@tatchi-xyz/sdk 0.16.0 → 0.17.0

package/dist/esm/sdk/{overlay-BTqPGG-o.js → overlay-ZGbucXIa.js}

@@ -1,6 +1,7 @@
 import { init_validation, isFunction } from "./validation-DtLVzHDY.js";
 import { base64Decode, base64Encode } from "./base64-DBPGuXh4.js";
 import { errorMessage, init_errors } from "./errors-D9ar28Dr.js";
+import { init_utils } from "./WebAuthnFallbacks-Bl4BTsNt.js";
 import { DEFAULT_WAIT_STATUS, init_rpc } from "./sdkSentEvents-_jrJLIhw.js";
 
 //#region src/core/NearRpcError.ts
@@ -116,6 +117,7 @@ function describeTxExecution(operationName, exec) {
 
 //#endregion
 //#region src/core/NearClient.ts
+init_utils();
 init_errors();
 init_rpc();
 init_validation();

package/dist/esm/sdk/{registration-C633u6x8.js → registration-CBiS4Ua_.js}

@@ -1,6 +1,6 @@
 import { ERROR_MESSAGES, getIntentDigest, getNearAccountId, getRegisterAccountPayload, isSerializedRegistrationCredential, isUserCancelledSecureConfirm, serializeRegistrationCredentialWithPRF, toError } from "./requestHelpers-aUKhXiEl.js";
 import "./validation-DhPPUba7.js";
-import { createConfirmSession, createConfirmTxFlowAdapters } from "./createAdapters-pNiL2KNq.js";
+import { createConfirmSession, createConfirmTxFlowAdapters } from "./createAdapters-BumKM2ft.js";
 import "./css-loader-BrMMlG4X.js";
 import "./lit-events-BKobq01K.js";
 import "./tx-tree-themes-i3It4IYY.js";
@@ -130,4 +130,4 @@ async function handleRegistrationFlow(ctx, request, worker, opts) {
 
 //#endregion
 export { handleRegistrationFlow };
-//# sourceMappingURL=registration-C633u6x8.js.map
+//# sourceMappingURL=registration-CBiS4Ua_.js.map

package/dist/esm/sdk/{registration-C633u6x8.js.map → registration-CBiS4Ua_.js.map}

@@ -1 +1 @@
-{"version":3,"file":"registration-C633u6x8.js","names":["uiVrfChallenge: VRFChallenge","credential: PublicKeyCredential | undefined","e: unknown","serialized: WebAuthnRegistrationCredential","err: unknown"],"sources":["../../../src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/flows/registration.ts"],"sourcesContent":["import type { VrfWorkerManagerContext } from '../../';\nimport type { ConfirmationConfig } from '../../../../types/signer-worker';\nimport {\n  TransactionSummary,\n  RegistrationSecureConfirmRequest,\n} from '../types';\nimport { VRFChallenge, TransactionContext } from '../../../../types';\nimport type { WebAuthnRegistrationCredential } from '../../../../types/webauthn';\nimport {\n  getNearAccountId,\n  getIntentDigest,\n  isUserCancelledSecureConfirm,\n  ERROR_MESSAGES,\n  getRegisterAccountPayload,\n} from './index';\nimport { isSerializedRegistrationCredential, serializeRegistrationCredentialWithPRF } from '../../../credentialsHelpers';\nimport { toError } from '../../../../../utils/errors';\nimport { createConfirmSession } from '../adapters/session';\nimport { createConfirmTxFlowAdapters } from '../adapters/createAdapters';\n\nexport async function handleRegistrationFlow(\n  ctx: VrfWorkerManagerContext,\n  request: RegistrationSecureConfirmRequest,\n  worker: Worker,\n  opts: { confirmationConfig: ConfirmationConfig; transactionSummary: TransactionSummary },\n): Promise<void> {\n\n  const { confirmationConfig, transactionSummary } = opts;\n  const adapters = createConfirmTxFlowAdapters(ctx);\n  const session = createConfirmSession({\n    adapters,\n    worker,\n    request,\n    confirmationConfig,\n    transactionSummary,\n  });\n  const nearAccountId = getNearAccountId(request);\n\n  console.debug('[RegistrationFlow] start', {\n    nearAccountId,\n    uiMode: confirmationConfig?.uiMode,\n    behavior: confirmationConfig?.behavior,\n    theme: confirmationConfig?.theme,\n    intentDigest: transactionSummary?.intentDigest,\n  });\n\n  // 1) NEAR context\n  const nearRpc = await adapters.near.fetchNearContext({ nearAccountId, txCount: 1, reserveNonces: true });\n  if (nearRpc.error && !nearRpc.transactionContext) {\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: `${ERROR_MESSAGES.nearRpcFailed}: ${nearRpc.details}`,\n    });\n  }\n  const transactionContext = nearRpc.transactionContext as TransactionContext;\n  session.setReservedNonces(nearRpc.reservedNonces);\n\n  // 2) Initial VRF challenge via bootstrap\n  const rpId = adapters.vrf.getRpId();\n  const bootstrap = await adapters.vrf.generateVrfKeypairBootstrap({\n    vrfInputData: {\n      userId: nearAccountId,\n      rpId,\n      blockHeight: transactionContext.txBlockHeight,\n      blockHash: transactionContext.txBlockHash,\n    },\n    saveInMemory: true,\n    sessionId: request.requestId,\n  });\n  let uiVrfChallenge: VRFChallenge = bootstrap.vrfChallenge;\n  console.debug('[RegistrationFlow] VRF bootstrap ok', { blockHeight: uiVrfChallenge.blockHeight });\n\n  // 3) UI confirm\n  const { confirmed, error: uiError } = await session.promptUser({ vrfChallenge: uiVrfChallenge });\n  if (!confirmed) {\n    console.debug('[RegistrationFlow] user cancelled');\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: uiError,\n    });\n  }\n\n  // 4) JIT refresh VRF (best-effort)\n  try {\n    const refreshed = await adapters.vrf.maybeRefreshVrfChallenge(request, nearAccountId);\n    uiVrfChallenge = refreshed.vrfChallenge;\n    session.updateUI({ vrfChallenge: uiVrfChallenge });\n    console.debug('[RegistrationFlow] VRF JIT refresh ok', { blockHeight: uiVrfChallenge.blockHeight });\n  } catch (e) {\n    console.debug('[RegistrationFlow] VRF JIT refresh skipped', e);\n  }\n\n  // 5) Collect registration credentials (with duplicate retry)\n  let credential: PublicKeyCredential | undefined;\n  let deviceNumber = request.payload?.deviceNumber;\n\n  const tryCreate = async (dn?: number): Promise<PublicKeyCredential> => {\n    console.debug('[RegistrationFlow] navigator.credentials.create start', { deviceNumber: dn });\n    return await adapters.webauthn.createRegistrationCredential({\n      nearAccountId,\n      challenge: uiVrfChallenge,\n      deviceNumber: dn,\n    });\n  };\n\n  try {\n    try {\n      credential = await tryCreate(deviceNumber);\n      console.debug('[RegistrationFlow] credentials.create ok');\n    } catch (e: unknown) {\n      const err = toError(e);\n      const name = String(err?.name || '');\n      const msg = String(err?.message || '');\n      const isDuplicate = name === 'InvalidStateError' || /excluded|already\\s*registered/i.test(msg);\n      if (isDuplicate) {\n        const nextDeviceNumber = (deviceNumber !== undefined && Number.isFinite(deviceNumber)) ? (deviceNumber + 1) : 2;\n        console.debug('[RegistrationFlow] duplicate credential, retry with next deviceNumber', { nextDeviceNumber });\n        credential = await tryCreate(nextDeviceNumber);\n        getRegisterAccountPayload(request).deviceNumber = nextDeviceNumber;\n      } else {\n        console.error('[RegistrationFlow] credentials.create failed (non-duplicate)', { name, msg });\n        throw err;\n      }\n    }\n\n    // We require registration credentials to include dual PRF outputs (first + second)\n    // so VRF/NEAR key derivation can happen inside the workers without passing PRF outputs\n    // as separate main-thread values.\n    const serialized: WebAuthnRegistrationCredential = isSerializedRegistrationCredential(credential as unknown)\n      ? (credential as unknown as WebAuthnRegistrationCredential)\n      : serializeRegistrationCredentialWithPRF({\n          credential: credential! as PublicKeyCredential,\n          firstPrfOutput: true,\n          secondPrfOutput: true,\n    });\n\n    // 6) Respond + close\n    session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: true,\n      credential: serialized,\n      // PRF outputs are embedded in serialized credential; VRF worker extracts and sends via MessagePort\n      vrfChallenge: uiVrfChallenge,\n      transactionContext,\n    });\n\n  } catch (err: unknown) {\n    const cancelled = isUserCancelledSecureConfirm(err);\n    const msg = String((toError(err))?.message || err || '');\n    // For missing PRF outputs, surface the error to caller (defensive path tests expect a throw)\n    if (/Missing PRF result/i.test(msg) || /Missing PRF results/i.test(msg)) {\n      return session.cleanupAndRethrow(err);\n    }\n    if (cancelled) {\n      window.parent?.postMessage({ type: 'WALLET_UI_CLOSED' }, '*');\n    }\n\n    const isPrfBrowserUnsupported =\n      /WebAuthn PRF output is missing from navigator\\.credentials\\.create\\(\\)/i.test(msg)\n      || /does not fully support the WebAuthn PRF extension during registration/i.test(msg)\n      || /roaming hardware authenticators .* not supported in this flow/i.test(msg);\n\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: cancelled\n        ? ERROR_MESSAGES.cancelled\n        : (isPrfBrowserUnsupported ? msg : ERROR_MESSAGES.collectCredentialsFailed),\n    });\n  }\n}\n"],"mappings":";;;;;;;;AAoBA,eAAsB,uBACpB,KACA,SACA,QACA,MACe;CAEf,MAAM,EAAE,oBAAoB,uBAAuB;CACnD,MAAM,WAAW,4BAA4B;CAC7C,MAAM,UAAU,qBAAqB;EACnC;EACA;EACA;EACA;EACA;;CAEF,MAAM,gBAAgB,iBAAiB;AAEvC,SAAQ,MAAM,4BAA4B;EACxC;EACA,QAAQ,oBAAoB;EAC5B,UAAU,oBAAoB;EAC9B,OAAO,oBAAoB;EAC3B,cAAc,oBAAoB;;CAIpC,MAAM,UAAU,MAAM,SAAS,KAAK,iBAAiB;EAAE;EAAe,SAAS;EAAG,eAAe;;AACjG,KAAI,QAAQ,SAAS,CAAC,QAAQ,mBAC5B,QAAO,QAAQ,qBAAqB;EAClC,WAAW,QAAQ;EACnB,cAAc,gBAAgB;EAC9B,WAAW;EACX,OAAO,GAAG,eAAe,cAAc,IAAI,QAAQ;;CAGvD,MAAM,qBAAqB,QAAQ;AACnC,SAAQ,kBAAkB,QAAQ;CAGlC,MAAM,OAAO,SAAS,IAAI;CAC1B,MAAM,YAAY,MAAM,SAAS,IAAI,4BAA4B;EAC/D,cAAc;GACZ,QAAQ;GACR;GACA,aAAa,mBAAmB;GAChC,WAAW,mBAAmB;;EAEhC,cAAc;EACd,WAAW,QAAQ;;CAErB,IAAIA,iBAA+B,UAAU;AAC7C,SAAQ,MAAM,uCAAuC,EAAE,aAAa,eAAe;CAGnF,MAAM,EAAE,WAAW,OAAO,YAAY,MAAM,QAAQ,WAAW,EAAE,cAAc;AAC/E,KAAI,CAAC,WAAW;AACd,UAAQ,MAAM;AACd,SAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO;;;AAKX,KAAI;EACF,MAAM,YAAY,MAAM,SAAS,IAAI,yBAAyB,SAAS;AACvE,mBAAiB,UAAU;AAC3B,UAAQ,SAAS,EAAE,cAAc;AACjC,UAAQ,MAAM,yCAAyC,EAAE,aAAa,eAAe;UAC9E,GAAG;AACV,UAAQ,MAAM,8CAA8C;;CAI9D,IAAIC;CACJ,IAAI,eAAe,QAAQ,SAAS;CAEpC,MAAM,YAAY,OAAO,OAA8C;AACrE,UAAQ,MAAM,yDAAyD,EAAE,cAAc;AACvF,SAAO,MAAM,SAAS,SAAS,6BAA6B;GAC1D;GACA,WAAW;GACX,cAAc;;;AAIlB,KAAI;AACF,MAAI;AACF,gBAAa,MAAM,UAAU;AAC7B,WAAQ,MAAM;WACPC,GAAY;GACnB,MAAM,MAAM,QAAQ;GACpB,MAAM,OAAO,OAAO,KAAK,QAAQ;GACjC,MAAM,MAAM,OAAO,KAAK,WAAW;GACnC,MAAM,cAAc,SAAS,uBAAuB,iCAAiC,KAAK;AAC1F,OAAI,aAAa;IACf,MAAM,mBAAoB,iBAAiB,UAAa,OAAO,SAAS,gBAAkB,eAAe,IAAK;AAC9G,YAAQ,MAAM,yEAAyE,EAAE;AACzF,iBAAa,MAAM,UAAU;AAC7B,8BAA0B,SAAS,eAAe;UAC7C;AACL,YAAQ,MAAM,gEAAgE;KAAE;KAAM;;AACtF,UAAM;;;EAOV,MAAMC,aAA6C,mCAAmC,cACjF,aACD,uCAAuC;GACzB;GACZ,gBAAgB;GAChB,iBAAiB;;AAIvB,UAAQ,qBAAqB;GAC3B,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,YAAY;GAEZ,cAAc;GACd;;UAGKC,KAAc;EACrB,MAAM,YAAY,6BAA6B;EAC/C,MAAM,MAAM,OAAQ,QAAQ,MAAO,WAAW,OAAO;AAErD,MAAI,sBAAsB,KAAK,QAAQ,uBAAuB,KAAK,KACjE,QAAO,QAAQ,kBAAkB;AAEnC,MAAI,UACF,QAAO,QAAQ,YAAY,EAAE,MAAM,sBAAsB;EAG3D,MAAM,0BACJ,0EAA0E,KAAK,QAC5E,yEAAyE,KAAK,QAC9E,iEAAiE,KAAK;AAE3E,SAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO,YACH,eAAe,YACd,0BAA0B,MAAM,eAAe"}
+{"version":3,"file":"registration-CBiS4Ua_.js","names":["uiVrfChallenge: VRFChallenge","credential: PublicKeyCredential | undefined","e: unknown","serialized: WebAuthnRegistrationCredential","err: unknown"],"sources":["../../../src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/flows/registration.ts"],"sourcesContent":["import type { VrfWorkerManagerContext } from '../../';\nimport type { ConfirmationConfig } from '../../../../types/signer-worker';\nimport {\n  TransactionSummary,\n  RegistrationSecureConfirmRequest,\n} from '../types';\nimport { VRFChallenge, TransactionContext } from '../../../../types';\nimport type { WebAuthnRegistrationCredential } from '../../../../types/webauthn';\nimport {\n  getNearAccountId,\n  getIntentDigest,\n  isUserCancelledSecureConfirm,\n  ERROR_MESSAGES,\n  getRegisterAccountPayload,\n} from './index';\nimport { isSerializedRegistrationCredential, serializeRegistrationCredentialWithPRF } from '../../../credentialsHelpers';\nimport { toError } from '../../../../../utils/errors';\nimport { createConfirmSession } from '../adapters/session';\nimport { createConfirmTxFlowAdapters } from '../adapters/createAdapters';\n\nexport async function handleRegistrationFlow(\n  ctx: VrfWorkerManagerContext,\n  request: RegistrationSecureConfirmRequest,\n  worker: Worker,\n  opts: { confirmationConfig: ConfirmationConfig; transactionSummary: TransactionSummary },\n): Promise<void> {\n\n  const { confirmationConfig, transactionSummary } = opts;\n  const adapters = createConfirmTxFlowAdapters(ctx);\n  const session = createConfirmSession({\n    adapters,\n    worker,\n    request,\n    confirmationConfig,\n    transactionSummary,\n  });\n  const nearAccountId = getNearAccountId(request);\n\n  console.debug('[RegistrationFlow] start', {\n    nearAccountId,\n    uiMode: confirmationConfig?.uiMode,\n    behavior: confirmationConfig?.behavior,\n    theme: confirmationConfig?.theme,\n    intentDigest: transactionSummary?.intentDigest,\n  });\n\n  // 1) NEAR context\n  const nearRpc = await adapters.near.fetchNearContext({ nearAccountId, txCount: 1, reserveNonces: true });\n  if (nearRpc.error && !nearRpc.transactionContext) {\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: `${ERROR_MESSAGES.nearRpcFailed}: ${nearRpc.details}`,\n    });\n  }\n  const transactionContext = nearRpc.transactionContext as TransactionContext;\n  session.setReservedNonces(nearRpc.reservedNonces);\n\n  // 2) Initial VRF challenge via bootstrap\n  const rpId = adapters.vrf.getRpId();\n  const bootstrap = await adapters.vrf.generateVrfKeypairBootstrap({\n    vrfInputData: {\n      userId: nearAccountId,\n      rpId,\n      blockHeight: transactionContext.txBlockHeight,\n      blockHash: transactionContext.txBlockHash,\n    },\n    saveInMemory: true,\n    sessionId: request.requestId,\n  });\n  let uiVrfChallenge: VRFChallenge = bootstrap.vrfChallenge;\n  console.debug('[RegistrationFlow] VRF bootstrap ok', { blockHeight: uiVrfChallenge.blockHeight });\n\n  // 3) UI confirm\n  const { confirmed, error: uiError } = await session.promptUser({ vrfChallenge: uiVrfChallenge });\n  if (!confirmed) {\n    console.debug('[RegistrationFlow] user cancelled');\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: uiError,\n    });\n  }\n\n  // 4) JIT refresh VRF (best-effort)\n  try {\n    const refreshed = await adapters.vrf.maybeRefreshVrfChallenge(request, nearAccountId);\n    uiVrfChallenge = refreshed.vrfChallenge;\n    session.updateUI({ vrfChallenge: uiVrfChallenge });\n    console.debug('[RegistrationFlow] VRF JIT refresh ok', { blockHeight: uiVrfChallenge.blockHeight });\n  } catch (e) {\n    console.debug('[RegistrationFlow] VRF JIT refresh skipped', e);\n  }\n\n  // 5) Collect registration credentials (with duplicate retry)\n  let credential: PublicKeyCredential | undefined;\n  let deviceNumber = request.payload?.deviceNumber;\n\n  const tryCreate = async (dn?: number): Promise<PublicKeyCredential> => {\n    console.debug('[RegistrationFlow] navigator.credentials.create start', { deviceNumber: dn });\n    return await adapters.webauthn.createRegistrationCredential({\n      nearAccountId,\n      challenge: uiVrfChallenge,\n      deviceNumber: dn,\n    });\n  };\n\n  try {\n    try {\n      credential = await tryCreate(deviceNumber);\n      console.debug('[RegistrationFlow] credentials.create ok');\n    } catch (e: unknown) {\n      const err = toError(e);\n      const name = String(err?.name || '');\n      const msg = String(err?.message || '');\n      const isDuplicate = name === 'InvalidStateError' || /excluded|already\\s*registered/i.test(msg);\n      if (isDuplicate) {\n        const nextDeviceNumber = (deviceNumber !== undefined && Number.isFinite(deviceNumber)) ? (deviceNumber + 1) : 2;\n        console.debug('[RegistrationFlow] duplicate credential, retry with next deviceNumber', { nextDeviceNumber });\n        credential = await tryCreate(nextDeviceNumber);\n        getRegisterAccountPayload(request).deviceNumber = nextDeviceNumber;\n      } else {\n        console.error('[RegistrationFlow] credentials.create failed (non-duplicate)', { name, msg });\n        throw err;\n      }\n    }\n\n    // We require registration credentials to include dual PRF outputs (first + second)\n    // so VRF/NEAR key derivation can happen inside the workers without passing PRF outputs\n    // as separate main-thread values.\n    const serialized: WebAuthnRegistrationCredential = isSerializedRegistrationCredential(credential as unknown)\n      ? (credential as unknown as WebAuthnRegistrationCredential)\n      : serializeRegistrationCredentialWithPRF({\n          credential: credential! as PublicKeyCredential,\n          firstPrfOutput: true,\n          secondPrfOutput: true,\n    });\n\n    // 6) Respond + close\n    session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: true,\n      credential: serialized,\n      // PRF outputs are embedded in serialized credential; VRF worker extracts and sends via MessagePort\n      vrfChallenge: uiVrfChallenge,\n      transactionContext,\n    });\n\n  } catch (err: unknown) {\n    const cancelled = isUserCancelledSecureConfirm(err);\n    const msg = String((toError(err))?.message || err || '');\n    // For missing PRF outputs, surface the error to caller (defensive path tests expect a throw)\n    if (/Missing PRF result/i.test(msg) || /Missing PRF results/i.test(msg)) {\n      return session.cleanupAndRethrow(err);\n    }\n    if (cancelled) {\n      window.parent?.postMessage({ type: 'WALLET_UI_CLOSED' }, '*');\n    }\n\n    const isPrfBrowserUnsupported =\n      /WebAuthn PRF output is missing from navigator\\.credentials\\.create\\(\\)/i.test(msg)\n      || /does not fully support the WebAuthn PRF extension during registration/i.test(msg)\n      || /roaming hardware authenticators .* not supported in this flow/i.test(msg);\n\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: cancelled\n        ? ERROR_MESSAGES.cancelled\n        : (isPrfBrowserUnsupported ? msg : ERROR_MESSAGES.collectCredentialsFailed),\n    });\n  }\n}\n"],"mappings":";;;;;;;;AAoBA,eAAsB,uBACpB,KACA,SACA,QACA,MACe;CAEf,MAAM,EAAE,oBAAoB,uBAAuB;CACnD,MAAM,WAAW,4BAA4B;CAC7C,MAAM,UAAU,qBAAqB;EACnC;EACA;EACA;EACA;EACA;;CAEF,MAAM,gBAAgB,iBAAiB;AAEvC,SAAQ,MAAM,4BAA4B;EACxC;EACA,QAAQ,oBAAoB;EAC5B,UAAU,oBAAoB;EAC9B,OAAO,oBAAoB;EAC3B,cAAc,oBAAoB;;CAIpC,MAAM,UAAU,MAAM,SAAS,KAAK,iBAAiB;EAAE;EAAe,SAAS;EAAG,eAAe;;AACjG,KAAI,QAAQ,SAAS,CAAC,QAAQ,mBAC5B,QAAO,QAAQ,qBAAqB;EAClC,WAAW,QAAQ;EACnB,cAAc,gBAAgB;EAC9B,WAAW;EACX,OAAO,GAAG,eAAe,cAAc,IAAI,QAAQ;;CAGvD,MAAM,qBAAqB,QAAQ;AACnC,SAAQ,kBAAkB,QAAQ;CAGlC,MAAM,OAAO,SAAS,IAAI;CAC1B,MAAM,YAAY,MAAM,SAAS,IAAI,4BAA4B;EAC/D,cAAc;GACZ,QAAQ;GACR;GACA,aAAa,mBAAmB;GAChC,WAAW,mBAAmB;;EAEhC,cAAc;EACd,WAAW,QAAQ;;CAErB,IAAIA,iBAA+B,UAAU;AAC7C,SAAQ,MAAM,uCAAuC,EAAE,aAAa,eAAe;CAGnF,MAAM,EAAE,WAAW,OAAO,YAAY,MAAM,QAAQ,WAAW,EAAE,cAAc;AAC/E,KAAI,CAAC,WAAW;AACd,UAAQ,MAAM;AACd,SAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO;;;AAKX,KAAI;EACF,MAAM,YAAY,MAAM,SAAS,IAAI,yBAAyB,SAAS;AACvE,mBAAiB,UAAU;AAC3B,UAAQ,SAAS,EAAE,cAAc;AACjC,UAAQ,MAAM,yCAAyC,EAAE,aAAa,eAAe;UAC9E,GAAG;AACV,UAAQ,MAAM,8CAA8C;;CAI9D,IAAIC;CACJ,IAAI,eAAe,QAAQ,SAAS;CAEpC,MAAM,YAAY,OAAO,OAA8C;AACrE,UAAQ,MAAM,yDAAyD,EAAE,cAAc;AACvF,SAAO,MAAM,SAAS,SAAS,6BAA6B;GAC1D;GACA,WAAW;GACX,cAAc;;;AAIlB,KAAI;AACF,MAAI;AACF,gBAAa,MAAM,UAAU;AAC7B,WAAQ,MAAM;WACPC,GAAY;GACnB,MAAM,MAAM,QAAQ;GACpB,MAAM,OAAO,OAAO,KAAK,QAAQ;GACjC,MAAM,MAAM,OAAO,KAAK,WAAW;GACnC,MAAM,cAAc,SAAS,uBAAuB,iCAAiC,KAAK;AAC1F,OAAI,aAAa;IACf,MAAM,mBAAoB,iBAAiB,UAAa,OAAO,SAAS,gBAAkB,eAAe,IAAK;AAC9G,YAAQ,MAAM,yEAAyE,EAAE;AACzF,iBAAa,MAAM,UAAU;AAC7B,8BAA0B,SAAS,eAAe;UAC7C;AACL,YAAQ,MAAM,gEAAgE;KAAE;KAAM;;AACtF,UAAM;;;EAOV,MAAMC,aAA6C,mCAAmC,cACjF,aACD,uCAAuC;GACzB;GACZ,gBAAgB;GAChB,iBAAiB;;AAIvB,UAAQ,qBAAqB;GAC3B,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,YAAY;GAEZ,cAAc;GACd;;UAGKC,KAAc;EACrB,MAAM,YAAY,6BAA6B;EAC/C,MAAM,MAAM,OAAQ,QAAQ,MAAO,WAAW,OAAO;AAErD,MAAI,sBAAsB,KAAK,QAAQ,uBAAuB,KAAK,KACjE,QAAO,QAAQ,kBAAkB;AAEnC,MAAI,UACF,QAAO,QAAQ,YAAY,EAAE,MAAM,sBAAsB;EAG3D,MAAM,0BACJ,0EAA0E,KAAK,QAC5E,yEAAyE,KAAK,QAC9E,iEAAiE,KAAK;AAE3E,SAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO,YACH,eAAe,YACd,0BAA0B,MAAM,eAAe"}

package/dist/esm/sdk/{registration-xyYUFRqk.js → registration-DLPLsGCz.js}

@@ -7,13 +7,14 @@ import "./txDigest-CxjhSCgm.js";
 import "./base64-DBPGuXh4.js";
 import "./actions-O1FD5Bq8.js";
 import "./lit-events-C-jpeT5r.js";
-import "./tx-confirmer-wrapper-CqfVBUaA.js";
+import "./tx-confirmer-wrapper-lHNgz9i4.js";
 import { init_errors, toError } from "./errors-D9ar28Dr.js";
-import { isSerializedRegistrationCredential, serializeRegistrationCredentialWithPRF } from "./safari-fallbacks-oQKu9xUs.js";
-import { ERROR_MESSAGES, getIntentDigest, getNearAccountId, getRegisterAccountPayload, isUserCancelledSecureConfirm } from "./requestHelpers-DLBGBHMw.js";
-import { createConfirmSession, createConfirmTxFlowAdapters } from "./createAdapters-BWLe9Ddo.js";
+import { init_credentialsHelpers, isSerializedRegistrationCredential, serializeRegistrationCredentialWithPRF } from "./WebAuthnFallbacks-Bl4BTsNt.js";
+import { ERROR_MESSAGES, getIntentDigest, getNearAccountId, getRegisterAccountPayload, isUserCancelledSecureConfirm } from "./requestHelpers-Dh1hEYL9.js";
+import { createConfirmSession, createConfirmTxFlowAdapters } from "./createAdapters-qVGD6i0g.js";
 
 //#region src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/flows/registration.ts
+init_credentialsHelpers();
 init_errors();
 async function handleRegistrationFlow(ctx, request, worker, opts) {
 	const { confirmationConfig, transactionSummary } = opts;

package/dist/esm/sdk/{requestHelpers-DLBGBHMw.js → requestHelpers-Dh1hEYL9.js}

@@ -2,7 +2,7 @@ import { __esm } from "./chunk-DIQ1yeMN.js";
 import { init_validation, isFunction, isObject, isString } from "./validation-DtLVzHDY.js";
 import { base64UrlDecode, base64UrlEncode } from "./base64-DBPGuXh4.js";
 import { init_encoders, init_errors, isTouchIdCancellationError, toError } from "./errors-D9ar28Dr.js";
-import { executeWebAuthnWithParentFallbacksSafari, generateChaCha20Salt, generateEd25519Salt, init_validation as init_validation$1, serializeAuthenticationCredentialWithPRF, validateNearAccountId } from "./safari-fallbacks-oQKu9xUs.js";
+import { executeWebAuthnWithParentFallbacksSafari, generateChaCha20Salt, generateEd25519Salt, init_WebAuthnFallbacks, init_credentialsHelpers, init_validation as init_validation$1, serializeAuthenticationCredentialWithPRF, validateNearAccountId } from "./WebAuthnFallbacks-Bl4BTsNt.js";
 
 //#region src/core/types/accountIds.ts
 /**
@@ -20,7 +20,6 @@ var init_accountIds = __esm({ "src/core/types/accountIds.ts": (() => {
 
 //#endregion
 //#region src/core/types/vrf-worker.ts
-init_encoders();
 /**
 * Decode VRF output and use first 32 bytes as WebAuthn challenge
 * @param vrfChallenge - VRF challenge object
@@ -74,10 +73,12 @@ function createRandomVRFChallenge() {
 		blockHash: void 0
 	};
 }
+var init_vrf_worker = __esm({ "src/core/types/vrf-worker.ts": (() => {
+	init_encoders();
+}) });
 
 //#endregion
 //#region src/core/WebAuthnManager/touchIdPrompt.ts
-init_encoders();
 function isRegistrableSuffix(host, cand) {
 	if (!host || !cand) return false;
 	if (host === cand) return true;
@@ -96,184 +97,6 @@ function authenticatorsToAllowCredentials(authenticators) {
 		transports: auth.transports
 	}));
 }
-/**
-* TouchIdPrompt prompts for touchID,
-* creates credentials,
-* manages WebAuthn touchID prompts,
-* and generates credentials, and PRF Outputs
-*/
-var TouchIdPrompt = class TouchIdPrompt {
-	rpIdOverride;
-	safariGetWebauthnRegistrationFallback;
-	abortController;
-	removePageAbortHandlers;
-	removeExternalAbortListener;
-	constructor(rpIdOverride, safariGetWebauthnRegistrationFallback = false) {
-		this.rpIdOverride = rpIdOverride;
-		this.safariGetWebauthnRegistrationFallback = safariGetWebauthnRegistrationFallback === true;
-	}
-	getRpId() {
-		try {
-			return resolveRpId(this.rpIdOverride, window?.location?.hostname);
-		} catch {
-			return this.rpIdOverride || "";
-		}
-	}
-	static _inIframe() {
-		try {
-			return window.self !== window.top;
-		} catch {
-			return true;
-		}
-	}
-	/**
-	* Get authentication credentials
-	* @param nearAccountId - NEAR account ID to authenticate
-	* @param challenge - VRF challenge bytes
-	* @param allowCredentials - Array of allowed credentials for authentication
-	* @returns WebAuthn credential with only the first PRF output
-	*/
-	async getAuthenticationCredentialsSerialized({ nearAccountId, challenge, allowCredentials }) {
-		const credentialMaybe = await this.getAuthenticationCredentialsInternal({
-			nearAccountId,
-			challenge,
-			allowCredentials
-		});
-		if (isSerializedAuthenticationCredential(credentialMaybe)) return credentialMaybe;
-		return serializeAuthenticationCredentialWithPRF({
-			credential: credentialMaybe,
-			firstPrfOutput: true,
-			secondPrfOutput: false
-		});
-	}
-	/**
-	*  Same as getAuthenticationCredentialsSerialized but returns both PRF outputs
-	*  (PRF.first + PRF.second).
-	* @param nearAccountId - NEAR account ID to authenticate
-	* @param challenge - VRF challenge bytes
-	* @param allowCredentials - Array of allowed credentials for authentication
-	* @returns
-	*/
-	async getAuthenticationCredentialsSerializedDualPrf({ nearAccountId, challenge, allowCredentials }) {
-		const credentialMaybe = await this.getAuthenticationCredentialsInternal({
-			nearAccountId,
-			challenge,
-			allowCredentials
-		});
-		if (isSerializedAuthenticationCredential(credentialMaybe)) return credentialMaybe;
-		return serializeAuthenticationCredentialWithPRF({
-			credential: credentialMaybe,
-			firstPrfOutput: true,
-			secondPrfOutput: true
-		});
-	}
-	/**
-	* Internal method for generating WebAuthn registration credentials with PRF output
-	* @param nearAccountId - NEAR account ID for PRF salts and keypair derivation (always base account)
-	* @param challenge - Random challenge bytes for the registration ceremony
-	* @param deviceNumber - Device number for device-specific user ID.
-	* @returns Credential with PRF output
-	*/
-	async generateRegistrationCredentialsInternal({ nearAccountId, challenge, deviceNumber }) {
-		this.abortController = new AbortController();
-		this.removePageAbortHandlers = TouchIdPrompt.attachPageAbortHandlers(this.abortController);
-		const rpId = this.getRpId();
-		const publicKey = {
-			challenge: outputAs32Bytes(challenge),
-			rp: {
-				name: "WebAuthn VRF Passkey",
-				id: rpId
-			},
-			user: {
-				id: new TextEncoder().encode(generateDeviceSpecificUserId(nearAccountId, deviceNumber)),
-				name: generateDeviceSpecificUserId(nearAccountId, deviceNumber),
-				displayName: generateUserFriendlyDisplayName(nearAccountId, deviceNumber)
-			},
-			pubKeyCredParams: [{
-				alg: -7,
-				type: "public-key"
-			}, {
-				alg: -257,
-				type: "public-key"
-			}],
-			authenticatorSelection: {
-				residentKey: "required",
-				userVerification: "preferred"
-			},
-			timeout: 6e4,
-			attestation: "none",
-			extensions: { prf: { eval: {
-				first: generateChaCha20Salt(nearAccountId),
-				second: generateEd25519Salt(nearAccountId)
-			} } }
-		};
-		try {
-			const result = await executeWebAuthnWithParentFallbacksSafari("create", publicKey, {
-				rpId,
-				inIframe: TouchIdPrompt._inIframe(),
-				timeoutMs: publicKey.timeout,
-				abortSignal: this.abortController.signal
-			});
-			return result;
-		} finally {
-			this.removePageAbortHandlers?.();
-			this.removePageAbortHandlers = void 0;
-			this.removeExternalAbortListener?.();
-			this.removeExternalAbortListener = void 0;
-			this.abortController = void 0;
-		}
-	}
-	/**
-	* Internal method for getting WebAuthn authentication credentials with PRF output
-	* @param nearAccountId - NEAR account ID to authenticate
-	* @param challenge - VRF challenge bytes to use for WebAuthn authentication
-	* @param authenticators - List of stored authenticator data for the user
-	* @returns WebAuthn credential with PRF output (HKDF derivation done in WASM worker)
-	* ```ts
-	* const credential = await touchIdPrompt.getCredentials({
-	*   nearAccountId,
-	*   challenge,
-	*   authenticators,
-	* });
-	* ```
-	*/
-	async getAuthenticationCredentialsInternal({ nearAccountId, challenge, allowCredentials }) {
-		this.abortController = new AbortController();
-		this.removePageAbortHandlers = TouchIdPrompt.attachPageAbortHandlers(this.abortController);
-		const rpId = this.getRpId();
-		const publicKey = {
-			challenge: outputAs32Bytes(challenge),
-			rpId,
-			allowCredentials: allowCredentials.map((credential) => ({
-				id: base64UrlDecode(credential.id),
-				type: "public-key",
-				transports: credential.transports
-			})),
-			userVerification: "preferred",
-			timeout: 6e4,
-			extensions: { prf: { eval: {
-				first: generateChaCha20Salt(nearAccountId),
-				second: generateEd25519Salt(nearAccountId)
-			} } }
-		};
-		try {
-			const result = await executeWebAuthnWithParentFallbacksSafari("get", publicKey, {
-				rpId,
-				inIframe: TouchIdPrompt._inIframe(),
-				timeoutMs: publicKey.timeout,
-				permitGetBridgeOnAncestorError: this.safariGetWebauthnRegistrationFallback,
-				abortSignal: this.abortController.signal
-			});
-			return result;
-		} finally {
-			this.removePageAbortHandlers?.();
-			this.removePageAbortHandlers = void 0;
-			this.removeExternalAbortListener?.();
-			this.removeExternalAbortListener = void 0;
-			this.abortController = void 0;
-		}
-	}
-};
 function isSerializedAuthenticationCredential(x) {
 	if (!x || typeof x !== "object") return false;
 	const obj = x;
@@ -311,28 +134,207 @@ function generateUserFriendlyDisplayName(nearAccountId, deviceNumber) {
 	if (deviceNumber === void 0 || deviceNumber === 1) return baseUsername;
 	return `${baseUsername} (device ${deviceNumber})`;
 }
-(function(_TouchIdPrompt) {
-	function attachPageAbortHandlers(controller) {
-		const onVisibility = () => {
-			if (document.hidden) controller.abort();
-		};
-		const onPageHide = () => {
-			controller.abort();
-		};
-		const onBeforeUnload = () => {
-			controller.abort();
-		};
-		document.addEventListener("visibilitychange", onVisibility, { passive: true });
-		window.addEventListener("pagehide", onPageHide, { passive: true });
-		window.addEventListener("beforeunload", onBeforeUnload, { passive: true });
-		return () => {
-			document.removeEventListener("visibilitychange", onVisibility);
-			window.removeEventListener("pagehide", onPageHide);
-			window.removeEventListener("beforeunload", onBeforeUnload);
-		};
-	}
-	_TouchIdPrompt.attachPageAbortHandlers = attachPageAbortHandlers;
-})(TouchIdPrompt || (TouchIdPrompt = {}));
+var TouchIdPrompt;
+var init_touchIdPrompt = __esm({ "src/core/WebAuthnManager/touchIdPrompt.ts": (() => {
+	init_encoders();
+	init_vrf_worker();
+	init_credentialsHelpers();
+	init_WebAuthnFallbacks();
+	TouchIdPrompt = class TouchIdPrompt {
+		rpIdOverride;
+		safariGetWebauthnRegistrationFallback;
+		abortController;
+		removePageAbortHandlers;
+		removeExternalAbortListener;
+		constructor(rpIdOverride, safariGetWebauthnRegistrationFallback = false) {
+			this.rpIdOverride = rpIdOverride;
+			this.safariGetWebauthnRegistrationFallback = safariGetWebauthnRegistrationFallback === true;
+		}
+		getRpId() {
+			try {
+				return resolveRpId(this.rpIdOverride, window?.location?.hostname);
+			} catch {
+				return this.rpIdOverride || "";
+			}
+		}
+		static _inIframe() {
+			try {
+				return window.self !== window.top;
+			} catch {
+				return true;
+			}
+		}
+		/**
+		* Get authentication credentials
+		* @param nearAccountId - NEAR account ID to authenticate
+		* @param challenge - VRF challenge bytes
+		* @param allowCredentials - Array of allowed credentials for authentication
+		* @returns WebAuthn credential with only the first PRF output
+		*/
+		async getAuthenticationCredentialsSerialized({ nearAccountId, challenge, allowCredentials }) {
+			const credentialMaybe = await this.getAuthenticationCredentialsInternal({
+				nearAccountId,
+				challenge,
+				allowCredentials
+			});
+			if (isSerializedAuthenticationCredential(credentialMaybe)) return credentialMaybe;
+			return serializeAuthenticationCredentialWithPRF({
+				credential: credentialMaybe,
+				firstPrfOutput: true,
+				secondPrfOutput: false
+			});
+		}
+		/**
+		*  Same as getAuthenticationCredentialsSerialized but returns both PRF outputs
+		*  (PRF.first + PRF.second).
+		* @param nearAccountId - NEAR account ID to authenticate
+		* @param challenge - VRF challenge bytes
+		* @param allowCredentials - Array of allowed credentials for authentication
+		* @returns
+		*/
+		async getAuthenticationCredentialsSerializedDualPrf({ nearAccountId, challenge, allowCredentials }) {
+			const credentialMaybe = await this.getAuthenticationCredentialsInternal({
+				nearAccountId,
+				challenge,
+				allowCredentials
+			});
+			if (isSerializedAuthenticationCredential(credentialMaybe)) return credentialMaybe;
+			return serializeAuthenticationCredentialWithPRF({
+				credential: credentialMaybe,
+				firstPrfOutput: true,
+				secondPrfOutput: true
+			});
+		}
+		/**
+		* Internal method for generating WebAuthn registration credentials with PRF output
+		* @param nearAccountId - NEAR account ID for PRF salts and keypair derivation (always base account)
+		* @param challenge - Random challenge bytes for the registration ceremony
+		* @param deviceNumber - Device number for device-specific user ID.
+		* @returns Credential with PRF output
+		*/
+		async generateRegistrationCredentialsInternal({ nearAccountId, challenge, deviceNumber }) {
+			this.abortController = new AbortController();
+			this.removePageAbortHandlers = TouchIdPrompt.attachPageAbortHandlers(this.abortController);
+			const rpId = this.getRpId();
+			const publicKey = {
+				challenge: outputAs32Bytes(challenge),
+				rp: {
+					name: "WebAuthn VRF Passkey",
+					id: rpId
+				},
+				user: {
+					id: new TextEncoder().encode(generateDeviceSpecificUserId(nearAccountId, deviceNumber)),
+					name: generateDeviceSpecificUserId(nearAccountId, deviceNumber),
+					displayName: generateUserFriendlyDisplayName(nearAccountId, deviceNumber)
+				},
+				pubKeyCredParams: [{
+					alg: -7,
+					type: "public-key"
+				}, {
+					alg: -257,
+					type: "public-key"
+				}],
+				authenticatorSelection: {
+					residentKey: "required",
+					userVerification: "preferred"
+				},
+				timeout: 6e4,
+				attestation: "none",
+				extensions: { prf: { eval: {
+					first: generateChaCha20Salt(nearAccountId),
+					second: generateEd25519Salt(nearAccountId)
+				} } }
+			};
+			try {
+				const result = await executeWebAuthnWithParentFallbacksSafari("create", publicKey, {
+					rpId,
+					inIframe: TouchIdPrompt._inIframe(),
+					timeoutMs: publicKey.timeout,
+					abortSignal: this.abortController.signal
+				});
+				return result;
+			} finally {
+				this.removePageAbortHandlers?.();
+				this.removePageAbortHandlers = void 0;
+				this.removeExternalAbortListener?.();
+				this.removeExternalAbortListener = void 0;
+				this.abortController = void 0;
+			}
+		}
+		/**
+		* Internal method for getting WebAuthn authentication credentials with PRF output
+		* @param nearAccountId - NEAR account ID to authenticate
+		* @param challenge - VRF challenge bytes to use for WebAuthn authentication
+		* @param authenticators - List of stored authenticator data for the user
+		* @returns WebAuthn credential with PRF output (HKDF derivation done in WASM worker)
+		* ```ts
+		* const credential = await touchIdPrompt.getCredentials({
+		*   nearAccountId,
+		*   challenge,
+		*   authenticators,
+		* });
+		* ```
+		*/
+		async getAuthenticationCredentialsInternal({ nearAccountId, challenge, allowCredentials }) {
+			this.abortController = new AbortController();
+			this.removePageAbortHandlers = TouchIdPrompt.attachPageAbortHandlers(this.abortController);
+			const rpId = this.getRpId();
+			const publicKey = {
+				challenge: outputAs32Bytes(challenge),
+				rpId,
+				allowCredentials: allowCredentials.map((credential) => ({
+					id: base64UrlDecode(credential.id),
+					type: "public-key",
+					transports: credential.transports
+				})),
+				userVerification: "preferred",
+				timeout: 6e4,
+				extensions: { prf: { eval: {
+					first: generateChaCha20Salt(nearAccountId),
+					second: generateEd25519Salt(nearAccountId)
+				} } }
+			};
+			try {
+				const result = await executeWebAuthnWithParentFallbacksSafari("get", publicKey, {
+					rpId,
+					inIframe: TouchIdPrompt._inIframe(),
+					timeoutMs: publicKey.timeout,
+					permitGetBridgeOnAncestorError: this.safariGetWebauthnRegistrationFallback,
+					abortSignal: this.abortController.signal
+				});
+				return result;
+			} finally {
+				this.removePageAbortHandlers?.();
+				this.removePageAbortHandlers = void 0;
+				this.removeExternalAbortListener?.();
+				this.removeExternalAbortListener = void 0;
+				this.abortController = void 0;
+			}
+		}
+	};
+	(function(_TouchIdPrompt) {
+		function attachPageAbortHandlers(controller) {
+			const onVisibility = () => {
+				if (document.hidden) controller.abort();
+			};
+			const onPageHide = () => {
+				controller.abort();
+			};
+			const onBeforeUnload = () => {
+				controller.abort();
+			};
+			document.addEventListener("visibilitychange", onVisibility, { passive: true });
+			window.addEventListener("pagehide", onPageHide, { passive: true });
+			window.addEventListener("beforeunload", onBeforeUnload, { passive: true });
+			return () => {
+				document.removeEventListener("visibilitychange", onVisibility);
+				window.removeEventListener("pagehide", onPageHide);
+				window.removeEventListener("beforeunload", onBeforeUnload);
+			};
+		}
+		_TouchIdPrompt.attachPageAbortHandlers = attachPageAbortHandlers;
+	})(TouchIdPrompt || (TouchIdPrompt = {}));
+}) });
 
 //#endregion
 //#region src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/types.ts
@@ -440,4 +442,4 @@ function getRegisterAccountPayload(request) {
 }
 
 //#endregion
-export { ERROR_MESSAGES, SecureConfirmMessageType, SecureConfirmationType, TouchIdPrompt, authenticatorsToAllowCredentials, createRandomVRFChallenge, getIntentDigest, getNearAccountId, getRegisterAccountPayload, getSignTransactionPayload, getTxCount, init_accountIds, isUserCancelledSecureConfirm, parseTransactionSummary, sanitizeForPostMessage, sendConfirmResponse, toAccountId, validateVRFChallenge };
+export { ERROR_MESSAGES, SecureConfirmMessageType, SecureConfirmationType, TouchIdPrompt, authenticatorsToAllowCredentials, createRandomVRFChallenge, getIntentDigest, getNearAccountId, getRegisterAccountPayload, getSignTransactionPayload, getTxCount, init_accountIds, init_touchIdPrompt, init_vrf_worker, isUserCancelledSecureConfirm, parseTransactionSummary, sanitizeForPostMessage, sendConfirmResponse, toAccountId, validateVRFChallenge };

package/dist/esm/sdk/{router-BG6KC_p7.js → router-BLFegW7J.js}

@@ -1,8 +1,8 @@
 import { extractBorshBytesFromPlainSignedTx, init_validation, isBoolean, isObject, isPlainSignedTransactionLike, stripFunctionsShallow } from "./validation-DtLVzHDY.js";
 import "./base64-DBPGuXh4.js";
 import { init_errors, toError } from "./errors-D9ar28Dr.js";
-import { WebAuthnBridgeMessage, serializeAuthenticationCredentialWithPRF, serializeRegistrationCredentialWithPRF } from "./safari-fallbacks-oQKu9xUs.js";
-import { SignedTransaction, openOfflineExportWindow } from "./overlay-BTqPGG-o.js";
+import { WebAuthnBridgeMessage, init_WebAuthnFallbacks, init_credentialsHelpers, serializeAuthenticationCredentialWithPRF, serializeRegistrationCredentialWithPRF } from "./WebAuthnFallbacks-Bl4BTsNt.js";
+import { SignedTransaction, openOfflineExportWindow } from "./overlay-ZGbucXIa.js";
 import { AccountRecoveryPhase, ActionPhase, DeviceLinkingPhase, EmailRecoveryPhase, LoginPhase, RegistrationPhase, init_sdkSentEvents } from "./sdkSentEvents-_jrJLIhw.js";
 
 //#region src/core/WalletIframe/client/on-events-progress-bus.ts
@@ -210,6 +210,7 @@ const defaultPhaseHeuristics = (payload) => {
 
 //#endregion
 //#region src/core/WalletIframe/client/overlay-styles.ts
+init_credentialsHelpers();
 init_validation();
 const CLASS_BASE = "w3a-wallet-overlay";
 const CLASS_HIDDEN = "is-hidden";
@@ -332,6 +333,7 @@ function setAnchored(el, rect) {
 
 //#endregion
 //#region src/core/WalletIframe/client/IframeTransport.ts
+init_WebAuthnFallbacks();
 const IframeMessage = {
 	Connect: "CONNECT",
 	Ready: "READY",
@@ -353,6 +355,13 @@ var IframeTransport = class {
 			connectTimeoutMs: 8e3,
 			...options
 		};
+		try {
+			const walletUrl = new URL(this.opts.walletOrigin);
+			if (walletUrl.protocol === "chrome-extension:") {
+				const trimmed = (this.opts.servicePath || "/wallet-service").replace(/\/+$/, "");
+				if (trimmed === "/wallet-service") this.opts.servicePath = "/wallet-service.html";
+			}
+		} catch {}
 		try {
 			this.walletServiceUrl = new URL(this.opts.servicePath, this.opts.walletOrigin);
 		} catch (err) {
@@ -1412,6 +1421,15 @@ var WalletIframeRouter = class {
 			options: { onProgress: payload.onEvent }
 		});
 	}
+	async stopEmailRecovery(payload) {
+		await this.post({
+			type: "PM_STOP_EMAIL_RECOVERY",
+			payload: {
+				accountId: payload?.accountId,
+				nearPublicKey: payload?.nearPublicKey
+			}
+		});
+	}
 	async linkDeviceWithScannedQRData(payload) {
 		this.showFrameForActivation();
 		try {

package/dist/esm/sdk/{rpcCalls-fLObBbbz.js → rpcCalls-DEv9x5-f.js}

@@ -3,8 +3,8 @@ import "./base64-DBPGuXh4.js";
 import "./actions-O1FD5Bq8.js";
 import "./errors-D9ar28Dr.js";
 import "./sdkSentEvents-_jrJLIhw.js";
-import "./defaultConfigs-VzvDejmy.js";
-import { buildSetRecoveryEmailsActions, checkCanRegisterUserContractCall, executeDeviceLinkingContractCalls, getAuthenticatorsByUser, getCredentialIdsContractCall, getDeviceLinkingAccountContractCall, getRecoveryEmailHashesContractCall, init_rpcCalls, syncAuthenticatorsContractCall, verifyAuthenticationResponse } from "./rpcCalls-CAU5XYEF.js";
+import "./defaultConfigs-DpslkAQd.js";
+import { buildSetRecoveryEmailsActions, checkCanRegisterUserContractCall, executeDeviceLinkingContractCalls, getAuthenticatorsByUser, getCredentialIdsContractCall, getDeviceLinkingAccountContractCall, getRecoveryEmailHashesContractCall, init_rpcCalls, syncAuthenticatorsContractCall, verifyAuthenticationResponse } from "./rpcCalls-OhgEeFig.js";
 
 init_rpcCalls();
 export { syncAuthenticatorsContractCall };

package/dist/esm/sdk/{rpcCalls-CAU5XYEF.js → rpcCalls-OhgEeFig.js}

@@ -3,7 +3,7 @@ import { base64UrlDecode, base64UrlEncode } from "./base64-DBPGuXh4.js";
 import { ActionType, init_actions } from "./actions-O1FD5Bq8.js";
 import { errorMessage, init_encoders, init_errors } from "./errors-D9ar28Dr.js";
 import { ActionPhase, DEFAULT_WAIT_STATUS, DeviceLinkingPhase, DeviceLinkingStatus, init_rpc, init_sdkSentEvents } from "./sdkSentEvents-_jrJLIhw.js";
-import { DEFAULT_EMAIL_RECOVERY_CONTRACTS, init_defaultConfigs } from "./defaultConfigs-VzvDejmy.js";
+import { DEFAULT_EMAIL_RECOVERY_CONTRACTS, init_defaultConfigs } from "./defaultConfigs-DpslkAQd.js";
 
 //#region src/core/rpcCalls.ts
 /**