@tatchi-xyz/sdk 0.21.0 → 0.31.0

package/dist/esm/sdk/offline-export-app.js

@@ -1,7 +1,7 @@
-import { ActionType, SecureConfirmMessageType, SecureConfirmationType, TouchIdPrompt, base64Decode, base64Encode, base64UrlDecode, computeUiIntentDigestFromTxs, createRandomVRFChallenge, errorMessage, getIntentDigest, normalizeRegistrationCredential, orderActionForDigest, parseTransactionSummary, removePrfOutputGuard, sanitizeForPostMessage, sendConfirmResponse, serializeRegistrationCredentialWithPRF, toAccountId, toActionArgsWasm, toError, validateActionArgsWasm, validateNearAccountId, validateVRFChallenge } from "./requestHelpers-aUKhXiEl.js";
-import { assertString, isFunction, isNumber, isObject, isString } from "./validation-DhPPUba7.js";
-import { onEmbeddedBaseChange } from "./base-Qt2P7SNn.js";
-import { PASSKEY_MANAGER_DEFAULT_CONFIGS, buildConfigsFromEnv, getLastLoggedInDeviceNumber } from "./getDeviceNumber-BpernPnM.js";
+import { assertString, ensureEd25519Prefix, isFunction, isNumber, isObject, isString, stripTrailingSlashes, toOptionalTrimmedString, toTrimmedString, validateNearAccountId } from "./validation-hUZgySTx.js";
+import { ActionType, SecureConfirmMessageType, SecureConfirmationType, TouchIdPrompt, base64Decode, base64Encode, base64UrlDecode, collectAuthenticationCredentialForVrfChallenge, computeThresholdEd25519KeygenIntentDigest, computeUiIntentDigestFromTxs, createRandomVRFChallenge, errorMessage, getIntentDigest, normalizeRegistrationCredential, orderActionForDigest, parseTransactionSummary, removePrfOutputGuard, sanitizeForPostMessage, sendConfirmResponse, serializeRegistrationCredentialWithPRF, toAccountId, toActionArgsWasm, toError, validateActionArgsWasm, validateVRFChallenge } from "./collectAuthenticationCredentialForVrfChallenge-C9p90e5Z.js";
+import { DEFAULT_CONFIRMATION_CONFIG, DEFAULT_SIGNING_MODE, DEFAULT_THRESHOLD_BEHAVIOR, INTERNAL_WORKER_REQUEST_TYPE_SIGN_ADD_KEY_THRESHOLD_PUBLIC_KEY_NO_PROMPT, PASSKEY_MANAGER_DEFAULT_CONFIGS, THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID, THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID, UserVerificationPolicy as UserVerificationPolicy$1, WorkerRequestType, WorkerResponseType, buildConfigsFromEnv, coerceSignerMode, getLastLoggedInDeviceNumber, getThresholdBehaviorFromSignerMode, isDecryptPrivateKeyWithPrfSuccess, isDeriveNearKeypairAndEncryptSuccess, isExtractCosePublicKeySuccess, isRecoverKeypairFromPasskeySuccess, isRegisterDevice2WithDerivedKeySuccess, isSignAddKeyThresholdPublicKeyNoPromptSuccess, isSignDelegateActionSuccess, isSignNep413MessageSuccess, isSignTransactionsWithActionsSuccess, isWorkerError, isWorkerProgress, isWorkerSuccess, mergeSignerMode } from "./getDeviceNumber-f8bfPB9U.js";
+import { __isWalletIframeHostMode } from "./host-mode-CgqmYAwZ.js";
 
 //#region ../node_modules/.pnpm/idb@8.0.3/node_modules/idb/build/index.js
 const instanceOfAny = (object, constructors) => constructors.some((c) => object instanceof c);
@@ -217,383 +217,6 @@ replaceTraps((oldTraps) => ({
 	}
 }));
 
-//#endregion
-//#region src/wasm_signer_worker/pkg/wasm_signer_worker.js
-let wasm;
-const cachedTextEncoder = typeof TextEncoder !== "undefined" ? new TextEncoder("utf-8") : { encode: () => {
-	throw Error("TextEncoder not available");
-} };
-const encodeString = typeof cachedTextEncoder.encodeInto === "function" ? function(arg, view) {
-	return cachedTextEncoder.encodeInto(arg, view);
-} : function(arg, view) {
-	const buf = cachedTextEncoder.encode(arg);
-	view.set(buf);
-	return {
-		read: arg.length,
-		written: buf.length
-	};
-};
-const cachedTextDecoder = typeof TextDecoder !== "undefined" ? new TextDecoder("utf-8", {
-	ignoreBOM: true,
-	fatal: true
-}) : { decode: () => {
-	throw Error("TextDecoder not available");
-} };
-if (typeof TextDecoder !== "undefined") cachedTextDecoder.decode();
-const CLOSURE_DTORS = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((state) => {
-	wasm.__wbindgen_export_5.get(state.dtor)(state.a, state.b);
-});
-/**
-* Behavior mode for confirmation flow
-* @enum {0 | 1}
-*/
-const ConfirmationBehavior = Object.freeze({
-	RequireClick: 0,
-	"0": "RequireClick",
-	AutoProceed: 1,
-	"1": "AutoProceed"
-});
-/**
-* UI mode for confirmation display
-* @enum {0 | 1 | 2}
-*/
-const ConfirmationUIMode = Object.freeze({
-	Skip: 0,
-	"0": "Skip",
-	Modal: 1,
-	"1": "Modal",
-	Drawer: 2,
-	"2": "Drawer"
-});
-/**
-* Progress message types that can be sent during WASM operations.
-* Values MUST align with the progress variants of WorkerResponseType in
-* `worker_messages.rs` so that TypeScript can treat them as progress
-* responses (not success/failure) based on the shared numeric codes.
-* @enum {18 | 19 | 20 | 21}
-*/
-const ProgressMessageType = Object.freeze({
-	RegistrationProgress: 18,
-	"18": "RegistrationProgress",
-	RegistrationComplete: 19,
-	"19": "RegistrationComplete",
-	ExecuteActionsProgress: 20,
-	"20": "ExecuteActionsProgress",
-	ExecuteActionsComplete: 21,
-	"21": "ExecuteActionsComplete"
-});
-/**
-* Progress step identifiers for different phases of operations
-* Values start at 100 to avoid conflicts with WorkerResponseType enum
-* @enum {100 | 101 | 102 | 103 | 104 | 105 | 106}
-*/
-const ProgressStep = Object.freeze({
-	Preparation: 100,
-	"100": "Preparation",
-	UserConfirmation: 101,
-	"101": "UserConfirmation",
-	WebauthnAuthentication: 102,
-	"102": "WebauthnAuthentication",
-	AuthenticationComplete: 103,
-	"103": "AuthenticationComplete",
-	TransactionSigningProgress: 104,
-	"104": "TransactionSigningProgress",
-	TransactionSigningComplete: 105,
-	"105": "TransactionSigningComplete",
-	Error: 106,
-	"106": "Error"
-});
-/**
-* User verification policy for WebAuthn authenticators
-* @enum {0 | 1 | 2}
-*/
-const UserVerificationPolicy$1 = Object.freeze({
-	Required: 0,
-	"0": "Required",
-	Preferred: 1,
-	"1": "Preferred",
-	Discouraged: 2,
-	"2": "Discouraged"
-});
-/**
-* @enum {0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8}
-*/
-const WorkerRequestType = Object.freeze({
-	DeriveNearKeypairAndEncrypt: 0,
-	"0": "DeriveNearKeypairAndEncrypt",
-	RecoverKeypairFromPasskey: 1,
-	"1": "RecoverKeypairFromPasskey",
-	DecryptPrivateKeyWithPrf: 2,
-	"2": "DecryptPrivateKeyWithPrf",
-	SignTransactionsWithActions: 3,
-	"3": "SignTransactionsWithActions",
-	ExtractCosePublicKey: 4,
-	"4": "ExtractCosePublicKey",
-	SignTransactionWithKeyPair: 5,
-	"5": "SignTransactionWithKeyPair",
-	SignNep413Message: 6,
-	"6": "SignNep413Message",
-	RegisterDevice2WithDerivedKey: 7,
-	"7": "RegisterDevice2WithDerivedKey",
-	SignDelegateAction: 8,
-	"8": "SignDelegateAction"
-});
-/**
-* Worker response types enum - corresponds to TypeScript WorkerResponseType
-* @enum {0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21}
-*/
-const WorkerResponseType = Object.freeze({
-	DeriveNearKeypairAndEncryptSuccess: 0,
-	"0": "DeriveNearKeypairAndEncryptSuccess",
-	RecoverKeypairFromPasskeySuccess: 1,
-	"1": "RecoverKeypairFromPasskeySuccess",
-	DecryptPrivateKeyWithPrfSuccess: 2,
-	"2": "DecryptPrivateKeyWithPrfSuccess",
-	SignTransactionsWithActionsSuccess: 3,
-	"3": "SignTransactionsWithActionsSuccess",
-	ExtractCosePublicKeySuccess: 4,
-	"4": "ExtractCosePublicKeySuccess",
-	SignTransactionWithKeyPairSuccess: 5,
-	"5": "SignTransactionWithKeyPairSuccess",
-	SignNep413MessageSuccess: 6,
-	"6": "SignNep413MessageSuccess",
-	RegisterDevice2WithDerivedKeySuccess: 7,
-	"7": "RegisterDevice2WithDerivedKeySuccess",
-	SignDelegateActionSuccess: 8,
-	"8": "SignDelegateActionSuccess",
-	DeriveNearKeypairAndEncryptFailure: 9,
-	"9": "DeriveNearKeypairAndEncryptFailure",
-	RecoverKeypairFromPasskeyFailure: 10,
-	"10": "RecoverKeypairFromPasskeyFailure",
-	DecryptPrivateKeyWithPrfFailure: 11,
-	"11": "DecryptPrivateKeyWithPrfFailure",
-	SignTransactionsWithActionsFailure: 12,
-	"12": "SignTransactionsWithActionsFailure",
-	ExtractCosePublicKeyFailure: 13,
-	"13": "ExtractCosePublicKeyFailure",
-	SignTransactionWithKeyPairFailure: 14,
-	"14": "SignTransactionWithKeyPairFailure",
-	SignNep413MessageFailure: 15,
-	"15": "SignNep413MessageFailure",
-	RegisterDevice2WithDerivedKeyFailure: 16,
-	"16": "RegisterDevice2WithDerivedKeyFailure",
-	SignDelegateActionFailure: 17,
-	"17": "SignDelegateActionFailure",
-	RegistrationProgress: 18,
-	"18": "RegistrationProgress",
-	RegistrationComplete: 19,
-	"19": "RegistrationComplete",
-	ExecuteActionsProgress: 20,
-	"20": "ExecuteActionsProgress",
-	ExecuteActionsComplete: 21,
-	"21": "ExecuteActionsComplete"
-});
-const AuthenticationResponseFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_authenticationresponse_free(ptr >>> 0, 1));
-const AuthenticatorOptionsFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_authenticatoroptions_free(ptr >>> 0, 1));
-const ClientExtensionResultsFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_clientextensionresults_free(ptr >>> 0, 1));
-const ConfirmationConfigFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_confirmationconfig_free(ptr >>> 0, 1));
-const CoseExtractionResultFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_coseextractionresult_free(ptr >>> 0, 1));
-const DecryptPrivateKeyRequestFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_decryptprivatekeyrequest_free(ptr >>> 0, 1));
-const DecryptPrivateKeyResultFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_decryptprivatekeyresult_free(ptr >>> 0, 1));
-const DecryptionPayloadFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_decryptionpayload_free(ptr >>> 0, 1));
-const DelegateSignResultFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_delegatesignresult_free(ptr >>> 0, 1));
-const DeriveNearKeypairAndEncryptRequestFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_derivenearkeypairandencryptrequest_free(ptr >>> 0, 1));
-const DeriveNearKeypairAndEncryptResultFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_derivenearkeypairandencryptresult_free(ptr >>> 0, 1));
-const Device2TransactionContextFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_device2transactioncontext_free(ptr >>> 0, 1));
-const ExtractCoseRequestFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_extractcoserequest_free(ptr >>> 0, 1));
-const KeyActionResultFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_keyactionresult_free(ptr >>> 0, 1));
-const OriginPolicyInputFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_originpolicyinput_free(ptr >>> 0, 1));
-const PrfOutputsFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_prfoutputs_free(ptr >>> 0, 1));
-const PrfResultsFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_prfresults_free(ptr >>> 0, 1));
-const RecoverKeypairRequestFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_recoverkeypairrequest_free(ptr >>> 0, 1));
-const RecoverKeypairResultFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_recoverkeypairresult_free(ptr >>> 0, 1));
-const RegisterDevice2WithDerivedKeyRequestFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_registerdevice2withderivedkeyrequest_free(ptr >>> 0, 1));
-const RegisterDevice2WithDerivedKeyResultFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_registerdevice2withderivedkeyresult_free(ptr >>> 0, 1));
-const RegistrationPayloadFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_registrationpayload_free(ptr >>> 0, 1));
-const RegistrationResponseFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_registrationresponse_free(ptr >>> 0, 1));
-const RpcCallPayloadFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_rpccallpayload_free(ptr >>> 0, 1));
-const SerializedCredentialFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_serializedcredential_free(ptr >>> 0, 1));
-const SerializedRegistrationCredentialFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_serializedregistrationcredential_free(ptr >>> 0, 1));
-const SignNep413RequestFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_signnep413request_free(ptr >>> 0, 1));
-const SignNep413ResultFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_signnep413result_free(ptr >>> 0, 1));
-const TransactionContextFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_transactioncontext_free(ptr >>> 0, 1));
-const TransactionSignResultFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_transactionsignresult_free(ptr >>> 0, 1));
-const VrfChallengeFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_vrfchallenge_free(ptr >>> 0, 1));
-const WasmDelegateActionFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_wasmdelegateaction_free(ptr >>> 0, 1));
-const WasmPublicKeyFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_wasmpublickey_free(ptr >>> 0, 1));
-const WasmSignatureFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_wasmsignature_free(ptr >>> 0, 1));
-const WasmSignedDelegateFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_wasmsigneddelegate_free(ptr >>> 0, 1));
-const WasmSignedTransactionFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_wasmsignedtransaction_free(ptr >>> 0, 1));
-const WasmTransactionFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_wasmtransaction_free(ptr >>> 0, 1));
-const WebAuthnAuthenticationCredentialStructFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_webauthnauthenticationcredentialstruct_free(ptr >>> 0, 1));
-const WebAuthnRegistrationCredentialStructFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_webauthnregistrationcredentialstruct_free(ptr >>> 0, 1));
-const WorkerProgressMessageFinalization = typeof FinalizationRegistry === "undefined" ? {
-	register: () => {},
-	unregister: () => {}
-} : new FinalizationRegistry((ptr) => wasm.__wbg_workerprogressmessage_free(ptr >>> 0, 1));
-
-//#endregion
-//#region src/core/types/signer-worker.ts
-const DEFAULT_CONFIRMATION_CONFIG = {
-	uiMode: "modal",
-	behavior: "requireClick",
-	autoProceedDelay: 0,
-	theme: "dark"
-};
-function isWorkerProgress(response) {
-	return response.type === WorkerResponseType.RegistrationProgress || response.type === WorkerResponseType.RegistrationComplete || response.type === WorkerResponseType.ExecuteActionsProgress || response.type === WorkerResponseType.ExecuteActionsComplete;
-}
-function isWorkerSuccess(response) {
-	return response.type === WorkerResponseType.DeriveNearKeypairAndEncryptSuccess || response.type === WorkerResponseType.RecoverKeypairFromPasskeySuccess || response.type === WorkerResponseType.DecryptPrivateKeyWithPrfSuccess || response.type === WorkerResponseType.SignTransactionsWithActionsSuccess || response.type === WorkerResponseType.SignDelegateActionSuccess || response.type === WorkerResponseType.ExtractCosePublicKeySuccess || response.type === WorkerResponseType.SignTransactionWithKeyPairSuccess || response.type === WorkerResponseType.SignNep413MessageSuccess || response.type === WorkerResponseType.RegisterDevice2WithDerivedKeySuccess;
-}
-function isWorkerError(response) {
-	return response.type === WorkerResponseType.DeriveNearKeypairAndEncryptFailure || response.type === WorkerResponseType.RecoverKeypairFromPasskeyFailure || response.type === WorkerResponseType.DecryptPrivateKeyWithPrfFailure || response.type === WorkerResponseType.SignTransactionsWithActionsFailure || response.type === WorkerResponseType.SignDelegateActionFailure || response.type === WorkerResponseType.ExtractCosePublicKeyFailure || response.type === WorkerResponseType.SignTransactionWithKeyPairFailure || response.type === WorkerResponseType.SignNep413MessageFailure || response.type === WorkerResponseType.RegisterDevice2WithDerivedKeyFailure;
-}
-function isDeriveNearKeypairAndEncryptSuccess(response) {
-	return response.type === WorkerResponseType.DeriveNearKeypairAndEncryptSuccess;
-}
-function isRecoverKeypairFromPasskeySuccess(response) {
-	return response.type === WorkerResponseType.RecoverKeypairFromPasskeySuccess;
-}
-function isSignTransactionsWithActionsSuccess(response) {
-	return response.type === WorkerResponseType.SignTransactionsWithActionsSuccess;
-}
-function isSignDelegateActionSuccess(response) {
-	return response.type === WorkerResponseType.SignDelegateActionSuccess;
-}
-function isDecryptPrivateKeyWithPrfSuccess(response) {
-	return response.type === WorkerResponseType.DecryptPrivateKeyWithPrfSuccess;
-}
-function isExtractCosePublicKeySuccess(response) {
-	return response.type === WorkerResponseType.ExtractCosePublicKeySuccess;
-}
-function isSignNep413MessageSuccess(response) {
-	return response.type === WorkerResponseType.SignNep413MessageSuccess;
-}
-function isRegisterDevice2WithDerivedKeySuccess(response) {
-	return response.type === WorkerResponseType.RegisterDevice2WithDerivedKeySuccess;
-}
-
 //#endregion
 //#region src/core/IndexedDBManager/passkeyClientDB.ts
 const DB_CONFIG$1 = {
@@ -1142,6 +765,21 @@ var PasskeyClientDBManager = class {
 		return theme || "dark";
 	}
 	/**
+	* Get user's signer mode preference from IndexedDB
+	*/
+	async getSignerMode(nearAccountId) {
+		const user = await this.getUser(nearAccountId);
+		const raw = user?.preferences?.signerMode;
+		return coerceSignerMode(raw, DEFAULT_SIGNING_MODE);
+	}
+	/**
+	* Set user's signer mode preference in IndexedDB
+	*/
+	async setSignerMode(nearAccountId, signerMode) {
+		const next = coerceSignerMode(signerMode, DEFAULT_SIGNING_MODE);
+		await this.updatePreferences(nearAccountId, { signerMode: next });
+	}
+	/**
 	* Toggle between dark and light theme for a user
 	* @param nearAccountId - The user's account ID
 	* @returns The new theme that was set
@@ -1257,253 +895,6 @@ var PasskeyClientDBManager = class {
 	}
 };
 
-//#endregion
-//#region src/core/IndexedDBManager/passkeyNearKeysDB.ts
-const DB_CONFIG = {
-	dbName: "PasskeyNearKeys",
-	dbVersion: 2,
-	storeName: "encryptedKeys",
-	keyPath: ["nearAccountId", "deviceNumber"]
-};
-var PasskeyNearKeysDBManager = class {
-	config;
-	db = null;
-	disabled = false;
-	constructor(config = DB_CONFIG) {
-		this.config = config;
-	}
-	getDbName() {
-		return this.config.dbName;
-	}
-	setDbName(dbName) {
-		const next = String(dbName || "").trim();
-		if (!next || next === this.config.dbName) return;
-		try {
-			this.db?.close?.();
-		} catch {}
-		this.db = null;
-		this.config = {
-			...this.config,
-			dbName: next
-		};
-	}
-	isDisabled() {
-		return this.disabled;
-	}
-	setDisabled(disabled) {
-		const next = !!disabled;
-		if (next === this.disabled) return;
-		this.disabled = next;
-		if (next) {
-			try {
-				this.db?.close?.();
-			} catch {}
-			this.db = null;
-		}
-	}
-	/**
-	* Get database connection, initializing if necessary
-	*/
-	async getDB() {
-		if (this.disabled) throw new Error("[PasskeyNearKeysDBManager] IndexedDB is disabled in this environment.");
-		if (this.db) return this.db;
-		this.db = await openDB(this.config.dbName, this.config.dbVersion, {
-			upgrade(db) {
-				try {
-					if (db.objectStoreNames.contains(DB_CONFIG.storeName)) db.deleteObjectStore(DB_CONFIG.storeName);
-				} catch {}
-				const store = db.createObjectStore(DB_CONFIG.storeName, { keyPath: DB_CONFIG.keyPath });
-				try {
-					store.createIndex("nearAccountId", "nearAccountId", { unique: false });
-				} catch {}
-			},
-			blocked() {
-				console.warn("PasskeyNearKeysDB connection is blocked.");
-			},
-			blocking() {
-				console.warn("PasskeyNearKeysDB connection is blocking another connection.");
-			},
-			terminated: () => {
-				console.warn("PasskeyNearKeysDB connection has been terminated.");
-				this.db = null;
-			}
-		});
-		return this.db;
-	}
-	/**
-	* Store encrypted key data
-	*/
-	async storeEncryptedKey(data) {
-		const db = await this.getDB();
-		if (!data.chacha20NonceB64u) throw new Error("PasskeyNearKeysDB: Missing chacha20NonceB64u");
-		await db.put(this.config.storeName, data);
-	}
-	/**
-	* Retrieve encrypted key data
-	*/
-	async getEncryptedKey(nearAccountId, deviceNumber) {
-		const db = await this.getDB();
-		const sanitize = (rec) => {
-			if (!rec?.encryptedData || !rec?.chacha20NonceB64u) return null;
-			return {
-				nearAccountId: rec.nearAccountId,
-				deviceNumber: rec.deviceNumber,
-				encryptedData: rec.encryptedData,
-				chacha20NonceB64u: rec.chacha20NonceB64u,
-				wrapKeySalt: rec.wrapKeySalt,
-				version: rec.version,
-				timestamp: rec.timestamp
-			};
-		};
-		if (typeof deviceNumber === "number") {
-			const res = await db.get(this.config.storeName, [nearAccountId, deviceNumber]);
-			const direct = sanitize(res);
-			if (direct) return direct;
-			if (nearAccountId !== "_init_check") console.warn("PasskeyNearKeysDB: getEncryptedKey - No result for device", deviceNumber, "→ falling back to any key for account");
-			try {
-				const idx = db.transaction(this.config.storeName).store.index("nearAccountId");
-				const all = await idx.getAll(nearAccountId);
-				if (Array.isArray(all) && all.length > 0) {
-					const latest = all.reduce((a, b) => a.timestamp >= b.timestamp ? a : b);
-					return sanitize(latest);
-				}
-			} catch {}
-			return null;
-		}
-		try {
-			const idx = db.transaction(this.config.storeName).store.index("nearAccountId");
-			const all = await idx.getAll(nearAccountId);
-			if (Array.isArray(all) && all.length > 0) {
-				const latest = all.reduce((a, b) => a.timestamp >= b.timestamp ? a : b);
-				return sanitize(latest);
-			}
-		} catch {}
-		return null;
-	}
-	/**
-	* Verify key storage by attempting retrieval
-	*/
-	async verifyKeyStorage(nearAccountId, deviceNumber) {
-		const retrievedKey = await this.getEncryptedKey(nearAccountId, deviceNumber);
-		return !!retrievedKey;
-	}
-	/**
-	* Delete encrypted key data for a specific account
-	*/
-	async deleteEncryptedKey(nearAccountId, deviceNumber) {
-		const db = await this.getDB();
-		if (typeof deviceNumber === "number") await db.delete(this.config.storeName, [nearAccountId, deviceNumber]);
-		else {
-			const tx = db.transaction(this.config.storeName, "readwrite");
-			const idx = tx.store.index("nearAccountId");
-			let cursor = await idx.openCursor(IDBKeyRange.only(nearAccountId));
-			while (cursor) {
-				await tx.store.delete(cursor.primaryKey);
-				cursor = await cursor.continue();
-			}
-			await tx.done;
-		}
-		console.debug("PasskeyNearKeysDB: deleteEncryptedKey - Successfully deleted");
-	}
-	/**
-	* Get all encrypted keys (for migration or debugging purposes)
-	*/
-	async getAllEncryptedKeys() {
-		const db = await this.getDB();
-		const all = await db.getAll(this.config.storeName);
-		return all.map((rec) => {
-			if (!rec?.encryptedData || !rec?.chacha20NonceB64u) return null;
-			return {
-				nearAccountId: rec.nearAccountId,
-				deviceNumber: rec.deviceNumber,
-				encryptedData: rec.encryptedData,
-				chacha20NonceB64u: rec.chacha20NonceB64u,
-				wrapKeySalt: rec.wrapKeySalt,
-				version: rec.version,
-				timestamp: rec.timestamp
-			};
-		}).filter((rec) => rec !== null);
-	}
-	/**
-	* Check if a key exists for the given account
-	*/
-	async hasEncryptedKey(nearAccountId, deviceNumber) {
-		const keyData = await this.getEncryptedKey(nearAccountId, deviceNumber);
-		return !!keyData;
-	}
-};
-
-//#endregion
-//#region src/core/IndexedDBManager/index.ts
-const passkeyClientDB = new PasskeyClientDBManager();
-const passkeyNearKeysDB = new PasskeyNearKeysDBManager();
-/**
-* Unified IndexedDB interface providing access to both databases
-* This allows centralized access while maintaining separation of concerns
-*/
-var UnifiedIndexedDBManager = class {
-	clientDB;
-	nearKeysDB;
-	_initialized = false;
-	constructor() {
-		this.clientDB = passkeyClientDB;
-		this.nearKeysDB = passkeyNearKeysDB;
-	}
-	/**
-	* Initialize both databases proactively
-	* This ensures both databases are created and ready for use
-	*/
-	async initialize() {
-		if (this._initialized) return;
-		try {
-			if (this.clientDB.isDisabled() || this.nearKeysDB.isDisabled()) {
-				this._initialized = true;
-				return;
-			}
-			await Promise.all([this.clientDB.getAppState("_init_check"), this.nearKeysDB.hasEncryptedKey("_init_check", 1)]);
-			this._initialized = true;
-		} catch (error) {
-			console.warn("Failed to initialize IndexedDB databases:", error);
-		}
-	}
-	/**
-	* Check if databases have been initialized
-	*/
-	get isInitialized() {
-		return this._initialized;
-	}
-	/**
-	* Get user data and check if they have encrypted NEAR keys
-	*/
-	async getUserWithKeys(nearAccountId) {
-		const last = await this.clientDB.getLastUser();
-		const userData = last && last.nearAccountId === nearAccountId ? last : await this.clientDB.getUserByDevice(nearAccountId, 1);
-		const deviceNumber = last && last.nearAccountId === nearAccountId ? last.deviceNumber : userData?.deviceNumber;
-		const [hasKeys, keyData] = await Promise.all([this.nearKeysDB.hasEncryptedKey(nearAccountId, deviceNumber), this.nearKeysDB.getEncryptedKey(nearAccountId, deviceNumber)]);
-		return {
-			userData,
-			hasKeys,
-			keyData: hasKeys ? keyData : void 0
-		};
-	}
-	async setDerivedAddress(nearAccountId, args) {
-		return this.clientDB.setDerivedAddress(nearAccountId, args);
-	}
-	async getDerivedAddressRecord(nearAccountId, args) {
-		return this.clientDB.getDerivedAddressRecord(nearAccountId, args);
-	}
-	async getDerivedAddress(nearAccountId, args) {
-		return this.clientDB.getDerivedAddress(nearAccountId, args);
-	}
-	async upsertRecoveryEmails(nearAccountId, entries) {
-		return this.clientDB.upsertRecoveryEmails(nearAccountId, entries);
-	}
-	async getRecoveryEmails(nearAccountId) {
-		return this.clientDB.getRecoveryEmails(nearAccountId);
-	}
-};
-const IndexedDBManager = new UnifiedIndexedDBManager();
-
 //#endregion
 //#region ../node_modules/.pnpm/base-x@5.0.1/node_modules/base-x/src/esm/index.js
 function base(ALPHABET$1) {
@@ -1667,37 +1058,435 @@ const isIOS = () => {
 	} catch {
 		return false;
 	}
-};
-/**
-* Returns true when the page currently has a transient user activation
-* (click/tap/key within the allowed time window).
-*/
-const hasActiveUserActivation = () => {
-	try {
-		const ua = navigator.userActivation;
-		return !!(ua && typeof ua.isActive === "boolean" && ua.isActive);
-	} catch {
-		return false;
+};
+/**
+* Returns true when the page currently has a transient user activation
+* (click/tap/key within the allowed time window).
+*/
+const hasActiveUserActivation = () => {
+	try {
+		const ua = navigator.userActivation;
+		return !!(ua && typeof ua.isActive === "boolean" && ua.isActive);
+	} catch {
+		return false;
+	}
+};
+/**
+* Heuristic: when on Safari/iOS or on a mobile device AND no active user
+* activation, we should surface a clickable UI to capture activation.
+*/
+const needsExplicitActivation = () => {
+	try {
+		if (hasActiveUserActivation()) return false;
+		return isIOS() || isMobileDevice() || isSafari();
+	} catch {
+		return false;
+	}
+};
+/**
+* Check if the current device is likely mobile
+*/
+const isMobileDevice = () => {
+	return detectDeviceType() === "mobile";
+};
+
+//#endregion
+//#region src/threshold/participants.ts
+function normalizeThresholdEd25519ParticipantId(id) {
+	const n = Number(id);
+	if (!Number.isSafeInteger(n) || n < 1 || n > 65535) return null;
+	return n;
+}
+function normalizeThresholdEd25519ParticipantIds(input) {
+	if (!Array.isArray(input) || input.length === 0) return null;
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const v of input) {
+		const id = normalizeThresholdEd25519ParticipantId(v);
+		if (!id) return null;
+		if (!seen.has(id)) {
+			seen.add(id);
+			out.push(id);
+		}
+	}
+	out.sort((a, b) => a - b);
+	return out.length ? out : null;
+}
+function parseThresholdEd25519ParticipantsV1(input) {
+	if (!Array.isArray(input) || input.length === 0) return null;
+	const out = [];
+	for (const item of input) {
+		if (!item || typeof item !== "object" || Array.isArray(item)) return null;
+		const rec = item;
+		const id = normalizeThresholdEd25519ParticipantId(rec.id);
+		const role = toOptionalTrimmedString(rec.role);
+		if (!id || role !== "client" && role !== "relayer") return null;
+		const participant = {
+			id,
+			role
+		};
+		const relayerUrl = toOptionalTrimmedString(rec.relayerUrl);
+		if (relayerUrl) participant.relayerUrl = relayerUrl;
+		const relayerKeyId = toOptionalTrimmedString(rec.relayerKeyId);
+		if (relayerKeyId) participant.relayerKeyId = relayerKeyId;
+		const verifyingShareB64u = toOptionalTrimmedString(rec.verifyingShareB64u);
+		if (verifyingShareB64u) participant.verifyingShareB64u = verifyingShareB64u;
+		const shareDerivation = toOptionalTrimmedString(rec.shareDerivation);
+		if (shareDerivation === "prf_first_v1" || shareDerivation === "derived_master_secret_v1" || shareDerivation === "kv_random_v1" || shareDerivation === "unknown") participant.shareDerivation = shareDerivation;
+		out.push(participant);
+	}
+	return out.length ? out : null;
+}
+function buildThresholdEd25519Participants2pV1(input) {
+	const relayerKeyId = toOptionalTrimmedString(input.relayerKeyId);
+	const relayerUrl = toOptionalTrimmedString(input.relayerUrl);
+	const clientVerifyingShareB64u = toOptionalTrimmedString(input.clientVerifyingShareB64u);
+	const relayerVerifyingShareB64u = toOptionalTrimmedString(input.relayerVerifyingShareB64u);
+	const clientParticipantId = normalizeThresholdEd25519ParticipantId(input.clientParticipantId) ?? THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID;
+	const relayerParticipantId = normalizeThresholdEd25519ParticipantId(input.relayerParticipantId) ?? THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID;
+	const client = {
+		id: clientParticipantId,
+		role: "client",
+		...clientVerifyingShareB64u ? { verifyingShareB64u: clientVerifyingShareB64u } : {},
+		shareDerivation: input.clientShareDerivation || "prf_first_v1"
+	};
+	const relayer = {
+		id: relayerParticipantId,
+		role: "relayer",
+		...relayerUrl ? { relayerUrl } : {},
+		...relayerKeyId ? { relayerKeyId } : {},
+		...relayerVerifyingShareB64u ? { verifyingShareB64u: relayerVerifyingShareB64u } : {},
+		...input.relayerShareDerivation ? { shareDerivation: input.relayerShareDerivation } : {}
+	};
+	return [client, relayer];
+}
+
+//#endregion
+//#region src/core/IndexedDBManager/passkeyNearKeysDB.ts
+const DB_CONFIG = {
+	dbName: "PasskeyNearKeys",
+	dbVersion: 4,
+	storeName: "keyMaterial",
+	keyPath: [
+		"nearAccountId",
+		"deviceNumber",
+		"kind"
+	]
+};
+var PasskeyNearKeysDBManager = class {
+	config;
+	db = null;
+	disabled = false;
+	constructor(config = DB_CONFIG) {
+		this.config = config;
+	}
+	getDbName() {
+		return this.config.dbName;
+	}
+	setDbName(dbName) {
+		const next = String(dbName || "").trim();
+		if (!next || next === this.config.dbName) return;
+		try {
+			this.db?.close?.();
+		} catch {}
+		this.db = null;
+		this.config = {
+			...this.config,
+			dbName: next
+		};
+	}
+	isDisabled() {
+		return this.disabled;
+	}
+	setDisabled(disabled) {
+		const next = !!disabled;
+		if (next === this.disabled) return;
+		this.disabled = next;
+		if (next) {
+			try {
+				this.db?.close?.();
+			} catch {}
+			this.db = null;
+		}
+	}
+	/**
+	* Get database connection, initializing if necessary
+	*/
+	async getDB() {
+		if (this.disabled) throw new Error("[PasskeyNearKeysDBManager] IndexedDB is disabled in this environment.");
+		if (this.db) return this.db;
+		this.db = await openDB(this.config.dbName, this.config.dbVersion, {
+			upgrade(db) {
+				for (const name of ["encryptedKeys", DB_CONFIG.storeName]) try {
+					if (db.objectStoreNames.contains(name)) db.deleteObjectStore(name);
+				} catch {}
+				const store = db.createObjectStore(DB_CONFIG.storeName, { keyPath: DB_CONFIG.keyPath });
+				try {
+					store.createIndex("nearAccountId", "nearAccountId", { unique: false });
+				} catch {}
+				try {
+					store.createIndex("publicKey", "publicKey", { unique: false });
+				} catch {}
+				try {
+					store.createIndex("kind", "kind", { unique: false });
+				} catch {}
+			},
+			blocked() {
+				console.warn("PasskeyNearKeysDB connection is blocked.");
+			},
+			blocking() {
+				console.warn("PasskeyNearKeysDB connection is blocking another connection.");
+			},
+			terminated: () => {
+				console.warn("PasskeyNearKeysDB connection has been terminated.");
+				this.db = null;
+			}
+		});
+		return this.db;
+	}
+	/**
+	* Store encrypted key data
+	*/
+	async storeKeyMaterial(data) {
+		const db = await this.getDB();
+		if (!data.wrapKeySalt) throw new Error("PasskeyNearKeysDB: Missing wrapKeySalt");
+		if (!data.publicKey) throw new Error("PasskeyNearKeysDB: Missing publicKey");
+		if (data.kind === "local_near_sk_v3") {
+			if (!data.encryptedSk) throw new Error("PasskeyNearKeysDB: Missing encryptedSk for local_near_sk_v3");
+			if (!data.chacha20NonceB64u) throw new Error("PasskeyNearKeysDB: Missing chacha20NonceB64u for local_near_sk_v3");
+		} else if (data.kind === "threshold_ed25519_2p_v1") {
+			if (!data.relayerKeyId) throw new Error("PasskeyNearKeysDB: Missing relayerKeyId for threshold_ed25519_2p_v1");
+			if (!data.clientShareDerivation) throw new Error("PasskeyNearKeysDB: Missing clientShareDerivation for threshold_ed25519_2p_v1");
+			const parsed = parseThresholdEd25519ParticipantsV1(data.participants);
+			data.participants = parsed || buildThresholdEd25519Participants2pV1({
+				relayerKeyId: data.relayerKeyId,
+				clientShareDerivation: data.clientShareDerivation
+			});
+		}
+		await db.put(this.config.storeName, data);
+	}
+	/**
+	* Retrieve encrypted key data
+	*/
+	async getKeyMaterial(nearAccountId, deviceNumber, kind) {
+		const db = await this.getDB();
+		if (!kind) throw new Error("PasskeyNearKeysDB: kind is required (no fallback lookup is allowed)");
+		const sanitize = (rec) => {
+			const kind$1 = rec?.kind;
+			if (!rec?.nearAccountId || typeof rec?.deviceNumber !== "number") return null;
+			if (!kind$1) return null;
+			if (!rec?.publicKey || !rec?.wrapKeySalt || typeof rec?.timestamp !== "number") return null;
+			if (kind$1 === "local_near_sk_v3") {
+				if (!rec?.encryptedSk || !rec?.chacha20NonceB64u) return null;
+				return {
+					nearAccountId: rec.nearAccountId,
+					deviceNumber: rec.deviceNumber,
+					kind: kind$1,
+					publicKey: rec.publicKey,
+					wrapKeySalt: rec.wrapKeySalt,
+					encryptedSk: rec.encryptedSk,
+					chacha20NonceB64u: rec.chacha20NonceB64u,
+					timestamp: rec.timestamp
+				};
+			}
+			if (kind$1 === "threshold_ed25519_2p_v1") {
+				if (!rec?.relayerKeyId || !rec?.clientShareDerivation) return null;
+				const participants = parseThresholdEd25519ParticipantsV1(rec.participants) || buildThresholdEd25519Participants2pV1({
+					relayerKeyId: rec.relayerKeyId,
+					clientShareDerivation: rec.clientShareDerivation
+				});
+				return {
+					nearAccountId: rec.nearAccountId,
+					deviceNumber: rec.deviceNumber,
+					kind: kind$1,
+					publicKey: rec.publicKey,
+					wrapKeySalt: rec.wrapKeySalt,
+					relayerKeyId: rec.relayerKeyId,
+					clientShareDerivation: rec.clientShareDerivation,
+					participants,
+					timestamp: rec.timestamp
+				};
+			}
+			return null;
+		};
+		const res = await db.get(this.config.storeName, [
+			nearAccountId,
+			deviceNumber,
+			kind
+		]);
+		return sanitize(res);
+	}
+	async getLocalKeyMaterial(nearAccountId, deviceNumber) {
+		const rec = await this.getKeyMaterial(nearAccountId, deviceNumber, "local_near_sk_v3");
+		return rec?.kind === "local_near_sk_v3" ? rec : null;
+	}
+	async getThresholdKeyMaterial(nearAccountId, deviceNumber) {
+		const rec = await this.getKeyMaterial(nearAccountId, deviceNumber, "threshold_ed25519_2p_v1");
+		return rec?.kind === "threshold_ed25519_2p_v1" ? rec : null;
+	}
+	/**
+	* Verify key storage by attempting retrieval
+	*/
+	async verifyKeyStorage(nearAccountId, deviceNumber, kind) {
+		const retrievedKey = await this.getKeyMaterial(nearAccountId, deviceNumber, kind);
+		return !!retrievedKey;
+	}
+	/**
+	* Delete encrypted key data for a specific account
+	*/
+	async deleteKeyMaterial(nearAccountId, deviceNumber, kind) {
+		const db = await this.getDB();
+		if (typeof deviceNumber === "number" && kind) await db.delete(this.config.storeName, [
+			nearAccountId,
+			deviceNumber,
+			kind
+		]);
+		else if (typeof deviceNumber === "number") {
+			const tx = db.transaction(this.config.storeName, "readwrite");
+			const idx = tx.store.index("nearAccountId");
+			let cursor = await idx.openCursor(IDBKeyRange.only(nearAccountId));
+			while (cursor) {
+				const value = cursor.value;
+				if (value?.deviceNumber === deviceNumber) await tx.store.delete(cursor.primaryKey);
+				cursor = await cursor.continue();
+			}
+			await tx.done;
+		} else {
+			const tx = db.transaction(this.config.storeName, "readwrite");
+			const idx = tx.store.index("nearAccountId");
+			let cursor = await idx.openCursor(IDBKeyRange.only(nearAccountId));
+			while (cursor) {
+				await tx.store.delete(cursor.primaryKey);
+				cursor = await cursor.continue();
+			}
+			await tx.done;
+		}
+		console.debug("PasskeyNearKeysDB: deleteKeyMaterial - Successfully deleted");
+	}
+	/**
+	* Get all encrypted keys (for migration or debugging purposes)
+	*/
+	async getAllKeyMaterial() {
+		const db = await this.getDB();
+		const all = await db.getAll(this.config.storeName);
+		return all.map((rec) => {
+			const kind = rec?.kind;
+			if (!kind) return null;
+			if (kind === "local_near_sk_v3") {
+				if (!rec?.encryptedSk || !rec?.chacha20NonceB64u) return null;
+				return {
+					nearAccountId: rec.nearAccountId,
+					deviceNumber: rec.deviceNumber,
+					kind,
+					publicKey: rec.publicKey,
+					wrapKeySalt: rec.wrapKeySalt,
+					encryptedSk: rec.encryptedSk,
+					chacha20NonceB64u: rec.chacha20NonceB64u,
+					timestamp: rec.timestamp
+				};
+			}
+			if (kind === "threshold_ed25519_2p_v1") {
+				if (!rec?.relayerKeyId || !rec?.clientShareDerivation) return null;
+				const participants = parseThresholdEd25519ParticipantsV1(rec.participants) || buildThresholdEd25519Participants2pV1({
+					relayerKeyId: rec.relayerKeyId,
+					clientShareDerivation: rec.clientShareDerivation
+				});
+				return {
+					nearAccountId: rec.nearAccountId,
+					deviceNumber: rec.deviceNumber,
+					kind,
+					publicKey: rec.publicKey,
+					wrapKeySalt: rec.wrapKeySalt,
+					relayerKeyId: rec.relayerKeyId,
+					clientShareDerivation: rec.clientShareDerivation,
+					participants,
+					timestamp: rec.timestamp
+				};
+			}
+			return null;
+		}).filter((rec) => rec !== null);
+	}
+	/**
+	* Check if a key exists for the given account
+	*/
+	async hasKeyMaterial(nearAccountId, deviceNumber, kind) {
+		const keyData = await this.getKeyMaterial(nearAccountId, deviceNumber, kind);
+		return !!keyData;
+	}
+};
+
+//#endregion
+//#region src/core/IndexedDBManager/index.ts
+const passkeyClientDB = new PasskeyClientDBManager();
+const passkeyNearKeysDB = new PasskeyNearKeysDBManager();
+/**
+* Unified IndexedDB interface providing access to both databases
+* This allows centralized access while maintaining separation of concerns
+*/
+var UnifiedIndexedDBManager = class {
+	clientDB;
+	nearKeysDB;
+	_initialized = false;
+	constructor() {
+		this.clientDB = passkeyClientDB;
+		this.nearKeysDB = passkeyNearKeysDB;
+	}
+	/**
+	* Initialize both databases proactively
+	* This ensures both databases are created and ready for use
+	*/
+	async initialize() {
+		if (this._initialized) return;
+		try {
+			if (this.clientDB.isDisabled() || this.nearKeysDB.isDisabled()) {
+				this._initialized = true;
+				return;
+			}
+			await Promise.all([this.clientDB.getAppState("_init_check"), this.nearKeysDB.hasKeyMaterial("_init_check", 1, "local_near_sk_v3")]);
+			this._initialized = true;
+		} catch (error) {
+			console.warn("Failed to initialize IndexedDB databases:", error);
+		}
+	}
+	/**
+	* Check if databases have been initialized
+	*/
+	get isInitialized() {
+		return this._initialized;
+	}
+	/**
+	* Get user data and check if they have encrypted NEAR keys
+	*/
+	async getUserWithKeys(nearAccountId) {
+		const last = await this.clientDB.getLastUser();
+		const userData = last && last.nearAccountId === nearAccountId ? last : await this.clientDB.getUserByDevice(nearAccountId, 1);
+		const deviceNumber = last && last.nearAccountId === nearAccountId ? last.deviceNumber : userData?.deviceNumber;
+		const [local, threshold] = await Promise.all([this.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber), this.nearKeysDB.getThresholdKeyMaterial(nearAccountId, deviceNumber)]);
+		const keyData = local ?? threshold;
+		const hasKeys = !!keyData;
+		return {
+			userData,
+			hasKeys,
+			keyMaterial: hasKeys ? keyData : void 0
+		};
+	}
+	async setDerivedAddress(nearAccountId, args) {
+		return this.clientDB.setDerivedAddress(nearAccountId, args);
 	}
-};
-/**
-* Heuristic: when on Safari/iOS or on a mobile device AND no active user
-* activation, we should surface a clickable UI to capture activation.
-*/
-const needsExplicitActivation = () => {
-	try {
-		if (hasActiveUserActivation()) return false;
-		return isIOS() || isMobileDevice() || isSafari();
-	} catch {
-		return false;
+	async getDerivedAddressRecord(nearAccountId, args) {
+		return this.clientDB.getDerivedAddressRecord(nearAccountId, args);
+	}
+	async getDerivedAddress(nearAccountId, args) {
+		return this.clientDB.getDerivedAddress(nearAccountId, args);
+	}
+	async upsertRecoveryEmails(nearAccountId, entries) {
+		return this.clientDB.upsertRecoveryEmails(nearAccountId, entries);
+	}
+	async getRecoveryEmails(nearAccountId) {
+		return this.clientDB.getRecoveryEmails(nearAccountId);
 	}
 };
-/**
-* Check if the current device is likely mobile
-*/
-const isMobileDevice = () => {
-	return detectDeviceType() === "mobile";
-};
+const IndexedDBManager = new UnifiedIndexedDBManager();
 
 //#endregion
 //#region src/core/NearRpcError.ts
@@ -1816,6 +1605,7 @@ function describeTxExecution(operationName, exec) {
 const DEFAULT_WAIT_STATUS = {
 	executeAction: "EXECUTED_OPTIMISTIC",
 	linkDeviceAddKey: "INCLUDED_FINAL",
+	thresholdAddKey: "EXECUTED_OPTIMISTIC",
 	linkDeviceSwapKey: "FINAL",
 	linkDeviceAccountMapping: "INCLUDED_FINAL",
 	linkDeviceDeleteKey: "INCLUDED_FINAL",
@@ -2032,6 +1822,13 @@ var MinimalNearClient = class MinimalNearClient {
 		}
 		throw lastError instanceof Error ? lastError : new Error(String(lastError));
 	}
+	async txStatus(txHash, senderAccountId) {
+		const params = {
+			tx_hash: txHash,
+			sender_account_id: senderAccountId
+		};
+		return this.makeRpcCall("EXPERIMENTAL_tx_status", params, "Tx Status");
+	}
 	async callFunction(contractId, method, args, blockQuery) {
 		const rpcParams = {
 			request_type: "call_function",
@@ -2165,25 +1962,44 @@ const DEVICE_LINKING_CONFIG = {
 	RETRY: { MAX_REGISTRATION_ATTEMPTS: 5 }
 };
 
+//#endregion
+//#region src/core/sdkPaths/base.ts
+const W3A_WALLET_SDK_BASE_EVENT = "W3A_WALLET_SDK_BASE_CHANGED";
+/**
+* @param cb - Callback invoked with the new absolute base URL when it changes.
+* @returns Unsubscribe function to remove the listener.
+*/
+function onEmbeddedBaseChange(cb) {
+	if (typeof window === "undefined") return () => {};
+	const handler = (e) => {
+		const d = e.detail;
+		if (typeof d === "string" && d.length > 0) cb(d);
+	};
+	window.addEventListener(W3A_WALLET_SDK_BASE_EVENT, handler, { passive: true });
+	return () => window.removeEventListener(W3A_WALLET_SDK_BASE_EVENT, handler);
+}
+
 //#endregion
 //#region src/core/sdkPaths/workers.ts
 /**
 * Resolve the base origin for worker scripts.
 * Priority:
-* 1) window.__W3A_WALLET_SDK_BASE__ (absolute `${walletOrigin}${sdkBasePath}/`) → take its origin
+* 1) window.__W3A_WALLET_SDK_BASE__ (absolute `${walletOrigin}${sdkBasePath}/`) → take its origin (only if same-origin)
 * 2) window.location.origin (host/app origin)
 *
 * @returns The origin (protocol + host [+ port]) used to resolve worker script URLs.
 *          Prefers the wallet SDK base origin; falls back to the current window origin.
 */
 function resolveWorkerBaseOrigin() {
-	let origin = "";
-	if (typeof window !== "undefined" && window.location?.origin) origin = window.location.origin;
+	const currentOrigin = typeof window !== "undefined" && window.location?.origin ? window.location.origin : "";
 	try {
 		const embeddedBase = window?.__W3A_WALLET_SDK_BASE__;
-		if (embeddedBase) origin = new URL(embeddedBase, origin || "https://invalid.local").origin;
+		if (embeddedBase) {
+			const embeddedOrigin = new URL(embeddedBase, currentOrigin || "https://invalid.local").origin;
+			if (embeddedOrigin === currentOrigin) return embeddedOrigin;
+		}
 	} catch {}
-	return origin;
+	return currentOrigin;
 }
 function resolveWorkerUrl(input, opts) {
 	const worker = opts.worker;
@@ -2224,13 +2040,24 @@ const WorkerControlMessage = {
 
 //#endregion
 //#region src/core/WebAuthnManager/SignerWorkerManager/sessionMessages.ts
+function asSessionMessage(msg) {
+	if (!isObject$1(msg)) return null;
+	if (typeof msg.type !== "string") return null;
+	if (msg.sessionId != null && typeof msg.sessionId !== "string") return null;
+	if (msg.error != null && typeof msg.error !== "string") return null;
+	return msg;
+}
 /**
 * Type guard to check if a message is a control message.
 */
 function isSignerWorkerControlMessage(msg) {
 	if (!isObject$1(msg) || typeof msg.type !== "string") return false;
-	const type = msg.type;
-	return type === WorkerControlMessage.ATTACH_WRAP_KEY_SEED_PORT_OK || type === WorkerControlMessage.ATTACH_WRAP_KEY_SEED_PORT_ERROR || type === WorkerControlMessage.WORKER_READY;
+	switch (msg.type) {
+		case WorkerControlMessage.ATTACH_WRAP_KEY_SEED_PORT_OK: return typeof msg.sessionId === "string";
+		case WorkerControlMessage.ATTACH_WRAP_KEY_SEED_PORT_ERROR: return typeof msg.sessionId === "string" && typeof msg.error === "string";
+		case WorkerControlMessage.WORKER_READY: return typeof msg.ready === "boolean";
+		default: return false;
+	}
 }
 function isObject$1(value) {
 	return typeof value === "object" && value !== null;
@@ -2252,8 +2079,8 @@ function waitForSessionMessage(worker, options) {
 			reject(/* @__PURE__ */ new Error(`Timeout waiting for session message (${successTypes.join("|")})${sessionId ? ` for session ${sessionId}` : ""}`));
 		}, timeoutMs);
 		const messageHandler = (event) => {
-			const msg = event.data;
-			if (!msg || typeof msg.type !== "string") return;
+			const msg = asSessionMessage(event.data);
+			if (!msg) return;
 			if (sessionId && msg.sessionId !== sessionId) return;
 			if (errorType && msg.type === errorType) {
 				cleanup();
@@ -2299,8 +2126,73 @@ function waitForWrapKeyPortAttach(worker, sessionId, timeoutMs = 2e3) {
 	});
 }
 
+//#endregion
+//#region src/core/types/sdkSentEvents.ts
+let RegistrationPhase = /* @__PURE__ */ function(RegistrationPhase$1) {
+	RegistrationPhase$1["STEP_1_WEBAUTHN_VERIFICATION"] = "webauthn-verification";
+	RegistrationPhase$1["STEP_2_KEY_GENERATION"] = "key-generation";
+	RegistrationPhase$1["STEP_3_CONTRACT_PRE_CHECK"] = "contract-pre-check";
+	RegistrationPhase$1["STEP_4_ACCESS_KEY_ADDITION"] = "access-key-addition";
+	RegistrationPhase$1["STEP_5_CONTRACT_REGISTRATION"] = "contract-registration";
+	RegistrationPhase$1["STEP_6_ACCOUNT_VERIFICATION"] = "account-verification";
+	RegistrationPhase$1["STEP_7_DATABASE_STORAGE"] = "database-storage";
+	RegistrationPhase$1["STEP_8_REGISTRATION_COMPLETE"] = "registration-complete";
+	RegistrationPhase$1["REGISTRATION_ERROR"] = "error";
+	return RegistrationPhase$1;
+}({});
+let RegistrationStatus = /* @__PURE__ */ function(RegistrationStatus$1) {
+	RegistrationStatus$1["PROGRESS"] = "progress";
+	RegistrationStatus$1["SUCCESS"] = "success";
+	RegistrationStatus$1["ERROR"] = "error";
+	return RegistrationStatus$1;
+}({});
+
 //#endregion
 //#region src/core/rpcCalls.ts
+function sleep(ms) {
+	return new Promise((res) => setTimeout(res, ms));
+}
+function isAccessKeyNotFoundError(err) {
+	const msg = String(errorMessage(err) || "").toLowerCase();
+	if (!msg) return false;
+	if (msg.includes("unknown access key") || msg.includes("unknown_access_key") || msg.includes("unknownaccesskey")) return true;
+	if (msg.includes("accesskeydoesnotexist")) return true;
+	if (msg.includes("access key does not exist")) return true;
+	if (msg.includes("access key doesn't exist")) return true;
+	if (msg.includes("access key not found")) return true;
+	if (msg.includes("no such access key")) return true;
+	if (msg.includes("viewing access key") && msg.includes("does not exist") && !msg.includes("account")) return true;
+	return false;
+}
+async function hasAccessKey(nearClient, nearAccountId, publicKey, opts) {
+	const expected = ensureEd25519Prefix(publicKey);
+	if (!expected) return false;
+	const attempts = Math.max(1, Math.floor(opts?.attempts ?? 6));
+	const delayMs = Math.max(50, Math.floor(opts?.delayMs ?? 750));
+	for (let i = 0; i < attempts; i++) {
+		try {
+			await nearClient.viewAccessKey(nearAccountId, expected);
+			return true;
+		} catch {}
+		if (i < attempts - 1) await sleep(delayMs);
+	}
+	return false;
+}
+async function waitForAccessKeyAbsent(nearClient, nearAccountId, publicKey, opts) {
+	const expected = ensureEd25519Prefix(publicKey);
+	if (!expected) return true;
+	const attempts = Math.max(1, Math.floor(opts?.attempts ?? 6));
+	const delayMs = Math.max(50, Math.floor(opts?.delayMs ?? 650));
+	for (let i = 0; i < attempts; i++) {
+		try {
+			await nearClient.viewAccessKey(nearAccountId, expected);
+		} catch (err) {
+			if (isAccessKeyNotFoundError(err)) return true;
+		}
+		if (i < attempts - 1) await sleep(delayMs);
+	}
+	return false;
+}
 /**
 * View-only registration pre-check.
 *
@@ -2310,6 +2202,10 @@ function waitForWrapKeyPortAttach(worker, sessionId, timeoutMs = 2e3) {
 */
 async function checkCanRegisterUserContractCall({ nearClient, contractId, vrfChallenge, credential, authenticatorOptions }) {
 	try {
+		const intent_digest_32 = Array.from(base64UrlDecode(vrfChallenge.intentDigest || ""));
+		if (intent_digest_32.length !== 32) throw new Error("Missing or invalid vrfChallenge.intentDigest (expected base64url-encoded 32 bytes)");
+		const session_policy_digest_32 = vrfChallenge.sessionPolicyDigest32 ? Array.from(base64UrlDecode(vrfChallenge.sessionPolicyDigest32)) : [];
+		if (session_policy_digest_32.length !== 0 && session_policy_digest_32.length !== 32) throw new Error("Invalid vrfChallenge.sessionPolicyDigest32 (expected base64url-encoded 32 bytes)");
 		const vrfData = {
 			vrf_input_data: Array.from(base64UrlDecode(vrfChallenge.vrfInput)),
 			vrf_output: Array.from(base64UrlDecode(vrfChallenge.vrfOutput)),
@@ -2318,7 +2214,9 @@ async function checkCanRegisterUserContractCall({ nearClient, contractId, vrfCha
 			user_id: vrfChallenge.userId,
 			rp_id: vrfChallenge.rpId,
 			block_height: Number(vrfChallenge.blockHeight),
-			block_hash: Array.from(base64UrlDecode(vrfChallenge.blockHash))
+			block_hash: Array.from(base64UrlDecode(vrfChallenge.blockHash)),
+			intent_digest_32,
+			...session_policy_digest_32.length ? { session_policy_digest_32 } : {}
 		};
 		const args = {
 			vrf_data: vrfData,
@@ -2342,6 +2240,78 @@ async function checkCanRegisterUserContractCall({ nearClient, contractId, vrfCha
 		};
 	}
 }
+async function thresholdEd25519Keygen(relayServerUrl, vrfChallenge, webauthnAuthentication, args) {
+	try {
+		const base$1 = String(relayServerUrl || "").trim().replace(/\/$/, "");
+		if (!base$1) throw new Error("Missing relayServerUrl");
+		const clientVerifyingShareB64u = String(args.clientVerifyingShareB64u || "").trim();
+		if (!clientVerifyingShareB64u) throw new Error("Missing clientVerifyingShareB64u");
+		const nearAccountId = String(args.nearAccountId || "").trim();
+		if (!nearAccountId) throw new Error("Missing nearAccountId");
+		const toBytes = (b64u) => {
+			if (!b64u) return [];
+			return Array.from(base64UrlDecode(b64u));
+		};
+		const intent_digest_32 = toBytes(vrfChallenge.intentDigest);
+		if (intent_digest_32.length !== 32) throw new Error("Missing or invalid vrfChallenge.intentDigest (expected base64url-encoded 32 bytes)");
+		const vrf_data = {
+			vrf_input_data: toBytes(vrfChallenge.vrfInput),
+			vrf_output: toBytes(vrfChallenge.vrfOutput),
+			vrf_proof: toBytes(vrfChallenge.vrfProof),
+			public_key: toBytes(vrfChallenge.vrfPublicKey),
+			user_id: vrfChallenge.userId,
+			rp_id: vrfChallenge.rpId,
+			block_height: Number(vrfChallenge.blockHeight || 0),
+			block_hash: toBytes(vrfChallenge.blockHash),
+			intent_digest_32
+		};
+		const webauthn_authentication = {
+			...webauthnAuthentication,
+			authenticatorAttachment: webauthnAuthentication.authenticatorAttachment ?? null,
+			response: {
+				...webauthnAuthentication.response,
+				userHandle: webauthnAuthentication.response.userHandle ?? null
+			},
+			clientExtensionResults: null
+		};
+		const url = `${base$1}/threshold-ed25519/keygen`;
+		const response = await fetch(url, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			credentials: "include",
+			body: JSON.stringify({
+				clientVerifyingShareB64u,
+				nearAccountId,
+				vrf_data,
+				webauthn_authentication
+			})
+		});
+		if (!response.ok) {
+			const errorText = await response.text();
+			return {
+				ok: false,
+				error: `HTTP ${response.status}: ${errorText}`
+			};
+		}
+		const json = await response.json();
+		return {
+			ok: !!json?.ok,
+			clientParticipantId: json?.clientParticipantId,
+			relayerParticipantId: json?.relayerParticipantId,
+			participantIds: json?.participantIds,
+			relayerKeyId: json?.relayerKeyId,
+			publicKey: json?.publicKey,
+			relayerVerifyingShareB64u: json?.relayerVerifyingShareB64u,
+			code: json?.code,
+			message: json?.message
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			error: error?.message || "Failed to keygen threshold-ed25519"
+		};
+	}
+}
 
 //#endregion
 //#region src/core/WebAuthnManager/SignerWorkerManager/handlers/checkCanRegisterUser.ts
@@ -2357,9 +2327,9 @@ async function checkCanRegisterUser({ ctx, vrfChallenge, credential, contractId,
 		const resolvedContractId = contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId;
 		onEvent?.({
 			step: 3,
-			phase: "REGISTRATION_CONTRACT_PRE_CHECK",
-			status: "PROGRESS",
-			message: "Calling check_can_register_user on contract..."
+			phase: RegistrationPhase.STEP_3_CONTRACT_PRE_CHECK,
+			status: RegistrationStatus.PROGRESS,
+			message: "Running webauthn contract registration checks..."
 		});
 		const strippedCredential = removePrfOutputGuard(serializedCredential);
 		const result = await checkCanRegisterUserContractCall({
@@ -2378,9 +2348,10 @@ async function checkCanRegisterUser({ ctx, vrfChallenge, credential, contractId,
 		};
 		onEvent?.({
 			step: 3,
-			phase: "REGISTRATION_CONTRACT_PRE_CHECK",
-			status: result.verified ? "SUCCESS" : "ERROR",
-			message: result.verified ? "Registration pre-check succeeded" : result.error || "Registration pre-check failed"
+			phase: RegistrationPhase.STEP_3_CONTRACT_PRE_CHECK,
+			status: result.verified ? RegistrationStatus.SUCCESS : RegistrationStatus.ERROR,
+			message: result.verified ? "Registration pre-check succeeded" : result.error || "Registration pre-check failed",
+			...result.verified ? {} : { error: result.error || "Registration pre-check failed" }
 		});
 		return {
 			success: true,
@@ -2448,6 +2419,7 @@ const DEFAULT_AUTHENTICATOR_OPTIONS = {
 function withSessionId(sessionId, payload) {
 	if (!sessionId) throw new Error("withSessionId: sessionId is required");
 	const existing = payload?.sessionId;
+	if (existing != null && typeof existing !== "string") throw new Error("withSessionId: payload.sessionId must be a string when provided");
 	if (existing && existing !== sessionId) throw new Error(`withSessionId: payload.sessionId (${existing}) does not match provided sessionId (${sessionId})`);
 	return {
 		...payload,
@@ -2480,21 +2452,22 @@ async function deriveNearKeypairAndEncryptFromSerialized({ ctx, credential, near
 		});
 		if (!isDeriveNearKeypairAndEncryptSuccess(response)) throw new Error("Dual PRF registration (from serialized) failed");
 		const wasmResult = response.payload;
-		const version = wasmResult.version ?? 2;
 		const wrapKeySaltPersisted = wasmResult.wrapKeySalt;
+		if (!wrapKeySaltPersisted) throw new Error("Missing wrapKeySalt in deriveNearKeypairAndEncrypt result");
 		const deviceNumber = typeof options?.deviceNumber === "number" ? options.deviceNumber : await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);
 		const chacha20NonceB64u = wasmResult.chacha20NonceB64u;
 		if (!chacha20NonceB64u) throw new Error("Missing chacha20NonceB64u in deriveNearKeypairAndEncrypt result");
-		const keyData = {
+		const keyMaterial = {
+			kind: "local_near_sk_v3",
 			nearAccountId,
 			deviceNumber,
-			encryptedData: wasmResult.encryptedData,
+			publicKey: wasmResult.publicKey,
+			encryptedSk: wasmResult.encryptedData,
 			chacha20NonceB64u,
 			wrapKeySalt: wrapKeySaltPersisted,
-			version,
 			timestamp: Date.now()
 		};
-		await ctx.indexedDB.nearKeysDB.storeEncryptedKey(keyData);
+		await ctx.indexedDB.nearKeysDB.storeKeyMaterial(keyMaterial);
 		return {
 			success: true,
 			nearAccountId: toAccountId(wasmResult.nearAccountId),
@@ -2520,16 +2493,16 @@ async function decryptPrivateKeyWithPrf({ ctx, nearAccountId, authenticators, se
 	try {
 		console.info("WebAuthnManager: Starting private key decryption with dual PRF (local operation)");
 		const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);
-		const encryptedKeyData = await ctx.indexedDB.nearKeysDB.getEncryptedKey(nearAccountId, deviceNumber);
-		if (!encryptedKeyData) throw new Error(`No encrypted key found for account: ${nearAccountId}`);
+		const keyMaterial = await ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber);
+		if (!keyMaterial) throw new Error(`No key material found for account: ${nearAccountId}`);
 		const response = await ctx.sendMessage({
 			sessionId,
 			message: {
 				type: WorkerRequestType.DecryptPrivateKeyWithPrf,
 				payload: withSessionId(sessionId, {
 					nearAccountId,
-					encryptedPrivateKeyData: encryptedKeyData.encryptedData,
-					encryptedPrivateKeyChacha20NonceB64u: encryptedKeyData.chacha20NonceB64u
+					encryptedPrivateKeyData: keyMaterial.encryptedSk,
+					encryptedPrivateKeyChacha20NonceB64u: keyMaterial.chacha20NonceB64u
 				})
 			}
 		});
@@ -2577,122 +2550,461 @@ const generateSessionId = () => {
 	return typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : `sign-session-${Date.now()}-${Math.random().toString(16).slice(2)}`;
 };
 
+//#endregion
+//#region src/core/threshold/thresholdEd25519RelayerHealth.ts
+const DEFAULT_CACHE_TTL_MS = 6e4;
+const cache = /* @__PURE__ */ new Map();
+const inFlight = /* @__PURE__ */ new Map();
+const DEFAULT_WARN_TTL_MS = 10 * 6e4;
+const MAX_WARN_KEYS = 1e3;
+const warnedUnsupportedRelayerByKey = /* @__PURE__ */ new Map();
+async function isRelayerThresholdEd25519ConfiguredBase(base$1, opts) {
+	if (!base$1) return false;
+	if (typeof fetch !== "function") return false;
+	const ttlMs = Math.max(0, Number(opts?.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS));
+	const now = Date.now();
+	const cached = cache.get(base$1);
+	if (cached && cached.expiresAtMs > now) return cached.configured;
+	const existing = inFlight.get(base$1);
+	if (existing) return existing;
+	const req = (async () => {
+		try {
+			const res = await fetch(`${base$1}/threshold-ed25519/healthz`, { method: "GET" });
+			if (!res.ok) {
+				cache.set(base$1, {
+					configured: false,
+					expiresAtMs: now + ttlMs
+				});
+				return false;
+			}
+			const data = await res.json().catch(() => null);
+			const configured = data?.configured === true;
+			cache.set(base$1, {
+				configured,
+				expiresAtMs: now + ttlMs
+			});
+			return configured;
+		} catch {
+			cache.set(base$1, {
+				configured: false,
+				expiresAtMs: now + ttlMs
+			});
+			return false;
+		} finally {
+			inFlight.delete(base$1);
+		}
+	})();
+	inFlight.set(base$1, req);
+	return req;
+}
+function coerceThresholdBehavior(input) {
+	return input === "fallback" || input === "strict" ? input : DEFAULT_THRESHOLD_BEHAVIOR;
+}
+function pruneWarned(nowMs) {
+	if (warnedUnsupportedRelayerByKey.size <= MAX_WARN_KEYS) return;
+	for (const [key, expiresAtMs] of warnedUnsupportedRelayerByKey.entries()) if (expiresAtMs <= nowMs) warnedUnsupportedRelayerByKey.delete(key);
+	while (warnedUnsupportedRelayerByKey.size > MAX_WARN_KEYS) {
+		const first = warnedUnsupportedRelayerByKey.keys().next().value;
+		if (!first) break;
+		warnedUnsupportedRelayerByKey.delete(first);
+	}
+}
+function warnOnce(key, message, opts) {
+	const nowMs = Date.now();
+	const ttlMs = Math.max(0, Math.floor(opts?.warnTtlMs ?? DEFAULT_WARN_TTL_MS));
+	if (ttlMs === 0) return;
+	pruneWarned(nowMs);
+	const existing = warnedUnsupportedRelayerByKey.get(key);
+	if (existing && existing > nowMs) return;
+	warnedUnsupportedRelayerByKey.set(key, nowMs + ttlMs);
+	console.warn(message);
+	opts?.warnings?.push(message);
+}
+async function fallbackToLocalSignerIfRelayerUnsupported(args) {
+	const requested = args.signerMode.mode;
+	if (requested !== "threshold-signer") return requested;
+	const base$1 = stripTrailingSlashes(toTrimmedString(args.relayerUrl));
+	const behavior = coerceThresholdBehavior(getThresholdBehaviorFromSignerMode(args.signerMode));
+	const configured = await isRelayerThresholdEd25519ConfiguredBase(base$1, { cacheTtlMs: args.cacheTtlMs });
+	if (configured) return requested;
+	const msg = "[WebAuthnManager] signerMode=threshold-signer requested but the relayer does not support threshold signing";
+	if (behavior === "fallback") {
+		warnOnce(`${args.nearAccountId}|${base$1}`, `${msg}; falling back to local-signer`, {
+			warnTtlMs: args.warnTtlMs,
+			warnings: args.warnings
+		});
+		return "local-signer";
+	}
+	throw new Error(`${msg}; set signerMode={ mode: 'threshold-signer', behavior: 'fallback' } to allow local-signer fallback`);
+}
+async function resolveSignerModeForThresholdSigning(args) {
+	const requested = args.signerMode.mode;
+	if (requested !== "threshold-signer") return requested;
+	const behavior = coerceThresholdBehavior(getThresholdBehaviorFromSignerMode(args.signerMode));
+	if (!args.hasThresholdKeyMaterial) {
+		const msg = "[WebAuthnManager] signerMode=threshold-signer requested but threshold key material is unavailable";
+		if (behavior === "fallback") {
+			warnOnce(`${args.nearAccountId}|threshold-key-material-missing`, `${msg}; falling back to local-signer`, {
+				warnTtlMs: args.warnTtlMs,
+				warnings: args.warnings
+			});
+			return "local-signer";
+		}
+		throw new Error(`${msg}; set signerMode={ mode: 'threshold-signer', behavior: 'fallback' } to allow local-signer fallback`);
+	}
+	return fallbackToLocalSignerIfRelayerUnsupported({
+		nearAccountId: args.nearAccountId,
+		signerMode: args.signerMode,
+		relayerUrl: args.relayerUrl,
+		warnings: args.warnings,
+		cacheTtlMs: args.cacheTtlMs,
+		warnTtlMs: args.warnTtlMs
+	});
+}
+
+//#endregion
+//#region src/core/threshold/thresholdEd25519AuthSession.ts
+const authSessionCache = /* @__PURE__ */ new Map();
+function makeThresholdEd25519AuthSessionCacheKey(args) {
+	const relayerUrl = stripTrailingSlashes(toTrimmedString(args.relayerUrl));
+	const participantIds = normalizeThresholdEd25519ParticipantIds(args.participantIds);
+	return [
+		String(args.nearAccountId || "").trim(),
+		String(args.rpId || "").trim(),
+		relayerUrl,
+		String(args.relayerKeyId || "").trim(),
+		...participantIds ? [participantIds.join(",")] : []
+	].join("|");
+}
+function getCachedThresholdEd25519AuthSession(cacheKey) {
+	const entry = authSessionCache.get(cacheKey);
+	if (!entry) return null;
+	if (typeof entry.expiresAtMs === "number" && Number.isFinite(entry.expiresAtMs) && Date.now() >= entry.expiresAtMs) {
+		authSessionCache.delete(cacheKey);
+		return null;
+	}
+	return entry;
+}
+function clearCachedThresholdEd25519AuthSession(cacheKey) {
+	authSessionCache.delete(cacheKey);
+}
+function getCachedThresholdEd25519AuthSessionJwt(cacheKey) {
+	const cached = getCachedThresholdEd25519AuthSession(cacheKey);
+	const jwt = cached?.jwt;
+	if (typeof jwt === "string") {
+		const trimmed = jwt.trim();
+		if (trimmed) return trimmed;
+	}
+	if (cached) clearCachedThresholdEd25519AuthSession(cacheKey);
+	return void 0;
+}
+
+//#endregion
+//#region src/core/threshold/thresholdSessionPolicy.ts
+const THRESHOLD_SESSION_POLICY_MAX_TTL_MS = 10 * 6e4;
+const DEFAULT_THRESHOLD_SESSION_POLICY = {
+	ttlMs: 5 * 6e4,
+	remainingUses: 5
+};
+function isThresholdSessionAuthUnavailableError(err) {
+	const msg = err instanceof Error ? err.message : String(err);
+	return msg.includes("no cached threshold session token") || msg.includes("relayer threshold session expired") || msg.includes("threshold session exhausted") || msg.includes("threshold session expired") || msg.includes("Missing or invalid threshold session token") || msg.includes("Invalid session token kind") || msg.includes("/authorize HTTP 401") || msg.includes("/authorize HTTP 403");
+}
+function isThresholdSignerMissingKeyError(err) {
+	const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();
+	return msg.includes("\"code\":\"missing_key\"") || msg.includes("missing_key") || msg.includes("unknown relayerkeyid") || msg.includes("call /threshold-ed25519/keygen");
+}
+
 //#endregion
 //#region src/core/WebAuthnManager/SignerWorkerManager/handlers/signTransactionsWithActions.ts
 /**
 * Sign multiple transactions with shared VRF challenge and credential
 * Efficiently processes multiple transactions with one PRF authentication
 */
-async function signTransactionsWithActions({ ctx, transactions, rpcCall, onEvent, confirmationConfigOverride, title, body, sessionId: providedSessionId }) {
-	try {
-		if (transactions.length === 0) throw new Error("No transactions provided for batch signing");
-		const sessionId = providedSessionId ?? generateSessionId();
-		const nearAccountId = rpcCall.nearAccountId;
-		transactions.forEach((txPayload, txIndex) => {
-			txPayload.actions.forEach((action, actionIndex) => {
-				try {
-					validateActionArgsWasm(action);
-				} catch (error) {
-					throw new Error(`Transaction ${txIndex}, Action ${actionIndex} validation failed: ${error instanceof Error ? error.message : "Unknown error"}`);
-				}
-			});
+async function signTransactionsWithActions({ ctx, sessionId: providedSessionId, transactions, rpcCall, signerMode, onEvent, confirmationConfigOverride, title, body }) {
+	const sessionId = providedSessionId ?? generateSessionId();
+	const nearAccountId = rpcCall.nearAccountId;
+	const relayerUrl = ctx.relayerUrl;
+	transactions.forEach((txPayload) => {
+		txPayload.actions.forEach((action) => {
+			validateActionArgsWasm(action);
 		});
-		console.debug("WebAuthnManager: Retrieving encrypted key from IndexedDB for account:", nearAccountId);
-		const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);
-		const encryptedKeyData = await ctx.indexedDB.nearKeysDB.getEncryptedKey(nearAccountId, deviceNumber);
-		if (!encryptedKeyData) throw new Error(`No encrypted key found for account: ${nearAccountId}`);
-		const resolvedRpcCall = {
-			contractId: rpcCall.contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId,
-			nearRpcUrl: rpcCall.nearRpcUrl || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl.split(",")[0] || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl,
-			nearAccountId: rpcCall.nearAccountId
-		};
-		if (!ctx.vrfWorkerManager) throw new Error("VrfWorkerManager not available for signing");
-		const confirmation = await ctx.vrfWorkerManager.confirmAndPrepareSigningSession({
-			ctx,
-			sessionId,
-			kind: "transaction",
-			txSigningRequests: transactions,
+	});
+	const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);
+	const [localKeyMaterial, thresholdKeyMaterial] = await Promise.all([ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber), ctx.indexedDB.nearKeysDB.getThresholdKeyMaterial(nearAccountId, deviceNumber)]);
+	if (!localKeyMaterial) throw new Error(`No local key material found for account: ${nearAccountId}`);
+	const warnings = [];
+	const thresholdBehavior = getThresholdBehaviorFromSignerMode(signerMode);
+	const resolvedSignerMode = await resolveSignerModeForThresholdSigning({
+		nearAccountId,
+		signerMode,
+		relayerUrl,
+		hasThresholdKeyMaterial: !!thresholdKeyMaterial,
+		warnings
+	});
+	console.debug("[signTransactionsWithActions] resolvedSignerMode", {
+		nearAccountId,
+		resolvedSignerMode,
+		warnings
+	});
+	const signingContext = validateAndPrepareSigningContext({
+		nearAccountId,
+		resolvedSignerMode,
+		relayerUrl,
+		rpId: ctx.touchIdPrompt.getRpId(),
+		localKeyMaterial,
+		thresholdKeyMaterial
+	});
+	ctx.nonceManager.initializeUser(toAccountId(nearAccountId), signingContext.signingNearPublicKeyStr);
+	const resolvedRpcCall = {
+		contractId: rpcCall.contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId,
+		nearRpcUrl: rpcCall.nearRpcUrl || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl,
+		nearAccountId: rpcCall.nearAccountId
+	};
+	const txSigningRequests = transactions.map((tx) => ({
+		nearAccountId: rpcCall.nearAccountId,
+		receiverId: tx.receiverId,
+		actions: tx.actions
+	}));
+	if (!ctx.vrfWorkerManager) throw new Error("VrfWorkerManager not available for signing");
+	const confirmation = await ctx.vrfWorkerManager.confirmAndPrepareSigningSession({
+		ctx,
+		sessionId,
+		kind: "transaction",
+		...signingContext.threshold && !signingContext.threshold.thresholdSessionJwt ? { signingAuthMode: "webauthn" } : {},
+		txSigningRequests: transactions,
+		rpcCall: resolvedRpcCall,
+		confirmationConfigOverride,
+		title,
+		body
+	});
+	let { intentDigest, transactionContext, vrfChallenge, credential } = extractSigningEvidenceFromConfirmation$2(confirmation);
+	if (signingContext.threshold) {
+		const requestPayload = {
+			signerMode: signingContext.resolvedSignerMode,
 			rpcCall: resolvedRpcCall,
-			confirmationConfigOverride,
-			title,
-			body
-		});
-		const intentDigest = confirmation.intentDigest;
-		const transactionContext = confirmation.transactionContext;
-		const credential = confirmation.credential ? JSON.stringify(confirmation.credential) : void 0;
-		const txSigningRequests = transactions.map((tx) => ({
-			nearAccountId: rpcCall.nearAccountId,
-			receiverId: tx.receiverId,
-			actions: tx.actions
-		}));
-		const response = await ctx.sendMessage({
-			sessionId,
-			message: {
-				type: WorkerRequestType.SignTransactionsWithActions,
-				payload: {
-					rpcCall: resolvedRpcCall,
-					createdAt: Date.now(),
-					decryption: {
-						encryptedPrivateKeyData: encryptedKeyData.encryptedData,
-						encryptedPrivateKeyChacha20NonceB64u: encryptedKeyData.chacha20NonceB64u
-					},
+			createdAt: Date.now(),
+			decryption: {
+				encryptedPrivateKeyData: "",
+				encryptedPrivateKeyChacha20NonceB64u: ""
+			},
+			threshold: {
+				relayerUrl: signingContext.threshold.relayerUrl,
+				relayerKeyId: signingContext.threshold.thresholdKeyMaterial.relayerKeyId,
+				clientParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "client")?.id,
+				relayerParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "relayer")?.id,
+				participantIds: signingContext.threshold.thresholdKeyMaterial.participants.map((p) => p.id),
+				thresholdSessionKind: "jwt",
+				thresholdSessionJwt: signingContext.threshold.thresholdSessionJwt
+			},
+			txSigningRequests,
+			intentDigest,
+			transactionContext,
+			vrfChallenge,
+			credential
+		};
+		for (let attempt = 0; attempt < 2; attempt++) try {
+			const response = await ctx.sendMessage({
+				sessionId,
+				message: {
+					type: WorkerRequestType.SignTransactionsWithActions,
+					payload: requestPayload
+				},
+				onEvent
+			});
+			const okResponse = requireOkSignTransactionsWithActionsResponse(response);
+			return toSignedTransactionResults({
+				okResponse,
+				expectedTransactionCount: transactions.length,
+				nearAccountId,
+				warnings
+			});
+		} catch (e) {
+			const err = e instanceof Error ? e : new Error(String(e));
+			if (thresholdBehavior === "fallback" && isThresholdSignerMissingKeyError(err)) {
+				const msg = "[WebAuthnManager] threshold-signer requested but the relayer is missing the signing share; falling back to local-signer";
+				console.warn(msg);
+				warnings.push(msg);
+				try {
+					clearCachedThresholdEd25519AuthSession(signingContext.threshold.thresholdSessionCacheKey);
+				} catch {}
+				signingContext.threshold.thresholdSessionJwt = void 0;
+				requestPayload.threshold.thresholdSessionJwt = void 0;
+				ctx.nonceManager.initializeUser(toAccountId(nearAccountId), localKeyMaterial.publicKey);
+				if (!credential || !vrfChallenge) {
+					const refreshed = await ctx.vrfWorkerManager.confirmAndPrepareSigningSession({
+						ctx,
+						sessionId,
+						kind: "transaction",
+						signingAuthMode: "webauthn",
+						txSigningRequests: transactions,
+						rpcCall: resolvedRpcCall,
+						confirmationConfigOverride,
+						title,
+						body
+					});
+					({intentDigest, transactionContext, vrfChallenge, credential} = extractSigningEvidenceFromConfirmation$2(refreshed));
+				} else transactionContext = await ctx.nonceManager.getNonceBlockHashAndHeight(ctx.nearClient, { force: true });
+				return await signTransactionsWithActionsLocally({
+					ctx,
+					sessionId,
+					onEvent,
+					resolvedRpcCall,
+					localKeyMaterial,
 					txSigningRequests,
 					intentDigest,
 					transactionContext,
-					credential
+					credential,
+					expectedTransactionCount: transactions.length,
+					warnings
+				});
+			}
+			if (attempt === 0 && isThresholdSessionAuthUnavailableError(err)) {
+				clearCachedThresholdEd25519AuthSession(signingContext.threshold.thresholdSessionCacheKey);
+				signingContext.threshold.thresholdSessionJwt = void 0;
+				requestPayload.threshold.thresholdSessionJwt = void 0;
+				if (!credential || !vrfChallenge) {
+					const refreshed = await ctx.vrfWorkerManager.confirmAndPrepareSigningSession({
+						ctx,
+						sessionId,
+						kind: "transaction",
+						signingAuthMode: "webauthn",
+						txSigningRequests: transactions,
+						rpcCall: resolvedRpcCall,
+						confirmationConfigOverride,
+						title,
+						body
+					});
+					({intentDigest, transactionContext, vrfChallenge, credential} = extractSigningEvidenceFromConfirmation$2(refreshed));
+					requestPayload.intentDigest = intentDigest;
+					requestPayload.transactionContext = transactionContext;
+					requestPayload.vrfChallenge = vrfChallenge;
+					requestPayload.credential = credential;
 				}
-			},
-			onEvent
-		});
-		if (!isSignTransactionsWithActionsSuccess(response)) {
-			console.error("WebAuthnManager: Batch transaction signing failed:", response);
-			const payloadError = isObject(response?.payload) && response?.payload?.error;
-			throw new Error(payloadError || "Batch transaction signing failed");
+				continue;
+			}
+			throw err;
 		}
-		if (!response.payload.success) throw new Error(response.payload.error || "Batch transaction signing failed");
-		const signedTransactions = response.payload.signedTransactions || [];
-		if (signedTransactions.length !== transactions.length) throw new Error(`Expected ${transactions.length} signed transactions but received ${signedTransactions.length}`);
-		const results = signedTransactions.map((signedTx, index) => {
-			if (!signedTx || !signedTx.transaction || !signedTx.signature) throw new Error(`Incomplete signed transaction data received for transaction ${index + 1}`);
-			return {
-				signedTransaction: new SignedTransaction({
-					transaction: signedTx.transaction,
-					signature: signedTx.signature,
-					borsh_bytes: Array.from(signedTx.borshBytes || [])
-				}),
-				nearAccountId: toAccountId(nearAccountId),
-				logs: response.payload.logs
-			};
-		});
-		return results;
-	} catch (error) {
-		console.error("WebAuthnManager: Batch transaction signing error:", error);
-		throw error;
 	}
+	return await signTransactionsWithActionsLocally({
+		ctx,
+		sessionId,
+		onEvent,
+		resolvedRpcCall,
+		localKeyMaterial,
+		txSigningRequests,
+		intentDigest,
+		transactionContext,
+		credential,
+		expectedTransactionCount: transactions.length,
+		warnings
+	});
 }
-
-//#endregion
-//#region src/core/nearCrypto.ts
-const NEAR_ED25519_KEY_PREFIX = "ed25519:";
-/**
-* Ensure a key string has the NEAR Ed25519 prefix (`ed25519:`).
-*
-* - Accepts either `ed25519:<base58>` or a bare `<base58>` string.
-* - Canonicalizes `ED25519:` → `ed25519:`.
-* - If a different prefix is present (e.g. `secp256k1:`), returns the input unchanged.
-*/
-function ensureEd25519Prefix(value) {
-	const raw = String(value || "").trim();
-	if (!raw) return "";
-	if (/^[a-z0-9_]+:/i.test(raw)) {
-		if (/^ed25519:/i.test(raw)) return `${NEAR_ED25519_KEY_PREFIX}${raw.replace(/^ed25519:/i, "")}`;
-		return raw;
-	}
-	return `${NEAR_ED25519_KEY_PREFIX}${raw}`;
+async function signTransactionsWithActionsLocally(args) {
+	const response = await args.ctx.sendMessage({
+		sessionId: args.sessionId,
+		message: {
+			type: WorkerRequestType.SignTransactionsWithActions,
+			payload: {
+				signerMode: "local-signer",
+				rpcCall: args.resolvedRpcCall,
+				createdAt: Date.now(),
+				decryption: {
+					encryptedPrivateKeyData: args.localKeyMaterial.encryptedSk,
+					encryptedPrivateKeyChacha20NonceB64u: args.localKeyMaterial.chacha20NonceB64u
+				},
+				txSigningRequests: args.txSigningRequests,
+				intentDigest: args.intentDigest,
+				transactionContext: args.transactionContext,
+				credential: args.credential
+			}
+		},
+		onEvent: args.onEvent
+	});
+	const okResponse = requireOkSignTransactionsWithActionsResponse(response);
+	return toSignedTransactionResults({
+		okResponse,
+		expectedTransactionCount: args.expectedTransactionCount,
+		nearAccountId: args.resolvedRpcCall.nearAccountId,
+		warnings: args.warnings
+	});
+}
+function toSignedTransactionResults(args) {
+	const signedTransactions = args.okResponse.payload.signedTransactions || [];
+	if (signedTransactions.length !== args.expectedTransactionCount) throw new Error(`Expected ${args.expectedTransactionCount} signed transactions but received ${signedTransactions.length}`);
+	return signedTransactions.map((signedTx, index) => {
+		if (!signedTx || !signedTx.transaction || !signedTx.signature) throw new Error(`Incomplete signed transaction data received for transaction ${index + 1}`);
+		return {
+			signedTransaction: new SignedTransaction({
+				transaction: signedTx.transaction,
+				signature: signedTx.signature,
+				borsh_bytes: Array.from(signedTx.borshBytes || [])
+			}),
+			nearAccountId: toAccountId(args.nearAccountId),
+			logs: [...args.okResponse.payload.logs || [], ...args.warnings]
+		};
+	});
+}
+function validateAndPrepareSigningContext(args) {
+	const localPublicKey = String(args.localKeyMaterial.publicKey || "").trim();
+	if (!localPublicKey) throw new Error(`Missing local signing public key for ${args.nearAccountId}`);
+	if (args.resolvedSignerMode !== "threshold-signer") return {
+		resolvedSignerMode: "local-signer",
+		signingNearPublicKeyStr: localPublicKey,
+		threshold: null
+	};
+	const thresholdKeyMaterial = args.thresholdKeyMaterial;
+	if (!thresholdKeyMaterial) throw new Error(`Missing threshold key material for ${args.nearAccountId}`);
+	const thresholdPublicKey = String(thresholdKeyMaterial.publicKey || "").trim();
+	if (!thresholdPublicKey) throw new Error(`Missing threshold signing public key for ${args.nearAccountId}`);
+	const relayerUrl = String(args.relayerUrl || "").trim();
+	if (!relayerUrl) throw new Error("Missing relayerUrl (required for threshold-signer)");
+	const rpId = String(args.rpId || "").trim();
+	if (!rpId) throw new Error("Missing rpId for threshold signing");
+	const participantIds = normalizeThresholdEd25519ParticipantIds(thresholdKeyMaterial.participants.map((p) => p.id));
+	if (!participantIds || participantIds.length < 2) throw new Error(`Invalid threshold signing participantIds (expected >=2 participants, got [${(participantIds || []).join(",")}])`);
+	const thresholdSessionCacheKey = makeThresholdEd25519AuthSessionCacheKey({
+		nearAccountId: args.nearAccountId,
+		rpId,
+		relayerUrl,
+		relayerKeyId: thresholdKeyMaterial.relayerKeyId,
+		participantIds
+	});
+	return {
+		resolvedSignerMode: "threshold-signer",
+		signingNearPublicKeyStr: thresholdPublicKey,
+		threshold: {
+			relayerUrl,
+			thresholdKeyMaterial,
+			thresholdSessionCacheKey,
+			thresholdSessionJwt: getCachedThresholdEd25519AuthSessionJwt(thresholdSessionCacheKey)
+		}
+	};
+}
+function extractSigningEvidenceFromConfirmation$2(confirmation) {
+	const credentialForRelay = confirmation.credential ? removePrfOutputGuard(confirmation.credential) : void 0;
+	return {
+		intentDigest: confirmation.intentDigest,
+		transactionContext: confirmation.transactionContext,
+		vrfChallenge: confirmation.vrfChallenge,
+		credential: credentialForRelay ? JSON.stringify(credentialForRelay) : void 0
+	};
+}
+function requireOkSignTransactionsWithActionsResponse(response) {
+	if (!isSignTransactionsWithActionsSuccess(response)) {
+		if (isWorkerError(response)) throw new Error(response.payload.error || "Batch transaction signing failed");
+		throw new Error("Batch transaction signing failed");
+	}
+	if (!response.payload.success) throw new Error(response.payload.error || "Batch transaction signing failed");
+	return response;
 }
 
 //#endregion
 //#region src/core/WebAuthnManager/SignerWorkerManager/handlers/validation.ts
+const toPublicKeyString = (pk) => {
+	if (typeof pk === "string") return pk;
+	return ensureEd25519Prefix(base58Encode(pk.keyData));
+};
 function validateTransactionContextMaybe(input) {
 	if (input == null) return void 0;
 	if (!isObject(input)) throw new Error("Invalid transactionContext: expected object");
@@ -2753,16 +3065,13 @@ function parseAndValidateRegistrationCredentialConfirmationPayload(payload) {
 		error: normalizedError
 	};
 }
-const toPublicKeyString = (pk) => {
-	if (typeof pk === "string") return pk;
-	return ensureEd25519Prefix(base58Encode(pk.keyData));
-};
 
 //#endregion
 //#region src/core/WebAuthnManager/SignerWorkerManager/handlers/signDelegateAction.ts
-async function signDelegateAction({ ctx, delegate, rpcCall, onEvent, confirmationConfigOverride, title, body, sessionId: providedSessionId }) {
+async function signDelegateAction({ ctx, delegate, rpcCall, signerMode, onEvent, confirmationConfigOverride, title, body, sessionId: providedSessionId }) {
 	const sessionId = providedSessionId ?? generateSessionId();
 	const nearAccountId = rpcCall.nearAccountId || delegate.senderId;
+	const relayerUrl = ctx.relayerUrl;
 	const resolvedRpcCall = {
 		contractId: rpcCall.contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId,
 		nearRpcUrl: rpcCall.nearRpcUrl || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl.split(",")[0] || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl,
@@ -2777,13 +3086,34 @@ async function signDelegateAction({ ctx, delegate, rpcCall, onEvent, confirmatio
 		}
 	});
 	const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);
-	const encryptedKeyData = await ctx.indexedDB.nearKeysDB.getEncryptedKey(nearAccountId, deviceNumber);
-	if (!encryptedKeyData) throw new Error(`No encrypted key found for account: ${nearAccountId}`);
-	if (!ctx.vrfWorkerManager) throw new Error("VrfWorkerManager not available for delegate signing");
-	const confirmation = await ctx.vrfWorkerManager.confirmAndPrepareSigningSession({
+	const [localKeyMaterial, thresholdKeyMaterial] = await Promise.all([ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber), ctx.indexedDB.nearKeysDB.getThresholdKeyMaterial(nearAccountId, deviceNumber)]);
+	if (!localKeyMaterial) throw new Error(`No local key material found for account: ${nearAccountId}`);
+	const warnings = [];
+	const vrfWorkerManager = ctx.vrfWorkerManager;
+	if (!vrfWorkerManager) throw new Error("VrfWorkerManager not available for delegate signing");
+	const resolvedSignerMode = await resolveSignerModeForThresholdSigning({
+		nearAccountId,
+		signerMode,
+		relayerUrl,
+		hasThresholdKeyMaterial: !!thresholdKeyMaterial,
+		warnings
+	});
+	const signingContext = validateAndPrepareDelegateSigningContext({
+		nearAccountId,
+		resolvedSignerMode,
+		relayerUrl,
+		rpId: ctx.touchIdPrompt.getRpId(),
+		localKeyMaterial,
+		thresholdKeyMaterial,
+		providedDelegatePublicKey: delegate.publicKey,
+		warnings
+	});
+	ctx.nonceManager.initializeUser(toAccountId(nearAccountId), signingContext.signingNearPublicKeyStr);
+	const confirmation = await vrfWorkerManager.confirmAndPrepareSigningSession({
 		ctx,
 		sessionId,
 		kind: "delegate",
+		...signingContext.threshold && !signingContext.threshold.thresholdSessionJwt ? { signingAuthMode: "webauthn" } : {},
 		nearAccountId,
 		delegate: {
 			senderId: delegate.senderId || nearAccountId,
@@ -2797,53 +3127,186 @@ async function signDelegateAction({ ctx, delegate, rpcCall, onEvent, confirmatio
 		title,
 		body
 	});
-	const intentDigest = confirmation.intentDigest;
-	const transactionContext = confirmation.transactionContext;
-	const credential = confirmation.credential ? JSON.stringify(confirmation.credential) : void 0;
-	const response = await ctx.sendMessage({
-		sessionId,
-		message: {
-			type: WorkerRequestType.SignDelegateAction,
-			payload: {
-				rpcCall: resolvedRpcCall,
-				createdAt: Date.now(),
-				decryption: {
-					encryptedPrivateKeyData: encryptedKeyData.encryptedData,
-					encryptedPrivateKeyChacha20NonceB64u: encryptedKeyData.chacha20NonceB64u
-				},
+	let { intentDigest, transactionContext, vrfChallenge, credential } = extractSigningEvidenceFromConfirmation$1(confirmation);
+	const delegatePayload = {
+		senderId: delegate.senderId || nearAccountId,
+		receiverId: delegate.receiverId,
+		actions: actionsWasm,
+		nonce: delegate.nonce.toString(),
+		maxBlockHeight: delegate.maxBlockHeight.toString(),
+		publicKey: signingContext.delegatePublicKeyStr
+	};
+	if (!signingContext.threshold) {
+		const response = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: WorkerRequestType.SignDelegateAction,
+				payload: {
+					signerMode: signingContext.resolvedSignerMode,
+					rpcCall: resolvedRpcCall,
+					createdAt: Date.now(),
+					decryption: {
+						encryptedPrivateKeyData: localKeyMaterial.encryptedSk,
+						encryptedPrivateKeyChacha20NonceB64u: localKeyMaterial.chacha20NonceB64u
+					},
+					delegate: delegatePayload,
+					intentDigest,
+					transactionContext,
+					credential
+				}
+			},
+			onEvent
+		});
+		const okResponse$1 = requireOkSignDelegateActionResponse(response);
+		return {
+			signedDelegate: okResponse$1.payload.signedDelegate,
+			hash: okResponse$1.payload.hash,
+			nearAccountId: toAccountId(nearAccountId),
+			logs: [...okResponse$1.payload.logs || [], ...warnings]
+		};
+	}
+	const requestPayload = {
+		signerMode: signingContext.resolvedSignerMode,
+		rpcCall: resolvedRpcCall,
+		createdAt: Date.now(),
+		decryption: {
+			encryptedPrivateKeyData: "",
+			encryptedPrivateKeyChacha20NonceB64u: ""
+		},
+		threshold: {
+			relayerUrl: signingContext.threshold.relayerUrl,
+			relayerKeyId: signingContext.threshold.thresholdKeyMaterial.relayerKeyId,
+			clientParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "client")?.id,
+			relayerParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "relayer")?.id,
+			participantIds: signingContext.threshold.thresholdKeyMaterial.participants.map((p) => p.id),
+			thresholdSessionKind: "jwt",
+			thresholdSessionJwt: signingContext.threshold.thresholdSessionJwt
+		},
+		delegate: delegatePayload,
+		intentDigest,
+		transactionContext,
+		vrfChallenge,
+		credential
+	};
+	let okResponse;
+	try {
+		const resp = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: WorkerRequestType.SignDelegateAction,
+				payload: requestPayload
+			},
+			onEvent
+		});
+		okResponse = requireOkSignDelegateActionResponse(resp);
+	} catch (e) {
+		const err = e instanceof Error ? e : new Error(String(e));
+		if (!isThresholdSessionAuthUnavailableError(err)) throw err;
+		clearCachedThresholdEd25519AuthSession(signingContext.threshold.thresholdSessionCacheKey);
+		signingContext.threshold.thresholdSessionJwt = void 0;
+		requestPayload.threshold.thresholdSessionJwt = void 0;
+		if (!credential || !vrfChallenge) {
+			const refreshed = await vrfWorkerManager.confirmAndPrepareSigningSession({
+				ctx,
+				sessionId,
+				kind: "delegate",
+				signingAuthMode: "webauthn",
+				nearAccountId,
 				delegate: {
 					senderId: delegate.senderId || nearAccountId,
 					receiverId: delegate.receiverId,
 					actions: actionsWasm,
-					nonce: delegate.nonce.toString(),
-					maxBlockHeight: delegate.maxBlockHeight.toString(),
-					publicKey: toPublicKeyString(delegate.publicKey)
+					nonce: delegate.nonce,
+					maxBlockHeight: delegate.maxBlockHeight
 				},
-				intentDigest,
-				transactionContext,
-				credential
-			}
-		},
-		onEvent
-	});
-	console.debug("[WebAuthnManager][delegate] raw worker response", response);
-	if (!isSignDelegateActionSuccess(response)) {
-		console.error("[WebAuthnManager][delegate] non-success worker response", response);
-		const payloadError = response?.payload?.error;
-		throw new Error(payloadError || "Delegate action signing failed");
-	}
-	const payload = response.payload;
-	if (!payload.success || !payload.signedDelegate || !payload.hash) {
-		console.error("[WebAuthnManager][delegate] invalid delegate payload", payload);
-		throw new Error(payload.error || "Delegate action signing failed");
+				rpcCall: resolvedRpcCall,
+				confirmationConfigOverride,
+				title,
+				body
+			});
+			({intentDigest, transactionContext, vrfChallenge, credential} = extractSigningEvidenceFromConfirmation$1(refreshed));
+			requestPayload.intentDigest = intentDigest;
+			requestPayload.transactionContext = transactionContext;
+			requestPayload.vrfChallenge = vrfChallenge;
+			requestPayload.credential = credential;
+		}
+		const resp = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: WorkerRequestType.SignDelegateAction,
+				payload: requestPayload
+			},
+			onEvent
+		});
+		okResponse = requireOkSignDelegateActionResponse(resp);
 	}
 	return {
-		signedDelegate: payload.signedDelegate,
-		hash: payload.hash,
+		signedDelegate: okResponse.payload.signedDelegate,
+		hash: okResponse.payload.hash,
 		nearAccountId: toAccountId(nearAccountId),
-		logs: payload.logs
+		logs: [...okResponse.payload.logs || [], ...warnings]
+	};
+}
+function validateAndPrepareDelegateSigningContext(args) {
+	const localPublicKey = ensureEd25519Prefix(args.localKeyMaterial.publicKey);
+	if (!localPublicKey) throw new Error(`Missing local signing public key for ${args.nearAccountId}`);
+	const providedDelegatePublicKeyStr = ensureEd25519Prefix(toPublicKeyString(args.providedDelegatePublicKey));
+	if (args.resolvedSignerMode !== "threshold-signer") {
+		if (providedDelegatePublicKeyStr && providedDelegatePublicKeyStr !== localPublicKey) args.warnings.push(`Delegate public key ${providedDelegatePublicKeyStr} does not match local signer key; using ${localPublicKey}`);
+		return {
+			resolvedSignerMode: "local-signer",
+			signingNearPublicKeyStr: localPublicKey,
+			delegatePublicKeyStr: localPublicKey,
+			threshold: null
+		};
+	}
+	const thresholdKeyMaterial = args.thresholdKeyMaterial;
+	if (!thresholdKeyMaterial) throw new Error(`Missing threshold key material for ${args.nearAccountId}`);
+	const thresholdPublicKey = ensureEd25519Prefix(thresholdKeyMaterial.publicKey);
+	if (!thresholdPublicKey) throw new Error(`Missing threshold signing public key for ${args.nearAccountId}`);
+	if (providedDelegatePublicKeyStr && providedDelegatePublicKeyStr !== thresholdPublicKey) args.warnings.push(`Delegate public key ${providedDelegatePublicKeyStr} does not match threshold signer key; using ${thresholdPublicKey}`);
+	const relayerUrl = String(args.relayerUrl || "").trim();
+	if (!relayerUrl) throw new Error("Missing relayerUrl (required for threshold-signer)");
+	const rpId = String(args.rpId || "").trim();
+	if (!rpId) throw new Error("Missing rpId for threshold signing");
+	const participantIds = normalizeThresholdEd25519ParticipantIds(thresholdKeyMaterial.participants.map((p) => p.id));
+	if (!participantIds || participantIds.length < 2) throw new Error(`Invalid threshold signing participantIds (expected >=2 participants, got [${(participantIds || []).join(",")}])`);
+	const thresholdSessionCacheKey = makeThresholdEd25519AuthSessionCacheKey({
+		nearAccountId: args.nearAccountId,
+		rpId,
+		relayerUrl,
+		relayerKeyId: thresholdKeyMaterial.relayerKeyId,
+		participantIds
+	});
+	return {
+		resolvedSignerMode: "threshold-signer",
+		signingNearPublicKeyStr: thresholdPublicKey,
+		delegatePublicKeyStr: thresholdPublicKey,
+		threshold: {
+			relayerUrl,
+			thresholdKeyMaterial,
+			thresholdSessionCacheKey,
+			thresholdSessionJwt: getCachedThresholdEd25519AuthSessionJwt(thresholdSessionCacheKey)
+		}
+	};
+}
+function extractSigningEvidenceFromConfirmation$1(confirmation) {
+	const credentialForRelay = confirmation.credential ? removePrfOutputGuard(confirmation.credential) : void 0;
+	return {
+		intentDigest: confirmation.intentDigest,
+		transactionContext: confirmation.transactionContext,
+		vrfChallenge: confirmation.vrfChallenge,
+		credential: credentialForRelay ? JSON.stringify(credentialForRelay) : void 0
 	};
 }
+function requireOkSignDelegateActionResponse(response) {
+	if (!isSignDelegateActionSuccess(response)) {
+		if (isWorkerError(response)) throw new Error(response.payload.error || "Delegate action signing failed");
+		throw new Error("Delegate action signing failed");
+	}
+	if (!response.payload.success || !response.payload.signedDelegate || !response.payload.hash) throw new Error(response.payload.error || "Delegate action signing failed");
+	return response;
+}
 
 //#endregion
 //#region src/core/WebAuthnManager/SignerWorkerManager/handlers/recoverKeypairFromPasskey.ts
@@ -2910,12 +3373,8 @@ async function extractCosePublicKey({ ctx, attestationObjectBase64url }) {
 async function signTransactionWithKeyPair({ ctx, nearPrivateKey, signerAccountId, receiverId, nonce, blockHash, actions }) {
 	try {
 		console.info("SignerWorkerManager: Starting transaction signing with provided private key");
-		actions.forEach((action, index) => {
-			try {
-				validateActionArgsWasm(action);
-			} catch (error) {
-				throw new Error(`Action ${index} validation failed: ${error instanceof Error ? error.message : "Unknown error"}`);
-			}
+		actions.forEach((action) => {
+			validateActionArgsWasm(action);
 		});
 		const response = await ctx.sendMessage({ message: {
 			type: WorkerRequestType.SignTransactionWithKeyPair,
@@ -2964,16 +3423,34 @@ async function signTransactionWithKeyPair({ ctx, nearPrivateKey, signerAccountId
 */
 async function signNep413Message({ ctx, payload }) {
 	try {
-		const deviceNumber = await getLastLoggedInDeviceNumber(payload.accountId, ctx.indexedDB.clientDB);
-		const encryptedKeyData = await ctx.indexedDB.nearKeysDB.getEncryptedKey(payload.accountId, deviceNumber);
-		if (!encryptedKeyData) throw new Error(`No encrypted key found for account: ${payload.accountId}`);
 		const sessionId = payload.sessionId ?? generateSessionId();
-		if (!ctx.vrfWorkerManager) throw new Error("VrfWorkerManager not available for NEP-413 signing");
-		await ctx.vrfWorkerManager.confirmAndPrepareSigningSession({
+		const relayerUrl = ctx.relayerUrl;
+		const nearAccountId = payload.accountId;
+		const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);
+		const [localKeyMaterial, thresholdKeyMaterial] = await Promise.all([ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber), ctx.indexedDB.nearKeysDB.getThresholdKeyMaterial(nearAccountId, deviceNumber)]);
+		if (!localKeyMaterial) throw new Error(`No local key material found for account: ${nearAccountId}`);
+		const resolvedSignerMode = await resolveSignerModeForThresholdSigning({
+			nearAccountId,
+			signerMode: payload.signerMode,
+			relayerUrl,
+			hasThresholdKeyMaterial: !!thresholdKeyMaterial
+		});
+		const vrfWorkerManager = ctx.vrfWorkerManager;
+		if (!vrfWorkerManager) throw new Error("VrfWorkerManager not available for NEP-413 signing");
+		const signingContext = validateAndPrepareNep413SigningContext({
+			nearAccountId,
+			resolvedSignerMode,
+			relayerUrl,
+			rpId: ctx.touchIdPrompt.getRpId(),
+			localKeyMaterial,
+			thresholdKeyMaterial
+		});
+		const confirmation = await vrfWorkerManager.confirmAndPrepareSigningSession({
 			ctx,
 			sessionId,
 			kind: "nep413",
-			nearAccountId: payload.accountId,
+			...signingContext.threshold && !signingContext.threshold.thresholdSessionJwt ? { signingAuthMode: "webauthn" } : {},
+			nearAccountId,
 			message: payload.message,
 			recipient: payload.recipient,
 			title: payload.title,
@@ -2982,32 +3459,95 @@ async function signNep413Message({ ctx, payload }) {
 			contractId: payload.contractId,
 			nearRpcUrl: payload.nearRpcUrl
 		});
-		const response = await ctx.sendMessage({
-			sessionId,
-			message: {
-				type: WorkerRequestType.SignNep413Message,
-				payload: {
+		let { vrfChallenge, credential } = extractSigningEvidenceFromConfirmation(confirmation);
+		const requestPayload = {
+			signerMode: signingContext.resolvedSignerMode,
+			message: payload.message,
+			recipient: payload.recipient,
+			nonce: payload.nonce,
+			state: payload.state || void 0,
+			accountId: nearAccountId,
+			nearPublicKey: signingContext.nearPublicKey,
+			decryption: signingContext.decryption,
+			threshold: signingContext.threshold ? {
+				relayerUrl: signingContext.threshold.relayerUrl,
+				relayerKeyId: signingContext.threshold.thresholdKeyMaterial.relayerKeyId,
+				clientParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "client")?.id,
+				relayerParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "relayer")?.id,
+				participantIds: signingContext.threshold.thresholdKeyMaterial.participants.map((p) => p.id),
+				thresholdSessionKind: "jwt",
+				thresholdSessionJwt: signingContext.threshold.thresholdSessionJwt
+			} : void 0,
+			vrfChallenge,
+			credential
+		};
+		if (!signingContext.threshold) {
+			const response = await ctx.sendMessage({
+				sessionId,
+				message: {
+					type: WorkerRequestType.SignNep413Message,
+					payload: requestPayload
+				}
+			});
+			const okResponse$1 = requireOkSignNep413MessageResponse(response);
+			return {
+				success: true,
+				accountId: okResponse$1.payload.accountId,
+				publicKey: okResponse$1.payload.publicKey,
+				signature: okResponse$1.payload.signature,
+				state: okResponse$1.payload.state || void 0
+			};
+		}
+		let okResponse;
+		try {
+			const response = await ctx.sendMessage({
+				sessionId,
+				message: {
+					type: WorkerRequestType.SignNep413Message,
+					payload: requestPayload
+				}
+			});
+			okResponse = requireOkSignNep413MessageResponse(response);
+		} catch (e) {
+			const err = e instanceof Error ? e : new Error(String(e));
+			if (!isThresholdSessionAuthUnavailableError(err)) throw err;
+			clearCachedThresholdEd25519AuthSession(signingContext.threshold.thresholdSessionCacheKey);
+			signingContext.threshold.thresholdSessionJwt = void 0;
+			requestPayload.threshold.thresholdSessionJwt = void 0;
+			if (!credential || !vrfChallenge) {
+				const refreshed = await vrfWorkerManager.confirmAndPrepareSigningSession({
+					ctx,
+					sessionId,
+					kind: "nep413",
+					signingAuthMode: "webauthn",
+					nearAccountId,
 					message: payload.message,
 					recipient: payload.recipient,
-					nonce: payload.nonce,
-					state: payload.state || void 0,
-					accountId: payload.accountId,
-					encryptedPrivateKeyData: encryptedKeyData.encryptedData,
-					encryptedPrivateKeyChacha20NonceB64u: encryptedKeyData.chacha20NonceB64u
-				}
+					title: payload.title,
+					body: payload.body,
+					confirmationConfigOverride: payload.confirmationConfigOverride,
+					contractId: payload.contractId,
+					nearRpcUrl: payload.nearRpcUrl
+				});
+				({vrfChallenge, credential} = extractSigningEvidenceFromConfirmation(refreshed));
+				requestPayload.vrfChallenge = vrfChallenge;
+				requestPayload.credential = credential;
 			}
-		});
-		if (!isSignNep413MessageSuccess(response)) {
-			console.error("SignerWorkerManager: NEP-413 signing failed:", response);
-			const payloadError = isObject(response?.payload) && response?.payload?.error;
-			throw new Error(payloadError || "NEP-413 signing failed");
+			const response = await ctx.sendMessage({
+				sessionId,
+				message: {
+					type: WorkerRequestType.SignNep413Message,
+					payload: requestPayload
+				}
+			});
+			okResponse = requireOkSignNep413MessageResponse(response);
 		}
 		return {
 			success: true,
-			accountId: response.payload.accountId,
-			publicKey: response.payload.publicKey,
-			signature: response.payload.signature,
-			state: response.payload.state || void 0
+			accountId: okResponse.payload.accountId,
+			publicKey: okResponse.payload.publicKey,
+			signature: okResponse.payload.signature,
+			state: okResponse.payload.state || void 0
 		};
 	} catch (error) {
 		console.error("SignerWorkerManager: NEP-413 signing error:", error);
@@ -3020,6 +3560,64 @@ async function signNep413Message({ ctx, payload }) {
 		};
 	}
 }
+function validateAndPrepareNep413SigningContext(args) {
+	const localPublicKey = String(args.localKeyMaterial.publicKey || "").trim();
+	if (!localPublicKey) throw new Error(`Missing local signing public key for ${args.nearAccountId}`);
+	if (args.resolvedSignerMode !== "threshold-signer") return {
+		resolvedSignerMode: "local-signer",
+		nearPublicKey: localPublicKey,
+		decryption: {
+			encryptedPrivateKeyData: args.localKeyMaterial.encryptedSk,
+			encryptedPrivateKeyChacha20NonceB64u: args.localKeyMaterial.chacha20NonceB64u
+		},
+		threshold: null
+	};
+	const thresholdKeyMaterial = args.thresholdKeyMaterial;
+	if (!thresholdKeyMaterial) throw new Error(`Missing threshold key material for ${args.nearAccountId}`);
+	const thresholdPublicKey = String(thresholdKeyMaterial.publicKey || "").trim();
+	if (!thresholdPublicKey) throw new Error(`Missing threshold signing public key for ${args.nearAccountId}`);
+	const relayerUrl = String(args.relayerUrl || "").trim();
+	if (!relayerUrl) throw new Error("Missing relayerUrl (required for threshold-signer)");
+	const rpId = String(args.rpId || "").trim();
+	if (!rpId) throw new Error("Missing rpId for threshold signing");
+	const participantIds = normalizeThresholdEd25519ParticipantIds(thresholdKeyMaterial.participants.map((p) => p.id));
+	if (!participantIds || participantIds.length < 2) throw new Error(`Invalid threshold signing participantIds (expected >=2 participants, got [${(participantIds || []).join(",")}])`);
+	const thresholdSessionCacheKey = makeThresholdEd25519AuthSessionCacheKey({
+		nearAccountId: args.nearAccountId,
+		rpId,
+		relayerUrl,
+		relayerKeyId: thresholdKeyMaterial.relayerKeyId,
+		participantIds
+	});
+	return {
+		resolvedSignerMode: "threshold-signer",
+		nearPublicKey: thresholdPublicKey,
+		decryption: {
+			encryptedPrivateKeyData: "",
+			encryptedPrivateKeyChacha20NonceB64u: ""
+		},
+		threshold: {
+			relayerUrl,
+			thresholdKeyMaterial,
+			thresholdSessionCacheKey,
+			thresholdSessionJwt: getCachedThresholdEd25519AuthSessionJwt(thresholdSessionCacheKey)
+		}
+	};
+}
+function extractSigningEvidenceFromConfirmation(confirmation) {
+	const credentialForRelay = confirmation.credential ? removePrfOutputGuard(confirmation.credential) : void 0;
+	return {
+		vrfChallenge: confirmation.vrfChallenge,
+		credential: credentialForRelay ? JSON.stringify(credentialForRelay) : void 0
+	};
+}
+function requireOkSignNep413MessageResponse(response) {
+	if (!isSignNep413MessageSuccess(response)) {
+		if (isWorkerError(response)) throw new Error(response.payload.error || "NEP-413 signing failed");
+		throw new Error("NEP-413 signing failed");
+	}
+	return response;
+}
 
 //#endregion
 //#region src/core/WebAuthnManager/SignerWorkerManager/handlers/registerDevice2WithDerivedKey.ts
@@ -3050,6 +3648,8 @@ async function registerDevice2WithDerivedKey({ ctx, sessionId, nearAccountId, cr
 			if (!s) return [];
 			return Array.from(base64UrlDecode(s));
 		};
+		const intentDigest32 = b64ToBytes(vrfChallenge.intentDigest);
+		if (intentDigest32.length !== 32) throw new Error("Missing or invalid vrfChallenge.intentDigest (expected base64url-encoded 32 bytes)");
 		const finalContractArgs = {
 			vrf_data: {
 				vrf_input_data: b64ToBytes(vrfChallenge.vrfInput),
@@ -3059,7 +3659,8 @@ async function registerDevice2WithDerivedKey({ ctx, sessionId, nearAccountId, cr
 				user_id: vrfChallenge.userId,
 				rp_id: vrfChallenge.rpId,
 				block_height: Number(vrfChallenge.blockHeight),
-				block_hash: b64ToBytes(vrfChallenge.blockHash)
+				block_hash: b64ToBytes(vrfChallenge.blockHash),
+				intent_digest_32: intentDigest32
 			},
 			webauthn_registration: credential,
 			deterministic_vrf_public_key: b64ToBytes(deterministicVrfPublicKey),
@@ -3094,22 +3695,25 @@ async function registerDevice2WithDerivedKey({ ctx, sessionId, nearAccountId, cr
 		console.debug("[SignerWorkerManager] Device2 registration complete, storing encrypted key");
 		const chacha20NonceB64u = wasmResult.chacha20NonceB64u;
 		if (!chacha20NonceB64u) throw new Error("Missing chacha20NonceB64u in Device2 registration result");
-		const keyData = {
+		const wrapKeySaltPersisted = wasmResult.wrapKeySalt;
+		if (!wrapKeySaltPersisted) throw new Error("Missing wrapKeySalt in Device2 registration result");
+		const keyMaterial = {
+			kind: "local_near_sk_v3",
 			nearAccountId,
 			deviceNumber: deviceNumber ?? 2,
-			encryptedData: wasmResult.encryptedData,
+			publicKey: wasmResult.publicKey,
+			encryptedSk: wasmResult.encryptedData,
 			chacha20NonceB64u,
-			wrapKeySalt: wasmResult.wrapKeySalt,
-			version: 2,
+			wrapKeySalt: wrapKeySaltPersisted,
 			timestamp: Date.now()
 		};
-		await ctx.indexedDB.nearKeysDB.storeEncryptedKey(keyData);
+		await ctx.indexedDB.nearKeysDB.storeKeyMaterial(keyMaterial);
 		console.debug("[SignerWorkerManager] Device2 encrypted key stored successfully");
 		return {
 			success: true,
 			publicKey: wasmResult.publicKey,
 			signedTransaction: wasmResult.signedTransaction,
-			wrapKeySalt: wasmResult.wrapKeySalt,
+			wrapKeySalt: wrapKeySaltPersisted,
 			encryptedData: wasmResult.encryptedData,
 			chacha20NonceB64u
 		};
@@ -3194,7 +3798,6 @@ function validateSecureConfirmRequest(input) {
 	if (typeof input === "string") throw new Error("Invalid secure confirm request: expected an object (JSON strings are not supported)");
 	if (!isObject(input)) throw new Error("parsed is not an object");
 	const p = input;
-	if (p.schemaVersion !== 2) throw new Error("schemaVersion must be 2");
 	if (!isString(p.requestId) || !p.requestId) throw new Error("missing requestId");
 	if (!isString(p.type) || !p.type) throw new Error("missing type");
 	if (p.summary === void 0 || p.summary === null) throw new Error("missing summary");
@@ -3275,42 +3878,42 @@ async function importFlow(label, loader) {
 }
 const HANDLERS = {
 	[SecureConfirmationType.DECRYPT_PRIVATE_KEY_WITH_PRF]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleLocalOnlyFlow } = await importFlow("localOnly", () => import("./localOnly-VevCI7H0.js"));
+		const { handleLocalOnlyFlow } = await importFlow("localOnly", () => import("./localOnly-40zxrBMm.js"));
 		await handleLocalOnlyFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.SHOW_SECURE_PRIVATE_KEY_UI]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleLocalOnlyFlow } = await importFlow("localOnly", () => import("./localOnly-VevCI7H0.js"));
+		const { handleLocalOnlyFlow } = await importFlow("localOnly", () => import("./localOnly-40zxrBMm.js"));
 		await handleLocalOnlyFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.REGISTER_ACCOUNT]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleRegistrationFlow } = await importFlow("registration", () => import("./registration-bKEg9Zr2.js"));
+		const { handleRegistrationFlow } = await importFlow("registration", () => import("./registration-MrAOC8Ub.js"));
 		await handleRegistrationFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.LINK_DEVICE]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleRegistrationFlow } = await importFlow("registration", () => import("./registration-bKEg9Zr2.js"));
+		const { handleRegistrationFlow } = await importFlow("registration", () => import("./registration-MrAOC8Ub.js"));
 		await handleRegistrationFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.SIGN_TRANSACTION]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleTransactionSigningFlow } = await importFlow("transactions", () => import("./transactions-Cn9xTWlK.js"));
+		const { handleTransactionSigningFlow } = await importFlow("transactions", () => import("./transactions-CrjP8yPD.js"));
 		await handleTransactionSigningFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.SIGN_NEP413_MESSAGE]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleTransactionSigningFlow } = await importFlow("transactions", () => import("./transactions-Cn9xTWlK.js"));
+		const { handleTransactionSigningFlow } = await importFlow("transactions", () => import("./transactions-CrjP8yPD.js"));
 		await handleTransactionSigningFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
@@ -3349,7 +3952,7 @@ async function runSecureConfirm(ctx, request) {
 async function exportNearKeypairUi({ ctx, nearAccountId, variant, theme, sessionId }) {
 	const accountId = toAccountId(nearAccountId);
 	const deviceNumber = await getLastLoggedInDeviceNumber(accountId, ctx.indexedDB.clientDB);
-	const [keyData, user] = await Promise.all([ctx.indexedDB.nearKeysDB.getEncryptedKey(accountId, deviceNumber), ctx.indexedDB.clientDB.getUserByDevice(accountId, deviceNumber)]);
+	const [keyData, user] = await Promise.all([ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(accountId, deviceNumber), ctx.indexedDB.clientDB.getUserByDevice(accountId, deviceNumber)]);
 	const publicKey = user?.clientNearPublicKey || "";
 	if (!keyData || !publicKey) throw new Error("Missing local key material for export. Re-register to upgrade vault.");
 	const response = await ctx.sendMessage({
@@ -3358,7 +3961,7 @@ async function exportNearKeypairUi({ ctx, nearAccountId, variant, theme, session
 			type: WorkerRequestType.DecryptPrivateKeyWithPrf,
 			payload: {
 				nearAccountId: accountId,
-				encryptedPrivateKeyData: keyData.encryptedData,
+				encryptedPrivateKeyData: keyData.encryptedSk,
 				encryptedPrivateKeyChacha20NonceB64u: keyData.chacha20NonceB64u
 			}
 		}
@@ -3371,7 +3974,6 @@ async function exportNearKeypairUi({ ctx, nearAccountId, variant, theme, session
 	}
 	const privateKey = response.payload.privateKey;
 	const showReq = {
-		schemaVersion: 2,
 		requestId: sessionId,
 		type: SecureConfirmationType.SHOW_SECURE_PRIVATE_KEY_UI,
 		summary: {
@@ -3391,6 +3993,46 @@ async function exportNearKeypairUi({ ctx, nearAccountId, variant, theme, session
 	await runSecureConfirm(ctx, showReq);
 }
 
+//#endregion
+//#region src/core/WebAuthnManager/SignerWorkerManager/handlers/deriveThresholdEd25519ClientVerifyingShare.ts
+async function deriveThresholdEd25519ClientVerifyingShare(args) {
+	const { ctx } = args;
+	const sessionId = args.sessionId;
+	const nearAccountId = args.nearAccountId;
+	try {
+		if (!sessionId) throw new Error("Missing sessionId");
+		if (!nearAccountId) throw new Error("Missing nearAccountId");
+		const response = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: WorkerRequestType.DeriveThresholdEd25519ClientVerifyingShare,
+				payload: { nearAccountId }
+			}
+		});
+		if (response.type !== WorkerResponseType.DeriveThresholdEd25519ClientVerifyingShareSuccess) throw new Error("DeriveThresholdEd25519ClientVerifyingShare failed");
+		const wasmResult = response.payload;
+		const clientVerifyingShareB64u = wasmResult?.clientVerifyingShareB64u;
+		const wrapKeySalt = wasmResult?.wrapKeySalt;
+		if (!clientVerifyingShareB64u) throw new Error("Missing clientVerifyingShareB64u in worker response");
+		if (!wrapKeySalt) throw new Error("Missing wrapKeySalt in worker response");
+		return {
+			success: true,
+			nearAccountId,
+			clientVerifyingShareB64u,
+			wrapKeySalt
+		};
+	} catch (error) {
+		const message = String(error?.message ?? error);
+		return {
+			success: false,
+			nearAccountId,
+			clientVerifyingShareB64u: "",
+			wrapKeySalt: "",
+			error: message
+		};
+	}
+}
+
 //#endregion
 //#region src/core/WebAuthnManager/SignerWorkerManager/index.ts
 /**
@@ -3406,15 +4048,17 @@ var SignerWorkerManager = class {
 	nearClient;
 	userPreferencesManager;
 	nonceManager;
+	relayerUrl;
 	workerBaseOrigin;
 	nearExplorerUrl;
-	constructor(vrfWorkerManager, nearClient, userPreferencesManager, nonceManager, rpIdOverride, enableSafariGetWebauthnRegistrationFallback = true, nearExplorerUrl) {
+	constructor(vrfWorkerManager, nearClient, userPreferencesManager, nonceManager, relayerUrl, rpIdOverride, enableSafariGetWebauthnRegistrationFallback = true, nearExplorerUrl) {
 		this.indexedDB = IndexedDBManager;
 		this.touchIdPrompt = new TouchIdPrompt(rpIdOverride, enableSafariGetWebauthnRegistrationFallback);
 		this.vrfWorkerManager = vrfWorkerManager;
 		this.nearClient = nearClient;
 		this.userPreferencesManager = userPreferencesManager;
 		this.nonceManager = nonceManager;
+		this.relayerUrl = relayerUrl;
 		this.nearExplorerUrl = nearExplorerUrl;
 	}
 	setWorkerBaseOrigin(origin) {
@@ -3430,7 +4074,8 @@ var SignerWorkerManager = class {
 			userPreferencesManager: this.userPreferencesManager,
 			nonceManager: this.nonceManager,
 			rpIdOverride: this.touchIdPrompt.getRpId(),
-			nearExplorerUrl: this.nearExplorerUrl
+			nearExplorerUrl: this.nearExplorerUrl,
+			relayerUrl: this.relayerUrl
 		};
 	}
 	createSecureWorker() {
@@ -3712,6 +4357,13 @@ var SignerWorkerManager = class {
 			...args
 		});
 	}
+	async deriveThresholdEd25519ClientVerifyingShare(args) {
+		return deriveThresholdEd25519ClientVerifyingShare({
+			ctx: this.getContext(),
+			sessionId: args.sessionId,
+			nearAccountId: String(args.nearAccountId)
+		});
+	}
 	/**
 	* Secure private key decryption with dual PRF
 	*/
@@ -3826,7 +4478,8 @@ async function checkVrfStatus(ctx) {
 	} catch {
 		return {
 			active: false,
-			nearAccountId: null
+			nearAccountId: null,
+			vrfPublicKey: null
 		};
 	}
 	try {
@@ -3842,18 +4495,21 @@ async function checkVrfStatus(ctx) {
 			return {
 				active: data.active,
 				nearAccountId: current ? toAccountId(current) : null,
-				sessionDuration: data.sessionDuration
+				sessionDuration: data.sessionDuration,
+				vrfPublicKey: data.vrfPublicKey ?? null
 			};
 		}
 		return {
 			active: false,
-			nearAccountId: null
+			nearAccountId: null,
+			vrfPublicKey: null
 		};
 	} catch (error) {
 		console.warn("VRF Manager: Failed to get VRF status:", error);
 		return {
 			active: false,
-			nearAccountId: null
+			nearAccountId: null,
+			vrfPublicKey: null
 		};
 	}
 }
@@ -3965,7 +4621,7 @@ async function confirmAndDeriveDevice2RegistrationSession(ctx, params) {
 /**
 * Kick off the SecureConfirm signing flow inside the VRF worker.
 *
-* This creates a schemaVersion=2 `SecureConfirmRequest` (tx / delegate / NEP-413) and sends it to the
+* This creates a `SecureConfirmRequest` (tx / delegate / NEP-413) and sends it to the
 * VRF worker, which will render UI, collect a WebAuthn credential when needed, and return the
 * `transactionContext` (reserved nonces, block hash/height) needed by the signer worker.
 */
@@ -3989,14 +4645,15 @@ async function confirmAndPrepareSigningSession(handlerCtx, params) {
 				...params.body != null ? { body: params.body } : {}
 			};
 			request = {
-				schemaVersion: 2,
 				requestId: sessionId,
 				type: SecureConfirmationType.SIGN_TRANSACTION,
 				summary,
 				payload: {
 					txSigningRequests,
 					intentDigest,
-					rpcCall: params.rpcCall
+					rpcCall: params.rpcCall,
+					...params.sessionPolicyDigest32 ? { sessionPolicyDigest32: params.sessionPolicyDigest32 } : {},
+					...params.signingAuthMode ? { signingAuthMode: params.signingAuthMode } : {}
 				},
 				confirmationConfig: params.confirmationConfigOverride,
 				intentDigest
@@ -4027,14 +4684,15 @@ async function confirmAndPrepareSigningSession(handlerCtx, params) {
 				}
 			};
 			request = {
-				schemaVersion: 2,
 				requestId: sessionId,
 				type: SecureConfirmationType.SIGN_TRANSACTION,
 				summary,
 				payload: {
 					txSigningRequests,
 					intentDigest,
-					rpcCall: params.rpcCall
+					rpcCall: params.rpcCall,
+					...params.sessionPolicyDigest32 ? { sessionPolicyDigest32: params.sessionPolicyDigest32 } : {},
+					...params.signingAuthMode ? { signingAuthMode: params.signingAuthMode } : {}
 				},
 				confirmationConfig: params.confirmationConfigOverride,
 				intentDigest
@@ -4051,7 +4709,6 @@ async function confirmAndPrepareSigningSession(handlerCtx, params) {
 				...params.body != null ? { body: params.body } : {}
 			};
 			request = {
-				schemaVersion: 2,
 				requestId: sessionId,
 				type: SecureConfirmationType.SIGN_NEP413_MESSAGE,
 				summary,
@@ -4059,8 +4716,10 @@ async function confirmAndPrepareSigningSession(handlerCtx, params) {
 					nearAccountId: params.nearAccountId,
 					message: params.message,
 					recipient: params.recipient,
+					...params.sessionPolicyDigest32 ? { sessionPolicyDigest32: params.sessionPolicyDigest32 } : {},
 					...params.contractId ? { contractId: params.contractId } : {},
-					...params.nearRpcUrl ? { nearRpcUrl: params.nearRpcUrl } : {}
+					...params.nearRpcUrl ? { nearRpcUrl: params.nearRpcUrl } : {},
+					...params.signingAuthMode ? { signingAuthMode: params.signingAuthMode } : {}
 				},
 				confirmationConfig: params.confirmationConfigOverride,
 				intentDigest
@@ -4084,7 +4743,8 @@ async function confirmAndPrepareSigningSession(handlerCtx, params) {
 		sessionId,
 		transactionContext: decision.transaction_context,
 		intentDigest: decision.intent_digest || intentDigest,
-		credential: decision.credential
+		credential: decision.credential,
+		vrfChallenge: decision.vrf_challenge
 	};
 }
 function computeTotalAmountYocto(txSigningRequests) {
@@ -4108,31 +4768,6 @@ function computeTotalAmountYocto(txSigningRequests) {
 	}
 }
 
-//#endregion
-//#region src/core/WebAuthnManager/VrfWorkerManager/handlers/createSigningSessionChannel.ts
-/**
-* Create a VRF-owned MessageChannel for signing and return the signer-facing port.
-* VRF retains the sibling port for WrapKeySeed delivery.
-*
-* This is the first step in the VRF ↔ Signer "warm session" handshake:
-* - transfer Port1 to the VRF worker (sender),
-* - return Port2 so the caller can transfer it to the signer worker (receiver).
-*/
-async function createSigningSessionChannel(ctx, sessionId) {
-	await ctx.ensureWorkerReady(true);
-	const channel = new MessageChannel();
-	try {
-		ctx.postToWorker({
-			type: WorkerControlMessage.ATTACH_WRAP_KEY_SEED_PORT,
-			sessionId
-		}, [channel.port1]);
-	} catch (err) {
-		console.error("[VrfWorkerManager] Failed to attach WrapKeySeed port to VRF worker", err);
-		throw err;
-	}
-	return channel.port2;
-}
-
 //#endregion
 //#region src/core/WebAuthnManager/VrfWorkerManager/handlers/deriveVrfKeypairFromPrf.ts
 /**
@@ -4154,7 +4789,9 @@ async function deriveVrfKeypairFromPrf(ctx, args) {
 				userId: vrfInputData.userId,
 				rpId: vrfInputData.rpId,
 				blockHeight: String(vrfInputData.blockHeight),
-				blockHash: vrfInputData.blockHash
+				blockHash: vrfInputData.blockHash,
+				intentDigest: vrfInputData.intentDigest,
+				sessionPolicyDigest32: vrfInputData.sessionPolicyDigest32
 			} : void 0
 		}
 	};
@@ -4172,7 +4809,9 @@ async function deriveVrfKeypairFromPrf(ctx, args) {
 		userId: data.vrfChallengeData.userId,
 		rpId: data.vrfChallengeData.rpId,
 		blockHeight: data.vrfChallengeData.blockHeight,
-		blockHash: data.vrfChallengeData.blockHash
+		blockHash: data.vrfChallengeData.blockHash,
+		...data.vrfChallengeData.intentDigest ? { intentDigest: data.vrfChallengeData.intentDigest } : {},
+		...data.vrfChallengeData.sessionPolicyDigest32 ? { sessionPolicyDigest32: data.vrfChallengeData.sessionPolicyDigest32 } : {}
 	}) : null;
 	if (saveInMemory) {
 		ctx.setCurrentVrfAccountId(args.nearAccountId);
@@ -4250,6 +4889,30 @@ async function dispenseSessionKey(ctx, args) {
 	return response.data || { sessionId: args.sessionId };
 }
 
+//#endregion
+//#region src/core/WebAuthnManager/VrfWorkerManager/handlers/shamir3PassDecryptVrfKeypair.ts
+/**
+* Shamir 3-pass (client): decrypt/unlock a VRF keypair using a server-protected envelope.
+*
+* On success, the VRF keypair becomes active in the VRF worker and is bound (in TS state) to `nearAccountId`.
+*/
+async function shamir3PassDecryptVrfKeypair(ctx, args) {
+	await ctx.ensureWorkerReady(true);
+	const message = {
+		type: "SHAMIR3PASS_CLIENT_DECRYPT_VRF_KEYPAIR",
+		id: ctx.generateMessageId(),
+		payload: {
+			nearAccountId: args.nearAccountId,
+			kek_s_b64u: args.kek_s_b64u,
+			ciphertextVrfB64u: args.ciphertextVrfB64u,
+			keyId: args.serverKeyId
+		}
+	};
+	const response = await ctx.sendMessage(message);
+	if (response.success) ctx.setCurrentVrfAccountId(args.nearAccountId);
+	return response;
+}
+
 //#endregion
 //#region src/core/WebAuthnManager/VrfWorkerManager/handlers/generateVrfChallenge.ts
 /**
@@ -4271,6 +4934,7 @@ async function generateVrfChallengeOnce(ctx, inputData) {
 }
 async function generateVrfChallengeInternal(ctx, inputData, sessionId) {
 	await ctx.ensureWorkerReady(true);
+	await ensureVrfKeypairBoundToLastUser(ctx, inputData.userId);
 	const message = {
 		type: "GENERATE_VRF_CHALLENGE",
 		id: ctx.generateMessageId(),
@@ -4280,16 +4944,45 @@ async function generateVrfChallengeInternal(ctx, inputData, sessionId) {
 				userId: inputData.userId,
 				rpId: inputData.rpId,
 				blockHeight: String(inputData.blockHeight),
-				blockHash: inputData.blockHash
+				blockHash: inputData.blockHash,
+				intentDigest: inputData.intentDigest,
+				sessionPolicyDigest32: inputData.sessionPolicyDigest32
 			}
 		}
 	};
 	const response = await ctx.sendMessage(message);
 	if (!response.success || !response.data) throw new Error(`VRF challenge generation failed: ${response.error}`);
 	const data = response.data;
-	console.debug("VRF Manager: VRF challenge generated successfully");
 	return validateVRFChallenge(data);
 }
+async function ensureVrfKeypairBoundToLastUser(ctx, nearAccountId) {
+	const accountId = toAccountId(nearAccountId);
+	const { indexedDB: indexedDB$1 } = ctx.getContext();
+	const lastUser = await indexedDB$1.clientDB.getLastUser().catch(() => null);
+	if (!lastUser || toAccountId(lastUser.nearAccountId) !== accountId) return;
+	const lastUserDeviceNumber = Number(lastUser.deviceNumber);
+	if (!Number.isFinite(lastUserDeviceNumber) || lastUserDeviceNumber < 1) return;
+	const status = await checkVrfStatus(ctx);
+	const currentVrfPublicKey = toTrimmedString(status.vrfPublicKey);
+	const authenticators = await indexedDB$1.clientDB.getAuthenticatorsByUser(accountId).catch(() => []);
+	const expectedVrfPublicKey = toTrimmedString(authenticators.find((a) => a.credentialId === lastUser.passkeyCredential.rawId)?.vrfPublicKey ?? authenticators.find((a) => a.deviceNumber === lastUserDeviceNumber)?.vrfPublicKey);
+	const needsRebind = !status.active || expectedVrfPublicKey && currentVrfPublicKey !== expectedVrfPublicKey;
+	if (!needsRebind) return;
+	const shamir = lastUser.serverEncryptedVrfKeypair;
+	if (!shamir?.ciphertextVrfB64u || !shamir?.kek_s_b64u || !shamir?.serverKeyId) throw new Error("VRF session is not bound to the last logged-in passkey device. Please log in again on this device.");
+	const unlock = await shamir3PassDecryptVrfKeypair(ctx, {
+		nearAccountId: accountId,
+		ciphertextVrfB64u: shamir.ciphertextVrfB64u,
+		kek_s_b64u: shamir.kek_s_b64u,
+		serverKeyId: shamir.serverKeyId
+	});
+	if (!unlock.success) throw new Error(unlock.error || "Failed to rebind VRF keypair to the last logged-in device");
+	if (expectedVrfPublicKey) {
+		const rebound = await checkVrfStatus(ctx);
+		const reboundPk = toTrimmedString(rebound.vrfPublicKey);
+		if (!rebound.active || reboundPk !== expectedVrfPublicKey) throw new Error("VRF session mismatch: VRF keypair did not match the last logged-in device after rebind. Please log in again.");
+	}
+}
 
 //#endregion
 //#region src/core/WebAuthnManager/VrfWorkerManager/handlers/generateVrfKeypairBootstrap.ts
@@ -4313,7 +5006,9 @@ async function generateVrfKeypairBootstrap(ctx, args) {
 					userId: args.vrfInputData.userId,
 					rpId: args.vrfInputData.rpId,
 					blockHeight: String(args.vrfInputData.blockHeight),
-					blockHash: args.vrfInputData.blockHash
+					blockHash: args.vrfInputData.blockHash,
+					intentDigest: args.vrfInputData.intentDigest,
+					sessionPolicyDigest32: args.vrfInputData.sessionPolicyDigest32
 				} : void 0
 			}
 		};
@@ -4335,7 +5030,9 @@ async function generateVrfKeypairBootstrap(ctx, args) {
 				userId: challengeData.userId,
 				rpId: challengeData.rpId,
 				blockHeight: challengeData.blockHeight,
-				blockHash: challengeData.blockHash
+				blockHash: challengeData.blockHash,
+				...challengeData.intentDigest ? { intentDigest: challengeData.intentDigest } : {},
+				...challengeData.sessionPolicyDigest32 ? { sessionPolicyDigest32: challengeData.sessionPolicyDigest32 } : {}
 			})
 		};
 	} catch (error) {
@@ -4426,7 +5123,6 @@ async function requestRegistrationCredentialConfirmation$1({ ctx, nearAccountId,
 	const title = confirmerText?.title;
 	const body = confirmerText?.body;
 	const request = {
-		schemaVersion: 2,
 		requestId,
 		type: SecureConfirmationType.REGISTER_ACCOUNT,
 		summary: {
@@ -4465,49 +5161,25 @@ async function requestRegistrationCredentialConfirmation$1({ ctx, nearAccountId,
 /**
 * Kick off the SecureConfirm UI flow for account registration and return the confirmed decision.
 *
-* This is used when the host (main thread) needs a registration credential + VRF challenge + NEAR context,
-* but the UI/confirmation orchestration lives in the VRF worker confirmation flow.
-*/
-async function requestRegistrationCredentialConfirmation(ctx, params) {
-	const hostCtx = ctx.getContext();
-	const decision = await requestRegistrationCredentialConfirmation$1({
-		ctx: hostCtx,
-		nearAccountId: params.nearAccountId,
-		deviceNumber: params.deviceNumber,
-		confirmerText: params.confirmerText,
-		contractId: params.contractId,
-		nearRpcUrl: params.nearRpcUrl,
-		confirmationConfig: params.confirmationConfigOverride
-	});
-	if (!decision.confirmed) throw new Error(decision.error || "User rejected registration request");
-	if (!decision.credential) throw new Error("Missing credential from registration confirmation");
-	if (!decision.vrfChallenge) throw new Error("Missing vrfChallenge from registration confirmation");
-	if (!decision.transactionContext) throw new Error("Missing transactionContext from registration confirmation");
-	return decision;
-}
-
-//#endregion
-//#region src/core/WebAuthnManager/VrfWorkerManager/handlers/shamir3PassDecryptVrfKeypair.ts
-/**
-* Shamir 3-pass (client): decrypt/unlock a VRF keypair using a server-protected envelope.
-*
-* On success, the VRF keypair becomes active in the VRF worker and is bound (in TS state) to `nearAccountId`.
-*/
-async function shamir3PassDecryptVrfKeypair(ctx, args) {
-	await ctx.ensureWorkerReady(true);
-	const message = {
-		type: "SHAMIR3PASS_CLIENT_DECRYPT_VRF_KEYPAIR",
-		id: ctx.generateMessageId(),
-		payload: {
-			nearAccountId: args.nearAccountId,
-			kek_s_b64u: args.kek_s_b64u,
-			ciphertextVrfB64u: args.ciphertextVrfB64u,
-			keyId: args.serverKeyId
-		}
-	};
-	const response = await ctx.sendMessage(message);
-	if (response.success) ctx.setCurrentVrfAccountId(args.nearAccountId);
-	return response;
+* This is used when the host (main thread) needs a registration credential + VRF challenge + NEAR context,
+* but the UI/confirmation orchestration lives in the VRF worker confirmation flow.
+*/
+async function requestRegistrationCredentialConfirmation(ctx, params) {
+	const hostCtx = ctx.getContext();
+	const decision = await requestRegistrationCredentialConfirmation$1({
+		ctx: hostCtx,
+		nearAccountId: params.nearAccountId,
+		deviceNumber: params.deviceNumber,
+		confirmerText: params.confirmerText,
+		contractId: params.contractId,
+		nearRpcUrl: params.nearRpcUrl,
+		confirmationConfig: params.confirmationConfigOverride
+	});
+	if (!decision.confirmed) throw new Error(decision.error || "User rejected registration request");
+	if (!decision.credential) throw new Error("Missing credential from registration confirmation");
+	if (!decision.vrfChallenge) throw new Error("Missing vrfChallenge from registration confirmation");
+	if (!decision.transactionContext) throw new Error("Missing transactionContext from registration confirmation");
+	return decision;
 }
 
 //#endregion
@@ -4632,7 +5304,41 @@ var VrfWorkerManager = class {
 	* VRF retains the sibling port for WrapKeySeed delivery.
 	*/
 	async createSigningSessionChannel(sessionId) {
-		return createSigningSessionChannel(this.getHandlerContext(), sessionId);
+		await this.ensureWorkerReady(true);
+		if (!this.vrfWorker) throw new Error("VRF Web Worker not available");
+		const channel = new MessageChannel();
+		const ackPromise = new Promise((resolve, reject) => {
+			const worker = this.vrfWorker;
+			const timeout = setTimeout(() => {
+				cleanup();
+				reject(/* @__PURE__ */ new Error(`Timeout waiting for VRF WrapKeySeed port attach for session ${sessionId}`));
+			}, 2e3);
+			const onMessage = (event) => {
+				const msg = event?.data;
+				if (!msg || typeof msg.type !== "string") return;
+				if (msg.sessionId !== sessionId) return;
+				if (msg.type === WorkerControlMessage.ATTACH_WRAP_KEY_SEED_PORT_ERROR) {
+					cleanup();
+					reject(new Error(String(msg.error || "VRF worker failed to attach WrapKeySeed port")));
+					return;
+				}
+				if (msg.type === WorkerControlMessage.ATTACH_WRAP_KEY_SEED_PORT_OK) {
+					cleanup();
+					resolve();
+				}
+			};
+			const cleanup = () => {
+				clearTimeout(timeout);
+				worker.removeEventListener("message", onMessage);
+			};
+			worker.addEventListener("message", onMessage);
+		});
+		this.vrfWorker.postMessage({
+			type: WorkerControlMessage.ATTACH_WRAP_KEY_SEED_PORT,
+			sessionId
+		}, [channel.port1]);
+		await ackPromise;
+		return channel.port2;
 	}
 	/**
 	* Derive WrapKeySeed in the VRF worker and deliver it (along with PRF.second if credential provided)
@@ -4929,9 +5635,13 @@ var VrfWorkerManager = class {
 var UserPreferencesManager = class {
 	themeChangeListeners = /* @__PURE__ */ new Set();
 	confirmationConfigChangeListeners = /* @__PURE__ */ new Set();
+	signerModeChangeListeners = /* @__PURE__ */ new Set();
 	currentUserAccountId;
 	confirmationConfig = DEFAULT_CONFIRMATION_CONFIG;
+	signerMode = DEFAULT_SIGNING_MODE;
 	walletThemeOverride = null;
+	signerModeOverride = null;
+	walletIframeSignerModeWriter = null;
 	envThemeSyncedForSession = false;
 	constructor() {
 		this.subscribeToIndexedDBChanges();
@@ -4957,6 +5667,26 @@ var UserPreferencesManager = class {
 		}
 	}
 	/**
+	* Apply an app-provided default signer mode (e.g., `configs.signerMode`) without
+	* persisting it as a per-user preference in IndexedDB.
+	*/
+	configureDefaultSignerMode(signerMode) {
+		const next = coerceSignerMode(signerMode, DEFAULT_SIGNING_MODE);
+		this.signerModeOverride = next;
+		if (!this.currentUserAccountId) this.setSignerModeInternal(next, {
+			persist: false,
+			notify: true
+		});
+	}
+	/**
+	* In wallet-iframe mode on the app origin, user preferences must be persisted by the wallet host
+	* (not the app origin). This configures a best-effort writer used by `setSignerMode(...)` when
+	* IndexedDB is disabled.
+	*/
+	configureWalletIframeSignerModeWriter(writer) {
+		this.walletIframeSignerModeWriter = writer;
+	}
+	/**
 	* Register a callback for theme change events
 	*/
 	onThemeChange(callback) {
@@ -4976,6 +5706,15 @@ var UserPreferencesManager = class {
 		};
 	}
 	/**
+	* Register a callback for signer mode changes.
+	*/
+	onSignerModeChange(callback) {
+		this.signerModeChangeListeners.add(callback);
+		return () => {
+			this.signerModeChangeListeners.delete(callback);
+		};
+	}
+	/**
 	* Notify all registered listeners of theme changes
 	*/
 	notifyThemeChange(theme) {
@@ -4983,21 +5722,15 @@ var UserPreferencesManager = class {
 			console.debug(`[UserPreferencesManager]: No listeners registered, theme change will not propagate.`);
 			return;
 		}
-		let index = 0;
-		this.themeChangeListeners.forEach((listener) => {
-			index++;
-			try {
-				listener(theme);
-			} catch (error) {}
-		});
+		for (const listener of this.themeChangeListeners) listener(theme);
 	}
 	notifyConfirmationConfigChange(config) {
 		if (this.confirmationConfigChangeListeners.size === 0) return;
-		this.confirmationConfigChangeListeners.forEach((listener) => {
-			try {
-				listener(config);
-			} catch {}
-		});
+		for (const listener of this.confirmationConfigChangeListeners) listener(config);
+	}
+	notifySignerModeChange(mode) {
+		if (this.signerModeChangeListeners.size === 0) return;
+		for (const listener of this.signerModeChangeListeners) listener(mode);
 	}
 	/**
 	* Best-effort async initialization from IndexedDB.
@@ -5006,18 +5739,18 @@ var UserPreferencesManager = class {
 	* app-origin IndexedDB (wallet-iframe mode) can skip it entirely.
 	*/
 	async initFromIndexedDB() {
-		try {
-			await this.loadUserSettings();
-		} catch (error) {
+		await this.loadUserSettings().catch((error) => {
 			console.warn("[WebAuthnManager]: Failed to initialize user settings:", error);
-		}
+		});
 	}
 	/**
 	* Subscribe to IndexedDB change events for automatic synchronization
 	*/
 	subscribeToIndexedDBChanges() {
 		this.unsubscribeFromIndexedDB = IndexedDBManager.clientDB.onChange((event) => {
-			this.handleIndexedDBEvent(event);
+			this.handleIndexedDBEvent(event).catch((error) => {
+				console.warn("[WebAuthnManager]: Error handling IndexedDB event:", error);
+			});
 		});
 	}
 	/**
@@ -5025,23 +5758,19 @@ var UserPreferencesManager = class {
 	* @param event - The IndexedDBEvent: `user-updated`, `preferences-updated`, `user-deleted` to handle.
 	*/
 	async handleIndexedDBEvent(event) {
-		try {
-			switch (event.type) {
-				case "preferences-updated":
-					if (event.accountId === this.currentUserAccountId) await this.reloadUserSettings();
-					break;
-				case "user-updated":
-					if (event.accountId === this.currentUserAccountId) await this.reloadUserSettings();
-					break;
-				case "user-deleted":
-					if (event.accountId === this.currentUserAccountId) {
-						this.currentUserAccountId = void 0;
-						this.confirmationConfig = DEFAULT_CONFIRMATION_CONFIG;
-					}
-					break;
-			}
-		} catch (error) {
-			console.warn("[WebAuthnManager]: Error handling IndexedDB event:", error);
+		switch (event.type) {
+			case "preferences-updated":
+				if (event.accountId === this.currentUserAccountId) await this.reloadUserSettings();
+				break;
+			case "user-updated":
+				if (event.accountId === this.currentUserAccountId) await this.reloadUserSettings();
+				break;
+			case "user-deleted":
+				if (event.accountId === this.currentUserAccountId) {
+					this.currentUserAccountId = void 0;
+					this.confirmationConfig = DEFAULT_CONFIRMATION_CONFIG;
+				}
+				break;
 		}
 	}
 	/**
@@ -5056,8 +5785,10 @@ var UserPreferencesManager = class {
 			this.unsubscribeFromIndexedDB();
 			this.unsubscribeFromIndexedDB = void 0;
 		}
+		this.walletIframeSignerModeWriter = null;
 		this.themeChangeListeners.clear();
 		this.confirmationConfigChangeListeners.clear();
+		this.signerModeChangeListeners.clear();
 	}
 	getCurrentUserAccountId() {
 		if (!this.currentUserAccountId) {
@@ -5069,6 +5800,9 @@ var UserPreferencesManager = class {
 	getConfirmationConfig() {
 		return this.confirmationConfig;
 	}
+	getSignerMode() {
+		return this.signerMode;
+	}
 	/**
 	* Apply an authoritative confirmation config snapshot from the wallet-iframe host.
 	* This updates in-memory state only; persistence remains owned by the wallet origin.
@@ -5086,6 +5820,20 @@ var UserPreferencesManager = class {
 		this.notifyConfirmationConfigChange(this.confirmationConfig);
 		if (this.confirmationConfig.theme !== prevTheme) this.notifyThemeChange(this.confirmationConfig.theme);
 	}
+	/**
+	* Apply an authoritative signer mode snapshot from the wallet-iframe host.
+	* This updates in-memory state only; persistence remains owned by the wallet origin.
+	*/
+	applyWalletHostSignerMode(args) {
+		const { nearAccountId, signerMode } = args || {};
+		if (nearAccountId) this.currentUserAccountId = nearAccountId;
+		const base$1 = this.signerModeOverride ?? DEFAULT_SIGNING_MODE;
+		const next = coerceSignerMode(signerMode, base$1);
+		this.setSignerModeInternal(next, {
+			persist: false,
+			notify: true
+		});
+	}
 	setCurrentUser(nearAccountId) {
 		this.currentUserAccountId = nearAccountId;
 		if (!IndexedDBManager.clientDB.isDisabled()) this.loadSettingsForUser(nearAccountId).catch(() => void 0);
@@ -5117,6 +5865,13 @@ var UserPreferencesManager = class {
 			this.notifyConfirmationConfigChange(this.confirmationConfig);
 			if (this.confirmationConfig.theme !== prevTheme) this.notifyThemeChange(this.confirmationConfig.theme);
 		}
+		const base$1 = this.signerModeOverride ?? DEFAULT_SIGNING_MODE;
+		const stored = user?.preferences?.signerMode;
+		const nextSignerMode = stored != null ? coerceSignerMode(stored, base$1) : base$1;
+		this.setSignerModeInternal(nextSignerMode, {
+			persist: false,
+			notify: true
+		});
 	}
 	/**
 	* Reload current user settings from IndexedDB
@@ -5165,6 +5920,13 @@ var UserPreferencesManager = class {
 				this.notifyConfirmationConfigChange(this.confirmationConfig);
 				if (this.confirmationConfig.theme !== prevTheme) this.notifyThemeChange(this.confirmationConfig.theme);
 			} else console.debug("[WebAuthnManager]: No user preferences found, using defaults");
+			const base$1 = this.signerModeOverride ?? DEFAULT_SIGNING_MODE;
+			const stored = user?.preferences?.signerMode;
+			const nextSignerMode = stored != null ? coerceSignerMode(stored, base$1) : base$1;
+			this.setSignerModeInternal(nextSignerMode, {
+				persist: false,
+				notify: true
+			});
 		} else console.debug("[WebAuthnManager]: No last user found, using default settings");
 	}
 	/**
@@ -5220,6 +5982,35 @@ var UserPreferencesManager = class {
 			console.warn("[UserPreferencesManager]: Failed to save user theme:", error);
 		}
 	}
+	/**
+	* Set signer mode preference (in-memory immediately; IndexedDB persistence is best-effort).
+	*/
+	setSignerMode(signerMode) {
+		const next = mergeSignerMode(this.signerMode, signerMode);
+		if (this.walletIframeSignerModeWriter && IndexedDBManager.clientDB.isDisabled()) {
+			this.walletIframeSignerModeWriter(next).catch(() => void 0);
+			return;
+		}
+		this.setSignerModeInternal(next, {
+			persist: true,
+			notify: true
+		});
+	}
+	isSignerModeEqual(a, b) {
+		if (a.mode !== b.mode) return false;
+		if (a.mode !== "threshold-signer" || b.mode !== "threshold-signer") return true;
+		return (a.behavior ?? null) === (b.behavior ?? null);
+	}
+	setSignerModeInternal(next, opts) {
+		const prev = this.signerMode;
+		this.signerMode = next;
+		if (opts.notify && !this.isSignerModeEqual(prev, next)) this.notifySignerModeChange(next);
+		if (opts.persist) {
+			const id = this.currentUserAccountId;
+			if (!id || IndexedDBManager.clientDB.isDisabled()) return;
+			IndexedDBManager.clientDB.setSignerMode(id, next).catch(() => void 0);
+		}
+	}
 };
 const UserPreferencesInstance = new UserPreferencesManager();
 var userPreferences_default = UserPreferencesInstance;
@@ -5367,10 +6158,8 @@ var NonceManager = class NonceManager {
 					} catch (akErr) {
 						const msg = errorMessage(akErr);
 						const missingAk = msg.includes("does not exist while viewing") || msg.includes("Access key not found") || msg.includes("unknown public key") || msg.includes("does not exist");
-						if (missingAk) {
-							console.debug("[NonceManager]: Access key missing during fetch; proceeding with block-only context");
-							maybeAccessKey = null;
-						} else accessKeyError = akErr;
+						if (missingAk) maybeAccessKey = null;
+						else accessKeyError = akErr;
 					}
 				})());
 				if (fetchBlock) tasks.push((async () => {
@@ -5480,7 +6269,6 @@ var NonceManager = class NonceManager {
 		for (const n of planned) newSet.add(n);
 		this.reservedNonces = newSet;
 		this.lastReservedNonce = planned[planned.length - 1];
-		console.debug(`[NonceManager]: Reserved ${count} nonces:`, planned);
 		return planned;
 	}
 	/**
@@ -5488,19 +6276,15 @@ var NonceManager = class NonceManager {
 	* @param nonce - The nonce to release
 	*/
 	releaseNonce(nonce) {
-		if (this.reservedNonces.has(nonce)) {
-			this.reservedNonces.delete(nonce);
-			console.debug(`[NonceManager]: Released nonce ${nonce}`);
-		}
+		if (this.reservedNonces.has(nonce)) this.reservedNonces.delete(nonce);
 	}
 	/**
 	* Release all reserved nonces
 	*/
 	releaseAllNonces() {
-		const count = this.reservedNonces.size;
+		this.reservedNonces.size;
 		this.reservedNonces.clear();
 		this.lastReservedNonce = null;
-		console.debug(`[NonceManager]: Released all ${count} reserved nonces`);
 	}
 	/**
 	* Update nonce from blockchain after transaction completion
@@ -5515,7 +6299,7 @@ var NonceManager = class NonceManager {
 			if (!accessKeyInfo || accessKeyInfo.nonce === void 0) throw new Error(`Access key not found or invalid for account ${this.nearAccountId}`);
 			const chainNonceBigInt = BigInt(accessKeyInfo.nonce);
 			const actualNonceBigInt = BigInt(actualNonce);
-			if (chainNonceBigInt < actualNonceBigInt - BigInt(1)) console.warn(`[NonceManager]: Chain nonce (${chainNonceBigInt}) behind expected (${actualNonceBigInt - BigInt(1)}). Proceeding with tolerant update.`);
+			if (chainNonceBigInt < actualNonceBigInt - BigInt(1)) console.warn(`[NonceManager]: Chain nonce (${chainNonceBigInt}) behind expected (${actualNonceBigInt - BigInt(1)}). Updating...`);
 			const candidateNext = this.maxBigInt(chainNonceBigInt + 1n, actualNonceBigInt + 1n, this.transactionContext?.nextNonce ? BigInt(this.transactionContext.nextNonce) : 0n, this.lastReservedNonce ? BigInt(this.lastReservedNonce) + 1n : 0n);
 			if (this.transactionContext) {
 				this.transactionContext.accessKeyInfo = accessKeyInfo;
@@ -5620,10 +6404,221 @@ const NonceManagerInstance = NonceManager.getInstance();
 var nonceManager_default = NonceManagerInstance;
 
 //#endregion
-//#region src/core/WalletIframe/host-mode.ts
-let IS_WALLET_IFRAME_HOST = false;
-function __isWalletIframeHostMode() {
-	return IS_WALLET_IFRAME_HOST;
+//#region src/core/WebAuthnManager/threshold/enrollThresholdEd25519Key.ts
+/**
+* Threshold keygen helper (2-of-2):
+* - derive deterministic client verifying share from WrapKeySeed (via signer worker session)
+* - run `/threshold-ed25519/keygen` to fetch relayer share + group public key
+*/
+async function enrollThresholdEd25519KeyHandler(ctx, args) {
+	const nearAccountId = toAccountId(args.nearAccountId);
+	const sessionId = String(args.sessionId || "").trim();
+	const relayerUrl = String(ctx.relayerUrl || "").trim();
+	try {
+		if (!sessionId) throw new Error("Missing sessionId");
+		if (!relayerUrl) throw new Error("Missing relayer url (configs.relayer.url)");
+		const derived = await ctx.signerWorkerManager.deriveThresholdEd25519ClientVerifyingShare({
+			sessionId,
+			nearAccountId
+		});
+		if (!derived.success) throw new Error(derived.error || "Failed to derive threshold client verifying share");
+		const rpId = ctx.touchIdPrompt.getRpId();
+		if (!rpId) throw new Error("Missing rpId for WebAuthn VRF challenge");
+		const keygenIntentDigestB64u = await computeThresholdEd25519KeygenIntentDigest({
+			nearAccountId,
+			rpId,
+			clientVerifyingShareB64u: derived.clientVerifyingShareB64u
+		});
+		const block = await ctx.nearClient.viewBlock({ finality: "final" });
+		const blockHeight = String(block?.header?.height ?? "");
+		const blockHash = String(block?.header?.hash ?? "");
+		if (!blockHeight || !blockHash) throw new Error("Failed to fetch NEAR block context for keygen VRF challenge");
+		const vrfChallenge = await ctx.vrfWorkerManager.generateVrfChallengeOnce({
+			userId: nearAccountId,
+			rpId,
+			blockHeight,
+			blockHash,
+			intentDigest: keygenIntentDigestB64u
+		});
+		const webauthnAuthentication = await collectAuthenticationCredentialForVrfChallenge({
+			indexedDB: IndexedDBManager,
+			touchIdPrompt: ctx.touchIdPrompt,
+			nearAccountId,
+			vrfChallenge
+		});
+		const keygen = await thresholdEd25519Keygen(relayerUrl, vrfChallenge, webauthnAuthentication, {
+			clientVerifyingShareB64u: derived.clientVerifyingShareB64u,
+			nearAccountId
+		});
+		if (!keygen.ok) throw new Error(keygen.error || keygen.message || keygen.code || "Threshold keygen failed");
+		const publicKeyRaw = keygen.publicKey;
+		const relayerKeyId = keygen.relayerKeyId;
+		const relayerVerifyingShareB64u = keygen.relayerVerifyingShareB64u;
+		if (!publicKeyRaw) throw new Error("Threshold keygen returned empty publicKey");
+		if (!relayerKeyId) throw new Error("Threshold keygen returned empty relayerKeyId");
+		if (!relayerVerifyingShareB64u) throw new Error("Threshold keygen returned empty relayerVerifyingShareB64u");
+		const publicKey = ensureEd25519Prefix(publicKeyRaw);
+		if (!publicKey) throw new Error("Threshold keygen returned empty publicKey");
+		const clientParticipantId = typeof keygen.clientParticipantId === "number" ? keygen.clientParticipantId : void 0;
+		const relayerParticipantId = typeof keygen.relayerParticipantId === "number" ? keygen.relayerParticipantId : void 0;
+		return {
+			success: true,
+			publicKey,
+			clientParticipantId,
+			relayerParticipantId,
+			participantIds: Array.isArray(keygen.participantIds) ? keygen.participantIds : void 0,
+			clientVerifyingShareB64u: derived.clientVerifyingShareB64u,
+			relayerKeyId,
+			relayerVerifyingShareB64u,
+			wrapKeySalt: derived.wrapKeySalt
+		};
+	} catch (error) {
+		const message = String(error?.message ?? error);
+		return {
+			success: false,
+			publicKey: "",
+			clientVerifyingShareB64u: "",
+			relayerKeyId: "",
+			relayerVerifyingShareB64u: "",
+			wrapKeySalt: "",
+			error: message
+		};
+	}
+}
+
+//#endregion
+//#region src/core/WebAuthnManager/threshold/rotateThresholdEd25519KeyPostRegistration.ts
+/**
+* Threshold key rotation (post-registration):
+* - keygen (new relayerKeyId + publicKey)
+* - AddKey(new threshold publicKey)
+* - DeleteKey(old threshold publicKey)
+*
+* Uses the local signer key for AddKey/DeleteKey, and requires the account to already
+* have a stored `threshold_ed25519_2p_v1` key material entry for the target device.
+*/
+async function rotateThresholdEd25519KeyPostRegistrationHandler(ctx, args) {
+	const nearAccountId = toAccountId(args.nearAccountId);
+	const oldPublicKey = String(args.oldPublicKey || "");
+	const oldRelayerKeyId = String(args.oldRelayerKeyId || "");
+	const newPublicKey = String(args.newPublicKey || "");
+	const newRelayerKeyId = String(args.newRelayerKeyId || "");
+	const wrapKeySalt = String(args.wrapKeySalt || "");
+	const base$1 = {
+		oldPublicKey,
+		oldRelayerKeyId,
+		publicKey: newPublicKey,
+		relayerKeyId: newRelayerKeyId,
+		wrapKeySalt
+	};
+	const ok = (params) => {
+		const { warning,...rest } = params;
+		return {
+			success: true,
+			...base$1,
+			...rest,
+			...warning ? { warning } : {}
+		};
+	};
+	try {
+		const deviceNumber = Number(args.deviceNumber);
+		const resolvedDeviceNumber = Number.isSafeInteger(deviceNumber) && deviceNumber >= 1 ? deviceNumber : NaN;
+		if (!Number.isSafeInteger(resolvedDeviceNumber) || resolvedDeviceNumber < 1) throw new Error("Invalid deviceNumber");
+		const oldNormalized = ensureEd25519Prefix(oldPublicKey);
+		const newNormalized = ensureEd25519Prefix(newPublicKey);
+		if (!oldNormalized) return ok({
+			deleteOldKeyAttempted: false,
+			deleteOldKeySuccess: false,
+			warning: "Rotation completed but old threshold key material had an invalid publicKey; skipped DeleteKey."
+		});
+		if (oldNormalized === newNormalized) return ok({
+			deleteOldKeyAttempted: false,
+			deleteOldKeySuccess: true,
+			warning: "Rotation returned the same threshold public key; skipped DeleteKey(old)."
+		});
+		const localKeyMaterial = await IndexedDBManager.nearKeysDB.getLocalKeyMaterial(nearAccountId, resolvedDeviceNumber);
+		if (!localKeyMaterial) return ok({
+			deleteOldKeyAttempted: false,
+			deleteOldKeySuccess: false,
+			warning: `Rotation completed but could not load local key material for DeleteKey(old) (account ${nearAccountId} device ${resolvedDeviceNumber}).`
+		});
+		const localPk = ensureEd25519Prefix(localKeyMaterial.publicKey);
+		if (localPk && localPk === oldNormalized) return ok({
+			deleteOldKeyAttempted: false,
+			deleteOldKeySuccess: false,
+			warning: "Refusing to DeleteKey(old) because it matches the local signer public key."
+		});
+		const oldOnChain = await hasAccessKey(ctx.nearClient, nearAccountId, oldPublicKey, {
+			attempts: 1,
+			delayMs: 0
+		});
+		if (!oldOnChain) return ok({
+			deleteOldKeyAttempted: false,
+			deleteOldKeySuccess: true
+		});
+		const deleteKeyAction = {
+			action_type: ActionType.DeleteKey,
+			public_key: oldNormalized
+		};
+		const txInputs = [{
+			receiverId: nearAccountId,
+			actions: [deleteKeyAction]
+		}];
+		let deleteOldKeyAttempted = false;
+		try {
+			const rpcCall = {
+				contractId: ctx.contractId,
+				nearRpcUrl: ctx.nearRpcUrl,
+				nearAccountId
+			};
+			const signed = await ctx.signTransactionsWithActions({
+				transactions: txInputs,
+				rpcCall,
+				signerMode: { mode: "local-signer" },
+				confirmationConfigOverride: {
+					uiMode: "skip",
+					behavior: "autoProceed",
+					autoProceedDelay: 0
+				},
+				title: "Rotate threshold key",
+				body: "Confirm deletion of the old threshold access key."
+			});
+			const signedTx = signed?.[0]?.signedTransaction;
+			if (!signedTx) throw new Error("Failed to sign DeleteKey(oldThresholdPublicKey) transaction");
+			deleteOldKeyAttempted = true;
+			await ctx.nearClient.sendTransaction(signedTx, DEFAULT_WAIT_STATUS.linkDeviceDeleteKey);
+			const deleted = await waitForAccessKeyAbsent(ctx.nearClient, nearAccountId, oldPublicKey);
+			if (!deleted) return ok({
+				deleteOldKeyAttempted,
+				deleteOldKeySuccess: false,
+				warning: "DeleteKey(old) submitted but old access key is still present on-chain."
+			});
+			return ok({
+				deleteOldKeyAttempted,
+				deleteOldKeySuccess: true
+			});
+		} catch (error) {
+			const message = String(error?.message ?? error);
+			return ok({
+				deleteOldKeyAttempted,
+				deleteOldKeySuccess: false,
+				warning: `Rotation completed but failed to DeleteKey(old): ${message}`
+			});
+		}
+	} catch (error) {
+		const message = String(error?.message ?? error);
+		return {
+			success: false,
+			oldPublicKey,
+			oldRelayerKeyId,
+			publicKey: "",
+			relayerKeyId: "",
+			wrapKeySalt: "",
+			deleteOldKeyAttempted: false,
+			deleteOldKeySuccess: false,
+			error: message
+		};
+	}
 }
 
 //#endregion
@@ -5652,9 +6647,8 @@ var WebAuthnManager = class {
 		this.nearClient = nearClient;
 		this.touchIdPrompt = new TouchIdPrompt(tatchiPasskeyConfigs.iframeWallet?.rpIdOverride, true);
 		this.userPreferencesManager = userPreferences_default;
-		try {
-			this.userPreferencesManager.configureWalletTheme?.(tatchiPasskeyConfigs.walletTheme);
-		} catch {}
+		this.userPreferencesManager.configureWalletTheme?.(tatchiPasskeyConfigs.walletTheme);
+		this.userPreferencesManager.configureDefaultSignerMode?.(tatchiPasskeyConfigs.signerMode);
 		this.nonceManager = nonceManager_default;
 		const { vrfWorkerConfigs } = tatchiPasskeyConfigs;
 		this.vrfWorkerManager = new VrfWorkerManager({
@@ -5671,7 +6665,7 @@ var WebAuthnManager = class {
 			rpIdOverride: this.touchIdPrompt.getRpId(),
 			nearExplorerUrl: tatchiPasskeyConfigs.nearExplorerUrl
 		});
-		this.signerWorkerManager = new SignerWorkerManager(this.vrfWorkerManager, nearClient, this.userPreferencesManager, this.nonceManager, tatchiPasskeyConfigs.iframeWallet?.rpIdOverride, true, tatchiPasskeyConfigs.nearExplorerUrl);
+		this.signerWorkerManager = new SignerWorkerManager(this.vrfWorkerManager, nearClient, this.userPreferencesManager, this.nonceManager, this.tatchiPasskeyConfigs.relayer.url, tatchiPasskeyConfigs.iframeWallet?.rpIdOverride, true, tatchiPasskeyConfigs.nearExplorerUrl);
 		this.workerBaseOrigin = resolveWorkerBaseOrigin() || (typeof window !== "undefined" ? window.location.origin : "");
 		this.signerWorkerManager.setWorkerBaseOrigin(this.workerBaseOrigin);
 		this.vrfWorkerManager.setWorkerBaseOrigin?.(this.workerBaseOrigin);
@@ -5753,7 +6747,7 @@ var WebAuthnManager = class {
 	}
 	async withSigningSession(args) {
 		if (typeof args.handler !== "function") throw new Error("withSigningSession requires a handler function");
-		const sessionId = (args.sessionId || "").trim() || (args.prefix ? this.generateSessionId(args.prefix) : "");
+		const sessionId = args.sessionId || (args.prefix ? this.generateSessionId(args.prefix) : "");
 		if (!sessionId) throw new Error("withSigningSession requires a sessionId or prefix");
 		return await this.withSigningSessionInternal({
 			sessionId,
@@ -5767,6 +6761,7 @@ var WebAuthnManager = class {
 		try {
 			if (args.options) await this.vrfWorkerManager.mintSessionKeysAndSendToSigner({
 				sessionId: args.sessionId,
+				wrapKeySalt: args.options.wrapKeySalt,
 				credential: args.options.credential
 			});
 			return await args.handler(args.sessionId);
@@ -5804,15 +6799,15 @@ var WebAuthnManager = class {
 		if (deviceNumber === null) throw new Error(`No deviceNumber found for account ${nearAccountId} (decrypt session)`);
 		const userForDevice = await IndexedDBManager.clientDB.getUserByDevice(nearAccountId, deviceNumber).catch(() => null);
 		const encryptedVrfKeypair = userForDevice?.encryptedVrfKeypair;
-		const encryptedKeyData = await IndexedDBManager.nearKeysDB.getEncryptedKey(nearAccountId, deviceNumber);
-		if (!encryptedKeyData) {
+		const keyMaterial = await IndexedDBManager.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber);
+		if (!keyMaterial) {
 			console.error("WebAuthnManager: No encrypted key found for decrypt session", {
 				nearAccountId: String(nearAccountId),
 				deviceNumber
 			});
-			throw new Error(`No encrypted key found for account: ${nearAccountId}`);
+			throw new Error(`No key material found for account: ${nearAccountId}`);
 		}
-		const wrapKeySalt = encryptedKeyData.wrapKeySalt || "";
+		const wrapKeySalt = keyMaterial.wrapKeySalt;
 		if (!wrapKeySalt) {
 			console.error("WebAuthnManager: Missing wrapKeySalt in vault for decrypt session", {
 				nearAccountId: String(nearAccountId),
@@ -5843,6 +6838,16 @@ var WebAuthnManager = class {
 			allowCredentials
 		});
 	}
+	async collectAuthenticationCredentialForVrfChallenge(args) {
+		return collectAuthenticationCredentialForVrfChallenge({
+			indexedDB: IndexedDBManager,
+			touchIdPrompt: this.touchIdPrompt,
+			nearAccountId: args.nearAccountId,
+			vrfChallenge: args.vrfChallenge,
+			includeSecondPrfOutput: args.includeSecondPrfOutput,
+			onBeforePrompt: args.onBeforePrompt
+		});
+	}
 	/**
 	* Generate a VRF challenge bound to a specific signing/confirm session.
 	* The challenge will be cached in the VRF worker under this sessionId so
@@ -5914,9 +6919,9 @@ var WebAuthnManager = class {
 		const contractId = this.tatchiPasskeyConfigs.contractId;
 		try {
 			const sessionId = `device2-sign-${Date.now()}-${Math.random().toString(36).slice(2, 11)}`;
-			const encryptedKeyData = await IndexedDBManager.nearKeysDB.getEncryptedKey(nearAccountId, deviceNumber);
-			if (!encryptedKeyData) throw new Error(`No encrypted key found for account ${nearAccountId} device ${deviceNumber}`);
-			const wrapKeySalt = encryptedKeyData.wrapKeySalt;
+			const keyMaterial = await IndexedDBManager.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber);
+			if (!keyMaterial) throw new Error(`No key material found for account ${nearAccountId} device ${deviceNumber}`);
+			const wrapKeySalt = keyMaterial.wrapKeySalt;
 			if (!wrapKeySalt) throw new Error(`Missing wrapKeySalt for account ${nearAccountId} device ${deviceNumber}`);
 			const signerPort = await this.vrfWorkerManager.createSigningSessionChannel(sessionId);
 			await this.signerWorkerManager.reserveSignerWorkerSession(sessionId, { signerPort });
@@ -6079,10 +7084,28 @@ var WebAuthnManager = class {
 		const vrfStatus = await this.vrfWorkerManager.checkVrfStatus();
 		if (!vrfStatus.active) throw new Error("VRF keypair not active in memory. Please log in again.");
 		if (!vrfStatus.nearAccountId || String(vrfStatus.nearAccountId) !== String(nearAccountId)) throw new Error("VRF keypair active but bound to a different account. Please log in again.");
-		const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, IndexedDBManager.clientDB);
-		const encryptedKeyData = await IndexedDBManager.nearKeysDB.getEncryptedKey(nearAccountId, deviceNumber);
-		if (!encryptedKeyData) throw new Error(`No encrypted key found for account ${nearAccountId} device ${deviceNumber}`);
-		const wrapKeySalt = encryptedKeyData.wrapKeySalt || "";
+		const credentialRawId = String(args.credential?.rawId || "").trim();
+		const authenticators = await this.getAuthenticatorsByUser(nearAccountId).catch(() => []);
+		let deviceNumber;
+		try {
+			deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, IndexedDBManager.clientDB);
+		} catch (err) {
+			if (credentialRawId) {
+				const matched = authenticators.find((a) => a.credentialId === credentialRawId);
+				const inferred = matched && typeof matched.deviceNumber === "number" && Number.isFinite(matched.deviceNumber) ? matched.deviceNumber : null;
+				if (inferred !== null) {
+					deviceNumber = inferred;
+					await this.setLastUser(nearAccountId, inferred).catch(() => void 0);
+				} else throw err;
+			} else throw err;
+		}
+		if (credentialRawId && authenticators.length > 1) {
+			const { wrongPasskeyError } = await IndexedDBManager.clientDB.ensureCurrentPasskey(nearAccountId, authenticators, credentialRawId);
+			if (wrongPasskeyError) throw new Error(wrongPasskeyError);
+		}
+		const keyMaterial = await IndexedDBManager.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber);
+		if (!keyMaterial) throw new Error(`No key material found for account ${nearAccountId} device ${deviceNumber}`);
+		const wrapKeySalt = keyMaterial.wrapKeySalt;
 		if (!wrapKeySalt) throw new Error("Missing wrapKeySalt in vault; re-register to upgrade vault format.");
 		const { ttlMs, remainingUses } = this.resolveSigningSessionPolicy(args);
 		await this.vrfWorkerManager.mintSessionKeysAndSendToSigner({
@@ -6287,14 +7310,13 @@ var WebAuthnManager = class {
 	* @param onEvent: Optional callback for progress updates during signing
 	* @param onEvent - Optional callback for progress updates during signing
 	*/
-	async signTransactionsWithActions({ transactions, rpcCall, confirmationConfigOverride, title, body, onEvent }) {
-		if (transactions.length === 0) throw new Error("No payloads provided for signing");
-		const activeSessionId = this.getOrCreateActiveSigningSessionId(toAccountId(rpcCall.nearAccountId));
+	async signTransactionsWithActions({ transactions, rpcCall, signerMode, confirmationConfigOverride, title, body, onEvent }) {
 		return this.withSigningSession({
-			sessionId: activeSessionId,
+			sessionId: this.getOrCreateActiveSigningSessionId(toAccountId(rpcCall.nearAccountId)),
 			handler: (sessionId) => this.signerWorkerManager.signTransactionsWithActions({
 				transactions,
 				rpcCall,
+				signerMode,
 				confirmationConfigOverride,
 				title,
 				body,
@@ -6303,7 +7325,74 @@ var WebAuthnManager = class {
 			})
 		});
 	}
-	async signDelegateAction({ delegate, rpcCall, confirmationConfigOverride, title, body, onEvent }) {
+	/**
+	* Sign AddKey(thresholdPublicKey) for `receiverId === nearAccountId` without running confirmTxFlow.
+	*
+	* This is a narrowly-scoped, internal-only helper for post-registration activation flows where
+	* the caller already has a PRF-bearing credential in memory (e.g., immediately after registration)
+	* and wants to avoid an extra TouchID/WebAuthn prompt.
+	*/
+	async signAddKeyThresholdPublicKeyNoPrompt(args) {
+		const nearAccountId = toAccountId(args.nearAccountId);
+		const wrapKeySalt = args.wrapKeySalt;
+		if (!wrapKeySalt) throw new Error("Missing wrapKeySalt for AddKey(thresholdPublicKey) signing");
+		if (!args.credential) throw new Error("Missing credential for AddKey(thresholdPublicKey) signing");
+		if (!args.transactionContext) throw new Error("Missing transactionContext for no-prompt signing");
+		const thresholdPublicKey = ensureEd25519Prefix(args.thresholdPublicKey);
+		if (!thresholdPublicKey) throw new Error("Missing thresholdPublicKey for AddKey(thresholdPublicKey) signing");
+		const relayerVerifyingShareB64u = args.relayerVerifyingShareB64u;
+		if (!relayerVerifyingShareB64u) throw new Error("Missing relayerVerifyingShareB64u for AddKey(thresholdPublicKey) signing");
+		const deviceNumber = Number(args.deviceNumber);
+		const resolvedDeviceNumber = Number.isSafeInteger(deviceNumber) && deviceNumber >= 1 ? deviceNumber : await getLastLoggedInDeviceNumber(nearAccountId, IndexedDBManager.clientDB).catch(() => 1);
+		const localKeyMaterial = await IndexedDBManager.nearKeysDB.getLocalKeyMaterial(nearAccountId, resolvedDeviceNumber);
+		if (!localKeyMaterial) throw new Error(`No local key material found for account ${nearAccountId} device ${resolvedDeviceNumber}`);
+		if (localKeyMaterial.wrapKeySalt !== wrapKeySalt) throw new Error("wrapKeySalt mismatch for AddKey(thresholdPublicKey) signing");
+		return await this.withSigningSession({
+			prefix: "no-prompt-add-threshold-key",
+			options: {
+				credential: args.credential,
+				wrapKeySalt
+			},
+			handler: async (sessionId) => {
+				const response = await this.signerWorkerManager.getContext().sendMessage({
+					sessionId,
+					message: {
+						type: INTERNAL_WORKER_REQUEST_TYPE_SIGN_ADD_KEY_THRESHOLD_PUBLIC_KEY_NO_PROMPT,
+						payload: {
+							createdAt: Date.now(),
+							decryption: {
+								encryptedPrivateKeyData: localKeyMaterial.encryptedSk,
+								encryptedPrivateKeyChacha20NonceB64u: localKeyMaterial.chacha20NonceB64u
+							},
+							transactionContext: args.transactionContext,
+							nearAccountId,
+							thresholdPublicKey,
+							relayerVerifyingShareB64u,
+							clientParticipantId: typeof args.clientParticipantId === "number" ? args.clientParticipantId : void 0,
+							relayerParticipantId: typeof args.relayerParticipantId === "number" ? args.relayerParticipantId : void 0
+						}
+					},
+					onEvent: args.onEvent
+				});
+				if (!isSignAddKeyThresholdPublicKeyNoPromptSuccess(response)) throw new Error("AddKey(thresholdPublicKey) signing failed");
+				if (!response.payload.success) throw new Error(response.payload.error || "AddKey(thresholdPublicKey) signing failed");
+				const signedTransactions = response.payload.signedTransactions || [];
+				if (signedTransactions.length !== 1) throw new Error(`Expected 1 signed transaction but received ${signedTransactions.length}`);
+				const signedTx = signedTransactions[0];
+				if (!signedTx || !signedTx.transaction || !signedTx.signature) throw new Error("Incomplete signed transaction data received for AddKey(thresholdPublicKey)");
+				return {
+					signedTransaction: new SignedTransaction({
+						transaction: signedTx.transaction,
+						signature: signedTx.signature,
+						borsh_bytes: Array.from(signedTx.borshBytes || [])
+					}),
+					nearAccountId: String(nearAccountId),
+					logs: response.payload.logs || []
+				};
+			}
+		});
+	}
+	async signDelegateAction({ delegate, rpcCall, signerMode, confirmationConfigOverride, title, body, onEvent }) {
 		const nearAccountId = toAccountId(rpcCall.nearAccountId || delegate.senderId);
 		const normalizedRpcCall = {
 			contractId: rpcCall.contractId || this.tatchiPasskeyConfigs.contractId,
@@ -6319,6 +7408,7 @@ var WebAuthnManager = class {
 					return this.signerWorkerManager.signDelegateAction({
 						delegate,
 						rpcCall: normalizedRpcCall,
+						signerMode,
 						confirmationConfigOverride,
 						title,
 						body,
@@ -6365,29 +7455,6 @@ var WebAuthnManager = class {
 	async extractCosePublicKey(attestationObjectBase64url) {
 		return await this.signerWorkerManager.extractCosePublicKey(attestationObjectBase64url);
 	}
-	/**
-	* Helper to ensure the local `lastUser` pointer is consistent with the latest DB updates.
-	* This fixes issues where a recovery or registration might have updated the user record
-	* but failed to update the `lastUser` pointer (e.g. due to previous bugs or interruptions),
-	* preventing the strict `ensureCurrentPasskey` check from passing.
-	*/
-	async autoHealLastUserPointer(nearAccountId) {
-		try {
-			const lastUser = await this.getLastUser();
-			if (lastUser && lastUser.nearAccountId === nearAccountId) {
-				const freshest = await IndexedDBManager.clientDB.getLastDBUpdatedUser(nearAccountId);
-				if (freshest && freshest.deviceNumber !== lastUser.deviceNumber) {
-					console.log(`[WebAuthnManager] Auto-healing lastUser pointer from device ${lastUser.deviceNumber} to ${freshest.deviceNumber}`);
-					await this.setLastUser(nearAccountId, freshest.deviceNumber);
-				}
-			} else {
-				const freshest = await IndexedDBManager.clientDB.getLastDBUpdatedUser(nearAccountId);
-				if (freshest) await this.setLastUser(nearAccountId, freshest.deviceNumber);
-			}
-		} catch (e) {
-			console.warn("[WebAuthnManager] Auto-heal pointer failed (non-fatal):", e);
-		}
-	}
 	/** Worker-driven export: two-phase V2 (collect PRF → decrypt → show UI) */
 	async exportNearKeypairWithUIWorkerDriven(nearAccountId, options) {
 		await this.withSigningSession({
@@ -6412,7 +7479,7 @@ var WebAuthnManager = class {
 		if (!userData || userData.nearAccountId !== nearAccountId) userData = await IndexedDBManager.clientDB.getLastDBUpdatedUser(nearAccountId);
 		return {
 			accountId: String(nearAccountId),
-			publicKey: String(userData?.clientNearPublicKey || ""),
+			publicKey: userData?.clientNearPublicKey ?? "",
 			privateKey: ""
 		};
 	}
@@ -6485,6 +7552,232 @@ var WebAuthnManager = class {
 			actions
 		});
 	}
+	/**
+	* Derive the deterministic threshold client verifying share (2-of-2 ed25519) from WrapKeySeed.
+	* This is safe to call during registration because it only requires the PRF-bearing credential
+	* (no on-chain verification needed) and returns public material only.
+	*/
+	async deriveThresholdEd25519ClientVerifyingShareFromCredential(args) {
+		const nearAccountId = toAccountId(args.nearAccountId);
+		try {
+			return await this.withSigningSession({
+				prefix: "threshold-client-share",
+				options: {
+					credential: args.credential,
+					wrapKeySalt: args.wrapKeySalt
+				},
+				handler: (sessionId) => this.signerWorkerManager.deriveThresholdEd25519ClientVerifyingShare({
+					sessionId,
+					nearAccountId
+				})
+			});
+		} catch (error) {
+			const message = String(error?.message ?? error);
+			return {
+				success: false,
+				nearAccountId,
+				clientVerifyingShareB64u: "",
+				wrapKeySalt: "",
+				error: message
+			};
+		}
+	}
+	/**
+	* Threshold key enrollment (post-registration):
+	* prompts for a dual-PRF WebAuthn authentication to obtain PRF.first/second,
+	* then runs the `/threshold-ed25519/keygen` enrollment flow.
+	*
+	* This is intended to be called only after the passkey is registered on-chain.
+	*/
+	async enrollThresholdEd25519KeyPostRegistration(args) {
+		const nearAccountId = toAccountId(args.nearAccountId);
+		try {
+			const rpId = this.touchIdPrompt.getRpId();
+			if (!rpId) throw new Error("Missing rpId for WebAuthn VRF challenge");
+			const block = await this.nearClient.viewBlock({ finality: "final" });
+			const blockHeight = String(block?.header?.height ?? "");
+			const blockHash = String(block?.header?.hash ?? "");
+			if (!blockHeight || !blockHash) throw new Error("Failed to fetch NEAR block context for VRF challenge");
+			const vrfChallenge = await this.vrfWorkerManager.generateVrfChallengeOnce({
+				userId: nearAccountId,
+				rpId,
+				blockHeight,
+				blockHash
+			});
+			const authenticators = await this.getAuthenticatorsByUser(nearAccountId);
+			if (!authenticators.length) throw new Error(`No passkey authenticators found for account ${nearAccountId}`);
+			const authCredential = await this.collectAuthenticationCredentialForVrfChallenge({
+				nearAccountId,
+				vrfChallenge,
+				includeSecondPrfOutput: true
+			});
+			return await this.enrollThresholdEd25519Key({
+				credential: authCredential,
+				nearAccountId,
+				deviceNumber: args.deviceNumber
+			});
+		} catch (error) {
+			const message = String(error?.message ?? error);
+			return {
+				success: false,
+				publicKey: "",
+				relayerKeyId: "",
+				wrapKeySalt: "",
+				error: message
+			};
+		}
+	}
+	/**
+	* Threshold key rotation (post-registration):
+	* - keygen (new relayerKeyId + publicKey)
+	* - AddKey(new threshold publicKey)
+	* - DeleteKey(old threshold publicKey)
+	*
+	* Uses the local signer key for AddKey/DeleteKey, and requires the account to already
+	* have a stored `threshold_ed25519_2p_v1` key material entry for the target device.
+	*/
+	async rotateThresholdEd25519KeyPostRegistration(args) {
+		const nearAccountId = toAccountId(args.nearAccountId);
+		let oldPublicKey = "";
+		let oldRelayerKeyId = "";
+		try {
+			const deviceNumber = Number(args.deviceNumber);
+			const resolvedDeviceNumber = Number.isSafeInteger(deviceNumber) && deviceNumber >= 1 ? deviceNumber : await getLastLoggedInDeviceNumber(nearAccountId, IndexedDBManager.clientDB).catch(() => 1);
+			const existing = await IndexedDBManager.nearKeysDB.getThresholdKeyMaterial(nearAccountId, resolvedDeviceNumber);
+			if (!existing) throw new Error(`No threshold key material found for account ${nearAccountId} device ${resolvedDeviceNumber}. Call enrollThresholdEd25519Key() first.`);
+			oldPublicKey = existing.publicKey;
+			oldRelayerKeyId = existing.relayerKeyId;
+			const enrollment = await this.enrollThresholdEd25519KeyPostRegistration({
+				nearAccountId,
+				deviceNumber: resolvedDeviceNumber
+			});
+			if (!enrollment.success) throw new Error(enrollment.error || "Threshold keygen/enrollment failed");
+			return await rotateThresholdEd25519KeyPostRegistrationHandler({
+				nearClient: this.nearClient,
+				contractId: this.tatchiPasskeyConfigs.contractId,
+				nearRpcUrl: this.tatchiPasskeyConfigs.nearRpcUrl,
+				signTransactionsWithActions: (params) => this.signTransactionsWithActions(params)
+			}, {
+				nearAccountId,
+				deviceNumber: resolvedDeviceNumber,
+				oldPublicKey,
+				oldRelayerKeyId,
+				newPublicKey: enrollment.publicKey,
+				newRelayerKeyId: enrollment.relayerKeyId,
+				wrapKeySalt: enrollment.wrapKeySalt
+			});
+		} catch (error) {
+			const message = String(error?.message ?? error);
+			return {
+				success: false,
+				oldPublicKey,
+				oldRelayerKeyId,
+				publicKey: "",
+				relayerKeyId: "",
+				wrapKeySalt: "",
+				deleteOldKeyAttempted: false,
+				deleteOldKeySuccess: false,
+				error: message
+			};
+		}
+	}
+	/**
+	* Threshold key enrollment (2-of-2): deterministically derive the client verifying share
+	* from WrapKeySeed and register the corresponding relayer share via `/threshold-ed25519/keygen`.
+	*
+	* Stores a v3 vault entry of kind `threshold_ed25519_2p_v1` (breaking; no migration).
+	*/
+	async enrollThresholdEd25519Key(args) {
+		const nearAccountId = toAccountId(args.nearAccountId);
+		const relayerUrl = this.tatchiPasskeyConfigs.relayer.url;
+		try {
+			if (!relayerUrl) throw new Error("Missing relayer url (configs.relayer.url)");
+			if (!args.credential) throw new Error("Missing credential");
+			const deviceNumber = Number(args.deviceNumber);
+			const resolvedDeviceNumber = Number.isSafeInteger(deviceNumber) && deviceNumber >= 1 ? deviceNumber : await getLastLoggedInDeviceNumber(nearAccountId, IndexedDBManager.clientDB).catch(() => 1);
+			const keygen = await this.withSigningSession({
+				prefix: "threshold-keygen",
+				options: { credential: args.credential },
+				handler: (sessionId) => enrollThresholdEd25519KeyHandler({
+					nearClient: this.nearClient,
+					vrfWorkerManager: this.vrfWorkerManager,
+					signerWorkerManager: this.signerWorkerManager,
+					touchIdPrompt: this.touchIdPrompt,
+					relayerUrl
+				}, {
+					sessionId,
+					nearAccountId
+				})
+			});
+			if (!keygen.success) throw new Error(keygen.error || "Threshold keygen failed");
+			const publicKey = keygen.publicKey;
+			const clientVerifyingShareB64u = keygen.clientVerifyingShareB64u;
+			const relayerKeyId = keygen.relayerKeyId;
+			const relayerVerifyingShareB64u = keygen.relayerVerifyingShareB64u;
+			if (!clientVerifyingShareB64u) throw new Error("Threshold keygen returned empty clientVerifyingShareB64u");
+			const localKeyMaterial = await IndexedDBManager.nearKeysDB.getLocalKeyMaterial(nearAccountId, resolvedDeviceNumber);
+			if (!localKeyMaterial) throw new Error(`No local key material found for account ${nearAccountId} device ${resolvedDeviceNumber}`);
+			const alreadyActive = await hasAccessKey(this.nearClient, nearAccountId, publicKey, {
+				attempts: 1,
+				delayMs: 0
+			});
+			if (!alreadyActive) {
+				this.nonceManager.initializeUser(nearAccountId, localKeyMaterial.publicKey);
+				const txContext = await this.nonceManager.getNonceBlockHashAndHeight(this.nearClient, { force: true });
+				const signed = await this.signAddKeyThresholdPublicKeyNoPrompt({
+					nearAccountId,
+					credential: args.credential,
+					wrapKeySalt: localKeyMaterial.wrapKeySalt,
+					transactionContext: txContext,
+					thresholdPublicKey: publicKey,
+					relayerVerifyingShareB64u,
+					clientParticipantId: keygen.clientParticipantId,
+					relayerParticipantId: keygen.relayerParticipantId,
+					deviceNumber: resolvedDeviceNumber
+				});
+				const signedTx = signed?.signedTransaction;
+				if (!signedTx) throw new Error("Failed to sign AddKey(thresholdPublicKey) transaction");
+				await this.nearClient.sendTransaction(signedTx, DEFAULT_WAIT_STATUS.thresholdAddKey);
+				const activated = await hasAccessKey(this.nearClient, nearAccountId, publicKey);
+				if (!activated) throw new Error("Threshold access key not found on-chain after AddKey");
+			}
+			const keyMaterial = {
+				kind: "threshold_ed25519_2p_v1",
+				nearAccountId,
+				deviceNumber: resolvedDeviceNumber,
+				publicKey,
+				wrapKeySalt: keygen.wrapKeySalt,
+				relayerKeyId,
+				clientShareDerivation: "prf_first_v1",
+				participants: buildThresholdEd25519Participants2pV1({
+					clientParticipantId: keygen.clientParticipantId,
+					relayerParticipantId: keygen.relayerParticipantId,
+					relayerKeyId,
+					relayerUrl,
+					clientVerifyingShareB64u,
+					relayerVerifyingShareB64u,
+					clientShareDerivation: "prf_first_v1"
+				}),
+				timestamp: Date.now()
+			};
+			await IndexedDBManager.nearKeysDB.storeKeyMaterial(keyMaterial);
+			return {
+				success: true,
+				publicKey,
+				relayerKeyId,
+				wrapKeySalt: keygen.wrapKeySalt
+			};
+		} catch (error) {
+			const message = String(error?.message ?? error);
+			return {
+				success: false,
+				publicKey: "",
+				relayerKeyId: "",
+				wrapKeySalt: "",
+				error: message
+			};
+		}
+	}
 	/** * Get user preferences manager */
 	getUserPreferences() {
 		return this.userPreferencesManager;
@@ -6712,13 +8005,14 @@ async function main() {
 						if (isAeadDecryptMismatch && !existing) throw new Error(`Decryption failed and no local user record was found for '${account}'. Open the wallet once online on this device to restore local vault state, then retry offline export.`);
 						const expectedPublicKey = String(existing?.clientNearPublicKey || "");
 						if (expectedPublicKey && expectedPublicKey !== rec.publicKey) throw new Error(`Selected passkey does not match the existing key for '${account}'. Please select the correct passkey for this account and try again.`);
-						await IndexedDBManager.nearKeysDB.storeEncryptedKey({
+						await IndexedDBManager.nearKeysDB.storeKeyMaterial({
+							kind: "local_near_sk_v3",
 							nearAccountId: account,
 							deviceNumber,
-							encryptedData: rec.encryptedPrivateKey,
+							publicKey: rec.publicKey,
+							encryptedSk: rec.encryptedPrivateKey,
 							chacha20NonceB64u: rec.chacha20NonceB64u,
 							wrapKeySalt: rec.wrapKeySalt,
-							version: 2,
 							timestamp: Date.now()
 						});
 						if (!existing?.clientNearPublicKey) try {