@seams/wallet-server 0.5.0

package/dist/esm/core/deviceLinking/requestProof.js

@@ -0,0 +1,172 @@
+import { parseLinkDeviceSessionId } from "../../shared-ts/src/utils/domainIds.js";
+import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
+import { LINKED_DEVICE_CLOCK_SKEW_TOLERANCE_MS_V1, LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, computeLinkedDevicePublicKeyDigestV1, computeLinkedDeviceRequestProofDigestV1, encodeLinkedDeviceRequestProofV1 } from "../../shared-ts/src/device-linking/requestProof.js";
+//#region src/core/deviceLinking/requestProof.ts
+var LinkedDeviceRequestProofVerifierV1 = class {
+	constructor(input) {
+		this.nonceStore = input.nonceStore;
+	}
+	async verifyV1(input) {
+		try {
+			validateRequestProofBindingV1(input);
+			if (!constantTimeEqualDigestV1(await computeLinkedDevicePublicKeyDigestV1(input.expectedDevicePublicKeyB64u), input.expectedDevicePublicKeyDigestB64u)) return {
+				kind: "denied",
+				code: "invalid",
+				message: "device request proof key digest is invalid"
+			};
+			const canonicalPayload = encodeLinkedDeviceRequestProofV1(input.proof);
+			const proofDigestB64u = await computeLinkedDeviceRequestProofDigestV1(input.proof);
+			if (!await verifyEd25519SignatureV1(input.expectedDevicePublicKeyB64u, input.proof.signatureB64u, canonicalPayload)) return {
+				kind: "denied",
+				code: "invalid",
+				message: "device request proof signature is invalid"
+			};
+			if ((await this.nonceStore.consumeRequestProofNonceV1({
+				linkSessionId: input.proof.linkSessionId,
+				requestNonceB64u: input.proof.requestNonceB64u,
+				proofDigestB64u,
+				issuedAtMs: input.proof.issuedAtMs,
+				expiresAtMs: input.proof.expiresAtMs,
+				consumedAtMs: input.nowMs
+			})).outcome === "already_used") return {
+				kind: "denied",
+				code: "replayed",
+				message: "device request proof was already used"
+			};
+			return {
+				kind: "authorized",
+				proofDigestB64u
+			};
+		} catch (error) {
+			const message = errorMessage(error);
+			return {
+				kind: "denied",
+				code: message.includes("expired") || message.includes("not yet valid") || message.includes("lifetime exceeds") ? "expired" : "invalid",
+				message
+			};
+		}
+	}
+	async verifyPublicCreateV1(input) {
+		return await this.verifyV1({
+			proof: input.proof,
+			expectedDevicePublicKeyB64u: input.devicePublicKeyB64u,
+			expectedDevicePublicKeyDigestB64u: input.devicePublicKeyDigestB64u,
+			expectedLinkSessionId: input.linkSessionId,
+			expectedMethod: input.method,
+			expectedCanonicalPath: input.canonicalPath,
+			expectedBodyDigestB64u: input.bodyDigestB64u,
+			nowMs: input.nowMs
+		});
+	}
+};
+function parseLinkedDeviceRequestProofV1(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device request proof must be an object");
+	if (!isLinkedDeviceRequestProofRecordV1(raw)) throw new Error("record contains invalid fields");
+	const record = raw;
+	if (record.kind !== "linked_device_request_proof_v1") throw new Error("linked-device request proof kind is invalid");
+	const linkSessionId = parseSessionId(record.linkSessionId);
+	const devicePublicKeyDigestB64u = parseDigestField(record.devicePublicKeyDigestB64u, "devicePublicKeyDigestB64u");
+	const requestNonceB64u = parseFixedB64u(record.requestNonceB64u, 32, "requestNonceB64u");
+	const method = parseMethod(record.method);
+	const canonicalPath = parseCanonicalPath(record.canonicalPath);
+	const bodyDigestB64u = parseDigestField(record.bodyDigestB64u, "bodyDigestB64u");
+	const issuedAtMs = parseTimestamp(record.issuedAtMs, "issuedAtMs");
+	const expiresAtMs = parseTimestamp(record.expiresAtMs, "expiresAtMs");
+	if (expiresAtMs <= issuedAtMs) throw new Error("expiresAtMs must be after issuedAtMs");
+	return {
+		kind: "linked_device_request_proof_v1",
+		linkSessionId,
+		devicePublicKeyDigestB64u,
+		requestNonceB64u,
+		method,
+		canonicalPath,
+		bodyDigestB64u,
+		issuedAtMs,
+		expiresAtMs,
+		signatureB64u: parseFixedB64u(record.signatureB64u, 64, "signatureB64u")
+	};
+}
+function validateRequestProofBindingV1(input) {
+	validateProofShapeV1(input.proof);
+	if (input.proof.linkSessionId !== input.expectedLinkSessionId) throw new Error("request proof link session does not match");
+	if (input.proof.method !== input.expectedMethod) throw new Error("request proof method does not match");
+	if (input.proof.canonicalPath !== input.expectedCanonicalPath) throw new Error("request proof canonical path does not match");
+	if (!constantTimeEqualDigestV1(input.proof.bodyDigestB64u, input.expectedBodyDigestB64u)) throw new Error("request proof body digest does not match");
+	if (!constantTimeEqualDigestV1(input.proof.devicePublicKeyDigestB64u, input.expectedDevicePublicKeyDigestB64u)) throw new Error("request proof device identity digest does not match");
+	if (!Number.isSafeInteger(input.nowMs) || input.proof.issuedAtMs - input.nowMs > 6e4) throw new Error("request proof is not yet valid");
+	if (input.nowMs >= input.proof.expiresAtMs) throw new Error("request proof is expired");
+	if (input.proof.expiresAtMs - input.proof.issuedAtMs > 6e4) throw new Error("request proof lifetime exceeds the maximum");
+}
+async function verifyEd25519SignatureV1(publicKeyB64u, signatureB64u, canonicalPayload) {
+	const publicKey = parseFixedB64u(publicKeyB64u, 32, "devicePublicKeyB64u");
+	const signature = parseFixedB64u(signatureB64u, 64, "signatureB64u");
+	const key = await crypto.subtle.importKey("raw", toArrayBuffer(base64UrlDecode(publicKey)), { name: "Ed25519" }, false, ["verify"]);
+	return await crypto.subtle.verify({ name: "Ed25519" }, key, toArrayBuffer(base64UrlDecode(signature)), toArrayBuffer(canonicalPayload));
+}
+function validateProofShapeV1(proof) {
+	if (proof.kind !== "linked_device_request_proof_v1") throw new Error("request proof kind is invalid");
+	parseSessionId(proof.linkSessionId);
+	parseDigestField(proof.devicePublicKeyDigestB64u, "devicePublicKeyDigestB64u");
+	parseFixedB64u(proof.requestNonceB64u, 32, "requestNonceB64u");
+	if (proof.method !== "GET" && proof.method !== "POST") throw new Error("request proof method is invalid");
+	parseCanonicalPath(proof.canonicalPath);
+	parseDigestField(proof.bodyDigestB64u, "bodyDigestB64u");
+	parseTimestamp(proof.issuedAtMs, "issuedAtMs");
+	parseTimestamp(proof.expiresAtMs, "expiresAtMs");
+	if (proof.expiresAtMs <= proof.issuedAtMs) throw new Error("expiresAtMs must be after issuedAtMs");
+	parseFixedB64u(proof.signatureB64u, 64, "signatureB64u");
+}
+function parseSessionId(raw) {
+	if (typeof raw !== "string") throw new Error("linkSessionId is invalid");
+	const parsed = parseLinkDeviceSessionId(raw);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function parseMethod(raw) {
+	if (raw !== "GET" && raw !== "POST") throw new Error("method is invalid");
+	return raw;
+}
+function parseCanonicalPath(raw) {
+	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw || !raw.startsWith("/")) throw new Error("canonicalPath is invalid");
+	if (raw.includes("?") || raw.includes("#")) throw new Error("canonicalPath must be a pathname");
+	return raw;
+}
+function parseTimestamp(raw, field) {
+	if (!Number.isSafeInteger(raw) || Number(raw) <= 0) throw new Error(`${field} is invalid`);
+	return Number(raw);
+}
+function parseDigestField(raw, field) {
+	try {
+		return parseDigestB64u(raw);
+	} catch {
+		throw new Error(`${field} is invalid`);
+	}
+}
+function parseFixedB64u(raw, expectedBytes, field) {
+	if (typeof raw !== "string" || raw.length === 0 || !/^[A-Za-z0-9_-]+$/.test(raw)) throw new Error(`${field} is invalid`);
+	const bytes = base64UrlDecode(raw);
+	if (bytes.length !== expectedBytes || base64UrlEncode(bytes) !== raw) throw new Error(`${field} is invalid`);
+	return raw;
+}
+function toArrayBuffer(bytes) {
+	return bytes.slice().buffer;
+}
+function isLinkedDeviceRequestProofRecordV1(value) {
+	return Object.keys(value).sort().join("|") === "bodyDigestB64u|canonicalPath|devicePublicKeyDigestB64u|expiresAtMs|issuedAtMs|kind|linkSessionId|method|requestNonceB64u|signatureB64u";
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error || "invalid device request proof");
+}
+function constantTimeEqualDigestV1(left, right) {
+	const leftBytes = base64UrlDecode(left);
+	const rightBytes = base64UrlDecode(right);
+	if (leftBytes.length !== rightBytes.length) return false;
+	let difference = 0;
+	for (let index = 0; index < leftBytes.length; index += 1) difference |= leftBytes[index] ^ rightBytes[index];
+	return difference === 0;
+}
+//#endregion
+export { LINKED_DEVICE_CLOCK_SKEW_TOLERANCE_MS_V1, LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, LinkedDeviceRequestProofVerifierV1, computeLinkedDevicePublicKeyDigestV1, computeLinkedDeviceRequestProofDigestV1, encodeLinkedDeviceRequestProofV1, parseLinkedDeviceRequestProofV1 };
+
+//# sourceMappingURL=requestProof.js.map

package/dist/esm/core/errors.js

@@ -0,0 +1,54 @@
+import { isObject, isString } from "../shared-ts/src/utils/validation.js";
+//#region src/core/errors.ts
+/**
+* Parse a NEAR FinalExecutionOutcome and surface a human-readable error
+* string when common contract/account failures are detected.
+*
+* This helper is intentionally conservative: it never throws, and returns
+* null when it cannot confidently extract a useful message.
+*/
+function parseContractExecutionError(result, accountId) {
+	try {
+		if (result.status && isObject(result.status) && "Failure" in result.status) {
+			console.log(`Transaction failed:`, result.status.Failure);
+			return `Transaction failed: ${JSON.stringify(result.status.Failure)}`;
+		}
+		const receipts = result.receipts_outcome || [];
+		for (const receipt of receipts) {
+			const status = receipt.outcome?.status;
+			if (status?.Failure) {
+				const failure = status.Failure;
+				console.log(`Receipt failure detected:`, failure);
+				if (failure.ActionError?.kind) {
+					const actionKind = failure.ActionError.kind;
+					if (actionKind.AccountAlreadyExists) {
+						const info = actionKind.AccountAlreadyExists;
+						return `Account ${info.accountId ?? info.account_id ?? accountId} already exists on NEAR network`;
+					}
+					if (actionKind.AccountDoesNotExist) return `Referenced account ${actionKind.AccountDoesNotExist.account_id ?? accountId} does not exist`;
+					if (actionKind.InsufficientStake) return `Insufficient stake for account creation: ${actionKind.InsufficientStake.account_id ?? accountId}`;
+					if (actionKind.LackBalanceForState) return `Insufficient balance for account state: ${actionKind.LackBalanceForState.account_id ?? accountId}`;
+					const executionError = actionKind?.FunctionCallError?.ExecutionError;
+					if (typeof executionError === "string" && executionError.includes("missing field `source`")) return "Contract input JSON is missing required field `source` (Outlayer `request_execution` accepts `source`; `code_source` is not supported).";
+					return `Account creation failed: ${JSON.stringify(actionKind)}`;
+				}
+				return `Contract execution failed: ${JSON.stringify(failure)}`;
+			}
+			const logs = receipt.outcome?.logs || [];
+			for (const log of logs) if (isString(log)) {
+				if (log.includes("AccountAlreadyExists") || log.includes("account already exists")) return `Account ${accountId} already exists`;
+				if (log.includes("AccountDoesNotExist")) return `Referenced account does not exist`;
+				if (log.includes("Cannot deserialize the contract state")) return `Contract state deserialization failed. This may be due to a contract upgrade. Please try again or contact support.`;
+				if (log.includes("GuestPanic")) return `Contract execution panic: ${log}`;
+			}
+		}
+		return null;
+	} catch (parseError) {
+		console.warn(`Error parsing contract execution results:`, parseError);
+		return null;
+	}
+}
+//#endregion
+export { parseContractExecutionError };
+
+//# sourceMappingURL=errors.js.map

package/dist/esm/core/hostedAccountIds.js

@@ -0,0 +1,225 @@
+import { parseWalletId } from "../shared-ts/src/utils/domainIds.js";
+import { isValidAccountId } from "../shared-ts/src/utils/near.js";
+import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
+import "../shared-ts/src/utils/validation.js";
+//#region src/core/hostedAccountIds.ts
+const DOMAIN = "near_account_slug_v1";
+const ADJECTIVES = [
+	"amber",
+	"arctic",
+	"autumn",
+	"brisk",
+	"calm",
+	"cedar",
+	"clear",
+	"cobalt",
+	"coral",
+	"cosmic",
+	"crisp",
+	"dawn",
+	"deep",
+	"ember",
+	"fair",
+	"fresh",
+	"frost",
+	"gentle",
+	"golden",
+	"green",
+	"hidden",
+	"high",
+	"ivory",
+	"jade",
+	"keen",
+	"kind",
+	"lunar",
+	"maple",
+	"misty",
+	"neon",
+	"nimble",
+	"noble",
+	"opal",
+	"quiet",
+	"rapid",
+	"river",
+	"sage",
+	"silver",
+	"solar",
+	"spruce",
+	"steady",
+	"stone",
+	"sunny",
+	"swift",
+	"tidal",
+	"true",
+	"urban",
+	"velvet",
+	"vivid",
+	"warm",
+	"wild",
+	"winter",
+	"wise",
+	"young",
+	"zen",
+	"azure",
+	"bright",
+	"cloud",
+	"distant",
+	"glad",
+	"honest",
+	"loyal",
+	"prime",
+	"zesty"
+];
+const NOUNS = [
+	"anchor",
+	"ash",
+	"bay",
+	"beacon",
+	"birch",
+	"brook",
+	"canyon",
+	"cliff",
+	"comet",
+	"cove",
+	"delta",
+	"dune",
+	"field",
+	"flare",
+	"forest",
+	"grove",
+	"harbor",
+	"hill",
+	"isle",
+	"lagoon",
+	"lake",
+	"leaf",
+	"light",
+	"meadow",
+	"mesa",
+	"moon",
+	"nova",
+	"oasis",
+	"orchid",
+	"peak",
+	"pine",
+	"plain",
+	"reef",
+	"ridge",
+	"river",
+	"rock",
+	"shell",
+	"shore",
+	"sky",
+	"spark",
+	"spring",
+	"star",
+	"stone",
+	"summit",
+	"sun",
+	"thicket",
+	"trail",
+	"vale",
+	"valley",
+	"wave",
+	"willow",
+	"wind",
+	"wood",
+	"zephyr",
+	"atlas",
+	"bridge",
+	"garden",
+	"haven",
+	"lantern",
+	"maple",
+	"signal",
+	"silver",
+	"tempo",
+	"vista"
+];
+function requireNonEmpty(label, value) {
+	const normalized = normalizeOptionalTrimmedString(value);
+	if (!normalized) throw new Error(`${label} is required`);
+	return normalized;
+}
+function bytesToUint32(bytes, offset) {
+	return (bytes[offset] || 0) * 16777216 + ((bytes[offset + 1] || 0) << 16) + ((bytes[offset + 2] || 0) << 8) + (bytes[offset + 3] || 0) >>> 0;
+}
+function bytesToBase36(bytes) {
+	let value = 0n;
+	for (const byte of bytes.slice(8, 16)) value = (value << 8n) + BigInt(byte);
+	return value.toString(36);
+}
+function parseHostedHmacReadableRelayerWalletId(input) {
+	const walletId = parseWalletId(input.walletId);
+	if (!walletId.ok) return {
+		ok: false,
+		code: "invalid_wallet_id"
+	};
+	const walletIdValue = String(walletId.value);
+	const relayerAccount = normalizeOptionalTrimmedString(input.relayerAccount);
+	if (!relayerAccount || !isValidAccountId(relayerAccount)) return {
+		ok: false,
+		code: "invalid_relayer_account"
+	};
+	if (!isValidAccountId(walletIdValue)) return {
+		ok: false,
+		code: "not_near_account"
+	};
+	if (!walletIdValue.endsWith(`.${relayerAccount}`)) return {
+		ok: false,
+		code: "not_relayer_subaccount"
+	};
+	const slug = walletIdValue.slice(0, -(relayerAccount.length + 1));
+	if (!/^[a-z]+-[a-z]+-[a-z0-9]{10}$/.test(slug)) return {
+		ok: false,
+		code: "not_hmac_readable"
+	};
+	return {
+		ok: true,
+		value: walletId.value
+	};
+}
+function isHostedHmacReadableRelayerWalletId(input) {
+	return parseHostedHmacReadableRelayerWalletId(input).ok;
+}
+async function hmacSha256(secret, context) {
+	if (typeof crypto === "undefined" || !crypto.subtle) throw new Error("WebCrypto (crypto.subtle) is unavailable in this runtime");
+	const encoder = new TextEncoder();
+	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const mac = await crypto.subtle.sign("HMAC", key, encoder.encode(context));
+	return new Uint8Array(mac);
+}
+async function deriveHostedNearAccountId(input) {
+	const secret = requireNonEmpty("ACCOUNT_ID_DERIVATION_SECRET", input.accountIdDerivationSecret);
+	const relayerAccount = requireNonEmpty("relayerAccount", input.relayerAccount);
+	if (!isValidAccountId(relayerAccount)) throw new Error("Hosted account ID generation requires a valid relayerAccount");
+	const projectId = requireNonEmpty("projectId", input.projectId);
+	const envId = requireNonEmpty("envId", input.envId);
+	const authProvider = requireNonEmpty("authProvider", input.authProvider);
+	const providerSubject = normalizeOptionalTrimmedString(input.providerSubject);
+	const verifiedEmail = normalizeOptionalTrimmedString(input.verifiedEmail);
+	const walletIdDerivationNonce = normalizeOptionalTrimmedString(input.walletIdDerivationNonce);
+	const identity = providerSubject || verifiedEmail;
+	if (!identity) throw new Error("Hosted account ID generation requires providerSubject or verifiedEmail");
+	const collisionCounter = Math.max(0, Math.floor(Number(input.collisionCounter) || 0));
+	const contextParts = [
+		DOMAIN,
+		projectId,
+		envId,
+		authProvider,
+		identity
+	];
+	if (walletIdDerivationNonce) contextParts.push(`nonce:${walletIdDerivationNonce}`);
+	if (collisionCounter > 0) contextParts.push(`collision:${collisionCounter}`);
+	const seed = await hmacSha256(secret, contextParts.join("\0"));
+	const walletId = `${ADJECTIVES[bytesToUint32(seed, 0) % ADJECTIVES.length]}-${NOUNS[bytesToUint32(seed, 4) % NOUNS.length]}-${bytesToBase36(seed).padStart(10, "0").slice(0, 10)}.${relayerAccount}`;
+	if (!isValidAccountId(walletId)) throw new Error("Generated hosted NEAR account ID is invalid");
+	return walletId;
+}
+//#endregion
+export { deriveHostedNearAccountId, isHostedHmacReadableRelayerWalletId, parseHostedHmacReadableRelayerWalletId };
+
+//# sourceMappingURL=hostedAccountIds.js.map

package/dist/esm/core/keyMaterialBrands.js

@@ -0,0 +1,58 @@
+//#region src/core/keyMaterialBrands.ts
+function parseNonEmptyBrand(value, label) {
+	const normalized = String(value ?? "").trim();
+	if (!normalized) throw new Error(`${label} must be a non-empty string`);
+	return normalized;
+}
+function parseEcdsaDerivationKeyVersion(value) {
+	return parseNonEmptyBrand(value, "ECDSA DERIVATION key version");
+}
+function parseSigningSessionSealKeyVersion(value) {
+	return parseNonEmptyBrand(value, "signing-session seal key version");
+}
+function parseEd25519ClientVerifyingShareB64u(value) {
+	return parseNonEmptyBrand(value, "Ed25519 client verifying share");
+}
+function parseEcdsaClientVerifyingShareB64u(value) {
+	return parseNonEmptyBrand(value, "ECDSA client verifying share");
+}
+function parseEd25519RelayerKeyId(value) {
+	return parseNonEmptyBrand(value, "Ed25519 relayer key id");
+}
+function parseEcdsaRelayerKeyId(value) {
+	return parseNonEmptyBrand(value, "ECDSA relayer key id");
+}
+function parseEcdsaThresholdKeyId(value) {
+	return parseNonEmptyBrand(value, "ECDSA threshold key id");
+}
+function parseEcdsaKeyHandle(value) {
+	return parseNonEmptyBrand(value, "ECDSA key handle");
+}
+function formatEcdsaDerivationKeyVersionForWire(value) {
+	return value;
+}
+function formatSigningSessionSealKeyVersionForWire(value) {
+	return value;
+}
+function formatEd25519ClientVerifyingShareB64uForWire(value) {
+	return value;
+}
+function formatEcdsaClientVerifyingShareB64uForWire(value) {
+	return value;
+}
+function formatEd25519RelayerKeyIdForWire(value) {
+	return value;
+}
+function formatEcdsaRelayerKeyIdForWire(value) {
+	return value;
+}
+function formatEcdsaThresholdKeyIdForWire(value) {
+	return value;
+}
+function formatEcdsaKeyHandleForWire(value) {
+	return value;
+}
+//#endregion
+export { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519ClientVerifyingShareB64uForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEcdsaThresholdKeyId, parseEd25519ClientVerifyingShareB64u, parseEd25519RelayerKeyId, parseSigningSessionSealKeyVersion };
+
+//# sourceMappingURL=keyMaterialBrands.js.map

package/dist/esm/core/logger.js

@@ -0,0 +1,39 @@
+//#region src/core/logger.ts
+function safe(fn) {
+	if (!fn) return () => {};
+	return (...args) => {
+		try {
+			fn(...args);
+		} catch {}
+	};
+}
+/**
+* Library code should never call `console.*` directly; the host decides where logs go.
+* - Default: no logs
+* - To enable: pass `logger: console` (or a structured logger) to the host config.
+*/
+function normalizeLogger(logger) {
+	if (!logger) return {
+		debug: () => {},
+		info: () => {},
+		warn: () => {},
+		error: () => {}
+	};
+	const base = logger;
+	const log = typeof base.log === "function" ? base.log.bind(base) : void 0;
+	const debug = typeof base.debug === "function" ? base.debug.bind(base) : log;
+	const info = typeof base.info === "function" ? base.info.bind(base) : log;
+	const warn = typeof base.warn === "function" ? base.warn.bind(base) : log;
+	const error = typeof base.error === "function" ? base.error.bind(base) : log;
+	return {
+		debug: safe(debug),
+		info: safe(info),
+		warn: safe(warn),
+		error: safe(error)
+	};
+}
+const coerceLogger = normalizeLogger;
+//#endregion
+export { coerceLogger, normalizeLogger };
+
+//# sourceMappingURL=logger.js.map

package/dist/esm/core/nearKeys.js

@@ -0,0 +1,20 @@
+import { ensureEd25519Prefix } from "../shared-ts/src/utils/near.js";
+import "../shared-ts/src/utils/validation.js";
+import bs58 from "bs58";
+//#region src/core/nearKeys.ts
+function stripEd25519Prefix(value) {
+	return String(value || "").trim().replace(/^ed25519:/i, "");
+}
+function decodeNearSecretKey(secretKey) {
+	const bytes = bs58.decode(stripEd25519Prefix(secretKey));
+	if (bytes.length !== 64) throw new Error(`Invalid NEAR secret key length: ${bytes.length}`);
+	return bytes;
+}
+function toPublicKeyStringFromSecretKey(secretKey) {
+	const bytes = decodeNearSecretKey(secretKey);
+	return ensureEd25519Prefix(bs58.encode(bytes.subarray(32, 64)));
+}
+//#endregion
+export { decodeNearSecretKey, toPublicKeyStringFromSecretKey };
+
+//# sourceMappingURL=nearKeys.js.map