@seams/wallet-server 0.8.0 → 0.9.0

package/dist/esm/router/domains/passkeyCustody/walletCustodyRegistrationCommit.js

@@ -126,14 +126,14 @@ function buildWalletCustodyRegistrationRecords(args) {
 	};
 }
 /**
-* Builds and commits in one call.
+* Builds the records and claims their recovery-code routes.
 *
 * A payload this server cannot parse becomes `rejected` rather than an
 * exception, so a malformed ceremony result is a request outcome and not a
-* route crash. Nothing is written in that case: the records are built before
-* the store is touched.
+* route crash. Nothing is claimed or written in that case: the records are
+* built before the store is touched.
 */
-async function commitWalletCustodyRegistration(input) {
+async function reserveWalletCustodyRegistration(input) {
 	let records;
 	try {
 		records = buildWalletCustodyRegistrationRecords(input);
@@ -143,7 +143,17 @@ async function commitWalletCustodyRegistration(input) {
 			reason: error instanceof Error ? error.message : "invalid wallet custody commit payload"
 		};
 	}
-	const stored = await input.store.commitRegistration(records);
+	const reserved = await input.store.reserveRegistration(records);
+	if (reserved.kind === "inconsistent") return {
+		kind: "rejected",
+		reason: reserved.reason
+	};
+	return {
+		kind: "reserved",
+		commit: async () => commitOutcome(await reserved.commit())
+	};
+}
+function commitOutcome(stored) {
 	switch (stored.kind) {
 		case "committed": return {
 			kind: "committed",
@@ -159,6 +169,6 @@ async function commitWalletCustodyRegistration(input) {
 	}
 }
 //#endregion
-export { commitWalletCustodyRegistration };
+export { reserveWalletCustodyRegistration };
 
 //# sourceMappingURL=walletCustodyRegistrationCommit.js.map

package/dist/esm/router/domains/signingOperations/authorizedOperationWire.js

@@ -0,0 +1,73 @@
+//#region src/router/domains/signingOperations/authorizedOperationWire.ts
+function buildAuthorizedOperationWire(input, commonAuthorizedOperation) {
+	const operation = input.operation;
+	switch (input.binding.kind) {
+		case "reusable_wallet_session":
+			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Reusable Wallet Session authorized operation is invalid");
+			return {
+				binding: {
+					kind: "reusable_wallet_session",
+					authorization_id: operation.authorization.authorizationGrantRef.authorizationId,
+					wallet_session_id: input.binding.walletSessionId,
+					quota_id: input.binding.quotaId
+				},
+				authorized_operation: {
+					kind: "reusable_wallet_session_authorized_operation_v1",
+					...commonAuthorizedOperation
+				}
+			};
+		case "gateway_owner_wallet_session":
+			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Gateway owner Wallet Session authorized operation is invalid");
+			return {
+				binding: {
+					kind: "gateway_owner_wallet_session",
+					ownership_generation: input.binding.ownershipGeneration,
+					subject_id: input.binding.subjectId,
+					account_id: input.binding.accountId,
+					authorization_id: input.binding.authorizationId,
+					wallet_session_id: input.binding.walletSessionId,
+					quota_id: input.binding.quotaId,
+					threshold_session_id: input.binding.thresholdSessionId,
+					org_id: input.binding.orgId,
+					project_id: input.binding.projectId,
+					environment: input.binding.environment,
+					project_environment_id: input.binding.projectEnvironmentId,
+					signing_worker_id: input.binding.signingWorkerId,
+					expires_at_ms: input.binding.expiresAtMs
+				},
+				authorized_operation: {
+					kind: "reusable_wallet_session_authorized_operation_v1",
+					...commonAuthorizedOperation
+				}
+			};
+		case "operation_step_up":
+			if (operation.authorization.kind !== "verified_step_up" || operation.quota.kind !== "quota_neutral") throw new Error("Verified step-up authorized operation is invalid");
+			return {
+				binding: {
+					kind: "operation_step_up",
+					ownership_generation: input.binding.ownershipGeneration,
+					authorization_session_id: input.binding.authorizationSessionId,
+					org_id: input.binding.orgId,
+					project_id: input.binding.projectId,
+					environment: input.binding.environment,
+					project_environment_id: input.binding.projectEnvironmentId,
+					subject_id: input.binding.subjectId,
+					account_id: input.binding.accountId
+				},
+				authorized_operation: {
+					kind: "verified_step_up_authorized_operation_v1",
+					authorization_session_id: input.binding.authorizationSessionId,
+					evidence_set_digest: operation.authorization.evidenceSetDigest,
+					...commonAuthorizedOperation
+				}
+			};
+		default: return assertNeverOperationBinding(input.binding);
+	}
+}
+function assertNeverOperationBinding(_binding) {
+	throw new Error("Unsupported authorized-operation binding");
+}
+//#endregion
+export { buildAuthorizedOperationWire };
+
+//# sourceMappingURL=authorizedOperationWire.js.map

package/dist/esm/router/domains/signingOperations/ecdsaSigningResponse.js

@@ -0,0 +1,31 @@
+import { completeRouterAbEcdsaOperation } from "./routerAbEcdsaDerivationNormalSigningRoute.js";
+//#region src/router/domains/signingOperations/ecdsaSigningResponse.ts
+async function finishRouterAbEcdsaSigningResponse(input) {
+	const upstream = input.upstream;
+	const upstreamBodyText = await upstream.clone().text().catch(() => "");
+	input.timing.proxy = performance.now() - input.proxyStartedAt;
+	if (isRouterAbEcdsaOperationInProgressResponse({
+		status: upstream.status,
+		bodyText: upstreamBodyText
+	})) return upstream;
+	const completionStartedAt = performance.now();
+	await completeRouterAbEcdsaOperation({
+		authorizedOperations: input.authorizedOperations,
+		operation: input.operation,
+		result: upstream.ok ? "succeeded" : upstream.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
+		response: {
+			status: upstream.status,
+			contentType: upstream.headers.get("content-type") || "application/json",
+			bodyText: upstreamBodyText
+		}
+	});
+	input.timing.complete = performance.now() - completionStartedAt;
+	return upstream;
+}
+function isRouterAbEcdsaOperationInProgressResponse(input) {
+	return input.status === 409 && input.bodyText.includes("ReplayedLocalRequest:") && input.bodyText.includes("SigningWorker ECDSA effect is already in progress");
+}
+//#endregion
+export { finishRouterAbEcdsaSigningResponse };
+
+//# sourceMappingURL=ecdsaSigningResponse.js.map

package/dist/esm/router/domains/signingOperations/ed25519AuthorizedOperationReceipt.js

@@ -1,6 +1,6 @@
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseCapabilityOperationFingerprintDigest } from "../../../shared-ts/src/authorization/operationFingerprint.js";
-import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 //#region src/router/domains/signingOperations/ed25519AuthorizedOperationReceipt.ts
 function requireEd25519OperationKind(value) {
 	if (value !== "near.sign_transaction" && value !== "near.sign_delegate_action" && value !== "near.sign_nep413_message") throw new Error("authorized_operation.operation_kind is invalid");

package/dist/esm/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js

@@ -9,6 +9,7 @@ import { WALLET_SESSION_FAILURE_CODES } from "../../../shared-ts/src/utils/walle
 import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
 import { walletSessionFailure, walletSessionFailureStatus } from "../../auth/walletSessionFailure.js";
 import { validateRouterAbEcdsaDerivationWalletSessionInputs } from "../../auth/commonRouterUtils.js";
+import { signingPrepareSessionResponse } from "./signingPrepareSession.js";
 import { evaluateRouterAbNormalSigningAdmission, requireAuthorizationValue, requireMpcMaterialActivationId, routerAbErrorMessage, routerAbOwnerOperationFailureResult, routerAbOwnerOperationStepUpDecision, routerAbSigningError, routerAbStepUpError, routerAbWalletSessionValidationStatus } from "./routerAbNormalSigningAdmission.js";
 import { ecdsaStepUpActiveMaterial, exactOperationStepUpSession, parseStepUpRequestOrigin, recordedStepUpOperationClaim, routerAbOperationStepUpClaimFailure, walletSessionCandidateAdmission, walletSessionScopeInvalidFailure, walletSessionUnavailableFailure } from "./routerAbOperationStepUp.js";
 import { buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, isRouterAbEcdsaSigningWorkerOperationInProgress, postRouterAbSigningWorkerJson, replayResponseFromSigningWorkerResult } from "./routerAbPrivateSigningWorker.js";
@@ -805,7 +806,7 @@ async function handleRouterAbEcdsaDerivationNormalSigningRouteCore(input) {
 		});
 		return forwarded.ok ? {
 			status: 200,
-			body: forwarded.body
+			body: signingPrepareSessionResponse(forwarded.body, authorization)
 		} : {
 			status: forwarded.status,
 			body: forwarded.body

package/dist/esm/router/domains/signingOperations/routerAbEd25519NormalSigningRoute.js

@@ -1,10 +1,10 @@
 import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
 import { buildNearEd25519MpcOperationRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseSigningOperationFingerprintDigest } from "../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
 import { validateRouterAbEd25519WalletSessionInputs } from "../../auth/commonRouterUtils.js";
@@ -327,30 +327,22 @@ function parseRouterAbEd25519NormalSigningOperationForAdmission(input) {
 	}
 	try {
 		switch (input.authorizationKind) {
-			case "reusable_wallet_session": {
-				const receipt = parseEd25519ReusableAuthorizedOperationReceipt(input.body.authorized_operation);
-				return {
-					ok: true,
-					operation: {
-						phase: "finalize",
-						operationKind: receipt.operation_kind,
-						authorizationKind: "reusable_wallet_session",
-						receipt
-					}
-				};
-			}
-			case "operation_step_up": {
-				const receipt = parseEd25519VerifiedStepUpAuthorizedOperationReceipt(input.body.authorized_operation);
-				return {
-					ok: true,
-					operation: {
-						phase: "finalize",
-						operationKind: receipt.operation_kind,
-						authorizationKind: "operation_step_up",
-						receipt
-					}
-				};
-			}
+			case "reusable_wallet_session": return {
+				ok: true,
+				operation: {
+					phase: "finalize",
+					operationKind: parseEd25519ReusableAuthorizedOperationReceipt(input.body.authorized_operation).operation_kind,
+					authorizationKind: "reusable_wallet_session"
+				}
+			};
+			case "operation_step_up": return {
+				ok: true,
+				operation: {
+					phase: "finalize",
+					operationKind: parseEd25519VerifiedStepUpAuthorizedOperationReceipt(input.body.authorized_operation).operation_kind,
+					authorizationKind: "operation_step_up"
+				}
+			};
 		}
 	} catch (error) {
 		return {
@@ -359,94 +351,7 @@ function parseRouterAbEd25519NormalSigningOperationForAdmission(input) {
 		};
 	}
 }
-async function validateRouterAbEd25519V2FinalizeAuthorizedOperation(input) {
-	if (!input.authorizedOperations) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 501,
-			code: "not_configured",
-			message: "Reusable Wallet Session authorization is not configured",
-			phase: input.phase
-		})
-	};
-	let authorizedOperationId;
-	try {
-		authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(input.receipt.authorized_operation_id));
-		requireAuthorizationValue(parseCapabilityOperationId(input.receipt.operation_id));
-	} catch (error) {
-		return {
-			ok: false,
-			result: routerAbEd25519OwnerOperationFailureResult({
-				status: 400,
-				code: "invalid_authorized_operation",
-				message: routerAbErrorMessage(error),
-				phase: input.phase
-			})
-		};
-	}
-	let operation;
-	try {
-		operation = await input.authorizedOperations.readAuthorizedOperationById({
-			tenantId: input.authorizedOperations.tenantId,
-			authorizedOperationId
-		});
-	} catch (error) {
-		return {
-			ok: false,
-			result: routerAbEd25519OwnerOperationFailureResult({
-				status: 500,
-				code: "internal",
-				message: routerAbErrorMessage(error),
-				phase: input.phase
-			})
-		};
-	}
-	if (!operation) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 409,
-			code: "authorized_operation_missing",
-			message: "Authorized operation is unavailable",
-			phase: input.phase
-		})
-	};
-	const operationRef = operation.operation.operation;
-	if (operation.tenantId !== input.authorizedOperations.tenantId || operation.authorizedOperationId !== authorizedOperationId || operation.operation.operationId !== input.receipt.operation_id || operation.operationFingerprintDigest !== input.receipt.operation_fingerprint_digest || operation.operation.digests.laneDigest !== input.receipt.lane_digest_b64u || operation.operation.digests.intentDigest !== input.receipt.intent_digest_b64u || operation.operation.digests.displayDigest !== input.receipt.display_digest_b64u || operationRef.capabilityKind !== "near_ed25519_mpc_signing" || operationRef.operationKind !== input.receipt.operation_kind) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 400,
-			code: "invalid_authorized_operation",
-			message: "Ed25519 authorized operation does not match its receipt",
-			phase: input.phase
-		})
-	};
-	switch (operationRef.operationKind) {
-		case "near.sign_transaction":
-		case "near.sign_delegate_action":
-		case "near.sign_nep413_message": return {
-			ok: true,
-			operationKind: operationRef.operationKind
-		};
-	}
-}
 async function authorizeRouterAbEd25519WalletSessionRequest(input) {
-	if (input.operation.phase === "finalize") {
-		const exactOperation = await validateRouterAbEd25519V2FinalizeAuthorizedOperation({
-			receipt: input.operation.receipt,
-			authorizedOperations: input.authorizedOperations,
-			phase: input.phase
-		});
-		if (!exactOperation.ok) return exactOperation;
-		if (exactOperation.operationKind !== input.admission.operationKind) return {
-			ok: false,
-			result: routerAbEd25519OwnerOperationFailureResult({
-				status: 403,
-				code: "wallet_session_scope_mismatch",
-				message: "Exact Wallet Session operation does not match the authorized operation",
-				phase: input.phase
-			})
-		};
-	}
 	const expectedMaterialActivation = routerAbMpcMaterialActivationRefFromWire(input.scope.material_activation);
 	const admittedMaterialActivation = routerAbMpcMaterialActivationRefToWire(input.admission.materialActivation);
 	const expiresAtMs = Number(input.body.expires_at_ms);
@@ -479,7 +384,8 @@ async function authorizeRouterAbEd25519WalletSessionRequest(input) {
 	};
 	const activeMaterial = await input.resolveEd25519MaterialActivation({
 		walletId: String(input.session.walletId),
-		materialActivation: admittedMaterialActivation
+		materialActivation: admittedMaterialActivation,
+		...input.signerRead ? { signerRead: input.signerRead } : {}
 	});
 	if (!activeMaterial.ok || !sameRouterAbMpcMaterialActivationRef(activeMaterial.materialActivation, admittedMaterialActivation) || activeMaterial.signingWorkerId !== input.scope.signing_worker_id || base64UrlEncode(Uint8Array.from(activeMaterial.exportIdentity.registered_public_key)) !== input.admission.signer.registeredPublicKeyB64u) return {
 		ok: false,
@@ -500,6 +406,7 @@ async function authorizeRouterAbEd25519WalletSessionRequest(input) {
 	const admissionDecision = await evaluateRouterAbNormalSigningAdmission({
 		adapter: input.admissionAdapter,
 		curve: "ed25519",
+		policyReadSource: input.policyReadSource,
 		authorizationKind: "wallet_session_operation_credential_v1",
 		phase: input.phase,
 		walletId: String(input.session.walletId),
@@ -557,13 +464,13 @@ async function resolveRouterAbEd25519ExhaustedCandidateAuthorization(input) {
 		phase: input.phase,
 		body: input.body,
 		scope: input.scope,
-		operation: input.operation,
 		session,
 		authorityId: String(candidate.authority.authorityId),
 		admission,
-		authorizedOperations: input.authorizedOperations,
 		admissionAdapter: input.admissionAdapter,
-		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation,
+		signerRead: null,
+		policyReadSource: { kind: "database" }
 	});
 	if (!authorized.ok) return authorized;
 	return {
@@ -626,7 +533,8 @@ async function authorizeRouterAbEd25519NormalSigningRoute(input) {
 	const validated = await validateRouterAbEd25519WalletSessionInputs({
 		headers: input.headers,
 		authorizationSessions: input.authorizationSessions,
-		operationKind: operationForAdmission.operation.operationKind
+		operationKind: operationForAdmission.operation.operationKind,
+		materialActivation: scope.material_activation
 	});
 	if (!validated.ok) {
 		const operation = operationForAdmission.operation;
@@ -637,7 +545,6 @@ async function authorizeRouterAbEd25519NormalSigningRoute(input) {
 				scope,
 				phase: input.phase,
 				operation,
-				authorizedOperations: input.authorizedOperations,
 				authorizationSessions: input.authorizationSessions,
 				admissionAdapter: input.admissionAdapter,
 				resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
@@ -675,13 +582,16 @@ async function authorizeRouterAbEd25519NormalSigningRoute(input) {
 		phase: input.phase,
 		body: input.body,
 		scope,
-		operation,
 		session: validated.admission.context.authorization.session,
 		authorityId: String(validated.admission.context.authority.authorityId),
 		admission: validated.admission.admission,
-		authorizedOperations: input.authorizedOperations,
 		admissionAdapter: input.admissionAdapter,
-		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation,
+		signerRead: validated.signerRead,
+		policyReadSource: {
+			kind: "credential_snapshot",
+			policyRead: validated.policyRead
+		}
 	});
 	if (!authorized.ok) return authorized;
 	return {

package/dist/esm/router/domains/signingOperations/routerAbNormalSigningAdmission.js

@@ -1,98 +1,6 @@
 import { parseMpcMaterialActivationId } from "../../../shared-ts/src/utils/domainIds.js";
 import { walletSessionFailureStatus } from "../../auth/walletSessionFailure.js";
 //#region src/router/domains/signingOperations/routerAbNormalSigningAdmission.ts
-function buildRouterAbEd25519AcceptedAuthorizedOperationV1(input) {
-	const operation = input.operation;
-	const operationRef = operation.operation.operation;
-	if (operationRef.capabilityKind !== "near_ed25519_mpc_signing") throw new Error("Ed25519 authorized operation capability is invalid");
-	if (operationRef.operationKind === "near.export_key") throw new Error("Ed25519 export cannot use normal-signing admission");
-	return buildRouterAbAcceptedAuthorizedOperationV1({
-		operation,
-		operationKind: operationRef.operationKind,
-		capabilityKind: "near_ed25519_mpc_signing",
-		binding: input.binding
-	});
-}
-function buildRouterAbEcdsaAcceptedAuthorizedOperationV1(input) {
-	const operation = input.operation;
-	const operationRef = operation.operation.operation;
-	if (operationRef.capabilityKind !== "evm_ecdsa_mpc_signing" || operationRef.operationKind !== "evm.sign_transaction") throw new Error("ECDSA authorized operation capability or operation kind is invalid");
-	return buildRouterAbAcceptedAuthorizedOperationV1({
-		operation,
-		operationKind: "evm.sign_transaction",
-		capabilityKind: "evm_ecdsa_mpc_signing",
-		binding: input.binding
-	});
-}
-function buildRouterAbAcceptedAuthorizedOperationV1(input) {
-	const operation = input.operation;
-	const commonAuthorizedOperation = {
-		authorized_operation_id: operation.authorizedOperationId,
-		operation_id: operation.operation.operationId,
-		capability_kind: input.capabilityKind,
-		operation_kind: input.operationKind,
-		lane_digest_b64u: operation.operation.digests.laneDigest,
-		intent_digest_b64u: operation.operation.digests.intentDigest,
-		display_digest_b64u: operation.operation.digests.displayDigest,
-		operation_fingerprint_digest: operation.operationFingerprintDigest
-	};
-	switch (input.binding.kind) {
-		case "reusable_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Reusable Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "reusable_wallet_session",
-					authorization_id: operation.authorization.authorizationGrantRef.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "gateway_owner_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Gateway owner Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "gateway_owner_wallet_session",
-					subject_id: input.binding.subjectId,
-					account_id: input.binding.accountId,
-					authorization_id: input.binding.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId,
-					threshold_session_id: input.binding.thresholdSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					signing_worker_id: input.binding.signingWorkerId,
-					expires_at_ms: input.binding.expiresAtMs
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "operation_step_up":
-			if (operation.authorization.kind !== "verified_step_up" || operation.quota.kind !== "quota_neutral") throw new Error("Verified step-up authorized operation is invalid");
-			return {
-				binding: {
-					kind: "operation_step_up",
-					authorization_session_id: input.binding.authorizationSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					subject_id: input.binding.subjectId
-				},
-				authorized_operation: {
-					kind: "verified_step_up_authorized_operation_v1",
-					authorization_session_id: input.binding.authorizationSessionId,
-					evidence_set_digest: operation.authorization.evidenceSetDigest,
-					...commonAuthorizedOperation
-				}
-			};
-	}
-}
 function routerAbOwnerOperationStepUpDecision(input) {
 	const reason = (() => {
 		switch (input.code) {
@@ -138,6 +46,7 @@ async function evaluateRouterAbNormalSigningAdmission(input) {
 	};
 	if (input.curve === "ed25519") return await input.adapter.evaluatePolicy({
 		curve: "ed25519",
+		policyReadSource: input.policyReadSource,
 		authorityKind: "wallet_authority_v1",
 		authorityId: input.authorityId,
 		phase: input.phase,
@@ -205,6 +114,6 @@ function routerAbErrorMessage(error) {
 	return String(error && typeof error === "object" && "message" in error ? error.message : error || "unknown error");
 }
 //#endregion
-export { buildRouterAbEcdsaAcceptedAuthorizedOperationV1, buildRouterAbEd25519AcceptedAuthorizedOperationV1, evaluateRouterAbNormalSigningAdmission, requireAuthorizationValue, requireMpcMaterialActivationId, routerAbErrorMessage, routerAbOwnerOperationFailureResult, routerAbOwnerOperationStepUpDecision, routerAbSigningError, routerAbStepUpError, routerAbWalletSessionValidationStatus };
+export { evaluateRouterAbNormalSigningAdmission, requireAuthorizationValue, requireMpcMaterialActivationId, routerAbErrorMessage, routerAbOwnerOperationFailureResult, routerAbOwnerOperationStepUpDecision, routerAbSigningError, routerAbStepUpError, routerAbWalletSessionValidationStatus };
 
 //# sourceMappingURL=routerAbNormalSigningAdmission.js.map

package/dist/esm/router/domains/signingOperations/routerAbPrivateSigningWorker.js

@@ -1,6 +1,6 @@
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { postRouterAbInternalServiceJson } from "../../../core/ThresholdService/routerAb/internalServiceHttp.js";
 import { requireMpcMaterialActivationId, routerAbSigningError } from "./routerAbNormalSigningAdmission.js";

package/dist/esm/router/domains/signingOperations/signingPrepareSession.js

@@ -0,0 +1,33 @@
+import { projectExactWalletSessionAuthorizationV1 } from "../../../authorization/domain.js";
+//#region src/router/domains/signingOperations/signingPrepareSession.ts
+/** The session snapshot validated for this admission, before its quota claim. */
+function signingPrepareSessionResponse(signing, authorization) {
+	switch (authorization.kind) {
+		case "operation_step_up": return {
+			kind: "operation_step_up",
+			signing
+		};
+		case "wallet_session_operation_credential_v1": {
+			const { session, quota } = authorization.validated.admission.context.authorization;
+			return {
+				kind: "reusable_wallet_session",
+				signing,
+				session_status: {
+					ok: true,
+					status: "active",
+					walletSessionId: session.walletSessionId,
+					quotaId: session.quotaId,
+					remainingUses: quota.remainingUses,
+					expiresAtMs: quota.expiresAtMs,
+					quotaLifecycle: "active",
+					authorization: projectExactWalletSessionAuthorizationV1(session)
+				}
+			};
+		}
+		case "wallet_session_operation_credential_exhausted_candidate_v1": throw new Error("An exhausted Wallet Session cannot publish a fresh prepare response");
+	}
+}
+//#endregion
+export { signingPrepareSessionResponse };
+
+//# sourceMappingURL=signingPrepareSession.js.map