@tatchi-xyz/sdk 0.16.0 → 0.18.0

package/dist/esm/sdk/wallet-iframe-host.js

@@ -10,13 +10,13 @@ import { base64UrlDecode } from "./base64-DBPGuXh4.js";
 import { ActionType, init_actions, toActionArgsWasm, validateActionArgsWasm } from "./actions-O1FD5Bq8.js";
 import { ensureKnownW3aElement } from "./ensure-defined-CHInSx7l.js";
 import { base58Encode, errorMessage, esm_default, getNearShortErrorMessage, getUserFriendlyErrorMessage, init_base58, init_encoders, init_errors, init_esm, isTouchIdCancellationError, toError } from "./errors-D9ar28Dr.js";
-import { init_validation as init_validation$1, needsExplicitActivation, normalizeRegistrationCredential, removePrfOutputGuard, serializeRegistrationCredential, serializeRegistrationCredentialWithPRF, validateNearAccountId } from "./safari-fallbacks-oQKu9xUs.js";
-import { MinimalNearClient, SignedTransaction, isOffline, openOfflineExport } from "./overlay-BTqPGG-o.js";
+import { init_credentialsHelpers, init_utils, init_validation as init_validation$1, needsExplicitActivation, normalizeRegistrationCredential, removePrfOutputGuard, serializeRegistrationCredential, serializeRegistrationCredentialWithPRF, validateNearAccountId } from "./WebAuthnFallbacks-Bl4BTsNt.js";
+import { MinimalNearClient, SignedTransaction, isOffline, openOfflineExport } from "./overlay-ZGbucXIa.js";
 import { AccountRecoveryPhase, AccountRecoveryStatus, ActionPhase, ActionStatus, DEFAULT_WAIT_STATUS, DeviceLinkingPhase, DeviceLinkingStatus, EmailRecoveryPhase, EmailRecoveryStatus, LoginPhase, LoginStatus, RegistrationPhase, RegistrationStatus, init_rpc, init_sdkSentEvents } from "./sdkSentEvents-_jrJLIhw.js";
-import { SecureConfirmMessageType, SecureConfirmationType, TouchIdPrompt, authenticatorsToAllowCredentials, createRandomVRFChallenge, getIntentDigest, init_accountIds, parseTransactionSummary, sanitizeForPostMessage, sendConfirmResponse, toAccountId, validateVRFChallenge } from "./requestHelpers-DLBGBHMw.js";
-import { PASSKEY_MANAGER_DEFAULT_CONFIGS, buildConfigsFromEnv, init_defaultConfigs } from "./defaultConfigs-VzvDejmy.js";
-import { buildSetRecoveryEmailsActions, checkCanRegisterUserContractCall, executeDeviceLinkingContractCalls, getCredentialIdsContractCall, getDeviceLinkingAccountContractCall, getRecoveryEmailHashesContractCall, init_rpcCalls, syncAuthenticatorsContractCall, verifyAuthenticationResponse } from "./rpcCalls-CAU5XYEF.js";
-import { getLastLoggedInDeviceNumber, parseDeviceNumber } from "./getDeviceNumber-CfmlgfMX.js";
+import { SecureConfirmMessageType, SecureConfirmationType, TouchIdPrompt, authenticatorsToAllowCredentials, createRandomVRFChallenge, getIntentDigest, init_accountIds, init_touchIdPrompt, init_vrf_worker, parseTransactionSummary, sanitizeForPostMessage, sendConfirmResponse, toAccountId, validateVRFChallenge } from "./requestHelpers-Dh1hEYL9.js";
+import { PASSKEY_MANAGER_DEFAULT_CONFIGS, buildConfigsFromEnv, init_defaultConfigs } from "./defaultConfigs-DpslkAQd.js";
+import { buildSetRecoveryEmailsActions, checkCanRegisterUserContractCall, executeDeviceLinkingContractCalls, getCredentialIdsContractCall, getDeviceLinkingAccountContractCall, getRecoveryEmailHashesContractCall, init_rpcCalls, syncAuthenticatorsContractCall, verifyAuthenticationResponse } from "./rpcCalls-YVeUVMk2.js";
+import { getLastLoggedInDeviceNumber, init_getDeviceNumber, parseDeviceNumber } from "./getDeviceNumber-zsOHT_Um.js";
 
 //#region src/core/sdkPaths/workers.ts
 /**
@@ -1417,22 +1417,17 @@ var init_passkeyClientDB = __esm({ "src/core/IndexedDBManager/passkeyClientDB.ts
 		* @returns filtered authenticators for allowCredentials, plus optional wrongPasskeyError
 		*/
 		async ensureCurrentPasskey(nearAccountId, authenticators, selectedCredentialRawId) {
-			let authenticatorsForPrompt = authenticators;
-			let wrongPasskeyError;
-			if (authenticators.length > 1) {
-				const accountIdNormalized = toAccountId(nearAccountId);
-				const lastUser = await this.getLastUser().catch(() => null);
-				const expectedAccountId = lastUser?.nearAccountId;
-				const expectedDeviceNumber = lastUser?.deviceNumber;
-				if (expectedAccountId && expectedDeviceNumber && expectedAccountId === accountIdNormalized) {
-					const filtered = authenticators.filter((a) => a.deviceNumber === expectedDeviceNumber);
-					if (filtered.length > 0) authenticatorsForPrompt = filtered;
-					if (selectedCredentialRawId) {
-						const matched = authenticators.find((a) => a.credentialId === selectedCredentialRawId);
-						if (matched && matched.deviceNumber !== expectedDeviceNumber) wrongPasskeyError = `You have multiple passkeys (deviceNumbers) for account ${accountIdNormalized}, but used a passkey from a different device. Please use the passkey for the most recently logged-in device.`;
-					}
-				}
-			}
+			if (authenticators.length <= 1) return { authenticatorsForPrompt: authenticators };
+			const accountIdNormalized = toAccountId(nearAccountId);
+			const lastUser = await this.getLastUser().catch(() => null);
+			if (!lastUser || lastUser.nearAccountId !== accountIdNormalized) return { authenticatorsForPrompt: authenticators };
+			const expectedDeviceNumber = lastUser.deviceNumber;
+			const byDeviceNumber = authenticators.filter((a) => a.deviceNumber === expectedDeviceNumber);
+			let expectedCredentialId = lastUser.passkeyCredential.rawId;
+			if (byDeviceNumber.length > 0 && !byDeviceNumber.some((a) => a.credentialId === expectedCredentialId)) expectedCredentialId = byDeviceNumber[0].credentialId;
+			const byCredentialId = authenticators.filter((a) => a.credentialId === expectedCredentialId);
+			const authenticatorsForPrompt = byCredentialId.length > 0 ? byCredentialId : byDeviceNumber.length > 0 ? byDeviceNumber : authenticators;
+			const wrongPasskeyError = selectedCredentialRawId && selectedCredentialRawId !== expectedCredentialId ? `You have multiple passkeys (deviceNumbers) for account ${accountIdNormalized}, but used a different passkey than the most recently logged-in one. Please use the passkey for the most recently logged-in device.` : void 0;
 			return {
 				authenticatorsForPrompt,
 				wrongPasskeyError
@@ -1543,30 +1538,34 @@ var init_passkeyClientDB = __esm({ "src/core/IndexedDBManager/passkeyClientDB.ts
 		* @param userData - User data with nearAccountId as primary identifier
 		*/
 		async storeWebAuthnUserData(userData) {
-			if (userData.deviceNumber === void 0) console.warn("WARNING: deviceNumber is undefined in storeWebAuthnUserData, will default to 1");
 			const validation = this.validateNearAccountId(userData.nearAccountId);
 			if (!validation.valid) throw new Error(`Cannot store WebAuthn data for invalid account ID: ${validation.error}`);
-			let existingUser = await this.getUser(userData.nearAccountId);
-			if (!existingUser) {
-				const deviceNumberToUse = userData.deviceNumber || 1;
-				existingUser = await this.registerUser({
-					nearAccountId: userData.nearAccountId,
-					deviceNumber: deviceNumberToUse,
-					clientNearPublicKey: userData.clientNearPublicKey,
-					passkeyCredential: userData.passkeyCredential,
-					encryptedVrfKeypair: userData.encryptedVrfKeypair,
-					version: userData.version || 2,
-					serverEncryptedVrfKeypair: userData.serverEncryptedVrfKeypair
-				});
-			}
-			const finalDeviceNumber = userData.deviceNumber || existingUser.deviceNumber;
-			await this.updateUser(userData.nearAccountId, {
+			const accountId = toAccountId(userData.nearAccountId);
+			const deviceNumber = userData.deviceNumber;
+			let user = await this.getUser(accountId, deviceNumber);
+			if (!user) user = await this.registerUser({
+				nearAccountId: accountId,
+				deviceNumber,
 				clientNearPublicKey: userData.clientNearPublicKey,
+				passkeyCredential: userData.passkeyCredential,
 				encryptedVrfKeypair: userData.encryptedVrfKeypair,
-				serverEncryptedVrfKeypair: userData.serverEncryptedVrfKeypair,
-				version: userData.version || existingUser.version,
-				deviceNumber: finalDeviceNumber,
-				lastUpdated: userData.lastUpdated || Date.now()
+				version: userData.version || 2,
+				serverEncryptedVrfKeypair: userData.serverEncryptedVrfKeypair
+			});
+			const updatedUser = {
+				...user,
+				clientNearPublicKey: userData.clientNearPublicKey,
+				passkeyCredential: userData.passkeyCredential,
+				encryptedVrfKeypair: userData.encryptedVrfKeypair,
+				serverEncryptedVrfKeypair: userData.serverEncryptedVrfKeypair ?? user.serverEncryptedVrfKeypair,
+				version: userData.version ?? user.version,
+				lastUpdated: userData.lastUpdated ?? Date.now()
+			};
+			await this.storeUser(updatedUser);
+			this.emitEvent({
+				type: "user-updated",
+				accountId,
+				data: { updatedUser }
 			});
 		}
 		async getAllUsers() {
@@ -2220,6 +2219,13 @@ const DEVICE_LINKING_CONFIG = {
 
 //#endregion
 //#region src/core/workerControlMessages.ts
+init_touchIdPrompt();
+init_credentialsHelpers();
+init_vrf_worker();
+init_utils();
+init_encoders();
+init_base58();
+init_esm();
 /**
 * Control messages exchanged between worker shims and the main thread.
 *
@@ -2375,11 +2381,9 @@ async function checkCanRegisterUser({ ctx, vrfChallenge, credential, contractId,
 
 //#endregion
 //#region src/core/types/authenticatorOptions.ts
+init_getDeviceNumber();
 init_sdkSentEvents();
 init_rpc();
-init_encoders();
-init_base58();
-init_esm();
 init_actions();
 init_wasm_signer_worker();
 /**
@@ -2500,6 +2504,7 @@ async function deriveNearKeypairAndEncryptFromSerialized({ ctx, credential, near
 //#region src/core/WebAuthnManager/SignerWorkerManager/handlers/decryptPrivateKeyWithPrf.ts
 init_signer_worker();
 init_accountIds();
+init_getDeviceNumber();
 init_validation();
 async function decryptPrivateKeyWithPrf({ ctx, nearAccountId, authenticators, sessionId }) {
 	try {
@@ -2567,6 +2572,7 @@ const generateSessionId = () => {
 init_signer_worker();
 init_defaultConfigs();
 init_accountIds();
+init_getDeviceNumber();
 init_validation();
 /**
 * Sign multiple transactions with shared VRF challenge and credential
@@ -2662,6 +2668,7 @@ async function signTransactionsWithActions$1({ ctx, transactions, rpcCall, onEve
 
 //#endregion
 //#region src/core/WebAuthnManager/SignerWorkerManager/handlers/validation.ts
+init_credentialsHelpers();
 init_validation();
 function validateTransactionContextMaybe(input) {
 	if (input == null) return void 0;
@@ -2737,6 +2744,7 @@ init_defaultConfigs();
 init_accountIds();
 init_actions();
 init_signer_worker();
+init_getDeviceNumber();
 async function signDelegateAction$1({ ctx, delegate, rpcCall, onEvent, confirmationConfigOverride, title, body, sessionId: providedSessionId }) {
 	const sessionId = providedSessionId ?? generateSessionId();
 	const nearAccountId = rpcCall.nearAccountId || delegate.senderId;
@@ -2938,6 +2946,7 @@ async function signTransactionWithKeyPair({ ctx, nearPrivateKey, signerAccountId
 //#endregion
 //#region src/core/WebAuthnManager/SignerWorkerManager/handlers/signNep413Message.ts
 init_signer_worker();
+init_getDeviceNumber();
 init_validation();
 /**
 * Sign a NEP-413 message using the user's passkey-derived private key
@@ -3112,6 +3121,7 @@ async function registerDevice2WithDerivedKey({ ctx, sessionId, nearAccountId, cr
 
 //#endregion
 //#region src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/determineConfirmationConfig.ts
+init_utils();
 /**
 * determineConfirmationConfig
 *
@@ -3261,42 +3271,42 @@ async function importFlow(label, loader) {
 }
 const HANDLERS = {
 	[SecureConfirmationType.DECRYPT_PRIVATE_KEY_WITH_PRF]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleLocalOnlyFlow } = await importFlow("localOnly", () => import("./localOnly-BdumO2st.js"));
+		const { handleLocalOnlyFlow } = await importFlow("localOnly", () => import("./localOnly-pXMTqh1m.js"));
 		await handleLocalOnlyFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.SHOW_SECURE_PRIVATE_KEY_UI]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleLocalOnlyFlow } = await importFlow("localOnly", () => import("./localOnly-BdumO2st.js"));
+		const { handleLocalOnlyFlow } = await importFlow("localOnly", () => import("./localOnly-pXMTqh1m.js"));
 		await handleLocalOnlyFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.REGISTER_ACCOUNT]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleRegistrationFlow } = await importFlow("registration", () => import("./registration-xyYUFRqk.js"));
+		const { handleRegistrationFlow } = await importFlow("registration", () => import("./registration-DLPLsGCz.js"));
 		await handleRegistrationFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.LINK_DEVICE]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleRegistrationFlow } = await importFlow("registration", () => import("./registration-xyYUFRqk.js"));
+		const { handleRegistrationFlow } = await importFlow("registration", () => import("./registration-DLPLsGCz.js"));
 		await handleRegistrationFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.SIGN_TRANSACTION]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleTransactionSigningFlow } = await importFlow("transactions", () => import("./transactions-CzZAt1Yn.js"));
+		const { handleTransactionSigningFlow } = await importFlow("transactions", () => import("./transactions-Bk-VavcV.js"));
 		await handleTransactionSigningFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.SIGN_NEP413_MESSAGE]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleTransactionSigningFlow } = await importFlow("transactions", () => import("./transactions-CzZAt1Yn.js"));
+		const { handleTransactionSigningFlow } = await importFlow("transactions", () => import("./transactions-Bk-VavcV.js"));
 		await handleTransactionSigningFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
@@ -3329,6 +3339,7 @@ async function runSecureConfirm(ctx, request) {
 init_validation();
 init_accountIds();
 init_signer_worker();
+init_getDeviceNumber();
 /**
 * Two-phase export (worker-driven):
 *  - Phase 1: collect PRF (uiMode: 'skip') and derive WrapKeySeed in VRF worker
@@ -4129,6 +4140,7 @@ async function createSigningSessionChannel(ctx, sessionId) {
 
 //#endregion
 //#region src/core/WebAuthnManager/VrfWorkerManager/handlers/deriveVrfKeypairFromPrf.ts
+init_vrf_worker();
 /**
 * Derive deterministic VRF keypair from PRF output embedded in a WebAuthn credential.
 */
@@ -4246,6 +4258,7 @@ async function dispenseSessionKey(ctx, args) {
 
 //#endregion
 //#region src/core/WebAuthnManager/VrfWorkerManager/handlers/generateVrfChallenge.ts
+init_vrf_worker();
 /**
 * Generate a VRF challenge and cache it under `sessionId` inside the VRF worker.
 *
@@ -4287,6 +4300,7 @@ async function generateVrfChallengeInternal(ctx, inputData, sessionId) {
 
 //#endregion
 //#region src/core/WebAuthnManager/VrfWorkerManager/handlers/generateVrfKeypairBootstrap.ts
+init_vrf_worker();
 /**
 * Registration bootstrap: generate a fresh random VRF keypair in the VRF worker and (optionally)
 * generate a VRF challenge from it.
@@ -5631,7 +5645,9 @@ function __isWalletIframeHostMode() {
 //#endregion
 //#region src/core/WebAuthnManager/index.ts
 init_IndexedDBManager();
+init_touchIdPrompt();
 init_accountIds();
+init_getDeviceNumber();
 /**
 * WebAuthnManager - Main orchestrator for WebAuthn operations
 *
@@ -6154,6 +6170,7 @@ var WebAuthnManager = class {
 	async storeUserData(userData) {
 		await IndexedDBManager.clientDB.storeWebAuthnUserData({
 			...userData,
+			deviceNumber: userData.deviceNumber ?? 1,
 			version: userData.version || 2
 		});
 	}
@@ -6209,10 +6226,12 @@ var WebAuthnManager = class {
 		return await IndexedDBManager.clientDB.registerUser(storeUserData);
 	}
 	async storeAuthenticator(authenticatorData) {
+		const deviceNumber = Number(authenticatorData.deviceNumber);
+		const normalizedDeviceNumber = Number.isSafeInteger(deviceNumber) && deviceNumber >= 1 ? deviceNumber : 1;
 		const authData = {
 			...authenticatorData,
 			nearAccountId: toAccountId(authenticatorData.nearAccountId),
-			deviceNumber: authenticatorData.deviceNumber || 1
+			deviceNumber: normalizedDeviceNumber
 		};
 		return await IndexedDBManager.clientDB.storeAuthenticator(authData);
 	}
@@ -6477,9 +6496,6 @@ var WebAuthnManager = class {
 
 //#endregion
 //#region src/core/TatchiPasskey/login.ts
-init_errors();
-init_IndexedDBManager();
-init_rpcCalls();
 /**
 * Core login function that handles passkey authentication without React dependencies.
 *
@@ -7027,9 +7043,17 @@ async function logoutAndClearSession(context) {
 		webAuthnManager.getNonceManager().clear();
 	} catch {}
 }
+var init_login = __esm({ "src/core/TatchiPasskey/login.ts": (() => {
+	init_errors();
+	init_vrf_worker();
+	init_touchIdPrompt();
+	init_IndexedDBManager();
+	init_rpcCalls();
+}) });
 
 //#endregion
 //#region src/core/TatchiPasskey/actions.ts
+init_login();
 init_actions();
 init_sdkSentEvents();
 init_errors();
@@ -7472,6 +7496,7 @@ async function wasmAuthenticateAndSignTransactions(context, nearAccountId, trans
 
 //#endregion
 //#region src/core/WebAuthnManager/userHandle.ts
+init_utils();
 init_validation$1();
 /**
 * Parse a WebAuthn userHandle into a NEAR account ID.
@@ -7506,6 +7531,7 @@ function parseAccountIdFromUserHandle(userHandle) {
 init_sdkSentEvents();
 init_validation$1();
 init_accountIds();
+init_vrf_worker();
 init_IndexedDBManager();
 init_rpcCalls();
 /**
@@ -7921,6 +7947,7 @@ async function restoreAuthenticators({ webAuthnManager, accountId, contractAuthe
 //#endregion
 //#region src/core/TatchiPasskey/faucets/createAccountRelayServer.ts
 init_sdkSentEvents();
+init_credentialsHelpers();
 init_validation();
 init_errors();
 /**
@@ -8881,6 +8908,7 @@ init_IndexedDBManager();
 init_actions();
 init_rpcCalls();
 init_sdkSentEvents();
+init_getDeviceNumber();
 async function generateQRCodeDataURL(data) {
 	const { default: QRCode } = await import("./browser-B3uuzKL0.js").then(__toDynamicImportESM(1));
 	return QRCode.toDataURL(data, {
@@ -9571,6 +9599,7 @@ var LinkDeviceFlow = class {
 //#endregion
 //#region src/core/TatchiPasskey/scanDevice.ts
 init_validation$1();
+init_login();
 init_sdkSentEvents();
 init_rpcCalls();
 /**
@@ -9816,8 +9845,30 @@ async function signDelegateAction(args) {
 //#endregion
 //#region src/core/TatchiPasskey/relay.ts
 init_sdkSentEvents();
+const toNumberArray = (value) => Array.isArray(value) ? value : Array.from(value);
+const normalizeSignedDelegateForRelay = (signedDelegate) => {
+	const delegateAction = signedDelegate.delegateAction;
+	const signature = signedDelegate.signature;
+	return {
+		delegateAction: {
+			...delegateAction,
+			publicKey: {
+				...delegateAction.publicKey,
+				keyData: toNumberArray(delegateAction.publicKey.keyData)
+			}
+		},
+		signature: {
+			...signature,
+			signatureData: toNumberArray(signature.signatureData)
+		}
+	};
+};
 async function sendDelegateActionViaRelayer(args) {
 	const { url, payload, signal, options } = args;
+	const normalizedPayload = {
+		...payload,
+		signedDelegate: normalizeSignedDelegateForRelay(payload.signedDelegate)
+	};
 	const emit = (event) => options?.onEvent?.(event);
 	const emitError = (message) => {
 		emit({
@@ -9839,7 +9890,7 @@ async function sendDelegateActionViaRelayer(args) {
 		res = await fetch(url, {
 			method: "POST",
 			headers: { "content-type": "application/json" },
-			body: JSON.stringify(payload),
+			body: JSON.stringify(normalizedPayload),
 			signal
 		});
 	} catch (err$1) {
@@ -9904,21 +9955,65 @@ const OFFLINE_EXPORT_FALLBACK = "OFFLINE_EXPORT_FALLBACK";
 const WALLET_UI_CLOSED = "WALLET_UI_CLOSED";
 const EXPORT_NEAR_KEYPAIR_CANCELLED = "EXPORT_NEAR_KEYPAIR_CANCELLED";
 
+//#endregion
+//#region src/core/EmailRecovery/emailRecoveryPendingStore.ts
+var EmailRecoveryPendingStore;
+var init_emailRecoveryPendingStore = __esm({ "src/core/EmailRecovery/emailRecoveryPendingStore.ts": (() => {
+	init_IndexedDBManager();
+	EmailRecoveryPendingStore = class {
+		getPendingTtlMs;
+		now;
+		constructor(options) {
+			this.getPendingTtlMs = options.getPendingTtlMs;
+			this.now = options.now ?? Date.now;
+		}
+		getPendingIndexKey(accountId) {
+			return `pendingEmailRecovery:${accountId}`;
+		}
+		getPendingRecordKey(accountId, nearPublicKey) {
+			return `${this.getPendingIndexKey(accountId)}:${nearPublicKey}`;
+		}
+		async get(accountId, nearPublicKey) {
+			const pendingTtlMs = this.getPendingTtlMs();
+			const indexKey = this.getPendingIndexKey(accountId);
+			const indexedNearPublicKey = await IndexedDBManager.clientDB.getAppState(indexKey);
+			const resolvedNearPublicKey = nearPublicKey ?? indexedNearPublicKey;
+			if (!resolvedNearPublicKey) return null;
+			const recordKey = this.getPendingRecordKey(accountId, resolvedNearPublicKey);
+			const record = await IndexedDBManager.clientDB.getAppState(recordKey);
+			const shouldClearIndex = indexedNearPublicKey === resolvedNearPublicKey;
+			if (!record) {
+				if (shouldClearIndex) await IndexedDBManager.clientDB.setAppState(indexKey, void 0).catch(() => {});
+				return null;
+			}
+			if (this.now() - record.createdAt > pendingTtlMs) {
+				await IndexedDBManager.clientDB.setAppState(recordKey, void 0).catch(() => {});
+				if (shouldClearIndex) await IndexedDBManager.clientDB.setAppState(indexKey, void 0).catch(() => {});
+				return null;
+			}
+			await this.touchIndex(accountId, record.nearPublicKey);
+			return record;
+		}
+		async set(record) {
+			const key = this.getPendingRecordKey(record.accountId, record.nearPublicKey);
+			await IndexedDBManager.clientDB.setAppState(key, record);
+			await this.touchIndex(record.accountId, record.nearPublicKey);
+		}
+		async clear(accountId, nearPublicKey) {
+			const indexKey = this.getPendingIndexKey(accountId);
+			const idx = await IndexedDBManager.clientDB.getAppState(indexKey).catch(() => void 0);
+			const resolvedNearPublicKey = nearPublicKey || idx || "";
+			if (resolvedNearPublicKey) await IndexedDBManager.clientDB.setAppState(this.getPendingRecordKey(accountId, resolvedNearPublicKey), void 0).catch(() => {});
+			if (!nearPublicKey || idx === nearPublicKey) await IndexedDBManager.clientDB.setAppState(indexKey, void 0).catch(() => {});
+		}
+		async touchIndex(accountId, nearPublicKey) {
+			await IndexedDBManager.clientDB.setAppState(this.getPendingIndexKey(accountId), nearPublicKey).catch(() => {});
+		}
+	};
+}) });
+
 //#endregion
 //#region src/core/EmailRecovery/index.ts
-init_accountIds();
-init_IndexedDBManager();
-const canonicalizeEmail = (email) => {
-	let addr = email;
-	const angleStart = email.indexOf("<");
-	const angleEnd = email.indexOf(">");
-	if (angleStart !== -1 && angleEnd > angleStart) addr = email.slice(angleStart + 1, angleEnd);
-	return addr.trim().toLowerCase();
-};
-const bytesToHex = (bytes) => {
-	const arr = bytes instanceof Uint8Array ? bytes : Uint8Array.from(bytes);
-	return `0x${Array.from(arr).map((b) => b.toString(16).padStart(2, "0")).join("")}`;
-};
 async function hashRecoveryEmails(emails, accountId) {
 	const encoder = new TextEncoder();
 	const salt = (accountId || "").trim().toLowerCase();
@@ -9965,6 +10060,30 @@ async function prepareRecoveryEmails(nearAccountId, recoveryEmails) {
 async function getLocalRecoveryEmails(nearAccountId) {
 	return IndexedDBManager.getRecoveryEmails(nearAccountId);
 }
+var canonicalizeEmail, bytesToHex;
+var init_EmailRecovery = __esm({ "src/core/EmailRecovery/index.ts": (() => {
+	init_accountIds();
+	init_IndexedDBManager();
+	init_emailRecoveryPendingStore();
+	canonicalizeEmail = (email) => {
+		const raw = String(email || "").trim();
+		if (!raw) return "";
+		const withoutHeaderName = raw.replace(/^[a-z0-9-]+\s*:\s*/i, "").trim();
+		const emailRegex = /([a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*)/;
+		const angleMatch = withoutHeaderName.match(/<([^>]+)>/);
+		const candidates = [angleMatch?.[1], withoutHeaderName].filter((v) => typeof v === "string" && v.length > 0);
+		for (const candidate of candidates) {
+			const cleaned = candidate.replace(/^mailto:\s*/i, "");
+			const match = cleaned.match(emailRegex);
+			if (match?.[1]) return match[1].trim().toLowerCase();
+		}
+		return withoutHeaderName.toLowerCase();
+	};
+	bytesToHex = (bytes) => {
+		const arr = bytes instanceof Uint8Array ? bytes : Uint8Array.from(bytes);
+		return `0x${Array.from(arr).map((b) => b.toString(16).padStart(2, "0")).join("")}`;
+	};
+}) });
 
 //#endregion
 //#region src/core/TatchiPasskey/emailRecovery.ts
@@ -10007,9 +10126,15 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 	init_validation$1();
 	init_accountIds();
 	init_sdkSentEvents();
+	init_vrf_worker();
+	init_rpc();
+	init_getDeviceNumber();
+	init_login();
+	init_EmailRecovery();
 	EmailRecoveryFlow = class {
 		context;
 		options;
+		pendingStore;
 		pending = null;
 		phase = EmailRecoveryPhase.STEP_1_PREPARATION;
 		pollingTimer;
@@ -10020,6 +10145,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 		constructor(context, options) {
 			this.context = context;
 			this.options = options;
+			this.pendingStore = options?.pendingStore ?? new EmailRecoveryPendingStore({ getPendingTtlMs: () => this.getConfig().pendingTtlMs });
 		}
 		setOptions(options) {
 			if (!options) return;
@@ -10027,6 +10153,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				...this.options || {},
 				...options
 			};
+			if (options.pendingStore) this.pendingStore = options.pendingStore;
 		}
 		emit(event) {
 			this.options?.onEvent?.(event);
@@ -10045,18 +10172,139 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 			this.options?.onError?.(err$1);
 			return err$1;
 		}
+		async fail(step, message) {
+			const err$1 = this.emitError(step, message);
+			await this.options?.afterCall?.(false);
+			throw err$1;
+		}
+		async assertValidAccountIdOrFail(step, accountId) {
+			const validation = validateNearAccountId(accountId);
+			if (!validation.valid) await this.fail(step, `Invalid NEAR account ID: ${validation.error}`);
+			return toAccountId(accountId);
+		}
+		async resolvePendingOrFail(step, args, options) {
+			const { allowErrorStatus = true, missingMessage = "No pending email recovery record found for this account", errorStatusMessage = "Pending email recovery is in an error state; please restart the flow" } = options ?? {};
+			let rec = this.pending;
+			if (!rec || rec.accountId !== args.accountId || args.nearPublicKey && rec.nearPublicKey !== args.nearPublicKey) {
+				rec = await this.loadPending(args.accountId, args.nearPublicKey);
+				this.pending = rec;
+			}
+			if (!rec) await this.fail(step, missingMessage);
+			const resolved = rec;
+			if (!allowErrorStatus && resolved.status === "error") await this.fail(step, errorStatusMessage);
+			return resolved;
+		}
 		getConfig() {
 			return getEmailRecoveryConfig(this.context.configs);
 		}
-		async checkVerificationStatus(rec) {
+		toBigInt(value) {
+			if (typeof value === "bigint") return value;
+			if (typeof value === "number") return BigInt(value);
+			if (typeof value === "string" && value.length > 0) return BigInt(value);
+			return BigInt(0);
+		}
+		computeAvailableBalance(accountView) {
+			const STORAGE_PRICE_PER_BYTE = BigInt("10000000000000000000");
+			const amount = this.toBigInt(accountView.amount);
+			const locked = this.toBigInt(accountView.locked);
+			const storageUsage = this.toBigInt(accountView.storage_usage);
+			const storageCost = storageUsage * STORAGE_PRICE_PER_BYTE;
+			const rawAvailable = amount - locked - storageCost;
+			return rawAvailable > 0 ? rawAvailable : BigInt(0);
+		}
+		async assertSufficientBalance(nearAccountId) {
+			const { minBalanceYocto } = this.getConfig();
+			try {
+				const accountView = await this.context.nearClient.viewAccount(nearAccountId);
+				const available = this.computeAvailableBalance(accountView);
+				if (available < BigInt(minBalanceYocto)) await this.fail(1, `This account does not have enough NEAR to finalize recovery. Available: ${available.toString()} yocto; required: ${String(minBalanceYocto)}. Please top up and try again.`);
+			} catch (e) {
+				await this.fail(1, e?.message || "Failed to fetch account balance for recovery");
+			}
+		}
+		async getCanonicalRecoveryEmailOrFail(recoveryEmail) {
+			const canonicalEmail = String(recoveryEmail || "").trim().toLowerCase();
+			if (!canonicalEmail) await this.fail(1, "Recovery email is required for email-based account recovery");
+			return canonicalEmail;
+		}
+		async getNextDeviceNumberFromContract(nearAccountId) {
+			try {
+				const { syncAuthenticatorsContractCall: syncAuthenticatorsContractCall$1 } = await import("./rpcCalls-BQrJMTdg.js");
+				const authenticators = await syncAuthenticatorsContractCall$1(this.context.nearClient, this.context.configs.contractId, nearAccountId);
+				const numbers = authenticators.map((a) => a?.authenticator?.deviceNumber).filter((n) => typeof n === "number" && Number.isFinite(n));
+				const max = numbers.length > 0 ? Math.max(...numbers) : 0;
+				return max + 1;
+			} catch {
+				return 1;
+			}
+		}
+		async collectRecoveryCredentialOrFail(nearAccountId, deviceNumber) {
+			const confirmerText = {
+				title: this.options?.confirmerText?.title ?? "Register New Recovery Account",
+				body: this.options?.confirmerText?.body ?? "Create a recovery account and send an encrypted email to recover your account."
+			};
+			const confirm = await this.context.webAuthnManager.requestRegistrationCredentialConfirmation({
+				nearAccountId,
+				deviceNumber,
+				confirmerText,
+				confirmationConfigOverride: this.options?.confirmationConfig
+			});
+			if (!confirm.confirmed || !confirm.credential) await this.fail(2, "User cancelled email recovery TouchID confirmation");
+			return {
+				credential: confirm.credential,
+				vrfChallenge: confirm.vrfChallenge || void 0
+			};
+		}
+		async deriveRecoveryKeysOrFail(nearAccountId, deviceNumber, credential) {
+			const vrfDerivationResult = await this.context.webAuthnManager.deriveVrfKeypair({
+				credential,
+				nearAccountId
+			});
+			if (!vrfDerivationResult.success || !vrfDerivationResult.encryptedVrfKeypair) await this.fail(2, "Failed to derive VRF keypair from PRF for email recovery");
+			const nearKeyResult = await this.context.webAuthnManager.deriveNearKeypairAndEncryptFromSerialized({
+				nearAccountId,
+				credential,
+				options: { deviceNumber }
+			});
+			if (!nearKeyResult.success || !nearKeyResult.publicKey) await this.fail(2, "Failed to derive NEAR keypair for email recovery");
+			return {
+				encryptedVrfKeypair: vrfDerivationResult.encryptedVrfKeypair,
+				serverEncryptedVrfKeypair: vrfDerivationResult.serverEncryptedVrfKeypair || null,
+				vrfPublicKey: vrfDerivationResult.vrfPublicKey,
+				nearPublicKey: nearKeyResult.publicKey
+			};
+		}
+		emitAwaitEmail(rec, mailtoUrl) {
+			this.phase = EmailRecoveryPhase.STEP_3_AWAIT_EMAIL;
+			this.emit({
+				step: 3,
+				phase: EmailRecoveryPhase.STEP_3_AWAIT_EMAIL,
+				status: EmailRecoveryStatus.PROGRESS,
+				message: "New device key created; please send the recovery email from your registered address.",
+				data: {
+					accountId: rec.accountId,
+					recoveryEmail: rec.recoveryEmail,
+					nearPublicKey: rec.nearPublicKey,
+					requestId: rec.requestId,
+					mailtoUrl
+				}
+			});
+		}
+		emitAutoLoginEvent(status, message, data) {
+			this.emit({
+				step: 5,
+				phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,
+				status,
+				message,
+				data
+			});
+		}
+		async checkViaDkimViewMethod(rec) {
 			const { dkimVerifierAccountId, verificationViewMethod } = this.getConfig();
 			if (!dkimVerifierAccountId) return null;
 			try {
-				const result = await this.context.nearClient.view({
-					account: dkimVerifierAccountId,
-					method: verificationViewMethod,
-					args: { request_id: rec.requestId }
-				});
+				const { getEmailRecoveryVerificationResult } = await import("./rpcCalls-BQrJMTdg.js");
+				const result = await getEmailRecoveryVerificationResult(this.context.nearClient, dkimVerifierAccountId, verificationViewMethod, rec.requestId);
 				if (!result) return {
 					completed: false,
 					success: false
@@ -10066,49 +10314,100 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 					return {
 						completed: true,
 						success: false,
-						errorMessage: errorMessage$1
+						errorMessage: errorMessage$1,
+						transactionHash: result.transaction_hash
 					};
 				}
 				if (result.account_id && result.account_id !== rec.accountId) return {
 					completed: true,
 					success: false,
-					errorMessage: "Email verification account_id does not match requested account."
+					errorMessage: "Email verification account_id does not match requested account.",
+					transactionHash: result.transaction_hash
 				};
 				if (result.new_public_key && result.new_public_key !== rec.nearPublicKey) return {
 					completed: true,
 					success: false,
-					errorMessage: "Email verification new_public_key does not match expected recovery key."
+					errorMessage: "Email verification new_public_key does not match expected recovery key.",
+					transactionHash: result.transaction_hash
 				};
 				return {
 					completed: true,
-					success: true
+					success: true,
+					transactionHash: result.transaction_hash
 				};
 			} catch (err$1) {
-				console.warn("[EmailRecoveryFlow] get_verification_result view failed; falling back to access key polling", err$1);
+				console.warn("[EmailRecoveryFlow] get_verification_result view failed; will retry", err$1);
 				return null;
 			}
 		}
-		async loadPending(accountId, nearPublicKey) {
-			const { pendingTtlMs } = this.getConfig();
-			const keyPrefix = `pendingEmailRecovery:${accountId}`;
-			const key = nearPublicKey ? `${keyPrefix}:${nearPublicKey}` : keyPrefix;
-			const record = await IndexedDBManager.clientDB.getAppState(key);
-			if (!record) return null;
-			if (Date.now() - record.createdAt > pendingTtlMs) {
-				await IndexedDBManager.clientDB.setAppState(key, void 0);
-				return null;
+		buildPollingEventData(rec, details) {
+			return {
+				accountId: rec.accountId,
+				requestId: rec.requestId,
+				nearPublicKey: rec.nearPublicKey,
+				transactionHash: details.transactionHash,
+				elapsedMs: details.elapsedMs,
+				pollCount: details.pollCount
+			};
+		}
+		async sleepForPollInterval(ms) {
+			await new Promise((resolve) => {
+				this.pollIntervalResolver = resolve;
+				this.pollingTimer = setTimeout(() => {
+					this.pollIntervalResolver = void 0;
+					this.pollingTimer = void 0;
+					resolve();
+				}, ms);
+			}).finally(() => {
+				this.pollIntervalResolver = void 0;
+			});
+		}
+		async pollUntil(args) {
+			const now = args.now ?? Date.now;
+			const sleep = args.sleep ?? this.sleepForPollInterval.bind(this);
+			const startedAt = now();
+			let pollCount = 0;
+			while (!args.isCancelled()) {
+				pollCount += 1;
+				const elapsedMs$1 = now() - startedAt;
+				if (elapsedMs$1 > args.timeoutMs) return {
+					status: "timedOut",
+					elapsedMs: elapsedMs$1,
+					pollCount
+				};
+				const result = await args.tick({
+					elapsedMs: elapsedMs$1,
+					pollCount
+				});
+				if (result.done) return {
+					status: "completed",
+					value: result.value,
+					elapsedMs: elapsedMs$1,
+					pollCount
+				};
+				if (args.isCancelled()) return {
+					status: "cancelled",
+					elapsedMs: elapsedMs$1,
+					pollCount
+				};
+				await sleep(args.intervalMs);
 			}
-			return record;
+			const elapsedMs = now() - startedAt;
+			return {
+				status: "cancelled",
+				elapsedMs,
+				pollCount
+			};
+		}
+		async loadPending(accountId, nearPublicKey) {
+			return this.pendingStore.get(accountId, nearPublicKey);
 		}
 		async savePending(rec) {
-			const key = `pendingEmailRecovery:${rec.accountId}:${rec.nearPublicKey}`;
-			await IndexedDBManager.clientDB.setAppState(key, rec);
+			await this.pendingStore.set(rec);
 			this.pending = rec;
 		}
 		async clearPending(accountId, nearPublicKey) {
-			const keyPrefix = `pendingEmailRecovery:${accountId}`;
-			const key = nearPublicKey ? `${keyPrefix}:${nearPublicKey}` : keyPrefix;
-			await IndexedDBManager.clientDB.setAppState(key, void 0);
+			await this.pendingStore.clear(accountId, nearPublicKey);
 			if (this.pending && this.pending.accountId === accountId && (!nearPublicKey || this.pending.nearPublicKey === nearPublicKey)) this.pending = null;
 		}
 		getState() {
@@ -10122,48 +10421,14 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 			const { accountId, nearPublicKey } = args;
 			this.cancelled = false;
 			this.error = void 0;
-			const validation = validateNearAccountId(accountId);
-			if (!validation.valid) {
-				const err$1 = this.emitError(3, `Invalid NEAR account ID: ${validation.error}`);
-				await this.options?.afterCall?.(false);
-				throw err$1;
-			}
-			const nearAccountId = toAccountId(accountId);
-			let rec = this.pending;
-			if (!rec || rec.accountId !== nearAccountId || nearPublicKey && rec.nearPublicKey !== nearPublicKey) {
-				rec = await this.loadPending(nearAccountId, nearPublicKey);
-				this.pending = rec;
-			}
-			if (!rec) {
-				const err$1 = this.emitError(3, "No pending email recovery record found for this account");
-				await this.options?.afterCall?.(false);
-				throw err$1;
-			}
-			if (rec.status === "error") {
-				const err$1 = this.emitError(3, "Pending email recovery is in an error state; please restart the flow");
-				await this.options?.afterCall?.(false);
-				throw err$1;
-			}
-			if (rec.status === "finalizing" || rec.status === "complete") {
-				const err$1 = this.emitError(3, "Recovery email has already been processed on-chain for this request");
-				await this.options?.afterCall?.(false);
-				throw err$1;
-			}
+			const nearAccountId = await this.assertValidAccountIdOrFail(3, accountId);
+			const rec = await this.resolvePendingOrFail(3, {
+				accountId: nearAccountId,
+				nearPublicKey
+			}, { allowErrorStatus: false });
+			if (rec.status === "finalizing" || rec.status === "complete") await this.fail(3, "Recovery email has already been processed on-chain for this request");
 			const mailtoUrl = rec.status === "awaiting-email" ? await this.buildMailtoUrlAndUpdateStatus(rec) : this.buildMailtoUrlInternal(rec);
-			this.phase = EmailRecoveryPhase.STEP_3_AWAIT_EMAIL;
-			this.emit({
-				step: 3,
-				phase: EmailRecoveryPhase.STEP_3_AWAIT_EMAIL,
-				status: EmailRecoveryStatus.PROGRESS,
-				message: "New device key created; please send the recovery email from your registered address.",
-				data: {
-					accountId: rec.accountId,
-					recoveryEmail: rec.recoveryEmail,
-					nearPublicKey: rec.nearPublicKey,
-					requestId: rec.requestId,
-					mailtoUrl
-				}
-			});
+			this.emitAwaitEmail(rec, mailtoUrl);
 			await this.options?.afterCall?.(true, void 0);
 			return mailtoUrl;
 		}
@@ -10178,49 +10443,10 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				status: EmailRecoveryStatus.PROGRESS,
 				message: "Preparing email recovery..."
 			});
-			const validation = validateNearAccountId(accountId);
-			if (!validation.valid) {
-				const err$1 = this.emitError(1, `Invalid NEAR account ID: ${validation.error}`);
-				await this.options?.afterCall?.(false);
-				throw err$1;
-			}
-			const nearAccountId = toAccountId(accountId);
-			const { minBalanceYocto } = this.getConfig();
-			const STORAGE_PRICE_PER_BYTE = BigInt("10000000000000000000");
-			try {
-				const accountView = await this.context.nearClient.viewAccount(nearAccountId);
-				const amount = BigInt(accountView.amount || "0");
-				const locked = BigInt(accountView.locked || "0");
-				const storageUsage = BigInt(accountView.storage_usage || 0);
-				const storageCost = storageUsage * STORAGE_PRICE_PER_BYTE;
-				const rawAvailable = amount - locked - storageCost;
-				const available = rawAvailable > 0 ? rawAvailable : BigInt(0);
-				if (available < BigInt(minBalanceYocto)) {
-					const err$1 = this.emitError(1, `This account does not have enough NEAR to finalize recovery. Available: ${available.toString()} yocto; required: ${String(minBalanceYocto)}. Please top up and try again.`);
-					await this.options?.afterCall?.(false);
-					throw err$1;
-				}
-			} catch (e) {
-				const err$1 = this.emitError(1, e?.message || "Failed to fetch account balance for recovery");
-				await this.options?.afterCall?.(false);
-				throw err$1;
-			}
-			const canonicalEmail = String(recoveryEmail || "").trim().toLowerCase();
-			if (!canonicalEmail) {
-				const err$1 = this.emitError(1, "Recovery email is required for email-based account recovery");
-				await this.options?.afterCall?.(false);
-				throw err$1;
-			}
-			let deviceNumber = 1;
-			try {
-				const { syncAuthenticatorsContractCall: syncAuthenticatorsContractCall$1 } = await import("./rpcCalls-fLObBbbz.js");
-				const authenticators = await syncAuthenticatorsContractCall$1(this.context.nearClient, this.context.configs.contractId, nearAccountId);
-				const numbers = authenticators.map((a) => a?.authenticator?.deviceNumber).filter((n) => typeof n === "number" && Number.isFinite(n));
-				const max = numbers.length > 0 ? Math.max(...numbers) : 0;
-				deviceNumber = max + 1;
-			} catch {
-				deviceNumber = 1;
-			}
+			const nearAccountId = await this.assertValidAccountIdOrFail(1, accountId);
+			await this.assertSufficientBalance(nearAccountId);
+			const canonicalEmail = await this.getCanonicalRecoveryEmailOrFail(recoveryEmail);
+			const deviceNumber = await this.getNextDeviceNumberFromContract(nearAccountId);
 			this.phase = EmailRecoveryPhase.STEP_2_TOUCH_ID_REGISTRATION;
 			this.emit({
 				step: 2,
@@ -10229,66 +10455,24 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				message: "Collecting passkey for email recovery..."
 			});
 			try {
-				const confirmerText = this.options?.confirmerText;
-				const confirm = await this.context.webAuthnManager.requestRegistrationCredentialConfirmation({
-					nearAccountId,
-					deviceNumber,
-					confirmerText,
-					confirmationConfigOverride: this.options?.confirmationConfig
-				});
-				if (!confirm.confirmed || !confirm.credential) {
-					const err$1 = this.emitError(2, "User cancelled email recovery TouchID confirmation");
-					await this.options?.afterCall?.(false);
-					throw err$1;
-				}
-				const vrfDerivationResult = await this.context.webAuthnManager.deriveVrfKeypair({
-					credential: confirm.credential,
-					nearAccountId
-				});
-				if (!vrfDerivationResult.success || !vrfDerivationResult.encryptedVrfKeypair) {
-					const err$1 = this.emitError(2, "Failed to derive VRF keypair from PRF for email recovery");
-					await this.options?.afterCall?.(false);
-					throw err$1;
-				}
-				const nearKeyResult = await this.context.webAuthnManager.deriveNearKeypairAndEncryptFromSerialized({
-					nearAccountId,
-					credential: confirm.credential,
-					options: { deviceNumber }
-				});
-				if (!nearKeyResult.success || !nearKeyResult.publicKey) {
-					const err$1 = this.emitError(2, "Failed to derive NEAR keypair for email recovery");
-					await this.options?.afterCall?.(false);
-					throw err$1;
-				}
+				const confirm = await this.collectRecoveryCredentialOrFail(nearAccountId, deviceNumber);
+				const derivedKeys = await this.deriveRecoveryKeysOrFail(nearAccountId, deviceNumber, confirm.credential);
 				const rec = {
 					accountId: nearAccountId,
 					recoveryEmail: canonicalEmail,
 					deviceNumber,
-					nearPublicKey: nearKeyResult.publicKey,
+					nearPublicKey: derivedKeys.nearPublicKey,
 					requestId: generateEmailRecoveryRequestId(),
-					encryptedVrfKeypair: vrfDerivationResult.encryptedVrfKeypair,
-					serverEncryptedVrfKeypair: vrfDerivationResult.serverEncryptedVrfKeypair || null,
-					vrfPublicKey: vrfDerivationResult.vrfPublicKey,
+					encryptedVrfKeypair: derivedKeys.encryptedVrfKeypair,
+					serverEncryptedVrfKeypair: derivedKeys.serverEncryptedVrfKeypair,
+					vrfPublicKey: derivedKeys.vrfPublicKey,
 					credential: confirm.credential,
 					vrfChallenge: confirm.vrfChallenge || void 0,
 					createdAt: Date.now(),
 					status: "awaiting-email"
 				};
 				const mailtoUrl = await this.buildMailtoUrlAndUpdateStatus(rec);
-				this.phase = EmailRecoveryPhase.STEP_3_AWAIT_EMAIL;
-				this.emit({
-					step: 3,
-					phase: EmailRecoveryPhase.STEP_3_AWAIT_EMAIL,
-					status: EmailRecoveryStatus.PROGRESS,
-					message: "New device key created; please send the recovery email from your registered address.",
-					data: {
-						accountId: rec.accountId,
-						recoveryEmail: rec.recoveryEmail,
-						nearPublicKey: rec.nearPublicKey,
-						requestId: rec.requestId,
-						mailtoUrl
-					}
-				});
+				this.emitAwaitEmail(rec, mailtoUrl);
 				await this.options?.afterCall?.(true, void 0);
 				return {
 					mailtoUrl,
@@ -10316,28 +10500,11 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 			const { accountId, nearPublicKey } = args;
 			this.cancelled = false;
 			this.error = void 0;
-			const validation = validateNearAccountId(accountId);
-			if (!validation.valid) {
-				const err$1 = this.emitError(4, `Invalid NEAR account ID: ${validation.error}`);
-				await this.options?.afterCall?.(false);
-				throw err$1;
-			}
-			const nearAccountId = toAccountId(accountId);
-			let rec = this.pending;
-			if (!rec || rec.accountId !== nearAccountId || nearPublicKey && rec.nearPublicKey !== nearPublicKey) {
-				rec = await this.loadPending(nearAccountId, nearPublicKey);
-				this.pending = rec;
-			}
-			if (!rec) {
-				const err$1 = this.emitError(4, "No pending email recovery record found for this account");
-				await this.options?.afterCall?.(false);
-				throw err$1;
-			}
-			if (rec.status === "error") {
-				const err$1 = this.emitError(4, "Pending email recovery is in an error state; please restart the flow");
-				await this.options?.afterCall?.(false);
-				throw err$1;
-			}
+			const nearAccountId = await this.assertValidAccountIdOrFail(4, accountId);
+			const rec = await this.resolvePendingOrFail(4, {
+				accountId: nearAccountId,
+				nearPublicKey
+			}, { allowErrorStatus: false });
 			if (rec.status === "complete" || rec.status === "finalizing") {
 				await this.options?.afterCall?.(true, void 0);
 				return;
@@ -10357,27 +10524,31 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				this.pollIntervalResolver = void 0;
 			}
 		}
+		/**
+		* Best-effort cancellation and local state reset so callers can retry.
+		* This does not remove any passkey created in the browser/OS (WebAuthn has no delete API),
+		* but it will stop polling and clear the pending IndexedDB record for the given key.
+		*/
+		async cancelAndReset(args) {
+			this.stopPolling();
+			const normalizedAccountId = (args?.accountId || this.pending?.accountId || "").toString().trim();
+			const nearPublicKey = (args?.nearPublicKey || this.pending?.nearPublicKey || "").toString().trim();
+			if (normalizedAccountId) try {
+				await this.clearPending(toAccountId(normalizedAccountId), nearPublicKey);
+			} catch {}
+			this.pending = null;
+			this.error = void 0;
+			this.phase = EmailRecoveryPhase.STEP_1_PREPARATION;
+		}
 		async finalize(args) {
 			const { accountId, nearPublicKey } = args;
 			this.cancelled = false;
 			this.error = void 0;
-			const validation = validateNearAccountId(accountId);
-			if (!validation.valid) {
-				const err$1 = this.emitError(4, `Invalid NEAR account ID: ${validation.error}`);
-				await this.options?.afterCall?.(false);
-				throw err$1;
-			}
-			const nearAccountId = toAccountId(accountId);
-			let rec = this.pending;
-			if (!rec || rec.accountId !== nearAccountId || nearPublicKey && rec.nearPublicKey !== nearPublicKey) {
-				rec = await this.loadPending(nearAccountId, nearPublicKey);
-				this.pending = rec;
-			}
-			if (!rec) {
-				const err$1 = this.emitError(4, "No pending email recovery record found for this account");
-				await this.options?.afterCall?.(false);
-				throw err$1;
-			}
+			const nearAccountId = await this.assertValidAccountIdOrFail(4, accountId);
+			const rec = await this.resolvePendingOrFail(4, {
+				accountId: nearAccountId,
+				nearPublicKey
+			}, { allowErrorStatus: true });
 			this.emit({
 				step: 0,
 				phase: EmailRecoveryPhase.RESUMED_FROM_PENDING,
@@ -10413,141 +10584,318 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 			}
 			this.phase = EmailRecoveryPhase.STEP_4_POLLING_VERIFICATION_RESULT;
 			this.pollingStartedAt = Date.now();
-			let pollCount = 0;
-			while (!this.cancelled) {
-				pollCount += 1;
-				const elapsed = Date.now() - (this.pollingStartedAt || 0);
-				if (elapsed > maxPollingDurationMs) {
-					const err$2 = this.emitError(4, "Timed out waiting for recovery email to be processed on-chain");
+			const pollResult = await this.pollUntil({
+				intervalMs: pollingIntervalMs,
+				timeoutMs: maxPollingDurationMs,
+				isCancelled: () => this.cancelled,
+				tick: async ({ elapsedMs, pollCount }) => {
+					const verification = await this.checkViaDkimViewMethod(rec);
+					const completed = verification?.completed === true;
+					const success = verification?.success === true;
+					this.emit({
+						step: 4,
+						phase: EmailRecoveryPhase.STEP_4_POLLING_VERIFICATION_RESULT,
+						status: EmailRecoveryStatus.PROGRESS,
+						message: completed && success ? `Email verified for request ${rec.requestId}; finalizing registration` : `Waiting for email verification for request ${rec.requestId}`,
+						data: this.buildPollingEventData(rec, {
+							transactionHash: verification?.transactionHash,
+							elapsedMs,
+							pollCount
+						})
+					});
+					if (!completed) return { done: false };
+					if (!success) return {
+						done: true,
+						value: {
+							outcome: "failed",
+							errorMessage: verification?.errorMessage || "Email verification failed"
+						}
+					};
+					return {
+						done: true,
+						value: { outcome: "verified" }
+					};
+				}
+			});
+			if (pollResult.status === "completed") {
+				if (pollResult.value.outcome === "failed") {
+					const err$2 = this.emitError(4, pollResult.value.errorMessage);
 					rec.status = "error";
 					await this.savePending(rec);
 					await this.options?.afterCall?.(false);
 					throw err$2;
 				}
-				const verification = await this.checkVerificationStatus(rec);
-				const completed = verification?.completed === true;
-				const success = verification?.success === true;
-				this.emit({
-					step: 4,
-					phase: EmailRecoveryPhase.STEP_4_POLLING_VERIFICATION_RESULT,
-					status: EmailRecoveryStatus.PROGRESS,
-					message: completed && success ? `Recovery email verified for request ${rec.requestId}; finalizing registration...` : `Waiting for recovery email verification for request ${rec.requestId}...`,
-					data: {
-						accountId: rec.accountId,
-						requestId: rec.requestId,
-						nearPublicKey: rec.nearPublicKey,
-						elapsedMs: elapsed,
-						pollCount
-					}
-				});
-				if (completed) {
-					if (!success) {
-						const err$2 = this.emitError(4, verification?.errorMessage || "Email verification failed");
-						rec.status = "error";
-						await this.savePending(rec);
-						await this.options?.afterCall?.(false);
-						throw err$2;
-					}
-					rec.status = "finalizing";
-					await this.savePending(rec);
-					return;
-				}
-				await new Promise((resolve) => {
-					this.pollIntervalResolver = resolve;
-					this.pollingTimer = setTimeout(() => {
-						this.pollIntervalResolver = void 0;
-						this.pollingTimer = void 0;
-						resolve();
-					}, pollingIntervalMs);
-				}).finally(() => {
-					this.pollIntervalResolver = void 0;
-				});
+				rec.status = "finalizing";
+				await this.savePending(rec);
+				return;
+			}
+			if (pollResult.status === "timedOut") {
+				const err$2 = this.emitError(4, "Timed out waiting for recovery email to be processed on-chain");
+				rec.status = "error";
+				await this.savePending(rec);
+				await this.options?.afterCall?.(false);
+				throw err$2;
 			}
 			const err$1 = this.emitError(4, "Email recovery polling was cancelled");
 			await this.options?.afterCall?.(false);
 			throw err$1;
 		}
-		async finalizeRegistration(rec) {
-			this.phase = EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION;
-			this.emit({
-				step: 5,
-				phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,
-				status: EmailRecoveryStatus.PROGRESS,
-				message: "Finalizing email recovery registration...",
-				data: {
-					accountId: rec.accountId,
-					nearPublicKey: rec.nearPublicKey
-				}
-			});
+		initializeNonceManager(rec) {
 			const nonceManager = this.context.webAuthnManager.getNonceManager();
 			const accountId = toAccountId(rec.accountId);
 			nonceManager.initializeUser(accountId, rec.nearPublicKey);
+			return {
+				nonceManager,
+				accountId
+			};
+		}
+		async signRegistrationTx(rec, accountId) {
+			const vrfChallenge = rec.vrfChallenge;
+			if (!vrfChallenge) return this.fail(5, "Missing VRF challenge for email recovery registration");
+			const registrationResult = await this.context.webAuthnManager.signDevice2RegistrationWithStoredKey({
+				nearAccountId: accountId,
+				credential: rec.credential,
+				vrfChallenge,
+				deterministicVrfPublicKey: rec.vrfPublicKey,
+				deviceNumber: rec.deviceNumber
+			});
+			if (!registrationResult.success || !registrationResult.signedTransaction) await this.fail(5, registrationResult.error || "Failed to sign email recovery registration transaction");
+			return registrationResult.signedTransaction;
+		}
+		async broadcastRegistrationTxAndWaitFinal(rec, signedTx) {
 			try {
-				if (!rec.vrfChallenge) {
-					const err$1 = this.emitError(5, "Missing VRF challenge for email recovery registration");
-					await this.options?.afterCall?.(false);
-					throw err$1;
-				}
-				const registrationResult = await this.context.webAuthnManager.signDevice2RegistrationWithStoredKey({
-					nearAccountId: accountId,
-					credential: rec.credential,
-					vrfChallenge: rec.vrfChallenge,
-					deterministicVrfPublicKey: rec.vrfPublicKey,
-					deviceNumber: rec.deviceNumber
-				});
-				if (!registrationResult.success || !registrationResult.signedTransaction) {
-					const err$1 = this.emitError(5, registrationResult.error || "Failed to sign email recovery registration transaction");
-					await this.options?.afterCall?.(false);
-					throw err$1;
-				}
-				const signedTx = registrationResult.signedTransaction;
-				try {
-					await this.context.nearClient.sendTransaction(signedTx);
-				} catch (e) {
-					const msg = String(e?.message || "");
-					const err$1 = this.emitError(5, msg || "Failed to broadcast email recovery registration transaction (insufficient funds or RPC error)");
-					await this.options?.afterCall?.(false);
-					throw err$1;
-				}
+				const txResult = await this.context.nearClient.sendTransaction(signedTx, DEFAULT_WAIT_STATUS.linkDeviceRegistration);
 				try {
-					const txNonce = signedTx.transaction?.nonce;
-					if (txNonce != null) await nonceManager.updateNonceFromBlockchain(this.context.nearClient, String(txNonce));
+					const txHash = txResult?.transaction?.hash || txResult?.transaction_hash;
+					if (txHash) this.emit({
+						step: 5,
+						phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,
+						status: EmailRecoveryStatus.PROGRESS,
+						message: "Registration transaction confirmed",
+						data: {
+							accountId: rec.accountId,
+							nearPublicKey: rec.nearPublicKey,
+							transactionHash: txHash
+						}
+					});
+					return txHash;
 				} catch {}
-				const { webAuthnManager } = this.context;
-				await webAuthnManager.storeUserData({
+			} catch (e) {
+				const msg = String(e?.message || "");
+				await this.fail(5, msg || "Failed to broadcast email recovery registration transaction (insufficient funds or RPC error)");
+			}
+			return void 0;
+		}
+		async persistRecoveredUserRecordBestEffort(rec, accountId) {
+			try {
+				await IndexedDBManager.clientDB.storeWebAuthnUserData({
 					nearAccountId: accountId,
 					deviceNumber: rec.deviceNumber,
 					clientNearPublicKey: rec.nearPublicKey,
-					lastUpdated: Date.now(),
 					passkeyCredential: {
 						id: rec.credential.id,
 						rawId: rec.credential.rawId
 					},
-					encryptedVrfKeypair: {
-						encryptedVrfDataB64u: rec.encryptedVrfKeypair.encryptedVrfDataB64u,
-						chacha20NonceB64u: rec.encryptedVrfKeypair.chacha20NonceB64u
-					},
+					encryptedVrfKeypair: rec.encryptedVrfKeypair,
 					serverEncryptedVrfKeypair: rec.serverEncryptedVrfKeypair || void 0
 				});
-				try {
-					const attestationB64u = rec.credential.response.attestationObject;
-					const credentialPublicKey = await webAuthnManager.extractCosePublicKey(attestationB64u);
-					await webAuthnManager.storeAuthenticator({
-						nearAccountId: accountId,
-						deviceNumber: rec.deviceNumber,
-						credentialId: rec.credential.rawId,
-						credentialPublicKey,
-						transports: ["internal"],
-						name: `Device ${rec.deviceNumber} Passkey for ${rec.accountId.split(".")[0]}`,
-						registered: (/* @__PURE__ */ new Date()).toISOString(),
-						syncedAt: (/* @__PURE__ */ new Date()).toISOString(),
-						vrfPublicKey: rec.vrfPublicKey
-					});
-				} catch {}
-				await this.attemptAutoLogin(rec);
-				rec.status = "complete";
-				await this.savePending(rec);
-				await this.clearPending(rec.accountId, rec.nearPublicKey);
+				return true;
+			} catch (err$1) {
+				console.warn("[EmailRecoveryFlow] Failed to store recovery user record:", err$1);
+				return false;
+			}
+		}
+		mapAuthenticatorsFromContract(authenticators) {
+			return authenticators.map(({ authenticator }) => ({
+				credentialId: authenticator.credentialId,
+				credentialPublicKey: authenticator.credentialPublicKey,
+				transports: authenticator.transports,
+				name: authenticator.name,
+				registered: authenticator.registered.toISOString(),
+				vrfPublicKey: authenticator.vrfPublicKeys?.[0] || "",
+				deviceNumber: authenticator.deviceNumber
+			}));
+		}
+		async syncAuthenticatorsBestEffort(accountId) {
+			try {
+				const { syncAuthenticatorsContractCall: syncAuthenticatorsContractCall$1 } = await import("./rpcCalls-BQrJMTdg.js");
+				const authenticators = await syncAuthenticatorsContractCall$1(this.context.nearClient, this.context.configs.contractId, accountId);
+				const mappedAuthenticators = this.mapAuthenticatorsFromContract(authenticators);
+				await IndexedDBManager.clientDB.syncAuthenticatorsFromContract(accountId, mappedAuthenticators);
+				return true;
+			} catch (err$1) {
+				console.warn("[EmailRecoveryFlow] Failed to sync authenticators after recovery:", err$1);
+				return false;
+			}
+		}
+		async setLastUserBestEffort(accountId, deviceNumber) {
+			try {
+				await IndexedDBManager.clientDB.setLastUser(accountId, deviceNumber);
+				return true;
+			} catch (err$1) {
+				console.warn("[EmailRecoveryFlow] Failed to set last user after recovery:", err$1);
+				return false;
+			}
+		}
+		async updateNonceBestEffort(nonceManager, signedTx) {
+			try {
+				const txNonce = signedTx.transaction?.nonce;
+				if (txNonce != null) await nonceManager.updateNonceFromBlockchain(this.context.nearClient, String(txNonce));
+			} catch {}
+		}
+		async persistRecoveredUserData(rec, accountId) {
+			const { webAuthnManager } = this.context;
+			const payload = {
+				nearAccountId: accountId,
+				deviceNumber: rec.deviceNumber,
+				clientNearPublicKey: rec.nearPublicKey,
+				lastUpdated: Date.now(),
+				passkeyCredential: {
+					id: rec.credential.id,
+					rawId: rec.credential.rawId
+				},
+				encryptedVrfKeypair: {
+					encryptedVrfDataB64u: rec.encryptedVrfKeypair.encryptedVrfDataB64u,
+					chacha20NonceB64u: rec.encryptedVrfKeypair.chacha20NonceB64u
+				},
+				serverEncryptedVrfKeypair: rec.serverEncryptedVrfKeypair || void 0
+			};
+			await webAuthnManager.storeUserData(payload);
+		}
+		async persistAuthenticatorBestEffort(rec, accountId) {
+			try {
+				const { webAuthnManager } = this.context;
+				const attestationB64u = rec.credential.response.attestationObject;
+				const credentialPublicKey = await webAuthnManager.extractCosePublicKey(attestationB64u);
+				await webAuthnManager.storeAuthenticator({
+					nearAccountId: accountId,
+					deviceNumber: rec.deviceNumber,
+					credentialId: rec.credential.rawId,
+					credentialPublicKey,
+					transports: ["internal"],
+					name: `Device ${rec.deviceNumber} Passkey for ${rec.accountId.split(".")[0]}`,
+					registered: (/* @__PURE__ */ new Date()).toISOString(),
+					syncedAt: (/* @__PURE__ */ new Date()).toISOString(),
+					vrfPublicKey: rec.vrfPublicKey
+				});
+			} catch {}
+		}
+		async markCompleteAndClearPending(rec) {
+			rec.status = "complete";
+			await this.savePending(rec);
+			await this.clearPending(rec.accountId, rec.nearPublicKey);
+		}
+		async assertVrfActiveForAccount(accountId, message) {
+			const vrfStatus = await this.context.webAuthnManager.checkVrfStatus();
+			const vrfActiveForAccount = vrfStatus.active && vrfStatus.nearAccountId && String(vrfStatus.nearAccountId) === String(accountId);
+			if (!vrfActiveForAccount) throw new Error(message);
+		}
+		async finalizeLocalLoginState(accountId, deviceNumber) {
+			const { webAuthnManager } = this.context;
+			await webAuthnManager.setLastUser(accountId, deviceNumber);
+			await webAuthnManager.initializeCurrentUser(accountId, this.context.nearClient);
+			try {
+				await getLoginSession(this.context, accountId);
+			} catch {}
+		}
+		async tryShamirUnlock(rec, accountId, deviceNumber) {
+			if (!rec.serverEncryptedVrfKeypair || !rec.serverEncryptedVrfKeypair.serverKeyId || !this.context.configs.vrfWorkerConfigs?.shamir3pass?.relayServerUrl) return false;
+			try {
+				const { webAuthnManager } = this.context;
+				const unlockResult = await webAuthnManager.shamir3PassDecryptVrfKeypair({
+					nearAccountId: accountId,
+					kek_s_b64u: rec.serverEncryptedVrfKeypair.kek_s_b64u,
+					ciphertextVrfB64u: rec.serverEncryptedVrfKeypair.ciphertextVrfB64u,
+					serverKeyId: rec.serverEncryptedVrfKeypair.serverKeyId
+				});
+				if (!unlockResult.success) return false;
+				await this.assertVrfActiveForAccount(accountId, "VRF session inactive after Shamir3Pass unlock");
+				await this.finalizeLocalLoginState(accountId, deviceNumber);
+				return true;
+			} catch (err$1) {
+				console.warn("[EmailRecoveryFlow] Shamir 3-pass unlock failed, falling back to TouchID", err$1);
+				return false;
+			}
+		}
+		async tryTouchIdUnlock(rec, accountId, deviceNumber) {
+			try {
+				const { webAuthnManager } = this.context;
+				const authChallenge = createRandomVRFChallenge();
+				const storedCredentialId = String(rec.credential?.rawId || rec.credential?.id || "").trim();
+				const credentialIds = storedCredentialId ? [storedCredentialId] : [];
+				const authenticators = credentialIds.length > 0 ? [] : await webAuthnManager.getAuthenticatorsByUser(accountId);
+				const authCredential = await webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({
+					nearAccountId: accountId,
+					challenge: authChallenge,
+					credentialIds: credentialIds.length > 0 ? credentialIds : authenticators.map((a) => a.credentialId)
+				});
+				if (storedCredentialId && authCredential.rawId !== storedCredentialId) return {
+					success: false,
+					reason: "Wrong passkey selected during recovery auto-login; please use the newly recovered passkey."
+				};
+				const vrfUnlockResult = await webAuthnManager.unlockVRFKeypair({
+					nearAccountId: accountId,
+					encryptedVrfKeypair: rec.encryptedVrfKeypair,
+					credential: authCredential
+				});
+				if (!vrfUnlockResult.success) return {
+					success: false,
+					reason: vrfUnlockResult.error || "VRF unlock failed during auto-login"
+				};
+				await this.assertVrfActiveForAccount(accountId, "VRF session inactive after TouchID unlock");
+				await this.finalizeLocalLoginState(accountId, deviceNumber);
+				return { success: true };
+			} catch (err$1) {
+				return {
+					success: false,
+					reason: err$1?.message || String(err$1)
+				};
+			}
+		}
+		async handleAutoLoginFailure(reason, err$1) {
+			console.warn("[EmailRecoveryFlow] Auto-login failed after recovery", err$1 ?? reason);
+			try {
+				await this.context.webAuthnManager.clearVrfSession();
+			} catch {}
+			return {
+				success: false,
+				reason
+			};
+		}
+		async finalizeRegistration(rec) {
+			this.phase = EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION;
+			this.emit({
+				step: 5,
+				phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,
+				status: EmailRecoveryStatus.PROGRESS,
+				message: "Finalizing email recovery registration...",
+				data: {
+					accountId: rec.accountId,
+					nearPublicKey: rec.nearPublicKey
+				}
+			});
+			try {
+				const { nonceManager, accountId } = this.initializeNonceManager(rec);
+				const signedTx = await this.signRegistrationTx(rec, accountId);
+				const txHash = await this.broadcastRegistrationTxAndWaitFinal(rec, signedTx);
+				if (txHash) {
+					const storedUser = await this.persistRecoveredUserRecordBestEffort(rec, accountId);
+					if (storedUser) {
+						const syncedAuthenticators = await this.syncAuthenticatorsBestEffort(accountId);
+						if (syncedAuthenticators) await this.setLastUserBestEffort(accountId, rec.deviceNumber);
+					}
+				}
+				await this.updateNonceBestEffort(nonceManager, signedTx);
+				await this.persistRecoveredUserData(rec, accountId);
+				await this.persistAuthenticatorBestEffort(rec, accountId);
+				this.emitAutoLoginEvent(EmailRecoveryStatus.PROGRESS, "Attempting auto-login with recovered device...", { autoLogin: "progress" });
+				const autoLoginResult = await this.attemptAutoLogin(rec);
+				if (autoLoginResult.success) this.emitAutoLoginEvent(EmailRecoveryStatus.SUCCESS, `Welcome ${accountId}`, { autoLogin: "success" });
+				else this.emitAutoLoginEvent(EmailRecoveryStatus.ERROR, "Auto-login failed; please log in manually on this device.", {
+					error: autoLoginResult.reason,
+					autoLogin: "error"
+				});
+				await this.markCompleteAndClearPending(rec);
 				this.phase = EmailRecoveryPhase.STEP_6_COMPLETE;
 				this.emit({
 					step: 6,
@@ -10567,77 +10915,22 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 		}
 		async attemptAutoLogin(rec) {
 			try {
-				this.emit({
-					step: 5,
-					phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,
-					status: EmailRecoveryStatus.PROGRESS,
-					message: "Attempting auto-login with recovered device...",
-					data: { autoLogin: "progress" }
-				});
-				const { webAuthnManager } = this.context;
 				const accountId = toAccountId(rec.accountId);
-				if (rec.serverEncryptedVrfKeypair && rec.serverEncryptedVrfKeypair.serverKeyId && this.context.configs.vrfWorkerConfigs?.shamir3pass?.relayServerUrl) try {
-					const unlockResult = await webAuthnManager.shamir3PassDecryptVrfKeypair({
-						nearAccountId: accountId,
-						kek_s_b64u: rec.serverEncryptedVrfKeypair.kek_s_b64u,
-						ciphertextVrfB64u: rec.serverEncryptedVrfKeypair.ciphertextVrfB64u,
-						serverKeyId: rec.serverEncryptedVrfKeypair.serverKeyId
-					});
-					if (unlockResult.success) {
-						await webAuthnManager.initializeCurrentUser(accountId, this.context.nearClient);
-						await webAuthnManager.setLastUser(accountId, rec.deviceNumber);
-						this.emit({
-							step: 5,
-							phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,
-							status: EmailRecoveryStatus.SUCCESS,
-							message: `Welcome ${accountId}`,
-							data: { autoLogin: "success" }
-						});
-						return;
-					}
-				} catch (err$1) {
-					console.warn("[EmailRecoveryFlow] Shamir 3-pass unlock failed, falling back to TouchID", err$1);
-				}
-				const { txBlockHash, txBlockHeight } = await webAuthnManager.getNonceManager().getNonceBlockHashAndHeight(this.context.nearClient);
-				const authChallenge = await webAuthnManager.generateVrfChallengeOnce({
-					userId: accountId,
-					rpId: webAuthnManager.getRpId(),
-					blockHash: txBlockHash,
-					blockHeight: txBlockHeight
-				});
-				const authenticators = await webAuthnManager.getAuthenticatorsByUser(accountId);
-				const authCredential = await webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({
-					nearAccountId: accountId,
-					challenge: authChallenge,
-					credentialIds: authenticators.map((a) => a.credentialId)
-				});
-				const vrfUnlockResult = await webAuthnManager.unlockVRFKeypair({
-					nearAccountId: accountId,
-					encryptedVrfKeypair: rec.encryptedVrfKeypair,
-					credential: authCredential
-				});
-				if (!vrfUnlockResult.success) throw new Error(vrfUnlockResult.error || "VRF unlock failed during auto-login");
-				await webAuthnManager.initializeCurrentUser(accountId, this.context.nearClient);
-				await webAuthnManager.setLastUser(accountId, rec.deviceNumber);
-				this.emit({
-					step: 5,
-					phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,
-					status: EmailRecoveryStatus.SUCCESS,
-					message: `Welcome ${accountId}`,
-					data: { autoLogin: "success" }
-				});
+				const deviceNumber = parseDeviceNumber(rec.deviceNumber, { min: 1 });
+				if (deviceNumber === null) return this.handleAutoLoginFailure(`Invalid deviceNumber for auto-login: ${String(rec.deviceNumber)}`);
+				const shamirUnlocked = await this.tryShamirUnlock(rec, accountId, deviceNumber);
+				if (shamirUnlocked) return {
+					success: true,
+					method: "shamir"
+				};
+				const touchIdResult = await this.tryTouchIdUnlock(rec, accountId, deviceNumber);
+				if (touchIdResult.success) return {
+					success: true,
+					method: "touchid"
+				};
+				return this.handleAutoLoginFailure(touchIdResult.reason || "Auto-login failed");
 			} catch (err$1) {
-				console.warn("[EmailRecoveryFlow] Auto-login failed after recovery", err$1);
-				this.emit({
-					step: 5,
-					phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,
-					status: EmailRecoveryStatus.ERROR,
-					message: "Auto-login failed; please log in manually on this device.",
-					data: {
-						error: err$1?.message || String(err$1),
-						autoLogin: "error"
-					}
-				});
+				return this.handleAutoLoginFailure(err$1?.message || String(err$1), err$1);
 			}
 		}
 	};
@@ -10645,12 +10938,14 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 
 //#endregion
 //#region src/core/TatchiPasskey/index.ts
+init_login();
 init_sdkSentEvents();
 init_accountIds();
 init_IndexedDBManager();
 init_actions();
 init_errors();
 init_rpcCalls();
+init_EmailRecovery();
 init_defaultConfigs();
 let warnedAboutSameOriginWallet = false;
 /**
@@ -10707,7 +11002,7 @@ var TatchiPasskey = class {
 		} catch {}
 		if (!this.iframeRouter) {
 			if (!this.walletIframeInitInFlight) this.walletIframeInitInFlight = (async () => {
-				const { WalletIframeRouter } = await import("./router-BG6KC_p7.js");
+				const { WalletIframeRouter } = await import("./router-DuGYOd3G.js");
 				this.iframeRouter = new WalletIframeRouter({
 					walletOrigin,
 					servicePath: walletIframeConfig?.walletServicePath || "/wallet-service",
@@ -11795,6 +12090,30 @@ var TatchiPasskey = class {
 		});
 	}
 	/**
+	* Best-effort cancellation for an in-flight email recovery flow.
+	* Intended for UI "user cancelled sending email" / retry UX.
+	*/
+	async cancelEmailRecovery(args) {
+		const { accountId, nearPublicKey } = args || {};
+		if (this.shouldUseWalletIframe()) {
+			try {
+				const router = await this.requireWalletIframeRouter();
+				await router.stopEmailRecovery({
+					accountId,
+					nearPublicKey
+				});
+			} catch {}
+			return;
+		}
+		try {
+			await this.activeEmailRecoveryFlow?.cancelAndReset({
+				accountId,
+				nearPublicKey
+			});
+		} catch {}
+		this.activeEmailRecoveryFlow = null;
+	}
+	/**
 	* Device2: Start device linking flow
 	* Returns QR payload and data URL to render; emits onEvent during the flow.
 	* Runs inside iframe when available for better isolation.
@@ -12462,6 +12781,22 @@ function createWalletIframeHandlers(deps) {
 				requestId: req.requestId,
 				payload: { ok: true }
 			});
+		},
+		PM_STOP_EMAIL_RECOVERY: async (req) => {
+			const pm = getTatchiPasskey$1();
+			const { accountId, nearPublicKey } = req.payload || {};
+			try {
+				const maybeCancel = pm.cancelEmailRecovery;
+				if (typeof maybeCancel === "function") await maybeCancel.call(pm, {
+					accountId,
+					nearPublicKey
+				});
+			} catch {}
+			post$1({
+				type: "PM_RESULT",
+				requestId: req.requestId,
+				payload: { ok: true }
+			});
 		}
 	};
 }