@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/shared-ts/src/authorization/walletAuthority.js

@@ -1,20 +1,24 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseMpcMaterialActivationRef, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId } from "../utils/domainIds.js";
 import { parseDeviceId } from "./capabilityKinds.js";
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+import { base64UrlEncode } from "../utils/base64.js";
 import { sha256Bytes } from "../utils/digests.js";
-import { buildExactAdministeredSignerManifestV1, parseExactAdministeredSignerManifestV1 } from "../device-linking/delegatedActivationPlan.js";
+import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+import { requireRecord } from "../utils/validation.js";
 import { parseDelegatedWalletPermissionSetV1 } from "./delegatedAuthority.js";
+import { buildExactAdministeredSignerManifestV1, parseExactAdministeredSignerManifestV1 } from "../device-linking/delegatedActivationPlan.js";
+import { concat, lp32, rawDigest, rawPublicKey, text, u32, u64 } from "../utils/digestEncoding.js";
 //#region ../shared-ts/src/authorization/walletAuthority.ts
 const SIGNER_ACTIVATION_SET_DOMAIN = "seams/wallet-signer-activation-set/v1";
 const WALLET_AUTHORITY_DOMAIN = "seams/wallet-authority/v1";
-const TEXT_ENCODER = new TextEncoder();
 function isCombinedWalletSignerActivationSetV1(value) {
 	return isBothFamilyActivationSet(value);
 }
 function isActiveEcdsaWalletAuthorityV1(value) {
 	return isEcdsaOnlyActivationSet(value.signerActivations);
 }
+function isActiveEd25519WalletAuthorityV1(value) {
+	return isEd25519OnlyActivationSet(value.signerActivations);
+}
 function isActiveRecoveredWalletAuthorityV1(value) {
 	return value.provenance.kind === "wallet_recovery";
 }
@@ -145,8 +149,8 @@ function encodeWalletSignerActivationSetV1(value) {
 async function computeWalletSignerActivationSetDigestB64u(value) {
 	return parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeWalletSignerActivationSetV1(value))));
 }
-function buildPendingWalletAuthorityV1(input) {
-	validateWalletAuthorityV1(input);
+/** The fields every lifecycle state carries, copied in record order. */
+function walletAuthorityCommonFields(input) {
 	return {
 		kind: "wallet_authority_v1",
 		authorityId: input.authorityId,
@@ -159,7 +163,13 @@ function buildPendingWalletAuthorityV1(input) {
 		authorityDigestB64u: input.authorityDigestB64u,
 		revocationEpoch: input.revocationEpoch,
 		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs,
+		updatedAtMs: input.updatedAtMs
+	};
+}
+function buildPendingWalletAuthorityV1(input) {
+	validateWalletAuthorityV1(input);
+	return {
+		...walletAuthorityCommonFields(input),
 		state: "pending_local_install",
 		localInstallPackageSetDigestB64u: input.localInstallPackageSetDigestB64u
 	};
@@ -167,18 +177,7 @@ function buildPendingWalletAuthorityV1(input) {
 function buildActiveWalletAuthorityV1(input) {
 	validateWalletAuthorityV1(input);
 	return {
-		kind: "wallet_authority_v1",
-		authorityId: input.authorityId,
-		walletId: input.walletId,
-		principal: input.principal,
-		provenance: input.provenance,
-		permissions: input.permissions,
-		signerActivations: input.signerActivations,
-		signerActivationSetDigestB64u: input.signerActivationSetDigestB64u,
-		authorityDigestB64u: input.authorityDigestB64u,
-		revocationEpoch: input.revocationEpoch,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs,
+		...walletAuthorityCommonFields(input),
 		state: "active",
 		activatedAtMs: input.activatedAtMs
 	};
@@ -218,37 +217,14 @@ async function replaceActiveWalletAuthorityEd25519MaterialActivationV1(input) {
 		activatedAtMs: input.authority.activatedAtMs
 	};
 	return buildActiveWalletAuthorityV1({
-		kind: draft.kind,
-		authorityId: draft.authorityId,
-		walletId: draft.walletId,
-		principal: draft.principal,
-		provenance: draft.provenance,
-		permissions: draft.permissions,
-		signerActivations: draft.signerActivations,
-		signerActivationSetDigestB64u: draft.signerActivationSetDigestB64u,
-		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft),
-		revocationEpoch: draft.revocationEpoch,
-		createdAtMs: draft.createdAtMs,
-		updatedAtMs: draft.updatedAtMs,
-		state: draft.state,
-		activatedAtMs: draft.activatedAtMs
+		...draft,
+		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft)
 	});
 }
 function buildActiveCombinedWalletAuthorityV1(input) {
 	validateWalletAuthorityV1(input);
 	return {
-		kind: "wallet_authority_v1",
-		authorityId: input.authorityId,
-		walletId: input.walletId,
-		principal: input.principal,
-		provenance: input.provenance,
-		permissions: input.permissions,
-		signerActivations: input.signerActivations,
-		signerActivationSetDigestB64u: input.signerActivationSetDigestB64u,
-		authorityDigestB64u: input.authorityDigestB64u,
-		revocationEpoch: input.revocationEpoch,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs,
+		...walletAuthorityCommonFields(input),
 		state: "active",
 		activatedAtMs: input.activatedAtMs
 	};
@@ -256,115 +232,58 @@ function buildActiveCombinedWalletAuthorityV1(input) {
 function buildRevokedWalletAuthorityV1(input) {
 	validateWalletAuthorityV1(input);
 	return {
-		kind: "wallet_authority_v1",
-		authorityId: input.authorityId,
-		walletId: input.walletId,
-		principal: input.principal,
-		provenance: input.provenance,
-		permissions: input.permissions,
-		signerActivations: input.signerActivations,
-		signerActivationSetDigestB64u: input.signerActivationSetDigestB64u,
-		authorityDigestB64u: input.authorityDigestB64u,
-		revocationEpoch: input.revocationEpoch,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs,
+		...walletAuthorityCommonFields(input),
 		state: "revoked",
 		activatedAtMs: input.activatedAtMs,
 		revokedAtMs: input.revokedAtMs
 	};
 }
+/** The record fields every lifecycle state has, in canonical order; each state adds its own. */
+const WALLET_AUTHORITY_FIELDS = [
+	"kind",
+	"authorityId",
+	"walletId",
+	"principal",
+	"provenance",
+	"permissions",
+	"signerActivations",
+	"signerActivationSetDigestB64u",
+	"authorityDigestB64u",
+	"revocationEpoch",
+	"createdAtMs",
+	"updatedAtMs",
+	"state"
+];
 function parseWalletAuthorityV1(raw) {
 	try {
 		const record = requireRecord(raw, "WalletAuthorityV1");
 		const common = parseWalletAuthorityCommon(record);
 		switch (record.state) {
 			case "pending_local_install":
-				exactFields(record, [
-					"kind",
-					"authorityId",
-					"walletId",
-					"principal",
-					"provenance",
-					"permissions",
-					"signerActivations",
-					"signerActivationSetDigestB64u",
-					"authorityDigestB64u",
-					"revocationEpoch",
-					"createdAtMs",
-					"updatedAtMs",
-					"state",
-					"localInstallPackageSetDigestB64u"
-				], "WalletAuthorityV1");
+				exactFields(record, [...WALLET_AUTHORITY_FIELDS, "localInstallPackageSetDigestB64u"], "WalletAuthorityV1");
 				return {
 					ok: true,
 					value: buildPendingWalletAuthorityV1({
 						kind: "wallet_authority_v1",
-						authorityId: common.authorityId,
-						walletId: common.walletId,
-						principal: common.principal,
-						provenance: common.provenance,
-						permissions: common.permissions,
-						signerActivations: common.signerActivations,
-						signerActivationSetDigestB64u: common.signerActivationSetDigestB64u,
-						authorityDigestB64u: common.authorityDigestB64u,
-						revocationEpoch: common.revocationEpoch,
-						createdAtMs: common.createdAtMs,
-						updatedAtMs: common.updatedAtMs,
+						...common,
 						state: "pending_local_install",
 						localInstallPackageSetDigestB64u: parseDigestField(record.localInstallPackageSetDigestB64u, "localInstallPackageSetDigestB64u")
 					})
 				};
 			case "active":
-				exactFields(record, [
-					"kind",
-					"authorityId",
-					"walletId",
-					"principal",
-					"provenance",
-					"permissions",
-					"signerActivations",
-					"signerActivationSetDigestB64u",
-					"authorityDigestB64u",
-					"revocationEpoch",
-					"createdAtMs",
-					"updatedAtMs",
-					"state",
-					"activatedAtMs"
-				], "WalletAuthorityV1");
+				exactFields(record, [...WALLET_AUTHORITY_FIELDS, "activatedAtMs"], "WalletAuthorityV1");
 				return {
 					ok: true,
 					value: buildActiveWalletAuthorityV1({
 						kind: "wallet_authority_v1",
-						authorityId: common.authorityId,
-						walletId: common.walletId,
-						principal: common.principal,
-						provenance: common.provenance,
-						permissions: common.permissions,
-						signerActivations: common.signerActivations,
-						signerActivationSetDigestB64u: common.signerActivationSetDigestB64u,
-						authorityDigestB64u: common.authorityDigestB64u,
-						revocationEpoch: common.revocationEpoch,
-						createdAtMs: common.createdAtMs,
-						updatedAtMs: common.updatedAtMs,
+						...common,
 						state: "active",
 						activatedAtMs: parseSafeInteger(record.activatedAtMs, "activatedAtMs")
 					})
 				};
 			case "revoked":
 				exactFields(record, [
-					"kind",
-					"authorityId",
-					"walletId",
-					"principal",
-					"provenance",
-					"permissions",
-					"signerActivations",
-					"signerActivationSetDigestB64u",
-					"authorityDigestB64u",
-					"revocationEpoch",
-					"createdAtMs",
-					"updatedAtMs",
-					"state",
+					...WALLET_AUTHORITY_FIELDS,
 					"activatedAtMs",
 					"revokedAtMs"
 				], "WalletAuthorityV1");
@@ -372,17 +291,7 @@ function parseWalletAuthorityV1(raw) {
 					ok: true,
 					value: buildRevokedWalletAuthorityV1({
 						kind: "wallet_authority_v1",
-						authorityId: common.authorityId,
-						walletId: common.walletId,
-						principal: common.principal,
-						provenance: common.provenance,
-						permissions: common.permissions,
-						signerActivations: common.signerActivations,
-						signerActivationSetDigestB64u: common.signerActivationSetDigestB64u,
-						authorityDigestB64u: common.authorityDigestB64u,
-						revocationEpoch: common.revocationEpoch,
-						createdAtMs: common.createdAtMs,
-						updatedAtMs: common.updatedAtMs,
+						...common,
 						state: "revoked",
 						activatedAtMs: parseSafeInteger(record.activatedAtMs, "activatedAtMs"),
 						revokedAtMs: parseSafeInteger(record.revokedAtMs, "revokedAtMs")
@@ -415,6 +324,14 @@ async function walletAuthorityDigestsMatchV1(value) {
 	if (await computeWalletSignerActivationSetDigestB64u(value.signerActivations) !== value.signerActivationSetDigestB64u) return false;
 	return await computeWalletAuthorityDigestB64u(value) === value.authorityDigestB64u;
 }
+/**
+* True when both authorities' stored digests verify and agree. The authority digest does not
+* cover the timestamps, so those must agree too.
+*/
+async function sameVerifiedActiveWalletAuthorityV1(left, right) {
+	const [leftVerified, rightVerified] = await Promise.all([walletAuthorityDigestsMatchV1(left), walletAuthorityDigestsMatchV1(right)]);
+	return leftVerified && rightVerified && left.authorityDigestB64u === right.authorityDigestB64u && left.signerActivationSetDigestB64u === right.signerActivationSetDigestB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs && left.activatedAtMs === right.activatedAtMs;
+}
 function parseWalletAuthorityCommon(record) {
 	if (record.kind !== "wallet_authority_v1") throw new Error("WalletAuthorityV1.kind is unsupported");
 	const authorityId = requireParsed(parseWalletAuthorityId(record.authorityId), "authorityId");
@@ -563,7 +480,7 @@ function parseEcdsaActivation(raw, label) {
 		materialActivation: requireParsed(parseMpcMaterialActivationRef(record.materialActivation), `${label}.materialActivation`)
 	});
 }
-function parseManifestForSigner(raw, family, label) {
+function parseManifestForSigner(raw, family, _label) {
 	return parseExactAdministeredSignerManifestV1({
 		kind: "exact_administered_signer_manifest_v1",
 		keyFamilies: [family],
@@ -639,10 +556,6 @@ function encodePermissions(value) {
 	for (const permission of value) parts.push(lp32(text(permission, "permissions.item"), "permissions.item"));
 	return concat(parts);
 }
-function requireRecord(value, label) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
 function exactRecord(value, fields, label) {
 	const record = requireRecord(value, label);
 	exactFields(record, fields, label);
@@ -717,59 +630,6 @@ function parseDigestField(raw, label) {
 		throw new Error(`${label} ${errorMessage(error, "is invalid")}`);
 	}
 }
-function rawDigest(value, label) {
-	try {
-		return base64UrlDecode(parseDigestB64u(value));
-	} catch (error) {
-		throw new Error(`${label} ${errorMessage(error, "is invalid")}`);
-	}
-}
-function rawPublicKey(value, label) {
-	try {
-		const decoded = base64UrlDecode(value);
-		if (decoded.length === 0 || base64UrlEncode(decoded) !== value) throw new Error("must be canonical base64url");
-		return decoded;
-	} catch (error) {
-		throw new Error(`${label} ${errorMessage(error, "is invalid")}`);
-	}
-}
-function concat(parts) {
-	let length = 0;
-	for (const part of parts) length += part.length;
-	const output = new Uint8Array(length);
-	let offset = 0;
-	for (const part of parts) {
-		output.set(part, offset);
-		offset += part.length;
-	}
-	return output;
-}
-function u32(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0 || value > 4294967295) throw new Error(`${label} must be a non-negative u32`);
-	return Uint8Array.from([
-		value >>> 24 & 255,
-		value >>> 16 & 255,
-		value >>> 8 & 255,
-		value & 255
-	]);
-}
-function u64(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	let remaining = BigInt(value);
-	const output = new Uint8Array(8);
-	for (let index = 7; index >= 0; index -= 1) {
-		output[index] = Number(remaining & 255n);
-		remaining >>= 8n;
-	}
-	return output;
-}
-function lp32(value, label) {
-	return concat([u32(value.length, `${label}.length`), value]);
-}
-function text(value, label) {
-	if (typeof value !== "string") throw new Error(`${label} must be a string`);
-	return lp32(TEXT_ENCODER.encode(value), label);
-}
 function parseSafeInteger(raw, label) {
 	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0) throw new Error(`${label} must be a non-negative safe integer`);
 	return raw;
@@ -796,6 +656,33 @@ function errorMessage(error, fallback) {
 function assertNever(value, label) {
 	throw new Error(`${label} branch is unsupported: ${String(value)}`);
 }
+/**
+* Re-seals an authority around its new combined signer activations. Both digests are
+* recomputed; identity, provenance, permissions and lifecycle stay as they were.
+*/
+async function withCombinedSignerActivations(authority, signerActivations, now) {
+	const signerActivationSetDigestB64u = await computeWalletSignerActivationSetDigestB64u(signerActivations);
+	const draft = {
+		kind: "wallet_authority_v1",
+		authorityId: authority.authorityId,
+		walletId: authority.walletId,
+		principal: authority.principal,
+		provenance: authority.provenance,
+		permissions: authority.permissions,
+		signerActivations,
+		signerActivationSetDigestB64u,
+		authorityDigestB64u: authority.authorityDigestB64u,
+		revocationEpoch: authority.revocationEpoch,
+		createdAtMs: authority.createdAtMs,
+		updatedAtMs: Math.max(authority.updatedAtMs, now),
+		state: "active",
+		activatedAtMs: authority.activatedAtMs
+	};
+	return buildActiveCombinedWalletAuthorityV1({
+		...draft,
+		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft)
+	});
+}
 async function extendEcdsaWalletAuthorityWithEd25519(input) {
 	if (input.ed25519.signer.walletId !== input.authority.walletId) throw new Error("NEAR signer belongs to a different wallet authority");
 	const existingEcdsa = input.authority.signerActivations.ecdsa;
@@ -809,42 +696,27 @@ async function extendEcdsaWalletAuthorityWithEd25519(input) {
 		}
 	});
 	if (!isCombinedWalletSignerActivationSetV1(signerActivationsCandidate)) throw new Error("Deferred Ed25519 activation did not produce a combined signer activation set");
-	const signerActivations = signerActivationsCandidate;
-	const signerActivationSetDigestB64u = await computeWalletSignerActivationSetDigestB64u(signerActivations);
-	const draft = {
-		kind: "wallet_authority_v1",
-		authorityId: input.authority.authorityId,
-		walletId: input.authority.walletId,
-		principal: input.authority.principal,
-		provenance: input.authority.provenance,
-		permissions: input.authority.permissions,
-		signerActivations,
-		signerActivationSetDigestB64u,
-		authorityDigestB64u: input.authority.authorityDigestB64u,
-		revocationEpoch: input.authority.revocationEpoch,
-		createdAtMs: input.authority.createdAtMs,
-		updatedAtMs: Math.max(input.authority.updatedAtMs, input.now),
-		state: "active",
-		activatedAtMs: input.authority.activatedAtMs
-	};
-	return buildActiveCombinedWalletAuthorityV1({
-		kind: draft.kind,
-		authorityId: draft.authorityId,
-		walletId: draft.walletId,
-		principal: draft.principal,
-		provenance: draft.provenance,
-		permissions: draft.permissions,
-		signerActivations: draft.signerActivations,
-		signerActivationSetDigestB64u: draft.signerActivationSetDigestB64u,
-		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft),
-		revocationEpoch: draft.revocationEpoch,
-		createdAtMs: draft.createdAtMs,
-		updatedAtMs: draft.updatedAtMs,
-		state: draft.state,
-		activatedAtMs: draft.activatedAtMs
+	return withCombinedSignerActivations(input.authority, signerActivationsCandidate, input.now);
+}
+/**
+* An authority holding only a NEAR signer gains the ECDSA signer its owner
+* added. The NEAR activation, identity and lifecycle stay as they were.
+*/
+async function extendEd25519WalletAuthorityWithEcdsa(input) {
+	if (input.ecdsa.signer.walletId !== input.authority.walletId) throw new Error("ECDSA signer belongs to a different wallet authority");
+	const existingEd25519 = input.authority.signerActivations.ed25519;
+	const signerActivationsCandidate = buildWalletSignerActivationSetV1({
+		manifest: buildExactAdministeredSignerManifestV1([existingEd25519.signer, input.ecdsa.signer]),
+		materialActivations: {
+			keyFamilies: ["ed25519", "ecdsa_secp256k1"],
+			ed25519: existingEd25519.materialActivation,
+			ecdsa: input.ecdsa.materialActivation
+		}
 	});
+	if (!isCombinedWalletSignerActivationSetV1(signerActivationsCandidate)) throw new Error("Added ECDSA activation did not produce a combined signer activation set");
+	return withCombinedSignerActivations(input.authority, signerActivationsCandidate, input.now);
 }
 //#endregion
-export { buildActiveCombinedWalletAuthorityV1, buildActiveWalletAuthorityV1, buildPendingWalletAuthorityV1, buildRevokedWalletAuthorityV1, buildWalletEcdsaSignerActivationV1, buildWalletEd25519SignerActivationV1, buildWalletSignerActivationSetV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, encodeWalletAuthorityV1, encodeWalletSignerActivationSetV1, extendEcdsaWalletAuthorityWithEd25519, isActiveEcdsaWalletAuthorityV1, isActiveRecoveredWalletAuthorityV1, isCombinedWalletSignerActivationSetV1, parseWalletAuthorityV1, parseWalletSignerActivationSetV1, replaceActiveWalletAuthorityEd25519MaterialActivationV1, walletAuthorityDigestsMatchV1 };
+export { buildActiveCombinedWalletAuthorityV1, buildActiveWalletAuthorityV1, buildPendingWalletAuthorityV1, buildRevokedWalletAuthorityV1, buildWalletEcdsaSignerActivationV1, buildWalletSignerActivationSetV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, encodeWalletSignerActivationSetV1, extendEcdsaWalletAuthorityWithEd25519, extendEd25519WalletAuthorityWithEcdsa, isActiveEcdsaWalletAuthorityV1, isActiveEd25519WalletAuthorityV1, isActiveRecoveredWalletAuthorityV1, isCombinedWalletSignerActivationSetV1, parseWalletAuthorityV1, parseWalletSignerActivationSetV1, replaceActiveWalletAuthorityEd25519MaterialActivationV1, sameVerifiedActiveWalletAuthorityV1, walletAuthorityDigestsMatchV1 };
 
 //# sourceMappingURL=walletAuthority.js.map

package/dist/esm/shared-ts/src/authorization/walletCustodyOperation.js

@@ -1,16 +1,14 @@
-import { base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../utils/digests.js";
-import "../utils/encoders.js";
+import { alphabetizeStringify } from "../utils/digests.js";
+import { sha256Utf8DigestB64u } from "../utils/canonicalPrimitives.js";
 //#region ../shared-ts/src/authorization/walletCustodyOperation.ts
 /** Public challenge digest for a single wallet-administration factor proof. */
 async function computeWalletCustodyAdminChallengeDigest(input) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(`seams:wallet-custody:challenge:v1|${alphabetizeStringify({
+	return sha256Utf8DigestB64u(`seams:wallet-custody:challenge:v1|${alphabetizeStringify({
 		walletId: input.walletId,
 		operation: input.operation,
 		payload: input.payload,
 		requestOrigin: input.requestOrigin
-	})}`)));
+	})}`);
 }
 //#endregion
 export { computeWalletCustodyAdminChallengeDigest };

package/dist/esm/shared-ts/src/device-linking/activeWalletSession.js

@@ -0,0 +1,74 @@
+import { requireRecord } from "../utils/validation.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { wireLiteral, wireObject } from "../utils/wireSchema.js";
+import { digest, keyLabeled, materialActivation, parseNonNegativeSafeInteger, parseUnixTime, quotaId, walletAuthMethodId, walletAuthorityId, walletId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
+//#region ../shared-ts/src/device-linking/activeWalletSession.ts
+function walletSessionOperationCredentialV1() {
+	return wireObject({
+		kind: wireLiteral("opaque_wallet_session_operation_credential_v1"),
+		token: (raw, label) => {
+			if (typeof raw !== "string" || raw.length > 8192) throw new Error(`${label} is invalid`);
+			return raw;
+		},
+		walletSessionId: keyLabeled(walletSessionId)
+	}, (credential, label) => {
+		if (!/^wst_[A-Za-z0-9_-]{43}$/.test(credential.token)) throw new Error(`${label} opaque token is invalid`);
+	});
+}
+function parseWalletSessionOperationCredentialV1(raw) {
+	return walletSessionOperationCredentialV1()(raw, "WalletSessionOperationCredentialV1");
+}
+function capabilitySubjectKey(subject) {
+	return subject.kind === "sign" || subject.kind === "export_keys" ? `${subject.kind}:${subject.keyFamily}:${subject.materialActivation.activationId}` : subject.kind;
+}
+function activeWalletSessionV1() {
+	return wireObject({
+		kind: wireLiteral("active_wallet_session_v1"),
+		walletId: keyLabeled(walletId),
+		authorityId: keyLabeled(walletAuthorityId),
+		authMethodId: keyLabeled(walletAuthMethodId),
+		authorizationId: keyLabeled(walletSessionAuthorizationId),
+		quotaId: keyLabeled(quotaId),
+		authorityDigestB64u: keyLabeled(digest),
+		authorityRevocationEpoch: keyLabeled(parseNonNegativeSafeInteger),
+		capabilitySubjects: (raw, label) => {
+			if (!Array.isArray(raw) || raw.length === 0) throw new Error(`${label} must be non-empty`);
+			const subjects = [];
+			for (const [index, subject] of raw.entries()) subjects.push(parseWalletCapabilitySubjectV1(subject, `capabilitySubjects[${index}]`));
+			const first = subjects[0];
+			if (!first) throw new Error(`${label} must be non-empty`);
+			return [first, ...subjects.slice(1)];
+		},
+		issuedAtMs: keyLabeled(parseUnixTime),
+		expiresAtMs: keyLabeled(parseUnixTime)
+	}, (session, label) => {
+		const keys = session.capabilitySubjects.map(capabilitySubjectKey);
+		if (new Set(keys).size !== keys.length) throw new Error(`${label} capability subjects repeat`);
+	});
+}
+function parseActiveWalletSessionV1(raw) {
+	return activeWalletSessionV1()(raw, "ActiveWalletSessionV1");
+}
+function parseWalletCapabilitySubjectV1(raw, label) {
+	const record = requireRecord(raw, label);
+	if (record.kind === "link_devices" || record.kind === "revoke_devices") {
+		rejectUnknownFields(record, ["kind"], label);
+		return { kind: record.kind };
+	}
+	if (record.kind !== "sign" && record.kind !== "export_keys") throw new Error(`${label}.kind is invalid`);
+	rejectUnknownFields(record, [
+		"kind",
+		"keyFamily",
+		"materialActivation"
+	], label);
+	if (record.keyFamily !== "ed25519" && record.keyFamily !== "ecdsa_secp256k1") throw new Error(`${label}.keyFamily is invalid`);
+	return {
+		kind: record.kind,
+		keyFamily: record.keyFamily,
+		materialActivation: materialActivation(record.materialActivation, `${label}.materialActivation`)
+	};
+}
+//#endregion
+export { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 };
+
+//# sourceMappingURL=activeWalletSession.js.map

package/dist/esm/shared-ts/src/device-linking/authorityActivation.js

@@ -0,0 +1,50 @@
+import "../utils/validation.js";
+import "../utils/exactRecord.js";
+import { wireLiteral, wireObject } from "../utils/wireSchema.js";
+import { authorizationDeviceId, digest, keyLabeled, parseUnixTime, sessionId, walletAuthMethodId, walletAuthorityId, walletId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
+import "./activeWalletSession.js";
+import { parseWalletSignerActivationSetV1 } from "../authorization/walletAuthority.js";
+import "./walletSessionCredentialDelivery.js";
+//#region ../shared-ts/src/device-linking/authorityActivation.ts
+function parseInstalledActivationRefs(raw, label) {
+	const result = parseWalletSignerActivationSetV1(raw);
+	if (!result.ok) throw new Error(`${label} ${result.error}`);
+	return result.value;
+}
+function localAuthorityInstallationReceiptV1() {
+	return wireObject({
+		kind: wireLiteral("local_authority_installation_receipt_v1"),
+		authorityId: keyLabeled(walletAuthorityId),
+		walletId: keyLabeled(walletId),
+		authMethodId: keyLabeled(walletAuthMethodId),
+		deviceId: keyLabeled(authorizationDeviceId),
+		packageSetDigestB64u: keyLabeled(digest),
+		installedActivationRefs: parseInstalledActivationRefs,
+		installedRecordSetDigestB64u: keyLabeled(digest),
+		targetFactorVerificationDigestB64u: keyLabeled(digest),
+		installedAtMs: keyLabeled(parseUnixTime)
+	});
+}
+function parseLocalAuthorityInstallationReceiptV1(raw) {
+	return localAuthorityInstallationReceiptV1()(raw, "LocalAuthorityInstallationReceiptV1");
+}
+function localAuthorityActivationFinalAckV1() {
+	return wireObject({
+		kind: wireLiteral("local_authority_activation_final_ack_v1"),
+		linkSessionId: keyLabeled(sessionId),
+		authorityId: keyLabeled(walletAuthorityId),
+		packageSetDigestB64u: keyLabeled(digest),
+		authorizationId: keyLabeled(walletSessionAuthorizationId),
+		walletSessionId: keyLabeled(walletSessionId),
+		credentialDigestB64u: keyLabeled(digest),
+		installationReceiptDigestB64u: keyLabeled(digest),
+		acknowledgedAtMs: keyLabeled(parseUnixTime)
+	});
+}
+function parseLocalAuthorityActivationFinalAckV1(raw) {
+	return localAuthorityActivationFinalAckV1()(raw, "LocalAuthorityActivationFinalAckV1");
+}
+//#endregion
+export { parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1 };
+
+//# sourceMappingURL=authorityActivation.js.map

package/dist/esm/shared-ts/src/device-linking/committedSignerPackages.js

@@ -1,13 +1,12 @@
 import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef } from "../utils/domainIds.js";
-import { base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../utils/digests.js";
+import { alphabetizeStringify } from "../utils/digests.js";
+import { parseDigestB64u, sha256Utf8DigestB64u } from "../utils/canonicalPrimitives.js";
 import { parseLinkedDeviceEd25519ExportRootPackageV1 } from "./ed25519ExportRoot.js";
-import { parseWalletAuthorityV1 } from "../authorization/walletAuthority.js";
-import { parseWalletAuthMethodRecordV2 } from "../utils/registrationIntent.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1 } from "../utils/routerAbEd25519Yao.js";
 import { parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from "./sourceContribution.js";
+import { parseWalletAuthMethodRecordV2 } from "../utils/walletAuthMethodRecord.js";
+import { parseWalletAuthorityV1 } from "../authorization/walletAuthority.js";
 //#region ../shared-ts/src/device-linking/committedSignerPackages.ts
 const COMMITTED_SIGNER_PACKAGE_DOMAIN_V1 = "seams/wallet/committed-signer-package/v1";
 const COMMITTED_SIGNER_PACKAGE_SET_DOMAIN_V1 = "seams/wallet/committed-signer-package-set/v1";
@@ -85,14 +84,14 @@ function parseCommittedSignerPackageSetDigestB64u(raw) {
 	return parseDigestB64u(raw);
 }
 async function computeCommittedSignerPackageDigestB64u(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+	return sha256Utf8DigestB64u(alphabetizeStringify({
 		domain: COMMITTED_SIGNER_PACKAGE_DOMAIN_V1,
 		package: value
-	}))));
+	}));
 }
 async function computeCommittedSignerPackageSetDigestB64u(input) {
 	const packageEntries = await committedSignerPackageSetCanonicalValue(input.signerPackages);
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify([
+	return sha256Utf8DigestB64u(alphabetizeStringify([
 		COMMITTED_SIGNER_PACKAGE_SET_DOMAIN_V1,
 		input.authorityId,
 		input.walletId,
@@ -105,7 +104,7 @@ async function computeCommittedSignerPackageSetDigestB64u(input) {
 		packageEntries,
 		input.ed25519ExportRootPackageDigestB64u,
 		input.targetFactorVerificationDigestB64u
-	]))));
+	]));
 }
 function parseEd25519Package(raw) {
 	const record = parseCommittedEd25519SignerPackageWireV1(raw);

package/dist/esm/shared-ts/src/device-linking/delegatedActivationPlan.js

@@ -1,5 +1,7 @@
 import { parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
-import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u, rejectUnknownFields, requireRecord } from "../passkey-custody/primitives.js";
+import { requireRecord } from "../utils/validation.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u } from "../passkey-custody/primitives.js";
 //#region ../shared-ts/src/device-linking/delegatedActivationPlan.ts
 const MANIFEST_FIELDS = [
 	"kind",