@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/core/deviceLinking/linkedDeviceSession.js

@@ -1,25 +1,10 @@
-import { hasWhitespaceOrControlCharacters, mpcMaterialActivationRefsEqual, parseLinkDeviceSessionId, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId } from "../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../../shared-ts/src/authorization/capabilityKinds.js";
-import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
-import { assertNeverLinkSessionStateV1 } from "../../shared-ts/src/device-linking/contracts.js";
-import { parseExactAdministeredSignerManifestV1 } from "../../shared-ts/src/device-linking/delegatedActivationPlan.js";
-import { hasDelegatedWalletPermissionV1, sameDelegatedWalletAuthorityV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
-import { routerAbMpcMaterialActivationRefFromWire, sameRouterAbMpcMaterialActivationRef } from "../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
-import { parseLinkSessionStateV1, parseLinkedDeviceApprovalV1 as parseLinkedDeviceApprovalV1$1, parseLinkedDeviceSessionClaimV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../shared-ts/src/device-linking/parsers.js";
+import { parseLinkDeviceSessionId, parseWalletAuthorityId } from "../../shared-ts/src/utils/domainIds.js";
+import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
+import { parseLinkedDeviceApprovalV1 } from "../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDeviceApprovalDigestV1, computeLinkedDeviceSessionClaimDigestV1 } from "../../shared-ts/src/device-linking/digests.js";
-import "../../shared-ts/src/device-linking/requestProof.js";
+import { activeStateV1, approvalTranscriptMatchesDigest, authorityPendingStateV1, awaitingSourceContributionDeadlineMsV1, awaitingSourceContributionStateV1, awaitingTargetDeadlineMsV1, awaitingTargetFactorStateV1, buildUnclaimedSessionRecordV1, claimTranscriptMatchesDigest, claimedStateV1, conflictResult, integrityResult, invalidStateResult, isPrecommitState, linkedDeviceEmailOtpChallengesEqualV1, linkedDevicePrecommitFailuresEqualV1, linkedDeviceQrPayloadsEqualV1, parseEmailOtpChallengeV1, parseId, parseQrLinkedDeviceSessionPayloadV1, provisioningStateV1, replaceSessionRecordV1, requireDigest, requireTimestamp, sessionExpiryMsV1, sourceContributionTranscriptMatchesDigest } from "./linkedDeviceSessionRecord.js";
+import { validateApprovalMatchesSession, validateLinkedDeviceRequestedAuthorityV1, validateSourceContributionApprovalMatchesSession, validateSourceContributionPreparationMatchesApproval } from "./linkedDeviceSessionApproval.js";
 //#region src/core/deviceLinking/linkedDeviceSession.ts
-function sourceKeyManifestDigestForFamilyV1(digests, keyFamily) {
-	switch (keyFamily) {
-		case "ed25519": return digests.ed25519 ?? null;
-		case "ecdsa_secp256k1": return digests.ecdsa_secp256k1 ?? null;
-		default: return assertNeverSourceKeyFamilyV1(keyFamily);
-	}
-}
-function assertNeverSourceKeyFamilyV1(value) {
-	throw new Error(`unsupported source key family: ${String(value)}`);
-}
 var LinkedDeviceSessionServiceV1 = class {
 	constructor(input) {
 		this.store = input.store;
@@ -472,467 +457,6 @@ async function digestTranscriptV1(kind, value) {
 	if (!isLinkedDeviceApprovalV1(value)) throw new Error("approval transcript value is invalid");
 	return computeLinkedDeviceApprovalDigestV1(value);
 }
-function buildUnclaimedSessionRecordV1(payload, nowMs) {
-	const parsedPayload = parseQrLinkedDeviceSessionPayloadV1(payload);
-	const createdAtMs = requireTimestamp(nowMs, "nowMs");
-	if (parsedPayload.issuedAtMs - createdAtMs > 6e4) throw new Error("link session issuedAtMs is in the future");
-	return buildSessionRecordV1({
-		linkSessionId: parsedPayload.linkSessionId,
-		qrPayload: parsedPayload,
-		state: { state: "displaying_qr" },
-		revision: 1,
-		createdAtMs,
-		updatedAtMs: createdAtMs
-	});
-}
-function parseLinkedDeviceSessionRecordV1(raw) {
-	const record = requireRecord(raw, "linked device session record");
-	requireAllowedKeys(record, [
-		"version",
-		"linkSessionId",
-		"qrPayload",
-		"state",
-		"revision",
-		"claimTranscript",
-		"approvalTranscript",
-		"targetFactor",
-		"emailOtpChallenge",
-		"sourceContributionPreparation",
-		"sourceContributionTranscript",
-		"authorityId",
-		"packageSetDigestB64u",
-		"createdAtMs",
-		"updatedAtMs"
-	]);
-	if (record.version !== "linked_device_session_v1") throw new Error("linked device session version is invalid");
-	const linkSessionId = parseId(record.linkSessionId, parseLinkDeviceSessionId, "linkSessionId");
-	const qrPayload = parseQrLinkedDeviceSessionPayloadV1(record.qrPayload);
-	if (qrPayload.linkSessionId !== linkSessionId) throw new Error("linkSessionId does not match QR payload");
-	const state = parseLinkSessionStateV1(record.state);
-	const revision = requirePositiveInteger(record.revision, "revision");
-	const createdAtMs = requireTimestamp(record.createdAtMs, "createdAtMs");
-	const updatedAtMs = requireTimestamp(record.updatedAtMs, "updatedAtMs");
-	if (updatedAtMs < createdAtMs) throw new Error("updatedAtMs precedes createdAtMs");
-	return buildSessionRecordV1({
-		linkSessionId,
-		qrPayload,
-		state,
-		revision,
-		claimTranscript: retiredShapeGuard("claimTranscript", () => parseOptionalClaimTranscript(record.claimTranscript)),
-		approvalTranscript: retiredShapeGuard("approvalTranscript", () => parseOptionalApprovalTranscript(record.approvalTranscript)),
-		targetFactor: parseOptionalApprovedTargetFactor(record.targetFactor),
-		emailOtpChallenge: parseOptionalEmailOtpChallenge(record.emailOtpChallenge),
-		sourceContributionPreparation: parseOptionalSourceContributionPreparation(record.sourceContributionPreparation),
-		sourceContributionTranscript: retiredShapeGuard("sourceContributionTranscript", () => parseOptionalSourceContributionTranscript(record.sourceContributionTranscript)),
-		authorityId: parseOptionalId(record.authorityId, parseWalletAuthorityId, "authorityId"),
-		packageSetDigestB64u: parseOptionalDigest(record.packageSetDigestB64u, "packageSetDigestB64u"),
-		createdAtMs,
-		updatedAtMs
-	});
-}
-function parseQrLinkedDeviceSessionPayloadV1(raw) {
-	return parseQrLinkedDeviceSessionPayloadV5(raw);
-}
-function buildSessionRecordV1(input) {
-	requireRecordIdentityFacts(input);
-	switch (input.state.state) {
-		case "displaying_qr":
-			requireNoRecordFacts(input, "displaying_qr");
-			return {
-				version: "linked_device_session_v1",
-				linkSessionId: input.linkSessionId,
-				qrPayload: input.qrPayload,
-				state: input.state,
-				revision: input.revision,
-				createdAtMs: input.createdAtMs,
-				updatedAtMs: input.updatedAtMs
-			};
-		case "claimed":
-			requireClaimRecordFacts(input, "claimed");
-			return {
-				version: "linked_device_session_v1",
-				linkSessionId: input.linkSessionId,
-				qrPayload: input.qrPayload,
-				state: input.state,
-				claimTranscript: input.claimTranscript,
-				revision: input.revision,
-				createdAtMs: input.createdAtMs,
-				updatedAtMs: input.updatedAtMs
-			};
-		case "awaiting_target_factor": return buildApprovedSessionRecordV1(input);
-		case "awaiting_source_contribution": return buildSourceContributionSessionRecordV1(input);
-		case "provisioning": return buildProvisioningSessionRecordV1(input);
-		case "authority_pending_local_install": return buildPendingSessionRecordV1(input);
-		case "active": return buildActiveSessionRecordV1(input);
-		case "failed_before_commit":
-		case "cancelled":
-		case "expired":
-			requireTerminalRecordFacts(input, input.state.state);
-			return {
-				version: "linked_device_session_v1",
-				linkSessionId: input.linkSessionId,
-				qrPayload: input.qrPayload,
-				state: input.state,
-				...input.claimTranscript ? { claimTranscript: input.claimTranscript } : {},
-				...input.approvalTranscript ? { approvalTranscript: input.approvalTranscript } : {},
-				...input.targetFactor ? { targetFactor: input.targetFactor } : {},
-				...input.emailOtpChallenge ? { emailOtpChallenge: input.emailOtpChallenge } : {},
-				...input.sourceContributionPreparation ? { sourceContributionPreparation: input.sourceContributionPreparation } : {},
-				...input.sourceContributionTranscript ? { sourceContributionTranscript: input.sourceContributionTranscript } : {},
-				revision: input.revision,
-				createdAtMs: input.createdAtMs,
-				updatedAtMs: input.updatedAtMs
-			};
-		default: return assertNeverLinkSessionStateV1(input.state);
-	}
-}
-function buildApprovedSessionRecordV1(input) {
-	if (input.state.state !== "awaiting_target_factor") throw new Error("approved session state is invalid");
-	requireApprovedRecordFacts(input, input.state.state);
-	if (input.sourceContributionPreparation || input.sourceContributionTranscript) throw new Error("awaiting target-factor session contains source-contribution facts");
-	if (input.targetFactor.kind === "passkey_prf") return {
-		version: "linked_device_session_v1",
-		linkSessionId: input.linkSessionId,
-		qrPayload: input.qrPayload,
-		state: input.state,
-		claimTranscript: input.claimTranscript,
-		approvalTranscript: input.approvalTranscript,
-		targetFactor: input.targetFactor,
-		revision: input.revision,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs
-	};
-	return {
-		version: "linked_device_session_v1",
-		linkSessionId: input.linkSessionId,
-		qrPayload: input.qrPayload,
-		state: input.state,
-		claimTranscript: input.claimTranscript,
-		approvalTranscript: input.approvalTranscript,
-		targetFactor: input.targetFactor,
-		...input.emailOtpChallenge ? { emailOtpChallenge: input.emailOtpChallenge } : {},
-		revision: input.revision,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs
-	};
-}
-function buildSourceContributionSessionRecordV1(input) {
-	if (input.state.state !== "awaiting_source_contribution") throw new Error("source-contribution session state is invalid");
-	requireApprovedRecordFacts(input, input.state.state);
-	if (!input.sourceContributionPreparation || input.sourceContributionTranscript) throw new Error("source-contribution session facts are incomplete");
-	const sourceContributionPreparation = input.sourceContributionPreparation;
-	if (input.targetFactor.kind === "passkey_prf") return {
-		version: "linked_device_session_v1",
-		linkSessionId: input.linkSessionId,
-		qrPayload: input.qrPayload,
-		state: input.state,
-		claimTranscript: input.claimTranscript,
-		approvalTranscript: input.approvalTranscript,
-		targetFactor: input.targetFactor,
-		sourceContributionPreparation,
-		revision: input.revision,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs
-	};
-	return {
-		version: "linked_device_session_v1",
-		linkSessionId: input.linkSessionId,
-		qrPayload: input.qrPayload,
-		state: input.state,
-		claimTranscript: input.claimTranscript,
-		approvalTranscript: input.approvalTranscript,
-		targetFactor: input.targetFactor,
-		...input.targetFactor.kind === "email_otp" && input.emailOtpChallenge ? { emailOtpChallenge: input.emailOtpChallenge } : {},
-		sourceContributionPreparation,
-		revision: input.revision,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs
-	};
-}
-function buildProvisioningSessionRecordV1(input) {
-	if (input.state.state !== "provisioning") throw new Error("provisioning session state is invalid");
-	requireApprovedRecordFacts(input, input.state.state);
-	if (!input.sourceContributionPreparation || !input.sourceContributionTranscript) throw new Error("provisioning session facts are incomplete");
-	const sourceContributionPreparation = input.sourceContributionPreparation;
-	const sourceContributionTranscript = input.sourceContributionTranscript;
-	if (input.targetFactor.kind === "passkey_prf") return {
-		version: "linked_device_session_v1",
-		linkSessionId: input.linkSessionId,
-		qrPayload: input.qrPayload,
-		state: input.state,
-		claimTranscript: input.claimTranscript,
-		approvalTranscript: input.approvalTranscript,
-		targetFactor: input.targetFactor,
-		sourceContributionPreparation,
-		sourceContributionTranscript,
-		revision: input.revision,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs
-	};
-	return {
-		version: "linked_device_session_v1",
-		linkSessionId: input.linkSessionId,
-		qrPayload: input.qrPayload,
-		state: input.state,
-		claimTranscript: input.claimTranscript,
-		approvalTranscript: input.approvalTranscript,
-		targetFactor: input.targetFactor,
-		...input.targetFactor.kind === "email_otp" && input.emailOtpChallenge ? { emailOtpChallenge: input.emailOtpChallenge } : {},
-		sourceContributionPreparation,
-		sourceContributionTranscript,
-		revision: input.revision,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs
-	};
-}
-function buildPendingSessionRecordV1(input) {
-	if (input.state.state !== "authority_pending_local_install") throw new Error("pending session state is invalid");
-	requireCommittedRecordFacts(input, input.state.state);
-	if (input.authorityId !== input.state.authorityId) throw new Error("pending authority facts do not match state");
-	if (input.packageSetDigestB64u !== input.state.packageSetDigestB64u) throw new Error("pending package digest does not match state");
-	if (input.targetFactor.kind === "passkey_prf") return {
-		version: "linked_device_session_v1",
-		linkSessionId: input.linkSessionId,
-		qrPayload: input.qrPayload,
-		state: input.state,
-		claimTranscript: input.claimTranscript,
-		approvalTranscript: input.approvalTranscript,
-		targetFactor: input.targetFactor,
-		sourceContributionPreparation: input.sourceContributionPreparation,
-		sourceContributionTranscript: input.sourceContributionTranscript,
-		authorityId: input.authorityId,
-		packageSetDigestB64u: input.packageSetDigestB64u,
-		revision: input.revision,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs
-	};
-	return {
-		version: "linked_device_session_v1",
-		linkSessionId: input.linkSessionId,
-		qrPayload: input.qrPayload,
-		state: input.state,
-		claimTranscript: input.claimTranscript,
-		approvalTranscript: input.approvalTranscript,
-		targetFactor: input.targetFactor,
-		...input.emailOtpChallenge ? { emailOtpChallenge: input.emailOtpChallenge } : {},
-		sourceContributionPreparation: input.sourceContributionPreparation,
-		sourceContributionTranscript: input.sourceContributionTranscript,
-		authorityId: input.authorityId,
-		packageSetDigestB64u: input.packageSetDigestB64u,
-		revision: input.revision,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs
-	};
-}
-function buildActiveSessionRecordV1(input) {
-	if (input.state.state !== "active") throw new Error("active session state is invalid");
-	requireCommittedRecordFacts(input, "active");
-	if (input.authorityId !== input.state.authorityId) throw new Error("active authority facts do not match state");
-	if (input.targetFactor.kind === "passkey_prf") return {
-		version: "linked_device_session_v1",
-		linkSessionId: input.linkSessionId,
-		qrPayload: input.qrPayload,
-		state: input.state,
-		claimTranscript: input.claimTranscript,
-		approvalTranscript: input.approvalTranscript,
-		targetFactor: input.targetFactor,
-		sourceContributionPreparation: input.sourceContributionPreparation,
-		sourceContributionTranscript: input.sourceContributionTranscript,
-		authorityId: input.authorityId,
-		packageSetDigestB64u: input.packageSetDigestB64u,
-		revision: input.revision,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs
-	};
-	return {
-		version: "linked_device_session_v1",
-		linkSessionId: input.linkSessionId,
-		qrPayload: input.qrPayload,
-		state: input.state,
-		claimTranscript: input.claimTranscript,
-		approvalTranscript: input.approvalTranscript,
-		targetFactor: input.targetFactor,
-		...input.emailOtpChallenge ? { emailOtpChallenge: input.emailOtpChallenge } : {},
-		sourceContributionPreparation: input.sourceContributionPreparation,
-		sourceContributionTranscript: input.sourceContributionTranscript,
-		authorityId: input.authorityId,
-		packageSetDigestB64u: input.packageSetDigestB64u,
-		revision: input.revision,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs
-	};
-}
-function replaceSessionRecordV1(record, patch) {
-	return buildSessionRecordV1({
-		linkSessionId: record.linkSessionId,
-		qrPayload: record.qrPayload,
-		state: patch.state ?? record.state,
-		revision: patch.revision,
-		claimTranscript: patch.claimTranscript ?? record.claimTranscript,
-		approvalTranscript: patch.approvalTranscript ?? record.approvalTranscript,
-		targetFactor: patch.targetFactor ?? record.targetFactor,
-		emailOtpChallenge: patch.emailOtpChallenge ?? record.emailOtpChallenge,
-		sourceContributionPreparation: patch.sourceContributionPreparation ?? record.sourceContributionPreparation,
-		sourceContributionTranscript: patch.sourceContributionTranscript ?? record.sourceContributionTranscript,
-		authorityId: patch.authorityId ?? record.authorityId,
-		packageSetDigestB64u: patch.packageSetDigestB64u ?? record.packageSetDigestB64u,
-		createdAtMs: record.createdAtMs,
-		updatedAtMs: patch.updatedAtMs
-	});
-}
-/** Builds the next linear session record for the authority commit transaction. */
-function buildAuthorityPendingLocalInstallSessionRecordV1(input) {
-	const nowMs = requireTimestamp(input.nowMs, "nowMs");
-	if (input.record.state.state !== "provisioning") throw new Error("linked-device session is not ready for authority commit");
-	return replaceSessionRecordV1(input.record, {
-		state: authorityPendingStateV1(input.record, input.authorityId, input.packageSetDigestB64u),
-		authorityId: input.authorityId,
-		packageSetDigestB64u: input.packageSetDigestB64u,
-		revision: input.record.revision + 1,
-		updatedAtMs: nowMs
-	});
-}
-/** Builds the next linear session record for the authority activation transaction. */
-function buildAuthorityActiveSessionRecordV1(input) {
-	const nowMs = requireTimestamp(input.nowMs, "nowMs");
-	const activatedAtMs = requireTimestamp(input.activatedAtMs, "activatedAtMs");
-	if (activatedAtMs > nowMs) throw new Error("activatedAtMs cannot be in the future");
-	if (input.record.state.state !== "authority_pending_local_install") throw new Error("linked-device session has no pending authority installation");
-	return replaceSessionRecordV1(input.record, {
-		state: activeStateV1(input.record, activatedAtMs),
-		revision: input.record.revision + 1,
-		updatedAtMs: nowMs
-	});
-}
-function claimedStateV1(record, claim) {
-	if (record.state.state !== "displaying_qr") throw new Error("link session is not claimable");
-	return {
-		state: "claimed",
-		deviceId: parseDeviceIdValue(claim.deviceId)
-	};
-}
-function awaitingTargetFactorStateV1(record) {
-	if (record.state.state !== "claimed") throw new Error("link session is not awaiting owner approval");
-	return {
-		state: "awaiting_target_factor",
-		deviceId: record.state.deviceId
-	};
-}
-function provisioningStateV1(record) {
-	if (record.state.state !== "awaiting_source_contribution") throw new Error("link session is not awaiting source contribution");
-	return {
-		state: "provisioning",
-		deviceId: record.state.deviceId
-	};
-}
-function awaitingSourceContributionStateV1(record) {
-	if (record.state.state !== "awaiting_target_factor") throw new Error("link session is not awaiting target credential");
-	return {
-		state: "awaiting_source_contribution",
-		deviceId: record.state.deviceId
-	};
-}
-function authorityPendingStateV1(record, authorityId, packageSetDigestB64u) {
-	if (record.state.state !== "provisioning") throw new Error("link session has no pending authority installation");
-	return {
-		state: "authority_pending_local_install",
-		deviceId: record.state.deviceId,
-		authorityId,
-		packageSetDigestB64u
-	};
-}
-function activeStateV1(record, activatedAtMs) {
-	if (record.state.state !== "authority_pending_local_install") throw new Error("link session has no pending authority installation");
-	return {
-		state: "active",
-		deviceId: record.state.deviceId,
-		authorityId: record.state.authorityId,
-		activatedAtMs
-	};
-}
-function validateApprovalMatchesSession(record, approval, nowMs) {
-	if (record.state.state !== "claimed" || !record.claimTranscript) throw new Error("link session is not awaiting owner approval");
-	const claim = record.claimTranscript.value;
-	if (claim.walletId !== approval.walletId || claim.enrollmentId !== approval.enrollmentId || claim.deviceId !== approval.deviceId || claim.devicePublicKeyB64u !== approval.devicePublicKeyB64u || approval.linkPublicKeyB64u !== record.qrPayload.linkPublicKeyB64u || approval.devicePublicKeyB64u !== record.qrPayload.devicePublicKeyB64u) throw new Error("approval identity does not match the claimed session");
-	if (!sameDelegatedWalletAuthorityV1(approval.permission, record.qrPayload.requestedPermission)) throw new Error("approval permission does not match QR payload");
-	if (approval.targetFactor.kind !== record.qrPayload.targetFactor.kind) throw new Error("approval target factor does not match the QR session");
-	if (approval.expiresAtMs <= nowMs || approval.expiresAtMs > claim.claimExpiresAtMs) throw new Error("approval expiry is outside the claim lifetime");
-	if (approval.approvedAtMs > nowMs) throw new Error("approval is from the future");
-}
-function validateSourceContributionApprovalMatchesSession(record, approval, nowMs) {
-	if (record.state.state !== "awaiting_source_contribution" || !record.approvalTranscript) throw new Error("link session is not awaiting source contribution");
-	if (!approval.sourceContribution) throw new Error("source contribution is required");
-	const initial = record.approvalTranscript.value;
-	if (approval.linkSessionId !== initial.linkSessionId || approval.walletId !== initial.walletId || approval.enrollmentId !== initial.enrollmentId || approval.deviceId !== initial.deviceId || approval.linkPublicKeyB64u !== initial.linkPublicKeyB64u || approval.devicePublicKeyB64u !== initial.devicePublicKeyB64u || approval.targetFactor.kind !== initial.targetFactor.kind || approval.approvedAtMs !== initial.approvedAtMs || approval.expiresAtMs !== initial.expiresAtMs || !sameDelegatedWalletAuthorityV1(approval.permission, initial.permission) || !linkedDeviceOwnerAuthorizationsEqualV1(approval.ownerAuthorization, initial.ownerAuthorization)) throw new Error("source contribution approval changes the owner approval transcript");
-	if (approval.expiresAtMs <= nowMs || approval.approvedAtMs > nowMs) throw new Error("source contribution approval is outside its validity window");
-}
-function validateSourceContributionPreparationMatchesApproval(record, approval) {
-	if (record.state.state !== "awaiting_source_contribution") throw new Error("link session is not awaiting source contribution");
-	const preparations = record.sourceContributionPreparation;
-	const contributions = approval.sourceContribution;
-	if (!preparations || !contributions || preparations.length !== contributions.length) throw new Error("source contribution families do not match target preparation");
-	preparations.forEach((preparation, index) => {
-		const contribution = contributions[index];
-		if (!contribution) throw new Error("source contribution tuple is incomplete");
-		if (preparation.linkSessionId !== approval.linkSessionId) throw new Error("source contribution preparation session differs from approval");
-		if (preparation.enrollmentId !== approval.enrollmentId) throw new Error("source contribution preparation enrollment differs from approval");
-		if ("kind" in preparation) {
-			if (contribution.keyFamily !== "ed25519") throw new Error("source contribution family order differs from preparation");
-			assertEd25519ContributionMatchesPreparation(preparation, contribution, approval);
-			return;
-		}
-		if (contribution.keyFamily !== "ecdsa_secp256k1") throw new Error("source contribution family order differs from preparation");
-		assertEcdsaContributionMatchesPreparation(preparation, contribution, approval);
-	});
-}
-function assertEd25519ContributionMatchesPreparation(preparation, contribution, approval) {
-	if (contribution.keyFamily !== "ed25519") throw new Error("source contribution is not Ed25519");
-	assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1({
-		contribution,
-		linkSessionId: preparation.linkSessionId,
-		enrollmentId: preparation.enrollmentId,
-		sourceAuthorityId: preparation.sourceAuthorityId,
-		walletKeyId: preparation.walletKeyId,
-		targetDeviceId: preparation.targetDeviceId,
-		targetFactorVerificationDigestB64u: preparation.targetFactorVerificationDigestB64u,
-		sourceMaterialActivation: routerAbMpcMaterialActivationRefFromWire(preparation.sourceBinding.material_activation),
-		targetMaterialActivation: preparation.targetMaterialActivation,
-		sourceSigner: {
-			keyFamily: "ed25519",
-			walletKeyId: preparation.walletKeyId,
-			registeredPublicKeyB64u: preparation.sourceRegisteredPublicKeyB64u
-		}
-	});
-	if (contribution.targetDeviceId !== parseDeviceIdValue(approval.deviceId) || contribution.targetMaterialActivation.activationId !== preparation.targetMaterialActivation.activationId || contribution.targetClientRecipientPublicKeyB64u !== preparation.targetClientRecipientPublicKeyB64u || contribution.targetSigningWorkerRecipientPublicKeyB64u !== preparation.targetSigningWorkerRecipientPublicKeyB64u || contribution.sourceRegisteredPublicKeyB64u !== preparation.sourceRegisteredPublicKeyB64u || !linkedDeviceEd25519BindingsEqualV1(contribution.sourceBinding, preparation.sourceBinding) || contribution.participantIds[0] !== preparation.participantIds[0] || contribution.participantIds[1] !== preparation.participantIds[1]) throw new Error("Ed25519 source contribution does not match target preparation");
-}
-function assertEcdsaContributionMatchesPreparation(preparation, contribution, approval) {
-	if (contribution.keyFamily !== "ecdsa_secp256k1") throw new Error("source contribution is not ECDSA");
-	assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1({
-		contribution,
-		linkSessionId: preparation.linkSessionId,
-		enrollmentId: preparation.enrollmentId,
-		sourceAuthorityId: preparation.sourceAuthorityId,
-		walletKeyId: contribution.walletKeyId,
-		targetDeviceId: preparation.target.targetDeviceId,
-		targetFactorVerificationDigestB64u: preparation.target.targetFactorVerificationDigestB64u,
-		sourceMaterialActivation: preparation.source.activation,
-		targetMaterialActivation: preparation.target.activation,
-		sourceSigner: {
-			keyFamily: "ecdsa_secp256k1",
-			walletKeyId: contribution.walletKeyId,
-			thresholdPublicKey33B64u: preparation.source.thresholdPublicKey33B64u
-		}
-	});
-	if (contribution.targetDeviceId !== parseDeviceIdValue(approval.deviceId) || !mpcMaterialActivationRefsEqual(contribution.target.activation, preparation.target.activation) || contribution.target.targetFactorVerificationDigestB64u !== preparation.target.targetFactorVerificationDigestB64u || contribution.target.clientRecipientPublicKeyB64u !== preparation.target.clientRecipientPublicKeyB64u || contribution.target.signingWorkerRecipientPublicKeyB64u !== preparation.target.signingWorkerRecipientPublicKeyB64u || !mpcMaterialActivationRefsEqual(contribution.sourceSigner.activation, preparation.source.activation)) throw new Error("ECDSA source contribution does not match target preparation");
-}
-function validateLinkedDeviceRequestedAuthorityV1(sourceAuthority, authority) {
-	if (!hasDelegatedWalletPermissionV1(sourceAuthority, "link_devices")) return "linking authority does not contain link_devices";
-	const attenuation = validateDelegatedWalletAuthorityAttenuationV1({
-		parent: sourceAuthority,
-		child: authority
-	});
-	return attenuation.ok ? null : attenuation.error.message;
-}
 function pendingRetryResult(record, authorityId, packageSetDigestB64u) {
 	if (record.state.state !== "authority_pending_local_install" && record.state.state !== "active") return null;
 	if (record.state.authorityId !== authorityId) return integrityResult(record, "authority_id_mismatch");
@@ -956,356 +480,12 @@ function activeRetryResult(record, authorityId, packageSetDigestB64u) {
 		record
 	};
 }
-function isPrecommitState(state) {
-	switch (state.state) {
-		case "displaying_qr":
-		case "claimed":
-		case "awaiting_target_factor":
-		case "awaiting_source_contribution":
-		case "provisioning": return true;
-		case "authority_pending_local_install":
-		case "active":
-		case "failed_before_commit":
-		case "cancelled":
-		case "expired": return false;
-		default: return assertNeverLinkSessionStateV1(state);
-	}
-}
-function sessionExpiryMsV1(record) {
-	switch (record.state.state) {
-		case "displaying_qr": return record.qrPayload.expiresAtMs;
-		case "claimed": return record.claimTranscript?.value.claimExpiresAtMs ?? record.qrPayload.expiresAtMs;
-		case "awaiting_target_factor":
-		case "awaiting_source_contribution":
-		case "provisioning": return record.approvalTranscript?.value.expiresAtMs ?? record.qrPayload.expiresAtMs;
-		case "authority_pending_local_install":
-		case "active":
-		case "failed_before_commit":
-		case "cancelled":
-		case "expired": return Number.POSITIVE_INFINITY;
-		default: return assertNeverLinkSessionStateV1(record.state);
-	}
-}
-function awaitingTargetDeadlineMsV1(record) {
-	if (record.state.state !== "awaiting_target_factor") throw new Error("link session is not awaiting target factor");
-	return record.approvalTranscript?.value.expiresAtMs ?? record.qrPayload.expiresAtMs;
-}
-function awaitingSourceContributionDeadlineMsV1(record) {
-	if (record.state.state !== "awaiting_source_contribution") throw new Error("link session is not awaiting source contribution");
-	return record.approvalTranscript?.value.expiresAtMs ?? record.qrPayload.expiresAtMs;
-}
-function linkedDeviceQrPayloadsEqualV1(left, right) {
-	if (left.version !== right.version || left.purpose !== right.purpose || left.linkSessionId !== right.linkSessionId || left.linkPublicKeyB64u !== right.linkPublicKeyB64u || left.devicePublicKeyB64u !== right.devicePublicKeyB64u || !sameDelegatedWalletAuthorityV1(left.requestedPermission, right.requestedPermission) || left.issuedAtMs !== right.issuedAtMs || left.expiresAtMs !== right.expiresAtMs) return false;
-	switch (left.targetFactor.kind) {
-		case "passkey_prf": return right.targetFactor.kind === "passkey_prf";
-		case "email_otp": return right.targetFactor.kind === "email_otp" && left.targetEmail === right.targetEmail;
-		default: return assertNeverLinkedDeviceTargetFactorV1(left.targetFactor);
-	}
-}
-function claimTranscriptMatchesDigest(record, digest) {
-	return record.claimTranscript?.digestB64u === digest;
-}
-function approvalTranscriptMatchesDigest(record, digest) {
-	return record.approvalTranscript?.digestB64u === digest;
-}
-function sourceContributionTranscriptMatchesDigest(record, digest) {
-	return record.sourceContributionTranscript?.digestB64u === digest;
-}
-function linkedDeviceEmailOtpChallengesEqualV1(left, right) {
-	switch (left.state) {
-		case "available": return right.state === "available" && left.maskedEmailHint === right.maskedEmailHint;
-		case "sent": return right.state === "sent" && left.challengeId === right.challengeId && left.workerEphemeralPublicKey65B64u === right.workerEphemeralPublicKey65B64u && left.maskedEmailHint === right.maskedEmailHint && left.expiresAtMs === right.expiresAtMs && left.resendAvailableAtMs === right.resendAvailableAtMs;
-		default: return assertNeverLinkedDeviceEmailOtpChallengeV1(left);
-	}
-}
-function linkedDevicePrecommitFailuresEqualV1(left, right) {
-	switch (left.kind) {
-		case "invalid_input": return right.kind === "invalid_input" && left.reason === right.reason;
-		case "unauthorized_source": return right.kind === "unauthorized_source" && left.reason === right.reason;
-		case "revoked_source": return right.kind === "revoked_source" && left.reason === right.reason;
-		case "permission_attenuation_failed": return right.kind === "permission_attenuation_failed" && left.reason === right.reason;
-		case "target_factor_failed": return right.kind === "target_factor_failed" && left.reason === right.reason;
-		case "expired_session": return right.kind === "expired_session" && left.reason === right.reason;
-		case "cancelled_session": return right.kind === "cancelled_session" && left.reason === right.reason;
-		case "claim_conflict": return right.kind === "claim_conflict" && left.reason === right.reason;
-		case "package_preparation_failed": return right.kind === "package_preparation_failed" && left.reason === right.reason;
-		default: return assertNeverLinkPrecommitFailureV1(left);
-	}
-}
-function linkedDeviceOwnerAuthorizationsEqualV1(left, right) {
-	return left.kind === "wallet_session" && right.kind === "wallet_session" && left.walletSessionId === right.walletSessionId && left.authorizationId === right.authorizationId;
-}
-function linkedDeviceEd25519BindingsEqualV1(left, right) {
-	return left.operation === right.operation && sameRouterAbEd25519YaoByteSequence(left.session_id, right.session_id) && sameRouterAbEd25519YaoByteSequence(left.stable_key_context_binding, right.stable_key_context_binding) && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation) && left.lifecycle.lifecycle_id === right.lifecycle.lifecycle_id && left.lifecycle.work_kind === right.lifecycle.work_kind && left.lifecycle.primitive_request_kind === right.lifecycle.primitive_request_kind && left.lifecycle.root_share_epoch === right.lifecycle.root_share_epoch && left.lifecycle.account_id === right.lifecycle.account_id && left.lifecycle.session_id === right.lifecycle.session_id && left.lifecycle.signer_set_id === right.lifecycle.signer_set_id && left.lifecycle.selected_server_id === right.lifecycle.selected_server_id;
-}
-function sameRouterAbEd25519YaoByteSequence(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-function assertNeverLinkedDeviceTargetFactorV1(value) {
-	throw new Error(`unsupported linked-device target factor: ${String(value)}`);
-}
-function assertNeverLinkedDeviceEmailOtpChallengeV1(value) {
-	throw new Error(`unsupported linked-device email OTP challenge: ${String(value)}`);
-}
-function assertNeverLinkPrecommitFailureV1(value) {
-	throw new Error(`unsupported linked-device precommit failure: ${String(value)}`);
-}
 function isLinkedDeviceClaimV1(value) {
 	return value.kind === "linked_device_session_claim_v1";
 }
 function isLinkedDeviceApprovalV1(value) {
 	return value.kind === "linked_device_approval_v1";
 }
-function parseLinkedDeviceApprovalV1(raw) {
-	return parseLinkedDeviceApprovalV1$1(raw);
-}
-function parseLinkedDeviceClaimV1(raw) {
-	return parseLinkedDeviceSessionClaimV1(raw);
-}
-function parseOptionalClaimTranscript(raw) {
-	if (raw === void 0) return void 0;
-	const record = requireRecord(raw, "claimTranscript");
-	requireExactKeys(record, ["digestB64u", "value"]);
-	return {
-		digestB64u: requireDigest(record.digestB64u, "claimTranscript.digestB64u"),
-		value: parseLinkedDeviceClaimV1(record.value)
-	};
-}
-/**
-* A stored transcript no longer parses under the current schema. This class
-* marks exactly the failures a deployment boundary produces - transcript
-* shapes are what refactors move - so a store can delete-and-recover them
-* while every value-consistency failure (tampering) keeps throwing raw.
-*/
-var LinkedDeviceRetiredSessionShapeErrorV1 = class extends Error {
-	constructor(transcript, cause) {
-		super(`linked-device ${transcript} shape is retired: ${cause instanceof Error ? cause.message : String(cause)}`);
-		this.name = "LinkedDeviceRetiredSessionShapeErrorV1";
-	}
-};
-function retiredShapeGuard(transcript, parse) {
-	try {
-		return parse();
-	} catch (error) {
-		if (error instanceof LinkedDeviceRetiredSessionShapeErrorV1) throw error;
-		throw new LinkedDeviceRetiredSessionShapeErrorV1(transcript, error);
-	}
-}
-function parseOptionalApprovalTranscript(raw) {
-	if (raw === void 0) return void 0;
-	const record = requireRecord(raw, "approvalTranscript");
-	requireExactKeys(record, [
-		"digestB64u",
-		"value",
-		"sourceSignerManifest",
-		"sourceKeyManifestDigestsB64u",
-		"sourceAuthorityDigestB64u"
-	]);
-	const value = parseLinkedDeviceApprovalV1(record.value);
-	const sourceKeyManifestDigestsB64u = parseSourceKeyManifestDigestsV1(record.sourceKeyManifestDigestsB64u, "approvalTranscript.sourceKeyManifestDigestsB64u");
-	const sourceSignerManifest = parseExactAdministeredSignerManifestV1(record.sourceSignerManifest);
-	assertSourceKeyManifestDigestFamiliesMatchManifestV1(sourceSignerManifest, sourceKeyManifestDigestsB64u);
-	return {
-		digestB64u: requireDigest(record.digestB64u, "approvalTranscript.digestB64u"),
-		value,
-		sourceSignerManifest,
-		sourceKeyManifestDigestsB64u,
-		sourceAuthorityDigestB64u: requireDigest(record.sourceAuthorityDigestB64u, "approvalTranscript.sourceAuthorityDigestB64u")
-	};
-}
-function parseSourceKeyManifestDigestsV1(raw, field) {
-	const record = requireRecord(raw, field);
-	const keys = Object.keys(record).sort();
-	if (keys.length === 1 && keys[0] === "ed25519") return { ed25519: requireDigest(record.ed25519, `${field}.ed25519`) };
-	if (keys.length === 1 && keys[0] === "ecdsa_secp256k1") return { ecdsa_secp256k1: requireDigest(record.ecdsa_secp256k1, `${field}.ecdsa_secp256k1`) };
-	if (keys.length === 2 && keys[0] === "ecdsa_secp256k1" && keys[1] === "ed25519") return {
-		ed25519: requireDigest(record.ed25519, `${field}.ed25519`),
-		ecdsa_secp256k1: requireDigest(record.ecdsa_secp256k1, `${field}.ecdsa_secp256k1`)
-	};
-	throw new Error(`${field} must contain exactly one digest for each approved source key family`);
-}
-function parseOptionalSourceContributionPreparation(raw) {
-	if (raw === void 0) return void 0;
-	return parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1(raw);
-}
-function parseOptionalSourceContributionTranscript(raw) {
-	if (raw === void 0) return void 0;
-	const record = requireRecord(raw, "sourceContributionTranscript");
-	requireExactKeys(record, [
-		"digestB64u",
-		"value",
-		"sourceSignerManifest",
-		"sourceKeyManifestDigestsB64u",
-		"sourceAuthorityDigestB64u"
-	]);
-	const value = parseLinkedDeviceApprovalV1(record.value);
-	if (!value.sourceContribution) throw new Error("sourceContributionTranscript.value has no source contribution");
-	const sourceKeyManifestDigestsB64u = parseSourceKeyManifestDigestsV1(record.sourceKeyManifestDigestsB64u, "sourceContributionTranscript.sourceKeyManifestDigestsB64u");
-	const sourceSignerManifest = parseExactAdministeredSignerManifestV1(record.sourceSignerManifest);
-	assertSourceKeyManifestDigestFamiliesMatchManifestV1(sourceSignerManifest, sourceKeyManifestDigestsB64u);
-	return {
-		digestB64u: requireDigest(record.digestB64u, "sourceContributionTranscript.digestB64u"),
-		value,
-		sourceSignerManifest,
-		sourceKeyManifestDigestsB64u,
-		sourceAuthorityDigestB64u: requireDigest(record.sourceAuthorityDigestB64u, "sourceContributionTranscript.sourceAuthorityDigestB64u")
-	};
-}
-function assertSourceKeyManifestDigestFamiliesMatchManifestV1(manifest, digests) {
-	const manifestHasEd25519 = manifest.keyFamilies.some((family) => family === "ed25519");
-	const manifestHasEcdsa = manifest.keyFamilies.some((family) => family === "ecdsa_secp256k1");
-	const digestHasEd25519 = digests.ed25519 !== void 0;
-	const digestHasEcdsa = digests.ecdsa_secp256k1 !== void 0;
-	if (manifestHasEd25519 !== digestHasEd25519 || manifestHasEcdsa !== digestHasEcdsa) throw new Error("source key manifest digest families do not match the verified signer manifest");
-}
-function parseOptionalApprovedTargetFactor(raw) {
-	if (raw === void 0) return void 0;
-	const record = requireRecord(raw, "targetFactor");
-	if (record.kind === "passkey_prf") {
-		requireExactKeys(record, ["kind"]);
-		return { kind: "passkey_prf" };
-	}
-	if (record.kind === "email_otp") {
-		const targetEmail = parseId(record.targetEmail, parseVerifiedEmailAddress, "targetFactor.targetEmail");
-		const enrollment = requireRecord(record.enrollment, "targetFactor.enrollment");
-		if (enrollment.kind === "existing_enrollment") {
-			requireExactKeys(record, [
-				"kind",
-				"targetEmail",
-				"enrollment",
-				"baseWalletAuthMethodId"
-			]);
-			requireExactKeys(enrollment, ["kind"]);
-			return {
-				kind: "email_otp",
-				targetEmail,
-				enrollment: { kind: "existing_enrollment" },
-				baseWalletAuthMethodId: parseId(record.baseWalletAuthMethodId, parseWalletAuthMethodId, "targetFactor.baseWalletAuthMethodId")
-			};
-		}
-		if (enrollment.kind === "new_enrollment") {
-			requireExactKeys(record, [
-				"kind",
-				"targetEmail",
-				"enrollment"
-			]);
-			requireExactKeys(enrollment, ["kind"]);
-			return {
-				kind: "email_otp",
-				targetEmail,
-				enrollment: { kind: "new_enrollment" }
-			};
-		}
-		throw new Error("targetFactor.enrollment.kind is invalid");
-	}
-	throw new Error("targetFactor.kind is invalid");
-}
-function parseOptionalEmailOtpChallenge(raw) {
-	if (raw === void 0) return void 0;
-	const record = requireRecord(raw, "emailOtpChallenge");
-	const state = parseIdentityString(record.state, "emailOtpChallenge.state");
-	if (state === "available") {
-		requireExactKeys(record, ["state", "maskedEmailHint"]);
-		return {
-			state,
-			maskedEmailHint: parseIdentityString(record.maskedEmailHint, "emailOtpChallenge.maskedEmailHint")
-		};
-	}
-	if (state === "sent") {
-		requireExactKeys(record, [
-			"state",
-			"challengeId",
-			"workerEphemeralPublicKey65B64u",
-			"maskedEmailHint",
-			"expiresAtMs",
-			"resendAvailableAtMs"
-		]);
-		return {
-			state,
-			challengeId: parseIdentityString(record.challengeId, "emailOtpChallenge.challengeId"),
-			workerEphemeralPublicKey65B64u: parseIdentityString(record.workerEphemeralPublicKey65B64u, "emailOtpChallenge.workerEphemeralPublicKey65B64u"),
-			maskedEmailHint: parseIdentityString(record.maskedEmailHint, "emailOtpChallenge.maskedEmailHint"),
-			expiresAtMs: requireTimestamp(record.expiresAtMs, "emailOtpChallenge.expiresAtMs"),
-			resendAvailableAtMs: requireTimestamp(record.resendAvailableAtMs, "emailOtpChallenge.resendAvailableAtMs")
-		};
-	}
-	throw new Error("emailOtpChallenge.state is invalid");
-}
-function parseEmailOtpChallengeV1(raw) {
-	const record = requireRecord(raw, "challenge");
-	requireExactKeys(record, [
-		"challengeId",
-		"workerEphemeralPublicKey65B64u",
-		"maskedEmailHint",
-		"expiresAtMs",
-		"resendAvailableAtMs"
-	]);
-	return {
-		state: "sent",
-		challengeId: parseIdentityString(record.challengeId, "challenge.challengeId"),
-		workerEphemeralPublicKey65B64u: parseIdentityString(record.workerEphemeralPublicKey65B64u, "challenge.workerEphemeralPublicKey65B64u"),
-		maskedEmailHint: parseIdentityString(record.maskedEmailHint, "challenge.maskedEmailHint"),
-		expiresAtMs: requireTimestamp(record.expiresAtMs, "challenge.expiresAtMs"),
-		resendAvailableAtMs: requireTimestamp(record.resendAvailableAtMs, "challenge.resendAvailableAtMs")
-	};
-}
-function requireNoRecordFacts(input, state) {
-	if (input.claimTranscript || input.approvalTranscript || input.targetFactor || input.emailOtpChallenge || input.sourceContributionPreparation || input.sourceContributionTranscript || input.authorityId || input.packageSetDigestB64u) throw new Error(`${state} session carries invalid durable facts`);
-}
-function requireClaimRecordFacts(input, state) {
-	if (!input.claimTranscript || input.approvalTranscript || input.targetFactor || input.emailOtpChallenge || input.sourceContributionPreparation || input.sourceContributionTranscript || input.authorityId || input.packageSetDigestB64u) throw new Error(`${state} session facts are invalid`);
-}
-function requireApprovedRecordFacts(input, state) {
-	if (!input.claimTranscript || !input.approvalTranscript || !input.targetFactor) throw new Error(`${state} session facts are incomplete`);
-	if (input.authorityId || input.packageSetDigestB64u) throw new Error(`${state} session contains committed facts`);
-	if (input.targetFactor.kind === "passkey_prf" && input.emailOtpChallenge) throw new Error(`${state} passkey session contains email challenge state`);
-}
-function requireCommittedRecordFacts(input, state) {
-	if (!input.claimTranscript || !input.approvalTranscript || !input.targetFactor || !input.authorityId || !input.packageSetDigestB64u) throw new Error(`${state} session facts are incomplete`);
-	if (!input.sourceContributionPreparation || !input.sourceContributionTranscript) throw new Error(`${state} session source-contribution facts are incomplete`);
-	if (input.targetFactor.kind === "passkey_prf" && input.emailOtpChallenge) throw new Error(`${state} passkey session contains email challenge state`);
-}
-function requireNoCommittedFacts(input, state) {
-	if (input.authorityId || input.packageSetDigestB64u) throw new Error(`${state} session contains committed facts`);
-}
-function requireRecordIdentityFacts(input) {
-	if (input.targetFactor && input.targetFactor.kind !== input.qrPayload.targetFactor.kind) throw new Error("target factor does not match QR payload");
-	const claim = input.claimTranscript?.value;
-	if (claim) {
-		if (claim.linkSessionId !== input.linkSessionId || claim.devicePublicKeyB64u !== input.qrPayload.devicePublicKeyB64u || claim.targetFactor.kind !== input.qrPayload.targetFactor.kind) throw new Error("claim transcript identity does not match QR payload");
-	}
-	const approval = input.approvalTranscript?.value;
-	if (approval) {
-		if (approval.linkSessionId !== input.linkSessionId || approval.linkPublicKeyB64u !== input.qrPayload.linkPublicKeyB64u || approval.devicePublicKeyB64u !== input.qrPayload.devicePublicKeyB64u || approval.targetFactor.kind !== input.qrPayload.targetFactor.kind) throw new Error("approval transcript identity does not match QR payload");
-	}
-	if (claim && approval && parseDeviceIdValue(claim.deviceId) !== parseDeviceIdValue(approval.deviceId)) throw new Error("approval transcript device identity does not match claim transcript");
-	switch (input.state.state) {
-		case "displaying_qr":
-		case "failed_before_commit":
-		case "cancelled":
-		case "expired": return;
-		case "claimed":
-		case "awaiting_target_factor":
-		case "awaiting_source_contribution":
-		case "provisioning":
-			if (!claim || input.state.deviceId !== parseDeviceIdValue(claim.deviceId)) throw new Error(`${input.state.state} device identity does not match claim transcript`);
-			return;
-		case "authority_pending_local_install":
-		case "active":
-			if (!claim || !approval || input.state.deviceId !== parseDeviceIdValue(claim.deviceId) || input.state.deviceId !== parseDeviceIdValue(approval.deviceId)) throw new Error(`${input.state.state} device identity does not match transcripts`);
-			return;
-		default: return assertNeverLinkSessionStateV1(input.state);
-	}
-}
-function requireTerminalRecordFacts(input, state) {
-	requireNoCommittedFacts(input, state);
-	if (!input.claimTranscript && (input.approvalTranscript || input.targetFactor || input.emailOtpChallenge)) throw new Error(`${state} session facts are incomplete`);
-	if (!input.approvalTranscript && input.emailOtpChallenge) throw new Error(`${state} session email challenge has no approval`);
-	if (input.sourceContributionTranscript && !input.sourceContributionPreparation) throw new Error(`${state} source contribution transcript has no preparation`);
-	if (input.sourceContributionPreparation && (!input.approvalTranscript || !input.targetFactor)) throw new Error(`${state} source contribution preparation has no approval`);
-	if (input.approvalTranscript && !input.targetFactor) throw new Error(`${state} session approval has no target factor`);
-	if (input.targetFactor?.kind === "passkey_prf" && input.emailOtpChallenge) throw new Error(`${state} passkey session contains email challenge state`);
-}
 function buildClaimV1(payload, identity, sessionRevision, claimedAtMs) {
 	if (identity.claimExpiresAtMs <= claimedAtMs || identity.claimExpiresAtMs > payload.expiresAtMs) throw new Error("claim expiry is outside the link session lifetime");
 	return {
@@ -1321,53 +501,6 @@ function buildClaimV1(payload, identity, sessionRevision, claimedAtMs) {
 		claimExpiresAtMs: identity.claimExpiresAtMs
 	};
 }
-function parseDeviceIdValue(raw) {
-	const parsed = parseDeviceId(raw);
-	if (!parsed.ok) throw new Error(`deviceId: ${parsed.error.message}`);
-	return parsed.value;
-}
-function parseId(raw, parser, field) {
-	const parsed = parser(raw);
-	if (!parsed.ok) throw new Error(`${field}: ${parsed.error.message}`);
-	return parsed.value;
-}
-function parseOptionalId(raw, parser, field) {
-	return raw === void 0 ? void 0 : parseId(raw, parser, field);
-}
-function parseIdentityString(raw, field) {
-	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw || hasWhitespaceOrControlCharacters(raw)) throw new Error(`${field} is invalid`);
-	return raw;
-}
-function requireDigest(raw, field) {
-	try {
-		return parseDigestB64u(raw);
-	} catch {
-		throw new Error(`${field} is invalid`);
-	}
-}
-function parseOptionalDigest(raw, field) {
-	return raw === void 0 ? void 0 : requireDigest(raw, field);
-}
-function requireTimestamp(raw, field) {
-	if (!Number.isSafeInteger(raw) || Number(raw) <= 0) throw new Error(`${field} must be a positive safe integer`);
-	return Number(raw);
-}
-function requirePositiveInteger(raw, field) {
-	return requireTimestamp(raw, field);
-}
-function requireRecord(raw, field) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error(`${field} must be an object`);
-	return Object.fromEntries(Object.entries(raw));
-}
-function requireExactKeys(record, expected) {
-	const actual = Object.keys(record).sort();
-	const required = [...expected].sort();
-	if (actual.length !== required.length || actual.some((key, index) => key !== required[index])) throw new Error("record contains invalid fields");
-}
-function requireAllowedKeys(record, allowed) {
-	const allowedSet = new Set(allowed);
-	for (const key of Object.keys(record)) if (!allowedSet.has(key)) throw new Error("record contains invalid fields");
-}
 function normalizeSessionReadInput(input) {
 	if (typeof input === "string") return {
 		linkSessionId: parseId(input, parseLinkDeviceSessionId, "linkSessionId"),
@@ -1391,29 +524,7 @@ function unauthorizedResult(code, message) {
 		message
 	};
 }
-function conflictResult(expectedRevision, record) {
-	return {
-		outcome: "conflict",
-		expectedRevision,
-		actualRevision: record?.revision ?? null,
-		record
-	};
-}
-function invalidStateResult(record) {
-	return {
-		outcome: "invalid_state",
-		state: record.state.state,
-		record
-	};
-}
-function integrityResult(record, reason) {
-	return {
-		outcome: "integrity_error",
-		reason,
-		record
-	};
-}
 //#endregion
-export { LinkedDeviceRetiredSessionShapeErrorV1, LinkedDeviceSessionServiceV1, buildAuthorityActiveSessionRecordV1, buildAuthorityPendingLocalInstallSessionRecordV1, buildUnclaimedSessionRecordV1, digestTranscriptV1, linkedDeviceQrPayloadsEqualV1, parseLinkedDeviceSessionRecordV1, sourceKeyManifestDigestForFamilyV1 };
+export { LinkedDeviceSessionServiceV1 };
 
 //# sourceMappingURL=linkedDeviceSession.js.map