@tatchi-xyz/sdk 0.21.0 → 0.31.0

package/dist/esm/sdk/login-DnROv3eA.js

@@ -0,0 +1,1540 @@
+import { ensureEd25519Prefix, stripTrailingSlashes, toTrimmedString } from "./validation-BTq6LGPp.js";
+import { base64UrlDecode, base64UrlEncode } from "./base64-dqpWgddX.js";
+import { createRandomVRFChallenge } from "./vrf-worker-BzQsJ5BW.js";
+import { LoginPhase, LoginStatus } from "./sdkSentEvents-CzAZBFjP.js";
+import { alphabetizeStringify, computeLoginIntentDigest, sha256BytesUtf8 } from "./intentDigest-yivVENNK.js";
+import { getUserFriendlyErrorMessage } from "./errors-DevlT39D.js";
+import { IndexedDBManager, normalizeThresholdEd25519ParticipantIds } from "./IndexedDBManager-B1cUvdyY.js";
+import { removePrfOutputGuard } from "./safari-fallbacks-BcMFntiP.js";
+import { authenticatorsToAllowCredentials } from "./touchIdPrompt-JPhrOx8o.js";
+import { verifyAuthenticationResponse } from "./rpcCalls-B44MZora.js";
+import { parseDeviceNumber } from "./getDeviceNumber-y3mMtky6.js";
+
+//#region ../node_modules/.pnpm/base-x@5.0.1/node_modules/base-x/src/esm/index.js
+function base(ALPHABET$1) {
+	if (ALPHABET$1.length >= 255) throw new TypeError("Alphabet too long");
+	const BASE_MAP = new Uint8Array(256);
+	for (let j = 0; j < BASE_MAP.length; j++) BASE_MAP[j] = 255;
+	for (let i = 0; i < ALPHABET$1.length; i++) {
+		const x = ALPHABET$1.charAt(i);
+		const xc = x.charCodeAt(0);
+		if (BASE_MAP[xc] !== 255) throw new TypeError(x + " is ambiguous");
+		BASE_MAP[xc] = i;
+	}
+	const BASE = ALPHABET$1.length;
+	const LEADER = ALPHABET$1.charAt(0);
+	const FACTOR = Math.log(BASE) / Math.log(256);
+	const iFACTOR = Math.log(256) / Math.log(BASE);
+	function encode(source) {
+		if (source instanceof Uint8Array) {} else if (ArrayBuffer.isView(source)) source = new Uint8Array(source.buffer, source.byteOffset, source.byteLength);
+		else if (Array.isArray(source)) source = Uint8Array.from(source);
+		if (!(source instanceof Uint8Array)) throw new TypeError("Expected Uint8Array");
+		if (source.length === 0) return "";
+		let zeroes = 0;
+		let length = 0;
+		let pbegin = 0;
+		const pend = source.length;
+		while (pbegin !== pend && source[pbegin] === 0) {
+			pbegin++;
+			zeroes++;
+		}
+		const size = (pend - pbegin) * iFACTOR + 1 >>> 0;
+		const b58 = new Uint8Array(size);
+		while (pbegin !== pend) {
+			let carry = source[pbegin];
+			let i = 0;
+			for (let it1 = size - 1; (carry !== 0 || i < length) && it1 !== -1; it1--, i++) {
+				carry += 256 * b58[it1] >>> 0;
+				b58[it1] = carry % BASE >>> 0;
+				carry = carry / BASE >>> 0;
+			}
+			if (carry !== 0) throw new Error("Non-zero carry");
+			length = i;
+			pbegin++;
+		}
+		let it2 = size - length;
+		while (it2 !== size && b58[it2] === 0) it2++;
+		let str = LEADER.repeat(zeroes);
+		for (; it2 < size; ++it2) str += ALPHABET$1.charAt(b58[it2]);
+		return str;
+	}
+	function decodeUnsafe(source) {
+		if (typeof source !== "string") throw new TypeError("Expected String");
+		if (source.length === 0) return new Uint8Array();
+		let psz = 0;
+		let zeroes = 0;
+		let length = 0;
+		while (source[psz] === LEADER) {
+			zeroes++;
+			psz++;
+		}
+		const size = (source.length - psz) * FACTOR + 1 >>> 0;
+		const b256 = new Uint8Array(size);
+		while (psz < source.length) {
+			const charCode = source.charCodeAt(psz);
+			if (charCode > 255) return;
+			let carry = BASE_MAP[charCode];
+			if (carry === 255) return;
+			let i = 0;
+			for (let it3 = size - 1; (carry !== 0 || i < length) && it3 !== -1; it3--, i++) {
+				carry += BASE * b256[it3] >>> 0;
+				b256[it3] = carry % 256 >>> 0;
+				carry = carry / 256 >>> 0;
+			}
+			if (carry !== 0) throw new Error("Non-zero carry");
+			length = i;
+			psz++;
+		}
+		let it4 = size - length;
+		while (it4 !== size && b256[it4] === 0) it4++;
+		const vch = new Uint8Array(zeroes + (size - it4));
+		let j = zeroes;
+		while (it4 !== size) vch[j++] = b256[it4++];
+		return vch;
+	}
+	function decode(string) {
+		const buffer = decodeUnsafe(string);
+		if (buffer) return buffer;
+		throw new Error("Non-base" + BASE + " character");
+	}
+	return {
+		encode,
+		decodeUnsafe,
+		decode
+	};
+}
+var esm_default$1 = base;
+
+//#endregion
+//#region ../node_modules/.pnpm/bs58@6.0.0/node_modules/bs58/src/esm/index.js
+var ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var esm_default = esm_default$1(ALPHABET);
+
+//#endregion
+//#region src/core/threshold/thresholdEd25519AuthSession.ts
+const authSessionCache = /* @__PURE__ */ new Map();
+function makeThresholdEd25519AuthSessionCacheKey(args) {
+	const relayerUrl = stripTrailingSlashes(toTrimmedString(args.relayerUrl));
+	const participantIds = normalizeThresholdEd25519ParticipantIds(args.participantIds);
+	return [
+		String(args.nearAccountId || "").trim(),
+		String(args.rpId || "").trim(),
+		relayerUrl,
+		String(args.relayerKeyId || "").trim(),
+		...participantIds ? [participantIds.join(",")] : []
+	].join("|");
+}
+function getCachedThresholdEd25519AuthSession(cacheKey) {
+	const entry = authSessionCache.get(cacheKey);
+	if (!entry) return null;
+	if (typeof entry.expiresAtMs === "number" && Number.isFinite(entry.expiresAtMs) && Date.now() >= entry.expiresAtMs) {
+		authSessionCache.delete(cacheKey);
+		return null;
+	}
+	return entry;
+}
+function putCachedThresholdEd25519AuthSession(cacheKey, entry) {
+	authSessionCache.set(cacheKey, entry);
+}
+function clearCachedThresholdEd25519AuthSession(cacheKey) {
+	authSessionCache.delete(cacheKey);
+}
+function clearAllCachedThresholdEd25519AuthSessions() {
+	authSessionCache.clear();
+}
+function getCachedThresholdEd25519AuthSessionJwt(cacheKey) {
+	const cached = getCachedThresholdEd25519AuthSession(cacheKey);
+	const jwt = cached?.jwt;
+	if (typeof jwt === "string") {
+		const trimmed = jwt.trim();
+		if (trimmed) return trimmed;
+	}
+	if (cached) clearCachedThresholdEd25519AuthSession(cacheKey);
+	return void 0;
+}
+async function mintThresholdEd25519AuthSession(args) {
+	const relayerUrl = stripTrailingSlashes(toTrimmedString(args.relayerUrl));
+	if (!relayerUrl) return {
+		ok: false,
+		code: "invalid_args",
+		message: "Missing relayerUrl for threshold session mint"
+	};
+	if (typeof fetch !== "function") return {
+		ok: false,
+		code: "unsupported",
+		message: "fetch is not available for threshold session mint"
+	};
+	const toBytes = (b64u) => {
+		if (!b64u) return [];
+		return Array.from(base64UrlDecode(b64u));
+	};
+	const intent_digest_32 = toBytes(args.vrfChallenge.intentDigest);
+	if (intent_digest_32.length !== 32) return {
+		ok: false,
+		code: "invalid_args",
+		message: "Missing or invalid vrfChallenge.intentDigest (expected base64url 32 bytes)"
+	};
+	const clientVerifyingShareBytes = toBytes(args.clientVerifyingShareB64u);
+	if (clientVerifyingShareBytes.length !== 32) return {
+		ok: false,
+		code: "invalid_args",
+		message: "Missing or invalid clientVerifyingShareB64u (expected base64url 32 bytes)"
+	};
+	const session_policy_digest_32 = toBytes(args.vrfChallenge.sessionPolicyDigest32);
+	if (session_policy_digest_32.length !== 32) return {
+		ok: false,
+		code: "invalid_args",
+		message: "Missing vrfChallenge.sessionPolicyDigest32 (expected base64url 32 bytes) for threshold session mint"
+	};
+	const vrf_data = {
+		vrf_input_data: toBytes(args.vrfChallenge.vrfInput),
+		vrf_output: toBytes(args.vrfChallenge.vrfOutput),
+		vrf_proof: toBytes(args.vrfChallenge.vrfProof),
+		public_key: toBytes(args.vrfChallenge.vrfPublicKey),
+		user_id: args.vrfChallenge.userId,
+		rp_id: args.vrfChallenge.rpId,
+		block_height: Number(args.vrfChallenge.blockHeight || 0),
+		block_hash: toBytes(args.vrfChallenge.blockHash),
+		intent_digest_32,
+		session_policy_digest_32
+	};
+	const webauthn_authentication = removePrfOutputGuard(args.webauthnAuthentication);
+	try {
+		const url = `${relayerUrl}/threshold-ed25519/session`;
+		const response = await fetch(url, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			credentials: args.sessionKind === "cookie" ? "include" : "omit",
+			body: JSON.stringify({
+				sessionKind: args.sessionKind,
+				relayerKeyId: args.relayerKeyId,
+				clientVerifyingShareB64u: args.clientVerifyingShareB64u,
+				sessionPolicy: args.sessionPolicy,
+				vrf_data,
+				webauthn_authentication
+			})
+		});
+		const data = await response.json().catch(() => ({}));
+		if (!response.ok) return {
+			ok: false,
+			code: data.code || "http_error",
+			message: data.message || `HTTP ${response.status}`
+		};
+		const expiresAtMs = (() => {
+			const raw = data.expiresAt ? Date.parse(data.expiresAt) : NaN;
+			return Number.isFinite(raw) ? raw : void 0;
+		})();
+		return {
+			ok: data.ok === true,
+			sessionId: data.sessionId,
+			expiresAtMs,
+			remainingUses: data.remainingUses,
+			jwt: data.jwt,
+			...data.code ? { code: data.code } : {},
+			...data.message ? { message: data.message } : {}
+		};
+	} catch (e) {
+		const msg = String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to mint threshold session");
+		return {
+			ok: false,
+			code: "network_error",
+			message: msg
+		};
+	}
+}
+
+//#endregion
+//#region src/core/threshold/thresholdSessionPolicy.ts
+const THRESHOLD_SESSION_POLICY_VERSION = "threshold_session_v1";
+const THRESHOLD_SESSION_POLICY_MAX_TTL_MS = 10 * 6e4;
+const THRESHOLD_SESSION_POLICY_MAX_USES = 20;
+const DEFAULT_THRESHOLD_SESSION_POLICY = {
+	ttlMs: 5 * 6e4,
+	remainingUses: 5
+};
+function clampThresholdSessionPolicy(input) {
+	const ttlMs = Math.max(0, Math.floor(Number(input.ttlMs) || 0));
+	const remainingUses = Math.max(0, Math.floor(Number(input.remainingUses) || 0));
+	return {
+		ttlMs: Math.min(ttlMs, THRESHOLD_SESSION_POLICY_MAX_TTL_MS),
+		remainingUses: Math.min(remainingUses, THRESHOLD_SESSION_POLICY_MAX_USES)
+	};
+}
+function generateThresholdSessionId() {
+	const id = typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : `tsess-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+	return `tsess-${id}`;
+}
+async function computeThresholdSessionPolicyDigest32(policy) {
+	const json = alphabetizeStringify(policy);
+	const bytes = await sha256BytesUtf8(json);
+	return base64UrlEncode(bytes);
+}
+async function buildThresholdSessionPolicy(params) {
+	const sessionId = params.sessionId || generateThresholdSessionId();
+	const { ttlMs, remainingUses } = clampThresholdSessionPolicy({
+		ttlMs: params.ttlMs ?? DEFAULT_THRESHOLD_SESSION_POLICY.ttlMs,
+		remainingUses: params.remainingUses ?? DEFAULT_THRESHOLD_SESSION_POLICY.remainingUses
+	});
+	const participantIds = normalizeThresholdEd25519ParticipantIds(params.participantIds);
+	const policy = {
+		version: THRESHOLD_SESSION_POLICY_VERSION,
+		nearAccountId: params.nearAccountId,
+		rpId: params.rpId,
+		relayerKeyId: params.relayerKeyId,
+		sessionId,
+		...participantIds ? { participantIds } : {},
+		ttlMs,
+		remainingUses
+	};
+	const sessionPolicyDigest32 = await computeThresholdSessionPolicyDigest32(policy);
+	return {
+		policy,
+		policyJson: JSON.stringify(policy),
+		sessionPolicyDigest32
+	};
+}
+function isThresholdSessionAuthUnavailableError(err$1) {
+	const msg = err$1 instanceof Error ? err$1.message : String(err$1);
+	return msg.includes("no cached threshold session token") || msg.includes("relayer threshold session expired") || msg.includes("threshold session exhausted") || msg.includes("threshold session expired") || msg.includes("Missing or invalid threshold session token") || msg.includes("Invalid session token kind") || msg.includes("/authorize HTTP 401") || msg.includes("/authorize HTTP 403");
+}
+function isThresholdSignerMissingKeyError(err$1) {
+	const msg = (err$1 instanceof Error ? err$1.message : String(err$1)).toLowerCase();
+	return msg.includes("\"code\":\"missing_key\"") || msg.includes("missing_key") || msg.includes("unknown relayerkeyid") || msg.includes("call /threshold-ed25519/keygen");
+}
+
+//#endregion
+//#region ../node_modules/.pnpm/@noble+ed25519@2.3.0/node_modules/@noble/ed25519/index.js
+/*! noble-ed25519 - MIT License (c) 2019 Paul Miller (paulmillr.com) */
+/**
+* 4KB JS implementation of ed25519 EdDSA signatures.
+* Compliant with RFC8032, FIPS 186-5 & ZIP215.
+* @module
+* @example
+* ```js
+import * as ed from '@noble/ed25519';
+(async () => {
+const privKey = ed.utils.randomPrivateKey();
+const message = Uint8Array.from([0xab, 0xbc, 0xcd, 0xde]);
+const pubKey = await ed.getPublicKeyAsync(privKey); // Sync methods are also present
+const signature = await ed.signAsync(message, privKey);
+const isValid = await ed.verifyAsync(signature, message, pubKey);
+})();
+```
+*/
+/**
+* Curve params. ed25519 is twisted edwards curve. Equation is −x² + y² = -a + dx²y².
+* * P = `2n**255n - 19n` // field over which calculations are done
+* * N = `2n**252n + 27742317777372353535851937790883648493n` // group order, amount of curve points
+* * h = 8 // cofactor
+* * a = `Fp.create(BigInt(-1))` // equation param
+* * d = -121665/121666 a.k.a. `Fp.neg(121665 * Fp.inv(121666))` // equation param
+* * Gx, Gy are coordinates of Generator / base point
+*/
+const ed25519_CURVE = {
+	p: 57896044618658097711785492504343953926634992332820282019728792003956564819949n,
+	n: 7237005577332262213973186563042994240857116359379907606001950938285454250989n,
+	h: 8n,
+	a: 57896044618658097711785492504343953926634992332820282019728792003956564819948n,
+	d: 37095705934669439343138083508754565189542113879843219016388785533085940283555n,
+	Gx: 15112221349535400772501151409588531511454012693041857206046113283949847762202n,
+	Gy: 46316835694926478169428394003475163141307993866256225615783033603165251855960n
+};
+const { p: P, n: N, Gx, Gy, a: _a, d: _d } = ed25519_CURVE;
+const h = 8n;
+const L = 32;
+const L2 = 64;
+const err = (m = "") => {
+	throw new Error(m);
+};
+const isBig = (n) => typeof n === "bigint";
+const isStr = (s) => typeof s === "string";
+const isBytes = (a) => a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+/** assert is Uint8Array (of specific length) */
+const abytes = (a, l) => !isBytes(a) || typeof l === "number" && l > 0 && a.length !== l ? err("Uint8Array expected") : a;
+/** create Uint8Array */
+const u8n = (len) => new Uint8Array(len);
+const u8fr = (buf) => Uint8Array.from(buf);
+const padh = (n, pad) => n.toString(16).padStart(pad, "0");
+const bytesToHex = (b) => Array.from(abytes(b)).map((e) => padh(e, 2)).join("");
+const C = {
+	_0: 48,
+	_9: 57,
+	A: 65,
+	F: 70,
+	a: 97,
+	f: 102
+};
+const _ch = (ch) => {
+	if (ch >= C._0 && ch <= C._9) return ch - C._0;
+	if (ch >= C.A && ch <= C.F) return ch - (C.A - 10);
+	if (ch >= C.a && ch <= C.f) return ch - (C.a - 10);
+};
+const hexToBytes = (hex) => {
+	const e = "hex invalid";
+	if (!isStr(hex)) return err(e);
+	const hl = hex.length;
+	const al = hl / 2;
+	if (hl % 2) return err(e);
+	const array = u8n(al);
+	for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
+		const n1 = _ch(hex.charCodeAt(hi));
+		const n2 = _ch(hex.charCodeAt(hi + 1));
+		if (n1 === void 0 || n2 === void 0) return err(e);
+		array[ai] = n1 * 16 + n2;
+	}
+	return array;
+};
+/** normalize hex or ui8a to ui8a */
+const toU8 = (a, len) => abytes(isStr(a) ? hexToBytes(a) : u8fr(abytes(a)), len);
+const cr = () => globalThis?.crypto;
+const subtle = () => cr()?.subtle ?? err("crypto.subtle must be defined");
+const concatBytes = (...arrs) => {
+	const r = u8n(arrs.reduce((sum, a) => sum + abytes(a).length, 0));
+	let pad = 0;
+	arrs.forEach((a) => {
+		r.set(a, pad);
+		pad += a.length;
+	});
+	return r;
+};
+/** WebCrypto OS-level CSPRNG (random number generator). Will throw when not available. */
+const randomBytes = (len = L) => {
+	const c = cr();
+	return c.getRandomValues(u8n(len));
+};
+const big = BigInt;
+const arange = (n, min, max, msg = "bad number: out of range") => isBig(n) && min <= n && n < max ? n : err(msg);
+/** modular division */
+const M = (a, b = P) => {
+	const r = a % b;
+	return r >= 0n ? r : b + r;
+};
+const modN = (a) => M(a, N);
+/** Modular inversion using eucledian GCD (non-CT). No negative exponent for now. */
+const invert = (num, md) => {
+	if (num === 0n || md <= 0n) err("no inverse n=" + num + " mod=" + md);
+	let a = M(num, md), b = md, x = 0n, y = 1n, u = 1n, v = 0n;
+	while (a !== 0n) {
+		const q = b / a, r = b % a;
+		const m = x - u * q, n = y - v * q;
+		b = a, a = r, x = u, y = v, u = m, v = n;
+	}
+	return b === 1n ? M(x, md) : err("no inverse");
+};
+const callHash = (name) => {
+	const fn = etc[name];
+	if (typeof fn !== "function") err("hashes." + name + " not set");
+	return fn;
+};
+const apoint = (p) => p instanceof Point ? p : err("Point expected");
+const B256 = 2n ** 256n;
+/** Point in XYZT extended coordinates. */
+var Point = class Point {
+	static BASE;
+	static ZERO;
+	ex;
+	ey;
+	ez;
+	et;
+	constructor(ex, ey, ez, et) {
+		const max = B256;
+		this.ex = arange(ex, 0n, max);
+		this.ey = arange(ey, 0n, max);
+		this.ez = arange(ez, 1n, max);
+		this.et = arange(et, 0n, max);
+		Object.freeze(this);
+	}
+	static fromAffine(p) {
+		return new Point(p.x, p.y, 1n, M(p.x * p.y));
+	}
+	/** RFC8032 5.1.3: Uint8Array to Point. */
+	static fromBytes(hex, zip215 = false) {
+		const d = _d;
+		const normed = u8fr(abytes(hex, L));
+		const lastByte = hex[31];
+		normed[31] = lastByte & -129;
+		const y = bytesToNumLE(normed);
+		const max = zip215 ? B256 : P;
+		arange(y, 0n, max);
+		const y2 = M(y * y);
+		const u = M(y2 - 1n);
+		const v = M(d * y2 + 1n);
+		let { isValid, value: x } = uvRatio(u, v);
+		if (!isValid) err("bad point: y not sqrt");
+		const isXOdd = (x & 1n) === 1n;
+		const isLastByteOdd = (lastByte & 128) !== 0;
+		if (!zip215 && x === 0n && isLastByteOdd) err("bad point: x==0, isLastByteOdd");
+		if (isLastByteOdd !== isXOdd) x = M(-x);
+		return new Point(x, y, 1n, M(x * y));
+	}
+	/** Checks if the point is valid and on-curve. */
+	assertValidity() {
+		const a = _a;
+		const d = _d;
+		const p = this;
+		if (p.is0()) throw new Error("bad point: ZERO");
+		const { ex: X, ey: Y, ez: Z, et: T } = p;
+		const X2 = M(X * X);
+		const Y2 = M(Y * Y);
+		const Z2 = M(Z * Z);
+		const Z4 = M(Z2 * Z2);
+		const aX2 = M(X2 * a);
+		const left = M(Z2 * M(aX2 + Y2));
+		const right = M(Z4 + M(d * M(X2 * Y2)));
+		if (left !== right) throw new Error("bad point: equation left != right (1)");
+		const XY = M(X * Y);
+		const ZT = M(Z * T);
+		if (XY !== ZT) throw new Error("bad point: equation left != right (2)");
+		return this;
+	}
+	/** Equality check: compare points P&Q. */
+	equals(other) {
+		const { ex: X1, ey: Y1, ez: Z1 } = this;
+		const { ex: X2, ey: Y2, ez: Z2 } = apoint(other);
+		const X1Z2 = M(X1 * Z2);
+		const X2Z1 = M(X2 * Z1);
+		const Y1Z2 = M(Y1 * Z2);
+		const Y2Z1 = M(Y2 * Z1);
+		return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
+	}
+	is0() {
+		return this.equals(I);
+	}
+	/** Flip point over y coordinate. */
+	negate() {
+		return new Point(M(-this.ex), this.ey, this.ez, M(-this.et));
+	}
+	/** Point doubling. Complete formula. Cost: `4M + 4S + 1*a + 6add + 1*2`. */
+	double() {
+		const { ex: X1, ey: Y1, ez: Z1 } = this;
+		const a = _a;
+		const A = M(X1 * X1);
+		const B = M(Y1 * Y1);
+		const C$1 = M(2n * M(Z1 * Z1));
+		const D = M(a * A);
+		const x1y1 = X1 + Y1;
+		const E = M(M(x1y1 * x1y1) - A - B);
+		const G$1 = D + B;
+		const F = G$1 - C$1;
+		const H = D - B;
+		const X3 = M(E * F);
+		const Y3 = M(G$1 * H);
+		const T3 = M(E * H);
+		const Z3 = M(F * G$1);
+		return new Point(X3, Y3, Z3, T3);
+	}
+	/** Point addition. Complete formula. Cost: `8M + 1*k + 8add + 1*2`. */
+	add(other) {
+		const { ex: X1, ey: Y1, ez: Z1, et: T1 } = this;
+		const { ex: X2, ey: Y2, ez: Z2, et: T2 } = apoint(other);
+		const a = _a;
+		const d = _d;
+		const A = M(X1 * X2);
+		const B = M(Y1 * Y2);
+		const C$1 = M(T1 * d * T2);
+		const D = M(Z1 * Z2);
+		const E = M((X1 + Y1) * (X2 + Y2) - A - B);
+		const F = M(D - C$1);
+		const G$1 = M(D + C$1);
+		const H = M(B - a * A);
+		const X3 = M(E * F);
+		const Y3 = M(G$1 * H);
+		const T3 = M(E * H);
+		const Z3 = M(F * G$1);
+		return new Point(X3, Y3, Z3, T3);
+	}
+	/**
+	* Point-by-scalar multiplication. Scalar must be in range 1 <= n < CURVE.n.
+	* Uses {@link wNAF} for base point.
+	* Uses fake point to mitigate side-channel leakage.
+	* @param n scalar by which point is multiplied
+	* @param safe safe mode guards against timing attacks; unsafe mode is faster
+	*/
+	multiply(n, safe = true) {
+		if (!safe && (n === 0n || this.is0())) return I;
+		arange(n, 1n, N);
+		if (n === 1n) return this;
+		if (this.equals(G)) return wNAF(n).p;
+		let p = I;
+		let f = G;
+		for (let d = this; n > 0n; d = d.double(), n >>= 1n) if (n & 1n) p = p.add(d);
+		else if (safe) f = f.add(d);
+		return p;
+	}
+	/** Convert point to 2d xy affine point. (X, Y, Z) ∋ (x=X/Z, y=Y/Z) */
+	toAffine() {
+		const { ex: x, ey: y, ez: z } = this;
+		if (this.equals(I)) return {
+			x: 0n,
+			y: 1n
+		};
+		const iz = invert(z, P);
+		if (M(z * iz) !== 1n) err("invalid inverse");
+		return {
+			x: M(x * iz),
+			y: M(y * iz)
+		};
+	}
+	toBytes() {
+		const { x, y } = this.assertValidity().toAffine();
+		const b = numTo32bLE(y);
+		b[31] |= x & 1n ? 128 : 0;
+		return b;
+	}
+	toHex() {
+		return bytesToHex(this.toBytes());
+	}
+	clearCofactor() {
+		return this.multiply(big(h), false);
+	}
+	isSmallOrder() {
+		return this.clearCofactor().is0();
+	}
+	isTorsionFree() {
+		let p = this.multiply(N / 2n, false).double();
+		if (N % 2n) p = p.add(this);
+		return p.is0();
+	}
+	static fromHex(hex, zip215) {
+		return Point.fromBytes(toU8(hex), zip215);
+	}
+	get x() {
+		return this.toAffine().x;
+	}
+	get y() {
+		return this.toAffine().y;
+	}
+	toRawBytes() {
+		return this.toBytes();
+	}
+};
+/** Generator / base point */
+const G = new Point(Gx, Gy, 1n, M(Gx * Gy));
+/** Identity / zero point */
+const I = new Point(0n, 1n, 1n, 0n);
+Point.BASE = G;
+Point.ZERO = I;
+const numTo32bLE = (num) => hexToBytes(padh(arange(num, 0n, B256), L2)).reverse();
+const bytesToNumLE = (b) => big("0x" + bytesToHex(u8fr(abytes(b)).reverse()));
+const pow2 = (x, power) => {
+	let r = x;
+	while (power-- > 0n) {
+		r *= r;
+		r %= P;
+	}
+	return r;
+};
+const pow_2_252_3 = (x) => {
+	const x2 = x * x % P;
+	const b2 = x2 * x % P;
+	const b4 = pow2(b2, 2n) * b2 % P;
+	const b5 = pow2(b4, 1n) * x % P;
+	const b10 = pow2(b5, 5n) * b5 % P;
+	const b20 = pow2(b10, 10n) * b10 % P;
+	const b40 = pow2(b20, 20n) * b20 % P;
+	const b80 = pow2(b40, 40n) * b40 % P;
+	const b160 = pow2(b80, 80n) * b80 % P;
+	const b240 = pow2(b160, 80n) * b80 % P;
+	const b250 = pow2(b240, 10n) * b10 % P;
+	const pow_p_5_8 = pow2(b250, 2n) * x % P;
+	return {
+		pow_p_5_8,
+		b2
+	};
+};
+const RM1 = 19681161376707505956807079304988542015446066515923890162744021073123829784752n;
+const uvRatio = (u, v) => {
+	const v3 = M(v * v * v);
+	const v7 = M(v3 * v3 * v);
+	const pow = pow_2_252_3(u * v7).pow_p_5_8;
+	let x = M(u * v3 * pow);
+	const vx2 = M(v * x * x);
+	const root1 = x;
+	const root2 = M(x * RM1);
+	const useRoot1 = vx2 === u;
+	const useRoot2 = vx2 === M(-u);
+	const noRoot = vx2 === M(-u * RM1);
+	if (useRoot1) x = root1;
+	if (useRoot2 || noRoot) x = root2;
+	if ((M(x) & 1n) === 1n) x = M(-x);
+	return {
+		isValid: useRoot1 || useRoot2,
+		value: x
+	};
+};
+const modL_LE = (hash) => modN(bytesToNumLE(hash));
+const sha512a = (...m) => etc.sha512Async(...m);
+const sha512s = (...m) => callHash("sha512Sync")(...m);
+const hash2extK = (hashed) => {
+	const head = hashed.slice(0, L);
+	head[0] &= 248;
+	head[31] &= 127;
+	head[31] |= 64;
+	const prefix = hashed.slice(L, L2);
+	const scalar = modL_LE(head);
+	const point = G.multiply(scalar);
+	const pointBytes = point.toBytes();
+	return {
+		head,
+		prefix,
+		scalar,
+		point,
+		pointBytes
+	};
+};
+const getExtendedPublicKeyAsync = (priv) => sha512a(toU8(priv, L)).then(hash2extK);
+const getExtendedPublicKey = (priv) => hash2extK(sha512s(toU8(priv, L)));
+/** Creates 32-byte ed25519 public key from 32-byte private key. Async. */
+const getPublicKeyAsync = (priv) => getExtendedPublicKeyAsync(priv).then((p) => p.pointBytes);
+/** Math, hex, byte helpers. Not in `utils` because utils share API with noble-curves. */
+const etc = {
+	sha512Async: async (...messages) => {
+		const s = subtle();
+		const m = concatBytes(...messages);
+		return u8n(await s.digest("SHA-512", m.buffer));
+	},
+	sha512Sync: void 0,
+	bytesToHex,
+	hexToBytes,
+	concatBytes,
+	mod: M,
+	invert,
+	randomBytes
+};
+/** ed25519-specific key utilities. */
+const utils = {
+	getExtendedPublicKeyAsync,
+	getExtendedPublicKey,
+	randomPrivateKey: () => randomBytes(L),
+	precompute: (w = 8, p = G) => {
+		p.multiply(3n);
+		return p;
+	}
+};
+const W = 8;
+const scalarBits = 256;
+const pwindows = Math.ceil(scalarBits / W) + 1;
+const pwindowSize = 2 ** (W - 1);
+const precompute = () => {
+	const points = [];
+	let p = G;
+	let b = p;
+	for (let w = 0; w < pwindows; w++) {
+		b = p;
+		points.push(b);
+		for (let i = 1; i < pwindowSize; i++) {
+			b = b.add(p);
+			points.push(b);
+		}
+		p = b.double();
+	}
+	return points;
+};
+let Gpows = void 0;
+const ctneg = (cnd, p) => {
+	const n = p.negate();
+	return cnd ? n : p;
+};
+/**
+* Precomputes give 12x faster getPublicKey(), 10x sign(), 2x verify() by
+* caching multiples of G (base point). Cache is stored in 32MB of RAM.
+* Any time `G.multiply` is done, precomputes are used.
+* Not used for getSharedSecret, which instead multiplies random pubkey `P.multiply`.
+*
+* w-ary non-adjacent form (wNAF) precomputation method is 10% slower than windowed method,
+* but takes 2x less RAM. RAM reduction is possible by utilizing `.subtract`.
+*
+* !! Precomputes can be disabled by commenting-out call of the wNAF() inside Point#multiply().
+*/
+const wNAF = (n) => {
+	const comp = Gpows || (Gpows = precompute());
+	let p = I;
+	let f = G;
+	const pow_2_w = 2 ** W;
+	const maxNum = pow_2_w;
+	const mask = big(pow_2_w - 1);
+	const shiftBy = big(W);
+	for (let w = 0; w < pwindows; w++) {
+		let wbits = Number(n & mask);
+		n >>= shiftBy;
+		if (wbits > pwindowSize) {
+			wbits -= maxNum;
+			n += 1n;
+		}
+		const off = w * pwindowSize;
+		const offF = off;
+		const offP = off + Math.abs(wbits) - 1;
+		const isEven = w % 2 !== 0;
+		const isNeg = wbits < 0;
+		if (wbits === 0) f = f.add(ctneg(isEven, comp[offF]));
+		else p = p.add(ctneg(isNeg, comp[offP]));
+	}
+	return {
+		p,
+		f
+	};
+};
+
+//#endregion
+//#region src/core/nearCrypto.ts
+/**
+* Creates a NEAR-compatible Ed25519 keypair formatted as strings:
+* - publicKey:  'ed25519:' + base58(pub)
+* - privateKey: 'ed25519:' + base58(seed(32) | pub(32))
+*/
+async function createNearKeypair() {
+	const seed = utils.randomPrivateKey();
+	const pub = await getPublicKeyAsync(seed);
+	const secret = new Uint8Array(64);
+	secret.set(seed, 0);
+	secret.set(pub, 32);
+	const publicKey = ensureEd25519Prefix(esm_default.encode(pub));
+	const privateKey = ensureEd25519Prefix(esm_default.encode(secret));
+	return {
+		publicKey,
+		privateKey
+	};
+}
+
+//#endregion
+//#region src/core/TatchiPasskey/login.ts
+/**
+* Core login function that handles passkey authentication without React dependencies.
+*
+* - Unlocks the VRF keypair (Shamir 3‑pass auto‑unlock when possible; falls back to TouchID).
+* - Updates local login state and returns success with account/public key info.
+* - Optional: mints a server session when `options.session` is provided.
+*   - Generates a fresh, chain‑anchored VRF challenge (using latest block).
+*   - Collects a WebAuthn assertion over the VRF output and posts to the relay route
+*     (defaults to `/verify-authentication-response`).
+*   - When `kind: 'jwt'`, returns the token in `result.jwt`.
+*   - When `kind: 'cookie'`, the server sets an HttpOnly cookie and no JWT is returned.
+*/
+async function loginAndCreateSession(context, nearAccountId, options) {
+	const { onEvent, onError, afterCall } = options || {};
+	const { webAuthnManager } = context;
+	onEvent?.({
+		step: 1,
+		phase: LoginPhase.STEP_1_PREPARATION,
+		status: LoginStatus.PROGRESS,
+		message: `Starting login for ${nearAccountId}`
+	});
+	const prevStatus = await webAuthnManager.checkVrfStatus();
+	const prevVrfAccountId = prevStatus?.active ? prevStatus.nearAccountId : null;
+	const rollbackVrfOnFailure = async () => {
+		const status = await webAuthnManager.checkVrfStatus();
+		const current = status?.active ? status.nearAccountId : null;
+		if (current && current !== prevVrfAccountId) await logoutAndClearSession(context);
+	};
+	try {
+		if (!window.isSecureContext) {
+			const errorMessage = "Passkey operations require a secure context (HTTPS or localhost).";
+			return await finalizeLoginError({
+				message: errorMessage,
+				error: new Error(errorMessage),
+				rollbackVrfOnFailure,
+				onEvent,
+				onError,
+				afterCall,
+				callAfterCall: false
+			});
+		}
+		const session = options?.session;
+		const wantsServerSession = session !== void 0;
+		const deviceNumberHint = parseDeviceNumber(options?.deviceNumber, { min: 1 });
+		const base$1 = await handleLoginUnlockVRF(context, nearAccountId, onEvent, onError, afterCall, true, deviceNumberHint);
+		if (!base$1.result.success) return base$1.result;
+		const preferredDeviceNumber = deviceNumberHint ?? base$1.activeDeviceNumber;
+		const warmPolicy = resolveWarmSigningSessionPolicy(context, options);
+		const wantsThresholdSession = webAuthnManager.getUserPreferences().getSignerMode().mode === "threshold-signer";
+		const relayUrl = (session?.relayUrl || context.configs.relayer.url).trim();
+		const verifyRoute = (session?.route || "/verify-authentication-response").trim();
+		const thresholdPlan = await prepareThresholdSessionPlan({
+			context,
+			nearAccountId,
+			preferredDeviceNumber,
+			relayUrl,
+			ttlMs: warmPolicy.ttlMs,
+			remainingUses: warmPolicy.remainingUses,
+			wantsThresholdSession
+		});
+		const wantsRelayerSession = wantsServerSession || thresholdPlan !== null;
+		if (wantsRelayerSession && !relayUrl) console.warn("[login] No relayUrl provided for session-style signing");
+		if (wantsRelayerSession && relayUrl) return await runRelayerSessionFlow({
+			context,
+			nearAccountId,
+			baseLoginResult: base$1.result,
+			baseUnlockCredential: base$1.unlockCredential,
+			preferredDeviceNumber,
+			session,
+			relayUrl,
+			verifyRoute,
+			thresholdPlan,
+			warmPolicy,
+			rollbackVrfOnFailure,
+			onEvent,
+			onError,
+			afterCall
+		});
+		await mintWarmSigningSession({
+			context,
+			nearAccountId,
+			onEvent,
+			credential: base$1.unlockCredential,
+			ttlMs: warmPolicy.ttlMs,
+			remainingUses: warmPolicy.remainingUses
+		});
+		return await finalizeLoginSuccess({
+			webAuthnManager,
+			nearAccountId,
+			loginResult: base$1.result,
+			onEvent,
+			afterCall
+		});
+	} catch (err$1) {
+		const errorMessage = getUserFriendlyErrorMessage(err$1, "login") || err$1?.message || "Login failed";
+		return await finalizeLoginError({
+			message: errorMessage,
+			error: err$1,
+			rollbackVrfOnFailure,
+			onEvent,
+			onError,
+			afterCall
+		});
+	}
+}
+function resolveWarmSigningSessionPolicy(context, options) {
+	const defaults = context.configs.signingSessionDefaults;
+	return {
+		ttlMs: options?.signingSession?.ttlMs ?? defaults.ttlMs,
+		remainingUses: options?.signingSession?.remainingUses ?? defaults.remainingUses
+	};
+}
+async function attachSigningSessionStatus(args) {
+	const { webAuthnManager, nearAccountId, loginResult } = args;
+	if (!loginResult.success) return loginResult;
+	try {
+		const signingSession = await webAuthnManager.getWarmSigningSessionStatus(nearAccountId);
+		return {
+			...loginResult,
+			signingSession
+		};
+	} catch {
+		return loginResult;
+	}
+}
+async function finalizeLoginSuccess(args) {
+	const { webAuthnManager, nearAccountId, loginResult, onEvent, afterCall } = args;
+	const finalResult = await attachSigningSessionStatus({
+		webAuthnManager,
+		nearAccountId,
+		loginResult
+	});
+	onEvent?.({
+		step: 4,
+		phase: LoginPhase.STEP_4_LOGIN_COMPLETE,
+		status: LoginStatus.SUCCESS,
+		message: "Login completed successfully",
+		nearAccountId,
+		clientNearPublicKey: loginResult.clientNearPublicKey ?? ""
+	});
+	await afterCall?.(true, finalResult);
+	return finalResult;
+}
+async function finalizeLoginError(args) {
+	const { message, error, rollbackVrfOnFailure, onEvent, onError, afterCall, callOnError = true, callAfterCall = true } = args;
+	try {
+		await rollbackVrfOnFailure();
+	} catch {}
+	if (callOnError) onError?.(error);
+	onEvent?.({
+		step: 0,
+		phase: LoginPhase.LOGIN_ERROR,
+		status: LoginStatus.ERROR,
+		message,
+		error: message
+	});
+	if (callAfterCall) await afterCall?.(false);
+	return {
+		success: false,
+		error: message
+	};
+}
+async function prepareThresholdSessionPlan(args) {
+	const { context, nearAccountId, preferredDeviceNumber, relayUrl, ttlMs, remainingUses, wantsThresholdSession } = args;
+	if (!wantsThresholdSession || !relayUrl) return null;
+	const { webAuthnManager } = context;
+	try {
+		const rpId = webAuthnManager.getRpId();
+		if (!rpId) throw new Error("Missing rpId for threshold session");
+		const lastUser = await webAuthnManager.getLastUser();
+		const deviceNumber = preferredDeviceNumber ?? (lastUser?.nearAccountId === nearAccountId ? lastUser.deviceNumber : (await IndexedDBManager.clientDB.getLastDBUpdatedUser(nearAccountId))?.deviceNumber ?? null);
+		if (deviceNumber === null) {
+			console.warn("[login] threshold-signer configured but no threshold key material found; skipping threshold session");
+			return null;
+		}
+		const thresholdKeyMaterial = await IndexedDBManager.nearKeysDB.getThresholdKeyMaterial(nearAccountId, deviceNumber);
+		const relayerKeyId = thresholdKeyMaterial?.relayerKeyId || null;
+		const participantIds = thresholdKeyMaterial?.participants?.map((p) => p.id) || null;
+		const normalizedParticipantIds = normalizeThresholdEd25519ParticipantIds(participantIds);
+		if (!relayerKeyId) {
+			console.warn("[login] threshold-signer configured but no threshold key material found; skipping threshold session");
+			return null;
+		}
+		if (!normalizedParticipantIds || normalizedParticipantIds.length < 2) {
+			console.warn("[login] threshold key material missing/invalid participantIds; skipping threshold session mint");
+			return null;
+		}
+		const policy = await buildThresholdSessionPolicy({
+			nearAccountId,
+			rpId,
+			relayerKeyId,
+			...normalizedParticipantIds?.length ? { participantIds: normalizedParticipantIds } : {},
+			ttlMs,
+			remainingUses
+		});
+		const cacheKey = makeThresholdEd25519AuthSessionCacheKey({
+			nearAccountId,
+			rpId,
+			relayerUrl: relayUrl,
+			relayerKeyId,
+			...normalizedParticipantIds?.length ? { participantIds: normalizedParticipantIds } : {}
+		});
+		return {
+			sessionKind: "jwt",
+			relayerUrl: relayUrl,
+			relayerKeyId,
+			cacheKey,
+			policy,
+			deviceNumber
+		};
+	} catch (e) {
+		console.warn("[login] failed to prepare threshold session policy; skipping threshold session mint:", e?.message || e);
+		return null;
+	}
+}
+async function mintThresholdSessionBestEffort(args) {
+	const { context, nearAccountId, plan, vrfChallenge, credential } = args;
+	const { webAuthnManager } = context;
+	let clientVerifyingShareB64u = null;
+	try {
+		const localKeyMaterial = await IndexedDBManager.nearKeysDB.getLocalKeyMaterial(nearAccountId, plan.deviceNumber);
+		const wrapKeySalt = String(localKeyMaterial?.wrapKeySalt || "").trim();
+		if (wrapKeySalt) {
+			const derived = await webAuthnManager.deriveThresholdEd25519ClientVerifyingShareFromCredential({
+				credential,
+				nearAccountId,
+				wrapKeySalt
+			});
+			if (derived.success && derived.clientVerifyingShareB64u) clientVerifyingShareB64u = derived.clientVerifyingShareB64u;
+		}
+	} catch (e) {
+		console.warn("[login] failed to derive clientVerifyingShareB64u for threshold session mint:", e?.message || e);
+	}
+	if (!clientVerifyingShareB64u) {
+		console.warn("[login] threshold session mint skipped: missing clientVerifyingShareB64u");
+		return;
+	}
+	const minted = await mintThresholdEd25519AuthSession({
+		relayerUrl: plan.relayerUrl,
+		sessionKind: plan.sessionKind,
+		relayerKeyId: plan.relayerKeyId,
+		clientVerifyingShareB64u,
+		sessionPolicy: plan.policy.policy,
+		vrfChallenge,
+		webauthnAuthentication: credential
+	});
+	if (minted.ok && minted.jwt) {
+		putCachedThresholdEd25519AuthSession(plan.cacheKey, {
+			sessionKind: plan.sessionKind,
+			policy: plan.policy.policy,
+			policyJson: plan.policy.policyJson,
+			sessionPolicyDigest32: plan.policy.sessionPolicyDigest32,
+			jwt: minted.jwt,
+			...minted.expiresAtMs ? { expiresAtMs: minted.expiresAtMs } : {}
+		});
+		return;
+	}
+	if (!minted.ok) console.warn("[login] threshold session mint failed:", minted.code || minted.message || "unknown error");
+}
+async function runRelayerSessionFlow(args) {
+	const { context, nearAccountId, baseLoginResult, baseUnlockCredential, preferredDeviceNumber, session, relayUrl, verifyRoute, thresholdPlan, warmPolicy, rollbackVrfOnFailure, onEvent, onError, afterCall } = args;
+	const { webAuthnManager } = context;
+	try {
+		const rpId = webAuthnManager.getRpId();
+		if (!rpId) throw new Error("Missing rpId for VRF challenge generation during login");
+		const blockInfo = await context.nearClient.viewBlock({ finality: "final" });
+		const txBlockHash = blockInfo?.header?.hash;
+		const txBlockHeight = String(blockInfo.header?.height ?? "");
+		const intentDigest = await computeLoginIntentDigest({
+			nearAccountId,
+			rpId
+		});
+		const vrfChallenge = await webAuthnManager.generateVrfChallengeOnce({
+			userId: nearAccountId,
+			rpId,
+			blockHash: txBlockHash,
+			blockHeight: txBlockHeight,
+			intentDigest,
+			...thresholdPlan ? { sessionPolicyDigest32: thresholdPlan.policy.sessionPolicyDigest32 } : {}
+		});
+		const authenticators = await webAuthnManager.getAuthenticatorsByUser(nearAccountId);
+		const authenticatorsForPrompt = prioritizeAuthenticatorsByDeviceNumber(authenticators, preferredDeviceNumber);
+		const credential = await webAuthnManager.getAuthenticationCredentialsSerialized({
+			nearAccountId,
+			challenge: vrfChallenge,
+			allowCredentials: authenticatorsToAllowCredentials(authenticatorsForPrompt)
+		});
+		const effectiveLoginResult = await bindVrfToSelectedLoginPasskeyDevice({
+			webAuthnManager,
+			nearAccountId,
+			authenticators,
+			credential,
+			baseUnlockCredential,
+			baseLoginResult
+		});
+		await mintWarmSigningSession({
+			context,
+			nearAccountId,
+			onEvent,
+			credential,
+			ttlMs: warmPolicy.ttlMs,
+			remainingUses: warmPolicy.remainingUses
+		});
+		let serverSessionJwt;
+		if (session) {
+			const v = await verifyAuthenticationResponse(relayUrl, verifyRoute, session.kind, vrfChallenge, credential);
+			if (!v.success || !v.verified) {
+				const errMsg = v.error || "Session verification failed";
+				return await finalizeLoginError({
+					message: errMsg,
+					rollbackVrfOnFailure,
+					onEvent,
+					afterCall,
+					callOnError: false
+				});
+			}
+			serverSessionJwt = v.jwt;
+		}
+		if (thresholdPlan) await mintThresholdSessionBestEffort({
+			context,
+			nearAccountId,
+			plan: thresholdPlan,
+			vrfChallenge,
+			credential
+		});
+		const loginResult = serverSessionJwt ? {
+			...effectiveLoginResult,
+			jwt: serverSessionJwt
+		} : effectiveLoginResult;
+		return await finalizeLoginSuccess({
+			webAuthnManager,
+			nearAccountId,
+			loginResult,
+			onEvent,
+			afterCall
+		});
+	} catch (e) {
+		console.error("[login] Failed to start session:", e);
+		const errMsg = getUserFriendlyErrorMessage(e, "login") || e?.message || "Session verification failed";
+		return await finalizeLoginError({
+			message: errMsg,
+			error: e,
+			rollbackVrfOnFailure,
+			onEvent,
+			onError,
+			afterCall
+		});
+	}
+}
+/**
+* When multiple passkeys exist for the same account, the user can select any of them in the WebAuthn prompt.
+* If the VRF worker was auto-unlocked using a different device (e.g. Shamir 3-pass based on the "latest" row),
+* we must rebind the VRF worker to the same deviceNumber as the selected credential. Otherwise, WrapKeySeed
+* derivation can mix PRF.first(from selected credential) with vrf_sk(from a different device), which later
+* causes vault decryption failures (e.g. `aead::Error` during private key export).
+*/
+async function bindVrfToSelectedLoginPasskeyDevice(args) {
+	const { webAuthnManager, nearAccountId, authenticators, credential, baseUnlockCredential, baseLoginResult } = args;
+	let effectiveLoginResult = baseLoginResult;
+	if (authenticators.length <= 1) return effectiveLoginResult;
+	const rawId = credential.rawId;
+	const matched = authenticators.find((a) => a.credentialId === rawId);
+	const selectedDeviceNumber = matched?.deviceNumber ?? null;
+	if (selectedDeviceNumber === null) return effectiveLoginResult;
+	const userForDevice = await IndexedDBManager.clientDB.getUserByDevice(nearAccountId, selectedDeviceNumber).catch(() => null);
+	if (userForDevice?.clientNearPublicKey) effectiveLoginResult = {
+		...effectiveLoginResult,
+		clientNearPublicKey: userForDevice.clientNearPublicKey
+	};
+	const shouldRebindVrf = !baseUnlockCredential || baseUnlockCredential.rawId !== rawId;
+	if (shouldRebindVrf) {
+		const shamir = userForDevice?.serverEncryptedVrfKeypair;
+		if (!shamir?.ciphertextVrfB64u || !shamir?.kek_s_b64u || !shamir?.serverKeyId) throw new Error(`Missing serverEncryptedVrfKeypair for account ${nearAccountId} device ${selectedDeviceNumber}. Open the wallet once online to refresh local state, then try again.`);
+		const unlock = await webAuthnManager.shamir3PassDecryptVrfKeypair({
+			nearAccountId,
+			kek_s_b64u: shamir.kek_s_b64u,
+			ciphertextVrfB64u: shamir.ciphertextVrfB64u,
+			serverKeyId: shamir.serverKeyId
+		});
+		if (!unlock.success) throw new Error(unlock.error || "Failed to bind VRF keypair to the passkey you selected. Please try again.");
+	}
+	await webAuthnManager.setLastUser(nearAccountId, selectedDeviceNumber);
+	await webAuthnManager.updateLastLogin(nearAccountId).catch(() => void 0);
+	return effectiveLoginResult;
+}
+/**
+* Mint or refresh a "warm signing session" in the VRF worker.
+*
+* Notes:
+* - Reuses a previously collected WebAuthn credential when provided (e.g. TouchID fallback),
+*   to avoid prompting the user twice in a single login flow.
+* - Session TTL/remainingUses policy is enforced by the VRF worker.
+*/
+async function mintWarmSigningSession(args) {
+	const { context, nearAccountId, onEvent, credential, ttlMs, remainingUses } = args;
+	const { webAuthnManager } = context;
+	onEvent?.({
+		step: 3,
+		phase: LoginPhase.STEP_3_VRF_UNLOCK,
+		status: LoginStatus.PROGRESS,
+		message: "Unlocking warm signing session..."
+	});
+	let effectiveCredential = credential;
+	if (!effectiveCredential) {
+		const challenge = createRandomVRFChallenge();
+		const authenticators = await webAuthnManager.getAuthenticatorsByUser(nearAccountId);
+		const { authenticatorsForPrompt } = await IndexedDBManager.clientDB.ensureCurrentPasskey(nearAccountId, authenticators);
+		effectiveCredential = await webAuthnManager.getAuthenticationCredentialsSerialized({
+			nearAccountId,
+			challenge,
+			allowCredentials: authenticatorsToAllowCredentials(authenticatorsForPrompt)
+		});
+	}
+	await webAuthnManager.mintSigningSessionFromCredential({
+		nearAccountId,
+		credential: effectiveCredential,
+		ttlMs,
+		remainingUses
+	});
+	onEvent?.({
+		step: 3,
+		phase: LoginPhase.STEP_3_VRF_UNLOCK,
+		status: LoginStatus.SUCCESS,
+		message: "Warm signing session unlocked"
+	});
+}
+/**
+* Handle onchain (serverless) login using VRF flow per docs/vrf_challenges.md
+*
+* VRF AUTHENTICATION FLOW:
+* 1. Unlock VRF keypair in VRF Worker memory, either
+*      - Decrypt via Shamir 3-pass (when Relayer is present), or
+*      - Re-derive the VRF via credentials inside VRF worker dynamically
+* 2. Generate VRF challenge using stored VRF keypair + NEAR block data (no TouchID needed)
+* 3. Use VRF output as WebAuthn challenge for authentication
+* 4. Verify VRF proof and WebAuthn response on contract simultaneously
+*      - VRF proof assures WebAuthn challenge is fresh and valid (replay protection)
+*      - WebAuthn verification for origin + biometric credentials + device authenticity
+*/
+async function handleLoginUnlockVRF(context, nearAccountId, onEvent, onError, afterCall, deferCompletionHooks, deviceNumberHint = null) {
+	const { webAuthnManager } = context;
+	try {
+		const hintUserPromise = deviceNumberHint !== null ? webAuthnManager.getUserByDevice(nearAccountId, deviceNumberHint).catch(() => null) : Promise.resolve(null);
+		const [hintUser, lastUser, latestByAccount, authenticators] = await Promise.all([
+			hintUserPromise,
+			webAuthnManager.getLastUser(),
+			IndexedDBManager.clientDB.getLastDBUpdatedUser(nearAccountId),
+			webAuthnManager.getAuthenticatorsByUser(nearAccountId)
+		]);
+		let userData = null;
+		if (hintUser && hintUser.nearAccountId === nearAccountId) userData = hintUser;
+		else if (latestByAccount && latestByAccount.nearAccountId === nearAccountId) userData = latestByAccount;
+		else if (lastUser && lastUser.nearAccountId === nearAccountId) userData = lastUser;
+		else userData = await webAuthnManager.getUserByDevice(nearAccountId, 1);
+		if (!userData) throw new Error(`User data not found for ${nearAccountId} in IndexedDB. Please register an account.`);
+		if (!userData.clientNearPublicKey) throw new Error(`No NEAR public key found for ${nearAccountId}. Please register an account.`);
+		if (!userData.encryptedVrfKeypair?.encryptedVrfDataB64u || !userData.encryptedVrfKeypair?.chacha20NonceB64u) throw new Error("No VRF credentials found. Please register an account.");
+		if (authenticators.length === 0) throw new Error(`No authenticators found for account ${nearAccountId}. Please register.`);
+		onEvent?.({
+			step: 2,
+			phase: LoginPhase.STEP_2_WEBAUTHN_ASSERTION,
+			status: LoginStatus.PROGRESS,
+			message: "Unlocking VRF keys..."
+		});
+		let unlockResult = { success: false };
+		let usedFallbackTouchId = false;
+		let unlockCredential;
+		let activeDeviceNumber = userData.deviceNumber;
+		let effectiveUserData = userData;
+		const shamir = userData.serverEncryptedVrfKeypair;
+		const relayerUrl = context.configs.relayer?.url;
+		const useShamir3PassVRFKeyUnlock = !!relayerUrl && !!shamir?.serverKeyId;
+		if (useShamir3PassVRFKeyUnlock && shamir) try {
+			if (!shamir.ciphertextVrfB64u || !shamir.kek_s_b64u) throw new Error("Missing Shamir3Pass fields (ciphertextVrfB64u/kek_s_b64u)");
+			unlockResult = await webAuthnManager.shamir3PassDecryptVrfKeypair({
+				nearAccountId,
+				kek_s_b64u: shamir.kek_s_b64u,
+				ciphertextVrfB64u: shamir.ciphertextVrfB64u,
+				serverKeyId: shamir.serverKeyId
+			});
+			if (unlockResult.success) {
+				const vrfStatus = await webAuthnManager.checkVrfStatus();
+				const active = vrfStatus.active && vrfStatus.nearAccountId === nearAccountId;
+				if (!active) unlockResult = {
+					success: false,
+					error: "VRF session inactive after Shamir3Pass"
+				};
+				if (active) await webAuthnManager.maybeProactiveShamirRefresh(nearAccountId);
+			} else throw new Error(`Shamir3Pass auto-unlock failed: ${unlockResult.error}`);
+		} catch (error) {
+			unlockResult = {
+				success: false,
+				error: error.message
+			};
+		}
+		if (!unlockResult.success) {
+			const authenticatorsForPrompt = prioritizeAuthenticatorsByDeviceNumber(authenticators, deviceNumberHint);
+			const fallback = await fallbackUnlockVrfKeypairWithTouchId({
+				webAuthnManager,
+				nearAccountId,
+				authenticators: authenticatorsForPrompt,
+				userData,
+				onEvent
+			});
+			unlockResult = fallback.unlockResult;
+			usedFallbackTouchId = fallback.usedFallbackTouchId;
+			unlockCredential = fallback.unlockCredential;
+			effectiveUserData = fallback.effectiveUserData;
+			activeDeviceNumber = fallback.activeDeviceNumber;
+		}
+		if (!unlockResult.success) throw new Error(`Failed to unlock VRF keypair: ${unlockResult.error}`);
+		onEvent?.({
+			step: 3,
+			phase: LoginPhase.STEP_3_VRF_UNLOCK,
+			status: LoginStatus.SUCCESS,
+			message: "VRF keypair unlocked..."
+		});
+		try {
+			const relayerUrl$1 = context.configs.relayer?.url;
+			if (usedFallbackTouchId && relayerUrl$1) {
+				const refreshed = await webAuthnManager.shamir3PassEncryptCurrentVrfKeypair();
+				await webAuthnManager.updateServerEncryptedVrfKeypair(nearAccountId, refreshed);
+			}
+		} catch (refreshErr) {
+			console.warn("Non-fatal: Failed to refresh serverEncryptedVrfKeypair:", refreshErr?.message || refreshErr);
+		}
+		try {
+			await webAuthnManager.setLastUser(nearAccountId, activeDeviceNumber);
+		} catch {}
+		await webAuthnManager.updateLastLogin(nearAccountId);
+		const result = {
+			success: true,
+			loggedInNearAccountId: nearAccountId,
+			clientNearPublicKey: effectiveUserData.clientNearPublicKey,
+			nearAccountId
+		};
+		if (!deferCompletionHooks) {
+			onEvent?.({
+				step: 4,
+				phase: LoginPhase.STEP_4_LOGIN_COMPLETE,
+				status: LoginStatus.SUCCESS,
+				message: "Login completed successfully",
+				nearAccountId,
+				clientNearPublicKey: effectiveUserData.clientNearPublicKey
+			});
+			afterCall?.(true, result);
+		}
+		return {
+			result,
+			usedFallbackTouchId,
+			unlockCredential,
+			activeDeviceNumber
+		};
+	} catch (error) {
+		const errorMessage = getUserFriendlyErrorMessage(error, "login");
+		onError?.(error);
+		onEvent?.({
+			step: 0,
+			phase: LoginPhase.LOGIN_ERROR,
+			status: LoginStatus.ERROR,
+			message: errorMessage,
+			error: errorMessage
+		});
+		const result = {
+			success: false,
+			error: errorMessage
+		};
+		afterCall?.(false);
+		return {
+			result,
+			usedFallbackTouchId: false,
+			activeDeviceNumber: null
+		};
+	}
+}
+/**
+* TouchID fallback path for VRF unlock.
+*
+* Used when Shamir 3-pass auto-unlock fails/unavailable:
+* - Prompts WebAuthn to obtain a serialized credential with PRF.first + PRF.second.
+* - Aligns the local encrypted VRF keypair blob with the passkey the user actually chose
+*   (important when multiple devices/passkeys exist for the same account).
+* - Unlocks the VRF keypair inside the VRF worker and returns updated effective user context.
+*/
+async function fallbackUnlockVrfKeypairWithTouchId(args) {
+	const { webAuthnManager, nearAccountId, authenticators, userData, onEvent } = args;
+	onEvent?.({
+		step: 2,
+		phase: LoginPhase.STEP_2_WEBAUTHN_ASSERTION,
+		status: LoginStatus.PROGRESS,
+		message: "Logging in, unlocking VRF credentials..."
+	});
+	const challenge = createRandomVRFChallenge();
+	const credential = await webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({
+		nearAccountId,
+		challenge,
+		credentialIds: authenticators.map((a) => a.credentialId)
+	});
+	let effectiveUserData = userData;
+	let activeDeviceNumber = userData.deviceNumber;
+	if (authenticators.length > 1) {
+		const rawId = credential.rawId;
+		const matched = authenticators.find((a) => a.credentialId === rawId);
+		if (matched) try {
+			const byDevice = await IndexedDBManager.clientDB.getUserByDevice(nearAccountId, matched.deviceNumber);
+			if (byDevice) {
+				effectiveUserData = byDevice;
+				activeDeviceNumber = matched.deviceNumber;
+			}
+		} catch {}
+	}
+	const unlockResult = await webAuthnManager.unlockVRFKeypair({
+		nearAccountId,
+		encryptedVrfKeypair: {
+			encryptedVrfDataB64u: effectiveUserData.encryptedVrfKeypair.encryptedVrfDataB64u,
+			chacha20NonceB64u: effectiveUserData.encryptedVrfKeypair.chacha20NonceB64u
+		},
+		credential
+	});
+	return {
+		unlockResult,
+		usedFallbackTouchId: unlockResult.success,
+		unlockCredential: credential,
+		effectiveUserData,
+		activeDeviceNumber
+	};
+}
+/**
+* High-level login snapshot used by React contexts/UI.
+*
+* Returns:
+* - `login`: derived from IndexedDB last-user pointer + VRF worker status
+* - `signingSession`: warm signing session status when available
+*
+* The `nearAccountId` argument is treated as a "query hint" and must match the
+* last logged-in account to be considered logged in (prevents accidental cross-account reads).
+*/
+async function getLoginSession(context, nearAccountId) {
+	const login = await getLoginStateInternal(context, nearAccountId);
+	if (!login?.isLoggedIn || !login.nearAccountId) return {
+		login,
+		signingSession: null
+	};
+	try {
+		const signingSession = await context.webAuthnManager.getWarmSigningSessionStatus(login.nearAccountId);
+		return {
+			login,
+			signingSession
+		};
+	} catch {
+		return {
+			login,
+			signingSession: null
+		};
+	}
+}
+/**
+* Internal helper for computing `LoginState`.
+*
+* Implementation detail:
+* - Trusts the IndexedDB last-user pointer for account selection, then confirms
+*   that the VRF worker is actually active for that same account.
+*/
+async function getLoginStateInternal(context, nearAccountId) {
+	const { webAuthnManager } = context;
+	try {
+		const lastUser = await webAuthnManager.getLastUser();
+		const targetAccountId = nearAccountId ?? lastUser?.nearAccountId ?? null;
+		if (!lastUser || targetAccountId && lastUser.nearAccountId !== targetAccountId) return {
+			isLoggedIn: false,
+			nearAccountId: targetAccountId || null,
+			publicKey: null,
+			vrfActive: false,
+			userData: null
+		};
+		const userData = lastUser;
+		const publicKey = userData?.clientNearPublicKey || null;
+		const vrfStatus = await webAuthnManager.checkVrfStatus();
+		const vrfActive = vrfStatus.active && vrfStatus.nearAccountId === targetAccountId;
+		const isLoggedIn = !!(userData && userData.clientNearPublicKey && vrfActive);
+		return {
+			isLoggedIn,
+			nearAccountId: targetAccountId,
+			publicKey,
+			vrfActive,
+			userData,
+			vrfSessionDuration: vrfStatus.sessionDuration || 0
+		};
+	} catch (error) {
+		console.warn("Error getting login state:", error);
+		return {
+			isLoggedIn: false,
+			nearAccountId: nearAccountId || null,
+			publicKey: null,
+			vrfActive: false,
+			userData: null
+		};
+	}
+}
+/**
+* List recently used accounts from IndexedDB.
+*
+* Used for account picker UIs and initial app bootstrap state.
+*/
+async function getRecentLogins(context) {
+	const { webAuthnManager } = context;
+	const allUsersData = await webAuthnManager.getAllUsers();
+	const accountIds = allUsersData.map((user) => user.nearAccountId);
+	const lastUsedAccount = await webAuthnManager.getLastUser();
+	return {
+		accountIds,
+		lastUsedAccount
+	};
+}
+/**
+* Clear the active VRF session and any client-side nonce caches.
+*
+* This is the canonical "logout" operation for the SDK (does not delete accounts).
+*/
+async function logoutAndClearSession(context) {
+	const { webAuthnManager } = context;
+	await webAuthnManager.clearVrfSession();
+	try {
+		webAuthnManager.getNonceManager().clear();
+	} catch {}
+	try {
+		clearAllCachedThresholdEd25519AuthSessions();
+	} catch {}
+}
+function prioritizeAuthenticatorsByDeviceNumber(authenticators, deviceNumber) {
+	if (authenticators.length <= 1) return authenticators;
+	if (deviceNumber === null) return authenticators;
+	const preferred = authenticators.filter((a) => a.deviceNumber === deviceNumber);
+	if (preferred.length === 0) return authenticators;
+	const rest = authenticators.filter((a) => a.deviceNumber !== deviceNumber);
+	return [...preferred, ...rest];
+}
+
+//#endregion
+export { clearCachedThresholdEd25519AuthSession, createNearKeypair, esm_default, getCachedThresholdEd25519AuthSessionJwt, getLoginSession, getRecentLogins, isThresholdSessionAuthUnavailableError, isThresholdSignerMissingKeyError, loginAndCreateSession, logoutAndClearSession, makeThresholdEd25519AuthSessionCacheKey };