@tatchi-xyz/sdk 0.20.0 → 0.31.0

package/dist/esm/react/src/core/TatchiPasskey/index.js

@@ -0,0 +1,1335 @@
+import { toAccountId } from "../types/accountIds.js";
+import { toError } from "../../utils/errors.js";
+import { buildConfigsFromEnv } from "../defaultConfigs.js";
+import { configureIndexedDB } from "../IndexedDBManager/index.js";
+import { MinimalNearClient } from "../NearClient.js";
+import { ActionPhase, ActionStatus, DeviceLinkingPhase } from "../types/sdkSentEvents.js";
+import { ActionType } from "../types/actions.js";
+import { DEFAULT_AUTHENTICATOR_OPTIONS } from "../types/authenticatorOptions.js";
+import { DeviceLinkingError, DeviceLinkingErrorCode } from "../types/linkDevice.js";
+import { __isWalletIframeHostMode } from "../WalletIframe/host-mode.js";
+import { WebAuthnManager } from "../WebAuthnManager/index.js";
+import { getLoginSession, getRecentLogins, loginAndCreateSession, logoutAndClearSession } from "./login.js";
+import { executeAction, sendTransaction, signAndSendTransactions, signTransactionsWithActions } from "./actions.js";
+import { registerPasskey, registerPasskeyInternal } from "./registration.js";
+import { chainsigAddressManager } from "../ChainsigAddressManager/index.js";
+import { isOffline, openOfflineExport } from "../OfflineExport/overlay.js";
+import { SyncAccountFlow } from "./syncAccount.js";
+import { ScanQRCodeFlow, ScanQRCodeFlowState } from "../../utils/qrScanner.js";
+
+//#region src/core/TatchiPasskey/index.ts
+let warnedAboutSameOriginWallet = false;
+/**
+* Main TatchiPasskey class that provides framework-agnostic passkey operations
+* with flexible event-based callbacks for custom UX implementation
+*/
+var TatchiPasskey = class {
+	webAuthnManager;
+	nearClient;
+	configs;
+	iframeRouter = null;
+	walletIframeInitInFlight = null;
+	walletIframePrefsUnsubscribe = null;
+	activeDeviceLinkFlow = null;
+	activeEmailRecoveryFlow = null;
+	constructor(configs, nearClient) {
+		this.configs = buildConfigsFromEnv(configs);
+		const mode = __isWalletIframeHostMode() ? "wallet" : this.configs.iframeWallet?.walletOrigin ? "disabled" : "legacy";
+		configureIndexedDB({ mode });
+		this.nearClient = nearClient || new MinimalNearClient(this.configs.nearRpcUrl);
+		this.webAuthnManager = new WebAuthnManager(this.configs, this.nearClient);
+		this.userPreferences.configureWalletIframeSignerModeWriter(this.shouldUseWalletIframe() ? async (next) => {
+			const router = await this.requireWalletIframeRouter();
+			await router.setSignerMode(next);
+		} : null);
+	}
+	/**
+	* Direct access to user preferences manager for convenience
+	* Example: tatchi.userPreferences.onThemeChange(cb)
+	*/
+	get userPreferences() {
+		return this.webAuthnManager.getUserPreferences();
+	}
+	/**
+	* Initialize the hidden wallet service iframe client (optional) and warm critical resources.
+	* Always warms local resources; initializes iframe when `walletOrigin` is provided.
+	* Idempotent and safe to call multiple times.
+	*/
+	async initWalletIframe(nearAccountId) {
+		const walletOriginConfigured = !!this.configs.iframeWallet?.walletOrigin;
+		const shouldAvoidLocalUserState = walletOriginConfigured && !__isWalletIframeHostMode();
+		await this.webAuthnManager.warmCriticalResources(shouldAvoidLocalUserState ? void 0 : nearAccountId);
+		if (__isWalletIframeHostMode()) return;
+		const walletIframeConfig = this.configs.iframeWallet;
+		const walletOrigin = walletIframeConfig?.walletOrigin;
+		if (!walletOrigin) {
+			await this.getLoginSession(nearAccountId);
+			return;
+		}
+		if (!warnedAboutSameOriginWallet) try {
+			const isWalletIframeHost = __isWalletIframeHostMode();
+			const parsed = new URL(walletOrigin);
+			if (typeof window !== "undefined" && parsed.origin === window.location.origin && !isWalletIframeHost) {
+				warnedAboutSameOriginWallet = true;
+				console.warn("[TatchiPasskey] iframeWallet.walletOrigin matches the host origin. Consider moving the wallet to a dedicated origin for stronger isolation.");
+			}
+		} catch {}
+		if (!this.iframeRouter) {
+			if (!this.walletIframeInitInFlight) this.walletIframeInitInFlight = (async () => {
+				const { WalletIframeRouter } = await import("../WalletIframe/client/router.js");
+				this.iframeRouter = new WalletIframeRouter({
+					walletOrigin,
+					servicePath: walletIframeConfig?.walletServicePath || "/wallet-service",
+					connectTimeoutMs: 2e4,
+					requestTimeoutMs: 6e4,
+					theme: this.configs.walletTheme,
+					signerMode: this.configs.signerMode,
+					nearRpcUrl: this.configs.nearRpcUrl,
+					nearNetwork: this.configs.nearNetwork,
+					contractId: this.configs.contractId,
+					nearExplorerUrl: this.configs.nearExplorerUrl,
+					relayer: this.configs.relayer,
+					vrfWorkerConfigs: this.configs.vrfWorkerConfigs,
+					emailRecoveryContracts: this.configs.emailRecoveryContracts,
+					rpIdOverride: walletIframeConfig?.rpIdOverride,
+					sdkBasePath: walletIframeConfig?.sdkBasePath
+				});
+				await this.iframeRouter.init();
+				try {
+					await this.iframeRouter.prefetchBlockheight();
+				} catch {}
+			})();
+			try {
+				await this.walletIframeInitInFlight;
+			} finally {
+				this.walletIframeInitInFlight = null;
+			}
+		} else {
+			await this.iframeRouter.init();
+			try {
+				await this.iframeRouter.prefetchBlockheight();
+			} catch {}
+		}
+		if (this.iframeRouter) {
+			this.ensureWalletIframePreferencesMirror(this.iframeRouter);
+			const cfg = await this.iframeRouter.getConfirmationConfig().catch(() => null);
+			if (cfg) this.userPreferences.applyWalletHostConfirmationConfig({
+				nearAccountId: nearAccountId ? toAccountId(nearAccountId) : null,
+				confirmationConfig: cfg
+			});
+			const signerMode = await this.iframeRouter.getSignerMode?.({ timeoutMs: 1e3 }).catch(() => null);
+			if (signerMode) this.userPreferences.applyWalletHostSignerMode?.({
+				nearAccountId: nearAccountId ? toAccountId(nearAccountId) : null,
+				signerMode
+			});
+		}
+		await this.getLoginSession(nearAccountId);
+	}
+	/** Get the wallet iframe client if initialized. */
+	getWalletIframeClient() {
+		return this.iframeRouter;
+	}
+	ensureWalletIframePreferencesMirror(router) {
+		if (this.walletIframePrefsUnsubscribe) return;
+		const unsubscribe = router.onPreferencesChanged?.((payload) => {
+			const id = payload?.nearAccountId;
+			const nearAccountId = id ? toAccountId(id) : null;
+			this.userPreferences.applyWalletHostConfirmationConfig({
+				nearAccountId,
+				confirmationConfig: payload?.confirmationConfig
+			});
+			if (payload?.signerMode) this.userPreferences.applyWalletHostSignerMode?.({
+				nearAccountId,
+				signerMode: payload.signerMode
+			});
+		});
+		this.walletIframePrefsUnsubscribe = unsubscribe ?? null;
+	}
+	/**
+	* True when the SDK is running on the app origin with a wallet iframe configured.
+	* In this mode, sensitive persistence must live in the wallet-iframe origin.
+	*/
+	shouldUseWalletIframe() {
+		return !!this.configs.iframeWallet?.walletOrigin && !__isWalletIframeHostMode();
+	}
+	async requireWalletIframeRouter(nearAccountId) {
+		if (!this.shouldUseWalletIframe()) throw new Error("[TatchiPasskey] Wallet iframe is not configured.");
+		if (!this.iframeRouter) await this.initWalletIframe(nearAccountId);
+		if (!this.iframeRouter) throw new Error("[TatchiPasskey] Wallet iframe is configured but unavailable.");
+		return this.iframeRouter;
+	}
+	getContext() {
+		return {
+			webAuthnManager: this.webAuthnManager,
+			nearClient: this.nearClient,
+			configs: this.configs
+		};
+	}
+	getNearClient() {
+		return this.nearClient;
+	}
+	/**
+	* Warm critical resources: delegates to WebAuthnManager and ensures iframe handshake when configured.
+	*/
+	async warmCriticalResources(nearAccountId) {
+		await this.initWalletIframe(nearAccountId);
+	}
+	/**
+	* Pre-warm resources on a best-effort basis without changing visible state.
+	* - When iframe=true, initializes the wallet iframe client (and warms local resources).
+	* - When workers=true, warms local critical resources (nonce, IndexedDB, workers) without touching iframe.
+	* - When both are false/omitted, does nothing.
+	*/
+	async prewarm(opts) {
+		const iframe = !!opts?.iframe;
+		const workers = !!opts?.workers;
+		const nearAccountId = opts?.nearAccountId;
+		const tasks = [];
+		if (iframe) tasks.push(this.initWalletIframe(nearAccountId));
+		else if (workers) {
+			const shouldAvoidLocalUserState = !!this.configs.iframeWallet?.walletOrigin && !__isWalletIframeHostMode();
+			tasks.push(this.webAuthnManager.warmCriticalResources(shouldAvoidLocalUserState ? void 0 : nearAccountId));
+		}
+		if (tasks.length === 0) return;
+		try {
+			await Promise.all(tasks);
+		} catch {}
+	}
+	/**
+	* View all access keys for a given account
+	* @param accountId - NEAR account ID to view access keys for
+	* @returns Promise resolving to access key list
+	*/
+	async viewAccessKeyList(accountId) {
+		if (this.iframeRouter) return await this.iframeRouter.viewAccessKeyList(accountId);
+		return this.nearClient.viewAccessKeyList(accountId);
+	}
+	/**
+	* Register a new passkey for the given NEAR account ID
+	* Uses AccountId for on-chain operations and PRF salt derivation
+	*/
+	async registerPasskey(nearAccountId, options = {}) {
+		if (this.shouldUseWalletIframe()) try {
+			const router = await this.requireWalletIframeRouter(nearAccountId);
+			const confirmationConfig = options?.confirmationConfig;
+			const res = await router.registerPasskey({
+				nearAccountId,
+				confirmationConfig,
+				options: {
+					onEvent: options?.onEvent,
+					...options?.signerMode ? { signerMode: options.signerMode } : {},
+					...options?.confirmerText ? { confirmerText: options.confirmerText } : {}
+				}
+			});
+			(async () => {
+				try {
+					await this.warmCriticalResources(nearAccountId);
+				} catch {}
+			})();
+			await options?.afterCall?.(true, res);
+			return res;
+		} catch (error) {
+			const e = toError(error);
+			await options?.onError?.(e);
+			await options?.afterCall?.(false);
+			throw e;
+		}
+		return registerPasskey(this.getContext(), toAccountId(nearAccountId), options, this.configs.authenticatorOptions || DEFAULT_AUTHENTICATOR_OPTIONS);
+	}
+	/**
+	* Internal variant that accepts a one-time confirmationConfig override.
+	* Used by wallet-iframe host to force modal/autoProceed behavior for ArrowButtonLit.
+	*/
+	async registerPasskeyInternal(nearAccountId, options = {}, confirmationConfigOverride) {
+		if (this.shouldUseWalletIframe()) try {
+			const router = await this.requireWalletIframeRouter(nearAccountId);
+			const confirmationConfig = confirmationConfigOverride ?? options?.confirmationConfig;
+			const res = await router.registerPasskey({
+				nearAccountId,
+				confirmationConfig,
+				options: {
+					onEvent: options?.onEvent,
+					...options?.signerMode ? { signerMode: options.signerMode } : {},
+					...options?.confirmerText ? { confirmerText: options.confirmerText } : {}
+				}
+			});
+			(async () => {
+				try {
+					await this.warmCriticalResources(nearAccountId);
+				} catch {}
+			})();
+			await options?.afterCall?.(true, res);
+			return res;
+		} catch (error) {
+			const e = toError(error);
+			await options?.onError?.(e);
+			await options?.afterCall?.(false);
+			throw e;
+		}
+		return registerPasskeyInternal(this.getContext(), toAccountId(nearAccountId), options, this.configs.authenticatorOptions || DEFAULT_AUTHENTICATOR_OPTIONS, confirmationConfigOverride);
+	}
+	/**
+	* Post-registration threshold enrollment.
+	* Runs `/threshold-ed25519/keygen` authorization and stores `threshold_ed25519_2p_v1`
+	* key material locally. Intended to be called after the passkey is registered on-chain.
+	*/
+	async enrollThresholdEd25519Key(nearAccountId, options) {
+		if (this.shouldUseWalletIframe()) {
+			const router = await this.requireWalletIframeRouter(nearAccountId);
+			return await router.enrollThresholdEd25519Key({
+				nearAccountId,
+				options: options || {}
+			});
+		}
+		return await this.webAuthnManager.enrollThresholdEd25519KeyPostRegistration({
+			nearAccountId: toAccountId(nearAccountId),
+			deviceNumber: options?.deviceNumber
+		});
+	}
+	/**
+	* Threshold key rotation helper:
+	* keygen → AddKey(new) → DeleteKey(old).
+	*/
+	async rotateThresholdEd25519Key(nearAccountId, options) {
+		if (this.shouldUseWalletIframe()) {
+			const router = await this.requireWalletIframeRouter(nearAccountId);
+			return await router.rotateThresholdEd25519Key({
+				nearAccountId,
+				options: options || {}
+			});
+		}
+		return await this.webAuthnManager.rotateThresholdEd25519KeyPostRegistration({
+			nearAccountId: toAccountId(nearAccountId),
+			deviceNumber: options?.deviceNumber
+		});
+	}
+	/**
+	* Login and ensure a warm signing session exists.
+	* - Unlocks VRF keypair (Shamir auto-unlock when possible; else WebAuthn prompt)
+	* - Mints a warm signing session (policy from configs, override via options.signingSession)
+	* - Optional: mints a server session (JWT/cookie) via options.session
+	*/
+	async loginAndCreateSession(nearAccountId, options) {
+		if (this.shouldUseWalletIframe()) try {
+			const router = await this.requireWalletIframeRouter(nearAccountId);
+			const res$1 = await router.loginAndCreateSession({
+				nearAccountId,
+				options: {
+					onEvent: options?.onEvent,
+					deviceNumber: options?.deviceNumber,
+					session: options?.session,
+					signingSession: options?.signingSession
+				}
+			});
+			(async () => {
+				try {
+					await this.warmCriticalResources(nearAccountId);
+				} catch {}
+			})();
+			await options?.afterCall?.(true, res$1);
+			return res$1;
+		} catch (error) {
+			const e = toError(error);
+			await options?.onError?.(e);
+			await options?.afterCall?.(false);
+			throw e;
+		}
+		await this.webAuthnManager.initializeCurrentUser(toAccountId(nearAccountId), this.nearClient);
+		const res = await loginAndCreateSession(this.getContext(), toAccountId(nearAccountId), options);
+		try {
+			this.warmCriticalResources(nearAccountId);
+		} catch {}
+		return res;
+	}
+	/**
+	* Logout: clears VRF keypair and all in-worker session state.
+	*/
+	async logoutAndClearSession() {
+		await logoutAndClearSession(this.getContext());
+		if (this.iframeRouter) try {
+			await this.iframeRouter.clearVrfSession?.();
+		} catch {}
+	}
+	/**
+	* Read login state + warm signing session status (no prompts).
+	*/
+	async getLoginSession(nearAccountId) {
+		if (this.shouldUseWalletIframe()) {
+			const router = await this.requireWalletIframeRouter(nearAccountId);
+			const session = await router.getLoginSession(nearAccountId);
+			try {
+				await router.prefetchBlockheight();
+			} catch {}
+			return session;
+		}
+		return await getLoginSession(this.getContext(), nearAccountId ? toAccountId(nearAccountId) : void 0);
+	}
+	/**
+	* Get check if accountId has a passkey from IndexedDB
+	*/
+	async hasPasskeyCredential(nearAccountId) {
+		if (this.shouldUseWalletIframe()) {
+			const router = await this.requireWalletIframeRouter();
+			return await router.hasPasskeyCredential(nearAccountId);
+		}
+		const baseAccountId = toAccountId(nearAccountId);
+		return await this.webAuthnManager.hasPasskeyCredential(baseAccountId);
+	}
+	/**
+	* Set confirmation behavior setting for the current user
+	*/
+	setConfirmBehavior(behavior) {
+		if (this.shouldUseWalletIframe()) {
+			(async () => {
+				try {
+					const router = await this.requireWalletIframeRouter();
+					await router.setConfirmBehavior(behavior);
+				} catch {}
+			})();
+			return;
+		}
+		this.webAuthnManager.getUserPreferences().setConfirmBehavior(behavior);
+	}
+	/**
+	* Set the unified confirmation configuration
+	*/
+	setConfirmationConfig(config) {
+		if (this.shouldUseWalletIframe()) {
+			(async () => {
+				try {
+					const router = await this.requireWalletIframeRouter();
+					await router.setConfirmationConfig(config);
+				} catch {}
+			})();
+			return;
+		}
+		this.webAuthnManager.getUserPreferences().setConfirmationConfig(config);
+	}
+	setUserTheme(theme) {
+		if (this.shouldUseWalletIframe()) {
+			(async () => {
+				try {
+					const router = await this.requireWalletIframeRouter();
+					await router.setTheme(theme);
+				} catch {}
+			})();
+			return;
+		}
+		this.webAuthnManager.getUserPreferences().setUserTheme(theme);
+	}
+	setSignerMode(signerMode) {
+		this.webAuthnManager.getUserPreferences().setSignerMode(signerMode);
+	}
+	/**
+	* Get the current confirmation configuration
+	*/
+	getConfirmationConfig() {
+		return this.webAuthnManager.getUserPreferences().getConfirmationConfig();
+	}
+	getSignerMode() {
+		return this.webAuthnManager.getUserPreferences().getSignerMode();
+	}
+	/**
+	* Prefetch latest block height/hash (and nonce if context missing) to reduce
+	* perceived latency when the user initiates a signing flow.
+	*/
+	async prefetchBlockheight() {
+		if (this.iframeRouter) {
+			await this.iframeRouter.prefetchBlockheight();
+			return;
+		}
+		try {
+			await this.webAuthnManager.getNonceManager().prefetchBlockheight(this.nearClient);
+		} catch {}
+	}
+	async getRecentLogins() {
+		if (this.shouldUseWalletIframe()) try {
+			const router = await this.requireWalletIframeRouter();
+			return await router.getRecentLogins();
+		} catch {
+			return {
+				accountIds: [],
+				lastUsedAccount: null
+			};
+		}
+		return getRecentLogins(this.getContext());
+	}
+	/**
+	* Execute a NEAR blockchain action using passkey-derived credentials
+	* Supports all NEAR action types: Transfer, FunctionCall, AddKey, etc.
+	*
+	* @param nearAccountId - NEAR account ID to execute action with
+	* @param actionArgs - Action to execute (single action or array for batched transactions)
+	* @param options - Action options for event handling
+	* - onEvent: EventCallback<ActionSSEEvent> - Optional event callback
+	* - onError: (error: Error) => void - Optional error callback
+	* - afterCall: AfterCall - Optional after call hooks
+	* - waitUntil: TxExecutionStatus - Optional waitUntil status
+	* @returns Promise resolving to action result
+	*
+	* @example
+	* ```typescript
+	* // Basic transfer
+	* const result = await tatchi.executeAction('alice.near', {
+	*   type: ActionType.Transfer,
+	*   receiverId: 'bob.near',
+	*   amount: '1000000000000000000000000' // 1 NEAR
+	* });
+	*
+	* // Function call with gas and deposit (already available in ActionArgs)
+	* const result = await tatchi.executeAction('alice.near', {
+	*   type: ActionType.FunctionCall,
+	*   receiverId: 'contract.near',
+	*   methodName: 'set_value',
+	*   args: { value: 42 },
+	*   gas: '50000000000000', // 50 TGas
+	*   deposit: '100000000000000000000000' // 0.1 NEAR
+	* });
+	*
+	* // Batched transaction
+	* const result = await tatchi.executeAction('alice.near', [
+	*   {
+	*     type: ActionType.Transfer,
+	*     receiverId: 'bob.near',
+	*     amount: '1000000000000000000000000'
+	*   },
+	*   {
+	*     type: ActionType.FunctionCall,
+	*     receiverId: 'contract.near',
+	*     methodName: 'log_transfer',
+	*     args: { recipient: 'bob.near' }
+	*   }
+	* ], {
+	*   onEvent: (event) => console.log('Action progress:', event)
+	* });
+	* ```
+	*/
+	async executeAction(args) {
+		if (this.shouldUseWalletIframe()) try {
+			const router = await this.requireWalletIframeRouter(args.nearAccountId);
+			const res = await router.executeAction({
+				nearAccountId: args.nearAccountId,
+				receiverId: args.receiverId,
+				actionArgs: args.actionArgs,
+				options: args.options
+			});
+			await args.options?.afterCall?.(true, res);
+			return res;
+		} catch (error) {
+			const e = toError(error);
+			await args.options?.onError?.(e);
+			await args.options?.afterCall?.(false);
+			throw e;
+		}
+		return executeAction({
+			context: this.getContext(),
+			nearAccountId: toAccountId(args.nearAccountId),
+			receiverId: toAccountId(args.receiverId),
+			actionArgs: args.actionArgs,
+			options: args.options
+		});
+	}
+	/**
+	* Sign and send multiple transactions with actions
+	* This method signs transactions with actions and sends them to the network
+	*
+	* @param nearAccountId - NEAR account ID to sign and send transactions with
+	* @param transactionInputs - Transaction inputs to sign and send
+	* @param options - Sign and send transaction options
+	* - onEvent: EventCallback<ActionSSEEvent> - Optional event callback
+	* - onError: (error: Error) => void - Optional error callback
+	* - afterCall: AfterCall - Optional after call hooks
+	* - waitUntil: TxExecutionStatus - Optional waitUntil status
+	* - executeSequentially: boolean - Wait for each transaction to finish before sending the next (default: true)
+	* @returns Promise resolving to action results
+	*
+	* @example
+	* ```typescript
+	* // Sign and send multiple transactions in a batch
+	* const results = await tatchi.signAndSendTransactions('alice.near', {
+	*   transactions: [
+	*     {
+	*       receiverId: 'bob.near',
+	*       actions: [{
+	*         action_type: ActionType.Transfer,
+	*         deposit: '1000000000000000000000000'
+	*       }],
+	*     },
+	*     {
+	*       receiverId: 'contract.near',
+	*       actions: [{
+	*         action_type: ActionType.FunctionCall,
+	*         method_name: 'log_transfer',
+	*         args: JSON.stringify({ recipient: 'bob.near' }),
+	*         gas: '30000000000000',
+	*         deposit: '0'
+	*       }],
+	*     }
+	*   ],
+	*   options: {
+	*     onEvent: (event) => console.log('Signing and sending progress:', event)
+	*     executeSequentially: true
+	*   }
+	* });
+	* ```
+	*/
+	async signAndSendTransactions({ nearAccountId, transactions, options }) {
+		if (this.shouldUseWalletIframe()) try {
+			const router = await this.requireWalletIframeRouter(nearAccountId);
+			const routerOptions = {
+				...options,
+				executionWait: options?.executionWait ?? {
+					mode: "sequential",
+					waitUntil: options?.waitUntil
+				}
+			};
+			const res = await router.signAndSendTransactions({
+				nearAccountId,
+				transactions: transactions.map((t) => ({
+					receiverId: t.receiverId,
+					actions: t.actions
+				})),
+				options: routerOptions
+			});
+			const txIds = (res || []).map((r) => r?.transactionId).filter(Boolean).join(", ");
+			options?.onEvent?.({
+				step: 8,
+				phase: ActionPhase.STEP_8_ACTION_COMPLETE,
+				status: ActionStatus.SUCCESS,
+				message: `All transactions sent: ${txIds}`
+			});
+			await options?.afterCall?.(true, res);
+			return res;
+		} catch (error) {
+			const e = toError(error);
+			await options?.onError?.(e);
+			await options?.afterCall?.(false);
+			throw e;
+		}
+		return signAndSendTransactions({
+			context: this.getContext(),
+			nearAccountId: toAccountId(nearAccountId),
+			transactionInputs: transactions,
+			options
+		}).then((txResults) => {
+			const txIds = txResults.map((txResult) => txResult.transactionId).join(", ");
+			options?.onEvent?.({
+				step: 8,
+				phase: ActionPhase.STEP_8_ACTION_COMPLETE,
+				status: ActionStatus.SUCCESS,
+				message: `All transactions sent: ${txIds}`
+			});
+			return txResults;
+		});
+	}
+	/**
+	* Convenience helper to sign and send a single transaction with actions.
+	* Internally delegates to signAndSendTransactions() and returns the first result.
+	*/
+	async signAndSendTransaction({ nearAccountId, receiverId, actions, options }) {
+		const results = await this.signAndSendTransactions({
+			nearAccountId,
+			transactions: [{
+				receiverId,
+				actions
+			}],
+			options
+		});
+		return results[0];
+	}
+	/**
+	* Batch sign transactions (with actions), allows you to sign transactions
+	* to different receivers with a single TouchID prompt.
+	* This method does not broadcast transactions, use sendTransaction() to do that.
+	*
+	* This method fetches the current nonce and increments it for the next N transactions,
+	* so you do not need to manually increment the nonce for each transaction.
+	*
+	* @param nearAccountId - NEAR account ID to sign transactions with
+	* @param params - Transaction signing parameters
+	* - @param params.transactions: Array of transaction objects with nearAccountId, receiverId, actions, and nonce
+	* - @param params.onEvent: Optional progress event callback
+	* @returns Promise resolving to signed transaction results
+	*
+	* @example
+	* ```typescript
+	* // Sign a single transaction
+	* const signedTransactions = await tatchi.signTransactionsWithActions('alice.near', {
+	*   transactions: [{
+	*     receiverId: 'bob.near',
+	*     actions: [{
+	*       action_type: ActionType.Transfer,
+	*       deposit: '1000000000000000000000000'
+	*     }],
+	*   }],
+	*   onEvent: (event) => console.log('Signing progress:', event)
+	* });
+	*
+	* // Sign multiple transactions in a batch
+	* const signedTransactions = await tatchi.signTransactionsWithActions('alice.near', {
+	*   transactions: [
+	*     {
+	*       receiverId: 'bob.near',
+	*       actions: [{
+	*         action_type: ActionType.Transfer,
+	*         deposit: '1000000000000000000000000'
+	*       }],
+	*     },
+	*     {
+	*       receiverId: 'contract.near',
+	*       actions: [{
+	*         action_type: ActionType.FunctionCall,
+	*         method_name: 'log_transfer',
+	*         args: JSON.stringify({ recipient: 'bob.near' }),
+	*         gas: '30000000000000',
+	*         deposit: '0'
+	*       }],
+	*     }
+	*   ]
+	* });
+	* ```
+	*/
+	async signTransactionsWithActions({ nearAccountId, transactions, options }) {
+		if (this.shouldUseWalletIframe()) try {
+			const router = await this.requireWalletIframeRouter(nearAccountId);
+			const txs = transactions.map((t) => ({
+				receiverId: t.receiverId,
+				actions: t.actions
+			}));
+			const result = await router.signTransactionsWithActions({
+				nearAccountId,
+				transactions: txs,
+				options: {
+					signerMode: options.signerMode,
+					onEvent: options.onEvent,
+					confirmationConfig: options.confirmationConfig,
+					confirmerText: options.confirmerText
+				}
+			});
+			const arr = Array.isArray(result) ? result : [];
+			await options?.afterCall?.(true, arr);
+			return arr;
+		} catch (error) {
+			const e = toError(error);
+			await options?.onError?.(e);
+			await options?.afterCall?.(false);
+			throw e;
+		}
+		return signTransactionsWithActions({
+			context: this.getContext(),
+			nearAccountId: toAccountId(nearAccountId),
+			transactionInputs: transactions,
+			options
+		});
+	}
+	/**
+	* Send a signed transaction to the NEAR network
+	* This method broadcasts a previously signed transaction and waits for execution
+	*
+	* @param signedTransaction - The signed transaction to broadcast
+	* @param waitUntil - The execution status to wait for (defaults to FINAL)
+	* @returns Promise resolving to the transaction execution outcome
+	*
+	* @example
+	* ```typescript
+	* // Sign a transaction first
+	* const signedTransactions = await tatchi.signTransactionsWithActions('alice.near', {
+	*   transactions: [{
+	*     receiverId: 'bob.near',
+	*     actions: [{
+	*       action_type: ActionType.Transfer,
+	*       deposit: '1000000000000000000000000'
+	*     }],
+	*   }]
+	* });
+	*
+	* // Then broadcast it
+	* const result = await tatchi.sendTransaction(
+	*   signedTransactions[0].signedTransaction,
+	*   TxExecutionStatus.FINAL
+	* );
+	* ```
+	*/
+	async sendTransaction({ signedTransaction, options }) {
+		if (this.shouldUseWalletIframe()) try {
+			const router = await this.requireWalletIframeRouter();
+			const res = await router.sendTransaction({
+				signedTransaction,
+				options: {
+					onEvent: options?.onEvent,
+					...options && "waitUntil" in options ? { waitUntil: options.waitUntil } : {}
+				}
+			});
+			await options?.afterCall?.(true, res);
+			options?.onEvent?.({
+				step: 8,
+				phase: ActionPhase.STEP_8_ACTION_COMPLETE,
+				status: ActionStatus.SUCCESS,
+				message: `Transaction ${res?.transactionId} broadcasted`
+			});
+			return res;
+		} catch (error) {
+			const e = toError(error);
+			await options?.onError?.(e);
+			await options?.afterCall?.(false);
+			throw e;
+		}
+		return sendTransaction({
+			context: this.getContext(),
+			signedTransaction,
+			options
+		}).then((txResult) => {
+			options?.onEvent?.({
+				step: 8,
+				phase: ActionPhase.STEP_8_ACTION_COMPLETE,
+				status: ActionStatus.SUCCESS,
+				message: `Transaction ${txResult.transactionId} broadcasted`
+			});
+			return txResult;
+		});
+	}
+	async signDelegateAction({ nearAccountId, delegate, options }) {
+		if (this.shouldUseWalletIframe()) try {
+			const router = await this.requireWalletIframeRouter(nearAccountId);
+			const result = await router.signDelegateAction({
+				nearAccountId,
+				delegate,
+				options: {
+					signerMode: options.signerMode,
+					onEvent: options.onEvent,
+					confirmationConfig: options.confirmationConfig,
+					confirmerText: options.confirmerText
+				}
+			});
+			await options?.afterCall?.(true, result);
+			return result;
+		} catch (error) {
+			const e = toError(error);
+			await options?.onError?.(e);
+			await options?.afterCall?.(false);
+			throw e;
+		}
+		const { signDelegateAction } = await import("./delegateAction.js");
+		return signDelegateAction({
+			context: this.getContext(),
+			nearAccountId: toAccountId(nearAccountId),
+			delegate,
+			options
+		});
+	}
+	/**
+	* Convenience helper to POST a signed delegate to a relayer.
+	* Does not enforce any relayer semantics; simply forwards the payload.
+	*/
+	async sendDelegateActionViaRelayer(args) {
+		const base = args.relayerUrl.replace(/\/+$/, "");
+		const route = (this.configs.relayer?.delegateActionRoute || "/signed-delegate").replace(/^\/?/, "/");
+		const endpoint = `${base}${route}`;
+		const { sendDelegateActionViaRelayer } = await import("./relay.js");
+		return sendDelegateActionViaRelayer({
+			url: endpoint,
+			payload: {
+				hash: args.hash,
+				signedDelegate: args.signedDelegate
+			},
+			signal: args.signal,
+			options: args.options
+		});
+	}
+	/**
+	* Convenience helper to sign a delegate action and immediately forward it to the relayer.
+	* Emits delegate signing events and relay broadcasting events through the provided options.
+	*/
+	async signAndSendDelegateAction(args) {
+		const { nearAccountId, delegate, relayerUrl, signal, options } = args;
+		const signOptions = options ? {
+			signerMode: options.signerMode,
+			onEvent: options.onEvent,
+			onError: options.onError,
+			waitUntil: options.waitUntil,
+			confirmationConfig: options.confirmationConfig,
+			confirmerText: options.confirmerText,
+			afterCall: () => {}
+		} : void 0;
+		let signResult;
+		try {
+			signResult = await this.signDelegateAction({
+				nearAccountId,
+				delegate,
+				options: signOptions
+			});
+		} catch (error) {
+			await options?.afterCall?.(false);
+			throw error;
+		}
+		const relayOptions = options ? {
+			onEvent: options.onEvent,
+			onError: options.onError
+		} : void 0;
+		let relayResult;
+		try {
+			relayResult = await this.sendDelegateActionViaRelayer({
+				relayerUrl,
+				hash: signResult.hash,
+				signedDelegate: signResult.signedDelegate,
+				signal,
+				options: relayOptions
+			});
+		} catch (error) {
+			await options?.afterCall?.(false);
+			throw error;
+		}
+		const combined = {
+			signResult,
+			relayResult
+		};
+		const success = relayResult.ok !== false;
+		if (success) await options?.afterCall?.(true, combined);
+		else await options?.afterCall?.(false);
+		return combined;
+	}
+	/**
+	* Sign a NEP-413 message using the user's passkey-derived private key:
+	* - Creates a payload with message, recipient, nonce, and state
+	* - Serializes using Borsh
+	* - Adds NEP-413 prefix
+	* - Hashes with SHA-256
+	* - Signs with Ed25519
+	* - Returns base64-encoded signature
+	*
+	* @param nearAccountId - NEAR account ID to sign with
+	* @param params - NEP-413 signing parameters
+	* - message: string - The message to sign
+	* - recipient: string - The recipient of the message
+	* - state: string - Optional state parameter
+	* @param options - Action options for event handling
+	* - onEvent: EventCallback<ActionSSEEvent> - Optional event callback
+	* - onError: (error: Error) => void - Optional error callback
+	* - afterCall: AfterCall - Optional after call hooks
+	* - waitUntil: TxExecutionStatus - Optional waitUntil status
+	* @returns Promise resolving to signing result
+	*
+	* @example
+	* ```typescript
+	* const result = await tatchi.signNEP413Message('alice.near', {
+	*   message: 'Hello World',
+	*   recipient: 'app.example.com',
+	*   state: 'optional-state'
+	* });
+	* ```
+	*/
+	async signNEP413Message(args) {
+		if (this.shouldUseWalletIframe()) try {
+			const router = await this.requireWalletIframeRouter(args.nearAccountId);
+			const result = await router.signNep413Message({
+				nearAccountId: args.nearAccountId,
+				message: args.params.message,
+				recipient: args.params.recipient,
+				state: args.params.state,
+				options: {
+					signerMode: args.options.signerMode,
+					onEvent: args.options.onEvent,
+					confirmerText: args.options.confirmerText,
+					confirmationConfig: args.options.confirmationConfig
+				}
+			});
+			await args.options?.afterCall?.(true, result);
+			return result;
+		} catch (error) {
+			const e = toError(error);
+			await args.options?.onError?.(e);
+			await args.options?.afterCall?.(false);
+			throw e;
+		}
+		const { signNEP413Message } = await import("./signNEP413.js");
+		const res = await signNEP413Message({
+			context: this.getContext(),
+			nearAccountId: toAccountId(args.nearAccountId),
+			params: args.params,
+			options: args.options
+		});
+		if (res?.success) await args.options?.afterCall?.(true, res);
+		else await args.options?.afterCall?.(false);
+		return res;
+	}
+	/**
+	* Canonical entrypoint to show the Export Private Key UI (secure drawer/modal)
+	* without returning the key to the caller. All dApps should use this wrapper;
+	* the underlying WebAuthnManager.exportNearKeypairWithUI() is fully worker-
+	* driven and only ever reveals the private key inside trusted UI surfaces.
+	*/
+	async exportNearKeypairWithUI(nearAccountId, options) {
+		if (isOffline()) await openOfflineExport({
+			accountId: nearAccountId,
+			routerOpen: this.iframeRouter?.openOfflineExport?.bind(this.iframeRouter),
+			walletOrigin: this.configs?.iframeWallet?.walletOrigin,
+			target: "_blank"
+		});
+		else {
+			if (this.iframeRouter?.isReady?.()) {
+				await this.iframeRouter.exportNearKeypairWithUI(nearAccountId, options);
+				return;
+			}
+			const routerOpen = this.iframeRouter?.openOfflineExport?.bind(this.iframeRouter);
+			const walletOrigin = this.configs?.iframeWallet?.walletOrigin;
+			if (routerOpen || walletOrigin) {
+				await openOfflineExport({
+					accountId: nearAccountId,
+					routerOpen,
+					walletOrigin,
+					target: "_blank"
+				});
+				return;
+			}
+			await this.webAuthnManager.exportNearKeypairWithUI(toAccountId(nearAccountId), options);
+		}
+	}
+	/** Store a derived address for an account + contract + path (multi-chain capable via path encoding). */
+	async setDerivedAddress(nearAccountId, args) {
+		if (this.shouldUseWalletIframe()) {
+			let router;
+			try {
+				router = await this.requireWalletIframeRouter();
+			} catch {
+				throw new Error("[TatchiPasskey] Wallet iframe is configured but unavailable; refusing to write derived addresses to app origin.");
+			}
+			return await router.setDerivedAddress({
+				nearAccountId,
+				args
+			});
+		}
+		await chainsigAddressManager.setDerivedAddress(toAccountId(nearAccountId), args);
+	}
+	/** Retrieve the full derived address record (or null if not found). */
+	async getDerivedAddressRecord(nearAccountId, args) {
+		if (this.shouldUseWalletIframe()) {
+			let router;
+			try {
+				router = await this.requireWalletIframeRouter();
+			} catch {
+				throw new Error("[TatchiPasskey] Wallet iframe is configured but unavailable; refusing to read derived addresses from app origin.");
+			}
+			return await router.getDerivedAddressRecord({
+				nearAccountId,
+				args
+			});
+		}
+		return await chainsigAddressManager.getDerivedAddressRecord(toAccountId(nearAccountId), args);
+	}
+	/** Retrieve only the derived address string for convenience. */
+	async getDerivedAddress(nearAccountId, args) {
+		if (this.shouldUseWalletIframe()) {
+			let router;
+			try {
+				router = await this.requireWalletIframeRouter();
+			} catch {
+				throw new Error("[TatchiPasskey] Wallet iframe is configured but unavailable; refusing to read derived addresses from app origin.");
+			}
+			return await router.getDerivedAddress({
+				nearAccountId,
+				args
+			});
+		}
+		return await chainsigAddressManager.getDerivedAddress(toAccountId(nearAccountId), args);
+	}
+	/**
+	* Get recovery emails for an account.
+	* - Fetches on-chain recovery email hashes via get_recovery_emails.
+	* - Resolves hashes to canonical emails using local IndexedDB mapping when available.
+	* - Returns an array of { hashHex, email }, where `email` is a human-readable label
+	*   (canonical email when known on this device, otherwise the hash hex).
+	*/
+	async getRecoveryEmails(nearAccountId) {
+		if (this.shouldUseWalletIframe()) {
+			let router;
+			try {
+				router = await this.requireWalletIframeRouter(nearAccountId);
+			} catch {
+				throw new Error("[TatchiPasskey] Wallet iframe is configured but unavailable; refusing to read recovery email mappings from app origin.");
+			}
+			return await router.getRecoveryEmails(nearAccountId);
+		}
+		const accountId = toAccountId(nearAccountId);
+		const { getRecoveryEmailHashesContractCall } = await import("../rpcCalls.js");
+		const { getLocalRecoveryEmails, bytesToHex } = await import("../EmailRecovery/index.js");
+		const rawHashes = await getRecoveryEmailHashesContractCall(this.nearClient, accountId);
+		if (!rawHashes.length) return [];
+		let local = [];
+		try {
+			local = await getLocalRecoveryEmails(accountId);
+		} catch (error) {
+			console.warn("[TatchiPasskey] Failed to load local recovery emails", error);
+		}
+		const emailByHashHex = /* @__PURE__ */ new Map();
+		for (const rec of local) {
+			if (!rec?.hashHex || !rec?.email) continue;
+			if (!emailByHashHex.has(rec.hashHex)) emailByHashHex.set(rec.hashHex, rec.email);
+		}
+		return rawHashes.map((hashBytes) => {
+			const hashHex = bytesToHex(hashBytes);
+			const email = emailByHashHex.get(hashHex) || hashHex;
+			return {
+				hashHex,
+				email
+			};
+		});
+	}
+	/**
+	* Set recovery emails for an account:
+	* - Canonicalizes and hashes emails client-side.
+	* - Persists mapping in IndexedDB.
+	* - Deploys/attaches the EmailRecoverer contract when needed.
+	* - Calls set_recovery_emails(...) on the per-account contract.
+	*/
+	async setRecoveryEmails(nearAccountId, recoveryEmails, options) {
+		if (this.shouldUseWalletIframe()) try {
+			const router = await this.requireWalletIframeRouter(nearAccountId);
+			const res = await router.setRecoveryEmails({
+				nearAccountId,
+				recoveryEmails,
+				options
+			});
+			await options?.afterCall?.(true, res);
+			return res;
+		} catch (error) {
+			const e = toError(error);
+			await options?.onError?.(e);
+			await options?.afterCall?.(false);
+			throw e;
+		}
+		const accountId = toAccountId(nearAccountId);
+		const { prepareRecoveryEmails } = await import("../EmailRecovery/index.js");
+		const { buildSetRecoveryEmailsActions } = await import("../rpcCalls.js");
+		const { hashes: recoveryEmailHashes } = await prepareRecoveryEmails(accountId, recoveryEmails);
+		const actions = await buildSetRecoveryEmailsActions(this.nearClient, accountId, recoveryEmailHashes, this.configs.emailRecoveryContracts);
+		return this.executeAction({
+			nearAccountId,
+			receiverId: nearAccountId,
+			actionArgs: actions,
+			options
+		});
+	}
+	/**
+	* Sync account state from on-chain data using an existing passkey.
+	*/
+	async syncAccount(args) {
+		const accountIdInput = args?.accountId || "";
+		const options = args?.options;
+		if (this.shouldUseWalletIframe()) try {
+			const router = await this.requireWalletIframeRouter();
+			const res = await router.syncAccount({
+				accountId: accountIdInput,
+				onEvent: options?.onEvent
+			});
+			await options?.afterCall?.(true, res);
+			return res;
+		} catch (error) {
+			const e = toError(error);
+			await options?.onError?.(e);
+			await options?.afterCall?.(false);
+			throw e;
+		}
+		try {
+			const { SyncAccountFlow: SyncAccountFlow$1 } = await import("./syncAccount.js");
+			const flow = new SyncAccountFlow$1(this.getContext(), options);
+			const discovered = await flow.discover(accountIdInput || "");
+			if (!Array.isArray(discovered) || discovered.length === 0) {
+				const err = /* @__PURE__ */ new Error("No syncable accounts found");
+				await options?.onError?.(err);
+				await options?.afterCall?.(false);
+				return {
+					success: false,
+					accountId: accountIdInput || "",
+					publicKey: "",
+					message: err.message,
+					error: err.message
+				};
+			}
+			const selected = discovered[0];
+			const result = await flow.sync({
+				credentialId: selected.credentialId,
+				accountId: selected.accountId
+			});
+			await options?.afterCall?.(true, result);
+			return result;
+		} catch (error) {
+			const e = toError(error);
+			await options?.onError?.(e);
+			await options?.afterCall?.(false);
+			throw e;
+		}
+	}
+	async ensureEmailRecoveryFlow(options) {
+		const { EmailRecoveryFlow } = await import("./emailRecovery.js");
+		if (!this.activeEmailRecoveryFlow) this.activeEmailRecoveryFlow = new EmailRecoveryFlow(this.getContext(), options);
+		else if (options) this.activeEmailRecoveryFlow.setOptions(options);
+		return this.activeEmailRecoveryFlow;
+	}
+	async startEmailRecovery(args) {
+		const { accountId, options } = args;
+		if (this.shouldUseWalletIframe()) try {
+			const router = await this.requireWalletIframeRouter();
+			const confirmerText = options?.confirmerText;
+			const confirmationConfig = options?.confirmationConfig;
+			const safeOptions = {
+				...confirmerText ? { confirmerText } : {},
+				...confirmationConfig ? { confirmationConfig } : {}
+			};
+			const res = await router.startEmailRecovery({
+				accountId,
+				onEvent: options?.onEvent,
+				options: Object.keys(safeOptions).length > 0 ? safeOptions : void 0
+			});
+			await options?.afterCall?.(true, void 0);
+			return res;
+		} catch (error) {
+			const e = toError(error);
+			await options?.onError?.(e);
+			await options?.afterCall?.(false);
+			throw e;
+		}
+		const flow = await this.ensureEmailRecoveryFlow(options);
+		return await flow.start({ accountId });
+	}
+	async finalizeEmailRecovery(args) {
+		const { accountId, nearPublicKey, options } = args;
+		if (this.shouldUseWalletIframe()) try {
+			const router = await this.requireWalletIframeRouter();
+			await router.finalizeEmailRecovery({
+				accountId,
+				nearPublicKey,
+				onEvent: options?.onEvent
+			});
+			await options?.afterCall?.(true, void 0);
+			return;
+		} catch (error) {
+			const e = toError(error);
+			await options?.onError?.(e);
+			await options?.afterCall?.(false);
+			throw e;
+		}
+		const flow = await this.ensureEmailRecoveryFlow(options);
+		await flow.finalize({
+			accountId,
+			nearPublicKey
+		});
+	}
+	/**
+	* Best-effort cancellation for an in-flight email recovery flow.
+	* Intended for UI "user cancelled sending email" / retry UX.
+	*/
+	async cancelEmailRecovery(args) {
+		const { accountId, nearPublicKey } = args || {};
+		if (this.shouldUseWalletIframe()) {
+			try {
+				const router = await this.requireWalletIframeRouter();
+				await router.stopEmailRecovery({
+					accountId,
+					nearPublicKey
+				});
+			} catch {}
+			return;
+		}
+		try {
+			await this.activeEmailRecoveryFlow?.cancelAndReset({
+				accountId,
+				nearPublicKey
+			});
+		} catch {}
+		this.activeEmailRecoveryFlow = null;
+	}
+	/**
+	* Device2: Start device linking flow
+	* Returns QR payload and data URL to render; emits onEvent during the flow.
+	* Runs inside iframe when available for better isolation.
+	*/
+	async startDevice2LinkingFlow(args) {
+		if (this.shouldUseWalletIframe()) {
+			const router = await this.requireWalletIframeRouter();
+			const options = args?.options;
+			return await router.startDevice2LinkingFlow({
+				ui: args?.ui,
+				cameraId: args?.cameraId,
+				options
+			});
+		}
+		this.activeDeviceLinkFlow?.cancel();
+		const { LinkDeviceFlow } = await import("./linkDevice.js");
+		const flow = new LinkDeviceFlow(this.getContext(), {
+			cameraId: args?.cameraId,
+			options: args?.options
+		});
+		this.activeDeviceLinkFlow = flow;
+		const { qrData, qrCodeDataURL } = await flow.generateQR();
+		return {
+			qrData,
+			qrCodeDataURL
+		};
+	}
+	/**
+	* Device2: Stops device linking flow inside the iframe host.
+	*/
+	async stopDevice2LinkingFlow() {
+		if (this.shouldUseWalletIframe()) {
+			try {
+				const router = await this.requireWalletIframeRouter();
+				await router.stopDevice2LinkingFlow();
+			} catch {}
+			return;
+		}
+		if (this.iframeRouter) {
+			await this.iframeRouter.stopDevice2LinkingFlow();
+			return;
+		}
+		this.activeDeviceLinkFlow?.cancel();
+		this.activeDeviceLinkFlow = null;
+	}
+	/**
+	* Device1: Link device using pre-scanned QR data.
+	* You can use a QR scanning component of your choice,
+	* or use the built-in <QRCodeScanner /> component.
+	*
+	* @param qrData The QR data obtained from scanning Device2's QR code
+	* @param options Device linking options including funding amount and event callbacks
+	* @returns Promise that resolves to the linking result
+	*/
+	async linkDeviceWithScannedQRData(qrData, options) {
+		if (this.shouldUseWalletIframe()) {
+			const router = await this.requireWalletIframeRouter();
+			const res = await router.linkDeviceWithScannedQRData({
+				qrData,
+				fundingAmount: options.fundingAmount,
+				options: {
+					onEvent: options.onEvent,
+					confirmationConfig: options.confirmationConfig,
+					confirmerText: options.confirmerText
+				}
+			});
+			return res;
+		}
+		const { linkDeviceWithScannedQRData } = await import("./scanDevice.js");
+		return linkDeviceWithScannedQRData(this.getContext(), qrData, options);
+	}
+	/**
+	* Delete a device key from an account
+	*/
+	async deleteDeviceKey(accountId, publicKeyToDelete, options) {
+		const keysView = this.iframeRouter ? await this.iframeRouter.viewAccessKeyList(accountId) : await this.nearClient.viewAccessKeyList(toAccountId(accountId));
+		if (keysView.keys.length <= 1) throw new Error("Cannot delete the last access key from an account");
+		const keyToDelete = keysView.keys.find((k) => k.public_key === publicKeyToDelete);
+		if (!keyToDelete) throw new Error(`Access key ${publicKeyToDelete} not found on account ${accountId}`);
+		return this.executeAction({
+			nearAccountId: accountId,
+			receiverId: accountId,
+			actionArgs: {
+				type: ActionType.DeleteKey,
+				publicKey: publicKeyToDelete
+			},
+			options
+		});
+	}
+};
+
+//#endregion
+export { TatchiPasskey };
+//# sourceMappingURL=index.js.map