@tatchi-xyz/sdk 0.19.0 → 0.21.0

package/dist/esm/core/TatchiPasskey/emailRecovery.js

@@ -3,12 +3,16 @@ import { init_validation, validateNearAccountId } from "../../utils/validation.j
 import { init_accountIds, toAccountId } from "../types/accountIds.js";
 import { IndexedDBManager, init_IndexedDBManager } from "../IndexedDBManager/index.js";
 import { createRandomVRFChallenge, init_vrf_worker } from "../types/vrf-worker.js";
+import { errorMessage, init_errors } from "../../utils/errors.js";
 import { EmailRecoveryPhase, EmailRecoveryStatus, init_sdkSentEvents } from "../types/sdkSentEvents.js";
 import { DEFAULT_WAIT_STATUS, init_rpc } from "../types/rpc.js";
+import { getEmailRecoveryAttempt, init_rpcCalls } from "../rpcCalls.js";
 import { init_getDeviceNumber, parseDeviceNumber } from "../WebAuthnManager/SignerWorkerManager/getDeviceNumber.js";
+import { ensureEd25519Prefix, init_nearCrypto } from "../nearCrypto.js";
 import { getLoginSession, init_login } from "./login.js";
 import { EmailRecoveryPendingStore } from "../EmailRecovery/emailRecoveryPendingStore.js";
-import { init_EmailRecovery } from "../EmailRecovery/index.js";
+import { init_EmailRecovery, parseLinkDeviceRegisterUserResponse } from "../EmailRecovery/index.js";
+import { EmailRecoveryError, EmailRecoveryErrorCode, init_emailRecovery as init_emailRecovery$1 } from "../types/emailRecovery.js";
 
 //#region src/core/TatchiPasskey/emailRecovery.ts
 var emailRecovery_exports = {};
@@ -23,16 +27,12 @@ function getEmailRecoveryConfig(configs) {
 	const maxPollingDurationMs = Number(relayerEmailCfg.maxPollingDurationMs);
 	const pendingTtlMs = Number(relayerEmailCfg.pendingTtlMs);
 	const mailtoAddress = String(relayerEmailCfg.mailtoAddress);
-	const dkimVerifierAccountId = String(relayerEmailCfg.dkimVerifierAccountId);
-	const verificationViewMethod = String(relayerEmailCfg.verificationViewMethod);
 	return {
 		minBalanceYocto,
 		pollingIntervalMs,
 		maxPollingDurationMs,
 		pendingTtlMs,
-		mailtoAddress,
-		dkimVerifierAccountId,
-		verificationViewMethod
+		mailtoAddress
 	};
 }
 function generateEmailRecoveryRequestId() {
@@ -48,6 +48,7 @@ var EmailRecoveryFlow;
 var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (() => {
 	init_IndexedDBManager();
 	init_validation();
+	init_errors();
 	init_accountIds();
 	init_sdkSentEvents();
 	init_vrf_worker();
@@ -55,6 +56,9 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 	init_getDeviceNumber();
 	init_login();
 	init_EmailRecovery();
+	init_emailRecovery$1();
+	init_rpcCalls();
+	init_nearCrypto();
 	EmailRecoveryFlow = class {
 		context;
 		options;
@@ -82,8 +86,9 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 		emit(event) {
 			this.options?.onEvent?.(event);
 		}
-		emitError(step, message) {
-			const err = new Error(message);
+		emitError(step, messageOrError) {
+			const err = typeof messageOrError === "string" ? new Error(messageOrError) : messageOrError;
+			const message = err.message || (typeof messageOrError === "string" ? messageOrError : "Unknown error");
 			this.phase = EmailRecoveryPhase.ERROR;
 			this.error = err;
 			this.emit({
@@ -142,20 +147,19 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				const accountView = await this.context.nearClient.viewAccount(nearAccountId);
 				const available = this.computeAvailableBalance(accountView);
 				if (available < BigInt(minBalanceYocto)) await this.fail(1, `This account does not have enough NEAR to finalize recovery. Available: ${available.toString()} yocto; required: ${String(minBalanceYocto)}. Please top up and try again.`);
-			} catch (e) {
-				await this.fail(1, e?.message || "Failed to fetch account balance for recovery");
+			} catch (err) {
+				await this.fail(1, errorMessage(err) || "Failed to fetch account balance for recovery");
 			}
 		}
-		async getCanonicalRecoveryEmailOrFail(recoveryEmail) {
+		getCanonicalRecoveryEmail(recoveryEmail) {
 			const canonicalEmail = String(recoveryEmail || "").trim().toLowerCase();
-			if (!canonicalEmail) await this.fail(1, "Recovery email is required for email-based account recovery");
-			return canonicalEmail;
+			return canonicalEmail || void 0;
 		}
 		async getNextDeviceNumberFromContract(nearAccountId) {
 			try {
 				const { syncAuthenticatorsContractCall } = await import("../rpcCalls.js");
 				const authenticators = await syncAuthenticatorsContractCall(this.context.nearClient, this.context.configs.contractId, nearAccountId);
-				const numbers = authenticators.map((a) => a?.authenticator?.deviceNumber).filter((n) => typeof n === "number" && Number.isFinite(n));
+				const numbers = authenticators.map(({ authenticator }) => authenticator.deviceNumber).filter((n) => typeof n === "number" && Number.isFinite(n));
 				const max = numbers.length > 0 ? Math.max(...numbers) : 0;
 				return max + 1;
 			} catch {
@@ -207,7 +211,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				message: "New device key created; please send the recovery email from your registered address.",
 				data: {
 					accountId: rec.accountId,
-					recoveryEmail: rec.recoveryEmail,
+					...rec.recoveryEmail ? { recoveryEmail: rec.recoveryEmail } : {},
 					nearPublicKey: rec.nearPublicKey,
 					requestId: rec.requestId,
 					mailtoUrl
@@ -223,44 +227,57 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				data
 			});
 		}
-		async checkViaDkimViewMethod(rec) {
-			const { dkimVerifierAccountId, verificationViewMethod } = this.getConfig();
-			if (!dkimVerifierAccountId) return null;
+		async checkViaEmailRecovererAttempt(rec) {
 			try {
-				const { getEmailRecoveryVerificationResult } = await import("../rpcCalls.js");
-				const result = await getEmailRecoveryVerificationResult(this.context.nearClient, dkimVerifierAccountId, verificationViewMethod, rec.requestId);
-				if (!result) return {
+				const attempt = await getEmailRecoveryAttempt(this.context.nearClient, rec.accountId, rec.requestId);
+				if (!attempt) return {
 					completed: false,
-					success: false
+					success: false,
+					missing: true
 				};
-				if (!result.verified) {
-					const errorMessage = result.error_message || result.error_code || "Email verification failed on relayer/contract";
-					return {
+				if (attempt.request_id && attempt.request_id !== rec.requestId) return {
+					completed: true,
+					success: false,
+					errorMessage: "Email recovery attempt request_id does not match requested requestId."
+				};
+				if (attempt.new_public_key && attempt.new_public_key !== rec.nearPublicKey) {
+					const expected = ensureEd25519Prefix(rec.nearPublicKey);
+					const actual = ensureEd25519Prefix(attempt.new_public_key);
+					if (actual === expected) {} else return {
 						completed: true,
 						success: false,
-						errorMessage,
-						transactionHash: result.transaction_hash
+						errorMessage: `Email recovery new_public_key mismatch for request ${rec.requestId}. Expected ${expected}; got ${actual}. This usually means the recovery email you sent was generated for a different device/attempt.`
 					};
 				}
-				if (result.account_id && result.account_id !== rec.accountId) return {
+				const normalized = attempt.status.toLowerCase();
+				if (normalized === "complete" || normalized === "completed") return {
 					completed: true,
-					success: false,
-					errorMessage: "Email verification account_id does not match requested account.",
-					transactionHash: result.transaction_hash
+					success: true
 				};
-				if (result.new_public_key && result.new_public_key !== rec.nearPublicKey) return {
+				if (normalized.includes("failed")) return {
 					completed: true,
 					success: false,
-					errorMessage: "Email verification new_public_key does not match expected recovery key.",
-					transactionHash: result.transaction_hash
+					errorMessage: attempt.error || `Email recovery failed (${attempt.status || "unknown status"})`
 				};
 				return {
-					completed: true,
-					success: true,
-					transactionHash: result.transaction_hash
+					completed: false,
+					success: false
 				};
 			} catch (err) {
-				console.warn("[EmailRecoveryFlow] get_verification_result view failed; will retry", err);
+				console.warn("[EmailRecoveryFlow] get_recovery_attempt view failed; will retry", err);
+				return null;
+			}
+		}
+		async isRecoveryAccessKeyPresent(rec) {
+			try {
+				await this.context.nearClient.viewAccessKey(rec.accountId, rec.nearPublicKey);
+				return true;
+			} catch (err) {
+				const kind = typeof err?.kind === "string" ? String(err.kind) : "";
+				const short = typeof err?.short === "string" ? String(err.short) : "";
+				const msg = typeof err?.message === "string" ? String(err.message) : "";
+				if (/AccessKeyDoesNotExist/i.test(kind) || /AccessKeyDoesNotExist/i.test(short) || /access key does not exist/i.test(msg) || /access key .*does not exist/i.test(msg)) return false;
+				console.warn("[EmailRecoveryFlow] view_access_key failed while checking recovery key; will retry", err);
 				return null;
 			}
 		}
@@ -369,7 +386,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 			});
 			const nearAccountId = await this.assertValidAccountIdOrFail(1, accountId);
 			await this.assertSufficientBalance(nearAccountId);
-			const canonicalEmail = await this.getCanonicalRecoveryEmailOrFail(recoveryEmail);
+			const canonicalEmail = this.getCanonicalRecoveryEmail(recoveryEmail);
 			const deviceNumber = await this.getNextDeviceNumberFromContract(nearAccountId);
 			this.phase = EmailRecoveryPhase.STEP_2_TOUCH_ID_REGISTRATION;
 			this.emit({
@@ -403,7 +420,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 					nearPublicKey: rec.nearPublicKey
 				};
 			} catch (e) {
-				const err = this.emitError(2, e?.message || "Email recovery TouchID/derivation failed");
+				const err = this.emitError(2, errorMessage(e) || "Email recovery TouchID/derivation failed");
 				await this.options?.afterCall?.(false);
 				throw err;
 			}
@@ -500,29 +517,39 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 			await this.options?.afterCall?.(true, void 0);
 		}
 		async pollUntilAddKey(rec) {
-			const { pollingIntervalMs, maxPollingDurationMs, dkimVerifierAccountId } = this.getConfig();
-			if (!dkimVerifierAccountId) {
-				const err$1 = this.emitError(4, "Email recovery verification contract (dkimVerifierAccountId) is not configured");
-				await this.options?.afterCall?.(false);
-				throw err$1;
-			}
+			const { pollingIntervalMs, maxPollingDurationMs } = this.getConfig();
 			this.phase = EmailRecoveryPhase.STEP_4_POLLING_VERIFICATION_RESULT;
 			this.pollingStartedAt = Date.now();
+			let sawAttempt = false;
 			const pollResult = await this.pollUntil({
 				intervalMs: pollingIntervalMs,
 				timeoutMs: maxPollingDurationMs,
 				isCancelled: () => this.cancelled,
 				tick: async ({ elapsedMs, pollCount }) => {
-					const verification = await this.checkViaDkimViewMethod(rec);
-					const completed = verification?.completed === true;
-					const success = verification?.success === true;
+					const verification = await this.checkViaEmailRecovererAttempt(rec);
+					if (verification && !verification.missing) sawAttempt = true;
+					let completed = verification?.completed === true;
+					let success = verification?.success === true;
+					let errorMessage$1 = verification?.errorMessage;
+					let transactionHash;
+					if (verification?.missing) {
+						const hasKey = await this.isRecoveryAccessKeyPresent(rec);
+						if (hasKey === true) {
+							completed = true;
+							success = true;
+						} else if (hasKey === false && sawAttempt) {
+							completed = true;
+							success = false;
+							errorMessage$1 = "Email recovery attempt was cleared on-chain before completion. Please resend the recovery email or restart the flow.";
+						} else if (hasKey === null) return { done: false };
+					}
 					this.emit({
 						step: 4,
 						phase: EmailRecoveryPhase.STEP_4_POLLING_VERIFICATION_RESULT,
 						status: EmailRecoveryStatus.PROGRESS,
-						message: completed && success ? `Email verified for request ${rec.requestId}; finalizing registration` : `Waiting for email verification for request ${rec.requestId}`,
+						message: completed && success ? `Email recovery completed for request ${rec.requestId}; finalizing registration` : `Waiting for email recovery for request ${rec.requestId}`,
 						data: this.buildPollingEventData(rec, {
-							transactionHash: verification?.transactionHash,
+							transactionHash,
 							elapsedMs,
 							pollCount
 						})
@@ -532,7 +559,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 						done: true,
 						value: {
 							outcome: "failed",
-							errorMessage: verification?.errorMessage || "Email verification failed"
+							errorMessage: errorMessage$1 || "Email recovery failed"
 						}
 					};
 					return {
@@ -573,7 +600,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				accountId
 			};
 		}
-		async signRegistrationTx(rec, accountId) {
+		async signNewDevice2RegistrationTx(rec, accountId) {
 			const vrfChallenge = rec.vrfChallenge;
 			if (!vrfChallenge) return this.fail(5, "Missing VRF challenge for email recovery registration");
 			const registrationResult = await this.context.webAuthnManager.signDevice2RegistrationWithStoredKey({
@@ -587,28 +614,56 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 			return registrationResult.signedTransaction;
 		}
 		async broadcastRegistrationTxAndWaitFinal(rec, signedTx) {
+			let txResult;
 			try {
-				const txResult = await this.context.nearClient.sendTransaction(signedTx, DEFAULT_WAIT_STATUS.linkDeviceRegistration);
-				try {
-					const txHash = txResult?.transaction?.hash || txResult?.transaction_hash;
-					if (txHash) this.emit({
-						step: 5,
-						phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,
-						status: EmailRecoveryStatus.PROGRESS,
-						message: "Registration transaction confirmed",
-						data: {
-							accountId: rec.accountId,
-							nearPublicKey: rec.nearPublicKey,
-							transactionHash: txHash
-						}
-					});
-					return txHash;
-				} catch {}
-			} catch (e) {
-				const msg = String(e?.message || "");
-				await this.fail(5, msg || "Failed to broadcast email recovery registration transaction (insufficient funds or RPC error)");
+				txResult = await this.context.nearClient.sendTransaction(signedTx, DEFAULT_WAIT_STATUS.linkDeviceRegistration);
+			} catch (err) {
+				const msg = errorMessage(err) || "Failed to broadcast email recovery registration transaction (insufficient funds or RPC error)";
+				throw new Error(msg);
+			}
+			const txHash = this.getTxHash(txResult);
+			const linkDeviceResult = parseLinkDeviceRegisterUserResponse(txResult);
+			if (linkDeviceResult?.verified === false) {
+				const logs = this.extractNearExecutionLogs(txResult);
+				const isStaleChallenge = logs.some((log) => /StaleChallenge|freshness validation failed/i.test(log));
+				const txHint = txHash ? ` (tx: ${txHash})` : "";
+				const code = isStaleChallenge ? EmailRecoveryErrorCode.VRF_CHALLENGE_EXPIRED : EmailRecoveryErrorCode.REGISTRATION_NOT_VERIFIED;
+				const message = isStaleChallenge ? `Timed out finalizing registration (VRF challenge expired). Please restart email recovery and try again${txHint}.` : `Registration did not verify on-chain. Please try again${txHint}.`;
+				throw new EmailRecoveryError(message, code, {
+					accountId: rec.accountId,
+					nearPublicKey: rec.nearPublicKey,
+					transactionHash: txHash,
+					logs,
+					result: linkDeviceResult
+				});
+			}
+			if (txHash) this.emit({
+				step: 5,
+				phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,
+				status: EmailRecoveryStatus.PROGRESS,
+				message: "Registration transaction confirmed",
+				data: {
+					accountId: rec.accountId,
+					nearPublicKey: rec.nearPublicKey,
+					transactionHash: txHash
+				}
+			});
+			return txHash;
+		}
+		getTxHash(outcome) {
+			const txUnknown = outcome.transaction;
+			if (txUnknown && typeof txUnknown === "object") {
+				const hash = txUnknown.hash;
+				if (typeof hash === "string" && hash.length > 0) return hash;
 			}
-			return void 0;
+			const fallback = outcome.transaction_hash;
+			return typeof fallback === "string" && fallback.length > 0 ? fallback : void 0;
+		}
+		extractNearExecutionLogs(outcome) {
+			const logs = [];
+			for (const entry of outcome.transaction_outcome.outcome.logs) logs.push(String(entry));
+			for (const receipt of outcome.receipts_outcome) for (const entry of receipt.outcome.logs) logs.push(String(entry));
+			return logs;
 		}
 		mapAuthenticatorsFromContract(authenticators) {
 			return authenticators.map(({ authenticator }) => ({
@@ -644,7 +699,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 		}
 		async updateNonceBestEffort(nonceManager, signedTx) {
 			try {
-				const txNonce = signedTx.transaction?.nonce;
+				const txNonce = signedTx.transaction.nonce;
 				if (txNonce != null) await nonceManager.updateNonceFromBlockchain(this.context.nearClient, String(txNonce));
 			} catch {}
 		}
@@ -760,7 +815,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 			} catch (err) {
 				return {
 					success: false,
-					reason: err?.message || String(err)
+					reason: errorMessage(err) || String(err)
 				};
 			}
 		}
@@ -788,7 +843,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 			});
 			try {
 				const { nonceManager, accountId } = this.initializeNonceManager(rec);
-				const signedTx = await this.signRegistrationTx(rec, accountId);
+				const signedTx = await this.signNewDevice2RegistrationTx(rec, accountId);
 				const txHash = await this.broadcastRegistrationTxAndWaitFinal(rec, signedTx);
 				if (!txHash) console.warn("[EmailRecoveryFlow] Registration transaction confirmed without hash; continuing local persistence");
 				await this.persistRecoveredUserData(rec, accountId);
@@ -816,7 +871,10 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 					}
 				});
 			} catch (e) {
-				const err = this.emitError(5, e?.message || "Email recovery finalization failed");
+				rec.status = "error";
+				await this.savePending(rec).catch(() => {});
+				const original = e instanceof Error ? e : new Error(errorMessage(e) || "Email recovery finalization failed");
+				const err = this.emitError(5, original);
 				await this.options?.afterCall?.(false);
 				throw err;
 			}
@@ -838,7 +896,7 @@ var init_emailRecovery = __esm({ "src/core/TatchiPasskey/emailRecovery.ts": (()
 				};
 				return this.handleAutoLoginFailure(touchIdResult.reason || "Auto-login failed");
 			} catch (err) {
-				return this.handleAutoLoginFailure(err?.message || String(err), err);
+				return this.handleAutoLoginFailure(errorMessage(err) || String(err), err);
 			}
 		}
 	};