@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/router/domains/signingOperations/routerAbNormalSigningAdmission.js

@@ -0,0 +1,209 @@
+import { parseMpcMaterialActivationId } from "../../../shared-ts/src/utils/domainIds.js";
+import { walletSessionFailureStatus } from "../../auth/walletSessionFailure.js";
+//#region src/router/domains/signingOperations/routerAbNormalSigningAdmission.ts
+function buildRouterAbEd25519AcceptedAuthorizedOperationV1(input) {
+	const operation = input.operation;
+	const operationRef = operation.operation.operation;
+	if (operationRef.capabilityKind !== "near_ed25519_mpc_signing") throw new Error("Ed25519 authorized operation capability is invalid");
+	if (operationRef.operationKind === "near.export_key") throw new Error("Ed25519 export cannot use normal-signing admission");
+	return buildRouterAbAcceptedAuthorizedOperationV1({
+		operation,
+		operationKind: operationRef.operationKind,
+		capabilityKind: "near_ed25519_mpc_signing",
+		binding: input.binding
+	});
+}
+function buildRouterAbEcdsaAcceptedAuthorizedOperationV1(input) {
+	const operation = input.operation;
+	const operationRef = operation.operation.operation;
+	if (operationRef.capabilityKind !== "evm_ecdsa_mpc_signing" || operationRef.operationKind !== "evm.sign_transaction") throw new Error("ECDSA authorized operation capability or operation kind is invalid");
+	return buildRouterAbAcceptedAuthorizedOperationV1({
+		operation,
+		operationKind: "evm.sign_transaction",
+		capabilityKind: "evm_ecdsa_mpc_signing",
+		binding: input.binding
+	});
+}
+function buildRouterAbAcceptedAuthorizedOperationV1(input) {
+	const operation = input.operation;
+	const commonAuthorizedOperation = {
+		authorized_operation_id: operation.authorizedOperationId,
+		operation_id: operation.operation.operationId,
+		capability_kind: input.capabilityKind,
+		operation_kind: input.operationKind,
+		lane_digest_b64u: operation.operation.digests.laneDigest,
+		intent_digest_b64u: operation.operation.digests.intentDigest,
+		display_digest_b64u: operation.operation.digests.displayDigest,
+		operation_fingerprint_digest: operation.operationFingerprintDigest
+	};
+	switch (input.binding.kind) {
+		case "reusable_wallet_session":
+			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Reusable Wallet Session authorized operation is invalid");
+			return {
+				binding: {
+					kind: "reusable_wallet_session",
+					authorization_id: operation.authorization.authorizationGrantRef.authorizationId,
+					wallet_session_id: input.binding.walletSessionId,
+					quota_id: input.binding.quotaId
+				},
+				authorized_operation: {
+					kind: "reusable_wallet_session_authorized_operation_v1",
+					...commonAuthorizedOperation
+				}
+			};
+		case "gateway_owner_wallet_session":
+			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Gateway owner Wallet Session authorized operation is invalid");
+			return {
+				binding: {
+					kind: "gateway_owner_wallet_session",
+					subject_id: input.binding.subjectId,
+					account_id: input.binding.accountId,
+					authorization_id: input.binding.authorizationId,
+					wallet_session_id: input.binding.walletSessionId,
+					quota_id: input.binding.quotaId,
+					threshold_session_id: input.binding.thresholdSessionId,
+					org_id: input.binding.orgId,
+					project_id: input.binding.projectId,
+					environment: input.binding.environment,
+					signing_worker_id: input.binding.signingWorkerId,
+					expires_at_ms: input.binding.expiresAtMs
+				},
+				authorized_operation: {
+					kind: "reusable_wallet_session_authorized_operation_v1",
+					...commonAuthorizedOperation
+				}
+			};
+		case "operation_step_up":
+			if (operation.authorization.kind !== "verified_step_up" || operation.quota.kind !== "quota_neutral") throw new Error("Verified step-up authorized operation is invalid");
+			return {
+				binding: {
+					kind: "operation_step_up",
+					authorization_session_id: input.binding.authorizationSessionId,
+					org_id: input.binding.orgId,
+					project_id: input.binding.projectId,
+					environment: input.binding.environment,
+					subject_id: input.binding.subjectId
+				},
+				authorized_operation: {
+					kind: "verified_step_up_authorized_operation_v1",
+					authorization_session_id: input.binding.authorizationSessionId,
+					evidence_set_digest: operation.authorization.evidenceSetDigest,
+					...commonAuthorizedOperation
+				}
+			};
+	}
+}
+function routerAbOwnerOperationStepUpDecision(input) {
+	const reason = (() => {
+		switch (input.code) {
+			case "wallet_session_missing": return "wallet_session_missing";
+			case "wallet_session_expired": return "wallet_session_expired";
+			case "wallet_budget_exhausted":
+			case "wallet_session_quota_exhausted": return "wallet_session_exhausted";
+			case "wallet_session_invalid": return "wallet_session_ended";
+			default: return null;
+		}
+	})();
+	if (!reason || input.phase !== "prepare") return null;
+	if (input.stepUp) return {
+		kind: "step_up_required",
+		reason,
+		step_up: input.stepUp
+	};
+	return {
+		kind: "denied",
+		denial: {
+			code: "authorization_unavailable",
+			message: "Owner operation step-up preparation is unavailable"
+		}
+	};
+}
+function routerAbOwnerOperationFailureResult(input, decision) {
+	return {
+		status: input.status,
+		body: {
+			ok: false,
+			code: input.code,
+			message: input.message,
+			...decision ? { authorization_decision: decision } : {}
+		}
+	};
+}
+async function evaluateRouterAbNormalSigningAdmission(input) {
+	if (!input.adapter) return {
+		ok: false,
+		status: 501,
+		code: "not_configured",
+		message: "Router A/B normal-signing admission adapter is not configured"
+	};
+	if (input.curve === "ed25519") return await input.adapter.evaluatePolicy({
+		curve: "ed25519",
+		authorityKind: "wallet_authority_v1",
+		authorityId: input.authorityId,
+		phase: input.phase,
+		walletId: input.walletId,
+		thresholdSessionId: input.thresholdSessionId,
+		walletSessionId: input.walletSessionId,
+		quotaId: input.quotaId,
+		requestId: input.requestId,
+		expiresAtMs: input.expiresAtMs,
+		signingWorkerId: input.signingWorkerId,
+		runtimePolicyScope: input.runtimePolicyScope
+	});
+	return await input.adapter.evaluatePolicy({
+		curve: "ecdsa",
+		phase: input.phase,
+		walletId: input.walletId,
+		materialActivationId: requireMpcMaterialActivationId(input.admission.materialActivation.activation_id),
+		authorizationIdentity: {
+			kind: "reusable_wallet_session",
+			walletSessionId: input.walletSessionId
+		},
+		requestId: input.admission.requestId,
+		expiresAtMs: input.admission.expiresAtMs,
+		signingWorkerId: input.signingWorkerId,
+		keyHandle: input.keyHandle,
+		runtimePolicyScope: input.runtimePolicyScope
+	});
+}
+function routerAbSigningError(status, code, message) {
+	return {
+		ok: false,
+		status,
+		body: {
+			ok: false,
+			code,
+			message
+		}
+	};
+}
+function routerAbWalletSessionValidationStatus(code) {
+	if (code === "sessions_disabled") return 501;
+	return walletSessionFailureStatus(code);
+}
+function requireMpcMaterialActivationId(value) {
+	const parsed = parseMpcMaterialActivationId(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function requireAuthorizationValue(result) {
+	if (!result.ok) throw new Error(result.error.message);
+	return result.value;
+}
+function routerAbStepUpError(status, code, message) {
+	return {
+		status,
+		body: {
+			ok: false,
+			code,
+			message
+		}
+	};
+}
+function routerAbErrorMessage(error) {
+	return String(error && typeof error === "object" && "message" in error ? error.message : error || "unknown error");
+}
+//#endregion
+export { buildRouterAbEcdsaAcceptedAuthorizedOperationV1, buildRouterAbEd25519AcceptedAuthorizedOperationV1, evaluateRouterAbNormalSigningAdmission, requireAuthorizationValue, requireMpcMaterialActivationId, routerAbErrorMessage, routerAbOwnerOperationFailureResult, routerAbOwnerOperationStepUpDecision, routerAbSigningError, routerAbStepUpError, routerAbWalletSessionValidationStatus };
+
+//# sourceMappingURL=routerAbNormalSigningAdmission.js.map

package/dist/esm/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.js

@@ -16,11 +16,17 @@ var InMemoryRouterAbNormalSigningAdmissionStore = class {
 	clearAbuseDecision(input) {
 		this.abuseDecisions.delete(abusePrincipalKey(input));
 	}
-	async evaluateProjectPolicy(input) {
-		return this.projectPolicies.get(runtimePolicyScopeKey(input.runtimePolicyScope)) || { kind: "allowed" };
-	}
-	async evaluateAbuse(input) {
-		return this.abuseDecisions.get(abusePrincipalKey(input)) || { kind: "allowed" };
+	async evaluatePolicy(input) {
+		const project = this.projectPolicies.get(runtimePolicyScopeKey(input.runtimePolicyScope));
+		if (project?.kind === "rejected") return {
+			kind: "project_policy_rejected",
+			retryAfterMs: project.retryAfterMs
+		};
+		const abuse = this.abuseDecisions.get(abusePrincipalKey(input)) ?? { kind: "allowed" };
+		return abuse.kind === "rejected" ? {
+			kind: "abuse_rejected",
+			retryAfterMs: abuse.retryAfterMs
+		} : abuse;
 	}
 };
 var DefaultRouterAbNormalSigningAdmissionAdapter = class {
@@ -30,18 +36,13 @@ var DefaultRouterAbNormalSigningAdmissionAdapter = class {
 	}
 	async evaluatePolicy(input) {
 		if (input.expiresAtMs <= this.now()) return admissionFailure(408, "invalid_body", "Router A/B normal-signing request is expired");
-		const projectPolicy = await this.store.evaluateProjectPolicy(input);
-		switch (projectPolicy.kind) {
-			case "allowed": break;
-			case "rejected": return admissionFailure(403, "project_policy_rejected", "Router A/B normal-signing project policy rejected the request");
-			default: return assertNever(projectPolicy);
-		}
-		const abuse = await this.store.evaluateAbuse(input);
-		switch (abuse.kind) {
+		const policy = await this.store.evaluatePolicy(input);
+		switch (policy.kind) {
 			case "allowed": return { ok: true };
+			case "project_policy_rejected": return admissionFailure(403, "project_policy_rejected", "Router A/B normal-signing project policy rejected the request");
 			case "rate_limited": return admissionFailure(429, "rate_limited", "Router A/B normal-signing request is rate limited");
-			case "rejected": return admissionFailure(403, "abuse_rejected", "Router A/B normal-signing abuse policy rejected the request");
-			default: return assertNever(abuse);
+			case "abuse_rejected": return admissionFailure(403, "abuse_rejected", "Router A/B normal-signing abuse policy rejected the request");
+			default: return assertNever(policy);
 		}
 	}
 };

package/dist/esm/router/domains/signingOperations/routerAbOperationStepUp.js

@@ -0,0 +1,313 @@
+import { parseProviderSubject } from "../../../shared-ts/src/utils/domainIds.js";
+import { parsePrincipalId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import "../../../shared-ts/src/utils/encoders.js";
+import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseSessionOrigin } from "../../../authorization/domain.js";
+import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
+import { resolveWalletSessionAuthorizationV2Admission } from "./walletExecutionAdmission.js";
+import { resolveWalletSessionOperationCredentialAdmission } from "../../auth/commonRouterUtils.js";
+import { routerAbStepUpError } from "./routerAbNormalSigningAdmission.js";
+//#region src/router/domains/signingOperations/routerAbOperationStepUp.ts
+async function resolveRouterAbEd25519OperationStepUpSession(input) {
+	const admittedMaterialActivation = routerAbMpcMaterialActivationRefToWire(input.admission.materialActivation);
+	if (input.admission.operationKind !== input.operationKind || String(input.session.walletId) !== input.walletId || input.materialOwner !== input.walletId || !Number.isSafeInteger(input.requestExpiresAtMs) || input.requestExpiresAtMs > input.session.expiresAtMs || !sameRouterAbMpcMaterialActivationRef(admittedMaterialActivation, input.materialActivation)) return walletSessionScopeInvalidFailure();
+	let activeMaterial;
+	try {
+		activeMaterial = await input.resolveEd25519MaterialActivation({
+			walletId: input.walletId,
+			materialActivation: admittedMaterialActivation
+		});
+	} catch {
+		return walletSessionUnavailableFailure();
+	}
+	if (!activeMaterial.ok || !sameRouterAbMpcMaterialActivationRef(activeMaterial.materialActivation, admittedMaterialActivation) || !sameRouterAbMpcMaterialActivationRef(activeMaterial.exportIdentity.scope.material_activation, admittedMaterialActivation) || activeMaterial.exportIdentity.scope.account_id !== input.walletId || activeMaterial.exportIdentity.application_binding.wallet_id !== input.walletId || base64UrlEncode(Uint8Array.from(activeMaterial.exportIdentity.registered_public_key)) !== input.admission.signer.registeredPublicKeyB64u) return {
+		ok: false,
+		error: routerAbStepUpError(activeMaterial.ok || activeMaterial.code !== "internal" ? 403 : 503, activeMaterial.ok || activeMaterial.code !== "internal" ? "scope_mismatch" : "wallet_session_unavailable", activeMaterial.ok ? "Wallet Session material does not match the active Ed25519 material" : activeMaterial.message)
+	};
+	const exact = exactOperationStepUpSession({
+		session: input.session,
+		authorizedOperations: input.authorizedOperations,
+		runtimePolicyScope: activeMaterial.runtimePolicyScope
+	});
+	if (!exact.ok) return exact;
+	return {
+		ok: true,
+		activeMaterial,
+		session: exact.session
+	};
+}
+function walletSessionUnavailableFailure() {
+	return {
+		ok: false,
+		error: routerAbStepUpError(503, "wallet_session_unavailable", "Wallet Session is unavailable")
+	};
+}
+function walletSessionScopeInvalidFailure() {
+	return {
+		ok: false,
+		error: routerAbStepUpError(403, "scope_mismatch", "Wallet Session scope is invalid")
+	};
+}
+function parseStepUpRequestOrigin(headers) {
+	const requestOriginRaw = (Array.isArray(headers.origin) ? headers.origin[0] : headers.origin) || "";
+	try {
+		return {
+			ok: true,
+			requestOrigin: parseSessionOrigin(String(requestOriginRaw).trim())
+		};
+	} catch {
+		return {
+			ok: false,
+			error: routerAbStepUpError(401, "unauthorized", "Wallet owner proof origin is invalid")
+		};
+	}
+}
+function walletSessionCandidateAdmission(session, candidate, operation) {
+	return resolveWalletSessionAuthorizationV2Admission({
+		authorization: session,
+		authority: candidate.authority,
+		authMethod: candidate.authMethod,
+		operation: {
+			tenantId: session.tenantId,
+			principalId: session.principalId,
+			walletId: session.walletId,
+			...operation
+		},
+		retiredAtMs: candidate.retiredAtMs,
+		nowMs: Date.now()
+	});
+}
+async function readExhaustedWalletSessionCandidate(input) {
+	let candidate;
+	try {
+		candidate = await input.authorizationSessions.readExhaustedWalletSessionAuthorizationV2CandidateByOperationCredential({
+			tenantId: input.authorizationSessions.tenantId,
+			token: input.token,
+			nowMs: Date.now()
+		});
+	} catch {
+		return walletSessionUnavailableFailure();
+	}
+	if (!candidate) return null;
+	const session = candidate.status.session;
+	return {
+		ok: true,
+		candidate,
+		session,
+		admission: walletSessionCandidateAdmission(session, candidate, input.operation)
+	};
+}
+function ecdsaStepUpActiveMaterial(input) {
+	const activeMaterial = input.activeMaterial;
+	const normalSigning = activeMaterial.ok ? activeMaterial.routerAbEcdsaDerivationNormalSigning : null;
+	if (!activeMaterial.ok || !normalSigning || !sameRouterAbMpcMaterialActivationRef(activeMaterial.materialActivation, input.admittedMaterialActivation) || !sameRouterAbMpcMaterialActivationRef(normalSigning.scope.material_activation, input.admittedMaterialActivation) || normalSigning.scope.wallet_id !== input.walletId || normalSigning.scope.public_identity.threshold_public_key33_b64u !== input.signer.thresholdPublicKey33B64u || normalSigning.scope.public_identity.ethereum_address20_b64u !== evmAddress20B64u(input.signer.evmAddress)) return {
+		ok: false,
+		error: routerAbStepUpError(activeMaterial.ok || activeMaterial.code !== "internal" ? 403 : 503, activeMaterial.ok || activeMaterial.code !== "internal" ? "scope_mismatch" : "wallet_session_unavailable", activeMaterial.ok ? "Wallet Session material does not match the active ECDSA material" : activeMaterial.message)
+	};
+	return {
+		ok: true,
+		activeMaterial
+	};
+}
+function exactOperationStepUpSession(input) {
+	if (input.session.tenantId !== input.authorizedOperations.tenantId || input.runtimePolicyScope.orgId !== input.session.tenantId || input.session.expiresAtMs <= Date.now()) return walletSessionScopeInvalidFailure();
+	return {
+		ok: true,
+		session: {
+			tenantId: input.session.tenantId,
+			principalId: input.session.principalId,
+			sessionId: String(input.session.authorizationId),
+			walletId: String(input.session.walletId),
+			runtimePolicyScope: input.runtimePolicyScope,
+			laneAuthorization: {
+				kind: "wallet_auth_method",
+				walletAuthMethodId: input.session.walletAuthMethodId
+			}
+		}
+	};
+}
+async function authenticateRouterAbWalletOperationStepUpIdentity(input) {
+	if (!input.authorizedOperations) return {
+		ok: false,
+		error: routerAbStepUpError(501, "not_configured", "Router A/B operation step-up authorization is not configured")
+	};
+	const origin = parseStepUpRequestOrigin(input.headers);
+	if (!origin.ok) return origin;
+	const requestOrigin = origin.requestOrigin;
+	if (input.kind === "verified_owner_proof") {
+		const tenantId = input.authorizedOperations.tenantId;
+		const authorityRef = await walletAuthAuthorityRef({ authority: input.authority });
+		const principal = parsePrincipalId(input.authority.factor.kind === "email_otp" ? input.authority.factor.providerUserId : input.walletId);
+		const authSource = walletExecutionLaneAuthSourceFromAuthority(input.authority);
+		if (!principal.ok || !authSource || input.walletId !== input.materialOwner || input.authority.walletId !== input.walletId || input.runtimePolicyScope.orgId !== tenantId || input.expiresAtMs <= Date.now()) return {
+			ok: false,
+			error: routerAbStepUpError(403, "scope_mismatch", "Wallet owner proof scope is invalid")
+		};
+		return {
+			ok: true,
+			authorizedOperations: input.authorizedOperations,
+			session: {
+				tenantId,
+				principalId: principal.value,
+				sessionId: input.operationId,
+				walletId: input.walletId,
+				runtimePolicyScope: input.runtimePolicyScope,
+				laneAuthorization: {
+					kind: "authority_ref",
+					authorityRef,
+					authSource
+				}
+			},
+			authorityRef,
+			requestOrigin,
+			expiresAtMs: input.expiresAtMs
+		};
+	}
+	if (!input.authorizationSessions) return {
+		ok: false,
+		error: routerAbStepUpError(501, "not_configured", "Router A/B Wallet Sessions are not configured")
+	};
+	const token = extractBearerCredential(input.headers);
+	if (!token) return {
+		ok: false,
+		error: routerAbStepUpError(401, "unauthorized", "Wallet Session is required")
+	};
+	let resolution;
+	try {
+		const operation = input.keyFamily === "ed25519" ? {
+			keyFamily: "ed25519",
+			operationKind: input.operationKind
+		} : {
+			keyFamily: "ecdsa_secp256k1",
+			operationKind: input.operationKind
+		};
+		resolution = await resolveWalletSessionOperationCredentialAdmission({
+			authorizationSessions: input.authorizationSessions,
+			token,
+			nowMs: Date.now(),
+			operation
+		});
+	} catch {
+		return walletSessionUnavailableFailure();
+	}
+	if (resolution.kind === "not_found") return {
+		ok: false,
+		error: routerAbStepUpError(401, "unauthorized", "Wallet Session is invalid")
+	};
+	if (resolution.kind === "rejected") return walletSessionScopeInvalidFailure();
+	const admission = resolution.admission;
+	const session = admission.context.authorization.session;
+	const admittedMaterialActivation = routerAbMpcMaterialActivationRefToWire(admission.admission.materialActivation);
+	if (admission.curve === "ed25519" && input.keyFamily === "ed25519") {
+		const resolved = await resolveRouterAbEd25519OperationStepUpSession({
+			walletId: input.walletId,
+			materialOwner: input.materialOwner,
+			materialActivation: input.materialActivation,
+			requestExpiresAtMs: input.requestExpiresAtMs,
+			operationKind: input.operationKind,
+			authorizedOperations: input.authorizedOperations,
+			session,
+			admission: admission.admission,
+			resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+		});
+		if (!resolved.ok) return {
+			ok: false,
+			error: resolved.error
+		};
+		return {
+			ok: true,
+			authorizedOperations: input.authorizedOperations,
+			session: resolved.session,
+			requestOrigin,
+			expiresAtMs: session.expiresAtMs
+		};
+	}
+	if (admission.admission.keyFamily !== input.keyFamily || admission.admission.operationKind !== input.operationKind || String(session.walletId) !== input.walletId || input.materialOwner !== input.walletId || !Number.isSafeInteger(input.requestExpiresAtMs) || input.requestExpiresAtMs > session.expiresAtMs || !sameRouterAbMpcMaterialActivationRef(admittedMaterialActivation, input.materialActivation)) return walletSessionScopeInvalidFailure();
+	let runtimePolicyScope;
+	try {
+		if (admission.curve === "ecdsa" && input.keyFamily === "ecdsa_secp256k1") {
+			const active = ecdsaStepUpActiveMaterial({
+				activeMaterial: await input.resolveEcdsaMaterialActivation({
+					walletId: input.walletId,
+					materialActivation: admittedMaterialActivation
+				}),
+				admittedMaterialActivation,
+				walletId: input.walletId,
+				signer: admission.admission.signer
+			});
+			if (!active.ok) return active;
+			runtimePolicyScope = active.activeMaterial.runtimePolicyScope;
+		} else return {
+			ok: false,
+			error: routerAbStepUpError(403, "scope_mismatch", "Wallet Session family is invalid")
+		};
+	} catch {
+		return walletSessionUnavailableFailure();
+	}
+	const exact = exactOperationStepUpSession({
+		session,
+		authorizedOperations: input.authorizedOperations,
+		runtimePolicyScope
+	});
+	if (!exact.ok) return exact;
+	return {
+		ok: true,
+		authorizedOperations: input.authorizedOperations,
+		session: exact.session,
+		requestOrigin,
+		expiresAtMs: session.expiresAtMs
+	};
+}
+function walletExecutionLaneAuthSourceFromAuthority(authority) {
+	if (authority.factor.kind === "passkey") return {
+		kind: "passkey",
+		credentialIdB64u: authority.factor.credentialIdB64u
+	};
+	const providerSubject = parseProviderSubject(authority.factor.providerUserId);
+	return providerSubject.ok ? {
+		kind: "oidc_provider",
+		providerId: authority.factor.provider === "google" ? "google_oidc" : "oidc",
+		providerSubject: providerSubject.value
+	} : null;
+}
+function evmAddress20B64u(value) {
+	if (!/^0x[0-9a-fA-F]{40}$/.test(value)) return null;
+	const bytes = new Uint8Array(20);
+	for (let index = 0; index < bytes.length; index += 1) bytes[index] = Number.parseInt(value.slice(2 + index * 2, 4 + index * 2), 16);
+	return base64UrlEncode(bytes);
+}
+function recordedStepUpOperationClaim(existing) {
+	if (existing.authorization.kind !== "verified_step_up" || existing.quota.kind !== "quota_neutral") return {
+		ok: false,
+		error: routerAbStepUpError(409, "authorized_operation_missing", "Operation authorization has an invalid source or quota")
+	};
+	return {
+		ok: true,
+		operation: {
+			tenantId: existing.tenantId,
+			authorizedOperationId: existing.authorizedOperationId,
+			auditEventId: existing.auditEventId,
+			operation: existing.operation,
+			authorization: existing.authorization,
+			quota: existing.quota,
+			claimedAtMs: Date.now()
+		}
+	};
+}
+function routerAbOperationStepUpClaimFailure(result) {
+	switch (result.kind) {
+		case "claimed":
+		case "operation_in_progress":
+		case "replayed": return null;
+		case "authorization_grant_rejected":
+		case "verified_step_up_rejected": return routerAbStepUpError(403, result.kind, "Operation step-up authorization is invalid");
+		case "wallet_session_quota_exhausted": return routerAbStepUpError(409, result.kind, "Operation step-up authorization is invalid");
+		case "material_mismatch": return routerAbStepUpError(403, result.kind, "Operation step-up material is invalid");
+	}
+}
+//#endregion
+export { authenticateRouterAbWalletOperationStepUpIdentity, ecdsaStepUpActiveMaterial, exactOperationStepUpSession, parseStepUpRequestOrigin, readExhaustedWalletSessionCandidate, recordedStepUpOperationClaim, resolveRouterAbEd25519OperationStepUpSession, routerAbOperationStepUpClaimFailure, walletSessionCandidateAdmission, walletSessionScopeInvalidFailure, walletSessionUnavailableFailure };
+
+//# sourceMappingURL=routerAbOperationStepUp.js.map