@tatchi-xyz/sdk 0.20.0 → 0.31.0

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/signTransactionsWithActions.js

@@ -0,0 +1,299 @@
+import { toAccountId } from "../../../types/accountIds.js";
+import { WorkerRequestType, getThresholdBehaviorFromSignerMode, isSignTransactionsWithActionsSuccess, isWorkerError } from "../../../types/signer-worker.js";
+import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from "../../../defaultConfigs.js";
+import { normalizeThresholdEd25519ParticipantIds } from "../../../../threshold/participants.js";
+import { SignedTransaction } from "../../../NearClient.js";
+import { removePrfOutputGuard } from "../../credentialsHelpers.js";
+import { validateActionArgsWasm } from "../../../types/actions.js";
+import { getLastLoggedInDeviceNumber } from "../getDeviceNumber.js";
+import { generateSessionId } from "../sessionHandshake.js";
+import { resolveSignerModeForThresholdSigning } from "../../../threshold/thresholdEd25519RelayerHealth.js";
+import { clearCachedThresholdEd25519AuthSession, getCachedThresholdEd25519AuthSessionJwt, makeThresholdEd25519AuthSessionCacheKey } from "../../../threshold/thresholdEd25519AuthSession.js";
+import { isThresholdSessionAuthUnavailableError, isThresholdSignerMissingKeyError } from "../../../threshold/thresholdSessionPolicy.js";
+
+//#region src/core/WebAuthnManager/SignerWorkerManager/handlers/signTransactionsWithActions.ts
+/**
+* Sign multiple transactions with shared VRF challenge and credential
+* Efficiently processes multiple transactions with one PRF authentication
+*/
+async function signTransactionsWithActions({ ctx, sessionId: providedSessionId, transactions, rpcCall, signerMode, onEvent, confirmationConfigOverride, title, body }) {
+	const sessionId = providedSessionId ?? generateSessionId();
+	const nearAccountId = rpcCall.nearAccountId;
+	const relayerUrl = ctx.relayerUrl;
+	transactions.forEach((txPayload) => {
+		txPayload.actions.forEach((action) => {
+			validateActionArgsWasm(action);
+		});
+	});
+	const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);
+	const [localKeyMaterial, thresholdKeyMaterial] = await Promise.all([ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber), ctx.indexedDB.nearKeysDB.getThresholdKeyMaterial(nearAccountId, deviceNumber)]);
+	if (!localKeyMaterial) throw new Error(`No local key material found for account: ${nearAccountId}`);
+	const warnings = [];
+	const thresholdBehavior = getThresholdBehaviorFromSignerMode(signerMode);
+	const resolvedSignerMode = await resolveSignerModeForThresholdSigning({
+		nearAccountId,
+		signerMode,
+		relayerUrl,
+		hasThresholdKeyMaterial: !!thresholdKeyMaterial,
+		warnings
+	});
+	console.debug("[signTransactionsWithActions] resolvedSignerMode", {
+		nearAccountId,
+		resolvedSignerMode,
+		warnings
+	});
+	const signingContext = validateAndPrepareSigningContext({
+		nearAccountId,
+		resolvedSignerMode,
+		relayerUrl,
+		rpId: ctx.touchIdPrompt.getRpId(),
+		localKeyMaterial,
+		thresholdKeyMaterial
+	});
+	ctx.nonceManager.initializeUser(toAccountId(nearAccountId), signingContext.signingNearPublicKeyStr);
+	const resolvedRpcCall = {
+		contractId: rpcCall.contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId,
+		nearRpcUrl: rpcCall.nearRpcUrl || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl,
+		nearAccountId: rpcCall.nearAccountId
+	};
+	const txSigningRequests = transactions.map((tx) => ({
+		nearAccountId: rpcCall.nearAccountId,
+		receiverId: tx.receiverId,
+		actions: tx.actions
+	}));
+	if (!ctx.vrfWorkerManager) throw new Error("VrfWorkerManager not available for signing");
+	const confirmation = await ctx.vrfWorkerManager.confirmAndPrepareSigningSession({
+		ctx,
+		sessionId,
+		kind: "transaction",
+		...signingContext.threshold && !signingContext.threshold.thresholdSessionJwt ? { signingAuthMode: "webauthn" } : {},
+		txSigningRequests: transactions,
+		rpcCall: resolvedRpcCall,
+		confirmationConfigOverride,
+		title,
+		body
+	});
+	let { intentDigest, transactionContext, vrfChallenge, credential } = extractSigningEvidenceFromConfirmation(confirmation);
+	if (signingContext.threshold) {
+		const requestPayload = {
+			signerMode: signingContext.resolvedSignerMode,
+			rpcCall: resolvedRpcCall,
+			createdAt: Date.now(),
+			decryption: {
+				encryptedPrivateKeyData: "",
+				encryptedPrivateKeyChacha20NonceB64u: ""
+			},
+			threshold: {
+				relayerUrl: signingContext.threshold.relayerUrl,
+				relayerKeyId: signingContext.threshold.thresholdKeyMaterial.relayerKeyId,
+				clientParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "client")?.id,
+				relayerParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "relayer")?.id,
+				participantIds: signingContext.threshold.thresholdKeyMaterial.participants.map((p) => p.id),
+				thresholdSessionKind: "jwt",
+				thresholdSessionJwt: signingContext.threshold.thresholdSessionJwt
+			},
+			txSigningRequests,
+			intentDigest,
+			transactionContext,
+			vrfChallenge,
+			credential
+		};
+		for (let attempt = 0; attempt < 2; attempt++) try {
+			const response = await ctx.sendMessage({
+				sessionId,
+				message: {
+					type: WorkerRequestType.SignTransactionsWithActions,
+					payload: requestPayload
+				},
+				onEvent
+			});
+			const okResponse = requireOkSignTransactionsWithActionsResponse(response);
+			return toSignedTransactionResults({
+				okResponse,
+				expectedTransactionCount: transactions.length,
+				nearAccountId,
+				warnings
+			});
+		} catch (e) {
+			const err = e instanceof Error ? e : new Error(String(e));
+			if (thresholdBehavior === "fallback" && isThresholdSignerMissingKeyError(err)) {
+				const msg = "[WebAuthnManager] threshold-signer requested but the relayer is missing the signing share; falling back to local-signer";
+				console.warn(msg);
+				warnings.push(msg);
+				try {
+					clearCachedThresholdEd25519AuthSession(signingContext.threshold.thresholdSessionCacheKey);
+				} catch {}
+				signingContext.threshold.thresholdSessionJwt = void 0;
+				requestPayload.threshold.thresholdSessionJwt = void 0;
+				ctx.nonceManager.initializeUser(toAccountId(nearAccountId), localKeyMaterial.publicKey);
+				if (!credential || !vrfChallenge) {
+					const refreshed = await ctx.vrfWorkerManager.confirmAndPrepareSigningSession({
+						ctx,
+						sessionId,
+						kind: "transaction",
+						signingAuthMode: "webauthn",
+						txSigningRequests: transactions,
+						rpcCall: resolvedRpcCall,
+						confirmationConfigOverride,
+						title,
+						body
+					});
+					({intentDigest, transactionContext, vrfChallenge, credential} = extractSigningEvidenceFromConfirmation(refreshed));
+				} else transactionContext = await ctx.nonceManager.getNonceBlockHashAndHeight(ctx.nearClient, { force: true });
+				return await signTransactionsWithActionsLocally({
+					ctx,
+					sessionId,
+					onEvent,
+					resolvedRpcCall,
+					localKeyMaterial,
+					txSigningRequests,
+					intentDigest,
+					transactionContext,
+					credential,
+					expectedTransactionCount: transactions.length,
+					warnings
+				});
+			}
+			if (attempt === 0 && isThresholdSessionAuthUnavailableError(err)) {
+				clearCachedThresholdEd25519AuthSession(signingContext.threshold.thresholdSessionCacheKey);
+				signingContext.threshold.thresholdSessionJwt = void 0;
+				requestPayload.threshold.thresholdSessionJwt = void 0;
+				if (!credential || !vrfChallenge) {
+					const refreshed = await ctx.vrfWorkerManager.confirmAndPrepareSigningSession({
+						ctx,
+						sessionId,
+						kind: "transaction",
+						signingAuthMode: "webauthn",
+						txSigningRequests: transactions,
+						rpcCall: resolvedRpcCall,
+						confirmationConfigOverride,
+						title,
+						body
+					});
+					({intentDigest, transactionContext, vrfChallenge, credential} = extractSigningEvidenceFromConfirmation(refreshed));
+					requestPayload.intentDigest = intentDigest;
+					requestPayload.transactionContext = transactionContext;
+					requestPayload.vrfChallenge = vrfChallenge;
+					requestPayload.credential = credential;
+				}
+				continue;
+			}
+			throw err;
+		}
+	}
+	return await signTransactionsWithActionsLocally({
+		ctx,
+		sessionId,
+		onEvent,
+		resolvedRpcCall,
+		localKeyMaterial,
+		txSigningRequests,
+		intentDigest,
+		transactionContext,
+		credential,
+		expectedTransactionCount: transactions.length,
+		warnings
+	});
+}
+async function signTransactionsWithActionsLocally(args) {
+	const response = await args.ctx.sendMessage({
+		sessionId: args.sessionId,
+		message: {
+			type: WorkerRequestType.SignTransactionsWithActions,
+			payload: {
+				signerMode: "local-signer",
+				rpcCall: args.resolvedRpcCall,
+				createdAt: Date.now(),
+				decryption: {
+					encryptedPrivateKeyData: args.localKeyMaterial.encryptedSk,
+					encryptedPrivateKeyChacha20NonceB64u: args.localKeyMaterial.chacha20NonceB64u
+				},
+				txSigningRequests: args.txSigningRequests,
+				intentDigest: args.intentDigest,
+				transactionContext: args.transactionContext,
+				credential: args.credential
+			}
+		},
+		onEvent: args.onEvent
+	});
+	const okResponse = requireOkSignTransactionsWithActionsResponse(response);
+	return toSignedTransactionResults({
+		okResponse,
+		expectedTransactionCount: args.expectedTransactionCount,
+		nearAccountId: args.resolvedRpcCall.nearAccountId,
+		warnings: args.warnings
+	});
+}
+function toSignedTransactionResults(args) {
+	const signedTransactions = args.okResponse.payload.signedTransactions || [];
+	if (signedTransactions.length !== args.expectedTransactionCount) throw new Error(`Expected ${args.expectedTransactionCount} signed transactions but received ${signedTransactions.length}`);
+	return signedTransactions.map((signedTx, index) => {
+		if (!signedTx || !signedTx.transaction || !signedTx.signature) throw new Error(`Incomplete signed transaction data received for transaction ${index + 1}`);
+		return {
+			signedTransaction: new SignedTransaction({
+				transaction: signedTx.transaction,
+				signature: signedTx.signature,
+				borsh_bytes: Array.from(signedTx.borshBytes || [])
+			}),
+			nearAccountId: toAccountId(args.nearAccountId),
+			logs: [...args.okResponse.payload.logs || [], ...args.warnings]
+		};
+	});
+}
+function validateAndPrepareSigningContext(args) {
+	const localPublicKey = String(args.localKeyMaterial.publicKey || "").trim();
+	if (!localPublicKey) throw new Error(`Missing local signing public key for ${args.nearAccountId}`);
+	if (args.resolvedSignerMode !== "threshold-signer") return {
+		resolvedSignerMode: "local-signer",
+		signingNearPublicKeyStr: localPublicKey,
+		threshold: null
+	};
+	const thresholdKeyMaterial = args.thresholdKeyMaterial;
+	if (!thresholdKeyMaterial) throw new Error(`Missing threshold key material for ${args.nearAccountId}`);
+	const thresholdPublicKey = String(thresholdKeyMaterial.publicKey || "").trim();
+	if (!thresholdPublicKey) throw new Error(`Missing threshold signing public key for ${args.nearAccountId}`);
+	const relayerUrl = String(args.relayerUrl || "").trim();
+	if (!relayerUrl) throw new Error("Missing relayerUrl (required for threshold-signer)");
+	const rpId = String(args.rpId || "").trim();
+	if (!rpId) throw new Error("Missing rpId for threshold signing");
+	const participantIds = normalizeThresholdEd25519ParticipantIds(thresholdKeyMaterial.participants.map((p) => p.id));
+	if (!participantIds || participantIds.length < 2) throw new Error(`Invalid threshold signing participantIds (expected >=2 participants, got [${(participantIds || []).join(",")}])`);
+	const thresholdSessionCacheKey = makeThresholdEd25519AuthSessionCacheKey({
+		nearAccountId: args.nearAccountId,
+		rpId,
+		relayerUrl,
+		relayerKeyId: thresholdKeyMaterial.relayerKeyId,
+		participantIds
+	});
+	return {
+		resolvedSignerMode: "threshold-signer",
+		signingNearPublicKeyStr: thresholdPublicKey,
+		threshold: {
+			relayerUrl,
+			thresholdKeyMaterial,
+			thresholdSessionCacheKey,
+			thresholdSessionJwt: getCachedThresholdEd25519AuthSessionJwt(thresholdSessionCacheKey)
+		}
+	};
+}
+function extractSigningEvidenceFromConfirmation(confirmation) {
+	const credentialForRelay = confirmation.credential ? removePrfOutputGuard(confirmation.credential) : void 0;
+	return {
+		intentDigest: confirmation.intentDigest,
+		transactionContext: confirmation.transactionContext,
+		vrfChallenge: confirmation.vrfChallenge,
+		credential: credentialForRelay ? JSON.stringify(credentialForRelay) : void 0
+	};
+}
+function requireOkSignTransactionsWithActionsResponse(response) {
+	if (!isSignTransactionsWithActionsSuccess(response)) {
+		if (isWorkerError(response)) throw new Error(response.payload.error || "Batch transaction signing failed");
+		throw new Error("Batch transaction signing failed");
+	}
+	if (!response.payload.success) throw new Error(response.payload.error || "Batch transaction signing failed");
+	return response;
+}
+
+//#endregion
+export { signTransactionsWithActions };
+//# sourceMappingURL=signTransactionsWithActions.js.map

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/signTransactionsWithActions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signTransactionsWithActions.js","names":["warnings: string[]","txSigningRequests: TransactionPayload[]","e: unknown","credentialForRelay: WebAuthnAuthenticationCredential | undefined"],"sources":["../../../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/signTransactionsWithActions.ts"],"sourcesContent":["\nimport { SignedTransaction } from '../../../NearClient';\nimport { TransactionInputWasm, validateActionArgsWasm } from '../../../types/actions';\nimport { type onProgressEvents } from '../../../types/sdkSentEvents';\nimport {\n  WorkerRequestType,\n  TransactionPayload,\n  isSignTransactionsWithActionsSuccess,\n  isWorkerError,\n  type ConfirmationConfig,\n  type RpcCallPayload,\n  type SignerMode,\n  type TransactionResponse,\n  type WorkerSuccessResponse,\n  getThresholdBehaviorFromSignerMode,\n} from '../../../types/signer-worker';\nimport { AccountId } from '../../../types/accountIds';\nimport { SignerWorkerManagerContext } from '..';\nimport { PASSKEY_MANAGER_DEFAULT_CONFIGS } from '../../../defaultConfigs';\nimport { toAccountId } from '../../../types/accountIds';\nimport { getLastLoggedInDeviceNumber } from '../getDeviceNumber';\nimport { generateSessionId } from '../sessionHandshake.js';\nimport { WebAuthnAuthenticationCredential } from '../../../types';\nimport { removePrfOutputGuard } from '../../credentialsHelpers';\nimport { resolveSignerModeForThresholdSigning } from '../../../threshold/thresholdEd25519RelayerHealth';\nimport type { TransactionContext } from '../../../types/rpc';\nimport type { VRFChallenge } from '../../../types/vrf-worker';\nimport type {\n  LocalNearSkV3Material,\n  ThresholdEd25519_2p_V1Material,\n} from '../../../IndexedDBManager/passkeyNearKeysDB';\nimport {\n  clearCachedThresholdEd25519AuthSession,\n  getCachedThresholdEd25519AuthSessionJwt,\n  makeThresholdEd25519AuthSessionCacheKey,\n} from '../../../threshold/thresholdEd25519AuthSession';\nimport {\n  isThresholdSessionAuthUnavailableError,\n  isThresholdSignerMissingKeyError,\n} from '../../../threshold/thresholdSessionPolicy';\nimport { normalizeThresholdEd25519ParticipantIds } from '../../../../threshold/participants';\n\n/**\n * Sign multiple transactions with shared VRF challenge and credential\n * Efficiently processes multiple transactions with one PRF authentication\n */\nexport async function signTransactionsWithActions({\n  ctx,\n  sessionId: providedSessionId,\n  transactions,\n  rpcCall,\n  signerMode,\n  onEvent,\n  confirmationConfigOverride,\n  title,\n  body,\n}: {\n  ctx: SignerWorkerManagerContext,\n  sessionId?: string;\n  transactions: TransactionInputWasm[],\n  rpcCall: RpcCallPayload;\n  signerMode: SignerMode;\n  onEvent?: (update: onProgressEvents) => void;\n  // Allow callers to pass a partial override (e.g., { uiMode: 'drawer' })\n  confirmationConfigOverride?: Partial<ConfirmationConfig>;\n  title?: string;\n  body?: string;\n}): Promise<Array<{\n  signedTransaction: SignedTransaction;\n  nearAccountId: AccountId;\n  logs?: string[]\n}>> {\n\n  const sessionId = providedSessionId ?? generateSessionId();\n  const nearAccountId = rpcCall.nearAccountId;\n  const relayerUrl = ctx.relayerUrl;\n\n  transactions.forEach(txPayload => {\n    txPayload.actions.forEach(action => {\n      validateActionArgsWasm(action);\n    })\n  })\n\n  const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);\n\n  // Retrieve encrypted key data from IndexedDB in main thread\n  const [localKeyMaterial, thresholdKeyMaterial] = await Promise.all([\n    ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber),\n    ctx.indexedDB.nearKeysDB.getThresholdKeyMaterial(nearAccountId, deviceNumber),\n  ]);\n  if (!localKeyMaterial) {\n    throw new Error(`No local key material found for account: ${nearAccountId}`);\n  }\n\n\t  const warnings: string[] = [];\n\t  const thresholdBehavior = getThresholdBehaviorFromSignerMode(signerMode);\n\t  const resolvedSignerMode = await resolveSignerModeForThresholdSigning({\n\t    nearAccountId,\n\t    signerMode,\n\t    relayerUrl,\n\t    hasThresholdKeyMaterial: !!thresholdKeyMaterial,\n    warnings,\n  });\n  console.debug('[signTransactionsWithActions] resolvedSignerMode', { nearAccountId, resolvedSignerMode, warnings });\n\n  const signingContext = validateAndPrepareSigningContext({\n    nearAccountId,\n    resolvedSignerMode,\n    relayerUrl,\n    rpId: ctx.touchIdPrompt.getRpId(),\n    localKeyMaterial,\n    thresholdKeyMaterial,\n  });\n\n  // Ensure nonce/block context is fetched for the same access key that will sign.\n  // Threshold signing MUST use the threshold/group public key (relayer access key) for:\n  // - correct nonce reservation\n  // - relayer scope checks (/authorize expects signingPayload.transactionContext.nearPublicKeyStr == relayer key)\n  ctx.nonceManager.initializeUser(toAccountId(nearAccountId), signingContext.signingNearPublicKeyStr);\n\n  // Normalize rpcCall to ensure required fields are present.\n  const resolvedRpcCall = {\n    contractId: rpcCall.contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId,\n    nearRpcUrl: rpcCall.nearRpcUrl || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl,\n    nearAccountId: rpcCall.nearAccountId,\n  } as RpcCallPayload;\n\n  // Create transaction signing requests (shared by local + threshold signing).\n  // NOTE: nonce and blockHash are computed in confirmation flow, not here.\n  const txSigningRequests: TransactionPayload[] = transactions.map(tx => ({\n    nearAccountId: rpcCall.nearAccountId,\n    receiverId: tx.receiverId,\n    actions: tx.actions,\n  }));\n\n  // Confirm via VRF-driven flow before sending anything to the signer worker.\n  // WrapKeySeed derivation is handled inside confirmTxFlow (handleTransactionSigningFlow),\n  // which uses the same sessionId/requestId and delivers WrapKeySeed over the reserved port.\n  if (!ctx.vrfWorkerManager) {\n    throw new Error('VrfWorkerManager not available for signing');\n  }\n  const confirmation = await ctx.vrfWorkerManager.confirmAndPrepareSigningSession({\n    ctx,\n    sessionId,\n    kind: 'transaction',\n    ...(signingContext.threshold && !signingContext.threshold.thresholdSessionJwt ? { signingAuthMode: 'webauthn' } : {}),\n    txSigningRequests: transactions,\n    rpcCall: resolvedRpcCall,\n    confirmationConfigOverride,\n    title,\n    body,\n  });\n\n\t  let { intentDigest, transactionContext, vrfChallenge, credential } =\n\t    extractSigningEvidenceFromConfirmation(confirmation);\n\n\t  // Threshold signer: authorize with relayer and pass threshold config into the signer worker.\n\t  if (signingContext.threshold) {\n\t    const requestPayload = {\n\t      signerMode: signingContext.resolvedSignerMode,\n\t      rpcCall: resolvedRpcCall,\n\t      createdAt: Date.now(),\n\t      decryption: {\n        encryptedPrivateKeyData: '',\n        encryptedPrivateKeyChacha20NonceB64u: '',\n      },\n      threshold: {\n        relayerUrl: signingContext.threshold.relayerUrl,\n        relayerKeyId: signingContext.threshold.thresholdKeyMaterial.relayerKeyId,\n        clientParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === 'client')?.id,\n        relayerParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === 'relayer')?.id,\n        participantIds: signingContext.threshold.thresholdKeyMaterial.participants.map((p) => p.id),\n        thresholdSessionKind: 'jwt' as const,\n        thresholdSessionJwt: signingContext.threshold.thresholdSessionJwt,\n      },\n      txSigningRequests,\n      intentDigest,\n      transactionContext,\n\t      vrfChallenge,\n\t      credential,\n\t    };\n\n\t    for (let attempt = 0; attempt < 2; attempt++) {\n\t      try {\n\t        const response = await ctx.sendMessage<typeof WorkerRequestType.SignTransactionsWithActions>({\n\t          sessionId,\n\t          message: { type: WorkerRequestType.SignTransactionsWithActions, payload: requestPayload },\n\t          onEvent,\n\t        });\n\t        const okResponse = requireOkSignTransactionsWithActionsResponse(response);\n\t        return toSignedTransactionResults({\n\t          okResponse,\n\t          expectedTransactionCount: transactions.length,\n\t          nearAccountId,\n\t          warnings,\n\t        });\n\t      } catch (e: unknown) {\n\t        const err = e instanceof Error ? e : new Error(String(e));\n\n\t        if (thresholdBehavior === 'fallback' && isThresholdSignerMissingKeyError(err)) {\n\t          const msg =\n\t            '[WebAuthnManager] threshold-signer requested but the relayer is missing the signing share; falling back to local-signer';\n\t          // eslint-disable-next-line no-console\n\t          console.warn(msg);\n\t          warnings.push(msg);\n\n\t          try {\n\t            clearCachedThresholdEd25519AuthSession(signingContext.threshold.thresholdSessionCacheKey);\n\t          } catch {}\n\t          signingContext.threshold.thresholdSessionJwt = undefined;\n\t          requestPayload.threshold.thresholdSessionJwt = undefined;\n\n\t          ctx.nonceManager.initializeUser(toAccountId(nearAccountId), localKeyMaterial.publicKey);\n\t          if (!credential || !vrfChallenge) {\n\t            const refreshed = await ctx.vrfWorkerManager.confirmAndPrepareSigningSession({\n\t              ctx,\n\t              sessionId,\n\t              kind: 'transaction',\n\t              signingAuthMode: 'webauthn',\n\t              txSigningRequests: transactions,\n\t              rpcCall: resolvedRpcCall,\n\t              confirmationConfigOverride,\n\t              title,\n\t              body,\n\t            });\n\t            ({ intentDigest, transactionContext, vrfChallenge, credential } =\n\t              extractSigningEvidenceFromConfirmation(refreshed));\n\t          } else {\n\t            transactionContext = await ctx.nonceManager.getNonceBlockHashAndHeight(ctx.nearClient, { force: true });\n\t          }\n\n\t          return await signTransactionsWithActionsLocally({\n\t            ctx,\n\t            sessionId,\n\t            onEvent,\n\t            resolvedRpcCall,\n\t            localKeyMaterial,\n\t            txSigningRequests,\n\t            intentDigest,\n\t            transactionContext,\n\t            credential,\n\t            expectedTransactionCount: transactions.length,\n\t            warnings,\n\t          });\n\t        }\n\n\t        if (attempt === 0 && isThresholdSessionAuthUnavailableError(err)) {\n\t          clearCachedThresholdEd25519AuthSession(signingContext.threshold.thresholdSessionCacheKey);\n\t          signingContext.threshold.thresholdSessionJwt = undefined;\n\t          requestPayload.threshold.thresholdSessionJwt = undefined;\n\n\t          if (!credential || !vrfChallenge) {\n\t            const refreshed = await ctx.vrfWorkerManager.confirmAndPrepareSigningSession({\n\t              ctx,\n\t              sessionId,\n\t              kind: 'transaction',\n\t              signingAuthMode: 'webauthn',\n\t              txSigningRequests: transactions,\n\t              rpcCall: resolvedRpcCall,\n\t              confirmationConfigOverride,\n\t              title,\n\t              body,\n\t            });\n\n\t            ({ intentDigest, transactionContext, vrfChallenge, credential } =\n\t              extractSigningEvidenceFromConfirmation(refreshed));\n\n\t            requestPayload.intentDigest = intentDigest;\n\t            requestPayload.transactionContext = transactionContext;\n\t            requestPayload.vrfChallenge = vrfChallenge;\n\t            requestPayload.credential = credential;\n\t          }\n\n\t          continue;\n\t        }\n\n\t        throw err;\n\t      }\n\t    }\n\t  }\n\n\t  return await signTransactionsWithActionsLocally({\n\t    ctx,\n\t    sessionId,\n\t    onEvent,\n\t    resolvedRpcCall,\n\t    localKeyMaterial,\n\t    txSigningRequests,\n\t    intentDigest,\n\t    transactionContext,\n\t    credential,\n\t    expectedTransactionCount: transactions.length,\n\t    warnings,\n\t  });\n\n\t}\n\nasync function signTransactionsWithActionsLocally(args: {\n  ctx: SignerWorkerManagerContext;\n  sessionId: string;\n  onEvent?: (update: onProgressEvents) => void;\n  resolvedRpcCall: RpcCallPayload;\n  localKeyMaterial: LocalNearSkV3Material;\n  txSigningRequests: TransactionPayload[];\n  intentDigest: string;\n  transactionContext: TransactionContext;\n  credential: string | undefined;\n  expectedTransactionCount: number;\n  warnings: string[];\n}): Promise<Array<{\n  signedTransaction: SignedTransaction;\n  nearAccountId: AccountId;\n  logs?: string[];\n}>> {\n  const response = await args.ctx.sendMessage<WorkerRequestType.SignTransactionsWithActions>({\n    sessionId: args.sessionId,\n    message: {\n      type: WorkerRequestType.SignTransactionsWithActions,\n      payload: {\n        signerMode: 'local-signer',\n        rpcCall: args.resolvedRpcCall,\n        createdAt: Date.now(),\n        decryption: {\n          encryptedPrivateKeyData: args.localKeyMaterial.encryptedSk,\n          encryptedPrivateKeyChacha20NonceB64u: args.localKeyMaterial.chacha20NonceB64u,\n        },\n        txSigningRequests: args.txSigningRequests,\n        intentDigest: args.intentDigest,\n        transactionContext: args.transactionContext,\n        credential: args.credential,\n      },\n    },\n    onEvent: args.onEvent,\n  });\n\n  const okResponse = requireOkSignTransactionsWithActionsResponse(response);\n  return toSignedTransactionResults({\n    okResponse,\n    expectedTransactionCount: args.expectedTransactionCount,\n    nearAccountId: args.resolvedRpcCall.nearAccountId,\n    warnings: args.warnings,\n  });\n}\n\nfunction toSignedTransactionResults(args: {\n  okResponse: WorkerSuccessResponse<typeof WorkerRequestType.SignTransactionsWithActions>;\n  expectedTransactionCount: number;\n  nearAccountId: string;\n  warnings: string[];\n}): Array<{\n  signedTransaction: SignedTransaction;\n  nearAccountId: AccountId;\n  logs?: string[];\n}> {\n  const signedTransactions = args.okResponse.payload.signedTransactions || [];\n  if (signedTransactions.length !== args.expectedTransactionCount) {\n    throw new Error(\n      `Expected ${args.expectedTransactionCount} signed transactions but received ${signedTransactions.length}`\n    );\n  }\n\n  return signedTransactions.map((signedTx, index) => {\n    if (!signedTx || !signedTx.transaction || !signedTx.signature) {\n      throw new Error(`Incomplete signed transaction data received for transaction ${index + 1}`);\n    }\n    return {\n      signedTransaction: new SignedTransaction({\n        transaction: signedTx.transaction,\n        signature: signedTx.signature,\n        borsh_bytes: Array.from(signedTx.borshBytes || []),\n      }),\n      nearAccountId: toAccountId(args.nearAccountId),\n      logs: [...(args.okResponse.payload.logs || []), ...args.warnings],\n    };\n  });\n}\n\ntype ThresholdSigningContext = {\n  resolvedSignerMode: 'threshold-signer';\n  signingNearPublicKeyStr: string;\n  threshold: {\n    relayerUrl: string;\n    thresholdKeyMaterial: ThresholdEd25519_2p_V1Material;\n    thresholdSessionCacheKey: string;\n    thresholdSessionJwt: string | undefined;\n  };\n};\n\ntype LocalSigningContext = {\n  resolvedSignerMode: 'local-signer';\n  signingNearPublicKeyStr: string;\n  threshold: null;\n};\n\ntype SigningContext = ThresholdSigningContext | LocalSigningContext;\n\nfunction validateAndPrepareSigningContext(args: {\n  nearAccountId: string;\n  resolvedSignerMode: SignerMode['mode'];\n  relayerUrl: string;\n  rpId: string | null;\n  localKeyMaterial: LocalNearSkV3Material;\n  thresholdKeyMaterial: ThresholdEd25519_2p_V1Material | null;\n}): SigningContext {\n  const localPublicKey = String(args.localKeyMaterial.publicKey || '').trim();\n  if (!localPublicKey) {\n    throw new Error(`Missing local signing public key for ${args.nearAccountId}`);\n  }\n\n  if (args.resolvedSignerMode !== 'threshold-signer') {\n    return { resolvedSignerMode: 'local-signer', signingNearPublicKeyStr: localPublicKey, threshold: null };\n  }\n\n  const thresholdKeyMaterial = args.thresholdKeyMaterial;\n  if (!thresholdKeyMaterial) {\n    throw new Error(`Missing threshold key material for ${args.nearAccountId}`);\n  }\n\n  const thresholdPublicKey = String(thresholdKeyMaterial.publicKey || '').trim();\n  if (!thresholdPublicKey) {\n    throw new Error(`Missing threshold signing public key for ${args.nearAccountId}`);\n  }\n\n  const relayerUrl = String(args.relayerUrl || '').trim();\n  if (!relayerUrl) {\n    throw new Error('Missing relayerUrl (required for threshold-signer)');\n  }\n\n  const rpId = String(args.rpId || '').trim();\n  if (!rpId) {\n    throw new Error('Missing rpId for threshold signing');\n  }\n\n  const participantIds = normalizeThresholdEd25519ParticipantIds(thresholdKeyMaterial.participants.map((p) => p.id));\n  if (!participantIds || participantIds.length < 2) {\n    throw new Error(\n      `Invalid threshold signing participantIds (expected >=2 participants, got [${(participantIds || []).join(',')}])`\n    );\n  }\n\n  const thresholdSessionCacheKey = makeThresholdEd25519AuthSessionCacheKey({\n    nearAccountId: args.nearAccountId,\n    rpId,\n    relayerUrl,\n    relayerKeyId: thresholdKeyMaterial.relayerKeyId,\n    participantIds,\n  });\n\n  return {\n    resolvedSignerMode: 'threshold-signer',\n    signingNearPublicKeyStr: thresholdPublicKey,\n    threshold: {\n      relayerUrl,\n      thresholdKeyMaterial,\n      thresholdSessionCacheKey,\n      thresholdSessionJwt: getCachedThresholdEd25519AuthSessionJwt(thresholdSessionCacheKey),\n    },\n  };\n}\n\nfunction extractSigningEvidenceFromConfirmation(confirmation: {\n  intentDigest: string;\n  transactionContext: TransactionContext;\n  vrfChallenge?: VRFChallenge;\n  credential?: unknown;\n}): {\n  intentDigest: string;\n  transactionContext: TransactionContext;\n  vrfChallenge: VRFChallenge | undefined;\n  credential: string | undefined;\n} {\n  const credentialForRelay: WebAuthnAuthenticationCredential | undefined = confirmation.credential\n    ? removePrfOutputGuard(confirmation.credential as WebAuthnAuthenticationCredential)\n    : undefined;\n\n  return {\n    intentDigest: confirmation.intentDigest,\n    transactionContext: confirmation.transactionContext,\n    vrfChallenge: confirmation.vrfChallenge,\n    credential: credentialForRelay ? JSON.stringify(credentialForRelay) : undefined,\n  };\n}\n\nfunction requireOkSignTransactionsWithActionsResponse(\n  response: TransactionResponse\n): WorkerSuccessResponse<typeof WorkerRequestType.SignTransactionsWithActions> {\n  if (!isSignTransactionsWithActionsSuccess(response)) {\n    if (isWorkerError(response)) {\n      throw new Error(response.payload.error || 'Batch transaction signing failed');\n    }\n    throw new Error('Batch transaction signing failed');\n  }\n\n  if (!response.payload.success) {\n    throw new Error(response.payload.error || 'Batch transaction signing failed');\n  }\n  return response;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA8CA,eAAsB,4BAA4B,EAChD,KACA,WAAW,mBACX,cACA,SACA,YACA,SACA,4BACA,OACA,QAgBE;CAEF,MAAM,YAAY,qBAAqB;CACvC,MAAM,gBAAgB,QAAQ;CAC9B,MAAM,aAAa,IAAI;AAEvB,cAAa,SAAQ,cAAa;AAChC,YAAU,QAAQ,SAAQ,WAAU;AAClC,0BAAuB;;;CAI3B,MAAM,eAAe,MAAM,4BAA4B,eAAe,IAAI,UAAU;CAGpF,MAAM,CAAC,kBAAkB,wBAAwB,MAAM,QAAQ,IAAI,CACjE,IAAI,UAAU,WAAW,oBAAoB,eAAe,eAC5D,IAAI,UAAU,WAAW,wBAAwB,eAAe;AAElE,KAAI,CAAC,iBACH,OAAM,IAAI,MAAM,4CAA4C;CAG7D,MAAMA,WAAqB;CAC3B,MAAM,oBAAoB,mCAAmC;CAC7D,MAAM,qBAAqB,MAAM,qCAAqC;EACpE;EACA;EACA;EACA,yBAAyB,CAAC,CAAC;EAC5B;;AAEF,SAAQ,MAAM,oDAAoD;EAAE;EAAe;EAAoB;;CAEvG,MAAM,iBAAiB,iCAAiC;EACtD;EACA;EACA;EACA,MAAM,IAAI,cAAc;EACxB;EACA;;AAOF,KAAI,aAAa,eAAe,YAAY,gBAAgB,eAAe;CAG3E,MAAM,kBAAkB;EACtB,YAAY,QAAQ,cAAc,gCAAgC;EAClE,YAAY,QAAQ,cAAc,gCAAgC;EAClE,eAAe,QAAQ;;CAKzB,MAAMC,oBAA0C,aAAa,KAAI,QAAO;EACtE,eAAe,QAAQ;EACvB,YAAY,GAAG;EACf,SAAS,GAAG;;AAMd,KAAI,CAAC,IAAI,iBACP,OAAM,IAAI,MAAM;CAElB,MAAM,eAAe,MAAM,IAAI,iBAAiB,gCAAgC;EAC9E;EACA;EACA,MAAM;EACN,GAAI,eAAe,aAAa,CAAC,eAAe,UAAU,sBAAsB,EAAE,iBAAiB,eAAe;EAClH,mBAAmB;EACnB,SAAS;EACT;EACA;EACA;;CAGD,IAAI,EAAE,cAAc,oBAAoB,cAAc,eACpD,uCAAuC;AAGzC,KAAI,eAAe,WAAW;EAC5B,MAAM,iBAAiB;GACrB,YAAY,eAAe;GAC3B,SAAS;GACT,WAAW,KAAK;GAChB,YAAY;IACX,yBAAyB;IACzB,sCAAsC;;GAExC,WAAW;IACT,YAAY,eAAe,UAAU;IACrC,cAAc,eAAe,UAAU,qBAAqB;IAC5D,qBAAqB,eAAe,UAAU,qBAAqB,aAAa,MAAM,MAAM,EAAE,SAAS,WAAW;IAClH,sBAAsB,eAAe,UAAU,qBAAqB,aAAa,MAAM,MAAM,EAAE,SAAS,YAAY;IACpH,gBAAgB,eAAe,UAAU,qBAAqB,aAAa,KAAK,MAAM,EAAE;IACxF,sBAAsB;IACtB,qBAAqB,eAAe,UAAU;;GAEhD;GACA;GACA;GACC;GACA;;AAGF,OAAK,IAAI,UAAU,GAAG,UAAU,GAAG,UACjC,KAAI;GACF,MAAM,WAAW,MAAM,IAAI,YAAkE;IAC3F;IACA,SAAS;KAAE,MAAM,kBAAkB;KAA6B,SAAS;;IACzE;;GAEF,MAAM,aAAa,6CAA6C;AAChE,UAAO,2BAA2B;IAChC;IACA,0BAA0B,aAAa;IACvC;IACA;;WAEKC,GAAY;GACnB,MAAM,MAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO;AAEtD,OAAI,sBAAsB,cAAc,iCAAiC,MAAM;IAC7E,MAAM,MACJ;AAEF,YAAQ,KAAK;AACb,aAAS,KAAK;AAEd,QAAI;AACF,4CAAuC,eAAe,UAAU;YAC1D;AACR,mBAAe,UAAU,sBAAsB;AAC/C,mBAAe,UAAU,sBAAsB;AAE/C,QAAI,aAAa,eAAe,YAAY,gBAAgB,iBAAiB;AAC7E,QAAI,CAAC,cAAc,CAAC,cAAc;KAChC,MAAM,YAAY,MAAM,IAAI,iBAAiB,gCAAgC;MAC3E;MACA;MACA,MAAM;MACN,iBAAiB;MACjB,mBAAmB;MACnB,SAAS;MACT;MACA;MACA;;AAEF,MAAC,CAAE,cAAc,oBAAoB,cAAc,cACjD,uCAAuC;UAEzC,sBAAqB,MAAM,IAAI,aAAa,2BAA2B,IAAI,YAAY,EAAE,OAAO;AAGlG,WAAO,MAAM,mCAAmC;KAC9C;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA,0BAA0B,aAAa;KACvC;;;AAIJ,OAAI,YAAY,KAAK,uCAAuC,MAAM;AAChE,2CAAuC,eAAe,UAAU;AAChE,mBAAe,UAAU,sBAAsB;AAC/C,mBAAe,UAAU,sBAAsB;AAE/C,QAAI,CAAC,cAAc,CAAC,cAAc;KAChC,MAAM,YAAY,MAAM,IAAI,iBAAiB,gCAAgC;MAC3E;MACA;MACA,MAAM;MACN,iBAAiB;MACjB,mBAAmB;MACnB,SAAS;MACT;MACA;MACA;;AAGF,MAAC,CAAE,cAAc,oBAAoB,cAAc,cACjD,uCAAuC;AAEzC,oBAAe,eAAe;AAC9B,oBAAe,qBAAqB;AACpC,oBAAe,eAAe;AAC9B,oBAAe,aAAa;;AAG9B;;AAGF,SAAM;;;AAKZ,QAAO,MAAM,mCAAmC;EAC9C;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,0BAA0B,aAAa;EACvC;;;AAKL,eAAe,mCAAmC,MAgB9C;CACF,MAAM,WAAW,MAAM,KAAK,IAAI,YAA2D;EACzF,WAAW,KAAK;EAChB,SAAS;GACP,MAAM,kBAAkB;GACxB,SAAS;IACP,YAAY;IACZ,SAAS,KAAK;IACd,WAAW,KAAK;IAChB,YAAY;KACV,yBAAyB,KAAK,iBAAiB;KAC/C,sCAAsC,KAAK,iBAAiB;;IAE9D,mBAAmB,KAAK;IACxB,cAAc,KAAK;IACnB,oBAAoB,KAAK;IACzB,YAAY,KAAK;;;EAGrB,SAAS,KAAK;;CAGhB,MAAM,aAAa,6CAA6C;AAChE,QAAO,2BAA2B;EAChC;EACA,0BAA0B,KAAK;EAC/B,eAAe,KAAK,gBAAgB;EACpC,UAAU,KAAK;;;AAInB,SAAS,2BAA2B,MASjC;CACD,MAAM,qBAAqB,KAAK,WAAW,QAAQ,sBAAsB;AACzE,KAAI,mBAAmB,WAAW,KAAK,yBACrC,OAAM,IAAI,MACR,YAAY,KAAK,yBAAyB,oCAAoC,mBAAmB;AAIrG,QAAO,mBAAmB,KAAK,UAAU,UAAU;AACjD,MAAI,CAAC,YAAY,CAAC,SAAS,eAAe,CAAC,SAAS,UAClD,OAAM,IAAI,MAAM,+DAA+D,QAAQ;AAEzF,SAAO;GACL,mBAAmB,IAAI,kBAAkB;IACvC,aAAa,SAAS;IACtB,WAAW,SAAS;IACpB,aAAa,MAAM,KAAK,SAAS,cAAc;;GAEjD,eAAe,YAAY,KAAK;GAChC,MAAM,CAAC,GAAI,KAAK,WAAW,QAAQ,QAAQ,IAAK,GAAG,KAAK;;;;AAwB9D,SAAS,iCAAiC,MAOvB;CACjB,MAAM,iBAAiB,OAAO,KAAK,iBAAiB,aAAa,IAAI;AACrE,KAAI,CAAC,eACH,OAAM,IAAI,MAAM,wCAAwC,KAAK;AAG/D,KAAI,KAAK,uBAAuB,mBAC9B,QAAO;EAAE,oBAAoB;EAAgB,yBAAyB;EAAgB,WAAW;;CAGnG,MAAM,uBAAuB,KAAK;AAClC,KAAI,CAAC,qBACH,OAAM,IAAI,MAAM,sCAAsC,KAAK;CAG7D,MAAM,qBAAqB,OAAO,qBAAqB,aAAa,IAAI;AACxE,KAAI,CAAC,mBACH,OAAM,IAAI,MAAM,4CAA4C,KAAK;CAGnE,MAAM,aAAa,OAAO,KAAK,cAAc,IAAI;AACjD,KAAI,CAAC,WACH,OAAM,IAAI,MAAM;CAGlB,MAAM,OAAO,OAAO,KAAK,QAAQ,IAAI;AACrC,KAAI,CAAC,KACH,OAAM,IAAI,MAAM;CAGlB,MAAM,iBAAiB,wCAAwC,qBAAqB,aAAa,KAAK,MAAM,EAAE;AAC9G,KAAI,CAAC,kBAAkB,eAAe,SAAS,EAC7C,OAAM,IAAI,MACR,8EAA8E,kBAAkB,IAAI,KAAK,KAAK;CAIlH,MAAM,2BAA2B,wCAAwC;EACvE,eAAe,KAAK;EACpB;EACA;EACA,cAAc,qBAAqB;EACnC;;AAGF,QAAO;EACL,oBAAoB;EACpB,yBAAyB;EACzB,WAAW;GACT;GACA;GACA;GACA,qBAAqB,wCAAwC;;;;AAKnE,SAAS,uCAAuC,cAU9C;CACA,MAAMC,qBAAmE,aAAa,aAClF,qBAAqB,aAAa,cAClC;AAEJ,QAAO;EACL,cAAc,aAAa;EAC3B,oBAAoB,aAAa;EACjC,cAAc,aAAa;EAC3B,YAAY,qBAAqB,KAAK,UAAU,sBAAsB;;;AAI1E,SAAS,6CACP,UAC6E;AAC7E,KAAI,CAAC,qCAAqC,WAAW;AACnD,MAAI,cAAc,UAChB,OAAM,IAAI,MAAM,SAAS,QAAQ,SAAS;AAE5C,QAAM,IAAI,MAAM;;AAGlB,KAAI,CAAC,SAAS,QAAQ,QACpB,OAAM,IAAI,MAAM,SAAS,QAAQ,SAAS;AAE5C,QAAO"}

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/validation.js

@@ -0,0 +1,74 @@
+import { assertString, ensureEd25519Prefix, isObject } from "../../../../utils/validation.js";
+import { base58Encode } from "../../../../utils/base58.js";
+import { validateVRFChallenge } from "../../../types/vrf-worker.js";
+import { normalizeRegistrationCredential } from "../../credentialsHelpers.js";
+
+//#region src/core/WebAuthnManager/SignerWorkerManager/handlers/validation.ts
+const toPublicKeyString = (pk) => {
+	if (typeof pk === "string") return pk;
+	return ensureEd25519Prefix(base58Encode(pk.keyData));
+};
+function validateTransactionContextMaybe(input) {
+	if (input == null) return void 0;
+	if (!isObject(input)) throw new Error("Invalid transactionContext: expected object");
+	const { nearPublicKeyStr, nextNonce, txBlockHeight, txBlockHash, accessKeyInfo } = input;
+	const normalizedNearPublicKeyStr = assertString(nearPublicKeyStr, "transactionContext.nearPublicKeyStr");
+	const normalizedNextNonce = assertString(nextNonce, "transactionContext.nextNonce");
+	const normalizedTxBlockHeight = assertString(txBlockHeight, "transactionContext.txBlockHeight");
+	const normalizedTxBlockHash = assertString(txBlockHash, "transactionContext.txBlockHash");
+	let normalizedAccessKeyInfo = accessKeyInfo;
+	if (normalizedAccessKeyInfo != null && !isObject(normalizedAccessKeyInfo)) throw new Error("Invalid transactionContext.accessKeyInfo: expected object");
+	if (normalizedAccessKeyInfo == null) normalizedAccessKeyInfo = { nonce: 0 };
+	return {
+		nearPublicKeyStr: normalizedNearPublicKeyStr,
+		nextNonce: normalizedNextNonce,
+		txBlockHeight: normalizedTxBlockHeight,
+		txBlockHash: normalizedTxBlockHash,
+		accessKeyInfo: normalizedAccessKeyInfo
+	};
+}
+function validateCredentialMaybe(input) {
+	if (input == null) return void 0;
+	const cred = normalizeRegistrationCredential(input);
+	if (cred.type !== "public-key") throw new Error("Invalid credential.type: expected \"public-key\"");
+	const { id, rawId, response, authenticatorAttachment } = cred;
+	assertString(id, "credential.id");
+	assertString(rawId, "credential.rawId");
+	if (!isObject(response)) throw new Error("Invalid credential.response: expected object");
+	const { clientDataJSON, attestationObject, transports } = response;
+	assertString(clientDataJSON, "credential.response.clientDataJSON");
+	assertString(attestationObject, "credential.response.attestationObject");
+	if (!Array.isArray(transports)) throw new Error("Invalid credential.response.transports: expected string[]");
+	for (const t of transports) if (typeof t !== "string") throw new Error("Invalid credential.response.transports item: expected string");
+	if (authenticatorAttachment != null && typeof authenticatorAttachment !== "string") throw new Error("Invalid credential.authenticatorAttachment: expected string | undefined");
+	return cred;
+}
+function validateVrfChallengeMaybe(input) {
+	if (input == null) return void 0;
+	return validateVRFChallenge(input);
+}
+function parseAndValidateRegistrationCredentialConfirmationPayload(payload) {
+	if (!isObject(payload)) throw new Error("Invalid response payload: expected object");
+	const { confirmed, requestId, intentDigest, credential, vrfChallenge, transactionContext, error } = payload;
+	const normalizedRequestId = assertString(requestId, "requestId");
+	const normalizedIntentDigest = intentDigest == null ? "" : assertString(intentDigest, "intentDigest");
+	const normalizedCredential = credential != null ? validateCredentialMaybe(credential) : void 0;
+	if (!normalizedCredential) throw new Error("Missing registration credential");
+	const normalizedVrfChallenge = vrfChallenge != null ? validateVrfChallengeMaybe(vrfChallenge) : void 0;
+	if (!normalizedVrfChallenge) throw new Error("Missing VRF Challenge");
+	const normalizedTransactionContext = transactionContext != null ? validateTransactionContextMaybe(transactionContext) : void 0;
+	const normalizedError = error == null ? void 0 : assertString(error, "error");
+	return {
+		confirmed: !!confirmed,
+		requestId: normalizedRequestId,
+		intentDigest: normalizedIntentDigest,
+		credential: normalizedCredential,
+		vrfChallenge: normalizedVrfChallenge,
+		transactionContext: normalizedTransactionContext,
+		error: normalizedError
+	};
+}
+
+//#endregion
+export { parseAndValidateRegistrationCredentialConfirmationPayload, toPublicKeyString };
+//# sourceMappingURL=validation.js.map

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","names":[],"sources":["../../../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/validation.ts"],"sourcesContent":["import { normalizeRegistrationCredential } from '../../credentialsHelpers';\nimport type { WebAuthnRegistrationCredential } from '../../../types/webauthn';\nimport { validateVRFChallenge, type VRFChallenge } from '../../../types/vrf-worker';\nimport type { TransactionContext } from '../../../types/rpc';\nimport { isObject, assertString } from '@/utils/validation';\nimport { DelegateActionInput } from '../../../types/delegate';\nimport { base58Encode } from '../../../../utils/base58';\n\nimport { ensureEd25519Prefix } from '../../../nearCrypto';\nexport { ensureEd25519Prefix };\n\nexport const toPublicKeyString = (pk: DelegateActionInput['publicKey']): string => {\n  if (typeof pk === 'string') {\n    return pk;\n  }\n  return ensureEd25519Prefix(base58Encode(pk.keyData));\n};\n\n// Strongly typed payload expected from the WASM → JS boundary\nexport interface RegistrationCredentialConfirmationPayload {\n  confirmed: boolean;\n  requestId: string;\n  intentDigest: string;\n  credential: WebAuthnRegistrationCredential; // serialized PublicKeyCredential (no methods)\n  vrfChallenge: VRFChallenge;\n  transactionContext?: TransactionContext;\n  error?: string;\n}\n\nfunction validateTransactionContextMaybe(input: unknown): TransactionContext | undefined {\n  if (input == null) return undefined;\n  if (!isObject(input)) {\n    throw new Error('Invalid transactionContext: expected object');\n  }\n\n  const {\n    nearPublicKeyStr,\n    nextNonce,\n    txBlockHeight,\n    txBlockHash,\n    accessKeyInfo,\n  } = input as {\n    nearPublicKeyStr?: unknown;\n    nextNonce?: unknown;\n    txBlockHeight?: unknown;\n    txBlockHash?: unknown;\n    accessKeyInfo?: unknown;\n  };\n\n  // Minimal structural validation; AccessKeyView is complex. Be tolerant because the WASM struct omits it.\n  const normalizedNearPublicKeyStr = assertString(\n    nearPublicKeyStr,\n    'transactionContext.nearPublicKeyStr',\n  );\n  const normalizedNextNonce = assertString(nextNonce, 'transactionContext.nextNonce');\n  const normalizedTxBlockHeight = assertString(\n    txBlockHeight,\n    'transactionContext.txBlockHeight',\n  );\n  const normalizedTxBlockHash = assertString(txBlockHash, 'transactionContext.txBlockHash');\n\n  let normalizedAccessKeyInfo = accessKeyInfo as TransactionContext['accessKeyInfo'] | undefined;\n  if (normalizedAccessKeyInfo != null && !isObject(normalizedAccessKeyInfo)) {\n    throw new Error('Invalid transactionContext.accessKeyInfo: expected object');\n  }\n  if (normalizedAccessKeyInfo == null) {\n    // Synthesize a minimal placeholder; not used by registration flows consuming this payload\n    normalizedAccessKeyInfo = { nonce: 0 } as unknown as TransactionContext['accessKeyInfo'];\n  }\n\n  return {\n    nearPublicKeyStr: normalizedNearPublicKeyStr,\n    nextNonce: normalizedNextNonce,\n    txBlockHeight: normalizedTxBlockHeight,\n    txBlockHash: normalizedTxBlockHash,\n    accessKeyInfo: normalizedAccessKeyInfo,\n  };\n}\n\nfunction validateCredentialMaybe(input: unknown): WebAuthnRegistrationCredential | undefined {\n  if (input == null) return undefined;\n\n  const cred = normalizeRegistrationCredential(input);\n  if (cred.type !== 'public-key') {\n    throw new Error('Invalid credential.type: expected \"public-key\"');\n  }\n\n  const { id, rawId, response, authenticatorAttachment } = cred as {\n    id?: unknown;\n    rawId?: unknown;\n    response?: unknown;\n    authenticatorAttachment?: unknown;\n  };\n\n  // Core field/type validation (serialized shapes should be base64url strings)\n  assertString(id, 'credential.id');\n  assertString(rawId, 'credential.rawId');\n\n  if (!isObject(response)) {\n    throw new Error('Invalid credential.response: expected object');\n  }\n\n  const {\n    clientDataJSON,\n    attestationObject,\n    transports,\n  } = response as {\n    clientDataJSON?: unknown;\n    attestationObject?: unknown;\n    transports?: unknown;\n  };\n\n  assertString(clientDataJSON, 'credential.response.clientDataJSON');\n  assertString(attestationObject, 'credential.response.attestationObject');\n\n  if (!Array.isArray(transports)) {\n    throw new Error('Invalid credential.response.transports: expected string[]');\n  }\n  for (const t of transports) {\n    if (typeof t !== 'string') {\n      throw new Error('Invalid credential.response.transports item: expected string');\n    }\n  }\n\n  if (authenticatorAttachment != null && typeof authenticatorAttachment !== 'string') {\n    throw new Error('Invalid credential.authenticatorAttachment: expected string | undefined');\n  }\n\n  // Note: prf.results may be undefined/null here. We intentionally do NOT\n  // require them at the boundary; internal callers that need PRF (e.g. key\n  // derivation) will extract/compute them separately. Contract payloads must\n  // not include PRF values.\n  return cred;\n}\n\nfunction validateVrfChallengeMaybe(input: unknown): VRFChallenge | undefined {\n  if (input == null) return undefined;\n  return validateVRFChallenge(input as Parameters<typeof validateVRFChallenge>[0]);\n}\n\nexport function parseAndValidateRegistrationCredentialConfirmationPayload(\n  payload: unknown,\n): RegistrationCredentialConfirmationPayload {\n\n  if (!isObject(payload)) {\n    throw new Error('Invalid response payload: expected object');\n  }\n\n  const {\n    confirmed,\n    requestId,\n    intentDigest,\n    credential,\n    vrfChallenge,\n    transactionContext,\n    error,\n  } = payload as {\n    confirmed?: unknown;\n    requestId?: unknown;\n    intentDigest?: unknown;\n    credential?: unknown;\n    vrfChallenge?: unknown;\n    transactionContext?: unknown;\n    error?: unknown;\n  };\n\n  const normalizedRequestId = assertString(requestId, 'requestId');\n\n  // intentDigest is only used for TX signing requests, not registration or link device requests\n  const normalizedIntentDigest =\n    intentDigest == null ? '' : assertString(intentDigest, 'intentDigest');\n\n  const normalizedCredential =\n    credential != null ? validateCredentialMaybe(credential) : undefined;\n\n  if (!normalizedCredential) {\n    throw new Error('Missing registration credential');\n  }\n\n  const normalizedVrfChallenge =\n    vrfChallenge != null ? validateVrfChallengeMaybe(vrfChallenge) : undefined;\n\n  if (!normalizedVrfChallenge) {\n    throw new Error('Missing VRF Challenge');\n  }\n\n  const normalizedTransactionContext =\n    transactionContext != null ? validateTransactionContextMaybe(transactionContext) : undefined;\n\n  const normalizedError =\n    error == null ? undefined : assertString(error, 'error');\n\n  return {\n    confirmed: !!confirmed,\n    requestId: normalizedRequestId,\n    intentDigest: normalizedIntentDigest,\n    credential: normalizedCredential,\n    vrfChallenge: normalizedVrfChallenge,\n    transactionContext: normalizedTransactionContext,\n    error: normalizedError,\n  };\n}"],"mappings":";;;;;;AAWA,MAAa,qBAAqB,OAAiD;AACjF,KAAI,OAAO,OAAO,SAChB,QAAO;AAET,QAAO,oBAAoB,aAAa,GAAG;;AAc7C,SAAS,gCAAgC,OAAgD;AACvF,KAAI,SAAS,KAAM,QAAO;AAC1B,KAAI,CAAC,SAAS,OACZ,OAAM,IAAI,MAAM;CAGlB,MAAM,EACJ,kBACA,WACA,eACA,aACA,kBACE;CASJ,MAAM,6BAA6B,aACjC,kBACA;CAEF,MAAM,sBAAsB,aAAa,WAAW;CACpD,MAAM,0BAA0B,aAC9B,eACA;CAEF,MAAM,wBAAwB,aAAa,aAAa;CAExD,IAAI,0BAA0B;AAC9B,KAAI,2BAA2B,QAAQ,CAAC,SAAS,yBAC/C,OAAM,IAAI,MAAM;AAElB,KAAI,2BAA2B,KAE7B,2BAA0B,EAAE,OAAO;AAGrC,QAAO;EACL,kBAAkB;EAClB,WAAW;EACX,eAAe;EACf,aAAa;EACb,eAAe;;;AAInB,SAAS,wBAAwB,OAA4D;AAC3F,KAAI,SAAS,KAAM,QAAO;CAE1B,MAAM,OAAO,gCAAgC;AAC7C,KAAI,KAAK,SAAS,aAChB,OAAM,IAAI,MAAM;CAGlB,MAAM,EAAE,IAAI,OAAO,UAAU,4BAA4B;AAQzD,cAAa,IAAI;AACjB,cAAa,OAAO;AAEpB,KAAI,CAAC,SAAS,UACZ,OAAM,IAAI,MAAM;CAGlB,MAAM,EACJ,gBACA,mBACA,eACE;AAMJ,cAAa,gBAAgB;AAC7B,cAAa,mBAAmB;AAEhC,KAAI,CAAC,MAAM,QAAQ,YACjB,OAAM,IAAI,MAAM;AAElB,MAAK,MAAM,KAAK,WACd,KAAI,OAAO,MAAM,SACf,OAAM,IAAI,MAAM;AAIpB,KAAI,2BAA2B,QAAQ,OAAO,4BAA4B,SACxE,OAAM,IAAI,MAAM;AAOlB,QAAO;;AAGT,SAAS,0BAA0B,OAA0C;AAC3E,KAAI,SAAS,KAAM,QAAO;AAC1B,QAAO,qBAAqB;;AAG9B,SAAgB,0DACd,SAC2C;AAE3C,KAAI,CAAC,SAAS,SACZ,OAAM,IAAI,MAAM;CAGlB,MAAM,EACJ,WACA,WACA,cACA,YACA,cACA,oBACA,UACE;CAUJ,MAAM,sBAAsB,aAAa,WAAW;CAGpD,MAAM,yBACJ,gBAAgB,OAAO,KAAK,aAAa,cAAc;CAEzD,MAAM,uBACJ,cAAc,OAAO,wBAAwB,cAAc;AAE7D,KAAI,CAAC,qBACH,OAAM,IAAI,MAAM;CAGlB,MAAM,yBACJ,gBAAgB,OAAO,0BAA0B,gBAAgB;AAEnE,KAAI,CAAC,uBACH,OAAM,IAAI,MAAM;CAGlB,MAAM,+BACJ,sBAAsB,OAAO,gCAAgC,sBAAsB;CAErF,MAAM,kBACJ,SAAS,OAAO,SAAY,aAAa,OAAO;AAElD,QAAO;EACL,WAAW,CAAC,CAAC;EACb,WAAW;EACX,cAAc;EACd,YAAY;EACZ,cAAc;EACd,oBAAoB;EACpB,OAAO"}