@tatchi-xyz/sdk 0.20.0 → 0.31.0

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/signDelegateAction.js

@@ -0,0 +1,258 @@
+import { ensureEd25519Prefix } from "../../../../utils/validation.js";
+import { toAccountId } from "../../../types/accountIds.js";
+import { WorkerRequestType, isSignDelegateActionSuccess, isWorkerError } from "../../../types/signer-worker.js";
+import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from "../../../defaultConfigs.js";
+import { normalizeThresholdEd25519ParticipantIds } from "../../../../threshold/participants.js";
+import { removePrfOutputGuard } from "../../credentialsHelpers.js";
+import { toActionArgsWasm, validateActionArgsWasm } from "../../../types/actions.js";
+import { getLastLoggedInDeviceNumber } from "../getDeviceNumber.js";
+import { generateSessionId } from "../sessionHandshake.js";
+import { resolveSignerModeForThresholdSigning } from "../../../threshold/thresholdEd25519RelayerHealth.js";
+import { clearCachedThresholdEd25519AuthSession, getCachedThresholdEd25519AuthSessionJwt, makeThresholdEd25519AuthSessionCacheKey } from "../../../threshold/thresholdEd25519AuthSession.js";
+import { isThresholdSessionAuthUnavailableError } from "../../../threshold/thresholdSessionPolicy.js";
+import { toPublicKeyString } from "./validation.js";
+
+//#region src/core/WebAuthnManager/SignerWorkerManager/handlers/signDelegateAction.ts
+async function signDelegateAction({ ctx, delegate, rpcCall, signerMode, onEvent, confirmationConfigOverride, title, body, sessionId: providedSessionId }) {
+	const sessionId = providedSessionId ?? generateSessionId();
+	const nearAccountId = rpcCall.nearAccountId || delegate.senderId;
+	const relayerUrl = ctx.relayerUrl;
+	const resolvedRpcCall = {
+		contractId: rpcCall.contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId,
+		nearRpcUrl: rpcCall.nearRpcUrl || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl.split(",")[0] || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl,
+		nearAccountId
+	};
+	const actionsWasm = delegate.actions.map(toActionArgsWasm);
+	actionsWasm.forEach((action, actionIndex) => {
+		try {
+			validateActionArgsWasm(action);
+		} catch (error) {
+			throw new Error(`Delegate action ${actionIndex} validation failed: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	});
+	const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);
+	const [localKeyMaterial, thresholdKeyMaterial] = await Promise.all([ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber), ctx.indexedDB.nearKeysDB.getThresholdKeyMaterial(nearAccountId, deviceNumber)]);
+	if (!localKeyMaterial) throw new Error(`No local key material found for account: ${nearAccountId}`);
+	const warnings = [];
+	const vrfWorkerManager = ctx.vrfWorkerManager;
+	if (!vrfWorkerManager) throw new Error("VrfWorkerManager not available for delegate signing");
+	const resolvedSignerMode = await resolveSignerModeForThresholdSigning({
+		nearAccountId,
+		signerMode,
+		relayerUrl,
+		hasThresholdKeyMaterial: !!thresholdKeyMaterial,
+		warnings
+	});
+	const signingContext = validateAndPrepareDelegateSigningContext({
+		nearAccountId,
+		resolvedSignerMode,
+		relayerUrl,
+		rpId: ctx.touchIdPrompt.getRpId(),
+		localKeyMaterial,
+		thresholdKeyMaterial,
+		providedDelegatePublicKey: delegate.publicKey,
+		warnings
+	});
+	ctx.nonceManager.initializeUser(toAccountId(nearAccountId), signingContext.signingNearPublicKeyStr);
+	const confirmation = await vrfWorkerManager.confirmAndPrepareSigningSession({
+		ctx,
+		sessionId,
+		kind: "delegate",
+		...signingContext.threshold && !signingContext.threshold.thresholdSessionJwt ? { signingAuthMode: "webauthn" } : {},
+		nearAccountId,
+		delegate: {
+			senderId: delegate.senderId || nearAccountId,
+			receiverId: delegate.receiverId,
+			actions: actionsWasm,
+			nonce: delegate.nonce,
+			maxBlockHeight: delegate.maxBlockHeight
+		},
+		rpcCall: resolvedRpcCall,
+		confirmationConfigOverride,
+		title,
+		body
+	});
+	let { intentDigest, transactionContext, vrfChallenge, credential } = extractSigningEvidenceFromConfirmation(confirmation);
+	const delegatePayload = {
+		senderId: delegate.senderId || nearAccountId,
+		receiverId: delegate.receiverId,
+		actions: actionsWasm,
+		nonce: delegate.nonce.toString(),
+		maxBlockHeight: delegate.maxBlockHeight.toString(),
+		publicKey: signingContext.delegatePublicKeyStr
+	};
+	if (!signingContext.threshold) {
+		const response = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: WorkerRequestType.SignDelegateAction,
+				payload: {
+					signerMode: signingContext.resolvedSignerMode,
+					rpcCall: resolvedRpcCall,
+					createdAt: Date.now(),
+					decryption: {
+						encryptedPrivateKeyData: localKeyMaterial.encryptedSk,
+						encryptedPrivateKeyChacha20NonceB64u: localKeyMaterial.chacha20NonceB64u
+					},
+					delegate: delegatePayload,
+					intentDigest,
+					transactionContext,
+					credential
+				}
+			},
+			onEvent
+		});
+		const okResponse$1 = requireOkSignDelegateActionResponse(response);
+		return {
+			signedDelegate: okResponse$1.payload.signedDelegate,
+			hash: okResponse$1.payload.hash,
+			nearAccountId: toAccountId(nearAccountId),
+			logs: [...okResponse$1.payload.logs || [], ...warnings]
+		};
+	}
+	const requestPayload = {
+		signerMode: signingContext.resolvedSignerMode,
+		rpcCall: resolvedRpcCall,
+		createdAt: Date.now(),
+		decryption: {
+			encryptedPrivateKeyData: "",
+			encryptedPrivateKeyChacha20NonceB64u: ""
+		},
+		threshold: {
+			relayerUrl: signingContext.threshold.relayerUrl,
+			relayerKeyId: signingContext.threshold.thresholdKeyMaterial.relayerKeyId,
+			clientParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "client")?.id,
+			relayerParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "relayer")?.id,
+			participantIds: signingContext.threshold.thresholdKeyMaterial.participants.map((p) => p.id),
+			thresholdSessionKind: "jwt",
+			thresholdSessionJwt: signingContext.threshold.thresholdSessionJwt
+		},
+		delegate: delegatePayload,
+		intentDigest,
+		transactionContext,
+		vrfChallenge,
+		credential
+	};
+	let okResponse;
+	try {
+		const resp = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: WorkerRequestType.SignDelegateAction,
+				payload: requestPayload
+			},
+			onEvent
+		});
+		okResponse = requireOkSignDelegateActionResponse(resp);
+	} catch (e) {
+		const err = e instanceof Error ? e : new Error(String(e));
+		if (!isThresholdSessionAuthUnavailableError(err)) throw err;
+		clearCachedThresholdEd25519AuthSession(signingContext.threshold.thresholdSessionCacheKey);
+		signingContext.threshold.thresholdSessionJwt = void 0;
+		requestPayload.threshold.thresholdSessionJwt = void 0;
+		if (!credential || !vrfChallenge) {
+			const refreshed = await vrfWorkerManager.confirmAndPrepareSigningSession({
+				ctx,
+				sessionId,
+				kind: "delegate",
+				signingAuthMode: "webauthn",
+				nearAccountId,
+				delegate: {
+					senderId: delegate.senderId || nearAccountId,
+					receiverId: delegate.receiverId,
+					actions: actionsWasm,
+					nonce: delegate.nonce,
+					maxBlockHeight: delegate.maxBlockHeight
+				},
+				rpcCall: resolvedRpcCall,
+				confirmationConfigOverride,
+				title,
+				body
+			});
+			({intentDigest, transactionContext, vrfChallenge, credential} = extractSigningEvidenceFromConfirmation(refreshed));
+			requestPayload.intentDigest = intentDigest;
+			requestPayload.transactionContext = transactionContext;
+			requestPayload.vrfChallenge = vrfChallenge;
+			requestPayload.credential = credential;
+		}
+		const resp = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: WorkerRequestType.SignDelegateAction,
+				payload: requestPayload
+			},
+			onEvent
+		});
+		okResponse = requireOkSignDelegateActionResponse(resp);
+	}
+	return {
+		signedDelegate: okResponse.payload.signedDelegate,
+		hash: okResponse.payload.hash,
+		nearAccountId: toAccountId(nearAccountId),
+		logs: [...okResponse.payload.logs || [], ...warnings]
+	};
+}
+function validateAndPrepareDelegateSigningContext(args) {
+	const localPublicKey = ensureEd25519Prefix(args.localKeyMaterial.publicKey);
+	if (!localPublicKey) throw new Error(`Missing local signing public key for ${args.nearAccountId}`);
+	const providedDelegatePublicKeyStr = ensureEd25519Prefix(toPublicKeyString(args.providedDelegatePublicKey));
+	if (args.resolvedSignerMode !== "threshold-signer") {
+		if (providedDelegatePublicKeyStr && providedDelegatePublicKeyStr !== localPublicKey) args.warnings.push(`Delegate public key ${providedDelegatePublicKeyStr} does not match local signer key; using ${localPublicKey}`);
+		return {
+			resolvedSignerMode: "local-signer",
+			signingNearPublicKeyStr: localPublicKey,
+			delegatePublicKeyStr: localPublicKey,
+			threshold: null
+		};
+	}
+	const thresholdKeyMaterial = args.thresholdKeyMaterial;
+	if (!thresholdKeyMaterial) throw new Error(`Missing threshold key material for ${args.nearAccountId}`);
+	const thresholdPublicKey = ensureEd25519Prefix(thresholdKeyMaterial.publicKey);
+	if (!thresholdPublicKey) throw new Error(`Missing threshold signing public key for ${args.nearAccountId}`);
+	if (providedDelegatePublicKeyStr && providedDelegatePublicKeyStr !== thresholdPublicKey) args.warnings.push(`Delegate public key ${providedDelegatePublicKeyStr} does not match threshold signer key; using ${thresholdPublicKey}`);
+	const relayerUrl = String(args.relayerUrl || "").trim();
+	if (!relayerUrl) throw new Error("Missing relayerUrl (required for threshold-signer)");
+	const rpId = String(args.rpId || "").trim();
+	if (!rpId) throw new Error("Missing rpId for threshold signing");
+	const participantIds = normalizeThresholdEd25519ParticipantIds(thresholdKeyMaterial.participants.map((p) => p.id));
+	if (!participantIds || participantIds.length < 2) throw new Error(`Invalid threshold signing participantIds (expected >=2 participants, got [${(participantIds || []).join(",")}])`);
+	const thresholdSessionCacheKey = makeThresholdEd25519AuthSessionCacheKey({
+		nearAccountId: args.nearAccountId,
+		rpId,
+		relayerUrl,
+		relayerKeyId: thresholdKeyMaterial.relayerKeyId,
+		participantIds
+	});
+	return {
+		resolvedSignerMode: "threshold-signer",
+		signingNearPublicKeyStr: thresholdPublicKey,
+		delegatePublicKeyStr: thresholdPublicKey,
+		threshold: {
+			relayerUrl,
+			thresholdKeyMaterial,
+			thresholdSessionCacheKey,
+			thresholdSessionJwt: getCachedThresholdEd25519AuthSessionJwt(thresholdSessionCacheKey)
+		}
+	};
+}
+function extractSigningEvidenceFromConfirmation(confirmation) {
+	const credentialForRelay = confirmation.credential ? removePrfOutputGuard(confirmation.credential) : void 0;
+	return {
+		intentDigest: confirmation.intentDigest,
+		transactionContext: confirmation.transactionContext,
+		vrfChallenge: confirmation.vrfChallenge,
+		credential: credentialForRelay ? JSON.stringify(credentialForRelay) : void 0
+	};
+}
+function requireOkSignDelegateActionResponse(response) {
+	if (!isSignDelegateActionSuccess(response)) {
+		if (isWorkerError(response)) throw new Error(response.payload.error || "Delegate action signing failed");
+		throw new Error("Delegate action signing failed");
+	}
+	if (!response.payload.success || !response.payload.signedDelegate || !response.payload.hash) throw new Error(response.payload.error || "Delegate action signing failed");
+	return response;
+}
+
+//#endregion
+export { signDelegateAction };
+//# sourceMappingURL=signDelegateAction.js.map

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/signDelegateAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signDelegateAction.js","names":["warnings: string[]","okResponse","okResponse: WorkerSuccessResponse<typeof WorkerRequestType.SignDelegateAction>","e: unknown","credentialForRelay: WebAuthnAuthenticationCredential | undefined"],"sources":["../../../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/signDelegateAction.ts"],"sourcesContent":["import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from '../../../defaultConfigs';\nimport { AccountId, toAccountId } from '../../../types/accountIds';\nimport { toActionArgsWasm, validateActionArgsWasm } from '../../../types/actions';\nimport { DelegateActionInput } from '../../../types/delegate';\nimport { type onProgressEvents } from '../../../types/sdkSentEvents';\nimport {\n  ConfirmationConfig,\n  RpcCallPayload,\n  type SignerMode,\n  WorkerRequestType,\n  type DelegateSignResponse,\n  isWorkerError,\n  isSignDelegateActionSuccess,\n  type WorkerSuccessResponse,\n  WasmSignedDelegate,\n} from '../../../types/signer-worker';\nimport type { WebAuthnAuthenticationCredential } from '../../../types';\nimport { removePrfOutputGuard } from '../../credentialsHelpers';\nimport { resolveSignerModeForThresholdSigning } from '../../../threshold/thresholdEd25519RelayerHealth';\nimport type {\n  LocalNearSkV3Material,\n  ThresholdEd25519_2p_V1Material,\n} from '../../../IndexedDBManager/passkeyNearKeysDB';\nimport type { TransactionContext } from '../../../types/rpc';\nimport type { VRFChallenge } from '../../../types/vrf-worker';\nimport {\n  clearCachedThresholdEd25519AuthSession,\n  getCachedThresholdEd25519AuthSessionJwt,\n  makeThresholdEd25519AuthSessionCacheKey,\n} from '../../../threshold/thresholdEd25519AuthSession';\nimport { isThresholdSessionAuthUnavailableError } from '../../../threshold/thresholdSessionPolicy';\nimport { normalizeThresholdEd25519ParticipantIds } from '../../../../threshold/participants';\nimport { SignerWorkerManagerContext } from '..';\nimport { getLastLoggedInDeviceNumber } from '../getDeviceNumber';\nimport { generateSessionId } from '../sessionHandshake.js';\nimport { ensureEd25519Prefix, toPublicKeyString } from './validation';\n\nexport async function signDelegateAction({\n  ctx,\n  delegate,\n  rpcCall,\n  signerMode,\n  onEvent,\n  confirmationConfigOverride,\n  title,\n  body,\n  sessionId: providedSessionId,\n}: {\n  ctx: SignerWorkerManagerContext;\n  delegate: DelegateActionInput;\n  rpcCall: RpcCallPayload;\n  signerMode: SignerMode;\n  onEvent?: (update: onProgressEvents) => void;\n  confirmationConfigOverride?: Partial<ConfirmationConfig>;\n  title?: string;\n  body?: string;\n  sessionId?: string;\n}): Promise<{\n  signedDelegate: WasmSignedDelegate;\n  hash: string;\n  nearAccountId: AccountId;\n  logs?: string[];\n}> {\n  const sessionId = providedSessionId ?? generateSessionId();\n  const nearAccountId = rpcCall.nearAccountId || delegate.senderId;\n  const relayerUrl = ctx.relayerUrl;\n\n  const resolvedRpcCall = {\n    contractId: rpcCall.contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId,\n    nearRpcUrl: rpcCall.nearRpcUrl || (PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl.split(',')[0] || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl),\n    nearAccountId,\n  } as RpcCallPayload;\n\n  const actionsWasm = delegate.actions.map(toActionArgsWasm);\n  actionsWasm.forEach((action, actionIndex) => {\n    try {\n      validateActionArgsWasm(action);\n    } catch (error) {\n      throw new Error(\n        `Delegate action ${actionIndex} validation failed: ${error instanceof Error ? error.message : String(error)}`\n      );\n    }\n  });\n\n  const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);\n  const [localKeyMaterial, thresholdKeyMaterial] = await Promise.all([\n    ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber),\n    ctx.indexedDB.nearKeysDB.getThresholdKeyMaterial(nearAccountId, deviceNumber),\n  ]);\n  if (!localKeyMaterial) {\n    throw new Error(`No local key material found for account: ${nearAccountId}`);\n  }\n\n  const warnings: string[] = [];\n  const vrfWorkerManager = ctx.vrfWorkerManager;\n  if (!vrfWorkerManager) {\n    throw new Error('VrfWorkerManager not available for delegate signing');\n  }\n\n  const resolvedSignerMode = await resolveSignerModeForThresholdSigning({\n    nearAccountId,\n    signerMode,\n    relayerUrl,\n    hasThresholdKeyMaterial: !!thresholdKeyMaterial,\n    warnings,\n  });\n\n  const signingContext = validateAndPrepareDelegateSigningContext({\n    nearAccountId,\n    resolvedSignerMode,\n    relayerUrl,\n    rpId: ctx.touchIdPrompt.getRpId(),\n    localKeyMaterial,\n    thresholdKeyMaterial,\n    providedDelegatePublicKey: delegate.publicKey,\n    warnings,\n  });\n\n  // Ensure nonce/block context is fetched for the same access key that will sign.\n  // Threshold signing MUST use the threshold/group public key (relayer access key) for:\n  // - correct nonce reservation\n  // - relayer scope checks (/authorize expects signingPayload.delegate.publicKey == relayer key)\n  ctx.nonceManager.initializeUser(toAccountId(nearAccountId), signingContext.signingNearPublicKeyStr);\n\n  const confirmation = await vrfWorkerManager.confirmAndPrepareSigningSession({\n    ctx,\n    sessionId,\n    kind: 'delegate',\n    ...(signingContext.threshold && !signingContext.threshold.thresholdSessionJwt ? { signingAuthMode: 'webauthn' } : {}),\n    nearAccountId,\n    delegate: {\n      senderId: delegate.senderId || nearAccountId,\n      receiverId: delegate.receiverId,\n      actions: actionsWasm,\n      nonce: delegate.nonce,\n      maxBlockHeight: delegate.maxBlockHeight,\n    },\n    rpcCall: resolvedRpcCall,\n    confirmationConfigOverride,\n    title,\n    body,\n  });\n\n  let { intentDigest, transactionContext, vrfChallenge, credential } =\n    extractSigningEvidenceFromConfirmation(confirmation);\n\n  const delegatePayload = {\n    senderId: delegate.senderId || nearAccountId,\n    receiverId: delegate.receiverId,\n    actions: actionsWasm,\n    nonce: delegate.nonce.toString(),\n    maxBlockHeight: delegate.maxBlockHeight.toString(),\n    publicKey: signingContext.delegatePublicKeyStr,\n  };\n\n  if (!signingContext.threshold) {\n    const response = await ctx.sendMessage<WorkerRequestType.SignDelegateAction>({\n      sessionId,\n      message: {\n        type: WorkerRequestType.SignDelegateAction,\n        payload: {\n          signerMode: signingContext.resolvedSignerMode,\n          rpcCall: resolvedRpcCall,\n          createdAt: Date.now(),\n          decryption: {\n            encryptedPrivateKeyData: localKeyMaterial.encryptedSk,\n            encryptedPrivateKeyChacha20NonceB64u: localKeyMaterial.chacha20NonceB64u,\n          },\n          delegate: delegatePayload,\n          intentDigest,\n          transactionContext,\n          credential,\n        },\n      },\n      onEvent,\n    });\n\n    const okResponse = requireOkSignDelegateActionResponse(response);\n    return {\n      signedDelegate: okResponse.payload.signedDelegate!,\n      hash: okResponse.payload.hash!,\n      nearAccountId: toAccountId(nearAccountId),\n      logs: [...(okResponse.payload.logs || []), ...warnings],\n    };\n  }\n\n  const requestPayload = {\n    signerMode: signingContext.resolvedSignerMode,\n    rpcCall: resolvedRpcCall,\n    createdAt: Date.now(),\n    decryption: {\n      encryptedPrivateKeyData: '',\n      encryptedPrivateKeyChacha20NonceB64u: '',\n    },\n    threshold: {\n      relayerUrl: signingContext.threshold.relayerUrl,\n      relayerKeyId: signingContext.threshold.thresholdKeyMaterial.relayerKeyId,\n      clientParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === 'client')?.id,\n      relayerParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === 'relayer')?.id,\n      participantIds: signingContext.threshold.thresholdKeyMaterial.participants.map((p) => p.id),\n      thresholdSessionKind: 'jwt' as const,\n      thresholdSessionJwt: signingContext.threshold.thresholdSessionJwt,\n    },\n    delegate: delegatePayload,\n    intentDigest,\n    transactionContext,\n    vrfChallenge,\n    credential,\n  };\n\n  let okResponse: WorkerSuccessResponse<typeof WorkerRequestType.SignDelegateAction>;\n  try {\n    const resp = await ctx.sendMessage<typeof WorkerRequestType.SignDelegateAction>({\n      sessionId,\n      message: { type: WorkerRequestType.SignDelegateAction, payload: requestPayload },\n      onEvent,\n    });\n    okResponse = requireOkSignDelegateActionResponse(resp);\n  } catch (e: unknown) {\n    const err = e instanceof Error ? e : new Error(String(e));\n    if (!isThresholdSessionAuthUnavailableError(err)) throw err;\n\n    clearCachedThresholdEd25519AuthSession(signingContext.threshold.thresholdSessionCacheKey);\n    signingContext.threshold.thresholdSessionJwt = undefined;\n    requestPayload.threshold.thresholdSessionJwt = undefined;\n\n    if (!credential || !vrfChallenge) {\n      const refreshed = await vrfWorkerManager.confirmAndPrepareSigningSession({\n        ctx,\n        sessionId,\n        kind: 'delegate',\n        signingAuthMode: 'webauthn',\n        nearAccountId,\n        delegate: {\n          senderId: delegate.senderId || nearAccountId,\n          receiverId: delegate.receiverId,\n          actions: actionsWasm,\n          nonce: delegate.nonce,\n          maxBlockHeight: delegate.maxBlockHeight,\n        },\n        rpcCall: resolvedRpcCall,\n        confirmationConfigOverride,\n        title,\n        body,\n      });\n\n      ({ intentDigest, transactionContext, vrfChallenge, credential } =\n        extractSigningEvidenceFromConfirmation(refreshed));\n\n      requestPayload.intentDigest = intentDigest;\n      requestPayload.transactionContext = transactionContext;\n      requestPayload.vrfChallenge = vrfChallenge;\n      requestPayload.credential = credential;\n    }\n\n    const resp = await ctx.sendMessage<typeof WorkerRequestType.SignDelegateAction>({\n      sessionId,\n      message: { type: WorkerRequestType.SignDelegateAction, payload: requestPayload },\n      onEvent,\n    });\n    okResponse = requireOkSignDelegateActionResponse(resp);\n  }\n\n  return {\n    signedDelegate: okResponse.payload.signedDelegate!,\n    hash: okResponse.payload.hash!,\n    nearAccountId: toAccountId(nearAccountId),\n    logs: [...(okResponse.payload.logs || []), ...warnings],\n  };\n}\n\ntype ThresholdDelegateSigningContext = {\n  resolvedSignerMode: 'threshold-signer';\n  signingNearPublicKeyStr: string;\n  delegatePublicKeyStr: string;\n  threshold: {\n    relayerUrl: string;\n    thresholdKeyMaterial: ThresholdEd25519_2p_V1Material;\n    thresholdSessionCacheKey: string;\n    thresholdSessionJwt: string | undefined;\n  };\n};\n\ntype LocalDelegateSigningContext = {\n  resolvedSignerMode: 'local-signer';\n  signingNearPublicKeyStr: string;\n  delegatePublicKeyStr: string;\n  threshold: null;\n};\n\ntype DelegateSigningContext = ThresholdDelegateSigningContext | LocalDelegateSigningContext;\n\nfunction validateAndPrepareDelegateSigningContext(args: {\n  nearAccountId: string;\n  resolvedSignerMode: SignerMode['mode'];\n  relayerUrl: string;\n  rpId: string | null;\n  localKeyMaterial: LocalNearSkV3Material;\n  thresholdKeyMaterial: ThresholdEd25519_2p_V1Material | null;\n  providedDelegatePublicKey: DelegateActionInput['publicKey'];\n  warnings: string[];\n}): DelegateSigningContext {\n  const localPublicKey = ensureEd25519Prefix(args.localKeyMaterial.publicKey);\n  if (!localPublicKey) {\n    throw new Error(`Missing local signing public key for ${args.nearAccountId}`);\n  }\n\n  const providedDelegatePublicKeyStr = ensureEd25519Prefix(toPublicKeyString(args.providedDelegatePublicKey));\n\n  if (args.resolvedSignerMode !== 'threshold-signer') {\n    if (providedDelegatePublicKeyStr && providedDelegatePublicKeyStr !== localPublicKey) {\n      args.warnings.push(\n        `Delegate public key ${providedDelegatePublicKeyStr} does not match local signer key; using ${localPublicKey}`\n      );\n    }\n    return {\n      resolvedSignerMode: 'local-signer',\n      signingNearPublicKeyStr: localPublicKey,\n      delegatePublicKeyStr: localPublicKey,\n      threshold: null,\n    };\n  }\n\n  const thresholdKeyMaterial = args.thresholdKeyMaterial;\n  if (!thresholdKeyMaterial) {\n    throw new Error(`Missing threshold key material for ${args.nearAccountId}`);\n  }\n\n  const thresholdPublicKey = ensureEd25519Prefix(thresholdKeyMaterial.publicKey);\n  if (!thresholdPublicKey) {\n    throw new Error(`Missing threshold signing public key for ${args.nearAccountId}`);\n  }\n\n  if (providedDelegatePublicKeyStr && providedDelegatePublicKeyStr !== thresholdPublicKey) {\n    args.warnings.push(\n      `Delegate public key ${providedDelegatePublicKeyStr} does not match threshold signer key; using ${thresholdPublicKey}`\n    );\n  }\n\n  const relayerUrl = String(args.relayerUrl || '').trim();\n  if (!relayerUrl) {\n    throw new Error('Missing relayerUrl (required for threshold-signer)');\n  }\n\n  const rpId = String(args.rpId || '').trim();\n  if (!rpId) {\n    throw new Error('Missing rpId for threshold signing');\n  }\n\n  const participantIds = normalizeThresholdEd25519ParticipantIds(thresholdKeyMaterial.participants.map((p) => p.id));\n  if (!participantIds || participantIds.length < 2) {\n    throw new Error(\n      `Invalid threshold signing participantIds (expected >=2 participants, got [${(participantIds || []).join(',')}])`\n    );\n  }\n\n  const thresholdSessionCacheKey = makeThresholdEd25519AuthSessionCacheKey({\n    nearAccountId: args.nearAccountId,\n    rpId,\n    relayerUrl,\n    relayerKeyId: thresholdKeyMaterial.relayerKeyId,\n    participantIds,\n  });\n\n  return {\n    resolvedSignerMode: 'threshold-signer',\n    signingNearPublicKeyStr: thresholdPublicKey,\n    delegatePublicKeyStr: thresholdPublicKey,\n    threshold: {\n      relayerUrl,\n      thresholdKeyMaterial,\n      thresholdSessionCacheKey,\n      thresholdSessionJwt: getCachedThresholdEd25519AuthSessionJwt(thresholdSessionCacheKey),\n    },\n  };\n}\n\nfunction extractSigningEvidenceFromConfirmation(confirmation: {\n  intentDigest: string;\n  transactionContext: TransactionContext;\n  vrfChallenge?: VRFChallenge;\n  credential?: unknown;\n}): {\n  intentDigest: string;\n  transactionContext: TransactionContext;\n  vrfChallenge: VRFChallenge | undefined;\n  credential: string | undefined;\n} {\n  const credentialForRelay: WebAuthnAuthenticationCredential | undefined = confirmation.credential\n    ? removePrfOutputGuard(confirmation.credential as WebAuthnAuthenticationCredential)\n    : undefined;\n\n  return {\n    intentDigest: confirmation.intentDigest,\n    transactionContext: confirmation.transactionContext,\n    vrfChallenge: confirmation.vrfChallenge,\n    credential: credentialForRelay ? JSON.stringify(credentialForRelay) : undefined,\n  };\n}\n\nfunction requireOkSignDelegateActionResponse(\n  response: DelegateSignResponse\n): WorkerSuccessResponse<typeof WorkerRequestType.SignDelegateAction> {\n  if (!isSignDelegateActionSuccess(response)) {\n    if (isWorkerError(response)) {\n      throw new Error(response.payload.error || 'Delegate action signing failed');\n    }\n    throw new Error('Delegate action signing failed');\n  }\n\n  if (!response.payload.success || !response.payload.signedDelegate || !response.payload.hash) {\n    throw new Error(response.payload.error || 'Delegate action signing failed');\n  }\n  return response;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAqCA,eAAsB,mBAAmB,EACvC,KACA,UACA,SACA,YACA,SACA,4BACA,OACA,MACA,WAAW,qBAgBV;CACD,MAAM,YAAY,qBAAqB;CACvC,MAAM,gBAAgB,QAAQ,iBAAiB,SAAS;CACxD,MAAM,aAAa,IAAI;CAEvB,MAAM,kBAAkB;EACtB,YAAY,QAAQ,cAAc,gCAAgC;EAClE,YAAY,QAAQ,cAAe,gCAAgC,WAAW,MAAM,KAAK,MAAM,gCAAgC;EAC/H;;CAGF,MAAM,cAAc,SAAS,QAAQ,IAAI;AACzC,aAAY,SAAS,QAAQ,gBAAgB;AAC3C,MAAI;AACF,0BAAuB;WAChB,OAAO;AACd,SAAM,IAAI,MACR,mBAAmB,YAAY,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,OAAO;;;CAK3G,MAAM,eAAe,MAAM,4BAA4B,eAAe,IAAI,UAAU;CACpF,MAAM,CAAC,kBAAkB,wBAAwB,MAAM,QAAQ,IAAI,CACjE,IAAI,UAAU,WAAW,oBAAoB,eAAe,eAC5D,IAAI,UAAU,WAAW,wBAAwB,eAAe;AAElE,KAAI,CAAC,iBACH,OAAM,IAAI,MAAM,4CAA4C;CAG9D,MAAMA,WAAqB;CAC3B,MAAM,mBAAmB,IAAI;AAC7B,KAAI,CAAC,iBACH,OAAM,IAAI,MAAM;CAGlB,MAAM,qBAAqB,MAAM,qCAAqC;EACpE;EACA;EACA;EACA,yBAAyB,CAAC,CAAC;EAC3B;;CAGF,MAAM,iBAAiB,yCAAyC;EAC9D;EACA;EACA;EACA,MAAM,IAAI,cAAc;EACxB;EACA;EACA,2BAA2B,SAAS;EACpC;;AAOF,KAAI,aAAa,eAAe,YAAY,gBAAgB,eAAe;CAE3E,MAAM,eAAe,MAAM,iBAAiB,gCAAgC;EAC1E;EACA;EACA,MAAM;EACN,GAAI,eAAe,aAAa,CAAC,eAAe,UAAU,sBAAsB,EAAE,iBAAiB,eAAe;EAClH;EACA,UAAU;GACR,UAAU,SAAS,YAAY;GAC/B,YAAY,SAAS;GACrB,SAAS;GACT,OAAO,SAAS;GAChB,gBAAgB,SAAS;;EAE3B,SAAS;EACT;EACA;EACA;;CAGF,IAAI,EAAE,cAAc,oBAAoB,cAAc,eACpD,uCAAuC;CAEzC,MAAM,kBAAkB;EACtB,UAAU,SAAS,YAAY;EAC/B,YAAY,SAAS;EACrB,SAAS;EACT,OAAO,SAAS,MAAM;EACtB,gBAAgB,SAAS,eAAe;EACxC,WAAW,eAAe;;AAG5B,KAAI,CAAC,eAAe,WAAW;EAC7B,MAAM,WAAW,MAAM,IAAI,YAAkD;GAC3E;GACA,SAAS;IACP,MAAM,kBAAkB;IACxB,SAAS;KACP,YAAY,eAAe;KAC3B,SAAS;KACT,WAAW,KAAK;KAChB,YAAY;MACV,yBAAyB,iBAAiB;MAC1C,sCAAsC,iBAAiB;;KAEzD,UAAU;KACV;KACA;KACA;;;GAGJ;;EAGF,MAAMC,eAAa,oCAAoC;AACvD,SAAO;GACL,gBAAgBA,aAAW,QAAQ;GACnC,MAAMA,aAAW,QAAQ;GACzB,eAAe,YAAY;GAC3B,MAAM,CAAC,GAAIA,aAAW,QAAQ,QAAQ,IAAK,GAAG;;;CAIlD,MAAM,iBAAiB;EACrB,YAAY,eAAe;EAC3B,SAAS;EACT,WAAW,KAAK;EAChB,YAAY;GACV,yBAAyB;GACzB,sCAAsC;;EAExC,WAAW;GACT,YAAY,eAAe,UAAU;GACrC,cAAc,eAAe,UAAU,qBAAqB;GAC5D,qBAAqB,eAAe,UAAU,qBAAqB,aAAa,MAAM,MAAM,EAAE,SAAS,WAAW;GAClH,sBAAsB,eAAe,UAAU,qBAAqB,aAAa,MAAM,MAAM,EAAE,SAAS,YAAY;GACpH,gBAAgB,eAAe,UAAU,qBAAqB,aAAa,KAAK,MAAM,EAAE;GACxF,sBAAsB;GACtB,qBAAqB,eAAe,UAAU;;EAEhD,UAAU;EACV;EACA;EACA;EACA;;CAGF,IAAIC;AACJ,KAAI;EACF,MAAM,OAAO,MAAM,IAAI,YAAyD;GAC9E;GACA,SAAS;IAAE,MAAM,kBAAkB;IAAoB,SAAS;;GAChE;;AAEF,eAAa,oCAAoC;UAC1CC,GAAY;EACnB,MAAM,MAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO;AACtD,MAAI,CAAC,uCAAuC,KAAM,OAAM;AAExD,yCAAuC,eAAe,UAAU;AAChE,iBAAe,UAAU,sBAAsB;AAC/C,iBAAe,UAAU,sBAAsB;AAE/C,MAAI,CAAC,cAAc,CAAC,cAAc;GAChC,MAAM,YAAY,MAAM,iBAAiB,gCAAgC;IACvE;IACA;IACA,MAAM;IACN,iBAAiB;IACjB;IACA,UAAU;KACR,UAAU,SAAS,YAAY;KAC/B,YAAY,SAAS;KACrB,SAAS;KACT,OAAO,SAAS;KAChB,gBAAgB,SAAS;;IAE3B,SAAS;IACT;IACA;IACA;;AAGF,IAAC,CAAE,cAAc,oBAAoB,cAAc,cACjD,uCAAuC;AAEzC,kBAAe,eAAe;AAC9B,kBAAe,qBAAqB;AACpC,kBAAe,eAAe;AAC9B,kBAAe,aAAa;;EAG9B,MAAM,OAAO,MAAM,IAAI,YAAyD;GAC9E;GACA,SAAS;IAAE,MAAM,kBAAkB;IAAoB,SAAS;;GAChE;;AAEF,eAAa,oCAAoC;;AAGnD,QAAO;EACL,gBAAgB,WAAW,QAAQ;EACnC,MAAM,WAAW,QAAQ;EACzB,eAAe,YAAY;EAC3B,MAAM,CAAC,GAAI,WAAW,QAAQ,QAAQ,IAAK,GAAG;;;AAyBlD,SAAS,yCAAyC,MASvB;CACzB,MAAM,iBAAiB,oBAAoB,KAAK,iBAAiB;AACjE,KAAI,CAAC,eACH,OAAM,IAAI,MAAM,wCAAwC,KAAK;CAG/D,MAAM,+BAA+B,oBAAoB,kBAAkB,KAAK;AAEhF,KAAI,KAAK,uBAAuB,oBAAoB;AAClD,MAAI,gCAAgC,iCAAiC,eACnE,MAAK,SAAS,KACZ,uBAAuB,6BAA6B,0CAA0C;AAGlG,SAAO;GACL,oBAAoB;GACpB,yBAAyB;GACzB,sBAAsB;GACtB,WAAW;;;CAIf,MAAM,uBAAuB,KAAK;AAClC,KAAI,CAAC,qBACH,OAAM,IAAI,MAAM,sCAAsC,KAAK;CAG7D,MAAM,qBAAqB,oBAAoB,qBAAqB;AACpE,KAAI,CAAC,mBACH,OAAM,IAAI,MAAM,4CAA4C,KAAK;AAGnE,KAAI,gCAAgC,iCAAiC,mBACnE,MAAK,SAAS,KACZ,uBAAuB,6BAA6B,8CAA8C;CAItG,MAAM,aAAa,OAAO,KAAK,cAAc,IAAI;AACjD,KAAI,CAAC,WACH,OAAM,IAAI,MAAM;CAGlB,MAAM,OAAO,OAAO,KAAK,QAAQ,IAAI;AACrC,KAAI,CAAC,KACH,OAAM,IAAI,MAAM;CAGlB,MAAM,iBAAiB,wCAAwC,qBAAqB,aAAa,KAAK,MAAM,EAAE;AAC9G,KAAI,CAAC,kBAAkB,eAAe,SAAS,EAC7C,OAAM,IAAI,MACR,8EAA8E,kBAAkB,IAAI,KAAK,KAAK;CAIlH,MAAM,2BAA2B,wCAAwC;EACvE,eAAe,KAAK;EACpB;EACA;EACA,cAAc,qBAAqB;EACnC;;AAGF,QAAO;EACL,oBAAoB;EACpB,yBAAyB;EACzB,sBAAsB;EACtB,WAAW;GACT;GACA;GACA;GACA,qBAAqB,wCAAwC;;;;AAKnE,SAAS,uCAAuC,cAU9C;CACA,MAAMC,qBAAmE,aAAa,aAClF,qBAAqB,aAAa,cAClC;AAEJ,QAAO;EACL,cAAc,aAAa;EAC3B,oBAAoB,aAAa;EACjC,cAAc,aAAa;EAC3B,YAAY,qBAAqB,KAAK,UAAU,sBAAsB;;;AAI1E,SAAS,oCACP,UACoE;AACpE,KAAI,CAAC,4BAA4B,WAAW;AAC1C,MAAI,cAAc,UAChB,OAAM,IAAI,MAAM,SAAS,QAAQ,SAAS;AAE5C,QAAM,IAAI,MAAM;;AAGlB,KAAI,CAAC,SAAS,QAAQ,WAAW,CAAC,SAAS,QAAQ,kBAAkB,CAAC,SAAS,QAAQ,KACrF,OAAM,IAAI,MAAM,SAAS,QAAQ,SAAS;AAE5C,QAAO"}

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/signNep413Message.js

@@ -0,0 +1,217 @@
+import { WorkerRequestType, isSignNep413MessageSuccess, isWorkerError } from "../../../types/signer-worker.js";
+import { normalizeThresholdEd25519ParticipantIds } from "../../../../threshold/participants.js";
+import { removePrfOutputGuard } from "../../credentialsHelpers.js";
+import { getLastLoggedInDeviceNumber } from "../getDeviceNumber.js";
+import { generateSessionId } from "../sessionHandshake.js";
+import { resolveSignerModeForThresholdSigning } from "../../../threshold/thresholdEd25519RelayerHealth.js";
+import { clearCachedThresholdEd25519AuthSession, getCachedThresholdEd25519AuthSessionJwt, makeThresholdEd25519AuthSessionCacheKey } from "../../../threshold/thresholdEd25519AuthSession.js";
+import { isThresholdSessionAuthUnavailableError } from "../../../threshold/thresholdSessionPolicy.js";
+
+//#region src/core/WebAuthnManager/SignerWorkerManager/handlers/signNep413Message.ts
+/**
+* Sign a NEP-413 message using the user's passkey-derived private key
+*
+* @param payload - NEP-413 signing parameters including message, recipient, nonce, and state
+* @returns Promise resolving to signing result with account ID, public key, and signature
+*/
+async function signNep413Message({ ctx, payload }) {
+	try {
+		const sessionId = payload.sessionId ?? generateSessionId();
+		const relayerUrl = ctx.relayerUrl;
+		const nearAccountId = payload.accountId;
+		const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);
+		const [localKeyMaterial, thresholdKeyMaterial] = await Promise.all([ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber), ctx.indexedDB.nearKeysDB.getThresholdKeyMaterial(nearAccountId, deviceNumber)]);
+		if (!localKeyMaterial) throw new Error(`No local key material found for account: ${nearAccountId}`);
+		const resolvedSignerMode = await resolveSignerModeForThresholdSigning({
+			nearAccountId,
+			signerMode: payload.signerMode,
+			relayerUrl,
+			hasThresholdKeyMaterial: !!thresholdKeyMaterial
+		});
+		const vrfWorkerManager = ctx.vrfWorkerManager;
+		if (!vrfWorkerManager) throw new Error("VrfWorkerManager not available for NEP-413 signing");
+		const signingContext = validateAndPrepareNep413SigningContext({
+			nearAccountId,
+			resolvedSignerMode,
+			relayerUrl,
+			rpId: ctx.touchIdPrompt.getRpId(),
+			localKeyMaterial,
+			thresholdKeyMaterial
+		});
+		const confirmation = await vrfWorkerManager.confirmAndPrepareSigningSession({
+			ctx,
+			sessionId,
+			kind: "nep413",
+			...signingContext.threshold && !signingContext.threshold.thresholdSessionJwt ? { signingAuthMode: "webauthn" } : {},
+			nearAccountId,
+			message: payload.message,
+			recipient: payload.recipient,
+			title: payload.title,
+			body: payload.body,
+			confirmationConfigOverride: payload.confirmationConfigOverride,
+			contractId: payload.contractId,
+			nearRpcUrl: payload.nearRpcUrl
+		});
+		let { vrfChallenge, credential } = extractSigningEvidenceFromConfirmation(confirmation);
+		const requestPayload = {
+			signerMode: signingContext.resolvedSignerMode,
+			message: payload.message,
+			recipient: payload.recipient,
+			nonce: payload.nonce,
+			state: payload.state || void 0,
+			accountId: nearAccountId,
+			nearPublicKey: signingContext.nearPublicKey,
+			decryption: signingContext.decryption,
+			threshold: signingContext.threshold ? {
+				relayerUrl: signingContext.threshold.relayerUrl,
+				relayerKeyId: signingContext.threshold.thresholdKeyMaterial.relayerKeyId,
+				clientParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "client")?.id,
+				relayerParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "relayer")?.id,
+				participantIds: signingContext.threshold.thresholdKeyMaterial.participants.map((p) => p.id),
+				thresholdSessionKind: "jwt",
+				thresholdSessionJwt: signingContext.threshold.thresholdSessionJwt
+			} : void 0,
+			vrfChallenge,
+			credential
+		};
+		if (!signingContext.threshold) {
+			const response = await ctx.sendMessage({
+				sessionId,
+				message: {
+					type: WorkerRequestType.SignNep413Message,
+					payload: requestPayload
+				}
+			});
+			const okResponse$1 = requireOkSignNep413MessageResponse(response);
+			return {
+				success: true,
+				accountId: okResponse$1.payload.accountId,
+				publicKey: okResponse$1.payload.publicKey,
+				signature: okResponse$1.payload.signature,
+				state: okResponse$1.payload.state || void 0
+			};
+		}
+		let okResponse;
+		try {
+			const response = await ctx.sendMessage({
+				sessionId,
+				message: {
+					type: WorkerRequestType.SignNep413Message,
+					payload: requestPayload
+				}
+			});
+			okResponse = requireOkSignNep413MessageResponse(response);
+		} catch (e) {
+			const err = e instanceof Error ? e : new Error(String(e));
+			if (!isThresholdSessionAuthUnavailableError(err)) throw err;
+			clearCachedThresholdEd25519AuthSession(signingContext.threshold.thresholdSessionCacheKey);
+			signingContext.threshold.thresholdSessionJwt = void 0;
+			requestPayload.threshold.thresholdSessionJwt = void 0;
+			if (!credential || !vrfChallenge) {
+				const refreshed = await vrfWorkerManager.confirmAndPrepareSigningSession({
+					ctx,
+					sessionId,
+					kind: "nep413",
+					signingAuthMode: "webauthn",
+					nearAccountId,
+					message: payload.message,
+					recipient: payload.recipient,
+					title: payload.title,
+					body: payload.body,
+					confirmationConfigOverride: payload.confirmationConfigOverride,
+					contractId: payload.contractId,
+					nearRpcUrl: payload.nearRpcUrl
+				});
+				({vrfChallenge, credential} = extractSigningEvidenceFromConfirmation(refreshed));
+				requestPayload.vrfChallenge = vrfChallenge;
+				requestPayload.credential = credential;
+			}
+			const response = await ctx.sendMessage({
+				sessionId,
+				message: {
+					type: WorkerRequestType.SignNep413Message,
+					payload: requestPayload
+				}
+			});
+			okResponse = requireOkSignNep413MessageResponse(response);
+		}
+		return {
+			success: true,
+			accountId: okResponse.payload.accountId,
+			publicKey: okResponse.payload.publicKey,
+			signature: okResponse.payload.signature,
+			state: okResponse.payload.state || void 0
+		};
+	} catch (error) {
+		console.error("SignerWorkerManager: NEP-413 signing error:", error);
+		return {
+			success: false,
+			accountId: "",
+			publicKey: "",
+			signature: "",
+			error: error && typeof error.message === "string" ? error.message : "Unknown error"
+		};
+	}
+}
+function validateAndPrepareNep413SigningContext(args) {
+	const localPublicKey = String(args.localKeyMaterial.publicKey || "").trim();
+	if (!localPublicKey) throw new Error(`Missing local signing public key for ${args.nearAccountId}`);
+	if (args.resolvedSignerMode !== "threshold-signer") return {
+		resolvedSignerMode: "local-signer",
+		nearPublicKey: localPublicKey,
+		decryption: {
+			encryptedPrivateKeyData: args.localKeyMaterial.encryptedSk,
+			encryptedPrivateKeyChacha20NonceB64u: args.localKeyMaterial.chacha20NonceB64u
+		},
+		threshold: null
+	};
+	const thresholdKeyMaterial = args.thresholdKeyMaterial;
+	if (!thresholdKeyMaterial) throw new Error(`Missing threshold key material for ${args.nearAccountId}`);
+	const thresholdPublicKey = String(thresholdKeyMaterial.publicKey || "").trim();
+	if (!thresholdPublicKey) throw new Error(`Missing threshold signing public key for ${args.nearAccountId}`);
+	const relayerUrl = String(args.relayerUrl || "").trim();
+	if (!relayerUrl) throw new Error("Missing relayerUrl (required for threshold-signer)");
+	const rpId = String(args.rpId || "").trim();
+	if (!rpId) throw new Error("Missing rpId for threshold signing");
+	const participantIds = normalizeThresholdEd25519ParticipantIds(thresholdKeyMaterial.participants.map((p) => p.id));
+	if (!participantIds || participantIds.length < 2) throw new Error(`Invalid threshold signing participantIds (expected >=2 participants, got [${(participantIds || []).join(",")}])`);
+	const thresholdSessionCacheKey = makeThresholdEd25519AuthSessionCacheKey({
+		nearAccountId: args.nearAccountId,
+		rpId,
+		relayerUrl,
+		relayerKeyId: thresholdKeyMaterial.relayerKeyId,
+		participantIds
+	});
+	return {
+		resolvedSignerMode: "threshold-signer",
+		nearPublicKey: thresholdPublicKey,
+		decryption: {
+			encryptedPrivateKeyData: "",
+			encryptedPrivateKeyChacha20NonceB64u: ""
+		},
+		threshold: {
+			relayerUrl,
+			thresholdKeyMaterial,
+			thresholdSessionCacheKey,
+			thresholdSessionJwt: getCachedThresholdEd25519AuthSessionJwt(thresholdSessionCacheKey)
+		}
+	};
+}
+function extractSigningEvidenceFromConfirmation(confirmation) {
+	const credentialForRelay = confirmation.credential ? removePrfOutputGuard(confirmation.credential) : void 0;
+	return {
+		vrfChallenge: confirmation.vrfChallenge,
+		credential: credentialForRelay ? JSON.stringify(credentialForRelay) : void 0
+	};
+}
+function requireOkSignNep413MessageResponse(response) {
+	if (!isSignNep413MessageSuccess(response)) {
+		if (isWorkerError(response)) throw new Error(response.payload.error || "NEP-413 signing failed");
+		throw new Error("NEP-413 signing failed");
+	}
+	return response;
+}
+
+//#endregion
+export { signNep413Message };
+//# sourceMappingURL=signNep413Message.js.map

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/signNep413Message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signNep413Message.js","names":["okResponse","okResponse: WorkerSuccessResponse<typeof WorkerRequestType.SignNep413Message>","e: unknown","error: unknown","credentialForRelay: WebAuthnAuthenticationCredential | undefined"],"sources":["../../../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/signNep413Message.ts"],"sourcesContent":["import {\n  WorkerRequestType,\n  isSignNep413MessageSuccess,\n  isWorkerError,\n  type ConfirmationConfig,\n  type Nep413SigningResponse,\n  type SignerMode,\n  type WorkerSuccessResponse,\n} from '../../../types/signer-worker';\nimport type { WebAuthnAuthenticationCredential } from '../../../types';\nimport { removePrfOutputGuard } from '../../credentialsHelpers';\nimport { resolveSignerModeForThresholdSigning } from '../../../threshold/thresholdEd25519RelayerHealth';\nimport type {\n  LocalNearSkV3Material,\n  ThresholdEd25519_2p_V1Material,\n} from '../../../IndexedDBManager/passkeyNearKeysDB';\nimport type { VRFChallenge } from '../../../types/vrf-worker';\nimport {\n  clearCachedThresholdEd25519AuthSession,\n  getCachedThresholdEd25519AuthSessionJwt,\n  makeThresholdEd25519AuthSessionCacheKey,\n} from '../../../threshold/thresholdEd25519AuthSession';\nimport { isThresholdSessionAuthUnavailableError } from '../../../threshold/thresholdSessionPolicy';\nimport { normalizeThresholdEd25519ParticipantIds } from '../../../../threshold/participants';\nimport { getLastLoggedInDeviceNumber } from '../getDeviceNumber';\nimport { generateSessionId } from '../sessionHandshake.js';\nimport { SignerWorkerManagerContext } from '..';\n\n/**\n * Sign a NEP-413 message using the user's passkey-derived private key\n *\n * @param payload - NEP-413 signing parameters including message, recipient, nonce, and state\n * @returns Promise resolving to signing result with account ID, public key, and signature\n */\nexport async function signNep413Message({ ctx, payload }: {\n  ctx: SignerWorkerManagerContext;\n  payload: {\n    message: string;\n    recipient: string;\n    nonce: string;\n    state: string | null;\n    accountId: string;\n    signerMode: SignerMode;\n    title?: string;\n    body?: string;\n    confirmationConfigOverride?: Partial<ConfirmationConfig>;\n    sessionId?: string;\n    contractId?: string;\n    nearRpcUrl?: string;\n  };\n}): Promise<{\n  success: boolean;\n  accountId: string;\n  publicKey: string;\n  signature: string;\n  state?: string;\n  error?: string;\n}> {\n  try {\n    const sessionId = payload.sessionId ?? generateSessionId();\n    const relayerUrl = ctx.relayerUrl;\n    const nearAccountId = payload.accountId;\n\n    const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);\n    const [localKeyMaterial, thresholdKeyMaterial] = await Promise.all([\n      ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber),\n      ctx.indexedDB.nearKeysDB.getThresholdKeyMaterial(nearAccountId, deviceNumber),\n    ]);\n    if (!localKeyMaterial) {\n      throw new Error(`No local key material found for account: ${nearAccountId}`);\n    }\n\n    const resolvedSignerMode = await resolveSignerModeForThresholdSigning({\n      nearAccountId,\n      signerMode: payload.signerMode,\n      relayerUrl,\n      hasThresholdKeyMaterial: !!thresholdKeyMaterial,\n    });\n\n    const vrfWorkerManager = ctx.vrfWorkerManager;\n    if (!vrfWorkerManager) {\n      throw new Error('VrfWorkerManager not available for NEP-413 signing');\n    }\n\n    const signingContext = validateAndPrepareNep413SigningContext({\n      nearAccountId,\n      resolvedSignerMode,\n      relayerUrl,\n      rpId: ctx.touchIdPrompt.getRpId(),\n      localKeyMaterial,\n      thresholdKeyMaterial,\n    });\n\n    const confirmation = await vrfWorkerManager.confirmAndPrepareSigningSession({\n      ctx,\n      sessionId,\n      kind: 'nep413',\n      ...(signingContext.threshold && !signingContext.threshold.thresholdSessionJwt\n        ? { signingAuthMode: 'webauthn' }\n        : {}),\n      nearAccountId,\n      message: payload.message,\n      recipient: payload.recipient,\n      title: payload.title,\n      body: payload.body,\n      confirmationConfigOverride: payload.confirmationConfigOverride,\n      contractId: payload.contractId,\n      nearRpcUrl: payload.nearRpcUrl,\n    });\n\n    let { vrfChallenge, credential } = extractSigningEvidenceFromConfirmation(confirmation);\n\n    const requestPayload = {\n      signerMode: signingContext.resolvedSignerMode,\n      message: payload.message,\n      recipient: payload.recipient,\n      nonce: payload.nonce,\n      state: payload.state || undefined,\n      accountId: nearAccountId,\n      nearPublicKey: signingContext.nearPublicKey,\n      decryption: signingContext.decryption,\n      threshold: signingContext.threshold\n        ? {\n          relayerUrl: signingContext.threshold.relayerUrl,\n          relayerKeyId: signingContext.threshold.thresholdKeyMaterial.relayerKeyId,\n          clientParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === 'client')?.id,\n          relayerParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === 'relayer')?.id,\n          participantIds: signingContext.threshold.thresholdKeyMaterial.participants.map((p) => p.id),\n          thresholdSessionKind: 'jwt' as const,\n          thresholdSessionJwt: signingContext.threshold.thresholdSessionJwt,\n        }\n        : undefined,\n      vrfChallenge,\n      credential,\n    };\n\n    if (!signingContext.threshold) {\n      const response = await ctx.sendMessage<typeof WorkerRequestType.SignNep413Message>({\n        sessionId,\n        message: { type: WorkerRequestType.SignNep413Message, payload: requestPayload },\n      });\n      const okResponse = requireOkSignNep413MessageResponse(response);\n\n      return {\n        success: true,\n        accountId: okResponse.payload.accountId,\n        publicKey: okResponse.payload.publicKey,\n        signature: okResponse.payload.signature,\n        state: okResponse.payload.state || undefined,\n      };\n    }\n\n    let okResponse: WorkerSuccessResponse<typeof WorkerRequestType.SignNep413Message>;\n    try {\n      const response = await ctx.sendMessage<typeof WorkerRequestType.SignNep413Message>({\n        sessionId,\n        message: { type: WorkerRequestType.SignNep413Message, payload: requestPayload },\n      });\n      okResponse = requireOkSignNep413MessageResponse(response);\n    } catch (e: unknown) {\n      const err = e instanceof Error ? e : new Error(String(e));\n      if (!isThresholdSessionAuthUnavailableError(err)) throw err;\n\n      clearCachedThresholdEd25519AuthSession(signingContext.threshold.thresholdSessionCacheKey);\n      signingContext.threshold.thresholdSessionJwt = undefined;\n      requestPayload.threshold!.thresholdSessionJwt = undefined;\n\n      if (!credential || !vrfChallenge) {\n        const refreshed = await vrfWorkerManager.confirmAndPrepareSigningSession({\n          ctx,\n          sessionId,\n          kind: 'nep413',\n          signingAuthMode: 'webauthn',\n          nearAccountId,\n          message: payload.message,\n          recipient: payload.recipient,\n          title: payload.title,\n          body: payload.body,\n          confirmationConfigOverride: payload.confirmationConfigOverride,\n          contractId: payload.contractId,\n          nearRpcUrl: payload.nearRpcUrl,\n        });\n\n        ({ vrfChallenge, credential } = extractSigningEvidenceFromConfirmation(refreshed));\n\n        requestPayload.vrfChallenge = vrfChallenge;\n        requestPayload.credential = credential;\n      }\n\n      const response = await ctx.sendMessage<typeof WorkerRequestType.SignNep413Message>({\n        sessionId,\n        message: { type: WorkerRequestType.SignNep413Message, payload: requestPayload },\n      });\n      okResponse = requireOkSignNep413MessageResponse(response);\n    }\n\n    return {\n      success: true,\n      accountId: okResponse.payload.accountId,\n      publicKey: okResponse.payload.publicKey,\n      signature: okResponse.payload.signature,\n      state: okResponse.payload.state || undefined,\n    };\n  } catch (error: unknown) {\n    // eslint-disable-next-line no-console\n    console.error('SignerWorkerManager: NEP-413 signing error:', error);\n    return {\n      success: false,\n      accountId: '',\n      publicKey: '',\n      signature: '',\n      error: (error && typeof (error as { message?: unknown }).message === 'string')\n        ? (error as { message: string }).message\n        : 'Unknown error'\n    };\n  }\n}\n\ntype ThresholdNep413SigningContext = {\n  resolvedSignerMode: 'threshold-signer';\n  nearPublicKey: string;\n  decryption: { encryptedPrivateKeyData: string; encryptedPrivateKeyChacha20NonceB64u: string };\n  threshold: {\n    relayerUrl: string;\n    thresholdKeyMaterial: ThresholdEd25519_2p_V1Material;\n    thresholdSessionCacheKey: string;\n    thresholdSessionJwt: string | undefined;\n  };\n};\n\ntype LocalNep413SigningContext = {\n  resolvedSignerMode: 'local-signer';\n  nearPublicKey: string;\n  decryption: { encryptedPrivateKeyData: string; encryptedPrivateKeyChacha20NonceB64u: string };\n  threshold: null;\n};\n\ntype Nep413SigningContext = ThresholdNep413SigningContext | LocalNep413SigningContext;\n\nfunction validateAndPrepareNep413SigningContext(args: {\n  nearAccountId: string;\n  resolvedSignerMode: SignerMode['mode'];\n  relayerUrl: string;\n  rpId: string | null;\n  localKeyMaterial: LocalNearSkV3Material;\n  thresholdKeyMaterial: ThresholdEd25519_2p_V1Material | null;\n}): Nep413SigningContext {\n  const localPublicKey = String(args.localKeyMaterial.publicKey || '').trim();\n  if (!localPublicKey) {\n    throw new Error(`Missing local signing public key for ${args.nearAccountId}`);\n  }\n\n  if (args.resolvedSignerMode !== 'threshold-signer') {\n    return {\n      resolvedSignerMode: 'local-signer',\n      nearPublicKey: localPublicKey,\n      decryption: {\n        encryptedPrivateKeyData: args.localKeyMaterial.encryptedSk,\n        encryptedPrivateKeyChacha20NonceB64u: args.localKeyMaterial.chacha20NonceB64u,\n      },\n      threshold: null,\n    };\n  }\n\n  const thresholdKeyMaterial = args.thresholdKeyMaterial;\n  if (!thresholdKeyMaterial) {\n    throw new Error(`Missing threshold key material for ${args.nearAccountId}`);\n  }\n\n  const thresholdPublicKey = String(thresholdKeyMaterial.publicKey || '').trim();\n  if (!thresholdPublicKey) {\n    throw new Error(`Missing threshold signing public key for ${args.nearAccountId}`);\n  }\n\n  const relayerUrl = String(args.relayerUrl || '').trim();\n  if (!relayerUrl) {\n    throw new Error('Missing relayerUrl (required for threshold-signer)');\n  }\n\n  const rpId = String(args.rpId || '').trim();\n  if (!rpId) {\n    throw new Error('Missing rpId for threshold signing');\n  }\n\n  const participantIds = normalizeThresholdEd25519ParticipantIds(thresholdKeyMaterial.participants.map((p) => p.id));\n  if (!participantIds || participantIds.length < 2) {\n    throw new Error(\n      `Invalid threshold signing participantIds (expected >=2 participants, got [${(participantIds || []).join(',')}])`\n    );\n  }\n\n  const thresholdSessionCacheKey = makeThresholdEd25519AuthSessionCacheKey({\n    nearAccountId: args.nearAccountId,\n    rpId,\n    relayerUrl,\n    relayerKeyId: thresholdKeyMaterial.relayerKeyId,\n    participantIds,\n  });\n\n  return {\n    resolvedSignerMode: 'threshold-signer',\n    nearPublicKey: thresholdPublicKey,\n    decryption: {\n      encryptedPrivateKeyData: '',\n      encryptedPrivateKeyChacha20NonceB64u: '',\n    },\n    threshold: {\n      relayerUrl,\n      thresholdKeyMaterial,\n      thresholdSessionCacheKey,\n      thresholdSessionJwt: getCachedThresholdEd25519AuthSessionJwt(thresholdSessionCacheKey),\n    },\n  };\n}\n\nfunction extractSigningEvidenceFromConfirmation(confirmation: {\n  vrfChallenge?: VRFChallenge;\n  credential?: unknown;\n}): {\n  vrfChallenge: VRFChallenge | undefined;\n  credential: string | undefined;\n} {\n  const credentialForRelay: WebAuthnAuthenticationCredential | undefined = confirmation.credential\n    ? removePrfOutputGuard(confirmation.credential as WebAuthnAuthenticationCredential)\n    : undefined;\n\n  return {\n    vrfChallenge: confirmation.vrfChallenge,\n    credential: credentialForRelay ? JSON.stringify(credentialForRelay) : undefined,\n  };\n}\n\nfunction requireOkSignNep413MessageResponse(\n  response: Nep413SigningResponse,\n): WorkerSuccessResponse<typeof WorkerRequestType.SignNep413Message> {\n  if (!isSignNep413MessageSuccess(response)) {\n    if (isWorkerError(response)) {\n      throw new Error(response.payload.error || 'NEP-413 signing failed');\n    }\n    throw new Error('NEP-413 signing failed');\n  }\n  return response;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkCA,eAAsB,kBAAkB,EAAE,KAAK,WAuB5C;AACD,KAAI;EACF,MAAM,YAAY,QAAQ,aAAa;EACvC,MAAM,aAAa,IAAI;EACvB,MAAM,gBAAgB,QAAQ;EAE9B,MAAM,eAAe,MAAM,4BAA4B,eAAe,IAAI,UAAU;EACpF,MAAM,CAAC,kBAAkB,wBAAwB,MAAM,QAAQ,IAAI,CACjE,IAAI,UAAU,WAAW,oBAAoB,eAAe,eAC5D,IAAI,UAAU,WAAW,wBAAwB,eAAe;AAElE,MAAI,CAAC,iBACH,OAAM,IAAI,MAAM,4CAA4C;EAG9D,MAAM,qBAAqB,MAAM,qCAAqC;GACpE;GACA,YAAY,QAAQ;GACpB;GACA,yBAAyB,CAAC,CAAC;;EAG7B,MAAM,mBAAmB,IAAI;AAC7B,MAAI,CAAC,iBACH,OAAM,IAAI,MAAM;EAGlB,MAAM,iBAAiB,uCAAuC;GAC5D;GACA;GACA;GACA,MAAM,IAAI,cAAc;GACxB;GACA;;EAGF,MAAM,eAAe,MAAM,iBAAiB,gCAAgC;GAC1E;GACA;GACA,MAAM;GACN,GAAI,eAAe,aAAa,CAAC,eAAe,UAAU,sBACtD,EAAE,iBAAiB,eACnB;GACJ;GACA,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB,OAAO,QAAQ;GACf,MAAM,QAAQ;GACd,4BAA4B,QAAQ;GACpC,YAAY,QAAQ;GACpB,YAAY,QAAQ;;EAGtB,IAAI,EAAE,cAAc,eAAe,uCAAuC;EAE1E,MAAM,iBAAiB;GACrB,YAAY,eAAe;GAC3B,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB,OAAO,QAAQ;GACf,OAAO,QAAQ,SAAS;GACxB,WAAW;GACX,eAAe,eAAe;GAC9B,YAAY,eAAe;GAC3B,WAAW,eAAe,YACtB;IACA,YAAY,eAAe,UAAU;IACrC,cAAc,eAAe,UAAU,qBAAqB;IAC5D,qBAAqB,eAAe,UAAU,qBAAqB,aAAa,MAAM,MAAM,EAAE,SAAS,WAAW;IAClH,sBAAsB,eAAe,UAAU,qBAAqB,aAAa,MAAM,MAAM,EAAE,SAAS,YAAY;IACpH,gBAAgB,eAAe,UAAU,qBAAqB,aAAa,KAAK,MAAM,EAAE;IACxF,sBAAsB;IACtB,qBAAqB,eAAe,UAAU;OAE9C;GACJ;GACA;;AAGF,MAAI,CAAC,eAAe,WAAW;GAC7B,MAAM,WAAW,MAAM,IAAI,YAAwD;IACjF;IACA,SAAS;KAAE,MAAM,kBAAkB;KAAmB,SAAS;;;GAEjE,MAAMA,eAAa,mCAAmC;AAEtD,UAAO;IACL,SAAS;IACT,WAAWA,aAAW,QAAQ;IAC9B,WAAWA,aAAW,QAAQ;IAC9B,WAAWA,aAAW,QAAQ;IAC9B,OAAOA,aAAW,QAAQ,SAAS;;;EAIvC,IAAIC;AACJ,MAAI;GACF,MAAM,WAAW,MAAM,IAAI,YAAwD;IACjF;IACA,SAAS;KAAE,MAAM,kBAAkB;KAAmB,SAAS;;;AAEjE,gBAAa,mCAAmC;WACzCC,GAAY;GACnB,MAAM,MAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO;AACtD,OAAI,CAAC,uCAAuC,KAAM,OAAM;AAExD,0CAAuC,eAAe,UAAU;AAChE,kBAAe,UAAU,sBAAsB;AAC/C,kBAAe,UAAW,sBAAsB;AAEhD,OAAI,CAAC,cAAc,CAAC,cAAc;IAChC,MAAM,YAAY,MAAM,iBAAiB,gCAAgC;KACvE;KACA;KACA,MAAM;KACN,iBAAiB;KACjB;KACA,SAAS,QAAQ;KACjB,WAAW,QAAQ;KACnB,OAAO,QAAQ;KACf,MAAM,QAAQ;KACd,4BAA4B,QAAQ;KACpC,YAAY,QAAQ;KACpB,YAAY,QAAQ;;AAGtB,KAAC,CAAE,cAAc,cAAe,uCAAuC;AAEvE,mBAAe,eAAe;AAC9B,mBAAe,aAAa;;GAG9B,MAAM,WAAW,MAAM,IAAI,YAAwD;IACjF;IACA,SAAS;KAAE,MAAM,kBAAkB;KAAmB,SAAS;;;AAEjE,gBAAa,mCAAmC;;AAGlD,SAAO;GACL,SAAS;GACT,WAAW,WAAW,QAAQ;GAC9B,WAAW,WAAW,QAAQ;GAC9B,WAAW,WAAW,QAAQ;GAC9B,OAAO,WAAW,QAAQ,SAAS;;UAE9BC,OAAgB;AAEvB,UAAQ,MAAM,+CAA+C;AAC7D,SAAO;GACL,SAAS;GACT,WAAW;GACX,WAAW;GACX,WAAW;GACX,OAAQ,SAAS,OAAQ,MAAgC,YAAY,WAChE,MAA8B,UAC/B;;;;AA0BV,SAAS,uCAAuC,MAOvB;CACvB,MAAM,iBAAiB,OAAO,KAAK,iBAAiB,aAAa,IAAI;AACrE,KAAI,CAAC,eACH,OAAM,IAAI,MAAM,wCAAwC,KAAK;AAG/D,KAAI,KAAK,uBAAuB,mBAC9B,QAAO;EACL,oBAAoB;EACpB,eAAe;EACf,YAAY;GACV,yBAAyB,KAAK,iBAAiB;GAC/C,sCAAsC,KAAK,iBAAiB;;EAE9D,WAAW;;CAIf,MAAM,uBAAuB,KAAK;AAClC,KAAI,CAAC,qBACH,OAAM,IAAI,MAAM,sCAAsC,KAAK;CAG7D,MAAM,qBAAqB,OAAO,qBAAqB,aAAa,IAAI;AACxE,KAAI,CAAC,mBACH,OAAM,IAAI,MAAM,4CAA4C,KAAK;CAGnE,MAAM,aAAa,OAAO,KAAK,cAAc,IAAI;AACjD,KAAI,CAAC,WACH,OAAM,IAAI,MAAM;CAGlB,MAAM,OAAO,OAAO,KAAK,QAAQ,IAAI;AACrC,KAAI,CAAC,KACH,OAAM,IAAI,MAAM;CAGlB,MAAM,iBAAiB,wCAAwC,qBAAqB,aAAa,KAAK,MAAM,EAAE;AAC9G,KAAI,CAAC,kBAAkB,eAAe,SAAS,EAC7C,OAAM,IAAI,MACR,8EAA8E,kBAAkB,IAAI,KAAK,KAAK;CAIlH,MAAM,2BAA2B,wCAAwC;EACvE,eAAe,KAAK;EACpB;EACA;EACA,cAAc,qBAAqB;EACnC;;AAGF,QAAO;EACL,oBAAoB;EACpB,eAAe;EACf,YAAY;GACV,yBAAyB;GACzB,sCAAsC;;EAExC,WAAW;GACT;GACA;GACA;GACA,qBAAqB,wCAAwC;;;;AAKnE,SAAS,uCAAuC,cAM9C;CACA,MAAMC,qBAAmE,aAAa,aAClF,qBAAqB,aAAa,cAClC;AAEJ,QAAO;EACL,cAAc,aAAa;EAC3B,YAAY,qBAAqB,KAAK,UAAU,sBAAsB;;;AAI1E,SAAS,mCACP,UACmE;AACnE,KAAI,CAAC,2BAA2B,WAAW;AACzC,MAAI,cAAc,UAChB,OAAM,IAAI,MAAM,SAAS,QAAQ,SAAS;AAE5C,QAAM,IAAI,MAAM;;AAElB,QAAO"}

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/signTransactionWithKeyPair.js

@@ -0,0 +1,55 @@
+import { WorkerRequestType, WorkerResponseType } from "../../../types/signer-worker.js";
+import { SignedTransaction } from "../../../NearClient.js";
+import { validateActionArgsWasm } from "../../../types/actions.js";
+
+//#region src/core/WebAuthnManager/SignerWorkerManager/handlers/signTransactionWithKeyPair.ts
+/**
+* Sign transaction with raw private key (for key replacement in Option D device linking)
+* No TouchID/PRF required - uses provided private key directly
+*/
+async function signTransactionWithKeyPair({ ctx, nearPrivateKey, signerAccountId, receiverId, nonce, blockHash, actions }) {
+	try {
+		console.info("SignerWorkerManager: Starting transaction signing with provided private key");
+		actions.forEach((action) => {
+			validateActionArgsWasm(action);
+		});
+		const response = await ctx.sendMessage({ message: {
+			type: WorkerRequestType.SignTransactionWithKeyPair,
+			payload: {
+				nearPrivateKey,
+				signerAccountId,
+				receiverId,
+				nonce,
+				blockHash,
+				actions
+			}
+		} });
+		if (response.type !== WorkerResponseType.SignTransactionWithKeyPairSuccess) {
+			console.error("SignerWorkerManager: Transaction signing with private key failed:", response);
+			throw new Error("Transaction signing with private key failed");
+		}
+		const wasmResult = response.payload;
+		if (!wasmResult.success) throw new Error(wasmResult.error || "Transaction signing failed");
+		const signedTransactions = wasmResult.signedTransactions || [];
+		if (signedTransactions.length !== 1) throw new Error(`Expected 1 signed transaction but received ${signedTransactions.length}`);
+		const signedTx = signedTransactions[0];
+		if (!signedTx || !signedTx.transaction || !signedTx.signature) throw new Error("Incomplete signed transaction data received");
+		const result = {
+			signedTransaction: new SignedTransaction({
+				transaction: signedTx.transaction,
+				signature: signedTx.signature,
+				borsh_bytes: Array.from(signedTx.borshBytes || [])
+			}),
+			logs: wasmResult.logs
+		};
+		console.debug("SignerWorkerManager: Transaction signing with private key successful");
+		return result;
+	} catch (error) {
+		console.error("SignerWorkerManager: Transaction signing with private key error:", error);
+		throw error;
+	}
+}
+
+//#endregion
+export { signTransactionWithKeyPair };
+//# sourceMappingURL=signTransactionWithKeyPair.js.map

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/signTransactionWithKeyPair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signTransactionWithKeyPair.js","names":["error: unknown"],"sources":["../../../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/signTransactionWithKeyPair.ts"],"sourcesContent":["\nimport { SignedTransaction } from '../../../NearClient';\nimport { type ActionArgsWasm, validateActionArgsWasm } from '../../../types/actions';\nimport {\n  WorkerRequestType,\n  WorkerResponseType,\n  WasmTransactionSignResult,\n} from '../../../types/signer-worker';\nimport { SignerWorkerManagerContext } from '..';\n\n/**\n * Sign transaction with raw private key (for key replacement in Option D device linking)\n * No TouchID/PRF required - uses provided private key directly\n */\nexport async function signTransactionWithKeyPair({\n  ctx,\n  nearPrivateKey,\n  signerAccountId,\n  receiverId,\n  nonce,\n  blockHash,\n  actions\n}: {\n  ctx: SignerWorkerManagerContext;\n  nearPrivateKey: string;\n  signerAccountId: string;\n  receiverId: string;\n  nonce: string;\n  blockHash: string;\n  actions: ActionArgsWasm[];\n}): Promise<{\n  signedTransaction: SignedTransaction;\n  logs?: string[];\n}> {\n  try {\n    console.info('SignerWorkerManager: Starting transaction signing with provided private key');\n    // Validate actions\n    actions.forEach(action => {\n      validateActionArgsWasm(action);\n    });\n\n    const response = await ctx.sendMessage<WorkerRequestType.SignTransactionWithKeyPair>({\n      message: {\n        type: WorkerRequestType.SignTransactionWithKeyPair,\n        payload: {\n          nearPrivateKey,\n          signerAccountId,\n          receiverId,\n          nonce,\n          blockHash: blockHash,\n          actions: actions\n        }\n      }\n    });\n\n    if (response.type !== WorkerResponseType.SignTransactionWithKeyPairSuccess) {\n      console.error('SignerWorkerManager: Transaction signing with private key failed:', response);\n      throw new Error('Transaction signing with private key failed');\n    }\n\n    const wasmResult = response.payload as WasmTransactionSignResult;\n    if (!wasmResult.success) {\n      throw new Error(wasmResult.error || 'Transaction signing failed');\n    }\n    // Extract the signed transaction\n    const signedTransactions = wasmResult.signedTransactions || [];\n    if (signedTransactions.length !== 1) {\n      throw new Error(`Expected 1 signed transaction but received ${signedTransactions.length}`);\n    }\n    const signedTx = signedTransactions[0];\n    if (!signedTx || !signedTx.transaction || !signedTx.signature) {\n      throw new Error('Incomplete signed transaction data received');\n    }\n\n    const result = {\n      signedTransaction: new SignedTransaction({\n        transaction: signedTx.transaction,\n        signature: signedTx.signature,\n        borsh_bytes: Array.from(signedTx.borshBytes || [])\n      }),\n      logs: wasmResult.logs\n    };\n\n    console.debug('SignerWorkerManager: Transaction signing with private key successful');\n    return result;\n\n  } catch (error: unknown) {\n    console.error('SignerWorkerManager: Transaction signing with private key error:', error);\n    throw error;\n  }\n}\n"],"mappings":";;;;;;;;;AAcA,eAAsB,2BAA2B,EAC/C,KACA,gBACA,iBACA,YACA,OACA,WACA,WAYC;AACD,KAAI;AACF,UAAQ,KAAK;AAEb,UAAQ,SAAQ,WAAU;AACxB,0BAAuB;;EAGzB,MAAM,WAAW,MAAM,IAAI,YAA0D,EACnF,SAAS;GACP,MAAM,kBAAkB;GACxB,SAAS;IACP;IACA;IACA;IACA;IACW;IACF;;;AAKf,MAAI,SAAS,SAAS,mBAAmB,mCAAmC;AAC1E,WAAQ,MAAM,qEAAqE;AACnF,SAAM,IAAI,MAAM;;EAGlB,MAAM,aAAa,SAAS;AAC5B,MAAI,CAAC,WAAW,QACd,OAAM,IAAI,MAAM,WAAW,SAAS;EAGtC,MAAM,qBAAqB,WAAW,sBAAsB;AAC5D,MAAI,mBAAmB,WAAW,EAChC,OAAM,IAAI,MAAM,8CAA8C,mBAAmB;EAEnF,MAAM,WAAW,mBAAmB;AACpC,MAAI,CAAC,YAAY,CAAC,SAAS,eAAe,CAAC,SAAS,UAClD,OAAM,IAAI,MAAM;EAGlB,MAAM,SAAS;GACb,mBAAmB,IAAI,kBAAkB;IACvC,aAAa,SAAS;IACtB,WAAW,SAAS;IACpB,aAAa,MAAM,KAAK,SAAS,cAAc;;GAEjD,MAAM,WAAW;;AAGnB,UAAQ,MAAM;AACd,SAAO;UAEAA,OAAgB;AACvB,UAAQ,MAAM,oEAAoE;AAClF,QAAM"}