonical unpadded base64url`);
+	try {
+		const decoded = base64UrlDecode(raw);
+		if (decoded.length !== 32 || base64UrlEncode(decoded) !== raw) throw new Error("non-canonical");
+	} catch {
+		throw new Error(`${label} must be a canonical 32-byte unpadded base64url key`);
+	}
+	return raw;
+}
+function parseCanonicalBase64UrlBytes(raw, label) {
+	if (typeof raw !== "string" || raw.length === 0 || !/^[A-Za-z0-9_-]+$/.test(raw)) throw new Error(`${label} must be canonical unpadded base64url`);
+	try {
+		const decoded = base64UrlDecode(raw);
+		if (decoded.length === 0 || base64UrlEncode(decoded) !== raw) throw new Error("non-canonical");
+	} catch {
+		throw new Error(`${label} must be canonical unpadded base64url`);
+	}
+	return raw;
+}
+function parseCanonicalFixedBase64UrlBytes(raw, length, label) {
+	const value = parseCanonicalBase64UrlBytes(raw, label);
+	const decoded = base64UrlDecode(value);
+	try {
+		if (decoded.length !== length) throw new Error(`${label} must encode ${length} bytes`);
+		return value;
+	} finally {
+		decoded.fill(0);
+	}
+}
+const P256_FIELD_PRIME = BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff");
+const P256_CURVE_A = P256_FIELD_PRIME - 3n;
+const P256_CURVE_B = BigInt("0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b");
+function bigEndianBytesToBigInt(bytes) {
+	let value = 0n;
+	for (const byte of bytes) value = value << 8n | BigInt(byte);
+	return value;
+}
+function isP256Point(decoded) {
+	const x = bigEndianBytesToBigInt(decoded.subarray(1, 33));
+	const y = bigEndianBytesToBigInt(decoded.subarray(33, 65));
+	if (x >= P256_FIELD_PRIME || y >= P256_FIELD_PRIME) return false;
+	return y * y % P256_FIELD_PRIME === (x * x * x % P256_FIELD_PRIME + P256_CURVE_A * x % P256_FIELD_PRIME + P256_CURVE_B) % P256_FIELD_PRIME;
+}
+function parseUncompressedP256PointB64u(raw, label) {
+	const value = parseCanonicalFixedBase64UrlBytes(raw, 65, label);
+	const decoded = base64UrlDecode(value);
+	try {
+		if (decoded[0] !== 4) throw new Error(`${label} must be an uncompressed SEC1 P-256 point`);
+		if (!isP256Point(decoded)) throw new Error(`${label} must be an on-curve P-256 point`);
+		return value;
+	} finally {
+		decoded.fill(0);
+	}
+}
+function parseLinkDevicePublicKeyB64u(raw) {
+	return parsePublicKey(raw, "LinkDevicePublicKeyB64u");
+}
+function parseCredential(raw, label) {
+	return parseId(parseWebAuthnCredentialIdB64u, parseCanonicalBase64UrlBytes(raw, label), label);
+}
+function parseKeyFamily(raw, label) {
+	if (raw !== "ed25519" && raw !== "ecdsa_secp256k1") throw new Error(`${label} must identify a supported key family`);
+	return raw;
+}
+function parseNonNegativeSafeInteger(raw, label) {
+	if (!Number.isSafeInteger(raw) || Number(raw) < 0) throw new Error(`${label} must be a non-negative safe integer`);
+	return Number(raw);
+}
+function parsePositiveSafeInteger(raw, label) {
+	const value = parseNonNegativeSafeInteger(raw, label);
+	if (value < 1) throw new Error(`${label} must be a positive safe integer`);
+	return value;
+}
+function parseNullableCursor(raw, label) {
+	if (raw === null) return null;
+	return parseNonEmptyToken(raw, label);
+}
+function assertExpiryAfterIssued(issuedAtMs, expiresAtMs, label) {
+	if (expiresAtMs <= issuedAtMs) throw new Error(`${label}.expiresAtMs must be after issuedAtMs`);
+}
+function parseDelegatedWalletAuthority(raw, label) {
+	const result = parseDelegatedWalletAuthorityV1(raw);
+	if (!result.ok) throw new Error(`${label}: ${result.error.message}`);
+	return result.value;
+}
+function parseTargetFactor(raw, label) {
+	switch (exactRecord(raw, ["kind"], label).kind) {
+		case "passkey_prf": return { kind: "passkey_prf" };
+		case "email_otp": return { kind: "email_otp" };
+		default: throw new Error(`${label}.kind is unsupported`);
+	}
+}
+function parseTargetEmail(raw, label) {
+	const parsed = parseVerifiedEmailAddress(raw);
+	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
+	return parsed.value;
+}
+function parseEmailOtpEnrollmentSelection(raw, label) {
+	const record = requireRecord(raw, label);
+	if (record.kind === "existing_enrollment") {
+		exactRecord(record, ["kind"], label);
+		return { kind: "existing_enrollment" };
+	}
+	if (record.kind === "new_enrollment") {
+		exactRecord(record, ["kind"], label);
+		return { kind: "new_enrollment" };
+	}
+	throw new Error(`${label}.kind is invalid`);
+}
+function parseEmailOtpEnrollmentMaterial(raw, label) {
+	const record = exactRecord(raw, [
+		"enrollmentSealKeyVersion",
+		"clientUnlockPublicKeyB64u",
+		"unlockKeyVersion",
+		"serverSealedFactorCiphertextB64u"
+	], label);
+	return {
+		enrollmentSealKeyVersion: parseNonEmptyToken(record.enrollmentSealKeyVersion, `${label}.enrollmentSealKeyVersion`),
+		clientUnlockPublicKeyB64u: parseNonEmptyToken(record.clientUnlockPublicKeyB64u, `${label}.clientUnlockPublicKeyB64u`),
+		unlockKeyVersion: parseNonEmptyToken(record.unlockKeyVersion, `${label}.unlockKeyVersion`),
+		serverSealedFactorCiphertextB64u: parseNonEmptyToken(record.serverSealedFactorCiphertextB64u, `${label}.serverSealedFactorCiphertextB64u`)
+	};
+}
+function parseApprovedTargetFactor(raw, label) {
+	const record = requireRecord(raw, label);
+	if (record.kind === "passkey_prf") {
+		exactRecord(record, ["kind"], label);
+		return { kind: "passkey_prf" };
+	}
+	if (record.kind === "email_otp") {
+		const enrollment = parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`);
+		const targetEmail = parseTargetEmail(record.targetEmail, `${label}.targetEmail`);
+		if (enrollment.kind === "existing_enrollment") return {
+			kind: "email_otp",
+			targetEmail,
+			enrollment,
+			baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, exactRecord(record, [
+				"kind",
+				"targetEmail",
+				"enrollment",
+				"baseWalletAuthMethodId"
+			], label).baseWalletAuthMethodId, `${label}.baseWalletAuthMethodId`)
+		};
+		exactRecord(record, [
+			"kind",
+			"targetEmail",
+			"enrollment"
+		], label);
+		return {
+			kind: "email_otp",
+			targetEmail,
+			enrollment
+		};
+	}
+	throw new Error(`${label}.kind is unsupported`);
+}
+function parseSessionId(raw, label) {
+	return parseId(parseLinkDeviceSessionId, raw, label);
+}
+function parseWallet(raw, label) {
+	return parseId(parseWalletId, raw, label);
+}
+function parseEnrollmentId(raw, label) {
+	return parseId(parseLinkedDeviceEnrollmentId, raw, label);
+}
+function parseDeviceId(raw, label) {
+	return parseId(parseLinkedDeviceId, raw, label);
+}
+function parseWalletKey(raw, label) {
+	return parseId(parseWalletKeyId, raw, label);
+}
+function parseWalletSession(raw, label) {
+	return parseId(parseWalletSessionId, raw, label);
+}
+function parseWalletAuthorization(raw, label) {
+	return parseId(parseWalletSessionAuthorizationId, raw, label);
+}
+function parseLinkedDeviceListRequestV1(raw) {
+	const record = exactRecord(raw, LINKED_DEVICE_LIST_REQUEST_FIELDS, "LinkedDeviceListRequestV1");
+	if (record.kind !== "linked_device_list_request_v1") throw new Error("LinkedDeviceListRequestV1.kind is invalid");
+	return {
+		kind: "linked_device_list_request_v1",
+		walletId: parseWallet(record.walletId, "LinkedDeviceListRequestV1.walletId"),
+		limit: parsePositiveSafeInteger(record.limit, "LinkedDeviceListRequestV1.limit"),
+		cursor: parseNullableCursor(record.cursor, "LinkedDeviceListRequestV1.cursor")
+	};
+}
+function parseLinkedDeviceRevokeRequestV1(raw) {
+	const record = exactRecord(raw, LINKED_DEVICE_REVOKE_REQUEST_FIELDS, "LinkedDeviceRevokeRequestV1");
+	if (record.kind !== "linked_device_revoke_request_v1") throw new Error("LinkedDeviceRevokeRequestV1.kind is invalid");
+	return {
+		kind: "linked_device_revoke_request_v1",
+		walletId: parseWallet(record.walletId, "LinkedDeviceRevokeRequestV1.walletId"),
+		walletAuthMethodId: parseLinkedDeviceRevokeWalletAuthMethodId(record.walletAuthMethodId, "LinkedDeviceRevokeRequestV1.walletAuthMethodId"),
+		requestedAtMs: parseUnixTime(record.requestedAtMs, "LinkedDeviceRevokeRequestV1.requestedAtMs")
+	};
+}
+function parseQrPayloadRecord(record) {
+	if (record.version !== "v5") throw new Error("QrLinkedDeviceSessionPayloadV5.version is invalid");
+	if (record.purpose !== "linked_device_lane_creation") throw new Error("QrLinkedDeviceSessionPayloadV5.purpose is invalid");
+	const issuedAtMs = parseUnixTime(record.issuedAtMs, "QrLinkedDeviceSessionPayloadV5.issuedAtMs");
+	const expiresAtMs = parseUnixTime(record.expiresAtMs, "QrLinkedDeviceSessionPayloadV5.expiresAtMs");
+	assertExpiryAfterIssued(issuedAtMs, expiresAtMs, "QrLinkedDeviceSessionPayloadV5");
+	const base = {
+		version: "v5",
+		purpose: "linked_device_lane_creation",
+		linkSessionId: parseSessionId(record.linkSessionId, "QrLinkedDeviceSessionPayloadV5.linkSessionId"),
+		linkPublicKeyB64u: parsePublicKey(record.linkPublicKeyB64u, "QrLinkedDeviceSessionPayloadV5.linkPublicKeyB64u"),
+		devicePublicKeyB64u: parsePublicKey(record.devicePublicKeyB64u, "QrLinkedDeviceSessionPayloadV5.devicePublicKeyB64u"),
+		requestedPermission: parseDelegatedWalletAuthority(record.requestedPermission, "QrLinkedDeviceSessionPayloadV5.requestedPermission"),
+		targetFactor: parseTargetFactor(record.targetFactor, "QrLinkedDeviceSessionPayloadV5.targetFactor"),
+		issuedAtMs,
+		expiresAtMs
+	};
+	if (base.targetFactor.kind === "email_otp") return {
+		...base,
+		targetFactor: { kind: "email_otp" },
+		targetEmail: parseTargetEmail(record.targetEmail, "QrLinkedDeviceSessionPayloadV5.targetEmail")
+	};
+	return {
+		...base,
+		targetFactor: { kind: "passkey_prf" }
+	};
+}
+function parseQrLinkedDeviceSessionPayloadV5(raw) {
+	const candidate = requireRecord(raw, "QrLinkedDeviceSessionPayloadV5");
+	return parseQrPayloadRecord(exactRecord(candidate, parseTargetFactor(candidate.targetFactor, "QrLinkedDeviceSessionPayloadV5.targetFactor").kind === "email_otp" ? QR_EMAIL_FIELDS : QR_FIELDS, "QrLinkedDeviceSessionPayloadV5"));
+}
+function parseLinkedDeviceOwnerAuthorizationRequestV1(raw) {
+	const record = exactRecord(raw, OWNER_AUTHORIZATION_REQUEST_FIELDS, "LinkedDeviceOwnerAuthorizationRequestV1");
+	const requestedAtMs = parseUnixTime(record.requestedAtMs, "LinkedDeviceOwnerAuthorizationRequestV1.requestedAtMs");
+	return {
+		payload: parseQrLinkedDeviceSessionPayloadV5(record.payload),
+		requestedAtMs
+	};
+}
+function parseLinkSessionStateV1(raw) {
+	const initial = requireRecord(raw, "LinkSessionStateV1");
+	if (typeof initial.state !== "string") throw new Error("LinkSessionStateV1.state is invalid");
+	switch (initial.state) {
+		case "displaying_qr":
+			exactRecord(initial, ["state"], "LinkSessionStateV1.displaying_qr");
+			return { state: "displaying_qr" };
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning":
+			exactRecord(initial, ["state", "deviceId"], `LinkSessionStateV1.${initial.state}`);
+			return {
+				state: initial.state,
+				deviceId: parseId(parseDeviceId$1, initial.deviceId, `LinkSessionStateV1.${initial.state}.deviceId`)
+			};
+		case "authority_pending_local_install":
+			exactRecord(initial, [
+				"state",
+				"deviceId",
+				"authorityId",
+				"packageSetDigestB64u"
+			], "LinkSessionStateV1.authority_pending_local_install");
+			return {
+				state: initial.state,
+				deviceId: parseId(parseDeviceId$1, initial.deviceId, "LinkSessionStateV1.authority_pending_local_install.deviceId"),
+				authorityId: parseId(parseWalletAuthorityId, initial.authorityId, "LinkSessionStateV1.authority_pending_local_install.authorityId"),
+				packageSetDigestB64u: parseDigest(initial.packageSetDigestB64u, "LinkSessionStateV1.authority_pending_local_install.packageSetDigestB64u")
+			};
+		case "active":
+			exactRecord(initial, [
+				"state",
+				"deviceId",
+				"authorityId",
+				"activatedAtMs"
+			], "LinkSessionStateV1.active");
+			return {
+				state: initial.state,
+				deviceId: parseId(parseDeviceId$1, initial.deviceId, "LinkSessionStateV1.active.deviceId"),
+				authorityId: parseId(parseWalletAuthorityId, initial.authorityId, "LinkSessionStateV1.active.authorityId"),
+				activatedAtMs: parseUnixTime(initial.activatedAtMs, "LinkSessionStateV1.active.activatedAtMs")
+			};
+		case "failed_before_commit":
+			exactRecord(initial, ["state", "error"], "LinkSessionStateV1.failed_before_commit");
+			return {
+				state: initial.state,
+				error: parseLinkPrecommitFailureV1(initial.error)
+			};
+		case "cancelled":
+			exactRecord(initial, ["state", "cancelledAtMs"], "LinkSessionStateV1.cancelled");
+			return {
+				state: initial.state,
+				cancelledAtMs: parseUnixTime(initial.cancelledAtMs, "LinkSessionStateV1.cancelled.cancelledAtMs")
+			};
+		case "expired":
+			exactRecord(initial, ["state", "expiredAtMs"], "LinkSessionStateV1.expired");
+			return {
+				state: initial.state,
+				expiredAtMs: parseUnixTime(initial.expiredAtMs, "LinkSessionStateV1.expired.expiredAtMs")
+			};
+		default: throw new Error(`LinkSessionStateV1.state ${initial.state} is unsupported`);
+	}
+}
+function parseLinkPrecommitFailureV1(raw) {
+	const record = exactRecord(raw, ["kind", "reason"], "LinkPrecommitFailureV1");
+	if (record.kind !== "invalid_input" && record.kind !== "unauthorized_source" && record.kind !== "revoked_source" && record.kind !== "permission_attenuation_failed" && record.kind !== "target_factor_failed" && record.kind !== "expired_session" && record.kind !== "cancelled_session" && record.kind !== "claim_conflict" && record.kind !== "package_preparation_failed") throw new Error("LinkPrecommitFailureV1.kind is invalid");
+	return {
+		kind: record.kind,
+		reason: parseNonEmptyToken(record.reason, "LinkPrecommitFailureV1.reason")
+	};
+}
+function parseLinkedDeviceSessionClaimRequestV1(raw) {
+	const record = exactRecord(raw, CLAIM_REQUEST_FIELDS, "LinkedDeviceSessionClaimRequestV1");
+	if (record.kind !== "linked_device_session_claim_request_v1") throw new Error("LinkedDeviceSessionClaimRequestV1.kind is invalid");
+	return {
+		kind: "linked_device_session_claim_request_v1",
+		payload: parseQrLinkedDeviceSessionPayloadV5(record.payload)
+	};
+}
+function parseLinkedDeviceSessionClaimV1(raw) {
+	const record = exactRecord(raw, CLAIM_FIELDS, "LinkedDeviceSessionClaimV1");
+	if (record.kind !== "linked_device_session_claim_v1") throw new Error("LinkedDeviceSessionClaimV1.kind is invalid");
+	const claimedAtMs = parseUnixTime(record.claimedAtMs, "LinkedDeviceSessionClaimV1.claimedAtMs");
+	const claimExpiresAtMs = parseUnixTime(record.claimExpiresAtMs, "LinkedDeviceSessionClaimV1.claimExpiresAtMs");
+	assertExpiryAfterIssued(claimedAtMs, claimExpiresAtMs, "LinkedDeviceSessionClaimV1");
+	return {
+		kind: "linked_device_session_claim_v1",
+		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceSessionClaimV1.linkSessionId"),
+		walletId: parseWallet(record.walletId, "LinkedDeviceSessionClaimV1.walletId"),
+		enrollmentId: parseEnrollmentId(record.enrollmentId, "LinkedDeviceSessionClaimV1.enrollmentId"),
+		deviceId: parseDeviceId(record.deviceId, "LinkedDeviceSessionClaimV1.deviceId"),
+		devicePublicKeyB64u: parsePublicKey(record.devicePublicKeyB64u, "LinkedDeviceSessionClaimV1.devicePublicKeyB64u"),
+		targetFactor: parseTargetFactor(record.targetFactor, "LinkedDeviceSessionClaimV1.targetFactor"),
+		sessionRevision: parseUnixTime(record.sessionRevision, "LinkedDeviceSessionClaimV1.sessionRevision"),
+		claimedAtMs,
+		claimExpiresAtMs
+	};
+}
+function parseLinkedDeviceOwnerAuthorizationSourceV1(raw, label = "ownerAuthorization") {
+	const record = requireRecord(raw, label);
+	if (record.kind === "wallet_session") {
+		const exact = exactRecord(record, OWNER_AUTH_WALLET_SESSION_FIELDS, label);
+		return {
+			kind: "wallet_session",
+			walletSessionId: parseWalletSession(exact.walletSessionId, `${label}.walletSessionId`),
+			authorizationId: parseWalletAuthorization(exact.authorizationId, `${label}.authorizationId`)
+		};
+	}
+	throw new Error(`${label}.kind is unsupported`);
+}
+function parseEnrollmentCore(record, label) {
+	const approvedAtMs = parseUnixTime(record.approvedAtMs, `${label}.approvedAtMs`);
+	const expiresAtMs = parseUnixTime(record.expiresAtMs, `${label}.expiresAtMs`);
+	assertExpiryAfterIssued(approvedAtMs, expiresAtMs, label);
+	const core = {
+		linkSessionId: parseSessionId(record.linkSessionId, `${label}.linkSessionId`),
+		walletId: parseWallet(record.walletId, `${label}.walletId`),
+		enrollmentId: parseEnrollmentId(record.enrollmentId, `${label}.enrollmentId`),
+		deviceId: parseDeviceId(record.deviceId, `${label}.deviceId`),
+		linkPublicKeyB64u: parsePublicKey(record.linkPublicKeyB64u, `${label}.linkPublicKeyB64u`),
+		devicePublicKeyB64u: parsePublicKey(record.devicePublicKeyB64u, `${label}.devicePublicKeyB64u`),
+		permission: parseDelegatedWalletAuthority(record.permission, `${label}.permission`),
+		targetFactor: parseApprovedTargetFactor(record.targetFactor, `${label}.targetFactor`),
+		ownerAuthorization: parseLinkedDeviceOwnerAuthorizationSourceV1(record.ownerAuthorization, `${label}.ownerAuthorization`),
+		approvedAtMs,
+		expiresAtMs
+	};
+	if (record.sourceContribution === void 0) return core;
+	return {
+		...core,
+		sourceContribution: parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1(record.sourceContribution)
+	};
+}
+function parseLinkedDeviceApprovalV1(raw) {
+	const candidate = requireRecord(raw, "LinkedDeviceApprovalV1");
+	const record = exactRecord(candidate, candidate.sourceContribution === void 0 ? ENROLLMENT_FIELDS : ENROLLMENT_FIELDS_WITH_SOURCE_CONTRIBUTION, "LinkedDeviceApprovalV1");
+	if (record.kind !== "linked_device_approval_v1") throw new Error("LinkedDeviceApprovalV1.kind is invalid");
+	return {
+		kind: "linked_device_approval_v1",
+		...parseEnrollmentCore(record, "LinkedDeviceApprovalV1")
+	};
+}
+function parseLinkedDeviceApprovalDeliveryV1(raw) {
+	const record = exactRecord(raw, APPROVAL_DELIVERY_FIELDS, "LinkedDeviceApprovalDeliveryV1");
+	if (record.kind !== "linked_device_approval_delivery_v1") throw new Error("LinkedDeviceApprovalDeliveryV1.kind is invalid");
+	return {
+		kind: "linked_device_approval_delivery_v1",
+		approval: parseLinkedDeviceApprovalV1(record.approval)
+	};
+}
+function parseLinkedDeviceTargetPreparationV1(raw) {
+	const candidate = requireRecord(raw, "LinkedDeviceTargetPreparationV1");
+	const targetFactor = parseTargetFactor(candidate.targetFactor, "LinkedDeviceTargetPreparationV1.targetFactor");
+	const emailEnrollment = targetFactor.kind === "email_otp" ? parseEmailOtpEnrollmentSelection(candidate.enrollment, "LinkedDeviceTargetPreparationV1.enrollment") : null;
+	const record = exactRecord(candidate, targetFactor.kind === "passkey_prf" ? TARGET_PREPARATION_PASSKEY_FIELDS : emailEnrollment?.kind === "new_enrollment" ? TARGET_PREPARATION_EMAIL_NEW_FIELDS : TARGET_PREPARATION_EMAIL_FIELDS, "LinkedDeviceTargetPreparationV1");
+	if (record.kind !== "linked_device_target_preparation_v1") throw new Error("LinkedDeviceTargetPreparationV1.kind is invalid");
+	const walletAuthMethodId = parseId(parseWalletAuthMethodId, record.walletAuthMethodId, "LinkedDeviceTargetPreparationV1.walletAuthMethodId");
+	const ordinarySignerMaterialRecipientRequirements = parseOrdinarySignerMaterialRecipientRequirementsV1(record.ordinarySignerMaterialRecipientRequirements);
+	const issuedAtMs = parseUnixTime(record.issuedAtMs, "LinkedDeviceTargetPreparationV1.issuedAtMs");
+	const expiresAtMs = parseUnixTime(record.expiresAtMs, "LinkedDeviceTargetPreparationV1.expiresAtMs");
+	if (expiresAtMs <= issuedAtMs) throw new Error("LinkedDeviceTargetPreparationV1.expiresAtMs must follow issuedAtMs");
+	const ed25519ExportRoot = parseLinkedDeviceEd25519ExportRootPreparationV1(record.ed25519ExportRoot);
+	const base = {
+		kind: "linked_device_target_preparation_v1",
+		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceTargetPreparationV1.linkSessionId"),
+		walletId: parseWallet(record.walletId, "LinkedDeviceTargetPreparationV1.walletId"),
+		enrollmentId: parseEnrollmentId(record.enrollmentId, "LinkedDeviceTargetPreparationV1.enrollmentId"),
+		deviceId: parseDeviceId(record.deviceId, "LinkedDeviceTargetPreparationV1.deviceId"),
+		deliveryRecipientPublicKey65B64u: parseUncompressedP256PointB64u(record.deliveryRecipientPublicKey65B64u, "LinkedDeviceTargetPreparationV1.deliveryRecipientPublicKey65B64u"),
+		walletAuthMethodId,
+		ed25519ExportRoot,
+		ordinarySignerMaterialRecipientRequirements,
+		issuedAtMs,
+		expiresAtMs
+	};
+	if (targetFactor.kind === "passkey_prf") {
+		const passkeyCreationOptions = parseLinkedDevicePasskeyCreationOptionsV1(record.passkeyCreationOptions, walletAuthMethodId);
+		return {
+			...base,
+			targetFactor,
+			passkeyCreationOptions,
+			passkeyConfigurationDigestB64u: parseDigest(record.passkeyConfigurationDigestB64u, "LinkedDeviceTargetPreparationV1.passkeyConfigurationDigestB64u")
+		};
+	}
+	if (!emailEnrollment) throw new Error("Email OTP target preparation enrollment is missing");
+	const targetEmail = parseTargetEmail(record.targetEmail, "LinkedDeviceTargetPreparationV1.targetEmail");
+	if (emailEnrollment.kind === "new_enrollment") return {
+		...base,
+		targetFactor,
+		targetEmail,
+		enrollment: emailEnrollment
+	};
+	return {
+		...base,
+		targetFactor,
+		targetEmail,
+		enrollment: emailEnrollment,
+		baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, record.baseWalletAuthMethodId, "LinkedDeviceTargetPreparationV1.baseWalletAuthMethodId")
+	};
+}
+function parseLinkedDeviceTargetPreparationRequestV1(raw) {
+	const record = exactRecord(raw, TARGET_PREPARATION_REQUEST_FIELDS, "LinkedDeviceTargetPreparationRequestV1");
+	if (record.kind !== "linked_device_target_preparation_request_v1") throw new Error("LinkedDeviceTargetPreparationRequestV1.kind is invalid");
+	return {
+		kind: "linked_device_target_preparation_request_v1",
+		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceTargetPreparationRequestV1.linkSessionId"),
+		deliveryRecipientPublicKey65B64u: parseUncompressedP256PointB64u(record.deliveryRecipientPublicKey65B64u, "LinkedDeviceTargetPreparationRequestV1.deliveryRecipientPublicKey65B64u")
+	};
+}
+function parseLinkedDeviceEmailOtpBaseFactorRequestV1(raw) {
+	const record = requireRecord(raw, "LinkedDeviceEmailOtpBaseFactorRequestV1");
+	const expectedRevision = parseUnixTime(record.expectedRevision, "LinkedDeviceEmailOtpBaseFactorRequestV1.expectedRevision");
+	if (record.kind === "resolve") {
+		exactRecord(record, ["kind", "expectedRevision"], "LinkedDeviceEmailOtpBaseFactorRequestV1");
+		return {
+			kind: "resolve",
+			expectedRevision
+		};
+	}
+	if (record.kind === "select") return {
+		kind: "select",
+		expectedRevision,
+		baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, exactRecord(record, [
+			"kind",
+			"expectedRevision",
+			"baseWalletAuthMethodId"
+		], "LinkedDeviceEmailOtpBaseFactorRequestV1").baseWalletAuthMethodId, "LinkedDeviceEmailOtpBaseFactorRequestV1.baseWalletAuthMethodId")
+	};
+	throw new Error("LinkedDeviceEmailOtpBaseFactorRequestV1.kind is unsupported");
+}
+function parseLinkedDevicePasskeyCreationOptionsV1(raw, expectedWalletAuthMethodId) {
+	const label = "LinkedDeviceTargetPreparationV1.passkeyCreationOptions";
+	const record = exactRecord(raw, [
+		"kind",
+		"walletAuthMethodId",
+		"challengeId",
+		"challengeB64u",
+		"rpId",
+		"user",
+		"pubKeyCredParams",
+		"authenticatorSelection",
+		"timeoutMs",
+		"attestation",
+		"extensions",
+		"excludeCredentials"
+	], label);
+	const walletAuthMethodId = parseId(parseWalletAuthMethodId, record.walletAuthMethodId, `${label}.walletAuthMethodId`);
+	if (walletAuthMethodId !== expectedWalletAuthMethodId) throw new Error(`${label}.walletAuthMethodId must match the preparation`);
+	exactRecord(record.user, [
+		"idB64u",
+		"name",
+		"displayName"
+	], `${label}.user`);
+	exactRecord(record.authenticatorSelection, ["residentKey", "userVerification"], `${label}.authenticatorSelection`);
+	exactRecord(exactRecord(exactRecord(record.extensions, ["prf"], `${label}.extensions`).prf, ["eval"], `${label}.extensions.prf`).eval, ["firstB64u", "secondB64u"], `${label}.extensions.prf.eval`);
+	if (!Array.isArray(record.pubKeyCredParams)) throw new Error(`${label}.pubKeyCredParams must be an array`);
+	record.pubKeyCredParams.forEach((entry, index) => {
+		exactRecord(entry, ["type", "alg"], `${label}.pubKeyCredParams[${index}]`);
+	});
+	if (!Array.isArray(record.excludeCredentials)) throw new Error(`${label}.excludeCredentials must be an array`);
+	record.excludeCredentials.forEach((entry, index) => {
+		exactRecord(entry, ["type", "id"], `${label}.excludeCredentials[${index}]`);
+	});
+	const options = parseWalletAddAuthMethodRegistrationOptions(record);
+	return {
+		kind: options.kind,
+		walletAuthMethodId,
+		challengeId: options.challengeId,
+		challengeB64u: options.challengeB64u,
+		rpId: options.rpId,
+		user: options.user,
+		pubKeyCredParams: options.pubKeyCredParams,
+		authenticatorSelection: options.authenticatorSelection,
+		timeoutMs: options.timeoutMs,
+		attestation: options.attestation,
+		extensions: options.extensions,
+		excludeCredentials: options.excludeCredentials
+	};
+}
+function parseLinkedDeviceEd25519ExportRootPreparationV1(raw) {
+	if (raw === null) return null;
+	const record = exactRecord(raw, [
+		"kind",
+		"walletKeyId",
+		"applicationBindingDigestB64u",
+		"registeredPublicKeyB64u",
+		"revocationEpoch"
+	], "LinkedDeviceTargetPreparationV1.ed25519ExportRoot");
+	if (record.kind !== "linked_device_ed25519_export_root_preparation_v1") throw new Error("LinkedDeviceTargetPreparationV1.ed25519ExportRoot.kind is invalid");
+	return {
+		kind: "linked_device_ed25519_export_root_preparation_v1",
+		walletKeyId: parseWalletKey(record.walletKeyId, "LinkedDeviceTargetPreparationV1.ed25519ExportRoot.walletKeyId"),
+		applicationBindingDigestB64u: parseDigest(record.applicationBindingDigestB64u, "LinkedDeviceTargetPreparationV1.ed25519ExportRoot.applicationBindingDigestB64u"),
+		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "LinkedDeviceTargetPreparationV1.ed25519ExportRoot.registeredPublicKeyB64u"),
+		revocationEpoch: parseNonNegativeSafeInteger(record.revocationEpoch, "LinkedDeviceTargetPreparationV1.ed25519ExportRoot.revocationEpoch")
+	};
+}
+function parseOrdinarySignerMaterialRecipientRequirementV1(raw, index) {
+	const label = `LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements[${index}]`;
+	const record = exactRecord(raw, [
+		"kind",
+		"keyFamily",
+		"walletKeyId"
+	], label);
+	if (record.kind !== "ordinary_signer_material_recipient_requirement_v1") throw new Error(`${label}.kind is invalid`);
+	return {
+		kind: "ordinary_signer_material_recipient_requirement_v1",
+		keyFamily: parseKeyFamily(record.keyFamily, `${label}.keyFamily`),
+		walletKeyId: parseId(parseWalletKeyId, record.walletKeyId, `${label}.walletKeyId`)
+	};
+}
+function parseOrdinarySignerMaterialRecipientRequirementsV1(raw) {
+	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 2) throw new Error("LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements must contain one or two entries");
+	const requirements = raw.map((entry, index) => parseOrdinarySignerMaterialRecipientRequirementV1(entry, index));
+	if (new Set(requirements.map((entry) => entry.keyFamily)).size !== requirements.length) throw new Error("LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements repeats a key family");
+	if (new Set(requirements.map((entry) => String(entry.walletKeyId))).size !== requirements.length) throw new Error("LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements repeats a wallet key");
+	if (requirements.length === 2 && (requirements[0]?.keyFamily !== "ed25519" || requirements[1]?.keyFamily !== "ecdsa_secp256k1")) throw new Error("LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements must be ordered Ed25519 then ECDSA");
+	const first = requirements[0];
+	if (!first) throw new Error("ordinary signer material recipient requirements are empty");
+	return [first, ...requirements.slice(1)];
+}
+function parseWebAuthnTransport(raw, label) {
+	switch (raw) {
+		case "ble":
+		case "cable":
+		case "hybrid":
+		case "internal":
+		case "nfc":
+		case "smart-card":
+		case "usb": return raw;
+		default: throw new Error(`${label} is invalid`);
+	}
+}
+function parseLinkedDeviceWebAuthnRegistrationV1(raw) {
+	const label = "LinkedDeviceTargetCredentialRegistrationV1.webauthnRegistration";
+	const record = exactRecord(raw, WEBAUTHN_REGISTRATION_FIELDS, label);
+	if (record.kind !== "linked_device_webauthn_registration_v1") throw new Error(`${label}.kind is invalid`);
+	if (!Array.isArray(record.transports)) throw new Error(`${label}.transports must be an array`);
+	if (record.authenticatorAttachment !== null && record.authenticatorAttachment !== "platform" && record.authenticatorAttachment !== "cross-platform") throw new Error(`${label}.authenticatorAttachment is invalid`);
+	const transports = record.transports.map((entry, index) => parseWebAuthnTransport(entry, `${label}.transports[${index}]`));
+	if (new Set(transports).size !== transports.length) throw new Error(`${label}.transports contains duplicates`);
+	return {
+		kind: "linked_device_webauthn_registration_v1",
+		credentialIdB64u: parseCredential(record.credentialIdB64u, `${label}.credentialIdB64u`),
+		authenticatorAttachment: record.authenticatorAttachment,
+		clientDataJsonB64u: parseCanonicalBase64UrlBytes(record.clientDataJsonB64u, `${label}.clientDataJsonB64u`),
+		attestationObjectB64u: parseCanonicalBase64UrlBytes(record.attestationObjectB64u, `${label}.attestationObjectB64u`),
+		transports
+	};
+}
+function parseOrdinarySignerMaterialPreparationsV1(raw) {
+	return parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1(raw);
+}
+function parseOrdinarySignerMaterialRecipientRequestV1(raw, index) {
+	const label = `LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests[${index}]`;
+	const record = requireRecord(raw, label);
+	if (record.kind === "ordinary_ed25519_signer_material_recipient_request_v1") {
+		exactRecord(record, [
+			"kind",
+			"keyFamily",
+			"walletKeyId",
+			"recipientPublicKeyB64u"
+		], label);
+		if (record.keyFamily !== "ed25519") throw new Error(`${label}.keyFamily does not match its kind`);
+		return {
+			kind: record.kind,
+			keyFamily: "ed25519",
+			walletKeyId: parseId(parseWalletKeyId, record.walletKeyId, `${label}.walletKeyId`),
+			recipientPublicKeyB64u: parseCanonicalFixedBase64UrlBytes(record.recipientPublicKeyB64u, 32, `${label}.recipientPublicKeyB64u`)
+		};
+	}
+	if (record.kind === "ordinary_ecdsa_signer_material_recipient_request_v1") {
+		exactRecord(record, [
+			"kind",
+			"keyFamily",
+			"walletKeyId",
+			"clientEphemeralPublicKey"
+		], label);
+		if (record.keyFamily !== "ecdsa_secp256k1") throw new Error(`${label}.keyFamily does not match its kind`);
+		return {
+			kind: record.kind,
+			keyFamily: "ecdsa_secp256k1",
+			walletKeyId: parseId(parseWalletKeyId, record.walletKeyId, `${label}.walletKeyId`),
+			clientEphemeralPublicKey: requireRouterAbX25519PublicKey(record.clientEphemeralPublicKey, `${label}.clientEphemeralPublicKey`)
+		};
+	}
+	throw new Error(`${label}.kind is invalid`);
+}
+function parseOrdinarySignerMaterialRecipientRequestsV1(raw) {
+	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 2) throw new Error("LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests must contain one or two entries");
+	const requests = raw.map((entry, index) => parseOrdinarySignerMaterialRecipientRequestV1(entry, index));
+	const families = requests.map((entry) => entry.keyFamily);
+	if (new Set(families).size !== families.length) throw new Error("LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests repeats a key family");
+	if (new Set(requests.map((entry) => String(entry.walletKeyId))).size !== requests.length) throw new Error("LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests repeats a wallet key");
+	if (requests.length === 2 && (requests[0]?.keyFamily !== "ed25519" || requests[1]?.keyFamily !== "ecdsa_secp256k1")) throw new Error("LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests must be ordered Ed25519 then ECDSA");
+	const first = requests[0];
+	if (!first) throw new Error("ordinary signer material recipient requests are empty");
+	return [first, ...requests.slice(1)];
+}
+function parseLinkedDeviceTargetCredentialRegistrationV1(raw) {
+	const initial = requireRecord(raw, "LinkedDeviceTargetCredentialRegistrationV1");
+	const targetFactor = parseTargetFactor(initial.targetFactor, "LinkedDeviceTargetCredentialRegistrationV1.targetFactor");
+	const emailGrant = targetFactor.kind === "email_otp" ? parseLinkedDeviceEmailOtpVerificationGrantV1(initial.emailOtpVerificationGrant) : null;
+	const record = exactRecord(initial, targetFactor.kind === "passkey_prf" ? PASSKEY_CREDENTIAL_FIELDS : emailGrant?.enrollment.kind === "new_enrollment" ? EMAIL_OTP_CREDENTIAL_NEW_FIELDS : EMAIL_OTP_CREDENTIAL_FIELDS, "LinkedDeviceTargetCredentialRegistrationV1");
+	if (record.kind !== "linked_device_target_credential_registration_v1") throw new Error("LinkedDeviceTargetCredentialRegistrationV1.kind is invalid");
+	if (targetFactor.kind === "email_otp" && !emailGrant) throw new Error("Email OTP target credential grant is missing");
+	const linkSessionId = parseSessionId(record.linkSessionId, "LinkedDeviceTargetCredentialRegistrationV1.linkSessionId");
+	const walletId = parseWallet(record.walletId, "LinkedDeviceTargetCredentialRegistrationV1.walletId");
+	const enrollmentId = parseEnrollmentId(record.enrollmentId, "LinkedDeviceTargetCredentialRegistrationV1.enrollmentId");
+	const deviceId = parseDeviceId(record.deviceId, "LinkedDeviceTargetCredentialRegistrationV1.deviceId");
+	const walletAuthMethodId = parseWalletAuthMethodId(record.walletAuthMethodId);
+	if (!walletAuthMethodId.ok) throw new Error(`LinkedDeviceTargetCredentialRegistrationV1.walletAuthMethodId ${walletAuthMethodId.error.message}`);
+	const targetPreparationDigestB64u = parseDigest(record.targetPreparationDigestB64u, "LinkedDeviceTargetCredentialRegistrationV1.targetPreparationDigestB64u");
+	const ordinarySignerMaterialRecipientRequests = parseOrdinarySignerMaterialRecipientRequestsV1(record.ordinarySignerMaterialRecipientRequests);
+	const registeredAtMs = parseUnixTime(record.registeredAtMs, "LinkedDeviceTargetCredentialRegistrationV1.registeredAtMs");
+	if (targetFactor.kind === "passkey_prf") return {
+		kind: "linked_device_target_credential_registration_v1",
+		linkSessionId,
+		walletId,
+		enrollmentId,
+		deviceId,
+		walletAuthMethodId: walletAuthMethodId.value,
+		targetFactor,
+		targetPreparationDigestB64u,
+		ordinarySignerMaterialRecipientRequests,
+		webauthnRegistration: parseLinkedDeviceWebAuthnRegistrationV1(record.webauthnRegistration),
+		registeredAtMs
+	};
+	if (!emailGrant) throw new Error("Email OTP target credential grant is missing");
+	const targetEmail = parseTargetEmail(record.targetEmail, "LinkedDeviceTargetCredentialRegistrationV1.targetEmail");
+	if (emailGrant.enrollment.kind === "new_enrollment") return {
+		kind: "linked_device_target_credential_registration_v1",
+		linkSessionId,
+		walletId,
+		enrollmentId,
+		deviceId,
+		walletAuthMethodId: walletAuthMethodId.value,
+		targetFactor,
+		targetEmail,
+		targetPreparationDigestB64u,
+		ordinarySignerMaterialRecipientRequests,
+		emailOtpVerificationGrant: emailGrant,
+		emailOtpEnrollment: parseEmailOtpEnrollmentMaterial(record.emailOtpEnrollment, "LinkedDeviceTargetCredentialRegistrationV1.emailOtpEnrollment"),
+		registeredAtMs
+	};
+	return {
+		kind: "linked_device_target_credential_registration_v1",
+		linkSessionId,
+		walletId,
+		enrollmentId,
+		deviceId,
+		walletAuthMethodId: walletAuthMethodId.value,
+		targetFactor,
+		targetEmail,
+		targetPreparationDigestB64u,
+		ordinarySignerMaterialRecipientRequests,
+		emailOtpVerificationGrant: emailGrant,
+		registeredAtMs
+	};
+}
+function parseLinkedDeviceTargetCredentialRegistrationResultV1(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"outcome",
+		"linkSessionId",
+		"walletId",
+		"enrollmentId",
+		"deviceId",
+		"walletAuthMethodId",
+		"targetPreparationDigestB64u",
+		"targetFactor",
+		"ordinarySignerMaterialPreparations",
+		"ordinarySignerMaterialRecipientRequests",
+		"keyManifestDigestB64u"
+	], "LinkedDeviceTargetCredentialRegistrationResultV1");
+	if (record.kind !== "linked_device_target_credential_registration_result_v1") throw new Error("LinkedDeviceTargetCredentialRegistrationResultV1.kind is invalid");
+	if (record.outcome !== "applied" && record.outcome !== "replayed") throw new Error("LinkedDeviceTargetCredentialRegistrationResultV1.outcome is invalid");
+	const linkSessionId = parseSessionId(record.linkSessionId, "LinkedDeviceTargetCredentialRegistrationResultV1.linkSessionId");
+	const walletId = parseWallet(record.walletId, "LinkedDeviceTargetCredentialRegistrationResultV1.walletId");
+	const enrollmentId = parseEnrollmentId(record.enrollmentId, "LinkedDeviceTargetCredentialRegistrationResultV1.enrollmentId");
+	const deviceId = parseDeviceId(record.deviceId, "LinkedDeviceTargetCredentialRegistrationResultV1.deviceId");
+	const walletAuthMethodId = parseId(parseWalletAuthMethodId, record.walletAuthMethodId, "LinkedDeviceTargetCredentialRegistrationResultV1.walletAuthMethodId");
+	const targetPreparationDigestB64u = parseDigest(record.targetPreparationDigestB64u, "LinkedDeviceTargetCredentialRegistrationResultV1.targetPreparationDigestB64u");
+	const targetFactor = parseVerifiedTargetFactorV1(record.targetFactor, "LinkedDeviceTargetCredentialRegistrationResultV1.targetFactor");
+	if (targetFactor.authMethod.walletAuthMethodId !== walletAuthMethodId || targetFactor.authMethod.walletId !== walletId) throw new Error("LinkedDeviceTargetCredentialRegistrationResultV1 target identity differs");
+	const ordinarySignerMaterialPreparations = parseOrdinarySignerMaterialPreparationsV1(record.ordinarySignerMaterialPreparations);
+	const ordinarySignerMaterialRecipientRequests = parseOrdinarySignerMaterialRecipientRequestsV1(record.ordinarySignerMaterialRecipientRequests);
+	return {
+		kind: "linked_device_target_credential_registration_result_v1",
+		outcome: record.outcome,
+		linkSessionId,
+		walletId,
+		enrollmentId,
+		deviceId,
+		walletAuthMethodId,
+		targetPreparationDigestB64u,
+		targetFactor,
+		ordinarySignerMaterialPreparations,
+		ordinarySignerMaterialRecipientRequests,
+		keyManifestDigestB64u: parseDigest(record.keyManifestDigestB64u, "LinkedDeviceTargetCredentialRegistrationResultV1.keyManifestDigestB64u")
+	};
+}
+function parseVerifiedTargetFactorV1(raw, label) {
+	const record = requireRecord(raw, label);
+	if (record.kind === "verified_passkey_target_v1") {
+		exactRecord(record, [
+			"kind",
+			"authMethod",
+			"verificationDigestB64u",
+			"verifiedAtMs"
+		], label);
+		const authMethod = parsePasskeyWalletAuthMethodDraftV1(record.authMethod, `${label}.authMethod`);
+		const verifiedAtMs = parseUnixTime(record.verifiedAtMs, `${label}.verifiedAtMs`);
+		if (verifiedAtMs < authMethod.createdAtMs) throw new Error(`${label}.verifiedAtMs precedes authMethod.createdAtMs`);
+		return {
+			kind: "verified_passkey_target_v1",
+			authMethod,
+			verificationDigestB64u: parseDigest(record.verificationDigestB64u, `${label}.verificationDigestB64u`),
+			verifiedAtMs
+		};
+	}
+	if (record.kind === "verified_email_otp_target_v1") {
+		const enrollment = parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`);
+		const exact = exactRecord(record, enrollment.kind === "existing_enrollment" ? [
+			"kind",
+			"authMethod",
+			"targetEmail",
+			"enrollment",
+			"baseWalletAuthMethodId",
+			"providerUserId",
+			"verificationDigestB64u",
+			"verifiedAtMs"
+		] : [
+			"kind",
+			"authMethod",
+			"targetEmail",
+			"enrollment",
+			"providerUserId",
+			"verificationDigestB64u",
+			"verifiedAtMs"
+		], label);
+		const authMethod = parseEmailOtpWalletAuthMethodDraftV1(record.authMethod, `${label}.authMethod`);
+		const verifiedAtMs = parseUnixTime(record.verifiedAtMs, `${label}.verifiedAtMs`);
+		if (verifiedAtMs < authMethod.createdAtMs) throw new Error(`${label}.verifiedAtMs precedes authMethod.createdAtMs`);
+		const targetEmail = parseTargetEmail(record.targetEmail, `${label}.targetEmail`);
+		const providerUserId = parseNonEmptyToken(record.providerUserId, `${label}.providerUserId`);
+		const verificationDigestB64u = parseDigest(record.verificationDigestB64u, `${label}.verificationDigestB64u`);
+		if (enrollment.kind === "existing_enrollment") return {
+			kind: "verified_email_otp_target_v1",
+			authMethod,
+			targetEmail,
+			enrollment,
+			baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, exact.baseWalletAuthMethodId, `${label}.baseWalletAuthMethodId`),
+			providerUserId,
+			verificationDigestB64u,
+			verifiedAtMs
+		};
+		return {
+			kind: "verified_email_otp_target_v1",
+			authMethod,
+			targetEmail,
+			enrollment,
+			providerUserId,
+			verificationDigestB64u,
+			verifiedAtMs
+		};
+	}
+	throw new Error(`${label}.kind is invalid`);
+}
+function parsePasskeyWalletAuthMethodDraftV1(raw, label) {
+	const record = exactRecord(raw, [
+		"walletAuthMethodId",
+		"walletId",
+		"createdAtMs",
+		"kind",
+		"rpId",
+		"credentialIdB64u",
+		"credentialPublicKeyB64u",
+		"counter"
+	], label);
+	if (record.kind !== "passkey") throw new Error(`${label}.kind is invalid`);
+	return {
+		walletAuthMethodId: parseId(parseWalletAuthMethodId, record.walletAuthMethodId, `${label}.walletAuthMethodId`),
+		walletId: parseWallet(record.walletId, `${label}.walletId`),
+		createdAtMs: parseUnixTime(record.createdAtMs, `${label}.createdAtMs`),
+		kind: "passkey",
+		rpId: parseId(parseWebAuthnRpId, record.rpId, `${label}.rpId`),
+		credentialIdB64u: parseId(parseWebAuthnCredentialIdB64u, record.credentialIdB64u, `${label}.credentialIdB64u`),
+		credentialPublicKeyB64u: parseCanonicalBase64UrlBytes(record.credentialPublicKeyB64u, `${label}.credentialPublicKeyB64u`),
+		counter: parseNonNegativeInteger(record.counter, `${label}.counter`)
+	};
+}
+function parseEmailOtpWalletAuthMethodDraftV1(raw, label) {
+	const record = exactRecord(raw, [
+		"walletAuthMethodId",
+		"walletId",
+		"createdAtMs",
+		"kind",
+		"emailHashHex",
+		"registrationAuthorityId"
+	], label);
+	if (record.kind !== "email_otp") throw new Error(`${label}.kind is invalid`);
+	return {
+		walletAuthMethodId: parseId(parseWalletAuthMethodId, record.walletAuthMethodId, `${label}.walletAuthMethodId`),
+		walletId: parseWallet(record.walletId, `${label}.walletId`),
+		createdAtMs: parseUnixTime(record.createdAtMs, `${label}.createdAtMs`),
+		kind: "email_otp",
+		emailHashHex: parseEmailHashHex(record.emailHashHex, `${label}.emailHashHex`),
+		registrationAuthorityId: parseNonEmptyToken(record.registrationAuthorityId, `${label}.registrationAuthorityId`)
+	};
+}
+function parseLinkedDeviceEmailOtpVerificationGrantV1(raw) {
+	const candidate = requireRecord(raw, "LinkedDeviceEmailOtpVerificationGrantV1");
+	const enrollment = parseEmailOtpEnrollmentSelection(candidate.enrollment, "LinkedDeviceEmailOtpVerificationGrantV1.enrollment");
+	const record = exactRecord(candidate, enrollment.kind === "new_enrollment" ? EMAIL_OTP_VERIFICATION_GRANT_BASE_FIELDS : EMAIL_OTP_VERIFICATION_GRANT_FIELDS, "LinkedDeviceEmailOtpVerificationGrantV1");
+	if (record.kind !== "linked_device_email_otp_verification_grant_v1") throw new Error("LinkedDeviceEmailOtpVerificationGrantV1.kind is invalid");
+	const issuedAtMs = parseUnixTime(record.issuedAtMs, "LinkedDeviceEmailOtpVerificationGrantV1.issuedAtMs");
+	const expiresAtMs = parseUnixTime(record.expiresAtMs, "LinkedDeviceEmailOtpVerificationGrantV1.expiresAtMs");
+	assertExpiryAfterIssued(issuedAtMs, expiresAtMs, "LinkedDeviceEmailOtpVerificationGrantV1");
+	const base = {
+		kind: "linked_device_email_otp_verification_grant_v1",
+		grantId: parseNonEmptyToken(record.grantId, "LinkedDeviceEmailOtpVerificationGrantV1.grantId"),
+		grantToken: parseNonEmptyToken(record.grantToken, "LinkedDeviceEmailOtpVerificationGrantV1.grantToken"),
+		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpVerificationGrantV1.challengeId"),
+		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "LinkedDeviceEmailOtpVerificationGrantV1.linkSessionId"),
+		walletId: parseId(parseWalletId, record.walletId, "LinkedDeviceEmailOtpVerificationGrantV1.walletId"),
+		enrollmentId: parseId(parseLinkedDeviceEnrollmentId, record.enrollmentId, "LinkedDeviceEmailOtpVerificationGrantV1.enrollmentId"),
+		deviceId: parseId(parseLinkedDeviceId, record.deviceId, "LinkedDeviceEmailOtpVerificationGrantV1.deviceId"),
+		targetPreparationDigestB64u: parseDigest(record.targetPreparationDigestB64u, "LinkedDeviceEmailOtpVerificationGrantV1.targetPreparationDigestB64u"),
+		targetEmail: parseTargetEmail(record.targetEmail, "LinkedDeviceEmailOtpVerificationGrantV1.targetEmail"),
+		enrollment,
+		emailHashHex: parseEmailHashHex(record.emailHashHex, "LinkedDeviceEmailOtpVerificationGrantV1.emailHashHex"),
+		registrationAuthorityId: parseNonEmptyToken(record.registrationAuthorityId, "LinkedDeviceEmailOtpVerificationGrantV1.registrationAuthorityId"),
+		providerUserId: parseNonEmptyToken(record.providerUserId, "LinkedDeviceEmailOtpVerificationGrantV1.providerUserId"),
+		authorityDigestB64u: parseDigest(record.authorityDigestB64u, "LinkedDeviceEmailOtpVerificationGrantV1.authorityDigestB64u"),
+		issuedAtMs,
+		expiresAtMs
+	};
+	if (enrollment.kind === "new_enrollment") return {
+		...base,
+		enrollment: { kind: "new_enrollment" }
+	};
+	return {
+		...base,
+		enrollment: { kind: "existing_enrollment" },
+		baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, record.baseWalletAuthMethodId, "LinkedDeviceEmailOtpVerificationGrantV1.baseWalletAuthMethodId")
+	};
+}
+function parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1(raw) {
+	const record = exactRecord(raw, EMAIL_OTP_FACTOR_RELEASE_FIELDS, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1");
+	if (record.kind !== "email_otp_factor_release_v1") throw new Error("LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.kind is invalid");
+	return {
+		kind: "email_otp_factor_release_v1",
+		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.challengeId"),
+		enrollmentId: parseNonEmptyToken(record.enrollmentId, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.enrollmentId"),
+		enrollmentSealKeyVersion: parseNonEmptyToken(record.enrollmentSealKeyVersion, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.enrollmentSealKeyVersion"),
+		serverEphemeralPublicKey65B64u: parseUncompressedP256PointB64u(record.serverEphemeralPublicKey65B64u, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.serverEphemeralPublicKey65B64u"),
+		nonce12B64u: parseCanonicalFixedBase64UrlBytes(record.nonce12B64u, 12, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.nonce12B64u"),
+		ciphertextB64u: parseCanonicalBase64UrlBytes(record.ciphertextB64u, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.ciphertextB64u")
+	};
+}
+function parseLinkedDeviceEmailOtpChallengeStartRequestV1(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"linkSessionId",
+		"workerEphemeralPublicKey65B64u"
+	], "LinkedDeviceEmailOtpChallengeStartRequestV1");
+	if (record.kind !== "linked_device_email_otp_challenge_start_request_v1") throw new Error("LinkedDeviceEmailOtpChallengeStartRequestV1.kind is invalid");
+	return {
+		kind: "linked_device_email_otp_challenge_start_request_v1",
+		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "LinkedDeviceEmailOtpChallengeStartRequestV1.linkSessionId"),
+		workerEphemeralPublicKey65B64u: parseUncompressedP256PointB64u(record.workerEphemeralPublicKey65B64u, "LinkedDeviceEmailOtpChallengeStartRequestV1.workerEphemeralPublicKey65B64u")
+	};
+}
+function parseLinkedDeviceEmailOtpChallengeResendRequestV1(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"linkSessionId",
+		"challengeId"
+	], "LinkedDeviceEmailOtpChallengeResendRequestV1");
+	if (record.kind !== "linked_device_email_otp_challenge_resend_request_v1") throw new Error("LinkedDeviceEmailOtpChallengeResendRequestV1.kind is invalid");
+	return {
+		kind: "linked_device_email_otp_challenge_resend_request_v1",
+		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "LinkedDeviceEmailOtpChallengeResendRequestV1.linkSessionId"),
+		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpChallengeResendRequestV1.challengeId")
+	};
+}
+function parseLinkedDeviceEmailOtpChallengeVerifyRequestV1(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"linkSessionId",
+		"challengeId",
+		"otpCode"
+	], "LinkedDeviceEmailOtpChallengeVerifyRequestV1");
+	if (record.kind !== "linked_device_email_otp_challenge_verify_request_v1") throw new Error("LinkedDeviceEmailOtpChallengeVerifyRequestV1.kind is invalid");
+	if (typeof record.otpCode !== "string" || !/^[0-9]{6,10}$/.test(record.otpCode)) throw new Error("LinkedDeviceEmailOtpChallengeVerifyRequestV1.otpCode is invalid");
+	return {
+		kind: "linked_device_email_otp_challenge_verify_request_v1",
+		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "LinkedDeviceEmailOtpChallengeVerifyRequestV1.linkSessionId"),
+		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpChallengeVerifyRequestV1.challengeId"),
+		otpCode: record.otpCode
+	};
+}
+function parseLinkedDeviceEmailOtpChallengeResultV1(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"challengeId",
+		"maskedEmailHint",
+		"expiresAtMs",
+		"resendAvailableAtMs"
+	], "LinkedDeviceEmailOtpChallengeResultV1");
+	if (record.kind !== "linked_device_email_otp_challenge_result_v1") throw new Error("LinkedDeviceEmailOtpChallengeResultV1.kind is invalid");
+	const expiresAtMs = parseUnixTime(record.expiresAtMs, "LinkedDeviceEmailOtpChallengeResultV1.expiresAtMs");
+	const resendAvailableAtMs = parseUnixTime(record.resendAvailableAtMs, "LinkedDeviceEmailOtpChallengeResultV1.resendAvailableAtMs");
+	return {
+		kind: "linked_device_email_otp_challenge_result_v1",
+		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpChallengeResultV1.challengeId"),
+		maskedEmailHint: parseNonEmptyToken(record.maskedEmailHint, "LinkedDeviceEmailOtpChallengeResultV1.maskedEmailHint"),
+		expiresAtMs,
+		resendAvailableAtMs
+	};
+}
+function parseLinkedDeviceEmailOtpVerificationResultV1(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"verificationGrant",
+		"factorRelease"
+	], "LinkedDeviceEmailOtpVerificationResultV1");
+	if (record.kind !== "linked_device_email_otp_verification_result_v1") throw new Error("LinkedDeviceEmailOtpVerificationResultV1.kind is invalid");
+	const verificationGrant = parseLinkedDeviceEmailOtpVerificationGrantV1(record.verificationGrant);
+	if (isNewEnrollmentEmailOtpVerificationGrantV1(verificationGrant)) {
+		if (record.factorRelease !== null) throw new Error("new linked-device Email OTP enrollment cannot carry a factor release");
+		return {
+			kind: "linked_device_email_otp_verification_result_v1",
+			verificationGrant,
+			factorRelease: null
+		};
+	}
+	const factorRelease = parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1(record.factorRelease);
+	if (factorRelease.challengeId !== verificationGrant.challengeId) throw new Error("LinkedDeviceEmailOtpVerificationResultV1 challenge binding changed");
+	return {
+		kind: "linked_device_email_otp_verification_result_v1",
+		verificationGrant,
+		factorRelease
+	};
+}
+function isNewEnrollmentEmailOtpVerificationGrantV1(grant) {
+	return grant.enrollment.kind === "new_enrollment";
+}
+function parseCancelUnclaimedRequest(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"linkSessionId",
+		"reason",
+		"requestedAtMs"
+	], "LinkedDeviceSessionCancelUnclaimedRequestV1");
+	if (record.kind !== "linked_device_session_cancel_unclaimed_request_v1" || record.reason !== "user_cancelled") throw new Error("LinkedDeviceSessionCancelUnclaimedRequestV1 is invalid");
+	return {
+		kind: "linked_device_session_cancel_unclaimed_request_v1",
+		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceSessionCancelUnclaimedRequestV1.linkSessionId"),
+		reason: "user_cancelled",
+		requestedAtMs: parseUnixTime(record.requestedAtMs, "LinkedDeviceSessionCancelUnclaimedRequestV1.requestedAtMs")
+	};
+}
+function parseCancelClaimedRequest(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"linkSessionId",
+		"enrollmentId",
+		"deviceId",
+		"reason",
+		"requestedAtMs"
+	], "LinkedDeviceSessionCancelClaimedRequestV1");
+	if (record.kind !== "linked_device_session_cancel_claimed_request_v1") throw new Error("LinkedDeviceSessionCancelClaimedRequestV1.kind is invalid");
+	if (record.reason !== "user_cancelled" && record.reason !== "expired" && record.reason !== "revoked") throw new Error("LinkedDeviceSessionCancelClaimedRequestV1.reason is unsupported");
+	return {
+		kind: "linked_device_session_cancel_claimed_request_v1",
+		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceSessionCancelClaimedRequestV1.linkSessionId"),
+		enrollmentId: parseEnrollmentId(record.enrollmentId, "LinkedDeviceSessionCancelClaimedRequestV1.enrollmentId"),
+		deviceId: parseDeviceId(record.deviceId, "LinkedDeviceSessionCancelClaimedRequestV1.deviceId"),
+		reason: record.reason,
+		requestedAtMs: parseUnixTime(record.requestedAtMs, "LinkedDeviceSessionCancelClaimedRequestV1.requestedAtMs")
+	};
+}
+function parseRetryRequest(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"linkSessionId",
+		"enrollmentId",
+		"deviceId",
+		"requestedAtMs"
+	], "LinkedDeviceSessionRetryCommittedDeliveryRequestV1");
+	if (record.kind !== "linked_device_session_retry_committed_delivery_request_v1") throw new Error("LinkedDeviceSessionRetryCommittedDeliveryRequestV1.kind is invalid");
+	return {
+		kind: "linked_device_session_retry_committed_delivery_request_v1",
+		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceSessionRetryCommittedDeliveryRequestV1.linkSessionId"),
+		enrollmentId: parseEnrollmentId(record.enrollmentId, "LinkedDeviceSessionRetryCommittedDeliveryRequestV1.enrollmentId"),
+		deviceId: parseDeviceId(record.deviceId, "LinkedDeviceSessionRetryCommittedDeliveryRequestV1.deviceId"),
+		requestedAtMs: parseUnixTime(record.requestedAtMs, "LinkedDeviceSessionRetryCommittedDeliveryRequestV1.requestedAtMs")
+	};
+}
+function parseLinkedDeviceSessionTransportRequestV1(raw) {
+	const record = requireRecord(raw, "LinkedDeviceSessionTransportRequestV1");
+	switch (record.kind) {
+		case "linked_device_session_claim_request_v1": return parseLinkedDeviceSessionClaimRequestV1(record);
+		case "linked_device_approval_v1": return parseLinkedDeviceApprovalV1(record);
+		case "linked_device_target_credential_registration_v1": return parseLinkedDeviceTargetCredentialRegistrationV1(record);
+		case "linked_device_session_cancel_unclaimed_request_v1": return parseCancelUnclaimedRequest(record);
+		case "linked_device_session_cancel_claimed_request_v1": return parseCancelClaimedRequest(record);
+		case "linked_device_session_retry_committed_delivery_request_v1": return parseRetryRequest(record);
+		default: throw new Error("LinkedDeviceSessionTransportRequestV1.kind is unsupported");
+	}
+}
+function buildWalletSessionLinkedDeviceOwnerAuthorizationV1(args) {
+	return {
+		kind: "wallet_session",
+		walletSessionId: args.walletSessionId,
+		authorizationId: args.authorizationId
+	};
+}
+function buildLinkedDeviceTargetPreparationV1(args) {
+	return parseLinkedDeviceTargetPreparationV1({
+		kind: "linked_device_target_preparation_v1",
+		...args
+	});
+}
+const LOCAL_AUTHORITY_INSTALLATION_RECEIPT_FIELDS = [
+	"kind",
+	"authorityId",
+	"walletId",
+	"authMethodId",
+	"deviceId",
+	"packageSetDigestB64u",
+	"installedActivationRefs",
+	"installedRecordSetDigestB64u",
+	"targetFactorVerificationDigestB64u",
+	"installedAtMs"
+];
+function parseLocalAuthorityInstallationReceiptV1(raw) {
+	const record = exactRecord(raw, LOCAL_AUTHORITY_INSTALLATION_RECEIPT_FIELDS, "LocalAuthorityInstallationReceiptV1");
+	if (record.kind !== "local_authority_installation_receipt_v1") throw new Error("LocalAuthorityInstallationReceiptV1.kind is invalid");
+	const installedActivationResult = parseWalletSignerActivationSetV1(record.installedActivationRefs);
+	if (!installedActivationResult.ok) throw new Error(`LocalAuthorityInstallationReceiptV1.installedActivationRefs ${installedActivationResult.error}`);
+	return {
+		kind: "local_authority_installation_receipt_v1",
+		authorityId: parseId(parseWalletAuthorityId, record.authorityId, "authorityId"),
+		walletId: parseId(parseWalletId, record.walletId, "walletId"),
+		authMethodId: parseId(parseWalletAuthMethodId, record.authMethodId, "authMethodId"),
+		deviceId: parseId(parseDeviceId$1, record.deviceId, "deviceId"),
+		packageSetDigestB64u: parseDigest(record.packageSetDigestB64u, "packageSetDigestB64u"),
+		installedActivationRefs: installedActivationResult.value,
+		installedRecordSetDigestB64u: parseDigest(record.installedRecordSetDigestB64u, "installedRecordSetDigestB64u"),
+		targetFactorVerificationDigestB64u: parseDigest(record.targetFactorVerificationDigestB64u, "targetFactorVerificationDigestB64u"),
+		installedAtMs: parseUnixTime(record.installedAtMs, "installedAtMs")
+	};
+}
+const ACTIVE_WALLET_SESSION_FIELDS = [
+	"kind",
+	"walletId",
+	"authorityId",
+	"authMethodId",
+	"authorizationId",
+	"quotaId",
+	"authorityDigestB64u",
+	"authorityRevocationEpoch",
+	"capabilitySubjects",
+	"issuedAtMs",
+	"expiresAtMs"
+];
+const WALLET_SESSION_OPERATION_CREDENTIAL_FIELDS = [
+	"kind",
+	"token",
+	"walletSessionId"
+];
+function parseWalletSessionOperationCredentialV1(raw) {
+	const record = exactRecord(raw, WALLET_SESSION_OPERATION_CREDENTIAL_FIELDS, "WalletSessionOperationCredentialV1");
+	if (typeof record.token !== "string" || record.token.length > 8192) throw new Error("WalletSessionOperationCredentialV1.token is invalid");
+	if (record.kind === "opaque_wallet_session_operation_credential_v1") {
+		if (!/^wst_[A-Za-z0-9_-]{43}$/.test(record.token)) throw new Error("WalletSessionOperationCredentialV1 opaque token is invalid");
+		return {
+			kind: record.kind,
+			token: record.token,
+			walletSessionId: parseId(parseWalletSessionId, record.walletSessionId, "walletSessionId")
+		};
+	}
+	throw new Error("WalletSessionOperationCredentialV1.kind is invalid");
+}
+function parseActiveWalletSessionV1(raw) {
+	const record = exactRecord(raw, ACTIVE_WALLET_SESSION_FIELDS, "ActiveWalletSessionV1");
+	if (record.kind !== "active_wallet_session_v1") throw new Error("ActiveWalletSessionV1.kind is invalid");
+	if (!Array.isArray(record.capabilitySubjects) || record.capabilitySubjects.length === 0) throw new Error("ActiveWalletSessionV1.capabilitySubjects must be non-empty");
+	const capabilitySubjects = [];
+	const subjectKeys = /* @__PURE__ */ new Set();
+	for (const [index, rawSubject] of record.capabilitySubjects.entries()) {
+		const subject = parseWalletCapabilitySubjectV1(rawSubject, `capabilitySubjects[${index}]`);
+		const key = subject.kind === "sign" || subject.kind === "export_keys" ? `${subject.kind}:${subject.keyFamily}:${subject.materialActivation.activationId}` : subject.kind;
+		if (subjectKeys.has(key)) throw new Error("ActiveWalletSessionV1 capability subjects repeat");
+		subjectKeys.add(key);
+		capabilitySubjects.push(subject);
+	}
+	const first = capabilitySubjects[0];
+	if (!first) throw new Error("ActiveWalletSessionV1.capabilitySubjects must be non-empty");
+	return {
+		kind: "active_wallet_session_v1",
+		walletId: parseId(parseWalletId, record.walletId, "walletId"),
+		authorityId: parseId(parseWalletAuthorityId, record.authorityId, "authorityId"),
+		authMethodId: parseId(parseWalletAuthMethodId, record.authMethodId, "authMethodId"),
+		authorizationId: parseId(parseWalletSessionAuthorizationId, record.authorizationId, "authorizationId"),
+		quotaId: parseId(parseMpcWalletSigningQuotaId, record.quotaId, "quotaId"),
+		authorityDigestB64u: parseDigest(record.authorityDigestB64u, "authorityDigestB64u"),
+		authorityRevocationEpoch: parseNonNegativeInteger(record.authorityRevocationEpoch, "authorityRevocationEpoch"),
+		capabilitySubjects: [first, ...capabilitySubjects.slice(1)],
+		issuedAtMs: parseUnixTime(record.issuedAtMs, "issuedAtMs"),
+		expiresAtMs: parseUnixTime(record.expiresAtMs, "expiresAtMs")
+	};
+}
+function parseWalletCapabilitySubjectV1(raw, label) {
+	const record = requireRecord(raw, label);
+	if (record.kind === "link_devices" || record.kind === "revoke_devices") {
+		rejectUnknownFields(record, ["kind"], label);
+		return { kind: record.kind };
+	}
+	if (record.kind !== "sign" && record.kind !== "export_keys") throw new Error(`${label}.kind is invalid`);
+	rejectUnknownFields(record, [
+		"kind",
+		"keyFamily",
+		"materialActivation"
+	], label);
+	if (record.keyFamily !== "ed25519" && record.keyFamily !== "ecdsa_secp256k1") throw new Error(`${label}.keyFamily is invalid`);
+	return {
+		kind: record.kind,
+		keyFamily: record.keyFamily,
+		materialActivation: parseId(parseMpcMaterialActivationRef, record.materialActivation, `${label}.materialActivation`)
+	};
+}
+function parseNonNegativeInteger(raw, label) {
+	if (!Number.isSafeInteger(raw) || Number(raw) < 0) throw new Error(`${label} must be a non-negative safe integer`);
+	return Number(raw);
+}
+const LOCAL_AUTHORITY_ACTIVATION_FINAL_ACK_FIELDS = [
+	"kind",
+	"linkSessionId",
+	"authorityId",
+	"packageSetDigestB64u",
+	"authorizationId",
+	"walletSessionId",
+	"credentialDigestB64u",
+	"installationReceiptDigestB64u",
+	"acknowledgedAtMs"
+];
+function parseLocalAuthorityActivationFinalAckV1(raw) {
+	const record = exactRecord(raw, LOCAL_AUTHORITY_ACTIVATION_FINAL_ACK_FIELDS, "LocalAuthorityActivationFinalAckV1");
+	if (record.kind !== "local_authority_activation_final_ack_v1") throw new Error("LocalAuthorityActivationFinalAckV1.kind is invalid");
+	return {
+		kind: "local_authority_activation_final_ack_v1",
+		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "linkSessionId"),
+		authorityId: parseId(parseWalletAuthorityId, record.authorityId, "authorityId"),
+		packageSetDigestB64u: parseDigest(record.packageSetDigestB64u, "packageSetDigestB64u"),
+		authorizationId: parseId(parseWalletSessionAuthorizationId, record.authorizationId, "authorizationId"),
+		walletSessionId: parseId(parseWalletSessionId, record.walletSessionId, "walletSessionId"),
+		credentialDigestB64u: parseDigest(record.credentialDigestB64u, "credentialDigestB64u"),
+		installationReceiptDigestB64u: parseDigest(record.installationReceiptDigestB64u, "installationReceiptDigestB64u"),
+		acknowledgedAtMs: parseUnixTime(record.acknowledgedAtMs, "acknowledgedAtMs")
+	};
+}
+//#endregion
+export { buildLinkedDeviceTargetPreparationV1, buildWalletSessionLinkedDeviceOwnerAuthorizationV1, parseActiveWalletSessionV1, parseLinkDevicePublicKeyB64u, parseLinkSessionStateV1, parseLinkedDeviceApprovalDeliveryV1, parseLinkedDeviceApprovalV1, parseLinkedDeviceEmailOtpBaseFactorRequestV1, parseLinkedDeviceEmailOtpChallengeResendRequestV1, parseLinkedDeviceEmailOtpChallengeResultV1, parseLinkedDeviceEmailOtpChallengeStartRequestV1, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1, parseLinkedDeviceEmailOtpVerificationGrantV1, parseLinkedDeviceEmailOtpVerificationResultV1, parseLinkedDeviceListRequestV1, parseLinkedDeviceOwnerAuthorizationRequestV1, parseLinkedDeviceOwnerAuthorizationSourceV1, parseLinkedDeviceRevokeRequestV1, parseLinkedDeviceSessionClaimRequestV1, parseLinkedDeviceSessionClaimV1, parseLinkedDeviceSessionTransportRequestV1, parseLinkedDeviceTargetCredentialRegistrationResultV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationRequestV1, parseLinkedDeviceTargetPreparationV1, parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1, parseQrLinkedDeviceSessionPayloadV5, parseWalletSessionOperationCredentialV1 };
+
+//# sourceMappingURL=parsers.js.map