@tatchi-xyz/sdk 0.21.0 → 0.31.0

package/dist/esm/sdk/collectAuthenticationCredentialForVrfChallenge-C9p90e5Z.js

@@ -0,0 +1,1404 @@
+import { isArray, isFunction, isObject, isString, validateNearAccountId } from "./validation-hUZgySTx.js";
+
+//#region src/core/types/accountIds.ts
+/**
+* Convert and validate string to AccountId
+* Validates proper NEAR account format (must contain at least one dot)
+*/
+function toAccountId(accountId) {
+	const validation = validateNearAccountId(accountId);
+	if (!validation.valid) throw new Error(`Invalid NEAR account ID: ${accountId}`);
+	return accountId;
+}
+
+//#endregion
+//#region src/utils/base64.ts
+/**
+* Encodes binary data to standard base64 format for NEAR RPC compatibility.
+* Uses standard base64 characters (+, /, =) rather than base64url encoding.
+*
+* Important: Avoids spreading large arrays into String.fromCharCode(...) which
+* can overflow the JS call stack when encoding big WASM binaries.
+*
+* @param value - ArrayBufferLike or ArrayBufferView containing the binary data to encode
+* @returns Standard base64-encoded string with padding
+*/
+const base64Encode = (value) => {
+	const bytes = ArrayBuffer.isView(value) ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength) : new Uint8Array(value);
+	let binary = "";
+	for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+	return btoa(binary);
+};
+/**
+* Decodes a standard base64-encoded string into a Uint8Array.
+* Handles standard base64 format with +, /, and = characters.
+*
+* @param base64 - The base64-encoded string to decode
+* @returns Uint8Array containing the decoded bytes
+* @throws Error if decoding fails due to invalid base64 input
+*/
+function base64Decode(base64) {
+	const binaryString = atob(base64);
+	const bytes = new Uint8Array(binaryString.length);
+	for (let i = 0; i < binaryString.length; i++) bytes[i] = binaryString.charCodeAt(i);
+	return bytes;
+}
+/**
+* Encodes an ArrayBuffer into a base64url string.
+* Converts binary data to base64 then replaces standard base64 characters with URL-safe ones:
+* + -> -
+* / -> _
+* Removes padding = characters
+*
+* Used for WebAuthn API compatibility in browser environments.
+* Equivalent to Buffer.from(value).toString('base64url') in Node.js.
+*
+* @param value - The ArrayBufferLike or ArrayBufferView to encode
+* @returns A base64url-encoded string without padding
+*/
+const base64UrlEncode = (value) => {
+	return base64Encode(value).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+};
+/**
+* Decodes a base64url-encoded string into a Uint8Array.
+* Handles base64url format by replacing URL-safe characters and adding padding.
+*
+* @param base64Url - The base64url-encoded string to decode
+* @returns Uint8Array containing the decoded bytes
+* @throws Error if decoding fails due to invalid base64url input
+*/
+function base64UrlDecode(base64Url) {
+	const padding = "=".repeat((4 - base64Url.length % 4) % 4);
+	const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/") + padding;
+	const binaryString = atob(base64);
+	const bytes = new Uint8Array(binaryString.length);
+	for (let i = 0; i < binaryString.length; i++) bytes[i] = binaryString.charCodeAt(i);
+	return bytes;
+}
+
+//#endregion
+//#region src/utils/errors.ts
+/**
+* Centralized error handling utilities for the Passkey SDK
+*/
+/**
+* Best-effort error message extractor without relying on `any`.
+* Always returns a string (may be empty when nothing usable can be derived).
+*/
+function errorMessage(err) {
+	try {
+		if (typeof err === "string") return err;
+		if (err && typeof err.message === "string") return err.message;
+		return String(err ?? "");
+	} catch {
+		return "";
+	}
+}
+/**
+* Normalize any thrown value into an Error instance.
+* - preserves message/name/stack when available
+* - best-effort copies optional code/details properties if present
+*/
+function toError(e) {
+	if (e instanceof Error) return e;
+	const err = new Error(errorMessage(e));
+	try {
+		const src = e;
+		if (typeof src?.name === "string") err.name = src.name;
+		if (typeof src?.stack === "string") err.stack = src.stack;
+		if (src && typeof src.code !== "undefined") err.code = src.code;
+		if (src && typeof src.details !== "undefined") err.details = src.details;
+	} catch {}
+	return err;
+}
+/**
+* Check if an error is related to user cancellation of TouchID/FaceID prompt
+* @param error - The error object or error message string
+* @returns true if the error indicates user cancellation
+*/
+function isTouchIdCancellationError(error) {
+	const msg = errorMessage(error);
+	const lower = msg.toLowerCase();
+	return msg.includes("The operation either timed out or was not allowed") || msg.includes("NotAllowedError") || msg.includes("AbortError") || lower.includes("user cancelled") || lower.includes("user canceled") || lower.includes("user aborted");
+}
+
+//#endregion
+//#region src/utils/digests.ts
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function alphabetizeStringify(input) {
+	const normalizeValue = (value) => {
+		if (Array.isArray(value)) return value.map(normalizeValue);
+		if (isRecord(value)) {
+			const sortedKeys = Object.keys(value).sort();
+			const result = {};
+			for (const key of sortedKeys) result[key] = normalizeValue(value[key]);
+			return result;
+		}
+		return value;
+	};
+	return JSON.stringify(normalizeValue(input));
+}
+async function sha256BytesUtf8(input) {
+	const data = new TextEncoder().encode(input);
+	const digest = await crypto.subtle.digest("SHA-256", data);
+	return new Uint8Array(digest);
+}
+
+//#endregion
+//#region src/core/types/vrf-worker.ts
+/**
+* Decode VRF output and use first 32 bytes as WebAuthn challenge
+* @param vrfChallenge - VRF challenge object
+* @returns 32-byte Uint8Array
+*/
+function outputAs32Bytes(vrfChallenge) {
+	let vrfOutputBytes = base64UrlDecode(vrfChallenge.vrfOutput);
+	return vrfOutputBytes.slice(0, 32);
+}
+/**
+* Validate and create a VRFChallenge object
+* @param vrfChallengeData - The challenge data to validate
+* @returns VRFChallenge object
+*/
+function validateVRFChallenge(vrfChallengeData) {
+	if (!vrfChallengeData.vrfInput || typeof vrfChallengeData.vrfInput !== "string") throw new Error("vrfInput must be a non-empty string");
+	if (!vrfChallengeData.vrfOutput || typeof vrfChallengeData.vrfOutput !== "string") throw new Error("vrfOutput must be a non-empty string");
+	if (!vrfChallengeData.vrfProof || typeof vrfChallengeData.vrfProof !== "string") throw new Error("vrfProof must be a non-empty string");
+	if (!vrfChallengeData.vrfPublicKey || typeof vrfChallengeData.vrfPublicKey !== "string") throw new Error("vrfPublicKey must be a non-empty string");
+	if (!vrfChallengeData.userId || typeof vrfChallengeData.userId !== "string") throw new Error("userId must be a non-empty string");
+	if (!vrfChallengeData.rpId || typeof vrfChallengeData.rpId !== "string") throw new Error("rpId must be a non-empty string");
+	if (!vrfChallengeData.blockHeight || typeof vrfChallengeData.blockHeight !== "string") throw new Error("blockHeight must be a non-empty string");
+	if (!vrfChallengeData.blockHash || typeof vrfChallengeData.blockHash !== "string") throw new Error("blockHash must be a non-empty string");
+	return {
+		vrfInput: vrfChallengeData.vrfInput,
+		vrfOutput: vrfChallengeData.vrfOutput,
+		vrfProof: vrfChallengeData.vrfProof,
+		vrfPublicKey: vrfChallengeData.vrfPublicKey,
+		userId: vrfChallengeData.userId,
+		rpId: vrfChallengeData.rpId,
+		blockHeight: vrfChallengeData.blockHeight,
+		blockHash: vrfChallengeData.blockHash,
+		...vrfChallengeData.intentDigest ? { intentDigest: vrfChallengeData.intentDigest } : {},
+		...vrfChallengeData.sessionPolicyDigest32 ? { sessionPolicyDigest32: vrfChallengeData.sessionPolicyDigest32 } : {}
+	};
+}
+/**
+* Create a random VRF challenge
+* @returns Partial<VRFChallenge> with vrfOutput set, but other fields are undefined
+* This is used for local operations that don't require a VRF verification
+*/
+function createRandomVRFChallenge() {
+	const challenge = crypto.getRandomValues(new Uint8Array(32));
+	const vrfOutput = base64UrlEncode(challenge.buffer);
+	return {
+		vrfOutput,
+		vrfInput: void 0,
+		vrfProof: void 0,
+		vrfPublicKey: void 0,
+		userId: void 0,
+		rpId: void 0,
+		blockHeight: void 0,
+		blockHash: void 0
+	};
+}
+
+//#endregion
+//#region src/core/WebAuthnManager/credentialsHelpers.ts
+/**
+* Serialize PublicKeyCredential for both authentication and registration for WASM worker
+* - Uses base64url encoding for WASM compatibility
+*
+* @returns SerializableCredential - The serialized credential
+* - Does not return PRF outputs
+*/
+function serializeRegistrationCredential(credential) {
+	const response = credential.response;
+	let transports = [];
+	try {
+		const fn = response?.getTransports;
+		if (typeof fn === "function") transports = fn.call(response) || [];
+	} catch {
+		transports = [];
+	}
+	return {
+		id: credential.id,
+		rawId: base64UrlEncode(credential.rawId),
+		type: credential.type,
+		authenticatorAttachment: credential.authenticatorAttachment ?? void 0,
+		response: {
+			clientDataJSON: base64UrlEncode(response.clientDataJSON),
+			attestationObject: base64UrlEncode(response.attestationObject),
+			transports
+		},
+		clientExtensionResults: { prf: { results: {
+			first: void 0,
+			second: void 0
+		} } }
+	};
+}
+function serializeAuthenticationCredential(credential) {
+	const response = credential.response;
+	return {
+		id: credential.id,
+		rawId: base64UrlEncode(credential.rawId),
+		type: credential.type,
+		authenticatorAttachment: credential.authenticatorAttachment ?? void 0,
+		response: {
+			clientDataJSON: base64UrlEncode(response.clientDataJSON),
+			authenticatorData: base64UrlEncode(response.authenticatorData),
+			signature: base64UrlEncode(response.signature),
+			userHandle: response.userHandle ? base64UrlEncode(response.userHandle) : void 0
+		},
+		clientExtensionResults: { prf: { results: {
+			first: void 0,
+			second: void 0
+		} } }
+	};
+}
+/**
+* Serialize PublicKeyCredential for both authentication and registration for WASM worker
+* @returns SerializableCredential - The serialized credential
+* - INCLUDES PRF outputs
+*/
+function serializeRegistrationCredentialWithPRF({ credential, firstPrfOutput = true, secondPrfOutput = true }) {
+	const base = serializeRegistrationCredential(credential);
+	const { chacha20PrfOutput, ed25519PrfOutput } = extractPrfFromCredential({
+		credential,
+		firstPrfOutput,
+		secondPrfOutput
+	});
+	return {
+		...base,
+		clientExtensionResults: { prf: { results: {
+			first: chacha20PrfOutput,
+			second: ed25519PrfOutput
+		} } }
+	};
+}
+function serializeAuthenticationCredentialWithPRF({ credential, firstPrfOutput = true, secondPrfOutput = false }) {
+	const base = serializeAuthenticationCredential(credential);
+	const { chacha20PrfOutput, ed25519PrfOutput } = extractPrfFromCredential({
+		credential,
+		firstPrfOutput,
+		secondPrfOutput
+	});
+	return {
+		...base,
+		clientExtensionResults: { prf: { results: {
+			first: chacha20PrfOutput,
+			second: ed25519PrfOutput
+		} } }
+	};
+}
+/**
+* Validates and normalizes a serialized WebAuthn registration credential.
+* Ensures required fields exist and have the expected primitive types.
+* Populates missing optional arrays like transports with [].
+*/
+function normalizeRegistrationCredential(input) {
+	if (!isObject(input)) throw new Error("Invalid credential: not an object");
+	const candidate = input;
+	const normalized = { ...candidate };
+	if (!isString(normalized.id)) throw new Error("Invalid credential.id");
+	if (!isString(normalized.type)) throw new Error("Invalid credential.type");
+	if (!isString(normalized.rawId)) normalized.rawId = "";
+	if (normalized.authenticatorAttachment !== void 0 && !isString(normalized.authenticatorAttachment)) normalized.authenticatorAttachment = String(normalized.authenticatorAttachment);
+	const response = isObject(normalized.response) ? { ...normalized.response } : {};
+	if (!isString(response.clientDataJSON)) response.clientDataJSON = "";
+	if (!isString(response.attestationObject)) response.attestationObject = "";
+	if (!isArray(response.transports)) response.transports = [];
+	normalized.response = response;
+	normalized.clientExtensionResults = normalizeClientExtensionOutputs(normalized.clientExtensionResults);
+	return normalized;
+}
+/**
+* Redacts client extension outputs from the credential before sending it over the network.
+*
+* Motivation:
+* - WebAuthn `clientExtensionResults` may contain sensitive material (e.g. PRF outputs).
+* - Even when not sensitive, extension outputs can add fingerprinting surface and bloat payloads.
+*
+* @param credential - The WebAuthn credential potentially containing extension outputs
+* @returns Credential with `clientExtensionResults` removed/redacted
+*/
+function removePrfOutputGuard(credential) {
+	const response = credential.response;
+	const responseWithoutExtensions = isObject(response) ? (() => {
+		const cloned = { ...response };
+		if ("clientExtensionResults" in cloned) cloned.clientExtensionResults = null;
+		return cloned;
+	})() : response;
+	return {
+		...credential,
+		response: responseWithoutExtensions,
+		clientExtensionResults: null
+	};
+}
+/**
+* Returns true when the input looks like a serialized registration credential
+* (i.e., plain object with base64url string fields), not a live PublicKeyCredential.
+*/
+function isSerializedRegistrationCredential(x) {
+	if (!isObject(x)) return false;
+	const candidate = x;
+	if (!isString(candidate.id) || !isString(candidate.rawId) || !isString(candidate.type)) return false;
+	if (!isObject(candidate.response)) return false;
+	const response = candidate.response;
+	if (!isString(response.clientDataJSON) || !isString(response.attestationObject)) return false;
+	return response.transports == null || isArray(response.transports);
+}
+/**
+* Generate ChaCha20Poly1305 salt using account-specific HKDF for encryption key derivation
+* @param nearAccountId - NEAR account ID to scope the salt to
+* @returns 32-byte Uint8Array salt for ChaCha20Poly1305 key derivation
+*/
+function generateChaCha20Salt(nearAccountId) {
+	const saltString = `chacha20-salt:${nearAccountId}`;
+	const salt = new Uint8Array(32);
+	const saltBytes = new TextEncoder().encode(saltString);
+	salt.set(saltBytes.slice(0, 32));
+	return salt;
+}
+/**
+* Generate Ed25519 salt using account-specific HKDF for signing key derivation
+* @param nearAccountId - NEAR account ID to scope the salt to
+* @returns 32-byte Uint8Array salt for Ed25519 key derivation
+*/
+function generateEd25519Salt(nearAccountId) {
+	const saltString = `ed25519-salt:${nearAccountId}`;
+	const salt = new Uint8Array(32);
+	const saltBytes = new TextEncoder().encode(saltString);
+	salt.set(saltBytes.slice(0, 32));
+	return salt;
+}
+/**
+* Extract PRF outputs from WebAuthn credential extension results
+* ENCODING: Uses base64url for WASM compatibility
+* @param credential - WebAuthn credential with dual PRF extension results
+* @param firstPrfOutput - Whether to include the first PRF output (default: true)
+* @param secondPrfOutput - Whether to include the second PRF output (default: false)
+* @returns PRF outputs
+*/
+function extractPrfFromCredential({ credential, firstPrfOutput = true, secondPrfOutput = false }) {
+	const extensionResults = getExtensionResults(credential);
+	const prfResults = extractPrfResultsObject(extensionResults);
+	validatePrfResults(prfResults, firstPrfOutput, secondPrfOutput);
+	const firstEncoded = firstPrfOutput ? normalizePrfValueToBase64Url(prfResults.first) : void 0;
+	const secondEncoded = secondPrfOutput ? normalizePrfValueToBase64Url(prfResults.second) : void 0;
+	if (firstPrfOutput && !firstEncoded) throw new Error("Missing PRF result: first");
+	if (secondPrfOutput && !secondEncoded) throw new Error("Missing PRF result: second");
+	return {
+		chacha20PrfOutput: firstEncoded || "",
+		ed25519PrfOutput: secondEncoded || ""
+	};
+}
+/** Get extension results from credential (live or serialized) */
+function getExtensionResults(credential) {
+	try {
+		const fn = credential.getClientExtensionResults;
+		if (typeof fn === "function") return fn.call(credential);
+	} catch {}
+	return credential.clientExtensionResults;
+}
+/** Extract PRF results object from extension results */
+function extractPrfResultsObject(extensionResults) {
+	try {
+		return extensionResults?.prf?.results;
+	} catch {
+		return void 0;
+	}
+}
+/** Validate PRF results are present and not empty */
+function validatePrfResults(prfResults, firstRequired, secondRequired) {
+	if (!prfResults) throw new Error("Missing PRF results from credential, use a PRF-enabled Authenticator");
+	const hasAnyPrfData = prfResults.first !== void 0 || prfResults.second !== void 0;
+	if (!hasAnyPrfData && (firstRequired || secondRequired)) throw new Error("Missing PRF result - PRF evaluation failed: results object is empty");
+}
+/** Normalize a PRF value to base64url string */
+function normalizePrfValueToBase64Url(value) {
+	if (!value) return void 0;
+	if (typeof value === "string") return value;
+	if (value instanceof ArrayBuffer) return base64UrlEncode(value);
+	if (ArrayBuffer.isView(value)) return base64UrlEncode(value.buffer);
+	try {
+		return base64UrlEncode(value);
+	} catch {
+		try {
+			return base64UrlEncode(new Uint8Array(value).buffer);
+		} catch {
+			return void 0;
+		}
+	}
+}
+/**
+* Normalize WebAuthn client extension outputs into an SDK‑local, clone‑safe shape.
+*
+* Purpose:
+* - Browsers return extension results on PublicKeyCredential in a variety of
+*   shapes and with optional presence. This helper takes an unknown value
+*   (either a live `credential.getClientExtensionResults()` object or a
+*   serialized snapshot) and produces a strictly typed
+*   `AuthenticationExtensionsClientOutputs` compatible with our WASM workers
+*   and cross‑window message passing (structured‑clone safe).
+*/
+function normalizeClientExtensionOutputs(input) {
+	const out = { prf: { results: {
+		first: void 0,
+		second: void 0
+	} } };
+	const src = isObject(input) ? input : {};
+	if (typeof src.appid === "boolean") out.appid = src.appid;
+	if (typeof src.appidExclude === "boolean") out.appidExclude = src.appidExclude;
+	if (typeof src.hmacCreateSecret === "boolean") out.hmacCreateSecret = src.hmacCreateSecret;
+	if (isObject(src.credProps)) {
+		const cp = src.credProps;
+		const outCp = {};
+		if (typeof cp.rk === "boolean") outCp.rk = cp.rk;
+		out.credProps = outCp;
+	}
+	if (isArray(src.uvm)) {
+		const uvmArr = src.uvm.filter(isArray).map((t) => {
+			const a = t;
+			const n0 = typeof a[0] === "number" ? a[0] : void 0;
+			const n1 = typeof a[1] === "number" ? a[1] : void 0;
+			const n2 = typeof a[2] === "number" ? a[2] : void 0;
+			return typeof n0 === "number" && typeof n1 === "number" && typeof n2 === "number" ? [
+				n0,
+				n1,
+				n2
+			] : void 0;
+		}).filter((x) => Array.isArray(x));
+		if (uvmArr.length > 0) out.uvm = uvmArr;
+	}
+	if (isObject(src.prf)) {
+		const prf = src.prf;
+		const results = isObject(prf.results) ? prf.results : {};
+		const first = results.first;
+		const second = results.second;
+		out.prf = { results: {
+			first: isString(first) ? first : void 0,
+			second: isString(second) ? second : void 0
+		} };
+	}
+	return out;
+}
+
+//#endregion
+//#region src/core/WebAuthnManager/WebAuthnFallbacks/safari-fallbacks.ts
+const WebAuthnBridgeMessage = {
+	Create: "WALLET_WEBAUTHN_CREATE",
+	Get: "WALLET_WEBAUTHN_GET",
+	CreateResult: "WALLET_WEBAUTHN_CREATE_RESULT",
+	GetResult: "WALLET_WEBAUTHN_GET_RESULT"
+};
+function getResultTypeFor(kind) {
+	return kind === WebAuthnBridgeMessage.Get ? WebAuthnBridgeMessage.GetResult : WebAuthnBridgeMessage.CreateResult;
+}
+/**
+* Execute a WebAuthn operation with Safari-aware fallbacks.
+*
+* Steps:
+* 1) Try native WebAuthn via navigator.credentials.{create|get}
+* 2) If the failure matches Safari's ancestor-origin restriction and we are in an iframe,
+*    ask the parent/top-level window to perform the WebAuthn operation (bridge). If the
+*    parent reports a user cancellation, throw NotAllowedError; if it times out, continue.
+* 3) If the failure matches Safari's "document not focused" path, first attempt to refocus
+*    and retry native once; if still blocked and in an iframe, ask the parent window to handle it.
+* 4) Generic last resort: when in an iframe (constrained context), always attempt the parent
+*    WebAuthn once even if the error wasn't recognized as a Safari-specific case. If the parent
+*    path times out, surface a deterministic timeout error without re-trying native again.
+* 5) Otherwise, rethrow the original error.
+*/
+async function executeWebAuthnWithParentFallbacksSafari(kind, publicKey, deps) {
+	const { rpId, inIframe, timeoutMs = 6e4, permitGetBridgeOnAncestorError = true } = deps;
+	const bridgeClient = deps.bridgeClient || new WindowParentDomainWebAuthnClient();
+	const isTestForceNativeFail = () => {
+		const g = globalThis;
+		const w = typeof window !== "undefined" ? window : void 0;
+		return !!(g && g.__W3A_TEST_FORCE_NATIVE_FAIL) || !!(w && w.__W3A_TEST_FORCE_NATIVE_FAIL);
+	};
+	const bumpCounter = (key) => {
+		const g = globalThis;
+		g[key] = (g[key] || 0) + 1;
+	};
+	if (isTestForceNativeFail()) {
+		if (kind === "create") bumpCounter("__W3A_TEST_NATIVE_CREATE_ATTEMPTS");
+		else bumpCounter("__W3A_TEST_NATIVE_GET_ATTEMPTS");
+		try {
+			const bridged = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);
+			if (bridged?.ok) return bridged.credential;
+			if (bridged && !bridged.timeout) throw notAllowedError(bridged.error || "WebAuthn cancelled or failed (bridge)");
+			throw new Error("WebAuthn bridge timeout");
+		} catch (be) {
+			throw notAllowedError(be?.message || "WebAuthn bridge failed");
+		}
+	}
+	const tryNative = async () => {
+		if (kind === "create") {
+			bumpCounter("__W3A_TEST_NATIVE_CREATE_ATTEMPTS");
+			if (isTestForceNativeFail()) throw notAllowedError("Forced native fail (create)");
+			return await navigator.credentials.create({
+				publicKey,
+				...deps.abortSignal ? { signal: deps.abortSignal } : {}
+			});
+		} else {
+			bumpCounter("__W3A_TEST_NATIVE_GET_ATTEMPTS");
+			if (isTestForceNativeFail()) throw notAllowedError("Forced native fail (get)");
+			return await navigator.credentials.get({
+				publicKey,
+				...deps.abortSignal ? { signal: deps.abortSignal } : {}
+			});
+		}
+	};
+	try {
+		return await tryNative();
+	} catch (e) {
+		const name = safeName(e);
+		if (name === "NotAllowedError" && !isAncestorOriginError(e) && !isDocumentNotFocusedError(e)) throw e;
+		if (isAncestorOriginError(e) && inIframe) {
+			if (kind === "get" && !permitGetBridgeOnAncestorError) throw e;
+			try {
+				const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);
+				if (bridgedCredentials?.ok) return bridgedCredentials.credential;
+				if (bridgedCredentials && !bridgedCredentials.timeout) throw notAllowedError(bridgedCredentials.error || "WebAuthn get cancelled or failed (bridge)");
+			} catch (be) {
+				throw notAllowedError(be?.message || "WebAuthn bridge failed");
+			}
+		}
+		if (isDocumentNotFocusedError(e)) {
+			const focused = await attemptRefocus();
+			if (focused) try {
+				return await tryNative();
+			} catch {}
+			if (inIframe) try {
+				const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);
+				if (bridgedCredentials?.ok) return bridgedCredentials.credential;
+				if (bridgedCredentials && !bridgedCredentials.timeout) throw notAllowedError(bridgedCredentials.error || "WebAuthn get cancelled or failed (bridge)");
+			} catch (be) {
+				throw notAllowedError(be?.message || "WebAuthn bridge failed");
+			}
+		}
+		if (inIframe) try {
+			const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);
+			if (bridgedCredentials?.ok) return bridgedCredentials.credential;
+			if (bridgedCredentials && !bridgedCredentials.timeout) throw notAllowedError(bridgedCredentials.error || "WebAuthn cancelled or failed (bridge)");
+			throw new Error("WebAuthn bridge timeout");
+		} catch (be) {
+			throw notAllowedError(be?.message || "WebAuthn bridge failed");
+		}
+		throw e;
+	}
+}
+async function requestParentDomainWebAuthn(kind, publicKey, client, timeoutMs) {
+	if (kind === "create") return client.request(WebAuthnBridgeMessage.Create, publicKey, timeoutMs);
+	return client.request(WebAuthnBridgeMessage.Get, publicKey, timeoutMs);
+}
+var WindowParentDomainWebAuthnClient = class {
+	async request(kind, publicKey, timeoutMs = 6e4) {
+		const requestId = `${kind}:${Date.now()}:${Math.random().toString(36).slice(2)}`;
+		const resultType = getResultTypeFor(kind);
+		return new Promise((resolve) => {
+			let settled = false;
+			const finish = (val) => {
+				if (!settled) {
+					settled = true;
+					resolve(val);
+				}
+			};
+			const onMessage = (ev) => {
+				const payload = ev?.data;
+				if (!payload || typeof payload.type !== "string") return;
+				const t = payload.type;
+				if (t !== resultType) return;
+				const rid = payload.requestId;
+				if (rid !== requestId) return;
+				window.removeEventListener("message", onMessage);
+				const ok = !!payload.ok;
+				const cred = payload.credential;
+				const err = payload.error;
+				if (ok && cred) return finish({
+					ok: true,
+					credential: cred
+				});
+				return finish({
+					ok: false,
+					error: typeof err === "string" ? err : void 0
+				});
+			};
+			window.addEventListener("message", onMessage);
+			window.parent?.postMessage({
+				type: kind,
+				requestId,
+				publicKey
+			}, "*");
+			setTimeout(() => {
+				window.removeEventListener("message", onMessage);
+				finish({
+					ok: false,
+					timeout: true
+				});
+			}, timeoutMs);
+		});
+	}
+};
+function notAllowedError(message) {
+	const e = new Error(message);
+	e.name = "NotAllowedError";
+	return e;
+}
+function isAncestorOriginError(err) {
+	const msg = safeMessage(err);
+	return /origin of the document is not the same as its ancestors/i.test(msg);
+}
+function isDocumentNotFocusedError(err) {
+	const name = safeName(err);
+	const msg = safeMessage(err);
+	const isNotAllowed = name === "NotAllowedError";
+	const mentionsFocus = /document is not focused|not focused|focus/i.test(msg);
+	return Boolean(isNotAllowed && mentionsFocus);
+}
+function safeMessage(err) {
+	return String(err?.message || "");
+}
+function safeName(err) {
+	const n = err?.name;
+	return typeof n === "string" ? n : "";
+}
+async function attemptRefocus(maxRetries = 2, delays = [50, 120]) {
+	window.focus?.();
+	(document?.body)?.focus?.();
+	const wait = (ms) => new Promise((r) => setTimeout(r, ms));
+	const total = Math.max(0, maxRetries);
+	for (let i = 0; i <= total; i++) {
+		const d = delays[i] ?? delays[delays.length - 1] ?? 80;
+		await wait(d);
+		if (document.hasFocus()) return true;
+		window.focus?.();
+	}
+	return document.hasFocus();
+}
+
+//#endregion
+//#region src/core/WebAuthnManager/touchIdPrompt.ts
+function isRegistrableSuffix(host, cand) {
+	if (!host || !cand) return false;
+	if (host === cand) return true;
+	return host.endsWith("." + cand);
+}
+function resolveRpId(override, host) {
+	const h = (host || "").toLowerCase();
+	const ov = (override || "").toLowerCase();
+	if (ov && h && isRegistrableSuffix(h, ov)) return ov;
+	return h || ov || "";
+}
+function authenticatorsToAllowCredentials(authenticators) {
+	return authenticators.map((auth) => ({
+		id: auth.credentialId,
+		type: "public-key",
+		transports: auth.transports
+	}));
+}
+/**
+* TouchIdPrompt prompts for touchID,
+* creates credentials,
+* manages WebAuthn touchID prompts,
+* and generates credentials, and PRF Outputs
+*/
+var TouchIdPrompt = class TouchIdPrompt {
+	rpIdOverride;
+	safariGetWebauthnRegistrationFallback;
+	abortController;
+	removePageAbortHandlers;
+	removeExternalAbortListener;
+	constructor(rpIdOverride, safariGetWebauthnRegistrationFallback = false) {
+		this.rpIdOverride = rpIdOverride;
+		this.safariGetWebauthnRegistrationFallback = safariGetWebauthnRegistrationFallback === true;
+	}
+	getRpId() {
+		try {
+			return resolveRpId(this.rpIdOverride, window?.location?.hostname);
+		} catch {
+			return this.rpIdOverride || "";
+		}
+	}
+	static _inIframe() {
+		try {
+			return window.self !== window.top;
+		} catch {
+			return true;
+		}
+	}
+	/**
+	* Get authentication credentials
+	* @param nearAccountId - NEAR account ID to authenticate
+	* @param challenge - VRF challenge bytes
+	* @param allowCredentials - Array of allowed credentials for authentication
+	* @returns WebAuthn credential with only the first PRF output
+	*/
+	async getAuthenticationCredentialsSerialized({ nearAccountId, challenge, allowCredentials }) {
+		const credentialMaybe = await this.getAuthenticationCredentialsInternal({
+			nearAccountId,
+			challenge,
+			allowCredentials
+		});
+		if (isSerializedAuthenticationCredential(credentialMaybe)) return credentialMaybe;
+		return serializeAuthenticationCredentialWithPRF({
+			credential: credentialMaybe,
+			firstPrfOutput: true,
+			secondPrfOutput: false
+		});
+	}
+	/**
+	*  Same as getAuthenticationCredentialsSerialized but returns both PRF outputs
+	*  (PRF.first + PRF.second).
+	* @param nearAccountId - NEAR account ID to authenticate
+	* @param challenge - VRF challenge bytes
+	* @param allowCredentials - Array of allowed credentials for authentication
+	* @returns
+	*/
+	async getAuthenticationCredentialsSerializedDualPrf({ nearAccountId, challenge, allowCredentials }) {
+		const credentialMaybe = await this.getAuthenticationCredentialsInternal({
+			nearAccountId,
+			challenge,
+			allowCredentials
+		});
+		if (isSerializedAuthenticationCredential(credentialMaybe)) return credentialMaybe;
+		return serializeAuthenticationCredentialWithPRF({
+			credential: credentialMaybe,
+			firstPrfOutput: true,
+			secondPrfOutput: true
+		});
+	}
+	/**
+	* Internal method for generating WebAuthn registration credentials with PRF output
+	* @param nearAccountId - NEAR account ID for PRF salts and keypair derivation (always base account)
+	* @param challenge - Random challenge bytes for the registration ceremony
+	* @param deviceNumber - Device number for device-specific user ID.
+	* @returns Credential with PRF output
+	*/
+	async generateRegistrationCredentialsInternal({ nearAccountId, challenge, deviceNumber }) {
+		this.abortController = new AbortController();
+		this.removePageAbortHandlers = TouchIdPrompt.attachPageAbortHandlers(this.abortController);
+		const rpId = this.getRpId();
+		const publicKey = {
+			challenge: outputAs32Bytes(challenge),
+			rp: {
+				name: "WebAuthn VRF Passkey",
+				id: rpId
+			},
+			user: {
+				id: new TextEncoder().encode(generateDeviceSpecificUserId(nearAccountId, deviceNumber)),
+				name: generateDeviceSpecificUserId(nearAccountId, deviceNumber),
+				displayName: generateUserFriendlyDisplayName(nearAccountId, deviceNumber)
+			},
+			pubKeyCredParams: [{
+				alg: -7,
+				type: "public-key"
+			}, {
+				alg: -257,
+				type: "public-key"
+			}],
+			authenticatorSelection: {
+				residentKey: "required",
+				userVerification: "preferred"
+			},
+			timeout: 6e4,
+			attestation: "none",
+			extensions: { prf: { eval: {
+				first: generateChaCha20Salt(nearAccountId),
+				second: generateEd25519Salt(nearAccountId)
+			} } }
+		};
+		try {
+			const result = await executeWebAuthnWithParentFallbacksSafari("create", publicKey, {
+				rpId,
+				inIframe: TouchIdPrompt._inIframe(),
+				timeoutMs: publicKey.timeout,
+				abortSignal: this.abortController.signal
+			});
+			return result;
+		} finally {
+			this.removePageAbortHandlers?.();
+			this.removePageAbortHandlers = void 0;
+			this.removeExternalAbortListener?.();
+			this.removeExternalAbortListener = void 0;
+			this.abortController = void 0;
+		}
+	}
+	/**
+	* Internal method for getting WebAuthn authentication credentials with PRF output
+	* @param nearAccountId - NEAR account ID to authenticate
+	* @param challenge - VRF challenge bytes to use for WebAuthn authentication
+	* @param authenticators - List of stored authenticator data for the user
+	* @returns WebAuthn credential with PRF output (HKDF derivation done in WASM worker)
+	* ```ts
+	* const credential = await touchIdPrompt.getCredentials({
+	*   nearAccountId,
+	*   challenge,
+	*   authenticators,
+	* });
+	* ```
+	*/
+	async getAuthenticationCredentialsInternal({ nearAccountId, challenge, allowCredentials }) {
+		this.abortController = new AbortController();
+		this.removePageAbortHandlers = TouchIdPrompt.attachPageAbortHandlers(this.abortController);
+		const rpId = this.getRpId();
+		const publicKey = {
+			challenge: outputAs32Bytes(challenge),
+			rpId,
+			allowCredentials: allowCredentials.map((credential) => ({
+				id: base64UrlDecode(credential.id),
+				type: "public-key",
+				transports: credential.transports
+			})),
+			userVerification: "preferred",
+			timeout: 6e4,
+			extensions: { prf: { eval: {
+				first: generateChaCha20Salt(nearAccountId),
+				second: generateEd25519Salt(nearAccountId)
+			} } }
+		};
+		try {
+			const result = await executeWebAuthnWithParentFallbacksSafari("get", publicKey, {
+				rpId,
+				inIframe: TouchIdPrompt._inIframe(),
+				timeoutMs: publicKey.timeout,
+				permitGetBridgeOnAncestorError: this.safariGetWebauthnRegistrationFallback,
+				abortSignal: this.abortController.signal
+			});
+			return result;
+		} finally {
+			this.removePageAbortHandlers?.();
+			this.removePageAbortHandlers = void 0;
+			this.removeExternalAbortListener?.();
+			this.removeExternalAbortListener = void 0;
+			this.abortController = void 0;
+		}
+	}
+};
+function isSerializedAuthenticationCredential(x) {
+	if (!x || typeof x !== "object") return false;
+	const obj = x;
+	const resp = obj.response;
+	return typeof resp?.authenticatorData === "string";
+}
+/**
+* Generate device-specific user ID to prevent Chrome sync conflicts
+* Creates technical identifiers with full account context
+*
+* @param nearAccountId - The NEAR account ID (e.g., "serp120.w3a-v1.testnet")
+* @param deviceNumber - The device number (optional, undefined for device 1, 2 for device 2, etc.)
+* @returns Technical identifier:
+*   - Device 1: "serp120.web3-authn.testnet"
+*   - Device 2: "serp120.web3-authn.testnet (2)"
+*   - Device 3: "serp120.web3-authn.testnet (3)"
+*/
+function generateDeviceSpecificUserId(nearAccountId, deviceNumber) {
+	if (deviceNumber === void 0 || deviceNumber === 1) return nearAccountId;
+	return `${nearAccountId} (${deviceNumber})`;
+}
+/**
+* Generate user-friendly display name for passkey manager UI
+* Creates clean, intuitive names that users will see
+*
+* @param nearAccountId - The NEAR account ID (e.g., "serp120.w3a-v1.testnet")
+* @param deviceNumber - The device number (optional, undefined for device 1, 2 for device 2, etc.)
+* @returns User-friendly display name:
+*   - Device 1: "serp120"
+*   - Device 2: "serp120 (device 2)"
+*   - Device 3: "serp120 (device 3)"
+*/
+function generateUserFriendlyDisplayName(nearAccountId, deviceNumber) {
+	const baseUsername = nearAccountId.split(".")[0];
+	if (deviceNumber === void 0 || deviceNumber === 1) return baseUsername;
+	return `${baseUsername} (device ${deviceNumber})`;
+}
+(function(_TouchIdPrompt) {
+	function attachPageAbortHandlers(controller) {
+		const onVisibility = () => {
+			if (document.hidden) controller.abort();
+		};
+		const onPageHide = () => {
+			controller.abort();
+		};
+		const onBeforeUnload = () => {
+			controller.abort();
+		};
+		document.addEventListener("visibilitychange", onVisibility, { passive: true });
+		window.addEventListener("pagehide", onPageHide, { passive: true });
+		window.addEventListener("beforeunload", onBeforeUnload, { passive: true });
+		return () => {
+			document.removeEventListener("visibilitychange", onVisibility);
+			window.removeEventListener("pagehide", onPageHide);
+			window.removeEventListener("beforeunload", onBeforeUnload);
+		};
+	}
+	_TouchIdPrompt.attachPageAbortHandlers = attachPageAbortHandlers;
+})(TouchIdPrompt || (TouchIdPrompt = {}));
+
+//#endregion
+//#region src/core/types/actions.ts
+/**
+* Enum for all supported NEAR action types
+*/
+let ActionType = /* @__PURE__ */ function(ActionType$1) {
+	ActionType$1["CreateAccount"] = "CreateAccount";
+	ActionType$1["DeployContract"] = "DeployContract";
+	ActionType$1["FunctionCall"] = "FunctionCall";
+	ActionType$1["Transfer"] = "Transfer";
+	ActionType$1["Stake"] = "Stake";
+	ActionType$1["AddKey"] = "AddKey";
+	ActionType$1["DeleteKey"] = "DeleteKey";
+	ActionType$1["DeleteAccount"] = "DeleteAccount";
+	ActionType$1["SignedDelegate"] = "SignedDelegate";
+	ActionType$1["DeployGlobalContract"] = "DeployGlobalContract";
+	ActionType$1["UseGlobalContract"] = "UseGlobalContract";
+	return ActionType$1;
+}({});
+function isActionArgsWasm(a) {
+	return isObject(a) && "action_type" in a;
+}
+function toActionArgsWasm(action) {
+	switch (action.type) {
+		case ActionType.Transfer: return {
+			action_type: ActionType.Transfer,
+			deposit: action.amount
+		};
+		case ActionType.FunctionCall: return {
+			action_type: ActionType.FunctionCall,
+			method_name: action.methodName,
+			args: JSON.stringify(action.args),
+			gas: action.gas || "30000000000000",
+			deposit: action.deposit || "0"
+		};
+		case ActionType.AddKey:
+			const rawPermission = action.accessKey.permission;
+			const permission = rawPermission === "FullAccess" ? { FullAccess: {} } : rawPermission;
+			const accessKey = {
+				nonce: action.accessKey.nonce || 0,
+				permission
+			};
+			return {
+				action_type: ActionType.AddKey,
+				public_key: action.publicKey,
+				access_key: JSON.stringify(accessKey)
+			};
+		case ActionType.DeleteKey: return {
+			action_type: ActionType.DeleteKey,
+			public_key: action.publicKey
+		};
+		case ActionType.CreateAccount: return { action_type: ActionType.CreateAccount };
+		case ActionType.DeleteAccount: return {
+			action_type: ActionType.DeleteAccount,
+			beneficiary_id: action.beneficiaryId
+		};
+		case ActionType.DeployContract: return {
+			action_type: ActionType.DeployContract,
+			code: typeof action.code === "string" ? Array.from(new TextEncoder().encode(action.code)) : Array.from(action.code)
+		};
+		case ActionType.DeployGlobalContract: return {
+			action_type: ActionType.DeployGlobalContract,
+			code: typeof action.code === "string" ? Array.from(new TextEncoder().encode(action.code)) : Array.from(action.code),
+			deploy_mode: action.deployMode
+		};
+		case ActionType.UseGlobalContract: return {
+			action_type: ActionType.UseGlobalContract,
+			account_id: action.accountId,
+			code_hash: action.codeHash
+		};
+		case ActionType.Stake: return {
+			action_type: ActionType.Stake,
+			stake: action.stake,
+			public_key: action.publicKey
+		};
+		default: throw new Error(`Action type ${action.type} is not supported`);
+	}
+}
+/**
+* Validate action parameters before sending to worker
+*/
+function validateActionArgsWasm(actionArgsWasm) {
+	switch (actionArgsWasm.action_type) {
+		case ActionType.FunctionCall:
+			if (!actionArgsWasm.method_name) throw new Error("method_name required for FunctionCall");
+			if (!actionArgsWasm.args) throw new Error("args required for FunctionCall");
+			if (!actionArgsWasm.gas) throw new Error("gas required for FunctionCall");
+			if (!actionArgsWasm.deposit) throw new Error("deposit required for FunctionCall");
+			if (typeof actionArgsWasm.args !== "string") throw new Error("FunctionCall action args must be a valid JSON string");
+			try {
+				JSON.parse(actionArgsWasm.args);
+			} catch {
+				throw new Error("FunctionCall action args must be valid JSON string");
+			}
+			break;
+		case ActionType.Transfer:
+			if (!actionArgsWasm.deposit) throw new Error("deposit required for Transfer");
+			break;
+		case ActionType.CreateAccount: break;
+		case ActionType.DeployContract:
+			if (!actionArgsWasm.code || actionArgsWasm.code.length === 0) throw new Error("code required for DeployContract");
+			break;
+		case ActionType.Stake:
+			if (!actionArgsWasm.stake) throw new Error("stake amount required for Stake");
+			if (!actionArgsWasm.public_key) throw new Error("public_key required for Stake");
+			break;
+		case ActionType.AddKey:
+			if (!actionArgsWasm.public_key) throw new Error("public_key required for AddKey");
+			if (!actionArgsWasm.access_key) throw new Error("access_key required for AddKey");
+			if (typeof actionArgsWasm.access_key !== "string") throw new Error("AddKey action access_key must be a valid JSON string");
+			try {
+				JSON.parse(actionArgsWasm.access_key);
+			} catch {
+				throw new Error("AddKey action access_key must be valid JSON string");
+			}
+			break;
+		case ActionType.DeleteKey:
+			if (!actionArgsWasm.public_key) throw new Error("public_key required for DeleteKey");
+			break;
+		case ActionType.DeleteAccount:
+			if (!actionArgsWasm.beneficiary_id) throw new Error("beneficiary_id required for DeleteAccount");
+			break;
+		case ActionType.SignedDelegate: {
+			const payload = actionArgsWasm;
+			if (!payload.delegate_action || typeof payload.delegate_action !== "object") throw new Error("delegate_action required for SignedDelegate");
+			if (!payload.signature || typeof payload.signature !== "object") throw new Error("signature required for SignedDelegate");
+			break;
+		}
+		case ActionType.DeployGlobalContract:
+			if (!actionArgsWasm.code || actionArgsWasm.code.length === 0) throw new Error("code required for DeployGlobalContract");
+			if (!actionArgsWasm.deploy_mode || actionArgsWasm.deploy_mode !== "CodeHash" && actionArgsWasm.deploy_mode !== "AccountId") throw new Error("deploy_mode must be CodeHash or AccountId for DeployGlobalContract");
+			break;
+		case ActionType.UseGlobalContract: {
+			const hasAccountId = !!actionArgsWasm.account_id;
+			const hasCodeHash = !!actionArgsWasm.code_hash;
+			if (hasAccountId === hasCodeHash) throw new Error("UseGlobalContract requires exactly one of account_id or code_hash");
+			break;
+		}
+		default: throw new Error(`Unsupported action type: ${actionArgsWasm.action_type}`);
+	}
+}
+/**
+* Convert a single ActionArgsWasm (snake_case, stringified fields) to ActionArgs (camelCase, typed fields)
+*/
+function fromActionArgsWasm(a) {
+	switch (a.action_type) {
+		case ActionType.FunctionCall: {
+			let parsedArgs = {};
+			try {
+				if (typeof a.args === "string") parsedArgs = a.args ? JSON.parse(a.args) : {};
+				else parsedArgs = a.args || {};
+			} catch {
+				parsedArgs = {};
+			}
+			return {
+				type: ActionType.FunctionCall,
+				methodName: a.method_name,
+				args: parsedArgs,
+				gas: a.gas,
+				deposit: a.deposit
+			};
+		}
+		case ActionType.Transfer: return {
+			type: ActionType.Transfer,
+			amount: a.deposit
+		};
+		case ActionType.CreateAccount: return { type: ActionType.CreateAccount };
+		case ActionType.DeployContract: {
+			const codeBytes = Array.isArray(a.code) ? new Uint8Array(a.code) : new Uint8Array();
+			return {
+				type: ActionType.DeployContract,
+				code: codeBytes
+			};
+		}
+		case ActionType.DeployGlobalContract: {
+			const codeBytes = Array.isArray(a.code) ? new Uint8Array(a.code) : new Uint8Array();
+			return {
+				type: ActionType.DeployGlobalContract,
+				code: codeBytes,
+				deployMode: a.deploy_mode
+			};
+		}
+		case ActionType.Stake: return {
+			type: ActionType.Stake,
+			stake: a.stake,
+			publicKey: a.public_key
+		};
+		case ActionType.AddKey: {
+			let accessKey;
+			try {
+				accessKey = JSON.parse(a.access_key);
+			} catch {
+				accessKey = {
+					nonce: BigInt(0),
+					permission: "FullAccess"
+				};
+			}
+			const permission = accessKey?.permission;
+			let normalizedPermission = "FullAccess";
+			if (isObject(permission)) {
+				if ("FullAccess" in permission) normalizedPermission = "FullAccess";
+				else if ("FunctionCall" in permission) {
+					const fc = permission.FunctionCall;
+					normalizedPermission = { FunctionCall: {
+						allowance: fc.allowance,
+						receiver_id: fc.receiver_id,
+						method_names: fc.method_names
+					} };
+				}
+			}
+			return {
+				type: ActionType.AddKey,
+				publicKey: a.public_key,
+				accessKey: {
+					nonce: typeof accessKey?.nonce === "number" ? accessKey.nonce : 0,
+					permission: normalizedPermission
+				}
+			};
+		}
+		case ActionType.DeleteKey: return {
+			type: ActionType.DeleteKey,
+			publicKey: a.public_key
+		};
+		case ActionType.DeleteAccount: return {
+			type: ActionType.DeleteAccount,
+			beneficiaryId: a.beneficiary_id
+		};
+		case ActionType.UseGlobalContract: return {
+			type: ActionType.UseGlobalContract,
+			accountId: a.account_id,
+			codeHash: a.code_hash
+		};
+		default: throw new Error(`Unsupported wasm action_type: ${a?.action_type}`);
+	}
+}
+/** Convert a TransactionInputWasm structure to TransactionInput */
+function fromTransactionInputWasm(tx) {
+	return {
+		receiverId: tx.receiverId,
+		actions: tx.actions.map(fromActionArgsWasm)
+	};
+}
+/** Convert an array of TransactionInputWasm to TransactionInput[] */
+function fromTransactionInputsWasm(txs) {
+	return (txs || []).map(fromTransactionInputWasm);
+}
+
+//#endregion
+//#region src/core/digests/intentDigest.ts
+async function sha256Base64UrlUtf8(input) {
+	const digest = await sha256BytesUtf8(input);
+	return base64UrlEncode(digest);
+}
+async function computeUiIntentDigestFromNep413(args) {
+	const json = alphabetizeStringify({
+		kind: "nep413",
+		...args
+	});
+	return sha256Base64UrlUtf8(json);
+}
+async function computeThresholdEd25519KeygenIntentDigest(args) {
+	const json = alphabetizeStringify({
+		kind: "threshold_ed25519_keygen",
+		...args
+	});
+	return sha256Base64UrlUtf8(json);
+}
+async function computeUiIntentDigestFromTxs(txInputs) {
+	const json = alphabetizeStringify(txInputs);
+	return sha256Base64UrlUtf8(json);
+}
+function orderActionForDigest(a) {
+	switch (a.action_type) {
+		case ActionType.FunctionCall: return {
+			action_type: a.action_type,
+			args: a.args,
+			deposit: a.deposit,
+			gas: a.gas,
+			method_name: a.method_name
+		};
+		case ActionType.Transfer: return {
+			action_type: a.action_type,
+			deposit: a.deposit
+		};
+		case ActionType.Stake: return {
+			action_type: a.action_type,
+			stake: a.stake,
+			public_key: a.public_key
+		};
+		case ActionType.AddKey: return {
+			action_type: a.action_type,
+			public_key: a.public_key,
+			access_key: a.access_key
+		};
+		case ActionType.DeleteKey: return {
+			action_type: a.action_type,
+			public_key: a.public_key
+		};
+		case ActionType.DeleteAccount: return {
+			action_type: a.action_type,
+			beneficiary_id: a.beneficiary_id
+		};
+		case ActionType.DeployContract: return {
+			action_type: a.action_type,
+			code: a.code
+		};
+		case ActionType.SignedDelegate: return {
+			action_type: a.action_type,
+			delegate_action: a.delegate_action,
+			signature: a.signature
+		};
+		case ActionType.DeployGlobalContract: return {
+			action_type: a.action_type,
+			code: a.code,
+			deploy_mode: a.deploy_mode
+		};
+		case ActionType.UseGlobalContract: return {
+			action_type: a.action_type,
+			account_id: a.account_id,
+			code_hash: a.code_hash
+		};
+		case ActionType.CreateAccount: return { action_type: a.action_type };
+		default: {
+			const _exhaustive = a;
+			return _exhaustive;
+		}
+	}
+}
+
+//#endregion
+//#region src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/types.ts
+let SecureConfirmMessageType = /* @__PURE__ */ function(SecureConfirmMessageType$1) {
+	SecureConfirmMessageType$1["PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD"] = "PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD";
+	SecureConfirmMessageType$1["USER_PASSKEY_CONFIRM_RESPONSE"] = "USER_PASSKEY_CONFIRM_RESPONSE";
+	return SecureConfirmMessageType$1;
+}({});
+let SecureConfirmationType = /* @__PURE__ */ function(SecureConfirmationType$1) {
+	SecureConfirmationType$1["SIGN_TRANSACTION"] = "signTransaction";
+	SecureConfirmationType$1["REGISTER_ACCOUNT"] = "registerAccount";
+	SecureConfirmationType$1["LINK_DEVICE"] = "linkDevice";
+	SecureConfirmationType$1["DECRYPT_PRIVATE_KEY_WITH_PRF"] = "decryptPrivateKeyWithPrf";
+	SecureConfirmationType$1["SIGN_NEP413_MESSAGE"] = "signNep413Message";
+	SecureConfirmationType$1["SHOW_SECURE_PRIVATE_KEY_UI"] = "showSecurePrivateKeyUi";
+	return SecureConfirmationType$1;
+}({});
+
+//#endregion
+//#region src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/adapters/common.ts
+function parseTransactionSummary(summaryData) {
+	if (!summaryData) return {};
+	if (isString(summaryData)) try {
+		const parsed = JSON.parse(summaryData);
+		return isObject(parsed) ? parsed : {};
+	} catch (parseError) {
+		console.warn("[SignerWorkerManager]: Failed to parse summary string:", parseError);
+		return {};
+	}
+	return isObject(summaryData) ? summaryData : {};
+}
+function sanitizeForPostMessage(data) {
+	if (data == null) return data;
+	if (Array.isArray(data)) return data.map((v) => v);
+	if (isObject(data)) {
+		const src = data;
+		const out = {};
+		for (const key of Object.keys(src)) {
+			if (key === "_confirmHandle") continue;
+			const value = src[key];
+			if (isFunction(value)) continue;
+			out[key] = value;
+		}
+		return out;
+	}
+	return data;
+}
+const ERROR_MESSAGES = {
+	cancelled: "User cancelled secure confirm request",
+	collectCredentialsFailed: "Failed to collect credentials",
+	nearRpcFailed: "Failed to fetch NEAR data"
+};
+function sendConfirmResponse(worker, response) {
+	const sanitized = sanitizeForPostMessage(response);
+	worker.postMessage({
+		type: SecureConfirmMessageType.USER_PASSKEY_CONFIRM_RESPONSE,
+		data: sanitized
+	});
+}
+function isUserCancelledSecureConfirm(error) {
+	return isTouchIdCancellationError(error) || (() => {
+		const e = toError(error);
+		return e?.name === "NotAllowedError" || e?.name === "AbortError";
+	})();
+}
+
+//#endregion
+//#region src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/adapters/requestHelpers.ts
+function getNearAccountId(request) {
+	switch (request.type) {
+		case SecureConfirmationType.SIGN_TRANSACTION: return getSignTransactionPayload(request).rpcCall.nearAccountId;
+		case SecureConfirmationType.SIGN_NEP413_MESSAGE: return request.payload.nearAccountId;
+		case SecureConfirmationType.REGISTER_ACCOUNT:
+		case SecureConfirmationType.LINK_DEVICE: return getRegisterAccountPayload(request).nearAccountId;
+		case SecureConfirmationType.DECRYPT_PRIVATE_KEY_WITH_PRF: {
+			const p = request.payload;
+			return p?.nearAccountId || "";
+		}
+		case SecureConfirmationType.SHOW_SECURE_PRIVATE_KEY_UI: {
+			const p = request.payload;
+			return p?.nearAccountId || "";
+		}
+		default: return "";
+	}
+}
+function getTxCount(request) {
+	return request.type === SecureConfirmationType.SIGN_TRANSACTION ? getSignTransactionPayload(request).txSigningRequests?.length || 1 : 1;
+}
+function getIntentDigest(request) {
+	if (request.type === SecureConfirmationType.SIGN_TRANSACTION) {
+		const p = request?.payload;
+		return p?.intentDigest;
+	}
+	return request?.intentDigest;
+}
+function getSignTransactionPayload(request) {
+	if (request.type !== SecureConfirmationType.SIGN_TRANSACTION) throw new Error(`Expected SIGN_TRANSACTION request, got ${request.type}`);
+	return request.payload;
+}
+function getRegisterAccountPayload(request) {
+	if (request.type !== SecureConfirmationType.REGISTER_ACCOUNT && request.type !== SecureConfirmationType.LINK_DEVICE) throw new Error(`Expected REGISTER_ACCOUNT or LINK_DEVICE request, got ${request.type}`);
+	return request.payload;
+}
+
+//#endregion
+//#region src/core/WebAuthnManager/collectAuthenticationCredentialForVrfChallenge.ts
+async function collectAuthenticationCredentialForVrfChallenge(args) {
+	const nearAccountId = toAccountId(args.nearAccountId);
+	const authenticators = await args.indexedDB.clientDB.getAuthenticatorsByUser(nearAccountId);
+	let authenticatorsForPrompt = authenticators;
+	if (authenticators.length > 0) ({authenticatorsForPrompt} = await args.indexedDB.clientDB.ensureCurrentPasskey(toAccountId(nearAccountId), authenticators));
+	args.onBeforePrompt?.({
+		authenticators,
+		authenticatorsForPrompt,
+		vrfChallenge: args.vrfChallenge
+	});
+	const allowCredentials = authenticatorsToAllowCredentials(authenticatorsForPrompt);
+	const serialized = args.includeSecondPrfOutput ? await args.touchIdPrompt.getAuthenticationCredentialsSerializedDualPrf({
+		nearAccountId,
+		challenge: args.vrfChallenge,
+		allowCredentials
+	}) : await args.touchIdPrompt.getAuthenticationCredentialsSerialized({
+		nearAccountId,
+		challenge: args.vrfChallenge,
+		allowCredentials
+	});
+	if (authenticators.length > 0) {
+		const { wrongPasskeyError } = await args.indexedDB.clientDB.ensureCurrentPasskey(toAccountId(nearAccountId), authenticators, serialized.rawId);
+		if (wrongPasskeyError) throw new Error(wrongPasskeyError);
+	}
+	return serialized;
+}
+
+//#endregion
+export { ActionType, ERROR_MESSAGES, SecureConfirmMessageType, SecureConfirmationType, TouchIdPrompt, base64Decode, base64Encode, base64UrlDecode, collectAuthenticationCredentialForVrfChallenge, computeThresholdEd25519KeygenIntentDigest, computeUiIntentDigestFromNep413, computeUiIntentDigestFromTxs, createRandomVRFChallenge, errorMessage, fromTransactionInputsWasm, getIntentDigest, getNearAccountId, getRegisterAccountPayload, getSignTransactionPayload, getTxCount, isActionArgsWasm, isSerializedRegistrationCredential, isUserCancelledSecureConfirm, normalizeRegistrationCredential, orderActionForDigest, parseTransactionSummary, removePrfOutputGuard, sanitizeForPostMessage, sendConfirmResponse, serializeRegistrationCredentialWithPRF, sha256Base64UrlUtf8, toAccountId, toActionArgsWasm, toError, validateActionArgsWasm, validateVRFChallenge };
+//# sourceMappingURL=collectAuthenticationCredentialForVrfChallenge-C9p90e5Z.js.map