@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbPrivateSigningWorker.d.ts

@@ -1,220 +1,13 @@
-import type { RouterAbNormalSigningAuthorizationIdentity, RouterAbSigningWorkerPrivateTransport } from '../../../core/routerAbSigning/RouterAbNormalSigningRuntime';
-import type { RouterAbNormalSigningRuntime } from '../../../core/routerAbSigning/RouterAbNormalSigningRuntime';
-import type { ThresholdEd25519AuthorityScope } from '../../../core/types';
-import { type ThresholdEd25519SessionInputs, type ThresholdEcdsaSessionInputs } from '../../auth/commonRouterUtils';
-import type { SessionAdapter } from '../../framework/routerApi';
-import { type RouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1Wire, type RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire, type RouterAbEcdsaOperationStepUpPreparationV1Wire, type RouterAbPublicDigest32V1Wire } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import { parseDigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { RouterAbSigningWorkerPrivateTransport } from '../../../core/routerAbSigning/RouterAbNormalSigningRuntime';
+import { type RouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1Wire, type RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire, type RouterAbPublicDigest32V1Wire } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
-import type { RouterApiAuthorizedOperationService, RouterApiAuthorizationSessionService, RouterApiWalletRegistrationService, RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext } from '../../framework/authServicePort';
-import type { WalletExecutionLaneAuthSource } from '../../../core/signingLanes/WalletExecutionLaneProjection';
 import type { SigningWorkerLaneMaterialIdentityV1 } from '../../../core/signingLanes/signingWorkerLaneMaterialIdentity';
-import { type WalletAuthAuthority, type WalletAuthAuthorityRef } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
-import { type AuthorizedOperationId, type CapabilityOperationId, type CapabilityOperationRef, type PrincipalId, type TenantId } from '../../../../../shared-ts/src/authorization/capabilityKinds';
-import { type AuthorizedOperation, type AuthorizedOperationReplayResponse, type OwnerOperationAuthorizationDecision } from '../../../authorization/domain';
-import { type RouterAbMpcMaterialActivationRefWire, type RouterAbEd25519OperationStepUpPreparationV1Wire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
-import { type Ed25519OperationKind } from './ed25519AuthorizedOperationReceipt';
-import { type WalletAuthMethodId, type MpcMaterialActivationId } from '../../../../../shared-ts/src/utils/domainIds';
-export declare function routerAbEcdsaAtomicAuthorizationConfigured(authorizedOperations: Pick<RouterApiAuthorizedOperationService, 'admitAuthorizedOperation'>): boolean;
-type RouterAbAcceptedAuthorizedOperationBindingV1 = {
-    readonly kind: 'reusable_wallet_session';
-    readonly walletSessionId: string;
-    readonly quotaId: string;
-} | {
-    readonly kind: 'gateway_owner_wallet_session';
-    readonly subjectId: string;
-    readonly accountId: string;
-    readonly authorizationId: string;
-    readonly walletSessionId: string;
-    readonly quotaId: string;
-    readonly thresholdSessionId: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly environment: string;
-    readonly signingWorkerId: string;
-    readonly expiresAtMs: number;
-} | {
-    readonly kind: 'operation_step_up';
-    readonly authorizationSessionId: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly environment: string;
-    readonly subjectId: string;
-};
-export declare function buildRouterAbEd25519AcceptedAuthorizedOperationV1(input: {
-    readonly operation: AuthorizedOperation;
-    readonly binding: RouterAbAcceptedAuthorizedOperationBindingV1;
-}): {
-    binding: {
-        kind: "reusable_wallet_session";
-        authorization_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").WalletSessionAuthorizationId;
-        wallet_session_id: string;
-        quota_id: string;
-        subject_id?: undefined;
-        account_id?: undefined;
-        threshold_session_id?: undefined;
-        org_id?: undefined;
-        project_id?: undefined;
-        environment?: undefined;
-        signing_worker_id?: undefined;
-        expires_at_ms?: undefined;
-        authorization_session_id?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: AuthorizedOperationId;
-        operation_id: CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization/operationFingerprint").CapabilityOperationFingerprintDigest;
-        kind: "reusable_wallet_session_authorized_operation_v1";
-    };
-} | {
-    binding: {
-        kind: "gateway_owner_wallet_session";
-        subject_id: string;
-        account_id: string;
-        authorization_id: string;
-        wallet_session_id: string;
-        quota_id: string;
-        threshold_session_id: string;
-        org_id: string;
-        project_id: string;
-        environment: string;
-        signing_worker_id: string;
-        expires_at_ms: number;
-        authorization_session_id?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: AuthorizedOperationId;
-        operation_id: CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization/operationFingerprint").CapabilityOperationFingerprintDigest;
-        kind: "reusable_wallet_session_authorized_operation_v1";
-    };
-} | {
-    binding: {
-        kind: "operation_step_up";
-        authorization_session_id: string;
-        org_id: string;
-        project_id: string;
-        environment: string;
-        subject_id: string;
-        authorization_id?: undefined;
-        wallet_session_id?: undefined;
-        quota_id?: undefined;
-        account_id?: undefined;
-        threshold_session_id?: undefined;
-        signing_worker_id?: undefined;
-        expires_at_ms?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: AuthorizedOperationId;
-        operation_id: CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization/operationFingerprint").CapabilityOperationFingerprintDigest;
-        kind: "verified_step_up_authorized_operation_v1";
-        authorization_session_id: string;
-        evidence_set_digest: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-    };
-};
-export declare function buildRouterAbEcdsaAcceptedAuthorizedOperationV1(input: {
-    readonly operation: AuthorizedOperation;
-    readonly binding: RouterAbAcceptedAuthorizedOperationBindingV1;
-}): {
-    binding: {
-        kind: "reusable_wallet_session";
-        authorization_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").WalletSessionAuthorizationId;
-        wallet_session_id: string;
-        quota_id: string;
-        subject_id?: undefined;
-        account_id?: undefined;
-        threshold_session_id?: undefined;
-        org_id?: undefined;
-        project_id?: undefined;
-        environment?: undefined;
-        signing_worker_id?: undefined;
-        expires_at_ms?: undefined;
-        authorization_session_id?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: AuthorizedOperationId;
-        operation_id: CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization/operationFingerprint").CapabilityOperationFingerprintDigest;
-        kind: "reusable_wallet_session_authorized_operation_v1";
-    };
-} | {
-    binding: {
-        kind: "gateway_owner_wallet_session";
-        subject_id: string;
-        account_id: string;
-        authorization_id: string;
-        wallet_session_id: string;
-        quota_id: string;
-        threshold_session_id: string;
-        org_id: string;
-        project_id: string;
-        environment: string;
-        signing_worker_id: string;
-        expires_at_ms: number;
-        authorization_session_id?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: AuthorizedOperationId;
-        operation_id: CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization/operationFingerprint").CapabilityOperationFingerprintDigest;
-        kind: "reusable_wallet_session_authorized_operation_v1";
-    };
-} | {
-    binding: {
-        kind: "operation_step_up";
-        authorization_session_id: string;
-        org_id: string;
-        project_id: string;
-        environment: string;
-        subject_id: string;
-        authorization_id?: undefined;
-        wallet_session_id?: undefined;
-        quota_id?: undefined;
-        account_id?: undefined;
-        threshold_session_id?: undefined;
-        signing_worker_id?: undefined;
-        expires_at_ms?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: AuthorizedOperationId;
-        operation_id: CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization/operationFingerprint").CapabilityOperationFingerprintDigest;
-        kind: "verified_step_up_authorized_operation_v1";
-        authorization_session_id: string;
-        evidence_set_digest: import("../../../../../shared-ts/src/utils/canonicalPrimitives").DigestB64u;
-    };
-};
+import type { AuthorizedOperationReplayResponse } from '../../../authorization/domain';
+import type { RouterAbNormalSigningAuthorizationWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import type { MpcMaterialActivationId } from '../../../../../shared-ts/src/utils/domainIds';
+import { type RouterAbSigningWorkerJsonResult } from './routerAbNormalSigningAdmission';
+import type { RouterAbOperationStepUpWalletSession } from './routerAbOperationStepUp';
+import type { ReadonlyExclusiveUnion } from '../../../../../shared-ts/src/utils/variant';
 declare const PRIVATE_ED25519_SIGNING_PREPARE_PATH = "/router-ab/signing-worker/sign/prepare";
 declare const PRIVATE_ED25519_SIGNING_FINALIZE_PATH = "/router-ab/signing-worker/sign";
 declare const PRIVATE_ECDSA_DERIVATION_SIGNING_PREPARE_PATH = "/router-ab/signing-worker/ecdsa-derivation/sign/prepare";
@@ -229,261 +22,10 @@ export declare const ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS: {
     readonly prepare: "/router-ab/signing-worker/ecdsa-derivation/sign/prepare";
     readonly finalize: "/router-ab/signing-worker/ecdsa-derivation/sign";
 };
-export type RouterAbSigningWorkerJsonResult = {
-    ok: true;
-    body: unknown;
-    replay: AuthorizedOperationReplayResponse;
-} | {
-    ok: false;
-    status: number;
-    body: {
-        ok: false;
-        code: string;
-        message: string;
-    };
-};
-type RouterAbSigningWorkerJsonError = Extract<RouterAbSigningWorkerJsonResult, {
-    ok: false;
-}>;
-export type RouterAbEd25519NormalSigningRoutePhase = 'prepare' | 'finalize';
-export type RouterAbJsonRouteResult = {
-    status: number;
-    body: unknown;
-};
-export type RouterAbEcdsaOperationAdmissionKind = 'claimed' | 'operation_in_progress' | 'replayed';
-export type RouterAbEcdsaOperationAdmission = {
-    readonly kind: RouterAbEcdsaOperationAdmissionKind;
-    readonly operation: AuthorizedOperation;
-};
-export declare function routerAbEcdsaOperationInProgressResult(): RouterAbJsonRouteResult;
-export declare function buildRouterAbEcdsaOwnerOperationStepUpPreparation(input: {
-    readonly request: RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire;
-    readonly keyHandle: string;
-    readonly relayerKeyId: string;
-    readonly participantIds: readonly number[];
-}): RouterAbEcdsaOperationStepUpPreparationV1Wire | null;
-export declare function decideRouterAbEcdsaOwnerOperationAuthorization(input: {
-    readonly operation: AuthorizedOperation;
-}): OwnerOperationAuthorizationDecision<RouterAbEcdsaOperationStepUpPreparationV1Wire>;
-export declare function buildRouterAbEd25519OwnerOperationStepUpPreparation(input: {
-    readonly scope: RouterAbEd25519NormalSigningScopeV2;
-    readonly body: Record<string, unknown>;
-    readonly material: {
-        readonly nearAccountId: string;
-        readonly signerSlot: number;
-        readonly signingWorkerId: string;
-        readonly participantIds: readonly [number, number];
-    };
-}): RouterAbEd25519OperationStepUpPreparationV1Wire | null;
-export declare function decideRouterAbEd25519OwnerOperationAuthorization(input: {
-    readonly operation: AuthorizedOperation;
-}): OwnerOperationAuthorizationDecision<RouterAbEd25519OperationStepUpPreparationV1Wire>;
-export declare function routerAbEd25519OwnerOperationFailureResult(input: {
-    readonly status: number;
-    readonly code: string;
-    readonly message: string;
-    readonly phase: RouterAbEd25519NormalSigningRoutePhase;
-    readonly stepUp?: RouterAbEd25519OperationStepUpPreparationV1Wire;
-}): RouterAbJsonRouteResult;
-export declare function routerAbEcdsaOwnerOperationFailureResult(input: {
-    readonly status: number;
-    readonly code: string;
-    readonly message: string;
-    readonly phase: 'prepare' | 'finalize';
-    readonly stepUp?: RouterAbEcdsaOperationStepUpPreparationV1Wire;
-}): RouterAbJsonRouteResult;
-export declare function routerAbEcdsaReplayUnavailableResult(): RouterAbJsonRouteResult;
-export declare function routerAbEcdsaRecordedResponse(operation: AuthorizedOperation): AuthorizedOperationReplayResponse | null;
-export declare function routerAbEcdsaReplayResult(operation: AuthorizedOperation): RouterAbJsonRouteResult;
-export declare function routerAbEcdsaReplayHttpResponse(operation: AuthorizedOperation): Response | null;
 type RouterAbConfiguredSigningWorkerPrivateTransport = Extract<RouterAbSigningWorkerPrivateTransport, {
     readonly kind: 'configured';
 }>;
-export type RouterAbNormalSigningRouteRuntime = Pick<RouterAbNormalSigningRuntime, 'getSigningWorkerPrivateTransport' | 'reservePrepareReplay'>;
-type AcceptedRouteAdmission = {
-    ok: true;
-    thresholdSessionId: string;
-    requestId: string;
-    expiresAtMs: number;
-    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
-};
-type AcceptedEcdsaRouteAdmission = AcceptedRouteAdmission & {
-    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
-};
-type RejectedRouteAdmission = {
-    ok: false;
-    error: RouterAbSigningWorkerJsonError;
-};
-export type RouterAbNormalSigningRouteAdmission = AcceptedRouteAdmission | AcceptedEcdsaRouteAdmission | RejectedRouteAdmission;
-type RouterAbEd25519WalletSessionValidationSuccess = Extract<ThresholdEd25519SessionInputs, {
-    readonly ok: true;
-}>;
-type RouterAbEd25519V2WalletSessionValidationSuccess = Extract<RouterAbEd25519WalletSessionValidationSuccess, {
-    readonly kind: 'wallet_session_operation_credential_v1';
-}>;
-type ActiveEd25519MaterialActivation = Extract<Awaited<ReturnType<RouterApiWalletRegistrationService['resolveEd25519MaterialActivation']>>, {
-    readonly ok: true;
-}>;
-type RouterAbEcdsaWalletSessionValidationSuccess = Extract<ThresholdEcdsaSessionInputs, {
-    readonly ok: true;
-}>;
-type RouterAbEcdsaV2WalletSessionValidationSuccess = Extract<RouterAbEcdsaWalletSessionValidationSuccess, {
-    readonly kind: 'wallet_session_operation_credential_v1';
-}>;
-type ActiveEcdsaMaterialActivation = Extract<Awaited<ReturnType<RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation']>>, {
-    readonly ok: true;
-}>;
-export type RouterAbEd25519NormalSigningAuthorizationResult = {
-    readonly ok: true;
-    readonly kind: 'wallet_session_operation_credential_v1';
-    readonly validated: RouterAbEd25519V2WalletSessionValidationSuccess;
-    readonly admission: Extract<RouterAbNormalSigningRouteAdmission, {
-        readonly ok: true;
-    }>;
-    readonly activeMaterial: ActiveEd25519MaterialActivation;
-} | {
-    readonly ok: true;
-    readonly kind: 'wallet_session_operation_credential_exhausted_candidate_v1';
-    readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
-    readonly admission: Extract<RouterAbNormalSigningRouteAdmission, {
-        readonly ok: true;
-    }>;
-    readonly activeMaterial: ActiveEd25519MaterialActivation;
-} | {
-    readonly ok: true;
-    readonly kind: 'operation_step_up';
-    readonly phase: 'prepare';
-    readonly session: RouterAbOperationStepUpWalletSession;
-    readonly operation: AuthorizedOperation;
-    readonly operationDigests: {
-        readonly laneDigest: ReturnType<typeof parseDigestB64u>;
-        readonly intentDigest: ReturnType<typeof parseDigestB64u>;
-        readonly displayDigest: ReturnType<typeof parseDigestB64u>;
-    };
-    readonly admissionKind: RouterAbEcdsaOperationAdmissionKind;
-} | {
-    readonly ok: true;
-    readonly kind: 'operation_step_up';
-    readonly phase: 'finalize';
-    readonly session: RouterAbOperationStepUpWalletSession;
-} | {
-    readonly ok: false;
-    readonly result: RouterAbJsonRouteResult;
-};
-export type RouterAbEcdsaNormalSigningAuthorizationResult = {
-    readonly ok: true;
-    readonly kind: 'wallet_session_operation_credential_v1';
-    readonly validated: RouterAbEcdsaV2WalletSessionValidationSuccess;
-    readonly admission: AcceptedEcdsaRouteAdmission;
-    readonly activeMaterial: ActiveEcdsaMaterialActivation;
-} | {
-    readonly ok: true;
-    readonly kind: 'wallet_session_operation_credential_exhausted_candidate_v1';
-    readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
-    readonly admission: AcceptedEcdsaRouteAdmission;
-    readonly activeMaterial: ActiveEcdsaMaterialActivation;
-} | {
-    readonly ok: true;
-    readonly kind: 'operation_step_up';
-    readonly phase: 'prepare' | 'finalize';
-    readonly operation: AuthorizedOperation;
-    readonly session: RouterAbOperationStepUpWalletSession;
-    readonly admissionKind: RouterAbEcdsaOperationAdmissionKind;
-} | {
-    readonly ok: false;
-    readonly result: RouterAbJsonRouteResult;
-};
-export type RouterAbNormalSigningAdmissionFailureCode = 'project_policy_rejected' | 'abuse_rejected' | 'rate_limited' | 'unauthorized' | 'invalid_body' | 'not_configured' | 'internal';
-export type RouterAbNormalSigningAdmissionFailure = {
-    ok: false;
-    status: 400 | 401 | 403 | 408 | 409 | 429 | 500 | 501 | 503;
-    code: RouterAbNormalSigningAdmissionFailureCode;
-    message: string;
-};
-export type RouterAbNormalSigningAdmissionResult = {
-    ok: true;
-} | RouterAbNormalSigningAdmissionFailure;
-export type RouterAbNormalSigningAdmissionInput = {
-    curve: 'ed25519';
-    authorityKind: 'wallet_authority_v1';
-    authorityId: string;
-    authorityScope?: never;
-    phase: 'prepare' | 'finalize';
-    walletId: string;
-    thresholdSessionId: string;
-    walletSessionId: string;
-    quotaId: string;
-    requestId: string;
-    expiresAtMs: number;
-    signingWorkerId: string;
-    runtimePolicyScope: RuntimePolicyScope;
-} | {
-    curve: 'ed25519';
-    authorityKind?: never;
-    authorityId?: never;
-    phase: 'prepare' | 'finalize';
-    walletId: string;
-    authorityScope: ThresholdEd25519AuthorityScope;
-    thresholdSessionId: string;
-    walletSessionId: string;
-    quotaId: string;
-    requestId: string;
-    expiresAtMs: number;
-    signingWorkerId: string;
-    runtimePolicyScope: RuntimePolicyScope;
-} | {
-    curve: 'ecdsa';
-    phase: 'prepare' | 'finalize';
-    walletId: string;
-    materialActivationId: MpcMaterialActivationId;
-    authorizationIdentity: RouterAbNormalSigningAuthorizationIdentity;
-    requestId: string;
-    expiresAtMs: number;
-    signingWorkerId: string;
-    keyHandle: string;
-    runtimePolicyScope: RuntimePolicyScope;
-};
-export interface RouterAbNormalSigningAdmissionAdapter {
-    evaluatePolicy(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningAdmissionResult>;
-}
-export type RouterAbNormalSigningAdmissionEvaluationInput = {
-    adapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
-    curve: 'ed25519';
-    authorizationKind: 'wallet_session_operation_credential_v1';
-    phase: 'prepare' | 'finalize';
-    walletId: string;
-    authorityId: string;
-    thresholdSessionId: string;
-    walletSessionId: string;
-    quotaId: string;
-    requestId: string;
-    expiresAtMs: number;
-    signingWorkerId: string;
-    runtimePolicyScope: RuntimePolicyScope;
-} | {
-    adapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
-    curve: 'ecdsa';
-    authorizationKind: 'wallet_session_operation_credential_v1';
-    phase: 'prepare' | 'finalize';
-    walletId: string;
-    walletSessionId: string;
-    materialActivation: RouterAbMpcMaterialActivationRefWire;
-    requestId: string;
-    expiresAtMs: number;
-    signingWorkerId: string;
-    keyHandle: string;
-    runtimePolicyScope: RuntimePolicyScope;
-    admission: AcceptedEcdsaRouteAdmission;
-};
-export declare function evaluateRouterAbNormalSigningAdmission(input: RouterAbNormalSigningAdmissionEvaluationInput): Promise<RouterAbNormalSigningAdmissionResult>;
-type RouterAbEd25519NormalSigningAuthorizationV2 = {
-    readonly kind: 'reusable_wallet_session';
-    readonly wallet_session_id: string;
-} | {
-    readonly kind: 'operation_step_up';
-    readonly evidence_set_digest?: never;
-    readonly wallet_session_id?: never;
-};
+export type RouterAbEd25519NormalSigningAuthorizationV2 = RouterAbNormalSigningAuthorizationWire;
 type RouterAbMpcMaterialActivationRefV1 = {
     readonly kind: 'mpc_material_activation_ref';
     readonly activation_id: MpcMaterialActivationId;
@@ -500,37 +42,7 @@ export type RouterAbEd25519NormalSigningScopeV2 = {
     readonly material_activation: RouterAbMpcMaterialActivationRefV1;
     readonly signing_worker_id: string;
 };
-type RouterAbOperationStepUpWalletSessionBase = {
-    readonly tenantId: TenantId;
-    readonly principalId: PrincipalId;
-    readonly sessionId: string;
-    readonly walletId: string;
-    readonly runtimePolicyScope: RuntimePolicyScope;
-};
-type RouterAbExactOperationStepUpWalletSession = RouterAbOperationStepUpWalletSessionBase & {
-    readonly laneAuthorization: {
-        readonly kind: 'wallet_auth_method';
-        readonly walletAuthMethodId: WalletAuthMethodId;
-    };
-};
-type RouterAbVerifiedOwnerOperationStepUpWalletSession = RouterAbOperationStepUpWalletSessionBase & {
-    readonly laneAuthorization: {
-        readonly kind: 'authority_ref';
-        readonly authorityRef: WalletAuthAuthorityRef;
-        readonly authSource: WalletExecutionLaneAuthSource;
-    };
-};
-type RouterAbOperationStepUpWalletSession = RouterAbExactOperationStepUpWalletSession | RouterAbVerifiedOwnerOperationStepUpWalletSession;
-type RouterAbEd25519PrivateSigningAuthorization = {
-    readonly kind: 'wallet_session_operation_credential_v1';
-    readonly walletSessionId: string;
-    readonly principalId: string;
-    readonly runtimePolicyScope: RuntimePolicyScope;
-} | {
-    readonly kind: 'operation_step_up';
-    readonly session: RouterAbOperationStepUpWalletSession;
-};
-type RouterAbEcdsaPrivateSigningAuthorization = {
+type RouterAbPrivateSigningAuthorization = {
     readonly kind: 'wallet_session_operation_credential_v1';
     readonly walletSessionId: string;
     readonly principalId: string;
@@ -539,26 +51,22 @@ type RouterAbEcdsaPrivateSigningAuthorization = {
     readonly kind: 'operation_step_up';
     readonly session: RouterAbOperationStepUpWalletSession;
 };
-type RouterAbOwnerAdmissionAuthV1 = {
+type RouterAbOwnerAdmissionAuthV1 = ReadonlyExclusiveUnion<{
     readonly auth: 'owner_wallet_session';
     readonly subject_id: string;
     readonly wallet_session_id: string;
-    readonly authorization_session_id?: never;
 } | {
     readonly auth: 'owner_operation_step_up';
     readonly subject_id: string;
     readonly authorization_session_id: string;
-    readonly wallet_session_id?: never;
-};
-type RouterAbNormalSigningPrivateAuthorizationV2 = {
+}>;
+type RouterAbNormalSigningPrivateAuthorizationV2 = ReadonlyExclusiveUnion<{
     readonly kind: 'reusable_wallet_session';
     readonly wallet_session_id: string;
-    readonly authorization_session_id?: never;
 } | {
     readonly kind: 'operation_step_up';
     readonly authorization_session_id: string;
-    readonly wallet_session_id?: never;
-};
+}>;
 type RouterAbNormalSigningTrustedMetadataV1 = {
     readonly org_id: string;
     readonly project_id: string;
@@ -591,21 +99,7 @@ type RouterAbNormalSigningPrepareAdmissionCandidateV2 = {
     readonly trusted_source_digest: RouterAbPublicDigest32V1Wire;
     readonly expires_at_ms: number;
 };
-type RouterAbNormalSigningFinalizeAdmissionCandidateV2 = {
-    readonly org_id: string;
-    readonly project_id: string;
-    readonly environment: string;
-    readonly account_id: string;
-    readonly subject_id: string;
-    readonly authorization: RouterAbNormalSigningPrivateAuthorizationV2;
-    readonly signing_worker_id: string;
-    readonly request_id: string;
-    readonly intent_digest: RouterAbPublicDigest32V1Wire;
-    readonly signing_payload_digest: RouterAbPublicDigest32V1Wire;
-    readonly round1_binding_digest: RouterAbPublicDigest32V1Wire;
-    readonly trusted_source_digest: RouterAbPublicDigest32V1Wire;
-    readonly expires_at_ms: number;
-};
+type RouterAbNormalSigningFinalizeAdmissionCandidateV2 = Omit<RouterAbNormalSigningPrepareAdmissionCandidateV2, 'admitted_signing_digest'>;
 type RouterAbNormalSigningEffectClaimV1 = {
     readonly kind: 'reusable_wallet_session';
     readonly wallet_session_id: string;
@@ -666,7 +160,10 @@ export declare function routerAbNormalSigningMaterialSourceFromActiveLaneV1(inpu
     readonly admittedLaneIdentityDigestB64u: string;
     readonly groupPublicKey: string;
 }): RouterAbNormalSigningMaterialSourceV1;
+export declare function replayResponseFromSigningWorkerResult(result: RouterAbSigningWorkerJsonResult): AuthorizedOperationReplayResponse;
+export declare function isRouterAbEcdsaSigningWorkerOperationInProgress(result: RouterAbSigningWorkerJsonResult): boolean;
 export declare function parseRouterAbEd25519NormalSigningScopeV2(value: unknown): RouterAbEd25519NormalSigningScopeV2;
+export declare function requirePrivateSigningDigest(value: unknown, label: string): RouterAbPublicDigest32V1Wire;
 export declare function computeRouterAbEd25519NormalSigningAdmissionMaterial(input: {
     readonly intent: unknown;
     readonly signingPayload: unknown;
@@ -678,14 +175,14 @@ export declare function computeRouterAbEd25519NormalSigningAdmissionMaterial(inp
 type RouterAbEd25519PrivateSigningWorkerBuildInput = {
     readonly phase: 'prepare';
     readonly body: Record<string, unknown>;
-    readonly authorization: RouterAbEd25519PrivateSigningAuthorization;
+    readonly authorization: RouterAbPrivateSigningAuthorization;
     readonly headers: Record<string, string | string[] | undefined>;
     readonly materialSource?: RouterAbNormalSigningMaterialSourceV1;
     readonly effectClaim?: never;
 } | {
     readonly phase: 'finalize';
     readonly body: Record<string, unknown>;
-    readonly authorization: RouterAbEd25519PrivateSigningAuthorization;
+    readonly authorization: RouterAbPrivateSigningAuthorization;
     readonly headers: Record<string, string | string[] | undefined>;
     readonly effectClaim: RouterAbNormalSigningEffectClaimV1;
     readonly materialSource?: RouterAbNormalSigningMaterialSourceV1;
@@ -694,203 +191,11 @@ export declare function buildRouterAbEd25519PrivateSigningWorkerBody(input: Rout
 export declare function buildRouterAbEcdsaDerivationPrivateSigningWorkerBody(input: {
     phase: 'prepare' | 'finalize';
     body: Record<string, unknown>;
-    authorization: RouterAbEcdsaPrivateSigningAuthorization;
+    authorization: RouterAbPrivateSigningAuthorization;
     headers: Record<string, string | string[] | undefined>;
     materialSource?: RouterAbNormalSigningMaterialSourceV1;
 }): Promise<RouterAbEcdsaDerivationPrivateSigningWorkerBody>;
-type RouterAbExactOperationStepUpIdentityInput = {
-    readonly kind: 'wallet_session_operation_credential_v1';
-    readonly headers: Record<string, string | string[] | undefined>;
-    readonly walletId: string;
-    readonly materialOwner: string;
-    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
-    readonly requestExpiresAtMs: number;
-    readonly authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
-    readonly authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
-} & ({
-    readonly keyFamily: 'ed25519';
-    readonly operationKind: Ed25519OperationKind;
-    readonly resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'];
-    readonly resolveEcdsaMaterialActivation?: never;
-} | {
-    readonly keyFamily: 'ecdsa_secp256k1';
-    readonly operationKind: 'evm.sign_transaction' | 'evm.export_key';
-    readonly resolveEd25519MaterialActivation?: never;
-    readonly resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
-});
-type RouterAbVerifiedOwnerOperationStepUpIdentityInput = {
-    readonly kind: 'verified_owner_proof';
-    readonly headers: Record<string, string | string[] | undefined>;
-    readonly walletId: string;
-    readonly materialOwner: string;
-    readonly operationId: string;
-    readonly authority: WalletAuthAuthority;
-    readonly runtimePolicyScope: RuntimePolicyScope;
-    readonly expiresAtMs: number;
-    readonly authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
-    readonly authorizationSessions?: never;
-    readonly keyFamily?: never;
-    readonly operationKind?: never;
-    readonly materialActivation?: never;
-    readonly requestExpiresAtMs?: never;
-    readonly resolveEd25519MaterialActivation?: never;
-    readonly resolveEcdsaMaterialActivation?: never;
-};
-type RouterAbOperationStepUpAuthenticationFailure = {
-    readonly ok: false;
-    readonly error: RouterAbJsonRouteResult;
-};
-type RouterAbOperationStepUpAuthenticationSuccess<TSession extends RouterAbOperationStepUpWalletSession> = {
-    readonly ok: true;
-    readonly authorizedOperations: RouterApiAuthorizedOperationService;
-    readonly session: TSession;
-    readonly requestOrigin: import('../../../authorization/domain').SessionOrigin;
-    readonly expiresAtMs: number;
-};
-type RouterAbExactOperationStepUpAuthenticationResult = RouterAbOperationStepUpAuthenticationSuccess<RouterAbExactOperationStepUpWalletSession> | RouterAbOperationStepUpAuthenticationFailure;
-type RouterAbVerifiedOwnerOperationStepUpAuthenticationResult = (RouterAbOperationStepUpAuthenticationSuccess<RouterAbVerifiedOwnerOperationStepUpWalletSession> & {
-    readonly authorityRef: WalletAuthAuthorityRef;
-}) | RouterAbOperationStepUpAuthenticationFailure;
-export declare function authenticateRouterAbWalletOperationStepUpIdentity(input: RouterAbExactOperationStepUpIdentityInput): Promise<RouterAbExactOperationStepUpAuthenticationResult>;
-export declare function authenticateRouterAbWalletOperationStepUpIdentity(input: RouterAbVerifiedOwnerOperationStepUpIdentityInput): Promise<RouterAbVerifiedOwnerOperationStepUpAuthenticationResult>;
-export declare function authenticateRouterAbWalletOperationStepUp(input: {
-    readonly headers: Record<string, string | string[] | undefined>;
-    readonly scope: RouterAbEd25519NormalSigningScopeV2;
-    readonly operationKind: Ed25519OperationKind;
-    readonly requestExpiresAtMs: number;
-    readonly authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
-    readonly authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
-    readonly resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'];
-}): Promise<RouterAbExactOperationStepUpAuthenticationResult>;
-export declare function parseRouterAbEd25519OperationStepUpScope(value: unknown): RouterAbEd25519NormalSigningScopeV2;
-export declare function parseRouterAbOperationStepUpOperation(value: unknown): {
-    readonly ok: true;
-    readonly operationId: CapabilityOperationId;
-    readonly operation: Extract<CapabilityOperationRef, {
-        readonly capabilityKind: 'near_ed25519_mpc_signing';
-    }> & {
-        readonly operationKind: 'near.sign_transaction' | 'near.sign_delegate_action' | 'near.sign_nep413_message';
-    };
-} | {
-    readonly ok: false;
-    readonly message: string;
-};
-export declare function authorizeRouterAbEd25519NormalSigningRoute(input: {
-    body: Record<string, unknown>;
-    rawBody: unknown;
-    headers: Record<string, string | string[] | undefined>;
-    session: SessionAdapter | null | undefined;
-    authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
-    authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
-    admissionAdapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
-    resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'];
-    phase: RouterAbEd25519NormalSigningRoutePhase;
-}): Promise<RouterAbEd25519NormalSigningAuthorizationResult>;
-/**
- * Re-resolve the complete activation reference immediately before a claim or
- * evidence write. The resolver is authoritative for capability identity and
- * all owner/key/lifecycle/worker bindings; a stale or superseded reference
- * must fail before any authorization side effect is attempted.
- */
-export declare function resolveFreshRouterAbEcdsaMaterialActivation(input: {
-    readonly resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
-    readonly walletId: string;
-    readonly expected: RouterAbMpcMaterialActivationRefWire;
-}): Promise<{
-    readonly ok: true;
-    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
-    readonly keyHandle: string;
-    readonly relayerKeyId: string;
-    readonly participantIds: readonly [number, number];
-    readonly runtimePolicyScope: RuntimePolicyScope;
-} | {
-    readonly ok: false;
-    readonly code: 'not_found' | 'internal';
-    readonly message: string;
-} | {
-    readonly ok: false;
-    readonly code: 'scope_mismatch';
-    readonly message: string;
-}>;
-type RouterAbEcdsaWalletSessionOperationBinding = {
-    readonly kind: 'wallet_session_operation_credential_v1';
-    readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
-} | {
-    readonly kind: 'wallet_session_operation_credential_exhausted_candidate_v1';
-    readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
-};
-export declare function admitRouterAbEcdsaReusableWalletSessionOperation(input: {
-    request: RouterAbEcdsaOperationStepUpRequest;
-    materialActivation: RouterAbMpcMaterialActivationRefWire;
-    binding: RouterAbEcdsaWalletSessionOperationBinding;
-    authorizedOperations: Pick<RouterApiAuthorizedOperationService, 'tenantId' | 'admitAuthorizedOperation'>;
-    resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
-}): Promise<{
-    readonly ok: true;
-    readonly admission: RouterAbEcdsaOperationAdmission;
-} | {
-    readonly ok: false;
-    readonly error: RouterAbJsonRouteResult;
-}>;
-export declare function completeRouterAbEcdsaOperation(input: {
-    authorizedOperations: RouterApiAuthorizedOperationService;
-    operation: AuthorizedOperation;
-    result: 'succeeded' | 'failed_before_side_effect' | 'failed_after_side_effect';
-    response: AuthorizedOperationReplayResponse;
-}): Promise<void>;
-type RouterAbEcdsaOperationStepUpRequest = RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire | RouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1Wire;
-type RouterAbEcdsaOperationStepUpAuthenticationRequest = RouterAbEcdsaOperationStepUpRequest | RouterAbEcdsaOperationStepUpPreparationV1Wire;
-type RouterAbEcdsaOperationStepUpAuthenticationResult = {
-    readonly ok: true;
-    readonly authorizedOperations: RouterApiAuthorizedOperationService;
-    readonly activeMaterial: ActiveEcdsaMaterialActivation;
-    readonly session: RouterAbExactOperationStepUpWalletSession;
-    readonly requestOrigin: import('../../../authorization/domain').SessionOrigin;
-    readonly expiresAtMs: number;
-} | {
-    readonly ok: false;
-    readonly error: RouterAbJsonRouteResult;
-};
-export declare function authenticateRouterAbEcdsaOperationStepUp(input: {
-    readonly headers: Record<string, string | string[] | undefined>;
-    readonly request: RouterAbEcdsaOperationStepUpAuthenticationRequest;
-    readonly authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
-    readonly authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
-    readonly resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
-}): Promise<RouterAbEcdsaOperationStepUpAuthenticationResult>;
-export declare function claimRouterAbEcdsaOperationStepUp(input: {
-    readonly operationKind: 'evm.sign_transaction' | 'evm.export_key';
-    readonly operation: Pick<RouterAbEcdsaOperationStepUpPreparationV1Wire, 'operation_id' | 'operation_digests' | 'material_activation'>;
-    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
-    readonly keyHandle: string;
-    readonly authenticated: Extract<Awaited<ReturnType<typeof authenticateRouterAbEcdsaOperationStepUp>>, {
-        readonly ok: true;
-    }>;
-}): Promise<RouterAbJsonRouteResult | RouterAbEcdsaOperationAdmission | null>;
-export declare function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input: {
-    body: Record<string, unknown>;
-    rawBody: unknown;
-    headers: Record<string, string | string[] | undefined>;
-    session: SessionAdapter | null | undefined;
-    authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
-    authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
-    admissionAdapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
-    resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
-    phase: 'prepare' | 'finalize';
-}): Promise<RouterAbEcdsaNormalSigningAuthorizationResult>;
-export declare function handleRouterAbEcdsaDerivationNormalSigningRouteCore(input: {
-    body: Record<string, unknown>;
-    rawBody: unknown;
-    headers: Record<string, string | string[] | undefined>;
-    session: SessionAdapter | null | undefined;
-    runtime: RouterAbNormalSigningRouteRuntime | null | undefined;
-    authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
-    authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
-    admissionAdapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
-    resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
-    privatePath: RouterAbEcdsaDerivationPrivateSigningPath;
-    phase: 'prepare' | 'finalize';
-}): Promise<RouterAbJsonRouteResult>;
+export type RouterAbEcdsaOperationStepUpRequest = RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire | RouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1Wire;
 export declare function postRouterAbSigningWorkerJson(input: {
     config: RouterAbConfiguredSigningWorkerPrivateTransport;
     path: RouterAbEd25519PrivateSigningPath | RouterAbEcdsaDerivationPrivateSigningPath;