npm - @tatchi-xyz/sdk - Versions diffs - 0.21.0 → 0.31.0 - Mend

@tatchi-xyz/sdk 0.21.0 → 0.31.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2488) hide show

package/dist/cjs/core/TatchiPasskey/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","names":["buildConfigsFromEnv","__isWalletIframeHostMode","MinimalNearClient","WebAuthnManager","toAccountId","tasks: Promise<unknown>[]","error: unknown","toError","registerPasskey","DEFAULT_AUTHENTICATOR_OPTIONS","registerPasskeyInternal","res","loginAndCreateSession","logoutAndClearSession","getLoginSession","getRecentLogins","executeAction","ActionPhase","ActionStatus","signAndSendTransactions","arr: SignTransactionResult[]","signTransactionsWithActions","sendTransaction","signDelegateAction","sendDelegateActionViaRelayer","signOptions: DelegateActionHooksOptions \| undefined","signResult: SignDelegateActionResult","relayOptions: DelegateRelayHooksOptions \| undefined","relayResult: DelegateRelayResult","combined: SignAndSendDelegateActionResult","signNEP413Message","isOffline","openOfflineExport","router: WalletIframeRouter","chainsigAddressManager","getRecoveryEmailHashesContractCall","local: RecoveryEmailRecord[]","getLocalRecoveryEmails","bytesToHex","prepareRecoveryEmails","actions: ActionArgs[]","buildSetRecoveryEmailsActions","AccountRecoveryFlow","LinkDeviceFlow","linkDeviceWithScannedQRData","ActionType"],"sources":["../../../../src/core/TatchiPasskey/index.ts"],"sourcesContent":["import { WebAuthnManager } from '../WebAuthnManager';\nimport {\n loginAndCreateSession,\n getLoginSession,\n getRecentLogins,\n logoutAndClearSession,\n} from './login';\nimport {\n executeAction,\n signTransactionsWithActions,\n sendTransaction,\n signAndSendTransactions,\n} from './actions';\nimport { AccountRecoveryFlow, type RecoveryResult } from './recoverAccount';\nimport { registerPasskey } from './registration';\nimport { registerPasskeyInternal } from './registration';\nimport {\n MinimalNearClient,\n type NearClient,\n type SignedTransaction,\n type AccessKeyList,\n} from '../NearClient';\nimport type {\n ActionResult,\n DelegateRelayResult,\n GetRecentLoginsResult,\n LoginAndCreateSessionResult,\n LoginResult,\n LoginSession,\n LoginState,\n RegistrationResult,\n SignAndSendDelegateActionResult,\n SignDelegateActionResult,\n SignTransactionResult,\n TatchiConfigs,\n TatchiConfigsInput,\n} from '../types/tatchi';\nimport type {\n AccountRecoveryHooksOptions,\n ActionHooksOptions,\n DelegateActionHooksOptions,\n DelegateRelayHooksOptions,\n LoginHooksOptions,\n RegistrationHooksOptions,\n SendTransactionHooksOptions,\n SignAndSendDelegateActionHooksOptions,\n SignAndSendTransactionHooksOptions,\n SignNEP413HooksOptions,\n SignTransactionHooksOptions,\n} from '../types/sdkSentEvents';\nimport { ActionPhase, ActionStatus } from '../types/sdkSentEvents';\nimport { ConfirmationConfig, type WasmSignedDelegate } from '../types/signer-worker';\nimport { DEFAULT_AUTHENTICATOR_OPTIONS } from '../types/authenticatorOptions';\nimport { toAccountId, type AccountId } from '../types/accountIds';\nimport type { DerivedAddressRecord, RecoveryEmailRecord } from '../IndexedDBManager';\nimport { configureIndexedDB } from '../IndexedDBManager';\nimport { chainsigAddressManager } from '../ChainsigAddressManager';\nimport { ActionType, type ActionArgs, type TransactionInput } from '../types/actions';\nimport type {\n DeviceLinkingQRData,\n LinkDeviceResult,\n ScanAndLinkDeviceOptionsDevice1,\n StartDevice2LinkingFlowArgs,\n StartDevice2LinkingFlowResults\n} from '../types/linkDevice';\nimport { LinkDeviceFlow } from './linkDevice';\nimport { linkDeviceWithScannedQRData } from './scanDevice';\nimport {\n signNEP413Message,\n type SignNEP413MessageParams,\n type SignNEP413MessageResult\n} from './signNEP413';\nimport { signDelegateAction } from './delegateAction';\nimport { SignedDelegate } from '../types/delegate';\nimport { sendDelegateActionViaRelayer } from './relay';\nimport type { UserPreferencesManager } from '../WebAuthnManager/userPreferences';\nimport type { WalletIframeRouter } from '../WalletIframe/client/router';\nimport { __isWalletIframeHostMode } from '../WalletIframe/host-mode';\nimport { toError } from '../../utils/errors';\nimport { isOffline, openOfflineExport } from '../OfflineExport';\nimport { buildSetRecoveryEmailsActions, getRecoveryEmailHashesContractCall } from '../rpcCalls';\nimport {\n prepareRecoveryEmails,\n getLocalRecoveryEmails,\n bytesToHex,\n} from '../EmailRecovery';\nimport type { DelegateActionInput } from '../types/delegate';\nimport { buildConfigsFromEnv } from '../defaultConfigs';\nimport { EmailRecoveryFlowOptions } from './emailRecovery';\n\n///////////////////////////////////////\n// PASSKEY MANAGER\n///////////////////////////////////////\n\nexport interface PasskeyManagerContext {\n webAuthnManager: WebAuthnManager;\n nearClient: NearClient;\n configs: TatchiConfigs;\n}\n\nlet warnedAboutSameOriginWallet = false;\n\n/*\n Main TatchiPasskey class that provides framework-agnostic passkey operations\n * with flexible event-based callbacks for custom UX implementation\n /\nexport class TatchiPasskey {\n private readonly webAuthnManager: WebAuthnManager;\n private readonly nearClient: NearClient;\n readonly configs: TatchiConfigs;\n private iframeRouter: WalletIframeRouter \| null = null;\n // Deduplicate concurrent initWalletIframe() calls to avoid mounting multiple iframes.\n private walletIframeInitInFlight: Promise<void> \| null = null;\n // Wallet-iframe mode: mirror wallet-host preferences into app-origin in-memory cache.\n private walletIframePrefsUnsubscribe: (() => void) \| null = null;\n // Internal active Device2 flow when running locally (not exposed)\n private activeDeviceLinkFlow: LinkDeviceFlow \| null = null;\n private activeAccountRecoveryFlow: AccountRecoveryFlow \| null = null;\n private activeEmailRecoveryFlow: import('./emailRecovery').EmailRecoveryFlow \| null = null;\n\n constructor(\n configs: TatchiConfigsInput,\n nearClient?: NearClient\n ) {\n this.configs = buildConfigsFromEnv(configs);\n // Configure IndexedDB naming before any local persistence is touched.\n // - Wallet iframe host keeps canonical DB names.\n // - App origin disables IndexedDB entirely when iframe mode is enabled.\n const mode = __isWalletIframeHostMode()\n ? 'wallet'\n : (this.configs.iframeWallet?.walletOrigin ? 'disabled' : 'legacy');\n configureIndexedDB({ mode });\n // Use provided client or create default one\n this.nearClient = nearClient \|\| new MinimalNearClient(this.configs.nearRpcUrl);\n this.webAuthnManager = new WebAuthnManager(this.configs, this.nearClient);\n // VRF worker initializes automatically in the constructor\n }\n\n /\n Direct access to user preferences manager for convenience\n * Example: passkeyManager.userPreferences.onThemeChange(cb)\n /\n get userPreferences(): UserPreferencesManager {\n return this.webAuthnManager.getUserPreferences();\n }\n\n /\n Initialize the hidden wallet service iframe client (optional) and warm critical resources.\n * Always warms local resources; initializes iframe when `walletOrigin` is provided.\n * Idempotent and safe to call multiple times.\n /\n async initWalletIframe(nearAccountId?: string): Promise<void> {\n const walletOriginConfigured = !!this.configs.iframeWallet?.walletOrigin;\n // Warm local critical resources (NonceManager, workers) regardless of iframe usage.\n // In iframe mode, avoid persisting user state (lastUserAccountId, preferences) on the app origin.\n const shouldAvoidLocalUserState = walletOriginConfigured && !__isWalletIframeHostMode();\n await this.webAuthnManager.warmCriticalResources(shouldAvoidLocalUserState ? undefined : nearAccountId);\n\n // Guardrail: when running inside the wallet service iframe host, never attempt to\n // initialize a nested wallet iframe client, even if configs accidentally include iframeWallet.\n // The host runs the real TatchiPasskey instance and must remain self-contained.\n if (__isWalletIframeHostMode()) {\n return;\n }\n\n const walletIframeConfig = this.configs.iframeWallet;\n const walletOrigin = walletIframeConfig?.walletOrigin;\n // If no wallet origin configured, we're done after local warm-up\n if (!walletOrigin) {\n // Reflect local login state so callers depending on init() get fresh status\n await this.getLoginSession(nearAccountId);\n return;\n }\n\n // Emit same-origin co-hosting warning only when actually initializing the iframe\n if (!warnedAboutSameOriginWallet) {\n try {\n const isWalletIframeHost = __isWalletIframeHostMode();\n const parsed = new URL(walletOrigin);\n if (typeof window !== 'undefined' && parsed.origin === window.location.origin && !isWalletIframeHost) {\n warnedAboutSameOriginWallet = true;\n console.warn('[TatchiPasskey] iframeWallet.walletOrigin matches the host origin. Consider moving the wallet to a dedicated origin for stronger isolation.');\n }\n } catch {\n // ignore invalid URL here; constructor downstream will surface an error\n }\n }\n\n // Initialize iframe router once (and prevent concurrent calls from mounting multiple iframes).\n if (!this.iframeRouter) {\n if (!this.walletIframeInitInFlight) {\n this.walletIframeInitInFlight = (async () => {\n const { WalletIframeRouter } = await import('../WalletIframe/client/router');\n this.iframeRouter = new WalletIframeRouter({\n walletOrigin,\n servicePath: walletIframeConfig?.walletServicePath \|\| '/wallet-service',\n connectTimeoutMs: 20_000, // 20s\n requestTimeoutMs: 60_000, // 60s\n theme: this.configs.walletTheme,\n nearRpcUrl: this.configs.nearRpcUrl,\n nearNetwork: this.configs.nearNetwork,\n contractId: this.configs.contractId,\n nearExplorerUrl: this.configs.nearExplorerUrl,\n // Ensure relay server config reaches the wallet host for atomic registration\n relayer: this.configs.relayer,\n vrfWorkerConfigs: this.configs.vrfWorkerConfigs,\n emailRecoveryContracts: this.configs.emailRecoveryContracts,\n rpIdOverride: walletIframeConfig?.rpIdOverride,\n // Allow apps/CI to control where embedded bundles are served from\n sdkBasePath: walletIframeConfig?.sdkBasePath,\n });\n\n await this.iframeRouter.init();\n // Opportunistically warm remote NonceManager\n try { await this.iframeRouter.prefetchBlockheight(); } catch {}\n })();\n }\n\n try {\n await this.walletIframeInitInFlight;\n } finally {\n this.walletIframeInitInFlight = null;\n }\n } else {\n await this.iframeRouter.init();\n // Opportunistically warm remote NonceManager\n try { await this.iframeRouter.prefetchBlockheight(); } catch {}\n }\n\n // Wallet-iframe mode: keep app-origin UI prefs in sync with the wallet host.\n if (this.iframeRouter) {\n this.ensureWalletIframePreferencesMirror(this.iframeRouter);\n // Best-effort pull snapshot to cover missed events / older hosts.\n const cfg = await this.iframeRouter.getConfirmationConfig().catch(() => null);\n if (cfg) {\n this.userPreferences.applyWalletHostConfirmationConfig({\n nearAccountId: nearAccountId ? toAccountId(nearAccountId) : null,\n confirmationConfig: cfg,\n });\n }\n }\n\n await this.getLoginSession(nearAccountId);\n }\n\n /* Get the wallet iframe client if initialized. /\n getWalletIframeClient(): WalletIframeRouter \| null {\n return this.iframeRouter;\n }\n\n private ensureWalletIframePreferencesMirror(router: WalletIframeRouter): void {\n if (this.walletIframePrefsUnsubscribe) return;\n const unsubscribe = router.onPreferencesChanged?.(payload => {\n const id = payload?.nearAccountId;\n const nearAccountId = id ? toAccountId(id) : null;\n this.userPreferences.applyWalletHostConfirmationConfig({\n nearAccountId,\n confirmationConfig: payload?.confirmationConfig,\n });\n });\n this.walletIframePrefsUnsubscribe = unsubscribe ?? null;\n }\n\n /\n True when the SDK is running on the app origin with a wallet iframe configured.\n * In this mode, sensitive persistence must live in the wallet-iframe origin.\n /\n private shouldUseWalletIframe(): boolean {\n return !!this.configs.iframeWallet?.walletOrigin && !__isWalletIframeHostMode();\n }\n\n private async requireWalletIframeRouter(nearAccountId?: string): Promise<WalletIframeRouter> {\n if (!this.shouldUseWalletIframe()) {\n throw new Error('[TatchiPasskey] Wallet iframe is not configured.');\n }\n if (!this.iframeRouter) {\n await this.initWalletIframe(nearAccountId);\n }\n if (!this.iframeRouter) {\n throw new Error('[TatchiPasskey] Wallet iframe is configured but unavailable.');\n }\n return this.iframeRouter;\n }\n\n getContext(): PasskeyManagerContext {\n return {\n webAuthnManager: this.webAuthnManager,\n nearClient: this.nearClient,\n configs: this.configs\n }\n }\n\n getNearClient(): NearClient {\n return this.nearClient;\n }\n\n /\n Warm critical resources: delegates to WebAuthnManager and ensures iframe handshake when configured.\n /\n async warmCriticalResources(nearAccountId?: string): Promise<void> {\n // Maintain backward compatibility: delegate to consolidated init\n await this.initWalletIframe(nearAccountId);\n }\n\n /\n Pre-warm resources on a best-effort basis without changing visible state.\n * - When iframe=true, initializes the wallet iframe client (and warms local resources).\n * - When workers=true, warms local critical resources (nonce, IndexedDB, workers) without touching iframe.\n * - When both are false/omitted, does nothing.\n /\n async prewarm(opts?: { iframe?: boolean; workers?: boolean; nearAccountId?: string }): Promise<void> {\n const iframe = !!opts?.iframe;\n const workers = !!opts?.workers;\n const nearAccountId = opts?.nearAccountId;\n\n const tasks: Promise<unknown>[] = [];\n\n if (iframe) {\n // initWalletIframe also calls WebAuthnManager.warmCriticalResources internally\n tasks.push(this.initWalletIframe(nearAccountId));\n } else if (workers) {\n // Warm local-only resources without touching the iframe.\n // In iframe mode, avoid persisting user state (lastUserAccountId, preferences) on the app origin.\n const shouldAvoidLocalUserState = !!this.configs.iframeWallet?.walletOrigin && !__isWalletIframeHostMode();\n tasks.push(this.webAuthnManager.warmCriticalResources(shouldAvoidLocalUserState ? undefined : nearAccountId));\n }\n\n if (tasks.length === 0) return;\n try {\n await Promise.all(tasks);\n } catch {\n // Best-effort: swallow errors so prewarm never breaks app flows\n }\n }\n\n /\n View all access keys for a given account\n * @param accountId - NEAR account ID to view access keys for\n * @returns Promise resolving to access key list\n /\n async viewAccessKeyList(accountId: string): Promise<AccessKeyList> {\n if (this.iframeRouter) {\n return await this.iframeRouter.viewAccessKeyList(accountId);\n }\n return this.nearClient.viewAccessKeyList(accountId);\n }\n\n ///////////////////////////////////////\n // === Registration and Login ===\n ///////////////////////////////////////\n\n /\n Register a new passkey for the given NEAR account ID\n * Uses AccountId for on-chain operations and PRF salt derivation\n /\n async registerPasskey(\n nearAccountId: string,\n options: RegistrationHooksOptions = {}\n ): Promise<RegistrationResult> {\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n const confirmationConfig = options?.confirmationConfig;\n const res = await router.registerPasskey({\n nearAccountId,\n confirmationConfig,\n options: {\n onEvent: options?.onEvent,\n ...(options?.confirmerText ? { confirmerText: options.confirmerText } : {})\n }\n });\n // Opportunistically warm resources (non-blocking)\n void (async () => { try { await this.warmCriticalResources(nearAccountId); } catch {} })();\n await options?.afterCall?.(true, res);\n return res;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n return registerPasskey(\n this.getContext(),\n toAccountId(nearAccountId),\n options,\n this.configs.authenticatorOptions \|\| DEFAULT_AUTHENTICATOR_OPTIONS,\n );\n }\n\n /\n Internal variant that accepts a one-time confirmationConfig override.\n * Used by wallet-iframe host to force modal/autoProceed behavior for ArrowButtonLit.\n /\n async registerPasskeyInternal(\n nearAccountId: string,\n options: RegistrationHooksOptions = {},\n confirmationConfigOverride?: ConfirmationConfig\n ): Promise<RegistrationResult> {\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n const confirmationConfig = confirmationConfigOverride ?? options?.confirmationConfig;\n const res = await router.registerPasskey({\n nearAccountId,\n confirmationConfig,\n options: {\n onEvent: options?.onEvent,\n ...(options?.confirmerText ? { confirmerText: options.confirmerText } : {})\n }\n });\n void (async () => { try { await this.warmCriticalResources(nearAccountId); } catch {} })();\n await options?.afterCall?.(true, res);\n return res;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n // App-wallet path: call core internal with override\n return registerPasskeyInternal(\n this.getContext(),\n toAccountId(nearAccountId),\n options,\n this.configs.authenticatorOptions \|\| DEFAULT_AUTHENTICATOR_OPTIONS,\n confirmationConfigOverride,\n );\n }\n\n /\n Login and ensure a warm signing session exists.\n * - Unlocks VRF keypair (Shamir auto-unlock when possible; else WebAuthn prompt)\n * - Mints a warm signing session (policy from configs, override via options.signingSession)\n * - Optional: mints a server session (JWT/cookie) via options.session\n /\n async loginAndCreateSession(\n nearAccountId: string,\n options?: LoginHooksOptions\n ): Promise<LoginAndCreateSessionResult> {\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n // Forward serializable options to wallet host, including session config\n const res = await router.loginAndCreateSession({\n nearAccountId,\n options: {\n onEvent: options?.onEvent,\n // Pass through session so the wallet host calls relay to mint JWT/cookie sessions\n session: options?.session,\n signingSession: options?.signingSession,\n }\n });\n // Best-effort warm-up after successful login (non-blocking)\n void (async () => { try { await this.warmCriticalResources(nearAccountId); } catch {} })();\n await options?.afterCall?.(true, res);\n return res;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n // Initialize current user before login\n await this.webAuthnManager.initializeCurrentUser(toAccountId(nearAccountId), this.nearClient);\n const res = await loginAndCreateSession(this.getContext(), toAccountId(nearAccountId), options);\n // Best-effort warm-up after successful login (non-blocking)\n try { void this.warmCriticalResources(nearAccountId); } catch {}\n return res;\n }\n\n /\n Logout: clears VRF keypair and all in-worker session state.\n /\n async logoutAndClearSession(): Promise<void> {\n await logoutAndClearSession(this.getContext());\n // Also clear wallet-origin VRF session if service iframe is active\n if (this.iframeRouter) {\n try { await this.iframeRouter.clearVrfSession?.(); } catch {}\n }\n }\n\n /\n Read login state + warm signing session status (no prompts).\n /\n async getLoginSession(nearAccountId?: string): Promise<LoginSession> {\n if (this.shouldUseWalletIframe()) {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n const session = await router.getLoginSession(nearAccountId);\n try { await router.prefetchBlockheight(); } catch {}\n return session;\n }\n return await getLoginSession(this.getContext(), nearAccountId ? toAccountId(nearAccountId) : undefined);\n }\n\n /\n Get check if accountId has a passkey from IndexedDB\n /\n async hasPasskeyCredential(nearAccountId: AccountId): Promise<boolean> {\n if (this.shouldUseWalletIframe()) {\n const router = await this.requireWalletIframeRouter();\n return await router.hasPasskeyCredential(nearAccountId);\n }\n const baseAccountId = toAccountId(nearAccountId);\n return await this.webAuthnManager.hasPasskeyCredential(baseAccountId);\n }\n\n ///////////////////////////////////////\n // === User Settings ===\n ///////////////////////////////////////\n\n /\n Set confirmation behavior setting for the current user\n /\n setConfirmBehavior(behavior: 'requireClick' \| 'autoProceed'): void {\n if (this.shouldUseWalletIframe()) {\n // Fire and forget; persistence handled in wallet host. Avoid unhandled rejections.\n void (async () => {\n try {\n const router = await this.requireWalletIframeRouter();\n await router.setConfirmBehavior(behavior);\n } catch {}\n })();\n return;\n }\n this.webAuthnManager.getUserPreferences().setConfirmBehavior(behavior);\n }\n\n /\n Set the unified confirmation configuration\n /\n setConfirmationConfig(config: ConfirmationConfig): void {\n if (this.shouldUseWalletIframe()) {\n // Fire and forget; avoid unhandled rejections in consumers\n void (async () => {\n try {\n const router = await this.requireWalletIframeRouter();\n await router.setConfirmationConfig(config);\n } catch {}\n })();\n return;\n }\n this.webAuthnManager.getUserPreferences().setConfirmationConfig(config);\n }\n\n setUserTheme(theme: 'dark' \| 'light'): void {\n if (this.shouldUseWalletIframe()) {\n void (async () => {\n try {\n const router = await this.requireWalletIframeRouter();\n await router.setTheme(theme);\n } catch {}\n })();\n return;\n }\n this.webAuthnManager.getUserPreferences().setUserTheme(theme);\n }\n\n /\n Get the current confirmation configuration\n /\n getConfirmationConfig(): ConfirmationConfig {\n // Prefer wallet host value when available\n // Note: synchronous signature; returns last-known local value if iframe reply is async\n // Callers needing fresh remote value should use TatchiPasskeyIframe directly.\n return this.webAuthnManager.getUserPreferences().getConfirmationConfig();\n }\n\n /\n Prefetch latest block height/hash (and nonce if context missing) to reduce\n * perceived latency when the user initiates a signing flow.\n /\n async prefetchBlockheight(): Promise<void> {\n if (this.iframeRouter) {\n await this.iframeRouter.prefetchBlockheight();\n return;\n }\n try { await this.webAuthnManager.getNonceManager().prefetchBlockheight(this.nearClient); } catch {}\n }\n\n async getRecentLogins(): Promise<GetRecentLoginsResult> {\n // In iframe mode, do not fall back to app-origin IndexedDB.\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter();\n return await router.getRecentLogins();\n } catch {\n return { accountIds: [], lastUsedAccount: null };\n }\n }\n\n return getRecentLogins(this.getContext());\n }\n\n ///////////////////////////////////////\n // === Transactions ===\n ///////////////////////////////////////\n\n /\n Execute a NEAR blockchain action using passkey-derived credentials\n * Supports all NEAR action types: Transfer, FunctionCall, AddKey, etc.\n \n @param nearAccountId - NEAR account ID to execute action with\n * @param actionArgs - Action to execute (single action or array for batched transactions)\n * @param options - Action options for event handling\n * - onEvent: EventCallback<ActionSSEEvent> - Optional event callback\n * - onError: (error: Error) => void - Optional error callback\n * - afterCall: AfterCall - Optional after call hooks\n * - waitUntil: TxExecutionStatus - Optional waitUntil status\n * @returns Promise resolving to action result\n \n @example\n * ```typescript\n * // Basic transfer\n * const result = await passkeyManager.executeAction('alice.near', {\n * type: ActionType.Transfer,\n * receiverId: 'bob.near',\n * amount: '1000000000000000000000000' // 1 NEAR\n * });\n \n // Function call with gas and deposit (already available in ActionArgs)\n * const result = await passkeyManager.executeAction('alice.near', {\n * type: ActionType.FunctionCall,\n * receiverId: 'contract.near',\n * methodName: 'set_value',\n * args: { value: 42 },\n * gas: '50000000000000', // 50 TGas\n * deposit: '100000000000000000000000' // 0.1 NEAR\n * });\n \n // Batched transaction\n * const result = await passkeyManager.executeAction('alice.near', [\n * {\n * type: ActionType.Transfer,\n * receiverId: 'bob.near',\n * amount: '1000000000000000000000000'\n * },\n * {\n * type: ActionType.FunctionCall,\n * receiverId: 'contract.near',\n * methodName: 'log_transfer',\n * args: { recipient: 'bob.near' }\n * }\n * ], {\n * onEvent: (event) => console.log('Action progress:', event)\n * });\n * ```\n /\n async executeAction(args: {\n nearAccountId: string,\n receiverId: string,\n actionArgs: ActionArgs \| ActionArgs[],\n options?: ActionHooksOptions\n }): Promise<ActionResult> {\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(args.nearAccountId);\n const confirmerText = args.options?.confirmerText;\n const res = await router.executeAction({\n nearAccountId: args.nearAccountId,\n receiverId: args.receiverId,\n actionArgs: args.actionArgs,\n options: {\n onEvent: args.options?.onEvent,\n waitUntil: args.options?.waitUntil,\n confirmationConfig: args.options?.confirmationConfig,\n confirmerText,\n }\n });\n await args.options?.afterCall?.(true, res);\n return res;\n } catch (error: unknown) {\n const e = toError(error);\n await args.options?.onError?.(e);\n await args.options?.afterCall?.(false);\n throw e;\n }\n }\n // same-origin mode\n return executeAction({\n context: this.getContext(),\n nearAccountId: toAccountId(args.nearAccountId),\n receiverId: toAccountId(args.receiverId),\n actionArgs: args.actionArgs,\n options: args.options\n });\n }\n\n /\n Sign and send multiple transactions with actions\n * This method signs transactions with actions and sends them to the network\n \n @param nearAccountId - NEAR account ID to sign and send transactions with\n * @param transactionInputs - Transaction inputs to sign and send\n * @param options - Sign and send transaction options\n * - onEvent: EventCallback<ActionSSEEvent> - Optional event callback\n * - onError: (error: Error) => void - Optional error callback\n * - afterCall: AfterCall - Optional after call hooks\n * - waitUntil: TxExecutionStatus - Optional waitUntil status\n * - executeSequentially: boolean - Wait for each transaction to finish before sending the next (default: true)\n * @returns Promise resolving to action results\n \n @example\n * ```typescript\n * // Sign and send multiple transactions in a batch\n * const results = await passkeyManager.signAndSendTransactions('alice.near', {\n * transactions: [\n * {\n * receiverId: 'bob.near',\n * actions: [{\n * action_type: ActionType.Transfer,\n * deposit: '1000000000000000000000000'\n * }],\n * },\n * {\n * receiverId: 'contract.near',\n * actions: [{\n * action_type: ActionType.FunctionCall,\n * method_name: 'log_transfer',\n * args: JSON.stringify({ recipient: 'bob.near' }),\n * gas: '30000000000000',\n * deposit: '0'\n * }],\n * }\n * ],\n * options: {\n * onEvent: (event) => console.log('Signing and sending progress:', event)\n * executeSequentially: true\n * }\n * });\n * ```\n /\n async signAndSendTransactions({\n nearAccountId,\n transactions,\n options = {}\n }: {\n nearAccountId: string,\n transactions: TransactionInput[],\n options?: SignAndSendTransactionHooksOptions,\n }): Promise<ActionResult[]> {\n\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n const confirmerText = options?.confirmerText;\n const res = await router.signAndSendTransactions({\n nearAccountId,\n transactions: transactions.map(t => ({ receiverId: t.receiverId, actions: t.actions })),\n options: {\n onEvent: options?.onEvent,\n executionWait: options?.executionWait ?? { mode: 'sequential', waitUntil: options?.waitUntil },\n confirmationConfig: options?.confirmationConfig,\n confirmerText,\n }\n });\n // Emit completion\n const txIds = (res \|\| []).map(r => r?.transactionId).filter(Boolean).join(', ');\n options?.onEvent?.({ step: 8, phase: ActionPhase.STEP_8_ACTION_COMPLETE, status: ActionStatus.SUCCESS, message: `All transactions sent: ${txIds}` });\n await options?.afterCall?.(true, res);\n return res;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n\n return signAndSendTransactions({\n context: this.getContext(),\n nearAccountId: toAccountId(nearAccountId),\n transactionInputs: transactions,\n options\n }).then(txResults => {\n const txIds = txResults.map(txResult => txResult.transactionId).join(', ');\n options?.onEvent?.({\n step: 8,\n phase: ActionPhase.STEP_8_ACTION_COMPLETE,\n status: ActionStatus.SUCCESS,\n message: `All transactions sent: ${txIds}`\n });\n return txResults;\n });\n }\n\n /\n Convenience helper to sign and send a single transaction with actions.\n * Internally delegates to signAndSendTransactions() and returns the first result.\n /\n async signAndSendTransaction({\n nearAccountId,\n receiverId,\n actions,\n options = {}\n }: {\n nearAccountId: string;\n receiverId: string;\n actions: ActionArgs[];\n options?: SignAndSendTransactionHooksOptions;\n }): Promise<ActionResult> {\n const results = await this.signAndSendTransactions({\n nearAccountId,\n transactions: [\n {\n receiverId,\n actions\n }\n ],\n options\n });\n return results[0] as ActionResult;\n }\n\n /\n Batch sign transactions (with actions), allows you to sign transactions\n * to different receivers with a single TouchID prompt.\n * This method does not broadcast transactions, use sendTransaction() to do that.\n \n This method fetches the current nonce and increments it for the next N transactions,\n * so you do not need to manually increment the nonce for each transaction.\n \n @param nearAccountId - NEAR account ID to sign transactions with\n * @param params - Transaction signing parameters\n * - @param params.transactions: Array of transaction objects with nearAccountId, receiverId, actions, and nonce\n * - @param params.onEvent: Optional progress event callback\n * @returns Promise resolving to signed transaction results\n \n @example\n * ```typescript\n * // Sign a single transaction\n * const signedTransactions = await passkeyManager.signTransactionsWithActions('alice.near', {\n * transactions: [{\n * receiverId: 'bob.near',\n * actions: [{\n * action_type: ActionType.Transfer,\n * deposit: '1000000000000000000000000'\n * }],\n * }],\n * onEvent: (event) => console.log('Signing progress:', event)\n * });\n \n // Sign multiple transactions in a batch\n * const signedTransactions = await passkeyManager.signTransactionsWithActions('alice.near', {\n * transactions: [\n * {\n * receiverId: 'bob.near',\n * actions: [{\n * action_type: ActionType.Transfer,\n * deposit: '1000000000000000000000000'\n * }],\n * },\n * {\n * receiverId: 'contract.near',\n * actions: [{\n * action_type: ActionType.FunctionCall,\n * method_name: 'log_transfer',\n * args: JSON.stringify({ recipient: 'bob.near' }),\n * gas: '30000000000000',\n * deposit: '0'\n * }],\n * }\n * ]\n * });\n * ```\n /\n async signTransactionsWithActions({ nearAccountId, transactions, options }: {\n nearAccountId: string,\n transactions: TransactionInput[],\n options?: SignTransactionHooksOptions\n }): Promise<SignTransactionResult[]> {\n // route signing via wallet origin\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n const txs = transactions.map((t) => ({ receiverId: t.receiverId, actions: t.actions }));\n const confirmerText = options?.confirmerText;\n const result = await router.signTransactionsWithActions({\n nearAccountId, transactions:\n txs,\n options: {\n onEvent: options?.onEvent,\n confirmationConfig: options?.confirmationConfig,\n confirmerText,\n }\n });\n const arr: SignTransactionResult[] = Array.isArray(result) ? result : [];\n await options?.afterCall?.(true, arr);\n return arr;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n\n return signTransactionsWithActions({\n context: this.getContext(),\n nearAccountId: toAccountId(nearAccountId),\n transactionInputs: transactions,\n options\n });\n }\n\n /\n Send a signed transaction to the NEAR network\n * This method broadcasts a previously signed transaction and waits for execution\n \n @param signedTransaction - The signed transaction to broadcast\n * @param waitUntil - The execution status to wait for (defaults to FINAL)\n * @returns Promise resolving to the transaction execution outcome\n \n @example\n * ```typescript\n * // Sign a transaction first\n * const signedTransactions = await passkeyManager.signTransactionsWithActions('alice.near', {\n * transactions: [{\n * receiverId: 'bob.near',\n * actions: [{\n * action_type: ActionType.Transfer,\n * deposit: '1000000000000000000000000'\n * }],\n * }]\n * });\n \n // Then broadcast it\n * const result = await passkeyManager.sendTransaction(\n * signedTransactions[0].signedTransaction,\n * TxExecutionStatus.FINAL\n * );\n * ```\n /\n async sendTransaction({ signedTransaction, options }: {\n signedTransaction: SignedTransaction,\n options?: SendTransactionHooksOptions\n }): Promise<ActionResult> {\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter();\n const res = await router.sendTransaction({\n signedTransaction,\n options: {\n onEvent: options?.onEvent,\n ...(options && ('waitUntil' in options)\n ? { waitUntil: options.waitUntil }\n : {})\n }\n });\n await options?.afterCall?.(true, res);\n options?.onEvent?.({ step: 8, phase: ActionPhase.STEP_8_ACTION_COMPLETE, status: ActionStatus.SUCCESS, message: `Transaction ${res?.transactionId} broadcasted` });\n return res;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n\n return sendTransaction({ context: this.getContext(), signedTransaction, options })\n .then(txResult => {\n options?.onEvent?.({ step: 8, phase: ActionPhase.STEP_8_ACTION_COMPLETE, status: ActionStatus.SUCCESS, message: `Transaction ${txResult.transactionId} broadcasted` });\n return txResult;\n });\n }\n\n ///////////////////////////////////////\n // === DELEGATE ACTION SIGNING (NEP-461) ===\n ///////////////////////////////////////\n\n async signDelegateAction({\n nearAccountId,\n delegate,\n options,\n }: {\n nearAccountId: string;\n delegate: DelegateActionInput;\n options?: DelegateActionHooksOptions;\n }): Promise<SignDelegateActionResult> {\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n const result = await router.signDelegateAction({\n nearAccountId,\n delegate,\n options: {\n onEvent: options?.onEvent,\n confirmationConfig: options?.confirmationConfig,\n confirmerText: options?.confirmerText,\n }\n }) as SignDelegateActionResult;\n await options?.afterCall?.(true, result);\n return result;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n\n return signDelegateAction({\n context: this.getContext(),\n nearAccountId: toAccountId(nearAccountId),\n delegate,\n options,\n });\n }\n\n /\n Convenience helper to POST a signed delegate to a relayer.\n * Does not enforce any relayer semantics; simply forwards the payload.\n /\n async sendDelegateActionViaRelayer(args: {\n relayerUrl: string;\n signedDelegate: SignedDelegate \| WasmSignedDelegate;\n hash: string;\n signal?: AbortSignal;\n options?: DelegateRelayHooksOptions;\n }): Promise<DelegateRelayResult> {\n const base = args.relayerUrl.replace(/\\/+$/, '');\n const route = (this.configs.relayer?.delegateActionRoute \|\| '/signed-delegate').replace(/^\\/?/, '/');\n const endpoint = `${base}${route}`;\n return sendDelegateActionViaRelayer({\n url: endpoint,\n payload: {\n hash: args.hash,\n signedDelegate: args.signedDelegate,\n },\n signal: args.signal,\n options: args.options,\n });\n }\n\n /\n Convenience helper to sign a delegate action and immediately forward it to the relayer.\n * Emits delegate signing events and relay broadcasting events through the provided options.\n /\n async signAndSendDelegateAction(args: {\n nearAccountId: string;\n delegate: DelegateActionInput;\n relayerUrl: string;\n signal?: AbortSignal;\n options?: SignAndSendDelegateActionHooksOptions;\n }): Promise<SignAndSendDelegateActionResult> {\n const { nearAccountId, delegate, relayerUrl, signal, options } = args;\n\n const signOptions: DelegateActionHooksOptions \| undefined = options\n ? {\n onEvent: options.onEvent,\n onError: options.onError,\n waitUntil: options.waitUntil,\n confirmationConfig: options.confirmationConfig,\n confirmerText: options.confirmerText,\n // suppress afterCall so we can call afterCall() once at the end of the lifecycle.\n afterCall: () => {},\n }\n : undefined;\n\n let signResult: SignDelegateActionResult;\n try {\n signResult = await this.signDelegateAction({\n nearAccountId,\n delegate,\n options: signOptions,\n });\n } catch (error) {\n await options?.afterCall?.(false);\n throw error;\n }\n\n const relayOptions: DelegateRelayHooksOptions \| undefined = options\n ? {\n onEvent: options.onEvent,\n onError: options.onError,\n }\n : undefined;\n\n let relayResult: DelegateRelayResult;\n try {\n relayResult = await this.sendDelegateActionViaRelayer({\n relayerUrl,\n hash: signResult.hash,\n signedDelegate: signResult.signedDelegate,\n signal,\n options: relayOptions,\n });\n } catch (error) {\n await options?.afterCall?.(false);\n throw error;\n }\n\n const combined: SignAndSendDelegateActionResult = {\n signResult,\n relayResult,\n };\n\n const success = relayResult.ok !== false;\n if (success) {\n await options?.afterCall?.(true, combined);\n } else {\n await options?.afterCall?.(false);\n }\n return combined;\n }\n\n ///////////////////////////////////////\n // === NEP-413 MESSAGE SIGNING ===\n ///////////////////////////////////////\n\n /\n Sign a NEP-413 message using the user's passkey-derived private key:\n * - Creates a payload with message, recipient, nonce, and state\n * - Serializes using Borsh\n * - Adds NEP-413 prefix\n * - Hashes with SHA-256\n * - Signs with Ed25519\n * - Returns base64-encoded signature\n \n @param nearAccountId - NEAR account ID to sign with\n * @param params - NEP-413 signing parameters\n * - message: string - The message to sign\n * - recipient: string - The recipient of the message\n * - state: string - Optional state parameter\n * @param options - Action options for event handling\n * - onEvent: EventCallback<ActionSSEEvent> - Optional event callback\n * - onError: (error: Error) => void - Optional error callback\n * - afterCall: AfterCall - Optional after call hooks\n * - waitUntil: TxExecutionStatus - Optional waitUntil status\n * @returns Promise resolving to signing result\n \n @example\n * ```typescript\n * const result = await passkeyManager.signNEP413Message('alice.near', {\n * message: 'Hello World',\n * recipient: 'app.example.com',\n * state: 'optional-state'\n * });\n * ```\n /\n async signNEP413Message(args: {\n nearAccountId: string,\n params: SignNEP413MessageParams,\n options?: SignNEP413HooksOptions\n }): Promise<SignNEP413MessageResult> {\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(args.nearAccountId);\n const confirmerText = args.options?.confirmerText;\n const confirmationConfig = args.options?.confirmationConfig;\n const result = await router.signNep413Message({\n nearAccountId: args.nearAccountId,\n message: args.params.message,\n recipient: args.params.recipient,\n state: args.params.state,\n options: { onEvent: args.options?.onEvent, confirmerText, confirmationConfig }\n });\n await args.options?.afterCall?.(true, result);\n // Expect wallet to return the same shape as WebAuthnManager.signNEP413Message\n return result as SignNEP413MessageResult;\n } catch (error: unknown) {\n const e = toError(error);\n await args.options?.onError?.(e);\n await args.options?.afterCall?.(false);\n throw e;\n }\n }\n\n const res = await signNEP413Message({\n context: this.getContext(),\n nearAccountId: toAccountId(args.nearAccountId),\n params: args.params,\n options: args.options\n });\n if (res?.success) {\n await args.options?.afterCall?.(true, res);\n } else {\n await args.options?.afterCall?.(false);\n }\n return res;\n }\n\n ///////////////////////////////////////\n // === KEY MANAGEMENT ===\n ///////////////////////////////////////\n\n /\n Canonical entrypoint to show the Export Private Key UI (secure drawer/modal)\n * without returning the key to the caller. All dApps should use this wrapper;\n * the underlying WebAuthnManager.exportNearKeypairWithUI() is fully worker-\n * driven and only ever reveals the private key inside trusted UI surfaces.\n /\n async exportNearKeypairWithUI(\n nearAccountId: string,\n options?: { variant?: 'drawer' \| 'modal'; theme?: 'dark' \| 'light' }\n ): Promise<void> {\n if (isOffline()) {\n // If offline, open the offline-export route\n await openOfflineExport({\n accountId: nearAccountId,\n routerOpen: this.iframeRouter?.openOfflineExport?.bind(this.iframeRouter),\n walletOrigin: this.configs?.iframeWallet?.walletOrigin,\n target: '_blank',\n });\n } else {\n // Prefer wallet iframe when ready\n if (this.iframeRouter?.isReady?.()) {\n await this.iframeRouter.exportNearKeypairWithUI(nearAccountId, options);\n return;\n }\n // Online but router not ready: prefer offline-export route via router (or new tab)\n // Only do this when we have a wallet origin configured or router API is available\n const routerOpen = this.iframeRouter?.openOfflineExport?.bind(this.iframeRouter);\n const walletOrigin = this.configs?.iframeWallet?.walletOrigin;\n if (routerOpen \|\| walletOrigin) {\n await openOfflineExport({ accountId: nearAccountId, routerOpen, walletOrigin, target: '_blank' });\n return;\n }\n // Final fallback: local worker-driven UI\n await this.webAuthnManager.exportNearKeypairWithUI(toAccountId(nearAccountId), options);\n }\n }\n\n ///////////////////////////////////////\n // === DERIVED ADDRESSES (public helpers) ===\n ///////////////////////////////////////\n\n /* Store a derived address for an account + contract + path (multi-chain capable via path encoding). /\n async setDerivedAddress(\n nearAccountId: string,\n args: { contractId: string; path: string; address: string }\n ): Promise<void> {\n if (this.shouldUseWalletIframe()) {\n let router: WalletIframeRouter;\n try {\n router = await this.requireWalletIframeRouter();\n } catch {\n throw new Error('[TatchiPasskey] Wallet iframe is configured but unavailable; refusing to write derived addresses to app origin.');\n }\n return await router.setDerivedAddress({ nearAccountId, args });\n }\n await chainsigAddressManager.setDerivedAddress(toAccountId(nearAccountId), args);\n }\n\n /* Retrieve the full derived address record (or null if not found). /\n async getDerivedAddressRecord(\n nearAccountId: string,\n args: { contractId: string; path: string }\n ): Promise<DerivedAddressRecord \| null> {\n if (this.shouldUseWalletIframe()) {\n let router: WalletIframeRouter;\n try {\n router = await this.requireWalletIframeRouter();\n } catch {\n throw new Error('[TatchiPasskey] Wallet iframe is configured but unavailable; refusing to read derived addresses from app origin.');\n }\n return await router.getDerivedAddressRecord({ nearAccountId, args });\n }\n return await chainsigAddressManager.getDerivedAddressRecord(toAccountId(nearAccountId), args);\n }\n\n /* Retrieve only the derived address string for convenience. /\n async getDerivedAddress(\n nearAccountId: string,\n args: { contractId: string; path: string }\n ): Promise<string \| null> {\n if (this.shouldUseWalletIframe()) {\n let router: WalletIframeRouter;\n try {\n router = await this.requireWalletIframeRouter();\n } catch {\n throw new Error('[TatchiPasskey] Wallet iframe is configured but unavailable; refusing to read derived addresses from app origin.');\n }\n return await router.getDerivedAddress({ nearAccountId, args });\n }\n return await chainsigAddressManager.getDerivedAddress(toAccountId(nearAccountId), args);\n }\n\n ///////////////////////////////////////\n // === Email Recovery (public helpers) ===\n ///////////////////////////////////////\n\n /\n Get recovery emails for an account.\n * - Fetches on-chain recovery email hashes via get_recovery_emails.\n * - Resolves hashes to canonical emails using local IndexedDB mapping when available.\n * - Returns an array of { hashHex, email }, where `email` is a human-readable label\n * (canonical email when known on this device, otherwise the hash hex).\n /\n async getRecoveryEmails(nearAccountId: string): Promise<Array<{ hashHex: string; email: string }>> {\n if (this.shouldUseWalletIframe()) {\n let router: WalletIframeRouter;\n try {\n router = await this.requireWalletIframeRouter(nearAccountId);\n } catch {\n throw new Error('[TatchiPasskey] Wallet iframe is configured but unavailable; refusing to read recovery email mappings from app origin.');\n }\n return await router.getRecoveryEmails(nearAccountId);\n }\n const accountId = toAccountId(nearAccountId);\n\n // Fetch on-chain recovery email hashes\n const rawHashes = await getRecoveryEmailHashesContractCall(this.nearClient, accountId);\n if (!rawHashes.length) {\n return [];\n }\n\n // Load local mapping from IndexedDB (best-effort)\n let local: RecoveryEmailRecord[] = [];\n try {\n local = await getLocalRecoveryEmails(accountId);\n } catch (error) {\n console.warn('[TatchiPasskey] Failed to load local recovery emails', error);\n }\n\n const emailByHashHex = new Map<string, string>();\n for (const rec of local) {\n if (!rec?.hashHex \|\| !rec?.email) continue;\n if (!emailByHashHex.has(rec.hashHex)) {\n emailByHashHex.set(rec.hashHex, rec.email);\n }\n }\n\n return rawHashes.map(hashBytes => {\n const hashHex = bytesToHex(hashBytes);\n const email = emailByHashHex.get(hashHex) \|\| hashHex;\n return { hashHex, email };\n });\n }\n\n /\n Set recovery emails for an account:\n * - Canonicalizes and hashes emails client-side.\n * - Persists mapping in IndexedDB.\n * - Deploys/attaches the EmailRecoverer contract when needed.\n * - Calls set_recovery_emails(...) on the per-account contract.\n /\n async setRecoveryEmails(\n nearAccountId: string,\n recoveryEmails: string[],\n options?: ActionHooksOptions\n ): Promise<ActionResult> {\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n const res = await router.setRecoveryEmails({ nearAccountId, recoveryEmails, options });\n await options?.afterCall?.(true, res);\n return res;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n const accountId = toAccountId(nearAccountId);\n\n // Canonicalize, hash, and persist mapping locally (best-effort)\n const { hashes: recoveryEmailHashes } = await prepareRecoveryEmails(accountId, recoveryEmails);\n\n const actions: ActionArgs[] = await buildSetRecoveryEmailsActions(\n this.nearClient,\n accountId,\n recoveryEmailHashes,\n this.configs.emailRecoveryContracts\n );\n\n // Delegate to executeAction so iframe vs same-origin routing is respected.\n return this.executeAction({\n nearAccountId,\n receiverId: nearAccountId,\n actionArgs: actions,\n options,\n });\n }\n\n ///////////////////////////////////////\n // === Account Recovery Flow ===\n ///////////////////////////////////////\n\n /\n Creates an AccountRecoveryFlow instance, for step-by-step account recovery UX\n /\n async recoverAccountFlow(args: {\n accountId?: string;\n options?: AccountRecoveryHooksOptions\n }): Promise<RecoveryResult> {\n\n const accountIdInput = args?.accountId \|\| '';\n const options = args?.options;\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter();\n const res = await router.recoverAccountFlow({\n accountId: accountIdInput,\n onEvent: options?.onEvent\n });\n await options?.afterCall?.(true, res);\n return res;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n\n // Local orchestration using AccountRecoveryFlow for a single-call UX\n try {\n const flow = new AccountRecoveryFlow(this.getContext(), options);\n // Phase 1: Discover available accounts\n const discovered = await flow.discover(accountIdInput \|\| '');\n if (!Array.isArray(discovered) \|\| discovered.length === 0) {\n const err = new Error('No recoverable accounts found');\n await options?.onError?.(err);\n await options?.afterCall?.(false);\n return { success: false, accountId: accountIdInput \|\| '', publicKey: '', message: err.message, error: err.message };\n }\n // Phase 2: User selects account in UI\n // Select the first account-scope; OS chooser selects the actual credential\n const selected = discovered[0];\n\n // Phase 3: Execute recovery with secure credential lookup\n const result = await flow.recover({\n credentialId: selected.credentialId,\n accountId: selected.accountId\n });\n\n await options?.afterCall?.(true, result);\n return result;\n\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n\n ///////////////////////////////////////\n // === Email Recovery Flow ===\n ///////////////////////////////////////\n\n private getEmailRecoveryFlow(options?: EmailRecoveryFlowOptions) {\n const { EmailRecoveryFlow } = require('./emailRecovery') as typeof import('./emailRecovery');\n if (!this.activeEmailRecoveryFlow) {\n this.activeEmailRecoveryFlow = new EmailRecoveryFlow(this.getContext(), options);\n } else if (options) {\n this.activeEmailRecoveryFlow.setOptions(options);\n }\n return this.activeEmailRecoveryFlow;\n }\n\n async startEmailRecovery(args: {\n accountId: string;\n recoveryEmail?: string;\n options?: EmailRecoveryFlowOptions;\n }): Promise<{ mailtoUrl: string; nearPublicKey: string }> {\n const { accountId, recoveryEmail, options } = args;\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter();\n const normalizedRecoveryEmail =\n typeof recoveryEmail === 'string' && recoveryEmail.trim().length > 0\n ? recoveryEmail.trim()\n : undefined;\n const confirmerText = options?.confirmerText;\n const confirmationConfig = options?.confirmationConfig;\n const safeOptions = {\n ...(confirmerText ? { confirmerText } : {}),\n ...(confirmationConfig ? { confirmationConfig } : {}),\n };\n const res = await router.startEmailRecovery({\n accountId,\n recoveryEmail: normalizedRecoveryEmail,\n onEvent: options?.onEvent,\n options: Object.keys(safeOptions).length > 0 ? safeOptions : undefined,\n });\n await options?.afterCall?.(true, undefined);\n return res;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n const flow = this.getEmailRecoveryFlow(options);\n return await flow.start({ accountId, recoveryEmail });\n }\n\n async finalizeEmailRecovery(args: {\n accountId: string;\n nearPublicKey?: string;\n options?: EmailRecoveryFlowOptions;\n }): Promise<void> {\n const { accountId, nearPublicKey, options } = args;\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter();\n await router.finalizeEmailRecovery({\n accountId,\n nearPublicKey,\n onEvent: options?.onEvent,\n });\n await options?.afterCall?.(true, undefined);\n return;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n const flow = this.getEmailRecoveryFlow(options);\n await flow.finalize({ accountId, nearPublicKey });\n }\n\n /\n Best-effort cancellation for an in-flight email recovery flow.\n * Intended for UI \"user cancelled sending email\" / retry UX.\n /\n async cancelEmailRecovery(args?: { accountId?: string; nearPublicKey?: string }): Promise<void> {\n const { accountId, nearPublicKey } = args \|\| {};\n // In wallet-iframe mode, instruct the wallet host to stop the active flow.\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter();\n await router.stopEmailRecovery({ accountId, nearPublicKey });\n } catch {}\n return;\n }\n\n try {\n await this.activeEmailRecoveryFlow?.cancelAndReset({ accountId, nearPublicKey });\n } catch {}\n this.activeEmailRecoveryFlow = null;\n }\n\n ///////////////////////////////////////\n // === Link Device ===\n ///////////////////////////////////////\n\n /\n Device2: Start device linking flow\n * Returns QR payload and data URL to render; emits onEvent during the flow.\n * Runs inside iframe when available for better isolation.\n /\n async startDevice2LinkingFlow(args: StartDevice2LinkingFlowArgs): Promise<StartDevice2LinkingFlowResults> {\n // In wallet-iframe mode, device linking must run inside the wallet origin.\n if (this.shouldUseWalletIframe()) {\n const router = await this.requireWalletIframeRouter();\n const options = args?.options;\n return await router.startDevice2LinkingFlow({\n ui: args?.ui,\n cameraId: args?.cameraId,\n options,\n });\n }\n // Local fallback: keep internal flow reference for cancellation\n this.activeDeviceLinkFlow?.cancel();\n const flow = new LinkDeviceFlow(this.getContext(), {\n cameraId: args?.cameraId,\n options: args?.options,\n });\n this.activeDeviceLinkFlow = flow;\n const { qrData, qrCodeDataURL } = await flow.generateQR();\n return { qrData, qrCodeDataURL };\n }\n\n /\n Device2: Stops device linking flow inside the iframe host.\n /\n async stopDevice2LinkingFlow(): Promise<void> {\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter();\n await router.stopDevice2LinkingFlow();\n } catch {}\n return;\n }\n if (this.iframeRouter) {\n await this.iframeRouter.stopDevice2LinkingFlow();\n return;\n }\n this.activeDeviceLinkFlow?.cancel();\n this.activeDeviceLinkFlow = null;\n }\n\n /\n Device1: Link device using pre-scanned QR data.\n * You can use a QR scanning component of your choice,\n * or use the built-in <QRCodeScanner /> component.\n \n @param qrData The QR data obtained from scanning Device2's QR code\n * @param options Device linking options including funding amount and event callbacks\n * @returns Promise that resolves to the linking result\n /\n async linkDeviceWithScannedQRData(\n qrData: DeviceLinkingQRData,\n options: ScanAndLinkDeviceOptionsDevice1\n ): Promise<LinkDeviceResult> {\n // In wallet-iframe mode, device linking must run inside the wallet origin.\n if (this.shouldUseWalletIframe()) {\n const router = await this.requireWalletIframeRouter();\n const res = await router.linkDeviceWithScannedQRData({\n qrData,\n fundingAmount: options.fundingAmount,\n options: {\n onEvent: options.onEvent,\n confirmationConfig: options.confirmationConfig,\n confirmerText: options.confirmerText,\n }\n });\n return res as LinkDeviceResult;\n }\n return linkDeviceWithScannedQRData(this.getContext(), qrData, options);\n }\n\n /\n Delete a device key from an account\n */\n async deleteDeviceKey(\n accountId: string,\n publicKeyToDelete: string,\n options?: ActionHooksOptions\n ): Promise<ActionResult> {\n // Validate that we're not deleting the last key\n const keysView = this.iframeRouter\n ? await this.iframeRouter.viewAccessKeyList(accountId)\n : await this.nearClient.viewAccessKeyList(toAccountId(accountId));\n if (keysView.keys.length <= 1) {\n throw new Error('Cannot delete the last access key from an account');\n }\n\n // Find the key to delete\n const keyToDelete = keysView.keys.find((k: { public_key: string }) => k.public_key === publicKeyToDelete);\n if (!keyToDelete) {\n throw new Error(`Access key ${publicKeyToDelete} not found on account ${accountId}`);\n }\n\n // Use the executeAction method with DeleteKey action\n return this.executeAction({\n nearAccountId: accountId,\n receiverId: accountId,\n actionArgs: {\n type: ActionType.DeleteKey,\n publicKey: publicKeyToDelete\n },\n options: options\n });\n }\n\n}\n\n// Re-export types for convenience\nexport type {\n TatchiConfigs,\n TatchiConfigsInput,\n RegistrationResult,\n LoginAndCreateSessionResult,\n LoginResult,\n LoginSession,\n SigningSessionStatus,\n ActionResult,\n} from '../types/tatchi';\nexport type {\n ActionHooksOptions,\n AfterCall,\n EventCallback,\n LoginHooksOptions,\n LoginSSEvent,\n RegistrationHooksOptions,\n RegistrationSSEEvent,\n SignNEP413HooksOptions,\n} from '../types/sdkSentEvents';\n// Context alias (optional convenience)\nexport type TatchiPasskeyContext = PasskeyManagerContext;\n\nexport type {\n DeviceLinkingQRData,\n DeviceLinkingSession,\n LinkDeviceResult\n} from '../types/linkDevice';\n\n// Re-export device linking error types and classes\nexport {\n DeviceLinkingPhase,\n DeviceLinkingError,\n DeviceLinkingErrorCode\n} from '../types/linkDevice';\n\n// Re-export account recovery types and classes\nexport type {\n RecoveryResult,\n AccountLookupResult,\n PasskeyOption,\n PasskeyOptionWithoutCredential,\n PasskeySelection\n} from './recoverAccount';\n\nexport {\n AccountRecoveryFlow\n} from './recoverAccount';\n\n// Re-export NEP-413 types\nexport type {\n SignNEP413MessageParams,\n SignNEP413MessageResult\n} from './signNEP413';\n\n// Re-export QR scanning flow\nexport {\n ScanQRCodeFlow,\n type ScanQRCodeFlowOptions,\n type ScanQRCodeFlowEvents,\n ScanQRCodeFlowState\n} from '../../utils/qrScanner';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoGA,IAAI,8BAA8B;;;;;AAMlC,IAAa,gBAAb,MAA2B;CACzB,AAAiB;CACjB,AAAiB;CACjB,AAAS;CACT,AAAQ,eAA0C;CAElD,AAAQ,2BAAiD;CAEzD,AAAQ,+BAAoD;CAE5D,AAAQ,uBAA8C;CACtD,AAAQ,4BAAwD;CAChE,AAAQ,0BAA8E;CAEtF,YACE,SACA,YACA;AACA,OAAK,UAAUA,2CAAoB;EAInC,MAAM,OAAOC,+CACT,WACC,KAAK,QAAQ,cAAc,eAAe,aAAa;AAC5D,mCAAmB,EAAE;AAErB,OAAK,aAAa,cAAc,IAAIC,qCAAkB,KAAK,QAAQ;AACnE,OAAK,kBAAkB,IAAIC,gCAAgB,KAAK,SAAS,KAAK;;;;;;CAQhE,IAAI,kBAA0C;AAC5C,SAAO,KAAK,gBAAgB;;;;;;;CAQ9B,MAAM,iBAAiB,eAAuC;EAC5D,MAAM,yBAAyB,CAAC,CAAC,KAAK,QAAQ,cAAc;EAG5D,MAAM,4BAA4B,0BAA0B,CAACF;AAC7D,QAAM,KAAK,gBAAgB,sBAAsB,4BAA4B,SAAY;AAKzF,MAAIA,6CACF;EAGF,MAAM,qBAAqB,KAAK,QAAQ;EACxC,MAAM,eAAe,oBAAoB;AAEzC,MAAI,CAAC,cAAc;AAEjB,SAAM,KAAK,gBAAgB;AAC3B;;AAIF,MAAI,CAAC,4BACH,KAAI;GACF,MAAM,qBAAqBA;GAC3B,MAAM,SAAS,IAAI,IAAI;AACvB,OAAI,OAAO,WAAW,eAAe,OAAO,WAAW,OAAO,SAAS,UAAU,CAAC,oBAAoB;AACpG,kCAA8B;AAC9B,YAAQ,KAAK;;UAET;AAMV,MAAI,CAAC,KAAK,cAAc;AACtB,OAAI,CAAC,KAAK,yBACR,MAAK,4BAA4B,YAAY;IAC3C,MAAM,EAAE,uBAAuB,2CAAM;AACrC,SAAK,eAAe,IAAI,mBAAmB;KACzC;KACA,aAAa,oBAAoB,qBAAqB;KACtD,kBAAkB;KAClB,kBAAkB;KAClB,OAAO,KAAK,QAAQ;KACpB,YAAY,KAAK,QAAQ;KACzB,aAAa,KAAK,QAAQ;KAC1B,YAAY,KAAK,QAAQ;KACzB,iBAAiB,KAAK,QAAQ;KAE9B,SAAS,KAAK,QAAQ;KACtB,kBAAkB,KAAK,QAAQ;KAC/B,wBAAwB,KAAK,QAAQ;KACrC,cAAc,oBAAoB;KAElC,aAAa,oBAAoB;;AAGnC,UAAM,KAAK,aAAa;AAExB,QAAI;AAAE,WAAM,KAAK,aAAa;YAA+B;;AAIjE,OAAI;AACF,UAAM,KAAK;aACH;AACR,SAAK,2BAA2B;;SAE7B;AACL,SAAM,KAAK,aAAa;AAExB,OAAI;AAAE,UAAM,KAAK,aAAa;WAA+B;;AAI/D,MAAI,KAAK,cAAc;AACrB,QAAK,oCAAoC,KAAK;GAE9C,MAAM,MAAM,MAAM,KAAK,aAAa,wBAAwB,YAAY;AACxE,OAAI,IACF,MAAK,gBAAgB,kCAAkC;IACrD,eAAe,gBAAgBG,+BAAY,iBAAiB;IAC5D,oBAAoB;;;AAK1B,QAAM,KAAK,gBAAgB;;;CAI7B,wBAAmD;AACjD,SAAO,KAAK;;CAGd,AAAQ,oCAAoC,QAAkC;AAC5E,MAAI,KAAK,6BAA8B;EACvC,MAAM,cAAc,OAAO,wBAAuB,YAAW;GAC3D,MAAM,KAAK,SAAS;GACpB,MAAM,gBAAgB,KAAKA,+BAAY,MAAM;AAC7C,QAAK,gBAAgB,kCAAkC;IACrD;IACA,oBAAoB,SAAS;;;AAGjC,OAAK,+BAA+B,eAAe;;;;;;CAOrD,AAAQ,wBAAiC;AACvC,SAAO,CAAC,CAAC,KAAK,QAAQ,cAAc,gBAAgB,CAACH;;CAGvD,MAAc,0BAA0B,eAAqD;AAC3F,MAAI,CAAC,KAAK,wBACR,OAAM,IAAI,MAAM;AAElB,MAAI,CAAC,KAAK,aACR,OAAM,KAAK,iBAAiB;AAE9B,MAAI,CAAC,KAAK,aACR,OAAM,IAAI,MAAM;AAElB,SAAO,KAAK;;CAGd,aAAoC;AAClC,SAAO;GACL,iBAAiB,KAAK;GACtB,YAAY,KAAK;GACjB,SAAS,KAAK;;;CAIlB,gBAA4B;AAC1B,SAAO,KAAK;;;;;CAMd,MAAM,sBAAsB,eAAuC;AAEjE,QAAM,KAAK,iBAAiB;;;;;;;;CAS9B,MAAM,QAAQ,MAAuF;EACnG,MAAM,SAAS,CAAC,CAAC,MAAM;EACvB,MAAM,UAAU,CAAC,CAAC,MAAM;EACxB,MAAM,gBAAgB,MAAM;EAE5B,MAAMI,QAA4B;AAElC,MAAI,OAEF,OAAM,KAAK,KAAK,iBAAiB;WACxB,SAAS;GAGlB,MAAM,4BAA4B,CAAC,CAAC,KAAK,QAAQ,cAAc,gBAAgB,CAACJ;AAChF,SAAM,KAAK,KAAK,gBAAgB,sBAAsB,4BAA4B,SAAY;;AAGhG,MAAI,MAAM,WAAW,EAAG;AACxB,MAAI;AACF,SAAM,QAAQ,IAAI;UACZ;;;;;;;CAUV,MAAM,kBAAkB,WAA2C;AACjE,MAAI,KAAK,aACP,QAAO,MAAM,KAAK,aAAa,kBAAkB;AAEnD,SAAO,KAAK,WAAW,kBAAkB;;;;;;CAW3C,MAAM,gBACJ,eACA,UAAoC,IACP;AAE7B,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B;GACpD,MAAM,qBAAqB,SAAS;GACpC,MAAM,MAAM,MAAM,OAAO,gBAAgB;IACvC;IACA;IACA,SAAS;KACP,SAAS,SAAS;KAClB,GAAI,SAAS,gBAAgB,EAAE,eAAe,QAAQ,kBAAkB;;;AAI5E,IAAM,YAAY;AAAE,QAAI;AAAE,WAAM,KAAK,sBAAsB;YAAwB;;AACnF,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WACAK,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;AAGV,SAAOC,qCACL,KAAK,cACLJ,+BAAY,gBACZ,SACA,KAAK,QAAQ,wBAAwBK;;;;;;CAQzC,MAAM,wBACJ,eACA,UAAoC,IACpC,4BAC6B;AAE7B,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B;GACpD,MAAM,qBAAqB,8BAA8B,SAAS;GAClE,MAAM,MAAM,MAAM,OAAO,gBAAgB;IACvC;IACA;IACA,SAAS;KACP,SAAS,SAAS;KAClB,GAAI,SAAS,gBAAgB,EAAE,eAAe,QAAQ,kBAAkB;;;AAG5E,IAAM,YAAY;AAAE,QAAI;AAAE,WAAM,KAAK,sBAAsB;YAAwB;;AACnF,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WACAH,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;AAIV,SAAOG,6CACL,KAAK,cACLN,+BAAY,gBACZ,SACA,KAAK,QAAQ,wBAAwBK,4DACrC;;;;;;;;CAUJ,MAAM,sBACJ,eACA,SACsC;AAEtC,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B;GAEpD,MAAME,QAAM,MAAM,OAAO,sBAAsB;IAC7C;IACA,SAAS;KACP,SAAS,SAAS;KAElB,SAAS,SAAS;KAClB,gBAAgB,SAAS;;;AAI7B,IAAM,YAAY;AAAE,QAAI;AAAE,WAAM,KAAK,sBAAsB;YAAwB;;AACnF,SAAM,SAAS,YAAY,MAAMA;AACjC,UAAOA;WACAL,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;AAIV,QAAM,KAAK,gBAAgB,sBAAsBH,+BAAY,gBAAgB,KAAK;EAClF,MAAM,MAAM,MAAMQ,oCAAsB,KAAK,cAAcR,+BAAY,gBAAgB;AAEvF,MAAI;AAAE,GAAK,KAAK,sBAAsB;UAAwB;AAC9D,SAAO;;;;;CAMT,MAAM,wBAAuC;AAC3C,QAAMS,oCAAsB,KAAK;AAEjC,MAAI,KAAK,aACP,KAAI;AAAE,SAAM,KAAK,aAAa;UAA6B;;;;;CAO/D,MAAM,gBAAgB,eAA+C;AACnE,MAAI,KAAK,yBAAyB;GAChC,MAAM,SAAS,MAAM,KAAK,0BAA0B;GACpD,MAAM,UAAU,MAAM,OAAO,gBAAgB;AAC7C,OAAI;AAAE,UAAM,OAAO;WAA+B;AAClD,UAAO;;AAET,SAAO,MAAMC,8BAAgB,KAAK,cAAc,gBAAgBV,+BAAY,iBAAiB;;;;;CAM/F,MAAM,qBAAqB,eAA4C;AACrE,MAAI,KAAK,yBAAyB;GAChC,MAAM,SAAS,MAAM,KAAK;AAC1B,UAAO,MAAM,OAAO,qBAAqB;;EAE3C,MAAM,gBAAgBA,+BAAY;AAClC,SAAO,MAAM,KAAK,gBAAgB,qBAAqB;;;;;CAUzD,mBAAmB,UAAgD;AACjE,MAAI,KAAK,yBAAyB;AAEhC,IAAM,YAAY;AAChB,QAAI;KACF,MAAM,SAAS,MAAM,KAAK;AAC1B,WAAM,OAAO,mBAAmB;YAC1B;;AAEV;;AAEF,OAAK,gBAAgB,qBAAqB,mBAAmB;;;;;CAM/D,sBAAsB,QAAkC;AACtD,MAAI,KAAK,yBAAyB;AAEhC,IAAM,YAAY;AAChB,QAAI;KACF,MAAM,SAAS,MAAM,KAAK;AAC1B,WAAM,OAAO,sBAAsB;YAC7B;;AAEV;;AAEF,OAAK,gBAAgB,qBAAqB,sBAAsB;;CAGlE,aAAa,OAA+B;AAC1C,MAAI,KAAK,yBAAyB;AAChC,IAAM,YAAY;AAChB,QAAI;KACF,MAAM,SAAS,MAAM,KAAK;AAC1B,WAAM,OAAO,SAAS;YAChB;;AAEV;;AAEF,OAAK,gBAAgB,qBAAqB,aAAa;;;;;CAMzD,wBAA4C;AAI1C,SAAO,KAAK,gBAAgB,qBAAqB;;;;;;CAOnD,MAAM,sBAAqC;AACzC,MAAI,KAAK,cAAc;AACrB,SAAM,KAAK,aAAa;AACxB;;AAEF,MAAI;AAAE,SAAM,KAAK,gBAAgB,kBAAkB,oBAAoB,KAAK;UAAqB;;CAGnG,MAAM,kBAAkD;AAEtD,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK;AAC1B,UAAO,MAAM,OAAO;UACd;AACN,UAAO;IAAE,YAAY;IAAI,iBAAiB;;;AAI9C,SAAOW,8BAAgB,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyD9B,MAAM,cAAc,MAKM;AAExB,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B,KAAK;GACzD,MAAM,gBAAgB,KAAK,SAAS;GACpC,MAAM,MAAM,MAAM,OAAO,cAAc;IACrC,eAAe,KAAK;IACpB,YAAY,KAAK;IACjB,YAAY,KAAK;IACjB,SAAS;KACP,SAAS,KAAK,SAAS;KACvB,WAAW,KAAK,SAAS;KACzB,oBAAoB,KAAK,SAAS;KAClC;;;AAGJ,SAAM,KAAK,SAAS,YAAY,MAAM;AACtC,UAAO;WACAT,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,KAAK,SAAS,UAAU;AAC9B,SAAM,KAAK,SAAS,YAAY;AAChC,SAAM;;AAIV,SAAOS,gCAAc;GACnB,SAAS,KAAK;GACd,eAAeZ,+BAAY,KAAK;GAChC,YAAYA,+BAAY,KAAK;GAC7B,YAAY,KAAK;GACjB,SAAS,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDlB,MAAM,wBAAwB,EAC5B,eACA,cACA,UAAU,MAKgB;AAG1B,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B;GACpD,MAAM,gBAAgB,SAAS;GAC/B,MAAM,MAAM,MAAM,OAAO,wBAAwB;IAC/C;IACA,cAAc,aAAa,KAAI,OAAM;KAAE,YAAY,EAAE;KAAY,SAAS,EAAE;;IAC5E,SAAS;KACP,SAAS,SAAS;KAClB,eAAe,SAAS,iBAAiB;MAAE,MAAM;MAAc,WAAW,SAAS;;KACnF,oBAAoB,SAAS;KAC7B;;;GAIJ,MAAM,SAAS,OAAO,IAAI,KAAI,MAAK,GAAG,eAAe,OAAO,SAAS,KAAK;AAC1E,YAAS,UAAU;IAAE,MAAM;IAAG,OAAOa,kCAAY;IAAwB,QAAQC,mCAAa;IAAS,SAAS,0BAA0B;;AAC1I,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WACAZ,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;AAIV,SAAOY,0CAAwB;GAC7B,SAAS,KAAK;GACd,eAAef,+BAAY;GAC3B,mBAAmB;GACnB;KACC,MAAK,cAAa;GACnB,MAAM,QAAQ,UAAU,KAAI,aAAY,SAAS,eAAe,KAAK;AACrE,YAAS,UAAU;IACjB,MAAM;IACN,OAAOa,kCAAY;IACnB,QAAQC,mCAAa;IACrB,SAAS,0BAA0B;;AAErC,UAAO;;;;;;;CAQX,MAAM,uBAAuB,EAC3B,eACA,YACA,SACA,UAAU,MAMc;EACxB,MAAM,UAAU,MAAM,KAAK,wBAAwB;GACjD;GACA,cAAc,CACZ;IACE;IACA;;GAGJ;;AAEF,SAAO,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDjB,MAAM,4BAA4B,EAAE,eAAe,cAAc,WAI5B;AAEnC,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B;GACpD,MAAM,MAAM,aAAa,KAAK,OAAO;IAAE,YAAY,EAAE;IAAY,SAAS,EAAE;;GAC5E,MAAM,gBAAgB,SAAS;GAC/B,MAAM,SAAS,MAAM,OAAO,4BAA4B;IACtD;IAAe,cACf;IACA,SAAS;KACP,SAAS,SAAS;KAClB,oBAAoB,SAAS;KAC7B;;;GAGJ,MAAME,MAA+B,MAAM,QAAQ,UAAU,SAAS;AACtE,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WACAd,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;AAIV,SAAOc,8CAA4B;GACjC,SAAS,KAAK;GACd,eAAejB,+BAAY;GAC3B,mBAAmB;GACnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCJ,MAAM,gBAAgB,EAAE,mBAAmB,WAGjB;AAExB,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK;GAC1B,MAAM,MAAM,MAAM,OAAO,gBAAgB;IACvC;IACA,SAAS;KACP,SAAS,SAAS;KAClB,GAAI,WAAY,eAAe,UAC3B,EAAE,WAAW,QAAQ,cACrB;;;AAGR,SAAM,SAAS,YAAY,MAAM;AACjC,YAAS,UAAU;IAAE,MAAM;IAAG,OAAOa,kCAAY;IAAwB,QAAQC,mCAAa;IAAS,SAAS,eAAe,KAAK,cAAc;;AAClJ,UAAO;WACAZ,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;AAIV,SAAOe,kCAAgB;GAAE,SAAS,KAAK;GAAc;GAAmB;KACrE,MAAK,aAAY;AAChB,YAAS,UAAU;IAAE,MAAM;IAAG,OAAOL,kCAAY;IAAwB,QAAQC,mCAAa;IAAS,SAAS,eAAe,SAAS,cAAc;;AACtJ,UAAO;;;CAQb,MAAM,mBAAmB,EACvB,eACA,UACA,WAKoC;AAEpC,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B;GACpD,MAAM,SAAS,MAAM,OAAO,mBAAmB;IAC7C;IACA;IACA,SAAS;KACP,SAAS,SAAS;KAClB,oBAAoB,SAAS;KAC7B,eAAe,SAAS;;;AAG5B,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WACAZ,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;AAIV,SAAOgB,0CAAmB;GACxB,SAAS,KAAK;GACd,eAAenB,+BAAY;GAC3B;GACA;;;;;;;CAQJ,MAAM,6BAA6B,MAMF;EAC/B,MAAM,OAAO,KAAK,WAAW,QAAQ,QAAQ;EAC7C,MAAM,SAAS,KAAK,QAAQ,SAAS,uBAAuB,oBAAoB,QAAQ,QAAQ;EAChG,MAAM,WAAW,GAAG,OAAO;AAC3B,SAAOoB,2CAA6B;GAClC,KAAK;GACL,SAAS;IACP,MAAM,KAAK;IACX,gBAAgB,KAAK;;GAEvB,QAAQ,KAAK;GACb,SAAS,KAAK;;;;;;;CAQlB,MAAM,0BAA0B,MAMa;EAC3C,MAAM,EAAE,eAAe,UAAU,YAAY,QAAQ,YAAY;EAEjE,MAAMC,cAAsD,UACxD;GACE,SAAS,QAAQ;GACjB,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB,oBAAoB,QAAQ;GAC5B,eAAe,QAAQ;GAEvB,iBAAiB;MAEnB;EAEJ,IAAIC;AACJ,MAAI;AACF,gBAAa,MAAM,KAAK,mBAAmB;IACzC;IACA;IACA,SAAS;;WAEJ,OAAO;AACd,SAAM,SAAS,YAAY;AAC3B,SAAM;;EAGR,MAAMC,eAAsD,UACxD;GACE,SAAS,QAAQ;GACjB,SAAS,QAAQ;MAEnB;EAEJ,IAAIC;AACJ,MAAI;AACF,iBAAc,MAAM,KAAK,6BAA6B;IACpD;IACA,MAAM,WAAW;IACjB,gBAAgB,WAAW;IAC3B;IACA,SAAS;;WAEJ,OAAO;AACd,SAAM,SAAS,YAAY;AAC3B,SAAM;;EAGR,MAAMC,WAA4C;GAChD;GACA;;EAGF,MAAM,UAAU,YAAY,OAAO;AACnC,MAAI,QACF,OAAM,SAAS,YAAY,MAAM;MAEjC,OAAM,SAAS,YAAY;AAE7B,SAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCT,MAAM,kBAAkB,MAIa;AAEnC,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B,KAAK;GACzD,MAAM,gBAAgB,KAAK,SAAS;GACpC,MAAM,qBAAqB,KAAK,SAAS;GACzC,MAAM,SAAS,MAAM,OAAO,kBAAkB;IAC5C,eAAe,KAAK;IACpB,SAAS,KAAK,OAAO;IACrB,WAAW,KAAK,OAAO;IACvB,OAAO,KAAK,OAAO;IACnB,SAAS;KAAE,SAAS,KAAK,SAAS;KAAS;KAAe;;;AAE5D,SAAM,KAAK,SAAS,YAAY,MAAM;AAEtC,UAAO;WACAvB,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,KAAK,SAAS,UAAU;AAC9B,SAAM,KAAK,SAAS,YAAY;AAChC,SAAM;;EAIV,MAAM,MAAM,MAAMuB,qCAAkB;GAClC,SAAS,KAAK;GACd,eAAe1B,+BAAY,KAAK;GAChC,QAAQ,KAAK;GACb,SAAS,KAAK;;AAEhB,MAAI,KAAK,QACP,OAAM,KAAK,SAAS,YAAY,MAAM;MAEtC,OAAM,KAAK,SAAS,YAAY;AAElC,SAAO;;;;;;;;CAaT,MAAM,wBACJ,eACA,SACe;AACf,MAAI2B,4BAEF,OAAMC,kCAAkB;GACtB,WAAW;GACX,YAAY,KAAK,cAAc,mBAAmB,KAAK,KAAK;GAC5D,cAAc,KAAK,SAAS,cAAc;GAC1C,QAAQ;;OAEL;AAEL,OAAI,KAAK,cAAc,aAAa;AAClC,UAAM,KAAK,aAAa,wBAAwB,eAAe;AAC/D;;GAIF,MAAM,aAAa,KAAK,cAAc,mBAAmB,KAAK,KAAK;GACnE,MAAM,eAAe,KAAK,SAAS,cAAc;AACjD,OAAI,cAAc,cAAc;AAC9B,UAAMA,kCAAkB;KAAE,WAAW;KAAe;KAAY;KAAc,QAAQ;;AACtF;;AAGF,SAAM,KAAK,gBAAgB,wBAAwB5B,+BAAY,gBAAgB;;;;CASnF,MAAM,kBACJ,eACA,MACe;AACf,MAAI,KAAK,yBAAyB;GAChC,IAAI6B;AACJ,OAAI;AACF,aAAS,MAAM,KAAK;WACd;AACN,UAAM,IAAI,MAAM;;AAElB,UAAO,MAAM,OAAO,kBAAkB;IAAE;IAAe;;;AAEzD,QAAMC,uCAAuB,kBAAkB9B,+BAAY,gBAAgB;;;CAI7E,MAAM,wBACJ,eACA,MACsC;AACtC,MAAI,KAAK,yBAAyB;GAChC,IAAI6B;AACJ,OAAI;AACF,aAAS,MAAM,KAAK;WACd;AACN,UAAM,IAAI,MAAM;;AAElB,UAAO,MAAM,OAAO,wBAAwB;IAAE;IAAe;;;AAE/D,SAAO,MAAMC,uCAAuB,wBAAwB9B,+BAAY,gBAAgB;;;CAI1F,MAAM,kBACJ,eACA,MACwB;AACxB,MAAI,KAAK,yBAAyB;GAChC,IAAI6B;AACJ,OAAI;AACF,aAAS,MAAM,KAAK;WACd;AACN,UAAM,IAAI,MAAM;;AAElB,UAAO,MAAM,OAAO,kBAAkB;IAAE;IAAe;;;AAEzD,SAAO,MAAMC,uCAAuB,kBAAkB9B,+BAAY,gBAAgB;;;;;;;;;CAcpF,MAAM,kBAAkB,eAA2E;AACjG,MAAI,KAAK,yBAAyB;GAChC,IAAI6B;AACJ,OAAI;AACF,aAAS,MAAM,KAAK,0BAA0B;WACxC;AACN,UAAM,IAAI,MAAM;;AAElB,UAAO,MAAM,OAAO,kBAAkB;;EAExC,MAAM,YAAY7B,+BAAY;EAG9B,MAAM,YAAY,MAAM+B,oDAAmC,KAAK,YAAY;AAC5E,MAAI,CAAC,UAAU,OACb,QAAO;EAIT,IAAIC,QAA+B;AACnC,MAAI;AACF,WAAQ,MAAMC,uCAAuB;WAC9B,OAAO;AACd,WAAQ,KAAK,wDAAwD;;EAGvE,MAAM,iCAAiB,IAAI;AAC3B,OAAK,MAAM,OAAO,OAAO;AACvB,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,MAAO;AAClC,OAAI,CAAC,eAAe,IAAI,IAAI,SAC1B,gBAAe,IAAI,IAAI,SAAS,IAAI;;AAIxC,SAAO,UAAU,KAAI,cAAa;GAChC,MAAM,UAAUC,2BAAW;GAC3B,MAAM,QAAQ,eAAe,IAAI,YAAY;AAC7C,UAAO;IAAE;IAAS;;;;;;;;;;;CAWtB,MAAM,kBACJ,eACA,gBACA,SACuB;AACvB,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B;GACpD,MAAM,MAAM,MAAM,OAAO,kBAAkB;IAAE;IAAe;IAAgB;;AAC5E,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WACAhC,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;EAGV,MAAM,YAAYH,+BAAY;EAG9B,MAAM,EAAE,QAAQ,wBAAwB,MAAMmC,sCAAsB,WAAW;EAE/E,MAAMC,UAAwB,MAAMC,+CAClC,KAAK,YACL,WACA,qBACA,KAAK,QAAQ;AAIf,SAAO,KAAK,cAAc;GACxB;GACA,YAAY;GACZ,YAAY;GACZ;;;;;;CAWJ,MAAM,mBAAmB,MAGG;EAE1B,MAAM,iBAAiB,MAAM,aAAa;EAC1C,MAAM,UAAU,MAAM;AACtB,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK;GAC1B,MAAM,MAAM,MAAM,OAAO,mBAAmB;IAC1C,WAAW;IACX,SAAS,SAAS;;AAEpB,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WACAnC,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;AAKV,MAAI;GACF,MAAM,OAAO,IAAImC,2CAAoB,KAAK,cAAc;GAExD,MAAM,aAAa,MAAM,KAAK,SAAS,kBAAkB;AACzD,OAAI,CAAC,MAAM,QAAQ,eAAe,WAAW,WAAW,GAAG;IACzD,MAAM,sBAAM,IAAI,MAAM;AACtB,UAAM,SAAS,UAAU;AACzB,UAAM,SAAS,YAAY;AAC3B,WAAO;KAAE,SAAS;KAAO,WAAW,kBAAkB;KAAI,WAAW;KAAI,SAAS,IAAI;KAAS,OAAO,IAAI;;;GAI5G,MAAM,WAAW,WAAW;GAG5B,MAAM,SAAS,MAAM,KAAK,QAAQ;IAChC,cAAc,SAAS;IACvB,WAAW,SAAS;;AAGtB,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WAEApC,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;;CAQV,AAAQ,qBAAqB,SAAoC;EAC/D,MAAM,EAAE;AACR,MAAI,CAAC,KAAK,wBACR,MAAK,0BAA0B,IAAI,kBAAkB,KAAK,cAAc;WAC/D,QACT,MAAK,wBAAwB,WAAW;AAE1C,SAAO,KAAK;;CAGd,MAAM,mBAAmB,MAIiC;EACxD,MAAM,EAAE,WAAW,eAAe,YAAY;AAC9C,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK;GAC1B,MAAM,0BACJ,OAAO,kBAAkB,YAAY,cAAc,OAAO,SAAS,IAC/D,cAAc,SACd;GACN,MAAM,gBAAgB,SAAS;GAC/B,MAAM,qBAAqB,SAAS;GACpC,MAAM,cAAc;IAClB,GAAI,gBAAgB,EAAE,kBAAkB;IACxC,GAAI,qBAAqB,EAAE,uBAAuB;;GAEpD,MAAM,MAAM,MAAM,OAAO,mBAAmB;IAC1C;IACA,eAAe;IACf,SAAS,SAAS;IAClB,SAAS,OAAO,KAAK,aAAa,SAAS,IAAI,cAAc;;AAE/D,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WACAD,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;EAGV,MAAM,OAAO,KAAK,qBAAqB;AACvC,SAAO,MAAM,KAAK,MAAM;GAAE;GAAW;;;CAGvC,MAAM,sBAAsB,MAIV;EAChB,MAAM,EAAE,WAAW,eAAe,YAAY;AAC9C,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK;AAC1B,SAAM,OAAO,sBAAsB;IACjC;IACA;IACA,SAAS,SAAS;;AAEpB,SAAM,SAAS,YAAY,MAAM;AACjC;WACOD,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;EAGV,MAAM,OAAO,KAAK,qBAAqB;AACvC,QAAM,KAAK,SAAS;GAAE;GAAW;;;;;;;CAOnC,MAAM,oBAAoB,MAAsE;EAC9F,MAAM,EAAE,WAAW,kBAAkB,QAAQ;AAE7C,MAAI,KAAK,yBAAyB;AAChC,OAAI;IACF,MAAM,SAAS,MAAM,KAAK;AAC1B,UAAM,OAAO,kBAAkB;KAAE;KAAW;;WACtC;AACR;;AAGF,MAAI;AACF,SAAM,KAAK,yBAAyB,eAAe;IAAE;IAAW;;UAC1D;AACR,OAAK,0BAA0B;;;;;;;CAYjC,MAAM,wBAAwB,MAA4E;AAExG,MAAI,KAAK,yBAAyB;GAChC,MAAM,SAAS,MAAM,KAAK;GAC1B,MAAM,UAAU,MAAM;AACtB,UAAO,MAAM,OAAO,wBAAwB;IAC1C,IAAI,MAAM;IACV,UAAU,MAAM;IAChB;;;AAIJ,OAAK,sBAAsB;EAC3B,MAAM,OAAO,IAAIoC,oCAAe,KAAK,cAAc;GACjD,UAAU,MAAM;GAChB,SAAS,MAAM;;AAEjB,OAAK,uBAAuB;EAC5B,MAAM,EAAE,QAAQ,kBAAkB,MAAM,KAAK;AAC7C,SAAO;GAAE;GAAQ;;;;;;CAMnB,MAAM,yBAAwC;AAC5C,MAAI,KAAK,yBAAyB;AAChC,OAAI;IACF,MAAM,SAAS,MAAM,KAAK;AAC1B,UAAM,OAAO;WACP;AACR;;AAEF,MAAI,KAAK,cAAc;AACrB,SAAM,KAAK,aAAa;AACxB;;AAEF,OAAK,sBAAsB;AAC3B,OAAK,uBAAuB;;;;;;;;;;;CAY9B,MAAM,4BACJ,QACA,SAC2B;AAE3B,MAAI,KAAK,yBAAyB;GAChC,MAAM,SAAS,MAAM,KAAK;GAC1B,MAAM,MAAM,MAAM,OAAO,4BAA4B;IACnD;IACA,eAAe,QAAQ;IACvB,SAAS;KACP,SAAS,QAAQ;KACjB,oBAAoB,QAAQ;KAC5B,eAAe,QAAQ;;;AAG3B,UAAO;;AAET,SAAOC,+CAA4B,KAAK,cAAc,QAAQ;;;;;CAMhE,MAAM,gBACJ,WACA,mBACA,SACuB;EAEvB,MAAM,WAAW,KAAK,eAClB,MAAM,KAAK,aAAa,kBAAkB,aAC1C,MAAM,KAAK,WAAW,kBAAkBxC,+BAAY;AACxD,MAAI,SAAS,KAAK,UAAU,EAC1B,OAAM,IAAI,MAAM;EAIlB,MAAM,cAAc,SAAS,KAAK,MAAM,MAA8B,EAAE,eAAe;AACvF,MAAI,CAAC,YACH,OAAM,IAAI,MAAM,cAAc,kBAAkB,wBAAwB;AAI1E,SAAO,KAAK,cAAc;GACxB,eAAe;GACf,YAAY;GACZ,YAAY;IACV,MAAMyC,2BAAW;IACjB,WAAW;;GAEJ"}
1	+ {"version":3,"file":"index.js","names":["buildConfigsFromEnv","__isWalletIframeHostMode","MinimalNearClient","WebAuthnManager","toAccountId","tasks: Promise<unknown>[]","error: unknown","toError","registerPasskey","DEFAULT_AUTHENTICATOR_OPTIONS","registerPasskeyInternal","res","loginAndCreateSession","logoutAndClearSession","getLoginSession","getRecentLogins","executeAction","routerOptions: SignAndSendTransactionHooksOptions","ActionPhase","ActionStatus","signAndSendTransactions","arr: SignTransactionResult[]","signTransactionsWithActions","sendTransaction","signOptions: DelegateActionHooksOptions \| undefined","signResult: SignDelegateActionResult","relayOptions: DelegateRelayHooksOptions \| undefined","relayResult: DelegateRelayResult","combined: SignAndSendDelegateActionResult","isOffline","openOfflineExport","router: WalletIframeRouter","chainsigAddressManager","local: RecoveryEmailRecord[]","actions: ActionArgs[]","SyncAccountFlow","ActionType"],"sources":["../../../../src/core/TatchiPasskey/index.ts"],"sourcesContent":["import { WebAuthnManager } from '../WebAuthnManager';\nimport {\n loginAndCreateSession,\n getLoginSession,\n getRecentLogins,\n logoutAndClearSession,\n} from './login';\nimport {\n executeAction,\n signTransactionsWithActions,\n sendTransaction,\n signAndSendTransactions,\n} from './actions';\nimport type { SyncAccountResult } from './syncAccount';\nimport { registerPasskey } from './registration';\nimport { registerPasskeyInternal } from './registration';\nimport {\n MinimalNearClient,\n type NearClient,\n type SignedTransaction,\n type AccessKeyList,\n} from '../NearClient';\nimport type {\n ActionResult,\n DelegateRelayResult,\n GetRecentLoginsResult,\n LoginAndCreateSessionResult,\n LoginResult,\n LoginSession,\n LoginState,\n RegistrationResult,\n SignAndSendDelegateActionResult,\n SignDelegateActionResult,\n SignTransactionResult,\n TatchiConfigs,\n TatchiConfigsInput,\n} from '../types/tatchi';\nimport type {\n SyncAccountHooksOptions,\n ActionHooksOptions,\n DelegateActionHooksOptions,\n DelegateRelayHooksOptions,\n LoginHooksOptions,\n RegistrationHooksOptions,\n SendTransactionHooksOptions,\n SignAndSendDelegateActionHooksOptions,\n SignAndSendTransactionHooksOptions,\n SignNEP413HooksOptions,\n SignTransactionHooksOptions,\n} from '../types/sdkSentEvents';\nimport { ActionPhase, ActionStatus } from '../types/sdkSentEvents';\nimport { ConfirmationConfig, type SignerMode, type WasmSignedDelegate } from '../types/signer-worker';\nimport { DEFAULT_AUTHENTICATOR_OPTIONS } from '../types/authenticatorOptions';\nimport { toAccountId, type AccountId } from '../types/accountIds';\nimport type { DerivedAddressRecord, RecoveryEmailRecord } from '../IndexedDBManager';\nimport { configureIndexedDB } from '../IndexedDBManager';\nimport { chainsigAddressManager } from '../ChainsigAddressManager';\nimport { ActionType, type ActionArgs, type TransactionInput } from '../types/actions';\nimport type {\n DeviceLinkingQRData,\n LinkDeviceResult,\n ScanAndLinkDeviceOptionsDevice1,\n StartDevice2LinkingFlowArgs,\n StartDevice2LinkingFlowResults\n} from '../types/linkDevice';\nimport type {\n SignNEP413MessageParams,\n SignNEP413MessageResult\n} from './signNEP413';\nimport { SignedDelegate } from '../types/delegate';\nimport type { UserPreferencesManager } from '../WebAuthnManager/userPreferences';\nimport type { WalletIframeRouter } from '../WalletIframe/client/router';\nimport { __isWalletIframeHostMode } from '../WalletIframe/host-mode';\nimport { toError } from '../../utils/errors';\nimport { isOffline, openOfflineExport } from '../OfflineExport';\nimport type { DelegateActionInput } from '../types/delegate';\nimport { buildConfigsFromEnv } from '../defaultConfigs';\nimport type { EmailRecoveryFlowOptions } from '../types/emailRecovery';\n\n///////////////////////////////////////\n// PASSKEY MANAGER\n///////////////////////////////////////\n\nexport interface PasskeyManagerContext {\n webAuthnManager: WebAuthnManager;\n nearClient: NearClient;\n configs: TatchiConfigs;\n}\n\nlet warnedAboutSameOriginWallet = false;\n\n/*\n Main TatchiPasskey class that provides framework-agnostic passkey operations\n * with flexible event-based callbacks for custom UX implementation\n /\nexport class TatchiPasskey {\n private readonly webAuthnManager: WebAuthnManager;\n private readonly nearClient: NearClient;\n readonly configs: TatchiConfigs;\n private iframeRouter: WalletIframeRouter \| null = null;\n // Deduplicate concurrent initWalletIframe() calls to avoid mounting multiple iframes.\n private walletIframeInitInFlight: Promise<void> \| null = null;\n\t// Wallet-iframe mode: mirror wallet-host preferences into app-origin in-memory cache.\n\tprivate walletIframePrefsUnsubscribe: (() => void) \| null = null;\n\t// Internal active Device2 flow when running locally (not exposed)\n\tprivate activeDeviceLinkFlow: import('./linkDevice').LinkDeviceFlow \| null = null;\n\tprivate activeEmailRecoveryFlow: import('./emailRecovery').EmailRecoveryFlow \| null = null;\n\n constructor(\n configs: TatchiConfigsInput,\n nearClient?: NearClient\n ) {\n this.configs = buildConfigsFromEnv(configs);\n // Configure IndexedDB naming before any local persistence is touched.\n // - Wallet iframe host keeps canonical DB names.\n // - App origin disables IndexedDB entirely when iframe mode is enabled.\n const mode = __isWalletIframeHostMode()\n ? 'wallet'\n : (this.configs.iframeWallet?.walletOrigin ? 'disabled' : 'legacy');\n configureIndexedDB({ mode });\n // Use provided client or create default one\n this.nearClient = nearClient \|\| new MinimalNearClient(this.configs.nearRpcUrl);\n this.webAuthnManager = new WebAuthnManager(this.configs, this.nearClient);\n // Wallet-iframe mode: delegate signerMode persistence to the wallet host.\n // Non-iframe mode: ensure any previous writer is cleared (UserPreferences is a singleton).\n this.userPreferences.configureWalletIframeSignerModeWriter(\n this.shouldUseWalletIframe()\n ? async (next) => {\n const router = await this.requireWalletIframeRouter();\n await router.setSignerMode(next);\n }\n : null\n );\n // VRF worker initializes automatically in the constructor\n }\n\n /\n Direct access to user preferences manager for convenience\n * Example: tatchi.userPreferences.onThemeChange(cb)\n /\n get userPreferences(): UserPreferencesManager {\n return this.webAuthnManager.getUserPreferences();\n }\n\n /\n Initialize the hidden wallet service iframe client (optional) and warm critical resources.\n * Always warms local resources; initializes iframe when `walletOrigin` is provided.\n * Idempotent and safe to call multiple times.\n /\n async initWalletIframe(nearAccountId?: string): Promise<void> {\n const walletOriginConfigured = !!this.configs.iframeWallet?.walletOrigin;\n // Warm local critical resources (NonceManager, workers) regardless of iframe usage.\n // In iframe mode, avoid persisting user state (lastUserAccountId, preferences) on the app origin.\n const shouldAvoidLocalUserState = walletOriginConfigured && !__isWalletIframeHostMode();\n await this.webAuthnManager.warmCriticalResources(shouldAvoidLocalUserState ? undefined : nearAccountId);\n\n // Guardrail: when running inside the wallet service iframe host, never attempt to\n // initialize a nested wallet iframe client, even if configs accidentally include iframeWallet.\n // The host runs the real TatchiPasskey instance and must remain self-contained.\n if (__isWalletIframeHostMode()) {\n return;\n }\n\n const walletIframeConfig = this.configs.iframeWallet;\n const walletOrigin = walletIframeConfig?.walletOrigin;\n // If no wallet origin configured, we're done after local warm-up\n if (!walletOrigin) {\n // Reflect local login state so callers depending on init() get fresh status\n await this.getLoginSession(nearAccountId);\n return;\n }\n\n // Emit same-origin co-hosting warning only when actually initializing the iframe\n if (!warnedAboutSameOriginWallet) {\n try {\n const isWalletIframeHost = __isWalletIframeHostMode();\n const parsed = new URL(walletOrigin);\n if (typeof window !== 'undefined' && parsed.origin === window.location.origin && !isWalletIframeHost) {\n warnedAboutSameOriginWallet = true;\n console.warn('[TatchiPasskey] iframeWallet.walletOrigin matches the host origin. Consider moving the wallet to a dedicated origin for stronger isolation.');\n }\n } catch {\n // ignore invalid URL here; constructor downstream will surface an error\n }\n }\n\n // Initialize iframe router once (and prevent concurrent calls from mounting multiple iframes).\n if (!this.iframeRouter) {\n if (!this.walletIframeInitInFlight) {\n this.walletIframeInitInFlight = (async () => {\n const { WalletIframeRouter } = await import('../WalletIframe/client/router');\n this.iframeRouter = new WalletIframeRouter({\n walletOrigin,\n servicePath: walletIframeConfig?.walletServicePath \|\| '/wallet-service',\n connectTimeoutMs: 20_000, // 20s\n requestTimeoutMs: 60_000, // 60s\n theme: this.configs.walletTheme,\n signerMode: this.configs.signerMode,\n nearRpcUrl: this.configs.nearRpcUrl,\n nearNetwork: this.configs.nearNetwork,\n contractId: this.configs.contractId,\n nearExplorerUrl: this.configs.nearExplorerUrl,\n // Ensure relay server config reaches the wallet host for atomic registration\n relayer: this.configs.relayer,\n vrfWorkerConfigs: this.configs.vrfWorkerConfigs,\n emailRecoveryContracts: this.configs.emailRecoveryContracts,\n rpIdOverride: walletIframeConfig?.rpIdOverride,\n // Allow apps/CI to control where embedded bundles are served from\n sdkBasePath: walletIframeConfig?.sdkBasePath,\n });\n\n await this.iframeRouter.init();\n // Opportunistically warm remote NonceManager\n try { await this.iframeRouter.prefetchBlockheight(); } catch { }\n })();\n }\n\n try {\n await this.walletIframeInitInFlight;\n } finally {\n this.walletIframeInitInFlight = null;\n }\n } else {\n await this.iframeRouter.init();\n // Opportunistically warm remote NonceManager\n try { await this.iframeRouter.prefetchBlockheight(); } catch { }\n }\n\n // Wallet-iframe mode: keep app-origin UI prefs in sync with the wallet host.\n if (this.iframeRouter) {\n this.ensureWalletIframePreferencesMirror(this.iframeRouter);\n // Best-effort pull snapshot to cover missed events / older hosts.\n const cfg = await this.iframeRouter.getConfirmationConfig().catch(() => null);\n if (cfg) {\n this.userPreferences.applyWalletHostConfirmationConfig({\n nearAccountId: nearAccountId ? toAccountId(nearAccountId) : null,\n confirmationConfig: cfg,\n });\n }\n const signerMode = await this.iframeRouter.getSignerMode?.({ timeoutMs: 1000 }).catch(() => null);\n if (signerMode) {\n this.userPreferences.applyWalletHostSignerMode?.({\n nearAccountId: nearAccountId ? toAccountId(nearAccountId) : null,\n signerMode,\n });\n }\n }\n\n await this.getLoginSession(nearAccountId);\n }\n\n /* Get the wallet iframe client if initialized. /\n getWalletIframeClient(): WalletIframeRouter \| null {\n return this.iframeRouter;\n }\n\n private ensureWalletIframePreferencesMirror(router: WalletIframeRouter): void {\n if (this.walletIframePrefsUnsubscribe) return;\n const unsubscribe = router.onPreferencesChanged?.(payload => {\n const id = payload?.nearAccountId;\n const nearAccountId = id ? toAccountId(id) : null;\n this.userPreferences.applyWalletHostConfirmationConfig({\n nearAccountId,\n confirmationConfig: payload?.confirmationConfig,\n });\n if (payload?.signerMode) {\n this.userPreferences.applyWalletHostSignerMode?.({\n nearAccountId,\n signerMode: payload.signerMode,\n });\n }\n });\n this.walletIframePrefsUnsubscribe = unsubscribe ?? null;\n }\n\n /\n True when the SDK is running on the app origin with a wallet iframe configured.\n * In this mode, sensitive persistence must live in the wallet-iframe origin.\n /\n private shouldUseWalletIframe(): boolean {\n return !!this.configs.iframeWallet?.walletOrigin && !__isWalletIframeHostMode();\n }\n\n private async requireWalletIframeRouter(nearAccountId?: string): Promise<WalletIframeRouter> {\n if (!this.shouldUseWalletIframe()) {\n throw new Error('[TatchiPasskey] Wallet iframe is not configured.');\n }\n if (!this.iframeRouter) {\n await this.initWalletIframe(nearAccountId);\n }\n if (!this.iframeRouter) {\n throw new Error('[TatchiPasskey] Wallet iframe is configured but unavailable.');\n }\n return this.iframeRouter;\n }\n\n getContext(): PasskeyManagerContext {\n return {\n webAuthnManager: this.webAuthnManager,\n nearClient: this.nearClient,\n configs: this.configs\n }\n }\n\n getNearClient(): NearClient {\n return this.nearClient;\n }\n\n /\n Warm critical resources: delegates to WebAuthnManager and ensures iframe handshake when configured.\n /\n async warmCriticalResources(nearAccountId?: string): Promise<void> {\n // Maintain backward compatibility: delegate to consolidated init\n await this.initWalletIframe(nearAccountId);\n }\n\n /\n Pre-warm resources on a best-effort basis without changing visible state.\n * - When iframe=true, initializes the wallet iframe client (and warms local resources).\n * - When workers=true, warms local critical resources (nonce, IndexedDB, workers) without touching iframe.\n * - When both are false/omitted, does nothing.\n /\n async prewarm(opts?: { iframe?: boolean; workers?: boolean; nearAccountId?: string }): Promise<void> {\n const iframe = !!opts?.iframe;\n const workers = !!opts?.workers;\n const nearAccountId = opts?.nearAccountId;\n\n const tasks: Promise<unknown>[] = [];\n\n if (iframe) {\n // initWalletIframe also calls WebAuthnManager.warmCriticalResources internally\n tasks.push(this.initWalletIframe(nearAccountId));\n } else if (workers) {\n // Warm local-only resources without touching the iframe.\n // In iframe mode, avoid persisting user state (lastUserAccountId, preferences) on the app origin.\n const shouldAvoidLocalUserState = !!this.configs.iframeWallet?.walletOrigin && !__isWalletIframeHostMode();\n tasks.push(this.webAuthnManager.warmCriticalResources(shouldAvoidLocalUserState ? undefined : nearAccountId));\n }\n\n if (tasks.length === 0) return;\n try {\n await Promise.all(tasks);\n } catch {\n // Best-effort: swallow errors so prewarm never breaks app flows\n }\n }\n\n /\n View all access keys for a given account\n * @param accountId - NEAR account ID to view access keys for\n * @returns Promise resolving to access key list\n /\n async viewAccessKeyList(accountId: string): Promise<AccessKeyList> {\n if (this.iframeRouter) {\n return await this.iframeRouter.viewAccessKeyList(accountId);\n }\n return this.nearClient.viewAccessKeyList(accountId);\n }\n\n ///////////////////////////////////////\n // === Registration and Login ===\n ///////////////////////////////////////\n\n /\n Register a new passkey for the given NEAR account ID\n * Uses AccountId for on-chain operations and PRF salt derivation\n /\n async registerPasskey(\n nearAccountId: string,\n options: RegistrationHooksOptions = {}\n ): Promise<RegistrationResult> {\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n const confirmationConfig = options?.confirmationConfig;\n const res = await router.registerPasskey({\n nearAccountId,\n confirmationConfig,\n options: {\n onEvent: options?.onEvent,\n ...(options?.signerMode ? { signerMode: options.signerMode } : {}),\n ...(options?.confirmerText ? { confirmerText: options.confirmerText } : {})\n }\n });\n // Opportunistically warm resources (non-blocking)\n void (async () => { try { await this.warmCriticalResources(nearAccountId); } catch { } })();\n await options?.afterCall?.(true, res);\n return res;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n return registerPasskey(\n this.getContext(),\n toAccountId(nearAccountId),\n options,\n this.configs.authenticatorOptions \|\| DEFAULT_AUTHENTICATOR_OPTIONS,\n );\n }\n\n /\n Internal variant that accepts a one-time confirmationConfig override.\n * Used by wallet-iframe host to force modal/autoProceed behavior for ArrowButtonLit.\n /\n async registerPasskeyInternal(\n nearAccountId: string,\n options: RegistrationHooksOptions = {},\n confirmationConfigOverride?: ConfirmationConfig\n ): Promise<RegistrationResult> {\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n const confirmationConfig = confirmationConfigOverride ?? options?.confirmationConfig;\n const res = await router.registerPasskey({\n nearAccountId,\n confirmationConfig,\n options: {\n onEvent: options?.onEvent,\n ...(options?.signerMode ? { signerMode: options.signerMode } : {}),\n ...(options?.confirmerText ? { confirmerText: options.confirmerText } : {})\n }\n });\n void (async () => { try { await this.warmCriticalResources(nearAccountId); } catch { } })();\n await options?.afterCall?.(true, res);\n return res;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n // App-wallet path: call core internal with override\n return registerPasskeyInternal(\n this.getContext(),\n toAccountId(nearAccountId),\n options,\n this.configs.authenticatorOptions \|\| DEFAULT_AUTHENTICATOR_OPTIONS,\n confirmationConfigOverride,\n );\n }\n\n /\n Post-registration threshold enrollment.\n * Runs `/threshold-ed25519/keygen` authorization and stores `threshold_ed25519_2p_v1`\n * key material locally. Intended to be called after the passkey is registered on-chain.\n /\n async enrollThresholdEd25519Key(\n nearAccountId: string,\n options?: {\n deviceNumber?: number;\n relayerUrl?: string;\n }\n ): Promise<{\n success: boolean;\n publicKey: string;\n relayerKeyId: string;\n wrapKeySalt: string;\n error?: string;\n }> {\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n return await router.enrollThresholdEd25519Key({\n nearAccountId,\n options: options \|\| {},\n });\n }\n\n return await this.webAuthnManager.enrollThresholdEd25519KeyPostRegistration({\n nearAccountId: toAccountId(nearAccountId),\n deviceNumber: options?.deviceNumber,\n });\n }\n\n /\n Threshold key rotation helper:\n * keygen → AddKey(new) → DeleteKey(old).\n /\n async rotateThresholdEd25519Key(\n nearAccountId: string,\n options?: {\n deviceNumber?: number;\n }\n ): Promise<{\n success: boolean;\n oldPublicKey: string;\n oldRelayerKeyId: string;\n publicKey: string;\n relayerKeyId: string;\n wrapKeySalt: string;\n deleteOldKeyAttempted: boolean;\n deleteOldKeySuccess: boolean;\n warning?: string;\n error?: string;\n }> {\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n return await router.rotateThresholdEd25519Key({\n nearAccountId,\n options: options \|\| {},\n });\n }\n\n return await this.webAuthnManager.rotateThresholdEd25519KeyPostRegistration({\n nearAccountId: toAccountId(nearAccountId),\n deviceNumber: options?.deviceNumber,\n });\n }\n\n /\n Login and ensure a warm signing session exists.\n * - Unlocks VRF keypair (Shamir auto-unlock when possible; else WebAuthn prompt)\n * - Mints a warm signing session (policy from configs, override via options.signingSession)\n * - Optional: mints a server session (JWT/cookie) via options.session\n /\n async loginAndCreateSession(\n nearAccountId: string,\n options?: LoginHooksOptions\n ): Promise<LoginAndCreateSessionResult> {\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n // Forward serializable options to wallet host, including session config\n const res = await router.loginAndCreateSession({\n nearAccountId,\n options: {\n onEvent: options?.onEvent,\n deviceNumber: options?.deviceNumber,\n // Pass through session so the wallet host calls relay to mint JWT/cookie sessions\n session: options?.session,\n signingSession: options?.signingSession,\n }\n });\n // Best-effort warm-up after successful login (non-blocking)\n void (async () => { try { await this.warmCriticalResources(nearAccountId); } catch { } })();\n await options?.afterCall?.(true, res);\n return res;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n // Initialize current user before login\n await this.webAuthnManager.initializeCurrentUser(toAccountId(nearAccountId), this.nearClient);\n const res = await loginAndCreateSession(this.getContext(), toAccountId(nearAccountId), options);\n // Best-effort warm-up after successful login (non-blocking)\n try { void this.warmCriticalResources(nearAccountId); } catch { }\n return res;\n }\n\n /\n Logout: clears VRF keypair and all in-worker session state.\n /\n async logoutAndClearSession(): Promise<void> {\n await logoutAndClearSession(this.getContext());\n // Also clear wallet-origin VRF session if service iframe is active\n if (this.iframeRouter) {\n try { await this.iframeRouter.clearVrfSession?.(); } catch { }\n }\n }\n\n /\n Read login state + warm signing session status (no prompts).\n /\n async getLoginSession(nearAccountId?: string): Promise<LoginSession> {\n if (this.shouldUseWalletIframe()) {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n const session = await router.getLoginSession(nearAccountId);\n try { await router.prefetchBlockheight(); } catch { }\n return session;\n }\n return await getLoginSession(this.getContext(), nearAccountId ? toAccountId(nearAccountId) : undefined);\n }\n\n /\n Get check if accountId has a passkey from IndexedDB\n /\n async hasPasskeyCredential(nearAccountId: AccountId): Promise<boolean> {\n if (this.shouldUseWalletIframe()) {\n const router = await this.requireWalletIframeRouter();\n return await router.hasPasskeyCredential(nearAccountId);\n }\n const baseAccountId = toAccountId(nearAccountId);\n return await this.webAuthnManager.hasPasskeyCredential(baseAccountId);\n }\n\n ///////////////////////////////////////\n // === User Settings ===\n ///////////////////////////////////////\n\n /\n Set confirmation behavior setting for the current user\n /\n setConfirmBehavior(behavior: 'requireClick' \| 'autoProceed'): void {\n if (this.shouldUseWalletIframe()) {\n // Fire and forget; persistence handled in wallet host. Avoid unhandled rejections.\n void (async () => {\n try {\n const router = await this.requireWalletIframeRouter();\n await router.setConfirmBehavior(behavior);\n } catch { }\n })();\n return;\n }\n this.webAuthnManager.getUserPreferences().setConfirmBehavior(behavior);\n }\n\n /\n Set the unified confirmation configuration\n /\n setConfirmationConfig(config: ConfirmationConfig): void {\n if (this.shouldUseWalletIframe()) {\n // Fire and forget; avoid unhandled rejections in consumers\n void (async () => {\n try {\n const router = await this.requireWalletIframeRouter();\n await router.setConfirmationConfig(config);\n } catch { }\n })();\n return;\n }\n this.webAuthnManager.getUserPreferences().setConfirmationConfig(config);\n }\n\n setUserTheme(theme: 'dark' \| 'light'): void {\n if (this.shouldUseWalletIframe()) {\n void (async () => {\n try {\n const router = await this.requireWalletIframeRouter();\n await router.setTheme(theme);\n } catch { }\n })();\n return;\n }\n this.webAuthnManager.getUserPreferences().setUserTheme(theme);\n }\n\n setSignerMode(signerMode: SignerMode \| SignerMode['mode']): void {\n this.webAuthnManager.getUserPreferences().setSignerMode(signerMode);\n }\n\n /\n Get the current confirmation configuration\n /\n getConfirmationConfig(): ConfirmationConfig {\n // Prefer wallet host value when available\n // Note: synchronous signature; returns last-known local value if iframe reply is async\n // Callers needing fresh remote value should use TatchiPasskeyIframe directly.\n return this.webAuthnManager.getUserPreferences().getConfirmationConfig();\n }\n\n getSignerMode(): SignerMode {\n return this.webAuthnManager.getUserPreferences().getSignerMode();\n }\n\n /\n Prefetch latest block height/hash (and nonce if context missing) to reduce\n * perceived latency when the user initiates a signing flow.\n /\n async prefetchBlockheight(): Promise<void> {\n if (this.iframeRouter) {\n await this.iframeRouter.prefetchBlockheight();\n return;\n }\n try { await this.webAuthnManager.getNonceManager().prefetchBlockheight(this.nearClient); } catch { }\n }\n\n async getRecentLogins(): Promise<GetRecentLoginsResult> {\n // In iframe mode, do not fall back to app-origin IndexedDB.\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter();\n return await router.getRecentLogins();\n } catch {\n return { accountIds: [], lastUsedAccount: null };\n }\n }\n\n return getRecentLogins(this.getContext());\n }\n\n ///////////////////////////////////////\n // === Transactions ===\n ///////////////////////////////////////\n\n /\n Execute a NEAR blockchain action using passkey-derived credentials\n * Supports all NEAR action types: Transfer, FunctionCall, AddKey, etc.\n \n @param nearAccountId - NEAR account ID to execute action with\n * @param actionArgs - Action to execute (single action or array for batched transactions)\n * @param options - Action options for event handling\n * - onEvent: EventCallback<ActionSSEEvent> - Optional event callback\n * - onError: (error: Error) => void - Optional error callback\n * - afterCall: AfterCall - Optional after call hooks\n * - waitUntil: TxExecutionStatus - Optional waitUntil status\n * @returns Promise resolving to action result\n \n @example\n * ```typescript\n * // Basic transfer\n * const result = await tatchi.executeAction('alice.near', {\n * type: ActionType.Transfer,\n * receiverId: 'bob.near',\n * amount: '1000000000000000000000000' // 1 NEAR\n * });\n \n // Function call with gas and deposit (already available in ActionArgs)\n * const result = await tatchi.executeAction('alice.near', {\n * type: ActionType.FunctionCall,\n * receiverId: 'contract.near',\n * methodName: 'set_value',\n * args: { value: 42 },\n * gas: '50000000000000', // 50 TGas\n * deposit: '100000000000000000000000' // 0.1 NEAR\n * });\n \n // Batched transaction\n * const result = await tatchi.executeAction('alice.near', [\n * {\n * type: ActionType.Transfer,\n * receiverId: 'bob.near',\n * amount: '1000000000000000000000000'\n * },\n * {\n * type: ActionType.FunctionCall,\n * receiverId: 'contract.near',\n * methodName: 'log_transfer',\n * args: { recipient: 'bob.near' }\n * }\n * ], {\n * onEvent: (event) => console.log('Action progress:', event)\n * });\n * ```\n /\n async executeAction(args: {\n nearAccountId: string,\n receiverId: string,\n actionArgs: ActionArgs \| ActionArgs[],\n options: ActionHooksOptions\n }): Promise<ActionResult> {\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(args.nearAccountId);\n const res = await router.executeAction({\n nearAccountId: args.nearAccountId,\n receiverId: args.receiverId,\n actionArgs: args.actionArgs,\n options: args.options\n });\n await args.options?.afterCall?.(true, res);\n return res;\n } catch (error: unknown) {\n const e = toError(error);\n await args.options?.onError?.(e);\n await args.options?.afterCall?.(false);\n throw e;\n }\n }\n // same-origin mode\n return executeAction({\n context: this.getContext(),\n nearAccountId: toAccountId(args.nearAccountId),\n receiverId: toAccountId(args.receiverId),\n actionArgs: args.actionArgs,\n options: args.options\n });\n }\n\n /\n Sign and send multiple transactions with actions\n * This method signs transactions with actions and sends them to the network\n \n @param nearAccountId - NEAR account ID to sign and send transactions with\n * @param transactionInputs - Transaction inputs to sign and send\n * @param options - Sign and send transaction options\n * - onEvent: EventCallback<ActionSSEEvent> - Optional event callback\n * - onError: (error: Error) => void - Optional error callback\n * - afterCall: AfterCall - Optional after call hooks\n * - waitUntil: TxExecutionStatus - Optional waitUntil status\n * - executeSequentially: boolean - Wait for each transaction to finish before sending the next (default: true)\n * @returns Promise resolving to action results\n \n @example\n * ```typescript\n * // Sign and send multiple transactions in a batch\n * const results = await tatchi.signAndSendTransactions('alice.near', {\n * transactions: [\n * {\n * receiverId: 'bob.near',\n * actions: [{\n * action_type: ActionType.Transfer,\n * deposit: '1000000000000000000000000'\n * }],\n * },\n * {\n * receiverId: 'contract.near',\n * actions: [{\n * action_type: ActionType.FunctionCall,\n * method_name: 'log_transfer',\n * args: JSON.stringify({ recipient: 'bob.near' }),\n * gas: '30000000000000',\n * deposit: '0'\n * }],\n * }\n * ],\n * options: {\n * onEvent: (event) => console.log('Signing and sending progress:', event)\n * executeSequentially: true\n * }\n * });\n * ```\n /\n async signAndSendTransactions({\n nearAccountId,\n transactions,\n options\n }: {\n nearAccountId: string,\n transactions: TransactionInput[],\n options: SignAndSendTransactionHooksOptions,\n }): Promise<ActionResult[]> {\n\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n const routerOptions: SignAndSendTransactionHooksOptions = {\n ...options,\n executionWait: options?.executionWait ?? { mode: 'sequential', waitUntil: options?.waitUntil },\n };\n const res = await router.signAndSendTransactions({\n nearAccountId,\n transactions: transactions.map(t => ({ receiverId: t.receiverId, actions: t.actions })),\n options: routerOptions\n });\n // Emit completion\n const txIds = (res \|\| []).map(r => r?.transactionId).filter(Boolean).join(', ');\n options?.onEvent?.({ step: 8, phase: ActionPhase.STEP_8_ACTION_COMPLETE, status: ActionStatus.SUCCESS, message: `All transactions sent: ${txIds}` });\n await options?.afterCall?.(true, res);\n return res;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n\n return signAndSendTransactions({\n context: this.getContext(),\n nearAccountId: toAccountId(nearAccountId),\n transactionInputs: transactions,\n options\n }).then(txResults => {\n const txIds = txResults.map(txResult => txResult.transactionId).join(', ');\n options?.onEvent?.({\n step: 8,\n phase: ActionPhase.STEP_8_ACTION_COMPLETE,\n status: ActionStatus.SUCCESS,\n message: `All transactions sent: ${txIds}`\n });\n return txResults;\n });\n }\n\n /\n Convenience helper to sign and send a single transaction with actions.\n * Internally delegates to signAndSendTransactions() and returns the first result.\n /\n async signAndSendTransaction({\n nearAccountId,\n receiverId,\n actions,\n options\n }: {\n nearAccountId: string;\n receiverId: string;\n actions: ActionArgs[];\n options: SignAndSendTransactionHooksOptions;\n }): Promise<ActionResult> {\n const results = await this.signAndSendTransactions({\n nearAccountId,\n transactions: [\n {\n receiverId,\n actions\n }\n ],\n options\n });\n return results[0] as ActionResult;\n }\n\n /\n Batch sign transactions (with actions), allows you to sign transactions\n * to different receivers with a single TouchID prompt.\n * This method does not broadcast transactions, use sendTransaction() to do that.\n \n This method fetches the current nonce and increments it for the next N transactions,\n * so you do not need to manually increment the nonce for each transaction.\n \n @param nearAccountId - NEAR account ID to sign transactions with\n * @param params - Transaction signing parameters\n * - @param params.transactions: Array of transaction objects with nearAccountId, receiverId, actions, and nonce\n * - @param params.onEvent: Optional progress event callback\n * @returns Promise resolving to signed transaction results\n \n @example\n * ```typescript\n * // Sign a single transaction\n * const signedTransactions = await tatchi.signTransactionsWithActions('alice.near', {\n * transactions: [{\n * receiverId: 'bob.near',\n * actions: [{\n * action_type: ActionType.Transfer,\n * deposit: '1000000000000000000000000'\n * }],\n * }],\n * onEvent: (event) => console.log('Signing progress:', event)\n * });\n \n // Sign multiple transactions in a batch\n * const signedTransactions = await tatchi.signTransactionsWithActions('alice.near', {\n * transactions: [\n * {\n * receiverId: 'bob.near',\n * actions: [{\n * action_type: ActionType.Transfer,\n * deposit: '1000000000000000000000000'\n * }],\n * },\n * {\n * receiverId: 'contract.near',\n * actions: [{\n * action_type: ActionType.FunctionCall,\n * method_name: 'log_transfer',\n * args: JSON.stringify({ recipient: 'bob.near' }),\n * gas: '30000000000000',\n * deposit: '0'\n * }],\n * }\n * ]\n * });\n * ```\n /\n async signTransactionsWithActions({ nearAccountId, transactions, options }: {\n nearAccountId: string,\n transactions: TransactionInput[],\n options: SignTransactionHooksOptions\n }): Promise<SignTransactionResult[]> {\n // route signing via wallet origin\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n const txs = transactions.map((t) => ({ receiverId: t.receiverId, actions: t.actions }));\n const result = await router.signTransactionsWithActions({\n nearAccountId,\n transactions: txs,\n options: {\n signerMode: options.signerMode,\n onEvent: options.onEvent,\n confirmationConfig: options.confirmationConfig,\n confirmerText: options.confirmerText,\n },\n });\n const arr: SignTransactionResult[] = Array.isArray(result) ? result : [];\n await options?.afterCall?.(true, arr);\n return arr;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n\n return signTransactionsWithActions({\n context: this.getContext(),\n nearAccountId: toAccountId(nearAccountId),\n transactionInputs: transactions,\n options\n });\n }\n\n /\n Send a signed transaction to the NEAR network\n * This method broadcasts a previously signed transaction and waits for execution\n \n @param signedTransaction - The signed transaction to broadcast\n * @param waitUntil - The execution status to wait for (defaults to FINAL)\n * @returns Promise resolving to the transaction execution outcome\n \n @example\n * ```typescript\n * // Sign a transaction first\n * const signedTransactions = await tatchi.signTransactionsWithActions('alice.near', {\n * transactions: [{\n * receiverId: 'bob.near',\n * actions: [{\n * action_type: ActionType.Transfer,\n * deposit: '1000000000000000000000000'\n * }],\n * }]\n * });\n \n // Then broadcast it\n * const result = await tatchi.sendTransaction(\n * signedTransactions[0].signedTransaction,\n * TxExecutionStatus.FINAL\n * );\n * ```\n /\n async sendTransaction({ signedTransaction, options }: {\n signedTransaction: SignedTransaction,\n options?: SendTransactionHooksOptions\n }): Promise<ActionResult> {\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter();\n const res = await router.sendTransaction({\n signedTransaction,\n options: {\n onEvent: options?.onEvent,\n ...(options && ('waitUntil' in options)\n ? { waitUntil: options.waitUntil }\n : {})\n }\n });\n await options?.afterCall?.(true, res);\n options?.onEvent?.({ step: 8, phase: ActionPhase.STEP_8_ACTION_COMPLETE, status: ActionStatus.SUCCESS, message: `Transaction ${res?.transactionId} broadcasted` });\n return res;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n\n return sendTransaction({ context: this.getContext(), signedTransaction, options })\n .then(txResult => {\n options?.onEvent?.({ step: 8, phase: ActionPhase.STEP_8_ACTION_COMPLETE, status: ActionStatus.SUCCESS, message: `Transaction ${txResult.transactionId} broadcasted` });\n return txResult;\n });\n }\n\n ///////////////////////////////////////\n // === DELEGATE ACTION SIGNING (NEP-461) ===\n ///////////////////////////////////////\n\n async signDelegateAction({\n nearAccountId,\n delegate,\n options,\n }: {\n nearAccountId: string;\n delegate: DelegateActionInput;\n options: DelegateActionHooksOptions;\n }): Promise<SignDelegateActionResult> {\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n const result = await router.signDelegateAction({\n nearAccountId,\n delegate,\n options: {\n signerMode: options.signerMode,\n onEvent: options.onEvent,\n confirmationConfig: options.confirmationConfig,\n confirmerText: options.confirmerText,\n }\n }) as SignDelegateActionResult;\n await options?.afterCall?.(true, result);\n return result;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n\n const { signDelegateAction } = await import('./delegateAction');\n return signDelegateAction({\n context: this.getContext(),\n nearAccountId: toAccountId(nearAccountId),\n delegate,\n options,\n });\n }\n\n /\n Convenience helper to POST a signed delegate to a relayer.\n * Does not enforce any relayer semantics; simply forwards the payload.\n /\n async sendDelegateActionViaRelayer(args: {\n relayerUrl: string;\n signedDelegate: SignedDelegate \| WasmSignedDelegate;\n hash: string;\n signal?: AbortSignal;\n options?: DelegateRelayHooksOptions;\n }): Promise<DelegateRelayResult> {\n const base = args.relayerUrl.replace(/\\/+$/, '');\n const route = (this.configs.relayer?.delegateActionRoute \|\| '/signed-delegate').replace(/^\\/?/, '/');\n const endpoint = `${base}${route}`;\n const { sendDelegateActionViaRelayer } = await import('./relay');\n return sendDelegateActionViaRelayer({\n url: endpoint,\n payload: {\n hash: args.hash,\n signedDelegate: args.signedDelegate,\n },\n signal: args.signal,\n options: args.options,\n });\n }\n\n /\n Convenience helper to sign a delegate action and immediately forward it to the relayer.\n * Emits delegate signing events and relay broadcasting events through the provided options.\n /\n async signAndSendDelegateAction(args: {\n nearAccountId: string;\n delegate: DelegateActionInput;\n relayerUrl: string;\n signal?: AbortSignal;\n options: SignAndSendDelegateActionHooksOptions;\n }): Promise<SignAndSendDelegateActionResult> {\n const { nearAccountId, delegate, relayerUrl, signal, options } = args;\n\n const signOptions: DelegateActionHooksOptions \| undefined = options\n ? {\n signerMode: options.signerMode,\n onEvent: options.onEvent,\n onError: options.onError,\n waitUntil: options.waitUntil,\n confirmationConfig: options.confirmationConfig,\n confirmerText: options.confirmerText,\n // suppress afterCall so we can call afterCall() once at the end of the lifecycle.\n afterCall: () => { },\n }\n : undefined;\n\n let signResult: SignDelegateActionResult;\n try {\n signResult = await this.signDelegateAction({\n nearAccountId,\n delegate,\n options: signOptions as DelegateActionHooksOptions,\n });\n } catch (error) {\n await options?.afterCall?.(false);\n throw error;\n }\n\n const relayOptions: DelegateRelayHooksOptions \| undefined = options\n ? {\n onEvent: options.onEvent,\n onError: options.onError,\n }\n : undefined;\n\n let relayResult: DelegateRelayResult;\n try {\n relayResult = await this.sendDelegateActionViaRelayer({\n relayerUrl,\n hash: signResult.hash,\n signedDelegate: signResult.signedDelegate,\n signal,\n options: relayOptions,\n });\n } catch (error) {\n await options?.afterCall?.(false);\n throw error;\n }\n\n const combined: SignAndSendDelegateActionResult = {\n signResult,\n relayResult,\n };\n\n const success = relayResult.ok !== false;\n if (success) {\n await options?.afterCall?.(true, combined);\n } else {\n await options?.afterCall?.(false);\n }\n return combined;\n }\n\n ///////////////////////////////////////\n // === NEP-413 MESSAGE SIGNING ===\n ///////////////////////////////////////\n\n /\n Sign a NEP-413 message using the user's passkey-derived private key:\n * - Creates a payload with message, recipient, nonce, and state\n * - Serializes using Borsh\n * - Adds NEP-413 prefix\n * - Hashes with SHA-256\n * - Signs with Ed25519\n * - Returns base64-encoded signature\n \n @param nearAccountId - NEAR account ID to sign with\n * @param params - NEP-413 signing parameters\n * - message: string - The message to sign\n * - recipient: string - The recipient of the message\n * - state: string - Optional state parameter\n * @param options - Action options for event handling\n * - onEvent: EventCallback<ActionSSEEvent> - Optional event callback\n * - onError: (error: Error) => void - Optional error callback\n * - afterCall: AfterCall - Optional after call hooks\n * - waitUntil: TxExecutionStatus - Optional waitUntil status\n * @returns Promise resolving to signing result\n \n @example\n * ```typescript\n * const result = await tatchi.signNEP413Message('alice.near', {\n * message: 'Hello World',\n * recipient: 'app.example.com',\n * state: 'optional-state'\n * });\n * ```\n /\n async signNEP413Message(args: {\n nearAccountId: string,\n params: SignNEP413MessageParams,\n options: SignNEP413HooksOptions\n }): Promise<SignNEP413MessageResult> {\n // In wallet-iframe mode, always run inside the wallet origin (no app-origin fallback).\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(args.nearAccountId);\n const result = await router.signNep413Message({\n nearAccountId: args.nearAccountId,\n message: args.params.message,\n recipient: args.params.recipient,\n state: args.params.state,\n options: {\n signerMode: args.options.signerMode,\n onEvent: args.options.onEvent,\n confirmerText: args.options.confirmerText,\n confirmationConfig: args.options.confirmationConfig,\n }\n });\n await args.options?.afterCall?.(true, result);\n // Expect wallet to return the same shape as WebAuthnManager.signNEP413Message\n return result as SignNEP413MessageResult;\n } catch (error: unknown) {\n const e = toError(error);\n await args.options?.onError?.(e);\n await args.options?.afterCall?.(false);\n throw e;\n }\n }\n\n const { signNEP413Message } = await import('./signNEP413');\n const res = await signNEP413Message({\n context: this.getContext(),\n nearAccountId: toAccountId(args.nearAccountId),\n params: args.params,\n options: args.options\n });\n if (res?.success) {\n await args.options?.afterCall?.(true, res);\n } else {\n await args.options?.afterCall?.(false);\n }\n return res;\n }\n\n ///////////////////////////////////////\n // === KEY MANAGEMENT ===\n ///////////////////////////////////////\n\n /\n Canonical entrypoint to show the Export Private Key UI (secure drawer/modal)\n * without returning the key to the caller. All dApps should use this wrapper;\n * the underlying WebAuthnManager.exportNearKeypairWithUI() is fully worker-\n * driven and only ever reveals the private key inside trusted UI surfaces.\n /\n async exportNearKeypairWithUI(\n nearAccountId: string,\n options?: { variant?: 'drawer' \| 'modal'; theme?: 'dark' \| 'light' }\n ): Promise<void> {\n if (isOffline()) {\n // If offline, open the offline-export route\n await openOfflineExport({\n accountId: nearAccountId,\n routerOpen: this.iframeRouter?.openOfflineExport?.bind(this.iframeRouter),\n walletOrigin: this.configs?.iframeWallet?.walletOrigin,\n target: '_blank',\n });\n } else {\n // Prefer wallet iframe when ready\n if (this.iframeRouter?.isReady?.()) {\n await this.iframeRouter.exportNearKeypairWithUI(nearAccountId, options);\n return;\n }\n // Online but router not ready: prefer offline-export route via router (or new tab)\n // Only do this when we have a wallet origin configured or router API is available\n const routerOpen = this.iframeRouter?.openOfflineExport?.bind(this.iframeRouter);\n const walletOrigin = this.configs?.iframeWallet?.walletOrigin;\n if (routerOpen \|\| walletOrigin) {\n await openOfflineExport({ accountId: nearAccountId, routerOpen, walletOrigin, target: '_blank' });\n return;\n }\n // Final fallback: local worker-driven UI\n await this.webAuthnManager.exportNearKeypairWithUI(toAccountId(nearAccountId), options);\n }\n }\n\n ///////////////////////////////////////\n // === DERIVED ADDRESSES (public helpers) ===\n ///////////////////////////////////////\n\n /* Store a derived address for an account + contract + path (multi-chain capable via path encoding). /\n async setDerivedAddress(\n nearAccountId: string,\n args: { contractId: string; path: string; address: string }\n ): Promise<void> {\n if (this.shouldUseWalletIframe()) {\n let router: WalletIframeRouter;\n try {\n router = await this.requireWalletIframeRouter();\n } catch {\n throw new Error('[TatchiPasskey] Wallet iframe is configured but unavailable; refusing to write derived addresses to app origin.');\n }\n return await router.setDerivedAddress({ nearAccountId, args });\n }\n await chainsigAddressManager.setDerivedAddress(toAccountId(nearAccountId), args);\n }\n\n /* Retrieve the full derived address record (or null if not found). /\n async getDerivedAddressRecord(\n nearAccountId: string,\n args: { contractId: string; path: string }\n ): Promise<DerivedAddressRecord \| null> {\n if (this.shouldUseWalletIframe()) {\n let router: WalletIframeRouter;\n try {\n router = await this.requireWalletIframeRouter();\n } catch {\n throw new Error('[TatchiPasskey] Wallet iframe is configured but unavailable; refusing to read derived addresses from app origin.');\n }\n return await router.getDerivedAddressRecord({ nearAccountId, args });\n }\n return await chainsigAddressManager.getDerivedAddressRecord(toAccountId(nearAccountId), args);\n }\n\n /* Retrieve only the derived address string for convenience. /\n async getDerivedAddress(\n nearAccountId: string,\n args: { contractId: string; path: string }\n ): Promise<string \| null> {\n if (this.shouldUseWalletIframe()) {\n let router: WalletIframeRouter;\n try {\n router = await this.requireWalletIframeRouter();\n } catch {\n throw new Error('[TatchiPasskey] Wallet iframe is configured but unavailable; refusing to read derived addresses from app origin.');\n }\n return await router.getDerivedAddress({ nearAccountId, args });\n }\n return await chainsigAddressManager.getDerivedAddress(toAccountId(nearAccountId), args);\n }\n\n ///////////////////////////////////////\n // === Email Recovery (public helpers) ===\n ///////////////////////////////////////\n\n /\n Get recovery emails for an account.\n * - Fetches on-chain recovery email hashes via get_recovery_emails.\n * - Resolves hashes to canonical emails using local IndexedDB mapping when available.\n * - Returns an array of { hashHex, email }, where `email` is a human-readable label\n * (canonical email when known on this device, otherwise the hash hex).\n /\n async getRecoveryEmails(nearAccountId: string): Promise<Array<{ hashHex: string; email: string }>> {\n if (this.shouldUseWalletIframe()) {\n let router: WalletIframeRouter;\n try {\n router = await this.requireWalletIframeRouter(nearAccountId);\n } catch {\n throw new Error('[TatchiPasskey] Wallet iframe is configured but unavailable; refusing to read recovery email mappings from app origin.');\n }\n return await router.getRecoveryEmails(nearAccountId);\n }\n const accountId = toAccountId(nearAccountId);\n\n // Dynamic import for rpc/email utils\n const { getRecoveryEmailHashesContractCall } = await import('../rpcCalls');\n const { getLocalRecoveryEmails, bytesToHex } = await import('../EmailRecovery');\n\n // Fetch on-chain recovery email hashes\n const rawHashes = await getRecoveryEmailHashesContractCall(this.nearClient, accountId);\n if (!rawHashes.length) {\n return [];\n }\n\n // Load local mapping from IndexedDB (best-effort)\n let local: RecoveryEmailRecord[] = [];\n try {\n local = await getLocalRecoveryEmails(accountId);\n } catch (error) {\n console.warn('[TatchiPasskey] Failed to load local recovery emails', error);\n }\n\n const emailByHashHex = new Map<string, string>();\n for (const rec of local) {\n if (!rec?.hashHex \|\| !rec?.email) continue;\n if (!emailByHashHex.has(rec.hashHex)) {\n emailByHashHex.set(rec.hashHex, rec.email);\n }\n }\n\n return rawHashes.map(hashBytes => {\n const hashHex = bytesToHex(hashBytes);\n const email = emailByHashHex.get(hashHex) \|\| hashHex;\n return { hashHex, email };\n });\n }\n\n /\n Set recovery emails for an account:\n * - Canonicalizes and hashes emails client-side.\n * - Persists mapping in IndexedDB.\n * - Deploys/attaches the EmailRecoverer contract when needed.\n * - Calls set_recovery_emails(...) on the per-account contract.\n /\n async setRecoveryEmails(\n nearAccountId: string,\n recoveryEmails: string[],\n options: ActionHooksOptions\n ): Promise<ActionResult> {\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter(nearAccountId);\n const res = await router.setRecoveryEmails({ nearAccountId, recoveryEmails, options });\n await options?.afterCall?.(true, res);\n return res;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n const accountId = toAccountId(nearAccountId);\n\n // Dynamic import\n const { prepareRecoveryEmails } = await import('../EmailRecovery');\n const { buildSetRecoveryEmailsActions } = await import('../rpcCalls');\n\n // Canonicalize, hash, and persist mapping locally (best-effort)\n const { hashes: recoveryEmailHashes } = await prepareRecoveryEmails(accountId, recoveryEmails);\n\n const actions: ActionArgs[] = await buildSetRecoveryEmailsActions(\n this.nearClient,\n accountId,\n recoveryEmailHashes,\n this.configs.emailRecoveryContracts\n );\n\n // Delegate to executeAction so iframe vs same-origin routing is respected.\n return this.executeAction({\n nearAccountId,\n receiverId: nearAccountId,\n actionArgs: actions,\n options,\n });\n }\n\n\t ///////////////////////////////////////\n\t // === Account Sync Flow ===\n\t ///////////////////////////////////////\n\n\t /\n\t Sync account state from on-chain data using an existing passkey.\n\t /\n\t async syncAccount(args: {\n\t accountId?: string;\n\t options?: SyncAccountHooksOptions\n\t }): Promise<SyncAccountResult> {\n\n const accountIdInput = args?.accountId \|\| '';\n\t const options = args?.options;\n\t if (this.shouldUseWalletIframe()) {\n\t try {\n\t const router = await this.requireWalletIframeRouter();\n\t const res = await router.syncAccount({\n\t accountId: accountIdInput,\n\t onEvent: options?.onEvent\n\t });\n\t await options?.afterCall?.(true, res);\n\t return res;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n\t }\n\n\t // Local orchestration using SyncAccountFlow for a single-call UX\n\t try {\n\t const { SyncAccountFlow } = await import('./syncAccount');\n\t const flow = new SyncAccountFlow(this.getContext(), options);\n\t // Phase 1: Discover available accounts\n\t const discovered = await flow.discover(accountIdInput \|\| '');\n\t if (!Array.isArray(discovered) \|\| discovered.length === 0) {\n\t const err = new Error('No syncable accounts found');\n\t await options?.onError?.(err);\n\t await options?.afterCall?.(false);\n\t return { success: false, accountId: accountIdInput \|\| '', publicKey: '', message: err.message, error: err.message };\n\t }\n // Phase 2: User selects account in UI\n // Select the first account-scope; OS chooser selects the actual credential\n const selected = discovered[0];\n\n\t // Phase 3: Execute sync with secure credential lookup\n\t const result = await flow.sync({\n\t credentialId: selected.credentialId,\n\t accountId: selected.accountId\n\t });\n\n await options?.afterCall?.(true, result);\n return result;\n\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n\n ///////////////////////////////////////\n // === Email Recovery Flow ===\n ///////////////////////////////////////\n\n\n private async ensureEmailRecoveryFlow(options?: EmailRecoveryFlowOptions) {\n const { EmailRecoveryFlow } = await import('./emailRecovery');\n if (!this.activeEmailRecoveryFlow) {\n this.activeEmailRecoveryFlow = new EmailRecoveryFlow(this.getContext(), options);\n } else if (options) {\n this.activeEmailRecoveryFlow.setOptions(options);\n }\n return this.activeEmailRecoveryFlow;\n }\n\n async startEmailRecovery(args: {\n accountId: string;\n options?: EmailRecoveryFlowOptions;\n }): Promise<{ mailtoUrl: string; nearPublicKey: string }> {\n const { accountId, options } = args;\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter();\n const confirmerText = options?.confirmerText;\n const confirmationConfig = options?.confirmationConfig;\n const safeOptions = {\n ...(confirmerText ? { confirmerText } : {}),\n ...(confirmationConfig ? { confirmationConfig } : {}),\n };\n const res = await router.startEmailRecovery({\n accountId,\n onEvent: options?.onEvent,\n options: Object.keys(safeOptions).length > 0 ? safeOptions : undefined,\n });\n await options?.afterCall?.(true, undefined);\n return res;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n const flow = await this.ensureEmailRecoveryFlow(options);\n return await flow.start({ accountId });\n }\n\n async finalizeEmailRecovery(args: {\n accountId: string;\n nearPublicKey?: string;\n options?: EmailRecoveryFlowOptions;\n }): Promise<void> {\n const { accountId, nearPublicKey, options } = args;\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter();\n await router.finalizeEmailRecovery({\n accountId,\n nearPublicKey,\n onEvent: options?.onEvent,\n });\n await options?.afterCall?.(true, undefined);\n return;\n } catch (error: unknown) {\n const e = toError(error);\n await options?.onError?.(e);\n await options?.afterCall?.(false);\n throw e;\n }\n }\n const flow = await this.ensureEmailRecoveryFlow(options);\n await flow.finalize({ accountId, nearPublicKey });\n }\n\n /\n Best-effort cancellation for an in-flight email recovery flow.\n * Intended for UI \"user cancelled sending email\" / retry UX.\n /\n async cancelEmailRecovery(args?: { accountId?: string; nearPublicKey?: string }): Promise<void> {\n const { accountId, nearPublicKey } = args \|\| {};\n // In wallet-iframe mode, instruct the wallet host to stop the active flow.\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter();\n await router.stopEmailRecovery({ accountId, nearPublicKey });\n } catch { }\n return;\n }\n\n try {\n await this.activeEmailRecoveryFlow?.cancelAndReset({ accountId, nearPublicKey });\n } catch { }\n this.activeEmailRecoveryFlow = null;\n }\n\n ///////////////////////////////////////\n // === Link Device ===\n ///////////////////////////////////////\n\n /\n Device2: Start device linking flow\n * Returns QR payload and data URL to render; emits onEvent during the flow.\n * Runs inside iframe when available for better isolation.\n /\n async startDevice2LinkingFlow(args: StartDevice2LinkingFlowArgs): Promise<StartDevice2LinkingFlowResults> {\n // In wallet-iframe mode, device linking must run inside the wallet origin.\n if (this.shouldUseWalletIframe()) {\n const router = await this.requireWalletIframeRouter();\n const options = args?.options;\n return await router.startDevice2LinkingFlow({\n ui: args?.ui,\n cameraId: args?.cameraId,\n options,\n });\n }\n // Local fallback: keep internal flow reference for cancellation\n this.activeDeviceLinkFlow?.cancel();\n const { LinkDeviceFlow } = await import('./linkDevice');\n const flow = new LinkDeviceFlow(this.getContext(), {\n cameraId: args?.cameraId,\n options: args?.options,\n });\n this.activeDeviceLinkFlow = flow;\n const { qrData, qrCodeDataURL } = await flow.generateQR();\n return { qrData, qrCodeDataURL };\n }\n\n /\n Device2: Stops device linking flow inside the iframe host.\n /\n async stopDevice2LinkingFlow(): Promise<void> {\n if (this.shouldUseWalletIframe()) {\n try {\n const router = await this.requireWalletIframeRouter();\n await router.stopDevice2LinkingFlow();\n } catch { }\n return;\n }\n if (this.iframeRouter) {\n await this.iframeRouter.stopDevice2LinkingFlow();\n return;\n }\n this.activeDeviceLinkFlow?.cancel();\n this.activeDeviceLinkFlow = null;\n }\n\n /\n Device1: Link device using pre-scanned QR data.\n * You can use a QR scanning component of your choice,\n * or use the built-in <QRCodeScanner /> component.\n \n @param qrData The QR data obtained from scanning Device2's QR code\n * @param options Device linking options including funding amount and event callbacks\n * @returns Promise that resolves to the linking result\n /\n async linkDeviceWithScannedQRData(\n qrData: DeviceLinkingQRData,\n options: ScanAndLinkDeviceOptionsDevice1\n ): Promise<LinkDeviceResult> {\n // In wallet-iframe mode, device linking must run inside the wallet origin.\n if (this.shouldUseWalletIframe()) {\n const router = await this.requireWalletIframeRouter();\n const res = await router.linkDeviceWithScannedQRData({\n qrData,\n fundingAmount: options.fundingAmount,\n options: {\n onEvent: options.onEvent,\n confirmationConfig: options.confirmationConfig,\n confirmerText: options.confirmerText,\n }\n });\n return res as LinkDeviceResult;\n }\n const { linkDeviceWithScannedQRData } = await import('./scanDevice');\n return linkDeviceWithScannedQRData(this.getContext(), qrData, options);\n }\n\n /\n Delete a device key from an account\n */\n async deleteDeviceKey(\n accountId: string,\n publicKeyToDelete: string,\n options: ActionHooksOptions\n ): Promise<ActionResult> {\n // Validate that we're not deleting the last key\n const keysView = this.iframeRouter\n ? await this.iframeRouter.viewAccessKeyList(accountId)\n : await this.nearClient.viewAccessKeyList(toAccountId(accountId));\n if (keysView.keys.length <= 1) {\n throw new Error('Cannot delete the last access key from an account');\n }\n\n // Find the key to delete\n const keyToDelete = keysView.keys.find((k: { public_key: string }) => k.public_key === publicKeyToDelete);\n if (!keyToDelete) {\n throw new Error(`Access key ${publicKeyToDelete} not found on account ${accountId}`);\n }\n\n // Use the executeAction method with DeleteKey action\n return this.executeAction({\n nearAccountId: accountId,\n receiverId: accountId,\n actionArgs: {\n type: ActionType.DeleteKey,\n publicKey: publicKeyToDelete\n },\n options: options\n });\n }\n\n}\n\n// Re-export types for convenience\nexport type {\n TatchiConfigs,\n TatchiConfigsInput,\n RegistrationResult,\n LoginAndCreateSessionResult,\n LoginResult,\n LoginSession,\n SigningSessionStatus,\n ActionResult,\n} from '../types/tatchi';\nexport type {\n ActionHooksOptions,\n AfterCall,\n EventCallback,\n LoginHooksOptions,\n LoginSSEvent,\n RegistrationHooksOptions,\n RegistrationSSEEvent,\n SignNEP413HooksOptions,\n} from '../types/sdkSentEvents';\n// Context alias (optional convenience)\nexport type TatchiPasskeyContext = PasskeyManagerContext;\n\nexport type {\n DeviceLinkingQRData,\n DeviceLinkingSession,\n LinkDeviceResult\n} from '../types/linkDevice';\n\n// Re-export device linking error types and classes\nexport {\n DeviceLinkingPhase,\n DeviceLinkingError,\n DeviceLinkingErrorCode\n} from '../types/linkDevice';\n\n// Re-export account sync types and classes\nexport type {\n SyncAccountResult,\n SyncAccountLookupResult,\n PasskeyOption,\n PasskeyOptionWithoutCredential,\n PasskeySelection\n} from './syncAccount';\n\nexport {\n SyncAccountFlow\n} from './syncAccount';\n\n// Re-export NEP-413 types\nexport type {\n SignNEP413MessageParams,\n SignNEP413MessageResult\n} from './signNEP413';\n\n// Re-export QR scanning flow\nexport {\n ScanQRCodeFlow,\n type ScanQRCodeFlowOptions,\n type ScanQRCodeFlowEvents,\n ScanQRCodeFlowState\n} from '../../utils/qrScanner';\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAyFA,IAAI,8BAA8B;;;;;AAMlC,IAAa,gBAAb,MAA2B;CACzB,AAAiB;CACjB,AAAiB;CACjB,AAAS;CACT,AAAQ,eAA0C;CAElD,AAAQ,2BAAiD;CAE1D,AAAQ,+BAAoD;CAE5D,AAAQ,uBAAqE;CAC7E,AAAQ,0BAA8E;CAErF,YACE,SACA,YACA;AACA,OAAK,UAAUA,2CAAoB;EAInC,MAAM,OAAOC,+CACT,WACC,KAAK,QAAQ,cAAc,eAAe,aAAa;AAC5D,mCAAmB,EAAE;AAErB,OAAK,aAAa,cAAc,IAAIC,qCAAkB,KAAK,QAAQ;AACnE,OAAK,kBAAkB,IAAIC,gCAAgB,KAAK,SAAS,KAAK;AAG9D,OAAK,gBAAgB,sCACnB,KAAK,0BACD,OAAO,SAAS;GAChB,MAAM,SAAS,MAAM,KAAK;AAC1B,SAAM,OAAO,cAAc;MAE3B;;;;;;CASR,IAAI,kBAA0C;AAC5C,SAAO,KAAK,gBAAgB;;;;;;;CAQ9B,MAAM,iBAAiB,eAAuC;EAC5D,MAAM,yBAAyB,CAAC,CAAC,KAAK,QAAQ,cAAc;EAG5D,MAAM,4BAA4B,0BAA0B,CAACF;AAC7D,QAAM,KAAK,gBAAgB,sBAAsB,4BAA4B,SAAY;AAKzF,MAAIA,6CACF;EAGF,MAAM,qBAAqB,KAAK,QAAQ;EACxC,MAAM,eAAe,oBAAoB;AAEzC,MAAI,CAAC,cAAc;AAEjB,SAAM,KAAK,gBAAgB;AAC3B;;AAIF,MAAI,CAAC,4BACH,KAAI;GACF,MAAM,qBAAqBA;GAC3B,MAAM,SAAS,IAAI,IAAI;AACvB,OAAI,OAAO,WAAW,eAAe,OAAO,WAAW,OAAO,SAAS,UAAU,CAAC,oBAAoB;AACpG,kCAA8B;AAC9B,YAAQ,KAAK;;UAET;AAMV,MAAI,CAAC,KAAK,cAAc;AACtB,OAAI,CAAC,KAAK,yBACR,MAAK,4BAA4B,YAAY;IAC3C,MAAM,EAAE,uBAAuB,2CAAM;AACrC,SAAK,eAAe,IAAI,mBAAmB;KACzC;KACA,aAAa,oBAAoB,qBAAqB;KACtD,kBAAkB;KAClB,kBAAkB;KAClB,OAAO,KAAK,QAAQ;KACpB,YAAY,KAAK,QAAQ;KACzB,YAAY,KAAK,QAAQ;KACzB,aAAa,KAAK,QAAQ;KAC1B,YAAY,KAAK,QAAQ;KACzB,iBAAiB,KAAK,QAAQ;KAE9B,SAAS,KAAK,QAAQ;KACtB,kBAAkB,KAAK,QAAQ;KAC/B,wBAAwB,KAAK,QAAQ;KACrC,cAAc,oBAAoB;KAElC,aAAa,oBAAoB;;AAGnC,UAAM,KAAK,aAAa;AAExB,QAAI;AAAE,WAAM,KAAK,aAAa;YAA+B;;AAIjE,OAAI;AACF,UAAM,KAAK;aACH;AACR,SAAK,2BAA2B;;SAE7B;AACL,SAAM,KAAK,aAAa;AAExB,OAAI;AAAE,UAAM,KAAK,aAAa;WAA+B;;AAI/D,MAAI,KAAK,cAAc;AACrB,QAAK,oCAAoC,KAAK;GAE9C,MAAM,MAAM,MAAM,KAAK,aAAa,wBAAwB,YAAY;AACxE,OAAI,IACF,MAAK,gBAAgB,kCAAkC;IACrD,eAAe,gBAAgBG,+BAAY,iBAAiB;IAC5D,oBAAoB;;GAGxB,MAAM,aAAa,MAAM,KAAK,aAAa,gBAAgB,EAAE,WAAW,OAAQ,YAAY;AAC5F,OAAI,WACF,MAAK,gBAAgB,4BAA4B;IAC/C,eAAe,gBAAgBA,+BAAY,iBAAiB;IAC5D;;;AAKN,QAAM,KAAK,gBAAgB;;;CAI7B,wBAAmD;AACjD,SAAO,KAAK;;CAGd,AAAQ,oCAAoC,QAAkC;AAC5E,MAAI,KAAK,6BAA8B;EACvC,MAAM,cAAc,OAAO,wBAAuB,YAAW;GAC3D,MAAM,KAAK,SAAS;GACpB,MAAM,gBAAgB,KAAKA,+BAAY,MAAM;AAC7C,QAAK,gBAAgB,kCAAkC;IACrD;IACA,oBAAoB,SAAS;;AAE/B,OAAI,SAAS,WACX,MAAK,gBAAgB,4BAA4B;IAC/C;IACA,YAAY,QAAQ;;;AAI1B,OAAK,+BAA+B,eAAe;;;;;;CAOrD,AAAQ,wBAAiC;AACvC,SAAO,CAAC,CAAC,KAAK,QAAQ,cAAc,gBAAgB,CAACH;;CAGvD,MAAc,0BAA0B,eAAqD;AAC3F,MAAI,CAAC,KAAK,wBACR,OAAM,IAAI,MAAM;AAElB,MAAI,CAAC,KAAK,aACR,OAAM,KAAK,iBAAiB;AAE9B,MAAI,CAAC,KAAK,aACR,OAAM,IAAI,MAAM;AAElB,SAAO,KAAK;;CAGd,aAAoC;AAClC,SAAO;GACL,iBAAiB,KAAK;GACtB,YAAY,KAAK;GACjB,SAAS,KAAK;;;CAIlB,gBAA4B;AAC1B,SAAO,KAAK;;;;;CAMd,MAAM,sBAAsB,eAAuC;AAEjE,QAAM,KAAK,iBAAiB;;;;;;;;CAS9B,MAAM,QAAQ,MAAuF;EACnG,MAAM,SAAS,CAAC,CAAC,MAAM;EACvB,MAAM,UAAU,CAAC,CAAC,MAAM;EACxB,MAAM,gBAAgB,MAAM;EAE5B,MAAMI,QAA4B;AAElC,MAAI,OAEF,OAAM,KAAK,KAAK,iBAAiB;WACxB,SAAS;GAGlB,MAAM,4BAA4B,CAAC,CAAC,KAAK,QAAQ,cAAc,gBAAgB,CAACJ;AAChF,SAAM,KAAK,KAAK,gBAAgB,sBAAsB,4BAA4B,SAAY;;AAGhG,MAAI,MAAM,WAAW,EAAG;AACxB,MAAI;AACF,SAAM,QAAQ,IAAI;UACZ;;;;;;;CAUV,MAAM,kBAAkB,WAA2C;AACjE,MAAI,KAAK,aACP,QAAO,MAAM,KAAK,aAAa,kBAAkB;AAEnD,SAAO,KAAK,WAAW,kBAAkB;;;;;;CAW3C,MAAM,gBACJ,eACA,UAAoC,IACP;AAE7B,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B;GACpD,MAAM,qBAAqB,SAAS;GACpC,MAAM,MAAM,MAAM,OAAO,gBAAgB;IACvC;IACA;IACA,SAAS;KACP,SAAS,SAAS;KAClB,GAAI,SAAS,aAAa,EAAE,YAAY,QAAQ,eAAe;KAC/D,GAAI,SAAS,gBAAgB,EAAE,eAAe,QAAQ,kBAAkB;;;AAI5E,IAAM,YAAY;AAAE,QAAI;AAAE,WAAM,KAAK,sBAAsB;YAAwB;;AACnF,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WACAK,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;AAGV,SAAOC,qCACL,KAAK,cACLJ,+BAAY,gBACZ,SACA,KAAK,QAAQ,wBAAwBK;;;;;;CAQzC,MAAM,wBACJ,eACA,UAAoC,IACpC,4BAC6B;AAE7B,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B;GACpD,MAAM,qBAAqB,8BAA8B,SAAS;GAClE,MAAM,MAAM,MAAM,OAAO,gBAAgB;IACvC;IACA;IACA,SAAS;KACP,SAAS,SAAS;KAClB,GAAI,SAAS,aAAa,EAAE,YAAY,QAAQ,eAAe;KAC/D,GAAI,SAAS,gBAAgB,EAAE,eAAe,QAAQ,kBAAkB;;;AAG5E,IAAM,YAAY;AAAE,QAAI;AAAE,WAAM,KAAK,sBAAsB;YAAwB;;AACnF,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WACAH,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;AAIV,SAAOG,6CACL,KAAK,cACLN,+BAAY,gBACZ,SACA,KAAK,QAAQ,wBAAwBK,4DACrC;;;;;;;CASJ,MAAM,0BACJ,eACA,SAUC;AAED,MAAI,KAAK,yBAAyB;GAChC,MAAM,SAAS,MAAM,KAAK,0BAA0B;AACpD,UAAO,MAAM,OAAO,0BAA0B;IAC5C;IACA,SAAS,WAAW;;;AAIxB,SAAO,MAAM,KAAK,gBAAgB,0CAA0C;GAC1E,eAAeL,+BAAY;GAC3B,cAAc,SAAS;;;;;;;CAQ3B,MAAM,0BACJ,eACA,SAcC;AAED,MAAI,KAAK,yBAAyB;GAChC,MAAM,SAAS,MAAM,KAAK,0BAA0B;AACpD,UAAO,MAAM,OAAO,0BAA0B;IAC5C;IACA,SAAS,WAAW;;;AAIxB,SAAO,MAAM,KAAK,gBAAgB,0CAA0C;GAC1E,eAAeA,+BAAY;GAC3B,cAAc,SAAS;;;;;;;;;CAU3B,MAAM,sBACJ,eACA,SACsC;AAEtC,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B;GAEpD,MAAMO,QAAM,MAAM,OAAO,sBAAsB;IAC7C;IACA,SAAS;KACP,SAAS,SAAS;KAClB,cAAc,SAAS;KAEvB,SAAS,SAAS;KAClB,gBAAgB,SAAS;;;AAI7B,IAAM,YAAY;AAAE,QAAI;AAAE,WAAM,KAAK,sBAAsB;YAAwB;;AACnF,SAAM,SAAS,YAAY,MAAMA;AACjC,UAAOA;WACAL,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;AAIV,QAAM,KAAK,gBAAgB,sBAAsBH,+BAAY,gBAAgB,KAAK;EAClF,MAAM,MAAM,MAAMQ,oCAAsB,KAAK,cAAcR,+BAAY,gBAAgB;AAEvF,MAAI;AAAE,GAAK,KAAK,sBAAsB;UAAwB;AAC9D,SAAO;;;;;CAMT,MAAM,wBAAuC;AAC3C,QAAMS,oCAAsB,KAAK;AAEjC,MAAI,KAAK,aACP,KAAI;AAAE,SAAM,KAAK,aAAa;UAA6B;;;;;CAO/D,MAAM,gBAAgB,eAA+C;AACnE,MAAI,KAAK,yBAAyB;GAChC,MAAM,SAAS,MAAM,KAAK,0BAA0B;GACpD,MAAM,UAAU,MAAM,OAAO,gBAAgB;AAC7C,OAAI;AAAE,UAAM,OAAO;WAA+B;AAClD,UAAO;;AAET,SAAO,MAAMC,8BAAgB,KAAK,cAAc,gBAAgBV,+BAAY,iBAAiB;;;;;CAM/F,MAAM,qBAAqB,eAA4C;AACrE,MAAI,KAAK,yBAAyB;GAChC,MAAM,SAAS,MAAM,KAAK;AAC1B,UAAO,MAAM,OAAO,qBAAqB;;EAE3C,MAAM,gBAAgBA,+BAAY;AAClC,SAAO,MAAM,KAAK,gBAAgB,qBAAqB;;;;;CAUzD,mBAAmB,UAAgD;AACjE,MAAI,KAAK,yBAAyB;AAEhC,IAAM,YAAY;AAChB,QAAI;KACF,MAAM,SAAS,MAAM,KAAK;AAC1B,WAAM,OAAO,mBAAmB;YAC1B;;AAEV;;AAEF,OAAK,gBAAgB,qBAAqB,mBAAmB;;;;;CAM/D,sBAAsB,QAAkC;AACtD,MAAI,KAAK,yBAAyB;AAEhC,IAAM,YAAY;AAChB,QAAI;KACF,MAAM,SAAS,MAAM,KAAK;AAC1B,WAAM,OAAO,sBAAsB;YAC7B;;AAEV;;AAEF,OAAK,gBAAgB,qBAAqB,sBAAsB;;CAGlE,aAAa,OAA+B;AAC1C,MAAI,KAAK,yBAAyB;AAChC,IAAM,YAAY;AAChB,QAAI;KACF,MAAM,SAAS,MAAM,KAAK;AAC1B,WAAM,OAAO,SAAS;YAChB;;AAEV;;AAEF,OAAK,gBAAgB,qBAAqB,aAAa;;CAGzD,cAAc,YAAmD;AAC/D,OAAK,gBAAgB,qBAAqB,cAAc;;;;;CAM1D,wBAA4C;AAI1C,SAAO,KAAK,gBAAgB,qBAAqB;;CAGnD,gBAA4B;AAC1B,SAAO,KAAK,gBAAgB,qBAAqB;;;;;;CAOnD,MAAM,sBAAqC;AACzC,MAAI,KAAK,cAAc;AACrB,SAAM,KAAK,aAAa;AACxB;;AAEF,MAAI;AAAE,SAAM,KAAK,gBAAgB,kBAAkB,oBAAoB,KAAK;UAAqB;;CAGnG,MAAM,kBAAkD;AAEtD,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK;AAC1B,UAAO,MAAM,OAAO;UACd;AACN,UAAO;IAAE,YAAY;IAAI,iBAAiB;;;AAI9C,SAAOW,8BAAgB,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyD9B,MAAM,cAAc,MAKM;AAExB,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B,KAAK;GACzD,MAAM,MAAM,MAAM,OAAO,cAAc;IACrC,eAAe,KAAK;IACpB,YAAY,KAAK;IACjB,YAAY,KAAK;IACjB,SAAS,KAAK;;AAEhB,SAAM,KAAK,SAAS,YAAY,MAAM;AACtC,UAAO;WACAT,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,KAAK,SAAS,UAAU;AAC9B,SAAM,KAAK,SAAS,YAAY;AAChC,SAAM;;AAIV,SAAOS,gCAAc;GACnB,SAAS,KAAK;GACd,eAAeZ,+BAAY,KAAK;GAChC,YAAYA,+BAAY,KAAK;GAC7B,YAAY,KAAK;GACjB,SAAS,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDlB,MAAM,wBAAwB,EAC5B,eACA,cACA,WAK0B;AAG1B,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B;GACpD,MAAMa,gBAAoD;IACxD,GAAG;IACH,eAAe,SAAS,iBAAiB;KAAE,MAAM;KAAc,WAAW,SAAS;;;GAErF,MAAM,MAAM,MAAM,OAAO,wBAAwB;IAC/C;IACA,cAAc,aAAa,KAAI,OAAM;KAAE,YAAY,EAAE;KAAY,SAAS,EAAE;;IAC5E,SAAS;;GAGX,MAAM,SAAS,OAAO,IAAI,KAAI,MAAK,GAAG,eAAe,OAAO,SAAS,KAAK;AAC1E,YAAS,UAAU;IAAE,MAAM;IAAG,OAAOC,kCAAY;IAAwB,QAAQC,mCAAa;IAAS,SAAS,0BAA0B;;AAC1I,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WACAb,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;AAIV,SAAOa,0CAAwB;GAC7B,SAAS,KAAK;GACd,eAAehB,+BAAY;GAC3B,mBAAmB;GACnB;KACC,MAAK,cAAa;GACnB,MAAM,QAAQ,UAAU,KAAI,aAAY,SAAS,eAAe,KAAK;AACrE,YAAS,UAAU;IACjB,MAAM;IACN,OAAOc,kCAAY;IACnB,QAAQC,mCAAa;IACrB,SAAS,0BAA0B;;AAErC,UAAO;;;;;;;CAQX,MAAM,uBAAuB,EAC3B,eACA,YACA,SACA,WAMwB;EACxB,MAAM,UAAU,MAAM,KAAK,wBAAwB;GACjD;GACA,cAAc,CACZ;IACE;IACA;;GAGJ;;AAEF,SAAO,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDjB,MAAM,4BAA4B,EAAE,eAAe,cAAc,WAI5B;AAEnC,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B;GACpD,MAAM,MAAM,aAAa,KAAK,OAAO;IAAE,YAAY,EAAE;IAAY,SAAS,EAAE;;GAC5E,MAAM,SAAS,MAAM,OAAO,4BAA4B;IACtD;IACA,cAAc;IACd,SAAS;KACP,YAAY,QAAQ;KACpB,SAAS,QAAQ;KACjB,oBAAoB,QAAQ;KAC5B,eAAe,QAAQ;;;GAG3B,MAAME,MAA+B,MAAM,QAAQ,UAAU,SAAS;AACtE,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WACAf,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;AAIV,SAAOe,8CAA4B;GACjC,SAAS,KAAK;GACd,eAAelB,+BAAY;GAC3B,mBAAmB;GACnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCJ,MAAM,gBAAgB,EAAE,mBAAmB,WAGjB;AAExB,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK;GAC1B,MAAM,MAAM,MAAM,OAAO,gBAAgB;IACvC;IACA,SAAS;KACP,SAAS,SAAS;KAClB,GAAI,WAAY,eAAe,UAC3B,EAAE,WAAW,QAAQ,cACrB;;;AAGR,SAAM,SAAS,YAAY,MAAM;AACjC,YAAS,UAAU;IAAE,MAAM;IAAG,OAAOc,kCAAY;IAAwB,QAAQC,mCAAa;IAAS,SAAS,eAAe,KAAK,cAAc;;AAClJ,UAAO;WACAb,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;AAIV,SAAOgB,kCAAgB;GAAE,SAAS,KAAK;GAAc;GAAmB;KACrE,MAAK,aAAY;AAChB,YAAS,UAAU;IAAE,MAAM;IAAG,OAAOL,kCAAY;IAAwB,QAAQC,mCAAa;IAAS,SAAS,eAAe,SAAS,cAAc;;AACtJ,UAAO;;;CAQb,MAAM,mBAAmB,EACvB,eACA,UACA,WAKoC;AAEpC,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B;GACpD,MAAM,SAAS,MAAM,OAAO,mBAAmB;IAC7C;IACA;IACA,SAAS;KACP,YAAY,QAAQ;KACpB,SAAS,QAAQ;KACjB,oBAAoB,QAAQ;KAC5B,eAAe,QAAQ;;;AAG3B,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WACAb,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;EAIV,MAAM,EAAE,uBAAuB,2CAAM;AACrC,SAAO,mBAAmB;GACxB,SAAS,KAAK;GACd,eAAeH,+BAAY;GAC3B;GACA;;;;;;;CAQJ,MAAM,6BAA6B,MAMF;EAC/B,MAAM,OAAO,KAAK,WAAW,QAAQ,QAAQ;EAC7C,MAAM,SAAS,KAAK,QAAQ,SAAS,uBAAuB,oBAAoB,QAAQ,QAAQ;EAChG,MAAM,WAAW,GAAG,OAAO;EAC3B,MAAM,EAAE,iCAAiC,2CAAM;AAC/C,SAAO,6BAA6B;GAClC,KAAK;GACL,SAAS;IACP,MAAM,KAAK;IACX,gBAAgB,KAAK;;GAEvB,QAAQ,KAAK;GACb,SAAS,KAAK;;;;;;;CAQlB,MAAM,0BAA0B,MAMa;EAC3C,MAAM,EAAE,eAAe,UAAU,YAAY,QAAQ,YAAY;EAEjE,MAAMoB,cAAsD,UACxD;GACA,YAAY,QAAQ;GACpB,SAAS,QAAQ;GACjB,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB,oBAAoB,QAAQ;GAC5B,eAAe,QAAQ;GAEvB,iBAAiB;MAEjB;EAEJ,IAAIC;AACJ,MAAI;AACF,gBAAa,MAAM,KAAK,mBAAmB;IACzC;IACA;IACA,SAAS;;WAEJ,OAAO;AACd,SAAM,SAAS,YAAY;AAC3B,SAAM;;EAGR,MAAMC,eAAsD,UACxD;GACA,SAAS,QAAQ;GACjB,SAAS,QAAQ;MAEjB;EAEJ,IAAIC;AACJ,MAAI;AACF,iBAAc,MAAM,KAAK,6BAA6B;IACpD;IACA,MAAM,WAAW;IACjB,gBAAgB,WAAW;IAC3B;IACA,SAAS;;WAEJ,OAAO;AACd,SAAM,SAAS,YAAY;AAC3B,SAAM;;EAGR,MAAMC,WAA4C;GAChD;GACA;;EAGF,MAAM,UAAU,YAAY,OAAO;AACnC,MAAI,QACF,OAAM,SAAS,YAAY,MAAM;MAEjC,OAAM,SAAS,YAAY;AAE7B,SAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCT,MAAM,kBAAkB,MAIa;AAEnC,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B,KAAK;GACzD,MAAM,SAAS,MAAM,OAAO,kBAAkB;IAC5C,eAAe,KAAK;IACpB,SAAS,KAAK,OAAO;IACrB,WAAW,KAAK,OAAO;IACvB,OAAO,KAAK,OAAO;IACnB,SAAS;KACP,YAAY,KAAK,QAAQ;KACzB,SAAS,KAAK,QAAQ;KACtB,eAAe,KAAK,QAAQ;KAC5B,oBAAoB,KAAK,QAAQ;;;AAGrC,SAAM,KAAK,SAAS,YAAY,MAAM;AAEtC,UAAO;WACAtB,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,KAAK,SAAS,UAAU;AAC9B,SAAM,KAAK,SAAS,YAAY;AAChC,SAAM;;EAIV,MAAM,EAAE,sBAAsB,2CAAM;EACpC,MAAM,MAAM,MAAM,kBAAkB;GAClC,SAAS,KAAK;GACd,eAAeH,+BAAY,KAAK;GAChC,QAAQ,KAAK;GACb,SAAS,KAAK;;AAEhB,MAAI,KAAK,QACP,OAAM,KAAK,SAAS,YAAY,MAAM;MAEtC,OAAM,KAAK,SAAS,YAAY;AAElC,SAAO;;;;;;;;CAaT,MAAM,wBACJ,eACA,SACe;AACf,MAAIyB,4BAEF,OAAMC,kCAAkB;GACtB,WAAW;GACX,YAAY,KAAK,cAAc,mBAAmB,KAAK,KAAK;GAC5D,cAAc,KAAK,SAAS,cAAc;GAC1C,QAAQ;;OAEL;AAEL,OAAI,KAAK,cAAc,aAAa;AAClC,UAAM,KAAK,aAAa,wBAAwB,eAAe;AAC/D;;GAIF,MAAM,aAAa,KAAK,cAAc,mBAAmB,KAAK,KAAK;GACnE,MAAM,eAAe,KAAK,SAAS,cAAc;AACjD,OAAI,cAAc,cAAc;AAC9B,UAAMA,kCAAkB;KAAE,WAAW;KAAe;KAAY;KAAc,QAAQ;;AACtF;;AAGF,SAAM,KAAK,gBAAgB,wBAAwB1B,+BAAY,gBAAgB;;;;CASnF,MAAM,kBACJ,eACA,MACe;AACf,MAAI,KAAK,yBAAyB;GAChC,IAAI2B;AACJ,OAAI;AACF,aAAS,MAAM,KAAK;WACd;AACN,UAAM,IAAI,MAAM;;AAElB,UAAO,MAAM,OAAO,kBAAkB;IAAE;IAAe;;;AAEzD,QAAMC,uCAAuB,kBAAkB5B,+BAAY,gBAAgB;;;CAI7E,MAAM,wBACJ,eACA,MACsC;AACtC,MAAI,KAAK,yBAAyB;GAChC,IAAI2B;AACJ,OAAI;AACF,aAAS,MAAM,KAAK;WACd;AACN,UAAM,IAAI,MAAM;;AAElB,UAAO,MAAM,OAAO,wBAAwB;IAAE;IAAe;;;AAE/D,SAAO,MAAMC,uCAAuB,wBAAwB5B,+BAAY,gBAAgB;;;CAI1F,MAAM,kBACJ,eACA,MACwB;AACxB,MAAI,KAAK,yBAAyB;GAChC,IAAI2B;AACJ,OAAI;AACF,aAAS,MAAM,KAAK;WACd;AACN,UAAM,IAAI,MAAM;;AAElB,UAAO,MAAM,OAAO,kBAAkB;IAAE;IAAe;;;AAEzD,SAAO,MAAMC,uCAAuB,kBAAkB5B,+BAAY,gBAAgB;;;;;;;;;CAcpF,MAAM,kBAAkB,eAA2E;AACjG,MAAI,KAAK,yBAAyB;GAChC,IAAI2B;AACJ,OAAI;AACF,aAAS,MAAM,KAAK,0BAA0B;WACxC;AACN,UAAM,IAAI,MAAM;;AAElB,UAAO,MAAM,OAAO,kBAAkB;;EAExC,MAAM,YAAY3B,+BAAY;EAG9B,MAAM,EAAE,uCAAuC,2CAAM;EACrD,MAAM,EAAE,wBAAwB,eAAe,2CAAM;EAGrD,MAAM,YAAY,MAAM,mCAAmC,KAAK,YAAY;AAC5E,MAAI,CAAC,UAAU,OACb,QAAO;EAIT,IAAI6B,QAA+B;AACnC,MAAI;AACF,WAAQ,MAAM,uBAAuB;WAC9B,OAAO;AACd,WAAQ,KAAK,wDAAwD;;EAGvE,MAAM,iCAAiB,IAAI;AAC3B,OAAK,MAAM,OAAO,OAAO;AACvB,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,MAAO;AAClC,OAAI,CAAC,eAAe,IAAI,IAAI,SAC1B,gBAAe,IAAI,IAAI,SAAS,IAAI;;AAIxC,SAAO,UAAU,KAAI,cAAa;GAChC,MAAM,UAAU,WAAW;GAC3B,MAAM,QAAQ,eAAe,IAAI,YAAY;AAC7C,UAAO;IAAE;IAAS;;;;;;;;;;;CAWtB,MAAM,kBACJ,eACA,gBACA,SACuB;AACvB,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK,0BAA0B;GACpD,MAAM,MAAM,MAAM,OAAO,kBAAkB;IAAE;IAAe;IAAgB;;AAC5E,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WACA3B,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;EAGV,MAAM,YAAYH,+BAAY;EAG9B,MAAM,EAAE,0BAA0B,2CAAM;EACxC,MAAM,EAAE,kCAAkC,2CAAM;EAGhD,MAAM,EAAE,QAAQ,wBAAwB,MAAM,sBAAsB,WAAW;EAE/E,MAAM8B,UAAwB,MAAM,8BAClC,KAAK,YACL,WACA,qBACA,KAAK,QAAQ;AAIf,SAAO,KAAK,cAAc;GACxB;GACA,YAAY;GACZ,YAAY;GACZ;;;;;;CAWH,MAAM,YAAY,MAGa;EAE9B,MAAM,iBAAiB,MAAM,aAAa;EACzC,MAAM,UAAU,MAAM;AACtB,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK;GAC1B,MAAM,MAAM,MAAM,OAAO,YAAY;IACnC,WAAW;IACX,SAAS,SAAS;;AAEpB,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WACD5B,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;AAKT,MAAI;GACF,MAAM,EAAE,uCAAoB,2CAAM;GAClC,MAAM,OAAO,IAAI4B,kBAAgB,KAAK,cAAc;GAEpD,MAAM,aAAa,MAAM,KAAK,SAAS,kBAAkB;AACzD,OAAI,CAAC,MAAM,QAAQ,eAAe,WAAW,WAAW,GAAG;IACzD,MAAM,sBAAM,IAAI,MAAM;AACtB,UAAM,SAAS,UAAU;AACzB,UAAM,SAAS,YAAY;AAC3B,WAAO;KAAE,SAAS;KAAO,WAAW,kBAAkB;KAAI,WAAW;KAAI,SAAS,IAAI;KAAS,OAAO,IAAI;;;GAI7G,MAAM,WAAW,WAAW;GAG3B,MAAM,SAAS,MAAM,KAAK,KAAK;IAC7B,cAAc,SAAS;IACvB,WAAW,SAAS;;AAGvB,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WAEA7B,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;;CASV,MAAc,wBAAwB,SAAoC;EACxE,MAAM,EAAE,sBAAsB,2CAAM;AACpC,MAAI,CAAC,KAAK,wBACR,MAAK,0BAA0B,IAAI,kBAAkB,KAAK,cAAc;WAC/D,QACT,MAAK,wBAAwB,WAAW;AAE1C,SAAO,KAAK;;CAGd,MAAM,mBAAmB,MAGiC;EACxD,MAAM,EAAE,WAAW,YAAY;AAC/B,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK;GAC1B,MAAM,gBAAgB,SAAS;GAC/B,MAAM,qBAAqB,SAAS;GACpC,MAAM,cAAc;IAClB,GAAI,gBAAgB,EAAE,kBAAkB;IACxC,GAAI,qBAAqB,EAAE,uBAAuB;;GAEpD,MAAM,MAAM,MAAM,OAAO,mBAAmB;IAC1C;IACA,SAAS,SAAS;IAClB,SAAS,OAAO,KAAK,aAAa,SAAS,IAAI,cAAc;;AAE/D,SAAM,SAAS,YAAY,MAAM;AACjC,UAAO;WACAD,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;EAGV,MAAM,OAAO,MAAM,KAAK,wBAAwB;AAChD,SAAO,MAAM,KAAK,MAAM,EAAE;;CAG5B,MAAM,sBAAsB,MAIV;EAChB,MAAM,EAAE,WAAW,eAAe,YAAY;AAC9C,MAAI,KAAK,wBACP,KAAI;GACF,MAAM,SAAS,MAAM,KAAK;AAC1B,SAAM,OAAO,sBAAsB;IACjC;IACA;IACA,SAAS,SAAS;;AAEpB,SAAM,SAAS,YAAY,MAAM;AACjC;WACOD,OAAgB;GACvB,MAAM,IAAIC,uBAAQ;AAClB,SAAM,SAAS,UAAU;AACzB,SAAM,SAAS,YAAY;AAC3B,SAAM;;EAGV,MAAM,OAAO,MAAM,KAAK,wBAAwB;AAChD,QAAM,KAAK,SAAS;GAAE;GAAW;;;;;;;CAOnC,MAAM,oBAAoB,MAAsE;EAC9F,MAAM,EAAE,WAAW,kBAAkB,QAAQ;AAE7C,MAAI,KAAK,yBAAyB;AAChC,OAAI;IACF,MAAM,SAAS,MAAM,KAAK;AAC1B,UAAM,OAAO,kBAAkB;KAAE;KAAW;;WACtC;AACR;;AAGF,MAAI;AACF,SAAM,KAAK,yBAAyB,eAAe;IAAE;IAAW;;UAC1D;AACR,OAAK,0BAA0B;;;;;;;CAYjC,MAAM,wBAAwB,MAA4E;AAExG,MAAI,KAAK,yBAAyB;GAChC,MAAM,SAAS,MAAM,KAAK;GAC1B,MAAM,UAAU,MAAM;AACtB,UAAO,MAAM,OAAO,wBAAwB;IAC1C,IAAI,MAAM;IACV,UAAU,MAAM;IAChB;;;AAIJ,OAAK,sBAAsB;EAC3B,MAAM,EAAE,mBAAmB,2CAAM;EACjC,MAAM,OAAO,IAAI,eAAe,KAAK,cAAc;GACjD,UAAU,MAAM;GAChB,SAAS,MAAM;;AAEjB,OAAK,uBAAuB;EAC5B,MAAM,EAAE,QAAQ,kBAAkB,MAAM,KAAK;AAC7C,SAAO;GAAE;GAAQ;;;;;;CAMnB,MAAM,yBAAwC;AAC5C,MAAI,KAAK,yBAAyB;AAChC,OAAI;IACF,MAAM,SAAS,MAAM,KAAK;AAC1B,UAAM,OAAO;WACP;AACR;;AAEF,MAAI,KAAK,cAAc;AACrB,SAAM,KAAK,aAAa;AACxB;;AAEF,OAAK,sBAAsB;AAC3B,OAAK,uBAAuB;;;;;;;;;;;CAY9B,MAAM,4BACJ,QACA,SAC2B;AAE3B,MAAI,KAAK,yBAAyB;GAChC,MAAM,SAAS,MAAM,KAAK;GAC1B,MAAM,MAAM,MAAM,OAAO,4BAA4B;IACnD;IACA,eAAe,QAAQ;IACvB,SAAS;KACP,SAAS,QAAQ;KACjB,oBAAoB,QAAQ;KAC5B,eAAe,QAAQ;;;AAG3B,UAAO;;EAET,MAAM,EAAE,gCAAgC,2CAAM;AAC9C,SAAO,4BAA4B,KAAK,cAAc,QAAQ;;;;;CAMhE,MAAM,gBACJ,WACA,mBACA,SACuB;EAEvB,MAAM,WAAW,KAAK,eAClB,MAAM,KAAK,aAAa,kBAAkB,aAC1C,MAAM,KAAK,WAAW,kBAAkBH,+BAAY;AACxD,MAAI,SAAS,KAAK,UAAU,EAC1B,OAAM,IAAI,MAAM;EAIlB,MAAM,cAAc,SAAS,KAAK,MAAM,MAA8B,EAAE,eAAe;AACvF,MAAI,CAAC,YACH,OAAM,IAAI,MAAM,cAAc,kBAAkB,wBAAwB;AAI1E,SAAO,KAAK,cAAc;GACxB,eAAe;GACf,YAAY;GACZ,YAAY;IACV,MAAMgC,2BAAW;IACjB,WAAW;;GAEJ"}

package/dist/cjs/core/TatchiPasskey/linkDevice.js CHANGED Viewed

@@ -1,24 +1,17 @@
-const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.js');
+const require_validation = require('../../utils/validation.js');
+const require_participants = require('../../threshold/participants.js');
 const require_index = require('../IndexedDBManager/index.js');
+const require_rpc = require('../types/rpc.js');
 const require_config = require('../../config.js');
 const require_sdkSentEvents = require('../types/sdkSentEvents.js');
 const require_actions = require('../types/actions.js');
-const require_rpc = require('../types/rpc.js');
 const require_rpcCalls = require('../rpcCalls.js');
 const require_getDeviceNumber = require('../WebAuthnManager/SignerWorkerManager/getDeviceNumber.js');
+const require_linkDevice = require('../types/linkDevice.js');
 const require_nearCrypto = require('../nearCrypto.js');
 const require_login = require('./login.js');
-const require_linkDevice = require('../types/linkDevice.js');
 //#region src/core/TatchiPasskey/linkDevice.ts
-require_nearCrypto.init_nearCrypto();
-require_index.init_IndexedDBManager();
-require_actions.init_actions();
-require_login.init_login();
-require_rpc.init_rpc();
-require_rpcCalls.init_rpcCalls();
-require_sdkSentEvents.init_sdkSentEvents();
-require_getDeviceNumber.init_getDeviceNumber();
 async function generateQRCodeDataURL(data) {
 	const { default: QRCode } = await import("qrcode");
 	return QRCode.toDataURL(data, {
@@ -352,7 +345,15 @@ var LinkDeviceFlow = class {
 			deviceNumber: this.session.deviceNumber
 		});
 		if (!registrationResult.success || !registrationResult.signedTransaction) throw new Error(registrationResult.error || "Device2 registration failed");
-		await this.context.nearClient.sendTransaction(registrationResult.signedTransaction, require_rpc.DEFAULT_WAIT_STATUS.linkDeviceRegistration);
+		const registrationOutcome = await this.context.nearClient.sendTransaction(registrationResult.signedTransaction, require_rpc.DEFAULT_WAIT_STATUS.linkDeviceRegistration);
+		const registrationTxHash = registrationOutcome?.transaction?.hash;
+		if (typeof registrationTxHash !== "string" || !registrationTxHash.trim()) throw new Error("Missing link_device_register_user transaction hash after broadcast");
+		await this.activateThresholdEnrollment({
+			accountId: realAccountId,
+			credential: deterministicKeysResult.credential,
+			deviceNumber: this.session.deviceNumber,
+			registrationTxHash
+		});
 		this.session.phase = require_sdkSentEvents.DeviceLinkingPhase.STEP_7_LINKING_COMPLETE;
 		this.registrationRetryCount = 0;
 		this.safeOnEvent({
@@ -363,6 +364,74 @@ var LinkDeviceFlow = class {
 		});
 		await this.attemptAutoLogin(deterministicKeysResult, this.options);
 	}
+	async activateThresholdEnrollment(args) {
+		const deviceNumber = require_getDeviceNumber.parseDeviceNumber(args.deviceNumber, { min: 1 });
+		if (deviceNumber === null) throw new Error(`Invalid deviceNumber for threshold enrollment: ${String(args.deviceNumber)}`);
+		try {
+			await this.context.webAuthnManager.setLastUser(args.accountId, deviceNumber);
+		} catch {}
+		const existing = await require_index.IndexedDBManager.nearKeysDB.getThresholdKeyMaterial(args.accountId, deviceNumber);
+		if (existing) return;
+		const relayerUrl = String(this.context.configs.relayer.url || "").trim();
+		if (!relayerUrl) throw new Error("Missing configs.relayer.url (required for threshold enrollment)");
+		const localKeyMaterial = await require_index.IndexedDBManager.nearKeysDB.getLocalKeyMaterial(args.accountId, deviceNumber);
+		if (!localKeyMaterial) throw new Error(`Missing local key material for ${String(args.accountId)} device ${deviceNumber}`);
+		const derived = await this.context.webAuthnManager.deriveThresholdEd25519ClientVerifyingShareFromCredential({
+			credential: args.credential,
+			nearAccountId: args.accountId,
+			wrapKeySalt: localKeyMaterial.wrapKeySalt
+		});
+		if (!derived.success) throw new Error(derived.error || "Failed to derive threshold client verifying share");
+		const keygen = await require_rpcCalls.thresholdEd25519KeygenFromRegistrationTx(relayerUrl, {
+			nearAccountId: args.accountId,
+			clientVerifyingShareB64u: derived.clientVerifyingShareB64u,
+			registrationTxHash: args.registrationTxHash
+		});
+		if (!keygen.ok) throw new Error(keygen.error || keygen.message || keygen.code || "Threshold registration keygen failed");
+		const thresholdPublicKey = require_validation.ensureEd25519Prefix(keygen.publicKey || "");
+		if (!thresholdPublicKey) throw new Error("Threshold registration keygen returned empty publicKey");
+		const relayerKeyId = String(keygen.relayerKeyId || "").trim();
+		if (!relayerKeyId) throw new Error("Threshold registration keygen returned empty relayerKeyId");
+		const relayerVerifyingShareB64u = String(keygen.relayerVerifyingShareB64u || "").trim();
+		if (!relayerVerifyingShareB64u) throw new Error("Threshold registration keygen returned empty relayerVerifyingShareB64u");
+		try {
+			this.context.webAuthnManager.getNonceManager().initializeUser(args.accountId, localKeyMaterial.publicKey);
+		} catch {}
+		const txContext = await this.context.webAuthnManager.getNonceManager().getNonceBlockHashAndHeight(this.context.nearClient, { force: true });
+		const signed = await this.context.webAuthnManager.signAddKeyThresholdPublicKeyNoPrompt({
+			nearAccountId: args.accountId,
+			credential: args.credential,
+			wrapKeySalt: localKeyMaterial.wrapKeySalt,
+			transactionContext: txContext,
+			thresholdPublicKey,
+			relayerVerifyingShareB64u,
+			clientParticipantId: keygen.clientParticipantId,
+			relayerParticipantId: keygen.relayerParticipantId,
+			deviceNumber
+		});
+		const signedTx = signed?.signedTransaction;
+		if (!signedTx) throw new Error("Failed to sign AddKey(thresholdPublicKey) transaction");
+		await this.context.nearClient.sendTransaction(signedTx, require_rpc.DEFAULT_WAIT_STATUS.thresholdAddKey);
+		await require_index.IndexedDBManager.nearKeysDB.storeKeyMaterial({
+			kind: "threshold_ed25519_2p_v1",
+			nearAccountId: String(args.accountId),
+			deviceNumber,
+			publicKey: thresholdPublicKey,
+			wrapKeySalt: derived.wrapKeySalt,
+			relayerKeyId,
+			clientShareDerivation: "prf_first_v1",
+			participants: require_participants.buildThresholdEd25519Participants2pV1({
+				clientParticipantId: keygen.clientParticipantId,
+				relayerParticipantId: keygen.relayerParticipantId,
+				relayerKeyId,
+				relayerUrl,
+				clientVerifyingShareB64u: derived.clientVerifyingShareB64u,
+				relayerVerifyingShareB64u,
+				clientShareDerivation: "prf_first_v1"
+			}),
+			timestamp: Date.now()
+		});
+	}
 	/**
 	* Check if an error is retryable (temporary issues that can be resolved)
 	*/
@@ -439,24 +508,10 @@ var LinkDeviceFlow = class {
 				console.log("LinkDeviceFlow: Shamir 3-pass unlock error, falling back to TouchID:", error);
 			}
 			try {
-				const nonceManager = this.context.webAuthnManager.getNonceManager();
-				const { nextNonce: _nextNonce, txBlockHash, txBlockHeight } = await nonceManager.getNonceBlockHashAndHeight(this.context.nearClient);
-				const authChallenge = await this.context.webAuthnManager.generateVrfChallengeOnce({
-					userId: accountId,
-					rpId: this.context.webAuthnManager.getRpId(),
-					blockHash: txBlockHash,
-					blockHeight: txBlockHeight
-				});
-				const authenticators = await this.context.webAuthnManager.getAuthenticatorsByUser(accountId);
-				const authCredential = await this.context.webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({
-					nearAccountId: accountId,
-					challenge: authChallenge,
-					credentialIds: authenticators.map((a) => a.credentialId)
-				});
 				const vrfUnlockResult = await this.context.webAuthnManager.unlockVRFKeypair({
 					nearAccountId: accountId,
 					encryptedVrfKeypair: deterministicKeysResult.encryptedVrfKeypair,
-					credential: authCredential
+					credential: sessionSnapshot.credential
 				});
 				if (!vrfUnlockResult.success) throw new Error(vrfUnlockResult.error || "VRF unlock failed during auto-login");
 				await this.context.webAuthnManager.initializeCurrentUser(accountId, this.context.nearClient);
@@ -578,7 +633,7 @@ var LinkDeviceFlow = class {
 		this.context.webAuthnManager.getNonceManager().initializeUser(realAccountId, nearKeyResultStep1.publicKey);
 		if (this.session?.tempPrivateKey) {
 			try {
-				await require_index.IndexedDBManager.nearKeysDB.deleteEncryptedKey("temp-device-linking.testnet");
+				await require_index.IndexedDBManager.nearKeysDB.deleteKeyMaterial("temp-device-linking.testnet");
 			} catch {}
 			this.cleanupTemporaryKeyFromMemory();
 		}
@@ -647,11 +702,11 @@ var LinkDeviceFlow = class {
 					await require_index.IndexedDBManager.clientDB.deleteUser(accountId);
 				} catch {}
 				try {
-					await require_index.IndexedDBManager.nearKeysDB.deleteEncryptedKey(accountId);
+					await require_index.IndexedDBManager.nearKeysDB.deleteKeyMaterial(accountId);
 				} catch {}
 			}
 			try {
-				await require_index.IndexedDBManager.nearKeysDB.deleteEncryptedKey("temp-device-linking.testnet");
+				await require_index.IndexedDBManager.nearKeysDB.deleteKeyMaterial("temp-device-linking.testnet");
 			} catch {}
 		} catch (error) {
 			console.error(`LinkDeviceFlow: Error during cleanup:`, error);