@tatchi-xyz/sdk 0.21.0 → 0.31.0

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/checkCanRegisterUser.js

@@ -0,0 +1,67 @@
+import { isObject, isString } from "../../../../utils/validation.js";
+import { errorMessage } from "../../../../utils/errors.js";
+import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from "../../../defaultConfigs.js";
+import { removePrfOutputGuard, serializeRegistrationCredentialWithPRF } from "../../credentialsHelpers.js";
+import { RegistrationPhase, RegistrationStatus } from "../../../types/sdkSentEvents.js";
+import { checkCanRegisterUserContractCall } from "../../../rpcCalls.js";
+
+//#region src/core/WebAuthnManager/SignerWorkerManager/handlers/checkCanRegisterUser.ts
+async function checkCanRegisterUser({ ctx, vrfChallenge, credential, contractId, nearRpcUrl, authenticatorOptions, onEvent }) {
+	try {
+		const isSerialized = (cred) => {
+			if (!isObject(cred)) return false;
+			const resp = cred.response;
+			if (!isObject(resp)) return false;
+			return isString(resp.clientDataJSON) && isString(resp.attestationObject);
+		};
+		const serializedCredential = isSerialized(credential) ? credential : serializeRegistrationCredentialWithPRF({ credential });
+		const resolvedContractId = contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId;
+		onEvent?.({
+			step: 3,
+			phase: RegistrationPhase.STEP_3_CONTRACT_PRE_CHECK,
+			status: RegistrationStatus.PROGRESS,
+			message: "Running webauthn contract registration checks..."
+		});
+		const strippedCredential = removePrfOutputGuard(serializedCredential);
+		const result = await checkCanRegisterUserContractCall({
+			nearClient: ctx.nearClient,
+			contractId: resolvedContractId,
+			vrfChallenge,
+			credential: strippedCredential,
+			authenticatorOptions
+		});
+		if (!result.success) throw new Error(result.error || "Registration pre-check RPC failed");
+		const wasmResult = {
+			verified: result.verified,
+			registrationInfo: void 0,
+			logs: result.logs,
+			error: result.error
+		};
+		onEvent?.({
+			step: 3,
+			phase: RegistrationPhase.STEP_3_CONTRACT_PRE_CHECK,
+			status: result.verified ? RegistrationStatus.SUCCESS : RegistrationStatus.ERROR,
+			message: result.verified ? "Registration pre-check succeeded" : result.error || "Registration pre-check failed",
+			...result.verified ? {} : { error: result.error || "Registration pre-check failed" }
+		});
+		return {
+			success: true,
+			verified: wasmResult.verified,
+			registrationInfo: wasmResult.registrationInfo,
+			logs: wasmResult.logs,
+			error: wasmResult.error
+		};
+	} catch (error) {
+		console.error("checkCanRegisterUser failed:", error);
+		return {
+			success: false,
+			verified: false,
+			error: errorMessage(error) || "Unknown error occurred",
+			logs: []
+		};
+	}
+}
+
+//#endregion
+export { checkCanRegisterUser };
+//# sourceMappingURL=checkCanRegisterUser.js.map

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/checkCanRegisterUser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkCanRegisterUser.js","names":["serializedCredential: WebAuthnRegistrationCredential","result: CheckCanRegisterUserResult","error: unknown"],"sources":["../../../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/checkCanRegisterUser.ts"],"sourcesContent":["\nimport { PASSKEY_MANAGER_DEFAULT_CONFIGS } from \"../../../defaultConfigs\";\nimport type { CheckCanRegisterUserResult } from '../../../rpcCalls';\nimport { checkCanRegisterUserContractCall } from '../../../rpcCalls';\nimport { serializeRegistrationCredentialWithPRF, removePrfOutputGuard } from '../../credentialsHelpers';\nimport { VRFChallenge } from '../../../types/vrf-worker';\nimport { RegistrationPhase, RegistrationStatus, type RegistrationEventStep3 } from '../../../types/sdkSentEvents';\nimport type { AuthenticatorOptions } from '../../../types/authenticatorOptions';\nimport { SignerWorkerManagerContext } from '..';\nimport type { WebAuthnRegistrationCredential } from '../../../types/webauthn';\nimport { errorMessage } from '@/utils/errors';\nimport { isObject, isString } from '@/utils/validation';\n\n\nexport async function checkCanRegisterUser({\n  ctx,\n  vrfChallenge,\n  credential,\n  contractId,\n  nearRpcUrl,\n  authenticatorOptions,\n  onEvent,\n}: {\n  ctx: SignerWorkerManagerContext,\n  vrfChallenge: VRFChallenge,\n  credential: WebAuthnRegistrationCredential,\n  contractId: string;\n  nearRpcUrl: string;\n  authenticatorOptions?: AuthenticatorOptions; // Authenticator options for registration check\n  onEvent?: (update: RegistrationEventStep3) => void;\n}): Promise<{\n  success: boolean;\n  verified?: boolean;\n  registrationInfo?: {\n    credentialId: Uint8Array;\n    credentialPublicKey: Uint8Array;\n    userId: string;\n    vrfPublicKey: Uint8Array | undefined;\n  };\n  logs?: string[];\n  signedTransactionBorsh?: number[];\n  error?: string;\n}> {\n  try {\n    // Accept either a real PublicKeyCredential or an already-serialized credential\n    const isSerialized = (cred: unknown): cred is WebAuthnRegistrationCredential => {\n      if (!isObject(cred)) return false;\n      const resp = (cred as { response?: unknown }).response;\n      if (!isObject(resp)) return false;\n      return isString((resp as { clientDataJSON?: unknown }).clientDataJSON)\n        && isString((resp as { attestationObject?: unknown }).attestationObject);\n    };\n\n    const serializedCredential: WebAuthnRegistrationCredential = isSerialized(credential)\n      ? credential\n      : serializeRegistrationCredentialWithPRF({ credential: credential });\n\n    // Ensure required fields are present; avoid undefined which gets dropped by JSON.stringify in the worker\n    const resolvedContractId = contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId;\n\n    onEvent?.({\n      step: 3,\n      phase: RegistrationPhase.STEP_3_CONTRACT_PRE_CHECK,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Running webauthn contract registration checks...',\n    });\n\n    // PRF outputs must never be sent over the network. Strip them before\n    // calling the contract while preserving the rest of the credential shape.\n    const strippedCredential = removePrfOutputGuard<WebAuthnRegistrationCredential>(serializedCredential);\n\n    const result: CheckCanRegisterUserResult = await checkCanRegisterUserContractCall({\n      nearClient: ctx.nearClient,\n      contractId: resolvedContractId,\n      vrfChallenge,\n      credential: strippedCredential,\n      authenticatorOptions,\n    });\n\n    if (!result.success) {\n      throw new Error(result.error || 'Registration pre-check RPC failed');\n    }\n\n    const wasmResult = {\n      verified: result.verified,\n      registrationInfo: undefined,\n      logs: result.logs,\n      error: result.error,\n    };\n\n    onEvent?.({\n      step: 3,\n      phase: RegistrationPhase.STEP_3_CONTRACT_PRE_CHECK,\n      status: result.verified ? RegistrationStatus.SUCCESS : RegistrationStatus.ERROR,\n      message: result.verified ? 'Registration pre-check succeeded' : (result.error || 'Registration pre-check failed'),\n      ...(result.verified ? {} : { error: result.error || 'Registration pre-check failed' }),\n    });\n\n    return {\n      success: true,\n      verified: wasmResult.verified,\n      registrationInfo: wasmResult.registrationInfo,\n      logs: wasmResult.logs,\n      error: wasmResult.error,\n    };\n\n  } catch (error: unknown) {\n    // Preserve the detailed error message instead of converting to generic error\n    console.error('checkCanRegisterUser failed:', error);\n    return {\n      success: false,\n      verified: false,\n      error: errorMessage(error) || 'Unknown error occurred',\n      logs: [],\n    };\n  }\n}\n"],"mappings":";;;;;;;;AAcA,eAAsB,qBAAqB,EACzC,KACA,cACA,YACA,YACA,YACA,sBACA,WAqBC;AACD,KAAI;EAEF,MAAM,gBAAgB,SAA0D;AAC9E,OAAI,CAAC,SAAS,MAAO,QAAO;GAC5B,MAAM,OAAQ,KAAgC;AAC9C,OAAI,CAAC,SAAS,MAAO,QAAO;AAC5B,UAAO,SAAU,KAAsC,mBAClD,SAAU,KAAyC;;EAG1D,MAAMA,uBAAuD,aAAa,cACtE,aACA,uCAAuC,EAAc;EAGzD,MAAM,qBAAqB,cAAc,gCAAgC;AAEzE,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;EAKX,MAAM,qBAAqB,qBAAqD;EAEhF,MAAMC,SAAqC,MAAM,iCAAiC;GAChF,YAAY,IAAI;GAChB,YAAY;GACZ;GACA,YAAY;GACZ;;AAGF,MAAI,CAAC,OAAO,QACV,OAAM,IAAI,MAAM,OAAO,SAAS;EAGlC,MAAM,aAAa;GACjB,UAAU,OAAO;GACjB,kBAAkB;GAClB,MAAM,OAAO;GACb,OAAO,OAAO;;AAGhB,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,OAAO,WAAW,mBAAmB,UAAU,mBAAmB;GAC1E,SAAS,OAAO,WAAW,qCAAsC,OAAO,SAAS;GACjF,GAAI,OAAO,WAAW,KAAK,EAAE,OAAO,OAAO,SAAS;;AAGtD,SAAO;GACL,SAAS;GACT,UAAU,WAAW;GACrB,kBAAkB,WAAW;GAC7B,MAAM,WAAW;GACjB,OAAO,WAAW;;UAGbC,OAAgB;AAEvB,UAAQ,MAAM,gCAAgC;AAC9C,SAAO;GACL,SAAS;GACT,UAAU;GACV,OAAO,aAAa,UAAU;GAC9B,MAAM"}

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/decryptPrivateKeyWithPrf.js

@@ -0,0 +1,42 @@
+import { isObject } from "../../../../utils/validation.js";
+import { toAccountId } from "../../../types/accountIds.js";
+import { WorkerRequestType, isDecryptPrivateKeyWithPrfSuccess } from "../../../types/signer-worker.js";
+import { getLastLoggedInDeviceNumber } from "../getDeviceNumber.js";
+import { withSessionId } from "./session.js";
+
+//#region src/core/WebAuthnManager/SignerWorkerManager/handlers/decryptPrivateKeyWithPrf.ts
+async function decryptPrivateKeyWithPrf({ ctx, nearAccountId, authenticators, sessionId }) {
+	try {
+		console.info("WebAuthnManager: Starting private key decryption with dual PRF (local operation)");
+		const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);
+		const keyMaterial = await ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber);
+		if (!keyMaterial) throw new Error(`No key material found for account: ${nearAccountId}`);
+		const response = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: WorkerRequestType.DecryptPrivateKeyWithPrf,
+				payload: withSessionId(sessionId, {
+					nearAccountId,
+					encryptedPrivateKeyData: keyMaterial.encryptedSk,
+					encryptedPrivateKeyChacha20NonceB64u: keyMaterial.chacha20NonceB64u
+				})
+			}
+		});
+		if (!isDecryptPrivateKeyWithPrfSuccess(response)) {
+			console.error("WebAuthnManager: Dual PRF private key decryption failed:", response);
+			const payloadError = isObject(response?.payload) && response?.payload?.error;
+			throw new Error(payloadError || "Private key decryption failed");
+		}
+		return {
+			decryptedPrivateKey: response.payload.privateKey,
+			nearAccountId: toAccountId(response.payload.nearAccountId)
+		};
+	} catch (error) {
+		console.error("WebAuthnManager: Dual PRF private key decryption error:", error);
+		throw error;
+	}
+}
+
+//#endregion
+export { decryptPrivateKeyWithPrf };
+//# sourceMappingURL=decryptPrivateKeyWithPrf.js.map

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/decryptPrivateKeyWithPrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decryptPrivateKeyWithPrf.js","names":["error: unknown"],"sources":["../../../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/decryptPrivateKeyWithPrf.ts"],"sourcesContent":["\nimport { ClientAuthenticatorData } from '../../../IndexedDBManager';\nimport {\n  WorkerRequestType,\n  isDecryptPrivateKeyWithPrfSuccess,\n} from '../../../types/signer-worker';\nimport { AccountId, toAccountId } from \"../../../types/accountIds\";\n\nimport { SignerWorkerManagerContext } from '..';\nimport { getLastLoggedInDeviceNumber } from '../getDeviceNumber';\nimport { isObject } from '@/utils/validation';\nimport { withSessionId } from './session';\n\nexport async function decryptPrivateKeyWithPrf({\n  ctx,\n  nearAccountId,\n  authenticators,\n  sessionId,\n}: {\n  ctx: SignerWorkerManagerContext,\n  nearAccountId: AccountId,\n  authenticators: ClientAuthenticatorData[],\n  sessionId: string,\n}): Promise<{ decryptedPrivateKey: string; nearAccountId: AccountId }> {\n  try {\n    console.info('WebAuthnManager: Starting private key decryption with dual PRF (local operation)');\n    // Retrieve encrypted key data from IndexedDB in main thread\n    const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);\n    const keyMaterial = await ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber);\n    if (!keyMaterial) {\n      throw new Error(`No key material found for account: ${nearAccountId}`);\n    }\n\n    const response = await ctx.sendMessage({\n      sessionId,\n      message: {\n        type: WorkerRequestType.DecryptPrivateKeyWithPrf,\n        payload: withSessionId(sessionId, {\n          nearAccountId: nearAccountId,\n          encryptedPrivateKeyData: keyMaterial.encryptedSk,\n          encryptedPrivateKeyChacha20NonceB64u: keyMaterial.chacha20NonceB64u,\n        })\n      },\n    });\n\n    if (!isDecryptPrivateKeyWithPrfSuccess(response)) {\n      console.error('WebAuthnManager: Dual PRF private key decryption failed:', response);\n      const payloadError = isObject(response?.payload) && (response as any)?.payload?.error;\n      throw new Error(payloadError || 'Private key decryption failed');\n    }\n    return {\n      decryptedPrivateKey: response.payload.privateKey,\n      nearAccountId: toAccountId(response.payload.nearAccountId)\n    };\n  } catch (error: unknown) {\n    console.error('WebAuthnManager: Dual PRF private key decryption error:', error);\n    throw error;\n  }\n}\n"],"mappings":";;;;;;;AAaA,eAAsB,yBAAyB,EAC7C,KACA,eACA,gBACA,aAMqE;AACrE,KAAI;AACF,UAAQ,KAAK;EAEb,MAAM,eAAe,MAAM,4BAA4B,eAAe,IAAI,UAAU;EACpF,MAAM,cAAc,MAAM,IAAI,UAAU,WAAW,oBAAoB,eAAe;AACtF,MAAI,CAAC,YACH,OAAM,IAAI,MAAM,sCAAsC;EAGxD,MAAM,WAAW,MAAM,IAAI,YAAY;GACrC;GACA,SAAS;IACP,MAAM,kBAAkB;IACxB,SAAS,cAAc,WAAW;KACjB;KACf,yBAAyB,YAAY;KACrC,sCAAsC,YAAY;;;;AAKxD,MAAI,CAAC,kCAAkC,WAAW;AAChD,WAAQ,MAAM,4DAA4D;GAC1E,MAAM,eAAe,SAAS,UAAU,YAAa,UAAkB,SAAS;AAChF,SAAM,IAAI,MAAM,gBAAgB;;AAElC,SAAO;GACL,qBAAqB,SAAS,QAAQ;GACtC,eAAe,YAAY,SAAS,QAAQ;;UAEvCA,OAAgB;AACvB,UAAQ,MAAM,2DAA2D;AACzE,QAAM"}

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/deriveNearKeypairAndEncryptFromSerialized.js

@@ -0,0 +1,68 @@
+import { toAccountId } from "../../../types/accountIds.js";
+import { WorkerRequestType, isDeriveNearKeypairAndEncryptSuccess } from "../../../types/signer-worker.js";
+import { getLastLoggedInDeviceNumber } from "../getDeviceNumber.js";
+import { toEnumUserVerificationPolicy } from "../../../types/authenticatorOptions.js";
+import { withSessionId } from "./session.js";
+
+//#region src/core/WebAuthnManager/SignerWorkerManager/handlers/deriveNearKeypairAndEncryptFromSerialized.ts
+/**
+* Derive NEAR keypair and encrypt it from a serialized WebAuthn registration credential
+* (shape compatible with SerializedRegistrationCredential from WASM) by extracting PRF outputs from it.
+*/
+async function deriveNearKeypairAndEncryptFromSerialized({ ctx, credential, nearAccountId, options, sessionId }) {
+	try {
+		if (!sessionId) throw new Error("Missing sessionId for registration WrapKeySeed delivery");
+		const response = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: WorkerRequestType.DeriveNearKeypairAndEncrypt,
+				payload: withSessionId(sessionId, {
+					nearAccountId,
+					credential,
+					authenticatorOptions: options?.authenticatorOptions ? {
+						userVerification: toEnumUserVerificationPolicy(options.authenticatorOptions.userVerification),
+						originPolicy: options.authenticatorOptions.originPolicy
+					} : void 0
+				})
+			}
+		});
+		if (!isDeriveNearKeypairAndEncryptSuccess(response)) throw new Error("Dual PRF registration (from serialized) failed");
+		const wasmResult = response.payload;
+		const wrapKeySaltPersisted = wasmResult.wrapKeySalt;
+		if (!wrapKeySaltPersisted) throw new Error("Missing wrapKeySalt in deriveNearKeypairAndEncrypt result");
+		const deviceNumber = typeof options?.deviceNumber === "number" ? options.deviceNumber : await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);
+		const chacha20NonceB64u = wasmResult.chacha20NonceB64u;
+		if (!chacha20NonceB64u) throw new Error("Missing chacha20NonceB64u in deriveNearKeypairAndEncrypt result");
+		const keyMaterial = {
+			kind: "local_near_sk_v3",
+			nearAccountId,
+			deviceNumber,
+			publicKey: wasmResult.publicKey,
+			encryptedSk: wasmResult.encryptedData,
+			chacha20NonceB64u,
+			wrapKeySalt: wrapKeySaltPersisted,
+			timestamp: Date.now()
+		};
+		await ctx.indexedDB.nearKeysDB.storeKeyMaterial(keyMaterial);
+		return {
+			success: true,
+			nearAccountId: toAccountId(wasmResult.nearAccountId),
+			publicKey: wasmResult.publicKey,
+			chacha20NonceB64u,
+			wrapKeySalt: wrapKeySaltPersisted
+		};
+	} catch (error) {
+		console.error("WebAuthnManager: deriveNearKeypairAndEncryptFromSerialized error:", error);
+		const message = String(error?.message || error || "");
+		return {
+			success: false,
+			nearAccountId,
+			publicKey: "",
+			error: message
+		};
+	}
+}
+
+//#endregion
+export { deriveNearKeypairAndEncryptFromSerialized };
+//# sourceMappingURL=deriveNearKeypairAndEncryptFromSerialized.js.map

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/deriveNearKeypairAndEncryptFromSerialized.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deriveNearKeypairAndEncryptFromSerialized.js","names":["keyMaterial: LocalNearSkV3Material","error: unknown"],"sources":["../../../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/deriveNearKeypairAndEncryptFromSerialized.ts"],"sourcesContent":["\nimport type { LocalNearSkV3Material } from '../../../IndexedDBManager/passkeyNearKeysDB';\nimport type { AuthenticatorOptions } from '../../../types/authenticatorOptions';\nimport {\n  WorkerRequestType,\n  isDeriveNearKeypairAndEncryptSuccess,\n} from '../../../types/signer-worker';\nimport { AccountId, toAccountId } from \"../../../types/accountIds\";\nimport { getLastLoggedInDeviceNumber } from '../getDeviceNumber';\nimport { SignerWorkerManagerContext } from '..';\nimport type { WebAuthnRegistrationCredential } from '@/core/types/webauthn';\nimport { toEnumUserVerificationPolicy } from '../../../types/authenticatorOptions';\nimport { withSessionId } from './session';\n\n/**\n * Derive NEAR keypair and encrypt it from a serialized WebAuthn registration credential\n * (shape compatible with SerializedRegistrationCredential from WASM) by extracting PRF outputs from it.\n */\nexport async function deriveNearKeypairAndEncryptFromSerialized({\n  ctx,\n  credential,\n  nearAccountId,\n  options,\n  sessionId,\n}: {\n  ctx: SignerWorkerManagerContext,\n  credential: WebAuthnRegistrationCredential;\n  nearAccountId: AccountId,\n  options?: {\n    authenticatorOptions?: AuthenticatorOptions;\n    deviceNumber?: number;\n  };\n  sessionId: string;\n}): Promise<{\n  success: boolean;\n  nearAccountId: AccountId;\n  publicKey: string;\n  /**\n   * Base64url-encoded AEAD nonce (ChaCha20-Poly1305) for the encrypted private key.\n   */\n  chacha20NonceB64u?: string;\n  wrapKeySalt?: string;\n  error?: string;\n}> {\n  try {\n    // PRF outputs are now extracted by VRF worker and delivered to signer worker via MessagePort\n    // No need to extract or send them through main thread\n    if (!sessionId) throw new Error('Missing sessionId for registration WrapKeySeed delivery');\n\n    const response = await ctx.sendMessage<WorkerRequestType.DeriveNearKeypairAndEncrypt>({\n      sessionId,\n      message: {\n        type: WorkerRequestType.DeriveNearKeypairAndEncrypt,\n        payload: withSessionId(sessionId, {\n          nearAccountId: nearAccountId,\n          credential,\n          authenticatorOptions: options?.authenticatorOptions ? {\n            userVerification: toEnumUserVerificationPolicy(options.authenticatorOptions.userVerification),\n            originPolicy: options.authenticatorOptions.originPolicy,\n          } : undefined,\n        })\n      },\n    });\n\n    if (!isDeriveNearKeypairAndEncryptSuccess(response)) {\n      throw new Error('Dual PRF registration (from serialized) failed');\n    }\n\n    const wasmResult = response.payload;\n    const wrapKeySaltPersisted = wasmResult.wrapKeySalt;\n    if (!wrapKeySaltPersisted) {\n      throw new Error('Missing wrapKeySalt in deriveNearKeypairAndEncrypt result');\n    }\n    // Prefer explicitly provided deviceNumber, else derive from IndexedDB state\n    const deviceNumber = (typeof options?.deviceNumber === 'number')\n      ? options!.deviceNumber!\n      : await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);\n    const chacha20NonceB64u = wasmResult.chacha20NonceB64u;\n    if (!chacha20NonceB64u) {\n      throw new Error('Missing chacha20NonceB64u in deriveNearKeypairAndEncrypt result');\n    }\n    const keyMaterial: LocalNearSkV3Material = {\n      kind: 'local_near_sk_v3',\n      nearAccountId,\n      deviceNumber,\n      publicKey: wasmResult.publicKey,\n      encryptedSk: wasmResult.encryptedData,\n      chacha20NonceB64u,\n      wrapKeySalt: wrapKeySaltPersisted,\n      timestamp: Date.now(),\n    };\n    await ctx.indexedDB.nearKeysDB.storeKeyMaterial(keyMaterial);\n\n    return {\n      success: true,\n      nearAccountId: toAccountId(wasmResult.nearAccountId),\n      publicKey: wasmResult.publicKey,\n      chacha20NonceB64u,\n      wrapKeySalt: wrapKeySaltPersisted,\n    };\n  } catch (error: unknown) {\n    console.error('WebAuthnManager: deriveNearKeypairAndEncryptFromSerialized error:', error);\n    const message = String((error as { message?: unknown })?.message || error || '');\n    return {\n      success: false,\n      nearAccountId,\n      publicKey: '',\n      error: message\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;AAkBA,eAAsB,0CAA0C,EAC9D,KACA,YACA,eACA,SACA,aAoBC;AACD,KAAI;AAGF,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM;EAEhC,MAAM,WAAW,MAAM,IAAI,YAA2D;GACpF;GACA,SAAS;IACP,MAAM,kBAAkB;IACxB,SAAS,cAAc,WAAW;KACjB;KACf;KACA,sBAAsB,SAAS,uBAAuB;MACpD,kBAAkB,6BAA6B,QAAQ,qBAAqB;MAC5E,cAAc,QAAQ,qBAAqB;SACzC;;;;AAKV,MAAI,CAAC,qCAAqC,UACxC,OAAM,IAAI,MAAM;EAGlB,MAAM,aAAa,SAAS;EAC5B,MAAM,uBAAuB,WAAW;AACxC,MAAI,CAAC,qBACH,OAAM,IAAI,MAAM;EAGlB,MAAM,eAAgB,OAAO,SAAS,iBAAiB,WACnD,QAAS,eACT,MAAM,4BAA4B,eAAe,IAAI,UAAU;EACnE,MAAM,oBAAoB,WAAW;AACrC,MAAI,CAAC,kBACH,OAAM,IAAI,MAAM;EAElB,MAAMA,cAAqC;GACzC,MAAM;GACN;GACA;GACA,WAAW,WAAW;GACtB,aAAa,WAAW;GACxB;GACA,aAAa;GACb,WAAW,KAAK;;AAElB,QAAM,IAAI,UAAU,WAAW,iBAAiB;AAEhD,SAAO;GACL,SAAS;GACT,eAAe,YAAY,WAAW;GACtC,WAAW,WAAW;GACtB;GACA,aAAa;;UAERC,OAAgB;AACvB,UAAQ,MAAM,qEAAqE;EACnF,MAAM,UAAU,OAAQ,OAAiC,WAAW,SAAS;AAC7E,SAAO;GACL,SAAS;GACT;GACA,WAAW;GACX,OAAO"}

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/deriveThresholdEd25519ClientVerifyingShare.js

@@ -0,0 +1,44 @@
+import { WorkerRequestType, WorkerResponseType } from "../../../types/signer-worker.js";
+
+//#region src/core/WebAuthnManager/SignerWorkerManager/handlers/deriveThresholdEd25519ClientVerifyingShare.ts
+async function deriveThresholdEd25519ClientVerifyingShare(args) {
+	const { ctx } = args;
+	const sessionId = args.sessionId;
+	const nearAccountId = args.nearAccountId;
+	try {
+		if (!sessionId) throw new Error("Missing sessionId");
+		if (!nearAccountId) throw new Error("Missing nearAccountId");
+		const response = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: WorkerRequestType.DeriveThresholdEd25519ClientVerifyingShare,
+				payload: { nearAccountId }
+			}
+		});
+		if (response.type !== WorkerResponseType.DeriveThresholdEd25519ClientVerifyingShareSuccess) throw new Error("DeriveThresholdEd25519ClientVerifyingShare failed");
+		const wasmResult = response.payload;
+		const clientVerifyingShareB64u = wasmResult?.clientVerifyingShareB64u;
+		const wrapKeySalt = wasmResult?.wrapKeySalt;
+		if (!clientVerifyingShareB64u) throw new Error("Missing clientVerifyingShareB64u in worker response");
+		if (!wrapKeySalt) throw new Error("Missing wrapKeySalt in worker response");
+		return {
+			success: true,
+			nearAccountId,
+			clientVerifyingShareB64u,
+			wrapKeySalt
+		};
+	} catch (error) {
+		const message = String(error?.message ?? error);
+		return {
+			success: false,
+			nearAccountId,
+			clientVerifyingShareB64u: "",
+			wrapKeySalt: "",
+			error: message
+		};
+	}
+}
+
+//#endregion
+export { deriveThresholdEd25519ClientVerifyingShare };
+//# sourceMappingURL=deriveThresholdEd25519ClientVerifyingShare.js.map

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/deriveThresholdEd25519ClientVerifyingShare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deriveThresholdEd25519ClientVerifyingShare.js","names":["error: unknown"],"sources":["../../../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/deriveThresholdEd25519ClientVerifyingShare.ts"],"sourcesContent":["import type { SignerWorkerManagerContext } from '..';\nimport {\n  WorkerRequestType,\n  WorkerResponseType,\n  type WasmDeriveThresholdEd25519ClientVerifyingShareResult,\n} from '../../../types/signer-worker';\n\nexport async function deriveThresholdEd25519ClientVerifyingShare(args: {\n  ctx: SignerWorkerManagerContext;\n  sessionId: string;\n  nearAccountId: string;\n}): Promise<{\n  success: boolean;\n  nearAccountId: string;\n  clientVerifyingShareB64u: string;\n  wrapKeySalt: string;\n  error?: string;\n}> {\n  const { ctx } = args;\n  const sessionId = args.sessionId;\n  const nearAccountId = args.nearAccountId;\n\n  try {\n    if (!sessionId) throw new Error('Missing sessionId');\n    if (!nearAccountId) throw new Error('Missing nearAccountId');\n\n    const response = await ctx.sendMessage<WorkerRequestType.DeriveThresholdEd25519ClientVerifyingShare>({\n      sessionId,\n      message: {\n        type: WorkerRequestType.DeriveThresholdEd25519ClientVerifyingShare,\n        payload: { nearAccountId },\n      },\n    });\n\n    if (response.type !== WorkerResponseType.DeriveThresholdEd25519ClientVerifyingShareSuccess) {\n      throw new Error('DeriveThresholdEd25519ClientVerifyingShare failed');\n    }\n\n    const wasmResult = response.payload as WasmDeriveThresholdEd25519ClientVerifyingShareResult;\n    const clientVerifyingShareB64u = wasmResult?.clientVerifyingShareB64u;\n    const wrapKeySalt = wasmResult?.wrapKeySalt;\n\n    if (!clientVerifyingShareB64u) throw new Error('Missing clientVerifyingShareB64u in worker response');\n    if (!wrapKeySalt) throw new Error('Missing wrapKeySalt in worker response');\n\n    return {\n      success: true,\n      nearAccountId,\n      clientVerifyingShareB64u,\n      wrapKeySalt\n    };\n  } catch (error: unknown) {\n    const message = String((error as { message?: unknown })?.message ?? error);\n    return {\n      success: false,\n      nearAccountId,\n      clientVerifyingShareB64u: '',\n      wrapKeySalt: '',\n      error: message\n    };\n  }\n}\n"],"mappings":";;;AAOA,eAAsB,2CAA2C,MAU9D;CACD,MAAM,EAAE,QAAQ;CAChB,MAAM,YAAY,KAAK;CACvB,MAAM,gBAAgB,KAAK;AAE3B,KAAI;AACF,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM;AAChC,MAAI,CAAC,cAAe,OAAM,IAAI,MAAM;EAEpC,MAAM,WAAW,MAAM,IAAI,YAA0E;GACnG;GACA,SAAS;IACP,MAAM,kBAAkB;IACxB,SAAS,EAAE;;;AAIf,MAAI,SAAS,SAAS,mBAAmB,kDACvC,OAAM,IAAI,MAAM;EAGlB,MAAM,aAAa,SAAS;EAC5B,MAAM,2BAA2B,YAAY;EAC7C,MAAM,cAAc,YAAY;AAEhC,MAAI,CAAC,yBAA0B,OAAM,IAAI,MAAM;AAC/C,MAAI,CAAC,YAAa,OAAM,IAAI,MAAM;AAElC,SAAO;GACL,SAAS;GACT;GACA;GACA;;UAEKA,OAAgB;EACvB,MAAM,UAAU,OAAQ,OAAiC,WAAW;AACpE,SAAO;GACL,SAAS;GACT;GACA,0BAA0B;GAC1B,aAAa;GACb,OAAO"}

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/exportNearKeypairUi.js

@@ -0,0 +1,61 @@
+import { isObject } from "../../../../utils/validation.js";
+import { toAccountId } from "../../../types/accountIds.js";
+import { WorkerRequestType, isDecryptPrivateKeyWithPrfSuccess } from "../../../types/signer-worker.js";
+import { getLastLoggedInDeviceNumber } from "../getDeviceNumber.js";
+import { SecureConfirmationType } from "../../VrfWorkerManager/confirmTxFlow/types.js";
+import { runSecureConfirm } from "../../VrfWorkerManager/secureConfirmBridge.js";
+
+//#region src/core/WebAuthnManager/SignerWorkerManager/handlers/exportNearKeypairUi.ts
+/**
+* Two-phase export (worker-driven):
+*  - Phase 1: collect PRF (uiMode: 'skip') and derive WrapKeySeed in VRF worker
+*  - Decrypt inside signer worker (session-bound)
+*  - Phase 2: show export UI with decrypted key (kept open until user closes)
+*/
+async function exportNearKeypairUi({ ctx, nearAccountId, variant, theme, sessionId }) {
+	const accountId = toAccountId(nearAccountId);
+	const deviceNumber = await getLastLoggedInDeviceNumber(accountId, ctx.indexedDB.clientDB);
+	const [keyData, user] = await Promise.all([ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(accountId, deviceNumber), ctx.indexedDB.clientDB.getUserByDevice(accountId, deviceNumber)]);
+	const publicKey = user?.clientNearPublicKey || "";
+	if (!keyData || !publicKey) throw new Error("Missing local key material for export. Re-register to upgrade vault.");
+	const response = await ctx.sendMessage({
+		sessionId,
+		message: {
+			type: WorkerRequestType.DecryptPrivateKeyWithPrf,
+			payload: {
+				nearAccountId: accountId,
+				encryptedPrivateKeyData: keyData.encryptedSk,
+				encryptedPrivateKeyChacha20NonceB64u: keyData.chacha20NonceB64u
+			}
+		}
+	});
+	if (!isDecryptPrivateKeyWithPrfSuccess(response)) {
+		console.error("WebAuthnManager: Export decrypt failed:", response);
+		const payloadError = isObject(response?.payload) && response?.payload?.error;
+		const msg = String(payloadError || "Export decrypt failed");
+		throw new Error(msg);
+	}
+	const privateKey = response.payload.privateKey;
+	const showReq = {
+		requestId: sessionId,
+		type: SecureConfirmationType.SHOW_SECURE_PRIVATE_KEY_UI,
+		summary: {
+			operation: "Export Private Key",
+			accountId,
+			publicKey,
+			warning: "Anyone with your private key can fully control your account. Never share it."
+		},
+		payload: {
+			nearAccountId: accountId,
+			publicKey,
+			privateKey,
+			variant,
+			theme
+		}
+	};
+	await runSecureConfirm(ctx, showReq);
+}
+
+//#endregion
+export { exportNearKeypairUi };
+//# sourceMappingURL=exportNearKeypairUi.js.map

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/exportNearKeypairUi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exportNearKeypairUi.js","names":[],"sources":["../../../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/exportNearKeypairUi.ts"],"sourcesContent":["import { isObject } from '@/utils/validation';\nimport { AccountId, toAccountId } from '../../../types/accountIds';\nimport {\n  WorkerRequestType,\n  isDecryptPrivateKeyWithPrfSuccess,\n} from '../../../types/signer-worker';\nimport { runSecureConfirm } from '../../VrfWorkerManager/secureConfirmBridge';\nimport { SecureConfirmationType } from '../../VrfWorkerManager/confirmTxFlow/types';\nimport { SignerWorkerManagerContext } from '..';\nimport { getLastLoggedInDeviceNumber } from '../getDeviceNumber';\n\n/**\n * Two-phase export (worker-driven):\n *  - Phase 1: collect PRF (uiMode: 'skip') and derive WrapKeySeed in VRF worker\n *  - Decrypt inside signer worker (session-bound)\n *  - Phase 2: show export UI with decrypted key (kept open until user closes)\n */\nexport async function exportNearKeypairUi({\n  ctx,\n  nearAccountId,\n  variant,\n  theme,\n  sessionId,\n}: {\n  ctx: SignerWorkerManagerContext;\n  nearAccountId: AccountId;\n  variant?: 'drawer' | 'modal';\n  theme?: 'dark' | 'light';\n  sessionId: string;\n}): Promise<void> {\n  const accountId = toAccountId(nearAccountId);\n\n  // Gather encrypted key + ChaCha20 nonce and public key from IndexedDB\n  const deviceNumber = await getLastLoggedInDeviceNumber(accountId, ctx.indexedDB.clientDB);\n  const [keyData, user] = await Promise.all([\n    ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(accountId, deviceNumber),\n    ctx.indexedDB.clientDB.getUserByDevice(accountId, deviceNumber),\n  ]);\n  const publicKey = user?.clientNearPublicKey || '';\n  if (!keyData || !publicKey) {\n    throw new Error('Missing local key material for export. Re-register to upgrade vault.');\n  }\n\n  // Decrypt inside signer worker using the reserved session\n  const response = await ctx.sendMessage<WorkerRequestType.DecryptPrivateKeyWithPrf>({\n    sessionId,\n    message: {\n      type: WorkerRequestType.DecryptPrivateKeyWithPrf,\n      payload: {\n        nearAccountId: accountId,\n        encryptedPrivateKeyData: keyData.encryptedSk,\n        encryptedPrivateKeyChacha20NonceB64u: keyData.chacha20NonceB64u,\n      },\n    },\n  });\n\n  if (!isDecryptPrivateKeyWithPrfSuccess(response)) {\n    console.error('WebAuthnManager: Export decrypt failed:', response);\n    const payloadError = isObject(response?.payload) && response?.payload?.error;\n    const msg = String(payloadError || 'Export decrypt failed');\n    throw new Error(msg);\n  }\n\n  const privateKey = response.payload.privateKey;\n\n  // Phase 2: show secure UI (VRF-driven viewer)\n  const showReq = {\n    requestId: sessionId,\n    type: SecureConfirmationType.SHOW_SECURE_PRIVATE_KEY_UI,\n    summary: {\n      operation: 'Export Private Key' as const,\n      accountId,\n      publicKey,\n      warning: 'Anyone with your private key can fully control your account. Never share it.',\n    },\n    payload: {\n      nearAccountId: accountId,\n      publicKey,\n      privateKey,\n      variant,\n      theme,\n    },\n  };\n  await runSecureConfirm(ctx, showReq);\n}\n"],"mappings":";;;;;;;;;;;;;;AAiBA,eAAsB,oBAAoB,EACxC,KACA,eACA,SACA,OACA,aAOgB;CAChB,MAAM,YAAY,YAAY;CAG9B,MAAM,eAAe,MAAM,4BAA4B,WAAW,IAAI,UAAU;CAChF,MAAM,CAAC,SAAS,QAAQ,MAAM,QAAQ,IAAI,CACxC,IAAI,UAAU,WAAW,oBAAoB,WAAW,eACxD,IAAI,UAAU,SAAS,gBAAgB,WAAW;CAEpD,MAAM,YAAY,MAAM,uBAAuB;AAC/C,KAAI,CAAC,WAAW,CAAC,UACf,OAAM,IAAI,MAAM;CAIlB,MAAM,WAAW,MAAM,IAAI,YAAwD;EACjF;EACA,SAAS;GACP,MAAM,kBAAkB;GACxB,SAAS;IACP,eAAe;IACf,yBAAyB,QAAQ;IACjC,sCAAsC,QAAQ;;;;AAKpD,KAAI,CAAC,kCAAkC,WAAW;AAChD,UAAQ,MAAM,2CAA2C;EACzD,MAAM,eAAe,SAAS,UAAU,YAAY,UAAU,SAAS;EACvE,MAAM,MAAM,OAAO,gBAAgB;AACnC,QAAM,IAAI,MAAM;;CAGlB,MAAM,aAAa,SAAS,QAAQ;CAGpC,MAAM,UAAU;EACd,WAAW;EACX,MAAM,uBAAuB;EAC7B,SAAS;GACP,WAAW;GACX;GACA;GACA,SAAS;;EAEX,SAAS;GACP,eAAe;GACf;GACA;GACA;GACA;;;AAGJ,OAAM,iBAAiB,KAAK"}

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/extractCosePublicKey.js

@@ -0,0 +1,23 @@
+import { WorkerRequestType, isExtractCosePublicKeySuccess } from "../../../types/signer-worker.js";
+
+//#region src/core/WebAuthnManager/SignerWorkerManager/handlers/extractCosePublicKey.ts
+/**
+* Extract COSE public key from WebAuthn attestation object
+* Simple operation that doesn't require TouchID or progress updates
+*/
+async function extractCosePublicKey({ ctx, attestationObjectBase64url }) {
+	try {
+		const response = await ctx.sendMessage({ message: {
+			type: WorkerRequestType.ExtractCosePublicKey,
+			payload: { attestationObjectBase64url }
+		} });
+		if (isExtractCosePublicKeySuccess(response)) return response.payload.cosePublicKeyBytes;
+		else throw new Error("COSE public key extraction failed in WASM worker");
+	} catch (error) {
+		throw error;
+	}
+}
+
+//#endregion
+export { extractCosePublicKey };
+//# sourceMappingURL=extractCosePublicKey.js.map

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/extractCosePublicKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extractCosePublicKey.js","names":["error: unknown"],"sources":["../../../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/extractCosePublicKey.ts"],"sourcesContent":["\nimport { WorkerRequestType, isExtractCosePublicKeySuccess } from '../../../types/signer-worker';\nimport { SignerWorkerManagerContext } from '..';\n\n\n/**\n * Extract COSE public key from WebAuthn attestation object\n * Simple operation that doesn't require TouchID or progress updates\n */\nexport async function extractCosePublicKey({ ctx, attestationObjectBase64url }: {\n  ctx: SignerWorkerManagerContext;\n  attestationObjectBase64url: string;\n}): Promise<Uint8Array> {\n  try {\n    const response = await ctx.sendMessage<WorkerRequestType.ExtractCosePublicKey>({\n      message: {\n        type: WorkerRequestType.ExtractCosePublicKey,\n        payload: {\n          attestationObjectBase64url\n        }\n      }\n    });\n\n    if (isExtractCosePublicKeySuccess(response)) {\n      return response.payload.cosePublicKeyBytes;\n    } else {\n      throw new Error('COSE public key extraction failed in WASM worker');\n    }\n  } catch (error: unknown) {\n    throw error;\n  }\n}\n"],"mappings":";;;;;;;AASA,eAAsB,qBAAqB,EAAE,KAAK,8BAG1B;AACtB,KAAI;EACF,MAAM,WAAW,MAAM,IAAI,YAAoD,EAC7E,SAAS;GACP,MAAM,kBAAkB;GACxB,SAAS,EACP;;AAKN,MAAI,8BAA8B,UAChC,QAAO,SAAS,QAAQ;MAExB,OAAM,IAAI,MAAM;UAEXA,OAAgB;AACvB,QAAM"}

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/recoverKeypairFromPasskey.js

@@ -0,0 +1,42 @@
+import { WorkerRequestType, isRecoverKeypairFromPasskeySuccess } from "../../../types/signer-worker.js";
+import { withSessionId } from "./session.js";
+
+//#region src/core/WebAuthnManager/SignerWorkerManager/handlers/recoverKeypairFromPasskey.ts
+/**
+* Recover keypair from authentication credential for account recovery
+* Uses dual PRF-based Ed25519 key derivation with account-specific HKDF and AES encryption
+*/
+async function recoverKeypairFromPasskey({ ctx, credential, accountIdHint, sessionId }) {
+	try {
+		console.info("SignerWorkerManager: Starting dual PRF-based keypair recovery from authentication credential");
+		if (!credential.clientExtensionResults?.prf?.results?.first || !credential.clientExtensionResults?.prf?.results?.second) throw new Error("Dual PRF outputs required for account recovery - both ChaCha20 and Ed25519 PRF outputs must be available");
+		if (!sessionId) throw new Error("Missing sessionId for recovery WrapKeySeed delivery");
+		const response = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: WorkerRequestType.RecoverKeypairFromPasskey,
+				payload: withSessionId(sessionId, {
+					credential,
+					accountIdHint
+				})
+			}
+		});
+		if (!isRecoverKeypairFromPasskeySuccess(response)) throw new Error("Dual PRF keypair recovery failed in WASM worker");
+		const chacha20NonceB64u = response.payload.chacha20NonceB64u;
+		if (!chacha20NonceB64u) throw new Error("Missing chacha20NonceB64u in recovery result");
+		return {
+			publicKey: response.payload.publicKey,
+			encryptedPrivateKey: response.payload.encryptedData,
+			chacha20NonceB64u,
+			accountIdHint: response.payload.accountIdHint,
+			wrapKeySalt: response.payload.wrapKeySalt
+		};
+	} catch (error) {
+		console.error("SignerWorkerManager: Dual PRF keypair recovery error:", error);
+		throw error;
+	}
+}
+
+//#endregion
+export { recoverKeypairFromPasskey };
+//# sourceMappingURL=recoverKeypairFromPasskey.js.map

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/recoverKeypairFromPasskey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recoverKeypairFromPasskey.js","names":["error: unknown"],"sources":["../../../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/recoverKeypairFromPasskey.ts"],"sourcesContent":["import {\n  WorkerRequestType,  // from wasm worker\n  isRecoverKeypairFromPasskeySuccess,\n} from '../../../types/signer-worker';\nimport type { WebAuthnAuthenticationCredential } from '../../../types/webauthn';\nimport { SignerWorkerManagerContext } from '..';\nimport { withSessionId } from './session';\n\n/**\n * Recover keypair from authentication credential for account recovery\n * Uses dual PRF-based Ed25519 key derivation with account-specific HKDF and AES encryption\n */\nexport async function recoverKeypairFromPasskey({\n  ctx,\n  credential,\n  accountIdHint,\n  sessionId,\n}: {\n  ctx: SignerWorkerManagerContext;\n  credential: WebAuthnAuthenticationCredential;\n  accountIdHint?: string;\n  sessionId: string;\n}): Promise<{\n  publicKey: string;\n  encryptedPrivateKey: string;\n  /**\n   * Base64url-encoded AEAD nonce (ChaCha20-Poly1305) for the encrypted private key.\n   */\n  chacha20NonceB64u: string;\n  accountIdHint?: string;\n  wrapKeySalt: string;\n}> {\n  try {\n    console.info('SignerWorkerManager: Starting dual PRF-based keypair recovery from authentication credential');\n    // Accept either live PublicKeyCredential or already-serialized auth credential\n\n    // Verify dual PRF outputs are available\n    if (\n      !credential.clientExtensionResults?.prf?.results?.first ||\n      !credential.clientExtensionResults?.prf?.results?.second\n    ) {\n      throw new Error('Dual PRF outputs required for account recovery - both ChaCha20 and Ed25519 PRF outputs must be available');\n    }\n\n    if (!sessionId) throw new Error('Missing sessionId for recovery WrapKeySeed delivery');\n\n    // Use generic sendMessage with specific request type for better type safety\n    const response = await ctx.sendMessage<WorkerRequestType.RecoverKeypairFromPasskey>({\n      sessionId,\n      message: {\n        type: WorkerRequestType.RecoverKeypairFromPasskey,\n        payload: withSessionId(sessionId, {\n          credential,\n          accountIdHint,\n        })\n      },\n    });\n\n    // response is RecoverKeypairSuccessResponse | RecoverKeypairFailureResponse\n    if (!isRecoverKeypairFromPasskeySuccess(response)) {\n      throw new Error('Dual PRF keypair recovery failed in WASM worker');\n    }\n\n    const chacha20NonceB64u = response.payload.chacha20NonceB64u;\n    if (!chacha20NonceB64u) {\n      throw new Error('Missing chacha20NonceB64u in recovery result');\n    }\n    return {\n      publicKey: response.payload.publicKey,\n      encryptedPrivateKey: response.payload.encryptedData,\n      chacha20NonceB64u,\n      accountIdHint: response.payload.accountIdHint,\n      wrapKeySalt: response.payload.wrapKeySalt,\n    };\n\n  } catch (error: unknown) {\n    console.error('SignerWorkerManager: Dual PRF keypair recovery error:', error);\n    throw error;\n  }\n}\n"],"mappings":";;;;;;;;AAYA,eAAsB,0BAA0B,EAC9C,KACA,YACA,eACA,aAeC;AACD,KAAI;AACF,UAAQ,KAAK;AAIb,MACE,CAAC,WAAW,wBAAwB,KAAK,SAAS,SAClD,CAAC,WAAW,wBAAwB,KAAK,SAAS,OAElD,OAAM,IAAI,MAAM;AAGlB,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM;EAGhC,MAAM,WAAW,MAAM,IAAI,YAAyD;GAClF;GACA,SAAS;IACP,MAAM,kBAAkB;IACxB,SAAS,cAAc,WAAW;KAChC;KACA;;;;AAMN,MAAI,CAAC,mCAAmC,UACtC,OAAM,IAAI,MAAM;EAGlB,MAAM,oBAAoB,SAAS,QAAQ;AAC3C,MAAI,CAAC,kBACH,OAAM,IAAI,MAAM;AAElB,SAAO;GACL,WAAW,SAAS,QAAQ;GAC5B,qBAAqB,SAAS,QAAQ;GACtC;GACA,eAAe,SAAS,QAAQ;GAChC,aAAa,SAAS,QAAQ;;UAGzBA,OAAgB;AACvB,UAAQ,MAAM,yDAAyD;AACvE,QAAM"}

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/registerDevice2WithDerivedKey.js

@@ -0,0 +1,118 @@
+import { WorkerRequestType, isRegisterDevice2WithDerivedKeySuccess } from "../../../types/signer-worker.js";
+import { base64UrlDecode } from "../../../../utils/base64.js";
+import { UserVerificationPolicy, toEnumUserVerificationPolicy } from "../../../types/authenticatorOptions.js";
+import { withSessionId } from "./session.js";
+
+//#region src/core/WebAuthnManager/SignerWorkerManager/handlers/registerDevice2WithDerivedKey.ts
+/**
+* Combined Device2 registration flow: derive NEAR keypair + sign registration transaction
+* in a single operation without requiring a separate authentication prompt.
+*
+* This handler orchestrates:
+* 1. Retrieving PRF.second and WrapKeySeed from session storage (delivered via MessagePort)
+* 2. Deriving NEAR ed25519 keypair from PRF.second
+* 3. Encrypting the NEAR private key with KEK (derived from WrapKeySeed + wrapKeySalt)
+* 4. Building the Device2 registration transaction (`link_device_register_user`)
+* 5. Signing the transaction with the derived NEAR keypair
+* 6. Storing encrypted key data in IndexedDB
+*
+* Security: PRF.second and WrapKeySeed never traverse the main thread - they're delivered
+* directly from VRF worker to Signer worker via MessagePort.
+*/
+async function registerDevice2WithDerivedKey({ ctx, sessionId, nearAccountId, credential, vrfChallenge, transactionContext, contractId, wrapKeySalt, deviceNumber, deterministicVrfPublicKey }) {
+	try {
+		if (!sessionId) throw new Error("Missing sessionId for Device2 registration");
+		console.debug("[SignerWorkerManager] Starting Device2 combined registration", {
+			nearAccountId,
+			sessionId,
+			deviceNumber
+		});
+		const b64ToBytes = (s) => {
+			if (!s) return [];
+			return Array.from(base64UrlDecode(s));
+		};
+		const intentDigest32 = b64ToBytes(vrfChallenge.intentDigest);
+		if (intentDigest32.length !== 32) throw new Error("Missing or invalid vrfChallenge.intentDigest (expected base64url-encoded 32 bytes)");
+		const finalContractArgs = {
+			vrf_data: {
+				vrf_input_data: b64ToBytes(vrfChallenge.vrfInput),
+				vrf_output: b64ToBytes(vrfChallenge.vrfOutput),
+				vrf_proof: b64ToBytes(vrfChallenge.vrfProof),
+				public_key: b64ToBytes(vrfChallenge.vrfPublicKey),
+				user_id: vrfChallenge.userId,
+				rp_id: vrfChallenge.rpId,
+				block_height: Number(vrfChallenge.blockHeight),
+				block_hash: b64ToBytes(vrfChallenge.blockHash),
+				intent_digest_32: intentDigest32
+			},
+			webauthn_registration: credential,
+			deterministic_vrf_public_key: b64ToBytes(deterministicVrfPublicKey),
+			authenticator_options: {
+				userVerification: toEnumUserVerificationPolicy(UserVerificationPolicy.Preferred),
+				originPolicy: {
+					single: void 0,
+					all_subdomains: true,
+					multiple: void 0
+				}
+			}
+		};
+		const response = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: WorkerRequestType.RegisterDevice2WithDerivedKey,
+				payload: withSessionId(sessionId, {
+					credential,
+					nearAccountId,
+					transactionContext: {
+						txBlockHash: transactionContext.txBlockHash,
+						txBlockHeight: transactionContext.txBlockHeight,
+						baseNonce: transactionContext.nextNonce
+					},
+					contractId,
+					contractArgsJson: JSON.stringify(finalContractArgs)
+				})
+			}
+		});
+		if (!isRegisterDevice2WithDerivedKeySuccess(response)) throw new Error("Device2 combined registration failed");
+		const wasmResult = response.payload;
+		console.debug("[SignerWorkerManager] Device2 registration complete, storing encrypted key");
+		const chacha20NonceB64u = wasmResult.chacha20NonceB64u;
+		if (!chacha20NonceB64u) throw new Error("Missing chacha20NonceB64u in Device2 registration result");
+		const wrapKeySaltPersisted = wasmResult.wrapKeySalt;
+		if (!wrapKeySaltPersisted) throw new Error("Missing wrapKeySalt in Device2 registration result");
+		const keyMaterial = {
+			kind: "local_near_sk_v3",
+			nearAccountId,
+			deviceNumber: deviceNumber ?? 2,
+			publicKey: wasmResult.publicKey,
+			encryptedSk: wasmResult.encryptedData,
+			chacha20NonceB64u,
+			wrapKeySalt: wrapKeySaltPersisted,
+			timestamp: Date.now()
+		};
+		await ctx.indexedDB.nearKeysDB.storeKeyMaterial(keyMaterial);
+		console.debug("[SignerWorkerManager] Device2 encrypted key stored successfully");
+		return {
+			success: true,
+			publicKey: wasmResult.publicKey,
+			signedTransaction: wasmResult.signedTransaction,
+			wrapKeySalt: wrapKeySaltPersisted,
+			encryptedData: wasmResult.encryptedData,
+			chacha20NonceB64u
+		};
+	} catch (error) {
+		console.error("[SignerWorkerManager] registerDevice2WithDerivedKey error:", error);
+		const message = String(error?.message || error || "");
+		return {
+			success: false,
+			publicKey: "",
+			signedTransaction: null,
+			wrapKeySalt: "",
+			error: message
+		};
+	}
+}
+
+//#endregion
+export { registerDevice2WithDerivedKey };
+//# sourceMappingURL=registerDevice2WithDerivedKey.js.map

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/registerDevice2WithDerivedKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registerDevice2WithDerivedKey.js","names":["keyMaterial: LocalNearSkV3Material","error: unknown"],"sources":["../../../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/registerDevice2WithDerivedKey.ts"],"sourcesContent":["import { base64UrlDecode } from '../../../../utils';\nimport type { LocalNearSkV3Material } from '../../../IndexedDBManager/passkeyNearKeysDB';\nimport {\n  WorkerRequestType,\n  isRegisterDevice2WithDerivedKeySuccess,\n  type WasmSignedTransaction,\n} from '../../../types/signer-worker';\nimport { AccountId, toAccountId } from \"../../../types/accountIds\";\nimport { SignerWorkerManagerContext } from '..';\nimport type { WebAuthnRegistrationCredential } from '@/core/types/webauthn';\nimport type { VRFChallenge } from '../../../types/vrf-worker';\nimport type { TransactionContext } from '../../../types/rpc';\nimport { withSessionId } from './session';\nimport { UserVerificationPolicy, toEnumUserVerificationPolicy } from '../../../types/authenticatorOptions';\n\n/**\n * Combined Device2 registration flow: derive NEAR keypair + sign registration transaction\n * in a single operation without requiring a separate authentication prompt.\n *\n * This handler orchestrates:\n * 1. Retrieving PRF.second and WrapKeySeed from session storage (delivered via MessagePort)\n * 2. Deriving NEAR ed25519 keypair from PRF.second\n * 3. Encrypting the NEAR private key with KEK (derived from WrapKeySeed + wrapKeySalt)\n * 4. Building the Device2 registration transaction (`link_device_register_user`)\n * 5. Signing the transaction with the derived NEAR keypair\n * 6. Storing encrypted key data in IndexedDB\n *\n * Security: PRF.second and WrapKeySeed never traverse the main thread - they're delivered\n * directly from VRF worker to Signer worker via MessagePort.\n */\nexport async function registerDevice2WithDerivedKey({\n  ctx,\n  sessionId,\n  nearAccountId,\n  credential,\n  vrfChallenge,\n  transactionContext,\n  contractId,\n  wrapKeySalt,\n  deviceNumber,\n  deterministicVrfPublicKey,\n}: {\n  ctx: SignerWorkerManagerContext;\n  sessionId: string;\n  nearAccountId: AccountId;\n  credential: WebAuthnRegistrationCredential;\n  vrfChallenge: VRFChallenge;\n  transactionContext: TransactionContext;\n  contractId: string;\n  wrapKeySalt: string;\n  deviceNumber?: number;\n  deterministicVrfPublicKey?: string;\n}): Promise<\n  | {\n    success: true;\n    publicKey: string;\n    signedTransaction: WasmSignedTransaction;\n    wrapKeySalt: string;\n    encryptedData: string;\n    /**\n     * Base64url-encoded AEAD nonce (ChaCha20-Poly1305) for the encrypted private key.\n     */\n    chacha20NonceB64u: string;\n  }\n  | {\n    success: false;\n    publicKey: '';\n    signedTransaction: null;\n    wrapKeySalt: '';\n    error: string;\n  }\n> {\n  try {\n    if (!sessionId) {\n      throw new Error('Missing sessionId for Device2 registration');\n    }\n\n    console.debug('[SignerWorkerManager] Starting Device2 combined registration', {\n      nearAccountId,\n      sessionId,\n      deviceNumber,\n    });\n\n    // Helper to convert base64url string to byte array (number[])\n    const b64ToBytes = (s: string | undefined): number[] => {\n      if (!s) return [];\n      return Array.from(base64UrlDecode(s));\n    };\n    const intentDigest32 = b64ToBytes(vrfChallenge.intentDigest);\n    if (intentDigest32.length !== 32) {\n      throw new Error('Missing or invalid vrfChallenge.intentDigest (expected base64url-encoded 32 bytes)');\n    }\n    // Construct contractArgs in TypeScript and use JSON.stringify() here.\n    // This is native to JS, extremely fast, and means the Rust worker just receives a \"dumb\" string that it can blindly convert to bytes\n    const finalContractArgs = {\n      vrf_data: {\n        vrf_input_data: b64ToBytes(vrfChallenge.vrfInput),\n        vrf_output: b64ToBytes(vrfChallenge.vrfOutput),\n        vrf_proof: b64ToBytes(vrfChallenge.vrfProof),\n        public_key: b64ToBytes(vrfChallenge.vrfPublicKey),\n        user_id: vrfChallenge.userId,\n        rp_id: vrfChallenge.rpId,\n        block_height: Number(vrfChallenge.blockHeight),\n        block_hash: b64ToBytes(vrfChallenge.blockHash),\n        intent_digest_32: intentDigest32,\n      },\n      webauthn_registration: credential,\n      deterministic_vrf_public_key: b64ToBytes(deterministicVrfPublicKey),\n      authenticator_options: {\n        userVerification: toEnumUserVerificationPolicy(UserVerificationPolicy.Preferred),\n        originPolicy: {\n          single: undefined,\n          all_subdomains: true,\n          multiple: undefined,\n        },\n      },\n    };\n\n    // Build request payload for combined Device2 registration\n    const response = await ctx.sendMessage<WorkerRequestType.RegisterDevice2WithDerivedKey>({\n      sessionId,\n      message: {\n        type: WorkerRequestType.RegisterDevice2WithDerivedKey,\n        payload: withSessionId(sessionId, {\n          credential,\n          nearAccountId,\n          transactionContext: {\n            txBlockHash: transactionContext.txBlockHash,\n            txBlockHeight: transactionContext.txBlockHeight,\n            baseNonce: transactionContext.nextNonce,\n          },\n          contractId,\n          contractArgsJson: JSON.stringify(finalContractArgs),\n        }),\n      },\n    });\n\n    if (!isRegisterDevice2WithDerivedKeySuccess(response)) {\n      throw new Error('Device2 combined registration failed');\n    }\n\n    const wasmResult = response.payload;\n\n    console.debug('[SignerWorkerManager] Device2 registration complete, storing encrypted key');\n\n    // Store encrypted NEAR key in IndexedDB\n    const chacha20NonceB64u = wasmResult.chacha20NonceB64u;\n    if (!chacha20NonceB64u) {\n      throw new Error('Missing chacha20NonceB64u in Device2 registration result');\n    }\n    const wrapKeySaltPersisted = wasmResult.wrapKeySalt;\n    if (!wrapKeySaltPersisted) {\n      throw new Error('Missing wrapKeySalt in Device2 registration result');\n    }\n\n    const keyMaterial: LocalNearSkV3Material = {\n      kind: 'local_near_sk_v3',\n      nearAccountId,\n      deviceNumber: deviceNumber ?? 2, // Default to device 2\n      publicKey: wasmResult.publicKey,\n      encryptedSk: wasmResult.encryptedData,\n      chacha20NonceB64u,\n      wrapKeySalt: wrapKeySaltPersisted,\n      timestamp: Date.now(),\n    };\n    await ctx.indexedDB.nearKeysDB.storeKeyMaterial(keyMaterial);\n\n    console.debug('[SignerWorkerManager] Device2 encrypted key stored successfully');\n\n    return {\n      success: true,\n      publicKey: wasmResult.publicKey,\n      signedTransaction: wasmResult.signedTransaction,\n      wrapKeySalt: wrapKeySaltPersisted,\n      encryptedData: wasmResult.encryptedData,\n      chacha20NonceB64u,\n    };\n  } catch (error: unknown) {\n    console.error('[SignerWorkerManager] registerDevice2WithDerivedKey error:', error);\n    const message = String((error as { message?: unknown })?.message || error || '');\n    return {\n      success: false,\n      publicKey: '',\n      signedTransaction: null,\n      wrapKeySalt: '',\n      error: message,\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA8BA,eAAsB,8BAA8B,EAClD,KACA,WACA,eACA,YACA,cACA,oBACA,YACA,aACA,cACA,6BA+BA;AACA,KAAI;AACF,MAAI,CAAC,UACH,OAAM,IAAI,MAAM;AAGlB,UAAQ,MAAM,gEAAgE;GAC5E;GACA;GACA;;EAIF,MAAM,cAAc,MAAoC;AACtD,OAAI,CAAC,EAAG,QAAO;AACf,UAAO,MAAM,KAAK,gBAAgB;;EAEpC,MAAM,iBAAiB,WAAW,aAAa;AAC/C,MAAI,eAAe,WAAW,GAC5B,OAAM,IAAI,MAAM;EAIlB,MAAM,oBAAoB;GACxB,UAAU;IACR,gBAAgB,WAAW,aAAa;IACxC,YAAY,WAAW,aAAa;IACpC,WAAW,WAAW,aAAa;IACnC,YAAY,WAAW,aAAa;IACpC,SAAS,aAAa;IACtB,OAAO,aAAa;IACpB,cAAc,OAAO,aAAa;IAClC,YAAY,WAAW,aAAa;IACpC,kBAAkB;;GAEpB,uBAAuB;GACvB,8BAA8B,WAAW;GACzC,uBAAuB;IACrB,kBAAkB,6BAA6B,uBAAuB;IACtE,cAAc;KACZ,QAAQ;KACR,gBAAgB;KAChB,UAAU;;;;EAMhB,MAAM,WAAW,MAAM,IAAI,YAA6D;GACtF;GACA,SAAS;IACP,MAAM,kBAAkB;IACxB,SAAS,cAAc,WAAW;KAChC;KACA;KACA,oBAAoB;MAClB,aAAa,mBAAmB;MAChC,eAAe,mBAAmB;MAClC,WAAW,mBAAmB;;KAEhC;KACA,kBAAkB,KAAK,UAAU;;;;AAKvC,MAAI,CAAC,uCAAuC,UAC1C,OAAM,IAAI,MAAM;EAGlB,MAAM,aAAa,SAAS;AAE5B,UAAQ,MAAM;EAGd,MAAM,oBAAoB,WAAW;AACrC,MAAI,CAAC,kBACH,OAAM,IAAI,MAAM;EAElB,MAAM,uBAAuB,WAAW;AACxC,MAAI,CAAC,qBACH,OAAM,IAAI,MAAM;EAGlB,MAAMA,cAAqC;GACzC,MAAM;GACN;GACA,cAAc,gBAAgB;GAC9B,WAAW,WAAW;GACtB,aAAa,WAAW;GACxB;GACA,aAAa;GACb,WAAW,KAAK;;AAElB,QAAM,IAAI,UAAU,WAAW,iBAAiB;AAEhD,UAAQ,MAAM;AAEd,SAAO;GACL,SAAS;GACT,WAAW,WAAW;GACtB,mBAAmB,WAAW;GAC9B,aAAa;GACb,eAAe,WAAW;GAC1B;;UAEKC,OAAgB;AACvB,UAAQ,MAAM,8DAA8D;EAC5E,MAAM,UAAU,OAAQ,OAAiC,WAAW,SAAS;AAC7E,SAAO;GACL,SAAS;GACT,WAAW;GACX,mBAAmB;GACnB,aAAa;GACb,OAAO"}

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/session.js

@@ -0,0 +1,15 @@
+//#region src/core/WebAuthnManager/SignerWorkerManager/handlers/session.ts
+function withSessionId(sessionId, payload) {
+	if (!sessionId) throw new Error("withSessionId: sessionId is required");
+	const existing = payload?.sessionId;
+	if (existing != null && typeof existing !== "string") throw new Error("withSessionId: payload.sessionId must be a string when provided");
+	if (existing && existing !== sessionId) throw new Error(`withSessionId: payload.sessionId (${existing}) does not match provided sessionId (${sessionId})`);
+	return {
+		...payload,
+		sessionId
+	};
+}
+
+//#endregion
+export { withSessionId };
+//# sourceMappingURL=session.js.map

package/dist/esm/react/src/core/WebAuthnManager/SignerWorkerManager/handlers/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","names":[],"sources":["../../../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/session.ts"],"sourcesContent":["\nexport function withSessionId<T extends object>(\n  sessionId: string,\n  payload: T,\n): T & { sessionId: string } {\n\n  if (!sessionId) {\n    throw new Error('withSessionId: sessionId is required');\n  }\n\n  const existing = (payload as { sessionId?: unknown })?.sessionId;\n  if (existing != null && typeof existing !== 'string') {\n    throw new Error('withSessionId: payload.sessionId must be a string when provided');\n  }\n  if (existing && existing !== sessionId) {\n    throw new Error(\n      `withSessionId: payload.sessionId (${existing}) does not match provided sessionId (${sessionId})`,\n    );\n  }\n\n  return { ...payload, sessionId };\n}\n"],"mappings":";AACA,SAAgB,cACd,WACA,SAC2B;AAE3B,KAAI,CAAC,UACH,OAAM,IAAI,MAAM;CAGlB,MAAM,WAAY,SAAqC;AACvD,KAAI,YAAY,QAAQ,OAAO,aAAa,SAC1C,OAAM,IAAI,MAAM;AAElB,KAAI,YAAY,aAAa,UAC3B,OAAM,IAAI,MACR,qCAAqC,SAAS,uCAAuC,UAAU;AAInG,QAAO;EAAE,GAAG;EAAS"}