npm - @seams/wallet - Versions diffs - 0.6.2 → 0.7.3 - Mend

@seams/wallet 0.6.2 → 0.7.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1594) hide show

package/dist/esm/react/shared-ts/src/device-linking/parsers.js CHANGED Viewed

@@ -1,15 +1,12 @@
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcMaterialActivationRef, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
+import { requireArray, requireRecord } from "../utils/validation.js";
 import { requireRouterAbX25519PublicKey } from "../utils/routerAbPublicKeyset.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { parseDeviceId as parseDeviceId$1, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
-import { delegatedWalletPermissionNamesV1, parseDelegatedWalletAuthorityV1 } from "../authorization/delegatedAuthority.js";
+import { exactRecord } from "../utils/exactRecord.js";
+import { wireLiteral, wireNullable, wireObject, wireUnion } from "../utils/wireSchema.js";
+import { delegatedWalletPermissionNamesV1 } from "../authorization/delegatedAuthority.js";
+import { parseEd25519PublicKeyB64u } from "../passkey-custody/primitives.js";
+import { authorizationDeviceId, credentialId, digest, enrollmentId, linkedDeviceId, parseDelegatedWalletAuthority, parseNonEmptyToken, parseNonNegativeSafeInteger, parseTargetEmail, parseUnixTime, rpId, sessionId, walletAuthMethodId, walletAuthorityId, walletId, walletKeyId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../utils/addAuthMethodRegistration.js";
-import { parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1, parseLinkedDeviceWalletSessionCredentialDeliveryV1 } from "./walletSessionCredentialDelivery.js";
-import { parseEd25519PublicKeyB64u, parseUnixMs, rejectUnknownFields, requireRecord } from "../passkey-custody/primitives.js";
-import { parseWalletAuthorityV1, parseWalletSignerActivationSetV1 } from "../authorization/walletAuthority.js";
-import { parseWalletAuthMethodRecordV2 } from "../utils/registrationIntent.js";
-import { parseWebAuthnAuthenticatorDeviceInfo } from "../utils/webauthnDeviceInfo.js";
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1 } from "./sourceContribution.js";
 import "./committedSignerPackages.js";
 //#region ../shared-ts/src/device-linking/parsers.ts
@@ -24,7 +21,6 @@ const QR_FIELDS = [
 	"issuedAtMs",
 	"expiresAtMs"
 ];
-const QR_EMAIL_FIELDS = [...QR_FIELDS, "targetEmail"];
 const COMPACT_QR_FIELDS = [
 	"v",
 	"s",
@@ -35,232 +31,16 @@ const COMPACT_QR_FIELDS = [
 	"i",
 	"e"
 ];
-const COMPACT_QR_EMAIL_FIELDS = [...COMPACT_QR_FIELDS, "t"];
-const OWNER_AUTHORIZATION_REQUEST_FIELDS = ["payload", "requestedAtMs"];
-const CLAIM_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"walletId",
-	"enrollmentId",
-	"deviceId",
-	"devicePublicKeyB64u",
-	"targetFactor",
-	"sessionRevision",
-	"claimedAtMs",
-	"claimExpiresAtMs"
-];
-const OWNER_AUTH_WALLET_SESSION_FIELDS = [
-	"kind",
-	"walletSessionId",
-	"authorizationId"
-];
-const ENROLLMENT_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"walletId",
-	"enrollmentId",
-	"deviceId",
-	"linkPublicKeyB64u",
-	"devicePublicKeyB64u",
-	"permission",
-	"targetFactor",
-	"ownerAuthorization",
-	"approvedAtMs",
-	"expiresAtMs"
-];
-const ENROLLMENT_FIELDS_WITH_SOURCE_CONTRIBUTION = [...ENROLLMENT_FIELDS, "sourceContribution"];
-const APPROVAL_DELIVERY_FIELDS = ["kind", "approval"];
-const CREDENTIAL_BASE_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"walletId",
-	"enrollmentId",
-	"deviceId",
-	"walletAuthMethodId",
-	"targetFactor",
-	"targetPreparationDigestB64u",
-	"ordinarySignerMaterialRecipientRequests",
-	"registeredAtMs"
-];
-const PASSKEY_CREDENTIAL_FIELDS = [...CREDENTIAL_BASE_FIELDS, "webauthnRegistration"];
-const EMAIL_OTP_CREDENTIAL_FIELDS = [
-	...CREDENTIAL_BASE_FIELDS,
-	"targetEmail",
-	"emailOtpVerificationGrant"
-];
-const EMAIL_OTP_CREDENTIAL_NEW_FIELDS = [...EMAIL_OTP_CREDENTIAL_FIELDS, "emailOtpEnrollment"];
-const TARGET_PREPARATION_BASE_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"walletId",
-	"enrollmentId",
-	"deviceId",
-	"deliveryRecipientPublicKey65B64u",
-	"walletAuthMethodId",
-	"ed25519ExportRoot",
-	"targetFactor",
-	"ordinarySignerMaterialRecipientRequirements",
-	"issuedAtMs",
-	"expiresAtMs"
-];
-const TARGET_PREPARATION_REQUEST_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"deliveryRecipientPublicKey65B64u"
-];
-const TARGET_PREPARATION_PASSKEY_FIELDS = [
-	...TARGET_PREPARATION_BASE_FIELDS,
-	"passkeyCreationOptions",
-	"passkeyConfigurationDigestB64u"
-];
-const TARGET_PREPARATION_EMAIL_FIELDS = [
-	...TARGET_PREPARATION_BASE_FIELDS,
-	"targetEmail",
-	"enrollment",
-	"baseWalletAuthMethodId"
-];
-const TARGET_PREPARATION_EMAIL_NEW_FIELDS = [
-	...TARGET_PREPARATION_BASE_FIELDS,
-	"targetEmail",
-	"enrollment"
-];
-const EMAIL_OTP_VERIFICATION_GRANT_BASE_FIELDS = [
-	"kind",
-	"grantId",
-	"grantToken",
-	"challengeId",
-	"linkSessionId",
-	"walletId",
-	"enrollmentId",
-	"deviceId",
-	"targetPreparationDigestB64u",
-	"targetEmail",
-	"enrollment",
-	"emailHashHex",
-	"registrationAuthorityId",
-	"providerUserId",
-	"authorityDigestB64u",
-	"issuedAtMs",
-	"expiresAtMs"
-];
-const EMAIL_OTP_VERIFICATION_GRANT_FIELDS = [...EMAIL_OTP_VERIFICATION_GRANT_BASE_FIELDS, "baseWalletAuthMethodId"];
-const EMAIL_OTP_FACTOR_RELEASE_FIELDS = [
-	"kind",
-	"challengeId",
-	"enrollmentId",
-	"enrollmentSealKeyVersion",
-	"serverEphemeralPublicKey65B64u",
-	"nonce12B64u",
-	"ciphertextB64u"
-];
-const WEBAUTHN_REGISTRATION_FIELDS = [
-	"kind",
-	"credentialIdB64u",
-	"authenticatorAttachment",
-	"clientDataJsonB64u",
-	"attestationObjectB64u",
-	"transports"
-];
-const APPROVAL_PENDING_FIELDS = ["outcome", "state"];
-const APPROVAL_REPLAY_FIELDS = ["outcome", "replay"];
-const APPROVAL_REPLAY_PENDING_FIELDS = ["state", "session"];
-const LINKED_DEVICE_SUMMARY_FIELDS = [
-	"deviceId",
-	"enrollmentId",
-	"walletId",
-	"credential",
-	"permission",
-	"keyManifestDigestB64u",
-	"coveredWalletKeys",
-	"state",
-	"createdAtMs",
-	"lastActivityAtMs",
-	"revocationEpoch"
-];
-const LINKED_OWNER_PASSKEY_CREDENTIAL_FIELDS = [
-	"kind",
-	"walletAuthMethodId",
-	"credentialIdB64u",
-	"device"
-];
-const LINKED_OWNER_EMAIL_OTP_CREDENTIAL_FIELDS = [
-	"kind",
-	"walletAuthMethodId",
-	"email"
-];
-const LINKED_DEVICE_LIST_REQUEST_FIELDS = [
-	"kind",
-	"walletId",
-	"limit",
-	"cursor"
-];
-const OWNER_DEVICE_SUMMARY_FIELDS = [
-	"walletId",
-	"walletAuthorityId",
-	"credential",
-	"createdAtMs",
-	"lastActivityAtMs"
-];
-const LINKED_DEVICE_LIST_RESULT_FIELDS = [
-	"devices",
-	"ownerDevices",
-	"nextCursor"
-];
-const LINKED_DEVICE_REVOKE_REQUEST_FIELDS = [
-	"kind",
-	"walletId",
-	"walletAuthMethodId",
-	"requestedAtMs"
-];
-const LINKED_DEVICE_REVOKE_SUCCESS_FIELDS = [
-	"kind",
-	"walletAuthMethodId",
-	"authorityId",
-	"revocationEpoch"
-];
-const LINKED_DEVICE_REVOKE_FAILURE_FIELDS = ["kind"];
-function exactRecord(raw, fields, label) {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, fields, label);
-	for (const field of fields) if (!Object.prototype.hasOwnProperty.call(record, field) || record[field] === void 0) throw new Error(`${label}.${field} is required`);
-	return record;
-}
-function parseId(parser, raw, label) {
-	const result = parser(raw);
-	if (result.ok) return result.value;
-	throw new Error(`${label} ${result.error.message}`);
-}
-function parseLinkedDeviceRevokeWalletAuthMethodId(raw, label) {
-	const value = parseId(parseWalletAuthMethodId, raw, label);
-	if (value.startsWith("wallet-authority:") || value.startsWith("authority:")) throw new Error(`${label} must identify a WalletAuthMethodId`);
-	return value;
-}
-function parseUnixTime(raw, label) {
-	try {
-		return parseUnixMs(raw, label);
-	} catch (error) {
-		throw new Error(error instanceof Error ? error.message : `${label} is invalid`);
-	}
+function supportedLiteral(...values) {
+	return (raw, label) => {
+		if (!values.includes(raw)) throw new Error(`${label} is unsupported`);
+		return raw;
+	};
 }
 function parseEmailHashHex(raw, label) {
 	if (typeof raw !== "string" || !/^[0-9a-f]{64}$/.test(raw)) throw new Error(`${label} must be 32 canonical lowercase hex bytes`);
 	return raw;
 }
-function parseNonEmptyToken(raw, label) {
-	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw) throw new Error(`${label} must be a non-empty canonical string`);
-	for (const character of raw) {
-		const code = character.charCodeAt(0);
-		if (/\s/.test(character) || code <= 31 || code === 127) throw new Error(`${label} must not contain whitespace or control characters`);
-	}
-	return raw;
-}
-function parseDigest(raw, label) {
-	try {
-		return parseDigestB64u(raw);
-	} catch (error) {
-		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
-	}
-}
 function parsePublicKey(raw, label) {
 	if (typeof raw !== "string" || raw.length === 0 || !/^[A-Za-z0-9_-]+$/.test(raw)) throw new Error(`${label} must be canonical unpadded base64url`);
 	try {
@@ -320,33 +100,15 @@ function parseLinkDevicePublicKeyB64u(raw) {
 	return parsePublicKey(raw, "LinkDevicePublicKeyB64u");
 }
 function parseCredential(raw, label) {
-	return parseId(parseWebAuthnCredentialIdB64u, parseCanonicalBase64UrlBytes(raw, label), label);
+	return credentialId(parseCanonicalBase64UrlBytes(raw, label), label);
 }
 function parseKeyFamily(raw, label) {
 	if (raw !== "ed25519" && raw !== "ecdsa_secp256k1") throw new Error(`${label} must identify a supported key family`);
 	return raw;
 }
-function parseNonNegativeSafeInteger(raw, label) {
-	if (!Number.isSafeInteger(raw) || Number(raw) < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	return Number(raw);
-}
-function parsePositiveSafeInteger(raw, label) {
-	const value = parseNonNegativeSafeInteger(raw, label);
-	if (value < 1) throw new Error(`${label} must be a positive safe integer`);
-	return value;
-}
-function parseNullableCursor(raw, label) {
-	if (raw === null) return null;
-	return parseNonEmptyToken(raw, label);
-}
 function assertExpiryAfterIssued(issuedAtMs, expiresAtMs, label) {
 	if (expiresAtMs <= issuedAtMs) throw new Error(`${label}.expiresAtMs must be after issuedAtMs`);
 }
-function parseDelegatedWalletAuthority(raw, label) {
-	const result = parseDelegatedWalletAuthorityV1(raw);
-	if (!result.ok) throw new Error(`${label}: ${result.error.message}`);
-	return result.value;
-}
 function delegatedWalletAuthorityWireValue(value) {
 	return {
 		kind: value.kind,
@@ -377,36 +139,31 @@ function parseTargetFactor(raw, label) {
 		default: throw new Error(`${label}.kind is unsupported`);
 	}
 }
-function parseTargetEmail(raw, label) {
-	const parsed = parseVerifiedEmailAddress(raw);
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
+function passkeyTargetFactorV1() {
+	return wireObject({ kind: wireLiteral("passkey_prf") });
 }
-function parseEmailOtpEnrollmentSelection(raw, label) {
-	const record = requireRecord(raw, label);
-	if (record.kind === "existing_enrollment") {
-		exactRecord(record, ["kind"], label);
-		return { kind: "existing_enrollment" };
-	}
-	if (record.kind === "new_enrollment") {
-		exactRecord(record, ["kind"], label);
-		return { kind: "new_enrollment" };
-	}
-	throw new Error(`${label}.kind is invalid`);
+function emailOtpTargetFactorV1() {
+	return wireObject({ kind: wireLiteral("email_otp") });
 }
-function parseEmailOtpEnrollmentMaterial(raw, label) {
-	const record = exactRecord(raw, [
-		"enrollmentSealKeyVersion",
-		"clientUnlockPublicKeyB64u",
-		"unlockKeyVersion",
-		"serverSealedFactorCiphertextB64u"
-	], label);
-	return {
-		enrollmentSealKeyVersion: parseNonEmptyToken(record.enrollmentSealKeyVersion, `${label}.enrollmentSealKeyVersion`),
-		clientUnlockPublicKeyB64u: parseNonEmptyToken(record.clientUnlockPublicKeyB64u, `${label}.clientUnlockPublicKeyB64u`),
-		unlockKeyVersion: parseNonEmptyToken(record.unlockKeyVersion, `${label}.unlockKeyVersion`),
-		serverSealedFactorCiphertextB64u: parseNonEmptyToken(record.serverSealedFactorCiphertextB64u, `${label}.serverSealedFactorCiphertextB64u`)
-	};
+function existingEnrollmentV1() {
+	return wireObject({ kind: wireLiteral("existing_enrollment") });
+}
+function newEnrollmentV1() {
+	return wireObject({ kind: wireLiteral("new_enrollment") });
+}
+function emailOtpEnrollmentSelectionV1() {
+	return wireUnion("kind", [existingEnrollmentV1(), newEnrollmentV1()]);
+}
+function parseEmailOtpEnrollmentSelection(raw, label) {
+	return emailOtpEnrollmentSelectionV1()(raw, label);
+}
+function emailOtpEnrollmentMaterialV1() {
+	return wireObject({
+		enrollmentSealKeyVersion: parseNonEmptyToken,
+		clientUnlockPublicKeyB64u: parseNonEmptyToken,
+		unlockKeyVersion: parseNonEmptyToken,
+		serverSealedFactorCiphertextB64u: parseNonEmptyToken
+	});
 }
 function parseApprovedTargetFactor(raw, label) {
 	const record = requireRecord(raw, label);
@@ -421,7 +178,7 @@ function parseApprovedTargetFactor(raw, label) {
 			kind: "email_otp",
 			targetEmail,
 			enrollment,
-			baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, exactRecord(record, [
+			baseWalletAuthMethodId: walletAuthMethodId(exactRecord(record, [
 				"kind",
 				"targetEmail",
 				"enrollment",
@@ -441,131 +198,6 @@ function parseApprovedTargetFactor(raw, label) {
 	}
 	throw new Error(`${label}.kind is unsupported`);
 }
-function parseSessionId(raw, label) {
-	return parseId(parseLinkDeviceSessionId, raw, label);
-}
-function parseWallet(raw, label) {
-	return parseId(parseWalletId, raw, label);
-}
-function parseEnrollmentId(raw, label) {
-	return parseId(parseLinkedDeviceEnrollmentId, raw, label);
-}
-function parseDeviceId(raw, label) {
-	return parseId(parseLinkedDeviceId, raw, label);
-}
-function parseWalletKey(raw, label) {
-	return parseId(parseWalletKeyId, raw, label);
-}
-function parseWalletSession(raw, label) {
-	return parseId(parseWalletSessionId, raw, label);
-}
-function parseWalletAuthorization(raw, label) {
-	return parseId(parseWalletSessionAuthorizationId, raw, label);
-}
-function parseLinkedOwnerCredentialMetadata(raw, label) {
-	const record = requireRecord(raw, label);
-	switch (record.kind) {
-		case "passkey": {
-			const exact = exactRecord(record, LINKED_OWNER_PASSKEY_CREDENTIAL_FIELDS, label);
-			const device = parseWebAuthnAuthenticatorDeviceInfo(exact.device);
-			if (!device) throw new Error(`${label}.device is invalid`);
-			return {
-				kind: "passkey",
-				walletAuthMethodId: parseId(parseWalletAuthMethodId, exact.walletAuthMethodId, `${label}.walletAuthMethodId`),
-				credentialIdB64u: parseId(parseWebAuthnCredentialIdB64u, exact.credentialIdB64u, `${label}.credentialIdB64u`),
-				device
-			};
-		}
-		case "email_otp": {
-			const exact = exactRecord(record, LINKED_OWNER_EMAIL_OTP_CREDENTIAL_FIELDS, label);
-			return {
-				kind: "email_otp",
-				walletAuthMethodId: parseId(parseWalletAuthMethodId, exact.walletAuthMethodId, `${label}.walletAuthMethodId`),
-				email: parseTargetEmail(exact.email, `${label}.email`)
-			};
-		}
-		default: throw new Error(`${label}.kind is invalid`);
-	}
-}
-function parseLinkedDeviceSummaryRecord(record) {
-	const state = record.state;
-	if (state !== "provisioning" && state !== "active" && state !== "suspended" && state !== "expired" && state !== "revoked") throw new Error("LinkedDeviceSummaryV1.state is invalid");
-	if (!Array.isArray(record.coveredWalletKeys)) throw new Error("LinkedDeviceSummaryV1.coveredWalletKeys is invalid");
-	const coveredWalletKeys = record.coveredWalletKeys.map((value, index) => parseWalletKey(value, `LinkedDeviceSummaryV1.coveredWalletKeys[${index}]`));
-	return {
-		deviceId: parseDeviceId(record.deviceId, "LinkedDeviceSummaryV1.deviceId"),
-		enrollmentId: parseEnrollmentId(record.enrollmentId, "LinkedDeviceSummaryV1.enrollmentId"),
-		walletId: parseWallet(record.walletId, "LinkedDeviceSummaryV1.walletId"),
-		credential: parseLinkedOwnerCredentialMetadata(record.credential, "LinkedDeviceSummaryV1.credential"),
-		permission: parseDelegatedWalletAuthority(record.permission, "LinkedDeviceSummaryV1.permission"),
-		keyManifestDigestB64u: parseDigest(record.keyManifestDigestB64u, "LinkedDeviceSummaryV1.keyManifestDigestB64u"),
-		coveredWalletKeys,
-		state,
-		createdAtMs: parseUnixTime(record.createdAtMs, "LinkedDeviceSummaryV1.createdAtMs"),
-		lastActivityAtMs: parseUnixTime(record.lastActivityAtMs, "LinkedDeviceSummaryV1.lastActivityAtMs"),
-		revocationEpoch: parseNonNegativeSafeInteger(record.revocationEpoch, "LinkedDeviceSummaryV1.revocationEpoch")
-	};
-}
-function parseLinkedDeviceSummaryV1(raw) {
-	return parseLinkedDeviceSummaryRecord(exactRecord(raw, LINKED_DEVICE_SUMMARY_FIELDS, "LinkedDeviceSummaryV1"));
-}
-function parseLinkedDeviceListRequestV1(raw) {
-	const record = exactRecord(raw, LINKED_DEVICE_LIST_REQUEST_FIELDS, "LinkedDeviceListRequestV1");
-	if (record.kind !== "linked_device_list_request_v1") throw new Error("LinkedDeviceListRequestV1.kind is invalid");
-	return {
-		kind: "linked_device_list_request_v1",
-		walletId: parseWallet(record.walletId, "LinkedDeviceListRequestV1.walletId"),
-		limit: parsePositiveSafeInteger(record.limit, "LinkedDeviceListRequestV1.limit"),
-		cursor: parseNullableCursor(record.cursor, "LinkedDeviceListRequestV1.cursor")
-	};
-}
-function parseOwnerDeviceSummaryV1(raw) {
-	const record = exactRecord(raw, OWNER_DEVICE_SUMMARY_FIELDS, "OwnerDeviceSummaryV1");
-	return {
-		walletId: parseWallet(record.walletId, "OwnerDeviceSummaryV1.walletId"),
-		walletAuthorityId: parseId(parseWalletAuthorityId, record.walletAuthorityId, "OwnerDeviceSummaryV1.walletAuthorityId"),
-		credential: parseLinkedOwnerCredentialMetadata(record.credential, "OwnerDeviceSummaryV1.credential"),
-		createdAtMs: parseUnixTime(record.createdAtMs, "OwnerDeviceSummaryV1.createdAtMs"),
-		lastActivityAtMs: parseUnixTime(record.lastActivityAtMs, "OwnerDeviceSummaryV1.lastActivityAtMs")
-	};
-}
-function parseLinkedDeviceListResultV1(raw) {
-	const record = exactRecord(raw, LINKED_DEVICE_LIST_RESULT_FIELDS, "LinkedDeviceListResultV1");
-	if (!Array.isArray(record.devices)) throw new Error("LinkedDeviceListResultV1.devices is invalid");
-	if (!Array.isArray(record.ownerDevices)) throw new Error("LinkedDeviceListResultV1.ownerDevices is invalid");
-	return {
-		devices: record.devices.map(parseLinkedDeviceSummaryV1),
-		ownerDevices: record.ownerDevices.map(parseOwnerDeviceSummaryV1),
-		nextCursor: parseNullableCursor(record.nextCursor, "LinkedDeviceListResultV1.nextCursor")
-	};
-}
-function parseLinkedDeviceRevokeRequestV1(raw) {
-	const record = exactRecord(raw, LINKED_DEVICE_REVOKE_REQUEST_FIELDS, "LinkedDeviceRevokeRequestV1");
-	if (record.kind !== "linked_device_revoke_request_v1") throw new Error("LinkedDeviceRevokeRequestV1.kind is invalid");
-	return {
-		kind: "linked_device_revoke_request_v1",
-		walletId: parseWallet(record.walletId, "LinkedDeviceRevokeRequestV1.walletId"),
-		walletAuthMethodId: parseLinkedDeviceRevokeWalletAuthMethodId(record.walletAuthMethodId, "LinkedDeviceRevokeRequestV1.walletAuthMethodId"),
-		requestedAtMs: parseUnixTime(record.requestedAtMs, "LinkedDeviceRevokeRequestV1.requestedAtMs")
-	};
-}
-function parseLinkedDeviceRevokeResultV1(raw) {
-	const initial = requireRecord(raw, "LinkedDeviceRevokeResultV1");
-	if (initial.kind === "not_found" || initial.kind === "conflict" || initial.kind === "unauthorized") switch (exactRecord(initial, LINKED_DEVICE_REVOKE_FAILURE_FIELDS, "LinkedDeviceRevokeResultV1").kind) {
-		case "not_found": return { kind: "not_found" };
-		case "conflict": return { kind: "conflict" };
-		case "unauthorized": return { kind: "unauthorized" };
-		default: throw new Error("LinkedDeviceRevokeResultV1.kind is invalid");
-	}
-	const record = exactRecord(initial, LINKED_DEVICE_REVOKE_SUCCESS_FIELDS, "LinkedDeviceRevokeResultV1");
-	if (record.kind !== "revoked") throw new Error("LinkedDeviceRevokeResultV1.kind is invalid");
-	return {
-		kind: record.kind,
-		walletAuthMethodId: parseLinkedDeviceRevokeWalletAuthMethodId(record.walletAuthMethodId, "LinkedDeviceRevokeResultV1.walletAuthMethodId"),
-		authorityId: parseId(parseWalletAuthorityId, record.authorityId, "LinkedDeviceRevokeResultV1.authorityId"),
-		revocationEpoch: parseNonNegativeSafeInteger(record.revocationEpoch, "LinkedDeviceRevokeResultV1.revocationEpoch")
-	};
-}
 function parseQrPayloadRecord(record) {
 	if (record.version !== "v5") throw new Error("QrLinkedDeviceSessionPayloadV5.version is invalid");
 	if (record.purpose !== "linked_device_lane_creation") throw new Error("QrLinkedDeviceSessionPayloadV5.purpose is invalid");
@@ -575,7 +207,7 @@ function parseQrPayloadRecord(record) {
 	const base = {
 		version: "v5",
 		purpose: "linked_device_lane_creation",
-		linkSessionId: parseSessionId(record.linkSessionId, "QrLinkedDeviceSessionPayloadV5.linkSessionId"),
+		linkSessionId: sessionId(record.linkSessionId, "QrLinkedDeviceSessionPayloadV5.linkSessionId"),
 		linkPublicKeyB64u: parsePublicKey(record.linkPublicKeyB64u, "QrLinkedDeviceSessionPayloadV5.linkPublicKeyB64u"),
 		devicePublicKeyB64u: parsePublicKey(record.devicePublicKeyB64u, "QrLinkedDeviceSessionPayloadV5.devicePublicKeyB64u"),
 		requestedPermission: parseDelegatedWalletAuthority(record.requestedPermission, "QrLinkedDeviceSessionPayloadV5.requestedPermission"),
@@ -595,7 +227,7 @@ function parseQrPayloadRecord(record) {
 }
 function parseQrLinkedDeviceSessionPayloadV5(raw) {
 	const candidate = requireRecord(raw, "QrLinkedDeviceSessionPayloadV5");
-	return parseQrPayloadRecord(exactRecord(candidate, parseTargetFactor(candidate.targetFactor, "QrLinkedDeviceSessionPayloadV5.targetFactor").kind === "email_otp" ? QR_EMAIL_FIELDS : QR_FIELDS, "QrLinkedDeviceSessionPayloadV5"));
+	return parseQrPayloadRecord(exactRecord(candidate, parseTargetFactor(candidate.targetFactor, "QrLinkedDeviceSessionPayloadV5.targetFactor").kind === "email_otp" ? [...QR_FIELDS, "targetEmail"] : QR_FIELDS, "QrLinkedDeviceSessionPayloadV5"));
 }
 function serializeQrLinkedDeviceSessionPayloadV5(payload) {
 	const parsed = parseQrPayloadRecord(qrPayloadWireValue(payload));
@@ -622,7 +254,7 @@ function parseQrLinkedDeviceSessionTextV5(raw) {
 		throw new Error("Linked-device QR payload is not valid JSON");
 	}
 	const candidate = requireRecord(decoded, "LinkedDeviceQrV5");
-	const compact = exactRecord(candidate, (candidate.f === "e" ? "email_otp" : "passkey_prf") === "email_otp" ? COMPACT_QR_EMAIL_FIELDS : COMPACT_QR_FIELDS, "LinkedDeviceQrV5");
+	const compact = exactRecord(candidate, (candidate.f === "e" ? "email_otp" : "passkey_prf") === "email_otp" ? [...COMPACT_QR_FIELDS, "t"] : COMPACT_QR_FIELDS, "LinkedDeviceQrV5");
 	if (compact.v !== 5) throw new Error("LinkedDeviceQrV5.v is invalid");
 	if (compact.f !== "p" && compact.f !== "e") throw new Error("LinkedDeviceQrV5.f is invalid");
 	const payload = {
@@ -644,91 +276,58 @@ function parseQrLinkedDeviceSessionTextV5(raw) {
 		targetFactor: { kind: "passkey_prf" }
 	});
 }
+function linkedDeviceOwnerAuthorizationRequestV1() {
+	return wireObject({
+		payload: parseQrLinkedDeviceSessionPayloadV5,
+		requestedAtMs: parseUnixTime
+	});
+}
 function parseLinkedDeviceOwnerAuthorizationRequestV1(raw) {
-	const record = exactRecord(raw, OWNER_AUTHORIZATION_REQUEST_FIELDS, "LinkedDeviceOwnerAuthorizationRequestV1");
-	const requestedAtMs = parseUnixTime(record.requestedAtMs, "LinkedDeviceOwnerAuthorizationRequestV1.requestedAtMs");
-	return {
-		payload: parseQrLinkedDeviceSessionPayloadV5(record.payload),
-		requestedAtMs
-	};
+	return linkedDeviceOwnerAuthorizationRequestV1()(raw, "LinkedDeviceOwnerAuthorizationRequestV1");
+}
+function linkSessionStatesV1() {
+	const withDevice = (state) => wireObject({
+		state: wireLiteral(state),
+		deviceId: authorizationDeviceId
+	});
+	return [
+		wireObject({ state: wireLiteral("displaying_qr") }),
+		withDevice("claimed"),
+		withDevice("awaiting_target_factor"),
+		withDevice("awaiting_source_contribution"),
+		withDevice("provisioning"),
+		wireObject({
+			state: wireLiteral("authority_pending_local_install"),
+			deviceId: authorizationDeviceId,
+			authorityId: walletAuthorityId,
+			packageSetDigestB64u: digest
+		}),
+		wireObject({
+			state: wireLiteral("active"),
+			deviceId: authorizationDeviceId,
+			authorityId: walletAuthorityId,
+			activatedAtMs: parseUnixTime
+		}),
+		wireObject({
+			state: wireLiteral("failed_before_commit"),
+			error: parseLinkPrecommitFailureV1
+		}),
+		wireObject({
+			state: wireLiteral("cancelled"),
+			cancelledAtMs: parseUnixTime
+		}),
+		wireObject({
+			state: wireLiteral("expired"),
+			expiredAtMs: parseUnixTime
+		})
+	];
 }
-const LINK_SESSION_PROJECTION_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"qrPayload",
-	"revision",
-	"createdAtMs",
-	"updatedAtMs",
-	"state"
-];
-const LINK_SESSION_EVENT_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"state",
-	"emittedAtMs"
-];
 function parseLinkSessionStateV1(raw) {
-	const initial = requireRecord(raw, "LinkSessionStateV1");
-	if (typeof initial.state !== "string") throw new Error("LinkSessionStateV1.state is invalid");
-	switch (initial.state) {
-		case "displaying_qr":
-			exactRecord(initial, ["state"], "LinkSessionStateV1.displaying_qr");
-			return { state: "displaying_qr" };
-		case "claimed":
-		case "awaiting_target_factor":
-		case "awaiting_source_contribution":
-		case "provisioning":
-			exactRecord(initial, ["state", "deviceId"], `LinkSessionStateV1.${initial.state}`);
-			return {
-				state: initial.state,
-				deviceId: parseId(parseDeviceId$1, initial.deviceId, `LinkSessionStateV1.${initial.state}.deviceId`)
-			};
-		case "authority_pending_local_install":
-			exactRecord(initial, [
-				"state",
-				"deviceId",
-				"authorityId",
-				"packageSetDigestB64u"
-			], "LinkSessionStateV1.authority_pending_local_install");
-			return {
-				state: initial.state,
-				deviceId: parseId(parseDeviceId$1, initial.deviceId, "LinkSessionStateV1.authority_pending_local_install.deviceId"),
-				authorityId: parseId(parseWalletAuthorityId, initial.authorityId, "LinkSessionStateV1.authority_pending_local_install.authorityId"),
-				packageSetDigestB64u: parseDigest(initial.packageSetDigestB64u, "LinkSessionStateV1.authority_pending_local_install.packageSetDigestB64u")
-			};
-		case "active":
-			exactRecord(initial, [
-				"state",
-				"deviceId",
-				"authorityId",
-				"activatedAtMs"
-			], "LinkSessionStateV1.active");
-			return {
-				state: initial.state,
-				deviceId: parseId(parseDeviceId$1, initial.deviceId, "LinkSessionStateV1.active.deviceId"),
-				authorityId: parseId(parseWalletAuthorityId, initial.authorityId, "LinkSessionStateV1.active.authorityId"),
-				activatedAtMs: parseUnixTime(initial.activatedAtMs, "LinkSessionStateV1.active.activatedAtMs")
-			};
-		case "failed_before_commit":
-			exactRecord(initial, ["state", "error"], "LinkSessionStateV1.failed_before_commit");
-			return {
-				state: initial.state,
-				error: parseLinkPrecommitFailureV1(initial.error)
-			};
-		case "cancelled":
-			exactRecord(initial, ["state", "cancelledAtMs"], "LinkSessionStateV1.cancelled");
-			return {
-				state: initial.state,
-				cancelledAtMs: parseUnixTime(initial.cancelledAtMs, "LinkSessionStateV1.cancelled.cancelledAtMs")
-			};
-		case "expired":
-			exactRecord(initial, ["state", "expiredAtMs"], "LinkSessionStateV1.expired");
-			return {
-				state: initial.state,
-				expiredAtMs: parseUnixTime(initial.expiredAtMs, "LinkSessionStateV1.expired.expiredAtMs")
-			};
-		default: throw new Error(`LinkSessionStateV1.state ${initial.state} is unsupported`);
-	}
+	const state = requireRecord(raw, "LinkSessionStateV1").state;
+	if (typeof state !== "string") throw new Error("LinkSessionStateV1.state is invalid");
+	const schema = linkSessionStatesV1().find((variant) => variant.shape.state.literals.includes(state));
+	if (!schema) throw new Error(`LinkSessionStateV1.state ${state} is unsupported`);
+	return schema(raw, `LinkSessionStateV1.${state}`);
 }
 function parseLinkPrecommitFailureV1(raw) {
 	const record = exactRecord(raw, ["kind", "reason"], "LinkPrecommitFailureV1");
@@ -738,43 +337,45 @@ function parseLinkPrecommitFailureV1(raw) {
 		reason: parseNonEmptyToken(record.reason, "LinkPrecommitFailureV1.reason")
 	};
 }
+function linkSessionProjectionV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_session_projection_v1"),
+		linkSessionId: sessionId,
+		qrPayload: parseQrLinkedDeviceSessionPayloadV5,
+		revision: parseNonNegativeSafeInteger,
+		createdAtMs: parseUnixTime,
+		updatedAtMs: parseUnixTime,
+		state: parseLinkSessionStateV1
+	});
+}
 function parseLinkSessionProjectionV1(raw) {
-	const record = exactRecord(raw, LINK_SESSION_PROJECTION_FIELDS, "LinkSessionProjectionV1");
-	if (record.kind !== "linked_device_session_projection_v1") throw new Error("LinkSessionProjectionV1.kind is invalid");
-	return {
-		kind: "linked_device_session_projection_v1",
-		linkSessionId: parseSessionId(record.linkSessionId, "LinkSessionProjectionV1.linkSessionId"),
-		qrPayload: parseQrLinkedDeviceSessionPayloadV5(record.qrPayload),
-		revision: parseNonNegativeSafeInteger(record.revision, "LinkSessionProjectionV1.revision"),
-		createdAtMs: parseUnixTime(record.createdAtMs, "LinkSessionProjectionV1.createdAtMs"),
-		updatedAtMs: parseUnixTime(record.updatedAtMs, "LinkSessionProjectionV1.updatedAtMs"),
-		state: parseLinkSessionStateV1(record.state)
-	};
+	return linkSessionProjectionV1()(raw, "LinkSessionProjectionV1");
+}
+function linkSessionTransportEventV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_session_event_v1"),
+		linkSessionId: sessionId,
+		state: parseLinkSessionStateV1,
+		emittedAtMs: parseUnixTime
+	});
 }
 function parseLinkSessionTransportEventV1(raw) {
-	const record = exactRecord(raw, LINK_SESSION_EVENT_FIELDS, "LinkSessionTransportEventV1");
-	if (record.kind !== "linked_device_session_event_v1") throw new Error("LinkSessionTransportEventV1.kind is invalid");
-	return {
-		kind: "linked_device_session_event_v1",
-		linkSessionId: parseSessionId(record.linkSessionId, "LinkSessionTransportEventV1.linkSessionId"),
-		state: parseLinkSessionStateV1(record.state),
-		emittedAtMs: parseUnixTime(record.emittedAtMs, "LinkSessionTransportEventV1.emittedAtMs")
-	};
+	return linkSessionTransportEventV1()(raw, "LinkSessionTransportEventV1");
+}
+function linkedDeviceApprovalResultV1() {
+	return wireUnion("outcome", [wireObject({
+		outcome: wireLiteral("pending"),
+		state: parsePendingApprovalState
+	}), wireObject({
+		outcome: wireLiteral("replayed"),
+		replay: wireObject({
+			state: () => "pending",
+			session: parsePendingApprovalState
+		})
+	})]);
 }
 function parseLinkedDeviceApprovalResultV1(raw) {
-	const initial = requireRecord(raw, "LinkedDeviceApprovalResultV1");
-	if (initial.outcome === "pending") return {
-		outcome: "pending",
-		state: parsePendingApprovalState(exactRecord(initial, APPROVAL_PENDING_FIELDS, "LinkedDeviceApprovalResultV1").state)
-	};
-	if (initial.outcome !== "replayed") throw new Error("LinkedDeviceApprovalResultV1.outcome is invalid");
-	return {
-		outcome: "replayed",
-		replay: {
-			state: "pending",
-			session: parsePendingApprovalState(exactRecord(exactRecord(initial, APPROVAL_REPLAY_FIELDS, "LinkedDeviceApprovalResultV1").replay, APPROVAL_REPLAY_PENDING_FIELDS, "LinkedDeviceApprovalResultV1.replay").session)
-		}
-	};
+	return linkedDeviceApprovalResultV1()(raw, "LinkedDeviceApprovalResultV1");
 }
 function parsePendingApprovalState(raw) {
 	const state = parseLinkSessionStateV1(raw);
@@ -786,180 +387,189 @@ function parsePendingApprovalState(raw) {
 		default: throw new Error("LinkedDeviceApprovalResultV1 state is not pending");
 	}
 }
+function linkedDeviceSessionClaimV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_session_claim_v1"),
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		devicePublicKeyB64u: parsePublicKey,
+		targetFactor: parseTargetFactor,
+		sessionRevision: parseUnixTime,
+		claimedAtMs: parseUnixTime,
+		claimExpiresAtMs: parseUnixTime
+	}, (claim, label) => assertExpiryAfterIssued(claim.claimedAtMs, claim.claimExpiresAtMs, label));
+}
 function parseLinkedDeviceSessionClaimV1(raw) {
-	const record = exactRecord(raw, CLAIM_FIELDS, "LinkedDeviceSessionClaimV1");
-	if (record.kind !== "linked_device_session_claim_v1") throw new Error("LinkedDeviceSessionClaimV1.kind is invalid");
-	const claimedAtMs = parseUnixTime(record.claimedAtMs, "LinkedDeviceSessionClaimV1.claimedAtMs");
-	const claimExpiresAtMs = parseUnixTime(record.claimExpiresAtMs, "LinkedDeviceSessionClaimV1.claimExpiresAtMs");
-	assertExpiryAfterIssued(claimedAtMs, claimExpiresAtMs, "LinkedDeviceSessionClaimV1");
-	return {
-		kind: "linked_device_session_claim_v1",
-		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceSessionClaimV1.linkSessionId"),
-		walletId: parseWallet(record.walletId, "LinkedDeviceSessionClaimV1.walletId"),
-		enrollmentId: parseEnrollmentId(record.enrollmentId, "LinkedDeviceSessionClaimV1.enrollmentId"),
-		deviceId: parseDeviceId(record.deviceId, "LinkedDeviceSessionClaimV1.deviceId"),
-		devicePublicKeyB64u: parsePublicKey(record.devicePublicKeyB64u, "LinkedDeviceSessionClaimV1.devicePublicKeyB64u"),
-		targetFactor: parseTargetFactor(record.targetFactor, "LinkedDeviceSessionClaimV1.targetFactor"),
-		sessionRevision: parseUnixTime(record.sessionRevision, "LinkedDeviceSessionClaimV1.sessionRevision"),
-		claimedAtMs,
-		claimExpiresAtMs
-	};
+	return linkedDeviceSessionClaimV1()(raw, "LinkedDeviceSessionClaimV1");
+}
+function walletSessionOwnerAuthorizationV1() {
+	return wireObject({
+		kind: wireLiteral("wallet_session"),
+		walletSessionId,
+		authorizationId: walletSessionAuthorizationId
+	});
 }
 function parseLinkedDeviceOwnerAuthorizationSourceV1(raw, label = "ownerAuthorization") {
-	const record = requireRecord(raw, label);
-	if (record.kind === "wallet_session") {
-		const exact = exactRecord(record, OWNER_AUTH_WALLET_SESSION_FIELDS, label);
-		return {
-			kind: "wallet_session",
-			walletSessionId: parseWalletSession(exact.walletSessionId, `${label}.walletSessionId`),
-			authorizationId: parseWalletAuthorization(exact.authorizationId, `${label}.authorizationId`)
-		};
-	}
-	throw new Error(`${label}.kind is unsupported`);
+	if (requireRecord(raw, label).kind !== "wallet_session") throw new Error(`${label}.kind is unsupported`);
+	return walletSessionOwnerAuthorizationV1()(raw, label);
 }
-function parseEnrollmentCore(record, label) {
-	const approvedAtMs = parseUnixTime(record.approvedAtMs, `${label}.approvedAtMs`);
-	const expiresAtMs = parseUnixTime(record.expiresAtMs, `${label}.expiresAtMs`);
-	assertExpiryAfterIssued(approvedAtMs, expiresAtMs, label);
-	const core = {
-		linkSessionId: parseSessionId(record.linkSessionId, `${label}.linkSessionId`),
-		walletId: parseWallet(record.walletId, `${label}.walletId`),
-		enrollmentId: parseEnrollmentId(record.enrollmentId, `${label}.enrollmentId`),
-		deviceId: parseDeviceId(record.deviceId, `${label}.deviceId`),
-		linkPublicKeyB64u: parsePublicKey(record.linkPublicKeyB64u, `${label}.linkPublicKeyB64u`),
-		devicePublicKeyB64u: parsePublicKey(record.devicePublicKeyB64u, `${label}.devicePublicKeyB64u`),
-		permission: parseDelegatedWalletAuthority(record.permission, `${label}.permission`),
-		targetFactor: parseApprovedTargetFactor(record.targetFactor, `${label}.targetFactor`),
-		ownerAuthorization: parseLinkedDeviceOwnerAuthorizationSourceV1(record.ownerAuthorization, `${label}.ownerAuthorization`),
-		approvedAtMs,
-		expiresAtMs
-	};
-	if (record.sourceContribution === void 0) return core;
+function linkedDeviceApprovalFields() {
 	return {
-		...core,
-		sourceContribution: parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1(record.sourceContribution)
+		kind: wireLiteral("linked_device_approval_v1"),
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		linkPublicKeyB64u: parsePublicKey,
+		devicePublicKeyB64u: parsePublicKey,
+		permission: parseDelegatedWalletAuthority,
+		targetFactor: parseApprovedTargetFactor,
+		ownerAuthorization: parseLinkedDeviceOwnerAuthorizationSourceV1,
+		approvedAtMs: parseUnixTime,
+		expiresAtMs: parseUnixTime
 	};
 }
+function approvedBeforeExpiry(approval, label) {
+	assertExpiryAfterIssued(approval.approvedAtMs, approval.expiresAtMs, label);
+}
+function linkedDeviceApprovalV1() {
+	return wireObject(linkedDeviceApprovalFields(), approvedBeforeExpiry);
+}
+function linkedDeviceSourceContributionApprovalV1() {
+	return wireObject({
+		...linkedDeviceApprovalFields(),
+		sourceContribution: parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1
+	}, approvedBeforeExpiry);
+}
 function parseLinkedDeviceApprovalV1(raw) {
-	const candidate = requireRecord(raw, "LinkedDeviceApprovalV1");
-	const record = exactRecord(candidate, candidate.sourceContribution === void 0 ? ENROLLMENT_FIELDS : ENROLLMENT_FIELDS_WITH_SOURCE_CONTRIBUTION, "LinkedDeviceApprovalV1");
-	if (record.kind !== "linked_device_approval_v1") throw new Error("LinkedDeviceApprovalV1.kind is invalid");
-	return {
-		kind: "linked_device_approval_v1",
-		...parseEnrollmentCore(record, "LinkedDeviceApprovalV1")
-	};
+	const record = requireRecord(raw, "LinkedDeviceApprovalV1");
+	return (record.sourceContribution === void 0 ? linkedDeviceApprovalV1() : linkedDeviceSourceContributionApprovalV1())(record, "LinkedDeviceApprovalV1");
+}
+function linkedDeviceApprovalDeliveryV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_approval_delivery_v1"),
+		approval: parseLinkedDeviceApprovalV1
+	});
 }
 function parseLinkedDeviceApprovalDeliveryV1(raw) {
-	const record = exactRecord(raw, APPROVAL_DELIVERY_FIELDS, "LinkedDeviceApprovalDeliveryV1");
-	if (record.kind !== "linked_device_approval_delivery_v1") throw new Error("LinkedDeviceApprovalDeliveryV1.kind is invalid");
+	return linkedDeviceApprovalDeliveryV1()(raw, "LinkedDeviceApprovalDeliveryV1");
+}
+function linkedDeviceTargetPreparationFields() {
 	return {
-		kind: "linked_device_approval_delivery_v1",
-		approval: parseLinkedDeviceApprovalV1(record.approval)
+		kind: wireLiteral("linked_device_target_preparation_v1"),
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		deliveryRecipientPublicKey65B64u: parseUncompressedP256PointB64u,
+		walletAuthMethodId,
+		ed25519ExportRoot: wireNullable(ed25519ExportRootPreparationV1()),
+		ordinarySignerMaterialRecipientRequirements: parseRecipientRequirements,
+		issuedAtMs: parseUnixTime,
+		expiresAtMs: parseUnixTime
 	};
 }
+function preparationExpiresAfterIssue(preparation, label) {
+	if (preparation.expiresAtMs <= preparation.issuedAtMs) throw new Error(`${label}.expiresAtMs must follow issuedAtMs`);
+}
+function passkeyTargetPreparationV1() {
+	return wireObject({
+		...linkedDeviceTargetPreparationFields(),
+		targetFactor: passkeyTargetFactorV1(),
+		passkeyCreationOptions: parseLinkedDevicePasskeyCreationOptionsV1,
+		passkeyConfigurationDigestB64u: digest
+	}, (preparation, label) => {
+		preparationExpiresAfterIssue(preparation, label);
+		if (preparation.passkeyCreationOptions.walletAuthMethodId !== preparation.walletAuthMethodId) throw new Error(`${label}.passkeyCreationOptions.walletAuthMethodId must match the preparation`);
+	});
+}
+function emailOtpTargetPreparationV1() {
+	return wireObject({
+		...linkedDeviceTargetPreparationFields(),
+		targetFactor: emailOtpTargetFactorV1(),
+		targetEmail: parseTargetEmail,
+		enrollment: existingEnrollmentV1(),
+		baseWalletAuthMethodId: walletAuthMethodId
+	}, preparationExpiresAfterIssue);
+}
+function newEmailOtpTargetPreparationV1() {
+	return wireObject({
+		...linkedDeviceTargetPreparationFields(),
+		targetFactor: emailOtpTargetFactorV1(),
+		targetEmail: parseTargetEmail,
+		enrollment: newEnrollmentV1()
+	}, preparationExpiresAfterIssue);
+}
 function parseLinkedDeviceTargetPreparationV1(raw) {
-	const candidate = requireRecord(raw, "LinkedDeviceTargetPreparationV1");
-	const targetFactor = parseTargetFactor(candidate.targetFactor, "LinkedDeviceTargetPreparationV1.targetFactor");
-	const emailEnrollment = targetFactor.kind === "email_otp" ? parseEmailOtpEnrollmentSelection(candidate.enrollment, "LinkedDeviceTargetPreparationV1.enrollment") : null;
-	const record = exactRecord(candidate, targetFactor.kind === "passkey_prf" ? TARGET_PREPARATION_PASSKEY_FIELDS : emailEnrollment?.kind === "new_enrollment" ? TARGET_PREPARATION_EMAIL_NEW_FIELDS : TARGET_PREPARATION_EMAIL_FIELDS, "LinkedDeviceTargetPreparationV1");
-	if (record.kind !== "linked_device_target_preparation_v1") throw new Error("LinkedDeviceTargetPreparationV1.kind is invalid");
-	const walletAuthMethodId = parseId(parseWalletAuthMethodId, record.walletAuthMethodId, "LinkedDeviceTargetPreparationV1.walletAuthMethodId");
-	const ordinarySignerMaterialRecipientRequirements = parseOrdinarySignerMaterialRecipientRequirementsV1(record.ordinarySignerMaterialRecipientRequirements);
-	const issuedAtMs = parseUnixTime(record.issuedAtMs, "LinkedDeviceTargetPreparationV1.issuedAtMs");
-	const expiresAtMs = parseUnixTime(record.expiresAtMs, "LinkedDeviceTargetPreparationV1.expiresAtMs");
-	if (expiresAtMs <= issuedAtMs) throw new Error("LinkedDeviceTargetPreparationV1.expiresAtMs must follow issuedAtMs");
-	const ed25519ExportRoot = parseLinkedDeviceEd25519ExportRootPreparationV1(record.ed25519ExportRoot);
-	const base = {
-		kind: "linked_device_target_preparation_v1",
-		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceTargetPreparationV1.linkSessionId"),
-		walletId: parseWallet(record.walletId, "LinkedDeviceTargetPreparationV1.walletId"),
-		enrollmentId: parseEnrollmentId(record.enrollmentId, "LinkedDeviceTargetPreparationV1.enrollmentId"),
-		deviceId: parseDeviceId(record.deviceId, "LinkedDeviceTargetPreparationV1.deviceId"),
-		deliveryRecipientPublicKey65B64u: parseUncompressedP256PointB64u(record.deliveryRecipientPublicKey65B64u, "LinkedDeviceTargetPreparationV1.deliveryRecipientPublicKey65B64u"),
-		walletAuthMethodId,
-		ed25519ExportRoot,
-		ordinarySignerMaterialRecipientRequirements,
-		issuedAtMs,
-		expiresAtMs
-	};
-	if (targetFactor.kind === "passkey_prf") {
-		const passkeyCreationOptions = parseLinkedDevicePasskeyCreationOptionsV1(record.passkeyCreationOptions, walletAuthMethodId);
-		return {
-			...base,
-			targetFactor,
-			passkeyCreationOptions,
-			passkeyConfigurationDigestB64u: parseDigest(record.passkeyConfigurationDigestB64u, "LinkedDeviceTargetPreparationV1.passkeyConfigurationDigestB64u")
-		};
-	}
-	if (!emailEnrollment) throw new Error("Email OTP target preparation enrollment is missing");
-	const targetEmail = parseTargetEmail(record.targetEmail, "LinkedDeviceTargetPreparationV1.targetEmail");
-	if (emailEnrollment.kind === "new_enrollment") return {
-		...base,
-		targetFactor,
-		targetEmail,
-		enrollment: emailEnrollment
-	};
-	return {
-		...base,
-		targetFactor,
-		targetEmail,
-		enrollment: emailEnrollment,
-		baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, record.baseWalletAuthMethodId, "LinkedDeviceTargetPreparationV1.baseWalletAuthMethodId")
-	};
+	const label = "LinkedDeviceTargetPreparationV1";
+	const record = requireRecord(raw, label);
+	if (parseTargetFactor(record.targetFactor, `${label}.targetFactor`).kind === "passkey_prf") return passkeyTargetPreparationV1()(record, label);
+	return (parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`).kind === "new_enrollment" ? newEmailOtpTargetPreparationV1() : emailOtpTargetPreparationV1())(record, label);
+}
+function linkedDeviceTargetPreparationRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_target_preparation_request_v1"),
+		linkSessionId: sessionId,
+		deliveryRecipientPublicKey65B64u: parseUncompressedP256PointB64u
+	});
 }
 function parseLinkedDeviceTargetPreparationRequestV1(raw) {
-	const record = exactRecord(raw, TARGET_PREPARATION_REQUEST_FIELDS, "LinkedDeviceTargetPreparationRequestV1");
-	if (record.kind !== "linked_device_target_preparation_request_v1") throw new Error("LinkedDeviceTargetPreparationRequestV1.kind is invalid");
-	return {
-		kind: "linked_device_target_preparation_request_v1",
-		linkSessionId: parseSessionId(record.linkSessionId, "LinkedDeviceTargetPreparationRequestV1.linkSessionId"),
-		deliveryRecipientPublicKey65B64u: parseUncompressedP256PointB64u(record.deliveryRecipientPublicKey65B64u, "LinkedDeviceTargetPreparationRequestV1.deliveryRecipientPublicKey65B64u")
-	};
+	return linkedDeviceTargetPreparationRequestV1()(raw, "LinkedDeviceTargetPreparationRequestV1");
+}
+function emailOtpBaseFactorChoiceV1() {
+	return wireObject({
+		baseWalletAuthMethodId: walletAuthMethodId,
+		maskedEmailHint: (raw, label) => {
+			if (typeof raw !== "string" || raw.length === 0) throw new Error(`${label} is invalid`);
+			return raw;
+		}
+	});
 }
-function parseLinkedDeviceEmailOtpBaseFactorChoiceV1(raw) {
-	const record = exactRecord(raw, ["baseWalletAuthMethodId", "maskedEmailHint"], "LinkedDeviceEmailOtpBaseFactorChoiceV1");
-	if (typeof record.maskedEmailHint !== "string" || record.maskedEmailHint.length === 0) throw new Error("LinkedDeviceEmailOtpBaseFactorChoiceV1.maskedEmailHint is invalid");
+function emailOtpBaseFactorResolutionsV1() {
+	const choice = emailOtpBaseFactorChoiceV1();
+	const parseChoice = (raw) => choice(raw, "LinkedDeviceEmailOtpBaseFactorChoiceV1");
 	return {
-		baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, record.baseWalletAuthMethodId, "LinkedDeviceEmailOtpBaseFactorChoiceV1.baseWalletAuthMethodId"),
-		maskedEmailHint: record.maskedEmailHint
+		selected: wireObject({
+			kind: wireLiteral("selected"),
+			choice: parseChoice
+		}),
+		selection_required: wireObject({
+			kind: wireLiteral("selection_required"),
+			choices: (raw, label) => {
+				if (!Array.isArray(raw) || raw.length === 0) throw new Error(`${label} must not be empty`);
+				const choices = raw.map(parseChoice);
+				return [choices[0], ...choices.slice(1)];
+			}
+		}),
+		unavailable: wireObject({
+			kind: wireLiteral("unavailable"),
+			reason: supportedLiteral("no_active_email_otp_base_factor")
+		})
 	};
 }
 function parseLinkedDeviceEmailOtpBaseFactorResolutionV1(raw) {
-	const record = requireRecord(raw, "LinkedDeviceEmailOtpBaseFactorResolutionV1");
+	const label = "LinkedDeviceEmailOtpBaseFactorResolutionV1";
+	const record = requireRecord(raw, label);
+	const resolutions = emailOtpBaseFactorResolutionsV1();
 	switch (record.kind) {
-		case "selected": return {
-			kind: "selected",
-			choice: parseLinkedDeviceEmailOtpBaseFactorChoiceV1(exactRecord(record, ["kind", "choice"], "LinkedDeviceEmailOtpBaseFactorResolutionV1").choice)
-		};
-		case "selection_required": {
-			const exact = exactRecord(record, ["kind", "choices"], "LinkedDeviceEmailOtpBaseFactorResolutionV1");
-			if (!Array.isArray(exact.choices) || exact.choices.length === 0) throw new Error("LinkedDeviceEmailOtpBaseFactorResolutionV1.choices must not be empty");
-			const choices = exact.choices.map(parseLinkedDeviceEmailOtpBaseFactorChoiceV1);
-			return {
-				kind: "selection_required",
-				choices: [choices[0], ...choices.slice(1)]
-			};
-		}
-		case "unavailable": {
-			const exact = exactRecord(record, ["kind", "reason"], "LinkedDeviceEmailOtpBaseFactorResolutionV1");
-			if (exact.reason !== "no_active_email_otp_base_factor") throw new Error("LinkedDeviceEmailOtpBaseFactorResolutionV1.reason is unsupported");
-			return {
-				kind: "unavailable",
-				reason: exact.reason
-			};
-		}
-		default: throw new Error("LinkedDeviceEmailOtpBaseFactorResolutionV1.kind is unsupported");
+		case "selected":
+		case "selection_required":
+		case "unavailable": return resolutions[record.kind](record, label);
+		default: throw new Error(`${label}.kind is unsupported`);
 	}
 }
+function emailOtpBaseFactorResolutionResultV1() {
+	return wireObject({
+		revision: parseUnixTime,
+		resolution: parseLinkedDeviceEmailOtpBaseFactorResolutionV1
+	});
+}
 function parseLinkedDeviceEmailOtpBaseFactorResolutionResultV1(raw) {
-	const record = exactRecord(raw, ["revision", "resolution"], "LinkedDeviceEmailOtpBaseFactorResolutionResultV1");
-	return {
-		revision: parseUnixTime(record.revision, "LinkedDeviceEmailOtpBaseFactorResolutionResultV1.revision"),
-		resolution: parseLinkedDeviceEmailOtpBaseFactorResolutionV1(record.resolution)
-	};
+	return emailOtpBaseFactorResolutionResultV1()(raw, "LinkedDeviceEmailOtpBaseFactorResolutionResultV1");
 }
-function parseLinkedDevicePasskeyCreationOptionsV1(raw, expectedWalletAuthMethodId) {
-	const label = "LinkedDeviceTargetPreparationV1.passkeyCreationOptions";
+function parseLinkedDevicePasskeyCreationOptionsV1(raw, label) {
 	const record = exactRecord(raw, [
 		"kind",
 		"walletAuthMethodId",
@@ -974,8 +584,7 @@ function parseLinkedDevicePasskeyCreationOptionsV1(raw, expectedWalletAuthMethod
 		"extensions",
 		"excludeCredentials"
 	], label);
-	const walletAuthMethodId = parseId(parseWalletAuthMethodId, record.walletAuthMethodId, `${label}.walletAuthMethodId`);
-	if (walletAuthMethodId !== expectedWalletAuthMethodId) throw new Error(`${label}.walletAuthMethodId must match the preparation`);
+	const methodId = walletAuthMethodId(record.walletAuthMethodId, `${label}.walletAuthMethodId`);
 	exactRecord(record.user, [
 		"idB64u",
 		"name",
@@ -994,7 +603,7 @@ function parseLinkedDevicePasskeyCreationOptionsV1(raw, expectedWalletAuthMethod
 	const options = parseWalletAddAuthMethodRegistrationOptions(record);
 	return {
 		kind: options.kind,
-		walletAuthMethodId,
+		walletAuthMethodId: methodId,
 		challengeId: options.challengeId,
 		challengeB64u: options.challengeB64u,
 		rpId: options.rpId,
@@ -1007,448 +616,311 @@ function parseLinkedDevicePasskeyCreationOptionsV1(raw, expectedWalletAuthMethod
 		excludeCredentials: options.excludeCredentials
 	};
 }
-function parseLinkedDeviceEd25519ExportRootPreparationV1(raw) {
-	if (raw === null) return null;
-	const record = exactRecord(raw, [
-		"kind",
-		"walletKeyId",
-		"applicationBindingDigestB64u",
-		"registeredPublicKeyB64u",
-		"revocationEpoch"
-	], "LinkedDeviceTargetPreparationV1.ed25519ExportRoot");
-	if (record.kind !== "linked_device_ed25519_export_root_preparation_v1") throw new Error("LinkedDeviceTargetPreparationV1.ed25519ExportRoot.kind is invalid");
-	return {
-		kind: "linked_device_ed25519_export_root_preparation_v1",
-		walletKeyId: parseWalletKey(record.walletKeyId, "LinkedDeviceTargetPreparationV1.ed25519ExportRoot.walletKeyId"),
-		applicationBindingDigestB64u: parseDigest(record.applicationBindingDigestB64u, "LinkedDeviceTargetPreparationV1.ed25519ExportRoot.applicationBindingDigestB64u"),
-		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "LinkedDeviceTargetPreparationV1.ed25519ExportRoot.registeredPublicKeyB64u"),
-		revocationEpoch: parseNonNegativeSafeInteger(record.revocationEpoch, "LinkedDeviceTargetPreparationV1.ed25519ExportRoot.revocationEpoch")
-	};
+function ed25519ExportRootPreparationV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_ed25519_export_root_preparation_v1"),
+		walletKeyId,
+		applicationBindingDigestB64u: digest,
+		registeredPublicKeyB64u: parseEd25519PublicKeyB64u,
+		revocationEpoch: parseNonNegativeSafeInteger
+	});
 }
-function parseOrdinarySignerMaterialRecipientRequirementV1(raw, index) {
-	const label = `LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements[${index}]`;
-	const record = exactRecord(raw, [
-		"kind",
-		"keyFamily",
-		"walletKeyId"
-	], label);
-	if (record.kind !== "ordinary_signer_material_recipient_requirement_v1") throw new Error(`${label}.kind is invalid`);
-	return {
-		kind: "ordinary_signer_material_recipient_requirement_v1",
-		keyFamily: parseKeyFamily(record.keyFamily, `${label}.keyFamily`),
-		walletKeyId: parseId(parseWalletKeyId, record.walletKeyId, `${label}.walletKeyId`)
-	};
+function parseKeyFamilyEntries(raw, item, label) {
+	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 2) throw new Error(`${label} must contain one or two entries`);
+	const entries = raw.map((entry, index) => item(entry, `${label}[${index}]`));
+	if (new Set(entries.map((entry) => entry.keyFamily)).size !== entries.length) throw new Error(`${label} repeats a key family`);
+	if (new Set(entries.map((entry) => String(entry.walletKeyId))).size !== entries.length) throw new Error(`${label} repeats a wallet key`);
+	if (entries.length === 2 && (entries[0]?.keyFamily !== "ed25519" || entries[1]?.keyFamily !== "ecdsa_secp256k1")) throw new Error(`${label} must be ordered Ed25519 then ECDSA`);
+	return entries;
+}
+function recipientRequirementV1() {
+	return wireObject({
+		kind: wireLiteral("ordinary_signer_material_recipient_requirement_v1"),
+		keyFamily: parseKeyFamily,
+		walletKeyId
+	});
 }
-function parseOrdinarySignerMaterialRecipientRequirementsV1(raw) {
-	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 2) throw new Error("LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements must contain one or two entries");
-	const requirements = raw.map((entry, index) => parseOrdinarySignerMaterialRecipientRequirementV1(entry, index));
-	if (new Set(requirements.map((entry) => entry.keyFamily)).size !== requirements.length) throw new Error("LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements repeats a key family");
-	if (new Set(requirements.map((entry) => String(entry.walletKeyId))).size !== requirements.length) throw new Error("LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements repeats a wallet key");
-	if (requirements.length === 2 && (requirements[0]?.keyFamily !== "ed25519" || requirements[1]?.keyFamily !== "ecdsa_secp256k1")) throw new Error("LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements must be ordered Ed25519 then ECDSA");
+function parseRecipientRequirements(raw) {
+	const requirements = parseKeyFamilyEntries(raw, recipientRequirementV1(), "LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements");
 	const first = requirements[0];
 	if (!first) throw new Error("ordinary signer material recipient requirements are empty");
 	return [first, ...requirements.slice(1)];
 }
-function parseWebAuthnTransport(raw, label) {
-	switch (raw) {
-		case "ble":
-		case "cable":
-		case "hybrid":
-		case "internal":
-		case "nfc":
-		case "smart-card":
-		case "usb": return raw;
-		default: throw new Error(`${label} is invalid`);
-	}
+const webAuthnTransport = /* @__PURE__ */ wireLiteral("ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb");
+function parseWebAuthnTransports(raw, label) {
+	const transports = requireArray(raw, label).map((entry, index) => webAuthnTransport(entry, `${label}[${index}]`));
+	if (new Set(transports).size !== transports.length) throw new Error(`${label} contains duplicates`);
+	return transports;
+}
+function linkedDeviceWebAuthnRegistrationV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_webauthn_registration_v1"),
+		credentialIdB64u: parseCredential,
+		authenticatorAttachment: wireNullable(wireLiteral("platform", "cross-platform")),
+		clientDataJsonB64u: parseCanonicalBase64UrlBytes,
+		attestationObjectB64u: parseCanonicalBase64UrlBytes,
+		transports: parseWebAuthnTransports
+	});
 }
-function parseLinkedDeviceWebAuthnRegistrationV1(raw) {
-	const label = "LinkedDeviceTargetCredentialRegistrationV1.webauthnRegistration";
-	const record = exactRecord(raw, WEBAUTHN_REGISTRATION_FIELDS, label);
-	if (record.kind !== "linked_device_webauthn_registration_v1") throw new Error(`${label}.kind is invalid`);
-	if (!Array.isArray(record.transports)) throw new Error(`${label}.transports must be an array`);
-	if (record.authenticatorAttachment !== null && record.authenticatorAttachment !== "platform" && record.authenticatorAttachment !== "cross-platform") throw new Error(`${label}.authenticatorAttachment is invalid`);
-	const transports = record.transports.map((entry, index) => parseWebAuthnTransport(entry, `${label}.transports[${index}]`));
-	if (new Set(transports).size !== transports.length) throw new Error(`${label}.transports contains duplicates`);
-	return {
-		kind: "linked_device_webauthn_registration_v1",
-		credentialIdB64u: parseCredential(record.credentialIdB64u, `${label}.credentialIdB64u`),
-		authenticatorAttachment: record.authenticatorAttachment,
-		clientDataJsonB64u: parseCanonicalBase64UrlBytes(record.clientDataJsonB64u, `${label}.clientDataJsonB64u`),
-		attestationObjectB64u: parseCanonicalBase64UrlBytes(record.attestationObjectB64u, `${label}.attestationObjectB64u`),
-		transports
+function recipientRequestV1() {
+	const keyFamily = (family) => (raw, label) => {
+		if (raw !== family) throw new Error(`${label} does not match its kind`);
+		return family;
 	};
-}
-function parseOrdinarySignerMaterialPreparationsV1(raw) {
-	return parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1(raw);
-}
-function parseOrdinarySignerMaterialRecipientRequestV1(raw, index) {
-	const label = `LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests[${index}]`;
-	const record = requireRecord(raw, label);
-	if (record.kind === "ordinary_ed25519_signer_material_recipient_request_v1") {
-		exactRecord(record, [
-			"kind",
-			"keyFamily",
-			"walletKeyId",
-			"recipientPublicKeyB64u"
-		], label);
-		if (record.keyFamily !== "ed25519") throw new Error(`${label}.keyFamily does not match its kind`);
-		return {
-			kind: record.kind,
-			keyFamily: "ed25519",
-			walletKeyId: parseId(parseWalletKeyId, record.walletKeyId, `${label}.walletKeyId`),
-			recipientPublicKeyB64u: parseCanonicalFixedBase64UrlBytes(record.recipientPublicKeyB64u, 32, `${label}.recipientPublicKeyB64u`)
-		};
-	}
-	if (record.kind === "ordinary_ecdsa_signer_material_recipient_request_v1") {
-		exactRecord(record, [
-			"kind",
-			"keyFamily",
-			"walletKeyId",
-			"clientEphemeralPublicKey"
-		], label);
-		if (record.keyFamily !== "ecdsa_secp256k1") throw new Error(`${label}.keyFamily does not match its kind`);
-		return {
-			kind: record.kind,
-			keyFamily: "ecdsa_secp256k1",
-			walletKeyId: parseId(parseWalletKeyId, record.walletKeyId, `${label}.walletKeyId`),
-			clientEphemeralPublicKey: requireRouterAbX25519PublicKey(record.clientEphemeralPublicKey, `${label}.clientEphemeralPublicKey`)
-		};
-	}
-	throw new Error(`${label}.kind is invalid`);
-}
-function parseOrdinarySignerMaterialRecipientRequestsV1(raw) {
-	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 2) throw new Error("LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests must contain one or two entries");
-	const requests = raw.map((entry, index) => parseOrdinarySignerMaterialRecipientRequestV1(entry, index));
-	const families = requests.map((entry) => entry.keyFamily);
-	if (new Set(families).size !== families.length) throw new Error("LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests repeats a key family");
-	if (new Set(requests.map((entry) => String(entry.walletKeyId))).size !== requests.length) throw new Error("LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests repeats a wallet key");
-	if (requests.length === 2 && (requests[0]?.keyFamily !== "ed25519" || requests[1]?.keyFamily !== "ecdsa_secp256k1")) throw new Error("LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests must be ordered Ed25519 then ECDSA");
+	return wireUnion("kind", [wireObject({
+		kind: wireLiteral("ordinary_ed25519_signer_material_recipient_request_v1"),
+		keyFamily: keyFamily("ed25519"),
+		walletKeyId,
+		recipientPublicKeyB64u: (raw, label) => parseCanonicalFixedBase64UrlBytes(raw, 32, label)
+	}), wireObject({
+		kind: wireLiteral("ordinary_ecdsa_signer_material_recipient_request_v1"),
+		keyFamily: keyFamily("ecdsa_secp256k1"),
+		walletKeyId,
+		clientEphemeralPublicKey: requireRouterAbX25519PublicKey
+	})]);
+}
+function parseRecipientRequests(raw) {
+	const requests = parseKeyFamilyEntries(raw, recipientRequestV1(), "LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests");
 	const first = requests[0];
 	if (!first) throw new Error("ordinary signer material recipient requests are empty");
 	return [first, ...requests.slice(1)];
 }
-function parseLinkedDeviceTargetCredentialRegistrationV1(raw) {
-	const initial = requireRecord(raw, "LinkedDeviceTargetCredentialRegistrationV1");
-	const targetFactor = parseTargetFactor(initial.targetFactor, "LinkedDeviceTargetCredentialRegistrationV1.targetFactor");
-	const emailGrant = targetFactor.kind === "email_otp" ? parseLinkedDeviceEmailOtpVerificationGrantV1(initial.emailOtpVerificationGrant) : null;
-	const record = exactRecord(initial, targetFactor.kind === "passkey_prf" ? PASSKEY_CREDENTIAL_FIELDS : emailGrant?.enrollment.kind === "new_enrollment" ? EMAIL_OTP_CREDENTIAL_NEW_FIELDS : EMAIL_OTP_CREDENTIAL_FIELDS, "LinkedDeviceTargetCredentialRegistrationV1");
-	if (record.kind !== "linked_device_target_credential_registration_v1") throw new Error("LinkedDeviceTargetCredentialRegistrationV1.kind is invalid");
-	if (targetFactor.kind === "email_otp" && !emailGrant) throw new Error("Email OTP target credential grant is missing");
-	const linkSessionId = parseSessionId(record.linkSessionId, "LinkedDeviceTargetCredentialRegistrationV1.linkSessionId");
-	const walletId = parseWallet(record.walletId, "LinkedDeviceTargetCredentialRegistrationV1.walletId");
-	const enrollmentId = parseEnrollmentId(record.enrollmentId, "LinkedDeviceTargetCredentialRegistrationV1.enrollmentId");
-	const deviceId = parseDeviceId(record.deviceId, "LinkedDeviceTargetCredentialRegistrationV1.deviceId");
-	const walletAuthMethodId = parseWalletAuthMethodId(record.walletAuthMethodId);
-	if (!walletAuthMethodId.ok) throw new Error(`LinkedDeviceTargetCredentialRegistrationV1.walletAuthMethodId ${walletAuthMethodId.error.message}`);
-	const targetPreparationDigestB64u = parseDigest(record.targetPreparationDigestB64u, "LinkedDeviceTargetCredentialRegistrationV1.targetPreparationDigestB64u");
-	const ordinarySignerMaterialRecipientRequests = parseOrdinarySignerMaterialRecipientRequestsV1(record.ordinarySignerMaterialRecipientRequests);
-	const registeredAtMs = parseUnixTime(record.registeredAtMs, "LinkedDeviceTargetCredentialRegistrationV1.registeredAtMs");
-	if (targetFactor.kind === "passkey_prf") return {
-		kind: "linked_device_target_credential_registration_v1",
-		linkSessionId,
-		walletId,
-		enrollmentId,
-		deviceId,
-		walletAuthMethodId: walletAuthMethodId.value,
-		targetFactor,
-		targetPreparationDigestB64u,
-		ordinarySignerMaterialRecipientRequests,
-		webauthnRegistration: parseLinkedDeviceWebAuthnRegistrationV1(record.webauthnRegistration),
-		registeredAtMs
-	};
-	if (!emailGrant) throw new Error("Email OTP target credential grant is missing");
-	const targetEmail = parseTargetEmail(record.targetEmail, "LinkedDeviceTargetCredentialRegistrationV1.targetEmail");
-	if (emailGrant.enrollment.kind === "new_enrollment") return {
-		kind: "linked_device_target_credential_registration_v1",
-		linkSessionId,
-		walletId,
-		enrollmentId,
-		deviceId,
-		walletAuthMethodId: walletAuthMethodId.value,
-		targetFactor,
-		targetEmail,
-		targetPreparationDigestB64u,
-		ordinarySignerMaterialRecipientRequests,
-		emailOtpVerificationGrant: emailGrant,
-		emailOtpEnrollment: parseEmailOtpEnrollmentMaterial(record.emailOtpEnrollment, "LinkedDeviceTargetCredentialRegistrationV1.emailOtpEnrollment"),
-		registeredAtMs
-	};
+function targetCredentialRegistrationIdentity() {
 	return {
-		kind: "linked_device_target_credential_registration_v1",
-		linkSessionId,
+		kind: wireLiteral("linked_device_target_credential_registration_v1"),
+		linkSessionId: sessionId,
 		walletId,
 		enrollmentId,
-		deviceId,
-		walletAuthMethodId: walletAuthMethodId.value,
-		targetFactor,
-		targetEmail,
-		targetPreparationDigestB64u,
-		ordinarySignerMaterialRecipientRequests,
-		emailOtpVerificationGrant: emailGrant,
-		registeredAtMs
+		deviceId: linkedDeviceId,
+		walletAuthMethodId
 	};
 }
-function parseLinkedDeviceTargetCredentialRegistrationResultV1(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"outcome",
-		"linkSessionId",
-		"walletId",
-		"enrollmentId",
-		"deviceId",
-		"walletAuthMethodId",
-		"targetPreparationDigestB64u",
-		"targetFactor",
-		"ordinarySignerMaterialPreparations",
-		"ordinarySignerMaterialRecipientRequests",
-		"keyManifestDigestB64u"
-	], "LinkedDeviceTargetCredentialRegistrationResultV1");
-	if (record.kind !== "linked_device_target_credential_registration_result_v1") throw new Error("LinkedDeviceTargetCredentialRegistrationResultV1.kind is invalid");
-	if (record.outcome !== "applied" && record.outcome !== "replayed") throw new Error("LinkedDeviceTargetCredentialRegistrationResultV1.outcome is invalid");
-	const linkSessionId = parseSessionId(record.linkSessionId, "LinkedDeviceTargetCredentialRegistrationResultV1.linkSessionId");
-	const walletId = parseWallet(record.walletId, "LinkedDeviceTargetCredentialRegistrationResultV1.walletId");
-	const enrollmentId = parseEnrollmentId(record.enrollmentId, "LinkedDeviceTargetCredentialRegistrationResultV1.enrollmentId");
-	const deviceId = parseDeviceId(record.deviceId, "LinkedDeviceTargetCredentialRegistrationResultV1.deviceId");
-	const walletAuthMethodId = parseId(parseWalletAuthMethodId, record.walletAuthMethodId, "LinkedDeviceTargetCredentialRegistrationResultV1.walletAuthMethodId");
-	const targetPreparationDigestB64u = parseDigest(record.targetPreparationDigestB64u, "LinkedDeviceTargetCredentialRegistrationResultV1.targetPreparationDigestB64u");
-	const targetFactor = parseVerifiedTargetFactorV1(record.targetFactor, "LinkedDeviceTargetCredentialRegistrationResultV1.targetFactor");
-	if (targetFactor.authMethod.walletAuthMethodId !== walletAuthMethodId || targetFactor.authMethod.walletId !== walletId) throw new Error("LinkedDeviceTargetCredentialRegistrationResultV1 target identity differs");
-	const ordinarySignerMaterialPreparations = parseOrdinarySignerMaterialPreparationsV1(record.ordinarySignerMaterialPreparations);
-	const ordinarySignerMaterialRecipientRequests = parseOrdinarySignerMaterialRecipientRequestsV1(record.ordinarySignerMaterialRecipientRequests);
-	return {
-		kind: "linked_device_target_credential_registration_result_v1",
-		outcome: record.outcome,
-		linkSessionId,
+function passkeyTargetCredentialRegistrationV1() {
+	return wireObject({
+		...targetCredentialRegistrationIdentity(),
+		targetFactor: passkeyTargetFactorV1(),
+		targetPreparationDigestB64u: digest,
+		ordinarySignerMaterialRecipientRequests: parseRecipientRequests,
+		webauthnRegistration: linkedDeviceWebAuthnRegistrationV1(),
+		registeredAtMs: parseUnixTime
+	});
+}
+function emailOtpTargetCredentialRegistrationV1() {
+	return wireObject({
+		...targetCredentialRegistrationIdentity(),
+		targetFactor: emailOtpTargetFactorV1(),
+		targetEmail: parseTargetEmail,
+		targetPreparationDigestB64u: digest,
+		ordinarySignerMaterialRecipientRequests: parseRecipientRequests,
+		emailOtpVerificationGrant: parseLinkedDeviceEmailOtpVerificationGrantV1,
+		registeredAtMs: parseUnixTime
+	});
+}
+function newEmailOtpTargetCredentialRegistrationV1() {
+	return wireObject({
+		...targetCredentialRegistrationIdentity(),
+		targetFactor: emailOtpTargetFactorV1(),
+		targetEmail: parseTargetEmail,
+		targetPreparationDigestB64u: digest,
+		ordinarySignerMaterialRecipientRequests: parseRecipientRequests,
+		emailOtpVerificationGrant: parseLinkedDeviceEmailOtpVerificationGrantV1,
+		emailOtpEnrollment: emailOtpEnrollmentMaterialV1(),
+		registeredAtMs: parseUnixTime
+	});
+}
+function parseLinkedDeviceTargetCredentialRegistrationV1(raw) {
+	const label = "LinkedDeviceTargetCredentialRegistrationV1";
+	const record = requireRecord(raw, label);
+	if (parseTargetFactor(record.targetFactor, `${label}.targetFactor`).kind === "passkey_prf") return passkeyTargetCredentialRegistrationV1()(record, label);
+	return (parseLinkedDeviceEmailOtpVerificationGrantV1(record.emailOtpVerificationGrant).enrollment.kind === "new_enrollment" ? newEmailOtpTargetCredentialRegistrationV1() : emailOtpTargetCredentialRegistrationV1())(record, label);
+}
+function targetCredentialRegistrationResultV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_target_credential_registration_result_v1"),
+		outcome: wireLiteral("applied", "replayed"),
+		linkSessionId: sessionId,
 		walletId,
 		enrollmentId,
-		deviceId,
+		deviceId: linkedDeviceId,
 		walletAuthMethodId,
-		targetPreparationDigestB64u,
-		targetFactor,
-		ordinarySignerMaterialPreparations,
-		ordinarySignerMaterialRecipientRequests,
-		keyManifestDigestB64u: parseDigest(record.keyManifestDigestB64u, "LinkedDeviceTargetCredentialRegistrationResultV1.keyManifestDigestB64u")
-	};
+		targetPreparationDigestB64u: digest,
+		targetFactor: parseVerifiedTargetFactorV1,
+		ordinarySignerMaterialPreparations: parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1,
+		ordinarySignerMaterialRecipientRequests: parseRecipientRequests,
+		keyManifestDigestB64u: digest
+	}, (result, label) => {
+		const { authMethod } = result.targetFactor;
+		if (authMethod.walletAuthMethodId !== result.walletAuthMethodId || authMethod.walletId !== result.walletId) throw new Error(`${label} target identity differs`);
+	});
+}
+function parseLinkedDeviceTargetCredentialRegistrationResultV1(raw) {
+	return targetCredentialRegistrationResultV1()(raw, "LinkedDeviceTargetCredentialRegistrationResultV1");
+}
+function verifiedAfterCreation(target, label) {
+	if (target.verifiedAtMs < target.authMethod.createdAtMs) throw new Error(`${label}.verifiedAtMs precedes authMethod.createdAtMs`);
+}
+function verifiedPasskeyTargetV1() {
+	return wireObject({
+		kind: wireLiteral("verified_passkey_target_v1"),
+		authMethod: parsePasskeyWalletAuthMethodDraftV1,
+		verificationDigestB64u: digest,
+		verifiedAtMs: parseUnixTime
+	}, verifiedAfterCreation);
+}
+function verifiedEmailOtpTargetV1() {
+	return wireObject({
+		kind: wireLiteral("verified_email_otp_target_v1"),
+		authMethod: parseEmailOtpWalletAuthMethodDraftV1,
+		targetEmail: parseTargetEmail,
+		enrollment: existingEnrollmentV1(),
+		baseWalletAuthMethodId: walletAuthMethodId,
+		providerUserId: parseNonEmptyToken,
+		verificationDigestB64u: digest,
+		verifiedAtMs: parseUnixTime
+	}, verifiedAfterCreation);
+}
+function verifiedNewEmailOtpTargetV1() {
+	return wireObject({
+		kind: wireLiteral("verified_email_otp_target_v1"),
+		authMethod: parseEmailOtpWalletAuthMethodDraftV1,
+		targetEmail: parseTargetEmail,
+		enrollment: newEnrollmentV1(),
+		providerUserId: parseNonEmptyToken,
+		verificationDigestB64u: digest,
+		verifiedAtMs: parseUnixTime
+	}, verifiedAfterCreation);
 }
 function parseVerifiedTargetFactorV1(raw, label) {
 	const record = requireRecord(raw, label);
-	if (record.kind === "verified_passkey_target_v1") {
-		exactRecord(record, [
-			"kind",
-			"authMethod",
-			"verificationDigestB64u",
-			"verifiedAtMs"
-		], label);
-		const authMethod = parsePasskeyWalletAuthMethodDraftV1(record.authMethod, `${label}.authMethod`);
-		const verifiedAtMs = parseUnixTime(record.verifiedAtMs, `${label}.verifiedAtMs`);
-		if (verifiedAtMs < authMethod.createdAtMs) throw new Error(`${label}.verifiedAtMs precedes authMethod.createdAtMs`);
-		return {
-			kind: "verified_passkey_target_v1",
-			authMethod,
-			verificationDigestB64u: parseDigest(record.verificationDigestB64u, `${label}.verificationDigestB64u`),
-			verifiedAtMs
-		};
-	}
-	if (record.kind === "verified_email_otp_target_v1") {
-		const enrollment = parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`);
-		const exact = exactRecord(record, enrollment.kind === "existing_enrollment" ? [
-			"kind",
-			"authMethod",
-			"targetEmail",
-			"enrollment",
-			"baseWalletAuthMethodId",
-			"providerUserId",
-			"verificationDigestB64u",
-			"verifiedAtMs"
-		] : [
-			"kind",
-			"authMethod",
-			"targetEmail",
-			"enrollment",
-			"providerUserId",
-			"verificationDigestB64u",
-			"verifiedAtMs"
-		], label);
-		const authMethod = parseEmailOtpWalletAuthMethodDraftV1(record.authMethod, `${label}.authMethod`);
-		const verifiedAtMs = parseUnixTime(record.verifiedAtMs, `${label}.verifiedAtMs`);
-		if (verifiedAtMs < authMethod.createdAtMs) throw new Error(`${label}.verifiedAtMs precedes authMethod.createdAtMs`);
-		const targetEmail = parseTargetEmail(record.targetEmail, `${label}.targetEmail`);
-		const providerUserId = parseNonEmptyToken(record.providerUserId, `${label}.providerUserId`);
-		const verificationDigestB64u = parseDigest(record.verificationDigestB64u, `${label}.verificationDigestB64u`);
-		if (enrollment.kind === "existing_enrollment") return {
-			kind: "verified_email_otp_target_v1",
-			authMethod,
-			targetEmail,
-			enrollment,
-			baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, exact.baseWalletAuthMethodId, `${label}.baseWalletAuthMethodId`),
-			providerUserId,
-			verificationDigestB64u,
-			verifiedAtMs
-		};
-		return {
-			kind: "verified_email_otp_target_v1",
-			authMethod,
-			targetEmail,
-			enrollment,
-			providerUserId,
-			verificationDigestB64u,
-			verifiedAtMs
-		};
-	}
-	throw new Error(`${label}.kind is invalid`);
+	if (record.kind === "verified_passkey_target_v1") return verifiedPasskeyTargetV1()(record, label);
+	if (record.kind !== "verified_email_otp_target_v1") throw new Error(`${label}.kind is invalid`);
+	return (parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`).kind === "existing_enrollment" ? verifiedEmailOtpTargetV1() : verifiedNewEmailOtpTargetV1())(record, label);
+}
+function passkeyWalletAuthMethodDraftV1() {
+	return wireObject({
+		walletAuthMethodId,
+		walletId,
+		createdAtMs: parseUnixTime,
+		kind: wireLiteral("passkey"),
+		rpId,
+		credentialIdB64u: credentialId,
+		credentialPublicKeyB64u: parseCanonicalBase64UrlBytes,
+		counter: parseNonNegativeSafeInteger
+	});
 }
 function parsePasskeyWalletAuthMethodDraftV1(raw, label) {
-	const record = exactRecord(raw, [
-		"walletAuthMethodId",
-		"walletId",
-		"createdAtMs",
-		"kind",
-		"rpId",
-		"credentialIdB64u",
-		"credentialPublicKeyB64u",
-		"counter"
-	], label);
-	if (record.kind !== "passkey") throw new Error(`${label}.kind is invalid`);
-	return {
-		walletAuthMethodId: parseId(parseWalletAuthMethodId, record.walletAuthMethodId, `${label}.walletAuthMethodId`),
-		walletId: parseWallet(record.walletId, `${label}.walletId`),
-		createdAtMs: parseUnixTime(record.createdAtMs, `${label}.createdAtMs`),
-		kind: "passkey",
-		rpId: parseId(parseWebAuthnRpId, record.rpId, `${label}.rpId`),
-		credentialIdB64u: parseId(parseWebAuthnCredentialIdB64u, record.credentialIdB64u, `${label}.credentialIdB64u`),
-		credentialPublicKeyB64u: parseCanonicalBase64UrlBytes(record.credentialPublicKeyB64u, `${label}.credentialPublicKeyB64u`),
-		counter: parseNonNegativeInteger(record.counter, `${label}.counter`)
-	};
+	return passkeyWalletAuthMethodDraftV1()(raw, label);
+}
+function emailOtpWalletAuthMethodDraftV1() {
+	return wireObject({
+		walletAuthMethodId,
+		walletId,
+		createdAtMs: parseUnixTime,
+		kind: wireLiteral("email_otp"),
+		emailHashHex: parseEmailHashHex,
+		registrationAuthorityId: parseNonEmptyToken
+	});
 }
 function parseEmailOtpWalletAuthMethodDraftV1(raw, label) {
-	const record = exactRecord(raw, [
-		"walletAuthMethodId",
-		"walletId",
-		"createdAtMs",
-		"kind",
-		"emailHashHex",
-		"registrationAuthorityId"
-	], label);
-	if (record.kind !== "email_otp") throw new Error(`${label}.kind is invalid`);
+	return emailOtpWalletAuthMethodDraftV1()(raw, label);
+}
+function emailOtpVerificationGrantFields(enrollment) {
 	return {
-		walletAuthMethodId: parseId(parseWalletAuthMethodId, record.walletAuthMethodId, `${label}.walletAuthMethodId`),
-		walletId: parseWallet(record.walletId, `${label}.walletId`),
-		createdAtMs: parseUnixTime(record.createdAtMs, `${label}.createdAtMs`),
-		kind: "email_otp",
-		emailHashHex: parseEmailHashHex(record.emailHashHex, `${label}.emailHashHex`),
-		registrationAuthorityId: parseNonEmptyToken(record.registrationAuthorityId, `${label}.registrationAuthorityId`)
+		kind: wireLiteral("linked_device_email_otp_verification_grant_v1"),
+		grantId: parseNonEmptyToken,
+		grantToken: parseNonEmptyToken,
+		challengeId: parseNonEmptyToken,
+		linkSessionId: sessionId,
+		walletId,
+		enrollmentId,
+		deviceId: linkedDeviceId,
+		targetPreparationDigestB64u: digest,
+		targetEmail: parseTargetEmail,
+		enrollment,
+		emailHashHex: parseEmailHashHex,
+		registrationAuthorityId: parseNonEmptyToken,
+		providerUserId: parseNonEmptyToken,
+		authorityDigestB64u: digest,
+		issuedAtMs: parseUnixTime,
+		expiresAtMs: parseUnixTime
 	};
 }
+function grantIssuedBeforeExpiry(grant, label) {
+	assertExpiryAfterIssued(grant.issuedAtMs, grant.expiresAtMs, label);
+}
+function emailOtpVerificationGrantV1() {
+	return wireObject({
+		...emailOtpVerificationGrantFields(existingEnrollmentV1()),
+		baseWalletAuthMethodId: walletAuthMethodId
+	}, grantIssuedBeforeExpiry);
+}
+function newEnrollmentEmailOtpVerificationGrantV1() {
+	return wireObject(emailOtpVerificationGrantFields(newEnrollmentV1()), grantIssuedBeforeExpiry);
+}
 function parseLinkedDeviceEmailOtpVerificationGrantV1(raw) {
-	const candidate = requireRecord(raw, "LinkedDeviceEmailOtpVerificationGrantV1");
-	const enrollment = parseEmailOtpEnrollmentSelection(candidate.enrollment, "LinkedDeviceEmailOtpVerificationGrantV1.enrollment");
-	const record = exactRecord(candidate, enrollment.kind === "new_enrollment" ? EMAIL_OTP_VERIFICATION_GRANT_BASE_FIELDS : EMAIL_OTP_VERIFICATION_GRANT_FIELDS, "LinkedDeviceEmailOtpVerificationGrantV1");
-	if (record.kind !== "linked_device_email_otp_verification_grant_v1") throw new Error("LinkedDeviceEmailOtpVerificationGrantV1.kind is invalid");
-	const issuedAtMs = parseUnixTime(record.issuedAtMs, "LinkedDeviceEmailOtpVerificationGrantV1.issuedAtMs");
-	const expiresAtMs = parseUnixTime(record.expiresAtMs, "LinkedDeviceEmailOtpVerificationGrantV1.expiresAtMs");
-	assertExpiryAfterIssued(issuedAtMs, expiresAtMs, "LinkedDeviceEmailOtpVerificationGrantV1");
-	const base = {
-		kind: "linked_device_email_otp_verification_grant_v1",
-		grantId: parseNonEmptyToken(record.grantId, "LinkedDeviceEmailOtpVerificationGrantV1.grantId"),
-		grantToken: parseNonEmptyToken(record.grantToken, "LinkedDeviceEmailOtpVerificationGrantV1.grantToken"),
-		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpVerificationGrantV1.challengeId"),
-		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "LinkedDeviceEmailOtpVerificationGrantV1.linkSessionId"),
-		walletId: parseId(parseWalletId, record.walletId, "LinkedDeviceEmailOtpVerificationGrantV1.walletId"),
-		enrollmentId: parseId(parseLinkedDeviceEnrollmentId, record.enrollmentId, "LinkedDeviceEmailOtpVerificationGrantV1.enrollmentId"),
-		deviceId: parseId(parseLinkedDeviceId, record.deviceId, "LinkedDeviceEmailOtpVerificationGrantV1.deviceId"),
-		targetPreparationDigestB64u: parseDigest(record.targetPreparationDigestB64u, "LinkedDeviceEmailOtpVerificationGrantV1.targetPreparationDigestB64u"),
-		targetEmail: parseTargetEmail(record.targetEmail, "LinkedDeviceEmailOtpVerificationGrantV1.targetEmail"),
-		enrollment,
-		emailHashHex: parseEmailHashHex(record.emailHashHex, "LinkedDeviceEmailOtpVerificationGrantV1.emailHashHex"),
-		registrationAuthorityId: parseNonEmptyToken(record.registrationAuthorityId, "LinkedDeviceEmailOtpVerificationGrantV1.registrationAuthorityId"),
-		providerUserId: parseNonEmptyToken(record.providerUserId, "LinkedDeviceEmailOtpVerificationGrantV1.providerUserId"),
-		authorityDigestB64u: parseDigest(record.authorityDigestB64u, "LinkedDeviceEmailOtpVerificationGrantV1.authorityDigestB64u"),
-		issuedAtMs,
-		expiresAtMs
-	};
-	if (enrollment.kind === "new_enrollment") return {
-		...base,
-		enrollment: { kind: "new_enrollment" }
-	};
-	return {
-		...base,
-		enrollment: { kind: "existing_enrollment" },
-		baseWalletAuthMethodId: parseId(parseWalletAuthMethodId, record.baseWalletAuthMethodId, "LinkedDeviceEmailOtpVerificationGrantV1.baseWalletAuthMethodId")
-	};
+	const label = "LinkedDeviceEmailOtpVerificationGrantV1";
+	const record = requireRecord(raw, label);
+	return (parseEmailOtpEnrollmentSelection(record.enrollment, `${label}.enrollment`).kind === "new_enrollment" ? newEnrollmentEmailOtpVerificationGrantV1() : emailOtpVerificationGrantV1())(record, label);
+}
+function emailOtpFactorReleaseEnvelopeV1() {
+	return wireObject({
+		kind: wireLiteral("email_otp_factor_release_v1"),
+		challengeId: parseNonEmptyToken,
+		enrollmentId: parseNonEmptyToken,
+		enrollmentSealKeyVersion: parseNonEmptyToken,
+		serverEphemeralPublicKey65B64u: parseUncompressedP256PointB64u,
+		nonce12B64u: (raw, label) => parseCanonicalFixedBase64UrlBytes(raw, 12, label),
+		ciphertextB64u: parseCanonicalBase64UrlBytes
+	});
 }
 function parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1(raw) {
-	const record = exactRecord(raw, EMAIL_OTP_FACTOR_RELEASE_FIELDS, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1");
-	if (record.kind !== "email_otp_factor_release_v1") throw new Error("LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.kind is invalid");
-	return {
-		kind: "email_otp_factor_release_v1",
-		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.challengeId"),
-		enrollmentId: parseNonEmptyToken(record.enrollmentId, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.enrollmentId"),
-		enrollmentSealKeyVersion: parseNonEmptyToken(record.enrollmentSealKeyVersion, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.enrollmentSealKeyVersion"),
-		serverEphemeralPublicKey65B64u: parseUncompressedP256PointB64u(record.serverEphemeralPublicKey65B64u, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.serverEphemeralPublicKey65B64u"),
-		nonce12B64u: parseCanonicalFixedBase64UrlBytes(record.nonce12B64u, 12, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.nonce12B64u"),
-		ciphertextB64u: parseCanonicalBase64UrlBytes(record.ciphertextB64u, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1.ciphertextB64u")
-	};
+	return emailOtpFactorReleaseEnvelopeV1()(raw, "LinkedDeviceEmailOtpFactorReleaseEnvelopeV1");
+}
+function emailOtpChallengeStartRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_email_otp_challenge_start_request_v1"),
+		linkSessionId: sessionId,
+		workerEphemeralPublicKey65B64u: parseUncompressedP256PointB64u
+	});
 }
 function parseLinkedDeviceEmailOtpChallengeStartRequestV1(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"linkSessionId",
-		"workerEphemeralPublicKey65B64u"
-	], "LinkedDeviceEmailOtpChallengeStartRequestV1");
-	if (record.kind !== "linked_device_email_otp_challenge_start_request_v1") throw new Error("LinkedDeviceEmailOtpChallengeStartRequestV1.kind is invalid");
-	return {
-		kind: "linked_device_email_otp_challenge_start_request_v1",
-		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "LinkedDeviceEmailOtpChallengeStartRequestV1.linkSessionId"),
-		workerEphemeralPublicKey65B64u: parseUncompressedP256PointB64u(record.workerEphemeralPublicKey65B64u, "LinkedDeviceEmailOtpChallengeStartRequestV1.workerEphemeralPublicKey65B64u")
-	};
+	return emailOtpChallengeStartRequestV1()(raw, "LinkedDeviceEmailOtpChallengeStartRequestV1");
+}
+function emailOtpChallengeResendRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_email_otp_challenge_resend_request_v1"),
+		linkSessionId: sessionId,
+		challengeId: parseNonEmptyToken
+	});
 }
 function parseLinkedDeviceEmailOtpChallengeResendRequestV1(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"linkSessionId",
-		"challengeId"
-	], "LinkedDeviceEmailOtpChallengeResendRequestV1");
-	if (record.kind !== "linked_device_email_otp_challenge_resend_request_v1") throw new Error("LinkedDeviceEmailOtpChallengeResendRequestV1.kind is invalid");
-	return {
-		kind: "linked_device_email_otp_challenge_resend_request_v1",
-		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "LinkedDeviceEmailOtpChallengeResendRequestV1.linkSessionId"),
-		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpChallengeResendRequestV1.challengeId")
-	};
+	return emailOtpChallengeResendRequestV1()(raw, "LinkedDeviceEmailOtpChallengeResendRequestV1");
+}
+function emailOtpChallengeVerifyRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_email_otp_challenge_verify_request_v1"),
+		linkSessionId: sessionId,
+		challengeId: parseNonEmptyToken,
+		otpCode: (raw, label) => {
+			if (typeof raw !== "string" || !/^[0-9]{6,10}$/.test(raw)) throw new Error(`${label} is invalid`);
+			return raw;
+		}
+	});
 }
 function parseLinkedDeviceEmailOtpChallengeVerifyRequestV1(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"linkSessionId",
-		"challengeId",
-		"otpCode"
-	], "LinkedDeviceEmailOtpChallengeVerifyRequestV1");
-	if (record.kind !== "linked_device_email_otp_challenge_verify_request_v1") throw new Error("LinkedDeviceEmailOtpChallengeVerifyRequestV1.kind is invalid");
-	if (typeof record.otpCode !== "string" || !/^[0-9]{6,10}$/.test(record.otpCode)) throw new Error("LinkedDeviceEmailOtpChallengeVerifyRequestV1.otpCode is invalid");
-	return {
-		kind: "linked_device_email_otp_challenge_verify_request_v1",
-		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "LinkedDeviceEmailOtpChallengeVerifyRequestV1.linkSessionId"),
-		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpChallengeVerifyRequestV1.challengeId"),
-		otpCode: record.otpCode
-	};
+	return emailOtpChallengeVerifyRequestV1()(raw, "LinkedDeviceEmailOtpChallengeVerifyRequestV1");
+}
+function emailOtpChallengeResultV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_email_otp_challenge_result_v1"),
+		challengeId: parseNonEmptyToken,
+		maskedEmailHint: parseNonEmptyToken,
+		expiresAtMs: parseUnixTime,
+		resendAvailableAtMs: parseUnixTime
+	});
 }
 function parseLinkedDeviceEmailOtpChallengeResultV1(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"challengeId",
-		"maskedEmailHint",
-		"expiresAtMs",
-		"resendAvailableAtMs"
-	], "LinkedDeviceEmailOtpChallengeResultV1");
-	if (record.kind !== "linked_device_email_otp_challenge_result_v1") throw new Error("LinkedDeviceEmailOtpChallengeResultV1.kind is invalid");
-	const expiresAtMs = parseUnixTime(record.expiresAtMs, "LinkedDeviceEmailOtpChallengeResultV1.expiresAtMs");
-	const resendAvailableAtMs = parseUnixTime(record.resendAvailableAtMs, "LinkedDeviceEmailOtpChallengeResultV1.resendAvailableAtMs");
-	return {
-		kind: "linked_device_email_otp_challenge_result_v1",
-		challengeId: parseNonEmptyToken(record.challengeId, "LinkedDeviceEmailOtpChallengeResultV1.challengeId"),
-		maskedEmailHint: parseNonEmptyToken(record.maskedEmailHint, "LinkedDeviceEmailOtpChallengeResultV1.maskedEmailHint"),
-		expiresAtMs,
-		resendAvailableAtMs
-	};
+	return emailOtpChallengeResultV1()(raw, "LinkedDeviceEmailOtpChallengeResultV1");
 }
 function parseLinkedDeviceEmailOtpVerificationResultV1(raw) {
 	const record = exactRecord(raw, [
@@ -1551,241 +1023,7 @@ function buildLinkedDeviceSessionCancelClaimedRequestV1(args) {
 		requestedAtMs: parseUnixTime(args.requestedAtMs, "LinkedDeviceSessionCancelClaimedRequestV1.requestedAtMs")
 	};
 }
-const LOCAL_AUTHORITY_INSTALLATION_RECEIPT_FIELDS = [
-	"kind",
-	"authorityId",
-	"walletId",
-	"authMethodId",
-	"deviceId",
-	"packageSetDigestB64u",
-	"installedActivationRefs",
-	"installedRecordSetDigestB64u",
-	"targetFactorVerificationDigestB64u",
-	"installedAtMs"
-];
-function parseLocalAuthorityInstallationReceiptV1(raw) {
-	const record = exactRecord(raw, LOCAL_AUTHORITY_INSTALLATION_RECEIPT_FIELDS, "LocalAuthorityInstallationReceiptV1");
-	if (record.kind !== "local_authority_installation_receipt_v1") throw new Error("LocalAuthorityInstallationReceiptV1.kind is invalid");
-	const installedActivationResult = parseWalletSignerActivationSetV1(record.installedActivationRefs);
-	if (!installedActivationResult.ok) throw new Error(`LocalAuthorityInstallationReceiptV1.installedActivationRefs ${installedActivationResult.error}`);
-	return {
-		kind: "local_authority_installation_receipt_v1",
-		authorityId: parseId(parseWalletAuthorityId, record.authorityId, "authorityId"),
-		walletId: parseId(parseWalletId, record.walletId, "walletId"),
-		authMethodId: parseId(parseWalletAuthMethodId, record.authMethodId, "authMethodId"),
-		deviceId: parseId(parseDeviceId$1, record.deviceId, "deviceId"),
-		packageSetDigestB64u: parseDigest(record.packageSetDigestB64u, "packageSetDigestB64u"),
-		installedActivationRefs: installedActivationResult.value,
-		installedRecordSetDigestB64u: parseDigest(record.installedRecordSetDigestB64u, "installedRecordSetDigestB64u"),
-		targetFactorVerificationDigestB64u: parseDigest(record.targetFactorVerificationDigestB64u, "targetFactorVerificationDigestB64u"),
-		installedAtMs: parseUnixTime(record.installedAtMs, "installedAtMs")
-	};
-}
-const ACTIVE_WALLET_SESSION_FIELDS = [
-	"kind",
-	"walletId",
-	"authorityId",
-	"authMethodId",
-	"authorizationId",
-	"quotaId",
-	"authorityDigestB64u",
-	"authorityRevocationEpoch",
-	"capabilitySubjects",
-	"issuedAtMs",
-	"expiresAtMs"
-];
-const WALLET_SESSION_OPERATION_CREDENTIAL_FIELDS = [
-	"kind",
-	"token",
-	"walletSessionId"
-];
-function parseWalletSessionOperationCredentialV1(raw) {
-	const record = exactRecord(raw, WALLET_SESSION_OPERATION_CREDENTIAL_FIELDS, "WalletSessionOperationCredentialV1");
-	if (typeof record.token !== "string" || record.token.length > 8192) throw new Error("WalletSessionOperationCredentialV1.token is invalid");
-	if (record.kind === "opaque_wallet_session_operation_credential_v1") {
-		if (!/^wst_[A-Za-z0-9_-]{43}$/.test(record.token)) throw new Error("WalletSessionOperationCredentialV1 opaque token is invalid");
-		return {
-			kind: record.kind,
-			token: record.token,
-			walletSessionId: parseId(parseWalletSessionId, record.walletSessionId, "walletSessionId")
-		};
-	}
-	throw new Error("WalletSessionOperationCredentialV1.kind is invalid");
-}
-function parseActiveWalletSessionV1(raw) {
-	const record = exactRecord(raw, ACTIVE_WALLET_SESSION_FIELDS, "ActiveWalletSessionV1");
-	if (record.kind !== "active_wallet_session_v1") throw new Error("ActiveWalletSessionV1.kind is invalid");
-	if (!Array.isArray(record.capabilitySubjects) || record.capabilitySubjects.length === 0) throw new Error("ActiveWalletSessionV1.capabilitySubjects must be non-empty");
-	const capabilitySubjects = [];
-	const subjectKeys = /* @__PURE__ */ new Set();
-	for (const [index, rawSubject] of record.capabilitySubjects.entries()) {
-		const subject = parseWalletCapabilitySubjectV1(rawSubject, `capabilitySubjects[${index}]`);
-		const key = subject.kind === "sign" || subject.kind === "export_keys" ? `${subject.kind}:${subject.keyFamily}:${subject.materialActivation.activationId}` : subject.kind;
-		if (subjectKeys.has(key)) throw new Error("ActiveWalletSessionV1 capability subjects repeat");
-		subjectKeys.add(key);
-		capabilitySubjects.push(subject);
-	}
-	const first = capabilitySubjects[0];
-	if (!first) throw new Error("ActiveWalletSessionV1.capabilitySubjects must be non-empty");
-	return {
-		kind: "active_wallet_session_v1",
-		walletId: parseId(parseWalletId, record.walletId, "walletId"),
-		authorityId: parseId(parseWalletAuthorityId, record.authorityId, "authorityId"),
-		authMethodId: parseId(parseWalletAuthMethodId, record.authMethodId, "authMethodId"),
-		authorizationId: parseId(parseWalletSessionAuthorizationId, record.authorizationId, "authorizationId"),
-		quotaId: parseId(parseMpcWalletSigningQuotaId, record.quotaId, "quotaId"),
-		authorityDigestB64u: parseDigest(record.authorityDigestB64u, "authorityDigestB64u"),
-		authorityRevocationEpoch: parseNonNegativeInteger(record.authorityRevocationEpoch, "authorityRevocationEpoch"),
-		capabilitySubjects: [first, ...capabilitySubjects.slice(1)],
-		issuedAtMs: parseUnixTime(record.issuedAtMs, "issuedAtMs"),
-		expiresAtMs: parseUnixTime(record.expiresAtMs, "expiresAtMs")
-	};
-}
-function parseWalletCapabilitySubjectV1(raw, label) {
-	const record = requireRecord(raw, label);
-	if (record.kind === "link_devices" || record.kind === "revoke_devices") {
-		rejectUnknownFields(record, ["kind"], label);
-		return { kind: record.kind };
-	}
-	if (record.kind !== "sign" && record.kind !== "export_keys") throw new Error(`${label}.kind is invalid`);
-	rejectUnknownFields(record, [
-		"kind",
-		"keyFamily",
-		"materialActivation"
-	], label);
-	if (record.keyFamily !== "ed25519" && record.keyFamily !== "ecdsa_secp256k1") throw new Error(`${label}.keyFamily is invalid`);
-	return {
-		kind: record.kind,
-		keyFamily: record.keyFamily,
-		materialActivation: parseId(parseMpcMaterialActivationRef, record.materialActivation, `${label}.materialActivation`)
-	};
-}
-function parseNonNegativeInteger(raw, label) {
-	if (!Number.isSafeInteger(raw) || Number(raw) < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	return Number(raw);
-}
-const LOCAL_AUTHORITY_ACTIVATION_FINAL_ACK_FIELDS = [
-	"kind",
-	"linkSessionId",
-	"authorityId",
-	"packageSetDigestB64u",
-	"authorizationId",
-	"walletSessionId",
-	"credentialDigestB64u",
-	"installationReceiptDigestB64u",
-	"acknowledgedAtMs"
-];
-function parseLocalAuthorityActivationFinalAckV1(raw) {
-	const record = exactRecord(raw, LOCAL_AUTHORITY_ACTIVATION_FINAL_ACK_FIELDS, "LocalAuthorityActivationFinalAckV1");
-	if (record.kind !== "local_authority_activation_final_ack_v1") throw new Error("LocalAuthorityActivationFinalAckV1.kind is invalid");
-	return {
-		kind: "local_authority_activation_final_ack_v1",
-		linkSessionId: parseId(parseLinkDeviceSessionId, record.linkSessionId, "linkSessionId"),
-		authorityId: parseId(parseWalletAuthorityId, record.authorityId, "authorityId"),
-		packageSetDigestB64u: parseDigest(record.packageSetDigestB64u, "packageSetDigestB64u"),
-		authorizationId: parseId(parseWalletSessionAuthorizationId, record.authorizationId, "authorizationId"),
-		walletSessionId: parseId(parseWalletSessionId, record.walletSessionId, "walletSessionId"),
-		credentialDigestB64u: parseDigest(record.credentialDigestB64u, "credentialDigestB64u"),
-		installationReceiptDigestB64u: parseDigest(record.installationReceiptDigestB64u, "installationReceiptDigestB64u"),
-		acknowledgedAtMs: parseUnixTime(record.acknowledgedAtMs, "acknowledgedAtMs")
-	};
-}
-function parseActivateInstalledAuthorityResultV1(raw) {
-	const record = requireRecord(raw, "ActivateInstalledAuthorityResultV1");
-	switch (record.kind) {
-		case "active": {
-			rejectUnknownFields(record, [
-				"kind",
-				"authority",
-				"authMethod",
-				"walletSession",
-				"deliveryBinding",
-				"sealedDelivery"
-			], "ActivateInstalledAuthorityResultV1");
-			const authorityResult = parseWalletAuthorityV1(record.authority);
-			if (!authorityResult.ok || authorityResult.value.state !== "active") throw new Error("ActivateInstalledAuthorityResultV1.authority must be active");
-			const authMethod = parseWalletAuthMethodRecordV2(record.authMethod);
-			if (!authMethod || authMethod.status !== "active") throw new Error("ActivateInstalledAuthorityResultV1.authMethod must be active");
-			const walletSession = parseActiveWalletSessionV1(record.walletSession);
-			const deliveryBinding = parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1(record.deliveryBinding);
-			const sealedDelivery = parseLinkedDeviceWalletSessionCredentialDeliveryV1(record.sealedDelivery);
-			if (authorityResult.value.walletId !== authMethod.walletId || authorityResult.value.authorityId !== authMethod.walletAuthorityId || walletSession.walletId !== authorityResult.value.walletId || walletSession.authorityId !== authorityResult.value.authorityId || walletSession.authMethodId !== authMethod.walletAuthMethodId || walletSession.authorityDigestB64u !== authorityResult.value.authorityDigestB64u || walletSession.authorityRevocationEpoch !== authorityResult.value.revocationEpoch || deliveryBinding.namespace !== sealedDelivery.aad.namespace || deliveryBinding.orgId !== sealedDelivery.aad.orgId || deliveryBinding.projectId !== sealedDelivery.aad.projectId || deliveryBinding.envId !== sealedDelivery.aad.envId || deliveryBinding.tenantId !== sealedDelivery.aad.tenantId || deliveryBinding.principalId !== sealedDelivery.aad.principalId || sealedDelivery.aad.walletId !== walletSession.walletId || sealedDelivery.aad.authorityId !== walletSession.authorityId || sealedDelivery.aad.walletAuthMethodId !== walletSession.authMethodId || sealedDelivery.aad.authorizationId !== walletSession.authorizationId || sealedDelivery.aad.quotaId !== walletSession.quotaId || sealedDelivery.aad.issuedAtMs !== walletSession.issuedAtMs || sealedDelivery.aad.expiresAtMs !== walletSession.expiresAtMs) throw new Error("ActivateInstalledAuthorityResultV1 identities do not match");
-			return {
-				kind: "active",
-				authority: authorityResult.value,
-				authMethod,
-				walletSession,
-				deliveryBinding,
-				sealedDelivery
-			};
-		}
-		case "pending_local_install":
-			rejectUnknownFields(record, [
-				"kind",
-				"authorityId",
-				"reason"
-			], "ActivateInstalledAuthorityResultV1");
-			return {
-				kind: "pending_local_install",
-				authorityId: parseId(parseWalletAuthorityId, record.authorityId, "authorityId"),
-				reason: parseActivationRetryReasonV1(record.reason)
-			};
-		case "integrity_error":
-			rejectUnknownFields(record, ["kind", "reason"], "ActivateInstalledAuthorityResultV1");
-			return {
-				kind: "integrity_error",
-				reason: parseLinkIntegrityFailureV1(record.reason)
-			};
-		default: throw new Error("ActivateInstalledAuthorityResultV1.kind is invalid");
-	}
-}
-function parseActivationRetryReasonV1(raw) {
-	const record = requireRecord(raw, "ActivationRetryReasonV1");
-	switch (record.kind) {
-		case "installation_receipt_not_found":
-		case "server_worker_activation_pending":
-		case "wallet_session_issuance_pending":
-			rejectUnknownFields(record, ["kind"], "ActivationRetryReasonV1");
-			return { kind: record.kind };
-		default: throw new Error("ActivationRetryReasonV1.kind is invalid");
-	}
-}
-function parseLinkIntegrityFailureV1(raw) {
-	const record = requireRecord(raw, "LinkIntegrityFailureV1");
-	switch (record.kind) {
-		case "authority_id_mismatch":
-			rejectUnknownFields(record, [
-				"kind",
-				"expectedAuthorityId",
-				"actualAuthorityId"
-			], "LinkIntegrityFailureV1");
-			return {
-				kind: "authority_id_mismatch",
-				expectedAuthorityId: parseId(parseWalletAuthorityId, record.expectedAuthorityId, "expectedAuthorityId"),
-				actualAuthorityId: parseId(parseWalletAuthorityId, record.actualAuthorityId, "actualAuthorityId")
-			};
-		case "package_set_digest_mismatch":
-			rejectUnknownFields(record, [
-				"kind",
-				"expectedPackageSetDigestB64u",
-				"actualPackageSetDigestB64u"
-			], "LinkIntegrityFailureV1");
-			return {
-				kind: "package_set_digest_mismatch",
-				expectedPackageSetDigestB64u: parseDigest(record.expectedPackageSetDigestB64u, "expectedPackageSetDigestB64u"),
-				actualPackageSetDigestB64u: parseDigest(record.actualPackageSetDigestB64u, "actualPackageSetDigestB64u")
-			};
-		case "installation_receipt_mismatch":
-			rejectUnknownFields(record, ["kind", "field"], "LinkIntegrityFailureV1");
-			if (record.field !== "walletId" && record.field !== "authMethodId" && record.field !== "deviceId" && record.field !== "targetFactorVerificationDigestB64u" && record.field !== "installedActivationRefs") throw new Error("LinkIntegrityFailureV1.field is invalid");
-			return {
-				kind: "installation_receipt_mismatch",
-				field: record.field
-			};
-		default: throw new Error("LinkIntegrityFailureV1.kind is invalid");
-	}
-}
 //#endregion
-export { buildLinkedDeviceApprovalV1, buildLinkedDeviceSessionCancelClaimedRequestV1, buildLinkedDeviceSessionCancelUnclaimedRequestV1, buildLinkedDeviceSessionClaimRequestV1, buildLinkedDeviceTargetCredentialRegistrationV1, buildQrLinkedDeviceSessionPayloadV5, parseActivateInstalledAuthorityResultV1, parseActiveWalletSessionV1, parseLinkDevicePublicKeyB64u, parseLinkSessionProjectionV1, parseLinkSessionStateV1, parseLinkSessionTransportEventV1, parseLinkedDeviceApprovalDeliveryV1, parseLinkedDeviceApprovalResultV1, parseLinkedDeviceApprovalV1, parseLinkedDeviceEmailOtpBaseFactorResolutionResultV1, parseLinkedDeviceEmailOtpBaseFactorResolutionV1, parseLinkedDeviceEmailOtpChallengeResendRequestV1, parseLinkedDeviceEmailOtpChallengeResultV1, parseLinkedDeviceEmailOtpChallengeStartRequestV1, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1, parseLinkedDeviceEmailOtpVerificationGrantV1, parseLinkedDeviceEmailOtpVerificationResultV1, parseLinkedDeviceListRequestV1, parseLinkedDeviceListResultV1, parseLinkedDeviceOwnerAuthorizationRequestV1, parseLinkedDeviceOwnerAuthorizationSourceV1, parseLinkedDeviceRevokeRequestV1, parseLinkedDeviceRevokeResultV1, parseLinkedDeviceSessionClaimV1, parseLinkedDeviceSummaryV1, parseLinkedDeviceTargetCredentialRegistrationResultV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationRequestV1, parseLinkedDeviceTargetPreparationV1, parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1, parseOwnerDeviceSummaryV1, parseQrLinkedDeviceSessionPayloadV5, parseQrLinkedDeviceSessionTextV5, parseWalletSessionOperationCredentialV1, serializeQrLinkedDeviceSessionPayloadV5 };
+export { buildLinkedDeviceApprovalV1, buildLinkedDeviceSessionCancelClaimedRequestV1, buildLinkedDeviceSessionCancelUnclaimedRequestV1, buildLinkedDeviceSessionClaimRequestV1, buildLinkedDeviceTargetCredentialRegistrationV1, buildQrLinkedDeviceSessionPayloadV5, parseLinkDevicePublicKeyB64u, parseLinkSessionProjectionV1, parseLinkSessionStateV1, parseLinkSessionTransportEventV1, parseLinkedDeviceApprovalDeliveryV1, parseLinkedDeviceApprovalResultV1, parseLinkedDeviceApprovalV1, parseLinkedDeviceEmailOtpBaseFactorResolutionResultV1, parseLinkedDeviceEmailOtpChallengeResendRequestV1, parseLinkedDeviceEmailOtpChallengeResultV1, parseLinkedDeviceEmailOtpChallengeStartRequestV1, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1, parseLinkedDeviceEmailOtpVerificationGrantV1, parseLinkedDeviceEmailOtpVerificationResultV1, parseLinkedDeviceOwnerAuthorizationRequestV1, parseLinkedDeviceOwnerAuthorizationSourceV1, parseLinkedDeviceSessionClaimV1, parseLinkedDeviceTargetCredentialRegistrationResultV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationRequestV1, parseLinkedDeviceTargetPreparationV1, parseQrLinkedDeviceSessionPayloadV5, parseQrLinkedDeviceSessionTextV5, serializeQrLinkedDeviceSessionPayloadV5 };
 //# sourceMappingURL=parsers.js.map