@tatchi-xyz/sdk 0.18.0 → 0.20.0

package/dist/esm/sdk/{registration-CBiS4Ua_.js → registration-bKEg9Zr2.js}

@@ -1,6 +1,6 @@
 import { ERROR_MESSAGES, getIntentDigest, getNearAccountId, getRegisterAccountPayload, isSerializedRegistrationCredential, isUserCancelledSecureConfirm, serializeRegistrationCredentialWithPRF, toError } from "./requestHelpers-aUKhXiEl.js";
 import "./validation-DhPPUba7.js";
-import { createConfirmSession, createConfirmTxFlowAdapters } from "./createAdapters-BumKM2ft.js";
+import { createConfirmSession, createConfirmTxFlowAdapters } from "./createAdapters-Yga6W0en.js";
 import "./css-loader-BrMMlG4X.js";
 import "./lit-events-BKobq01K.js";
 import "./tx-tree-themes-i3It4IYY.js";
@@ -130,4 +130,4 @@ async function handleRegistrationFlow(ctx, request, worker, opts) {
 
 //#endregion
 export { handleRegistrationFlow };
-//# sourceMappingURL=registration-CBiS4Ua_.js.map
+//# sourceMappingURL=registration-bKEg9Zr2.js.map

package/dist/esm/sdk/{registration-CBiS4Ua_.js.map → registration-bKEg9Zr2.js.map}

@@ -1 +1 @@
-{"version":3,"file":"registration-CBiS4Ua_.js","names":["uiVrfChallenge: VRFChallenge","credential: PublicKeyCredential | undefined","e: unknown","serialized: WebAuthnRegistrationCredential","err: unknown"],"sources":["../../../src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/flows/registration.ts"],"sourcesContent":["import type { VrfWorkerManagerContext } from '../../';\nimport type { ConfirmationConfig } from '../../../../types/signer-worker';\nimport {\n  TransactionSummary,\n  RegistrationSecureConfirmRequest,\n} from '../types';\nimport { VRFChallenge, TransactionContext } from '../../../../types';\nimport type { WebAuthnRegistrationCredential } from '../../../../types/webauthn';\nimport {\n  getNearAccountId,\n  getIntentDigest,\n  isUserCancelledSecureConfirm,\n  ERROR_MESSAGES,\n  getRegisterAccountPayload,\n} from './index';\nimport { isSerializedRegistrationCredential, serializeRegistrationCredentialWithPRF } from '../../../credentialsHelpers';\nimport { toError } from '../../../../../utils/errors';\nimport { createConfirmSession } from '../adapters/session';\nimport { createConfirmTxFlowAdapters } from '../adapters/createAdapters';\n\nexport async function handleRegistrationFlow(\n  ctx: VrfWorkerManagerContext,\n  request: RegistrationSecureConfirmRequest,\n  worker: Worker,\n  opts: { confirmationConfig: ConfirmationConfig; transactionSummary: TransactionSummary },\n): Promise<void> {\n\n  const { confirmationConfig, transactionSummary } = opts;\n  const adapters = createConfirmTxFlowAdapters(ctx);\n  const session = createConfirmSession({\n    adapters,\n    worker,\n    request,\n    confirmationConfig,\n    transactionSummary,\n  });\n  const nearAccountId = getNearAccountId(request);\n\n  console.debug('[RegistrationFlow] start', {\n    nearAccountId,\n    uiMode: confirmationConfig?.uiMode,\n    behavior: confirmationConfig?.behavior,\n    theme: confirmationConfig?.theme,\n    intentDigest: transactionSummary?.intentDigest,\n  });\n\n  // 1) NEAR context\n  const nearRpc = await adapters.near.fetchNearContext({ nearAccountId, txCount: 1, reserveNonces: true });\n  if (nearRpc.error && !nearRpc.transactionContext) {\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: `${ERROR_MESSAGES.nearRpcFailed}: ${nearRpc.details}`,\n    });\n  }\n  const transactionContext = nearRpc.transactionContext as TransactionContext;\n  session.setReservedNonces(nearRpc.reservedNonces);\n\n  // 2) Initial VRF challenge via bootstrap\n  const rpId = adapters.vrf.getRpId();\n  const bootstrap = await adapters.vrf.generateVrfKeypairBootstrap({\n    vrfInputData: {\n      userId: nearAccountId,\n      rpId,\n      blockHeight: transactionContext.txBlockHeight,\n      blockHash: transactionContext.txBlockHash,\n    },\n    saveInMemory: true,\n    sessionId: request.requestId,\n  });\n  let uiVrfChallenge: VRFChallenge = bootstrap.vrfChallenge;\n  console.debug('[RegistrationFlow] VRF bootstrap ok', { blockHeight: uiVrfChallenge.blockHeight });\n\n  // 3) UI confirm\n  const { confirmed, error: uiError } = await session.promptUser({ vrfChallenge: uiVrfChallenge });\n  if (!confirmed) {\n    console.debug('[RegistrationFlow] user cancelled');\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: uiError,\n    });\n  }\n\n  // 4) JIT refresh VRF (best-effort)\n  try {\n    const refreshed = await adapters.vrf.maybeRefreshVrfChallenge(request, nearAccountId);\n    uiVrfChallenge = refreshed.vrfChallenge;\n    session.updateUI({ vrfChallenge: uiVrfChallenge });\n    console.debug('[RegistrationFlow] VRF JIT refresh ok', { blockHeight: uiVrfChallenge.blockHeight });\n  } catch (e) {\n    console.debug('[RegistrationFlow] VRF JIT refresh skipped', e);\n  }\n\n  // 5) Collect registration credentials (with duplicate retry)\n  let credential: PublicKeyCredential | undefined;\n  let deviceNumber = request.payload?.deviceNumber;\n\n  const tryCreate = async (dn?: number): Promise<PublicKeyCredential> => {\n    console.debug('[RegistrationFlow] navigator.credentials.create start', { deviceNumber: dn });\n    return await adapters.webauthn.createRegistrationCredential({\n      nearAccountId,\n      challenge: uiVrfChallenge,\n      deviceNumber: dn,\n    });\n  };\n\n  try {\n    try {\n      credential = await tryCreate(deviceNumber);\n      console.debug('[RegistrationFlow] credentials.create ok');\n    } catch (e: unknown) {\n      const err = toError(e);\n      const name = String(err?.name || '');\n      const msg = String(err?.message || '');\n      const isDuplicate = name === 'InvalidStateError' || /excluded|already\\s*registered/i.test(msg);\n      if (isDuplicate) {\n        const nextDeviceNumber = (deviceNumber !== undefined && Number.isFinite(deviceNumber)) ? (deviceNumber + 1) : 2;\n        console.debug('[RegistrationFlow] duplicate credential, retry with next deviceNumber', { nextDeviceNumber });\n        credential = await tryCreate(nextDeviceNumber);\n        getRegisterAccountPayload(request).deviceNumber = nextDeviceNumber;\n      } else {\n        console.error('[RegistrationFlow] credentials.create failed (non-duplicate)', { name, msg });\n        throw err;\n      }\n    }\n\n    // We require registration credentials to include dual PRF outputs (first + second)\n    // so VRF/NEAR key derivation can happen inside the workers without passing PRF outputs\n    // as separate main-thread values.\n    const serialized: WebAuthnRegistrationCredential = isSerializedRegistrationCredential(credential as unknown)\n      ? (credential as unknown as WebAuthnRegistrationCredential)\n      : serializeRegistrationCredentialWithPRF({\n          credential: credential! as PublicKeyCredential,\n          firstPrfOutput: true,\n          secondPrfOutput: true,\n    });\n\n    // 6) Respond + close\n    session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: true,\n      credential: serialized,\n      // PRF outputs are embedded in serialized credential; VRF worker extracts and sends via MessagePort\n      vrfChallenge: uiVrfChallenge,\n      transactionContext,\n    });\n\n  } catch (err: unknown) {\n    const cancelled = isUserCancelledSecureConfirm(err);\n    const msg = String((toError(err))?.message || err || '');\n    // For missing PRF outputs, surface the error to caller (defensive path tests expect a throw)\n    if (/Missing PRF result/i.test(msg) || /Missing PRF results/i.test(msg)) {\n      return session.cleanupAndRethrow(err);\n    }\n    if (cancelled) {\n      window.parent?.postMessage({ type: 'WALLET_UI_CLOSED' }, '*');\n    }\n\n    const isPrfBrowserUnsupported =\n      /WebAuthn PRF output is missing from navigator\\.credentials\\.create\\(\\)/i.test(msg)\n      || /does not fully support the WebAuthn PRF extension during registration/i.test(msg)\n      || /roaming hardware authenticators .* not supported in this flow/i.test(msg);\n\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: cancelled\n        ? ERROR_MESSAGES.cancelled\n        : (isPrfBrowserUnsupported ? msg : ERROR_MESSAGES.collectCredentialsFailed),\n    });\n  }\n}\n"],"mappings":";;;;;;;;AAoBA,eAAsB,uBACpB,KACA,SACA,QACA,MACe;CAEf,MAAM,EAAE,oBAAoB,uBAAuB;CACnD,MAAM,WAAW,4BAA4B;CAC7C,MAAM,UAAU,qBAAqB;EACnC;EACA;EACA;EACA;EACA;;CAEF,MAAM,gBAAgB,iBAAiB;AAEvC,SAAQ,MAAM,4BAA4B;EACxC;EACA,QAAQ,oBAAoB;EAC5B,UAAU,oBAAoB;EAC9B,OAAO,oBAAoB;EAC3B,cAAc,oBAAoB;;CAIpC,MAAM,UAAU,MAAM,SAAS,KAAK,iBAAiB;EAAE;EAAe,SAAS;EAAG,eAAe;;AACjG,KAAI,QAAQ,SAAS,CAAC,QAAQ,mBAC5B,QAAO,QAAQ,qBAAqB;EAClC,WAAW,QAAQ;EACnB,cAAc,gBAAgB;EAC9B,WAAW;EACX,OAAO,GAAG,eAAe,cAAc,IAAI,QAAQ;;CAGvD,MAAM,qBAAqB,QAAQ;AACnC,SAAQ,kBAAkB,QAAQ;CAGlC,MAAM,OAAO,SAAS,IAAI;CAC1B,MAAM,YAAY,MAAM,SAAS,IAAI,4BAA4B;EAC/D,cAAc;GACZ,QAAQ;GACR;GACA,aAAa,mBAAmB;GAChC,WAAW,mBAAmB;;EAEhC,cAAc;EACd,WAAW,QAAQ;;CAErB,IAAIA,iBAA+B,UAAU;AAC7C,SAAQ,MAAM,uCAAuC,EAAE,aAAa,eAAe;CAGnF,MAAM,EAAE,WAAW,OAAO,YAAY,MAAM,QAAQ,WAAW,EAAE,cAAc;AAC/E,KAAI,CAAC,WAAW;AACd,UAAQ,MAAM;AACd,SAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO;;;AAKX,KAAI;EACF,MAAM,YAAY,MAAM,SAAS,IAAI,yBAAyB,SAAS;AACvE,mBAAiB,UAAU;AAC3B,UAAQ,SAAS,EAAE,cAAc;AACjC,UAAQ,MAAM,yCAAyC,EAAE,aAAa,eAAe;UAC9E,GAAG;AACV,UAAQ,MAAM,8CAA8C;;CAI9D,IAAIC;CACJ,IAAI,eAAe,QAAQ,SAAS;CAEpC,MAAM,YAAY,OAAO,OAA8C;AACrE,UAAQ,MAAM,yDAAyD,EAAE,cAAc;AACvF,SAAO,MAAM,SAAS,SAAS,6BAA6B;GAC1D;GACA,WAAW;GACX,cAAc;;;AAIlB,KAAI;AACF,MAAI;AACF,gBAAa,MAAM,UAAU;AAC7B,WAAQ,MAAM;WACPC,GAAY;GACnB,MAAM,MAAM,QAAQ;GACpB,MAAM,OAAO,OAAO,KAAK,QAAQ;GACjC,MAAM,MAAM,OAAO,KAAK,WAAW;GACnC,MAAM,cAAc,SAAS,uBAAuB,iCAAiC,KAAK;AAC1F,OAAI,aAAa;IACf,MAAM,mBAAoB,iBAAiB,UAAa,OAAO,SAAS,gBAAkB,eAAe,IAAK;AAC9G,YAAQ,MAAM,yEAAyE,EAAE;AACzF,iBAAa,MAAM,UAAU;AAC7B,8BAA0B,SAAS,eAAe;UAC7C;AACL,YAAQ,MAAM,gEAAgE;KAAE;KAAM;;AACtF,UAAM;;;EAOV,MAAMC,aAA6C,mCAAmC,cACjF,aACD,uCAAuC;GACzB;GACZ,gBAAgB;GAChB,iBAAiB;;AAIvB,UAAQ,qBAAqB;GAC3B,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,YAAY;GAEZ,cAAc;GACd;;UAGKC,KAAc;EACrB,MAAM,YAAY,6BAA6B;EAC/C,MAAM,MAAM,OAAQ,QAAQ,MAAO,WAAW,OAAO;AAErD,MAAI,sBAAsB,KAAK,QAAQ,uBAAuB,KAAK,KACjE,QAAO,QAAQ,kBAAkB;AAEnC,MAAI,UACF,QAAO,QAAQ,YAAY,EAAE,MAAM,sBAAsB;EAG3D,MAAM,0BACJ,0EAA0E,KAAK,QAC5E,yEAAyE,KAAK,QAC9E,iEAAiE,KAAK;AAE3E,SAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO,YACH,eAAe,YACd,0BAA0B,MAAM,eAAe"}
+{"version":3,"file":"registration-bKEg9Zr2.js","names":["uiVrfChallenge: VRFChallenge","credential: PublicKeyCredential | undefined","e: unknown","serialized: WebAuthnRegistrationCredential","err: unknown"],"sources":["../../../src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/flows/registration.ts"],"sourcesContent":["import type { VrfWorkerManagerContext } from '../../';\nimport type { ConfirmationConfig } from '../../../../types/signer-worker';\nimport {\n  TransactionSummary,\n  RegistrationSecureConfirmRequest,\n} from '../types';\nimport { VRFChallenge, TransactionContext } from '../../../../types';\nimport type { WebAuthnRegistrationCredential } from '../../../../types/webauthn';\nimport {\n  getNearAccountId,\n  getIntentDigest,\n  isUserCancelledSecureConfirm,\n  ERROR_MESSAGES,\n  getRegisterAccountPayload,\n} from './index';\nimport { isSerializedRegistrationCredential, serializeRegistrationCredentialWithPRF } from '../../../credentialsHelpers';\nimport { toError } from '../../../../../utils/errors';\nimport { createConfirmSession } from '../adapters/session';\nimport { createConfirmTxFlowAdapters } from '../adapters/createAdapters';\n\nexport async function handleRegistrationFlow(\n  ctx: VrfWorkerManagerContext,\n  request: RegistrationSecureConfirmRequest,\n  worker: Worker,\n  opts: { confirmationConfig: ConfirmationConfig; transactionSummary: TransactionSummary },\n): Promise<void> {\n\n  const { confirmationConfig, transactionSummary } = opts;\n  const adapters = createConfirmTxFlowAdapters(ctx);\n  const session = createConfirmSession({\n    adapters,\n    worker,\n    request,\n    confirmationConfig,\n    transactionSummary,\n  });\n  const nearAccountId = getNearAccountId(request);\n\n  console.debug('[RegistrationFlow] start', {\n    nearAccountId,\n    uiMode: confirmationConfig?.uiMode,\n    behavior: confirmationConfig?.behavior,\n    theme: confirmationConfig?.theme,\n    intentDigest: transactionSummary?.intentDigest,\n  });\n\n  // 1) NEAR context\n  const nearRpc = await adapters.near.fetchNearContext({ nearAccountId, txCount: 1, reserveNonces: true });\n  if (nearRpc.error && !nearRpc.transactionContext) {\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: `${ERROR_MESSAGES.nearRpcFailed}: ${nearRpc.details}`,\n    });\n  }\n  const transactionContext = nearRpc.transactionContext as TransactionContext;\n  session.setReservedNonces(nearRpc.reservedNonces);\n\n  // 2) Initial VRF challenge via bootstrap\n  const rpId = adapters.vrf.getRpId();\n  const bootstrap = await adapters.vrf.generateVrfKeypairBootstrap({\n    vrfInputData: {\n      userId: nearAccountId,\n      rpId,\n      blockHeight: transactionContext.txBlockHeight,\n      blockHash: transactionContext.txBlockHash,\n    },\n    saveInMemory: true,\n    sessionId: request.requestId,\n  });\n  let uiVrfChallenge: VRFChallenge = bootstrap.vrfChallenge;\n  console.debug('[RegistrationFlow] VRF bootstrap ok', { blockHeight: uiVrfChallenge.blockHeight });\n\n  // 3) UI confirm\n  const { confirmed, error: uiError } = await session.promptUser({ vrfChallenge: uiVrfChallenge });\n  if (!confirmed) {\n    console.debug('[RegistrationFlow] user cancelled');\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: uiError,\n    });\n  }\n\n  // 4) JIT refresh VRF (best-effort)\n  try {\n    const refreshed = await adapters.vrf.maybeRefreshVrfChallenge(request, nearAccountId);\n    uiVrfChallenge = refreshed.vrfChallenge;\n    session.updateUI({ vrfChallenge: uiVrfChallenge });\n    console.debug('[RegistrationFlow] VRF JIT refresh ok', { blockHeight: uiVrfChallenge.blockHeight });\n  } catch (e) {\n    console.debug('[RegistrationFlow] VRF JIT refresh skipped', e);\n  }\n\n  // 5) Collect registration credentials (with duplicate retry)\n  let credential: PublicKeyCredential | undefined;\n  let deviceNumber = request.payload?.deviceNumber;\n\n  const tryCreate = async (dn?: number): Promise<PublicKeyCredential> => {\n    console.debug('[RegistrationFlow] navigator.credentials.create start', { deviceNumber: dn });\n    return await adapters.webauthn.createRegistrationCredential({\n      nearAccountId,\n      challenge: uiVrfChallenge,\n      deviceNumber: dn,\n    });\n  };\n\n  try {\n    try {\n      credential = await tryCreate(deviceNumber);\n      console.debug('[RegistrationFlow] credentials.create ok');\n    } catch (e: unknown) {\n      const err = toError(e);\n      const name = String(err?.name || '');\n      const msg = String(err?.message || '');\n      const isDuplicate = name === 'InvalidStateError' || /excluded|already\\s*registered/i.test(msg);\n      if (isDuplicate) {\n        const nextDeviceNumber = (deviceNumber !== undefined && Number.isFinite(deviceNumber)) ? (deviceNumber + 1) : 2;\n        console.debug('[RegistrationFlow] duplicate credential, retry with next deviceNumber', { nextDeviceNumber });\n        credential = await tryCreate(nextDeviceNumber);\n        getRegisterAccountPayload(request).deviceNumber = nextDeviceNumber;\n      } else {\n        console.error('[RegistrationFlow] credentials.create failed (non-duplicate)', { name, msg });\n        throw err;\n      }\n    }\n\n    // We require registration credentials to include dual PRF outputs (first + second)\n    // so VRF/NEAR key derivation can happen inside the workers without passing PRF outputs\n    // as separate main-thread values.\n    const serialized: WebAuthnRegistrationCredential = isSerializedRegistrationCredential(credential as unknown)\n      ? (credential as unknown as WebAuthnRegistrationCredential)\n      : serializeRegistrationCredentialWithPRF({\n          credential: credential! as PublicKeyCredential,\n          firstPrfOutput: true,\n          secondPrfOutput: true,\n    });\n\n    // 6) Respond + close\n    session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: true,\n      credential: serialized,\n      // PRF outputs are embedded in serialized credential; VRF worker extracts and sends via MessagePort\n      vrfChallenge: uiVrfChallenge,\n      transactionContext,\n    });\n\n  } catch (err: unknown) {\n    const cancelled = isUserCancelledSecureConfirm(err);\n    const msg = String((toError(err))?.message || err || '');\n    // For missing PRF outputs, surface the error to caller (defensive path tests expect a throw)\n    if (/Missing PRF result/i.test(msg) || /Missing PRF results/i.test(msg)) {\n      return session.cleanupAndRethrow(err);\n    }\n    if (cancelled) {\n      window.parent?.postMessage({ type: 'WALLET_UI_CLOSED' }, '*');\n    }\n\n    const isPrfBrowserUnsupported =\n      /WebAuthn PRF output is missing from navigator\\.credentials\\.create\\(\\)/i.test(msg)\n      || /does not fully support the WebAuthn PRF extension during registration/i.test(msg)\n      || /roaming hardware authenticators .* not supported in this flow/i.test(msg);\n\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: cancelled\n        ? ERROR_MESSAGES.cancelled\n        : (isPrfBrowserUnsupported ? msg : ERROR_MESSAGES.collectCredentialsFailed),\n    });\n  }\n}\n"],"mappings":";;;;;;;;AAoBA,eAAsB,uBACpB,KACA,SACA,QACA,MACe;CAEf,MAAM,EAAE,oBAAoB,uBAAuB;CACnD,MAAM,WAAW,4BAA4B;CAC7C,MAAM,UAAU,qBAAqB;EACnC;EACA;EACA;EACA;EACA;;CAEF,MAAM,gBAAgB,iBAAiB;AAEvC,SAAQ,MAAM,4BAA4B;EACxC;EACA,QAAQ,oBAAoB;EAC5B,UAAU,oBAAoB;EAC9B,OAAO,oBAAoB;EAC3B,cAAc,oBAAoB;;CAIpC,MAAM,UAAU,MAAM,SAAS,KAAK,iBAAiB;EAAE;EAAe,SAAS;EAAG,eAAe;;AACjG,KAAI,QAAQ,SAAS,CAAC,QAAQ,mBAC5B,QAAO,QAAQ,qBAAqB;EAClC,WAAW,QAAQ;EACnB,cAAc,gBAAgB;EAC9B,WAAW;EACX,OAAO,GAAG,eAAe,cAAc,IAAI,QAAQ;;CAGvD,MAAM,qBAAqB,QAAQ;AACnC,SAAQ,kBAAkB,QAAQ;CAGlC,MAAM,OAAO,SAAS,IAAI;CAC1B,MAAM,YAAY,MAAM,SAAS,IAAI,4BAA4B;EAC/D,cAAc;GACZ,QAAQ;GACR;GACA,aAAa,mBAAmB;GAChC,WAAW,mBAAmB;;EAEhC,cAAc;EACd,WAAW,QAAQ;;CAErB,IAAIA,iBAA+B,UAAU;AAC7C,SAAQ,MAAM,uCAAuC,EAAE,aAAa,eAAe;CAGnF,MAAM,EAAE,WAAW,OAAO,YAAY,MAAM,QAAQ,WAAW,EAAE,cAAc;AAC/E,KAAI,CAAC,WAAW;AACd,UAAQ,MAAM;AACd,SAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO;;;AAKX,KAAI;EACF,MAAM,YAAY,MAAM,SAAS,IAAI,yBAAyB,SAAS;AACvE,mBAAiB,UAAU;AAC3B,UAAQ,SAAS,EAAE,cAAc;AACjC,UAAQ,MAAM,yCAAyC,EAAE,aAAa,eAAe;UAC9E,GAAG;AACV,UAAQ,MAAM,8CAA8C;;CAI9D,IAAIC;CACJ,IAAI,eAAe,QAAQ,SAAS;CAEpC,MAAM,YAAY,OAAO,OAA8C;AACrE,UAAQ,MAAM,yDAAyD,EAAE,cAAc;AACvF,SAAO,MAAM,SAAS,SAAS,6BAA6B;GAC1D;GACA,WAAW;GACX,cAAc;;;AAIlB,KAAI;AACF,MAAI;AACF,gBAAa,MAAM,UAAU;AAC7B,WAAQ,MAAM;WACPC,GAAY;GACnB,MAAM,MAAM,QAAQ;GACpB,MAAM,OAAO,OAAO,KAAK,QAAQ;GACjC,MAAM,MAAM,OAAO,KAAK,WAAW;GACnC,MAAM,cAAc,SAAS,uBAAuB,iCAAiC,KAAK;AAC1F,OAAI,aAAa;IACf,MAAM,mBAAoB,iBAAiB,UAAa,OAAO,SAAS,gBAAkB,eAAe,IAAK;AAC9G,YAAQ,MAAM,yEAAyE,EAAE;AACzF,iBAAa,MAAM,UAAU;AAC7B,8BAA0B,SAAS,eAAe;UAC7C;AACL,YAAQ,MAAM,gEAAgE;KAAE;KAAM;;AACtF,UAAM;;;EAOV,MAAMC,aAA6C,mCAAmC,cACjF,aACD,uCAAuC;GACzB;GACZ,gBAAgB;GAChB,iBAAiB;;AAIvB,UAAQ,qBAAqB;GAC3B,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,YAAY;GAEZ,cAAc;GACd;;UAGKC,KAAc;EACrB,MAAM,YAAY,6BAA6B;EAC/C,MAAM,MAAM,OAAQ,QAAQ,MAAO,WAAW,OAAO;AAErD,MAAI,sBAAsB,KAAK,QAAQ,uBAAuB,KAAK,KACjE,QAAO,QAAQ,kBAAkB;AAEnC,MAAI,UACF,QAAO,QAAQ,YAAY,EAAE,MAAM,sBAAsB;EAG3D,MAAM,0BACJ,0EAA0E,KAAK,QAC5E,yEAAyE,KAAK,QAC9E,iEAAiE,KAAK;AAE3E,SAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO,YACH,eAAe,YACd,0BAA0B,MAAM,eAAe"}

package/dist/esm/sdk/{registration-DLPLsGCz.js → registration-lDD60Ytt.js}

@@ -11,7 +11,7 @@ import "./tx-confirmer-wrapper-lHNgz9i4.js";
 import { init_errors, toError } from "./errors-D9ar28Dr.js";
 import { init_credentialsHelpers, isSerializedRegistrationCredential, serializeRegistrationCredentialWithPRF } from "./WebAuthnFallbacks-Bl4BTsNt.js";
 import { ERROR_MESSAGES, getIntentDigest, getNearAccountId, getRegisterAccountPayload, isUserCancelledSecureConfirm } from "./requestHelpers-Dh1hEYL9.js";
-import { createConfirmSession, createConfirmTxFlowAdapters } from "./createAdapters-qVGD6i0g.js";
+import { createConfirmSession, createConfirmTxFlowAdapters } from "./createAdapters-DIRR8_Z9.js";
 
 //#region src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/flows/registration.ts
 init_credentialsHelpers();

package/dist/esm/sdk/{transactions-Bk-VavcV.js → transactions-BalIhtJ9.js}

@@ -13,7 +13,7 @@ import "./WebAuthnFallbacks-Bl4BTsNt.js";
 import { ERROR_MESSAGES, SecureConfirmationType, getIntentDigest, getNearAccountId, getSignTransactionPayload, getTxCount, init_accountIds, isUserCancelledSecureConfirm, toAccountId } from "./requestHelpers-Dh1hEYL9.js";
 import { PASSKEY_MANAGER_DEFAULT_CONFIGS, init_defaultConfigs } from "./defaultConfigs-DpslkAQd.js";
 import { getLastLoggedInDeviceNumber, init_getDeviceNumber } from "./getDeviceNumber-zsOHT_Um.js";
-import { createConfirmSession, createConfirmTxFlowAdapters } from "./createAdapters-qVGD6i0g.js";
+import { createConfirmSession, createConfirmTxFlowAdapters } from "./createAdapters-DIRR8_Z9.js";
 
 //#region src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/flows/transactions.ts
 init_accountIds();

package/dist/esm/sdk/{transactions-BIqKZeR0.js → transactions-bqaAwL4k.js}

@@ -1,7 +1,7 @@
 import { ERROR_MESSAGES, SecureConfirmationType, getIntentDigest, getNearAccountId, getSignTransactionPayload, getTxCount, isUserCancelledSecureConfirm, toAccountId, toError } from "./requestHelpers-aUKhXiEl.js";
 import "./validation-DhPPUba7.js";
 import { PASSKEY_MANAGER_DEFAULT_CONFIGS, getLastLoggedInDeviceNumber } from "./getDeviceNumber-fXizNGQl.js";
-import { createConfirmSession, createConfirmTxFlowAdapters } from "./createAdapters-BumKM2ft.js";
+import { createConfirmSession, createConfirmTxFlowAdapters } from "./createAdapters-Yga6W0en.js";
 import "./css-loader-BrMMlG4X.js";
 import "./lit-events-BKobq01K.js";
 import "./tx-tree-themes-i3It4IYY.js";
@@ -163,4 +163,4 @@ async function handleTransactionSigningFlow(ctx, request, worker, opts) {
 
 //#endregion
 export { handleTransactionSigningFlow };
-//# sourceMappingURL=transactions-BIqKZeR0.js.map
+//# sourceMappingURL=transactions-bqaAwL4k.js.map

package/dist/esm/sdk/{transactions-BIqKZeR0.js.map → transactions-bqaAwL4k.js.map}

@@ -1 +1 @@
-{"version":3,"file":"transactions-BIqKZeR0.js","names":["uiVrfChallenge: VRFChallenge | undefined","uiVrfChallengeForUi: Partial<VRFChallenge> | undefined","err: unknown","contractId: string | undefined","nearRpcUrl: string | undefined"],"sources":["../../../src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/flows/transactions.ts"],"sourcesContent":["import type { VrfWorkerManagerContext } from '../../';\nimport type { ConfirmationConfig } from '../../../../types/signer-worker';\nimport {\n  SecureConfirmationType,\n  TransactionSummary,\n  SigningSecureConfirmRequest,\n  SigningAuthMode,\n} from '../types';\nimport { VRFChallenge, TransactionContext } from '../../../../types';\nimport {\n  getNearAccountId,\n  getIntentDigest,\n  getTxCount,\n  isUserCancelledSecureConfirm,\n  ERROR_MESSAGES,\n  getSignTransactionPayload,\n} from './index';\nimport { toAccountId } from '../../../../types/accountIds';\nimport { getLastLoggedInDeviceNumber } from '../../../SignerWorkerManager/getDeviceNumber';\nimport { toError } from '../../../../../utils/errors';\nimport { PASSKEY_MANAGER_DEFAULT_CONFIGS } from '../../../../defaultConfigs';\nimport { createConfirmSession } from '../adapters/session';\nimport { createConfirmTxFlowAdapters } from '../adapters/createAdapters';\n\nfunction getSigningAuthMode(request: SigningSecureConfirmRequest): SigningAuthMode {\n  if (request.type === SecureConfirmationType.SIGN_TRANSACTION) {\n    return getSignTransactionPayload(request).signingAuthMode ?? 'webauthn';\n  }\n  if (request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE) {\n    const p = request.payload as any;\n    return (p?.signingAuthMode as SigningAuthMode | undefined) ?? 'webauthn';\n  }\n  return 'webauthn';\n}\n\nexport async function handleTransactionSigningFlow(\n  ctx: VrfWorkerManagerContext,\n  request: SigningSecureConfirmRequest,\n  worker: Worker,\n  opts: { confirmationConfig: ConfirmationConfig; transactionSummary: TransactionSummary },\n): Promise<void> {\n  const { confirmationConfig, transactionSummary } = opts;\n  const adapters = createConfirmTxFlowAdapters(ctx);\n  const session = createConfirmSession({\n    adapters,\n    worker,\n    request,\n    confirmationConfig,\n    transactionSummary,\n  });\n  const nearAccountId = getNearAccountId(request);\n  const signingAuthMode = getSigningAuthMode(request);\n  const usesNeeded = getTxCount(request);\n\n  // 1) NEAR context + nonce reservation\n  const nearRpc = await adapters.near.fetchNearContext({ nearAccountId, txCount: usesNeeded, reserveNonces: true });\n  if (nearRpc.error && !nearRpc.transactionContext) {\n    // eslint-disable-next-line no-console\n    console.error('[SigningFlow] fetchNearContext failed', { error: nearRpc.error, details: nearRpc.details });\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: `${ERROR_MESSAGES.nearRpcFailed}: ${nearRpc.details}`,\n    });\n  }\n  session.setReservedNonces(nearRpc.reservedNonces);\n  let transactionContext = nearRpc.transactionContext as TransactionContext;\n\n  // 2) Security context shown in the confirmer (rpId + block height).\n  // For warmSession signing we still want to show this context even though\n  // we won't collect a WebAuthn credential.\n  const rpId = adapters.vrf.getRpId();\n  let uiVrfChallenge: VRFChallenge | undefined;\n  let uiVrfChallengeForUi: Partial<VRFChallenge> | undefined = rpId\n    ? {\n        userId: nearAccountId,\n        rpId,\n        blockHeight: transactionContext.txBlockHeight,\n        blockHash: transactionContext.txBlockHash,\n      }\n    : undefined;\n\n  // Initial VRF challenge (only needed for WebAuthn credential collection)\n  if (signingAuthMode === 'webauthn') {\n    uiVrfChallenge = await adapters.vrf.generateVrfChallengeForSession(\n      {\n        userId: nearAccountId,\n        rpId,\n        blockHeight: transactionContext.txBlockHeight,\n        blockHash: transactionContext.txBlockHash,\n      },\n      request.requestId,\n    );\n    uiVrfChallengeForUi = uiVrfChallenge;\n  }\n\n  // 3) UI confirm\n  const { confirmed, error: uiError } = await session.promptUser({ vrfChallenge: uiVrfChallengeForUi });\n  if (!confirmed) {\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: uiError,\n    });\n  }\n\n  // 4) Warm session: dispense WrapKeySeed and skip WebAuthn\n  if (signingAuthMode === 'warmSession') {\n    try {\n      await adapters.vrf.dispenseSessionKey({ sessionId: request.requestId, uses: usesNeeded });\n    } catch (err: unknown) {\n      const msg = String((toError(err))?.message || err || '');\n      return session.confirmAndCloseModal({\n        requestId: request.requestId,\n        intentDigest: getIntentDigest(request),\n        confirmed: false,\n        error: msg || 'Failed to dispense warm session key',\n      });\n    }\n\n    session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: true,\n      transactionContext,\n    });\n    return;\n  }\n\n  // 5) JIT refresh VRF + ctx (best-effort)\n  try {\n    const refreshed = await adapters.vrf.maybeRefreshVrfChallenge(request, nearAccountId);\n    uiVrfChallenge = refreshed.vrfChallenge;\n    transactionContext = refreshed.transactionContext;\n    session.updateUI({ vrfChallenge: uiVrfChallenge });\n  } catch (e) {\n    console.debug('[SigningFlow] VRF JIT refresh skipped', e);\n  }\n\n  // 6) Collect authentication credential\n  try {\n    if (!uiVrfChallenge) {\n      throw new Error('Missing vrfChallenge for WebAuthn signing flow');\n    }\n    const serializedCredential = await adapters.webauthn.collectAuthenticationCredentialWithPRF({\n      nearAccountId,\n      vrfChallenge: uiVrfChallenge,\n    });\n\n    // 5c) Derive WrapKeySeed inside the VRF worker and deliver it to the signer worker via\n    // the reserved WrapKeySeed MessagePort. Main thread only sees wrapKeySalt metadata.\n    let contractId: string | undefined;\n    let nearRpcUrl: string | undefined;\n    try {\n      // Ensure VRF session is active and bound to the same account we are signing for.\n      const vrfStatus = await adapters.vrf.checkVrfStatus();\n      if (!vrfStatus.active) {\n        throw new Error('VRF keypair not active in memory. VRF session may have expired or was not properly initialized. Please refresh and try again.');\n      }\n      if (!vrfStatus.nearAccountId || String(vrfStatus.nearAccountId) !== String(toAccountId(nearAccountId))) {\n        throw new Error('VRF session is active but bound to a different account than the one being signed. Please log in again on this device.');\n      }\n\n      const deviceNumber = await getLastLoggedInDeviceNumber(toAccountId(nearAccountId), ctx.indexedDB.clientDB);\n      const encryptedKeyData = await ctx.indexedDB.nearKeysDB.getEncryptedKey(nearAccountId, deviceNumber);\n      // For v2+ vaults, wrapKeySalt is the canonical salt.\n      const wrapKeySalt = encryptedKeyData?.wrapKeySalt || '';\n      if (!wrapKeySalt) {\n        throw new Error('Missing wrapKeySalt in vault; re-register to upgrade vault format.');\n      }\n\n      // Extract contract verification context when available.\n      // - SIGN_TRANSACTION: use per-request rpcCall (already normalized by caller).\n      // - SIGN_NEP413_MESSAGE: allow per-request override; fall back to PASSKEY_MANAGER_DEFAULT_CONFIGS.\n      if (request.type === SecureConfirmationType.SIGN_TRANSACTION) {\n        const payload = getSignTransactionPayload(request);\n        contractId = payload?.rpcCall?.contractId;\n        nearRpcUrl = payload?.rpcCall?.nearRpcUrl;\n      } else if (request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE) {\n        const payload = request.payload as any;\n        contractId = payload?.contractId\n          || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId;\n        nearRpcUrl = payload?.nearRpcUrl\n          || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl;\n      }\n\n      await adapters.vrf.mintSessionKeysAndSendToSigner({\n        sessionId: request.requestId,\n        wrapKeySalt,\n        contractId,\n        nearRpcUrl,\n        credential: serializedCredential,\n      });\n\t    } catch (err) {\n\t      console.error('[SigningFlow] WrapKeySeed derivation failed:', err);\n\t      throw err; // Don't silently ignore - propagate the error\n\t    }\n\n    // 6) Respond; keep nonces reserved for worker to use\n    session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: true,\n      credential: serializedCredential,\n      // prfOutput intentionally omitted to keep signer PRF-free\n      // WrapKeySeed travels only over the dedicated VRF→Signer MessagePort; do not echo in the main-thread envelope\n      vrfChallenge: uiVrfChallenge,\n      transactionContext,\n    });\n  } catch (err: unknown) {\n    // Treat TouchID/FaceID cancellation and related errors as a negative decision\n    const cancelled = isUserCancelledSecureConfirm(err);\n    // For missing PRF outputs, surface the error to caller (defensive path tests expect a throw)\n    const msg = String((toError(err))?.message || err || '');\n    if (/Missing PRF result/i.test(msg) || /Missing PRF results/i.test(msg)) {\n      // Ensure UI is closed and nonces released, then rethrow\n      return session.cleanupAndRethrow(err);\n    }\n    if (cancelled) {\n      window.parent?.postMessage({ type: 'WALLET_UI_CLOSED' }, '*');\n    }\n    const isWrongPasskeyError = /multiple passkeys \\(devicenumbers\\) for account/i.test(msg);\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: cancelled\n        ? ERROR_MESSAGES.cancelled\n        : (isWrongPasskeyError ? msg : ERROR_MESSAGES.collectCredentialsFailed),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;AAwBA,SAAS,mBAAmB,SAAuD;AACjF,KAAI,QAAQ,SAAS,uBAAuB,iBAC1C,QAAO,0BAA0B,SAAS,mBAAmB;AAE/D,KAAI,QAAQ,SAAS,uBAAuB,qBAAqB;EAC/D,MAAM,IAAI,QAAQ;AAClB,SAAQ,GAAG,mBAAmD;;AAEhE,QAAO;;AAGT,eAAsB,6BACpB,KACA,SACA,QACA,MACe;CACf,MAAM,EAAE,oBAAoB,uBAAuB;CACnD,MAAM,WAAW,4BAA4B;CAC7C,MAAM,UAAU,qBAAqB;EACnC;EACA;EACA;EACA;EACA;;CAEF,MAAM,gBAAgB,iBAAiB;CACvC,MAAM,kBAAkB,mBAAmB;CAC3C,MAAM,aAAa,WAAW;CAG9B,MAAM,UAAU,MAAM,SAAS,KAAK,iBAAiB;EAAE;EAAe,SAAS;EAAY,eAAe;;AAC1G,KAAI,QAAQ,SAAS,CAAC,QAAQ,oBAAoB;AAEhD,UAAQ,MAAM,yCAAyC;GAAE,OAAO,QAAQ;GAAO,SAAS,QAAQ;;AAChG,SAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO,GAAG,eAAe,cAAc,IAAI,QAAQ;;;AAGvD,SAAQ,kBAAkB,QAAQ;CAClC,IAAI,qBAAqB,QAAQ;CAKjC,MAAM,OAAO,SAAS,IAAI;CAC1B,IAAIA;CACJ,IAAIC,sBAAyD,OACzD;EACE,QAAQ;EACR;EACA,aAAa,mBAAmB;EAChC,WAAW,mBAAmB;KAEhC;AAGJ,KAAI,oBAAoB,YAAY;AAClC,mBAAiB,MAAM,SAAS,IAAI,+BAClC;GACE,QAAQ;GACR;GACA,aAAa,mBAAmB;GAChC,WAAW,mBAAmB;KAEhC,QAAQ;AAEV,wBAAsB;;CAIxB,MAAM,EAAE,WAAW,OAAO,YAAY,MAAM,QAAQ,WAAW,EAAE,cAAc;AAC/E,KAAI,CAAC,UACH,QAAO,QAAQ,qBAAqB;EAClC,WAAW,QAAQ;EACnB,cAAc,gBAAgB;EAC9B,WAAW;EACX,OAAO;;AAKX,KAAI,oBAAoB,eAAe;AACrC,MAAI;AACF,SAAM,SAAS,IAAI,mBAAmB;IAAE,WAAW,QAAQ;IAAW,MAAM;;WACrEC,KAAc;GACrB,MAAM,MAAM,OAAQ,QAAQ,MAAO,WAAW,OAAO;AACrD,UAAO,QAAQ,qBAAqB;IAClC,WAAW,QAAQ;IACnB,cAAc,gBAAgB;IAC9B,WAAW;IACX,OAAO,OAAO;;;AAIlB,UAAQ,qBAAqB;GAC3B,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX;;AAEF;;AAIF,KAAI;EACF,MAAM,YAAY,MAAM,SAAS,IAAI,yBAAyB,SAAS;AACvE,mBAAiB,UAAU;AAC3B,uBAAqB,UAAU;AAC/B,UAAQ,SAAS,EAAE,cAAc;UAC1B,GAAG;AACV,UAAQ,MAAM,yCAAyC;;AAIzD,KAAI;AACF,MAAI,CAAC,eACH,OAAM,IAAI,MAAM;EAElB,MAAM,uBAAuB,MAAM,SAAS,SAAS,uCAAuC;GAC1F;GACA,cAAc;;EAKhB,IAAIC;EACJ,IAAIC;AACJ,MAAI;GAEF,MAAM,YAAY,MAAM,SAAS,IAAI;AACrC,OAAI,CAAC,UAAU,OACb,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,UAAU,iBAAiB,OAAO,UAAU,mBAAmB,OAAO,YAAY,gBACrF,OAAM,IAAI,MAAM;GAGlB,MAAM,eAAe,MAAM,4BAA4B,YAAY,gBAAgB,IAAI,UAAU;GACjG,MAAM,mBAAmB,MAAM,IAAI,UAAU,WAAW,gBAAgB,eAAe;GAEvF,MAAM,cAAc,kBAAkB,eAAe;AACrD,OAAI,CAAC,YACH,OAAM,IAAI,MAAM;AAMlB,OAAI,QAAQ,SAAS,uBAAuB,kBAAkB;IAC5D,MAAM,UAAU,0BAA0B;AAC1C,iBAAa,SAAS,SAAS;AAC/B,iBAAa,SAAS,SAAS;cACtB,QAAQ,SAAS,uBAAuB,qBAAqB;IACtE,MAAM,UAAU,QAAQ;AACxB,iBAAa,SAAS,cACjB,gCAAgC;AACrC,iBAAa,SAAS,cACjB,gCAAgC;;AAGvC,SAAM,SAAS,IAAI,+BAA+B;IAChD,WAAW,QAAQ;IACnB;IACA;IACA;IACA,YAAY;;WAEN,KAAK;AACZ,WAAQ,MAAM,gDAAgD;AAC9D,SAAM;;AAIT,UAAQ,qBAAqB;GAC3B,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,YAAY;GAGZ,cAAc;GACd;;UAEKF,KAAc;EAErB,MAAM,YAAY,6BAA6B;EAE/C,MAAM,MAAM,OAAQ,QAAQ,MAAO,WAAW,OAAO;AACrD,MAAI,sBAAsB,KAAK,QAAQ,uBAAuB,KAAK,KAEjE,QAAO,QAAQ,kBAAkB;AAEnC,MAAI,UACF,QAAO,QAAQ,YAAY,EAAE,MAAM,sBAAsB;EAE3D,MAAM,sBAAsB,mDAAmD,KAAK;AACpF,SAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO,YACH,eAAe,YACd,sBAAsB,MAAM,eAAe"}
+{"version":3,"file":"transactions-bqaAwL4k.js","names":["uiVrfChallenge: VRFChallenge | undefined","uiVrfChallengeForUi: Partial<VRFChallenge> | undefined","err: unknown","contractId: string | undefined","nearRpcUrl: string | undefined"],"sources":["../../../src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/flows/transactions.ts"],"sourcesContent":["import type { VrfWorkerManagerContext } from '../../';\nimport type { ConfirmationConfig } from '../../../../types/signer-worker';\nimport {\n  SecureConfirmationType,\n  TransactionSummary,\n  SigningSecureConfirmRequest,\n  SigningAuthMode,\n} from '../types';\nimport { VRFChallenge, TransactionContext } from '../../../../types';\nimport {\n  getNearAccountId,\n  getIntentDigest,\n  getTxCount,\n  isUserCancelledSecureConfirm,\n  ERROR_MESSAGES,\n  getSignTransactionPayload,\n} from './index';\nimport { toAccountId } from '../../../../types/accountIds';\nimport { getLastLoggedInDeviceNumber } from '../../../SignerWorkerManager/getDeviceNumber';\nimport { toError } from '../../../../../utils/errors';\nimport { PASSKEY_MANAGER_DEFAULT_CONFIGS } from '../../../../defaultConfigs';\nimport { createConfirmSession } from '../adapters/session';\nimport { createConfirmTxFlowAdapters } from '../adapters/createAdapters';\n\nfunction getSigningAuthMode(request: SigningSecureConfirmRequest): SigningAuthMode {\n  if (request.type === SecureConfirmationType.SIGN_TRANSACTION) {\n    return getSignTransactionPayload(request).signingAuthMode ?? 'webauthn';\n  }\n  if (request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE) {\n    const p = request.payload as any;\n    return (p?.signingAuthMode as SigningAuthMode | undefined) ?? 'webauthn';\n  }\n  return 'webauthn';\n}\n\nexport async function handleTransactionSigningFlow(\n  ctx: VrfWorkerManagerContext,\n  request: SigningSecureConfirmRequest,\n  worker: Worker,\n  opts: { confirmationConfig: ConfirmationConfig; transactionSummary: TransactionSummary },\n): Promise<void> {\n  const { confirmationConfig, transactionSummary } = opts;\n  const adapters = createConfirmTxFlowAdapters(ctx);\n  const session = createConfirmSession({\n    adapters,\n    worker,\n    request,\n    confirmationConfig,\n    transactionSummary,\n  });\n  const nearAccountId = getNearAccountId(request);\n  const signingAuthMode = getSigningAuthMode(request);\n  const usesNeeded = getTxCount(request);\n\n  // 1) NEAR context + nonce reservation\n  const nearRpc = await adapters.near.fetchNearContext({ nearAccountId, txCount: usesNeeded, reserveNonces: true });\n  if (nearRpc.error && !nearRpc.transactionContext) {\n    // eslint-disable-next-line no-console\n    console.error('[SigningFlow] fetchNearContext failed', { error: nearRpc.error, details: nearRpc.details });\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: `${ERROR_MESSAGES.nearRpcFailed}: ${nearRpc.details}`,\n    });\n  }\n  session.setReservedNonces(nearRpc.reservedNonces);\n  let transactionContext = nearRpc.transactionContext as TransactionContext;\n\n  // 2) Security context shown in the confirmer (rpId + block height).\n  // For warmSession signing we still want to show this context even though\n  // we won't collect a WebAuthn credential.\n  const rpId = adapters.vrf.getRpId();\n  let uiVrfChallenge: VRFChallenge | undefined;\n  let uiVrfChallengeForUi: Partial<VRFChallenge> | undefined = rpId\n    ? {\n        userId: nearAccountId,\n        rpId,\n        blockHeight: transactionContext.txBlockHeight,\n        blockHash: transactionContext.txBlockHash,\n      }\n    : undefined;\n\n  // Initial VRF challenge (only needed for WebAuthn credential collection)\n  if (signingAuthMode === 'webauthn') {\n    uiVrfChallenge = await adapters.vrf.generateVrfChallengeForSession(\n      {\n        userId: nearAccountId,\n        rpId,\n        blockHeight: transactionContext.txBlockHeight,\n        blockHash: transactionContext.txBlockHash,\n      },\n      request.requestId,\n    );\n    uiVrfChallengeForUi = uiVrfChallenge;\n  }\n\n  // 3) UI confirm\n  const { confirmed, error: uiError } = await session.promptUser({ vrfChallenge: uiVrfChallengeForUi });\n  if (!confirmed) {\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: uiError,\n    });\n  }\n\n  // 4) Warm session: dispense WrapKeySeed and skip WebAuthn\n  if (signingAuthMode === 'warmSession') {\n    try {\n      await adapters.vrf.dispenseSessionKey({ sessionId: request.requestId, uses: usesNeeded });\n    } catch (err: unknown) {\n      const msg = String((toError(err))?.message || err || '');\n      return session.confirmAndCloseModal({\n        requestId: request.requestId,\n        intentDigest: getIntentDigest(request),\n        confirmed: false,\n        error: msg || 'Failed to dispense warm session key',\n      });\n    }\n\n    session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: true,\n      transactionContext,\n    });\n    return;\n  }\n\n  // 5) JIT refresh VRF + ctx (best-effort)\n  try {\n    const refreshed = await adapters.vrf.maybeRefreshVrfChallenge(request, nearAccountId);\n    uiVrfChallenge = refreshed.vrfChallenge;\n    transactionContext = refreshed.transactionContext;\n    session.updateUI({ vrfChallenge: uiVrfChallenge });\n  } catch (e) {\n    console.debug('[SigningFlow] VRF JIT refresh skipped', e);\n  }\n\n  // 6) Collect authentication credential\n  try {\n    if (!uiVrfChallenge) {\n      throw new Error('Missing vrfChallenge for WebAuthn signing flow');\n    }\n    const serializedCredential = await adapters.webauthn.collectAuthenticationCredentialWithPRF({\n      nearAccountId,\n      vrfChallenge: uiVrfChallenge,\n    });\n\n    // 5c) Derive WrapKeySeed inside the VRF worker and deliver it to the signer worker via\n    // the reserved WrapKeySeed MessagePort. Main thread only sees wrapKeySalt metadata.\n    let contractId: string | undefined;\n    let nearRpcUrl: string | undefined;\n    try {\n      // Ensure VRF session is active and bound to the same account we are signing for.\n      const vrfStatus = await adapters.vrf.checkVrfStatus();\n      if (!vrfStatus.active) {\n        throw new Error('VRF keypair not active in memory. VRF session may have expired or was not properly initialized. Please refresh and try again.');\n      }\n      if (!vrfStatus.nearAccountId || String(vrfStatus.nearAccountId) !== String(toAccountId(nearAccountId))) {\n        throw new Error('VRF session is active but bound to a different account than the one being signed. Please log in again on this device.');\n      }\n\n      const deviceNumber = await getLastLoggedInDeviceNumber(toAccountId(nearAccountId), ctx.indexedDB.clientDB);\n      const encryptedKeyData = await ctx.indexedDB.nearKeysDB.getEncryptedKey(nearAccountId, deviceNumber);\n      // For v2+ vaults, wrapKeySalt is the canonical salt.\n      const wrapKeySalt = encryptedKeyData?.wrapKeySalt || '';\n      if (!wrapKeySalt) {\n        throw new Error('Missing wrapKeySalt in vault; re-register to upgrade vault format.');\n      }\n\n      // Extract contract verification context when available.\n      // - SIGN_TRANSACTION: use per-request rpcCall (already normalized by caller).\n      // - SIGN_NEP413_MESSAGE: allow per-request override; fall back to PASSKEY_MANAGER_DEFAULT_CONFIGS.\n      if (request.type === SecureConfirmationType.SIGN_TRANSACTION) {\n        const payload = getSignTransactionPayload(request);\n        contractId = payload?.rpcCall?.contractId;\n        nearRpcUrl = payload?.rpcCall?.nearRpcUrl;\n      } else if (request.type === SecureConfirmationType.SIGN_NEP413_MESSAGE) {\n        const payload = request.payload as any;\n        contractId = payload?.contractId\n          || PASSKEY_MANAGER_DEFAULT_CONFIGS.contractId;\n        nearRpcUrl = payload?.nearRpcUrl\n          || PASSKEY_MANAGER_DEFAULT_CONFIGS.nearRpcUrl;\n      }\n\n      await adapters.vrf.mintSessionKeysAndSendToSigner({\n        sessionId: request.requestId,\n        wrapKeySalt,\n        contractId,\n        nearRpcUrl,\n        credential: serializedCredential,\n      });\n\t    } catch (err) {\n\t      console.error('[SigningFlow] WrapKeySeed derivation failed:', err);\n\t      throw err; // Don't silently ignore - propagate the error\n\t    }\n\n    // 6) Respond; keep nonces reserved for worker to use\n    session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: true,\n      credential: serializedCredential,\n      // prfOutput intentionally omitted to keep signer PRF-free\n      // WrapKeySeed travels only over the dedicated VRF→Signer MessagePort; do not echo in the main-thread envelope\n      vrfChallenge: uiVrfChallenge,\n      transactionContext,\n    });\n  } catch (err: unknown) {\n    // Treat TouchID/FaceID cancellation and related errors as a negative decision\n    const cancelled = isUserCancelledSecureConfirm(err);\n    // For missing PRF outputs, surface the error to caller (defensive path tests expect a throw)\n    const msg = String((toError(err))?.message || err || '');\n    if (/Missing PRF result/i.test(msg) || /Missing PRF results/i.test(msg)) {\n      // Ensure UI is closed and nonces released, then rethrow\n      return session.cleanupAndRethrow(err);\n    }\n    if (cancelled) {\n      window.parent?.postMessage({ type: 'WALLET_UI_CLOSED' }, '*');\n    }\n    const isWrongPasskeyError = /multiple passkeys \\(devicenumbers\\) for account/i.test(msg);\n    return session.confirmAndCloseModal({\n      requestId: request.requestId,\n      intentDigest: getIntentDigest(request),\n      confirmed: false,\n      error: cancelled\n        ? ERROR_MESSAGES.cancelled\n        : (isWrongPasskeyError ? msg : ERROR_MESSAGES.collectCredentialsFailed),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;AAwBA,SAAS,mBAAmB,SAAuD;AACjF,KAAI,QAAQ,SAAS,uBAAuB,iBAC1C,QAAO,0BAA0B,SAAS,mBAAmB;AAE/D,KAAI,QAAQ,SAAS,uBAAuB,qBAAqB;EAC/D,MAAM,IAAI,QAAQ;AAClB,SAAQ,GAAG,mBAAmD;;AAEhE,QAAO;;AAGT,eAAsB,6BACpB,KACA,SACA,QACA,MACe;CACf,MAAM,EAAE,oBAAoB,uBAAuB;CACnD,MAAM,WAAW,4BAA4B;CAC7C,MAAM,UAAU,qBAAqB;EACnC;EACA;EACA;EACA;EACA;;CAEF,MAAM,gBAAgB,iBAAiB;CACvC,MAAM,kBAAkB,mBAAmB;CAC3C,MAAM,aAAa,WAAW;CAG9B,MAAM,UAAU,MAAM,SAAS,KAAK,iBAAiB;EAAE;EAAe,SAAS;EAAY,eAAe;;AAC1G,KAAI,QAAQ,SAAS,CAAC,QAAQ,oBAAoB;AAEhD,UAAQ,MAAM,yCAAyC;GAAE,OAAO,QAAQ;GAAO,SAAS,QAAQ;;AAChG,SAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO,GAAG,eAAe,cAAc,IAAI,QAAQ;;;AAGvD,SAAQ,kBAAkB,QAAQ;CAClC,IAAI,qBAAqB,QAAQ;CAKjC,MAAM,OAAO,SAAS,IAAI;CAC1B,IAAIA;CACJ,IAAIC,sBAAyD,OACzD;EACE,QAAQ;EACR;EACA,aAAa,mBAAmB;EAChC,WAAW,mBAAmB;KAEhC;AAGJ,KAAI,oBAAoB,YAAY;AAClC,mBAAiB,MAAM,SAAS,IAAI,+BAClC;GACE,QAAQ;GACR;GACA,aAAa,mBAAmB;GAChC,WAAW,mBAAmB;KAEhC,QAAQ;AAEV,wBAAsB;;CAIxB,MAAM,EAAE,WAAW,OAAO,YAAY,MAAM,QAAQ,WAAW,EAAE,cAAc;AAC/E,KAAI,CAAC,UACH,QAAO,QAAQ,qBAAqB;EAClC,WAAW,QAAQ;EACnB,cAAc,gBAAgB;EAC9B,WAAW;EACX,OAAO;;AAKX,KAAI,oBAAoB,eAAe;AACrC,MAAI;AACF,SAAM,SAAS,IAAI,mBAAmB;IAAE,WAAW,QAAQ;IAAW,MAAM;;WACrEC,KAAc;GACrB,MAAM,MAAM,OAAQ,QAAQ,MAAO,WAAW,OAAO;AACrD,UAAO,QAAQ,qBAAqB;IAClC,WAAW,QAAQ;IACnB,cAAc,gBAAgB;IAC9B,WAAW;IACX,OAAO,OAAO;;;AAIlB,UAAQ,qBAAqB;GAC3B,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX;;AAEF;;AAIF,KAAI;EACF,MAAM,YAAY,MAAM,SAAS,IAAI,yBAAyB,SAAS;AACvE,mBAAiB,UAAU;AAC3B,uBAAqB,UAAU;AAC/B,UAAQ,SAAS,EAAE,cAAc;UAC1B,GAAG;AACV,UAAQ,MAAM,yCAAyC;;AAIzD,KAAI;AACF,MAAI,CAAC,eACH,OAAM,IAAI,MAAM;EAElB,MAAM,uBAAuB,MAAM,SAAS,SAAS,uCAAuC;GAC1F;GACA,cAAc;;EAKhB,IAAIC;EACJ,IAAIC;AACJ,MAAI;GAEF,MAAM,YAAY,MAAM,SAAS,IAAI;AACrC,OAAI,CAAC,UAAU,OACb,OAAM,IAAI,MAAM;AAElB,OAAI,CAAC,UAAU,iBAAiB,OAAO,UAAU,mBAAmB,OAAO,YAAY,gBACrF,OAAM,IAAI,MAAM;GAGlB,MAAM,eAAe,MAAM,4BAA4B,YAAY,gBAAgB,IAAI,UAAU;GACjG,MAAM,mBAAmB,MAAM,IAAI,UAAU,WAAW,gBAAgB,eAAe;GAEvF,MAAM,cAAc,kBAAkB,eAAe;AACrD,OAAI,CAAC,YACH,OAAM,IAAI,MAAM;AAMlB,OAAI,QAAQ,SAAS,uBAAuB,kBAAkB;IAC5D,MAAM,UAAU,0BAA0B;AAC1C,iBAAa,SAAS,SAAS;AAC/B,iBAAa,SAAS,SAAS;cACtB,QAAQ,SAAS,uBAAuB,qBAAqB;IACtE,MAAM,UAAU,QAAQ;AACxB,iBAAa,SAAS,cACjB,gCAAgC;AACrC,iBAAa,SAAS,cACjB,gCAAgC;;AAGvC,SAAM,SAAS,IAAI,+BAA+B;IAChD,WAAW,QAAQ;IACnB;IACA;IACA;IACA,YAAY;;WAEN,KAAK;AACZ,WAAQ,MAAM,gDAAgD;AAC9D,SAAM;;AAIT,UAAQ,qBAAqB;GAC3B,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,YAAY;GAGZ,cAAc;GACd;;UAEKF,KAAc;EAErB,MAAM,YAAY,6BAA6B;EAE/C,MAAM,MAAM,OAAQ,QAAQ,MAAO,WAAW,OAAO;AACrD,MAAI,sBAAsB,KAAK,QAAQ,uBAAuB,KAAK,KAEjE,QAAO,QAAQ,kBAAkB;AAEnC,MAAI,UACF,QAAO,QAAQ,YAAY,EAAE,MAAM,sBAAsB;EAE3D,MAAM,sBAAsB,mDAAmD,KAAK;AACpF,SAAO,QAAQ,qBAAqB;GAClC,WAAW,QAAQ;GACnB,cAAc,gBAAgB;GAC9B,WAAW;GACX,OAAO,YACH,eAAe,YACd,sBAAsB,MAAM,eAAe"}

package/dist/esm/sdk/wallet-iframe-host.js

@@ -6,7 +6,7 @@ import "./asset-base-K63RlTrt.js";
 import "./tx-tree-themes-BND0SU2h.js";
 import { CONFIRM_UI_ELEMENT_SELECTORS, W3A_TX_BUTTON_HOST_ID, W3A_TX_BUTTON_ID, defineTag } from "./tags-C2Wlhqjd.js";
 import { WalletIframeDomEvents, computeUiIntentDigestFromTxs, orderActionForDigest } from "./txDigest-CxjhSCgm.js";
-import { base64UrlDecode } from "./base64-DBPGuXh4.js";
+import { base64Decode, base64UrlDecode, init_base64 } from "./base64-DBPGuXh4.js";
 import { ActionType, init_actions, toActionArgsWasm, validateActionArgsWasm } from "./actions-O1FD5Bq8.js";
 import { ensureKnownW3aElement } from "./ensure-defined-CHInSx7l.js";
 import { base58Encode, errorMessage, esm_default, getNearShortErrorMessage, getUserFriendlyErrorMessage, init_base58, init_encoders, init_errors, init_esm, isTouchIdCancellationError, toError } from "./errors-D9ar28Dr.js";
@@ -2226,6 +2226,7 @@ init_utils();
 init_encoders();
 init_base58();
 init_esm();
+init_base64();
 /**
 * Control messages exchanged between worker shims and the main thread.
 *
@@ -3271,42 +3272,42 @@ async function importFlow(label, loader) {
 }
 const HANDLERS = {
 	[SecureConfirmationType.DECRYPT_PRIVATE_KEY_WITH_PRF]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleLocalOnlyFlow } = await importFlow("localOnly", () => import("./localOnly-pXMTqh1m.js"));
+		const { handleLocalOnlyFlow } = await importFlow("localOnly", () => import("./localOnly-BHScJasw.js"));
 		await handleLocalOnlyFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.SHOW_SECURE_PRIVATE_KEY_UI]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleLocalOnlyFlow } = await importFlow("localOnly", () => import("./localOnly-pXMTqh1m.js"));
+		const { handleLocalOnlyFlow } = await importFlow("localOnly", () => import("./localOnly-BHScJasw.js"));
 		await handleLocalOnlyFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.REGISTER_ACCOUNT]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleRegistrationFlow } = await importFlow("registration", () => import("./registration-DLPLsGCz.js"));
+		const { handleRegistrationFlow } = await importFlow("registration", () => import("./registration-lDD60Ytt.js"));
 		await handleRegistrationFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.LINK_DEVICE]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleRegistrationFlow } = await importFlow("registration", () => import("./registration-DLPLsGCz.js"));
+		const { handleRegistrationFlow } = await importFlow("registration", () => import("./registration-lDD60Ytt.js"));
 		await handleRegistrationFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.SIGN_TRANSACTION]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleTransactionSigningFlow } = await importFlow("transactions", () => import("./transactions-Bk-VavcV.js"));
+		const { handleTransactionSigningFlow } = await importFlow("transactions", () => import("./transactions-BalIhtJ9.js"));
 		await handleTransactionSigningFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
 		});
 	},
 	[SecureConfirmationType.SIGN_NEP413_MESSAGE]: async ({ ctx, request, worker, confirmationConfig, transactionSummary }) => {
-		const { handleTransactionSigningFlow } = await importFlow("transactions", () => import("./transactions-Bk-VavcV.js"));
+		const { handleTransactionSigningFlow } = await importFlow("transactions", () => import("./transactions-BalIhtJ9.js"));
 		await handleTransactionSigningFlow(ctx, request, worker, {
 			confirmationConfig,
 			transactionSummary
@@ -6385,6 +6386,29 @@ var WebAuthnManager = class {
 	async extractCosePublicKey(attestationObjectBase64url) {
 		return await this.signerWorkerManager.extractCosePublicKey(attestationObjectBase64url);
 	}
+	/**
+	* Helper to ensure the local `lastUser` pointer is consistent with the latest DB updates.
+	* This fixes issues where a recovery or registration might have updated the user record
+	* but failed to update the `lastUser` pointer (e.g. due to previous bugs or interruptions),
+	* preventing the strict `ensureCurrentPasskey` check from passing.
+	*/
+	async autoHealLastUserPointer(nearAccountId) {
+		try {
+			const lastUser = await this.getLastUser();
+			if (lastUser && lastUser.nearAccountId === nearAccountId) {
+				const freshest = await IndexedDBManager.clientDB.getLastDBUpdatedUser(nearAccountId);
+				if (freshest && freshest.deviceNumber !== lastUser.deviceNumber) {
+					console.log(`[WebAuthnManager] Auto-healing lastUser pointer from device ${lastUser.deviceNumber} to ${freshest.deviceNumber}`);
+					await this.setLastUser(nearAccountId, freshest.deviceNumber);
+				}
+			} else {
+				const freshest = await IndexedDBManager.clientDB.getLastDBUpdatedUser(nearAccountId);
+				if (freshest) await this.setLastUser(nearAccountId, freshest.deviceNumber);
+			}
+		} catch (e) {
+			console.warn("[WebAuthnManager] Auto-heal pointer failed (non-fatal):", e);
+		}
+	}
 	/** Worker-driven export: two-phase V2 (collect PRF → decrypt → show UI) */
 	async exportNearKeypairWithUIWorkerDriven(nearAccountId, options) {
 		await this.withSigningSession({
@@ -10014,6 +10038,28 @@ var init_emailRecoveryPendingStore = __esm({ "src/core/EmailRecovery/emailRecove
 
 //#endregion
 //#region src/core/EmailRecovery/index.ts
+function getTxSuccessValueBase64(outcome) {
+	const status = outcome.status;
+	if (!status || typeof status !== "object") return null;
+	if (!("SuccessValue" in status)) return null;
+	const value = status.SuccessValue;
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
+function parseLinkDeviceRegisterUserResponse(outcome) {
+	try {
+		const successValueB64 = getTxSuccessValueBase64(outcome);
+		if (!successValueB64) return null;
+		const bytes = base64Decode(successValueB64);
+		const text = new TextDecoder().decode(bytes);
+		if (!text.trim()) return null;
+		const parsed = JSON.parse(text);
+		if (!parsed || typeof parsed !== "object") return null;
+		const candidate = parsed;
+		return typeof candidate.verified === "boolean" ? candidate : null;
+	} catch {
+		return null;
+	}
+}
 async function hashRecoveryEmails(emails, accountId) {
 	const encoder = new TextEncoder();
 	const salt = (accountId || "").trim().toLowerCase();
@@ -10085,6 +10131,27 @@ var init_EmailRecovery = __esm({ "src/core/EmailRecovery/index.ts": (() => {
 	};
 }) });
 
+//#endregion
+//#region src/core/types/emailRecovery.ts
+var EmailRecoveryErrorCode, EmailRecoveryError;
+var init_emailRecovery$1 = __esm({ "src/core/types/emailRecovery.ts": (() => {
+	EmailRecoveryErrorCode = /* @__PURE__ */ function(EmailRecoveryErrorCode$1) {
+		EmailRecoveryErrorCode$1["REGISTRATION_NOT_VERIFIED"] = "EMAIL_RECOVERY_REGISTRATION_NOT_VERIFIED";
+		EmailRecoveryErrorCode$1["VRF_CHALLENGE_EXPIRED"] = "EMAIL_RECOVERY_VRF_CHALLENGE_EXPIRED";
+		return EmailRecoveryErrorCode$1;
+	}({});
+	EmailRecoveryError = class extends Error {
+		code;
+		context;
+		constructor(message, code, context) {
+			super(message);
+			this.name = "EmailRecoveryError";
+			this.code = code;
+			this.context = context;
+		}
+	};
+}) });
+
 //#endregion
 //#region src/core/TatchiPasskey/emailRecovery.ts
 var emailRecovery_exports = {};
@@ -10124,6 +10191,7 @@ var EmailRecoveryFlow;
 var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (() => {
 	init_IndexedDBManager();
 	init_validation$1();
+	init_errors();
 	init_accountIds();
 	init_sdkSentEvents();
 	init_vrf_worker();
@@ -10131,6 +10199,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 	init_getDeviceNumber();
 	init_login();
 	init_EmailRecovery();
+	init_emailRecovery$1();
 	EmailRecoveryFlow = class {
 		context;
 		options;
@@ -10158,8 +10227,9 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 		emit(event) {
 			this.options?.onEvent?.(event);
 		}
-		emitError(step, message) {
-			const err$1 = new Error(message);
+		emitError(step, messageOrError) {
+			const err$1 = typeof messageOrError === "string" ? new Error(messageOrError) : messageOrError;
+			const message = err$1.message || (typeof messageOrError === "string" ? messageOrError : "Unknown error");
 			this.phase = EmailRecoveryPhase.ERROR;
 			this.error = err$1;
 			this.emit({
@@ -10218,8 +10288,8 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				const accountView = await this.context.nearClient.viewAccount(nearAccountId);
 				const available = this.computeAvailableBalance(accountView);
 				if (available < BigInt(minBalanceYocto)) await this.fail(1, `This account does not have enough NEAR to finalize recovery. Available: ${available.toString()} yocto; required: ${String(minBalanceYocto)}. Please top up and try again.`);
-			} catch (e) {
-				await this.fail(1, e?.message || "Failed to fetch account balance for recovery");
+			} catch (err$1) {
+				await this.fail(1, errorMessage(err$1) || "Failed to fetch account balance for recovery");
 			}
 		}
 		async getCanonicalRecoveryEmailOrFail(recoveryEmail) {
@@ -10231,7 +10301,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 			try {
 				const { syncAuthenticatorsContractCall: syncAuthenticatorsContractCall$1 } = await import("./rpcCalls-BQrJMTdg.js");
 				const authenticators = await syncAuthenticatorsContractCall$1(this.context.nearClient, this.context.configs.contractId, nearAccountId);
-				const numbers = authenticators.map((a) => a?.authenticator?.deviceNumber).filter((n) => typeof n === "number" && Number.isFinite(n));
+				const numbers = authenticators.map(({ authenticator }) => authenticator.deviceNumber).filter((n) => typeof n === "number" && Number.isFinite(n));
 				const max = numbers.length > 0 ? Math.max(...numbers) : 0;
 				return max + 1;
 			} catch {
@@ -10479,7 +10549,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 					nearPublicKey: rec.nearPublicKey
 				};
 			} catch (e) {
-				const err$1 = this.emitError(2, e?.message || "Email recovery TouchID/derivation failed");
+				const err$1 = this.emitError(2, errorMessage(e) || "Email recovery TouchID/derivation failed");
 				await this.options?.afterCall?.(false);
 				throw err$1;
 			}
@@ -10649,7 +10719,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				accountId
 			};
 		}
-		async signRegistrationTx(rec, accountId) {
+		async signNewDevice2RegistrationTx(rec, accountId) {
 			const vrfChallenge = rec.vrfChallenge;
 			if (!vrfChallenge) return this.fail(5, "Missing VRF challenge for email recovery registration");
 			const registrationResult = await this.context.webAuthnManager.signDevice2RegistrationWithStoredKey({
@@ -10663,47 +10733,56 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 			return registrationResult.signedTransaction;
 		}
 		async broadcastRegistrationTxAndWaitFinal(rec, signedTx) {
+			let txResult;
 			try {
-				const txResult = await this.context.nearClient.sendTransaction(signedTx, DEFAULT_WAIT_STATUS.linkDeviceRegistration);
-				try {
-					const txHash = txResult?.transaction?.hash || txResult?.transaction_hash;
-					if (txHash) this.emit({
-						step: 5,
-						phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,
-						status: EmailRecoveryStatus.PROGRESS,
-						message: "Registration transaction confirmed",
-						data: {
-							accountId: rec.accountId,
-							nearPublicKey: rec.nearPublicKey,
-							transactionHash: txHash
-						}
-					});
-					return txHash;
-				} catch {}
-			} catch (e) {
-				const msg = String(e?.message || "");
-				await this.fail(5, msg || "Failed to broadcast email recovery registration transaction (insufficient funds or RPC error)");
+				txResult = await this.context.nearClient.sendTransaction(signedTx, DEFAULT_WAIT_STATUS.linkDeviceRegistration);
+			} catch (err$1) {
+				const msg = errorMessage(err$1) || "Failed to broadcast email recovery registration transaction (insufficient funds or RPC error)";
+				throw new Error(msg);
 			}
-			return void 0;
-		}
-		async persistRecoveredUserRecordBestEffort(rec, accountId) {
-			try {
-				await IndexedDBManager.clientDB.storeWebAuthnUserData({
-					nearAccountId: accountId,
-					deviceNumber: rec.deviceNumber,
-					clientNearPublicKey: rec.nearPublicKey,
-					passkeyCredential: {
-						id: rec.credential.id,
-						rawId: rec.credential.rawId
-					},
-					encryptedVrfKeypair: rec.encryptedVrfKeypair,
-					serverEncryptedVrfKeypair: rec.serverEncryptedVrfKeypair || void 0
+			const txHash = this.getTxHash(txResult);
+			const linkDeviceResult = parseLinkDeviceRegisterUserResponse(txResult);
+			if (linkDeviceResult?.verified === false) {
+				const logs = this.extractNearExecutionLogs(txResult);
+				const isStaleChallenge = logs.some((log) => /StaleChallenge|freshness validation failed/i.test(log));
+				const txHint = txHash ? ` (tx: ${txHash})` : "";
+				const code = isStaleChallenge ? EmailRecoveryErrorCode.VRF_CHALLENGE_EXPIRED : EmailRecoveryErrorCode.REGISTRATION_NOT_VERIFIED;
+				const message = isStaleChallenge ? `Timed out finalizing registration (VRF challenge expired). Please restart email recovery and try again${txHint}.` : `Registration did not verify on-chain. Please try again${txHint}.`;
+				throw new EmailRecoveryError(message, code, {
+					accountId: rec.accountId,
+					nearPublicKey: rec.nearPublicKey,
+					transactionHash: txHash,
+					logs,
+					result: linkDeviceResult
 				});
-				return true;
-			} catch (err$1) {
-				console.warn("[EmailRecoveryFlow] Failed to store recovery user record:", err$1);
-				return false;
 			}
+			if (txHash) this.emit({
+				step: 5,
+				phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,
+				status: EmailRecoveryStatus.PROGRESS,
+				message: "Registration transaction confirmed",
+				data: {
+					accountId: rec.accountId,
+					nearPublicKey: rec.nearPublicKey,
+					transactionHash: txHash
+				}
+			});
+			return txHash;
+		}
+		getTxHash(outcome) {
+			const txUnknown = outcome.transaction;
+			if (txUnknown && typeof txUnknown === "object") {
+				const hash = txUnknown.hash;
+				if (typeof hash === "string" && hash.length > 0) return hash;
+			}
+			const fallback = outcome.transaction_hash;
+			return typeof fallback === "string" && fallback.length > 0 ? fallback : void 0;
+		}
+		extractNearExecutionLogs(outcome) {
+			const logs = [];
+			for (const entry of outcome.transaction_outcome.outcome.logs) logs.push(String(entry));
+			for (const receipt of outcome.receipts_outcome) for (const entry of receipt.outcome.logs) logs.push(String(entry));
+			return logs;
 		}
 		mapAuthenticatorsFromContract(authenticators) {
 			return authenticators.map(({ authenticator }) => ({
@@ -10739,7 +10818,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 		}
 		async updateNonceBestEffort(nonceManager, signedTx) {
 			try {
-				const txNonce = signedTx.transaction?.nonce;
+				const txNonce = signedTx.transaction.nonce;
 				if (txNonce != null) await nonceManager.updateNonceFromBlockchain(this.context.nearClient, String(txNonce));
 			} catch {}
 		}
@@ -10762,6 +10841,10 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 			};
 			await webAuthnManager.storeUserData(payload);
 		}
+		/**
+		* Explicitly persist the authenticator from the recovery record into the local cache.
+		* This ensures the key is available immediately, bridging the gap before RPC sync sees it.
+		*/
 		async persistAuthenticatorBestEffort(rec, accountId) {
 			try {
 				const { webAuthnManager } = this.context;
@@ -10778,7 +10861,10 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 					syncedAt: (/* @__PURE__ */ new Date()).toISOString(),
 					vrfPublicKey: rec.vrfPublicKey
 				});
-			} catch {}
+				console.log("[EmailRecoveryFlow] Locally persisted recovered authenticator for immediate use.");
+			} catch (e) {
+				console.error("[EmailRecoveryFlow] Failed to locally persist authenticator (critical for immediate export):", e);
+			}
 		}
 		async markCompleteAndClearPending(rec) {
 			rec.status = "complete";
@@ -10848,7 +10934,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 			} catch (err$1) {
 				return {
 					success: false,
-					reason: err$1?.message || String(err$1)
+					reason: errorMessage(err$1) || String(err$1)
 				};
 			}
 		}
@@ -10876,18 +10962,14 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 			});
 			try {
 				const { nonceManager, accountId } = this.initializeNonceManager(rec);
-				const signedTx = await this.signRegistrationTx(rec, accountId);
+				const signedTx = await this.signNewDevice2RegistrationTx(rec, accountId);
 				const txHash = await this.broadcastRegistrationTxAndWaitFinal(rec, signedTx);
-				if (txHash) {
-					const storedUser = await this.persistRecoveredUserRecordBestEffort(rec, accountId);
-					if (storedUser) {
-						const syncedAuthenticators = await this.syncAuthenticatorsBestEffort(accountId);
-						if (syncedAuthenticators) await this.setLastUserBestEffort(accountId, rec.deviceNumber);
-					}
-				}
-				await this.updateNonceBestEffort(nonceManager, signedTx);
+				if (!txHash) console.warn("[EmailRecoveryFlow] Registration transaction confirmed without hash; continuing local persistence");
 				await this.persistRecoveredUserData(rec, accountId);
+				await this.syncAuthenticatorsBestEffort(accountId);
 				await this.persistAuthenticatorBestEffort(rec, accountId);
+				await this.setLastUserBestEffort(accountId, rec.deviceNumber);
+				await this.updateNonceBestEffort(nonceManager, signedTx);
 				this.emitAutoLoginEvent(EmailRecoveryStatus.PROGRESS, "Attempting auto-login with recovered device...", { autoLogin: "progress" });
 				const autoLoginResult = await this.attemptAutoLogin(rec);
 				if (autoLoginResult.success) this.emitAutoLoginEvent(EmailRecoveryStatus.SUCCESS, `Welcome ${accountId}`, { autoLogin: "success" });
@@ -10908,7 +10990,10 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 					}
 				});
 			} catch (e) {
-				const err$1 = this.emitError(5, e?.message || "Email recovery finalization failed");
+				rec.status = "error";
+				await this.savePending(rec).catch(() => {});
+				const original = e instanceof Error ? e : new Error(errorMessage(e) || "Email recovery finalization failed");
+				const err$1 = this.emitError(5, original);
 				await this.options?.afterCall?.(false);
 				throw err$1;
 			}
@@ -10930,7 +11015,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				};
 				return this.handleAutoLoginFailure(touchIdResult.reason || "Auto-login failed");
 			} catch (err$1) {
-				return this.handleAutoLoginFailure(err$1?.message || String(err$1), err$1);
+				return this.handleAutoLoginFailure(errorMessage(err$1) || String(err$1), err$1);
 			}
 		}
 	};

package/dist/types/src/core/EmailRecovery/index.d.ts

@@ -1,11 +1,19 @@
 import type { AccountId } from '../types/accountIds';
 import { type RecoveryEmailRecord } from '../IndexedDBManager';
+import type { FinalExecutionOutcome } from '@near-js/types';
 export { EmailRecoveryPendingStore, type PendingStore } from './emailRecoveryPendingStore';
 export type RecoveryEmailEntry = {
     hashHex: string;
     email: string;
 };
 export { type RecoveryEmailRecord };
+export type LinkDeviceRegisterUserResponse = {
+    verified?: boolean;
+    registration_info?: unknown;
+    registrationInfo?: unknown;
+    error?: unknown;
+};
+export declare function parseLinkDeviceRegisterUserResponse(outcome: FinalExecutionOutcome): LinkDeviceRegisterUserResponse | null;
 export declare const canonicalizeEmail: (email: string) => string;
 export declare const bytesToHex: (bytes: number[] | Uint8Array) => string;
 /**

package/dist/types/src/core/EmailRecovery/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/EmailRecovery/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3F,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,OAAO,EAAE,KAAK,mBAAmB,EAAE,CAAC;AAEpC,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,KAAG,MA2BjD,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,EAAE,GAAG,UAAU,KAAG,MAKzD,CAAC;AA4BF;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACvG,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;IACnB,KAAK,EAAE,kBAAkB,EAAE,CAAC;CAC7B,CAAC,CAqBD;AAED,wBAAsB,sBAAsB,CAAC,aAAa,EAAE,SAAS,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAErG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/EmailRecovery/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAAE,yBAAyB,EAAE,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3F,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,OAAO,EAAE,KAAK,mBAAmB,EAAE,CAAC;AAEpC,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAUF,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,qBAAqB,GAC7B,8BAA8B,GAAG,IAAI,CAgBvC;AAED,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,KAAG,MA2BjD,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,EAAE,GAAG,UAAU,KAAG,MAKzD,CAAC;AA4BF;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACvG,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;IACnB,KAAK,EAAE,kBAAkB,EAAE,CAAC;CAC7B,CAAC,CAqBD;AAED,wBAAsB,sBAAsB,CAAC,aAAa,EAAE,SAAS,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAErG"}

package/dist/types/src/core/TatchiPasskey/emailRecovery.d.ts

@@ -105,14 +105,19 @@ export declare class EmailRecoveryFlow {
     }): Promise<void>;
     private pollUntilAddKey;
     private initializeNonceManager;
-    private signRegistrationTx;
+    private signNewDevice2RegistrationTx;
     private broadcastRegistrationTxAndWaitFinal;
-    private persistRecoveredUserRecordBestEffort;
+    private getTxHash;
+    private extractNearExecutionLogs;
     private mapAuthenticatorsFromContract;
     private syncAuthenticatorsBestEffort;
     private setLastUserBestEffort;
     private updateNonceBestEffort;
     private persistRecoveredUserData;
+    /**
+     * Explicitly persist the authenticator from the recovery record into the local cache.
+     * This ensures the key is available immediately, bridging the gap before RPC sync sees it.
+     */
     private persistAuthenticatorBestEffort;
     private markCompleteAndClearPending;
     private assertVrfActiveForAccount;

package/dist/types/src/core/TatchiPasskey/emailRecovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"emailRecovery.d.ts","sourceRoot":"","sources":["../../../../../src/core/TatchiPasskey/emailRecovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAGrD,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EACL,kBAAkB,EAElB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,SAAS,EACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAKjE,OAAO,EAA6B,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhF,MAAM,MAAM,0BAA0B,GAClC,gBAAgB,GAChB,kBAAkB,GAClB,YAAY,GACZ,UAAU,GACV,OAAO,CAAC;AAEZ,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,SAAS,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,yBAAyB,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,8BAA8B,CAAC;IAC3C,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,0BAA0B,CAAC;CACpC,CAAC;AAqCF,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,aAAa,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,kBAAkB,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAClD;AA8BD,wBAAgB,8BAA8B,IAAI,MAAM,CAWvD;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,OAAO,CAAC,CAA2B;IAC3C,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,KAAK,CAA6D;IAC1E,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,oBAAoB,CAAC,CAA6C;IAC1E,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,KAAK,CAAC,CAAQ;gBAEV,OAAO,EAAE,qBAAqB,EAAE,OAAO,CAAC,EAAE,wBAAwB;IAQ9E,UAAU,CAAC,OAAO,CAAC,EAAE,wBAAwB;IAO7C,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,SAAS;YAeH,IAAI;YAMJ,0BAA0B;YAQ1B,oBAAoB;IAiClC,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,uBAAuB;YAUjB,uBAAuB;YAiBvB,+BAA+B;YAQ/B,+BAA+B;YAkB/B,+BAA+B;YAyB/B,wBAAwB;IAgCtC,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,kBAAkB;YAcZ,sBAAsB;IA4DpC,OAAO,CAAC,qBAAqB;YAcf,oBAAoB;YAapB,SAAS;YAoCT,WAAW;YAOX,WAAW;YAKX,YAAY;IAY1B,QAAQ;;;;;IAQF,cAAc,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAyBpF,KAAK,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IA6DtH,OAAO,CAAC,sBAAsB;YAQhB,6BAA6B;IAMrC,YAAY,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBtF,WAAW,IAAI,IAAI;IAYnB;;;;OAIG;IACG,cAAc,CAAC,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBpF,QAAQ,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YA0CpE,eAAe;IA8E7B,OAAO,CAAC,sBAAsB;YAYhB,kBAAkB;YAqBlB,mCAAmC;YAwCnC,oCAAoC;IAuBlD,OAAO,CAAC,6BAA6B;YAYvB,4BAA4B;YAkB5B,qBAAqB;YAUrB,qBAAqB;YAiBrB,wBAAwB;YAsBxB,8BAA8B;YAqB9B,2BAA2B;YAM3B,yBAAyB;YAWzB,uBAAuB;YAOvB,eAAe;YAmCf,gBAAgB;YA6ChB,sBAAsB;YAQtB,oBAAoB;YAoEpB,gBAAgB;CAyB/B"}
+{"version":3,"file":"emailRecovery.d.ts","sourceRoot":"","sources":["../../../../../src/core/TatchiPasskey/emailRecovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAIrD,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EACL,kBAAkB,EAElB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,SAAS,EACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAuB,8BAA8B,EAAE,MAAM,UAAU,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAKjE,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,kBAAkB,CAAC;AAG1B,MAAM,MAAM,0BAA0B,GAClC,gBAAgB,GAChB,kBAAkB,GAClB,YAAY,GACZ,UAAU,GACV,OAAO,CAAC;AAEZ,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,SAAS,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,yBAAyB,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,8BAA8B,CAAC;IAC3C,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,0BAA0B,CAAC;CACpC,CAAC;AAqCF,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,aAAa,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,kBAAkB,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAClD;AA8BD,wBAAgB,8BAA8B,IAAI,MAAM,CAWvD;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,OAAO,CAAC,CAA2B;IAC3C,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,KAAK,CAA6D;IAC1E,OAAO,CAAC,YAAY,CAA4C;IAChE,OAAO,CAAC,oBAAoB,CAAC,CAAa;IAC1C,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,KAAK,CAAC,CAAQ;gBAEV,OAAO,EAAE,qBAAqB,EAAE,OAAO,CAAC,EAAE,wBAAwB;IAQ9E,UAAU,CAAC,OAAO,CAAC,EAAE,wBAAwB;IAO7C,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,SAAS;YAgBH,IAAI;YAMJ,0BAA0B;YAQ1B,oBAAoB;IAiClC,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,uBAAuB;YAUjB,uBAAuB;YAiBvB,+BAA+B;YAQ/B,+BAA+B;YAkB/B,+BAA+B;YAyB/B,wBAAwB;IAgCtC,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,kBAAkB;YAcZ,sBAAsB;IA4DpC,OAAO,CAAC,qBAAqB;YAcf,oBAAoB;YAapB,SAAS;YAoCT,WAAW;YAOX,WAAW;YAKX,YAAY;IAY1B,QAAQ;;;;;IAQF,cAAc,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAyBpF,KAAK,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IA6DtH,OAAO,CAAC,sBAAsB;YAQhB,6BAA6B;IAMrC,YAAY,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBtF,WAAW,IAAI,IAAI;IAYnB;;;;OAIG;IACG,cAAc,CAAC,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBpF,QAAQ,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YA0CpE,eAAe;IA8E7B,OAAO,CAAC,sBAAsB;YAehB,4BAA4B;YAqB5B,mCAAmC;IAyDjD,OAAO,CAAC,SAAS;IAWjB,OAAO,CAAC,wBAAwB;IAahC,OAAO,CAAC,6BAA6B;YAcvB,4BAA4B;YAkB5B,qBAAqB;YAUrB,qBAAqB;YAiBrB,wBAAwB;IAsBtC;;;OAGG;YACW,8BAA8B;YAwB9B,2BAA2B;YAM3B,yBAAyB;YAWzB,uBAAuB;YAOvB,eAAe;YAmCf,gBAAgB;YA6ChB,sBAAsB;YAQtB,oBAAoB;YAgFpB,gBAAgB;CAyB/B"}