@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletRecoveryFinalization.d.ts

@@ -1,13 +1,26 @@
 import { type PasskeyCustodyEnvelopeRecord } from '../../../../../shared-ts/src/passkey-custody';
-import { type WalletAuthMethodId, type WalletAuthorityId, type WalletRecoveryOperationId } from '../../../../../shared-ts/src/utils/domainIds';
+import { type ActiveWalletAuthorityV1 } from '../../../../../shared-ts/src/authorization';
+import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId, type WalletRecoveryOperationId } from '../../../../../shared-ts/src/utils/domainIds';
+import type { WalletAuthAuthorityRef } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
 import { type RecoveryCodeReservationId } from '../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
+import type { WalletRecoveryEnvelopeSetRecord } from '../../../../../shared-ts/src/wallet-recovery';
 import type { DeviceId } from '../../../../../shared-ts/src/authorization/capabilityKinds';
 import type { CloudflareD1PasskeyCustodyEnvelopeStore } from '../../cloudflare/d1/passkeyCustody/d1PasskeyCustodyEnvelopeStore';
 import type { CloudflareD1WalletCustodyCommitStore } from '../../cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore';
 import type { CloudflareD1WebAuthnStore } from '../../cloudflare/d1/webauthn/d1WebAuthnStore';
+import type { WebAuthnRecoveryContinuityAnchorRecord } from '../../cloudflare/d1/webauthn/d1WebAuthnRecords';
 import type { D1WalletStore } from '../../../core/d1WalletStore';
 import type { D1WalletAuthorityStore } from '../../cloudflare/d1/wallet/d1WalletAuthorityStore';
+import { type WalletRecoveryKeyManifestV1 } from './walletRecoveryKeyManifest';
 import type { WalletRecoveryEcdsaPossessionProofV1 } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession';
+type ContinuityAnchorRead = {
+    readonly kind: 'ready';
+    readonly authority: ActiveWalletAuthorityV1;
+    readonly authorityRef: WalletAuthAuthorityRef;
+} | {
+    readonly kind: 'rejected';
+    readonly reason: string;
+};
 export type WalletRecoveryFinalizationResult = {
     readonly kind: 'promoted';
     readonly storeVersion: string;
@@ -31,6 +44,35 @@ export type WalletRecoveryFinalizationResult = {
     readonly kind: 'registration_rejected';
     readonly reason: string;
 };
+export declare function sameWalletCustodyRecoveryReplacementEnvelopeV1(left: PasskeyCustodyEnvelopeRecord, right: PasskeyCustodyEnvelopeRecord): boolean;
+export declare function readRecoveryContinuityAnchor(input: {
+    readonly walletId: WalletId;
+    readonly anchor: WebAuthnRecoveryContinuityAnchorRecord;
+    readonly manifest: WalletRecoveryKeyManifestV1;
+    readonly envelopeStore: CloudflareD1PasskeyCustodyEnvelopeStore;
+    readonly walletCustodyCommits: CloudflareD1WalletCustodyCommitStore;
+    readonly walletAuthorityStore: Pick<D1WalletAuthorityStore, 'readById'>;
+}): Promise<ContinuityAnchorRead>;
+export declare function parseRecoveryAuthorityDigest(authority: ActiveWalletAuthorityV1): import("../../../../../shared-ts/src/utils/domainIds").WalletAuthorityBindingDigest;
+export declare function buildRecoveredWalletAuthority(input: {
+    readonly walletId: WalletId;
+    readonly target: {
+        readonly recoveryOperationId: WalletRecoveryOperationId;
+        readonly targetDeviceId: DeviceId;
+        readonly targetAuthorityId: WalletAuthorityId;
+    };
+    readonly continuityAuthority: ActiveWalletAuthorityV1;
+    readonly manifest: WalletRecoveryKeyManifestV1;
+    readonly nowMs: number;
+}): Promise<ActiveWalletAuthorityV1>;
+export declare function buildConsumedRecoverySet(input: {
+    readonly record: WalletRecoveryEnvelopeSetRecord;
+    readonly reservedIndex: number;
+    readonly consumedLifecycle: Extract<WalletRecoveryEnvelopeSetRecord['manifestKekWraps'][number]['lifecycle'], {
+        readonly state: 'consumed';
+    }>;
+    readonly nowMs: number;
+}): WalletRecoveryEnvelopeSetRecord;
 export declare function finalizeRecoveredWalletCredentialV1(input: {
     readonly envelopeStore: CloudflareD1PasskeyCustodyEnvelopeStore;
     readonly walletCustodyCommits: CloudflareD1WalletCustodyCommitStore;

package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletRecoveryKeyManifest.d.ts

@@ -3,7 +3,6 @@ import type { EcdsaServerGeneration } from '../../../../../shared-ts/src/utils/e
 import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
 import type { WalletId } from '../../../../../shared-ts/src/utils/domainIds';
 import type { ThresholdEcdsaChainTarget } from '../../../core/thresholdEcdsaChainTarget';
-import type { RouterAbEd25519YaoApplicationBindingFactsV1, RouterAbEd25519YaoBytes32V1, RouterAbEd25519YaoLifecycleScopeV1 } from '../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import { type RouterAbEcdsaDerivationPublicCapabilityV1, type RouterAbEcdsaRegistrationActivationReceiptV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import { type WalletEcdsaSignerRecord, type WalletEd25519SignerRecord } from '../../../core/WalletStore';
 import type { D1WalletStore } from '../../../core/d1WalletStore';
@@ -11,8 +10,9 @@ import { type RecoveryCodeReservationId, type WalletRecoveryKeySetId } from '../
 import type { WalletRecoveryEcdsaPossessionChallengeV1 } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession';
 import { type WalletRecoveryEcdsaPossessionProofV1 } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession';
 import type { WalletAuthAuthorityRef } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { WalletRecoveryPreparationNearRecoveryBasisV1 } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryPreparation';
 export type { WalletRecoveryKeySetId } from '../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
-export type WalletRecoveryKeyManifestEntryV1 = {
+type WalletRecoveryKeyManifestEntryV1 = {
     readonly kind: 'near_ed25519';
     readonly keySetId: `near_ed25519:${string}`;
     readonly signerId: string;
@@ -64,7 +64,7 @@ export type PreparedEd25519RecoveryAdmissionV1 = {
         readonly kind: 'near_ed25519';
     }>[];
 };
-export type WalletRecoveryPreparationKeyManifestEntryV1 = {
+type WalletRecoveryPreparationKeyManifestEntryV1 = {
     readonly kind: 'near_ed25519';
     readonly keySetId: `near_ed25519:${string}`;
     readonly signerId: string;
@@ -79,19 +79,7 @@ export type WalletRecoveryPreparationKeyManifestEntryV1 = {
     readonly recordedKeyManifestDigestB64u: string;
     readonly recoveryBasis: WalletRecoveryPreparationEcdsaRecoveryBasisV1;
 };
-export type WalletRecoveryPreparationNearRecoveryBasisV1 = {
-    readonly capabilityKind: 'registration' | 'recovery';
-    readonly activeCapabilityBinding: RouterAbEd25519YaoBytes32V1;
-    readonly scope: RouterAbEd25519YaoLifecycleScopeV1;
-    readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
-    readonly participantIds: readonly [number, number];
-    readonly registeredPublicKey: RouterAbEd25519YaoBytes32V1;
-    readonly runtimePolicyScope: RuntimePolicyScope;
-    readonly activationTranscript: RouterAbEd25519YaoBytes32V1;
-    readonly activationStateEpoch: number;
-    readonly signingWorkerVerifyingShare: RouterAbEd25519YaoBytes32V1;
-};
-export type WalletRecoveryPreparationEcdsaRecoveryBasisV1 = {
+type WalletRecoveryPreparationEcdsaRecoveryBasisV1 = {
     readonly publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
     readonly activationReceipt: RouterAbEcdsaRegistrationActivationReceiptV1;
     readonly serverGeneration: EcdsaServerGeneration;
@@ -104,7 +92,7 @@ export type WalletRecoveryPreparationEcdsaRecoveryBasisV1 = {
     readonly participantIds: readonly [number, number];
     readonly possessionChallenge: WalletRecoveryEcdsaPossessionChallengeV1;
 };
-export type WalletUnlockKeyManifestEntryV1 = {
+type WalletUnlockKeyManifestEntryV1 = {
     readonly kind: 'near_ed25519';
     readonly keySetId: `near_ed25519:${string}`;
     readonly signerId: string;
@@ -134,7 +122,7 @@ export type WalletRecoveryPreparationKeyManifestV1 = {
     readonly walletId: WalletId;
     readonly entries: readonly WalletRecoveryPreparationKeyManifestEntryV1[];
 };
-export type WalletRecoveryActivationVerification = {
+type WalletRecoveryActivationVerification = {
     readonly kind: 'verified';
     readonly keySetIds: readonly WalletRecoveryKeySetId[];
 } | {
@@ -145,7 +133,7 @@ export type WalletRecoveryEcdsaMaterialPossessionProofInputV1 = {
     readonly keySetId: string;
     readonly proof: WalletRecoveryEcdsaPossessionProofV1;
 };
-export type WalletRecoveryEcdsaActivationReceiptInputV1 = {
+type WalletRecoveryEcdsaActivationReceiptInputV1 = {
     readonly keySetId: string;
     readonly activationReceipt: RouterAbEcdsaRegistrationActivationReceiptV1;
 };

package/dist/types/wallet-server/src/router/domains/signingOperations/ed25519AuthorizedOperationReceipt.d.ts

@@ -23,10 +23,7 @@ export type Ed25519VerifiedStepUpAuthorizedOperationReceipt = {
     readonly display_digest_b64u: string;
     readonly operation_fingerprint_digest: string;
 };
-export type Ed25519AuthorizedOperationReceipt = Ed25519ReusableAuthorizedOperationReceipt | Ed25519VerifiedStepUpAuthorizedOperationReceipt;
 export declare function requireEd25519OperationKind(value: unknown): Ed25519OperationKind;
-export declare function requireAuthorizedOperationReceiptString(record: Record<string, unknown>, name: string): string;
-export declare function requireExactAuthorizedOperationReceiptFields(record: Record<string, unknown>, branchFields?: readonly string[]): void;
 export declare function parseEd25519ReusableAuthorizedOperationReceipt(value: unknown): Ed25519ReusableAuthorizedOperationReceipt;
 export declare function parseEd25519VerifiedStepUpAuthorizedOperationReceipt(value: unknown): Ed25519VerifiedStepUpAuthorizedOperationReceipt;
 //# sourceMappingURL=ed25519AuthorizedOperationReceipt.d.ts.map

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.d.ts

@@ -0,0 +1,164 @@
+import type { EcdsaWalletSessionAdmissionInput, EcdsaWalletSessionPhaseAdmission } from '../../../authorization/ecdsaWalletSessionAdmission';
+import { type ThresholdEcdsaSessionInputs } from '../../auth/commonRouterUtils';
+import type { SessionAdapter } from '../../framework/routerApi';
+import { type RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire, type RouterAbEcdsaOperationStepUpPreparationV1Wire } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
+import type { RouterApiAuthorizedOperationService, RouterApiAuthorizationSessionService, RouterApiWalletRegistrationService, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext } from '../../framework/authServicePort';
+import { type AuthorizedOperation, type AuthorizedOperationReplayResponse, type OwnerOperationAuthorizationDecision, type SessionOrigin } from '../../../authorization/domain';
+import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import { type AcceptedEcdsaRouteAdmission, type RouterAbEcdsaOperationAdmission, type RouterAbEcdsaOperationAdmissionKind, type RouterAbJsonRouteResult, type RouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningRouteRuntime } from './routerAbNormalSigningAdmission';
+import { type ActiveEcdsaMaterialActivation, type RouterAbExactOperationStepUpWalletSession, type RouterAbOperationStepUpAuthenticationFailure, type RouterAbOperationStepUpWalletSession } from './routerAbOperationStepUp';
+import { type RouterAbEcdsaDerivationPrivateSigningPath, type RouterAbEcdsaOperationStepUpRequest } from './routerAbPrivateSigningWorker';
+export declare function routerAbEcdsaAtomicAuthorizationConfigured(authorizedOperations: Pick<RouterApiAuthorizedOperationService, 'admitAuthorizedOperation'>): boolean;
+export declare function routerAbEcdsaOperationInProgressResult(): RouterAbJsonRouteResult;
+export declare function buildRouterAbEcdsaOwnerOperationStepUpPreparation(input: {
+    readonly request: RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire;
+    readonly keyHandle: string;
+    readonly relayerKeyId: string;
+    readonly participantIds: readonly number[];
+}): RouterAbEcdsaOperationStepUpPreparationV1Wire | null;
+export declare function decideRouterAbEcdsaOwnerOperationAuthorization(input: {
+    readonly operation: AuthorizedOperation;
+}): OwnerOperationAuthorizationDecision<RouterAbEcdsaOperationStepUpPreparationV1Wire>;
+export declare function routerAbEcdsaOwnerOperationFailureResult(input: {
+    readonly status: number;
+    readonly code: string;
+    readonly message: string;
+    readonly phase: 'prepare' | 'finalize';
+    readonly stepUp?: RouterAbEcdsaOperationStepUpPreparationV1Wire;
+}): RouterAbJsonRouteResult;
+export declare function routerAbEcdsaReplayUnavailableResult(): RouterAbJsonRouteResult;
+export declare function routerAbEcdsaRecordedResponse(operation: AuthorizedOperation): AuthorizedOperationReplayResponse | null;
+export declare function routerAbEcdsaReplayResult(operation: AuthorizedOperation): RouterAbJsonRouteResult;
+export declare function routerAbEcdsaReplayHttpResponse(operation: AuthorizedOperation): Response | null;
+type RouterAbEcdsaWalletSessionValidationSuccess = Extract<ThresholdEcdsaSessionInputs, {
+    readonly ok: true;
+}>;
+type RouterAbEcdsaV2WalletSessionValidationSuccess = Extract<RouterAbEcdsaWalletSessionValidationSuccess, {
+    readonly kind: 'wallet_session_operation_credential_v1';
+}>;
+export type RouterAbEcdsaNormalSigningAuthorizationResult = {
+    readonly ok: true;
+    readonly kind: 'wallet_session_operation_credential_v1';
+    readonly validated: RouterAbEcdsaV2WalletSessionValidationSuccess;
+    readonly admission: AcceptedEcdsaRouteAdmission;
+    readonly activeMaterial: ActiveEcdsaMaterialActivation;
+} | {
+    readonly ok: true;
+    readonly kind: 'wallet_session_operation_credential_exhausted_candidate_v1';
+    readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
+    readonly admission: AcceptedEcdsaRouteAdmission;
+    readonly activeMaterial: ActiveEcdsaMaterialActivation;
+} | {
+    readonly ok: true;
+    readonly kind: 'operation_step_up';
+    readonly phase: 'prepare' | 'finalize';
+    readonly operation: AuthorizedOperation;
+    readonly session: RouterAbOperationStepUpWalletSession;
+    readonly admissionKind: RouterAbEcdsaOperationAdmissionKind;
+} | {
+    readonly ok: false;
+    readonly result: RouterAbJsonRouteResult;
+};
+/**
+ * Re-resolve the complete activation reference immediately before a claim or
+ * evidence write. The resolver is authoritative for capability identity and
+ * all owner/key/lifecycle/worker bindings; a stale or superseded reference
+ * must fail before any authorization side effect is attempted.
+ */
+export declare function resolveFreshRouterAbEcdsaMaterialActivation(input: {
+    readonly resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
+    readonly walletId: string;
+    readonly expected: RouterAbMpcMaterialActivationRefWire;
+}): Promise<{
+    readonly ok: true;
+    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    readonly keyHandle: string;
+    readonly relayerKeyId: string;
+    readonly participantIds: readonly [number, number];
+    readonly runtimePolicyScope: RuntimePolicyScope;
+} | {
+    readonly ok: false;
+    readonly code: 'not_found' | 'internal';
+    readonly message: string;
+} | {
+    readonly ok: false;
+    readonly code: 'scope_mismatch';
+    readonly message: string;
+}>;
+type RouterAbEcdsaWalletSessionOperationBinding = {
+    readonly kind: 'wallet_session_operation_credential_v1';
+    readonly validated: Pick<RouterAbEcdsaV2WalletSessionValidationSuccess, 'admission'>;
+} | {
+    readonly kind: 'wallet_session_operation_credential_exhausted_candidate_v1';
+    readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
+};
+export declare function admitRouterAbEcdsaReusableWalletSessionOperation(input: {
+    readonly phase: 'prepare' | 'finalize';
+    request: RouterAbEcdsaOperationStepUpRequest;
+    material: Pick<EcdsaWalletSessionAdmissionInput['material'], 'readSnapshot' | 'materialActivation' | 'keyHandle' | 'runtimePolicyScope'>;
+    binding: RouterAbEcdsaWalletSessionOperationBinding;
+    authorizedOperations: Pick<RouterApiAuthorizedOperationService, 'tenantId' | 'admitEcdsaWalletSessionOperation' | 'resolveEcdsaWalletSessionOperation'>;
+}): Promise<({
+    readonly ok: true;
+} & EcdsaWalletSessionPhaseAdmission) | {
+    readonly ok: false;
+    readonly error: RouterAbJsonRouteResult;
+}>;
+export declare function completeRouterAbEcdsaOperation(input: {
+    authorizedOperations: RouterApiAuthorizedOperationService;
+    operation: AuthorizedOperation;
+    result: 'succeeded' | 'failed_before_side_effect' | 'failed_after_side_effect';
+    response: AuthorizedOperationReplayResponse;
+}): Promise<void>;
+type RouterAbEcdsaOperationStepUpAuthenticationRequest = RouterAbEcdsaOperationStepUpRequest | RouterAbEcdsaOperationStepUpPreparationV1Wire;
+type RouterAbEcdsaOperationStepUpAuthenticationResult = {
+    readonly ok: true;
+    readonly authorizedOperations: RouterApiAuthorizedOperationService;
+    readonly activeMaterial: ActiveEcdsaMaterialActivation;
+    readonly session: RouterAbExactOperationStepUpWalletSession;
+    readonly requestOrigin: SessionOrigin;
+    readonly expiresAtMs: number;
+} | RouterAbOperationStepUpAuthenticationFailure;
+export declare function authenticateRouterAbEcdsaOperationStepUp(input: {
+    readonly headers: Record<string, string | string[] | undefined>;
+    readonly request: RouterAbEcdsaOperationStepUpAuthenticationRequest;
+    readonly authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
+    readonly authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
+    readonly resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
+}): Promise<RouterAbEcdsaOperationStepUpAuthenticationResult>;
+export declare function claimRouterAbEcdsaOperationStepUp(input: {
+    readonly operationKind: 'evm.sign_transaction' | 'evm.export_key';
+    readonly operation: Pick<RouterAbEcdsaOperationStepUpPreparationV1Wire, 'operation_id' | 'operation_digests' | 'material_activation'>;
+    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    readonly keyHandle: string;
+    readonly authenticated: Extract<Awaited<ReturnType<typeof authenticateRouterAbEcdsaOperationStepUp>>, {
+        readonly ok: true;
+    }>;
+}): Promise<RouterAbJsonRouteResult | RouterAbEcdsaOperationAdmission | null>;
+export declare function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input: {
+    body: Record<string, unknown>;
+    rawBody: unknown;
+    headers: Record<string, string | string[] | undefined>;
+    session: SessionAdapter | null | undefined;
+    authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
+    authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
+    admissionAdapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
+    resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
+    phase: 'prepare' | 'finalize';
+}): Promise<RouterAbEcdsaNormalSigningAuthorizationResult>;
+export declare function handleRouterAbEcdsaDerivationNormalSigningRouteCore(input: {
+    body: Record<string, unknown>;
+    rawBody: unknown;
+    headers: Record<string, string | string[] | undefined>;
+    session: SessionAdapter | null | undefined;
+    runtime: RouterAbNormalSigningRouteRuntime | null | undefined;
+    authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
+    authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
+    admissionAdapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
+    resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
+    privatePath: RouterAbEcdsaDerivationPrivateSigningPath;
+    phase: 'prepare' | 'finalize';
+}): Promise<RouterAbJsonRouteResult>;
+export {};
+//# sourceMappingURL=routerAbEcdsaDerivationNormalSigningRoute.d.ts.map

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbEd25519NormalSigningRoute.d.ts

@@ -0,0 +1,110 @@
+import { type ThresholdEd25519SessionInputs } from '../../auth/commonRouterUtils';
+import type { SessionAdapter } from '../../framework/routerApi';
+import { parseDigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { RouterApiAuthorizedOperationService, RouterApiAuthorizationSessionService, RouterApiWalletRegistrationService, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext } from '../../framework/authServicePort';
+import { type CapabilityOperationId, type CapabilityOperationRef } from '../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { AuthorizedOperation, OwnerOperationAuthorizationDecision } from '../../../authorization/domain';
+import { type RouterAbEd25519OperationStepUpPreparationV1Wire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import { type Ed25519OperationKind } from './ed25519AuthorizedOperationReceipt';
+import { type RouterAbEcdsaOperationAdmissionKind, type RouterAbJsonRouteResult, type RouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningRouteAdmission } from './routerAbNormalSigningAdmission';
+import { type ActiveEd25519MaterialActivation, type RouterAbExactOperationStepUpAuthenticationResult, type RouterAbOperationStepUpWalletSession } from './routerAbOperationStepUp';
+import { type RouterAbEd25519NormalSigningScopeV2 } from './routerAbPrivateSigningWorker';
+export type RouterAbEd25519NormalSigningRoutePhase = 'prepare' | 'finalize';
+export declare function buildRouterAbEd25519OwnerOperationStepUpPreparation(input: {
+    readonly scope: RouterAbEd25519NormalSigningScopeV2;
+    readonly body: Record<string, unknown>;
+    readonly material: {
+        readonly nearAccountId: string;
+        readonly signerSlot: number;
+        readonly signingWorkerId: string;
+        readonly participantIds: readonly [number, number];
+    };
+}): RouterAbEd25519OperationStepUpPreparationV1Wire | null;
+export declare function decideRouterAbEd25519OwnerOperationAuthorization(input: {
+    readonly operation: AuthorizedOperation;
+}): OwnerOperationAuthorizationDecision<RouterAbEd25519OperationStepUpPreparationV1Wire>;
+export declare function routerAbEd25519OwnerOperationFailureResult(input: {
+    readonly status: number;
+    readonly code: string;
+    readonly message: string;
+    readonly phase: RouterAbEd25519NormalSigningRoutePhase;
+    readonly stepUp?: RouterAbEd25519OperationStepUpPreparationV1Wire;
+}): RouterAbJsonRouteResult;
+type RouterAbEd25519WalletSessionValidationSuccess = Extract<ThresholdEd25519SessionInputs, {
+    readonly ok: true;
+}>;
+type RouterAbEd25519V2WalletSessionValidationSuccess = Extract<RouterAbEd25519WalletSessionValidationSuccess, {
+    readonly kind: 'wallet_session_operation_credential_v1';
+}>;
+export type RouterAbEd25519NormalSigningAuthorizationResult = {
+    readonly ok: true;
+    readonly kind: 'wallet_session_operation_credential_v1';
+    readonly validated: RouterAbEd25519V2WalletSessionValidationSuccess;
+    readonly admission: Extract<RouterAbNormalSigningRouteAdmission, {
+        readonly ok: true;
+    }>;
+    readonly activeMaterial: ActiveEd25519MaterialActivation;
+} | {
+    readonly ok: true;
+    readonly kind: 'wallet_session_operation_credential_exhausted_candidate_v1';
+    readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
+    readonly admission: Extract<RouterAbNormalSigningRouteAdmission, {
+        readonly ok: true;
+    }>;
+    readonly activeMaterial: ActiveEd25519MaterialActivation;
+} | {
+    readonly ok: true;
+    readonly kind: 'operation_step_up';
+    readonly phase: 'prepare';
+    readonly session: RouterAbOperationStepUpWalletSession;
+    readonly operation: AuthorizedOperation;
+    readonly operationDigests: {
+        readonly laneDigest: ReturnType<typeof parseDigestB64u>;
+        readonly intentDigest: ReturnType<typeof parseDigestB64u>;
+        readonly displayDigest: ReturnType<typeof parseDigestB64u>;
+    };
+    readonly admissionKind: RouterAbEcdsaOperationAdmissionKind;
+} | {
+    readonly ok: true;
+    readonly kind: 'operation_step_up';
+    readonly phase: 'finalize';
+    readonly session: RouterAbOperationStepUpWalletSession;
+} | {
+    readonly ok: false;
+    readonly result: RouterAbJsonRouteResult;
+};
+export declare function authenticateRouterAbWalletOperationStepUp(input: {
+    readonly headers: Record<string, string | string[] | undefined>;
+    readonly scope: RouterAbEd25519NormalSigningScopeV2;
+    readonly operationKind: Ed25519OperationKind;
+    readonly requestExpiresAtMs: number;
+    readonly authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
+    readonly authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
+    readonly resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'];
+}): Promise<RouterAbExactOperationStepUpAuthenticationResult>;
+export declare function parseRouterAbEd25519OperationStepUpScope(value: unknown): RouterAbEd25519NormalSigningScopeV2;
+export declare function parseRouterAbOperationStepUpOperation(value: unknown): {
+    readonly ok: true;
+    readonly operationId: CapabilityOperationId;
+    readonly operation: Extract<CapabilityOperationRef, {
+        readonly capabilityKind: 'near_ed25519_mpc_signing';
+    }> & {
+        readonly operationKind: 'near.sign_transaction' | 'near.sign_delegate_action' | 'near.sign_nep413_message';
+    };
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
+export declare function authorizeRouterAbEd25519NormalSigningRoute(input: {
+    body: Record<string, unknown>;
+    rawBody: unknown;
+    headers: Record<string, string | string[] | undefined>;
+    session: SessionAdapter | null | undefined;
+    authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
+    authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
+    admissionAdapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
+    resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'];
+    phase: RouterAbEd25519NormalSigningRoutePhase;
+}): Promise<RouterAbEd25519NormalSigningAuthorizationResult>;
+export {};
+//# sourceMappingURL=routerAbEd25519NormalSigningRoute.d.ts.map