@tatchi-xyz/sdk 0.21.0 → 0.31.1

package/dist/esm/core/WebAuthnManager/SignerWorkerManager/handlers/recoverKeypairFromPasskey.js

@@ -1,8 +1,7 @@
-import { WorkerRequestType, init_signer_worker, isRecoverKeypairFromPasskeySuccess } from "../../../types/signer-worker.js";
+import { WorkerRequestType, isRecoverKeypairFromPasskeySuccess } from "../../../types/signer-worker.js";
 import { withSessionId } from "./session.js";
 
 //#region src/core/WebAuthnManager/SignerWorkerManager/handlers/recoverKeypairFromPasskey.ts
-init_signer_worker();
 /**
 * Recover keypair from authentication credential for account recovery
 * Uses dual PRF-based Ed25519 key derivation with account-specific HKDF and AES encryption

package/dist/esm/core/WebAuthnManager/SignerWorkerManager/handlers/recoverKeypairFromPasskey.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoverKeypairFromPasskey.js","names":["error: unknown"],"sources":["../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/recoverKeypairFromPasskey.ts"],"sourcesContent":["import {\n  WorkerRequestType,  // from wasm worker\n  isRecoverKeypairFromPasskeySuccess,\n} from '../../../types/signer-worker';\nimport type { WebAuthnAuthenticationCredential } from '../../../types/webauthn';\nimport { SignerWorkerManagerContext } from '..';\nimport { withSessionId } from './session';\n\n/**\n * Recover keypair from authentication credential for account recovery\n * Uses dual PRF-based Ed25519 key derivation with account-specific HKDF and AES encryption\n */\nexport async function recoverKeypairFromPasskey({\n  ctx,\n  credential,\n  accountIdHint,\n  sessionId,\n}: {\n  ctx: SignerWorkerManagerContext;\n  credential: WebAuthnAuthenticationCredential;\n  accountIdHint?: string;\n  sessionId: string;\n}): Promise<{\n  publicKey: string;\n  encryptedPrivateKey: string;\n  /**\n   * Base64url-encoded AEAD nonce (ChaCha20-Poly1305) for the encrypted private key.\n   */\n  chacha20NonceB64u: string;\n  accountIdHint?: string;\n  wrapKeySalt: string;\n}> {\n  try {\n    console.info('SignerWorkerManager: Starting dual PRF-based keypair recovery from authentication credential');\n    // Accept either live PublicKeyCredential or already-serialized auth credential\n\n    // Verify dual PRF outputs are available\n    if (\n      !credential.clientExtensionResults?.prf?.results?.first ||\n      !credential.clientExtensionResults?.prf?.results?.second\n    ) {\n      throw new Error('Dual PRF outputs required for account recovery - both ChaCha20 and Ed25519 PRF outputs must be available');\n    }\n\n    if (!sessionId) throw new Error('Missing sessionId for recovery WrapKeySeed delivery');\n\n    // Use generic sendMessage with specific request type for better type safety\n    const response = await ctx.sendMessage<WorkerRequestType.RecoverKeypairFromPasskey>({\n      sessionId,\n      message: {\n        type: WorkerRequestType.RecoverKeypairFromPasskey,\n        payload: withSessionId(sessionId, {\n          credential,\n          accountIdHint,\n        })\n      },\n    });\n\n    // response is RecoverKeypairSuccessResponse | RecoverKeypairFailureResponse\n    if (!isRecoverKeypairFromPasskeySuccess(response)) {\n      throw new Error('Dual PRF keypair recovery failed in WASM worker');\n    }\n\n    const chacha20NonceB64u = response.payload.chacha20NonceB64u;\n    if (!chacha20NonceB64u) {\n      throw new Error('Missing chacha20NonceB64u in recovery result');\n    }\n    return {\n      publicKey: response.payload.publicKey,\n      encryptedPrivateKey: response.payload.encryptedData,\n      chacha20NonceB64u,\n      accountIdHint: response.payload.accountIdHint,\n      wrapKeySalt: response.payload.wrapKeySalt,\n    };\n\n  } catch (error: unknown) {\n    console.error('SignerWorkerManager: Dual PRF keypair recovery error:', error);\n    throw error;\n  }\n}\n"],"mappings":";;;;;;;;;AAYA,eAAsB,0BAA0B,EAC9C,KACA,YACA,eACA,aAeC;AACD,KAAI;AACF,UAAQ,KAAK;AAIb,MACE,CAAC,WAAW,wBAAwB,KAAK,SAAS,SAClD,CAAC,WAAW,wBAAwB,KAAK,SAAS,OAElD,OAAM,IAAI,MAAM;AAGlB,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM;EAGhC,MAAM,WAAW,MAAM,IAAI,YAAyD;GAClF;GACA,SAAS;IACP,MAAM,kBAAkB;IACxB,SAAS,cAAc,WAAW;KAChC;KACA;;;;AAMN,MAAI,CAAC,mCAAmC,UACtC,OAAM,IAAI,MAAM;EAGlB,MAAM,oBAAoB,SAAS,QAAQ;AAC3C,MAAI,CAAC,kBACH,OAAM,IAAI,MAAM;AAElB,SAAO;GACL,WAAW,SAAS,QAAQ;GAC5B,qBAAqB,SAAS,QAAQ;GACtC;GACA,eAAe,SAAS,QAAQ;GAChC,aAAa,SAAS,QAAQ;;UAGzBA,OAAgB;AACvB,UAAQ,MAAM,yDAAyD;AACvE,QAAM"}
+{"version":3,"file":"recoverKeypairFromPasskey.js","names":["error: unknown"],"sources":["../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/recoverKeypairFromPasskey.ts"],"sourcesContent":["import {\n  WorkerRequestType,  // from wasm worker\n  isRecoverKeypairFromPasskeySuccess,\n} from '../../../types/signer-worker';\nimport type { WebAuthnAuthenticationCredential } from '../../../types/webauthn';\nimport { SignerWorkerManagerContext } from '..';\nimport { withSessionId } from './session';\n\n/**\n * Recover keypair from authentication credential for account recovery\n * Uses dual PRF-based Ed25519 key derivation with account-specific HKDF and AES encryption\n */\nexport async function recoverKeypairFromPasskey({\n  ctx,\n  credential,\n  accountIdHint,\n  sessionId,\n}: {\n  ctx: SignerWorkerManagerContext;\n  credential: WebAuthnAuthenticationCredential;\n  accountIdHint?: string;\n  sessionId: string;\n}): Promise<{\n  publicKey: string;\n  encryptedPrivateKey: string;\n  /**\n   * Base64url-encoded AEAD nonce (ChaCha20-Poly1305) for the encrypted private key.\n   */\n  chacha20NonceB64u: string;\n  accountIdHint?: string;\n  wrapKeySalt: string;\n}> {\n  try {\n    console.info('SignerWorkerManager: Starting dual PRF-based keypair recovery from authentication credential');\n    // Accept either live PublicKeyCredential or already-serialized auth credential\n\n    // Verify dual PRF outputs are available\n    if (\n      !credential.clientExtensionResults?.prf?.results?.first ||\n      !credential.clientExtensionResults?.prf?.results?.second\n    ) {\n      throw new Error('Dual PRF outputs required for account recovery - both ChaCha20 and Ed25519 PRF outputs must be available');\n    }\n\n    if (!sessionId) throw new Error('Missing sessionId for recovery WrapKeySeed delivery');\n\n    // Use generic sendMessage with specific request type for better type safety\n    const response = await ctx.sendMessage<WorkerRequestType.RecoverKeypairFromPasskey>({\n      sessionId,\n      message: {\n        type: WorkerRequestType.RecoverKeypairFromPasskey,\n        payload: withSessionId(sessionId, {\n          credential,\n          accountIdHint,\n        })\n      },\n    });\n\n    // response is RecoverKeypairSuccessResponse | RecoverKeypairFailureResponse\n    if (!isRecoverKeypairFromPasskeySuccess(response)) {\n      throw new Error('Dual PRF keypair recovery failed in WASM worker');\n    }\n\n    const chacha20NonceB64u = response.payload.chacha20NonceB64u;\n    if (!chacha20NonceB64u) {\n      throw new Error('Missing chacha20NonceB64u in recovery result');\n    }\n    return {\n      publicKey: response.payload.publicKey,\n      encryptedPrivateKey: response.payload.encryptedData,\n      chacha20NonceB64u,\n      accountIdHint: response.payload.accountIdHint,\n      wrapKeySalt: response.payload.wrapKeySalt,\n    };\n\n  } catch (error: unknown) {\n    console.error('SignerWorkerManager: Dual PRF keypair recovery error:', error);\n    throw error;\n  }\n}\n"],"mappings":";;;;;;;;AAYA,eAAsB,0BAA0B,EAC9C,KACA,YACA,eACA,aAeC;AACD,KAAI;AACF,UAAQ,KAAK;AAIb,MACE,CAAC,WAAW,wBAAwB,KAAK,SAAS,SAClD,CAAC,WAAW,wBAAwB,KAAK,SAAS,OAElD,OAAM,IAAI,MAAM;AAGlB,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM;EAGhC,MAAM,WAAW,MAAM,IAAI,YAAyD;GAClF;GACA,SAAS;IACP,MAAM,kBAAkB;IACxB,SAAS,cAAc,WAAW;KAChC;KACA;;;;AAMN,MAAI,CAAC,mCAAmC,UACtC,OAAM,IAAI,MAAM;EAGlB,MAAM,oBAAoB,SAAS,QAAQ;AAC3C,MAAI,CAAC,kBACH,OAAM,IAAI,MAAM;AAElB,SAAO;GACL,WAAW,SAAS,QAAQ;GAC5B,qBAAqB,SAAS,QAAQ;GACtC;GACA,eAAe,SAAS,QAAQ;GAChC,aAAa,SAAS,QAAQ;;UAGzBA,OAAgB;AACvB,UAAQ,MAAM,yDAAyD;AACvE,QAAM"}

package/dist/esm/core/WebAuthnManager/SignerWorkerManager/handlers/registerDevice2WithDerivedKey.js

@@ -1,12 +1,9 @@
-import { WorkerRequestType, init_signer_worker, isRegisterDevice2WithDerivedKeySuccess } from "../../../types/signer-worker.js";
+import { WorkerRequestType, isRegisterDevice2WithDerivedKeySuccess } from "../../../types/signer-worker.js";
 import { base64UrlDecode } from "../../../../utils/base64.js";
-import { init_utils } from "../../../../utils/index.js";
 import { UserVerificationPolicy, toEnumUserVerificationPolicy } from "../../../types/authenticatorOptions.js";
 import { withSessionId } from "./session.js";
 
 //#region src/core/WebAuthnManager/SignerWorkerManager/handlers/registerDevice2WithDerivedKey.ts
-init_utils();
-init_signer_worker();
 /**
 * Combined Device2 registration flow: derive NEAR keypair + sign registration transaction
 * in a single operation without requiring a separate authentication prompt.
@@ -34,6 +31,8 @@ async function registerDevice2WithDerivedKey({ ctx, sessionId, nearAccountId, cr
 			if (!s) return [];
 			return Array.from(base64UrlDecode(s));
 		};
+		const intentDigest32 = b64ToBytes(vrfChallenge.intentDigest);
+		if (intentDigest32.length !== 32) throw new Error("Missing or invalid vrfChallenge.intentDigest (expected base64url-encoded 32 bytes)");
 		const finalContractArgs = {
 			vrf_data: {
 				vrf_input_data: b64ToBytes(vrfChallenge.vrfInput),
@@ -43,7 +42,8 @@ async function registerDevice2WithDerivedKey({ ctx, sessionId, nearAccountId, cr
 				user_id: vrfChallenge.userId,
 				rp_id: vrfChallenge.rpId,
 				block_height: Number(vrfChallenge.blockHeight),
-				block_hash: b64ToBytes(vrfChallenge.blockHash)
+				block_hash: b64ToBytes(vrfChallenge.blockHash),
+				intent_digest_32: intentDigest32
 			},
 			webauthn_registration: credential,
 			deterministic_vrf_public_key: b64ToBytes(deterministicVrfPublicKey),
@@ -78,22 +78,25 @@ async function registerDevice2WithDerivedKey({ ctx, sessionId, nearAccountId, cr
 		console.debug("[SignerWorkerManager] Device2 registration complete, storing encrypted key");
 		const chacha20NonceB64u = wasmResult.chacha20NonceB64u;
 		if (!chacha20NonceB64u) throw new Error("Missing chacha20NonceB64u in Device2 registration result");
-		const keyData = {
+		const wrapKeySaltPersisted = wasmResult.wrapKeySalt;
+		if (!wrapKeySaltPersisted) throw new Error("Missing wrapKeySalt in Device2 registration result");
+		const keyMaterial = {
+			kind: "local_near_sk_v3",
 			nearAccountId,
 			deviceNumber: deviceNumber ?? 2,
-			encryptedData: wasmResult.encryptedData,
+			publicKey: wasmResult.publicKey,
+			encryptedSk: wasmResult.encryptedData,
 			chacha20NonceB64u,
-			wrapKeySalt: wasmResult.wrapKeySalt,
-			version: 2,
+			wrapKeySalt: wrapKeySaltPersisted,
 			timestamp: Date.now()
 		};
-		await ctx.indexedDB.nearKeysDB.storeEncryptedKey(keyData);
+		await ctx.indexedDB.nearKeysDB.storeKeyMaterial(keyMaterial);
 		console.debug("[SignerWorkerManager] Device2 encrypted key stored successfully");
 		return {
 			success: true,
 			publicKey: wasmResult.publicKey,
 			signedTransaction: wasmResult.signedTransaction,
-			wrapKeySalt: wasmResult.wrapKeySalt,
+			wrapKeySalt: wrapKeySaltPersisted,
 			encryptedData: wasmResult.encryptedData,
 			chacha20NonceB64u
 		};

package/dist/esm/core/WebAuthnManager/SignerWorkerManager/handlers/registerDevice2WithDerivedKey.js.map

@@ -1 +1 @@
-{"version":3,"file":"registerDevice2WithDerivedKey.js","names":["keyData: EncryptedKeyData","error: unknown"],"sources":["../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/registerDevice2WithDerivedKey.ts"],"sourcesContent":["import { base64UrlDecode } from '../../../../utils';\nimport type { EncryptedKeyData } from '../../../IndexedDBManager/passkeyNearKeysDB';\nimport {\n  WorkerRequestType,\n  isRegisterDevice2WithDerivedKeySuccess,\n} from '../../../types/signer-worker';\nimport { AccountId, toAccountId } from \"../../../types/accountIds\";\nimport { SignerWorkerManagerContext } from '..';\nimport type { WebAuthnRegistrationCredential } from '@/core/types/webauthn';\nimport type { VRFChallenge } from '../../../types/vrf-worker';\nimport type { TransactionContext } from '../../../types/rpc';\nimport { withSessionId } from './session';\nimport { UserVerificationPolicy, toEnumUserVerificationPolicy } from '../../../types/authenticatorOptions';\n\n/**\n * Combined Device2 registration flow: derive NEAR keypair + sign registration transaction\n * in a single operation without requiring a separate authentication prompt.\n *\n * This handler orchestrates:\n * 1. Retrieving PRF.second and WrapKeySeed from session storage (delivered via MessagePort)\n * 2. Deriving NEAR ed25519 keypair from PRF.second\n * 3. Encrypting the NEAR private key with KEK (derived from WrapKeySeed + wrapKeySalt)\n * 4. Building the Device2 registration transaction (`link_device_register_user`)\n * 5. Signing the transaction with the derived NEAR keypair\n * 6. Storing encrypted key data in IndexedDB\n *\n * Security: PRF.second and WrapKeySeed never traverse the main thread - they're delivered\n * directly from VRF worker to Signer worker via MessagePort.\n */\nexport async function registerDevice2WithDerivedKey({\n  ctx,\n  sessionId,\n  nearAccountId,\n  credential,\n  vrfChallenge,\n  transactionContext,\n  contractId,\n  wrapKeySalt,\n  deviceNumber,\n  deterministicVrfPublicKey,\n}: {\n  ctx: SignerWorkerManagerContext;\n  sessionId: string;\n  nearAccountId: AccountId;\n  credential: WebAuthnRegistrationCredential;\n  vrfChallenge: VRFChallenge;\n  transactionContext: TransactionContext;\n  contractId: string;\n  wrapKeySalt: string;\n  deviceNumber?: number;\n  deterministicVrfPublicKey?: string;\n}): Promise<{\n  success: boolean;\n  publicKey: string;\n  signedTransaction: any;\n  wrapKeySalt: string;\n  encryptedData?: string;\n  /**\n   * Base64url-encoded AEAD nonce (ChaCha20-Poly1305) for the encrypted private key.\n   */\n  chacha20NonceB64u?: string;\n  error?: string;\n}> {\n  try {\n    if (!sessionId) {\n      throw new Error('Missing sessionId for Device2 registration');\n    }\n\n    console.debug('[SignerWorkerManager] Starting Device2 combined registration', {\n      nearAccountId,\n      sessionId,\n      deviceNumber,\n    });\n\n    // Helper to convert base64url string to byte array (number[])\n    const b64ToBytes = (s: string | undefined): number[] => {\n      if (!s) return [];\n      return Array.from(base64UrlDecode(s));\n    };\n    // Construct contractArgs in TypeScript and use JSON.stringify() here.\n    // This is native to JS, extremely fast, and means the Rust worker just receives a \"dumb\" string that it can blindly convert to bytes\n    const finalContractArgs = {\n      vrf_data: {\n        vrf_input_data: b64ToBytes(vrfChallenge.vrfInput),\n        vrf_output: b64ToBytes(vrfChallenge.vrfOutput),\n        vrf_proof: b64ToBytes(vrfChallenge.vrfProof),\n        public_key: b64ToBytes(vrfChallenge.vrfPublicKey),\n        user_id: vrfChallenge.userId,\n        rp_id: vrfChallenge.rpId,\n        block_height: Number(vrfChallenge.blockHeight),\n        block_hash: b64ToBytes(vrfChallenge.blockHash),\n      },\n      webauthn_registration: credential,\n      deterministic_vrf_public_key: b64ToBytes(deterministicVrfPublicKey),\n      authenticator_options: {\n        userVerification: toEnumUserVerificationPolicy(UserVerificationPolicy.Preferred),\n        originPolicy: {\n          single: undefined,\n          all_subdomains: true,\n          multiple: undefined,\n        },\n      },\n    };\n\n    // Build request payload for combined Device2 registration\n    const response = await ctx.sendMessage<WorkerRequestType.RegisterDevice2WithDerivedKey>({\n      sessionId,\n      message: {\n        type: WorkerRequestType.RegisterDevice2WithDerivedKey,\n        payload: withSessionId(sessionId, {\n          credential,\n          nearAccountId,\n          transactionContext: {\n            txBlockHash: transactionContext.txBlockHash,\n            txBlockHeight: transactionContext.txBlockHeight,\n            baseNonce: transactionContext.nextNonce,\n          },\n          contractId,\n          contractArgsJson: JSON.stringify(finalContractArgs),\n        }),\n      },\n    });\n\n    if (!isRegisterDevice2WithDerivedKeySuccess(response)) {\n      throw new Error('Device2 combined registration failed');\n    }\n\n    const wasmResult = response.payload;\n\n    console.debug('[SignerWorkerManager] Device2 registration complete, storing encrypted key');\n\n    // Store encrypted NEAR key in IndexedDB\n    const chacha20NonceB64u = wasmResult.chacha20NonceB64u;\n    if (!chacha20NonceB64u) {\n      throw new Error('Missing chacha20NonceB64u in Device2 registration result');\n    }\n    const keyData: EncryptedKeyData = {\n      nearAccountId,\n      deviceNumber: deviceNumber ?? 2, // Default to device 2\n      encryptedData: wasmResult.encryptedData,\n      chacha20NonceB64u,\n      wrapKeySalt: wasmResult.wrapKeySalt,\n      version: 2,\n      timestamp: Date.now(),\n    };\n    await ctx.indexedDB.nearKeysDB.storeEncryptedKey(keyData);\n\n    console.debug('[SignerWorkerManager] Device2 encrypted key stored successfully');\n\n    return {\n      success: true,\n      publicKey: wasmResult.publicKey,\n      signedTransaction: wasmResult.signedTransaction,\n      wrapKeySalt: wasmResult.wrapKeySalt,\n      encryptedData: wasmResult.encryptedData,\n      chacha20NonceB64u,\n    };\n  } catch (error: unknown) {\n    console.error('[SignerWorkerManager] registerDevice2WithDerivedKey error:', error);\n    const message = String((error as { message?: unknown })?.message || error || '');\n    return {\n      success: false,\n      publicKey: '',\n      signedTransaction: null,\n      wrapKeySalt: '',\n      error: message,\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA6BA,eAAsB,8BAA8B,EAClD,KACA,WACA,eACA,YACA,cACA,oBACA,YACA,aACA,cACA,6BAuBC;AACD,KAAI;AACF,MAAI,CAAC,UACH,OAAM,IAAI,MAAM;AAGlB,UAAQ,MAAM,gEAAgE;GAC5E;GACA;GACA;;EAIF,MAAM,cAAc,MAAoC;AACtD,OAAI,CAAC,EAAG,QAAO;AACf,UAAO,MAAM,KAAK,gBAAgB;;EAIpC,MAAM,oBAAoB;GACxB,UAAU;IACR,gBAAgB,WAAW,aAAa;IACxC,YAAY,WAAW,aAAa;IACpC,WAAW,WAAW,aAAa;IACnC,YAAY,WAAW,aAAa;IACpC,SAAS,aAAa;IACtB,OAAO,aAAa;IACpB,cAAc,OAAO,aAAa;IAClC,YAAY,WAAW,aAAa;;GAEtC,uBAAuB;GACvB,8BAA8B,WAAW;GACzC,uBAAuB;IACrB,kBAAkB,6BAA6B,uBAAuB;IACtE,cAAc;KACZ,QAAQ;KACR,gBAAgB;KAChB,UAAU;;;;EAMhB,MAAM,WAAW,MAAM,IAAI,YAA6D;GACtF;GACA,SAAS;IACP,MAAM,kBAAkB;IACxB,SAAS,cAAc,WAAW;KAChC;KACA;KACA,oBAAoB;MAClB,aAAa,mBAAmB;MAChC,eAAe,mBAAmB;MAClC,WAAW,mBAAmB;;KAEhC;KACA,kBAAkB,KAAK,UAAU;;;;AAKvC,MAAI,CAAC,uCAAuC,UAC1C,OAAM,IAAI,MAAM;EAGlB,MAAM,aAAa,SAAS;AAE5B,UAAQ,MAAM;EAGd,MAAM,oBAAoB,WAAW;AACrC,MAAI,CAAC,kBACH,OAAM,IAAI,MAAM;EAElB,MAAMA,UAA4B;GAChC;GACA,cAAc,gBAAgB;GAC9B,eAAe,WAAW;GAC1B;GACA,aAAa,WAAW;GACxB,SAAS;GACT,WAAW,KAAK;;AAElB,QAAM,IAAI,UAAU,WAAW,kBAAkB;AAEjD,UAAQ,MAAM;AAEd,SAAO;GACL,SAAS;GACT,WAAW,WAAW;GACtB,mBAAmB,WAAW;GAC9B,aAAa,WAAW;GACxB,eAAe,WAAW;GAC1B;;UAEKC,OAAgB;AACvB,UAAQ,MAAM,8DAA8D;EAC5E,MAAM,UAAU,OAAQ,OAAiC,WAAW,SAAS;AAC7E,SAAO;GACL,SAAS;GACT,WAAW;GACX,mBAAmB;GACnB,aAAa;GACb,OAAO"}
+{"version":3,"file":"registerDevice2WithDerivedKey.js","names":["keyMaterial: LocalNearSkV3Material","error: unknown"],"sources":["../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/registerDevice2WithDerivedKey.ts"],"sourcesContent":["import { base64UrlDecode } from '../../../../utils';\nimport type { LocalNearSkV3Material } from '../../../IndexedDBManager/passkeyNearKeysDB';\nimport {\n  WorkerRequestType,\n  isRegisterDevice2WithDerivedKeySuccess,\n  type WasmSignedTransaction,\n} from '../../../types/signer-worker';\nimport { AccountId, toAccountId } from \"../../../types/accountIds\";\nimport { SignerWorkerManagerContext } from '..';\nimport type { WebAuthnRegistrationCredential } from '@/core/types/webauthn';\nimport type { VRFChallenge } from '../../../types/vrf-worker';\nimport type { TransactionContext } from '../../../types/rpc';\nimport { withSessionId } from './session';\nimport { UserVerificationPolicy, toEnumUserVerificationPolicy } from '../../../types/authenticatorOptions';\n\n/**\n * Combined Device2 registration flow: derive NEAR keypair + sign registration transaction\n * in a single operation without requiring a separate authentication prompt.\n *\n * This handler orchestrates:\n * 1. Retrieving PRF.second and WrapKeySeed from session storage (delivered via MessagePort)\n * 2. Deriving NEAR ed25519 keypair from PRF.second\n * 3. Encrypting the NEAR private key with KEK (derived from WrapKeySeed + wrapKeySalt)\n * 4. Building the Device2 registration transaction (`link_device_register_user`)\n * 5. Signing the transaction with the derived NEAR keypair\n * 6. Storing encrypted key data in IndexedDB\n *\n * Security: PRF.second and WrapKeySeed never traverse the main thread - they're delivered\n * directly from VRF worker to Signer worker via MessagePort.\n */\nexport async function registerDevice2WithDerivedKey({\n  ctx,\n  sessionId,\n  nearAccountId,\n  credential,\n  vrfChallenge,\n  transactionContext,\n  contractId,\n  wrapKeySalt,\n  deviceNumber,\n  deterministicVrfPublicKey,\n}: {\n  ctx: SignerWorkerManagerContext;\n  sessionId: string;\n  nearAccountId: AccountId;\n  credential: WebAuthnRegistrationCredential;\n  vrfChallenge: VRFChallenge;\n  transactionContext: TransactionContext;\n  contractId: string;\n  wrapKeySalt: string;\n  deviceNumber?: number;\n  deterministicVrfPublicKey?: string;\n}): Promise<\n  | {\n    success: true;\n    publicKey: string;\n    signedTransaction: WasmSignedTransaction;\n    wrapKeySalt: string;\n    encryptedData: string;\n    /**\n     * Base64url-encoded AEAD nonce (ChaCha20-Poly1305) for the encrypted private key.\n     */\n    chacha20NonceB64u: string;\n  }\n  | {\n    success: false;\n    publicKey: '';\n    signedTransaction: null;\n    wrapKeySalt: '';\n    error: string;\n  }\n> {\n  try {\n    if (!sessionId) {\n      throw new Error('Missing sessionId for Device2 registration');\n    }\n\n    console.debug('[SignerWorkerManager] Starting Device2 combined registration', {\n      nearAccountId,\n      sessionId,\n      deviceNumber,\n    });\n\n    // Helper to convert base64url string to byte array (number[])\n    const b64ToBytes = (s: string | undefined): number[] => {\n      if (!s) return [];\n      return Array.from(base64UrlDecode(s));\n    };\n    const intentDigest32 = b64ToBytes(vrfChallenge.intentDigest);\n    if (intentDigest32.length !== 32) {\n      throw new Error('Missing or invalid vrfChallenge.intentDigest (expected base64url-encoded 32 bytes)');\n    }\n    // Construct contractArgs in TypeScript and use JSON.stringify() here.\n    // This is native to JS, extremely fast, and means the Rust worker just receives a \"dumb\" string that it can blindly convert to bytes\n    const finalContractArgs = {\n      vrf_data: {\n        vrf_input_data: b64ToBytes(vrfChallenge.vrfInput),\n        vrf_output: b64ToBytes(vrfChallenge.vrfOutput),\n        vrf_proof: b64ToBytes(vrfChallenge.vrfProof),\n        public_key: b64ToBytes(vrfChallenge.vrfPublicKey),\n        user_id: vrfChallenge.userId,\n        rp_id: vrfChallenge.rpId,\n        block_height: Number(vrfChallenge.blockHeight),\n        block_hash: b64ToBytes(vrfChallenge.blockHash),\n        intent_digest_32: intentDigest32,\n      },\n      webauthn_registration: credential,\n      deterministic_vrf_public_key: b64ToBytes(deterministicVrfPublicKey),\n      authenticator_options: {\n        userVerification: toEnumUserVerificationPolicy(UserVerificationPolicy.Preferred),\n        originPolicy: {\n          single: undefined,\n          all_subdomains: true,\n          multiple: undefined,\n        },\n      },\n    };\n\n    // Build request payload for combined Device2 registration\n    const response = await ctx.sendMessage<WorkerRequestType.RegisterDevice2WithDerivedKey>({\n      sessionId,\n      message: {\n        type: WorkerRequestType.RegisterDevice2WithDerivedKey,\n        payload: withSessionId(sessionId, {\n          credential,\n          nearAccountId,\n          transactionContext: {\n            txBlockHash: transactionContext.txBlockHash,\n            txBlockHeight: transactionContext.txBlockHeight,\n            baseNonce: transactionContext.nextNonce,\n          },\n          contractId,\n          contractArgsJson: JSON.stringify(finalContractArgs),\n        }),\n      },\n    });\n\n    if (!isRegisterDevice2WithDerivedKeySuccess(response)) {\n      throw new Error('Device2 combined registration failed');\n    }\n\n    const wasmResult = response.payload;\n\n    console.debug('[SignerWorkerManager] Device2 registration complete, storing encrypted key');\n\n    // Store encrypted NEAR key in IndexedDB\n    const chacha20NonceB64u = wasmResult.chacha20NonceB64u;\n    if (!chacha20NonceB64u) {\n      throw new Error('Missing chacha20NonceB64u in Device2 registration result');\n    }\n    const wrapKeySaltPersisted = wasmResult.wrapKeySalt;\n    if (!wrapKeySaltPersisted) {\n      throw new Error('Missing wrapKeySalt in Device2 registration result');\n    }\n\n    const keyMaterial: LocalNearSkV3Material = {\n      kind: 'local_near_sk_v3',\n      nearAccountId,\n      deviceNumber: deviceNumber ?? 2, // Default to device 2\n      publicKey: wasmResult.publicKey,\n      encryptedSk: wasmResult.encryptedData,\n      chacha20NonceB64u,\n      wrapKeySalt: wrapKeySaltPersisted,\n      timestamp: Date.now(),\n    };\n    await ctx.indexedDB.nearKeysDB.storeKeyMaterial(keyMaterial);\n\n    console.debug('[SignerWorkerManager] Device2 encrypted key stored successfully');\n\n    return {\n      success: true,\n      publicKey: wasmResult.publicKey,\n      signedTransaction: wasmResult.signedTransaction,\n      wrapKeySalt: wrapKeySaltPersisted,\n      encryptedData: wasmResult.encryptedData,\n      chacha20NonceB64u,\n    };\n  } catch (error: unknown) {\n    console.error('[SignerWorkerManager] registerDevice2WithDerivedKey error:', error);\n    const message = String((error as { message?: unknown })?.message || error || '');\n    return {\n      success: false,\n      publicKey: '',\n      signedTransaction: null,\n      wrapKeySalt: '',\n      error: message,\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA8BA,eAAsB,8BAA8B,EAClD,KACA,WACA,eACA,YACA,cACA,oBACA,YACA,aACA,cACA,6BA+BA;AACA,KAAI;AACF,MAAI,CAAC,UACH,OAAM,IAAI,MAAM;AAGlB,UAAQ,MAAM,gEAAgE;GAC5E;GACA;GACA;;EAIF,MAAM,cAAc,MAAoC;AACtD,OAAI,CAAC,EAAG,QAAO;AACf,UAAO,MAAM,KAAK,gBAAgB;;EAEpC,MAAM,iBAAiB,WAAW,aAAa;AAC/C,MAAI,eAAe,WAAW,GAC5B,OAAM,IAAI,MAAM;EAIlB,MAAM,oBAAoB;GACxB,UAAU;IACR,gBAAgB,WAAW,aAAa;IACxC,YAAY,WAAW,aAAa;IACpC,WAAW,WAAW,aAAa;IACnC,YAAY,WAAW,aAAa;IACpC,SAAS,aAAa;IACtB,OAAO,aAAa;IACpB,cAAc,OAAO,aAAa;IAClC,YAAY,WAAW,aAAa;IACpC,kBAAkB;;GAEpB,uBAAuB;GACvB,8BAA8B,WAAW;GACzC,uBAAuB;IACrB,kBAAkB,6BAA6B,uBAAuB;IACtE,cAAc;KACZ,QAAQ;KACR,gBAAgB;KAChB,UAAU;;;;EAMhB,MAAM,WAAW,MAAM,IAAI,YAA6D;GACtF;GACA,SAAS;IACP,MAAM,kBAAkB;IACxB,SAAS,cAAc,WAAW;KAChC;KACA;KACA,oBAAoB;MAClB,aAAa,mBAAmB;MAChC,eAAe,mBAAmB;MAClC,WAAW,mBAAmB;;KAEhC;KACA,kBAAkB,KAAK,UAAU;;;;AAKvC,MAAI,CAAC,uCAAuC,UAC1C,OAAM,IAAI,MAAM;EAGlB,MAAM,aAAa,SAAS;AAE5B,UAAQ,MAAM;EAGd,MAAM,oBAAoB,WAAW;AACrC,MAAI,CAAC,kBACH,OAAM,IAAI,MAAM;EAElB,MAAM,uBAAuB,WAAW;AACxC,MAAI,CAAC,qBACH,OAAM,IAAI,MAAM;EAGlB,MAAMA,cAAqC;GACzC,MAAM;GACN;GACA,cAAc,gBAAgB;GAC9B,WAAW,WAAW;GACtB,aAAa,WAAW;GACxB;GACA,aAAa;GACb,WAAW,KAAK;;AAElB,QAAM,IAAI,UAAU,WAAW,iBAAiB;AAEhD,UAAQ,MAAM;AAEd,SAAO;GACL,SAAS;GACT,WAAW,WAAW;GACtB,mBAAmB,WAAW;GAC9B,aAAa;GACb,eAAe,WAAW;GAC1B;;UAEKC,OAAgB;AACvB,UAAQ,MAAM,8DAA8D;EAC5E,MAAM,UAAU,OAAQ,OAAiC,WAAW,SAAS;AAC7E,SAAO;GACL,SAAS;GACT,WAAW;GACX,mBAAmB;GACnB,aAAa;GACb,OAAO"}

package/dist/esm/core/WebAuthnManager/SignerWorkerManager/handlers/session.js

@@ -2,6 +2,7 @@
 function withSessionId(sessionId, payload) {
 	if (!sessionId) throw new Error("withSessionId: sessionId is required");
 	const existing = payload?.sessionId;
+	if (existing != null && typeof existing !== "string") throw new Error("withSessionId: payload.sessionId must be a string when provided");
 	if (existing && existing !== sessionId) throw new Error(`withSessionId: payload.sessionId (${existing}) does not match provided sessionId (${sessionId})`);
 	return {
 		...payload,

package/dist/esm/core/WebAuthnManager/SignerWorkerManager/handlers/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","names":[],"sources":["../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/session.ts"],"sourcesContent":["\nexport function withSessionId<T>(\n  sessionId: string,\n  payload: T,\n): T & { sessionId: string } {\n\n  if (!sessionId) {\n    throw new Error('withSessionId: sessionId is required');\n  }\n\n  const existing = (payload as any)?.sessionId as string | undefined;\n  if (existing && existing !== sessionId) {\n    throw new Error(\n      `withSessionId: payload.sessionId (${existing}) does not match provided sessionId (${sessionId})`,\n    );\n  }\n\n  return { ...payload, sessionId };\n}\n"],"mappings":";AACA,SAAgB,cACd,WACA,SAC2B;AAE3B,KAAI,CAAC,UACH,OAAM,IAAI,MAAM;CAGlB,MAAM,WAAY,SAAiB;AACnC,KAAI,YAAY,aAAa,UAC3B,OAAM,IAAI,MACR,qCAAqC,SAAS,uCAAuC,UAAU;AAInG,QAAO;EAAE,GAAG;EAAS"}
+{"version":3,"file":"session.js","names":[],"sources":["../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/session.ts"],"sourcesContent":["\nexport function withSessionId<T extends object>(\n  sessionId: string,\n  payload: T,\n): T & { sessionId: string } {\n\n  if (!sessionId) {\n    throw new Error('withSessionId: sessionId is required');\n  }\n\n  const existing = (payload as { sessionId?: unknown })?.sessionId;\n  if (existing != null && typeof existing !== 'string') {\n    throw new Error('withSessionId: payload.sessionId must be a string when provided');\n  }\n  if (existing && existing !== sessionId) {\n    throw new Error(\n      `withSessionId: payload.sessionId (${existing}) does not match provided sessionId (${sessionId})`,\n    );\n  }\n\n  return { ...payload, sessionId };\n}\n"],"mappings":";AACA,SAAgB,cACd,WACA,SAC2B;AAE3B,KAAI,CAAC,UACH,OAAM,IAAI,MAAM;CAGlB,MAAM,WAAY,SAAqC;AACvD,KAAI,YAAY,QAAQ,OAAO,aAAa,SAC1C,OAAM,IAAI,MAAM;AAElB,KAAI,YAAY,aAAa,UAC3B,OAAM,IAAI,MACR,qCAAqC,SAAS,uCAAuC,UAAU;AAInG,QAAO;EAAE,GAAG;EAAS"}

package/dist/esm/core/WebAuthnManager/SignerWorkerManager/handlers/signDelegateAction.js

@@ -1,20 +1,22 @@
-import { init_accountIds, toAccountId } from "../../../types/accountIds.js";
-import { WorkerRequestType, init_signer_worker, isSignDelegateActionSuccess } from "../../../types/signer-worker.js";
-import { PASSKEY_MANAGER_DEFAULT_CONFIGS, init_defaultConfigs } from "../../../defaultConfigs.js";
-import { init_actions, toActionArgsWasm, validateActionArgsWasm } from "../../../types/actions.js";
-import { getLastLoggedInDeviceNumber, init_getDeviceNumber } from "../getDeviceNumber.js";
+import { ensureEd25519Prefix } from "../../../../utils/validation.js";
+import { toAccountId } from "../../../types/accountIds.js";
+import { WorkerRequestType, isSignDelegateActionSuccess, isWorkerError } from "../../../types/signer-worker.js";
+import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from "../../../defaultConfigs.js";
+import { normalizeThresholdEd25519ParticipantIds } from "../../../../threshold/participants.js";
+import { removePrfOutputGuard } from "../../credentialsHelpers.js";
+import { toActionArgsWasm, validateActionArgsWasm } from "../../../types/actions.js";
+import { getLastLoggedInDeviceNumber } from "../getDeviceNumber.js";
 import { generateSessionId } from "../sessionHandshake.js";
+import { resolveSignerModeForThresholdSigning } from "../../../threshold/thresholdEd25519RelayerHealth.js";
+import { clearCachedThresholdEd25519AuthSession, getCachedThresholdEd25519AuthSessionJwt, makeThresholdEd25519AuthSessionCacheKey } from "../../../threshold/thresholdEd25519AuthSession.js";
+import { isThresholdSessionAuthUnavailableError } from "../../../threshold/thresholdSessionPolicy.js";
 import { toPublicKeyString } from "./validation.js";
 
 //#region src/core/WebAuthnManager/SignerWorkerManager/handlers/signDelegateAction.ts
-init_defaultConfigs();
-init_accountIds();
-init_actions();
-init_signer_worker();
-init_getDeviceNumber();
-async function signDelegateAction({ ctx, delegate, rpcCall, onEvent, confirmationConfigOverride, title, body, sessionId: providedSessionId }) {
+async function signDelegateAction({ ctx, delegate, rpcCall, signerMode, onEvent, confirmationConfigOverride, title, body, sessionId: providedSessionId }) {
 	const sessionId = providedSessionId ?? generateSessionId();
 	const nearAccountId = rpcCall.nearAccountId || delegate.senderId;
+	const relayerUrl = ctx.relayerUrl;
 	const resolvedRpcCall = {
 		contractId: rpcCall.contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId,
 		nearRpcUrl: rpcCall.nearRpcUrl || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl.split(",")[0] || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl,
@@ -29,13 +31,34 @@ async function signDelegateAction({ ctx, delegate, rpcCall, onEvent, confirmatio
 		}
 	});
 	const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);
-	const encryptedKeyData = await ctx.indexedDB.nearKeysDB.getEncryptedKey(nearAccountId, deviceNumber);
-	if (!encryptedKeyData) throw new Error(`No encrypted key found for account: ${nearAccountId}`);
-	if (!ctx.vrfWorkerManager) throw new Error("VrfWorkerManager not available for delegate signing");
-	const confirmation = await ctx.vrfWorkerManager.confirmAndPrepareSigningSession({
+	const [localKeyMaterial, thresholdKeyMaterial] = await Promise.all([ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber), ctx.indexedDB.nearKeysDB.getThresholdKeyMaterial(nearAccountId, deviceNumber)]);
+	if (!localKeyMaterial) throw new Error(`No local key material found for account: ${nearAccountId}`);
+	const warnings = [];
+	const vrfWorkerManager = ctx.vrfWorkerManager;
+	if (!vrfWorkerManager) throw new Error("VrfWorkerManager not available for delegate signing");
+	const resolvedSignerMode = await resolveSignerModeForThresholdSigning({
+		nearAccountId,
+		signerMode,
+		relayerUrl,
+		hasThresholdKeyMaterial: !!thresholdKeyMaterial,
+		warnings
+	});
+	const signingContext = validateAndPrepareDelegateSigningContext({
+		nearAccountId,
+		resolvedSignerMode,
+		relayerUrl,
+		rpId: ctx.touchIdPrompt.getRpId(),
+		localKeyMaterial,
+		thresholdKeyMaterial,
+		providedDelegatePublicKey: delegate.publicKey,
+		warnings
+	});
+	ctx.nonceManager.initializeUser(toAccountId(nearAccountId), signingContext.signingNearPublicKeyStr);
+	const confirmation = await vrfWorkerManager.confirmAndPrepareSigningSession({
 		ctx,
 		sessionId,
 		kind: "delegate",
+		...signingContext.threshold && !signingContext.threshold.thresholdSessionJwt ? { signingAuthMode: "webauthn" } : {},
 		nearAccountId,
 		delegate: {
 			senderId: delegate.senderId || nearAccountId,
@@ -49,53 +72,186 @@ async function signDelegateAction({ ctx, delegate, rpcCall, onEvent, confirmatio
 		title,
 		body
 	});
-	const intentDigest = confirmation.intentDigest;
-	const transactionContext = confirmation.transactionContext;
-	const credential = confirmation.credential ? JSON.stringify(confirmation.credential) : void 0;
-	const response = await ctx.sendMessage({
-		sessionId,
-		message: {
-			type: WorkerRequestType.SignDelegateAction,
-			payload: {
-				rpcCall: resolvedRpcCall,
-				createdAt: Date.now(),
-				decryption: {
-					encryptedPrivateKeyData: encryptedKeyData.encryptedData,
-					encryptedPrivateKeyChacha20NonceB64u: encryptedKeyData.chacha20NonceB64u
-				},
+	let { intentDigest, transactionContext, vrfChallenge, credential } = extractSigningEvidenceFromConfirmation(confirmation);
+	const delegatePayload = {
+		senderId: delegate.senderId || nearAccountId,
+		receiverId: delegate.receiverId,
+		actions: actionsWasm,
+		nonce: delegate.nonce.toString(),
+		maxBlockHeight: delegate.maxBlockHeight.toString(),
+		publicKey: signingContext.delegatePublicKeyStr
+	};
+	if (!signingContext.threshold) {
+		const response = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: WorkerRequestType.SignDelegateAction,
+				payload: {
+					signerMode: signingContext.resolvedSignerMode,
+					rpcCall: resolvedRpcCall,
+					createdAt: Date.now(),
+					decryption: {
+						encryptedPrivateKeyData: localKeyMaterial.encryptedSk,
+						encryptedPrivateKeyChacha20NonceB64u: localKeyMaterial.chacha20NonceB64u
+					},
+					delegate: delegatePayload,
+					intentDigest,
+					transactionContext,
+					credential
+				}
+			},
+			onEvent
+		});
+		const okResponse$1 = requireOkSignDelegateActionResponse(response);
+		return {
+			signedDelegate: okResponse$1.payload.signedDelegate,
+			hash: okResponse$1.payload.hash,
+			nearAccountId: toAccountId(nearAccountId),
+			logs: [...okResponse$1.payload.logs || [], ...warnings]
+		};
+	}
+	const requestPayload = {
+		signerMode: signingContext.resolvedSignerMode,
+		rpcCall: resolvedRpcCall,
+		createdAt: Date.now(),
+		decryption: {
+			encryptedPrivateKeyData: "",
+			encryptedPrivateKeyChacha20NonceB64u: ""
+		},
+		threshold: {
+			relayerUrl: signingContext.threshold.relayerUrl,
+			relayerKeyId: signingContext.threshold.thresholdKeyMaterial.relayerKeyId,
+			clientParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "client")?.id,
+			relayerParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === "relayer")?.id,
+			participantIds: signingContext.threshold.thresholdKeyMaterial.participants.map((p) => p.id),
+			thresholdSessionKind: "jwt",
+			thresholdSessionJwt: signingContext.threshold.thresholdSessionJwt
+		},
+		delegate: delegatePayload,
+		intentDigest,
+		transactionContext,
+		vrfChallenge,
+		credential
+	};
+	let okResponse;
+	try {
+		const resp = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: WorkerRequestType.SignDelegateAction,
+				payload: requestPayload
+			},
+			onEvent
+		});
+		okResponse = requireOkSignDelegateActionResponse(resp);
+	} catch (e) {
+		const err = e instanceof Error ? e : new Error(String(e));
+		if (!isThresholdSessionAuthUnavailableError(err)) throw err;
+		clearCachedThresholdEd25519AuthSession(signingContext.threshold.thresholdSessionCacheKey);
+		signingContext.threshold.thresholdSessionJwt = void 0;
+		requestPayload.threshold.thresholdSessionJwt = void 0;
+		if (!credential || !vrfChallenge) {
+			const refreshed = await vrfWorkerManager.confirmAndPrepareSigningSession({
+				ctx,
+				sessionId,
+				kind: "delegate",
+				signingAuthMode: "webauthn",
+				nearAccountId,
 				delegate: {
 					senderId: delegate.senderId || nearAccountId,
 					receiverId: delegate.receiverId,
 					actions: actionsWasm,
-					nonce: delegate.nonce.toString(),
-					maxBlockHeight: delegate.maxBlockHeight.toString(),
-					publicKey: toPublicKeyString(delegate.publicKey)
+					nonce: delegate.nonce,
+					maxBlockHeight: delegate.maxBlockHeight
 				},
-				intentDigest,
-				transactionContext,
-				credential
-			}
-		},
-		onEvent
-	});
-	console.debug("[WebAuthnManager][delegate] raw worker response", response);
-	if (!isSignDelegateActionSuccess(response)) {
-		console.error("[WebAuthnManager][delegate] non-success worker response", response);
-		const payloadError = response?.payload?.error;
-		throw new Error(payloadError || "Delegate action signing failed");
-	}
-	const payload = response.payload;
-	if (!payload.success || !payload.signedDelegate || !payload.hash) {
-		console.error("[WebAuthnManager][delegate] invalid delegate payload", payload);
-		throw new Error(payload.error || "Delegate action signing failed");
+				rpcCall: resolvedRpcCall,
+				confirmationConfigOverride,
+				title,
+				body
+			});
+			({intentDigest, transactionContext, vrfChallenge, credential} = extractSigningEvidenceFromConfirmation(refreshed));
+			requestPayload.intentDigest = intentDigest;
+			requestPayload.transactionContext = transactionContext;
+			requestPayload.vrfChallenge = vrfChallenge;
+			requestPayload.credential = credential;
+		}
+		const resp = await ctx.sendMessage({
+			sessionId,
+			message: {
+				type: WorkerRequestType.SignDelegateAction,
+				payload: requestPayload
+			},
+			onEvent
+		});
+		okResponse = requireOkSignDelegateActionResponse(resp);
 	}
 	return {
-		signedDelegate: payload.signedDelegate,
-		hash: payload.hash,
+		signedDelegate: okResponse.payload.signedDelegate,
+		hash: okResponse.payload.hash,
 		nearAccountId: toAccountId(nearAccountId),
-		logs: payload.logs
+		logs: [...okResponse.payload.logs || [], ...warnings]
 	};
 }
+function validateAndPrepareDelegateSigningContext(args) {
+	const localPublicKey = ensureEd25519Prefix(args.localKeyMaterial.publicKey);
+	if (!localPublicKey) throw new Error(`Missing local signing public key for ${args.nearAccountId}`);
+	const providedDelegatePublicKeyStr = ensureEd25519Prefix(toPublicKeyString(args.providedDelegatePublicKey));
+	if (args.resolvedSignerMode !== "threshold-signer") {
+		if (providedDelegatePublicKeyStr && providedDelegatePublicKeyStr !== localPublicKey) args.warnings.push(`Delegate public key ${providedDelegatePublicKeyStr} does not match local signer key; using ${localPublicKey}`);
+		return {
+			resolvedSignerMode: "local-signer",
+			signingNearPublicKeyStr: localPublicKey,
+			delegatePublicKeyStr: localPublicKey,
+			threshold: null
+		};
+	}
+	const thresholdKeyMaterial = args.thresholdKeyMaterial;
+	if (!thresholdKeyMaterial) throw new Error(`Missing threshold key material for ${args.nearAccountId}`);
+	const thresholdPublicKey = ensureEd25519Prefix(thresholdKeyMaterial.publicKey);
+	if (!thresholdPublicKey) throw new Error(`Missing threshold signing public key for ${args.nearAccountId}`);
+	if (providedDelegatePublicKeyStr && providedDelegatePublicKeyStr !== thresholdPublicKey) args.warnings.push(`Delegate public key ${providedDelegatePublicKeyStr} does not match threshold signer key; using ${thresholdPublicKey}`);
+	const relayerUrl = String(args.relayerUrl || "").trim();
+	if (!relayerUrl) throw new Error("Missing relayerUrl (required for threshold-signer)");
+	const rpId = String(args.rpId || "").trim();
+	if (!rpId) throw new Error("Missing rpId for threshold signing");
+	const participantIds = normalizeThresholdEd25519ParticipantIds(thresholdKeyMaterial.participants.map((p) => p.id));
+	if (!participantIds || participantIds.length < 2) throw new Error(`Invalid threshold signing participantIds (expected >=2 participants, got [${(participantIds || []).join(",")}])`);
+	const thresholdSessionCacheKey = makeThresholdEd25519AuthSessionCacheKey({
+		nearAccountId: args.nearAccountId,
+		rpId,
+		relayerUrl,
+		relayerKeyId: thresholdKeyMaterial.relayerKeyId,
+		participantIds
+	});
+	return {
+		resolvedSignerMode: "threshold-signer",
+		signingNearPublicKeyStr: thresholdPublicKey,
+		delegatePublicKeyStr: thresholdPublicKey,
+		threshold: {
+			relayerUrl,
+			thresholdKeyMaterial,
+			thresholdSessionCacheKey,
+			thresholdSessionJwt: getCachedThresholdEd25519AuthSessionJwt(thresholdSessionCacheKey)
+		}
+	};
+}
+function extractSigningEvidenceFromConfirmation(confirmation) {
+	const credentialForRelay = confirmation.credential ? removePrfOutputGuard(confirmation.credential) : void 0;
+	return {
+		intentDigest: confirmation.intentDigest,
+		transactionContext: confirmation.transactionContext,
+		vrfChallenge: confirmation.vrfChallenge,
+		credential: credentialForRelay ? JSON.stringify(credentialForRelay) : void 0
+	};
+}
+function requireOkSignDelegateActionResponse(response) {
+	if (!isSignDelegateActionSuccess(response)) {
+		if (isWorkerError(response)) throw new Error(response.payload.error || "Delegate action signing failed");
+		throw new Error("Delegate action signing failed");
+	}
+	if (!response.payload.success || !response.payload.signedDelegate || !response.payload.hash) throw new Error(response.payload.error || "Delegate action signing failed");
+	return response;
+}
 
 //#endregion
 export { signDelegateAction };

package/dist/esm/core/WebAuthnManager/SignerWorkerManager/handlers/signDelegateAction.js.map

@@ -1 +1 @@
-{"version":3,"file":"signDelegateAction.js","names":[],"sources":["../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/signDelegateAction.ts"],"sourcesContent":["import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from '../../../defaultConfigs';\nimport { AccountId, toAccountId } from '../../../types/accountIds';\nimport { toActionArgsWasm, validateActionArgsWasm } from '../../../types/actions';\nimport { DelegateActionInput } from '../../../types/delegate';\nimport { type onProgressEvents } from '../../../types/sdkSentEvents';\nimport {\n  ConfirmationConfig,\n  RpcCallPayload,\n  WorkerRequestType,\n  isSignDelegateActionSuccess,\n  WasmDelegateSignResult,\n  WasmSignedDelegate,\n} from '../../../types/signer-worker';\nimport { SignerWorkerManagerContext } from '..';\nimport { getLastLoggedInDeviceNumber } from '../getDeviceNumber';\nimport { generateSessionId } from '../sessionHandshake.js';\nimport { toPublicKeyString } from './validation';\n\n\nexport async function signDelegateAction({\n  ctx,\n  delegate,\n  rpcCall,\n  onEvent,\n  confirmationConfigOverride,\n  title,\n  body,\n  sessionId: providedSessionId,\n}: {\n  ctx: SignerWorkerManagerContext;\n  delegate: DelegateActionInput;\n  rpcCall: RpcCallPayload;\n  onEvent?: (update: onProgressEvents) => void;\n  confirmationConfigOverride?: Partial<ConfirmationConfig>;\n  title?: string;\n  body?: string;\n  sessionId?: string;\n}): Promise<{\n  signedDelegate: WasmSignedDelegate;\n  hash: string;\n  nearAccountId: AccountId;\n  logs?: string[];\n}> {\n  const sessionId = providedSessionId ?? generateSessionId();\n  const nearAccountId = rpcCall.nearAccountId || delegate.senderId;\n\n  const resolvedRpcCall = {\n    contractId: rpcCall.contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId,\n    nearRpcUrl: rpcCall.nearRpcUrl || (PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl.split(',')[0] || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl),\n    nearAccountId,\n  } as RpcCallPayload;\n\n  const actionsWasm = delegate.actions.map(toActionArgsWasm);\n  actionsWasm.forEach((action, actionIndex) => {\n    try {\n      validateActionArgsWasm(action);\n    } catch (error) {\n      throw new Error(\n        `Delegate action ${actionIndex} validation failed: ${error instanceof Error ? error.message : String(error)}`\n      );\n    }\n  });\n\n  const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);\n  const encryptedKeyData = await ctx.indexedDB.nearKeysDB.getEncryptedKey(nearAccountId, deviceNumber);\n  if (!encryptedKeyData) {\n    throw new Error(`No encrypted key found for account: ${nearAccountId}`);\n  }\n  if (!ctx.vrfWorkerManager) {\n    throw new Error('VrfWorkerManager not available for delegate signing');\n  }\n\n  const confirmation = await ctx.vrfWorkerManager.confirmAndPrepareSigningSession({\n    ctx,\n    sessionId,\n    kind: 'delegate',\n    nearAccountId,\n    delegate: {\n      senderId: delegate.senderId || nearAccountId,\n      receiverId: delegate.receiverId,\n      actions: actionsWasm,\n      nonce: delegate.nonce,\n      maxBlockHeight: delegate.maxBlockHeight,\n    },\n    rpcCall: resolvedRpcCall,\n    confirmationConfigOverride,\n    title,\n    body,\n  });\n\n  const intentDigest = confirmation.intentDigest;\n  const transactionContext = confirmation.transactionContext;\n  const credential = confirmation.credential ? JSON.stringify(confirmation.credential) : undefined;\n\n  const response = await ctx.sendMessage({\n    sessionId,\n    message: {\n      type: WorkerRequestType.SignDelegateAction,\n      payload: {\n        rpcCall: resolvedRpcCall,\n        createdAt: Date.now(),\n        decryption: {\n          encryptedPrivateKeyData: encryptedKeyData.encryptedData,\n          encryptedPrivateKeyChacha20NonceB64u: encryptedKeyData.chacha20NonceB64u,\n        },\n        delegate: {\n          senderId: delegate.senderId || nearAccountId,\n          receiverId: delegate.receiverId,\n          actions: actionsWasm,\n          nonce: delegate.nonce.toString(),\n          maxBlockHeight: delegate.maxBlockHeight.toString(),\n          publicKey: toPublicKeyString(delegate.publicKey),\n        },\n        intentDigest,\n        transactionContext,\n        credential,\n      },\n    },\n    onEvent,\n  });\n\n  // eslint-disable-next-line no-console\n  console.debug('[WebAuthnManager][delegate] raw worker response', response);\n\n  if (!isSignDelegateActionSuccess(response)) {\n    // eslint-disable-next-line no-console\n    console.error('[WebAuthnManager][delegate] non-success worker response', response);\n    const payloadError = (response as any)?.payload?.error;\n    throw new Error(payloadError || 'Delegate action signing failed');\n  }\n\n  const payload = response.payload as WasmDelegateSignResult;\n  if (!payload.success || !payload.signedDelegate || !payload.hash) {\n    // eslint-disable-next-line no-console\n    console.error('[WebAuthnManager][delegate] invalid delegate payload', payload);\n    throw new Error(payload.error || 'Delegate action signing failed');\n  }\n\n  return {\n    signedDelegate: payload.signedDelegate,\n    hash: payload.hash,\n    nearAccountId: toAccountId(nearAccountId),\n    logs: payload.logs,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AAmBA,eAAsB,mBAAmB,EACvC,KACA,UACA,SACA,SACA,4BACA,OACA,MACA,WAAW,qBAeV;CACD,MAAM,YAAY,qBAAqB;CACvC,MAAM,gBAAgB,QAAQ,iBAAiB,SAAS;CAExD,MAAM,kBAAkB;EACtB,YAAY,QAAQ,cAAc,gCAAgC;EAClE,YAAY,QAAQ,cAAe,gCAAgC,WAAW,MAAM,KAAK,MAAM,gCAAgC;EAC/H;;CAGF,MAAM,cAAc,SAAS,QAAQ,IAAI;AACzC,aAAY,SAAS,QAAQ,gBAAgB;AAC3C,MAAI;AACF,0BAAuB;WAChB,OAAO;AACd,SAAM,IAAI,MACR,mBAAmB,YAAY,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,OAAO;;;CAK3G,MAAM,eAAe,MAAM,4BAA4B,eAAe,IAAI,UAAU;CACpF,MAAM,mBAAmB,MAAM,IAAI,UAAU,WAAW,gBAAgB,eAAe;AACvF,KAAI,CAAC,iBACH,OAAM,IAAI,MAAM,uCAAuC;AAEzD,KAAI,CAAC,IAAI,iBACP,OAAM,IAAI,MAAM;CAGlB,MAAM,eAAe,MAAM,IAAI,iBAAiB,gCAAgC;EAC9E;EACA;EACA,MAAM;EACN;EACA,UAAU;GACR,UAAU,SAAS,YAAY;GAC/B,YAAY,SAAS;GACrB,SAAS;GACT,OAAO,SAAS;GAChB,gBAAgB,SAAS;;EAE3B,SAAS;EACT;EACA;EACA;;CAGF,MAAM,eAAe,aAAa;CAClC,MAAM,qBAAqB,aAAa;CACxC,MAAM,aAAa,aAAa,aAAa,KAAK,UAAU,aAAa,cAAc;CAEvF,MAAM,WAAW,MAAM,IAAI,YAAY;EACrC;EACA,SAAS;GACP,MAAM,kBAAkB;GACxB,SAAS;IACP,SAAS;IACT,WAAW,KAAK;IAChB,YAAY;KACV,yBAAyB,iBAAiB;KAC1C,sCAAsC,iBAAiB;;IAEzD,UAAU;KACR,UAAU,SAAS,YAAY;KAC/B,YAAY,SAAS;KACrB,SAAS;KACT,OAAO,SAAS,MAAM;KACtB,gBAAgB,SAAS,eAAe;KACxC,WAAW,kBAAkB,SAAS;;IAExC;IACA;IACA;;;EAGJ;;AAIF,SAAQ,MAAM,mDAAmD;AAEjE,KAAI,CAAC,4BAA4B,WAAW;AAE1C,UAAQ,MAAM,2DAA2D;EACzE,MAAM,eAAgB,UAAkB,SAAS;AACjD,QAAM,IAAI,MAAM,gBAAgB;;CAGlC,MAAM,UAAU,SAAS;AACzB,KAAI,CAAC,QAAQ,WAAW,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,MAAM;AAEhE,UAAQ,MAAM,wDAAwD;AACtE,QAAM,IAAI,MAAM,QAAQ,SAAS;;AAGnC,QAAO;EACL,gBAAgB,QAAQ;EACxB,MAAM,QAAQ;EACd,eAAe,YAAY;EAC3B,MAAM,QAAQ"}
+{"version":3,"file":"signDelegateAction.js","names":["warnings: string[]","okResponse","okResponse: WorkerSuccessResponse<typeof WorkerRequestType.SignDelegateAction>","e: unknown","credentialForRelay: WebAuthnAuthenticationCredential | undefined"],"sources":["../../../../../../src/core/WebAuthnManager/SignerWorkerManager/handlers/signDelegateAction.ts"],"sourcesContent":["import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from '../../../defaultConfigs';\nimport { AccountId, toAccountId } from '../../../types/accountIds';\nimport { toActionArgsWasm, validateActionArgsWasm } from '../../../types/actions';\nimport { DelegateActionInput } from '../../../types/delegate';\nimport { type onProgressEvents } from '../../../types/sdkSentEvents';\nimport {\n  ConfirmationConfig,\n  RpcCallPayload,\n  type SignerMode,\n  WorkerRequestType,\n  type DelegateSignResponse,\n  isWorkerError,\n  isSignDelegateActionSuccess,\n  type WorkerSuccessResponse,\n  WasmSignedDelegate,\n} from '../../../types/signer-worker';\nimport type { WebAuthnAuthenticationCredential } from '../../../types';\nimport { removePrfOutputGuard } from '../../credentialsHelpers';\nimport { resolveSignerModeForThresholdSigning } from '../../../threshold/thresholdEd25519RelayerHealth';\nimport type {\n  LocalNearSkV3Material,\n  ThresholdEd25519_2p_V1Material,\n} from '../../../IndexedDBManager/passkeyNearKeysDB';\nimport type { TransactionContext } from '../../../types/rpc';\nimport type { VRFChallenge } from '../../../types/vrf-worker';\nimport {\n  clearCachedThresholdEd25519AuthSession,\n  getCachedThresholdEd25519AuthSessionJwt,\n  makeThresholdEd25519AuthSessionCacheKey,\n} from '../../../threshold/thresholdEd25519AuthSession';\nimport { isThresholdSessionAuthUnavailableError } from '../../../threshold/thresholdSessionPolicy';\nimport { normalizeThresholdEd25519ParticipantIds } from '../../../../threshold/participants';\nimport { SignerWorkerManagerContext } from '..';\nimport { getLastLoggedInDeviceNumber } from '../getDeviceNumber';\nimport { generateSessionId } from '../sessionHandshake.js';\nimport { ensureEd25519Prefix, toPublicKeyString } from './validation';\n\nexport async function signDelegateAction({\n  ctx,\n  delegate,\n  rpcCall,\n  signerMode,\n  onEvent,\n  confirmationConfigOverride,\n  title,\n  body,\n  sessionId: providedSessionId,\n}: {\n  ctx: SignerWorkerManagerContext;\n  delegate: DelegateActionInput;\n  rpcCall: RpcCallPayload;\n  signerMode: SignerMode;\n  onEvent?: (update: onProgressEvents) => void;\n  confirmationConfigOverride?: Partial<ConfirmationConfig>;\n  title?: string;\n  body?: string;\n  sessionId?: string;\n}): Promise<{\n  signedDelegate: WasmSignedDelegate;\n  hash: string;\n  nearAccountId: AccountId;\n  logs?: string[];\n}> {\n  const sessionId = providedSessionId ?? generateSessionId();\n  const nearAccountId = rpcCall.nearAccountId || delegate.senderId;\n  const relayerUrl = ctx.relayerUrl;\n\n  const resolvedRpcCall = {\n    contractId: rpcCall.contractId || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId,\n    nearRpcUrl: rpcCall.nearRpcUrl || (PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl.split(',')[0] || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl),\n    nearAccountId,\n  } as RpcCallPayload;\n\n  const actionsWasm = delegate.actions.map(toActionArgsWasm);\n  actionsWasm.forEach((action, actionIndex) => {\n    try {\n      validateActionArgsWasm(action);\n    } catch (error) {\n      throw new Error(\n        `Delegate action ${actionIndex} validation failed: ${error instanceof Error ? error.message : String(error)}`\n      );\n    }\n  });\n\n  const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, ctx.indexedDB.clientDB);\n  const [localKeyMaterial, thresholdKeyMaterial] = await Promise.all([\n    ctx.indexedDB.nearKeysDB.getLocalKeyMaterial(nearAccountId, deviceNumber),\n    ctx.indexedDB.nearKeysDB.getThresholdKeyMaterial(nearAccountId, deviceNumber),\n  ]);\n  if (!localKeyMaterial) {\n    throw new Error(`No local key material found for account: ${nearAccountId}`);\n  }\n\n  const warnings: string[] = [];\n  const vrfWorkerManager = ctx.vrfWorkerManager;\n  if (!vrfWorkerManager) {\n    throw new Error('VrfWorkerManager not available for delegate signing');\n  }\n\n  const resolvedSignerMode = await resolveSignerModeForThresholdSigning({\n    nearAccountId,\n    signerMode,\n    relayerUrl,\n    hasThresholdKeyMaterial: !!thresholdKeyMaterial,\n    warnings,\n  });\n\n  const signingContext = validateAndPrepareDelegateSigningContext({\n    nearAccountId,\n    resolvedSignerMode,\n    relayerUrl,\n    rpId: ctx.touchIdPrompt.getRpId(),\n    localKeyMaterial,\n    thresholdKeyMaterial,\n    providedDelegatePublicKey: delegate.publicKey,\n    warnings,\n  });\n\n  // Ensure nonce/block context is fetched for the same access key that will sign.\n  // Threshold signing MUST use the threshold/group public key (relayer access key) for:\n  // - correct nonce reservation\n  // - relayer scope checks (/authorize expects signingPayload.delegate.publicKey == relayer key)\n  ctx.nonceManager.initializeUser(toAccountId(nearAccountId), signingContext.signingNearPublicKeyStr);\n\n  const confirmation = await vrfWorkerManager.confirmAndPrepareSigningSession({\n    ctx,\n    sessionId,\n    kind: 'delegate',\n    ...(signingContext.threshold && !signingContext.threshold.thresholdSessionJwt ? { signingAuthMode: 'webauthn' } : {}),\n    nearAccountId,\n    delegate: {\n      senderId: delegate.senderId || nearAccountId,\n      receiverId: delegate.receiverId,\n      actions: actionsWasm,\n      nonce: delegate.nonce,\n      maxBlockHeight: delegate.maxBlockHeight,\n    },\n    rpcCall: resolvedRpcCall,\n    confirmationConfigOverride,\n    title,\n    body,\n  });\n\n  let { intentDigest, transactionContext, vrfChallenge, credential } =\n    extractSigningEvidenceFromConfirmation(confirmation);\n\n  const delegatePayload = {\n    senderId: delegate.senderId || nearAccountId,\n    receiverId: delegate.receiverId,\n    actions: actionsWasm,\n    nonce: delegate.nonce.toString(),\n    maxBlockHeight: delegate.maxBlockHeight.toString(),\n    publicKey: signingContext.delegatePublicKeyStr,\n  };\n\n  if (!signingContext.threshold) {\n    const response = await ctx.sendMessage<WorkerRequestType.SignDelegateAction>({\n      sessionId,\n      message: {\n        type: WorkerRequestType.SignDelegateAction,\n        payload: {\n          signerMode: signingContext.resolvedSignerMode,\n          rpcCall: resolvedRpcCall,\n          createdAt: Date.now(),\n          decryption: {\n            encryptedPrivateKeyData: localKeyMaterial.encryptedSk,\n            encryptedPrivateKeyChacha20NonceB64u: localKeyMaterial.chacha20NonceB64u,\n          },\n          delegate: delegatePayload,\n          intentDigest,\n          transactionContext,\n          credential,\n        },\n      },\n      onEvent,\n    });\n\n    const okResponse = requireOkSignDelegateActionResponse(response);\n    return {\n      signedDelegate: okResponse.payload.signedDelegate!,\n      hash: okResponse.payload.hash!,\n      nearAccountId: toAccountId(nearAccountId),\n      logs: [...(okResponse.payload.logs || []), ...warnings],\n    };\n  }\n\n  const requestPayload = {\n    signerMode: signingContext.resolvedSignerMode,\n    rpcCall: resolvedRpcCall,\n    createdAt: Date.now(),\n    decryption: {\n      encryptedPrivateKeyData: '',\n      encryptedPrivateKeyChacha20NonceB64u: '',\n    },\n    threshold: {\n      relayerUrl: signingContext.threshold.relayerUrl,\n      relayerKeyId: signingContext.threshold.thresholdKeyMaterial.relayerKeyId,\n      clientParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === 'client')?.id,\n      relayerParticipantId: signingContext.threshold.thresholdKeyMaterial.participants.find((p) => p.role === 'relayer')?.id,\n      participantIds: signingContext.threshold.thresholdKeyMaterial.participants.map((p) => p.id),\n      thresholdSessionKind: 'jwt' as const,\n      thresholdSessionJwt: signingContext.threshold.thresholdSessionJwt,\n    },\n    delegate: delegatePayload,\n    intentDigest,\n    transactionContext,\n    vrfChallenge,\n    credential,\n  };\n\n  let okResponse: WorkerSuccessResponse<typeof WorkerRequestType.SignDelegateAction>;\n  try {\n    const resp = await ctx.sendMessage<typeof WorkerRequestType.SignDelegateAction>({\n      sessionId,\n      message: { type: WorkerRequestType.SignDelegateAction, payload: requestPayload },\n      onEvent,\n    });\n    okResponse = requireOkSignDelegateActionResponse(resp);\n  } catch (e: unknown) {\n    const err = e instanceof Error ? e : new Error(String(e));\n    if (!isThresholdSessionAuthUnavailableError(err)) throw err;\n\n    clearCachedThresholdEd25519AuthSession(signingContext.threshold.thresholdSessionCacheKey);\n    signingContext.threshold.thresholdSessionJwt = undefined;\n    requestPayload.threshold.thresholdSessionJwt = undefined;\n\n    if (!credential || !vrfChallenge) {\n      const refreshed = await vrfWorkerManager.confirmAndPrepareSigningSession({\n        ctx,\n        sessionId,\n        kind: 'delegate',\n        signingAuthMode: 'webauthn',\n        nearAccountId,\n        delegate: {\n          senderId: delegate.senderId || nearAccountId,\n          receiverId: delegate.receiverId,\n          actions: actionsWasm,\n          nonce: delegate.nonce,\n          maxBlockHeight: delegate.maxBlockHeight,\n        },\n        rpcCall: resolvedRpcCall,\n        confirmationConfigOverride,\n        title,\n        body,\n      });\n\n      ({ intentDigest, transactionContext, vrfChallenge, credential } =\n        extractSigningEvidenceFromConfirmation(refreshed));\n\n      requestPayload.intentDigest = intentDigest;\n      requestPayload.transactionContext = transactionContext;\n      requestPayload.vrfChallenge = vrfChallenge;\n      requestPayload.credential = credential;\n    }\n\n    const resp = await ctx.sendMessage<typeof WorkerRequestType.SignDelegateAction>({\n      sessionId,\n      message: { type: WorkerRequestType.SignDelegateAction, payload: requestPayload },\n      onEvent,\n    });\n    okResponse = requireOkSignDelegateActionResponse(resp);\n  }\n\n  return {\n    signedDelegate: okResponse.payload.signedDelegate!,\n    hash: okResponse.payload.hash!,\n    nearAccountId: toAccountId(nearAccountId),\n    logs: [...(okResponse.payload.logs || []), ...warnings],\n  };\n}\n\ntype ThresholdDelegateSigningContext = {\n  resolvedSignerMode: 'threshold-signer';\n  signingNearPublicKeyStr: string;\n  delegatePublicKeyStr: string;\n  threshold: {\n    relayerUrl: string;\n    thresholdKeyMaterial: ThresholdEd25519_2p_V1Material;\n    thresholdSessionCacheKey: string;\n    thresholdSessionJwt: string | undefined;\n  };\n};\n\ntype LocalDelegateSigningContext = {\n  resolvedSignerMode: 'local-signer';\n  signingNearPublicKeyStr: string;\n  delegatePublicKeyStr: string;\n  threshold: null;\n};\n\ntype DelegateSigningContext = ThresholdDelegateSigningContext | LocalDelegateSigningContext;\n\nfunction validateAndPrepareDelegateSigningContext(args: {\n  nearAccountId: string;\n  resolvedSignerMode: SignerMode['mode'];\n  relayerUrl: string;\n  rpId: string | null;\n  localKeyMaterial: LocalNearSkV3Material;\n  thresholdKeyMaterial: ThresholdEd25519_2p_V1Material | null;\n  providedDelegatePublicKey: DelegateActionInput['publicKey'];\n  warnings: string[];\n}): DelegateSigningContext {\n  const localPublicKey = ensureEd25519Prefix(args.localKeyMaterial.publicKey);\n  if (!localPublicKey) {\n    throw new Error(`Missing local signing public key for ${args.nearAccountId}`);\n  }\n\n  const providedDelegatePublicKeyStr = ensureEd25519Prefix(toPublicKeyString(args.providedDelegatePublicKey));\n\n  if (args.resolvedSignerMode !== 'threshold-signer') {\n    if (providedDelegatePublicKeyStr && providedDelegatePublicKeyStr !== localPublicKey) {\n      args.warnings.push(\n        `Delegate public key ${providedDelegatePublicKeyStr} does not match local signer key; using ${localPublicKey}`\n      );\n    }\n    return {\n      resolvedSignerMode: 'local-signer',\n      signingNearPublicKeyStr: localPublicKey,\n      delegatePublicKeyStr: localPublicKey,\n      threshold: null,\n    };\n  }\n\n  const thresholdKeyMaterial = args.thresholdKeyMaterial;\n  if (!thresholdKeyMaterial) {\n    throw new Error(`Missing threshold key material for ${args.nearAccountId}`);\n  }\n\n  const thresholdPublicKey = ensureEd25519Prefix(thresholdKeyMaterial.publicKey);\n  if (!thresholdPublicKey) {\n    throw new Error(`Missing threshold signing public key for ${args.nearAccountId}`);\n  }\n\n  if (providedDelegatePublicKeyStr && providedDelegatePublicKeyStr !== thresholdPublicKey) {\n    args.warnings.push(\n      `Delegate public key ${providedDelegatePublicKeyStr} does not match threshold signer key; using ${thresholdPublicKey}`\n    );\n  }\n\n  const relayerUrl = String(args.relayerUrl || '').trim();\n  if (!relayerUrl) {\n    throw new Error('Missing relayerUrl (required for threshold-signer)');\n  }\n\n  const rpId = String(args.rpId || '').trim();\n  if (!rpId) {\n    throw new Error('Missing rpId for threshold signing');\n  }\n\n  const participantIds = normalizeThresholdEd25519ParticipantIds(thresholdKeyMaterial.participants.map((p) => p.id));\n  if (!participantIds || participantIds.length < 2) {\n    throw new Error(\n      `Invalid threshold signing participantIds (expected >=2 participants, got [${(participantIds || []).join(',')}])`\n    );\n  }\n\n  const thresholdSessionCacheKey = makeThresholdEd25519AuthSessionCacheKey({\n    nearAccountId: args.nearAccountId,\n    rpId,\n    relayerUrl,\n    relayerKeyId: thresholdKeyMaterial.relayerKeyId,\n    participantIds,\n  });\n\n  return {\n    resolvedSignerMode: 'threshold-signer',\n    signingNearPublicKeyStr: thresholdPublicKey,\n    delegatePublicKeyStr: thresholdPublicKey,\n    threshold: {\n      relayerUrl,\n      thresholdKeyMaterial,\n      thresholdSessionCacheKey,\n      thresholdSessionJwt: getCachedThresholdEd25519AuthSessionJwt(thresholdSessionCacheKey),\n    },\n  };\n}\n\nfunction extractSigningEvidenceFromConfirmation(confirmation: {\n  intentDigest: string;\n  transactionContext: TransactionContext;\n  vrfChallenge?: VRFChallenge;\n  credential?: unknown;\n}): {\n  intentDigest: string;\n  transactionContext: TransactionContext;\n  vrfChallenge: VRFChallenge | undefined;\n  credential: string | undefined;\n} {\n  const credentialForRelay: WebAuthnAuthenticationCredential | undefined = confirmation.credential\n    ? removePrfOutputGuard(confirmation.credential as WebAuthnAuthenticationCredential)\n    : undefined;\n\n  return {\n    intentDigest: confirmation.intentDigest,\n    transactionContext: confirmation.transactionContext,\n    vrfChallenge: confirmation.vrfChallenge,\n    credential: credentialForRelay ? JSON.stringify(credentialForRelay) : undefined,\n  };\n}\n\nfunction requireOkSignDelegateActionResponse(\n  response: DelegateSignResponse\n): WorkerSuccessResponse<typeof WorkerRequestType.SignDelegateAction> {\n  if (!isSignDelegateActionSuccess(response)) {\n    if (isWorkerError(response)) {\n      throw new Error(response.payload.error || 'Delegate action signing failed');\n    }\n    throw new Error('Delegate action signing failed');\n  }\n\n  if (!response.payload.success || !response.payload.signedDelegate || !response.payload.hash) {\n    throw new Error(response.payload.error || 'Delegate action signing failed');\n  }\n  return response;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAqCA,eAAsB,mBAAmB,EACvC,KACA,UACA,SACA,YACA,SACA,4BACA,OACA,MACA,WAAW,qBAgBV;CACD,MAAM,YAAY,qBAAqB;CACvC,MAAM,gBAAgB,QAAQ,iBAAiB,SAAS;CACxD,MAAM,aAAa,IAAI;CAEvB,MAAM,kBAAkB;EACtB,YAAY,QAAQ,cAAc,gCAAgC;EAClE,YAAY,QAAQ,cAAe,gCAAgC,WAAW,MAAM,KAAK,MAAM,gCAAgC;EAC/H;;CAGF,MAAM,cAAc,SAAS,QAAQ,IAAI;AACzC,aAAY,SAAS,QAAQ,gBAAgB;AAC3C,MAAI;AACF,0BAAuB;WAChB,OAAO;AACd,SAAM,IAAI,MACR,mBAAmB,YAAY,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,OAAO;;;CAK3G,MAAM,eAAe,MAAM,4BAA4B,eAAe,IAAI,UAAU;CACpF,MAAM,CAAC,kBAAkB,wBAAwB,MAAM,QAAQ,IAAI,CACjE,IAAI,UAAU,WAAW,oBAAoB,eAAe,eAC5D,IAAI,UAAU,WAAW,wBAAwB,eAAe;AAElE,KAAI,CAAC,iBACH,OAAM,IAAI,MAAM,4CAA4C;CAG9D,MAAMA,WAAqB;CAC3B,MAAM,mBAAmB,IAAI;AAC7B,KAAI,CAAC,iBACH,OAAM,IAAI,MAAM;CAGlB,MAAM,qBAAqB,MAAM,qCAAqC;EACpE;EACA;EACA;EACA,yBAAyB,CAAC,CAAC;EAC3B;;CAGF,MAAM,iBAAiB,yCAAyC;EAC9D;EACA;EACA;EACA,MAAM,IAAI,cAAc;EACxB;EACA;EACA,2BAA2B,SAAS;EACpC;;AAOF,KAAI,aAAa,eAAe,YAAY,gBAAgB,eAAe;CAE3E,MAAM,eAAe,MAAM,iBAAiB,gCAAgC;EAC1E;EACA;EACA,MAAM;EACN,GAAI,eAAe,aAAa,CAAC,eAAe,UAAU,sBAAsB,EAAE,iBAAiB,eAAe;EAClH;EACA,UAAU;GACR,UAAU,SAAS,YAAY;GAC/B,YAAY,SAAS;GACrB,SAAS;GACT,OAAO,SAAS;GAChB,gBAAgB,SAAS;;EAE3B,SAAS;EACT;EACA;EACA;;CAGF,IAAI,EAAE,cAAc,oBAAoB,cAAc,eACpD,uCAAuC;CAEzC,MAAM,kBAAkB;EACtB,UAAU,SAAS,YAAY;EAC/B,YAAY,SAAS;EACrB,SAAS;EACT,OAAO,SAAS,MAAM;EACtB,gBAAgB,SAAS,eAAe;EACxC,WAAW,eAAe;;AAG5B,KAAI,CAAC,eAAe,WAAW;EAC7B,MAAM,WAAW,MAAM,IAAI,YAAkD;GAC3E;GACA,SAAS;IACP,MAAM,kBAAkB;IACxB,SAAS;KACP,YAAY,eAAe;KAC3B,SAAS;KACT,WAAW,KAAK;KAChB,YAAY;MACV,yBAAyB,iBAAiB;MAC1C,sCAAsC,iBAAiB;;KAEzD,UAAU;KACV;KACA;KACA;;;GAGJ;;EAGF,MAAMC,eAAa,oCAAoC;AACvD,SAAO;GACL,gBAAgBA,aAAW,QAAQ;GACnC,MAAMA,aAAW,QAAQ;GACzB,eAAe,YAAY;GAC3B,MAAM,CAAC,GAAIA,aAAW,QAAQ,QAAQ,IAAK,GAAG;;;CAIlD,MAAM,iBAAiB;EACrB,YAAY,eAAe;EAC3B,SAAS;EACT,WAAW,KAAK;EAChB,YAAY;GACV,yBAAyB;GACzB,sCAAsC;;EAExC,WAAW;GACT,YAAY,eAAe,UAAU;GACrC,cAAc,eAAe,UAAU,qBAAqB;GAC5D,qBAAqB,eAAe,UAAU,qBAAqB,aAAa,MAAM,MAAM,EAAE,SAAS,WAAW;GAClH,sBAAsB,eAAe,UAAU,qBAAqB,aAAa,MAAM,MAAM,EAAE,SAAS,YAAY;GACpH,gBAAgB,eAAe,UAAU,qBAAqB,aAAa,KAAK,MAAM,EAAE;GACxF,sBAAsB;GACtB,qBAAqB,eAAe,UAAU;;EAEhD,UAAU;EACV;EACA;EACA;EACA;;CAGF,IAAIC;AACJ,KAAI;EACF,MAAM,OAAO,MAAM,IAAI,YAAyD;GAC9E;GACA,SAAS;IAAE,MAAM,kBAAkB;IAAoB,SAAS;;GAChE;;AAEF,eAAa,oCAAoC;UAC1CC,GAAY;EACnB,MAAM,MAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO;AACtD,MAAI,CAAC,uCAAuC,KAAM,OAAM;AAExD,yCAAuC,eAAe,UAAU;AAChE,iBAAe,UAAU,sBAAsB;AAC/C,iBAAe,UAAU,sBAAsB;AAE/C,MAAI,CAAC,cAAc,CAAC,cAAc;GAChC,MAAM,YAAY,MAAM,iBAAiB,gCAAgC;IACvE;IACA;IACA,MAAM;IACN,iBAAiB;IACjB;IACA,UAAU;KACR,UAAU,SAAS,YAAY;KAC/B,YAAY,SAAS;KACrB,SAAS;KACT,OAAO,SAAS;KAChB,gBAAgB,SAAS;;IAE3B,SAAS;IACT;IACA;IACA;;AAGF,IAAC,CAAE,cAAc,oBAAoB,cAAc,cACjD,uCAAuC;AAEzC,kBAAe,eAAe;AAC9B,kBAAe,qBAAqB;AACpC,kBAAe,eAAe;AAC9B,kBAAe,aAAa;;EAG9B,MAAM,OAAO,MAAM,IAAI,YAAyD;GAC9E;GACA,SAAS;IAAE,MAAM,kBAAkB;IAAoB,SAAS;;GAChE;;AAEF,eAAa,oCAAoC;;AAGnD,QAAO;EACL,gBAAgB,WAAW,QAAQ;EACnC,MAAM,WAAW,QAAQ;EACzB,eAAe,YAAY;EAC3B,MAAM,CAAC,GAAI,WAAW,QAAQ,QAAQ,IAAK,GAAG;;;AAyBlD,SAAS,yCAAyC,MASvB;CACzB,MAAM,iBAAiB,oBAAoB,KAAK,iBAAiB;AACjE,KAAI,CAAC,eACH,OAAM,IAAI,MAAM,wCAAwC,KAAK;CAG/D,MAAM,+BAA+B,oBAAoB,kBAAkB,KAAK;AAEhF,KAAI,KAAK,uBAAuB,oBAAoB;AAClD,MAAI,gCAAgC,iCAAiC,eACnE,MAAK,SAAS,KACZ,uBAAuB,6BAA6B,0CAA0C;AAGlG,SAAO;GACL,oBAAoB;GACpB,yBAAyB;GACzB,sBAAsB;GACtB,WAAW;;;CAIf,MAAM,uBAAuB,KAAK;AAClC,KAAI,CAAC,qBACH,OAAM,IAAI,MAAM,sCAAsC,KAAK;CAG7D,MAAM,qBAAqB,oBAAoB,qBAAqB;AACpE,KAAI,CAAC,mBACH,OAAM,IAAI,MAAM,4CAA4C,KAAK;AAGnE,KAAI,gCAAgC,iCAAiC,mBACnE,MAAK,SAAS,KACZ,uBAAuB,6BAA6B,8CAA8C;CAItG,MAAM,aAAa,OAAO,KAAK,cAAc,IAAI;AACjD,KAAI,CAAC,WACH,OAAM,IAAI,MAAM;CAGlB,MAAM,OAAO,OAAO,KAAK,QAAQ,IAAI;AACrC,KAAI,CAAC,KACH,OAAM,IAAI,MAAM;CAGlB,MAAM,iBAAiB,wCAAwC,qBAAqB,aAAa,KAAK,MAAM,EAAE;AAC9G,KAAI,CAAC,kBAAkB,eAAe,SAAS,EAC7C,OAAM,IAAI,MACR,8EAA8E,kBAAkB,IAAI,KAAK,KAAK;CAIlH,MAAM,2BAA2B,wCAAwC;EACvE,eAAe,KAAK;EACpB;EACA;EACA,cAAc,qBAAqB;EACnC;;AAGF,QAAO;EACL,oBAAoB;EACpB,yBAAyB;EACzB,sBAAsB;EACtB,WAAW;GACT;GACA;GACA;GACA,qBAAqB,wCAAwC;;;;AAKnE,SAAS,uCAAuC,cAU9C;CACA,MAAMC,qBAAmE,aAAa,aAClF,qBAAqB,aAAa,cAClC;AAEJ,QAAO;EACL,cAAc,aAAa;EAC3B,oBAAoB,aAAa;EACjC,cAAc,aAAa;EAC3B,YAAY,qBAAqB,KAAK,UAAU,sBAAsB;;;AAI1E,SAAS,oCACP,UACoE;AACpE,KAAI,CAAC,4BAA4B,WAAW;AAC1C,MAAI,cAAc,UAChB,OAAM,IAAI,MAAM,SAAS,QAAQ,SAAS;AAE5C,QAAM,IAAI,MAAM;;AAGlB,KAAI,CAAC,SAAS,QAAQ,WAAW,CAAC,SAAS,QAAQ,kBAAkB,CAAC,SAAS,QAAQ,KACrF,OAAM,IAAI,MAAM,SAAS,QAAQ,SAAS;AAE5C,QAAO"}