@tatchi-xyz/sdk 0.21.0 → 0.31.0

package/dist/esm/core/sdkPaths/workers.js.map

@@ -1 +1 @@
-{"version":3,"file":"workers.js","names":[],"sources":["../../../../src/core/sdkPaths/workers.ts"],"sourcesContent":["/**\n * Resolve the base origin for worker scripts.\n * Priority:\n * 1) window.__W3A_WALLET_SDK_BASE__ (absolute `${walletOrigin}${sdkBasePath}/`) → take its origin\n * 2) window.location.origin (host/app origin)\n *\n * @returns The origin (protocol + host [+ port]) used to resolve worker script URLs.\n *          Prefers the wallet SDK base origin; falls back to the current window origin.\n */\nexport function resolveWorkerBaseOrigin(): string {\n  let origin = ''\n  if (typeof window !== 'undefined' && window.location?.origin) {\n    origin = window.location.origin\n  }\n  try {\n    const embeddedBase = (window as any)?.__W3A_WALLET_SDK_BASE__ as string | undefined\n    if (embeddedBase) {\n      origin = new URL(embeddedBase, origin || 'https://invalid.local').origin\n    }\n  } catch {}\n  return origin\n}\n\n/**\n * Build an absolute worker script URL from a path or absolute URL.\n * If `input` is a path (e.g., `/sdk/workers/foo.js`), it will be resolved\n * against the wallet origin (from `__W3A_WALLET_SDK_BASE__`) when available,\n * otherwise against the host origin.\n *\n * @param input - Absolute URL or path (e.g., `/sdk/workers/web3authn-signer.worker.js`).\n * @returns Absolute URL to the worker script, resolved against the wallet origin when available,\n *          otherwise against the current window origin.\n */\nexport function resolveWorkerScriptUrl(input: string): string {\n  return resolveWorkerUrl(input, { worker: detectWorkerFromPath(input) })\n}\n\nexport function resolveWorkerUrl(\n  input: string | undefined,\n  opts: { worker: 'signer' | 'vrf'; baseOrigin?: string }\n): string {\n  const worker = opts.worker\n  const baseOrigin = opts.baseOrigin || resolveWorkerBaseOrigin() || (typeof window !== 'undefined' ? window.location.origin : '') || 'https://invalid.local'\n  try {\n    // Prefer explicit per-worker URL override\n    const ovAny = (typeof window !== 'undefined' ? (window as any) : {}) as any\n    const override = worker === 'signer' ? ovAny.__W3A_SIGNER_WORKER_URL__ : ovAny.__W3A_VRF_WORKER_URL__\n    const candidate = (typeof override === 'string' && override) ? override : (input || defaultWorkerPath(worker))\n    if (/^https?:\\/\\//i.test(candidate)) {\n      return new URL(candidate).toString()\n    }\n    return new URL(candidate, baseOrigin).toString()\n  } catch {\n    try { return new URL(input || defaultWorkerPath(worker), baseOrigin).toString() } catch {}\n    return input || defaultWorkerPath(worker)\n  }\n}\n\nfunction detectWorkerFromPath(p: string): 'signer' | 'vrf' {\n  return /web3authn-signer\\.worker\\.js(?:$|\\?)/.test(p) ? 'signer' : 'vrf'\n}\n\nfunction defaultWorkerPath(worker: 'signer' | 'vrf'): string {\n  return worker === 'signer' ? '/sdk/workers/web3authn-signer.worker.js' : '/sdk/workers/web3authn-vrf.worker.js'\n}\n"],"mappings":";;;;;;;;;;AASA,SAAgB,0BAAkC;CAChD,IAAI,SAAS;AACb,KAAI,OAAO,WAAW,eAAe,OAAO,UAAU,OACpD,UAAS,OAAO,SAAS;AAE3B,KAAI;EACF,MAAM,eAAgB,QAAgB;AACtC,MAAI,aACF,UAAS,IAAI,IAAI,cAAc,UAAU,yBAAyB;SAE9D;AACR,QAAO;;AAiBT,SAAgB,iBACd,OACA,MACQ;CACR,MAAM,SAAS,KAAK;CACpB,MAAM,aAAa,KAAK,cAAc,8BAA8B,OAAO,WAAW,cAAc,OAAO,SAAS,SAAS,OAAO;AACpI,KAAI;EAEF,MAAM,QAAS,OAAO,WAAW,cAAe,SAAiB;EACjE,MAAM,WAAW,WAAW,WAAW,MAAM,4BAA4B,MAAM;EAC/E,MAAM,YAAa,OAAO,aAAa,YAAY,WAAY,WAAY,SAAS,kBAAkB;AACtG,MAAI,gBAAgB,KAAK,WACvB,QAAO,IAAI,IAAI,WAAW;AAE5B,SAAO,IAAI,IAAI,WAAW,YAAY;SAChC;AACN,MAAI;AAAE,UAAO,IAAI,IAAI,SAAS,kBAAkB,SAAS,YAAY;UAAmB;AACxF,SAAO,SAAS,kBAAkB;;;AAQtC,SAAS,kBAAkB,QAAkC;AAC3D,QAAO,WAAW,WAAW,4CAA4C"}
+{"version":3,"file":"workers.js","names":[],"sources":["../../../../src/core/sdkPaths/workers.ts"],"sourcesContent":["/**\n * Resolve the base origin for worker scripts.\n * Priority:\n * 1) window.__W3A_WALLET_SDK_BASE__ (absolute `${walletOrigin}${sdkBasePath}/`) → take its origin (only if same-origin)\n * 2) window.location.origin (host/app origin)\n *\n * @returns The origin (protocol + host [+ port]) used to resolve worker script URLs.\n *          Prefers the wallet SDK base origin; falls back to the current window origin.\n */\nexport function resolveWorkerBaseOrigin(): string {\n  const currentOrigin =\n    (typeof window !== 'undefined' && window.location?.origin)\n      ? window.location.origin\n      : '';\n\n  // Only allow worker scripts to resolve from the embedded base when it matches\n  // the current origin. Cross-origin worker scripts are not reliably loadable\n  // across browsers (even for module workers) and will fail with CORS errors.\n  try {\n    const embeddedBase = (window as any)?.__W3A_WALLET_SDK_BASE__ as string | undefined;\n    if (embeddedBase) {\n      const embeddedOrigin = new URL(embeddedBase, currentOrigin || 'https://invalid.local').origin;\n      if (embeddedOrigin === currentOrigin) {\n        return embeddedOrigin;\n      }\n    }\n  } catch {}\n\n  return currentOrigin;\n}\n\n/**\n * Build an absolute worker script URL from a path or absolute URL.\n * If `input` is a path (e.g., `/sdk/workers/foo.js`), it will be resolved\n * against the wallet origin (from `__W3A_WALLET_SDK_BASE__`) when available,\n * otherwise against the host origin.\n *\n * @param input - Absolute URL or path (e.g., `/sdk/workers/web3authn-signer.worker.js`).\n * @returns Absolute URL to the worker script, resolved against the wallet origin when available,\n *          otherwise against the current window origin.\n */\nexport function resolveWorkerScriptUrl(input: string): string {\n  return resolveWorkerUrl(input, { worker: detectWorkerFromPath(input) })\n}\n\nexport function resolveWorkerUrl(\n  input: string | undefined,\n  opts: { worker: 'signer' | 'vrf'; baseOrigin?: string }\n): string {\n  const worker = opts.worker\n  const baseOrigin = opts.baseOrigin || resolveWorkerBaseOrigin() || (typeof window !== 'undefined' ? window.location.origin : '') || 'https://invalid.local'\n  try {\n    // Prefer explicit per-worker URL override\n    const ovAny = (typeof window !== 'undefined' ? (window as any) : {}) as any\n    const override = worker === 'signer' ? ovAny.__W3A_SIGNER_WORKER_URL__ : ovAny.__W3A_VRF_WORKER_URL__\n    const candidate = (typeof override === 'string' && override) ? override : (input || defaultWorkerPath(worker))\n    if (/^https?:\\/\\//i.test(candidate)) {\n      return new URL(candidate).toString()\n    }\n    return new URL(candidate, baseOrigin).toString()\n  } catch {\n    try { return new URL(input || defaultWorkerPath(worker), baseOrigin).toString() } catch {}\n    return input || defaultWorkerPath(worker)\n  }\n}\n\nfunction detectWorkerFromPath(p: string): 'signer' | 'vrf' {\n  return /web3authn-signer\\.worker\\.js(?:$|\\?)/.test(p) ? 'signer' : 'vrf'\n}\n\nfunction defaultWorkerPath(worker: 'signer' | 'vrf'): string {\n  return worker === 'signer' ? '/sdk/workers/web3authn-signer.worker.js' : '/sdk/workers/web3authn-vrf.worker.js'\n}\n"],"mappings":";;;;;;;;;;AASA,SAAgB,0BAAkC;CAChD,MAAM,gBACH,OAAO,WAAW,eAAe,OAAO,UAAU,SAC/C,OAAO,SAAS,SAChB;AAKN,KAAI;EACF,MAAM,eAAgB,QAAgB;AACtC,MAAI,cAAc;GAChB,MAAM,iBAAiB,IAAI,IAAI,cAAc,iBAAiB,yBAAyB;AACvF,OAAI,mBAAmB,cACrB,QAAO;;SAGL;AAER,QAAO;;AAiBT,SAAgB,iBACd,OACA,MACQ;CACR,MAAM,SAAS,KAAK;CACpB,MAAM,aAAa,KAAK,cAAc,8BAA8B,OAAO,WAAW,cAAc,OAAO,SAAS,SAAS,OAAO;AACpI,KAAI;EAEF,MAAM,QAAS,OAAO,WAAW,cAAe,SAAiB;EACjE,MAAM,WAAW,WAAW,WAAW,MAAM,4BAA4B,MAAM;EAC/E,MAAM,YAAa,OAAO,aAAa,YAAY,WAAY,WAAY,SAAS,kBAAkB;AACtG,MAAI,gBAAgB,KAAK,WACvB,QAAO,IAAI,IAAI,WAAW;AAE5B,SAAO,IAAI,IAAI,WAAW,YAAY;SAChC;AACN,MAAI;AAAE,UAAO,IAAI,IAAI,SAAS,kBAAkB,SAAS,YAAY;UAAmB;AACxF,SAAO,SAAS,kBAAkB;;;AAQtC,SAAS,kBAAkB,QAAkC;AAC3D,QAAO,WAAW,WAAW,4CAA4C"}

package/dist/esm/core/threshold/thresholdEd25519AuthSession.js

@@ -0,0 +1,140 @@
+import { stripTrailingSlashes, toTrimmedString } from "../../utils/validation.js";
+import { base64UrlDecode } from "../../utils/base64.js";
+import { normalizeThresholdEd25519ParticipantIds } from "../../threshold/participants.js";
+import { removePrfOutputGuard } from "../WebAuthnManager/credentialsHelpers.js";
+
+//#region src/core/threshold/thresholdEd25519AuthSession.ts
+const authSessionCache = /* @__PURE__ */ new Map();
+function makeThresholdEd25519AuthSessionCacheKey(args) {
+	const relayerUrl = stripTrailingSlashes(toTrimmedString(args.relayerUrl));
+	const participantIds = normalizeThresholdEd25519ParticipantIds(args.participantIds);
+	return [
+		String(args.nearAccountId || "").trim(),
+		String(args.rpId || "").trim(),
+		relayerUrl,
+		String(args.relayerKeyId || "").trim(),
+		...participantIds ? [participantIds.join(",")] : []
+	].join("|");
+}
+function getCachedThresholdEd25519AuthSession(cacheKey) {
+	const entry = authSessionCache.get(cacheKey);
+	if (!entry) return null;
+	if (typeof entry.expiresAtMs === "number" && Number.isFinite(entry.expiresAtMs) && Date.now() >= entry.expiresAtMs) {
+		authSessionCache.delete(cacheKey);
+		return null;
+	}
+	return entry;
+}
+function putCachedThresholdEd25519AuthSession(cacheKey, entry) {
+	authSessionCache.set(cacheKey, entry);
+}
+function clearCachedThresholdEd25519AuthSession(cacheKey) {
+	authSessionCache.delete(cacheKey);
+}
+function clearAllCachedThresholdEd25519AuthSessions() {
+	authSessionCache.clear();
+}
+function getCachedThresholdEd25519AuthSessionJwt(cacheKey) {
+	const cached = getCachedThresholdEd25519AuthSession(cacheKey);
+	const jwt = cached?.jwt;
+	if (typeof jwt === "string") {
+		const trimmed = jwt.trim();
+		if (trimmed) return trimmed;
+	}
+	if (cached) clearCachedThresholdEd25519AuthSession(cacheKey);
+	return void 0;
+}
+async function mintThresholdEd25519AuthSession(args) {
+	const relayerUrl = stripTrailingSlashes(toTrimmedString(args.relayerUrl));
+	if (!relayerUrl) return {
+		ok: false,
+		code: "invalid_args",
+		message: "Missing relayerUrl for threshold session mint"
+	};
+	if (typeof fetch !== "function") return {
+		ok: false,
+		code: "unsupported",
+		message: "fetch is not available for threshold session mint"
+	};
+	const toBytes = (b64u) => {
+		if (!b64u) return [];
+		return Array.from(base64UrlDecode(b64u));
+	};
+	const intent_digest_32 = toBytes(args.vrfChallenge.intentDigest);
+	if (intent_digest_32.length !== 32) return {
+		ok: false,
+		code: "invalid_args",
+		message: "Missing or invalid vrfChallenge.intentDigest (expected base64url 32 bytes)"
+	};
+	const clientVerifyingShareBytes = toBytes(args.clientVerifyingShareB64u);
+	if (clientVerifyingShareBytes.length !== 32) return {
+		ok: false,
+		code: "invalid_args",
+		message: "Missing or invalid clientVerifyingShareB64u (expected base64url 32 bytes)"
+	};
+	const session_policy_digest_32 = toBytes(args.vrfChallenge.sessionPolicyDigest32);
+	if (session_policy_digest_32.length !== 32) return {
+		ok: false,
+		code: "invalid_args",
+		message: "Missing vrfChallenge.sessionPolicyDigest32 (expected base64url 32 bytes) for threshold session mint"
+	};
+	const vrf_data = {
+		vrf_input_data: toBytes(args.vrfChallenge.vrfInput),
+		vrf_output: toBytes(args.vrfChallenge.vrfOutput),
+		vrf_proof: toBytes(args.vrfChallenge.vrfProof),
+		public_key: toBytes(args.vrfChallenge.vrfPublicKey),
+		user_id: args.vrfChallenge.userId,
+		rp_id: args.vrfChallenge.rpId,
+		block_height: Number(args.vrfChallenge.blockHeight || 0),
+		block_hash: toBytes(args.vrfChallenge.blockHash),
+		intent_digest_32,
+		session_policy_digest_32
+	};
+	const webauthn_authentication = removePrfOutputGuard(args.webauthnAuthentication);
+	try {
+		const url = `${relayerUrl}/threshold-ed25519/session`;
+		const response = await fetch(url, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			credentials: args.sessionKind === "cookie" ? "include" : "omit",
+			body: JSON.stringify({
+				sessionKind: args.sessionKind,
+				relayerKeyId: args.relayerKeyId,
+				clientVerifyingShareB64u: args.clientVerifyingShareB64u,
+				sessionPolicy: args.sessionPolicy,
+				vrf_data,
+				webauthn_authentication
+			})
+		});
+		const data = await response.json().catch(() => ({}));
+		if (!response.ok) return {
+			ok: false,
+			code: data.code || "http_error",
+			message: data.message || `HTTP ${response.status}`
+		};
+		const expiresAtMs = (() => {
+			const raw = data.expiresAt ? Date.parse(data.expiresAt) : NaN;
+			return Number.isFinite(raw) ? raw : void 0;
+		})();
+		return {
+			ok: data.ok === true,
+			sessionId: data.sessionId,
+			expiresAtMs,
+			remainingUses: data.remainingUses,
+			jwt: data.jwt,
+			...data.code ? { code: data.code } : {},
+			...data.message ? { message: data.message } : {}
+		};
+	} catch (e) {
+		const msg = String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to mint threshold session");
+		return {
+			ok: false,
+			code: "network_error",
+			message: msg
+		};
+	}
+}
+
+//#endregion
+export { clearAllCachedThresholdEd25519AuthSessions, clearCachedThresholdEd25519AuthSession, getCachedThresholdEd25519AuthSessionJwt, makeThresholdEd25519AuthSessionCacheKey, mintThresholdEd25519AuthSession, putCachedThresholdEd25519AuthSession };
+//# sourceMappingURL=thresholdEd25519AuthSession.js.map

package/dist/esm/core/threshold/thresholdEd25519AuthSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"thresholdEd25519AuthSession.js","names":["e: unknown"],"sources":["../../../../src/core/threshold/thresholdEd25519AuthSession.ts"],"sourcesContent":["import { base64UrlDecode } from '@/utils/encoders';\nimport { stripTrailingSlashes, toTrimmedString } from '@/utils/validation';\nimport { removePrfOutputGuard } from '../WebAuthnManager/credentialsHelpers';\nimport type { VRFChallenge } from '../types/vrf-worker';\nimport type { ThresholdEd25519SessionPolicy } from './thresholdSessionPolicy';\nimport type { WebAuthnAuthenticationCredential } from '../types/webauthn';\nimport { normalizeThresholdEd25519ParticipantIds } from '../../threshold/participants';\n\nexport type ThresholdEd25519SessionKind = 'jwt' | 'cookie';\n\nexport type ThresholdEd25519AuthSession = {\n  sessionKind: ThresholdEd25519SessionKind;\n  policy: ThresholdEd25519SessionPolicy;\n  policyJson: string;\n  sessionPolicyDigest32: string;\n  jwt?: string;\n  expiresAtMs?: number;\n};\n\ntype ThresholdEd25519AuthSessionCacheEntry = ThresholdEd25519AuthSession;\n\nconst authSessionCache = new Map<string, ThresholdEd25519AuthSessionCacheEntry>();\n\nexport function makeThresholdEd25519AuthSessionCacheKey(args: {\n  nearAccountId: string;\n  rpId: string;\n  relayerUrl: string;\n  relayerKeyId: string;\n  participantIds?: number[];\n}): string {\n  const relayerUrl = stripTrailingSlashes(toTrimmedString(args.relayerUrl));\n  const participantIds = normalizeThresholdEd25519ParticipantIds(args.participantIds);\n  return [\n    String(args.nearAccountId || '').trim(),\n    String(args.rpId || '').trim(),\n    relayerUrl,\n    String(args.relayerKeyId || '').trim(),\n    ...(participantIds ? [participantIds.join(',')] : []),\n  ].join('|');\n}\n\nexport function getCachedThresholdEd25519AuthSession(cacheKey: string): ThresholdEd25519AuthSession | null {\n  const entry = authSessionCache.get(cacheKey);\n  if (!entry) return null;\n\n  if (typeof entry.expiresAtMs === 'number' && Number.isFinite(entry.expiresAtMs) && Date.now() >= entry.expiresAtMs) {\n    authSessionCache.delete(cacheKey);\n    return null;\n  }\n\n  return entry;\n}\n\nexport function putCachedThresholdEd25519AuthSession(cacheKey: string, entry: ThresholdEd25519AuthSession): void {\n  authSessionCache.set(cacheKey, entry);\n}\n\nexport function clearCachedThresholdEd25519AuthSession(cacheKey: string): void {\n  authSessionCache.delete(cacheKey);\n}\n\nexport function clearAllCachedThresholdEd25519AuthSessions(): void {\n  authSessionCache.clear();\n}\n\nexport function getCachedThresholdEd25519AuthSessionJwt(cacheKey: string): string | undefined {\n  const cached = getCachedThresholdEd25519AuthSession(cacheKey);\n  const jwt = cached?.jwt;\n  if (typeof jwt === 'string') {\n    const trimmed = jwt.trim();\n    if (trimmed) return trimmed;\n  }\n  if (cached) clearCachedThresholdEd25519AuthSession(cacheKey);\n  return undefined;\n}\n\nexport async function mintThresholdEd25519AuthSession(args: {\n  relayerUrl: string;\n  sessionKind: ThresholdEd25519SessionKind;\n  relayerKeyId: string;\n  clientVerifyingShareB64u: string;\n  sessionPolicy: ThresholdEd25519SessionPolicy;\n  vrfChallenge: VRFChallenge;\n  webauthnAuthentication: WebAuthnAuthenticationCredential;\n}): Promise<{\n  ok: boolean;\n  sessionId?: string;\n  expiresAtMs?: number;\n  remainingUses?: number;\n  jwt?: string;\n  code?: string;\n  message?: string;\n}> {\n  const relayerUrl = stripTrailingSlashes(toTrimmedString(args.relayerUrl));\n  if (!relayerUrl) {\n    return { ok: false, code: 'invalid_args', message: 'Missing relayerUrl for threshold session mint' };\n  }\n\n  if (typeof fetch !== 'function') {\n    return { ok: false, code: 'unsupported', message: 'fetch is not available for threshold session mint' };\n  }\n\n  const toBytes = (b64u: string | undefined): number[] => {\n    if (!b64u) return [];\n    return Array.from(base64UrlDecode(b64u));\n  };\n\n  const intent_digest_32 = toBytes(args.vrfChallenge.intentDigest);\n  if (intent_digest_32.length !== 32) {\n    return { ok: false, code: 'invalid_args', message: 'Missing or invalid vrfChallenge.intentDigest (expected base64url 32 bytes)' };\n  }\n\n  const clientVerifyingShareBytes = toBytes(args.clientVerifyingShareB64u);\n  if (clientVerifyingShareBytes.length !== 32) {\n    return { ok: false, code: 'invalid_args', message: 'Missing or invalid clientVerifyingShareB64u (expected base64url 32 bytes)' };\n  }\n\n  const session_policy_digest_32 = toBytes(args.vrfChallenge.sessionPolicyDigest32);\n  if (session_policy_digest_32.length !== 32) {\n    return { ok: false, code: 'invalid_args', message: 'Missing vrfChallenge.sessionPolicyDigest32 (expected base64url 32 bytes) for threshold session mint' };\n  }\n\n  const vrf_data = {\n    vrf_input_data: toBytes(args.vrfChallenge.vrfInput),\n    vrf_output: toBytes(args.vrfChallenge.vrfOutput),\n    vrf_proof: toBytes(args.vrfChallenge.vrfProof),\n    public_key: toBytes(args.vrfChallenge.vrfPublicKey),\n    user_id: args.vrfChallenge.userId,\n    rp_id: args.vrfChallenge.rpId,\n    block_height: Number(args.vrfChallenge.blockHeight || 0),\n    block_hash: toBytes(args.vrfChallenge.blockHash),\n    intent_digest_32,\n    session_policy_digest_32,\n  };\n\n  // Never send PRF outputs to the relay.\n  const webauthn_authentication = removePrfOutputGuard(args.webauthnAuthentication);\n\n  type ThresholdEd25519SessionMintResponseBody = Partial<{\n    ok: boolean;\n    sessionId: string;\n    expiresAt: string;\n    remainingUses: number;\n    jwt: string;\n    code: string;\n    message: string;\n  }>;\n\n  try {\n    const url = `${relayerUrl}/threshold-ed25519/session`;\n    const response = await fetch(url, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      credentials: args.sessionKind === 'cookie' ? 'include' : 'omit',\n      body: JSON.stringify({\n        sessionKind: args.sessionKind,\n        relayerKeyId: args.relayerKeyId,\n        clientVerifyingShareB64u: args.clientVerifyingShareB64u,\n        sessionPolicy: args.sessionPolicy,\n        vrf_data,\n        webauthn_authentication,\n      }),\n    });\n\n    const data = (await response.json().catch(() => ({}))) as ThresholdEd25519SessionMintResponseBody;\n    if (!response.ok) {\n      return {\n        ok: false,\n        code: data.code || 'http_error',\n        message: data.message || `HTTP ${response.status}`,\n      };\n    }\n\n    const expiresAtMs = (() => {\n      const raw = data.expiresAt ? Date.parse(data.expiresAt) : NaN;\n      return Number.isFinite(raw) ? raw : undefined;\n    })();\n\n    return {\n      ok: data.ok === true,\n      sessionId: data.sessionId,\n      expiresAtMs,\n      remainingUses: data.remainingUses,\n      jwt: data.jwt,\n      ...(data.code ? { code: data.code } : {}),\n      ...(data.message ? { message: data.message } : {}),\n    };\n  } catch (e: unknown) {\n    const msg = String((e && typeof e === 'object' && 'message' in e) ? (e as { message?: unknown }).message : e || 'Failed to mint threshold session');\n    return { ok: false, code: 'network_error', message: msg };\n  }\n}\n"],"mappings":";;;;;;AAqBA,MAAM,mCAAmB,IAAI;AAE7B,SAAgB,wCAAwC,MAM7C;CACT,MAAM,aAAa,qBAAqB,gBAAgB,KAAK;CAC7D,MAAM,iBAAiB,wCAAwC,KAAK;AACpE,QAAO;EACL,OAAO,KAAK,iBAAiB,IAAI;EACjC,OAAO,KAAK,QAAQ,IAAI;EACxB;EACA,OAAO,KAAK,gBAAgB,IAAI;EAChC,GAAI,iBAAiB,CAAC,eAAe,KAAK,QAAQ;GAClD,KAAK;;AAGT,SAAgB,qCAAqC,UAAsD;CACzG,MAAM,QAAQ,iBAAiB,IAAI;AACnC,KAAI,CAAC,MAAO,QAAO;AAEnB,KAAI,OAAO,MAAM,gBAAgB,YAAY,OAAO,SAAS,MAAM,gBAAgB,KAAK,SAAS,MAAM,aAAa;AAClH,mBAAiB,OAAO;AACxB,SAAO;;AAGT,QAAO;;AAGT,SAAgB,qCAAqC,UAAkB,OAA0C;AAC/G,kBAAiB,IAAI,UAAU;;AAGjC,SAAgB,uCAAuC,UAAwB;AAC7E,kBAAiB,OAAO;;AAG1B,SAAgB,6CAAmD;AACjE,kBAAiB;;AAGnB,SAAgB,wCAAwC,UAAsC;CAC5F,MAAM,SAAS,qCAAqC;CACpD,MAAM,MAAM,QAAQ;AACpB,KAAI,OAAO,QAAQ,UAAU;EAC3B,MAAM,UAAU,IAAI;AACpB,MAAI,QAAS,QAAO;;AAEtB,KAAI,OAAQ,wCAAuC;AACnD,QAAO;;AAGT,eAAsB,gCAAgC,MAgBnD;CACD,MAAM,aAAa,qBAAqB,gBAAgB,KAAK;AAC7D,KAAI,CAAC,WACH,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;AAGrD,KAAI,OAAO,UAAU,WACnB,QAAO;EAAE,IAAI;EAAO,MAAM;EAAe,SAAS;;CAGpD,MAAM,WAAW,SAAuC;AACtD,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,MAAM,KAAK,gBAAgB;;CAGpC,MAAM,mBAAmB,QAAQ,KAAK,aAAa;AACnD,KAAI,iBAAiB,WAAW,GAC9B,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;CAGrD,MAAM,4BAA4B,QAAQ,KAAK;AAC/C,KAAI,0BAA0B,WAAW,GACvC,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;CAGrD,MAAM,2BAA2B,QAAQ,KAAK,aAAa;AAC3D,KAAI,yBAAyB,WAAW,GACtC,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;CAGrD,MAAM,WAAW;EACf,gBAAgB,QAAQ,KAAK,aAAa;EAC1C,YAAY,QAAQ,KAAK,aAAa;EACtC,WAAW,QAAQ,KAAK,aAAa;EACrC,YAAY,QAAQ,KAAK,aAAa;EACtC,SAAS,KAAK,aAAa;EAC3B,OAAO,KAAK,aAAa;EACzB,cAAc,OAAO,KAAK,aAAa,eAAe;EACtD,YAAY,QAAQ,KAAK,aAAa;EACtC;EACA;;CAIF,MAAM,0BAA0B,qBAAqB,KAAK;AAY1D,KAAI;EACF,MAAM,MAAM,GAAG,WAAW;EAC1B,MAAM,WAAW,MAAM,MAAM,KAAK;GAChC,QAAQ;GACR,SAAS,EAAE,gBAAgB;GAC3B,aAAa,KAAK,gBAAgB,WAAW,YAAY;GACzD,MAAM,KAAK,UAAU;IACnB,aAAa,KAAK;IAClB,cAAc,KAAK;IACnB,0BAA0B,KAAK;IAC/B,eAAe,KAAK;IACpB;IACA;;;EAIJ,MAAM,OAAQ,MAAM,SAAS,OAAO,aAAa;AACjD,MAAI,CAAC,SAAS,GACZ,QAAO;GACL,IAAI;GACJ,MAAM,KAAK,QAAQ;GACnB,SAAS,KAAK,WAAW,QAAQ,SAAS;;EAI9C,MAAM,qBAAqB;GACzB,MAAM,MAAM,KAAK,YAAY,KAAK,MAAM,KAAK,aAAa;AAC1D,UAAO,OAAO,SAAS,OAAO,MAAM;;AAGtC,SAAO;GACL,IAAI,KAAK,OAAO;GAChB,WAAW,KAAK;GAChB;GACA,eAAe,KAAK;GACpB,KAAK,KAAK;GACV,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,SAAS;GACtC,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,YAAY;;UAE1CA,GAAY;EACnB,MAAM,MAAM,OAAQ,KAAK,OAAO,MAAM,YAAY,aAAa,IAAM,EAA4B,UAAU,KAAK;AAChH,SAAO;GAAE,IAAI;GAAO,MAAM;GAAiB,SAAS"}

package/dist/esm/core/threshold/thresholdEd25519RelayerHealth.js

@@ -0,0 +1,117 @@
+import { stripTrailingSlashes, toTrimmedString } from "../../utils/validation.js";
+import { DEFAULT_THRESHOLD_BEHAVIOR, getThresholdBehaviorFromSignerMode } from "../types/signer-worker.js";
+
+//#region src/core/threshold/thresholdEd25519RelayerHealth.ts
+const DEFAULT_CACHE_TTL_MS = 6e4;
+const cache = /* @__PURE__ */ new Map();
+const inFlight = /* @__PURE__ */ new Map();
+const DEFAULT_WARN_TTL_MS = 10 * 6e4;
+const MAX_WARN_KEYS = 1e3;
+const warnedUnsupportedRelayerByKey = /* @__PURE__ */ new Map();
+async function isRelayerThresholdEd25519ConfiguredBase(base, opts) {
+	if (!base) return false;
+	if (typeof fetch !== "function") return false;
+	const ttlMs = Math.max(0, Number(opts?.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS));
+	const now = Date.now();
+	const cached = cache.get(base);
+	if (cached && cached.expiresAtMs > now) return cached.configured;
+	const existing = inFlight.get(base);
+	if (existing) return existing;
+	const req = (async () => {
+		try {
+			const res = await fetch(`${base}/threshold-ed25519/healthz`, { method: "GET" });
+			if (!res.ok) {
+				cache.set(base, {
+					configured: false,
+					expiresAtMs: now + ttlMs
+				});
+				return false;
+			}
+			const data = await res.json().catch(() => null);
+			const configured = data?.configured === true;
+			cache.set(base, {
+				configured,
+				expiresAtMs: now + ttlMs
+			});
+			return configured;
+		} catch {
+			cache.set(base, {
+				configured: false,
+				expiresAtMs: now + ttlMs
+			});
+			return false;
+		} finally {
+			inFlight.delete(base);
+		}
+	})();
+	inFlight.set(base, req);
+	return req;
+}
+function coerceThresholdBehavior(input) {
+	return input === "fallback" || input === "strict" ? input : DEFAULT_THRESHOLD_BEHAVIOR;
+}
+function pruneWarned(nowMs) {
+	if (warnedUnsupportedRelayerByKey.size <= MAX_WARN_KEYS) return;
+	for (const [key, expiresAtMs] of warnedUnsupportedRelayerByKey.entries()) if (expiresAtMs <= nowMs) warnedUnsupportedRelayerByKey.delete(key);
+	while (warnedUnsupportedRelayerByKey.size > MAX_WARN_KEYS) {
+		const first = warnedUnsupportedRelayerByKey.keys().next().value;
+		if (!first) break;
+		warnedUnsupportedRelayerByKey.delete(first);
+	}
+}
+function warnOnce(key, message, opts) {
+	const nowMs = Date.now();
+	const ttlMs = Math.max(0, Math.floor(opts?.warnTtlMs ?? DEFAULT_WARN_TTL_MS));
+	if (ttlMs === 0) return;
+	pruneWarned(nowMs);
+	const existing = warnedUnsupportedRelayerByKey.get(key);
+	if (existing && existing > nowMs) return;
+	warnedUnsupportedRelayerByKey.set(key, nowMs + ttlMs);
+	console.warn(message);
+	opts?.warnings?.push(message);
+}
+async function fallbackToLocalSignerIfRelayerUnsupported(args) {
+	const requested = args.signerMode.mode;
+	if (requested !== "threshold-signer") return requested;
+	const base = stripTrailingSlashes(toTrimmedString(args.relayerUrl));
+	const behavior = coerceThresholdBehavior(getThresholdBehaviorFromSignerMode(args.signerMode));
+	const configured = await isRelayerThresholdEd25519ConfiguredBase(base, { cacheTtlMs: args.cacheTtlMs });
+	if (configured) return requested;
+	const msg = "[WebAuthnManager] signerMode=threshold-signer requested but the relayer does not support threshold signing";
+	if (behavior === "fallback") {
+		warnOnce(`${args.nearAccountId}|${base}`, `${msg}; falling back to local-signer`, {
+			warnTtlMs: args.warnTtlMs,
+			warnings: args.warnings
+		});
+		return "local-signer";
+	}
+	throw new Error(`${msg}; set signerMode={ mode: 'threshold-signer', behavior: 'fallback' } to allow local-signer fallback`);
+}
+async function resolveSignerModeForThresholdSigning(args) {
+	const requested = args.signerMode.mode;
+	if (requested !== "threshold-signer") return requested;
+	const behavior = coerceThresholdBehavior(getThresholdBehaviorFromSignerMode(args.signerMode));
+	if (!args.hasThresholdKeyMaterial) {
+		const msg = "[WebAuthnManager] signerMode=threshold-signer requested but threshold key material is unavailable";
+		if (behavior === "fallback") {
+			warnOnce(`${args.nearAccountId}|threshold-key-material-missing`, `${msg}; falling back to local-signer`, {
+				warnTtlMs: args.warnTtlMs,
+				warnings: args.warnings
+			});
+			return "local-signer";
+		}
+		throw new Error(`${msg}; set signerMode={ mode: 'threshold-signer', behavior: 'fallback' } to allow local-signer fallback`);
+	}
+	return fallbackToLocalSignerIfRelayerUnsupported({
+		nearAccountId: args.nearAccountId,
+		signerMode: args.signerMode,
+		relayerUrl: args.relayerUrl,
+		warnings: args.warnings,
+		cacheTtlMs: args.cacheTtlMs,
+		warnTtlMs: args.warnTtlMs
+	});
+}
+
+//#endregion
+export { resolveSignerModeForThresholdSigning };
+//# sourceMappingURL=thresholdEd25519RelayerHealth.js.map

package/dist/esm/core/threshold/thresholdEd25519RelayerHealth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"thresholdEd25519RelayerHealth.js","names":[],"sources":["../../../../src/core/threshold/thresholdEd25519RelayerHealth.ts"],"sourcesContent":["import type { SignerMode, ThresholdBehavior } from '../types/signer-worker';\nimport { DEFAULT_THRESHOLD_BEHAVIOR, getThresholdBehaviorFromSignerMode } from '../types/signer-worker';\nimport { stripTrailingSlashes, toTrimmedString } from '../../utils/validation';\n\nexport type ThresholdEd25519HealthzResponse =\n  | { ok: true; configured: true }\n  | { ok: false; configured: false; code?: string; message?: string };\n\nconst DEFAULT_CACHE_TTL_MS = 60_000;\nconst cache = new Map<string, { configured: boolean; expiresAtMs: number }>();\nconst inFlight = new Map<string, Promise<boolean>>();\nconst DEFAULT_WARN_TTL_MS = 10 * 60_000;\nconst MAX_WARN_KEYS = 1_000;\nconst warnedUnsupportedRelayerByKey = new Map<string, number>();\n\nexport async function isRelayerThresholdEd25519Configured(\n  relayerUrl: string,\n  opts?: { cacheTtlMs?: number },\n): Promise<boolean> {\n  const base = stripTrailingSlashes(toTrimmedString(relayerUrl));\n  return isRelayerThresholdEd25519ConfiguredBase(base, opts);\n}\n\nasync function isRelayerThresholdEd25519ConfiguredBase(\n  base: string,\n  opts?: { cacheTtlMs?: number },\n): Promise<boolean> {\n  if (!base) return false;\n  if (typeof fetch !== 'function') return false;\n\n  const ttlMs = Math.max(0, Number(opts?.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS));\n  const now = Date.now();\n  const cached = cache.get(base);\n  if (cached && cached.expiresAtMs > now) return cached.configured;\n\n  const existing = inFlight.get(base);\n  if (existing) return existing;\n\n  const req = (async (): Promise<boolean> => {\n    try {\n      const res = await fetch(`${base}/threshold-ed25519/healthz`, { method: 'GET' });\n      if (!res.ok) {\n        cache.set(base, { configured: false, expiresAtMs: now + ttlMs });\n        return false;\n      }\n      const data = (await res.json().catch(() => null)) as ThresholdEd25519HealthzResponse | null;\n      const configured = data?.configured === true;\n      cache.set(base, { configured, expiresAtMs: now + ttlMs });\n      return configured;\n    } catch {\n      cache.set(base, { configured: false, expiresAtMs: now + ttlMs });\n      return false;\n    } finally {\n      inFlight.delete(base);\n    }\n  })();\n\n  inFlight.set(base, req);\n  return req;\n}\n\nfunction coerceThresholdBehavior(input?: ThresholdBehavior): ThresholdBehavior {\n  return input === 'fallback' || input === 'strict' ? input : DEFAULT_THRESHOLD_BEHAVIOR;\n}\n\nfunction pruneWarned(nowMs: number): void {\n  if (warnedUnsupportedRelayerByKey.size <= MAX_WARN_KEYS) return;\n  for (const [key, expiresAtMs] of warnedUnsupportedRelayerByKey.entries()) {\n    if (expiresAtMs <= nowMs) warnedUnsupportedRelayerByKey.delete(key);\n  }\n  while (warnedUnsupportedRelayerByKey.size > MAX_WARN_KEYS) {\n    const first = warnedUnsupportedRelayerByKey.keys().next().value as string | undefined;\n    if (!first) break;\n    warnedUnsupportedRelayerByKey.delete(first);\n  }\n}\n\nfunction warnOnce(key: string, message: string, opts?: { warnTtlMs?: number; warnings?: string[] }): void {\n  const nowMs = Date.now();\n  const ttlMs = Math.max(0, Math.floor(opts?.warnTtlMs ?? DEFAULT_WARN_TTL_MS));\n  if (ttlMs === 0) return;\n  pruneWarned(nowMs);\n  const existing = warnedUnsupportedRelayerByKey.get(key);\n  if (existing && existing > nowMs) return;\n  warnedUnsupportedRelayerByKey.set(key, nowMs + ttlMs);\n  // eslint-disable-next-line no-console\n  console.warn(message);\n  opts?.warnings?.push(message);\n}\n\nexport async function fallbackToLocalSignerIfRelayerUnsupported(args: {\n  nearAccountId: string;\n  signerMode: SignerMode;\n  relayerUrl: string;\n  warnings?: string[];\n  cacheTtlMs?: number;\n  warnTtlMs?: number;\n}): Promise<SignerMode['mode']> {\n  const requested = args.signerMode.mode;\n  if (requested !== 'threshold-signer') return requested;\n\n  const base = stripTrailingSlashes(toTrimmedString(args.relayerUrl));\n  const behavior = coerceThresholdBehavior(getThresholdBehaviorFromSignerMode(args.signerMode));\n  const configured = await isRelayerThresholdEd25519ConfiguredBase(base, { cacheTtlMs: args.cacheTtlMs });\n  if (configured) return requested;\n\n  const msg = '[WebAuthnManager] signerMode=threshold-signer requested but the relayer does not support threshold signing';\n  if (behavior === 'fallback') {\n    warnOnce(`${args.nearAccountId}|${base}`, `${msg}; falling back to local-signer`, {\n      warnTtlMs: args.warnTtlMs,\n      warnings: args.warnings,\n    });\n    return 'local-signer';\n  }\n  throw new Error(`${msg}; set signerMode={ mode: 'threshold-signer', behavior: 'fallback' } to allow local-signer fallback`);\n}\n\nexport async function resolveSignerModeForThresholdSigning(args: {\n  nearAccountId: string;\n  signerMode: SignerMode;\n  relayerUrl: string;\n  hasThresholdKeyMaterial: boolean;\n  warnings?: string[];\n  cacheTtlMs?: number;\n  warnTtlMs?: number;\n}): Promise<SignerMode['mode']> {\n  const requested = args.signerMode.mode;\n  if (requested !== 'threshold-signer') return requested;\n\n  const behavior = coerceThresholdBehavior(getThresholdBehaviorFromSignerMode(args.signerMode));\n\n  if (!args.hasThresholdKeyMaterial) {\n    const msg = '[WebAuthnManager] signerMode=threshold-signer requested but threshold key material is unavailable';\n    if (behavior === 'fallback') {\n      warnOnce(`${args.nearAccountId}|threshold-key-material-missing`, `${msg}; falling back to local-signer`, {\n        warnTtlMs: args.warnTtlMs,\n        warnings: args.warnings,\n      });\n      return 'local-signer';\n    }\n    throw new Error(`${msg}; set signerMode={ mode: 'threshold-signer', behavior: 'fallback' } to allow local-signer fallback`);\n  }\n\n  return fallbackToLocalSignerIfRelayerUnsupported({\n    nearAccountId: args.nearAccountId,\n    signerMode: args.signerMode,\n    relayerUrl: args.relayerUrl,\n    warnings: args.warnings,\n    cacheTtlMs: args.cacheTtlMs,\n    warnTtlMs: args.warnTtlMs,\n  });\n}\n"],"mappings":";;;;AAQA,MAAM,uBAAuB;AAC7B,MAAM,wBAAQ,IAAI;AAClB,MAAM,2BAAW,IAAI;AACrB,MAAM,sBAAsB,KAAK;AACjC,MAAM,gBAAgB;AACtB,MAAM,gDAAgC,IAAI;AAU1C,eAAe,wCACb,MACA,MACkB;AAClB,KAAI,CAAC,KAAM,QAAO;AAClB,KAAI,OAAO,UAAU,WAAY,QAAO;CAExC,MAAM,QAAQ,KAAK,IAAI,GAAG,OAAO,MAAM,cAAc;CACrD,MAAM,MAAM,KAAK;CACjB,MAAM,SAAS,MAAM,IAAI;AACzB,KAAI,UAAU,OAAO,cAAc,IAAK,QAAO,OAAO;CAEtD,MAAM,WAAW,SAAS,IAAI;AAC9B,KAAI,SAAU,QAAO;CAErB,MAAM,OAAO,YAA8B;AACzC,MAAI;GACF,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,6BAA6B,EAAE,QAAQ;AACvE,OAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,MAAM;KAAE,YAAY;KAAO,aAAa,MAAM;;AACxD,WAAO;;GAET,MAAM,OAAQ,MAAM,IAAI,OAAO,YAAY;GAC3C,MAAM,aAAa,MAAM,eAAe;AACxC,SAAM,IAAI,MAAM;IAAE;IAAY,aAAa,MAAM;;AACjD,UAAO;UACD;AACN,SAAM,IAAI,MAAM;IAAE,YAAY;IAAO,aAAa,MAAM;;AACxD,UAAO;YACC;AACR,YAAS,OAAO;;;AAIpB,UAAS,IAAI,MAAM;AACnB,QAAO;;AAGT,SAAS,wBAAwB,OAA8C;AAC7E,QAAO,UAAU,cAAc,UAAU,WAAW,QAAQ;;AAG9D,SAAS,YAAY,OAAqB;AACxC,KAAI,8BAA8B,QAAQ,cAAe;AACzD,MAAK,MAAM,CAAC,KAAK,gBAAgB,8BAA8B,UAC7D,KAAI,eAAe,MAAO,+BAA8B,OAAO;AAEjE,QAAO,8BAA8B,OAAO,eAAe;EACzD,MAAM,QAAQ,8BAA8B,OAAO,OAAO;AAC1D,MAAI,CAAC,MAAO;AACZ,gCAA8B,OAAO;;;AAIzC,SAAS,SAAS,KAAa,SAAiB,MAA0D;CACxG,MAAM,QAAQ,KAAK;CACnB,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,MAAM,MAAM,aAAa;AACxD,KAAI,UAAU,EAAG;AACjB,aAAY;CACZ,MAAM,WAAW,8BAA8B,IAAI;AACnD,KAAI,YAAY,WAAW,MAAO;AAClC,+BAA8B,IAAI,KAAK,QAAQ;AAE/C,SAAQ,KAAK;AACb,OAAM,UAAU,KAAK;;AAGvB,eAAsB,0CAA0C,MAOhC;CAC9B,MAAM,YAAY,KAAK,WAAW;AAClC,KAAI,cAAc,mBAAoB,QAAO;CAE7C,MAAM,OAAO,qBAAqB,gBAAgB,KAAK;CACvD,MAAM,WAAW,wBAAwB,mCAAmC,KAAK;CACjF,MAAM,aAAa,MAAM,wCAAwC,MAAM,EAAE,YAAY,KAAK;AAC1F,KAAI,WAAY,QAAO;CAEvB,MAAM,MAAM;AACZ,KAAI,aAAa,YAAY;AAC3B,WAAS,GAAG,KAAK,cAAc,GAAG,QAAQ,GAAG,IAAI,iCAAiC;GAChF,WAAW,KAAK;GAChB,UAAU,KAAK;;AAEjB,SAAO;;AAET,OAAM,IAAI,MAAM,GAAG,IAAI;;AAGzB,eAAsB,qCAAqC,MAQ3B;CAC9B,MAAM,YAAY,KAAK,WAAW;AAClC,KAAI,cAAc,mBAAoB,QAAO;CAE7C,MAAM,WAAW,wBAAwB,mCAAmC,KAAK;AAEjF,KAAI,CAAC,KAAK,yBAAyB;EACjC,MAAM,MAAM;AACZ,MAAI,aAAa,YAAY;AAC3B,YAAS,GAAG,KAAK,cAAc,kCAAkC,GAAG,IAAI,iCAAiC;IACvG,WAAW,KAAK;IAChB,UAAU,KAAK;;AAEjB,UAAO;;AAET,QAAM,IAAI,MAAM,GAAG,IAAI;;AAGzB,QAAO,0CAA0C;EAC/C,eAAe,KAAK;EACpB,YAAY,KAAK;EACjB,YAAY,KAAK;EACjB,UAAU,KAAK;EACf,YAAY,KAAK;EACjB,WAAW,KAAK"}

package/dist/esm/core/threshold/thresholdSessionPolicy.js

@@ -0,0 +1,65 @@
+import { base64UrlEncode } from "../../utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../utils/digests.js";
+import { normalizeThresholdEd25519ParticipantIds } from "../../threshold/participants.js";
+
+//#region src/core/threshold/thresholdSessionPolicy.ts
+const THRESHOLD_SESSION_POLICY_VERSION = "threshold_session_v1";
+const THRESHOLD_SESSION_POLICY_MAX_TTL_MS = 10 * 6e4;
+const THRESHOLD_SESSION_POLICY_MAX_USES = 20;
+const DEFAULT_THRESHOLD_SESSION_POLICY = {
+	ttlMs: 5 * 6e4,
+	remainingUses: 5
+};
+function clampThresholdSessionPolicy(input) {
+	const ttlMs = Math.max(0, Math.floor(Number(input.ttlMs) || 0));
+	const remainingUses = Math.max(0, Math.floor(Number(input.remainingUses) || 0));
+	return {
+		ttlMs: Math.min(ttlMs, THRESHOLD_SESSION_POLICY_MAX_TTL_MS),
+		remainingUses: Math.min(remainingUses, THRESHOLD_SESSION_POLICY_MAX_USES)
+	};
+}
+function generateThresholdSessionId() {
+	const id = typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : `tsess-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+	return `tsess-${id}`;
+}
+async function computeThresholdSessionPolicyDigest32(policy) {
+	const json = alphabetizeStringify(policy);
+	const bytes = await sha256BytesUtf8(json);
+	return base64UrlEncode(bytes);
+}
+async function buildThresholdSessionPolicy(params) {
+	const sessionId = params.sessionId || generateThresholdSessionId();
+	const { ttlMs, remainingUses } = clampThresholdSessionPolicy({
+		ttlMs: params.ttlMs ?? DEFAULT_THRESHOLD_SESSION_POLICY.ttlMs,
+		remainingUses: params.remainingUses ?? DEFAULT_THRESHOLD_SESSION_POLICY.remainingUses
+	});
+	const participantIds = normalizeThresholdEd25519ParticipantIds(params.participantIds);
+	const policy = {
+		version: THRESHOLD_SESSION_POLICY_VERSION,
+		nearAccountId: params.nearAccountId,
+		rpId: params.rpId,
+		relayerKeyId: params.relayerKeyId,
+		sessionId,
+		...participantIds ? { participantIds } : {},
+		ttlMs,
+		remainingUses
+	};
+	const sessionPolicyDigest32 = await computeThresholdSessionPolicyDigest32(policy);
+	return {
+		policy,
+		policyJson: JSON.stringify(policy),
+		sessionPolicyDigest32
+	};
+}
+function isThresholdSessionAuthUnavailableError(err) {
+	const msg = err instanceof Error ? err.message : String(err);
+	return msg.includes("no cached threshold session token") || msg.includes("relayer threshold session expired") || msg.includes("threshold session exhausted") || msg.includes("threshold session expired") || msg.includes("Missing or invalid threshold session token") || msg.includes("Invalid session token kind") || msg.includes("/authorize HTTP 401") || msg.includes("/authorize HTTP 403");
+}
+function isThresholdSignerMissingKeyError(err) {
+	const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();
+	return msg.includes("\"code\":\"missing_key\"") || msg.includes("missing_key") || msg.includes("unknown relayerkeyid") || msg.includes("call /threshold-ed25519/keygen");
+}
+
+//#endregion
+export { buildThresholdSessionPolicy, isThresholdSessionAuthUnavailableError, isThresholdSignerMissingKeyError };
+//# sourceMappingURL=thresholdSessionPolicy.js.map

package/dist/esm/core/threshold/thresholdSessionPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"thresholdSessionPolicy.js","names":["DEFAULT_THRESHOLD_SESSION_POLICY: Pick<ThresholdEd25519SessionPolicy, 'ttlMs' | 'remainingUses'>","policy: ThresholdEd25519SessionPolicy"],"sources":["../../../../src/core/threshold/thresholdSessionPolicy.ts"],"sourcesContent":["import { alphabetizeStringify, sha256BytesUtf8 } from '@/utils/digests';\nimport { base64UrlEncode } from '@/utils/encoders';\nimport { normalizeThresholdEd25519ParticipantIds } from '../../threshold/participants';\n\nexport const THRESHOLD_SESSION_POLICY_VERSION = 'threshold_session_v1' as const;\n\nexport type ThresholdEd25519SessionPolicy = {\n  version: typeof THRESHOLD_SESSION_POLICY_VERSION;\n  nearAccountId: string;\n  rpId: string;\n  relayerKeyId: string;\n  sessionId: string;\n  /**\n   * Optional signer set binding (participant ids).\n   *\n   * When present, the relayer must bind the session token to this signer set and ensure\n   * downstream signature share usage is scoped to the same set.\n   */\n  participantIds?: number[];\n  ttlMs: number;\n  remainingUses: number;\n};\n\nexport const THRESHOLD_SESSION_POLICY_MAX_TTL_MS = 10 * 60_000;\nexport const THRESHOLD_SESSION_POLICY_MAX_USES = 20;\n\n// Default policy used when callers do not specify a policy explicitly.\n// These defaults are kept conservative to limit the blast radius of a stolen token.\nexport const DEFAULT_THRESHOLD_SESSION_POLICY: Pick<ThresholdEd25519SessionPolicy, 'ttlMs' | 'remainingUses'> = {\n  ttlMs: 5 * 60_000,\n  remainingUses: 5,\n};\n\nexport function clampThresholdSessionPolicy(input: {\n  ttlMs: number;\n  remainingUses: number;\n}): { ttlMs: number; remainingUses: number } {\n  const ttlMs = Math.max(0, Math.floor(Number(input.ttlMs) || 0));\n  const remainingUses = Math.max(0, Math.floor(Number(input.remainingUses) || 0));\n  return {\n    ttlMs: Math.min(ttlMs, THRESHOLD_SESSION_POLICY_MAX_TTL_MS),\n    remainingUses: Math.min(remainingUses, THRESHOLD_SESSION_POLICY_MAX_USES),\n  };\n}\n\nexport function generateThresholdSessionId(): string {\n  const id = (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function')\n    ? crypto.randomUUID()\n    : `tsess-${Date.now()}-${Math.random().toString(16).slice(2)}`;\n  return `tsess-${id}`;\n}\n\nexport async function computeThresholdSessionPolicyDigest32(policy: ThresholdEd25519SessionPolicy): Promise<string> {\n  const json = alphabetizeStringify(policy);\n  const bytes = await sha256BytesUtf8(json);\n  return base64UrlEncode(bytes);\n}\n\nexport async function buildThresholdSessionPolicy(params: {\n  nearAccountId: string;\n  rpId: string;\n  relayerKeyId: string;\n  participantIds?: number[];\n  sessionId?: string;\n  ttlMs?: number;\n  remainingUses?: number;\n}): Promise<{\n  policy: ThresholdEd25519SessionPolicy;\n  policyJson: string;\n  sessionPolicyDigest32: string;\n}> {\n  const sessionId = params.sessionId || generateThresholdSessionId();\n  const { ttlMs, remainingUses } = clampThresholdSessionPolicy({\n    ttlMs: params.ttlMs ?? DEFAULT_THRESHOLD_SESSION_POLICY.ttlMs,\n    remainingUses: params.remainingUses ?? DEFAULT_THRESHOLD_SESSION_POLICY.remainingUses,\n  });\n  const participantIds = normalizeThresholdEd25519ParticipantIds(params.participantIds);\n  const policy: ThresholdEd25519SessionPolicy = {\n    version: THRESHOLD_SESSION_POLICY_VERSION,\n    nearAccountId: params.nearAccountId,\n    rpId: params.rpId,\n    relayerKeyId: params.relayerKeyId,\n    sessionId,\n    ...(participantIds ? { participantIds } : {}),\n    ttlMs,\n    remainingUses,\n  };\n  const sessionPolicyDigest32 = await computeThresholdSessionPolicyDigest32(policy);\n  return { policy, policyJson: JSON.stringify(policy), sessionPolicyDigest32 };\n}\n\nexport function isThresholdSessionAuthUnavailableError(err: unknown): boolean {\n  const msg = err instanceof Error ? err.message : String(err);\n  return (\n    msg.includes('no cached threshold session token') ||\n    msg.includes('relayer threshold session expired') ||\n    msg.includes('threshold session exhausted') ||\n    msg.includes('threshold session expired') ||\n    msg.includes('Missing or invalid threshold session token') ||\n    msg.includes('Invalid session token kind') ||\n    msg.includes('/authorize HTTP 401') ||\n    msg.includes('/authorize HTTP 403')\n  );\n}\n\nexport function isThresholdSignerMissingKeyError(err: unknown): boolean {\n  const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();\n  return (\n    msg.includes('\"code\":\"missing_key\"') ||\n    msg.includes('missing_key') ||\n    msg.includes('unknown relayerkeyid') ||\n    msg.includes('call /threshold-ed25519/keygen')\n  );\n}\n"],"mappings":";;;;;AAIA,MAAa,mCAAmC;AAmBhD,MAAa,sCAAsC,KAAK;AACxD,MAAa,oCAAoC;AAIjD,MAAaA,mCAAmG;CAC9G,OAAO,IAAI;CACX,eAAe;;AAGjB,SAAgB,4BAA4B,OAGC;CAC3C,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,MAAM,UAAU;CAC5D,MAAM,gBAAgB,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,MAAM,kBAAkB;AAC5E,QAAO;EACL,OAAO,KAAK,IAAI,OAAO;EACvB,eAAe,KAAK,IAAI,eAAe;;;AAI3C,SAAgB,6BAAqC;CACnD,MAAM,KAAM,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe,aACtE,OAAO,eACP,SAAS,KAAK,MAAM,GAAG,KAAK,SAAS,SAAS,IAAI,MAAM;AAC5D,QAAO,SAAS;;AAGlB,eAAsB,sCAAsC,QAAwD;CAClH,MAAM,OAAO,qBAAqB;CAClC,MAAM,QAAQ,MAAM,gBAAgB;AACpC,QAAO,gBAAgB;;AAGzB,eAAsB,4BAA4B,QAY/C;CACD,MAAM,YAAY,OAAO,aAAa;CACtC,MAAM,EAAE,OAAO,kBAAkB,4BAA4B;EAC3D,OAAO,OAAO,SAAS,iCAAiC;EACxD,eAAe,OAAO,iBAAiB,iCAAiC;;CAE1E,MAAM,iBAAiB,wCAAwC,OAAO;CACtE,MAAMC,SAAwC;EAC5C,SAAS;EACT,eAAe,OAAO;EACtB,MAAM,OAAO;EACb,cAAc,OAAO;EACrB;EACA,GAAI,iBAAiB,EAAE,mBAAmB;EAC1C;EACA;;CAEF,MAAM,wBAAwB,MAAM,sCAAsC;AAC1E,QAAO;EAAE;EAAQ,YAAY,KAAK,UAAU;EAAS;;;AAGvD,SAAgB,uCAAuC,KAAuB;CAC5E,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO;AACxD,QACE,IAAI,SAAS,wCACb,IAAI,SAAS,wCACb,IAAI,SAAS,kCACb,IAAI,SAAS,gCACb,IAAI,SAAS,iDACb,IAAI,SAAS,iCACb,IAAI,SAAS,0BACb,IAAI,SAAS;;AAIjB,SAAgB,iCAAiC,KAAuB;CACtE,MAAM,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,MAAM;AAC/D,QACE,IAAI,SAAS,+BACb,IAAI,SAAS,kBACb,IAAI,SAAS,2BACb,IAAI,SAAS"}

package/dist/esm/core/types/accountIds.js

@@ -1,5 +1,4 @@
-import { __esm } from "../../_virtual/rolldown_runtime.js";
-import { init_validation, validateNearAccountId } from "../../utils/validation.js";
+import { validateNearAccountId } from "../../utils/validation.js";
 
 //#region src/core/types/accountIds.ts
 /**
@@ -11,11 +10,7 @@ function toAccountId(accountId) {
 	if (!validation.valid) throw new Error(`Invalid NEAR account ID: ${accountId}`);
 	return accountId;
 }
-var init_accountIds = __esm({ "src/core/types/accountIds.ts": (() => {
-	init_validation();
-}) });
 
 //#endregion
-init_accountIds();
-export { init_accountIds, toAccountId };
+export { toAccountId };
 //# sourceMappingURL=accountIds.js.map

package/dist/esm/core/types/accountIds.js.map

@@ -1 +1 @@
-{"version":3,"file":"accountIds.js","names":[],"sources":["../../../../src/core/types/accountIds.ts"],"sourcesContent":["\n/**\n * Type-safe account ID system for NEAR account operations\n *\n * USAGE:\n * - AccountId: Use for all operations - on-chain, PRF salt derivation, VRF operations, storage, WebAuthn\n *\n * EXAMPLES:\n * - \"serp126.w3a-v1.testnet\"\n * - \"alice.near\"\n * - \"simple.testnet\"\n */\n\nimport { validateNearAccountId } from '../../utils/validation';\n\n// Branded string type for compile-time type safety\nexport type AccountId = string & { readonly __brand: 'AccountId' };\n\n/**\n * Convert and validate string to AccountId\n * Validates proper NEAR account format (must contain at least one dot)\n */\nexport function toAccountId(accountId: string): AccountId {\n  const validation = validateNearAccountId(accountId);\n  if (!validation.valid) {\n    throw new Error(`Invalid NEAR account ID: ${accountId}`);\n  }\n  return accountId as AccountId;\n}\n\n/**\n * Account ID utilities\n */\nexport const AccountId = {\n  validate: validateNearAccountId,\n  to: toAccountId,\n} as const;\n"],"mappings":";;;;;;;;AAsBA,SAAgB,YAAY,WAA8B;CACxD,MAAM,aAAa,sBAAsB;AACzC,KAAI,CAAC,WAAW,MACd,OAAM,IAAI,MAAM,4BAA4B;AAE9C,QAAO"}
+{"version":3,"file":"accountIds.js","names":[],"sources":["../../../../src/core/types/accountIds.ts"],"sourcesContent":["\n/**\n * Type-safe account ID system for NEAR account operations\n *\n * USAGE:\n * - AccountId: Use for all operations - on-chain, PRF salt derivation, VRF operations, storage, WebAuthn\n *\n * EXAMPLES:\n * - \"serp126.w3a-v1.testnet\"\n * - \"alice.near\"\n * - \"simple.testnet\"\n */\n\nimport { validateNearAccountId } from '../../utils/validation';\n\n// Branded string type for compile-time type safety\nexport type AccountId = string & { readonly __brand: 'AccountId' };\n\n/**\n * Convert and validate string to AccountId\n * Validates proper NEAR account format (must contain at least one dot)\n */\nexport function toAccountId(accountId: string): AccountId {\n  const validation = validateNearAccountId(accountId);\n  if (!validation.valid) {\n    throw new Error(`Invalid NEAR account ID: ${accountId}`);\n  }\n  return accountId as AccountId;\n}\n\n/**\n * Account ID utilities\n */\nexport const AccountId = {\n  validate: validateNearAccountId,\n  to: toAccountId,\n} as const;\n"],"mappings":";;;;;;;AAsBA,SAAgB,YAAY,WAA8B;CACxD,MAAM,aAAa,sBAAsB;AACzC,KAAI,CAAC,WAAW,MACd,OAAM,IAAI,MAAM,4BAA4B;AAE9C,QAAO"}

package/dist/esm/core/types/actions.js

@@ -1,7 +1,23 @@
-import { __esm } from "../../_virtual/rolldown_runtime.js";
-import { init_validation, isObject } from "../WalletIframe/validation.js";
+import { isObject } from "../../utils/validation.js";
 
 //#region src/core/types/actions.ts
+/**
+* Enum for all supported NEAR action types
+*/
+let ActionType = /* @__PURE__ */ function(ActionType$1) {
+	ActionType$1["CreateAccount"] = "CreateAccount";
+	ActionType$1["DeployContract"] = "DeployContract";
+	ActionType$1["FunctionCall"] = "FunctionCall";
+	ActionType$1["Transfer"] = "Transfer";
+	ActionType$1["Stake"] = "Stake";
+	ActionType$1["AddKey"] = "AddKey";
+	ActionType$1["DeleteKey"] = "DeleteKey";
+	ActionType$1["DeleteAccount"] = "DeleteAccount";
+	ActionType$1["SignedDelegate"] = "SignedDelegate";
+	ActionType$1["DeployGlobalContract"] = "DeployGlobalContract";
+	ActionType$1["UseGlobalContract"] = "UseGlobalContract";
+	return ActionType$1;
+}({});
 function isActionArgsWasm(a) {
 	return isObject(a) && "action_type" in a;
 }
@@ -229,26 +245,7 @@ function fromTransactionInputWasm(tx) {
 function fromTransactionInputsWasm(txs) {
 	return (txs || []).map(fromTransactionInputWasm);
 }
-var ActionType;
-var init_actions = __esm({ "src/core/types/actions.ts": (() => {
-	init_validation();
-	ActionType = /* @__PURE__ */ function(ActionType$1) {
-		ActionType$1["CreateAccount"] = "CreateAccount";
-		ActionType$1["DeployContract"] = "DeployContract";
-		ActionType$1["FunctionCall"] = "FunctionCall";
-		ActionType$1["Transfer"] = "Transfer";
-		ActionType$1["Stake"] = "Stake";
-		ActionType$1["AddKey"] = "AddKey";
-		ActionType$1["DeleteKey"] = "DeleteKey";
-		ActionType$1["DeleteAccount"] = "DeleteAccount";
-		ActionType$1["SignedDelegate"] = "SignedDelegate";
-		ActionType$1["DeployGlobalContract"] = "DeployGlobalContract";
-		ActionType$1["UseGlobalContract"] = "UseGlobalContract";
-		return ActionType$1;
-	}({});
-}) });
 
 //#endregion
-init_actions();
-export { ActionType, fromTransactionInputsWasm, init_actions, isActionArgsWasm, toActionArgsWasm, validateActionArgsWasm };
+export { ActionType, fromTransactionInputsWasm, isActionArgsWasm, toActionArgsWasm, validateActionArgsWasm };
 //# sourceMappingURL=actions.js.map

package/dist/esm/core/types/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","names":["parsedArgs: Record<string, any>","accessKey: { nonce: bigint; permission: 'FullAccess' | FunctionCallPermissionView; }","normalizedPermission: 'FullAccess' | FunctionCallPermissionView"],"sources":["../../../../src/core/types/actions.ts"],"sourcesContent":["import { DelegateAction, Signature } from './delegate';\n\n// === TRANSACTION INPUT INTERFACES ===\n\nexport interface TransactionInput {\n  receiverId: string;\n  actions: ActionArgs[],\n}\n\nexport interface TransactionInputWasm {\n  receiverId: string;\n  actions: ActionArgsWasm[],\n  nonce?: string; // Optional - computed in confirmation flow if not provided\n}\n\n/**\n * Enum for all supported NEAR action types\n */\nexport enum ActionType {\n  CreateAccount = \"CreateAccount\",\n  DeployContract = \"DeployContract\",\n  FunctionCall = \"FunctionCall\",\n  Transfer = \"Transfer\",\n  Stake = \"Stake\",\n  AddKey = \"AddKey\",\n  DeleteKey = \"DeleteKey\",\n  DeleteAccount = \"DeleteAccount\",\n  SignedDelegate = \"SignedDelegate\",\n  DeployGlobalContract = \"DeployGlobalContract\",\n  UseGlobalContract = \"UseGlobalContract\",\n}\n\nexport enum TxExecutionStatus {\n  NONE = 'NONE',\n  INCLUDED = 'INCLUDED',\n  INCLUDED_FINAL = 'INCLUDED_FINAL',\n  EXECUTED = 'EXECUTED',\n  FINAL = 'FINAL',\n  EXECUTED_OPTIMISTIC = 'EXECUTED_OPTIMISTIC'\n}\n\n// === ACTION INTERFACES (camelCase for JS) ===\n\nexport interface FunctionCallAction {\n  type: ActionType.FunctionCall;\n  /** Name of the contract method to call */\n  methodName: string;\n  /** Arguments to pass to the method (will be JSON.stringify'd automatically) */\n  args: Record<string, any>;\n  /** Maximum gas to use for this call (default: '30000000000000' 30 TGas) */\n  gas?: string;\n  /** Amount of NEAR tokens to attach in yoctoNEAR (default: '0') */\n  deposit?: string;\n}\n\nexport interface TransferAction {\n  type: ActionType.Transfer;\n  /** Amount of NEAR tokens to transfer in yoctoNEAR */\n  amount: string;\n}\n\nexport interface CreateAccountAction {\n  type: ActionType.CreateAccount;\n}\n\nexport interface DeployContractAction {\n  type: ActionType.DeployContract;\n  /** Contract code as Uint8Array or base64 string */\n  code: Uint8Array | string;\n}\n\nexport interface DeployGlobalContractAction {\n  type: ActionType.DeployGlobalContract;\n  /** Global contract code as Uint8Array or base64 string */\n  code: Uint8Array | string;\n  /** Deployment mode: CodeHash | AccountId */\n  deployMode: 'CodeHash' | 'AccountId';\n}\n\nexport interface UseGlobalContractAction {\n  type: ActionType.UseGlobalContract;\n  /** Exactly one of these should be set */\n  accountId?: string;\n  /** bs58-encoded 32-byte code hash */\n  codeHash?: string;\n}\n\nexport interface StakeAction {\n  type: ActionType.Stake;\n  /** Amount to stake in yoctoNEAR */\n  stake: string;\n  /** Public key of the validator */\n  publicKey: string;\n}\n\nexport interface AddKeyAction {\n  type: ActionType.AddKey;\n  /** Public key to add */\n  publicKey: string;\n  /** Access key configuration */\n  accessKey: {\n    /** Starting nonce for the key */\n    nonce?: number;\n    /** Permission level for the key */\n    permission: 'FullAccess' | {\n      /** Function call permissions */\n      FunctionCall: {\n        /** Maximum allowance in yoctoNEAR (optional for unlimited) */\n        allowance?: string;\n        /** Contract that can be called (default: same as receiverId) */\n        receiverId?: string;\n        /** Method names that can be called (empty array = all methods) */\n        methodNames?: string[];\n      };\n    };\n  };\n}\n\nexport interface DeleteKeyAction {\n  type: ActionType.DeleteKey;\n  /** Public key to remove */\n  publicKey: string;\n}\n\nexport interface DeleteAccountAction {\n  type: ActionType.DeleteAccount;\n  /** Account that will receive the remaining balance */\n  beneficiaryId: string;\n}\n\n/**\n * Action types for all NEAR actions\n * camelCase for JS\n */\nexport type ActionArgs =\n  | FunctionCallAction\n  | TransferAction\n  | CreateAccountAction\n  | DeployContractAction\n  | StakeAction\n  | AddKeyAction\n  | DeleteKeyAction\n  | DeleteAccountAction\n  | DeployGlobalContractAction\n  | UseGlobalContractAction;\n\n// === ACTION TYPES ===\n\n// ActionArgsWasm matches the Rust enum structure exactly\n// snake_case for wasm\nexport type ActionArgsWasm =\n  | { action_type: ActionType.CreateAccount }\n  | { action_type: ActionType.DeployContract; code: number[] }\n  | {\n    action_type: ActionType.FunctionCall;\n    method_name: string;\n    args: string; // JSON string\n    gas: string;\n    deposit: string;\n  }\n  | { action_type: ActionType.Transfer; deposit: string }\n  | { action_type: ActionType.Stake; stake: string; public_key: string }\n  | { action_type: ActionType.AddKey; public_key: string; access_key: string }\n  | { action_type: ActionType.DeleteKey; public_key: string }\n  | { action_type: ActionType.DeleteAccount; beneficiary_id: string }\n  | {\n    action_type: ActionType.SignedDelegate;\n    delegate_action: DelegateAction;\n    signature: Signature;\n  }\n  | { action_type: ActionType.DeployGlobalContract; code: number[]; deploy_mode: 'CodeHash' | 'AccountId' }\n  | { action_type: ActionType.UseGlobalContract; account_id?: string; code_hash?: string }\n\nexport function isActionArgsWasm(a?: any): a is ActionArgsWasm {\n  return isObject(a) && 'action_type' in a;\n}\n\nexport function toActionArgsWasm(action: ActionArgs): ActionArgsWasm {\n  switch (action.type) {\n    case ActionType.Transfer:\n      return {\n        action_type: ActionType.Transfer,\n        deposit: action.amount\n      };\n\n    case ActionType.FunctionCall:\n      return {\n        action_type: ActionType.FunctionCall,\n        method_name: action.methodName,\n        args: JSON.stringify(action.args),\n        gas: action.gas || \"30000000000000\",\n        deposit: action.deposit || \"0\"\n      };\n\n    case ActionType.AddKey:\n      // Ensure access key has proper format with nonce and permission object.\n      // For FullAccess we emit the NEAR-style `{ FullAccess: {} }` shape to\n      // match near-api-js and RPC JSON; FunctionCall permissions are passed\n      // through as-is.\n      const rawPermission = action.accessKey.permission;\n      const permission = rawPermission === 'FullAccess'\n          ? { FullAccess: {} }\n          : rawPermission;\n      const accessKey = {\n        nonce: action.accessKey.nonce || 0,\n        permission,\n      };\n      return {\n        action_type: ActionType.AddKey,\n        public_key: action.publicKey,\n        access_key: JSON.stringify(accessKey)\n      };\n\n    case ActionType.DeleteKey:\n      return {\n        action_type: ActionType.DeleteKey,\n        public_key: action.publicKey\n      };\n\n    case ActionType.CreateAccount:\n      return {\n        action_type: ActionType.CreateAccount\n      };\n\n    case ActionType.DeleteAccount:\n      return {\n        action_type: ActionType.DeleteAccount,\n        beneficiary_id: action.beneficiaryId\n      };\n\n    case ActionType.DeployContract:\n      return {\n        action_type: ActionType.DeployContract,\n        code: typeof action.code === 'string'\n          ? Array.from(new TextEncoder().encode(action.code))\n          : Array.from(action.code)\n      };\n\n    case ActionType.DeployGlobalContract:\n      return {\n        action_type: ActionType.DeployGlobalContract,\n        code: typeof action.code === 'string'\n          ? Array.from(new TextEncoder().encode(action.code))\n          : Array.from(action.code),\n        deploy_mode: action.deployMode,\n      };\n\n    case ActionType.UseGlobalContract:\n      return {\n        action_type: ActionType.UseGlobalContract,\n        account_id: action.accountId,\n        code_hash: action.codeHash,\n      };\n\n    case ActionType.Stake:\n      return {\n        action_type: ActionType.Stake,\n        stake: action.stake,\n        public_key: action.publicKey\n      };\n\n    default:\n      throw new Error(`Action type ${(action as any).type} is not supported`);\n  }\n}\n\n// === ACTION TYPE VALIDATION ===\n\n/**\n * Validate action parameters before sending to worker\n */\nexport function validateActionArgsWasm(actionArgsWasm: ActionArgsWasm): void {\n  switch (actionArgsWasm.action_type) {\n    case ActionType.FunctionCall:\n      if (!actionArgsWasm.method_name) {\n        throw new Error('method_name required for FunctionCall');\n      }\n      if (!actionArgsWasm.args) {\n        throw new Error('args required for FunctionCall');\n      }\n      if (!actionArgsWasm.gas) {\n        throw new Error('gas required for FunctionCall');\n      }\n      if (!actionArgsWasm.deposit) {\n        throw new Error('deposit required for FunctionCall');\n      }\n      // Validate args is valid JSON string\n      if (typeof actionArgsWasm.args !== 'string') {\n        throw new Error('FunctionCall action args must be a valid JSON string');\n      }\n      try {\n        JSON.parse(actionArgsWasm.args);\n      } catch {\n        throw new Error('FunctionCall action args must be valid JSON string');\n      }\n      break;\n    case ActionType.Transfer:\n      if (!actionArgsWasm.deposit) {\n        throw new Error('deposit required for Transfer');\n      }\n      break;\n    case ActionType.CreateAccount:\n      // No additional validation needed\n      break;\n    case ActionType.DeployContract:\n      if (!actionArgsWasm.code || actionArgsWasm.code.length === 0) {\n        throw new Error('code required for DeployContract');\n      }\n      break;\n    case ActionType.Stake:\n      if (!actionArgsWasm.stake) {\n        throw new Error('stake amount required for Stake');\n      }\n      if (!actionArgsWasm.public_key) {\n        throw new Error('public_key required for Stake');\n      }\n      break;\n    case ActionType.AddKey:\n      if (!actionArgsWasm.public_key) {\n        throw new Error('public_key required for AddKey');\n      }\n      if (!actionArgsWasm.access_key) {\n        throw new Error('access_key required for AddKey');\n      }\n      // Validate access_key is valid JSON string\n      if (typeof actionArgsWasm.access_key !== 'string') {\n        throw new Error('AddKey action access_key must be a valid JSON string');\n      }\n      try {\n        JSON.parse(actionArgsWasm.access_key);\n      } catch {\n        throw new Error('AddKey action access_key must be valid JSON string');\n      }\n      break;\n    case ActionType.DeleteKey:\n      if (!actionArgsWasm.public_key) {\n        throw new Error('public_key required for DeleteKey');\n      }\n      break;\n    case ActionType.DeleteAccount:\n      if (!actionArgsWasm.beneficiary_id) {\n        throw new Error('beneficiary_id required for DeleteAccount');\n      }\n      break;\n    case ActionType.SignedDelegate: {\n      const payload = actionArgsWasm as {\n        delegate_action?: unknown;\n        signature?: unknown;\n      };\n      if (!payload.delegate_action || typeof payload.delegate_action !== 'object') {\n        throw new Error('delegate_action required for SignedDelegate');\n      }\n      if (!payload.signature || typeof payload.signature !== 'object') {\n        throw new Error('signature required for SignedDelegate');\n      }\n      break;\n    }\n    case ActionType.DeployGlobalContract:\n      if (!actionArgsWasm.code || actionArgsWasm.code.length === 0) {\n        throw new Error('code required for DeployGlobalContract');\n      }\n      if (!actionArgsWasm.deploy_mode || (actionArgsWasm.deploy_mode !== 'CodeHash' && actionArgsWasm.deploy_mode !== 'AccountId')) {\n        throw new Error('deploy_mode must be CodeHash or AccountId for DeployGlobalContract');\n      }\n      break;\n    case ActionType.UseGlobalContract: {\n      const hasAccountId = !!actionArgsWasm.account_id;\n      const hasCodeHash = !!actionArgsWasm.code_hash;\n      if (hasAccountId === hasCodeHash) {\n        throw new Error('UseGlobalContract requires exactly one of account_id or code_hash');\n      }\n      break;\n    }\n    default:\n      throw new Error(`Unsupported action type: ${(actionArgsWasm as any).action_type}`);\n  }\n}\n\n// === CONVERSIONS: WASM -> JS ACTIONS ===\n\ninterface FunctionCallPermissionView {\n  FunctionCall: {\n    allowance: string;\n    receiver_id: string;\n    method_names: string[];\n  };\n}\n\n/**\n * Convert a single ActionArgsWasm (snake_case, stringified fields) to ActionArgs (camelCase, typed fields)\n */\nexport function fromActionArgsWasm(a: ActionArgsWasm): ActionArgs {\n  switch (a.action_type) {\n    case ActionType.FunctionCall: {\n      let parsedArgs: Record<string, any> = {};\n      try {\n        if (typeof a.args === 'string') {\n          parsedArgs = a.args ? JSON.parse(a.args) : {};\n        } else {\n          parsedArgs = a.args || {};\n        }\n      } catch {\n        // leave as empty object if parsing fails\n        parsedArgs = {};\n      }\n      return {\n        type: ActionType.FunctionCall,\n        methodName: a.method_name,\n        args: parsedArgs,\n        gas: a.gas,\n        deposit: a.deposit\n      };\n    }\n    case ActionType.Transfer:\n      return {\n        type: ActionType.Transfer,\n        amount: a.deposit\n      };\n    case ActionType.CreateAccount:\n      return {\n        type: ActionType.CreateAccount\n      };\n    case ActionType.DeployContract: {\n      // Represent code as Uint8Array for consistency\n      const codeBytes = Array.isArray(a.code) ? new Uint8Array(a.code) : new Uint8Array();\n      return {\n        type: ActionType.DeployContract,\n        code: codeBytes\n      };\n    }\n    case ActionType.DeployGlobalContract: {\n      const codeBytes = Array.isArray(a.code) ? new Uint8Array(a.code) : new Uint8Array();\n      return {\n        type: ActionType.DeployGlobalContract,\n        code: codeBytes,\n        deployMode: a.deploy_mode,\n      };\n    }\n    case ActionType.Stake:\n      return {\n        type: ActionType.Stake,\n        stake: a.stake,\n        publicKey: a.public_key\n      };\n    case ActionType.AddKey: {\n      // access_key is a JSON string of { nonce, permission: ... }\n      let accessKey: { nonce: bigint; permission: 'FullAccess' | FunctionCallPermissionView; }\n      try {\n        accessKey = JSON.parse(a.access_key);\n      } catch {\n        accessKey = { nonce: BigInt(0), permission: 'FullAccess' };\n      }\n      // Normalize permission back to SDK shape\n      const permission = accessKey?.permission;\n      let normalizedPermission: 'FullAccess' | FunctionCallPermissionView = 'FullAccess';\n\n      if (isObject(permission)) {\n        if ('FullAccess' in permission) {\n          normalizedPermission = 'FullAccess';\n        } else if ('FunctionCall' in permission) {\n          const fc = (permission as FunctionCallPermissionView).FunctionCall;\n          normalizedPermission = {\n            FunctionCall: {\n              allowance: fc.allowance,\n              receiver_id: fc.receiver_id,\n              method_names: fc.method_names\n            }\n          };\n        }\n      }\n      return {\n        type: ActionType.AddKey,\n        publicKey: a.public_key,\n        accessKey: {\n          nonce: typeof accessKey?.nonce === 'number' ? accessKey.nonce : 0,\n          permission: normalizedPermission\n        }\n      };\n    }\n    case ActionType.DeleteKey:\n      return {\n        type: ActionType.DeleteKey,\n        publicKey: a.public_key\n      };\n    case ActionType.DeleteAccount:\n      return {\n        type: ActionType.DeleteAccount,\n        beneficiaryId: a.beneficiary_id\n      };\n    case ActionType.UseGlobalContract:\n      return {\n        type: ActionType.UseGlobalContract,\n        accountId: a.account_id,\n        codeHash: a.code_hash,\n      };\n    default:\n      // Exhaustive guard\n      throw new Error(`Unsupported wasm action_type: ${(a as any)?.action_type}`);\n  }\n}\n\n/** Convert a TransactionInputWasm structure to TransactionInput */\nexport function fromTransactionInputWasm(tx: TransactionInputWasm): TransactionInput {\n  return {\n    receiverId: tx.receiverId,\n    actions: tx.actions.map(fromActionArgsWasm)\n  };\n}\n\n/** Convert an array of TransactionInputWasm to TransactionInput[] */\nexport function fromTransactionInputsWasm(txs: TransactionInputWasm[]): TransactionInput[] {\n  return (txs || []).map(fromTransactionInputWasm);\n}\nimport { isObject } from '../WalletIframe/validation';\n"],"mappings":";;;;AA6KA,SAAgB,iBAAiB,GAA8B;AAC7D,QAAO,SAAS,MAAM,iBAAiB;;AAGzC,SAAgB,iBAAiB,QAAoC;AACnE,SAAQ,OAAO,MAAf;EACE,KAAK,WAAW,SACd,QAAO;GACL,aAAa,WAAW;GACxB,SAAS,OAAO;;EAGpB,KAAK,WAAW,aACd,QAAO;GACL,aAAa,WAAW;GACxB,aAAa,OAAO;GACpB,MAAM,KAAK,UAAU,OAAO;GAC5B,KAAK,OAAO,OAAO;GACnB,SAAS,OAAO,WAAW;;EAG/B,KAAK,WAAW;GAKd,MAAM,gBAAgB,OAAO,UAAU;GACvC,MAAM,aAAa,kBAAkB,eAC/B,EAAE,YAAY,OACd;GACN,MAAM,YAAY;IAChB,OAAO,OAAO,UAAU,SAAS;IACjC;;AAEF,UAAO;IACL,aAAa,WAAW;IACxB,YAAY,OAAO;IACnB,YAAY,KAAK,UAAU;;EAG/B,KAAK,WAAW,UACd,QAAO;GACL,aAAa,WAAW;GACxB,YAAY,OAAO;;EAGvB,KAAK,WAAW,cACd,QAAO,EACL,aAAa,WAAW;EAG5B,KAAK,WAAW,cACd,QAAO;GACL,aAAa,WAAW;GACxB,gBAAgB,OAAO;;EAG3B,KAAK,WAAW,eACd,QAAO;GACL,aAAa,WAAW;GACxB,MAAM,OAAO,OAAO,SAAS,WACzB,MAAM,KAAK,IAAI,cAAc,OAAO,OAAO,SAC3C,MAAM,KAAK,OAAO;;EAG1B,KAAK,WAAW,qBACd,QAAO;GACL,aAAa,WAAW;GACxB,MAAM,OAAO,OAAO,SAAS,WACzB,MAAM,KAAK,IAAI,cAAc,OAAO,OAAO,SAC3C,MAAM,KAAK,OAAO;GACtB,aAAa,OAAO;;EAGxB,KAAK,WAAW,kBACd,QAAO;GACL,aAAa,WAAW;GACxB,YAAY,OAAO;GACnB,WAAW,OAAO;;EAGtB,KAAK,WAAW,MACd,QAAO;GACL,aAAa,WAAW;GACxB,OAAO,OAAO;GACd,YAAY,OAAO;;EAGvB,QACE,OAAM,IAAI,MAAM,eAAgB,OAAe,KAAK;;;;;;AAS1D,SAAgB,uBAAuB,gBAAsC;AAC3E,SAAQ,eAAe,aAAvB;EACE,KAAK,WAAW;AACd,OAAI,CAAC,eAAe,YAClB,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,eAAe,KAClB,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,eAAe,IAClB,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,eAAe,QAClB,OAAM,IAAI,MAAM;AAGlB,OAAI,OAAO,eAAe,SAAS,SACjC,OAAM,IAAI,MAAM;AAElB,OAAI;AACF,SAAK,MAAM,eAAe;WACpB;AACN,UAAM,IAAI,MAAM;;AAElB;EACF,KAAK,WAAW;AACd,OAAI,CAAC,eAAe,QAClB,OAAM,IAAI,MAAM;AAElB;EACF,KAAK,WAAW,cAEd;EACF,KAAK,WAAW;AACd,OAAI,CAAC,eAAe,QAAQ,eAAe,KAAK,WAAW,EACzD,OAAM,IAAI,MAAM;AAElB;EACF,KAAK,WAAW;AACd,OAAI,CAAC,eAAe,MAClB,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,eAAe,WAClB,OAAM,IAAI,MAAM;AAElB;EACF,KAAK,WAAW;AACd,OAAI,CAAC,eAAe,WAClB,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,eAAe,WAClB,OAAM,IAAI,MAAM;AAGlB,OAAI,OAAO,eAAe,eAAe,SACvC,OAAM,IAAI,MAAM;AAElB,OAAI;AACF,SAAK,MAAM,eAAe;WACpB;AACN,UAAM,IAAI,MAAM;;AAElB;EACF,KAAK,WAAW;AACd,OAAI,CAAC,eAAe,WAClB,OAAM,IAAI,MAAM;AAElB;EACF,KAAK,WAAW;AACd,OAAI,CAAC,eAAe,eAClB,OAAM,IAAI,MAAM;AAElB;EACF,KAAK,WAAW,gBAAgB;GAC9B,MAAM,UAAU;AAIhB,OAAI,CAAC,QAAQ,mBAAmB,OAAO,QAAQ,oBAAoB,SACjE,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,SACrD,OAAM,IAAI,MAAM;AAElB;;EAEF,KAAK,WAAW;AACd,OAAI,CAAC,eAAe,QAAQ,eAAe,KAAK,WAAW,EACzD,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,eAAe,eAAgB,eAAe,gBAAgB,cAAc,eAAe,gBAAgB,YAC9G,OAAM,IAAI,MAAM;AAElB;EACF,KAAK,WAAW,mBAAmB;GACjC,MAAM,eAAe,CAAC,CAAC,eAAe;GACtC,MAAM,cAAc,CAAC,CAAC,eAAe;AACrC,OAAI,iBAAiB,YACnB,OAAM,IAAI,MAAM;AAElB;;EAEF,QACE,OAAM,IAAI,MAAM,4BAA6B,eAAuB;;;;;;AAiB1E,SAAgB,mBAAmB,GAA+B;AAChE,SAAQ,EAAE,aAAV;EACE,KAAK,WAAW,cAAc;GAC5B,IAAIA,aAAkC;AACtC,OAAI;AACF,QAAI,OAAO,EAAE,SAAS,SACpB,cAAa,EAAE,OAAO,KAAK,MAAM,EAAE,QAAQ;QAE3C,cAAa,EAAE,QAAQ;WAEnB;AAEN,iBAAa;;AAEf,UAAO;IACL,MAAM,WAAW;IACjB,YAAY,EAAE;IACd,MAAM;IACN,KAAK,EAAE;IACP,SAAS,EAAE;;;EAGf,KAAK,WAAW,SACd,QAAO;GACL,MAAM,WAAW;GACjB,QAAQ,EAAE;;EAEd,KAAK,WAAW,cACd,QAAO,EACL,MAAM,WAAW;EAErB,KAAK,WAAW,gBAAgB;GAE9B,MAAM,YAAY,MAAM,QAAQ,EAAE,QAAQ,IAAI,WAAW,EAAE,QAAQ,IAAI;AACvE,UAAO;IACL,MAAM,WAAW;IACjB,MAAM;;;EAGV,KAAK,WAAW,sBAAsB;GACpC,MAAM,YAAY,MAAM,QAAQ,EAAE,QAAQ,IAAI,WAAW,EAAE,QAAQ,IAAI;AACvE,UAAO;IACL,MAAM,WAAW;IACjB,MAAM;IACN,YAAY,EAAE;;;EAGlB,KAAK,WAAW,MACd,QAAO;GACL,MAAM,WAAW;GACjB,OAAO,EAAE;GACT,WAAW,EAAE;;EAEjB,KAAK,WAAW,QAAQ;GAEtB,IAAIC;AACJ,OAAI;AACF,gBAAY,KAAK,MAAM,EAAE;WACnB;AACN,gBAAY;KAAE,OAAO,OAAO;KAAI,YAAY;;;GAG9C,MAAM,aAAa,WAAW;GAC9B,IAAIC,uBAAkE;AAEtE,OAAI,SAAS,aACX;QAAI,gBAAgB,WAClB,wBAAuB;aACd,kBAAkB,YAAY;KACvC,MAAM,KAAM,WAA0C;AACtD,4BAAuB,EACrB,cAAc;MACZ,WAAW,GAAG;MACd,aAAa,GAAG;MAChB,cAAc,GAAG;;;;AAKzB,UAAO;IACL,MAAM,WAAW;IACjB,WAAW,EAAE;IACb,WAAW;KACT,OAAO,OAAO,WAAW,UAAU,WAAW,UAAU,QAAQ;KAChE,YAAY;;;;EAIlB,KAAK,WAAW,UACd,QAAO;GACL,MAAM,WAAW;GACjB,WAAW,EAAE;;EAEjB,KAAK,WAAW,cACd,QAAO;GACL,MAAM,WAAW;GACjB,eAAe,EAAE;;EAErB,KAAK,WAAW,kBACd,QAAO;GACL,MAAM,WAAW;GACjB,WAAW,EAAE;GACb,UAAU,EAAE;;EAEhB,QAEE,OAAM,IAAI,MAAM,iCAAkC,GAAW;;;;AAKnE,SAAgB,yBAAyB,IAA4C;AACnF,QAAO;EACL,YAAY,GAAG;EACf,SAAS,GAAG,QAAQ,IAAI;;;;AAK5B,SAAgB,0BAA0B,KAAiD;AACzF,SAAQ,OAAO,IAAI,IAAI;;;;;CA7eb,oDAAL;AACL;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA"}
+{"version":3,"file":"actions.js","names":["parsedArgs: Record<string, any>","accessKey: { nonce: bigint; permission: 'FullAccess' | FunctionCallPermissionView; }","normalizedPermission: 'FullAccess' | FunctionCallPermissionView"],"sources":["../../../../src/core/types/actions.ts"],"sourcesContent":["import { DelegateAction, Signature } from './delegate';\n\n// === TRANSACTION INPUT INTERFACES ===\n\nexport interface TransactionInput {\n  receiverId: string;\n  actions: ActionArgs[],\n}\n\nexport interface TransactionInputWasm {\n  receiverId: string;\n  actions: ActionArgsWasm[],\n  nonce?: string; // Optional - computed in confirmation flow if not provided\n}\n\n/**\n * Enum for all supported NEAR action types\n */\nexport enum ActionType {\n  CreateAccount = \"CreateAccount\",\n  DeployContract = \"DeployContract\",\n  FunctionCall = \"FunctionCall\",\n  Transfer = \"Transfer\",\n  Stake = \"Stake\",\n  AddKey = \"AddKey\",\n  DeleteKey = \"DeleteKey\",\n  DeleteAccount = \"DeleteAccount\",\n  SignedDelegate = \"SignedDelegate\",\n  DeployGlobalContract = \"DeployGlobalContract\",\n  UseGlobalContract = \"UseGlobalContract\",\n}\n\nexport enum TxExecutionStatus {\n  NONE = 'NONE',\n  INCLUDED = 'INCLUDED',\n  INCLUDED_FINAL = 'INCLUDED_FINAL',\n  EXECUTED = 'EXECUTED',\n  FINAL = 'FINAL',\n  EXECUTED_OPTIMISTIC = 'EXECUTED_OPTIMISTIC'\n}\n\n// === ACTION INTERFACES (camelCase for JS) ===\n\nexport interface FunctionCallAction {\n  type: ActionType.FunctionCall;\n  /** Name of the contract method to call */\n  methodName: string;\n  /** Arguments to pass to the method (will be JSON.stringify'd automatically) */\n  args: Record<string, any>;\n  /** Maximum gas to use for this call (default: '30000000000000' 30 TGas) */\n  gas?: string;\n  /** Amount of NEAR tokens to attach in yoctoNEAR (default: '0') */\n  deposit?: string;\n}\n\nexport interface TransferAction {\n  type: ActionType.Transfer;\n  /** Amount of NEAR tokens to transfer in yoctoNEAR */\n  amount: string;\n}\n\nexport interface CreateAccountAction {\n  type: ActionType.CreateAccount;\n}\n\nexport interface DeployContractAction {\n  type: ActionType.DeployContract;\n  /** Contract code as Uint8Array or base64 string */\n  code: Uint8Array | string;\n}\n\nexport interface DeployGlobalContractAction {\n  type: ActionType.DeployGlobalContract;\n  /** Global contract code as Uint8Array or base64 string */\n  code: Uint8Array | string;\n  /** Deployment mode: CodeHash | AccountId */\n  deployMode: 'CodeHash' | 'AccountId';\n}\n\nexport interface UseGlobalContractAction {\n  type: ActionType.UseGlobalContract;\n  /** Exactly one of these should be set */\n  accountId?: string;\n  /** bs58-encoded 32-byte code hash */\n  codeHash?: string;\n}\n\nexport interface StakeAction {\n  type: ActionType.Stake;\n  /** Amount to stake in yoctoNEAR */\n  stake: string;\n  /** Public key of the validator */\n  publicKey: string;\n}\n\nexport interface AddKeyAction {\n  type: ActionType.AddKey;\n  /** Public key to add */\n  publicKey: string;\n  /** Access key configuration */\n  accessKey: {\n    /** Starting nonce for the key */\n    nonce?: number;\n    /** Permission level for the key */\n    permission: 'FullAccess' | {\n      /** Function call permissions */\n      FunctionCall: {\n        /** Maximum allowance in yoctoNEAR (optional for unlimited) */\n        allowance?: string;\n        /** Contract that can be called (default: same as receiverId) */\n        receiverId?: string;\n        /** Method names that can be called (empty array = all methods) */\n        methodNames?: string[];\n      };\n    };\n  };\n}\n\nexport interface DeleteKeyAction {\n  type: ActionType.DeleteKey;\n  /** Public key to remove */\n  publicKey: string;\n}\n\nexport interface DeleteAccountAction {\n  type: ActionType.DeleteAccount;\n  /** Account that will receive the remaining balance */\n  beneficiaryId: string;\n}\n\n/**\n * Action types for all NEAR actions\n * camelCase for JS\n */\nexport type ActionArgs =\n  | FunctionCallAction\n  | TransferAction\n  | CreateAccountAction\n  | DeployContractAction\n  | StakeAction\n  | AddKeyAction\n  | DeleteKeyAction\n  | DeleteAccountAction\n  | DeployGlobalContractAction\n  | UseGlobalContractAction;\n\n// === ACTION TYPES ===\n\n// ActionArgsWasm matches the Rust enum structure exactly\n// snake_case for wasm\nexport type ActionArgsWasm =\n  | { action_type: ActionType.CreateAccount }\n  | { action_type: ActionType.DeployContract; code: number[] }\n  | {\n    action_type: ActionType.FunctionCall;\n    method_name: string;\n    args: string; // JSON string\n    gas: string;\n    deposit: string;\n  }\n  | { action_type: ActionType.Transfer; deposit: string }\n  | { action_type: ActionType.Stake; stake: string; public_key: string }\n  | { action_type: ActionType.AddKey; public_key: string; access_key: string }\n  | { action_type: ActionType.DeleteKey; public_key: string }\n  | { action_type: ActionType.DeleteAccount; beneficiary_id: string }\n  | {\n    action_type: ActionType.SignedDelegate;\n    delegate_action: DelegateAction;\n    signature: Signature;\n  }\n  | { action_type: ActionType.DeployGlobalContract; code: number[]; deploy_mode: 'CodeHash' | 'AccountId' }\n  | { action_type: ActionType.UseGlobalContract; account_id?: string; code_hash?: string }\n\nexport function isActionArgsWasm(a?: any): a is ActionArgsWasm {\n  return isObject(a) && 'action_type' in a;\n}\n\nexport function toActionArgsWasm(action: ActionArgs): ActionArgsWasm {\n  switch (action.type) {\n    case ActionType.Transfer:\n      return {\n        action_type: ActionType.Transfer,\n        deposit: action.amount\n      };\n\n    case ActionType.FunctionCall:\n      return {\n        action_type: ActionType.FunctionCall,\n        method_name: action.methodName,\n        args: JSON.stringify(action.args),\n        gas: action.gas || \"30000000000000\",\n        deposit: action.deposit || \"0\"\n      };\n\n    case ActionType.AddKey:\n      // Ensure access key has proper format with nonce and permission object.\n      // For FullAccess we emit the NEAR-style `{ FullAccess: {} }` shape to\n      // match near-api-js and RPC JSON; FunctionCall permissions are passed\n      // through as-is.\n      const rawPermission = action.accessKey.permission;\n      const permission = rawPermission === 'FullAccess'\n          ? { FullAccess: {} }\n          : rawPermission;\n      const accessKey = {\n        nonce: action.accessKey.nonce || 0,\n        permission,\n      };\n      return {\n        action_type: ActionType.AddKey,\n        public_key: action.publicKey,\n        access_key: JSON.stringify(accessKey)\n      };\n\n    case ActionType.DeleteKey:\n      return {\n        action_type: ActionType.DeleteKey,\n        public_key: action.publicKey\n      };\n\n    case ActionType.CreateAccount:\n      return {\n        action_type: ActionType.CreateAccount\n      };\n\n    case ActionType.DeleteAccount:\n      return {\n        action_type: ActionType.DeleteAccount,\n        beneficiary_id: action.beneficiaryId\n      };\n\n    case ActionType.DeployContract:\n      return {\n        action_type: ActionType.DeployContract,\n        code: typeof action.code === 'string'\n          ? Array.from(new TextEncoder().encode(action.code))\n          : Array.from(action.code)\n      };\n\n    case ActionType.DeployGlobalContract:\n      return {\n        action_type: ActionType.DeployGlobalContract,\n        code: typeof action.code === 'string'\n          ? Array.from(new TextEncoder().encode(action.code))\n          : Array.from(action.code),\n        deploy_mode: action.deployMode,\n      };\n\n    case ActionType.UseGlobalContract:\n      return {\n        action_type: ActionType.UseGlobalContract,\n        account_id: action.accountId,\n        code_hash: action.codeHash,\n      };\n\n    case ActionType.Stake:\n      return {\n        action_type: ActionType.Stake,\n        stake: action.stake,\n        public_key: action.publicKey\n      };\n\n    default:\n      throw new Error(`Action type ${(action as any).type} is not supported`);\n  }\n}\n\n// === ACTION TYPE VALIDATION ===\n\n/**\n * Validate action parameters before sending to worker\n */\nexport function validateActionArgsWasm(actionArgsWasm: ActionArgsWasm): void {\n  switch (actionArgsWasm.action_type) {\n    case ActionType.FunctionCall:\n      if (!actionArgsWasm.method_name) {\n        throw new Error('method_name required for FunctionCall');\n      }\n      if (!actionArgsWasm.args) {\n        throw new Error('args required for FunctionCall');\n      }\n      if (!actionArgsWasm.gas) {\n        throw new Error('gas required for FunctionCall');\n      }\n      if (!actionArgsWasm.deposit) {\n        throw new Error('deposit required for FunctionCall');\n      }\n      // Validate args is valid JSON string\n      if (typeof actionArgsWasm.args !== 'string') {\n        throw new Error('FunctionCall action args must be a valid JSON string');\n      }\n      try {\n        JSON.parse(actionArgsWasm.args);\n      } catch {\n        throw new Error('FunctionCall action args must be valid JSON string');\n      }\n      break;\n    case ActionType.Transfer:\n      if (!actionArgsWasm.deposit) {\n        throw new Error('deposit required for Transfer');\n      }\n      break;\n    case ActionType.CreateAccount:\n      // No additional validation needed\n      break;\n    case ActionType.DeployContract:\n      if (!actionArgsWasm.code || actionArgsWasm.code.length === 0) {\n        throw new Error('code required for DeployContract');\n      }\n      break;\n    case ActionType.Stake:\n      if (!actionArgsWasm.stake) {\n        throw new Error('stake amount required for Stake');\n      }\n      if (!actionArgsWasm.public_key) {\n        throw new Error('public_key required for Stake');\n      }\n      break;\n    case ActionType.AddKey:\n      if (!actionArgsWasm.public_key) {\n        throw new Error('public_key required for AddKey');\n      }\n      if (!actionArgsWasm.access_key) {\n        throw new Error('access_key required for AddKey');\n      }\n      // Validate access_key is valid JSON string\n      if (typeof actionArgsWasm.access_key !== 'string') {\n        throw new Error('AddKey action access_key must be a valid JSON string');\n      }\n      try {\n        JSON.parse(actionArgsWasm.access_key);\n      } catch {\n        throw new Error('AddKey action access_key must be valid JSON string');\n      }\n      break;\n    case ActionType.DeleteKey:\n      if (!actionArgsWasm.public_key) {\n        throw new Error('public_key required for DeleteKey');\n      }\n      break;\n    case ActionType.DeleteAccount:\n      if (!actionArgsWasm.beneficiary_id) {\n        throw new Error('beneficiary_id required for DeleteAccount');\n      }\n      break;\n    case ActionType.SignedDelegate: {\n      const payload = actionArgsWasm as {\n        delegate_action?: unknown;\n        signature?: unknown;\n      };\n      if (!payload.delegate_action || typeof payload.delegate_action !== 'object') {\n        throw new Error('delegate_action required for SignedDelegate');\n      }\n      if (!payload.signature || typeof payload.signature !== 'object') {\n        throw new Error('signature required for SignedDelegate');\n      }\n      break;\n    }\n    case ActionType.DeployGlobalContract:\n      if (!actionArgsWasm.code || actionArgsWasm.code.length === 0) {\n        throw new Error('code required for DeployGlobalContract');\n      }\n      if (!actionArgsWasm.deploy_mode || (actionArgsWasm.deploy_mode !== 'CodeHash' && actionArgsWasm.deploy_mode !== 'AccountId')) {\n        throw new Error('deploy_mode must be CodeHash or AccountId for DeployGlobalContract');\n      }\n      break;\n    case ActionType.UseGlobalContract: {\n      const hasAccountId = !!actionArgsWasm.account_id;\n      const hasCodeHash = !!actionArgsWasm.code_hash;\n      if (hasAccountId === hasCodeHash) {\n        throw new Error('UseGlobalContract requires exactly one of account_id or code_hash');\n      }\n      break;\n    }\n    default:\n      throw new Error(`Unsupported action type: ${(actionArgsWasm as any).action_type}`);\n  }\n}\n\n// === CONVERSIONS: WASM -> JS ACTIONS ===\n\ninterface FunctionCallPermissionView {\n  FunctionCall: {\n    allowance: string;\n    receiver_id: string;\n    method_names: string[];\n  };\n}\n\n/**\n * Convert a single ActionArgsWasm (snake_case, stringified fields) to ActionArgs (camelCase, typed fields)\n */\nexport function fromActionArgsWasm(a: ActionArgsWasm): ActionArgs {\n  switch (a.action_type) {\n    case ActionType.FunctionCall: {\n      let parsedArgs: Record<string, any> = {};\n      try {\n        if (typeof a.args === 'string') {\n          parsedArgs = a.args ? JSON.parse(a.args) : {};\n        } else {\n          parsedArgs = a.args || {};\n        }\n      } catch {\n        // leave as empty object if parsing fails\n        parsedArgs = {};\n      }\n      return {\n        type: ActionType.FunctionCall,\n        methodName: a.method_name,\n        args: parsedArgs,\n        gas: a.gas,\n        deposit: a.deposit\n      };\n    }\n    case ActionType.Transfer:\n      return {\n        type: ActionType.Transfer,\n        amount: a.deposit\n      };\n    case ActionType.CreateAccount:\n      return {\n        type: ActionType.CreateAccount\n      };\n    case ActionType.DeployContract: {\n      // Represent code as Uint8Array for consistency\n      const codeBytes = Array.isArray(a.code) ? new Uint8Array(a.code) : new Uint8Array();\n      return {\n        type: ActionType.DeployContract,\n        code: codeBytes\n      };\n    }\n    case ActionType.DeployGlobalContract: {\n      const codeBytes = Array.isArray(a.code) ? new Uint8Array(a.code) : new Uint8Array();\n      return {\n        type: ActionType.DeployGlobalContract,\n        code: codeBytes,\n        deployMode: a.deploy_mode,\n      };\n    }\n    case ActionType.Stake:\n      return {\n        type: ActionType.Stake,\n        stake: a.stake,\n        publicKey: a.public_key\n      };\n    case ActionType.AddKey: {\n      // access_key is a JSON string of { nonce, permission: ... }\n      let accessKey: { nonce: bigint; permission: 'FullAccess' | FunctionCallPermissionView; }\n      try {\n        accessKey = JSON.parse(a.access_key);\n      } catch {\n        accessKey = { nonce: BigInt(0), permission: 'FullAccess' };\n      }\n      // Normalize permission back to SDK shape\n      const permission = accessKey?.permission;\n      let normalizedPermission: 'FullAccess' | FunctionCallPermissionView = 'FullAccess';\n\n      if (isObject(permission)) {\n        if ('FullAccess' in permission) {\n          normalizedPermission = 'FullAccess';\n        } else if ('FunctionCall' in permission) {\n          const fc = (permission as FunctionCallPermissionView).FunctionCall;\n          normalizedPermission = {\n            FunctionCall: {\n              allowance: fc.allowance,\n              receiver_id: fc.receiver_id,\n              method_names: fc.method_names\n            }\n          };\n        }\n      }\n      return {\n        type: ActionType.AddKey,\n        publicKey: a.public_key,\n        accessKey: {\n          nonce: typeof accessKey?.nonce === 'number' ? accessKey.nonce : 0,\n          permission: normalizedPermission\n        }\n      };\n    }\n    case ActionType.DeleteKey:\n      return {\n        type: ActionType.DeleteKey,\n        publicKey: a.public_key\n      };\n    case ActionType.DeleteAccount:\n      return {\n        type: ActionType.DeleteAccount,\n        beneficiaryId: a.beneficiary_id\n      };\n    case ActionType.UseGlobalContract:\n      return {\n        type: ActionType.UseGlobalContract,\n        accountId: a.account_id,\n        codeHash: a.code_hash,\n      };\n    default:\n      // Exhaustive guard\n      throw new Error(`Unsupported wasm action_type: ${(a as any)?.action_type}`);\n  }\n}\n\n/** Convert a TransactionInputWasm structure to TransactionInput */\nexport function fromTransactionInputWasm(tx: TransactionInputWasm): TransactionInput {\n  return {\n    receiverId: tx.receiverId,\n    actions: tx.actions.map(fromActionArgsWasm)\n  };\n}\n\n/** Convert an array of TransactionInputWasm to TransactionInput[] */\nexport function fromTransactionInputsWasm(txs: TransactionInputWasm[]): TransactionInput[] {\n  return (txs || []).map(fromTransactionInputWasm);\n}\nimport { isObject } from '@/utils/validation';\n"],"mappings":";;;;;;AAkBA,IAAY,oDAAL;AACL;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;;AAgJF,SAAgB,iBAAiB,GAA8B;AAC7D,QAAO,SAAS,MAAM,iBAAiB;;AAGzC,SAAgB,iBAAiB,QAAoC;AACnE,SAAQ,OAAO,MAAf;EACE,KAAK,WAAW,SACd,QAAO;GACL,aAAa,WAAW;GACxB,SAAS,OAAO;;EAGpB,KAAK,WAAW,aACd,QAAO;GACL,aAAa,WAAW;GACxB,aAAa,OAAO;GACpB,MAAM,KAAK,UAAU,OAAO;GAC5B,KAAK,OAAO,OAAO;GACnB,SAAS,OAAO,WAAW;;EAG/B,KAAK,WAAW;GAKd,MAAM,gBAAgB,OAAO,UAAU;GACvC,MAAM,aAAa,kBAAkB,eAC/B,EAAE,YAAY,OACd;GACN,MAAM,YAAY;IAChB,OAAO,OAAO,UAAU,SAAS;IACjC;;AAEF,UAAO;IACL,aAAa,WAAW;IACxB,YAAY,OAAO;IACnB,YAAY,KAAK,UAAU;;EAG/B,KAAK,WAAW,UACd,QAAO;GACL,aAAa,WAAW;GACxB,YAAY,OAAO;;EAGvB,KAAK,WAAW,cACd,QAAO,EACL,aAAa,WAAW;EAG5B,KAAK,WAAW,cACd,QAAO;GACL,aAAa,WAAW;GACxB,gBAAgB,OAAO;;EAG3B,KAAK,WAAW,eACd,QAAO;GACL,aAAa,WAAW;GACxB,MAAM,OAAO,OAAO,SAAS,WACzB,MAAM,KAAK,IAAI,cAAc,OAAO,OAAO,SAC3C,MAAM,KAAK,OAAO;;EAG1B,KAAK,WAAW,qBACd,QAAO;GACL,aAAa,WAAW;GACxB,MAAM,OAAO,OAAO,SAAS,WACzB,MAAM,KAAK,IAAI,cAAc,OAAO,OAAO,SAC3C,MAAM,KAAK,OAAO;GACtB,aAAa,OAAO;;EAGxB,KAAK,WAAW,kBACd,QAAO;GACL,aAAa,WAAW;GACxB,YAAY,OAAO;GACnB,WAAW,OAAO;;EAGtB,KAAK,WAAW,MACd,QAAO;GACL,aAAa,WAAW;GACxB,OAAO,OAAO;GACd,YAAY,OAAO;;EAGvB,QACE,OAAM,IAAI,MAAM,eAAgB,OAAe,KAAK;;;;;;AAS1D,SAAgB,uBAAuB,gBAAsC;AAC3E,SAAQ,eAAe,aAAvB;EACE,KAAK,WAAW;AACd,OAAI,CAAC,eAAe,YAClB,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,eAAe,KAClB,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,eAAe,IAClB,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,eAAe,QAClB,OAAM,IAAI,MAAM;AAGlB,OAAI,OAAO,eAAe,SAAS,SACjC,OAAM,IAAI,MAAM;AAElB,OAAI;AACF,SAAK,MAAM,eAAe;WACpB;AACN,UAAM,IAAI,MAAM;;AAElB;EACF,KAAK,WAAW;AACd,OAAI,CAAC,eAAe,QAClB,OAAM,IAAI,MAAM;AAElB;EACF,KAAK,WAAW,cAEd;EACF,KAAK,WAAW;AACd,OAAI,CAAC,eAAe,QAAQ,eAAe,KAAK,WAAW,EACzD,OAAM,IAAI,MAAM;AAElB;EACF,KAAK,WAAW;AACd,OAAI,CAAC,eAAe,MAClB,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,eAAe,WAClB,OAAM,IAAI,MAAM;AAElB;EACF,KAAK,WAAW;AACd,OAAI,CAAC,eAAe,WAClB,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,eAAe,WAClB,OAAM,IAAI,MAAM;AAGlB,OAAI,OAAO,eAAe,eAAe,SACvC,OAAM,IAAI,MAAM;AAElB,OAAI;AACF,SAAK,MAAM,eAAe;WACpB;AACN,UAAM,IAAI,MAAM;;AAElB;EACF,KAAK,WAAW;AACd,OAAI,CAAC,eAAe,WAClB,OAAM,IAAI,MAAM;AAElB;EACF,KAAK,WAAW;AACd,OAAI,CAAC,eAAe,eAClB,OAAM,IAAI,MAAM;AAElB;EACF,KAAK,WAAW,gBAAgB;GAC9B,MAAM,UAAU;AAIhB,OAAI,CAAC,QAAQ,mBAAmB,OAAO,QAAQ,oBAAoB,SACjE,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,SACrD,OAAM,IAAI,MAAM;AAElB;;EAEF,KAAK,WAAW;AACd,OAAI,CAAC,eAAe,QAAQ,eAAe,KAAK,WAAW,EACzD,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,eAAe,eAAgB,eAAe,gBAAgB,cAAc,eAAe,gBAAgB,YAC9G,OAAM,IAAI,MAAM;AAElB;EACF,KAAK,WAAW,mBAAmB;GACjC,MAAM,eAAe,CAAC,CAAC,eAAe;GACtC,MAAM,cAAc,CAAC,CAAC,eAAe;AACrC,OAAI,iBAAiB,YACnB,OAAM,IAAI,MAAM;AAElB;;EAEF,QACE,OAAM,IAAI,MAAM,4BAA6B,eAAuB;;;;;;AAiB1E,SAAgB,mBAAmB,GAA+B;AAChE,SAAQ,EAAE,aAAV;EACE,KAAK,WAAW,cAAc;GAC5B,IAAIA,aAAkC;AACtC,OAAI;AACF,QAAI,OAAO,EAAE,SAAS,SACpB,cAAa,EAAE,OAAO,KAAK,MAAM,EAAE,QAAQ;QAE3C,cAAa,EAAE,QAAQ;WAEnB;AAEN,iBAAa;;AAEf,UAAO;IACL,MAAM,WAAW;IACjB,YAAY,EAAE;IACd,MAAM;IACN,KAAK,EAAE;IACP,SAAS,EAAE;;;EAGf,KAAK,WAAW,SACd,QAAO;GACL,MAAM,WAAW;GACjB,QAAQ,EAAE;;EAEd,KAAK,WAAW,cACd,QAAO,EACL,MAAM,WAAW;EAErB,KAAK,WAAW,gBAAgB;GAE9B,MAAM,YAAY,MAAM,QAAQ,EAAE,QAAQ,IAAI,WAAW,EAAE,QAAQ,IAAI;AACvE,UAAO;IACL,MAAM,WAAW;IACjB,MAAM;;;EAGV,KAAK,WAAW,sBAAsB;GACpC,MAAM,YAAY,MAAM,QAAQ,EAAE,QAAQ,IAAI,WAAW,EAAE,QAAQ,IAAI;AACvE,UAAO;IACL,MAAM,WAAW;IACjB,MAAM;IACN,YAAY,EAAE;;;EAGlB,KAAK,WAAW,MACd,QAAO;GACL,MAAM,WAAW;GACjB,OAAO,EAAE;GACT,WAAW,EAAE;;EAEjB,KAAK,WAAW,QAAQ;GAEtB,IAAIC;AACJ,OAAI;AACF,gBAAY,KAAK,MAAM,EAAE;WACnB;AACN,gBAAY;KAAE,OAAO,OAAO;KAAI,YAAY;;;GAG9C,MAAM,aAAa,WAAW;GAC9B,IAAIC,uBAAkE;AAEtE,OAAI,SAAS,aACX;QAAI,gBAAgB,WAClB,wBAAuB;aACd,kBAAkB,YAAY;KACvC,MAAM,KAAM,WAA0C;AACtD,4BAAuB,EACrB,cAAc;MACZ,WAAW,GAAG;MACd,aAAa,GAAG;MAChB,cAAc,GAAG;;;;AAKzB,UAAO;IACL,MAAM,WAAW;IACjB,WAAW,EAAE;IACb,WAAW;KACT,OAAO,OAAO,WAAW,UAAU,WAAW,UAAU,QAAQ;KAChE,YAAY;;;;EAIlB,KAAK,WAAW,UACd,QAAO;GACL,MAAM,WAAW;GACjB,WAAW,EAAE;;EAEjB,KAAK,WAAW,cACd,QAAO;GACL,MAAM,WAAW;GACjB,eAAe,EAAE;;EAErB,KAAK,WAAW,kBACd,QAAO;GACL,MAAM,WAAW;GACjB,WAAW,EAAE;GACb,UAAU,EAAE;;EAEhB,QAEE,OAAM,IAAI,MAAM,iCAAkC,GAAW;;;;AAKnE,SAAgB,yBAAyB,IAA4C;AACnF,QAAO;EACL,YAAY,GAAG;EACf,SAAS,GAAG,QAAQ,IAAI;;;;AAK5B,SAAgB,0BAA0B,KAAiD;AACzF,SAAQ,OAAO,IAAI,IAAI"}