@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/router/domains/signingOperations/routerAbEd25519NormalSigningRoute.js

@@ -0,0 +1,698 @@
+import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
+import { buildNearEd25519MpcOperationRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseSigningOperationFingerprintDigest } from "../../../shared-ts/src/authorization/operationFingerprint.js";
+import "../../../shared-ts/src/utils/encoders.js";
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
+import { validateRouterAbEd25519WalletSessionInputs } from "../../auth/commonRouterUtils.js";
+import { evaluateRouterAbNormalSigningAdmission, requireAuthorizationValue, routerAbErrorMessage, routerAbOwnerOperationFailureResult, routerAbOwnerOperationStepUpDecision, routerAbStepUpError, routerAbWalletSessionValidationStatus } from "./routerAbNormalSigningAdmission.js";
+import { authenticateRouterAbWalletOperationStepUpIdentity, parseStepUpRequestOrigin, readExhaustedWalletSessionCandidate, recordedStepUpOperationClaim, resolveRouterAbEd25519OperationStepUpSession, routerAbOperationStepUpClaimFailure, walletSessionScopeInvalidFailure } from "./routerAbOperationStepUp.js";
+import { buildRouterAbEd25519PrivateSigningWorkerBody, parseRouterAbEd25519NormalSigningScopeV2, requirePrivateSigningDigest } from "./routerAbPrivateSigningWorker.js";
+import { parseEd25519ReusableAuthorizedOperationReceipt, parseEd25519VerifiedStepUpAuthorizedOperationReceipt } from "./ed25519AuthorizedOperationReceipt.js";
+//#region src/router/domains/signingOperations/routerAbEd25519NormalSigningRoute.ts
+function buildRouterAbEd25519OwnerOperationStepUpPreparation(input) {
+	const operation = parseRouterAbOperationStepUpOperation(input.body.intent);
+	const expiresAtMs = Number(input.body.expires_at_ms);
+	if (!operation.ok || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= 0 || input.scope.account_id !== input.scope.material_activation.material_owner || input.material.signingWorkerId !== input.scope.signing_worker_id || input.material.participantIds.length !== 2) return null;
+	return {
+		wallet_id: input.scope.account_id,
+		operation_kind: operation.operation.operationKind,
+		operation_id: operation.operationId,
+		request_id: input.scope.request_id,
+		account_id: input.scope.account_id,
+		material_activation: input.scope.material_activation,
+		signing_worker_id: input.scope.signing_worker_id,
+		near_account_id: input.material.nearAccountId,
+		signer_slot: input.material.signerSlot,
+		participant_ids: input.material.participantIds,
+		expires_at_ms: expiresAtMs
+	};
+}
+async function resolveRouterAbEd25519OwnerOperationStepUpPreparation(input) {
+	if (input.phase !== "prepare") return void 0;
+	try {
+		const activeMaterial = await input.resolveEd25519MaterialActivation({
+			walletId: input.scope.account_id,
+			materialActivation: input.scope.material_activation
+		});
+		if (!activeMaterial.ok) return void 0;
+		return buildRouterAbEd25519OwnerOperationStepUpPreparation({
+			scope: input.scope,
+			body: input.body,
+			material: activeMaterial
+		}) ?? void 0;
+	} catch {
+		return;
+	}
+}
+function decideRouterAbEd25519OwnerOperationAuthorization(input) {
+	if (input.operation.lifecycle !== "claimed" || input.operation.authorization.kind !== "authorization_grant" || input.operation.authorization.authorizationGrantRef.kind !== "wallet_session_authorization" || input.operation.quota.kind !== "consume_reusable_wallet_session") return {
+		kind: "denied",
+		denial: {
+			code: "invalid_authority",
+			message: "Ed25519 reusable Wallet Session authorization is invalid"
+		}
+	};
+	return {
+		kind: "authorized",
+		operation: input.operation,
+		source: {
+			kind: "authorization_grant",
+			authorizationGrantRef: input.operation.authorization.authorizationGrantRef
+		}
+	};
+}
+function routerAbEd25519OwnerOperationDecisionForFailure(input) {
+	const stepUpDecision = routerAbOwnerOperationStepUpDecision(input);
+	if (stepUpDecision) return stepUpDecision;
+	switch (input.code) {
+		case "invalid_body": return {
+			kind: "denied",
+			denial: {
+				code: "invalid_operation",
+				message: "Ed25519 operation request is invalid"
+			}
+		};
+		case "wallet_session_mismatch":
+		case "wallet_session_scope_mismatch":
+		case "scope_mismatch":
+		case "authorization_grant_rejected":
+		case "verified_step_up_rejected": return {
+			kind: "denied",
+			denial: {
+				code: "invalid_authority",
+				message: "Ed25519 operation authority is invalid"
+			}
+		};
+		case "material_mismatch": return {
+			kind: "denied",
+			denial: {
+				code: "inactive_material",
+				message: "Ed25519 signing material is inactive"
+			}
+		};
+		case "internal":
+		case "not_configured": return {
+			kind: "denied",
+			denial: {
+				code: "authorization_unavailable",
+				message: "Ed25519 operation authorization is unavailable"
+			}
+		};
+		default: return null;
+	}
+}
+function routerAbEd25519OwnerOperationFailureResult(input) {
+	return routerAbOwnerOperationFailureResult(input, routerAbEd25519OwnerOperationDecisionForFailure(input));
+}
+async function handleRouterAbEd25519OperationStepUpRoute(input) {
+	if (input.scope.authorization.kind !== "operation_step_up") return routerAbStepUpError(400, "invalid_body", "Operation step-up authority is required");
+	const expiresAtMs = Number(input.body.expires_at_ms);
+	if (!Number.isSafeInteger(expiresAtMs) || expiresAtMs <= Date.now()) return routerAbStepUpError(408, "expired_request", "Router A/B Ed25519 step-up request is expired");
+	let authenticated = await authenticateRouterAbWalletOperationStepUp({
+		headers: input.headers,
+		scope: input.scope,
+		operationKind: input.operationKind,
+		requestExpiresAtMs: expiresAtMs,
+		authorizedOperations: input.authorizedOperations,
+		authorizationSessions: input.authorizationSessions,
+		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+	});
+	if (!authenticated.ok && input.authorizedOperations && input.authorizationSessions && isWalletSessionUnavailableStepUpError(authenticated.error)) {
+		const exhaustedCandidate = await resolveRouterAbEd25519ExhaustedCandidateOperationStepUpAuthentication({
+			headers: input.headers,
+			scope: input.scope,
+			operationKind: input.operationKind,
+			requestExpiresAtMs: expiresAtMs,
+			authorizedOperations: input.authorizedOperations,
+			authorizationSessions: input.authorizationSessions,
+			resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+		});
+		if (exhaustedCandidate) {
+			if (!exhaustedCandidate.ok) return exhaustedCandidate.error;
+			authenticated = exhaustedCandidate;
+		}
+	}
+	if (!authenticated.ok) return authenticated.error;
+	const activeMaterial = "activeMaterial" in authenticated ? authenticated.activeMaterial : await input.resolveEd25519MaterialActivation({
+		walletId: authenticated.session.walletId,
+		materialActivation: input.scope.material_activation
+	});
+	if (!activeMaterial.ok) return routerAbStepUpError(activeMaterial.code === "internal" ? 500 : 403, activeMaterial.code === "internal" ? "internal" : "scope_mismatch", activeMaterial.code === "internal" ? activeMaterial.message : "Operation step-up material is no longer active");
+	if (!sameRouterAbMpcMaterialActivationRef(activeMaterial.materialActivation, input.scope.material_activation)) return routerAbStepUpError(403, "scope_mismatch", "Operation step-up scope does not name the active material");
+	if (input.phase === "prepare") {
+		let privateBody;
+		try {
+			privateBody = await buildRouterAbEd25519PrivateSigningWorkerBody({
+				phase: "prepare",
+				body: input.body,
+				authorization: {
+					kind: "operation_step_up",
+					session: authenticated.session
+				},
+				headers: input.headers
+			});
+		} catch (error) {
+			return routerAbStepUpError(400, "invalid_body", routerAbErrorMessage(error));
+		}
+		const operation = parseRouterAbOperationStepUpOperation(input.body.intent);
+		if (!operation.ok) return routerAbStepUpError(400, "invalid_body", operation.message);
+		let authorizedOperationId;
+		let capabilityId;
+		let laneDigest;
+		let intentDigest;
+		let displayDigest;
+		try {
+			authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(`normal-signing-operation:${input.scope.request_id}`));
+			capabilityId = requireAuthorizationValue(parseCapabilityId(input.scope.material_activation.capability));
+			if (!("admission_candidate" in privateBody)) throw new Error("Router A/B step-up prepare admission is missing");
+			laneDigest = parseSigningOperationFingerprintDigest(input.body.intent.operation_fingerprint);
+			intentDigest = parseDigestB64u(base64UrlEncode(Uint8Array.from(privateBody.admission_candidate.intent_digest.bytes)));
+			displayDigest = parseDigestB64u(base64UrlEncode(Uint8Array.from(requirePrivateSigningDigest(input.body.display_digest, "display_digest").bytes)));
+		} catch (error) {
+			return routerAbStepUpError(400, "invalid_body", routerAbErrorMessage(error));
+		}
+		const operationFingerprintDigest = await computeCapabilityOperationFingerprintDigest(buildCapabilityOperationEnvelope({
+			tenantId: authenticated.session.tenantId,
+			principalId: authenticated.session.principalId,
+			capabilityId,
+			operationId: operation.operationId,
+			operation: operation.operation,
+			digests: {
+				laneDigest,
+				intentDigest,
+				displayDigest
+			}
+		}));
+		const existing = await authenticated.authorizedOperations.readAuthorizedOperation({
+			tenantId: authenticated.session.tenantId,
+			operationFingerprintDigest
+		});
+		if (!existing || existing.authorizedOperationId !== authorizedOperationId) return routerAbStepUpError(409, "authorized_operation_missing", "Authorized operation is unavailable");
+		const claim = recordedStepUpOperationClaim(existing);
+		if (!claim.ok) return claim.error;
+		let claimResult;
+		try {
+			claimResult = await authenticated.authorizedOperations.admitAuthorizedOperation({ operation: claim.operation });
+		} catch (error) {
+			return routerAbStepUpError(400, "invalid_body", routerAbErrorMessage(error));
+		}
+		const claimFailure = routerAbOperationStepUpClaimFailure(claimResult);
+		if (claimFailure) return claimFailure;
+		if (claimResult.kind !== "claimed" && claimResult.kind !== "operation_in_progress" && claimResult.kind !== "replayed") return routerAbStepUpError(409, "authorized_operation_missing", "Authorized operation is unavailable");
+		return {
+			phase: "prepare",
+			session: authenticated.session,
+			operation: claimResult.operation,
+			operationDigests: {
+				laneDigest,
+				intentDigest,
+				displayDigest
+			},
+			admissionKind: claimResult.kind
+		};
+	}
+	return {
+		phase: "finalize",
+		session: authenticated.session
+	};
+}
+async function resolveRouterAbEd25519ExhaustedCandidateOperationStepUpAuthentication(input) {
+	const token = extractBearerCredential(input.headers);
+	if (!token) return null;
+	const origin = parseStepUpRequestOrigin(input.headers);
+	if (!origin.ok) return origin;
+	const exhausted = await readExhaustedWalletSessionCandidate({
+		authorizationSessions: input.authorizationSessions,
+		token,
+		operation: {
+			keyFamily: "ed25519",
+			operationKind: input.operationKind
+		}
+	});
+	if (!exhausted?.ok) return exhausted;
+	const { candidate, session, admission } = exhausted;
+	if (!admission.ok || admission.keyFamily !== "ed25519") return walletSessionScopeInvalidFailure();
+	const resolved = await resolveRouterAbEd25519OperationStepUpSession({
+		walletId: input.scope.account_id,
+		materialOwner: input.scope.material_activation.material_owner,
+		materialActivation: input.scope.material_activation,
+		requestExpiresAtMs: input.requestExpiresAtMs,
+		operationKind: input.operationKind,
+		authorizedOperations: input.authorizedOperations,
+		session,
+		admission,
+		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+	});
+	if (!resolved.ok) return resolved;
+	return {
+		ok: true,
+		kind: "wallet_session_operation_credential_exhausted_candidate_v1",
+		authorizedOperations: input.authorizedOperations,
+		candidate,
+		activeMaterial: resolved.activeMaterial,
+		session: resolved.session,
+		requestOrigin: origin.requestOrigin,
+		expiresAtMs: session.expiresAtMs
+	};
+}
+function isWalletSessionUnavailableStepUpError(result) {
+	return isPlainObject(result.body) && result.body.code === "wallet_session_unavailable";
+}
+async function authenticateRouterAbWalletOperationStepUp(input) {
+	return authenticateRouterAbWalletOperationStepUpIdentity({
+		kind: "wallet_session_operation_credential_v1",
+		headers: input.headers,
+		keyFamily: "ed25519",
+		operationKind: input.operationKind,
+		walletId: input.scope.account_id,
+		materialOwner: input.scope.material_activation.material_owner,
+		materialActivation: input.scope.material_activation,
+		requestExpiresAtMs: input.requestExpiresAtMs,
+		authorizedOperations: input.authorizedOperations,
+		authorizationSessions: input.authorizationSessions,
+		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+	});
+}
+function parseRouterAbEd25519OperationStepUpScope(value) {
+	return parseRouterAbEd25519NormalSigningScopeV2(value);
+}
+function parseRouterAbOperationStepUpOperation(value) {
+	const intent = isPlainObject(value) ? value : null;
+	if (!intent) return {
+		ok: false,
+		message: "Router A/B step-up intent is required"
+	};
+	let operationKind;
+	switch (intent.kind) {
+		case "near_transaction_v1":
+			operationKind = "near.sign_transaction";
+			break;
+		case "near_delegate_action_v1":
+			operationKind = "near.sign_delegate_action";
+			break;
+		case "nep413_v1":
+			operationKind = "near.sign_nep413_message";
+			break;
+		default: return {
+			ok: false,
+			message: "Router A/B step-up intent kind is invalid"
+		};
+	}
+	const operationId = parseCapabilityOperationId(intent.operation_id);
+	if (!operationId.ok) return {
+		ok: false,
+		message: operationId.error.message
+	};
+	return {
+		ok: true,
+		operationId: operationId.value,
+		operation: buildNearEd25519MpcOperationRef(operationKind)
+	};
+}
+function parseRouterAbEd25519NormalSigningOperationForAdmission(input) {
+	if (input.phase === "prepare") {
+		const requestedOperation = parseRouterAbOperationStepUpOperation(input.body.intent);
+		if (!requestedOperation.ok) return requestedOperation;
+		return {
+			ok: true,
+			operation: {
+				phase: "prepare",
+				operationKind: requestedOperation.operation.operationKind
+			}
+		};
+	}
+	try {
+		switch (input.authorizationKind) {
+			case "reusable_wallet_session": {
+				const receipt = parseEd25519ReusableAuthorizedOperationReceipt(input.body.authorized_operation);
+				return {
+					ok: true,
+					operation: {
+						phase: "finalize",
+						operationKind: receipt.operation_kind,
+						authorizationKind: "reusable_wallet_session",
+						receipt
+					}
+				};
+			}
+			case "operation_step_up": {
+				const receipt = parseEd25519VerifiedStepUpAuthorizedOperationReceipt(input.body.authorized_operation);
+				return {
+					ok: true,
+					operation: {
+						phase: "finalize",
+						operationKind: receipt.operation_kind,
+						authorizationKind: "operation_step_up",
+						receipt
+					}
+				};
+			}
+		}
+	} catch (error) {
+		return {
+			ok: false,
+			message: routerAbErrorMessage(error)
+		};
+	}
+}
+async function validateRouterAbEd25519V2FinalizeAuthorizedOperation(input) {
+	if (!input.authorizedOperations) return {
+		ok: false,
+		result: routerAbEd25519OwnerOperationFailureResult({
+			status: 501,
+			code: "not_configured",
+			message: "Reusable Wallet Session authorization is not configured",
+			phase: input.phase
+		})
+	};
+	let authorizedOperationId;
+	try {
+		authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(input.receipt.authorized_operation_id));
+		requireAuthorizationValue(parseCapabilityOperationId(input.receipt.operation_id));
+	} catch (error) {
+		return {
+			ok: false,
+			result: routerAbEd25519OwnerOperationFailureResult({
+				status: 400,
+				code: "invalid_authorized_operation",
+				message: routerAbErrorMessage(error),
+				phase: input.phase
+			})
+		};
+	}
+	let operation;
+	try {
+		operation = await input.authorizedOperations.readAuthorizedOperationById({
+			tenantId: input.authorizedOperations.tenantId,
+			authorizedOperationId
+		});
+	} catch (error) {
+		return {
+			ok: false,
+			result: routerAbEd25519OwnerOperationFailureResult({
+				status: 500,
+				code: "internal",
+				message: routerAbErrorMessage(error),
+				phase: input.phase
+			})
+		};
+	}
+	if (!operation) return {
+		ok: false,
+		result: routerAbEd25519OwnerOperationFailureResult({
+			status: 409,
+			code: "authorized_operation_missing",
+			message: "Authorized operation is unavailable",
+			phase: input.phase
+		})
+	};
+	const operationRef = operation.operation.operation;
+	if (operation.tenantId !== input.authorizedOperations.tenantId || operation.authorizedOperationId !== authorizedOperationId || operation.operation.operationId !== input.receipt.operation_id || operation.operationFingerprintDigest !== input.receipt.operation_fingerprint_digest || operation.operation.digests.laneDigest !== input.receipt.lane_digest_b64u || operation.operation.digests.intentDigest !== input.receipt.intent_digest_b64u || operation.operation.digests.displayDigest !== input.receipt.display_digest_b64u || operationRef.capabilityKind !== "near_ed25519_mpc_signing" || operationRef.operationKind !== input.receipt.operation_kind) return {
+		ok: false,
+		result: routerAbEd25519OwnerOperationFailureResult({
+			status: 400,
+			code: "invalid_authorized_operation",
+			message: "Ed25519 authorized operation does not match its receipt",
+			phase: input.phase
+		})
+	};
+	switch (operationRef.operationKind) {
+		case "near.sign_transaction":
+		case "near.sign_delegate_action":
+		case "near.sign_nep413_message": return {
+			ok: true,
+			operationKind: operationRef.operationKind
+		};
+	}
+}
+async function authorizeRouterAbEd25519WalletSessionRequest(input) {
+	if (input.operation.phase === "finalize") {
+		const exactOperation = await validateRouterAbEd25519V2FinalizeAuthorizedOperation({
+			receipt: input.operation.receipt,
+			authorizedOperations: input.authorizedOperations,
+			phase: input.phase
+		});
+		if (!exactOperation.ok) return exactOperation;
+		if (exactOperation.operationKind !== input.admission.operationKind) return {
+			ok: false,
+			result: routerAbEd25519OwnerOperationFailureResult({
+				status: 403,
+				code: "wallet_session_scope_mismatch",
+				message: "Exact Wallet Session operation does not match the authorized operation",
+				phase: input.phase
+			})
+		};
+	}
+	const expectedMaterialActivation = routerAbMpcMaterialActivationRefFromWire(input.scope.material_activation);
+	const admittedMaterialActivation = routerAbMpcMaterialActivationRefToWire(input.admission.materialActivation);
+	const expiresAtMs = Number(input.body.expires_at_ms);
+	if (input.scope.authorization.wallet_session_id !== input.session.walletSessionId || input.scope.account_id !== String(input.session.walletId) || input.scope.material_activation.material_owner !== String(input.session.walletId) || input.scope.signing_worker_id !== input.scope.material_activation.signing_worker || !mpcMaterialActivationRefsEqual(expectedMaterialActivation, input.admission.materialActivation) || !Number.isFinite(expiresAtMs) || expiresAtMs <= 0) return {
+		ok: false,
+		result: routerAbEd25519OwnerOperationFailureResult({
+			status: 403,
+			code: "wallet_session_scope_mismatch",
+			message: "Exact Wallet Session does not authorize this Ed25519 request",
+			phase: input.phase
+		})
+	};
+	if (expiresAtMs <= Date.now()) return {
+		ok: false,
+		result: routerAbEd25519OwnerOperationFailureResult({
+			status: 408,
+			code: "expired_request",
+			message: "Router A/B Ed25519 normal-signing request is expired",
+			phase: input.phase
+		})
+	};
+	if (expiresAtMs > input.session.expiresAtMs) return {
+		ok: false,
+		result: routerAbEd25519OwnerOperationFailureResult({
+			status: 403,
+			code: "wallet_session_scope_mismatch",
+			message: "Ed25519 request exceeds the exact Wallet Session lifetime",
+			phase: input.phase
+		})
+	};
+	const activeMaterial = await input.resolveEd25519MaterialActivation({
+		walletId: String(input.session.walletId),
+		materialActivation: admittedMaterialActivation
+	});
+	if (!activeMaterial.ok || !sameRouterAbMpcMaterialActivationRef(activeMaterial.materialActivation, admittedMaterialActivation) || activeMaterial.signingWorkerId !== input.scope.signing_worker_id || base64UrlEncode(Uint8Array.from(activeMaterial.exportIdentity.registered_public_key)) !== input.admission.signer.registeredPublicKeyB64u) return {
+		ok: false,
+		result: routerAbEd25519OwnerOperationFailureResult({
+			status: activeMaterial.ok || activeMaterial.code !== "internal" ? 403 : 500,
+			code: activeMaterial.ok || activeMaterial.code !== "internal" ? "material_mismatch" : "internal",
+			message: activeMaterial.ok ? "Exact Wallet Session material does not match the active Ed25519 material" : activeMaterial.message,
+			phase: input.phase
+		})
+	};
+	const admission = {
+		ok: true,
+		thresholdSessionId: activeMaterial.exportIdentity.scope.threshold_session_id,
+		requestId: input.scope.request_id,
+		expiresAtMs,
+		materialActivation: admittedMaterialActivation
+	};
+	const admissionDecision = await evaluateRouterAbNormalSigningAdmission({
+		adapter: input.admissionAdapter,
+		curve: "ed25519",
+		authorizationKind: "wallet_session_operation_credential_v1",
+		phase: input.phase,
+		walletId: String(input.session.walletId),
+		authorityId: input.authorityId,
+		thresholdSessionId: activeMaterial.exportIdentity.scope.threshold_session_id,
+		walletSessionId: String(input.session.walletSessionId),
+		quotaId: String(input.session.quotaId),
+		requestId: input.scope.request_id,
+		expiresAtMs,
+		signingWorkerId: activeMaterial.signingWorkerId,
+		runtimePolicyScope: activeMaterial.runtimePolicyScope
+	});
+	if (!admissionDecision.ok) return {
+		ok: false,
+		result: routerAbEd25519OwnerOperationFailureResult({
+			status: admissionDecision.status,
+			code: admissionDecision.code,
+			message: admissionDecision.message,
+			phase: input.phase
+		})
+	};
+	return {
+		ok: true,
+		admission,
+		activeMaterial
+	};
+}
+async function resolveRouterAbEd25519ExhaustedCandidateAuthorization(input) {
+	const token = extractBearerCredential(input.headers);
+	if (!token) return null;
+	const exhausted = await readExhaustedWalletSessionCandidate({
+		authorizationSessions: input.authorizationSessions,
+		token,
+		operation: {
+			keyFamily: "ed25519",
+			operationKind: input.operation.operationKind
+		}
+	});
+	if (!exhausted) return null;
+	if (!exhausted.ok) return {
+		ok: false,
+		result: exhausted.error
+	};
+	const { candidate, session, admission } = exhausted;
+	if (!admission.ok || admission.keyFamily !== "ed25519") return {
+		ok: false,
+		result: routerAbEd25519OwnerOperationFailureResult({
+			status: 403,
+			code: "wallet_session_scope_mismatch",
+			message: "Exact Wallet Session does not authorize this Ed25519 request",
+			phase: input.phase
+		})
+	};
+	const authorized = await authorizeRouterAbEd25519WalletSessionRequest({
+		phase: input.phase,
+		body: input.body,
+		scope: input.scope,
+		operation: input.operation,
+		session,
+		authorityId: String(candidate.authority.authorityId),
+		admission,
+		authorizedOperations: input.authorizedOperations,
+		admissionAdapter: input.admissionAdapter,
+		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+	});
+	if (!authorized.ok) return authorized;
+	return {
+		ok: true,
+		kind: "wallet_session_operation_credential_exhausted_candidate_v1",
+		candidate,
+		admission: authorized.admission,
+		activeMaterial: authorized.activeMaterial
+	};
+}
+async function authorizeRouterAbEd25519NormalSigningRoute(input) {
+	let scope;
+	try {
+		scope = parseRouterAbEd25519NormalSigningScopeV2(input.body.scope);
+	} catch (error) {
+		return {
+			ok: false,
+			result: routerAbEd25519OwnerOperationFailureResult({
+				status: 400,
+				code: "invalid_body",
+				message: routerAbErrorMessage(error),
+				phase: input.phase
+			})
+		};
+	}
+	const operationForAdmission = parseRouterAbEd25519NormalSigningOperationForAdmission({
+		phase: input.phase,
+		body: input.body,
+		authorizationKind: scope.authorization.kind
+	});
+	if (!operationForAdmission.ok) return {
+		ok: false,
+		result: routerAbEd25519OwnerOperationFailureResult({
+			status: 400,
+			code: "invalid_body",
+			message: operationForAdmission.message,
+			phase: input.phase
+		})
+	};
+	if (scope.authorization.kind === "operation_step_up") {
+		const result = await handleRouterAbEd25519OperationStepUpRoute({
+			body: input.body,
+			headers: input.headers,
+			authorizedOperations: input.authorizedOperations,
+			authorizationSessions: input.authorizationSessions,
+			resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation,
+			phase: input.phase,
+			scope,
+			operationKind: operationForAdmission.operation.operationKind
+		});
+		return "status" in result ? {
+			ok: false,
+			result
+		} : {
+			ok: true,
+			kind: "operation_step_up",
+			...result
+		};
+	}
+	const validated = await validateRouterAbEd25519WalletSessionInputs({
+		headers: input.headers,
+		authorizationSessions: input.authorizationSessions,
+		operationKind: operationForAdmission.operation.operationKind
+	});
+	if (!validated.ok) {
+		const operation = operationForAdmission.operation;
+		if (validated.code === "wallet_session_unavailable" && input.authorizationSessions && (operation.phase === "prepare" || operation.authorizationKind === "reusable_wallet_session")) {
+			const exhaustedCandidate = await resolveRouterAbEd25519ExhaustedCandidateAuthorization({
+				body: input.body,
+				headers: input.headers,
+				scope,
+				phase: input.phase,
+				operation,
+				authorizedOperations: input.authorizedOperations,
+				authorizationSessions: input.authorizationSessions,
+				admissionAdapter: input.admissionAdapter,
+				resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+			});
+			if (exhaustedCandidate) return exhaustedCandidate;
+		}
+		const stepUp = await resolveRouterAbEd25519OwnerOperationStepUpPreparation({
+			scope,
+			body: input.body,
+			phase: input.phase,
+			resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+		});
+		return {
+			ok: false,
+			result: routerAbEd25519OwnerOperationFailureResult({
+				status: routerAbWalletSessionValidationStatus(validated.code),
+				code: validated.code,
+				message: validated.message,
+				phase: input.phase,
+				stepUp
+			})
+		};
+	}
+	const operation = operationForAdmission.operation;
+	if (operation.phase === "finalize" && operation.authorizationKind !== "reusable_wallet_session") return {
+		ok: false,
+		result: routerAbEd25519OwnerOperationFailureResult({
+			status: 400,
+			code: "invalid_authorized_operation",
+			message: "Reusable Wallet Session authorized operation is required",
+			phase: input.phase
+		})
+	};
+	const authorized = await authorizeRouterAbEd25519WalletSessionRequest({
+		phase: input.phase,
+		body: input.body,
+		scope,
+		operation,
+		session: validated.admission.context.authorization.session,
+		authorityId: String(validated.admission.context.authority.authorityId),
+		admission: validated.admission.admission,
+		authorizedOperations: input.authorizedOperations,
+		admissionAdapter: input.admissionAdapter,
+		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+	});
+	if (!authorized.ok) return authorized;
+	return {
+		ok: true,
+		kind: "wallet_session_operation_credential_v1",
+		validated,
+		admission: authorized.admission,
+		activeMaterial: authorized.activeMaterial
+	};
+}
+//#endregion
+export { authenticateRouterAbWalletOperationStepUp, authorizeRouterAbEd25519NormalSigningRoute, buildRouterAbEd25519OwnerOperationStepUpPreparation, decideRouterAbEd25519OwnerOperationAuthorization, parseRouterAbEd25519OperationStepUpScope, parseRouterAbOperationStepUpOperation, routerAbEd25519OwnerOperationFailureResult };
+
+//# sourceMappingURL=routerAbEd25519NormalSigningRoute.js.map