@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/shared-ts/src/device-linking/parsers.js

@@ -1,13 +1,11 @@
-import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcMaterialActivationRef, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
-import { parseDeviceId as parseDeviceId$1, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { parseEd25519PublicKeyB64u, parseUnixMs, rejectUnknownFields, requireRecord } from "../passkey-custody/primitives.js";
-import { parseDelegatedWalletAuthorityV1 } from "../authorization/delegatedAuthority.js";
+import { requireArray, requireRecord } from "../utils/validation.js";
+import { exactRecord } from "../utils/exactRecord.js";
+import { wireLiteral, wireNullable, wireObject, wireUnion } from "../utils/wireSchema.js";
+import "../authorization/delegatedAuthority.js";
+import { parseEd25519PublicKeyB64u } from "../passkey-custody/primitives.js";
+import { authorizationDeviceId, credentialId, digest, enrollmentId, linkedDeviceId, parseDelegatedWalletAuthority, parseNonEmptyToken, parseNonNegativeSafeInteger, parseTargetEmail, parseUnixTime, rpId, sessionId, walletAuthMethodId, walletAuthorityId, walletId, walletKeyId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../utils/addAuthMethodRegistration.js";
-import "./walletSessionCredentialDelivery.js";
-import { parseWalletSignerActivationSetV1 } from "../authorization/walletAuthority.js";
-import "../utils/registrationIntent.js";
 import { requireRouterAbX25519PublicKey } from "../utils/routerAbPublicKeyset.js";
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1 } from "./sourceContribution.js";
 import "./committedSignerPackages.js";
@@ -23,187 +21,16 @@ const QR_FIELDS = [
 	"issuedAtMs",
 	"expiresAtMs"
 ];
-const QR_EMAIL_FIELDS = [...QR_FIELDS, "targetEmail"];
-const OWNER_AUTHORIZATION_REQUEST_FIELDS = ["payload", "requestedAtMs"];
-const CLAIM_REQUEST_FIELDS = ["kind", "payload"];
-const CLAIM_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"walletId",
-	"enrollmentId",
-	"deviceId",
-	"devicePublicKeyB64u",
-	"targetFactor",
-	"sessionRevision",
-	"claimedAtMs",
-	"claimExpiresAtMs"
-];
-const OWNER_AUTH_WALLET_SESSION_FIELDS = [
-	"kind",
-	"walletSessionId",
-	"authorizationId"
-];
-const ENROLLMENT_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"walletId",
-	"enrollmentId",
-	"deviceId",
-	"linkPublicKeyB64u",
-	"devicePublicKeyB64u",
-	"permission",
-	"targetFactor",
-	"ownerAuthorization",
-	"approvedAtMs",
-	"expiresAtMs"
-];
-const ENROLLMENT_FIELDS_WITH_SOURCE_CONTRIBUTION = [...ENROLLMENT_FIELDS, "sourceContribution"];
-const APPROVAL_DELIVERY_FIELDS = ["kind", "approval"];
-const CREDENTIAL_BASE_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"walletId",
-	"enrollmentId",
-	"deviceId",
-	"walletAuthMethodId",
-	"targetFactor",
-	"targetPreparationDigestB64u",
-	"ordinarySignerMaterialRecipientRequests",
-	"registeredAtMs"
-];
-const PASSKEY_CREDENTIAL_FIELDS = [...CREDENTIAL_BASE_FIELDS, "webauthnRegistration"];
-const EMAIL_OTP_CREDENTIAL_FIELDS = [
-	...CREDENTIAL_BASE_FIELDS,
-	"targetEmail",
-	"emailOtpVerificationGrant"
-];
-const EMAIL_OTP_CREDENTIAL_NEW_FIELDS = [...EMAIL_OTP_CREDENTIAL_FIELDS, "emailOtpEnrollment"];
-const TARGET_PREPARATION_BASE_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"walletId",
-	"enrollmentId",
-	"deviceId",
-	"deliveryRecipientPublicKey65B64u",
-	"walletAuthMethodId",
-	"ed25519ExportRoot",
-	"targetFactor",
-	"ordinarySignerMaterialRecipientRequirements",
-	"issuedAtMs",
-	"expiresAtMs"
-];
-const TARGET_PREPARATION_REQUEST_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"deliveryRecipientPublicKey65B64u"
-];
-const TARGET_PREPARATION_PASSKEY_FIELDS = [
-	...TARGET_PREPARATION_BASE_FIELDS,
-	"passkeyCreationOptions",
-	"passkeyConfigurationDigestB64u"
-];
-const TARGET_PREPARATION_EMAIL_FIELDS = [
-	...TARGET_PREPARATION_BASE_FIELDS,
-	"targetEmail",
-	"enrollment",
-	"baseWalletAuthMethodId"
-];
-const TARGET_PREPARATION_EMAIL_NEW_FIELDS = [
-	...TARGET_PREPARATION_BASE_FIELDS,
-	"targetEmail",
-	"enrollment"
-];
-const EMAIL_OTP_VERIFICATION_GRANT_BASE_FIELDS = [
-	"kind",
-	"grantId",
-	"grantToken",
-	"challengeId",
-	"linkSessionId",
-	"walletId",
-	"enrollmentId",
-	"deviceId",
-	"targetPreparationDigestB64u",
-	"targetEmail",
-	"enrollment",
-	"emailHashHex",
-	"registrationAuthorityId",
-	"providerUserId",
-	"authorityDigestB64u",
-	"issuedAtMs",
-	"expiresAtMs"
-];
-const EMAIL_OTP_VERIFICATION_GRANT_FIELDS = [...EMAIL_OTP_VERIFICATION_GRANT_BASE_FIELDS, "baseWalletAuthMethodId"];
-const EMAIL_OTP_FACTOR_RELEASE_FIELDS = [
-	"kind",
-	"challengeId",
-	"enrollmentId",
-	"enrollmentSealKeyVersion",
-	"serverEphemeralPublicKey65B64u",
-	"nonce12B64u",
-	"ciphertextB64u"
-];
-const WEBAUTHN_REGISTRATION_FIELDS = [
-	"kind",
-	"credentialIdB64u",
-	"authenticatorAttachment",
-	"clientDataJsonB64u",
-	"attestationObjectB64u",
-	"transports"
-];
-const LINKED_DEVICE_LIST_REQUEST_FIELDS = [
-	"kind",
-	"walletId",
-	"limit",
-	"cursor"
-];
-const LINKED_DEVICE_REVOKE_REQUEST_FIELDS = [
-	"kind",
-	"walletId",
-	"walletAuthMethodId",
-	"requestedAtMs"
-];
-function exactRecord(raw, fields, label) {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, fields, label);
-	for (const field of fields) if (!Object.prototype.hasOwnProperty.call(record, field) || record[field] === void 0) throw new Error(`${label}.${field} is required`);
-	return record;
-}
-function parseId(parser, raw, label) {
-	const result = parser(raw);
-	if (result.ok) return result.value;
-	throw new Error(`${label} ${result.error.message}`);
-}
-function parseLinkedDeviceRevokeWalletAuthMethodId(raw, label) {
-	const value = parseId(parseWalletAuthMethodId, raw, label);
-	if (value.startsWith("wallet-authority:") || value.startsWith("authority:")) throw new Error(`${label} must identify a WalletAuthMethodId`);
-	return value;
-}
-function parseUnixTime(raw, label) {
-	try {
-		return parseUnixMs(raw, label);
-	} catch (error) {
-		throw new Error(error instanceof Error ? error.message : `${label} is invalid`);
-	}
+function supportedLiteral(...values) {
+	return (raw, label) => {
+		if (!values.includes(raw)) throw new Error(`${label} is unsupported`);
+		return raw;
+	};
 }
 function parseEmailHashHex(raw, label) {
 	if (typeof raw !== "string" || !/^[0-9a-f]{64}$/.test(raw)) throw new Error(`${label} must be 32 canonical lowercase hex bytes`);
 	return raw;
 }
-function parseNonEmptyToken(raw, label) {
-	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw) throw new Error(`${label} must be a non-empty canonical string`);
-	for (const character of raw) {
-		const code = character.charCodeAt(0);
-		if (/\s/.test(character) || code <= 31 || code === 127) throw new Error(`${label} must not contain whitespace or control characters`);
-	}
-	return raw;
-}
-function parseDigest(raw, label) {
-	try {
-		return parseDigestB64u(raw);
-	} catch (error) {
-		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
-	}
-}
 function parsePublicKey(raw, label) {
 	if (typeof raw !== "string" || raw.length === 0 || !/^[A-Za-z0-9_-]+$/.test(raw)) throw new Error(`${label} must be canonical unpadded base64url`);
 	try {
@@ -263,33 +90,15 @@ function parseLinkDevicePublicKeyB64u(raw) {
 	return parsePublicKey(raw, "LinkDevicePublicKeyB64u");
 }
 function parseCredential(raw, label) {
-	return parseId(parseWebAuthnCredentialIdB64u, parseCanonicalBase64UrlBytes(raw, label), label);
+	return credentialId(parseCanonicalBase64UrlBytes(raw, label), label);
 }
 function parseKeyFamily(raw, label) {
 	if (raw !== "ed25519" && raw !== "ecdsa_secp256k1") throw new Error(`${label} must identify a supported key family`);
 	return raw;
 }
-function parseNonNegativeSafeInteger(raw, label) {
-	if (!Number.isSafeInteger(raw) || Number(raw) < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	return Number(raw);
-}
-function parsePositiveSafeInteger(raw, label) {
-	const value = parseNonNegativeSafeInteger(raw, label);
-	if (value < 1) throw new Error(`${label} must be a positive safe integer`);
-	return value;
-}
-function parseNullableCursor(raw, label) {
-	if (raw === null) return null;
-	return parseNonEmptyToken(raw, label);
-}
 function assertExpiryAfterIssued(issuedAtMs, expiresAtMs, label) {
 	if (expiresAtMs <= issuedAtMs) throw new Error(`${label}.expiresAtMs must be after issuedAtMs`);
 }
-function parseDelegatedWalletAuthority(raw, label) {
-	const result = parseDelegatedWalletAuthorityV1(raw);
-	if (!result.ok) throw new Error(`${label}: ${result.error.message}`);
-	return result.value;
-}
 function parseTargetFactor(raw, label) {
 	switch (exactRecord(raw, ["kind"], label).kind) {
 		case "passkey_prf": return { kind: "passkey_prf" };
@@ -297,36 +106,31 @@ function parseTargetFactor(raw, label) {
 		default: throw new Error(`${label}.kind is unsupported`);
 	}
 }
-function parseTargetEmail(raw, label) {
-	const parsed = parseVerifiedEmailAddress(raw);
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
+function passkeyTargetFactorV1() {
+	return wireObject({ kind: wireLiteral("passkey_prf") });
 }
-function parseEmailOtpEnrollmentSelection(raw, label) {
-	const record = requireRecord(raw, label);
-	if (record.kind === "existing_enrollment") {
-		exactRecord(record, ["kind"], label);
-		return { kind: "existing_enrollment" };
-	}
-	if (record.kind === "new_enrollment") {
-		exactRecord(record, ["kind"], label);
-		return { kind: "new_enrollment" };
-	}
-	throw new Error(`${label}.kind is invalid`);
+function emailOtpTargetFactorV1() {
+	return wireObject({ kind: wireLiteral("email_otp") });
 }
-function parseEmailOtpEnrollmentMaterial(raw, label) {
-	const record = exactRecord(raw, [
-		"enrollmentSealKeyVersion",
-		"clientUnlockPublicKeyB64u",
-		"unlockKeyVersion",
-		"serverSealedFactorCiphertextB64u"
-	], label);
-	return {
-		enrollmentSealKeyVersion: parseNonEmptyToken(record.enrollmentSealKeyVersion, `${label}.enrollmentSealKeyVersion`),
-		clientUnlockPublicKeyB64u: parseNonEmptyToken(record.clientUnlockPublicKeyB64u, `${label}.clientUnlockPublicKeyB64u`),
-		unlockKeyVersion: parseNonEmptyToken(record.unlockKeyVersion, `${label}.unlockKeyVersion`),
-		serverSealedFactorCiphertextB64u: parseNonEmptyToken(record.serverSealedFactorCiphertextB64u, `${label}.serverSealedFactorCiphertextB64u`)
-	};
+function existingEnrollmentV1() {
+	return wireObject({ kind: wireLiteral("existing_enrollment") });
+}
+function newEnrollmentV1() {
+	return wireObject({ kind: wireLiteral("new_enrollment") });
+}
+function emailOtpEnrollmentSelectionV1() {
+	return wireUnion("kind", [existingEnrollmentV1(), newEnrollmentV1()]);
+}
+function parseEmailOtpEnrollmentSelection(raw, label) {
+	return emailOtpEnrollmentSelectionV1()(raw, label);
+}
+function emailOtpEnrollmentMaterialV1() {
+	return wireObject({
+		enrollmentSealKeyVersion: parseNonEmptyToken,
+		clientUnlockPublicKeyB64u: parseNonEmptyToken,
+		unlockKeyVersion: parseNonEmptyToken,
+		serverSealedFactorCiphertextB64u: parseNonEmptyToken
+	});
 }
 function parseApprovedTargetFactor(raw, label) {
 	const record = requireRecord(raw, label);
@@ -341,7 +145,7 @@ function parseApprovedTargetFactor(raw, label) {
 			kind: "email_otp",
 			targetEmail,
 			enrollment,
-			baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, exactRecord(record, [
+			baseWalletAuthMethodId: walletAuthMethodId(exactRecord(record, [
 				"kind",
 				"targetEmail",
 				"enrollment",
@@ -361,47 +165,6 @@ function parseApprovedTargetFactor(raw, label) {
 	}
 	throw new Error(`${label}.kind is unsupported`);
 }
-function parseSessionId(raw, label) {
-	return parseId(parseLinkDeviceSessionId, raw, label);
-}
-function parseWallet(raw, label) {
-	return parseId(parseWalletId, raw, label);
-}
-function parseEnrollmentId(raw, label) {
-	return parseId(parseLinkedDeviceEnrollmentId, raw, label);
-}
-function parseDeviceId(raw, label) {
-	return parseId(parseLinkedDeviceId, raw, label);
-}
-function parseWalletKey(raw, label) {
-	return parseId(parseWalletKeyId, raw, label);
-}
-function parseWalletSession(raw, label) {
-	return parseId(parseWalletSessionId, raw, label);
-}
-function parseWalletAuthorization(raw, label) {
-	return parseId(parseWalletSessionAuthorizationId, raw, label);
-}
-function parseLinkedDeviceListRequestV1(raw) {
-	const record = exactRecord(raw, LINKED_DEVICE_LIST_REQUEST_FIELDS, "LinkedDeviceListRequestV1");
-	if (record.kind !== "linked_device_list_request_v1") throw new Error("LinkedDeviceListRequestV1.kind is invalid");
-	return {
-		kind: "linked_device_list_request_v1",
-		walletId: parseWallet(record.walletId, "LinkedDeviceListRequestV1.walletId"),
-		limit: parsePositiveSafeInteger(record.limit, "LinkedDeviceListRequestV1.limit"),
-		cursor: parseNullableCursor(record.cursor, "LinkedDeviceListRequestV1.cursor")
-	};
-}
-function parseLinkedDeviceRevokeRequestV1(raw) {
-	const record = exactRecord(raw, LINKED_DEVICE_REVOKE_REQUEST_FIELDS, "LinkedDeviceRevokeRequestV1");
-	if (record.kind !== "linked_device_revoke_request_v1") throw new Error("LinkedDeviceRevokeRequestV1.kind is invalid");
-	return {
-		kind: "linked_device_revoke_request_v1",
-		walletId: parseWallet(record.walletId, "LinkedDeviceRevokeRequestV1.walletId"),
-		walletAuthMethodId: parseLinkedDeviceRevokeWalletAuthMethodId(record.walletAuthMethodId, "LinkedDeviceRevokeRequestV1.walletAuthMethodId"),
-		requestedAtMs: parseUnixTime(record.requestedAtMs, "LinkedDeviceRevokeRequestV1.requestedAtMs")
-	};
-}
 function parseQrPayloadRecord(record) {
 	if (record.version !== "v5") throw new Error("QrLinkedDeviceSessionPayloadV5.version is invalid");
 	if (record.purpose !== "linked_device_lane_creation") throw new Error("QrLinkedDeviceSessionPayloadV5.purpose is invalid");
@@ -411,7 +174,7 @@ function parseQrPayloadRecord(record) {
 	const base = {
 		version: "v5",
 		purpose: "linked_device_lane_creation",
-		linkSessionId: parseSessionId(record.linkSessionId, "QrLinkedDeviceSessionPayloadV5.linkSessionId"),
+		linkSessionId: sessionId(record.linkSessionId, "QrLinkedDeviceSessionPayloadV5.linkSessionId"),
 		linkPublicKeyB64u: parsePublicKey(record.linkPublicKeyB64u, "QrLinkedDeviceSessionPayloadV5.linkPublicKeyB64u"),
 		devicePublicKeyB64u: parsePublicKey(record.devicePublicKeyB64u, "QrLinkedDeviceSessionPayloadV5.devicePublicKeyB64u"),
 		requestedPermission: parseDelegatedWalletAuthority(record.requestedPermission, "QrLinkedDeviceSessionPayloadV5.requestedPermission"),
@@ -431,78 +194,60 @@ function parseQrPayloadRecord(record) {
 }
 function parseQrLinkedDeviceSessionPayloadV5(raw) {
 	const candidate = requireRecord(raw, "QrLinkedDeviceSessionPayloadV5");
-	return parseQrPayloadRecord(exactRecord(candidate, parseTargetFactor(candidate.targetFactor, "QrLinkedDeviceSessionPayloadV5.targetFactor").kind === "email_otp" ? QR_EMAIL_FIELDS : QR_FIELDS, "QrLinkedDeviceSessionPayloadV5"));
+	return parseQrPayloadRecord(exactRecord(candidate, parseTargetFactor(candidate.targetFactor, "QrLinkedDeviceSessionPayloadV5.targetFactor").kind === "email_otp" ? [...QR_FIELDS, "targetEmail"] : QR_FIELDS, "QrLinkedDeviceSessionPayloadV5"));
+}
+function linkedDeviceOwnerAuthorizationRequestV1() {
+	return wireObject({
+		payload: parseQrLinkedDeviceSessionPayloadV5,
+		requestedAtMs: parseUnixTime
+	});
 }
 function parseLinkedDeviceOwnerAuthorizationRequestV1(raw) {
-	const record = exactRecord(raw, OWNER_AUTHORIZATION_REQUEST_FIELDS, "LinkedDeviceOwnerAuthorizationRequestV1");
-	const requestedAtMs = parseUnixTime(record.requestedAtMs, "LinkedDeviceOwnerAuthorizationRequestV1.requestedAtMs");
-	return {
-		payload: parseQrLinkedDeviceSessionPayloadV5(record.payload),
-		requestedAtMs
-	};
+	return linkedDeviceOwnerAuthorizationRequestV1()(raw, "LinkedDeviceOwnerAuthorizationRequestV1");
+}
+function linkSessionStatesV1() {
+	const withDevice = (state) => wireObject({
+		state: wireLiteral(state),
+		deviceId: authorizationDeviceId
+	});
+	return [
+		wireObject({ state: wireLiteral("displaying_qr") }),
+		withDevice("claimed"),
+		withDevice("awaiting_target_factor"),
+		withDevice("awaiting_source_contribution"),
+		withDevice("provisioning"),
+		wireObject({
+			state: wireLiteral("authority_pending_local_install"),
+			deviceId: authorizationDeviceId,
+			authorityId: walletAuthorityId,
+			packageSetDigestB64u: digest
+		}),
+		wireObject({
+			state: wireLiteral("active"),
+			deviceId: authorizationDeviceId,
+			authorityId: walletAuthorityId,
+			activatedAtMs: parseUnixTime
+		}),
+		wireObject({
+			state: wireLiteral("failed_before_commit"),
+			error: parseLinkPrecommitFailureV1
+		}),
+		wireObject({
+			state: wireLiteral("cancelled"),
+			cancelledAtMs: parseUnixTime
+		}),
+		wireObject({
+			state: wireLiteral("expired"),
+			expiredAtMs: parseUnixTime
+		})
+	];
 }
 function parseLinkSessionStateV1(raw) {
-	const initial = requireRecord(raw, "LinkSessionStateV1");
-	if (typeof initial.state !== "string") throw new Error("LinkSessionStateV1.state is invalid");
-	switch (initial.state) {
-		case "displaying_qr":
-			exactRecord(initial, ["state"], "LinkSessionStateV1.displaying_qr");
-			return { state: "displaying_qr" };
-		case "claimed":
-		case "awaiting_target_factor":
-		case "awaiting_source_contribution":
-		case "provisioning":
-			exactRecord(initial, ["state", "deviceId"], `LinkSessionStateV1.${initial.state}`);
-			return {
-				state: initial.state,
-				deviceId: parseId(parseDeviceId$1, initial.deviceId, `LinkSessionStateV1.${initial.state}.deviceId`)
-			};
-		case "authority_pending_local_install":
-			exactRecord(initial, [
-				"state",
-				"deviceId",
-				"authorityId",
-				"packageSetDigestB64u"
-			], "LinkSessionStateV1.authority_pending_local_install");
-			return {
-				state: initial.state,
-				deviceId: parseId(parseDeviceId$1, initial.deviceId, "LinkSessionStateV1.authority_pending_local_install.deviceId"),
-				authorityId: parseId(parseWalletAuthorityId, initial.authorityId, "LinkSessionStateV1.authority_pending_local_install.authorityId"),
-				packageSetDigestB64u: parseDigest(initial.packageSetDigestB64u, "LinkSessionStateV1.authority_pending_local_install.packageSetDigestB64u")
-			};
-		case "active":
-			exactRecord(initial, [
-				"state",
-				"deviceId",
-				"authorityId",
-				"activatedAtMs"
-			], "LinkSessionStateV1.active");
-			return {
-				state: initial.state,
-				deviceId: parseId(parseDeviceId$1, initial.deviceId, "LinkSessionStateV1.active.deviceId"),
-				authorityId: parseId(parseWalletAuthorityId, initial.authorityId, "LinkSessionStateV1.active.authorityId"),
-				activatedAtMs: parseUnixTime(initial.activatedAtMs, "LinkSessionStateV1.active.activatedAtMs")
-			};
-		case "failed_before_commit":
-			exactRecord(initial, ["state", "error"], "LinkSessionStateV1.failed_before_commit");
-			return {
-				state: initial.state,
-				error: parseLinkPrecommitFailureV1(initial.error)
-			};
-		case "cancelled":
-			exactRecord(initial, ["state", "cancelledAtMs"], "LinkSessionStateV1.cancelled");
-			return {
-				state: initial.state,
-				cancelledAtMs: parseUnixTime(initial.cancelledAtMs, "LinkSessionStateV1.cancelled.cancelledAtMs")
-			};
-		case "expired":
-			exactRecord(initial, ["state", "expiredAtMs"], "LinkSessionStateV1.expired");
-			return {
-				state: initial.state,
-				expiredAtMs: parseUnixTime(initial.expiredAtMs, "LinkSessionStateV1.expired.expiredAtMs")
-			};
-		default: throw new Error(`LinkSessionStateV1.state ${initial.state} is unsupported`);
-	}
+	const state = requireRecord(raw, "LinkSessionStateV1").state;
+	if (typeof state !== "string") throw new Error("LinkSessionStateV1.state is invalid");
+	const schema = linkSessionStatesV1().find((variant) => variant.shape.state.literals.includes(state));
+	if (!schema) throw new Error(`LinkSessionStateV1.state ${state} is unsupported`);
+	return schema(raw, `LinkSessionStateV1.${state}`);
 }
 function parseLinkPrecommitFailureV1(raw) {
 	const record = exactRecord(raw, ["kind", "reason"], "LinkPrecommitFailureV1");
@@ -512,143 +257,145 @@ function parseLinkPrecommitFailureV1(raw) {
 		reason: parseNonEmptyToken(record.reason, "LinkPrecommitFailureV1.reason")
 	};
 }
+function linkedDeviceSessionClaimRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_session_claim_request_v1"),
+		payload: parseQrLinkedDeviceSessionPayloadV5
+	});
+}
 function parseLinkedDeviceSessionClaimRequestV1(raw) {
-	const record = exactRecord(raw, CLAIM_REQUEST_FIELDS, "LinkedDeviceSessionClaimRequestV1");
-	if (record.kind !== "linked_device_session_claim_request_v1") throw new Error("LinkedDeviceSessionClaimRequestV1.kind is invalid");
-	return {
-		kind: "linked_device_session_claim_request_v1",
-		payload: parseQrLinkedDeviceSessionPayloadV5(record.payload)
-	};
+	return linkedDeviceSessionClaimRequestV1()(raw, "LinkedDeviceSessionClaimRequestV1");
+}
+function linkedDeviceSessionClaimV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_session_claim_v1"),
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		devicePublicKeyB64u: parsePublicKey,
+		targetFactor: parseTargetFactor,
+		sessionRevision: parseUnixTime,
+		claimedAtMs: parseUnixTime,
+		claimExpiresAtMs: parseUnixTime
+	}, (claim, label) => assertExpiryAfterIssued(claim.claimedAtMs, claim.claimExpiresAtMs, label));
 }
 function parseLinkedDeviceSessionClaimV1(raw) {
-	const record = exactRecord(raw, CLAIM_FIELDS, "LinkedDeviceSessionClaimV1");
-	if (record.kind !== "linked_device_session_claim_v1") throw new Error("LinkedDeviceSessionClaimV1.kind is invalid");
-	const claimedAtMs = parseUnixTime(record.claimedAtMs, "LinkedDeviceSessionClaimV1.claimedAtMs");
-	const claimExpiresAtMs = parseUnixTime(record.claimExpiresAtMs, "LinkedDeviceSessionClaimV1.claimExpiresAtMs");
-	assertExpiryAfterIssued(claimedAtMs, claimExpiresAtMs, "LinkedDeviceSessionClaimV1");
-	return {
-		kind: "linked_device_session_claim_v1",
-		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceSessionClaimV1.linkSessionId"),
-		walletId: parseWallet(record.walletId, "LinkedDeviceSessionClaimV1.walletId"),
-		enrollmentId: parseEnrollmentId(record.enrollmentId, "LinkedDeviceSessionClaimV1.enrollmentId"),
-		deviceId: parseDeviceId(record.deviceId, "LinkedDeviceSessionClaimV1.deviceId"),
-		devicePublicKeyB64u: parsePublicKey(record.devicePublicKeyB64u, "LinkedDeviceSessionClaimV1.devicePublicKeyB64u"),
-		targetFactor: parseTargetFactor(record.targetFactor, "LinkedDeviceSessionClaimV1.targetFactor"),
-		sessionRevision: parseUnixTime(record.sessionRevision, "LinkedDeviceSessionClaimV1.sessionRevision"),
-		claimedAtMs,
-		claimExpiresAtMs
-	};
+	return linkedDeviceSessionClaimV1()(raw, "LinkedDeviceSessionClaimV1");
+}
+function walletSessionOwnerAuthorizationV1() {
+	return wireObject({
+		kind: wireLiteral("wallet_session"),
+		walletSessionId,
+		authorizationId: walletSessionAuthorizationId
+	});
 }
 function parseLinkedDeviceOwnerAuthorizationSourceV1(raw, label = "ownerAuthorization") {
-	const record = requireRecord(raw, label);
-	if (record.kind === "wallet_session") {
-		const exact = exactRecord(record, OWNER_AUTH_WALLET_SESSION_FIELDS, label);
-		return {
-			kind: "wallet_session",
-			walletSessionId: parseWalletSession(exact.walletSessionId, `${label}.walletSessionId`),
-			authorizationId: parseWalletAuthorization(exact.authorizationId, `${label}.authorizationId`)
-		};
-	}
-	throw new Error(`${label}.kind is unsupported`);
+	if (requireRecord(raw, label).kind !== "wallet_session") throw new Error(`${label}.kind is unsupported`);
+	return walletSessionOwnerAuthorizationV1()(raw, label);
 }
-function parseEnrollmentCore(record, label) {
-	const approvedAtMs = parseUnixTime(record.approvedAtMs, `${label}.approvedAtMs`);
-	const expiresAtMs = parseUnixTime(record.expiresAtMs, `${label}.expiresAtMs`);
-	assertExpiryAfterIssued(approvedAtMs, expiresAtMs, label);
-	const core = {
-		linkSessionId: parseSessionId(record.linkSessionId, `${label}.linkSessionId`),
-		walletId: parseWallet(record.walletId, `${label}.walletId`),
-		enrollmentId: parseEnrollmentId(record.enrollmentId, `${label}.enrollmentId`),
-		deviceId: parseDeviceId(record.deviceId, `${label}.deviceId`),
-		linkPublicKeyB64u: parsePublicKey(record.linkPublicKeyB64u, `${label}.linkPublicKeyB64u`),
-		devicePublicKeyB64u: parsePublicKey(record.devicePublicKeyB64u, `${label}.devicePublicKeyB64u`),
-		permission: parseDelegatedWalletAuthority(record.permission, `${label}.permission`),
-		targetFactor: parseApprovedTargetFactor(record.targetFactor, `${label}.targetFactor`),
-		ownerAuthorization: parseLinkedDeviceOwnerAuthorizationSourceV1(record.ownerAuthorization, `${label}.ownerAuthorization`),
-		approvedAtMs,
-		expiresAtMs
-	};
-	if (record.sourceContribution === void 0) return core;
+function linkedDeviceApprovalFields() {
 	return {
-		...core,
-		sourceContribution: parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1(record.sourceContribution)
+		kind: wireLiteral("linked_device_approval_v1"),
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		linkPublicKeyB64u: parsePublicKey,
+		devicePublicKeyB64u: parsePublicKey,
+		permission: parseDelegatedWalletAuthority,
+		targetFactor: parseApprovedTargetFactor,
+		ownerAuthorization: parseLinkedDeviceOwnerAuthorizationSourceV1,
+		approvedAtMs: parseUnixTime,
+		expiresAtMs: parseUnixTime
 	};
 }
+function approvedBeforeExpiry(approval, label) {
+	assertExpiryAfterIssued(approval.approvedAtMs, approval.expiresAtMs, label);
+}
+function linkedDeviceApprovalV1() {
+	return wireObject(linkedDeviceApprovalFields(), approvedBeforeExpiry);
+}
+function linkedDeviceSourceContributionApprovalV1() {
+	return wireObject({
+		...linkedDeviceApprovalFields(),
+		sourceContribution: parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1
+	}, approvedBeforeExpiry);
+}
 function parseLinkedDeviceApprovalV1(raw) {
-	const candidate = requireRecord(raw, "LinkedDeviceApprovalV1");
-	const record = exactRecord(candidate, candidate.sourceContribution === void 0 ? ENROLLMENT_FIELDS : ENROLLMENT_FIELDS_WITH_SOURCE_CONTRIBUTION, "LinkedDeviceApprovalV1");
-	if (record.kind !== "linked_device_approval_v1") throw new Error("LinkedDeviceApprovalV1.kind is invalid");
-	return {
-		kind: "linked_device_approval_v1",
-		...parseEnrollmentCore(record, "LinkedDeviceApprovalV1")
-	};
+	const record = requireRecord(raw, "LinkedDeviceApprovalV1");
+	return (record.sourceContribution === void 0 ? linkedDeviceApprovalV1() : linkedDeviceSourceContributionApprovalV1())(record, "LinkedDeviceApprovalV1");
+}
+function linkedDeviceApprovalDeliveryV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_approval_delivery_v1"),
+		approval: parseLinkedDeviceApprovalV1
+	});
 }
 function parseLinkedDeviceApprovalDeliveryV1(raw) {
-	const record = exactRecord(raw, APPROVAL_DELIVERY_FIELDS, "LinkedDeviceApprovalDeliveryV1");
-	if (record.kind !== "linked_device_approval_delivery_v1") throw new Error("LinkedDeviceApprovalDeliveryV1.kind is invalid");
+	return linkedDeviceApprovalDeliveryV1()(raw, "LinkedDeviceApprovalDeliveryV1");
+}
+function linkedDeviceTargetPreparationFields() {
 	return {
-		kind: "linked_device_approval_delivery_v1",
-		approval: parseLinkedDeviceApprovalV1(record.approval)
-	};
+		kind: wireLiteral("linked_device_target_preparation_v1"),
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		deliveryRecipientPublicKey65B64u: parseUncompressedP256PointB64u,
+		walletAuthMethodId,
+		ed25519ExportRoot: wireNullable(ed25519ExportRootPreparationV1()),
+		ordinarySignerMaterialRecipientRequirements: parseRecipientRequirements,
+		issuedAtMs: parseUnixTime,
+		expiresAtMs: parseUnixTime
+	};
+}
+function preparationExpiresAfterIssue(preparation, label) {
+	if (preparation.expiresAtMs <= preparation.issuedAtMs) throw new Error(`${label}.expiresAtMs must follow issuedAtMs`);
+}
+function passkeyTargetPreparationV1() {
+	return wireObject({
+		...linkedDeviceTargetPreparationFields(),
+		targetFactor: passkeyTargetFactorV1(),
+		passkeyCreationOptions: parseLinkedDevicePasskeyCreationOptionsV1,
+		passkeyConfigurationDigestB64u: digest
+	}, (preparation, label) => {
+		preparationExpiresAfterIssue(preparation, label);
+		if (preparation.passkeyCreationOptions.walletAuthMethodId !== preparation.walletAuthMethodId) throw new Error(`${label}.passkeyCreationOptions.walletAuthMethodId must match the preparation`);
+	});
+}
+function emailOtpTargetPreparationV1() {
+	return wireObject({
+		...linkedDeviceTargetPreparationFields(),
+		targetFactor: emailOtpTargetFactorV1(),
+		targetEmail: parseTargetEmail,
+		enrollment: existingEnrollmentV1(),
+		baseWalletAuthMethodId: walletAuthMethodId
+	}, preparationExpiresAfterIssue);
+}
+function newEmailOtpTargetPreparationV1() {
+	return wireObject({
+		...linkedDeviceTargetPreparationFields(),
+		targetFactor: emailOtpTargetFactorV1(),
+		targetEmail: parseTargetEmail,
+		enrollment: newEnrollmentV1()
+	}, preparationExpiresAfterIssue);
 }
 function parseLinkedDeviceTargetPreparationV1(raw) {
-	const candidate = requireRecord(raw, "LinkedDeviceTargetPreparationV1");
-	const targetFactor = parseTargetFactor(candidate.targetFactor, "LinkedDeviceTargetPreparationV1.targetFactor");
-	const emailEnrollment = targetFactor.kind === "email_otp" ? parseEmailOtpEnrollmentSelection(candidate.enrollment, "LinkedDeviceTargetPreparationV1.enrollment") : null;
-	const record = exactRecord(candidate, targetFactor.kind === "passkey_prf" ? TARGET_PREPARATION_PASSKEY_FIELDS : emailEnrollment?.kind === "new_enrollment" ? TARGET_PREPARATION_EMAIL_NEW_FIELDS : TARGET_PREPARATION_EMAIL_FIELDS, "LinkedDeviceTargetPreparationV1");
-	if (record.kind !== "linked_device_target_preparation_v1") throw new Error("LinkedDeviceTargetPreparationV1.kind is invalid");
-	const walletAuthMethodId = parseId(parseWalletAuthMethodId, record.walletAuthMethodId, "LinkedDeviceTargetPreparationV1.walletAuthMethodId");
-	const ordinarySignerMaterialRecipientRequirements = parseOrdinarySignerMaterialRecipientRequirementsV1(record.ordinarySignerMaterialRecipientRequirements);
-	const issuedAtMs = parseUnixTime(record.issuedAtMs, "LinkedDeviceTargetPreparationV1.issuedAtMs");
-	const expiresAtMs = parseUnixTime(record.expiresAtMs, "LinkedDeviceTargetPreparationV1.expiresAtMs");
-	if (expiresAtMs <= issuedAtMs) throw new Error("LinkedDeviceTargetPreparationV1.expiresAtMs must follow issuedAtMs");
-	const ed25519ExportRoot = parseLinkedDeviceEd25519ExportRootPreparationV1(record.ed25519ExportRoot);
-	const base = {
-		kind: "linked_device_target_preparation_v1",
-		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceTargetPreparationV1.linkSessionId"),
-		walletId: parseWallet(record.walletId, "LinkedDeviceTargetPreparationV1.walletId"),
-		enrollmentId: parseEnrollmentId(record.enrollmentId, "LinkedDeviceTargetPreparationV1.enrollmentId"),
-		deviceId: parseDeviceId(record.deviceId, "LinkedDeviceTargetPreparationV1.deviceId"),
-		deliveryRecipientPublicKey65B64u: parseUncompressedP256PointB64u(record.deliveryRecipientPublicKey65B64u, "LinkedDeviceTargetPreparationV1.deliveryRecipientPublicKey65B64u"),
-		walletAuthMethodId,
-		ed25519ExportRoot,
-		ordinarySignerMaterialRecipientRequirements,
-		issuedAtMs,
-		expiresAtMs
-	};
-	if (targetFactor.kind === "passkey_prf") {
-		const passkeyCreationOptions = parseLinkedDevicePasskeyCreationOptionsV1(record.passkeyCreationOptions, walletAuthMethodId);
-		return {
-			...base,
-			targetFactor,
-			passkeyCreationOptions,
-			passkeyConfigurationDigestB64u: parseDigest(record.passkeyConfigurationDigestB64u, "LinkedDeviceTargetPreparationV1.passkeyConfigurationDigestB64u")
-		};
-	}
-	if (!emailEnrollment) throw new Error("Email OTP target preparation enrollment is missing");
-	const targetEmail = parseTargetEmail(record.targetEmail, "LinkedDeviceTargetPreparationV1.targetEmail");
-	if (emailEnrollment.kind === "new_enrollment") return {
-		...base,
-		targetFactor,
-		targetEmail,
-		enrollment: emailEnrollment
-	};
-	return {
-		...base,
-		targetFactor,
-		targetEmail,
-		enrollment: emailEnrollment,
-		baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, record.baseWalletAuthMethodId, "LinkedDeviceTargetPreparationV1.baseWalletAuthMethodId")
-	};
+	const label = "LinkedDeviceTargetPreparationV1";
+	const record = requireRecord(raw, label);
+	if (parseTargetFactor(record.targetFactor, `${label}.targetFactor`).kind === "passkey_prf") return passkeyTargetPreparationV1()(record, label);
+	return (parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`).kind === "new_enrollment" ? newEmailOtpTargetPreparationV1() : emailOtpTargetPreparationV1())(record, label);
+}
+function linkedDeviceTargetPreparationRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_target_preparation_request_v1"),
+		linkSessionId: sessionId,
+		deliveryRecipientPublicKey65B64u: parseUncompressedP256PointB64u
+	});
 }
 function parseLinkedDeviceTargetPreparationRequestV1(raw) {
-	const record = exactRecord(raw, TARGET_PREPARATION_REQUEST_FIELDS, "LinkedDeviceTargetPreparationRequestV1");
-	if (record.kind !== "linked_device_target_preparation_request_v1") throw new Error("LinkedDeviceTargetPreparationRequestV1.kind is invalid");
-	return {
-		kind: "linked_device_target_preparation_request_v1",
-		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceTargetPreparationRequestV1.linkSessionId"),
-		deliveryRecipientPublicKey65B64u: parseUncompressedP256PointB64u(record.deliveryRecipientPublicKey65B64u, "LinkedDeviceTargetPreparationRequestV1.deliveryRecipientPublicKey65B64u")
-	};
+	return linkedDeviceTargetPreparationRequestV1()(raw, "LinkedDeviceTargetPreparationRequestV1");
 }
 function parseLinkedDeviceEmailOtpBaseFactorRequestV1(raw) {
 	const record = requireRecord(raw, "LinkedDeviceEmailOtpBaseFactorRequestV1");
@@ -663,7 +410,7 @@ function parseLinkedDeviceEmailOtpBaseFactorRequestV1(raw) {
 	if (record.kind === "select") return {
 		kind: "select",
 		expectedRevision,
-		baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, exactRecord(record, [
+		baseWalletAuthMethodId: walletAuthMethodId(exactRecord(record, [
 			"kind",
 			"expectedRevision",
 			"baseWalletAuthMethodId"
@@ -671,8 +418,7 @@ function parseLinkedDeviceEmailOtpBaseFactorRequestV1(raw) {
 	};
 	throw new Error("LinkedDeviceEmailOtpBaseFactorRequestV1.kind is unsupported");
 }
-function parseLinkedDevicePasskeyCreationOptionsV1(raw, expectedWalletAuthMethodId) {
-	const label = "LinkedDeviceTargetPreparationV1.passkeyCreationOptions";
+function parseLinkedDevicePasskeyCreationOptionsV1(raw, label) {
 	const record = exactRecord(raw, [
 		"kind",
 		"walletAuthMethodId",
@@ -687,8 +433,7 @@ function parseLinkedDevicePasskeyCreationOptionsV1(raw, expectedWalletAuthMethod
 		"extensions",
 		"excludeCredentials"
 	], label);
-	const walletAuthMethodId = parseId(parseWalletAuthMethodId, record.walletAuthMethodId, `${label}.walletAuthMethodId`);
-	if (walletAuthMethodId !== expectedWalletAuthMethodId) throw new Error(`${label}.walletAuthMethodId must match the preparation`);
+	const methodId = walletAuthMethodId(record.walletAuthMethodId, `${label}.walletAuthMethodId`);
 	exactRecord(record.user, [
 		"idB64u",
 		"name",
@@ -707,7 +452,7 @@ function parseLinkedDevicePasskeyCreationOptionsV1(raw, expectedWalletAuthMethod
 	const options = parseWalletAddAuthMethodRegistrationOptions(record);
 	return {
 		kind: options.kind,
-		walletAuthMethodId,
+		walletAuthMethodId: methodId,
 		challengeId: options.challengeId,
 		challengeB64u: options.challengeB64u,
 		rpId: options.rpId,
@@ -720,448 +465,311 @@ function parseLinkedDevicePasskeyCreationOptionsV1(raw, expectedWalletAuthMethod
 		excludeCredentials: options.excludeCredentials
 	};
 }
-function parseLinkedDeviceEd25519ExportRootPreparationV1(raw) {
-	if (raw === null) return null;
-	const record = exactRecord(raw, [
-		"kind",
-		"walletKeyId",
-		"applicationBindingDigestB64u",
-		"registeredPublicKeyB64u",
-		"revocationEpoch"
-	], "LinkedDeviceTargetPreparationV1.ed25519ExportRoot");
-	if (record.kind !== "linked_device_ed25519_export_root_preparation_v1") throw new Error("LinkedDeviceTargetPreparationV1.ed25519ExportRoot.kind is invalid");
-	return {
-		kind: "linked_device_ed25519_export_root_preparation_v1",
-		walletKeyId: parseWalletKey(record.walletKeyId, "LinkedDeviceTargetPreparationV1.ed25519ExportRoot.walletKeyId"),
-		applicationBindingDigestB64u: parseDigest(record.applicationBindingDigestB64u, "LinkedDeviceTargetPreparationV1.ed25519ExportRoot.applicationBindingDigestB64u"),
-		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "LinkedDeviceTargetPreparationV1.ed25519ExportRoot.registeredPublicKeyB64u"),
-		revocationEpoch: parseNonNegativeSafeInteger(record.revocationEpoch, "LinkedDeviceTargetPreparationV1.ed25519ExportRoot.revocationEpoch")
-	};
+function ed25519ExportRootPreparationV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_ed25519_export_root_preparation_v1"),
+		walletKeyId,
+		applicationBindingDigestB64u: digest,
+		registeredPublicKeyB64u: parseEd25519PublicKeyB64u,
+		revocationEpoch: parseNonNegativeSafeInteger
+	});
 }
-function parseOrdinarySignerMaterialRecipientRequirementV1(raw, index) {
-	const label = `LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements[${index}]`;
-	const record = exactRecord(raw, [
-		"kind",
-		"keyFamily",
-		"walletKeyId"
-	], label);
-	if (record.kind !== "ordinary_signer_material_recipient_requirement_v1") throw new Error(`${label}.kind is invalid`);
-	return {
-		kind: "ordinary_signer_material_recipient_requirement_v1",
-		keyFamily: parseKeyFamily(record.keyFamily, `${label}.keyFamily`),
-		walletKeyId: parseId(parseWalletKeyId, record.walletKeyId, `${label}.walletKeyId`)
-	};
+function parseKeyFamilyEntries(raw, item, label) {
+	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 2) throw new Error(`${label} must contain one or two entries`);
+	const entries = raw.map((entry, index) => item(entry, `${label}[${index}]`));
+	if (new Set(entries.map((entry) => entry.keyFamily)).size !== entries.length) throw new Error(`${label} repeats a key family`);
+	if (new Set(entries.map((entry) => String(entry.walletKeyId))).size !== entries.length) throw new Error(`${label} repeats a wallet key`);
+	if (entries.length === 2 && (entries[0]?.keyFamily !== "ed25519" || entries[1]?.keyFamily !== "ecdsa_secp256k1")) throw new Error(`${label} must be ordered Ed25519 then ECDSA`);
+	return entries;
+}
+function recipientRequirementV1() {
+	return wireObject({
+		kind: wireLiteral("ordinary_signer_material_recipient_requirement_v1"),
+		keyFamily: parseKeyFamily,
+		walletKeyId
+	});
 }
-function parseOrdinarySignerMaterialRecipientRequirementsV1(raw) {
-	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 2) throw new Error("LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements must contain one or two entries");
-	const requirements = raw.map((entry, index) => parseOrdinarySignerMaterialRecipientRequirementV1(entry, index));
-	if (new Set(requirements.map((entry) => entry.keyFamily)).size !== requirements.length) throw new Error("LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements repeats a key family");
-	if (new Set(requirements.map((entry) => String(entry.walletKeyId))).size !== requirements.length) throw new Error("LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements repeats a wallet key");
-	if (requirements.length === 2 && (requirements[0]?.keyFamily !== "ed25519" || requirements[1]?.keyFamily !== "ecdsa_secp256k1")) throw new Error("LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements must be ordered Ed25519 then ECDSA");
+function parseRecipientRequirements(raw) {
+	const requirements = parseKeyFamilyEntries(raw, recipientRequirementV1(), "LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements");
 	const first = requirements[0];
 	if (!first) throw new Error("ordinary signer material recipient requirements are empty");
 	return [first, ...requirements.slice(1)];
 }
-function parseWebAuthnTransport(raw, label) {
-	switch (raw) {
-		case "ble":
-		case "cable":
-		case "hybrid":
-		case "internal":
-		case "nfc":
-		case "smart-card":
-		case "usb": return raw;
-		default: throw new Error(`${label} is invalid`);
-	}
-}
-function parseLinkedDeviceWebAuthnRegistrationV1(raw) {
-	const label = "LinkedDeviceTargetCredentialRegistrationV1.webauthnRegistration";
-	const record = exactRecord(raw, WEBAUTHN_REGISTRATION_FIELDS, label);
-	if (record.kind !== "linked_device_webauthn_registration_v1") throw new Error(`${label}.kind is invalid`);
-	if (!Array.isArray(record.transports)) throw new Error(`${label}.transports must be an array`);
-	if (record.authenticatorAttachment !== null && record.authenticatorAttachment !== "platform" && record.authenticatorAttachment !== "cross-platform") throw new Error(`${label}.authenticatorAttachment is invalid`);
-	const transports = record.transports.map((entry, index) => parseWebAuthnTransport(entry, `${label}.transports[${index}]`));
-	if (new Set(transports).size !== transports.length) throw new Error(`${label}.transports contains duplicates`);
-	return {
-		kind: "linked_device_webauthn_registration_v1",
-		credentialIdB64u: parseCredential(record.credentialIdB64u, `${label}.credentialIdB64u`),
-		authenticatorAttachment: record.authenticatorAttachment,
-		clientDataJsonB64u: parseCanonicalBase64UrlBytes(record.clientDataJsonB64u, `${label}.clientDataJsonB64u`),
-		attestationObjectB64u: parseCanonicalBase64UrlBytes(record.attestationObjectB64u, `${label}.attestationObjectB64u`),
-		transports
-	};
-}
-function parseOrdinarySignerMaterialPreparationsV1(raw) {
-	return parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1(raw);
+const webAuthnTransport = /* @__PURE__ */ wireLiteral("ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb");
+function parseWebAuthnTransports(raw, label) {
+	const transports = requireArray(raw, label).map((entry, index) => webAuthnTransport(entry, `${label}[${index}]`));
+	if (new Set(transports).size !== transports.length) throw new Error(`${label} contains duplicates`);
+	return transports;
+}
+function linkedDeviceWebAuthnRegistrationV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_webauthn_registration_v1"),
+		credentialIdB64u: parseCredential,
+		authenticatorAttachment: wireNullable(wireLiteral("platform", "cross-platform")),
+		clientDataJsonB64u: parseCanonicalBase64UrlBytes,
+		attestationObjectB64u: parseCanonicalBase64UrlBytes,
+		transports: parseWebAuthnTransports
+	});
 }
-function parseOrdinarySignerMaterialRecipientRequestV1(raw, index) {
-	const label = `LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests[${index}]`;
-	const record = requireRecord(raw, label);
-	if (record.kind === "ordinary_ed25519_signer_material_recipient_request_v1") {
-		exactRecord(record, [
-			"kind",
-			"keyFamily",
-			"walletKeyId",
-			"recipientPublicKeyB64u"
-		], label);
-		if (record.keyFamily !== "ed25519") throw new Error(`${label}.keyFamily does not match its kind`);
-		return {
-			kind: record.kind,
-			keyFamily: "ed25519",
-			walletKeyId: parseId(parseWalletKeyId, record.walletKeyId, `${label}.walletKeyId`),
-			recipientPublicKeyB64u: parseCanonicalFixedBase64UrlBytes(record.recipientPublicKeyB64u, 32, `${label}.recipientPublicKeyB64u`)
-		};
-	}
-	if (record.kind === "ordinary_ecdsa_signer_material_recipient_request_v1") {
-		exactRecord(record, [
-			"kind",
-			"keyFamily",
-			"walletKeyId",
-			"clientEphemeralPublicKey"
-		], label);
-		if (record.keyFamily !== "ecdsa_secp256k1") throw new Error(`${label}.keyFamily does not match its kind`);
-		return {
-			kind: record.kind,
-			keyFamily: "ecdsa_secp256k1",
-			walletKeyId: parseId(parseWalletKeyId, record.walletKeyId, `${label}.walletKeyId`),
-			clientEphemeralPublicKey: requireRouterAbX25519PublicKey(record.clientEphemeralPublicKey, `${label}.clientEphemeralPublicKey`)
-		};
-	}
-	throw new Error(`${label}.kind is invalid`);
-}
-function parseOrdinarySignerMaterialRecipientRequestsV1(raw) {
-	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 2) throw new Error("LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests must contain one or two entries");
-	const requests = raw.map((entry, index) => parseOrdinarySignerMaterialRecipientRequestV1(entry, index));
-	const families = requests.map((entry) => entry.keyFamily);
-	if (new Set(families).size !== families.length) throw new Error("LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests repeats a key family");
-	if (new Set(requests.map((entry) => String(entry.walletKeyId))).size !== requests.length) throw new Error("LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests repeats a wallet key");
-	if (requests.length === 2 && (requests[0]?.keyFamily !== "ed25519" || requests[1]?.keyFamily !== "ecdsa_secp256k1")) throw new Error("LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests must be ordered Ed25519 then ECDSA");
+function recipientRequestV1() {
+	const keyFamily = (family) => (raw, label) => {
+		if (raw !== family) throw new Error(`${label} does not match its kind`);
+		return family;
+	};
+	return wireUnion("kind", [wireObject({
+		kind: wireLiteral("ordinary_ed25519_signer_material_recipient_request_v1"),
+		keyFamily: keyFamily("ed25519"),
+		walletKeyId,
+		recipientPublicKeyB64u: (raw, label) => parseCanonicalFixedBase64UrlBytes(raw, 32, label)
+	}), wireObject({
+		kind: wireLiteral("ordinary_ecdsa_signer_material_recipient_request_v1"),
+		keyFamily: keyFamily("ecdsa_secp256k1"),
+		walletKeyId,
+		clientEphemeralPublicKey: requireRouterAbX25519PublicKey
+	})]);
+}
+function parseRecipientRequests(raw) {
+	const requests = parseKeyFamilyEntries(raw, recipientRequestV1(), "LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests");
 	const first = requests[0];
 	if (!first) throw new Error("ordinary signer material recipient requests are empty");
 	return [first, ...requests.slice(1)];
 }
-function parseLinkedDeviceTargetCredentialRegistrationV1(raw) {
-	const initial = requireRecord(raw, "LinkedDeviceTargetCredentialRegistrationV1");
-	const targetFactor = parseTargetFactor(initial.targetFactor, "LinkedDeviceTargetCredentialRegistrationV1.targetFactor");
-	const emailGrant = targetFactor.kind === "email_otp" ? parseLinkedDeviceEmailOtpVerificationGrantV1(initial.emailOtpVerificationGrant) : null;
-	const record = exactRecord(initial, targetFactor.kind === "passkey_prf" ? PASSKEY_CREDENTIAL_FIELDS : emailGrant?.enrollment.kind === "new_enrollment" ? EMAIL_OTP_CREDENTIAL_NEW_FIELDS : EMAIL_OTP_CREDENTIAL_FIELDS, "LinkedDeviceTargetCredentialRegistrationV1");
-	if (record.kind !== "linked_device_target_credential_registration_v1") throw new Error("LinkedDeviceTargetCredentialRegistrationV1.kind is invalid");
-	if (targetFactor.kind === "email_otp" && !emailGrant) throw new Error("Email OTP target credential grant is missing");
-	const linkSessionId = parseSessionId(record.linkSessionId, "LinkedDeviceTargetCredentialRegistrationV1.linkSessionId");
-	const walletId = parseWallet(record.walletId, "LinkedDeviceTargetCredentialRegistrationV1.walletId");
-	const enrollmentId = parseEnrollmentId(record.enrollmentId, "LinkedDeviceTargetCredentialRegistrationV1.enrollmentId");
-	const deviceId = parseDeviceId(record.deviceId, "LinkedDeviceTargetCredentialRegistrationV1.deviceId");
-	const walletAuthMethodId = parseWalletAuthMethodId(record.walletAuthMethodId);
-	if (!walletAuthMethodId.ok) throw new Error(`LinkedDeviceTargetCredentialRegistrationV1.walletAuthMethodId ${walletAuthMethodId.error.message}`);
-	const targetPreparationDigestB64u = parseDigest(record.targetPreparationDigestB64u, "LinkedDeviceTargetCredentialRegistrationV1.targetPreparationDigestB64u");
-	const ordinarySignerMaterialRecipientRequests = parseOrdinarySignerMaterialRecipientRequestsV1(record.ordinarySignerMaterialRecipientRequests);
-	const registeredAtMs = parseUnixTime(record.registeredAtMs, "LinkedDeviceTargetCredentialRegistrationV1.registeredAtMs");
-	if (targetFactor.kind === "passkey_prf") return {
-		kind: "linked_device_target_credential_registration_v1",
-		linkSessionId,
-		walletId,
-		enrollmentId,
-		deviceId,
-		walletAuthMethodId: walletAuthMethodId.value,
-		targetFactor,
-		targetPreparationDigestB64u,
-		ordinarySignerMaterialRecipientRequests,
-		webauthnRegistration: parseLinkedDeviceWebAuthnRegistrationV1(record.webauthnRegistration),
-		registeredAtMs
-	};
-	if (!emailGrant) throw new Error("Email OTP target credential grant is missing");
-	const targetEmail = parseTargetEmail(record.targetEmail, "LinkedDeviceTargetCredentialRegistrationV1.targetEmail");
-	if (emailGrant.enrollment.kind === "new_enrollment") return {
-		kind: "linked_device_target_credential_registration_v1",
-		linkSessionId,
-		walletId,
-		enrollmentId,
-		deviceId,
-		walletAuthMethodId: walletAuthMethodId.value,
-		targetFactor,
-		targetEmail,
-		targetPreparationDigestB64u,
-		ordinarySignerMaterialRecipientRequests,
-		emailOtpVerificationGrant: emailGrant,
-		emailOtpEnrollment: parseEmailOtpEnrollmentMaterial(record.emailOtpEnrollment, "LinkedDeviceTargetCredentialRegistrationV1.emailOtpEnrollment"),
-		registeredAtMs
-	};
+function targetCredentialRegistrationIdentity() {
 	return {
-		kind: "linked_device_target_credential_registration_v1",
-		linkSessionId,
+		kind: wireLiteral("linked_device_target_credential_registration_v1"),
+		linkSessionId: sessionId,
 		walletId,
 		enrollmentId,
-		deviceId,
-		walletAuthMethodId: walletAuthMethodId.value,
-		targetFactor,
-		targetEmail,
-		targetPreparationDigestB64u,
-		ordinarySignerMaterialRecipientRequests,
-		emailOtpVerificationGrant: emailGrant,
-		registeredAtMs
-	};
+		deviceId: linkedDeviceId,
+		walletAuthMethodId
+	};
+}
+function passkeyTargetCredentialRegistrationV1() {
+	return wireObject({
+		...targetCredentialRegistrationIdentity(),
+		targetFactor: passkeyTargetFactorV1(),
+		targetPreparationDigestB64u: digest,
+		ordinarySignerMaterialRecipientRequests: parseRecipientRequests,
+		webauthnRegistration: linkedDeviceWebAuthnRegistrationV1(),
+		registeredAtMs: parseUnixTime
+	});
 }
-function parseLinkedDeviceTargetCredentialRegistrationResultV1(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"outcome",
-		"linkSessionId",
-		"walletId",
-		"enrollmentId",
-		"deviceId",
-		"walletAuthMethodId",
-		"targetPreparationDigestB64u",
-		"targetFactor",
-		"ordinarySignerMaterialPreparations",
-		"ordinarySignerMaterialRecipientRequests",
-		"keyManifestDigestB64u"
-	], "LinkedDeviceTargetCredentialRegistrationResultV1");
-	if (record.kind !== "linked_device_target_credential_registration_result_v1") throw new Error("LinkedDeviceTargetCredentialRegistrationResultV1.kind is invalid");
-	if (record.outcome !== "applied" && record.outcome !== "replayed") throw new Error("LinkedDeviceTargetCredentialRegistrationResultV1.outcome is invalid");
-	const linkSessionId = parseSessionId(record.linkSessionId, "LinkedDeviceTargetCredentialRegistrationResultV1.linkSessionId");
-	const walletId = parseWallet(record.walletId, "LinkedDeviceTargetCredentialRegistrationResultV1.walletId");
-	const enrollmentId = parseEnrollmentId(record.enrollmentId, "LinkedDeviceTargetCredentialRegistrationResultV1.enrollmentId");
-	const deviceId = parseDeviceId(record.deviceId, "LinkedDeviceTargetCredentialRegistrationResultV1.deviceId");
-	const walletAuthMethodId = parseId(parseWalletAuthMethodId, record.walletAuthMethodId, "LinkedDeviceTargetCredentialRegistrationResultV1.walletAuthMethodId");
-	const targetPreparationDigestB64u = parseDigest(record.targetPreparationDigestB64u, "LinkedDeviceTargetCredentialRegistrationResultV1.targetPreparationDigestB64u");
-	const targetFactor = parseVerifiedTargetFactorV1(record.targetFactor, "LinkedDeviceTargetCredentialRegistrationResultV1.targetFactor");
-	if (targetFactor.authMethod.walletAuthMethodId !== walletAuthMethodId || targetFactor.authMethod.walletId !== walletId) throw new Error("LinkedDeviceTargetCredentialRegistrationResultV1 target identity differs");
-	const ordinarySignerMaterialPreparations = parseOrdinarySignerMaterialPreparationsV1(record.ordinarySignerMaterialPreparations);
-	const ordinarySignerMaterialRecipientRequests = parseOrdinarySignerMaterialRecipientRequestsV1(record.ordinarySignerMaterialRecipientRequests);
-	return {
-		kind: "linked_device_target_credential_registration_result_v1",
-		outcome: record.outcome,
-		linkSessionId,
+function emailOtpTargetCredentialRegistrationV1() {
+	return wireObject({
+		...targetCredentialRegistrationIdentity(),
+		targetFactor: emailOtpTargetFactorV1(),
+		targetEmail: parseTargetEmail,
+		targetPreparationDigestB64u: digest,
+		ordinarySignerMaterialRecipientRequests: parseRecipientRequests,
+		emailOtpVerificationGrant: parseLinkedDeviceEmailOtpVerificationGrantV1,
+		registeredAtMs: parseUnixTime
+	});
+}
+function newEmailOtpTargetCredentialRegistrationV1() {
+	return wireObject({
+		...targetCredentialRegistrationIdentity(),
+		targetFactor: emailOtpTargetFactorV1(),
+		targetEmail: parseTargetEmail,
+		targetPreparationDigestB64u: digest,
+		ordinarySignerMaterialRecipientRequests: parseRecipientRequests,
+		emailOtpVerificationGrant: parseLinkedDeviceEmailOtpVerificationGrantV1,
+		emailOtpEnrollment: emailOtpEnrollmentMaterialV1(),
+		registeredAtMs: parseUnixTime
+	});
+}
+function parseLinkedDeviceTargetCredentialRegistrationV1(raw) {
+	const label = "LinkedDeviceTargetCredentialRegistrationV1";
+	const record = requireRecord(raw, label);
+	if (parseTargetFactor(record.targetFactor, `${label}.targetFactor`).kind === "passkey_prf") return passkeyTargetCredentialRegistrationV1()(record, label);
+	return (parseLinkedDeviceEmailOtpVerificationGrantV1(record.emailOtpVerificationGrant).enrollment.kind === "new_enrollment" ? newEmailOtpTargetCredentialRegistrationV1() : emailOtpTargetCredentialRegistrationV1())(record, label);
+}
+function targetCredentialRegistrationResultV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_target_credential_registration_result_v1"),
+		outcome: wireLiteral("applied", "replayed"),
+		linkSessionId: sessionId,
 		walletId,
 		enrollmentId,
-		deviceId,
+		deviceId: linkedDeviceId,
 		walletAuthMethodId,
-		targetPreparationDigestB64u,
-		targetFactor,
-		ordinarySignerMaterialPreparations,
-		ordinarySignerMaterialRecipientRequests,
-		keyManifestDigestB64u: parseDigest(record.keyManifestDigestB64u, "LinkedDeviceTargetCredentialRegistrationResultV1.keyManifestDigestB64u")
-	};
+		targetPreparationDigestB64u: digest,
+		targetFactor: parseVerifiedTargetFactorV1,
+		ordinarySignerMaterialPreparations: parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1,
+		ordinarySignerMaterialRecipientRequests: parseRecipientRequests,
+		keyManifestDigestB64u: digest
+	}, (result, label) => {
+		const { authMethod } = result.targetFactor;
+		if (authMethod.walletAuthMethodId !== result.walletAuthMethodId || authMethod.walletId !== result.walletId) throw new Error(`${label} target identity differs`);
+	});
+}
+function parseLinkedDeviceTargetCredentialRegistrationResultV1(raw) {
+	return targetCredentialRegistrationResultV1()(raw, "LinkedDeviceTargetCredentialRegistrationResultV1");
+}
+function verifiedAfterCreation(target, label) {
+	if (target.verifiedAtMs < target.authMethod.createdAtMs) throw new Error(`${label}.verifiedAtMs precedes authMethod.createdAtMs`);
+}
+function verifiedPasskeyTargetV1() {
+	return wireObject({
+		kind: wireLiteral("verified_passkey_target_v1"),
+		authMethod: parsePasskeyWalletAuthMethodDraftV1,
+		verificationDigestB64u: digest,
+		verifiedAtMs: parseUnixTime
+	}, verifiedAfterCreation);
+}
+function verifiedEmailOtpTargetV1() {
+	return wireObject({
+		kind: wireLiteral("verified_email_otp_target_v1"),
+		authMethod: parseEmailOtpWalletAuthMethodDraftV1,
+		targetEmail: parseTargetEmail,
+		enrollment: existingEnrollmentV1(),
+		baseWalletAuthMethodId: walletAuthMethodId,
+		providerUserId: parseNonEmptyToken,
+		verificationDigestB64u: digest,
+		verifiedAtMs: parseUnixTime
+	}, verifiedAfterCreation);
+}
+function verifiedNewEmailOtpTargetV1() {
+	return wireObject({
+		kind: wireLiteral("verified_email_otp_target_v1"),
+		authMethod: parseEmailOtpWalletAuthMethodDraftV1,
+		targetEmail: parseTargetEmail,
+		enrollment: newEnrollmentV1(),
+		providerUserId: parseNonEmptyToken,
+		verificationDigestB64u: digest,
+		verifiedAtMs: parseUnixTime
+	}, verifiedAfterCreation);
 }
 function parseVerifiedTargetFactorV1(raw, label) {
 	const record = requireRecord(raw, label);
-	if (record.kind === "verified_passkey_target_v1") {
-		exactRecord(record, [
-			"kind",
-			"authMethod",
-			"verificationDigestB64u",
-			"verifiedAtMs"
-		], label);
-		const authMethod = parsePasskeyWalletAuthMethodDraftV1(record.authMethod, `${label}.authMethod`);
-		const verifiedAtMs = parseUnixTime(record.verifiedAtMs, `${label}.verifiedAtMs`);
-		if (verifiedAtMs < authMethod.createdAtMs) throw new Error(`${label}.verifiedAtMs precedes authMethod.createdAtMs`);
-		return {
-			kind: "verified_passkey_target_v1",
-			authMethod,
-			verificationDigestB64u: parseDigest(record.verificationDigestB64u, `${label}.verificationDigestB64u`),
-			verifiedAtMs
-		};
-	}
-	if (record.kind === "verified_email_otp_target_v1") {
-		const enrollment = parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`);
-		const exact = exactRecord(record, enrollment.kind === "existing_enrollment" ? [
-			"kind",
-			"authMethod",
-			"targetEmail",
-			"enrollment",
-			"baseWalletAuthMethodId",
-			"providerUserId",
-			"verificationDigestB64u",
-			"verifiedAtMs"
-		] : [
-			"kind",
-			"authMethod",
-			"targetEmail",
-			"enrollment",
-			"providerUserId",
-			"verificationDigestB64u",
-			"verifiedAtMs"
-		], label);
-		const authMethod = parseEmailOtpWalletAuthMethodDraftV1(record.authMethod, `${label}.authMethod`);
-		const verifiedAtMs = parseUnixTime(record.verifiedAtMs, `${label}.verifiedAtMs`);
-		if (verifiedAtMs < authMethod.createdAtMs) throw new Error(`${label}.verifiedAtMs precedes authMethod.createdAtMs`);
-		const targetEmail = parseTargetEmail(record.targetEmail, `${label}.targetEmail`);
-		const providerUserId = parseNonEmptyToken(record.providerUserId, `${label}.providerUserId`);
-		const verificationDigestB64u = parseDigest(record.verificationDigestB64u, `${label}.verificationDigestB64u`);
-		if (enrollment.kind === "existing_enrollment") return {
-			kind: "verified_email_otp_target_v1",
-			authMethod,
-			targetEmail,
-			enrollment,
-			baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, exact.baseWalletAuthMethodId, `${label}.baseWalletAuthMethodId`),
-			providerUserId,
-			verificationDigestB64u,
-			verifiedAtMs
-		};
-		return {
-			kind: "verified_email_otp_target_v1",
-			authMethod,
-			targetEmail,
-			enrollment,
-			providerUserId,
-			verificationDigestB64u,
-			verifiedAtMs
-		};
-	}
-	throw new Error(`${label}.kind is invalid`);
+	if (record.kind === "verified_passkey_target_v1") return verifiedPasskeyTargetV1()(record, label);
+	if (record.kind !== "verified_email_otp_target_v1") throw new Error(`${label}.kind is invalid`);
+	return (parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`).kind === "existing_enrollment" ? verifiedEmailOtpTargetV1() : verifiedNewEmailOtpTargetV1())(record, label);
+}
+function passkeyWalletAuthMethodDraftV1() {
+	return wireObject({
+		walletAuthMethodId,
+		walletId,
+		createdAtMs: parseUnixTime,
+		kind: wireLiteral("passkey"),
+		rpId,
+		credentialIdB64u: credentialId,
+		credentialPublicKeyB64u: parseCanonicalBase64UrlBytes,
+		counter: parseNonNegativeSafeInteger
+	});
 }
 function parsePasskeyWalletAuthMethodDraftV1(raw, label) {
-	const record = exactRecord(raw, [
-		"walletAuthMethodId",
-		"walletId",
-		"createdAtMs",
-		"kind",
-		"rpId",
-		"credentialIdB64u",
-		"credentialPublicKeyB64u",
-		"counter"
-	], label);
-	if (record.kind !== "passkey") throw new Error(`${label}.kind is invalid`);
-	return {
-		walletAuthMethodId: parseId(parseWalletAuthMethodId, record.walletAuthMethodId, `${label}.walletAuthMethodId`),
-		walletId: parseWallet(record.walletId, `${label}.walletId`),
-		createdAtMs: parseUnixTime(record.createdAtMs, `${label}.createdAtMs`),
-		kind: "passkey",
-		rpId: parseId(parseWebAuthnRpId, record.rpId, `${label}.rpId`),
-		credentialIdB64u: parseId(parseWebAuthnCredentialIdB64u, record.credentialIdB64u, `${label}.credentialIdB64u`),
-		credentialPublicKeyB64u: parseCanonicalBase64UrlBytes(record.credentialPublicKeyB64u, `${label}.credentialPublicKeyB64u`),
-		counter: parseNonNegativeInteger(record.counter, `${label}.counter`)
-	};
+	return passkeyWalletAuthMethodDraftV1()(raw, label);
+}
+function emailOtpWalletAuthMethodDraftV1() {
+	return wireObject({
+		walletAuthMethodId,
+		walletId,
+		createdAtMs: parseUnixTime,
+		kind: wireLiteral("email_otp"),
+		emailHashHex: parseEmailHashHex,
+		registrationAuthorityId: parseNonEmptyToken
+	});
 }
 function parseEmailOtpWalletAuthMethodDraftV1(raw, label) {
-	const record = exactRecord(raw, [
-		"walletAuthMethodId",
-		"walletId",
-		"createdAtMs",
-		"kind",
-		"emailHashHex",
-		"registrationAuthorityId"
-	], label);
-	if (record.kind !== "email_otp") throw new Error(`${label}.kind is invalid`);
+	return emailOtpWalletAuthMethodDraftV1()(raw, label);
+}
+function emailOtpVerificationGrantFields(enrollment) {
 	return {
-		walletAuthMethodId: parseId(parseWalletAuthMethodId, record.walletAuthMethodId, `${label}.walletAuthMethodId`),
-		walletId: parseWallet(record.walletId, `${label}.walletId`),
-		createdAtMs: parseUnixTime(record.createdAtMs, `${label}.createdAtMs`),
-		kind: "email_otp",
-		emailHashHex: parseEmailHashHex(record.emailHashHex, `${label}.emailHashHex`),
-		registrationAuthorityId: parseNonEmptyToken(record.registrationAuthorityId, `${label}.registrationAuthorityId`)
+		kind: wireLiteral("linked_device_email_otp_verification_grant_v1"),
+		grantId: parseNonEmptyToken,
+		grantToken: parseNonEmptyToken,
+		challengeId: parseNonEmptyToken,
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		targetPreparationDigestB64u: digest,
+		targetEmail: parseTargetEmail,
+		enrollment,
+		emailHashHex: parseEmailHashHex,
+		registrationAuthorityId: parseNonEmptyToken,
+		providerUserId: parseNonEmptyToken,
+		authorityDigestB64u: digest,
+		issuedAtMs: parseUnixTime,
+		expiresAtMs: parseUnixTime
 	};
 }
+function grantIssuedBeforeExpiry(grant, label) {
+	assertExpiryAfterIssued(grant.issuedAtMs, grant.expiresAtMs, label);
+}
+function emailOtpVerificationGrantV1() {
+	return wireObject({
+		...emailOtpVerificationGrantFields(existingEnrollmentV1()),
+		baseWalletAuthMethodId: walletAuthMethodId
+	}, grantIssuedBeforeExpiry);
+}
+function newEnrollmentEmailOtpVerificationGrantV1() {
+	return wireObject(emailOtpVerificationGrantFields(newEnrollmentV1()), grantIssuedBeforeExpiry);
+}
 function parseLinkedDeviceEmailOtpVerificationGrantV1(raw) {
-	const candidate = requireRecord(raw, "LinkedDeviceEmailOtpVerificationGrantV1");
-	const enrollment = parseEmailOtpEnrollmentSelection(candidate.enrollment, "LinkedDeviceEmailOtpVerificationGrantV1.enrollment");
-	const record = exactRecord(candidate, enrollment.kind === "new_enrollment" ? EMAIL_OTP_VERIFICATION_GRANT_BASE_FIELDS : EMAIL_OTP_VERIFICATION_GRANT_FIELDS, "LinkedDeviceEmailOtpVerificationGrantV1");
-	if (record.kind !== "linked_device_email_otp_verification_grant_v1") throw new Error("LinkedDeviceEmailOtpVerificationGrantV1.kind is invalid");
-	const issuedAtMs = parseUnixTime(record.issuedAtMs, "LinkedDeviceEmailOtpVerificationGrantV1.issuedAtMs");
-	const expiresAtMs = parseUnixTime(record.expiresAtMs, "LinkedDeviceEmailOtpVerificationGrantV1.expiresAtMs");
-	assertExpiryAfterIssued(issuedAtMs, expiresAtMs, "LinkedDeviceEmailOtpVerificationGrantV1");
-	const base = {
-		kind: "linked_device_email_otp_verification_grant_v1",
-		grantId: parseNonEmptyToken(record.grantId, "LinkedDeviceEmailOtpVerificationGrantV1.grantId"),
-		grantToken: parseNonEmptyToken(record.grantToken, "LinkedDeviceEmailOtpVerificationGrantV1.grantToken"),
-		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpVerificationGrantV1.challengeId"),
-		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "LinkedDeviceEmailOtpVerificationGrantV1.linkSessionId"),
-		walletId: parseId(parseWalletId, record.walletId, "LinkedDeviceEmailOtpVerificationGrantV1.walletId"),
-		enrollmentId: parseId(parseLinkedDeviceEnrollmentId, record.enrollmentId, "LinkedDeviceEmailOtpVerificationGrantV1.enrollmentId"),
-		deviceId: parseId(parseLinkedDeviceId, record.deviceId, "LinkedDeviceEmailOtpVerificationGrantV1.deviceId"),
-		targetPreparationDigestB64u: parseDigest(record.targetPreparationDigestB64u, "LinkedDeviceEmailOtpVerificationGrantV1.targetPreparationDigestB64u"),
-		targetEmail: parseTargetEmail(record.targetEmail, "LinkedDeviceEmailOtpVerificationGrantV1.targetEmail"),
-		enrollment,
-		emailHashHex: parseEmailHashHex(record.emailHashHex, "LinkedDeviceEmailOtpVerificationGrantV1.emailHashHex"),
-		registrationAuthorityId: parseNonEmptyToken(record.registrationAuthorityId, "LinkedDeviceEmailOtpVerificationGrantV1.registrationAuthorityId"),
-		providerUserId: parseNonEmptyToken(record.providerUserId, "LinkedDeviceEmailOtpVerificationGrantV1.providerUserId"),
-		authorityDigestB64u: parseDigest(record.authorityDigestB64u, "LinkedDeviceEmailOtpVerificationGrantV1.authorityDigestB64u"),
-		issuedAtMs,
-		expiresAtMs
-	};
-	if (enrollment.kind === "new_enrollment") return {
-		...base,
-		enrollment: { kind: "new_enrollment" }
-	};
-	return {
-		...base,
-		enrollment: { kind: "existing_enrollment" },
-		baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, record.baseWalletAuthMethodId, "LinkedDeviceEmailOtpVerificationGrantV1.baseWalletAuthMethodId")
-	};
+	const label = "LinkedDeviceEmailOtpVerificationGrantV1";
+	const record = requireRecord(raw, label);
+	return (parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`).kind === "new_enrollment" ? newEnrollmentEmailOtpVerificationGrantV1() : emailOtpVerificationGrantV1())(record, label);
+}
+function emailOtpFactorReleaseEnvelopeV1() {
+	return wireObject({
+		kind: wireLiteral("email_otp_factor_release_v1"),
+		challengeId: parseNonEmptyToken,
+		enrollmentId: parseNonEmptyToken,
+		enrollmentSealKeyVersion: parseNonEmptyToken,
+		serverEphemeralPublicKey65B64u: parseUncompressedP256PointB64u,
+		nonce12B64u: (raw, label) => parseCanonicalFixedBase64UrlBytes(raw, 12, label),
+		ciphertextB64u: parseCanonicalBase64UrlBytes
+	});
 }
 function parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1(raw) {
-	const record = exactRecord(raw, EMAIL_OTP_FACTOR_RELEASE_FIELDS, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1");
-	if (record.kind !== "email_otp_factor_release_v1") throw new Error("LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.kind is invalid");
-	return {
-		kind: "email_otp_factor_release_v1",
-		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.challengeId"),
-		enrollmentId: parseNonEmptyToken(record.enrollmentId, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.enrollmentId"),
-		enrollmentSealKeyVersion: parseNonEmptyToken(record.enrollmentSealKeyVersion, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.enrollmentSealKeyVersion"),
-		serverEphemeralPublicKey65B64u: parseUncompressedP256PointB64u(record.serverEphemeralPublicKey65B64u, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.serverEphemeralPublicKey65B64u"),
-		nonce12B64u: parseCanonicalFixedBase64UrlBytes(record.nonce12B64u, 12, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.nonce12B64u"),
-		ciphertextB64u: parseCanonicalBase64UrlBytes(record.ciphertextB64u, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.ciphertextB64u")
-	};
+	return emailOtpFactorReleaseEnvelopeV1()(raw, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1");
+}
+function emailOtpChallengeStartRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_email_otp_challenge_start_request_v1"),
+		linkSessionId: sessionId,
+		workerEphemeralPublicKey65B64u: parseUncompressedP256PointB64u
+	});
 }
 function parseLinkedDeviceEmailOtpChallengeStartRequestV1(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"linkSessionId",
-		"workerEphemeralPublicKey65B64u"
-	], "LinkedDeviceEmailOtpChallengeStartRequestV1");
-	if (record.kind !== "linked_device_email_otp_challenge_start_request_v1") throw new Error("LinkedDeviceEmailOtpChallengeStartRequestV1.kind is invalid");
-	return {
-		kind: "linked_device_email_otp_challenge_start_request_v1",
-		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "LinkedDeviceEmailOtpChallengeStartRequestV1.linkSessionId"),
-		workerEphemeralPublicKey65B64u: parseUncompressedP256PointB64u(record.workerEphemeralPublicKey65B64u, "LinkedDeviceEmailOtpChallengeStartRequestV1.workerEphemeralPublicKey65B64u")
-	};
+	return emailOtpChallengeStartRequestV1()(raw, "LinkedDeviceEmailOtpChallengeStartRequestV1");
+}
+function emailOtpChallengeResendRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_email_otp_challenge_resend_request_v1"),
+		linkSessionId: sessionId,
+		challengeId: parseNonEmptyToken
+	});
 }
 function parseLinkedDeviceEmailOtpChallengeResendRequestV1(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"linkSessionId",
-		"challengeId"
-	], "LinkedDeviceEmailOtpChallengeResendRequestV1");
-	if (record.kind !== "linked_device_email_otp_challenge_resend_request_v1") throw new Error("LinkedDeviceEmailOtpChallengeResendRequestV1.kind is invalid");
-	return {
-		kind: "linked_device_email_otp_challenge_resend_request_v1",
-		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "LinkedDeviceEmailOtpChallengeResendRequestV1.linkSessionId"),
-		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpChallengeResendRequestV1.challengeId")
-	};
+	return emailOtpChallengeResendRequestV1()(raw, "LinkedDeviceEmailOtpChallengeResendRequestV1");
+}
+function emailOtpChallengeVerifyRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_email_otp_challenge_verify_request_v1"),
+		linkSessionId: sessionId,
+		challengeId: parseNonEmptyToken,
+		otpCode: (raw, label) => {
+			if (typeof raw !== "string" || !/^[0-9]{6,10}$/.test(raw)) throw new Error(`${label} is invalid`);
+			return raw;
+		}
+	});
 }
 function parseLinkedDeviceEmailOtpChallengeVerifyRequestV1(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"linkSessionId",
-		"challengeId",
-		"otpCode"
-	], "LinkedDeviceEmailOtpChallengeVerifyRequestV1");
-	if (record.kind !== "linked_device_email_otp_challenge_verify_request_v1") throw new Error("LinkedDeviceEmailOtpChallengeVerifyRequestV1.kind is invalid");
-	if (typeof record.otpCode !== "string" || !/^[0-9]{6,10}$/.test(record.otpCode)) throw new Error("LinkedDeviceEmailOtpChallengeVerifyRequestV1.otpCode is invalid");
-	return {
-		kind: "linked_device_email_otp_challenge_verify_request_v1",
-		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "LinkedDeviceEmailOtpChallengeVerifyRequestV1.linkSessionId"),
-		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpChallengeVerifyRequestV1.challengeId"),
-		otpCode: record.otpCode
-	};
+	return emailOtpChallengeVerifyRequestV1()(raw, "LinkedDeviceEmailOtpChallengeVerifyRequestV1");
+}
+function emailOtpChallengeResultV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_email_otp_challenge_result_v1"),
+		challengeId: parseNonEmptyToken,
+		maskedEmailHint: parseNonEmptyToken,
+		expiresAtMs: parseUnixTime,
+		resendAvailableAtMs: parseUnixTime
+	});
 }
 function parseLinkedDeviceEmailOtpChallengeResultV1(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"challengeId",
-		"maskedEmailHint",
-		"expiresAtMs",
-		"resendAvailableAtMs"
-	], "LinkedDeviceEmailOtpChallengeResultV1");
-	if (record.kind !== "linked_device_email_otp_challenge_result_v1") throw new Error("LinkedDeviceEmailOtpChallengeResultV1.kind is invalid");
-	const expiresAtMs = parseUnixTime(record.expiresAtMs, "LinkedDeviceEmailOtpChallengeResultV1.expiresAtMs");
-	const resendAvailableAtMs = parseUnixTime(record.resendAvailableAtMs, "LinkedDeviceEmailOtpChallengeResultV1.resendAvailableAtMs");
-	return {
-		kind: "linked_device_email_otp_challenge_result_v1",
-		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpChallengeResultV1.challengeId"),
-		maskedEmailHint: parseNonEmptyToken(record.maskedEmailHint, "LinkedDeviceEmailOtpChallengeResultV1.maskedEmailHint"),
-		expiresAtMs,
-		resendAvailableAtMs
-	};
+	return emailOtpChallengeResultV1()(raw, "LinkedDeviceEmailOtpChallengeResultV1");
 }
 function parseLinkedDeviceEmailOtpVerificationResultV1(raw) {
 	const record = exactRecord(raw, [
@@ -1190,57 +798,35 @@ function parseLinkedDeviceEmailOtpVerificationResultV1(raw) {
 function isNewEnrollmentEmailOtpVerificationGrantV1(grant) {
 	return grant.enrollment.kind === "new_enrollment";
 }
-function parseCancelUnclaimedRequest(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"linkSessionId",
-		"reason",
-		"requestedAtMs"
-	], "LinkedDeviceSessionCancelUnclaimedRequestV1");
-	if (record.kind !== "linked_device_session_cancel_unclaimed_request_v1" || record.reason !== "user_cancelled") throw new Error("LinkedDeviceSessionCancelUnclaimedRequestV1 is invalid");
-	return {
-		kind: "linked_device_session_cancel_unclaimed_request_v1",
-		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceSessionCancelUnclaimedRequestV1.linkSessionId"),
-		reason: "user_cancelled",
-		requestedAtMs: parseUnixTime(record.requestedAtMs, "LinkedDeviceSessionCancelUnclaimedRequestV1.requestedAtMs")
-	};
+function cancelUnclaimedRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_session_cancel_unclaimed_request_v1"),
+		linkSessionId: sessionId,
+		reason: (raw) => {
+			if (raw !== "user_cancelled") throw new Error("LinkedDeviceSessionCancelUnclaimedRequestV1 is invalid");
+			return raw;
+		},
+		requestedAtMs: parseUnixTime
+	});
 }
-function parseCancelClaimedRequest(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"linkSessionId",
-		"enrollmentId",
-		"deviceId",
-		"reason",
-		"requestedAtMs"
-	], "LinkedDeviceSessionCancelClaimedRequestV1");
-	if (record.kind !== "linked_device_session_cancel_claimed_request_v1") throw new Error("LinkedDeviceSessionCancelClaimedRequestV1.kind is invalid");
-	if (record.reason !== "user_cancelled" && record.reason !== "expired" && record.reason !== "revoked") throw new Error("LinkedDeviceSessionCancelClaimedRequestV1.reason is unsupported");
-	return {
-		kind: "linked_device_session_cancel_claimed_request_v1",
-		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceSessionCancelClaimedRequestV1.linkSessionId"),
-		enrollmentId: parseEnrollmentId(record.enrollmentId, "LinkedDeviceSessionCancelClaimedRequestV1.enrollmentId"),
-		deviceId: parseDeviceId(record.deviceId, "LinkedDeviceSessionCancelClaimedRequestV1.deviceId"),
-		reason: record.reason,
-		requestedAtMs: parseUnixTime(record.requestedAtMs, "LinkedDeviceSessionCancelClaimedRequestV1.requestedAtMs")
-	};
+function cancelClaimedRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_session_cancel_claimed_request_v1"),
+		linkSessionId: sessionId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		reason: supportedLiteral("user_cancelled", "expired", "revoked"),
+		requestedAtMs: parseUnixTime
+	});
 }
-function parseRetryRequest(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"linkSessionId",
-		"enrollmentId",
-		"deviceId",
-		"requestedAtMs"
-	], "LinkedDeviceSessionRetryCommittedDeliveryRequestV1");
-	if (record.kind !== "linked_device_session_retry_committed_delivery_request_v1") throw new Error("LinkedDeviceSessionRetryCommittedDeliveryRequestV1.kind is invalid");
-	return {
-		kind: "linked_device_session_retry_committed_delivery_request_v1",
-		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceSessionRetryCommittedDeliveryRequestV1.linkSessionId"),
-		enrollmentId: parseEnrollmentId(record.enrollmentId, "LinkedDeviceSessionRetryCommittedDeliveryRequestV1.enrollmentId"),
-		deviceId: parseDeviceId(record.deviceId, "LinkedDeviceSessionRetryCommittedDeliveryRequestV1.deviceId"),
-		requestedAtMs: parseUnixTime(record.requestedAtMs, "LinkedDeviceSessionRetryCommittedDeliveryRequestV1.requestedAtMs")
-	};
+function retryCommittedDeliveryRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_session_retry_committed_delivery_request_v1"),
+		linkSessionId: sessionId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		requestedAtMs: parseUnixTime
+	});
 }
 function parseLinkedDeviceSessionTransportRequestV1(raw) {
 	const record = requireRecord(raw, "LinkedDeviceSessionTransportRequestV1");
@@ -1248,9 +834,9 @@ function parseLinkedDeviceSessionTransportRequestV1(raw) {
 		case "linked_device_session_claim_request_v1": return parseLinkedDeviceSessionClaimRequestV1(record);
 		case "linked_device_approval_v1": return parseLinkedDeviceApprovalV1(record);
 		case "linked_device_target_credential_registration_v1": return parseLinkedDeviceTargetCredentialRegistrationV1(record);
-		case "linked_device_session_cancel_unclaimed_request_v1": return parseCancelUnclaimedRequest(record);
-		case "linked_device_session_cancel_claimed_request_v1": return parseCancelClaimedRequest(record);
-		case "linked_device_session_retry_committed_delivery_request_v1": return parseRetryRequest(record);
+		case "linked_device_session_cancel_unclaimed_request_v1": return cancelUnclaimedRequestV1()(record, "LinkedDeviceSessionCancelUnclaimedRequestV1");
+		case "linked_device_session_cancel_claimed_request_v1": return cancelClaimedRequestV1()(record, "LinkedDeviceSessionCancelClaimedRequestV1");
+		case "linked_device_session_retry_committed_delivery_request_v1": return retryCommittedDeliveryRequestV1()(record, "LinkedDeviceSessionRetryCommittedDeliveryRequestV1");
 		default: throw new Error("LinkedDeviceSessionTransportRequestV1.kind is unsupported");
 	}
 }
@@ -1267,146 +853,7 @@ function buildLinkedDeviceTargetPreparationV1(args) {
 		...args
 	});
 }
-const LOCAL_AUTHORITY_INSTALLATION_RECEIPT_FIELDS = [
-	"kind",
-	"authorityId",
-	"walletId",
-	"authMethodId",
-	"deviceId",
-	"packageSetDigestB64u",
-	"installedActivationRefs",
-	"installedRecordSetDigestB64u",
-	"targetFactorVerificationDigestB64u",
-	"installedAtMs"
-];
-function parseLocalAuthorityInstallationReceiptV1(raw) {
-	const record = exactRecord(raw, LOCAL_AUTHORITY_INSTALLATION_RECEIPT_FIELDS, "LocalAuthorityInstallationReceiptV1");
-	if (record.kind !== "local_authority_installation_receipt_v1") throw new Error("LocalAuthorityInstallationReceiptV1.kind is invalid");
-	const installedActivationResult = parseWalletSignerActivationSetV1(record.installedActivationRefs);
-	if (!installedActivationResult.ok) throw new Error(`LocalAuthorityInstallationReceiptV1.installedActivationRefs ${installedActivationResult.error}`);
-	return {
-		kind: "local_authority_installation_receipt_v1",
-		authorityId: parseId(parseWalletAuthorityId, record.authorityId, "authorityId"),
-		walletId: parseId(parseWalletId, record.walletId, "walletId"),
-		authMethodId: parseId(parseWalletAuthMethodId, record.authMethodId, "authMethodId"),
-		deviceId: parseId(parseDeviceId$1, record.deviceId, "deviceId"),
-		packageSetDigestB64u: parseDigest(record.packageSetDigestB64u, "packageSetDigestB64u"),
-		installedActivationRefs: installedActivationResult.value,
-		installedRecordSetDigestB64u: parseDigest(record.installedRecordSetDigestB64u, "installedRecordSetDigestB64u"),
-		targetFactorVerificationDigestB64u: parseDigest(record.targetFactorVerificationDigestB64u, "targetFactorVerificationDigestB64u"),
-		installedAtMs: parseUnixTime(record.installedAtMs, "installedAtMs")
-	};
-}
-const ACTIVE_WALLET_SESSION_FIELDS = [
-	"kind",
-	"walletId",
-	"authorityId",
-	"authMethodId",
-	"authorizationId",
-	"quotaId",
-	"authorityDigestB64u",
-	"authorityRevocationEpoch",
-	"capabilitySubjects",
-	"issuedAtMs",
-	"expiresAtMs"
-];
-const WALLET_SESSION_OPERATION_CREDENTIAL_FIELDS = [
-	"kind",
-	"token",
-	"walletSessionId"
-];
-function parseWalletSessionOperationCredentialV1(raw) {
-	const record = exactRecord(raw, WALLET_SESSION_OPERATION_CREDENTIAL_FIELDS, "WalletSessionOperationCredentialV1");
-	if (typeof record.token !== "string" || record.token.length > 8192) throw new Error("WalletSessionOperationCredentialV1.token is invalid");
-	if (record.kind === "opaque_wallet_session_operation_credential_v1") {
-		if (!/^wst_[A-Za-z0-9_-]{43}$/.test(record.token)) throw new Error("WalletSessionOperationCredentialV1 opaque token is invalid");
-		return {
-			kind: record.kind,
-			token: record.token,
-			walletSessionId: parseId(parseWalletSessionId, record.walletSessionId, "walletSessionId")
-		};
-	}
-	throw new Error("WalletSessionOperationCredentialV1.kind is invalid");
-}
-function parseActiveWalletSessionV1(raw) {
-	const record = exactRecord(raw, ACTIVE_WALLET_SESSION_FIELDS, "ActiveWalletSessionV1");
-	if (record.kind !== "active_wallet_session_v1") throw new Error("ActiveWalletSessionV1.kind is invalid");
-	if (!Array.isArray(record.capabilitySubjects) || record.capabilitySubjects.length === 0) throw new Error("ActiveWalletSessionV1.capabilitySubjects must be non-empty");
-	const capabilitySubjects = [];
-	const subjectKeys = /* @__PURE__ */ new Set();
-	for (const [index, rawSubject] of record.capabilitySubjects.entries()) {
-		const subject = parseWalletCapabilitySubjectV1(rawSubject, `capabilitySubjects[${index}]`);
-		const key = subject.kind === "sign" || subject.kind === "export_keys" ? `${subject.kind}:${subject.keyFamily}:${subject.materialActivation.activationId}` : subject.kind;
-		if (subjectKeys.has(key)) throw new Error("ActiveWalletSessionV1 capability subjects repeat");
-		subjectKeys.add(key);
-		capabilitySubjects.push(subject);
-	}
-	const first = capabilitySubjects[0];
-	if (!first) throw new Error("ActiveWalletSessionV1.capabilitySubjects must be non-empty");
-	return {
-		kind: "active_wallet_session_v1",
-		walletId: parseId(parseWalletId, record.walletId, "walletId"),
-		authorityId: parseId(parseWalletAuthorityId, record.authorityId, "authorityId"),
-		authMethodId: parseId(parseWalletAuthMethodId, record.authMethodId, "authMethodId"),
-		authorizationId: parseId(parseWalletSessionAuthorizationId, record.authorizationId, "authorizationId"),
-		quotaId: parseId(parseMpcWalletSigningQuotaId, record.quotaId, "quotaId"),
-		authorityDigestB64u: parseDigest(record.authorityDigestB64u, "authorityDigestB64u"),
-		authorityRevocationEpoch: parseNonNegativeInteger(record.authorityRevocationEpoch, "authorityRevocationEpoch"),
-		capabilitySubjects: [first, ...capabilitySubjects.slice(1)],
-		issuedAtMs: parseUnixTime(record.issuedAtMs, "issuedAtMs"),
-		expiresAtMs: parseUnixTime(record.expiresAtMs, "expiresAtMs")
-	};
-}
-function parseWalletCapabilitySubjectV1(raw, label) {
-	const record = requireRecord(raw, label);
-	if (record.kind === "link_devices" || record.kind === "revoke_devices") {
-		rejectUnknownFields(record, ["kind"], label);
-		return { kind: record.kind };
-	}
-	if (record.kind !== "sign" && record.kind !== "export_keys") throw new Error(`${label}.kind is invalid`);
-	rejectUnknownFields(record, [
-		"kind",
-		"keyFamily",
-		"materialActivation"
-	], label);
-	if (record.keyFamily !== "ed25519" && record.keyFamily !== "ecdsa_secp256k1") throw new Error(`${label}.keyFamily is invalid`);
-	return {
-		kind: record.kind,
-		keyFamily: record.keyFamily,
-		materialActivation: parseId(parseMpcMaterialActivationRef, record.materialActivation, `${label}.materialActivation`)
-	};
-}
-function parseNonNegativeInteger(raw, label) {
-	if (!Number.isSafeInteger(raw) || Number(raw) < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	return Number(raw);
-}
-const LOCAL_AUTHORITY_ACTIVATION_FINAL_ACK_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"authorityId",
-	"packageSetDigestB64u",
-	"authorizationId",
-	"walletSessionId",
-	"credentialDigestB64u",
-	"installationReceiptDigestB64u",
-	"acknowledgedAtMs"
-];
-function parseLocalAuthorityActivationFinalAckV1(raw) {
-	const record = exactRecord(raw, LOCAL_AUTHORITY_ACTIVATION_FINAL_ACK_FIELDS, "LocalAuthorityActivationFinalAckV1");
-	if (record.kind !== "local_authority_activation_final_ack_v1") throw new Error("LocalAuthorityActivationFinalAckV1.kind is invalid");
-	return {
-		kind: "local_authority_activation_final_ack_v1",
-		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "linkSessionId"),
-		authorityId: parseId(parseWalletAuthorityId, record.authorityId, "authorityId"),
-		packageSetDigestB64u: parseDigest(record.packageSetDigestB64u, "packageSetDigestB64u"),
-		authorizationId: parseId(parseWalletSessionAuthorizationId, record.authorizationId, "authorizationId"),
-		walletSessionId: parseId(parseWalletSessionId, record.walletSessionId, "walletSessionId"),
-		credentialDigestB64u: parseDigest(record.credentialDigestB64u, "credentialDigestB64u"),
-		installationReceiptDigestB64u: parseDigest(record.installationReceiptDigestB64u, "installationReceiptDigestB64u"),
-		acknowledgedAtMs: parseUnixTime(record.acknowledgedAtMs, "acknowledgedAtMs")
-	};
-}
 //#endregion
-export { buildLinkedDeviceTargetPreparationV1, buildWalletSessionLinkedDeviceOwnerAuthorizationV1, parseActiveWalletSessionV1, parseLinkDevicePublicKeyB64u, parseLinkSessionStateV1, parseLinkedDeviceApprovalDeliveryV1, parseLinkedDeviceApprovalV1, parseLinkedDeviceEmailOtpBaseFactorRequestV1, parseLinkedDeviceEmailOtpChallengeResendRequestV1, parseLinkedDeviceEmailOtpChallengeResultV1, parseLinkedDeviceEmailOtpChallengeStartRequestV1, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1, parseLinkedDeviceEmailOtpVerificationGrantV1, parseLinkedDeviceEmailOtpVerificationResultV1, parseLinkedDeviceListRequestV1, parseLinkedDeviceOwnerAuthorizationRequestV1, parseLinkedDeviceOwnerAuthorizationSourceV1, parseLinkedDeviceRevokeRequestV1, parseLinkedDeviceSessionClaimRequestV1, parseLinkedDeviceSessionClaimV1, parseLinkedDeviceSessionTransportRequestV1, parseLinkedDeviceTargetCredentialRegistrationResultV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationRequestV1, parseLinkedDeviceTargetPreparationV1, parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1, parseQrLinkedDeviceSessionPayloadV5, parseWalletSessionOperationCredentialV1 };
+export { buildLinkedDeviceTargetPreparationV1, buildWalletSessionLinkedDeviceOwnerAuthorizationV1, parseLinkDevicePublicKeyB64u, parseLinkSessionStateV1, parseLinkedDeviceApprovalDeliveryV1, parseLinkedDeviceApprovalV1, parseLinkedDeviceEmailOtpBaseFactorRequestV1, parseLinkedDeviceEmailOtpChallengeResendRequestV1, parseLinkedDeviceEmailOtpChallengeResultV1, parseLinkedDeviceEmailOtpChallengeStartRequestV1, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1, parseLinkedDeviceEmailOtpVerificationGrantV1, parseLinkedDeviceEmailOtpVerificationResultV1, parseLinkedDeviceOwnerAuthorizationRequestV1, parseLinkedDeviceOwnerAuthorizationSourceV1, parseLinkedDeviceSessionClaimRequestV1, parseLinkedDeviceSessionClaimV1, parseLinkedDeviceSessionTransportRequestV1, parseLinkedDeviceTargetCredentialRegistrationResultV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationRequestV1, parseLinkedDeviceTargetPreparationV1, parseQrLinkedDeviceSessionPayloadV5 };
 
 //# sourceMappingURL=parsers.js.map