@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/SeamsWeb/operations/authMethods/revokeAuthMethod.js

@@ -1,205 +0,0 @@
-import { parseWalletAuthMethodId, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../shared-ts/src/utils/emailOtpDomain.js";
-import { WALLET_AUTH_METHODS } from "../../../shared-ts/src/utils/signerDomain.js";
-import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
-import { redactCredentialExtensionOutputs } from "../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
-import { computeWalletAuthMethodRevokeOperationFingerprintV1, parseWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/walletAuthMethodRecord.js";
-import { toError } from "../../../shared-ts/src/utils/errors.js";
-import { revokeWalletAuthMethod } from "../../../core/rpcClients/relayer/walletRegistration.js";
-import { IndexedDBManager } from "../../../core/indexedDB/index.js";
-import { passkeyCredentialIdB64uFromAuthentication } from "./passkey/ecdsaBootstrap.js";
-import { requestEmailOtpChallenge } from "./emailOtp/challenge.js";
-//#region src/SeamsWeb/operations/authMethods/revokeAuthMethod.ts
-/**
-* Remove one auth method using a different active one.
-*
-* The inverse of the two addition branches, and the reason they are safe to
-* offer: a wallet that can gain a second way in must be able to lose one it no
-* longer trusts. The proof comes from a sibling, never from the method being
-* removed, so losing a credential does not also lose the ability to retire it.
-*
-* Deliberately not `devices.revokeLinkedDevice`. That path authenticates an
-* owner *request* against the device-linking management service; a sibling on
-* this device is not a linked device, and the wallet's own auth-method route
-* wants a factor proof bound to this exact revocation instead.
-*/
-/**
-* Every local passkey credential backed by an active V2 method except the one
-* being revoked.
-*
-* Offering the target would let a credential authorize its own removal, which
-* the server refuses anyway - but refusing it here means the prompt never asks
-* for the one credential that cannot answer.
-*/
-function webAuthnTransportsFromRaw(value) {
-	if (!Array.isArray(value)) return [];
-	return value.filter((transport) => [
-		"ble",
-		"hybrid",
-		"internal",
-		"nfc",
-		"smart-card",
-		"usb"
-	].includes(String(transport)));
-}
-function passkeySourceCredentialsForActiveMethods(args) {
-	const activeCredentialIds = /* @__PURE__ */ new Set();
-	for (const method of args.authMethods) if (method.kind === "passkey" && method.status === "active" && method.walletId === args.walletId) activeCredentialIds.add(method.credentialIdB64u);
-	const allowCredentials = [];
-	for (const record of args.authenticators) {
-		const id = String(record.credentialId || "").trim();
-		if (!id || id === args.excludeCredentialIdB64u || !activeCredentialIds.has(id)) continue;
-		allowCredentials.push({
-			id,
-			type: "public-key",
-			transports: webAuthnTransportsFromRaw(record.transports)
-		});
-	}
-	return allowCredentials;
-}
-async function passkeySourceCredentials(args) {
-	const [authenticators, authMethods] = await Promise.all([IndexedDBManager.listProfileAuthenticators(String(args.walletId)), IndexedDBManager.listWalletAuthMethodsV2ForWallet(String(args.walletId))]);
-	return passkeySourceCredentialsForActiveMethods({
-		walletId: args.walletId,
-		authenticators,
-		authMethods,
-		excludeCredentialIdB64u: args.excludeCredentialIdB64u
-	});
-}
-async function passkeySourceProof(args) {
-	const credential = await args.context.signingEngine.getAuthenticationCredentialsSerialized({
-		subjectId: String(args.walletId),
-		challengeB64u: args.operationFingerprintDigest,
-		allowCredentials: args.allowCredentials,
-		includeSecondPrfOutput: false
-	});
-	const credentialIdB64u = passkeyCredentialIdB64uFromAuthentication(credential);
-	if (!credentialIdB64u || !args.allowCredentials.some((allowed) => allowed.id === credentialIdB64u)) throw new Error("registration.revokeAuthMethod used a credential outside the wallet");
-	return {
-		kind: "webauthn_assertion",
-		rpId: args.rpId,
-		credential: redactCredentialExtensionOutputs(credential),
-		expectedChallengeDigestB64u: args.operationFingerprintDigest
-	};
-}
-async function emailOtpSourceProof(args) {
-	const [source, ...remaining] = (await IndexedDBManager.listWalletAuthMethodsForWallet(String(args.walletId))).filter((method) => method.kind === "email_otp" && method.status === "active" && String(method.walletId) === String(args.walletId) && String(method.authority.bindingId) !== String(args.targetWalletAuthMethodId));
-	if (!source || remaining.length > 0 || source.kind !== "email_otp") throw new Error("registration.revokeAuthMethod needs exactly one other active method to authorize with");
-	const walletAuthMethodId = String(source.authority.bindingId);
-	const requestChallenge = async () => await requestEmailOtpChallenge({
-		relayUrl: args.relayerUrl,
-		walletId: String(args.walletId),
-		walletAuthMethodId,
-		operation: WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION,
-		operationFingerprintDigest: parseDigestB64u(args.operationFingerprintDigest)
-	});
-	const challenge = await requestChallenge();
-	const confirmed = await args.context.signingEngine.requestEmailOtpEnrollmentConfirmation({
-		walletId: String(args.walletId),
-		emailAddress: String(challenge.emailHint || ""),
-		challengeId: challenge.challengeId,
-		...challenge.emailHint ? { emailHint: challenge.emailHint } : {},
-		onResend: async () => {
-			const resent = await requestChallenge();
-			return resent.emailHint ? {
-				challengeId: resent.challengeId,
-				emailHint: resent.emailHint
-			} : { challengeId: resent.challengeId };
-		}
-	});
-	return {
-		kind: "email_otp",
-		challengeId: confirmed.challengeId,
-		otpCode: confirmed.otpCode,
-		ownerProofBindingDigest: challenge.ownerProofBindingDigest
-	};
-}
-async function revokeAuthMethodInternal(args) {
-	const relayerUrl = String(args.context.configs.network.relayer.url || "").trim();
-	if (!relayerUrl) throw new Error("registration.revokeAuthMethod requires relayer.url");
-	const parsedRpId = parseWebAuthnRpId(String(args.context.signingEngine.getRpId() || "").trim());
-	if (!parsedRpId.ok) throw new Error(`registration.revokeAuthMethod ${parsedRpId.error.message}`);
-	const requestedAtMs = Date.now();
-	const operationFingerprintDigest = await computeWalletAuthMethodRevokeOperationFingerprintV1({
-		walletId: args.walletId,
-		targetWalletAuthMethodId: args.walletAuthMethodId,
-		requestedAtMs
-	});
-	const target = await IndexedDBManager.getWalletAuthMethodV2(args.walletAuthMethodId);
-	const excludeCredentialIdB64u = target && target.kind === "passkey" ? String(target.credentialIdB64u) : null;
-	const allowCredentials = await passkeySourceCredentials({
-		walletId: args.walletId,
-		excludeCredentialIdB64u
-	});
-	let sourceAuthMethod;
-	if (allowCredentials.length > 0) sourceAuthMethod = WALLET_AUTH_METHODS.passkey;
-	else sourceAuthMethod = WALLET_AUTH_METHODS.emailOtp;
-	let sourceProof;
-	switch (sourceAuthMethod) {
-		case WALLET_AUTH_METHODS.passkey:
-			sourceProof = await passkeySourceProof({
-				context: args.context,
-				walletId: args.walletId,
-				rpId: parsedRpId.value,
-				operationFingerprintDigest: String(operationFingerprintDigest),
-				allowCredentials
-			});
-			break;
-		case WALLET_AUTH_METHODS.emailOtp:
-			sourceProof = await emailOtpSourceProof({
-				context: args.context,
-				relayerUrl,
-				walletId: args.walletId,
-				targetWalletAuthMethodId: args.walletAuthMethodId,
-				operationFingerprintDigest: String(operationFingerprintDigest)
-			});
-			break;
-		default: throw new Error("registration.revokeAuthMethod encountered an unsupported source method");
-	}
-	const response = await revokeWalletAuthMethod({
-		relayerUrl,
-		walletId: args.walletId,
-		walletAuthMethodId: args.walletAuthMethodId,
-		requestedAtMs,
-		sourceProof
-	});
-	if (!response.ok || response.authMethod.status !== "revoked") throw new Error("registration.revokeAuthMethod did not revoke the method");
-	const local = await IndexedDBManager.getWalletAuthMethodV2(args.walletAuthMethodId);
-	if (local && local.status !== "revoked") {
-		const revokedAtMs = Date.now();
-		const activatedAtMs = local.status === "active" ? local.activatedAtMs : revokedAtMs;
-		const revoked = parseWalletAuthMethodRecordV2({
-			...local,
-			status: "revoked",
-			activatedAtMs,
-			revokedAtMs,
-			updatedAtMs: revokedAtMs
-		});
-		if (revoked) await IndexedDBManager.upsertWalletAuthMethodV2(revoked);
-	}
-	return {
-		ok: true,
-		walletId: args.walletId,
-		walletAuthMethodId: args.walletAuthMethodId,
-		authMethod: response.authMethod
-	};
-}
-async function revokeWalletAuthMethodOperation(args) {
-	const walletId = walletIdFromString(String(args.walletId || "").trim());
-	const parsedMethodId = parseWalletAuthMethodId(String(args.walletAuthMethodId || "").trim());
-	if (!parsedMethodId.ok) throw new Error("registration.revokeAuthMethod requires a wallet auth method id");
-	try {
-		return await revokeAuthMethodInternal({
-			context: args.context,
-			walletId,
-			walletAuthMethodId: parsedMethodId.value
-		});
-	} catch (error) {
-		throw toError(error);
-	}
-}
-//#endregion
-export { revokeWalletAuthMethodOperation };
-
-//# sourceMappingURL=revokeAuthMethod.js.map

package/dist/esm/SeamsWeb/operations/authMethods/sourcePasskeyProof.js

@@ -1,12 +0,0 @@
-//#region src/SeamsWeb/operations/authMethods/sourcePasskeyProof.ts
-function addAuthMethodSourcePasskeyAllowCredentials(sourceAuthMethod) {
-	return [{
-		id: sourceAuthMethod.credentialIdB64u,
-		type: "public-key",
-		transports: []
-	}];
-}
-//#endregion
-export { addAuthMethodSourcePasskeyAllowCredentials };
-
-//# sourceMappingURL=sourcePasskeyProof.js.map

package/dist/esm/SeamsWeb/operations/devices/deviceLinkingAuthorityInstallation.js

@@ -1,444 +0,0 @@
-import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { buildEmailOtpWalletAuthAuthority } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { encodeWalletSignerActivationSetV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
-import { assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1 } from "../../../shared-ts/src/device-linking/walletSessionCredentialDelivery.js";
-import { computeWalletSessionInstallationReceiptDigestB64u } from "../../../shared-ts/src/device-linking/digests.js";
-import "../../../shared-ts/src/device-linking/index.js";
-import { LINKED_DEVICE_COMMITTED_RESUME_APP_STATE_PREFIX_V1, LINKED_DEVICE_PENDING_ACK_APP_STATE_PREFIX_V1, buildDeviceLinkingCommittedResumeV1, buildDeviceLinkingPendingAcknowledgementV1, committedResumeAppStateKeyV1, compareDeviceLinkingCommittedResumeV1, parseDeviceLinkingCommittedResumeV1, parseDeviceLinkingPendingAcknowledgementV1, pendingAcknowledgementAppStateKeyV1 } from "./deviceLinkingResume.js";
-//#region src/SeamsWeb/operations/devices/deviceLinkingAuthorityInstallation.ts
-function localAuthorityProfileProjectionV1(authMethod, targetFactor) {
-	const profileId = String(authMethod.walletId);
-	switch (authMethod.kind) {
-		case "passkey": {
-			const credentialId = String(authMethod.credentialIdB64u);
-			return {
-				profile: {
-					profileId,
-					defaultSignerSlot: 1,
-					passkeyCredential: {
-						id: credentialId,
-						rawId: credentialId
-					}
-				},
-				authenticator: {
-					profileId,
-					signerSlot: 1,
-					credentialId,
-					credentialPublicKey: base64UrlDecode(authMethod.credentialPublicKeyB64u),
-					registered: new Date(authMethod.createdAtMs).toISOString(),
-					syncedAt: new Date(authMethod.updatedAtMs).toISOString()
-				},
-				localAuthMethod: null
-			};
-		}
-		case "email_otp": {
-			if (targetFactor.kind !== "verified_email_otp_target_v1" || targetFactor.authMethod.walletAuthMethodId !== authMethod.walletAuthMethodId || targetFactor.authMethod.walletId !== authMethod.walletId || targetFactor.authMethod.emailHashHex !== authMethod.emailHashHex || targetFactor.authMethod.registrationAuthorityId !== authMethod.registrationAuthorityId) throw new Error("linked Email OTP target factor does not match the committed auth method");
-			const baseAuthority = buildEmailOtpWalletAuthAuthority({
-				walletId: authMethod.walletId,
-				provider: targetFactor.enrollment.kind === "existing_enrollment" ? "google" : "email",
-				providerUserId: targetFactor.providerUserId,
-				emailHashHex: authMethod.emailHashHex
-			});
-			return {
-				profile: {
-					profileId,
-					defaultSignerSlot: 1
-				},
-				authenticator: null,
-				localAuthMethod: {
-					version: "wallet_auth_method_v1",
-					kind: "email_otp",
-					status: "active",
-					localStatus: "synced",
-					walletId: authMethod.walletId,
-					emailHashHex: authMethod.emailHashHex,
-					registrationAuthorityId: authMethod.registrationAuthorityId,
-					authority: {
-						walletId: baseAuthority.walletId,
-						factor: baseAuthority.factor,
-						verifier: baseAuthority.verifier,
-						bindingId: authMethod.walletAuthMethodId
-					},
-					createdAtMs: authMethod.createdAtMs,
-					updatedAtMs: authMethod.updatedAtMs
-				}
-			};
-		}
-		default: {
-			const _exhaustive = authMethod;
-			throw new Error(`Unsupported linked-device auth method: ${String(_exhaustive)}`);
-		}
-	}
-}
-function createDeviceLinkingAuthorityInstallationPortV1(options) {
-	return {
-		...createDeviceLinkingDeliveryResumePortV1({ indexedDB: options.indexedDB }),
-		persistCommittedDeliveryResumeV1: async (input) => {
-			const resume = buildDeviceLinkingCommittedResumeV1(input);
-			await options.indexedDB.setAppState(committedResumeAppStateKeyV1(resume.authorityId), resume);
-		},
-		readCommittedDeliveryResumeV1: async ({ authorityId }) => parseDeviceLinkingCommittedResumeV1(await options.indexedDB.getAppState(committedResumeAppStateKeyV1(authorityId))),
-		persistPendingActivationAcknowledgementV1: async ({ acknowledgement }) => {
-			const pending = buildDeviceLinkingPendingAcknowledgementV1(acknowledgement);
-			await options.indexedDB.setAppState(pendingAcknowledgementAppStateKeyV1(acknowledgement.authorityId), pending);
-		},
-		readPendingActivationAcknowledgementV1: async ({ authorityId }) => {
-			return parseDeviceLinkingPendingAcknowledgementV1(await options.indexedDB.getAppState(pendingAcknowledgementAppStateKeyV1(authorityId)))?.acknowledgement ?? null;
-		},
-		readLocalAuthorityInstallationReceiptV1: async ({ authorityId }) => await options.indexedDB.getLocalAuthorityInstallationReceipt(authorityId),
-		installLocalAuthorityV1: (input) => installLocalAuthorityV1({
-			...input,
-			...options
-		}),
-		publishLocalAuthorityActivationV1: ({ active, expectedLockGeneration }) => publishLocalAuthorityActivationV1({
-			indexedDB: options.indexedDB,
-			active,
-			expectedLockGeneration
-		}),
-		finalizeLocalAuthorityActivationV1: ({ active, operationCredential, expectedLockGeneration }) => finalizeLocalAuthorityActivationV1({
-			indexedDB: options.indexedDB,
-			active,
-			operationCredential,
-			expectedLockGeneration
-		})
-	};
-}
-function createDeviceLinkingDeliveryResumePortV1(input) {
-	return {
-		listCommittedDeliveryResumesV1: async () => {
-			return (await input.indexedDB.listAppStateEntriesByPrefix(LINKED_DEVICE_COMMITTED_RESUME_APP_STATE_PREFIX_V1)).flatMap((row) => {
-				if (row.value === null) return [];
-				const resume = parseDeviceLinkingCommittedResumeV1(row.value);
-				if (!resume || committedResumeAppStateKeyV1(resume.authorityId) !== row.key) throw new Error("durable linked-device delivery resume is corrupt");
-				return [resume];
-			});
-		},
-		listPendingActivationAcknowledgementsV1: async () => {
-			return (await input.indexedDB.listAppStateEntriesByPrefix(LINKED_DEVICE_PENDING_ACK_APP_STATE_PREFIX_V1)).flatMap((row) => {
-				if (row.value === null) return [];
-				const pending = parseDeviceLinkingPendingAcknowledgementV1(row.value);
-				if (!pending || pendingAcknowledgementAppStateKeyV1(pending.acknowledgement.authorityId) !== row.key) throw new Error("durable linked-device acknowledgement is corrupt");
-				return [pending.acknowledgement];
-			});
-		},
-		clearCommittedDeliveryResumeV1: async ({ authorityId }) => {
-			await input.indexedDB.setAppState(committedResumeAppStateKeyV1(authorityId), null);
-		},
-		clearPendingActivationAcknowledgementV1: async ({ authorityId }) => {
-			await input.indexedDB.setAppState(pendingAcknowledgementAppStateKeyV1(authorityId), null);
-		}
-	};
-}
-async function installLocalAuthorityV1(input) {
-	const existingReceipt = await input.indexedDB.getLocalAuthorityInstallationReceipt(input.committed.authority.authorityId);
-	if (existingReceipt) {
-		assertReceiptMatchesCommitted({
-			committed: input.committed,
-			targetFactor: input.targetFactor,
-			receipt: existingReceipt
-		});
-		return existingReceipt;
-	}
-	const sealed = await input.sealing.sealCommittedAuthorityPackagesV1({
-		committed: input.committed,
-		targetFactor: input.targetFactor,
-		keyMaterial: input.keyMaterial,
-		resealedExportRoot: input.resealedExportRoot
-	});
-	assertSealedAuthorityRecordsMatchCommitted({
-		committed: input.committed,
-		sealed
-	});
-	const localProfileProjection = localAuthorityProfileProjectionV1(input.committed.authMethod, input.targetFactor);
-	const installedAtMs = input.nowMs();
-	if (!Number.isSafeInteger(installedAtMs) || installedAtMs <= 0) throw new Error("local authority installation clock is invalid");
-	const receipt = {
-		kind: "local_authority_installation_receipt_v1",
-		authorityId: input.committed.authority.authorityId,
-		walletId: input.committed.authority.walletId,
-		authMethodId: input.committed.authMethod.walletAuthMethodId,
-		deviceId: input.committed.authority.principal.deviceId,
-		packageSetDigestB64u: input.committed.packageSetDigestB64u,
-		installedActivationRefs: input.committed.authority.signerActivations,
-		installedRecordSetDigestB64u: sealed.installedRecordSetDigestB64u,
-		targetFactorVerificationDigestB64u: input.targetFactor.verificationDigestB64u,
-		installedAtMs
-	};
-	const result = await input.indexedDB.installLocalAuthority({
-		authority: input.committed.authority,
-		authMethod: input.committed.authMethod,
-		profile: localProfileProjection.profile,
-		authenticator: localProfileProjection.authenticator,
-		localAuthMethod: localProfileProjection.localAuthMethod,
-		signerMaterials: sealed.signerMaterials,
-		exportRoot: sealed.exportRoot,
-		receipt,
-		expectedLockGeneration: input.expectedLockGeneration
-	});
-	switch (result.kind) {
-		case "installed":
-		case "idempotent_replay": return result.receipt;
-		case "stale_lock_generation": throw new Error(`local authority installation lock generation is stale (expected ${result.expectedLockGeneration}, actual ${result.actualLockGeneration})`);
-		case "integrity_error": throw new Error(`local authority installation integrity error: ${result.reason}`);
-	}
-}
-async function publishLocalAuthorityActivationV1(input) {
-	const result = await input.indexedDB.publishLocalAuthorityActivation({
-		authority: input.active.authority,
-		authMethod: input.active.authMethod,
-		expectedLockGeneration: input.expectedLockGeneration
-	});
-	switch (result.kind) {
-		case "published": return;
-		case "stale_lock_generation": throw new Error(`local authority activation lock generation is stale (expected ${result.expectedLockGeneration}, actual ${result.actualLockGeneration})`);
-		case "wallet_locked": throw new Error(`local authority activation refused while wallet is locked at generation ${result.lockGeneration}`);
-		default: throw new Error("local authority activation publication returned an unknown result");
-	}
-}
-async function finalizeLocalAuthorityActivationV1(input) {
-	const finalization = {
-		authority: input.active.authority,
-		authMethod: input.active.authMethod,
-		walletSession: input.active.walletSession,
-		operationCredential: input.operationCredential,
-		expectedLockGeneration: input.expectedLockGeneration
-	};
-	const result = await input.indexedDB.finalizeLocalAuthorityActivation(finalization);
-	switch (result.kind) {
-		case "finalized": return;
-		case "stale_lock_generation": throw new Error(`local authority activation lock generation is stale (expected ${result.expectedLockGeneration}, actual ${result.actualLockGeneration})`);
-		case "wallet_locked": throw new Error(`local authority activation refused while wallet is locked at generation ${result.lockGeneration}`);
-		default: throw new Error("local authority activation returned an unknown result");
-	}
-}
-async function activateLinkedAuthorityV1(input) {
-	const committedStateResult = assertCommittedAuthorityStateMatchesSession({
-		committed: input.committed,
-		sessionState: input.sessionState
-	});
-	if (committedStateResult) return committedStateResult;
-	const durableResume = await input.installation.readCommittedDeliveryResumeV1({ authorityId: input.committed.authority.authorityId });
-	if (durableResume) {
-		const mismatch = compareDeviceLinkingCommittedResumeV1({
-			resume: durableResume,
-			linkSessionId: input.linkSessionId,
-			committed: input.committed,
-			targetFactor: input.targetFactor
-		});
-		if (mismatch) return {
-			kind: "integrity_error",
-			reason: mismatch
-		};
-	} else await input.installation.persistCommittedDeliveryResumeV1({
-		linkSessionId: input.linkSessionId,
-		committed: input.committed,
-		targetFactor: input.targetFactor,
-		committedAtMs: input.nowMs()
-	});
-	const receipt = await input.installation.installLocalAuthorityV1({
-		committed: input.committed,
-		targetFactor: input.targetFactor,
-		keyMaterial: input.keyMaterial,
-		resealedExportRoot: input.resealedExportRoot,
-		expectedLockGeneration: input.expectedLockGeneration
-	});
-	const active = await input.transport.activateInstalledAuthorityV1({
-		linkSessionId: input.linkSessionId,
-		receipt
-	});
-	switch (active.kind) {
-		case "pending_local_install": return {
-			kind: "pending_local_install",
-			authorityId: active.authorityId,
-			packageSetDigestB64u: receipt.packageSetDigestB64u
-		};
-		case "integrity_error": return active;
-		case "active": {
-			const activationReceiptResult = assertActivationResultMatchesReceipt({
-				active,
-				receipt
-			});
-			if (activationReceiptResult) return activationReceiptResult;
-			await input.installation.publishLocalAuthorityActivationV1({
-				active,
-				expectedLockGeneration: input.expectedLockGeneration
-			});
-			await assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1(active.sealedDelivery);
-			await assertDeliveryMatchesActivation({
-				active,
-				receipt,
-				linkSessionId: input.linkSessionId,
-				deliveryRecipientPublicKey65B64u: input.deliveryRecipientPublicKey65B64u
-			});
-			await input.installation.persistPendingActivationAcknowledgementV1({ acknowledgement: await buildPendingActivationAcknowledgementV1({
-				active,
-				receipt,
-				linkSessionId: input.linkSessionId,
-				acknowledgedAtMs: input.nowMs()
-			}) });
-			const operationCredential = await input.keyMaterialPort.openWalletSessionCredentialDeliveryV1({
-				keyMaterial: input.keyMaterial,
-				delivery: active.sealedDelivery,
-				expected: {
-					linkSessionId: input.linkSessionId,
-					walletId: active.walletSession.walletId,
-					authorityId: active.walletSession.authorityId,
-					walletAuthMethodId: active.walletSession.authMethodId,
-					authorizationId: active.walletSession.authorizationId,
-					walletSessionId: active.sealedDelivery.aad.walletSessionId,
-					quotaId: active.walletSession.quotaId,
-					deliveryBinding: active.deliveryBinding,
-					credentialDigestB64u: active.sealedDelivery.aad.credentialDigestB64u,
-					installationReceiptDigestB64u: active.sealedDelivery.installationReceiptDigestB64u,
-					recipientPublicKey65B64u: input.deliveryRecipientPublicKey65B64u,
-					issuedAtMs: active.walletSession.issuedAtMs,
-					expiresAtMs: active.walletSession.expiresAtMs
-				}
-			});
-			await input.installation.finalizeLocalAuthorityActivationV1({
-				active,
-				operationCredential,
-				expectedLockGeneration: input.expectedLockGeneration
-			});
-			return {
-				kind: "active",
-				session: active.walletSession,
-				operationCredential
-			};
-		}
-	}
-}
-async function buildPendingActivationAcknowledgementV1(input) {
-	if (!Number.isSafeInteger(input.acknowledgedAtMs) || input.acknowledgedAtMs <= 0) throw new Error("linked-device acknowledgement clock is invalid");
-	return {
-		kind: "local_authority_activation_final_ack_v1",
-		linkSessionId: input.linkSessionId,
-		authorityId: input.active.authority.authorityId,
-		packageSetDigestB64u: input.receipt.packageSetDigestB64u,
-		authorizationId: input.active.sealedDelivery.aad.authorizationId,
-		walletSessionId: input.active.sealedDelivery.aad.walletSessionId,
-		credentialDigestB64u: input.active.sealedDelivery.aad.credentialDigestB64u,
-		installationReceiptDigestB64u: await computeWalletSessionInstallationReceiptDigestB64u(input.receipt),
-		acknowledgedAtMs: input.acknowledgedAtMs
-	};
-}
-function assertCommittedAuthorityStateMatchesSession(input) {
-	if (input.sessionState.state === "provisioning") return null;
-	if (input.committed.authority.authorityId !== input.sessionState.authorityId) return {
-		kind: "integrity_error",
-		reason: {
-			kind: "authority_id_mismatch",
-			expectedAuthorityId: input.sessionState.authorityId,
-			actualAuthorityId: input.committed.authority.authorityId
-		}
-	};
-	if (input.sessionState.state !== "active" && input.committed.packageSetDigestB64u !== input.sessionState.packageSetDigestB64u) return {
-		kind: "integrity_error",
-		reason: {
-			kind: "package_set_digest_mismatch",
-			expectedPackageSetDigestB64u: input.sessionState.packageSetDigestB64u,
-			actualPackageSetDigestB64u: input.committed.packageSetDigestB64u
-		}
-	};
-	return null;
-}
-function assertActivationResultMatchesReceipt(input) {
-	if (input.active.authority.authorityId !== input.receipt.authorityId) return {
-		kind: "integrity_error",
-		reason: {
-			kind: "authority_id_mismatch",
-			expectedAuthorityId: input.receipt.authorityId,
-			actualAuthorityId: input.active.authority.authorityId
-		}
-	};
-	if (input.active.authority.walletId !== input.receipt.walletId) return {
-		kind: "integrity_error",
-		reason: {
-			kind: "installation_receipt_mismatch",
-			field: "walletId"
-		}
-	};
-	if (input.active.walletSession.walletId !== input.receipt.walletId) return {
-		kind: "integrity_error",
-		reason: {
-			kind: "installation_receipt_mismatch",
-			field: "walletId"
-		}
-	};
-	if (input.active.authMethod.walletAuthMethodId !== input.receipt.authMethodId || input.active.walletSession.authMethodId !== input.receipt.authMethodId) return {
-		kind: "integrity_error",
-		reason: {
-			kind: "installation_receipt_mismatch",
-			field: "authMethodId"
-		}
-	};
-	return null;
-}
-async function assertDeliveryMatchesActivation(input) {
-	const aad = input.active.sealedDelivery.aad;
-	const binding = input.active.deliveryBinding;
-	const installationReceiptDigestB64u = input.active.sealedDelivery.installationReceiptDigestB64u;
-	const expectedInstallationReceiptDigestB64u = await computeWalletSessionInstallationReceiptDigestB64u(input.receipt);
-	if (binding.namespace !== aad.namespace || binding.orgId !== aad.orgId || binding.projectId !== aad.projectId || binding.envId !== aad.envId || binding.tenantId !== aad.tenantId || binding.principalId !== aad.principalId || aad.linkSessionId !== input.linkSessionId || aad.walletId !== input.receipt.walletId || aad.authorityId !== input.receipt.authorityId || aad.walletAuthMethodId !== input.receipt.authMethodId || aad.authorizationId !== input.active.walletSession.authorizationId || aad.quotaId !== input.active.walletSession.quotaId || String(aad.principalId) !== `linked-device:${String(input.active.authority.principal.deviceId)}` || aad.recipientPublicKey65B64u !== input.deliveryRecipientPublicKey65B64u || aad.issuedAtMs !== input.active.walletSession.issuedAtMs || aad.expiresAtMs !== input.active.walletSession.expiresAtMs || installationReceiptDigestB64u !== expectedInstallationReceiptDigestB64u) throw new Error("linked-device Wallet Session credential delivery identity changed");
-}
-function assertSealedAuthorityRecordsMatchCommitted(input) {
-	const authority = input.committed.authority;
-	const authMethod = input.committed.authMethod;
-	const expectedActivations = signerMaterialActivations(authority.signerActivations);
-	if (input.sealed.signerMaterials.length !== expectedActivations.length) throw new Error("sealed signer material count does not match committed authority");
-	for (let index = 0; index < expectedActivations.length; index += 1) {
-		const expected = expectedActivations[index];
-		const actual = input.sealed.signerMaterials[index];
-		if (!actual || actual.authorityId !== authority.authorityId || actual.walletAuthMethodId !== authMethod.walletAuthMethodId || actual.keyFamily !== expected.keyFamily || actual.activationId !== expected.materialActivation.activationId || actual.materialActivation.activationId !== expected.materialActivation.activationId) throw new Error("sealed signer material identity does not match committed authority");
-	}
-	if ((hasEd25519SignerFamily(authority.signerActivations) && authority.permissions.includes("export_keys")) !== (input.sealed.exportRoot !== null)) throw new Error("sealed Ed25519 export root presence does not match committed authority");
-	if (input.sealed.exportRoot) {
-		if (input.sealed.exportRoot.authorityId !== authority.authorityId || input.sealed.exportRoot.walletAuthMethodId !== authMethod.walletAuthMethodId) throw new Error("sealed export root identity does not match committed authority");
-	}
-	parseDigestB64u(input.sealed.installedRecordSetDigestB64u);
-}
-function assertReceiptMatchesCommitted(input) {
-	if (input.receipt.authorityId !== input.committed.authority.authorityId || input.receipt.walletId !== input.committed.authority.walletId || input.receipt.authMethodId !== input.committed.authMethod.walletAuthMethodId || input.receipt.deviceId !== input.committed.authority.principal.deviceId || input.receipt.packageSetDigestB64u !== input.committed.packageSetDigestB64u || input.receipt.targetFactorVerificationDigestB64u !== input.targetFactor.verificationDigestB64u || !walletSignerActivationSetsMatch(input.receipt.installedActivationRefs, input.committed.authority.signerActivations)) throw new Error("stored local authority receipt does not match committed packages");
-}
-function walletSignerActivationSetsMatch(left, right) {
-	const leftBytes = encodeWalletSignerActivationSetV1(left);
-	const rightBytes = encodeWalletSignerActivationSetV1(right);
-	if (leftBytes.byteLength !== rightBytes.byteLength) return false;
-	for (let index = 0; index < leftBytes.byteLength; index += 1) if (leftBytes[index] !== rightBytes[index]) return false;
-	return true;
-}
-function hasEd25519SignerFamily(activations) {
-	return activations.keyFamilies.length === 2 || activations.keyFamilies[0] === "ed25519";
-}
-function signerMaterialActivations(activations) {
-	if (activations.keyFamilies.length === 1 && activations.keyFamilies[0] === "ed25519") {
-		if (!activations.ed25519) throw new Error("Ed25519 activation is missing");
-		return [{
-			keyFamily: "ed25519",
-			materialActivation: activations.ed25519.materialActivation
-		}];
-	}
-	if (activations.keyFamilies.length === 1 && activations.keyFamilies[0] === "ecdsa_secp256k1") {
-		if (!activations.ecdsa) throw new Error("ECDSA activation is missing");
-		return [{
-			keyFamily: "ecdsa_secp256k1",
-			materialActivation: activations.ecdsa.materialActivation
-		}];
-	}
-	if (activations.keyFamilies.length === 2) {
-		if (!activations.ed25519 || !activations.ecdsa) throw new Error("combined signer activations are incomplete");
-		return [{
-			keyFamily: "ed25519",
-			materialActivation: activations.ed25519.materialActivation
-		}, {
-			keyFamily: "ecdsa_secp256k1",
-			materialActivation: activations.ecdsa.materialActivation
-		}];
-	}
-	throw new Error("committed signer activation families are invalid");
-}
-//#endregion
-export { activateLinkedAuthorityV1, createDeviceLinkingAuthorityInstallationPortV1 };
-
-//# sourceMappingURL=deviceLinkingAuthorityInstallation.js.map