@tatchi-xyz/sdk 0.21.0 → 0.31.1

package/dist/esm/sdk/requestHelpers-aUKhXiEl.js

@@ -1,1393 +0,0 @@
-import { isArray, isFunction, isObject, isString } from "./validation-DhPPUba7.js";
-
-//#region src/utils/validation.ts
-/**
-* Validate NEAR account ID format with optional suffix restrictions
-* @param nearAccountId - The account ID to validate
-* @param options - Optional validation constraints
-*/
-function validateNearAccountId(nearAccountId, options = {
-	allowedSuffixes: ["testnet", "near"],
-	requireTopLevelDomain: false
-}) {
-	if (!nearAccountId || typeof nearAccountId !== "string") return {
-		valid: false,
-		error: "Account ID must be a non-empty string"
-	};
-	const parts = nearAccountId.split(".");
-	if (parts.length < 2) return {
-		valid: false,
-		error: "Account ID must contain at least one dot (e.g., username.testnet)"
-	};
-	if (options.requireTopLevelDomain && parts.length !== 2) {
-		const suffixList = options.allowedSuffixes?.join(", ") || "valid suffixes";
-		return {
-			valid: false,
-			error: `Invalid NEAR account ID format. Expected format: <username>.<suffix> where suffix is one of: ${suffixList}`
-		};
-	}
-	const username = parts[0];
-	const suffix = parts[parts.length - 1];
-	const domain = parts.slice(1).join(".");
-	if (!username || username.length === 0) return {
-		valid: false,
-		error: "Username part cannot be empty"
-	};
-	if (!/^[a-z0-9_\-]+$/.test(username)) return {
-		valid: false,
-		error: "Username can only contain lowercase letters, numbers, underscores, and hyphens"
-	};
-	if (!domain || domain.length === 0) return {
-		valid: false,
-		error: "Domain part cannot be empty"
-	};
-	if (options.allowedSuffixes && options.allowedSuffixes.length > 0) {
-		const matchesAnySuffix = options.allowedSuffixes.some((allowedSuffix) => {
-			if (!allowedSuffix.includes(".")) return suffix === allowedSuffix;
-			return nearAccountId.endsWith(`.${allowedSuffix}`);
-		});
-		if (!matchesAnySuffix) return {
-			valid: false,
-			error: `Invalid NEAR account ID suffix. Expected account to end with one of: ${options.allowedSuffixes.join(", ")}`
-		};
-	}
-	return { valid: true };
-}
-
-//#endregion
-//#region src/core/types/accountIds.ts
-/**
-* Convert and validate string to AccountId
-* Validates proper NEAR account format (must contain at least one dot)
-*/
-function toAccountId(accountId) {
-	const validation = validateNearAccountId(accountId);
-	if (!validation.valid) throw new Error(`Invalid NEAR account ID: ${accountId}`);
-	return accountId;
-}
-
-//#endregion
-//#region src/utils/base64.ts
-/**
-* Encodes binary data to standard base64 format for NEAR RPC compatibility.
-* Uses standard base64 characters (+, /, =) rather than base64url encoding.
-*
-* Important: Avoids spreading large arrays into String.fromCharCode(...) which
-* can overflow the JS call stack when encoding big WASM binaries.
-*
-* @param value - ArrayBufferLike or ArrayBufferView containing the binary data to encode
-* @returns Standard base64-encoded string with padding
-*/
-const base64Encode = (value) => {
-	const bytes = ArrayBuffer.isView(value) ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength) : new Uint8Array(value);
-	let binary = "";
-	for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
-	return btoa(binary);
-};
-/**
-* Decodes a standard base64-encoded string into a Uint8Array.
-* Handles standard base64 format with +, /, and = characters.
-*
-* @param base64 - The base64-encoded string to decode
-* @returns Uint8Array containing the decoded bytes
-* @throws Error if decoding fails due to invalid base64 input
-*/
-function base64Decode(base64) {
-	const binaryString = atob(base64);
-	const bytes = new Uint8Array(binaryString.length);
-	for (let i = 0; i < binaryString.length; i++) bytes[i] = binaryString.charCodeAt(i);
-	return bytes;
-}
-/**
-* Encodes an ArrayBuffer into a base64url string.
-* Converts binary data to base64 then replaces standard base64 characters with URL-safe ones:
-* + -> -
-* / -> _
-* Removes padding = characters
-*
-* Used for WebAuthn API compatibility in browser environments.
-* Equivalent to Buffer.from(value).toString('base64url') in Node.js.
-*
-* @param value - The ArrayBufferLike or ArrayBufferView to encode
-* @returns A base64url-encoded string without padding
-*/
-const base64UrlEncode = (value) => {
-	return base64Encode(value).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-};
-/**
-* Decodes a base64url-encoded string into a Uint8Array.
-* Handles base64url format by replacing URL-safe characters and adding padding.
-*
-* @param base64Url - The base64url-encoded string to decode
-* @returns Uint8Array containing the decoded bytes
-* @throws Error if decoding fails due to invalid base64url input
-*/
-function base64UrlDecode(base64Url) {
-	const padding = "=".repeat((4 - base64Url.length % 4) % 4);
-	const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/") + padding;
-	const binaryString = atob(base64);
-	const bytes = new Uint8Array(binaryString.length);
-	for (let i = 0; i < binaryString.length; i++) bytes[i] = binaryString.charCodeAt(i);
-	return bytes;
-}
-
-//#endregion
-//#region src/utils/errors.ts
-/**
-* Centralized error handling utilities for the Passkey SDK
-*/
-/**
-* Best-effort error message extractor without relying on `any`.
-* Always returns a string (may be empty when nothing usable can be derived).
-*/
-function errorMessage(err) {
-	try {
-		if (typeof err === "string") return err;
-		if (err && typeof err.message === "string") return err.message;
-		return String(err ?? "");
-	} catch {
-		return "";
-	}
-}
-/**
-* Normalize any thrown value into an Error instance.
-* - preserves message/name/stack when available
-* - best-effort copies optional code/details properties if present
-*/
-function toError(e) {
-	if (e instanceof Error) return e;
-	const err = new Error(errorMessage(e));
-	try {
-		const src = e;
-		if (typeof src?.name === "string") err.name = src.name;
-		if (typeof src?.stack === "string") err.stack = src.stack;
-		if (src && typeof src.code !== "undefined") err.code = src.code;
-		if (src && typeof src.details !== "undefined") err.details = src.details;
-	} catch {}
-	return err;
-}
-/**
-* Check if an error is related to user cancellation of TouchID/FaceID prompt
-* @param error - The error object or error message string
-* @returns true if the error indicates user cancellation
-*/
-function isTouchIdCancellationError(error) {
-	const msg = errorMessage(error);
-	const lower = msg.toLowerCase();
-	return msg.includes("The operation either timed out or was not allowed") || msg.includes("NotAllowedError") || msg.includes("AbortError") || lower.includes("user cancelled") || lower.includes("user canceled") || lower.includes("user aborted");
-}
-
-//#endregion
-//#region src/core/types/vrf-worker.ts
-/**
-* Decode VRF output and use first 32 bytes as WebAuthn challenge
-* @param vrfChallenge - VRF challenge object
-* @returns 32-byte Uint8Array
-*/
-function outputAs32Bytes(vrfChallenge) {
-	let vrfOutputBytes = base64UrlDecode(vrfChallenge.vrfOutput);
-	return vrfOutputBytes.slice(0, 32);
-}
-/**
-* Validate and create a VRFChallenge object
-* @param vrfChallengeData - The challenge data to validate
-* @returns VRFChallenge object
-*/
-function validateVRFChallenge(vrfChallengeData) {
-	if (!vrfChallengeData.vrfInput || typeof vrfChallengeData.vrfInput !== "string") throw new Error("vrfInput must be a non-empty string");
-	if (!vrfChallengeData.vrfOutput || typeof vrfChallengeData.vrfOutput !== "string") throw new Error("vrfOutput must be a non-empty string");
-	if (!vrfChallengeData.vrfProof || typeof vrfChallengeData.vrfProof !== "string") throw new Error("vrfProof must be a non-empty string");
-	if (!vrfChallengeData.vrfPublicKey || typeof vrfChallengeData.vrfPublicKey !== "string") throw new Error("vrfPublicKey must be a non-empty string");
-	if (!vrfChallengeData.userId || typeof vrfChallengeData.userId !== "string") throw new Error("userId must be a non-empty string");
-	if (!vrfChallengeData.rpId || typeof vrfChallengeData.rpId !== "string") throw new Error("rpId must be a non-empty string");
-	if (!vrfChallengeData.blockHeight || typeof vrfChallengeData.blockHeight !== "string") throw new Error("blockHeight must be a non-empty string");
-	if (!vrfChallengeData.blockHash || typeof vrfChallengeData.blockHash !== "string") throw new Error("blockHash must be a non-empty string");
-	return {
-		vrfInput: vrfChallengeData.vrfInput,
-		vrfOutput: vrfChallengeData.vrfOutput,
-		vrfProof: vrfChallengeData.vrfProof,
-		vrfPublicKey: vrfChallengeData.vrfPublicKey,
-		userId: vrfChallengeData.userId,
-		rpId: vrfChallengeData.rpId,
-		blockHeight: vrfChallengeData.blockHeight,
-		blockHash: vrfChallengeData.blockHash
-	};
-}
-/**
-* Create a random VRF challenge
-* @returns Partial<VRFChallenge> with vrfOutput set, but other fields are undefined
-* This is used for local operations that don't require a VRF verification
-*/
-function createRandomVRFChallenge() {
-	const challenge = crypto.getRandomValues(new Uint8Array(32));
-	const vrfOutput = base64UrlEncode(challenge.buffer);
-	return {
-		vrfOutput,
-		vrfInput: void 0,
-		vrfProof: void 0,
-		vrfPublicKey: void 0,
-		userId: void 0,
-		rpId: void 0,
-		blockHeight: void 0,
-		blockHash: void 0
-	};
-}
-
-//#endregion
-//#region src/core/WebAuthnManager/credentialsHelpers.ts
-/**
-* Serialize PublicKeyCredential for both authentication and registration for WASM worker
-* - Uses base64url encoding for WASM compatibility
-*
-* @returns SerializableCredential - The serialized credential
-* - Does not return PRF outputs
-*/
-function serializeRegistrationCredential(credential) {
-	const response = credential.response;
-	let transports = [];
-	try {
-		const fn = response?.getTransports;
-		if (typeof fn === "function") transports = fn.call(response) || [];
-	} catch {
-		transports = [];
-	}
-	return {
-		id: credential.id,
-		rawId: base64UrlEncode(credential.rawId),
-		type: credential.type,
-		authenticatorAttachment: credential.authenticatorAttachment ?? void 0,
-		response: {
-			clientDataJSON: base64UrlEncode(response.clientDataJSON),
-			attestationObject: base64UrlEncode(response.attestationObject),
-			transports
-		},
-		clientExtensionResults: { prf: { results: {
-			first: void 0,
-			second: void 0
-		} } }
-	};
-}
-function serializeAuthenticationCredential(credential) {
-	const response = credential.response;
-	return {
-		id: credential.id,
-		rawId: base64UrlEncode(credential.rawId),
-		type: credential.type,
-		authenticatorAttachment: credential.authenticatorAttachment ?? void 0,
-		response: {
-			clientDataJSON: base64UrlEncode(response.clientDataJSON),
-			authenticatorData: base64UrlEncode(response.authenticatorData),
-			signature: base64UrlEncode(response.signature),
-			userHandle: response.userHandle ? base64UrlEncode(response.userHandle) : void 0
-		},
-		clientExtensionResults: { prf: { results: {
-			first: void 0,
-			second: void 0
-		} } }
-	};
-}
-/**
-* Serialize PublicKeyCredential for both authentication and registration for WASM worker
-* @returns SerializableCredential - The serialized credential
-* - INCLUDES PRF outputs
-*/
-function serializeRegistrationCredentialWithPRF({ credential, firstPrfOutput = true, secondPrfOutput = true }) {
-	const base = serializeRegistrationCredential(credential);
-	const { chacha20PrfOutput, ed25519PrfOutput } = extractPrfFromCredential({
-		credential,
-		firstPrfOutput,
-		secondPrfOutput
-	});
-	return {
-		...base,
-		clientExtensionResults: { prf: { results: {
-			first: chacha20PrfOutput,
-			second: ed25519PrfOutput
-		} } }
-	};
-}
-function serializeAuthenticationCredentialWithPRF({ credential, firstPrfOutput = true, secondPrfOutput = false }) {
-	const base = serializeAuthenticationCredential(credential);
-	const { chacha20PrfOutput, ed25519PrfOutput } = extractPrfFromCredential({
-		credential,
-		firstPrfOutput,
-		secondPrfOutput
-	});
-	return {
-		...base,
-		clientExtensionResults: { prf: { results: {
-			first: chacha20PrfOutput,
-			second: ed25519PrfOutput
-		} } }
-	};
-}
-/**
-* Validates and normalizes a serialized WebAuthn registration credential.
-* Ensures required fields exist and have the expected primitive types.
-* Populates missing optional arrays like transports with [].
-*/
-function normalizeRegistrationCredential(input) {
-	if (!isObject(input)) throw new Error("Invalid credential: not an object");
-	const candidate = input;
-	const normalized = { ...candidate };
-	if (!isString(normalized.id)) throw new Error("Invalid credential.id");
-	if (!isString(normalized.type)) throw new Error("Invalid credential.type");
-	if (!isString(normalized.rawId)) normalized.rawId = "";
-	if (normalized.authenticatorAttachment !== void 0 && !isString(normalized.authenticatorAttachment)) normalized.authenticatorAttachment = String(normalized.authenticatorAttachment);
-	const response = isObject(normalized.response) ? { ...normalized.response } : {};
-	if (!isString(response.clientDataJSON)) response.clientDataJSON = "";
-	if (!isString(response.attestationObject)) response.attestationObject = "";
-	if (!isArray(response.transports)) response.transports = [];
-	normalized.response = response;
-	normalized.clientExtensionResults = normalizeClientExtensionOutputs(normalized.clientExtensionResults);
-	return normalized;
-}
-/**
-* Removes PRF outputs from the credential
-* @param credential - The WebAuthn credential containing PRF outputs
-* @returns Credential with PRF results cleared
-*/
-function removePrfOutputGuard(credential) {
-	const credentialWithoutPrf = {
-		...credential,
-		clientExtensionResults: {
-			...credential.clientExtensionResults,
-			prf: { results: {
-				first: void 0,
-				second: void 0
-			} }
-		}
-	};
-	return credentialWithoutPrf;
-}
-/**
-* Returns true when the input looks like a serialized registration credential
-* (i.e., plain object with base64url string fields), not a live PublicKeyCredential.
-*/
-function isSerializedRegistrationCredential(x) {
-	if (!isObject(x)) return false;
-	const candidate = x;
-	if (!isString(candidate.id) || !isString(candidate.rawId) || !isString(candidate.type)) return false;
-	if (!isObject(candidate.response)) return false;
-	const response = candidate.response;
-	if (!isString(response.clientDataJSON) || !isString(response.attestationObject)) return false;
-	return response.transports == null || isArray(response.transports);
-}
-/**
-* Generate ChaCha20Poly1305 salt using account-specific HKDF for encryption key derivation
-* @param nearAccountId - NEAR account ID to scope the salt to
-* @returns 32-byte Uint8Array salt for ChaCha20Poly1305 key derivation
-*/
-function generateChaCha20Salt(nearAccountId) {
-	const saltString = `chacha20-salt:${nearAccountId}`;
-	const salt = new Uint8Array(32);
-	const saltBytes = new TextEncoder().encode(saltString);
-	salt.set(saltBytes.slice(0, 32));
-	return salt;
-}
-/**
-* Generate Ed25519 salt using account-specific HKDF for signing key derivation
-* @param nearAccountId - NEAR account ID to scope the salt to
-* @returns 32-byte Uint8Array salt for Ed25519 key derivation
-*/
-function generateEd25519Salt(nearAccountId) {
-	const saltString = `ed25519-salt:${nearAccountId}`;
-	const salt = new Uint8Array(32);
-	const saltBytes = new TextEncoder().encode(saltString);
-	salt.set(saltBytes.slice(0, 32));
-	return salt;
-}
-/**
-* Extract PRF outputs from WebAuthn credential extension results
-* ENCODING: Uses base64url for WASM compatibility
-* @param credential - WebAuthn credential with dual PRF extension results
-* @param firstPrfOutput - Whether to include the first PRF output (default: true)
-* @param secondPrfOutput - Whether to include the second PRF output (default: false)
-* @returns PRF outputs
-*/
-function extractPrfFromCredential({ credential, firstPrfOutput = true, secondPrfOutput = false }) {
-	const extensionResults = getExtensionResults(credential);
-	const prfResults = extractPrfResultsObject(extensionResults);
-	validatePrfResults(prfResults, firstPrfOutput, secondPrfOutput);
-	const firstEncoded = firstPrfOutput ? normalizePrfValueToBase64Url(prfResults.first) : void 0;
-	const secondEncoded = secondPrfOutput ? normalizePrfValueToBase64Url(prfResults.second) : void 0;
-	if (firstPrfOutput && !firstEncoded) throw new Error("Missing PRF result: first");
-	if (secondPrfOutput && !secondEncoded) throw new Error("Missing PRF result: second");
-	return {
-		chacha20PrfOutput: firstEncoded || "",
-		ed25519PrfOutput: secondEncoded || ""
-	};
-}
-/** Get extension results from credential (live or serialized) */
-function getExtensionResults(credential) {
-	try {
-		const fn = credential.getClientExtensionResults;
-		if (typeof fn === "function") return fn.call(credential);
-	} catch {}
-	return credential.clientExtensionResults;
-}
-/** Extract PRF results object from extension results */
-function extractPrfResultsObject(extensionResults) {
-	try {
-		return extensionResults?.prf?.results;
-	} catch {
-		return void 0;
-	}
-}
-/** Validate PRF results are present and not empty */
-function validatePrfResults(prfResults, firstRequired, secondRequired) {
-	if (!prfResults) throw new Error("Missing PRF results from credential, use a PRF-enabled Authenticator");
-	const hasAnyPrfData = prfResults.first !== void 0 || prfResults.second !== void 0;
-	if (!hasAnyPrfData && (firstRequired || secondRequired)) throw new Error("Missing PRF result - PRF evaluation failed: results object is empty");
-}
-/** Normalize a PRF value to base64url string */
-function normalizePrfValueToBase64Url(value) {
-	if (!value) return void 0;
-	if (typeof value === "string") return value;
-	if (value instanceof ArrayBuffer) return base64UrlEncode(value);
-	if (ArrayBuffer.isView(value)) return base64UrlEncode(value.buffer);
-	try {
-		return base64UrlEncode(value);
-	} catch {
-		try {
-			return base64UrlEncode(new Uint8Array(value).buffer);
-		} catch {
-			return void 0;
-		}
-	}
-}
-/**
-* Normalize WebAuthn client extension outputs into an SDK‑local, clone‑safe shape.
-*
-* Purpose:
-* - Browsers return extension results on PublicKeyCredential in a variety of
-*   shapes and with optional presence. This helper takes an unknown value
-*   (either a live `credential.getClientExtensionResults()` object or a
-*   serialized snapshot) and produces a strictly typed
-*   `AuthenticationExtensionsClientOutputs` compatible with our WASM workers
-*   and cross‑window message passing (structured‑clone safe).
-*/
-function normalizeClientExtensionOutputs(input) {
-	const out = { prf: { results: {
-		first: void 0,
-		second: void 0
-	} } };
-	const src = isObject(input) ? input : {};
-	if (typeof src.appid === "boolean") out.appid = src.appid;
-	if (typeof src.appidExclude === "boolean") out.appidExclude = src.appidExclude;
-	if (typeof src.hmacCreateSecret === "boolean") out.hmacCreateSecret = src.hmacCreateSecret;
-	if (isObject(src.credProps)) {
-		const cp = src.credProps;
-		const outCp = {};
-		if (typeof cp.rk === "boolean") outCp.rk = cp.rk;
-		out.credProps = outCp;
-	}
-	if (isArray(src.uvm)) {
-		const uvmArr = src.uvm.filter(isArray).map((t) => {
-			const a = t;
-			const n0 = typeof a[0] === "number" ? a[0] : void 0;
-			const n1 = typeof a[1] === "number" ? a[1] : void 0;
-			const n2 = typeof a[2] === "number" ? a[2] : void 0;
-			return typeof n0 === "number" && typeof n1 === "number" && typeof n2 === "number" ? [
-				n0,
-				n1,
-				n2
-			] : void 0;
-		}).filter((x) => Array.isArray(x));
-		if (uvmArr.length > 0) out.uvm = uvmArr;
-	}
-	if (isObject(src.prf)) {
-		const prf = src.prf;
-		const results = isObject(prf.results) ? prf.results : {};
-		const first = results.first;
-		const second = results.second;
-		out.prf = { results: {
-			first: isString(first) ? first : void 0,
-			second: isString(second) ? second : void 0
-		} };
-	}
-	return out;
-}
-
-//#endregion
-//#region src/core/WebAuthnManager/WebAuthnFallbacks/safari-fallbacks.ts
-const WebAuthnBridgeMessage = {
-	Create: "WALLET_WEBAUTHN_CREATE",
-	Get: "WALLET_WEBAUTHN_GET",
-	CreateResult: "WALLET_WEBAUTHN_CREATE_RESULT",
-	GetResult: "WALLET_WEBAUTHN_GET_RESULT"
-};
-function getResultTypeFor(kind) {
-	return kind === WebAuthnBridgeMessage.Get ? WebAuthnBridgeMessage.GetResult : WebAuthnBridgeMessage.CreateResult;
-}
-/**
-* Execute a WebAuthn operation with Safari-aware fallbacks.
-*
-* Steps:
-* 1) Try native WebAuthn via navigator.credentials.{create|get}
-* 2) If the failure matches Safari's ancestor-origin restriction and we are in an iframe,
-*    ask the parent/top-level window to perform the WebAuthn operation (bridge). If the
-*    parent reports a user cancellation, throw NotAllowedError; if it times out, continue.
-* 3) If the failure matches Safari's "document not focused" path, first attempt to refocus
-*    and retry native once; if still blocked and in an iframe, ask the parent window to handle it.
-* 4) Generic last resort: when in an iframe (constrained context), always attempt the parent
-*    WebAuthn once even if the error wasn't recognized as a Safari-specific case. If the parent
-*    path times out, surface a deterministic timeout error without re-trying native again.
-* 5) Otherwise, rethrow the original error.
-*/
-async function executeWebAuthnWithParentFallbacksSafari(kind, publicKey, deps) {
-	const { rpId, inIframe, timeoutMs = 6e4, permitGetBridgeOnAncestorError = true } = deps;
-	const bridgeClient = deps.bridgeClient || new WindowParentDomainWebAuthnClient();
-	const isTestForceNativeFail = () => {
-		const g = globalThis;
-		const w = typeof window !== "undefined" ? window : void 0;
-		return !!(g && g.__W3A_TEST_FORCE_NATIVE_FAIL) || !!(w && w.__W3A_TEST_FORCE_NATIVE_FAIL);
-	};
-	const bumpCounter = (key) => {
-		const g = globalThis;
-		g[key] = (g[key] || 0) + 1;
-	};
-	if (isTestForceNativeFail()) {
-		if (kind === "create") bumpCounter("__W3A_TEST_NATIVE_CREATE_ATTEMPTS");
-		else bumpCounter("__W3A_TEST_NATIVE_GET_ATTEMPTS");
-		try {
-			const bridged = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);
-			if (bridged?.ok) return bridged.credential;
-			if (bridged && !bridged.timeout) throw notAllowedError(bridged.error || "WebAuthn cancelled or failed (bridge)");
-			throw new Error("WebAuthn bridge timeout");
-		} catch (be) {
-			throw notAllowedError(be?.message || "WebAuthn bridge failed");
-		}
-	}
-	const tryNative = async () => {
-		if (kind === "create") {
-			bumpCounter("__W3A_TEST_NATIVE_CREATE_ATTEMPTS");
-			if (isTestForceNativeFail()) throw notAllowedError("Forced native fail (create)");
-			return await navigator.credentials.create({
-				publicKey,
-				...deps.abortSignal ? { signal: deps.abortSignal } : {}
-			});
-		} else {
-			bumpCounter("__W3A_TEST_NATIVE_GET_ATTEMPTS");
-			if (isTestForceNativeFail()) throw notAllowedError("Forced native fail (get)");
-			return await navigator.credentials.get({
-				publicKey,
-				...deps.abortSignal ? { signal: deps.abortSignal } : {}
-			});
-		}
-	};
-	try {
-		return await tryNative();
-	} catch (e) {
-		const name = safeName(e);
-		if (name === "NotAllowedError" && !isAncestorOriginError(e) && !isDocumentNotFocusedError(e)) throw e;
-		if (isAncestorOriginError(e) && inIframe) {
-			if (kind === "get" && !permitGetBridgeOnAncestorError) throw e;
-			try {
-				const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);
-				if (bridgedCredentials?.ok) return bridgedCredentials.credential;
-				if (bridgedCredentials && !bridgedCredentials.timeout) throw notAllowedError(bridgedCredentials.error || "WebAuthn get cancelled or failed (bridge)");
-			} catch (be) {
-				throw notAllowedError(be?.message || "WebAuthn bridge failed");
-			}
-		}
-		if (isDocumentNotFocusedError(e)) {
-			const focused = await attemptRefocus();
-			if (focused) try {
-				return await tryNative();
-			} catch {}
-			if (inIframe) try {
-				const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);
-				if (bridgedCredentials?.ok) return bridgedCredentials.credential;
-				if (bridgedCredentials && !bridgedCredentials.timeout) throw notAllowedError(bridgedCredentials.error || "WebAuthn get cancelled or failed (bridge)");
-			} catch (be) {
-				throw notAllowedError(be?.message || "WebAuthn bridge failed");
-			}
-		}
-		if (inIframe) try {
-			const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);
-			if (bridgedCredentials?.ok) return bridgedCredentials.credential;
-			if (bridgedCredentials && !bridgedCredentials.timeout) throw notAllowedError(bridgedCredentials.error || "WebAuthn cancelled or failed (bridge)");
-			throw new Error("WebAuthn bridge timeout");
-		} catch (be) {
-			throw notAllowedError(be?.message || "WebAuthn bridge failed");
-		}
-		throw e;
-	}
-}
-async function requestParentDomainWebAuthn(kind, publicKey, client, timeoutMs) {
-	if (kind === "create") return client.request(WebAuthnBridgeMessage.Create, publicKey, timeoutMs);
-	return client.request(WebAuthnBridgeMessage.Get, publicKey, timeoutMs);
-}
-var WindowParentDomainWebAuthnClient = class {
-	async request(kind, publicKey, timeoutMs = 6e4) {
-		const requestId = `${kind}:${Date.now()}:${Math.random().toString(36).slice(2)}`;
-		const resultType = getResultTypeFor(kind);
-		return new Promise((resolve) => {
-			let settled = false;
-			const finish = (val) => {
-				if (!settled) {
-					settled = true;
-					resolve(val);
-				}
-			};
-			const onMessage = (ev) => {
-				const payload = ev?.data;
-				if (!payload || typeof payload.type !== "string") return;
-				const t = payload.type;
-				if (t !== resultType) return;
-				const rid = payload.requestId;
-				if (rid !== requestId) return;
-				window.removeEventListener("message", onMessage);
-				const ok = !!payload.ok;
-				const cred = payload.credential;
-				const err = payload.error;
-				if (ok && cred) return finish({
-					ok: true,
-					credential: cred
-				});
-				return finish({
-					ok: false,
-					error: typeof err === "string" ? err : void 0
-				});
-			};
-			window.addEventListener("message", onMessage);
-			window.parent?.postMessage({
-				type: kind,
-				requestId,
-				publicKey
-			}, "*");
-			setTimeout(() => {
-				window.removeEventListener("message", onMessage);
-				finish({
-					ok: false,
-					timeout: true
-				});
-			}, timeoutMs);
-		});
-	}
-};
-function notAllowedError(message) {
-	const e = new Error(message);
-	e.name = "NotAllowedError";
-	return e;
-}
-function isAncestorOriginError(err) {
-	const msg = safeMessage(err);
-	return /origin of the document is not the same as its ancestors/i.test(msg);
-}
-function isDocumentNotFocusedError(err) {
-	const name = safeName(err);
-	const msg = safeMessage(err);
-	const isNotAllowed = name === "NotAllowedError";
-	const mentionsFocus = /document is not focused|not focused|focus/i.test(msg);
-	return Boolean(isNotAllowed && mentionsFocus);
-}
-function safeMessage(err) {
-	return String(err?.message || "");
-}
-function safeName(err) {
-	const n = err?.name;
-	return typeof n === "string" ? n : "";
-}
-async function attemptRefocus(maxRetries = 2, delays = [50, 120]) {
-	window.focus?.();
-	(document?.body)?.focus?.();
-	const wait = (ms) => new Promise((r) => setTimeout(r, ms));
-	const total = Math.max(0, maxRetries);
-	for (let i = 0; i <= total; i++) {
-		const d = delays[i] ?? delays[delays.length - 1] ?? 80;
-		await wait(d);
-		if (document.hasFocus()) return true;
-		window.focus?.();
-	}
-	return document.hasFocus();
-}
-
-//#endregion
-//#region src/core/WebAuthnManager/touchIdPrompt.ts
-function isRegistrableSuffix(host, cand) {
-	if (!host || !cand) return false;
-	if (host === cand) return true;
-	return host.endsWith("." + cand);
-}
-function resolveRpId(override, host) {
-	const h = (host || "").toLowerCase();
-	const ov = (override || "").toLowerCase();
-	if (ov && h && isRegistrableSuffix(h, ov)) return ov;
-	return h || ov || "";
-}
-function authenticatorsToAllowCredentials(authenticators) {
-	return authenticators.map((auth) => ({
-		id: auth.credentialId,
-		type: "public-key",
-		transports: auth.transports
-	}));
-}
-/**
-* TouchIdPrompt prompts for touchID,
-* creates credentials,
-* manages WebAuthn touchID prompts,
-* and generates credentials, and PRF Outputs
-*/
-var TouchIdPrompt = class TouchIdPrompt {
-	rpIdOverride;
-	safariGetWebauthnRegistrationFallback;
-	abortController;
-	removePageAbortHandlers;
-	removeExternalAbortListener;
-	constructor(rpIdOverride, safariGetWebauthnRegistrationFallback = false) {
-		this.rpIdOverride = rpIdOverride;
-		this.safariGetWebauthnRegistrationFallback = safariGetWebauthnRegistrationFallback === true;
-	}
-	getRpId() {
-		try {
-			return resolveRpId(this.rpIdOverride, window?.location?.hostname);
-		} catch {
-			return this.rpIdOverride || "";
-		}
-	}
-	static _inIframe() {
-		try {
-			return window.self !== window.top;
-		} catch {
-			return true;
-		}
-	}
-	/**
-	* Get authentication credentials
-	* @param nearAccountId - NEAR account ID to authenticate
-	* @param challenge - VRF challenge bytes
-	* @param allowCredentials - Array of allowed credentials for authentication
-	* @returns WebAuthn credential with only the first PRF output
-	*/
-	async getAuthenticationCredentialsSerialized({ nearAccountId, challenge, allowCredentials }) {
-		const credentialMaybe = await this.getAuthenticationCredentialsInternal({
-			nearAccountId,
-			challenge,
-			allowCredentials
-		});
-		if (isSerializedAuthenticationCredential(credentialMaybe)) return credentialMaybe;
-		return serializeAuthenticationCredentialWithPRF({
-			credential: credentialMaybe,
-			firstPrfOutput: true,
-			secondPrfOutput: false
-		});
-	}
-	/**
-	*  Same as getAuthenticationCredentialsSerialized but returns both PRF outputs
-	*  (PRF.first + PRF.second).
-	* @param nearAccountId - NEAR account ID to authenticate
-	* @param challenge - VRF challenge bytes
-	* @param allowCredentials - Array of allowed credentials for authentication
-	* @returns
-	*/
-	async getAuthenticationCredentialsSerializedDualPrf({ nearAccountId, challenge, allowCredentials }) {
-		const credentialMaybe = await this.getAuthenticationCredentialsInternal({
-			nearAccountId,
-			challenge,
-			allowCredentials
-		});
-		if (isSerializedAuthenticationCredential(credentialMaybe)) return credentialMaybe;
-		return serializeAuthenticationCredentialWithPRF({
-			credential: credentialMaybe,
-			firstPrfOutput: true,
-			secondPrfOutput: true
-		});
-	}
-	/**
-	* Internal method for generating WebAuthn registration credentials with PRF output
-	* @param nearAccountId - NEAR account ID for PRF salts and keypair derivation (always base account)
-	* @param challenge - Random challenge bytes for the registration ceremony
-	* @param deviceNumber - Device number for device-specific user ID.
-	* @returns Credential with PRF output
-	*/
-	async generateRegistrationCredentialsInternal({ nearAccountId, challenge, deviceNumber }) {
-		this.abortController = new AbortController();
-		this.removePageAbortHandlers = TouchIdPrompt.attachPageAbortHandlers(this.abortController);
-		const rpId = this.getRpId();
-		const publicKey = {
-			challenge: outputAs32Bytes(challenge),
-			rp: {
-				name: "WebAuthn VRF Passkey",
-				id: rpId
-			},
-			user: {
-				id: new TextEncoder().encode(generateDeviceSpecificUserId(nearAccountId, deviceNumber)),
-				name: generateDeviceSpecificUserId(nearAccountId, deviceNumber),
-				displayName: generateUserFriendlyDisplayName(nearAccountId, deviceNumber)
-			},
-			pubKeyCredParams: [{
-				alg: -7,
-				type: "public-key"
-			}, {
-				alg: -257,
-				type: "public-key"
-			}],
-			authenticatorSelection: {
-				residentKey: "required",
-				userVerification: "preferred"
-			},
-			timeout: 6e4,
-			attestation: "none",
-			extensions: { prf: { eval: {
-				first: generateChaCha20Salt(nearAccountId),
-				second: generateEd25519Salt(nearAccountId)
-			} } }
-		};
-		try {
-			const result = await executeWebAuthnWithParentFallbacksSafari("create", publicKey, {
-				rpId,
-				inIframe: TouchIdPrompt._inIframe(),
-				timeoutMs: publicKey.timeout,
-				abortSignal: this.abortController.signal
-			});
-			return result;
-		} finally {
-			this.removePageAbortHandlers?.();
-			this.removePageAbortHandlers = void 0;
-			this.removeExternalAbortListener?.();
-			this.removeExternalAbortListener = void 0;
-			this.abortController = void 0;
-		}
-	}
-	/**
-	* Internal method for getting WebAuthn authentication credentials with PRF output
-	* @param nearAccountId - NEAR account ID to authenticate
-	* @param challenge - VRF challenge bytes to use for WebAuthn authentication
-	* @param authenticators - List of stored authenticator data for the user
-	* @returns WebAuthn credential with PRF output (HKDF derivation done in WASM worker)
-	* ```ts
-	* const credential = await touchIdPrompt.getCredentials({
-	*   nearAccountId,
-	*   challenge,
-	*   authenticators,
-	* });
-	* ```
-	*/
-	async getAuthenticationCredentialsInternal({ nearAccountId, challenge, allowCredentials }) {
-		this.abortController = new AbortController();
-		this.removePageAbortHandlers = TouchIdPrompt.attachPageAbortHandlers(this.abortController);
-		const rpId = this.getRpId();
-		const publicKey = {
-			challenge: outputAs32Bytes(challenge),
-			rpId,
-			allowCredentials: allowCredentials.map((credential) => ({
-				id: base64UrlDecode(credential.id),
-				type: "public-key",
-				transports: credential.transports
-			})),
-			userVerification: "preferred",
-			timeout: 6e4,
-			extensions: { prf: { eval: {
-				first: generateChaCha20Salt(nearAccountId),
-				second: generateEd25519Salt(nearAccountId)
-			} } }
-		};
-		try {
-			const result = await executeWebAuthnWithParentFallbacksSafari("get", publicKey, {
-				rpId,
-				inIframe: TouchIdPrompt._inIframe(),
-				timeoutMs: publicKey.timeout,
-				permitGetBridgeOnAncestorError: this.safariGetWebauthnRegistrationFallback,
-				abortSignal: this.abortController.signal
-			});
-			return result;
-		} finally {
-			this.removePageAbortHandlers?.();
-			this.removePageAbortHandlers = void 0;
-			this.removeExternalAbortListener?.();
-			this.removeExternalAbortListener = void 0;
-			this.abortController = void 0;
-		}
-	}
-};
-function isSerializedAuthenticationCredential(x) {
-	if (!x || typeof x !== "object") return false;
-	const obj = x;
-	const resp = obj.response;
-	return typeof resp?.authenticatorData === "string";
-}
-/**
-* Generate device-specific user ID to prevent Chrome sync conflicts
-* Creates technical identifiers with full account context
-*
-* @param nearAccountId - The NEAR account ID (e.g., "serp120.w3a-v1.testnet")
-* @param deviceNumber - The device number (optional, undefined for device 1, 2 for device 2, etc.)
-* @returns Technical identifier:
-*   - Device 1: "serp120.web3-authn.testnet"
-*   - Device 2: "serp120.web3-authn.testnet (2)"
-*   - Device 3: "serp120.web3-authn.testnet (3)"
-*/
-function generateDeviceSpecificUserId(nearAccountId, deviceNumber) {
-	if (deviceNumber === void 0 || deviceNumber === 1) return nearAccountId;
-	return `${nearAccountId} (${deviceNumber})`;
-}
-/**
-* Generate user-friendly display name for passkey manager UI
-* Creates clean, intuitive names that users will see
-*
-* @param nearAccountId - The NEAR account ID (e.g., "serp120.w3a-v1.testnet")
-* @param deviceNumber - The device number (optional, undefined for device 1, 2 for device 2, etc.)
-* @returns User-friendly display name:
-*   - Device 1: "serp120"
-*   - Device 2: "serp120 (device 2)"
-*   - Device 3: "serp120 (device 3)"
-*/
-function generateUserFriendlyDisplayName(nearAccountId, deviceNumber) {
-	const baseUsername = nearAccountId.split(".")[0];
-	if (deviceNumber === void 0 || deviceNumber === 1) return baseUsername;
-	return `${baseUsername} (device ${deviceNumber})`;
-}
-(function(_TouchIdPrompt) {
-	function attachPageAbortHandlers(controller) {
-		const onVisibility = () => {
-			if (document.hidden) controller.abort();
-		};
-		const onPageHide = () => {
-			controller.abort();
-		};
-		const onBeforeUnload = () => {
-			controller.abort();
-		};
-		document.addEventListener("visibilitychange", onVisibility, { passive: true });
-		window.addEventListener("pagehide", onPageHide, { passive: true });
-		window.addEventListener("beforeunload", onBeforeUnload, { passive: true });
-		return () => {
-			document.removeEventListener("visibilitychange", onVisibility);
-			window.removeEventListener("pagehide", onPageHide);
-			window.removeEventListener("beforeunload", onBeforeUnload);
-		};
-	}
-	_TouchIdPrompt.attachPageAbortHandlers = attachPageAbortHandlers;
-})(TouchIdPrompt || (TouchIdPrompt = {}));
-
-//#endregion
-//#region src/core/types/actions.ts
-/**
-* Enum for all supported NEAR action types
-*/
-let ActionType = /* @__PURE__ */ function(ActionType$1) {
-	ActionType$1["CreateAccount"] = "CreateAccount";
-	ActionType$1["DeployContract"] = "DeployContract";
-	ActionType$1["FunctionCall"] = "FunctionCall";
-	ActionType$1["Transfer"] = "Transfer";
-	ActionType$1["Stake"] = "Stake";
-	ActionType$1["AddKey"] = "AddKey";
-	ActionType$1["DeleteKey"] = "DeleteKey";
-	ActionType$1["DeleteAccount"] = "DeleteAccount";
-	ActionType$1["SignedDelegate"] = "SignedDelegate";
-	ActionType$1["DeployGlobalContract"] = "DeployGlobalContract";
-	ActionType$1["UseGlobalContract"] = "UseGlobalContract";
-	return ActionType$1;
-}({});
-function isActionArgsWasm(a) {
-	return isObject(a) && "action_type" in a;
-}
-function toActionArgsWasm(action) {
-	switch (action.type) {
-		case ActionType.Transfer: return {
-			action_type: ActionType.Transfer,
-			deposit: action.amount
-		};
-		case ActionType.FunctionCall: return {
-			action_type: ActionType.FunctionCall,
-			method_name: action.methodName,
-			args: JSON.stringify(action.args),
-			gas: action.gas || "30000000000000",
-			deposit: action.deposit || "0"
-		};
-		case ActionType.AddKey:
-			const rawPermission = action.accessKey.permission;
-			const permission = rawPermission === "FullAccess" ? { FullAccess: {} } : rawPermission;
-			const accessKey = {
-				nonce: action.accessKey.nonce || 0,
-				permission
-			};
-			return {
-				action_type: ActionType.AddKey,
-				public_key: action.publicKey,
-				access_key: JSON.stringify(accessKey)
-			};
-		case ActionType.DeleteKey: return {
-			action_type: ActionType.DeleteKey,
-			public_key: action.publicKey
-		};
-		case ActionType.CreateAccount: return { action_type: ActionType.CreateAccount };
-		case ActionType.DeleteAccount: return {
-			action_type: ActionType.DeleteAccount,
-			beneficiary_id: action.beneficiaryId
-		};
-		case ActionType.DeployContract: return {
-			action_type: ActionType.DeployContract,
-			code: typeof action.code === "string" ? Array.from(new TextEncoder().encode(action.code)) : Array.from(action.code)
-		};
-		case ActionType.DeployGlobalContract: return {
-			action_type: ActionType.DeployGlobalContract,
-			code: typeof action.code === "string" ? Array.from(new TextEncoder().encode(action.code)) : Array.from(action.code),
-			deploy_mode: action.deployMode
-		};
-		case ActionType.UseGlobalContract: return {
-			action_type: ActionType.UseGlobalContract,
-			account_id: action.accountId,
-			code_hash: action.codeHash
-		};
-		case ActionType.Stake: return {
-			action_type: ActionType.Stake,
-			stake: action.stake,
-			public_key: action.publicKey
-		};
-		default: throw new Error(`Action type ${action.type} is not supported`);
-	}
-}
-/**
-* Validate action parameters before sending to worker
-*/
-function validateActionArgsWasm(actionArgsWasm) {
-	switch (actionArgsWasm.action_type) {
-		case ActionType.FunctionCall:
-			if (!actionArgsWasm.method_name) throw new Error("method_name required for FunctionCall");
-			if (!actionArgsWasm.args) throw new Error("args required for FunctionCall");
-			if (!actionArgsWasm.gas) throw new Error("gas required for FunctionCall");
-			if (!actionArgsWasm.deposit) throw new Error("deposit required for FunctionCall");
-			if (typeof actionArgsWasm.args !== "string") throw new Error("FunctionCall action args must be a valid JSON string");
-			try {
-				JSON.parse(actionArgsWasm.args);
-			} catch {
-				throw new Error("FunctionCall action args must be valid JSON string");
-			}
-			break;
-		case ActionType.Transfer:
-			if (!actionArgsWasm.deposit) throw new Error("deposit required for Transfer");
-			break;
-		case ActionType.CreateAccount: break;
-		case ActionType.DeployContract:
-			if (!actionArgsWasm.code || actionArgsWasm.code.length === 0) throw new Error("code required for DeployContract");
-			break;
-		case ActionType.Stake:
-			if (!actionArgsWasm.stake) throw new Error("stake amount required for Stake");
-			if (!actionArgsWasm.public_key) throw new Error("public_key required for Stake");
-			break;
-		case ActionType.AddKey:
-			if (!actionArgsWasm.public_key) throw new Error("public_key required for AddKey");
-			if (!actionArgsWasm.access_key) throw new Error("access_key required for AddKey");
-			if (typeof actionArgsWasm.access_key !== "string") throw new Error("AddKey action access_key must be a valid JSON string");
-			try {
-				JSON.parse(actionArgsWasm.access_key);
-			} catch {
-				throw new Error("AddKey action access_key must be valid JSON string");
-			}
-			break;
-		case ActionType.DeleteKey:
-			if (!actionArgsWasm.public_key) throw new Error("public_key required for DeleteKey");
-			break;
-		case ActionType.DeleteAccount:
-			if (!actionArgsWasm.beneficiary_id) throw new Error("beneficiary_id required for DeleteAccount");
-			break;
-		case ActionType.SignedDelegate: {
-			const payload = actionArgsWasm;
-			if (!payload.delegate_action || typeof payload.delegate_action !== "object") throw new Error("delegate_action required for SignedDelegate");
-			if (!payload.signature || typeof payload.signature !== "object") throw new Error("signature required for SignedDelegate");
-			break;
-		}
-		case ActionType.DeployGlobalContract:
-			if (!actionArgsWasm.code || actionArgsWasm.code.length === 0) throw new Error("code required for DeployGlobalContract");
-			if (!actionArgsWasm.deploy_mode || actionArgsWasm.deploy_mode !== "CodeHash" && actionArgsWasm.deploy_mode !== "AccountId") throw new Error("deploy_mode must be CodeHash or AccountId for DeployGlobalContract");
-			break;
-		case ActionType.UseGlobalContract: {
-			const hasAccountId = !!actionArgsWasm.account_id;
-			const hasCodeHash = !!actionArgsWasm.code_hash;
-			if (hasAccountId === hasCodeHash) throw new Error("UseGlobalContract requires exactly one of account_id or code_hash");
-			break;
-		}
-		default: throw new Error(`Unsupported action type: ${actionArgsWasm.action_type}`);
-	}
-}
-/**
-* Convert a single ActionArgsWasm (snake_case, stringified fields) to ActionArgs (camelCase, typed fields)
-*/
-function fromActionArgsWasm(a) {
-	switch (a.action_type) {
-		case ActionType.FunctionCall: {
-			let parsedArgs = {};
-			try {
-				if (typeof a.args === "string") parsedArgs = a.args ? JSON.parse(a.args) : {};
-				else parsedArgs = a.args || {};
-			} catch {
-				parsedArgs = {};
-			}
-			return {
-				type: ActionType.FunctionCall,
-				methodName: a.method_name,
-				args: parsedArgs,
-				gas: a.gas,
-				deposit: a.deposit
-			};
-		}
-		case ActionType.Transfer: return {
-			type: ActionType.Transfer,
-			amount: a.deposit
-		};
-		case ActionType.CreateAccount: return { type: ActionType.CreateAccount };
-		case ActionType.DeployContract: {
-			const codeBytes = Array.isArray(a.code) ? new Uint8Array(a.code) : new Uint8Array();
-			return {
-				type: ActionType.DeployContract,
-				code: codeBytes
-			};
-		}
-		case ActionType.DeployGlobalContract: {
-			const codeBytes = Array.isArray(a.code) ? new Uint8Array(a.code) : new Uint8Array();
-			return {
-				type: ActionType.DeployGlobalContract,
-				code: codeBytes,
-				deployMode: a.deploy_mode
-			};
-		}
-		case ActionType.Stake: return {
-			type: ActionType.Stake,
-			stake: a.stake,
-			publicKey: a.public_key
-		};
-		case ActionType.AddKey: {
-			let accessKey;
-			try {
-				accessKey = JSON.parse(a.access_key);
-			} catch {
-				accessKey = {
-					nonce: BigInt(0),
-					permission: "FullAccess"
-				};
-			}
-			const permission = accessKey?.permission;
-			let normalizedPermission = "FullAccess";
-			if (isObject(permission)) {
-				if ("FullAccess" in permission) normalizedPermission = "FullAccess";
-				else if ("FunctionCall" in permission) {
-					const fc = permission.FunctionCall;
-					normalizedPermission = { FunctionCall: {
-						allowance: fc.allowance,
-						receiver_id: fc.receiver_id,
-						method_names: fc.method_names
-					} };
-				}
-			}
-			return {
-				type: ActionType.AddKey,
-				publicKey: a.public_key,
-				accessKey: {
-					nonce: typeof accessKey?.nonce === "number" ? accessKey.nonce : 0,
-					permission: normalizedPermission
-				}
-			};
-		}
-		case ActionType.DeleteKey: return {
-			type: ActionType.DeleteKey,
-			publicKey: a.public_key
-		};
-		case ActionType.DeleteAccount: return {
-			type: ActionType.DeleteAccount,
-			beneficiaryId: a.beneficiary_id
-		};
-		case ActionType.UseGlobalContract: return {
-			type: ActionType.UseGlobalContract,
-			accountId: a.account_id,
-			codeHash: a.code_hash
-		};
-		default: throw new Error(`Unsupported wasm action_type: ${a?.action_type}`);
-	}
-}
-/** Convert a TransactionInputWasm structure to TransactionInput */
-function fromTransactionInputWasm(tx) {
-	return {
-		receiverId: tx.receiverId,
-		actions: tx.actions.map(fromActionArgsWasm)
-	};
-}
-/** Convert an array of TransactionInputWasm to TransactionInput[] */
-function fromTransactionInputsWasm(txs) {
-	return (txs || []).map(fromTransactionInputWasm);
-}
-
-//#endregion
-//#region src/core/WebAuthnManager/txDigest.ts
-function alphabetizeStringify(input) {
-	const normalizeValue = (value) => {
-		if (Array.isArray(value)) return value.map(normalizeValue);
-		if (isObject(value)) {
-			const obj = value;
-			const sortedKeys = Object.keys(obj).sort();
-			const result = {};
-			for (const key of sortedKeys) result[key] = normalizeValue(obj[key]);
-			return result;
-		}
-		return value;
-	};
-	return JSON.stringify(normalizeValue(input));
-}
-async function sha256Base64UrlUtf8(input) {
-	const enc = new TextEncoder();
-	const data = enc.encode(input);
-	const digest = await crypto.subtle.digest("SHA-256", data);
-	return base64UrlEncode(digest);
-}
-async function computeUiIntentDigestFromTxs(txInputs) {
-	const json = alphabetizeStringify(txInputs);
-	return sha256Base64UrlUtf8(json);
-}
-function orderActionForDigest(a) {
-	switch (a.action_type) {
-		case "FunctionCall": return {
-			action_type: a.action_type,
-			args: a.args,
-			deposit: a.deposit,
-			gas: a.gas,
-			method_name: a.method_name
-		};
-		case "Transfer": return {
-			action_type: a.action_type,
-			deposit: a.deposit
-		};
-		case "Stake": return {
-			action_type: a.action_type,
-			stake: a.stake,
-			public_key: a.public_key
-		};
-		case "AddKey": return {
-			action_type: a.action_type,
-			public_key: a.public_key,
-			access_key: a.access_key
-		};
-		case "DeleteKey": return {
-			action_type: a.action_type,
-			public_key: a.public_key
-		};
-		case "DeleteAccount": return {
-			action_type: a.action_type,
-			beneficiary_id: a.beneficiary_id
-		};
-		case "DeployContract": return {
-			action_type: a.action_type,
-			code: a.code
-		};
-		case "DeployGlobalContract": return {
-			action_type: a.action_type,
-			code: a.code,
-			deploy_mode: a.deploy_mode
-		};
-		case "UseGlobalContract": return {
-			action_type: a.action_type,
-			account_id: a.account_id,
-			code_hash: a.code_hash
-		};
-		case "CreateAccount":
-		default: return { action_type: a.action_type };
-	}
-}
-
-//#endregion
-//#region src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/types.ts
-let SecureConfirmMessageType = /* @__PURE__ */ function(SecureConfirmMessageType$1) {
-	SecureConfirmMessageType$1["PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD"] = "PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD";
-	SecureConfirmMessageType$1["USER_PASSKEY_CONFIRM_RESPONSE"] = "USER_PASSKEY_CONFIRM_RESPONSE";
-	return SecureConfirmMessageType$1;
-}({});
-let SecureConfirmationType = /* @__PURE__ */ function(SecureConfirmationType$1) {
-	SecureConfirmationType$1["SIGN_TRANSACTION"] = "signTransaction";
-	SecureConfirmationType$1["REGISTER_ACCOUNT"] = "registerAccount";
-	SecureConfirmationType$1["LINK_DEVICE"] = "linkDevice";
-	SecureConfirmationType$1["DECRYPT_PRIVATE_KEY_WITH_PRF"] = "decryptPrivateKeyWithPrf";
-	SecureConfirmationType$1["SIGN_NEP413_MESSAGE"] = "signNep413Message";
-	SecureConfirmationType$1["SHOW_SECURE_PRIVATE_KEY_UI"] = "showSecurePrivateKeyUi";
-	return SecureConfirmationType$1;
-}({});
-
-//#endregion
-//#region src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/adapters/common.ts
-function parseTransactionSummary(summaryData) {
-	if (!summaryData) return {};
-	if (isString(summaryData)) try {
-		const parsed = JSON.parse(summaryData);
-		return isObject(parsed) ? parsed : {};
-	} catch (parseError) {
-		console.warn("[SignerWorkerManager]: Failed to parse summary string:", parseError);
-		return {};
-	}
-	return isObject(summaryData) ? summaryData : {};
-}
-function sanitizeForPostMessage(data) {
-	if (data == null) return data;
-	if (Array.isArray(data)) return data.map((v) => v);
-	if (isObject(data)) {
-		const src = data;
-		const out = {};
-		for (const key of Object.keys(src)) {
-			if (key === "_confirmHandle") continue;
-			const value = src[key];
-			if (isFunction(value)) continue;
-			out[key] = value;
-		}
-		return out;
-	}
-	return data;
-}
-const ERROR_MESSAGES = {
-	cancelled: "User cancelled secure confirm request",
-	collectCredentialsFailed: "Failed to collect credentials",
-	nearRpcFailed: "Failed to fetch NEAR data"
-};
-function sendConfirmResponse(worker, response) {
-	const sanitized = sanitizeForPostMessage(response);
-	worker.postMessage({
-		type: SecureConfirmMessageType.USER_PASSKEY_CONFIRM_RESPONSE,
-		data: sanitized
-	});
-}
-function isUserCancelledSecureConfirm(error) {
-	return isTouchIdCancellationError(error) || (() => {
-		const e = toError(error);
-		return e?.name === "NotAllowedError" || e?.name === "AbortError";
-	})();
-}
-
-//#endregion
-//#region src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/adapters/requestHelpers.ts
-function getNearAccountId(request) {
-	switch (request.type) {
-		case SecureConfirmationType.SIGN_TRANSACTION: return getSignTransactionPayload(request).rpcCall.nearAccountId;
-		case SecureConfirmationType.SIGN_NEP413_MESSAGE: return request.payload.nearAccountId;
-		case SecureConfirmationType.REGISTER_ACCOUNT:
-		case SecureConfirmationType.LINK_DEVICE: return getRegisterAccountPayload(request).nearAccountId;
-		case SecureConfirmationType.DECRYPT_PRIVATE_KEY_WITH_PRF: {
-			const p = request.payload;
-			return p?.nearAccountId || "";
-		}
-		case SecureConfirmationType.SHOW_SECURE_PRIVATE_KEY_UI: {
-			const p = request.payload;
-			return p?.nearAccountId || "";
-		}
-		default: return "";
-	}
-}
-function getTxCount(request) {
-	return request.type === SecureConfirmationType.SIGN_TRANSACTION ? getSignTransactionPayload(request).txSigningRequests?.length || 1 : 1;
-}
-function getIntentDigest(request) {
-	if (request.type === SecureConfirmationType.SIGN_TRANSACTION) {
-		const p = request?.payload;
-		return p?.intentDigest;
-	}
-	return request?.intentDigest;
-}
-function getSignTransactionPayload(request) {
-	if (request.type !== SecureConfirmationType.SIGN_TRANSACTION) throw new Error(`Expected SIGN_TRANSACTION request, got ${request.type}`);
-	return request.payload;
-}
-function getRegisterAccountPayload(request) {
-	if (request.type !== SecureConfirmationType.REGISTER_ACCOUNT && request.type !== SecureConfirmationType.LINK_DEVICE) throw new Error(`Expected REGISTER_ACCOUNT or LINK_DEVICE request, got ${request.type}`);
-	return request.payload;
-}
-
-//#endregion
-export { ActionType, ERROR_MESSAGES, SecureConfirmMessageType, SecureConfirmationType, TouchIdPrompt, authenticatorsToAllowCredentials, base64Decode, base64Encode, base64UrlDecode, computeUiIntentDigestFromTxs, createRandomVRFChallenge, errorMessage, fromTransactionInputsWasm, getIntentDigest, getNearAccountId, getRegisterAccountPayload, getSignTransactionPayload, getTxCount, isActionArgsWasm, isSerializedRegistrationCredential, isUserCancelledSecureConfirm, normalizeRegistrationCredential, orderActionForDigest, parseTransactionSummary, removePrfOutputGuard, sanitizeForPostMessage, sendConfirmResponse, serializeAuthenticationCredentialWithPRF, serializeRegistrationCredentialWithPRF, toAccountId, toActionArgsWasm, toError, validateActionArgsWasm, validateNearAccountId, validateVRFChallenge };
-//# sourceMappingURL=requestHelpers-aUKhXiEl.js.map