@seams/wallet 0.5.1 → 0.5.2

package/dist/public/sdk/workers/passkey-confirm.worker.js

@@ -1 +1,606 @@
-function y($){return String($??"").trim()}function A($){return y($)||void 0}function g($){if($.length>=255)throw new TypeError("Alphabet too long");let Y=new Uint8Array(256);for(let J=0;J<Y.length;J++)Y[J]=255;for(let J=0;J<$.length;J++){let X=$.charAt(J),Z=X.charCodeAt(0);if(Y[Z]!==255)throw new TypeError(X+" is ambiguous");Y[Z]=J}let G=$.length,Q=$.charAt(0),_=Math.log(G)/Math.log(256),K=Math.log(256)/Math.log(G);function W(J){if(J instanceof Uint8Array);else if(ArrayBuffer.isView(J))J=new Uint8Array(J.buffer,J.byteOffset,J.byteLength);else if(Array.isArray(J))J=Uint8Array.from(J);if(!(J instanceof Uint8Array))throw new TypeError("Expected Uint8Array");if(J.length===0)return"";let X=0,Z=0,V=0,D=J.length;while(V!==D&&J[V]===0)V++,X++;let M=(D-V)*K+1>>>0,F=new Uint8Array(M);while(V!==D){let N=J[V],H=0;for(let B=M-1;(N!==0||H<Z)&&B!==-1;B--,H++)N+=256*F[B]>>>0,F[B]=N%G>>>0,N=N/G>>>0;if(N!==0)throw new Error("Non-zero carry");Z=H,V++}let U=M-Z;while(U!==M&&F[U]===0)U++;let j=Q.repeat(X);for(;U<M;++U)j+=$.charAt(F[U]);return j}function R(J){if(typeof J!=="string")throw new TypeError("Expected String");if(J.length===0)return new Uint8Array;let X=0,Z=0,V=0;while(J[X]===Q)Z++,X++;let D=(J.length-X)*_+1>>>0,M=new Uint8Array(D);while(X<J.length){let N=J.charCodeAt(X);if(N>255)return;let H=Y[N];if(H===255)return;let B=0;for(let h=D-1;(H!==0||B<V)&&h!==-1;h--,B++)H+=G*M[h]>>>0,M[h]=H%256>>>0,H=H/256>>>0;if(H!==0)throw new Error("Non-zero carry");V=B,X++}let F=D-V;while(F!==D&&M[F]===0)F++;let U=new Uint8Array(Z+(D-F)),j=Z;while(F!==D)U[j++]=M[F++];return U}function P(J){let X=R(J);if(X)return X;throw new Error("Non-base"+G+" character")}return{encode:W,decodeUnsafe:R,decode:P}}var z=g;var m="123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz",p=z(m);function q($){return $!==null&&typeof $==="object"}function C($){return typeof $==="string"}function I($){return typeof $==="boolean"}function c($){try{if(typeof $==="string")return $;if($&&typeof $.message==="string")return $.message;return String($??"")}catch{return""}}function L($){return`${$}B64u`}var I0=["nearPrivateKey","near_private_key","privateKey","private_key",L("seed"),"seed_b64u",L("canonicalSeed"),"canonical_seed_b64u",L("xClientBase"),"x_client_base_b64u",L("clientOutputMask"),"client_output_mask_b64u",L("clientRecoverableSecret"),"client_recoverable_secret_b64u","prfOutput","prf_output","prfFirst","prf_first",L("prfFirst"),"prf_first_b64u","prfSecond","prf_second",L("prfSecond"),"prf_second_b64u",L("signingShare32"),"signing_share32_b64u",L("clientNonceHandle"),"client_nonce_handle_b64u"];function k($){if($ instanceof Error)return $;let Y=new Error(c($));try{let G=$;if(typeof G?.name==="string")Y.name=G.name;if(typeof G?.stack==="string")Y.stack=G.stack;if(G&&typeof G.code!=="undefined")Y.code=G.code;if(G&&typeof G.details!=="undefined")Y.details=G.details}catch{}return Y}var d=($)=>{let Y=ArrayBuffer.isView($)?new Uint8Array($.buffer,$.byteOffset,$.byteLength):new Uint8Array($),G="";for(let Q=0;Q<Y.length;Q++)G+=String.fromCharCode(Y[Q]);return btoa(G)};var f=($)=>{return d($).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")};var x=32;function u($=x,Y="secure random bytes"){let G=Math.max(1,Math.floor(Number($)||0)),Q=globalThis.crypto;if(typeof Q?.getRandomValues!=="function")throw new Error(`WebCrypto getRandomValues is required for ${Y}`);return Q.getRandomValues(new Uint8Array(G))}function b($=x,Y="secure random id"){return f(u($,Y))}function E($,Y={}){let G,Q;try{G=l($),Q=t(G)}catch(_){return Promise.reject(new Error(`[signer-worker]: invalid confirmation prompt: ${k(_).message}`))}return new Promise((_,K)=>{let W=$0(Q),R,P=()=>{if(R)clearTimeout(R);if(self.removeEventListener("message",X),Y.signal)Y.signal.removeEventListener("abort",J)},J=()=>{P(),K(new Error("[signer-worker]: confirmation aborted"))},X=(Z)=>{let V=Z?.data;if(!e(V))return;if(!J0(Z))return;if(Y0(V)!==Q)return;if(!G0(V,W))return;P();let D;try{D=V.data.confirmed?o({requestId:Q,data:V.data}):V.data.walletSessionFailure?{request_id:Q,intent_digest:V.data.intentDigest,confirmed:!1,registration_diagnostics:V.data.registrationDiagnostics,wallet_session_failure:V.data.walletSessionFailure}:{request_id:Q,intent_digest:V.data.intentDigest,confirmed:!1,registration_diagnostics:V.data.registrationDiagnostics,error:V.data.error}}catch(M){return K(k(M))}return _(D)};if(self.addEventListener("message",X),Y.timeoutMs&&Y.timeoutMs>0)R=setTimeout(()=>{P(),K(new Error("[signer-worker]: confirmation timed out"))},Y.timeoutMs);if(Y.signal){if(Y.signal.aborted)return P(),K(new Error("[signer-worker]: confirmation aborted"));Y.signal.addEventListener("abort",J)}try{let Z={type:"PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD",requestId:Q,channelToken:W,data:G};self.postMessage(Z)}catch(Z){return P(),console.error("[signer-worker][V2] postMessage failed",Z),K(k(Z))}})}function l($){if(!q($))throw new Error("expected an object");if($.kind==="pending_request"){let Y=w($.requestId),G=n($.requestToken);return{kind:"pending_request",requestId:Y,requestToken:G}}if($.kind==="export_request"){if(!q($.request))throw new Error("export request is missing");return w($.request.requestId),$}throw new Error("unsupported prompt kind")}function t($){switch($.kind){case"pending_request":return $.requestId;case"export_request":return w($.request.requestId);default:return s($)}}function w($){if(!C($))throw new Error("missing requestId");let Y=$.trim();if(!Y)throw new Error("missing requestId");return Y}function n($){if(!C($))throw new Error("missing requestToken");let Y=$.trim();if(!Y)throw new Error("missing requestToken");return Y}function s($){throw new Error(`Unexpected confirmation prompt kind: ${String($)}`)}function o($){let Y=i($.data.nonceLeases),G={request_id:$.requestId,confirmed:!0,...$.data.intentDigest?{intent_digest:$.data.intentDigest}:{},...$.data.credential?{credential:$.data.credential}:{},...$.data.operationStepUpPreparation?{operation_step_up_preparation:$.data.operationStepUpPreparation}:{},...$.data.otpCode?{otp_code:$.data.otpCode}:{},...$.data.emailOtpChallengeId?{email_otp_challenge_id:$.data.emailOtpChallengeId}:{},...$.data.registrationDiagnostics?{registration_diagnostics:$.data.registrationDiagnostics}:{}};if($.data.nearTransactionReadiness){if($.data.transactionContext||Y!==void 0)throw new Error("Secure confirm NEAR readiness cannot include top-level transaction context");return{...G,near_transaction_readiness:$.data.nearTransactionReadiness}}if($.data.transactionContext){if(!Y?.length)throw new Error("Secure confirm transaction response requires nonceLeases");return{...G,transaction_context:$.data.transactionContext,nonce_leases:Y}}if(Y!==void 0)throw new Error("Secure confirm response nonceLeases require transactionContext");return G}function i($){if($==null)return;if(!Array.isArray($))throw new Error("Invalid secure confirm response nonceLeases: expected array");return $.map(a)}function a($){if(!q($))throw new Error("Invalid secure confirm response nonceLease: expected object");let Y=S($.leaseId,"nonceLease.leaseId"),G=S($.operationId,"nonceLease.operationId"),Q=S($.operationFingerprint,"nonceLease.operationFingerprint"),_=S($.nonce,"nonceLease.nonce"),K=$.batchId==null?void 0:S($.batchId,"nonceLease.batchId"),W=r($.txIndex);return{leaseId:Y,operationId:G,operationFingerprint:Q,nonce:_,...K?{batchId:K}:{},...W!==void 0?{txIndex:W}:{}}}function S($,Y){if(!C($))throw new Error(`Invalid secure confirm response ${Y}: expected string`);let G=$.trim();if(!G)throw new Error(`Invalid secure confirm response ${Y}: expected non-empty string`);return G}function r($){if($==null)return;if(typeof $!=="number"||!Number.isSafeInteger($))throw new Error("Invalid secure confirm response nonceLease.txIndex: expected safe integer");return $}function e($){if(!q($))return!1;if($.type!=="USER_PASSKEY_CONFIRM_RESPONSE")return!1;let Y=$.data;if(!q(Y))return!1;return C(Y.requestId)&&I(Y.confirmed)}function $0($){let Y=String($||"").trim()||"sc",G=b(32,"user confirmation channel tokens");return`${Y}:${G}`}function Y0($){let Y=C($.requestId)?$.requestId.trim():"";if(Y)return Y;return String($.data.requestId||"").trim()}function G0($,Y){return(A($.channelToken)||"")===Y}function J0($){let Y=$.origin.trim();if(!Y)return!0;try{let G=String(self.location?.origin||"").trim();return!!G&&Y===G}catch{return!1}}globalThis.awaitUserConfirmationV2=E;function T($){return $&&typeof $==="object"&&!Array.isArray($)?$:null}function Q0($){let Y=T($);return Y?{id:Y.id,type:Y.type,payload:Y.payload}:{}}function O($,Y){let G=Y.success===!0?{...typeof $==="string"&&$.trim()?{id:$.trim()}:{},success:!0,data:Y.data}:{...typeof $==="string"&&$.trim()?{id:$.trim()}:{},success:!1,error:Y.error};self.postMessage(G)}function V0($){let Y=T($);if(Y)self.postMessage(Y)}function X0($){let Y=T($);if(!Y)return null;if("request"in Y)return null;let G=typeof Y.requestId==="string"?Y.requestId.trim():"";return G?{requestId:G}:null}self.onmessage=($)=>{let Y=Q0($.data),G=Y.type;if(G==="USER_PASSKEY_CONFIRM_RESPONSE")return;if(G==="USER_PASSKEY_CONFIRM_PROGRESS"){V0($.data);return}let Q=Y.id;if(G==="PING"){O(Q,{success:!0,data:{ok:!0}});return}if(G==="SECURE_CONFIRM_REQUEST"){(async()=>{try{let _=T(Y.payload),K=X0(_);if(!K){O(Q,{success:!1,error:"Invalid SECURE_CONFIRM_REQUEST payload: missing requestId"});return}let W=typeof Q==="string"?Q.trim():"";if(!W){O(Q,{success:!1,error:"Invalid SECURE_CONFIRM_REQUEST message: missing id"});return}await E({kind:"pending_request",requestId:K.requestId,requestToken:W}),O(Q,{success:!0,data:{ok:!0}})}catch(_){O(Q,{success:!1,error:_ instanceof Error?_.message:String(_)})}})();return}if(typeof Q==="string"&&Q.trim())O(Q,{success:!1,error:`Unsupported UserConfirm worker message type: ${String(G)}`})};self.onerror=($)=>{console.error("[passkey-confirm-worker] error:",$)};self.onunhandledrejection=($)=>{console.error("[passkey-confirm-worker] Unhandled promise rejection:",$.reason),$.preventDefault()};
+// ../shared-ts/src/utils/normalize.ts
+function normalizeTrimmedString(value) {
+  return String(value ?? "").trim();
+}
+function normalizeOptionalNonEmptyString(value) {
+  const normalized = normalizeTrimmedString(value);
+  return normalized || undefined;
+}
+
+// ../../node_modules/base-x/src/esm/index.js
+function base(ALPHABET) {
+  if (ALPHABET.length >= 255) {
+    throw new TypeError("Alphabet too long");
+  }
+  const BASE_MAP = new Uint8Array(256);
+  for (let j = 0;j < BASE_MAP.length; j++) {
+    BASE_MAP[j] = 255;
+  }
+  for (let i = 0;i < ALPHABET.length; i++) {
+    const x = ALPHABET.charAt(i);
+    const xc = x.charCodeAt(0);
+    if (BASE_MAP[xc] !== 255) {
+      throw new TypeError(x + " is ambiguous");
+    }
+    BASE_MAP[xc] = i;
+  }
+  const BASE = ALPHABET.length;
+  const LEADER = ALPHABET.charAt(0);
+  const FACTOR = Math.log(BASE) / Math.log(256);
+  const iFACTOR = Math.log(256) / Math.log(BASE);
+  function encode(source) {
+    if (source instanceof Uint8Array) {} else if (ArrayBuffer.isView(source)) {
+      source = new Uint8Array(source.buffer, source.byteOffset, source.byteLength);
+    } else if (Array.isArray(source)) {
+      source = Uint8Array.from(source);
+    }
+    if (!(source instanceof Uint8Array)) {
+      throw new TypeError("Expected Uint8Array");
+    }
+    if (source.length === 0) {
+      return "";
+    }
+    let zeroes = 0;
+    let length = 0;
+    let pbegin = 0;
+    const pend = source.length;
+    while (pbegin !== pend && source[pbegin] === 0) {
+      pbegin++;
+      zeroes++;
+    }
+    const size = (pend - pbegin) * iFACTOR + 1 >>> 0;
+    const b58 = new Uint8Array(size);
+    while (pbegin !== pend) {
+      let carry = source[pbegin];
+      let i = 0;
+      for (let it1 = size - 1;(carry !== 0 || i < length) && it1 !== -1; it1--, i++) {
+        carry += 256 * b58[it1] >>> 0;
+        b58[it1] = carry % BASE >>> 0;
+        carry = carry / BASE >>> 0;
+      }
+      if (carry !== 0) {
+        throw new Error("Non-zero carry");
+      }
+      length = i;
+      pbegin++;
+    }
+    let it2 = size - length;
+    while (it2 !== size && b58[it2] === 0) {
+      it2++;
+    }
+    let str = LEADER.repeat(zeroes);
+    for (;it2 < size; ++it2) {
+      str += ALPHABET.charAt(b58[it2]);
+    }
+    return str;
+  }
+  function decodeUnsafe(source) {
+    if (typeof source !== "string") {
+      throw new TypeError("Expected String");
+    }
+    if (source.length === 0) {
+      return new Uint8Array;
+    }
+    let psz = 0;
+    let zeroes = 0;
+    let length = 0;
+    while (source[psz] === LEADER) {
+      zeroes++;
+      psz++;
+    }
+    const size = (source.length - psz) * FACTOR + 1 >>> 0;
+    const b256 = new Uint8Array(size);
+    while (psz < source.length) {
+      const charCode = source.charCodeAt(psz);
+      if (charCode > 255) {
+        return;
+      }
+      let carry = BASE_MAP[charCode];
+      if (carry === 255) {
+        return;
+      }
+      let i = 0;
+      for (let it3 = size - 1;(carry !== 0 || i < length) && it3 !== -1; it3--, i++) {
+        carry += BASE * b256[it3] >>> 0;
+        b256[it3] = carry % 256 >>> 0;
+        carry = carry / 256 >>> 0;
+      }
+      if (carry !== 0) {
+        throw new Error("Non-zero carry");
+      }
+      length = i;
+      psz++;
+    }
+    let it4 = size - length;
+    while (it4 !== size && b256[it4] === 0) {
+      it4++;
+    }
+    const vch = new Uint8Array(zeroes + (size - it4));
+    let j = zeroes;
+    while (it4 !== size) {
+      vch[j++] = b256[it4++];
+    }
+    return vch;
+  }
+  function decode(string) {
+    const buffer = decodeUnsafe(string);
+    if (buffer) {
+      return buffer;
+    }
+    throw new Error("Non-base" + BASE + " character");
+  }
+  return {
+    encode,
+    decodeUnsafe,
+    decode
+  };
+}
+var esm_default = base;
+
+// ../../node_modules/bs58/src/esm/index.js
+var ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var esm_default2 = esm_default(ALPHABET);
+// ../shared-ts/src/utils/validation.ts
+function isObject(x) {
+  return x !== null && typeof x === "object";
+}
+function isString(x) {
+  return typeof x === "string";
+}
+function isBoolean(x) {
+  return typeof x === "boolean";
+}
+
+// ../shared-ts/src/utils/errors.ts
+function errorMessage(err) {
+  try {
+    if (typeof err === "string")
+      return err;
+    if (err && typeof err.message === "string") {
+      return err.message;
+    }
+    return String(err ?? "");
+  } catch {
+    return "";
+  }
+}
+function b64uField(prefix) {
+  return `${prefix}B64u`;
+}
+var SENSITIVE_ERROR_FIELD_NAMES = [
+  "nearPrivateKey",
+  "near_private_key",
+  "privateKey",
+  "private_key",
+  b64uField("seed"),
+  "seed_b64u",
+  b64uField("canonicalSeed"),
+  "canonical_seed_b64u",
+  b64uField("xClientBase"),
+  "x_client_base_b64u",
+  b64uField("clientOutputMask"),
+  "client_output_mask_b64u",
+  b64uField("clientRecoverableSecret"),
+  "client_recoverable_secret_b64u",
+  "prfOutput",
+  "prf_output",
+  "prfFirst",
+  "prf_first",
+  b64uField("prfFirst"),
+  "prf_first_b64u",
+  "prfSecond",
+  "prf_second",
+  b64uField("prfSecond"),
+  "prf_second_b64u",
+  b64uField("signingShare32"),
+  "signing_share32_b64u",
+  b64uField("clientNonceHandle"),
+  "client_nonce_handle_b64u"
+];
+function toError(e) {
+  if (e instanceof Error)
+    return e;
+  const err = new Error(errorMessage(e));
+  try {
+    const src = e;
+    if (typeof src?.name === "string")
+      err.name = src.name;
+    if (typeof src?.stack === "string")
+      err.stack = src.stack;
+    if (src && typeof src.code !== "undefined")
+      err.code = src.code;
+    if (src && typeof src.details !== "undefined")
+      err.details = src.details;
+  } catch {}
+  return err;
+}
+
+// ../shared-ts/src/utils/base64.ts
+var base64Encode = (value) => {
+  const bytes = ArrayBuffer.isView(value) ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength) : new Uint8Array(value);
+  let binary = "";
+  for (let i = 0;i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary);
+};
+var base64UrlEncode = (value) => {
+  return base64Encode(value).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+};
+
+// ../shared-ts/src/utils/secureRandomId.ts
+var DEFAULT_SECURE_RANDOM_ID_BYTES = 32;
+function secureRandomBytes(length = DEFAULT_SECURE_RANDOM_ID_BYTES, label = "secure random bytes") {
+  const byteLength = Math.max(1, Math.floor(Number(length) || 0));
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.getRandomValues !== "function") {
+    throw new Error(`WebCrypto getRandomValues is required for ${label}`);
+  }
+  return cryptoApi.getRandomValues(new Uint8Array(byteLength));
+}
+function secureRandomBase64Url(byteLength = DEFAULT_SECURE_RANDOM_ID_BYTES, label = "secure random id") {
+  return base64UrlEncode(secureRandomBytes(byteLength, label));
+}
+
+// src/core/signingEngine/uiConfirm/awaitUserConfirmation.ts
+function awaitUserConfirmationV2(promptInput, opts = {}) {
+  let prompt;
+  let requestId;
+  try {
+    prompt = normalizeConfirmPrompt(promptInput);
+    requestId = requestIdForPrompt(prompt);
+  } catch (error) {
+    return Promise.reject(new Error(`[signer-worker]: invalid confirmation prompt: ${toError(error).message}`));
+  }
+  return new Promise((resolve, reject) => {
+    const channelToken = createChannelToken(requestId);
+    let timeoutId;
+    const cleanup = () => {
+      if (timeoutId)
+        clearTimeout(timeoutId);
+      self.removeEventListener("message", onDecisionReceived);
+      if (opts.signal)
+        opts.signal.removeEventListener("abort", onAbort);
+    };
+    const onAbort = () => {
+      cleanup();
+      reject(new Error("[signer-worker]: confirmation aborted"));
+    };
+    const onDecisionReceived = (messageEvent) => {
+      const env = messageEvent?.data;
+      if (!isConfirmResponseEnvelope(env))
+        return;
+      if (!isValidUserConfirmOrigin(messageEvent))
+        return;
+      if (resolveEnvelopeRequestId(env) !== requestId)
+        return;
+      if (!isMatchingChannelToken(env, channelToken))
+        return;
+      cleanup();
+      let response;
+      try {
+        response = env.data.confirmed ? buildConfirmedWorkerConfirmationResponse({
+          requestId,
+          data: env.data
+        }) : env.data.walletSessionFailure ? {
+          request_id: requestId,
+          intent_digest: env.data.intentDigest,
+          confirmed: false,
+          registration_diagnostics: env.data.registrationDiagnostics,
+          wallet_session_failure: env.data.walletSessionFailure
+        } : {
+          request_id: requestId,
+          intent_digest: env.data.intentDigest,
+          confirmed: false,
+          registration_diagnostics: env.data.registrationDiagnostics,
+          error: env.data.error
+        };
+      } catch (error) {
+        return reject(toError(error));
+      }
+      return resolve(response);
+    };
+    self.addEventListener("message", onDecisionReceived);
+    if (opts.timeoutMs && opts.timeoutMs > 0) {
+      timeoutId = setTimeout(() => {
+        cleanup();
+        reject(new Error("[signer-worker]: confirmation timed out"));
+      }, opts.timeoutMs);
+    }
+    if (opts.signal) {
+      if (opts.signal.aborted) {
+        cleanup();
+        return reject(new Error("[signer-worker]: confirmation aborted"));
+      }
+      opts.signal.addEventListener("abort", onAbort);
+    }
+    try {
+      const promptEnvelope = {
+        type: "PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD" /* PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD */,
+        requestId,
+        channelToken,
+        data: prompt
+      };
+      self.postMessage(promptEnvelope);
+    } catch (postErr) {
+      cleanup();
+      console.error("[signer-worker][V2] postMessage failed", postErr);
+      return reject(toError(postErr));
+    }
+  });
+}
+function normalizeConfirmPrompt(input) {
+  if (!isObject(input)) {
+    throw new Error("expected an object");
+  }
+  if (input.kind === "pending_request") {
+    const requestId = normalizePromptRequestId(input.requestId);
+    const requestToken = normalizePromptRequestToken(input.requestToken);
+    return { kind: "pending_request", requestId, requestToken };
+  }
+  if (input.kind === "export_request") {
+    if (!isObject(input.request)) {
+      throw new Error("export request is missing");
+    }
+    normalizePromptRequestId(input.request.requestId);
+    return input;
+  }
+  throw new Error("unsupported prompt kind");
+}
+function requestIdForPrompt(prompt) {
+  switch (prompt.kind) {
+    case "pending_request":
+      return prompt.requestId;
+    case "export_request":
+      return normalizePromptRequestId(prompt.request.requestId);
+    default:
+      return assertNever(prompt);
+  }
+}
+function normalizePromptRequestId(value) {
+  if (!isString(value)) {
+    throw new Error("missing requestId");
+  }
+  const requestId = value.trim();
+  if (!requestId) {
+    throw new Error("missing requestId");
+  }
+  return requestId;
+}
+function normalizePromptRequestToken(value) {
+  if (!isString(value)) {
+    throw new Error("missing requestToken");
+  }
+  const requestToken = value.trim();
+  if (!requestToken) {
+    throw new Error("missing requestToken");
+  }
+  return requestToken;
+}
+function assertNever(value) {
+  throw new Error(`Unexpected confirmation prompt kind: ${String(value)}`);
+}
+function buildConfirmedWorkerConfirmationResponse(args) {
+  const nonceLeases = normalizeNonceLeaseRefs(args.data.nonceLeases);
+  const base = {
+    request_id: args.requestId,
+    confirmed: true,
+    ...args.data.intentDigest ? { intent_digest: args.data.intentDigest } : {},
+    ...args.data.credential ? { credential: args.data.credential } : {},
+    ...args.data.operationStepUpPreparation ? { operation_step_up_preparation: args.data.operationStepUpPreparation } : {},
+    ...args.data.otpCode ? { otp_code: args.data.otpCode } : {},
+    ...args.data.emailOtpChallengeId ? { email_otp_challenge_id: args.data.emailOtpChallengeId } : {},
+    ...args.data.registrationDiagnostics ? { registration_diagnostics: args.data.registrationDiagnostics } : {}
+  };
+  if (args.data.nearTransactionReadiness) {
+    if (args.data.transactionContext || nonceLeases !== undefined) {
+      throw new Error("Secure confirm NEAR readiness cannot include top-level transaction context");
+    }
+    return {
+      ...base,
+      near_transaction_readiness: args.data.nearTransactionReadiness
+    };
+  }
+  if (args.data.transactionContext) {
+    if (!nonceLeases?.length) {
+      throw new Error("Secure confirm transaction response requires nonceLeases");
+    }
+    return {
+      ...base,
+      transaction_context: args.data.transactionContext,
+      nonce_leases: nonceLeases
+    };
+  }
+  if (nonceLeases !== undefined) {
+    throw new Error("Secure confirm response nonceLeases require transactionContext");
+  }
+  return base;
+}
+function normalizeNonceLeaseRefs(value) {
+  if (value == null)
+    return;
+  if (!Array.isArray(value)) {
+    throw new Error("Invalid secure confirm response nonceLeases: expected array");
+  }
+  return value.map(normalizeNonceLeaseRef);
+}
+function normalizeNonceLeaseRef(value) {
+  if (!isObject(value)) {
+    throw new Error("Invalid secure confirm response nonceLease: expected object");
+  }
+  const leaseId = normalizeNonceLeaseString(value.leaseId, "nonceLease.leaseId");
+  const operationId = normalizeNonceLeaseString(value.operationId, "nonceLease.operationId");
+  const operationFingerprint = normalizeNonceLeaseString(value.operationFingerprint, "nonceLease.operationFingerprint");
+  const nonce = normalizeNonceLeaseString(value.nonce, "nonceLease.nonce");
+  const batchId = value.batchId == null ? undefined : normalizeNonceLeaseString(value.batchId, "nonceLease.batchId");
+  const txIndex = normalizeNonceLeaseTxIndex(value.txIndex);
+  return {
+    leaseId,
+    operationId,
+    operationFingerprint,
+    nonce,
+    ...batchId ? { batchId } : {},
+    ...txIndex !== undefined ? { txIndex } : {}
+  };
+}
+function normalizeNonceLeaseString(value, field) {
+  if (!isString(value)) {
+    throw new Error(`Invalid secure confirm response ${field}: expected string`);
+  }
+  const normalized = value.trim();
+  if (!normalized) {
+    throw new Error(`Invalid secure confirm response ${field}: expected non-empty string`);
+  }
+  return normalized;
+}
+function normalizeNonceLeaseTxIndex(value) {
+  if (value == null)
+    return;
+  if (typeof value !== "number" || !Number.isSafeInteger(value)) {
+    throw new Error("Invalid secure confirm response nonceLease.txIndex: expected safe integer");
+  }
+  return value;
+}
+function isConfirmResponseEnvelope(msg) {
+  if (!isObject(msg))
+    return false;
+  if (msg.type !== "USER_PASSKEY_CONFIRM_RESPONSE" /* USER_PASSKEY_CONFIRM_RESPONSE */)
+    return false;
+  const data = msg.data;
+  if (!isObject(data))
+    return false;
+  return isString(data.requestId) && isBoolean(data.confirmed);
+}
+function createChannelToken(requestId) {
+  const seed = String(requestId || "").trim() || "sc";
+  const randomPart = secureRandomBase64Url(32, "user confirmation channel tokens");
+  return `${seed}:${randomPart}`;
+}
+function resolveEnvelopeRequestId(env) {
+  const topLevelRequestId = isString(env.requestId) ? env.requestId.trim() : "";
+  if (topLevelRequestId) {
+    return topLevelRequestId;
+  }
+  return String(env.data.requestId || "").trim();
+}
+function isMatchingChannelToken(env, expectedChannelToken) {
+  return (normalizeOptionalNonEmptyString(env.channelToken) || "") === expectedChannelToken;
+}
+function isValidUserConfirmOrigin(messageEvent) {
+  const origin = messageEvent.origin.trim();
+  if (!origin) {
+    return true;
+  }
+  try {
+    const selfOrigin = String(self.location?.origin || "").trim();
+    return !!selfOrigin && origin === selfOrigin;
+  } catch {
+    return false;
+  }
+}
+
+// src/core/signingEngine/workerManager/workers/passkey-confirm.worker.ts
+globalThis.awaitUserConfirmationV2 = awaitUserConfirmationV2;
+function asRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function asIncomingMessage(value) {
+  const record = asRecord(value);
+  return record ? {
+    id: record.id,
+    type: record.type,
+    payload: record.payload
+  } : {};
+}
+function postUserConfirmWorkerResponse(id, payload) {
+  const response = payload.success === true ? {
+    ...typeof id === "string" && id.trim() ? { id: id.trim() } : {},
+    success: true,
+    data: payload.data
+  } : {
+    ...typeof id === "string" && id.trim() ? { id: id.trim() } : {},
+    success: false,
+    error: payload.error
+  };
+  self.postMessage(response);
+}
+function forwardUserConfirmProgressToHost(value) {
+  const envelope = asRecord(value);
+  if (envelope)
+    self.postMessage(envelope);
+}
+function parseSecureConfirmRequestPayload(value) {
+  const record = asRecord(value);
+  if (!record)
+    return null;
+  if ("request" in record)
+    return null;
+  const requestId = typeof record.requestId === "string" ? record.requestId.trim() : "";
+  return requestId ? { requestId } : null;
+}
+self.onmessage = (event) => {
+  const incoming = asIncomingMessage(event.data);
+  const eventType = incoming.type;
+  if (eventType === "USER_PASSKEY_CONFIRM_RESPONSE" /* USER_PASSKEY_CONFIRM_RESPONSE */)
+    return;
+  if (eventType === "USER_PASSKEY_CONFIRM_PROGRESS" /* USER_PASSKEY_CONFIRM_PROGRESS */) {
+    forwardUserConfirmProgressToHost(event.data);
+    return;
+  }
+  const id = incoming.id;
+  if (eventType === "PING") {
+    postUserConfirmWorkerResponse(id, { success: true, data: { ok: true } });
+    return;
+  }
+  if (eventType === "SECURE_CONFIRM_REQUEST") {
+    (async () => {
+      try {
+        const payload = asRecord(incoming.payload);
+        const request = parseSecureConfirmRequestPayload(payload);
+        if (!request) {
+          postUserConfirmWorkerResponse(id, {
+            success: false,
+            error: "Invalid SECURE_CONFIRM_REQUEST payload: missing requestId"
+          });
+          return;
+        }
+        const requestToken = typeof id === "string" ? id.trim() : "";
+        if (!requestToken) {
+          postUserConfirmWorkerResponse(id, {
+            success: false,
+            error: "Invalid SECURE_CONFIRM_REQUEST message: missing id"
+          });
+          return;
+        }
+        await awaitUserConfirmationV2({
+          kind: "pending_request",
+          requestId: request.requestId,
+          requestToken
+        });
+        postUserConfirmWorkerResponse(id, {
+          success: true,
+          data: { ok: true }
+        });
+      } catch (error) {
+        postUserConfirmWorkerResponse(id, {
+          success: false,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    })();
+    return;
+  }
+  if (typeof id === "string" && id.trim()) {
+    postUserConfirmWorkerResponse(id, {
+      success: false,
+      error: `Unsupported UserConfirm worker message type: ${String(eventType)}`
+    });
+  }
+};
+self.onerror = (error) => {
+  console.error("[passkey-confirm-worker] error:", error);
+};
+self.onunhandledrejection = (event) => {
+  console.error("[passkey-confirm-worker] Unhandled promise rejection:", event.reason);
+  event.preventDefault();
+};