@tatchi-xyz/sdk 0.20.0 → 0.31.0

package/dist/esm/react/src/core/rpcCalls.js

@@ -0,0 +1,672 @@
+import { ensureEd25519Prefix } from "../utils/validation.js";
+import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
+import { errorMessage } from "../utils/errors.js";
+import { DEFAULT_EMAIL_RECOVERY_CONTRACTS } from "./defaultConfigs.js";
+import { DEFAULT_WAIT_STATUS } from "./types/rpc.js";
+import { createRandomVRFChallenge } from "./types/vrf-worker.js";
+import { ActionPhase, DeviceLinkingPhase, DeviceLinkingStatus } from "./types/sdkSentEvents.js";
+import { ActionType } from "./types/actions.js";
+
+//#region src/core/rpcCalls.ts
+function normalizeByteArray(input) {
+	if (input == null) return input;
+	if (Array.isArray(input)) return input.map((v) => Number(v)).filter((v) => Number.isFinite(v));
+	if (typeof input === "string" && input) try {
+		const bytes = typeof Buffer !== "undefined" ? Buffer.from(input, "base64") : Uint8Array.from(atob(input), (c) => c.charCodeAt(0));
+		const arr = bytes instanceof Uint8Array ? Array.from(bytes) : Array.from(new Uint8Array(bytes));
+		return arr;
+	} catch {
+		return void 0;
+	}
+	return void 0;
+}
+async function getEmailRecoveryAttempt(nearClient, accountId, requestId) {
+	const raw = await nearClient.view({
+		account: accountId,
+		method: "get_recovery_attempt",
+		args: { request_id: requestId }
+	});
+	if (!raw) return null;
+	const statusRaw = raw.status;
+	const status = (() => {
+		if (typeof statusRaw === "string") return statusRaw.trim();
+		if (statusRaw && typeof statusRaw === "object") {
+			const keys = Object.keys(statusRaw);
+			if (keys.length === 1) return String(keys[0] || "").trim();
+		}
+		return "";
+	})();
+	return {
+		...raw,
+		from_address_hash: normalizeByteArray(raw.from_address_hash) ?? raw.from_address_hash,
+		status
+	};
+}
+/**
+* Query the contract to get the account linked to a device public key
+* Used in device linking flow to check if a device key has been added
+*
+* NEAR does not provide a way to lookup the AccountID an access key has access to.
+* So we store a temporary mapping in the contract to lookup pubkey -> account ID.
+*/
+async function getDeviceLinkingAccountContractCall(nearClient, contractId, devicePublicKey) {
+	try {
+		const result = await nearClient.callFunction(contractId, "get_device_linking_account", { device_public_key: devicePublicKey });
+		if (result && Array.isArray(result) && result.length >= 2) {
+			const [linkedAccountId, deviceNumberRaw] = result;
+			const deviceNumber = Number(deviceNumberRaw);
+			if (!Number.isSafeInteger(deviceNumber) || deviceNumber < 0) {
+				console.warn("Invalid deviceNumber returned from get_device_linking_account:", deviceNumberRaw);
+				return null;
+			}
+			return {
+				linkedAccountId,
+				deviceNumber
+			};
+		}
+		return null;
+	} catch (error) {
+		console.warn("Failed to get device linking account:", error.message);
+		return null;
+	}
+}
+/**
+* Execute device1's linking transactions (AddKey + Contract mapping)
+* This function signs and broadcasts both transactions required for device linking
+*/
+async function executeDeviceLinkingContractCalls({ context, device1AccountId, device2PublicKey, nextNonce, nextNextNonce, nextNextNextNonce, txBlockHash, vrfChallenge, onEvent, confirmationConfigOverride, confirmerText }) {
+	const signTransactions = () => context.webAuthnManager.signTransactionsWithActions({
+		rpcCall: {
+			contractId: context.webAuthnManager.tatchiPasskeyConfigs.contractId,
+			nearRpcUrl: context.webAuthnManager.tatchiPasskeyConfigs.nearRpcUrl,
+			nearAccountId: device1AccountId
+		},
+		signerMode: {
+			mode: "threshold-signer",
+			behavior: "fallback"
+		},
+		confirmationConfigOverride,
+		title: confirmerText?.title,
+		body: confirmerText?.body,
+		transactions: [
+			{
+				receiverId: device1AccountId,
+				actions: [{
+					action_type: ActionType.AddKey,
+					public_key: device2PublicKey,
+					access_key: JSON.stringify({
+						nonce: 0,
+						permission: { FullAccess: {} }
+					})
+				}],
+				nonce: nextNonce
+			},
+			{
+				receiverId: context.webAuthnManager.tatchiPasskeyConfigs.contractId,
+				actions: [{
+					action_type: ActionType.FunctionCall,
+					method_name: "store_device_linking_mapping",
+					args: JSON.stringify({
+						device_public_key: device2PublicKey,
+						target_account_id: device1AccountId
+					}),
+					gas: "30000000000000",
+					deposit: "0"
+				}],
+				nonce: nextNextNonce
+			},
+			{
+				receiverId: device1AccountId,
+				actions: [{
+					action_type: ActionType.DeleteKey,
+					public_key: device2PublicKey
+				}],
+				nonce: nextNextNextNonce
+			}
+		],
+		onEvent: (progress) => {
+			try {
+				onEvent?.(progress);
+			} catch {}
+			if (progress.phase == ActionPhase.STEP_6_TRANSACTION_SIGNING_COMPLETE) onEvent?.({
+				step: 3,
+				phase: DeviceLinkingPhase.STEP_3_AUTHORIZATION,
+				status: DeviceLinkingStatus.PROGRESS,
+				message: progress.message || "Transaction signing in progress..."
+			});
+		}
+	});
+	let signedTransactions = [];
+	try {
+		signedTransactions = await signTransactions();
+	} catch (e) {
+		if (!isVrfSessionPasskeyMismatchError(e)) throw e;
+		onEvent?.({
+			step: 3,
+			phase: DeviceLinkingPhase.STEP_3_AUTHORIZATION,
+			status: DeviceLinkingStatus.PROGRESS,
+			message: "Session mismatch detected; re-authenticating with TouchID..."
+		});
+		await repairVrfSessionForCurrentDevice({
+			context,
+			nearAccountId: device1AccountId,
+			remainingUses: 3,
+			ttlMs: 120 * 1e3
+		});
+		signedTransactions = await signTransactions();
+	}
+	if (!signedTransactions[0].signedTransaction) throw new Error("AddKey transaction signing failed");
+	if (!signedTransactions[1].signedTransaction) throw new Error("Contract mapping transaction signing failed");
+	if (!signedTransactions[2].signedTransaction) throw new Error("DeleteKey transaction signing failed");
+	let addKeyTxResult;
+	let storeDeviceLinkingTxResult;
+	try {
+		console.debug("LinkDeviceFlow: AddKey transaction details:", {
+			receiverId: signedTransactions[0].signedTransaction.transaction.receiverId,
+			actions: signedTransactions[0].signedTransaction.transaction.actions || [],
+			transactionKeys: Object.keys(signedTransactions[0].signedTransaction.transaction)
+		});
+		addKeyTxResult = await context.nearClient.sendTransaction(signedTransactions[0].signedTransaction, DEFAULT_WAIT_STATUS.linkDeviceAddKey);
+		console.log("LinkDeviceFlow: AddKey transaction result:", addKeyTxResult?.transaction?.hash);
+		onEvent?.({
+			step: 3,
+			phase: DeviceLinkingPhase.STEP_3_AUTHORIZATION,
+			status: DeviceLinkingStatus.SUCCESS,
+			message: `AddKey transaction completed successfully!`
+		});
+		const contractTx = signedTransactions[1].signedTransaction;
+		console.log("LinkDeviceFlow: Contract mapping transaction details:", {
+			receiverId: contractTx.transaction.receiverId,
+			actions: (contractTx.transaction.actions || []).length
+		});
+		storeDeviceLinkingTxResult = await context.nearClient.sendTransaction(contractTx, DEFAULT_WAIT_STATUS.linkDeviceAccountMapping);
+	} catch (txError) {
+		console.error("LinkDeviceFlow: Transaction broadcasting failed:", txError);
+		throw new Error(`Transaction broadcasting failed: ${txError.message}`);
+	}
+	onEvent?.({
+		step: 6,
+		phase: DeviceLinkingPhase.STEP_6_REGISTRATION,
+		status: DeviceLinkingStatus.SUCCESS,
+		message: `Device linking completed successfully!`
+	});
+	return {
+		addKeyTxResult,
+		storeDeviceLinkingTxResult,
+		signedDeleteKeyTransaction: signedTransactions[2].signedTransaction
+	};
+}
+function isVrfSessionPasskeyMismatchError(err) {
+	const msg = errorMessage(err) || String(err || "");
+	return msg.includes("different passkey/VRF session than the current device");
+}
+async function repairVrfSessionForCurrentDevice(args) {
+	const { context, nearAccountId } = args;
+	const lastUser = await context.webAuthnManager.getLastUser();
+	if (!lastUser || lastUser.nearAccountId !== nearAccountId) throw new Error("Cannot repair VRF session: no lastUser for this account. Please log in again.");
+	const deviceNumber = lastUser.deviceNumber;
+	if (!Number.isFinite(deviceNumber) || deviceNumber < 1) throw new Error("Cannot repair VRF session: invalid lastUser.deviceNumber");
+	const authenticators = await context.webAuthnManager.getAuthenticatorsByUser(nearAccountId);
+	const credentialIdsForDevice = authenticators.filter((a) => a.deviceNumber === deviceNumber).map((a) => a.credentialId);
+	const credentialIds = credentialIdsForDevice.length > 0 ? credentialIdsForDevice : authenticators.map((a) => a.credentialId);
+	if (credentialIds.length === 0) throw new Error(`Cannot repair VRF session: no authenticators found for ${nearAccountId}`);
+	const challenge = createRandomVRFChallenge();
+	const credential = await context.webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({
+		nearAccountId,
+		challenge,
+		credentialIds
+	});
+	const unlockResult = await context.webAuthnManager.unlockVRFKeypair({
+		nearAccountId,
+		encryptedVrfKeypair: lastUser.encryptedVrfKeypair,
+		credential
+	});
+	if (!unlockResult.success) throw new Error(unlockResult.error || "Failed to re-unlock VRF keypair for current device");
+	await context.webAuthnManager.mintSigningSessionFromCredential({
+		nearAccountId,
+		credential,
+		ttlMs: args.ttlMs,
+		remainingUses: args.remainingUses
+	});
+}
+/**
+* Get credential IDs associated with an account from the contract
+* Used in account recovery to discover available credentials
+*/
+async function getCredentialIdsContractCall(nearClient, contractId, accountId) {
+	try {
+		const credentialIds = await nearClient.callFunction(contractId, "get_credential_ids_by_account", { account_id: accountId });
+		return credentialIds || [];
+	} catch (error) {
+		console.warn("Failed to fetch credential IDs from contract:", error.message);
+		return [];
+	}
+}
+/**
+* Get all authenticators stored for a user from the contract
+* Used in account recovery to sync authenticator data
+*/
+async function getAuthenticatorsByUser(nearClient, contractId, accountId) {
+	try {
+		const authenticatorsResult = await nearClient.view({
+			account: contractId,
+			method: "get_authenticators_by_user",
+			args: { user_id: accountId }
+		});
+		if (authenticatorsResult && Array.isArray(authenticatorsResult)) return authenticatorsResult;
+		return [];
+	} catch (error) {
+		console.warn("Failed to fetch authenticators from contract:", error.message);
+		return [];
+	}
+}
+async function syncAuthenticatorsContractCall(nearClient, contractId, accountId) {
+	try {
+		const authenticatorsResult = await getAuthenticatorsByUser(nearClient, contractId, accountId);
+		if (authenticatorsResult && Array.isArray(authenticatorsResult)) return authenticatorsResult.map(([credentialId, contractAuthenticator]) => {
+			console.log(`Contract authenticator device_number for ${credentialId}:`, contractAuthenticator.device_number);
+			const transports = Array.isArray(contractAuthenticator.transports) ? contractAuthenticator.transports : [];
+			const registered = (() => {
+				const raw = String(contractAuthenticator.registered ?? "");
+				if (!raw) return /* @__PURE__ */ new Date(0);
+				if (/^\d+$/.test(raw)) {
+					const ts = Number(raw);
+					return Number.isFinite(ts) ? new Date(ts) : /* @__PURE__ */ new Date(0);
+				}
+				const d = new Date(raw);
+				return Number.isFinite(d.getTime()) ? d : /* @__PURE__ */ new Date(0);
+			})();
+			const vrfPublicKeys = (() => {
+				const raw = contractAuthenticator.vrf_public_keys;
+				if (!raw) return void 0;
+				if (Array.isArray(raw) && raw.length > 0 && typeof raw[0] === "string") return raw;
+				if (Array.isArray(raw)) return raw.map((entry) => {
+					if (!entry) return null;
+					if (entry instanceof Uint8Array) return base64UrlEncode(entry);
+					if (Array.isArray(entry)) return base64UrlEncode(new Uint8Array(entry));
+					return null;
+				}).filter((x) => typeof x === "string" && x.length > 0);
+				return void 0;
+			})();
+			const nearPublicKey = (() => {
+				const raw = contractAuthenticator.near_public_key;
+				if (typeof raw !== "string") return void 0;
+				const trimmed = raw.trim();
+				return trimmed ? ensureEd25519Prefix(trimmed) : void 0;
+			})();
+			return {
+				credentialId,
+				authenticator: {
+					credentialId,
+					credentialPublicKey: new Uint8Array(contractAuthenticator.credential_public_key),
+					transports,
+					userId: accountId,
+					name: `Device ${contractAuthenticator.device_number} Authenticator`,
+					registered,
+					deviceNumber: contractAuthenticator.device_number,
+					vrfPublicKeys
+				},
+				...nearPublicKey ? { nearPublicKey } : {}
+			};
+		});
+		return [];
+	} catch (error) {
+		console.warn("Failed to fetch authenticators from contract:", error.message);
+		return [];
+	}
+}
+const EMPTY_NEAR_CODE_HASH = "11111111111111111111111111111111";
+async function hasDeployedContractCode(nearClient, accountId) {
+	try {
+		const account = await nearClient.viewAccount(accountId);
+		const codeHash = account?.code_hash;
+		const globalContractHash = account?.global_contract_hash;
+		const globalContractAccountId = account?.global_contract_account_id;
+		const hasLocalCode = typeof codeHash === "string" && codeHash !== EMPTY_NEAR_CODE_HASH;
+		const hasGlobalCode = typeof globalContractHash === "string" && globalContractHash.trim().length > 0 || typeof globalContractAccountId === "string" && globalContractAccountId.trim().length > 0;
+		return hasLocalCode || hasGlobalCode;
+	} catch {
+		return false;
+	}
+}
+/**
+* Fetch on-chain recovery email hashes from the per-account contract.
+* Returns [] when no contract is deployed or on failure.
+*/
+async function getRecoveryEmailHashesContractCall(nearClient, accountId) {
+	try {
+		const hasContract = await hasDeployedContractCode(nearClient, accountId);
+		if (!hasContract) return [];
+		const hashes = await nearClient.view({
+			account: accountId,
+			method: "get_recovery_emails",
+			args: {}
+		});
+		return Array.isArray(hashes) ? hashes : [];
+	} catch (error) {
+		return [];
+	}
+}
+/**
+* Build action args to update on-chain recovery emails for an account.
+* If the per-account contract is missing, deploy/attach the global recoverer via `init_email_recovery`.
+*/
+async function buildSetRecoveryEmailsActions(nearClient, accountId, recoveryEmailHashes, contracts = DEFAULT_EMAIL_RECOVERY_CONTRACTS) {
+	const hasContract = await hasDeployedContractCode(nearClient, accountId);
+	const { emailRecovererGlobalContract, zkEmailVerifierContract, emailDkimVerifierContract } = contracts;
+	let shouldInit = !hasContract;
+	if (!shouldInit) try {
+		await nearClient.view({
+			account: accountId,
+			method: "get_recovery_emails",
+			args: {}
+		});
+	} catch (err) {
+		const msg = errorMessage(err);
+		if (/Cannot deserialize the contract state/i.test(msg) || /CodeDoesNotExist/i.test(msg) || /MethodNotFound/i.test(msg)) shouldInit = true;
+	}
+	const base = [{
+		type: ActionType.UseGlobalContract,
+		accountId: emailRecovererGlobalContract
+	}];
+	return shouldInit ? [...base, {
+		type: ActionType.FunctionCall,
+		methodName: "init_email_recovery",
+		args: {
+			zk_email_verifier: zkEmailVerifierContract,
+			email_dkim_verifier: emailDkimVerifierContract,
+			policy: null,
+			recovery_emails: recoveryEmailHashes
+		},
+		gas: "80000000000000",
+		deposit: "0"
+	}] : [...base, {
+		type: ActionType.FunctionCall,
+		methodName: "set_recovery_emails",
+		args: { recovery_emails: recoveryEmailHashes },
+		gas: "80000000000000",
+		deposit: "0"
+	}];
+}
+function sleep(ms) {
+	return new Promise((res) => setTimeout(res, ms));
+}
+function isAccessKeyNotFoundError(err) {
+	const msg = String(errorMessage(err) || "").toLowerCase();
+	if (!msg) return false;
+	if (msg.includes("unknown access key") || msg.includes("unknown_access_key") || msg.includes("unknownaccesskey")) return true;
+	if (msg.includes("accesskeydoesnotexist")) return true;
+	if (msg.includes("access key does not exist")) return true;
+	if (msg.includes("access key doesn't exist")) return true;
+	if (msg.includes("access key not found")) return true;
+	if (msg.includes("no such access key")) return true;
+	if (msg.includes("viewing access key") && msg.includes("does not exist") && !msg.includes("account")) return true;
+	return false;
+}
+async function hasAccessKey(nearClient, nearAccountId, publicKey, opts) {
+	const expected = ensureEd25519Prefix(publicKey);
+	if (!expected) return false;
+	const attempts = Math.max(1, Math.floor(opts?.attempts ?? 6));
+	const delayMs = Math.max(50, Math.floor(opts?.delayMs ?? 750));
+	for (let i = 0; i < attempts; i++) {
+		try {
+			await nearClient.viewAccessKey(nearAccountId, expected);
+			return true;
+		} catch {}
+		if (i < attempts - 1) await sleep(delayMs);
+	}
+	return false;
+}
+async function waitForAccessKeyAbsent(nearClient, nearAccountId, publicKey, opts) {
+	const expected = ensureEd25519Prefix(publicKey);
+	if (!expected) return true;
+	const attempts = Math.max(1, Math.floor(opts?.attempts ?? 6));
+	const delayMs = Math.max(50, Math.floor(opts?.delayMs ?? 650));
+	for (let i = 0; i < attempts; i++) {
+		try {
+			await nearClient.viewAccessKey(nearAccountId, expected);
+		} catch (err) {
+			if (isAccessKeyNotFoundError(err)) return true;
+		}
+		if (i < attempts - 1) await sleep(delayMs);
+	}
+	return false;
+}
+/**
+* View-only registration pre-check.
+*
+* Calls the contract's `check_can_register_user` view method with VRF data
+* derived from the provided VRF challenge and a serialized WebAuthn
+* registration credential (typically with PRF outputs embedded).
+*/
+async function checkCanRegisterUserContractCall({ nearClient, contractId, vrfChallenge, credential, authenticatorOptions }) {
+	try {
+		const intent_digest_32 = Array.from(base64UrlDecode(vrfChallenge.intentDigest || ""));
+		if (intent_digest_32.length !== 32) throw new Error("Missing or invalid vrfChallenge.intentDigest (expected base64url-encoded 32 bytes)");
+		const session_policy_digest_32 = vrfChallenge.sessionPolicyDigest32 ? Array.from(base64UrlDecode(vrfChallenge.sessionPolicyDigest32)) : [];
+		if (session_policy_digest_32.length !== 0 && session_policy_digest_32.length !== 32) throw new Error("Invalid vrfChallenge.sessionPolicyDigest32 (expected base64url-encoded 32 bytes)");
+		const vrfData = {
+			vrf_input_data: Array.from(base64UrlDecode(vrfChallenge.vrfInput)),
+			vrf_output: Array.from(base64UrlDecode(vrfChallenge.vrfOutput)),
+			vrf_proof: Array.from(base64UrlDecode(vrfChallenge.vrfProof)),
+			public_key: Array.from(base64UrlDecode(vrfChallenge.vrfPublicKey)),
+			user_id: vrfChallenge.userId,
+			rp_id: vrfChallenge.rpId,
+			block_height: Number(vrfChallenge.blockHeight),
+			block_hash: Array.from(base64UrlDecode(vrfChallenge.blockHash)),
+			intent_digest_32,
+			...session_policy_digest_32.length ? { session_policy_digest_32 } : {}
+		};
+		const args = {
+			vrf_data: vrfData,
+			webauthn_registration: credential,
+			authenticator_options: authenticatorOptions
+		};
+		const response = await nearClient.callFunction(contractId, "check_can_register_user", args);
+		const verified = !!response?.verified;
+		return {
+			success: true,
+			verified,
+			logs: [],
+			error: verified ? void 0 : "Contract registration check failed"
+		};
+	} catch (err) {
+		return {
+			success: false,
+			verified: false,
+			logs: [],
+			error: errorMessage(err) || "Failed to call check_can_register_user"
+		};
+	}
+}
+/**
+* Verify authentication response through relay server
+* Routes the request to relay server which calls the web3authn contract for verification
+* and issues a JWT or session credential
+*/
+async function verifyAuthenticationResponse(relayServerUrl, routePath, sessionKind, vrfChallenge, webauthnAuthentication) {
+	try {
+		const toBytes = (b64u) => {
+			if (!b64u) return [];
+			return Array.from(base64UrlDecode(b64u));
+		};
+		const intent_digest_32 = toBytes(vrfChallenge.intentDigest);
+		if (intent_digest_32.length !== 32) throw new Error("Missing or invalid vrfChallenge.intentDigest (expected base64url-encoded 32 bytes)");
+		const session_policy_digest_32 = toBytes(vrfChallenge.sessionPolicyDigest32);
+		if (session_policy_digest_32.length !== 0 && session_policy_digest_32.length !== 32) throw new Error("Invalid vrfChallenge.sessionPolicyDigest32 (expected base64url-encoded 32 bytes)");
+		const vrf_data = {
+			vrf_input_data: toBytes(vrfChallenge.vrfInput),
+			vrf_output: toBytes(vrfChallenge.vrfOutput),
+			vrf_proof: toBytes(vrfChallenge.vrfProof),
+			public_key: toBytes(vrfChallenge.vrfPublicKey),
+			user_id: vrfChallenge.userId,
+			rp_id: vrfChallenge.rpId,
+			block_height: Number(vrfChallenge.blockHeight || 0),
+			block_hash: toBytes(vrfChallenge.blockHash),
+			intent_digest_32,
+			...session_policy_digest_32.length ? { session_policy_digest_32 } : {}
+		};
+		const webauthn_authentication = {
+			...webauthnAuthentication,
+			authenticatorAttachment: webauthnAuthentication.authenticatorAttachment ?? null,
+			response: {
+				...webauthnAuthentication.response,
+				userHandle: webauthnAuthentication.response.userHandle ?? null
+			}
+		};
+		const url = `${relayServerUrl.replace(/\/$/, "")}${routePath.startsWith("/") ? routePath : `/${routePath}`}`;
+		const response = await fetch(url, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			credentials: sessionKind === "cookie" ? "include" : "omit",
+			body: JSON.stringify({
+				sessionKind,
+				vrf_data,
+				webauthn_authentication
+			})
+		});
+		if (!response.ok) {
+			const errorText = await response.text();
+			return {
+				success: false,
+				error: `HTTP ${response.status}: ${errorText}`
+			};
+		}
+		const result = await response.json();
+		return {
+			success: true,
+			verified: result.verified,
+			jwt: result.jwt,
+			sessionCredential: result.sessionCredential,
+			contractResponse: result.contractResponse
+		};
+	} catch (error) {
+		return {
+			success: false,
+			error: error.message || "Failed to verify authentication response"
+		};
+	}
+}
+async function thresholdEd25519Keygen(relayServerUrl, vrfChallenge, webauthnAuthentication, args) {
+	try {
+		const base = String(relayServerUrl || "").trim().replace(/\/$/, "");
+		if (!base) throw new Error("Missing relayServerUrl");
+		const clientVerifyingShareB64u = String(args.clientVerifyingShareB64u || "").trim();
+		if (!clientVerifyingShareB64u) throw new Error("Missing clientVerifyingShareB64u");
+		const nearAccountId = String(args.nearAccountId || "").trim();
+		if (!nearAccountId) throw new Error("Missing nearAccountId");
+		const toBytes = (b64u) => {
+			if (!b64u) return [];
+			return Array.from(base64UrlDecode(b64u));
+		};
+		const intent_digest_32 = toBytes(vrfChallenge.intentDigest);
+		if (intent_digest_32.length !== 32) throw new Error("Missing or invalid vrfChallenge.intentDigest (expected base64url-encoded 32 bytes)");
+		const vrf_data = {
+			vrf_input_data: toBytes(vrfChallenge.vrfInput),
+			vrf_output: toBytes(vrfChallenge.vrfOutput),
+			vrf_proof: toBytes(vrfChallenge.vrfProof),
+			public_key: toBytes(vrfChallenge.vrfPublicKey),
+			user_id: vrfChallenge.userId,
+			rp_id: vrfChallenge.rpId,
+			block_height: Number(vrfChallenge.blockHeight || 0),
+			block_hash: toBytes(vrfChallenge.blockHash),
+			intent_digest_32
+		};
+		const webauthn_authentication = {
+			...webauthnAuthentication,
+			authenticatorAttachment: webauthnAuthentication.authenticatorAttachment ?? null,
+			response: {
+				...webauthnAuthentication.response,
+				userHandle: webauthnAuthentication.response.userHandle ?? null
+			},
+			clientExtensionResults: null
+		};
+		const url = `${base}/threshold-ed25519/keygen`;
+		const response = await fetch(url, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			credentials: "include",
+			body: JSON.stringify({
+				clientVerifyingShareB64u,
+				nearAccountId,
+				vrf_data,
+				webauthn_authentication
+			})
+		});
+		if (!response.ok) {
+			const errorText = await response.text();
+			return {
+				ok: false,
+				error: `HTTP ${response.status}: ${errorText}`
+			};
+		}
+		const json = await response.json();
+		return {
+			ok: !!json?.ok,
+			clientParticipantId: json?.clientParticipantId,
+			relayerParticipantId: json?.relayerParticipantId,
+			participantIds: json?.participantIds,
+			relayerKeyId: json?.relayerKeyId,
+			publicKey: json?.publicKey,
+			relayerVerifyingShareB64u: json?.relayerVerifyingShareB64u,
+			code: json?.code,
+			message: json?.message
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			error: error?.message || "Failed to keygen threshold-ed25519"
+		};
+	}
+}
+async function thresholdEd25519KeygenFromRegistrationTx(relayServerUrl, args) {
+	try {
+		const base = String(relayServerUrl || "").trim().replace(/\/$/, "");
+		if (!base) throw new Error("Missing relayServerUrl");
+		const clientVerifyingShareB64u = String(args.clientVerifyingShareB64u || "").trim();
+		if (!clientVerifyingShareB64u) throw new Error("Missing clientVerifyingShareB64u");
+		const nearAccountId = String(args.nearAccountId || "").trim();
+		if (!nearAccountId) throw new Error("Missing nearAccountId");
+		const registrationTxHash = String(args.registrationTxHash || "").trim();
+		if (!registrationTxHash) throw new Error("Missing registrationTxHash");
+		const url = `${base}/threshold-ed25519/keygen`;
+		const response = await fetch(url, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			credentials: "include",
+			body: JSON.stringify({
+				clientVerifyingShareB64u,
+				nearAccountId,
+				registrationTxHash
+			})
+		});
+		if (!response.ok) {
+			const errorText = await response.text();
+			return {
+				ok: false,
+				error: `HTTP ${response.status}: ${errorText}`
+			};
+		}
+		const json = await response.json();
+		return {
+			ok: !!json?.ok,
+			clientParticipantId: json?.clientParticipantId,
+			relayerParticipantId: json?.relayerParticipantId,
+			participantIds: json?.participantIds,
+			relayerKeyId: json?.relayerKeyId,
+			publicKey: json?.publicKey,
+			relayerVerifyingShareB64u: json?.relayerVerifyingShareB64u,
+			code: json?.code,
+			message: json?.message
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			error: error?.message || "Failed to keygen threshold-ed25519 from registration tx"
+		};
+	}
+}
+
+//#endregion
+export { buildSetRecoveryEmailsActions, checkCanRegisterUserContractCall, executeDeviceLinkingContractCalls, getAuthenticatorsByUser, getCredentialIdsContractCall, getDeviceLinkingAccountContractCall, getEmailRecoveryAttempt, getRecoveryEmailHashesContractCall, hasAccessKey, syncAuthenticatorsContractCall, thresholdEd25519Keygen, thresholdEd25519KeygenFromRegistrationTx, verifyAuthenticationResponse, waitForAccessKeyAbsent };
+//# sourceMappingURL=rpcCalls.js.map