@tatchi-xyz/sdk 0.20.0 → 0.31.0

package/dist/esm/sdk/linkDevice-C98klpcE.js

@@ -0,0 +1,772 @@
+import { __toDynamicImportESM } from "./chunk-DitdNFGZ.js";
+import { ensureEd25519Prefix } from "./validation-BTq6LGPp.js";
+import { ActionType } from "./actions-fHadejPs.js";
+import { DEFAULT_WAIT_STATUS } from "./rpc-Dq3ioE9T.js";
+import "./signer-worker-DK847sXj.js";
+import "./base64-dqpWgddX.js";
+import { createNearKeypair, getLoginSession } from "./login-DnROv3eA.js";
+import "./vrf-worker-BzQsJ5BW.js";
+import { DeviceLinkingPhase, DeviceLinkingStatus } from "./sdkSentEvents-CzAZBFjP.js";
+import { DEVICE_LINKING_CONFIG, DeviceLinkingError, DeviceLinkingErrorCode } from "./config-BbNXtVtu.js";
+import "./accountIds-DVDhXwVA.js";
+import "./intentDigest-yivVENNK.js";
+import "./errors-DevlT39D.js";
+import { IndexedDBManager, buildThresholdEd25519Participants2pV1 } from "./IndexedDBManager-B1cUvdyY.js";
+import "./defaultConfigs-BmCU1_qI.js";
+import "./safari-fallbacks-BcMFntiP.js";
+import "./touchIdPrompt-JPhrOx8o.js";
+import { getDeviceLinkingAccountContractCall, thresholdEd25519KeygenFromRegistrationTx } from "./rpcCalls-B44MZora.js";
+import { parseDeviceNumber } from "./getDeviceNumber-y3mMtky6.js";
+
+//#region src/core/TatchiPasskey/linkDevice.ts
+async function generateQRCodeDataURL(data) {
+	const { default: QRCode } = await import("./browser-CH0Ca-MX.js").then(__toDynamicImportESM(1));
+	return QRCode.toDataURL(data, {
+		width: 256,
+		margin: 2,
+		color: {
+			dark: "#000000",
+			light: "#ffffff"
+		},
+		errorCorrectionLevel: "M"
+	});
+}
+/**
+* Device linking flow class - manages the complete device linking process
+*
+* Usage:
+* ```typescript
+* // Device2: Generate QR and start polling
+* const flow = new LinkDeviceFlow(context, options);
+* const { qrData, qrCodeDataURL } = await flow.generateQR(accountId);
+*
+* // Device1: Scan and authorize
+* const result = await LinkDeviceFlow.scanAndLink(context, options);
+*
+* // Device2: Flow automatically completes when AddKey is detected
+* const state = flow.getState();
+* ```
+*/
+var LinkDeviceFlow = class {
+	context;
+	options;
+	session = null;
+	error;
+	cancelled = false;
+	pollingInterval;
+	pollGeneration = 0;
+	KEY_POLLING_INTERVAL = DEVICE_LINKING_CONFIG.TIMEOUTS.POLLING_INTERVAL_MS;
+	registrationRetryTimeout;
+	registrationRetryCount = 0;
+	MAX_REGISTRATION_RETRIES = DEVICE_LINKING_CONFIG.RETRY.MAX_REGISTRATION_ATTEMPTS;
+	RETRY_DELAY_MS = DEVICE_LINKING_CONFIG.TIMEOUTS.REGISTRATION_RETRY_DELAY_MS;
+	tempKeyCleanupTimer;
+	TEMP_KEY_CLEANUP_DELAY_MS = DEVICE_LINKING_CONFIG.TIMEOUTS.TEMP_KEY_CLEANUP_MS;
+	get hookOptions() {
+		return this.options?.options;
+	}
+	constructor(context, options) {
+		this.context = context;
+		this.options = options;
+	}
+	ifActive(fn) {
+		if (this.cancelled) return;
+		return fn();
+	}
+	safeOnEvent(evt) {
+		this.ifActive(() => this.hookOptions?.onEvent?.(evt));
+	}
+	/**
+	* Device2 (companion device): Generate QR code and start polling for AddKey transaction
+	*
+	* Single flow:
+	* - Generate a temporary NEAR keypair, discover the real account via AddKey mapping,
+	*   then swap the temporary key for a deterministic key derived from a passkey.
+	*/
+	async generateQR() {
+		try {
+			const tempNearKeyResult = await this.generateTemporaryNearKeypair();
+			this.session = {
+				accountId: null,
+				deviceNumber: void 0,
+				nearPublicKey: tempNearKeyResult.publicKey,
+				credential: null,
+				vrfChallenge: null,
+				phase: DeviceLinkingPhase.IDLE,
+				createdAt: Date.now(),
+				expiresAt: Date.now() + DEVICE_LINKING_CONFIG.TIMEOUTS.SESSION_EXPIRATION_MS,
+				tempPrivateKey: tempNearKeyResult.privateKey
+			};
+			const qrData = {
+				device2PublicKey: this.session.nearPublicKey,
+				accountId: this.session.accountId || void 0,
+				timestamp: Date.now(),
+				version: "1.0"
+			};
+			const qrDataString = JSON.stringify(qrData);
+			const qrCodeDataURL = await generateQRCodeDataURL(qrDataString);
+			this.safeOnEvent({
+				step: 1,
+				phase: DeviceLinkingPhase.STEP_1_QR_CODE_GENERATED,
+				status: DeviceLinkingStatus.PROGRESS,
+				message: `QR code generated for device linking, waiting for Device1 to scan and authorize...`
+			});
+			if (!this.cancelled) this.startPolling();
+			this.safeOnEvent({
+				step: 4,
+				phase: DeviceLinkingPhase.STEP_4_POLLING,
+				status: DeviceLinkingStatus.PROGRESS,
+				message: `Polling contract for linked account...`
+			});
+			return {
+				qrData,
+				qrCodeDataURL
+			};
+		} catch (error) {
+			this.error = error;
+			this.safeOnEvent({
+				step: 0,
+				phase: DeviceLinkingPhase.DEVICE_LINKING_ERROR,
+				status: DeviceLinkingStatus.ERROR,
+				error: error.message,
+				message: error.message
+			});
+			throw new DeviceLinkingError(`Failed to generate device linking QR: ${error.message}`, DeviceLinkingErrorCode.REGISTRATION_FAILED, "generation");
+		}
+	}
+	/**
+	* Generate temporary NEAR keypair without TouchID/VRF for Option F flow
+	* This creates a proper Ed25519 keypair that can be used for the QR code
+	* Includes memory cleanup and automatic expiration
+	*/
+	async generateTemporaryNearKeypair() {
+		const { publicKey: publicKeyNear, privateKey: privateKeyNear } = await createNearKeypair();
+		this.scheduleTemporaryKeyCleanup(publicKeyNear);
+		return {
+			publicKey: publicKeyNear,
+			privateKey: privateKeyNear
+		};
+	}
+	/**
+	* Schedule automatic cleanup of temporary private key from memory
+	* This provides defense-in-depth against memory exposure
+	*/
+	scheduleTemporaryKeyCleanup(publicKey) {
+		if (this.tempKeyCleanupTimer) clearTimeout(this.tempKeyCleanupTimer);
+		this.tempKeyCleanupTimer = setTimeout(() => {
+			this.cleanupTemporaryKeyFromMemory();
+		}, this.TEMP_KEY_CLEANUP_DELAY_MS);
+	}
+	/**
+	* Immediately clean up temporary private key from memory
+	* Called on successful completion, cancellation, or timeout
+	*/
+	cleanupTemporaryKeyFromMemory() {
+		if (this.session?.tempPrivateKey) {
+			const keyLength = this.session.tempPrivateKey.length;
+			this.session.tempPrivateKey = "0".repeat(keyLength);
+			this.session.tempPrivateKey = "";
+		}
+		if (this.tempKeyCleanupTimer) {
+			clearTimeout(this.tempKeyCleanupTimer);
+			this.tempKeyCleanupTimer = void 0;
+		}
+	}
+	/**
+	* Device2: Start polling blockchain for AddKey transaction
+	*/
+	startPolling() {
+		if (!this.session || this.cancelled) return;
+		this.stopPolling();
+		const myGen = ++this.pollGeneration;
+		const tick = async () => {
+			if (this.cancelled || this.pollGeneration !== myGen) return;
+			if (!this.shouldContinuePolling()) {
+				this.stopPolling();
+				return;
+			}
+			try {
+				const hasKeyAdded = await this.checkForDeviceKeyAdded();
+				if (this.cancelled || this.pollGeneration !== myGen) return;
+				if (hasKeyAdded && this.session) {
+					this.stopPolling();
+					this.safeOnEvent({
+						step: 5,
+						phase: DeviceLinkingPhase.STEP_5_ADDKEY_DETECTED,
+						status: DeviceLinkingStatus.PROGRESS,
+						message: "AddKey transaction detected, starting registration..."
+					});
+					this.session.phase = DeviceLinkingPhase.STEP_5_ADDKEY_DETECTED;
+					this.startRegistrationWithRetries();
+					return;
+				}
+			} catch (error) {
+				if (this.cancelled || this.pollGeneration !== myGen) return;
+				console.error("Polling error:", error);
+				if (error.message?.includes("Account not found")) {
+					console.warn("Account not found - stopping polling");
+					this.stopPolling();
+					return;
+				}
+			}
+			if (!this.cancelled && this.pollGeneration === myGen) this.pollingInterval = setTimeout(tick, this.KEY_POLLING_INTERVAL);
+		};
+		this.pollingInterval = setTimeout(tick, this.KEY_POLLING_INTERVAL);
+	}
+	shouldContinuePolling() {
+		if (!this.session) return false;
+		if (this.session.phase === DeviceLinkingPhase.STEP_5_ADDKEY_DETECTED) return false;
+		if (this.session.phase === DeviceLinkingPhase.STEP_7_LINKING_COMPLETE) return false;
+		if (Date.now() > this.session.expiresAt) {
+			this.error = /* @__PURE__ */ new Error("Session expired");
+			this.safeOnEvent({
+				step: 0,
+				phase: DeviceLinkingPhase.DEVICE_LINKING_ERROR,
+				status: DeviceLinkingStatus.ERROR,
+				error: this.error?.message,
+				message: "Device linking session expired"
+			});
+			return false;
+		}
+		return true;
+	}
+	/**
+	* Device2: Check if device key has been added by polling contract HashMap
+	*/
+	async checkForDeviceKeyAdded() {
+		if (this.cancelled || !this.pollingInterval) return false;
+		if (!this.session?.nearPublicKey) {
+			console.error(`LinkDeviceFlow: No session or public key available for polling`);
+			return false;
+		}
+		try {
+			const linkingResult = await getDeviceLinkingAccountContractCall(this.context.nearClient, this.context.configs.contractId, this.session.nearPublicKey);
+			if (this.cancelled || !this.pollingInterval) return false;
+			this.safeOnEvent({
+				step: 4,
+				phase: DeviceLinkingPhase.STEP_4_POLLING,
+				status: DeviceLinkingStatus.PROGRESS,
+				message: "Polling contract for linked account..."
+			});
+			if (linkingResult && linkingResult.linkedAccountId && linkingResult.deviceNumber !== void 0) {
+				const currentCounter = parseDeviceNumber(linkingResult.deviceNumber, { min: 0 });
+				if (currentCounter === null) {
+					console.warn("LinkDeviceFlow: Invalid deviceNumber counter returned from contract:", linkingResult.deviceNumber);
+					return false;
+				}
+				const nextDeviceNumber = currentCounter + 1;
+				console.debug(`LinkDeviceFlow: Success! Discovered linked account:`, {
+					linkedAccountId: linkingResult.linkedAccountId,
+					currentCounter,
+					nextDeviceNumber
+				});
+				this.session.accountId = linkingResult.linkedAccountId;
+				this.session.deviceNumber = nextDeviceNumber;
+				return true;
+			} else if (!this.cancelled) console.log(`LinkDeviceFlow: No mapping found yet...`);
+			return false;
+		} catch (error) {
+			console.error(`LinkDeviceFlow: Error checking for device key addition:`, {
+				error: error.message,
+				stack: error.stack,
+				name: error.name,
+				code: error.code
+			});
+			return false;
+		}
+	}
+	/**
+	* Device2: Start registration process with retry logic
+	*/
+	startRegistrationWithRetries() {
+		this.registrationRetryCount = 0;
+		this.attemptRegistration();
+	}
+	/**
+	* Device2: Attempt registration with retry logic
+	*/
+	attemptRegistration() {
+		this.swapKeysAndRegisterAccount().catch((error) => {
+			if (this.isRetryableError(error)) {
+				this.registrationRetryCount++;
+				if (this.registrationRetryCount > this.MAX_REGISTRATION_RETRIES) {
+					console.error("LinkDeviceFlow: Max registration retries exceeded, failing permanently");
+					this.session.phase = DeviceLinkingPhase.REGISTRATION_ERROR;
+					this.error = error;
+					this.hookOptions?.onEvent?.({
+						step: 0,
+						phase: DeviceLinkingPhase.REGISTRATION_ERROR,
+						status: DeviceLinkingStatus.ERROR,
+						error: error.message,
+						message: error.message
+					});
+				} else {
+					console.warn(`LinkDeviceFlow: Registration failed with retryable error (attempt ${this.registrationRetryCount}/${this.MAX_REGISTRATION_RETRIES}), will retry in ${this.RETRY_DELAY_MS}ms:`, error.message);
+					this.hookOptions?.onEvent?.({
+						step: 5,
+						phase: DeviceLinkingPhase.STEP_5_ADDKEY_DETECTED,
+						status: DeviceLinkingStatus.PROGRESS,
+						message: `Registration failed (${error.message}), retrying in ${this.RETRY_DELAY_MS}ms... (${this.registrationRetryCount}/${this.MAX_REGISTRATION_RETRIES})`
+					});
+					this.registrationRetryTimeout = setTimeout(() => {
+						this.attemptRegistration();
+					}, this.RETRY_DELAY_MS);
+				}
+			} else {
+				this.session.phase = DeviceLinkingPhase.REGISTRATION_ERROR;
+				this.error = error;
+				this.hookOptions?.onEvent?.({
+					step: 0,
+					phase: DeviceLinkingPhase.REGISTRATION_ERROR,
+					status: DeviceLinkingStatus.ERROR,
+					error: error.message,
+					message: error.message
+				});
+			}
+		});
+	}
+	/**
+	* Device2: Complete device linking
+	* 1. Derives deterministic VRF and NEAR keys using real accountID (instead of temporary keys)
+	* 2. Executes Key Replacement transaction to replace temporary key with the real key
+	* 3. Stores authenticator and VRF data locally, performs on-chain Device2 registration, and then auto-login.
+	*/
+	async swapKeysAndRegisterAccount() {
+		if (!this.session || !this.session.accountId) throw new Error("AccountID not available for registration");
+		const realAccountId = this.session.accountId;
+		this.safeOnEvent({
+			step: 6,
+			phase: DeviceLinkingPhase.STEP_6_REGISTRATION,
+			status: DeviceLinkingStatus.PROGRESS,
+			message: "Storing device authenticator data locally..."
+		});
+		const deterministicKeysResult = await this.deriveDeterministicKeysAndRegisterAccount();
+		if (!deterministicKeysResult) throw new Error("Failed to derive deterministic keys");
+		if (!deterministicKeysResult.vrfChallenge) throw new Error("Missing VRF challenge from deterministic key derivation");
+		await this.storeDeviceAuthenticator(deterministicKeysResult);
+		const registrationResult = await this.context.webAuthnManager.signDevice2RegistrationWithStoredKey({
+			nearAccountId: realAccountId,
+			credential: deterministicKeysResult.credential,
+			vrfChallenge: deterministicKeysResult.vrfChallenge,
+			deterministicVrfPublicKey: deterministicKeysResult.vrfPublicKey,
+			deviceNumber: this.session.deviceNumber
+		});
+		if (!registrationResult.success || !registrationResult.signedTransaction) throw new Error(registrationResult.error || "Device2 registration failed");
+		const registrationOutcome = await this.context.nearClient.sendTransaction(registrationResult.signedTransaction, DEFAULT_WAIT_STATUS.linkDeviceRegistration);
+		const registrationTxHash = registrationOutcome?.transaction?.hash;
+		if (typeof registrationTxHash !== "string" || !registrationTxHash.trim()) throw new Error("Missing link_device_register_user transaction hash after broadcast");
+		await this.activateThresholdEnrollment({
+			accountId: realAccountId,
+			credential: deterministicKeysResult.credential,
+			deviceNumber: this.session.deviceNumber,
+			registrationTxHash
+		});
+		this.session.phase = DeviceLinkingPhase.STEP_7_LINKING_COMPLETE;
+		this.registrationRetryCount = 0;
+		this.safeOnEvent({
+			step: 7,
+			phase: DeviceLinkingPhase.STEP_7_LINKING_COMPLETE,
+			status: DeviceLinkingStatus.SUCCESS,
+			message: "Device linking completed successfully"
+		});
+		await this.attemptAutoLogin(deterministicKeysResult, this.options);
+	}
+	async activateThresholdEnrollment(args) {
+		const deviceNumber = parseDeviceNumber(args.deviceNumber, { min: 1 });
+		if (deviceNumber === null) throw new Error(`Invalid deviceNumber for threshold enrollment: ${String(args.deviceNumber)}`);
+		try {
+			await this.context.webAuthnManager.setLastUser(args.accountId, deviceNumber);
+		} catch {}
+		const existing = await IndexedDBManager.nearKeysDB.getThresholdKeyMaterial(args.accountId, deviceNumber);
+		if (existing) return;
+		const relayerUrl = String(this.context.configs.relayer.url || "").trim();
+		if (!relayerUrl) throw new Error("Missing configs.relayer.url (required for threshold enrollment)");
+		const localKeyMaterial = await IndexedDBManager.nearKeysDB.getLocalKeyMaterial(args.accountId, deviceNumber);
+		if (!localKeyMaterial) throw new Error(`Missing local key material for ${String(args.accountId)} device ${deviceNumber}`);
+		const derived = await this.context.webAuthnManager.deriveThresholdEd25519ClientVerifyingShareFromCredential({
+			credential: args.credential,
+			nearAccountId: args.accountId,
+			wrapKeySalt: localKeyMaterial.wrapKeySalt
+		});
+		if (!derived.success) throw new Error(derived.error || "Failed to derive threshold client verifying share");
+		const keygen = await thresholdEd25519KeygenFromRegistrationTx(relayerUrl, {
+			nearAccountId: args.accountId,
+			clientVerifyingShareB64u: derived.clientVerifyingShareB64u,
+			registrationTxHash: args.registrationTxHash
+		});
+		if (!keygen.ok) throw new Error(keygen.error || keygen.message || keygen.code || "Threshold registration keygen failed");
+		const thresholdPublicKey = ensureEd25519Prefix(keygen.publicKey || "");
+		if (!thresholdPublicKey) throw new Error("Threshold registration keygen returned empty publicKey");
+		const relayerKeyId = String(keygen.relayerKeyId || "").trim();
+		if (!relayerKeyId) throw new Error("Threshold registration keygen returned empty relayerKeyId");
+		const relayerVerifyingShareB64u = String(keygen.relayerVerifyingShareB64u || "").trim();
+		if (!relayerVerifyingShareB64u) throw new Error("Threshold registration keygen returned empty relayerVerifyingShareB64u");
+		try {
+			this.context.webAuthnManager.getNonceManager().initializeUser(args.accountId, localKeyMaterial.publicKey);
+		} catch {}
+		const txContext = await this.context.webAuthnManager.getNonceManager().getNonceBlockHashAndHeight(this.context.nearClient, { force: true });
+		const signed = await this.context.webAuthnManager.signAddKeyThresholdPublicKeyNoPrompt({
+			nearAccountId: args.accountId,
+			credential: args.credential,
+			wrapKeySalt: localKeyMaterial.wrapKeySalt,
+			transactionContext: txContext,
+			thresholdPublicKey,
+			relayerVerifyingShareB64u,
+			clientParticipantId: keygen.clientParticipantId,
+			relayerParticipantId: keygen.relayerParticipantId,
+			deviceNumber
+		});
+		const signedTx = signed?.signedTransaction;
+		if (!signedTx) throw new Error("Failed to sign AddKey(thresholdPublicKey) transaction");
+		await this.context.nearClient.sendTransaction(signedTx, DEFAULT_WAIT_STATUS.thresholdAddKey);
+		await IndexedDBManager.nearKeysDB.storeKeyMaterial({
+			kind: "threshold_ed25519_2p_v1",
+			nearAccountId: String(args.accountId),
+			deviceNumber,
+			publicKey: thresholdPublicKey,
+			wrapKeySalt: derived.wrapKeySalt,
+			relayerKeyId,
+			clientShareDerivation: "prf_first_v1",
+			participants: buildThresholdEd25519Participants2pV1({
+				clientParticipantId: keygen.clientParticipantId,
+				relayerParticipantId: keygen.relayerParticipantId,
+				relayerKeyId,
+				relayerUrl,
+				clientVerifyingShareB64u: derived.clientVerifyingShareB64u,
+				relayerVerifyingShareB64u,
+				clientShareDerivation: "prf_first_v1"
+			}),
+			timestamp: Date.now()
+		});
+	}
+	/**
+	* Check if an error is retryable (temporary issues that can be resolved)
+	*/
+	isRetryableError(error) {
+		const retryableErrorMessages = [
+			"page does not have focus",
+			"a request is already pending",
+			"request is already pending",
+			"operationerror",
+			"notallowederror",
+			"the operation is not allowed at this time",
+			"network error",
+			"timeout",
+			"temporary",
+			"transient"
+		];
+		const errorMessage = error.message?.toLowerCase() || "";
+		const errorName = error.name?.toLowerCase() || "";
+		return retryableErrorMessages.some((msg) => errorMessage.includes(msg.toLowerCase()) || errorName.includes(msg.toLowerCase()));
+	}
+	/**
+	* Device2: Attempt auto-login after successful device linking
+	*/
+	async attemptAutoLogin(deterministicKeysResult, options) {
+		try {
+			if (this.cancelled) {
+				console.warn("LinkDeviceFlow: Auto-login aborted because flow was cancelled");
+				return;
+			}
+			const sessionSnapshot = this.session;
+			options?.options?.onEvent?.({
+				step: 8,
+				phase: DeviceLinkingPhase.STEP_8_AUTO_LOGIN,
+				status: DeviceLinkingStatus.PROGRESS,
+				message: "Logging in..."
+			});
+			if (!sessionSnapshot || !sessionSnapshot.accountId || !sessionSnapshot.credential || !deterministicKeysResult) {
+				const missing = [];
+				if (!sessionSnapshot) missing.push("session");
+				if (!sessionSnapshot?.accountId) missing.push("accountId");
+				if (!sessionSnapshot?.credential) missing.push("credential");
+				if (!deterministicKeysResult) missing.push("deterministicKeysResult");
+				throw new Error(`Missing required data for auto-login: ${missing.join(", ")}`);
+			}
+			const { accountId } = sessionSnapshot;
+			const deviceNumberRaw = sessionSnapshot.deviceNumber;
+			if (deviceNumberRaw == null) throw new Error("Device number missing for auto-login");
+			const deviceNumber = parseDeviceNumber(deviceNumberRaw, { min: 1 });
+			if (deviceNumber === null) throw new Error(`Invalid device number for auto-login: ${String(deviceNumberRaw)}`);
+			if (deterministicKeysResult.serverEncryptedVrfKeypair && deterministicKeysResult.serverEncryptedVrfKeypair.serverKeyId && this.context.configs.vrfWorkerConfigs?.shamir3pass?.relayServerUrl) try {
+				const unlockResult = await this.context.webAuthnManager.shamir3PassDecryptVrfKeypair({
+					nearAccountId: accountId,
+					kek_s_b64u: deterministicKeysResult.serverEncryptedVrfKeypair.kek_s_b64u,
+					ciphertextVrfB64u: deterministicKeysResult.serverEncryptedVrfKeypair.ciphertextVrfB64u,
+					serverKeyId: deterministicKeysResult.serverEncryptedVrfKeypair.serverKeyId
+				});
+				if (unlockResult.success) {
+					console.log("LinkDeviceFlow: Shamir 3-pass unlock successful for auto-login");
+					if (this.cancelled) {
+						console.warn("LinkDeviceFlow: Auto-login aborted after Shamir unlock because flow was cancelled");
+						return;
+					}
+					await this.context.webAuthnManager.initializeCurrentUser(accountId, this.context.nearClient);
+					await this.context.webAuthnManager.setLastUser(accountId, deviceNumber);
+					this.hookOptions?.onEvent?.({
+						step: 8,
+						phase: DeviceLinkingPhase.STEP_8_AUTO_LOGIN,
+						status: DeviceLinkingStatus.SUCCESS,
+						message: `Welcome ${accountId}`
+					});
+					return;
+				} else console.log("LinkDeviceFlow: Shamir 3-pass unlock failed, falling back to TouchID");
+			} catch (error) {
+				console.log("LinkDeviceFlow: Shamir 3-pass unlock error, falling back to TouchID:", error);
+			}
+			try {
+				const vrfUnlockResult = await this.context.webAuthnManager.unlockVRFKeypair({
+					nearAccountId: accountId,
+					encryptedVrfKeypair: deterministicKeysResult.encryptedVrfKeypair,
+					credential: sessionSnapshot.credential
+				});
+				if (!vrfUnlockResult.success) throw new Error(vrfUnlockResult.error || "VRF unlock failed during auto-login");
+				await this.context.webAuthnManager.initializeCurrentUser(accountId, this.context.nearClient);
+				await this.context.webAuthnManager.setLastUser(accountId, deviceNumber);
+				this.hookOptions?.onEvent?.({
+					step: 8,
+					phase: DeviceLinkingPhase.STEP_8_AUTO_LOGIN,
+					status: DeviceLinkingStatus.SUCCESS,
+					message: `Welcome ${accountId}`
+				});
+				try {
+					await getLoginSession(this.context, accountId);
+				} catch {}
+			} catch (unlockError) {
+				console.warn("LinkDeviceFlow: TouchID VRF unlock failed during auto-login:", unlockError);
+				await this.context.webAuthnManager.initializeCurrentUser(accountId, this.context.nearClient);
+				await this.context.webAuthnManager.setLastUser(accountId, deviceNumber);
+				this.hookOptions?.onEvent?.({
+					step: 0,
+					phase: DeviceLinkingPhase.LOGIN_ERROR,
+					status: DeviceLinkingStatus.ERROR,
+					error: unlockError.message,
+					message: unlockError.message
+				});
+			}
+		} catch (loginError) {
+			console.warn("Login failed after device linking:", loginError);
+			options?.options?.onEvent?.({
+				step: 0,
+				phase: DeviceLinkingPhase.LOGIN_ERROR,
+				status: DeviceLinkingStatus.ERROR,
+				error: loginError.message,
+				message: loginError.message
+			});
+		}
+	}
+	/**
+	* Device2: Store authenticator data locally on Device2
+	*/
+	async storeDeviceAuthenticator(deterministicKeysResult) {
+		if (!this.session || !this.session.accountId) throw new Error("Session or account ID not available for storing authenticator");
+		try {
+			const { webAuthnManager } = this.context;
+			const { credential, accountId } = this.session;
+			if (!credential) throw new Error("WebAuthn credential not available after VRF migration");
+			if (!deterministicKeysResult?.encryptedVrfKeypair) throw new Error("VRF credentials not available after migration");
+			if (this.session.deviceNumber === void 0 || this.session.deviceNumber === null) throw new Error("Device number not available - cannot determine device-specific account ID");
+			const deviceNumber = parseDeviceNumber(this.session.deviceNumber, { min: 1 });
+			if (deviceNumber === null) throw new Error(`Invalid device number in session: ${String(this.session.deviceNumber)}`);
+			this.session.deviceNumber = deviceNumber;
+			console.debug("Storing device authenticator data with device number: ", deviceNumber);
+			await webAuthnManager.storeUserData({
+				nearAccountId: accountId,
+				deviceNumber,
+				clientNearPublicKey: deterministicKeysResult.nearPublicKey,
+				lastUpdated: Date.now(),
+				passkeyCredential: {
+					id: credential.id,
+					rawId: credential.rawId
+				},
+				encryptedVrfKeypair: {
+					encryptedVrfDataB64u: deterministicKeysResult.encryptedVrfKeypair.encryptedVrfDataB64u,
+					chacha20NonceB64u: deterministicKeysResult.encryptedVrfKeypair.chacha20NonceB64u
+				},
+				serverEncryptedVrfKeypair: deterministicKeysResult.serverEncryptedVrfKeypair || void 0
+			});
+			const attestationB64u = credential.response.attestationObject;
+			const credentialPublicKey = await webAuthnManager.extractCosePublicKey(attestationB64u);
+			await webAuthnManager.storeAuthenticator({
+				nearAccountId: accountId,
+				deviceNumber,
+				credentialId: credential.rawId,
+				credentialPublicKey,
+				transports: ["internal"],
+				name: `Device ${deviceNumber} Passkey for ${accountId.split(".")[0]}`,
+				registered: (/* @__PURE__ */ new Date()).toISOString(),
+				syncedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				vrfPublicKey: deterministicKeysResult.vrfPublicKey
+			});
+		} catch (error) {
+			console.error(`LinkDeviceFlow: Failed to store authenticator data:`, error);
+			await this.cleanupFailedLinkingAttempt();
+			throw error;
+		}
+	}
+	/**
+	* 1. Derives deterministic VRF and NEAR keys using real accountID (instead of temporary keys)
+	* 2. Executes Key Replacement transaction to replace temporary key with the real key
+	* 3. Stores authenticator and VRF data; on-chain registration is handled separately via VRF-driven flow.
+	*/
+	async deriveDeterministicKeysAndRegisterAccount() {
+		if (!this.session || !this.session.accountId) throw new Error("Session account ID not available for migration");
+		const realAccountId = this.session.accountId;
+		const confirmerText = this.hookOptions?.confirmerText;
+		const confirmationConfigOverride = this.hookOptions?.confirmationConfig;
+		const confirm = await this.context.webAuthnManager.requestRegistrationCredentialConfirmation({
+			nearAccountId: realAccountId,
+			deviceNumber: this.session.deviceNumber,
+			confirmerText,
+			confirmationConfigOverride
+		});
+		if (!confirm.confirmed || !confirm.credential) throw new Error("User cancelled link-device confirmation");
+		this.session.credential = confirm.credential;
+		this.session.vrfChallenge = confirm.vrfChallenge || null;
+		const vrfDerivationResult = await this.context.webAuthnManager.deriveVrfKeypair({
+			credential: confirm.credential,
+			nearAccountId: realAccountId
+		});
+		if (!vrfDerivationResult.success || !vrfDerivationResult.encryptedVrfKeypair) throw new Error("Failed to derive VRF keypair from PRF for real account");
+		const nearKeyResultStep1 = await this.context.webAuthnManager.deriveNearKeypairAndEncryptFromSerialized({
+			nearAccountId: realAccountId,
+			credential: confirm.credential,
+			options: { deviceNumber: this.session.deviceNumber }
+		});
+		if (!nearKeyResultStep1.success || !nearKeyResultStep1.publicKey) throw new Error("Failed to derive NEAR keypair in step 1");
+		this.context.webAuthnManager.getNonceManager().initializeUser(realAccountId, this.session.nearPublicKey);
+		const { nextNonce, txBlockHash } = await this.context.webAuthnManager.getNonceManager().getNonceBlockHashAndHeight(this.context.nearClient);
+		await this.executeKeySwapTransaction(nearKeyResultStep1.publicKey, nextNonce, txBlockHash);
+		this.context.webAuthnManager.getNonceManager().initializeUser(realAccountId, nearKeyResultStep1.publicKey);
+		if (this.session?.tempPrivateKey) {
+			try {
+				await IndexedDBManager.nearKeysDB.deleteKeyMaterial("temp-device-linking.testnet");
+			} catch {}
+			this.cleanupTemporaryKeyFromMemory();
+		}
+		if (!this.session.credential) throw new Error("WebAuthn credential not available after VRF migration");
+		const result = {
+			encryptedVrfKeypair: vrfDerivationResult.encryptedVrfKeypair,
+			serverEncryptedVrfKeypair: vrfDerivationResult.serverEncryptedVrfKeypair,
+			vrfPublicKey: vrfDerivationResult.vrfPublicKey,
+			nearPublicKey: nearKeyResultStep1.publicKey,
+			credential: this.session.credential,
+			vrfChallenge: this.session.vrfChallenge
+		};
+		return result;
+	}
+	/**
+	* Execute key replacement transaction for Option F flow
+	* Replace temporary key with properly derived key using AddKey + DeleteKey
+	*/
+	async executeKeySwapTransaction(newPublicKey, nextNonce, txBlockHash) {
+		if (!this.session?.tempPrivateKey || !this.session?.accountId) throw new Error("Missing temporary private key or account ID for key replacement");
+		const { tempPrivateKey, accountId, nearPublicKey: oldPublicKey } = this.session;
+		try {
+			const actions = [{
+				action_type: ActionType.AddKey,
+				public_key: newPublicKey,
+				access_key: JSON.stringify({
+					nonce: 0,
+					permission: { FullAccess: {} }
+				})
+			}, {
+				action_type: ActionType.DeleteKey,
+				public_key: oldPublicKey
+			}];
+			const keySwapResult = await this.context.webAuthnManager.signTransactionWithKeyPair({
+				nearPrivateKey: tempPrivateKey,
+				signerAccountId: accountId,
+				receiverId: accountId,
+				nonce: nextNonce,
+				blockHash: txBlockHash,
+				actions
+			});
+			await this.context.nearClient.sendTransaction(keySwapResult.signedTransaction, DEFAULT_WAIT_STATUS.linkDeviceSwapKey);
+			try {
+				await this.context.webAuthnManager.getNonceManager().updateNonceFromBlockchain(this.context.nearClient, nextNonce);
+			} catch (e) {
+				console.warn("[LinkDeviceFlow]: Failed to update nonce after key swap broadcast:", e);
+			}
+		} catch (error) {
+			console.error(`LinkDeviceFlow: Key replacement transaction failed:`, error);
+			throw new Error(`Key replacement failed: ${error instanceof Error ? error.message : "Unknown error"}`);
+		}
+	}
+	/**
+	* Clean up failed linking attempts - remove any partially stored data
+	*/
+	async cleanupFailedLinkingAttempt() {
+		if (!this.session) return;
+		try {
+			const { credential, accountId, nearPublicKey } = this.session;
+			this.cleanupTemporaryKeyFromMemory();
+			if (accountId && credential) {
+				try {
+					await IndexedDBManager.clientDB.deleteAllAuthenticatorsForUser(accountId);
+				} catch {}
+				try {
+					await IndexedDBManager.clientDB.deleteUser(accountId);
+				} catch {}
+				try {
+					await IndexedDBManager.nearKeysDB.deleteKeyMaterial(accountId);
+				} catch {}
+			}
+			try {
+				await IndexedDBManager.nearKeysDB.deleteKeyMaterial("temp-device-linking.testnet");
+			} catch {}
+		} catch (error) {
+			console.error(`LinkDeviceFlow: Error during cleanup:`, error);
+		}
+	}
+	/**
+	* Stop polling - guaranteed to clear any existing interval
+	*/
+	stopPolling() {
+		if (this.pollingInterval) {
+			clearTimeout(this.pollingInterval);
+			this.pollingInterval = void 0;
+		}
+		this.pollGeneration++;
+	}
+	/**
+	* Stop registration retry timeout
+	*/
+	stopRegistrationRetry() {
+		if (this.registrationRetryTimeout) {
+			clearTimeout(this.registrationRetryTimeout);
+			this.registrationRetryTimeout = void 0;
+		}
+	}
+	/**
+	* Get current flow state
+	*/
+	getState() {
+		return {
+			phase: this.session?.phase,
+			session: this.session,
+			error: this.error
+		};
+	}
+	/**
+	* Cancel the flow and cleanup
+	*/
+	cancel() {
+		this.cancelled = true;
+		this.stopPolling();
+		this.stopRegistrationRetry();
+		this.cleanupTemporaryKeyFromMemory();
+		this.session = null;
+		this.error = void 0;
+		this.registrationRetryCount = 0;
+	}
+	/**
+	* Reset flow to initial state
+	*/
+	reset() {
+		this.cancel();
+	}
+};
+
+//#endregion
+export { LinkDeviceFlow };