@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/core/deviceLinking/linkedDeviceSessionRecord.js

@@ -0,0 +1,668 @@
+import { hasWhitespaceOrControlCharacters, parseLinkDeviceSessionId, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId } from "../../shared-ts/src/utils/domainIds.js";
+import { parseDeviceId } from "../../shared-ts/src/authorization/capabilityKinds.js";
+import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
+import { assertNeverLinkSessionStateV1 } from "../../shared-ts/src/device-linking/contracts.js";
+import { requireRecordCopy } from "../../shared-ts/src/utils/validation.js";
+import { sameDelegatedWalletAuthorityV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
+import { parseExactAdministeredSignerManifestV1 } from "../../shared-ts/src/device-linking/delegatedActivationPlan.js";
+import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
+import { parseLinkSessionStateV1, parseLinkedDeviceApprovalV1 as parseLinkedDeviceApprovalV1$1, parseLinkedDeviceSessionClaimV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../shared-ts/src/device-linking/parsers.js";
+import "../../shared-ts/src/device-linking/requestProof.js";
+//#region src/core/deviceLinking/linkedDeviceSessionRecord.ts
+function sourceKeyManifestDigestForFamilyV1(digests, keyFamily) {
+	switch (keyFamily) {
+		case "ed25519": return digests.ed25519 ?? null;
+		case "ecdsa_secp256k1": return digests.ecdsa_secp256k1 ?? null;
+		default: return assertNeverSourceKeyFamilyV1(keyFamily);
+	}
+}
+function assertNeverSourceKeyFamilyV1(value) {
+	throw new Error(`unsupported source key family: ${String(value)}`);
+}
+function buildUnclaimedSessionRecordV1(payload, nowMs) {
+	const parsedPayload = parseQrLinkedDeviceSessionPayloadV1(payload);
+	const createdAtMs = requireTimestamp(nowMs, "nowMs");
+	if (parsedPayload.issuedAtMs - createdAtMs > 6e4) throw new Error("link session issuedAtMs is in the future");
+	return buildSessionRecordV1({
+		linkSessionId: parsedPayload.linkSessionId,
+		qrPayload: parsedPayload,
+		state: { state: "displaying_qr" },
+		revision: 1,
+		createdAtMs,
+		updatedAtMs: createdAtMs
+	});
+}
+function parseLinkedDeviceSessionRecordV1(raw) {
+	const record = requireRecordCopy(raw, "linked device session record");
+	requireAllowedKeys(record, [
+		"version",
+		"linkSessionId",
+		"qrPayload",
+		"state",
+		"revision",
+		"claimTranscript",
+		"approvalTranscript",
+		"targetFactor",
+		"emailOtpChallenge",
+		"sourceContributionPreparation",
+		"sourceContributionTranscript",
+		"authorityId",
+		"packageSetDigestB64u",
+		"createdAtMs",
+		"updatedAtMs"
+	]);
+	if (record.version !== "linked_device_session_v1") throw new Error("linked device session version is invalid");
+	const linkSessionId = parseId(record.linkSessionId, parseLinkDeviceSessionId, "linkSessionId");
+	const qrPayload = parseQrLinkedDeviceSessionPayloadV1(record.qrPayload);
+	if (qrPayload.linkSessionId !== linkSessionId) throw new Error("linkSessionId does not match QR payload");
+	const state = parseLinkSessionStateV1(record.state);
+	const revision = requirePositiveInteger(record.revision, "revision");
+	const createdAtMs = requireTimestamp(record.createdAtMs, "createdAtMs");
+	const updatedAtMs = requireTimestamp(record.updatedAtMs, "updatedAtMs");
+	if (updatedAtMs < createdAtMs) throw new Error("updatedAtMs precedes createdAtMs");
+	return buildSessionRecordV1({
+		linkSessionId,
+		qrPayload,
+		state,
+		revision,
+		claimTranscript: retiredShapeGuard("claimTranscript", () => parseOptionalClaimTranscript(record.claimTranscript)),
+		approvalTranscript: retiredShapeGuard("approvalTranscript", () => parseOptionalApprovalTranscript(record.approvalTranscript, "approvalTranscript")),
+		targetFactor: parseOptionalApprovedTargetFactor(record.targetFactor),
+		emailOtpChallenge: parseOptionalEmailOtpChallenge(record.emailOtpChallenge),
+		sourceContributionPreparation: parseOptionalSourceContributionPreparation(record.sourceContributionPreparation),
+		sourceContributionTranscript: retiredShapeGuard("sourceContributionTranscript", () => parseOptionalApprovalTranscript(record.sourceContributionTranscript, "sourceContributionTranscript")),
+		authorityId: parseOptionalId(record.authorityId, parseWalletAuthorityId, "authorityId"),
+		packageSetDigestB64u: parseOptionalDigest(record.packageSetDigestB64u, "packageSetDigestB64u"),
+		createdAtMs,
+		updatedAtMs
+	});
+}
+function parseQrLinkedDeviceSessionPayloadV1(raw) {
+	return parseQrLinkedDeviceSessionPayloadV5(raw);
+}
+function buildSessionRecordV1(input) {
+	requireRecordIdentityFacts(input);
+	switch (input.state.state) {
+		case "displaying_qr":
+			requireNoRecordFacts(input, "displaying_qr");
+			return {
+				version: "linked_device_session_v1",
+				linkSessionId: input.linkSessionId,
+				qrPayload: input.qrPayload,
+				state: input.state,
+				revision: input.revision,
+				createdAtMs: input.createdAtMs,
+				updatedAtMs: input.updatedAtMs
+			};
+		case "claimed":
+			requireClaimRecordFacts(input, "claimed");
+			return {
+				version: "linked_device_session_v1",
+				linkSessionId: input.linkSessionId,
+				qrPayload: input.qrPayload,
+				state: input.state,
+				claimTranscript: input.claimTranscript,
+				revision: input.revision,
+				createdAtMs: input.createdAtMs,
+				updatedAtMs: input.updatedAtMs
+			};
+		case "awaiting_target_factor": return buildApprovedSessionRecordV1(input);
+		case "awaiting_source_contribution": return buildSourceContributionSessionRecordV1(input);
+		case "provisioning": return buildProvisioningSessionRecordV1(input);
+		case "authority_pending_local_install": return buildPendingSessionRecordV1(input);
+		case "active": return buildActiveSessionRecordV1(input);
+		case "failed_before_commit":
+		case "cancelled":
+		case "expired":
+			requireTerminalRecordFacts(input, input.state.state);
+			return {
+				version: "linked_device_session_v1",
+				linkSessionId: input.linkSessionId,
+				qrPayload: input.qrPayload,
+				state: input.state,
+				...input.claimTranscript ? { claimTranscript: input.claimTranscript } : {},
+				...input.approvalTranscript ? { approvalTranscript: input.approvalTranscript } : {},
+				...input.targetFactor ? { targetFactor: input.targetFactor } : {},
+				...input.emailOtpChallenge ? { emailOtpChallenge: input.emailOtpChallenge } : {},
+				...input.sourceContributionPreparation ? { sourceContributionPreparation: input.sourceContributionPreparation } : {},
+				...input.sourceContributionTranscript ? { sourceContributionTranscript: input.sourceContributionTranscript } : {},
+				revision: input.revision,
+				createdAtMs: input.createdAtMs,
+				updatedAtMs: input.updatedAtMs
+			};
+		default: return assertNeverLinkSessionStateV1(input.state);
+	}
+}
+function buildApprovedSessionRecordV1(input) {
+	if (input.state.state !== "awaiting_target_factor") throw new Error("approved session state is invalid");
+	requireApprovedRecordFacts(input, input.state.state);
+	if (input.sourceContributionPreparation || input.sourceContributionTranscript) throw new Error("awaiting target-factor session contains source-contribution facts");
+	return approvedStageSessionRecordV1(input, input.state, {});
+}
+function buildSourceContributionSessionRecordV1(input) {
+	if (input.state.state !== "awaiting_source_contribution") throw new Error("source-contribution session state is invalid");
+	requireApprovedRecordFacts(input, input.state.state);
+	if (!input.sourceContributionPreparation || input.sourceContributionTranscript) throw new Error("source-contribution session facts are incomplete");
+	return approvedStageSessionRecordV1(input, input.state, { sourceContributionPreparation: input.sourceContributionPreparation });
+}
+function buildProvisioningSessionRecordV1(input) {
+	if (input.state.state !== "provisioning") throw new Error("provisioning session state is invalid");
+	requireApprovedRecordFacts(input, input.state.state);
+	if (!input.sourceContributionPreparation || !input.sourceContributionTranscript) throw new Error("provisioning session facts are incomplete");
+	return approvedStageSessionRecordV1(input, input.state, {
+		sourceContributionPreparation: input.sourceContributionPreparation,
+		sourceContributionTranscript: input.sourceContributionTranscript
+	});
+}
+function buildPendingSessionRecordV1(input) {
+	if (input.state.state !== "authority_pending_local_install") throw new Error("pending session state is invalid");
+	requireCommittedRecordFacts(input, input.state.state);
+	if (input.authorityId !== input.state.authorityId) throw new Error("pending authority facts do not match state");
+	if (input.packageSetDigestB64u !== input.state.packageSetDigestB64u) throw new Error("pending package digest does not match state");
+	return approvedStageSessionRecordV1(input, input.state, {
+		sourceContributionPreparation: input.sourceContributionPreparation,
+		sourceContributionTranscript: input.sourceContributionTranscript,
+		authorityId: input.authorityId,
+		packageSetDigestB64u: input.packageSetDigestB64u
+	});
+}
+function buildActiveSessionRecordV1(input) {
+	if (input.state.state !== "active") throw new Error("active session state is invalid");
+	requireCommittedRecordFacts(input, "active");
+	if (input.authorityId !== input.state.authorityId) throw new Error("active authority facts do not match state");
+	return approvedStageSessionRecordV1(input, input.state, {
+		sourceContributionPreparation: input.sourceContributionPreparation,
+		sourceContributionTranscript: input.sourceContributionTranscript,
+		authorityId: input.authorityId,
+		packageSetDigestB64u: input.packageSetDigestB64u
+	});
+}
+/**
+* Lays out a record from owner approval onward, in the key order every stored record
+* uses: the approval-stage facts, then the facts the caller's state adds.
+*/
+function approvedStageSessionRecordV1(input, state, stageFacts) {
+	return {
+		version: "linked_device_session_v1",
+		linkSessionId: input.linkSessionId,
+		qrPayload: input.qrPayload,
+		state,
+		claimTranscript: input.claimTranscript,
+		approvalTranscript: input.approvalTranscript,
+		...targetFactorRecordFieldsV1(input.targetFactor, input.emailOtpChallenge),
+		...stageFacts,
+		revision: input.revision,
+		createdAtMs: input.createdAtMs,
+		updatedAtMs: input.updatedAtMs
+	};
+}
+/** A passkey record never carries Email OTP challenge state. */
+function targetFactorRecordFieldsV1(targetFactor, emailOtpChallenge) {
+	if (targetFactor.kind === "passkey_prf") return { targetFactor };
+	return {
+		targetFactor,
+		...emailOtpChallenge ? { emailOtpChallenge } : {}
+	};
+}
+function replaceSessionRecordV1(record, patch) {
+	return buildSessionRecordV1({
+		linkSessionId: record.linkSessionId,
+		qrPayload: record.qrPayload,
+		state: patch.state ?? record.state,
+		revision: patch.revision,
+		claimTranscript: patch.claimTranscript ?? record.claimTranscript,
+		approvalTranscript: patch.approvalTranscript ?? record.approvalTranscript,
+		targetFactor: patch.targetFactor ?? record.targetFactor,
+		emailOtpChallenge: patch.emailOtpChallenge ?? record.emailOtpChallenge,
+		sourceContributionPreparation: patch.sourceContributionPreparation ?? record.sourceContributionPreparation,
+		sourceContributionTranscript: patch.sourceContributionTranscript ?? record.sourceContributionTranscript,
+		authorityId: patch.authorityId ?? record.authorityId,
+		packageSetDigestB64u: patch.packageSetDigestB64u ?? record.packageSetDigestB64u,
+		createdAtMs: record.createdAtMs,
+		updatedAtMs: patch.updatedAtMs
+	});
+}
+/** Builds the next linear session record for the authority commit transaction. */
+function buildAuthorityPendingLocalInstallSessionRecordV1(input) {
+	const nowMs = requireTimestamp(input.nowMs, "nowMs");
+	if (input.record.state.state !== "provisioning") throw new Error("linked-device session is not ready for authority commit");
+	return replaceSessionRecordV1(input.record, {
+		state: authorityPendingStateV1(input.record, input.authorityId, input.packageSetDigestB64u),
+		authorityId: input.authorityId,
+		packageSetDigestB64u: input.packageSetDigestB64u,
+		revision: input.record.revision + 1,
+		updatedAtMs: nowMs
+	});
+}
+/** Builds the next linear session record for the authority activation transaction. */
+function buildAuthorityActiveSessionRecordV1(input) {
+	const nowMs = requireTimestamp(input.nowMs, "nowMs");
+	const activatedAtMs = requireTimestamp(input.activatedAtMs, "activatedAtMs");
+	if (activatedAtMs > nowMs) throw new Error("activatedAtMs cannot be in the future");
+	if (input.record.state.state !== "authority_pending_local_install") throw new Error("linked-device session has no pending authority installation");
+	return replaceSessionRecordV1(input.record, {
+		state: activeStateV1(input.record, activatedAtMs),
+		revision: input.record.revision + 1,
+		updatedAtMs: nowMs
+	});
+}
+function claimedStateV1(record, claim) {
+	if (record.state.state !== "displaying_qr") throw new Error("link session is not claimable");
+	return {
+		state: "claimed",
+		deviceId: parseDeviceIdValue(claim.deviceId)
+	};
+}
+function awaitingTargetFactorStateV1(record) {
+	if (record.state.state !== "claimed") throw new Error("link session is not awaiting owner approval");
+	return {
+		state: "awaiting_target_factor",
+		deviceId: record.state.deviceId
+	};
+}
+function provisioningStateV1(record) {
+	if (record.state.state !== "awaiting_source_contribution") throw new Error("link session is not awaiting source contribution");
+	return {
+		state: "provisioning",
+		deviceId: record.state.deviceId
+	};
+}
+function awaitingSourceContributionStateV1(record) {
+	if (record.state.state !== "awaiting_target_factor") throw new Error("link session is not awaiting target credential");
+	return {
+		state: "awaiting_source_contribution",
+		deviceId: record.state.deviceId
+	};
+}
+function authorityPendingStateV1(record, authorityId, packageSetDigestB64u) {
+	if (record.state.state !== "provisioning") throw new Error("link session has no pending authority installation");
+	return {
+		state: "authority_pending_local_install",
+		deviceId: record.state.deviceId,
+		authorityId,
+		packageSetDigestB64u
+	};
+}
+function activeStateV1(record, activatedAtMs) {
+	if (record.state.state !== "authority_pending_local_install") throw new Error("link session has no pending authority installation");
+	return {
+		state: "active",
+		deviceId: record.state.deviceId,
+		authorityId: record.state.authorityId,
+		activatedAtMs
+	};
+}
+function isPrecommitState(state) {
+	switch (state.state) {
+		case "displaying_qr":
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning": return true;
+		case "authority_pending_local_install":
+		case "active":
+		case "failed_before_commit":
+		case "cancelled":
+		case "expired": return false;
+		default: return assertNeverLinkSessionStateV1(state);
+	}
+}
+function sessionExpiryMsV1(record) {
+	switch (record.state.state) {
+		case "displaying_qr": return record.qrPayload.expiresAtMs;
+		case "claimed": return record.claimTranscript?.value.claimExpiresAtMs ?? record.qrPayload.expiresAtMs;
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning": return record.approvalTranscript?.value.expiresAtMs ?? record.qrPayload.expiresAtMs;
+		case "authority_pending_local_install":
+		case "active":
+		case "failed_before_commit":
+		case "cancelled":
+		case "expired": return Number.POSITIVE_INFINITY;
+		default: return assertNeverLinkSessionStateV1(record.state);
+	}
+}
+function awaitingTargetDeadlineMsV1(record) {
+	if (record.state.state !== "awaiting_target_factor") throw new Error("link session is not awaiting target factor");
+	return record.approvalTranscript?.value.expiresAtMs ?? record.qrPayload.expiresAtMs;
+}
+function awaitingSourceContributionDeadlineMsV1(record) {
+	if (record.state.state !== "awaiting_source_contribution") throw new Error("link session is not awaiting source contribution");
+	return record.approvalTranscript?.value.expiresAtMs ?? record.qrPayload.expiresAtMs;
+}
+function linkedDeviceQrPayloadsEqualV1(left, right) {
+	if (left.version !== right.version || left.purpose !== right.purpose || left.linkSessionId !== right.linkSessionId || left.linkPublicKeyB64u !== right.linkPublicKeyB64u || left.devicePublicKeyB64u !== right.devicePublicKeyB64u || !sameDelegatedWalletAuthorityV1(left.requestedPermission, right.requestedPermission) || left.issuedAtMs !== right.issuedAtMs || left.expiresAtMs !== right.expiresAtMs) return false;
+	switch (left.targetFactor.kind) {
+		case "passkey_prf": return right.targetFactor.kind === "passkey_prf";
+		case "email_otp": return right.targetFactor.kind === "email_otp" && left.targetEmail === right.targetEmail;
+		default: return assertNeverLinkedDeviceTargetFactorV1(left.targetFactor);
+	}
+}
+function claimTranscriptMatchesDigest(record, digest) {
+	return record.claimTranscript?.digestB64u === digest;
+}
+function approvalTranscriptMatchesDigest(record, digest) {
+	return record.approvalTranscript?.digestB64u === digest;
+}
+function sourceContributionTranscriptMatchesDigest(record, digest) {
+	return record.sourceContributionTranscript?.digestB64u === digest;
+}
+function linkedDeviceEmailOtpChallengesEqualV1(left, right) {
+	switch (left.state) {
+		case "available": return right.state === "available" && left.maskedEmailHint === right.maskedEmailHint;
+		case "sent": return right.state === "sent" && left.challengeId === right.challengeId && left.workerEphemeralPublicKey65B64u === right.workerEphemeralPublicKey65B64u && left.maskedEmailHint === right.maskedEmailHint && left.expiresAtMs === right.expiresAtMs && left.resendAvailableAtMs === right.resendAvailableAtMs;
+		default: return assertNeverLinkedDeviceEmailOtpChallengeV1(left);
+	}
+}
+function linkedDevicePrecommitFailuresEqualV1(left, right) {
+	switch (left.kind) {
+		case "invalid_input": return right.kind === "invalid_input" && left.reason === right.reason;
+		case "unauthorized_source": return right.kind === "unauthorized_source" && left.reason === right.reason;
+		case "revoked_source": return right.kind === "revoked_source" && left.reason === right.reason;
+		case "permission_attenuation_failed": return right.kind === "permission_attenuation_failed" && left.reason === right.reason;
+		case "target_factor_failed": return right.kind === "target_factor_failed" && left.reason === right.reason;
+		case "expired_session": return right.kind === "expired_session" && left.reason === right.reason;
+		case "cancelled_session": return right.kind === "cancelled_session" && left.reason === right.reason;
+		case "claim_conflict": return right.kind === "claim_conflict" && left.reason === right.reason;
+		case "package_preparation_failed": return right.kind === "package_preparation_failed" && left.reason === right.reason;
+		default: return assertNeverLinkPrecommitFailureV1(left);
+	}
+}
+function assertNeverLinkedDeviceTargetFactorV1(value) {
+	throw new Error(`unsupported linked-device target factor: ${String(value)}`);
+}
+function assertNeverLinkedDeviceEmailOtpChallengeV1(value) {
+	throw new Error(`unsupported linked-device email OTP challenge: ${String(value)}`);
+}
+function assertNeverLinkPrecommitFailureV1(value) {
+	throw new Error(`unsupported linked-device precommit failure: ${String(value)}`);
+}
+function parseLinkedDeviceApprovalV1(raw) {
+	return parseLinkedDeviceApprovalV1$1(raw);
+}
+function parseLinkedDeviceClaimV1(raw) {
+	return parseLinkedDeviceSessionClaimV1(raw);
+}
+function parseOptionalClaimTranscript(raw) {
+	if (raw === void 0) return void 0;
+	const record = requireRecordCopy(raw, "claimTranscript");
+	requireExactKeys(record, ["digestB64u", "value"]);
+	return {
+		digestB64u: requireDigest(record.digestB64u, "claimTranscript.digestB64u"),
+		value: parseLinkedDeviceClaimV1(record.value)
+	};
+}
+/**
+* A stored transcript no longer parses under the current schema. This class
+* marks exactly the failures a deployment boundary produces - transcript
+* shapes are what refactors move - so a store can delete-and-recover them
+* while every value-consistency failure (tampering) keeps throwing raw.
+*/
+var LinkedDeviceRetiredSessionShapeErrorV1 = class extends Error {
+	constructor(transcript, cause) {
+		super(`linked-device ${transcript} shape is retired: ${cause instanceof Error ? cause.message : String(cause)}`);
+		this.name = "LinkedDeviceRetiredSessionShapeErrorV1";
+	}
+};
+function retiredShapeGuard(transcript, parse) {
+	try {
+		return parse();
+	} catch (error) {
+		if (error instanceof LinkedDeviceRetiredSessionShapeErrorV1) throw error;
+		throw new LinkedDeviceRetiredSessionShapeErrorV1(transcript, error);
+	}
+}
+/** The owner approval and its source-contribution re-approval share one transcript shape. */
+function parseOptionalApprovalTranscript(raw, field) {
+	if (raw === void 0) return void 0;
+	const record = requireRecordCopy(raw, field);
+	requireExactKeys(record, [
+		"digestB64u",
+		"value",
+		"sourceSignerManifest",
+		"sourceKeyManifestDigestsB64u",
+		"sourceAuthorityDigestB64u"
+	]);
+	const value = parseLinkedDeviceApprovalV1(record.value);
+	if (field === "sourceContributionTranscript" && !value.sourceContribution) throw new Error(`${field}.value has no source contribution`);
+	const sourceKeyManifestDigestsB64u = parseSourceKeyManifestDigestsV1(record.sourceKeyManifestDigestsB64u, `${field}.sourceKeyManifestDigestsB64u`);
+	const sourceSignerManifest = parseExactAdministeredSignerManifestV1(record.sourceSignerManifest);
+	assertSourceKeyManifestDigestFamiliesMatchManifestV1(sourceSignerManifest, sourceKeyManifestDigestsB64u);
+	return {
+		digestB64u: requireDigest(record.digestB64u, `${field}.digestB64u`),
+		value,
+		sourceSignerManifest,
+		sourceKeyManifestDigestsB64u,
+		sourceAuthorityDigestB64u: requireDigest(record.sourceAuthorityDigestB64u, `${field}.sourceAuthorityDigestB64u`)
+	};
+}
+function parseSourceKeyManifestDigestsV1(raw, field) {
+	const record = requireRecordCopy(raw, field);
+	const keys = Object.keys(record).sort();
+	if (keys.length === 1 && keys[0] === "ed25519") return { ed25519: requireDigest(record.ed25519, `${field}.ed25519`) };
+	if (keys.length === 1 && keys[0] === "ecdsa_secp256k1") return { ecdsa_secp256k1: requireDigest(record.ecdsa_secp256k1, `${field}.ecdsa_secp256k1`) };
+	if (keys.length === 2 && keys[0] === "ecdsa_secp256k1" && keys[1] === "ed25519") return {
+		ed25519: requireDigest(record.ed25519, `${field}.ed25519`),
+		ecdsa_secp256k1: requireDigest(record.ecdsa_secp256k1, `${field}.ecdsa_secp256k1`)
+	};
+	throw new Error(`${field} must contain exactly one digest for each approved source key family`);
+}
+function parseOptionalSourceContributionPreparation(raw) {
+	if (raw === void 0) return void 0;
+	return parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1(raw);
+}
+function assertSourceKeyManifestDigestFamiliesMatchManifestV1(manifest, digests) {
+	const manifestHasEd25519 = manifest.keyFamilies.some((family) => family === "ed25519");
+	const manifestHasEcdsa = manifest.keyFamilies.some((family) => family === "ecdsa_secp256k1");
+	const digestHasEd25519 = digests.ed25519 !== void 0;
+	const digestHasEcdsa = digests.ecdsa_secp256k1 !== void 0;
+	if (manifestHasEd25519 !== digestHasEd25519 || manifestHasEcdsa !== digestHasEcdsa) throw new Error("source key manifest digest families do not match the verified signer manifest");
+}
+function parseOptionalApprovedTargetFactor(raw) {
+	if (raw === void 0) return void 0;
+	const record = requireRecordCopy(raw, "targetFactor");
+	if (record.kind === "passkey_prf") {
+		requireExactKeys(record, ["kind"]);
+		return { kind: "passkey_prf" };
+	}
+	if (record.kind === "email_otp") {
+		const targetEmail = parseId(record.targetEmail, parseVerifiedEmailAddress, "targetFactor.targetEmail");
+		const enrollment = requireRecordCopy(record.enrollment, "targetFactor.enrollment");
+		if (enrollment.kind === "existing_enrollment") {
+			requireExactKeys(record, [
+				"kind",
+				"targetEmail",
+				"enrollment",
+				"baseWalletAuthMethodId"
+			]);
+			requireExactKeys(enrollment, ["kind"]);
+			return {
+				kind: "email_otp",
+				targetEmail,
+				enrollment: { kind: "existing_enrollment" },
+				baseWalletAuthMethodId: parseId(record.baseWalletAuthMethodId, parseWalletAuthMethodId, "targetFactor.baseWalletAuthMethodId")
+			};
+		}
+		if (enrollment.kind === "new_enrollment") {
+			requireExactKeys(record, [
+				"kind",
+				"targetEmail",
+				"enrollment"
+			]);
+			requireExactKeys(enrollment, ["kind"]);
+			return {
+				kind: "email_otp",
+				targetEmail,
+				enrollment: { kind: "new_enrollment" }
+			};
+		}
+		throw new Error("targetFactor.enrollment.kind is invalid");
+	}
+	throw new Error("targetFactor.kind is invalid");
+}
+function parseOptionalEmailOtpChallenge(raw) {
+	if (raw === void 0) return void 0;
+	const record = requireRecordCopy(raw, "emailOtpChallenge");
+	const state = parseIdentityString(record.state, "emailOtpChallenge.state");
+	if (state === "available") {
+		requireExactKeys(record, ["state", "maskedEmailHint"]);
+		return {
+			state,
+			maskedEmailHint: parseIdentityString(record.maskedEmailHint, "emailOtpChallenge.maskedEmailHint")
+		};
+	}
+	if (state === "sent") {
+		requireExactKeys(record, ["state", ...SENT_EMAIL_OTP_CHALLENGE_KEYS]);
+		return parseSentEmailOtpChallengeFieldsV1(record, "emailOtpChallenge");
+	}
+	throw new Error("emailOtpChallenge.state is invalid");
+}
+function parseEmailOtpChallengeV1(raw) {
+	const record = requireRecordCopy(raw, "challenge");
+	requireExactKeys(record, SENT_EMAIL_OTP_CHALLENGE_KEYS);
+	return parseSentEmailOtpChallengeFieldsV1(record, "challenge");
+}
+const SENT_EMAIL_OTP_CHALLENGE_KEYS = [
+	"challengeId",
+	"workerEphemeralPublicKey65B64u",
+	"maskedEmailHint",
+	"expiresAtMs",
+	"resendAvailableAtMs"
+];
+/** A stored challenge and a newly sent one parse the same fields under their own prefix. */
+function parseSentEmailOtpChallengeFieldsV1(record, field) {
+	return {
+		state: "sent",
+		challengeId: parseIdentityString(record.challengeId, `${field}.challengeId`),
+		workerEphemeralPublicKey65B64u: parseIdentityString(record.workerEphemeralPublicKey65B64u, `${field}.workerEphemeralPublicKey65B64u`),
+		maskedEmailHint: parseIdentityString(record.maskedEmailHint, `${field}.maskedEmailHint`),
+		expiresAtMs: requireTimestamp(record.expiresAtMs, `${field}.expiresAtMs`),
+		resendAvailableAtMs: requireTimestamp(record.resendAvailableAtMs, `${field}.resendAvailableAtMs`)
+	};
+}
+function requireNoRecordFacts(input, state) {
+	if (input.claimTranscript || input.approvalTranscript || input.targetFactor || input.emailOtpChallenge || input.sourceContributionPreparation || input.sourceContributionTranscript || input.authorityId || input.packageSetDigestB64u) throw new Error(`${state} session carries invalid durable facts`);
+}
+function requireClaimRecordFacts(input, state) {
+	if (!input.claimTranscript || input.approvalTranscript || input.targetFactor || input.emailOtpChallenge || input.sourceContributionPreparation || input.sourceContributionTranscript || input.authorityId || input.packageSetDigestB64u) throw new Error(`${state} session facts are invalid`);
+}
+function requireApprovedRecordFacts(input, state) {
+	if (!input.claimTranscript || !input.approvalTranscript || !input.targetFactor) throw new Error(`${state} session facts are incomplete`);
+	if (input.authorityId || input.packageSetDigestB64u) throw new Error(`${state} session contains committed facts`);
+	if (input.targetFactor.kind === "passkey_prf" && input.emailOtpChallenge) throw new Error(`${state} passkey session contains email challenge state`);
+}
+function requireCommittedRecordFacts(input, state) {
+	if (!input.claimTranscript || !input.approvalTranscript || !input.targetFactor || !input.authorityId || !input.packageSetDigestB64u) throw new Error(`${state} session facts are incomplete`);
+	if (!input.sourceContributionPreparation || !input.sourceContributionTranscript) throw new Error(`${state} session source-contribution facts are incomplete`);
+	if (input.targetFactor.kind === "passkey_prf" && input.emailOtpChallenge) throw new Error(`${state} passkey session contains email challenge state`);
+}
+function requireNoCommittedFacts(input, state) {
+	if (input.authorityId || input.packageSetDigestB64u) throw new Error(`${state} session contains committed facts`);
+}
+function requireRecordIdentityFacts(input) {
+	if (input.targetFactor && input.targetFactor.kind !== input.qrPayload.targetFactor.kind) throw new Error("target factor does not match QR payload");
+	const claim = input.claimTranscript?.value;
+	if (claim) {
+		if (claim.linkSessionId !== input.linkSessionId || claim.devicePublicKeyB64u !== input.qrPayload.devicePublicKeyB64u || claim.targetFactor.kind !== input.qrPayload.targetFactor.kind) throw new Error("claim transcript identity does not match QR payload");
+	}
+	const approval = input.approvalTranscript?.value;
+	if (approval) {
+		if (approval.linkSessionId !== input.linkSessionId || approval.linkPublicKeyB64u !== input.qrPayload.linkPublicKeyB64u || approval.devicePublicKeyB64u !== input.qrPayload.devicePublicKeyB64u || approval.targetFactor.kind !== input.qrPayload.targetFactor.kind) throw new Error("approval transcript identity does not match QR payload");
+	}
+	if (claim && approval && parseDeviceIdValue(claim.deviceId) !== parseDeviceIdValue(approval.deviceId)) throw new Error("approval transcript device identity does not match claim transcript");
+	switch (input.state.state) {
+		case "displaying_qr":
+		case "failed_before_commit":
+		case "cancelled":
+		case "expired": return;
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning":
+			if (!claim || input.state.deviceId !== parseDeviceIdValue(claim.deviceId)) throw new Error(`${input.state.state} device identity does not match claim transcript`);
+			return;
+		case "authority_pending_local_install":
+		case "active":
+			if (!claim || !approval || input.state.deviceId !== parseDeviceIdValue(claim.deviceId) || input.state.deviceId !== parseDeviceIdValue(approval.deviceId)) throw new Error(`${input.state.state} device identity does not match transcripts`);
+			return;
+		default: return assertNeverLinkSessionStateV1(input.state);
+	}
+}
+function requireTerminalRecordFacts(input, state) {
+	requireNoCommittedFacts(input, state);
+	if (!input.claimTranscript && (input.approvalTranscript || input.targetFactor || input.emailOtpChallenge)) throw new Error(`${state} session facts are incomplete`);
+	if (!input.approvalTranscript && input.emailOtpChallenge) throw new Error(`${state} session email challenge has no approval`);
+	if (input.sourceContributionTranscript && !input.sourceContributionPreparation) throw new Error(`${state} source contribution transcript has no preparation`);
+	if (input.sourceContributionPreparation && (!input.approvalTranscript || !input.targetFactor)) throw new Error(`${state} source contribution preparation has no approval`);
+	if (input.approvalTranscript && !input.targetFactor) throw new Error(`${state} session approval has no target factor`);
+	if (input.targetFactor?.kind === "passkey_prf" && input.emailOtpChallenge) throw new Error(`${state} passkey session contains email challenge state`);
+}
+function parseDeviceIdValue(raw) {
+	const parsed = parseDeviceId(raw);
+	if (!parsed.ok) throw new Error(`deviceId: ${parsed.error.message}`);
+	return parsed.value;
+}
+function parseId(raw, parser, field) {
+	const parsed = parser(raw);
+	if (!parsed.ok) throw new Error(`${field}: ${parsed.error.message}`);
+	return parsed.value;
+}
+function parseOptionalId(raw, parser, field) {
+	return raw === void 0 ? void 0 : parseId(raw, parser, field);
+}
+function parseIdentityString(raw, field) {
+	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw || hasWhitespaceOrControlCharacters(raw)) throw new Error(`${field} is invalid`);
+	return raw;
+}
+function requireDigest(raw, field) {
+	try {
+		return parseDigestB64u(raw);
+	} catch {
+		throw new Error(`${field} is invalid`);
+	}
+}
+function parseOptionalDigest(raw, field) {
+	return raw === void 0 ? void 0 : requireDigest(raw, field);
+}
+function requireTimestamp(raw, field) {
+	if (!Number.isSafeInteger(raw) || Number(raw) <= 0) throw new Error(`${field} must be a positive safe integer`);
+	return Number(raw);
+}
+function requirePositiveInteger(raw, field) {
+	return requireTimestamp(raw, field);
+}
+function requireExactKeys(record, expected) {
+	const actual = Object.keys(record).sort();
+	const required = [...expected].sort();
+	if (actual.length !== required.length || actual.some((key, index) => key !== required[index])) throw new Error("record contains invalid fields");
+}
+function requireAllowedKeys(record, allowed) {
+	const allowedSet = new Set(allowed);
+	for (const key of Object.keys(record)) if (!allowedSet.has(key)) throw new Error("record contains invalid fields");
+}
+function conflictResult(expectedRevision, record) {
+	return {
+		outcome: "conflict",
+		expectedRevision,
+		actualRevision: record?.revision ?? null,
+		record
+	};
+}
+function invalidStateResult(record) {
+	return {
+		outcome: "invalid_state",
+		state: record.state.state,
+		record
+	};
+}
+function integrityResult(record, reason) {
+	return {
+		outcome: "integrity_error",
+		reason,
+		record
+	};
+}
+//#endregion
+export { LinkedDeviceRetiredSessionShapeErrorV1, activeStateV1, approvalTranscriptMatchesDigest, authorityPendingStateV1, awaitingSourceContributionDeadlineMsV1, awaitingSourceContributionStateV1, awaitingTargetDeadlineMsV1, awaitingTargetFactorStateV1, buildAuthorityActiveSessionRecordV1, buildAuthorityPendingLocalInstallSessionRecordV1, buildUnclaimedSessionRecordV1, claimTranscriptMatchesDigest, claimedStateV1, conflictResult, integrityResult, invalidStateResult, isPrecommitState, linkedDeviceEmailOtpChallengesEqualV1, linkedDevicePrecommitFailuresEqualV1, linkedDeviceQrPayloadsEqualV1, parseDeviceIdValue, parseEmailOtpChallengeV1, parseId, parseLinkedDeviceSessionRecordV1, parseQrLinkedDeviceSessionPayloadV1, provisioningStateV1, replaceSessionRecordV1, requireDigest, requireTimestamp, sessionExpiryMsV1, sourceContributionTranscriptMatchesDigest, sourceKeyManifestDigestForFamilyV1 };
+
+//# sourceMappingURL=linkedDeviceSessionRecord.js.map