@seams/wallet-server 0.5.0

package/dist/esm/shared-ts/src/signing-lanes/rotationParsers.js

@@ -0,0 +1,1620 @@
+import { hasWhitespaceOrControlCharacters, parseEcdsaRelayerKeyId, parseEd25519YaoSuiteId, parseLaneEnrollmentId, parseLaneOperationId as parseLaneOperationId$1, parseLaneOperationIdempotencyKey, parseLaneShareEpoch, parseLinkedDeviceEnrollmentId, parseMpcMaterialActivationId, parseMpcMaterialActivationRef, parseSigningLaneId, parseThresholdEcdsaSessionId, parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
+import { parseAuthorizedOperationId } from "../authorization/capabilityKinds.js";
+import { parseCorrelationId, parseDigestB64u, parseIsoTimestamp } from "../utils/canonicalPrimitives.js";
+import { parseEd25519PublicKeyB64u, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, rejectUnknownFields, requireRecord } from "../passkey-custody/primitives.js";
+import { parseNearEd25519SigningKeyId } from "../utils/registrationIntent.js";
+import { parseEvmFamilySigningKeySlotId } from "./evmFamilySigningKeySlotId.js";
+import { parseSdkEcdsaDerivationThresholdKeyId } from "../threshold/ecdsaDerivationRoleLocalBootstrap.js";
+import { parseEcdsaCapabilityManifestId, parseEcdsaCapabilityManifestRevision, parseEcdsaLifecycleId, parseEcdsaServerGeneration } from "../utils/ecdsaCapabilityActivation.js";
+import { parseHpkePublicKeyB64u, parseLaneCustodyBindingDigestB64u, parseLaneHolderCustodyBindingId, parseLaneHolderParticipantId, parseLaneHolderParticipantRecordV1, parseLaneParticipantBindingDigestB64u, parseSigningWorkerParticipantId, parseSigningWorkerParticipantRecordV1, parseSigningWorkerRecipientKeyDigestB64u, parseSigningWorkerRecipientKeyId } from "./participants.js";
+import { parseOwnerLaneParticipantContinuityV1 } from "./ownerContinuity.js";
+//#region ../shared-ts/src/signing-lanes/rotationParsers.ts
+const NON_EMPTY_FIELDS = {
+	authorization: [
+		"kind",
+		"authorizedOperationId",
+		"linkedDeviceEnrollmentId",
+		"linkedDevicePermissionDigestB64u"
+	],
+	refreshAuthorization: [
+		"kind",
+		"authorizedOperationId",
+		"ownerLaneRefreshDigestB64u"
+	],
+	ownerSource: [
+		"laneId",
+		"laneKind",
+		"sourceKind",
+		"laneShareEpoch",
+		"revocationEpoch",
+		"ownerParticipantContinuity",
+		"participantBindingDigestB64u",
+		"materialActivation"
+	],
+	provisionedSource: [
+		"laneId",
+		"laneKind",
+		"sourceKind",
+		"laneShareEpoch",
+		"revocationEpoch",
+		"holderParticipantId",
+		"signingWorkerParticipantId",
+		"signingWorkerRecipientKeyId",
+		"participantBindingDigestB64u",
+		"materialActivation"
+	],
+	holder: [
+		"participantId",
+		"participantBindingDigestB64u",
+		"custodyBindingId",
+		"custodyBindingDigestB64u",
+		"hpkePublicKeyB64u",
+		"hpkePublicKeyDigestB64u"
+	],
+	worker: [
+		"participantId",
+		"participantBindingDigestB64u",
+		"recipientKeyId",
+		"hpkePublicKeyB64u",
+		"hpkePublicKeyDigestB64u"
+	]
+};
+function requiredField(record, field, label) {
+	if (!Object.prototype.hasOwnProperty.call(record, field) || record[field] === void 0) throw new Error(`${label}.${field} is required`);
+	return record[field];
+}
+function exactRecord(raw, fields, label) {
+	const record = requireRecord(raw, label);
+	rejectUnknownFields(record, fields, label);
+	for (const field of fields) requiredField(record, field, label);
+	return record;
+}
+function requiredString(raw, label) {
+	if (typeof raw !== "string") throw new Error(`${label} must be a string`);
+	const value = raw.trim();
+	if (!value) throw new Error(`${label} is required`);
+	if (hasWhitespaceOrControlCharacters(value)) throw new Error(`${label} must not contain whitespace or control characters`);
+	return value;
+}
+function requiredInteger(raw, label, allowZero = true) {
+	if (!Number.isSafeInteger(raw) || Number(raw) < (allowZero ? 0 : 1)) throw new Error(`${label} must be a ${allowZero ? "non-negative" : "positive"} safe integer`);
+	return Number(raw);
+}
+function resultValue(result, label) {
+	if (result.ok) return result.value;
+	throw new Error(`${label} ${result.error.message}`);
+}
+function digest(raw, label) {
+	try {
+		return parseDigestB64u(raw);
+	} catch (error) {
+		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
+	}
+}
+function parseIso(raw, label) {
+	try {
+		return parseIsoTimestamp(raw);
+	} catch (error) {
+		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
+	}
+}
+function parseMpcActivation(raw, label) {
+	return resultValue(parseMpcMaterialActivationRef(raw), label);
+}
+function nonEmptyTuple(values, label) {
+	if (values.length === 0) throw new Error(`${label} must be non-empty`);
+	const [first, ...rest] = values;
+	return [first, ...rest];
+}
+function parseLaneOperationId(raw, label) {
+	return resultValue(parseLaneOperationId$1(raw), label);
+}
+function parseEnrollmentId(raw, label) {
+	return resultValue(parseLaneEnrollmentId(raw), label);
+}
+function parseOperationIdempotencyKey(raw, label) {
+	return resultValue(parseLaneOperationIdempotencyKey(raw), label);
+}
+function parseLinkedDeviceEnrollmentIdValue(raw, label) {
+	return resultValue(parseLinkedDeviceEnrollmentId(raw), label);
+}
+function parseLaneId(raw, label) {
+	return resultValue(parseSigningLaneId(raw), label);
+}
+function parseShareEpoch(raw, label) {
+	return resultValue(parseLaneShareEpoch(raw), label);
+}
+function parseKeyId(raw, label) {
+	return resultValue(parseWalletKeyId(raw), label);
+}
+function parseLaneKind(raw, label) {
+	switch (raw) {
+		case "owner_passkey":
+		case "owner_email_otp":
+		case "linked_device":
+		case "delegated_execution":
+		case "recovery":
+		case "break_glass": return raw;
+		default: throw new Error(`${label} must be a known signing lane kind`);
+	}
+}
+function parseKeyFamily(raw, label) {
+	if (raw === "ed25519" || raw === "ecdsa_secp256k1") return raw;
+	throw new Error(`${label} must be ed25519 or ecdsa_secp256k1`);
+}
+function parseAuthorization(raw, label = "authorization") {
+	const record = requireRecord(raw, label);
+	switch (record.kind) {
+		case "linked_device_enrollment": {
+			const value = exactRecord(record, NON_EMPTY_FIELDS.authorization, label);
+			return {
+				kind: "linked_device_enrollment",
+				authorizedOperationId: resultValue(parseAuthorizedOperationId(value.authorizedOperationId), `${label}.authorizedOperationId`),
+				linkedDeviceEnrollmentId: parseLinkedDeviceEnrollmentIdValue(value.linkedDeviceEnrollmentId, `${label}.linkedDeviceEnrollmentId`),
+				linkedDevicePermissionDigestB64u: digest(value.linkedDevicePermissionDigestB64u, `${label}.linkedDevicePermissionDigestB64u`)
+			};
+		}
+		case "owner_lane_refresh": {
+			const value = exactRecord(record, NON_EMPTY_FIELDS.refreshAuthorization, label);
+			return {
+				kind: "owner_lane_refresh",
+				authorizedOperationId: resultValue(parseAuthorizedOperationId(value.authorizedOperationId), `${label}.authorizedOperationId`),
+				ownerLaneRefreshDigestB64u: digest(value.ownerLaneRefreshDigestB64u, `${label}.ownerLaneRefreshDigestB64u`)
+			};
+		}
+		default: throw new Error(`${label}.kind is invalid`);
+	}
+}
+function parseSource(raw, label = "source") {
+	const baseRecord = requireRecord(raw, label);
+	const laneKind = parseLaneKind(baseRecord.laneKind, `${label}.laneKind`);
+	if (laneKind === "owner_passkey" || laneKind === "owner_email_otp") {
+		const record = exactRecord(baseRecord, NON_EMPTY_FIELDS.ownerSource, label);
+		if (record.sourceKind !== "owner_registration") throw new Error(`${label}.sourceKind must be owner_registration`);
+		return {
+			sourceKind: "owner_registration",
+			laneId: parseLaneId(record.laneId, `${label}.laneId`),
+			laneKind,
+			laneShareEpoch: parseShareEpoch(record.laneShareEpoch, `${label}.laneShareEpoch`),
+			revocationEpoch: requiredInteger(record.revocationEpoch, `${label}.revocationEpoch`),
+			ownerParticipantContinuity: parseOwnerLaneParticipantContinuityV1(record.ownerParticipantContinuity, `${label}.ownerParticipantContinuity`),
+			participantBindingDigestB64u: resultValue(parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u), `${label}.participantBindingDigestB64u`),
+			materialActivation: parseMpcActivation(record.materialActivation, `${label}.materialActivation`)
+		};
+	}
+	const record = exactRecord(baseRecord, NON_EMPTY_FIELDS.provisionedSource, label);
+	if (record.sourceKind !== "provisioned_lane") throw new Error(`${label}.sourceKind must be provisioned_lane`);
+	return {
+		sourceKind: "provisioned_lane",
+		laneId: parseLaneId(record.laneId, `${label}.laneId`),
+		laneKind,
+		laneShareEpoch: parseShareEpoch(record.laneShareEpoch, `${label}.laneShareEpoch`),
+		revocationEpoch: requiredInteger(record.revocationEpoch, `${label}.revocationEpoch`),
+		holderParticipantId: resultValue(parseLaneHolderParticipantId(record.holderParticipantId), `${label}.holderParticipantId`),
+		signingWorkerParticipantId: resultValue(parseSigningWorkerParticipantId(record.signingWorkerParticipantId), `${label}.signingWorkerParticipantId`),
+		signingWorkerRecipientKeyId: resultValue(parseSigningWorkerRecipientKeyId(record.signingWorkerRecipientKeyId), `${label}.signingWorkerRecipientKeyId`),
+		participantBindingDigestB64u: resultValue(parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u), `${label}.participantBindingDigestB64u`),
+		materialActivation: parseMpcActivation(record.materialActivation, `${label}.materialActivation`)
+	};
+}
+function parseTargetHolder(raw, label = "targetHolder") {
+	const record = exactRecord(raw, NON_EMPTY_FIELDS.holder, label);
+	return {
+		participantId: resultValue(parseLaneHolderParticipantId(record.participantId), `${label}.participantId`),
+		participantBindingDigestB64u: resultValue(parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u), `${label}.participantBindingDigestB64u`),
+		custodyBindingId: resultValue(parseLaneHolderCustodyBindingId(record.custodyBindingId), `${label}.custodyBindingId`),
+		custodyBindingDigestB64u: resultValue(parseLaneCustodyBindingDigestB64u(record.custodyBindingDigestB64u), `${label}.custodyBindingDigestB64u`),
+		hpkePublicKeyB64u: resultValue(parseHpkePublicKeyB64u(record.hpkePublicKeyB64u), `${label}.hpkePublicKeyB64u`),
+		hpkePublicKeyDigestB64u: resultValue(parseSigningWorkerRecipientKeyDigestB64u(record.hpkePublicKeyDigestB64u), `${label}.hpkePublicKeyDigestB64u`)
+	};
+}
+function parseTargetSigningWorker(raw, label = "targetSigningWorker") {
+	const record = exactRecord(raw, NON_EMPTY_FIELDS.worker, label);
+	return {
+		participantId: resultValue(parseSigningWorkerParticipantId(record.participantId), `${label}.participantId`),
+		participantBindingDigestB64u: resultValue(parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u), `${label}.participantBindingDigestB64u`),
+		recipientKeyId: resultValue(parseSigningWorkerRecipientKeyId(record.recipientKeyId), `${label}.recipientKeyId`),
+		hpkePublicKeyB64u: resultValue(parseHpkePublicKeyB64u(record.hpkePublicKeyB64u), `${label}.hpkePublicKeyB64u`),
+		hpkePublicKeyDigestB64u: resultValue(parseSigningWorkerRecipientKeyDigestB64u(record.hpkePublicKeyDigestB64u), `${label}.hpkePublicKeyDigestB64u`)
+	};
+}
+function buildLaneCreationTargetV1(args) {
+	return {
+		operation: "create_lane",
+		laneId: args.laneId,
+		laneKind: "linked_device",
+		laneShareEpoch: args.laneShareEpoch,
+		expectedTargetState: "absent"
+	};
+}
+function buildLaneRefreshTargetV1(args) {
+	return {
+		operation: "refresh_lane",
+		laneId: args.laneId,
+		laneKind: args.laneKind,
+		laneShareEpoch: args.laneShareEpoch,
+		expectedTargetState: "active_previous_epoch",
+		priorMaterialActivation: args.priorMaterialActivation
+	};
+}
+function parseTarget(raw, source, label = "target") {
+	const record = requireRecord(raw, label);
+	if (record.operation === "create_lane") {
+		const value = exactRecord(record, [
+			"operation",
+			"laneId",
+			"laneKind",
+			"laneShareEpoch",
+			"expectedTargetState"
+		], label);
+		if (value.laneKind !== "linked_device" || value.expectedTargetState !== "absent") throw new Error(`${label} create branch has invalid target state`);
+		const target = buildLaneCreationTargetV1({
+			laneId: parseLaneId(value.laneId, `${label}.laneId`),
+			laneShareEpoch: parseShareEpoch(value.laneShareEpoch, `${label}.laneShareEpoch`)
+		});
+		if (source.laneKind === "linked_device" || source.laneKind === "delegated_execution") throw new Error(`${label} creation requires an owner-controlled source lane`);
+		if (String(target.laneId) === String(source.laneId)) throw new Error(`${label}.laneId must differ from source.laneId for creation`);
+		return target;
+	}
+	if (record.operation === "refresh_lane") {
+		const value = exactRecord(record, [
+			"operation",
+			"laneId",
+			"laneKind",
+			"laneShareEpoch",
+			"expectedTargetState",
+			"priorMaterialActivation"
+		], label);
+		if (value.expectedTargetState !== "active_previous_epoch") throw new Error(`${label} refresh branch has invalid target state`);
+		const laneId = parseLaneId(value.laneId, `${label}.laneId`);
+		if (String(laneId) !== String(source.laneId)) throw new Error(`${label}.laneId must match source.laneId for refresh`);
+		const laneShareEpoch = parseShareEpoch(value.laneShareEpoch, `${label}.laneShareEpoch`);
+		if (String(laneShareEpoch) === String(source.laneShareEpoch)) throw new Error(`${label}.laneShareEpoch must advance source.laneShareEpoch`);
+		const laneKind = parseLaneKind(value.laneKind, `${label}.laneKind`);
+		if (laneKind !== source.laneKind) throw new Error(`${label}.laneKind must match source.laneKind for refresh`);
+		if (laneKind !== "delegated_execution") return buildLaneRefreshTargetV1({
+			laneId,
+			laneKind,
+			laneShareEpoch,
+			priorMaterialActivation: parseMpcActivation(value.priorMaterialActivation, `${label}.priorMaterialActivation`)
+		});
+	}
+	throw new Error(`${label}.operation is invalid`);
+}
+function parseOperation(raw, source, label = "operation") {
+	const record = exactRecord(raw, ["target", "authorization"], label);
+	const target = parseTarget(record.target, source, `${label}.target`);
+	const authorization = parseAuthorization(record.authorization, `${label}.authorization`);
+	if (target.operation === "create_lane") {
+		if (authorization.kind !== "linked_device_enrollment") throw new Error(`${label}.authorization must be linked-device enrollment for creation`);
+		return {
+			target,
+			authorization
+		};
+	}
+	if (authorization.kind !== "owner_lane_refresh") throw new Error(`${label}.authorization must be owner refresh for refresh`);
+	return {
+		target,
+		authorization
+	};
+}
+function isParsedCreationOperation(value) {
+	return value.target.operation === "create_lane";
+}
+function parseCommonJob(record, label) {
+	const value = exactRecord({
+		operationId: record.operationId,
+		enrollmentId: record.enrollmentId,
+		idempotencyKey: record.idempotencyKey,
+		walletId: record.walletId,
+		walletKeyId: record.walletKeyId,
+		source: record.source,
+		targetHolder: record.targetHolder,
+		targetSigningWorker: record.targetSigningWorker,
+		targetMaterialActivationId: record.targetMaterialActivationId,
+		protocolVersion: record.protocolVersion,
+		expiresAtMs: record.expiresAtMs
+	}, [
+		"operationId",
+		"enrollmentId",
+		"idempotencyKey",
+		"walletId",
+		"walletKeyId",
+		"source",
+		"targetHolder",
+		"targetSigningWorker",
+		"targetMaterialActivationId",
+		"protocolVersion",
+		"expiresAtMs"
+	], label);
+	const source = parseSource(value.source, `${label}.source`);
+	const targetHolder = parseTargetHolder(value.targetHolder, `${label}.targetHolder`);
+	const targetSigningWorker = parseTargetSigningWorker(value.targetSigningWorker, `${label}.targetSigningWorker`);
+	const targetMaterialActivationId = resultValue(parseMpcMaterialActivationId(value.targetMaterialActivationId), `${label}.targetMaterialActivationId`);
+	if (String(targetMaterialActivationId) === String(source.materialActivation.activationId)) throw new Error(`${label}.targetMaterialActivationId must be fresh`);
+	if (value.protocolVersion !== "rotatable_signing_lane_protocol_v1") throw new Error(`${label}.protocolVersion is invalid`);
+	return {
+		operationId: parseLaneOperationId(value.operationId, `${label}.operationId`),
+		enrollmentId: parseEnrollmentId(value.enrollmentId, `${label}.enrollmentId`),
+		idempotencyKey: parseOperationIdempotencyKey(value.idempotencyKey, `${label}.idempotencyKey`),
+		walletId: resultValue(parseWalletId(value.walletId), `${label}.walletId`),
+		walletKeyId: parseKeyId(value.walletKeyId, `${label}.walletKeyId`),
+		source,
+		targetHolder,
+		targetSigningWorker,
+		targetMaterialActivationId,
+		protocolVersion: "rotatable_signing_lane_protocol_v1",
+		expiresAtMs: requiredInteger(value.expiresAtMs, `${label}.expiresAtMs`)
+	};
+}
+function parseEcdsaSourceCapability(raw, label) {
+	const record = exactRecord(raw, [
+		"manifestId",
+		"manifestRevision",
+		"serverGeneration",
+		"ecdsaThresholdKeyId",
+		"relayerKeyId"
+	], label);
+	return {
+		manifestId: parseEcdsaCapabilityManifestId(record.manifestId),
+		manifestRevision: parseEcdsaCapabilityManifestRevision(record.manifestRevision),
+		serverGeneration: parseEcdsaServerGeneration(record.serverGeneration),
+		ecdsaThresholdKeyId: parseSdkEcdsaDerivationThresholdKeyId(record.ecdsaThresholdKeyId),
+		relayerKeyId: resultValue(parseEcdsaRelayerKeyId(record.relayerKeyId), `${label}.relayerKeyId`)
+	};
+}
+function parseChainTarget(raw, label) {
+	const record = requireRecord(raw, label);
+	if (record.kind === "evm") {
+		const value = exactRecord(record, [
+			"kind",
+			"namespace",
+			"chainId",
+			"networkSlug"
+		], label);
+		if (value.namespace !== "eip155") throw new Error(`${label}.namespace is invalid`);
+		return {
+			kind: "evm",
+			namespace: "eip155",
+			chainId: requiredInteger(value.chainId, `${label}.chainId`),
+			networkSlug: requiredString(value.networkSlug, `${label}.networkSlug`)
+		};
+	}
+	if (record.kind === "tempo") {
+		const value = exactRecord(record, [
+			"kind",
+			"chainId",
+			"networkSlug"
+		], label);
+		return {
+			kind: "tempo",
+			chainId: requiredInteger(value.chainId, `${label}.chainId`),
+			networkSlug: requiredString(value.networkSlug, `${label}.networkSlug`)
+		};
+	}
+	throw new Error(`${label}.kind is invalid`);
+}
+function parseEcdsaTargetCapabilityBindingV1(raw, label) {
+	const record = exactRecord(raw, [
+		"manifestId",
+		"manifestRevision",
+		"ecdsaThresholdKeyId",
+		"orderedThresholdSessions"
+	], label);
+	const sessionsRaw = requiredArray(record.orderedThresholdSessions, `${label}.orderedThresholdSessions`);
+	if (sessionsRaw.length === 0) throw new Error(`${label}.orderedThresholdSessions must be non-empty`);
+	const orderedThresholdSessions = sessionsRaw.map((item, index) => {
+		const session = exactRecord(item, [
+			"chainTarget",
+			"thresholdSessionId",
+			"participantBindingDigestB64u"
+		], `${label}.orderedThresholdSessions[${index}]`);
+		return {
+			chainTarget: parseChainTarget(session.chainTarget, `${label}.orderedThresholdSessions[${index}].chainTarget`),
+			thresholdSessionId: resultValue(parseThresholdEcdsaSessionId(session.thresholdSessionId), `${label}.orderedThresholdSessions[${index}].thresholdSessionId`),
+			participantBindingDigestB64u: digest(session.participantBindingDigestB64u, `${label}.orderedThresholdSessions[${index}].participantBindingDigestB64u`)
+		};
+	});
+	return {
+		manifestId: parseEcdsaCapabilityManifestId(record.manifestId),
+		manifestRevision: parseEcdsaCapabilityManifestRevision(record.manifestRevision),
+		ecdsaThresholdKeyId: parseSdkEcdsaDerivationThresholdKeyId(record.ecdsaThresholdKeyId),
+		orderedThresholdSessions: nonEmptyTuple(orderedThresholdSessions, `${label}.orderedThresholdSessions`)
+	};
+}
+function buildEdCreationJob(common, operation, curve) {
+	return {
+		operationId: common.operationId,
+		enrollmentId: common.enrollmentId,
+		idempotencyKey: common.idempotencyKey,
+		walletId: common.walletId,
+		walletKeyId: common.walletKeyId,
+		source: common.source,
+		targetHolder: common.targetHolder,
+		targetSigningWorker: common.targetSigningWorker,
+		targetMaterialActivationId: common.targetMaterialActivationId,
+		protocolVersion: common.protocolVersion,
+		expiresAtMs: common.expiresAtMs,
+		target: operation.target,
+		authorization: operation.authorization,
+		yaoRequestKind: "lane_provisioning",
+		kind: curve.kind,
+		keyFamily: curve.keyFamily,
+		registeredPublicKeyB64u: curve.registeredPublicKeyB64u,
+		nearEd25519SigningKeyId: curve.nearEd25519SigningKeyId,
+		keyCreationSignerSlot: curve.keyCreationSignerSlot,
+		stableContextBindingB64u: curve.stableContextBindingB64u,
+		yaoSuiteId: curve.yaoSuiteId,
+		circuitDigestB64u: curve.circuitDigestB64u
+	};
+}
+function buildEdRefreshJob(common, operation, curve) {
+	return {
+		operationId: common.operationId,
+		enrollmentId: common.enrollmentId,
+		idempotencyKey: common.idempotencyKey,
+		walletId: common.walletId,
+		walletKeyId: common.walletKeyId,
+		source: common.source,
+		targetHolder: common.targetHolder,
+		targetSigningWorker: common.targetSigningWorker,
+		targetMaterialActivationId: common.targetMaterialActivationId,
+		protocolVersion: common.protocolVersion,
+		expiresAtMs: common.expiresAtMs,
+		target: operation.target,
+		authorization: operation.authorization,
+		yaoRequestKind: "lane_refresh",
+		kind: curve.kind,
+		keyFamily: curve.keyFamily,
+		registeredPublicKeyB64u: curve.registeredPublicKeyB64u,
+		nearEd25519SigningKeyId: curve.nearEd25519SigningKeyId,
+		keyCreationSignerSlot: curve.keyCreationSignerSlot,
+		stableContextBindingB64u: curve.stableContextBindingB64u,
+		yaoSuiteId: curve.yaoSuiteId,
+		circuitDigestB64u: curve.circuitDigestB64u
+	};
+}
+function buildEcdsaCreationJob(common, operation, curve) {
+	return {
+		operationId: common.operationId,
+		enrollmentId: common.enrollmentId,
+		idempotencyKey: common.idempotencyKey,
+		walletId: common.walletId,
+		walletKeyId: common.walletKeyId,
+		source: common.source,
+		targetHolder: common.targetHolder,
+		targetSigningWorker: common.targetSigningWorker,
+		targetMaterialActivationId: common.targetMaterialActivationId,
+		protocolVersion: common.protocolVersion,
+		expiresAtMs: common.expiresAtMs,
+		target: operation.target,
+		authorization: operation.authorization,
+		kind: curve.kind,
+		keyFamily: curve.keyFamily,
+		evmFamilySigningKeySlotId: curve.evmFamilySigningKeySlotId,
+		thresholdPublicKey33B64u: curve.thresholdPublicKey33B64u,
+		evmAddress: curve.evmAddress,
+		sourceCapability: curve.sourceCapability,
+		targetCapability: curve.targetCapability,
+		sourceHolderVerifyingShare33B64u: curve.sourceHolderVerifyingShare33B64u,
+		sourceServerVerifyingShare33B64u: curve.sourceServerVerifyingShare33B64u,
+		reshareChannelBindingDigestB64u: curve.reshareChannelBindingDigestB64u,
+		transcriptEncoding: curve.transcriptEncoding
+	};
+}
+function buildEcdsaRefreshJob(common, operation, curve) {
+	return {
+		operationId: common.operationId,
+		enrollmentId: common.enrollmentId,
+		idempotencyKey: common.idempotencyKey,
+		walletId: common.walletId,
+		walletKeyId: common.walletKeyId,
+		source: common.source,
+		targetHolder: common.targetHolder,
+		targetSigningWorker: common.targetSigningWorker,
+		targetMaterialActivationId: common.targetMaterialActivationId,
+		protocolVersion: common.protocolVersion,
+		expiresAtMs: common.expiresAtMs,
+		target: operation.target,
+		authorization: operation.authorization,
+		kind: curve.kind,
+		keyFamily: curve.keyFamily,
+		evmFamilySigningKeySlotId: curve.evmFamilySigningKeySlotId,
+		thresholdPublicKey33B64u: curve.thresholdPublicKey33B64u,
+		evmAddress: curve.evmAddress,
+		sourceCapability: curve.sourceCapability,
+		targetCapability: curve.targetCapability,
+		sourceHolderVerifyingShare33B64u: curve.sourceHolderVerifyingShare33B64u,
+		sourceServerVerifyingShare33B64u: curve.sourceServerVerifyingShare33B64u,
+		reshareChannelBindingDigestB64u: curve.reshareChannelBindingDigestB64u,
+		transcriptEncoding: curve.transcriptEncoding
+	};
+}
+function parseEcdsaJob(record, label) {
+	const value = exactRecord(record, [
+		"kind",
+		"keyFamily",
+		"operationId",
+		"enrollmentId",
+		"idempotencyKey",
+		"walletId",
+		"walletKeyId",
+		"source",
+		"targetHolder",
+		"targetSigningWorker",
+		"targetMaterialActivationId",
+		"protocolVersion",
+		"expiresAtMs",
+		"target",
+		"authorization",
+		"evmFamilySigningKeySlotId",
+		"thresholdPublicKey33B64u",
+		"evmAddress",
+		"sourceCapability",
+		"targetCapability",
+		"sourceHolderVerifyingShare33B64u",
+		"sourceServerVerifyingShare33B64u",
+		"reshareChannelBindingDigestB64u",
+		"transcriptEncoding"
+	], label);
+	if (value.kind !== "ecdsa_additive_lane_job_v1" || value.keyFamily !== "ecdsa_secp256k1") throw new Error(`${label} kind/keyFamily is invalid`);
+	if (value.transcriptEncoding !== "ecdsa_additive_lane_transcript_v1") throw new Error(`${label}.transcriptEncoding is invalid`);
+	const common = parseCommonJob(value, label);
+	const operationFromValue = parseOperation({
+		target: value.target,
+		authorization: value.authorization
+	}, common.source, `${label}.operation`);
+	const curve = {
+		kind: "ecdsa_additive_lane_job_v1",
+		keyFamily: "ecdsa_secp256k1",
+		evmFamilySigningKeySlotId: (() => {
+			const parsed = parseEvmFamilySigningKeySlotId(value.evmFamilySigningKeySlotId);
+			if (parsed.ok) return parsed.value;
+			throw new Error(`${label}.evmFamilySigningKeySlotId is invalid`);
+		})(),
+		thresholdPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(value.thresholdPublicKey33B64u),
+		evmAddress: requiredString(value.evmAddress, `${label}.evmAddress`),
+		sourceCapability: parseEcdsaSourceCapability(value.sourceCapability, `${label}.sourceCapability`),
+		targetCapability: parseEcdsaTargetCapabilityBindingV1(value.targetCapability, `${label}.targetCapability`),
+		sourceHolderVerifyingShare33B64u: parseSecp256k1CompressedPublicKeyB64u(value.sourceHolderVerifyingShare33B64u, `${label}.sourceHolderVerifyingShare33B64u`),
+		sourceServerVerifyingShare33B64u: parseSecp256k1CompressedPublicKeyB64u(value.sourceServerVerifyingShare33B64u, `${label}.sourceServerVerifyingShare33B64u`),
+		reshareChannelBindingDigestB64u: digest(value.reshareChannelBindingDigestB64u, `${label}.reshareChannelBindingDigestB64u`),
+		transcriptEncoding: "ecdsa_additive_lane_transcript_v1"
+	};
+	if (isParsedCreationOperation(operationFromValue)) return buildEcdsaCreationJob(common, operationFromValue, curve);
+	return buildEcdsaRefreshJob(common, operationFromValue, curve);
+}
+function parseEdJob(record, label) {
+	const value = exactRecord(record, [
+		"kind",
+		"keyFamily",
+		"operationId",
+		"enrollmentId",
+		"idempotencyKey",
+		"walletId",
+		"walletKeyId",
+		"source",
+		"targetHolder",
+		"targetSigningWorker",
+		"targetMaterialActivationId",
+		"protocolVersion",
+		"expiresAtMs",
+		"target",
+		"authorization",
+		"yaoRequestKind",
+		"registeredPublicKeyB64u",
+		"nearEd25519SigningKeyId",
+		"keyCreationSignerSlot",
+		"stableContextBindingB64u",
+		"yaoSuiteId",
+		"circuitDigestB64u"
+	], label);
+	if (value.kind !== "ed25519_yao_lane_job_v1" || value.keyFamily !== "ed25519") throw new Error(`${label} kind/keyFamily is invalid`);
+	const common = parseCommonJob(value, label);
+	const operation = parseOperation({
+		target: value.target,
+		authorization: value.authorization
+	}, common.source, `${label}.operation`);
+	const yaoRequestKind = requiredString(value.yaoRequestKind, `${label}.yaoRequestKind`);
+	const curve = {
+		kind: "ed25519_yao_lane_job_v1",
+		keyFamily: "ed25519",
+		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(value.registeredPublicKeyB64u),
+		nearEd25519SigningKeyId: parseNearEd25519SigningKeyId(value.nearEd25519SigningKeyId),
+		keyCreationSignerSlot: parseKeyCreationSignerSlot(value.keyCreationSignerSlot),
+		stableContextBindingB64u: digest(value.stableContextBindingB64u, `${label}.stableContextBindingB64u`),
+		yaoSuiteId: resultValue(parseEd25519YaoSuiteId(value.yaoSuiteId), `${label}.yaoSuiteId`),
+		circuitDigestB64u: digest(value.circuitDigestB64u, `${label}.circuitDigestB64u`)
+	};
+	if (isParsedCreationOperation(operation)) {
+		if (yaoRequestKind !== "lane_provisioning") throw new Error(`${label}.yaoRequestKind must be lane_provisioning for creation`);
+		return buildEdCreationJob(common, operation, curve);
+	}
+	if (yaoRequestKind !== "lane_refresh") throw new Error(`${label}.yaoRequestKind must be lane_refresh for refresh`);
+	return buildEdRefreshJob(common, operation, curve);
+}
+function parseRotatableSigningLaneJobV1(raw, label = "laneProtocolJob") {
+	const record = requireRecord(raw, label);
+	if (record.kind === "ed25519_yao_lane_job_v1") return parseEdJob(record, label);
+	if (record.kind === "ecdsa_additive_lane_job_v1") return parseEcdsaJob(record, label);
+	throw new Error(`${label}.kind is invalid`);
+}
+const parseLaneProtocolJobV1 = parseRotatableSigningLaneJobV1;
+function parseReceiptCommon(raw, fields, label) {
+	return exactRecord(raw, fields, label);
+}
+function parseLaneProtocolCommitReceiptV1(raw, label = "protocolCommitReceipt") {
+	const record = parseReceiptCommon(raw, [
+		"kind",
+		"operationId",
+		"enrollmentId",
+		"walletId",
+		"walletKeyId",
+		"sourceLaneId",
+		"sourceLaneShareEpoch",
+		"sourceRevocationEpoch",
+		"sourceMaterialActivation",
+		"targetLaneId",
+		"targetLaneShareEpoch",
+		"targetMaterialActivationId",
+		"keyFamily",
+		"publicIdentityDigestB64u",
+		"targetHolderPublicCommitmentB64u",
+		"targetServerPublicCommitmentB64u",
+		"targetHolderCiphertextDigestSetB64u",
+		"targetServerCiphertextDigestSetB64u",
+		"holderRecipientKeyDigestB64u",
+		"serverRecipientKeyDigestB64u",
+		"transcriptHashB64u",
+		"committedAtMs"
+	], label);
+	if (record.kind !== "lane_protocol_commit_receipt_v1") throw new Error(`${label}.kind is invalid`);
+	return {
+		kind: "lane_protocol_commit_receipt_v1",
+		operationId: parseLaneOperationId(record.operationId, `${label}.operationId`),
+		enrollmentId: parseEnrollmentId(record.enrollmentId, `${label}.enrollmentId`),
+		walletId: resultValue(parseWalletId(record.walletId), `${label}.walletId`),
+		walletKeyId: parseKeyId(record.walletKeyId, `${label}.walletKeyId`),
+		sourceLaneId: parseLaneId(record.sourceLaneId, `${label}.sourceLaneId`),
+		sourceLaneShareEpoch: parseShareEpoch(record.sourceLaneShareEpoch, `${label}.sourceLaneShareEpoch`),
+		sourceRevocationEpoch: requiredInteger(record.sourceRevocationEpoch, `${label}.sourceRevocationEpoch`),
+		sourceMaterialActivation: parseMpcActivation(record.sourceMaterialActivation, `${label}.sourceMaterialActivation`),
+		targetLaneId: parseLaneId(record.targetLaneId, `${label}.targetLaneId`),
+		targetLaneShareEpoch: parseShareEpoch(record.targetLaneShareEpoch, `${label}.targetLaneShareEpoch`),
+		targetMaterialActivationId: resultValue(parseMpcMaterialActivationId(record.targetMaterialActivationId), `${label}.targetMaterialActivationId`),
+		keyFamily: parseKeyFamily(record.keyFamily, `${label}.keyFamily`),
+		publicIdentityDigestB64u: digest(record.publicIdentityDigestB64u, `${label}.publicIdentityDigestB64u`),
+		targetHolderPublicCommitmentB64u: requiredString(record.targetHolderPublicCommitmentB64u, `${label}.targetHolderPublicCommitmentB64u`),
+		targetServerPublicCommitmentB64u: requiredString(record.targetServerPublicCommitmentB64u, `${label}.targetServerPublicCommitmentB64u`),
+		targetHolderCiphertextDigestSetB64u: digest(record.targetHolderCiphertextDigestSetB64u, `${label}.targetHolderCiphertextDigestSetB64u`),
+		targetServerCiphertextDigestSetB64u: digest(record.targetServerCiphertextDigestSetB64u, `${label}.targetServerCiphertextDigestSetB64u`),
+		holderRecipientKeyDigestB64u: digest(record.holderRecipientKeyDigestB64u, `${label}.holderRecipientKeyDigestB64u`),
+		serverRecipientKeyDigestB64u: digest(record.serverRecipientKeyDigestB64u, `${label}.serverRecipientKeyDigestB64u`),
+		transcriptHashB64u: digest(record.transcriptHashB64u, `${label}.transcriptHashB64u`),
+		committedAtMs: requiredInteger(record.committedAtMs, `${label}.committedAtMs`)
+	};
+}
+function parseLaneHolderDeliveryReceiptV1(raw, label = "holderDeliveryReceipt") {
+	const record = parseReceiptCommon(raw, [
+		"kind",
+		"operationId",
+		"enrollmentId",
+		"targetLaneId",
+		"targetLaneShareEpoch",
+		"targetMaterialActivationId",
+		"holderParticipantBindingDigestB64u",
+		"holderRecipientKeyDigestB64u",
+		"holderCiphertextDigestSetB64u",
+		"sealedHolderRecordDigestB64u",
+		"transcriptHashB64u",
+		"acknowledgedAtMs"
+	], label);
+	if (record.kind !== "lane_holder_delivery_receipt_v1") throw new Error(`${label}.kind is invalid`);
+	return {
+		kind: "lane_holder_delivery_receipt_v1",
+		operationId: parseLaneOperationId(record.operationId, `${label}.operationId`),
+		enrollmentId: parseEnrollmentId(record.enrollmentId, `${label}.enrollmentId`),
+		targetLaneId: parseLaneId(record.targetLaneId, `${label}.targetLaneId`),
+		targetLaneShareEpoch: parseShareEpoch(record.targetLaneShareEpoch, `${label}.targetLaneShareEpoch`),
+		targetMaterialActivationId: resultValue(parseMpcMaterialActivationId(record.targetMaterialActivationId), `${label}.targetMaterialActivationId`),
+		holderParticipantBindingDigestB64u: digest(record.holderParticipantBindingDigestB64u, `${label}.holderParticipantBindingDigestB64u`),
+		holderRecipientKeyDigestB64u: digest(record.holderRecipientKeyDigestB64u, `${label}.holderRecipientKeyDigestB64u`),
+		holderCiphertextDigestSetB64u: digest(record.holderCiphertextDigestSetB64u, `${label}.holderCiphertextDigestSetB64u`),
+		sealedHolderRecordDigestB64u: digest(record.sealedHolderRecordDigestB64u, `${label}.sealedHolderRecordDigestB64u`),
+		transcriptHashB64u: digest(record.transcriptHashB64u, `${label}.transcriptHashB64u`),
+		acknowledgedAtMs: requiredInteger(record.acknowledgedAtMs, `${label}.acknowledgedAtMs`)
+	};
+}
+function parseLaneServerActivationReceiptV1(raw, label = "serverActivationReceipt") {
+	const record = parseReceiptCommon(raw, [
+		"kind",
+		"operationId",
+		"enrollmentId",
+		"targetLaneId",
+		"targetLaneShareEpoch",
+		"targetMaterialActivation",
+		"signingWorkerParticipantBindingDigestB64u",
+		"serverCiphertextDigestSetB64u",
+		"transcriptHashB64u",
+		"activatedAtMs"
+	], label);
+	if (record.kind !== "lane_server_activation_receipt_v1") throw new Error(`${label}.kind is invalid`);
+	return {
+		kind: "lane_server_activation_receipt_v1",
+		operationId: parseLaneOperationId(record.operationId, `${label}.operationId`),
+		enrollmentId: parseEnrollmentId(record.enrollmentId, `${label}.enrollmentId`),
+		targetLaneId: parseLaneId(record.targetLaneId, `${label}.targetLaneId`),
+		targetLaneShareEpoch: parseShareEpoch(record.targetLaneShareEpoch, `${label}.targetLaneShareEpoch`),
+		targetMaterialActivation: parseMpcActivation(record.targetMaterialActivation, `${label}.targetMaterialActivation`),
+		signingWorkerParticipantBindingDigestB64u: digest(record.signingWorkerParticipantBindingDigestB64u, `${label}.signingWorkerParticipantBindingDigestB64u`),
+		serverCiphertextDigestSetB64u: digest(record.serverCiphertextDigestSetB64u, `${label}.serverCiphertextDigestSetB64u`),
+		transcriptHashB64u: digest(record.transcriptHashB64u, `${label}.transcriptHashB64u`),
+		activatedAtMs: requiredInteger(record.activatedAtMs, `${label}.activatedAtMs`)
+	};
+}
+function requiredArray(raw, label) {
+	if (!Array.isArray(raw)) throw new Error(`${label} must be an array`);
+	return raw;
+}
+function parseManifestChild(raw, label) {
+	const record = exactRecord(raw, [
+		"operationId",
+		"walletKeyId",
+		"keyFamily",
+		"sourceLaneId",
+		"sourceLaneShareEpoch",
+		"sourceRevocationEpoch",
+		"sourceMaterialActivation",
+		"targetLaneId",
+		"targetLaneShareEpoch",
+		"targetMaterialActivationId",
+		"holderParticipantBindingDigestB64u",
+		"signingWorkerParticipantBindingDigestB64u"
+	], label);
+	return {
+		operationId: parseLaneOperationId(record.operationId, `${label}.operationId`),
+		walletKeyId: parseKeyId(record.walletKeyId, `${label}.walletKeyId`),
+		keyFamily: parseKeyFamily(record.keyFamily, `${label}.keyFamily`),
+		sourceLaneId: parseLaneId(record.sourceLaneId, `${label}.sourceLaneId`),
+		sourceLaneShareEpoch: parseShareEpoch(record.sourceLaneShareEpoch, `${label}.sourceLaneShareEpoch`),
+		sourceRevocationEpoch: requiredInteger(record.sourceRevocationEpoch, `${label}.sourceRevocationEpoch`),
+		sourceMaterialActivation: parseMpcActivation(record.sourceMaterialActivation, `${label}.sourceMaterialActivation`),
+		targetLaneId: parseLaneId(record.targetLaneId, `${label}.targetLaneId`),
+		targetLaneShareEpoch: parseShareEpoch(record.targetLaneShareEpoch, `${label}.targetLaneShareEpoch`),
+		targetMaterialActivationId: resultValue(parseMpcMaterialActivationId(record.targetMaterialActivationId), `${label}.targetMaterialActivationId`),
+		holderParticipantBindingDigestB64u: digest(record.holderParticipantBindingDigestB64u, `${label}.holderParticipantBindingDigestB64u`),
+		signingWorkerParticipantBindingDigestB64u: digest(record.signingWorkerParticipantBindingDigestB64u, `${label}.signingWorkerParticipantBindingDigestB64u`)
+	};
+}
+function assertUniqueChildren(children, label) {
+	for (const field of [
+		"operationId",
+		"walletKeyId",
+		"targetLaneId",
+		"targetMaterialActivationId"
+	]) {
+		const values = children.map((child) => String(child[field]));
+		if (new Set(values).size !== values.length) throw new Error(`${label} contains duplicate ${field}`);
+	}
+}
+function assertUniqueAggregateActivationChildren(children, label) {
+	const values = [
+		children.map((child) => String(child.operationId)),
+		children.map((child) => String(child.walletKeyId)),
+		children.map((child) => String(child.targetLaneId)),
+		children.map((child) => String(child.targetMaterialActivation.activationId))
+	];
+	for (const entries of values) if (new Set(entries).size !== entries.length) throw new Error(`${label} contains duplicate child identity`);
+}
+function parseLaneEnrollmentManifestV1(raw, label = "laneEnrollmentManifest") {
+	const record = exactRecord(raw, [
+		"kind",
+		"enrollmentId",
+		"walletId",
+		"authorization",
+		"orderedChildren",
+		"createdAtMs",
+		"expiresAtMs"
+	], label);
+	if (record.kind !== "lane_enrollment_manifest_v1") throw new Error(`${label}.kind is invalid`);
+	const childrenRaw = requiredArray(record.orderedChildren, `${label}.orderedChildren`);
+	if (childrenRaw.length === 0) throw new Error(`${label}.orderedChildren must be non-empty`);
+	const orderedChildren = nonEmptyTuple(childrenRaw.map((child, index) => parseManifestChild(child, `${label}.orderedChildren[${index}]`)), `${label}.orderedChildren`);
+	assertUniqueChildren(orderedChildren, `${label}.orderedChildren`);
+	const createdAtMs = requiredInteger(record.createdAtMs, `${label}.createdAtMs`);
+	const expiresAtMs = requiredInteger(record.expiresAtMs, `${label}.expiresAtMs`);
+	if (expiresAtMs <= createdAtMs) throw new Error(`${label}.expiresAtMs must be after createdAtMs`);
+	return {
+		kind: "lane_enrollment_manifest_v1",
+		enrollmentId: parseEnrollmentId(record.enrollmentId, `${label}.enrollmentId`),
+		walletId: resultValue(parseWalletId(record.walletId), `${label}.walletId`),
+		authorization: parseAuthorization(record.authorization, `${label}.authorization`),
+		orderedChildren,
+		createdAtMs,
+		expiresAtMs
+	};
+}
+function parseAggregateActivationChild(raw, label) {
+	const record = exactRecord(raw, [
+		"operationId",
+		"walletKeyId",
+		"targetLaneId",
+		"targetLaneShareEpoch",
+		"targetMaterialActivation",
+		"protocolCommitReceiptDigestB64u",
+		"holderDeliveryReceiptDigestB64u",
+		"serverActivationReceiptDigestB64u"
+	], label);
+	return {
+		operationId: parseLaneOperationId(record.operationId, `${label}.operationId`),
+		walletKeyId: parseKeyId(record.walletKeyId, `${label}.walletKeyId`),
+		targetLaneId: parseLaneId(record.targetLaneId, `${label}.targetLaneId`),
+		targetLaneShareEpoch: parseShareEpoch(record.targetLaneShareEpoch, `${label}.targetLaneShareEpoch`),
+		targetMaterialActivation: parseMpcActivation(record.targetMaterialActivation, `${label}.targetMaterialActivation`),
+		protocolCommitReceiptDigestB64u: digest(record.protocolCommitReceiptDigestB64u, `${label}.protocolCommitReceiptDigestB64u`),
+		holderDeliveryReceiptDigestB64u: digest(record.holderDeliveryReceiptDigestB64u, `${label}.holderDeliveryReceiptDigestB64u`),
+		serverActivationReceiptDigestB64u: digest(record.serverActivationReceiptDigestB64u, `${label}.serverActivationReceiptDigestB64u`)
+	};
+}
+function parseAggregateLaneActivationReceiptV1(raw, label = "aggregateActivationReceipt") {
+	const record = exactRecord(raw, [
+		"kind",
+		"enrollmentId",
+		"walletId",
+		"manifestDigestB64u",
+		"orderedChildReceipts",
+		"activatedAtMs"
+	], label);
+	if (record.kind !== "aggregate_lane_activation_receipt_v1") throw new Error(`${label}.kind is invalid`);
+	const childrenRaw = requiredArray(record.orderedChildReceipts, `${label}.orderedChildReceipts`);
+	if (childrenRaw.length === 0) throw new Error(`${label}.orderedChildReceipts must be non-empty`);
+	const orderedChildReceipts = nonEmptyTuple(childrenRaw.map((child, index) => parseAggregateActivationChild(child, `${label}.orderedChildReceipts[${index}]`)), `${label}.orderedChildReceipts`);
+	assertUniqueAggregateActivationChildren(orderedChildReceipts, `${label}.orderedChildReceipts`);
+	return {
+		kind: "aggregate_lane_activation_receipt_v1",
+		enrollmentId: parseEnrollmentId(record.enrollmentId, `${label}.enrollmentId`),
+		walletId: resultValue(parseWalletId(record.walletId), `${label}.walletId`),
+		manifestDigestB64u: digest(record.manifestDigestB64u, `${label}.manifestDigestB64u`),
+		orderedChildReceipts,
+		activatedAtMs: requiredInteger(record.activatedAtMs, `${label}.activatedAtMs`)
+	};
+}
+function parseLaneRefreshPredecessorRetirementV1(raw, label = "laneRefreshPredecessorRetirement") {
+	const record = exactRecord(raw, [
+		"refreshOperationId",
+		"sourceLaneId",
+		"sourceLaneShareEpoch",
+		"sourceMaterialActivation",
+		"retirementEffectBindingDigestB64u",
+		"retirementReceipt"
+	], label);
+	return {
+		refreshOperationId: parseLaneOperationId(record.refreshOperationId, `${label}.refreshOperationId`),
+		sourceLaneId: parseLaneId(record.sourceLaneId, `${label}.sourceLaneId`),
+		sourceLaneShareEpoch: parseShareEpoch(record.sourceLaneShareEpoch, `${label}.sourceLaneShareEpoch`),
+		sourceMaterialActivation: parseMpcActivation(record.sourceMaterialActivation, `${label}.sourceMaterialActivation`),
+		retirementEffectBindingDigestB64u: digest(record.retirementEffectBindingDigestB64u, `${label}.retirementEffectBindingDigestB64u`),
+		retirementReceipt: parseLaneServerRetirementReceiptV1(record.retirementReceipt, `${label}.retirementReceipt`)
+	};
+}
+function parseAggregateRevocationChild(raw, label) {
+	const record = exactRecord(raw, [
+		"operationId",
+		"walletKeyId",
+		"targetLaneId",
+		"targetLaneShareEpoch",
+		"targetMaterialActivation",
+		"revocationEpoch",
+		"retirementReceiptDigestB64u"
+	], label);
+	return {
+		operationId: parseLaneOperationId(record.operationId, `${label}.operationId`),
+		walletKeyId: parseKeyId(record.walletKeyId, `${label}.walletKeyId`),
+		targetLaneId: parseLaneId(record.targetLaneId, `${label}.targetLaneId`),
+		targetLaneShareEpoch: parseShareEpoch(record.targetLaneShareEpoch, `${label}.targetLaneShareEpoch`),
+		targetMaterialActivation: parseMpcActivation(record.targetMaterialActivation, `${label}.targetMaterialActivation`),
+		revocationEpoch: requiredInteger(record.revocationEpoch, `${label}.revocationEpoch`),
+		retirementReceiptDigestB64u: digest(record.retirementReceiptDigestB64u, `${label}.retirementReceiptDigestB64u`)
+	};
+}
+function parseAggregateLaneRevocationReceiptV1(raw, label = "aggregateRevocationReceipt") {
+	const record = exactRecord(raw, [
+		"kind",
+		"enrollmentId",
+		"walletId",
+		"manifestDigestB64u",
+		"orderedChildReceipts",
+		"revokedAtMs"
+	], label);
+	if (record.kind !== "aggregate_lane_revocation_receipt_v1") throw new Error(`${label}.kind is invalid`);
+	const childrenRaw = requiredArray(record.orderedChildReceipts, `${label}.orderedChildReceipts`);
+	if (childrenRaw.length === 0) throw new Error(`${label}.orderedChildReceipts must be non-empty`);
+	const orderedChildReceipts = nonEmptyTuple(childrenRaw.map((child, index) => parseAggregateRevocationChild(child, `${label}.orderedChildReceipts[${index}]`)), `${label}.orderedChildReceipts`);
+	return {
+		kind: "aggregate_lane_revocation_receipt_v1",
+		enrollmentId: parseEnrollmentId(record.enrollmentId, `${label}.enrollmentId`),
+		walletId: resultValue(parseWalletId(record.walletId), `${label}.walletId`),
+		manifestDigestB64u: digest(record.manifestDigestB64u, `${label}.manifestDigestB64u`),
+		orderedChildReceipts,
+		revokedAtMs: requiredInteger(record.revokedAtMs, `${label}.revokedAtMs`)
+	};
+}
+function parseRevokeLaneEnrollmentV1(raw, label = "revokeLaneEnrollment") {
+	const record = exactRecord(raw, [
+		"kind",
+		"enrollmentId",
+		"walletId",
+		"manifestDigestB64u",
+		"reason",
+		"requestedAtMs"
+	], label);
+	if (record.kind !== "revoke_lane_enrollment_v1") throw new Error(`${label}.kind is invalid`);
+	const reason = record.reason;
+	if (reason !== "cancelled_after_commit" && reason !== "expired_after_commit" && reason !== "revoked_during_activation" && reason !== "user_revoked" && reason !== "device_compromise" && reason !== "agent_compromise") throw new Error(`${label}.reason is invalid`);
+	return {
+		kind: "revoke_lane_enrollment_v1",
+		enrollmentId: parseEnrollmentId(record.enrollmentId, `${label}.enrollmentId`),
+		walletId: resultValue(parseWalletId(record.walletId), `${label}.walletId`),
+		manifestDigestB64u: digest(record.manifestDigestB64u, `${label}.manifestDigestB64u`),
+		reason,
+		requestedAtMs: requiredInteger(record.requestedAtMs, `${label}.requestedAtMs`)
+	};
+}
+function parseRevokeSigningLaneV1(raw, label = "revokeSigningLane") {
+	const record = exactRecord(raw, [
+		"kind",
+		"walletId",
+		"walletKeyId",
+		"laneId",
+		"laneShareEpoch",
+		"expectedRevocationEpoch",
+		"reason",
+		"retirementCorrelationId",
+		"retirementRequestDigestB64u",
+		"retirementEffectBindingDigestB64u",
+		"requestedAtMs"
+	], label);
+	if (record.kind !== "revoke_signing_lane_v1") throw new Error(`${label}.kind is invalid`);
+	const reason = record.reason;
+	if (reason !== "user_revoked" && reason !== "policy_revoked" && reason !== "device_compromise" && reason !== "agent_compromise" && reason !== "rotation") throw new Error(`${label}.reason is invalid`);
+	return {
+		kind: "revoke_signing_lane_v1",
+		walletId: resultValue(parseWalletId(record.walletId), `${label}.walletId`),
+		walletKeyId: parseKeyId(record.walletKeyId, `${label}.walletKeyId`),
+		laneId: parseLaneId(record.laneId, `${label}.laneId`),
+		laneShareEpoch: parseShareEpoch(record.laneShareEpoch, `${label}.laneShareEpoch`),
+		expectedRevocationEpoch: requiredInteger(record.expectedRevocationEpoch, `${label}.expectedRevocationEpoch`),
+		reason,
+		retirementCorrelationId: parseCorrelationId(record.retirementCorrelationId),
+		retirementRequestDigestB64u: digest(record.retirementRequestDigestB64u, `${label}.retirementRequestDigestB64u`),
+		retirementEffectBindingDigestB64u: digest(record.retirementEffectBindingDigestB64u, `${label}.retirementEffectBindingDigestB64u`),
+		requestedAtMs: requiredInteger(record.requestedAtMs, `${label}.requestedAtMs`)
+	};
+}
+function parseCompleteSigningLaneRevocationV1(raw, label = "completeSigningLaneRevocation") {
+	const record = exactRecord(raw, [
+		"kind",
+		"command",
+		"expectedVersion",
+		"commandDigestB64u",
+		"retirementReceipt",
+		"revokedAtMs"
+	], label);
+	if (record.kind !== "complete_signing_lane_revocation_v1") throw new Error(`${label}.kind is invalid`);
+	return {
+		kind: "complete_signing_lane_revocation_v1",
+		command: parseRevokeSigningLaneV1(record.command, `${label}.command`),
+		expectedVersion: requiredInteger(record.expectedVersion, `${label}.expectedVersion`),
+		commandDigestB64u: digest(record.commandDigestB64u, `${label}.commandDigestB64u`),
+		retirementReceipt: parseLaneServerRetirementReceiptV1(record.retirementReceipt, `${label}.retirementReceipt`),
+		revokedAtMs: requiredInteger(record.revokedAtMs, `${label}.revokedAtMs`)
+	};
+}
+function parseCommitLaneEnrollmentRevocationV1(raw, label = "commitLaneEnrollmentRevocation") {
+	const record = exactRecord(raw, [
+		"kind",
+		"enrollmentId",
+		"walletId",
+		"manifestDigestB64u",
+		"receipt",
+		"revokedAtMs"
+	], label);
+	if (record.kind !== "commit_lane_enrollment_revocation_v1") throw new Error(`${label}.kind is invalid`);
+	const receipt = parseAggregateLaneRevocationReceiptV1(record.receipt, `${label}.receipt`);
+	const enrollmentId = parseEnrollmentId(record.enrollmentId, `${label}.enrollmentId`);
+	const walletId = resultValue(parseWalletId(record.walletId), `${label}.walletId`);
+	if (String(receipt.enrollmentId) !== String(enrollmentId) || String(receipt.walletId) !== String(walletId)) throw new Error(`${label}.receipt identity does not match command`);
+	return {
+		kind: "commit_lane_enrollment_revocation_v1",
+		enrollmentId,
+		walletId,
+		manifestDigestB64u: digest(record.manifestDigestB64u, `${label}.manifestDigestB64u`),
+		receipt,
+		revokedAtMs: requiredInteger(record.revokedAtMs, `${label}.revokedAtMs`)
+	};
+}
+function parseProductEpochCommon(record, label) {
+	return {
+		kind: "lane_product_epoch_record_v1",
+		walletId: resultValue(parseWalletId(record.walletId), `${label}.walletId`),
+		walletKeyId: parseKeyId(record.walletKeyId, `${label}.walletKeyId`),
+		laneId: parseLaneId(record.laneId, `${label}.laneId`),
+		laneKind: parseLaneKind(record.laneKind, `${label}.laneKind`),
+		laneShareEpoch: parseShareEpoch(record.laneShareEpoch, `${label}.laneShareEpoch`),
+		keyFamily: parseKeyFamily(record.keyFamily, `${label}.keyFamily`),
+		enrollmentId: parseEnrollmentId(record.enrollmentId, `${label}.enrollmentId`),
+		operationId: parseLaneOperationId(record.operationId, `${label}.operationId`),
+		targetMaterialActivationId: resultValue(parseMpcMaterialActivationId(record.targetMaterialActivationId), `${label}.targetMaterialActivationId`),
+		materialActivation: parseMpcActivation(record.materialActivation, `${label}.materialActivation`),
+		publicIdentityDigestB64u: digest(record.publicIdentityDigestB64u, `${label}.publicIdentityDigestB64u`),
+		holderParticipant: parseLaneHolderParticipantRecordV1(record.holderParticipant, `${label}.holderParticipant`),
+		signingWorkerParticipant: parseSigningWorkerParticipantRecordV1(record.signingWorkerParticipant, `${label}.signingWorkerParticipant`),
+		participantSetBindingDigestB64u: resultValue(parseLaneParticipantBindingDigestB64u(record.participantSetBindingDigestB64u), `${label}.participantSetBindingDigestB64u`),
+		revocationEpoch: requiredInteger(record.revocationEpoch, `${label}.revocationEpoch`),
+		createdAtMs: requiredInteger(record.createdAtMs, `${label}.createdAtMs`)
+	};
+}
+function parseProductRevocationReason(raw, label) {
+	if (raw !== "user_revoked" && raw !== "policy_revoked" && raw !== "device_compromise" && raw !== "agent_compromise" && raw !== "rotation") throw new Error(`${label}.revocationReason is invalid`);
+	return raw;
+}
+function parseLaneProductEpochRecordV1(raw, label = "laneProductEpochRecord") {
+	const record = requireRecord(raw, label);
+	switch (record.state) {
+		case "pending_visibility": {
+			const value = exactRecord(record, [
+				"kind",
+				"walletId",
+				"walletKeyId",
+				"laneId",
+				"laneKind",
+				"laneShareEpoch",
+				"keyFamily",
+				"enrollmentId",
+				"operationId",
+				"targetMaterialActivationId",
+				"materialActivation",
+				"publicIdentityDigestB64u",
+				"holderParticipant",
+				"signingWorkerParticipant",
+				"participantSetBindingDigestB64u",
+				"revocationEpoch",
+				"createdAtMs",
+				"state",
+				"aggregateManifestDigestB64u",
+				"protocolCommitReceiptDigestB64u",
+				"holderDeliveryReceiptDigestB64u",
+				"serverActivationReceiptDigestB64u",
+				"pendingSinceMs"
+			], label);
+			if (value.kind !== "lane_product_epoch_record_v1") throw new Error(`${label}.kind is invalid`);
+			return {
+				...parseProductEpochCommon(value, label),
+				state: "pending_visibility",
+				aggregateManifestDigestB64u: digest(value.aggregateManifestDigestB64u, `${label}.aggregateManifestDigestB64u`),
+				protocolCommitReceiptDigestB64u: digest(value.protocolCommitReceiptDigestB64u, `${label}.protocolCommitReceiptDigestB64u`),
+				holderDeliveryReceiptDigestB64u: digest(value.holderDeliveryReceiptDigestB64u, `${label}.holderDeliveryReceiptDigestB64u`),
+				serverActivationReceiptDigestB64u: digest(value.serverActivationReceiptDigestB64u, `${label}.serverActivationReceiptDigestB64u`),
+				pendingSinceMs: requiredInteger(value.pendingSinceMs, `${label}.pendingSinceMs`)
+			};
+		}
+		case "active": {
+			const value = exactRecord(record, [
+				"kind",
+				"walletId",
+				"walletKeyId",
+				"laneId",
+				"laneKind",
+				"laneShareEpoch",
+				"keyFamily",
+				"enrollmentId",
+				"operationId",
+				"targetMaterialActivationId",
+				"materialActivation",
+				"publicIdentityDigestB64u",
+				"holderParticipant",
+				"signingWorkerParticipant",
+				"participantSetBindingDigestB64u",
+				"revocationEpoch",
+				"createdAtMs",
+				"state",
+				"aggregateManifestDigestB64u",
+				"aggregateActivationReceiptDigestB64u",
+				"activatedAtMs"
+			], label);
+			if (value.kind !== "lane_product_epoch_record_v1") throw new Error(`${label}.kind is invalid`);
+			return {
+				...parseProductEpochCommon(value, label),
+				state: "active",
+				aggregateManifestDigestB64u: digest(value.aggregateManifestDigestB64u, `${label}.aggregateManifestDigestB64u`),
+				aggregateActivationReceiptDigestB64u: digest(value.aggregateActivationReceiptDigestB64u, `${label}.aggregateActivationReceiptDigestB64u`),
+				activatedAtMs: requiredInteger(value.activatedAtMs, `${label}.activatedAtMs`)
+			};
+		}
+		case "retired": {
+			const value = exactRecord(record, [
+				"kind",
+				"walletId",
+				"walletKeyId",
+				"laneId",
+				"laneKind",
+				"laneShareEpoch",
+				"keyFamily",
+				"enrollmentId",
+				"operationId",
+				"targetMaterialActivationId",
+				"materialActivation",
+				"publicIdentityDigestB64u",
+				"holderParticipant",
+				"signingWorkerParticipant",
+				"participantSetBindingDigestB64u",
+				"revocationEpoch",
+				"createdAtMs",
+				"state",
+				"retirementReason",
+				"retirementReceiptDigestB64u",
+				"retiredAtMs"
+			], label);
+			if (value.kind !== "lane_product_epoch_record_v1") throw new Error(`${label}.kind is invalid`);
+			if (value.retirementReason !== "rotation" && value.retirementReason !== "device_compromise" && value.retirementReason !== "agent_compromise") throw new Error(`${label}.retirementReason is invalid`);
+			return {
+				...parseProductEpochCommon(value, label),
+				state: "retired",
+				retirementReason: value.retirementReason,
+				retirementReceiptDigestB64u: digest(value.retirementReceiptDigestB64u, `${label}.retirementReceiptDigestB64u`),
+				retiredAtMs: requiredInteger(value.retiredAtMs, `${label}.retiredAtMs`)
+			};
+		}
+		case "revocation_pending": {
+			const value = exactRecord(record, [
+				"kind",
+				"walletId",
+				"walletKeyId",
+				"laneId",
+				"laneKind",
+				"laneShareEpoch",
+				"keyFamily",
+				"enrollmentId",
+				"operationId",
+				"targetMaterialActivationId",
+				"materialActivation",
+				"publicIdentityDigestB64u",
+				"holderParticipant",
+				"signingWorkerParticipant",
+				"participantSetBindingDigestB64u",
+				"revocationEpoch",
+				"createdAtMs",
+				"state",
+				"revocationReason",
+				"retirementEffectBindingDigestB64u",
+				"revocationRequestedAtMs"
+			], label);
+			if (value.kind !== "lane_product_epoch_record_v1") throw new Error(`${label}.kind is invalid`);
+			const reason = parseProductRevocationReason(value.revocationReason, label);
+			return {
+				...parseProductEpochCommon(value, label),
+				state: "revocation_pending",
+				revocationEpoch: requiredInteger(value.revocationEpoch, `${label}.revocationEpoch`),
+				revocationReason: reason,
+				retirementEffectBindingDigestB64u: digest(value.retirementEffectBindingDigestB64u, `${label}.retirementEffectBindingDigestB64u`),
+				revocationRequestedAtMs: requiredInteger(value.revocationRequestedAtMs, `${label}.revocationRequestedAtMs`)
+			};
+		}
+		case "revoked": {
+			const value = exactRecord(record, [
+				"kind",
+				"walletId",
+				"walletKeyId",
+				"laneId",
+				"laneKind",
+				"laneShareEpoch",
+				"keyFamily",
+				"enrollmentId",
+				"operationId",
+				"targetMaterialActivationId",
+				"materialActivation",
+				"publicIdentityDigestB64u",
+				"holderParticipant",
+				"signingWorkerParticipant",
+				"participantSetBindingDigestB64u",
+				"revocationEpoch",
+				"createdAtMs",
+				"state",
+				"revocationReason",
+				"retirementEffectBindingDigestB64u",
+				"revocationReceiptDigestB64u",
+				"revokedAtMs"
+			], label);
+			if (value.kind !== "lane_product_epoch_record_v1") throw new Error(`${label}.kind is invalid`);
+			const reason = parseProductRevocationReason(value.revocationReason, label);
+			return {
+				...parseProductEpochCommon(value, label),
+				state: "revoked",
+				revocationEpoch: requiredInteger(value.revocationEpoch, `${label}.revocationEpoch`),
+				revocationReason: reason,
+				retirementEffectBindingDigestB64u: digest(value.retirementEffectBindingDigestB64u, `${label}.retirementEffectBindingDigestB64u`),
+				revocationReceiptDigestB64u: digest(value.revocationReceiptDigestB64u, `${label}.revocationReceiptDigestB64u`),
+				revokedAtMs: requiredInteger(value.revokedAtMs, `${label}.revokedAtMs`)
+			};
+		}
+		default: throw new Error(`${label}.state is invalid`);
+	}
+}
+function parseLaneProtocolLifecycleV1(raw, label = "laneProtocolLifecycle") {
+	const record = requireRecord(raw, label);
+	switch (record.state) {
+		case "preparing": return {
+			state: "preparing",
+			startedAtMs: requiredInteger(exactRecord(record, ["state", "startedAtMs"], label).startedAtMs, `${label}.startedAtMs`)
+		};
+		case "awaiting_protocol_commitment": return {
+			state: "awaiting_protocol_commitment",
+			startedAtMs: requiredInteger(exactRecord(record, ["state", "startedAtMs"], label).startedAtMs, `${label}.startedAtMs`)
+		};
+		case "committed_awaiting_holder_delivery": {
+			const value = exactRecord(record, [
+				"state",
+				"startedAtMs",
+				"committedAtMs",
+				"transcriptHashB64u",
+				"protocolCommitReceiptDigestB64u"
+			], label);
+			return {
+				state: "committed_awaiting_holder_delivery",
+				startedAtMs: requiredInteger(value.startedAtMs, `${label}.startedAtMs`),
+				committedAtMs: requiredInteger(value.committedAtMs, `${label}.committedAtMs`),
+				transcriptHashB64u: digest(value.transcriptHashB64u, `${label}.transcriptHashB64u`),
+				protocolCommitReceiptDigestB64u: digest(value.protocolCommitReceiptDigestB64u, `${label}.protocolCommitReceiptDigestB64u`)
+			};
+		}
+		case "awaiting_server_activation": {
+			const value = exactRecord(record, [
+				"state",
+				"startedAtMs",
+				"committedAtMs",
+				"transcriptHashB64u",
+				"protocolCommitReceiptDigestB64u",
+				"holderDeliveryReceiptDigestB64u",
+				"holderReceiptAtMs"
+			], label);
+			return {
+				state: "awaiting_server_activation",
+				startedAtMs: requiredInteger(value.startedAtMs, `${label}.startedAtMs`),
+				committedAtMs: requiredInteger(value.committedAtMs, `${label}.committedAtMs`),
+				transcriptHashB64u: digest(value.transcriptHashB64u, `${label}.transcriptHashB64u`),
+				protocolCommitReceiptDigestB64u: digest(value.protocolCommitReceiptDigestB64u, `${label}.protocolCommitReceiptDigestB64u`),
+				holderDeliveryReceiptDigestB64u: digest(value.holderDeliveryReceiptDigestB64u, `${label}.holderDeliveryReceiptDigestB64u`),
+				holderReceiptAtMs: requiredInteger(value.holderReceiptAtMs, `${label}.holderReceiptAtMs`)
+			};
+		}
+		case "ready_for_parent_visibility": {
+			const value = exactRecord(record, [
+				"state",
+				"startedAtMs",
+				"committedAtMs",
+				"transcriptHashB64u",
+				"protocolCommitReceiptDigestB64u",
+				"holderDeliveryReceiptDigestB64u",
+				"holderReceiptAtMs",
+				"serverActivationReceiptDigestB64u",
+				"serverActivatedAtMs"
+			], label);
+			return {
+				state: "ready_for_parent_visibility",
+				startedAtMs: requiredInteger(value.startedAtMs, `${label}.startedAtMs`),
+				committedAtMs: requiredInteger(value.committedAtMs, `${label}.committedAtMs`),
+				transcriptHashB64u: digest(value.transcriptHashB64u, `${label}.transcriptHashB64u`),
+				protocolCommitReceiptDigestB64u: digest(value.protocolCommitReceiptDigestB64u, `${label}.protocolCommitReceiptDigestB64u`),
+				holderDeliveryReceiptDigestB64u: digest(value.holderDeliveryReceiptDigestB64u, `${label}.holderDeliveryReceiptDigestB64u`),
+				holderReceiptAtMs: requiredInteger(value.holderReceiptAtMs, `${label}.holderReceiptAtMs`),
+				serverActivationReceiptDigestB64u: digest(value.serverActivationReceiptDigestB64u, `${label}.serverActivationReceiptDigestB64u`),
+				serverActivatedAtMs: requiredInteger(value.serverActivatedAtMs, `${label}.serverActivatedAtMs`)
+			};
+		}
+		case "active": {
+			const value = exactRecord(record, [
+				"state",
+				"transcriptHashB64u",
+				"protocolCommitReceiptDigestB64u",
+				"holderDeliveryReceiptDigestB64u",
+				"serverActivationReceiptDigestB64u",
+				"aggregateActivationReceiptDigestB64u",
+				"activatedAtMs"
+			], label);
+			return {
+				state: "active",
+				transcriptHashB64u: digest(value.transcriptHashB64u, `${label}.transcriptHashB64u`),
+				protocolCommitReceiptDigestB64u: digest(value.protocolCommitReceiptDigestB64u, `${label}.protocolCommitReceiptDigestB64u`),
+				holderDeliveryReceiptDigestB64u: digest(value.holderDeliveryReceiptDigestB64u, `${label}.holderDeliveryReceiptDigestB64u`),
+				serverActivationReceiptDigestB64u: digest(value.serverActivationReceiptDigestB64u, `${label}.serverActivationReceiptDigestB64u`),
+				aggregateActivationReceiptDigestB64u: digest(value.aggregateActivationReceiptDigestB64u, `${label}.aggregateActivationReceiptDigestB64u`),
+				activatedAtMs: requiredInteger(value.activatedAtMs, `${label}.activatedAtMs`)
+			};
+		}
+		case "aborted_precommit": {
+			const value = exactRecord(record, [
+				"state",
+				"startedAtMs",
+				"abortedAtMs",
+				"abortReason"
+			], label);
+			if (value.abortReason !== "cancelled" && value.abortReason !== "expired" && value.abortReason !== "revoked_before_commit") throw new Error(`${label}.abortReason is invalid`);
+			return {
+				state: "aborted_precommit",
+				startedAtMs: requiredInteger(value.startedAtMs, `${label}.startedAtMs`),
+				abortedAtMs: requiredInteger(value.abortedAtMs, `${label}.abortedAtMs`),
+				abortReason: value.abortReason
+			};
+		}
+		case "committed_completion_required": {
+			const value = exactRecord(record, [
+				"state",
+				"startedAtMs",
+				"committedAtMs",
+				"transcriptHashB64u",
+				"protocolCommitReceiptDigestB64u",
+				"recoveryReason"
+			], label);
+			if (value.recoveryReason !== "exact_redelivery_required" && value.recoveryReason !== "recovery_required") throw new Error(`${label}.recoveryReason is invalid`);
+			return {
+				state: "committed_completion_required",
+				startedAtMs: requiredInteger(value.startedAtMs, `${label}.startedAtMs`),
+				committedAtMs: requiredInteger(value.committedAtMs, `${label}.committedAtMs`),
+				transcriptHashB64u: digest(value.transcriptHashB64u, `${label}.transcriptHashB64u`),
+				protocolCommitReceiptDigestB64u: digest(value.protocolCommitReceiptDigestB64u, `${label}.protocolCommitReceiptDigestB64u`),
+				recoveryReason: value.recoveryReason
+			};
+		}
+		default: throw new Error(`${label}.state is invalid`);
+	}
+}
+function parseLaneEnrollmentLifecycleV1(raw, label = "laneEnrollmentLifecycle") {
+	const record = requireRecord(raw, label);
+	switch (record.state) {
+		case "preparing": {
+			const value = exactRecord(record, [
+				"state",
+				"manifestDigestB64u",
+				"startedAtMs"
+			], label);
+			return {
+				state: "preparing",
+				manifestDigestB64u: digest(value.manifestDigestB64u, `${label}.manifestDigestB64u`),
+				startedAtMs: requiredInteger(value.startedAtMs, `${label}.startedAtMs`)
+			};
+		}
+		case "committed_completion_required": {
+			const value = exactRecord(record, [
+				"state",
+				"manifestDigestB64u",
+				"committedChildOperationIds",
+				"markedAtMs"
+			], label);
+			const ids = requiredArray(value.committedChildOperationIds, `${label}.committedChildOperationIds`);
+			if (ids.length === 0) throw new Error(`${label}.committedChildOperationIds must be non-empty`);
+			return {
+				state: "committed_completion_required",
+				manifestDigestB64u: digest(value.manifestDigestB64u, `${label}.manifestDigestB64u`),
+				committedChildOperationIds: nonEmptyTuple(ids.map((id, index) => parseLaneOperationId(id, `${label}.committedChildOperationIds[${index}]`)), `${label}.committedChildOperationIds`),
+				markedAtMs: requiredInteger(value.markedAtMs, `${label}.markedAtMs`)
+			};
+		}
+		case "ready_for_visibility": {
+			const value = exactRecord(record, [
+				"state",
+				"manifestDigestB64u",
+				"aggregateReceiptDigestB64u",
+				"readyAtMs"
+			], label);
+			return {
+				state: "ready_for_visibility",
+				manifestDigestB64u: digest(value.manifestDigestB64u, `${label}.manifestDigestB64u`),
+				aggregateReceiptDigestB64u: digest(value.aggregateReceiptDigestB64u, `${label}.aggregateReceiptDigestB64u`),
+				readyAtMs: requiredInteger(value.readyAtMs, `${label}.readyAtMs`)
+			};
+		}
+		case "active": {
+			const value = exactRecord(record, [
+				"state",
+				"manifestDigestB64u",
+				"aggregateReceiptDigestB64u",
+				"activatedAtMs"
+			], label);
+			return {
+				state: "active",
+				manifestDigestB64u: digest(value.manifestDigestB64u, `${label}.manifestDigestB64u`),
+				aggregateReceiptDigestB64u: digest(value.aggregateReceiptDigestB64u, `${label}.aggregateReceiptDigestB64u`),
+				activatedAtMs: requiredInteger(value.activatedAtMs, `${label}.activatedAtMs`)
+			};
+		}
+		case "cancelled_precommit": return {
+			state: "cancelled_precommit",
+			cancelledAtMs: requiredInteger(exactRecord(record, ["state", "cancelledAtMs"], label).cancelledAtMs, `${label}.cancelledAtMs`)
+		};
+		case "revoking_committed_targets": {
+			const value = exactRecord(record, [
+				"state",
+				"manifestDigestB64u",
+				"reason",
+				"markedAtMs"
+			], label);
+			if (value.reason !== "cancelled_after_commit" && value.reason !== "expired_after_commit" && value.reason !== "revoked_during_activation") throw new Error(`${label}.reason is invalid`);
+			return {
+				state: "revoking_committed_targets",
+				manifestDigestB64u: digest(value.manifestDigestB64u, `${label}.manifestDigestB64u`),
+				reason: value.reason,
+				markedAtMs: requiredInteger(value.markedAtMs, `${label}.markedAtMs`)
+			};
+		}
+		case "revoked": {
+			const value = exactRecord(record, [
+				"state",
+				"manifestDigestB64u",
+				"aggregateRevocationReceiptDigestB64u",
+				"revokedAtMs"
+			], label);
+			return {
+				state: "revoked",
+				manifestDigestB64u: digest(value.manifestDigestB64u, `${label}.manifestDigestB64u`),
+				aggregateRevocationReceiptDigestB64u: digest(value.aggregateRevocationReceiptDigestB64u, `${label}.aggregateRevocationReceiptDigestB64u`),
+				revokedAtMs: requiredInteger(value.revokedAtMs, `${label}.revokedAtMs`)
+			};
+		}
+		default: throw new Error(`${label}.state is invalid`);
+	}
+}
+function buildLaneProtocolRecordV1(args) {
+	return {
+		job: args.job,
+		lifecycle: args.lifecycle
+	};
+}
+function buildAggregateLaneRevocationReceiptV1(args) {
+	return parseAggregateLaneRevocationReceiptV1({
+		kind: "aggregate_lane_revocation_receipt_v1",
+		...args
+	});
+}
+function buildRevokeSigningLaneV1(args) {
+	return parseRevokeSigningLaneV1({
+		kind: "revoke_signing_lane_v1",
+		...args
+	});
+}
+function buildCommitLaneEnrollmentRevocationV1(args) {
+	return parseCommitLaneEnrollmentRevocationV1({
+		kind: "commit_lane_enrollment_revocation_v1",
+		...args
+	});
+}
+function buildLaneProductEpochPendingVisibilityV1(args) {
+	const value = parseLaneProductEpochRecordV1({
+		kind: "lane_product_epoch_record_v1",
+		state: "pending_visibility",
+		...args
+	});
+	if (value.state !== "pending_visibility") throw new Error("product epoch state changed");
+	return value;
+}
+function buildLaneProductEpochRevokedV1(args) {
+	const value = parseLaneProductEpochRecordV1({
+		kind: "lane_product_epoch_record_v1",
+		state: "revoked",
+		...args
+	});
+	if (value.state !== "revoked") throw new Error("product epoch state changed");
+	return value;
+}
+function parseEcdsaServerRetirementReceiptV1(raw, label = "ecdsaRetirementReceipt") {
+	const record = exactRecord(raw, [
+		"kind",
+		"manifest",
+		"materialActivation",
+		"walletKeyId",
+		"laneId",
+		"laneShareEpoch",
+		"revocationEpoch",
+		"retirementReason",
+		"retirementCorrelationId",
+		"retirementRequestDigestB64u",
+		"serverGeneration",
+		"lifecycleId",
+		"receiptDigestB64u",
+		"retiredAt"
+	], label);
+	if (record.kind !== "ecdsa_server_retirement_receipt_v1") throw new Error(`${label}.kind is invalid`);
+	const manifest = exactRecord(record.manifest, ["manifestId", "manifestRevision"], `${label}.manifest`);
+	const retirementReason = record.retirementReason;
+	if (retirementReason !== "lane_revoked" && retirementReason !== "device_compromise" && retirementReason !== "agent_compromise" && retirementReason !== "rotation") throw new Error(`${label}.retirementReason is invalid`);
+	return {
+		kind: "ecdsa_server_retirement_receipt_v1",
+		manifest: {
+			manifestId: parseEcdsaCapabilityManifestId(manifest.manifestId),
+			manifestRevision: parseEcdsaCapabilityManifestRevision(manifest.manifestRevision)
+		},
+		materialActivation: parseMpcActivation(record.materialActivation, `${label}.materialActivation`),
+		walletKeyId: parseKeyId(record.walletKeyId, `${label}.walletKeyId`),
+		laneId: parseLaneId(record.laneId, `${label}.laneId`),
+		laneShareEpoch: parseShareEpoch(record.laneShareEpoch, `${label}.laneShareEpoch`),
+		revocationEpoch: requiredInteger(record.revocationEpoch, `${label}.revocationEpoch`),
+		retirementReason,
+		retirementCorrelationId: parseCorrelationId(record.retirementCorrelationId),
+		retirementRequestDigestB64u: digest(record.retirementRequestDigestB64u, `${label}.retirementRequestDigestB64u`),
+		serverGeneration: parseEcdsaServerGeneration(record.serverGeneration),
+		lifecycleId: parseEcdsaLifecycleId(record.lifecycleId),
+		receiptDigestB64u: digest(record.receiptDigestB64u, `${label}.receiptDigestB64u`),
+		retiredAt: parseIso(record.retiredAt, `${label}.retiredAt`)
+	};
+}
+function parseSigningWorkerLaneMaterialIdentityV1(raw, expectedKeyFamily, label = "signingWorkerLaneMaterialIdentity") {
+	const record = exactRecord(raw, [
+		"operationId",
+		"enrollmentId",
+		"walletId",
+		"walletKeyId",
+		"targetLaneId",
+		"targetLaneShareEpoch",
+		"targetMaterialActivationId",
+		"keyFamily",
+		"holderParticipantBindingDigestB64u",
+		"signingWorkerParticipantBindingDigestB64u",
+		"holderRecipientKeyDigestB64u",
+		"serverRecipientKeyDigestB64u",
+		"transcriptHashB64u",
+		"protocolCommitReceiptDigestB64u"
+	], label);
+	if (record.keyFamily !== expectedKeyFamily) throw new Error(`${label}.keyFamily is invalid`);
+	return {
+		operationId: resultValue(parseLaneOperationId$1(record.operationId), `${label}.operationId`),
+		enrollmentId: resultValue(parseLaneEnrollmentId(record.enrollmentId), `${label}.enrollmentId`),
+		walletId: resultValue(parseWalletId(record.walletId), `${label}.walletId`),
+		walletKeyId: resultValue(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
+		targetLaneId: resultValue(parseSigningLaneId(record.targetLaneId), `${label}.targetLaneId`),
+		targetLaneShareEpoch: resultValue(parseLaneShareEpoch(record.targetLaneShareEpoch), `${label}.targetLaneShareEpoch`),
+		targetMaterialActivationId: resultValue(parseMpcMaterialActivationId(record.targetMaterialActivationId), `${label}.targetMaterialActivationId`),
+		keyFamily: expectedKeyFamily,
+		holderParticipantBindingDigestB64u: digest(record.holderParticipantBindingDigestB64u, `${label}.holderParticipantBindingDigestB64u`),
+		signingWorkerParticipantBindingDigestB64u: digest(record.signingWorkerParticipantBindingDigestB64u, `${label}.signingWorkerParticipantBindingDigestB64u`),
+		holderRecipientKeyDigestB64u: digest(record.holderRecipientKeyDigestB64u, `${label}.holderRecipientKeyDigestB64u`),
+		serverRecipientKeyDigestB64u: digest(record.serverRecipientKeyDigestB64u, `${label}.serverRecipientKeyDigestB64u`),
+		transcriptHashB64u: digest(record.transcriptHashB64u, `${label}.transcriptHashB64u`),
+		protocolCommitReceiptDigestB64u: digest(record.protocolCommitReceiptDigestB64u, `${label}.protocolCommitReceiptDigestB64u`)
+	};
+}
+function parseEd25519ServerRetirementReceiptV1(raw, label = "ed25519RetirementReceipt") {
+	const record = exactRecord(raw, [
+		"kind",
+		"identity",
+		"revocationEpoch",
+		"retirementReason",
+		"retirementCorrelationId",
+		"retirementRequestDigestB64u",
+		"receiptDigestB64u",
+		"retiredAtMs"
+	], label);
+	if (record.kind !== "ed25519_server_retirement_receipt_v1") throw new Error(`${label}.kind is invalid`);
+	const retirementReason = record.retirementReason;
+	if (retirementReason !== "lane_revoked" && retirementReason !== "device_compromise" && retirementReason !== "agent_compromise" && retirementReason !== "rotation") throw new Error(`${label}.retirementReason is invalid`);
+	return {
+		kind: "ed25519_server_retirement_receipt_v1",
+		identity: parseSigningWorkerLaneMaterialIdentityV1(record.identity, "ed25519", `${label}.identity`),
+		revocationEpoch: requiredInteger(record.revocationEpoch, `${label}.revocationEpoch`),
+		retirementReason,
+		retirementCorrelationId: parseCorrelationId(record.retirementCorrelationId),
+		retirementRequestDigestB64u: digest(record.retirementRequestDigestB64u, `${label}.retirementRequestDigestB64u`),
+		receiptDigestB64u: digest(record.receiptDigestB64u, `${label}.receiptDigestB64u`),
+		retiredAtMs: requiredInteger(record.retiredAtMs, `${label}.retiredAtMs`)
+	};
+}
+function parseLaneServerRetirementReceiptV1(raw, label = "laneServerRetirementReceipt") {
+	const record = requireRecord(raw, label);
+	switch (record.kind) {
+		case "ecdsa_server_retirement_receipt_v1": return parseEcdsaServerRetirementReceiptV1(record, label);
+		case "ed25519_server_retirement_receipt_v1": return parseEd25519ServerRetirementReceiptV1(record, label);
+		default: throw new Error(`${label}.kind is invalid`);
+	}
+}
+//#endregion
+export { buildAggregateLaneRevocationReceiptV1, buildCommitLaneEnrollmentRevocationV1, buildLaneCreationTargetV1, buildLaneProductEpochPendingVisibilityV1, buildLaneProductEpochRevokedV1, buildLaneProtocolRecordV1, buildLaneRefreshTargetV1, buildRevokeSigningLaneV1, parseAggregateLaneActivationReceiptV1, parseAggregateLaneRevocationReceiptV1, parseCommitLaneEnrollmentRevocationV1, parseCompleteSigningLaneRevocationV1, parseEcdsaServerRetirementReceiptV1, parseEcdsaTargetCapabilityBindingV1, parseEd25519ServerRetirementReceiptV1, parseLaneEnrollmentLifecycleV1, parseLaneEnrollmentManifestV1, parseLaneHolderDeliveryReceiptV1, parseLaneProductEpochRecordV1, parseLaneProtocolCommitReceiptV1, parseLaneProtocolJobV1, parseLaneProtocolLifecycleV1, parseLaneRefreshPredecessorRetirementV1, parseLaneServerActivationReceiptV1, parseLaneServerRetirementReceiptV1, parseRevokeLaneEnrollmentV1, parseRevokeSigningLaneV1, parseRotatableSigningLaneJobV1, parseSigningWorkerLaneMaterialIdentityV1 };
+
+//# sourceMappingURL=rotationParsers.js.map