@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/shared-ts/src/authorization/walletSessionIssuance.js

@@ -1,115 +1,4 @@
-import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../utils/domainIds.js";
-import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "./capabilityKinds.js";
-import { isPlainObject } from "../utils/validation.js";
-import { hasExactKeys } from "../utils/exactKeys.js";
-//#region ../shared-ts/src/authorization/walletSessionIssuance.ts
-const COMMITTED_IDENTITY_FIELDS = [
-	"kind",
-	"walletId",
-	"authorityId",
-	"walletAuthMethodId",
-	"mintId",
-	"authorizationId",
-	"walletSessionId",
-	"quotaId"
-];
-const NESTED_RESPONSE_FIELDS = [
-	"ok",
-	"code",
-	"message",
-	"next",
-	"committed"
-];
-const FLAT_RESPONSE_FIELDS = [
-	"ok",
-	"code",
-	"message",
-	"next",
-	"kind",
-	"walletId",
-	"authorityId",
-	"walletAuthMethodId",
-	"mintId",
-	"authorizationId",
-	"walletSessionId",
-	"quotaId"
-];
-const UNLOCK_FLAT_RESPONSE_FIELDS = [
-	...FLAT_RESPONSE_FIELDS,
-	"unlocked",
-	"unlockBackend"
-];
-function parseCommittedIdentity(value) {
-	if (!isPlainObject(value) || !hasExactKeys(value, COMMITTED_IDENTITY_FIELDS)) return null;
-	if (value.kind !== "already_committed_wallet_session_v1") return null;
-	const walletId = parseWalletId(value.walletId);
-	const authorityId = parseWalletAuthorityId(value.authorityId);
-	const walletAuthMethodId = parseWalletAuthMethodId(value.walletAuthMethodId);
-	const mintId = parseWalletSessionMintId(value.mintId);
-	const authorizationId = parseWalletSessionAuthorizationId(value.authorizationId);
-	const walletSessionId = parseWalletSessionId(value.walletSessionId);
-	const quotaId = parseMpcWalletSigningQuotaId(value.quotaId);
-	if (!walletId.ok || !authorityId.ok || !walletAuthMethodId.ok || !mintId.ok || !authorizationId.ok || !walletSessionId.ok || !quotaId.ok) return null;
-	return {
-		kind: "already_committed_wallet_session_v1",
-		walletId: walletId.value,
-		authorityId: authorityId.value,
-		walletAuthMethodId: walletAuthMethodId.value,
-		mintId: mintId.value,
-		authorizationId: authorizationId.value,
-		walletSessionId: walletSessionId.value,
-		quotaId: quotaId.value
-	};
-}
-function parseResponseEnvelope(value) {
-	if (value.ok !== false || value.code !== "already_committed" || typeof value.message !== "string" || value.next !== "unlock_exact_method") return null;
-	return {
-		ok: false,
-		code: "already_committed",
-		message: value.message,
-		next: "unlock_exact_method"
-	};
-}
-function parseFlatCommittedIdentity(value) {
-	if (!hasExactKeys(value, FLAT_RESPONSE_FIELDS) && !hasExactKeys(value, UNLOCK_FLAT_RESPONSE_FIELDS)) return null;
-	if (hasExactKeys(value, UNLOCK_FLAT_RESPONSE_FIELDS) && (value.unlocked !== false || value.unlockBackend !== "passkey" && value.unlockBackend !== "email_otp")) return null;
-	if (value.kind !== "already_committed") return null;
-	return parseCommittedIdentity({
-		kind: "already_committed_wallet_session_v1",
-		walletId: value.walletId,
-		authorityId: value.authorityId,
-		walletAuthMethodId: value.walletAuthMethodId,
-		mintId: value.mintId,
-		authorizationId: value.authorizationId,
-		walletSessionId: value.walletSessionId,
-		quotaId: value.quotaId
-	});
-}
-function buildAlreadyCommittedResponse(envelope, committed) {
-	return {
-		ok: false,
-		code: "already_committed",
-		message: envelope.message,
-		next: "unlock_exact_method",
-		committed
-	};
-}
-function parseWalletSessionAlreadyCommittedResponseV1(value) {
-	if (!isPlainObject(value)) return null;
-	const envelope = parseResponseEnvelope(value);
-	if (!envelope) return null;
-	if (!hasExactKeys(value, NESTED_RESPONSE_FIELDS)) return null;
-	const committed = parseCommittedIdentity(value.committed);
-	return committed ? buildAlreadyCommittedResponse(envelope, committed) : null;
-}
-function parseWalletUnlockAlreadyCommittedResponseV1(value) {
-	if (!isPlainObject(value)) return null;
-	const envelope = parseResponseEnvelope(value);
-	if (!envelope) return null;
-	const committed = parseFlatCommittedIdentity(value);
-	return committed ? buildAlreadyCommittedResponse(envelope, committed) : null;
-}
+import "./capabilityKinds.js";
 //#endregion
-export { parseWalletSessionAlreadyCommittedResponseV1, parseWalletUnlockAlreadyCommittedResponseV1 };
 
 //# sourceMappingURL=walletSessionIssuance.js.map

package/dist/esm/shared-ts/src/device-linking/activeWalletSession.js

@@ -1,7 +1,7 @@
-import { mpcMaterialActivationRefsEqual } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
+import { mpcMaterialActivationRefsEqual } from "../utils/domainIds.js";
 import { rejectUnknownFields } from "../utils/exactRecord.js";
-import { wireLiteral, wireObject } from "../utils/wireSchema.js";
+import { wireLiteral, wireObject, wireUnion } from "../utils/wireSchema.js";
 import { digest, keyLabeled, materialActivation, parseNonNegativeSafeInteger, parseUnixTime, quotaId, walletAuthMethodId, walletAuthorityId, walletId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
 //#region ../shared-ts/src/device-linking/activeWalletSession.ts
 function activeWalletSessionV1RecordsEqual(left, right) {
@@ -33,15 +33,25 @@ function walletSessionPreservesCapabilities(previous, next) {
 	}
 	return true;
 }
+const walletSessionHome = wireUnion("kind", [wireObject({ kind: wireLiteral("direct") }), wireObject({
+	kind: wireLiteral("regional"),
+	region: wireLiteral("US", "WEUR", "APAC", "OC")
+})]);
+function parseWalletSessionHome(raw) {
+	return walletSessionHome(raw, "Wallet Session home");
+}
 function walletSessionOperationCredentialV1() {
 	return wireObject({
 		kind: wireLiteral("opaque_wallet_session_operation_credential_v1"),
+		ownershipGeneration: parseNonNegativeSafeInteger,
+		home: parseWalletSessionHome,
 		token: (raw, label) => {
 			if (typeof raw !== "string" || raw.length > 8192) throw new Error(`${label} is invalid`);
 			return raw;
 		},
 		walletSessionId: keyLabeled(walletSessionId)
 	}, (credential, label) => {
+		if (credential.ownershipGeneration === 0) throw new Error(`${label} ownership generation must be positive`);
 		if (!/^wst_[A-Za-z0-9_-]{43}$/.test(credential.token)) throw new Error(`${label} opaque token is invalid`);
 	});
 }
@@ -99,6 +109,6 @@ function parseWalletCapabilitySubjectV1(raw, label) {
 	};
 }
 //#endregion
-export { activeWalletSessionV1RecordsEqual, parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1, walletSessionPreservesCapabilities };
+export { activeWalletSessionV1RecordsEqual, parseActiveWalletSessionV1, parseWalletSessionHome, parseWalletSessionOperationCredentialV1, walletSessionPreservesCapabilities };
 
 //# sourceMappingURL=activeWalletSession.js.map

package/dist/esm/shared-ts/src/device-linking/authorityActivation.js

@@ -1,11 +1,8 @@
-import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
-import { wireLiteral, wireObject, wireUnion } from "../utils/wireSchema.js";
-import { authorizationDeviceId, digest, keyLabeled, parseUnixTime, sessionId, walletAuthMethodId, walletAuthorityId, walletId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
-import { parseActiveWalletSessionV1 } from "./activeWalletSession.js";
-import { parseWalletAuthMethodRecordV2 } from "../utils/walletAuthMethodRecord.js";
-import { parseWalletAuthorityV1, parseWalletSignerActivationSetV1 } from "../authorization/walletAuthority.js";
-import { parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1, parseLinkedDeviceWalletSessionCredentialDeliveryV1 } from "./walletSessionCredentialDelivery.js";
+import { wireLiteral, wireObject } from "../utils/wireSchema.js";
+import { authorizationDeviceId, digest, keyLabeled, parseUnixTime, walletAuthMethodId, walletAuthorityId, walletId } from "./wireFields.js";
+import "./activeWalletSession.js";
+import { parseWalletSignerActivationSetV1 } from "../authorization/walletAuthority.js";
+import "./walletSessionCredentialDelivery.js";
 //#region ../shared-ts/src/device-linking/authorityActivation.ts
 function parseInstalledActivationRefs(raw, label) {
 	const result = parseWalletSignerActivationSetV1(raw);
@@ -29,114 +26,7 @@ function localAuthorityInstallationReceiptV1() {
 function parseLocalAuthorityInstallationReceiptV1(raw) {
 	return localAuthorityInstallationReceiptV1()(raw, "LocalAuthorityInstallationReceiptV1");
 }
-function localAuthorityActivationFinalAckV1() {
-	return wireObject({
-		kind: wireLiteral("local_authority_activation_final_ack_v1"),
-		linkSessionId: keyLabeled(sessionId),
-		authorityId: keyLabeled(walletAuthorityId),
-		packageSetDigestB64u: keyLabeled(digest),
-		authorizationId: keyLabeled(walletSessionAuthorizationId),
-		walletSessionId: keyLabeled(walletSessionId),
-		credentialDigestB64u: keyLabeled(digest),
-		installationReceiptDigestB64u: keyLabeled(digest),
-		acknowledgedAtMs: keyLabeled(parseUnixTime)
-	});
-}
-function parseLocalAuthorityActivationFinalAckV1(raw) {
-	return localAuthorityActivationFinalAckV1()(raw, "LocalAuthorityActivationFinalAckV1");
-}
-function parseActivateInstalledAuthorityResultV1(raw) {
-	const record = requireRecord(raw, "ActivateInstalledAuthorityResultV1");
-	switch (record.kind) {
-		case "active": {
-			rejectUnknownFields(record, [
-				"kind",
-				"authority",
-				"authMethod",
-				"walletSession",
-				"deliveryBinding",
-				"sealedDelivery"
-			], "ActivateInstalledAuthorityResultV1");
-			const authorityResult = parseWalletAuthorityV1(record.authority);
-			if (!authorityResult.ok || authorityResult.value.state !== "active") throw new Error("ActivateInstalledAuthorityResultV1.authority must be active");
-			const authMethod = parseWalletAuthMethodRecordV2(record.authMethod);
-			if (!authMethod || authMethod.status !== "active") throw new Error("ActivateInstalledAuthorityResultV1.authMethod must be active");
-			const walletSession = parseActiveWalletSessionV1(record.walletSession);
-			const deliveryBinding = parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1(record.deliveryBinding);
-			const sealedDelivery = parseLinkedDeviceWalletSessionCredentialDeliveryV1(record.sealedDelivery);
-			if (authorityResult.value.walletId !== authMethod.walletId || authorityResult.value.authorityId !== authMethod.walletAuthorityId || walletSession.walletId !== authorityResult.value.walletId || walletSession.authorityId !== authorityResult.value.authorityId || walletSession.authMethodId !== authMethod.walletAuthMethodId || walletSession.authorityDigestB64u !== authorityResult.value.authorityDigestB64u || walletSession.authorityRevocationEpoch !== authorityResult.value.revocationEpoch || deliveryBinding.namespace !== sealedDelivery.aad.namespace || deliveryBinding.orgId !== sealedDelivery.aad.orgId || deliveryBinding.projectId !== sealedDelivery.aad.projectId || deliveryBinding.envId !== sealedDelivery.aad.envId || deliveryBinding.tenantId !== sealedDelivery.aad.tenantId || deliveryBinding.principalId !== sealedDelivery.aad.principalId || sealedDelivery.aad.walletId !== walletSession.walletId || sealedDelivery.aad.authorityId !== walletSession.authorityId || sealedDelivery.aad.walletAuthMethodId !== walletSession.authMethodId || sealedDelivery.aad.authorizationId !== walletSession.authorizationId || sealedDelivery.aad.quotaId !== walletSession.quotaId || sealedDelivery.aad.issuedAtMs !== walletSession.issuedAtMs || sealedDelivery.aad.expiresAtMs !== walletSession.expiresAtMs) throw new Error("ActivateInstalledAuthorityResultV1 identities do not match");
-			return {
-				kind: "active",
-				authority: authorityResult.value,
-				authMethod,
-				walletSession,
-				deliveryBinding,
-				sealedDelivery
-			};
-		}
-		case "pending_local_install":
-			rejectUnknownFields(record, [
-				"kind",
-				"authorityId",
-				"reason"
-			], "ActivateInstalledAuthorityResultV1");
-			return {
-				kind: "pending_local_install",
-				authorityId: walletAuthorityId(record.authorityId, "authorityId"),
-				reason: activationRetryReasonV1()(record.reason, "ActivationRetryReasonV1")
-			};
-		case "integrity_error":
-			rejectUnknownFields(record, ["kind", "reason"], "ActivateInstalledAuthorityResultV1");
-			return {
-				kind: "integrity_error",
-				reason: parseLinkIntegrityFailureV1(record.reason)
-			};
-		default: throw new Error("ActivateInstalledAuthorityResultV1.kind is invalid");
-	}
-}
-function activationRetryReasonV1() {
-	return wireUnion("kind", [
-		wireObject({ kind: wireLiteral("installation_receipt_not_found") }),
-		wireObject({ kind: wireLiteral("server_worker_activation_pending") }),
-		wireObject({ kind: wireLiteral("wallet_session_issuance_pending") })
-	]);
-}
-function parseLinkIntegrityFailureV1(raw) {
-	const record = requireRecord(raw, "LinkIntegrityFailureV1");
-	switch (record.kind) {
-		case "authority_id_mismatch":
-			rejectUnknownFields(record, [
-				"kind",
-				"expectedAuthorityId",
-				"actualAuthorityId"
-			], "LinkIntegrityFailureV1");
-			return {
-				kind: "authority_id_mismatch",
-				expectedAuthorityId: walletAuthorityId(record.expectedAuthorityId, "expectedAuthorityId"),
-				actualAuthorityId: walletAuthorityId(record.actualAuthorityId, "actualAuthorityId")
-			};
-		case "package_set_digest_mismatch":
-			rejectUnknownFields(record, [
-				"kind",
-				"expectedPackageSetDigestB64u",
-				"actualPackageSetDigestB64u"
-			], "LinkIntegrityFailureV1");
-			return {
-				kind: "package_set_digest_mismatch",
-				expectedPackageSetDigestB64u: digest(record.expectedPackageSetDigestB64u, "expectedPackageSetDigestB64u"),
-				actualPackageSetDigestB64u: digest(record.actualPackageSetDigestB64u, "actualPackageSetDigestB64u")
-			};
-		case "installation_receipt_mismatch":
-			rejectUnknownFields(record, ["kind", "field"], "LinkIntegrityFailureV1");
-			if (record.field !== "walletId" && record.field !== "authMethodId" && record.field !== "deviceId" && record.field !== "targetFactorVerificationDigestB64u" && record.field !== "installedActivationRefs") throw new Error("LinkIntegrityFailureV1.field is invalid");
-			return {
-				kind: "installation_receipt_mismatch",
-				field: record.field
-			};
-		default: throw new Error("LinkIntegrityFailureV1.kind is invalid");
-	}
-}
 //#endregion
-export { parseActivateInstalledAuthorityResultV1, parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1 };
+export { parseLocalAuthorityInstallationReceiptV1 };
 
 //# sourceMappingURL=authorityActivation.js.map

package/dist/esm/shared-ts/src/device-linking/committedSignerPackages.js

@@ -1,270 +1,3 @@
-import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef } from "../utils/domainIds.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../utils/routerAbNormalSigningIdentity.js";
-import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, sameRouterAbEd25519YaoByteSequence } from "../utils/routerAbEd25519Yao.js";
-import { parseLinkedDeviceEd25519ExportRootPackageV1 } from "./ed25519ExportRoot.js";
-import { parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from "./sourceContribution.js";
-import { parseWalletAuthMethodRecordV2 } from "../utils/walletAuthMethodRecord.js";
-import { parseWalletAuthorityV1 } from "../authorization/walletAuthority.js";
-//#region ../shared-ts/src/device-linking/committedSignerPackages.ts
-function parseCommittedAuthorityPackagesV1(raw) {
-	const record = parseCommittedAuthorityPackagesWireV1(raw);
-	if (record.kind !== "committed_authority_packages_v1") throw new Error("CommittedAuthorityPackagesV1.kind is invalid");
-	const authority = parseWalletAuthorityV1(record.authority);
-	if (!authority.ok || authority.value.state !== "pending_local_install") throw new Error("CommittedAuthorityPackagesV1.authority is not pending");
-	const authMethod = parseWalletAuthMethodRecordV2(record.authMethod);
-	if (!authMethod || authMethod.status !== "pending_local_install") throw new Error("CommittedAuthorityPackagesV1.authMethod is not pending");
-	if (authMethod.walletId !== authority.value.walletId || authMethod.walletAuthorityId !== authority.value.authorityId) throw new Error("CommittedAuthorityPackagesV1 authority and auth method identities differ");
-	const signerPackages = parseCommittedSignerPackageSetV1(record.signerPackages);
-	assertSignerPackagesMatchAuthority(signerPackages, authority.value.signerActivations);
-	const ed25519ExportRootPackage = record.ed25519ExportRootPackage === null ? null : parseLinkedDeviceEd25519ExportRootPackageV1(record.ed25519ExportRootPackage);
-	if (ed25519ExportRootPackage) {
-		if (ed25519ExportRootPackage.walletId !== authority.value.walletId || ed25519ExportRootPackage.revocationEpoch !== authority.value.revocationEpoch || authority.value.provenance.kind !== "device_link" || ed25519ExportRootPackage.enrollmentId !== authority.value.provenance.enrollmentId || ed25519ExportRootPackage.linkSessionId !== authority.value.provenance.linkSessionId || String(ed25519ExportRootPackage.deviceId) !== String(authority.value.principal.deviceId)) throw new Error("CommittedAuthorityPackagesV1 export root identity does not match authority");
-	}
-	return {
-		kind: "committed_authority_packages_v1",
-		authority: authority.value,
-		authMethod,
-		signerPackages,
-		ed25519ExportRootPackage,
-		packageSetDigestB64u: parseCommittedSignerPackageSetDigestB64u(record.packageSetDigestB64u)
-	};
-}
-function assertSignerPackagesMatchAuthority(packages, activations) {
-	if (packages.keyFamilies.length !== activations.keyFamilies.length) throw new Error("CommittedAuthorityPackagesV1 signer families do not match authority");
-	for (let index = 0; index < packages.keyFamilies.length; index += 1) if (packages.keyFamilies[index] !== activations.keyFamilies[index]) throw new Error("CommittedAuthorityPackagesV1 signer family order does not match authority");
-	if (packages.keyFamilies.length === 1 && packages.keyFamilies[0] === "ed25519") {
-		if (!activations.ed25519 || !packages.ed25519) throw new Error("CommittedAuthorityPackagesV1 Ed25519 activation is missing");
-		if (!mpcMaterialActivationRefsEqual(packages.ed25519.materialActivation, activations.ed25519.materialActivation)) throw new Error("CommittedAuthorityPackagesV1 Ed25519 activation does not match authority");
-		return;
-	}
-	if (packages.keyFamilies.length === 1 && packages.keyFamilies[0] === "ecdsa_secp256k1") {
-		if (!activations.ecdsa || !packages.ecdsa) throw new Error("CommittedAuthorityPackagesV1 ECDSA activation is missing");
-		if (!mpcMaterialActivationRefsEqual(packages.ecdsa.materialActivation, activations.ecdsa.materialActivation)) throw new Error("CommittedAuthorityPackagesV1 ECDSA activation does not match authority");
-		return;
-	}
-	if (!activations.ed25519 || !activations.ecdsa || !packages.ed25519 || !packages.ecdsa) throw new Error("CommittedAuthorityPackagesV1 combined activations are incomplete");
-	if (!mpcMaterialActivationRefsEqual(packages.ed25519.materialActivation, activations.ed25519.materialActivation) || !mpcMaterialActivationRefsEqual(packages.ecdsa.materialActivation, activations.ecdsa.materialActivation)) throw new Error("CommittedAuthorityPackagesV1 activation references do not match authority");
-}
-function parseCommittedSignerPackageSetV1(raw) {
-	const record = parseCommittedSignerPackageSetWireV1(raw);
-	if (record.kind !== "committed_signer_package_set_v1") throw new Error("CommittedSignerPackageSetV1.kind is invalid");
-	const keyFamilies = parseKeyFamilies(record.keyFamilies);
-	if (keyFamilies.length === 1 && keyFamilies[0] === "ed25519") {
-		if (!("ed25519" in record)) throw new Error("CommittedSignerPackageSetV1 fields are invalid");
-		return {
-			kind: "committed_signer_package_set_v1",
-			keyFamilies,
-			ed25519: parseEd25519Package(record.ed25519)
-		};
-	}
-	if (keyFamilies.length === 1 && keyFamilies[0] === "ecdsa_secp256k1") {
-		if (!("ecdsa" in record)) throw new Error("CommittedSignerPackageSetV1 fields are invalid");
-		return {
-			kind: "committed_signer_package_set_v1",
-			keyFamilies,
-			ecdsa: parseEcdsaPackage(record.ecdsa)
-		};
-	}
-	if (!("ed25519" in record) || !("ecdsa" in record)) throw new Error("CommittedSignerPackageSetV1 fields are invalid");
-	const ed25519 = parseEd25519Package(record.ed25519);
-	const ecdsa = parseEcdsaPackage(record.ecdsa);
-	if (ed25519.materialActivation.activationId === ecdsa.materialActivation.activationId) throw new Error("CommittedSignerPackageSetV1 activation references must be distinct");
-	return {
-		kind: "committed_signer_package_set_v1",
-		keyFamilies,
-		ed25519,
-		ecdsa
-	};
-}
-function parseCommittedSignerPackageSetDigestB64u(raw) {
-	return parseDigestB64u(raw);
-}
-function parseEd25519Package(raw) {
-	const record = parseCommittedEd25519SignerPackageWireV1(raw);
-	if (record.kind !== "committed_ed25519_signer_package_v1") throw new Error("CommittedEd25519SignerPackageV1.kind is invalid");
-	const materialActivation = parseActivation(record.materialActivation, "materialActivation");
-	const targetBinding = parseRouterAbEd25519YaoCeremonyBindingV1(record.targetBinding);
-	const applicationBinding = parseRouterAbEd25519YaoApplicationBindingFactsV1(record.applicationBinding);
-	const activationReceipt = parseRouterAbEd25519YaoActivationPublicReceiptV1(record.activationReceipt);
-	if (!mpcMaterialActivationRefsEqual(materialActivation, routerAbMpcMaterialActivationRefFromWire(activationReceipt.material_activation))) throw new Error("CommittedEd25519SignerPackageV1 activation receipt does not match material");
-	if (!mpcMaterialActivationRefsEqual(materialActivation, routerAbMpcMaterialActivationRefFromWire(targetBinding.material_activation))) throw new Error("CommittedEd25519SignerPackageV1 target binding does not match material");
-	const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a_client_package", "deriver_a");
-	const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b_client_package", "deriver_b");
-	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverA.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverB.transcript)) throw new Error("CommittedEd25519SignerPackageV1 receipt transcript does not match packages");
-	return {
-		kind: "committed_ed25519_signer_package_v1",
-		materialActivation,
-		targetBinding,
-		applicationBinding,
-		participantIds: parseRouterAbEd25519YaoParticipantIdsV1(record.participantIds),
-		activationReceipt,
-		deriver_a_client_package: deriverA,
-		deriver_b_client_package: deriverB
-	};
-}
-function parseEcdsaPackage(raw) {
-	const record = parseCommittedEcdsaSignerPackageWireV1(raw);
-	if (record.kind !== "committed_ecdsa_signer_package_v1") throw new Error("CommittedEcdsaSignerPackageV1.kind is invalid");
-	const materialActivation = parseActivation(record.materialActivation, "materialActivation");
-	const activationReceipt = parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1(record.activationReceipt);
-	const targetActivation = activationReceipt.binding.target.activation;
-	if (!mpcMaterialActivationRefsEqual(materialActivation, targetActivation)) throw new Error("CommittedEcdsaSignerPackageV1 receipt activation does not match material");
-	const encryptedTargetClientShare = parseLinkedDeviceEcdsaEncryptedSourceContributionV1(record.encryptedTargetClientShare, "encryptedTargetClientShare");
-	if (encryptedTargetClientShare.recipientPublicKeyB64u !== activationReceipt.binding.target.clientRecipientPublicKeyB64u) throw new Error("CommittedEcdsaSignerPackageV1 client share recipient does not match receipt");
-	return {
-		kind: "committed_ecdsa_signer_package_v1",
-		materialActivation,
-		encryptedTargetClientShare,
-		activationReceipt
-	};
-}
-function parseEd25519ClientPackage(raw, label, deriver) {
-	const parsed = parseRouterAbEd25519YaoEncryptedPackageV1(raw);
-	if (!parsed.ok) throw new Error(`${label} ${parsed.message}`);
-	if (parsed.value.kind !== "activation_client" || parsed.value.deriver !== deriver) throw new Error(`${label} must be an activation_client for ${deriver}`);
-	return {
-		kind: "activation_client",
-		deriver,
-		session: parsed.value.session,
-		transcript: parsed.value.transcript,
-		encapsulated_key: parsed.value.encapsulated_key,
-		ciphertext: parsed.value.ciphertext
-	};
-}
-function parseActivation(raw, label) {
-	const parsed = parseMpcMaterialActivationRef(raw);
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
-}
-function parseKeyFamilies(raw) {
-	if (!Array.isArray(raw)) throw new Error("CommittedSignerPackageSetV1.keyFamilies must be an array");
-	if (raw.length === 1 && raw[0] === "ed25519") return ["ed25519"];
-	if (raw.length === 1 && raw[0] === "ecdsa_secp256k1") return ["ecdsa_secp256k1"];
-	if (raw.length === 2 && raw[0] === "ed25519" && raw[1] === "ecdsa_secp256k1") return ["ed25519", "ecdsa_secp256k1"];
-	throw new Error("CommittedSignerPackageSetV1.keyFamilies must use canonical family order");
-}
-function parseCommittedAuthorityPackagesWireV1(raw) {
-	const record = inspectRawObject(raw);
-	if (record === null) throw new Error("CommittedAuthorityPackagesV1 must be an object");
-	requireExactWireFields(record, [
-		"kind",
-		"authority",
-		"authMethod",
-		"signerPackages",
-		"ed25519ExportRootPackage",
-		"packageSetDigestB64u"
-	], "CommittedAuthorityPackagesV1");
-	return {
-		kind: Reflect.get(record, "kind"),
-		authority: Reflect.get(record, "authority"),
-		authMethod: Reflect.get(record, "authMethod"),
-		signerPackages: Reflect.get(record, "signerPackages"),
-		ed25519ExportRootPackage: Reflect.get(record, "ed25519ExportRootPackage"),
-		packageSetDigestB64u: Reflect.get(record, "packageSetDigestB64u")
-	};
-}
-function parseCommittedSignerPackageSetWireV1(raw) {
-	const record = inspectRawObject(raw);
-	if (record === null) throw new Error("CommittedSignerPackageSetV1 must be an object");
-	const actual = Object.keys(record);
-	const hasEd25519 = actual.includes("ed25519");
-	const hasEcdsa = actual.includes("ecdsa");
-	if (hasEd25519 && hasEcdsa) {
-		requireExactWireFields(record, [
-			"kind",
-			"keyFamilies",
-			"ed25519",
-			"ecdsa"
-		], "CommittedSignerPackageSetV1");
-		return {
-			kind: Reflect.get(record, "kind"),
-			keyFamilies: Reflect.get(record, "keyFamilies"),
-			ed25519: Reflect.get(record, "ed25519"),
-			ecdsa: Reflect.get(record, "ecdsa")
-		};
-	}
-	if (hasEd25519) {
-		requireExactWireFields(record, [
-			"kind",
-			"keyFamilies",
-			"ed25519"
-		], "CommittedSignerPackageSetV1");
-		return {
-			kind: Reflect.get(record, "kind"),
-			keyFamilies: Reflect.get(record, "keyFamilies"),
-			ed25519: Reflect.get(record, "ed25519")
-		};
-	}
-	if (hasEcdsa) {
-		requireExactWireFields(record, [
-			"kind",
-			"keyFamilies",
-			"ecdsa"
-		], "CommittedSignerPackageSetV1");
-		return {
-			kind: Reflect.get(record, "kind"),
-			keyFamilies: Reflect.get(record, "keyFamilies"),
-			ecdsa: Reflect.get(record, "ecdsa")
-		};
-	}
-	requireExactWireFields(record, ["kind", "keyFamilies"], "CommittedSignerPackageSetV1");
-	return {
-		kind: Reflect.get(record, "kind"),
-		keyFamilies: Reflect.get(record, "keyFamilies")
-	};
-}
-function parseCommittedEd25519SignerPackageWireV1(raw) {
-	const record = inspectRawObject(raw);
-	if (record === null) throw new Error("CommittedEd25519SignerPackageV1 must be an object");
-	requireExactWireFields(record, [
-		"kind",
-		"materialActivation",
-		"targetBinding",
-		"applicationBinding",
-		"participantIds",
-		"activationReceipt",
-		"deriver_a_client_package",
-		"deriver_b_client_package"
-	], "CommittedEd25519SignerPackageV1");
-	return {
-		kind: Reflect.get(record, "kind"),
-		materialActivation: Reflect.get(record, "materialActivation"),
-		targetBinding: Reflect.get(record, "targetBinding"),
-		applicationBinding: Reflect.get(record, "applicationBinding"),
-		participantIds: Reflect.get(record, "participantIds"),
-		activationReceipt: Reflect.get(record, "activationReceipt"),
-		deriver_a_client_package: Reflect.get(record, "deriver_a_client_package"),
-		deriver_b_client_package: Reflect.get(record, "deriver_b_client_package")
-	};
-}
-function parseCommittedEcdsaSignerPackageWireV1(raw) {
-	const record = inspectRawObject(raw);
-	if (record === null) throw new Error("CommittedEcdsaSignerPackageV1 must be an object");
-	requireExactWireFields(record, [
-		"kind",
-		"materialActivation",
-		"encryptedTargetClientShare",
-		"activationReceipt"
-	], "CommittedEcdsaSignerPackageV1");
-	return {
-		kind: Reflect.get(record, "kind"),
-		materialActivation: Reflect.get(record, "materialActivation"),
-		encryptedTargetClientShare: Reflect.get(record, "encryptedTargetClientShare"),
-		activationReceipt: Reflect.get(record, "activationReceipt")
-	};
-}
-function inspectRawObject(raw) {
-	return raw !== null && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
-}
-function requireExactWireFields(record, keys, label) {
-	const expected = new Set(keys);
-	const actual = Object.keys(record);
-	if (actual.length !== keys.length) throw new Error(`${label} contains unexpected fields`);
-	for (const key of actual) if (!expected.has(key)) throw new Error(`${label} contains unexpected fields`);
-	for (const key of keys) if (!Object.prototype.hasOwnProperty.call(record, key)) throw new Error(`${label}.${key} is required`);
-}
-//#endregion
-export { parseCommittedAuthorityPackagesV1, parseCommittedSignerPackageSetDigestB64u, parseCommittedSignerPackageSetV1 };
-
-//# sourceMappingURL=committedSignerPackages.js.map
+import "../utils/routerAbEd25519Yao.js";
+import "./sourceContribution.js";
+import "../authorization/walletAuthority.js";

package/dist/esm/shared-ts/src/device-linking/delegatedActivationPlan.js

@@ -1,7 +1,7 @@
-import { parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
 import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u, requireParsed } from "../passkey-custody/primitives.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
 //#region ../shared-ts/src/device-linking/delegatedActivationPlan.ts
 const MANIFEST_FIELDS = [
 	"kind",

package/dist/esm/shared-ts/src/device-linking/deviceManagement.js

@@ -88,17 +88,6 @@ function linkedDeviceListResultV1() {
 function parseLinkedDeviceListResultV1(raw) {
 	return linkedDeviceListResultV1()(raw, "LinkedDeviceListResultV1");
 }
-function linkedDeviceRevokeRequestV1() {
-	return wireObject({
-		kind: wireLiteral("linked_device_revoke_request_v1"),
-		walletId,
-		walletAuthMethodId: parseLinkedDeviceRevokeWalletAuthMethodId,
-		requestedAtMs: parseUnixTime
-	});
-}
-function parseLinkedDeviceRevokeRequestV1(raw) {
-	return linkedDeviceRevokeRequestV1()(raw, "LinkedDeviceRevokeRequestV1");
-}
 function linkedDeviceRevokeFailureV1() {
 	return wireObject({ kind: wireLiteral("not_found", "conflict", "unauthorized") });
 }
@@ -115,6 +104,6 @@ function parseLinkedDeviceRevokeResultV1(raw) {
 	return (record.kind === "not_found" || record.kind === "conflict" || record.kind === "unauthorized" ? linkedDeviceRevokeFailureV1() : linkedDeviceRevokedV1())(record, "LinkedDeviceRevokeResultV1");
 }
 //#endregion
-export { parseLinkedDeviceListRequestV1, parseLinkedDeviceListResultV1, parseLinkedDeviceRevokeRequestV1, parseLinkedDeviceRevokeResultV1, parseLinkedDeviceSummaryV1 };
+export { parseLinkedDeviceListRequestV1, parseLinkedDeviceListResultV1, parseLinkedDeviceRevokeResultV1, parseLinkedDeviceSummaryV1 };
 
 //# sourceMappingURL=deviceManagement.js.map