@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js

@@ -2,6 +2,9 @@ import { InMemoryRouterAbEd25519YaoRegistrationService } from "../registration/r
 import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter } from "../registration/routerAbEd25519YaoRegistrationIntentAuthorization.js";
 import { InMemoryRouterAbEd25519YaoRecoveryService } from "../recovery/routerAbEd25519YaoRecovery.js";
 import { routerAbEd25519YaoPersistedCapabilityMatchesLookupV1 } from "./routerAbEd25519YaoProductRegistration.js";
+import { parseRouterAbEd25519YaoRegistrationRouterAnswerV1 } from "../registration/routerAbEd25519YaoHttpRegistrationBackend.js";
+import { pinRouterAbEd25519YaoRegistrationDispatchRootV1, routerAbEd25519YaoRegistrationExecuteRequestFromRouterRequestJsonV1, routerAbEd25519YaoRegistrationResultFromRouterAnswerV1 } from "../registration/routerAbEd25519YaoRegistrationExecutionRecord.js";
+import { routerAbEd25519YaoAdmittedRegistrationAuthorityV1 } from "./routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
 //#region src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.ts
 const SHARED_CAPABILITY_READ_LIFECYCLE_ID = "shared-capability-read";
 const MAX_DETERMINISTIC_COMMIT_ATTEMPTS = 2;
@@ -9,6 +12,7 @@ const UNUSED_BACKEND = {
 	admit: rejectUnusedBackend,
 	execute: rejectUnusedBackend,
 	admitRecovery: rejectUnusedBackend,
+	resolveRecoveryDispatchRoot: rejectUnusedBackend,
 	executeRecovery: rejectUnusedBackend,
 	activateRecovery: rejectUnusedBackend
 };
@@ -38,8 +42,54 @@ var RouterAbEd25519YaoProductRegistrationRequestScopedRuntime = class {
 			backend: this.input.registrationBackend
 		});
 	}
+	/**
+	* Consumes a registration's activation at the Router, which owns its
+	* execution: the first consumer binding wins, and the same binding
+	* replays. The admission and the tenant root pinned with it come from this
+	* Gateway's ceremony record, and the result is derived from the Router's
+	* recorded answer: no active-root lookup is needed.
+	*/
 	async consumeActivated(input) {
-		return await this.input.store.consumeRegistrationExecution(input);
+		const lifecycleId = input.reference.lifecycleId;
+		const authority = routerAbEd25519YaoAdmittedRegistrationAuthorityV1((await this.input.store.load(lifecycleId)).state, lifecycleId);
+		if (!authority) return {
+			ok: false,
+			code: "unknown_registration",
+			message: "registration lifecycle was not found"
+		};
+		const backend = this.input.registrationBackend;
+		const consumed = await backend.consumeRegistration({
+			tenantRoot: authority.dispatchRoot,
+			walletId: authority.admissionReceipt.binding.lifecycle.account_id,
+			lifecycleId,
+			sessionId: input.reference.sessionId,
+			consumerBinding: input.consumerBinding
+		});
+		switch (consumed.kind) {
+			case "unavailable": throw new Error(`Router registration consumption is unavailable: ${consumed.message}`);
+			case "refused": return {
+				ok: false,
+				code: consumed.code,
+				message: consumed.message
+			};
+			case "consumed": break;
+		}
+		const request = routerAbEd25519YaoRegistrationExecuteRequestFromRouterRequestJsonV1(consumed.requestJson);
+		const result = routerAbEd25519YaoRegistrationResultFromRouterAnswerV1({
+			backend,
+			authority,
+			request,
+			answer: parseRouterAbEd25519YaoRegistrationRouterAnswerV1(consumed.responseJson, request)
+		});
+		if (!result.ok) throw new Error(`Router recorded answer is not a verifiable activation: ${result.message}`);
+		return {
+			ok: true,
+			activation: {
+				admissionRequest: authority.admissionRequest,
+				admissionReceipt: authority.admissionReceipt,
+				result: result.value
+			}
+		};
 	}
 	async installRegistrationFinalizeCapability(input) {
 		return await this.commitUntilReconciled(input.registrationAdmissionRequest.scope.lifecycle_id, installRegistrationFinalizeCapabilityMutation.bind(void 0, input));
@@ -70,9 +120,15 @@ var RouterAbEd25519YaoProductRegistrationRequestScopedRuntime = class {
 		throw new Error("Request-scoped product state remained contended after one reconciliation");
 	}
 };
+/**
+* Binds a verified intent and admits its registration. The tenant root the
+* registration dispatches to is resolved once, for a fresh admission, and
+* pinned with the admission in the ceremony record.
+*/
 async function bindAndAdmitVerifiedRegistration(input) {
 	const lifecycleId = input.input.admissionRequest.scope.lifecycle_id;
 	let backendResult = null;
+	let dispatchRoot = null;
 	for (let attempt = 0; attempt < MAX_DETERMINISTIC_COMMIT_ATTEMPTS; attempt += 1) {
 		const loaded = await input.store.load(lifecycleId);
 		const bound = await new InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter(loaded.state.authorization).bindVerifiedIntent(input.input);
@@ -85,6 +141,16 @@ async function bindAndAdmitVerifiedRegistration(input) {
 			value: preparation.value
 		};
 		if (preparation.kind === "failed") return preparation.failure;
+		if (dispatchRoot === null) try {
+			dispatchRoot = await input.backend.resolveRegistrationDispatchRoot(bound.admissionRequest);
+		} catch (error) {
+			return {
+				ok: false,
+				status: 503,
+				code: "admission_failed",
+				message: `registration tenant root is unavailable: ${error instanceof Error ? error.message : String(error)}`
+			};
+		}
 		if (backendResult === null) try {
 			backendResult = await input.backend.admit(bound.admissionRequest);
 		} catch (error) {
@@ -104,6 +170,7 @@ async function bindAndAdmitVerifiedRegistration(input) {
 			}
 		});
 		if (!admitted.ok) return admitted;
+		pinRouterAbEd25519YaoRegistrationDispatchRootV1(loaded.state.registration, lifecycleId, dispatchRoot);
 		if ((await input.store.commit(commitInput(lifecycleId, loaded))).kind === "stored") return admitted;
 	}
 	return {
@@ -150,7 +217,8 @@ function commitInput(lifecycleId, loaded) {
 	return {
 		lifecycleId,
 		state: loaded.state,
-		baseline: loaded.baseline
+		baseline: loaded.baseline,
+		companionWrite: null
 	};
 }
 async function rejectUnusedBackend() {

package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js

@@ -1,13 +1,14 @@
 import { parseEmailOtpChallengeId, parseThresholdEd25519SessionId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, deriveRouterAbEd25519YaoExportAuthorizationDigestV1, deriveRouterAbEd25519YaoExportConfirmationDigestV1, deriveRouterAbEd25519YaoRuntimePolicyBindingV1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportAdmissionRequestV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { deriveRouterAbEd25519YaoExportAuthorizationDigestV1, deriveRouterAbEd25519YaoExportConfirmationDigestV1, deriveRouterAbEd25519YaoRuntimePolicyBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
+import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportAdmissionRequestV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
@@ -154,14 +155,6 @@ function authorizationConflict(code, message) {
 		message
 	};
 }
-function authorizationUnavailable(code, message) {
-	return {
-		ok: false,
-		status: 503,
-		code,
-		message
-	};
-}
 function assertNeverExportState(value) {
 	throw new Error(`Unhandled Ed25519 Yao export state: ${String(value)}`);
 }
@@ -171,8 +164,6 @@ function exportStateHasReceipt(state) {
 		case "executing":
 		case "execution_failed":
 		case "completed": return true;
-		case "authorizing":
-		case "authorization_failed":
 		case "authorized":
 		case "admitting":
 		case "admission_failed": return false;
@@ -191,21 +182,15 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 	recordAuthorizationUncertain(request) {
 		this.state.authorizationUncertain.add(exportKey(request));
 	}
-	async admitExport(request, authorizationIdentity, traceContext) {
-		const authorizationFingerprint = exportKey(request);
-		const authorization = this.prepareAuthorizeExport(request, authorizationFingerprint, authorizationIdentity);
-		if (authorization.kind === "claimed") {
-			const authorized = this.commitAuthorizeExport({
-				request,
-				claim: authorization.claim,
-				outcome: { ok: true }
-			});
-			if (!authorized.ok) return failure({
-				status: authorized.status === 503 ? 503 : 409,
-				code: "admission_failed",
-				message: authorized.message
-			});
-		} else if (!authorization.value.ok) return failure({
+	async admitExport(request, authorizationIdentity, admission, factorRelease, traceContext) {
+		const admitted = await admission.admit();
+		if (!admitted.ok) return failure({
+			status: admitted.status === 503 ? 503 : 409,
+			code: "admission_failed",
+			message: admitted.message
+		});
+		const authorization = this.authorizeExport(request, exportKey(request), authorizationIdentity, factorRelease);
+		if (authorization.kind === "completed" && !authorization.value.ok) return failure({
 			status: authorization.value.status === 503 ? 503 : 409,
 			code: "admission_failed",
 			message: authorization.value.message
@@ -235,7 +220,13 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			outcome
 		});
 	}
-	prepareAuthorizeExport(request, authorizationFingerprint, authorizationIdentity) {
+	/**
+	* Authorizes one export: its nonce claimed and its state `authorized`, in
+	* this state for the caller to commit with the export's operation
+	* admission. An export already here answers from its state instead, with
+	* the factor release it recorded.
+	*/
+	authorizeExport(request, authorizationFingerprint, authorizationIdentity, factorRelease) {
 		const key = exportKey(request);
 		const existing = this.state.exports.get(key);
 		if (existing) {
@@ -248,14 +239,6 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 				value: authorizationConflict("export_authorization_conflict", "Export authorization changed for an existing request")
 			};
 			switch (existing.kind) {
-				case "authorizing": return {
-					kind: "completed",
-					value: authorizationUnavailable("export_authorization_uncertain", "Export authorization outcome is uncertain and cannot be retried")
-				};
-				case "authorization_failed": return {
-					kind: "completed",
-					value: existing.failure
-				};
 				case "authorized":
 				case "admitting":
 				case "admission_failed":
@@ -264,7 +247,10 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 				case "execution_failed":
 				case "completed": return {
 					kind: "completed",
-					value: { ok: true }
+					value: {
+						ok: true,
+						...existing.factorRelease ? { factorRelease: existing.factorRelease } : {}
+					}
 				};
 				default: return assertNeverExportState(existing);
 			}
@@ -276,50 +262,18 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 		};
 		this.state.authorizationNonces.add(nonce);
 		this.state.exports.set(key, {
-			kind: "authorizing",
+			kind: "authorized",
 			request,
 			authorizationFingerprint,
-			authorizationIdentity
+			authorizationIdentity,
+			factorRelease
 		});
-		return {
-			kind: "claimed",
-			claim: {
-				kind: "router_ab_ed25519_yao_export_authorization_claim_v1",
-				lifecycleId: request.scope.lifecycle_id,
-				exportKey: key,
-				authorizationFingerprint
-			}
-		};
+		return { kind: "authorized" };
 	}
 	readAuthorizationIdentity(request) {
 		return this.state.exports.get(exportKey(request))?.authorizationIdentity ?? null;
 	}
-	authorizationRequiresActiveIdentity(request) {
-		return this.state.exports.get(exportKey(request))?.kind === "authorized";
-	}
-	commitAuthorizeExport(input) {
-		const key = exportKey(input.request);
-		const current = this.state.exports.get(input.claim.exportKey);
-		if (current?.kind !== "authorizing" || input.claim.lifecycleId !== input.request.scope.lifecycle_id || input.claim.exportKey !== key || input.claim.authorizationFingerprint !== current.authorizationFingerprint || !sameExportAdmissionRequestV1(current.request, input.request)) return authorizationUnavailable("export_authorization_uncertain", "Export authorization claim is no longer current");
-		if (!input.outcome.ok) {
-			this.state.exports.set(key, {
-				kind: "authorization_failed",
-				request: current.request,
-				authorizationFingerprint: current.authorizationFingerprint,
-				authorizationIdentity: current.authorizationIdentity,
-				failure: input.outcome
-			});
-			return input.outcome;
-		}
-		this.state.exports.set(key, {
-			kind: "authorized",
-			request: current.request,
-			authorizationFingerprint: current.authorizationFingerprint,
-			authorizationIdentity: current.authorizationIdentity
-		});
-		return { ok: true };
-	}
-	async prepareAdmitExport(request, authorizationIdentity) {
+	async prepareAdmitExport(request, _authorizationIdentity) {
 		const key = exportKey(request);
 		const current = this.state.exports.get(key);
 		if (!current || !sameExportAdmissionRequestV1(current.request, request)) return {
@@ -350,15 +304,6 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 					message: "Export admission is already in progress"
 				})
 			};
-			case "authorizing":
-			case "authorization_failed": return {
-				kind: "failed",
-				failure: failure({
-					status: 409,
-					code: "admission_failed",
-					message: "Export admission authorization is incomplete"
-				})
-			};
 			case "authorized": break;
 			default: return assertNeverExportState(current);
 		}
@@ -405,7 +350,8 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			kind: "admitting",
 			request: current.request,
 			authorizationFingerprint: current.authorizationFingerprint,
-			authorizationIdentity: current.authorizationIdentity
+			authorizationIdentity: current.authorizationIdentity,
+			factorRelease: current.factorRelease
 		});
 		return {
 			kind: "claimed",
@@ -466,6 +412,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			request: current.request,
 			authorizationFingerprint: current.authorizationFingerprint,
 			authorizationIdentity: current.authorizationIdentity,
+			factorRelease: current.factorRelease,
 			receipt: parsed.value
 		});
 		return {
@@ -523,6 +470,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 				request: current.request,
 				authorizationFingerprint: current.authorizationFingerprint,
 				authorizationIdentity: current.authorizationIdentity,
+				factorRelease: current.factorRelease,
 				receipt: current.receipt,
 				executeFingerprint: canonicalFingerprint(request),
 				failure: rejected
@@ -540,6 +488,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 					request: current.request,
 					authorizationFingerprint: current.authorizationFingerprint,
 					authorizationIdentity: current.authorizationIdentity,
+					factorRelease: current.factorRelease,
 					receipt: current.receipt,
 					executeFingerprint
 				});
@@ -612,6 +561,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			request: current.request,
 			authorizationFingerprint: current.authorizationFingerprint,
 			authorizationIdentity: current.authorizationIdentity,
+			factorRelease: current.factorRelease,
 			receipt: current.receipt,
 			executeFingerprint: current.executeFingerprint,
 			result: parsed.value
@@ -648,6 +598,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			request: current.request,
 			authorizationFingerprint: current.authorizationFingerprint,
 			authorizationIdentity: current.authorizationIdentity,
+			factorRelease: current.factorRelease,
 			failure: rejected
 		});
 	}
@@ -657,6 +608,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			request: current.request,
 			authorizationFingerprint: current.authorizationFingerprint,
 			authorizationIdentity: current.authorizationIdentity,
+			factorRelease: current.factorRelease,
 			receipt: current.receipt,
 			executeFingerprint: current.executeFingerprint,
 			failure: rejected
@@ -684,9 +636,6 @@ function requireString(value) {
 	if (!value) throw new Error("Ed25519 Yao export passkey credential id is required");
 	return value;
 }
-function assertNeverExportAuthorizationInput(value) {
-	throw new Error(`Unsupported Ed25519 Yao export authorization input: ${String(value)}`);
-}
 function assertNeverExportAdmissionAuthorization(value) {
 	throw new Error(`Unsupported Ed25519 Yao export admission authorization: ${String(value)}`);
 }
@@ -897,6 +846,7 @@ async function authorizeExportAdmission(args) {
 	if (!recorded.ok) return recorded;
 	return {
 		ok: true,
+		admission: recorded.admission,
 		factorRelease: checked.factorRelease
 	};
 }
@@ -1022,31 +972,68 @@ async function recordFreshExportProof(args) {
 		proofId,
 		factor
 	});
-	const admitted = await args.authorizedOperations.admitAuthorizedOperation({ operation: {
-		tenantId: args.authorizedOperations.tenantId,
-		authorizedOperationId: authorizedOperationId.value,
-		auditEventId: auditEventId.value,
-		operation,
-		authorization: {
-			kind: "verified_step_up",
-			evidenceSetDigest: evidence.evidenceSetDigest
-		},
-		quota: { kind: "quota_neutral" },
-		claimedAtMs: args.verifiedAtMs
-	} });
-	switch (admitted.kind) {
-		case "claimed":
-		case "replayed":
-		case "operation_in_progress": return { ok: true };
-		case "authorization_grant_rejected":
-		case "verified_step_up_rejected":
-		case "wallet_session_quota_exhausted":
-		case "material_mismatch": return authorizationFailure({
-			status: 403,
-			code: admitted.kind,
-			message: "Ed25519 Yao export owner proof was rejected"
-		});
+	return {
+		ok: true,
+		admission: new ExportOperationAdmission(args.authorizedOperations, {
+			tenantId: args.authorizedOperations.tenantId,
+			authorizedOperationId: authorizedOperationId.value,
+			auditEventId: auditEventId.value,
+			operation,
+			authorization: {
+				kind: "verified_step_up",
+				evidenceSetDigest: evidence.evidenceSetDigest
+			},
+			quota: { kind: "quota_neutral" },
+			claimedAtMs: args.verifiedAtMs
+		})
+	};
+}
+var ExportOperationAdmission = class {
+	constructor(authorizedOperations, operation) {
+		this.authorizedOperations = authorizedOperations;
+		this.operation = operation;
+	}
+	async prepare() {
+		const prepared = await this.authorizedOperations.prepareAuthorizedOperationAdmission({ operation: this.operation });
+		switch (prepared.kind) {
+			case "prepared": return {
+				kind: "prepared",
+				write: { statements: prepared.statements }
+			};
+			case "replayed":
+			case "operation_in_progress": return { kind: "already_admitted" };
+			case "authorization_grant_rejected":
+			case "verified_step_up_rejected":
+			case "wallet_session_quota_exhausted":
+			case "material_mismatch": return {
+				kind: "rejected",
+				failure: exportOwnerProofRejected(prepared.kind)
+			};
+		}
+	}
+	classifyFailure(error) {
+		const rejected = this.authorizedOperations.classifyAuthorizedOperationAdmissionFailure(error);
+		return rejected ? exportOwnerProofRejected(rejected.kind) : null;
+	}
+	async admit() {
+		const admitted = await this.authorizedOperations.admitAuthorizedOperation({ operation: this.operation });
+		switch (admitted.kind) {
+			case "claimed":
+			case "replayed":
+			case "operation_in_progress": return { ok: true };
+			case "authorization_grant_rejected":
+			case "verified_step_up_rejected":
+			case "wallet_session_quota_exhausted":
+			case "material_mismatch": return exportOwnerProofRejected(admitted.kind);
+		}
 	}
+};
+function exportOwnerProofRejected(code) {
+	return authorizationFailure({
+		status: 403,
+		code,
+		message: "Ed25519 Yao export owner proof was rejected"
+	});
 }
 var RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter = class {
 	constructor(webAuthn, emailOtp, walletAuthMethods, authorizedOperations, resolveEd25519MaterialActivation) {
@@ -1056,63 +1043,43 @@ var RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter = class {
 		this.authorizedOperations = authorizedOperations;
 		this.resolveEd25519MaterialActivation = resolveEd25519MaterialActivation;
 	}
-	async authorize(input) {
-		switch (input.kind) {
-			case "admit": {
-				const activeIdentity = await resolveActiveExportAuthorizationIdentity({
-					body: input.body,
-					resolveEd25519MaterialActivation: this.resolveEd25519MaterialActivation
-				});
-				if (!activeIdentity.ok) return activeIdentity;
-				const checked = await authorizeExportAdmission({
-					input,
-					webAuthn: this.webAuthn,
-					emailOtp: this.emailOtp,
-					walletAuthMethods: this.walletAuthMethods,
-					authorizedOperations: this.authorizedOperations
-				});
-				return checked.ok ? {
-					ok: true,
-					authorizationIdentity: activeIdentity.authorizationIdentity,
-					...checked.factorRelease ? { factorRelease: checked.factorRelease } : {}
-				} : checked;
-			}
-			case "execute": {
-				const thresholdSessionId = parseThresholdEd25519SessionId(input.body.binding.ceremony.lifecycle.session_id);
-				if (!thresholdSessionId.ok) return authorizationFailure({
-					status: 403,
-					code: "invalid_body",
-					message: thresholdSessionId.error.message
-				});
-				const authorizationIdentity = { thresholdSessionId: thresholdSessionId.value };
-				const checked = authorizeExportExecution(input, authorizationIdentity);
-				return checked.ok ? {
-					ok: true,
-					authorizationIdentity
-				} : checked;
-			}
-			default: return assertNeverExportAuthorizationInput(input);
-		}
+	async authorizeAdmission(input) {
+		const activeIdentity = await resolveActiveExportAuthorizationIdentity({
+			body: input.body,
+			resolveEd25519MaterialActivation: this.resolveEd25519MaterialActivation
+		});
+		if (!activeIdentity.ok) return activeIdentity;
+		const checked = await authorizeExportAdmission({
+			input,
+			webAuthn: this.webAuthn,
+			emailOtp: this.emailOtp,
+			walletAuthMethods: this.walletAuthMethods,
+			authorizedOperations: this.authorizedOperations
+		});
+		return checked.ok ? {
+			ok: true,
+			authorizationIdentity: activeIdentity.authorizationIdentity,
+			admission: checked.admission,
+			...checked.factorRelease ? { factorRelease: checked.factorRelease } : {}
+		} : checked;
 	}
-	async resolveAuthorizationIdentity(request) {
-		let raw;
-		try {
-			raw = await request.clone().json();
-		} catch {
-			return authorizationFailure({
-				status: 403,
-				code: "invalid_body",
-				message: "Ed25519 Yao export authorization body is invalid"
-			});
-		}
-		const parsed = parseRouterAbEd25519YaoExportAdmissionEnvelopeV1(raw);
-		if (!parsed.ok) return authorizationFailure({
+	authorizeExecution(input) {
+		const thresholdSessionId = parseThresholdEd25519SessionId(input.body.binding.ceremony.lifecycle.session_id);
+		if (!thresholdSessionId.ok) return authorizationFailure({
 			status: 403,
 			code: "invalid_body",
-			message: parsed.message
+			message: thresholdSessionId.error.message
 		});
+		const authorizationIdentity = { thresholdSessionId: thresholdSessionId.value };
+		const checked = authorizeExportExecution(input, authorizationIdentity);
+		return checked.ok ? {
+			ok: true,
+			authorizationIdentity
+		} : checked;
+	}
+	async resolveAuthorizationIdentity(body) {
 		return await resolveActiveExportAuthorizationIdentity({
-			body: parsed.protocol,
+			body,
 			resolveEd25519MaterialActivation: this.resolveEd25519MaterialActivation
 		});
 	}
@@ -1295,8 +1262,7 @@ var RouterAbEd25519YaoExportRouteExtension = class {
 				code: "forbidden",
 				message: "Origin header is required and must be a valid exact origin"
 			}, { status: 403 });
-			const authorized = await this.authorization.authorize({
-				kind: "admit",
+			const authorized = await this.authorization.authorizeAdmission({
 				request: input.request,
 				body: parsed.protocol,
 				authorization: parsed.authorization,
@@ -1307,7 +1273,7 @@ var RouterAbEd25519YaoExportRouteExtension = class {
 				code: authorized.code,
 				message: authorized.message
 			}, { status: authorized.status });
-			const result = await this.service.admitExport(parsed.protocol, authorized.authorizationIdentity, traceContext.value);
+			const result = await this.service.admitExport(parsed.protocol, authorized.authorizationIdentity, authorized.admission, authorized.factorRelease ?? null, traceContext.value);
 			return result.ok ? json({
 				protocol: result.value,
 				...authorized.factorRelease ? { factorRelease: authorized.factorRelease } : {}
@@ -1330,8 +1296,7 @@ var RouterAbEd25519YaoExportRouteExtension = class {
 				code: "invalid_body",
 				message: parsed.message
 			}, { status: 400 });
-			const authorized = await this.authorization.authorize({
-				kind: "execute",
+			const authorized = await this.authorization.authorizeExecution({
 				request: input.request,
 				body: parsed.protocol
 			});