@tatchi-xyz/sdk 0.20.0 → 0.31.0

package/dist/cjs/core/WebAuthnManager/SignerWorkerManager/handlers/signDelegateAction.js

@@ -1,23 +1,25 @@
 const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.js');
+const require_validation = require('../../../../utils/validation.js');
 const require_accountIds = require('../../../types/accountIds.js');
 const require_signer_worker = require('../../../types/signer-worker.js');
 const require_defaultConfigs = require('../../../defaultConfigs.js');
+const require_participants = require('../../../../threshold/participants.js');
+const require_credentialsHelpers = require('../../credentialsHelpers.js');
 const require_actions = require('../../../types/actions.js');
 const require_getDeviceNumber = require('../getDeviceNumber.js');
 const require_sessionHandshake = require('../sessionHandshake.js');
-const require_validation = require('./validation.js');
+const require_thresholdEd25519RelayerHealth = require('../../../threshold/thresholdEd25519RelayerHealth.js');
+const require_thresholdEd25519AuthSession = require('../../../threshold/thresholdEd25519AuthSession.js');
+const require_thresholdSessionPolicy = require('../../../threshold/thresholdSessionPolicy.js');
+const require_validation$1 = require('./validation.js');
 let src_wasm_signer_worker_pkg_wasm_signer_worker_js = require("../../../../wasm_signer_worker/pkg/wasm_signer_worker.js");
 src_wasm_signer_worker_pkg_wasm_signer_worker_js = require_rolldown_runtime.__toESM(src_wasm_signer_worker_pkg_wasm_signer_worker_js);
 
 //#region src/core/WebAuthnManager/SignerWorkerManager/handlers/signDelegateAction.ts
-require_defaultConfigs.init_defaultConfigs();
-require_accountIds.init_accountIds();
-require_actions.init_actions();
-require_signer_worker.init_signer_worker();
-require_getDeviceNumber.init_getDeviceNumber();
-async function signDelegateAction({ ctx, delegate, rpcCall, onEvent, confirmationConfigOverride, title, body, sessionId: providedSessionId }) {
+async function signDelegateAction({ ctx, delegate, rpcCall, signerMode, onEvent, confirmationConfigOverride, title, body, sessionId: providedSessionId }) {
 	const sessionId = providedSessionId ?? require_sessionHandshake.generateSessionId();
 	const nearAccountId = rpcCall.nearAccountId || delegate.senderId;
+	const relayerUrl = ctx.relayerUrl;
 	const resolvedRpcCall = {
 		contractId: rpcCall.contractId || require_defaultConfigs.PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId,
 		nearRpcUrl: rpcCall.nearRpcUrl || require_defaultConfigs.PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl.split(",")[0] || require_defaultConfigs.PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl,
@@ -32,13 +34,34 @@ async function signDelegateAction({ ctx, delegate, rpcCall, onEvent, confirmatio
 		}
 	});
 	const deviceNumber = await require_getDeviceNumber.getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);
-	const encryptedKeyData = await ctx.indexedDB.nearKeysDB.getEncryptedKey(nearAccountId, deviceNumber);
-	if (!encryptedKeyData) throw new Error(`No encrypted key found for account: ${nearAccountId}`);
-	if (!ctx.vrfWorkerManager) throw new Error("VrfWorkerManager not available for delegate signing");
-	const confirmation = await ctx.vrfWorkerManager.confirmAndPrepareSigningSession({
+	const [localKeyMaterial, thresholdKeyMaterial] = await Promise.all([ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber), ctx.indexedDB.nearKeysDB.getThresholdKeyMaterial(nearAccountId, deviceNumber)]);
+	if (!localKeyMaterial) throw new Error(`No local key material found for account: ${nearAccountId}`);
+	const warnings = [];
+	const vrfWorkerManager = ctx.vrfWorkerManager;
+	if (!vrfWorkerManager) throw new Error("VrfWorkerManager not available for delegate signing");
+	const resolvedSignerMode = await require_thresholdEd25519RelayerHealth.resolveSignerModeForThresholdSigning({
+		nearAccountId,
+		signerMode,
+		relayerUrl,
+		hasThresholdKeyMaterial: !!thresholdKeyMaterial,
+		warnings
+	});
+	const signingContext = validateAndPrepareDelegateSigningContext({
+		nearAccountId,
+		resolvedSignerMode,
+		relayerUrl,
+		rpId: ctx.touchIdPrompt.getRpId(),
+		localKeyMaterial,
+		thresholdKeyMaterial,
+		providedDelegatePublicKey: delegate.publicKey,
+		warnings
+	});
+	ctx.nonceManager.initializeUser(require_accountIds.toAccountId(nearAccountId), signingContext.signingNearPublicKeyStr);
+	const confirmation = await vrfWorkerManager.confirmAndPrepareSigningSession({
 		ctx,
 		sessionId,
 		kind: "delegate",
+		...signingContext.threshold && !signingContext.threshold.thresholdSessionJwt ? { signingAuthMode: "webauthn" } : {},
 		nearAccountId,
 		delegate: {
 			senderId: delegate.senderId || nearAccountId,
@@ -52,53 +75,186 @@ async function signDelegateAction({ ctx, delegate, rpcCall, onEvent, confirmatio
 		title,
 		body
 	});
-	const intentDigest = confirmation.intentDigest;
-	const transactionContext = confirmation.transactionContext;
-	const credential = confirmation.credential ? JSON.stringify(confirmation.credential) : void 0;
-	const response = await ctx.sendMessage({
-		sessionId,
-		message: {
-			type: src_wasm_signer_worker_pkg_wasm_signer_worker_js.WorkerRequestType.SignDelegateAction,
-			payload: {
-				rpcCall: resolvedRpcCall,
-				createdAt: Date.now(),
-				decryption: {
-					encryptedPrivateKeyData: encryptedKeyData.encryptedData,
-					encryptedPrivateKeyChacha20NonceB64u: encryptedKeyData.chacha20NonceB64u
-				},
+	let { intentDigest, transactionContext, vrfChallenge, credential } = extractSigningEvidenceFromConfirmation(confirmation);
+	const delegatePayload = {
+		senderId: delegate.senderId || nearAccountId,
+		receiverId: delegate.receiverId,
+		actions: actionsWasm,
+		nonce: delegate.nonce.toString(),
+		maxBlockHeight: delegate.maxBlockHeight.toString(),
+		publicKey: signingContext.delegatePublicKeyStr
+	};
+	if (!signingContext.threshold) {
+		const response = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: src_wasm_signer_worker_pkg_wasm_signer_worker_js.WorkerRequestType.SignDelegateAction,
+				payload: {
+					signerMode: signingContext.resolvedSignerMode,
+					rpcCall: resolvedRpcCall,
+					createdAt: Date.now(),
+					decryption: {
+						encryptedPrivateKeyData: localKeyMaterial.encryptedSk,
+						encryptedPrivateKeyChacha20NonceB64u: localKeyMaterial.chacha20NonceB64u
+					},
+					delegate: delegatePayload,
+					intentDigest,
+					transactionContext,
+					credential
+				}
+			},
+			onEvent
+		});
+		const okResponse$1 = requireOkSignDelegateActionResponse(response);
+		return {
+			signedDelegate: okResponse$1.payload.signedDelegate,
+			hash: okResponse$1.payload.hash,
+			nearAccountId: require_accountIds.toAccountId(nearAccountId),
+			logs: [...okResponse$1.payload.logs || [], ...warnings]
+		};
+	}
+	const requestPayload = {
+		signerMode: signingContext.resolvedSignerMode,
+		rpcCall: resolvedRpcCall,
+		createdAt: Date.now(),
+		decryption: {
+			encryptedPrivateKeyData: "",
+			encryptedPrivateKeyChacha20NonceB64u: ""
+		},
+		threshold: {
+			relayerUrl: signingContext.threshold.relayerUrl,
+			relayerKeyId: signingContext.threshold.thresholdKeyMaterial.relayerKeyId,
+			clientParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "client")?.id,
+			relayerParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "relayer")?.id,
+			participantIds: signingContext.threshold.thresholdKeyMaterial.participants.map((p) => p.id),
+			thresholdSessionKind: "jwt",
+			thresholdSessionJwt: signingContext.threshold.thresholdSessionJwt
+		},
+		delegate: delegatePayload,
+		intentDigest,
+		transactionContext,
+		vrfChallenge,
+		credential
+	};
+	let okResponse;
+	try {
+		const resp = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: src_wasm_signer_worker_pkg_wasm_signer_worker_js.WorkerRequestType.SignDelegateAction,
+				payload: requestPayload
+			},
+			onEvent
+		});
+		okResponse = requireOkSignDelegateActionResponse(resp);
+	} catch (e) {
+		const err = e instanceof Error ? e : new Error(String(e));
+		if (!require_thresholdSessionPolicy.isThresholdSessionAuthUnavailableError(err)) throw err;
+		require_thresholdEd25519AuthSession.clearCachedThresholdEd25519AuthSession(signingContext.threshold.thresholdSessionCacheKey);
+		signingContext.threshold.thresholdSessionJwt = void 0;
+		requestPayload.threshold.thresholdSessionJwt = void 0;
+		if (!credential || !vrfChallenge) {
+			const refreshed = await vrfWorkerManager.confirmAndPrepareSigningSession({
+				ctx,
+				sessionId,
+				kind: "delegate",
+				signingAuthMode: "webauthn",
+				nearAccountId,
 				delegate: {
 					senderId: delegate.senderId || nearAccountId,
 					receiverId: delegate.receiverId,
 					actions: actionsWasm,
-					nonce: delegate.nonce.toString(),
-					maxBlockHeight: delegate.maxBlockHeight.toString(),
-					publicKey: require_validation.toPublicKeyString(delegate.publicKey)
+					nonce: delegate.nonce,
+					maxBlockHeight: delegate.maxBlockHeight
 				},
-				intentDigest,
-				transactionContext,
-				credential
-			}
-		},
-		onEvent
-	});
-	console.debug("[WebAuthnManager][delegate] raw worker response", response);
-	if (!require_signer_worker.isSignDelegateActionSuccess(response)) {
-		console.error("[WebAuthnManager][delegate] non-success worker response", response);
-		const payloadError = response?.payload?.error;
-		throw new Error(payloadError || "Delegate action signing failed");
-	}
-	const payload = response.payload;
-	if (!payload.success || !payload.signedDelegate || !payload.hash) {
-		console.error("[WebAuthnManager][delegate] invalid delegate payload", payload);
-		throw new Error(payload.error || "Delegate action signing failed");
+				rpcCall: resolvedRpcCall,
+				confirmationConfigOverride,
+				title,
+				body
+			});
+			({intentDigest, transactionContext, vrfChallenge, credential} = extractSigningEvidenceFromConfirmation(refreshed));
+			requestPayload.intentDigest = intentDigest;
+			requestPayload.transactionContext = transactionContext;
+			requestPayload.vrfChallenge = vrfChallenge;
+			requestPayload.credential = credential;
+		}
+		const resp = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: src_wasm_signer_worker_pkg_wasm_signer_worker_js.WorkerRequestType.SignDelegateAction,
+				payload: requestPayload
+			},
+			onEvent
+		});
+		okResponse = requireOkSignDelegateActionResponse(resp);
 	}
 	return {
-		signedDelegate: payload.signedDelegate,
-		hash: payload.hash,
+		signedDelegate: okResponse.payload.signedDelegate,
+		hash: okResponse.payload.hash,
 		nearAccountId: require_accountIds.toAccountId(nearAccountId),
-		logs: payload.logs
+		logs: [...okResponse.payload.logs || [], ...warnings]
 	};
 }
+function validateAndPrepareDelegateSigningContext(args) {
+	const localPublicKey = require_validation.ensureEd25519Prefix(args.localKeyMaterial.publicKey);
+	if (!localPublicKey) throw new Error(`Missing local signing public key for ${args.nearAccountId}`);
+	const providedDelegatePublicKeyStr = require_validation.ensureEd25519Prefix(require_validation$1.toPublicKeyString(args.providedDelegatePublicKey));
+	if (args.resolvedSignerMode !== "threshold-signer") {
+		if (providedDelegatePublicKeyStr && providedDelegatePublicKeyStr !== localPublicKey) args.warnings.push(`Delegate public key ${providedDelegatePublicKeyStr} does not match local signer key; using ${localPublicKey}`);
+		return {
+			resolvedSignerMode: "local-signer",
+			signingNearPublicKeyStr: localPublicKey,
+			delegatePublicKeyStr: localPublicKey,
+			threshold: null
+		};
+	}
+	const thresholdKeyMaterial = args.thresholdKeyMaterial;
+	if (!thresholdKeyMaterial) throw new Error(`Missing threshold key material for ${args.nearAccountId}`);
+	const thresholdPublicKey = require_validation.ensureEd25519Prefix(thresholdKeyMaterial.publicKey);
+	if (!thresholdPublicKey) throw new Error(`Missing threshold signing public key for ${args.nearAccountId}`);
+	if (providedDelegatePublicKeyStr && providedDelegatePublicKeyStr !== thresholdPublicKey) args.warnings.push(`Delegate public key ${providedDelegatePublicKeyStr} does not match threshold signer key; using ${thresholdPublicKey}`);
+	const relayerUrl = String(args.relayerUrl || "").trim();
+	if (!relayerUrl) throw new Error("Missing relayerUrl (required for threshold-signer)");
+	const rpId = String(args.rpId || "").trim();
+	if (!rpId) throw new Error("Missing rpId for threshold signing");
+	const participantIds = require_participants.normalizeThresholdEd25519ParticipantIds(thresholdKeyMaterial.participants.map((p) => p.id));
+	if (!participantIds || participantIds.length < 2) throw new Error(`Invalid threshold signing participantIds (expected >=2 participants, got [${(participantIds || []).join(",")}])`);
+	const thresholdSessionCacheKey = require_thresholdEd25519AuthSession.makeThresholdEd25519AuthSessionCacheKey({
+		nearAccountId: args.nearAccountId,
+		rpId,
+		relayerUrl,
+		relayerKeyId: thresholdKeyMaterial.relayerKeyId,
+		participantIds
+	});
+	return {
+		resolvedSignerMode: "threshold-signer",
+		signingNearPublicKeyStr: thresholdPublicKey,
+		delegatePublicKeyStr: thresholdPublicKey,
+		threshold: {
+			relayerUrl,
+			thresholdKeyMaterial,
+			thresholdSessionCacheKey,
+			thresholdSessionJwt: require_thresholdEd25519AuthSession.getCachedThresholdEd25519AuthSessionJwt(thresholdSessionCacheKey)
+		}
+	};
+}
+function extractSigningEvidenceFromConfirmation(confirmation) {
+	const credentialForRelay = confirmation.credential ? require_credentialsHelpers.removePrfOutputGuard(confirmation.credential) : void 0;
+	return {
+		intentDigest: confirmation.intentDigest,
+		transactionContext: confirmation.transactionContext,
+		vrfChallenge: confirmation.vrfChallenge,
+		credential: credentialForRelay ? JSON.stringify(credentialForRelay) : void 0
+	};
+}
+function requireOkSignDelegateActionResponse(response) {
+	if (!require_signer_worker.isSignDelegateActionSuccess(response)) {
+		if (require_signer_worker.isWorkerError(response)) throw new Error(response.payload.error || "Delegate action signing failed");
+		throw new Error("Delegate action signing failed");
+	}
+	if (!response.payload.success || !response.payload.signedDelegate || !response.payload.hash) throw new Error(response.payload.error || "Delegate action signing failed");
+	return response;
+}
 
 //#endregion
 exports.signDelegateAction = signDelegateAction;

package/dist/cjs/core/WebAuthnManager/SignerWorkerManager/handlers/signDelegateAction.js.map

@@ -1 +1 @@
-{"version":3,"file":"signDelegateAction.js","names":["generateSessionId","PASSKEY_MANAGER_DEFAULT_CONFIGS","toActionArgsWasm","getLastLoggedInDeviceNumber","WorkerRequestType","toPublicKeyString","isSignDelegateActionSuccess","toAccountId"],"sources":["../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/signDelegateAction.ts"],"sourcesContent":["import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from '../../../defaultConfigs';\nimport { AccountId, toAccountId } from '../../../types/accountIds';\nimport { toActionArgsWasm, validateActionArgsWasm } from '../../../types/actions';\nimport { DelegateActionInput } from '../../../types/delegate';\nimport { type onProgressEvents } from '../../../types/sdkSentEvents';\nimport {\n  ConfirmationConfig,\n  RpcCallPayload,\n  WorkerRequestType,\n  isSignDelegateActionSuccess,\n  WasmDelegateSignResult,\n  WasmSignedDelegate,\n} from '../../../types/signer-worker';\nimport { SignerWorkerManagerContext } from '..';\nimport { getLastLoggedInDeviceNumber } from '../getDeviceNumber';\nimport { generateSessionId } from '../sessionHandshake.js';\nimport { toPublicKeyString } from './validation';\n\n\nexport async function signDelegateAction({\n  ctx,\n  delegate,\n  rpcCall,\n  onEvent,\n  confirmationConfigOverride,\n  title,\n  body,\n  sessionId: providedSessionId,\n}: {\n  ctx: SignerWorkerManagerContext;\n  delegate: DelegateActionInput;\n  rpcCall: RpcCallPayload;\n  onEvent?: (update: onProgressEvents) => void;\n  confirmationConfigOverride?: Partial<ConfirmationConfig>;\n  title?: string;\n  body?: string;\n  sessionId?: string;\n}): Promise<{\n  signedDelegate: WasmSignedDelegate;\n  hash: string;\n  nearAccountId: AccountId;\n  logs?: string[];\n}> {\n  const sessionId = providedSessionId ?? generateSessionId();\n  const nearAccountId = rpcCall.nearAccountId || delegate.senderId;\n\n  const resolvedRpcCall = {\n    contractId: rpcCall.contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId,\n    nearRpcUrl: rpcCall.nearRpcUrl || (PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl.split(',')[0] || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl),\n    nearAccountId,\n  } as RpcCallPayload;\n\n  const actionsWasm = delegate.actions.map(toActionArgsWasm);\n  actionsWasm.forEach((action, actionIndex) => {\n    try {\n      validateActionArgsWasm(action);\n    } catch (error) {\n      throw new Error(\n        `Delegate action ${actionIndex} validation failed: ${error instanceof Error ? error.message : String(error)}`\n      );\n    }\n  });\n\n  const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);\n  const encryptedKeyData = await ctx.indexedDB.nearKeysDB.getEncryptedKey(nearAccountId, deviceNumber);\n  if (!encryptedKeyData) {\n    throw new Error(`No encrypted key found for account: ${nearAccountId}`);\n  }\n  if (!ctx.vrfWorkerManager) {\n    throw new Error('VrfWorkerManager not available for delegate signing');\n  }\n\n  const confirmation = await ctx.vrfWorkerManager.confirmAndPrepareSigningSession({\n    ctx,\n    sessionId,\n    kind: 'delegate',\n    nearAccountId,\n    delegate: {\n      senderId: delegate.senderId || nearAccountId,\n      receiverId: delegate.receiverId,\n      actions: actionsWasm,\n      nonce: delegate.nonce,\n      maxBlockHeight: delegate.maxBlockHeight,\n    },\n    rpcCall: resolvedRpcCall,\n    confirmationConfigOverride,\n    title,\n    body,\n  });\n\n  const intentDigest = confirmation.intentDigest;\n  const transactionContext = confirmation.transactionContext;\n  const credential = confirmation.credential ? JSON.stringify(confirmation.credential) : undefined;\n\n  const response = await ctx.sendMessage({\n    sessionId,\n    message: {\n      type: WorkerRequestType.SignDelegateAction,\n      payload: {\n        rpcCall: resolvedRpcCall,\n        createdAt: Date.now(),\n        decryption: {\n          encryptedPrivateKeyData: encryptedKeyData.encryptedData,\n          encryptedPrivateKeyChacha20NonceB64u: encryptedKeyData.chacha20NonceB64u,\n        },\n        delegate: {\n          senderId: delegate.senderId || nearAccountId,\n          receiverId: delegate.receiverId,\n          actions: actionsWasm,\n          nonce: delegate.nonce.toString(),\n          maxBlockHeight: delegate.maxBlockHeight.toString(),\n          publicKey: toPublicKeyString(delegate.publicKey),\n        },\n        intentDigest,\n        transactionContext,\n        credential,\n      },\n    },\n    onEvent,\n  });\n\n  // eslint-disable-next-line no-console\n  console.debug('[WebAuthnManager][delegate] raw worker response', response);\n\n  if (!isSignDelegateActionSuccess(response)) {\n    // eslint-disable-next-line no-console\n    console.error('[WebAuthnManager][delegate] non-success worker response', response);\n    const payloadError = (response as any)?.payload?.error;\n    throw new Error(payloadError || 'Delegate action signing failed');\n  }\n\n  const payload = response.payload as WasmDelegateSignResult;\n  if (!payload.success || !payload.signedDelegate || !payload.hash) {\n    // eslint-disable-next-line no-console\n    console.error('[WebAuthnManager][delegate] invalid delegate payload', payload);\n    throw new Error(payload.error || 'Delegate action signing failed');\n  }\n\n  return {\n    signedDelegate: payload.signedDelegate,\n    hash: payload.hash,\n    nearAccountId: toAccountId(nearAccountId),\n    logs: payload.logs,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAmBA,eAAsB,mBAAmB,EACvC,KACA,UACA,SACA,SACA,4BACA,OACA,MACA,WAAW,qBAeV;CACD,MAAM,YAAY,qBAAqBA;CACvC,MAAM,gBAAgB,QAAQ,iBAAiB,SAAS;CAExD,MAAM,kBAAkB;EACtB,YAAY,QAAQ,cAAcC,uDAAgC;EAClE,YAAY,QAAQ,cAAeA,uDAAgC,WAAW,MAAM,KAAK,MAAMA,uDAAgC;EAC/H;;CAGF,MAAM,cAAc,SAAS,QAAQ,IAAIC;AACzC,aAAY,SAAS,QAAQ,gBAAgB;AAC3C,MAAI;AACF,0CAAuB;WAChB,OAAO;AACd,SAAM,IAAI,MACR,mBAAmB,YAAY,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,OAAO;;;CAK3G,MAAM,eAAe,MAAMC,oDAA4B,eAAe,IAAI,UAAU;CACpF,MAAM,mBAAmB,MAAM,IAAI,UAAU,WAAW,gBAAgB,eAAe;AACvF,KAAI,CAAC,iBACH,OAAM,IAAI,MAAM,uCAAuC;AAEzD,KAAI,CAAC,IAAI,iBACP,OAAM,IAAI,MAAM;CAGlB,MAAM,eAAe,MAAM,IAAI,iBAAiB,gCAAgC;EAC9E;EACA;EACA,MAAM;EACN;EACA,UAAU;GACR,UAAU,SAAS,YAAY;GAC/B,YAAY,SAAS;GACrB,SAAS;GACT,OAAO,SAAS;GAChB,gBAAgB,SAAS;;EAE3B,SAAS;EACT;EACA;EACA;;CAGF,MAAM,eAAe,aAAa;CAClC,MAAM,qBAAqB,aAAa;CACxC,MAAM,aAAa,aAAa,aAAa,KAAK,UAAU,aAAa,cAAc;CAEvF,MAAM,WAAW,MAAM,IAAI,YAAY;EACrC;EACA,SAAS;GACP,MAAMC,mEAAkB;GACxB,SAAS;IACP,SAAS;IACT,WAAW,KAAK;IAChB,YAAY;KACV,yBAAyB,iBAAiB;KAC1C,sCAAsC,iBAAiB;;IAEzD,UAAU;KACR,UAAU,SAAS,YAAY;KAC/B,YAAY,SAAS;KACrB,SAAS;KACT,OAAO,SAAS,MAAM;KACtB,gBAAgB,SAAS,eAAe;KACxC,WAAWC,qCAAkB,SAAS;;IAExC;IACA;IACA;;;EAGJ;;AAIF,SAAQ,MAAM,mDAAmD;AAEjE,KAAI,CAACC,kDAA4B,WAAW;AAE1C,UAAQ,MAAM,2DAA2D;EACzE,MAAM,eAAgB,UAAkB,SAAS;AACjD,QAAM,IAAI,MAAM,gBAAgB;;CAGlC,MAAM,UAAU,SAAS;AACzB,KAAI,CAAC,QAAQ,WAAW,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,MAAM;AAEhE,UAAQ,MAAM,wDAAwD;AACtE,QAAM,IAAI,MAAM,QAAQ,SAAS;;AAGnC,QAAO;EACL,gBAAgB,QAAQ;EACxB,MAAM,QAAQ;EACd,eAAeC,+BAAY;EAC3B,MAAM,QAAQ"}
+{"version":3,"file":"signDelegateAction.js","names":["generateSessionId","PASSKEY_MANAGER_DEFAULT_CONFIGS","toActionArgsWasm","getLastLoggedInDeviceNumber","warnings: string[]","resolveSignerModeForThresholdSigning","toAccountId","WorkerRequestType","okResponse","okResponse: WorkerSuccessResponse<typeof WorkerRequestType.SignDelegateAction>","e: unknown","isThresholdSessionAuthUnavailableError","ensureEd25519Prefix","toPublicKeyString","normalizeThresholdEd25519ParticipantIds","makeThresholdEd25519AuthSessionCacheKey","getCachedThresholdEd25519AuthSessionJwt","credentialForRelay: WebAuthnAuthenticationCredential | undefined","removePrfOutputGuard","isSignDelegateActionSuccess","isWorkerError"],"sources":["../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/signDelegateAction.ts"],"sourcesContent":["import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from '../../../defaultConfigs';\nimport { AccountId, toAccountId } from '../../../types/accountIds';\nimport { toActionArgsWasm, validateActionArgsWasm } from '../../../types/actions';\nimport { DelegateActionInput } from '../../../types/delegate';\nimport { type onProgressEvents } from '../../../types/sdkSentEvents';\nimport {\n  ConfirmationConfig,\n  RpcCallPayload,\n  type SignerMode,\n  WorkerRequestType,\n  type DelegateSignResponse,\n  isWorkerError,\n  isSignDelegateActionSuccess,\n  type WorkerSuccessResponse,\n  WasmSignedDelegate,\n} from '../../../types/signer-worker';\nimport type { WebAuthnAuthenticationCredential } from '../../../types';\nimport { removePrfOutputGuard } from '../../credentialsHelpers';\nimport { resolveSignerModeForThresholdSigning } from '../../../threshold/thresholdEd25519RelayerHealth';\nimport type {\n  LocalNearSkV3Material,\n  ThresholdEd25519_2p_V1Material,\n} from '../../../IndexedDBManager/passkeyNearKeysDB';\nimport type { TransactionContext } from '../../../types/rpc';\nimport type { VRFChallenge } from '../../../types/vrf-worker';\nimport {\n  clearCachedThresholdEd25519AuthSession,\n  getCachedThresholdEd25519AuthSessionJwt,\n  makeThresholdEd25519AuthSessionCacheKey,\n} from '../../../threshold/thresholdEd25519AuthSession';\nimport { isThresholdSessionAuthUnavailableError } from '../../../threshold/thresholdSessionPolicy';\nimport { normalizeThresholdEd25519ParticipantIds } from '../../../../threshold/participants';\nimport { SignerWorkerManagerContext } from '..';\nimport { getLastLoggedInDeviceNumber } from '../getDeviceNumber';\nimport { generateSessionId } from '../sessionHandshake.js';\nimport { ensureEd25519Prefix, toPublicKeyString } from './validation';\n\nexport async function signDelegateAction({\n  ctx,\n  delegate,\n  rpcCall,\n  signerMode,\n  onEvent,\n  confirmationConfigOverride,\n  title,\n  body,\n  sessionId: providedSessionId,\n}: {\n  ctx: SignerWorkerManagerContext;\n  delegate: DelegateActionInput;\n  rpcCall: RpcCallPayload;\n  signerMode: SignerMode;\n  onEvent?: (update: onProgressEvents) => void;\n  confirmationConfigOverride?: Partial<ConfirmationConfig>;\n  title?: string;\n  body?: string;\n  sessionId?: string;\n}): Promise<{\n  signedDelegate: WasmSignedDelegate;\n  hash: string;\n  nearAccountId: AccountId;\n  logs?: string[];\n}> {\n  const sessionId = providedSessionId ?? generateSessionId();\n  const nearAccountId = rpcCall.nearAccountId || delegate.senderId;\n  const relayerUrl = ctx.relayerUrl;\n\n  const resolvedRpcCall = {\n    contractId: rpcCall.contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId,\n    nearRpcUrl: rpcCall.nearRpcUrl || (PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl.split(',')[0] || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl),\n    nearAccountId,\n  } as RpcCallPayload;\n\n  const actionsWasm = delegate.actions.map(toActionArgsWasm);\n  actionsWasm.forEach((action, actionIndex) => {\n    try {\n      validateActionArgsWasm(action);\n    } catch (error) {\n      throw new Error(\n        `Delegate action ${actionIndex} validation failed: ${error instanceof Error ? error.message : String(error)}`\n      );\n    }\n  });\n\n  const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);\n  const [localKeyMaterial, thresholdKeyMaterial] = await Promise.all([\n    ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber),\n    ctx.indexedDB.nearKeysDB.getThresholdKeyMaterial(nearAccountId, deviceNumber),\n  ]);\n  if (!localKeyMaterial) {\n    throw new Error(`No local key material found for account: ${nearAccountId}`);\n  }\n\n  const warnings: string[] = [];\n  const vrfWorkerManager = ctx.vrfWorkerManager;\n  if (!vrfWorkerManager) {\n    throw new Error('VrfWorkerManager not available for delegate signing');\n  }\n\n  const resolvedSignerMode = await resolveSignerModeForThresholdSigning({\n    nearAccountId,\n    signerMode,\n    relayerUrl,\n    hasThresholdKeyMaterial: !!thresholdKeyMaterial,\n    warnings,\n  });\n\n  const signingContext = validateAndPrepareDelegateSigningContext({\n    nearAccountId,\n    resolvedSignerMode,\n    relayerUrl,\n    rpId: ctx.touchIdPrompt.getRpId(),\n    localKeyMaterial,\n    thresholdKeyMaterial,\n    providedDelegatePublicKey: delegate.publicKey,\n    warnings,\n  });\n\n  // Ensure nonce/block context is fetched for the same access key that will sign.\n  // Threshold signing MUST use the threshold/group public key (relayer access key) for:\n  // - correct nonce reservation\n  // - relayer scope checks (/authorize expects signingPayload.delegate.publicKey == relayer key)\n  ctx.nonceManager.initializeUser(toAccountId(nearAccountId), signingContext.signingNearPublicKeyStr);\n\n  const confirmation = await vrfWorkerManager.confirmAndPrepareSigningSession({\n    ctx,\n    sessionId,\n    kind: 'delegate',\n    ...(signingContext.threshold && !signingContext.threshold.thresholdSessionJwt ? { signingAuthMode: 'webauthn' } : {}),\n    nearAccountId,\n    delegate: {\n      senderId: delegate.senderId || nearAccountId,\n      receiverId: delegate.receiverId,\n      actions: actionsWasm,\n      nonce: delegate.nonce,\n      maxBlockHeight: delegate.maxBlockHeight,\n    },\n    rpcCall: resolvedRpcCall,\n    confirmationConfigOverride,\n    title,\n    body,\n  });\n\n  let { intentDigest, transactionContext, vrfChallenge, credential } =\n    extractSigningEvidenceFromConfirmation(confirmation);\n\n  const delegatePayload = {\n    senderId: delegate.senderId || nearAccountId,\n    receiverId: delegate.receiverId,\n    actions: actionsWasm,\n    nonce: delegate.nonce.toString(),\n    maxBlockHeight: delegate.maxBlockHeight.toString(),\n    publicKey: signingContext.delegatePublicKeyStr,\n  };\n\n  if (!signingContext.threshold) {\n    const response = await ctx.sendMessage<WorkerRequestType.SignDelegateAction>({\n      sessionId,\n      message: {\n        type: WorkerRequestType.SignDelegateAction,\n        payload: {\n          signerMode: signingContext.resolvedSignerMode,\n          rpcCall: resolvedRpcCall,\n          createdAt: Date.now(),\n          decryption: {\n            encryptedPrivateKeyData: localKeyMaterial.encryptedSk,\n            encryptedPrivateKeyChacha20NonceB64u: localKeyMaterial.chacha20NonceB64u,\n          },\n          delegate: delegatePayload,\n          intentDigest,\n          transactionContext,\n          credential,\n        },\n      },\n      onEvent,\n    });\n\n    const okResponse = requireOkSignDelegateActionResponse(response);\n    return {\n      signedDelegate: okResponse.payload.signedDelegate!,\n      hash: okResponse.payload.hash!,\n      nearAccountId: toAccountId(nearAccountId),\n      logs: [...(okResponse.payload.logs || []), ...warnings],\n    };\n  }\n\n  const requestPayload = {\n    signerMode: signingContext.resolvedSignerMode,\n    rpcCall: resolvedRpcCall,\n    createdAt: Date.now(),\n    decryption: {\n      encryptedPrivateKeyData: '',\n      encryptedPrivateKeyChacha20NonceB64u: '',\n    },\n    threshold: {\n      relayerUrl: signingContext.threshold.relayerUrl,\n      relayerKeyId: signingContext.threshold.thresholdKeyMaterial.relayerKeyId,\n      clientParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === 'client')?.id,\n      relayerParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === 'relayer')?.id,\n      participantIds: signingContext.threshold.thresholdKeyMaterial.participants.map((p) => p.id),\n      thresholdSessionKind: 'jwt' as const,\n      thresholdSessionJwt: signingContext.threshold.thresholdSessionJwt,\n    },\n    delegate: delegatePayload,\n    intentDigest,\n    transactionContext,\n    vrfChallenge,\n    credential,\n  };\n\n  let okResponse: WorkerSuccessResponse<typeof WorkerRequestType.SignDelegateAction>;\n  try {\n    const resp = await ctx.sendMessage<typeof WorkerRequestType.SignDelegateAction>({\n      sessionId,\n      message: { type: WorkerRequestType.SignDelegateAction, payload: requestPayload },\n      onEvent,\n    });\n    okResponse = requireOkSignDelegateActionResponse(resp);\n  } catch (e: unknown) {\n    const err = e instanceof Error ? e : new Error(String(e));\n    if (!isThresholdSessionAuthUnavailableError(err)) throw err;\n\n    clearCachedThresholdEd25519AuthSession(signingContext.threshold.thresholdSessionCacheKey);\n    signingContext.threshold.thresholdSessionJwt = undefined;\n    requestPayload.threshold.thresholdSessionJwt = undefined;\n\n    if (!credential || !vrfChallenge) {\n      const refreshed = await vrfWorkerManager.confirmAndPrepareSigningSession({\n        ctx,\n        sessionId,\n        kind: 'delegate',\n        signingAuthMode: 'webauthn',\n        nearAccountId,\n        delegate: {\n          senderId: delegate.senderId || nearAccountId,\n          receiverId: delegate.receiverId,\n          actions: actionsWasm,\n          nonce: delegate.nonce,\n          maxBlockHeight: delegate.maxBlockHeight,\n        },\n        rpcCall: resolvedRpcCall,\n        confirmationConfigOverride,\n        title,\n        body,\n      });\n\n      ({ intentDigest, transactionContext, vrfChallenge, credential } =\n        extractSigningEvidenceFromConfirmation(refreshed));\n\n      requestPayload.intentDigest = intentDigest;\n      requestPayload.transactionContext = transactionContext;\n      requestPayload.vrfChallenge = vrfChallenge;\n      requestPayload.credential = credential;\n    }\n\n    const resp = await ctx.sendMessage<typeof WorkerRequestType.SignDelegateAction>({\n      sessionId,\n      message: { type: WorkerRequestType.SignDelegateAction, payload: requestPayload },\n      onEvent,\n    });\n    okResponse = requireOkSignDelegateActionResponse(resp);\n  }\n\n  return {\n    signedDelegate: okResponse.payload.signedDelegate!,\n    hash: okResponse.payload.hash!,\n    nearAccountId: toAccountId(nearAccountId),\n    logs: [...(okResponse.payload.logs || []), ...warnings],\n  };\n}\n\ntype ThresholdDelegateSigningContext = {\n  resolvedSignerMode: 'threshold-signer';\n  signingNearPublicKeyStr: string;\n  delegatePublicKeyStr: string;\n  threshold: {\n    relayerUrl: string;\n    thresholdKeyMaterial: ThresholdEd25519_2p_V1Material;\n    thresholdSessionCacheKey: string;\n    thresholdSessionJwt: string | undefined;\n  };\n};\n\ntype LocalDelegateSigningContext = {\n  resolvedSignerMode: 'local-signer';\n  signingNearPublicKeyStr: string;\n  delegatePublicKeyStr: string;\n  threshold: null;\n};\n\ntype DelegateSigningContext = ThresholdDelegateSigningContext | LocalDelegateSigningContext;\n\nfunction validateAndPrepareDelegateSigningContext(args: {\n  nearAccountId: string;\n  resolvedSignerMode: SignerMode['mode'];\n  relayerUrl: string;\n  rpId: string | null;\n  localKeyMaterial: LocalNearSkV3Material;\n  thresholdKeyMaterial: ThresholdEd25519_2p_V1Material | null;\n  providedDelegatePublicKey: DelegateActionInput['publicKey'];\n  warnings: string[];\n}): DelegateSigningContext {\n  const localPublicKey = ensureEd25519Prefix(args.localKeyMaterial.publicKey);\n  if (!localPublicKey) {\n    throw new Error(`Missing local signing public key for ${args.nearAccountId}`);\n  }\n\n  const providedDelegatePublicKeyStr = ensureEd25519Prefix(toPublicKeyString(args.providedDelegatePublicKey));\n\n  if (args.resolvedSignerMode !== 'threshold-signer') {\n    if (providedDelegatePublicKeyStr && providedDelegatePublicKeyStr !== localPublicKey) {\n      args.warnings.push(\n        `Delegate public key ${providedDelegatePublicKeyStr} does not match local signer key; using ${localPublicKey}`\n      );\n    }\n    return {\n      resolvedSignerMode: 'local-signer',\n      signingNearPublicKeyStr: localPublicKey,\n      delegatePublicKeyStr: localPublicKey,\n      threshold: null,\n    };\n  }\n\n  const thresholdKeyMaterial = args.thresholdKeyMaterial;\n  if (!thresholdKeyMaterial) {\n    throw new Error(`Missing threshold key material for ${args.nearAccountId}`);\n  }\n\n  const thresholdPublicKey = ensureEd25519Prefix(thresholdKeyMaterial.publicKey);\n  if (!thresholdPublicKey) {\n    throw new Error(`Missing threshold signing public key for ${args.nearAccountId}`);\n  }\n\n  if (providedDelegatePublicKeyStr && providedDelegatePublicKeyStr !== thresholdPublicKey) {\n    args.warnings.push(\n      `Delegate public key ${providedDelegatePublicKeyStr} does not match threshold signer key; using ${thresholdPublicKey}`\n    );\n  }\n\n  const relayerUrl = String(args.relayerUrl || '').trim();\n  if (!relayerUrl) {\n    throw new Error('Missing relayerUrl (required for threshold-signer)');\n  }\n\n  const rpId = String(args.rpId || '').trim();\n  if (!rpId) {\n    throw new Error('Missing rpId for threshold signing');\n  }\n\n  const participantIds = normalizeThresholdEd25519ParticipantIds(thresholdKeyMaterial.participants.map((p) => p.id));\n  if (!participantIds || participantIds.length < 2) {\n    throw new Error(\n      `Invalid threshold signing participantIds (expected >=2 participants, got [${(participantIds || []).join(',')}])`\n    );\n  }\n\n  const thresholdSessionCacheKey = makeThresholdEd25519AuthSessionCacheKey({\n    nearAccountId: args.nearAccountId,\n    rpId,\n    relayerUrl,\n    relayerKeyId: thresholdKeyMaterial.relayerKeyId,\n    participantIds,\n  });\n\n  return {\n    resolvedSignerMode: 'threshold-signer',\n    signingNearPublicKeyStr: thresholdPublicKey,\n    delegatePublicKeyStr: thresholdPublicKey,\n    threshold: {\n      relayerUrl,\n      thresholdKeyMaterial,\n      thresholdSessionCacheKey,\n      thresholdSessionJwt: getCachedThresholdEd25519AuthSessionJwt(thresholdSessionCacheKey),\n    },\n  };\n}\n\nfunction extractSigningEvidenceFromConfirmation(confirmation: {\n  intentDigest: string;\n  transactionContext: TransactionContext;\n  vrfChallenge?: VRFChallenge;\n  credential?: unknown;\n}): {\n  intentDigest: string;\n  transactionContext: TransactionContext;\n  vrfChallenge: VRFChallenge | undefined;\n  credential: string | undefined;\n} {\n  const credentialForRelay: WebAuthnAuthenticationCredential | undefined = confirmation.credential\n    ? removePrfOutputGuard(confirmation.credential as WebAuthnAuthenticationCredential)\n    : undefined;\n\n  return {\n    intentDigest: confirmation.intentDigest,\n    transactionContext: confirmation.transactionContext,\n    vrfChallenge: confirmation.vrfChallenge,\n    credential: credentialForRelay ? JSON.stringify(credentialForRelay) : undefined,\n  };\n}\n\nfunction requireOkSignDelegateActionResponse(\n  response: DelegateSignResponse\n): WorkerSuccessResponse<typeof WorkerRequestType.SignDelegateAction> {\n  if (!isSignDelegateActionSuccess(response)) {\n    if (isWorkerError(response)) {\n      throw new Error(response.payload.error || 'Delegate action signing failed');\n    }\n    throw new Error('Delegate action signing failed');\n  }\n\n  if (!response.payload.success || !response.payload.signedDelegate || !response.payload.hash) {\n    throw new Error(response.payload.error || 'Delegate action signing failed');\n  }\n  return response;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAqCA,eAAsB,mBAAmB,EACvC,KACA,UACA,SACA,YACA,SACA,4BACA,OACA,MACA,WAAW,qBAgBV;CACD,MAAM,YAAY,qBAAqBA;CACvC,MAAM,gBAAgB,QAAQ,iBAAiB,SAAS;CACxD,MAAM,aAAa,IAAI;CAEvB,MAAM,kBAAkB;EACtB,YAAY,QAAQ,cAAcC,uDAAgC;EAClE,YAAY,QAAQ,cAAeA,uDAAgC,WAAW,MAAM,KAAK,MAAMA,uDAAgC;EAC/H;;CAGF,MAAM,cAAc,SAAS,QAAQ,IAAIC;AACzC,aAAY,SAAS,QAAQ,gBAAgB;AAC3C,MAAI;AACF,0CAAuB;WAChB,OAAO;AACd,SAAM,IAAI,MACR,mBAAmB,YAAY,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,OAAO;;;CAK3G,MAAM,eAAe,MAAMC,oDAA4B,eAAe,IAAI,UAAU;CACpF,MAAM,CAAC,kBAAkB,wBAAwB,MAAM,QAAQ,IAAI,CACjE,IAAI,UAAU,WAAW,oBAAoB,eAAe,eAC5D,IAAI,UAAU,WAAW,wBAAwB,eAAe;AAElE,KAAI,CAAC,iBACH,OAAM,IAAI,MAAM,4CAA4C;CAG9D,MAAMC,WAAqB;CAC3B,MAAM,mBAAmB,IAAI;AAC7B,KAAI,CAAC,iBACH,OAAM,IAAI,MAAM;CAGlB,MAAM,qBAAqB,MAAMC,2EAAqC;EACpE;EACA;EACA;EACA,yBAAyB,CAAC,CAAC;EAC3B;;CAGF,MAAM,iBAAiB,yCAAyC;EAC9D;EACA;EACA;EACA,MAAM,IAAI,cAAc;EACxB;EACA;EACA,2BAA2B,SAAS;EACpC;;AAOF,KAAI,aAAa,eAAeC,+BAAY,gBAAgB,eAAe;CAE3E,MAAM,eAAe,MAAM,iBAAiB,gCAAgC;EAC1E;EACA;EACA,MAAM;EACN,GAAI,eAAe,aAAa,CAAC,eAAe,UAAU,sBAAsB,EAAE,iBAAiB,eAAe;EAClH;EACA,UAAU;GACR,UAAU,SAAS,YAAY;GAC/B,YAAY,SAAS;GACrB,SAAS;GACT,OAAO,SAAS;GAChB,gBAAgB,SAAS;;EAE3B,SAAS;EACT;EACA;EACA;;CAGF,IAAI,EAAE,cAAc,oBAAoB,cAAc,eACpD,uCAAuC;CAEzC,MAAM,kBAAkB;EACtB,UAAU,SAAS,YAAY;EAC/B,YAAY,SAAS;EACrB,SAAS;EACT,OAAO,SAAS,MAAM;EACtB,gBAAgB,SAAS,eAAe;EACxC,WAAW,eAAe;;AAG5B,KAAI,CAAC,eAAe,WAAW;EAC7B,MAAM,WAAW,MAAM,IAAI,YAAkD;GAC3E;GACA,SAAS;IACP,MAAMC,mEAAkB;IACxB,SAAS;KACP,YAAY,eAAe;KAC3B,SAAS;KACT,WAAW,KAAK;KAChB,YAAY;MACV,yBAAyB,iBAAiB;MAC1C,sCAAsC,iBAAiB;;KAEzD,UAAU;KACV;KACA;KACA;;;GAGJ;;EAGF,MAAMC,eAAa,oCAAoC;AACvD,SAAO;GACL,gBAAgBA,aAAW,QAAQ;GACnC,MAAMA,aAAW,QAAQ;GACzB,eAAeF,+BAAY;GAC3B,MAAM,CAAC,GAAIE,aAAW,QAAQ,QAAQ,IAAK,GAAG;;;CAIlD,MAAM,iBAAiB;EACrB,YAAY,eAAe;EAC3B,SAAS;EACT,WAAW,KAAK;EAChB,YAAY;GACV,yBAAyB;GACzB,sCAAsC;;EAExC,WAAW;GACT,YAAY,eAAe,UAAU;GACrC,cAAc,eAAe,UAAU,qBAAqB;GAC5D,qBAAqB,eAAe,UAAU,qBAAqB,aAAa,MAAM,MAAM,EAAE,SAAS,WAAW;GAClH,sBAAsB,eAAe,UAAU,qBAAqB,aAAa,MAAM,MAAM,EAAE,SAAS,YAAY;GACpH,gBAAgB,eAAe,UAAU,qBAAqB,aAAa,KAAK,MAAM,EAAE;GACxF,sBAAsB;GACtB,qBAAqB,eAAe,UAAU;;EAEhD,UAAU;EACV;EACA;EACA;EACA;;CAGF,IAAIC;AACJ,KAAI;EACF,MAAM,OAAO,MAAM,IAAI,YAAyD;GAC9E;GACA,SAAS;IAAE,MAAMF,mEAAkB;IAAoB,SAAS;;GAChE;;AAEF,eAAa,oCAAoC;UAC1CG,GAAY;EACnB,MAAM,MAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO;AACtD,MAAI,CAACC,sEAAuC,KAAM,OAAM;AAExD,6EAAuC,eAAe,UAAU;AAChE,iBAAe,UAAU,sBAAsB;AAC/C,iBAAe,UAAU,sBAAsB;AAE/C,MAAI,CAAC,cAAc,CAAC,cAAc;GAChC,MAAM,YAAY,MAAM,iBAAiB,gCAAgC;IACvE;IACA;IACA,MAAM;IACN,iBAAiB;IACjB;IACA,UAAU;KACR,UAAU,SAAS,YAAY;KAC/B,YAAY,SAAS;KACrB,SAAS;KACT,OAAO,SAAS;KAChB,gBAAgB,SAAS;;IAE3B,SAAS;IACT;IACA;IACA;;AAGF,IAAC,CAAE,cAAc,oBAAoB,cAAc,cACjD,uCAAuC;AAEzC,kBAAe,eAAe;AAC9B,kBAAe,qBAAqB;AACpC,kBAAe,eAAe;AAC9B,kBAAe,aAAa;;EAG9B,MAAM,OAAO,MAAM,IAAI,YAAyD;GAC9E;GACA,SAAS;IAAE,MAAMJ,mEAAkB;IAAoB,SAAS;;GAChE;;AAEF,eAAa,oCAAoC;;AAGnD,QAAO;EACL,gBAAgB,WAAW,QAAQ;EACnC,MAAM,WAAW,QAAQ;EACzB,eAAeD,+BAAY;EAC3B,MAAM,CAAC,GAAI,WAAW,QAAQ,QAAQ,IAAK,GAAG;;;AAyBlD,SAAS,yCAAyC,MASvB;CACzB,MAAM,iBAAiBM,uCAAoB,KAAK,iBAAiB;AACjE,KAAI,CAAC,eACH,OAAM,IAAI,MAAM,wCAAwC,KAAK;CAG/D,MAAM,+BAA+BA,uCAAoBC,uCAAkB,KAAK;AAEhF,KAAI,KAAK,uBAAuB,oBAAoB;AAClD,MAAI,gCAAgC,iCAAiC,eACnE,MAAK,SAAS,KACZ,uBAAuB,6BAA6B,0CAA0C;AAGlG,SAAO;GACL,oBAAoB;GACpB,yBAAyB;GACzB,sBAAsB;GACtB,WAAW;;;CAIf,MAAM,uBAAuB,KAAK;AAClC,KAAI,CAAC,qBACH,OAAM,IAAI,MAAM,sCAAsC,KAAK;CAG7D,MAAM,qBAAqBD,uCAAoB,qBAAqB;AACpE,KAAI,CAAC,mBACH,OAAM,IAAI,MAAM,4CAA4C,KAAK;AAGnE,KAAI,gCAAgC,iCAAiC,mBACnE,MAAK,SAAS,KACZ,uBAAuB,6BAA6B,8CAA8C;CAItG,MAAM,aAAa,OAAO,KAAK,cAAc,IAAI;AACjD,KAAI,CAAC,WACH,OAAM,IAAI,MAAM;CAGlB,MAAM,OAAO,OAAO,KAAK,QAAQ,IAAI;AACrC,KAAI,CAAC,KACH,OAAM,IAAI,MAAM;CAGlB,MAAM,iBAAiBE,6DAAwC,qBAAqB,aAAa,KAAK,MAAM,EAAE;AAC9G,KAAI,CAAC,kBAAkB,eAAe,SAAS,EAC7C,OAAM,IAAI,MACR,8EAA8E,kBAAkB,IAAI,KAAK,KAAK;CAIlH,MAAM,2BAA2BC,4EAAwC;EACvE,eAAe,KAAK;EACpB;EACA;EACA,cAAc,qBAAqB;EACnC;;AAGF,QAAO;EACL,oBAAoB;EACpB,yBAAyB;EACzB,sBAAsB;EACtB,WAAW;GACT;GACA;GACA;GACA,qBAAqBC,4EAAwC;;;;AAKnE,SAAS,uCAAuC,cAU9C;CACA,MAAMC,qBAAmE,aAAa,aAClFC,gDAAqB,aAAa,cAClC;AAEJ,QAAO;EACL,cAAc,aAAa;EAC3B,oBAAoB,aAAa;EACjC,cAAc,aAAa;EAC3B,YAAY,qBAAqB,KAAK,UAAU,sBAAsB;;;AAI1E,SAAS,oCACP,UACoE;AACpE,KAAI,CAACC,kDAA4B,WAAW;AAC1C,MAAIC,oCAAc,UAChB,OAAM,IAAI,MAAM,SAAS,QAAQ,SAAS;AAE5C,QAAM,IAAI,MAAM;;AAGlB,KAAI,CAAC,SAAS,QAAQ,WAAW,CAAC,SAAS,QAAQ,kBAAkB,CAAC,SAAS,QAAQ,KACrF,OAAM,IAAI,MAAM,SAAS,QAAQ,SAAS;AAE5C,QAAO"}

package/dist/cjs/core/WebAuthnManager/SignerWorkerManager/handlers/signNep413Message.js

@@ -1,15 +1,16 @@
 const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.js');
 const require_signer_worker = require('../../../types/signer-worker.js');
-const require_validation = require('../../../WalletIframe/validation.js');
+const require_participants = require('../../../../threshold/participants.js');
+const require_credentialsHelpers = require('../../credentialsHelpers.js');
 const require_getDeviceNumber = require('../getDeviceNumber.js');
 const require_sessionHandshake = require('../sessionHandshake.js');
+const require_thresholdEd25519RelayerHealth = require('../../../threshold/thresholdEd25519RelayerHealth.js');
+const require_thresholdEd25519AuthSession = require('../../../threshold/thresholdEd25519AuthSession.js');
+const require_thresholdSessionPolicy = require('../../../threshold/thresholdSessionPolicy.js');
 let src_wasm_signer_worker_pkg_wasm_signer_worker_js = require("../../../../wasm_signer_worker/pkg/wasm_signer_worker.js");
 src_wasm_signer_worker_pkg_wasm_signer_worker_js = require_rolldown_runtime.__toESM(src_wasm_signer_worker_pkg_wasm_signer_worker_js);
 
 //#region src/core/WebAuthnManager/SignerWorkerManager/handlers/signNep413Message.ts
-require_signer_worker.init_signer_worker();
-require_getDeviceNumber.init_getDeviceNumber();
-require_validation.init_validation();
 /**
 * Sign a NEP-413 message using the user's passkey-derived private key
 *
@@ -18,16 +19,34 @@ require_validation.init_validation();
 */
 async function signNep413Message({ ctx, payload }) {
 	try {
-		const deviceNumber = await require_getDeviceNumber.getLastLoggedInDeviceNumber(payload.accountId, ctx.indexedDB.clientDB);
-		const encryptedKeyData = await ctx.indexedDB.nearKeysDB.getEncryptedKey(payload.accountId, deviceNumber);
-		if (!encryptedKeyData) throw new Error(`No encrypted key found for account: ${payload.accountId}`);
 		const sessionId = payload.sessionId ?? require_sessionHandshake.generateSessionId();
-		if (!ctx.vrfWorkerManager) throw new Error("VrfWorkerManager not available for NEP-413 signing");
-		await ctx.vrfWorkerManager.confirmAndPrepareSigningSession({
+		const relayerUrl = ctx.relayerUrl;
+		const nearAccountId = payload.accountId;
+		const deviceNumber = await require_getDeviceNumber.getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);
+		const [localKeyMaterial, thresholdKeyMaterial] = await Promise.all([ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber), ctx.indexedDB.nearKeysDB.getThresholdKeyMaterial(nearAccountId, deviceNumber)]);
+		if (!localKeyMaterial) throw new Error(`No local key material found for account: ${nearAccountId}`);
+		const resolvedSignerMode = await require_thresholdEd25519RelayerHealth.resolveSignerModeForThresholdSigning({
+			nearAccountId,
+			signerMode: payload.signerMode,
+			relayerUrl,
+			hasThresholdKeyMaterial: !!thresholdKeyMaterial
+		});
+		const vrfWorkerManager = ctx.vrfWorkerManager;
+		if (!vrfWorkerManager) throw new Error("VrfWorkerManager not available for NEP-413 signing");
+		const signingContext = validateAndPrepareNep413SigningContext({
+			nearAccountId,
+			resolvedSignerMode,
+			relayerUrl,
+			rpId: ctx.touchIdPrompt.getRpId(),
+			localKeyMaterial,
+			thresholdKeyMaterial
+		});
+		const confirmation = await vrfWorkerManager.confirmAndPrepareSigningSession({
 			ctx,
 			sessionId,
 			kind: "nep413",
-			nearAccountId: payload.accountId,
+			...signingContext.threshold && !signingContext.threshold.thresholdSessionJwt ? { signingAuthMode: "webauthn" } : {},
+			nearAccountId,
 			message: payload.message,
 			recipient: payload.recipient,
 			title: payload.title,
@@ -36,32 +55,95 @@ async function signNep413Message({ ctx, payload }) {
 			contractId: payload.contractId,
 			nearRpcUrl: payload.nearRpcUrl
 		});
-		const response = await ctx.sendMessage({
-			sessionId,
-			message: {
-				type: src_wasm_signer_worker_pkg_wasm_signer_worker_js.WorkerRequestType.SignNep413Message,
-				payload: {
+		let { vrfChallenge, credential } = extractSigningEvidenceFromConfirmation(confirmation);
+		const requestPayload = {
+			signerMode: signingContext.resolvedSignerMode,
+			message: payload.message,
+			recipient: payload.recipient,
+			nonce: payload.nonce,
+			state: payload.state || void 0,
+			accountId: nearAccountId,
+			nearPublicKey: signingContext.nearPublicKey,
+			decryption: signingContext.decryption,
+			threshold: signingContext.threshold ? {
+				relayerUrl: signingContext.threshold.relayerUrl,
+				relayerKeyId: signingContext.threshold.thresholdKeyMaterial.relayerKeyId,
+				clientParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "client")?.id,
+				relayerParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "relayer")?.id,
+				participantIds: signingContext.threshold.thresholdKeyMaterial.participants.map((p) => p.id),
+				thresholdSessionKind: "jwt",
+				thresholdSessionJwt: signingContext.threshold.thresholdSessionJwt
+			} : void 0,
+			vrfChallenge,
+			credential
+		};
+		if (!signingContext.threshold) {
+			const response = await ctx.sendMessage({
+				sessionId,
+				message: {
+					type: src_wasm_signer_worker_pkg_wasm_signer_worker_js.WorkerRequestType.SignNep413Message,
+					payload: requestPayload
+				}
+			});
+			const okResponse$1 = requireOkSignNep413MessageResponse(response);
+			return {
+				success: true,
+				accountId: okResponse$1.payload.accountId,
+				publicKey: okResponse$1.payload.publicKey,
+				signature: okResponse$1.payload.signature,
+				state: okResponse$1.payload.state || void 0
+			};
+		}
+		let okResponse;
+		try {
+			const response = await ctx.sendMessage({
+				sessionId,
+				message: {
+					type: src_wasm_signer_worker_pkg_wasm_signer_worker_js.WorkerRequestType.SignNep413Message,
+					payload: requestPayload
+				}
+			});
+			okResponse = requireOkSignNep413MessageResponse(response);
+		} catch (e) {
+			const err = e instanceof Error ? e : new Error(String(e));
+			if (!require_thresholdSessionPolicy.isThresholdSessionAuthUnavailableError(err)) throw err;
+			require_thresholdEd25519AuthSession.clearCachedThresholdEd25519AuthSession(signingContext.threshold.thresholdSessionCacheKey);
+			signingContext.threshold.thresholdSessionJwt = void 0;
+			requestPayload.threshold.thresholdSessionJwt = void 0;
+			if (!credential || !vrfChallenge) {
+				const refreshed = await vrfWorkerManager.confirmAndPrepareSigningSession({
+					ctx,
+					sessionId,
+					kind: "nep413",
+					signingAuthMode: "webauthn",
+					nearAccountId,
 					message: payload.message,
 					recipient: payload.recipient,
-					nonce: payload.nonce,
-					state: payload.state || void 0,
-					accountId: payload.accountId,
-					encryptedPrivateKeyData: encryptedKeyData.encryptedData,
-					encryptedPrivateKeyChacha20NonceB64u: encryptedKeyData.chacha20NonceB64u
-				}
+					title: payload.title,
+					body: payload.body,
+					confirmationConfigOverride: payload.confirmationConfigOverride,
+					contractId: payload.contractId,
+					nearRpcUrl: payload.nearRpcUrl
+				});
+				({vrfChallenge, credential} = extractSigningEvidenceFromConfirmation(refreshed));
+				requestPayload.vrfChallenge = vrfChallenge;
+				requestPayload.credential = credential;
 			}
-		});
-		if (!require_signer_worker.isSignNep413MessageSuccess(response)) {
-			console.error("SignerWorkerManager: NEP-413 signing failed:", response);
-			const payloadError = require_validation.isObject(response?.payload) && response?.payload?.error;
-			throw new Error(payloadError || "NEP-413 signing failed");
+			const response = await ctx.sendMessage({
+				sessionId,
+				message: {
+					type: src_wasm_signer_worker_pkg_wasm_signer_worker_js.WorkerRequestType.SignNep413Message,
+					payload: requestPayload
+				}
+			});
+			okResponse = requireOkSignNep413MessageResponse(response);
 		}
 		return {
 			success: true,
-			accountId: response.payload.accountId,
-			publicKey: response.payload.publicKey,
-			signature: response.payload.signature,
-			state: response.payload.state || void 0
+			accountId: okResponse.payload.accountId,
+			publicKey: okResponse.payload.publicKey,
+			signature: okResponse.payload.signature,
+			state: okResponse.payload.state || void 0
 		};
 	} catch (error) {
 		console.error("SignerWorkerManager: NEP-413 signing error:", error);
@@ -74,6 +156,64 @@ async function signNep413Message({ ctx, payload }) {
 		};
 	}
 }
+function validateAndPrepareNep413SigningContext(args) {
+	const localPublicKey = String(args.localKeyMaterial.publicKey || "").trim();
+	if (!localPublicKey) throw new Error(`Missing local signing public key for ${args.nearAccountId}`);
+	if (args.resolvedSignerMode !== "threshold-signer") return {
+		resolvedSignerMode: "local-signer",
+		nearPublicKey: localPublicKey,
+		decryption: {
+			encryptedPrivateKeyData: args.localKeyMaterial.encryptedSk,
+			encryptedPrivateKeyChacha20NonceB64u: args.localKeyMaterial.chacha20NonceB64u
+		},
+		threshold: null
+	};
+	const thresholdKeyMaterial = args.thresholdKeyMaterial;
+	if (!thresholdKeyMaterial) throw new Error(`Missing threshold key material for ${args.nearAccountId}`);
+	const thresholdPublicKey = String(thresholdKeyMaterial.publicKey || "").trim();
+	if (!thresholdPublicKey) throw new Error(`Missing threshold signing public key for ${args.nearAccountId}`);
+	const relayerUrl = String(args.relayerUrl || "").trim();
+	if (!relayerUrl) throw new Error("Missing relayerUrl (required for threshold-signer)");
+	const rpId = String(args.rpId || "").trim();
+	if (!rpId) throw new Error("Missing rpId for threshold signing");
+	const participantIds = require_participants.normalizeThresholdEd25519ParticipantIds(thresholdKeyMaterial.participants.map((p) => p.id));
+	if (!participantIds || participantIds.length < 2) throw new Error(`Invalid threshold signing participantIds (expected >=2 participants, got [${(participantIds || []).join(",")}])`);
+	const thresholdSessionCacheKey = require_thresholdEd25519AuthSession.makeThresholdEd25519AuthSessionCacheKey({
+		nearAccountId: args.nearAccountId,
+		rpId,
+		relayerUrl,
+		relayerKeyId: thresholdKeyMaterial.relayerKeyId,
+		participantIds
+	});
+	return {
+		resolvedSignerMode: "threshold-signer",
+		nearPublicKey: thresholdPublicKey,
+		decryption: {
+			encryptedPrivateKeyData: "",
+			encryptedPrivateKeyChacha20NonceB64u: ""
+		},
+		threshold: {
+			relayerUrl,
+			thresholdKeyMaterial,
+			thresholdSessionCacheKey,
+			thresholdSessionJwt: require_thresholdEd25519AuthSession.getCachedThresholdEd25519AuthSessionJwt(thresholdSessionCacheKey)
+		}
+	};
+}
+function extractSigningEvidenceFromConfirmation(confirmation) {
+	const credentialForRelay = confirmation.credential ? require_credentialsHelpers.removePrfOutputGuard(confirmation.credential) : void 0;
+	return {
+		vrfChallenge: confirmation.vrfChallenge,
+		credential: credentialForRelay ? JSON.stringify(credentialForRelay) : void 0
+	};
+}
+function requireOkSignNep413MessageResponse(response) {
+	if (!require_signer_worker.isSignNep413MessageSuccess(response)) {
+		if (require_signer_worker.isWorkerError(response)) throw new Error(response.payload.error || "NEP-413 signing failed");
+		throw new Error("NEP-413 signing failed");
+	}
+	return response;
+}
 
 //#endregion
 exports.signNep413Message = signNep413Message;