@tatchi-xyz/sdk 0.21.0 → 0.31.0

package/dist/esm/sdk/safari-fallbacks-BcMFntiP.js

@@ -0,0 +1,480 @@
+import { isArray, isObject, isString } from "./validation-BTq6LGPp.js";
+import { base64UrlEncode } from "./base64-dqpWgddX.js";
+
+//#region src/core/WebAuthnManager/credentialsHelpers.ts
+/**
+* Serialize PublicKeyCredential for both authentication and registration for WASM worker
+* - Uses base64url encoding for WASM compatibility
+*
+* @returns SerializableCredential - The serialized credential
+* - Does not return PRF outputs
+*/
+function serializeRegistrationCredential(credential) {
+	const response = credential.response;
+	let transports = [];
+	try {
+		const fn = response?.getTransports;
+		if (typeof fn === "function") transports = fn.call(response) || [];
+	} catch {
+		transports = [];
+	}
+	return {
+		id: credential.id,
+		rawId: base64UrlEncode(credential.rawId),
+		type: credential.type,
+		authenticatorAttachment: credential.authenticatorAttachment ?? void 0,
+		response: {
+			clientDataJSON: base64UrlEncode(response.clientDataJSON),
+			attestationObject: base64UrlEncode(response.attestationObject),
+			transports
+		},
+		clientExtensionResults: { prf: { results: {
+			first: void 0,
+			second: void 0
+		} } }
+	};
+}
+function serializeAuthenticationCredential(credential) {
+	const response = credential.response;
+	return {
+		id: credential.id,
+		rawId: base64UrlEncode(credential.rawId),
+		type: credential.type,
+		authenticatorAttachment: credential.authenticatorAttachment ?? void 0,
+		response: {
+			clientDataJSON: base64UrlEncode(response.clientDataJSON),
+			authenticatorData: base64UrlEncode(response.authenticatorData),
+			signature: base64UrlEncode(response.signature),
+			userHandle: response.userHandle ? base64UrlEncode(response.userHandle) : void 0
+		},
+		clientExtensionResults: { prf: { results: {
+			first: void 0,
+			second: void 0
+		} } }
+	};
+}
+/**
+* Serialize PublicKeyCredential for both authentication and registration for WASM worker
+* @returns SerializableCredential - The serialized credential
+* - INCLUDES PRF outputs
+*/
+function serializeRegistrationCredentialWithPRF({ credential, firstPrfOutput = true, secondPrfOutput = true }) {
+	const base = serializeRegistrationCredential(credential);
+	const { chacha20PrfOutput, ed25519PrfOutput } = extractPrfFromCredential({
+		credential,
+		firstPrfOutput,
+		secondPrfOutput
+	});
+	return {
+		...base,
+		clientExtensionResults: { prf: { results: {
+			first: chacha20PrfOutput,
+			second: ed25519PrfOutput
+		} } }
+	};
+}
+function serializeAuthenticationCredentialWithPRF({ credential, firstPrfOutput = true, secondPrfOutput = false }) {
+	const base = serializeAuthenticationCredential(credential);
+	const { chacha20PrfOutput, ed25519PrfOutput } = extractPrfFromCredential({
+		credential,
+		firstPrfOutput,
+		secondPrfOutput
+	});
+	return {
+		...base,
+		clientExtensionResults: { prf: { results: {
+			first: chacha20PrfOutput,
+			second: ed25519PrfOutput
+		} } }
+	};
+}
+/**
+* Validates and normalizes a serialized WebAuthn registration credential.
+* Ensures required fields exist and have the expected primitive types.
+* Populates missing optional arrays like transports with [].
+*/
+function normalizeRegistrationCredential(input) {
+	if (!isObject(input)) throw new Error("Invalid credential: not an object");
+	const candidate = input;
+	const normalized = { ...candidate };
+	if (!isString(normalized.id)) throw new Error("Invalid credential.id");
+	if (!isString(normalized.type)) throw new Error("Invalid credential.type");
+	if (!isString(normalized.rawId)) normalized.rawId = "";
+	if (normalized.authenticatorAttachment !== void 0 && !isString(normalized.authenticatorAttachment)) normalized.authenticatorAttachment = String(normalized.authenticatorAttachment);
+	const response = isObject(normalized.response) ? { ...normalized.response } : {};
+	if (!isString(response.clientDataJSON)) response.clientDataJSON = "";
+	if (!isString(response.attestationObject)) response.attestationObject = "";
+	if (!isArray(response.transports)) response.transports = [];
+	normalized.response = response;
+	normalized.clientExtensionResults = normalizeClientExtensionOutputs(normalized.clientExtensionResults);
+	return normalized;
+}
+/**
+* Redacts client extension outputs from the credential before sending it over the network.
+*
+* Motivation:
+* - WebAuthn `clientExtensionResults` may contain sensitive material (e.g. PRF outputs).
+* - Even when not sensitive, extension outputs can add fingerprinting surface and bloat payloads.
+*
+* @param credential - The WebAuthn credential potentially containing extension outputs
+* @returns Credential with `clientExtensionResults` removed/redacted
+*/
+function removePrfOutputGuard(credential) {
+	const response = credential.response;
+	const responseWithoutExtensions = isObject(response) ? (() => {
+		const cloned = { ...response };
+		if ("clientExtensionResults" in cloned) cloned.clientExtensionResults = null;
+		return cloned;
+	})() : response;
+	return {
+		...credential,
+		response: responseWithoutExtensions,
+		clientExtensionResults: null
+	};
+}
+/**
+* Returns true when the input looks like a serialized registration credential
+* (i.e., plain object with base64url string fields), not a live PublicKeyCredential.
+*/
+function isSerializedRegistrationCredential(x) {
+	if (!isObject(x)) return false;
+	const candidate = x;
+	if (!isString(candidate.id) || !isString(candidate.rawId) || !isString(candidate.type)) return false;
+	if (!isObject(candidate.response)) return false;
+	const response = candidate.response;
+	if (!isString(response.clientDataJSON) || !isString(response.attestationObject)) return false;
+	return response.transports == null || isArray(response.transports);
+}
+/**
+* Generate ChaCha20Poly1305 salt using account-specific HKDF for encryption key derivation
+* @param nearAccountId - NEAR account ID to scope the salt to
+* @returns 32-byte Uint8Array salt for ChaCha20Poly1305 key derivation
+*/
+function generateChaCha20Salt(nearAccountId) {
+	const saltString = `chacha20-salt:${nearAccountId}`;
+	const salt = new Uint8Array(32);
+	const saltBytes = new TextEncoder().encode(saltString);
+	salt.set(saltBytes.slice(0, 32));
+	return salt;
+}
+/**
+* Generate Ed25519 salt using account-specific HKDF for signing key derivation
+* @param nearAccountId - NEAR account ID to scope the salt to
+* @returns 32-byte Uint8Array salt for Ed25519 key derivation
+*/
+function generateEd25519Salt(nearAccountId) {
+	const saltString = `ed25519-salt:${nearAccountId}`;
+	const salt = new Uint8Array(32);
+	const saltBytes = new TextEncoder().encode(saltString);
+	salt.set(saltBytes.slice(0, 32));
+	return salt;
+}
+/**
+* Extract PRF outputs from WebAuthn credential extension results
+* ENCODING: Uses base64url for WASM compatibility
+* @param credential - WebAuthn credential with dual PRF extension results
+* @param firstPrfOutput - Whether to include the first PRF output (default: true)
+* @param secondPrfOutput - Whether to include the second PRF output (default: false)
+* @returns PRF outputs
+*/
+function extractPrfFromCredential({ credential, firstPrfOutput = true, secondPrfOutput = false }) {
+	const extensionResults = getExtensionResults(credential);
+	const prfResults = extractPrfResultsObject(extensionResults);
+	validatePrfResults(prfResults, firstPrfOutput, secondPrfOutput);
+	const firstEncoded = firstPrfOutput ? normalizePrfValueToBase64Url(prfResults.first) : void 0;
+	const secondEncoded = secondPrfOutput ? normalizePrfValueToBase64Url(prfResults.second) : void 0;
+	if (firstPrfOutput && !firstEncoded) throw new Error("Missing PRF result: first");
+	if (secondPrfOutput && !secondEncoded) throw new Error("Missing PRF result: second");
+	return {
+		chacha20PrfOutput: firstEncoded || "",
+		ed25519PrfOutput: secondEncoded || ""
+	};
+}
+/** Get extension results from credential (live or serialized) */
+function getExtensionResults(credential) {
+	try {
+		const fn = credential.getClientExtensionResults;
+		if (typeof fn === "function") return fn.call(credential);
+	} catch {}
+	return credential.clientExtensionResults;
+}
+/** Extract PRF results object from extension results */
+function extractPrfResultsObject(extensionResults) {
+	try {
+		return extensionResults?.prf?.results;
+	} catch {
+		return void 0;
+	}
+}
+/** Validate PRF results are present and not empty */
+function validatePrfResults(prfResults, firstRequired, secondRequired) {
+	if (!prfResults) throw new Error("Missing PRF results from credential, use a PRF-enabled Authenticator");
+	const hasAnyPrfData = prfResults.first !== void 0 || prfResults.second !== void 0;
+	if (!hasAnyPrfData && (firstRequired || secondRequired)) throw new Error("Missing PRF result - PRF evaluation failed: results object is empty");
+}
+/** Normalize a PRF value to base64url string */
+function normalizePrfValueToBase64Url(value) {
+	if (!value) return void 0;
+	if (typeof value === "string") return value;
+	if (value instanceof ArrayBuffer) return base64UrlEncode(value);
+	if (ArrayBuffer.isView(value)) return base64UrlEncode(value.buffer);
+	try {
+		return base64UrlEncode(value);
+	} catch {
+		try {
+			return base64UrlEncode(new Uint8Array(value).buffer);
+		} catch {
+			return void 0;
+		}
+	}
+}
+/**
+* Normalize WebAuthn client extension outputs into an SDK‑local, clone‑safe shape.
+*
+* Purpose:
+* - Browsers return extension results on PublicKeyCredential in a variety of
+*   shapes and with optional presence. This helper takes an unknown value
+*   (either a live `credential.getClientExtensionResults()` object or a
+*   serialized snapshot) and produces a strictly typed
+*   `AuthenticationExtensionsClientOutputs` compatible with our WASM workers
+*   and cross‑window message passing (structured‑clone safe).
+*/
+function normalizeClientExtensionOutputs(input) {
+	const out = { prf: { results: {
+		first: void 0,
+		second: void 0
+	} } };
+	const src = isObject(input) ? input : {};
+	if (typeof src.appid === "boolean") out.appid = src.appid;
+	if (typeof src.appidExclude === "boolean") out.appidExclude = src.appidExclude;
+	if (typeof src.hmacCreateSecret === "boolean") out.hmacCreateSecret = src.hmacCreateSecret;
+	if (isObject(src.credProps)) {
+		const cp = src.credProps;
+		const outCp = {};
+		if (typeof cp.rk === "boolean") outCp.rk = cp.rk;
+		out.credProps = outCp;
+	}
+	if (isArray(src.uvm)) {
+		const uvmArr = src.uvm.filter(isArray).map((t) => {
+			const a = t;
+			const n0 = typeof a[0] === "number" ? a[0] : void 0;
+			const n1 = typeof a[1] === "number" ? a[1] : void 0;
+			const n2 = typeof a[2] === "number" ? a[2] : void 0;
+			return typeof n0 === "number" && typeof n1 === "number" && typeof n2 === "number" ? [
+				n0,
+				n1,
+				n2
+			] : void 0;
+		}).filter((x) => Array.isArray(x));
+		if (uvmArr.length > 0) out.uvm = uvmArr;
+	}
+	if (isObject(src.prf)) {
+		const prf = src.prf;
+		const results = isObject(prf.results) ? prf.results : {};
+		const first = results.first;
+		const second = results.second;
+		out.prf = { results: {
+			first: isString(first) ? first : void 0,
+			second: isString(second) ? second : void 0
+		} };
+	}
+	return out;
+}
+
+//#endregion
+//#region src/core/WebAuthnManager/WebAuthnFallbacks/safari-fallbacks.ts
+const WebAuthnBridgeMessage = {
+	Create: "WALLET_WEBAUTHN_CREATE",
+	Get: "WALLET_WEBAUTHN_GET",
+	CreateResult: "WALLET_WEBAUTHN_CREATE_RESULT",
+	GetResult: "WALLET_WEBAUTHN_GET_RESULT"
+};
+function getResultTypeFor(kind) {
+	return kind === WebAuthnBridgeMessage.Get ? WebAuthnBridgeMessage.GetResult : WebAuthnBridgeMessage.CreateResult;
+}
+/**
+* Execute a WebAuthn operation with Safari-aware fallbacks.
+*
+* Steps:
+* 1) Try native WebAuthn via navigator.credentials.{create|get}
+* 2) If the failure matches Safari's ancestor-origin restriction and we are in an iframe,
+*    ask the parent/top-level window to perform the WebAuthn operation (bridge). If the
+*    parent reports a user cancellation, throw NotAllowedError; if it times out, continue.
+* 3) If the failure matches Safari's "document not focused" path, first attempt to refocus
+*    and retry native once; if still blocked and in an iframe, ask the parent window to handle it.
+* 4) Generic last resort: when in an iframe (constrained context), always attempt the parent
+*    WebAuthn once even if the error wasn't recognized as a Safari-specific case. If the parent
+*    path times out, surface a deterministic timeout error without re-trying native again.
+* 5) Otherwise, rethrow the original error.
+*/
+async function executeWebAuthnWithParentFallbacksSafari(kind, publicKey, deps) {
+	const { rpId, inIframe, timeoutMs = 6e4, permitGetBridgeOnAncestorError = true } = deps;
+	const bridgeClient = deps.bridgeClient || new WindowParentDomainWebAuthnClient();
+	const isTestForceNativeFail = () => {
+		const g = globalThis;
+		const w = typeof window !== "undefined" ? window : void 0;
+		return !!(g && g.__W3A_TEST_FORCE_NATIVE_FAIL) || !!(w && w.__W3A_TEST_FORCE_NATIVE_FAIL);
+	};
+	const bumpCounter = (key) => {
+		const g = globalThis;
+		g[key] = (g[key] || 0) + 1;
+	};
+	if (isTestForceNativeFail()) {
+		if (kind === "create") bumpCounter("__W3A_TEST_NATIVE_CREATE_ATTEMPTS");
+		else bumpCounter("__W3A_TEST_NATIVE_GET_ATTEMPTS");
+		try {
+			const bridged = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);
+			if (bridged?.ok) return bridged.credential;
+			if (bridged && !bridged.timeout) throw notAllowedError(bridged.error || "WebAuthn cancelled or failed (bridge)");
+			throw new Error("WebAuthn bridge timeout");
+		} catch (be) {
+			throw notAllowedError(be?.message || "WebAuthn bridge failed");
+		}
+	}
+	const tryNative = async () => {
+		if (kind === "create") {
+			bumpCounter("__W3A_TEST_NATIVE_CREATE_ATTEMPTS");
+			if (isTestForceNativeFail()) throw notAllowedError("Forced native fail (create)");
+			return await navigator.credentials.create({
+				publicKey,
+				...deps.abortSignal ? { signal: deps.abortSignal } : {}
+			});
+		} else {
+			bumpCounter("__W3A_TEST_NATIVE_GET_ATTEMPTS");
+			if (isTestForceNativeFail()) throw notAllowedError("Forced native fail (get)");
+			return await navigator.credentials.get({
+				publicKey,
+				...deps.abortSignal ? { signal: deps.abortSignal } : {}
+			});
+		}
+	};
+	try {
+		return await tryNative();
+	} catch (e) {
+		const name = safeName(e);
+		if (name === "NotAllowedError" && !isAncestorOriginError(e) && !isDocumentNotFocusedError(e)) throw e;
+		if (isAncestorOriginError(e) && inIframe) {
+			if (kind === "get" && !permitGetBridgeOnAncestorError) throw e;
+			try {
+				const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);
+				if (bridgedCredentials?.ok) return bridgedCredentials.credential;
+				if (bridgedCredentials && !bridgedCredentials.timeout) throw notAllowedError(bridgedCredentials.error || "WebAuthn get cancelled or failed (bridge)");
+			} catch (be) {
+				throw notAllowedError(be?.message || "WebAuthn bridge failed");
+			}
+		}
+		if (isDocumentNotFocusedError(e)) {
+			const focused = await attemptRefocus();
+			if (focused) try {
+				return await tryNative();
+			} catch {}
+			if (inIframe) try {
+				const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);
+				if (bridgedCredentials?.ok) return bridgedCredentials.credential;
+				if (bridgedCredentials && !bridgedCredentials.timeout) throw notAllowedError(bridgedCredentials.error || "WebAuthn get cancelled or failed (bridge)");
+			} catch (be) {
+				throw notAllowedError(be?.message || "WebAuthn bridge failed");
+			}
+		}
+		if (inIframe) try {
+			const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);
+			if (bridgedCredentials?.ok) return bridgedCredentials.credential;
+			if (bridgedCredentials && !bridgedCredentials.timeout) throw notAllowedError(bridgedCredentials.error || "WebAuthn cancelled or failed (bridge)");
+			throw new Error("WebAuthn bridge timeout");
+		} catch (be) {
+			throw notAllowedError(be?.message || "WebAuthn bridge failed");
+		}
+		throw e;
+	}
+}
+async function requestParentDomainWebAuthn(kind, publicKey, client, timeoutMs) {
+	if (kind === "create") return client.request(WebAuthnBridgeMessage.Create, publicKey, timeoutMs);
+	return client.request(WebAuthnBridgeMessage.Get, publicKey, timeoutMs);
+}
+var WindowParentDomainWebAuthnClient = class {
+	async request(kind, publicKey, timeoutMs = 6e4) {
+		const requestId = `${kind}:${Date.now()}:${Math.random().toString(36).slice(2)}`;
+		const resultType = getResultTypeFor(kind);
+		return new Promise((resolve) => {
+			let settled = false;
+			const finish = (val) => {
+				if (!settled) {
+					settled = true;
+					resolve(val);
+				}
+			};
+			const onMessage = (ev) => {
+				const payload = ev?.data;
+				if (!payload || typeof payload.type !== "string") return;
+				const t = payload.type;
+				if (t !== resultType) return;
+				const rid = payload.requestId;
+				if (rid !== requestId) return;
+				window.removeEventListener("message", onMessage);
+				const ok = !!payload.ok;
+				const cred = payload.credential;
+				const err = payload.error;
+				if (ok && cred) return finish({
+					ok: true,
+					credential: cred
+				});
+				return finish({
+					ok: false,
+					error: typeof err === "string" ? err : void 0
+				});
+			};
+			window.addEventListener("message", onMessage);
+			window.parent?.postMessage({
+				type: kind,
+				requestId,
+				publicKey
+			}, "*");
+			setTimeout(() => {
+				window.removeEventListener("message", onMessage);
+				finish({
+					ok: false,
+					timeout: true
+				});
+			}, timeoutMs);
+		});
+	}
+};
+function notAllowedError(message) {
+	const e = new Error(message);
+	e.name = "NotAllowedError";
+	return e;
+}
+function isAncestorOriginError(err) {
+	const msg = safeMessage(err);
+	return /origin of the document is not the same as its ancestors/i.test(msg);
+}
+function isDocumentNotFocusedError(err) {
+	const name = safeName(err);
+	const msg = safeMessage(err);
+	const isNotAllowed = name === "NotAllowedError";
+	const mentionsFocus = /document is not focused|not focused|focus/i.test(msg);
+	return Boolean(isNotAllowed && mentionsFocus);
+}
+function safeMessage(err) {
+	return String(err?.message || "");
+}
+function safeName(err) {
+	const n = err?.name;
+	return typeof n === "string" ? n : "";
+}
+async function attemptRefocus(maxRetries = 2, delays = [50, 120]) {
+	window.focus?.();
+	(document?.body)?.focus?.();
+	const wait = (ms) => new Promise((r) => setTimeout(r, ms));
+	const total = Math.max(0, maxRetries);
+	for (let i = 0; i <= total; i++) {
+		const d = delays[i] ?? delays[delays.length - 1] ?? 80;
+		await wait(d);
+		if (document.hasFocus()) return true;
+		window.focus?.();
+	}
+	return document.hasFocus();
+}
+
+//#endregion
+export { WebAuthnBridgeMessage, executeWebAuthnWithParentFallbacksSafari, generateChaCha20Salt, generateEd25519Salt, isSerializedRegistrationCredential, normalizeRegistrationCredential, removePrfOutputGuard, serializeAuthenticationCredentialWithPRF, serializeRegistrationCredential, serializeRegistrationCredentialWithPRF };

package/dist/esm/sdk/scanDevice-Cp-r-Z2T.js

@@ -0,0 +1,109 @@
+import { ensureEd25519Prefix, validateNearAccountId } from "./validation-BTq6LGPp.js";
+import "./actions-fHadejPs.js";
+import "./rpc-Dq3ioE9T.js";
+import "./signer-worker-DK847sXj.js";
+import "./base64-dqpWgddX.js";
+import { getLoginSession } from "./login-DnROv3eA.js";
+import "./vrf-worker-BzQsJ5BW.js";
+import { DeviceLinkingPhase, DeviceLinkingStatus } from "./sdkSentEvents-CzAZBFjP.js";
+import { DEVICE_LINKING_CONFIG, DeviceLinkingError, DeviceLinkingErrorCode } from "./config-BbNXtVtu.js";
+import "./accountIds-DVDhXwVA.js";
+import "./intentDigest-yivVENNK.js";
+import "./errors-DevlT39D.js";
+import "./IndexedDBManager-B1cUvdyY.js";
+import "./defaultConfigs-BmCU1_qI.js";
+import "./safari-fallbacks-BcMFntiP.js";
+import "./touchIdPrompt-JPhrOx8o.js";
+import { executeDeviceLinkingContractCalls } from "./rpcCalls-B44MZora.js";
+import "./getDeviceNumber-y3mMtky6.js";
+
+//#region src/core/TatchiPasskey/scanDevice.ts
+/**
+* Device1 (original device): Link device using pre-scanned QR data
+*/
+async function linkDeviceWithScannedQRData(context, qrData, options) {
+	const { onEvent, onError } = options || {};
+	try {
+		onEvent?.({
+			step: 2,
+			phase: DeviceLinkingPhase.STEP_2_SCANNING,
+			status: DeviceLinkingStatus.PROGRESS,
+			message: "Validating QR data..."
+		});
+		validateDeviceLinkingQRData(qrData);
+		const { login: device1LoginState } = await getLoginSession(context);
+		if (!device1LoginState.isLoggedIn || !device1LoginState.nearAccountId) throw new Error("Device1 must be logged in to authorize device linking");
+		const device1AccountId = device1LoginState.nearAccountId;
+		const fundingAmount = options.fundingAmount;
+		const device2PublicKey = ensureEd25519Prefix(qrData.device2PublicKey);
+		if (!device2PublicKey || !/^ed25519:/i.test(device2PublicKey)) throw new Error("Invalid device public key format");
+		onEvent?.({
+			step: 3,
+			phase: DeviceLinkingPhase.STEP_3_AUTHORIZATION,
+			status: DeviceLinkingStatus.PROGRESS,
+			message: `Performing TouchID authentication for device linking...`
+		});
+		const userData = await context.webAuthnManager.getLastUser();
+		const nearPublicKeyStr = userData?.clientNearPublicKey;
+		if (!nearPublicKeyStr) throw new Error("Client NEAR public key not found in user data");
+		const { accessKeyInfo, nextNonce, txBlockHeight, txBlockHash } = await context.webAuthnManager.getNonceManager().getNonceBlockHashAndHeight(context.nearClient);
+		const nextNextNonce = (BigInt(nextNonce) + BigInt(1)).toString();
+		const nextNextNextNonce = (BigInt(nextNonce) + BigInt(2)).toString();
+		const vrfInputData = {
+			userId: device1AccountId,
+			rpId: context.webAuthnManager.getRpId(),
+			blockHeight: txBlockHeight,
+			blockHash: txBlockHash
+		};
+		const vrfChallenge = await context.webAuthnManager.generateVrfChallengeOnce(vrfInputData);
+		onEvent?.({
+			step: 6,
+			phase: DeviceLinkingPhase.STEP_6_REGISTRATION,
+			status: DeviceLinkingStatus.PROGRESS,
+			message: "TouchID successful! Signing AddKey transaction..."
+		});
+		const { addKeyTxResult, storeDeviceLinkingTxResult, signedDeleteKeyTransaction } = await executeDeviceLinkingContractCalls({
+			context,
+			device1AccountId,
+			device2PublicKey,
+			nextNonce,
+			nextNextNonce,
+			nextNextNextNonce,
+			txBlockHash,
+			vrfChallenge,
+			onEvent,
+			confirmationConfigOverride: options?.confirmationConfig,
+			confirmerText: options?.confirmerText
+		});
+		const result = {
+			success: true,
+			device2PublicKey,
+			transactionId: addKeyTxResult?.transaction?.hash || storeDeviceLinkingTxResult?.transaction?.hash || "unknown",
+			fundingAmount,
+			linkedToAccount: device1AccountId,
+			signedDeleteKeyTransaction
+		};
+		onEvent?.({
+			step: 6,
+			phase: DeviceLinkingPhase.STEP_6_REGISTRATION,
+			status: DeviceLinkingStatus.SUCCESS,
+			message: `Device2's key added to ${device1AccountId} successfully!`
+		});
+		return result;
+	} catch (error) {
+		console.error("LinkDeviceFlow: linkDeviceWithQRData caught error:", error);
+		const errorMessage = `Failed to scan and link device: ${error.message}`;
+		onError?.(new Error(errorMessage));
+		throw new DeviceLinkingError(errorMessage, DeviceLinkingErrorCode.AUTHORIZATION_TIMEOUT, "authorization");
+	}
+}
+function validateDeviceLinkingQRData(qrData) {
+	if (!qrData.device2PublicKey) throw new DeviceLinkingError("Missing device public key", DeviceLinkingErrorCode.INVALID_QR_DATA, "authorization");
+	if (!qrData.timestamp) throw new DeviceLinkingError("Missing timestamp", DeviceLinkingErrorCode.INVALID_QR_DATA, "authorization");
+	const maxAge = DEVICE_LINKING_CONFIG.TIMEOUTS.QR_CODE_MAX_AGE_MS;
+	if (Date.now() - qrData.timestamp > maxAge) throw new DeviceLinkingError("QR code expired", DeviceLinkingErrorCode.SESSION_EXPIRED, "authorization");
+	if (qrData.accountId) validateNearAccountId(qrData.accountId);
+}
+
+//#endregion
+export { linkDeviceWithScannedQRData };