@tatchi-xyz/sdk 0.16.0 → 0.17.0

package/dist/esm/sdk/wallet-iframe-host.js

@@ -10,13 +10,13 @@ import { base64UrlDecode } from "./base64-DBPGuXh4.js";
 import { ActionType, init_actions, toActionArgsWasm, validateActionArgsWasm } from "./actions-O1FD5Bq8.js";
 import { ensureKnownW3aElement } from "./ensure-defined-CHInSx7l.js";
 import { base58Encode, errorMessage, esm_default, getNearShortErrorMessage, getUserFriendlyErrorMessage, init_base58, init_encoders, init_errors, init_esm, isTouchIdCancellationError, toError } from "./errors-D9ar28Dr.js";
-import { init_validation as init_validation$1, needsExplicitActivation, normalizeRegistrationCredential, removePrfOutputGuard, serializeRegistrationCredential, serializeRegistrationCredentialWithPRF, validateNearAccountId } from "./safari-fallbacks-oQKu9xUs.js";
-import { MinimalNearClient, SignedTransaction, isOffline, openOfflineExport } from "./overlay-BTqPGG-o.js";
+import { init_credentialsHelpers, init_utils, init_validation as init_validation$1, needsExplicitActivation, normalizeRegistrationCredential, removePrfOutputGuard, serializeRegistrationCredential, serializeRegistrationCredentialWithPRF, validateNearAccountId } from "./WebAuthnFallbacks-Bl4BTsNt.js";
+import { MinimalNearClient, SignedTransaction, isOffline, openOfflineExport } from "./overlay-ZGbucXIa.js";
 import { AccountRecoveryPhase, AccountRecoveryStatus, ActionPhase, ActionStatus, DEFAULT_WAIT_STATUS, DeviceLinkingPhase, DeviceLinkingStatus, EmailRecoveryPhase, EmailRecoveryStatus, LoginPhase, LoginStatus, RegistrationPhase, RegistrationStatus, init_rpc, init_sdkSentEvents } from "./sdkSentEvents-_jrJLIhw.js";
-import { SecureConfirmMessageType, SecureConfirmationType, TouchIdPrompt, authenticatorsToAllowCredentials, createRandomVRFChallenge, getIntentDigest, init_accountIds, parseTransactionSummary, sanitizeForPostMessage, sendConfirmResponse, toAccountId, validateVRFChallenge } from "./requestHelpers-DLBGBHMw.js";
-import { PASSKEY_MANAGER_DEFAULT_CONFIGS, buildConfigsFromEnv, init_defaultConfigs } from "./defaultConfigs-VzvDejmy.js";
-import { buildSetRecoveryEmailsActions, checkCanRegisterUserContractCall, executeDeviceLinkingContractCalls, getCredentialIdsContractCall, getDeviceLinkingAccountContractCall, getRecoveryEmailHashesContractCall, init_rpcCalls, syncAuthenticatorsContractCall, verifyAuthenticationResponse } from "./rpcCalls-CAU5XYEF.js";
-import { getLastLoggedInDeviceNumber, parseDeviceNumber } from "./getDeviceNumber-CfmlgfMX.js";
+import { SecureConfirmMessageType, SecureConfirmationType, TouchIdPrompt, authenticatorsToAllowCredentials, createRandomVRFChallenge, getIntentDigest, init_accountIds, init_touchIdPrompt, init_vrf_worker, parseTransactionSummary, sanitizeForPostMessage, sendConfirmResponse, toAccountId, validateVRFChallenge } from "./requestHelpers-Dh1hEYL9.js";
+import { PASSKEY_MANAGER_DEFAULT_CONFIGS, buildConfigsFromEnv, init_defaultConfigs } from "./defaultConfigs-DpslkAQd.js";
+import { buildSetRecoveryEmailsActions, checkCanRegisterUserContractCall, executeDeviceLinkingContractCalls, getCredentialIdsContractCall, getDeviceLinkingAccountContractCall, getRecoveryEmailHashesContractCall, init_rpcCalls, syncAuthenticatorsContractCall, verifyAuthenticationResponse } from "./rpcCalls-OhgEeFig.js";
+import { getLastLoggedInDeviceNumber, init_getDeviceNumber, parseDeviceNumber } from "./getDeviceNumber-zsOHT_Um.js";
 
 //#region src/core/sdkPaths/workers.ts
 /**
@@ -1417,22 +1417,17 @@ var init_passkeyClientDB = __esm({ "src/core/IndexedDBManager/passkeyClientDB.ts
 		* @returns filtered authenticators for allowCredentials, plus optional wrongPasskeyError
 		*/
 		async ensureCurrentPasskey(nearAccountId, authenticators, selectedCredentialRawId) {
-			let authenticatorsForPrompt = authenticators;
-			let wrongPasskeyError;
-			if (authenticators.length > 1) {
-				const accountIdNormalized = toAccountId(nearAccountId);
-				const lastUser = await this.getLastUser().catch(() => null);
-				const expectedAccountId = lastUser?.nearAccountId;
-				const expectedDeviceNumber = lastUser?.deviceNumber;
-				if (expectedAccountId && expectedDeviceNumber && expectedAccountId === accountIdNormalized) {
-					const filtered = authenticators.filter((a) => a.deviceNumber === expectedDeviceNumber);
-					if (filtered.length > 0) authenticatorsForPrompt = filtered;
-					if (selectedCredentialRawId) {
-						const matched = authenticators.find((a) => a.credentialId === selectedCredentialRawId);
-						if (matched && matched.deviceNumber !== expectedDeviceNumber) wrongPasskeyError = `You have multiple passkeys (deviceNumbers) for account ${accountIdNormalized}, but used a passkey from a different device. Please use the passkey for the most recently logged-in device.`;
-					}
-				}
-			}
+			if (authenticators.length <= 1) return { authenticatorsForPrompt: authenticators };
+			const accountIdNormalized = toAccountId(nearAccountId);
+			const lastUser = await this.getLastUser().catch(() => null);
+			if (!lastUser || lastUser.nearAccountId !== accountIdNormalized) return { authenticatorsForPrompt: authenticators };
+			const expectedDeviceNumber = lastUser.deviceNumber;
+			const byDeviceNumber = authenticators.filter((a) => a.deviceNumber === expectedDeviceNumber);
+			let expectedCredentialId = lastUser.passkeyCredential.rawId;
+			if (byDeviceNumber.length > 0 && !byDeviceNumber.some((a) => a.credentialId === expectedCredentialId)) expectedCredentialId = byDeviceNumber[0].credentialId;
+			const byCredentialId = authenticators.filter((a) => a.credentialId === expectedCredentialId);
+			const authenticatorsForPrompt = byCredentialId.length > 0 ? byCredentialId : byDeviceNumber.length > 0 ? byDeviceNumber : authenticators;
+			const wrongPasskeyError = selectedCredentialRawId && selectedCredentialRawId !== expectedCredentialId ? `You have multiple passkeys (deviceNumbers) for account ${accountIdNormalized}, but used a different passkey than the most recently logged-in one. Please use the passkey for the most recently logged-in device.` : void 0;
 			return {
 				authenticatorsForPrompt,
 				wrongPasskeyError
@@ -1543,30 +1538,34 @@ var init_passkeyClientDB = __esm({ "src/core/IndexedDBManager/passkeyClientDB.ts
 		* @param userData - User data with nearAccountId as primary identifier
 		*/
 		async storeWebAuthnUserData(userData) {
-			if (userData.deviceNumber === void 0) console.warn("WARNING: deviceNumber is undefined in storeWebAuthnUserData, will default to 1");
 			const validation = this.validateNearAccountId(userData.nearAccountId);
 			if (!validation.valid) throw new Error(`Cannot store WebAuthn data for invalid account ID: ${validation.error}`);
-			let existingUser = await this.getUser(userData.nearAccountId);
-			if (!existingUser) {
-				const deviceNumberToUse = userData.deviceNumber || 1;
-				existingUser = await this.registerUser({
-					nearAccountId: userData.nearAccountId,
-					deviceNumber: deviceNumberToUse,
-					clientNearPublicKey: userData.clientNearPublicKey,
-					passkeyCredential: userData.passkeyCredential,
-					encryptedVrfKeypair: userData.encryptedVrfKeypair,
-					version: userData.version || 2,
-					serverEncryptedVrfKeypair: userData.serverEncryptedVrfKeypair
-				});
-			}
-			const finalDeviceNumber = userData.deviceNumber || existingUser.deviceNumber;
-			await this.updateUser(userData.nearAccountId, {
+			const accountId = toAccountId(userData.nearAccountId);
+			const deviceNumber = userData.deviceNumber;
+			let user = await this.getUser(accountId, deviceNumber);
+			if (!user) user = await this.registerUser({
+				nearAccountId: accountId,
+				deviceNumber,
 				clientNearPublicKey: userData.clientNearPublicKey,
+				passkeyCredential: userData.passkeyCredential,
 				encryptedVrfKeypair: userData.encryptedVrfKeypair,
-				serverEncryptedVrfKeypair: userData.serverEncryptedVrfKeypair,
-				version: userData.version || existingUser.version,
-				deviceNumber: finalDeviceNumber,
-				lastUpdated: userData.lastUpdated || Date.now()
+				version: userData.version || 2,
+				serverEncryptedVrfKeypair: userData.serverEncryptedVrfKeypair
+			});
+			const updatedUser = {
+				...user,
+				clientNearPublicKey: userData.clientNearPublicKey,
+				passkeyCredential: userData.passkeyCredential,
+				encryptedVrfKeypair: userData.encryptedVrfKeypair,
+				serverEncryptedVrfKeypair: userData.serverEncryptedVrfKeypair ?? user.serverEncryptedVrfKeypair,
+				version: userData.version ?? user.version,
+				lastUpdated: userData.lastUpdated ?? Date.now()
+			};
+			await this.storeUser(updatedUser);
+			this.emitEvent({
+				type: "user-updated",
+				accountId,
+				data: { updatedUser }
 			});
 		}
 		async getAllUsers() {
@@ -2220,6 +2219,13 @@ const DEVICE_LINKING_CONFIG = {
 
 //#endregion
 //#region src/core/workerControlMessages.ts
+init_touchIdPrompt();
+init_credentialsHelpers();
+init_vrf_worker();
+init_utils();
+init_encoders();
+init_base58();
+init_esm();
 /**
 * Control messages exchanged between worker shims and the main thread.
 *
@@ -2375,11 +2381,9 @@ async function checkCanRegisterUser({ ctx, vrfChallenge, credential, contractId,
 
 //#endregion
 //#region src/core/types/authenticatorOptions.ts
+init_getDeviceNumber();
 init_sdkSentEvents();
 init_rpc();
-init_encoders();
-init_base58();
-init_esm();
 init_actions();
 init_wasm_signer_worker();
 /**
@@ -2500,6 +2504,7 @@ async function deriveNearKeypairAndEncryptFromSerialized({ ctx, credential, near
 //#region src/core/WebAuthnManager/SignerWorkerManager/handlers/decryptPrivateKeyWithPrf.ts
 init_signer_worker();
 init_accountIds();
+init_getDeviceNumber();
 init_validation();
 async function decryptPrivateKeyWithPrf({ ctx, nearAccountId, authenticators, sessionId }) {
 	try {
@@ -2567,6 +2572,7 @@ const generateSessionId = () => {
 init_signer_worker();
 init_defaultConfigs();
 init_accountIds();
+init_getDeviceNumber();
 init_validation();
 /**
 * Sign multiple transactions with shared VRF challenge and credential
@@ -2662,6 +2668,7 @@ async function signTransactionsWithActions$1({ ctx, transactions, rpcCall, onEve
 
 //#endregion
 //#region src/core/WebAuthnManager/SignerWorkerManager/handlers/validation.ts
+init_credentialsHelpers();
 init_validation();
 function validateTransactionContextMaybe(input) {
 	if (input == null) return void 0;
@@ -2737,6 +2744,7 @@ init_defaultConfigs();
 init_accountIds();
 init_actions();
 init_signer_worker();
+init_getDeviceNumber();
 async function signDelegateAction$1({ ctx, delegate, rpcCall, onEvent, confirmationConfigOverride, title, body, sessionId: providedSessionId }) {
 	const sessionId = providedSessionId ?? generateSessionId();
 	const nearAccountId = rpcCall.nearAccountId || delegate.senderId;
@@ -2938,6 +2946,7 @@ async function signTransactionWithKeyPair({ ctx, nearPrivateKey, signerAccountId
 //#endregion
 //#region src/core/WebAuthnManager/SignerWorkerManager/handlers/signNep413Message.ts
 init_signer_worker();
+init_getDeviceNumber();
 init_validation();
 /**
 * Sign a NEP-413 message using the user's passkey-derived private key
@@ -3112,6 +3121,7 @@ async function registerDevice2WithDerivedKey({ ctx, sessionId, nearAccountId, cr
 
 //#endregion
 //#region src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/determineConfirmationConfig.ts
+init_utils();
 /**
 * determineConfirmationConfig
 *
@@ -3261,42 +3271,42 @@ async function importFlow(label, loader) {
 }
 const HANDLERS = {
 	[SecureConfirmationType.DECRYPT_PRIVATE_KEY_WITH_PRF]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleLocalOnlyFlow } = await importFlow("localOnly", () => import("./localOnly-BdumO2st.js"));
+		const { handleLocalOnlyFlow } = await importFlow("localOnly", () => import("./localOnly-pXMTqh1m.js"));
 		await handleLocalOnlyFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.SHOW_SECURE_PRIVATE_KEY_UI]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleLocalOnlyFlow } = await importFlow("localOnly", () => import("./localOnly-BdumO2st.js"));
+		const { handleLocalOnlyFlow } = await importFlow("localOnly", () => import("./localOnly-pXMTqh1m.js"));
 		await handleLocalOnlyFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.REGISTER_ACCOUNT]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleRegistrationFlow } = await importFlow("registration", () => import("./registration-xyYUFRqk.js"));
+		const { handleRegistrationFlow } = await importFlow("registration", () => import("./registration-DLPLsGCz.js"));
 		await handleRegistrationFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.LINK_DEVICE]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleRegistrationFlow } = await importFlow("registration", () => import("./registration-xyYUFRqk.js"));
+		const { handleRegistrationFlow } = await importFlow("registration", () => import("./registration-DLPLsGCz.js"));
 		await handleRegistrationFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.SIGN_TRANSACTION]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleTransactionSigningFlow } = await importFlow("transactions", () => import("./transactions-CzZAt1Yn.js"));
+		const { handleTransactionSigningFlow } = await importFlow("transactions", () => import("./transactions-Bk-VavcV.js"));
 		await handleTransactionSigningFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.SIGN_NEP413_MESSAGE]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleTransactionSigningFlow } = await importFlow("transactions", () => import("./transactions-CzZAt1Yn.js"));
+		const { handleTransactionSigningFlow } = await importFlow("transactions", () => import("./transactions-Bk-VavcV.js"));
 		await handleTransactionSigningFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
@@ -3329,6 +3339,7 @@ async function runSecureConfirm(ctx, request) {
 init_validation();
 init_accountIds();
 init_signer_worker();
+init_getDeviceNumber();
 /**
 * Two-phase export (worker-driven):
 *  - Phase 1: collect PRF (uiMode: 'skip') and derive WrapKeySeed in VRF worker
@@ -4129,6 +4140,7 @@ async function createSigningSessionChannel(ctx, sessionId) {
 
 //#endregion
 //#region src/core/WebAuthnManager/VrfWorkerManager/handlers/deriveVrfKeypairFromPrf.ts
+init_vrf_worker();
 /**
 * Derive deterministic VRF keypair from PRF output embedded in a WebAuthn credential.
 */
@@ -4246,6 +4258,7 @@ async function dispenseSessionKey(ctx, args) {
 
 //#endregion
 //#region src/core/WebAuthnManager/VrfWorkerManager/handlers/generateVrfChallenge.ts
+init_vrf_worker();
 /**
 * Generate a VRF challenge and cache it under `sessionId` inside the VRF worker.
 *
@@ -4287,6 +4300,7 @@ async function generateVrfChallengeInternal(ctx, inputData, sessionId) {
 
 //#endregion
 //#region src/core/WebAuthnManager/VrfWorkerManager/handlers/generateVrfKeypairBootstrap.ts
+init_vrf_worker();
 /**
 * Registration bootstrap: generate a fresh random VRF keypair in the VRF worker and (optionally)
 * generate a VRF challenge from it.
@@ -5631,7 +5645,9 @@ function __isWalletIframeHostMode() {
 //#endregion
 //#region src/core/WebAuthnManager/index.ts
 init_IndexedDBManager();
+init_touchIdPrompt();
 init_accountIds();
+init_getDeviceNumber();
 /**
 * WebAuthnManager - Main orchestrator for WebAuthn operations
 *
@@ -6154,6 +6170,7 @@ var WebAuthnManager = class {
 	async storeUserData(userData) {
 		await IndexedDBManager.clientDB.storeWebAuthnUserData({
 			...userData,
+			deviceNumber: userData.deviceNumber ?? 1,
 			version: userData.version || 2
 		});
 	}
@@ -6209,10 +6226,12 @@ var WebAuthnManager = class {
 		return await IndexedDBManager.clientDB.registerUser(storeUserData);
 	}
 	async storeAuthenticator(authenticatorData) {
+		const deviceNumber = Number(authenticatorData.deviceNumber);
+		const normalizedDeviceNumber = Number.isSafeInteger(deviceNumber) && deviceNumber >= 1 ? deviceNumber : 1;
 		const authData = {
 			...authenticatorData,
 			nearAccountId: toAccountId(authenticatorData.nearAccountId),
-			deviceNumber: authenticatorData.deviceNumber || 1
+			deviceNumber: normalizedDeviceNumber
 		};
 		return await IndexedDBManager.clientDB.storeAuthenticator(authData);
 	}
@@ -6477,9 +6496,6 @@ var WebAuthnManager = class {
 
 //#endregion
 //#region src/core/TatchiPasskey/login.ts
-init_errors();
-init_IndexedDBManager();
-init_rpcCalls();
 /**
 * Core login function that handles passkey authentication without React dependencies.
 *
@@ -7027,9 +7043,17 @@ async function logoutAndClearSession(context) {
 		webAuthnManager.getNonceManager().clear();
 	} catch {}
 }
+var init_login = __esm({ "src/core/TatchiPasskey/login.ts": (() => {
+	init_errors();
+	init_vrf_worker();
+	init_touchIdPrompt();
+	init_IndexedDBManager();
+	init_rpcCalls();
+}) });
 
 //#endregion
 //#region src/core/TatchiPasskey/actions.ts
+init_login();
 init_actions();
 init_sdkSentEvents();
 init_errors();
@@ -7472,6 +7496,7 @@ async function wasmAuthenticateAndSignTransactions(context, nearAccountId, trans
 
 //#endregion
 //#region src/core/WebAuthnManager/userHandle.ts
+init_utils();
 init_validation$1();
 /**
 * Parse a WebAuthn userHandle into a NEAR account ID.
@@ -7506,6 +7531,7 @@ function parseAccountIdFromUserHandle(userHandle) {
 init_sdkSentEvents();
 init_validation$1();
 init_accountIds();
+init_vrf_worker();
 init_IndexedDBManager();
 init_rpcCalls();
 /**
@@ -7921,6 +7947,7 @@ async function restoreAuthenticators({ webAuthnManager, accountId, contractAuthe
 //#endregion
 //#region src/core/TatchiPasskey/faucets/createAccountRelayServer.ts
 init_sdkSentEvents();
+init_credentialsHelpers();
 init_validation();
 init_errors();
 /**
@@ -8881,6 +8908,7 @@ init_IndexedDBManager();
 init_actions();
 init_rpcCalls();
 init_sdkSentEvents();
+init_getDeviceNumber();
 async function generateQRCodeDataURL(data) {
 	const { default: QRCode } = await import("./browser-B3uuzKL0.js").then(__toDynamicImportESM(1));
 	return QRCode.toDataURL(data, {
@@ -9571,6 +9599,7 @@ var LinkDeviceFlow = class {
 //#endregion
 //#region src/core/TatchiPasskey/scanDevice.ts
 init_validation$1();
+init_login();
 init_sdkSentEvents();
 init_rpcCalls();
 /**
@@ -9909,11 +9938,18 @@ const EXPORT_NEAR_KEYPAIR_CANCELLED = "EXPORT_NEAR_KEYPAIR_CANCELLED";
 init_accountIds();
 init_IndexedDBManager();
 const canonicalizeEmail = (email) => {
-	let addr = email;
-	const angleStart = email.indexOf("<");
-	const angleEnd = email.indexOf(">");
-	if (angleStart !== -1 && angleEnd > angleStart) addr = email.slice(angleStart + 1, angleEnd);
-	return addr.trim().toLowerCase();
+	const raw = String(email || "").trim();
+	if (!raw) return "";
+	const withoutHeaderName = raw.replace(/^[a-z0-9-]+\s*:\s*/i, "").trim();
+	const emailRegex = /([a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*)/;
+	const angleMatch = withoutHeaderName.match(/<([^>]+)>/);
+	const candidates = [angleMatch?.[1], withoutHeaderName].filter((v) => typeof v === "string" && v.length > 0);
+	for (const candidate of candidates) {
+		const cleaned = candidate.replace(/^mailto:\s*/i, "");
+		const match = cleaned.match(emailRegex);
+		if (match?.[1]) return match[1].trim().toLowerCase();
+	}
+	return withoutHeaderName.toLowerCase();
 };
 const bytesToHex = (bytes) => {
 	const arr = bytes instanceof Uint8Array ? bytes : Uint8Array.from(bytes);
@@ -10007,6 +10043,10 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 	init_validation$1();
 	init_accountIds();
 	init_sdkSentEvents();
+	init_vrf_worker();
+	init_rpc();
+	init_getDeviceNumber();
+	init_login();
 	EmailRecoveryFlow = class {
 		context;
 		options;
@@ -10048,6 +10088,12 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 		getConfig() {
 			return getEmailRecoveryConfig(this.context.configs);
 		}
+		getPendingIndexKey(accountId) {
+			return `pendingEmailRecovery:${accountId}`;
+		}
+		getPendingRecordKey(accountId, nearPublicKey) {
+			return `${this.getPendingIndexKey(accountId)}:${nearPublicKey}`;
+		}
 		async checkVerificationStatus(rec) {
 			const { dkimVerifierAccountId, verificationViewMethod } = this.getConfig();
 			if (!dkimVerifierAccountId) return null;
@@ -10066,22 +10112,26 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 					return {
 						completed: true,
 						success: false,
-						errorMessage: errorMessage$1
+						errorMessage: errorMessage$1,
+						transactionHash: result.transaction_hash
 					};
 				}
 				if (result.account_id && result.account_id !== rec.accountId) return {
 					completed: true,
 					success: false,
-					errorMessage: "Email verification account_id does not match requested account."
+					errorMessage: "Email verification account_id does not match requested account.",
+					transactionHash: result.transaction_hash
 				};
 				if (result.new_public_key && result.new_public_key !== rec.nearPublicKey) return {
 					completed: true,
 					success: false,
-					errorMessage: "Email verification new_public_key does not match expected recovery key."
+					errorMessage: "Email verification new_public_key does not match expected recovery key.",
+					transactionHash: result.transaction_hash
 				};
 				return {
 					completed: true,
-					success: true
+					success: true,
+					transactionHash: result.transaction_hash
 				};
 			} catch (err$1) {
 				console.warn("[EmailRecoveryFlow] get_verification_result view failed; falling back to access key polling", err$1);
@@ -10090,25 +10140,37 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 		}
 		async loadPending(accountId, nearPublicKey) {
 			const { pendingTtlMs } = this.getConfig();
-			const keyPrefix = `pendingEmailRecovery:${accountId}`;
-			const key = nearPublicKey ? `${keyPrefix}:${nearPublicKey}` : keyPrefix;
-			const record = await IndexedDBManager.clientDB.getAppState(key);
-			if (!record) return null;
+			const indexKey = this.getPendingIndexKey(accountId);
+			const indexedNearPublicKey = await IndexedDBManager.clientDB.getAppState(indexKey);
+			const resolvedNearPublicKey = nearPublicKey ?? indexedNearPublicKey;
+			if (!resolvedNearPublicKey) return null;
+			const recordKey = this.getPendingRecordKey(accountId, resolvedNearPublicKey);
+			const record = await IndexedDBManager.clientDB.getAppState(recordKey);
+			const shouldClearIndex = indexedNearPublicKey === resolvedNearPublicKey;
+			if (!record) {
+				if (shouldClearIndex) await IndexedDBManager.clientDB.setAppState(indexKey, void 0).catch(() => {});
+				return null;
+			}
 			if (Date.now() - record.createdAt > pendingTtlMs) {
-				await IndexedDBManager.clientDB.setAppState(key, void 0);
+				await IndexedDBManager.clientDB.setAppState(recordKey, void 0).catch(() => {});
+				if (shouldClearIndex) await IndexedDBManager.clientDB.setAppState(indexKey, void 0).catch(() => {});
 				return null;
 			}
+			await IndexedDBManager.clientDB.setAppState(indexKey, record.nearPublicKey).catch(() => {});
 			return record;
 		}
 		async savePending(rec) {
-			const key = `pendingEmailRecovery:${rec.accountId}:${rec.nearPublicKey}`;
+			const key = this.getPendingRecordKey(rec.accountId, rec.nearPublicKey);
 			await IndexedDBManager.clientDB.setAppState(key, rec);
+			await IndexedDBManager.clientDB.setAppState(this.getPendingIndexKey(rec.accountId), rec.nearPublicKey).catch(() => {});
 			this.pending = rec;
 		}
 		async clearPending(accountId, nearPublicKey) {
-			const keyPrefix = `pendingEmailRecovery:${accountId}`;
-			const key = nearPublicKey ? `${keyPrefix}:${nearPublicKey}` : keyPrefix;
-			await IndexedDBManager.clientDB.setAppState(key, void 0);
+			const indexKey = this.getPendingIndexKey(accountId);
+			const idx = await IndexedDBManager.clientDB.getAppState(indexKey).catch(() => void 0);
+			const resolvedNearPublicKey = nearPublicKey || idx || "";
+			if (resolvedNearPublicKey) await IndexedDBManager.clientDB.setAppState(this.getPendingRecordKey(accountId, resolvedNearPublicKey), void 0).catch(() => {});
+			if (!nearPublicKey || idx === nearPublicKey) await IndexedDBManager.clientDB.setAppState(indexKey, void 0).catch(() => {});
 			if (this.pending && this.pending.accountId === accountId && (!nearPublicKey || this.pending.nearPublicKey === nearPublicKey)) this.pending = null;
 		}
 		getState() {
@@ -10213,7 +10275,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 			}
 			let deviceNumber = 1;
 			try {
-				const { syncAuthenticatorsContractCall: syncAuthenticatorsContractCall$1 } = await import("./rpcCalls-fLObBbbz.js");
+				const { syncAuthenticatorsContractCall: syncAuthenticatorsContractCall$1 } = await import("./rpcCalls-DEv9x5-f.js");
 				const authenticators = await syncAuthenticatorsContractCall$1(this.context.nearClient, this.context.configs.contractId, nearAccountId);
 				const numbers = authenticators.map((a) => a?.authenticator?.deviceNumber).filter((n) => typeof n === "number" && Number.isFinite(n));
 				const max = numbers.length > 0 ? Math.max(...numbers) : 0;
@@ -10229,7 +10291,10 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				message: "Collecting passkey for email recovery..."
 			});
 			try {
-				const confirmerText = this.options?.confirmerText;
+				const confirmerText = {
+					title: this.options?.confirmerText?.title ?? "Register New Recovery Account",
+					body: this.options?.confirmerText?.body ?? "Create a recovery account and send an encrypted email to recover your account."
+				};
 				const confirm = await this.context.webAuthnManager.requestRegistrationCredentialConfirmation({
 					nearAccountId,
 					deviceNumber,
@@ -10357,6 +10422,22 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				this.pollIntervalResolver = void 0;
 			}
 		}
+		/**
+		* Best-effort cancellation and local state reset so callers can retry.
+		* This does not remove any passkey created in the browser/OS (WebAuthn has no delete API),
+		* but it will stop polling and clear the pending IndexedDB record for the given key.
+		*/
+		async cancelAndReset(args) {
+			this.stopPolling();
+			const normalizedAccountId = (args?.accountId || this.pending?.accountId || "").toString().trim();
+			const nearPublicKey = (args?.nearPublicKey || this.pending?.nearPublicKey || "").toString().trim();
+			if (normalizedAccountId) try {
+				await this.clearPending(toAccountId(normalizedAccountId), nearPublicKey);
+			} catch {}
+			this.pending = null;
+			this.error = void 0;
+			this.phase = EmailRecoveryPhase.STEP_1_PREPARATION;
+		}
 		async finalize(args) {
 			const { accountId, nearPublicKey } = args;
 			this.cancelled = false;
@@ -10431,11 +10512,12 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 					step: 4,
 					phase: EmailRecoveryPhase.STEP_4_POLLING_VERIFICATION_RESULT,
 					status: EmailRecoveryStatus.PROGRESS,
-					message: completed && success ? `Recovery email verified for request ${rec.requestId}; finalizing registration...` : `Waiting for recovery email verification for request ${rec.requestId}...`,
+					message: completed && success ? `Email verified for request ${rec.requestId}; finalizing registration` : `Waiting for email verification for request ${rec.requestId}`,
 					data: {
 						accountId: rec.accountId,
 						requestId: rec.requestId,
 						nearPublicKey: rec.nearPublicKey,
+						transactionHash: verification?.transactionHash,
 						elapsedMs: elapsed,
 						pollCount
 					}
@@ -10452,6 +10534,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 					await this.savePending(rec);
 					return;
 				}
+				if (this.cancelled) break;
 				await new Promise((resolve) => {
 					this.pollIntervalResolver = resolve;
 					this.pollingTimer = setTimeout(() => {
@@ -10502,7 +10585,51 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				}
 				const signedTx = registrationResult.signedTransaction;
 				try {
-					await this.context.nearClient.sendTransaction(signedTx);
+					const txResult = await this.context.nearClient.sendTransaction(signedTx, DEFAULT_WAIT_STATUS.linkDeviceRegistration);
+					try {
+						const txHash = txResult?.transaction?.hash || txResult?.transaction_hash;
+						if (txHash) {
+							this.emit({
+								step: 5,
+								phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,
+								status: EmailRecoveryStatus.PROGRESS,
+								message: "Registration transaction confirmed",
+								data: {
+									accountId: rec.accountId,
+									nearPublicKey: rec.nearPublicKey,
+									transactionHash: txHash
+								}
+							});
+							try {
+								await IndexedDBManager.clientDB.storeWebAuthnUserData({
+									nearAccountId: accountId,
+									deviceNumber: rec.deviceNumber,
+									clientNearPublicKey: rec.nearPublicKey,
+									passkeyCredential: {
+										id: rec.credential.id,
+										rawId: rec.credential.rawId
+									},
+									encryptedVrfKeypair: rec.encryptedVrfKeypair,
+									serverEncryptedVrfKeypair: rec.serverEncryptedVrfKeypair || void 0
+								});
+								const { syncAuthenticatorsContractCall: syncAuthenticatorsContractCall$1 } = await import("./rpcCalls-DEv9x5-f.js");
+								const authenticators = await syncAuthenticatorsContractCall$1(this.context.nearClient, this.context.configs.contractId, accountId);
+								const mappedAuthenticators = authenticators.map(({ authenticator }) => ({
+									credentialId: authenticator.credentialId,
+									credentialPublicKey: authenticator.credentialPublicKey,
+									transports: authenticator.transports,
+									name: authenticator.name,
+									registered: authenticator.registered.toISOString(),
+									vrfPublicKey: authenticator.vrfPublicKeys?.[0] || "",
+									deviceNumber: authenticator.deviceNumber
+								}));
+								await IndexedDBManager.clientDB.syncAuthenticatorsFromContract(accountId, mappedAuthenticators);
+								await IndexedDBManager.clientDB.setLastUser(accountId, rec.deviceNumber);
+							} catch (syncErr) {
+								console.warn("[EmailRecoveryFlow] Failed to sync authenticators after recovery:", syncErr);
+							}
+						}
+					} catch {}
 				} catch (e) {
 					const msg = String(e?.message || "");
 					const err$1 = this.emitError(5, msg || "Failed to broadcast email recovery registration transaction (insufficient funds or RPC error)");
@@ -10576,6 +10703,8 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				});
 				const { webAuthnManager } = this.context;
 				const accountId = toAccountId(rec.accountId);
+				const deviceNumber = parseDeviceNumber(rec.deviceNumber, { min: 1 });
+				if (deviceNumber === null) throw new Error(`Invalid deviceNumber for auto-login: ${String(rec.deviceNumber)}`);
 				if (rec.serverEncryptedVrfKeypair && rec.serverEncryptedVrfKeypair.serverKeyId && this.context.configs.vrfWorkerConfigs?.shamir3pass?.relayServerUrl) try {
 					const unlockResult = await webAuthnManager.shamir3PassDecryptVrfKeypair({
 						nearAccountId: accountId,
@@ -10584,8 +10713,14 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 						serverKeyId: rec.serverEncryptedVrfKeypair.serverKeyId
 					});
 					if (unlockResult.success) {
+						const vrfStatus$1 = await webAuthnManager.checkVrfStatus();
+						const vrfActiveForAccount$1 = vrfStatus$1.active && vrfStatus$1.nearAccountId && String(vrfStatus$1.nearAccountId) === String(accountId);
+						if (!vrfActiveForAccount$1) throw new Error("VRF session inactive after Shamir3Pass unlock");
+						await webAuthnManager.setLastUser(accountId, deviceNumber);
 						await webAuthnManager.initializeCurrentUser(accountId, this.context.nearClient);
-						await webAuthnManager.setLastUser(accountId, rec.deviceNumber);
+						try {
+							await getLoginSession(this.context, accountId);
+						} catch {}
 						this.emit({
 							step: 5,
 							phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,
@@ -10598,27 +10733,30 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				} catch (err$1) {
 					console.warn("[EmailRecoveryFlow] Shamir 3-pass unlock failed, falling back to TouchID", err$1);
 				}
-				const { txBlockHash, txBlockHeight } = await webAuthnManager.getNonceManager().getNonceBlockHashAndHeight(this.context.nearClient);
-				const authChallenge = await webAuthnManager.generateVrfChallengeOnce({
-					userId: accountId,
-					rpId: webAuthnManager.getRpId(),
-					blockHash: txBlockHash,
-					blockHeight: txBlockHeight
-				});
-				const authenticators = await webAuthnManager.getAuthenticatorsByUser(accountId);
+				const authChallenge = createRandomVRFChallenge();
+				const storedCredentialId = String(rec.credential?.rawId || rec.credential?.id || "").trim();
+				const credentialIds = storedCredentialId ? [storedCredentialId] : [];
+				const authenticators = credentialIds.length > 0 ? [] : await webAuthnManager.getAuthenticatorsByUser(accountId);
 				const authCredential = await webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({
 					nearAccountId: accountId,
 					challenge: authChallenge,
-					credentialIds: authenticators.map((a) => a.credentialId)
+					credentialIds: credentialIds.length > 0 ? credentialIds : authenticators.map((a) => a.credentialId)
 				});
+				if (storedCredentialId && authCredential.rawId !== storedCredentialId) throw new Error("Wrong passkey selected during recovery auto-login; please use the newly recovered passkey.");
 				const vrfUnlockResult = await webAuthnManager.unlockVRFKeypair({
 					nearAccountId: accountId,
 					encryptedVrfKeypair: rec.encryptedVrfKeypair,
 					credential: authCredential
 				});
 				if (!vrfUnlockResult.success) throw new Error(vrfUnlockResult.error || "VRF unlock failed during auto-login");
+				const vrfStatus = await webAuthnManager.checkVrfStatus();
+				const vrfActiveForAccount = vrfStatus.active && vrfStatus.nearAccountId && String(vrfStatus.nearAccountId) === String(accountId);
+				if (!vrfActiveForAccount) throw new Error("VRF session inactive after TouchID unlock");
+				await webAuthnManager.setLastUser(accountId, deviceNumber);
 				await webAuthnManager.initializeCurrentUser(accountId, this.context.nearClient);
-				await webAuthnManager.setLastUser(accountId, rec.deviceNumber);
+				try {
+					await getLoginSession(this.context, accountId);
+				} catch {}
 				this.emit({
 					step: 5,
 					phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,
@@ -10628,6 +10766,9 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				});
 			} catch (err$1) {
 				console.warn("[EmailRecoveryFlow] Auto-login failed after recovery", err$1);
+				try {
+					await this.context.webAuthnManager.clearVrfSession();
+				} catch {}
 				this.emit({
 					step: 5,
 					phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,
@@ -10645,6 +10786,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 
 //#endregion
 //#region src/core/TatchiPasskey/index.ts
+init_login();
 init_sdkSentEvents();
 init_accountIds();
 init_IndexedDBManager();
@@ -10707,7 +10849,7 @@ var TatchiPasskey = class {
 		} catch {}
 		if (!this.iframeRouter) {
 			if (!this.walletIframeInitInFlight) this.walletIframeInitInFlight = (async () => {
-				const { WalletIframeRouter } = await import("./router-BG6KC_p7.js");
+				const { WalletIframeRouter } = await import("./router-BLFegW7J.js");
 				this.iframeRouter = new WalletIframeRouter({
 					walletOrigin,
 					servicePath: walletIframeConfig?.walletServicePath || "/wallet-service",
@@ -11795,6 +11937,30 @@ var TatchiPasskey = class {
 		});
 	}
 	/**
+	* Best-effort cancellation for an in-flight email recovery flow.
+	* Intended for UI "user cancelled sending email" / retry UX.
+	*/
+	async cancelEmailRecovery(args) {
+		const { accountId, nearPublicKey } = args || {};
+		if (this.shouldUseWalletIframe()) {
+			try {
+				const router = await this.requireWalletIframeRouter();
+				await router.stopEmailRecovery({
+					accountId,
+					nearPublicKey
+				});
+			} catch {}
+			return;
+		}
+		try {
+			await this.activeEmailRecoveryFlow?.cancelAndReset({
+				accountId,
+				nearPublicKey
+			});
+		} catch {}
+		this.activeEmailRecoveryFlow = null;
+	}
+	/**
 	* Device2: Start device linking flow
 	* Returns QR payload and data URL to render; emits onEvent during the flow.
 	* Runs inside iframe when available for better isolation.
@@ -12462,6 +12628,22 @@ function createWalletIframeHandlers(deps) {
 				requestId: req.requestId,
 				payload: { ok: true }
 			});
+		},
+		PM_STOP_EMAIL_RECOVERY: async (req) => {
+			const pm = getTatchiPasskey$1();
+			const { accountId, nearPublicKey } = req.payload || {};
+			try {
+				const maybeCancel = pm.cancelEmailRecovery;
+				if (typeof maybeCancel === "function") await maybeCancel.call(pm, {
+					accountId,
+					nearPublicKey
+				});
+			} catch {}
+			post$1({
+				type: "PM_RESULT",
+				requestId: req.requestId,
+				payload: { ok: true }
+			});
 		}
 	};
 }