@tatchi-xyz/sdk 0.21.0 → 0.31.1

package/dist/cjs/react/src/core/WebAuthnManager/touchIdPrompt.js

@@ -0,0 +1,271 @@
+const require_base64 = require('../../utils/base64.js');
+const require_vrf_worker = require('../types/vrf-worker.js');
+const require_credentialsHelpers = require('./credentialsHelpers.js');
+const require_safari_fallbacks = require('./WebAuthnFallbacks/safari-fallbacks.js');
+
+//#region src/core/WebAuthnManager/touchIdPrompt.ts
+function isRegistrableSuffix(host, cand) {
+	if (!host || !cand) return false;
+	if (host === cand) return true;
+	return host.endsWith("." + cand);
+}
+function resolveRpId(override, host) {
+	const h = (host || "").toLowerCase();
+	const ov = (override || "").toLowerCase();
+	if (ov && h && isRegistrableSuffix(h, ov)) return ov;
+	return h || ov || "";
+}
+function authenticatorsToAllowCredentials(authenticators) {
+	return authenticators.map((auth) => ({
+		id: auth.credentialId,
+		type: "public-key",
+		transports: auth.transports
+	}));
+}
+/**
+* TouchIdPrompt prompts for touchID,
+* creates credentials,
+* manages WebAuthn touchID prompts,
+* and generates credentials, and PRF Outputs
+*/
+var TouchIdPrompt = class TouchIdPrompt {
+	rpIdOverride;
+	safariGetWebauthnRegistrationFallback;
+	abortController;
+	removePageAbortHandlers;
+	removeExternalAbortListener;
+	constructor(rpIdOverride, safariGetWebauthnRegistrationFallback = false) {
+		this.rpIdOverride = rpIdOverride;
+		this.safariGetWebauthnRegistrationFallback = safariGetWebauthnRegistrationFallback === true;
+	}
+	getRpId() {
+		try {
+			return resolveRpId(this.rpIdOverride, window?.location?.hostname);
+		} catch {
+			return this.rpIdOverride || "";
+		}
+	}
+	static _inIframe() {
+		try {
+			return window.self !== window.top;
+		} catch {
+			return true;
+		}
+	}
+	/**
+	* Get authentication credentials
+	* @param nearAccountId - NEAR account ID to authenticate
+	* @param challenge - VRF challenge bytes
+	* @param allowCredentials - Array of allowed credentials for authentication
+	* @returns WebAuthn credential with only the first PRF output
+	*/
+	async getAuthenticationCredentialsSerialized({ nearAccountId, challenge, allowCredentials }) {
+		const credentialMaybe = await this.getAuthenticationCredentialsInternal({
+			nearAccountId,
+			challenge,
+			allowCredentials
+		});
+		if (isSerializedAuthenticationCredential(credentialMaybe)) return credentialMaybe;
+		return require_credentialsHelpers.serializeAuthenticationCredentialWithPRF({
+			credential: credentialMaybe,
+			firstPrfOutput: true,
+			secondPrfOutput: false
+		});
+	}
+	/**
+	*  Same as getAuthenticationCredentialsSerialized but returns both PRF outputs
+	*  (PRF.first + PRF.second).
+	* @param nearAccountId - NEAR account ID to authenticate
+	* @param challenge - VRF challenge bytes
+	* @param allowCredentials - Array of allowed credentials for authentication
+	* @returns
+	*/
+	async getAuthenticationCredentialsSerializedDualPrf({ nearAccountId, challenge, allowCredentials }) {
+		const credentialMaybe = await this.getAuthenticationCredentialsInternal({
+			nearAccountId,
+			challenge,
+			allowCredentials
+		});
+		if (isSerializedAuthenticationCredential(credentialMaybe)) return credentialMaybe;
+		return require_credentialsHelpers.serializeAuthenticationCredentialWithPRF({
+			credential: credentialMaybe,
+			firstPrfOutput: true,
+			secondPrfOutput: true
+		});
+	}
+	/**
+	* Internal method for generating WebAuthn registration credentials with PRF output
+	* @param nearAccountId - NEAR account ID for PRF salts and keypair derivation (always base account)
+	* @param challenge - Random challenge bytes for the registration ceremony
+	* @param deviceNumber - Device number for device-specific user ID.
+	* @returns Credential with PRF output
+	*/
+	async generateRegistrationCredentialsInternal({ nearAccountId, challenge, deviceNumber }) {
+		this.abortController = new AbortController();
+		this.removePageAbortHandlers = TouchIdPrompt.attachPageAbortHandlers(this.abortController);
+		const rpId = this.getRpId();
+		const publicKey = {
+			challenge: require_vrf_worker.outputAs32Bytes(challenge),
+			rp: {
+				name: "WebAuthn VRF Passkey",
+				id: rpId
+			},
+			user: {
+				id: new TextEncoder().encode(generateDeviceSpecificUserId(nearAccountId, deviceNumber)),
+				name: generateDeviceSpecificUserId(nearAccountId, deviceNumber),
+				displayName: generateUserFriendlyDisplayName(nearAccountId, deviceNumber)
+			},
+			pubKeyCredParams: [{
+				alg: -7,
+				type: "public-key"
+			}, {
+				alg: -257,
+				type: "public-key"
+			}],
+			authenticatorSelection: {
+				residentKey: "required",
+				userVerification: "preferred"
+			},
+			timeout: 6e4,
+			attestation: "none",
+			extensions: { prf: { eval: {
+				first: require_credentialsHelpers.generateChaCha20Salt(nearAccountId),
+				second: require_credentialsHelpers.generateEd25519Salt(nearAccountId)
+			} } }
+		};
+		try {
+			const result = await require_safari_fallbacks.executeWebAuthnWithParentFallbacksSafari("create", publicKey, {
+				rpId,
+				inIframe: TouchIdPrompt._inIframe(),
+				timeoutMs: publicKey.timeout,
+				abortSignal: this.abortController.signal
+			});
+			return result;
+		} finally {
+			this.removePageAbortHandlers?.();
+			this.removePageAbortHandlers = void 0;
+			this.removeExternalAbortListener?.();
+			this.removeExternalAbortListener = void 0;
+			this.abortController = void 0;
+		}
+	}
+	/**
+	* Internal method for getting WebAuthn authentication credentials with PRF output
+	* @param nearAccountId - NEAR account ID to authenticate
+	* @param challenge - VRF challenge bytes to use for WebAuthn authentication
+	* @param authenticators - List of stored authenticator data for the user
+	* @returns WebAuthn credential with PRF output (HKDF derivation done in WASM worker)
+	* ```ts
+	* const credential = await touchIdPrompt.getCredentials({
+	*   nearAccountId,
+	*   challenge,
+	*   authenticators,
+	* });
+	* ```
+	*/
+	async getAuthenticationCredentialsInternal({ nearAccountId, challenge, allowCredentials }) {
+		this.abortController = new AbortController();
+		this.removePageAbortHandlers = TouchIdPrompt.attachPageAbortHandlers(this.abortController);
+		const rpId = this.getRpId();
+		const publicKey = {
+			challenge: require_vrf_worker.outputAs32Bytes(challenge),
+			rpId,
+			allowCredentials: allowCredentials.map((credential) => ({
+				id: require_base64.base64UrlDecode(credential.id),
+				type: "public-key",
+				transports: credential.transports
+			})),
+			userVerification: "preferred",
+			timeout: 6e4,
+			extensions: { prf: { eval: {
+				first: require_credentialsHelpers.generateChaCha20Salt(nearAccountId),
+				second: require_credentialsHelpers.generateEd25519Salt(nearAccountId)
+			} } }
+		};
+		try {
+			const result = await require_safari_fallbacks.executeWebAuthnWithParentFallbacksSafari("get", publicKey, {
+				rpId,
+				inIframe: TouchIdPrompt._inIframe(),
+				timeoutMs: publicKey.timeout,
+				permitGetBridgeOnAncestorError: this.safariGetWebauthnRegistrationFallback,
+				abortSignal: this.abortController.signal
+			});
+			return result;
+		} finally {
+			this.removePageAbortHandlers?.();
+			this.removePageAbortHandlers = void 0;
+			this.removeExternalAbortListener?.();
+			this.removeExternalAbortListener = void 0;
+			this.abortController = void 0;
+		}
+	}
+};
+function isSerializedAuthenticationCredential(x) {
+	if (!x || typeof x !== "object") return false;
+	const obj = x;
+	const resp = obj.response;
+	return typeof resp?.authenticatorData === "string";
+}
+/**
+* Generate device-specific user ID to prevent Chrome sync conflicts
+* Creates technical identifiers with full account context
+*
+* @param nearAccountId - The NEAR account ID (e.g., "serp120.w3a-v1.testnet")
+* @param deviceNumber - The device number (optional, undefined for device 1, 2 for device 2, etc.)
+* @returns Technical identifier:
+*   - Device 1: "serp120.web3-authn.testnet"
+*   - Device 2: "serp120.web3-authn.testnet (2)"
+*   - Device 3: "serp120.web3-authn.testnet (3)"
+*/
+function generateDeviceSpecificUserId(nearAccountId, deviceNumber) {
+	if (deviceNumber === void 0 || deviceNumber === 1) return nearAccountId;
+	return `${nearAccountId} (${deviceNumber})`;
+}
+/**
+* Generate user-friendly display name for passkey manager UI
+* Creates clean, intuitive names that users will see
+*
+* @param nearAccountId - The NEAR account ID (e.g., "serp120.w3a-v1.testnet")
+* @param deviceNumber - The device number (optional, undefined for device 1, 2 for device 2, etc.)
+* @returns User-friendly display name:
+*   - Device 1: "serp120"
+*   - Device 2: "serp120 (device 2)"
+*   - Device 3: "serp120 (device 3)"
+*/
+function generateUserFriendlyDisplayName(nearAccountId, deviceNumber) {
+	const baseUsername = nearAccountId.split(".")[0];
+	if (deviceNumber === void 0 || deviceNumber === 1) return baseUsername;
+	return `${baseUsername} (device ${deviceNumber})`;
+}
+(function(_TouchIdPrompt) {
+	function attachPageAbortHandlers(controller) {
+		const onVisibility = () => {
+			if (document.hidden) controller.abort();
+		};
+		const onPageHide = () => {
+			controller.abort();
+		};
+		const onBeforeUnload = () => {
+			controller.abort();
+		};
+		document.addEventListener("visibilitychange", onVisibility, { passive: true });
+		window.addEventListener("pagehide", onPageHide, { passive: true });
+		window.addEventListener("beforeunload", onBeforeUnload, { passive: true });
+		return () => {
+			document.removeEventListener("visibilitychange", onVisibility);
+			window.removeEventListener("pagehide", onPageHide);
+			window.removeEventListener("beforeunload", onBeforeUnload);
+		};
+	}
+	_TouchIdPrompt.attachPageAbortHandlers = attachPageAbortHandlers;
+})(TouchIdPrompt || (TouchIdPrompt = {}));
+
+//#endregion
+Object.defineProperty(exports, 'TouchIdPrompt', {
+  enumerable: true,
+  get: function () {
+    return TouchIdPrompt;
+  }
+});
+exports.authenticatorsToAllowCredentials = authenticatorsToAllowCredentials;
+//# sourceMappingURL=touchIdPrompt.js.map

package/dist/cjs/react/src/core/WebAuthnManager/touchIdPrompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"touchIdPrompt.js","names":["serializeAuthenticationCredentialWithPRF","publicKey: PublicKeyCredentialCreationOptions","outputAs32Bytes","generateChaCha20Salt","generateEd25519Salt","executeWebAuthnWithParentFallbacksSafari","publicKey: PublicKeyCredentialRequestOptions","base64UrlDecode"],"sources":["../../../../../../src/core/WebAuthnManager/touchIdPrompt.ts"],"sourcesContent":["import { ClientAuthenticatorData } from '../IndexedDBManager';\nimport { base64UrlDecode } from '../../utils/encoders';\nimport { outputAs32Bytes, VRFChallenge } from '../types/vrf-worker';\nimport { serializeAuthenticationCredentialWithPRF, generateChaCha20Salt, generateEd25519Salt } from './credentialsHelpers';\nimport type {\n  WebAuthnAuthenticationCredential,\n  WebAuthnRegistrationCredential\n} from '../types/webauthn';\nimport { executeWebAuthnWithParentFallbacksSafari } from './WebAuthnFallbacks';\n// Local rpId policy helpers (moved back from WebAuthnFallbacks)\nfunction isRegistrableSuffix(host: string, cand: string): boolean {\n  if (!host || !cand) return false;\n  if (host === cand) return true;\n  return host.endsWith('.' + cand);\n}\n\nfunction resolveRpId(override: string | undefined, host: string | undefined): string {\n  const h = (host || '').toLowerCase();\n  const ov = (override || '').toLowerCase();\n  if (ov && h && isRegistrableSuffix(h, ov)) return ov;\n  return h || ov || '';\n}\n\nexport interface RegisterCredentialsArgs {\n  nearAccountId: string,    // NEAR account ID for PRF salts and keypair derivation (always base account)\n  challenge: VRFChallenge,\n  deviceNumber?: number, // Optional device number for device-specific user ID (0, 1, 2, etc.)\n}\n\nexport interface AuthenticateCredentialsArgs {\n  nearAccountId: string,\n  challenge: VRFChallenge,\n  allowCredentials: AllowCredential[],\n}\n\nexport interface AllowCredential {\n  id: string,\n  type: string,\n  transports: AuthenticatorTransport[]\n}\n\nexport function authenticatorsToAllowCredentials(\n  authenticators: ClientAuthenticatorData[]\n): AllowCredential[] {\n  return authenticators.map(auth => ({\n    id: auth.credentialId,\n    type: 'public-key',\n    transports: auth.transports as AuthenticatorTransport[]\n  }));\n}\n\n/**\n * TouchIdPrompt prompts for touchID,\n * creates credentials,\n * manages WebAuthn touchID prompts,\n * and generates credentials, and PRF Outputs\n */\nexport class TouchIdPrompt {\n  private rpIdOverride?: string;\n  private safariGetWebauthnRegistrationFallback: boolean;\n  // create() only: internal abort controller + cleanup hooks\n  private abortController?: AbortController;\n  private removePageAbortHandlers?: () => void;\n  private removeExternalAbortListener?: () => void;\n\n  constructor(rpIdOverride?: string, safariGetWebauthnRegistrationFallback = false) {\n    this.rpIdOverride = rpIdOverride;\n    this.safariGetWebauthnRegistrationFallback = safariGetWebauthnRegistrationFallback === true;\n  }\n\n  getRpId(): string {\n    try {\n      return resolveRpId(this.rpIdOverride, window?.location?.hostname);\n    } catch {\n      return this.rpIdOverride || '';\n    }\n  }\n\n  // Utility helpers for cross‑origin fallback\n  private static _inIframe(): boolean {\n    try { return window.self !== window.top; } catch { return true; }\n  }\n\n  /**\n   * Get authentication credentials\n   * @param nearAccountId - NEAR account ID to authenticate\n   * @param challenge - VRF challenge bytes\n   * @param allowCredentials - Array of allowed credentials for authentication\n   * @returns WebAuthn credential with only the first PRF output\n   */\n  async getAuthenticationCredentialsSerialized({\n    nearAccountId,\n    challenge,\n    allowCredentials,\n  }: {\n    nearAccountId: string\n    challenge: VRFChallenge\n    allowCredentials: AllowCredential[]\n  }): Promise<WebAuthnAuthenticationCredential> {\n    const credentialMaybe = (await this.getAuthenticationCredentialsInternal({\n      nearAccountId,\n      challenge,\n      allowCredentials,\n    })) as unknown;\n    // Support parent-bridge fallback returning an already-serialized credential\n    if (isSerializedAuthenticationCredential(credentialMaybe)) {\n      return credentialMaybe;\n    }\n    return serializeAuthenticationCredentialWithPRF({\n      credential: credentialMaybe as PublicKeyCredential,\n      firstPrfOutput: true,\n      secondPrfOutput: false,\n    })\n  }\n\n  /**\n   *  Same as getAuthenticationCredentialsSerialized but returns both PRF outputs\n   *  (PRF.first + PRF.second).\n   * @param nearAccountId - NEAR account ID to authenticate\n   * @param challenge - VRF challenge bytes\n   * @param allowCredentials - Array of allowed credentials for authentication\n   * @returns\n   */\n  async getAuthenticationCredentialsSerializedDualPrf({\n    nearAccountId,\n    challenge,\n    allowCredentials,\n  }: {\n    nearAccountId: string,\n    challenge: VRFChallenge,\n    allowCredentials: AllowCredential[],\n  }): Promise<WebAuthnAuthenticationCredential> {\n    const credentialMaybe = (await this.getAuthenticationCredentialsInternal({\n      nearAccountId,\n      challenge,\n      allowCredentials,\n    })) as unknown;\n    // Support parent-bridge fallback returning an already-serialized credential\n    if (isSerializedAuthenticationCredential(credentialMaybe)) {\n      return credentialMaybe;\n    }\n    return serializeAuthenticationCredentialWithPRF({\n      credential: credentialMaybe as PublicKeyCredential,\n      firstPrfOutput: true,\n      secondPrfOutput: true,\n    });\n  }\n\n  /**\n   * Internal method for generating WebAuthn registration credentials with PRF output\n   * @param nearAccountId - NEAR account ID for PRF salts and keypair derivation (always base account)\n   * @param challenge - Random challenge bytes for the registration ceremony\n   * @param deviceNumber - Device number for device-specific user ID.\n   * @returns Credential with PRF output\n   */\n  async generateRegistrationCredentialsInternal({\n    nearAccountId,\n    challenge,\n    deviceNumber,\n  }: RegisterCredentialsArgs): Promise<PublicKeyCredential> {\n    // New controller per create() call\n    this.abortController = new AbortController();\n    this.removePageAbortHandlers = TouchIdPrompt.attachPageAbortHandlers(this.abortController);\n    // Single source of truth for rpId: use getRpId().\n    const rpId = this.getRpId();\n    const publicKey: PublicKeyCredentialCreationOptions = {\n      challenge: outputAs32Bytes(challenge) as BufferSource,\n      rp: {\n        name: 'WebAuthn VRF Passkey',\n        id: rpId\n      },\n      user: {\n        id: new TextEncoder().encode(generateDeviceSpecificUserId(nearAccountId, deviceNumber)),\n        name: generateDeviceSpecificUserId(nearAccountId, deviceNumber),\n        displayName: generateUserFriendlyDisplayName(nearAccountId, deviceNumber)\n      },\n      pubKeyCredParams: [\n        { alg: -7, type: 'public-key' },\n        { alg: -257, type: 'public-key' }\n      ],\n      authenticatorSelection: {\n        residentKey: 'required',\n        userVerification: 'preferred'\n      },\n      timeout: 60000,\n      attestation: 'none',\n      extensions: {\n        prf: {\n          eval: {\n            // Always use NEAR account ID for PRF salts to ensure consistent keypair derivation across devices\n            first: generateChaCha20Salt(nearAccountId) as BufferSource,  // ChaCha20Poly1305 encryption keys\n            second: generateEd25519Salt(nearAccountId) as BufferSource   // Ed25519 signing keys\n          }\n        }\n      },\n    };\n    try {\n      const result = await executeWebAuthnWithParentFallbacksSafari('create', publicKey, {\n        rpId,\n        inIframe: TouchIdPrompt._inIframe(),\n        timeoutMs: publicKey.timeout as number | undefined,\n        // Pass AbortSignal through when supported; Safari bridge path may ignore it.\n        abortSignal: this.abortController.signal,\n      });\n      return result as PublicKeyCredential;\n    } finally {\n      this.removePageAbortHandlers?.();\n      this.removePageAbortHandlers = undefined;\n      this.removeExternalAbortListener?.();\n      this.removeExternalAbortListener = undefined;\n      this.abortController = undefined;\n    }\n  }\n\n  /**\n   * Internal method for getting WebAuthn authentication credentials with PRF output\n   * @param nearAccountId - NEAR account ID to authenticate\n   * @param challenge - VRF challenge bytes to use for WebAuthn authentication\n   * @param authenticators - List of stored authenticator data for the user\n   * @returns WebAuthn credential with PRF output (HKDF derivation done in WASM worker)\n   * ```ts\n   * const credential = await touchIdPrompt.getCredentials({\n   *   nearAccountId,\n   *   challenge,\n   *   authenticators,\n   * });\n   * ```\n   */\n  async getAuthenticationCredentialsInternal({\n    nearAccountId,\n    challenge,\n    allowCredentials,\n  }: AuthenticateCredentialsArgs): Promise<PublicKeyCredential> {\n    // New controller per get() call\n    this.abortController = new AbortController();\n    this.removePageAbortHandlers = TouchIdPrompt.attachPageAbortHandlers(this.abortController);\n    // Single source of truth for rpId: use getRpId().\n    const rpId = this.getRpId();\n    const publicKey: PublicKeyCredentialRequestOptions = {\n      challenge: outputAs32Bytes(challenge) as BufferSource,\n      rpId,\n      allowCredentials: allowCredentials.map((credential) => ({\n        id: base64UrlDecode(credential.id) as BufferSource,\n        type: 'public-key' as PublicKeyCredentialType,\n        transports: credential.transports,\n      })),\n      userVerification: 'preferred' as UserVerificationRequirement,\n      timeout: 60000,\n      extensions: {\n        prf: {\n          eval: {\n            // Always use NEAR account ID for PRF salts to ensure consistent keypair derivation across devices\n            first: generateChaCha20Salt(nearAccountId) as BufferSource,  // ChaCha20Poly1305 encryption keys\n            second: generateEd25519Salt(nearAccountId) as BufferSource   // Ed25519 signing keys\n          }\n        }\n      }\n    };\n    try {\n      const result = await executeWebAuthnWithParentFallbacksSafari('get', publicKey, {\n        rpId,\n        inIframe: TouchIdPrompt._inIframe(),\n        timeoutMs: publicKey.timeout as number | undefined,\n        permitGetBridgeOnAncestorError: this.safariGetWebauthnRegistrationFallback,\n        abortSignal: this.abortController.signal,\n      });\n      return result as PublicKeyCredential;\n    } finally {\n      this.removePageAbortHandlers?.();\n      this.removePageAbortHandlers = undefined;\n      this.removeExternalAbortListener?.();\n      this.removeExternalAbortListener = undefined;\n      this.abortController = undefined;\n    }\n  }\n}\n\n// Type guard for already-serialized authentication credential\nfunction isSerializedAuthenticationCredential(x: unknown): x is WebAuthnAuthenticationCredential {\n  if (!x || typeof x !== 'object') return false;\n  const obj = x as { response?: unknown };\n  const resp = obj.response as { authenticatorData?: unknown } | undefined;\n  return typeof resp?.authenticatorData === 'string';\n}\n\n/**\n * Generate device-specific user ID to prevent Chrome sync conflicts\n * Creates technical identifiers with full account context\n *\n * @param nearAccountId - The NEAR account ID (e.g., \"serp120.w3a-v1.testnet\")\n * @param deviceNumber - The device number (optional, undefined for device 1, 2 for device 2, etc.)\n * @returns Technical identifier:\n *   - Device 1: \"serp120.web3-authn.testnet\"\n *   - Device 2: \"serp120.web3-authn.testnet (2)\"\n *   - Device 3: \"serp120.web3-authn.testnet (3)\"\n */\nexport function generateDeviceSpecificUserId(nearAccountId: string, deviceNumber?: number): string {\n  // If no device number provided or device number is 1, this is the first device\n  if (deviceNumber === undefined || deviceNumber === 1) {\n    return nearAccountId;\n  }\n  // For additional devices, add device number in parentheses\n  return `${nearAccountId} (${deviceNumber})`;\n}\n\n/**\n * Generate user-friendly display name for passkey manager UI\n * Creates clean, intuitive names that users will see\n *\n * @param nearAccountId - The NEAR account ID (e.g., \"serp120.w3a-v1.testnet\")\n * @param deviceNumber - The device number (optional, undefined for device 1, 2 for device 2, etc.)\n * @returns User-friendly display name:\n *   - Device 1: \"serp120\"\n *   - Device 2: \"serp120 (device 2)\"\n *   - Device 3: \"serp120 (device 3)\"\n */\nfunction generateUserFriendlyDisplayName(nearAccountId: string, deviceNumber?: number): string {\n  // Extract the base username (everything before the first dot)\n  const baseUsername = nearAccountId.split('.')[0];\n  // If no device number provided or device number is 1, this is the first device\n  if (deviceNumber === undefined || deviceNumber === 1) {\n    return baseUsername;\n  }\n  // For additional devices, add device number with friendly label\n  return `${baseUsername} (device ${deviceNumber})`;\n}\n\n// Abort native WebAuthn when page is being hidden or unloaded\n// Centralized here to keep WebAuthn lifecycle concerns alongside native calls.\nexport namespace TouchIdPrompt {\n  export function attachPageAbortHandlers(controller: AbortController): () => void {\n    const onVisibility = () => { if (document.hidden) controller.abort(); };\n    const onPageHide = () => { controller.abort(); };\n    const onBeforeUnload = () => { controller.abort(); };\n    document.addEventListener('visibilitychange', onVisibility, { passive: true });\n    window.addEventListener('pagehide', onPageHide, { passive: true });\n    window.addEventListener('beforeunload', onBeforeUnload, { passive: true });\n    return () => {\n      document.removeEventListener('visibilitychange', onVisibility);\n      window.removeEventListener('pagehide', onPageHide);\n      window.removeEventListener('beforeunload', onBeforeUnload);\n    };\n  }\n}\n"],"mappings":";;;;;;AAUA,SAAS,oBAAoB,MAAc,MAAuB;AAChE,KAAI,CAAC,QAAQ,CAAC,KAAM,QAAO;AAC3B,KAAI,SAAS,KAAM,QAAO;AAC1B,QAAO,KAAK,SAAS,MAAM;;AAG7B,SAAS,YAAY,UAA8B,MAAkC;CACnF,MAAM,KAAK,QAAQ,IAAI;CACvB,MAAM,MAAM,YAAY,IAAI;AAC5B,KAAI,MAAM,KAAK,oBAAoB,GAAG,IAAK,QAAO;AAClD,QAAO,KAAK,MAAM;;AAqBpB,SAAgB,iCACd,gBACmB;AACnB,QAAO,eAAe,KAAI,UAAS;EACjC,IAAI,KAAK;EACT,MAAM;EACN,YAAY,KAAK;;;;;;;;;AAUrB,IAAa,gBAAb,MAAa,cAAc;CACzB,AAAQ;CACR,AAAQ;CAER,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,YAAY,cAAuB,wCAAwC,OAAO;AAChF,OAAK,eAAe;AACpB,OAAK,wCAAwC,0CAA0C;;CAGzF,UAAkB;AAChB,MAAI;AACF,UAAO,YAAY,KAAK,cAAc,QAAQ,UAAU;UAClD;AACN,UAAO,KAAK,gBAAgB;;;CAKhC,OAAe,YAAqB;AAClC,MAAI;AAAE,UAAO,OAAO,SAAS,OAAO;UAAa;AAAE,UAAO;;;;;;;;;;CAU5D,MAAM,uCAAuC,EAC3C,eACA,WACA,oBAK4C;EAC5C,MAAM,kBAAmB,MAAM,KAAK,qCAAqC;GACvE;GACA;GACA;;AAGF,MAAI,qCAAqC,iBACvC,QAAO;AAET,SAAOA,oEAAyC;GAC9C,YAAY;GACZ,gBAAgB;GAChB,iBAAiB;;;;;;;;;;;CAYrB,MAAM,8CAA8C,EAClD,eACA,WACA,oBAK4C;EAC5C,MAAM,kBAAmB,MAAM,KAAK,qCAAqC;GACvE;GACA;GACA;;AAGF,MAAI,qCAAqC,iBACvC,QAAO;AAET,SAAOA,oEAAyC;GAC9C,YAAY;GACZ,gBAAgB;GAChB,iBAAiB;;;;;;;;;;CAWrB,MAAM,wCAAwC,EAC5C,eACA,WACA,gBACwD;AAExD,OAAK,kBAAkB,IAAI;AAC3B,OAAK,0BAA0B,cAAc,wBAAwB,KAAK;EAE1E,MAAM,OAAO,KAAK;EAClB,MAAMC,YAAgD;GACpD,WAAWC,mCAAgB;GAC3B,IAAI;IACF,MAAM;IACN,IAAI;;GAEN,MAAM;IACJ,IAAI,IAAI,cAAc,OAAO,6BAA6B,eAAe;IACzE,MAAM,6BAA6B,eAAe;IAClD,aAAa,gCAAgC,eAAe;;GAE9D,kBAAkB,CAChB;IAAE,KAAK;IAAI,MAAM;MACjB;IAAE,KAAK;IAAM,MAAM;;GAErB,wBAAwB;IACtB,aAAa;IACb,kBAAkB;;GAEpB,SAAS;GACT,aAAa;GACb,YAAY,EACV,KAAK,EACH,MAAM;IAEJ,OAAOC,gDAAqB;IAC5B,QAAQC,+CAAoB;;;AAKpC,MAAI;GACF,MAAM,SAAS,MAAMC,kEAAyC,UAAU,WAAW;IACjF;IACA,UAAU,cAAc;IACxB,WAAW,UAAU;IAErB,aAAa,KAAK,gBAAgB;;AAEpC,UAAO;YACC;AACR,QAAK;AACL,QAAK,0BAA0B;AAC/B,QAAK;AACL,QAAK,8BAA8B;AACnC,QAAK,kBAAkB;;;;;;;;;;;;;;;;;CAkB3B,MAAM,qCAAqC,EACzC,eACA,WACA,oBAC4D;AAE5D,OAAK,kBAAkB,IAAI;AAC3B,OAAK,0BAA0B,cAAc,wBAAwB,KAAK;EAE1E,MAAM,OAAO,KAAK;EAClB,MAAMC,YAA+C;GACnD,WAAWJ,mCAAgB;GAC3B;GACA,kBAAkB,iBAAiB,KAAK,gBAAgB;IACtD,IAAIK,+BAAgB,WAAW;IAC/B,MAAM;IACN,YAAY,WAAW;;GAEzB,kBAAkB;GAClB,SAAS;GACT,YAAY,EACV,KAAK,EACH,MAAM;IAEJ,OAAOJ,gDAAqB;IAC5B,QAAQC,+CAAoB;;;AAKpC,MAAI;GACF,MAAM,SAAS,MAAMC,kEAAyC,OAAO,WAAW;IAC9E;IACA,UAAU,cAAc;IACxB,WAAW,UAAU;IACrB,gCAAgC,KAAK;IACrC,aAAa,KAAK,gBAAgB;;AAEpC,UAAO;YACC;AACR,QAAK;AACL,QAAK,0BAA0B;AAC/B,QAAK;AACL,QAAK,8BAA8B;AACnC,QAAK,kBAAkB;;;;AAM7B,SAAS,qCAAqC,GAAmD;AAC/F,KAAI,CAAC,KAAK,OAAO,MAAM,SAAU,QAAO;CACxC,MAAM,MAAM;CACZ,MAAM,OAAO,IAAI;AACjB,QAAO,OAAO,MAAM,sBAAsB;;;;;;;;;;;;;AAc5C,SAAgB,6BAA6B,eAAuB,cAA+B;AAEjG,KAAI,iBAAiB,UAAa,iBAAiB,EACjD,QAAO;AAGT,QAAO,GAAG,cAAc,IAAI,aAAa;;;;;;;;;;;;;AAc3C,SAAS,gCAAgC,eAAuB,cAA+B;CAE7F,MAAM,eAAe,cAAc,MAAM,KAAK;AAE9C,KAAI,iBAAiB,UAAa,iBAAiB,EACjD,QAAO;AAGT,QAAO,GAAG,aAAa,WAAW,aAAa;;;CAMxC,SAAS,wBAAwB,YAAyC;EAC/E,MAAM,qBAAqB;AAAE,OAAI,SAAS,OAAQ,YAAW;;EAC7D,MAAM,mBAAmB;AAAE,cAAW;;EACtC,MAAM,uBAAuB;AAAE,cAAW;;AAC1C,WAAS,iBAAiB,oBAAoB,cAAc,EAAE,SAAS;AACvE,SAAO,iBAAiB,YAAY,YAAY,EAAE,SAAS;AAC3D,SAAO,iBAAiB,gBAAgB,gBAAgB,EAAE,SAAS;AACnE,eAAa;AACX,YAAS,oBAAoB,oBAAoB;AACjD,UAAO,oBAAoB,YAAY;AACvC,UAAO,oBAAoB,gBAAgB"}

package/dist/cjs/react/src/core/WebAuthnManager/userHandle.js

@@ -0,0 +1,35 @@
+const require_validation = require('../../utils/validation.js');
+const require_base64 = require('../../utils/base64.js');
+
+//#region src/core/WebAuthnManager/userHandle.ts
+/**
+* Parse a WebAuthn userHandle into a NEAR account ID.
+* Accepts either a base64url string (serialized) or an ArrayBuffer-like value.
+* Strips optional device suffixes like " (2)" appended during registration.
+* Returns a validated account ID string or null if invalid/unavailable.
+*/
+function parseAccountIdFromUserHandle(userHandle) {
+	try {
+		let bytes = null;
+		if (typeof userHandle === "string" && userHandle.length > 0) try {
+			bytes = require_base64.base64UrlDecode(userHandle);
+		} catch {
+			bytes = null;
+		}
+		else if (userHandle && typeof userHandle.byteLength === "number") try {
+			bytes = new Uint8Array(userHandle);
+		} catch {
+			bytes = null;
+		}
+		if (!bytes || bytes.byteLength === 0) return null;
+		const decoded = new TextDecoder().decode(bytes);
+		const base = decoded.replace(/ \(\d+\)$/g, "");
+		return require_validation.validateNearAccountId(base).valid ? base : null;
+	} catch {
+		return null;
+	}
+}
+
+//#endregion
+exports.parseAccountIdFromUserHandle = parseAccountIdFromUserHandle;
+//# sourceMappingURL=userHandle.js.map

package/dist/cjs/react/src/core/WebAuthnManager/userHandle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userHandle.js","names":["bytes: Uint8Array | null","base64UrlDecode","validateNearAccountId"],"sources":["../../../../../../src/core/WebAuthnManager/userHandle.ts"],"sourcesContent":["import { base64UrlDecode } from '../../utils';\nimport { validateNearAccountId } from '../../utils/validation';\n\n/**\n * Parse a WebAuthn userHandle into a NEAR account ID.\n * Accepts either a base64url string (serialized) or an ArrayBuffer-like value.\n * Strips optional device suffixes like \" (2)\" appended during registration.\n * Returns a validated account ID string or null if invalid/unavailable.\n */\nexport function parseAccountIdFromUserHandle(userHandle: unknown): string | null {\n  try {\n    let bytes: Uint8Array | null = null;\n    if (typeof userHandle === 'string' && userHandle.length > 0) {\n      try { bytes = base64UrlDecode(userHandle); } catch { bytes = null; }\n    } else if (userHandle && typeof (userHandle as any).byteLength === 'number') {\n      try { bytes = new Uint8Array(userHandle as ArrayBuffer); } catch { bytes = null; }\n    }\n    if (!bytes || bytes.byteLength === 0) return null;\n\n    const decoded = new TextDecoder().decode(bytes);\n    const base = decoded.replace(/ \\(\\d+\\)$/g, '');\n    return validateNearAccountId(base).valid ? base : null;\n  } catch {\n    return null;\n  }\n}\n\n"],"mappings":";;;;;;;;;;AASA,SAAgB,6BAA6B,YAAoC;AAC/E,KAAI;EACF,IAAIA,QAA2B;AAC/B,MAAI,OAAO,eAAe,YAAY,WAAW,SAAS,EACxD,KAAI;AAAE,WAAQC,+BAAgB;UAAqB;AAAE,WAAQ;;WACpD,cAAc,OAAQ,WAAmB,eAAe,SACjE,KAAI;AAAE,WAAQ,IAAI,WAAW;UAAoC;AAAE,WAAQ;;AAE7E,MAAI,CAAC,SAAS,MAAM,eAAe,EAAG,QAAO;EAE7C,MAAM,UAAU,IAAI,cAAc,OAAO;EACzC,MAAM,OAAO,QAAQ,QAAQ,cAAc;AAC3C,SAAOC,yCAAsB,MAAM,QAAQ,OAAO;SAC5C;AACN,SAAO"}