@tatchi-xyz/sdk 0.20.0 → 0.31.0

package/dist/esm/sdk/touchIdPrompt-JPhrOx8o.js

@@ -0,0 +1,263 @@
+import { base64UrlDecode } from "./base64-dqpWgddX.js";
+import { outputAs32Bytes } from "./vrf-worker-BzQsJ5BW.js";
+import { executeWebAuthnWithParentFallbacksSafari, generateChaCha20Salt, generateEd25519Salt, serializeAuthenticationCredentialWithPRF } from "./safari-fallbacks-BcMFntiP.js";
+
+//#region src/core/WebAuthnManager/touchIdPrompt.ts
+function isRegistrableSuffix(host, cand) {
+	if (!host || !cand) return false;
+	if (host === cand) return true;
+	return host.endsWith("." + cand);
+}
+function resolveRpId(override, host) {
+	const h = (host || "").toLowerCase();
+	const ov = (override || "").toLowerCase();
+	if (ov && h && isRegistrableSuffix(h, ov)) return ov;
+	return h || ov || "";
+}
+function authenticatorsToAllowCredentials(authenticators) {
+	return authenticators.map((auth) => ({
+		id: auth.credentialId,
+		type: "public-key",
+		transports: auth.transports
+	}));
+}
+/**
+* TouchIdPrompt prompts for touchID,
+* creates credentials,
+* manages WebAuthn touchID prompts,
+* and generates credentials, and PRF Outputs
+*/
+var TouchIdPrompt = class TouchIdPrompt {
+	rpIdOverride;
+	safariGetWebauthnRegistrationFallback;
+	abortController;
+	removePageAbortHandlers;
+	removeExternalAbortListener;
+	constructor(rpIdOverride, safariGetWebauthnRegistrationFallback = false) {
+		this.rpIdOverride = rpIdOverride;
+		this.safariGetWebauthnRegistrationFallback = safariGetWebauthnRegistrationFallback === true;
+	}
+	getRpId() {
+		try {
+			return resolveRpId(this.rpIdOverride, window?.location?.hostname);
+		} catch {
+			return this.rpIdOverride || "";
+		}
+	}
+	static _inIframe() {
+		try {
+			return window.self !== window.top;
+		} catch {
+			return true;
+		}
+	}
+	/**
+	* Get authentication credentials
+	* @param nearAccountId - NEAR account ID to authenticate
+	* @param challenge - VRF challenge bytes
+	* @param allowCredentials - Array of allowed credentials for authentication
+	* @returns WebAuthn credential with only the first PRF output
+	*/
+	async getAuthenticationCredentialsSerialized({ nearAccountId, challenge, allowCredentials }) {
+		const credentialMaybe = await this.getAuthenticationCredentialsInternal({
+			nearAccountId,
+			challenge,
+			allowCredentials
+		});
+		if (isSerializedAuthenticationCredential(credentialMaybe)) return credentialMaybe;
+		return serializeAuthenticationCredentialWithPRF({
+			credential: credentialMaybe,
+			firstPrfOutput: true,
+			secondPrfOutput: false
+		});
+	}
+	/**
+	*  Same as getAuthenticationCredentialsSerialized but returns both PRF outputs
+	*  (PRF.first + PRF.second).
+	* @param nearAccountId - NEAR account ID to authenticate
+	* @param challenge - VRF challenge bytes
+	* @param allowCredentials - Array of allowed credentials for authentication
+	* @returns
+	*/
+	async getAuthenticationCredentialsSerializedDualPrf({ nearAccountId, challenge, allowCredentials }) {
+		const credentialMaybe = await this.getAuthenticationCredentialsInternal({
+			nearAccountId,
+			challenge,
+			allowCredentials
+		});
+		if (isSerializedAuthenticationCredential(credentialMaybe)) return credentialMaybe;
+		return serializeAuthenticationCredentialWithPRF({
+			credential: credentialMaybe,
+			firstPrfOutput: true,
+			secondPrfOutput: true
+		});
+	}
+	/**
+	* Internal method for generating WebAuthn registration credentials with PRF output
+	* @param nearAccountId - NEAR account ID for PRF salts and keypair derivation (always base account)
+	* @param challenge - Random challenge bytes for the registration ceremony
+	* @param deviceNumber - Device number for device-specific user ID.
+	* @returns Credential with PRF output
+	*/
+	async generateRegistrationCredentialsInternal({ nearAccountId, challenge, deviceNumber }) {
+		this.abortController = new AbortController();
+		this.removePageAbortHandlers = TouchIdPrompt.attachPageAbortHandlers(this.abortController);
+		const rpId = this.getRpId();
+		const publicKey = {
+			challenge: outputAs32Bytes(challenge),
+			rp: {
+				name: "WebAuthn VRF Passkey",
+				id: rpId
+			},
+			user: {
+				id: new TextEncoder().encode(generateDeviceSpecificUserId(nearAccountId, deviceNumber)),
+				name: generateDeviceSpecificUserId(nearAccountId, deviceNumber),
+				displayName: generateUserFriendlyDisplayName(nearAccountId, deviceNumber)
+			},
+			pubKeyCredParams: [{
+				alg: -7,
+				type: "public-key"
+			}, {
+				alg: -257,
+				type: "public-key"
+			}],
+			authenticatorSelection: {
+				residentKey: "required",
+				userVerification: "preferred"
+			},
+			timeout: 6e4,
+			attestation: "none",
+			extensions: { prf: { eval: {
+				first: generateChaCha20Salt(nearAccountId),
+				second: generateEd25519Salt(nearAccountId)
+			} } }
+		};
+		try {
+			const result = await executeWebAuthnWithParentFallbacksSafari("create", publicKey, {
+				rpId,
+				inIframe: TouchIdPrompt._inIframe(),
+				timeoutMs: publicKey.timeout,
+				abortSignal: this.abortController.signal
+			});
+			return result;
+		} finally {
+			this.removePageAbortHandlers?.();
+			this.removePageAbortHandlers = void 0;
+			this.removeExternalAbortListener?.();
+			this.removeExternalAbortListener = void 0;
+			this.abortController = void 0;
+		}
+	}
+	/**
+	* Internal method for getting WebAuthn authentication credentials with PRF output
+	* @param nearAccountId - NEAR account ID to authenticate
+	* @param challenge - VRF challenge bytes to use for WebAuthn authentication
+	* @param authenticators - List of stored authenticator data for the user
+	* @returns WebAuthn credential with PRF output (HKDF derivation done in WASM worker)
+	* ```ts
+	* const credential = await touchIdPrompt.getCredentials({
+	*   nearAccountId,
+	*   challenge,
+	*   authenticators,
+	* });
+	* ```
+	*/
+	async getAuthenticationCredentialsInternal({ nearAccountId, challenge, allowCredentials }) {
+		this.abortController = new AbortController();
+		this.removePageAbortHandlers = TouchIdPrompt.attachPageAbortHandlers(this.abortController);
+		const rpId = this.getRpId();
+		const publicKey = {
+			challenge: outputAs32Bytes(challenge),
+			rpId,
+			allowCredentials: allowCredentials.map((credential) => ({
+				id: base64UrlDecode(credential.id),
+				type: "public-key",
+				transports: credential.transports
+			})),
+			userVerification: "preferred",
+			timeout: 6e4,
+			extensions: { prf: { eval: {
+				first: generateChaCha20Salt(nearAccountId),
+				second: generateEd25519Salt(nearAccountId)
+			} } }
+		};
+		try {
+			const result = await executeWebAuthnWithParentFallbacksSafari("get", publicKey, {
+				rpId,
+				inIframe: TouchIdPrompt._inIframe(),
+				timeoutMs: publicKey.timeout,
+				permitGetBridgeOnAncestorError: this.safariGetWebauthnRegistrationFallback,
+				abortSignal: this.abortController.signal
+			});
+			return result;
+		} finally {
+			this.removePageAbortHandlers?.();
+			this.removePageAbortHandlers = void 0;
+			this.removeExternalAbortListener?.();
+			this.removeExternalAbortListener = void 0;
+			this.abortController = void 0;
+		}
+	}
+};
+function isSerializedAuthenticationCredential(x) {
+	if (!x || typeof x !== "object") return false;
+	const obj = x;
+	const resp = obj.response;
+	return typeof resp?.authenticatorData === "string";
+}
+/**
+* Generate device-specific user ID to prevent Chrome sync conflicts
+* Creates technical identifiers with full account context
+*
+* @param nearAccountId - The NEAR account ID (e.g., "serp120.w3a-v1.testnet")
+* @param deviceNumber - The device number (optional, undefined for device 1, 2 for device 2, etc.)
+* @returns Technical identifier:
+*   - Device 1: "serp120.web3-authn.testnet"
+*   - Device 2: "serp120.web3-authn.testnet (2)"
+*   - Device 3: "serp120.web3-authn.testnet (3)"
+*/
+function generateDeviceSpecificUserId(nearAccountId, deviceNumber) {
+	if (deviceNumber === void 0 || deviceNumber === 1) return nearAccountId;
+	return `${nearAccountId} (${deviceNumber})`;
+}
+/**
+* Generate user-friendly display name for passkey manager UI
+* Creates clean, intuitive names that users will see
+*
+* @param nearAccountId - The NEAR account ID (e.g., "serp120.w3a-v1.testnet")
+* @param deviceNumber - The device number (optional, undefined for device 1, 2 for device 2, etc.)
+* @returns User-friendly display name:
+*   - Device 1: "serp120"
+*   - Device 2: "serp120 (device 2)"
+*   - Device 3: "serp120 (device 3)"
+*/
+function generateUserFriendlyDisplayName(nearAccountId, deviceNumber) {
+	const baseUsername = nearAccountId.split(".")[0];
+	if (deviceNumber === void 0 || deviceNumber === 1) return baseUsername;
+	return `${baseUsername} (device ${deviceNumber})`;
+}
+(function(_TouchIdPrompt) {
+	function attachPageAbortHandlers(controller) {
+		const onVisibility = () => {
+			if (document.hidden) controller.abort();
+		};
+		const onPageHide = () => {
+			controller.abort();
+		};
+		const onBeforeUnload = () => {
+			controller.abort();
+		};
+		document.addEventListener("visibilitychange", onVisibility, { passive: true });
+		window.addEventListener("pagehide", onPageHide, { passive: true });
+		window.addEventListener("beforeunload", onBeforeUnload, { passive: true });
+		return () => {
+			document.removeEventListener("visibilitychange", onVisibility);
+			window.removeEventListener("pagehide", onPageHide);
+			window.removeEventListener("beforeunload", onBeforeUnload);
+		};
+	}
+	_TouchIdPrompt.attachPageAbortHandlers = attachPageAbortHandlers;
+})(TouchIdPrompt || (TouchIdPrompt = {}));
+
+//#endregion
+export { TouchIdPrompt, authenticatorsToAllowCredentials };

package/dist/esm/sdk/transactions-CrjP8yPD.js

@@ -0,0 +1,170 @@
+import "./validation-hUZgySTx.js";
+import { ERROR_MESSAGES, SecureConfirmationType, computeUiIntentDigestFromNep413, getIntentDigest, getNearAccountId, getSignTransactionPayload, getTxCount, isUserCancelledSecureConfirm, toAccountId, toError } from "./collectAuthenticationCredentialForVrfChallenge-C9p90e5Z.js";
+import { PASSKEY_MANAGER_DEFAULT_CONFIGS, getLastLoggedInDeviceNumber } from "./getDeviceNumber-f8bfPB9U.js";
+import { createConfirmSession, createConfirmTxFlowAdapters } from "./createAdapters-Dv7ZJPf1.js";
+import "./css-loader-DWW-_Vli.js";
+
+//#region src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/flows/transactions.ts
+function getSigningAuthMode(request) {
+	if (request.type === SecureConfirmationType.SIGN_TRANSACTION) return getSignTransactionPayload(request).signingAuthMode ?? "webauthn";
+	if (request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE) return request.payload.signingAuthMode ?? "webauthn";
+	return "webauthn";
+}
+async function handleTransactionSigningFlow(ctx, request, worker, opts) {
+	const { confirmationConfig, transactionSummary } = opts;
+	const adapters = createConfirmTxFlowAdapters(ctx);
+	const session = createConfirmSession({
+		adapters,
+		worker,
+		request,
+		confirmationConfig,
+		transactionSummary
+	});
+	const nearAccountId = getNearAccountId(request);
+	const signingAuthMode = getSigningAuthMode(request);
+	const usesNeeded = getTxCount(request);
+	const vrfIntentDigestB64u = request.type === SecureConfirmationType.SIGN_TRANSACTION ? getIntentDigest(request) : request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE ? await computeUiIntentDigestFromNep413({
+		nearAccountId,
+		recipient: request.payload.recipient,
+		message: request.payload.message
+	}) : void 0;
+	const sessionPolicyDigest32 = request.payload.sessionPolicyDigest32;
+	const nearRpc = await adapters.near.fetchNearContext({
+		nearAccountId,
+		txCount: usesNeeded,
+		reserveNonces: true
+	});
+	if (!nearRpc.transactionContext) {
+		console.error("[SigningFlow] fetchNearContext failed", {
+			error: nearRpc.error,
+			details: nearRpc.details
+		});
+		return session.confirmAndCloseModal({
+			requestId: request.requestId,
+			intentDigest: getIntentDigest(request),
+			confirmed: false,
+			error: nearRpc.details ? `${ERROR_MESSAGES.nearRpcFailed}: ${nearRpc.details}` : ERROR_MESSAGES.nearRpcFailed
+		});
+	}
+	session.setReservedNonces(nearRpc.reservedNonces);
+	let transactionContext = nearRpc.transactionContext;
+	const rpId = adapters.vrf.getRpId();
+	let uiVrfChallenge;
+	let uiVrfChallengeForUi = rpId ? {
+		userId: nearAccountId,
+		rpId,
+		blockHeight: transactionContext.txBlockHeight,
+		blockHash: transactionContext.txBlockHash
+	} : void 0;
+	if (signingAuthMode === "webauthn") {
+		uiVrfChallenge = await adapters.vrf.generateVrfChallengeForSession({
+			userId: nearAccountId,
+			rpId,
+			blockHeight: transactionContext.txBlockHeight,
+			blockHash: transactionContext.txBlockHash,
+			...vrfIntentDigestB64u ? { intentDigest: vrfIntentDigestB64u } : {},
+			...sessionPolicyDigest32 ? { sessionPolicyDigest32 } : {}
+		}, request.requestId);
+		uiVrfChallengeForUi = uiVrfChallenge;
+	}
+	const { confirmed, error: uiError } = await session.promptUser({ vrfChallenge: uiVrfChallengeForUi });
+	if (!confirmed) return session.confirmAndCloseModal({
+		requestId: request.requestId,
+		intentDigest: getIntentDigest(request),
+		confirmed: false,
+		error: uiError
+	});
+	if (signingAuthMode === "warmSession") {
+		try {
+			await adapters.vrf.dispenseSessionKey({
+				sessionId: request.requestId,
+				uses: usesNeeded
+			});
+		} catch (err) {
+			const msg = String(toError(err)?.message || err || "");
+			return session.confirmAndCloseModal({
+				requestId: request.requestId,
+				intentDigest: getIntentDigest(request),
+				confirmed: false,
+				error: msg || "Failed to dispense warm session key"
+			});
+		}
+		session.confirmAndCloseModal({
+			requestId: request.requestId,
+			intentDigest: getIntentDigest(request),
+			confirmed: true,
+			transactionContext
+		});
+		return;
+	}
+	try {
+		const refreshed = await adapters.vrf.maybeRefreshVrfChallenge(request, nearAccountId);
+		uiVrfChallenge = refreshed.vrfChallenge;
+		transactionContext = refreshed.transactionContext;
+		session.updateUI({ vrfChallenge: uiVrfChallenge });
+	} catch (e) {
+		console.debug("[SigningFlow] VRF JIT refresh skipped", e);
+	}
+	try {
+		if (!uiVrfChallenge) throw new Error("Missing vrfChallenge for WebAuthn signing flow");
+		const serializedCredential = await adapters.webauthn.collectAuthenticationCredentialWithPRF({
+			nearAccountId,
+			vrfChallenge: uiVrfChallenge
+		});
+		let contractId;
+		let nearRpcUrl;
+		try {
+			const vrfStatus = await adapters.vrf.checkVrfStatus();
+			if (!vrfStatus.active) throw new Error("VRF keypair not active in memory. VRF session may have expired or was not properly initialized. Please refresh and try again.");
+			if (!vrfStatus.nearAccountId || String(vrfStatus.nearAccountId) !== String(toAccountId(nearAccountId))) throw new Error("VRF session is active but bound to a different account than the one being signed. Please log in again on this device.");
+			const deviceNumber = await getLastLoggedInDeviceNumber(toAccountId(nearAccountId), ctx.indexedDB.clientDB);
+			const keyMaterial = await ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber);
+			if (!keyMaterial) throw new Error(`No key material found for account ${nearAccountId} device ${deviceNumber}`);
+			const wrapKeySalt = keyMaterial.wrapKeySalt;
+			if (!wrapKeySalt) throw new Error("Missing wrapKeySalt in vault; re-register to upgrade vault format.");
+			if (request.type === SecureConfirmationType.SIGN_TRANSACTION) {
+				const payload = getSignTransactionPayload(request);
+				contractId = payload?.rpcCall?.contractId;
+				nearRpcUrl = payload?.rpcCall?.nearRpcUrl;
+			} else if (request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE) {
+				const payload = request.payload;
+				contractId = payload.contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId;
+				nearRpcUrl = payload.nearRpcUrl || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl;
+			}
+			await adapters.vrf.mintSessionKeysAndSendToSigner({
+				sessionId: request.requestId,
+				wrapKeySalt,
+				contractId,
+				nearRpcUrl,
+				credential: serializedCredential
+			});
+		} catch (err) {
+			console.error("[SigningFlow] WrapKeySeed derivation failed:", err);
+			throw err;
+		}
+		session.confirmAndCloseModal({
+			requestId: request.requestId,
+			intentDigest: getIntentDigest(request),
+			confirmed: true,
+			credential: serializedCredential,
+			vrfChallenge: uiVrfChallenge,
+			transactionContext
+		});
+	} catch (err) {
+		const cancelled = isUserCancelledSecureConfirm(err);
+		const msg = String(toError(err)?.message || err || "");
+		if (/Missing PRF result/i.test(msg) || /Missing PRF results/i.test(msg)) return session.cleanupAndRethrow(err);
+		if (cancelled) window.parent?.postMessage({ type: "WALLET_UI_CLOSED" }, "*");
+		const isWrongPasskeyError = /multiple passkeys \(devicenumbers\) for account/i.test(msg);
+		return session.confirmAndCloseModal({
+			requestId: request.requestId,
+			intentDigest: getIntentDigest(request),
+			confirmed: false,
+			error: cancelled ? ERROR_MESSAGES.cancelled : isWrongPasskeyError ? msg : msg || ERROR_MESSAGES.collectCredentialsFailed
+		});
+	}
+}
+
+//#endregion
+export { handleTransactionSigningFlow };
+//# sourceMappingURL=transactions-CrjP8yPD.js.map

package/dist/esm/sdk/transactions-CrjP8yPD.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transactions-CrjP8yPD.js","names":["transactionContext: TransactionContext","uiVrfChallenge: VRFChallenge | undefined","uiVrfChallengeForUi: Partial<VRFChallenge> | undefined","err: unknown","contractId: string | undefined","nearRpcUrl: string | undefined"],"sources":["../../../src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/flows/transactions.ts"],"sourcesContent":["import type { VrfWorkerManagerContext } from '../../';\nimport type { ConfirmationConfig } from '../../../../types/signer-worker';\nimport {\n  SecureConfirmationType,\n  TransactionSummary,\n  SigningSecureConfirmRequest,\n  SigningAuthMode,\n} from '../types';\nimport { VRFChallenge, TransactionContext } from '../../../../types';\nimport {\n  getNearAccountId,\n  getIntentDigest,\n  getTxCount,\n  isUserCancelledSecureConfirm,\n  ERROR_MESSAGES,\n  getSignTransactionPayload,\n} from './index';\nimport { toAccountId } from '../../../../types/accountIds';\nimport { getLastLoggedInDeviceNumber } from '../../../SignerWorkerManager/getDeviceNumber';\nimport { toError } from '../../../../../utils/errors';\nimport { PASSKEY_MANAGER_DEFAULT_CONFIGS } from '../../../../defaultConfigs';\nimport { createConfirmSession } from '../adapters/session';\nimport { createConfirmTxFlowAdapters } from '../adapters/createAdapters';\nimport { computeUiIntentDigestFromNep413 } from '../../../../digests/intentDigest';\n\nfunction getSigningAuthMode(request: SigningSecureConfirmRequest): SigningAuthMode {\n  if (request.type === SecureConfirmationType.SIGN_TRANSACTION) {\n    return getSignTransactionPayload(request).signingAuthMode ?? 'webauthn';\n  }\n  if (request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE) {\n    return request.payload.signingAuthMode ?? 'webauthn';\n  }\n  return 'webauthn';\n}\n\nexport async function handleTransactionSigningFlow(\n  ctx: VrfWorkerManagerContext,\n  request: SigningSecureConfirmRequest,\n  worker: Worker,\n  opts: { confirmationConfig: ConfirmationConfig; transactionSummary: TransactionSummary },\n): Promise<void> {\n  const { confirmationConfig, transactionSummary } = opts;\n  const adapters = createConfirmTxFlowAdapters(ctx);\n  const session = createConfirmSession({\n    adapters,\n    worker,\n    request,\n    confirmationConfig,\n    transactionSummary,\n  });\n  const nearAccountId = getNearAccountId(request);\n  const signingAuthMode = getSigningAuthMode(request);\n  const usesNeeded = getTxCount(request);\n  const vrfIntentDigestB64u = request.type === SecureConfirmationType.SIGN_TRANSACTION\n    ? getIntentDigest(request)\n    : request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE\n      ? await computeUiIntentDigestFromNep413({\n        nearAccountId,\n        recipient: request.payload.recipient,\n        message: request.payload.message,\n      })\n      : undefined;\n  const sessionPolicyDigest32 = request.payload.sessionPolicyDigest32;\n\n  // 1) NEAR context + nonce reservation\n  const nearRpc = await adapters.near.fetchNearContext({ nearAccountId, txCount: usesNeeded, reserveNonces: true });\n  if (!nearRpc.transactionContext) {\n    // eslint-disable-next-line no-console\n    console.error('[SigningFlow] fetchNearContext failed', { error: nearRpc.error, details: nearRpc.details });\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: nearRpc.details ? `${ERROR_MESSAGES.nearRpcFailed}: ${nearRpc.details}` : ERROR_MESSAGES.nearRpcFailed,\n    });\n  }\n  session.setReservedNonces(nearRpc.reservedNonces);\n  let transactionContext: TransactionContext = nearRpc.transactionContext;\n\n  // 2) Security context shown in the confirmer (rpId + block height).\n  // For warmSession signing we still want to show this context even though\n  // we won't collect a WebAuthn credential.\n  const rpId = adapters.vrf.getRpId();\n  let uiVrfChallenge: VRFChallenge | undefined;\n  let uiVrfChallengeForUi: Partial<VRFChallenge> | undefined = rpId\n    ? {\n        userId: nearAccountId,\n        rpId,\n        blockHeight: transactionContext.txBlockHeight,\n        blockHash: transactionContext.txBlockHash,\n      }\n    : undefined;\n\n  // Initial VRF challenge (only needed for WebAuthn credential collection)\n  if (signingAuthMode === 'webauthn') {\n    uiVrfChallenge = await adapters.vrf.generateVrfChallengeForSession(\n      {\n        userId: nearAccountId,\n        rpId,\n        blockHeight: transactionContext.txBlockHeight,\n        blockHash: transactionContext.txBlockHash,\n        ...(vrfIntentDigestB64u ? { intentDigest: vrfIntentDigestB64u } : {}),\n        ...(sessionPolicyDigest32 ? { sessionPolicyDigest32 } : {}),\n      },\n      request.requestId,\n    );\n    uiVrfChallengeForUi = uiVrfChallenge;\n  }\n\n  // 3) UI confirm\n  const { confirmed, error: uiError } = await session.promptUser({ vrfChallenge: uiVrfChallengeForUi });\n  if (!confirmed) {\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: uiError,\n    });\n  }\n\n  // 4) Warm session: dispense WrapKeySeed and skip WebAuthn\n  if (signingAuthMode === 'warmSession') {\n    try {\n      await adapters.vrf.dispenseSessionKey({ sessionId: request.requestId, uses: usesNeeded });\n    } catch (err: unknown) {\n      const msg = String((toError(err))?.message || err || '');\n      return session.confirmAndCloseModal({\n        requestId: request.requestId,\n        intentDigest: getIntentDigest(request),\n        confirmed: false,\n        error: msg || 'Failed to dispense warm session key',\n      });\n    }\n\n    session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: true,\n      transactionContext,\n    });\n    return;\n  }\n\n  // 5) JIT refresh VRF + ctx (best-effort)\n  try {\n    const refreshed = await adapters.vrf.maybeRefreshVrfChallenge(request, nearAccountId);\n    uiVrfChallenge = refreshed.vrfChallenge;\n    transactionContext = refreshed.transactionContext;\n    session.updateUI({ vrfChallenge: uiVrfChallenge });\n  } catch (e) {\n    console.debug('[SigningFlow] VRF JIT refresh skipped', e);\n  }\n\n  // 6) Collect authentication credential\n  try {\n    if (!uiVrfChallenge) {\n      throw new Error('Missing vrfChallenge for WebAuthn signing flow');\n    }\n    const serializedCredential = await adapters.webauthn.collectAuthenticationCredentialWithPRF({\n      nearAccountId,\n      vrfChallenge: uiVrfChallenge,\n    });\n\n    // 5c) Derive WrapKeySeed inside the VRF worker and deliver it to the signer worker via\n    // the reserved WrapKeySeed MessagePort. Main thread only sees wrapKeySalt metadata.\n    let contractId: string | undefined;\n    let nearRpcUrl: string | undefined;\n    try {\n      // Ensure VRF session is active and bound to the same account we are signing for.\n      const vrfStatus = await adapters.vrf.checkVrfStatus();\n      if (!vrfStatus.active) {\n        throw new Error('VRF keypair not active in memory. VRF session may have expired or was not properly initialized. Please refresh and try again.');\n      }\n      if (!vrfStatus.nearAccountId || String(vrfStatus.nearAccountId) !== String(toAccountId(nearAccountId))) {\n        throw new Error('VRF session is active but bound to a different account than the one being signed. Please log in again on this device.');\n      }\n\n      const deviceNumber = await getLastLoggedInDeviceNumber(toAccountId(nearAccountId), ctx.indexedDB.clientDB);\n      const keyMaterial = await ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber);\n      if (!keyMaterial) {\n        throw new Error(`No key material found for account ${nearAccountId} device ${deviceNumber}`);\n      }\n      const wrapKeySalt = keyMaterial.wrapKeySalt;\n      if (!wrapKeySalt) {\n        throw new Error('Missing wrapKeySalt in vault; re-register to upgrade vault format.');\n      }\n\n      // Extract contract verification context when available.\n      // - SIGN_TRANSACTION: use per-request rpcCall (already normalized by caller).\n      // - SIGN_NEP413_MESSAGE: allow per-request override; fall back to PASSKEY_MANAGER_DEFAULT_CONFIGS.\n      if (request.type === SecureConfirmationType.SIGN_TRANSACTION) {\n        const payload = getSignTransactionPayload(request);\n        contractId = payload?.rpcCall?.contractId;\n        nearRpcUrl = payload?.rpcCall?.nearRpcUrl;\n      } else if (request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE) {\n        const payload = request.payload;\n        contractId = payload.contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId;\n        nearRpcUrl = payload.nearRpcUrl || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl;\n      }\n\n      await adapters.vrf.mintSessionKeysAndSendToSigner({\n        sessionId: request.requestId,\n        wrapKeySalt,\n        contractId,\n        nearRpcUrl,\n        credential: serializedCredential,\n      });\n\t    } catch (err) {\n\t      console.error('[SigningFlow] WrapKeySeed derivation failed:', err);\n\t      throw err; // Don't silently ignore - propagate the error\n\t    }\n\n    // 6) Respond; keep nonces reserved for worker to use\n    session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: true,\n      credential: serializedCredential,\n      // prfOutput intentionally omitted to keep signer PRF-free\n      // WrapKeySeed travels only over the dedicated VRF→Signer MessagePort; do not echo in the main-thread envelope\n      vrfChallenge: uiVrfChallenge,\n      transactionContext,\n    });\n  } catch (err: unknown) {\n    // Treat TouchID/FaceID cancellation and related errors as a negative decision\n    const cancelled = isUserCancelledSecureConfirm(err);\n    // For missing PRF outputs, surface the error to caller (defensive path tests expect a throw)\n    const msg = String((toError(err))?.message || err || '');\n    if (/Missing PRF result/i.test(msg) || /Missing PRF results/i.test(msg)) {\n      // Ensure UI is closed and nonces released, then rethrow\n      return session.cleanupAndRethrow(err);\n    }\n    if (cancelled) {\n      window.parent?.postMessage({ type: 'WALLET_UI_CLOSED' }, '*');\n    }\n    const isWrongPasskeyError = /multiple passkeys \\(devicenumbers\\) for account/i.test(msg);\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: cancelled\n        ? ERROR_MESSAGES.cancelled\n        : (isWrongPasskeyError ? msg : (msg || ERROR_MESSAGES.collectCredentialsFailed)),\n    });\n  }\n}\n"],"mappings":";;;;;;;AAyBA,SAAS,mBAAmB,SAAuD;AACjF,KAAI,QAAQ,SAAS,uBAAuB,iBAC1C,QAAO,0BAA0B,SAAS,mBAAmB;AAE/D,KAAI,QAAQ,SAAS,uBAAuB,oBAC1C,QAAO,QAAQ,QAAQ,mBAAmB;AAE5C,QAAO;;AAGT,eAAsB,6BACpB,KACA,SACA,QACA,MACe;CACf,MAAM,EAAE,oBAAoB,uBAAuB;CACnD,MAAM,WAAW,4BAA4B;CAC7C,MAAM,UAAU,qBAAqB;EACnC;EACA;EACA;EACA;EACA;;CAEF,MAAM,gBAAgB,iBAAiB;CACvC,MAAM,kBAAkB,mBAAmB;CAC3C,MAAM,aAAa,WAAW;CAC9B,MAAM,sBAAsB,QAAQ,SAAS,uBAAuB,mBAChE,gBAAgB,WAChB,QAAQ,SAAS,uBAAuB,sBACtC,MAAM,gCAAgC;EACtC;EACA,WAAW,QAAQ,QAAQ;EAC3B,SAAS,QAAQ,QAAQ;MAEzB;CACN,MAAM,wBAAwB,QAAQ,QAAQ;CAG9C,MAAM,UAAU,MAAM,SAAS,KAAK,iBAAiB;EAAE;EAAe,SAAS;EAAY,eAAe;;AAC1G,KAAI,CAAC,QAAQ,oBAAoB;AAE/B,UAAQ,MAAM,yCAAyC;GAAE,OAAO,QAAQ;GAAO,SAAS,QAAQ;;AAChG,SAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO,QAAQ,UAAU,GAAG,eAAe,cAAc,IAAI,QAAQ,YAAY,eAAe;;;AAGpG,SAAQ,kBAAkB,QAAQ;CAClC,IAAIA,qBAAyC,QAAQ;CAKrD,MAAM,OAAO,SAAS,IAAI;CAC1B,IAAIC;CACJ,IAAIC,sBAAyD,OACzD;EACE,QAAQ;EACR;EACA,aAAa,mBAAmB;EAChC,WAAW,mBAAmB;KAEhC;AAGJ,KAAI,oBAAoB,YAAY;AAClC,mBAAiB,MAAM,SAAS,IAAI,+BAClC;GACE,QAAQ;GACR;GACA,aAAa,mBAAmB;GAChC,WAAW,mBAAmB;GAC9B,GAAI,sBAAsB,EAAE,cAAc,wBAAwB;GAClE,GAAI,wBAAwB,EAAE,0BAA0B;KAE1D,QAAQ;AAEV,wBAAsB;;CAIxB,MAAM,EAAE,WAAW,OAAO,YAAY,MAAM,QAAQ,WAAW,EAAE,cAAc;AAC/E,KAAI,CAAC,UACH,QAAO,QAAQ,qBAAqB;EAClC,WAAW,QAAQ;EACnB,cAAc,gBAAgB;EAC9B,WAAW;EACX,OAAO;;AAKX,KAAI,oBAAoB,eAAe;AACrC,MAAI;AACF,SAAM,SAAS,IAAI,mBAAmB;IAAE,WAAW,QAAQ;IAAW,MAAM;;WACrEC,KAAc;GACrB,MAAM,MAAM,OAAQ,QAAQ,MAAO,WAAW,OAAO;AACrD,UAAO,QAAQ,qBAAqB;IAClC,WAAW,QAAQ;IACnB,cAAc,gBAAgB;IAC9B,WAAW;IACX,OAAO,OAAO;;;AAIlB,UAAQ,qBAAqB;GAC3B,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX;;AAEF;;AAIF,KAAI;EACF,MAAM,YAAY,MAAM,SAAS,IAAI,yBAAyB,SAAS;AACvE,mBAAiB,UAAU;AAC3B,uBAAqB,UAAU;AAC/B,UAAQ,SAAS,EAAE,cAAc;UAC1B,GAAG;AACV,UAAQ,MAAM,yCAAyC;;AAIzD,KAAI;AACF,MAAI,CAAC,eACH,OAAM,IAAI,MAAM;EAElB,MAAM,uBAAuB,MAAM,SAAS,SAAS,uCAAuC;GAC1F;GACA,cAAc;;EAKhB,IAAIC;EACJ,IAAIC;AACJ,MAAI;GAEF,MAAM,YAAY,MAAM,SAAS,IAAI;AACrC,OAAI,CAAC,UAAU,OACb,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,UAAU,iBAAiB,OAAO,UAAU,mBAAmB,OAAO,YAAY,gBACrF,OAAM,IAAI,MAAM;GAGlB,MAAM,eAAe,MAAM,4BAA4B,YAAY,gBAAgB,IAAI,UAAU;GACjG,MAAM,cAAc,MAAM,IAAI,UAAU,WAAW,oBAAoB,eAAe;AACtF,OAAI,CAAC,YACH,OAAM,IAAI,MAAM,qCAAqC,cAAc,UAAU;GAE/E,MAAM,cAAc,YAAY;AAChC,OAAI,CAAC,YACH,OAAM,IAAI,MAAM;AAMlB,OAAI,QAAQ,SAAS,uBAAuB,kBAAkB;IAC5D,MAAM,UAAU,0BAA0B;AAC1C,iBAAa,SAAS,SAAS;AAC/B,iBAAa,SAAS,SAAS;cACtB,QAAQ,SAAS,uBAAuB,qBAAqB;IACtE,MAAM,UAAU,QAAQ;AACxB,iBAAa,QAAQ,cAAc,gCAAgC;AACnE,iBAAa,QAAQ,cAAc,gCAAgC;;AAGrE,SAAM,SAAS,IAAI,+BAA+B;IAChD,WAAW,QAAQ;IACnB;IACA;IACA;IACA,YAAY;;WAEN,KAAK;AACZ,WAAQ,MAAM,gDAAgD;AAC9D,SAAM;;AAIT,UAAQ,qBAAqB;GAC3B,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,YAAY;GAGZ,cAAc;GACd;;UAEKF,KAAc;EAErB,MAAM,YAAY,6BAA6B;EAE/C,MAAM,MAAM,OAAQ,QAAQ,MAAO,WAAW,OAAO;AACrD,MAAI,sBAAsB,KAAK,QAAQ,uBAAuB,KAAK,KAEjE,QAAO,QAAQ,kBAAkB;AAEnC,MAAI,UACF,QAAO,QAAQ,YAAY,EAAE,MAAM,sBAAsB;EAE3D,MAAM,sBAAsB,mDAAmD,KAAK;AACpF,SAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO,YACH,eAAe,YACd,sBAAsB,MAAO,OAAO,eAAe"}

package/dist/esm/sdk/transactions-DAZrPW-6.js

@@ -0,0 +1,183 @@
+import "./css-loader-CAIkFQ3i.js";
+import "./validation-BTq6LGPp.js";
+import "./events-D2g80q67.js";
+import "./actions-fHadejPs.js";
+import "./signer-worker-DK847sXj.js";
+import "./base64-dqpWgddX.js";
+import "./vrf-worker-BzQsJ5BW.js";
+import { toAccountId } from "./accountIds-DVDhXwVA.js";
+import { computeUiIntentDigestFromNep413 } from "./intentDigest-yivVENNK.js";
+import "./tags-ByzxP7Cc.js";
+import "./lit-events-Bb4tAEO2.js";
+import "./tx-confirmer-wrapper-DWKpXTUW.js";
+import { toError } from "./errors-DevlT39D.js";
+import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from "./defaultConfigs-BmCU1_qI.js";
+import "./safari-fallbacks-BcMFntiP.js";
+import "./touchIdPrompt-JPhrOx8o.js";
+import { getLastLoggedInDeviceNumber } from "./getDeviceNumber-y3mMtky6.js";
+import { ERROR_MESSAGES, SecureConfirmationType, getIntentDigest, getNearAccountId, getSignTransactionPayload, getTxCount, isUserCancelledSecureConfirm } from "./collectAuthenticationCredentialForVrfChallenge-DqzPzwvU.js";
+import { createConfirmSession, createConfirmTxFlowAdapters } from "./createAdapters-1Hmc1vVC.js";
+
+//#region src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/flows/transactions.ts
+function getSigningAuthMode(request) {
+	if (request.type === SecureConfirmationType.SIGN_TRANSACTION) return getSignTransactionPayload(request).signingAuthMode ?? "webauthn";
+	if (request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE) return request.payload.signingAuthMode ?? "webauthn";
+	return "webauthn";
+}
+async function handleTransactionSigningFlow(ctx, request, worker, opts) {
+	const { confirmationConfig, transactionSummary } = opts;
+	const adapters = createConfirmTxFlowAdapters(ctx);
+	const session = createConfirmSession({
+		adapters,
+		worker,
+		request,
+		confirmationConfig,
+		transactionSummary
+	});
+	const nearAccountId = getNearAccountId(request);
+	const signingAuthMode = getSigningAuthMode(request);
+	const usesNeeded = getTxCount(request);
+	const vrfIntentDigestB64u = request.type === SecureConfirmationType.SIGN_TRANSACTION ? getIntentDigest(request) : request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE ? await computeUiIntentDigestFromNep413({
+		nearAccountId,
+		recipient: request.payload.recipient,
+		message: request.payload.message
+	}) : void 0;
+	const sessionPolicyDigest32 = request.payload.sessionPolicyDigest32;
+	const nearRpc = await adapters.near.fetchNearContext({
+		nearAccountId,
+		txCount: usesNeeded,
+		reserveNonces: true
+	});
+	if (!nearRpc.transactionContext) {
+		console.error("[SigningFlow] fetchNearContext failed", {
+			error: nearRpc.error,
+			details: nearRpc.details
+		});
+		return session.confirmAndCloseModal({
+			requestId: request.requestId,
+			intentDigest: getIntentDigest(request),
+			confirmed: false,
+			error: nearRpc.details ? `${ERROR_MESSAGES.nearRpcFailed}: ${nearRpc.details}` : ERROR_MESSAGES.nearRpcFailed
+		});
+	}
+	session.setReservedNonces(nearRpc.reservedNonces);
+	let transactionContext = nearRpc.transactionContext;
+	const rpId = adapters.vrf.getRpId();
+	let uiVrfChallenge;
+	let uiVrfChallengeForUi = rpId ? {
+		userId: nearAccountId,
+		rpId,
+		blockHeight: transactionContext.txBlockHeight,
+		blockHash: transactionContext.txBlockHash
+	} : void 0;
+	if (signingAuthMode === "webauthn") {
+		uiVrfChallenge = await adapters.vrf.generateVrfChallengeForSession({
+			userId: nearAccountId,
+			rpId,
+			blockHeight: transactionContext.txBlockHeight,
+			blockHash: transactionContext.txBlockHash,
+			...vrfIntentDigestB64u ? { intentDigest: vrfIntentDigestB64u } : {},
+			...sessionPolicyDigest32 ? { sessionPolicyDigest32 } : {}
+		}, request.requestId);
+		uiVrfChallengeForUi = uiVrfChallenge;
+	}
+	const { confirmed, error: uiError } = await session.promptUser({ vrfChallenge: uiVrfChallengeForUi });
+	if (!confirmed) return session.confirmAndCloseModal({
+		requestId: request.requestId,
+		intentDigest: getIntentDigest(request),
+		confirmed: false,
+		error: uiError
+	});
+	if (signingAuthMode === "warmSession") {
+		try {
+			await adapters.vrf.dispenseSessionKey({
+				sessionId: request.requestId,
+				uses: usesNeeded
+			});
+		} catch (err) {
+			const msg = String(toError(err)?.message || err || "");
+			return session.confirmAndCloseModal({
+				requestId: request.requestId,
+				intentDigest: getIntentDigest(request),
+				confirmed: false,
+				error: msg || "Failed to dispense warm session key"
+			});
+		}
+		session.confirmAndCloseModal({
+			requestId: request.requestId,
+			intentDigest: getIntentDigest(request),
+			confirmed: true,
+			transactionContext
+		});
+		return;
+	}
+	try {
+		const refreshed = await adapters.vrf.maybeRefreshVrfChallenge(request, nearAccountId);
+		uiVrfChallenge = refreshed.vrfChallenge;
+		transactionContext = refreshed.transactionContext;
+		session.updateUI({ vrfChallenge: uiVrfChallenge });
+	} catch (e) {
+		console.debug("[SigningFlow] VRF JIT refresh skipped", e);
+	}
+	try {
+		if (!uiVrfChallenge) throw new Error("Missing vrfChallenge for WebAuthn signing flow");
+		const serializedCredential = await adapters.webauthn.collectAuthenticationCredentialWithPRF({
+			nearAccountId,
+			vrfChallenge: uiVrfChallenge
+		});
+		let contractId;
+		let nearRpcUrl;
+		try {
+			const vrfStatus = await adapters.vrf.checkVrfStatus();
+			if (!vrfStatus.active) throw new Error("VRF keypair not active in memory. VRF session may have expired or was not properly initialized. Please refresh and try again.");
+			if (!vrfStatus.nearAccountId || String(vrfStatus.nearAccountId) !== String(toAccountId(nearAccountId))) throw new Error("VRF session is active but bound to a different account than the one being signed. Please log in again on this device.");
+			const deviceNumber = await getLastLoggedInDeviceNumber(toAccountId(nearAccountId), ctx.indexedDB.clientDB);
+			const keyMaterial = await ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber);
+			if (!keyMaterial) throw new Error(`No key material found for account ${nearAccountId} device ${deviceNumber}`);
+			const wrapKeySalt = keyMaterial.wrapKeySalt;
+			if (!wrapKeySalt) throw new Error("Missing wrapKeySalt in vault; re-register to upgrade vault format.");
+			if (request.type === SecureConfirmationType.SIGN_TRANSACTION) {
+				const payload = getSignTransactionPayload(request);
+				contractId = payload?.rpcCall?.contractId;
+				nearRpcUrl = payload?.rpcCall?.nearRpcUrl;
+			} else if (request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE) {
+				const payload = request.payload;
+				contractId = payload.contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId;
+				nearRpcUrl = payload.nearRpcUrl || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl;
+			}
+			await adapters.vrf.mintSessionKeysAndSendToSigner({
+				sessionId: request.requestId,
+				wrapKeySalt,
+				contractId,
+				nearRpcUrl,
+				credential: serializedCredential
+			});
+		} catch (err) {
+			console.error("[SigningFlow] WrapKeySeed derivation failed:", err);
+			throw err;
+		}
+		session.confirmAndCloseModal({
+			requestId: request.requestId,
+			intentDigest: getIntentDigest(request),
+			confirmed: true,
+			credential: serializedCredential,
+			vrfChallenge: uiVrfChallenge,
+			transactionContext
+		});
+	} catch (err) {
+		const cancelled = isUserCancelledSecureConfirm(err);
+		const msg = String(toError(err)?.message || err || "");
+		if (/Missing PRF result/i.test(msg) || /Missing PRF results/i.test(msg)) return session.cleanupAndRethrow(err);
+		if (cancelled) window.parent?.postMessage({ type: "WALLET_UI_CLOSED" }, "*");
+		const isWrongPasskeyError = /multiple passkeys \(devicenumbers\) for account/i.test(msg);
+		return session.confirmAndCloseModal({
+			requestId: request.requestId,
+			intentDigest: getIntentDigest(request),
+			confirmed: false,
+			error: cancelled ? ERROR_MESSAGES.cancelled : isWrongPasskeyError ? msg : msg || ERROR_MESSAGES.collectCredentialsFailed
+		});
+	}
+}
+
+//#endregion
+export { handleTransactionSigningFlow };