@tatchi-xyz/sdk 0.17.0 → 0.18.0

package/dist/cjs/react/sdk/src/core/rpcCalls.js.map

@@ -1 +1 @@
-{"version":3,"file":"rpcCalls.js","names":["error: any","ActionType","ActionPhase","DeviceLinkingPhase","DeviceLinkingStatus","addKeyTxResult: FinalExecutionOutcome","storeDeviceLinkingTxResult: FinalExecutionOutcome","DEFAULT_WAIT_STATUS","txError: any","base64UrlEncode","DEFAULT_EMAIL_RECOVERY_CONTRACTS","base64UrlDecode","err: unknown","errorMessage"],"sources":["../../../../../../src/core/rpcCalls.ts"],"sourcesContent":["/**\n * Consolidated NEAR Contract Calls\n *\n * This file contains all the NEAR contract calls made to the web3authn contract\n * throughout the passkey SDK. It provides a centralized location for all\n * contract interactions and makes it easier to maintain and update contract\n * call patterns.\n */\n\nimport type { FinalExecutionOutcome } from '@near-js/types';\nimport type { NearClient, SignedTransaction } from './NearClient';\nimport type { ContractStoredAuthenticator } from './TatchiPasskey/recoverAccount';\nimport type { PasskeyManagerContext } from './TatchiPasskey';\nimport type { AccountId } from './types/accountIds';\nimport type { DeviceLinkingSSEEvent } from './types/sdkSentEvents';\nimport type {\n  StoredAuthenticator,\n  WebAuthnRegistrationCredential,\n  WebAuthnAuthenticationCredential\n} from './types/webauthn';\n\nimport { ActionPhase, DeviceLinkingPhase, DeviceLinkingStatus } from './types/sdkSentEvents';\nimport { ActionType, type ActionArgs } from './types/actions';\nimport { VRFChallenge } from './types/vrf-worker';\nimport { DEFAULT_WAIT_STATUS, TransactionContext } from './types/rpc';\nimport type { AuthenticatorOptions } from './types/authenticatorOptions';\nimport type { ConfirmationConfig } from './types/signer-worker';\nimport { base64UrlDecode, base64UrlEncode } from '../utils/encoders';\nimport { errorMessage } from '../utils/errors';\nimport type { EmailRecoveryContracts } from './types/tatchi';\nimport { DEFAULT_EMAIL_RECOVERY_CONTRACTS } from './defaultConfigs';\n\n// ===========================\n// CONTRACT CALL RESPONSES\n// ===========================\n\nexport interface DeviceLinkingResult {\n  linkedAccountId: string;\n  deviceNumber: number;\n}\n\nexport interface CredentialIdsResult {\n  credentialIds: string[];\n}\n\nexport interface AuthenticatorsResult {\n  authenticators: Array<[string, ContractStoredAuthenticator]>;\n}\n\n// ===========================\n// DEVICE LINKING CONTRACT CALLS\n// ===========================\n\n/**\n * Query the contract to get the account linked to a device public key\n * Used in device linking flow to check if a device key has been added\n *\n * NEAR does not provide a way to lookup the AccountID an access key has access to.\n * So we store a temporary mapping in the contract to lookup pubkey -> account ID.\n */\nexport async function getDeviceLinkingAccountContractCall(\n  nearClient: NearClient,\n  contractId: string,\n  devicePublicKey: string\n): Promise<DeviceLinkingResult | null> {\n  try {\n    const result = await nearClient.callFunction<\n      { device_public_key: string },\n      [string, number | string]\n    >(\n      contractId,\n      'get_device_linking_account',\n      { device_public_key: devicePublicKey }\n    );\n\n    // Handle different result formats\n    if (result && Array.isArray(result) && result.length >= 2) {\n      const [linkedAccountId, deviceNumberRaw] = result;\n      const deviceNumber = Number(deviceNumberRaw);\n      if (!Number.isSafeInteger(deviceNumber) || deviceNumber < 0) {\n        console.warn(\n          'Invalid deviceNumber returned from get_device_linking_account:',\n          deviceNumberRaw\n        );\n        return null;\n      }\n      return {\n        linkedAccountId,\n        deviceNumber\n      };\n    }\n\n    return null;\n  } catch (error: any) {\n    console.warn('Failed to get device linking account:', error.message);\n    return null;\n  }\n}\n\n// ===========================\n// DEVICE LINKING TRANSACTION CALLS\n// ===========================\n\n/**\n * Execute device1's linking transactions (AddKey + Contract mapping)\n * This function signs and broadcasts both transactions required for device linking\n */\nexport async function executeDeviceLinkingContractCalls({\n  context,\n  device1AccountId,\n  device2PublicKey,\n  nextNonce,\n  nextNextNonce,\n  nextNextNextNonce,\n  txBlockHash,\n  vrfChallenge,\n  onEvent,\n  confirmationConfigOverride,\n  confirmerText,\n}: {\n  context: PasskeyManagerContext,\n  device1AccountId: AccountId,\n  device2PublicKey: string,\n  nextNonce: string,\n  nextNextNonce: string,\n  nextNextNextNonce: string,\n  txBlockHash: string,\n  vrfChallenge: VRFChallenge,\n  onEvent?: (event: DeviceLinkingSSEEvent) => void;\n  confirmationConfigOverride?: Partial<ConfirmationConfig>;\n  confirmerText?: { title?: string; body?: string };\n}): Promise<{\n  addKeyTxResult: FinalExecutionOutcome;\n  storeDeviceLinkingTxResult: FinalExecutionOutcome;\n  signedDeleteKeyTransaction: SignedTransaction\n}> {\n\n  // Sign three transactions with one PRF authentication\n  const signedTransactions = await context.webAuthnManager.signTransactionsWithActions({\n    rpcCall: {\n      contractId: context.webAuthnManager.tatchiPasskeyConfigs.contractId,\n      nearRpcUrl: context.webAuthnManager.tatchiPasskeyConfigs.nearRpcUrl,\n      nearAccountId: device1AccountId\n    },\n    confirmationConfigOverride,\n    title: confirmerText?.title,\n    body: confirmerText?.body,\n    transactions: [\n      // Transaction 1: AddKey - Add Device2's key to Device1's account\n      {\n        receiverId: device1AccountId,\n        actions: [{\n          action_type: ActionType.AddKey,\n          public_key: device2PublicKey,\n          access_key: JSON.stringify({\n            // NEAR-style AccessKey JSON shape, matching near-api-js:\n            // { nonce: number, permission: { FullAccess: {} } }\n            nonce: 0,\n            permission: { FullAccess: {} },\n          }),\n        }],\n        nonce: nextNonce,\n      },\n      // Transaction 2: Store temporary mapping in contract so Device2 can lookup Device1's accountID.\n      {\n        receiverId: context.webAuthnManager.tatchiPasskeyConfigs.contractId,\n        actions: [{\n          action_type: ActionType.FunctionCall,\n          method_name: 'store_device_linking_mapping',\n          args: JSON.stringify({\n            device_public_key: device2PublicKey,\n            target_account_id: device1AccountId,\n          }),\n          gas: '30000000000000', // 30 TGas for device linking with yield promise automatic cleanup\n          deposit: '0'\n        }],\n        nonce: nextNextNonce,\n      },\n      // Transaction 3: Remove Device2's temporary key if it fails to complete linking after a timeout\n      {\n        receiverId: device1AccountId,\n        actions: [{\n          action_type: ActionType.DeleteKey,\n          public_key: device2PublicKey\n        }],\n        nonce: nextNextNextNonce,\n      }\n    ],\n    onEvent: (progress) => {\n      // Bridge all action progress events to the parent so the wallet iframe overlay\n      // can expand during user confirmation in wallet-iframe mode.\n      try { onEvent?.(progress as any); } catch { }\n      // Keep existing mapping for device linking semantics; surface signing as a loading state\n      if (progress.phase == ActionPhase.STEP_6_TRANSACTION_SIGNING_COMPLETE) {\n        onEvent?.({\n          step: 3,\n          phase: DeviceLinkingPhase.STEP_3_AUTHORIZATION,\n          status: DeviceLinkingStatus.PROGRESS,\n          message: progress.message || 'Transaction signing in progress...'\n        })\n      }\n    }\n  });\n\n  if (!signedTransactions[0].signedTransaction) {\n    throw new Error('AddKey transaction signing failed');\n  }\n  if (!signedTransactions[1].signedTransaction) {\n    throw new Error('Contract mapping transaction signing failed');\n  }\n  if (!signedTransactions[2].signedTransaction) {\n    throw new Error('DeleteKey transaction signing failed');\n  }\n\n  // Broadcast just the first 2 transactions: addKey and store device linking mapping\n  let addKeyTxResult: FinalExecutionOutcome;\n  let storeDeviceLinkingTxResult: FinalExecutionOutcome;\n  try {\n    console.debug('LinkDeviceFlow: AddKey transaction details:', {\n      receiverId: signedTransactions[0].signedTransaction.transaction.receiverId,\n      actions: signedTransactions[0].signedTransaction.transaction.actions || [],\n      transactionKeys: Object.keys(signedTransactions[0].signedTransaction.transaction),\n    });\n\n    addKeyTxResult = await context.nearClient.sendTransaction(\n      signedTransactions[0].signedTransaction,\n      DEFAULT_WAIT_STATUS.linkDeviceAddKey\n    );\n    console.log('LinkDeviceFlow: AddKey transaction result:', addKeyTxResult?.transaction?.hash);\n\n    // Send success events immediately after AddKey succeeds\n    onEvent?.({\n      step: 3,\n      phase: DeviceLinkingPhase.STEP_3_AUTHORIZATION,\n      status: DeviceLinkingStatus.SUCCESS,\n      message: `AddKey transaction completed successfully!`\n    });\n\n    // Check if contract mapping transaction is valid before attempting to broadcast\n    const contractTx = signedTransactions[1].signedTransaction;\n    console.log('LinkDeviceFlow: Contract mapping transaction details:', {\n      receiverId: contractTx.transaction.receiverId,\n      actions: (contractTx.transaction.actions || []).length\n    });\n\n    // Standard timeout since nonce conflict should be resolved by the 2s delay\n    storeDeviceLinkingTxResult = await context.nearClient.sendTransaction(\n      contractTx,\n      DEFAULT_WAIT_STATUS.linkDeviceAccountMapping\n    );\n\n  } catch (txError: any) {\n    console.error('LinkDeviceFlow: Transaction broadcasting failed:', txError);\n    throw new Error(`Transaction broadcasting failed: ${txError.message}`);\n  }\n\n  onEvent?.({\n    step: 6,\n    phase: DeviceLinkingPhase.STEP_6_REGISTRATION,\n    status: DeviceLinkingStatus.SUCCESS,\n    message: `Device linking completed successfully!`\n  });\n\n  return {\n    addKeyTxResult,\n    storeDeviceLinkingTxResult,\n    signedDeleteKeyTransaction: signedTransactions[2].signedTransaction\n  };\n}\n\n// ===========================\n// ACCOUNT RECOVERY CONTRACT CALLS\n// ===========================\n\n/**\n * Get credential IDs associated with an account from the contract\n * Used in account recovery to discover available credentials\n */\nexport async function getCredentialIdsContractCall(\n  nearClient: NearClient,\n  contractId: string,\n  accountId: AccountId\n): Promise<string[]> {\n  try {\n    const credentialIds = await nearClient.callFunction<{ account_id: AccountId }, string[]>(\n      contractId,\n      'get_credential_ids_by_account',\n      { account_id: accountId }\n    );\n    return credentialIds || [];\n  } catch (error: any) {\n    console.warn('Failed to fetch credential IDs from contract:', error.message);\n    return [];\n  }\n}\n\n/**\n * Get all authenticators stored for a user from the contract\n * Used in account recovery to sync authenticator data\n */\nexport async function getAuthenticatorsByUser(\n  nearClient: NearClient,\n  contractId: string,\n  accountId: AccountId\n): Promise<[string, ContractStoredAuthenticator][]> {\n  try {\n    const authenticatorsResult = await nearClient.view<{ user_id: AccountId }, [string, ContractStoredAuthenticator][]>({\n      account: contractId,\n      method: 'get_authenticators_by_user',\n      args: { user_id: accountId }\n    });\n\n    if (authenticatorsResult && Array.isArray(authenticatorsResult)) {\n      return authenticatorsResult;\n    }\n    return [];\n  } catch (error: any) {\n    console.warn('Failed to fetch authenticators from contract:', error.message);\n    return [];\n  }\n}\n\nexport async function syncAuthenticatorsContractCall(\n  nearClient: NearClient,\n  contractId: string,\n  accountId: AccountId\n): Promise<Array<{ credentialId: string, authenticator: StoredAuthenticator }>> {\n  try {\n    const authenticatorsResult = await getAuthenticatorsByUser(nearClient, contractId, accountId);\n    if (authenticatorsResult && Array.isArray(authenticatorsResult)) {\n      return authenticatorsResult.map(([credentialId, contractAuthenticator]) => {\n        console.log(`Contract authenticator device_number for ${credentialId}:`, contractAuthenticator.device_number);\n\n        const transports = Array.isArray(contractAuthenticator.transports)\n          ? contractAuthenticator.transports\n          : [];\n\n        const registered = (() => {\n          const raw = String((contractAuthenticator as any).registered ?? '');\n          if (!raw) return new Date(0);\n          if (/^\\d+$/.test(raw)) {\n            const ts = Number(raw);\n            return Number.isFinite(ts) ? new Date(ts) : new Date(0);\n          }\n          const d = new Date(raw);\n          return Number.isFinite(d.getTime()) ? d : new Date(0);\n        })();\n\n        const vrfPublicKeys = (() => {\n          const raw = (contractAuthenticator as any).vrf_public_keys;\n          if (!raw) return undefined;\n          if (Array.isArray(raw) && raw.length > 0 && typeof raw[0] === 'string') {\n            return raw as string[];\n          }\n          if (Array.isArray(raw)) {\n            return raw\n              .map((entry: unknown) => {\n                if (!entry) return null;\n                if (entry instanceof Uint8Array) return base64UrlEncode(entry);\n                if (Array.isArray(entry)) return base64UrlEncode(new Uint8Array(entry));\n                return null;\n              })\n              .filter((x): x is string => typeof x === 'string' && x.length > 0);\n          }\n          return undefined;\n        })();\n\n        return {\n          credentialId,\n          authenticator: {\n            credentialId,\n            credentialPublicKey: new Uint8Array(contractAuthenticator.credential_public_key),\n            transports,\n            userId: accountId,\n            name: `Device ${contractAuthenticator.device_number} Authenticator`,\n            registered,\n            // Store the actual device number from contract (no fallback)\n            deviceNumber: contractAuthenticator.device_number,\n            vrfPublicKeys\n          }\n        };\n      });\n    }\n    return [];\n  } catch (error: any) {\n    console.warn('Failed to fetch authenticators from contract:', error.message);\n    return [];\n  }\n}\n\n// ===========================\n// RECOVERY EMAIL CONTRACT CALLS\n// ===========================\n\n/**\n * Fetch on-chain recovery email hashes from the per-account contract.\n * Returns [] when no contract is deployed or on failure.\n */\nexport async function getRecoveryEmailHashesContractCall(\n  nearClient: NearClient,\n  accountId: AccountId\n): Promise<number[][]> {\n  try {\n    const code = await nearClient.viewCode(accountId);\n    const hasContract = !!code && code.byteLength > 0;\n    if (!hasContract) return [];\n\n    const hashes = await nearClient.view<Record<string, never>, number[][]>({\n      account: accountId,\n      method: 'get_recovery_emails',\n      args: {} as Record<string, never>,\n    });\n\n    return Array.isArray(hashes) ? (hashes as number[][]) : [];\n  } catch (error) {\n    console.error('[rpcCalls] Failed to fetch recovery email hashes', error);\n    return [];\n  }\n}\n\n/**\n * Build action args to update on-chain recovery emails for an account.\n * If the per-account contract is missing, deploy/attach the global recoverer via `init_email_recovery`.\n */\nexport async function buildSetRecoveryEmailsActions(\n  nearClient: NearClient,\n  accountId: AccountId,\n  recoveryEmailHashes: number[][],\n  contracts: EmailRecoveryContracts = DEFAULT_EMAIL_RECOVERY_CONTRACTS\n): Promise<ActionArgs[]> {\n  let hasContract = false;\n  try {\n    const code = await nearClient.viewCode(accountId);\n    hasContract = !!code && code.byteLength > 0;\n  } catch {\n    hasContract = false;\n  }\n\n  const {\n    emailRecovererGlobalContract,\n    zkEmailVerifierContract,\n    emailDkimVerifierContract,\n  } = contracts;\n\n  return hasContract\n    ? [\n        {\n          type: ActionType.UseGlobalContract,\n          accountId: emailRecovererGlobalContract,\n        },\n        {\n          type: ActionType.FunctionCall,\n          methodName: 'set_recovery_emails',\n          args: {\n            recovery_emails: recoveryEmailHashes,\n          },\n          gas: '80000000000000',\n          deposit: '0',\n        },\n      ]\n    : [\n        {\n          type: ActionType.UseGlobalContract,\n          accountId: emailRecovererGlobalContract,\n        },\n        {\n          type: ActionType.FunctionCall,\n          methodName: 'init_email_recovery',\n          args: {\n            zk_email_verifier: zkEmailVerifierContract,\n            email_dkim_verifier: emailDkimVerifierContract,\n            policy: null,\n            recovery_emails: recoveryEmailHashes,\n          },\n          gas: '80000000000000',\n          deposit: '0',\n        },\n      ];\n}\n\nexport async function fetchNonceBlockHashAndHeight({ nearClient, nearPublicKeyStr, nearAccountId }: {\n  nearClient: NearClient,\n  nearPublicKeyStr: string,\n  nearAccountId: AccountId\n}): Promise<TransactionContext> {\n  // Get access key and transaction block info concurrently\n  const [accessKeyInfo, txBlockInfo] = await Promise.all([\n    nearClient.viewAccessKey(nearAccountId, nearPublicKeyStr)\n      .catch(e => { throw new Error(`Failed to fetch Access Key`) }),\n    nearClient.viewBlock({ finality: 'final' })\n      .catch(e => { throw new Error(`Failed to fetch Block Info`) })\n  ]);\n  if (!accessKeyInfo || accessKeyInfo.nonce === undefined) {\n    throw new Error(`Access key not found or invalid for account ${nearAccountId} with public key ${nearPublicKeyStr}. Response: ${JSON.stringify(accessKeyInfo)}`);\n  }\n  const nextNonce = (BigInt(accessKeyInfo.nonce) + BigInt(1)).toString();\n  const txBlockHeight = String(txBlockInfo.header.height);\n  const txBlockHash = txBlockInfo.header.hash; // Keep original base58 string\n\n  return {\n    nearPublicKeyStr,\n    accessKeyInfo,\n    nextNonce,\n    txBlockHeight,\n    txBlockHash,\n  };\n}\n\n// ===========================\n// REGISTRATION PRE-CHECK CALL\n// ===========================\n\nexport interface CheckCanRegisterUserResult {\n  success: boolean;\n  verified: boolean;\n  logs: string[];\n  error?: string;\n}\n\n/**\n * View-only registration pre-check.\n *\n * Calls the contract's `check_can_register_user` view method with VRF data\n * derived from the provided VRF challenge and a serialized WebAuthn\n * registration credential (typically with PRF outputs embedded).\n */\nexport async function checkCanRegisterUserContractCall({\n  nearClient,\n  contractId,\n  vrfChallenge,\n  credential,\n  authenticatorOptions,\n}: {\n  nearClient: NearClient;\n  contractId: string;\n  vrfChallenge: VRFChallenge;\n  credential: WebAuthnRegistrationCredential;\n  authenticatorOptions?: AuthenticatorOptions;\n}): Promise<CheckCanRegisterUserResult> {\n  try {\n    const vrfData = {\n      vrf_input_data: Array.from(base64UrlDecode(vrfChallenge.vrfInput)),\n      vrf_output: Array.from(base64UrlDecode(vrfChallenge.vrfOutput)),\n      vrf_proof: Array.from(base64UrlDecode(vrfChallenge.vrfProof)),\n      public_key: Array.from(base64UrlDecode(vrfChallenge.vrfPublicKey)),\n      user_id: vrfChallenge.userId,\n      rp_id: vrfChallenge.rpId,\n      block_height: Number(vrfChallenge.blockHeight),\n      block_hash: Array.from(base64UrlDecode(vrfChallenge.blockHash)),\n    };\n\n    const args = {\n      vrf_data: vrfData,\n      webauthn_registration: credential,\n      authenticator_options: authenticatorOptions,\n    };\n\n    const response = await nearClient.callFunction<typeof args, any>(\n      contractId,\n      'check_can_register_user',\n      args,\n    );\n\n    const verified = !!response?.verified;\n    return {\n      success: true,\n      verified,\n      logs: [],\n      error: verified ? undefined : 'Contract registration check failed',\n    };\n  } catch (err: unknown) {\n    return {\n      success: false,\n      verified: false,\n      logs: [],\n      error: errorMessage(err) || 'Failed to call check_can_register_user',\n    };\n  }\n}\n\n\n/**\n * Verify authentication response through relay server\n * Routes the request to relay server which calls the web3authn contract for verification\n * and issues a JWT or session credential\n */\nexport async function verifyAuthenticationResponse(\n  relayServerUrl: string,\n  routePath: string,\n  sessionKind: 'jwt' | 'cookie',\n  vrfChallenge: VRFChallenge,\n  webauthnAuthentication: WebAuthnAuthenticationCredential\n): Promise<{\n  success: boolean;\n  verified?: boolean;\n  jwt?: string;\n  sessionCredential?: any;\n  error?: string;\n  contractResponse?: any;\n}> {\n  try {\n    // Map VRFChallenge into server ContractVrfData shape (number arrays)\n    const toBytes = (b64u: string | undefined): number[] => {\n      if (!b64u) return [];\n      return Array.from(base64UrlDecode(b64u));\n    };\n    const vrf_data = {\n      vrf_input_data: toBytes(vrfChallenge.vrfInput),\n      vrf_output: toBytes(vrfChallenge.vrfOutput),\n      vrf_proof: toBytes(vrfChallenge.vrfProof),\n      public_key: toBytes(vrfChallenge.vrfPublicKey),\n      user_id: vrfChallenge.userId,\n      rp_id: vrfChallenge.rpId,\n      block_height: Number(vrfChallenge.blockHeight || 0),\n      block_hash: toBytes(vrfChallenge.blockHash),\n    };\n\n    // Normalize authenticatorAttachment and userHandle to null for server schema\n    const webauthn_authentication = {\n      ...webauthnAuthentication,\n      authenticatorAttachment: webauthnAuthentication.authenticatorAttachment ?? null,\n      response: {\n        ...webauthnAuthentication.response,\n        userHandle: webauthnAuthentication.response.userHandle ?? null,\n      }\n    };\n\n    const url = `${relayServerUrl.replace(/\\/$/, '')}${routePath.startsWith('/') ? routePath : `/${routePath}`}`;\n    const response = await fetch(url, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n      },\n      credentials: sessionKind === 'cookie' ? 'include' : 'omit',\n      body: JSON.stringify({\n        sessionKind: sessionKind,\n        vrf_data,\n        webauthn_authentication,\n      }),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      return {\n        success: false,\n        error: `HTTP ${response.status}: ${errorText}`,\n      };\n    }\n\n    const result = await response.json();\n    return {\n      success: true,\n      verified: result.verified,\n      jwt: result.jwt,\n      sessionCredential: result.sessionCredential,\n      contractResponse: result.contractResponse,\n    };\n  } catch (error: any) {\n    return {\n      success: false,\n      error: error.message || 'Failed to verify authentication response',\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA4DA,eAAsB,oCACpB,YACA,YACA,iBACqC;AACrC,KAAI;EACF,MAAM,SAAS,MAAM,WAAW,aAI9B,YACA,8BACA,EAAE,mBAAmB;AAIvB,MAAI,UAAU,MAAM,QAAQ,WAAW,OAAO,UAAU,GAAG;GACzD,MAAM,CAAC,iBAAiB,mBAAmB;GAC3C,MAAM,eAAe,OAAO;AAC5B,OAAI,CAAC,OAAO,cAAc,iBAAiB,eAAe,GAAG;AAC3D,YAAQ,KACN,kEACA;AAEF,WAAO;;AAET,UAAO;IACL;IACA;;;AAIJ,SAAO;UACAA,OAAY;AACnB,UAAQ,KAAK,yCAAyC,MAAM;AAC5D,SAAO;;;;;;;AAYX,eAAsB,kCAAkC,EACtD,SACA,kBACA,kBACA,WACA,eACA,mBACA,aACA,cACA,SACA,4BACA,iBAiBC;CAGD,MAAM,qBAAqB,MAAM,QAAQ,gBAAgB,4BAA4B;EACnF,SAAS;GACP,YAAY,QAAQ,gBAAgB,qBAAqB;GACzD,YAAY,QAAQ,gBAAgB,qBAAqB;GACzD,eAAe;;EAEjB;EACA,OAAO,eAAe;EACtB,MAAM,eAAe;EACrB,cAAc;GAEZ;IACE,YAAY;IACZ,SAAS,CAAC;KACR,aAAaC,2BAAW;KACxB,YAAY;KACZ,YAAY,KAAK,UAAU;MAGzB,OAAO;MACP,YAAY,EAAE,YAAY;;;IAG9B,OAAO;;GAGT;IACE,YAAY,QAAQ,gBAAgB,qBAAqB;IACzD,SAAS,CAAC;KACR,aAAaA,2BAAW;KACxB,aAAa;KACb,MAAM,KAAK,UAAU;MACnB,mBAAmB;MACnB,mBAAmB;;KAErB,KAAK;KACL,SAAS;;IAEX,OAAO;;GAGT;IACE,YAAY;IACZ,SAAS,CAAC;KACR,aAAaA,2BAAW;KACxB,YAAY;;IAEd,OAAO;;;EAGX,UAAU,aAAa;AAGrB,OAAI;AAAE,cAAU;WAA0B;AAE1C,OAAI,SAAS,SAASC,kCAAY,oCAChC,WAAU;IACR,MAAM;IACN,OAAOC,yCAAmB;IAC1B,QAAQC,0CAAoB;IAC5B,SAAS,SAAS,WAAW;;;;AAMrC,KAAI,CAAC,mBAAmB,GAAG,kBACzB,OAAM,IAAI,MAAM;AAElB,KAAI,CAAC,mBAAmB,GAAG,kBACzB,OAAM,IAAI,MAAM;AAElB,KAAI,CAAC,mBAAmB,GAAG,kBACzB,OAAM,IAAI,MAAM;CAIlB,IAAIC;CACJ,IAAIC;AACJ,KAAI;AACF,UAAQ,MAAM,+CAA+C;GAC3D,YAAY,mBAAmB,GAAG,kBAAkB,YAAY;GAChE,SAAS,mBAAmB,GAAG,kBAAkB,YAAY,WAAW;GACxE,iBAAiB,OAAO,KAAK,mBAAmB,GAAG,kBAAkB;;AAGvE,mBAAiB,MAAM,QAAQ,WAAW,gBACxC,mBAAmB,GAAG,mBACtBC,gCAAoB;AAEtB,UAAQ,IAAI,8CAA8C,gBAAgB,aAAa;AAGvF,YAAU;GACR,MAAM;GACN,OAAOJ,yCAAmB;GAC1B,QAAQC,0CAAoB;GAC5B,SAAS;;EAIX,MAAM,aAAa,mBAAmB,GAAG;AACzC,UAAQ,IAAI,yDAAyD;GACnE,YAAY,WAAW,YAAY;GACnC,UAAU,WAAW,YAAY,WAAW,IAAI;;AAIlD,+BAA6B,MAAM,QAAQ,WAAW,gBACpD,YACAG,gCAAoB;UAGfC,SAAc;AACrB,UAAQ,MAAM,oDAAoD;AAClE,QAAM,IAAI,MAAM,oCAAoC,QAAQ;;AAG9D,WAAU;EACR,MAAM;EACN,OAAOL,yCAAmB;EAC1B,QAAQC,0CAAoB;EAC5B,SAAS;;AAGX,QAAO;EACL;EACA;EACA,4BAA4B,mBAAmB,GAAG;;;;;;;AAYtD,eAAsB,6BACpB,YACA,YACA,WACmB;AACnB,KAAI;EACF,MAAM,gBAAgB,MAAM,WAAW,aACrC,YACA,iCACA,EAAE,YAAY;AAEhB,SAAO,iBAAiB;UACjBJ,OAAY;AACnB,UAAQ,KAAK,iDAAiD,MAAM;AACpE,SAAO;;;;;;;AAQX,eAAsB,wBACpB,YACA,YACA,WACkD;AAClD,KAAI;EACF,MAAM,uBAAuB,MAAM,WAAW,KAAsE;GAClH,SAAS;GACT,QAAQ;GACR,MAAM,EAAE,SAAS;;AAGnB,MAAI,wBAAwB,MAAM,QAAQ,sBACxC,QAAO;AAET,SAAO;UACAA,OAAY;AACnB,UAAQ,KAAK,iDAAiD,MAAM;AACpE,SAAO;;;AAIX,eAAsB,+BACpB,YACA,YACA,WAC8E;AAC9E,KAAI;EACF,MAAM,uBAAuB,MAAM,wBAAwB,YAAY,YAAY;AACnF,MAAI,wBAAwB,MAAM,QAAQ,sBACxC,QAAO,qBAAqB,KAAK,CAAC,cAAc,2BAA2B;AACzE,WAAQ,IAAI,4CAA4C,aAAa,IAAI,sBAAsB;GAE/F,MAAM,aAAa,MAAM,QAAQ,sBAAsB,cACnD,sBAAsB,aACtB;GAEJ,MAAM,oBAAoB;IACxB,MAAM,MAAM,OAAQ,sBAA8B,cAAc;AAChE,QAAI,CAAC,IAAK,wBAAO,IAAI,KAAK;AAC1B,QAAI,QAAQ,KAAK,MAAM;KACrB,MAAM,KAAK,OAAO;AAClB,YAAO,OAAO,SAAS,MAAM,IAAI,KAAK,sBAAM,IAAI,KAAK;;IAEvD,MAAM,IAAI,IAAI,KAAK;AACnB,WAAO,OAAO,SAAS,EAAE,aAAa,oBAAI,IAAI,KAAK;;GAGrD,MAAM,uBAAuB;IAC3B,MAAM,MAAO,sBAA8B;AAC3C,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,MAAM,QAAQ,QAAQ,IAAI,SAAS,KAAK,OAAO,IAAI,OAAO,SAC5D,QAAO;AAET,QAAI,MAAM,QAAQ,KAChB,QAAO,IACJ,KAAK,UAAmB;AACvB,SAAI,CAAC,MAAO,QAAO;AACnB,SAAI,iBAAiB,WAAY,QAAOS,+BAAgB;AACxD,SAAI,MAAM,QAAQ,OAAQ,QAAOA,+BAAgB,IAAI,WAAW;AAChE,YAAO;OAER,QAAQ,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS;AAEpE,WAAO;;AAGT,UAAO;IACL;IACA,eAAe;KACb;KACA,qBAAqB,IAAI,WAAW,sBAAsB;KAC1D;KACA,QAAQ;KACR,MAAM,UAAU,sBAAsB,cAAc;KACpD;KAEA,cAAc,sBAAsB;KACpC;;;;AAKR,SAAO;UACAT,OAAY;AACnB,UAAQ,KAAK,iDAAiD,MAAM;AACpE,SAAO;;;;;;;AAYX,eAAsB,mCACpB,YACA,WACqB;AACrB,KAAI;EACF,MAAM,OAAO,MAAM,WAAW,SAAS;EACvC,MAAM,cAAc,CAAC,CAAC,QAAQ,KAAK,aAAa;AAChD,MAAI,CAAC,YAAa,QAAO;EAEzB,MAAM,SAAS,MAAM,WAAW,KAAwC;GACtE,SAAS;GACT,QAAQ;GACR,MAAM;;AAGR,SAAO,MAAM,QAAQ,UAAW,SAAwB;UACjD,OAAO;AACd,UAAQ,MAAM,oDAAoD;AAClE,SAAO;;;;;;;AAQX,eAAsB,8BACpB,YACA,WACA,qBACA,YAAoCU,yDACb;CACvB,IAAI,cAAc;AAClB,KAAI;EACF,MAAM,OAAO,MAAM,WAAW,SAAS;AACvC,gBAAc,CAAC,CAAC,QAAQ,KAAK,aAAa;SACpC;AACN,gBAAc;;CAGhB,MAAM,EACJ,8BACA,yBACA,8BACE;AAEJ,QAAO,cACH,CACE;EACE,MAAMT,2BAAW;EACjB,WAAW;IAEb;EACE,MAAMA,2BAAW;EACjB,YAAY;EACZ,MAAM,EACJ,iBAAiB;EAEnB,KAAK;EACL,SAAS;MAGb,CACE;EACE,MAAMA,2BAAW;EACjB,WAAW;IAEb;EACE,MAAMA,2BAAW;EACjB,YAAY;EACZ,MAAM;GACJ,mBAAmB;GACnB,qBAAqB;GACrB,QAAQ;GACR,iBAAiB;;EAEnB,KAAK;EACL,SAAS;;;;;;;;;;AAmDnB,eAAsB,iCAAiC,EACrD,YACA,YACA,cACA,YACA,wBAOsC;AACtC,KAAI;EACF,MAAM,UAAU;GACd,gBAAgB,MAAM,KAAKU,+BAAgB,aAAa;GACxD,YAAY,MAAM,KAAKA,+BAAgB,aAAa;GACpD,WAAW,MAAM,KAAKA,+BAAgB,aAAa;GACnD,YAAY,MAAM,KAAKA,+BAAgB,aAAa;GACpD,SAAS,aAAa;GACtB,OAAO,aAAa;GACpB,cAAc,OAAO,aAAa;GAClC,YAAY,MAAM,KAAKA,+BAAgB,aAAa;;EAGtD,MAAM,OAAO;GACX,UAAU;GACV,uBAAuB;GACvB,uBAAuB;;EAGzB,MAAM,WAAW,MAAM,WAAW,aAChC,YACA,2BACA;EAGF,MAAM,WAAW,CAAC,CAAC,UAAU;AAC7B,SAAO;GACL,SAAS;GACT;GACA,MAAM;GACN,OAAO,WAAW,SAAY;;UAEzBC,KAAc;AACrB,SAAO;GACL,SAAS;GACT,UAAU;GACV,MAAM;GACN,OAAOC,4BAAa,QAAQ;;;;;;;;;AAWlC,eAAsB,6BACpB,gBACA,WACA,aACA,cACA,wBAQC;AACD,KAAI;EAEF,MAAM,WAAW,SAAuC;AACtD,OAAI,CAAC,KAAM,QAAO;AAClB,UAAO,MAAM,KAAKF,+BAAgB;;EAEpC,MAAM,WAAW;GACf,gBAAgB,QAAQ,aAAa;GACrC,YAAY,QAAQ,aAAa;GACjC,WAAW,QAAQ,aAAa;GAChC,YAAY,QAAQ,aAAa;GACjC,SAAS,aAAa;GACtB,OAAO,aAAa;GACpB,cAAc,OAAO,aAAa,eAAe;GACjD,YAAY,QAAQ,aAAa;;EAInC,MAAM,0BAA0B;GAC9B,GAAG;GACH,yBAAyB,uBAAuB,2BAA2B;GAC3E,UAAU;IACR,GAAG,uBAAuB;IAC1B,YAAY,uBAAuB,SAAS,cAAc;;;EAI9D,MAAM,MAAM,GAAG,eAAe,QAAQ,OAAO,MAAM,UAAU,WAAW,OAAO,YAAY,IAAI;EAC/F,MAAM,WAAW,MAAM,MAAM,KAAK;GAChC,QAAQ;GACR,SAAS,EACP,gBAAgB;GAElB,aAAa,gBAAgB,WAAW,YAAY;GACpD,MAAM,KAAK,UAAU;IACN;IACb;IACA;;;AAIJ,MAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAY,MAAM,SAAS;AACjC,UAAO;IACL,SAAS;IACT,OAAO,QAAQ,SAAS,OAAO,IAAI;;;EAIvC,MAAM,SAAS,MAAM,SAAS;AAC9B,SAAO;GACL,SAAS;GACT,UAAU,OAAO;GACjB,KAAK,OAAO;GACZ,mBAAmB,OAAO;GAC1B,kBAAkB,OAAO;;UAEpBX,OAAY;AACnB,SAAO;GACL,SAAS;GACT,OAAO,MAAM,WAAW"}
+{"version":3,"file":"rpcCalls.js","names":["error: any","ActionType","ActionPhase","DeviceLinkingPhase","DeviceLinkingStatus","addKeyTxResult: FinalExecutionOutcome","storeDeviceLinkingTxResult: FinalExecutionOutcome","DEFAULT_WAIT_STATUS","txError: any","base64UrlEncode","DEFAULT_EMAIL_RECOVERY_CONTRACTS","base64UrlDecode","err: unknown","errorMessage"],"sources":["../../../../../../src/core/rpcCalls.ts"],"sourcesContent":["/**\n * Consolidated NEAR Contract Calls\n *\n * This file contains all the NEAR contract calls made to the web3authn contract\n * throughout the passkey SDK. It provides a centralized location for all\n * contract interactions and makes it easier to maintain and update contract\n * call patterns.\n */\n\nimport type { FinalExecutionOutcome } from '@near-js/types';\nimport type { NearClient, SignedTransaction } from './NearClient';\nimport type { ContractStoredAuthenticator } from './TatchiPasskey/recoverAccount';\nimport type { PasskeyManagerContext } from './TatchiPasskey';\nimport type { AccountId } from './types/accountIds';\nimport type { DeviceLinkingSSEEvent } from './types/sdkSentEvents';\nimport type {\n  StoredAuthenticator,\n  WebAuthnRegistrationCredential,\n  WebAuthnAuthenticationCredential\n} from './types/webauthn';\n\nimport { ActionPhase, DeviceLinkingPhase, DeviceLinkingStatus } from './types/sdkSentEvents';\nimport { ActionType, type ActionArgs } from './types/actions';\nimport { VRFChallenge } from './types/vrf-worker';\nimport { DEFAULT_WAIT_STATUS, TransactionContext } from './types/rpc';\nimport type { AuthenticatorOptions } from './types/authenticatorOptions';\nimport type { ConfirmationConfig } from './types/signer-worker';\nimport { base64UrlDecode, base64UrlEncode } from '../utils/encoders';\nimport { errorMessage } from '../utils/errors';\nimport type { EmailRecoveryContracts } from './types/tatchi';\nimport { DEFAULT_EMAIL_RECOVERY_CONTRACTS } from './defaultConfigs';\n\n// ===========================\n// CONTRACT CALL RESPONSES\n// ===========================\n\nexport interface DeviceLinkingResult {\n  linkedAccountId: string;\n  deviceNumber: number;\n}\n\nexport interface CredentialIdsResult {\n  credentialIds: string[];\n}\n\nexport interface AuthenticatorsResult {\n  authenticators: Array<[string, ContractStoredAuthenticator]>;\n}\n\nexport type EmailRecoveryVerificationResult = {\n  verified: boolean;\n  account_id?: string;\n  new_public_key?: string;\n  transaction_hash?: string;\n  error_code?: string;\n  error_message?: string;\n};\n\nexport async function getEmailRecoveryVerificationResult(\n  nearClient: NearClient,\n  dkimVerifierAccountId: string,\n  verificationViewMethod: string,\n  requestId: string\n): Promise<EmailRecoveryVerificationResult | null> {\n  return await nearClient.view<{ request_id: string }, EmailRecoveryVerificationResult | null>({\n    account: dkimVerifierAccountId,\n    method: verificationViewMethod,\n    args: { request_id: requestId },\n  });\n}\n\n// ===========================\n// DEVICE LINKING CONTRACT CALLS\n// ===========================\n\n/**\n * Query the contract to get the account linked to a device public key\n * Used in device linking flow to check if a device key has been added\n *\n * NEAR does not provide a way to lookup the AccountID an access key has access to.\n * So we store a temporary mapping in the contract to lookup pubkey -> account ID.\n */\nexport async function getDeviceLinkingAccountContractCall(\n  nearClient: NearClient,\n  contractId: string,\n  devicePublicKey: string\n): Promise<DeviceLinkingResult | null> {\n  try {\n    const result = await nearClient.callFunction<\n      { device_public_key: string },\n      [string, number | string]\n    >(\n      contractId,\n      'get_device_linking_account',\n      { device_public_key: devicePublicKey }\n    );\n\n    // Handle different result formats\n    if (result && Array.isArray(result) && result.length >= 2) {\n      const [linkedAccountId, deviceNumberRaw] = result;\n      const deviceNumber = Number(deviceNumberRaw);\n      if (!Number.isSafeInteger(deviceNumber) || deviceNumber < 0) {\n        console.warn(\n          'Invalid deviceNumber returned from get_device_linking_account:',\n          deviceNumberRaw\n        );\n        return null;\n      }\n      return {\n        linkedAccountId,\n        deviceNumber\n      };\n    }\n\n    return null;\n  } catch (error: any) {\n    console.warn('Failed to get device linking account:', error.message);\n    return null;\n  }\n}\n\n// ===========================\n// DEVICE LINKING TRANSACTION CALLS\n// ===========================\n\n/**\n * Execute device1's linking transactions (AddKey + Contract mapping)\n * This function signs and broadcasts both transactions required for device linking\n */\nexport async function executeDeviceLinkingContractCalls({\n  context,\n  device1AccountId,\n  device2PublicKey,\n  nextNonce,\n  nextNextNonce,\n  nextNextNextNonce,\n  txBlockHash,\n  vrfChallenge,\n  onEvent,\n  confirmationConfigOverride,\n  confirmerText,\n}: {\n  context: PasskeyManagerContext,\n  device1AccountId: AccountId,\n  device2PublicKey: string,\n  nextNonce: string,\n  nextNextNonce: string,\n  nextNextNextNonce: string,\n  txBlockHash: string,\n  vrfChallenge: VRFChallenge,\n  onEvent?: (event: DeviceLinkingSSEEvent) => void;\n  confirmationConfigOverride?: Partial<ConfirmationConfig>;\n  confirmerText?: { title?: string; body?: string };\n}): Promise<{\n  addKeyTxResult: FinalExecutionOutcome;\n  storeDeviceLinkingTxResult: FinalExecutionOutcome;\n  signedDeleteKeyTransaction: SignedTransaction\n}> {\n\n  // Sign three transactions with one PRF authentication\n  const signedTransactions = await context.webAuthnManager.signTransactionsWithActions({\n    rpcCall: {\n      contractId: context.webAuthnManager.tatchiPasskeyConfigs.contractId,\n      nearRpcUrl: context.webAuthnManager.tatchiPasskeyConfigs.nearRpcUrl,\n      nearAccountId: device1AccountId\n    },\n    confirmationConfigOverride,\n    title: confirmerText?.title,\n    body: confirmerText?.body,\n    transactions: [\n      // Transaction 1: AddKey - Add Device2's key to Device1's account\n      {\n        receiverId: device1AccountId,\n        actions: [{\n          action_type: ActionType.AddKey,\n          public_key: device2PublicKey,\n          access_key: JSON.stringify({\n            // NEAR-style AccessKey JSON shape, matching near-api-js:\n            // { nonce: number, permission: { FullAccess: {} } }\n            nonce: 0,\n            permission: { FullAccess: {} },\n          }),\n        }],\n        nonce: nextNonce,\n      },\n      // Transaction 2: Store temporary mapping in contract so Device2 can lookup Device1's accountID.\n      {\n        receiverId: context.webAuthnManager.tatchiPasskeyConfigs.contractId,\n        actions: [{\n          action_type: ActionType.FunctionCall,\n          method_name: 'store_device_linking_mapping',\n          args: JSON.stringify({\n            device_public_key: device2PublicKey,\n            target_account_id: device1AccountId,\n          }),\n          gas: '30000000000000', // 30 TGas for device linking with yield promise automatic cleanup\n          deposit: '0'\n        }],\n        nonce: nextNextNonce,\n      },\n      // Transaction 3: Remove Device2's temporary key if it fails to complete linking after a timeout\n      {\n        receiverId: device1AccountId,\n        actions: [{\n          action_type: ActionType.DeleteKey,\n          public_key: device2PublicKey\n        }],\n        nonce: nextNextNextNonce,\n      }\n    ],\n    onEvent: (progress) => {\n      // Bridge all action progress events to the parent so the wallet iframe overlay\n      // can expand during user confirmation in wallet-iframe mode.\n      try { onEvent?.(progress as any); } catch { }\n      // Keep existing mapping for device linking semantics; surface signing as a loading state\n      if (progress.phase == ActionPhase.STEP_6_TRANSACTION_SIGNING_COMPLETE) {\n        onEvent?.({\n          step: 3,\n          phase: DeviceLinkingPhase.STEP_3_AUTHORIZATION,\n          status: DeviceLinkingStatus.PROGRESS,\n          message: progress.message || 'Transaction signing in progress...'\n        })\n      }\n    }\n  });\n\n  if (!signedTransactions[0].signedTransaction) {\n    throw new Error('AddKey transaction signing failed');\n  }\n  if (!signedTransactions[1].signedTransaction) {\n    throw new Error('Contract mapping transaction signing failed');\n  }\n  if (!signedTransactions[2].signedTransaction) {\n    throw new Error('DeleteKey transaction signing failed');\n  }\n\n  // Broadcast just the first 2 transactions: addKey and store device linking mapping\n  let addKeyTxResult: FinalExecutionOutcome;\n  let storeDeviceLinkingTxResult: FinalExecutionOutcome;\n  try {\n    console.debug('LinkDeviceFlow: AddKey transaction details:', {\n      receiverId: signedTransactions[0].signedTransaction.transaction.receiverId,\n      actions: signedTransactions[0].signedTransaction.transaction.actions || [],\n      transactionKeys: Object.keys(signedTransactions[0].signedTransaction.transaction),\n    });\n\n    addKeyTxResult = await context.nearClient.sendTransaction(\n      signedTransactions[0].signedTransaction,\n      DEFAULT_WAIT_STATUS.linkDeviceAddKey\n    );\n    console.log('LinkDeviceFlow: AddKey transaction result:', addKeyTxResult?.transaction?.hash);\n\n    // Send success events immediately after AddKey succeeds\n    onEvent?.({\n      step: 3,\n      phase: DeviceLinkingPhase.STEP_3_AUTHORIZATION,\n      status: DeviceLinkingStatus.SUCCESS,\n      message: `AddKey transaction completed successfully!`\n    });\n\n    // Check if contract mapping transaction is valid before attempting to broadcast\n    const contractTx = signedTransactions[1].signedTransaction;\n    console.log('LinkDeviceFlow: Contract mapping transaction details:', {\n      receiverId: contractTx.transaction.receiverId,\n      actions: (contractTx.transaction.actions || []).length\n    });\n\n    // Standard timeout since nonce conflict should be resolved by the 2s delay\n    storeDeviceLinkingTxResult = await context.nearClient.sendTransaction(\n      contractTx,\n      DEFAULT_WAIT_STATUS.linkDeviceAccountMapping\n    );\n\n  } catch (txError: any) {\n    console.error('LinkDeviceFlow: Transaction broadcasting failed:', txError);\n    throw new Error(`Transaction broadcasting failed: ${txError.message}`);\n  }\n\n  onEvent?.({\n    step: 6,\n    phase: DeviceLinkingPhase.STEP_6_REGISTRATION,\n    status: DeviceLinkingStatus.SUCCESS,\n    message: `Device linking completed successfully!`\n  });\n\n  return {\n    addKeyTxResult,\n    storeDeviceLinkingTxResult,\n    signedDeleteKeyTransaction: signedTransactions[2].signedTransaction\n  };\n}\n\n// ===========================\n// ACCOUNT RECOVERY CONTRACT CALLS\n// ===========================\n\n/**\n * Get credential IDs associated with an account from the contract\n * Used in account recovery to discover available credentials\n */\nexport async function getCredentialIdsContractCall(\n  nearClient: NearClient,\n  contractId: string,\n  accountId: AccountId\n): Promise<string[]> {\n  try {\n    const credentialIds = await nearClient.callFunction<{ account_id: AccountId }, string[]>(\n      contractId,\n      'get_credential_ids_by_account',\n      { account_id: accountId }\n    );\n    return credentialIds || [];\n  } catch (error: any) {\n    console.warn('Failed to fetch credential IDs from contract:', error.message);\n    return [];\n  }\n}\n\n/**\n * Get all authenticators stored for a user from the contract\n * Used in account recovery to sync authenticator data\n */\nexport async function getAuthenticatorsByUser(\n  nearClient: NearClient,\n  contractId: string,\n  accountId: AccountId\n): Promise<[string, ContractStoredAuthenticator][]> {\n  try {\n    const authenticatorsResult = await nearClient.view<{ user_id: AccountId }, [string, ContractStoredAuthenticator][]>({\n      account: contractId,\n      method: 'get_authenticators_by_user',\n      args: { user_id: accountId }\n    });\n\n    if (authenticatorsResult && Array.isArray(authenticatorsResult)) {\n      return authenticatorsResult;\n    }\n    return [];\n  } catch (error: any) {\n    console.warn('Failed to fetch authenticators from contract:', error.message);\n    return [];\n  }\n}\n\nexport async function syncAuthenticatorsContractCall(\n  nearClient: NearClient,\n  contractId: string,\n  accountId: AccountId\n): Promise<Array<{ credentialId: string, authenticator: StoredAuthenticator }>> {\n  try {\n    const authenticatorsResult = await getAuthenticatorsByUser(nearClient, contractId, accountId);\n    if (authenticatorsResult && Array.isArray(authenticatorsResult)) {\n      return authenticatorsResult.map(([credentialId, contractAuthenticator]) => {\n        console.log(`Contract authenticator device_number for ${credentialId}:`, contractAuthenticator.device_number);\n\n        const transports = Array.isArray(contractAuthenticator.transports)\n          ? contractAuthenticator.transports\n          : [];\n\n        const registered = (() => {\n          const raw = String((contractAuthenticator as any).registered ?? '');\n          if (!raw) return new Date(0);\n          if (/^\\d+$/.test(raw)) {\n            const ts = Number(raw);\n            return Number.isFinite(ts) ? new Date(ts) : new Date(0);\n          }\n          const d = new Date(raw);\n          return Number.isFinite(d.getTime()) ? d : new Date(0);\n        })();\n\n        const vrfPublicKeys = (() => {\n          const raw = (contractAuthenticator as any).vrf_public_keys;\n          if (!raw) return undefined;\n          if (Array.isArray(raw) && raw.length > 0 && typeof raw[0] === 'string') {\n            return raw as string[];\n          }\n          if (Array.isArray(raw)) {\n            return raw\n              .map((entry: unknown) => {\n                if (!entry) return null;\n                if (entry instanceof Uint8Array) return base64UrlEncode(entry);\n                if (Array.isArray(entry)) return base64UrlEncode(new Uint8Array(entry));\n                return null;\n              })\n              .filter((x): x is string => typeof x === 'string' && x.length > 0);\n          }\n          return undefined;\n        })();\n\n        return {\n          credentialId,\n          authenticator: {\n            credentialId,\n            credentialPublicKey: new Uint8Array(contractAuthenticator.credential_public_key),\n            transports,\n            userId: accountId,\n            name: `Device ${contractAuthenticator.device_number} Authenticator`,\n            registered,\n            // Store the actual device number from contract (no fallback)\n            deviceNumber: contractAuthenticator.device_number,\n            vrfPublicKeys\n          }\n        };\n      });\n    }\n    return [];\n  } catch (error: any) {\n    console.warn('Failed to fetch authenticators from contract:', error.message);\n    return [];\n  }\n}\n\n// ===========================\n// RECOVERY EMAIL CONTRACT CALLS\n// ===========================\n\n/**\n * Fetch on-chain recovery email hashes from the per-account contract.\n * Returns [] when no contract is deployed or on failure.\n */\nexport async function getRecoveryEmailHashesContractCall(\n  nearClient: NearClient,\n  accountId: AccountId\n): Promise<number[][]> {\n  try {\n    const code = await nearClient.viewCode(accountId);\n    const hasContract = !!code && code.byteLength > 0;\n    if (!hasContract) return [];\n\n    const hashes = await nearClient.view<Record<string, never>, number[][]>({\n      account: accountId,\n      method: 'get_recovery_emails',\n      args: {} as Record<string, never>,\n    });\n\n    return Array.isArray(hashes) ? (hashes as number[][]) : [];\n  } catch (error) {\n    console.error('[rpcCalls] Failed to fetch recovery email hashes', error);\n    return [];\n  }\n}\n\n/**\n * Build action args to update on-chain recovery emails for an account.\n * If the per-account contract is missing, deploy/attach the global recoverer via `init_email_recovery`.\n */\nexport async function buildSetRecoveryEmailsActions(\n  nearClient: NearClient,\n  accountId: AccountId,\n  recoveryEmailHashes: number[][],\n  contracts: EmailRecoveryContracts = DEFAULT_EMAIL_RECOVERY_CONTRACTS\n): Promise<ActionArgs[]> {\n  let hasContract = false;\n  try {\n    const code = await nearClient.viewCode(accountId);\n    hasContract = !!code && code.byteLength > 0;\n  } catch {\n    hasContract = false;\n  }\n\n  const {\n    emailRecovererGlobalContract,\n    zkEmailVerifierContract,\n    emailDkimVerifierContract,\n  } = contracts;\n\n  return hasContract\n    ? [\n        {\n          type: ActionType.UseGlobalContract,\n          accountId: emailRecovererGlobalContract,\n        },\n        {\n          type: ActionType.FunctionCall,\n          methodName: 'set_recovery_emails',\n          args: {\n            recovery_emails: recoveryEmailHashes,\n          },\n          gas: '80000000000000',\n          deposit: '0',\n        },\n      ]\n    : [\n        {\n          type: ActionType.UseGlobalContract,\n          accountId: emailRecovererGlobalContract,\n        },\n        {\n          type: ActionType.FunctionCall,\n          methodName: 'init_email_recovery',\n          args: {\n            zk_email_verifier: zkEmailVerifierContract,\n            email_dkim_verifier: emailDkimVerifierContract,\n            policy: null,\n            recovery_emails: recoveryEmailHashes,\n          },\n          gas: '80000000000000',\n          deposit: '0',\n        },\n      ];\n}\n\nexport async function fetchNonceBlockHashAndHeight({ nearClient, nearPublicKeyStr, nearAccountId }: {\n  nearClient: NearClient,\n  nearPublicKeyStr: string,\n  nearAccountId: AccountId\n}): Promise<TransactionContext> {\n  // Get access key and transaction block info concurrently\n  const [accessKeyInfo, txBlockInfo] = await Promise.all([\n    nearClient.viewAccessKey(nearAccountId, nearPublicKeyStr)\n      .catch(e => { throw new Error(`Failed to fetch Access Key`) }),\n    nearClient.viewBlock({ finality: 'final' })\n      .catch(e => { throw new Error(`Failed to fetch Block Info`) })\n  ]);\n  if (!accessKeyInfo || accessKeyInfo.nonce === undefined) {\n    throw new Error(`Access key not found or invalid for account ${nearAccountId} with public key ${nearPublicKeyStr}. Response: ${JSON.stringify(accessKeyInfo)}`);\n  }\n  const nextNonce = (BigInt(accessKeyInfo.nonce) + BigInt(1)).toString();\n  const txBlockHeight = String(txBlockInfo.header.height);\n  const txBlockHash = txBlockInfo.header.hash; // Keep original base58 string\n\n  return {\n    nearPublicKeyStr,\n    accessKeyInfo,\n    nextNonce,\n    txBlockHeight,\n    txBlockHash,\n  };\n}\n\n// ===========================\n// REGISTRATION PRE-CHECK CALL\n// ===========================\n\nexport interface CheckCanRegisterUserResult {\n  success: boolean;\n  verified: boolean;\n  logs: string[];\n  error?: string;\n}\n\n/**\n * View-only registration pre-check.\n *\n * Calls the contract's `check_can_register_user` view method with VRF data\n * derived from the provided VRF challenge and a serialized WebAuthn\n * registration credential (typically with PRF outputs embedded).\n */\nexport async function checkCanRegisterUserContractCall({\n  nearClient,\n  contractId,\n  vrfChallenge,\n  credential,\n  authenticatorOptions,\n}: {\n  nearClient: NearClient;\n  contractId: string;\n  vrfChallenge: VRFChallenge;\n  credential: WebAuthnRegistrationCredential;\n  authenticatorOptions?: AuthenticatorOptions;\n}): Promise<CheckCanRegisterUserResult> {\n  try {\n    const vrfData = {\n      vrf_input_data: Array.from(base64UrlDecode(vrfChallenge.vrfInput)),\n      vrf_output: Array.from(base64UrlDecode(vrfChallenge.vrfOutput)),\n      vrf_proof: Array.from(base64UrlDecode(vrfChallenge.vrfProof)),\n      public_key: Array.from(base64UrlDecode(vrfChallenge.vrfPublicKey)),\n      user_id: vrfChallenge.userId,\n      rp_id: vrfChallenge.rpId,\n      block_height: Number(vrfChallenge.blockHeight),\n      block_hash: Array.from(base64UrlDecode(vrfChallenge.blockHash)),\n    };\n\n    const args = {\n      vrf_data: vrfData,\n      webauthn_registration: credential,\n      authenticator_options: authenticatorOptions,\n    };\n\n    const response = await nearClient.callFunction<typeof args, any>(\n      contractId,\n      'check_can_register_user',\n      args,\n    );\n\n    const verified = !!response?.verified;\n    return {\n      success: true,\n      verified,\n      logs: [],\n      error: verified ? undefined : 'Contract registration check failed',\n    };\n  } catch (err: unknown) {\n    return {\n      success: false,\n      verified: false,\n      logs: [],\n      error: errorMessage(err) || 'Failed to call check_can_register_user',\n    };\n  }\n}\n\n\n/**\n * Verify authentication response through relay server\n * Routes the request to relay server which calls the web3authn contract for verification\n * and issues a JWT or session credential\n */\nexport async function verifyAuthenticationResponse(\n  relayServerUrl: string,\n  routePath: string,\n  sessionKind: 'jwt' | 'cookie',\n  vrfChallenge: VRFChallenge,\n  webauthnAuthentication: WebAuthnAuthenticationCredential\n): Promise<{\n  success: boolean;\n  verified?: boolean;\n  jwt?: string;\n  sessionCredential?: any;\n  error?: string;\n  contractResponse?: any;\n}> {\n  try {\n    // Map VRFChallenge into server ContractVrfData shape (number arrays)\n    const toBytes = (b64u: string | undefined): number[] => {\n      if (!b64u) return [];\n      return Array.from(base64UrlDecode(b64u));\n    };\n    const vrf_data = {\n      vrf_input_data: toBytes(vrfChallenge.vrfInput),\n      vrf_output: toBytes(vrfChallenge.vrfOutput),\n      vrf_proof: toBytes(vrfChallenge.vrfProof),\n      public_key: toBytes(vrfChallenge.vrfPublicKey),\n      user_id: vrfChallenge.userId,\n      rp_id: vrfChallenge.rpId,\n      block_height: Number(vrfChallenge.blockHeight || 0),\n      block_hash: toBytes(vrfChallenge.blockHash),\n    };\n\n    // Normalize authenticatorAttachment and userHandle to null for server schema\n    const webauthn_authentication = {\n      ...webauthnAuthentication,\n      authenticatorAttachment: webauthnAuthentication.authenticatorAttachment ?? null,\n      response: {\n        ...webauthnAuthentication.response,\n        userHandle: webauthnAuthentication.response.userHandle ?? null,\n      }\n    };\n\n    const url = `${relayServerUrl.replace(/\\/$/, '')}${routePath.startsWith('/') ? routePath : `/${routePath}`}`;\n    const response = await fetch(url, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n      },\n      credentials: sessionKind === 'cookie' ? 'include' : 'omit',\n      body: JSON.stringify({\n        sessionKind: sessionKind,\n        vrf_data,\n        webauthn_authentication,\n      }),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      return {\n        success: false,\n        error: `HTTP ${response.status}: ${errorText}`,\n      };\n    }\n\n    const result = await response.json();\n    return {\n      success: true,\n      verified: result.verified,\n      jwt: result.jwt,\n      sessionCredential: result.sessionCredential,\n      contractResponse: result.contractResponse,\n    };\n  } catch (error: any) {\n    return {\n      success: false,\n      error: error.message || 'Failed to verify authentication response',\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;AA0DA,eAAsB,mCACpB,YACA,uBACA,wBACA,WACiD;AACjD,QAAO,MAAM,WAAW,KAAqE;EAC3F,SAAS;EACT,QAAQ;EACR,MAAM,EAAE,YAAY;;;;;;;;;;AAexB,eAAsB,oCACpB,YACA,YACA,iBACqC;AACrC,KAAI;EACF,MAAM,SAAS,MAAM,WAAW,aAI9B,YACA,8BACA,EAAE,mBAAmB;AAIvB,MAAI,UAAU,MAAM,QAAQ,WAAW,OAAO,UAAU,GAAG;GACzD,MAAM,CAAC,iBAAiB,mBAAmB;GAC3C,MAAM,eAAe,OAAO;AAC5B,OAAI,CAAC,OAAO,cAAc,iBAAiB,eAAe,GAAG;AAC3D,YAAQ,KACN,kEACA;AAEF,WAAO;;AAET,UAAO;IACL;IACA;;;AAIJ,SAAO;UACAA,OAAY;AACnB,UAAQ,KAAK,yCAAyC,MAAM;AAC5D,SAAO;;;;;;;AAYX,eAAsB,kCAAkC,EACtD,SACA,kBACA,kBACA,WACA,eACA,mBACA,aACA,cACA,SACA,4BACA,iBAiBC;CAGD,MAAM,qBAAqB,MAAM,QAAQ,gBAAgB,4BAA4B;EACnF,SAAS;GACP,YAAY,QAAQ,gBAAgB,qBAAqB;GACzD,YAAY,QAAQ,gBAAgB,qBAAqB;GACzD,eAAe;;EAEjB;EACA,OAAO,eAAe;EACtB,MAAM,eAAe;EACrB,cAAc;GAEZ;IACE,YAAY;IACZ,SAAS,CAAC;KACR,aAAaC,2BAAW;KACxB,YAAY;KACZ,YAAY,KAAK,UAAU;MAGzB,OAAO;MACP,YAAY,EAAE,YAAY;;;IAG9B,OAAO;;GAGT;IACE,YAAY,QAAQ,gBAAgB,qBAAqB;IACzD,SAAS,CAAC;KACR,aAAaA,2BAAW;KACxB,aAAa;KACb,MAAM,KAAK,UAAU;MACnB,mBAAmB;MACnB,mBAAmB;;KAErB,KAAK;KACL,SAAS;;IAEX,OAAO;;GAGT;IACE,YAAY;IACZ,SAAS,CAAC;KACR,aAAaA,2BAAW;KACxB,YAAY;;IAEd,OAAO;;;EAGX,UAAU,aAAa;AAGrB,OAAI;AAAE,cAAU;WAA0B;AAE1C,OAAI,SAAS,SAASC,kCAAY,oCAChC,WAAU;IACR,MAAM;IACN,OAAOC,yCAAmB;IAC1B,QAAQC,0CAAoB;IAC5B,SAAS,SAAS,WAAW;;;;AAMrC,KAAI,CAAC,mBAAmB,GAAG,kBACzB,OAAM,IAAI,MAAM;AAElB,KAAI,CAAC,mBAAmB,GAAG,kBACzB,OAAM,IAAI,MAAM;AAElB,KAAI,CAAC,mBAAmB,GAAG,kBACzB,OAAM,IAAI,MAAM;CAIlB,IAAIC;CACJ,IAAIC;AACJ,KAAI;AACF,UAAQ,MAAM,+CAA+C;GAC3D,YAAY,mBAAmB,GAAG,kBAAkB,YAAY;GAChE,SAAS,mBAAmB,GAAG,kBAAkB,YAAY,WAAW;GACxE,iBAAiB,OAAO,KAAK,mBAAmB,GAAG,kBAAkB;;AAGvE,mBAAiB,MAAM,QAAQ,WAAW,gBACxC,mBAAmB,GAAG,mBACtBC,gCAAoB;AAEtB,UAAQ,IAAI,8CAA8C,gBAAgB,aAAa;AAGvF,YAAU;GACR,MAAM;GACN,OAAOJ,yCAAmB;GAC1B,QAAQC,0CAAoB;GAC5B,SAAS;;EAIX,MAAM,aAAa,mBAAmB,GAAG;AACzC,UAAQ,IAAI,yDAAyD;GACnE,YAAY,WAAW,YAAY;GACnC,UAAU,WAAW,YAAY,WAAW,IAAI;;AAIlD,+BAA6B,MAAM,QAAQ,WAAW,gBACpD,YACAG,gCAAoB;UAGfC,SAAc;AACrB,UAAQ,MAAM,oDAAoD;AAClE,QAAM,IAAI,MAAM,oCAAoC,QAAQ;;AAG9D,WAAU;EACR,MAAM;EACN,OAAOL,yCAAmB;EAC1B,QAAQC,0CAAoB;EAC5B,SAAS;;AAGX,QAAO;EACL;EACA;EACA,4BAA4B,mBAAmB,GAAG;;;;;;;AAYtD,eAAsB,6BACpB,YACA,YACA,WACmB;AACnB,KAAI;EACF,MAAM,gBAAgB,MAAM,WAAW,aACrC,YACA,iCACA,EAAE,YAAY;AAEhB,SAAO,iBAAiB;UACjBJ,OAAY;AACnB,UAAQ,KAAK,iDAAiD,MAAM;AACpE,SAAO;;;;;;;AAQX,eAAsB,wBACpB,YACA,YACA,WACkD;AAClD,KAAI;EACF,MAAM,uBAAuB,MAAM,WAAW,KAAsE;GAClH,SAAS;GACT,QAAQ;GACR,MAAM,EAAE,SAAS;;AAGnB,MAAI,wBAAwB,MAAM,QAAQ,sBACxC,QAAO;AAET,SAAO;UACAA,OAAY;AACnB,UAAQ,KAAK,iDAAiD,MAAM;AACpE,SAAO;;;AAIX,eAAsB,+BACpB,YACA,YACA,WAC8E;AAC9E,KAAI;EACF,MAAM,uBAAuB,MAAM,wBAAwB,YAAY,YAAY;AACnF,MAAI,wBAAwB,MAAM,QAAQ,sBACxC,QAAO,qBAAqB,KAAK,CAAC,cAAc,2BAA2B;AACzE,WAAQ,IAAI,4CAA4C,aAAa,IAAI,sBAAsB;GAE/F,MAAM,aAAa,MAAM,QAAQ,sBAAsB,cACnD,sBAAsB,aACtB;GAEJ,MAAM,oBAAoB;IACxB,MAAM,MAAM,OAAQ,sBAA8B,cAAc;AAChE,QAAI,CAAC,IAAK,wBAAO,IAAI,KAAK;AAC1B,QAAI,QAAQ,KAAK,MAAM;KACrB,MAAM,KAAK,OAAO;AAClB,YAAO,OAAO,SAAS,MAAM,IAAI,KAAK,sBAAM,IAAI,KAAK;;IAEvD,MAAM,IAAI,IAAI,KAAK;AACnB,WAAO,OAAO,SAAS,EAAE,aAAa,oBAAI,IAAI,KAAK;;GAGrD,MAAM,uBAAuB;IAC3B,MAAM,MAAO,sBAA8B;AAC3C,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,MAAM,QAAQ,QAAQ,IAAI,SAAS,KAAK,OAAO,IAAI,OAAO,SAC5D,QAAO;AAET,QAAI,MAAM,QAAQ,KAChB,QAAO,IACJ,KAAK,UAAmB;AACvB,SAAI,CAAC,MAAO,QAAO;AACnB,SAAI,iBAAiB,WAAY,QAAOS,+BAAgB;AACxD,SAAI,MAAM,QAAQ,OAAQ,QAAOA,+BAAgB,IAAI,WAAW;AAChE,YAAO;OAER,QAAQ,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS;AAEpE,WAAO;;AAGT,UAAO;IACL;IACA,eAAe;KACb;KACA,qBAAqB,IAAI,WAAW,sBAAsB;KAC1D;KACA,QAAQ;KACR,MAAM,UAAU,sBAAsB,cAAc;KACpD;KAEA,cAAc,sBAAsB;KACpC;;;;AAKR,SAAO;UACAT,OAAY;AACnB,UAAQ,KAAK,iDAAiD,MAAM;AACpE,SAAO;;;;;;;AAYX,eAAsB,mCACpB,YACA,WACqB;AACrB,KAAI;EACF,MAAM,OAAO,MAAM,WAAW,SAAS;EACvC,MAAM,cAAc,CAAC,CAAC,QAAQ,KAAK,aAAa;AAChD,MAAI,CAAC,YAAa,QAAO;EAEzB,MAAM,SAAS,MAAM,WAAW,KAAwC;GACtE,SAAS;GACT,QAAQ;GACR,MAAM;;AAGR,SAAO,MAAM,QAAQ,UAAW,SAAwB;UACjD,OAAO;AACd,UAAQ,MAAM,oDAAoD;AAClE,SAAO;;;;;;;AAQX,eAAsB,8BACpB,YACA,WACA,qBACA,YAAoCU,yDACb;CACvB,IAAI,cAAc;AAClB,KAAI;EACF,MAAM,OAAO,MAAM,WAAW,SAAS;AACvC,gBAAc,CAAC,CAAC,QAAQ,KAAK,aAAa;SACpC;AACN,gBAAc;;CAGhB,MAAM,EACJ,8BACA,yBACA,8BACE;AAEJ,QAAO,cACH,CACE;EACE,MAAMT,2BAAW;EACjB,WAAW;IAEb;EACE,MAAMA,2BAAW;EACjB,YAAY;EACZ,MAAM,EACJ,iBAAiB;EAEnB,KAAK;EACL,SAAS;MAGb,CACE;EACE,MAAMA,2BAAW;EACjB,WAAW;IAEb;EACE,MAAMA,2BAAW;EACjB,YAAY;EACZ,MAAM;GACJ,mBAAmB;GACnB,qBAAqB;GACrB,QAAQ;GACR,iBAAiB;;EAEnB,KAAK;EACL,SAAS;;;;;;;;;;AAmDnB,eAAsB,iCAAiC,EACrD,YACA,YACA,cACA,YACA,wBAOsC;AACtC,KAAI;EACF,MAAM,UAAU;GACd,gBAAgB,MAAM,KAAKU,+BAAgB,aAAa;GACxD,YAAY,MAAM,KAAKA,+BAAgB,aAAa;GACpD,WAAW,MAAM,KAAKA,+BAAgB,aAAa;GACnD,YAAY,MAAM,KAAKA,+BAAgB,aAAa;GACpD,SAAS,aAAa;GACtB,OAAO,aAAa;GACpB,cAAc,OAAO,aAAa;GAClC,YAAY,MAAM,KAAKA,+BAAgB,aAAa;;EAGtD,MAAM,OAAO;GACX,UAAU;GACV,uBAAuB;GACvB,uBAAuB;;EAGzB,MAAM,WAAW,MAAM,WAAW,aAChC,YACA,2BACA;EAGF,MAAM,WAAW,CAAC,CAAC,UAAU;AAC7B,SAAO;GACL,SAAS;GACT;GACA,MAAM;GACN,OAAO,WAAW,SAAY;;UAEzBC,KAAc;AACrB,SAAO;GACL,SAAS;GACT,UAAU;GACV,MAAM;GACN,OAAOC,4BAAa,QAAQ;;;;;;;;;AAWlC,eAAsB,6BACpB,gBACA,WACA,aACA,cACA,wBAQC;AACD,KAAI;EAEF,MAAM,WAAW,SAAuC;AACtD,OAAI,CAAC,KAAM,QAAO;AAClB,UAAO,MAAM,KAAKF,+BAAgB;;EAEpC,MAAM,WAAW;GACf,gBAAgB,QAAQ,aAAa;GACrC,YAAY,QAAQ,aAAa;GACjC,WAAW,QAAQ,aAAa;GAChC,YAAY,QAAQ,aAAa;GACjC,SAAS,aAAa;GACtB,OAAO,aAAa;GACpB,cAAc,OAAO,aAAa,eAAe;GACjD,YAAY,QAAQ,aAAa;;EAInC,MAAM,0BAA0B;GAC9B,GAAG;GACH,yBAAyB,uBAAuB,2BAA2B;GAC3E,UAAU;IACR,GAAG,uBAAuB;IAC1B,YAAY,uBAAuB,SAAS,cAAc;;;EAI9D,MAAM,MAAM,GAAG,eAAe,QAAQ,OAAO,MAAM,UAAU,WAAW,OAAO,YAAY,IAAI;EAC/F,MAAM,WAAW,MAAM,MAAM,KAAK;GAChC,QAAQ;GACR,SAAS,EACP,gBAAgB;GAElB,aAAa,gBAAgB,WAAW,YAAY;GACpD,MAAM,KAAK,UAAU;IACN;IACb;IACA;;;AAIJ,MAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAY,MAAM,SAAS;AACjC,UAAO;IACL,SAAS;IACT,OAAO,QAAQ,SAAS,OAAO,IAAI;;;EAIvC,MAAM,SAAS,MAAM,SAAS;AAC9B,SAAO;GACL,SAAS;GACT,UAAU,OAAO;GACjB,KAAK,OAAO;GACZ,mBAAmB,OAAO;GAC1B,kBAAkB,OAAO;;UAEpBX,OAAY;AACnB,SAAO;GACL,SAAS;GACT,OAAO,MAAM,WAAW"}

package/dist/esm/core/EmailRecovery/emailRecoveryPendingStore.js

@@ -0,0 +1,63 @@
+import { __esm } from "../../_virtual/rolldown_runtime.js";
+import { IndexedDBManager, init_IndexedDBManager } from "../IndexedDBManager/index.js";
+
+//#region src/core/EmailRecovery/emailRecoveryPendingStore.ts
+var EmailRecoveryPendingStore;
+var init_emailRecoveryPendingStore = __esm({ "src/core/EmailRecovery/emailRecoveryPendingStore.ts": (() => {
+	init_IndexedDBManager();
+	EmailRecoveryPendingStore = class {
+		getPendingTtlMs;
+		now;
+		constructor(options) {
+			this.getPendingTtlMs = options.getPendingTtlMs;
+			this.now = options.now ?? Date.now;
+		}
+		getPendingIndexKey(accountId) {
+			return `pendingEmailRecovery:${accountId}`;
+		}
+		getPendingRecordKey(accountId, nearPublicKey) {
+			return `${this.getPendingIndexKey(accountId)}:${nearPublicKey}`;
+		}
+		async get(accountId, nearPublicKey) {
+			const pendingTtlMs = this.getPendingTtlMs();
+			const indexKey = this.getPendingIndexKey(accountId);
+			const indexedNearPublicKey = await IndexedDBManager.clientDB.getAppState(indexKey);
+			const resolvedNearPublicKey = nearPublicKey ?? indexedNearPublicKey;
+			if (!resolvedNearPublicKey) return null;
+			const recordKey = this.getPendingRecordKey(accountId, resolvedNearPublicKey);
+			const record = await IndexedDBManager.clientDB.getAppState(recordKey);
+			const shouldClearIndex = indexedNearPublicKey === resolvedNearPublicKey;
+			if (!record) {
+				if (shouldClearIndex) await IndexedDBManager.clientDB.setAppState(indexKey, void 0).catch(() => {});
+				return null;
+			}
+			if (this.now() - record.createdAt > pendingTtlMs) {
+				await IndexedDBManager.clientDB.setAppState(recordKey, void 0).catch(() => {});
+				if (shouldClearIndex) await IndexedDBManager.clientDB.setAppState(indexKey, void 0).catch(() => {});
+				return null;
+			}
+			await this.touchIndex(accountId, record.nearPublicKey);
+			return record;
+		}
+		async set(record) {
+			const key = this.getPendingRecordKey(record.accountId, record.nearPublicKey);
+			await IndexedDBManager.clientDB.setAppState(key, record);
+			await this.touchIndex(record.accountId, record.nearPublicKey);
+		}
+		async clear(accountId, nearPublicKey) {
+			const indexKey = this.getPendingIndexKey(accountId);
+			const idx = await IndexedDBManager.clientDB.getAppState(indexKey).catch(() => void 0);
+			const resolvedNearPublicKey = nearPublicKey || idx || "";
+			if (resolvedNearPublicKey) await IndexedDBManager.clientDB.setAppState(this.getPendingRecordKey(accountId, resolvedNearPublicKey), void 0).catch(() => {});
+			if (!nearPublicKey || idx === nearPublicKey) await IndexedDBManager.clientDB.setAppState(indexKey, void 0).catch(() => {});
+		}
+		async touchIndex(accountId, nearPublicKey) {
+			await IndexedDBManager.clientDB.setAppState(this.getPendingIndexKey(accountId), nearPublicKey).catch(() => {});
+		}
+	};
+}) });
+
+//#endregion
+init_emailRecoveryPendingStore();
+export { EmailRecoveryPendingStore, init_emailRecoveryPendingStore };
+//# sourceMappingURL=emailRecoveryPendingStore.js.map

package/dist/esm/core/EmailRecovery/emailRecoveryPendingStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailRecoveryPendingStore.js","names":[],"sources":["../../../../src/core/EmailRecovery/emailRecoveryPendingStore.ts"],"sourcesContent":["import { IndexedDBManager } from '../IndexedDBManager';\nimport type { AccountId } from '../types/accountIds';\nimport type { PendingEmailRecovery } from '../TatchiPasskey/emailRecovery';\n\nexport interface PendingStore {\n  get(accountId: AccountId, nearPublicKey?: string): Promise<PendingEmailRecovery | null>;\n  set(record: PendingEmailRecovery): Promise<void>;\n  clear(accountId: AccountId, nearPublicKey?: string): Promise<void>;\n  touchIndex(accountId: AccountId, nearPublicKey: string): Promise<void>;\n}\n\ntype EmailRecoveryPendingStoreOptions = {\n  getPendingTtlMs: () => number;\n  now?: () => number;\n};\n\nexport class EmailRecoveryPendingStore implements PendingStore {\n  private getPendingTtlMs: () => number;\n  private now: () => number;\n\n  constructor(options: EmailRecoveryPendingStoreOptions) {\n    this.getPendingTtlMs = options.getPendingTtlMs;\n    this.now = options.now ?? Date.now;\n  }\n\n  private getPendingIndexKey(accountId: AccountId): string {\n    return `pendingEmailRecovery:${accountId}`;\n  }\n\n  private getPendingRecordKey(accountId: AccountId, nearPublicKey: string): string {\n    return `${this.getPendingIndexKey(accountId)}:${nearPublicKey}`;\n  }\n\n  async get(accountId: AccountId, nearPublicKey?: string): Promise<PendingEmailRecovery | null> {\n    const pendingTtlMs = this.getPendingTtlMs();\n    const indexKey = this.getPendingIndexKey(accountId);\n    const indexedNearPublicKey = await IndexedDBManager.clientDB.getAppState<string>(indexKey);\n    const resolvedNearPublicKey = nearPublicKey ?? indexedNearPublicKey;\n    if (!resolvedNearPublicKey) {\n      return null;\n    }\n\n    const recordKey = this.getPendingRecordKey(accountId, resolvedNearPublicKey);\n    const record = await IndexedDBManager.clientDB.getAppState<PendingEmailRecovery>(recordKey);\n    const shouldClearIndex = indexedNearPublicKey === resolvedNearPublicKey;\n    if (!record) {\n      if (shouldClearIndex) {\n        await IndexedDBManager.clientDB.setAppState(indexKey, undefined as any).catch(() => { });\n      }\n      return null;\n    }\n\n    if (this.now() - record.createdAt > pendingTtlMs) {\n      await IndexedDBManager.clientDB.setAppState(recordKey, undefined as any).catch(() => { });\n      if (shouldClearIndex) {\n        await IndexedDBManager.clientDB.setAppState(indexKey, undefined as any).catch(() => { });\n      }\n      return null;\n    }\n\n    await this.touchIndex(accountId, record.nearPublicKey);\n    return record;\n  }\n\n  async set(record: PendingEmailRecovery): Promise<void> {\n    const key = this.getPendingRecordKey(record.accountId, record.nearPublicKey);\n    await IndexedDBManager.clientDB.setAppState(key, record);\n    await this.touchIndex(record.accountId, record.nearPublicKey);\n  }\n\n  async clear(accountId: AccountId, nearPublicKey?: string): Promise<void> {\n    const indexKey = this.getPendingIndexKey(accountId);\n    const idx = await IndexedDBManager.clientDB.getAppState<string>(indexKey).catch(() => undefined);\n\n    const resolvedNearPublicKey = nearPublicKey || idx || '';\n    if (resolvedNearPublicKey) {\n      await IndexedDBManager.clientDB\n        .setAppState(this.getPendingRecordKey(accountId, resolvedNearPublicKey), undefined as any)\n        .catch(() => { });\n    }\n\n    if (!nearPublicKey || idx === nearPublicKey) {\n      await IndexedDBManager.clientDB.setAppState(indexKey, undefined as any).catch(() => { });\n    }\n  }\n\n  async touchIndex(accountId: AccountId, nearPublicKey: string): Promise<void> {\n    await IndexedDBManager.clientDB.setAppState(this.getPendingIndexKey(accountId), nearPublicKey).catch(() => { });\n  }\n}\n"],"mappings":";;;;;;;CAgBa,4BAAb,MAA+D;EAC7D,AAAQ;EACR,AAAQ;EAER,YAAY,SAA2C;AACrD,QAAK,kBAAkB,QAAQ;AAC/B,QAAK,MAAM,QAAQ,OAAO,KAAK;;EAGjC,AAAQ,mBAAmB,WAA8B;AACvD,UAAO,wBAAwB;;EAGjC,AAAQ,oBAAoB,WAAsB,eAA+B;AAC/E,UAAO,GAAG,KAAK,mBAAmB,WAAW,GAAG;;EAGlD,MAAM,IAAI,WAAsB,eAA8D;GAC5F,MAAM,eAAe,KAAK;GAC1B,MAAM,WAAW,KAAK,mBAAmB;GACzC,MAAM,uBAAuB,MAAM,iBAAiB,SAAS,YAAoB;GACjF,MAAM,wBAAwB,iBAAiB;AAC/C,OAAI,CAAC,sBACH,QAAO;GAGT,MAAM,YAAY,KAAK,oBAAoB,WAAW;GACtD,MAAM,SAAS,MAAM,iBAAiB,SAAS,YAAkC;GACjF,MAAM,mBAAmB,yBAAyB;AAClD,OAAI,CAAC,QAAQ;AACX,QAAI,iBACF,OAAM,iBAAiB,SAAS,YAAY,UAAU,QAAkB,YAAY;AAEtF,WAAO;;AAGT,OAAI,KAAK,QAAQ,OAAO,YAAY,cAAc;AAChD,UAAM,iBAAiB,SAAS,YAAY,WAAW,QAAkB,YAAY;AACrF,QAAI,iBACF,OAAM,iBAAiB,SAAS,YAAY,UAAU,QAAkB,YAAY;AAEtF,WAAO;;AAGT,SAAM,KAAK,WAAW,WAAW,OAAO;AACxC,UAAO;;EAGT,MAAM,IAAI,QAA6C;GACrD,MAAM,MAAM,KAAK,oBAAoB,OAAO,WAAW,OAAO;AAC9D,SAAM,iBAAiB,SAAS,YAAY,KAAK;AACjD,SAAM,KAAK,WAAW,OAAO,WAAW,OAAO;;EAGjD,MAAM,MAAM,WAAsB,eAAuC;GACvE,MAAM,WAAW,KAAK,mBAAmB;GACzC,MAAM,MAAM,MAAM,iBAAiB,SAAS,YAAoB,UAAU,YAAY;GAEtF,MAAM,wBAAwB,iBAAiB,OAAO;AACtD,OAAI,sBACF,OAAM,iBAAiB,SACpB,YAAY,KAAK,oBAAoB,WAAW,wBAAwB,QACxE,YAAY;AAGjB,OAAI,CAAC,iBAAiB,QAAQ,cAC5B,OAAM,iBAAiB,SAAS,YAAY,UAAU,QAAkB,YAAY;;EAIxF,MAAM,WAAW,WAAsB,eAAsC;AAC3E,SAAM,iBAAiB,SAAS,YAAY,KAAK,mBAAmB,YAAY,eAAe,YAAY"}

package/dist/esm/core/EmailRecovery/index.js

@@ -1,27 +1,9 @@
+import { __esm } from "../../_virtual/rolldown_runtime.js";
 import { init_accountIds, toAccountId } from "../types/accountIds.js";
 import { IndexedDBManager, init_IndexedDBManager } from "../IndexedDBManager/index.js";
+import { EmailRecoveryPendingStore, init_emailRecoveryPendingStore } from "./emailRecoveryPendingStore.js";
 
 //#region src/core/EmailRecovery/index.ts
-init_accountIds();
-init_IndexedDBManager();
-const canonicalizeEmail = (email) => {
-	const raw = String(email || "").trim();
-	if (!raw) return "";
-	const withoutHeaderName = raw.replace(/^[a-z0-9-]+\s*:\s*/i, "").trim();
-	const emailRegex = /([a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*)/;
-	const angleMatch = withoutHeaderName.match(/<([^>]+)>/);
-	const candidates = [angleMatch?.[1], withoutHeaderName].filter((v) => typeof v === "string" && v.length > 0);
-	for (const candidate of candidates) {
-		const cleaned = candidate.replace(/^mailto:\s*/i, "");
-		const match = cleaned.match(emailRegex);
-		if (match?.[1]) return match[1].trim().toLowerCase();
-	}
-	return withoutHeaderName.toLowerCase();
-};
-const bytesToHex = (bytes) => {
-	const arr = bytes instanceof Uint8Array ? bytes : Uint8Array.from(bytes);
-	return `0x${Array.from(arr).map((b) => b.toString(16).padStart(2, "0")).join("")}`;
-};
 async function hashRecoveryEmails(emails, accountId) {
 	const encoder = new TextEncoder();
 	const salt = (accountId || "").trim().toLowerCase();
@@ -68,7 +50,32 @@ async function prepareRecoveryEmails(nearAccountId, recoveryEmails) {
 async function getLocalRecoveryEmails(nearAccountId) {
 	return IndexedDBManager.getRecoveryEmails(nearAccountId);
 }
+var canonicalizeEmail, bytesToHex;
+var init_EmailRecovery = __esm({ "src/core/EmailRecovery/index.ts": (() => {
+	init_accountIds();
+	init_IndexedDBManager();
+	init_emailRecoveryPendingStore();
+	canonicalizeEmail = (email) => {
+		const raw = String(email || "").trim();
+		if (!raw) return "";
+		const withoutHeaderName = raw.replace(/^[a-z0-9-]+\s*:\s*/i, "").trim();
+		const emailRegex = /([a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*)/;
+		const angleMatch = withoutHeaderName.match(/<([^>]+)>/);
+		const candidates = [angleMatch?.[1], withoutHeaderName].filter((v) => typeof v === "string" && v.length > 0);
+		for (const candidate of candidates) {
+			const cleaned = candidate.replace(/^mailto:\s*/i, "");
+			const match = cleaned.match(emailRegex);
+			if (match?.[1]) return match[1].trim().toLowerCase();
+		}
+		return withoutHeaderName.toLowerCase();
+	};
+	bytesToHex = (bytes) => {
+		const arr = bytes instanceof Uint8Array ? bytes : Uint8Array.from(bytes);
+		return `0x${Array.from(arr).map((b) => b.toString(16).padStart(2, "0")).join("")}`;
+	};
+}) });
 
 //#endregion
-export { bytesToHex, getLocalRecoveryEmails, prepareRecoveryEmails };
+init_EmailRecovery();
+export { bytesToHex, getLocalRecoveryEmails, init_EmailRecovery, prepareRecoveryEmails };
 //# sourceMappingURL=index.js.map

package/dist/esm/core/EmailRecovery/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["hashed: number[][]","pairs: RecoveryEmailEntry[]"],"sources":["../../../../src/core/EmailRecovery/index.ts"],"sourcesContent":["import type { AccountId } from '../types/accountIds';\nimport { toAccountId } from '../types/accountIds';\nimport { IndexedDBManager, type RecoveryEmailRecord } from '../IndexedDBManager';\n\nexport type RecoveryEmailEntry = {\n  hashHex: string;\n  email: string;\n};\n\nexport { type RecoveryEmailRecord };\n\nexport const canonicalizeEmail = (email: string): string => {\n  const raw = String(email || '').trim();\n  if (!raw) return '';\n\n  // Handle cases where a full header line is passed in (e.g. \"From: ...\").\n  const withoutHeaderName = raw.replace(/^[a-z0-9-]+\\s*:\\s*/i, '').trim();\n\n  const emailRegex =\n    /([a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\\.[a-zA-Z0-9-]+)*)/;\n\n  // Prefer the common \"Name <email@domain>\" format when present, but still\n  // validate/extract the actual address via regex.\n  const angleMatch = withoutHeaderName.match(/<([^>]+)>/);\n  const candidates = [\n    angleMatch?.[1],\n    withoutHeaderName,\n  ].filter((v): v is string => typeof v === 'string' && v.length > 0);\n\n  for (const candidate of candidates) {\n    const cleaned = candidate.replace(/^mailto:\\s*/i, '');\n    const match = cleaned.match(emailRegex);\n    if (match?.[1]) {\n      return match[1].trim().toLowerCase();\n    }\n  }\n\n  return withoutHeaderName.toLowerCase();\n};\n\nexport const bytesToHex = (bytes: number[] | Uint8Array): string => {\n  const arr = bytes instanceof Uint8Array ? bytes : Uint8Array.from(bytes);\n  return `0x${Array.from(arr)\n    .map(b => b.toString(16).padStart(2, '0'))\n    .join('')}`;\n};\n\nasync function hashRecoveryEmails(emails: string[], accountId: AccountId): Promise<number[][]> {\n  const encoder = new TextEncoder();\n  const salt = (accountId || '').trim().toLowerCase();\n  const normalized = (emails || [])\n    .map(e => e.trim())\n    .filter(e => e.length > 0);\n\n  const hashed: number[][] = [];\n\n  for (const email of normalized) {\n    try {\n      const canonicalEmail = canonicalizeEmail(email);\n      const input = `${canonicalEmail}|${salt}`;\n      const data = encoder.encode(input);\n      const digest = await crypto.subtle.digest('SHA-256', data);\n      const bytes = new Uint8Array(digest);\n      hashed.push(Array.from(bytes));\n    } catch {\n      const bytes = encoder.encode(email.toLowerCase());\n      hashed.push(Array.from(bytes));\n    }\n  }\n\n  return hashed;\n}\n\n/**\n * Canonicalize and hash recovery emails for an account, and persist the mapping\n * (hashHex → canonical email) in IndexedDB on a best-effort basis.\n */\nexport async function prepareRecoveryEmails(nearAccountId: AccountId, recoveryEmails: string[]): Promise<{\n  hashes: number[][];\n  pairs: RecoveryEmailEntry[];\n}> {\n  const accountId = toAccountId(nearAccountId);\n\n  const trimmedEmails = (recoveryEmails || []).map(e => e.trim()).filter(e => e.length > 0);\n  const canonicalEmails = trimmedEmails.map(canonicalizeEmail);\n  const recoveryEmailHashes = await hashRecoveryEmails(recoveryEmails, accountId);\n\n  const pairs: RecoveryEmailEntry[] = recoveryEmailHashes.map((hashBytes, idx) => ({\n    hashHex: bytesToHex(hashBytes),\n    email: canonicalEmails[idx],\n  }));\n\n  void (async () => {\n    try {\n      await IndexedDBManager.upsertRecoveryEmails(accountId, pairs);\n    } catch (error) {\n      console.warn('[EmailRecovery] Failed to persist local recovery emails', error);\n    }\n  })();\n\n  return { hashes: recoveryEmailHashes, pairs };\n}\n\nexport async function getLocalRecoveryEmails(nearAccountId: AccountId): Promise<RecoveryEmailRecord[]> {\n  return IndexedDBManager.getRecoveryEmails(nearAccountId);\n}\n"],"mappings":";;;;;;AAWA,MAAa,qBAAqB,UAA0B;CAC1D,MAAM,MAAM,OAAO,SAAS,IAAI;AAChC,KAAI,CAAC,IAAK,QAAO;CAGjB,MAAM,oBAAoB,IAAI,QAAQ,uBAAuB,IAAI;CAEjE,MAAM,aACJ;CAIF,MAAM,aAAa,kBAAkB,MAAM;CAC3C,MAAM,aAAa,CACjB,aAAa,IACb,mBACA,QAAQ,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS;AAEjE,MAAK,MAAM,aAAa,YAAY;EAClC,MAAM,UAAU,UAAU,QAAQ,gBAAgB;EAClD,MAAM,QAAQ,QAAQ,MAAM;AAC5B,MAAI,QAAQ,GACV,QAAO,MAAM,GAAG,OAAO;;AAI3B,QAAO,kBAAkB;;AAG3B,MAAa,cAAc,UAAyC;CAClE,MAAM,MAAM,iBAAiB,aAAa,QAAQ,WAAW,KAAK;AAClE,QAAO,KAAK,MAAM,KAAK,KACpB,KAAI,MAAK,EAAE,SAAS,IAAI,SAAS,GAAG,MACpC,KAAK;;AAGV,eAAe,mBAAmB,QAAkB,WAA2C;CAC7F,MAAM,UAAU,IAAI;CACpB,MAAM,QAAQ,aAAa,IAAI,OAAO;CACtC,MAAM,cAAc,UAAU,IAC3B,KAAI,MAAK,EAAE,QACX,QAAO,MAAK,EAAE,SAAS;CAE1B,MAAMA,SAAqB;AAE3B,MAAK,MAAM,SAAS,WAClB,KAAI;EACF,MAAM,iBAAiB,kBAAkB;EACzC,MAAM,QAAQ,GAAG,eAAe,GAAG;EACnC,MAAM,OAAO,QAAQ,OAAO;EAC5B,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW;EACrD,MAAM,QAAQ,IAAI,WAAW;AAC7B,SAAO,KAAK,MAAM,KAAK;SACjB;EACN,MAAM,QAAQ,QAAQ,OAAO,MAAM;AACnC,SAAO,KAAK,MAAM,KAAK;;AAI3B,QAAO;;;;;;AAOT,eAAsB,sBAAsB,eAA0B,gBAGnE;CACD,MAAM,YAAY,YAAY;CAE9B,MAAM,iBAAiB,kBAAkB,IAAI,KAAI,MAAK,EAAE,QAAQ,QAAO,MAAK,EAAE,SAAS;CACvF,MAAM,kBAAkB,cAAc,IAAI;CAC1C,MAAM,sBAAsB,MAAM,mBAAmB,gBAAgB;CAErE,MAAMC,QAA8B,oBAAoB,KAAK,WAAW,SAAS;EAC/E,SAAS,WAAW;EACpB,OAAO,gBAAgB;;AAGzB,EAAM,YAAY;AAChB,MAAI;AACF,SAAM,iBAAiB,qBAAqB,WAAW;WAChD,OAAO;AACd,WAAQ,KAAK,2DAA2D;;;AAI5E,QAAO;EAAE,QAAQ;EAAqB;;;AAGxC,eAAsB,uBAAuB,eAA0D;AACrG,QAAO,iBAAiB,kBAAkB"}
+{"version":3,"file":"index.js","names":["hashed: number[][]","pairs: RecoveryEmailEntry[]"],"sources":["../../../../src/core/EmailRecovery/index.ts"],"sourcesContent":["import type { AccountId } from '../types/accountIds';\nimport { toAccountId } from '../types/accountIds';\nimport { IndexedDBManager, type RecoveryEmailRecord } from '../IndexedDBManager';\nexport { EmailRecoveryPendingStore, type PendingStore } from './emailRecoveryPendingStore';\n\nexport type RecoveryEmailEntry = {\n  hashHex: string;\n  email: string;\n};\n\nexport { type RecoveryEmailRecord };\n\nexport const canonicalizeEmail = (email: string): string => {\n  const raw = String(email || '').trim();\n  if (!raw) return '';\n\n  // Handle cases where a full header line is passed in (e.g. \"From: ...\").\n  const withoutHeaderName = raw.replace(/^[a-z0-9-]+\\s*:\\s*/i, '').trim();\n\n  const emailRegex =\n    /([a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\\.[a-zA-Z0-9-]+)*)/;\n\n  // Prefer the common \"Name <email@domain>\" format when present, but still\n  // validate/extract the actual address via regex.\n  const angleMatch = withoutHeaderName.match(/<([^>]+)>/);\n  const candidates = [\n    angleMatch?.[1],\n    withoutHeaderName,\n  ].filter((v): v is string => typeof v === 'string' && v.length > 0);\n\n  for (const candidate of candidates) {\n    const cleaned = candidate.replace(/^mailto:\\s*/i, '');\n    const match = cleaned.match(emailRegex);\n    if (match?.[1]) {\n      return match[1].trim().toLowerCase();\n    }\n  }\n\n  return withoutHeaderName.toLowerCase();\n};\n\nexport const bytesToHex = (bytes: number[] | Uint8Array): string => {\n  const arr = bytes instanceof Uint8Array ? bytes : Uint8Array.from(bytes);\n  return `0x${Array.from(arr)\n    .map(b => b.toString(16).padStart(2, '0'))\n    .join('')}`;\n};\n\nasync function hashRecoveryEmails(emails: string[], accountId: AccountId): Promise<number[][]> {\n  const encoder = new TextEncoder();\n  const salt = (accountId || '').trim().toLowerCase();\n  const normalized = (emails || [])\n    .map(e => e.trim())\n    .filter(e => e.length > 0);\n\n  const hashed: number[][] = [];\n\n  for (const email of normalized) {\n    try {\n      const canonicalEmail = canonicalizeEmail(email);\n      const input = `${canonicalEmail}|${salt}`;\n      const data = encoder.encode(input);\n      const digest = await crypto.subtle.digest('SHA-256', data);\n      const bytes = new Uint8Array(digest);\n      hashed.push(Array.from(bytes));\n    } catch {\n      const bytes = encoder.encode(email.toLowerCase());\n      hashed.push(Array.from(bytes));\n    }\n  }\n\n  return hashed;\n}\n\n/**\n * Canonicalize and hash recovery emails for an account, and persist the mapping\n * (hashHex → canonical email) in IndexedDB on a best-effort basis.\n */\nexport async function prepareRecoveryEmails(nearAccountId: AccountId, recoveryEmails: string[]): Promise<{\n  hashes: number[][];\n  pairs: RecoveryEmailEntry[];\n}> {\n  const accountId = toAccountId(nearAccountId);\n\n  const trimmedEmails = (recoveryEmails || []).map(e => e.trim()).filter(e => e.length > 0);\n  const canonicalEmails = trimmedEmails.map(canonicalizeEmail);\n  const recoveryEmailHashes = await hashRecoveryEmails(recoveryEmails, accountId);\n\n  const pairs: RecoveryEmailEntry[] = recoveryEmailHashes.map((hashBytes, idx) => ({\n    hashHex: bytesToHex(hashBytes),\n    email: canonicalEmails[idx],\n  }));\n\n  void (async () => {\n    try {\n      await IndexedDBManager.upsertRecoveryEmails(accountId, pairs);\n    } catch (error) {\n      console.warn('[EmailRecovery] Failed to persist local recovery emails', error);\n    }\n  })();\n\n  return { hashes: recoveryEmailHashes, pairs };\n}\n\nexport async function getLocalRecoveryEmails(nearAccountId: AccountId): Promise<RecoveryEmailRecord[]> {\n  return IndexedDBManager.getRecoveryEmails(nearAccountId);\n}\n"],"mappings":";;;;;;AAgDA,eAAe,mBAAmB,QAAkB,WAA2C;CAC7F,MAAM,UAAU,IAAI;CACpB,MAAM,QAAQ,aAAa,IAAI,OAAO;CACtC,MAAM,cAAc,UAAU,IAC3B,KAAI,MAAK,EAAE,QACX,QAAO,MAAK,EAAE,SAAS;CAE1B,MAAMA,SAAqB;AAE3B,MAAK,MAAM,SAAS,WAClB,KAAI;EACF,MAAM,iBAAiB,kBAAkB;EACzC,MAAM,QAAQ,GAAG,eAAe,GAAG;EACnC,MAAM,OAAO,QAAQ,OAAO;EAC5B,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW;EACrD,MAAM,QAAQ,IAAI,WAAW;AAC7B,SAAO,KAAK,MAAM,KAAK;SACjB;EACN,MAAM,QAAQ,QAAQ,OAAO,MAAM;AACnC,SAAO,KAAK,MAAM,KAAK;;AAI3B,QAAO;;;;;;AAOT,eAAsB,sBAAsB,eAA0B,gBAGnE;CACD,MAAM,YAAY,YAAY;CAE9B,MAAM,iBAAiB,kBAAkB,IAAI,KAAI,MAAK,EAAE,QAAQ,QAAO,MAAK,EAAE,SAAS;CACvF,MAAM,kBAAkB,cAAc,IAAI;CAC1C,MAAM,sBAAsB,MAAM,mBAAmB,gBAAgB;CAErE,MAAMC,QAA8B,oBAAoB,KAAK,WAAW,SAAS;EAC/E,SAAS,WAAW;EACpB,OAAO,gBAAgB;;AAGzB,EAAM,YAAY;AAChB,MAAI;AACF,SAAM,iBAAiB,qBAAqB,WAAW;WAChD,OAAO;AACd,WAAQ,KAAK,2DAA2D;;;AAI5E,QAAO;EAAE,QAAQ;EAAqB;;;AAGxC,eAAsB,uBAAuB,eAA0D;AACrG,QAAO,iBAAiB,kBAAkB;;;;;;;CA7F/B,qBAAqB,UAA0B;EAC1D,MAAM,MAAM,OAAO,SAAS,IAAI;AAChC,MAAI,CAAC,IAAK,QAAO;EAGjB,MAAM,oBAAoB,IAAI,QAAQ,uBAAuB,IAAI;EAEjE,MAAM,aACJ;EAIF,MAAM,aAAa,kBAAkB,MAAM;EAC3C,MAAM,aAAa,CACjB,aAAa,IACb,mBACA,QAAQ,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS;AAEjE,OAAK,MAAM,aAAa,YAAY;GAClC,MAAM,UAAU,UAAU,QAAQ,gBAAgB;GAClD,MAAM,QAAQ,QAAQ,MAAM;AAC5B,OAAI,QAAQ,GACV,QAAO,MAAM,GAAG,OAAO;;AAI3B,SAAO,kBAAkB;;CAGd,cAAc,UAAyC;EAClE,MAAM,MAAM,iBAAiB,aAAa,QAAQ,WAAW,KAAK;AAClE,SAAO,KAAK,MAAM,KAAK,KACpB,KAAI,MAAK,EAAE,SAAS,IAAI,SAAS,GAAG,MACpC,KAAK"}