@veridex/sdk 1.1.5 → 1.1.7

package/dist/auth/prepareAuth.js

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,14 +15,6 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/auth/prepareAuth.ts
@@ -33,7 +23,6 @@ __export(prepareAuth_exports, {
   authenticateAndPrepare: () => authenticateAndPrepare
 });
 module.exports = __toCommonJS(prepareAuth_exports);
-var import_ethers5 = require("ethers");
 
 // src/core/PasskeyManager.ts
 var import_browser = require("@simplewebauthn/browser");
@@ -46,255 +35,6 @@ var import_ethers = require("ethers");
 var ACTION_TRANSFER = 1;
 var ACTION_EXECUTE = 2;
 var ACTION_BRIDGE = 4;
-var TESTNET_CHAINS = {
-  baseSepolia: {
-    name: "Base Sepolia",
-    chainId: 84532,
-    wormholeChainId: 10004,
-    rpcUrl: "https://sepolia.base.org",
-    explorerUrl: "https://sepolia.basescan.org",
-    isEvm: true,
-    contracts: {
-      hub: "0xD5D29b6EaeE6FF4b765e704298a7e48D22607059",
-      vaultFactory: "0xb25b73D5FeD5693dcd1Bb78f8e33387B59A022EC",
-      vaultImplementation: "0x2CB8397df988c1880d9e5cFfF65bfC22D7D90EE6",
-      wormholeCoreBridge: "0x79A1027a6A159502049F10906D333EC57E95F083",
-      tokenBridge: "0x86F55A04690fd7815A3D802bD587e83eA888B239"
-    }
-  },
-  ethereumSepolia: {
-    name: "Ethereum Sepolia",
-    chainId: 11155111,
-    wormholeChainId: 10002,
-    rpcUrl: "https://ethereum-sepolia-rpc.publicnode.com",
-    explorerUrl: "https://sepolia.etherscan.io",
-    isEvm: true,
-    contracts: {
-      vaultFactory: "0x265c10763B4d16AD970bC3d7670c645e37f63AF4",
-      vaultImplementation: "0x942426C94652ebC48f4f404928016B95ADb1DA25",
-      wormholeCoreBridge: "0x4a8bc80Ed5a4067f1CCf107057b8270E0cC11A78",
-      tokenBridge: "0xDB5492265f6038831E89f495670FF909aDe94bd9"
-    }
-  },
-  optimismSepolia: {
-    name: "Optimism Sepolia",
-    chainId: 11155420,
-    wormholeChainId: 10005,
-    rpcUrl: "https://sepolia.optimism.io",
-    explorerUrl: "https://sepolia-optimism.etherscan.io",
-    isEvm: true,
-    contracts: {
-      vaultFactory: "0x3c5e4aCdC8Cd53ae5ae603B4c511885191fBb868",
-      vaultImplementation: "0xA45dBF322c5A3028687fEEB161603d3BCe02e119",
-      wormholeCoreBridge: "0x31377888146f3253211EFEf5c676D41ECe7D58Fe",
-      tokenBridge: "0x99737Ec4B815d816c49A385943baf0380e75c0Ac"
-    }
-  },
-  arbitrumSepolia: {
-    name: "Arbitrum Sepolia",
-    chainId: 421614,
-    wormholeChainId: 10003,
-    rpcUrl: "https://sepolia-rollup.arbitrum.io/rpc",
-    explorerUrl: "https://sepolia.arbiscan.io",
-    isEvm: true,
-    contracts: {
-      vaultFactory: "0xB9C3e6bad3c6f26956be4a4bb5a366376Fd3045D",
-      vaultImplementation: "0x8601881b94B68B09b485f407317686103d3CB681",
-      wormholeCoreBridge: "0x6b9C8671cdDC8dEab9c719bB87cBd3e782bA6a35",
-      tokenBridge: "0xC7A204bDBFe983FCD8d8E61D02b475D4073fF97e"
-    }
-  },
-  monadTestnet: {
-    name: "Monad Testnet",
-    chainId: 10143,
-    wormholeChainId: 10048,
-    rpcUrl: "https://testnet-rpc.monad.xyz",
-    explorerUrl: "https://testnet.monadexplorer.com",
-    isEvm: true,
-    contracts: {
-      vaultFactory: "0xbE9B9c39956448DA75Ac97E5e3dE17e34171660A",
-      vaultImplementation: "0x500853DCc54Fd1A707ec9d443032Bb7748f426d3",
-      wormholeCoreBridge: "0xBB73cB66C26740F31d1FabDC6b7A46a038A300dd",
-      tokenBridge: "0x0000000000000000000000000000000000000000"
-    }
-  },
-  avalancheFuji: {
-    name: "Avalanche Fuji",
-    chainId: 43113,
-    wormholeChainId: 6,
-    rpcUrl: "https://api.avax-test.network/ext/bc/C/rpc",
-    explorerUrl: "https://testnet.snowtrace.io",
-    isEvm: true,
-    contracts: {
-      vaultFactory: "0x9e9716442e908A9b61F11432cC38024DD390cd2a",
-      vaultImplementation: "0xE0b9919ffDf3415355Db369C8FfA5Dd4e000052c",
-      wormholeCoreBridge: "0x7bbcE28e64B3F8b84d876Ab298393c38ad7aac4C",
-      tokenBridge: "0x61E44E506Ca5659E6c0bba9b678586fA2d729756"
-    }
-  },
-  polygonAmoy: {
-    name: "Polygon Amoy",
-    chainId: 80002,
-    wormholeChainId: 10007,
-    rpcUrl: "https://rpc-amoy.polygon.technology",
-    explorerUrl: "https://amoy.polygonscan.com",
-    isEvm: true,
-    contracts: {
-      vaultFactory: "0x07F608AFf6d63b68029488b726d895c4Bb593038",
-      vaultImplementation: "0xD66153fccFB6731fB6c4944FbD607ba86A76a1f6",
-      wormholeCoreBridge: "0x6b9C8671cdDC8dEab9c719bB87cBd3e782bA6a35",
-      tokenBridge: "0xC7A204bDBFe983FCD8d8E61D02b475D4073fF97e"
-    }
-  },
-  solanaDevnet: {
-    name: "Solana Devnet",
-    chainId: 0,
-    wormholeChainId: 1,
-    rpcUrl: "https://api.devnet.solana.com",
-    explorerUrl: "https://explorer.solana.com",
-    isEvm: false,
-    contracts: {
-      hub: "64ZZBdmGd1YT6Fok7PELvAdfoXyR4PHxHnRqHNqZHJ13",
-      wormholeCoreBridge: "3u8hJUVTA4jH1wYAyUur7FFZVQ8H635K3tSHHF4ssjQ5",
-      tokenBridge: "DZnkkTmCiFWfYTfT41X3Rd1kDgozqzxWaHqsw6W4x2oe"
-    }
-  },
-  aptosTestnet: {
-    name: "Aptos Testnet",
-    chainId: 0,
-    wormholeChainId: 22,
-    rpcUrl: "https://fullnode.testnet.aptoslabs.com/v1",
-    explorerUrl: "https://explorer.aptoslabs.com",
-    isEvm: false,
-    contracts: {
-      hub: "0x9e8641143245ab8b93af1417a1fbc698d40fd351a25f6c17e4210e59bf82c9c7",
-      wormholeCoreBridge: "0x5bc11445584a763c1fa7ed39081f1b920954da14e04b32440cba863d03e19625",
-      tokenBridge: "0x576410486a2da45eee6c949c995670112ddf2fbeedab20350d506328eefc9d4f"
-    }
-  },
-  suiTestnet: {
-    name: "Sui Testnet",
-    chainId: 0,
-    wormholeChainId: 21,
-    rpcUrl: "https://fullnode.testnet.sui.io:443",
-    explorerUrl: "https://suiscan.xyz/testnet",
-    isEvm: false,
-    contracts: {
-      hub: "0xaf36d8bc349883b23e78b00a342a656c799319508600583eaee9121ffaa7f5f7",
-      wormholeCoreBridge: "0x31358d198147da50db32eda2562951d53973a0c0ad5ed738e9b17d88b213d790"
-    }
-  },
-  starknetSepolia: {
-    name: "Starknet Sepolia",
-    chainId: 0,
-    wormholeChainId: 50001,
-    rpcUrl: "https://starknet-sepolia-rpc.publicnode.com",
-    explorerUrl: "https://sepolia.starkscan.co",
-    isEvm: false,
-    contracts: {
-      hub: "0x7bb7cbe7d82e910b296611b582035a207343431f98bdd7b692bddfdd6f28737",
-      wormholeCoreBridge: "0x30d2e7f26dc75819cfddcd7caa26a76b681d5918f219c99060c42ce1e3f69e4"
-    },
-    hubChainId: 10004
-  }
-};
-var MAINNET_CHAINS = {
-  ethereum: {
-    name: "Ethereum",
-    chainId: 1,
-    wormholeChainId: 2,
-    rpcUrl: "https://eth.llamarpc.com",
-    explorerUrl: "https://etherscan.io",
-    isEvm: true,
-    contracts: {
-      wormholeCoreBridge: "0x98f3c9e6E3fAce36bAAd05FE09d375Ef1464288B",
-      tokenBridge: "0x3ee18B2214AFF97000D974cf647E7C347E8fa585"
-    }
-  },
-  base: {
-    name: "Base",
-    chainId: 8453,
-    wormholeChainId: 30,
-    rpcUrl: "https://mainnet.base.org",
-    explorerUrl: "https://basescan.org",
-    isEvm: true,
-    contracts: {
-      wormholeCoreBridge: "0xbebdb6C8ddC678FfA9f8748f85C815C556Dd8ac6",
-      tokenBridge: "0x8d2de8d2f73F1F4cAB472AC9A881C9b123C79627"
-    }
-  },
-  optimism: {
-    name: "Optimism",
-    chainId: 10,
-    wormholeChainId: 24,
-    rpcUrl: "https://mainnet.optimism.io",
-    explorerUrl: "https://optimistic.etherscan.io",
-    isEvm: true,
-    contracts: {
-      wormholeCoreBridge: "0xEe91C335eab126dF5fDB3797EA9d6aD93aeC9722",
-      tokenBridge: "0x1D68124e65faFC907325e3EDbF8c4d84499DAa8b"
-    }
-  },
-  arbitrum: {
-    name: "Arbitrum",
-    chainId: 42161,
-    wormholeChainId: 23,
-    rpcUrl: "https://arb1.arbitrum.io/rpc",
-    explorerUrl: "https://arbiscan.io",
-    isEvm: true,
-    contracts: {
-      wormholeCoreBridge: "0xa5f208e072434bC67592E4C49C1B991BA79BCA46",
-      tokenBridge: "0x0b2402144Bb366A632D14B83F244D2e0e21bD39c"
-    }
-  },
-  polygon: {
-    name: "Polygon",
-    chainId: 137,
-    wormholeChainId: 5,
-    rpcUrl: "https://polygon-rpc.com",
-    explorerUrl: "https://polygonscan.com",
-    isEvm: true,
-    contracts: {
-      wormholeCoreBridge: "0x7A4B5a56256163F07b2C80A7cA55aBE66c4ec4d7",
-      tokenBridge: "0x5a58505a96D1dbf8dF91cB21B54419FC36e93fdE"
-    }
-  },
-  solana: {
-    name: "Solana",
-    chainId: 0,
-    wormholeChainId: 1,
-    rpcUrl: "https://api.mainnet-beta.solana.com",
-    explorerUrl: "https://explorer.solana.com",
-    isEvm: false,
-    contracts: {
-      wormholeCoreBridge: "worm2ZoG2kUd4vFXhvjh93UUH596ayRfgQ2MgjNMTth",
-      tokenBridge: "wormDTUJ6AWPNvk59vGQbDvGJmqbDTdgWgAqcLBCgUb"
-    }
-  },
-  aptos: {
-    name: "Aptos",
-    chainId: 0,
-    wormholeChainId: 22,
-    rpcUrl: "https://fullnode.mainnet.aptoslabs.com/v1",
-    explorerUrl: "https://explorer.aptoslabs.com",
-    isEvm: false,
-    contracts: {
-      wormholeCoreBridge: "0x5bc11445584a763c1fa7ed39081f1b920954da14e04b32440cba863d03e19625",
-      tokenBridge: "0x576410486a2da45eee6c949c995670112ddf2fbeedab20350d506328eefc9d4f"
-    }
-  },
-  sui: {
-    name: "Sui",
-    chainId: 0,
-    wormholeChainId: 21,
-    rpcUrl: "https://fullnode.mainnet.sui.io:443",
-    explorerUrl: "https://suiscan.xyz/mainnet",
-    isEvm: false,
-    contracts: {
-      wormholeCoreBridge: "0xaeab97f96cf9877fee2883315d459552b2b921edc16d7ceac6eab944dd88919c"
-    }
-  }
-};
 
 // src/utils.ts
 function base64URLEncode(buffer) {
@@ -499,7 +239,8 @@ var PasskeyManager = class _PasskeyManager {
       credentialId: response.id,
       publicKeyX: publicKey.x,
       publicKeyY: publicKey.y,
-      keyHash
+      keyHash,
+      assurance: _PasskeyManager.assuranceFromRegistration(response) ?? void 0
     };
     return this.credential;
   }
@@ -878,7 +619,8 @@ var PasskeyManager = class _PasskeyManager {
       credentialId: response.id,
       publicKeyX: publicKey.x,
       publicKeyY: publicKey.y,
-      keyHash
+      keyHash,
+      assurance: _PasskeyManager.assuranceFromRegistration(response) ?? void 0
     };
     this.addCredentialToStorage(backupCredential);
     return backupCredential;
@@ -895,17 +637,94 @@ var PasskeyManager = class _PasskeyManager {
    */
   static parseBackupFlags(authenticatorData) {
     try {
-      const data = import_ethers2.ethers.getBytes(authenticatorData);
-      if (data.length < 37) return null;
-      const flags = data[32];
+      const assurance = _PasskeyManager.deriveAssurance(import_ethers2.ethers.getBytes(authenticatorData));
+      if (!assurance) return null;
       return {
-        backupEligible: (flags & 8) !== 0,
-        backupState: (flags & 16) !== 0
+        backupEligible: assurance.backupEligible,
+        backupState: assurance.backupState
       };
     } catch {
       return null;
     }
   }
+  /**
+   * Derive credential assurance from raw WebAuthn authenticator data.
+   *
+   * authData layout:
+   *   rpIdHash (32) | flags (1) | signCount (4) | [attestedCredentialData: aaguid (16) | ...]
+   *
+   * Flags byte: UP 0x01 | UV 0x04 | BE 0x08 | BS 0x10 | AT 0x40 | ED 0x80
+   *
+   * BE is the authoritative signal for whether a credential is device-bound or
+   * syncable. It is set by the authenticator itself — unlike a platform/user-agent
+   * guess, it correctly identifies a hardware key used on a syncing platform.
+   *
+   * @returns Assurance, or `null` if authData is too short to be valid.
+   */
+  static deriveAssurance(authData) {
+    if (authData.length < 37) return null;
+    const flags = authData[32];
+    const backupEligible = (flags & 8) !== 0;
+    const attestedCredentialData = (flags & 64) !== 0;
+    let aaguid;
+    if (attestedCredentialData && authData.length >= 53) {
+      aaguid = import_ethers2.ethers.hexlify(authData.slice(37, 53));
+    }
+    return {
+      backupEligible,
+      backupState: (flags & 16) !== 0,
+      userVerified: (flags & 4) !== 0,
+      level: backupEligible ? "synced" : "device-bound",
+      aaguid
+    };
+  }
+  /**
+   * Extract raw authenticator data from a registration response.
+   *
+   * Prefers the `authenticatorData` field when the authenticator provides it,
+   * and otherwise locates the `authData` byte string inside the CBOR
+   * attestation object.
+   */
+  static extractAuthData(response) {
+    const direct = response.response.authenticatorData;
+    if (direct) {
+      try {
+        return base64URLDecode(direct);
+      } catch {
+      }
+    }
+    try {
+      const attestationObject = base64URLDecode(response.response.attestationObject);
+      let offset = 0;
+      if (attestationObject[offset] >= 160 && attestationObject[offset] <= 191) {
+        offset++;
+      }
+      const key = [104, 97, 117, 116, 104, 68, 97, 116, 97];
+      let found = false;
+      while (offset < attestationObject.length - 37) {
+        if (key.every((byte, i) => attestationObject[offset + i] === byte)) {
+          offset += key.length;
+          found = true;
+          break;
+        }
+        offset++;
+      }
+      if (!found) return null;
+      if (attestationObject[offset] === 88) {
+        offset += 2;
+      } else if (attestationObject[offset] === 89) {
+        offset += 3;
+      }
+      return attestationObject.slice(offset);
+    } catch {
+      return null;
+    }
+  }
+  /** Derive assurance directly from a registration response. */
+  static assuranceFromRegistration(response) {
+    const authData = _PasskeyManager.extractAuthData(response);
+    return authData ? _PasskeyManager.deriveAssurance(authData) : null;
+  }
   /**
    * Get the number of credentials stored locally.
    */
@@ -1273,1105 +1092,55 @@ function padTo32Bytes(address) {
   }
   return "0x" + hex.padStart(64, "0");
 }
-function createGaslessMessageHash(targetChain, actionPayload, nonce, hubChainId) {
-  return import_ethers3.ethers.solidityPacked(
-    ["uint16", "bytes", "uint256", "uint16"],
-    [targetChain, actionPayload, nonce, hubChainId]
+var HUB_NONCE_DOMAIN = 0;
+var TIER_T2_AUTHORITATIVE = 3;
+var CHALLENGE_DOMAIN = import_ethers3.ethers.sha256(import_ethers3.ethers.toUtf8Bytes("veridex.challenge.v1"));
+function buildCanonicalChallenge(input) {
+  if (!Number.isInteger(input.veridexChainId) || input.veridexChainId <= 0 || input.veridexChainId > 4294967295) {
+    throw new Error("veridexChainId must be an integer between 1 and 4294967295");
+  }
+  if (!Number.isInteger(input.minTier) || input.minTier < 0 || input.minTier > TIER_T2_AUTHORITATIVE) {
+    throw new Error("minTier must be an integer between 0 and 3");
+  }
+  if (input.nonce < 0n || input.nonce > 0xffffffffffffffffn) {
+    throw new Error("nonce must fit in uint64");
+  }
+  const executor = import_ethers3.ethers.hexlify(import_ethers3.ethers.zeroPadValue(input.executor, 32));
+  if (executor === import_ethers3.ethers.ZeroHash) {
+    throw new Error("executor must not be zero");
+  }
+  const preimage = import_ethers3.ethers.solidityPacked(
+    ["bytes32", "uint8", "uint8", "uint32", "bytes32", "uint32", "uint64", "bytes32"],
+    [
+      CHALLENGE_DOMAIN,
+      1,
+      input.minTier,
+      input.veridexChainId,
+      executor,
+      HUB_NONCE_DOMAIN,
+      input.nonce,
+      input.actionHash
+    ]
   );
-}
-function buildGaslessChallenge(targetChain, actionPayload, nonce, hubChainId) {
-  const packed = createGaslessMessageHash(targetChain, actionPayload, nonce, hubChainId);
-  return import_ethers3.ethers.getBytes(packed);
-}
-
-// src/queries/hubState.ts
-var import_axios = __toESM(require("axios"));
-var import_buffer = require("buffer");
-var import_ethers4 = require("ethers");
-var import_wormhole_query_sdk = require("@wormhole-foundation/wormhole-query-sdk");
-
-// src/queries/constants.ts
-var WORMHOLE_QUERY_PROXY_URLS = {
-  mainnet: "https://query.wormhole.com/v1/query",
-  testnet: "https://testnet.query.wormhole.com/v1/query"
-};
-
-// src/queries/hubState.ts
-var QueryHubStateError = class extends Error {
-  code;
-  cause;
-  constructor(code, message, cause) {
-    super(message);
-    this.name = "QueryHubStateError";
-    this.code = code;
-    this.cause = cause;
-  }
-};
-function resolveNetwork(options) {
-  if (options?.network) return options.network;
-  const envCandidates = [
-    globalThis?.process?.env?.NEXT_PUBLIC_VERIDEX_NETWORK,
-    globalThis?.process?.env?.VERIDEX_NETWORK,
-    globalThis?.process?.env?.NEXT_PUBLIC_WORMHOLE_NETWORK,
-    globalThis?.process?.env?.WORMHOLE_NETWORK
-  ].filter(Boolean);
-  const env = envCandidates[0]?.toLowerCase();
-  if (env === "mainnet" || env === "testnet") return env;
-  return "testnet";
-}
-function concatBytes(parts) {
-  const total = parts.reduce((sum, p) => sum + p.length, 0);
-  const out = new Uint8Array(total);
-  let offset = 0;
-  for (const p of parts) {
-    out.set(p, offset);
-    offset += p.length;
-  }
-  return out;
-}
-function signaturesToProofBytes(signatures) {
-  const chunks = [];
-  for (const sig of signatures) {
-    if (typeof sig !== "string" || sig.length !== 132 || !/^[0-9a-fA-F]+$/.test(sig)) {
-      throw new QueryHubStateError(
-        "PROXY_RESPONSE_INVALID",
-        `Invalid guardian signature format (expected 132 hex chars): ${String(sig)}`
-      );
-    }
-    chunks.push((0, import_wormhole_query_sdk.hexToUint8Array)(`0x${sig}`));
-  }
-  return concatBytes(chunks);
-}
-function decodeQueryBytes(bytes) {
-  if (typeof bytes !== "string" || bytes.length === 0) {
-    throw new QueryHubStateError("PROXY_RESPONSE_INVALID", "Missing query response bytes");
-  }
-  if ((0, import_wormhole_query_sdk.isValidHexString)(bytes)) {
-    return (0, import_wormhole_query_sdk.hexToUint8Array)(bytes);
-  }
-  try {
-    if (typeof atob === "function") {
-      const raw = atob(bytes);
-      const arr = new Uint8Array(raw.length);
-      for (let i = 0; i < raw.length; i++) arr[i] = raw.charCodeAt(i);
-      return arr;
-    }
-  } catch {
-  }
-  try {
-    return new Uint8Array(import_buffer.Buffer.from(bytes, "base64"));
-  } catch (cause) {
-    throw new QueryHubStateError("PROXY_RESPONSE_INVALID", "Unrecognized query response bytes encoding", cause);
-  }
-}
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-async function withExponentialBackoff(fn, maxAttempts) {
-  let attempt = 0;
-  let lastError;
-  while (attempt < maxAttempts) {
-    try {
-      return await fn();
-    } catch (err) {
-      lastError = err;
-      attempt += 1;
-      if (attempt >= maxAttempts) break;
-      const baseMs = 250;
-      const backoffMs = Math.min(5e3, baseMs * 2 ** (attempt - 1));
-      const jitterMs = Math.floor(Math.random() * 100);
-      await sleep(backoffMs + jitterMs);
-    }
-  }
-  throw lastError;
-}
-function getHubConfig(network) {
-  if (network === "testnet") {
-    const baseSepolia = TESTNET_CHAINS.baseSepolia;
-    if (!baseSepolia?.contracts?.hub) {
-      throw new QueryHubStateError("MISSING_HUB_ADDRESS", "Missing Base Sepolia hub address in SDK constants");
-    }
-    return {
-      wormholeChainId: baseSepolia.wormholeChainId,
-      hubAddress: baseSepolia.contracts.hub,
-      endpoint: WORMHOLE_QUERY_PROXY_URLS.testnet,
-      rpcUrl: baseSepolia.rpcUrl
-    };
-  }
-  if (network === "mainnet") {
-    const base = MAINNET_CHAINS.base;
-    const hubAddress = base?.contracts?.hub;
-    if (!hubAddress) {
-      throw new QueryHubStateError(
-        "MISSING_HUB_ADDRESS",
-        "Missing mainnet hub address in SDK constants (MAINNET_CHAINS.base.contracts.hub)"
-      );
-    }
-    return {
-      wormholeChainId: base.wormholeChainId,
-      hubAddress,
-      endpoint: WORMHOLE_QUERY_PROXY_URLS.mainnet,
-      rpcUrl: base.rpcUrl
-    };
-  }
-  throw new QueryHubStateError("UNSUPPORTED_NETWORK", `Unsupported network: ${network}`);
-}
-function encodeHubCalls(hubAddress, userKeyHash) {
-  const nonceAbiCandidates = [
-    "function getUserNonce(bytes32 userKeyHash) view returns (uint256)",
-    "function userNonces(bytes32 userKeyHash) view returns (uint256)",
-    "function getNonceByHash(bytes32 userKeyHash) view returns (uint256)"
-  ];
-  const registeredAbiCandidates = [
-    "function registeredKeys(bytes32 userKeyHash) view returns (bool)",
-    "function isKeyRegisteredByHash(bytes32 userKeyHash) view returns (bool)"
-  ];
-  const actionHashAbiCandidates = [
-    "function getUserLastActionHash(bytes32 userKeyHash) view returns (bytes32)",
-    "function userLastActionHash(bytes32 userKeyHash) view returns (bytes32)"
-  ];
-  const iface = new import_ethers4.ethers.Interface([
-    ...nonceAbiCandidates,
-    ...registeredAbiCandidates,
-    ...actionHashAbiCandidates
-  ]);
-  const nonceFnNames = ["getUserNonce", "userNonces", "getNonceByHash"];
-  const regFnNames = ["registeredKeys", "isKeyRegisteredByHash"];
-  const actionHashFnNames = ["getUserLastActionHash", "userLastActionHash"];
-  return [
-    ...nonceFnNames.map((fn) => ({
-      to: hubAddress,
-      data: iface.encodeFunctionData(fn, [userKeyHash])
-    })),
-    ...regFnNames.map((fn) => ({
-      to: hubAddress,
-      data: iface.encodeFunctionData(fn, [userKeyHash])
-    })),
-    ...actionHashFnNames.map((fn) => ({
-      to: hubAddress,
-      data: iface.encodeFunctionData(fn, [userKeyHash])
-    }))
-  ];
-}
-function decodeFirstNonce(results) {
-  const candidates = [
-    "function getUserNonce(bytes32 userKeyHash) view returns (uint256)",
-    "function userNonces(bytes32 userKeyHash) view returns (uint256)",
-    "function getNonceByHash(bytes32 userKeyHash) view returns (uint256)"
-  ];
-  const iface = new import_ethers4.ethers.Interface(candidates);
-  const fnNames = ["getUserNonce", "userNonces", "getNonceByHash"];
-  for (let idx = 0; idx < fnNames.length; idx++) {
-    const fnName = fnNames[idx];
-    try {
-      const data = results[idx];
-      if (!data || data === "0x") continue;
-      const decoded = iface.decodeFunctionResult(fnName, data);
-      return decoded[0];
-    } catch {
-    }
-  }
-  throw new QueryHubStateError("QUERY_RESPONSE_INVALID", "Unable to decode user nonce from query response");
-}
-function decodeFirstIsRegistered(results) {
-  const nonceCandidateCount = 3;
-  const candidates = [
-    "function registeredKeys(bytes32 userKeyHash) view returns (bool)",
-    "function isKeyRegisteredByHash(bytes32 userKeyHash) view returns (bool)"
-  ];
-  const iface = new import_ethers4.ethers.Interface(candidates);
-  const fnNames = ["registeredKeys", "isKeyRegisteredByHash"];
-  for (let i = 0; i < fnNames.length; i++) {
-    const fnName = fnNames[i];
-    try {
-      const data = results[nonceCandidateCount + i];
-      if (!data || data === "0x") continue;
-      const decoded = iface.decodeFunctionResult(fnName, data);
-      return Boolean(decoded[0]);
-    } catch {
-    }
-  }
-  return false;
-}
-function decodeLastActionHash(results) {
-  const nonceCandidateCount = 3;
-  const registeredCandidateCount = 2;
-  const actionHashOffset = nonceCandidateCount + registeredCandidateCount;
-  const candidates = [
-    "function getUserLastActionHash(bytes32 userKeyHash) view returns (bytes32)",
-    "function userLastActionHash(bytes32 userKeyHash) view returns (bytes32)"
-  ];
-  const iface = new import_ethers4.ethers.Interface(candidates);
-  const fnNames = ["getUserLastActionHash", "userLastActionHash"];
-  for (let i = 0; i < fnNames.length; i++) {
-    const fnName = fnNames[i];
-    try {
-      const data = results[actionHashOffset + i];
-      if (!data || data === "0x") continue;
-      const decoded = iface.decodeFunctionResult(fnName, data);
-      return decoded[0];
-    } catch {
-    }
-  }
-  return import_ethers4.ethers.ZeroHash;
-}
-async function queryHubState(userKeyHash, apiKey, options) {
-  if (typeof userKeyHash !== "string" || userKeyHash.length === 0) {
-    throw new QueryHubStateError("INVALID_ARGUMENT", "userKeyHash is required");
-  }
-  if (!(0, import_wormhole_query_sdk.isValidHexString)(userKeyHash) || (0, import_wormhole_query_sdk.hexToUint8Array)(userKeyHash).length !== 32) {
-    throw new QueryHubStateError("INVALID_ARGUMENT", "userKeyHash must be a 32-byte hex string");
-  }
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new QueryHubStateError("INVALID_ARGUMENT", "apiKey is required");
-  }
-  const network = resolveNetwork(options);
-  const maxAgeSeconds = options?.maxAge ?? 60;
-  const maxAttempts = options?.maxAttempts ?? 4;
-  const { wormholeChainId, hubAddress, endpoint, rpcUrl } = getHubConfig(network);
-  const provider = new import_ethers4.ethers.JsonRpcProvider(rpcUrl);
-  const callData = encodeHubCalls(hubAddress, userKeyHash);
-  const doFetch = async () => {
-    try {
-      const latestBlock = await provider.getBlockNumber();
-      const blockTag = Math.max(0, latestBlock - 2);
-      const request = new import_wormhole_query_sdk.QueryRequest(Date.now() & 4294967295, [
-        new import_wormhole_query_sdk.PerChainQueryRequest(wormholeChainId, new import_wormhole_query_sdk.EthCallQueryRequest(blockTag, callData))
-      ]);
-      const requestHex = import_buffer.Buffer.from(request.serialize()).toString("hex");
-      const response = await import_axios.default.post(
-        endpoint,
-        { bytes: requestHex },
-        {
-          headers: {
-            "X-API-Key": apiKey,
-            "Content-Type": "application/json"
-          },
-          timeout: 1e4
-        }
-      );
-      const data = response.data;
-      const signatures = data?.signatures;
-      const bytes = data?.bytes;
-      if (!Array.isArray(signatures) || typeof bytes !== "string") {
-        throw new QueryHubStateError("PROXY_RESPONSE_INVALID", "Query Proxy response missing signatures/bytes");
-      }
-      const proof = signaturesToProofBytes(signatures);
-      const queryBytes = decodeQueryBytes(bytes);
-      const parsed = import_wormhole_query_sdk.QueryResponse.from(queryBytes);
-      const perChain = parsed.responses.find((r) => r.chainId === wormholeChainId);
-      if (!perChain) {
-        throw new QueryHubStateError("QUERY_RESPONSE_INVALID", "Missing per-chain response for hub chain");
-      }
-      const chainResp = import_wormhole_query_sdk.EthCallQueryResponse.from(perChain.response.serialize());
-      const blockTime = Number(chainResp.blockTime);
-      const nowSeconds = Math.floor(Date.now() / 1e3);
-      if (nowSeconds - blockTime > maxAgeSeconds) {
-        throw new QueryHubStateError(
-          "ATTESTATION_STALE",
-          `Guardian attestation is stale (blockTime=${blockTime}, now=${nowSeconds}, maxAge=${maxAgeSeconds}s)`
-        );
-      }
-      const nonce = decodeFirstNonce(chainResp.results);
-      const isRegistered = decodeFirstIsRegistered(chainResp.results);
-      const lastActionHash = decodeLastActionHash(chainResp.results);
-      return {
-        nonce,
-        isRegistered,
-        blockTime,
-        proof,
-        lastActionHash
-      };
-    } catch (err) {
-      if (err instanceof QueryHubStateError) throw err;
-      if (import_axios.default.isAxiosError(err)) {
-        const ax = err;
-        const status = ax.response?.status;
-        const statusText = ax.response?.statusText;
-        const details = typeof ax.response?.data === "string" ? ax.response?.data : void 0;
-        throw new QueryHubStateError(
-          "PROXY_HTTP_ERROR",
-          `Query Proxy request failed${status ? ` (${status} ${statusText ?? ""})` : ""}${details ? `: ${details}` : ""}`,
-          err
-        );
-      }
-      throw new QueryHubStateError("PROXY_HTTP_ERROR", "Query Proxy request failed", err);
-    }
-  };
-  return await withExponentialBackoff(doFetch, maxAttempts);
-}
-
-// src/featureFlags.ts
-var DEFAULT_FLAGS = {
-  multiHub: false,
-  primaryHub: "base"
-};
-var _flags = { ...DEFAULT_FLAGS };
-function getEffectivePrimaryHub() {
-  if (!_flags.multiHub) {
-    return "base";
+  if (import_ethers3.ethers.dataLength(preimage) !== 114) {
+    throw new Error("canonical challenge preimage must be 114 bytes");
   }
-  return _flags.primaryHub;
+  return import_ethers3.ethers.getBytes(import_ethers3.ethers.sha256(preimage));
 }
-
-// src/presets.ts
-var CHAIN_PRESETS = {
-  // ────────────────────────────────────────────────────────────────────────
-  // BASE - Primary Hub Chain
-  // ────────────────────────────────────────────────────────────────────────
-  base: {
-    displayName: "Base",
-    type: "evm",
-    canBeHub: true,
-    testnet: {
-      name: "Base Sepolia",
-      chainId: 84532,
-      wormholeChainId: 10004,
-      rpcUrl: "https://sepolia.base.org",
-      explorerUrl: "https://sepolia.basescan.org",
-      isEvm: true,
-      contracts: {
-        hub: "0xD5D29b6EaeE6FF4b765e704298a7e48D22607059",
-        vaultFactory: "0xb25b73D5FeD5693dcd1Bb78f8e33387B59A022EC",
-        vaultImplementation: "0x2CB8397df988c1880d9e5cFfF65bfC22D7D90EE6",
-        wormholeCoreBridge: "0x79A1027a6A159502049F10906D333EC57E95F083",
-        tokenBridge: "0x86F55A04690fd7815A3D802bD587e83eA888B239"
-      }
-    },
-    mainnet: {
-      name: "Base",
-      chainId: 8453,
-      wormholeChainId: 30,
-      rpcUrl: "https://mainnet.base.org",
-      explorerUrl: "https://basescan.org",
-      isEvm: true,
-      contracts: {
-        // TODO: Deploy mainnet contracts
-        wormholeCoreBridge: "0xbebdb6C8ddC678FfA9f8748f85C815C556Dd8ac6",
-        tokenBridge: "0x8d2de8d2f73F1F4cAB472AC9A881C9b123C79627"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // OPTIMISM - Secondary Hub / Spoke
-  // ────────────────────────────────────────────────────────────────────────
-  optimism: {
-    displayName: "Optimism",
-    type: "evm",
-    canBeHub: true,
-    testnet: {
-      name: "Optimism Sepolia",
-      chainId: 11155420,
-      wormholeChainId: 10005,
-      rpcUrl: "https://sepolia.optimism.io",
-      explorerUrl: "https://sepolia-optimism.etherscan.io",
-      isEvm: true,
-      contracts: {
-        vaultFactory: "0x3c5e4aCdC8Cd53ae5ae603B4c511885191fBb868",
-        vaultImplementation: "0xA45dBF322c5A3028687fEEB161603d3BCe02e119",
-        wormholeCoreBridge: "0x31377888146f3253211EFEf5c676D41ECe7D58Fe",
-        tokenBridge: "0x99737Ec4B815d816c49A385943baf0380e75c0Ac"
-      }
-    },
-    mainnet: {
-      name: "Optimism",
-      chainId: 10,
-      wormholeChainId: 24,
-      rpcUrl: "https://mainnet.optimism.io",
-      explorerUrl: "https://optimistic.etherscan.io",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0xEe91C335eab126dF5fDB3797EA9d6aD93aeC9722",
-        tokenBridge: "0x1D68124e65faFC907325e3EDbF8c4d84499DAa8b"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // ARBITRUM
-  // ────────────────────────────────────────────────────────────────────────
-  arbitrum: {
-    displayName: "Arbitrum",
-    type: "evm",
-    canBeHub: true,
-    testnet: {
-      name: "Arbitrum Sepolia",
-      chainId: 421614,
-      wormholeChainId: 10003,
-      rpcUrl: "https://sepolia-rollup.arbitrum.io/rpc",
-      explorerUrl: "https://sepolia.arbiscan.io",
-      isEvm: true,
-      contracts: {
-        vaultFactory: "0xB9C3e6bad3c6f26956be4a4bb5a366376Fd3045D",
-        vaultImplementation: "0x8601881b94B68B09b485f407317686103d3CB681",
-        wormholeCoreBridge: "0x6b9C8671cdDC8dEab9c719bB87cBd3e782bA6a35",
-        tokenBridge: "0xC7A204bDBFe983FCD8d8E61D02b475D4073fF97e"
-      }
-    },
-    mainnet: {
-      name: "Arbitrum",
-      chainId: 42161,
-      wormholeChainId: 23,
-      rpcUrl: "https://arb1.arbitrum.io/rpc",
-      explorerUrl: "https://arbiscan.io",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0xa5f208e072434bC67592E4C49C1B991BA79BCA46",
-        tokenBridge: "0x0b2402144Bb366A632D14B83F244D2e0e21bD39c"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // ETHEREUM
-  // ────────────────────────────────────────────────────────────────────────
-  ethereum: {
-    displayName: "Ethereum",
-    type: "evm",
-    canBeHub: false,
-    testnet: {
-      name: "Sepolia",
-      chainId: 11155111,
-      wormholeChainId: 10002,
-      rpcUrl: "https://ethereum-sepolia-rpc.publicnode.com",
-      explorerUrl: "https://sepolia.etherscan.io",
-      isEvm: true,
-      contracts: {
-        vaultFactory: "0x265c10763B4d16AD970bC3d7670c645e37f63AF4",
-        vaultImplementation: "0x942426C94652ebC48f4f404928016B95ADb1DA25",
-        wormholeCoreBridge: "0x4a8bc80Ed5a4067f1CCf107057b8270E0cC11A78",
-        tokenBridge: "0xDB5492265f6038831E89f495670FF909aDe94bd9"
-      }
-    },
-    mainnet: {
-      name: "Ethereum",
-      chainId: 1,
-      wormholeChainId: 2,
-      rpcUrl: "https://eth.llamarpc.com",
-      explorerUrl: "https://etherscan.io",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0x98f3c9e6E3fAce36bAAd05FE09d375Ef1464288B",
-        tokenBridge: "0x3ee18B2214AFF97000D974cf647E7C347E8fa585"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // POLYGON
-  // ────────────────────────────────────────────────────────────────────────
-  polygon: {
-    displayName: "Polygon",
-    type: "evm",
-    canBeHub: false,
-    testnet: {
-      name: "Polygon Amoy",
-      chainId: 80002,
-      wormholeChainId: 10007,
-      rpcUrl: "https://rpc-amoy.polygon.technology",
-      explorerUrl: "https://amoy.polygonscan.com",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0x0CBE91CF822c73C2315FB05100C2F714765d5c20",
-        tokenBridge: "0x0290FB167208Af455bB137780163b7B7a9a10C16"
-      }
-    },
-    mainnet: {
-      name: "Polygon",
-      chainId: 137,
-      wormholeChainId: 5,
-      rpcUrl: "https://polygon-rpc.com",
-      explorerUrl: "https://polygonscan.com",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0x7A4B5a56256163F07b2C80A7cA55aBE66c4ec4d7",
-        tokenBridge: "0x5a58505a96D1dbf8dF91cB21B54419FC36e93fdE"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // BSC
-  // ────────────────────────────────────────────────────────────────────────
-  bsc: {
-    displayName: "BNB Chain",
-    type: "evm",
-    canBeHub: false,
-    testnet: {
-      name: "BSC Testnet",
-      chainId: 97,
-      wormholeChainId: 4,
-      rpcUrl: "https://data-seed-prebsc-1-s1.binance.org:8545",
-      explorerUrl: "https://testnet.bscscan.com",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0x68605AD7b15c732a30b1BbC62BE8F2A509D74b4D",
-        tokenBridge: "0x9dcF9D205C9De35334D646BeE44b2D2859712A09"
-      }
-    },
-    mainnet: {
-      name: "BNB Chain",
-      chainId: 56,
-      wormholeChainId: 4,
-      rpcUrl: "https://bsc-dataseed.binance.org",
-      explorerUrl: "https://bscscan.com",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0x98f3c9e6E3fAce36bAAd05FE09d375Ef1464288B",
-        tokenBridge: "0xB6F6D86a8f9879A9c87f643768d9efc38c1Da6E7"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // AVALANCHE — ACP-204 Native P-256 + ICM Teleporter + Hub-Capable
-  // ────────────────────────────────────────────────────────────────────────
-  avalanche: {
-    displayName: "Avalanche",
-    type: "evm",
-    canBeHub: true,
-    // ACP-204 provides native P-256 at 0x0100 (6,900 gas)
-    testnet: {
-      name: "Avalanche Fuji",
-      chainId: 43113,
-      wormholeChainId: 6,
-      rpcUrl: "https://api.avax-test.network/ext/bc/C/rpc",
-      explorerUrl: "https://testnet.snowtrace.io",
-      isEvm: true,
-      contracts: {
-        // Veridex Hub (deployed via deploy-avalanche.ts)
-        hub: "",
-        // No Hub on Fuji — Hub is on Base Sepolia
-        vaultFactory: "0x9e9716442e908A9b61F11432cC38024DD390cd2a",
-        vaultImplementation: "0xE0b9919ffDf3415355Db369C8FfA5Dd4e000052c",
-        // Wormhole bridges (canonical Fuji addresses)
-        wormholeCoreBridge: "0x7bbcE28e64B3F8b84d876Ab298393c38ad7aac4C",
-        tokenBridge: "0x61E44E506Ca5659E6c0bba9b678586fA2d729756",
-        // Avalanche-specific: ACP-204 P-256 verifier wrapper
-        p256Verifier: "0xB5d29EA1E2e90A24D6506E2a6a269506a12974CC",
-        // Avalanche-specific: ICM Spoke for cross-L1 session bridging
-        icmSpoke: "0x9fCFC608086539A69839EfA9628884dB75ac07D0",
-        // Chainlink price feeds (Fuji testnet)
-        chainlinkAvaxUsd: "0x5498BB86BC934c8D34FDA08E81D444153d0D06aD",
-        chainlinkUsdcUsd: "0x7898AcCC83587C3C55116c5230C17a6Cd9C71bad",
-        chainlinkUsdtUsd: "0x7898AcCC83587C3C55116c5230C17a6Cd9C71bad"
-      },
-      hubChainId: 10004
-      // Base Sepolia (primary Hub)
-    },
-    mainnet: {
-      name: "Avalanche",
-      chainId: 43114,
-      wormholeChainId: 6,
-      rpcUrl: "https://api.avax.network/ext/bc/C/rpc",
-      explorerUrl: "https://snowtrace.io",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0x54a8e5f9c4CbA08F9943965859F6c34eAF03E26c",
-        tokenBridge: "0x0e082F06FF657D94310cB8cE8B0D9a04541d8052",
-        // Chainlink price feeds (Avalanche mainnet)
-        chainlinkAvaxUsd: "0x0A77230d17318075983913bC2145DB16C7366156",
-        chainlinkUsdcUsd: "0xF096872672F44d6EBA71458D74fe67F9a77a23B9",
-        chainlinkUsdtUsd: "0xEBE676ee90Fe1112671f19b6B7459bC678B67e8a"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // SCROLL
-  // ────────────────────────────────────────────────────────────────────────
-  scroll: {
-    displayName: "Scroll",
-    type: "evm",
-    canBeHub: false,
-    testnet: {
-      name: "Scroll Sepolia",
-      chainId: 534351,
-      wormholeChainId: 34,
-      rpcUrl: "https://sepolia-rpc.scroll.io",
-      explorerUrl: "https://sepolia.scrollscan.com",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0x055F47F1250012C6B20c436570a76e52c17Af2D5",
-        tokenBridge: "0x22427d90B7dA3fA4642F7025A854c7254E4e45BF"
-      }
-    },
-    mainnet: {
-      name: "Scroll",
-      chainId: 534352,
-      wormholeChainId: 34,
-      rpcUrl: "https://rpc.scroll.io",
-      explorerUrl: "https://scrollscan.com",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0xbebdb6C8ddC678FfA9f8748f85C815C556Dd8ac6",
-        tokenBridge: "0x24850c6f61C438823F01B7A3BF2B89B72174Fa9d"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // BLAST
-  // ────────────────────────────────────────────────────────────────────────
-  blast: {
-    displayName: "Blast",
-    type: "evm",
-    canBeHub: false,
-    testnet: {
-      name: "Blast Sepolia",
-      chainId: 168587773,
-      wormholeChainId: 36,
-      rpcUrl: "https://sepolia.blast.io",
-      explorerUrl: "https://sepolia.blastscan.io",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0x473e002D7add6fB67a4964F13bFd61280Ca46886",
-        tokenBridge: "0x430855B4D43b8AEB9D2B9869B74d58dda79C0dB2"
-      }
-    },
-    mainnet: {
-      name: "Blast",
-      chainId: 81457,
-      wormholeChainId: 36,
-      rpcUrl: "https://rpc.blast.io",
-      explorerUrl: "https://blastscan.io",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0xbebdb6C8ddC678FfA9f8748f85C815C556Dd8ac6",
-        tokenBridge: "0x24850c6f61C438823F01B7A3BF2B89B72174Fa9d"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // MANTLE
-  // ────────────────────────────────────────────────────────────────────────
-  mantle: {
-    displayName: "Mantle",
-    type: "evm",
-    canBeHub: false,
-    testnet: {
-      name: "Mantle Sepolia",
-      chainId: 5003,
-      wormholeChainId: 35,
-      rpcUrl: "https://rpc.sepolia.mantle.xyz",
-      explorerUrl: "https://sepolia.mantlescan.xyz",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0x376428e7f26D5867e69201b275553C45B09EE090",
-        tokenBridge: "0x75Bfa155a9D7A3714b0861c8a8aF0C4633c45b5D"
-      }
-    },
-    mainnet: {
-      name: "Mantle",
-      chainId: 5e3,
-      wormholeChainId: 35,
-      rpcUrl: "https://rpc.mantle.xyz",
-      explorerUrl: "https://mantlescan.xyz",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0xbebdb6C8ddC678FfA9f8748f85C815C556Dd8ac6",
-        tokenBridge: "0x24850c6f61C438823F01B7A3BF2B89B72174Fa9d"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // FANTOM
-  // ────────────────────────────────────────────────────────────────────────
-  fantom: {
-    displayName: "Fantom",
-    type: "evm",
-    canBeHub: false,
-    testnet: {
-      name: "Fantom Testnet",
-      chainId: 4002,
-      wormholeChainId: 10,
-      rpcUrl: "https://rpc.testnet.fantom.network",
-      explorerUrl: "https://testnet.ftmscan.com",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0x1BB3B4119b7BA9dfad76B0545fb3F531383c3bB7",
-        tokenBridge: "0x599CEa2204B4FaECd584Ab1F2b6aCA137a0afbE8"
-      }
-    },
-    mainnet: {
-      name: "Fantom",
-      chainId: 250,
-      wormholeChainId: 10,
-      rpcUrl: "https://rpcapi.fantom.network",
-      explorerUrl: "https://ftmscan.com",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0x126783A6Cb203a3E35344528B26ca3a0489a1485",
-        tokenBridge: "0x7C9Fc5741288cDFdD83CeB07f3ea7e22618D79D2"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // CELO
-  // ────────────────────────────────────────────────────────────────────────
-  celo: {
-    displayName: "Celo",
-    type: "evm",
-    canBeHub: false,
-    testnet: {
-      name: "Celo Alfajores",
-      chainId: 44787,
-      wormholeChainId: 14,
-      rpcUrl: "https://alfajores-forno.celo-testnet.org",
-      explorerUrl: "https://alfajores.celoscan.io",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0x88505117CA88e7dd2eC6EA1E13f0948db2D50D56",
-        tokenBridge: "0x05ca6037eC51F8b712eD2E6Fa72219FEaE74E153"
-      }
-    },
-    mainnet: {
-      name: "Celo",
-      chainId: 42220,
-      wormholeChainId: 14,
-      rpcUrl: "https://forno.celo.org",
-      explorerUrl: "https://celoscan.io",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0xa321448d90d4e5b0A732867c18eA198e75CAC48E",
-        tokenBridge: "0x796Dff6D74F3E27060B71255Fe517BFb23C93eed"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // MOONBEAM
-  // ────────────────────────────────────────────────────────────────────────
-  moonbeam: {
-    displayName: "Moonbeam",
-    type: "evm",
-    canBeHub: false,
-    testnet: {
-      name: "Moonbase Alpha",
-      chainId: 1287,
-      wormholeChainId: 16,
-      rpcUrl: "https://rpc.api.moonbase.moonbeam.network",
-      explorerUrl: "https://moonbase.moonscan.io",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0xa5B7D85a8f27dd7907dc8FdC21FA5657D5E2F901",
-        tokenBridge: "0xbc976D4b9D57E57c3cA52e1Fd136C45FF7955A96"
-      }
-    },
-    mainnet: {
-      name: "Moonbeam",
-      chainId: 1284,
-      wormholeChainId: 16,
-      rpcUrl: "https://rpc.api.moonbeam.network",
-      explorerUrl: "https://moonscan.io",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0xC8e2b0cD52Cf01b0Ce87d389Daa3d414d4cE29f3",
-        tokenBridge: "0xb1731c586ca89a23809861c6103F0b96B3F57D92"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // MONAD - High-Performance L1 with EIP-7951 P256 + Agent Gateway
-  // ────────────────────────────────────────────────────────────────────────
-  monad: {
-    displayName: "Monad",
-    type: "evm",
-    canBeHub: true,
-    // Has native P-256 precompile (EIP-7951)
-    testnet: {
-      name: "Monad Testnet",
-      chainId: 10143,
-      wormholeChainId: 10048,
-      rpcUrl: "https://testnet-rpc.monad.xyz",
-      explorerUrl: "https://testnet.monadvision.com",
-      isEvm: true,
-      contracts: {
-        vaultFactory: "0x50F2c37584823A6cc293bd0d7647D558d05CA4C1",
-        vaultImplementation: "0x53d4D3943d0E524836f0B1955AbB216449F538fF",
-        wormholeCoreBridge: "0xBB73cB66C26740F31d1FabDC6b7A46a038A300dd",
-        // Agent Gateway contracts
-        serviceDirectory: "0x2d20f29E1f5B24294B3F125B47f2a22a7012a35E"
-      },
-      hubChainId: 10004
-      // Base Sepolia
-    },
-    mainnet: {
-      name: "Monad",
-      chainId: 143,
-      wormholeChainId: 0,
-      // TBD
-      rpcUrl: "https://rpc.monad.xyz",
-      explorerUrl: "https://monadscan.com",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0x194B123c5E96B9b2E49763619985790Dc241CAC0",
-        tokenBridge: "0x0B2719cdA2F10595369e6673ceA3Ee2EDFa13BA7"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // SEI
-  // ────────────────────────────────────────────────────────────────────────
-  sei: {
-    displayName: "Sei",
-    type: "evm",
-    canBeHub: false,
-    testnet: {
-      name: "Sei Atlantic-2",
-      chainId: 1328,
-      wormholeChainId: 40,
-      rpcUrl: "https://evm-rpc-testnet.sei-apis.com",
-      explorerUrl: "https://seitrace.com/?chain=atlantic-2",
-      isEvm: true,
-      contracts: {
-        vaultFactory: "0x07F608AFf6d63b68029488b726d895c4Bb593038",
-        vaultImplementation: "0xD66153fccFB6731fB6c4944FbD607ba86A76a1f6",
-        wormholeCoreBridge: "0x0000000000000000000000000000000000000000"
-      }
-    },
-    mainnet: {
-      name: "Sei",
-      chainId: 1329,
-      wormholeChainId: 32,
-      rpcUrl: "https://evm-rpc.sei-apis.com",
-      explorerUrl: "https://seitrace.com",
-      isEvm: true,
-      contracts: {
-        wormholeCoreBridge: "0x0000000000000000000000000000000000000000"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // SOLANA
-  // ────────────────────────────────────────────────────────────────────────
-  solana: {
-    displayName: "Solana",
-    type: "solana",
-    canBeHub: false,
-    testnet: {
-      name: "Solana Devnet",
-      chainId: 0,
-      wormholeChainId: 1,
-      rpcUrl: "https://api.devnet.solana.com",
-      explorerUrl: "https://explorer.solana.com",
-      isEvm: false,
-      contracts: {
-        hub: "64ZZBdmGd1YT6Fok7PELvAdfoXyR4PHxHnRqHNqZHJ13",
-        wormholeCoreBridge: "3u8hJUVTA4jH1wYAyUur7FFZVQ8H635K3tSHHF4ssjQ5",
-        tokenBridge: "DZnkkTmCiFWfYTfT41X3Rd1kDgozqzxWaHqsw6W4x2oe"
-      }
-    },
-    mainnet: {
-      name: "Solana",
-      chainId: 0,
-      wormholeChainId: 1,
-      rpcUrl: "https://api.mainnet-beta.solana.com",
-      explorerUrl: "https://explorer.solana.com",
-      isEvm: false,
-      contracts: {
-        wormholeCoreBridge: "worm2ZoG2kUd4vFXhvjh93UUH596ayRfgQ2MgjNMTth",
-        tokenBridge: "wormDTUJ6AWPNvk59vGQbDvGJmqbDTdgWgAqcLBCgUb"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // APTOS
-  // ────────────────────────────────────────────────────────────────────────
-  aptos: {
-    displayName: "Aptos",
-    type: "aptos",
-    canBeHub: false,
-    testnet: {
-      name: "Aptos Testnet",
-      chainId: 0,
-      wormholeChainId: 22,
-      rpcUrl: "https://fullnode.testnet.aptoslabs.com/v1",
-      explorerUrl: "https://explorer.aptoslabs.com",
-      isEvm: false,
-      contracts: {
-        hub: "0x9e8641143245ab8b93af1417a1fbc698d40fd351a25f6c17e4210e59bf82c9c7",
-        wormholeCoreBridge: "0x5bc11445584a763c1fa7ed39081f1b920954da14e04b32440cba863d03e19625",
-        tokenBridge: "0x576410486a2da45eee6c949c995670112ddf2fbeedab20350d506328eefc9d4f"
-      }
-    },
-    mainnet: {
-      name: "Aptos",
-      chainId: 0,
-      wormholeChainId: 22,
-      rpcUrl: "https://fullnode.mainnet.aptoslabs.com/v1",
-      explorerUrl: "https://explorer.aptoslabs.com",
-      isEvm: false,
-      contracts: {
-        wormholeCoreBridge: "0x5bc11445584a763c1fa7ed39081f1b920954da14e04b32440cba863d03e19625",
-        tokenBridge: "0x576410486a2da45eee6c949c995670112ddf2fbeedab20350d506328eefc9d4f"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // SUI
-  // ────────────────────────────────────────────────────────────────────────
-  sui: {
-    displayName: "Sui",
-    type: "sui",
-    canBeHub: false,
-    testnet: {
-      name: "Sui Testnet",
-      chainId: 0,
-      wormholeChainId: 21,
-      rpcUrl: "https://fullnode.testnet.sui.io:443",
-      explorerUrl: "https://suiscan.xyz/testnet",
-      isEvm: false,
-      contracts: {
-        hub: "0xaf36d8bc349883b23e78b00a342a656c799319508600583eaee9121ffaa7f5f7",
-        wormholeCoreBridge: "0x31358d198147da50db32eda2562951d53973a0c0ad5ed738e9b17d88b213d790"
-      }
-    },
-    mainnet: {
-      name: "Sui",
-      chainId: 0,
-      wormholeChainId: 21,
-      rpcUrl: "https://fullnode.mainnet.sui.io:443",
-      explorerUrl: "https://suiscan.xyz/mainnet",
-      isEvm: false,
-      contracts: {
-        wormholeCoreBridge: "0xaeab97f96cf9877fee2883315d459552b2b921edc16d7ceac6eab944dd88919c"
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // STARKNET
-  // ────────────────────────────────────────────────────────────────────────
-  starknet: {
-    displayName: "Starknet",
-    type: "starknet",
-    canBeHub: false,
-    testnet: {
-      name: "Starknet Sepolia",
-      chainId: 0,
-      wormholeChainId: 50001,
-      // Custom bridge (non-Wormhole)
-      rpcUrl: "https://starknet-sepolia-rpc.publicnode.com",
-      explorerUrl: "https://sepolia.starkscan.co",
-      isEvm: false,
-      contracts: {
-        hub: "0x7bb7cbe7d82e910b296611b582035a207343431f98bdd7b692bddfdd6f28737",
-        wormholeCoreBridge: "0x30d2e7f26dc75819cfddcd7caa26a76b681d5918f219c99060c42ce1e3f69e4"
-      },
-      hubChainId: 10004
-      // Base Sepolia
-    },
-    mainnet: {
-      name: "Starknet",
-      chainId: 0,
-      wormholeChainId: 50001,
-      rpcUrl: "https://starknet-mainnet.public.blastapi.io/rpc/v0_7",
-      explorerUrl: "https://starkscan.co",
-      isEvm: false,
-      contracts: {
-        // TODO: Deploy mainnet contracts
-        wormholeCoreBridge: ""
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // STACKS
-  // ────────────────────────────────────────────────────────────────────────
-  stacks: {
-    displayName: "Stacks",
-    type: "stacks",
-    canBeHub: false,
-    testnet: {
-      name: "Stacks Testnet",
-      chainId: 2147483648,
-      // CAIP-2: stacks:2147483648
-      wormholeChainId: 60,
-      // Official Wormhole chain ID for Stacks
-      rpcUrl: "https://api.testnet.hiro.so",
-      explorerUrl: "https://explorer.hiro.so/?chain=testnet",
-      isEvm: false,
-      contracts: {
-        // Spoke contract: identity + session management
-        hub: "STWJ9E8J5NPKB4MT1378G6XWNFGAKRY1E6D6PYSM.veridex-spoke",
-        // Vault contract: STX/sBTC custody
-        vaultFactory: "STWJ9E8J5NPKB4MT1378G6XWNFGAKRY1E6D6PYSM.veridex-vault",
-        wormholeCoreBridge: "",
-        // Phase 2: Wormhole integration contracts
-        wormholeVerifier: "STWJ9E8J5NPKB4MT1378G6XWNFGAKRY1E6D6PYSM.veridex-wormhole-verifier",
-        vaultVaa: "STWJ9E8J5NPKB4MT1378G6XWNFGAKRY1E6D6PYSM.veridex-vault-vaa"
-      },
-      hubChainId: 10004
-      // Base Sepolia
-    },
-    mainnet: {
-      name: "Stacks",
-      chainId: 1,
-      // CAIP-2: stacks:1
-      wormholeChainId: 60,
-      rpcUrl: "https://api.hiro.so",
-      explorerUrl: "https://explorer.hiro.so",
-      isEvm: false,
-      contracts: {
-        // TODO: Deploy mainnet contracts
-        wormholeCoreBridge: ""
-      }
-    }
-  },
-  // ────────────────────────────────────────────────────────────────────────
-  // NEAR
-  // ────────────────────────────────────────────────────────────────────────
-  near: {
-    displayName: "Near",
-    type: "near",
-    canBeHub: false,
-    testnet: {
-      name: "Near Testnet",
-      chainId: 0,
-      wormholeChainId: 15,
-      rpcUrl: "https://rpc.testnet.near.org",
-      explorerUrl: "https://explorer.testnet.near.org",
-      isEvm: false,
-      contracts: {
-        wormholeCoreBridge: "wormhole.wormhole.testnet",
-        tokenBridge: "token.wormhole.testnet"
-      }
-    },
-    mainnet: {
-      name: "Near",
-      chainId: 0,
-      wormholeChainId: 15,
-      rpcUrl: "https://rpc.mainnet.near.org",
-      explorerUrl: "https://explorer.near.org",
-      isEvm: false,
-      contracts: {
-        wormholeCoreBridge: "contract.wormhole_crypto.near",
-        tokenBridge: "contract.portalbridge.near"
-      }
-    }
-  }
-};
-function getDefaultHub(network = "testnet") {
-  const primary = getEffectivePrimaryHub();
-  return CHAIN_PRESETS[primary][network];
+function buildGaslessChallenge(input) {
+  if (!Number.isInteger(input.targetChain) || input.targetChain < 0 || input.targetChain > 65535) {
+    throw new Error("targetChain must fit in uint16");
+  }
+  return buildCanonicalChallenge({
+    veridexChainId: input.veridexChainId,
+    executor: input.executor,
+    minTier: input.minTier,
+    nonce: input.nonce,
+    actionHash: import_ethers3.ethers.keccak256(input.actionPayload)
+  });
 }
 
 // src/auth/prepareAuth.ts
-function resolveNetwork2() {
-  const envCandidates = [
-    globalThis?.process?.env?.NEXT_PUBLIC_VERIDEX_NETWORK,
-    globalThis?.process?.env?.VERIDEX_NETWORK,
-    globalThis?.process?.env?.NEXT_PUBLIC_WORMHOLE_NETWORK,
-    globalThis?.process?.env?.WORMHOLE_NETWORK
-  ].filter(Boolean);
-  const env = envCandidates[0]?.toLowerCase();
-  if (env === "mainnet" || env === "testnet") return env;
-  return "testnet";
-}
-function getHubChainId(network) {
-  return getDefaultHub(network).wormholeChainId;
-}
-function getHubRpcUrl(network) {
-  return getDefaultHub(network).rpcUrl;
-}
-function getHubAddress(network) {
-  const hub = getDefaultHub(network).contracts.hub;
-  if (!hub) {
-    throw new Error("Hub address missing in SDK constants");
-  }
-  return hub;
-}
 function encodeActionPayload(action, targetChain) {
   if (action.token !== void 0 && action.recipient !== void 0) {
     const a2 = action;
@@ -2384,68 +1153,21 @@ function encodeActionPayload(action, targetChain) {
   const a = action;
   return encodeBridgeAction(a.token, a.amount, targetChain, a.recipient);
 }
-async function fetchNonceViaRpc(userKeyHash, network) {
-  const rpcUrl = getHubRpcUrl(network);
-  const hubAddress = getHubAddress(network);
-  const provider = new import_ethers5.ethers.JsonRpcProvider(rpcUrl);
-  const hubIface = new import_ethers5.ethers.Interface([
-    "function getNonce(bytes32 userKeyHash) external view returns (uint256)",
-    "function userNonces(bytes32 userKeyHash) external view returns (uint256)"
-  ]);
-  const calls = [
-    async () => {
-      const data = hubIface.encodeFunctionData("getNonce", [userKeyHash]);
-      const res = await provider.call({ to: hubAddress, data });
-      const decoded = hubIface.decodeFunctionResult("getNonce", res);
-      return decoded[0];
-    },
-    async () => {
-      const data = hubIface.encodeFunctionData("userNonces", [userKeyHash]);
-      const res = await provider.call({ to: hubAddress, data });
-      const decoded = hubIface.decodeFunctionResult("userNonces", res);
-      return decoded[0];
-    }
-  ];
-  let lastErr;
-  for (const fn of calls) {
-    try {
-      return await fn();
-    } catch (e) {
-      lastErr = e;
-    }
-  }
-  throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
-}
 function toHex32(value) {
   return "0x" + value.toString(16).padStart(64, "0");
 }
-async function authenticateAndPrepare(userParams, apiKey) {
-  const network = resolveNetwork2();
-  const hubChainId = getHubChainId(network);
+async function authenticateAndPrepare(userParams) {
   const actionPayload = userParams.actionPayload ?? (userParams.action ? encodeActionPayload(userParams.action, userParams.targetChain) : void 0);
   if (!actionPayload) {
     throw new Error("Missing action payload: provide either actionPayload or action");
   }
-  let nonce;
-  let queryProof = new Uint8Array();
-  let fallbackAvailable = true;
-  const queryStart = Date.now();
-  try {
-    if (!apiKey) {
-      throw new Error("Missing Query Proxy apiKey");
-    }
-    const state = await queryHubState(userParams.credential.keyHash, apiKey, { network, maxAge: 60 });
-    if (!state.isRegistered) {
-      throw new Error("Passkey is not registered on Hub");
-    }
-    nonce = state.nonce;
-    queryProof = state.proof;
-  } catch {
-    nonce = await fetchNonceViaRpc(userParams.credential.keyHash, network);
-    queryProof = new Uint8Array();
-  }
-  const queryLatencyMs = Date.now() - queryStart;
-  const challenge = buildGaslessChallenge(userParams.targetChain, actionPayload, nonce, hubChainId);
+  const nonce = userParams.nonce;
+  const queryProof = new Uint8Array();
+  const challenge = buildGaslessChallenge({
+    ...userParams.destination,
+    actionPayload,
+    nonce
+  });
   const passkey = new PasskeyManager();
   passkey.setCredential(userParams.credential);
   const signature = await passkey.sign(challenge);
@@ -2459,19 +1181,18 @@ async function authenticateAndPrepare(userParams, apiKey) {
     publicKeyX: toHex32(userParams.credential.publicKeyX),
     publicKeyY: toHex32(userParams.credential.publicKeyY),
     targetChain: userParams.targetChain,
+    veridexChainId: userParams.destination.veridexChainId,
+    executor: userParams.destination.executor,
+    minTier: userParams.destination.minTier,
     actionPayload,
-    nonce: Number(nonce)
+    nonce: nonce.toString()
   };
-  if (queryProof.length) {
-    requestBody.queryProof = import_ethers5.ethers.hexlify(queryProof);
-  }
   const serializedTx = new TextEncoder().encode(JSON.stringify(requestBody));
-  const estimatedLatency = queryProof.length ? Math.max(250, queryLatencyMs) : Math.max(800, queryLatencyMs);
   return {
     serializedTx,
     queryProof,
-    estimatedLatency,
-    fallbackAvailable
+    estimatedLatency: 0,
+    fallbackAvailable: false
   };
 }
 // Annotate the CommonJS export names for ESM import in node: