@tatchi-xyz/sdk 0.21.0 → 0.31.0

package/dist/esm/react/sdk/src/core/WebAuthnManager/VrfWorkerManager/index.js

@@ -1,374 +0,0 @@
-import { BUILD_PATHS } from "../../../../build-paths.js";
-import { resolveWorkerUrl } from "../../sdkPaths/workers.js";
-import { SecureConfirmMessageType } from "./confirmTxFlow/types.js";
-import { handlePromptUserConfirmInJsMainThread } from "./confirmTxFlow/handleSecureConfirmRequest.js";
-import { checkVrfStatus } from "./handlers/checkVrfStatus.js";
-import { clearSession } from "./handlers/clearSession.js";
-import { clearVrfSession } from "./handlers/clearVrf.js";
-import { confirmAndDeriveDevice2RegistrationSession } from "./handlers/confirmAndDeriveDevice2RegistrationSession.js";
-import { confirmAndPrepareSigningSession } from "./handlers/confirmAndPrepareSigningSession.js";
-import { createSigningSessionChannel } from "./handlers/createSigningSessionChannel.js";
-import { deriveVrfKeypairFromPrf } from "./handlers/deriveVrfKeypairFromPrf.js";
-import { mintSessionKeysAndSendToSigner } from "./handlers/mintSessionKeysAndSendToSigner.js";
-import { dispenseSessionKey } from "./handlers/dispenseSessionKey.js";
-import { generateVrfChallengeForSession, generateVrfChallengeOnce } from "./handlers/generateVrfChallenge.js";
-import { generateVrfKeypairBootstrap } from "./handlers/generateVrfKeypairBootstrap.js";
-import { checkSessionStatus } from "./handlers/checkSessionStatus.js";
-import { prepareDecryptSession } from "./handlers/prepareDecryptSession.js";
-import { requestRegistrationCredentialConfirmation } from "./handlers/requestRegistrationCredentialConfirmation.js";
-import { shamir3PassDecryptVrfKeypair } from "./handlers/shamir3PassDecryptVrfKeypair.js";
-import { shamir3PassEncryptCurrentVrfKeypair } from "./handlers/shamir3PassEncryptCurrentVrfKeypair.js";
-import { unlockVrfKeypair } from "./handlers/unlockVrfKeypair.js";
-
-//#region src/core/WebAuthnManager/VrfWorkerManager/index.ts
-/**
-* VRF Worker Manager
-*
-* This class manages VRF operations using Web Workers for:
-* - VRF keypair unlocking (login)
-* - VRF challenge generation (authentication)
-* - Session management (browser session only)
-* - Client-hosted worker files
-*/
-var VrfWorkerManager = class {
-	vrfWorker = null;
-	initializationPromise = null;
-	messageId = 0;
-	config;
-	currentVrfAccountId = null;
-	workerBaseOrigin;
-	context;
-	constructor(config, context) {
-		this.config = {
-			vrfWorkerUrl: BUILD_PATHS.RUNTIME.VRF_WORKER,
-			workerTimeout: 6e4,
-			debug: false,
-			...config
-		};
-		this.context = {
-			...context,
-			vrfWorkerManager: this
-		};
-	}
-	/**
-	* Context used by confirmTxFlow for VRF-driven flows.
-	*/
-	getContext() {
-		return this.context;
-	}
-	getHandlerContext() {
-		return {
-			ensureWorkerReady: this.ensureWorkerReady.bind(this),
-			sendMessage: this.sendMessage.bind(this),
-			generateMessageId: this.generateMessageId.bind(this),
-			getContext: this.getContext.bind(this),
-			postToWorker: (message, transfer) => {
-				if (!this.vrfWorker) throw new Error("VRF Web Worker not available");
-				this.vrfWorker.postMessage(message, transfer);
-			},
-			getCurrentVrfAccountId: () => this.currentVrfAccountId,
-			setCurrentVrfAccountId: (next) => {
-				this.currentVrfAccountId = next;
-			}
-		};
-	}
-	/**
-	* Create a VRF-owned MessageChannel for signing and return the signer-facing port.
-	* VRF retains the sibling port for WrapKeySeed delivery.
-	*/
-	async createSigningSessionChannel(sessionId) {
-		return createSigningSessionChannel(this.getHandlerContext(), sessionId);
-	}
-	/**
-	* Derive WrapKeySeed in the VRF worker and deliver it (along with PRF.second if credential provided)
-	* to the signer worker via the registered port.
-	*/
-	async mintSessionKeysAndSendToSigner(args) {
-		return mintSessionKeysAndSendToSigner(this.getHandlerContext(), args);
-	}
-	/**
-	* Dispense an existing VRF-owned session key (WrapKeySeed + wrapKeySalt) over the
-	* attached MessagePort for `sessionId`, enforcing TTL/usage in the VRF worker.
-	*
-	* This is the primitive needed for "warm" signing sessions: 1 VRF worker → N one-shot signer workers.
-	*/
-	async dispenseSessionKey(args) {
-		return dispenseSessionKey(this.getHandlerContext(), args);
-	}
-	/**
-	* Query VRF-owned signing session status for UI introspection.
-	* This does not prompt and does not reveal secrets; it only returns metadata.
-	*/
-	async checkSessionStatus(args) {
-		return checkSessionStatus(this.getHandlerContext(), args);
-	}
-	/**
-	* Clear VRF-owned signing session material for a given `sessionId`.
-	* Intended for explicit "Lock" actions or lifecycle cleanup.
-	*/
-	async clearSession(args) {
-		return clearSession(this.getHandlerContext(), args);
-	}
-	/**
-	* VRF-driven decrypt session for export flows.
-	* Kicks off a LocalOnly DECRYPT_PRIVATE_KEY_WITH_PRF confirm via VRF Rust and derives
-	* WrapKeySeed using the vault-provided wrapKeySalt. WrapKeySeed + wrapKeySalt are sent to the signer over
-	* the dedicated MessagePort for the given sessionId.
-	*/
-	async prepareDecryptSession(args) {
-		return prepareDecryptSession(this.getHandlerContext(), args);
-	}
-	/**
-	* VRF-driven confirmation + WrapKeySeed derivation for signing flows.
-	* Runs confirmTxFlow on the main thread, derives WrapKeySeed in the VRF worker, and returns
-	* the session metadata needed by the signer worker. WrapKeySeed itself travels only over the
-	* reserved MessagePort registered via registerSignerWrapKeySeedPort.
-	*/
-	async confirmAndPrepareSigningSession(params) {
-		return confirmAndPrepareSigningSession(this.getHandlerContext(), params);
-	}
-	/**
-	* VRF-driven helper for registration confirmation.
-	* Runs confirmTxFlow on the main thread and returns registration artifacts.
-	* WrapKeySeed derivation is handled later when we call into signing/derivation
-	* flows with PRF + withSigningSession.
-	*/
-	async requestRegistrationCredentialConfirmation(params) {
-		return requestRegistrationCredentialConfirmation(this.getHandlerContext(), params);
-	}
-	/**
-	* Combined Device2 registration session: single WebAuthn ceremony for credential + WrapKeySeed derivation.
-	*
-	* This method orchestrates the complete Device2 registration flow:
-	* 1. Runs a VRF-driven registration confirmation (single TouchID prompt)
-	* 2. Extracts PRF.first from the credential and derives WrapKeySeed
-	* 3. Sends WrapKeySeed to signer worker via MessagePort (never exposed to JS)
-	* 4. Returns credential (with PRF.second embedded), vrfChallenge, transactionContext, wrapKeySalt
-	*
-	* The signer worker can then use PRF.second for NEAR key derivation and WrapKeySeed for encryption.
-	*/
-	async confirmAndDeriveDevice2RegistrationSession(params) {
-		return confirmAndDeriveDevice2RegistrationSession(this.getHandlerContext(), params);
-	}
-	setWorkerBaseOrigin(origin) {
-		this.workerBaseOrigin = origin;
-	}
-	/**
-	* Ensure VRF worker is ready for operations
-	* @param requireHealthCheck - Whether to perform health check after initialization
-	*/
-	async ensureWorkerReady(requireHealthCheck = false) {
-		if (this.initializationPromise) await this.initializationPromise;
-		else if (!this.vrfWorker) await this.initialize();
-		if (!this.vrfWorker) throw new Error("VRF Worker failed to initialize");
-		if (requireHealthCheck) try {
-			const healthResponse = await this.sendMessage({
-				type: "PING",
-				id: this.generateMessageId(),
-				payload: {}
-			}, 3e3);
-			if (!healthResponse.success) throw new Error("VRF Worker failed health check");
-		} catch (error) {
-			console.error("VRF Manager: Health check failed:", error);
-			throw new Error("VRF Worker failed health check");
-		}
-	}
-	/**
-	* Initialize VRF functionality using Web Workers
-	*/
-	async initialize() {
-		if (this.initializationPromise) return this.initializationPromise;
-		this.initializationPromise = this.createVrfWorker().catch((error) => {
-			console.error("VRF Manager: Initialization failed:", error);
-			console.error("VRF Manager: Error details:", {
-				message: error.message,
-				stack: error.stack,
-				name: error.name
-			});
-			this.initializationPromise = null;
-			throw error;
-		});
-		const result = await this.initializationPromise;
-		return result;
-	}
-	/**
-	* Initialize Web Worker with client-hosted VRF worker
-	*/
-	async createVrfWorker() {
-		try {
-			const relativePath = this.config.vrfWorkerUrl || BUILD_PATHS.RUNTIME.VRF_WORKER;
-			const vrfUrlStr = resolveWorkerUrl(relativePath, {
-				worker: "vrf",
-				baseOrigin: this.workerBaseOrigin
-			});
-			console.debug("VRF Manager: Worker URL:", vrfUrlStr);
-			this.vrfWorker = new Worker(vrfUrlStr, {
-				type: "module",
-				name: "Web3AuthnVRFWorker"
-			});
-			this.vrfWorker.onerror = (error) => {
-				console.error("VRF Manager: Web Worker error:", error);
-			};
-			await this.testWebWorkerCommunication();
-			if (this.config.shamirPB64u) {
-				const resp = await this.sendMessage({
-					type: "SHAMIR3PASS_CONFIG_P",
-					id: this.generateMessageId(),
-					payload: { p_b64u: this.config.shamirPB64u }
-				});
-				if (!resp.success) throw new Error(`Failed to configure Shamir P: ${resp.error}`);
-			}
-			if (this.config.relayServerUrl && this.config.applyServerLockRoute && this.config.removeServerLockRoute) {
-				const resp2 = await this.sendMessage({
-					type: "SHAMIR3PASS_CONFIG_SERVER_URLS",
-					id: this.generateMessageId(),
-					payload: {
-						relayServerUrl: this.config.relayServerUrl,
-						applyLockRoute: this.config.applyServerLockRoute,
-						removeLockRoute: this.config.removeServerLockRoute
-					}
-				});
-				if (!resp2.success) throw new Error(`Failed to configure Shamir server URLs: ${resp2.error}`);
-			}
-		} catch (error) {
-			throw new Error(`VRF Web Worker initialization failed: ${error.message}`);
-		}
-	}
-	/**
-	* Send message to Web Worker and wait for response
-	*/
-	async sendMessage(message, customTimeout) {
-		return new Promise((resolve, reject) => {
-			if (!this.vrfWorker) {
-				reject(/* @__PURE__ */ new Error("VRF Web Worker not available"));
-				return;
-			}
-			const timeoutMs = customTimeout ?? this.config.workerTimeout ?? 6e4;
-			const timeout = setTimeout(() => {
-				reject(/* @__PURE__ */ new Error(`VRF Web Worker communication timeout (${timeoutMs}ms) for message type: ${message.type}`));
-			}, timeoutMs);
-			const handleMessage = (event) => {
-				const payload = event.data;
-				if (payload?.type === SecureConfirmMessageType.PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD) {
-					const env = payload;
-					const ctx = this.getContext();
-					if (!this.vrfWorker) {
-						console.error("[VRF] SecureConfirm: vrfWorker missing for PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD");
-						return;
-					}
-					handlePromptUserConfirmInJsMainThread(ctx, env, this.vrfWorker);
-					return;
-				}
-				const response = payload;
-				if (response.id === message.id) {
-					clearTimeout(timeout);
-					this.vrfWorker.removeEventListener("message", handleMessage);
-					resolve(response);
-				}
-			};
-			this.vrfWorker.addEventListener("message", handleMessage);
-			this.vrfWorker.postMessage(message);
-		});
-	}
-	/**
-	* Generate unique message ID
-	*/
-	generateMessageId() {
-		return `vrf_${Date.now()}_${++this.messageId}`;
-	}
-	/**
-	* Unlock VRF keypair in Web Worker memory using PRF output
-	* This is called during login to decrypt and load the VRF keypair in-memory
-	*/
-	async unlockVrfKeypair(args) {
-		return unlockVrfKeypair(this.getHandlerContext(), args);
-	}
-	async generateVrfChallengeForSession(inputData, sessionId) {
-		return generateVrfChallengeForSession(this.getHandlerContext(), inputData, sessionId);
-	}
-	async generateVrfChallengeOnce(inputData) {
-		return generateVrfChallengeOnce(this.getHandlerContext(), inputData);
-	}
-	/**
-	* Get current VRF session status
-	*/
-	async checkVrfStatus() {
-		return checkVrfStatus(this.getHandlerContext());
-	}
-	/**
-	* Logout and clear VRF session
-	*/
-	async clearVrfSession() {
-		return clearVrfSession(this.getHandlerContext());
-	}
-	/**
-	* Set the current VRF account ID at the TypeScript level
-	* Used after VRF keypair is loaded in WASM memory (e.g., after deriveVrfKeypairFromPrf)
-	* to track which account has an active VRF session
-	*/
-	setCurrentVrfAccountId(nearAccountId) {
-		this.currentVrfAccountId = nearAccountId;
-		console.debug(`VRF Manager: Current VRF account ID set to ${nearAccountId}`);
-	}
-	/**
-	* Generate VRF keypair for bootstrapping - stores in memory unencrypted temporarily
-	* This is used during registration to generate a VRF keypair that will be used for
-	* WebAuthn ceremony and later encrypted with the real PRF output
-	*
-	* @param saveInMemory - Always true for bootstrap (VRF keypair stored in memory)
-	* @param vrfInputParams - Optional parameters to generate VRF challenge/proof in same call
-	* @returns VRF public key and optionally VRF challenge data
-	*/
-	async generateVrfKeypairBootstrap(args) {
-		return generateVrfKeypairBootstrap(this.getHandlerContext(), args);
-	}
-	/**
-	* Derive deterministic VRF keypair from PRF output embedded in a WebAuthn credential.
-	* Optionally generates VRF challenge if input parameters are provided
-	* This enables deterministic VRF key derivation without needing stored VRF keypairs
-	*
-	* @param credential - WebAuthn credential containing PRF outputs
-	* @param nearAccountId - NEAR account ID for key derivation salt
-	* @param vrfInputParams - Optional VRF input parameters for challenge generation
-	* @returns Deterministic VRF public key, optional VRF challenge, and encrypted VRF keypair for storage
-	*/
-	async deriveVrfKeypairFromPrf(args) {
-		return deriveVrfKeypairFromPrf(this.getHandlerContext(), args);
-	}
-	/**
-	* This securely decrypts the shamir3Pass encrypted VRF keypair and loads it into memory
-	* It performs Shamir-3-Pass commutative decryption within WASM worker with the relay-server
-	*/
-	async shamir3PassDecryptVrfKeypair(args) {
-		return shamir3PassDecryptVrfKeypair(this.getHandlerContext(), args);
-	}
-	/**
-	* Shamir 3-pass: encrypt the currently unlocked VRF keypair under the server key
-	* Returns a fresh serverEncryptedVrfKeypair blob for IndexedDB.
-	* Requires: current VRF keypair is unlocked and present in worker memory.
-	*/
-	async shamir3PassEncryptCurrentVrfKeypair() {
-		return shamir3PassEncryptCurrentVrfKeypair(this.getHandlerContext());
-	}
-	/**
-	* Test Web Worker communication
-	*/
-	async testWebWorkerCommunication() {
-		try {
-			const timeoutMs = 2e3;
-			const pingResponse = await this.sendMessage({
-				type: "PING",
-				id: this.generateMessageId(),
-				payload: {}
-			}, timeoutMs);
-			if (!pingResponse.success) throw new Error(`VRF Web Worker PING failed: ${pingResponse.error}`);
-			return;
-		} catch (error) {
-			console.warn(`️VRF Manager: testWebWorkerCommunication failed:`, error.message);
-		}
-	}
-};
-
-//#endregion
-export { VrfWorkerManager };
-//# sourceMappingURL=index.js.map

package/dist/esm/react/sdk/src/core/WebAuthnManager/VrfWorkerManager/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","names":["error: any"],"sources":["../../../../../../../../src/core/WebAuthnManager/VrfWorkerManager/index.ts"],"sourcesContent":["/**\n * VRF Manager\n * Uses Web Workers for VRF keypair management with client-hosted worker files.\n */\n\nimport type {\n  VRFWorkerStatus,\n  VrfWorkerManagerConfig,\n  EncryptedVRFKeypair,\n  VRFInputData,\n  VRFWorkerMessage,\n  VRFWorkerResponse,\n  ServerEncryptedVrfKeypair,\n  WasmVrfWorkerRequestType,\n  WasmShamir3PassConfigPRequest,\n  WasmShamir3PassConfigServerUrlsRequest,\n} from '../../types/vrf-worker';\nimport type { VRFChallenge } from '../../types/vrf-worker';\nimport { BUILD_PATHS } from '../../../../build-paths.js';\nimport { resolveWorkerUrl } from '../../sdkPaths';\nimport type { AccountId } from '../../types/accountIds';\nimport type { TouchIdPrompt } from '../touchIdPrompt';\nimport type { NearClient } from '../../NearClient';\nimport type { UnifiedIndexedDBManager } from '../../IndexedDBManager';\nimport type { UserPreferencesManager } from '../userPreferences';\nimport type { NonceManager } from '../../nonceManager';\nimport {\n  SecureConfirmMessageType,\n  type SecureConfirmRequest,\n  type SerializableCredential,\n} from './confirmTxFlow/types';\nimport type { TransactionInputWasm } from '../../types/actions';\nimport type { RpcCallPayload, ConfirmationConfig } from '../../types/signer-worker';\nimport type { TransactionContext } from '../../types/rpc';\nimport type { RegistrationCredentialConfirmationPayload } from '../SignerWorkerManager/handlers/validation';\nimport type { WebAuthnAuthenticationCredential, WebAuthnRegistrationCredential } from '../../types/webauthn';\nimport { handlePromptUserConfirmInJsMainThread } from './confirmTxFlow';\nimport type { VrfWorkerManagerHandlerContext } from './handlers/types';\nimport {\n  checkVrfStatus,\n  clearSession,\n  clearVrfSession,\n  confirmAndDeriveDevice2RegistrationSession,\n  confirmAndPrepareSigningSession,\n  createSigningSessionChannel,\n  deriveVrfKeypairFromPrf,\n  mintSessionKeysAndSendToSigner,\n  dispenseSessionKey,\n  generateVrfChallengeForSession,\n  generateVrfChallengeOnce,\n  generateVrfKeypairBootstrap,\n  checkSessionStatus,\n  prepareDecryptSession,\n  requestRegistrationCredentialConfirmation,\n  shamir3PassDecryptVrfKeypair,\n  shamir3PassEncryptCurrentVrfKeypair,\n  unlockVrfKeypair,\n} from './handlers';\n\n/**\n * VRF-owned host context passed into confirmTxFlow.\n */\nexport interface VrfWorkerManagerContext {\n  touchIdPrompt: TouchIdPrompt;\n  nearClient: NearClient;\n  indexedDB: UnifiedIndexedDBManager;\n  userPreferencesManager: UserPreferencesManager;\n  nonceManager: NonceManager;\n  rpIdOverride?: string;\n  nearExplorerUrl?: string;\n  vrfWorkerManager?: SessionVrfWorkerManager;\n}\n\n/**\n * Narrow VRF manager surface used by confirmTxFlow. This interface only exposes\n * session-bound operations so confirm flows cannot accidentally call the\n * low-level helpers that take an optional sessionId.\n */\nexport interface SessionVrfWorkerManager {\n  generateVrfKeypairBootstrap(args: {\n    vrfInputData: VRFInputData;\n    saveInMemory: boolean;\n    sessionId: string;\n  }): Promise<{\n    vrfPublicKey: string;\n    vrfChallenge: VRFChallenge;\n  }>;\n\n  generateVrfChallengeForSession(inputData: VRFInputData, sessionId: string): Promise<VRFChallenge>;\n\n  mintSessionKeysAndSendToSigner(args: {\n    sessionId: string;\n    wrapKeySalt?: string;\n    contractId?: string;\n    nearRpcUrl?: string;\n    ttlMs?: number;\n    remainingUses?: number;\n    credential: WebAuthnRegistrationCredential | WebAuthnAuthenticationCredential;\n  }): Promise<{ sessionId: string; wrapKeySalt: string }>;\n\n  dispenseSessionKey(args: {\n    sessionId: string;\n    uses?: number;\n  }): Promise<{\n    sessionId: string;\n    remainingUses?: number;\n    expiresAtMs?: number;\n  }>;\n\n  prepareDecryptSession(args: {\n    sessionId: string;\n    nearAccountId: AccountId;\n    wrapKeySalt: string;\n    encryptedVrfKeypair?: EncryptedVRFKeypair;\n    expectedVrfPublicKey?: string;\n  }): Promise<void>;\n\n  requestRegistrationCredentialConfirmation(params: {\n    nearAccountId: string;\n    deviceNumber: number;\n    confirmerText?: { title?: string; body?: string };\n    confirmationConfigOverride?: Partial<ConfirmationConfig>;\n    contractId: string;\n    nearRpcUrl: string;\n  }): Promise<RegistrationCredentialConfirmationPayload>;\n\n  confirmAndDeriveDevice2RegistrationSession(params: {\n    sessionId: string;\n    nearAccountId: AccountId;\n    deviceNumber: number;\n    contractId: string;\n    nearRpcUrl: string;\n    authenticatorOptions?: object;\n    wrapKeySalt?: string;\n  }): Promise<{\n    confirmed: boolean;\n    sessionId: string;\n    credential: WebAuthnRegistrationCredential;\n    vrfChallenge: VRFChallenge;\n    transactionContext: TransactionContext;\n    wrapKeySalt: string;\n    requestId: string;\n    intentDigest: string;\n    deterministicVrfPublicKey: string;\n    encryptedVrfKeypair: EncryptedVRFKeypair;\n    error?: string;\n  }>;\n\n  checkVrfStatus(): Promise<VRFWorkerStatus>;\n}\n\n/**\n * VRF Worker Manager\n *\n * This class manages VRF operations using Web Workers for:\n * - VRF keypair unlocking (login)\n * - VRF challenge generation (authentication)\n * - Session management (browser session only)\n * - Client-hosted worker files\n */\nexport class VrfWorkerManager {\n  private vrfWorker: Worker | null = null;\n  private initializationPromise: Promise<void> | null = null;\n  private messageId = 0;\n  private config: VrfWorkerManagerConfig;\n  private currentVrfAccountId: string | null = null;\n  private workerBaseOrigin: string | undefined;\n  private context: VrfWorkerManagerContext;\n\n  constructor(config: VrfWorkerManagerConfig, context: VrfWorkerManagerContext) {\n    this.config = {\n      // Default to client-hosted worker file using centralized config\n      vrfWorkerUrl: BUILD_PATHS.RUNTIME.VRF_WORKER,\n      workerTimeout: 60_000,\n      debug: false,\n      ...config\n    };\n    // Attach a self-reference so confirmTxFlow helpers can call back into VRF APIs.\n    this.context = {\n      ...context,\n      vrfWorkerManager: this,\n    };\n  }\n\n  /**\n   * Context used by confirmTxFlow for VRF-driven flows.\n   */\n  getContext(): VrfWorkerManagerContext {\n    return this.context;\n  }\n\n  private getHandlerContext(): VrfWorkerManagerHandlerContext {\n    return {\n      ensureWorkerReady: this.ensureWorkerReady.bind(this),\n      sendMessage: this.sendMessage.bind(this),\n      generateMessageId: this.generateMessageId.bind(this),\n      getContext: this.getContext.bind(this),\n      postToWorker: (message: unknown, transfer?: Transferable[]) => {\n        if (!this.vrfWorker) {\n          throw new Error('VRF Web Worker not available');\n        }\n        this.vrfWorker.postMessage(message, transfer as any);\n      },\n      getCurrentVrfAccountId: () => this.currentVrfAccountId,\n      setCurrentVrfAccountId: (next: string | null) => {\n        this.currentVrfAccountId = next;\n      },\n    };\n  }\n\n  /**\n   * Create a VRF-owned MessageChannel for signing and return the signer-facing port.\n   * VRF retains the sibling port for WrapKeySeed delivery.\n   */\n  async createSigningSessionChannel(sessionId: string): Promise<MessagePort> {\n    return createSigningSessionChannel(this.getHandlerContext(), sessionId);\n  }\n\n  /**\n   * Derive WrapKeySeed in the VRF worker and deliver it (along with PRF.second if credential provided)\n   * to the signer worker via the registered port.\n   */\n  async mintSessionKeysAndSendToSigner(args: {\n    sessionId: string;\n    // Optional vault wrapKeySalt. When omitted or empty, VRF worker will generate a fresh wrapKeySalt.\n    wrapKeySalt?: string;\n    // Optional contract verification context; when provided, VRF Rust will call\n    // verify_authentication_response before deriving WrapKeySeed.\n    contractId?: string;\n    nearRpcUrl?: string;\n    // Optional signing-session config. When omitted, VRF worker uses defaults.\n    ttlMs?: number;\n    remainingUses?: number;\n    // Optional credential for PRF.second extraction (registration or authentication)\n    credential: WebAuthnRegistrationCredential | WebAuthnAuthenticationCredential;\n  }): Promise<{ sessionId: string; wrapKeySalt: string }> {\n    return mintSessionKeysAndSendToSigner(this.getHandlerContext(), args);\n  }\n\n  /**\n   * Dispense an existing VRF-owned session key (WrapKeySeed + wrapKeySalt) over the\n   * attached MessagePort for `sessionId`, enforcing TTL/usage in the VRF worker.\n   *\n   * This is the primitive needed for \"warm\" signing sessions: 1 VRF worker → N one-shot signer workers.\n   */\n  async dispenseSessionKey(args: {\n    sessionId: string;\n    uses?: number;\n  }): Promise<{\n    sessionId: string;\n    remainingUses?: number;\n    expiresAtMs?: number;\n  }> {\n    return dispenseSessionKey(this.getHandlerContext(), args);\n  }\n\n  /**\n   * Query VRF-owned signing session status for UI introspection.\n   * This does not prompt and does not reveal secrets; it only returns metadata.\n   */\n  async checkSessionStatus(args: {\n    sessionId: string;\n  }): Promise<{\n    sessionId: string;\n    status: 'active' | 'exhausted' | 'expired' | 'not_found';\n    remainingUses?: number;\n    expiresAtMs?: number;\n    createdAtMs?: number;\n  }> {\n    return checkSessionStatus(this.getHandlerContext(), args);\n  }\n\n  /**\n   * Clear VRF-owned signing session material for a given `sessionId`.\n   * Intended for explicit \"Lock\" actions or lifecycle cleanup.\n   */\n  async clearSession(args: {\n    sessionId: string;\n  }): Promise<{\n    sessionId: string;\n    clearedSession: boolean;\n    clearedChallenge: boolean;\n    clearedPort: boolean;\n  }> {\n    return clearSession(this.getHandlerContext(), args);\n  }\n\n  /**\n   * VRF-driven decrypt session for export flows.\n   * Kicks off a LocalOnly DECRYPT_PRIVATE_KEY_WITH_PRF confirm via VRF Rust and derives\n   * WrapKeySeed using the vault-provided wrapKeySalt. WrapKeySeed + wrapKeySalt are sent to the signer over\n   * the dedicated MessagePort for the given sessionId.\n   */\n  async prepareDecryptSession(args: {\n    sessionId: string;\n    nearAccountId: AccountId;\n    wrapKeySalt: string;\n    encryptedVrfKeypair?: EncryptedVRFKeypair;\n    expectedVrfPublicKey?: string;\n  }): Promise<void> {\n    return prepareDecryptSession(this.getHandlerContext(), args);\n  }\n\n  /**\n   * VRF-driven confirmation + WrapKeySeed derivation for signing flows.\n   * Runs confirmTxFlow on the main thread, derives WrapKeySeed in the VRF worker, and returns\n   * the session metadata needed by the signer worker. WrapKeySeed itself travels only over the\n   * reserved MessagePort registered via registerSignerWrapKeySeedPort.\n   */\n  async confirmAndPrepareSigningSession(params: {\n    ctx: VrfWorkerManagerContext;\n    sessionId: string;\n    kind: 'transaction';\n    txSigningRequests: TransactionInputWasm[];\n    rpcCall: RpcCallPayload;\n    title?: string;\n    body?: string;\n    confirmationConfigOverride?: Partial<ConfirmationConfig>;\n  } | {\n    ctx: VrfWorkerManagerContext;\n    sessionId: string;\n    kind: 'delegate';\n    nearAccountId: string;\n    title?: string;\n    body?: string;\n    delegate: {\n      senderId: string;\n      receiverId: string;\n      actions: TransactionInputWasm['actions'];\n      nonce: string | number | bigint;\n      maxBlockHeight: string | number | bigint;\n    };\n    rpcCall: RpcCallPayload;\n    confirmationConfigOverride?: Partial<ConfirmationConfig>;\n  } | {\n    ctx: VrfWorkerManagerContext;\n    sessionId: string;\n    kind: 'nep413';\n    nearAccountId: string;\n    message: string;\n    recipient: string;\n    title?: string;\n    body?: string;\n    contractId?: string;\n    nearRpcUrl?: string;\n    confirmationConfigOverride?: Partial<ConfirmationConfig>;\n  }): Promise<{\n    sessionId: string;\n    transactionContext: TransactionContext;\n    intentDigest: string;\n    credential?: SerializableCredential;\n  }> {\n    return confirmAndPrepareSigningSession(this.getHandlerContext(), params);\n  }\n\n  /**\n   * VRF-driven helper for registration confirmation.\n   * Runs confirmTxFlow on the main thread and returns registration artifacts.\n   * WrapKeySeed derivation is handled later when we call into signing/derivation\n   * flows with PRF + withSigningSession.\n   */\n  async requestRegistrationCredentialConfirmation(params: {\n    nearAccountId: string;\n    deviceNumber: number;\n    confirmerText?: { title?: string; body?: string };\n    confirmationConfigOverride?: Partial<ConfirmationConfig>;\n    contractId: string;\n    nearRpcUrl: string;\n  }): Promise<RegistrationCredentialConfirmationPayload> {\n    return requestRegistrationCredentialConfirmation(this.getHandlerContext(), params);\n  }\n\n  /**\n   * Combined Device2 registration session: single WebAuthn ceremony for credential + WrapKeySeed derivation.\n   *\n   * This method orchestrates the complete Device2 registration flow:\n   * 1. Runs a VRF-driven registration confirmation (single TouchID prompt)\n   * 2. Extracts PRF.first from the credential and derives WrapKeySeed\n   * 3. Sends WrapKeySeed to signer worker via MessagePort (never exposed to JS)\n   * 4. Returns credential (with PRF.second embedded), vrfChallenge, transactionContext, wrapKeySalt\n   *\n   * The signer worker can then use PRF.second for NEAR key derivation and WrapKeySeed for encryption.\n   */\n  async confirmAndDeriveDevice2RegistrationSession(params: {\n    sessionId: string;\n    nearAccountId: AccountId;\n    deviceNumber: number;\n    contractId: string;\n    nearRpcUrl: string;\n    authenticatorOptions?: object;\n    wrapKeySalt?: string;\n  }): Promise<{\n    confirmed: boolean;\n    sessionId: string;\n    credential: WebAuthnRegistrationCredential;\n    vrfChallenge: VRFChallenge;\n    transactionContext: TransactionContext;\n    wrapKeySalt: string;\n    requestId: string;\n    intentDigest: string;\n    deterministicVrfPublicKey: string;\n    encryptedVrfKeypair: EncryptedVRFKeypair;\n    error?: string;\n  }> {\n    return confirmAndDeriveDevice2RegistrationSession(this.getHandlerContext(), params);\n  }\n\n  setWorkerBaseOrigin(origin: string | undefined): void {\n    this.workerBaseOrigin = origin;\n  }\n\n  /**\n   * Ensure VRF worker is ready for operations\n   * @param requireHealthCheck - Whether to perform health check after initialization\n   */\n  private async ensureWorkerReady(requireHealthCheck = false): Promise<void> {\n    if (this.initializationPromise) {\n      await this.initializationPromise;\n    } else if (!this.vrfWorker) {\n      await this.initialize();\n    }\n    if (!this.vrfWorker) {\n      throw new Error('VRF Worker failed to initialize');\n    }\n    // Optional health check for critical operations\n    if (requireHealthCheck) {\n      try {\n        const healthResponse = await this.sendMessage({\n          type: 'PING',\n          id: this.generateMessageId(),\n          payload: {} as WasmVrfWorkerRequestType\n        }, 3000);\n\n        if (!healthResponse.success) {\n          throw new Error('VRF Worker failed health check');\n        }\n      } catch (error) {\n        console.error('VRF Manager: Health check failed:', error);\n        throw new Error('VRF Worker failed health check');\n      }\n    }\n  }\n\n  /**\n   * Initialize VRF functionality using Web Workers\n   */\n  async initialize(): Promise<void> {\n    if (this.initializationPromise) {\n      return this.initializationPromise;\n    }\n    // =============================================================\n    // This improved error handling ensures that:\n    // 1. Initialization failures are properly logged with full details\n    // 2. Errors are re-thrown to callers (no silent swallowing)\n    // 3. Failed initialization promise is reset for retry\n    // 4. Debug logs actually appear in test output\n    this.initializationPromise = this.createVrfWorker().catch(error => {\n      console.error('VRF Manager: Initialization failed:', error);\n      console.error('VRF Manager: Error details:', {\n        message: error.message,\n        stack: error.stack,\n        name: error.name\n      });\n      // Reset promise so initialization can be retried\n      this.initializationPromise = null;\n      throw error; // Re-throw so callers know it failed\n    });\n\n    const result = await this.initializationPromise;\n    return result;\n  }\n\n  /**\n   * Initialize Web Worker with client-hosted VRF worker\n   */\n  private async createVrfWorker(): Promise<void> {\n    try {\n      const relativePath = this.config.vrfWorkerUrl || BUILD_PATHS.RUNTIME.VRF_WORKER;\n      const vrfUrlStr = resolveWorkerUrl(relativePath, { worker: 'vrf', baseOrigin: this.workerBaseOrigin })\n      console.debug('VRF Manager: Worker URL:', vrfUrlStr);\n      // Create Web Worker from resolved URL\n      this.vrfWorker = new Worker(vrfUrlStr, {\n        type: 'module',\n        name: 'Web3AuthnVRFWorker'\n      });\n      // Set up error handling\n      this.vrfWorker.onerror = (error) => {\n        console.error('VRF Manager: Web Worker error:', error);\n      };\n      // Test communication with the Web Worker\n      await this.testWebWorkerCommunication();\n\n      // Configure Shamir P if provided\n      if (this.config.shamirPB64u) {\n        const resp = await this.sendMessage<WasmShamir3PassConfigPRequest>({\n          type: 'SHAMIR3PASS_CONFIG_P',\n          id: this.generateMessageId(),\n          payload: { p_b64u: this.config.shamirPB64u }\n        });\n        if (!resp.success) {\n          throw new Error(`Failed to configure Shamir P: ${resp.error}`);\n        }\n      }\n\n      // Configure relay server URLs if provided\n      if (this.config.relayServerUrl && this.config.applyServerLockRoute && this.config.removeServerLockRoute) {\n        const resp2 = await this.sendMessage<WasmShamir3PassConfigServerUrlsRequest>({\n          type: 'SHAMIR3PASS_CONFIG_SERVER_URLS',\n          id: this.generateMessageId(),\n          payload: {\n            relayServerUrl: this.config.relayServerUrl,\n            applyLockRoute: this.config.applyServerLockRoute,\n            removeLockRoute: this.config.removeServerLockRoute,\n          }\n        });\n        if (!resp2.success) {\n          throw new Error(`Failed to configure Shamir server URLs: ${resp2.error}`);\n        }\n      }\n\n    } catch (error: any) {\n      throw new Error(`VRF Web Worker initialization failed: ${error.message}`);\n    }\n  }\n\n  /**\n   * Send message to Web Worker and wait for response\n   */\n  private async sendMessage<T extends WasmVrfWorkerRequestType>(\n    message: VRFWorkerMessage<T>,\n    customTimeout?: number\n  ): Promise<VRFWorkerResponse> {\n    return new Promise((resolve, reject) => {\n      if (!this.vrfWorker) {\n        reject(new Error('VRF Web Worker not available'));\n        return;\n      }\n\n      const timeoutMs = (customTimeout ?? this.config.workerTimeout ?? 60_000);\n      const timeout = setTimeout(() => {\n        reject(new Error(`VRF Web Worker communication timeout (${timeoutMs}ms) for message type: ${message.type}`));\n      }, timeoutMs);\n\n      const handleMessage = (event: MessageEvent) => {\n        const payload = event.data as VRFWorkerResponse | {\n          type?: unknown;\n          data?: unknown;\n        };\n\n        // Intercept SecureConfirm handshake messages from the VRF worker and\n        // dispatch them through confirmTxFlow on the main thread. The decision\n        // is sent back to the worker as USER_PASSKEY_CONFIRM_RESPONSE and\n        // consumed by awaitSecureConfirmationV2; this should not resolve the\n        // original VRF request promise.\n        if ((payload as any)?.type === SecureConfirmMessageType.PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD) {\n          const env = payload as {\n            type: SecureConfirmMessageType.PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD;\n            data: SecureConfirmRequest;\n          };\n          const ctx = this.getContext();\n          if (!this.vrfWorker) {\n            console.error('[VRF] SecureConfirm: vrfWorker missing for PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD');\n            return;\n          }\n          void handlePromptUserConfirmInJsMainThread(ctx, env, this.vrfWorker);\n          return;\n        }\n\n        const response = payload as VRFWorkerResponse;\n        if (response.id === message.id) {\n          clearTimeout(timeout);\n          this.vrfWorker!.removeEventListener('message', handleMessage);\n          resolve(response);\n        }\n      };\n\n      this.vrfWorker.addEventListener('message', handleMessage);\n      this.vrfWorker.postMessage(message);\n    });\n  }\n\n  /**\n   * Generate unique message ID\n   */\n  private generateMessageId(): string {\n    return `vrf_${Date.now()}_${++this.messageId}`;\n  }\n\n  /**\n   * Unlock VRF keypair in Web Worker memory using PRF output\n   * This is called during login to decrypt and load the VRF keypair in-memory\n   */\n  async unlockVrfKeypair(args: {\n    credential: WebAuthnAuthenticationCredential;\n    nearAccountId: AccountId;\n    encryptedVrfKeypair: EncryptedVRFKeypair;\n    onEvent?: (event: { type: string; data: { step: string; message: string } }) => void;\n  }): Promise<VRFWorkerResponse> {\n    return unlockVrfKeypair(this.getHandlerContext(), args);\n  }\n\n  async generateVrfChallengeForSession(inputData: VRFInputData, sessionId: string): Promise<VRFChallenge> {\n    return generateVrfChallengeForSession(this.getHandlerContext(), inputData, sessionId);\n  }\n\n  async generateVrfChallengeOnce(inputData: VRFInputData): Promise<VRFChallenge> {\n    return generateVrfChallengeOnce(this.getHandlerContext(), inputData);\n  }\n\n  /**\n   * Get current VRF session status\n   */\n  async checkVrfStatus(): Promise<VRFWorkerStatus> {\n    return checkVrfStatus(this.getHandlerContext());\n  }\n\n  /**\n   * Logout and clear VRF session\n   */\n  async clearVrfSession(): Promise<void> {\n    return clearVrfSession(this.getHandlerContext());\n  }\n\n  /**\n   * Set the current VRF account ID at the TypeScript level\n   * Used after VRF keypair is loaded in WASM memory (e.g., after deriveVrfKeypairFromPrf)\n   * to track which account has an active VRF session\n   */\n  setCurrentVrfAccountId(nearAccountId: AccountId): void {\n    this.currentVrfAccountId = nearAccountId;\n    console.debug(`VRF Manager: Current VRF account ID set to ${nearAccountId}`);\n  }\n\n  /**\n   * Generate VRF keypair for bootstrapping - stores in memory unencrypted temporarily\n   * This is used during registration to generate a VRF keypair that will be used for\n   * WebAuthn ceremony and later encrypted with the real PRF output\n   *\n   * @param saveInMemory - Always true for bootstrap (VRF keypair stored in memory)\n   * @param vrfInputParams - Optional parameters to generate VRF challenge/proof in same call\n   * @returns VRF public key and optionally VRF challenge data\n   */\n  async generateVrfKeypairBootstrap(args: {\n    vrfInputData: VRFInputData;\n    saveInMemory: boolean;\n    sessionId?: string;\n  }): Promise<{\n    vrfPublicKey: string;\n    vrfChallenge: VRFChallenge;\n  }> {\n    return generateVrfKeypairBootstrap(this.getHandlerContext(), args);\n  }\n\n  /**\n   * Derive deterministic VRF keypair from PRF output embedded in a WebAuthn credential.\n   * Optionally generates VRF challenge if input parameters are provided\n   * This enables deterministic VRF key derivation without needing stored VRF keypairs\n   *\n   * @param credential - WebAuthn credential containing PRF outputs\n   * @param nearAccountId - NEAR account ID for key derivation salt\n   * @param vrfInputParams - Optional VRF input parameters for challenge generation\n   * @returns Deterministic VRF public key, optional VRF challenge, and encrypted VRF keypair for storage\n   */\n  async deriveVrfKeypairFromPrf(args: {\n    credential: WebAuthnRegistrationCredential | WebAuthnAuthenticationCredential;\n    nearAccountId: AccountId;\n    vrfInputData?: VRFInputData; // optional, for challenge generation\n    saveInMemory?: boolean; // optional, whether to save in worker memory\n  }): Promise<{\n    vrfPublicKey: string;\n    vrfChallenge: VRFChallenge | null;\n    encryptedVrfKeypair: EncryptedVRFKeypair;\n    serverEncryptedVrfKeypair: ServerEncryptedVrfKeypair | null;\n  }> {\n    return deriveVrfKeypairFromPrf(this.getHandlerContext(), args);\n  }\n\n  /**\n   * This securely decrypts the shamir3Pass encrypted VRF keypair and loads it into memory\n   * It performs Shamir-3-Pass commutative decryption within WASM worker with the relay-server\n   */\n  async shamir3PassDecryptVrfKeypair(args: {\n    nearAccountId: AccountId;\n    kek_s_b64u: string;\n    ciphertextVrfB64u: string;\n    serverKeyId: string;\n  }): Promise<VRFWorkerResponse> {\n    return shamir3PassDecryptVrfKeypair(this.getHandlerContext(), args);\n  }\n\n  /**\n   * Shamir 3-pass: encrypt the currently unlocked VRF keypair under the server key\n   * Returns a fresh serverEncryptedVrfKeypair blob for IndexedDB.\n   * Requires: current VRF keypair is unlocked and present in worker memory.\n   */\n  async shamir3PassEncryptCurrentVrfKeypair(): Promise<{\n    ciphertextVrfB64u: string;\n    kek_s_b64u: string;\n    serverKeyId: string;\n  }> {\n    return shamir3PassEncryptCurrentVrfKeypair(this.getHandlerContext());\n  }\n\n  /**\n   * Test Web Worker communication\n   */\n  private async testWebWorkerCommunication(): Promise<void> {\n    try {\n      const timeoutMs = 2000;\n      const pingResponse = await this.sendMessage({\n        type: 'PING',\n        id: this.generateMessageId(),\n        payload: {} as WasmVrfWorkerRequestType\n      }, timeoutMs);\n      if (!pingResponse.success) {\n        throw new Error(`VRF Web Worker PING failed: ${pingResponse.error}`);\n      }\n      return;\n    } catch (error: any) {\n      console.warn(`️VRF Manager: testWebWorkerCommunication failed:`, error.message);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgKA,IAAa,mBAAb,MAA8B;CAC5B,AAAQ,YAA2B;CACnC,AAAQ,wBAA8C;CACtD,AAAQ,YAAY;CACpB,AAAQ;CACR,AAAQ,sBAAqC;CAC7C,AAAQ;CACR,AAAQ;CAER,YAAY,QAAgC,SAAkC;AAC5E,OAAK,SAAS;GAEZ,cAAc,YAAY,QAAQ;GAClC,eAAe;GACf,OAAO;GACP,GAAG;;AAGL,OAAK,UAAU;GACb,GAAG;GACH,kBAAkB;;;;;;CAOtB,aAAsC;AACpC,SAAO,KAAK;;CAGd,AAAQ,oBAAoD;AAC1D,SAAO;GACL,mBAAmB,KAAK,kBAAkB,KAAK;GAC/C,aAAa,KAAK,YAAY,KAAK;GACnC,mBAAmB,KAAK,kBAAkB,KAAK;GAC/C,YAAY,KAAK,WAAW,KAAK;GACjC,eAAe,SAAkB,aAA8B;AAC7D,QAAI,CAAC,KAAK,UACR,OAAM,IAAI,MAAM;AAElB,SAAK,UAAU,YAAY,SAAS;;GAEtC,8BAA8B,KAAK;GACnC,yBAAyB,SAAwB;AAC/C,SAAK,sBAAsB;;;;;;;;CASjC,MAAM,4BAA4B,WAAyC;AACzE,SAAO,4BAA4B,KAAK,qBAAqB;;;;;;CAO/D,MAAM,+BAA+B,MAamB;AACtD,SAAO,+BAA+B,KAAK,qBAAqB;;;;;;;;CASlE,MAAM,mBAAmB,MAOtB;AACD,SAAO,mBAAmB,KAAK,qBAAqB;;;;;;CAOtD,MAAM,mBAAmB,MAQtB;AACD,SAAO,mBAAmB,KAAK,qBAAqB;;;;;;CAOtD,MAAM,aAAa,MAOhB;AACD,SAAO,aAAa,KAAK,qBAAqB;;;;;;;;CAShD,MAAM,sBAAsB,MAMV;AAChB,SAAO,sBAAsB,KAAK,qBAAqB;;;;;;;;CASzD,MAAM,gCAAgC,QA0CnC;AACD,SAAO,gCAAgC,KAAK,qBAAqB;;;;;;;;CASnE,MAAM,0CAA0C,QAOO;AACrD,SAAO,0CAA0C,KAAK,qBAAqB;;;;;;;;;;;;;CAc7E,MAAM,2CAA2C,QAoB9C;AACD,SAAO,2CAA2C,KAAK,qBAAqB;;CAG9E,oBAAoB,QAAkC;AACpD,OAAK,mBAAmB;;;;;;CAO1B,MAAc,kBAAkB,qBAAqB,OAAsB;AACzE,MAAI,KAAK,sBACP,OAAM,KAAK;WACF,CAAC,KAAK,UACf,OAAM,KAAK;AAEb,MAAI,CAAC,KAAK,UACR,OAAM,IAAI,MAAM;AAGlB,MAAI,mBACF,KAAI;GACF,MAAM,iBAAiB,MAAM,KAAK,YAAY;IAC5C,MAAM;IACN,IAAI,KAAK;IACT,SAAS;MACR;AAEH,OAAI,CAAC,eAAe,QAClB,OAAM,IAAI,MAAM;WAEX,OAAO;AACd,WAAQ,MAAM,qCAAqC;AACnD,SAAM,IAAI,MAAM;;;;;;CAQtB,MAAM,aAA4B;AAChC,MAAI,KAAK,sBACP,QAAO,KAAK;AAQd,OAAK,wBAAwB,KAAK,kBAAkB,OAAM,UAAS;AACjE,WAAQ,MAAM,uCAAuC;AACrD,WAAQ,MAAM,+BAA+B;IAC3C,SAAS,MAAM;IACf,OAAO,MAAM;IACb,MAAM,MAAM;;AAGd,QAAK,wBAAwB;AAC7B,SAAM;;EAGR,MAAM,SAAS,MAAM,KAAK;AAC1B,SAAO;;;;;CAMT,MAAc,kBAAiC;AAC7C,MAAI;GACF,MAAM,eAAe,KAAK,OAAO,gBAAgB,YAAY,QAAQ;GACrE,MAAM,YAAY,iBAAiB,cAAc;IAAE,QAAQ;IAAO,YAAY,KAAK;;AACnF,WAAQ,MAAM,4BAA4B;AAE1C,QAAK,YAAY,IAAI,OAAO,WAAW;IACrC,MAAM;IACN,MAAM;;AAGR,QAAK,UAAU,WAAW,UAAU;AAClC,YAAQ,MAAM,kCAAkC;;AAGlD,SAAM,KAAK;AAGX,OAAI,KAAK,OAAO,aAAa;IAC3B,MAAM,OAAO,MAAM,KAAK,YAA2C;KACjE,MAAM;KACN,IAAI,KAAK;KACT,SAAS,EAAE,QAAQ,KAAK,OAAO;;AAEjC,QAAI,CAAC,KAAK,QACR,OAAM,IAAI,MAAM,iCAAiC,KAAK;;AAK1D,OAAI,KAAK,OAAO,kBAAkB,KAAK,OAAO,wBAAwB,KAAK,OAAO,uBAAuB;IACvG,MAAM,QAAQ,MAAM,KAAK,YAAoD;KAC3E,MAAM;KACN,IAAI,KAAK;KACT,SAAS;MACP,gBAAgB,KAAK,OAAO;MAC5B,gBAAgB,KAAK,OAAO;MAC5B,iBAAiB,KAAK,OAAO;;;AAGjC,QAAI,CAAC,MAAM,QACT,OAAM,IAAI,MAAM,2CAA2C,MAAM;;WAI9DA,OAAY;AACnB,SAAM,IAAI,MAAM,yCAAyC,MAAM;;;;;;CAOnE,MAAc,YACZ,SACA,eAC4B;AAC5B,SAAO,IAAI,SAAS,SAAS,WAAW;AACtC,OAAI,CAAC,KAAK,WAAW;AACnB,2BAAO,IAAI,MAAM;AACjB;;GAGF,MAAM,YAAa,iBAAiB,KAAK,OAAO,iBAAiB;GACjE,MAAM,UAAU,iBAAiB;AAC/B,2BAAO,IAAI,MAAM,yCAAyC,UAAU,wBAAwB,QAAQ;MACnG;GAEH,MAAM,iBAAiB,UAAwB;IAC7C,MAAM,UAAU,MAAM;AAUtB,QAAK,SAAiB,SAAS,yBAAyB,uCAAuC;KAC7F,MAAM,MAAM;KAIZ,MAAM,MAAM,KAAK;AACjB,SAAI,CAAC,KAAK,WAAW;AACnB,cAAQ,MAAM;AACd;;AAEF,KAAK,sCAAsC,KAAK,KAAK,KAAK;AAC1D;;IAGF,MAAM,WAAW;AACjB,QAAI,SAAS,OAAO,QAAQ,IAAI;AAC9B,kBAAa;AACb,UAAK,UAAW,oBAAoB,WAAW;AAC/C,aAAQ;;;AAIZ,QAAK,UAAU,iBAAiB,WAAW;AAC3C,QAAK,UAAU,YAAY;;;;;;CAO/B,AAAQ,oBAA4B;AAClC,SAAO,OAAO,KAAK,MAAM,GAAG,EAAE,KAAK;;;;;;CAOrC,MAAM,iBAAiB,MAKQ;AAC7B,SAAO,iBAAiB,KAAK,qBAAqB;;CAGpD,MAAM,+BAA+B,WAAyB,WAA0C;AACtG,SAAO,+BAA+B,KAAK,qBAAqB,WAAW;;CAG7E,MAAM,yBAAyB,WAAgD;AAC7E,SAAO,yBAAyB,KAAK,qBAAqB;;;;;CAM5D,MAAM,iBAA2C;AAC/C,SAAO,eAAe,KAAK;;;;;CAM7B,MAAM,kBAAiC;AACrC,SAAO,gBAAgB,KAAK;;;;;;;CAQ9B,uBAAuB,eAAgC;AACrD,OAAK,sBAAsB;AAC3B,UAAQ,MAAM,8CAA8C;;;;;;;;;;;CAY9D,MAAM,4BAA4B,MAO/B;AACD,SAAO,4BAA4B,KAAK,qBAAqB;;;;;;;;;;;;CAa/D,MAAM,wBAAwB,MAU3B;AACD,SAAO,wBAAwB,KAAK,qBAAqB;;;;;;CAO3D,MAAM,6BAA6B,MAKJ;AAC7B,SAAO,6BAA6B,KAAK,qBAAqB;;;;;;;CAQhE,MAAM,sCAIH;AACD,SAAO,oCAAoC,KAAK;;;;;CAMlD,MAAc,6BAA4C;AACxD,MAAI;GACF,MAAM,YAAY;GAClB,MAAM,eAAe,MAAM,KAAK,YAAY;IAC1C,MAAM;IACN,IAAI,KAAK;IACT,SAAS;MACR;AACH,OAAI,CAAC,aAAa,QAChB,OAAM,IAAI,MAAM,+BAA+B,aAAa;AAE9D;WACOA,OAAY;AACnB,WAAQ,KAAK,oDAAoD,MAAM"}

package/dist/esm/react/sdk/src/core/WebAuthnManager/VrfWorkerManager/secureConfirmBridge.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"secureConfirmBridge.js","names":[],"sources":["../../../../../../../../src/core/WebAuthnManager/VrfWorkerManager/secureConfirmBridge.ts"],"sourcesContent":["import {\n  SecureConfirmMessageType,\n  SecureConfirmRequest,\n  SecureConfirmDecision,\n} from './confirmTxFlow/types';\nimport { handlePromptUserConfirmInJsMainThread } from './confirmTxFlow';\nimport type { VrfWorkerManagerContext } from '.';\n\n/**\n * VRF-side helper to run confirmTxFlow directly from JS without going through a worker.\n * Useful while VRF-driven flows migrate off the signer worker.\n *\n * Returns the USER_PASSKEY_CONFIRM_RESPONSE data once the flow completes.\n */\nexport async function runSecureConfirm(\n  ctx: VrfWorkerManagerContext,\n  request: SecureConfirmRequest\n): Promise<SecureConfirmDecision> {\n  return new Promise<SecureConfirmDecision>((resolve, reject) => {\n    // Minimal Worker-like object to capture the response\n    const worker = {\n      postMessage: (msg: any) => {\n        if (msg?.type === SecureConfirmMessageType.USER_PASSKEY_CONFIRM_RESPONSE) {\n          resolve(msg.data as SecureConfirmDecision);\n        }\n      }\n    } as unknown as Worker;\n\n    handlePromptUserConfirmInJsMainThread(\n      ctx,\n      { type: SecureConfirmMessageType.PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD, data: request },\n      worker\n    ).catch(reject);\n  });\n}\n"],"mappings":";;;;;;;;;;AAcA,eAAsB,iBACpB,KACA,SACgC;AAChC,QAAO,IAAI,SAAgC,SAAS,WAAW;EAE7D,MAAM,SAAS,EACb,cAAc,QAAa;AACzB,OAAI,KAAK,SAAS,yBAAyB,8BACzC,SAAQ,IAAI;;AAKlB,wCACE,KACA;GAAE,MAAM,yBAAyB;GAAuC,MAAM;KAC9E,QACA,MAAM"}

package/dist/esm/react/sdk/src/core/WebAuthnManager/WebAuthnFallbacks/index.js

@@ -1,12 +0,0 @@
-import { __esm } from "../../../../../_virtual/rolldown_runtime.js";
-import { WebAuthnBridgeMessage, executeWebAuthnWithParentFallbacksSafari, init_safari_fallbacks } from "./safari-fallbacks.js";
-
-//#region src/core/WebAuthnManager/WebAuthnFallbacks/index.ts
-var init_WebAuthnFallbacks = __esm({ "src/core/WebAuthnManager/WebAuthnFallbacks/index.ts": (() => {
-	init_safari_fallbacks();
-}) });
-
-//#endregion
-init_WebAuthnFallbacks();
-export { init_WebAuthnFallbacks };
-//# sourceMappingURL=index.js.map

package/dist/esm/react/sdk/src/core/WebAuthnManager/WebAuthnFallbacks/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../../../../../../src/core/WebAuthnManager/WebAuthnFallbacks/index.ts"],"sourcesContent":["export {\n  executeWebAuthnWithParentFallbacksSafari,\n  WebAuthnBridgeMessage,\n} from './safari-fallbacks';\n"],"mappings":""}

package/dist/esm/react/sdk/src/core/WebAuthnManager/WebAuthnFallbacks/safari-fallbacks.js

@@ -1,203 +0,0 @@
-import { __esm } from "../../../../../_virtual/rolldown_runtime.js";
-
-//#region src/core/WebAuthnManager/WebAuthnFallbacks/safari-fallbacks.ts
-function getResultTypeFor(kind) {
-	return kind === WebAuthnBridgeMessage.Get ? WebAuthnBridgeMessage.GetResult : WebAuthnBridgeMessage.CreateResult;
-}
-/**
-* Execute a WebAuthn operation with Safari-aware fallbacks.
-*
-* Steps:
-* 1) Try native WebAuthn via navigator.credentials.{create|get}
-* 2) If the failure matches Safari's ancestor-origin restriction and we are in an iframe,
-*    ask the parent/top-level window to perform the WebAuthn operation (bridge). If the
-*    parent reports a user cancellation, throw NotAllowedError; if it times out, continue.
-* 3) If the failure matches Safari's "document not focused" path, first attempt to refocus
-*    and retry native once; if still blocked and in an iframe, ask the parent window to handle it.
-* 4) Generic last resort: when in an iframe (constrained context), always attempt the parent
-*    WebAuthn once even if the error wasn't recognized as a Safari-specific case. If the parent
-*    path times out, surface a deterministic timeout error without re-trying native again.
-* 5) Otherwise, rethrow the original error.
-*/
-async function executeWebAuthnWithParentFallbacksSafari(kind, publicKey, deps) {
-	const { rpId, inIframe, timeoutMs = 6e4, permitGetBridgeOnAncestorError = true } = deps;
-	const bridgeClient = deps.bridgeClient || new WindowParentDomainWebAuthnClient();
-	const isTestForceNativeFail = () => {
-		const g = globalThis;
-		const w = typeof window !== "undefined" ? window : void 0;
-		return !!(g && g.__W3A_TEST_FORCE_NATIVE_FAIL) || !!(w && w.__W3A_TEST_FORCE_NATIVE_FAIL);
-	};
-	const bumpCounter = (key) => {
-		const g = globalThis;
-		g[key] = (g[key] || 0) + 1;
-	};
-	if (isTestForceNativeFail()) {
-		if (kind === "create") bumpCounter("__W3A_TEST_NATIVE_CREATE_ATTEMPTS");
-		else bumpCounter("__W3A_TEST_NATIVE_GET_ATTEMPTS");
-		try {
-			const bridged = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);
-			if (bridged?.ok) return bridged.credential;
-			if (bridged && !bridged.timeout) throw notAllowedError(bridged.error || "WebAuthn cancelled or failed (bridge)");
-			throw new Error("WebAuthn bridge timeout");
-		} catch (be) {
-			throw notAllowedError(be?.message || "WebAuthn bridge failed");
-		}
-	}
-	const tryNative = async () => {
-		if (kind === "create") {
-			bumpCounter("__W3A_TEST_NATIVE_CREATE_ATTEMPTS");
-			if (isTestForceNativeFail()) throw notAllowedError("Forced native fail (create)");
-			return await navigator.credentials.create({
-				publicKey,
-				...deps.abortSignal ? { signal: deps.abortSignal } : {}
-			});
-		} else {
-			bumpCounter("__W3A_TEST_NATIVE_GET_ATTEMPTS");
-			if (isTestForceNativeFail()) throw notAllowedError("Forced native fail (get)");
-			return await navigator.credentials.get({
-				publicKey,
-				...deps.abortSignal ? { signal: deps.abortSignal } : {}
-			});
-		}
-	};
-	try {
-		return await tryNative();
-	} catch (e) {
-		const name = safeName(e);
-		if (name === "NotAllowedError" && !isAncestorOriginError(e) && !isDocumentNotFocusedError(e)) throw e;
-		if (isAncestorOriginError(e) && inIframe) {
-			if (kind === "get" && !permitGetBridgeOnAncestorError) throw e;
-			try {
-				const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);
-				if (bridgedCredentials?.ok) return bridgedCredentials.credential;
-				if (bridgedCredentials && !bridgedCredentials.timeout) throw notAllowedError(bridgedCredentials.error || "WebAuthn get cancelled or failed (bridge)");
-			} catch (be) {
-				throw notAllowedError(be?.message || "WebAuthn bridge failed");
-			}
-		}
-		if (isDocumentNotFocusedError(e)) {
-			const focused = await attemptRefocus();
-			if (focused) try {
-				return await tryNative();
-			} catch {}
-			if (inIframe) try {
-				const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);
-				if (bridgedCredentials?.ok) return bridgedCredentials.credential;
-				if (bridgedCredentials && !bridgedCredentials.timeout) throw notAllowedError(bridgedCredentials.error || "WebAuthn get cancelled or failed (bridge)");
-			} catch (be) {
-				throw notAllowedError(be?.message || "WebAuthn bridge failed");
-			}
-		}
-		if (inIframe) try {
-			const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);
-			if (bridgedCredentials?.ok) return bridgedCredentials.credential;
-			if (bridgedCredentials && !bridgedCredentials.timeout) throw notAllowedError(bridgedCredentials.error || "WebAuthn cancelled or failed (bridge)");
-			throw new Error("WebAuthn bridge timeout");
-		} catch (be) {
-			throw notAllowedError(be?.message || "WebAuthn bridge failed");
-		}
-		throw e;
-	}
-}
-async function requestParentDomainWebAuthn(kind, publicKey, client, timeoutMs) {
-	if (kind === "create") return client.request(WebAuthnBridgeMessage.Create, publicKey, timeoutMs);
-	return client.request(WebAuthnBridgeMessage.Get, publicKey, timeoutMs);
-}
-function notAllowedError(message) {
-	const e = new Error(message);
-	e.name = "NotAllowedError";
-	return e;
-}
-function isAncestorOriginError(err) {
-	const msg = safeMessage(err);
-	return /origin of the document is not the same as its ancestors/i.test(msg);
-}
-function isDocumentNotFocusedError(err) {
-	const name = safeName(err);
-	const msg = safeMessage(err);
-	const isNotAllowed = name === "NotAllowedError";
-	const mentionsFocus = /document is not focused|not focused|focus/i.test(msg);
-	return Boolean(isNotAllowed && mentionsFocus);
-}
-function safeMessage(err) {
-	return String(err?.message || "");
-}
-function safeName(err) {
-	const n = err?.name;
-	return typeof n === "string" ? n : "";
-}
-async function attemptRefocus(maxRetries = 2, delays = [50, 120]) {
-	window.focus?.();
-	(document?.body)?.focus?.();
-	const wait = (ms) => new Promise((r) => setTimeout(r, ms));
-	const total = Math.max(0, maxRetries);
-	for (let i = 0; i <= total; i++) {
-		const d = delays[i] ?? delays[delays.length - 1] ?? 80;
-		await wait(d);
-		if (document.hasFocus()) return true;
-		window.focus?.();
-	}
-	return document.hasFocus();
-}
-var WebAuthnBridgeMessage, WindowParentDomainWebAuthnClient;
-var init_safari_fallbacks = __esm({ "src/core/WebAuthnManager/WebAuthnFallbacks/safari-fallbacks.ts": (() => {
-	WebAuthnBridgeMessage = {
-		Create: "WALLET_WEBAUTHN_CREATE",
-		Get: "WALLET_WEBAUTHN_GET",
-		CreateResult: "WALLET_WEBAUTHN_CREATE_RESULT",
-		GetResult: "WALLET_WEBAUTHN_GET_RESULT"
-	};
-	WindowParentDomainWebAuthnClient = class {
-		async request(kind, publicKey, timeoutMs = 6e4) {
-			const requestId = `${kind}:${Date.now()}:${Math.random().toString(36).slice(2)}`;
-			const resultType = getResultTypeFor(kind);
-			return new Promise((resolve) => {
-				let settled = false;
-				const finish = (val) => {
-					if (!settled) {
-						settled = true;
-						resolve(val);
-					}
-				};
-				const onMessage = (ev) => {
-					const payload = ev?.data;
-					if (!payload || typeof payload.type !== "string") return;
-					const t = payload.type;
-					if (t !== resultType) return;
-					const rid = payload.requestId;
-					if (rid !== requestId) return;
-					window.removeEventListener("message", onMessage);
-					const ok = !!payload.ok;
-					const cred = payload.credential;
-					const err = payload.error;
-					if (ok && cred) return finish({
-						ok: true,
-						credential: cred
-					});
-					return finish({
-						ok: false,
-						error: typeof err === "string" ? err : void 0
-					});
-				};
-				window.addEventListener("message", onMessage);
-				window.parent?.postMessage({
-					type: kind,
-					requestId,
-					publicKey
-				}, "*");
-				setTimeout(() => {
-					window.removeEventListener("message", onMessage);
-					finish({
-						ok: false,
-						timeout: true
-					});
-				}, timeoutMs);
-			});
-		}
-	};
-}) });
-
-//#endregion
-init_safari_fallbacks();
-export { WebAuthnBridgeMessage, executeWebAuthnWithParentFallbacksSafari, init_safari_fallbacks };
-//# sourceMappingURL=safari-fallbacks.js.map