@seams/wallet 0.6.1 → 0.7.1

package/dist/esm/shared-ts/src/device-linking/activeWalletSession.js

@@ -1,4 +1,8 @@
 import { mpcMaterialActivationRefsEqual } from "../utils/domainIds.js";
+import { requireRecord } from "../utils/validation.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { wireLiteral, wireObject } from "../utils/wireSchema.js";
+import { digest, keyLabeled, materialActivation, parseNonNegativeSafeInteger, parseUnixTime, quotaId, walletAuthMethodId, walletAuthorityId, walletId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
 //#region ../shared-ts/src/device-linking/activeWalletSession.ts
 function activeWalletSessionV1RecordsEqual(left, right) {
 	if (left.kind !== right.kind || left.walletId !== right.walletId || left.authorityId !== right.authorityId || left.authMethodId !== right.authMethodId || left.authorizationId !== right.authorizationId || left.quotaId !== right.quotaId || left.authorityDigestB64u !== right.authorityDigestB64u || left.authorityRevocationEpoch !== right.authorityRevocationEpoch || left.issuedAtMs !== right.issuedAtMs || left.expiresAtMs !== right.expiresAtMs || left.capabilitySubjects.length !== right.capabilitySubjects.length) return false;
@@ -29,7 +33,72 @@ function walletSessionPreservesCapabilities(previous, next) {
 	}
 	return true;
 }
+function walletSessionOperationCredentialV1() {
+	return wireObject({
+		kind: wireLiteral("opaque_wallet_session_operation_credential_v1"),
+		token: (raw, label) => {
+			if (typeof raw !== "string" || raw.length > 8192) throw new Error(`${label} is invalid`);
+			return raw;
+		},
+		walletSessionId: keyLabeled(walletSessionId)
+	}, (credential, label) => {
+		if (!/^wst_[A-Za-z0-9_-]{43}$/.test(credential.token)) throw new Error(`${label} opaque token is invalid`);
+	});
+}
+function parseWalletSessionOperationCredentialV1(raw) {
+	return walletSessionOperationCredentialV1()(raw, "WalletSessionOperationCredentialV1");
+}
+function capabilitySubjectKey(subject) {
+	return subject.kind === "sign" || subject.kind === "export_keys" ? `${subject.kind}:${subject.keyFamily}:${subject.materialActivation.activationId}` : subject.kind;
+}
+function activeWalletSessionV1() {
+	return wireObject({
+		kind: wireLiteral("active_wallet_session_v1"),
+		walletId: keyLabeled(walletId),
+		authorityId: keyLabeled(walletAuthorityId),
+		authMethodId: keyLabeled(walletAuthMethodId),
+		authorizationId: keyLabeled(walletSessionAuthorizationId),
+		quotaId: keyLabeled(quotaId),
+		authorityDigestB64u: keyLabeled(digest),
+		authorityRevocationEpoch: keyLabeled(parseNonNegativeSafeInteger),
+		capabilitySubjects: (raw, label) => {
+			if (!Array.isArray(raw) || raw.length === 0) throw new Error(`${label} must be non-empty`);
+			const subjects = [];
+			for (const [index, subject] of raw.entries()) subjects.push(parseWalletCapabilitySubjectV1(subject, `capabilitySubjects[${index}]`));
+			const first = subjects[0];
+			if (!first) throw new Error(`${label} must be non-empty`);
+			return [first, ...subjects.slice(1)];
+		},
+		issuedAtMs: keyLabeled(parseUnixTime),
+		expiresAtMs: keyLabeled(parseUnixTime)
+	}, (session, label) => {
+		const keys = session.capabilitySubjects.map(capabilitySubjectKey);
+		if (new Set(keys).size !== keys.length) throw new Error(`${label} capability subjects repeat`);
+	});
+}
+function parseActiveWalletSessionV1(raw) {
+	return activeWalletSessionV1()(raw, "ActiveWalletSessionV1");
+}
+function parseWalletCapabilitySubjectV1(raw, label) {
+	const record = requireRecord(raw, label);
+	if (record.kind === "link_devices" || record.kind === "revoke_devices") {
+		rejectUnknownFields(record, ["kind"], label);
+		return { kind: record.kind };
+	}
+	if (record.kind !== "sign" && record.kind !== "export_keys") throw new Error(`${label}.kind is invalid`);
+	rejectUnknownFields(record, [
+		"kind",
+		"keyFamily",
+		"materialActivation"
+	], label);
+	if (record.keyFamily !== "ed25519" && record.keyFamily !== "ecdsa_secp256k1") throw new Error(`${label}.keyFamily is invalid`);
+	return {
+		kind: record.kind,
+		keyFamily: record.keyFamily,
+		materialActivation: materialActivation(record.materialActivation, `${label}.materialActivation`)
+	};
+}
 //#endregion
-export { activeWalletSessionV1RecordsEqual, walletCapabilitySubjectsEqual, walletSessionPreservesCapabilities };
+export { activeWalletSessionV1RecordsEqual, parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1, walletSessionPreservesCapabilities };
 
 //# sourceMappingURL=activeWalletSession.js.map

package/dist/esm/shared-ts/src/device-linking/authorityActivation.js

@@ -0,0 +1,142 @@
+import { requireRecord } from "../utils/validation.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { wireLiteral, wireObject, wireUnion } from "../utils/wireSchema.js";
+import { authorizationDeviceId, digest, keyLabeled, parseUnixTime, sessionId, walletAuthMethodId, walletAuthorityId, walletId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
+import { parseActiveWalletSessionV1 } from "./activeWalletSession.js";
+import { parseWalletAuthMethodRecordV2 } from "../utils/walletAuthMethodRecord.js";
+import { parseWalletAuthorityV1, parseWalletSignerActivationSetV1 } from "../authorization/walletAuthority.js";
+import { parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1, parseLinkedDeviceWalletSessionCredentialDeliveryV1 } from "./walletSessionCredentialDelivery.js";
+//#region ../shared-ts/src/device-linking/authorityActivation.ts
+function parseInstalledActivationRefs(raw, label) {
+	const result = parseWalletSignerActivationSetV1(raw);
+	if (!result.ok) throw new Error(`${label} ${result.error}`);
+	return result.value;
+}
+function localAuthorityInstallationReceiptV1() {
+	return wireObject({
+		kind: wireLiteral("local_authority_installation_receipt_v1"),
+		authorityId: keyLabeled(walletAuthorityId),
+		walletId: keyLabeled(walletId),
+		authMethodId: keyLabeled(walletAuthMethodId),
+		deviceId: keyLabeled(authorizationDeviceId),
+		packageSetDigestB64u: keyLabeled(digest),
+		installedActivationRefs: parseInstalledActivationRefs,
+		installedRecordSetDigestB64u: keyLabeled(digest),
+		targetFactorVerificationDigestB64u: keyLabeled(digest),
+		installedAtMs: keyLabeled(parseUnixTime)
+	});
+}
+function parseLocalAuthorityInstallationReceiptV1(raw) {
+	return localAuthorityInstallationReceiptV1()(raw, "LocalAuthorityInstallationReceiptV1");
+}
+function localAuthorityActivationFinalAckV1() {
+	return wireObject({
+		kind: wireLiteral("local_authority_activation_final_ack_v1"),
+		linkSessionId: keyLabeled(sessionId),
+		authorityId: keyLabeled(walletAuthorityId),
+		packageSetDigestB64u: keyLabeled(digest),
+		authorizationId: keyLabeled(walletSessionAuthorizationId),
+		walletSessionId: keyLabeled(walletSessionId),
+		credentialDigestB64u: keyLabeled(digest),
+		installationReceiptDigestB64u: keyLabeled(digest),
+		acknowledgedAtMs: keyLabeled(parseUnixTime)
+	});
+}
+function parseLocalAuthorityActivationFinalAckV1(raw) {
+	return localAuthorityActivationFinalAckV1()(raw, "LocalAuthorityActivationFinalAckV1");
+}
+function parseActivateInstalledAuthorityResultV1(raw) {
+	const record = requireRecord(raw, "ActivateInstalledAuthorityResultV1");
+	switch (record.kind) {
+		case "active": {
+			rejectUnknownFields(record, [
+				"kind",
+				"authority",
+				"authMethod",
+				"walletSession",
+				"deliveryBinding",
+				"sealedDelivery"
+			], "ActivateInstalledAuthorityResultV1");
+			const authorityResult = parseWalletAuthorityV1(record.authority);
+			if (!authorityResult.ok || authorityResult.value.state !== "active") throw new Error("ActivateInstalledAuthorityResultV1.authority must be active");
+			const authMethod = parseWalletAuthMethodRecordV2(record.authMethod);
+			if (!authMethod || authMethod.status !== "active") throw new Error("ActivateInstalledAuthorityResultV1.authMethod must be active");
+			const walletSession = parseActiveWalletSessionV1(record.walletSession);
+			const deliveryBinding = parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1(record.deliveryBinding);
+			const sealedDelivery = parseLinkedDeviceWalletSessionCredentialDeliveryV1(record.sealedDelivery);
+			if (authorityResult.value.walletId !== authMethod.walletId || authorityResult.value.authorityId !== authMethod.walletAuthorityId || walletSession.walletId !== authorityResult.value.walletId || walletSession.authorityId !== authorityResult.value.authorityId || walletSession.authMethodId !== authMethod.walletAuthMethodId || walletSession.authorityDigestB64u !== authorityResult.value.authorityDigestB64u || walletSession.authorityRevocationEpoch !== authorityResult.value.revocationEpoch || deliveryBinding.namespace !== sealedDelivery.aad.namespace || deliveryBinding.orgId !== sealedDelivery.aad.orgId || deliveryBinding.projectId !== sealedDelivery.aad.projectId || deliveryBinding.envId !== sealedDelivery.aad.envId || deliveryBinding.tenantId !== sealedDelivery.aad.tenantId || deliveryBinding.principalId !== sealedDelivery.aad.principalId || sealedDelivery.aad.walletId !== walletSession.walletId || sealedDelivery.aad.authorityId !== walletSession.authorityId || sealedDelivery.aad.walletAuthMethodId !== walletSession.authMethodId || sealedDelivery.aad.authorizationId !== walletSession.authorizationId || sealedDelivery.aad.quotaId !== walletSession.quotaId || sealedDelivery.aad.issuedAtMs !== walletSession.issuedAtMs || sealedDelivery.aad.expiresAtMs !== walletSession.expiresAtMs) throw new Error("ActivateInstalledAuthorityResultV1 identities do not match");
+			return {
+				kind: "active",
+				authority: authorityResult.value,
+				authMethod,
+				walletSession,
+				deliveryBinding,
+				sealedDelivery
+			};
+		}
+		case "pending_local_install":
+			rejectUnknownFields(record, [
+				"kind",
+				"authorityId",
+				"reason"
+			], "ActivateInstalledAuthorityResultV1");
+			return {
+				kind: "pending_local_install",
+				authorityId: walletAuthorityId(record.authorityId, "authorityId"),
+				reason: activationRetryReasonV1()(record.reason, "ActivationRetryReasonV1")
+			};
+		case "integrity_error":
+			rejectUnknownFields(record, ["kind", "reason"], "ActivateInstalledAuthorityResultV1");
+			return {
+				kind: "integrity_error",
+				reason: parseLinkIntegrityFailureV1(record.reason)
+			};
+		default: throw new Error("ActivateInstalledAuthorityResultV1.kind is invalid");
+	}
+}
+function activationRetryReasonV1() {
+	return wireUnion("kind", [
+		wireObject({ kind: wireLiteral("installation_receipt_not_found") }),
+		wireObject({ kind: wireLiteral("server_worker_activation_pending") }),
+		wireObject({ kind: wireLiteral("wallet_session_issuance_pending") })
+	]);
+}
+function parseLinkIntegrityFailureV1(raw) {
+	const record = requireRecord(raw, "LinkIntegrityFailureV1");
+	switch (record.kind) {
+		case "authority_id_mismatch":
+			rejectUnknownFields(record, [
+				"kind",
+				"expectedAuthorityId",
+				"actualAuthorityId"
+			], "LinkIntegrityFailureV1");
+			return {
+				kind: "authority_id_mismatch",
+				expectedAuthorityId: walletAuthorityId(record.expectedAuthorityId, "expectedAuthorityId"),
+				actualAuthorityId: walletAuthorityId(record.actualAuthorityId, "actualAuthorityId")
+			};
+		case "package_set_digest_mismatch":
+			rejectUnknownFields(record, [
+				"kind",
+				"expectedPackageSetDigestB64u",
+				"actualPackageSetDigestB64u"
+			], "LinkIntegrityFailureV1");
+			return {
+				kind: "package_set_digest_mismatch",
+				expectedPackageSetDigestB64u: digest(record.expectedPackageSetDigestB64u, "expectedPackageSetDigestB64u"),
+				actualPackageSetDigestB64u: digest(record.actualPackageSetDigestB64u, "actualPackageSetDigestB64u")
+			};
+		case "installation_receipt_mismatch":
+			rejectUnknownFields(record, ["kind", "field"], "LinkIntegrityFailureV1");
+			if (record.field !== "walletId" && record.field !== "authMethodId" && record.field !== "deviceId" && record.field !== "targetFactorVerificationDigestB64u" && record.field !== "installedActivationRefs") throw new Error("LinkIntegrityFailureV1.field is invalid");
+			return {
+				kind: "installation_receipt_mismatch",
+				field: record.field
+			};
+		default: throw new Error("LinkIntegrityFailureV1.kind is invalid");
+	}
+}
+//#endregion
+export { parseActivateInstalledAuthorityResultV1, parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1 };
+
+//# sourceMappingURL=authorityActivation.js.map

package/dist/esm/shared-ts/src/device-linking/committedSignerPackages.js

@@ -1,11 +1,11 @@
 import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef } from "../utils/domainIds.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { parseWalletAuthorityV1 } from "../authorization/walletAuthority.js";
-import { parseWalletAuthMethodRecordV2 } from "../utils/registrationIntent.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1 } from "../utils/routerAbEd25519Yao.js";
-import { parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from "./sourceContribution.js";
 import { parseLinkedDeviceEd25519ExportRootPackageV1 } from "./ed25519ExportRoot.js";
+import { parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from "./sourceContribution.js";
+import { parseWalletAuthMethodRecordV2 } from "../utils/walletAuthMethodRecord.js";
+import { parseWalletAuthorityV1 } from "../authorization/walletAuthority.js";
 //#region ../shared-ts/src/device-linking/committedSignerPackages.ts
 function parseCommittedAuthorityPackagesV1(raw) {
 	const record = parseCommittedAuthorityPackagesWireV1(raw);

package/dist/esm/shared-ts/src/device-linking/delegatedActivationPlan.js

@@ -1,5 +1,7 @@
 import { parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
-import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u, rejectUnknownFields, requireRecord } from "../passkey-custody/primitives.js";
+import { requireRecord } from "../utils/validation.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u } from "../passkey-custody/primitives.js";
 //#region ../shared-ts/src/device-linking/delegatedActivationPlan.ts
 const MANIFEST_FIELDS = [
 	"kind",

package/dist/esm/shared-ts/src/device-linking/deviceManagement.js

@@ -0,0 +1,120 @@
+import { requireRecord } from "../utils/validation.js";
+import { wireLiteral, wireObject, wireUnion } from "../utils/wireSchema.js";
+import { credentialId, digest, enrollmentId, linkedDeviceId, nullableToken, parseDelegatedWalletAuthority, parseNonNegativeSafeInteger, parseTargetEmail, parseUnixTime, walletAuthMethodId, walletAuthorityId, walletId, walletKeyId } from "./wireFields.js";
+import { parseWebAuthnAuthenticatorDeviceInfo } from "../utils/webauthnDeviceInfo.js";
+//#region ../shared-ts/src/device-linking/deviceManagement.ts
+function listOf(item) {
+	return (raw, label) => {
+		if (!Array.isArray(raw)) throw new Error(`${label} is invalid`);
+		return raw.map((entry, index) => item(entry, `${label}[${index}]`));
+	};
+}
+function parseLinkedDeviceRevokeWalletAuthMethodId(raw, label) {
+	const value = walletAuthMethodId(raw, label);
+	if (value.startsWith("wallet-authority:") || value.startsWith("authority:")) throw new Error(`${label} must identify a WalletAuthMethodId`);
+	return value;
+}
+function parsePositiveSafeInteger(raw, label) {
+	const value = parseNonNegativeSafeInteger(raw, label);
+	if (value < 1) throw new Error(`${label} must be a positive safe integer`);
+	return value;
+}
+function parseWebAuthnDeviceInfo(raw, label) {
+	const device = parseWebAuthnAuthenticatorDeviceInfo(raw);
+	if (!device) throw new Error(`${label} is invalid`);
+	return device;
+}
+function linkedOwnerCredentialMetadataV1() {
+	return wireUnion("kind", [wireObject({
+		kind: wireLiteral("passkey"),
+		walletAuthMethodId,
+		credentialIdB64u: credentialId,
+		device: parseWebAuthnDeviceInfo
+	}), wireObject({
+		kind: wireLiteral("email_otp"),
+		walletAuthMethodId,
+		email: parseTargetEmail
+	})]);
+}
+function parseLinkedOwnerCredentialMetadata(raw, label) {
+	return linkedOwnerCredentialMetadataV1()(raw, label);
+}
+function linkedDeviceSummaryV1() {
+	return wireObject({
+		deviceId: linkedDeviceId,
+		enrollmentId,
+		walletId,
+		credential: parseLinkedOwnerCredentialMetadata,
+		permission: parseDelegatedWalletAuthority,
+		keyManifestDigestB64u: digest,
+		coveredWalletKeys: listOf(walletKeyId),
+		state: wireLiteral("provisioning", "active", "suspended", "expired", "revoked"),
+		createdAtMs: parseUnixTime,
+		lastActivityAtMs: parseUnixTime,
+		revocationEpoch: parseNonNegativeSafeInteger
+	});
+}
+function parseLinkedDeviceSummaryV1(raw) {
+	return linkedDeviceSummaryV1()(raw, "LinkedDeviceSummaryV1");
+}
+function linkedDeviceListRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_list_request_v1"),
+		walletId,
+		limit: parsePositiveSafeInteger,
+		cursor: nullableToken
+	});
+}
+function parseLinkedDeviceListRequestV1(raw) {
+	return linkedDeviceListRequestV1()(raw, "LinkedDeviceListRequestV1");
+}
+function ownerDeviceSummaryV1() {
+	return wireObject({
+		walletId,
+		walletAuthorityId,
+		credential: parseLinkedOwnerCredentialMetadata,
+		createdAtMs: parseUnixTime,
+		lastActivityAtMs: parseUnixTime
+	});
+}
+function linkedDeviceListResultV1() {
+	const ownerDevice = ownerDeviceSummaryV1();
+	return wireObject({
+		devices: listOf(parseLinkedDeviceSummaryV1),
+		ownerDevices: listOf((raw) => ownerDevice(raw, "OwnerDeviceSummaryV1")),
+		nextCursor: nullableToken
+	});
+}
+function parseLinkedDeviceListResultV1(raw) {
+	return linkedDeviceListResultV1()(raw, "LinkedDeviceListResultV1");
+}
+function linkedDeviceRevokeRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_revoke_request_v1"),
+		walletId,
+		walletAuthMethodId: parseLinkedDeviceRevokeWalletAuthMethodId,
+		requestedAtMs: parseUnixTime
+	});
+}
+function parseLinkedDeviceRevokeRequestV1(raw) {
+	return linkedDeviceRevokeRequestV1()(raw, "LinkedDeviceRevokeRequestV1");
+}
+function linkedDeviceRevokeFailureV1() {
+	return wireObject({ kind: wireLiteral("not_found", "conflict", "unauthorized") });
+}
+function linkedDeviceRevokedV1() {
+	return wireObject({
+		kind: wireLiteral("revoked"),
+		walletAuthMethodId: parseLinkedDeviceRevokeWalletAuthMethodId,
+		authorityId: walletAuthorityId,
+		revocationEpoch: parseNonNegativeSafeInteger
+	});
+}
+function parseLinkedDeviceRevokeResultV1(raw) {
+	const record = requireRecord(raw, "LinkedDeviceRevokeResultV1");
+	return (record.kind === "not_found" || record.kind === "conflict" || record.kind === "unauthorized" ? linkedDeviceRevokeFailureV1() : linkedDeviceRevokedV1())(record, "LinkedDeviceRevokeResultV1");
+}
+//#endregion
+export { parseLinkedDeviceListRequestV1, parseLinkedDeviceListResultV1, parseLinkedDeviceRevokeRequestV1, parseLinkedDeviceRevokeResultV1, parseLinkedDeviceSummaryV1 };
+
+//# sourceMappingURL=deviceManagement.js.map

package/dist/esm/shared-ts/src/device-linking/digests.js

@@ -1,18 +1,18 @@
 import "../authorization/delegatedAuthority.js";
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256Bytes, sha256BytesUtf8 } from "../utils/digests.js";
+import { alphabetizeStringify } from "../utils/digests.js";
+import { sha256DigestB64u, sha256Utf8DigestB64u } from "../utils/canonicalPrimitives.js";
+import { concat, lp32, rawDigest, rawPublicKey, text, u32, u64 } from "../utils/digestEncoding.js";
 import "./committedSignerPackages.js";
 //#region ../shared-ts/src/device-linking/digests.ts
 const TARGET_PREPARATION_DOMAIN = "seams/linked-device/target-preparation/v1";
 const LOCAL_AUTHORITY_INSTALLATION_RECEIPT_DOMAIN = "seams/linked-device/local-authority-installation-receipt/v1";
-const TEXT_ENCODER = new TextEncoder();
+new TextEncoder();
 /**
 * The server stores this digest alongside the authorization. Hashing the
 * opaque token directly keeps the browser binding identical to that row.
 */
 async function computeWalletSessionOperationCredentialDigestB64u(credential) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(credential.token)));
+	return sha256Utf8DigestB64u(credential.token);
 }
 function encodeWalletSessionInstallationReceiptV1(receipt) {
 	return alphabetizeStringify({
@@ -21,67 +21,12 @@ function encodeWalletSessionInstallationReceiptV1(receipt) {
 	});
 }
 async function computeWalletSessionInstallationReceiptDigestB64u(receipt) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(encodeWalletSessionInstallationReceiptV1(receipt))));
-}
-function concat(parts) {
-	let length = 0;
-	for (const part of parts) length += part.length;
-	const output = new Uint8Array(length);
-	let offset = 0;
-	for (const part of parts) {
-		output.set(part, offset);
-		offset += part.length;
-	}
-	return output;
-}
-function u32(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0 || value > 4294967295) throw new Error(`${label} must be a non-negative u32`);
-	return Uint8Array.from([
-		value >>> 24 & 255,
-		value >>> 16 & 255,
-		value >>> 8 & 255,
-		value & 255
-	]);
-}
-function u64(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	let remaining = BigInt(value);
-	const output = new Uint8Array(8);
-	for (let index = 7; index >= 0; index -= 1) {
-		output[index] = Number(remaining & 255n);
-		remaining >>= 8n;
-	}
-	return output;
-}
-function lp32(value, label) {
-	return concat([u32(value.length, `${label}.length`), value]);
-}
-function text(value, label) {
-	if (typeof value !== "string") throw new Error(`${label} must be a string`);
-	return lp32(TEXT_ENCODER.encode(value), label);
+	return sha256Utf8DigestB64u(encodeWalletSessionInstallationReceiptV1(receipt));
 }
 function requirePresentString(value, label) {
 	if (value === void 0) throw new Error(`${label} is required`);
 	return value;
 }
-function rawDigest(value, label) {
-	try {
-		const decoded = base64UrlDecode(parseDigestB64u(value));
-		if (decoded.length !== 32) throw new Error("must decode to 32 bytes");
-		return decoded;
-	} catch (error) {
-		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
-	}
-}
-function rawPublicKey(value, label) {
-	try {
-		const decoded = base64UrlDecode(value);
-		if (decoded.length === 0 || base64UrlEncode(decoded) !== value) throw new Error("must be canonical base64url");
-		return decoded;
-	} catch (error) {
-		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
-	}
-}
 function encodeTargetFactor(value) {
 	return text(value.kind, "targetFactor.kind");
 }
@@ -162,9 +107,9 @@ function isPasskeyTargetPreparationV1(value) {
 	return value.targetFactor.kind === "passkey_prf";
 }
 async function computeLinkedDeviceTargetPreparationDigestV1(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeLinkedDeviceTargetPreparationV1(value))));
+	return sha256DigestB64u(encodeLinkedDeviceTargetPreparationV1(value));
 }
 //#endregion
-export { computeLinkedDeviceTargetPreparationDigestV1, computeWalletSessionInstallationReceiptDigestB64u, computeWalletSessionOperationCredentialDigestB64u, encodeLinkedDeviceTargetPreparationV1, encodeWalletSessionInstallationReceiptV1 };
+export { computeLinkedDeviceTargetPreparationDigestV1, computeWalletSessionInstallationReceiptDigestB64u, computeWalletSessionOperationCredentialDigestB64u };
 
 //# sourceMappingURL=digests.js.map

package/dist/esm/shared-ts/src/device-linking/ed25519ExportRoot.js

@@ -1,6 +1,8 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
+import { requireRecord } from "../utils/validation.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, rejectUnknownFields, requireRecord } from "../passkey-custody/primitives.js";
+import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u } from "../passkey-custody/primitives.js";
 //#region ../shared-ts/src/device-linking/ed25519ExportRoot.ts
 /**
 * Authenticated relay records for the cross-device Ed25519 Yao Client export

package/dist/esm/shared-ts/src/device-linking/index.js

@@ -1,10 +1,12 @@
-import "./walletSessionCredentialDelivery.js";
+import "./activeWalletSession.js";
+import "./contracts.js";
+import "./ed25519ExportRoot.js";
 import "./delegatedActivationPlan.js";
 import "./sourceContribution.js";
-import "./ed25519ExportRoot.js";
 import "./committedSignerPackages.js";
 import "./parsers.js";
-import "./activeWalletSession.js";
-import "./contracts.js";
+import "./deviceManagement.js";
+import "./walletSessionCredentialDelivery.js";
+import "./authorityActivation.js";
 import "./digests.js";
 import "./requestProof.js";