@seams/wallet 0.6.2 → 0.7.1

package/dist/esm/shared-ts/src/device-linking/parsers.js

@@ -1,15 +1,12 @@
-import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcMaterialActivationRef, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
-import { parseDeviceId as parseDeviceId$1, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
-import { delegatedWalletPermissionNamesV1, parseDelegatedWalletAuthorityV1 } from "../authorization/delegatedAuthority.js";
+import { requireArray, requireRecord } from "../utils/validation.js";
+import { exactRecord } from "../utils/exactRecord.js";
+import { wireLiteral, wireNullable, wireObject, wireUnion } from "../utils/wireSchema.js";
+import { delegatedWalletPermissionNamesV1 } from "../authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { parseWalletAddAuthMethodRegistrationOptions } from "../utils/addAuthMethodRegistration.js";
-import { parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1, parseLinkedDeviceWalletSessionCredentialDeliveryV1 } from "./walletSessionCredentialDelivery.js";
-import { parseEd25519PublicKeyB64u, parseUnixMs, rejectUnknownFields, requireRecord } from "../passkey-custody/primitives.js";
-import { parseWalletAuthorityV1, parseWalletSignerActivationSetV1 } from "../authorization/walletAuthority.js";
-import { parseWalletAuthMethodRecordV2 } from "../utils/registrationIntent.js";
+import { parseEd25519PublicKeyB64u } from "../passkey-custody/primitives.js";
+import { authorizationDeviceId, credentialId, digest, enrollmentId, linkedDeviceId, parseDelegatedWalletAuthority, parseNonEmptyToken, parseNonNegativeSafeInteger, parseTargetEmail, parseUnixTime, rpId, sessionId, walletAuthMethodId, walletAuthorityId, walletId, walletKeyId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
 import { requireRouterAbX25519PublicKey } from "../utils/routerAbPublicKeyset.js";
-import { parseWebAuthnAuthenticatorDeviceInfo } from "../utils/webauthnDeviceInfo.js";
+import { parseWalletAddAuthMethodRegistrationOptions } from "../utils/addAuthMethodRegistration.js";
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1 } from "./sourceContribution.js";
 import "./committedSignerPackages.js";
 //#region ../shared-ts/src/device-linking/parsers.ts
@@ -24,232 +21,16 @@ const QR_FIELDS = [
 	"issuedAtMs",
 	"expiresAtMs"
 ];
-const QR_EMAIL_FIELDS = [...QR_FIELDS, "targetEmail"];
-const OWNER_AUTHORIZATION_REQUEST_FIELDS = ["payload", "requestedAtMs"];
-const CLAIM_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"walletId",
-	"enrollmentId",
-	"deviceId",
-	"devicePublicKeyB64u",
-	"targetFactor",
-	"sessionRevision",
-	"claimedAtMs",
-	"claimExpiresAtMs"
-];
-const OWNER_AUTH_WALLET_SESSION_FIELDS = [
-	"kind",
-	"walletSessionId",
-	"authorizationId"
-];
-const ENROLLMENT_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"walletId",
-	"enrollmentId",
-	"deviceId",
-	"linkPublicKeyB64u",
-	"devicePublicKeyB64u",
-	"permission",
-	"targetFactor",
-	"ownerAuthorization",
-	"approvedAtMs",
-	"expiresAtMs"
-];
-const ENROLLMENT_FIELDS_WITH_SOURCE_CONTRIBUTION = [...ENROLLMENT_FIELDS, "sourceContribution"];
-const APPROVAL_DELIVERY_FIELDS = ["kind", "approval"];
-const CREDENTIAL_BASE_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"walletId",
-	"enrollmentId",
-	"deviceId",
-	"walletAuthMethodId",
-	"targetFactor",
-	"targetPreparationDigestB64u",
-	"ordinarySignerMaterialRecipientRequests",
-	"registeredAtMs"
-];
-const PASSKEY_CREDENTIAL_FIELDS = [...CREDENTIAL_BASE_FIELDS, "webauthnRegistration"];
-const EMAIL_OTP_CREDENTIAL_FIELDS = [
-	...CREDENTIAL_BASE_FIELDS,
-	"targetEmail",
-	"emailOtpVerificationGrant"
-];
-const EMAIL_OTP_CREDENTIAL_NEW_FIELDS = [...EMAIL_OTP_CREDENTIAL_FIELDS, "emailOtpEnrollment"];
-const TARGET_PREPARATION_BASE_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"walletId",
-	"enrollmentId",
-	"deviceId",
-	"deliveryRecipientPublicKey65B64u",
-	"walletAuthMethodId",
-	"ed25519ExportRoot",
-	"targetFactor",
-	"ordinarySignerMaterialRecipientRequirements",
-	"issuedAtMs",
-	"expiresAtMs"
-];
-const TARGET_PREPARATION_REQUEST_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"deliveryRecipientPublicKey65B64u"
-];
-const TARGET_PREPARATION_PASSKEY_FIELDS = [
-	...TARGET_PREPARATION_BASE_FIELDS,
-	"passkeyCreationOptions",
-	"passkeyConfigurationDigestB64u"
-];
-const TARGET_PREPARATION_EMAIL_FIELDS = [
-	...TARGET_PREPARATION_BASE_FIELDS,
-	"targetEmail",
-	"enrollment",
-	"baseWalletAuthMethodId"
-];
-const TARGET_PREPARATION_EMAIL_NEW_FIELDS = [
-	...TARGET_PREPARATION_BASE_FIELDS,
-	"targetEmail",
-	"enrollment"
-];
-const EMAIL_OTP_VERIFICATION_GRANT_BASE_FIELDS = [
-	"kind",
-	"grantId",
-	"grantToken",
-	"challengeId",
-	"linkSessionId",
-	"walletId",
-	"enrollmentId",
-	"deviceId",
-	"targetPreparationDigestB64u",
-	"targetEmail",
-	"enrollment",
-	"emailHashHex",
-	"registrationAuthorityId",
-	"providerUserId",
-	"authorityDigestB64u",
-	"issuedAtMs",
-	"expiresAtMs"
-];
-const EMAIL_OTP_VERIFICATION_GRANT_FIELDS = [...EMAIL_OTP_VERIFICATION_GRANT_BASE_FIELDS, "baseWalletAuthMethodId"];
-const EMAIL_OTP_FACTOR_RELEASE_FIELDS = [
-	"kind",
-	"challengeId",
-	"enrollmentId",
-	"enrollmentSealKeyVersion",
-	"serverEphemeralPublicKey65B64u",
-	"nonce12B64u",
-	"ciphertextB64u"
-];
-const WEBAUTHN_REGISTRATION_FIELDS = [
-	"kind",
-	"credentialIdB64u",
-	"authenticatorAttachment",
-	"clientDataJsonB64u",
-	"attestationObjectB64u",
-	"transports"
-];
-const APPROVAL_PENDING_FIELDS = ["outcome", "state"];
-const APPROVAL_REPLAY_FIELDS = ["outcome", "replay"];
-const APPROVAL_REPLAY_PENDING_FIELDS = ["state", "session"];
-const LINKED_DEVICE_SUMMARY_FIELDS = [
-	"deviceId",
-	"enrollmentId",
-	"walletId",
-	"credential",
-	"permission",
-	"keyManifestDigestB64u",
-	"coveredWalletKeys",
-	"state",
-	"createdAtMs",
-	"lastActivityAtMs",
-	"revocationEpoch"
-];
-const LINKED_OWNER_PASSKEY_CREDENTIAL_FIELDS = [
-	"kind",
-	"walletAuthMethodId",
-	"credentialIdB64u",
-	"device"
-];
-const LINKED_OWNER_EMAIL_OTP_CREDENTIAL_FIELDS = [
-	"kind",
-	"walletAuthMethodId",
-	"email"
-];
-const LINKED_DEVICE_LIST_REQUEST_FIELDS = [
-	"kind",
-	"walletId",
-	"limit",
-	"cursor"
-];
-const OWNER_DEVICE_SUMMARY_FIELDS = [
-	"walletId",
-	"walletAuthorityId",
-	"credential",
-	"createdAtMs",
-	"lastActivityAtMs"
-];
-const LINKED_DEVICE_LIST_RESULT_FIELDS = [
-	"devices",
-	"ownerDevices",
-	"nextCursor"
-];
-const LINKED_DEVICE_REVOKE_REQUEST_FIELDS = [
-	"kind",
-	"walletId",
-	"walletAuthMethodId",
-	"requestedAtMs"
-];
-const LINKED_DEVICE_REVOKE_SUCCESS_FIELDS = [
-	"kind",
-	"walletAuthMethodId",
-	"authorityId",
-	"revocationEpoch"
-];
-const LINKED_DEVICE_REVOKE_FAILURE_FIELDS = ["kind"];
-function exactRecord(raw, fields, label) {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, fields, label);
-	for (const field of fields) if (!Object.prototype.hasOwnProperty.call(record, field) || record[field] === void 0) throw new Error(`${label}.${field} is required`);
-	return record;
-}
-function parseId(parser, raw, label) {
-	const result = parser(raw);
-	if (result.ok) return result.value;
-	throw new Error(`${label} ${result.error.message}`);
-}
-function parseLinkedDeviceRevokeWalletAuthMethodId(raw, label) {
-	const value = parseId(parseWalletAuthMethodId, raw, label);
-	if (value.startsWith("wallet-authority:") || value.startsWith("authority:")) throw new Error(`${label} must identify a WalletAuthMethodId`);
-	return value;
-}
-function parseUnixTime(raw, label) {
-	try {
-		return parseUnixMs(raw, label);
-	} catch (error) {
-		throw new Error(error instanceof Error ? error.message : `${label} is invalid`);
-	}
+function supportedLiteral(...values) {
+	return (raw, label) => {
+		if (!values.includes(raw)) throw new Error(`${label} is unsupported`);
+		return raw;
+	};
 }
 function parseEmailHashHex(raw, label) {
 	if (typeof raw !== "string" || !/^[0-9a-f]{64}$/.test(raw)) throw new Error(`${label} must be 32 canonical lowercase hex bytes`);
 	return raw;
 }
-function parseNonEmptyToken(raw, label) {
-	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw) throw new Error(`${label} must be a non-empty canonical string`);
-	for (const character of raw) {
-		const code = character.charCodeAt(0);
-		if (/\s/.test(character) || code <= 31 || code === 127) throw new Error(`${label} must not contain whitespace or control characters`);
-	}
-	return raw;
-}
-function parseDigest(raw, label) {
-	try {
-		return parseDigestB64u(raw);
-	} catch (error) {
-		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
-	}
-}
 function parsePublicKey(raw, label) {
 	if (typeof raw !== "string" || raw.length === 0 || !/^[A-Za-z0-9_-]+$/.test(raw)) throw new Error(`${label} must be canonical unpadded base64url`);
 	try {
@@ -309,33 +90,15 @@ function parseLinkDevicePublicKeyB64u(raw) {
 	return parsePublicKey(raw, "LinkDevicePublicKeyB64u");
 }
 function parseCredential(raw, label) {
-	return parseId(parseWebAuthnCredentialIdB64u, parseCanonicalBase64UrlBytes(raw, label), label);
+	return credentialId(parseCanonicalBase64UrlBytes(raw, label), label);
 }
 function parseKeyFamily(raw, label) {
 	if (raw !== "ed25519" && raw !== "ecdsa_secp256k1") throw new Error(`${label} must identify a supported key family`);
 	return raw;
 }
-function parseNonNegativeSafeInteger(raw, label) {
-	if (!Number.isSafeInteger(raw) || Number(raw) < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	return Number(raw);
-}
-function parsePositiveSafeInteger(raw, label) {
-	const value = parseNonNegativeSafeInteger(raw, label);
-	if (value < 1) throw new Error(`${label} must be a positive safe integer`);
-	return value;
-}
-function parseNullableCursor(raw, label) {
-	if (raw === null) return null;
-	return parseNonEmptyToken(raw, label);
-}
 function assertExpiryAfterIssued(issuedAtMs, expiresAtMs, label) {
 	if (expiresAtMs <= issuedAtMs) throw new Error(`${label}.expiresAtMs must be after issuedAtMs`);
 }
-function parseDelegatedWalletAuthority(raw, label) {
-	const result = parseDelegatedWalletAuthorityV1(raw);
-	if (!result.ok) throw new Error(`${label}: ${result.error.message}`);
-	return result.value;
-}
 function delegatedWalletAuthorityWireValue(value) {
 	return {
 		kind: value.kind,
@@ -366,36 +129,31 @@ function parseTargetFactor(raw, label) {
 		default: throw new Error(`${label}.kind is unsupported`);
 	}
 }
-function parseTargetEmail(raw, label) {
-	const parsed = parseVerifiedEmailAddress(raw);
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
+function passkeyTargetFactorV1() {
+	return wireObject({ kind: wireLiteral("passkey_prf") });
 }
-function parseEmailOtpEnrollmentSelection(raw, label) {
-	const record = requireRecord(raw, label);
-	if (record.kind === "existing_enrollment") {
-		exactRecord(record, ["kind"], label);
-		return { kind: "existing_enrollment" };
-	}
-	if (record.kind === "new_enrollment") {
-		exactRecord(record, ["kind"], label);
-		return { kind: "new_enrollment" };
-	}
-	throw new Error(`${label}.kind is invalid`);
+function emailOtpTargetFactorV1() {
+	return wireObject({ kind: wireLiteral("email_otp") });
 }
-function parseEmailOtpEnrollmentMaterial(raw, label) {
-	const record = exactRecord(raw, [
-		"enrollmentSealKeyVersion",
-		"clientUnlockPublicKeyB64u",
-		"unlockKeyVersion",
-		"serverSealedFactorCiphertextB64u"
-	], label);
-	return {
-		enrollmentSealKeyVersion: parseNonEmptyToken(record.enrollmentSealKeyVersion, `${label}.enrollmentSealKeyVersion`),
-		clientUnlockPublicKeyB64u: parseNonEmptyToken(record.clientUnlockPublicKeyB64u, `${label}.clientUnlockPublicKeyB64u`),
-		unlockKeyVersion: parseNonEmptyToken(record.unlockKeyVersion, `${label}.unlockKeyVersion`),
-		serverSealedFactorCiphertextB64u: parseNonEmptyToken(record.serverSealedFactorCiphertextB64u, `${label}.serverSealedFactorCiphertextB64u`)
-	};
+function existingEnrollmentV1() {
+	return wireObject({ kind: wireLiteral("existing_enrollment") });
+}
+function newEnrollmentV1() {
+	return wireObject({ kind: wireLiteral("new_enrollment") });
+}
+function emailOtpEnrollmentSelectionV1() {
+	return wireUnion("kind", [existingEnrollmentV1(), newEnrollmentV1()]);
+}
+function parseEmailOtpEnrollmentSelection(raw, label) {
+	return emailOtpEnrollmentSelectionV1()(raw, label);
+}
+function emailOtpEnrollmentMaterialV1() {
+	return wireObject({
+		enrollmentSealKeyVersion: parseNonEmptyToken,
+		clientUnlockPublicKeyB64u: parseNonEmptyToken,
+		unlockKeyVersion: parseNonEmptyToken,
+		serverSealedFactorCiphertextB64u: parseNonEmptyToken
+	});
 }
 function parseApprovedTargetFactor(raw, label) {
 	const record = requireRecord(raw, label);
@@ -410,7 +168,7 @@ function parseApprovedTargetFactor(raw, label) {
 			kind: "email_otp",
 			targetEmail,
 			enrollment,
-			baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, exactRecord(record, [
+			baseWalletAuthMethodId: walletAuthMethodId(exactRecord(record, [
 				"kind",
 				"targetEmail",
 				"enrollment",
@@ -430,131 +188,6 @@ function parseApprovedTargetFactor(raw, label) {
 	}
 	throw new Error(`${label}.kind is unsupported`);
 }
-function parseSessionId(raw, label) {
-	return parseId(parseLinkDeviceSessionId, raw, label);
-}
-function parseWallet(raw, label) {
-	return parseId(parseWalletId, raw, label);
-}
-function parseEnrollmentId(raw, label) {
-	return parseId(parseLinkedDeviceEnrollmentId, raw, label);
-}
-function parseDeviceId(raw, label) {
-	return parseId(parseLinkedDeviceId, raw, label);
-}
-function parseWalletKey(raw, label) {
-	return parseId(parseWalletKeyId, raw, label);
-}
-function parseWalletSession(raw, label) {
-	return parseId(parseWalletSessionId, raw, label);
-}
-function parseWalletAuthorization(raw, label) {
-	return parseId(parseWalletSessionAuthorizationId, raw, label);
-}
-function parseLinkedOwnerCredentialMetadata(raw, label) {
-	const record = requireRecord(raw, label);
-	switch (record.kind) {
-		case "passkey": {
-			const exact = exactRecord(record, LINKED_OWNER_PASSKEY_CREDENTIAL_FIELDS, label);
-			const device = parseWebAuthnAuthenticatorDeviceInfo(exact.device);
-			if (!device) throw new Error(`${label}.device is invalid`);
-			return {
-				kind: "passkey",
-				walletAuthMethodId: parseId(parseWalletAuthMethodId, exact.walletAuthMethodId, `${label}.walletAuthMethodId`),
-				credentialIdB64u: parseId(parseWebAuthnCredentialIdB64u, exact.credentialIdB64u, `${label}.credentialIdB64u`),
-				device
-			};
-		}
-		case "email_otp": {
-			const exact = exactRecord(record, LINKED_OWNER_EMAIL_OTP_CREDENTIAL_FIELDS, label);
-			return {
-				kind: "email_otp",
-				walletAuthMethodId: parseId(parseWalletAuthMethodId, exact.walletAuthMethodId, `${label}.walletAuthMethodId`),
-				email: parseTargetEmail(exact.email, `${label}.email`)
-			};
-		}
-		default: throw new Error(`${label}.kind is invalid`);
-	}
-}
-function parseLinkedDeviceSummaryRecord(record) {
-	const state = record.state;
-	if (state !== "provisioning" && state !== "active" && state !== "suspended" && state !== "expired" && state !== "revoked") throw new Error("LinkedDeviceSummaryV1.state is invalid");
-	if (!Array.isArray(record.coveredWalletKeys)) throw new Error("LinkedDeviceSummaryV1.coveredWalletKeys is invalid");
-	const coveredWalletKeys = record.coveredWalletKeys.map((value, index) => parseWalletKey(value, `LinkedDeviceSummaryV1.coveredWalletKeys[${index}]`));
-	return {
-		deviceId: parseDeviceId(record.deviceId, "LinkedDeviceSummaryV1.deviceId"),
-		enrollmentId: parseEnrollmentId(record.enrollmentId, "LinkedDeviceSummaryV1.enrollmentId"),
-		walletId: parseWallet(record.walletId, "LinkedDeviceSummaryV1.walletId"),
-		credential: parseLinkedOwnerCredentialMetadata(record.credential, "LinkedDeviceSummaryV1.credential"),
-		permission: parseDelegatedWalletAuthority(record.permission, "LinkedDeviceSummaryV1.permission"),
-		keyManifestDigestB64u: parseDigest(record.keyManifestDigestB64u, "LinkedDeviceSummaryV1.keyManifestDigestB64u"),
-		coveredWalletKeys,
-		state,
-		createdAtMs: parseUnixTime(record.createdAtMs, "LinkedDeviceSummaryV1.createdAtMs"),
-		lastActivityAtMs: parseUnixTime(record.lastActivityAtMs, "LinkedDeviceSummaryV1.lastActivityAtMs"),
-		revocationEpoch: parseNonNegativeSafeInteger(record.revocationEpoch, "LinkedDeviceSummaryV1.revocationEpoch")
-	};
-}
-function parseLinkedDeviceSummaryV1(raw) {
-	return parseLinkedDeviceSummaryRecord(exactRecord(raw, LINKED_DEVICE_SUMMARY_FIELDS, "LinkedDeviceSummaryV1"));
-}
-function parseLinkedDeviceListRequestV1(raw) {
-	const record = exactRecord(raw, LINKED_DEVICE_LIST_REQUEST_FIELDS, "LinkedDeviceListRequestV1");
-	if (record.kind !== "linked_device_list_request_v1") throw new Error("LinkedDeviceListRequestV1.kind is invalid");
-	return {
-		kind: "linked_device_list_request_v1",
-		walletId: parseWallet(record.walletId, "LinkedDeviceListRequestV1.walletId"),
-		limit: parsePositiveSafeInteger(record.limit, "LinkedDeviceListRequestV1.limit"),
-		cursor: parseNullableCursor(record.cursor, "LinkedDeviceListRequestV1.cursor")
-	};
-}
-function parseOwnerDeviceSummaryV1(raw) {
-	const record = exactRecord(raw, OWNER_DEVICE_SUMMARY_FIELDS, "OwnerDeviceSummaryV1");
-	return {
-		walletId: parseWallet(record.walletId, "OwnerDeviceSummaryV1.walletId"),
-		walletAuthorityId: parseId(parseWalletAuthorityId, record.walletAuthorityId, "OwnerDeviceSummaryV1.walletAuthorityId"),
-		credential: parseLinkedOwnerCredentialMetadata(record.credential, "OwnerDeviceSummaryV1.credential"),
-		createdAtMs: parseUnixTime(record.createdAtMs, "OwnerDeviceSummaryV1.createdAtMs"),
-		lastActivityAtMs: parseUnixTime(record.lastActivityAtMs, "OwnerDeviceSummaryV1.lastActivityAtMs")
-	};
-}
-function parseLinkedDeviceListResultV1(raw) {
-	const record = exactRecord(raw, LINKED_DEVICE_LIST_RESULT_FIELDS, "LinkedDeviceListResultV1");
-	if (!Array.isArray(record.devices)) throw new Error("LinkedDeviceListResultV1.devices is invalid");
-	if (!Array.isArray(record.ownerDevices)) throw new Error("LinkedDeviceListResultV1.ownerDevices is invalid");
-	return {
-		devices: record.devices.map(parseLinkedDeviceSummaryV1),
-		ownerDevices: record.ownerDevices.map(parseOwnerDeviceSummaryV1),
-		nextCursor: parseNullableCursor(record.nextCursor, "LinkedDeviceListResultV1.nextCursor")
-	};
-}
-function parseLinkedDeviceRevokeRequestV1(raw) {
-	const record = exactRecord(raw, LINKED_DEVICE_REVOKE_REQUEST_FIELDS, "LinkedDeviceRevokeRequestV1");
-	if (record.kind !== "linked_device_revoke_request_v1") throw new Error("LinkedDeviceRevokeRequestV1.kind is invalid");
-	return {
-		kind: "linked_device_revoke_request_v1",
-		walletId: parseWallet(record.walletId, "LinkedDeviceRevokeRequestV1.walletId"),
-		walletAuthMethodId: parseLinkedDeviceRevokeWalletAuthMethodId(record.walletAuthMethodId, "LinkedDeviceRevokeRequestV1.walletAuthMethodId"),
-		requestedAtMs: parseUnixTime(record.requestedAtMs, "LinkedDeviceRevokeRequestV1.requestedAtMs")
-	};
-}
-function parseLinkedDeviceRevokeResultV1(raw) {
-	const initial = requireRecord(raw, "LinkedDeviceRevokeResultV1");
-	if (initial.kind === "not_found" || initial.kind === "conflict" || initial.kind === "unauthorized") switch (exactRecord(initial, LINKED_DEVICE_REVOKE_FAILURE_FIELDS, "LinkedDeviceRevokeResultV1").kind) {
-		case "not_found": return { kind: "not_found" };
-		case "conflict": return { kind: "conflict" };
-		case "unauthorized": return { kind: "unauthorized" };
-		default: throw new Error("LinkedDeviceRevokeResultV1.kind is invalid");
-	}
-	const record = exactRecord(initial, LINKED_DEVICE_REVOKE_SUCCESS_FIELDS, "LinkedDeviceRevokeResultV1");
-	if (record.kind !== "revoked") throw new Error("LinkedDeviceRevokeResultV1.kind is invalid");
-	return {
-		kind: record.kind,
-		walletAuthMethodId: parseLinkedDeviceRevokeWalletAuthMethodId(record.walletAuthMethodId, "LinkedDeviceRevokeResultV1.walletAuthMethodId"),
-		authorityId: parseId(parseWalletAuthorityId, record.authorityId, "LinkedDeviceRevokeResultV1.authorityId"),
-		revocationEpoch: parseNonNegativeSafeInteger(record.revocationEpoch, "LinkedDeviceRevokeResultV1.revocationEpoch")
-	};
-}
 function parseQrPayloadRecord(record) {
 	if (record.version !== "v5") throw new Error("QrLinkedDeviceSessionPayloadV5.version is invalid");
 	if (record.purpose !== "linked_device_lane_creation") throw new Error("QrLinkedDeviceSessionPayloadV5.purpose is invalid");
@@ -564,7 +197,7 @@ function parseQrPayloadRecord(record) {
 	const base = {
 		version: "v5",
 		purpose: "linked_device_lane_creation",
-		linkSessionId: parseSessionId(record.linkSessionId, "QrLinkedDeviceSessionPayloadV5.linkSessionId"),
+		linkSessionId: sessionId(record.linkSessionId, "QrLinkedDeviceSessionPayloadV5.linkSessionId"),
 		linkPublicKeyB64u: parsePublicKey(record.linkPublicKeyB64u, "QrLinkedDeviceSessionPayloadV5.linkPublicKeyB64u"),
 		devicePublicKeyB64u: parsePublicKey(record.devicePublicKeyB64u, "QrLinkedDeviceSessionPayloadV5.devicePublicKeyB64u"),
 		requestedPermission: parseDelegatedWalletAuthority(record.requestedPermission, "QrLinkedDeviceSessionPayloadV5.requestedPermission"),
@@ -584,7 +217,7 @@ function parseQrPayloadRecord(record) {
 }
 function parseQrLinkedDeviceSessionPayloadV5(raw) {
 	const candidate = requireRecord(raw, "QrLinkedDeviceSessionPayloadV5");
-	return parseQrPayloadRecord(exactRecord(candidate, parseTargetFactor(candidate.targetFactor, "QrLinkedDeviceSessionPayloadV5.targetFactor").kind === "email_otp" ? QR_EMAIL_FIELDS : QR_FIELDS, "QrLinkedDeviceSessionPayloadV5"));
+	return parseQrPayloadRecord(exactRecord(candidate, parseTargetFactor(candidate.targetFactor, "QrLinkedDeviceSessionPayloadV5.targetFactor").kind === "email_otp" ? [...QR_FIELDS, "targetEmail"] : QR_FIELDS, "QrLinkedDeviceSessionPayloadV5"));
 }
 function serializeQrLinkedDeviceSessionPayloadV5(payload) {
 	const parsed = parseQrPayloadRecord(qrPayloadWireValue(payload));
@@ -603,91 +236,58 @@ function serializeQrLinkedDeviceSessionPayloadV5(payload) {
 		t: parsed.targetEmail
 	}) : JSON.stringify(compact);
 }
+function linkedDeviceOwnerAuthorizationRequestV1() {
+	return wireObject({
+		payload: parseQrLinkedDeviceSessionPayloadV5,
+		requestedAtMs: parseUnixTime
+	});
+}
 function parseLinkedDeviceOwnerAuthorizationRequestV1(raw) {
-	const record = exactRecord(raw, OWNER_AUTHORIZATION_REQUEST_FIELDS, "LinkedDeviceOwnerAuthorizationRequestV1");
-	const requestedAtMs = parseUnixTime(record.requestedAtMs, "LinkedDeviceOwnerAuthorizationRequestV1.requestedAtMs");
-	return {
-		payload: parseQrLinkedDeviceSessionPayloadV5(record.payload),
-		requestedAtMs
-	};
+	return linkedDeviceOwnerAuthorizationRequestV1()(raw, "LinkedDeviceOwnerAuthorizationRequestV1");
+}
+function linkSessionStatesV1() {
+	const withDevice = (state) => wireObject({
+		state: wireLiteral(state),
+		deviceId: authorizationDeviceId
+	});
+	return [
+		wireObject({ state: wireLiteral("displaying_qr") }),
+		withDevice("claimed"),
+		withDevice("awaiting_target_factor"),
+		withDevice("awaiting_source_contribution"),
+		withDevice("provisioning"),
+		wireObject({
+			state: wireLiteral("authority_pending_local_install"),
+			deviceId: authorizationDeviceId,
+			authorityId: walletAuthorityId,
+			packageSetDigestB64u: digest
+		}),
+		wireObject({
+			state: wireLiteral("active"),
+			deviceId: authorizationDeviceId,
+			authorityId: walletAuthorityId,
+			activatedAtMs: parseUnixTime
+		}),
+		wireObject({
+			state: wireLiteral("failed_before_commit"),
+			error: parseLinkPrecommitFailureV1
+		}),
+		wireObject({
+			state: wireLiteral("cancelled"),
+			cancelledAtMs: parseUnixTime
+		}),
+		wireObject({
+			state: wireLiteral("expired"),
+			expiredAtMs: parseUnixTime
+		})
+	];
 }
-const LINK_SESSION_PROJECTION_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"qrPayload",
-	"revision",
-	"createdAtMs",
-	"updatedAtMs",
-	"state"
-];
-const LINK_SESSION_EVENT_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"state",
-	"emittedAtMs"
-];
 function parseLinkSessionStateV1(raw) {
-	const initial = requireRecord(raw, "LinkSessionStateV1");
-	if (typeof initial.state !== "string") throw new Error("LinkSessionStateV1.state is invalid");
-	switch (initial.state) {
-		case "displaying_qr":
-			exactRecord(initial, ["state"], "LinkSessionStateV1.displaying_qr");
-			return { state: "displaying_qr" };
-		case "claimed":
-		case "awaiting_target_factor":
-		case "awaiting_source_contribution":
-		case "provisioning":
-			exactRecord(initial, ["state", "deviceId"], `LinkSessionStateV1.${initial.state}`);
-			return {
-				state: initial.state,
-				deviceId: parseId(parseDeviceId$1, initial.deviceId, `LinkSessionStateV1.${initial.state}.deviceId`)
-			};
-		case "authority_pending_local_install":
-			exactRecord(initial, [
-				"state",
-				"deviceId",
-				"authorityId",
-				"packageSetDigestB64u"
-			], "LinkSessionStateV1.authority_pending_local_install");
-			return {
-				state: initial.state,
-				deviceId: parseId(parseDeviceId$1, initial.deviceId, "LinkSessionStateV1.authority_pending_local_install.deviceId"),
-				authorityId: parseId(parseWalletAuthorityId, initial.authorityId, "LinkSessionStateV1.authority_pending_local_install.authorityId"),
-				packageSetDigestB64u: parseDigest(initial.packageSetDigestB64u, "LinkSessionStateV1.authority_pending_local_install.packageSetDigestB64u")
-			};
-		case "active":
-			exactRecord(initial, [
-				"state",
-				"deviceId",
-				"authorityId",
-				"activatedAtMs"
-			], "LinkSessionStateV1.active");
-			return {
-				state: initial.state,
-				deviceId: parseId(parseDeviceId$1, initial.deviceId, "LinkSessionStateV1.active.deviceId"),
-				authorityId: parseId(parseWalletAuthorityId, initial.authorityId, "LinkSessionStateV1.active.authorityId"),
-				activatedAtMs: parseUnixTime(initial.activatedAtMs, "LinkSessionStateV1.active.activatedAtMs")
-			};
-		case "failed_before_commit":
-			exactRecord(initial, ["state", "error"], "LinkSessionStateV1.failed_before_commit");
-			return {
-				state: initial.state,
-				error: parseLinkPrecommitFailureV1(initial.error)
-			};
-		case "cancelled":
-			exactRecord(initial, ["state", "cancelledAtMs"], "LinkSessionStateV1.cancelled");
-			return {
-				state: initial.state,
-				cancelledAtMs: parseUnixTime(initial.cancelledAtMs, "LinkSessionStateV1.cancelled.cancelledAtMs")
-			};
-		case "expired":
-			exactRecord(initial, ["state", "expiredAtMs"], "LinkSessionStateV1.expired");
-			return {
-				state: initial.state,
-				expiredAtMs: parseUnixTime(initial.expiredAtMs, "LinkSessionStateV1.expired.expiredAtMs")
-			};
-		default: throw new Error(`LinkSessionStateV1.state ${initial.state} is unsupported`);
-	}
+	const state = requireRecord(raw, "LinkSessionStateV1").state;
+	if (typeof state !== "string") throw new Error("LinkSessionStateV1.state is invalid");
+	const schema = linkSessionStatesV1().find((variant) => variant.shape.state.literals.includes(state));
+	if (!schema) throw new Error(`LinkSessionStateV1.state ${state} is unsupported`);
+	return schema(raw, `LinkSessionStateV1.${state}`);
 }
 function parseLinkPrecommitFailureV1(raw) {
 	const record = exactRecord(raw, ["kind", "reason"], "LinkPrecommitFailureV1");
@@ -697,43 +297,45 @@ function parseLinkPrecommitFailureV1(raw) {
 		reason: parseNonEmptyToken(record.reason, "LinkPrecommitFailureV1.reason")
 	};
 }
+function linkSessionProjectionV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_session_projection_v1"),
+		linkSessionId: sessionId,
+		qrPayload: parseQrLinkedDeviceSessionPayloadV5,
+		revision: parseNonNegativeSafeInteger,
+		createdAtMs: parseUnixTime,
+		updatedAtMs: parseUnixTime,
+		state: parseLinkSessionStateV1
+	});
+}
 function parseLinkSessionProjectionV1(raw) {
-	const record = exactRecord(raw, LINK_SESSION_PROJECTION_FIELDS, "LinkSessionProjectionV1");
-	if (record.kind !== "linked_device_session_projection_v1") throw new Error("LinkSessionProjectionV1.kind is invalid");
-	return {
-		kind: "linked_device_session_projection_v1",
-		linkSessionId: parseSessionId(record.linkSessionId, "LinkSessionProjectionV1.linkSessionId"),
-		qrPayload: parseQrLinkedDeviceSessionPayloadV5(record.qrPayload),
-		revision: parseNonNegativeSafeInteger(record.revision, "LinkSessionProjectionV1.revision"),
-		createdAtMs: parseUnixTime(record.createdAtMs, "LinkSessionProjectionV1.createdAtMs"),
-		updatedAtMs: parseUnixTime(record.updatedAtMs, "LinkSessionProjectionV1.updatedAtMs"),
-		state: parseLinkSessionStateV1(record.state)
-	};
+	return linkSessionProjectionV1()(raw, "LinkSessionProjectionV1");
+}
+function linkSessionTransportEventV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_session_event_v1"),
+		linkSessionId: sessionId,
+		state: parseLinkSessionStateV1,
+		emittedAtMs: parseUnixTime
+	});
 }
 function parseLinkSessionTransportEventV1(raw) {
-	const record = exactRecord(raw, LINK_SESSION_EVENT_FIELDS, "LinkSessionTransportEventV1");
-	if (record.kind !== "linked_device_session_event_v1") throw new Error("LinkSessionTransportEventV1.kind is invalid");
-	return {
-		kind: "linked_device_session_event_v1",
-		linkSessionId: parseSessionId(record.linkSessionId, "LinkSessionTransportEventV1.linkSessionId"),
-		state: parseLinkSessionStateV1(record.state),
-		emittedAtMs: parseUnixTime(record.emittedAtMs, "LinkSessionTransportEventV1.emittedAtMs")
-	};
+	return linkSessionTransportEventV1()(raw, "LinkSessionTransportEventV1");
+}
+function linkedDeviceApprovalResultV1() {
+	return wireUnion("outcome", [wireObject({
+		outcome: wireLiteral("pending"),
+		state: parsePendingApprovalState
+	}), wireObject({
+		outcome: wireLiteral("replayed"),
+		replay: wireObject({
+			state: () => "pending",
+			session: parsePendingApprovalState
+		})
+	})]);
 }
 function parseLinkedDeviceApprovalResultV1(raw) {
-	const initial = requireRecord(raw, "LinkedDeviceApprovalResultV1");
-	if (initial.outcome === "pending") return {
-		outcome: "pending",
-		state: parsePendingApprovalState(exactRecord(initial, APPROVAL_PENDING_FIELDS, "LinkedDeviceApprovalResultV1").state)
-	};
-	if (initial.outcome !== "replayed") throw new Error("LinkedDeviceApprovalResultV1.outcome is invalid");
-	return {
-		outcome: "replayed",
-		replay: {
-			state: "pending",
-			session: parsePendingApprovalState(exactRecord(exactRecord(initial, APPROVAL_REPLAY_FIELDS, "LinkedDeviceApprovalResultV1").replay, APPROVAL_REPLAY_PENDING_FIELDS, "LinkedDeviceApprovalResultV1.replay").session)
-		}
-	};
+	return linkedDeviceApprovalResultV1()(raw, "LinkedDeviceApprovalResultV1");
 }
 function parsePendingApprovalState(raw) {
 	const state = parseLinkSessionStateV1(raw);
@@ -745,180 +347,189 @@ function parsePendingApprovalState(raw) {
 		default: throw new Error("LinkedDeviceApprovalResultV1 state is not pending");
 	}
 }
+function linkedDeviceSessionClaimV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_session_claim_v1"),
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		devicePublicKeyB64u: parsePublicKey,
+		targetFactor: parseTargetFactor,
+		sessionRevision: parseUnixTime,
+		claimedAtMs: parseUnixTime,
+		claimExpiresAtMs: parseUnixTime
+	}, (claim, label) => assertExpiryAfterIssued(claim.claimedAtMs, claim.claimExpiresAtMs, label));
+}
 function parseLinkedDeviceSessionClaimV1(raw) {
-	const record = exactRecord(raw, CLAIM_FIELDS, "LinkedDeviceSessionClaimV1");
-	if (record.kind !== "linked_device_session_claim_v1") throw new Error("LinkedDeviceSessionClaimV1.kind is invalid");
-	const claimedAtMs = parseUnixTime(record.claimedAtMs, "LinkedDeviceSessionClaimV1.claimedAtMs");
-	const claimExpiresAtMs = parseUnixTime(record.claimExpiresAtMs, "LinkedDeviceSessionClaimV1.claimExpiresAtMs");
-	assertExpiryAfterIssued(claimedAtMs, claimExpiresAtMs, "LinkedDeviceSessionClaimV1");
-	return {
-		kind: "linked_device_session_claim_v1",
-		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceSessionClaimV1.linkSessionId"),
-		walletId: parseWallet(record.walletId, "LinkedDeviceSessionClaimV1.walletId"),
-		enrollmentId: parseEnrollmentId(record.enrollmentId, "LinkedDeviceSessionClaimV1.enrollmentId"),
-		deviceId: parseDeviceId(record.deviceId, "LinkedDeviceSessionClaimV1.deviceId"),
-		devicePublicKeyB64u: parsePublicKey(record.devicePublicKeyB64u, "LinkedDeviceSessionClaimV1.devicePublicKeyB64u"),
-		targetFactor: parseTargetFactor(record.targetFactor, "LinkedDeviceSessionClaimV1.targetFactor"),
-		sessionRevision: parseUnixTime(record.sessionRevision, "LinkedDeviceSessionClaimV1.sessionRevision"),
-		claimedAtMs,
-		claimExpiresAtMs
-	};
+	return linkedDeviceSessionClaimV1()(raw, "LinkedDeviceSessionClaimV1");
+}
+function walletSessionOwnerAuthorizationV1() {
+	return wireObject({
+		kind: wireLiteral("wallet_session"),
+		walletSessionId,
+		authorizationId: walletSessionAuthorizationId
+	});
 }
 function parseLinkedDeviceOwnerAuthorizationSourceV1(raw, label = "ownerAuthorization") {
-	const record = requireRecord(raw, label);
-	if (record.kind === "wallet_session") {
-		const exact = exactRecord(record, OWNER_AUTH_WALLET_SESSION_FIELDS, label);
-		return {
-			kind: "wallet_session",
-			walletSessionId: parseWalletSession(exact.walletSessionId, `${label}.walletSessionId`),
-			authorizationId: parseWalletAuthorization(exact.authorizationId, `${label}.authorizationId`)
-		};
-	}
-	throw new Error(`${label}.kind is unsupported`);
+	if (requireRecord(raw, label).kind !== "wallet_session") throw new Error(`${label}.kind is unsupported`);
+	return walletSessionOwnerAuthorizationV1()(raw, label);
 }
-function parseEnrollmentCore(record, label) {
-	const approvedAtMs = parseUnixTime(record.approvedAtMs, `${label}.approvedAtMs`);
-	const expiresAtMs = parseUnixTime(record.expiresAtMs, `${label}.expiresAtMs`);
-	assertExpiryAfterIssued(approvedAtMs, expiresAtMs, label);
-	const core = {
-		linkSessionId: parseSessionId(record.linkSessionId, `${label}.linkSessionId`),
-		walletId: parseWallet(record.walletId, `${label}.walletId`),
-		enrollmentId: parseEnrollmentId(record.enrollmentId, `${label}.enrollmentId`),
-		deviceId: parseDeviceId(record.deviceId, `${label}.deviceId`),
-		linkPublicKeyB64u: parsePublicKey(record.linkPublicKeyB64u, `${label}.linkPublicKeyB64u`),
-		devicePublicKeyB64u: parsePublicKey(record.devicePublicKeyB64u, `${label}.devicePublicKeyB64u`),
-		permission: parseDelegatedWalletAuthority(record.permission, `${label}.permission`),
-		targetFactor: parseApprovedTargetFactor(record.targetFactor, `${label}.targetFactor`),
-		ownerAuthorization: parseLinkedDeviceOwnerAuthorizationSourceV1(record.ownerAuthorization, `${label}.ownerAuthorization`),
-		approvedAtMs,
-		expiresAtMs
-	};
-	if (record.sourceContribution === void 0) return core;
+function linkedDeviceApprovalFields() {
 	return {
-		...core,
-		sourceContribution: parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1(record.sourceContribution)
+		kind: wireLiteral("linked_device_approval_v1"),
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		linkPublicKeyB64u: parsePublicKey,
+		devicePublicKeyB64u: parsePublicKey,
+		permission: parseDelegatedWalletAuthority,
+		targetFactor: parseApprovedTargetFactor,
+		ownerAuthorization: parseLinkedDeviceOwnerAuthorizationSourceV1,
+		approvedAtMs: parseUnixTime,
+		expiresAtMs: parseUnixTime
 	};
 }
+function approvedBeforeExpiry(approval, label) {
+	assertExpiryAfterIssued(approval.approvedAtMs, approval.expiresAtMs, label);
+}
+function linkedDeviceApprovalV1() {
+	return wireObject(linkedDeviceApprovalFields(), approvedBeforeExpiry);
+}
+function linkedDeviceSourceContributionApprovalV1() {
+	return wireObject({
+		...linkedDeviceApprovalFields(),
+		sourceContribution: parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1
+	}, approvedBeforeExpiry);
+}
 function parseLinkedDeviceApprovalV1(raw) {
-	const candidate = requireRecord(raw, "LinkedDeviceApprovalV1");
-	const record = exactRecord(candidate, candidate.sourceContribution === void 0 ? ENROLLMENT_FIELDS : ENROLLMENT_FIELDS_WITH_SOURCE_CONTRIBUTION, "LinkedDeviceApprovalV1");
-	if (record.kind !== "linked_device_approval_v1") throw new Error("LinkedDeviceApprovalV1.kind is invalid");
-	return {
-		kind: "linked_device_approval_v1",
-		...parseEnrollmentCore(record, "LinkedDeviceApprovalV1")
-	};
+	const record = requireRecord(raw, "LinkedDeviceApprovalV1");
+	return (record.sourceContribution === void 0 ? linkedDeviceApprovalV1() : linkedDeviceSourceContributionApprovalV1())(record, "LinkedDeviceApprovalV1");
+}
+function linkedDeviceApprovalDeliveryV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_approval_delivery_v1"),
+		approval: parseLinkedDeviceApprovalV1
+	});
 }
 function parseLinkedDeviceApprovalDeliveryV1(raw) {
-	const record = exactRecord(raw, APPROVAL_DELIVERY_FIELDS, "LinkedDeviceApprovalDeliveryV1");
-	if (record.kind !== "linked_device_approval_delivery_v1") throw new Error("LinkedDeviceApprovalDeliveryV1.kind is invalid");
+	return linkedDeviceApprovalDeliveryV1()(raw, "LinkedDeviceApprovalDeliveryV1");
+}
+function linkedDeviceTargetPreparationFields() {
 	return {
-		kind: "linked_device_approval_delivery_v1",
-		approval: parseLinkedDeviceApprovalV1(record.approval)
-	};
+		kind: wireLiteral("linked_device_target_preparation_v1"),
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		deliveryRecipientPublicKey65B64u: parseUncompressedP256PointB64u,
+		walletAuthMethodId,
+		ed25519ExportRoot: wireNullable(ed25519ExportRootPreparationV1()),
+		ordinarySignerMaterialRecipientRequirements: parseRecipientRequirements,
+		issuedAtMs: parseUnixTime,
+		expiresAtMs: parseUnixTime
+	};
+}
+function preparationExpiresAfterIssue(preparation, label) {
+	if (preparation.expiresAtMs <= preparation.issuedAtMs) throw new Error(`${label}.expiresAtMs must follow issuedAtMs`);
+}
+function passkeyTargetPreparationV1() {
+	return wireObject({
+		...linkedDeviceTargetPreparationFields(),
+		targetFactor: passkeyTargetFactorV1(),
+		passkeyCreationOptions: parseLinkedDevicePasskeyCreationOptionsV1,
+		passkeyConfigurationDigestB64u: digest
+	}, (preparation, label) => {
+		preparationExpiresAfterIssue(preparation, label);
+		if (preparation.passkeyCreationOptions.walletAuthMethodId !== preparation.walletAuthMethodId) throw new Error(`${label}.passkeyCreationOptions.walletAuthMethodId must match the preparation`);
+	});
+}
+function emailOtpTargetPreparationV1() {
+	return wireObject({
+		...linkedDeviceTargetPreparationFields(),
+		targetFactor: emailOtpTargetFactorV1(),
+		targetEmail: parseTargetEmail,
+		enrollment: existingEnrollmentV1(),
+		baseWalletAuthMethodId: walletAuthMethodId
+	}, preparationExpiresAfterIssue);
+}
+function newEmailOtpTargetPreparationV1() {
+	return wireObject({
+		...linkedDeviceTargetPreparationFields(),
+		targetFactor: emailOtpTargetFactorV1(),
+		targetEmail: parseTargetEmail,
+		enrollment: newEnrollmentV1()
+	}, preparationExpiresAfterIssue);
 }
 function parseLinkedDeviceTargetPreparationV1(raw) {
-	const candidate = requireRecord(raw, "LinkedDeviceTargetPreparationV1");
-	const targetFactor = parseTargetFactor(candidate.targetFactor, "LinkedDeviceTargetPreparationV1.targetFactor");
-	const emailEnrollment = targetFactor.kind === "email_otp" ? parseEmailOtpEnrollmentSelection(candidate.enrollment, "LinkedDeviceTargetPreparationV1.enrollment") : null;
-	const record = exactRecord(candidate, targetFactor.kind === "passkey_prf" ? TARGET_PREPARATION_PASSKEY_FIELDS : emailEnrollment?.kind === "new_enrollment" ? TARGET_PREPARATION_EMAIL_NEW_FIELDS : TARGET_PREPARATION_EMAIL_FIELDS, "LinkedDeviceTargetPreparationV1");
-	if (record.kind !== "linked_device_target_preparation_v1") throw new Error("LinkedDeviceTargetPreparationV1.kind is invalid");
-	const walletAuthMethodId = parseId(parseWalletAuthMethodId, record.walletAuthMethodId, "LinkedDeviceTargetPreparationV1.walletAuthMethodId");
-	const ordinarySignerMaterialRecipientRequirements = parseOrdinarySignerMaterialRecipientRequirementsV1(record.ordinarySignerMaterialRecipientRequirements);
-	const issuedAtMs = parseUnixTime(record.issuedAtMs, "LinkedDeviceTargetPreparationV1.issuedAtMs");
-	const expiresAtMs = parseUnixTime(record.expiresAtMs, "LinkedDeviceTargetPreparationV1.expiresAtMs");
-	if (expiresAtMs <= issuedAtMs) throw new Error("LinkedDeviceTargetPreparationV1.expiresAtMs must follow issuedAtMs");
-	const ed25519ExportRoot = parseLinkedDeviceEd25519ExportRootPreparationV1(record.ed25519ExportRoot);
-	const base = {
-		kind: "linked_device_target_preparation_v1",
-		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceTargetPreparationV1.linkSessionId"),
-		walletId: parseWallet(record.walletId, "LinkedDeviceTargetPreparationV1.walletId"),
-		enrollmentId: parseEnrollmentId(record.enrollmentId, "LinkedDeviceTargetPreparationV1.enrollmentId"),
-		deviceId: parseDeviceId(record.deviceId, "LinkedDeviceTargetPreparationV1.deviceId"),
-		deliveryRecipientPublicKey65B64u: parseUncompressedP256PointB64u(record.deliveryRecipientPublicKey65B64u, "LinkedDeviceTargetPreparationV1.deliveryRecipientPublicKey65B64u"),
-		walletAuthMethodId,
-		ed25519ExportRoot,
-		ordinarySignerMaterialRecipientRequirements,
-		issuedAtMs,
-		expiresAtMs
-	};
-	if (targetFactor.kind === "passkey_prf") {
-		const passkeyCreationOptions = parseLinkedDevicePasskeyCreationOptionsV1(record.passkeyCreationOptions, walletAuthMethodId);
-		return {
-			...base,
-			targetFactor,
-			passkeyCreationOptions,
-			passkeyConfigurationDigestB64u: parseDigest(record.passkeyConfigurationDigestB64u, "LinkedDeviceTargetPreparationV1.passkeyConfigurationDigestB64u")
-		};
-	}
-	if (!emailEnrollment) throw new Error("Email OTP target preparation enrollment is missing");
-	const targetEmail = parseTargetEmail(record.targetEmail, "LinkedDeviceTargetPreparationV1.targetEmail");
-	if (emailEnrollment.kind === "new_enrollment") return {
-		...base,
-		targetFactor,
-		targetEmail,
-		enrollment: emailEnrollment
-	};
-	return {
-		...base,
-		targetFactor,
-		targetEmail,
-		enrollment: emailEnrollment,
-		baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, record.baseWalletAuthMethodId, "LinkedDeviceTargetPreparationV1.baseWalletAuthMethodId")
-	};
+	const label = "LinkedDeviceTargetPreparationV1";
+	const record = requireRecord(raw, label);
+	if (parseTargetFactor(record.targetFactor, `${label}.targetFactor`).kind === "passkey_prf") return passkeyTargetPreparationV1()(record, label);
+	return (parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`).kind === "new_enrollment" ? newEmailOtpTargetPreparationV1() : emailOtpTargetPreparationV1())(record, label);
+}
+function linkedDeviceTargetPreparationRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_target_preparation_request_v1"),
+		linkSessionId: sessionId,
+		deliveryRecipientPublicKey65B64u: parseUncompressedP256PointB64u
+	});
 }
 function parseLinkedDeviceTargetPreparationRequestV1(raw) {
-	const record = exactRecord(raw, TARGET_PREPARATION_REQUEST_FIELDS, "LinkedDeviceTargetPreparationRequestV1");
-	if (record.kind !== "linked_device_target_preparation_request_v1") throw new Error("LinkedDeviceTargetPreparationRequestV1.kind is invalid");
-	return {
-		kind: "linked_device_target_preparation_request_v1",
-		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceTargetPreparationRequestV1.linkSessionId"),
-		deliveryRecipientPublicKey65B64u: parseUncompressedP256PointB64u(record.deliveryRecipientPublicKey65B64u, "LinkedDeviceTargetPreparationRequestV1.deliveryRecipientPublicKey65B64u")
-	};
+	return linkedDeviceTargetPreparationRequestV1()(raw, "LinkedDeviceTargetPreparationRequestV1");
+}
+function emailOtpBaseFactorChoiceV1() {
+	return wireObject({
+		baseWalletAuthMethodId: walletAuthMethodId,
+		maskedEmailHint: (raw, label) => {
+			if (typeof raw !== "string" || raw.length === 0) throw new Error(`${label} is invalid`);
+			return raw;
+		}
+	});
 }
-function parseLinkedDeviceEmailOtpBaseFactorChoiceV1(raw) {
-	const record = exactRecord(raw, ["baseWalletAuthMethodId", "maskedEmailHint"], "LinkedDeviceEmailOtpBaseFactorChoiceV1");
-	if (typeof record.maskedEmailHint !== "string" || record.maskedEmailHint.length === 0) throw new Error("LinkedDeviceEmailOtpBaseFactorChoiceV1.maskedEmailHint is invalid");
-	return {
-		baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, record.baseWalletAuthMethodId, "LinkedDeviceEmailOtpBaseFactorChoiceV1.baseWalletAuthMethodId"),
-		maskedEmailHint: record.maskedEmailHint
+function emailOtpBaseFactorResolutionsV1() {
+	const choice = emailOtpBaseFactorChoiceV1();
+	const parseChoice = (raw) => choice(raw, "LinkedDeviceEmailOtpBaseFactorChoiceV1");
+	return {
+		selected: wireObject({
+			kind: wireLiteral("selected"),
+			choice: parseChoice
+		}),
+		selection_required: wireObject({
+			kind: wireLiteral("selection_required"),
+			choices: (raw, label) => {
+				if (!Array.isArray(raw) || raw.length === 0) throw new Error(`${label} must not be empty`);
+				const choices = raw.map(parseChoice);
+				return [choices[0], ...choices.slice(1)];
+			}
+		}),
+		unavailable: wireObject({
+			kind: wireLiteral("unavailable"),
+			reason: supportedLiteral("no_active_email_otp_base_factor")
+		})
 	};
 }
 function parseLinkedDeviceEmailOtpBaseFactorResolutionV1(raw) {
-	const record = requireRecord(raw, "LinkedDeviceEmailOtpBaseFactorResolutionV1");
+	const label = "LinkedDeviceEmailOtpBaseFactorResolutionV1";
+	const record = requireRecord(raw, label);
+	const resolutions = emailOtpBaseFactorResolutionsV1();
 	switch (record.kind) {
-		case "selected": return {
-			kind: "selected",
-			choice: parseLinkedDeviceEmailOtpBaseFactorChoiceV1(exactRecord(record, ["kind", "choice"], "LinkedDeviceEmailOtpBaseFactorResolutionV1").choice)
-		};
-		case "selection_required": {
-			const exact = exactRecord(record, ["kind", "choices"], "LinkedDeviceEmailOtpBaseFactorResolutionV1");
-			if (!Array.isArray(exact.choices) || exact.choices.length === 0) throw new Error("LinkedDeviceEmailOtpBaseFactorResolutionV1.choices must not be empty");
-			const choices = exact.choices.map(parseLinkedDeviceEmailOtpBaseFactorChoiceV1);
-			return {
-				kind: "selection_required",
-				choices: [choices[0], ...choices.slice(1)]
-			};
-		}
-		case "unavailable": {
-			const exact = exactRecord(record, ["kind", "reason"], "LinkedDeviceEmailOtpBaseFactorResolutionV1");
-			if (exact.reason !== "no_active_email_otp_base_factor") throw new Error("LinkedDeviceEmailOtpBaseFactorResolutionV1.reason is unsupported");
-			return {
-				kind: "unavailable",
-				reason: exact.reason
-			};
-		}
-		default: throw new Error("LinkedDeviceEmailOtpBaseFactorResolutionV1.kind is unsupported");
+		case "selected":
+		case "selection_required":
+		case "unavailable": return resolutions[record.kind](record, label);
+		default: throw new Error(`${label}.kind is unsupported`);
 	}
 }
+function emailOtpBaseFactorResolutionResultV1() {
+	return wireObject({
+		revision: parseUnixTime,
+		resolution: parseLinkedDeviceEmailOtpBaseFactorResolutionV1
+	});
+}
 function parseLinkedDeviceEmailOtpBaseFactorResolutionResultV1(raw) {
-	const record = exactRecord(raw, ["revision", "resolution"], "LinkedDeviceEmailOtpBaseFactorResolutionResultV1");
-	return {
-		revision: parseUnixTime(record.revision, "LinkedDeviceEmailOtpBaseFactorResolutionResultV1.revision"),
-		resolution: parseLinkedDeviceEmailOtpBaseFactorResolutionV1(record.resolution)
-	};
+	return emailOtpBaseFactorResolutionResultV1()(raw, "LinkedDeviceEmailOtpBaseFactorResolutionResultV1");
 }
-function parseLinkedDevicePasskeyCreationOptionsV1(raw, expectedWalletAuthMethodId) {
-	const label = "LinkedDeviceTargetPreparationV1.passkeyCreationOptions";
+function parseLinkedDevicePasskeyCreationOptionsV1(raw, label) {
 	const record = exactRecord(raw, [
 		"kind",
 		"walletAuthMethodId",
@@ -933,8 +544,7 @@ function parseLinkedDevicePasskeyCreationOptionsV1(raw, expectedWalletAuthMethod
 		"extensions",
 		"excludeCredentials"
 	], label);
-	const walletAuthMethodId = parseId(parseWalletAuthMethodId, record.walletAuthMethodId, `${label}.walletAuthMethodId`);
-	if (walletAuthMethodId !== expectedWalletAuthMethodId) throw new Error(`${label}.walletAuthMethodId must match the preparation`);
+	const methodId = walletAuthMethodId(record.walletAuthMethodId, `${label}.walletAuthMethodId`);
 	exactRecord(record.user, [
 		"idB64u",
 		"name",
@@ -953,7 +563,7 @@ function parseLinkedDevicePasskeyCreationOptionsV1(raw, expectedWalletAuthMethod
 	const options = parseWalletAddAuthMethodRegistrationOptions(record);
 	return {
 		kind: options.kind,
-		walletAuthMethodId,
+		walletAuthMethodId: methodId,
 		challengeId: options.challengeId,
 		challengeB64u: options.challengeB64u,
 		rpId: options.rpId,
@@ -966,448 +576,311 @@ function parseLinkedDevicePasskeyCreationOptionsV1(raw, expectedWalletAuthMethod
 		excludeCredentials: options.excludeCredentials
 	};
 }
-function parseLinkedDeviceEd25519ExportRootPreparationV1(raw) {
-	if (raw === null) return null;
-	const record = exactRecord(raw, [
-		"kind",
-		"walletKeyId",
-		"applicationBindingDigestB64u",
-		"registeredPublicKeyB64u",
-		"revocationEpoch"
-	], "LinkedDeviceTargetPreparationV1.ed25519ExportRoot");
-	if (record.kind !== "linked_device_ed25519_export_root_preparation_v1") throw new Error("LinkedDeviceTargetPreparationV1.ed25519ExportRoot.kind is invalid");
-	return {
-		kind: "linked_device_ed25519_export_root_preparation_v1",
-		walletKeyId: parseWalletKey(record.walletKeyId, "LinkedDeviceTargetPreparationV1.ed25519ExportRoot.walletKeyId"),
-		applicationBindingDigestB64u: parseDigest(record.applicationBindingDigestB64u, "LinkedDeviceTargetPreparationV1.ed25519ExportRoot.applicationBindingDigestB64u"),
-		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "LinkedDeviceTargetPreparationV1.ed25519ExportRoot.registeredPublicKeyB64u"),
-		revocationEpoch: parseNonNegativeSafeInteger(record.revocationEpoch, "LinkedDeviceTargetPreparationV1.ed25519ExportRoot.revocationEpoch")
-	};
+function ed25519ExportRootPreparationV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_ed25519_export_root_preparation_v1"),
+		walletKeyId,
+		applicationBindingDigestB64u: digest,
+		registeredPublicKeyB64u: parseEd25519PublicKeyB64u,
+		revocationEpoch: parseNonNegativeSafeInteger
+	});
 }
-function parseOrdinarySignerMaterialRecipientRequirementV1(raw, index) {
-	const label = `LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements[${index}]`;
-	const record = exactRecord(raw, [
-		"kind",
-		"keyFamily",
-		"walletKeyId"
-	], label);
-	if (record.kind !== "ordinary_signer_material_recipient_requirement_v1") throw new Error(`${label}.kind is invalid`);
-	return {
-		kind: "ordinary_signer_material_recipient_requirement_v1",
-		keyFamily: parseKeyFamily(record.keyFamily, `${label}.keyFamily`),
-		walletKeyId: parseId(parseWalletKeyId, record.walletKeyId, `${label}.walletKeyId`)
-	};
+function parseKeyFamilyEntries(raw, item, label) {
+	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 2) throw new Error(`${label} must contain one or two entries`);
+	const entries = raw.map((entry, index) => item(entry, `${label}[${index}]`));
+	if (new Set(entries.map((entry) => entry.keyFamily)).size !== entries.length) throw new Error(`${label} repeats a key family`);
+	if (new Set(entries.map((entry) => String(entry.walletKeyId))).size !== entries.length) throw new Error(`${label} repeats a wallet key`);
+	if (entries.length === 2 && (entries[0]?.keyFamily !== "ed25519" || entries[1]?.keyFamily !== "ecdsa_secp256k1")) throw new Error(`${label} must be ordered Ed25519 then ECDSA`);
+	return entries;
+}
+function recipientRequirementV1() {
+	return wireObject({
+		kind: wireLiteral("ordinary_signer_material_recipient_requirement_v1"),
+		keyFamily: parseKeyFamily,
+		walletKeyId
+	});
 }
-function parseOrdinarySignerMaterialRecipientRequirementsV1(raw) {
-	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 2) throw new Error("LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements must contain one or two entries");
-	const requirements = raw.map((entry, index) => parseOrdinarySignerMaterialRecipientRequirementV1(entry, index));
-	if (new Set(requirements.map((entry) => entry.keyFamily)).size !== requirements.length) throw new Error("LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements repeats a key family");
-	if (new Set(requirements.map((entry) => String(entry.walletKeyId))).size !== requirements.length) throw new Error("LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements repeats a wallet key");
-	if (requirements.length === 2 && (requirements[0]?.keyFamily !== "ed25519" || requirements[1]?.keyFamily !== "ecdsa_secp256k1")) throw new Error("LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements must be ordered Ed25519 then ECDSA");
+function parseRecipientRequirements(raw) {
+	const requirements = parseKeyFamilyEntries(raw, recipientRequirementV1(), "LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements");
 	const first = requirements[0];
 	if (!first) throw new Error("ordinary signer material recipient requirements are empty");
 	return [first, ...requirements.slice(1)];
 }
-function parseWebAuthnTransport(raw, label) {
-	switch (raw) {
-		case "ble":
-		case "cable":
-		case "hybrid":
-		case "internal":
-		case "nfc":
-		case "smart-card":
-		case "usb": return raw;
-		default: throw new Error(`${label} is invalid`);
-	}
-}
-function parseLinkedDeviceWebAuthnRegistrationV1(raw) {
-	const label = "LinkedDeviceTargetCredentialRegistrationV1.webauthnRegistration";
-	const record = exactRecord(raw, WEBAUTHN_REGISTRATION_FIELDS, label);
-	if (record.kind !== "linked_device_webauthn_registration_v1") throw new Error(`${label}.kind is invalid`);
-	if (!Array.isArray(record.transports)) throw new Error(`${label}.transports must be an array`);
-	if (record.authenticatorAttachment !== null && record.authenticatorAttachment !== "platform" && record.authenticatorAttachment !== "cross-platform") throw new Error(`${label}.authenticatorAttachment is invalid`);
-	const transports = record.transports.map((entry, index) => parseWebAuthnTransport(entry, `${label}.transports[${index}]`));
-	if (new Set(transports).size !== transports.length) throw new Error(`${label}.transports contains duplicates`);
-	return {
-		kind: "linked_device_webauthn_registration_v1",
-		credentialIdB64u: parseCredential(record.credentialIdB64u, `${label}.credentialIdB64u`),
-		authenticatorAttachment: record.authenticatorAttachment,
-		clientDataJsonB64u: parseCanonicalBase64UrlBytes(record.clientDataJsonB64u, `${label}.clientDataJsonB64u`),
-		attestationObjectB64u: parseCanonicalBase64UrlBytes(record.attestationObjectB64u, `${label}.attestationObjectB64u`),
-		transports
-	};
-}
-function parseOrdinarySignerMaterialPreparationsV1(raw) {
-	return parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1(raw);
+const webAuthnTransport = /* @__PURE__ */ wireLiteral("ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb");
+function parseWebAuthnTransports(raw, label) {
+	const transports = requireArray(raw, label).map((entry, index) => webAuthnTransport(entry, `${label}[${index}]`));
+	if (new Set(transports).size !== transports.length) throw new Error(`${label} contains duplicates`);
+	return transports;
+}
+function linkedDeviceWebAuthnRegistrationV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_webauthn_registration_v1"),
+		credentialIdB64u: parseCredential,
+		authenticatorAttachment: wireNullable(wireLiteral("platform", "cross-platform")),
+		clientDataJsonB64u: parseCanonicalBase64UrlBytes,
+		attestationObjectB64u: parseCanonicalBase64UrlBytes,
+		transports: parseWebAuthnTransports
+	});
 }
-function parseOrdinarySignerMaterialRecipientRequestV1(raw, index) {
-	const label = `LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests[${index}]`;
-	const record = requireRecord(raw, label);
-	if (record.kind === "ordinary_ed25519_signer_material_recipient_request_v1") {
-		exactRecord(record, [
-			"kind",
-			"keyFamily",
-			"walletKeyId",
-			"recipientPublicKeyB64u"
-		], label);
-		if (record.keyFamily !== "ed25519") throw new Error(`${label}.keyFamily does not match its kind`);
-		return {
-			kind: record.kind,
-			keyFamily: "ed25519",
-			walletKeyId: parseId(parseWalletKeyId, record.walletKeyId, `${label}.walletKeyId`),
-			recipientPublicKeyB64u: parseCanonicalFixedBase64UrlBytes(record.recipientPublicKeyB64u, 32, `${label}.recipientPublicKeyB64u`)
-		};
-	}
-	if (record.kind === "ordinary_ecdsa_signer_material_recipient_request_v1") {
-		exactRecord(record, [
-			"kind",
-			"keyFamily",
-			"walletKeyId",
-			"clientEphemeralPublicKey"
-		], label);
-		if (record.keyFamily !== "ecdsa_secp256k1") throw new Error(`${label}.keyFamily does not match its kind`);
-		return {
-			kind: record.kind,
-			keyFamily: "ecdsa_secp256k1",
-			walletKeyId: parseId(parseWalletKeyId, record.walletKeyId, `${label}.walletKeyId`),
-			clientEphemeralPublicKey: requireRouterAbX25519PublicKey(record.clientEphemeralPublicKey, `${label}.clientEphemeralPublicKey`)
-		};
-	}
-	throw new Error(`${label}.kind is invalid`);
-}
-function parseOrdinarySignerMaterialRecipientRequestsV1(raw) {
-	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 2) throw new Error("LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests must contain one or two entries");
-	const requests = raw.map((entry, index) => parseOrdinarySignerMaterialRecipientRequestV1(entry, index));
-	const families = requests.map((entry) => entry.keyFamily);
-	if (new Set(families).size !== families.length) throw new Error("LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests repeats a key family");
-	if (new Set(requests.map((entry) => String(entry.walletKeyId))).size !== requests.length) throw new Error("LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests repeats a wallet key");
-	if (requests.length === 2 && (requests[0]?.keyFamily !== "ed25519" || requests[1]?.keyFamily !== "ecdsa_secp256k1")) throw new Error("LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests must be ordered Ed25519 then ECDSA");
+function recipientRequestV1() {
+	const keyFamily = (family) => (raw, label) => {
+		if (raw !== family) throw new Error(`${label} does not match its kind`);
+		return family;
+	};
+	return wireUnion("kind", [wireObject({
+		kind: wireLiteral("ordinary_ed25519_signer_material_recipient_request_v1"),
+		keyFamily: keyFamily("ed25519"),
+		walletKeyId,
+		recipientPublicKeyB64u: (raw, label) => parseCanonicalFixedBase64UrlBytes(raw, 32, label)
+	}), wireObject({
+		kind: wireLiteral("ordinary_ecdsa_signer_material_recipient_request_v1"),
+		keyFamily: keyFamily("ecdsa_secp256k1"),
+		walletKeyId,
+		clientEphemeralPublicKey: requireRouterAbX25519PublicKey
+	})]);
+}
+function parseRecipientRequests(raw) {
+	const requests = parseKeyFamilyEntries(raw, recipientRequestV1(), "LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests");
 	const first = requests[0];
 	if (!first) throw new Error("ordinary signer material recipient requests are empty");
 	return [first, ...requests.slice(1)];
 }
-function parseLinkedDeviceTargetCredentialRegistrationV1(raw) {
-	const initial = requireRecord(raw, "LinkedDeviceTargetCredentialRegistrationV1");
-	const targetFactor = parseTargetFactor(initial.targetFactor, "LinkedDeviceTargetCredentialRegistrationV1.targetFactor");
-	const emailGrant = targetFactor.kind === "email_otp" ? parseLinkedDeviceEmailOtpVerificationGrantV1(initial.emailOtpVerificationGrant) : null;
-	const record = exactRecord(initial, targetFactor.kind === "passkey_prf" ? PASSKEY_CREDENTIAL_FIELDS : emailGrant?.enrollment.kind === "new_enrollment" ? EMAIL_OTP_CREDENTIAL_NEW_FIELDS : EMAIL_OTP_CREDENTIAL_FIELDS, "LinkedDeviceTargetCredentialRegistrationV1");
-	if (record.kind !== "linked_device_target_credential_registration_v1") throw new Error("LinkedDeviceTargetCredentialRegistrationV1.kind is invalid");
-	if (targetFactor.kind === "email_otp" && !emailGrant) throw new Error("Email OTP target credential grant is missing");
-	const linkSessionId = parseSessionId(record.linkSessionId, "LinkedDeviceTargetCredentialRegistrationV1.linkSessionId");
-	const walletId = parseWallet(record.walletId, "LinkedDeviceTargetCredentialRegistrationV1.walletId");
-	const enrollmentId = parseEnrollmentId(record.enrollmentId, "LinkedDeviceTargetCredentialRegistrationV1.enrollmentId");
-	const deviceId = parseDeviceId(record.deviceId, "LinkedDeviceTargetCredentialRegistrationV1.deviceId");
-	const walletAuthMethodId = parseWalletAuthMethodId(record.walletAuthMethodId);
-	if (!walletAuthMethodId.ok) throw new Error(`LinkedDeviceTargetCredentialRegistrationV1.walletAuthMethodId ${walletAuthMethodId.error.message}`);
-	const targetPreparationDigestB64u = parseDigest(record.targetPreparationDigestB64u, "LinkedDeviceTargetCredentialRegistrationV1.targetPreparationDigestB64u");
-	const ordinarySignerMaterialRecipientRequests = parseOrdinarySignerMaterialRecipientRequestsV1(record.ordinarySignerMaterialRecipientRequests);
-	const registeredAtMs = parseUnixTime(record.registeredAtMs, "LinkedDeviceTargetCredentialRegistrationV1.registeredAtMs");
-	if (targetFactor.kind === "passkey_prf") return {
-		kind: "linked_device_target_credential_registration_v1",
-		linkSessionId,
-		walletId,
-		enrollmentId,
-		deviceId,
-		walletAuthMethodId: walletAuthMethodId.value,
-		targetFactor,
-		targetPreparationDigestB64u,
-		ordinarySignerMaterialRecipientRequests,
-		webauthnRegistration: parseLinkedDeviceWebAuthnRegistrationV1(record.webauthnRegistration),
-		registeredAtMs
-	};
-	if (!emailGrant) throw new Error("Email OTP target credential grant is missing");
-	const targetEmail = parseTargetEmail(record.targetEmail, "LinkedDeviceTargetCredentialRegistrationV1.targetEmail");
-	if (emailGrant.enrollment.kind === "new_enrollment") return {
-		kind: "linked_device_target_credential_registration_v1",
-		linkSessionId,
-		walletId,
-		enrollmentId,
-		deviceId,
-		walletAuthMethodId: walletAuthMethodId.value,
-		targetFactor,
-		targetEmail,
-		targetPreparationDigestB64u,
-		ordinarySignerMaterialRecipientRequests,
-		emailOtpVerificationGrant: emailGrant,
-		emailOtpEnrollment: parseEmailOtpEnrollmentMaterial(record.emailOtpEnrollment, "LinkedDeviceTargetCredentialRegistrationV1.emailOtpEnrollment"),
-		registeredAtMs
-	};
+function targetCredentialRegistrationIdentity() {
 	return {
-		kind: "linked_device_target_credential_registration_v1",
-		linkSessionId,
+		kind: wireLiteral("linked_device_target_credential_registration_v1"),
+		linkSessionId: sessionId,
 		walletId,
 		enrollmentId,
-		deviceId,
-		walletAuthMethodId: walletAuthMethodId.value,
-		targetFactor,
-		targetEmail,
-		targetPreparationDigestB64u,
-		ordinarySignerMaterialRecipientRequests,
-		emailOtpVerificationGrant: emailGrant,
-		registeredAtMs
-	};
+		deviceId: linkedDeviceId,
+		walletAuthMethodId
+	};
+}
+function passkeyTargetCredentialRegistrationV1() {
+	return wireObject({
+		...targetCredentialRegistrationIdentity(),
+		targetFactor: passkeyTargetFactorV1(),
+		targetPreparationDigestB64u: digest,
+		ordinarySignerMaterialRecipientRequests: parseRecipientRequests,
+		webauthnRegistration: linkedDeviceWebAuthnRegistrationV1(),
+		registeredAtMs: parseUnixTime
+	});
 }
-function parseLinkedDeviceTargetCredentialRegistrationResultV1(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"outcome",
-		"linkSessionId",
-		"walletId",
-		"enrollmentId",
-		"deviceId",
-		"walletAuthMethodId",
-		"targetPreparationDigestB64u",
-		"targetFactor",
-		"ordinarySignerMaterialPreparations",
-		"ordinarySignerMaterialRecipientRequests",
-		"keyManifestDigestB64u"
-	], "LinkedDeviceTargetCredentialRegistrationResultV1");
-	if (record.kind !== "linked_device_target_credential_registration_result_v1") throw new Error("LinkedDeviceTargetCredentialRegistrationResultV1.kind is invalid");
-	if (record.outcome !== "applied" && record.outcome !== "replayed") throw new Error("LinkedDeviceTargetCredentialRegistrationResultV1.outcome is invalid");
-	const linkSessionId = parseSessionId(record.linkSessionId, "LinkedDeviceTargetCredentialRegistrationResultV1.linkSessionId");
-	const walletId = parseWallet(record.walletId, "LinkedDeviceTargetCredentialRegistrationResultV1.walletId");
-	const enrollmentId = parseEnrollmentId(record.enrollmentId, "LinkedDeviceTargetCredentialRegistrationResultV1.enrollmentId");
-	const deviceId = parseDeviceId(record.deviceId, "LinkedDeviceTargetCredentialRegistrationResultV1.deviceId");
-	const walletAuthMethodId = parseId(parseWalletAuthMethodId, record.walletAuthMethodId, "LinkedDeviceTargetCredentialRegistrationResultV1.walletAuthMethodId");
-	const targetPreparationDigestB64u = parseDigest(record.targetPreparationDigestB64u, "LinkedDeviceTargetCredentialRegistrationResultV1.targetPreparationDigestB64u");
-	const targetFactor = parseVerifiedTargetFactorV1(record.targetFactor, "LinkedDeviceTargetCredentialRegistrationResultV1.targetFactor");
-	if (targetFactor.authMethod.walletAuthMethodId !== walletAuthMethodId || targetFactor.authMethod.walletId !== walletId) throw new Error("LinkedDeviceTargetCredentialRegistrationResultV1 target identity differs");
-	const ordinarySignerMaterialPreparations = parseOrdinarySignerMaterialPreparationsV1(record.ordinarySignerMaterialPreparations);
-	const ordinarySignerMaterialRecipientRequests = parseOrdinarySignerMaterialRecipientRequestsV1(record.ordinarySignerMaterialRecipientRequests);
-	return {
-		kind: "linked_device_target_credential_registration_result_v1",
-		outcome: record.outcome,
-		linkSessionId,
+function emailOtpTargetCredentialRegistrationV1() {
+	return wireObject({
+		...targetCredentialRegistrationIdentity(),
+		targetFactor: emailOtpTargetFactorV1(),
+		targetEmail: parseTargetEmail,
+		targetPreparationDigestB64u: digest,
+		ordinarySignerMaterialRecipientRequests: parseRecipientRequests,
+		emailOtpVerificationGrant: parseLinkedDeviceEmailOtpVerificationGrantV1,
+		registeredAtMs: parseUnixTime
+	});
+}
+function newEmailOtpTargetCredentialRegistrationV1() {
+	return wireObject({
+		...targetCredentialRegistrationIdentity(),
+		targetFactor: emailOtpTargetFactorV1(),
+		targetEmail: parseTargetEmail,
+		targetPreparationDigestB64u: digest,
+		ordinarySignerMaterialRecipientRequests: parseRecipientRequests,
+		emailOtpVerificationGrant: parseLinkedDeviceEmailOtpVerificationGrantV1,
+		emailOtpEnrollment: emailOtpEnrollmentMaterialV1(),
+		registeredAtMs: parseUnixTime
+	});
+}
+function parseLinkedDeviceTargetCredentialRegistrationV1(raw) {
+	const label = "LinkedDeviceTargetCredentialRegistrationV1";
+	const record = requireRecord(raw, label);
+	if (parseTargetFactor(record.targetFactor, `${label}.targetFactor`).kind === "passkey_prf") return passkeyTargetCredentialRegistrationV1()(record, label);
+	return (parseLinkedDeviceEmailOtpVerificationGrantV1(record.emailOtpVerificationGrant).enrollment.kind === "new_enrollment" ? newEmailOtpTargetCredentialRegistrationV1() : emailOtpTargetCredentialRegistrationV1())(record, label);
+}
+function targetCredentialRegistrationResultV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_target_credential_registration_result_v1"),
+		outcome: wireLiteral("applied", "replayed"),
+		linkSessionId: sessionId,
 		walletId,
 		enrollmentId,
-		deviceId,
+		deviceId: linkedDeviceId,
 		walletAuthMethodId,
-		targetPreparationDigestB64u,
-		targetFactor,
-		ordinarySignerMaterialPreparations,
-		ordinarySignerMaterialRecipientRequests,
-		keyManifestDigestB64u: parseDigest(record.keyManifestDigestB64u, "LinkedDeviceTargetCredentialRegistrationResultV1.keyManifestDigestB64u")
-	};
+		targetPreparationDigestB64u: digest,
+		targetFactor: parseVerifiedTargetFactorV1,
+		ordinarySignerMaterialPreparations: parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1,
+		ordinarySignerMaterialRecipientRequests: parseRecipientRequests,
+		keyManifestDigestB64u: digest
+	}, (result, label) => {
+		const { authMethod } = result.targetFactor;
+		if (authMethod.walletAuthMethodId !== result.walletAuthMethodId || authMethod.walletId !== result.walletId) throw new Error(`${label} target identity differs`);
+	});
+}
+function parseLinkedDeviceTargetCredentialRegistrationResultV1(raw) {
+	return targetCredentialRegistrationResultV1()(raw, "LinkedDeviceTargetCredentialRegistrationResultV1");
+}
+function verifiedAfterCreation(target, label) {
+	if (target.verifiedAtMs < target.authMethod.createdAtMs) throw new Error(`${label}.verifiedAtMs precedes authMethod.createdAtMs`);
+}
+function verifiedPasskeyTargetV1() {
+	return wireObject({
+		kind: wireLiteral("verified_passkey_target_v1"),
+		authMethod: parsePasskeyWalletAuthMethodDraftV1,
+		verificationDigestB64u: digest,
+		verifiedAtMs: parseUnixTime
+	}, verifiedAfterCreation);
+}
+function verifiedEmailOtpTargetV1() {
+	return wireObject({
+		kind: wireLiteral("verified_email_otp_target_v1"),
+		authMethod: parseEmailOtpWalletAuthMethodDraftV1,
+		targetEmail: parseTargetEmail,
+		enrollment: existingEnrollmentV1(),
+		baseWalletAuthMethodId: walletAuthMethodId,
+		providerUserId: parseNonEmptyToken,
+		verificationDigestB64u: digest,
+		verifiedAtMs: parseUnixTime
+	}, verifiedAfterCreation);
+}
+function verifiedNewEmailOtpTargetV1() {
+	return wireObject({
+		kind: wireLiteral("verified_email_otp_target_v1"),
+		authMethod: parseEmailOtpWalletAuthMethodDraftV1,
+		targetEmail: parseTargetEmail,
+		enrollment: newEnrollmentV1(),
+		providerUserId: parseNonEmptyToken,
+		verificationDigestB64u: digest,
+		verifiedAtMs: parseUnixTime
+	}, verifiedAfterCreation);
 }
 function parseVerifiedTargetFactorV1(raw, label) {
 	const record = requireRecord(raw, label);
-	if (record.kind === "verified_passkey_target_v1") {
-		exactRecord(record, [
-			"kind",
-			"authMethod",
-			"verificationDigestB64u",
-			"verifiedAtMs"
-		], label);
-		const authMethod = parsePasskeyWalletAuthMethodDraftV1(record.authMethod, `${label}.authMethod`);
-		const verifiedAtMs = parseUnixTime(record.verifiedAtMs, `${label}.verifiedAtMs`);
-		if (verifiedAtMs < authMethod.createdAtMs) throw new Error(`${label}.verifiedAtMs precedes authMethod.createdAtMs`);
-		return {
-			kind: "verified_passkey_target_v1",
-			authMethod,
-			verificationDigestB64u: parseDigest(record.verificationDigestB64u, `${label}.verificationDigestB64u`),
-			verifiedAtMs
-		};
-	}
-	if (record.kind === "verified_email_otp_target_v1") {
-		const enrollment = parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`);
-		const exact = exactRecord(record, enrollment.kind === "existing_enrollment" ? [
-			"kind",
-			"authMethod",
-			"targetEmail",
-			"enrollment",
-			"baseWalletAuthMethodId",
-			"providerUserId",
-			"verificationDigestB64u",
-			"verifiedAtMs"
-		] : [
-			"kind",
-			"authMethod",
-			"targetEmail",
-			"enrollment",
-			"providerUserId",
-			"verificationDigestB64u",
-			"verifiedAtMs"
-		], label);
-		const authMethod = parseEmailOtpWalletAuthMethodDraftV1(record.authMethod, `${label}.authMethod`);
-		const verifiedAtMs = parseUnixTime(record.verifiedAtMs, `${label}.verifiedAtMs`);
-		if (verifiedAtMs < authMethod.createdAtMs) throw new Error(`${label}.verifiedAtMs precedes authMethod.createdAtMs`);
-		const targetEmail = parseTargetEmail(record.targetEmail, `${label}.targetEmail`);
-		const providerUserId = parseNonEmptyToken(record.providerUserId, `${label}.providerUserId`);
-		const verificationDigestB64u = parseDigest(record.verificationDigestB64u, `${label}.verificationDigestB64u`);
-		if (enrollment.kind === "existing_enrollment") return {
-			kind: "verified_email_otp_target_v1",
-			authMethod,
-			targetEmail,
-			enrollment,
-			baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, exact.baseWalletAuthMethodId, `${label}.baseWalletAuthMethodId`),
-			providerUserId,
-			verificationDigestB64u,
-			verifiedAtMs
-		};
-		return {
-			kind: "verified_email_otp_target_v1",
-			authMethod,
-			targetEmail,
-			enrollment,
-			providerUserId,
-			verificationDigestB64u,
-			verifiedAtMs
-		};
-	}
-	throw new Error(`${label}.kind is invalid`);
+	if (record.kind === "verified_passkey_target_v1") return verifiedPasskeyTargetV1()(record, label);
+	if (record.kind !== "verified_email_otp_target_v1") throw new Error(`${label}.kind is invalid`);
+	return (parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`).kind === "existing_enrollment" ? verifiedEmailOtpTargetV1() : verifiedNewEmailOtpTargetV1())(record, label);
+}
+function passkeyWalletAuthMethodDraftV1() {
+	return wireObject({
+		walletAuthMethodId,
+		walletId,
+		createdAtMs: parseUnixTime,
+		kind: wireLiteral("passkey"),
+		rpId,
+		credentialIdB64u: credentialId,
+		credentialPublicKeyB64u: parseCanonicalBase64UrlBytes,
+		counter: parseNonNegativeSafeInteger
+	});
 }
 function parsePasskeyWalletAuthMethodDraftV1(raw, label) {
-	const record = exactRecord(raw, [
-		"walletAuthMethodId",
-		"walletId",
-		"createdAtMs",
-		"kind",
-		"rpId",
-		"credentialIdB64u",
-		"credentialPublicKeyB64u",
-		"counter"
-	], label);
-	if (record.kind !== "passkey") throw new Error(`${label}.kind is invalid`);
-	return {
-		walletAuthMethodId: parseId(parseWalletAuthMethodId, record.walletAuthMethodId, `${label}.walletAuthMethodId`),
-		walletId: parseWallet(record.walletId, `${label}.walletId`),
-		createdAtMs: parseUnixTime(record.createdAtMs, `${label}.createdAtMs`),
-		kind: "passkey",
-		rpId: parseId(parseWebAuthnRpId, record.rpId, `${label}.rpId`),
-		credentialIdB64u: parseId(parseWebAuthnCredentialIdB64u, record.credentialIdB64u, `${label}.credentialIdB64u`),
-		credentialPublicKeyB64u: parseCanonicalBase64UrlBytes(record.credentialPublicKeyB64u, `${label}.credentialPublicKeyB64u`),
-		counter: parseNonNegativeInteger(record.counter, `${label}.counter`)
-	};
+	return passkeyWalletAuthMethodDraftV1()(raw, label);
+}
+function emailOtpWalletAuthMethodDraftV1() {
+	return wireObject({
+		walletAuthMethodId,
+		walletId,
+		createdAtMs: parseUnixTime,
+		kind: wireLiteral("email_otp"),
+		emailHashHex: parseEmailHashHex,
+		registrationAuthorityId: parseNonEmptyToken
+	});
 }
 function parseEmailOtpWalletAuthMethodDraftV1(raw, label) {
-	const record = exactRecord(raw, [
-		"walletAuthMethodId",
-		"walletId",
-		"createdAtMs",
-		"kind",
-		"emailHashHex",
-		"registrationAuthorityId"
-	], label);
-	if (record.kind !== "email_otp") throw new Error(`${label}.kind is invalid`);
+	return emailOtpWalletAuthMethodDraftV1()(raw, label);
+}
+function emailOtpVerificationGrantFields(enrollment) {
 	return {
-		walletAuthMethodId: parseId(parseWalletAuthMethodId, record.walletAuthMethodId, `${label}.walletAuthMethodId`),
-		walletId: parseWallet(record.walletId, `${label}.walletId`),
-		createdAtMs: parseUnixTime(record.createdAtMs, `${label}.createdAtMs`),
-		kind: "email_otp",
-		emailHashHex: parseEmailHashHex(record.emailHashHex, `${label}.emailHashHex`),
-		registrationAuthorityId: parseNonEmptyToken(record.registrationAuthorityId, `${label}.registrationAuthorityId`)
+		kind: wireLiteral("linked_device_email_otp_verification_grant_v1"),
+		grantId: parseNonEmptyToken,
+		grantToken: parseNonEmptyToken,
+		challengeId: parseNonEmptyToken,
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		targetPreparationDigestB64u: digest,
+		targetEmail: parseTargetEmail,
+		enrollment,
+		emailHashHex: parseEmailHashHex,
+		registrationAuthorityId: parseNonEmptyToken,
+		providerUserId: parseNonEmptyToken,
+		authorityDigestB64u: digest,
+		issuedAtMs: parseUnixTime,
+		expiresAtMs: parseUnixTime
 	};
 }
+function grantIssuedBeforeExpiry(grant, label) {
+	assertExpiryAfterIssued(grant.issuedAtMs, grant.expiresAtMs, label);
+}
+function emailOtpVerificationGrantV1() {
+	return wireObject({
+		...emailOtpVerificationGrantFields(existingEnrollmentV1()),
+		baseWalletAuthMethodId: walletAuthMethodId
+	}, grantIssuedBeforeExpiry);
+}
+function newEnrollmentEmailOtpVerificationGrantV1() {
+	return wireObject(emailOtpVerificationGrantFields(newEnrollmentV1()), grantIssuedBeforeExpiry);
+}
 function parseLinkedDeviceEmailOtpVerificationGrantV1(raw) {
-	const candidate = requireRecord(raw, "LinkedDeviceEmailOtpVerificationGrantV1");
-	const enrollment = parseEmailOtpEnrollmentSelection(candidate.enrollment, "LinkedDeviceEmailOtpVerificationGrantV1.enrollment");
-	const record = exactRecord(candidate, enrollment.kind === "new_enrollment" ? EMAIL_OTP_VERIFICATION_GRANT_BASE_FIELDS : EMAIL_OTP_VERIFICATION_GRANT_FIELDS, "LinkedDeviceEmailOtpVerificationGrantV1");
-	if (record.kind !== "linked_device_email_otp_verification_grant_v1") throw new Error("LinkedDeviceEmailOtpVerificationGrantV1.kind is invalid");
-	const issuedAtMs = parseUnixTime(record.issuedAtMs, "LinkedDeviceEmailOtpVerificationGrantV1.issuedAtMs");
-	const expiresAtMs = parseUnixTime(record.expiresAtMs, "LinkedDeviceEmailOtpVerificationGrantV1.expiresAtMs");
-	assertExpiryAfterIssued(issuedAtMs, expiresAtMs, "LinkedDeviceEmailOtpVerificationGrantV1");
-	const base = {
-		kind: "linked_device_email_otp_verification_grant_v1",
-		grantId: parseNonEmptyToken(record.grantId, "LinkedDeviceEmailOtpVerificationGrantV1.grantId"),
-		grantToken: parseNonEmptyToken(record.grantToken, "LinkedDeviceEmailOtpVerificationGrantV1.grantToken"),
-		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpVerificationGrantV1.challengeId"),
-		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "LinkedDeviceEmailOtpVerificationGrantV1.linkSessionId"),
-		walletId: parseId(parseWalletId, record.walletId, "LinkedDeviceEmailOtpVerificationGrantV1.walletId"),
-		enrollmentId: parseId(parseLinkedDeviceEnrollmentId, record.enrollmentId, "LinkedDeviceEmailOtpVerificationGrantV1.enrollmentId"),
-		deviceId: parseId(parseLinkedDeviceId, record.deviceId, "LinkedDeviceEmailOtpVerificationGrantV1.deviceId"),
-		targetPreparationDigestB64u: parseDigest(record.targetPreparationDigestB64u, "LinkedDeviceEmailOtpVerificationGrantV1.targetPreparationDigestB64u"),
-		targetEmail: parseTargetEmail(record.targetEmail, "LinkedDeviceEmailOtpVerificationGrantV1.targetEmail"),
-		enrollment,
-		emailHashHex: parseEmailHashHex(record.emailHashHex, "LinkedDeviceEmailOtpVerificationGrantV1.emailHashHex"),
-		registrationAuthorityId: parseNonEmptyToken(record.registrationAuthorityId, "LinkedDeviceEmailOtpVerificationGrantV1.registrationAuthorityId"),
-		providerUserId: parseNonEmptyToken(record.providerUserId, "LinkedDeviceEmailOtpVerificationGrantV1.providerUserId"),
-		authorityDigestB64u: parseDigest(record.authorityDigestB64u, "LinkedDeviceEmailOtpVerificationGrantV1.authorityDigestB64u"),
-		issuedAtMs,
-		expiresAtMs
-	};
-	if (enrollment.kind === "new_enrollment") return {
-		...base,
-		enrollment: { kind: "new_enrollment" }
-	};
-	return {
-		...base,
-		enrollment: { kind: "existing_enrollment" },
-		baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, record.baseWalletAuthMethodId, "LinkedDeviceEmailOtpVerificationGrantV1.baseWalletAuthMethodId")
-	};
+	const label = "LinkedDeviceEmailOtpVerificationGrantV1";
+	const record = requireRecord(raw, label);
+	return (parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`).kind === "new_enrollment" ? newEnrollmentEmailOtpVerificationGrantV1() : emailOtpVerificationGrantV1())(record, label);
+}
+function emailOtpFactorReleaseEnvelopeV1() {
+	return wireObject({
+		kind: wireLiteral("email_otp_factor_release_v1"),
+		challengeId: parseNonEmptyToken,
+		enrollmentId: parseNonEmptyToken,
+		enrollmentSealKeyVersion: parseNonEmptyToken,
+		serverEphemeralPublicKey65B64u: parseUncompressedP256PointB64u,
+		nonce12B64u: (raw, label) => parseCanonicalFixedBase64UrlBytes(raw, 12, label),
+		ciphertextB64u: parseCanonicalBase64UrlBytes
+	});
 }
 function parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1(raw) {
-	const record = exactRecord(raw, EMAIL_OTP_FACTOR_RELEASE_FIELDS, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1");
-	if (record.kind !== "email_otp_factor_release_v1") throw new Error("LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.kind is invalid");
-	return {
-		kind: "email_otp_factor_release_v1",
-		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.challengeId"),
-		enrollmentId: parseNonEmptyToken(record.enrollmentId, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.enrollmentId"),
-		enrollmentSealKeyVersion: parseNonEmptyToken(record.enrollmentSealKeyVersion, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.enrollmentSealKeyVersion"),
-		serverEphemeralPublicKey65B64u: parseUncompressedP256PointB64u(record.serverEphemeralPublicKey65B64u, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.serverEphemeralPublicKey65B64u"),
-		nonce12B64u: parseCanonicalFixedBase64UrlBytes(record.nonce12B64u, 12, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.nonce12B64u"),
-		ciphertextB64u: parseCanonicalBase64UrlBytes(record.ciphertextB64u, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.ciphertextB64u")
-	};
+	return emailOtpFactorReleaseEnvelopeV1()(raw, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1");
+}
+function emailOtpChallengeStartRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_email_otp_challenge_start_request_v1"),
+		linkSessionId: sessionId,
+		workerEphemeralPublicKey65B64u: parseUncompressedP256PointB64u
+	});
 }
 function parseLinkedDeviceEmailOtpChallengeStartRequestV1(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"linkSessionId",
-		"workerEphemeralPublicKey65B64u"
-	], "LinkedDeviceEmailOtpChallengeStartRequestV1");
-	if (record.kind !== "linked_device_email_otp_challenge_start_request_v1") throw new Error("LinkedDeviceEmailOtpChallengeStartRequestV1.kind is invalid");
-	return {
-		kind: "linked_device_email_otp_challenge_start_request_v1",
-		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "LinkedDeviceEmailOtpChallengeStartRequestV1.linkSessionId"),
-		workerEphemeralPublicKey65B64u: parseUncompressedP256PointB64u(record.workerEphemeralPublicKey65B64u, "LinkedDeviceEmailOtpChallengeStartRequestV1.workerEphemeralPublicKey65B64u")
-	};
+	return emailOtpChallengeStartRequestV1()(raw, "LinkedDeviceEmailOtpChallengeStartRequestV1");
+}
+function emailOtpChallengeResendRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_email_otp_challenge_resend_request_v1"),
+		linkSessionId: sessionId,
+		challengeId: parseNonEmptyToken
+	});
 }
 function parseLinkedDeviceEmailOtpChallengeResendRequestV1(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"linkSessionId",
-		"challengeId"
-	], "LinkedDeviceEmailOtpChallengeResendRequestV1");
-	if (record.kind !== "linked_device_email_otp_challenge_resend_request_v1") throw new Error("LinkedDeviceEmailOtpChallengeResendRequestV1.kind is invalid");
-	return {
-		kind: "linked_device_email_otp_challenge_resend_request_v1",
-		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "LinkedDeviceEmailOtpChallengeResendRequestV1.linkSessionId"),
-		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpChallengeResendRequestV1.challengeId")
-	};
+	return emailOtpChallengeResendRequestV1()(raw, "LinkedDeviceEmailOtpChallengeResendRequestV1");
+}
+function emailOtpChallengeVerifyRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_email_otp_challenge_verify_request_v1"),
+		linkSessionId: sessionId,
+		challengeId: parseNonEmptyToken,
+		otpCode: (raw, label) => {
+			if (typeof raw !== "string" || !/^[0-9]{6,10}$/.test(raw)) throw new Error(`${label} is invalid`);
+			return raw;
+		}
+	});
 }
 function parseLinkedDeviceEmailOtpChallengeVerifyRequestV1(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"linkSessionId",
-		"challengeId",
-		"otpCode"
-	], "LinkedDeviceEmailOtpChallengeVerifyRequestV1");
-	if (record.kind !== "linked_device_email_otp_challenge_verify_request_v1") throw new Error("LinkedDeviceEmailOtpChallengeVerifyRequestV1.kind is invalid");
-	if (typeof record.otpCode !== "string" || !/^[0-9]{6,10}$/.test(record.otpCode)) throw new Error("LinkedDeviceEmailOtpChallengeVerifyRequestV1.otpCode is invalid");
-	return {
-		kind: "linked_device_email_otp_challenge_verify_request_v1",
-		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "LinkedDeviceEmailOtpChallengeVerifyRequestV1.linkSessionId"),
-		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpChallengeVerifyRequestV1.challengeId"),
-		otpCode: record.otpCode
-	};
+	return emailOtpChallengeVerifyRequestV1()(raw, "LinkedDeviceEmailOtpChallengeVerifyRequestV1");
+}
+function emailOtpChallengeResultV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_email_otp_challenge_result_v1"),
+		challengeId: parseNonEmptyToken,
+		maskedEmailHint: parseNonEmptyToken,
+		expiresAtMs: parseUnixTime,
+		resendAvailableAtMs: parseUnixTime
+	});
 }
 function parseLinkedDeviceEmailOtpChallengeResultV1(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"challengeId",
-		"maskedEmailHint",
-		"expiresAtMs",
-		"resendAvailableAtMs"
-	], "LinkedDeviceEmailOtpChallengeResultV1");
-	if (record.kind !== "linked_device_email_otp_challenge_result_v1") throw new Error("LinkedDeviceEmailOtpChallengeResultV1.kind is invalid");
-	const expiresAtMs = parseUnixTime(record.expiresAtMs, "LinkedDeviceEmailOtpChallengeResultV1.expiresAtMs");
-	const resendAvailableAtMs = parseUnixTime(record.resendAvailableAtMs, "LinkedDeviceEmailOtpChallengeResultV1.resendAvailableAtMs");
-	return {
-		kind: "linked_device_email_otp_challenge_result_v1",
-		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpChallengeResultV1.challengeId"),
-		maskedEmailHint: parseNonEmptyToken(record.maskedEmailHint, "LinkedDeviceEmailOtpChallengeResultV1.maskedEmailHint"),
-		expiresAtMs,
-		resendAvailableAtMs
-	};
+	return emailOtpChallengeResultV1()(raw, "LinkedDeviceEmailOtpChallengeResultV1");
 }
 function parseLinkedDeviceEmailOtpVerificationResultV1(raw) {
 	const record = exactRecord(raw, [
@@ -1510,241 +983,7 @@ function buildLinkedDeviceSessionCancelClaimedRequestV1(args) {
 		requestedAtMs: parseUnixTime(args.requestedAtMs, "LinkedDeviceSessionCancelClaimedRequestV1.requestedAtMs")
 	};
 }
-const LOCAL_AUTHORITY_INSTALLATION_RECEIPT_FIELDS = [
-	"kind",
-	"authorityId",
-	"walletId",
-	"authMethodId",
-	"deviceId",
-	"packageSetDigestB64u",
-	"installedActivationRefs",
-	"installedRecordSetDigestB64u",
-	"targetFactorVerificationDigestB64u",
-	"installedAtMs"
-];
-function parseLocalAuthorityInstallationReceiptV1(raw) {
-	const record = exactRecord(raw, LOCAL_AUTHORITY_INSTALLATION_RECEIPT_FIELDS, "LocalAuthorityInstallationReceiptV1");
-	if (record.kind !== "local_authority_installation_receipt_v1") throw new Error("LocalAuthorityInstallationReceiptV1.kind is invalid");
-	const installedActivationResult = parseWalletSignerActivationSetV1(record.installedActivationRefs);
-	if (!installedActivationResult.ok) throw new Error(`LocalAuthorityInstallationReceiptV1.installedActivationRefs ${installedActivationResult.error}`);
-	return {
-		kind: "local_authority_installation_receipt_v1",
-		authorityId: parseId(parseWalletAuthorityId, record.authorityId, "authorityId"),
-		walletId: parseId(parseWalletId, record.walletId, "walletId"),
-		authMethodId: parseId(parseWalletAuthMethodId, record.authMethodId, "authMethodId"),
-		deviceId: parseId(parseDeviceId$1, record.deviceId, "deviceId"),
-		packageSetDigestB64u: parseDigest(record.packageSetDigestB64u, "packageSetDigestB64u"),
-		installedActivationRefs: installedActivationResult.value,
-		installedRecordSetDigestB64u: parseDigest(record.installedRecordSetDigestB64u, "installedRecordSetDigestB64u"),
-		targetFactorVerificationDigestB64u: parseDigest(record.targetFactorVerificationDigestB64u, "targetFactorVerificationDigestB64u"),
-		installedAtMs: parseUnixTime(record.installedAtMs, "installedAtMs")
-	};
-}
-const ACTIVE_WALLET_SESSION_FIELDS = [
-	"kind",
-	"walletId",
-	"authorityId",
-	"authMethodId",
-	"authorizationId",
-	"quotaId",
-	"authorityDigestB64u",
-	"authorityRevocationEpoch",
-	"capabilitySubjects",
-	"issuedAtMs",
-	"expiresAtMs"
-];
-const WALLET_SESSION_OPERATION_CREDENTIAL_FIELDS = [
-	"kind",
-	"token",
-	"walletSessionId"
-];
-function parseWalletSessionOperationCredentialV1(raw) {
-	const record = exactRecord(raw, WALLET_SESSION_OPERATION_CREDENTIAL_FIELDS, "WalletSessionOperationCredentialV1");
-	if (typeof record.token !== "string" || record.token.length > 8192) throw new Error("WalletSessionOperationCredentialV1.token is invalid");
-	if (record.kind === "opaque_wallet_session_operation_credential_v1") {
-		if (!/^wst_[A-Za-z0-9_-]{43}$/.test(record.token)) throw new Error("WalletSessionOperationCredentialV1 opaque token is invalid");
-		return {
-			kind: record.kind,
-			token: record.token,
-			walletSessionId: parseId(parseWalletSessionId, record.walletSessionId, "walletSessionId")
-		};
-	}
-	throw new Error("WalletSessionOperationCredentialV1.kind is invalid");
-}
-function parseActiveWalletSessionV1(raw) {
-	const record = exactRecord(raw, ACTIVE_WALLET_SESSION_FIELDS, "ActiveWalletSessionV1");
-	if (record.kind !== "active_wallet_session_v1") throw new Error("ActiveWalletSessionV1.kind is invalid");
-	if (!Array.isArray(record.capabilitySubjects) || record.capabilitySubjects.length === 0) throw new Error("ActiveWalletSessionV1.capabilitySubjects must be non-empty");
-	const capabilitySubjects = [];
-	const subjectKeys = /* @__PURE__ */ new Set();
-	for (const [index, rawSubject] of record.capabilitySubjects.entries()) {
-		const subject = parseWalletCapabilitySubjectV1(rawSubject, `capabilitySubjects[${index}]`);
-		const key = subject.kind === "sign" || subject.kind === "export_keys" ? `${subject.kind}:${subject.keyFamily}:${subject.materialActivation.activationId}` : subject.kind;
-		if (subjectKeys.has(key)) throw new Error("ActiveWalletSessionV1 capability subjects repeat");
-		subjectKeys.add(key);
-		capabilitySubjects.push(subject);
-	}
-	const first = capabilitySubjects[0];
-	if (!first) throw new Error("ActiveWalletSessionV1.capabilitySubjects must be non-empty");
-	return {
-		kind: "active_wallet_session_v1",
-		walletId: parseId(parseWalletId, record.walletId, "walletId"),
-		authorityId: parseId(parseWalletAuthorityId, record.authorityId, "authorityId"),
-		authMethodId: parseId(parseWalletAuthMethodId, record.authMethodId, "authMethodId"),
-		authorizationId: parseId(parseWalletSessionAuthorizationId, record.authorizationId, "authorizationId"),
-		quotaId: parseId(parseMpcWalletSigningQuotaId, record.quotaId, "quotaId"),
-		authorityDigestB64u: parseDigest(record.authorityDigestB64u, "authorityDigestB64u"),
-		authorityRevocationEpoch: parseNonNegativeInteger(record.authorityRevocationEpoch, "authorityRevocationEpoch"),
-		capabilitySubjects: [first, ...capabilitySubjects.slice(1)],
-		issuedAtMs: parseUnixTime(record.issuedAtMs, "issuedAtMs"),
-		expiresAtMs: parseUnixTime(record.expiresAtMs, "expiresAtMs")
-	};
-}
-function parseWalletCapabilitySubjectV1(raw, label) {
-	const record = requireRecord(raw, label);
-	if (record.kind === "link_devices" || record.kind === "revoke_devices") {
-		rejectUnknownFields(record, ["kind"], label);
-		return { kind: record.kind };
-	}
-	if (record.kind !== "sign" && record.kind !== "export_keys") throw new Error(`${label}.kind is invalid`);
-	rejectUnknownFields(record, [
-		"kind",
-		"keyFamily",
-		"materialActivation"
-	], label);
-	if (record.keyFamily !== "ed25519" && record.keyFamily !== "ecdsa_secp256k1") throw new Error(`${label}.keyFamily is invalid`);
-	return {
-		kind: record.kind,
-		keyFamily: record.keyFamily,
-		materialActivation: parseId(parseMpcMaterialActivationRef, record.materialActivation, `${label}.materialActivation`)
-	};
-}
-function parseNonNegativeInteger(raw, label) {
-	if (!Number.isSafeInteger(raw) || Number(raw) < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	return Number(raw);
-}
-const LOCAL_AUTHORITY_ACTIVATION_FINAL_ACK_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"authorityId",
-	"packageSetDigestB64u",
-	"authorizationId",
-	"walletSessionId",
-	"credentialDigestB64u",
-	"installationReceiptDigestB64u",
-	"acknowledgedAtMs"
-];
-function parseLocalAuthorityActivationFinalAckV1(raw) {
-	const record = exactRecord(raw, LOCAL_AUTHORITY_ACTIVATION_FINAL_ACK_FIELDS, "LocalAuthorityActivationFinalAckV1");
-	if (record.kind !== "local_authority_activation_final_ack_v1") throw new Error("LocalAuthorityActivationFinalAckV1.kind is invalid");
-	return {
-		kind: "local_authority_activation_final_ack_v1",
-		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "linkSessionId"),
-		authorityId: parseId(parseWalletAuthorityId, record.authorityId, "authorityId"),
-		packageSetDigestB64u: parseDigest(record.packageSetDigestB64u, "packageSetDigestB64u"),
-		authorizationId: parseId(parseWalletSessionAuthorizationId, record.authorizationId, "authorizationId"),
-		walletSessionId: parseId(parseWalletSessionId, record.walletSessionId, "walletSessionId"),
-		credentialDigestB64u: parseDigest(record.credentialDigestB64u, "credentialDigestB64u"),
-		installationReceiptDigestB64u: parseDigest(record.installationReceiptDigestB64u, "installationReceiptDigestB64u"),
-		acknowledgedAtMs: parseUnixTime(record.acknowledgedAtMs, "acknowledgedAtMs")
-	};
-}
-function parseActivateInstalledAuthorityResultV1(raw) {
-	const record = requireRecord(raw, "ActivateInstalledAuthorityResultV1");
-	switch (record.kind) {
-		case "active": {
-			rejectUnknownFields(record, [
-				"kind",
-				"authority",
-				"authMethod",
-				"walletSession",
-				"deliveryBinding",
-				"sealedDelivery"
-			], "ActivateInstalledAuthorityResultV1");
-			const authorityResult = parseWalletAuthorityV1(record.authority);
-			if (!authorityResult.ok || authorityResult.value.state !== "active") throw new Error("ActivateInstalledAuthorityResultV1.authority must be active");
-			const authMethod = parseWalletAuthMethodRecordV2(record.authMethod);
-			if (!authMethod || authMethod.status !== "active") throw new Error("ActivateInstalledAuthorityResultV1.authMethod must be active");
-			const walletSession = parseActiveWalletSessionV1(record.walletSession);
-			const deliveryBinding = parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1(record.deliveryBinding);
-			const sealedDelivery = parseLinkedDeviceWalletSessionCredentialDeliveryV1(record.sealedDelivery);
-			if (authorityResult.value.walletId !== authMethod.walletId || authorityResult.value.authorityId !== authMethod.walletAuthorityId || walletSession.walletId !== authorityResult.value.walletId || walletSession.authorityId !== authorityResult.value.authorityId || walletSession.authMethodId !== authMethod.walletAuthMethodId || walletSession.authorityDigestB64u !== authorityResult.value.authorityDigestB64u || walletSession.authorityRevocationEpoch !== authorityResult.value.revocationEpoch || deliveryBinding.namespace !== sealedDelivery.aad.namespace || deliveryBinding.orgId !== sealedDelivery.aad.orgId || deliveryBinding.projectId !== sealedDelivery.aad.projectId || deliveryBinding.envId !== sealedDelivery.aad.envId || deliveryBinding.tenantId !== sealedDelivery.aad.tenantId || deliveryBinding.principalId !== sealedDelivery.aad.principalId || sealedDelivery.aad.walletId !== walletSession.walletId || sealedDelivery.aad.authorityId !== walletSession.authorityId || sealedDelivery.aad.walletAuthMethodId !== walletSession.authMethodId || sealedDelivery.aad.authorizationId !== walletSession.authorizationId || sealedDelivery.aad.quotaId !== walletSession.quotaId || sealedDelivery.aad.issuedAtMs !== walletSession.issuedAtMs || sealedDelivery.aad.expiresAtMs !== walletSession.expiresAtMs) throw new Error("ActivateInstalledAuthorityResultV1 identities do not match");
-			return {
-				kind: "active",
-				authority: authorityResult.value,
-				authMethod,
-				walletSession,
-				deliveryBinding,
-				sealedDelivery
-			};
-		}
-		case "pending_local_install":
-			rejectUnknownFields(record, [
-				"kind",
-				"authorityId",
-				"reason"
-			], "ActivateInstalledAuthorityResultV1");
-			return {
-				kind: "pending_local_install",
-				authorityId: parseId(parseWalletAuthorityId, record.authorityId, "authorityId"),
-				reason: parseActivationRetryReasonV1(record.reason)
-			};
-		case "integrity_error":
-			rejectUnknownFields(record, ["kind", "reason"], "ActivateInstalledAuthorityResultV1");
-			return {
-				kind: "integrity_error",
-				reason: parseLinkIntegrityFailureV1(record.reason)
-			};
-		default: throw new Error("ActivateInstalledAuthorityResultV1.kind is invalid");
-	}
-}
-function parseActivationRetryReasonV1(raw) {
-	const record = requireRecord(raw, "ActivationRetryReasonV1");
-	switch (record.kind) {
-		case "installation_receipt_not_found":
-		case "server_worker_activation_pending":
-		case "wallet_session_issuance_pending":
-			rejectUnknownFields(record, ["kind"], "ActivationRetryReasonV1");
-			return { kind: record.kind };
-		default: throw new Error("ActivationRetryReasonV1.kind is invalid");
-	}
-}
-function parseLinkIntegrityFailureV1(raw) {
-	const record = requireRecord(raw, "LinkIntegrityFailureV1");
-	switch (record.kind) {
-		case "authority_id_mismatch":
-			rejectUnknownFields(record, [
-				"kind",
-				"expectedAuthorityId",
-				"actualAuthorityId"
-			], "LinkIntegrityFailureV1");
-			return {
-				kind: "authority_id_mismatch",
-				expectedAuthorityId: parseId(parseWalletAuthorityId, record.expectedAuthorityId, "expectedAuthorityId"),
-				actualAuthorityId: parseId(parseWalletAuthorityId, record.actualAuthorityId, "actualAuthorityId")
-			};
-		case "package_set_digest_mismatch":
-			rejectUnknownFields(record, [
-				"kind",
-				"expectedPackageSetDigestB64u",
-				"actualPackageSetDigestB64u"
-			], "LinkIntegrityFailureV1");
-			return {
-				kind: "package_set_digest_mismatch",
-				expectedPackageSetDigestB64u: parseDigest(record.expectedPackageSetDigestB64u, "expectedPackageSetDigestB64u"),
-				actualPackageSetDigestB64u: parseDigest(record.actualPackageSetDigestB64u, "actualPackageSetDigestB64u")
-			};
-		case "installation_receipt_mismatch":
-			rejectUnknownFields(record, ["kind", "field"], "LinkIntegrityFailureV1");
-			if (record.field !== "walletId" && record.field !== "authMethodId" && record.field !== "deviceId" && record.field !== "targetFactorVerificationDigestB64u" && record.field !== "installedActivationRefs") throw new Error("LinkIntegrityFailureV1.field is invalid");
-			return {
-				kind: "installation_receipt_mismatch",
-				field: record.field
-			};
-		default: throw new Error("LinkIntegrityFailureV1.kind is invalid");
-	}
-}
 //#endregion
-export { buildLinkedDeviceApprovalV1, buildLinkedDeviceSessionCancelClaimedRequestV1, buildLinkedDeviceSessionCancelUnclaimedRequestV1, buildLinkedDeviceSessionClaimRequestV1, buildLinkedDeviceTargetCredentialRegistrationV1, buildQrLinkedDeviceSessionPayloadV5, parseActivateInstalledAuthorityResultV1, parseActiveWalletSessionV1, parseLinkDevicePublicKeyB64u, parseLinkSessionProjectionV1, parseLinkSessionStateV1, parseLinkSessionTransportEventV1, parseLinkedDeviceApprovalDeliveryV1, parseLinkedDeviceApprovalResultV1, parseLinkedDeviceApprovalV1, parseLinkedDeviceEmailOtpBaseFactorResolutionResultV1, parseLinkedDeviceEmailOtpBaseFactorResolutionV1, parseLinkedDeviceEmailOtpChallengeResendRequestV1, parseLinkedDeviceEmailOtpChallengeResultV1, parseLinkedDeviceEmailOtpChallengeStartRequestV1, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1, parseLinkedDeviceEmailOtpVerificationGrantV1, parseLinkedDeviceEmailOtpVerificationResultV1, parseLinkedDeviceListRequestV1, parseLinkedDeviceListResultV1, parseLinkedDeviceOwnerAuthorizationRequestV1, parseLinkedDeviceOwnerAuthorizationSourceV1, parseLinkedDeviceRevokeRequestV1, parseLinkedDeviceRevokeResultV1, parseLinkedDeviceSessionClaimV1, parseLinkedDeviceSummaryV1, parseLinkedDeviceTargetCredentialRegistrationResultV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationRequestV1, parseLinkedDeviceTargetPreparationV1, parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1, parseOwnerDeviceSummaryV1, parseQrLinkedDeviceSessionPayloadV5, parseWalletSessionOperationCredentialV1, serializeQrLinkedDeviceSessionPayloadV5 };
+export { buildLinkedDeviceApprovalV1, buildLinkedDeviceSessionCancelClaimedRequestV1, buildLinkedDeviceSessionCancelUnclaimedRequestV1, buildLinkedDeviceSessionClaimRequestV1, buildLinkedDeviceTargetCredentialRegistrationV1, buildQrLinkedDeviceSessionPayloadV5, parseLinkDevicePublicKeyB64u, parseLinkSessionProjectionV1, parseLinkSessionStateV1, parseLinkSessionTransportEventV1, parseLinkedDeviceApprovalDeliveryV1, parseLinkedDeviceApprovalResultV1, parseLinkedDeviceApprovalV1, parseLinkedDeviceEmailOtpBaseFactorResolutionResultV1, parseLinkedDeviceEmailOtpChallengeResendRequestV1, parseLinkedDeviceEmailOtpChallengeResultV1, parseLinkedDeviceEmailOtpChallengeStartRequestV1, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1, parseLinkedDeviceEmailOtpVerificationGrantV1, parseLinkedDeviceEmailOtpVerificationResultV1, parseLinkedDeviceOwnerAuthorizationRequestV1, parseLinkedDeviceOwnerAuthorizationSourceV1, parseLinkedDeviceSessionClaimV1, parseLinkedDeviceTargetCredentialRegistrationResultV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationRequestV1, parseLinkedDeviceTargetPreparationV1, parseQrLinkedDeviceSessionPayloadV5, serializeQrLinkedDeviceSessionPayloadV5 };
 
 //# sourceMappingURL=parsers.js.map