@seams/wallet-server 0.5.0

package/dist/esm/core/authService/identity.js

@@ -0,0 +1,57 @@
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import "../../shared-ts/src/utils/validation.js";
+import { errorMessage } from "../../shared-ts/src/utils/errors.js";
+//#region src/core/authService/identity.ts
+async function listIdentitiesWithStore(input) {
+	try {
+		const userId = normalizeOptionalTrimmedString(input.userId);
+		if (!userId) return {
+			ok: false,
+			code: "invalid_args",
+			message: "Missing userId"
+		};
+		return {
+			ok: true,
+			subjects: await input.store.listSubjectsByUserId(userId)
+		};
+	} catch (e) {
+		return {
+			ok: false,
+			code: "internal",
+			message: errorMessage(e) || "Failed to list identities"
+		};
+	}
+}
+async function linkIdentityWithStore(input) {
+	try {
+		return await input.store.linkSubjectToUserId({
+			userId: input.userId,
+			subject: input.subject,
+			allowMoveIfSoleIdentity: input.allowMoveIfSoleIdentity
+		});
+	} catch (e) {
+		return {
+			ok: false,
+			code: "internal",
+			message: errorMessage(e) || "Failed to link identity"
+		};
+	}
+}
+async function unlinkIdentityWithStore(input) {
+	try {
+		return await input.store.unlinkSubjectFromUserId({
+			userId: input.userId,
+			subject: input.subject
+		});
+	} catch (e) {
+		return {
+			ok: false,
+			code: "internal",
+			message: errorMessage(e) || "Failed to unlink identity"
+		};
+	}
+}
+//#endregion
+export { linkIdentityWithStore, listIdentitiesWithStore, unlinkIdentityWithStore };
+
+//# sourceMappingURL=identity.js.map

package/dist/esm/core/authService/identityOperations.js

@@ -0,0 +1,32 @@
+import { linkIdentityWithStore, listIdentitiesWithStore, unlinkIdentityWithStore } from "./identity.js";
+//#region src/core/authService/identityOperations.ts
+var IdentityOperations = class {
+	constructor(store) {
+		this.store = store;
+	}
+	async listIdentities(input) {
+		return await listIdentitiesWithStore({
+			store: this.store,
+			userId: input.userId
+		});
+	}
+	async linkIdentity(input) {
+		return await linkIdentityWithStore({
+			store: this.store,
+			userId: input.userId,
+			subject: input.subject,
+			allowMoveIfSoleIdentity: Boolean(input.allowMoveIfSoleIdentity)
+		});
+	}
+	async unlinkIdentity(input) {
+		return await unlinkIdentityWithStore({
+			store: this.store,
+			userId: input.userId,
+			subject: input.subject
+		});
+	}
+};
+//#endregion
+export { IdentityOperations };
+
+//# sourceMappingURL=identityOperations.js.map

package/dist/esm/core/authService/nearAccountOperations.js

@@ -0,0 +1,229 @@
+import { isValidAccountId } from "../../shared-ts/src/utils/near.js";
+import "../../shared-ts/src/utils/validation.js";
+import { ActionType, validateActionArgsWasm } from "../../shared-ts/src/near/actions.js";
+import { executeSignedDelegateWithRelayer } from "../../delegateAction/index.js";
+import { errorMessage } from "../../shared-ts/src/utils/errors.js";
+import { checkNearAccountExistsWithClient, dispatchNearSignedTransactionBorshWithClient, fetchNearTxContextWithClient, signGasRelayerNearTransactionWithDeps, verifyAccountAccessKeysPresentWithClient, viewAccessKeyListWithClient } from "./nearTransactions.js";
+import { fundImplicitNearAccountWithRelayer } from "../nearRelayerAccountProvisioning.js";
+import { buildFullAccessAddKeyAction, normalizeBootstrapPublicKeys } from "./registrationThresholdHelpers.js";
+//#region src/core/authService/nearAccountOperations.ts
+const ACCOUNT_CREATE_BROADCAST_WAIT_UNTIL = "EXECUTED_OPTIMISTIC";
+const ACCOUNT_CREATE_FAST_KEY_VISIBILITY_CHECK = {
+	attempts: 2,
+	delayMs: 100,
+	finality: "optimistic"
+};
+const ACCOUNT_CREATE_BACKGROUND_KEY_VISIBILITY_AUDIT = {
+	attempts: 8,
+	delayMs: 250,
+	finality: "final"
+};
+var NearAccountOperations = class {
+	constructor(input) {
+		this.input = input;
+		this.transactionQueue = Promise.resolve();
+		this.queueStats = {
+			pending: 0,
+			completed: 0,
+			failed: 0
+		};
+	}
+	async viewAccessKeyList(accountId) {
+		await this.input.ensureSignerAndRelayerAccount();
+		return await viewAccessKeyListWithClient({
+			nearClient: this.input.nearClient,
+			accountId
+		});
+	}
+	async dispatchNearSignedTransactionBorsh(input) {
+		await this.input.ensureSignerAndRelayerAccount();
+		return await dispatchNearSignedTransactionBorshWithClient({
+			nearClient: this.input.nearClient,
+			signedTransactionBorshB64u: input.signedTransactionBorshB64u
+		});
+	}
+	async txStatus(txHash, senderAccountId) {
+		await this.input.ensureSignerAndRelayerAccount();
+		return this.input.nearClient.txStatus(txHash, senderAccountId);
+	}
+	async createAccount(request) {
+		await this.input.ensureSignerAndRelayerAccount();
+		return this.queueTransaction(this.createAccountQueueTask(request), `create account ${request.accountId}`);
+	}
+	async fundImplicitNearAccount(request) {
+		await this.input.ensureSignerAndRelayerAccount();
+		return await this.queueTransaction(this.createFundImplicitNearAccountQueueTask(request), `fund implicit NEAR account ${request.nearAccountId}`);
+	}
+	async checkAccountExists(accountId) {
+		await this.input.ensureSignerAndRelayerAccount();
+		return await checkNearAccountExistsWithClient({
+			nearClient: this.input.nearClient,
+			logger: this.input.logger,
+			accountId
+		});
+	}
+	async executeSignedDelegate(input) {
+		await this.input.ensureSignerAndRelayerAccount();
+		if (!input?.hash || !input?.signedDelegate) return {
+			ok: false,
+			code: "invalid_delegate_request",
+			error: "hash and signedDelegate are required"
+		};
+		const senderId = input.signedDelegate?.delegateAction?.senderId ?? "unknown-sender";
+		return this.queueTransaction(() => executeSignedDelegateWithRelayer({
+			nearClient: this.input.nearClient,
+			relayerAccount: this.input.config.relayerAccount,
+			relayerPublicKey: this.input.getRelayerPublicKey(),
+			hash: input.hash,
+			signedDelegate: input.signedDelegate,
+			policy: input.policy,
+			signGasRelayerNearTransaction: (args) => this.signGasRelayerNearTransaction(args)
+		}), `execute signed delegate for ${senderId}`);
+	}
+	async fetchTxContext(accountId, publicKey) {
+		return await fetchNearTxContextWithClient({
+			nearClient: this.input.nearClient,
+			accountId,
+			publicKey
+		});
+	}
+	async signGasRelayerNearTransaction(input) {
+		return await signGasRelayerNearTransactionWithDeps({
+			ensureSignerWasm: this.input.ensureSignerWasm,
+			relayerAccount: this.input.config.relayerAccount,
+			relayerPrivateKey: this.input.config.relayerPrivateKey,
+			receiverId: input.receiverId,
+			nonce: input.nonce,
+			blockHash: input.blockHash,
+			actions: input.actions
+		});
+	}
+	async queueTransaction(operation, description) {
+		this.queueStats.pending++;
+		this.input.logger.debug(`[AuthService] Queueing: ${description} (pending: ${this.queueStats.pending})`);
+		const next = this.transactionQueue.then(async () => {
+			try {
+				this.input.logger.debug(`[AuthService] Executing: ${description}`);
+				const result = await operation();
+				this.queueStats.completed++;
+				this.queueStats.pending--;
+				this.input.logger.debug(`[AuthService] Completed: ${description} (pending: ${this.queueStats.pending})`);
+				return result;
+			} catch (error) {
+				this.queueStats.failed++;
+				this.queueStats.pending--;
+				this.input.logger.error(`[AuthService] Failed: ${description} (failed: ${this.queueStats.failed}):`, errorMessage(error) || "unknown error");
+				throw error;
+			}
+		});
+		this.transactionQueue = next.catch(() => void 0);
+		return await next;
+	}
+	createAccountQueueTask(request) {
+		return this.createAccountFromQueue.bind(this, request);
+	}
+	async createAccountFromQueue(request) {
+		try {
+			if (!isValidAccountId(request.accountId)) throw new Error(`Invalid account ID format: ${request.accountId}`);
+			this.input.logger.info(`Checking if account ${request.accountId} already exists...`);
+			if (await this.checkAccountExists(request.accountId)) throw new Error(`Account ${request.accountId} already exists. Cannot create duplicate account.`);
+			this.input.logger.info(`Account ${request.accountId} is available for creation`);
+			const initialBalance = this.input.config.accountInitialBalance;
+			const { publicKey, recoveryPublicKey, expectedPublicKeys } = normalizeBootstrapPublicKeys({
+				publicKey: request.publicKey,
+				recoveryPublicKey: request.recoveryPublicKey
+			});
+			this.input.logger.info(`Creating account: ${request.accountId}`);
+			this.input.logger.info(`Initial balance: ${initialBalance} yoctoNEAR`);
+			const actions = [
+				{ action_type: ActionType.CreateAccount },
+				{
+					action_type: ActionType.Transfer,
+					deposit: String(initialBalance)
+				},
+				buildFullAccessAddKeyAction(publicKey),
+				...recoveryPublicKey ? [buildFullAccessAddKeyAction(recoveryPublicKey)] : []
+			];
+			actions.forEach(validateActionArgsWasm);
+			const { nextNonce, blockHash } = await this.fetchTxContext(this.input.config.relayerAccount, this.input.getRelayerPublicKey());
+			const signed = await this.signGasRelayerNearTransaction({
+				receiverId: request.accountId,
+				nonce: nextNonce,
+				blockHash,
+				actions
+			});
+			const createAccountBroadcastStartedAt = Date.now();
+			const result = await this.input.nearClient.sendTransaction(signed, ACCOUNT_CREATE_BROADCAST_WAIT_UNTIL);
+			this.input.logger.info(`Account creation for ${request.accountId} reached ${ACCOUNT_CREATE_BROADCAST_WAIT_UNTIL} in ${Date.now() - createAccountBroadcastStartedAt}ms`);
+			const createAccountKeyCheckStartedAt = Date.now();
+			const keysVerified = await this.verifyAccountAccessKeysPresent(request.accountId, expectedPublicKeys, ACCOUNT_CREATE_FAST_KEY_VISIBILITY_CHECK);
+			this.input.logger.info(`Account creation for ${request.accountId} key visibility verified=${keysVerified} in ${Date.now() - createAccountKeyCheckStartedAt}ms`);
+			if (!keysVerified) {
+				this.input.logger.warn(recoveryPublicKey ? "Bootstrap committed before both access keys were visible on final state; scheduling background audit" : "Bootstrap committed before the operational access key was visible on final state; scheduling background audit");
+				this.scheduleAccountAccessKeyVisibilityAudit({
+					accountId: request.accountId,
+					expectedPublicKeys,
+					contextLabel: `Account creation for ${request.accountId}`
+				});
+			}
+			this.input.logger.info(`Account creation completed: ${result.transaction.hash}`);
+			const nearAmount = (Number(BigInt(initialBalance)) / 1e24).toFixed(6);
+			return {
+				success: true,
+				transactionHash: result.transaction.hash,
+				accountId: request.accountId,
+				message: `Account ${request.accountId} created with ${nearAmount} NEAR initial balance`
+			};
+		} catch (error) {
+			this.input.logger.error(`Account creation failed for ${request.accountId}:`, error);
+			const msg = errorMessage(error) || "Unknown account creation error";
+			return {
+				success: false,
+				error: msg,
+				message: `Failed to create account ${request.accountId}: ${msg}`
+			};
+		}
+	}
+	createFundImplicitNearAccountQueueTask(request) {
+		return this.fundImplicitNearAccountFromQueue.bind(this, request);
+	}
+	async fundImplicitNearAccountFromQueue(request) {
+		return await fundImplicitNearAccountWithRelayer({
+			...request,
+			relayerAccount: this.input.config.relayerAccount,
+			relayerPrivateKey: this.input.config.relayerPrivateKey,
+			relayerPublicKey: this.input.getRelayerPublicKey(),
+			nearRpcUrl: this.input.config.nearRpcUrl,
+			fundedAmountYocto: this.input.config.accountInitialBalance,
+			nearClient: this.input.nearClient,
+			ensureSignerWasm: this.input.ensureSignerWasm
+		});
+	}
+	async verifyAccountAccessKeysPresent(accountId, expectedPublicKeys, opts) {
+		return await verifyAccountAccessKeysPresentWithClient({
+			nearClient: this.input.nearClient,
+			accountId,
+			expectedPublicKeys,
+			options: opts
+		});
+	}
+	scheduleAccountAccessKeyVisibilityAudit(input) {
+		this.runAccountAccessKeyVisibilityAudit(input);
+	}
+	async runAccountAccessKeyVisibilityAudit(input) {
+		try {
+			const startedAt = Date.now();
+			if (await this.verifyAccountAccessKeysPresent(input.accountId, input.expectedPublicKeys, ACCOUNT_CREATE_BACKGROUND_KEY_VISIBILITY_AUDIT)) {
+				this.input.logger.info(`${input.contextLabel} final key visibility verified=true in ${Date.now() - startedAt}ms`);
+				return;
+			}
+			this.input.logger.warn(`${input.contextLabel} final key visibility is still pending after ${Date.now() - startedAt}ms`);
+		} catch (error) {
+			this.input.logger.warn(`${input.contextLabel} final key visibility audit failed`, error);
+		}
+	}
+};
+//#endregion
+export { NearAccountOperations };
+
+//# sourceMappingURL=nearAccountOperations.js.map

package/dist/esm/core/authService/nearPrivateKeySigning.js

@@ -0,0 +1,110 @@
+import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
+import "../../shared-ts/src/utils/encoders.js";
+import { decodeNearSecretKey, toPublicKeyStringFromSecretKey } from "../nearKeys.js";
+//#region src/core/authService/nearPrivateKeySigning.ts
+const ED25519_PKCS8_SEED_PREFIX = Uint8Array.from([
+	48,
+	46,
+	2,
+	1,
+	0,
+	48,
+	5,
+	6,
+	3,
+	43,
+	101,
+	112,
+	4,
+	34,
+	4,
+	32
+]);
+function requireRecord(value, label) {
+	if (!value || typeof value !== "object") throw new Error(`${label} must be an object`);
+	return value;
+}
+function requireNonEmptyString(value, label) {
+	const text = String(value || "").trim();
+	if (!text) throw new Error(`${label} is required`);
+	return text;
+}
+function requireSingleUnsignedNearTxBorshOutput(value) {
+	if (!Array.isArray(value) || value.length !== 1) throw new Error("Expected exactly one unsigned NEAR transaction from signer WASM");
+	const record = requireRecord(value[0], "unsigned NEAR transaction output");
+	return {
+		unsignedTransactionBorshB64u: requireNonEmptyString(record.unsignedTransactionBorshB64u, "unsignedTransactionBorshB64u"),
+		signingDigestB64u: requireNonEmptyString(record.signingDigestB64u, "signingDigestB64u")
+	};
+}
+function requireFinalizeNearTxFromSignatureOutput(value) {
+	const record = requireRecord(value, "finalized NEAR transaction output");
+	return {
+		signedTransactionBorshB64u: requireNonEmptyString(record.signedTransactionBorshB64u, "signedTransactionBorshB64u"),
+		transactionHash: requireNonEmptyString(record.transactionHash, "transactionHash")
+	};
+}
+function createEd25519Pkcs8FromSeed(seed32) {
+	if (seed32.length !== 32) throw new Error(`Ed25519 seed must be 32 bytes, got ${seed32.length}`);
+	const pkcs8 = new Uint8Array(ED25519_PKCS8_SEED_PREFIX.length + seed32.length);
+	pkcs8.set(ED25519_PKCS8_SEED_PREFIX, 0);
+	pkcs8.set(seed32, ED25519_PKCS8_SEED_PREFIX.length);
+	return pkcs8;
+}
+async function signNearDigestWithSecretKey(args) {
+	if (toPublicKeyStringFromSecretKey(args.nearPrivateKey) !== args.expectedSignerPublicKey) throw new Error("NEAR private key does not match expected signer public key");
+	const digest = base64UrlDecode(args.signingDigestB64u);
+	if (digest.length !== 32) throw new Error(`NEAR signing digest must be 32 bytes, got ${digest.length}`);
+	const secretKeyBytes = decodeNearSecretKey(args.nearPrivateKey);
+	const seed32 = new Uint8Array(secretKeyBytes.subarray(0, 32));
+	const pkcs8 = createEd25519Pkcs8FromSeed(seed32);
+	try {
+		const signature = await signEd25519MessageWithPkcs8(pkcs8, digest);
+		if (signature.length !== 64) throw new Error(`Ed25519 signature must be 64 bytes, got ${signature.length}`);
+		return base64UrlEncode(signature);
+	} finally {
+		secretKeyBytes.fill(0);
+		seed32.fill(0);
+		pkcs8.fill(0);
+	}
+}
+async function signEd25519MessageWithPkcs8(pkcs8, message) {
+	const nodeSignature = await signEd25519MessageWithNodeCrypto(pkcs8, message);
+	if (nodeSignature) return nodeSignature;
+	const webCryptoSignature = await signEd25519MessageWithWebCrypto(pkcs8, message);
+	if (webCryptoSignature) return webCryptoSignature;
+	throw new Error("Ed25519 private-key signing is unavailable in this runtime");
+}
+async function signEd25519MessageWithNodeCrypto(pkcs8, message) {
+	try {
+		const nodeCrypto = await import("node:crypto");
+		const { Buffer } = await import("node:buffer");
+		const key = nodeCrypto.createPrivateKey({
+			key: Buffer.from(pkcs8),
+			format: "der",
+			type: "pkcs8"
+		});
+		return new Uint8Array(nodeCrypto.sign(null, message, key));
+	} catch {
+		return null;
+	}
+}
+async function signEd25519MessageWithWebCrypto(pkcs8, message) {
+	const subtle = globalThis.crypto?.subtle;
+	if (!subtle) return null;
+	try {
+		const key = await subtle.importKey("pkcs8", copyToArrayBuffer(pkcs8), "Ed25519", false, ["sign"]);
+		return new Uint8Array(await subtle.sign("Ed25519", key, copyToArrayBuffer(message)));
+	} catch {
+		return null;
+	}
+}
+function copyToArrayBuffer(bytes) {
+	const buffer = new ArrayBuffer(bytes.length);
+	new Uint8Array(buffer).set(bytes);
+	return buffer;
+}
+//#endregion
+export { requireFinalizeNearTxFromSignatureOutput, requireSingleUnsignedNearTxBorshOutput, signNearDigestWithSecretKey };
+
+//# sourceMappingURL=nearPrivateKeySigning.js.map

package/dist/esm/core/authService/nearPublicKeyMetadata.js

@@ -0,0 +1,127 @@
+import { parseWebAuthnRpId } from "../../shared-ts/src/utils/domainIds.js";
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import "../../shared-ts/src/utils/validation.js";
+import { errorMessage } from "../../shared-ts/src/utils/errors.js";
+//#region src/core/authService/nearPublicKeyMetadata.ts
+function optionalPositiveInteger(input) {
+	const value = typeof input === "number" ? input : Number(input);
+	return Number.isFinite(value) && value >= 1 ? Math.floor(value) : null;
+}
+function optionalPositiveTimestamp(input) {
+	const value = typeof input === "number" ? input : Number(input);
+	return Number.isFinite(value) && value > 0 ? Math.floor(value) : null;
+}
+function nearPublicKeyAuthBinding(input) {
+	if (!input.credentialIdB64u && !input.rpIdRaw) return { ok: true };
+	if (!input.credentialIdB64u || !input.rpIdRaw) return {
+		ok: false,
+		message: "passkey near public key binding requires rpId and credentialIdB64u"
+	};
+	const rpId = parseWebAuthnRpId(input.rpIdRaw);
+	if (!rpId.ok) return {
+		ok: false,
+		message: rpId.error.message
+	};
+	return {
+		ok: true,
+		binding: {
+			kind: "passkey",
+			rpId: rpId.value,
+			credentialIdB64u: input.credentialIdB64u
+		}
+	};
+}
+function nearPublicKeyRecord(input) {
+	const record = {
+		version: "near_public_key_v1",
+		userId: input.userId,
+		publicKey: input.publicKey,
+		kind: input.kind,
+		createdAtMs: input.nowMs,
+		updatedAtMs: input.nowMs
+	};
+	if (input.signerSlot !== null) record.signerSlot = input.signerSlot;
+	if (input.authBinding) record.authBinding = input.authBinding;
+	if (input.addedTxHash) record.addedTxHash = input.addedTxHash;
+	if (input.removedAtMs !== null) record.removedAtMs = input.removedAtMs;
+	return record;
+}
+function nearPublicKeyListEntry(record) {
+	const entry = {
+		publicKey: record.publicKey,
+		kind: record.kind,
+		createdAtMs: record.createdAtMs,
+		updatedAtMs: record.updatedAtMs
+	};
+	if (typeof record.signerSlot === "number") entry.signerSlot = record.signerSlot;
+	if (record.authBinding) entry.authBinding = record.authBinding;
+	return entry;
+}
+async function recordNearPublicKeyMetadataWithStore(input) {
+	const userId = normalizeOptionalTrimmedString(input.userId);
+	const publicKey = normalizeOptionalTrimmedString(input.publicKey);
+	if (!userId || !publicKey) return {
+		ok: false,
+		code: "invalid_args",
+		message: "userId and publicKey are required"
+	};
+	const authBinding = nearPublicKeyAuthBinding({
+		credentialIdB64u: normalizeOptionalTrimmedString(input.credentialIdB64u),
+		rpIdRaw: normalizeOptionalTrimmedString(input.rpId)
+	});
+	if (!authBinding.ok) return {
+		ok: false,
+		code: "invalid_args",
+		message: authBinding.message
+	};
+	const record = nearPublicKeyRecord({
+		userId,
+		publicKey,
+		kind: input.kind,
+		signerSlot: optionalPositiveInteger(input.signerSlot),
+		authBinding: authBinding.binding,
+		addedTxHash: normalizeOptionalTrimmedString(input.addedTxHash),
+		removedAtMs: optionalPositiveTimestamp(input.removedAtMs),
+		nowMs: Date.now()
+	});
+	try {
+		await input.store.put(record);
+		return { ok: true };
+	} catch (error) {
+		const source = normalizeOptionalTrimmedString(input.source) || "near-public-key-metadata";
+		const message = errorMessage(error) || "Failed to persist NEAR public key metadata";
+		input.logger.warn(`[AuthService] ${source} failed for ${userId}`, error);
+		return {
+			ok: false,
+			code: "internal",
+			message
+		};
+	}
+}
+async function listNearPublicKeysForUserWithStore(input) {
+	try {
+		const userId = String(input.userId || "").trim();
+		if (!userId) return {
+			ok: false,
+			code: "invalid_args",
+			message: "Missing userId"
+		};
+		const records = await input.store.listByUserId(userId);
+		const keys = [];
+		for (const record of records || []) keys.push(nearPublicKeyListEntry(record));
+		return {
+			ok: true,
+			keys
+		};
+	} catch (e) {
+		return {
+			ok: false,
+			code: "internal",
+			message: errorMessage(e) || "Failed to list keys"
+		};
+	}
+}
+//#endregion
+export { listNearPublicKeysForUserWithStore, recordNearPublicKeyMetadataWithStore };
+
+//# sourceMappingURL=nearPublicKeyMetadata.js.map

package/dist/esm/core/authService/nearTransactions.js

@@ -0,0 +1,139 @@
+import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
+import "../../shared-ts/src/utils/encoders.js";
+import { ensureEd25519Prefix } from "../../shared-ts/src/utils/near.js";
+import "../../shared-ts/src/utils/validation.js";
+import { toError } from "../../shared-ts/src/utils/errors.js";
+import { toPublicKeyStringFromSecretKey } from "../nearKeys.js";
+import { SignedTransaction } from "../rpcClients/near/NearClient.js";
+import { requireFinalizeNearTxFromSignatureOutput, requireSingleUnsignedNearTxBorshOutput, signNearDigestWithSecretKey } from "./nearPrivateKeySigning.js";
+import { threshold_ed25519_build_near_tx_unsigned_borsh, threshold_ed25519_finalize_near_tx_from_signature } from "../../wasm/near_signer/pkg/wasm_signer_worker.js";
+//#region src/core/authService/nearTransactions.ts
+function nearAccountNotFound(message) {
+	return /does not exist|UNKNOWN_ACCOUNT|unknown\s+account/i.test(message);
+}
+function retryableNearAccountLookupError(message) {
+	return /server error|internal|temporar|timeout|too many requests|429|empty response|rpc request failed/i.test(message);
+}
+function errorDetailsBlob(error) {
+	const details = error.details;
+	if (!details) return "";
+	try {
+		return typeof details === "string" ? details : JSON.stringify(details);
+	} catch {
+		return "";
+	}
+}
+function accountLookupRetryDelayMs(attemptNumber) {
+	return 150 * Math.pow(2, attemptNumber - 1);
+}
+function delay(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function normalizedExpectedEd25519PublicKeys(expectedPublicKeys) {
+	return Array.from(new Set(expectedPublicKeys.map((key) => ensureEd25519Prefix(key)).filter(Boolean)));
+}
+function accessKeyPublicKeys(accessKeyList) {
+	return accessKeyList.keys.map((key) => ensureEd25519Prefix(String(key?.public_key || "").trim())).filter(Boolean);
+}
+async function viewAccessKeyListWithClient(input) {
+	return await input.nearClient.viewAccessKeyList(input.accountId);
+}
+async function dispatchNearSignedTransactionBorshWithClient(input) {
+	const signedTransactionBorsh = base64UrlDecode(input.signedTransactionBorshB64u);
+	const signedTransaction = SignedTransaction.fromPlain({
+		transaction: {},
+		signature: {},
+		borsh_bytes: Array.from(signedTransactionBorsh)
+	});
+	return { rpcResult: await input.nearClient.sendTransaction(signedTransaction) };
+}
+async function fetchNearTxContextWithClient(input) {
+	let nonce = 0n;
+	try {
+		const accessKey = await input.nearClient.viewAccessKey(input.accountId, input.publicKey);
+		nonce = BigInt(accessKey?.nonce ?? 0);
+	} catch {
+		nonce = 0n;
+	}
+	const block = await input.nearClient.viewBlock({ finality: "final" });
+	return {
+		nextNonce: (nonce + 1n).toString(),
+		blockHash: block.header.hash
+	};
+}
+async function signGasRelayerNearTransactionWithDeps(input) {
+	await input.ensureSignerWasm();
+	const signerPublicKey = toPublicKeyStringFromSecretKey(input.relayerPrivateKey);
+	const unsignedTx = requireSingleUnsignedNearTxBorshOutput(threshold_ed25519_build_near_tx_unsigned_borsh({
+		txSigningRequests: [{
+			nearAccountId: input.relayerAccount,
+			receiverId: input.receiverId,
+			actions: [...input.actions]
+		}],
+		transactionContext: {
+			nearPublicKeyStr: signerPublicKey,
+			nextNonce: input.nonce,
+			txBlockHash: input.blockHash
+		}
+	}));
+	const signatureB64u = await signNearDigestWithSecretKey({
+		nearPrivateKey: input.relayerPrivateKey,
+		signingDigestB64u: unsignedTx.signingDigestB64u,
+		expectedSignerPublicKey: signerPublicKey
+	});
+	const finalized = requireFinalizeNearTxFromSignatureOutput(threshold_ed25519_finalize_near_tx_from_signature({
+		unsignedTransactionBorshB64u: unsignedTx.unsignedTransactionBorshB64u,
+		signingDigestB64u: unsignedTx.signingDigestB64u,
+		signatureB64u,
+		expectedNearAccountId: input.relayerAccount,
+		expectedSignerPublicKey: signerPublicKey
+	}));
+	return SignedTransaction.fromPlain({
+		transaction: null,
+		signature: null,
+		borsh_bytes: Array.from(base64UrlDecode(finalized.signedTransactionBorshB64u))
+	});
+}
+async function checkNearAccountExistsWithClient(input) {
+	const attempts = 3;
+	let lastError = null;
+	for (let attempt = 1; attempt <= attempts; attempt += 1) try {
+		const view = await input.nearClient.viewAccount(input.accountId);
+		return Boolean(view);
+	} catch (error) {
+		const parsedError = toError(error);
+		lastError = parsedError;
+		const message = parsedError.message;
+		if (nearAccountNotFound(`${message}\n${errorDetailsBlob(parsedError)}`)) return false;
+		if (retryableNearAccountLookupError(message) && attempt < attempts) {
+			await delay(accountLookupRetryDelayMs(attempt));
+			continue;
+		}
+		if (retryableNearAccountLookupError(message)) {
+			input.logger.warn(`[AuthService] Assuming account '${input.accountId}' not found after retryable RPC errors:`, message);
+			return false;
+		}
+		input.logger.error(`Error checking account existence for ${input.accountId}:`, parsedError);
+		throw parsedError;
+	}
+	throw lastError || /* @__PURE__ */ new Error("Unknown error");
+}
+async function verifyAccountAccessKeysPresentWithClient(input) {
+	const expectedPublicKeys = normalizedExpectedEd25519PublicKeys(input.expectedPublicKeys);
+	if (!expectedPublicKeys.length) return false;
+	const attempts = Math.max(1, Math.floor(input.options?.attempts ?? 4));
+	const delayMs = Math.max(50, Math.floor(input.options?.delayMs ?? 250));
+	const finality = input.options?.finality ?? "final";
+	for (let attempt = 0; attempt < attempts; attempt += 1) {
+		try {
+			const actualPublicKeys = accessKeyPublicKeys(await input.nearClient.viewAccessKeyList(input.accountId, { finality }));
+			if (expectedPublicKeys.every((expected) => actualPublicKeys.includes(expected))) return true;
+		} catch {}
+		if (attempt < attempts - 1) await delay(delayMs);
+	}
+	return false;
+}
+//#endregion
+export { checkNearAccountExistsWithClient, dispatchNearSignedTransactionBorshWithClient, fetchNearTxContextWithClient, signGasRelayerNearTransactionWithDeps, verifyAccountAccessKeysPresentWithClient, viewAccessKeyListWithClient };
+
+//# sourceMappingURL=nearTransactions.js.map