@seams/wallet 0.6.2 → 0.7.1

package/dist/public/sdk/evmFamilyEcdsaIdentity-Co5XDcEA.js

@@ -0,0 +1,4288 @@
+import { D as parseWalletAuthorityId, M as parseWebAuthnRpId, O as parseWalletId, T as parseWalletAuthMethodId, _ as parseMpcSigningWorkerRef, d as parseLinkedDeviceId, h as parseMpcMaterialActivationRef, k as parseWalletKeyId, l as parseLinkDeviceSessionId, n as hasWhitespaceOrControlCharacters, r as mpcMaterialActivationRefsEqual, u as parseLinkedDeviceEnrollmentId } from "./domainIds-lcrFg6Sa.js";
+import { D as parseImplicitNearAccountId, O as parseNamedNearAccountId, _ as requireRecord, m as requireArray, v as requireRecordCopy } from "./validation-gat4LEKm.js";
+import { i as base64UrlEncode, r as base64UrlDecode } from "./base64-Clm8C-e9.js";
+import { N as exactRecord$3, O as delegatedWalletPermissionNamesV1, P as rejectUnknownFields$1, S as parseEnvelopeNonceB64u, T as parseSecp256k1CompressedPublicKeyB64u, _ as deriveEvmFamilySigningKeySlotId$1, b as parseEd25519PublicKeyB64u, d as normalizeThresholdEd25519ParticipantIds, g as signingRootScopeFromRuntimePolicyScope, x as parseEnvelopeCiphertextB64u, y as parseDigestField$1 } from "./sessionPolicy-CHiilOAB.js";
+import { $t as wireObject, Bt as parseNonNegativeSafeInteger, Ct as routerAbMpcMaterialActivationRefFromWire, Et as requireRouterAbX25519PublicKey, Ft as keyLabeled, Gt as walletAuthMethodId, Ht as parseUnixTime, It as linkedDeviceId, Jt as walletKeyId, Kt as walletAuthorityId, Lt as nullableToken, Mt as credentialId, Nt as digest, Ot as parseActiveWalletSessionV1, Pt as enrollmentId, Qt as wireNullable, Rt as parseDelegatedWalletAuthority, Tt as sameRouterAbMpcMaterialActivationRef, Ut as rpId$1, Vt as parseTargetEmail, Wt as sessionId, Xt as walletSessionId, Yt as walletSessionAuthorizationId, Zt as wireLiteral, en as wireUnion, j as requireRouterAbEcdsaDerivationNormalSigningStateV1, jt as authorizationDeviceId, qt as walletId, xt as parseRouterAbMpcMaterialActivationRef, yt as parseSdkEcdsaDerivationThresholdKeyId, zt as parseNonEmptyToken } from "./ecdsaPresignLifecycle-BFOTNYCK.js";
+import { d as parseMpcWalletSigningQuotaId, f as parsePrincipalId, h as parseWalletSessionId, l as parseDeviceId, m as parseWalletSessionAuthorizationId, p as parseTenantId } from "./capabilityKinds-hvYqa6S_.js";
+import { f as alphabetizeStringify, m as sha256BytesUtf8 } from "./chains-BMh3btVo.js";
+import { a as sha256DigestB64u, o as sha256Utf8DigestB64u, r as parseDigestB64u } from "./canonicalPrimitives-BTHWz80v.js";
+import { c as toWalletId, l as walletIdFromWalletProfile } from "./ecdsaChainTarget-Bl-JWyuw.js";
+import { n as SIGNER_AUTH_METHODS } from "./signerDomain-IEAVrOrc.js";
+import { _ as rawDigest, b as u32, d as parseWalletSignerActivationSetV1, g as lp32, h as concat, u as parseWalletAuthorityV1, v as rawPublicKey, w as parseWalletAuthMethodRecordV2, x as u64, y as text } from "./walletAuthority-BQBxgUBn.js";
+import { i as nearEd25519SigningKeyIdFromString } from "./registrationIds-DLSdEKSv.js";
+import { r as SigningSessionIds } from "./types-Dx9fczU7.js";
+//#region ../shared-ts/src/device-linking/contracts.ts
+function assertNeverLinkSessionStateV1(value) {
+	throw new Error(`[LinkSessionStateV1] unsupported state: ${String(value)}`);
+}
+//#endregion
+//#region ../shared-ts/src/device-linking/ed25519ExportRoot.ts
+/**
+* Authenticated relay records for the cross-device Ed25519 Yao Client export
+* root. The relay sees only public routing facts and an encrypted root.
+* Wallet-custody seed bindings deliberately have no representation here.
+*/
+/** Frozen by signer-core's Ed25519 Yao Client-root transfer module. */
+const LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1 = "x25519-hkdf-sha256-chacha20poly1305-v1";
+const X25519_PUBLIC_KEY_LENGTH = 32;
+const UNPADDED_BASE64URL = /^[A-Za-z0-9_-]+$/;
+const RECIPIENT_FIELDS = [
+	"kind",
+	"linkSessionId",
+	"walletId",
+	"walletKeyId",
+	"enrollmentId",
+	"deviceId",
+	"transferAlg",
+	"applicationBindingDigestB64u",
+	"registeredPublicKeyB64u",
+	"targetFactor",
+	"revocationEpoch",
+	"recipientPublicKeyB64u",
+	"registeredAtMs"
+];
+const PACKAGE_FIELDS = [
+	"kind",
+	"linkSessionId",
+	"walletId",
+	"walletKeyId",
+	"enrollmentId",
+	"deviceId",
+	"transferAlg",
+	"applicationBindingDigestB64u",
+	"registeredPublicKeyB64u",
+	"targetFactor",
+	"revocationEpoch",
+	"recipientPublicKeyB64u",
+	"ephemeralPublicKeyB64u",
+	"nonceB64u",
+	"sealedExportRootB64u",
+	"bindingDigestB64u",
+	"ciphertextDigestB64u",
+	"sealedAtMs"
+];
+function parseLinkedDeviceEd25519ExportRootRecipientPublicKeyB64u(value, label = "recipientPublicKeyB64u") {
+	if (typeof value !== "string" || !UNPADDED_BASE64URL.test(value)) throw new Error(`${label} must be unpadded base64url`);
+	let decoded;
+	try {
+		decoded = base64UrlDecode(value);
+	} catch {
+		throw new Error(`${label} must be valid base64url`);
+	}
+	if (base64UrlEncode(decoded) !== value) throw new Error(`${label} must be canonical base64url`);
+	if (decoded.length !== X25519_PUBLIC_KEY_LENGTH) throw new Error(`${label} must decode to a 32-byte X25519 public key`);
+	return value;
+}
+function buildLinkedDeviceEd25519ExportRootTransferBindingV1(input) {
+	return {
+		linkSessionId: input.linkSessionId,
+		walletId: input.walletId,
+		walletKeyId: input.walletKeyId,
+		targetFactor: input.targetFactor,
+		enrollmentId: input.enrollmentId,
+		deviceId: input.deviceId,
+		revocationEpoch: input.revocationEpoch,
+		applicationBindingDigestB64u: input.applicationBindingDigestB64u,
+		registeredPublicKeyB64u: input.registeredPublicKeyB64u,
+		recipientPublicKeyB64u: input.recipientPublicKeyB64u
+	};
+}
+/** Serializes exactly the six fields accepted by signer-core's AAD binding. */
+function serializeLinkedDeviceEd25519ExportRootTransferBindingV1(binding) {
+	return JSON.stringify({
+		linkSessionId: String(binding.linkSessionId),
+		walletId: String(binding.walletId),
+		walletKeyId: String(binding.walletKeyId),
+		targetFactor: binding.targetFactor,
+		enrollmentId: String(binding.enrollmentId),
+		deviceId: String(binding.deviceId),
+		revocationEpoch: binding.revocationEpoch,
+		applicationBindingDigestB64u: String(binding.applicationBindingDigestB64u),
+		registeredPublicKeyB64u: String(binding.registeredPublicKeyB64u),
+		recipientPublicKeyB64u: String(binding.recipientPublicKeyB64u)
+	});
+}
+function parseLinkedDeviceEd25519ExportRootRecipientV1(raw) {
+	const record = exactRecord$2(raw, RECIPIENT_FIELDS, "LinkedDeviceEd25519ExportRootRecipientV1");
+	if (record.kind !== "linked_device_ed25519_export_root_recipient_v1") throw new Error("LinkedDeviceEd25519ExportRootRecipientV1.kind is invalid");
+	requireTransferAlg(record.transferAlg, "LinkedDeviceEd25519ExportRootRecipientV1.transferAlg");
+	return {
+		kind: "linked_device_ed25519_export_root_recipient_v1",
+		linkSessionId: parseRequired(parseLinkDeviceSessionId(record.linkSessionId), "LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId"),
+		walletId: parseRequired(parseWalletId(record.walletId), "walletId"),
+		walletKeyId: parseRequired(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
+		enrollmentId: parseRequired(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
+		deviceId: parseRequired(parseLinkedDeviceId(record.deviceId), "deviceId"),
+		transferAlg: LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1,
+		applicationBindingDigestB64u: parseDigestField$1(record.applicationBindingDigestB64u, "applicationBindingDigestB64u"),
+		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "registeredPublicKeyB64u"),
+		targetFactor: parseTargetFactor$1(record.targetFactor),
+		revocationEpoch: parseRevocationEpoch(record.revocationEpoch, "revocationEpoch"),
+		recipientPublicKeyB64u: parseLinkedDeviceEd25519ExportRootRecipientPublicKeyB64u(record.recipientPublicKeyB64u, "recipientPublicKeyB64u"),
+		registeredAtMs: parseUnixMs(record.registeredAtMs, "registeredAtMs")
+	};
+}
+function parseLinkedDeviceEd25519ExportRootPackageV1(raw) {
+	const record = exactRecord$2(raw, PACKAGE_FIELDS, "LinkedDeviceEd25519ExportRootPackageV1");
+	if (record.kind !== "linked_device_ed25519_export_root_package_v1") throw new Error("LinkedDeviceEd25519ExportRootPackageV1.kind is invalid");
+	requireTransferAlg(record.transferAlg, "LinkedDeviceEd25519ExportRootPackageV1.transferAlg");
+	const recipientPublicKeyB64u = parseLinkedDeviceEd25519ExportRootRecipientPublicKeyB64u(record.recipientPublicKeyB64u, "recipientPublicKeyB64u");
+	const ephemeralPublicKeyB64u = parseLinkedDeviceEd25519ExportRootRecipientPublicKeyB64u(record.ephemeralPublicKeyB64u, "ephemeralPublicKeyB64u");
+	if (recipientPublicKeyB64u === ephemeralPublicKeyB64u) throw new Error("ephemeralPublicKeyB64u repeats the recipient key");
+	return {
+		kind: "linked_device_ed25519_export_root_package_v1",
+		linkSessionId: parseRequired(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
+		walletId: parseRequired(parseWalletId(record.walletId), "walletId"),
+		walletKeyId: parseRequired(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
+		enrollmentId: parseRequired(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
+		deviceId: parseRequired(parseLinkedDeviceId(record.deviceId), "deviceId"),
+		transferAlg: LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1,
+		applicationBindingDigestB64u: parseDigestField$1(record.applicationBindingDigestB64u, "applicationBindingDigestB64u"),
+		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "registeredPublicKeyB64u"),
+		targetFactor: parseTargetFactor$1(record.targetFactor),
+		revocationEpoch: parseRevocationEpoch(record.revocationEpoch, "revocationEpoch"),
+		recipientPublicKeyB64u,
+		ephemeralPublicKeyB64u,
+		nonceB64u: parseEnvelopeNonceB64u(record.nonceB64u, "nonceB64u"),
+		sealedExportRootB64u: parseEnvelopeCiphertextB64u(record.sealedExportRootB64u, "sealedExportRootB64u"),
+		bindingDigestB64u: parseDigestField$1(record.bindingDigestB64u, "bindingDigestB64u"),
+		ciphertextDigestB64u: parseDigestField$1(record.ciphertextDigestB64u, "ciphertextDigestB64u"),
+		sealedAtMs: parseUnixMs(record.sealedAtMs, "sealedAtMs")
+	};
+}
+function parseTargetFactor$1(raw) {
+	switch (exactRecord$2(raw, ["kind"], "targetFactor").kind) {
+		case "passkey_prf": return { kind: "passkey_prf" };
+		case "email_otp": return { kind: "email_otp" };
+		default: throw new Error("targetFactor.kind is unsupported");
+	}
+}
+function exactRecord$2(raw, fields, label) {
+	const record = requireRecord(raw, label);
+	rejectUnknownFields$1(record, fields, label);
+	for (const field of fields) if (record[field] === void 0) throw new Error(`${label}.${field} is required`);
+	return record;
+}
+function requireTransferAlg(value, label) {
+	if (value !== "x25519-hkdf-sha256-chacha20poly1305-v1") throw new Error(`${label} must be ${LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1}`);
+}
+function parseRevocationEpoch(value, label) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative safe integer`);
+	return value;
+}
+function parseUnixMs(value, label) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive unix-millisecond timestamp`);
+	return value;
+}
+function parseRequired(parsed, label) {
+	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
+	return parsed.value;
+}
+//#endregion
+//#region ../shared-ts/src/utils/addAuthMethodRegistration.ts
+/**
+* The canonical WebAuthn registration options for adding a wallet auth method.
+*
+* This lives in the shared package because three parties read the same record:
+* the server that mints it, the browser that passes it to
+* `navigator.credentials.create`, and the linked-device target preparation that
+* carries it to Device 2. One declaration, so a change to the ceremony cannot
+* silently diverge from what a linked device creates its passkey against.
+*
+* Everything here is fixed by the canonical add-auth-method ceremony: two
+* algorithms in a fixed order, a resident key, no attestation, and PRF
+* evaluation. Encoding them as literal types rather than open unions is what
+* makes a registration that drifted from the ceremony fail to parse instead of
+* producing a credential nothing can finalize.
+*/
+function record(value, label) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} must be an object`);
+	return value;
+}
+function token(value, label) {
+	if (typeof value !== "string") throw new Error(`${label} must be a string`);
+	const trimmed = value.trim();
+	if (!trimmed) throw new Error(`${label} must not be empty`);
+	if (trimmed !== value) throw new Error(`${label} must not be padded with whitespace`);
+	return trimmed;
+}
+/**
+* The relying party is branded at the boundary rather than at each use, so a
+* consumer cannot verify a credential against an unvalidated host string.
+*/
+function rpId(value, label) {
+	const parsed = parseWebAuthnRpId(token(value, label));
+	if (!parsed.ok) throw new Error(`${label} is invalid: ${parsed.error.message}`);
+	return parsed.value;
+}
+function literal(value, expected, label) {
+	if (value !== expected) throw new Error(`${label} must be ${String(expected)}`);
+	return expected;
+}
+/**
+* Throws on anything that is not exactly a canonical add-auth-method
+* registration. Callers that need a nullable result wrap this rather than
+* writing a second, looser reading of the same record.
+*/
+function parseWalletAddAuthMethodRegistrationOptions(raw) {
+	const label = "WalletAddAuthMethodRegistrationOptions";
+	const value = record(raw, label);
+	literal(value.kind, "webauthn_add_auth_method_registration_v1", `${label}.kind`);
+	const user = record(value.user, `${label}.user`);
+	const selection = record(value.authenticatorSelection, `${label}.authenticatorSelection`);
+	const prfEval = record(record(record(value.extensions, `${label}.extensions`).prf, `${label}.extensions.prf`).eval, `${label}.extensions.prf.eval`);
+	if (!Array.isArray(value.pubKeyCredParams) || value.pubKeyCredParams.length !== 2) throw new Error(`${label}.pubKeyCredParams must list exactly two algorithms`);
+	const [first, second] = value.pubKeyCredParams;
+	literal(record(first, `${label}.pubKeyCredParams[0]`).type, "public-key", `${label}.pubKeyCredParams[0].type`);
+	literal(record(first, `${label}.pubKeyCredParams[0]`).alg, -7, `${label}.pubKeyCredParams[0].alg`);
+	literal(record(second, `${label}.pubKeyCredParams[1]`).type, "public-key", `${label}.pubKeyCredParams[1].type`);
+	literal(record(second, `${label}.pubKeyCredParams[1]`).alg, -257, `${label}.pubKeyCredParams[1].alg`);
+	if (!Array.isArray(value.excludeCredentials)) throw new Error(`${label}.excludeCredentials must be an array`);
+	const excludeCredentials = value.excludeCredentials.map((entry, index) => {
+		const credential = record(entry, `${label}.excludeCredentials[${index}]`);
+		return {
+			type: literal(credential.type, "public-key", `${label}.excludeCredentials[${index}].type`),
+			id: token(credential.id, `${label}.excludeCredentials[${index}].id`)
+		};
+	});
+	const timeoutMs = value.timeoutMs;
+	if (typeof timeoutMs !== "number" || !Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new Error(`${label}.timeoutMs must be a positive safe integer`);
+	return {
+		kind: "webauthn_add_auth_method_registration_v1",
+		challengeId: token(value.challengeId, `${label}.challengeId`),
+		challengeB64u: token(value.challengeB64u, `${label}.challengeB64u`),
+		rpId: rpId(value.rpId, `${label}.rpId`),
+		user: {
+			idB64u: token(user.idB64u, `${label}.user.idB64u`),
+			name: token(user.name, `${label}.user.name`),
+			displayName: token(user.displayName, `${label}.user.displayName`)
+		},
+		pubKeyCredParams: [{
+			type: "public-key",
+			alg: -7
+		}, {
+			type: "public-key",
+			alg: -257
+		}],
+		authenticatorSelection: {
+			residentKey: literal(selection.residentKey, "required", `${label}.authenticatorSelection.residentKey`),
+			userVerification: literal(selection.userVerification, "preferred", `${label}.authenticatorSelection.userVerification`)
+		},
+		timeoutMs,
+		attestation: literal(value.attestation, "none", `${label}.attestation`),
+		extensions: { prf: { eval: {
+			firstB64u: token(prfEval.firstB64u, `${label}.extensions.prf.eval.firstB64u`),
+			secondB64u: token(prfEval.secondB64u, `${label}.extensions.prf.eval.secondB64u`)
+		} } },
+		excludeCredentials
+	};
+}
+//#endregion
+//#region ../shared-ts/src/utils/routerAbEd25519YaoDigests.ts
+const APPLICATION_BINDING_DOMAIN = "seams/router-ab/ed25519-yao/application-binding/v1";
+const UTF8 = new TextEncoder();
+function requireVisibleIdentifier(value, label) {
+	if (typeof value !== "string" || value.length === 0) throw new Error(`${label} must be a non-empty visible ASCII string`);
+	for (let index = 0; index < value.length; index += 1) {
+		const code = value.charCodeAt(index);
+		if (code < 33 || code > 126) throw new Error(`${label} must contain visible ASCII bytes`);
+	}
+	return value;
+}
+function requireByte(value, label) {
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > 255) throw new Error(`${label} must be a byte`);
+	return value;
+}
+function requireBytes(value, label, minimumLength, maximumLength) {
+	if (!Array.isArray(value)) throw new Error(`${label} must be a byte array`);
+	if (value.length < minimumLength || value.length > maximumLength) throw new Error(`${label} has an invalid length`);
+	const parsed = [];
+	for (let index = 0; index < value.length; index += 1) parsed.push(requireByte(value[index], `${label}[${index}]`));
+	return parsed;
+}
+function requireBytes32(value, label, nonzero) {
+	const parsed = requireBytes(value, label, 32, 32);
+	if (nonzero && isZeroBytes(parsed)) throw new Error(`${label} must be nonzero`);
+	return parsed;
+}
+function isZeroBytes(value) {
+	for (const byte of value) if (byte !== 0) return false;
+	return true;
+}
+function equalBytes(left, right) {
+	if (left.length !== right.length) return false;
+	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
+	return true;
+}
+function u32BigEndian(value) {
+	const bytes = new Uint8Array(4);
+	new DataView(bytes.buffer).setUint32(0, value, false);
+	return bytes;
+}
+function concatenateBytes(chunks) {
+	let length = 0;
+	for (const chunk of chunks) length += chunk.length;
+	const output = new Uint8Array(length);
+	let offset = 0;
+	for (const chunk of chunks) {
+		output.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return output;
+}
+function lengthDelimited(value) {
+	return concatenateBytes([u32BigEndian(value.length), value]);
+}
+function labeledField(label, value) {
+	return concatenateBytes([lengthDelimited(UTF8.encode(label)), lengthDelimited(value)]);
+}
+async function sha256(value) {
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", value);
+	return new Uint8Array(digest);
+}
+async function deriveRouterAbEd25519YaoApplicationBindingDigestV1(facts) {
+	const encoded = concatenateBytes([
+		lengthDelimited(UTF8.encode(APPLICATION_BINDING_DOMAIN)),
+		labeledField("walletId", UTF8.encode(facts.wallet_id)),
+		labeledField("nearEd25519SigningKeyId", UTF8.encode(facts.near_ed25519_signing_key_id)),
+		labeledField("signingRootId", UTF8.encode(facts.signing_root_id)),
+		labeledField("keyCreationSignerSlot", u32BigEndian(facts.key_creation_signer_slot))
+	]);
+	return Array.from(await sha256(encoded));
+}
+//#endregion
+//#region ../shared-ts/src/utils/routerAbEd25519Yao.ts
+const ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1 = "/router-ab/ed25519/yao/registration/admit";
+const ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1 = "/router-ab/ed25519/yao/registration/execute";
+const ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1 = "/router-ab/ed25519/yao/recovery/admit";
+const ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1 = "/router-ab/ed25519/yao/recovery/execute";
+const ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1 = "/router-ab/ed25519/yao/recovery/activate";
+const ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1 = "x-seams-wallet-recovery-challenge-id";
+const ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1 = "/router-ab/ed25519/yao/recovery/bootstrap";
+const ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1 = "router_ab_ed25519_yao_email_otp_recovery_v1";
+const ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1 = "/router-ab/ed25519/yao/export/admit";
+const ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1 = "/router-ab/ed25519/yao/export/execute";
+const ED25519_YAO_CONTROL_CIPHERTEXT_MAX_BYTES_V1 = 64 * 1024;
+function sameRouterAbEd25519YaoActivationBindingV1(left, right) {
+	return left.operation === right.operation && sameRouterAbEd25519YaoByteSequence(left.session_id, right.session_id) && sameRouterAbEd25519YaoByteSequence(left.stable_key_context_binding, right.stable_key_context_binding) && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation) && left.lifecycle.lifecycle_id === right.lifecycle.lifecycle_id && left.lifecycle.work_kind === right.lifecycle.work_kind && left.lifecycle.primitive_request_kind === right.lifecycle.primitive_request_kind && left.lifecycle.root_share_epoch === right.lifecycle.root_share_epoch && left.lifecycle.account_id === right.lifecycle.account_id && left.lifecycle.session_id === right.lifecycle.session_id && left.lifecycle.signer_set_id === right.lifecycle.signer_set_id && left.lifecycle.selected_server_id === right.lifecycle.selected_server_id;
+}
+function sameRouterAbEd25519YaoByteSequence(left, right) {
+	return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function sameRouterAbEd25519YaoParticipantPairV1(left, right) {
+	return left[0] === right[0] && left[1] === right[1];
+}
+function sameRouterAbEd25519YaoLifecycleScopeV1(left, right) {
+	return left.lifecycle_id === right.lifecycle_id && left.root_share_epoch === right.root_share_epoch && left.account_id === right.account_id && left.threshold_session_id === right.threshold_session_id && left.signer_set_id === right.signer_set_id && left.signing_worker_id === right.signing_worker_id && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation);
+}
+function sameRouterAbEd25519YaoApplicationBindingFactsV1(left, right) {
+	return left.wallet_id === right.wallet_id && left.near_ed25519_signing_key_id === right.near_ed25519_signing_key_id && left.signing_root_id === right.signing_root_id && left.key_creation_signer_slot === right.key_creation_signer_slot;
+}
+function sameRouterAbEd25519YaoRegistrationAdmissionRequestV1(left, right) {
+	return sameRouterAbEd25519YaoLifecycleScopeV1(left.scope, right.scope) && sameRouterAbEd25519YaoApplicationBindingFactsV1(left.application_binding, right.application_binding) && sameRouterAbEd25519YaoParticipantPairV1(left.participant_ids, right.participant_ids);
+}
+const REGISTRATION_WORK_KIND = "registration_prepare";
+const REGISTRATION_PRIMITIVE_REQUEST_KIND = "registration";
+const RECOVERY_WORK_KIND = "recovery";
+const RECOVERY_PRIMITIVE_REQUEST_KIND = "recovery";
+const EXPORT_WORK_KIND = "key_export";
+const EXPORT_PRIMITIVE_REQUEST_KIND = "export";
+function requireExactKeys(record, label, allowedKeys) {
+	const allowed = new Set(allowedKeys);
+	for (const key of Object.keys(record)) if (!allowed.has(key)) throw new Error(`${label}.${key} is not a supported field`);
+	for (const key of allowedKeys) if (!Object.hasOwn(record, key)) throw new Error(`${label}.${key} is required`);
+}
+function requirePositiveU32(value, label) {
+	if (!Number.isInteger(value) || typeof value !== "number" || value <= 0 || value > 4294967295) throw new Error(`${label} must be a positive u32`);
+	return value;
+}
+function requirePositiveSafeInteger(value, label) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
+	return value;
+}
+function parseOperation(value, label) {
+	switch (value) {
+		case "registration":
+		case "recovery":
+		case "refresh":
+		case "export":
+		case "lane_provisioning":
+		case "lane_refresh": return value;
+		default: throw new Error(`${label} is invalid`);
+	}
+}
+function parseDeriverRole(value, label) {
+	switch (value) {
+		case "deriver_a":
+		case "deriver_b": return value;
+		default: throw new Error(`${label} is invalid`);
+	}
+}
+function parseInputKind(value, label) {
+	switch (value) {
+		case "activation":
+		case "export": return value;
+		default: throw new Error(`${label} is invalid`);
+	}
+}
+function parsePackageKind(value, label) {
+	switch (value) {
+		case "activation_client":
+		case "activation_signing_worker":
+		case "export_client": return value;
+		default: throw new Error(`${label} is invalid`);
+	}
+}
+function parseWorkKind(value, label) {
+	switch (value) {
+		case "registration_prepare":
+		case "key_export":
+		case "recovery":
+		case "server_share_refresh": return value;
+		default: throw new Error(`${label} is invalid`);
+	}
+}
+function parsePrimitiveRequestKind(value, label) {
+	switch (value) {
+		case "registration":
+		case "recovery":
+		case "export":
+		case "refresh": return value;
+		default: throw new Error(`${label} is invalid`);
+	}
+}
+function parseRouterAbEd25519YaoApplicationBindingFactsV1(value) {
+	const record = requireRecord(value, "application_binding");
+	requireExactKeys(record, "application_binding", [
+		"wallet_id",
+		"near_ed25519_signing_key_id",
+		"signing_root_id",
+		"key_creation_signer_slot"
+	]);
+	return {
+		wallet_id: requireVisibleIdentifier(record.wallet_id, "application_binding.wallet_id"),
+		near_ed25519_signing_key_id: requireVisibleIdentifier(record.near_ed25519_signing_key_id, "application_binding.near_ed25519_signing_key_id"),
+		signing_root_id: requireVisibleIdentifier(record.signing_root_id, "application_binding.signing_root_id"),
+		key_creation_signer_slot: requirePositiveU32(record.key_creation_signer_slot, "application_binding.key_creation_signer_slot")
+	};
+}
+function parsePublicLifecycleScope(value) {
+	const record = requireRecord(value, "scope");
+	requireExactKeys(record, "scope", [
+		"lifecycle_id",
+		"root_share_epoch",
+		"account_id",
+		"threshold_session_id",
+		"signer_set_id",
+		"signing_worker_id",
+		"material_activation"
+	]);
+	const accountId = requireVisibleIdentifier(record.account_id, "scope.account_id");
+	const signingWorkerId = requireVisibleIdentifier(record.signing_worker_id, "scope.signing_worker_id");
+	const materialActivation = parseRouterAbMpcMaterialActivationRef(record.material_activation);
+	if (materialActivation.material_owner !== accountId || materialActivation.signing_worker !== signingWorkerId) throw new Error("scope.material_activation does not match the lifecycle owner and worker");
+	return {
+		lifecycle_id: requireVisibleIdentifier(record.lifecycle_id, "scope.lifecycle_id"),
+		root_share_epoch: requireVisibleIdentifier(record.root_share_epoch, "scope.root_share_epoch"),
+		account_id: accountId,
+		threshold_session_id: requireVisibleIdentifier(record.threshold_session_id, "scope.threshold_session_id"),
+		signer_set_id: requireVisibleIdentifier(record.signer_set_id, "scope.signer_set_id"),
+		signing_worker_id: signingWorkerId,
+		material_activation: materialActivation
+	};
+}
+function parseParticipantIds$1(value) {
+	if (!Array.isArray(value) || value.length !== 2) throw new Error("participant_ids must contain exactly two values");
+	const first = requirePositiveU32(value[0], "participant_ids[0]");
+	const second = requirePositiveU32(value[1], "participant_ids[1]");
+	if (first > 65535 || second > 65535 || first >= second) throw new Error("participant_ids must be distinct, nonzero, ascending u16 values");
+	return [first, second];
+}
+function parseRouterAbEd25519YaoParticipantIdsV1(value) {
+	return parseParticipantIds$1(value);
+}
+function parseAdmittedLifecycle(value) {
+	const record = requireRecord(value, "binding.lifecycle");
+	requireExactKeys(record, "binding.lifecycle", [
+		"lifecycle_id",
+		"work_kind",
+		"primitive_request_kind",
+		"root_share_epoch",
+		"account_id",
+		"session_id",
+		"signer_set_id",
+		"selected_server_id"
+	]);
+	const lifecycle = {
+		lifecycle_id: requireVisibleIdentifier(record.lifecycle_id, "binding.lifecycle.lifecycle_id"),
+		work_kind: parseWorkKind(record.work_kind, "binding.lifecycle.work_kind"),
+		primitive_request_kind: parsePrimitiveRequestKind(record.primitive_request_kind, "binding.lifecycle.primitive_request_kind"),
+		root_share_epoch: requireVisibleIdentifier(record.root_share_epoch, "binding.lifecycle.root_share_epoch"),
+		account_id: requireVisibleIdentifier(record.account_id, "binding.lifecycle.account_id"),
+		session_id: requireVisibleIdentifier(record.session_id, "binding.lifecycle.session_id"),
+		signer_set_id: requireVisibleIdentifier(record.signer_set_id, "binding.lifecycle.signer_set_id"),
+		selected_server_id: requireVisibleIdentifier(record.selected_server_id, "binding.lifecycle.selected_server_id")
+	};
+	if (lifecycle.work_kind === REGISTRATION_WORK_KIND && lifecycle.primitive_request_kind !== REGISTRATION_PRIMITIVE_REQUEST_KIND) throw new Error("binding.lifecycle primitive request kind does not match its work kind");
+	if (lifecycle.work_kind === RECOVERY_WORK_KIND && lifecycle.primitive_request_kind !== RECOVERY_PRIMITIVE_REQUEST_KIND) throw new Error("binding.lifecycle primitive request kind does not match its work kind");
+	if (lifecycle.work_kind === EXPORT_WORK_KIND && lifecycle.primitive_request_kind !== EXPORT_PRIMITIVE_REQUEST_KIND) throw new Error("binding.lifecycle primitive request kind does not match its work kind");
+	return lifecycle;
+}
+function parseCeremonyBinding(value) {
+	const record = requireRecord(value, "binding");
+	requireExactKeys(record, "binding", [
+		"lifecycle",
+		"operation",
+		"session_id",
+		"stable_key_context_binding",
+		"material_activation"
+	]);
+	const binding = {
+		lifecycle: parseAdmittedLifecycle(record.lifecycle),
+		operation: parseOperation(record.operation, "binding.operation"),
+		session_id: requireBytes32(record.session_id, "binding.session_id", true),
+		stable_key_context_binding: requireBytes32(record.stable_key_context_binding, "binding.stable_key_context_binding", false),
+		material_activation: parseRouterAbMpcMaterialActivationRef(record.material_activation)
+	};
+	if (binding.operation === "registration" && binding.lifecycle.work_kind !== REGISTRATION_WORK_KIND) throw new Error("binding operation does not match its lifecycle work kind");
+	if (binding.operation === "recovery" && binding.lifecycle.work_kind !== RECOVERY_WORK_KIND) throw new Error("binding operation does not match its lifecycle work kind");
+	if (binding.operation === "export" && binding.lifecycle.work_kind !== EXPORT_WORK_KIND) throw new Error("binding operation does not match its lifecycle work kind");
+	if (binding.material_activation.material_owner !== binding.lifecycle.account_id || binding.material_activation.signing_worker !== binding.lifecycle.selected_server_id) throw new Error("binding material activation does not match its lifecycle owner and worker");
+	return binding;
+}
+function parseRouterAbEd25519YaoCeremonyBindingV1(value) {
+	return parseCeremonyBinding(value);
+}
+function requireExportCeremonyBinding(value) {
+	const binding = parseCeremonyBinding(value);
+	if (binding.operation !== "export" || binding.lifecycle.work_kind !== EXPORT_WORK_KIND || binding.lifecycle.primitive_request_kind !== EXPORT_PRIMITIVE_REQUEST_KIND) throw new Error("export binding requires the exact export lifecycle");
+	return {
+		lifecycle: {
+			lifecycle_id: binding.lifecycle.lifecycle_id,
+			work_kind: EXPORT_WORK_KIND,
+			primitive_request_kind: EXPORT_PRIMITIVE_REQUEST_KIND,
+			root_share_epoch: binding.lifecycle.root_share_epoch,
+			account_id: binding.lifecycle.account_id,
+			session_id: binding.lifecycle.session_id,
+			signer_set_id: binding.lifecycle.signer_set_id,
+			selected_server_id: binding.lifecycle.selected_server_id
+		},
+		operation: "export",
+		session_id: binding.session_id,
+		stable_key_context_binding: binding.stable_key_context_binding,
+		material_activation: binding.material_activation
+	};
+}
+function parseExportBinding(value) {
+	const record = requireRecord(value, "export binding");
+	requireExactKeys(record, "export binding", [
+		"ceremony",
+		"registered_public_key",
+		"state_epoch",
+		"runtime_policy_binding",
+		"authorization_digest"
+	]);
+	return {
+		ceremony: requireExportCeremonyBinding(record.ceremony),
+		registered_public_key: requireBytes32(record.registered_public_key, "export binding.registered_public_key", true),
+		state_epoch: requirePositiveSafeInteger(record.state_epoch, "export binding.state_epoch"),
+		runtime_policy_binding: requireBytes32(record.runtime_policy_binding, "export binding.runtime_policy_binding", true),
+		authorization_digest: requireBytes32(record.authorization_digest, "export binding.authorization_digest", true)
+	};
+}
+function requireActivationBinding(binding) {
+	switch (binding.operation) {
+		case "registration":
+			if (binding.lifecycle.work_kind !== REGISTRATION_WORK_KIND || binding.lifecycle.primitive_request_kind !== REGISTRATION_PRIMITIVE_REQUEST_KIND) throw new Error("activation binding has the wrong registration lifecycle kind");
+			return {
+				lifecycle: {
+					lifecycle_id: binding.lifecycle.lifecycle_id,
+					work_kind: REGISTRATION_WORK_KIND,
+					primitive_request_kind: REGISTRATION_PRIMITIVE_REQUEST_KIND,
+					root_share_epoch: binding.lifecycle.root_share_epoch,
+					account_id: binding.lifecycle.account_id,
+					session_id: binding.lifecycle.session_id,
+					signer_set_id: binding.lifecycle.signer_set_id,
+					selected_server_id: binding.lifecycle.selected_server_id
+				},
+				operation: "registration",
+				session_id: binding.session_id,
+				stable_key_context_binding: binding.stable_key_context_binding,
+				material_activation: binding.material_activation
+			};
+		case "recovery":
+			if (binding.lifecycle.work_kind !== RECOVERY_WORK_KIND || binding.lifecycle.primitive_request_kind !== RECOVERY_PRIMITIVE_REQUEST_KIND) throw new Error("activation binding has the wrong recovery lifecycle kind");
+			return {
+				lifecycle: {
+					lifecycle_id: binding.lifecycle.lifecycle_id,
+					work_kind: RECOVERY_WORK_KIND,
+					primitive_request_kind: RECOVERY_PRIMITIVE_REQUEST_KIND,
+					root_share_epoch: binding.lifecycle.root_share_epoch,
+					account_id: binding.lifecycle.account_id,
+					session_id: binding.lifecycle.session_id,
+					signer_set_id: binding.lifecycle.signer_set_id,
+					selected_server_id: binding.lifecycle.selected_server_id
+				},
+				operation: "recovery",
+				session_id: binding.session_id,
+				stable_key_context_binding: binding.stable_key_context_binding,
+				material_activation: binding.material_activation
+			};
+		case "refresh":
+		case "export":
+		case "lane_provisioning":
+		case "lane_refresh": throw new Error("activation binding has a non-activation operation");
+	}
+}
+function parseKeyset(value) {
+	const record = requireRecord(value, "keyset");
+	requireExactKeys(record, "keyset", [
+		"deriver_a_input_public_key",
+		"deriver_b_input_public_key",
+		"signing_worker_recipient_public_key"
+	]);
+	const keyset = {
+		deriver_a_input_public_key: requireBytes32(record.deriver_a_input_public_key, "keyset.deriver_a_input_public_key", true),
+		deriver_b_input_public_key: requireBytes32(record.deriver_b_input_public_key, "keyset.deriver_b_input_public_key", true),
+		signing_worker_recipient_public_key: requireBytes32(record.signing_worker_recipient_public_key, "keyset.signing_worker_recipient_public_key", true)
+	};
+	if (equalBytes(keyset.deriver_a_input_public_key, keyset.deriver_b_input_public_key) || equalBytes(keyset.deriver_a_input_public_key, keyset.signing_worker_recipient_public_key) || equalBytes(keyset.deriver_b_input_public_key, keyset.signing_worker_recipient_public_key)) throw new Error("keyset public keys must be distinct");
+	return keyset;
+}
+function parseEncryptedInput(value, label) {
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"kind",
+		"deriver",
+		"operation",
+		"session",
+		"stable_context_binding",
+		"encapsulated_key",
+		"ciphertext"
+	]);
+	const input = {
+		kind: parseInputKind(record.kind, `${label}.kind`),
+		deriver: parseDeriverRole(record.deriver, `${label}.deriver`),
+		operation: parseOperation(record.operation, `${label}.operation`),
+		session: requireBytes32(record.session, `${label}.session`, true),
+		stable_context_binding: requireBytes32(record.stable_context_binding, `${label}.stable_context_binding`, true),
+		encapsulated_key: requireBytes32(record.encapsulated_key, `${label}.encapsulated_key`, true),
+		ciphertext: requireBytes(record.ciphertext, `${label}.ciphertext`, 16, ED25519_YAO_CONTROL_CIPHERTEXT_MAX_BYTES_V1)
+	};
+	if (input.kind === "activation" && input.operation === "export") throw new Error(`${label} operation does not match its circuit family`);
+	if (input.kind === "export" && input.operation !== "export") throw new Error(`${label} operation does not match its circuit family`);
+	return input;
+}
+function requireActivationInput(binding, input, expectedDeriver, label) {
+	if (input.kind !== "activation" || input.deriver !== expectedDeriver || input.operation !== binding.operation || !equalBytes(input.session, binding.session_id) || !equalBytes(input.stable_context_binding, binding.stable_key_context_binding)) throw new Error(`${label} does not match the admitted activation binding`);
+	switch (binding.operation) {
+		case "registration": return {
+			kind: "activation",
+			deriver: expectedDeriver,
+			operation: "registration",
+			session: input.session,
+			stable_context_binding: input.stable_context_binding,
+			encapsulated_key: input.encapsulated_key,
+			ciphertext: input.ciphertext
+		};
+		case "recovery": return {
+			kind: "activation",
+			deriver: expectedDeriver,
+			operation: "recovery",
+			session: input.session,
+			stable_context_binding: input.stable_context_binding,
+			encapsulated_key: input.encapsulated_key,
+			ciphertext: input.ciphertext
+		};
+	}
+}
+function requireExportInput(binding, input, expectedDeriver, label) {
+	if (input.kind !== "export" || input.deriver !== expectedDeriver || input.operation !== "export" || !equalBytes(input.session, binding.ceremony.session_id) || !equalBytes(input.stable_context_binding, binding.ceremony.stable_key_context_binding)) throw new Error(`${label} does not match the admitted export binding`);
+	return {
+		kind: "export",
+		deriver: expectedDeriver,
+		operation: "export",
+		session: input.session,
+		stable_context_binding: input.stable_context_binding,
+		encapsulated_key: input.encapsulated_key,
+		ciphertext: input.ciphertext
+	};
+}
+function parseEncryptedPackage(value, label) {
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"kind",
+		"deriver",
+		"session",
+		"transcript",
+		"encapsulated_key",
+		"ciphertext"
+	]);
+	return {
+		kind: parsePackageKind(record.kind, `${label}.kind`),
+		deriver: parseDeriverRole(record.deriver, `${label}.deriver`),
+		session: requireBytes32(record.session, `${label}.session`, true),
+		transcript: requireBytes32(record.transcript, `${label}.transcript`, true),
+		encapsulated_key: requireBytes32(record.encapsulated_key, `${label}.encapsulated_key`, true),
+		ciphertext: requireBytes(record.ciphertext, `${label}.ciphertext`, 16, ED25519_YAO_CONTROL_CIPHERTEXT_MAX_BYTES_V1)
+	};
+}
+function parseRouterAbEd25519YaoActivationPublicReceiptV1(value) {
+	const record = requireRecord(value, "public_receipt");
+	requireExactKeys(record, "public_receipt", [
+		"transcript",
+		"registered_public_key",
+		"joined_client_commitment",
+		"joined_signing_worker_commitment",
+		"signing_worker_verifying_share",
+		"state_epoch",
+		"material_activation"
+	]);
+	return {
+		transcript: requireBytes32(record.transcript, "public_receipt.transcript", true),
+		registered_public_key: requireBytes32(record.registered_public_key, "public_receipt.registered_public_key", true),
+		joined_client_commitment: requireBytes32(record.joined_client_commitment, "public_receipt.joined_client_commitment", true),
+		joined_signing_worker_commitment: requireBytes32(record.joined_signing_worker_commitment, "public_receipt.joined_signing_worker_commitment", true),
+		signing_worker_verifying_share: requireBytes32(record.signing_worker_verifying_share, "public_receipt.signing_worker_verifying_share", true),
+		state_epoch: requirePositiveSafeInteger(record.state_epoch, "public_receipt.state_epoch"),
+		material_activation: parseRouterAbMpcMaterialActivationRef(record.material_activation)
+	};
+}
+function requireActivationClientPackage(binding, receipt, packageValue, expectedDeriver, label) {
+	if (packageValue.kind !== "activation_client" || packageValue.deriver !== expectedDeriver || !equalBytes(packageValue.session, binding.session_id) || !equalBytes(packageValue.transcript, receipt.transcript)) throw new Error(`${label} does not match the terminal activation receipt`);
+	return {
+		kind: "activation_client",
+		deriver: expectedDeriver,
+		session: packageValue.session,
+		transcript: packageValue.transcript,
+		encapsulated_key: packageValue.encapsulated_key,
+		ciphertext: packageValue.ciphertext
+	};
+}
+function requireExportClientPackage(binding, transcript, packageValue, expectedDeriver, label) {
+	if (packageValue.kind !== "export_client" || packageValue.deriver !== expectedDeriver || !equalBytes(packageValue.session, binding.ceremony.session_id) || !equalBytes(packageValue.transcript, transcript)) throw new Error(`${label} does not match the terminal export result`);
+	return {
+		kind: "export_client",
+		deriver: expectedDeriver,
+		session: packageValue.session,
+		transcript: packageValue.transcript,
+		encapsulated_key: packageValue.encapsulated_key,
+		ciphertext: packageValue.ciphertext
+	};
+}
+function parseBoundary(parser, value) {
+	try {
+		return {
+			ok: true,
+			value: parser(value)
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+function parseRegistrationAdmissionRequestValue(value) {
+	const record = requireRecord(value, "registration admission request");
+	requireExactKeys(record, "registration admission request", [
+		"scope",
+		"application_binding",
+		"participant_ids"
+	]);
+	return {
+		scope: parsePublicLifecycleScope(record.scope),
+		application_binding: parseRouterAbEd25519YaoApplicationBindingFactsV1(record.application_binding),
+		participant_ids: parseParticipantIds$1(record.participant_ids)
+	};
+}
+function parseRecoveryAdmissionRequestValue(value) {
+	const record = requireRecord(value, "recovery admission request");
+	requireExactKeys(record, "recovery admission request", [
+		"scope",
+		"active_material_activation",
+		"application_binding",
+		"participant_ids",
+		"active_capability_binding",
+		"replacement_capability_binding",
+		"registered_public_key"
+	]);
+	const activeCapabilityBinding = requireBytes32(record.active_capability_binding, "recovery admission request.active_capability_binding", true);
+	const replacementCapabilityBinding = requireBytes32(record.replacement_capability_binding, "recovery admission request.replacement_capability_binding", true);
+	if (equalBytes(activeCapabilityBinding, replacementCapabilityBinding)) throw new Error("recovery replacement capability binding must be fresh");
+	const scope = parsePublicLifecycleScope(record.scope);
+	const activeMaterialActivation = parseRouterAbMpcMaterialActivationRef(record.active_material_activation);
+	const replacementMaterialActivation = scope.material_activation;
+	if (activeMaterialActivation.activation_id === replacementMaterialActivation.activation_id || activeMaterialActivation.lifecycle_binding === replacementMaterialActivation.lifecycle_binding) throw new Error("recovery replacement material activation identity must be fresh");
+	if (activeMaterialActivation.capability !== replacementMaterialActivation.capability || activeMaterialActivation.material_owner !== replacementMaterialActivation.material_owner || activeMaterialActivation.key_binding !== replacementMaterialActivation.key_binding || activeMaterialActivation.signing_worker !== replacementMaterialActivation.signing_worker) throw new Error("recovery replacement material activation changed stable identity facts");
+	return {
+		scope,
+		active_material_activation: activeMaterialActivation,
+		application_binding: parseRouterAbEd25519YaoApplicationBindingFactsV1(record.application_binding),
+		participant_ids: parseParticipantIds$1(record.participant_ids),
+		active_capability_binding: activeCapabilityBinding,
+		replacement_capability_binding: replacementCapabilityBinding,
+		registered_public_key: requireBytes32(record.registered_public_key, "recovery admission request.registered_public_key", true)
+	};
+}
+function parseWarmRecoveryBootstrapRequestValue(value) {
+	const record = requireRecord(value, "warm recovery bootstrap request");
+	requireExactKeys(record, "warm recovery bootstrap request", [
+		"kind",
+		"walletId",
+		"nearAccountId",
+		"nearEd25519SigningKeyId",
+		"signerSlot",
+		"thresholdSessionId",
+		"signingWorkerId",
+		"participantIds"
+	]);
+	if (record.kind !== "router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1") throw new Error("warm recovery bootstrap request.kind is invalid");
+	return {
+		kind: "router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1",
+		walletId: requireVisibleIdentifier(record.walletId, "warm recovery bootstrap request.walletId"),
+		nearAccountId: requireVisibleIdentifier(record.nearAccountId, "warm recovery bootstrap request.nearAccountId"),
+		nearEd25519SigningKeyId: requireVisibleIdentifier(record.nearEd25519SigningKeyId, "warm recovery bootstrap request.nearEd25519SigningKeyId"),
+		signerSlot: requirePositiveSafeInteger(record.signerSlot, "warm recovery bootstrap request.signerSlot"),
+		thresholdSessionId: requireVisibleIdentifier(record.thresholdSessionId, "warm recovery bootstrap request.thresholdSessionId"),
+		signingWorkerId: requireVisibleIdentifier(record.signingWorkerId, "warm recovery bootstrap request.signingWorkerId"),
+		participantIds: parseParticipantIds$1(record.participantIds)
+	};
+}
+function parseExportAdmissionReceiptValue(value) {
+	const record = requireRecord(value, "export admission receipt");
+	requireExactKeys(record, "export admission receipt", ["binding", "keyset"]);
+	return {
+		binding: parseExportBinding(record.binding),
+		keyset: parseKeyset(record.keyset)
+	};
+}
+function parseExportExecuteRequestValue(value) {
+	const record = requireRecord(value, "export execute request");
+	requireExactKeys(record, "export execute request", [
+		"binding",
+		"deriver_a_input",
+		"deriver_b_input"
+	]);
+	const binding = parseExportBinding(record.binding);
+	return {
+		binding,
+		deriver_a_input: requireExportInput(binding, parseEncryptedInput(record.deriver_a_input, "deriver_a_input"), "deriver_a", "deriver_a_input"),
+		deriver_b_input: requireExportInput(binding, parseEncryptedInput(record.deriver_b_input, "deriver_b_input"), "deriver_b", "deriver_b_input")
+	};
+}
+function parseExportResultValue(value) {
+	const record = requireRecord(value, "export result");
+	requireExactKeys(record, "export result", [
+		"binding",
+		"transcript",
+		"deriver_a_client_package",
+		"deriver_b_client_package"
+	]);
+	const binding = parseExportBinding(record.binding);
+	const transcript = requireBytes32(record.transcript, "export result.transcript", true);
+	return {
+		binding,
+		transcript,
+		deriver_a_client_package: requireExportClientPackage(binding, transcript, parseEncryptedPackage(record.deriver_a_client_package, "deriver_a_client_package"), "deriver_a", "deriver_a_client_package"),
+		deriver_b_client_package: requireExportClientPackage(binding, transcript, parseEncryptedPackage(record.deriver_b_client_package, "deriver_b_client_package"), "deriver_b", "deriver_b_client_package")
+	};
+}
+function parseActivationAdmissionReceiptValue(value) {
+	const record = requireRecord(value, "activation admission receipt");
+	requireExactKeys(record, "activation admission receipt", ["binding", "keyset"]);
+	const binding = requireActivationBinding(parseCeremonyBinding(record.binding));
+	const keyset = parseKeyset(record.keyset);
+	switch (binding.operation) {
+		case "registration": return {
+			binding,
+			keyset
+		};
+		case "recovery": return {
+			binding,
+			keyset
+		};
+	}
+}
+function parseActivationExecuteRequestValue(value) {
+	const record = requireRecord(value, "activation execute request");
+	requireExactKeys(record, "activation execute request", [
+		"binding",
+		"deriver_a_input",
+		"deriver_b_input"
+	]);
+	const binding = requireActivationBinding(parseCeremonyBinding(record.binding));
+	const deriverAInput = requireActivationInput(binding, parseEncryptedInput(record.deriver_a_input, "deriver_a_input"), "deriver_a", "deriver_a_input");
+	const deriverBInput = requireActivationInput(binding, parseEncryptedInput(record.deriver_b_input, "deriver_b_input"), "deriver_b", "deriver_b_input");
+	if (binding.operation === "registration") {
+		if (deriverAInput.operation !== "registration" || deriverBInput.operation !== "registration") throw new Error("activation inputs do not match registration binding");
+		return {
+			binding,
+			deriver_a_input: deriverAInput,
+			deriver_b_input: deriverBInput
+		};
+	}
+	if (deriverAInput.operation !== "recovery" || deriverBInput.operation !== "recovery") throw new Error("activation inputs do not match recovery binding");
+	return {
+		binding,
+		deriver_a_input: deriverAInput,
+		deriver_b_input: deriverBInput
+	};
+}
+function parseActivationResultValue(value) {
+	const record = requireRecord(value, "activation result");
+	requireExactKeys(record, "activation result", [
+		"binding",
+		"deriver_a_client_package",
+		"deriver_b_client_package",
+		"public_receipt"
+	]);
+	const binding = requireActivationBinding(parseCeremonyBinding(record.binding));
+	const receipt = parseRouterAbEd25519YaoActivationPublicReceiptV1(record.public_receipt);
+	if (!sameRouterAbMpcMaterialActivationRef(binding.material_activation, receipt.material_activation)) throw new Error("activation result receipt material does not match the admitted binding");
+	const packageA = parseEncryptedPackage(record.deriver_a_client_package, "deriver_a_client_package");
+	const packageB = parseEncryptedPackage(record.deriver_b_client_package, "deriver_b_client_package");
+	const deriverAPackage = requireActivationClientPackage(binding, receipt, packageA, "deriver_a", "deriver_a_client_package");
+	const deriverBPackage = requireActivationClientPackage(binding, receipt, packageB, "deriver_b", "deriver_b_client_package");
+	switch (binding.operation) {
+		case "registration": return {
+			binding,
+			deriver_a_client_package: deriverAPackage,
+			deriver_b_client_package: deriverBPackage,
+			public_receipt: receipt
+		};
+		case "recovery": return {
+			binding,
+			deriver_a_client_package: deriverAPackage,
+			deriver_b_client_package: deriverBPackage,
+			public_receipt: receipt
+		};
+	}
+}
+function requireRecoveryBinding(value) {
+	const binding = requireActivationBinding(parseCeremonyBinding(value));
+	switch (binding.operation) {
+		case "registration": throw new Error("recovery activation requires a recovery binding");
+		case "recovery": return binding;
+	}
+}
+function parseRecoveryActivationReceiptValue(value) {
+	const record = requireRecord(value, "recovery activation receipt");
+	requireExactKeys(record, "recovery activation receipt", [
+		"binding",
+		"public_receipt",
+		"active_capability_binding",
+		"retired_capability_binding"
+	]);
+	const activeCapabilityBinding = requireBytes32(record.active_capability_binding, "recovery activation receipt.active_capability_binding", true);
+	const retiredCapabilityBinding = requireBytes32(record.retired_capability_binding, "recovery activation receipt.retired_capability_binding", true);
+	if (equalBytes(activeCapabilityBinding, retiredCapabilityBinding)) throw new Error("recovery activation receipt capability bindings must be distinct");
+	return {
+		binding: requireRecoveryBinding(record.binding),
+		public_receipt: parseRouterAbEd25519YaoActivationPublicReceiptV1(record.public_receipt),
+		active_capability_binding: activeCapabilityBinding,
+		retired_capability_binding: retiredCapabilityBinding
+	};
+}
+function isActivationAdmissionReceiptFor(value, operation) {
+	return value.binding.operation === operation;
+}
+function isActivationExecuteRequestFor(value, operation) {
+	return value.binding.operation === operation;
+}
+function isActivationResultFor(value, operation) {
+	return value.binding.operation === operation;
+}
+function operationMismatch(operation) {
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: `activation value must use the ${operation} operation`
+	};
+}
+function parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(value) {
+	return parseBoundary(parseRegistrationAdmissionRequestValue, value);
+}
+function parseRouterAbEd25519YaoRecoveryAdmissionRequestV1(value) {
+	return parseBoundary(parseRecoveryAdmissionRequestValue, value);
+}
+function parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1(value) {
+	return parseBoundary(parseWarmRecoveryBootstrapRequestValue, value);
+}
+function parseRouterAbEd25519YaoExportAdmissionReceiptV1(value) {
+	return parseBoundary(parseExportAdmissionReceiptValue, value);
+}
+function parseRouterAbEd25519YaoExportExecuteRequestV1(value) {
+	return parseBoundary(parseExportExecuteRequestValue, value);
+}
+function parseRouterAbEd25519YaoExportResultV1(value) {
+	return parseBoundary(parseExportResultValue, value);
+}
+function parseRouterAbEd25519YaoActivationAdmissionReceiptV1(value) {
+	return parseBoundary(parseActivationAdmissionReceiptValue, value);
+}
+function parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(value) {
+	const parsed = parseRouterAbEd25519YaoActivationAdmissionReceiptV1(value);
+	if (!parsed.ok) return parsed;
+	if (!isActivationAdmissionReceiptFor(parsed.value, "registration")) return operationMismatch("registration");
+	return {
+		ok: true,
+		value: parsed.value
+	};
+}
+function parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1(value) {
+	const parsed = parseRouterAbEd25519YaoActivationAdmissionReceiptV1(value);
+	if (!parsed.ok) return parsed;
+	if (!isActivationAdmissionReceiptFor(parsed.value, "recovery")) return operationMismatch("recovery");
+	return {
+		ok: true,
+		value: parsed.value
+	};
+}
+function parseRouterAbEd25519YaoActivationExecuteRequestV1(value) {
+	return parseBoundary(parseActivationExecuteRequestValue, value);
+}
+function parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1(value) {
+	const parsed = parseRouterAbEd25519YaoActivationExecuteRequestV1(value);
+	if (!parsed.ok) return parsed;
+	if (!isActivationExecuteRequestFor(parsed.value, "registration")) return operationMismatch("registration");
+	return {
+		ok: true,
+		value: parsed.value
+	};
+}
+function parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1(value) {
+	const parsed = parseRouterAbEd25519YaoActivationExecuteRequestV1(value);
+	if (!parsed.ok) return parsed;
+	if (!isActivationExecuteRequestFor(parsed.value, "recovery")) return operationMismatch("recovery");
+	return {
+		ok: true,
+		value: parsed.value
+	};
+}
+function parseRouterAbEd25519YaoActivationResultV1(value) {
+	return parseBoundary(parseActivationResultValue, value);
+}
+function parseRouterAbEd25519YaoRegistrationActivationResultV1(value) {
+	const parsed = parseRouterAbEd25519YaoActivationResultV1(value);
+	if (!parsed.ok) return parsed;
+	if (!isActivationResultFor(parsed.value, "registration")) return operationMismatch("registration");
+	return {
+		ok: true,
+		value: parsed.value
+	};
+}
+function parseRouterAbEd25519YaoRecoveryActivationResultV1(value) {
+	const parsed = parseRouterAbEd25519YaoActivationResultV1(value);
+	if (!parsed.ok) return parsed;
+	if (!isActivationResultFor(parsed.value, "recovery")) return operationMismatch("recovery");
+	return {
+		ok: true,
+		value: parsed.value
+	};
+}
+function parseRouterAbEd25519YaoRecoveryActivationReceiptV1(value) {
+	return parseBoundary(parseRecoveryActivationReceiptValue, value);
+}
+function parseRouterAbEd25519YaoEncryptedPackageV1(value) {
+	return parseBoundary(parseEncryptedPackageValue, value);
+}
+function parseEncryptedPackageValue(value) {
+	return parseEncryptedPackage(value, "encrypted_package");
+}
+//#endregion
+//#region ../shared-ts/src/device-linking/sourceContribution.ts
+/** Exact discriminator accepted by the ECDSA source-contribution core. */
+const LINKED_DEVICE_ECDSA_SOURCE_CONTRIBUTION_ENVELOPE_KIND_V1 = "seams/linked-device/ecdsa-source-contribution-envelope/v1";
+function parseLinkedDeviceOrdinaryMaterialSourceContributionV1(raw) {
+	const record = requireRecordCopy(raw, "linked-device ordinary source contribution");
+	switch (record.kind) {
+		case "linked_device_ed25519_source_contribution_v1": return parseEd25519Contribution(record);
+		case "linked_device_ecdsa_source_contribution_v1": return parseEcdsaContribution(record);
+		default: throw new Error("linked-device ordinary source contribution kind is invalid");
+	}
+}
+function parseLinkedDeviceEd25519SourcePreservingReservationV1(raw) {
+	const record = exactRecord$1(raw, [
+		"state",
+		"reservation_id",
+		"participant_ids",
+		"activation_receipt",
+		"deriver_a_client_package",
+		"deriver_b_client_package"
+	], "linked-device Ed25519 source-preserving reservation");
+	if (record.state !== "inactive") throw new Error("linked-device Ed25519 source-preserving reservation is not inactive");
+	const activationReceipt = parseRouterAbEd25519YaoActivationPublicReceiptV1(record.activation_receipt);
+	const participantIds = parseRouterAbEd25519YaoParticipantIdsV1(record.participant_ids);
+	const deriverA = parseEd25519ClientPackage$1(record.deriver_a_client_package, "deriver_a");
+	const deriverB = parseEd25519ClientPackage$1(record.deriver_b_client_package, "deriver_b");
+	if (!sameBytes$1(activationReceipt.transcript, deriverA.transcript) || !sameBytes$1(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 reservation packages have mismatched transcripts");
+	return {
+		state: "inactive",
+		reservationId: requireText(record.reservation_id, "reservation_id"),
+		participantIds,
+		activationReceipt,
+		deriver_a_client_package: deriverA,
+		deriver_b_client_package: deriverB
+	};
+}
+function parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1(raw) {
+	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 2) throw new Error("linked-device ordinary source contributions must contain one or two entries");
+	const contributions = raw.map(parseLinkedDeviceOrdinaryMaterialSourceContributionV1);
+	const families = contributions.map((entry) => entry.keyFamily);
+	if (new Set(families).size !== families.length) throw new Error("linked-device ordinary source contributions repeat a key family");
+	if (contributions.length === 2 && (contributions[0]?.keyFamily !== "ed25519" || contributions[1]?.keyFamily !== "ecdsa_secp256k1")) throw new Error("linked-device ordinary source contributions must be Ed25519 then ECDSA");
+	const first = contributions[0];
+	if (!first) throw new Error("linked-device ordinary source contributions are empty");
+	return [first, ...contributions.slice(1)];
+}
+function parseLinkedDeviceEcdsaSourceContributionPreparationV1(raw) {
+	const record = exactRecord$1(raw, [
+		"linkSessionId",
+		"enrollmentId",
+		"sourceAuthorityId",
+		"source",
+		"target"
+	], "linked-device ECDSA source contribution preparation");
+	const source = parseEcdsaSourceSigner(record.source);
+	const target = parseEcdsaTarget(record.target);
+	assertEcdsaSourceTargetActivations(source.activation, target.activation);
+	return {
+		linkSessionId: parseSessionId(record.linkSessionId),
+		enrollmentId: parseEnrollmentId(record.enrollmentId),
+		sourceAuthorityId: parseAuthorityId(record.sourceAuthorityId),
+		source,
+		target
+	};
+}
+function parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1(raw) {
+	const record = requireRecordCopy(raw, "linked-device ordinary source contribution preparation");
+	if (record.kind === "linked_device_ed25519_source_contribution_preparation_v1") return parseEd25519SourceContributionPreparation(record);
+	if (Object.prototype.hasOwnProperty.call(record, "source") && Object.prototype.hasOwnProperty.call(record, "target")) return parseLinkedDeviceEcdsaSourceContributionPreparationV1(record);
+	throw new Error("linked-device ordinary source contribution preparation family is invalid");
+}
+function parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1(raw) {
+	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 2) throw new Error("linked-device ordinary source contribution preparations must contain one or two entries");
+	const preparations = raw.map(parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1);
+	const families = preparations.map((entry) => "kind" in entry ? "ed25519" : "ecdsa_secp256k1");
+	if (new Set(families).size !== families.length) throw new Error("linked-device ordinary source contribution preparations repeat a key family");
+	if (preparations.length === 2 && (families[0] !== "ed25519" || families[1] !== "ecdsa_secp256k1")) throw new Error("linked-device ordinary source contribution preparations must be ordered Ed25519 then ECDSA");
+	const first = preparations[0];
+	if (!first) throw new Error("linked-device ordinary source contribution preparation is empty");
+	return [first, ...preparations.slice(1)];
+}
+function parseEd25519SourceContributionPreparation(record) {
+	exactRecord$1(record, [
+		"kind",
+		"linkSessionId",
+		"enrollmentId",
+		"sourceAuthorityId",
+		"walletKeyId",
+		"targetDeviceId",
+		"targetFactorVerificationDigestB64u",
+		"sourceBinding",
+		"targetAdmission",
+		"applicationBinding",
+		"sourceRevocationEpoch",
+		"participantIds",
+		"targetMaterialActivation",
+		"targetClientRecipientPublicKeyB64u",
+		"targetSigningWorkerRecipientPublicKeyB64u",
+		"sourceRegisteredPublicKeyB64u"
+	], "linked-device Ed25519 source contribution preparation");
+	if (record.kind !== "linked_device_ed25519_source_contribution_preparation_v1") throw new Error("linked-device Ed25519 source contribution preparation kind is invalid");
+	const sourceBinding = parseRegistrationBinding(record.sourceBinding, "sourceBinding");
+	const targetAdmissionResult = parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(record.targetAdmission);
+	if (!targetAdmissionResult.ok) throw new Error(`targetAdmission ${targetAdmissionResult.message}`);
+	const targetAdmission = targetAdmissionResult.value;
+	const applicationBinding = parseRouterAbEd25519YaoApplicationBindingFactsV1(record.applicationBinding);
+	if (typeof record.sourceRevocationEpoch !== "number" || !Number.isSafeInteger(record.sourceRevocationEpoch) || record.sourceRevocationEpoch < 0) throw new Error("sourceRevocationEpoch must be a non-negative safe integer");
+	const targetMaterialActivation = parseActivation$1(record.targetMaterialActivation, "targetMaterialActivation");
+	const linkSessionId = parseSessionId(record.linkSessionId);
+	const enrollmentId = parseEnrollmentId(record.enrollmentId);
+	const sourceAuthorityId = parseAuthorityId(record.sourceAuthorityId);
+	const walletKeyId = parseWalletKeyIdField(record.walletKeyId);
+	const targetDeviceId = parseDeviceIdField(record.targetDeviceId);
+	const targetFactorVerificationDigestB64u = parseDigestField(record.targetFactorVerificationDigestB64u, "targetFactorVerificationDigestB64u");
+	const targetClientRecipientPublicKeyB64u = parseFixedBase64(record.targetClientRecipientPublicKeyB64u, 32, "targetClientRecipientPublicKeyB64u");
+	const targetSigningWorkerRecipientPublicKeyB64u = parseFixedBase64(record.targetSigningWorkerRecipientPublicKeyB64u, 32, "targetSigningWorkerRecipientPublicKeyB64u");
+	if (targetClientRecipientPublicKeyB64u === targetSigningWorkerRecipientPublicKeyB64u) throw new Error("linked-device Ed25519 source contribution recipients must differ");
+	const participantIds = parseRouterAbEd25519YaoParticipantIdsV1(record.participantIds);
+	assertSourceBindingContext(sourceBinding, linkSessionId, "sourceBinding");
+	if (!mpcMaterialActivationRefsEqual(targetMaterialActivation, routerAbMpcMaterialActivationRefFromWire(targetAdmission.binding.material_activation))) throw new Error("targetAdmission activation differs from targetMaterialActivation");
+	if (!sameEdStableIdentity(sourceBinding, targetAdmission.binding)) throw new Error("source and target Ed25519 contribution bindings differ");
+	if (sourceBinding.material_activation.activation_id === targetMaterialActivation.activationId) throw new Error("source and target Ed25519 contribution activations must differ");
+	return {
+		kind: "linked_device_ed25519_source_contribution_preparation_v1",
+		linkSessionId,
+		enrollmentId,
+		sourceAuthorityId,
+		walletKeyId,
+		targetDeviceId,
+		targetFactorVerificationDigestB64u,
+		sourceBinding,
+		targetAdmission,
+		applicationBinding,
+		sourceRevocationEpoch: record.sourceRevocationEpoch,
+		participantIds,
+		targetMaterialActivation,
+		targetClientRecipientPublicKeyB64u,
+		targetSigningWorkerRecipientPublicKeyB64u,
+		sourceRegisteredPublicKeyB64u: parseEd25519PublicKeyB64u(record.sourceRegisteredPublicKeyB64u, "sourceRegisteredPublicKeyB64u")
+	};
+}
+function parseEd25519Contribution(record) {
+	exactRecord$1(record, [
+		"kind",
+		"keyFamily",
+		"linkSessionId",
+		"enrollmentId",
+		"sourceAuthorityId",
+		"walletKeyId",
+		"targetDeviceId",
+		"targetFactorVerificationDigestB64u",
+		"targetMaterialActivation",
+		"targetClientRecipientPublicKeyB64u",
+		"targetSigningWorkerRecipientPublicKeyB64u",
+		"sourceBinding",
+		"reservationId",
+		"targetBinding",
+		"activationReceipt",
+		"participantIds",
+		"deriver_a_client_package",
+		"deriver_b_client_package",
+		"sourceRegisteredPublicKeyB64u"
+	], "linked-device Ed25519 source contribution");
+	if (record.kind !== "linked_device_ed25519_source_contribution_v1") throw new Error("linked-device Ed25519 source contribution kind is invalid");
+	if (record.keyFamily !== "ed25519") throw new Error("linked-device Ed25519 source contribution family is invalid");
+	const sourceBinding = parseRegistrationBinding(record.sourceBinding, "sourceBinding");
+	const targetMaterialActivation = parseActivation$1(record.targetMaterialActivation, "source contribution targetMaterialActivation");
+	const targetBinding = parseRegistrationBinding(record.targetBinding, "targetBinding");
+	const activationReceipt = parseRouterAbEd25519YaoActivationPublicReceiptV1(record.activationReceipt);
+	const reservationId = requireText(record.reservationId, "reservationId");
+	const participantIds = parseRouterAbEd25519YaoParticipantIdsV1(record.participantIds);
+	const linkSessionId = parseSessionId(record.linkSessionId);
+	const enrollmentId = parseEnrollmentId(record.enrollmentId);
+	const sourceAuthorityId = parseAuthorityId(record.sourceAuthorityId);
+	const walletKeyId = parseWalletKeyIdField(record.walletKeyId);
+	const targetDeviceId = parseDeviceIdField(record.targetDeviceId);
+	const targetFactorVerificationDigestB64u = parseDigestField(record.targetFactorVerificationDigestB64u, "targetFactorVerificationDigestB64u");
+	const targetClientRecipientPublicKeyB64u = parseFixedBase64(record.targetClientRecipientPublicKeyB64u, 32, "targetClientRecipientPublicKeyB64u");
+	const targetSigningWorkerRecipientPublicKeyB64u = parseFixedBase64(record.targetSigningWorkerRecipientPublicKeyB64u, 32, "targetSigningWorkerRecipientPublicKeyB64u");
+	if (targetClientRecipientPublicKeyB64u === targetSigningWorkerRecipientPublicKeyB64u) throw new Error("linked-device Ed25519 source contribution recipients must differ");
+	assertSourceBindingContext(sourceBinding, linkSessionId, "sourceBinding");
+	assertBindingContext(targetBinding, linkSessionId, targetMaterialActivation, "targetBinding");
+	if (!sameEdStableIdentity(sourceBinding, targetBinding)) throw new Error("linked-device Ed25519 source contribution stable identity differs");
+	if (!mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(activationReceipt.material_activation), targetMaterialActivation)) throw new Error("linked-device Ed25519 source contribution receipt activation differs");
+	const sourceRegisteredPublicKeyB64u = parseEd25519PublicKeyB64u(record.sourceRegisteredPublicKeyB64u, "sourceRegisteredPublicKeyB64u");
+	if (!sameBytes$1(activationReceipt.registered_public_key, Array.from(base64UrlDecode(sourceRegisteredPublicKeyB64u)))) throw new Error("linked-device Ed25519 source contribution receipt public key differs");
+	const deriverA = parseEd25519ClientPackage$1(record.deriver_a_client_package, "deriver_a");
+	const deriverB = parseEd25519ClientPackage$1(record.deriver_b_client_package, "deriver_b");
+	if (!sameBytes$1(activationReceipt.transcript, deriverA.transcript) || !sameBytes$1(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 source contribution package transcript differs");
+	if (sourceBinding.material_activation.activation_id === targetMaterialActivation.activationId) throw new Error("linked-device Ed25519 source contribution reuses the source activation");
+	return {
+		kind: "linked_device_ed25519_source_contribution_v1",
+		keyFamily: "ed25519",
+		linkSessionId,
+		enrollmentId,
+		sourceAuthorityId,
+		walletKeyId,
+		targetDeviceId,
+		targetFactorVerificationDigestB64u,
+		targetMaterialActivation,
+		targetClientRecipientPublicKeyB64u,
+		targetSigningWorkerRecipientPublicKeyB64u,
+		sourceBinding,
+		reservationId,
+		targetBinding,
+		activationReceipt,
+		participantIds,
+		deriver_a_client_package: deriverA,
+		deriver_b_client_package: deriverB,
+		sourceRegisteredPublicKeyB64u
+	};
+}
+function parseEcdsaContribution(record) {
+	exactRecord$1(record, [
+		"kind",
+		"keyFamily",
+		"linkSessionId",
+		"enrollmentId",
+		"sourceAuthorityId",
+		"walletKeyId",
+		"targetDeviceId",
+		"targetFactorVerificationDigestB64u",
+		"sourceSigner",
+		"sourceDerivation",
+		"target",
+		"package"
+	], "linked-device ECDSA source contribution");
+	if (record.kind !== "linked_device_ecdsa_source_contribution_v1") throw new Error("linked-device ECDSA source contribution kind is invalid");
+	if (record.keyFamily !== "ecdsa_secp256k1") throw new Error("linked-device ECDSA source contribution family is invalid");
+	const linkSessionId = parseSessionId(record.linkSessionId);
+	const enrollmentId = parseEnrollmentId(record.enrollmentId);
+	const sourceAuthorityId = parseAuthorityId(record.sourceAuthorityId);
+	const walletKeyId = parseWalletKeyIdField(record.walletKeyId);
+	const targetDeviceId = parseDeviceIdField(record.targetDeviceId);
+	const targetFactorVerificationDigestB64u = parseDigestField(record.targetFactorVerificationDigestB64u, "targetFactorVerificationDigestB64u");
+	const sourceSigner = parseEcdsaSourceSigner(record.sourceSigner);
+	const sourceDerivation = parseLinkedDeviceEcdsaSourceDerivationV1(record.sourceDerivation);
+	const target = parseEcdsaTarget(record.target);
+	assertEcdsaSourceTargetActivations(sourceSigner.activation, target.activation);
+	const packageValue = parseLinkedDeviceEcdsaSourceContributionPackageV1(record.package);
+	if (packageValue.binding.linkSessionId !== linkSessionId || packageValue.binding.enrollmentId !== enrollmentId || packageValue.binding.sourceAuthorityId !== sourceAuthorityId || packageValue.binding.target.targetDeviceId !== targetDeviceId || packageValue.binding.target.targetFactorVerificationDigestB64u !== targetFactorVerificationDigestB64u) throw new Error("linked-device ECDSA source contribution package binding differs");
+	if (!sameEcdsaSourceSigner(packageValue.binding.source, sourceSigner)) throw new Error("linked-device ECDSA source contribution signer differs from package binding");
+	if (!sameEcdsaTarget(packageValue.binding.target, target)) throw new Error("linked-device ECDSA source contribution target differs from package binding");
+	return {
+		kind: "linked_device_ecdsa_source_contribution_v1",
+		keyFamily: "ecdsa_secp256k1",
+		linkSessionId,
+		enrollmentId,
+		sourceAuthorityId,
+		walletKeyId,
+		targetDeviceId,
+		targetFactorVerificationDigestB64u,
+		sourceSigner,
+		sourceDerivation,
+		target,
+		package: packageValue
+	};
+}
+function parseLinkedDeviceEcdsaSourceDerivationV1(raw) {
+	const record = exactRecord$1(raw, [
+		"applicationBindingDigestB64u",
+		"clientShareRetryCounter",
+		"ecdsaThresholdKeyId",
+		"sourceNormalSigning"
+	], "linked-device ECDSA source derivation");
+	const clientShareRetryCounter = record.clientShareRetryCounter;
+	if (typeof clientShareRetryCounter !== "number" || !Number.isSafeInteger(clientShareRetryCounter) || clientShareRetryCounter < 0) throw new Error("linked-device ECDSA source derivation retry counter is invalid");
+	const applicationBindingDigestB64u = parseDigestField(record.applicationBindingDigestB64u, "sourceDerivation.applicationBindingDigestB64u");
+	const sourceNormalSigning = requireRouterAbEcdsaDerivationNormalSigningStateV1(record.sourceNormalSigning);
+	const ecdsaThresholdKeyId = parseSdkEcdsaDerivationThresholdKeyId(record.ecdsaThresholdKeyId);
+	if (sourceNormalSigning.scope.context.application_binding_digest_b64u !== applicationBindingDigestB64u || sourceNormalSigning.scope.public_identity.client_share_retry_counter !== clientShareRetryCounter || sourceNormalSigning.scope.ecdsa_threshold_key_id !== ecdsaThresholdKeyId) throw new Error("linked-device ECDSA source derivation differs from normal signing");
+	return {
+		applicationBindingDigestB64u,
+		clientShareRetryCounter,
+		ecdsaThresholdKeyId,
+		sourceNormalSigning
+	};
+}
+function parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1(raw) {
+	const record = exactRecord$1(raw, [
+		"state",
+		"binding",
+		"sourceDerivation",
+		"targetRelayerPublicKey33B64u",
+		"thresholdPublicKey33B64u",
+		"thresholdEthereumAddress20B64u",
+		"normalSigning"
+	], "linked-device ECDSA source-preserving activation receipt");
+	if (record.state !== "inactive") throw new Error("linked-device ECDSA source-preserving activation receipt is not inactive");
+	const binding = parseLinkedDeviceEcdsaSourceContributionBindingV1(record.binding);
+	const sourceDerivation = parseLinkedDeviceEcdsaSourceDerivationV1(record.sourceDerivation);
+	const targetRelayerPublicKey33B64u = parseSecp256k1CompressedPublicKeyB64u(record.targetRelayerPublicKey33B64u, "targetRelayerPublicKey33B64u");
+	const thresholdPublicKey33B64u = parseSecp256k1CompressedPublicKeyB64u(record.thresholdPublicKey33B64u, "thresholdPublicKey33B64u");
+	const thresholdEthereumAddress20B64u = parseFixedBase64(record.thresholdEthereumAddress20B64u, 20, "thresholdEthereumAddress20B64u");
+	const normalSigning = requireRouterAbEcdsaDerivationNormalSigningStateV1(record.normalSigning);
+	assertLinkedDeviceEcdsaNormalSigningReceipt({
+		binding,
+		sourceDerivation,
+		targetRelayerPublicKey33B64u,
+		thresholdPublicKey33B64u,
+		thresholdEthereumAddress20B64u,
+		normalSigning
+	});
+	return {
+		state: "inactive",
+		binding,
+		sourceDerivation,
+		targetRelayerPublicKey33B64u,
+		thresholdPublicKey33B64u,
+		thresholdEthereumAddress20B64u,
+		normalSigning
+	};
+}
+function assertLinkedDeviceEcdsaNormalSigningReceipt(input) {
+	const source = input.sourceDerivation.sourceNormalSigning.scope;
+	const target = input.normalSigning.scope;
+	if (!mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(source.material_activation), input.binding.source.activation) || !mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(target.material_activation), input.binding.target.activation) || source.wallet_id !== target.wallet_id || source.wallet_id !== input.binding.source.activation.materialOwner || target.wallet_id !== input.binding.target.activation.materialOwner || source.ecdsa_threshold_key_id !== target.ecdsa_threshold_key_id || source.signing_root_id !== target.signing_root_id || source.signing_root_version !== target.signing_root_version || source.context.application_binding_digest_b64u !== target.context.application_binding_digest_b64u || source.activation_epoch !== target.activation_epoch || source.public_identity.derivation_client_share_public_key33_b64u !== input.binding.source.clientPublicKey33B64u || source.public_identity.server_public_key33_b64u !== input.binding.source.relayerPublicKey33B64u || source.public_identity.threshold_public_key33_b64u !== input.binding.source.thresholdPublicKey33B64u || source.public_identity.ethereum_address20_b64u !== input.binding.source.thresholdEthereumAddress20B64u || target.public_identity.context_binding_b64u !== source.public_identity.context_binding_b64u || target.public_identity.derivation_client_share_public_key33_b64u !== input.binding.targetClientPublicKey33B64u || target.public_identity.server_public_key33_b64u !== input.targetRelayerPublicKey33B64u || target.public_identity.threshold_public_key33_b64u !== input.thresholdPublicKey33B64u || target.public_identity.ethereum_address20_b64u !== input.thresholdEthereumAddress20B64u || target.public_identity.client_share_retry_counter !== source.public_identity.client_share_retry_counter || target.public_identity.server_share_retry_counter !== source.public_identity.server_share_retry_counter || target.signing_worker.server_id !== input.binding.target.activation.signingWorker || target.signing_worker.key_epoch !== source.signing_worker.key_epoch || target.signing_worker.recipient_encryption_key !== routerAbX25519PublicKeyFromB64u(input.binding.target.signingWorkerRecipientPublicKeyB64u)) throw new Error("linked-device ECDSA normal signing state differs from its activation receipt");
+}
+function routerAbX25519PublicKeyFromB64u(value) {
+	const bytes = base64UrlDecode(value);
+	if (bytes.length !== 32 || base64UrlEncode(bytes) !== value) throw new Error("linked-device signing-worker recipient key is invalid");
+	let hex = "";
+	for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
+	return `x25519:${hex}`;
+}
+function parseEd25519ClientPackage$1(raw, role) {
+	const packageValue = parseRouterPackage(raw, `${role} client package`);
+	if (packageValue.kind !== "activation_client" || packageValue.deriver !== role) throw new Error(`${role} client package is not an activation client package`);
+	if (role === "deriver_a") return {
+		kind: "activation_client",
+		deriver: "deriver_a",
+		session: packageValue.session,
+		transcript: packageValue.transcript,
+		encapsulated_key: packageValue.encapsulated_key,
+		ciphertext: packageValue.ciphertext
+	};
+	return {
+		kind: "activation_client",
+		deriver: "deriver_b",
+		session: packageValue.session,
+		transcript: packageValue.transcript,
+		encapsulated_key: packageValue.encapsulated_key,
+		ciphertext: packageValue.ciphertext
+	};
+}
+function parseRouterPackage(raw, label) {
+	const parsed = parseRouterAbEd25519YaoEncryptedPackageV1(raw);
+	if (!parsed.ok) throw new Error(`${label} ${parsed.message}`);
+	return parsed.value;
+}
+function parseLinkedDeviceEcdsaSourceContributionPackageV1(raw) {
+	const record = exactRecord$1(raw, [
+		"binding",
+		"encryptedDelta",
+		"encryptedTargetClientShare"
+	], "linked-device ECDSA source contribution package");
+	const binding = parseLinkedDeviceEcdsaSourceContributionBindingV1(record.binding);
+	const encryptedDelta = parseLinkedDeviceEcdsaEncryptedSourceContributionV1(record.encryptedDelta, "encryptedDelta");
+	const encryptedTargetClientShare = parseLinkedDeviceEcdsaEncryptedSourceContributionV1(record.encryptedTargetClientShare, "encryptedTargetClientShare");
+	const bindingDigest = encryptedDelta.bindingDigestB64u;
+	if (encryptedTargetClientShare.bindingDigestB64u !== bindingDigest) throw new Error("linked-device ECDSA source contribution envelope bindings differ");
+	if (encryptedDelta.recipientPublicKeyB64u !== binding.target.signingWorkerRecipientPublicKeyB64u || encryptedTargetClientShare.recipientPublicKeyB64u !== binding.target.clientRecipientPublicKeyB64u) throw new Error("linked-device ECDSA source contribution envelope recipients differ");
+	return {
+		binding,
+		encryptedDelta,
+		encryptedTargetClientShare
+	};
+}
+function parseLinkedDeviceEcdsaSourceContributionBindingV1(raw) {
+	const record = exactRecord$1(raw, [
+		"linkSessionId",
+		"enrollmentId",
+		"sourceAuthorityId",
+		"source",
+		"target",
+		"targetClientPublicKey33B64u"
+	], "linked-device ECDSA source contribution binding");
+	const source = parseEcdsaSourceSigner(record.source);
+	const target = parseEcdsaTarget(record.target);
+	assertEcdsaSourceTargetActivations(source.activation, target.activation);
+	return {
+		linkSessionId: requireText(record.linkSessionId, "binding.linkSessionId"),
+		enrollmentId: requireText(record.enrollmentId, "binding.enrollmentId"),
+		sourceAuthorityId: requireText(record.sourceAuthorityId, "binding.sourceAuthorityId"),
+		source,
+		target,
+		targetClientPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.targetClientPublicKey33B64u, "binding.targetClientPublicKey33B64u")
+	};
+}
+function parseEcdsaSourceSigner(raw) {
+	const record = exactRecord$1(raw, [
+		"activation",
+		"clientPublicKey33B64u",
+		"relayerPublicKey33B64u",
+		"thresholdPublicKey33B64u",
+		"thresholdEthereumAddress20B64u"
+	], "linked-device ECDSA source signer");
+	return {
+		activation: parseActivation$1(record.activation, "source.activation"),
+		clientPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.clientPublicKey33B64u, "source.clientPublicKey33B64u"),
+		relayerPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.relayerPublicKey33B64u, "source.relayerPublicKey33B64u"),
+		thresholdPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.thresholdPublicKey33B64u, "source.thresholdPublicKey33B64u"),
+		thresholdEthereumAddress20B64u: parseFixedBase64(record.thresholdEthereumAddress20B64u, 20, "source.thresholdEthereumAddress20B64u")
+	};
+}
+function parseEcdsaTarget(raw) {
+	const record = exactRecord$1(raw, [
+		"activation",
+		"targetDeviceId",
+		"targetFactorVerificationDigestB64u",
+		"clientRecipientPublicKeyB64u",
+		"signingWorkerRecipientPublicKeyB64u"
+	], "linked-device ECDSA target recipient");
+	const clientRecipientPublicKeyB64u = parseFixedBase64(record.clientRecipientPublicKeyB64u, 32, "target.clientRecipientPublicKeyB64u");
+	const signingWorkerRecipientPublicKeyB64u = parseFixedBase64(record.signingWorkerRecipientPublicKeyB64u, 32, "target.signingWorkerRecipientPublicKeyB64u");
+	if (clientRecipientPublicKeyB64u === signingWorkerRecipientPublicKeyB64u) throw new Error("linked-device ECDSA target recipients must differ");
+	return {
+		activation: parseActivation$1(record.activation, "target.activation"),
+		targetDeviceId: parseDeviceIdField(record.targetDeviceId),
+		targetFactorVerificationDigestB64u: parseDigestField(record.targetFactorVerificationDigestB64u, "target.targetFactorVerificationDigestB64u"),
+		clientRecipientPublicKeyB64u,
+		signingWorkerRecipientPublicKeyB64u
+	};
+}
+function parseLinkedDeviceEcdsaEncryptedSourceContributionV1(raw, label) {
+	const record = exactRecord$1(raw, [
+		"kind",
+		"recipientPublicKeyB64u",
+		"bindingDigestB64u",
+		"encappedKeyB64u",
+		"ciphertextB64u"
+	], `linked-device ECDSA ${label}`);
+	if (record.kind !== LINKED_DEVICE_ECDSA_SOURCE_CONTRIBUTION_ENVELOPE_KIND_V1) throw new Error(`${label}.kind is invalid`);
+	return {
+		kind: LINKED_DEVICE_ECDSA_SOURCE_CONTRIBUTION_ENVELOPE_KIND_V1,
+		recipientPublicKeyB64u: parseFixedBase64(record.recipientPublicKeyB64u, 32, `${label}.recipientPublicKeyB64u`),
+		bindingDigestB64u: parseDigestField(record.bindingDigestB64u, `${label}.bindingDigestB64u`),
+		encappedKeyB64u: parseFixedBase64(record.encappedKeyB64u, 32, `${label}.encappedKeyB64u`),
+		ciphertextB64u: parseEnvelopeCiphertextB64u(record.ciphertextB64u, `${label}.ciphertextB64u`)
+	};
+}
+function parseRegistrationBinding(raw, label) {
+	const binding = parseRouterAbEd25519YaoCeremonyBindingV1(raw);
+	if (binding.operation !== "registration") throw new Error(`${label} must use the registration operation`);
+	return binding;
+}
+function assertBindingContext(binding, linkSessionId, targetMaterialActivation, label) {
+	if (binding.material_activation.activation_id !== targetMaterialActivation.activationId) throw new Error(`${label} activation does not match the target activation`);
+	if (binding.material_activation.material_owner !== targetMaterialActivation.materialOwner) throw new Error(`${label} material owner does not match the target activation`);
+	if (binding.material_activation.signing_worker !== targetMaterialActivation.signingWorker) throw new Error(`${label} signing worker does not match the target activation`);
+	if (binding.session_id.length !== 32 || String(linkSessionId).length === 0) throw new Error(`${label} link binding is invalid`);
+}
+function assertSourceBindingContext(binding, linkSessionId, label) {
+	if (binding.session_id.length !== 32 || String(linkSessionId).length === 0) throw new Error(`${label} link binding is invalid`);
+}
+function sameEdStableIdentity(left, right) {
+	return left.operation === right.operation && left.stable_key_context_binding.every((value, index) => value === right.stable_key_context_binding[index]) && left.material_activation.capability === right.material_activation.capability && left.material_activation.material_owner === right.material_activation.material_owner && left.material_activation.key_binding === right.material_activation.key_binding && left.material_activation.lifecycle_binding === right.material_activation.lifecycle_binding && left.material_activation.signing_worker === right.material_activation.signing_worker && left.lifecycle.root_share_epoch === right.lifecycle.root_share_epoch && left.lifecycle.account_id === right.lifecycle.account_id && left.lifecycle.signer_set_id === right.lifecycle.signer_set_id && left.lifecycle.selected_server_id === right.lifecycle.selected_server_id;
+}
+function sameEcdsaSourceSigner(left, right) {
+	return mpcMaterialActivationRefsEqual(left.activation, right.activation) && left.clientPublicKey33B64u === right.clientPublicKey33B64u && left.relayerPublicKey33B64u === right.relayerPublicKey33B64u && left.thresholdPublicKey33B64u === right.thresholdPublicKey33B64u && left.thresholdEthereumAddress20B64u === right.thresholdEthereumAddress20B64u;
+}
+function assertEcdsaSourceTargetActivations(source, target) {
+	if (mpcMaterialActivationRefsEqual(source, target) || source.materialOwner !== target.materialOwner || source.signingWorker !== target.signingWorker) throw new Error("linked-device ECDSA source and target activations are invalid");
+}
+function sameEcdsaTarget(left, right) {
+	return mpcMaterialActivationRefsEqual(left.activation, right.activation) && left.targetDeviceId === right.targetDeviceId && left.targetFactorVerificationDigestB64u === right.targetFactorVerificationDigestB64u && left.clientRecipientPublicKeyB64u === right.clientRecipientPublicKeyB64u && left.signingWorkerRecipientPublicKeyB64u === right.signingWorkerRecipientPublicKeyB64u;
+}
+function parseActivation$1(raw, label) {
+	const parsed = parseMpcMaterialActivationRef(raw);
+	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
+	return parsed.value;
+}
+function parseSessionId(raw) {
+	const parsed = parseLinkDeviceSessionId(requireText(raw, "linkSessionId"));
+	if (!parsed.ok) throw new Error(`linkSessionId ${parsed.error.message}`);
+	return parsed.value;
+}
+function parseEnrollmentId(raw) {
+	const parsed = parseLinkedDeviceEnrollmentId(requireText(raw, "enrollmentId"));
+	if (!parsed.ok) throw new Error(`enrollmentId ${parsed.error.message}`);
+	return parsed.value;
+}
+function parseAuthorityId(raw) {
+	const parsed = parseWalletAuthorityId(requireText(raw, "sourceAuthorityId"));
+	if (!parsed.ok) throw new Error(`sourceAuthorityId ${parsed.error.message}`);
+	return parsed.value;
+}
+function parseWalletKeyIdField(raw) {
+	const parsed = parseWalletKeyId(requireText(raw, "walletKeyId"));
+	if (!parsed.ok) throw new Error(`walletKeyId ${parsed.error.message}`);
+	return parsed.value;
+}
+function parseDeviceIdField(raw) {
+	const parsed = parseDeviceId(requireText(raw, "targetDeviceId"));
+	if (!parsed.ok) throw new Error(`targetDeviceId ${parsed.error.message}`);
+	return parsed.value;
+}
+function parseDigestField(raw, label) {
+	try {
+		return parseDigestB64u(raw);
+	} catch (error) {
+		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
+	}
+}
+function parseFixedBase64(raw, byteLength, label) {
+	if (typeof raw !== "string" || !/^[A-Za-z0-9_-]+$/.test(raw)) throw new Error(`${label} must be canonical base64url`);
+	let decoded;
+	try {
+		decoded = base64UrlDecode(raw);
+	} catch {
+		throw new Error(`${label} must be canonical base64url`);
+	}
+	if (decoded.length !== byteLength || base64UrlEncode(decoded) !== raw) throw new Error(`${label} must decode to ${byteLength} bytes`);
+	return raw;
+}
+function sameBytes$1(left, right) {
+	return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function requireText(raw, label) {
+	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw || [...raw].some((character) => {
+		const code = character.charCodeAt(0);
+		return code < 32 || code === 127;
+	})) throw new Error(`${label} must be a non-empty visible string`);
+	return raw;
+}
+function exactRecord$1(raw, keys, label) {
+	const record = requireRecordCopy(raw, label);
+	const expected = new Set(keys);
+	const actual = Object.keys(record);
+	if (actual.length !== keys.length || actual.some((key) => !expected.has(key)) || keys.some((key) => !Object.prototype.hasOwnProperty.call(record, key))) throw new Error(`${label} contains unknown or missing fields`);
+	return record;
+}
+//#endregion
+//#region ../shared-ts/src/device-linking/committedSignerPackages.ts
+function parseCommittedAuthorityPackagesV1(raw) {
+	const record = parseCommittedAuthorityPackagesWireV1(raw);
+	if (record.kind !== "committed_authority_packages_v1") throw new Error("CommittedAuthorityPackagesV1.kind is invalid");
+	const authority = parseWalletAuthorityV1(record.authority);
+	if (!authority.ok || authority.value.state !== "pending_local_install") throw new Error("CommittedAuthorityPackagesV1.authority is not pending");
+	const authMethod = parseWalletAuthMethodRecordV2(record.authMethod);
+	if (!authMethod || authMethod.status !== "pending_local_install") throw new Error("CommittedAuthorityPackagesV1.authMethod is not pending");
+	if (authMethod.walletId !== authority.value.walletId || authMethod.walletAuthorityId !== authority.value.authorityId) throw new Error("CommittedAuthorityPackagesV1 authority and auth method identities differ");
+	const signerPackages = parseCommittedSignerPackageSetV1(record.signerPackages);
+	assertSignerPackagesMatchAuthority(signerPackages, authority.value.signerActivations);
+	const ed25519ExportRootPackage = record.ed25519ExportRootPackage === null ? null : parseLinkedDeviceEd25519ExportRootPackageV1(record.ed25519ExportRootPackage);
+	if (ed25519ExportRootPackage) {
+		if (ed25519ExportRootPackage.walletId !== authority.value.walletId || ed25519ExportRootPackage.revocationEpoch !== authority.value.revocationEpoch || authority.value.provenance.kind !== "device_link" || ed25519ExportRootPackage.enrollmentId !== authority.value.provenance.enrollmentId || ed25519ExportRootPackage.linkSessionId !== authority.value.provenance.linkSessionId || String(ed25519ExportRootPackage.deviceId) !== String(authority.value.principal.deviceId)) throw new Error("CommittedAuthorityPackagesV1 export root identity does not match authority");
+	}
+	return {
+		kind: "committed_authority_packages_v1",
+		authority: authority.value,
+		authMethod,
+		signerPackages,
+		ed25519ExportRootPackage,
+		packageSetDigestB64u: parseCommittedSignerPackageSetDigestB64u(record.packageSetDigestB64u)
+	};
+}
+function assertSignerPackagesMatchAuthority(packages, activations) {
+	if (packages.keyFamilies.length !== activations.keyFamilies.length) throw new Error("CommittedAuthorityPackagesV1 signer families do not match authority");
+	for (let index = 0; index < packages.keyFamilies.length; index += 1) if (packages.keyFamilies[index] !== activations.keyFamilies[index]) throw new Error("CommittedAuthorityPackagesV1 signer family order does not match authority");
+	if (packages.keyFamilies.length === 1 && packages.keyFamilies[0] === "ed25519") {
+		if (!activations.ed25519 || !packages.ed25519) throw new Error("CommittedAuthorityPackagesV1 Ed25519 activation is missing");
+		if (!mpcMaterialActivationRefsEqual(packages.ed25519.materialActivation, activations.ed25519.materialActivation)) throw new Error("CommittedAuthorityPackagesV1 Ed25519 activation does not match authority");
+		return;
+	}
+	if (packages.keyFamilies.length === 1 && packages.keyFamilies[0] === "ecdsa_secp256k1") {
+		if (!activations.ecdsa || !packages.ecdsa) throw new Error("CommittedAuthorityPackagesV1 ECDSA activation is missing");
+		if (!mpcMaterialActivationRefsEqual(packages.ecdsa.materialActivation, activations.ecdsa.materialActivation)) throw new Error("CommittedAuthorityPackagesV1 ECDSA activation does not match authority");
+		return;
+	}
+	if (!activations.ed25519 || !activations.ecdsa || !packages.ed25519 || !packages.ecdsa) throw new Error("CommittedAuthorityPackagesV1 combined activations are incomplete");
+	if (!mpcMaterialActivationRefsEqual(packages.ed25519.materialActivation, activations.ed25519.materialActivation) || !mpcMaterialActivationRefsEqual(packages.ecdsa.materialActivation, activations.ecdsa.materialActivation)) throw new Error("CommittedAuthorityPackagesV1 activation references do not match authority");
+}
+function parseCommittedSignerPackageSetV1(raw) {
+	const record = parseCommittedSignerPackageSetWireV1(raw);
+	if (record.kind !== "committed_signer_package_set_v1") throw new Error("CommittedSignerPackageSetV1.kind is invalid");
+	const keyFamilies = parseKeyFamilies(record.keyFamilies);
+	if (keyFamilies.length === 1 && keyFamilies[0] === "ed25519") {
+		if (!("ed25519" in record)) throw new Error("CommittedSignerPackageSetV1 fields are invalid");
+		return {
+			kind: "committed_signer_package_set_v1",
+			keyFamilies,
+			ed25519: parseEd25519Package(record.ed25519)
+		};
+	}
+	if (keyFamilies.length === 1 && keyFamilies[0] === "ecdsa_secp256k1") {
+		if (!("ecdsa" in record)) throw new Error("CommittedSignerPackageSetV1 fields are invalid");
+		return {
+			kind: "committed_signer_package_set_v1",
+			keyFamilies,
+			ecdsa: parseEcdsaPackage(record.ecdsa)
+		};
+	}
+	if (!("ed25519" in record) || !("ecdsa" in record)) throw new Error("CommittedSignerPackageSetV1 fields are invalid");
+	const ed25519 = parseEd25519Package(record.ed25519);
+	const ecdsa = parseEcdsaPackage(record.ecdsa);
+	if (ed25519.materialActivation.activationId === ecdsa.materialActivation.activationId) throw new Error("CommittedSignerPackageSetV1 activation references must be distinct");
+	return {
+		kind: "committed_signer_package_set_v1",
+		keyFamilies,
+		ed25519,
+		ecdsa
+	};
+}
+function parseCommittedSignerPackageSetDigestB64u(raw) {
+	return parseDigestB64u(raw);
+}
+function parseEd25519Package(raw) {
+	const record = parseCommittedEd25519SignerPackageWireV1(raw);
+	if (record.kind !== "committed_ed25519_signer_package_v1") throw new Error("CommittedEd25519SignerPackageV1.kind is invalid");
+	const materialActivation = parseActivation(record.materialActivation, "materialActivation");
+	const targetBinding = parseRouterAbEd25519YaoCeremonyBindingV1(record.targetBinding);
+	const applicationBinding = parseRouterAbEd25519YaoApplicationBindingFactsV1(record.applicationBinding);
+	const activationReceipt = parseRouterAbEd25519YaoActivationPublicReceiptV1(record.activationReceipt);
+	if (!mpcMaterialActivationRefsEqual(materialActivation, routerAbMpcMaterialActivationRefFromWire(activationReceipt.material_activation))) throw new Error("CommittedEd25519SignerPackageV1 activation receipt does not match material");
+	if (!mpcMaterialActivationRefsEqual(materialActivation, routerAbMpcMaterialActivationRefFromWire(targetBinding.material_activation))) throw new Error("CommittedEd25519SignerPackageV1 target binding does not match material");
+	const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a_client_package", "deriver_a");
+	const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b_client_package", "deriver_b");
+	if (!sameBytes(activationReceipt.transcript, deriverA.transcript) || !sameBytes(activationReceipt.transcript, deriverB.transcript)) throw new Error("CommittedEd25519SignerPackageV1 receipt transcript does not match packages");
+	return {
+		kind: "committed_ed25519_signer_package_v1",
+		materialActivation,
+		targetBinding,
+		applicationBinding,
+		participantIds: parseRouterAbEd25519YaoParticipantIdsV1(record.participantIds),
+		activationReceipt,
+		deriver_a_client_package: deriverA,
+		deriver_b_client_package: deriverB
+	};
+}
+function parseEcdsaPackage(raw) {
+	const record = parseCommittedEcdsaSignerPackageWireV1(raw);
+	if (record.kind !== "committed_ecdsa_signer_package_v1") throw new Error("CommittedEcdsaSignerPackageV1.kind is invalid");
+	const materialActivation = parseActivation(record.materialActivation, "materialActivation");
+	const activationReceipt = parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1(record.activationReceipt);
+	const targetActivation = activationReceipt.binding.target.activation;
+	if (!mpcMaterialActivationRefsEqual(materialActivation, targetActivation)) throw new Error("CommittedEcdsaSignerPackageV1 receipt activation does not match material");
+	const encryptedTargetClientShare = parseLinkedDeviceEcdsaEncryptedSourceContributionV1(record.encryptedTargetClientShare, "encryptedTargetClientShare");
+	if (encryptedTargetClientShare.recipientPublicKeyB64u !== activationReceipt.binding.target.clientRecipientPublicKeyB64u) throw new Error("CommittedEcdsaSignerPackageV1 client share recipient does not match receipt");
+	return {
+		kind: "committed_ecdsa_signer_package_v1",
+		materialActivation,
+		encryptedTargetClientShare,
+		activationReceipt
+	};
+}
+function parseEd25519ClientPackage(raw, label, deriver) {
+	const parsed = parseRouterAbEd25519YaoEncryptedPackageV1(raw);
+	if (!parsed.ok) throw new Error(`${label} ${parsed.message}`);
+	if (parsed.value.kind !== "activation_client" || parsed.value.deriver !== deriver) throw new Error(`${label} must be an activation_client for ${deriver}`);
+	return {
+		kind: "activation_client",
+		deriver,
+		session: parsed.value.session,
+		transcript: parsed.value.transcript,
+		encapsulated_key: parsed.value.encapsulated_key,
+		ciphertext: parsed.value.ciphertext
+	};
+}
+function parseActivation(raw, label) {
+	const parsed = parseMpcMaterialActivationRef(raw);
+	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
+	return parsed.value;
+}
+function parseKeyFamilies(raw) {
+	if (!Array.isArray(raw)) throw new Error("CommittedSignerPackageSetV1.keyFamilies must be an array");
+	if (raw.length === 1 && raw[0] === "ed25519") return ["ed25519"];
+	if (raw.length === 1 && raw[0] === "ecdsa_secp256k1") return ["ecdsa_secp256k1"];
+	if (raw.length === 2 && raw[0] === "ed25519" && raw[1] === "ecdsa_secp256k1") return ["ed25519", "ecdsa_secp256k1"];
+	throw new Error("CommittedSignerPackageSetV1.keyFamilies must use canonical family order");
+}
+function parseCommittedAuthorityPackagesWireV1(raw) {
+	const record = inspectRawObject(raw);
+	if (record === null) throw new Error("CommittedAuthorityPackagesV1 must be an object");
+	requireExactWireFields(record, [
+		"kind",
+		"authority",
+		"authMethod",
+		"signerPackages",
+		"ed25519ExportRootPackage",
+		"packageSetDigestB64u"
+	], "CommittedAuthorityPackagesV1");
+	return {
+		kind: Reflect.get(record, "kind"),
+		authority: Reflect.get(record, "authority"),
+		authMethod: Reflect.get(record, "authMethod"),
+		signerPackages: Reflect.get(record, "signerPackages"),
+		ed25519ExportRootPackage: Reflect.get(record, "ed25519ExportRootPackage"),
+		packageSetDigestB64u: Reflect.get(record, "packageSetDigestB64u")
+	};
+}
+function parseCommittedSignerPackageSetWireV1(raw) {
+	const record = inspectRawObject(raw);
+	if (record === null) throw new Error("CommittedSignerPackageSetV1 must be an object");
+	const actual = Object.keys(record);
+	const hasEd25519 = actual.includes("ed25519");
+	const hasEcdsa = actual.includes("ecdsa");
+	if (hasEd25519 && hasEcdsa) {
+		requireExactWireFields(record, [
+			"kind",
+			"keyFamilies",
+			"ed25519",
+			"ecdsa"
+		], "CommittedSignerPackageSetV1");
+		return {
+			kind: Reflect.get(record, "kind"),
+			keyFamilies: Reflect.get(record, "keyFamilies"),
+			ed25519: Reflect.get(record, "ed25519"),
+			ecdsa: Reflect.get(record, "ecdsa")
+		};
+	}
+	if (hasEd25519) {
+		requireExactWireFields(record, [
+			"kind",
+			"keyFamilies",
+			"ed25519"
+		], "CommittedSignerPackageSetV1");
+		return {
+			kind: Reflect.get(record, "kind"),
+			keyFamilies: Reflect.get(record, "keyFamilies"),
+			ed25519: Reflect.get(record, "ed25519")
+		};
+	}
+	if (hasEcdsa) {
+		requireExactWireFields(record, [
+			"kind",
+			"keyFamilies",
+			"ecdsa"
+		], "CommittedSignerPackageSetV1");
+		return {
+			kind: Reflect.get(record, "kind"),
+			keyFamilies: Reflect.get(record, "keyFamilies"),
+			ecdsa: Reflect.get(record, "ecdsa")
+		};
+	}
+	requireExactWireFields(record, ["kind", "keyFamilies"], "CommittedSignerPackageSetV1");
+	return {
+		kind: Reflect.get(record, "kind"),
+		keyFamilies: Reflect.get(record, "keyFamilies")
+	};
+}
+function parseCommittedEd25519SignerPackageWireV1(raw) {
+	const record = inspectRawObject(raw);
+	if (record === null) throw new Error("CommittedEd25519SignerPackageV1 must be an object");
+	requireExactWireFields(record, [
+		"kind",
+		"materialActivation",
+		"targetBinding",
+		"applicationBinding",
+		"participantIds",
+		"activationReceipt",
+		"deriver_a_client_package",
+		"deriver_b_client_package"
+	], "CommittedEd25519SignerPackageV1");
+	return {
+		kind: Reflect.get(record, "kind"),
+		materialActivation: Reflect.get(record, "materialActivation"),
+		targetBinding: Reflect.get(record, "targetBinding"),
+		applicationBinding: Reflect.get(record, "applicationBinding"),
+		participantIds: Reflect.get(record, "participantIds"),
+		activationReceipt: Reflect.get(record, "activationReceipt"),
+		deriver_a_client_package: Reflect.get(record, "deriver_a_client_package"),
+		deriver_b_client_package: Reflect.get(record, "deriver_b_client_package")
+	};
+}
+function parseCommittedEcdsaSignerPackageWireV1(raw) {
+	const record = inspectRawObject(raw);
+	if (record === null) throw new Error("CommittedEcdsaSignerPackageV1 must be an object");
+	requireExactWireFields(record, [
+		"kind",
+		"materialActivation",
+		"encryptedTargetClientShare",
+		"activationReceipt"
+	], "CommittedEcdsaSignerPackageV1");
+	return {
+		kind: Reflect.get(record, "kind"),
+		materialActivation: Reflect.get(record, "materialActivation"),
+		encryptedTargetClientShare: Reflect.get(record, "encryptedTargetClientShare"),
+		activationReceipt: Reflect.get(record, "activationReceipt")
+	};
+}
+function inspectRawObject(raw) {
+	return raw !== null && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
+}
+function sameBytes(left, right) {
+	return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function requireExactWireFields(record, keys, label) {
+	const expected = new Set(keys);
+	const actual = Object.keys(record);
+	if (actual.length !== keys.length) throw new Error(`${label} contains unexpected fields`);
+	for (const key of actual) if (!expected.has(key)) throw new Error(`${label} contains unexpected fields`);
+	for (const key of keys) if (!Object.prototype.hasOwnProperty.call(record, key)) throw new Error(`${label}.${key} is required`);
+}
+//#endregion
+//#region ../shared-ts/src/device-linking/parsers.ts
+const QR_FIELDS = [
+	"version",
+	"purpose",
+	"linkSessionId",
+	"linkPublicKeyB64u",
+	"devicePublicKeyB64u",
+	"requestedPermission",
+	"targetFactor",
+	"issuedAtMs",
+	"expiresAtMs"
+];
+function supportedLiteral(...values) {
+	return (raw, label) => {
+		if (!values.includes(raw)) throw new Error(`${label} is unsupported`);
+		return raw;
+	};
+}
+function parseEmailHashHex(raw, label) {
+	if (typeof raw !== "string" || !/^[0-9a-f]{64}$/.test(raw)) throw new Error(`${label} must be 32 canonical lowercase hex bytes`);
+	return raw;
+}
+function parsePublicKey(raw, label) {
+	if (typeof raw !== "string" || raw.length === 0 || !/^[A-Za-z0-9_-]+$/.test(raw)) throw new Error(`${label} must be canonical unpadded base64url`);
+	try {
+		const decoded = base64UrlDecode(raw);
+		if (decoded.length !== 32 || base64UrlEncode(decoded) !== raw) throw new Error("non-canonical");
+	} catch {
+		throw new Error(`${label} must be a canonical 32-byte unpadded base64url key`);
+	}
+	return raw;
+}
+function parseCanonicalBase64UrlBytes(raw, label) {
+	if (typeof raw !== "string" || raw.length === 0 || !/^[A-Za-z0-9_-]+$/.test(raw)) throw new Error(`${label} must be canonical unpadded base64url`);
+	try {
+		const decoded = base64UrlDecode(raw);
+		if (decoded.length === 0 || base64UrlEncode(decoded) !== raw) throw new Error("non-canonical");
+	} catch {
+		throw new Error(`${label} must be canonical unpadded base64url`);
+	}
+	return raw;
+}
+function parseCanonicalFixedBase64UrlBytes(raw, length, label) {
+	const value = parseCanonicalBase64UrlBytes(raw, label);
+	const decoded = base64UrlDecode(value);
+	try {
+		if (decoded.length !== length) throw new Error(`${label} must encode ${length} bytes`);
+		return value;
+	} finally {
+		decoded.fill(0);
+	}
+}
+const P256_FIELD_PRIME = BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff");
+const P256_CURVE_A = P256_FIELD_PRIME - 3n;
+const P256_CURVE_B = BigInt("0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b");
+function bigEndianBytesToBigInt(bytes) {
+	let value = 0n;
+	for (const byte of bytes) value = value << 8n | BigInt(byte);
+	return value;
+}
+function isP256Point(decoded) {
+	const x = bigEndianBytesToBigInt(decoded.subarray(1, 33));
+	const y = bigEndianBytesToBigInt(decoded.subarray(33, 65));
+	if (x >= P256_FIELD_PRIME || y >= P256_FIELD_PRIME) return false;
+	return y * y % P256_FIELD_PRIME === (x * x * x % P256_FIELD_PRIME + P256_CURVE_A * x % P256_FIELD_PRIME + P256_CURVE_B) % P256_FIELD_PRIME;
+}
+function parseUncompressedP256PointB64u(raw, label) {
+	const value = parseCanonicalFixedBase64UrlBytes(raw, 65, label);
+	const decoded = base64UrlDecode(value);
+	try {
+		if (decoded[0] !== 4) throw new Error(`${label} must be an uncompressed SEC1 P-256 point`);
+		if (!isP256Point(decoded)) throw new Error(`${label} must be an on-curve P-256 point`);
+		return value;
+	} finally {
+		decoded.fill(0);
+	}
+}
+function parseLinkDevicePublicKeyB64u(raw) {
+	return parsePublicKey(raw, "LinkDevicePublicKeyB64u");
+}
+function parseCredential(raw, label) {
+	return credentialId(parseCanonicalBase64UrlBytes(raw, label), label);
+}
+function parseKeyFamily(raw, label) {
+	if (raw !== "ed25519" && raw !== "ecdsa_secp256k1") throw new Error(`${label} must identify a supported key family`);
+	return raw;
+}
+function assertExpiryAfterIssued(issuedAtMs, expiresAtMs, label) {
+	if (expiresAtMs <= issuedAtMs) throw new Error(`${label}.expiresAtMs must be after issuedAtMs`);
+}
+function delegatedWalletAuthorityWireValue(value) {
+	return {
+		kind: value.kind,
+		permissions: [...delegatedWalletPermissionNamesV1(value)]
+	};
+}
+function qrPayloadWireValue(payload) {
+	const base = {
+		version: payload.version,
+		purpose: payload.purpose,
+		linkSessionId: payload.linkSessionId,
+		linkPublicKeyB64u: payload.linkPublicKeyB64u,
+		devicePublicKeyB64u: payload.devicePublicKeyB64u,
+		requestedPermission: delegatedWalletAuthorityWireValue(payload.requestedPermission),
+		targetFactor: payload.targetFactor,
+		issuedAtMs: payload.issuedAtMs,
+		expiresAtMs: payload.expiresAtMs
+	};
+	return payload.targetFactor.kind === "email_otp" ? {
+		...base,
+		targetEmail: payload.targetEmail
+	} : base;
+}
+function parseTargetFactor(raw, label) {
+	switch (exactRecord$3(raw, ["kind"], label).kind) {
+		case "passkey_prf": return { kind: "passkey_prf" };
+		case "email_otp": return { kind: "email_otp" };
+		default: throw new Error(`${label}.kind is unsupported`);
+	}
+}
+function passkeyTargetFactorV1() {
+	return wireObject({ kind: wireLiteral("passkey_prf") });
+}
+function emailOtpTargetFactorV1() {
+	return wireObject({ kind: wireLiteral("email_otp") });
+}
+function existingEnrollmentV1() {
+	return wireObject({ kind: wireLiteral("existing_enrollment") });
+}
+function newEnrollmentV1() {
+	return wireObject({ kind: wireLiteral("new_enrollment") });
+}
+function emailOtpEnrollmentSelectionV1() {
+	return wireUnion("kind", [existingEnrollmentV1(), newEnrollmentV1()]);
+}
+function parseEmailOtpEnrollmentSelection(raw, label) {
+	return emailOtpEnrollmentSelectionV1()(raw, label);
+}
+function emailOtpEnrollmentMaterialV1() {
+	return wireObject({
+		enrollmentSealKeyVersion: parseNonEmptyToken,
+		clientUnlockPublicKeyB64u: parseNonEmptyToken,
+		unlockKeyVersion: parseNonEmptyToken,
+		serverSealedFactorCiphertextB64u: parseNonEmptyToken
+	});
+}
+function parseApprovedTargetFactor(raw, label) {
+	const record = requireRecord(raw, label);
+	if (record.kind === "passkey_prf") {
+		exactRecord$3(record, ["kind"], label);
+		return { kind: "passkey_prf" };
+	}
+	if (record.kind === "email_otp") {
+		const enrollment = parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`);
+		const targetEmail = parseTargetEmail(record.targetEmail, `${label}.targetEmail`);
+		if (enrollment.kind === "existing_enrollment") return {
+			kind: "email_otp",
+			targetEmail,
+			enrollment,
+			baseWalletAuthMethodId: walletAuthMethodId(exactRecord$3(record, [
+				"kind",
+				"targetEmail",
+				"enrollment",
+				"baseWalletAuthMethodId"
+			], label).baseWalletAuthMethodId, `${label}.baseWalletAuthMethodId`)
+		};
+		exactRecord$3(record, [
+			"kind",
+			"targetEmail",
+			"enrollment"
+		], label);
+		return {
+			kind: "email_otp",
+			targetEmail,
+			enrollment
+		};
+	}
+	throw new Error(`${label}.kind is unsupported`);
+}
+function parseQrPayloadRecord(record) {
+	if (record.version !== "v5") throw new Error("QrLinkedDeviceSessionPayloadV5.version is invalid");
+	if (record.purpose !== "linked_device_lane_creation") throw new Error("QrLinkedDeviceSessionPayloadV5.purpose is invalid");
+	const issuedAtMs = parseUnixTime(record.issuedAtMs, "QrLinkedDeviceSessionPayloadV5.issuedAtMs");
+	const expiresAtMs = parseUnixTime(record.expiresAtMs, "QrLinkedDeviceSessionPayloadV5.expiresAtMs");
+	assertExpiryAfterIssued(issuedAtMs, expiresAtMs, "QrLinkedDeviceSessionPayloadV5");
+	const base = {
+		version: "v5",
+		purpose: "linked_device_lane_creation",
+		linkSessionId: sessionId(record.linkSessionId, "QrLinkedDeviceSessionPayloadV5.linkSessionId"),
+		linkPublicKeyB64u: parsePublicKey(record.linkPublicKeyB64u, "QrLinkedDeviceSessionPayloadV5.linkPublicKeyB64u"),
+		devicePublicKeyB64u: parsePublicKey(record.devicePublicKeyB64u, "QrLinkedDeviceSessionPayloadV5.devicePublicKeyB64u"),
+		requestedPermission: parseDelegatedWalletAuthority(record.requestedPermission, "QrLinkedDeviceSessionPayloadV5.requestedPermission"),
+		targetFactor: parseTargetFactor(record.targetFactor, "QrLinkedDeviceSessionPayloadV5.targetFactor"),
+		issuedAtMs,
+		expiresAtMs
+	};
+	if (base.targetFactor.kind === "email_otp") return {
+		...base,
+		targetFactor: { kind: "email_otp" },
+		targetEmail: parseTargetEmail(record.targetEmail, "QrLinkedDeviceSessionPayloadV5.targetEmail")
+	};
+	return {
+		...base,
+		targetFactor: { kind: "passkey_prf" }
+	};
+}
+function parseQrLinkedDeviceSessionPayloadV5(raw) {
+	const candidate = requireRecord(raw, "QrLinkedDeviceSessionPayloadV5");
+	return parseQrPayloadRecord(exactRecord$3(candidate, parseTargetFactor(candidate.targetFactor, "QrLinkedDeviceSessionPayloadV5.targetFactor").kind === "email_otp" ? [...QR_FIELDS, "targetEmail"] : QR_FIELDS, "QrLinkedDeviceSessionPayloadV5"));
+}
+function serializeQrLinkedDeviceSessionPayloadV5(payload) {
+	const parsed = parseQrPayloadRecord(qrPayloadWireValue(payload));
+	const compact = {
+		v: 5,
+		s: parsed.linkSessionId,
+		l: parsed.linkPublicKeyB64u,
+		d: parsed.devicePublicKeyB64u,
+		a: delegatedWalletAuthorityWireValue(parsed.requestedPermission),
+		f: parsed.targetFactor.kind === "passkey_prf" ? "p" : "e",
+		i: parsed.issuedAtMs,
+		e: parsed.expiresAtMs
+	};
+	return parsed.targetFactor.kind === "email_otp" ? JSON.stringify({
+		...compact,
+		t: parsed.targetEmail
+	}) : JSON.stringify(compact);
+}
+function linkedDeviceOwnerAuthorizationRequestV1() {
+	return wireObject({
+		payload: parseQrLinkedDeviceSessionPayloadV5,
+		requestedAtMs: parseUnixTime
+	});
+}
+function parseLinkedDeviceOwnerAuthorizationRequestV1(raw) {
+	return linkedDeviceOwnerAuthorizationRequestV1()(raw, "LinkedDeviceOwnerAuthorizationRequestV1");
+}
+function linkSessionStatesV1() {
+	const withDevice = (state) => wireObject({
+		state: wireLiteral(state),
+		deviceId: authorizationDeviceId
+	});
+	return [
+		wireObject({ state: wireLiteral("displaying_qr") }),
+		withDevice("claimed"),
+		withDevice("awaiting_target_factor"),
+		withDevice("awaiting_source_contribution"),
+		withDevice("provisioning"),
+		wireObject({
+			state: wireLiteral("authority_pending_local_install"),
+			deviceId: authorizationDeviceId,
+			authorityId: walletAuthorityId,
+			packageSetDigestB64u: digest
+		}),
+		wireObject({
+			state: wireLiteral("active"),
+			deviceId: authorizationDeviceId,
+			authorityId: walletAuthorityId,
+			activatedAtMs: parseUnixTime
+		}),
+		wireObject({
+			state: wireLiteral("failed_before_commit"),
+			error: parseLinkPrecommitFailureV1
+		}),
+		wireObject({
+			state: wireLiteral("cancelled"),
+			cancelledAtMs: parseUnixTime
+		}),
+		wireObject({
+			state: wireLiteral("expired"),
+			expiredAtMs: parseUnixTime
+		})
+	];
+}
+function parseLinkSessionStateV1(raw) {
+	const state = requireRecord(raw, "LinkSessionStateV1").state;
+	if (typeof state !== "string") throw new Error("LinkSessionStateV1.state is invalid");
+	const schema = linkSessionStatesV1().find((variant) => variant.shape.state.literals.includes(state));
+	if (!schema) throw new Error(`LinkSessionStateV1.state ${state} is unsupported`);
+	return schema(raw, `LinkSessionStateV1.${state}`);
+}
+function parseLinkPrecommitFailureV1(raw) {
+	const record = exactRecord$3(raw, ["kind", "reason"], "LinkPrecommitFailureV1");
+	if (record.kind !== "invalid_input" && record.kind !== "unauthorized_source" && record.kind !== "revoked_source" && record.kind !== "permission_attenuation_failed" && record.kind !== "target_factor_failed" && record.kind !== "expired_session" && record.kind !== "cancelled_session" && record.kind !== "claim_conflict" && record.kind !== "package_preparation_failed") throw new Error("LinkPrecommitFailureV1.kind is invalid");
+	return {
+		kind: record.kind,
+		reason: parseNonEmptyToken(record.reason, "LinkPrecommitFailureV1.reason")
+	};
+}
+function linkSessionProjectionV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_session_projection_v1"),
+		linkSessionId: sessionId,
+		qrPayload: parseQrLinkedDeviceSessionPayloadV5,
+		revision: parseNonNegativeSafeInteger,
+		createdAtMs: parseUnixTime,
+		updatedAtMs: parseUnixTime,
+		state: parseLinkSessionStateV1
+	});
+}
+function parseLinkSessionProjectionV1(raw) {
+	return linkSessionProjectionV1()(raw, "LinkSessionProjectionV1");
+}
+function linkSessionTransportEventV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_session_event_v1"),
+		linkSessionId: sessionId,
+		state: parseLinkSessionStateV1,
+		emittedAtMs: parseUnixTime
+	});
+}
+function parseLinkSessionTransportEventV1(raw) {
+	return linkSessionTransportEventV1()(raw, "LinkSessionTransportEventV1");
+}
+function linkedDeviceApprovalResultV1() {
+	return wireUnion("outcome", [wireObject({
+		outcome: wireLiteral("pending"),
+		state: parsePendingApprovalState
+	}), wireObject({
+		outcome: wireLiteral("replayed"),
+		replay: wireObject({
+			state: () => "pending",
+			session: parsePendingApprovalState
+		})
+	})]);
+}
+function parseLinkedDeviceApprovalResultV1(raw) {
+	return linkedDeviceApprovalResultV1()(raw, "LinkedDeviceApprovalResultV1");
+}
+function parsePendingApprovalState(raw) {
+	const state = parseLinkSessionStateV1(raw);
+	switch (state.state) {
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning":
+		case "authority_pending_local_install": return state;
+		default: throw new Error("LinkedDeviceApprovalResultV1 state is not pending");
+	}
+}
+function linkedDeviceSessionClaimV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_session_claim_v1"),
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		devicePublicKeyB64u: parsePublicKey,
+		targetFactor: parseTargetFactor,
+		sessionRevision: parseUnixTime,
+		claimedAtMs: parseUnixTime,
+		claimExpiresAtMs: parseUnixTime
+	}, (claim, label) => assertExpiryAfterIssued(claim.claimedAtMs, claim.claimExpiresAtMs, label));
+}
+function parseLinkedDeviceSessionClaimV1(raw) {
+	return linkedDeviceSessionClaimV1()(raw, "LinkedDeviceSessionClaimV1");
+}
+function walletSessionOwnerAuthorizationV1() {
+	return wireObject({
+		kind: wireLiteral("wallet_session"),
+		walletSessionId,
+		authorizationId: walletSessionAuthorizationId
+	});
+}
+function parseLinkedDeviceOwnerAuthorizationSourceV1(raw, label = "ownerAuthorization") {
+	if (requireRecord(raw, label).kind !== "wallet_session") throw new Error(`${label}.kind is unsupported`);
+	return walletSessionOwnerAuthorizationV1()(raw, label);
+}
+function linkedDeviceApprovalFields() {
+	return {
+		kind: wireLiteral("linked_device_approval_v1"),
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		linkPublicKeyB64u: parsePublicKey,
+		devicePublicKeyB64u: parsePublicKey,
+		permission: parseDelegatedWalletAuthority,
+		targetFactor: parseApprovedTargetFactor,
+		ownerAuthorization: parseLinkedDeviceOwnerAuthorizationSourceV1,
+		approvedAtMs: parseUnixTime,
+		expiresAtMs: parseUnixTime
+	};
+}
+function approvedBeforeExpiry(approval, label) {
+	assertExpiryAfterIssued(approval.approvedAtMs, approval.expiresAtMs, label);
+}
+function linkedDeviceApprovalV1() {
+	return wireObject(linkedDeviceApprovalFields(), approvedBeforeExpiry);
+}
+function linkedDeviceSourceContributionApprovalV1() {
+	return wireObject({
+		...linkedDeviceApprovalFields(),
+		sourceContribution: parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1
+	}, approvedBeforeExpiry);
+}
+function parseLinkedDeviceApprovalV1(raw) {
+	const record = requireRecord(raw, "LinkedDeviceApprovalV1");
+	return (record.sourceContribution === void 0 ? linkedDeviceApprovalV1() : linkedDeviceSourceContributionApprovalV1())(record, "LinkedDeviceApprovalV1");
+}
+function linkedDeviceApprovalDeliveryV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_approval_delivery_v1"),
+		approval: parseLinkedDeviceApprovalV1
+	});
+}
+function parseLinkedDeviceApprovalDeliveryV1(raw) {
+	return linkedDeviceApprovalDeliveryV1()(raw, "LinkedDeviceApprovalDeliveryV1");
+}
+function linkedDeviceTargetPreparationFields() {
+	return {
+		kind: wireLiteral("linked_device_target_preparation_v1"),
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		deliveryRecipientPublicKey65B64u: parseUncompressedP256PointB64u,
+		walletAuthMethodId,
+		ed25519ExportRoot: wireNullable(ed25519ExportRootPreparationV1()),
+		ordinarySignerMaterialRecipientRequirements: parseRecipientRequirements,
+		issuedAtMs: parseUnixTime,
+		expiresAtMs: parseUnixTime
+	};
+}
+function preparationExpiresAfterIssue(preparation, label) {
+	if (preparation.expiresAtMs <= preparation.issuedAtMs) throw new Error(`${label}.expiresAtMs must follow issuedAtMs`);
+}
+function passkeyTargetPreparationV1() {
+	return wireObject({
+		...linkedDeviceTargetPreparationFields(),
+		targetFactor: passkeyTargetFactorV1(),
+		passkeyCreationOptions: parseLinkedDevicePasskeyCreationOptionsV1,
+		passkeyConfigurationDigestB64u: digest
+	}, (preparation, label) => {
+		preparationExpiresAfterIssue(preparation, label);
+		if (preparation.passkeyCreationOptions.walletAuthMethodId !== preparation.walletAuthMethodId) throw new Error(`${label}.passkeyCreationOptions.walletAuthMethodId must match the preparation`);
+	});
+}
+function emailOtpTargetPreparationV1() {
+	return wireObject({
+		...linkedDeviceTargetPreparationFields(),
+		targetFactor: emailOtpTargetFactorV1(),
+		targetEmail: parseTargetEmail,
+		enrollment: existingEnrollmentV1(),
+		baseWalletAuthMethodId: walletAuthMethodId
+	}, preparationExpiresAfterIssue);
+}
+function newEmailOtpTargetPreparationV1() {
+	return wireObject({
+		...linkedDeviceTargetPreparationFields(),
+		targetFactor: emailOtpTargetFactorV1(),
+		targetEmail: parseTargetEmail,
+		enrollment: newEnrollmentV1()
+	}, preparationExpiresAfterIssue);
+}
+function parseLinkedDeviceTargetPreparationV1(raw) {
+	const label = "LinkedDeviceTargetPreparationV1";
+	const record = requireRecord(raw, label);
+	if (parseTargetFactor(record.targetFactor, `${label}.targetFactor`).kind === "passkey_prf") return passkeyTargetPreparationV1()(record, label);
+	return (parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`).kind === "new_enrollment" ? newEmailOtpTargetPreparationV1() : emailOtpTargetPreparationV1())(record, label);
+}
+function linkedDeviceTargetPreparationRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_target_preparation_request_v1"),
+		linkSessionId: sessionId,
+		deliveryRecipientPublicKey65B64u: parseUncompressedP256PointB64u
+	});
+}
+function parseLinkedDeviceTargetPreparationRequestV1(raw) {
+	return linkedDeviceTargetPreparationRequestV1()(raw, "LinkedDeviceTargetPreparationRequestV1");
+}
+function emailOtpBaseFactorChoiceV1() {
+	return wireObject({
+		baseWalletAuthMethodId: walletAuthMethodId,
+		maskedEmailHint: (raw, label) => {
+			if (typeof raw !== "string" || raw.length === 0) throw new Error(`${label} is invalid`);
+			return raw;
+		}
+	});
+}
+function emailOtpBaseFactorResolutionsV1() {
+	const choice = emailOtpBaseFactorChoiceV1();
+	const parseChoice = (raw) => choice(raw, "LinkedDeviceEmailOtpBaseFactorChoiceV1");
+	return {
+		selected: wireObject({
+			kind: wireLiteral("selected"),
+			choice: parseChoice
+		}),
+		selection_required: wireObject({
+			kind: wireLiteral("selection_required"),
+			choices: (raw, label) => {
+				if (!Array.isArray(raw) || raw.length === 0) throw new Error(`${label} must not be empty`);
+				const choices = raw.map(parseChoice);
+				return [choices[0], ...choices.slice(1)];
+			}
+		}),
+		unavailable: wireObject({
+			kind: wireLiteral("unavailable"),
+			reason: supportedLiteral("no_active_email_otp_base_factor")
+		})
+	};
+}
+function parseLinkedDeviceEmailOtpBaseFactorResolutionV1(raw) {
+	const label = "LinkedDeviceEmailOtpBaseFactorResolutionV1";
+	const record = requireRecord(raw, label);
+	const resolutions = emailOtpBaseFactorResolutionsV1();
+	switch (record.kind) {
+		case "selected":
+		case "selection_required":
+		case "unavailable": return resolutions[record.kind](record, label);
+		default: throw new Error(`${label}.kind is unsupported`);
+	}
+}
+function emailOtpBaseFactorResolutionResultV1() {
+	return wireObject({
+		revision: parseUnixTime,
+		resolution: parseLinkedDeviceEmailOtpBaseFactorResolutionV1
+	});
+}
+function parseLinkedDeviceEmailOtpBaseFactorResolutionResultV1(raw) {
+	return emailOtpBaseFactorResolutionResultV1()(raw, "LinkedDeviceEmailOtpBaseFactorResolutionResultV1");
+}
+function parseLinkedDevicePasskeyCreationOptionsV1(raw, label) {
+	const record = exactRecord$3(raw, [
+		"kind",
+		"walletAuthMethodId",
+		"challengeId",
+		"challengeB64u",
+		"rpId",
+		"user",
+		"pubKeyCredParams",
+		"authenticatorSelection",
+		"timeoutMs",
+		"attestation",
+		"extensions",
+		"excludeCredentials"
+	], label);
+	const methodId = walletAuthMethodId(record.walletAuthMethodId, `${label}.walletAuthMethodId`);
+	exactRecord$3(record.user, [
+		"idB64u",
+		"name",
+		"displayName"
+	], `${label}.user`);
+	exactRecord$3(record.authenticatorSelection, ["residentKey", "userVerification"], `${label}.authenticatorSelection`);
+	exactRecord$3(exactRecord$3(exactRecord$3(record.extensions, ["prf"], `${label}.extensions`).prf, ["eval"], `${label}.extensions.prf`).eval, ["firstB64u", "secondB64u"], `${label}.extensions.prf.eval`);
+	if (!Array.isArray(record.pubKeyCredParams)) throw new Error(`${label}.pubKeyCredParams must be an array`);
+	record.pubKeyCredParams.forEach((entry, index) => {
+		exactRecord$3(entry, ["type", "alg"], `${label}.pubKeyCredParams[${index}]`);
+	});
+	if (!Array.isArray(record.excludeCredentials)) throw new Error(`${label}.excludeCredentials must be an array`);
+	record.excludeCredentials.forEach((entry, index) => {
+		exactRecord$3(entry, ["type", "id"], `${label}.excludeCredentials[${index}]`);
+	});
+	const options = parseWalletAddAuthMethodRegistrationOptions(record);
+	return {
+		kind: options.kind,
+		walletAuthMethodId: methodId,
+		challengeId: options.challengeId,
+		challengeB64u: options.challengeB64u,
+		rpId: options.rpId,
+		user: options.user,
+		pubKeyCredParams: options.pubKeyCredParams,
+		authenticatorSelection: options.authenticatorSelection,
+		timeoutMs: options.timeoutMs,
+		attestation: options.attestation,
+		extensions: options.extensions,
+		excludeCredentials: options.excludeCredentials
+	};
+}
+function ed25519ExportRootPreparationV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_ed25519_export_root_preparation_v1"),
+		walletKeyId,
+		applicationBindingDigestB64u: digest,
+		registeredPublicKeyB64u: parseEd25519PublicKeyB64u,
+		revocationEpoch: parseNonNegativeSafeInteger
+	});
+}
+function parseKeyFamilyEntries(raw, item, label) {
+	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 2) throw new Error(`${label} must contain one or two entries`);
+	const entries = raw.map((entry, index) => item(entry, `${label}[${index}]`));
+	if (new Set(entries.map((entry) => entry.keyFamily)).size !== entries.length) throw new Error(`${label} repeats a key family`);
+	if (new Set(entries.map((entry) => String(entry.walletKeyId))).size !== entries.length) throw new Error(`${label} repeats a wallet key`);
+	if (entries.length === 2 && (entries[0]?.keyFamily !== "ed25519" || entries[1]?.keyFamily !== "ecdsa_secp256k1")) throw new Error(`${label} must be ordered Ed25519 then ECDSA`);
+	return entries;
+}
+function recipientRequirementV1() {
+	return wireObject({
+		kind: wireLiteral("ordinary_signer_material_recipient_requirement_v1"),
+		keyFamily: parseKeyFamily,
+		walletKeyId
+	});
+}
+function parseRecipientRequirements(raw) {
+	const requirements = parseKeyFamilyEntries(raw, recipientRequirementV1(), "LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements");
+	const first = requirements[0];
+	if (!first) throw new Error("ordinary signer material recipient requirements are empty");
+	return [first, ...requirements.slice(1)];
+}
+const webAuthnTransport = /* @__PURE__ */ wireLiteral("ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb");
+function parseWebAuthnTransports(raw, label) {
+	const transports = requireArray(raw, label).map((entry, index) => webAuthnTransport(entry, `${label}[${index}]`));
+	if (new Set(transports).size !== transports.length) throw new Error(`${label} contains duplicates`);
+	return transports;
+}
+function linkedDeviceWebAuthnRegistrationV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_webauthn_registration_v1"),
+		credentialIdB64u: parseCredential,
+		authenticatorAttachment: wireNullable(wireLiteral("platform", "cross-platform")),
+		clientDataJsonB64u: parseCanonicalBase64UrlBytes,
+		attestationObjectB64u: parseCanonicalBase64UrlBytes,
+		transports: parseWebAuthnTransports
+	});
+}
+function recipientRequestV1() {
+	const keyFamily = (family) => (raw, label) => {
+		if (raw !== family) throw new Error(`${label} does not match its kind`);
+		return family;
+	};
+	return wireUnion("kind", [wireObject({
+		kind: wireLiteral("ordinary_ed25519_signer_material_recipient_request_v1"),
+		keyFamily: keyFamily("ed25519"),
+		walletKeyId,
+		recipientPublicKeyB64u: (raw, label) => parseCanonicalFixedBase64UrlBytes(raw, 32, label)
+	}), wireObject({
+		kind: wireLiteral("ordinary_ecdsa_signer_material_recipient_request_v1"),
+		keyFamily: keyFamily("ecdsa_secp256k1"),
+		walletKeyId,
+		clientEphemeralPublicKey: requireRouterAbX25519PublicKey
+	})]);
+}
+function parseRecipientRequests(raw) {
+	const requests = parseKeyFamilyEntries(raw, recipientRequestV1(), "LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests");
+	const first = requests[0];
+	if (!first) throw new Error("ordinary signer material recipient requests are empty");
+	return [first, ...requests.slice(1)];
+}
+function targetCredentialRegistrationIdentity() {
+	return {
+		kind: wireLiteral("linked_device_target_credential_registration_v1"),
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		walletAuthMethodId
+	};
+}
+function passkeyTargetCredentialRegistrationV1() {
+	return wireObject({
+		...targetCredentialRegistrationIdentity(),
+		targetFactor: passkeyTargetFactorV1(),
+		targetPreparationDigestB64u: digest,
+		ordinarySignerMaterialRecipientRequests: parseRecipientRequests,
+		webauthnRegistration: linkedDeviceWebAuthnRegistrationV1(),
+		registeredAtMs: parseUnixTime
+	});
+}
+function emailOtpTargetCredentialRegistrationV1() {
+	return wireObject({
+		...targetCredentialRegistrationIdentity(),
+		targetFactor: emailOtpTargetFactorV1(),
+		targetEmail: parseTargetEmail,
+		targetPreparationDigestB64u: digest,
+		ordinarySignerMaterialRecipientRequests: parseRecipientRequests,
+		emailOtpVerificationGrant: parseLinkedDeviceEmailOtpVerificationGrantV1,
+		registeredAtMs: parseUnixTime
+	});
+}
+function newEmailOtpTargetCredentialRegistrationV1() {
+	return wireObject({
+		...targetCredentialRegistrationIdentity(),
+		targetFactor: emailOtpTargetFactorV1(),
+		targetEmail: parseTargetEmail,
+		targetPreparationDigestB64u: digest,
+		ordinarySignerMaterialRecipientRequests: parseRecipientRequests,
+		emailOtpVerificationGrant: parseLinkedDeviceEmailOtpVerificationGrantV1,
+		emailOtpEnrollment: emailOtpEnrollmentMaterialV1(),
+		registeredAtMs: parseUnixTime
+	});
+}
+function parseLinkedDeviceTargetCredentialRegistrationV1(raw) {
+	const label = "LinkedDeviceTargetCredentialRegistrationV1";
+	const record = requireRecord(raw, label);
+	if (parseTargetFactor(record.targetFactor, `${label}.targetFactor`).kind === "passkey_prf") return passkeyTargetCredentialRegistrationV1()(record, label);
+	return (parseLinkedDeviceEmailOtpVerificationGrantV1(record.emailOtpVerificationGrant).enrollment.kind === "new_enrollment" ? newEmailOtpTargetCredentialRegistrationV1() : emailOtpTargetCredentialRegistrationV1())(record, label);
+}
+function targetCredentialRegistrationResultV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_target_credential_registration_result_v1"),
+		outcome: wireLiteral("applied", "replayed"),
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		walletAuthMethodId,
+		targetPreparationDigestB64u: digest,
+		targetFactor: parseVerifiedTargetFactorV1,
+		ordinarySignerMaterialPreparations: parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1,
+		ordinarySignerMaterialRecipientRequests: parseRecipientRequests,
+		keyManifestDigestB64u: digest
+	}, (result, label) => {
+		const { authMethod } = result.targetFactor;
+		if (authMethod.walletAuthMethodId !== result.walletAuthMethodId || authMethod.walletId !== result.walletId) throw new Error(`${label} target identity differs`);
+	});
+}
+function parseLinkedDeviceTargetCredentialRegistrationResultV1(raw) {
+	return targetCredentialRegistrationResultV1()(raw, "LinkedDeviceTargetCredentialRegistrationResultV1");
+}
+function verifiedAfterCreation(target, label) {
+	if (target.verifiedAtMs < target.authMethod.createdAtMs) throw new Error(`${label}.verifiedAtMs precedes authMethod.createdAtMs`);
+}
+function verifiedPasskeyTargetV1() {
+	return wireObject({
+		kind: wireLiteral("verified_passkey_target_v1"),
+		authMethod: parsePasskeyWalletAuthMethodDraftV1,
+		verificationDigestB64u: digest,
+		verifiedAtMs: parseUnixTime
+	}, verifiedAfterCreation);
+}
+function verifiedEmailOtpTargetV1() {
+	return wireObject({
+		kind: wireLiteral("verified_email_otp_target_v1"),
+		authMethod: parseEmailOtpWalletAuthMethodDraftV1,
+		targetEmail: parseTargetEmail,
+		enrollment: existingEnrollmentV1(),
+		baseWalletAuthMethodId: walletAuthMethodId,
+		providerUserId: parseNonEmptyToken,
+		verificationDigestB64u: digest,
+		verifiedAtMs: parseUnixTime
+	}, verifiedAfterCreation);
+}
+function verifiedNewEmailOtpTargetV1() {
+	return wireObject({
+		kind: wireLiteral("verified_email_otp_target_v1"),
+		authMethod: parseEmailOtpWalletAuthMethodDraftV1,
+		targetEmail: parseTargetEmail,
+		enrollment: newEnrollmentV1(),
+		providerUserId: parseNonEmptyToken,
+		verificationDigestB64u: digest,
+		verifiedAtMs: parseUnixTime
+	}, verifiedAfterCreation);
+}
+function parseVerifiedTargetFactorV1(raw, label) {
+	const record = requireRecord(raw, label);
+	if (record.kind === "verified_passkey_target_v1") return verifiedPasskeyTargetV1()(record, label);
+	if (record.kind !== "verified_email_otp_target_v1") throw new Error(`${label}.kind is invalid`);
+	return (parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`).kind === "existing_enrollment" ? verifiedEmailOtpTargetV1() : verifiedNewEmailOtpTargetV1())(record, label);
+}
+function passkeyWalletAuthMethodDraftV1() {
+	return wireObject({
+		walletAuthMethodId,
+		walletId,
+		createdAtMs: parseUnixTime,
+		kind: wireLiteral("passkey"),
+		rpId: rpId$1,
+		credentialIdB64u: credentialId,
+		credentialPublicKeyB64u: parseCanonicalBase64UrlBytes,
+		counter: parseNonNegativeSafeInteger
+	});
+}
+function parsePasskeyWalletAuthMethodDraftV1(raw, label) {
+	return passkeyWalletAuthMethodDraftV1()(raw, label);
+}
+function emailOtpWalletAuthMethodDraftV1() {
+	return wireObject({
+		walletAuthMethodId,
+		walletId,
+		createdAtMs: parseUnixTime,
+		kind: wireLiteral("email_otp"),
+		emailHashHex: parseEmailHashHex,
+		registrationAuthorityId: parseNonEmptyToken
+	});
+}
+function parseEmailOtpWalletAuthMethodDraftV1(raw, label) {
+	return emailOtpWalletAuthMethodDraftV1()(raw, label);
+}
+function emailOtpVerificationGrantFields(enrollment) {
+	return {
+		kind: wireLiteral("linked_device_email_otp_verification_grant_v1"),
+		grantId: parseNonEmptyToken,
+		grantToken: parseNonEmptyToken,
+		challengeId: parseNonEmptyToken,
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		targetPreparationDigestB64u: digest,
+		targetEmail: parseTargetEmail,
+		enrollment,
+		emailHashHex: parseEmailHashHex,
+		registrationAuthorityId: parseNonEmptyToken,
+		providerUserId: parseNonEmptyToken,
+		authorityDigestB64u: digest,
+		issuedAtMs: parseUnixTime,
+		expiresAtMs: parseUnixTime
+	};
+}
+function grantIssuedBeforeExpiry(grant, label) {
+	assertExpiryAfterIssued(grant.issuedAtMs, grant.expiresAtMs, label);
+}
+function emailOtpVerificationGrantV1() {
+	return wireObject({
+		...emailOtpVerificationGrantFields(existingEnrollmentV1()),
+		baseWalletAuthMethodId: walletAuthMethodId
+	}, grantIssuedBeforeExpiry);
+}
+function newEnrollmentEmailOtpVerificationGrantV1() {
+	return wireObject(emailOtpVerificationGrantFields(newEnrollmentV1()), grantIssuedBeforeExpiry);
+}
+function parseLinkedDeviceEmailOtpVerificationGrantV1(raw) {
+	const label = "LinkedDeviceEmailOtpVerificationGrantV1";
+	const record = requireRecord(raw, label);
+	return (parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`).kind === "new_enrollment" ? newEnrollmentEmailOtpVerificationGrantV1() : emailOtpVerificationGrantV1())(record, label);
+}
+function emailOtpFactorReleaseEnvelopeV1() {
+	return wireObject({
+		kind: wireLiteral("email_otp_factor_release_v1"),
+		challengeId: parseNonEmptyToken,
+		enrollmentId: parseNonEmptyToken,
+		enrollmentSealKeyVersion: parseNonEmptyToken,
+		serverEphemeralPublicKey65B64u: parseUncompressedP256PointB64u,
+		nonce12B64u: (raw, label) => parseCanonicalFixedBase64UrlBytes(raw, 12, label),
+		ciphertextB64u: parseCanonicalBase64UrlBytes
+	});
+}
+function parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1(raw) {
+	return emailOtpFactorReleaseEnvelopeV1()(raw, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1");
+}
+function emailOtpChallengeStartRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_email_otp_challenge_start_request_v1"),
+		linkSessionId: sessionId,
+		workerEphemeralPublicKey65B64u: parseUncompressedP256PointB64u
+	});
+}
+function parseLinkedDeviceEmailOtpChallengeStartRequestV1(raw) {
+	return emailOtpChallengeStartRequestV1()(raw, "LinkedDeviceEmailOtpChallengeStartRequestV1");
+}
+function emailOtpChallengeResendRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_email_otp_challenge_resend_request_v1"),
+		linkSessionId: sessionId,
+		challengeId: parseNonEmptyToken
+	});
+}
+function parseLinkedDeviceEmailOtpChallengeResendRequestV1(raw) {
+	return emailOtpChallengeResendRequestV1()(raw, "LinkedDeviceEmailOtpChallengeResendRequestV1");
+}
+function emailOtpChallengeVerifyRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_email_otp_challenge_verify_request_v1"),
+		linkSessionId: sessionId,
+		challengeId: parseNonEmptyToken,
+		otpCode: (raw, label) => {
+			if (typeof raw !== "string" || !/^[0-9]{6,10}$/.test(raw)) throw new Error(`${label} is invalid`);
+			return raw;
+		}
+	});
+}
+function parseLinkedDeviceEmailOtpChallengeVerifyRequestV1(raw) {
+	return emailOtpChallengeVerifyRequestV1()(raw, "LinkedDeviceEmailOtpChallengeVerifyRequestV1");
+}
+function emailOtpChallengeResultV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_email_otp_challenge_result_v1"),
+		challengeId: parseNonEmptyToken,
+		maskedEmailHint: parseNonEmptyToken,
+		expiresAtMs: parseUnixTime,
+		resendAvailableAtMs: parseUnixTime
+	});
+}
+function parseLinkedDeviceEmailOtpChallengeResultV1(raw) {
+	return emailOtpChallengeResultV1()(raw, "LinkedDeviceEmailOtpChallengeResultV1");
+}
+function parseLinkedDeviceEmailOtpVerificationResultV1(raw) {
+	const record = exactRecord$3(raw, [
+		"kind",
+		"verificationGrant",
+		"factorRelease"
+	], "LinkedDeviceEmailOtpVerificationResultV1");
+	if (record.kind !== "linked_device_email_otp_verification_result_v1") throw new Error("LinkedDeviceEmailOtpVerificationResultV1.kind is invalid");
+	const verificationGrant = parseLinkedDeviceEmailOtpVerificationGrantV1(record.verificationGrant);
+	if (isNewEnrollmentEmailOtpVerificationGrantV1(verificationGrant)) {
+		if (record.factorRelease !== null) throw new Error("new linked-device Email OTP enrollment cannot carry a factor release");
+		return {
+			kind: "linked_device_email_otp_verification_result_v1",
+			verificationGrant,
+			factorRelease: null
+		};
+	}
+	const factorRelease = parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1(record.factorRelease);
+	if (factorRelease.challengeId !== verificationGrant.challengeId) throw new Error("LinkedDeviceEmailOtpVerificationResultV1 challenge binding changed");
+	return {
+		kind: "linked_device_email_otp_verification_result_v1",
+		verificationGrant,
+		factorRelease
+	};
+}
+function isNewEnrollmentEmailOtpVerificationGrantV1(grant) {
+	return grant.enrollment.kind === "new_enrollment";
+}
+function buildQrLinkedDeviceSessionPayloadV5(args) {
+	const issuedAtMs = parseUnixTime(args.issuedAtMs, "QrLinkedDeviceSessionPayloadV5.issuedAtMs");
+	const expiresAtMs = parseUnixTime(args.expiresAtMs, "QrLinkedDeviceSessionPayloadV5.expiresAtMs");
+	assertExpiryAfterIssued(issuedAtMs, expiresAtMs, "QrLinkedDeviceSessionPayloadV5");
+	const targetFactor = parseTargetFactor(args.targetFactor, "QrLinkedDeviceSessionPayloadV5.targetFactor");
+	if (targetFactor.kind === "passkey_prf") return {
+		version: "v5",
+		purpose: "linked_device_lane_creation",
+		linkSessionId: args.linkSessionId,
+		linkPublicKeyB64u: args.linkPublicKeyB64u,
+		devicePublicKeyB64u: args.devicePublicKeyB64u,
+		requestedPermission: parseDelegatedWalletAuthority(delegatedWalletAuthorityWireValue(args.requestedPermission), "QrLinkedDeviceSessionPayloadV5.requestedPermission"),
+		targetFactor,
+		issuedAtMs,
+		expiresAtMs
+	};
+	if (args.targetEmail === void 0) throw new Error("QrLinkedDeviceSessionPayloadV5.targetEmail is required for Email OTP");
+	return {
+		version: "v5",
+		purpose: "linked_device_lane_creation",
+		linkSessionId: args.linkSessionId,
+		linkPublicKeyB64u: args.linkPublicKeyB64u,
+		devicePublicKeyB64u: args.devicePublicKeyB64u,
+		requestedPermission: parseDelegatedWalletAuthority(delegatedWalletAuthorityWireValue(args.requestedPermission), "QrLinkedDeviceSessionPayloadV5.requestedPermission"),
+		targetFactor,
+		targetEmail: parseTargetEmail(args.targetEmail, "QrLinkedDeviceSessionPayloadV5.targetEmail"),
+		issuedAtMs,
+		expiresAtMs
+	};
+}
+function buildLinkedDeviceSessionClaimRequestV1(payload) {
+	return {
+		kind: "linked_device_session_claim_request_v1",
+		payload
+	};
+}
+function validateEnrollmentTimes(approvedAtMs, expiresAtMs, label) {
+	const approved = parseUnixTime(approvedAtMs, `${label}.approvedAtMs`);
+	const expires = parseUnixTime(expiresAtMs, `${label}.expiresAtMs`);
+	assertExpiryAfterIssued(approved, expires, label);
+	return {
+		approvedAtMs: approved,
+		expiresAtMs: expires
+	};
+}
+function buildLinkedDeviceApprovalV1(args) {
+	const times = validateEnrollmentTimes(args.approvedAtMs, args.expiresAtMs, "LinkedDeviceApprovalV1");
+	return parseLinkedDeviceApprovalV1({
+		kind: "linked_device_approval_v1",
+		...args,
+		...times
+	});
+}
+function buildLinkedDeviceTargetCredentialRegistrationV1(args) {
+	return parseLinkedDeviceTargetCredentialRegistrationV1({
+		kind: "linked_device_target_credential_registration_v1",
+		...args
+	});
+}
+function buildLinkedDeviceSessionCancelUnclaimedRequestV1(args) {
+	return {
+		kind: "linked_device_session_cancel_unclaimed_request_v1",
+		linkSessionId: args.linkSessionId,
+		reason: "user_cancelled",
+		requestedAtMs: parseUnixTime(args.requestedAtMs, "LinkedDeviceSessionCancelUnclaimedRequestV1.requestedAtMs")
+	};
+}
+function buildLinkedDeviceSessionCancelClaimedRequestV1(args) {
+	return {
+		kind: "linked_device_session_cancel_claimed_request_v1",
+		...args,
+		requestedAtMs: parseUnixTime(args.requestedAtMs, "LinkedDeviceSessionCancelClaimedRequestV1.requestedAtMs")
+	};
+}
+//#endregion
+//#region ../shared-ts/src/utils/webauthnDeviceInfo.ts
+const WEBAUTHN_DEVICE_BROWSERS = [
+	"chrome",
+	"safari",
+	"firefox",
+	"edge",
+	"other"
+];
+const WEBAUTHN_DEVICE_OSES = [
+	"macos",
+	"ios",
+	"windows",
+	"android",
+	"linux",
+	"other"
+];
+function isWebAuthnDeviceBrowser(value) {
+	return typeof value === "string" && WEBAUTHN_DEVICE_BROWSERS.some((browser) => browser === value);
+}
+function isWebAuthnDeviceOs(value) {
+	return typeof value === "string" && WEBAUTHN_DEVICE_OSES.some((os) => os === value);
+}
+/** Strict parse of a stored/transported device-info record; null when the
+* shape is not a valid WebAuthnAuthenticatorDeviceInfo. */
+function parseWebAuthnAuthenticatorDeviceInfo(raw) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const record = raw;
+	const label = typeof record.label === "string" ? record.label.trim() : "";
+	if (!label) return null;
+	if (!isWebAuthnDeviceBrowser(record.browser)) return null;
+	if (!isWebAuthnDeviceOs(record.os)) return null;
+	if (typeof record.synced !== "boolean") return null;
+	if (!Array.isArray(record.transports)) return null;
+	const transports = record.transports.map((t) => typeof t === "string" ? t.trim() : "").filter((t) => t.length > 0);
+	const provider = typeof record.provider === "string" ? record.provider.trim() : "";
+	const providerLabel = typeof record.providerLabel === "string" ? record.providerLabel.trim() : "";
+	return {
+		label,
+		browser: record.browser,
+		os: record.os,
+		synced: record.synced,
+		transports,
+		...provider ? { provider } : {},
+		...providerLabel ? { providerLabel } : {}
+	};
+}
+//#endregion
+//#region ../shared-ts/src/device-linking/deviceManagement.ts
+function listOf(item) {
+	return (raw, label) => {
+		if (!Array.isArray(raw)) throw new Error(`${label} is invalid`);
+		return raw.map((entry, index) => item(entry, `${label}[${index}]`));
+	};
+}
+function parseLinkedDeviceRevokeWalletAuthMethodId(raw, label) {
+	const value = walletAuthMethodId(raw, label);
+	if (value.startsWith("wallet-authority:") || value.startsWith("authority:")) throw new Error(`${label} must identify a WalletAuthMethodId`);
+	return value;
+}
+function parsePositiveSafeInteger(raw, label) {
+	const value = parseNonNegativeSafeInteger(raw, label);
+	if (value < 1) throw new Error(`${label} must be a positive safe integer`);
+	return value;
+}
+function parseWebAuthnDeviceInfo(raw, label) {
+	const device = parseWebAuthnAuthenticatorDeviceInfo(raw);
+	if (!device) throw new Error(`${label} is invalid`);
+	return device;
+}
+function linkedOwnerCredentialMetadataV1() {
+	return wireUnion("kind", [wireObject({
+		kind: wireLiteral("passkey"),
+		walletAuthMethodId,
+		credentialIdB64u: credentialId,
+		device: parseWebAuthnDeviceInfo
+	}), wireObject({
+		kind: wireLiteral("email_otp"),
+		walletAuthMethodId,
+		email: parseTargetEmail
+	})]);
+}
+function parseLinkedOwnerCredentialMetadata(raw, label) {
+	return linkedOwnerCredentialMetadataV1()(raw, label);
+}
+function linkedDeviceSummaryV1() {
+	return wireObject({
+		deviceId: linkedDeviceId,
+		enrollmentId,
+		walletId,
+		credential: parseLinkedOwnerCredentialMetadata,
+		permission: parseDelegatedWalletAuthority,
+		keyManifestDigestB64u: digest,
+		coveredWalletKeys: listOf(walletKeyId),
+		state: wireLiteral("provisioning", "active", "suspended", "expired", "revoked"),
+		createdAtMs: parseUnixTime,
+		lastActivityAtMs: parseUnixTime,
+		revocationEpoch: parseNonNegativeSafeInteger
+	});
+}
+function parseLinkedDeviceSummaryV1(raw) {
+	return linkedDeviceSummaryV1()(raw, "LinkedDeviceSummaryV1");
+}
+function linkedDeviceListRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_list_request_v1"),
+		walletId,
+		limit: parsePositiveSafeInteger,
+		cursor: nullableToken
+	});
+}
+function parseLinkedDeviceListRequestV1(raw) {
+	return linkedDeviceListRequestV1()(raw, "LinkedDeviceListRequestV1");
+}
+function ownerDeviceSummaryV1() {
+	return wireObject({
+		walletId,
+		walletAuthorityId,
+		credential: parseLinkedOwnerCredentialMetadata,
+		createdAtMs: parseUnixTime,
+		lastActivityAtMs: parseUnixTime
+	});
+}
+function linkedDeviceListResultV1() {
+	const ownerDevice = ownerDeviceSummaryV1();
+	return wireObject({
+		devices: listOf(parseLinkedDeviceSummaryV1),
+		ownerDevices: listOf((raw) => ownerDevice(raw, "OwnerDeviceSummaryV1")),
+		nextCursor: nullableToken
+	});
+}
+function parseLinkedDeviceListResultV1(raw) {
+	return linkedDeviceListResultV1()(raw, "LinkedDeviceListResultV1");
+}
+function linkedDeviceRevokeRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_revoke_request_v1"),
+		walletId,
+		walletAuthMethodId: parseLinkedDeviceRevokeWalletAuthMethodId,
+		requestedAtMs: parseUnixTime
+	});
+}
+function parseLinkedDeviceRevokeRequestV1(raw) {
+	return linkedDeviceRevokeRequestV1()(raw, "LinkedDeviceRevokeRequestV1");
+}
+function linkedDeviceRevokeFailureV1() {
+	return wireObject({ kind: wireLiteral("not_found", "conflict", "unauthorized") });
+}
+function linkedDeviceRevokedV1() {
+	return wireObject({
+		kind: wireLiteral("revoked"),
+		walletAuthMethodId: parseLinkedDeviceRevokeWalletAuthMethodId,
+		authorityId: walletAuthorityId,
+		revocationEpoch: parseNonNegativeSafeInteger
+	});
+}
+function parseLinkedDeviceRevokeResultV1(raw) {
+	const record = requireRecord(raw, "LinkedDeviceRevokeResultV1");
+	return (record.kind === "not_found" || record.kind === "conflict" || record.kind === "unauthorized" ? linkedDeviceRevokeFailureV1() : linkedDeviceRevokedV1())(record, "LinkedDeviceRevokeResultV1");
+}
+//#endregion
+//#region ../shared-ts/src/device-linking/walletSessionCredentialDelivery.ts
+const DELIVERY_AAD_DOMAIN = "seams/linked-device/wallet-session-credential-delivery-aad/v1";
+const DELIVERY_ENVELOPE_DOMAIN = "seams/linked-device/wallet-session-credential-delivery-envelope/v1";
+function encodeLinkedDeviceWalletSessionCredentialDeliveryAadV1(aad) {
+	return alphabetizeStringify({
+		domain: DELIVERY_AAD_DOMAIN,
+		aad
+	});
+}
+function parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"namespace",
+		"orgId",
+		"projectId",
+		"envId",
+		"tenantId",
+		"principalId"
+	], "LinkedDeviceWalletSessionCredentialDeliveryBindingV1");
+	if (record.kind !== "linked_device_wallet_session_credential_delivery_binding_v1") throw new Error("LinkedDeviceWalletSessionCredentialDeliveryBindingV1.kind is invalid");
+	return {
+		kind: "linked_device_wallet_session_credential_delivery_binding_v1",
+		namespace: nonEmpty(record.namespace, "namespace"),
+		orgId: nonEmpty(record.orgId, "orgId"),
+		projectId: nonEmpty(record.projectId, "projectId"),
+		envId: nonEmpty(record.envId, "envId"),
+		tenantId: parsed(parseTenantId(record.tenantId)),
+		principalId: parsed(parsePrincipalId(record.principalId))
+	};
+}
+async function computeLinkedDeviceWalletSessionCredentialDeliveryAadDigestB64u(aad) {
+	return sha256Utf8DigestB64u(encodeLinkedDeviceWalletSessionCredentialDeliveryAadV1(aad));
+}
+async function computeLinkedDeviceWalletSessionCredentialEnvelopeDigestB64u(envelope) {
+	return sha256Utf8DigestB64u(alphabetizeStringify({
+		domain: DELIVERY_ENVELOPE_DOMAIN,
+		envelope
+	}));
+}
+async function assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1(delivery) {
+	if (await computeLinkedDeviceWalletSessionCredentialDeliveryAadDigestB64u(delivery.aad) !== delivery.aadDigestB64u) throw new Error("linked-device Wallet Session credential delivery AAD digest is invalid");
+	if (await computeLinkedDeviceWalletSessionCredentialEnvelopeDigestB64u(delivery.envelope) !== delivery.envelopeDigestB64u) throw new Error("linked-device Wallet Session credential delivery envelope digest is invalid");
+	if (await sha256Utf8DigestB64u(alphabetizeStringify({
+		domain: "seams/linked-device/delivery-recipient/v1",
+		recipientPublicKey65B64u: delivery.aad.recipientPublicKey65B64u
+	})) !== delivery.recipientBindingDigestB64u) throw new Error("linked-device Wallet Session credential delivery recipient binding is invalid");
+}
+function parseLinkedDeviceWalletSessionCredentialDeliveryV1(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"aad",
+		"aadDigestB64u",
+		"recipientBindingDigestB64u",
+		"envelope",
+		"envelopeDigestB64u",
+		"installationReceiptDigestB64u"
+	], "LinkedDeviceWalletSessionCredentialDeliveryV1");
+	if (record.kind !== "linked_device_wallet_session_credential_delivery_v1") throw new Error("LinkedDeviceWalletSessionCredentialDeliveryV1.kind is invalid");
+	return {
+		kind: "linked_device_wallet_session_credential_delivery_v1",
+		aad: parseDeliveryAad(record.aad),
+		aadDigestB64u: parseDigestB64u(record.aadDigestB64u),
+		recipientBindingDigestB64u: parseDigestB64u(record.recipientBindingDigestB64u),
+		envelope: parseDeliveryEnvelope(record.envelope),
+		envelopeDigestB64u: parseDigestB64u(record.envelopeDigestB64u),
+		installationReceiptDigestB64u: parseDigestB64u(record.installationReceiptDigestB64u)
+	};
+}
+function parseDeliveryAad(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"namespace",
+		"orgId",
+		"projectId",
+		"envId",
+		"tenantId",
+		"principalId",
+		"linkSessionId",
+		"walletId",
+		"authorityId",
+		"walletAuthMethodId",
+		"authorizationId",
+		"walletSessionId",
+		"quotaId",
+		"credentialDigestB64u",
+		"recipientPublicKey65B64u",
+		"issuedAtMs",
+		"expiresAtMs"
+	], "LinkedDeviceWalletSessionCredentialDeliveryAadV1");
+	if (record.kind !== "linked_device_wallet_session_credential_delivery_aad_v1") throw new Error("LinkedDeviceWalletSessionCredentialDeliveryAadV1.kind is invalid");
+	const issuedAtMs = positiveInteger(record.issuedAtMs, "issuedAtMs");
+	const expiresAtMs = positiveInteger(record.expiresAtMs, "expiresAtMs");
+	if (expiresAtMs <= issuedAtMs) throw new Error("expiresAtMs must be after issuedAtMs");
+	return {
+		kind: "linked_device_wallet_session_credential_delivery_aad_v1",
+		namespace: nonEmpty(record.namespace, "namespace"),
+		orgId: nonEmpty(record.orgId, "orgId"),
+		projectId: nonEmpty(record.projectId, "projectId"),
+		envId: nonEmpty(record.envId, "envId"),
+		tenantId: parsed(parseTenantId(record.tenantId)),
+		principalId: parsed(parsePrincipalId(record.principalId)),
+		linkSessionId: parsed(parseLinkDeviceSessionId(record.linkSessionId)),
+		walletId: parsed(parseWalletId(record.walletId)),
+		authorityId: parsed(parseWalletAuthorityId(record.authorityId)),
+		walletAuthMethodId: parsed(parseWalletAuthMethodId(record.walletAuthMethodId)),
+		authorizationId: parsed(parseWalletSessionAuthorizationId(record.authorizationId)),
+		walletSessionId: parsed(parseWalletSessionId(record.walletSessionId)),
+		quotaId: parsed(parseMpcWalletSigningQuotaId(record.quotaId)),
+		credentialDigestB64u: parseDigestB64u(record.credentialDigestB64u),
+		recipientPublicKey65B64u: fixedBase64Url(record.recipientPublicKey65B64u, 65),
+		issuedAtMs,
+		expiresAtMs
+	};
+}
+function parseDeliveryEnvelope(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"algorithm",
+		"serverEphemeralPublicKey65B64u",
+		"nonce12B64u",
+		"ciphertextB64u"
+	], "LinkedDeviceWalletSessionCredentialEnvelopeV1");
+	if (record.kind !== "linked_device_wallet_session_credential_envelope_v1" || record.algorithm !== "p256-ecdh-aes256gcm-v1") throw new Error("LinkedDeviceWalletSessionCredentialEnvelopeV1 identity is invalid");
+	return {
+		kind: "linked_device_wallet_session_credential_envelope_v1",
+		algorithm: "p256-ecdh-aes256gcm-v1",
+		serverEphemeralPublicKey65B64u: fixedBase64Url(record.serverEphemeralPublicKey65B64u, 65),
+		nonce12B64u: fixedBase64Url(record.nonce12B64u, 12),
+		ciphertextB64u: canonicalBase64Url(record.ciphertextB64u)
+	};
+}
+function exactRecord(raw, fields, label) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error(`${label} must be an object`);
+	const record = raw;
+	const expected = new Set(fields);
+	for (const field of Object.keys(record)) if (!expected.has(field)) throw new Error(`${label}.${field} is not supported`);
+	for (const field of fields) if (!(field in record)) throw new Error(`${label}.${field} is required`);
+	return record;
+}
+function nonEmpty(raw, label) {
+	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw) throw new Error(`${label} is required`);
+	return raw;
+}
+function positiveInteger(raw, label) {
+	if (!Number.isSafeInteger(raw) || Number(raw) <= 0) throw new Error(`${label} is invalid`);
+	return Number(raw);
+}
+function canonicalBase64Url(raw) {
+	const encoded = nonEmpty(raw, "base64url");
+	if (base64UrlEncode(base64UrlDecode(encoded)) !== encoded) throw new Error("base64url is not canonical");
+	return encoded;
+}
+function fixedBase64Url(raw, length) {
+	const encoded = canonicalBase64Url(raw);
+	const bytes = base64UrlDecode(encoded);
+	if (bytes.length !== length) throw new Error(`base64url must contain ${length} bytes`);
+	if (length === 65 && bytes[0] !== 4) throw new Error("P-256 public key is invalid");
+	return encoded;
+}
+function parsed(result) {
+	if (!result.ok) throw new Error(result.error.message);
+	return result.value;
+}
+//#endregion
+//#region ../shared-ts/src/device-linking/authorityActivation.ts
+function parseInstalledActivationRefs(raw, label) {
+	const result = parseWalletSignerActivationSetV1(raw);
+	if (!result.ok) throw new Error(`${label} ${result.error}`);
+	return result.value;
+}
+function localAuthorityInstallationReceiptV1() {
+	return wireObject({
+		kind: wireLiteral("local_authority_installation_receipt_v1"),
+		authorityId: keyLabeled(walletAuthorityId),
+		walletId: keyLabeled(walletId),
+		authMethodId: keyLabeled(walletAuthMethodId),
+		deviceId: keyLabeled(authorizationDeviceId),
+		packageSetDigestB64u: keyLabeled(digest),
+		installedActivationRefs: parseInstalledActivationRefs,
+		installedRecordSetDigestB64u: keyLabeled(digest),
+		targetFactorVerificationDigestB64u: keyLabeled(digest),
+		installedAtMs: keyLabeled(parseUnixTime)
+	});
+}
+function parseLocalAuthorityInstallationReceiptV1(raw) {
+	return localAuthorityInstallationReceiptV1()(raw, "LocalAuthorityInstallationReceiptV1");
+}
+function localAuthorityActivationFinalAckV1() {
+	return wireObject({
+		kind: wireLiteral("local_authority_activation_final_ack_v1"),
+		linkSessionId: keyLabeled(sessionId),
+		authorityId: keyLabeled(walletAuthorityId),
+		packageSetDigestB64u: keyLabeled(digest),
+		authorizationId: keyLabeled(walletSessionAuthorizationId),
+		walletSessionId: keyLabeled(walletSessionId),
+		credentialDigestB64u: keyLabeled(digest),
+		installationReceiptDigestB64u: keyLabeled(digest),
+		acknowledgedAtMs: keyLabeled(parseUnixTime)
+	});
+}
+function parseLocalAuthorityActivationFinalAckV1(raw) {
+	return localAuthorityActivationFinalAckV1()(raw, "LocalAuthorityActivationFinalAckV1");
+}
+function parseActivateInstalledAuthorityResultV1(raw) {
+	const record = requireRecord(raw, "ActivateInstalledAuthorityResultV1");
+	switch (record.kind) {
+		case "active": {
+			rejectUnknownFields$1(record, [
+				"kind",
+				"authority",
+				"authMethod",
+				"walletSession",
+				"deliveryBinding",
+				"sealedDelivery"
+			], "ActivateInstalledAuthorityResultV1");
+			const authorityResult = parseWalletAuthorityV1(record.authority);
+			if (!authorityResult.ok || authorityResult.value.state !== "active") throw new Error("ActivateInstalledAuthorityResultV1.authority must be active");
+			const authMethod = parseWalletAuthMethodRecordV2(record.authMethod);
+			if (!authMethod || authMethod.status !== "active") throw new Error("ActivateInstalledAuthorityResultV1.authMethod must be active");
+			const walletSession = parseActiveWalletSessionV1(record.walletSession);
+			const deliveryBinding = parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1(record.deliveryBinding);
+			const sealedDelivery = parseLinkedDeviceWalletSessionCredentialDeliveryV1(record.sealedDelivery);
+			if (authorityResult.value.walletId !== authMethod.walletId || authorityResult.value.authorityId !== authMethod.walletAuthorityId || walletSession.walletId !== authorityResult.value.walletId || walletSession.authorityId !== authorityResult.value.authorityId || walletSession.authMethodId !== authMethod.walletAuthMethodId || walletSession.authorityDigestB64u !== authorityResult.value.authorityDigestB64u || walletSession.authorityRevocationEpoch !== authorityResult.value.revocationEpoch || deliveryBinding.namespace !== sealedDelivery.aad.namespace || deliveryBinding.orgId !== sealedDelivery.aad.orgId || deliveryBinding.projectId !== sealedDelivery.aad.projectId || deliveryBinding.envId !== sealedDelivery.aad.envId || deliveryBinding.tenantId !== sealedDelivery.aad.tenantId || deliveryBinding.principalId !== sealedDelivery.aad.principalId || sealedDelivery.aad.walletId !== walletSession.walletId || sealedDelivery.aad.authorityId !== walletSession.authorityId || sealedDelivery.aad.walletAuthMethodId !== walletSession.authMethodId || sealedDelivery.aad.authorizationId !== walletSession.authorizationId || sealedDelivery.aad.quotaId !== walletSession.quotaId || sealedDelivery.aad.issuedAtMs !== walletSession.issuedAtMs || sealedDelivery.aad.expiresAtMs !== walletSession.expiresAtMs) throw new Error("ActivateInstalledAuthorityResultV1 identities do not match");
+			return {
+				kind: "active",
+				authority: authorityResult.value,
+				authMethod,
+				walletSession,
+				deliveryBinding,
+				sealedDelivery
+			};
+		}
+		case "pending_local_install":
+			rejectUnknownFields$1(record, [
+				"kind",
+				"authorityId",
+				"reason"
+			], "ActivateInstalledAuthorityResultV1");
+			return {
+				kind: "pending_local_install",
+				authorityId: walletAuthorityId(record.authorityId, "authorityId"),
+				reason: activationRetryReasonV1()(record.reason, "ActivationRetryReasonV1")
+			};
+		case "integrity_error":
+			rejectUnknownFields$1(record, ["kind", "reason"], "ActivateInstalledAuthorityResultV1");
+			return {
+				kind: "integrity_error",
+				reason: parseLinkIntegrityFailureV1(record.reason)
+			};
+		default: throw new Error("ActivateInstalledAuthorityResultV1.kind is invalid");
+	}
+}
+function activationRetryReasonV1() {
+	return wireUnion("kind", [
+		wireObject({ kind: wireLiteral("installation_receipt_not_found") }),
+		wireObject({ kind: wireLiteral("server_worker_activation_pending") }),
+		wireObject({ kind: wireLiteral("wallet_session_issuance_pending") })
+	]);
+}
+function parseLinkIntegrityFailureV1(raw) {
+	const record = requireRecord(raw, "LinkIntegrityFailureV1");
+	switch (record.kind) {
+		case "authority_id_mismatch":
+			rejectUnknownFields$1(record, [
+				"kind",
+				"expectedAuthorityId",
+				"actualAuthorityId"
+			], "LinkIntegrityFailureV1");
+			return {
+				kind: "authority_id_mismatch",
+				expectedAuthorityId: walletAuthorityId(record.expectedAuthorityId, "expectedAuthorityId"),
+				actualAuthorityId: walletAuthorityId(record.actualAuthorityId, "actualAuthorityId")
+			};
+		case "package_set_digest_mismatch":
+			rejectUnknownFields$1(record, [
+				"kind",
+				"expectedPackageSetDigestB64u",
+				"actualPackageSetDigestB64u"
+			], "LinkIntegrityFailureV1");
+			return {
+				kind: "package_set_digest_mismatch",
+				expectedPackageSetDigestB64u: digest(record.expectedPackageSetDigestB64u, "expectedPackageSetDigestB64u"),
+				actualPackageSetDigestB64u: digest(record.actualPackageSetDigestB64u, "actualPackageSetDigestB64u")
+			};
+		case "installation_receipt_mismatch":
+			rejectUnknownFields$1(record, ["kind", "field"], "LinkIntegrityFailureV1");
+			if (record.field !== "walletId" && record.field !== "authMethodId" && record.field !== "deviceId" && record.field !== "targetFactorVerificationDigestB64u" && record.field !== "installedActivationRefs") throw new Error("LinkIntegrityFailureV1.field is invalid");
+			return {
+				kind: "installation_receipt_mismatch",
+				field: record.field
+			};
+		default: throw new Error("LinkIntegrityFailureV1.kind is invalid");
+	}
+}
+//#endregion
+//#region ../shared-ts/src/device-linking/digests.ts
+const TARGET_PREPARATION_DOMAIN = "seams/linked-device/target-preparation/v1";
+const LOCAL_AUTHORITY_INSTALLATION_RECEIPT_DOMAIN = "seams/linked-device/local-authority-installation-receipt/v1";
+new TextEncoder();
+/**
+* The server stores this digest alongside the authorization. Hashing the
+* opaque token directly keeps the browser binding identical to that row.
+*/
+async function computeWalletSessionOperationCredentialDigestB64u(credential) {
+	return sha256Utf8DigestB64u(credential.token);
+}
+function encodeWalletSessionInstallationReceiptV1(receipt) {
+	return alphabetizeStringify({
+		domain: LOCAL_AUTHORITY_INSTALLATION_RECEIPT_DOMAIN,
+		receipt
+	});
+}
+async function computeWalletSessionInstallationReceiptDigestB64u(receipt) {
+	return sha256Utf8DigestB64u(encodeWalletSessionInstallationReceiptV1(receipt));
+}
+function requirePresentString(value, label) {
+	if (value === void 0) throw new Error(`${label} is required`);
+	return value;
+}
+function encodeTargetFactor(value) {
+	return text(value.kind, "targetFactor.kind");
+}
+function encodeLinkedDevicePasskeyCreationOptionsV1(value) {
+	const algorithms = value.pubKeyCredParams.map((entry) => concat([text(entry.type, "passkeyCreationOptions.pubKeyCredParams.type"), text(String(entry.alg), "passkeyCreationOptions.pubKeyCredParams.alg")]));
+	const excludeCredentials = value.excludeCredentials.map((entry) => concat([text(entry.type, "passkeyCreationOptions.excludeCredentials.type"), text(entry.id, "passkeyCreationOptions.excludeCredentials.id")]));
+	return concat([
+		text(value.kind, "passkeyCreationOptions.kind"),
+		text(value.walletAuthMethodId, "passkeyCreationOptions.walletAuthMethodId"),
+		text(value.challengeId, "passkeyCreationOptions.challengeId"),
+		text(value.challengeB64u, "passkeyCreationOptions.challengeB64u"),
+		text(value.rpId, "passkeyCreationOptions.rpId"),
+		text(value.user.idB64u, "passkeyCreationOptions.user.idB64u"),
+		text(value.user.name, "passkeyCreationOptions.user.name"),
+		text(value.user.displayName, "passkeyCreationOptions.user.displayName"),
+		u32(algorithms.length, "passkeyCreationOptions.pubKeyCredParams"),
+		...algorithms.map((entry) => lp32(entry, "passkeyCreationOptions.pubKeyCredParams.item")),
+		text(value.authenticatorSelection.residentKey, "passkeyCreationOptions.authenticatorSelection.residentKey"),
+		text(value.authenticatorSelection.userVerification, "passkeyCreationOptions.authenticatorSelection.userVerification"),
+		u64(value.timeoutMs, "passkeyCreationOptions.timeoutMs"),
+		text(value.attestation, "passkeyCreationOptions.attestation"),
+		text(value.extensions.prf.eval.firstB64u, "passkeyCreationOptions.extensions.prf.eval.firstB64u"),
+		text(value.extensions.prf.eval.secondB64u, "passkeyCreationOptions.extensions.prf.eval.secondB64u"),
+		u32(excludeCredentials.length, "passkeyCreationOptions.excludeCredentials"),
+		...excludeCredentials.map((entry) => lp32(entry, "passkeyCreationOptions.excludeCredentials.item"))
+	]);
+}
+function encodeRecipientRequirement(value) {
+	return concat([
+		text(value.kind, "recipientRequirement.kind"),
+		text(value.keyFamily, "recipientRequirement.keyFamily"),
+		text(value.walletKeyId, "recipientRequirement.walletKeyId")
+	]);
+}
+function encodeEd25519ExportRootPreparation(value) {
+	if (value === null) return text("none", "ed25519ExportRoot.kind");
+	return concat([
+		text(value.kind, "ed25519ExportRoot.kind"),
+		text(value.walletKeyId, "ed25519ExportRoot.walletKeyId"),
+		rawDigest(value.applicationBindingDigestB64u, "ed25519ExportRoot.applicationBindingDigestB64u"),
+		rawPublicKey(value.registeredPublicKeyB64u, "ed25519ExportRoot.registeredPublicKeyB64u"),
+		u64(value.revocationEpoch, "ed25519ExportRoot.revocationEpoch")
+	]);
+}
+function encodeLinkedDeviceTargetPreparationV1(value) {
+	const requirements = value.ordinarySignerMaterialRecipientRequirements.map(encodeRecipientRequirement);
+	const passkeyPreparation = isPasskeyTargetPreparationV1(value) ? value : void 0;
+	const passkeyCreationOptions = passkeyPreparation?.passkeyCreationOptions;
+	if (value.targetFactor.kind === "passkey_prf" && !passkeyCreationOptions) throw new Error("passkey target preparation is missing creation options");
+	return concat([
+		text(TARGET_PREPARATION_DOMAIN, "domain"),
+		text(value.kind, "kind"),
+		text(value.linkSessionId, "linkSessionId"),
+		text(value.walletId, "walletId"),
+		text(value.enrollmentId, "enrollmentId"),
+		text(value.deviceId, "deviceId"),
+		lp32(rawPublicKey(value.deliveryRecipientPublicKey65B64u, "deliveryRecipientPublicKey65B64u"), "deliveryRecipientPublicKey65B64u"),
+		text(value.walletAuthMethodId, "walletAuthMethodId"),
+		lp32(encodeEd25519ExportRootPreparation(value.ed25519ExportRoot), "ed25519ExportRoot"),
+		lp32(encodeTargetFactor(value.targetFactor), "targetFactor"),
+		...passkeyCreationOptions ? [lp32(encodeLinkedDevicePasskeyCreationOptionsV1(passkeyCreationOptions), "passkeyCreationOptions"), rawDigest(passkeyPreparation.passkeyConfigurationDigestB64u, "passkeyConfigurationDigestB64u")] : [],
+		...encodeEmailTargetPreparationFactorBindingV1(value),
+		u32(requirements.length, "ordinarySignerMaterialRecipientRequirements"),
+		...requirements.map((entry) => lp32(entry, "ordinarySignerMaterialRecipientRequirements.item")),
+		u64(value.issuedAtMs, "issuedAtMs"),
+		u64(value.expiresAtMs, "expiresAtMs")
+	]);
+}
+function encodeEmailTargetPreparationFactorBindingV1(value) {
+	if (isPasskeyTargetPreparationV1(value)) return [];
+	return [
+		text(value.targetEmail, "targetEmail"),
+		text(value.enrollment.kind, "enrollment.kind"),
+		...value.enrollment.kind === "existing_enrollment" ? [text(requirePresentString(value.baseWalletAuthMethodId, "baseWalletAuthMethodId"), "baseWalletAuthMethodId")] : []
+	];
+}
+function isPasskeyTargetPreparationV1(value) {
+	return value.targetFactor.kind === "passkey_prf";
+}
+async function computeLinkedDeviceTargetPreparationDigestV1(value) {
+	return sha256DigestB64u(encodeLinkedDeviceTargetPreparationV1(value));
+}
+//#endregion
+//#region ../shared-ts/src/device-linking/requestProof.ts
+const LINKED_DEVICE_REQUEST_PROOF_HEADER_V1 = "x-seams-linked-device-proof-v1";
+const LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1 = 6e4;
+const LINKED_DEVICE_CLOCK_SKEW_TOLERANCE_MS_V1 = 6e4;
+async function computeLinkedDevicePublicKeyDigestV1(publicKeyB64u) {
+	return sha256DigestB64u(parseFixedB64u(publicKeyB64u, 32, "devicePublicKeyB64u"));
+}
+function parseFixedB64u(value, expectedBytes, label) {
+	if (typeof value !== "string" || value.length === 0 || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(`${label} is invalid`);
+	let bytes;
+	try {
+		bytes = base64UrlDecode(value);
+	} catch {
+		throw new Error(`${label} is invalid`);
+	}
+	if (bytes.length !== expectedBytes || base64UrlEncode(bytes) !== value) throw new Error(`${label} is invalid`);
+	return bytes;
+}
+//#endregion
+//#region ../shared-ts/src/utils/walletCapabilityBindings.ts
+function objectRecord(raw) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+	return raw;
+}
+function trimString(raw) {
+	return typeof raw === "string" ? raw.trim() : "";
+}
+function parseStringField(raw, fieldName) {
+	const value = trimString(raw);
+	if (!value) return {
+		ok: false,
+		error: {
+			code: "missing",
+			message: `${fieldName} is required`
+		}
+	};
+	return {
+		ok: true,
+		value
+	};
+}
+function parseSignerSlot(raw) {
+	const signerSlot = typeof raw === "number" ? raw : Number(raw);
+	if (!Number.isSafeInteger(signerSlot) || signerSlot < 1) return {
+		ok: false,
+		error: {
+			code: "invalid",
+			message: "signerSlot must be an integer >= 1"
+		}
+	};
+	return {
+		ok: true,
+		value: signerSlot
+	};
+}
+function missingObject(typeName) {
+	return {
+		ok: false,
+		error: {
+			code: "invalid",
+			message: `${typeName} must be an object`
+		}
+	};
+}
+function parseRpId(raw) {
+	const parsed = parseWebAuthnRpId(raw);
+	if (!parsed.ok) return {
+		ok: false,
+		error: parsed.error
+	};
+	return {
+		ok: true,
+		value: parsed.value
+	};
+}
+function walletIdentityFromRaw(raw) {
+	const record = objectRecord(raw);
+	if (!record) return missingObject("WalletIdentity");
+	const parsed = parseWalletId(record.walletId);
+	if (!parsed.ok) return {
+		ok: false,
+		error: parsed.error
+	};
+	return {
+		ok: true,
+		value: { walletId: parsed.value }
+	};
+}
+function buildWalletIdentity(args) {
+	return { walletId: args.walletId };
+}
+function passkeyAuthScopeFromRaw(raw) {
+	const record = objectRecord(raw);
+	if (!record) return missingObject("PasskeyAuthScope");
+	const wallet = walletIdentityFromRaw(record.wallet);
+	if (!wallet.ok) return wallet;
+	const rpId = parseRpId(record.rpId);
+	if (!rpId.ok) return rpId;
+	return {
+		ok: true,
+		value: {
+			wallet: wallet.value,
+			rpId: rpId.value
+		}
+	};
+}
+function buildPasskeyAuthScope(args) {
+	return {
+		wallet: args.wallet,
+		rpId: args.rpId
+	};
+}
+function buildPasskeyWalletAuthMethodBinding(args) {
+	const credentialIdB64u = trimString(args.credentialIdB64u);
+	if (!credentialIdB64u) throw new Error("credentialIdB64u is required");
+	return {
+		kind: "passkey",
+		walletAuthMethodId: args.walletAuthMethodId,
+		scope: args.scope,
+		credentialIdB64u
+	};
+}
+function buildEmailOtpWalletAuthMethodBinding(args) {
+	const emailHashHex = trimString(args.emailHashHex);
+	const registrationAuthorityId = trimString(args.registrationAuthorityId);
+	if (!emailHashHex) throw new Error("emailHashHex is required");
+	if (!registrationAuthorityId) throw new Error("registrationAuthorityId is required");
+	return {
+		kind: "email_otp",
+		walletAuthMethodId: args.walletAuthMethodId,
+		wallet: args.wallet,
+		emailHashHex,
+		registrationAuthorityId
+	};
+}
+function walletAuthMethodBindingFromRaw(raw) {
+	const record = objectRecord(raw);
+	if (!record) return missingObject("WalletAuthMethodBinding");
+	const kind = trimString(record.kind);
+	const walletAuthMethodId = parseWalletAuthMethodId(record.walletAuthMethodId);
+	if (!walletAuthMethodId.ok) return {
+		ok: false,
+		error: walletAuthMethodId.error
+	};
+	if (kind === "passkey") {
+		const scope = passkeyAuthScopeFromRaw(record.scope);
+		if (!scope.ok) return scope;
+		const credentialIdB64u = parseStringField(record.credentialIdB64u, "credentialIdB64u");
+		if (!credentialIdB64u.ok) return credentialIdB64u;
+		return {
+			ok: true,
+			value: buildPasskeyWalletAuthMethodBinding({
+				walletAuthMethodId: walletAuthMethodId.value,
+				scope: scope.value,
+				credentialIdB64u: credentialIdB64u.value
+			})
+		};
+	}
+	if (kind === "email_otp") {
+		if ("rpId" in record && trimString(record.rpId)) return {
+			ok: false,
+			error: {
+				code: "invalid",
+				message: "Email OTP auth-method binding must not include rpId"
+			}
+		};
+		const wallet = walletIdentityFromRaw(record.wallet);
+		if (!wallet.ok) return wallet;
+		const emailHashHex = parseStringField(record.emailHashHex, "emailHashHex");
+		if (!emailHashHex.ok) return emailHashHex;
+		const registrationAuthorityId = parseStringField(record.registrationAuthorityId, "registrationAuthorityId");
+		if (!registrationAuthorityId.ok) return registrationAuthorityId;
+		return {
+			ok: true,
+			value: buildEmailOtpWalletAuthMethodBinding({
+				walletAuthMethodId: walletAuthMethodId.value,
+				wallet: wallet.value,
+				emailHashHex: emailHashHex.value,
+				registrationAuthorityId: registrationAuthorityId.value
+			})
+		};
+	}
+	return {
+		ok: false,
+		error: {
+			code: "invalid",
+			message: "WalletAuthMethodBinding kind is invalid"
+		}
+	};
+}
+function buildImplicitNearAccountBinding(args) {
+	return {
+		kind: "implicit_near_account",
+		wallet: args.wallet,
+		nearAccountId: args.nearAccountId
+	};
+}
+function buildNamedNearAccountBinding(args) {
+	return {
+		kind: "named_near_account",
+		wallet: args.wallet,
+		nearAccountId: args.nearAccountId
+	};
+}
+function nearAccountBindingFromRaw(raw) {
+	const record = objectRecord(raw);
+	if (!record) return missingObject("NearAccountBinding");
+	const wallet = walletIdentityFromRaw(record.wallet);
+	if (!wallet.ok) return wallet;
+	const kind = trimString(record.kind);
+	if (kind === "implicit_near_account") {
+		const nearAccountId = parseImplicitNearAccountId(record.nearAccountId);
+		if (!nearAccountId.ok) return {
+			ok: false,
+			error: {
+				code: nearAccountId.code,
+				message: nearAccountId.message
+			}
+		};
+		return {
+			ok: true,
+			value: buildImplicitNearAccountBinding({
+				wallet: wallet.value,
+				nearAccountId: nearAccountId.value
+			})
+		};
+	}
+	if (kind === "named_near_account") {
+		const nearAccountId = parseNamedNearAccountId(record.nearAccountId);
+		if (!nearAccountId.ok) return {
+			ok: false,
+			error: {
+				code: nearAccountId.code,
+				message: nearAccountId.message
+			}
+		};
+		return {
+			ok: true,
+			value: buildNamedNearAccountBinding({
+				wallet: wallet.value,
+				nearAccountId: nearAccountId.value
+			})
+		};
+	}
+	return {
+		ok: false,
+		error: {
+			code: "invalid",
+			message: "NearAccountBinding kind is invalid"
+		}
+	};
+}
+function buildNearEd25519SignerBinding(args) {
+	const signerSlot = parseSignerSlot(args.signerSlot);
+	if (!signerSlot.ok) throw new Error(signerSlot.error.message);
+	return {
+		kind: "near_ed25519_signer",
+		account: args.account,
+		nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
+		signerSlot: signerSlot.value
+	};
+}
+function nearEd25519SignerBindingFromRaw(raw) {
+	const record = objectRecord(raw);
+	if (!record) return missingObject("NearEd25519SignerBinding");
+	const account = nearAccountBindingFromRaw(record.account);
+	if (!account.ok) return account;
+	const keyScopeRaw = parseStringField(record.nearEd25519SigningKeyId, "nearEd25519SigningKeyId");
+	if (!keyScopeRaw.ok) return keyScopeRaw;
+	const signerSlot = parseSignerSlot(record.signerSlot);
+	if (!signerSlot.ok) return signerSlot;
+	return {
+		ok: true,
+		value: buildNearEd25519SignerBinding({
+			account: account.value,
+			nearEd25519SigningKeyId: nearEd25519SigningKeyIdFromString(keyScopeRaw.value),
+			signerSlot: signerSlot.value
+		})
+	};
+}
+//#endregion
+//#region ../shared-ts/src/utils/thresholdEcdsaKeyHandle.ts
+function parseThresholdEcdsaKeyHandle(value) {
+	const normalized = typeof value === "string" ? value.trim() : "";
+	if (!normalized.startsWith("ederivation-key-")) throw new Error("Threshold ECDSA key handle is invalid");
+	return normalized;
+}
+function requiredString$1(value, field) {
+	const normalized = String(value ?? "").trim();
+	if (!normalized) throw new Error(`[threshold-ecdsa-key-handle] ${field} is required`);
+	return normalized;
+}
+function normalizedSigningRootVersion(value) {
+	return String(value ?? "").trim() || "default";
+}
+async function deriveThresholdEcdsaKeyHandle(input) {
+	return `ederivation-key-${base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		domain: "seams.threshold_ecdsa.key_handle.v1",
+		ecdsaThresholdKeyId: requiredString$1(input.ecdsaThresholdKeyId, "ecdsaThresholdKeyId"),
+		signingRootId: requiredString$1(input.signingRootId, "signingRootId"),
+		signingRootVersion: normalizedSigningRootVersion(input.signingRootVersion)
+	})))}`;
+}
+//#endregion
+//#region ../shared-ts/src/signing-lanes/participants.ts
+function missing(field) {
+	return {
+		code: "missing",
+		message: `${field} is required`
+	};
+}
+function invalid(field, reason) {
+	return {
+		code: "invalid",
+		message: `${field} ${reason}`
+	};
+}
+function parseIdentityId(raw, field) {
+	if (raw === void 0 || raw === null) return {
+		ok: false,
+		error: missing(field)
+	};
+	if (typeof raw !== "string") return {
+		ok: false,
+		error: invalid(field, "must be a string")
+	};
+	const value = raw.trim();
+	if (!value) return {
+		ok: false,
+		error: missing(field)
+	};
+	if (hasWhitespaceOrControlCharacters(value)) return {
+		ok: false,
+		error: invalid(field, "must not contain whitespace or control characters")
+	};
+	return {
+		ok: true,
+		value
+	};
+}
+function parseHpkePublicKey(raw, field) {
+	if (raw === void 0 || raw === null) return {
+		ok: false,
+		error: missing(field)
+	};
+	if (typeof raw !== "string" || raw.length === 0) return {
+		ok: false,
+		error: invalid(field, "must be non-empty base64url")
+	};
+	try {
+		const bytes = base64UrlDecode(raw);
+		if (bytes.length === 0 || base64UrlEncode(bytes) !== raw) return {
+			ok: false,
+			error: invalid(field, "must be canonical unpadded base64url")
+		};
+	} catch {
+		return {
+			ok: false,
+			error: invalid(field, "must be canonical unpadded base64url")
+		};
+	}
+	return {
+		ok: true,
+		value: raw
+	};
+}
+function parseDigest(raw, field, brand) {
+	if (raw === void 0 || raw === null) return {
+		ok: false,
+		error: missing(field)
+	};
+	try {
+		return {
+			ok: true,
+			value: brand(parseDigestB64u(raw))
+		};
+	} catch {
+		return {
+			ok: false,
+			error: invalid(field, "must be canonical base64url for 32 bytes")
+		};
+	}
+}
+function brandLaneCustodyDigest(value) {
+	return value;
+}
+function brandRecipientDigest(value) {
+	return value;
+}
+function brandParticipantDigest(value) {
+	return value;
+}
+function rejectUnknownFields(record, fields, label) {
+	const allowed = new Set(fields);
+	for (const field of Object.keys(record)) if (!allowed.has(field)) throw new Error(`${label}.${field} is not supported`);
+	for (const field of fields) if (!(field in record)) throw new Error(`${label}.${field} is required`);
+}
+function parseLaneHolderParticipantId(raw) {
+	return parseIdentityId(raw, "laneHolderParticipantId");
+}
+function parseSigningWorkerParticipantId(raw) {
+	return parseIdentityId(raw, "signingWorkerParticipantId");
+}
+function parseSigningWorkerRecipientKeyId(raw) {
+	return parseIdentityId(raw, "signingWorkerRecipientKeyId");
+}
+function parseLaneHolderCustodyBindingId(raw) {
+	return parseIdentityId(raw, "laneHolderCustodyBindingId");
+}
+function parseLaneParticipantBindingDigestB64u(raw) {
+	return parseDigest(raw, "participantBindingDigestB64u", brandParticipantDigest);
+}
+function parseLaneCustodyBindingDigestB64u(raw) {
+	return parseDigest(raw, "custodyBindingDigestB64u", brandLaneCustodyDigest);
+}
+function parseSigningWorkerRecipientKeyDigestB64u(raw) {
+	return parseDigest(raw, "hpkePublicKeyDigestB64u", brandRecipientDigest);
+}
+function buildLaneHolderCustodyIdentityV1(args) {
+	return {
+		kind: "lane_holder_custody_identity_v1",
+		custodyBindingId: args.custodyBindingId,
+		custodyBindingDigestB64u: args.custodyBindingDigestB64u
+	};
+}
+function buildSigningWorkerRecipientIdentityV1(args) {
+	return {
+		kind: "signing_worker_recipient_identity_v1",
+		recipientKeyId: args.recipientKeyId,
+		hpkePublicKeyB64u: args.hpkePublicKeyB64u,
+		hpkePublicKeyDigestB64u: args.hpkePublicKeyDigestB64u
+	};
+}
+function parseLaneHolderCustodyIdentityV1(raw, label = "laneHolderCustodyIdentity") {
+	const record = requireRecord(raw, label);
+	rejectUnknownFields(record, [
+		"kind",
+		"custodyBindingId",
+		"custodyBindingDigestB64u"
+	], label);
+	if (record.kind !== "lane_holder_custody_identity_v1") throw new Error(`${label}.kind is invalid`);
+	const custodyBindingId = parseLaneHolderCustodyBindingId(record.custodyBindingId);
+	if (!custodyBindingId.ok) throw new Error(`${label}.${custodyBindingId.error.message}`);
+	const custodyBindingDigestB64u = parseLaneCustodyBindingDigestB64u(record.custodyBindingDigestB64u);
+	if (!custodyBindingDigestB64u.ok) throw new Error(`${label}.${custodyBindingDigestB64u.error.message}`);
+	return buildLaneHolderCustodyIdentityV1({
+		custodyBindingId: custodyBindingId.value,
+		custodyBindingDigestB64u: custodyBindingDigestB64u.value
+	});
+}
+function parseSigningWorkerRecipientIdentityV1(raw, label = "signingWorkerRecipientIdentity") {
+	const record = requireRecord(raw, label);
+	rejectUnknownFields(record, [
+		"kind",
+		"recipientKeyId",
+		"hpkePublicKeyB64u",
+		"hpkePublicKeyDigestB64u"
+	], label);
+	if (record.kind !== "signing_worker_recipient_identity_v1") throw new Error(`${label}.kind is invalid`);
+	const recipientKeyId = parseSigningWorkerRecipientKeyId(record.recipientKeyId);
+	if (!recipientKeyId.ok) throw new Error(`${label}.${recipientKeyId.error.message}`);
+	const hpkePublicKeyB64u = parseHpkePublicKey(record.hpkePublicKeyB64u, `${label}.hpkePublicKeyB64u`);
+	if (!hpkePublicKeyB64u.ok) throw new Error(hpkePublicKeyB64u.error.message);
+	const hpkePublicKeyDigestB64u = parseSigningWorkerRecipientKeyDigestB64u(record.hpkePublicKeyDigestB64u);
+	if (!hpkePublicKeyDigestB64u.ok) throw new Error(`${label}.${hpkePublicKeyDigestB64u.error.message}`);
+	return buildSigningWorkerRecipientIdentityV1({
+		recipientKeyId: recipientKeyId.value,
+		hpkePublicKeyB64u: hpkePublicKeyB64u.value,
+		hpkePublicKeyDigestB64u: hpkePublicKeyDigestB64u.value
+	});
+}
+function buildLaneHolderParticipantRecordV1(args) {
+	return {
+		kind: "lane_holder_participant_v1",
+		participantId: args.participantId,
+		custodyBindingId: args.custody.custodyBindingId,
+		custodyBindingDigestB64u: args.custody.custodyBindingDigestB64u,
+		hpkePublicKeyB64u: args.hpkePublicKeyB64u,
+		hpkePublicKeyDigestB64u: args.hpkePublicKeyDigestB64u,
+		participantBindingDigestB64u: args.participantBindingDigestB64u
+	};
+}
+function buildSigningWorkerParticipantRecordV1(args) {
+	return {
+		kind: "signing_worker_participant_v1",
+		participantId: args.participantId,
+		recipientKeyId: args.recipient.recipientKeyId,
+		hpkePublicKeyB64u: args.recipient.hpkePublicKeyB64u,
+		hpkePublicKeyDigestB64u: args.recipient.hpkePublicKeyDigestB64u,
+		participantBindingDigestB64u: args.participantBindingDigestB64u
+	};
+}
+function parseLaneHolderParticipantRecordV1(raw, label = "laneHolderParticipant") {
+	const record = requireRecord(raw, label);
+	rejectUnknownFields(record, [
+		"kind",
+		"participantId",
+		"custodyBindingId",
+		"custodyBindingDigestB64u",
+		"hpkePublicKeyB64u",
+		"hpkePublicKeyDigestB64u",
+		"participantBindingDigestB64u"
+	], label);
+	if (record.kind !== "lane_holder_participant_v1") throw new Error(`${label}.kind is invalid`);
+	const participantId = parseLaneHolderParticipantId(record.participantId);
+	if (!participantId.ok) throw new Error(`${label}.${participantId.error.message}`);
+	const custody = parseLaneHolderCustodyIdentityV1({
+		kind: "lane_holder_custody_identity_v1",
+		custodyBindingId: record.custodyBindingId,
+		custodyBindingDigestB64u: record.custodyBindingDigestB64u
+	}, `${label}.custody`);
+	const hpkePublicKeyB64u = parseHpkePublicKey(record.hpkePublicKeyB64u, `${label}.hpkePublicKeyB64u`);
+	if (!hpkePublicKeyB64u.ok) throw new Error(hpkePublicKeyB64u.error.message);
+	const hpkePublicKeyDigestB64u = parseSigningWorkerRecipientKeyDigestB64u(record.hpkePublicKeyDigestB64u);
+	if (!hpkePublicKeyDigestB64u.ok) throw new Error(`${label}.${hpkePublicKeyDigestB64u.error.message}`);
+	const participantBindingDigestB64u = parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u);
+	if (!participantBindingDigestB64u.ok) throw new Error(`${label}.${participantBindingDigestB64u.error.message}`);
+	return buildLaneHolderParticipantRecordV1({
+		participantId: participantId.value,
+		custody,
+		hpkePublicKeyB64u: hpkePublicKeyB64u.value,
+		hpkePublicKeyDigestB64u: hpkePublicKeyDigestB64u.value,
+		participantBindingDigestB64u: participantBindingDigestB64u.value
+	});
+}
+function parseSigningWorkerParticipantRecordV1(raw, label = "signingWorkerParticipant") {
+	const record = requireRecord(raw, label);
+	rejectUnknownFields(record, [
+		"kind",
+		"participantId",
+		"recipientKeyId",
+		"hpkePublicKeyB64u",
+		"hpkePublicKeyDigestB64u",
+		"participantBindingDigestB64u"
+	], label);
+	if (record.kind !== "signing_worker_participant_v1") throw new Error(`${label}.kind is invalid`);
+	const participantId = parseSigningWorkerParticipantId(record.participantId);
+	if (!participantId.ok) throw new Error(`${label}.${participantId.error.message}`);
+	const recipient = parseSigningWorkerRecipientIdentityV1({
+		kind: "signing_worker_recipient_identity_v1",
+		recipientKeyId: record.recipientKeyId,
+		hpkePublicKeyB64u: record.hpkePublicKeyB64u,
+		hpkePublicKeyDigestB64u: record.hpkePublicKeyDigestB64u
+	}, `${label}.recipient`);
+	const participantBindingDigestB64u = parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u);
+	if (!participantBindingDigestB64u.ok) throw new Error(`${label}.${participantBindingDigestB64u.error.message}`);
+	return buildSigningWorkerParticipantRecordV1({
+		participantId: participantId.value,
+		recipient,
+		participantBindingDigestB64u: participantBindingDigestB64u.value
+	});
+}
+//#endregion
+//#region ../shared-ts/src/signing-lanes/ownerContinuity.ts
+const OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
+	"kind",
+	"signerId",
+	"participantIds",
+	"signingWorkerId",
+	"custodyKeyManifestDigestB64u",
+	"sourceIdentityDigestB64u"
+];
+function requireResult(result, label) {
+	if (result.ok) return result.value;
+	throw new Error(`${label} ${result.error.message}`);
+}
+/** Parse the owner signer identity without widening it into a generic string. */
+function parseWalletSignerId(raw, label = "walletSignerId") {
+	if (typeof raw !== "string") throw new Error(`${label} must be a string`);
+	const value = raw.trim();
+	if (!value) throw new Error(`${label} is required`);
+	if (hasWhitespaceOrControlCharacters(value)) throw new Error(`${label} must not contain whitespace or control characters`);
+	return value;
+}
+function parseParticipantId(raw, label) {
+	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw <= 0) throw new Error(`${label} must be a positive safe integer`);
+	return raw;
+}
+function parseParticipantIds(raw, label) {
+	if (!Array.isArray(raw) || raw.length !== 2) throw new Error(`${label} must contain exactly two participant ids`);
+	const first = parseParticipantId(raw[0], `${label}[0]`);
+	const second = parseParticipantId(raw[1], `${label}[1]`);
+	if (first === second) throw new Error(`${label} must contain distinct participant ids`);
+	return [first, second];
+}
+function buildOwnerLaneParticipantContinuityV1(args) {
+	const participantIds = parseParticipantIds(args.participantIds, "participantIds");
+	return {
+		kind: "owner_lane_participant_continuity_v1",
+		signerId: parseWalletSignerId(args.signerId),
+		participantIds,
+		signingWorkerId: requireResult(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
+		custodyKeyManifestDigestB64u: parseDigestField$1(args.custodyKeyManifestDigestB64u, "custodyKeyManifestDigestB64u"),
+		sourceIdentityDigestB64u: parseDigestField$1(args.sourceIdentityDigestB64u, "sourceIdentityDigestB64u")
+	};
+}
+function parseOwnerLaneParticipantContinuityV1(raw, label = "ownerParticipantContinuity") {
+	const record = requireRecord(raw, label);
+	rejectUnknownFields$1(record, OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS, label);
+	if (record.kind !== "owner_lane_participant_continuity_v1") throw new Error(`${label}.kind must be owner_lane_participant_continuity_v1`);
+	return buildOwnerLaneParticipantContinuityV1({
+		signerId: parseWalletSignerId(record.signerId, `${label}.signerId`),
+		participantIds: parseParticipantIds(record.participantIds, `${label}.participantIds`),
+		signingWorkerId: requireResult(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
+		custodyKeyManifestDigestB64u: parseDigestField$1(record.custodyKeyManifestDigestB64u, `${label}.custodyKeyManifestDigestB64u`),
+		sourceIdentityDigestB64u: parseDigestField$1(record.sourceIdentityDigestB64u, `${label}.sourceIdentityDigestB64u`)
+	});
+}
+new TextEncoder();
+//#endregion
+//#region src/core/signingEngine/session/identity/evmFamilyEcdsaIdentity.ts
+function requiredString(value, field) {
+	const normalized = String(value ?? "").trim();
+	if (!normalized) throw new Error(`[evm-family-ecdsa] ${field} is required`);
+	return normalized;
+}
+function normalizeRpId(value) {
+	return requiredString(value, "rpId");
+}
+function deriveEvmFamilySigningKeySlotId(input) {
+	return deriveEvmFamilySigningKeySlotId$1({
+		walletId: toWalletId(input.walletId),
+		signingRootId: normalizeSigningRootId(input.signingRootId),
+		signingRootVersion: normalizeSigningRootVersion(input.signingRootVersion)
+	});
+}
+function normalizeEcdsaThresholdKeyId(value) {
+	return requiredString(value, "ecdsaThresholdKeyId");
+}
+function normalizeSigningRootId(value) {
+	return requiredString(value, "signingRootId");
+}
+function normalizeSigningRootVersion(value) {
+	return String(value ?? "").trim() || "default";
+}
+function normalizeThresholdOwnerAddress(value) {
+	const normalized = String(value ?? "").trim().toLowerCase();
+	if (!/^0x[0-9a-f]{40}$/.test(normalized)) throw new Error("[evm-family-ecdsa] thresholdOwnerAddress must be an EVM address");
+	return normalized;
+}
+function toThresholdOwnerAddress(value) {
+	return normalizeThresholdOwnerAddress(value);
+}
+function toRpId(value) {
+	return normalizeRpId(value);
+}
+function toEvmFamilyEcdsaKeyHandle(value) {
+	return requiredString(value, "keyHandle");
+}
+function resolveThresholdEcdsaKeyIdFromRecord(args) {
+	return normalizeEcdsaThresholdKeyId(String(args.record.ecdsaThresholdKeyId ?? "").trim());
+}
+function parseThresholdSigningRootBinding(input) {
+	return {
+		signingRootId: normalizeSigningRootId(input.signingRootId),
+		signingRootVersion: normalizeSigningRootVersion(input.signingRootVersion)
+	};
+}
+function resolveThresholdSigningRootBindingFromRecord(args) {
+	return parseThresholdSigningRootBinding({
+		signingRootId: args.record.signingRootId,
+		signingRootVersion: args.record.signingRootVersion
+	});
+}
+function resolveThresholdSigningRootBindingFromRuntimePolicyScope(args) {
+	const scopeBinding = signingRootScopeFromRuntimePolicyScope(args.runtimePolicyScope);
+	return parseThresholdSigningRootBinding({
+		signingRootId: scopeBinding.signingRootId,
+		signingRootVersion: scopeBinding.signingRootVersion
+	});
+}
+function toThresholdEcdsaPublicKeyB64u(value) {
+	const normalized = requiredString(value, "thresholdEcdsaPublicKeyB64u");
+	let bytes;
+	try {
+		bytes = base64UrlDecode(normalized);
+	} catch {
+		throw new Error("[evm-family-ecdsa] thresholdEcdsaPublicKeyB64u must be base64url");
+	}
+	if (bytes.length !== 33) throw new Error("[evm-family-ecdsa] thresholdEcdsaPublicKeyB64u must decode to 33 bytes");
+	return normalized;
+}
+function toParticipantId(value) {
+	const normalized = Math.floor(Number(value));
+	if (!Number.isSafeInteger(normalized) || normalized < 1 || normalized > 65535) throw new Error("[evm-family-ecdsa] participantId must be a positive safe integer");
+	return normalized;
+}
+function normalizeParticipantIds(value) {
+	const participantIds = normalizeThresholdEd25519ParticipantIds(value);
+	if (!participantIds?.length) throw new Error("[evm-family-ecdsa] participantIds are required");
+	return participantIds.map(toParticipantId);
+}
+function participantIdKey(participantIds) {
+	return participantIds.map((id) => String(Number(id))).join(",");
+}
+function fnv1a32Hex(input) {
+	let hash = 2166136261;
+	for (let index = 0; index < input.length; index += 1) {
+		hash ^= input.charCodeAt(index);
+		hash = Math.imul(hash, 16777619) >>> 0;
+	}
+	return hash.toString(16).padStart(8, "0");
+}
+function buildNormalizedEvmFamilyEcdsaKeyIdentity(input) {
+	return {
+		walletId: input.walletId,
+		keyScope: "evm-family",
+		ecdsaThresholdKeyId: normalizeEcdsaThresholdKeyId(input.ecdsaThresholdKeyId),
+		signingRootId: normalizeSigningRootId(input.signingRootId),
+		signingRootVersion: normalizeSigningRootVersion(input.signingRootVersion),
+		participantIds: normalizeParticipantIds(input.participantIds),
+		thresholdOwnerAddress: normalizeThresholdOwnerAddress(input.thresholdOwnerAddress)
+	};
+}
+function buildBaseEvmFamilyEcdsaKeyIdentity(input) {
+	return buildNormalizedEvmFamilyEcdsaKeyIdentity({
+		walletId: toWalletId(input.walletId),
+		ecdsaThresholdKeyId: input.ecdsaThresholdKeyId,
+		signingRootId: input.signingRootId,
+		signingRootVersion: input.signingRootVersion,
+		participantIds: input.participantIds,
+		thresholdOwnerAddress: input.thresholdOwnerAddress
+	});
+}
+function deriveBaseEcdsaSubjectIdFromWalletId(walletId) {
+	return walletIdFromWalletProfile({ walletId: toWalletId(walletId) });
+}
+async function deriveEvmFamilyEcdsaKeyHandle(input) {
+	return await deriveThresholdEcdsaKeyHandle(input);
+}
+function buildVerifiedEcdsaPublicFacts(input) {
+	return {
+		kind: "verified_ecdsa_public_facts",
+		keyHandle: input.keyHandle,
+		publicKeyB64u: toThresholdEcdsaPublicKeyB64u(input.publicKeyB64u),
+		participantIds: normalizeParticipantIds(input.participantIds),
+		thresholdOwnerAddress: normalizeThresholdOwnerAddress(input.thresholdOwnerAddress)
+	};
+}
+function evmFamilyEcdsaWalletKeyToIdentity(walletKey) {
+	return {
+		walletId: walletKey.walletId,
+		keyScope: walletKey.keyFacts.keyScope,
+		ecdsaThresholdKeyId: walletKey.keyFacts.ecdsaThresholdKeyId,
+		signingRootId: walletKey.keyFacts.signingRootId,
+		signingRootVersion: walletKey.keyFacts.signingRootVersion,
+		participantIds: walletKey.keyFacts.participantIds,
+		thresholdOwnerAddress: walletKey.keyFacts.thresholdOwnerAddress
+	};
+}
+function buildEvmFamilyEcdsaWalletKey(input) {
+	const keyHandle = toEvmFamilyEcdsaKeyHandle(input.keyHandle);
+	const keyIdentity = buildBaseEvmFamilyEcdsaKeyIdentity(input);
+	const publicFacts = buildVerifiedEcdsaPublicFacts({
+		keyHandle,
+		publicKeyB64u: input.thresholdEcdsaPublicKeyB64u,
+		participantIds: keyIdentity.participantIds,
+		thresholdOwnerAddress: keyIdentity.thresholdOwnerAddress
+	});
+	return {
+		kind: "evm_family_ecdsa_wallet_key",
+		walletId: keyIdentity.walletId,
+		keyHandle,
+		chainTarget: input.chainTarget,
+		keyFacts: {
+			kind: "evm_family_ecdsa_key_facts",
+			keyScope: keyIdentity.keyScope,
+			ecdsaThresholdKeyId: keyIdentity.ecdsaThresholdKeyId,
+			signingRootId: keyIdentity.signingRootId,
+			signingRootVersion: keyIdentity.signingRootVersion,
+			participantIds: publicFacts.participantIds,
+			thresholdOwnerAddress: publicFacts.thresholdOwnerAddress,
+			thresholdEcdsaPublicKeyB64u: publicFacts.publicKeyB64u
+		}
+	};
+}
+function assertMatchingVerifiedEcdsaPublicFacts(args) {
+	const mismatches = [];
+	if (String(args.expected.keyHandle) !== String(args.actual.keyHandle)) mismatches.push("keyHandle");
+	if (String(args.expected.publicKeyB64u) !== String(args.actual.publicKeyB64u)) mismatches.push("publicKeyB64u");
+	if (participantIdKey(args.expected.participantIds) !== participantIdKey(args.actual.participantIds)) mismatches.push("participantIds");
+	if (String(args.expected.thresholdOwnerAddress) !== String(args.actual.thresholdOwnerAddress)) mismatches.push("thresholdOwnerAddress");
+	if (mismatches.length) throw new Error(`[evm-family-ecdsa] ${args.context} public facts mismatch: ${mismatches.join(", ")}`);
+}
+function buildPasskeyEcdsaAuthBinding(args) {
+	return {
+		kind: "passkey_ecdsa_auth_binding",
+		authMethod: SIGNER_AUTH_METHODS.passkey,
+		rpId: normalizeRpId(args.rpId),
+		credentialIdB64u: requiredString(args.credentialIdB64u, "credentialIdB64u")
+	};
+}
+function buildResolvedEvmFamilyEcdsaKey(input) {
+	return {
+		kind: "resolved_evm_family_ecdsa_key",
+		walletId: toWalletId(input.walletId),
+		publicFacts: input.publicFacts,
+		authBinding: input.authBinding
+	};
+}
+function buildHydratedEcdsaSignerMaterial(input) {
+	return {
+		kind: "hydrated_ecdsa_signer_material",
+		walletId: input.walletId,
+		materialActivation: input.materialActivation,
+		publicFacts: input.publicFacts,
+		chainTarget: input.chainTarget,
+		transport: input.transport,
+		clientShare: input.clientShare,
+		routerAbEcdsaDerivationNormalSigning: input.routerAbEcdsaDerivationNormalSigning
+	};
+}
+function buildEvmFamilyEcdsaSessionLanePolicy(input) {
+	const ttlMs = Math.floor(Number(input.ttlMs));
+	const remainingUses = Math.floor(Number(input.remainingUses));
+	if (!Number.isFinite(ttlMs) || ttlMs <= 0) throw new Error("[evm-family-ecdsa] ttlMs must be a positive finite value");
+	if (!Number.isFinite(remainingUses) || remainingUses <= 0) throw new Error("[evm-family-ecdsa] remainingUses must be a positive finite value");
+	return {
+		chainTarget: input.chainTarget,
+		thresholdSessionId: SigningSessionIds.thresholdEcdsaSession(input.thresholdSessionId),
+		ttlMs,
+		remainingUses,
+		runtimePolicyScope: input.runtimePolicyScope
+	};
+}
+function buildEvmFamilyEcdsaRecoveredMaterialLanePolicy(input) {
+	const ttlMs = Math.floor(Number(input.ttlMs));
+	const remainingUses = Math.floor(Number(input.remainingUses));
+	if (!Number.isFinite(ttlMs) || ttlMs <= 0) throw new Error("[evm-family-ecdsa] ttlMs must be a positive finite value");
+	if (!Number.isFinite(remainingUses) || remainingUses <= 0) throw new Error("[evm-family-ecdsa] remainingUses must be a positive finite value");
+	return {
+		chainTarget: input.chainTarget,
+		thresholdSessionId: SigningSessionIds.thresholdEcdsaSession(input.thresholdSessionId),
+		ttlMs,
+		remainingUses,
+		runtimePolicyScope: input.runtimePolicyScope
+	};
+}
+function deriveEvmFamilyKeyFingerprint(key) {
+	return `evmfam-ecdsa:${fnv1a32Hex(alphabetizeStringify({
+		version: "evm_family_ecdsa_key_fingerprint_v2",
+		walletId: String(key.walletId),
+		baseEcdsaSubjectId: String(deriveBaseEcdsaSubjectIdFromWalletId(key.walletId)),
+		keyScope: key.keyScope,
+		ecdsaThresholdKeyId: String(key.ecdsaThresholdKeyId),
+		signingRootId: String(key.signingRootId),
+		signingRootVersion: String(key.signingRootVersion),
+		participantIds: key.participantIds.map((id) => Number(id)),
+		thresholdOwnerAddress: String(key.thresholdOwnerAddress)
+	}))}`;
+}
+function deriveEvmFamilyKeyFingerprintFromPublicFacts(input) {
+	return `evmfam-ecdsa:${fnv1a32Hex(alphabetizeStringify({
+		version: "evm_family_ecdsa_public_facts_fingerprint_v1",
+		walletId: String(toWalletId(input.walletId)),
+		keyHandle: String(input.publicFacts.keyHandle),
+		publicKeyB64u: String(input.publicFacts.publicKeyB64u),
+		participantIds: input.publicFacts.participantIds.map((id) => Number(id)),
+		thresholdOwnerAddress: String(input.publicFacts.thresholdOwnerAddress)
+	}))}`;
+}
+//#endregion
+export { parseLinkedDeviceListRequestV1 as $, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1 as $t, buildImplicitNearAccountBinding as A, serializeQrLinkedDeviceSessionPayloadV5 as At, LINKED_DEVICE_CLOCK_SKEW_TOLERANCE_MS_V1 as B, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1 as Bt, toThresholdOwnerAddress as C, parseLinkedDeviceOwnerAuthorizationRequestV1 as Ct, parseSigningWorkerParticipantRecordV1 as D, parseLinkedDeviceTargetPreparationRequestV1 as Dt, parseLaneParticipantBindingDigestB64u as E, parseLinkedDeviceTargetCredentialRegistrationResultV1 as Et, buildWalletIdentity as F, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1 as Ft, computeWalletSessionInstallationReceiptDigestB64u as G, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1 as Gt, LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1 as H, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1 as Ht, nearAccountBindingFromRaw as I, ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1 as It, parseLocalAuthorityActivationFinalAckV1 as J, parseRouterAbEd25519YaoCeremonyBindingV1 as Jt, computeWalletSessionOperationCredentialDigestB64u as K, parseRouterAbEd25519YaoActivationPublicReceiptV1 as Kt, nearEd25519SignerBindingFromRaw as L, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1 as Lt, buildNearEd25519SignerBinding as M, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 as Mt, buildPasskeyAuthScope as N, parseLinkedDeviceEd25519SourcePreservingReservationV1 as Nt, parseThresholdEcdsaKeyHandle as O, parseLinkedDeviceTargetPreparationV1 as Ot, buildPasskeyWalletAuthMethodBinding as P, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 as Pt, parseLinkedDeviceWalletSessionCredentialDeliveryV1 as Q, parseRouterAbEd25519YaoParticipantIdsV1 as Qt, parseRpId as R, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1 as Rt, toThresholdEcdsaPublicKeyB64u as S, parseLinkedDeviceEmailOtpVerificationResultV1 as St, parseLaneHolderParticipantRecordV1 as T, parseLinkedDeviceSessionClaimV1 as Tt, computeLinkedDevicePublicKeyDigestV1 as U, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1 as Ut, LINKED_DEVICE_REQUEST_PROOF_HEADER_V1 as V, ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1 as Vt, computeLinkedDeviceTargetPreparationDigestV1 as W, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1 as Wt, assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1 as X, parseRouterAbEd25519YaoExportExecuteRequestV1 as Xt, parseLocalAuthorityInstallationReceiptV1 as Y, parseRouterAbEd25519YaoExportAdmissionReceiptV1 as Yt, parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1 as Z, parseRouterAbEd25519YaoExportResultV1 as Zt, resolveThresholdSigningRootBindingFromRecord as _, parseLinkedDeviceEd25519ExportRootRecipientV1 as _n, parseLinkedDeviceEmailOtpChallengeResultV1 as _t, buildEvmFamilyEcdsaWalletKey as a, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1 as an, buildLinkedDeviceSessionCancelClaimedRequestV1 as at, toParticipantId as b, parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1 as bt, buildResolvedEvmFamilyEcdsaKey as c, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 as cn, buildLinkedDeviceTargetCredentialRegistrationV1 as ct, deriveEvmFamilyKeyFingerprint as d, deriveRouterAbEd25519YaoApplicationBindingDigestV1 as dn, parseLinkSessionProjectionV1 as dt, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1 as en, parseLinkedDeviceListResultV1 as et, deriveEvmFamilyKeyFingerprintFromPublicFacts as f, parseWalletAddAuthMethodRegistrationOptions as fn, parseLinkSessionTransportEventV1 as ft, resolveThresholdEcdsaKeyIdFromRecord as g, parseLinkedDeviceEd25519ExportRootRecipientPublicKeyB64u as gn, parseLinkedDeviceEmailOtpChallengeResendRequestV1 as gt, parseThresholdSigningRootBinding as h, parseLinkedDeviceEd25519ExportRootPackageV1 as hn, parseLinkedDeviceEmailOtpBaseFactorResolutionResultV1 as ht, buildEvmFamilyEcdsaSessionLanePolicy as i, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1 as in, buildLinkedDeviceApprovalV1 as it, buildNamedNearAccountBinding as j, parseCommittedAuthorityPackagesV1 as jt, buildEmailOtpWalletAuthMethodBinding as k, parseQrLinkedDeviceSessionPayloadV5 as kt, buildVerifiedEcdsaPublicFacts as l, sameRouterAbEd25519YaoActivationBindingV1 as ln, buildQrLinkedDeviceSessionPayloadV5 as lt, evmFamilyEcdsaWalletKeyToIdentity as m, buildLinkedDeviceEd25519ExportRootTransferBindingV1 as mn, parseLinkedDeviceApprovalResultV1 as mt, buildBaseEvmFamilyEcdsaKeyIdentity as n, parseRouterAbEd25519YaoRecoveryActivationResultV1 as nn, parseLinkedDeviceRevokeResultV1 as nt, buildHydratedEcdsaSignerMaterial as o, parseRouterAbEd25519YaoRegistrationActivationResultV1 as on, buildLinkedDeviceSessionCancelUnclaimedRequestV1 as ot, deriveEvmFamilySigningKeySlotId as p, LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1 as pn, parseLinkedDeviceApprovalDeliveryV1 as pt, parseActivateInstalledAuthorityResultV1 as q, parseRouterAbEd25519YaoApplicationBindingFactsV1 as qt, buildEvmFamilyEcdsaRecoveredMaterialLanePolicy as r, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1 as rn, parseWebAuthnAuthenticatorDeviceInfo as rt, buildPasskeyEcdsaAuthBinding as s, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 as sn, buildLinkedDeviceSessionClaimRequestV1 as st, assertMatchingVerifiedEcdsaPublicFacts as t, parseRouterAbEd25519YaoRecoveryActivationReceiptV1 as tn, parseLinkedDeviceRevokeRequestV1 as tt, deriveEvmFamilyEcdsaKeyHandle as u, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 as un, parseLinkDevicePublicKeyB64u as ut, resolveThresholdSigningRootBindingFromRuntimePolicyScope as v, serializeLinkedDeviceEd25519ExportRootTransferBindingV1 as vn, parseLinkedDeviceEmailOtpChallengeStartRequestV1 as vt, parseOwnerLaneParticipantContinuityV1 as w, parseLinkedDeviceOwnerAuthorizationSourceV1 as wt, toRpId as x, parseLinkedDeviceEmailOtpVerificationGrantV1 as xt, toEvmFamilyEcdsaKeyHandle as y, assertNeverLinkSessionStateV1 as yn, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1 as yt, walletAuthMethodBindingFromRaw as z, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1 as zt };