@seams/wallet-server 0.6.1 → 0.7.1

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmission.d.ts

@@ -0,0 +1,360 @@
+import type { RouterAbNormalSigningAuthorizationIdentity } from '../../../core/routerAbSigning/RouterAbNormalSigningRuntime';
+import type { RouterAbNormalSigningRuntime } from '../../../core/routerAbSigning/RouterAbNormalSigningRuntime';
+import type { ThresholdEd25519AuthorityScope } from '../../../core/types';
+import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
+import type { WalletSessionFailureCode } from '../../../../../shared-ts/src/utils/walletSessionFailure';
+import type { AuthorizationParseResult } from '../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { AuthorizedOperation, AuthorizedOperationReplayResponse, OwnerOperationStepUpReason } from '../../../authorization/domain';
+import type { RouterAbMpcMaterialActivationRefWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import { type MpcMaterialActivationId } from '../../../../../shared-ts/src/utils/domainIds';
+type RouterAbAcceptedAuthorizedOperationBindingV1 = {
+    readonly kind: 'reusable_wallet_session';
+    readonly walletSessionId: string;
+    readonly quotaId: string;
+} | {
+    readonly kind: 'gateway_owner_wallet_session';
+    readonly subjectId: string;
+    readonly accountId: string;
+    readonly authorizationId: string;
+    readonly walletSessionId: string;
+    readonly quotaId: string;
+    readonly thresholdSessionId: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly environment: string;
+    readonly signingWorkerId: string;
+    readonly expiresAtMs: number;
+} | {
+    readonly kind: 'operation_step_up';
+    readonly authorizationSessionId: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly environment: string;
+    readonly subjectId: string;
+};
+export declare function buildRouterAbEd25519AcceptedAuthorizedOperationV1(input: {
+    readonly operation: AuthorizedOperation;
+    readonly binding: RouterAbAcceptedAuthorizedOperationBindingV1;
+}): {
+    binding: {
+        kind: "reusable_wallet_session";
+        authorization_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").WalletSessionAuthorizationId;
+        wallet_session_id: string;
+        quota_id: string;
+        subject_id?: undefined;
+        account_id?: undefined;
+        threshold_session_id?: undefined;
+        org_id?: undefined;
+        project_id?: undefined;
+        environment?: undefined;
+        signing_worker_id?: undefined;
+        expires_at_ms?: undefined;
+        authorization_session_id?: undefined;
+    };
+    authorized_operation: {
+        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
+        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
+        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
+        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
+        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
+        kind: "reusable_wallet_session_authorized_operation_v1";
+    };
+} | {
+    binding: {
+        kind: "gateway_owner_wallet_session";
+        subject_id: string;
+        account_id: string;
+        authorization_id: string;
+        wallet_session_id: string;
+        quota_id: string;
+        threshold_session_id: string;
+        org_id: string;
+        project_id: string;
+        environment: string;
+        signing_worker_id: string;
+        expires_at_ms: number;
+        authorization_session_id?: undefined;
+    };
+    authorized_operation: {
+        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
+        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
+        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
+        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
+        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
+        kind: "reusable_wallet_session_authorized_operation_v1";
+    };
+} | {
+    binding: {
+        kind: "operation_step_up";
+        authorization_session_id: string;
+        org_id: string;
+        project_id: string;
+        environment: string;
+        subject_id: string;
+        authorization_id?: undefined;
+        wallet_session_id?: undefined;
+        quota_id?: undefined;
+        account_id?: undefined;
+        threshold_session_id?: undefined;
+        signing_worker_id?: undefined;
+        expires_at_ms?: undefined;
+    };
+    authorized_operation: {
+        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
+        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
+        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
+        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
+        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
+        kind: "verified_step_up_authorized_operation_v1";
+        authorization_session_id: string;
+        evidence_set_digest: import("../../../../../shared-ts/src/utils").DigestB64u;
+    };
+};
+export declare function buildRouterAbEcdsaAcceptedAuthorizedOperationV1(input: {
+    readonly operation: AuthorizedOperation;
+    readonly binding: RouterAbAcceptedAuthorizedOperationBindingV1;
+}): {
+    binding: {
+        kind: "reusable_wallet_session";
+        authorization_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").WalletSessionAuthorizationId;
+        wallet_session_id: string;
+        quota_id: string;
+        subject_id?: undefined;
+        account_id?: undefined;
+        threshold_session_id?: undefined;
+        org_id?: undefined;
+        project_id?: undefined;
+        environment?: undefined;
+        signing_worker_id?: undefined;
+        expires_at_ms?: undefined;
+        authorization_session_id?: undefined;
+    };
+    authorized_operation: {
+        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
+        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
+        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
+        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
+        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
+        kind: "reusable_wallet_session_authorized_operation_v1";
+    };
+} | {
+    binding: {
+        kind: "gateway_owner_wallet_session";
+        subject_id: string;
+        account_id: string;
+        authorization_id: string;
+        wallet_session_id: string;
+        quota_id: string;
+        threshold_session_id: string;
+        org_id: string;
+        project_id: string;
+        environment: string;
+        signing_worker_id: string;
+        expires_at_ms: number;
+        authorization_session_id?: undefined;
+    };
+    authorized_operation: {
+        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
+        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
+        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
+        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
+        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
+        kind: "reusable_wallet_session_authorized_operation_v1";
+    };
+} | {
+    binding: {
+        kind: "operation_step_up";
+        authorization_session_id: string;
+        org_id: string;
+        project_id: string;
+        environment: string;
+        subject_id: string;
+        authorization_id?: undefined;
+        wallet_session_id?: undefined;
+        quota_id?: undefined;
+        account_id?: undefined;
+        threshold_session_id?: undefined;
+        signing_worker_id?: undefined;
+        expires_at_ms?: undefined;
+    };
+    authorized_operation: {
+        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
+        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
+        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
+        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
+        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
+        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
+        kind: "verified_step_up_authorized_operation_v1";
+        authorization_session_id: string;
+        evidence_set_digest: import("../../../../../shared-ts/src/utils").DigestB64u;
+    };
+};
+export type RouterAbSigningWorkerJsonResult = {
+    ok: true;
+    body: unknown;
+    replay: AuthorizedOperationReplayResponse;
+} | {
+    ok: false;
+    status: number;
+    body: {
+        ok: false;
+        code: string;
+        message: string;
+    };
+};
+export type RouterAbSigningWorkerJsonError = Extract<RouterAbSigningWorkerJsonResult, {
+    ok: false;
+}>;
+export type RouterAbJsonRouteResult = {
+    status: number;
+    body: unknown;
+};
+export type RouterAbEcdsaOperationAdmissionKind = 'claimed' | 'operation_in_progress' | 'replayed';
+export type RouterAbEcdsaOperationAdmission = {
+    readonly kind: RouterAbEcdsaOperationAdmissionKind;
+    readonly operation: AuthorizedOperation;
+};
+export declare function routerAbOwnerOperationStepUpDecision<TStepUp>(input: {
+    readonly code: string;
+    readonly phase: 'prepare' | 'finalize';
+    readonly stepUp?: TStepUp;
+}): {
+    readonly kind: 'step_up_required';
+    readonly reason: OwnerOperationStepUpReason;
+    readonly step_up: TStepUp;
+} | {
+    readonly kind: 'denied';
+    readonly denial: {
+        readonly code: 'authorization_unavailable';
+        readonly message: string;
+    };
+} | null;
+export declare function routerAbOwnerOperationFailureResult(input: {
+    readonly status: number;
+    readonly code: string;
+    readonly message: string;
+}, decision: object | null): RouterAbJsonRouteResult;
+export type RouterAbNormalSigningRouteRuntime = Pick<RouterAbNormalSigningRuntime, 'getSigningWorkerPrivateTransport' | 'reservePrepareReplay'>;
+type AcceptedRouteAdmission = {
+    ok: true;
+    thresholdSessionId: string;
+    requestId: string;
+    expiresAtMs: number;
+    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+};
+export type AcceptedEcdsaRouteAdmission = AcceptedRouteAdmission & {
+    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+};
+type RejectedRouteAdmission = {
+    ok: false;
+    error: RouterAbSigningWorkerJsonError;
+};
+export type RouterAbNormalSigningRouteAdmission = AcceptedRouteAdmission | AcceptedEcdsaRouteAdmission | RejectedRouteAdmission;
+export type RouterAbNormalSigningAdmissionFailureCode = 'project_policy_rejected' | 'abuse_rejected' | 'rate_limited' | 'unauthorized' | 'invalid_body' | 'not_configured' | 'internal';
+export type RouterAbNormalSigningAdmissionFailure = {
+    ok: false;
+    status: 400 | 401 | 403 | 408 | 409 | 429 | 500 | 501 | 503;
+    code: RouterAbNormalSigningAdmissionFailureCode;
+    message: string;
+};
+export type RouterAbNormalSigningAdmissionResult = {
+    ok: true;
+} | RouterAbNormalSigningAdmissionFailure;
+export type RouterAbNormalSigningAdmissionInput = {
+    curve: 'ed25519';
+    authorityKind: 'wallet_authority_v1';
+    authorityId: string;
+    authorityScope?: never;
+    phase: 'prepare' | 'finalize';
+    walletId: string;
+    thresholdSessionId: string;
+    walletSessionId: string;
+    quotaId: string;
+    requestId: string;
+    expiresAtMs: number;
+    signingWorkerId: string;
+    runtimePolicyScope: RuntimePolicyScope;
+} | {
+    curve: 'ed25519';
+    authorityKind?: never;
+    authorityId?: never;
+    phase: 'prepare' | 'finalize';
+    walletId: string;
+    authorityScope: ThresholdEd25519AuthorityScope;
+    thresholdSessionId: string;
+    walletSessionId: string;
+    quotaId: string;
+    requestId: string;
+    expiresAtMs: number;
+    signingWorkerId: string;
+    runtimePolicyScope: RuntimePolicyScope;
+} | {
+    curve: 'ecdsa';
+    phase: 'prepare' | 'finalize';
+    walletId: string;
+    materialActivationId: MpcMaterialActivationId;
+    authorizationIdentity: RouterAbNormalSigningAuthorizationIdentity;
+    requestId: string;
+    expiresAtMs: number;
+    signingWorkerId: string;
+    keyHandle: string;
+    runtimePolicyScope: RuntimePolicyScope;
+};
+export interface RouterAbNormalSigningAdmissionAdapter {
+    evaluatePolicy(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningAdmissionResult>;
+}
+export type RouterAbNormalSigningAdmissionEvaluationInput = {
+    adapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
+    curve: 'ed25519';
+    authorizationKind: 'wallet_session_operation_credential_v1';
+    phase: 'prepare' | 'finalize';
+    walletId: string;
+    authorityId: string;
+    thresholdSessionId: string;
+    walletSessionId: string;
+    quotaId: string;
+    requestId: string;
+    expiresAtMs: number;
+    signingWorkerId: string;
+    runtimePolicyScope: RuntimePolicyScope;
+} | {
+    adapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
+    curve: 'ecdsa';
+    authorizationKind: 'wallet_session_operation_credential_v1';
+    phase: 'prepare' | 'finalize';
+    walletId: string;
+    walletSessionId: string;
+    materialActivation: RouterAbMpcMaterialActivationRefWire;
+    requestId: string;
+    expiresAtMs: number;
+    signingWorkerId: string;
+    keyHandle: string;
+    runtimePolicyScope: RuntimePolicyScope;
+    admission: AcceptedEcdsaRouteAdmission;
+};
+export declare function evaluateRouterAbNormalSigningAdmission(input: RouterAbNormalSigningAdmissionEvaluationInput): Promise<RouterAbNormalSigningAdmissionResult>;
+export declare function routerAbSigningError(status: number, code: string, message: string): RouterAbSigningWorkerJsonError;
+export declare function routerAbWalletSessionValidationStatus(code: 'sessions_disabled' | WalletSessionFailureCode): number;
+export declare function requireMpcMaterialActivationId(value: unknown): MpcMaterialActivationId;
+export declare function requireAuthorizationValue<T>(result: AuthorizationParseResult<T>): T;
+export declare function routerAbStepUpError(status: number, code: string, message: string): RouterAbJsonRouteResult;
+export declare function routerAbErrorMessage(error: unknown): string;
+export {};
+//# sourceMappingURL=routerAbNormalSigningAdmission.d.ts.map

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.d.ts

@@ -1,5 +1,5 @@
 import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
-import type { RouterAbNormalSigningAdmissionAdapter, RouterAbNormalSigningAdmissionInput } from './routerAbPrivateSigningWorker';
+import type { RouterAbNormalSigningAdmissionAdapter, RouterAbNormalSigningAdmissionInput } from './routerAbNormalSigningAdmission';
 export type RouterAbNormalSigningProjectPolicyDecision = {
     kind: 'allowed';
 } | {
@@ -15,13 +15,15 @@ export type RouterAbNormalSigningAbuseDecision = {
     kind: 'rejected';
     retryAfterMs: number;
 };
-export interface RouterAbNormalSigningProjectPolicyProvider {
-    evaluateProjectPolicy(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningProjectPolicyDecision>;
-}
-export interface RouterAbNormalSigningAbuseProvider {
-    evaluateAbuse(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningAbuseDecision>;
-}
-export interface RouterAbNormalSigningAdmissionStore extends RouterAbNormalSigningProjectPolicyProvider, RouterAbNormalSigningAbuseProvider {
+export type RouterAbNormalSigningPolicyDecision = {
+    readonly kind: 'allowed';
+    readonly retryAfterMs?: never;
+} | {
+    readonly kind: 'project_policy_rejected' | 'abuse_rejected' | 'rate_limited';
+    readonly retryAfterMs: number;
+};
+export interface RouterAbNormalSigningAdmissionStore {
+    evaluatePolicy(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningPolicyDecision>;
 }
 export declare class InMemoryRouterAbNormalSigningAdmissionStore implements RouterAbNormalSigningAdmissionStore {
     private readonly projectPolicies;
@@ -30,8 +32,7 @@ export declare class InMemoryRouterAbNormalSigningAdmissionStore implements Rout
     clearProjectPolicy(scope: RuntimePolicyScope): void;
     setAbuseDecision(input: RouterAbNormalSigningAdmissionInput, decision: RouterAbNormalSigningAbuseDecision): void;
     clearAbuseDecision(input: RouterAbNormalSigningAdmissionInput): void;
-    evaluateProjectPolicy(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningProjectPolicyDecision>;
-    evaluateAbuse(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningAbuseDecision>;
+    evaluatePolicy(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningPolicyDecision>;
 }
 export declare function createRouterAbNormalSigningAdmissionAdapter(store: RouterAbNormalSigningAdmissionStore, options?: {
     readonly now?: () => number;

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=routerAbNormalSigningAdmissionCore.typecheck.d.ts.map

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbOperationStepUp.d.ts

@@ -0,0 +1,165 @@
+import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
+import type { RouterApiAuthorizedOperationService, RouterApiAuthorizationSessionService, RouterApiWalletRegistrationService, RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext } from '../../framework/authServicePort';
+import { resolveWalletSessionAuthorizationV2Admission } from './walletExecutionAdmission';
+import type { WalletExecutionLaneAuthSource } from '../../../core/signingLanes/WalletExecutionLaneProjection';
+import { type WalletAuthAuthority, type WalletAuthAuthorityRef } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
+import { type PrincipalId, type TenantId } from '../../../../../shared-ts/src/authorization/capabilityKinds';
+import { type AuthorizedOperation, type AuthorizedOperationInput, type SessionOrigin } from '../../../authorization/domain';
+import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import type { Ed25519OperationKind } from './ed25519AuthorizedOperationReceipt';
+import { type WalletAuthMethodId } from '../../../../../shared-ts/src/utils/domainIds';
+import { type RouterAbJsonRouteResult } from './routerAbNormalSigningAdmission';
+export type ActiveEd25519MaterialActivation = Extract<Awaited<ReturnType<RouterApiWalletRegistrationService['resolveEd25519MaterialActivation']>>, {
+    readonly ok: true;
+}>;
+export type ActiveEcdsaMaterialActivation = Extract<Awaited<ReturnType<RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation']>>, {
+    readonly ok: true;
+}>;
+type RouterAbOperationStepUpWalletSessionBase = {
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly sessionId: string;
+    readonly walletId: string;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+};
+export type RouterAbExactOperationStepUpWalletSession = RouterAbOperationStepUpWalletSessionBase & {
+    readonly laneAuthorization: {
+        readonly kind: 'wallet_auth_method';
+        readonly walletAuthMethodId: WalletAuthMethodId;
+    };
+};
+type RouterAbVerifiedOwnerOperationStepUpWalletSession = RouterAbOperationStepUpWalletSessionBase & {
+    readonly laneAuthorization: {
+        readonly kind: 'authority_ref';
+        readonly authorityRef: WalletAuthAuthorityRef;
+        readonly authSource: WalletExecutionLaneAuthSource;
+    };
+};
+export type RouterAbOperationStepUpWalletSession = RouterAbExactOperationStepUpWalletSession | RouterAbVerifiedOwnerOperationStepUpWalletSession;
+type RouterAbEd25519OperationStepUpSessionResolution = {
+    readonly ok: true;
+    readonly activeMaterial: ActiveEd25519MaterialActivation;
+    readonly session: RouterAbExactOperationStepUpWalletSession;
+} | RouterAbOperationStepUpAuthenticationFailure;
+export declare function resolveRouterAbEd25519OperationStepUpSession(input: {
+    readonly walletId: string;
+    readonly materialOwner: string;
+    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    readonly requestExpiresAtMs: number;
+    readonly operationKind: Ed25519OperationKind;
+    readonly authorizedOperations: RouterApiAuthorizedOperationService;
+    readonly session: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session'];
+    readonly admission: Extract<ReturnType<typeof resolveWalletSessionAuthorizationV2Admission>, {
+        readonly ok: true;
+        readonly keyFamily: 'ed25519';
+    }>;
+    readonly resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'];
+}): Promise<RouterAbEd25519OperationStepUpSessionResolution>;
+type RouterAbExactOperationStepUpIdentityInput = {
+    readonly kind: 'wallet_session_operation_credential_v1';
+    readonly headers: Record<string, string | string[] | undefined>;
+    readonly walletId: string;
+    readonly materialOwner: string;
+    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    readonly requestExpiresAtMs: number;
+    readonly authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
+    readonly authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
+} & ({
+    readonly keyFamily: 'ed25519';
+    readonly operationKind: Ed25519OperationKind;
+    readonly resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'];
+    readonly resolveEcdsaMaterialActivation?: never;
+} | {
+    readonly keyFamily: 'ecdsa_secp256k1';
+    readonly operationKind: 'evm.sign_transaction' | 'evm.export_key';
+    readonly resolveEd25519MaterialActivation?: never;
+    readonly resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
+});
+type RouterAbVerifiedOwnerOperationStepUpIdentityInput = {
+    readonly kind: 'verified_owner_proof';
+    readonly headers: Record<string, string | string[] | undefined>;
+    readonly walletId: string;
+    readonly materialOwner: string;
+    readonly operationId: string;
+    readonly authority: WalletAuthAuthority;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+    readonly expiresAtMs: number;
+    readonly authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
+    readonly authorizationSessions?: never;
+    readonly keyFamily?: never;
+    readonly operationKind?: never;
+    readonly materialActivation?: never;
+    readonly requestExpiresAtMs?: never;
+    readonly resolveEd25519MaterialActivation?: never;
+    readonly resolveEcdsaMaterialActivation?: never;
+};
+export type RouterAbOperationStepUpAuthenticationFailure = {
+    readonly ok: false;
+    readonly error: RouterAbJsonRouteResult;
+};
+type RouterAbOperationStepUpAuthenticationSuccess<TSession extends RouterAbOperationStepUpWalletSession> = {
+    readonly ok: true;
+    readonly authorizedOperations: RouterApiAuthorizedOperationService;
+    readonly session: TSession;
+    readonly requestOrigin: SessionOrigin;
+    readonly expiresAtMs: number;
+};
+export type RouterAbExactOperationStepUpAuthenticationResult = RouterAbOperationStepUpAuthenticationSuccess<RouterAbExactOperationStepUpWalletSession> | RouterAbOperationStepUpAuthenticationFailure;
+type RouterAbVerifiedOwnerOperationStepUpAuthenticationResult = (RouterAbOperationStepUpAuthenticationSuccess<RouterAbVerifiedOwnerOperationStepUpWalletSession> & {
+    readonly authorityRef: WalletAuthAuthorityRef;
+}) | RouterAbOperationStepUpAuthenticationFailure;
+export declare function walletSessionUnavailableFailure(): RouterAbOperationStepUpAuthenticationFailure;
+export declare function walletSessionScopeInvalidFailure(): RouterAbOperationStepUpAuthenticationFailure;
+export declare function parseStepUpRequestOrigin(headers: Record<string, string | string[] | undefined>): {
+    readonly ok: true;
+    readonly requestOrigin: SessionOrigin;
+} | RouterAbOperationStepUpAuthenticationFailure;
+export declare function walletSessionCandidateAdmission(session: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session'], candidate: Pick<RouterApiWalletSessionAuthorizationV2AdmissionContext, 'authority' | 'authMethod' | 'retiredAtMs'>, operation: {
+    readonly keyFamily: 'ed25519';
+    readonly operationKind: Ed25519OperationKind;
+} | {
+    readonly keyFamily: 'ecdsa_secp256k1';
+    readonly operationKind: 'evm.sign_transaction';
+}): import("./walletExecutionAdmission").WalletSessionAuthorizationV2AdmissionResult;
+export declare function readExhaustedWalletSessionCandidate(input: {
+    readonly authorizationSessions: RouterApiAuthorizationSessionService;
+    readonly token: string;
+    readonly operation: Parameters<typeof walletSessionCandidateAdmission>[2];
+}): Promise<{
+    readonly ok: true;
+    readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
+    readonly session: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext['status']['session'];
+    readonly admission: ReturnType<typeof walletSessionCandidateAdmission>;
+} | RouterAbOperationStepUpAuthenticationFailure | null>;
+export declare function ecdsaStepUpActiveMaterial(input: {
+    readonly activeMaterial: Awaited<ReturnType<RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation']>>;
+    readonly admittedMaterialActivation: RouterAbMpcMaterialActivationRefWire;
+    readonly walletId: string;
+    readonly signer: {
+        readonly thresholdPublicKey33B64u: string;
+        readonly evmAddress: string;
+    };
+}): {
+    readonly ok: true;
+    readonly activeMaterial: ActiveEcdsaMaterialActivation;
+} | RouterAbOperationStepUpAuthenticationFailure;
+export declare function exactOperationStepUpSession(input: {
+    readonly session: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session'];
+    readonly authorizedOperations: Pick<RouterApiAuthorizedOperationService, 'tenantId'>;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+}): {
+    readonly ok: true;
+    readonly session: RouterAbExactOperationStepUpWalletSession;
+} | RouterAbOperationStepUpAuthenticationFailure;
+export declare function authenticateRouterAbWalletOperationStepUpIdentity(input: RouterAbExactOperationStepUpIdentityInput): Promise<RouterAbExactOperationStepUpAuthenticationResult>;
+export declare function authenticateRouterAbWalletOperationStepUpIdentity(input: RouterAbVerifiedOwnerOperationStepUpIdentityInput): Promise<RouterAbVerifiedOwnerOperationStepUpAuthenticationResult>;
+export declare function recordedStepUpOperationClaim(existing: AuthorizedOperation): {
+    readonly ok: true;
+    readonly operation: AuthorizedOperationInput;
+} | {
+    readonly ok: false;
+    readonly error: RouterAbJsonRouteResult;
+};
+export declare function routerAbOperationStepUpClaimFailure(result: Awaited<ReturnType<RouterApiAuthorizedOperationService['admitAuthorizedOperation']>>): RouterAbJsonRouteResult | null;
+export {};
+//# sourceMappingURL=routerAbOperationStepUp.d.ts.map