@tatchi-xyz/sdk 0.21.0 → 0.31.0

package/dist/cjs/react/src/core/TatchiPasskey/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","names":["LoginPhase","LoginStatus","parseDeviceNumber","err: any","getUserFriendlyErrorMessage","signingSession: SigningSessionStatus","IndexedDBManager","normalizeThresholdEd25519ParticipantIds","buildThresholdSessionPolicy","makeThresholdEd25519AuthSessionCacheKey","e: any","clientVerifyingShareB64u: string | null","mintThresholdEd25519AuthSession","computeLoginIntentDigest","authenticatorsToAllowCredentials","serverSessionJwt: string | undefined","verifyAuthenticationResponse","loginResult: LoginResult","createRandomVRFChallenge","hintUserPromise: Promise<ClientUserData | null>","userData: ClientUserData | null","unlockResult: { success: boolean; error?: string }","unlockCredential: WebAuthnAuthenticationCredential | undefined","error: any","relayerUrl","refreshErr: any","result: LoginResult"],"sources":["../../../../../../src/core/TatchiPasskey/login.ts"],"sourcesContent":["import type {\n  AfterCall,\n  LoginHooksOptions,\n  LoginSSEvent,\n} from '../types/sdkSentEvents';\nimport { LoginPhase, LoginStatus } from '../types/sdkSentEvents';\nimport type {\n  GetRecentLoginsResult,\n  LoginAndCreateSessionResult,\n  LoginResult,\n  LoginSession,\n  LoginState,\n  SigningSessionStatus,\n} from '../types/tatchi';\nimport type { PasskeyManagerContext } from './index';\nimport type { AccountId } from '../types/accountIds';\nimport type { WebAuthnAuthenticationCredential } from '../types/webauthn';\nimport { getUserFriendlyErrorMessage } from '../../utils/errors';\nimport { createRandomVRFChallenge, VRFChallenge } from '../types/vrf-worker';\nimport { authenticatorsToAllowCredentials } from '../WebAuthnManager/touchIdPrompt';\nimport { IndexedDBManager } from '../IndexedDBManager';\nimport type { ClientAuthenticatorData, ClientUserData } from '../IndexedDBManager';\nimport { verifyAuthenticationResponse } from '../rpcCalls';\nimport { computeLoginIntentDigest } from '../digests/intentDigest';\nimport { buildThresholdSessionPolicy } from '../threshold/thresholdSessionPolicy';\nimport { parseDeviceNumber } from '../WebAuthnManager/SignerWorkerManager/getDeviceNumber';\nimport {\n  clearAllCachedThresholdEd25519AuthSessions,\n  makeThresholdEd25519AuthSessionCacheKey,\n  mintThresholdEd25519AuthSession,\n  putCachedThresholdEd25519AuthSession,\n} from '../threshold/thresholdEd25519AuthSession';\nimport { normalizeThresholdEd25519ParticipantIds } from '../../threshold/participants';\n\ntype WarmSigningSessionPolicy = { ttlMs: number; remainingUses: number };\n\ntype ThresholdSessionPlan = {\n  sessionKind: 'jwt';\n  relayerUrl: string;\n  relayerKeyId: string;\n  cacheKey: string;\n  policy: Awaited<ReturnType<typeof buildThresholdSessionPolicy>>;\n  deviceNumber: number;\n};\n\n/**\n * Core login function that handles passkey authentication without React dependencies.\n *\n * - Unlocks the VRF keypair (Shamir 3‑pass auto‑unlock when possible; falls back to TouchID).\n * - Updates local login state and returns success with account/public key info.\n * - Optional: mints a server session when `options.session` is provided.\n *   - Generates a fresh, chain‑anchored VRF challenge (using latest block).\n *   - Collects a WebAuthn assertion over the VRF output and posts to the relay route\n *     (defaults to `/verify-authentication-response`).\n *   - When `kind: 'jwt'`, returns the token in `result.jwt`.\n *   - When `kind: 'cookie'`, the server sets an HttpOnly cookie and no JWT is returned.\n */\nexport async function loginAndCreateSession(\n  context: PasskeyManagerContext,\n  nearAccountId: AccountId,\n  options?: LoginHooksOptions\n): Promise<LoginAndCreateSessionResult> {\n  const { onEvent, onError, afterCall } = options || {};\n  const { webAuthnManager } = context;\n\n  onEvent?.({\n    step: 1,\n    phase: LoginPhase.STEP_1_PREPARATION,\n    status: LoginStatus.PROGRESS,\n    message: `Starting login for ${nearAccountId}`\n  });\n\n  const prevStatus = await webAuthnManager.checkVrfStatus();\n  const prevVrfAccountId = prevStatus?.active ? prevStatus.nearAccountId : null;\n\n  // If this call activates VRF then fails, clear the partial session.\n  const rollbackVrfOnFailure = async () => {\n    const status = await webAuthnManager.checkVrfStatus();\n    const current = status?.active ? status.nearAccountId : null;\n    if (current && current !== prevVrfAccountId) {\n      await logoutAndClearSession(context);\n    }\n  };\n\n  try {\n    // Validation\n    if (!window.isSecureContext) {\n      const errorMessage = 'Passkey operations require a secure context (HTTPS or localhost).';\n      return await finalizeLoginError({\n        message: errorMessage,\n        error: new Error(errorMessage),\n        rollbackVrfOnFailure,\n        onEvent,\n        onError,\n        afterCall,\n        callAfterCall: false,\n      });\n    }\n\n    const session = options?.session;\n    const wantsServerSession = session !== undefined;\n    const deviceNumberHint = parseDeviceNumber(options?.deviceNumber, { min: 1 });\n    const base = await handleLoginUnlockVRF(\n      context,\n      nearAccountId,\n      onEvent,\n      onError,\n      afterCall,\n      // Defer final 'login-complete' event & afterCall until warm signing session is minted\n      true,\n      deviceNumberHint\n    );\n    // If base login failed, just return\n    if (!base.result.success) {\n      return base.result;\n    }\n\n    const preferredDeviceNumber = deviceNumberHint ?? base.activeDeviceNumber;\n    const warmPolicy = resolveWarmSigningSessionPolicy(context, options);\n\n    const wantsThresholdSession =\n      webAuthnManager.getUserPreferences().getSignerMode().mode === 'threshold-signer';\n    const relayUrl = (session?.relayUrl || context.configs.relayer.url).trim();\n    const verifyRoute = (session?.route || '/verify-authentication-response').trim();\n\n    const thresholdPlan = await prepareThresholdSessionPlan({\n      context,\n      nearAccountId,\n      preferredDeviceNumber,\n      relayUrl,\n      ttlMs: warmPolicy.ttlMs,\n      remainingUses: warmPolicy.remainingUses,\n      wantsThresholdSession,\n    });\n\n    const wantsRelayerSession = wantsServerSession || thresholdPlan !== null;\n    if (wantsRelayerSession && !relayUrl) {\n      console.warn('[login] No relayUrl provided for session-style signing');\n    }\n\n    if (wantsRelayerSession && relayUrl) {\n      return await runRelayerSessionFlow({\n        context,\n        nearAccountId,\n        baseLoginResult: base.result,\n        baseUnlockCredential: base.unlockCredential,\n        preferredDeviceNumber,\n        session,\n        relayUrl,\n        verifyRoute,\n        thresholdPlan,\n        warmPolicy,\n        rollbackVrfOnFailure,\n        onEvent,\n        onError,\n        afterCall,\n      });\n    }\n\n    // No relayer session requested (or relayUrl missing): mint/refresh warm signing session only.\n    await mintWarmSigningSession({\n      context,\n      nearAccountId,\n      onEvent,\n      credential: base.unlockCredential,\n      ttlMs: warmPolicy.ttlMs,\n      remainingUses: warmPolicy.remainingUses,\n    });\n    return await finalizeLoginSuccess({\n      webAuthnManager,\n      nearAccountId,\n      loginResult: base.result,\n      onEvent,\n      afterCall,\n    });\n  } catch (err: any) {\n    const errorMessage =\n      getUserFriendlyErrorMessage(err, 'login') || err?.message || 'Login failed';\n    return await finalizeLoginError({\n      message: errorMessage,\n      error: err,\n      rollbackVrfOnFailure,\n      onEvent,\n      onError,\n      afterCall,\n    });\n  }\n}\n\nfunction resolveWarmSigningSessionPolicy(\n  context: PasskeyManagerContext,\n  options?: LoginHooksOptions\n): WarmSigningSessionPolicy {\n  const defaults = context.configs.signingSessionDefaults;\n  return {\n    ttlMs: options?.signingSession?.ttlMs ?? defaults.ttlMs,\n    remainingUses: options?.signingSession?.remainingUses ?? defaults.remainingUses,\n  };\n}\n\nasync function attachSigningSessionStatus(args: {\n  webAuthnManager: PasskeyManagerContext['webAuthnManager'];\n  nearAccountId: AccountId;\n  loginResult: LoginResult;\n}): Promise<LoginAndCreateSessionResult> {\n  const { webAuthnManager, nearAccountId, loginResult } = args;\n  if (!loginResult.success) return loginResult;\n  try {\n    const signingSession: SigningSessionStatus =\n      await webAuthnManager.getWarmSigningSessionStatus(nearAccountId);\n    return { ...loginResult, signingSession };\n  } catch {\n    return loginResult;\n  }\n}\n\nasync function finalizeLoginSuccess(args: {\n  webAuthnManager: PasskeyManagerContext['webAuthnManager'];\n  nearAccountId: AccountId;\n  loginResult: LoginResult;\n  onEvent?: (event: LoginSSEvent) => void;\n  afterCall?: AfterCall<LoginAndCreateSessionResult>;\n}): Promise<LoginAndCreateSessionResult> {\n  const { webAuthnManager, nearAccountId, loginResult, onEvent, afterCall } = args;\n  const finalResult = await attachSigningSessionStatus({\n    webAuthnManager,\n    nearAccountId,\n    loginResult,\n  });\n  onEvent?.({\n    step: 4,\n    phase: LoginPhase.STEP_4_LOGIN_COMPLETE,\n    status: LoginStatus.SUCCESS,\n    message: 'Login completed successfully',\n    nearAccountId,\n    clientNearPublicKey: loginResult.clientNearPublicKey ?? '',\n  });\n  await afterCall?.(true, finalResult);\n  return finalResult;\n}\n\nasync function finalizeLoginError(args: {\n  message: string;\n  error?: unknown;\n  rollbackVrfOnFailure: () => Promise<void>;\n  onEvent?: (event: LoginSSEvent) => void;\n  onError?: (error: Error) => void;\n  afterCall?: AfterCall<LoginAndCreateSessionResult>;\n  callOnError?: boolean;\n  callAfterCall?: boolean;\n}): Promise<LoginAndCreateSessionResult> {\n  const {\n    message,\n    error,\n    rollbackVrfOnFailure,\n    onEvent,\n    onError,\n    afterCall,\n    callOnError = true,\n    callAfterCall = true,\n  } = args;\n\n  try { await rollbackVrfOnFailure(); } catch {}\n\n  if (callOnError) {\n    onError?.(error as any);\n  }\n\n  onEvent?.({\n    step: 0,\n    phase: LoginPhase.LOGIN_ERROR,\n    status: LoginStatus.ERROR,\n    message,\n    error: message,\n  });\n\n  if (callAfterCall) {\n    await afterCall?.(false);\n  }\n  return { success: false, error: message };\n}\n\nasync function prepareThresholdSessionPlan(args: {\n  context: PasskeyManagerContext;\n  nearAccountId: AccountId;\n  preferredDeviceNumber: number | null;\n  relayUrl: string;\n  ttlMs: number;\n  remainingUses: number;\n  wantsThresholdSession: boolean;\n}): Promise<ThresholdSessionPlan | null> {\n  const {\n    context,\n    nearAccountId,\n    preferredDeviceNumber,\n    relayUrl,\n    ttlMs,\n    remainingUses,\n    wantsThresholdSession,\n  } = args;\n  if (!wantsThresholdSession || !relayUrl) return null;\n\n  const { webAuthnManager } = context;\n\n  try {\n    const rpId = webAuthnManager.getRpId();\n    if (!rpId) throw new Error('Missing rpId for threshold session');\n\n    const lastUser = await webAuthnManager.getLastUser();\n    const deviceNumber = preferredDeviceNumber ??\n      (lastUser?.nearAccountId === nearAccountId\n        ? lastUser.deviceNumber\n        : (await IndexedDBManager.clientDB.getLastDBUpdatedUser(nearAccountId))\n            ?.deviceNumber ?? null);\n\n    if (deviceNumber === null) {\n      console.warn('[login] threshold-signer configured but no threshold key material found; skipping threshold session');\n      return null;\n    }\n\n    const thresholdKeyMaterial = await IndexedDBManager.nearKeysDB.getThresholdKeyMaterial(\n      nearAccountId,\n      deviceNumber\n    );\n    const relayerKeyId = thresholdKeyMaterial?.relayerKeyId || null;\n    const participantIds = thresholdKeyMaterial?.participants?.map((p) => p.id) || null;\n    const normalizedParticipantIds = normalizeThresholdEd25519ParticipantIds(participantIds);\n\n    if (!relayerKeyId) {\n      console.warn('[login] threshold-signer configured but no threshold key material found; skipping threshold session');\n      return null;\n    }\n\n    if (!normalizedParticipantIds || normalizedParticipantIds.length < 2) {\n      console.warn('[login] threshold key material missing/invalid participantIds; skipping threshold session mint');\n      return null;\n    }\n\n    const policy = await buildThresholdSessionPolicy({\n      nearAccountId,\n      rpId,\n      relayerKeyId,\n      ...(normalizedParticipantIds?.length ? { participantIds: normalizedParticipantIds } : {}),\n      ttlMs,\n      remainingUses,\n    });\n\n    const cacheKey = makeThresholdEd25519AuthSessionCacheKey({\n      nearAccountId,\n      rpId,\n      relayerUrl: relayUrl,\n      relayerKeyId,\n      ...(normalizedParticipantIds?.length ? { participantIds: normalizedParticipantIds } : {}),\n    });\n\n    return {\n      sessionKind: 'jwt',\n      relayerUrl: relayUrl,\n      relayerKeyId,\n      cacheKey,\n      policy,\n      deviceNumber,\n    };\n  } catch (e: any) {\n    console.warn(\n      '[login] failed to prepare threshold session policy; skipping threshold session mint:',\n      e?.message || e\n    );\n    return null;\n  }\n}\n\nasync function mintThresholdSessionBestEffort(args: {\n  context: PasskeyManagerContext;\n  nearAccountId: AccountId;\n  plan: ThresholdSessionPlan;\n  vrfChallenge: VRFChallenge;\n  credential: WebAuthnAuthenticationCredential;\n}): Promise<void> {\n  const { context, nearAccountId, plan, vrfChallenge, credential } = args;\n  const { webAuthnManager } = context;\n\n  let clientVerifyingShareB64u: string | null = null;\n  try {\n    const localKeyMaterial = await IndexedDBManager.nearKeysDB.getLocalKeyMaterial(\n      nearAccountId,\n      plan.deviceNumber\n    );\n    const wrapKeySalt = String(localKeyMaterial?.wrapKeySalt || '').trim();\n    if (wrapKeySalt) {\n      const derived =\n        await webAuthnManager.deriveThresholdEd25519ClientVerifyingShareFromCredential({\n          credential,\n          nearAccountId,\n          wrapKeySalt,\n        });\n      if (derived.success && derived.clientVerifyingShareB64u) {\n        clientVerifyingShareB64u = derived.clientVerifyingShareB64u;\n      }\n    }\n  } catch (e: any) {\n    console.warn(\n      '[login] failed to derive clientVerifyingShareB64u for threshold session mint:',\n      e?.message || e\n    );\n  }\n\n  if (!clientVerifyingShareB64u) {\n    console.warn(\n      '[login] threshold session mint skipped: missing clientVerifyingShareB64u'\n    );\n    return;\n  }\n\n  const minted = await mintThresholdEd25519AuthSession({\n    relayerUrl: plan.relayerUrl,\n    sessionKind: plan.sessionKind,\n    relayerKeyId: plan.relayerKeyId,\n    clientVerifyingShareB64u,\n    sessionPolicy: plan.policy.policy,\n    vrfChallenge,\n    webauthnAuthentication: credential,\n  });\n\n  if (minted.ok && minted.jwt) {\n    putCachedThresholdEd25519AuthSession(plan.cacheKey, {\n      sessionKind: plan.sessionKind,\n      policy: plan.policy.policy,\n      policyJson: plan.policy.policyJson,\n      sessionPolicyDigest32: plan.policy.sessionPolicyDigest32,\n      jwt: minted.jwt,\n      ...(minted.expiresAtMs ? { expiresAtMs: minted.expiresAtMs } : {}),\n    });\n    return;\n  }\n\n  if (!minted.ok) {\n    console.warn(\n      '[login] threshold session mint failed:',\n      minted.code || minted.message || 'unknown error'\n    );\n  }\n}\n\nasync function runRelayerSessionFlow(args: {\n  context: PasskeyManagerContext;\n  nearAccountId: AccountId;\n  baseLoginResult: LoginResult;\n  baseUnlockCredential?: WebAuthnAuthenticationCredential;\n  preferredDeviceNumber: number | null;\n  session: LoginHooksOptions['session'] | undefined;\n  relayUrl: string;\n  verifyRoute: string;\n  thresholdPlan: ThresholdSessionPlan | null;\n  warmPolicy: WarmSigningSessionPolicy;\n  rollbackVrfOnFailure: () => Promise<void>;\n  onEvent?: (event: LoginSSEvent) => void;\n  onError?: (error: Error) => void;\n  afterCall?: AfterCall<LoginAndCreateSessionResult>;\n}): Promise<LoginAndCreateSessionResult> {\n  const {\n    context,\n    nearAccountId,\n    baseLoginResult,\n    baseUnlockCredential,\n    preferredDeviceNumber,\n    session,\n    relayUrl,\n    verifyRoute,\n    thresholdPlan,\n    warmPolicy,\n    rollbackVrfOnFailure,\n    onEvent,\n    onError,\n    afterCall,\n  } = args;\n\n  const { webAuthnManager } = context;\n\n  try {\n    const rpId = webAuthnManager.getRpId();\n    if (!rpId) {\n      throw new Error('Missing rpId for VRF challenge generation during login');\n    }\n\n    const blockInfo = await context.nearClient.viewBlock({ finality: 'final' });\n    const txBlockHash = blockInfo?.header?.hash;\n    const txBlockHeight = String(blockInfo.header?.height ?? '');\n    const intentDigest = await computeLoginIntentDigest({ nearAccountId, rpId });\n    const vrfChallenge = await webAuthnManager.generateVrfChallengeOnce({\n      userId: nearAccountId,\n      rpId,\n      blockHash: txBlockHash,\n      blockHeight: txBlockHeight,\n      intentDigest,\n      ...(thresholdPlan ? { sessionPolicyDigest32: thresholdPlan.policy.sessionPolicyDigest32 } : {}),\n    });\n\n    const authenticators = await webAuthnManager.getAuthenticatorsByUser(nearAccountId);\n    const authenticatorsForPrompt = prioritizeAuthenticatorsByDeviceNumber(\n      authenticators,\n      preferredDeviceNumber\n    );\n    const credential = await webAuthnManager.getAuthenticationCredentialsSerialized({\n      nearAccountId,\n      challenge: vrfChallenge,\n      allowCredentials: authenticatorsToAllowCredentials(authenticatorsForPrompt),\n    });\n\n    const effectiveLoginResult = await bindVrfToSelectedLoginPasskeyDevice({\n      webAuthnManager,\n      nearAccountId,\n      authenticators,\n      credential,\n      baseUnlockCredential,\n      baseLoginResult: baseLoginResult,\n    });\n\n    await mintWarmSigningSession({\n      context,\n      nearAccountId,\n      onEvent,\n      credential,\n      ttlMs: warmPolicy.ttlMs,\n      remainingUses: warmPolicy.remainingUses,\n    });\n\n    let serverSessionJwt: string | undefined;\n    if (session) {\n      const v = await verifyAuthenticationResponse(\n        relayUrl,\n        verifyRoute,\n        session.kind,\n        vrfChallenge,\n        credential\n      );\n      if (!v.success || !v.verified) {\n        const errMsg = v.error || 'Session verification failed';\n        return await finalizeLoginError({\n          message: errMsg,\n          rollbackVrfOnFailure,\n          onEvent,\n          afterCall,\n          callOnError: false,\n        });\n      }\n      serverSessionJwt = v.jwt;\n    }\n\n    if (thresholdPlan) {\n      await mintThresholdSessionBestEffort({\n        context,\n        nearAccountId,\n        plan: thresholdPlan,\n        vrfChallenge,\n        credential,\n      });\n    }\n\n    const loginResult: LoginResult = serverSessionJwt\n      ? { ...effectiveLoginResult, jwt: serverSessionJwt }\n      : effectiveLoginResult;\n\n    return await finalizeLoginSuccess({\n      webAuthnManager,\n      nearAccountId,\n      loginResult,\n      onEvent,\n      afterCall,\n    });\n  } catch (e: any) {\n    console.error('[login] Failed to start session:', e);\n    const errMsg =\n      getUserFriendlyErrorMessage(e, 'login') ||\n      e?.message ||\n      'Session verification failed';\n    return await finalizeLoginError({\n      message: errMsg,\n      error: e,\n      rollbackVrfOnFailure,\n      onEvent,\n      onError,\n      afterCall,\n    });\n  }\n}\n\n/**\n * When multiple passkeys exist for the same account, the user can select any of them in the WebAuthn prompt.\n * If the VRF worker was auto-unlocked using a different device (e.g. Shamir 3-pass based on the \"latest\" row),\n * we must rebind the VRF worker to the same deviceNumber as the selected credential. Otherwise, WrapKeySeed\n * derivation can mix PRF.first(from selected credential) with vrf_sk(from a different device), which later\n * causes vault decryption failures (e.g. `aead::Error` during private key export).\n */\nasync function bindVrfToSelectedLoginPasskeyDevice(args: {\n  webAuthnManager: PasskeyManagerContext['webAuthnManager'];\n  nearAccountId: AccountId;\n  authenticators: ClientAuthenticatorData[];\n  credential: WebAuthnAuthenticationCredential;\n  baseUnlockCredential?: WebAuthnAuthenticationCredential;\n  baseLoginResult: LoginResult;\n}): Promise<LoginResult> {\n  const {\n    webAuthnManager,\n    nearAccountId,\n    authenticators,\n    credential,\n    baseUnlockCredential,\n    baseLoginResult,\n  } = args;\n\n  // Start with the base login result (may reflect whichever VRF keypair was auto-unlocked).\n  // If the user selects a different passkey below, update it to match the chosen device.\n  let effectiveLoginResult = baseLoginResult;\n\n  if (authenticators.length <= 1) {\n    return effectiveLoginResult;\n  }\n\n  const rawId = credential.rawId;\n  const matched = authenticators.find((a) => a.credentialId === rawId);\n  const selectedDeviceNumber = matched?.deviceNumber ?? null;\n\n  if (selectedDeviceNumber === null) {\n    return effectiveLoginResult;\n  }\n\n  const userForDevice = await IndexedDBManager.clientDB\n    .getUserByDevice(nearAccountId, selectedDeviceNumber)\n    .catch(() => null);\n\n  if (userForDevice?.clientNearPublicKey) {\n    effectiveLoginResult = {\n      ...effectiveLoginResult,\n      clientNearPublicKey: userForDevice.clientNearPublicKey,\n    };\n  }\n\n  const shouldRebindVrf = !baseUnlockCredential || baseUnlockCredential.rawId !== rawId;\n  if (shouldRebindVrf) {\n    const shamir = userForDevice?.serverEncryptedVrfKeypair;\n    if (!shamir?.ciphertextVrfB64u || !shamir?.kek_s_b64u || !shamir?.serverKeyId) {\n      throw new Error(\n        `Missing serverEncryptedVrfKeypair for account ${nearAccountId} device ${selectedDeviceNumber}. ` +\n        'Open the wallet once online to refresh local state, then try again.'\n      );\n    }\n\n    const unlock = await webAuthnManager.shamir3PassDecryptVrfKeypair({\n      nearAccountId,\n      kek_s_b64u: shamir.kek_s_b64u,\n      ciphertextVrfB64u: shamir.ciphertextVrfB64u,\n      serverKeyId: shamir.serverKeyId,\n    });\n    if (!unlock.success) {\n      throw new Error(\n        unlock.error ||\n        'Failed to bind VRF keypair to the passkey you selected. Please try again.'\n      );\n    }\n  }\n\n  // Persist the deviceNumber that the user actually selected so subsequent flows (export/signing)\n  // use the correct vault entry.\n  await webAuthnManager.setLastUser(nearAccountId, selectedDeviceNumber);\n  // Best-effort: stamp the selected device as the one last used for login.\n  await webAuthnManager.updateLastLogin(nearAccountId).catch(() => undefined);\n\n  return effectiveLoginResult;\n}\n\n/**\n * Mint or refresh a \"warm signing session\" in the VRF worker.\n *\n * Notes:\n * - Reuses a previously collected WebAuthn credential when provided (e.g. TouchID fallback),\n *   to avoid prompting the user twice in a single login flow.\n * - Session TTL/remainingUses policy is enforced by the VRF worker.\n */\nasync function mintWarmSigningSession(args: {\n  context: PasskeyManagerContext;\n  nearAccountId: AccountId;\n  onEvent?: (event: LoginSSEvent) => void;\n  credential?: WebAuthnAuthenticationCredential;\n  ttlMs: number;\n  remainingUses: number;\n}): Promise<void> {\n  const { context, nearAccountId, onEvent, credential, ttlMs, remainingUses } = args;\n  const { webAuthnManager } = context;\n\n  onEvent?.({\n    step: 3,\n    phase: LoginPhase.STEP_3_VRF_UNLOCK,\n    status: LoginStatus.PROGRESS,\n    message: 'Unlocking warm signing session...'\n  });\n\n  // If we already performed a TouchID ceremony (e.g., VRF unlock fallback),\n  // reuse that credential to avoid a second prompt.\n  let effectiveCredential = credential;\n  if (!effectiveCredential) {\n    const challenge = createRandomVRFChallenge();\n    const authenticators = await webAuthnManager.getAuthenticatorsByUser(nearAccountId);\n    const { authenticatorsForPrompt } = await IndexedDBManager.clientDB.ensureCurrentPasskey(\n      nearAccountId,\n      authenticators,\n    );\n    effectiveCredential = await webAuthnManager.getAuthenticationCredentialsSerialized({\n      nearAccountId,\n      challenge: challenge as VRFChallenge,\n      allowCredentials: authenticatorsToAllowCredentials(authenticatorsForPrompt),\n    });\n  }\n\n  await webAuthnManager.mintSigningSessionFromCredential({\n    nearAccountId,\n    credential: effectiveCredential,\n    ttlMs,\n    remainingUses,\n  });\n\n  onEvent?.({\n    step: 3,\n    phase: LoginPhase.STEP_3_VRF_UNLOCK,\n    status: LoginStatus.SUCCESS,\n    message: 'Warm signing session unlocked'\n  });\n}\n\n/**\n * Handle onchain (serverless) login using VRF flow per docs/vrf_challenges.md\n *\n * VRF AUTHENTICATION FLOW:\n * 1. Unlock VRF keypair in VRF Worker memory, either\n *      - Decrypt via Shamir 3-pass (when Relayer is present), or\n *      - Re-derive the VRF via credentials inside VRF worker dynamically\n * 2. Generate VRF challenge using stored VRF keypair + NEAR block data (no TouchID needed)\n * 3. Use VRF output as WebAuthn challenge for authentication\n * 4. Verify VRF proof and WebAuthn response on contract simultaneously\n *      - VRF proof assures WebAuthn challenge is fresh and valid (replay protection)\n *      - WebAuthn verification for origin + biometric credentials + device authenticity\n */\nasync function handleLoginUnlockVRF(\n  context: PasskeyManagerContext,\n  nearAccountId: AccountId,\n  onEvent?: (event: LoginSSEvent) => void,\n  onError?: (error: Error) => void,\n  afterCall?: AfterCall<LoginAndCreateSessionResult>,\n  deferCompletionHooks?: boolean,\n  deviceNumberHint: number | null = null,\n): Promise<{\n  result: LoginResult;\n  usedFallbackTouchId: boolean;\n  unlockCredential?: WebAuthnAuthenticationCredential;\n  activeDeviceNumber: number | null;\n}> {\n  const { webAuthnManager } = context;\n\n  try {\n    // Step 1: Get VRF credentials and authenticators, and validate them\n    const hintUserPromise: Promise<ClientUserData | null> =\n      deviceNumberHint !== null\n        ? webAuthnManager.getUserByDevice(nearAccountId, deviceNumberHint).catch(() => null)\n        : Promise.resolve(null);\n\n    const [hintUser, lastUser, latestByAccount, authenticators] = await Promise.all([\n      hintUserPromise,\n      webAuthnManager.getLastUser(),\n      IndexedDBManager.clientDB.getLastDBUpdatedUser(nearAccountId),\n      webAuthnManager.getAuthenticatorsByUser(nearAccountId),\n    ]);\n\n    // Prefer the most recently updated record for this account; fall back to lastUser pointer.\n    let userData: ClientUserData | null = null;\n    if (hintUser && hintUser.nearAccountId === nearAccountId) {\n      userData = hintUser;\n    } else if (latestByAccount && latestByAccount.nearAccountId === nearAccountId) {\n      userData = latestByAccount;\n    } else if (lastUser && lastUser.nearAccountId === nearAccountId) {\n      userData = lastUser;\n    } else {\n      userData = await webAuthnManager.getUserByDevice(nearAccountId, 1);\n    }\n\n    // Validate user data and authenticators\n    if (!userData) {\n      throw new Error(`User data not found for ${nearAccountId} in IndexedDB. Please register an account.`);\n    }\n    if (!userData.clientNearPublicKey) {\n      throw new Error(`No NEAR public key found for ${nearAccountId}. Please register an account.`);\n    }\n    if (\n      !userData.encryptedVrfKeypair?.encryptedVrfDataB64u ||\n      !userData.encryptedVrfKeypair?.chacha20NonceB64u\n    ) {\n      throw new Error('No VRF credentials found. Please register an account.');\n    }\n    if (authenticators.length === 0) {\n      throw new Error(`No authenticators found for account ${nearAccountId}. Please register.`);\n    }\n\n    // Step 2: Try Shamir 3-pass commutative unlock first (no TouchID required), fallback to TouchID\n    onEvent?.({\n      step: 2,\n      phase: LoginPhase.STEP_2_WEBAUTHN_ASSERTION,\n      status: LoginStatus.PROGRESS,\n      message: 'Unlocking VRF keys...'\n    });\n\n    let unlockResult: { success: boolean; error?: string } = { success: false };\n    let usedFallbackTouchId = false;\n    let unlockCredential: WebAuthnAuthenticationCredential | undefined;\n    let activeDeviceNumber = userData.deviceNumber;\n    // Effective user row whose VRF/NEAR keys are actually used for this login.\n    // May be switched when multiple devices exist and the user picks a different passkey.\n    let effectiveUserData = userData;\n\n    const shamir = userData.serverEncryptedVrfKeypair;\n    const relayerUrl = context.configs.relayer?.url;\n    const useShamir3PassVRFKeyUnlock = !!relayerUrl && !!shamir?.serverKeyId;\n\n    if (useShamir3PassVRFKeyUnlock && shamir) {\n      try {\n        if (!shamir.ciphertextVrfB64u || !shamir.kek_s_b64u) {\n          throw new Error('Missing Shamir3Pass fields (ciphertextVrfB64u/kek_s_b64u)');\n        }\n\n        unlockResult = await webAuthnManager.shamir3PassDecryptVrfKeypair({\n          nearAccountId,\n          kek_s_b64u: shamir.kek_s_b64u,\n          ciphertextVrfB64u: shamir.ciphertextVrfB64u,\n          serverKeyId: shamir.serverKeyId,\n        });\n\n        if (unlockResult.success) {\n          const vrfStatus = await webAuthnManager.checkVrfStatus();\n          const active = vrfStatus.active && vrfStatus.nearAccountId === nearAccountId;\n          if (!active) {\n            unlockResult = { success: false, error: 'VRF session inactive after Shamir3Pass' };\n          }\n          if (active) {\n            // Proactive rotation if serverKeyId changed and we unlocked via Shamir\n            await webAuthnManager.maybeProactiveShamirRefresh(nearAccountId);\n          }\n        } else {\n          throw new Error(`Shamir3Pass auto-unlock failed: ${unlockResult.error}`);\n        }\n      } catch (error: any) {\n        unlockResult = { success: false, error: error.message };\n      }\n    }\n\n    // Fallback to TouchID if Shamir3Pass decryption failed\n    if (!unlockResult.success) {\n      const authenticatorsForPrompt = prioritizeAuthenticatorsByDeviceNumber(authenticators, deviceNumberHint);\n      const fallback = await fallbackUnlockVrfKeypairWithTouchId({\n        webAuthnManager,\n        nearAccountId,\n        authenticators: authenticatorsForPrompt,\n        userData,\n        onEvent,\n      });\n      unlockResult = fallback.unlockResult;\n      usedFallbackTouchId = fallback.usedFallbackTouchId;\n      unlockCredential = fallback.unlockCredential;\n      effectiveUserData = fallback.effectiveUserData;\n      activeDeviceNumber = fallback.activeDeviceNumber;\n    }\n\n    if (!unlockResult.success) {\n      throw new Error(`Failed to unlock VRF keypair: ${unlockResult.error}`);\n    }\n\n    onEvent?.({\n      step: 3,\n      phase: LoginPhase.STEP_3_VRF_UNLOCK,\n      status: LoginStatus.SUCCESS,\n      message: 'VRF keypair unlocked...'\n    });\n\n    // Proactive refresh: if Shamir3Pass failed and we used TouchID, re-encrypt under current server key\n    try {\n      const relayerUrl = context.configs.relayer?.url;\n      if (usedFallbackTouchId && relayerUrl) {\n        const refreshed = await webAuthnManager.shamir3PassEncryptCurrentVrfKeypair();\n        await webAuthnManager.updateServerEncryptedVrfKeypair(nearAccountId, refreshed);\n      }\n    } catch (refreshErr: any) {\n      console.warn('Non-fatal: Failed to refresh serverEncryptedVrfKeypair:', refreshErr?.message || refreshErr);\n    }\n\n    // Step 3: Update local data and return success\n    // Ensure last-user deviceNumber reflects the passkey actually used for login.\n    try {\n      await webAuthnManager.setLastUser(nearAccountId, activeDeviceNumber);\n    } catch {\n      // Non-fatal; continue even if last-user update fails.\n    }\n    await webAuthnManager.updateLastLogin(nearAccountId);\n\n    const result: LoginResult = {\n      success: true,\n      loggedInNearAccountId: nearAccountId,\n      // Ensure the clientNearPublicKey reflects the device whose VRF credentials\n      // are actually active for this login.\n      clientNearPublicKey: effectiveUserData.clientNearPublicKey,\n      nearAccountId: nearAccountId\n    };\n\n    if (!deferCompletionHooks) {\n      onEvent?.({\n        step: 4,\n        phase: LoginPhase.STEP_4_LOGIN_COMPLETE,\n        status: LoginStatus.SUCCESS,\n        message: 'Login completed successfully',\n        nearAccountId: nearAccountId,\n        clientNearPublicKey: effectiveUserData.clientNearPublicKey\n      });\n      afterCall?.(true, result);\n    }\n    return { result, usedFallbackTouchId, unlockCredential, activeDeviceNumber };\n\n  } catch (error: any) {\n    // Use centralized error handling\n    const errorMessage = getUserFriendlyErrorMessage(error, 'login');\n\n    onError?.(error);\n    onEvent?.({\n      step: 0,\n      phase: LoginPhase.LOGIN_ERROR,\n      status: LoginStatus.ERROR,\n      message: errorMessage,\n      error: errorMessage\n    });\n\n    const result: LoginResult = { success: false, error: errorMessage };\n    afterCall?.(false);\n    return { result, usedFallbackTouchId: false, activeDeviceNumber: null };\n  }\n}\n\n/**\n * TouchID fallback path for VRF unlock.\n *\n * Used when Shamir 3-pass auto-unlock fails/unavailable:\n * - Prompts WebAuthn to obtain a serialized credential with PRF.first + PRF.second.\n * - Aligns the local encrypted VRF keypair blob with the passkey the user actually chose\n *   (important when multiple devices/passkeys exist for the same account).\n * - Unlocks the VRF keypair inside the VRF worker and returns updated effective user context.\n */\nasync function fallbackUnlockVrfKeypairWithTouchId(args: {\n  webAuthnManager: PasskeyManagerContext['webAuthnManager'];\n  nearAccountId: AccountId;\n  authenticators: ClientAuthenticatorData[];\n  userData: ClientUserData;\n  onEvent?: (event: LoginSSEvent) => void;\n}): Promise<{\n  unlockResult: { success: boolean; error?: string };\n  usedFallbackTouchId: boolean;\n  unlockCredential: WebAuthnAuthenticationCredential;\n  effectiveUserData: ClientUserData;\n  activeDeviceNumber: number;\n}> {\n  const { webAuthnManager, nearAccountId, authenticators, userData, onEvent } = args;\n\n  onEvent?.({\n    step: 2,\n    phase: LoginPhase.STEP_2_WEBAUTHN_ASSERTION,\n    status: LoginStatus.PROGRESS,\n    message: 'Logging in, unlocking VRF credentials...'\n  });\n\n  const challenge = createRandomVRFChallenge();\n  const credential = await webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({\n    nearAccountId,\n    challenge: challenge as VRFChallenge,\n    credentialIds: authenticators.map((a) => a.credentialId),\n  });\n\n  let effectiveUserData = userData;\n  let activeDeviceNumber = userData.deviceNumber;\n\n  // If multiple authenticators exist, align VRF credentials with the passkey\n  // the user actually chose, based on credentialId → deviceNumber.\n  if (authenticators.length > 1) {\n    const rawId = credential.rawId;\n    const matched = authenticators.find(a => a.credentialId === rawId);\n    if (matched) {\n      try {\n        const byDevice = await IndexedDBManager.clientDB.getUserByDevice(nearAccountId, matched.deviceNumber);\n        if (byDevice) {\n          effectiveUserData = byDevice;\n          activeDeviceNumber = matched.deviceNumber;\n        }\n      } catch {\n        // If lookup by device fails, fall back to the base userData.\n      }\n    }\n  }\n\n  const unlockResult = await webAuthnManager.unlockVRFKeypair({\n    nearAccountId: nearAccountId,\n    encryptedVrfKeypair: {\n      encryptedVrfDataB64u: effectiveUserData.encryptedVrfKeypair.encryptedVrfDataB64u,\n      chacha20NonceB64u: effectiveUserData.encryptedVrfKeypair.chacha20NonceB64u,\n    },\n    credential: credential,\n  });\n\n  return {\n    unlockResult,\n    usedFallbackTouchId: unlockResult.success,\n    unlockCredential: credential,\n    effectiveUserData,\n    activeDeviceNumber,\n  };\n}\n\n/**\n * High-level login snapshot used by React contexts/UI.\n *\n * Returns:\n * - `login`: derived from IndexedDB last-user pointer + VRF worker status\n * - `signingSession`: warm signing session status when available\n *\n * The `nearAccountId` argument is treated as a \"query hint\" and must match the\n * last logged-in account to be considered logged in (prevents accidental cross-account reads).\n */\nexport async function getLoginSession(\n  context: PasskeyManagerContext,\n  nearAccountId?: AccountId\n): Promise<LoginSession> {\n  const login = await getLoginStateInternal(context, nearAccountId);\n  if (!login?.isLoggedIn || !login.nearAccountId) return { login, signingSession: null };\n  try {\n    const signingSession = await context.webAuthnManager.getWarmSigningSessionStatus(login.nearAccountId);\n    return { login, signingSession };\n  } catch {\n    return { login, signingSession: null };\n  }\n}\n\n/**\n * Internal helper for computing `LoginState`.\n *\n * Implementation detail:\n * - Trusts the IndexedDB last-user pointer for account selection, then confirms\n *   that the VRF worker is actually active for that same account.\n */\nasync function getLoginStateInternal(\n  context: PasskeyManagerContext,\n  nearAccountId?: AccountId\n): Promise<LoginState> {\n  const { webAuthnManager } = context;\n  try {\n    // Determine target account strictly from the last logged-in device.\n    const lastUser = await webAuthnManager.getLastUser();\n    const targetAccountId = nearAccountId ?? lastUser?.nearAccountId ?? null;\n\n    // If caller requested a specific account, it must match the last logged-in account.\n    if (!lastUser || (targetAccountId && lastUser.nearAccountId !== targetAccountId)) {\n      return {\n        isLoggedIn: false,\n        nearAccountId: targetAccountId || null,\n        publicKey: null,\n        vrfActive: false,\n        userData: null\n      };\n    }\n\n    const userData = lastUser;\n    const publicKey = userData?.clientNearPublicKey || null;\n\n    // Check actual VRF worker status\n    const vrfStatus = await webAuthnManager.checkVrfStatus();\n    const vrfActive = vrfStatus.active && vrfStatus.nearAccountId === targetAccountId;\n\n    // Determine if user is considered \"logged in\"\n    // User is logged in if they have user data and VRF is active\n    const isLoggedIn = !!(userData && userData.clientNearPublicKey && vrfActive);\n\n    return {\n      isLoggedIn,\n      nearAccountId: targetAccountId,\n      publicKey,\n      vrfActive,\n      userData,\n      vrfSessionDuration: vrfStatus.sessionDuration || 0\n    };\n\n  } catch (error: any) {\n    console.warn('Error getting login state:', error);\n    return {\n      isLoggedIn: false,\n      nearAccountId: nearAccountId || null,\n      publicKey: null,\n      vrfActive: false,\n      userData: null\n    };\n  }\n}\n\n/**\n * List recently used accounts from IndexedDB.\n *\n * Used for account picker UIs and initial app bootstrap state.\n */\nexport async function getRecentLogins(\n  context: PasskeyManagerContext\n): Promise<GetRecentLoginsResult> {\n  const { webAuthnManager } = context;\n  // Get all user accounts from IndexDB\n  const allUsersData = await webAuthnManager.getAllUsers();\n  const accountIds = allUsersData.map(user => user.nearAccountId);\n  // Get last used account for initial state\n  const lastUsedAccount = await webAuthnManager.getLastUser();\n  return {\n    accountIds,\n    lastUsedAccount,\n  };\n}\n\n/**\n * Clear the active VRF session and any client-side nonce caches.\n *\n * This is the canonical \"logout\" operation for the SDK (does not delete accounts).\n */\nexport async function logoutAndClearSession(context: PasskeyManagerContext): Promise<void> {\n  const { webAuthnManager } = context;\n  await webAuthnManager.clearVrfSession();\n  try { webAuthnManager.getNonceManager().clear(); } catch {}\n  try { clearAllCachedThresholdEd25519AuthSessions(); } catch {}\n}\n\nfunction prioritizeAuthenticatorsByDeviceNumber(\n  authenticators: ClientAuthenticatorData[],\n  deviceNumber: number | null\n): ClientAuthenticatorData[] {\n  if (authenticators.length <= 1) return authenticators;\n  if (deviceNumber === null) return authenticators;\n  const preferred = authenticators.filter((a) => a.deviceNumber === deviceNumber);\n  if (preferred.length === 0) return authenticators;\n  const rest = authenticators.filter((a) => a.deviceNumber !== deviceNumber);\n  return [...preferred, ...rest];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,eAAsB,sBACpB,SACA,eACA,SACsC;CACtC,MAAM,EAAE,SAAS,SAAS,cAAc,WAAW;CACnD,MAAM,EAAE,oBAAoB;AAE5B,WAAU;EACR,MAAM;EACN,OAAOA,iCAAW;EAClB,QAAQC,kCAAY;EACpB,SAAS,sBAAsB;;CAGjC,MAAM,aAAa,MAAM,gBAAgB;CACzC,MAAM,mBAAmB,YAAY,SAAS,WAAW,gBAAgB;CAGzE,MAAM,uBAAuB,YAAY;EACvC,MAAM,SAAS,MAAM,gBAAgB;EACrC,MAAM,UAAU,QAAQ,SAAS,OAAO,gBAAgB;AACxD,MAAI,WAAW,YAAY,iBACzB,OAAM,sBAAsB;;AAIhC,KAAI;AAEF,MAAI,CAAC,OAAO,iBAAiB;GAC3B,MAAM,eAAe;AACrB,UAAO,MAAM,mBAAmB;IAC9B,SAAS;IACT,OAAO,IAAI,MAAM;IACjB;IACA;IACA;IACA;IACA,eAAe;;;EAInB,MAAM,UAAU,SAAS;EACzB,MAAM,qBAAqB,YAAY;EACvC,MAAM,mBAAmBC,0CAAkB,SAAS,cAAc,EAAE,KAAK;EACzE,MAAM,OAAO,MAAM,qBACjB,SACA,eACA,SACA,SACA,WAEA,MACA;AAGF,MAAI,CAAC,KAAK,OAAO,QACf,QAAO,KAAK;EAGd,MAAM,wBAAwB,oBAAoB,KAAK;EACvD,MAAM,aAAa,gCAAgC,SAAS;EAE5D,MAAM,wBACJ,gBAAgB,qBAAqB,gBAAgB,SAAS;EAChE,MAAM,YAAY,SAAS,YAAY,QAAQ,QAAQ,QAAQ,KAAK;EACpE,MAAM,eAAe,SAAS,SAAS,mCAAmC;EAE1E,MAAM,gBAAgB,MAAM,4BAA4B;GACtD;GACA;GACA;GACA;GACA,OAAO,WAAW;GAClB,eAAe,WAAW;GAC1B;;EAGF,MAAM,sBAAsB,sBAAsB,kBAAkB;AACpE,MAAI,uBAAuB,CAAC,SAC1B,SAAQ,KAAK;AAGf,MAAI,uBAAuB,SACzB,QAAO,MAAM,sBAAsB;GACjC;GACA;GACA,iBAAiB,KAAK;GACtB,sBAAsB,KAAK;GAC3B;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;;AAKJ,QAAM,uBAAuB;GAC3B;GACA;GACA;GACA,YAAY,KAAK;GACjB,OAAO,WAAW;GAClB,eAAe,WAAW;;AAE5B,SAAO,MAAM,qBAAqB;GAChC;GACA;GACA,aAAa,KAAK;GAClB;GACA;;UAEKC,KAAU;EACjB,MAAM,eACJC,2CAA4B,KAAK,YAAY,KAAK,WAAW;AAC/D,SAAO,MAAM,mBAAmB;GAC9B,SAAS;GACT,OAAO;GACP;GACA;GACA;GACA;;;;AAKN,SAAS,gCACP,SACA,SAC0B;CAC1B,MAAM,WAAW,QAAQ,QAAQ;AACjC,QAAO;EACL,OAAO,SAAS,gBAAgB,SAAS,SAAS;EAClD,eAAe,SAAS,gBAAgB,iBAAiB,SAAS;;;AAItE,eAAe,2BAA2B,MAID;CACvC,MAAM,EAAE,iBAAiB,eAAe,gBAAgB;AACxD,KAAI,CAAC,YAAY,QAAS,QAAO;AACjC,KAAI;EACF,MAAMC,iBACJ,MAAM,gBAAgB,4BAA4B;AACpD,SAAO;GAAE,GAAG;GAAa;;SACnB;AACN,SAAO;;;AAIX,eAAe,qBAAqB,MAMK;CACvC,MAAM,EAAE,iBAAiB,eAAe,aAAa,SAAS,cAAc;CAC5E,MAAM,cAAc,MAAM,2BAA2B;EACnD;EACA;EACA;;AAEF,WAAU;EACR,MAAM;EACN,OAAOL,iCAAW;EAClB,QAAQC,kCAAY;EACpB,SAAS;EACT;EACA,qBAAqB,YAAY,uBAAuB;;AAE1D,OAAM,YAAY,MAAM;AACxB,QAAO;;AAGT,eAAe,mBAAmB,MASO;CACvC,MAAM,EACJ,SACA,OACA,sBACA,SACA,SACA,WACA,cAAc,MACd,gBAAgB,SACd;AAEJ,KAAI;AAAE,QAAM;SAAgC;AAE5C,KAAI,YACF,WAAU;AAGZ,WAAU;EACR,MAAM;EACN,OAAOD,iCAAW;EAClB,QAAQC,kCAAY;EACpB;EACA,OAAO;;AAGT,KAAI,cACF,OAAM,YAAY;AAEpB,QAAO;EAAE,SAAS;EAAO,OAAO;;;AAGlC,eAAe,4BAA4B,MAQF;CACvC,MAAM,EACJ,SACA,eACA,uBACA,UACA,OACA,eACA,0BACE;AACJ,KAAI,CAAC,yBAAyB,CAAC,SAAU,QAAO;CAEhD,MAAM,EAAE,oBAAoB;AAE5B,KAAI;EACF,MAAM,OAAO,gBAAgB;AAC7B,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM;EAE3B,MAAM,WAAW,MAAM,gBAAgB;EACvC,MAAM,eAAe,0BAClB,UAAU,kBAAkB,gBACzB,SAAS,gBACR,MAAMK,+BAAiB,SAAS,qBAAqB,iBAClD,gBAAgB;AAE1B,MAAI,iBAAiB,MAAM;AACzB,WAAQ,KAAK;AACb,UAAO;;EAGT,MAAM,uBAAuB,MAAMA,+BAAiB,WAAW,wBAC7D,eACA;EAEF,MAAM,eAAe,sBAAsB,gBAAgB;EAC3D,MAAM,iBAAiB,sBAAsB,cAAc,KAAK,MAAM,EAAE,OAAO;EAC/E,MAAM,2BAA2BC,6DAAwC;AAEzE,MAAI,CAAC,cAAc;AACjB,WAAQ,KAAK;AACb,UAAO;;AAGT,MAAI,CAAC,4BAA4B,yBAAyB,SAAS,GAAG;AACpE,WAAQ,KAAK;AACb,UAAO;;EAGT,MAAM,SAAS,MAAMC,2DAA4B;GAC/C;GACA;GACA;GACA,GAAI,0BAA0B,SAAS,EAAE,gBAAgB,6BAA6B;GACtF;GACA;;EAGF,MAAM,WAAWC,4EAAwC;GACvD;GACA;GACA,YAAY;GACZ;GACA,GAAI,0BAA0B,SAAS,EAAE,gBAAgB,6BAA6B;;AAGxF,SAAO;GACL,aAAa;GACb,YAAY;GACZ;GACA;GACA;GACA;;UAEKC,GAAQ;AACf,UAAQ,KACN,wFACA,GAAG,WAAW;AAEhB,SAAO;;;AAIX,eAAe,+BAA+B,MAM5B;CAChB,MAAM,EAAE,SAAS,eAAe,MAAM,cAAc,eAAe;CACnE,MAAM,EAAE,oBAAoB;CAE5B,IAAIC,2BAA0C;AAC9C,KAAI;EACF,MAAM,mBAAmB,MAAML,+BAAiB,WAAW,oBACzD,eACA,KAAK;EAEP,MAAM,cAAc,OAAO,kBAAkB,eAAe,IAAI;AAChE,MAAI,aAAa;GACf,MAAM,UACJ,MAAM,gBAAgB,yDAAyD;IAC7E;IACA;IACA;;AAEJ,OAAI,QAAQ,WAAW,QAAQ,yBAC7B,4BAA2B,QAAQ;;UAGhCI,GAAQ;AACf,UAAQ,KACN,iFACA,GAAG,WAAW;;AAIlB,KAAI,CAAC,0BAA0B;AAC7B,UAAQ,KACN;AAEF;;CAGF,MAAM,SAAS,MAAME,oEAAgC;EACnD,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,cAAc,KAAK;EACnB;EACA,eAAe,KAAK,OAAO;EAC3B;EACA,wBAAwB;;AAG1B,KAAI,OAAO,MAAM,OAAO,KAAK;AAC3B,2EAAqC,KAAK,UAAU;GAClD,aAAa,KAAK;GAClB,QAAQ,KAAK,OAAO;GACpB,YAAY,KAAK,OAAO;GACxB,uBAAuB,KAAK,OAAO;GACnC,KAAK,OAAO;GACZ,GAAI,OAAO,cAAc,EAAE,aAAa,OAAO,gBAAgB;;AAEjE;;AAGF,KAAI,CAAC,OAAO,GACV,SAAQ,KACN,0CACA,OAAO,QAAQ,OAAO,WAAW;;AAKvC,eAAe,sBAAsB,MAeI;CACvC,MAAM,EACJ,SACA,eACA,iBACA,sBACA,uBACA,SACA,UACA,aACA,eACA,YACA,sBACA,SACA,SACA,cACE;CAEJ,MAAM,EAAE,oBAAoB;AAE5B,KAAI;EACF,MAAM,OAAO,gBAAgB;AAC7B,MAAI,CAAC,KACH,OAAM,IAAI,MAAM;EAGlB,MAAM,YAAY,MAAM,QAAQ,WAAW,UAAU,EAAE,UAAU;EACjE,MAAM,cAAc,WAAW,QAAQ;EACvC,MAAM,gBAAgB,OAAO,UAAU,QAAQ,UAAU;EACzD,MAAM,eAAe,MAAMC,8CAAyB;GAAE;GAAe;;EACrE,MAAM,eAAe,MAAM,gBAAgB,yBAAyB;GAClE,QAAQ;GACR;GACA,WAAW;GACX,aAAa;GACb;GACA,GAAI,gBAAgB,EAAE,uBAAuB,cAAc,OAAO,0BAA0B;;EAG9F,MAAM,iBAAiB,MAAM,gBAAgB,wBAAwB;EACrE,MAAM,0BAA0B,uCAC9B,gBACA;EAEF,MAAM,aAAa,MAAM,gBAAgB,uCAAuC;GAC9E;GACA,WAAW;GACX,kBAAkBC,uDAAiC;;EAGrD,MAAM,uBAAuB,MAAM,oCAAoC;GACrE;GACA;GACA;GACA;GACA;GACiB;;AAGnB,QAAM,uBAAuB;GAC3B;GACA;GACA;GACA;GACA,OAAO,WAAW;GAClB,eAAe,WAAW;;EAG5B,IAAIC;AACJ,MAAI,SAAS;GACX,MAAM,IAAI,MAAMC,8CACd,UACA,aACA,QAAQ,MACR,cACA;AAEF,OAAI,CAAC,EAAE,WAAW,CAAC,EAAE,UAAU;IAC7B,MAAM,SAAS,EAAE,SAAS;AAC1B,WAAO,MAAM,mBAAmB;KAC9B,SAAS;KACT;KACA;KACA;KACA,aAAa;;;AAGjB,sBAAmB,EAAE;;AAGvB,MAAI,cACF,OAAM,+BAA+B;GACnC;GACA;GACA,MAAM;GACN;GACA;;EAIJ,MAAMC,cAA2B,mBAC7B;GAAE,GAAG;GAAsB,KAAK;MAChC;AAEJ,SAAO,MAAM,qBAAqB;GAChC;GACA;GACA;GACA;GACA;;UAEKP,GAAQ;AACf,UAAQ,MAAM,oCAAoC;EAClD,MAAM,SACJN,2CAA4B,GAAG,YAC/B,GAAG,WACH;AACF,SAAO,MAAM,mBAAmB;GAC9B,SAAS;GACT,OAAO;GACP;GACA;GACA;GACA;;;;;;;;;;;AAYN,eAAe,oCAAoC,MAO1B;CACvB,MAAM,EACJ,iBACA,eACA,gBACA,YACA,sBACA,oBACE;CAIJ,IAAI,uBAAuB;AAE3B,KAAI,eAAe,UAAU,EAC3B,QAAO;CAGT,MAAM,QAAQ,WAAW;CACzB,MAAM,UAAU,eAAe,MAAM,MAAM,EAAE,iBAAiB;CAC9D,MAAM,uBAAuB,SAAS,gBAAgB;AAEtD,KAAI,yBAAyB,KAC3B,QAAO;CAGT,MAAM,gBAAgB,MAAME,+BAAiB,SAC1C,gBAAgB,eAAe,sBAC/B,YAAY;AAEf,KAAI,eAAe,oBACjB,wBAAuB;EACrB,GAAG;EACH,qBAAqB,cAAc;;CAIvC,MAAM,kBAAkB,CAAC,wBAAwB,qBAAqB,UAAU;AAChF,KAAI,iBAAiB;EACnB,MAAM,SAAS,eAAe;AAC9B,MAAI,CAAC,QAAQ,qBAAqB,CAAC,QAAQ,cAAc,CAAC,QAAQ,YAChE,OAAM,IAAI,MACR,iDAAiD,cAAc,UAAU,qBAAqB;EAKlG,MAAM,SAAS,MAAM,gBAAgB,6BAA6B;GAChE;GACA,YAAY,OAAO;GACnB,mBAAmB,OAAO;GAC1B,aAAa,OAAO;;AAEtB,MAAI,CAAC,OAAO,QACV,OAAM,IAAI,MACR,OAAO,SACP;;AAON,OAAM,gBAAgB,YAAY,eAAe;AAEjD,OAAM,gBAAgB,gBAAgB,eAAe,YAAY;AAEjE,QAAO;;;;;;;;;;AAWT,eAAe,uBAAuB,MAOpB;CAChB,MAAM,EAAE,SAAS,eAAe,SAAS,YAAY,OAAO,kBAAkB;CAC9E,MAAM,EAAE,oBAAoB;AAE5B,WAAU;EACR,MAAM;EACN,OAAON,iCAAW;EAClB,QAAQC,kCAAY;EACpB,SAAS;;CAKX,IAAI,sBAAsB;AAC1B,KAAI,CAAC,qBAAqB;EACxB,MAAM,YAAYiB;EAClB,MAAM,iBAAiB,MAAM,gBAAgB,wBAAwB;EACrE,MAAM,EAAE,4BAA4B,MAAMZ,+BAAiB,SAAS,qBAClE,eACA;AAEF,wBAAsB,MAAM,gBAAgB,uCAAuC;GACjF;GACW;GACX,kBAAkBQ,uDAAiC;;;AAIvD,OAAM,gBAAgB,iCAAiC;EACrD;EACA,YAAY;EACZ;EACA;;AAGF,WAAU;EACR,MAAM;EACN,OAAOd,iCAAW;EAClB,QAAQC,kCAAY;EACpB,SAAS;;;;;;;;;;;;;;;;AAiBb,eAAe,qBACb,SACA,eACA,SACA,SACA,WACA,sBACA,mBAAkC,MAMjC;CACD,MAAM,EAAE,oBAAoB;AAE5B,KAAI;EAEF,MAAMkB,kBACJ,qBAAqB,OACjB,gBAAgB,gBAAgB,eAAe,kBAAkB,YAAY,QAC7E,QAAQ,QAAQ;EAEtB,MAAM,CAAC,UAAU,UAAU,iBAAiB,kBAAkB,MAAM,QAAQ,IAAI;GAC9E;GACA,gBAAgB;GAChBb,+BAAiB,SAAS,qBAAqB;GAC/C,gBAAgB,wBAAwB;;EAI1C,IAAIc,WAAkC;AACtC,MAAI,YAAY,SAAS,kBAAkB,cACzC,YAAW;WACF,mBAAmB,gBAAgB,kBAAkB,cAC9D,YAAW;WACF,YAAY,SAAS,kBAAkB,cAChD,YAAW;MAEX,YAAW,MAAM,gBAAgB,gBAAgB,eAAe;AAIlE,MAAI,CAAC,SACH,OAAM,IAAI,MAAM,2BAA2B,cAAc;AAE3D,MAAI,CAAC,SAAS,oBACZ,OAAM,IAAI,MAAM,gCAAgC,cAAc;AAEhE,MACE,CAAC,SAAS,qBAAqB,wBAC/B,CAAC,SAAS,qBAAqB,kBAE/B,OAAM,IAAI,MAAM;AAElB,MAAI,eAAe,WAAW,EAC5B,OAAM,IAAI,MAAM,uCAAuC,cAAc;AAIvE,YAAU;GACR,MAAM;GACN,OAAOpB,iCAAW;GAClB,QAAQC,kCAAY;GACpB,SAAS;;EAGX,IAAIoB,eAAqD,EAAE,SAAS;EACpE,IAAI,sBAAsB;EAC1B,IAAIC;EACJ,IAAI,qBAAqB,SAAS;EAGlC,IAAI,oBAAoB;EAExB,MAAM,SAAS,SAAS;EACxB,MAAM,aAAa,QAAQ,QAAQ,SAAS;EAC5C,MAAM,6BAA6B,CAAC,CAAC,cAAc,CAAC,CAAC,QAAQ;AAE7D,MAAI,8BAA8B,OAChC,KAAI;AACF,OAAI,CAAC,OAAO,qBAAqB,CAAC,OAAO,WACvC,OAAM,IAAI,MAAM;AAGlB,kBAAe,MAAM,gBAAgB,6BAA6B;IAChE;IACA,YAAY,OAAO;IACnB,mBAAmB,OAAO;IAC1B,aAAa,OAAO;;AAGtB,OAAI,aAAa,SAAS;IACxB,MAAM,YAAY,MAAM,gBAAgB;IACxC,MAAM,SAAS,UAAU,UAAU,UAAU,kBAAkB;AAC/D,QAAI,CAAC,OACH,gBAAe;KAAE,SAAS;KAAO,OAAO;;AAE1C,QAAI,OAEF,OAAM,gBAAgB,4BAA4B;SAGpD,OAAM,IAAI,MAAM,mCAAmC,aAAa;WAE3DC,OAAY;AACnB,kBAAe;IAAE,SAAS;IAAO,OAAO,MAAM;;;AAKlD,MAAI,CAAC,aAAa,SAAS;GACzB,MAAM,0BAA0B,uCAAuC,gBAAgB;GACvF,MAAM,WAAW,MAAM,oCAAoC;IACzD;IACA;IACA,gBAAgB;IAChB;IACA;;AAEF,kBAAe,SAAS;AACxB,yBAAsB,SAAS;AAC/B,sBAAmB,SAAS;AAC5B,uBAAoB,SAAS;AAC7B,wBAAqB,SAAS;;AAGhC,MAAI,CAAC,aAAa,QAChB,OAAM,IAAI,MAAM,iCAAiC,aAAa;AAGhE,YAAU;GACR,MAAM;GACN,OAAOvB,iCAAW;GAClB,QAAQC,kCAAY;GACpB,SAAS;;AAIX,MAAI;GACF,MAAMuB,eAAa,QAAQ,QAAQ,SAAS;AAC5C,OAAI,uBAAuBA,cAAY;IACrC,MAAM,YAAY,MAAM,gBAAgB;AACxC,UAAM,gBAAgB,gCAAgC,eAAe;;WAEhEC,YAAiB;AACxB,WAAQ,KAAK,2DAA2D,YAAY,WAAW;;AAKjG,MAAI;AACF,SAAM,gBAAgB,YAAY,eAAe;UAC3C;AAGR,QAAM,gBAAgB,gBAAgB;EAEtC,MAAMC,SAAsB;GAC1B,SAAS;GACT,uBAAuB;GAGvB,qBAAqB,kBAAkB;GACxB;;AAGjB,MAAI,CAAC,sBAAsB;AACzB,aAAU;IACR,MAAM;IACN,OAAO1B,iCAAW;IAClB,QAAQC,kCAAY;IACpB,SAAS;IACM;IACf,qBAAqB,kBAAkB;;AAEzC,eAAY,MAAM;;AAEpB,SAAO;GAAE;GAAQ;GAAqB;GAAkB;;UAEjDsB,OAAY;EAEnB,MAAM,eAAenB,2CAA4B,OAAO;AAExD,YAAU;AACV,YAAU;GACR,MAAM;GACN,OAAOJ,iCAAW;GAClB,QAAQC,kCAAY;GACpB,SAAS;GACT,OAAO;;EAGT,MAAMyB,SAAsB;GAAE,SAAS;GAAO,OAAO;;AACrD,cAAY;AACZ,SAAO;GAAE;GAAQ,qBAAqB;GAAO,oBAAoB;;;;;;;;;;;;;AAarE,eAAe,oCAAoC,MAYhD;CACD,MAAM,EAAE,iBAAiB,eAAe,gBAAgB,UAAU,YAAY;AAE9E,WAAU;EACR,MAAM;EACN,OAAO1B,iCAAW;EAClB,QAAQC,kCAAY;EACpB,SAAS;;CAGX,MAAM,YAAYiB;CAClB,MAAM,aAAa,MAAM,gBAAgB,8CAA8C;EACrF;EACW;EACX,eAAe,eAAe,KAAK,MAAM,EAAE;;CAG7C,IAAI,oBAAoB;CACxB,IAAI,qBAAqB,SAAS;AAIlC,KAAI,eAAe,SAAS,GAAG;EAC7B,MAAM,QAAQ,WAAW;EACzB,MAAM,UAAU,eAAe,MAAK,MAAK,EAAE,iBAAiB;AAC5D,MAAI,QACF,KAAI;GACF,MAAM,WAAW,MAAMZ,+BAAiB,SAAS,gBAAgB,eAAe,QAAQ;AACxF,OAAI,UAAU;AACZ,wBAAoB;AACpB,yBAAqB,QAAQ;;UAEzB;;CAMZ,MAAM,eAAe,MAAM,gBAAgB,iBAAiB;EAC3C;EACf,qBAAqB;GACnB,sBAAsB,kBAAkB,oBAAoB;GAC5D,mBAAmB,kBAAkB,oBAAoB;;EAE/C;;AAGd,QAAO;EACL;EACA,qBAAqB,aAAa;EAClC,kBAAkB;EAClB;EACA;;;;;;;;;;;;;AAcJ,eAAsB,gBACpB,SACA,eACuB;CACvB,MAAM,QAAQ,MAAM,sBAAsB,SAAS;AACnD,KAAI,CAAC,OAAO,cAAc,CAAC,MAAM,cAAe,QAAO;EAAE;EAAO,gBAAgB;;AAChF,KAAI;EACF,MAAM,iBAAiB,MAAM,QAAQ,gBAAgB,4BAA4B,MAAM;AACvF,SAAO;GAAE;GAAO;;SACV;AACN,SAAO;GAAE;GAAO,gBAAgB;;;;;;;;;;;AAWpC,eAAe,sBACb,SACA,eACqB;CACrB,MAAM,EAAE,oBAAoB;AAC5B,KAAI;EAEF,MAAM,WAAW,MAAM,gBAAgB;EACvC,MAAM,kBAAkB,iBAAiB,UAAU,iBAAiB;AAGpE,MAAI,CAAC,YAAa,mBAAmB,SAAS,kBAAkB,gBAC9D,QAAO;GACL,YAAY;GACZ,eAAe,mBAAmB;GAClC,WAAW;GACX,WAAW;GACX,UAAU;;EAId,MAAM,WAAW;EACjB,MAAM,YAAY,UAAU,uBAAuB;EAGnD,MAAM,YAAY,MAAM,gBAAgB;EACxC,MAAM,YAAY,UAAU,UAAU,UAAU,kBAAkB;EAIlE,MAAM,aAAa,CAAC,EAAE,YAAY,SAAS,uBAAuB;AAElE,SAAO;GACL;GACA,eAAe;GACf;GACA;GACA;GACA,oBAAoB,UAAU,mBAAmB;;UAG5CiB,OAAY;AACnB,UAAQ,KAAK,8BAA8B;AAC3C,SAAO;GACL,YAAY;GACZ,eAAe,iBAAiB;GAChC,WAAW;GACX,WAAW;GACX,UAAU;;;;;;;;;AAUhB,eAAsB,gBACpB,SACgC;CAChC,MAAM,EAAE,oBAAoB;CAE5B,MAAM,eAAe,MAAM,gBAAgB;CAC3C,MAAM,aAAa,aAAa,KAAI,SAAQ,KAAK;CAEjD,MAAM,kBAAkB,MAAM,gBAAgB;AAC9C,QAAO;EACL;EACA;;;;;;;;AASJ,eAAsB,sBAAsB,SAA+C;CACzF,MAAM,EAAE,oBAAoB;AAC5B,OAAM,gBAAgB;AACtB,KAAI;AAAE,kBAAgB,kBAAkB;SAAiB;AACzD,KAAI;AAAE;SAAsD;;AAG9D,SAAS,uCACP,gBACA,cAC2B;AAC3B,KAAI,eAAe,UAAU,EAAG,QAAO;AACvC,KAAI,iBAAiB,KAAM,QAAO;CAClC,MAAM,YAAY,eAAe,QAAQ,MAAM,EAAE,iBAAiB;AAClE,KAAI,UAAU,WAAW,EAAG,QAAO;CACnC,MAAM,OAAO,eAAe,QAAQ,MAAM,EAAE,iBAAiB;AAC7D,QAAO,CAAC,GAAG,WAAW,GAAG"}

package/dist/cjs/react/src/core/TatchiPasskey/registration.js

@@ -0,0 +1,441 @@
+const require_validation = require('../../utils/validation.js');
+const require_signer_worker = require('../types/signer-worker.js');
+const require_errors = require('../../utils/errors.js');
+const require_participants = require('../../threshold/participants.js');
+const require_index = require('../IndexedDBManager/index.js');
+const require_rpc = require('../types/rpc.js');
+const require_sdkSentEvents = require('../types/sdkSentEvents.js');
+const require_createAccountRelayServer = require('./faucets/createAccountRelayServer.js');
+
+//#region src/core/TatchiPasskey/registration.ts
+/**
+* Core registration function that handles passkey registration
+*
+* VRF Registration Flow (Single VRF Keypair):
+* 1. Generate VRF keypair (ed25519) using crypto.randomUUID() + persist in worker memory
+* 2. Generate VRF proof + output using the VRF keypair
+*    - VRF input with domain separator + NEAR block height + hash
+* 3. Use VRF output as WebAuthn challenge in registration ceremony
+* 4. Derive AES key from WebAuthn PRF output and encrypt the SAME VRF keypair
+* 5. Store encrypted VRF keypair in IndexedDB
+* 6. Call contract verify_registration_response with VRF proof + WebAuthn registration payload
+* 7. Contract verifies VRF proof and WebAuthn registration (challenges match!)
+* 8. Contract stores VRF pubkey + authenticator credentials on-chain for
+*    future stateless authentication
+*/
+async function registerPasskeyInternal(context, nearAccountId, options, authenticatorOptions, confirmationConfigOverride) {
+	const { onEvent, onError, afterCall } = options;
+	const { webAuthnManager, configs } = context;
+	const registrationState = {
+		accountCreated: false,
+		contractRegistered: false,
+		databaseStored: false,
+		contractTransactionId: null
+	};
+	console.log("⚡ Registration: Passkey registration with VRF WebAuthn");
+	onEvent?.({
+		step: 1,
+		phase: require_sdkSentEvents.RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,
+		status: require_sdkSentEvents.RegistrationStatus.PROGRESS,
+		message: `Starting registration for ${nearAccountId}`
+	});
+	try {
+		await validateRegistrationInputs(context, nearAccountId, onEvent, onError);
+		onEvent?.({
+			step: 1,
+			phase: require_sdkSentEvents.RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,
+			status: require_sdkSentEvents.RegistrationStatus.PROGRESS,
+			message: "Account available, generating credentials..."
+		});
+		const confirmationConfig = {
+			uiMode: "modal",
+			behavior: "requireClick",
+			theme: context.configs?.walletTheme === "light" ? "light" : "dark",
+			...confirmationConfigOverride ?? options?.confirmationConfig ?? {}
+		};
+		const registrationSession = await context.webAuthnManager.requestRegistrationCredentialConfirmation({
+			nearAccountId: String(nearAccountId),
+			deviceNumber: 1,
+			confirmerText: options?.confirmerText,
+			confirmationConfigOverride: confirmationConfig
+		});
+		const credential = registrationSession.credential;
+		const vrfChallenge = registrationSession.vrfChallenge;
+		onEvent?.({
+			step: 1,
+			phase: require_sdkSentEvents.RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,
+			status: require_sdkSentEvents.RegistrationStatus.SUCCESS,
+			message: "WebAuthn ceremony successful"
+		});
+		const canRegisterUserPromise = webAuthnManager.checkCanRegisterUser({
+			contractId: context.configs.contractId,
+			credential,
+			vrfChallenge,
+			onEvent: (progress) => {
+				console.debug(`Registration progress: ${progress.step} - ${progress.message}`);
+				onEvent?.({
+					step: 3,
+					phase: require_sdkSentEvents.RegistrationPhase.STEP_3_CONTRACT_PRE_CHECK,
+					status: require_sdkSentEvents.RegistrationStatus.PROGRESS,
+					message: `${progress.message}`
+				});
+			}
+		});
+		const deterministicVrfKeyResult = await webAuthnManager.deriveVrfKeypair({
+			credential,
+			nearAccountId,
+			saveInMemory: true
+		});
+		if (!deterministicVrfKeyResult.success || !deterministicVrfKeyResult.vrfPublicKey) throw new Error("Failed to derive deterministic VRF keypair from PRF");
+		const baseSignerMode = webAuthnManager.getUserPreferences().getSignerMode();
+		const requestedSignerMode = require_signer_worker.mergeSignerMode(baseSignerMode, options?.signerMode);
+		const requestedSignerModeStr = requestedSignerMode.mode;
+		const nearKeyResult = await webAuthnManager.deriveNearKeypairAndEncryptFromSerialized({
+			credential,
+			nearAccountId,
+			options: { deviceNumber: 1 }
+		});
+		if (!nearKeyResult.success || !nearKeyResult.publicKey) {
+			const reason = nearKeyResult?.error || "Failed to generate NEAR keypair with PRF";
+			throw new Error(reason);
+		}
+		const nearPublicKey = nearKeyResult.publicKey;
+		const wrapKeySalt = String(nearKeyResult.wrapKeySalt || "").trim();
+		if (!wrapKeySalt) throw new Error("Missing wrapKeySalt after local key derivation");
+		let thresholdClientVerifyingShareB64u = null;
+		if (requestedSignerModeStr === "threshold-signer") {
+			const derived = await webAuthnManager.deriveThresholdEd25519ClientVerifyingShareFromCredential({
+				credential,
+				nearAccountId,
+				wrapKeySalt
+			});
+			if (!derived.success || !derived.clientVerifyingShareB64u) throw new Error(derived.error || "Failed to derive threshold client verifying share");
+			thresholdClientVerifyingShareB64u = derived.clientVerifyingShareB64u;
+		}
+		const canRegisterUserResult = await canRegisterUserPromise;
+		if (!canRegisterUserResult.verified) {
+			console.error(canRegisterUserResult);
+			const errorMessage = canRegisterUserResult.error || "User verification failed - account may already exist or contract is unreachable";
+			throw new Error(`Web3Authn contract registration check failed: ${errorMessage}`);
+		}
+		onEvent?.({
+			step: 2,
+			phase: require_sdkSentEvents.RegistrationPhase.STEP_2_KEY_GENERATION,
+			status: require_sdkSentEvents.RegistrationStatus.SUCCESS,
+			message: "Wallet derived successfully from Passkey",
+			verified: true,
+			nearAccountId,
+			nearPublicKey,
+			vrfPublicKey: vrfChallenge.vrfPublicKey
+		});
+		let accountAndRegistrationResult;
+		accountAndRegistrationResult = await require_createAccountRelayServer.createAccountAndRegisterWithRelayServer(context, nearAccountId, nearPublicKey, credential, vrfChallenge, deterministicVrfKeyResult.vrfPublicKey, authenticatorOptions, onEvent, { thresholdEd25519: thresholdClientVerifyingShareB64u ? { clientVerifyingShareB64u: thresholdClientVerifyingShareB64u } : void 0 });
+		if (!accountAndRegistrationResult.success) throw new Error(accountAndRegistrationResult.error || "Account creation and registration failed");
+		registrationState.accountCreated = true;
+		registrationState.contractRegistered = true;
+		registrationState.contractTransactionId = accountAndRegistrationResult.transactionId || null;
+		onEvent?.({
+			step: 6,
+			phase: require_sdkSentEvents.RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,
+			status: require_sdkSentEvents.RegistrationStatus.PROGRESS,
+			message: "Verifying on-chain access key matches expected public key..."
+		});
+		const expectedAccessKeys = [nearPublicKey];
+		const thresholdPublicKey = String(accountAndRegistrationResult?.thresholdEd25519?.publicKey || "").trim();
+		const relayerKeyId = String(accountAndRegistrationResult?.thresholdEd25519?.relayerKeyId || "").trim();
+		const accessKeyVerified = await verifyAccountAccessKeysPresent(context.nearClient, nearAccountId, expectedAccessKeys);
+		if (!accessKeyVerified) throw new Error("On-chain access key mismatch or not found after registration");
+		onEvent?.({
+			step: 6,
+			phase: require_sdkSentEvents.RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,
+			status: require_sdkSentEvents.RegistrationStatus.SUCCESS,
+			message: "Access key verified on-chain"
+		});
+		await activateThresholdEnrollmentPostRegistration({
+			requestedSignerMode: requestedSignerModeStr,
+			nearAccountId,
+			nearPublicKey,
+			thresholdPublicKey,
+			relayerKeyId,
+			clientParticipantId: accountAndRegistrationResult?.thresholdEd25519?.clientParticipantId,
+			relayerParticipantId: accountAndRegistrationResult?.thresholdEd25519?.relayerParticipantId,
+			thresholdClientVerifyingShareB64u,
+			relayerVerifyingShareB64u: String(accountAndRegistrationResult?.thresholdEd25519?.relayerVerifyingShareB64u || "").trim(),
+			credential,
+			wrapKeySalt,
+			webAuthnManager: context.webAuthnManager,
+			nearClient: context.nearClient,
+			onEvent
+		});
+		onEvent?.({
+			step: 7,
+			phase: require_sdkSentEvents.RegistrationPhase.STEP_7_DATABASE_STORAGE,
+			status: require_sdkSentEvents.RegistrationStatus.PROGRESS,
+			message: "Storing passkey wallet metadata..."
+		});
+		await webAuthnManager.atomicStoreRegistrationData({
+			nearAccountId,
+			credential,
+			publicKey: nearPublicKey,
+			encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,
+			vrfPublicKey: deterministicVrfKeyResult.vrfPublicKey,
+			serverEncryptedVrfKeypair: deterministicVrfKeyResult.serverEncryptedVrfKeypair
+		});
+		registrationState.databaseStored = true;
+		onEvent?.({
+			step: 7,
+			phase: require_sdkSentEvents.RegistrationPhase.STEP_7_DATABASE_STORAGE,
+			status: require_sdkSentEvents.RegistrationStatus.SUCCESS,
+			message: "Registration metadata stored successfully"
+		});
+		try {
+			context.webAuthnManager.getNonceManager().initializeUser(nearAccountId, nearPublicKey);
+			await context.webAuthnManager.getNonceManager().prefetchBlockheight(context.nearClient);
+		} catch {}
+		let vrfStatus = await webAuthnManager.checkVrfStatus().catch(() => ({ active: false }));
+		if (!vrfStatus?.active) {
+			const blockInfo = await context.nearClient.viewBlock({ finality: "final" });
+			const txBlockHash = blockInfo?.header?.hash;
+			const txBlockHeight = String(blockInfo.header?.height ?? "");
+			const vrfChallenge2 = await webAuthnManager.generateVrfChallengeOnce({
+				userId: nearAccountId,
+				rpId: webAuthnManager.getRpId(),
+				blockHash: txBlockHash,
+				blockHeight: txBlockHeight
+			});
+			const authenticators = await webAuthnManager.getAuthenticatorsByUser(nearAccountId);
+			const authCredential = await webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({
+				nearAccountId,
+				challenge: vrfChallenge2,
+				credentialIds: authenticators.map((a) => a.credentialId)
+			});
+			const unlockResult = await webAuthnManager.unlockVRFKeypair({
+				nearAccountId,
+				encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,
+				credential: authCredential
+			}).catch((unlockError) => {
+				const message = unlockError && typeof unlockError === "object" && "message" in unlockError ? String(unlockError.message || "") : String(unlockError || "");
+				return {
+					success: false,
+					error: message
+				};
+			});
+			if (!unlockResult.success) {
+				console.warn("VRF keypair unlock failed:", unlockResult.error);
+				throw new Error(unlockResult.error);
+			}
+		} else console.debug("Registration: VRF session already active; skipping extra Touch ID unlock");
+		try {
+			await webAuthnManager.initializeCurrentUser(nearAccountId, context.nearClient);
+		} catch (initErr) {
+			console.warn("Failed to initialize current user after registration:", initErr);
+		}
+		onEvent?.({
+			step: 8,
+			phase: require_sdkSentEvents.RegistrationPhase.STEP_8_REGISTRATION_COMPLETE,
+			status: require_sdkSentEvents.RegistrationStatus.SUCCESS,
+			message: "Registration completed!"
+		});
+		const successResult = {
+			success: true,
+			nearAccountId,
+			clientNearPublicKey: nearPublicKey,
+			transactionId: registrationState.contractTransactionId,
+			vrfRegistration: {
+				success: true,
+				vrfPublicKey: vrfChallenge.vrfPublicKey,
+				encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,
+				contractVerified: accountAndRegistrationResult.success
+			}
+		};
+		afterCall?.(true, successResult);
+		return successResult;
+	} catch (error) {
+		const message = error && typeof error === "object" && "message" in error ? String(error.message || "") : String(error || "");
+		const stack = error && typeof error === "object" && "stack" in error ? String(error.stack || "") : "";
+		console.error("Registration failed:", message, stack);
+		await performRegistrationRollback(registrationState, nearAccountId, webAuthnManager, onEvent);
+		const errorMessage = require_errors.getUserFriendlyErrorMessage(error, "registration", nearAccountId);
+		const errorObject = new Error(errorMessage);
+		onError?.(errorObject);
+		onEvent?.({
+			step: 0,
+			phase: require_sdkSentEvents.RegistrationPhase.REGISTRATION_ERROR,
+			status: require_sdkSentEvents.RegistrationStatus.ERROR,
+			message: errorMessage,
+			error: errorMessage
+		});
+		const result = {
+			success: false,
+			error: errorMessage
+		};
+		afterCall?.(false);
+		return result;
+	}
+}
+async function registerPasskey(context, nearAccountId, options, authenticatorOptions) {
+	return registerPasskeyInternal(context, nearAccountId, options, authenticatorOptions, void 0);
+}
+/**
+* Validates registration inputs and throws errors if invalid
+* @param nearAccountId - NEAR account ID to validate
+* @param onEvent - Optional callback for registration progress events
+* @param onError - Optional callback for error handling
+*/
+const validateRegistrationInputs = async (context, nearAccountId, onEvent, onError) => {
+	onEvent?.({
+		step: 1,
+		phase: require_sdkSentEvents.RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,
+		status: require_sdkSentEvents.RegistrationStatus.PROGRESS,
+		message: "Validating registration inputs..."
+	});
+	if (!nearAccountId) {
+		const error = /* @__PURE__ */ new Error("NEAR account ID is required for registration.");
+		onError?.(error);
+		throw error;
+	}
+	const validation = require_validation.validateNearAccountId(nearAccountId);
+	if (!validation.valid) {
+		const error = /* @__PURE__ */ new Error(`Invalid NEAR account ID: ${validation.error}`);
+		onError?.(error);
+		throw error;
+	}
+	if (!window.isSecureContext) {
+		const error = /* @__PURE__ */ new Error("Passkey operations require a secure context (HTTPS or localhost).");
+		onError?.(error);
+		throw error;
+	}
+	onEvent?.({
+		step: 1,
+		phase: require_sdkSentEvents.RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,
+		status: require_sdkSentEvents.RegistrationStatus.PROGRESS,
+		message: `Account format validated, preparing confirmation`
+	});
+};
+/**
+* Rollback registration data in case of errors
+*/
+async function performRegistrationRollback(registrationState, nearAccountId, webAuthnManager, onEvent) {
+	console.debug("Starting registration rollback...", registrationState);
+	try {
+		await webAuthnManager.clearVrfSession();
+		if (registrationState.databaseStored) {
+			console.debug("Rolling back database storage...");
+			onEvent?.({
+				step: 0,
+				phase: require_sdkSentEvents.RegistrationPhase.REGISTRATION_ERROR,
+				status: require_sdkSentEvents.RegistrationStatus.ERROR,
+				message: "Rolling back database storage...",
+				error: "Registration failed - rolling back database storage"
+			});
+			await webAuthnManager.rollbackUserRegistration(nearAccountId);
+			console.debug("Database rollback completed");
+		}
+		if (registrationState.contractRegistered) {
+			console.debug("Contract registration cannot be rolled back (immutable blockchain state)");
+			onEvent?.({
+				step: 0,
+				phase: require_sdkSentEvents.RegistrationPhase.REGISTRATION_ERROR,
+				status: require_sdkSentEvents.RegistrationStatus.ERROR,
+				message: `Contract registration (tx: ${registrationState.contractTransactionId}) cannot be rolled back`,
+				error: "Registration failed - contract state is immutable"
+			});
+		}
+		console.debug("Registration rollback completed");
+	} catch (rollbackError) {
+		console.error("Rollback failed:", rollbackError);
+		onEvent?.({
+			step: 0,
+			phase: require_sdkSentEvents.RegistrationPhase.REGISTRATION_ERROR,
+			status: require_sdkSentEvents.RegistrationStatus.ERROR,
+			message: `Rollback failed: ${rollbackError && typeof rollbackError === "object" && "message" in rollbackError ? String(rollbackError.message || "") : String(rollbackError || "")}`,
+			error: "Both registration and rollback failed"
+		});
+	}
+}
+async function activateThresholdEnrollmentPostRegistration(opts) {
+	if (opts.requestedSignerMode !== "threshold-signer") return;
+	const thresholdPublicKey = String(opts.thresholdPublicKey || "").trim();
+	const relayerKeyId = String(opts.relayerKeyId || "").trim();
+	const clientVerifyingShareB64u = String(opts.thresholdClientVerifyingShareB64u || "").trim();
+	const relayerVerifyingShareB64u = String(opts.relayerVerifyingShareB64u || "").trim();
+	if (!thresholdPublicKey || !relayerKeyId || !clientVerifyingShareB64u || !relayerVerifyingShareB64u) {
+		console.warn("[Registration] threshold-signer requested but threshold enrollment details are missing; continuing with local-signer only");
+		return;
+	}
+	try {
+		opts.onEvent?.({
+			step: 6,
+			phase: require_sdkSentEvents.RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,
+			status: require_sdkSentEvents.RegistrationStatus.PROGRESS,
+			message: "Activating threshold access key onchain..."
+		});
+		try {
+			opts.webAuthnManager.getNonceManager().initializeUser(opts.nearAccountId, opts.nearPublicKey);
+		} catch {}
+		const txContext = await opts.webAuthnManager.getNonceManager().getNonceBlockHashAndHeight(opts.nearClient, { force: true });
+		const signed = await opts.webAuthnManager.signAddKeyThresholdPublicKeyNoPrompt({
+			nearAccountId: opts.nearAccountId,
+			credential: opts.credential,
+			wrapKeySalt: opts.wrapKeySalt,
+			transactionContext: txContext,
+			thresholdPublicKey,
+			relayerVerifyingShareB64u,
+			clientParticipantId: opts.clientParticipantId,
+			relayerParticipantId: opts.relayerParticipantId
+		});
+		const signedTx = signed?.signedTransaction;
+		if (!signedTx) throw new Error("Failed to sign AddKey(thresholdPublicKey) transaction");
+		await opts.nearClient.sendTransaction(signedTx, require_rpc.DEFAULT_WAIT_STATUS.thresholdAddKey);
+		const thresholdKeyVerified = await verifyAccountAccessKeysPresent(opts.nearClient, opts.nearAccountId, [opts.nearPublicKey, thresholdPublicKey]);
+		if (!thresholdKeyVerified) throw new Error("Threshold access key not found on-chain after AddKey");
+		await require_index.IndexedDBManager.nearKeysDB.storeKeyMaterial({
+			kind: "threshold_ed25519_2p_v1",
+			nearAccountId: opts.nearAccountId,
+			deviceNumber: 1,
+			publicKey: thresholdPublicKey,
+			wrapKeySalt: opts.wrapKeySalt,
+			relayerKeyId,
+			clientShareDerivation: "prf_first_v1",
+			participants: require_participants.buildThresholdEd25519Participants2pV1({
+				clientParticipantId: opts.clientParticipantId,
+				relayerParticipantId: opts.relayerParticipantId,
+				relayerKeyId,
+				relayerUrl: opts.webAuthnManager.tatchiPasskeyConfigs?.relayer?.url,
+				clientVerifyingShareB64u,
+				relayerVerifyingShareB64u,
+				clientShareDerivation: "prf_first_v1"
+			}),
+			timestamp: Date.now()
+		});
+		opts.onEvent?.({
+			step: 6,
+			phase: require_sdkSentEvents.RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,
+			status: require_sdkSentEvents.RegistrationStatus.SUCCESS,
+			message: "Threshold access key activated on-chain"
+		});
+	} catch (e) {
+		console.warn("[Registration] threshold enrollment activation failed; continuing with local-signer only:", e);
+	}
+}
+async function verifyAccountAccessKeysPresent(nearClient, nearAccountId, expectedPublicKeys, opts) {
+	const unique = Array.from(new Set(expectedPublicKeys.map((k) => require_validation.ensureEd25519Prefix(k)).filter(Boolean)));
+	if (!unique.length) return false;
+	const attempts = Math.max(1, Math.floor(opts?.attempts ?? 6));
+	const delayMs = Math.max(50, Math.floor(opts?.delayMs ?? 750));
+	for (let i = 0; i < attempts; i++) {
+		try {
+			const { fullAccessKeys, functionCallAccessKeys } = await nearClient.getAccessKeys({ account: nearAccountId });
+			const keys = [...fullAccessKeys, ...functionCallAccessKeys].map((k) => require_validation.ensureEd25519Prefix(k.public_key));
+			const allPresent = unique.every((expected) => keys.includes(expected));
+			if (allPresent) return true;
+		} catch {}
+		await new Promise((res) => setTimeout(res, delayMs));
+	}
+	return false;
+}
+
+//#endregion
+exports.registerPasskey = registerPasskey;
+exports.registerPasskeyInternal = registerPasskeyInternal;
+//# sourceMappingURL=registration.js.map

package/dist/cjs/react/src/core/TatchiPasskey/registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.js","names":["RegistrationPhase","RegistrationStatus","confirmationConfig: Partial<ConfirmationConfig>","mergeSignerMode","thresholdClientVerifyingShareB64u: string | null","createAccountAndRegisterWithRelayServer","expectedAccessKeys: string[]","error: unknown","getUserFriendlyErrorMessage","validateNearAccountId","rollbackError: unknown","DEFAULT_WAIT_STATUS","IndexedDBManager","buildThresholdEd25519Participants2pV1","ensureEd25519Prefix"],"sources":["../../../../../../src/core/TatchiPasskey/registration.ts"],"sourcesContent":["import type { NearClient } from '../NearClient';\nimport { ensureEd25519Prefix, validateNearAccountId } from '../../utils/validation';\nimport type {\n  RegistrationHooksOptions,\n  RegistrationSSEEvent,\n} from '../types/sdkSentEvents';\nimport type { RegistrationResult, TatchiConfigs } from '../types/tatchi';\nimport type { AuthenticatorOptions } from '../types/authenticatorOptions';\nimport { RegistrationPhase, RegistrationStatus } from '../types/sdkSentEvents';\nimport {\n  createAccountAndRegisterWithRelayServer\n} from './faucets/createAccountRelayServer';\nimport { PasskeyManagerContext } from './index';\nimport { WebAuthnManager } from '../WebAuthnManager';\nimport { IndexedDBManager } from '../IndexedDBManager';\nimport { VRFChallenge } from '../types/vrf-worker';\nimport { type ConfirmationConfig, type SignerMode, mergeSignerMode } from '../types/signer-worker';\nimport type { WebAuthnRegistrationCredential } from '../types/webauthn';\nimport type { AccountId } from '../types/accountIds';\nimport { getUserFriendlyErrorMessage } from '../../utils/errors';\nimport { authenticatorsToAllowCredentials } from '../WebAuthnManager/touchIdPrompt';\nimport { DEFAULT_WAIT_STATUS } from '../types/rpc';\nimport { buildThresholdEd25519Participants2pV1 } from '../../threshold/participants';\n// Registration forces a visible, clickable confirmation for cross‑origin safety\n\n/**\n * Core registration function that handles passkey registration\n *\n * VRF Registration Flow (Single VRF Keypair):\n * 1. Generate VRF keypair (ed25519) using crypto.randomUUID() + persist in worker memory\n * 2. Generate VRF proof + output using the VRF keypair\n *    - VRF input with domain separator + NEAR block height + hash\n * 3. Use VRF output as WebAuthn challenge in registration ceremony\n * 4. Derive AES key from WebAuthn PRF output and encrypt the SAME VRF keypair\n * 5. Store encrypted VRF keypair in IndexedDB\n * 6. Call contract verify_registration_response with VRF proof + WebAuthn registration payload\n * 7. Contract verifies VRF proof and WebAuthn registration (challenges match!)\n * 8. Contract stores VRF pubkey + authenticator credentials on-chain for\n *    future stateless authentication\n */\nexport async function registerPasskeyInternal(\n  context: PasskeyManagerContext,\n  nearAccountId: AccountId,\n  options: RegistrationHooksOptions,\n  authenticatorOptions: AuthenticatorOptions,\n  confirmationConfigOverride?: Partial<ConfirmationConfig>\n): Promise<RegistrationResult> {\n\n  const { onEvent, onError, afterCall } = options;\n  const { webAuthnManager, configs } = context;\n\n  // Track registration progress for rollback\n  const registrationState = {\n    accountCreated: false,\n    contractRegistered: false,\n    databaseStored: false,\n    contractTransactionId: null as string | null,\n  };\n\n  console.log('⚡ Registration: Passkey registration with VRF WebAuthn');\n  onEvent?.({\n    step: 1,\n    phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n    status: RegistrationStatus.PROGRESS,\n    message: `Starting registration for ${nearAccountId}`\n  } as RegistrationSSEEvent);\n\n  try {\n\n    await validateRegistrationInputs(context, nearAccountId, onEvent, onError);\n\n    onEvent?.({\n      step: 1,\n      phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Account available, generating credentials...'\n    });\n\n    const confirmationConfig: Partial<ConfirmationConfig> = {\n      uiMode: 'modal',\n      behavior: 'requireClick', // cross‑origin safari requirement: must requireClick\n      theme: (context.configs?.walletTheme === 'light') ? 'light' : 'dark',\n      ...(confirmationConfigOverride ?? options?.confirmationConfig ?? {}),\n    };\n\n    const registrationSession = await context.webAuthnManager.requestRegistrationCredentialConfirmation({\n      nearAccountId: String(nearAccountId),\n      deviceNumber: 1,\n      confirmerText: options?.confirmerText,\n      confirmationConfigOverride: confirmationConfig,\n    });\n\n    const credential = registrationSession.credential;\n    const vrfChallenge = registrationSession.vrfChallenge;\n\n    onEvent?.({\n      step: 1,\n      phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n      status: RegistrationStatus.SUCCESS,\n      message: 'WebAuthn ceremony successful'\n    });\n\n    // Start the contract pre-check, run it in parallel to key derivation (await later)\n    const canRegisterUserPromise = webAuthnManager.checkCanRegisterUser({\n      contractId: context.configs.contractId,\n      credential,\n      vrfChallenge,\n      onEvent: (progress) => {\n        console.debug(`Registration progress: ${progress.step} - ${progress.message}`);\n        onEvent?.({\n          step: 3,\n          phase: RegistrationPhase.STEP_3_CONTRACT_PRE_CHECK,\n          status: RegistrationStatus.PROGRESS,\n          message: `${progress.message}`\n        });\n      },\n    });\n\n    // 1) Ensure VRF keypair is derived and loaded in-memory\n    // before deriving WrapKeySeed for NEAR key encryption\n    const deterministicVrfKeyResult = await webAuthnManager.deriveVrfKeypair({\n      credential,\n      nearAccountId,\n      saveInMemory: true,\n    });\n    if (!deterministicVrfKeyResult.success || !deterministicVrfKeyResult.vrfPublicKey) {\n      throw new Error('Failed to derive deterministic VRF keypair from PRF');\n    }\n\n    const baseSignerMode = webAuthnManager.getUserPreferences().getSignerMode();\n    const requestedSignerMode = mergeSignerMode(baseSignerMode, options?.signerMode);\n    const requestedSignerModeStr = requestedSignerMode.mode;\n\n    // 2) Derive/enroll the local NEAR key after VRF keypair exists.\n    const nearKeyResult = await webAuthnManager.deriveNearKeypairAndEncryptFromSerialized({\n      credential,\n      nearAccountId,\n      options: { deviceNumber: 1 },\n    });\n    if (!nearKeyResult.success || !nearKeyResult.publicKey) {\n      const reason = nearKeyResult?.error || 'Failed to generate NEAR keypair with PRF';\n      throw new Error(reason);\n    }\n    const nearPublicKey = nearKeyResult.publicKey;\n    const wrapKeySalt = String(nearKeyResult.wrapKeySalt || '').trim();\n    if (!wrapKeySalt) {\n      throw new Error('Missing wrapKeySalt after local key derivation');\n    }\n\n    // Optional: threshold-signer enrollment during registration.\n    // Derive client verifying share (public) and let the relay compute threshold group public key\n    // and include it in the on-chain AddKey set during create_account_and_register_user.\n    let thresholdClientVerifyingShareB64u: string | null = null;\n    if (requestedSignerModeStr === 'threshold-signer') {\n      const derived = await webAuthnManager.deriveThresholdEd25519ClientVerifyingShareFromCredential({\n        credential,\n        nearAccountId,\n        wrapKeySalt,\n      });\n      if (!derived.success || !derived.clientVerifyingShareB64u) {\n        throw new Error(derived.error || 'Failed to derive threshold client verifying share');\n      }\n      thresholdClientVerifyingShareB64u = derived.clientVerifyingShareB64u;\n    }\n\n    // 3) Await contract registration check (main blocker)\n    const canRegisterUserResult = await canRegisterUserPromise;\n    if (!canRegisterUserResult.verified) {\n      console.error(canRegisterUserResult);\n      const errorMessage = canRegisterUserResult.error || 'User verification failed - account may already exist or contract is unreachable';\n      throw new Error(`Web3Authn contract registration check failed: ${errorMessage}`);\n    }\n\n    // Step 4-5: Create account and register with contract using the relay (atomic)\n    onEvent?.({\n      step: 2,\n      phase: RegistrationPhase.STEP_2_KEY_GENERATION,\n      status: RegistrationStatus.SUCCESS,\n      message: 'Wallet derived successfully from Passkey',\n      verified: true,\n      nearAccountId: nearAccountId,\n      nearPublicKey: nearPublicKey,\n      vrfPublicKey: vrfChallenge.vrfPublicKey,\n    });\n\n    let accountAndRegistrationResult;\n    accountAndRegistrationResult = await createAccountAndRegisterWithRelayServer(\n      context,\n      nearAccountId,\n      nearPublicKey,\n      credential,\n      vrfChallenge,\n      deterministicVrfKeyResult.vrfPublicKey,\n      authenticatorOptions,\n      onEvent,\n      {\n        thresholdEd25519: thresholdClientVerifyingShareB64u\n          ? { clientVerifyingShareB64u: thresholdClientVerifyingShareB64u }\n          : undefined,\n      },\n    );\n\n    if (!accountAndRegistrationResult.success) {\n      throw new Error(accountAndRegistrationResult.error || 'Account creation and registration failed');\n    }\n\n    // Update registration state based on results\n    registrationState.accountCreated = true;\n    registrationState.contractRegistered = true;\n    registrationState.contractTransactionId = accountAndRegistrationResult.transactionId || null;\n\n    // Step 6: Post-commit verification: ensure on-chain access key matches expected public key\n    onEvent?.({\n      step: 6,\n      phase: RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Verifying on-chain access key matches expected public key...'\n    });\n\n    const expectedAccessKeys: string[] = [nearPublicKey];\n    const thresholdPublicKey = String(accountAndRegistrationResult?.thresholdEd25519?.publicKey || '').trim();\n    const relayerKeyId = String(accountAndRegistrationResult?.thresholdEd25519?.relayerKeyId || '').trim();\n\n    const accessKeyVerified = await verifyAccountAccessKeysPresent(\n      context.nearClient,\n      nearAccountId,\n      expectedAccessKeys,\n    );\n\n    if (!accessKeyVerified) {\n      throw new Error('On-chain access key mismatch or not found after registration');\n    }\n\n    onEvent?.({\n      step: 6,\n      phase: RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,\n      status: RegistrationStatus.SUCCESS,\n      message: 'Access key verified on-chain'\n    });\n\n    await activateThresholdEnrollmentPostRegistration({\n      requestedSignerMode: requestedSignerModeStr,\n      nearAccountId,\n      nearPublicKey,\n      thresholdPublicKey,\n      relayerKeyId,\n      clientParticipantId: accountAndRegistrationResult?.thresholdEd25519?.clientParticipantId,\n      relayerParticipantId: accountAndRegistrationResult?.thresholdEd25519?.relayerParticipantId,\n      thresholdClientVerifyingShareB64u,\n      relayerVerifyingShareB64u: String(\n        accountAndRegistrationResult?.thresholdEd25519?.relayerVerifyingShareB64u || '',\n      ).trim(),\n      credential,\n      wrapKeySalt,\n      webAuthnManager: context.webAuthnManager,\n      nearClient: context.nearClient,\n      onEvent,\n    });\n\n    // Step 7: Store user data with VRF credentials atomically\n    onEvent?.({\n      step: 7,\n      phase: RegistrationPhase.STEP_7_DATABASE_STORAGE,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Storing passkey wallet metadata...'\n    });\n\n    await webAuthnManager.atomicStoreRegistrationData({\n      nearAccountId,\n      credential,\n      publicKey: nearPublicKey,\n      encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,\n      vrfPublicKey: deterministicVrfKeyResult.vrfPublicKey,\n      serverEncryptedVrfKeypair: deterministicVrfKeyResult.serverEncryptedVrfKeypair,\n    });\n\n    // Mark database as stored for rollback tracking\n    registrationState.databaseStored = true;\n\n    onEvent?.({\n      step: 7,\n      phase: RegistrationPhase.STEP_7_DATABASE_STORAGE,\n      status: RegistrationStatus.SUCCESS,\n      message: 'Registration metadata stored successfully'\n    });\n\n    // Initialize NonceManager with newly stored user before fetching block/nonce\n    try {\n      context.webAuthnManager.getNonceManager().initializeUser(nearAccountId, nearPublicKey);\n      await context.webAuthnManager.getNonceManager().prefetchBlockheight(context.nearClient);\n    } catch {}\n\n    // Step 7: Ensure VRF session is active for auto-login\n    // If VRF keypair is already in-memory (saved earlier), skip an extra Touch ID prompt.\n    let vrfStatus = await webAuthnManager.checkVrfStatus().catch(() => ({ active: false }));\n    if (!vrfStatus?.active) {\n      // Obtain an authentication credential for VRF unlock (separate from registration credential)\n      // IMPORTANT: Immediately after account creation, the new access key may not be queryable yet on some RPC nodes.\n      // We only need fresh block info for the VRF challenge here, so fetch the block directly to avoid AK lookup failures.\n      const blockInfo = await context.nearClient.viewBlock({ finality: 'final' });\n      const txBlockHash = blockInfo?.header?.hash;\n      const txBlockHeight = String(blockInfo.header?.height ?? '');\n      const vrfChallenge2 = await webAuthnManager.generateVrfChallengeOnce({\n        userId: nearAccountId,\n        rpId: webAuthnManager.getRpId(),\n        blockHash: txBlockHash,\n        blockHeight: txBlockHeight,\n      });\n      const authenticators = await webAuthnManager.getAuthenticatorsByUser(nearAccountId);\n      const authCredential = await webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({\n        nearAccountId,\n        challenge: vrfChallenge2,\n        credentialIds: authenticators.map((a) => a.credentialId),\n      });\n      const unlockResult = await webAuthnManager.unlockVRFKeypair({\n        nearAccountId: nearAccountId,\n        encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,\n        credential: authCredential,\n      }).catch((unlockError: unknown) => {\n        const message = (unlockError && typeof unlockError === 'object' && 'message' in unlockError)\n          ? String((unlockError as { message?: unknown }).message || '')\n          : String(unlockError || '');\n        return { success: false, error: message };\n      });\n\n      if (!unlockResult.success) {\n        console.warn('VRF keypair unlock failed:', unlockResult.error);\n        throw new Error(unlockResult.error);\n      }\n    } else {\n      console.debug('Registration: VRF session already active; skipping extra Touch ID unlock');\n    }\n\n    // Initialize current user only after a successful unlock\n    try {\n      await webAuthnManager.initializeCurrentUser(nearAccountId, context.nearClient);\n    } catch (initErr) {\n      console.warn('Failed to initialize current user after registration:', initErr);\n    }\n\n    onEvent?.({\n      step: 8,\n      phase: RegistrationPhase.STEP_8_REGISTRATION_COMPLETE,\n      status: RegistrationStatus.SUCCESS,\n      message: 'Registration completed!'\n    });\n\n    const successResult = {\n      success: true,\n      nearAccountId: nearAccountId,\n      clientNearPublicKey: nearPublicKey,\n      transactionId: registrationState.contractTransactionId,\n      vrfRegistration: {\n        success: true,\n        vrfPublicKey: vrfChallenge.vrfPublicKey,\n        encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,\n        contractVerified: accountAndRegistrationResult.success,\n      }\n    };\n\n    afterCall?.(true, successResult);\n    return successResult;\n\n  } catch (error: unknown) {\n    const message = (error && typeof error === 'object' && 'message' in error)\n      ? String((error as { message?: unknown }).message || '')\n      : String(error || '');\n    const stack = (error && typeof error === 'object' && 'stack' in error)\n      ? String((error as { stack?: unknown }).stack || '')\n      : '';\n    console.error('Registration failed:', message, stack);\n\n    // Perform rollback based on registration state\n    await performRegistrationRollback(\n      registrationState,\n      nearAccountId,\n      webAuthnManager,\n      onEvent\n    );\n\n    // Use centralized error handling\n    const errorMessage = getUserFriendlyErrorMessage(error, 'registration', nearAccountId);\n\n    const errorObject = new Error(errorMessage);\n    onError?.(errorObject);\n\n    onEvent?.({\n      step: 0,\n      phase: RegistrationPhase.REGISTRATION_ERROR,\n      status: RegistrationStatus.ERROR,\n      message: errorMessage,\n      error: errorMessage\n    } as RegistrationSSEEvent);\n\n    const result = { success: false, error: errorMessage };\n    afterCall?.(false);\n    return result;\n  }\n}\n\n// Backward-compatible wrapper without explicit confirmationConfig override\nexport async function registerPasskey(\n  context: PasskeyManagerContext,\n  nearAccountId: AccountId,\n  options: RegistrationHooksOptions,\n  authenticatorOptions: AuthenticatorOptions\n): Promise<RegistrationResult> {\n  return registerPasskeyInternal(context, nearAccountId, options, authenticatorOptions, undefined);\n}\n\n//////////////////////////////////////\n// HELPER FUNCTIONS\n//////////////////////////////////////\n\n/**\n * Generate a VRF keypair + challenge in VRF wasm worker for WebAuthn registration ceremony bootstrapping\n *\n * ARCHITECTURE: This function solves the chicken-and-egg problem with a single VRF keypair:\n * 1. Generate VRF keypair + challenge (no PRF needed)\n * 2. Persist VRF keypair in worker memory (NOT encrypted yet)\n * 3. Use VRF challenge for WebAuthn ceremony → get PRF output\n * 4. Encrypt the SAME VRF keypair (still in memory) with PRF\n *\n * @param webAuthnManager - WebAuthn manager instance\n * @param nearAccountId - NEAR account ID for VRF input\n * @param blockHeight - Current NEAR block height for freshness\n * @param blockHashBytes - Current NEAR block hash bytes for entropy\n * @returns VRF challenge data (VRF keypair persisted in worker memory)\n */\nexport async function generateBootstrapVrfChallenge(\n  context: PasskeyManagerContext,\n  nearAccountId: AccountId,\n): Promise<VRFChallenge> {\n\n  const { webAuthnManager, nearClient } = context;\n\n  const blockInfo = await nearClient.viewBlock({ finality: 'final' });\n\n  // Generate VRF keypair and persist in worker memory\n  const vrfResult = await webAuthnManager.generateVrfKeypairBootstrap({\n    vrfInputData: {\n      userId: nearAccountId,\n      // Keep VRF rpId consistent with WebAuthn rpId selection logic.\n      rpId: webAuthnManager.getRpId(),\n      blockHeight: String(blockInfo.header.height),\n      blockHash: blockInfo.header.hash,\n    },\n    saveInMemory: true,\n    // VRF keypair persists in worker memory until PRF encryption\n  });\n\n  if (!vrfResult.vrfChallenge) {\n    throw new Error('Registration VRF keypair generation failed');\n  }\n  return vrfResult.vrfChallenge;\n}\n\n/**\n * Validates registration inputs and throws errors if invalid\n * @param nearAccountId - NEAR account ID to validate\n * @param onEvent - Optional callback for registration progress events\n * @param onError - Optional callback for error handling\n */\nconst validateRegistrationInputs = async (\n  context: {\n    configs: TatchiConfigs,\n    webAuthnManager: WebAuthnManager,\n    nearClient: NearClient,\n  },\n  nearAccountId: AccountId,\n  onEvent?: (event: RegistrationSSEEvent) => void,\n  onError?: (error: Error) => void,\n) => {\n\n  onEvent?.({\n    step: 1,\n    phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n    status: RegistrationStatus.PROGRESS,\n    message: 'Validating registration inputs...'\n  } as RegistrationSSEEvent);\n\n  // Validation\n  if (!nearAccountId) {\n    const error = new Error('NEAR account ID is required for registration.');\n    onError?.(error);\n    throw error;\n  }\n  // Validate the account ID format\n  const validation = validateNearAccountId(nearAccountId);\n  if (!validation.valid) {\n    const error = new Error(`Invalid NEAR account ID: ${validation.error}`);\n    onError?.(error);\n    throw error;\n  }\n  if (!window.isSecureContext) {\n    const error = new Error('Passkey operations require a secure context (HTTPS or localhost).');\n    onError?.(error);\n    throw error;\n  }\n\n  // on-chain account existence check is performed later via signer worker (checkCanRegisterUser),\n  onEvent?.({\n    step: 1,\n    phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n    status: RegistrationStatus.PROGRESS,\n    message: `Account format validated, preparing confirmation`\n  } as RegistrationSSEEvent);\n  return;\n}\n\n/**\n * Rollback registration data in case of errors\n */\nasync function performRegistrationRollback(\n  registrationState: {\n    accountCreated: boolean;\n    contractRegistered: boolean;\n    databaseStored: boolean;\n    contractTransactionId: string | null;\n  },\n  nearAccountId: AccountId,\n  webAuthnManager: WebAuthnManager,\n  onEvent?: (event: RegistrationSSEEvent) => void\n): Promise<void> {\n  console.debug('Starting registration rollback...', registrationState);\n\n  // Rollback in reverse order\n  try {\n    // 1. Always clear any in-memory VRF session established during bootstrap\n    await webAuthnManager.clearVrfSession();\n\n    // 2. Rollback database storage\n    if (registrationState.databaseStored) {\n      console.debug('Rolling back database storage...');\n      onEvent?.({\n        step: 0,\n        phase: RegistrationPhase.REGISTRATION_ERROR,\n        status: RegistrationStatus.ERROR,\n        message: 'Rolling back database storage...',\n        error: 'Registration failed - rolling back database storage'\n      } as RegistrationSSEEvent);\n\n      await webAuthnManager.rollbackUserRegistration(nearAccountId);\n      console.debug('Database rollback completed');\n    }\n\n    // 3. Contract rollback on the Web3Authn contract\n    // NOT NEEDED - account creation and contract registration are atomic in the relay server flow\n    if (registrationState.contractRegistered) {\n      console.debug('Contract registration cannot be rolled back (immutable blockchain state)');\n      onEvent?.({\n        step: 0,\n        phase: RegistrationPhase.REGISTRATION_ERROR,\n        status: RegistrationStatus.ERROR,\n        message: `Contract registration (tx: ${registrationState.contractTransactionId}) cannot be rolled back`,\n        error: 'Registration failed - contract state is immutable'\n      } as RegistrationSSEEvent);\n    }\n    console.debug('Registration rollback completed');\n\n  } catch (rollbackError: unknown) {\n    console.error('Rollback failed:', rollbackError);\n    onEvent?.({\n      step: 0,\n      phase: RegistrationPhase.REGISTRATION_ERROR,\n      status: RegistrationStatus.ERROR,\n      message: `Rollback failed: ${\n        (rollbackError && typeof rollbackError === 'object' && 'message' in rollbackError)\n          ? String((rollbackError as { message?: unknown }).message || '')\n          : String(rollbackError || '')\n      }`,\n      error: 'Both registration and rollback failed'\n    } as RegistrationSSEEvent);\n  }\n}\n\nasync function activateThresholdEnrollmentPostRegistration(opts: {\n  requestedSignerMode: SignerMode['mode'];\n  nearAccountId: AccountId;\n  nearPublicKey: string;\n  thresholdPublicKey: string;\n  relayerKeyId: string;\n  clientParticipantId?: number;\n  relayerParticipantId?: number;\n  thresholdClientVerifyingShareB64u: string | null;\n  relayerVerifyingShareB64u: string;\n  credential: WebAuthnRegistrationCredential;\n  wrapKeySalt: string;\n  webAuthnManager: WebAuthnManager;\n  nearClient: NearClient;\n  onEvent?: (event: RegistrationSSEEvent) => void;\n}): Promise<void> {\n  // Optional: activate threshold enrollment post-registration by having the client\n  // submit AddKey(thresholdPublicKey) signed with the local key.\n  if (opts.requestedSignerMode !== 'threshold-signer') return;\n\n  const thresholdPublicKey = String(opts.thresholdPublicKey || '').trim();\n  const relayerKeyId = String(opts.relayerKeyId || '').trim();\n  const clientVerifyingShareB64u = String(opts.thresholdClientVerifyingShareB64u || '').trim();\n  const relayerVerifyingShareB64u = String(opts.relayerVerifyingShareB64u || '').trim();\n\n  if (!thresholdPublicKey || !relayerKeyId || !clientVerifyingShareB64u || !relayerVerifyingShareB64u) {\n    console.warn('[Registration] threshold-signer requested but threshold enrollment details are missing; continuing with local-signer only');\n    return;\n  }\n\n  try {\n    opts.onEvent?.({\n      step: 6,\n      phase: RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Activating threshold access key onchain...'\n    });\n\n    // Prepare a single AddKey transaction signed with the local key (no extra TouchID prompt).\n    try {\n      opts.webAuthnManager.getNonceManager().initializeUser(opts.nearAccountId, opts.nearPublicKey);\n    } catch {}\n    const txContext = await opts.webAuthnManager.getNonceManager().getNonceBlockHashAndHeight(\n      opts.nearClient,\n      { force: true },\n    );\n\n    const signed = await opts.webAuthnManager.signAddKeyThresholdPublicKeyNoPrompt({\n      nearAccountId: opts.nearAccountId,\n      credential: opts.credential,\n      wrapKeySalt: opts.wrapKeySalt,\n      transactionContext: txContext,\n      thresholdPublicKey,\n      relayerVerifyingShareB64u,\n      clientParticipantId: opts.clientParticipantId,\n      relayerParticipantId: opts.relayerParticipantId,\n    });\n\n    const signedTx = signed?.signedTransaction;\n    if (!signedTx) throw new Error('Failed to sign AddKey(thresholdPublicKey) transaction');\n\n    await opts.nearClient.sendTransaction(signedTx, DEFAULT_WAIT_STATUS.thresholdAddKey);\n\n    const thresholdKeyVerified = await verifyAccountAccessKeysPresent(\n      opts.nearClient,\n      opts.nearAccountId,\n      [opts.nearPublicKey, thresholdPublicKey],\n    );\n    if (!thresholdKeyVerified) {\n      throw new Error('Threshold access key not found on-chain after AddKey');\n    }\n\n    await IndexedDBManager.nearKeysDB.storeKeyMaterial({\n      kind: 'threshold_ed25519_2p_v1',\n      nearAccountId: opts.nearAccountId,\n      deviceNumber: 1,\n      publicKey: thresholdPublicKey,\n      wrapKeySalt: opts.wrapKeySalt,\n      relayerKeyId,\n      clientShareDerivation: 'prf_first_v1',\n      participants: buildThresholdEd25519Participants2pV1({\n        clientParticipantId: opts.clientParticipantId,\n        relayerParticipantId: opts.relayerParticipantId,\n        relayerKeyId,\n        relayerUrl: opts.webAuthnManager.tatchiPasskeyConfigs?.relayer?.url,\n        clientVerifyingShareB64u,\n        relayerVerifyingShareB64u,\n        clientShareDerivation: 'prf_first_v1',\n      }),\n      timestamp: Date.now(),\n    });\n\n    opts.onEvent?.({\n      step: 6,\n      phase: RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,\n      status: RegistrationStatus.SUCCESS,\n      message: 'Threshold access key activated on-chain'\n    });\n  } catch (e) {\n    console.warn('[Registration] threshold enrollment activation failed; continuing with local-signer only:', e);\n  }\n}\n\nasync function verifyAccountAccessKeysPresent(\n  nearClient: NearClient,\n  nearAccountId: string,\n  expectedPublicKeys: string[],\n  opts?: { attempts?: number; delayMs?: number },\n): Promise<boolean> {\n  const unique = Array.from(\n    new Set(expectedPublicKeys.map((k) => ensureEd25519Prefix(k)).filter(Boolean)),\n  );\n  if (!unique.length) return false;\n\n  const attempts = Math.max(1, Math.floor(opts?.attempts ?? 6));\n  const delayMs = Math.max(50, Math.floor(opts?.delayMs ?? 750));\n\n  for (let i = 0; i < attempts; i++) {\n    try {\n      const { fullAccessKeys, functionCallAccessKeys } = await nearClient.getAccessKeys({ account: nearAccountId });\n      const keys = [...fullAccessKeys, ...functionCallAccessKeys].map((k) => ensureEd25519Prefix(k.public_key));\n      const allPresent = unique.every((expected) => keys.includes(expected));\n      if (allPresent) return true;\n    } catch {\n      // tolerate transient view errors during propagation; retry\n    }\n    await new Promise((res) => setTimeout(res, delayMs));\n  }\n  return false;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,eAAsB,wBACpB,SACA,eACA,SACA,sBACA,4BAC6B;CAE7B,MAAM,EAAE,SAAS,SAAS,cAAc;CACxC,MAAM,EAAE,iBAAiB,YAAY;CAGrC,MAAM,oBAAoB;EACxB,gBAAgB;EAChB,oBAAoB;EACpB,gBAAgB;EAChB,uBAAuB;;AAGzB,SAAQ,IAAI;AACZ,WAAU;EACR,MAAM;EACN,OAAOA,wCAAkB;EACzB,QAAQC,yCAAmB;EAC3B,SAAS,6BAA6B;;AAGxC,KAAI;AAEF,QAAM,2BAA2B,SAAS,eAAe,SAAS;AAElE,YAAU;GACR,MAAM;GACN,OAAOD,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;EAGX,MAAMC,qBAAkD;GACtD,QAAQ;GACR,UAAU;GACV,OAAQ,QAAQ,SAAS,gBAAgB,UAAW,UAAU;GAC9D,GAAI,8BAA8B,SAAS,sBAAsB;;EAGnE,MAAM,sBAAsB,MAAM,QAAQ,gBAAgB,0CAA0C;GAClG,eAAe,OAAO;GACtB,cAAc;GACd,eAAe,SAAS;GACxB,4BAA4B;;EAG9B,MAAM,aAAa,oBAAoB;EACvC,MAAM,eAAe,oBAAoB;AAEzC,YAAU;GACR,MAAM;GACN,OAAOF,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;EAIX,MAAM,yBAAyB,gBAAgB,qBAAqB;GAClE,YAAY,QAAQ,QAAQ;GAC5B;GACA;GACA,UAAU,aAAa;AACrB,YAAQ,MAAM,0BAA0B,SAAS,KAAK,KAAK,SAAS;AACpE,cAAU;KACR,MAAM;KACN,OAAOD,wCAAkB;KACzB,QAAQC,yCAAmB;KAC3B,SAAS,GAAG,SAAS;;;;EAO3B,MAAM,4BAA4B,MAAM,gBAAgB,iBAAiB;GACvE;GACA;GACA,cAAc;;AAEhB,MAAI,CAAC,0BAA0B,WAAW,CAAC,0BAA0B,aACnE,OAAM,IAAI,MAAM;EAGlB,MAAM,iBAAiB,gBAAgB,qBAAqB;EAC5D,MAAM,sBAAsBE,sCAAgB,gBAAgB,SAAS;EACrE,MAAM,yBAAyB,oBAAoB;EAGnD,MAAM,gBAAgB,MAAM,gBAAgB,0CAA0C;GACpF;GACA;GACA,SAAS,EAAE,cAAc;;AAE3B,MAAI,CAAC,cAAc,WAAW,CAAC,cAAc,WAAW;GACtD,MAAM,SAAS,eAAe,SAAS;AACvC,SAAM,IAAI,MAAM;;EAElB,MAAM,gBAAgB,cAAc;EACpC,MAAM,cAAc,OAAO,cAAc,eAAe,IAAI;AAC5D,MAAI,CAAC,YACH,OAAM,IAAI,MAAM;EAMlB,IAAIC,oCAAmD;AACvD,MAAI,2BAA2B,oBAAoB;GACjD,MAAM,UAAU,MAAM,gBAAgB,yDAAyD;IAC7F;IACA;IACA;;AAEF,OAAI,CAAC,QAAQ,WAAW,CAAC,QAAQ,yBAC/B,OAAM,IAAI,MAAM,QAAQ,SAAS;AAEnC,uCAAoC,QAAQ;;EAI9C,MAAM,wBAAwB,MAAM;AACpC,MAAI,CAAC,sBAAsB,UAAU;AACnC,WAAQ,MAAM;GACd,MAAM,eAAe,sBAAsB,SAAS;AACpD,SAAM,IAAI,MAAM,iDAAiD;;AAInE,YAAU;GACR,MAAM;GACN,OAAOJ,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;GACT,UAAU;GACK;GACA;GACf,cAAc,aAAa;;EAG7B,IAAI;AACJ,iCAA+B,MAAMI,yEACnC,SACA,eACA,eACA,YACA,cACA,0BAA0B,cAC1B,sBACA,SACA,EACE,kBAAkB,oCACd,EAAE,0BAA0B,sCAC5B;AAIR,MAAI,CAAC,6BAA6B,QAChC,OAAM,IAAI,MAAM,6BAA6B,SAAS;AAIxD,oBAAkB,iBAAiB;AACnC,oBAAkB,qBAAqB;AACvC,oBAAkB,wBAAwB,6BAA6B,iBAAiB;AAGxF,YAAU;GACR,MAAM;GACN,OAAOL,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;EAGX,MAAMK,qBAA+B,CAAC;EACtC,MAAM,qBAAqB,OAAO,8BAA8B,kBAAkB,aAAa,IAAI;EACnG,MAAM,eAAe,OAAO,8BAA8B,kBAAkB,gBAAgB,IAAI;EAEhG,MAAM,oBAAoB,MAAM,+BAC9B,QAAQ,YACR,eACA;AAGF,MAAI,CAAC,kBACH,OAAM,IAAI,MAAM;AAGlB,YAAU;GACR,MAAM;GACN,OAAON,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;AAGX,QAAM,4CAA4C;GAChD,qBAAqB;GACrB;GACA;GACA;GACA;GACA,qBAAqB,8BAA8B,kBAAkB;GACrE,sBAAsB,8BAA8B,kBAAkB;GACtE;GACA,2BAA2B,OACzB,8BAA8B,kBAAkB,6BAA6B,IAC7E;GACF;GACA;GACA,iBAAiB,QAAQ;GACzB,YAAY,QAAQ;GACpB;;AAIF,YAAU;GACR,MAAM;GACN,OAAOD,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;AAGX,QAAM,gBAAgB,4BAA4B;GAChD;GACA;GACA,WAAW;GACX,qBAAqB,0BAA0B;GAC/C,cAAc,0BAA0B;GACxC,2BAA2B,0BAA0B;;AAIvD,oBAAkB,iBAAiB;AAEnC,YAAU;GACR,MAAM;GACN,OAAOD,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;AAIX,MAAI;AACF,WAAQ,gBAAgB,kBAAkB,eAAe,eAAe;AACxE,SAAM,QAAQ,gBAAgB,kBAAkB,oBAAoB,QAAQ;UACtE;EAIR,IAAI,YAAY,MAAM,gBAAgB,iBAAiB,aAAa,EAAE,QAAQ;AAC9E,MAAI,CAAC,WAAW,QAAQ;GAItB,MAAM,YAAY,MAAM,QAAQ,WAAW,UAAU,EAAE,UAAU;GACjE,MAAM,cAAc,WAAW,QAAQ;GACvC,MAAM,gBAAgB,OAAO,UAAU,QAAQ,UAAU;GACzD,MAAM,gBAAgB,MAAM,gBAAgB,yBAAyB;IACnE,QAAQ;IACR,MAAM,gBAAgB;IACtB,WAAW;IACX,aAAa;;GAEf,MAAM,iBAAiB,MAAM,gBAAgB,wBAAwB;GACrE,MAAM,iBAAiB,MAAM,gBAAgB,8CAA8C;IACzF;IACA,WAAW;IACX,eAAe,eAAe,KAAK,MAAM,EAAE;;GAE7C,MAAM,eAAe,MAAM,gBAAgB,iBAAiB;IAC3C;IACf,qBAAqB,0BAA0B;IAC/C,YAAY;MACX,OAAO,gBAAyB;IACjC,MAAM,UAAW,eAAe,OAAO,gBAAgB,YAAY,aAAa,cAC5E,OAAQ,YAAsC,WAAW,MACzD,OAAO,eAAe;AAC1B,WAAO;KAAE,SAAS;KAAO,OAAO;;;AAGlC,OAAI,CAAC,aAAa,SAAS;AACzB,YAAQ,KAAK,8BAA8B,aAAa;AACxD,UAAM,IAAI,MAAM,aAAa;;QAG/B,SAAQ,MAAM;AAIhB,MAAI;AACF,SAAM,gBAAgB,sBAAsB,eAAe,QAAQ;WAC5D,SAAS;AAChB,WAAQ,KAAK,yDAAyD;;AAGxE,YAAU;GACR,MAAM;GACN,OAAOD,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;EAGX,MAAM,gBAAgB;GACpB,SAAS;GACM;GACf,qBAAqB;GACrB,eAAe,kBAAkB;GACjC,iBAAiB;IACf,SAAS;IACT,cAAc,aAAa;IAC3B,qBAAqB,0BAA0B;IAC/C,kBAAkB,6BAA6B;;;AAInD,cAAY,MAAM;AAClB,SAAO;UAEAM,OAAgB;EACvB,MAAM,UAAW,SAAS,OAAO,UAAU,YAAY,aAAa,QAChE,OAAQ,MAAgC,WAAW,MACnD,OAAO,SAAS;EACpB,MAAM,QAAS,SAAS,OAAO,UAAU,YAAY,WAAW,QAC5D,OAAQ,MAA8B,SAAS,MAC/C;AACJ,UAAQ,MAAM,wBAAwB,SAAS;AAG/C,QAAM,4BACJ,mBACA,eACA,iBACA;EAIF,MAAM,eAAeC,2CAA4B,OAAO,gBAAgB;EAExE,MAAM,cAAc,IAAI,MAAM;AAC9B,YAAU;AAEV,YAAU;GACR,MAAM;GACN,OAAOR,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;GACT,OAAO;;EAGT,MAAM,SAAS;GAAE,SAAS;GAAO,OAAO;;AACxC,cAAY;AACZ,SAAO;;;AAKX,eAAsB,gBACpB,SACA,eACA,SACA,sBAC6B;AAC7B,QAAO,wBAAwB,SAAS,eAAe,SAAS,sBAAsB;;;;;;;;AAwDxF,MAAM,6BAA6B,OACjC,SAKA,eACA,SACA,YACG;AAEH,WAAU;EACR,MAAM;EACN,OAAOD,wCAAkB;EACzB,QAAQC,yCAAmB;EAC3B,SAAS;;AAIX,KAAI,CAAC,eAAe;EAClB,MAAM,wBAAQ,IAAI,MAAM;AACxB,YAAU;AACV,QAAM;;CAGR,MAAM,aAAaQ,yCAAsB;AACzC,KAAI,CAAC,WAAW,OAAO;EACrB,MAAM,wBAAQ,IAAI,MAAM,4BAA4B,WAAW;AAC/D,YAAU;AACV,QAAM;;AAER,KAAI,CAAC,OAAO,iBAAiB;EAC3B,MAAM,wBAAQ,IAAI,MAAM;AACxB,YAAU;AACV,QAAM;;AAIR,WAAU;EACR,MAAM;EACN,OAAOT,wCAAkB;EACzB,QAAQC,yCAAmB;EAC3B,SAAS;;;;;;AAQb,eAAe,4BACb,mBAMA,eACA,iBACA,SACe;AACf,SAAQ,MAAM,qCAAqC;AAGnD,KAAI;AAEF,QAAM,gBAAgB;AAGtB,MAAI,kBAAkB,gBAAgB;AACpC,WAAQ,MAAM;AACd,aAAU;IACR,MAAM;IACN,OAAOD,wCAAkB;IACzB,QAAQC,yCAAmB;IAC3B,SAAS;IACT,OAAO;;AAGT,SAAM,gBAAgB,yBAAyB;AAC/C,WAAQ,MAAM;;AAKhB,MAAI,kBAAkB,oBAAoB;AACxC,WAAQ,MAAM;AACd,aAAU;IACR,MAAM;IACN,OAAOD,wCAAkB;IACzB,QAAQC,yCAAmB;IAC3B,SAAS,8BAA8B,kBAAkB,sBAAsB;IAC/E,OAAO;;;AAGX,UAAQ,MAAM;UAEPS,eAAwB;AAC/B,UAAQ,MAAM,oBAAoB;AAClC,YAAU;GACR,MAAM;GACN,OAAOV,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS,oBACN,iBAAiB,OAAO,kBAAkB,YAAY,aAAa,gBAChE,OAAQ,cAAwC,WAAW,MAC3D,OAAO,iBAAiB;GAE9B,OAAO;;;;AAKb,eAAe,4CAA4C,MAezC;AAGhB,KAAI,KAAK,wBAAwB,mBAAoB;CAErD,MAAM,qBAAqB,OAAO,KAAK,sBAAsB,IAAI;CACjE,MAAM,eAAe,OAAO,KAAK,gBAAgB,IAAI;CACrD,MAAM,2BAA2B,OAAO,KAAK,qCAAqC,IAAI;CACtF,MAAM,4BAA4B,OAAO,KAAK,6BAA6B,IAAI;AAE/E,KAAI,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,2BAA2B;AACnG,UAAQ,KAAK;AACb;;AAGF,KAAI;AACF,OAAK,UAAU;GACb,MAAM;GACN,OAAOD,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;AAIX,MAAI;AACF,QAAK,gBAAgB,kBAAkB,eAAe,KAAK,eAAe,KAAK;UACzE;EACR,MAAM,YAAY,MAAM,KAAK,gBAAgB,kBAAkB,2BAC7D,KAAK,YACL,EAAE,OAAO;EAGX,MAAM,SAAS,MAAM,KAAK,gBAAgB,qCAAqC;GAC7E,eAAe,KAAK;GACpB,YAAY,KAAK;GACjB,aAAa,KAAK;GAClB,oBAAoB;GACpB;GACA;GACA,qBAAqB,KAAK;GAC1B,sBAAsB,KAAK;;EAG7B,MAAM,WAAW,QAAQ;AACzB,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM;AAE/B,QAAM,KAAK,WAAW,gBAAgB,UAAUU,gCAAoB;EAEpE,MAAM,uBAAuB,MAAM,+BACjC,KAAK,YACL,KAAK,eACL,CAAC,KAAK,eAAe;AAEvB,MAAI,CAAC,qBACH,OAAM,IAAI,MAAM;AAGlB,QAAMC,+BAAiB,WAAW,iBAAiB;GACjD,MAAM;GACN,eAAe,KAAK;GACpB,cAAc;GACd,WAAW;GACX,aAAa,KAAK;GAClB;GACA,uBAAuB;GACvB,cAAcC,2DAAsC;IAClD,qBAAqB,KAAK;IAC1B,sBAAsB,KAAK;IAC3B;IACA,YAAY,KAAK,gBAAgB,sBAAsB,SAAS;IAChE;IACA;IACA,uBAAuB;;GAEzB,WAAW,KAAK;;AAGlB,OAAK,UAAU;GACb,MAAM;GACN,OAAOb,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;UAEJ,GAAG;AACV,UAAQ,KAAK,6FAA6F;;;AAI9G,eAAe,+BACb,YACA,eACA,oBACA,MACkB;CAClB,MAAM,SAAS,MAAM,KACnB,IAAI,IAAI,mBAAmB,KAAK,MAAMa,uCAAoB,IAAI,OAAO;AAEvE,KAAI,CAAC,OAAO,OAAQ,QAAO;CAE3B,MAAM,WAAW,KAAK,IAAI,GAAG,KAAK,MAAM,MAAM,YAAY;CAC1D,MAAM,UAAU,KAAK,IAAI,IAAI,KAAK,MAAM,MAAM,WAAW;AAEzD,MAAK,IAAI,IAAI,GAAG,IAAI,UAAU,KAAK;AACjC,MAAI;GACF,MAAM,EAAE,gBAAgB,2BAA2B,MAAM,WAAW,cAAc,EAAE,SAAS;GAC7F,MAAM,OAAO,CAAC,GAAG,gBAAgB,GAAG,wBAAwB,KAAK,MAAMA,uCAAoB,EAAE;GAC7F,MAAM,aAAa,OAAO,OAAO,aAAa,KAAK,SAAS;AAC5D,OAAI,WAAY,QAAO;UACjB;AAGR,QAAM,IAAI,SAAS,QAAQ,WAAW,KAAK;;AAE7C,QAAO"}