@tatchi-xyz/sdk 0.21.0 → 0.31.0

package/dist/esm/react/sdk/src/core/WebAuthnManager/index.js

@@ -1,889 +0,0 @@
-import { init_accountIds, toAccountId } from "../types/accountIds.js";
-import { IndexedDBManager, init_IndexedDBManager } from "../IndexedDBManager/index.js";
-import { onEmbeddedBaseChange } from "../sdkPaths/base.js";
-import { resolveWorkerBaseOrigin } from "../sdkPaths/workers.js";
-import { TouchIdPrompt, init_touchIdPrompt } from "./touchIdPrompt.js";
-import { getLastLoggedInDeviceNumber, init_getDeviceNumber } from "./SignerWorkerManager/getDeviceNumber.js";
-import { SignerWorkerManager } from "./SignerWorkerManager/index.js";
-import { VrfWorkerManager } from "./VrfWorkerManager/index.js";
-import userPreferences_default from "./userPreferences.js";
-import nonceManager_default from "../nonceManager.js";
-import { __isWalletIframeHostMode } from "../WalletIframe/host-mode.js";
-
-//#region src/core/WebAuthnManager/index.ts
-init_IndexedDBManager();
-init_touchIdPrompt();
-init_accountIds();
-init_getDeviceNumber();
-/**
-* WebAuthnManager - Main orchestrator for WebAuthn operations
-*
-* Architecture:
-* - index.ts (this file): Main class orchestrating everything
-* - signerWorkerManager: NEAR transaction signing, and VRF Web3Authn verification RPC calls
-* - vrfWorkerManager: VRF keypair generation, challenge generation
-* - touchIdPrompt: TouchID prompt for biometric authentication
-*/
-var WebAuthnManager = class {
-	vrfWorkerManager;
-	signerWorkerManager;
-	touchIdPrompt;
-	userPreferencesManager;
-	nearClient;
-	nonceManager;
-	workerBaseOrigin = "";
-	activeSigningSessionIds = /* @__PURE__ */ new Map();
-	tatchiPasskeyConfigs;
-	constructor(tatchiPasskeyConfigs, nearClient) {
-		this.tatchiPasskeyConfigs = tatchiPasskeyConfigs;
-		this.nearClient = nearClient;
-		this.touchIdPrompt = new TouchIdPrompt(tatchiPasskeyConfigs.iframeWallet?.rpIdOverride, true);
-		this.userPreferencesManager = userPreferences_default;
-		try {
-			this.userPreferencesManager.configureWalletTheme?.(tatchiPasskeyConfigs.walletTheme);
-		} catch {}
-		this.nonceManager = nonceManager_default;
-		const { vrfWorkerConfigs } = tatchiPasskeyConfigs;
-		this.vrfWorkerManager = new VrfWorkerManager({
-			shamirPB64u: vrfWorkerConfigs?.shamir3pass?.p,
-			relayServerUrl: vrfWorkerConfigs?.shamir3pass?.relayServerUrl,
-			applyServerLockRoute: vrfWorkerConfigs?.shamir3pass?.applyServerLockRoute,
-			removeServerLockRoute: vrfWorkerConfigs?.shamir3pass?.removeServerLockRoute
-		}, {
-			touchIdPrompt: this.touchIdPrompt,
-			nearClient: this.nearClient,
-			indexedDB: IndexedDBManager,
-			userPreferencesManager: this.userPreferencesManager,
-			nonceManager: this.nonceManager,
-			rpIdOverride: this.touchIdPrompt.getRpId(),
-			nearExplorerUrl: tatchiPasskeyConfigs.nearExplorerUrl
-		});
-		this.signerWorkerManager = new SignerWorkerManager(this.vrfWorkerManager, nearClient, this.userPreferencesManager, this.nonceManager, tatchiPasskeyConfigs.iframeWallet?.rpIdOverride, true, tatchiPasskeyConfigs.nearExplorerUrl);
-		this.workerBaseOrigin = resolveWorkerBaseOrigin() || (typeof window !== "undefined" ? window.location.origin : "");
-		this.signerWorkerManager.setWorkerBaseOrigin(this.workerBaseOrigin);
-		this.vrfWorkerManager.setWorkerBaseOrigin?.(this.workerBaseOrigin);
-		if (typeof window !== "undefined") onEmbeddedBaseChange((url) => {
-			const origin = new URL(url, window.location.origin).origin;
-			if (origin && origin !== this.workerBaseOrigin) {
-				this.workerBaseOrigin = origin;
-				this.signerWorkerManager.setWorkerBaseOrigin(origin);
-				this.vrfWorkerManager.setWorkerBaseOrigin?.(origin);
-			}
-		});
-		const shouldAvoidAppOriginIndexedDB = !!tatchiPasskeyConfigs.iframeWallet?.walletOrigin && !__isWalletIframeHostMode();
-		if (!shouldAvoidAppOriginIndexedDB) this.userPreferencesManager.initFromIndexedDB().catch(() => void 0);
-	}
-	/**
-	* Public pre-warm hook to initialize signer workers ahead of time.
-	* Safe to call multiple times; errors are non-fatal.
-	*/
-	prewarmSignerWorkers() {
-		if (typeof window === "undefined" || typeof window.Worker === "undefined") return;
-		if (this.workerBaseOrigin && this.workerBaseOrigin !== window.location.origin) return;
-		this.signerWorkerManager.preWarmWorkerPool().catch(() => {});
-	}
-	/**
-	* Warm critical resources to reduce first-action latency.
-	* - Initialize current user (sets up NonceManager and local state)
-	* - Prefetch latest block context (and nonce if missing)
-	* - Pre-open IndexedDB and warm encrypted key for the active account (best-effort)
-	* - Pre-warm signer workers in the background
-	*/
-	async warmCriticalResources(nearAccountId) {
-		if (nearAccountId) await this.initializeCurrentUser(toAccountId(nearAccountId), this.nearClient).catch(() => null);
-		await this.nonceManager.prefetchBlockheight(this.nearClient).catch(() => null);
-		if (nearAccountId) await IndexedDBManager.getUserWithKeys(toAccountId(nearAccountId)).catch(() => null);
-		this.prewarmSignerWorkers();
-	}
-	/**
-	* Resolve the effective rpId used for WebAuthn operations.
-	* Delegates to TouchIdPrompt to centralize rpId selection logic.
-	*/
-	getRpId() {
-		return this.touchIdPrompt.getRpId();
-	}
-	/** Getter for NonceManager instance */
-	getNonceManager() {
-		return this.nonceManager;
-	}
-	/**
-	* WebAuthnManager-level orchestrator for VRF-owned signing sessions.
-	* Creates sessionId, wires MessagePort between VRF and signer workers, and ensures cleanup.
-	*
-	* Overload 1: plain signing session (no WrapKeySeed derivation).
-	* Overload 2: signing session with WrapKeySeed derivation, when `SigningSessionOptions`
-	*             (PRF.first_auth) are provided. wrapKeySalt is generated inside the VRF worker
-	*             when a new vault entry is being created.
-	*/
-	generateSessionId(prefix) {
-		return typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : `${prefix}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
-	}
-	toNonNegativeInt(value) {
-		if (typeof value !== "number" || !Number.isFinite(value) || value < 0) return void 0;
-		return Math.floor(value);
-	}
-	resolveSigningSessionPolicy(args) {
-		const ttlMs = this.toNonNegativeInt(args.ttlMs) ?? this.tatchiPasskeyConfigs.signingSessionDefaults.ttlMs;
-		const remainingUses = this.toNonNegativeInt(args.remainingUses) ?? this.tatchiPasskeyConfigs.signingSessionDefaults.remainingUses;
-		return {
-			ttlMs,
-			remainingUses
-		};
-	}
-	getOrCreateActiveSigningSessionId(nearAccountId) {
-		const key = String(toAccountId(nearAccountId));
-		const existing = this.activeSigningSessionIds.get(key);
-		if (existing) return existing;
-		const sessionId = this.generateSessionId("signing-session");
-		this.activeSigningSessionIds.set(key, sessionId);
-		return sessionId;
-	}
-	async withSigningSession(args) {
-		if (typeof args.handler !== "function") throw new Error("withSigningSession requires a handler function");
-		const sessionId = (args.sessionId || "").trim() || (args.prefix ? this.generateSessionId(args.prefix) : "");
-		if (!sessionId) throw new Error("withSigningSession requires a sessionId or prefix");
-		return await this.withSigningSessionInternal({
-			sessionId,
-			options: args.options,
-			handler: args.handler
-		});
-	}
-	async withSigningSessionInternal(args) {
-		const signerPort = await this.vrfWorkerManager.createSigningSessionChannel(args.sessionId);
-		await this.signerWorkerManager.reserveSignerWorkerSession(args.sessionId, { signerPort });
-		try {
-			if (args.options) await this.vrfWorkerManager.mintSessionKeysAndSendToSigner({
-				sessionId: args.sessionId,
-				credential: args.options.credential
-			});
-			return await args.handler(args.sessionId);
-		} finally {
-			this.signerWorkerManager.releaseSigningSession(args.sessionId);
-		}
-	}
-	/**
-	* VRF-driven registration confirmation helper.
-	* Runs confirmTxFlow and returns registration artifacts.
-	*
-	* SecureConfirm wrapper for link-device / registration: prompts user in-iframe to create a
-	* new passkey (device N), returning artifacts for subsequent derivation.
-	*/
-	async requestRegistrationCredentialConfirmation(params) {
-		return this.vrfWorkerManager.requestRegistrationCredentialConfirmation({
-			nearAccountId: params.nearAccountId,
-			deviceNumber: params.deviceNumber,
-			confirmerText: params.confirmerText,
-			confirmationConfigOverride: params.confirmationConfigOverride,
-			contractId: this.tatchiPasskeyConfigs.contractId,
-			nearRpcUrl: this.tatchiPasskeyConfigs.nearRpcUrl
-		});
-	}
-	/**
-	* Helper for export/decrypt flows:
-	*  - Read vault wrapKeySalt
-	*  - Ask VRF worker to run LocalOnly(DECRYPT_PRIVATE_KEY_WITH_PRF) + derive WrapKeySeed
-	*  - WrapKeySeed travels only over the VRF→Signer MessagePort
-	*/
-	async confirmDecryptAndDeriveWrapKeySeed(args) {
-		const nearAccountId = toAccountId(args.nearAccountId);
-		const [last, latest] = await Promise.all([IndexedDBManager.clientDB.getLastUser().catch(() => null), IndexedDBManager.clientDB.getLastDBUpdatedUser(nearAccountId).catch(() => null)]);
-		const deviceNumber = last && last.nearAccountId === nearAccountId && typeof last.deviceNumber === "number" ? last.deviceNumber : latest && typeof latest.deviceNumber === "number" ? latest.deviceNumber : null;
-		if (deviceNumber === null) throw new Error(`No deviceNumber found for account ${nearAccountId} (decrypt session)`);
-		const userForDevice = await IndexedDBManager.clientDB.getUserByDevice(nearAccountId, deviceNumber).catch(() => null);
-		const encryptedVrfKeypair = userForDevice?.encryptedVrfKeypair;
-		const encryptedKeyData = await IndexedDBManager.nearKeysDB.getEncryptedKey(nearAccountId, deviceNumber);
-		if (!encryptedKeyData) {
-			console.error("WebAuthnManager: No encrypted key found for decrypt session", {
-				nearAccountId: String(nearAccountId),
-				deviceNumber
-			});
-			throw new Error(`No encrypted key found for account: ${nearAccountId}`);
-		}
-		const wrapKeySalt = encryptedKeyData.wrapKeySalt || "";
-		if (!wrapKeySalt) {
-			console.error("WebAuthnManager: Missing wrapKeySalt in vault for decrypt session", {
-				nearAccountId: String(nearAccountId),
-				deviceNumber
-			});
-			throw new Error("Missing wrapKeySalt in vault; re-register to upgrade vault format.");
-		}
-		try {
-			await this.vrfWorkerManager.prepareDecryptSession({
-				sessionId: args.sessionId,
-				nearAccountId,
-				wrapKeySalt,
-				encryptedVrfKeypair
-			});
-		} catch (error) {
-			console.error("WebAuthnManager: VRF decrypt session failed", {
-				nearAccountId: String(nearAccountId),
-				sessionId: args.sessionId,
-				error
-			});
-			throw error;
-		}
-	}
-	getAuthenticationCredentialsSerialized({ nearAccountId, challenge, allowCredentials }) {
-		return this.touchIdPrompt.getAuthenticationCredentialsSerialized({
-			nearAccountId,
-			challenge,
-			allowCredentials
-		});
-	}
-	/**
-	* Generate a VRF challenge bound to a specific signing/confirm session.
-	* The challenge will be cached in the VRF worker under this sessionId so
-	* later contract verification (MINT_SESSION_KEYS_AND_SEND_TO_SIGNER) can look it up.
-	*/
-	async generateVrfChallengeForSession(sessionId, vrfInputData) {
-		return this.vrfWorkerManager.generateVrfChallengeForSession(vrfInputData, sessionId);
-	}
-	/**
-	* Generate a one-off VRF challenge without caching it in the VRF worker.
-	* Use this for flows that don't perform contract verification or derive
-	* wrap keys via MINT_SESSION_KEYS_AND_SEND_TO_SIGNER.
-	*/
-	async generateVrfChallengeOnce(vrfInputData) {
-		return this.vrfWorkerManager.generateVrfChallengeOnce(vrfInputData);
-	}
-	/**
-	* Generate VRF keypair for bootstrapping - stores in memory unencrypted temporarily
-	* This is used during registration to generate a VRF keypair that will be used for
-	* WebAuthn ceremony and later encrypted with the real PRF output
-	*
-	* @param saveInMemory - Whether to persist the generated VRF keypair in WASM worker memory
-	* @param vrfInputParams - Optional parameters to generate VRF challenge/proof in same call
-	* @returns VRF public key and optionally VRF challenge data
-	*/
-	async generateVrfKeypairBootstrap(args) {
-		return this.vrfWorkerManager.generateVrfKeypairBootstrap({
-			vrfInputData: args.vrfInputData,
-			saveInMemory: args.saveInMemory,
-			sessionId: args.sessionId
-		});
-	}
-	/**
-	* Derive NEAR keypair directly from a serialized WebAuthn registration credential
-	*/
-	async deriveNearKeypairAndEncryptFromSerialized({ credential, nearAccountId, options }) {
-		return this.withSigningSession({
-			prefix: "reg",
-			options: { credential },
-			handler: (sessionId) => this.signerWorkerManager.deriveNearKeypairAndEncryptFromSerialized({
-				credential,
-				nearAccountId: toAccountId(nearAccountId),
-				options,
-				sessionId
-			})
-		});
-	}
-	/**
-	* **Sign Device2 registration transaction with already-stored key (no prompt)**
-	*
-	* Used by linkDevice flow after key swap to sign the registration transaction
-	* without prompting the user again. Reuses the credential collected earlier.
-	*
-	* Flow:
-	* 1. Extract PRF.first from the provided credential
-	* 2. Create new MessagePort session for WrapKeySeed delivery
-	* 3. VRF worker re-derives WrapKeySeed and sends to signer (with PRF.second)
-	* 4. Signer worker retrieves encrypted key from IndexedDB
-	* 5. Signer worker decrypts key and signs registration transaction
-	*
-	* @param nearAccountId - NEAR account ID for Device2
-	* @param credential - WebAuthn registration credential from earlier prompt
-	* @param vrfChallenge - VRF challenge from earlier prompt
-	* @param deviceNumber - Device number for Device2
-	* @returns Signed registration transaction ready for submission
-	*/
-	async signDevice2RegistrationWithStoredKey(args) {
-		const { nearAccountId, credential, vrfChallenge, deviceNumber, deterministicVrfPublicKey } = args;
-		const contractId = this.tatchiPasskeyConfigs.contractId;
-		try {
-			const sessionId = `device2-sign-${Date.now()}-${Math.random().toString(36).slice(2, 11)}`;
-			const encryptedKeyData = await IndexedDBManager.nearKeysDB.getEncryptedKey(nearAccountId, deviceNumber);
-			if (!encryptedKeyData) throw new Error(`No encrypted key found for account ${nearAccountId} device ${deviceNumber}`);
-			const wrapKeySalt = encryptedKeyData.wrapKeySalt;
-			if (!wrapKeySalt) throw new Error(`Missing wrapKeySalt for account ${nearAccountId} device ${deviceNumber}`);
-			const signerPort = await this.vrfWorkerManager.createSigningSessionChannel(sessionId);
-			await this.signerWorkerManager.reserveSignerWorkerSession(sessionId, { signerPort });
-			await this.vrfWorkerManager.mintSessionKeysAndSendToSigner({
-				sessionId,
-				wrapKeySalt,
-				credential
-			});
-			const transactionContext = await this.nonceManager.getNonceBlockHashAndHeight(this.nearClient);
-			let vrfPublicKey = deterministicVrfPublicKey;
-			const finalVrfPublicKey = vrfPublicKey || vrfChallenge.vrfPublicKey;
-			const signerResult = await this.signerWorkerManager.registerDevice2WithDerivedKey({
-				sessionId,
-				nearAccountId,
-				credential,
-				vrfChallenge,
-				transactionContext,
-				contractId,
-				wrapKeySalt,
-				deviceNumber,
-				deterministicVrfPublicKey: finalVrfPublicKey
-			});
-			return {
-				success: true,
-				publicKey: signerResult.publicKey,
-				signedTransaction: signerResult.signedTransaction
-			};
-		} catch (error) {
-			console.error("[WebAuthnManager] Failed to sign Device2 registration with stored key:", error);
-			return {
-				success: false,
-				error: error.message || String(error)
-			};
-		}
-	}
-	/**
-	* Derive deterministic VRF keypair from PRF output for recovery
-	* Optionally generates VRF challenge if input parameters are provided
-	* This enables deterministic VRF key derivation from WebAuthn credentials
-	*
-	* @param credential - WebAuthn credential containing PRF outputs
-	* @param nearAccountId - NEAR account ID for key derivation salt
-	* @param vrfInputParams - Optional VRF inputs, if provided will generate a challenge
-	* @param saveInMemory - Whether to save the derived VRF keypair in worker memory for immediate use
-	* @returns Deterministic VRF public key, optional VRF challenge, and encrypted VRF keypair for storage
-	*/
-	async deriveVrfKeypair({ credential, nearAccountId, vrfInputData, saveInMemory = true }) {
-		try {
-			const vrfResult = await this.vrfWorkerManager.deriveVrfKeypairFromPrf({
-				credential,
-				nearAccountId,
-				vrfInputData,
-				saveInMemory
-			});
-			const result = {
-				success: true,
-				vrfPublicKey: vrfResult.vrfPublicKey,
-				encryptedVrfKeypair: vrfResult.encryptedVrfKeypair,
-				vrfChallenge: vrfResult.vrfChallenge,
-				serverEncryptedVrfKeypair: vrfResult.serverEncryptedVrfKeypair
-			};
-			return result;
-		} catch (error) {
-			console.error("WebAuthnManager: VRF keypair derivation error:", error);
-			throw new Error(`VRF keypair derivation failed ${error.message}`);
-		}
-	}
-	/**
-	* Unlock VRF keypair in memory using PRF output
-	* This is called during login to decrypt and load the VRF keypair in-memory
-	*/
-	async unlockVRFKeypair({ nearAccountId, encryptedVrfKeypair, credential }) {
-		try {
-			const unlockResult = await this.vrfWorkerManager.unlockVrfKeypair({
-				credential,
-				nearAccountId,
-				encryptedVrfKeypair
-			});
-			if (!unlockResult.success) {
-				console.error("WebAuthnManager: VRF keypair unlock failed");
-				return {
-					success: false,
-					error: "VRF keypair unlock failed"
-				};
-			}
-			this.signerWorkerManager.preWarmWorkerPool().catch(() => {});
-			return { success: true };
-		} catch (error) {
-			console.error("WebAuthnManager: VRF keypair unlock failed:", error.message);
-			return {
-				success: false,
-				error: error.message
-			};
-		}
-	}
-	/**
-	* Perform Shamir 3-pass commutative decryption within WASM worker
-	* This securely decrypts a server-encrypted KEK (key encryption key)
-	* which the wasm worker uses to unlock a key to decrypt the VRF keypair and loads it into memory
-	* The server never knows the real value of the KEK, nor the VRF keypair
-	*/
-	async shamir3PassDecryptVrfKeypair({ nearAccountId, kek_s_b64u, ciphertextVrfB64u, serverKeyId }) {
-		const result = await this.vrfWorkerManager.shamir3PassDecryptVrfKeypair({
-			nearAccountId,
-			kek_s_b64u,
-			ciphertextVrfB64u,
-			serverKeyId
-		});
-		return {
-			success: result.success,
-			error: result.error
-		};
-	}
-	/**
-	* Shamir 3-pass: encrypt the unlocked VRF keypair under the server key
-	* Returns a fresh blob to store in IndexedDB for future auto-login.
-	*/
-	async shamir3PassEncryptCurrentVrfKeypair() {
-		const res = await this.vrfWorkerManager.shamir3PassEncryptCurrentVrfKeypair();
-		return {
-			ciphertextVrfB64u: res.ciphertextVrfB64u,
-			kek_s_b64u: res.kek_s_b64u,
-			serverKeyId: res.serverKeyId
-		};
-	}
-	/**
-	* Persist refreshed server-encrypted VRF keypair in IndexedDB.
-	*/
-	async updateServerEncryptedVrfKeypair(nearAccountId, serverEncrypted) {
-		await IndexedDBManager.clientDB.updateUser(nearAccountId, { serverEncryptedVrfKeypair: {
-			ciphertextVrfB64u: serverEncrypted.ciphertextVrfB64u,
-			kek_s_b64u: serverEncrypted.kek_s_b64u,
-			serverKeyId: serverEncrypted.serverKeyId,
-			updatedAt: Date.now()
-		} });
-	}
-	async clearVrfSession() {
-		if (typeof window !== "undefined" && this.workerBaseOrigin !== window.location.origin) return;
-		return await this.vrfWorkerManager.clearVrfSession();
-	}
-	/**
-	* Check VRF worker status
-	*/
-	async checkVrfStatus() {
-		return this.vrfWorkerManager.checkVrfStatus();
-	}
-	/**
-	* Mint/refresh a VRF-owned warm signing session using an already-collected WebAuthn credential.
-	*
-	* This is used to avoid a second TouchID prompt during login flows when we already
-	* performed an authentication ceremony (e.g., to unlock the VRF keypair).
-	*
-	* Notes:
-	* - This method does not initiate a WebAuthn prompt.
-	* - Contract verification is optional and only performed when `contractId` + `nearRpcUrl` are provided.
-	*/
-	async mintSigningSessionFromCredential(args) {
-		const nearAccountId = toAccountId(args.nearAccountId);
-		const sessionId = this.getOrCreateActiveSigningSessionId(nearAccountId);
-		const vrfStatus = await this.vrfWorkerManager.checkVrfStatus();
-		if (!vrfStatus.active) throw new Error("VRF keypair not active in memory. Please log in again.");
-		if (!vrfStatus.nearAccountId || String(vrfStatus.nearAccountId) !== String(nearAccountId)) throw new Error("VRF keypair active but bound to a different account. Please log in again.");
-		const deviceNumber = await getLastLoggedInDeviceNumber(nearAccountId, IndexedDBManager.clientDB);
-		const encryptedKeyData = await IndexedDBManager.nearKeysDB.getEncryptedKey(nearAccountId, deviceNumber);
-		if (!encryptedKeyData) throw new Error(`No encrypted key found for account ${nearAccountId} device ${deviceNumber}`);
-		const wrapKeySalt = encryptedKeyData.wrapKeySalt || "";
-		if (!wrapKeySalt) throw new Error("Missing wrapKeySalt in vault; re-register to upgrade vault format.");
-		const { ttlMs, remainingUses } = this.resolveSigningSessionPolicy(args);
-		await this.vrfWorkerManager.mintSessionKeysAndSendToSigner({
-			sessionId,
-			wrapKeySalt,
-			contractId: args.contractId,
-			nearRpcUrl: args.nearRpcUrl,
-			ttlMs,
-			remainingUses,
-			credential: args.credential
-		});
-		return await this.vrfWorkerManager.checkSessionStatus({ sessionId });
-	}
-	/**
-	* Introspect the VRF-owned signing session for UI (no prompt, metadata only).
-	* Session usage (`remainingUses`) is decremented on `DISPENSE_SESSION_KEY` calls.
-	*/
-	async getWarmSigningSessionStatus(nearAccountId) {
-		const sessionId = this.getOrCreateActiveSigningSessionId(nearAccountId);
-		return await this.vrfWorkerManager.checkSessionStatus({ sessionId });
-	}
-	/**
-	* Fetch Shamir server key info to support proactive refresh.
-	*/
-	async getShamirKeyInfo() {
-		try {
-			const relayUrl = this.tatchiPasskeyConfigs?.vrfWorkerConfigs?.shamir3pass?.relayServerUrl;
-			if (!relayUrl) return null;
-			const res = await fetch(`${relayUrl}/shamir/key-info`, { method: "GET" });
-			if (!res.ok) return null;
-			const data = await res.json();
-			return {
-				currentKeyId: data?.currentKeyId ?? null,
-				p_b64u: data?.p_b64u ?? null,
-				graceKeyIds: Array.isArray(data?.graceKeyIds) ? data.graceKeyIds : void 0
-			};
-		} catch {
-			return null;
-		}
-	}
-	/**
-	* If server key changed and VRF is unlocked in memory, re-encrypt under the new server key.
-	* Returns true if refreshed, false otherwise.
-	*/
-	async maybeProactiveShamirRefresh(nearAccountId) {
-		try {
-			const relayUrl = this.tatchiPasskeyConfigs?.vrfWorkerConfigs?.shamir3pass?.relayServerUrl;
-			if (!relayUrl) return false;
-			const userData = await this.getLastUser();
-			const stored = userData?.serverEncryptedVrfKeypair;
-			if (!stored || !stored.kek_s_b64u || !stored.ciphertextVrfB64u || !stored.serverKeyId) return false;
-			const keyInfo = await this.getShamirKeyInfo();
-			const currentKeyId = keyInfo?.currentKeyId;
-			if (!currentKeyId || currentKeyId === stored.serverKeyId) return false;
-			const status = await this.checkVrfStatus();
-			const active = status.active && status.nearAccountId === nearAccountId;
-			if (!active) return false;
-			const refreshed = await this.shamir3PassEncryptCurrentVrfKeypair();
-			await this.updateServerEncryptedVrfKeypair(nearAccountId, refreshed);
-			return true;
-		} catch {
-			return false;
-		}
-	}
-	async storeUserData(userData) {
-		await IndexedDBManager.clientDB.storeWebAuthnUserData({
-			...userData,
-			deviceNumber: userData.deviceNumber ?? 1,
-			version: userData.version || 2
-		});
-	}
-	async getAllUsers() {
-		return await IndexedDBManager.clientDB.getAllUsers();
-	}
-	async getUserByDevice(nearAccountId, deviceNumber) {
-		return await IndexedDBManager.clientDB.getUserByDevice(nearAccountId, deviceNumber);
-	}
-	async getLastUser() {
-		return await IndexedDBManager.clientDB.getLastUser();
-	}
-	async getAuthenticatorsByUser(nearAccountId) {
-		return await IndexedDBManager.clientDB.getAuthenticatorsByUser(nearAccountId);
-	}
-	async updateLastLogin(nearAccountId) {
-		return await IndexedDBManager.clientDB.updateLastLogin(nearAccountId);
-	}
-	/**
-	* Set the last logged-in user
-	* @param nearAccountId - The account ID of the user
-	* @param deviceNumber - The device number (defaults to 1)
-	*/
-	async setLastUser(nearAccountId, deviceNumber = 1) {
-		return await IndexedDBManager.clientDB.setLastUser(nearAccountId, deviceNumber);
-	}
-	/**
-	* Initialize current user authentication state
-	* This should be called after VRF keypair is successfully unlocked in memory
-	* to ensure the user is properly logged in and can perform transactions
-	*
-	* @param nearAccountId - The NEAR account ID to initialize
-	* @param nearClient - The NEAR client for nonce prefetching
-	*/
-	async initializeCurrentUser(nearAccountId, nearClient) {
-		const accountId = toAccountId(nearAccountId);
-		let deviceNumberToUse = null;
-		const lastUser = await IndexedDBManager.clientDB.getLastUser().catch(() => null);
-		if (lastUser && toAccountId(lastUser.nearAccountId) === accountId && Number.isFinite(lastUser.deviceNumber)) deviceNumberToUse = lastUser.deviceNumber;
-		if (deviceNumberToUse === null) {
-			const userForAccount = await IndexedDBManager.clientDB.getUserByDevice(accountId, 1).catch(() => null);
-			if (userForAccount && Number.isFinite(userForAccount.deviceNumber)) deviceNumberToUse = userForAccount.deviceNumber;
-		}
-		if (deviceNumberToUse === null) deviceNumberToUse = 1;
-		await this.setLastUser(accountId, deviceNumberToUse);
-		this.userPreferencesManager.setCurrentUser(accountId);
-		await this.userPreferencesManager.reloadUserSettings().catch(() => void 0);
-		const userData = await IndexedDBManager.clientDB.getUserByDevice(accountId, deviceNumberToUse).catch(() => null);
-		if (userData && userData.clientNearPublicKey) this.nonceManager.initializeUser(accountId, userData.clientNearPublicKey);
-		if (nearClient) await this.nonceManager.prefetchBlockheight(nearClient).catch((prefetchErr) => console.debug("Nonce prefetch after authentication state initialization failed (non-fatal):", prefetchErr));
-	}
-	async registerUser(storeUserData) {
-		return await IndexedDBManager.clientDB.registerUser(storeUserData);
-	}
-	async storeAuthenticator(authenticatorData) {
-		const deviceNumber = Number(authenticatorData.deviceNumber);
-		const normalizedDeviceNumber = Number.isSafeInteger(deviceNumber) && deviceNumber >= 1 ? deviceNumber : 1;
-		const authData = {
-			...authenticatorData,
-			nearAccountId: toAccountId(authenticatorData.nearAccountId),
-			deviceNumber: normalizedDeviceNumber
-		};
-		return await IndexedDBManager.clientDB.storeAuthenticator(authData);
-	}
-	extractUsername(nearAccountId) {
-		return IndexedDBManager.clientDB.extractUsername(nearAccountId);
-	}
-	async atomicOperation(callback) {
-		return await IndexedDBManager.clientDB.atomicOperation(callback);
-	}
-	async rollbackUserRegistration(nearAccountId) {
-		return await IndexedDBManager.clientDB.rollbackUserRegistration(nearAccountId);
-	}
-	async hasPasskeyCredential(nearAccountId) {
-		return await IndexedDBManager.clientDB.hasPasskeyCredential(nearAccountId);
-	}
-	/**
-	* Atomically store all registration data (user, authenticator, VRF credentials)
-	*/
-	async atomicStoreRegistrationData({ nearAccountId, credential, publicKey, encryptedVrfKeypair, vrfPublicKey, serverEncryptedVrfKeypair }) {
-		await this.atomicOperation(async (db) => {
-			const credentialId = credential.rawId;
-			const attestationB64u = credential.response.attestationObject;
-			const transports = credential.response?.transports;
-			await this.storeAuthenticator({
-				nearAccountId,
-				credentialId,
-				credentialPublicKey: await this.extractCosePublicKey(attestationB64u),
-				transports,
-				name: `VRF Passkey for ${this.extractUsername(nearAccountId)}`,
-				registered: (/* @__PURE__ */ new Date()).toISOString(),
-				syncedAt: (/* @__PURE__ */ new Date()).toISOString(),
-				vrfPublicKey
-			});
-			await this.storeUserData({
-				nearAccountId,
-				deviceNumber: 1,
-				clientNearPublicKey: publicKey,
-				lastUpdated: Date.now(),
-				passkeyCredential: {
-					id: credential.id,
-					rawId: credentialId
-				},
-				encryptedVrfKeypair: {
-					encryptedVrfDataB64u: encryptedVrfKeypair.encryptedVrfDataB64u,
-					chacha20NonceB64u: encryptedVrfKeypair.chacha20NonceB64u
-				},
-				version: 2,
-				serverEncryptedVrfKeypair: serverEncryptedVrfKeypair ? {
-					ciphertextVrfB64u: serverEncryptedVrfKeypair?.ciphertextVrfB64u,
-					kek_s_b64u: serverEncryptedVrfKeypair?.kek_s_b64u,
-					serverKeyId: serverEncryptedVrfKeypair?.serverKeyId,
-					updatedAt: Date.now()
-				} : void 0
-			});
-			return true;
-		});
-	}
-	/**
-	* Transaction signing with contract verification and progress updates.
-	* Demonstrates the "streaming" worker pattern similar to SSE.
-	*
-	* Requires a successful TouchID/biometric prompt before transaction signing in wasm worker
-	* Automatically verifies the authentication with the web3authn contract.
-	*
-	* @param transactions - Transaction payload containing:
-	*   - receiverId: NEAR account ID receiving the transaction
-	*   - actions: Array of NEAR actions to execute
-	* @param rpcCall: RpcCallPayload containing:
-	*   - contractId: Web3Authn contract ID for verification
-	*   - nearRpcUrl: NEAR RPC endpoint URL
-	*   - nearAccountId: NEAR account ID performing the transaction
-	* @param confirmationConfigOverride: Optional confirmation configuration override
-	* @param onEvent: Optional callback for progress updates during signing
-	* @param onEvent - Optional callback for progress updates during signing
-	*/
-	async signTransactionsWithActions({ transactions, rpcCall, confirmationConfigOverride, title, body, onEvent }) {
-		if (transactions.length === 0) throw new Error("No payloads provided for signing");
-		const activeSessionId = this.getOrCreateActiveSigningSessionId(toAccountId(rpcCall.nearAccountId));
-		return this.withSigningSession({
-			sessionId: activeSessionId,
-			handler: (sessionId) => this.signerWorkerManager.signTransactionsWithActions({
-				transactions,
-				rpcCall,
-				confirmationConfigOverride,
-				title,
-				body,
-				onEvent,
-				sessionId
-			})
-		});
-	}
-	async signDelegateAction({ delegate, rpcCall, confirmationConfigOverride, title, body, onEvent }) {
-		const nearAccountId = toAccountId(rpcCall.nearAccountId || delegate.senderId);
-		const normalizedRpcCall = {
-			contractId: rpcCall.contractId || this.tatchiPasskeyConfigs.contractId,
-			nearRpcUrl: rpcCall.nearRpcUrl || this.tatchiPasskeyConfigs.nearRpcUrl,
-			nearAccountId
-		};
-		try {
-			const activeSessionId = this.getOrCreateActiveSigningSessionId(nearAccountId);
-			return await this.withSigningSession({
-				sessionId: activeSessionId,
-				handler: (sessionId) => {
-					console.debug("[WebAuthnManager][delegate] session created", { sessionId });
-					return this.signerWorkerManager.signDelegateAction({
-						delegate,
-						rpcCall: normalizedRpcCall,
-						confirmationConfigOverride,
-						title,
-						body,
-						onEvent,
-						sessionId
-					});
-				}
-			});
-		} catch (err) {
-			console.error("[WebAuthnManager][delegate] failed", err);
-			throw err;
-		}
-	}
-	async signNEP413Message(payload) {
-		try {
-			const activeSessionId = this.getOrCreateActiveSigningSessionId(payload.accountId);
-			const contractId = this.tatchiPasskeyConfigs.contractId;
-			const nearRpcUrl = this.tatchiPasskeyConfigs.nearRpcUrl.split(",")[0] || this.tatchiPasskeyConfigs.nearRpcUrl;
-			const result = await this.withSigningSession({
-				sessionId: activeSessionId,
-				handler: (sessionId) => this.signerWorkerManager.signNep413Message({
-					...payload,
-					sessionId,
-					contractId,
-					nearRpcUrl
-				})
-			});
-			if (result.success) return result;
-			else throw new Error(`NEP-413 signing failed: ${result.error || "Unknown error"}`);
-		} catch (error) {
-			console.error("WebAuthnManager: NEP-413 signing error:", error);
-			return {
-				success: false,
-				accountId: "",
-				publicKey: "",
-				signature: "",
-				error: error.message || "Unknown error"
-			};
-		}
-	}
-	/**
-	* Extract COSE public key from WebAuthn attestation object using WASM worker
-	*/
-	async extractCosePublicKey(attestationObjectBase64url) {
-		return await this.signerWorkerManager.extractCosePublicKey(attestationObjectBase64url);
-	}
-	/**
-	* Helper to ensure the local `lastUser` pointer is consistent with the latest DB updates.
-	* This fixes issues where a recovery or registration might have updated the user record
-	* but failed to update the `lastUser` pointer (e.g. due to previous bugs or interruptions),
-	* preventing the strict `ensureCurrentPasskey` check from passing.
-	*/
-	async autoHealLastUserPointer(nearAccountId) {
-		try {
-			const lastUser = await this.getLastUser();
-			if (lastUser && lastUser.nearAccountId === nearAccountId) {
-				const freshest = await IndexedDBManager.clientDB.getLastDBUpdatedUser(nearAccountId);
-				if (freshest && freshest.deviceNumber !== lastUser.deviceNumber) {
-					console.log(`[WebAuthnManager] Auto-healing lastUser pointer from device ${lastUser.deviceNumber} to ${freshest.deviceNumber}`);
-					await this.setLastUser(nearAccountId, freshest.deviceNumber);
-				}
-			} else {
-				const freshest = await IndexedDBManager.clientDB.getLastDBUpdatedUser(nearAccountId);
-				if (freshest) await this.setLastUser(nearAccountId, freshest.deviceNumber);
-			}
-		} catch (e) {
-			console.warn("[WebAuthnManager] Auto-heal pointer failed (non-fatal):", e);
-		}
-	}
-	/** Worker-driven export: two-phase V2 (collect PRF → decrypt → show UI) */
-	async exportNearKeypairWithUIWorkerDriven(nearAccountId, options) {
-		await this.withSigningSession({
-			prefix: "export-session",
-			handler: async (sessionId) => {
-				await this.confirmDecryptAndDeriveWrapKeySeed({
-					nearAccountId,
-					sessionId
-				});
-				return this.signerWorkerManager.exportNearKeypairUi({
-					nearAccountId,
-					variant: options?.variant,
-					theme: options?.theme,
-					sessionId
-				});
-			}
-		});
-	}
-	async exportNearKeypairWithUI(nearAccountId, options) {
-		await this.exportNearKeypairWithUIWorkerDriven(nearAccountId, options);
-		let userData = await this.getLastUser();
-		if (!userData || userData.nearAccountId !== nearAccountId) userData = await IndexedDBManager.clientDB.getLastDBUpdatedUser(nearAccountId);
-		return {
-			accountId: String(nearAccountId),
-			publicKey: String(userData?.clientNearPublicKey || ""),
-			privateKey: ""
-		};
-	}
-	async checkCanRegisterUser({ contractId, credential, vrfChallenge, authenticatorOptions, onEvent }) {
-		return await this.signerWorkerManager.checkCanRegisterUser({
-			contractId,
-			credential,
-			vrfChallenge,
-			authenticatorOptions,
-			onEvent,
-			nearRpcUrl: this.tatchiPasskeyConfigs.nearRpcUrl
-		});
-	}
-	/**
-	* Recover keypair from authentication credential for account recovery
-	* Uses dual PRF outputs to re-derive the same NEAR keypair and re-encrypt it
-	* @param challenge - Random challenge for WebAuthn authentication ceremony
-	* @param authenticationCredential - The authentication credential with dual PRF outputs
-	* @param accountIdHint - Optional account ID hint for recovery
-	* @returns Public key and encrypted private key for secure storage
-	*/
-	async recoverKeypairFromPasskey(authenticationCredential, accountIdHint) {
-		try {
-			if (!authenticationCredential) throw new Error("Authentication credential required for account recovery. Use an existing credential with dual PRF outputs to re-derive the same NEAR keypair.");
-			const prfResults = authenticationCredential.clientExtensionResults?.prf?.results;
-			if (!prfResults?.first || !prfResults?.second) throw new Error("Dual PRF outputs required for account recovery - both AES and Ed25519 PRF outputs must be available");
-			const result = await this.withSigningSession({
-				prefix: "recover",
-				options: { credential: authenticationCredential },
-				handler: (sessionId) => this.signerWorkerManager.recoverKeypairFromPasskey({
-					credential: authenticationCredential,
-					accountIdHint,
-					sessionId
-				})
-			});
-			return result;
-		} catch (error) {
-			console.error("WebAuthnManager: Deterministic keypair derivation error:", error);
-			throw new Error(`Deterministic keypair derivation failed: ${error.message}`);
-		}
-	}
-	async getAuthenticationCredentialsSerializedDualPrf({ nearAccountId, challenge, credentialIds }) {
-		return this.touchIdPrompt.getAuthenticationCredentialsSerializedDualPrf({
-			nearAccountId,
-			challenge,
-			allowCredentials: credentialIds.map((id) => ({
-				id,
-				type: "public-key",
-				transports: [
-					"internal",
-					"hybrid",
-					"usb",
-					"ble"
-				]
-			}))
-		});
-	}
-	/**
-	* Sign transaction with raw private key
-	* for key replacement in device linking
-	* No TouchID/PRF required - uses provided private key directly
-	*/
-	async signTransactionWithKeyPair({ nearPrivateKey, signerAccountId, receiverId, nonce, blockHash, actions }) {
-		return await this.signerWorkerManager.signTransactionWithKeyPair({
-			nearPrivateKey,
-			signerAccountId,
-			receiverId,
-			nonce,
-			blockHash,
-			actions
-		});
-	}
-	/** * Get user preferences manager */
-	getUserPreferences() {
-		return this.userPreferencesManager;
-	}
-	/** * Clean up resources */
-	destroy() {
-		if (this.userPreferencesManager) this.userPreferencesManager.destroy();
-		if (this.nonceManager) this.nonceManager.clear();
-		this.activeSigningSessionIds.clear();
-	}
-};
-
-//#endregion
-export { WebAuthnManager };
-//# sourceMappingURL=index.js.map