@tatchi-xyz/sdk 0.21.0 → 0.31.0

package/dist/cjs/core/TatchiPasskey/emailRecovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"emailRecovery.js","names":["EmailRecoveryPhase","EmailRecoveryPendingStore","EmailRecoveryStatus","validateNearAccountId","toAccountId","err: unknown","errorMessage","getEmailRecoveryAttempt","ensureEd25519Prefix","err: any","elapsedMs","rec: PendingEmailRecovery","e: unknown","transactionHash: string | undefined","err","txResult: FinalExecutionOutcome","DEFAULT_WAIT_STATUS","parseLinkDeviceRegisterUserResponse","EmailRecoveryErrorCode","EmailRecoveryError","txUnknown: unknown","logs: string[]","IndexedDBManager","payload: StoreUserDataPayload","getLoginSession","createRandomVRFChallenge","parseDeviceNumber"],"sources":["../../../../src/core/TatchiPasskey/emailRecovery.ts"],"sourcesContent":["import type { PasskeyManagerContext } from './index';\nimport { IndexedDBManager } from '../IndexedDBManager';\nimport { validateNearAccountId } from '../../utils/validation';\nimport { errorMessage } from '../../utils/errors';\nimport { toAccountId, type AccountId } from '../types/accountIds';\nimport {\n  EmailRecoveryPhase,\n  EmailRecoveryStatus,\n  type EmailRecoverySSEEvent,\n  type EventCallback,\n  type AfterCall,\n} from '../types/sdkSentEvents';\nimport type { TatchiConfigs } from '../types/tatchi';\nimport {\n  createRandomVRFChallenge,\n  type EncryptedVRFKeypair,\n  type ServerEncryptedVrfKeypair,\n  type VRFChallenge,\n} from '../types/vrf-worker';\nimport type { FinalExecutionOutcome } from '@near-js/types';\nimport type { StoredAuthenticator, WebAuthnRegistrationCredential } from '../types';\nimport type { ConfirmationConfig } from '../types/signer-worker';\nimport { DEFAULT_WAIT_STATUS } from '../types/rpc';\nimport { parseDeviceNumber } from '../WebAuthnManager/SignerWorkerManager/getDeviceNumber';\nimport { getLoginSession } from './login';\nimport type { SignedTransaction } from '../NearClient';\nimport {\n  EmailRecoveryPendingStore,\n  parseLinkDeviceRegisterUserResponse,\n  type PendingStore,\n} from '../EmailRecovery';\nimport { EmailRecoveryError, EmailRecoveryErrorCode } from '../types/emailRecovery';\nimport { getEmailRecoveryAttempt } from '../rpcCalls';\nimport { ensureEd25519Prefix } from '../nearCrypto';\n\nexport type PendingEmailRecoveryStatus =\n  | 'awaiting-email'\n  | 'awaiting-add-key'\n  | 'finalizing'\n  | 'complete'\n  | 'error';\n\nexport type PendingEmailRecovery = {\n  accountId: AccountId;\n  recoveryEmail?: string;\n  deviceNumber: number;\n  nearPublicKey: string;\n  requestId: string;\n  encryptedVrfKeypair: EncryptedVRFKeypair;\n  serverEncryptedVrfKeypair: ServerEncryptedVrfKeypair | null;\n  vrfPublicKey: string;\n  credential: WebAuthnRegistrationCredential;\n  vrfChallenge?: VRFChallenge;\n  createdAt: number;\n  status: PendingEmailRecoveryStatus;\n};\n\ntype PollTickResult<T> = { done: false } | { done: true; value: T };\n\ntype PollUntilResult<T> =\n  | { status: 'completed'; value: T; elapsedMs: number; pollCount: number }\n  | { status: 'timedOut'; elapsedMs: number; pollCount: number }\n  | { status: 'cancelled'; elapsedMs: number; pollCount: number };\n\ntype VerificationOutcome =\n  | { outcome: 'verified' }\n  | { outcome: 'failed'; errorMessage: string };\n\ntype AutoLoginResult =\n  | { success: true; method: 'shamir' | 'touchid' }\n  | { success: false; reason: string };\n\ntype StoreUserDataPayload = Parameters<PasskeyManagerContext['webAuthnManager']['storeUserData']>[0];\n\ntype AccountViewLike = {\n  amount: bigint | string;\n  locked: bigint | string;\n  storage_usage: number | bigint;\n};\n\ntype CollectedRecoveryCredential = {\n  credential: WebAuthnRegistrationCredential;\n  vrfChallenge?: VRFChallenge;\n};\n\ntype DerivedRecoveryKeys = {\n  encryptedVrfKeypair: EncryptedVRFKeypair;\n  serverEncryptedVrfKeypair: ServerEncryptedVrfKeypair | null;\n  vrfPublicKey: string;\n  nearPublicKey: string;\n};\n\nexport interface EmailRecoveryFlowOptions {\n  onEvent?: EventCallback<EmailRecoverySSEEvent>;\n  onError?: (error: Error) => void;\n  afterCall?: AfterCall<void>;\n  pendingStore?: PendingStore;\n  confirmerText?: { title?: string; body?: string };\n  confirmationConfig?: Partial<ConfirmationConfig>;\n}\n\nfunction getEmailRecoveryConfig(configs: TatchiConfigs): {\n  minBalanceYocto: string;\n  pollingIntervalMs: number;\n  maxPollingDurationMs: number;\n  pendingTtlMs: number;\n  mailtoAddress: string;\n} {\n  const relayerEmailCfg = configs.relayer.emailRecovery;\n  const minBalanceYocto = String(relayerEmailCfg.minBalanceYocto);\n  const pollingIntervalMs = Number(relayerEmailCfg.pollingIntervalMs);\n  const maxPollingDurationMs = Number(relayerEmailCfg.maxPollingDurationMs);\n  const pendingTtlMs = Number(relayerEmailCfg.pendingTtlMs);\n  const mailtoAddress = String(relayerEmailCfg.mailtoAddress);\n  return {\n    minBalanceYocto,\n    pollingIntervalMs,\n    maxPollingDurationMs,\n    pendingTtlMs,\n    mailtoAddress,\n  };\n}\n\nexport function generateEmailRecoveryRequestId(): string {\n  // 6-character A–Z0–9 identifier, suitable for short-lived correlation.\n  const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';\n  const length = 6;\n  const bytes = new Uint8Array(length);\n  (globalThis.crypto || window.crypto).getRandomValues(bytes);\n  let out = '';\n  for (let i = 0; i < length; i++) {\n    out += alphabet[bytes[i] % alphabet.length];\n  }\n  return out;\n}\n\nexport class EmailRecoveryFlow {\n  private context: PasskeyManagerContext;\n  private options?: EmailRecoveryFlowOptions;\n  private pendingStore: PendingStore;\n  private pending: PendingEmailRecovery | null = null;\n  private phase: EmailRecoveryPhase = EmailRecoveryPhase.STEP_1_PREPARATION;\n  private pollingTimer: ReturnType<typeof setTimeout> | undefined;\n  private pollIntervalResolver?: () => void;\n  private pollingStartedAt: number | null = null;\n  private cancelled = false;\n  private error?: Error;\n\n  constructor(context: PasskeyManagerContext, options?: EmailRecoveryFlowOptions) {\n    this.context = context;\n    this.options = options;\n    this.pendingStore = options?.pendingStore ?? new EmailRecoveryPendingStore({\n      getPendingTtlMs: () => this.getConfig().pendingTtlMs,\n    });\n  }\n\n  setOptions(options?: EmailRecoveryFlowOptions) {\n    if (!options) return;\n    this.options = { ...(this.options || {}), ...options };\n    if (options.pendingStore) {\n      this.pendingStore = options.pendingStore;\n    }\n  }\n  private emit(event: EmailRecoverySSEEvent) {\n    this.options?.onEvent?.(event);\n  }\n\n  private emitError(step: number, messageOrError: string | Error): Error {\n    const err = typeof messageOrError === 'string' ? new Error(messageOrError) : messageOrError;\n    const message = err.message || (typeof messageOrError === 'string' ? messageOrError : 'Unknown error');\n    this.phase = EmailRecoveryPhase.ERROR;\n    this.error = err;\n    this.emit({\n      step,\n      phase: EmailRecoveryPhase.ERROR,\n      status: EmailRecoveryStatus.ERROR,\n      message,\n      error: message,\n    } as EmailRecoverySSEEvent & { error: string });\n    this.options?.onError?.(err);\n    return err;\n  }\n\n  private async fail(step: number, message: string): Promise<never> {\n    const err = this.emitError(step, message);\n    await this.options?.afterCall?.(false);\n    throw err;\n  }\n\n  private async assertValidAccountIdOrFail(step: number, accountId: string): Promise<AccountId> {\n    const validation = validateNearAccountId(accountId as AccountId);\n    if (!validation.valid) {\n      await this.fail(step, `Invalid NEAR account ID: ${validation.error}`);\n    }\n    return toAccountId(accountId as string);\n  }\n\n  private async resolvePendingOrFail(\n    step: number,\n    args: { accountId: AccountId; nearPublicKey?: string },\n    options?: {\n      allowErrorStatus?: boolean;\n      missingMessage?: string;\n      errorStatusMessage?: string;\n    }\n  ): Promise<PendingEmailRecovery> {\n    const {\n      allowErrorStatus = true,\n      missingMessage = 'No pending email recovery record found for this account',\n      errorStatusMessage = 'Pending email recovery is in an error state; please restart the flow',\n    } = options ?? {};\n\n    let rec = this.pending;\n    if (!rec || rec.accountId !== args.accountId || (args.nearPublicKey && rec.nearPublicKey !== args.nearPublicKey)) {\n      rec = await this.loadPending(args.accountId, args.nearPublicKey);\n      this.pending = rec;\n    }\n\n    if (!rec) {\n      await this.fail(step, missingMessage);\n    }\n\n    const resolved = rec as PendingEmailRecovery;\n    if (!allowErrorStatus && resolved.status === 'error') {\n      await this.fail(step, errorStatusMessage);\n    }\n\n    return resolved;\n  }\n\n  private getConfig() {\n    return getEmailRecoveryConfig(this.context.configs);\n  }\n\n  private toBigInt(value: bigint | number | string | null | undefined): bigint {\n    if (typeof value === 'bigint') return value;\n    if (typeof value === 'number') return BigInt(value);\n    if (typeof value === 'string' && value.length > 0) return BigInt(value);\n    return BigInt(0);\n  }\n\n  private computeAvailableBalance(accountView: AccountViewLike): bigint {\n    const STORAGE_PRICE_PER_BYTE = BigInt('10000000000000000000'); // 1e19 yocto NEAR per byte\n    const amount = this.toBigInt(accountView.amount);\n    const locked = this.toBigInt(accountView.locked);\n    const storageUsage = this.toBigInt(accountView.storage_usage);\n    const storageCost = storageUsage * STORAGE_PRICE_PER_BYTE;\n    const rawAvailable = amount - locked - storageCost;\n    return rawAvailable > 0 ? rawAvailable : BigInt(0);\n  }\n\n  private async assertSufficientBalance(nearAccountId: AccountId): Promise<void> {\n    const { minBalanceYocto } = this.getConfig();\n\n    try {\n      const accountView = await this.context.nearClient.viewAccount(nearAccountId);\n      const available = this.computeAvailableBalance(accountView);\n      if (available < BigInt(minBalanceYocto)) {\n        await this.fail(\n          1,\n          `This account does not have enough NEAR to finalize recovery. Available: ${available.toString()} yocto; required: ${String(minBalanceYocto)}. Please top up and try again.`\n        );\n      }\n    } catch (err: unknown) {\n      await this.fail(1, errorMessage(err) || 'Failed to fetch account balance for recovery');\n    }\n  }\n\n  private getCanonicalRecoveryEmail(recoveryEmail?: string): string | undefined {\n    const canonicalEmail = String(recoveryEmail || '').trim().toLowerCase();\n    return canonicalEmail || undefined;\n  }\n\n  private async getNextDeviceNumberFromContract(nearAccountId: AccountId): Promise<number> {\n    try {\n      const { syncAuthenticatorsContractCall } = await import('../rpcCalls');\n      const authenticators = await syncAuthenticatorsContractCall(\n        this.context.nearClient,\n        this.context.configs.contractId,\n        nearAccountId\n      );\n      const numbers = authenticators\n        .map(({ authenticator }) => authenticator.deviceNumber)\n        .filter((n): n is number => typeof n === 'number' && Number.isFinite(n));\n      const max = numbers.length > 0 ? Math.max(...numbers) : 0;\n      return max + 1;\n    } catch {\n      return 1;\n    }\n  }\n\n  private async collectRecoveryCredentialOrFail(\n    nearAccountId: AccountId,\n    deviceNumber: number\n  ): Promise<CollectedRecoveryCredential> {\n    const confirmerText = {\n      title: this.options?.confirmerText?.title ?? 'Register New Recovery Account',\n      body: this.options?.confirmerText?.body ?? 'Create a recovery account and send an encrypted email to recover your account.',\n    };\n    const confirm = await this.context.webAuthnManager.requestRegistrationCredentialConfirmation({\n      nearAccountId,\n      deviceNumber,\n      confirmerText,\n      confirmationConfigOverride: this.options?.confirmationConfig,\n    });\n\n    if (!confirm.confirmed || !confirm.credential) {\n      await this.fail(2, 'User cancelled email recovery TouchID confirmation');\n    }\n\n    return {\n      credential: confirm.credential,\n      vrfChallenge: confirm.vrfChallenge || undefined,\n    };\n  }\n\n  private async deriveRecoveryKeysOrFail(\n    nearAccountId: AccountId,\n    deviceNumber: number,\n    credential: WebAuthnRegistrationCredential\n  ): Promise<DerivedRecoveryKeys> {\n    const vrfDerivationResult = await this.context.webAuthnManager.deriveVrfKeypair({\n      credential,\n      nearAccountId,\n    });\n\n    if (!vrfDerivationResult.success || !vrfDerivationResult.encryptedVrfKeypair) {\n      await this.fail(2, 'Failed to derive VRF keypair from PRF for email recovery');\n    }\n\n    const nearKeyResult = await this.context.webAuthnManager.deriveNearKeypairAndEncryptFromSerialized({\n      nearAccountId,\n      credential,\n      options: { deviceNumber },\n    });\n\n    if (!nearKeyResult.success || !nearKeyResult.publicKey) {\n      await this.fail(2, 'Failed to derive NEAR keypair for email recovery');\n    }\n\n    return {\n      encryptedVrfKeypair: vrfDerivationResult.encryptedVrfKeypair,\n      serverEncryptedVrfKeypair: vrfDerivationResult.serverEncryptedVrfKeypair || null,\n      vrfPublicKey: vrfDerivationResult.vrfPublicKey,\n      nearPublicKey: nearKeyResult.publicKey,\n    };\n  }\n\n  private emitAwaitEmail(rec: PendingEmailRecovery, mailtoUrl: string): void {\n    this.phase = EmailRecoveryPhase.STEP_3_AWAIT_EMAIL;\n    this.emit({\n      step: 3,\n      phase: EmailRecoveryPhase.STEP_3_AWAIT_EMAIL,\n      status: EmailRecoveryStatus.PROGRESS,\n      message: 'New device key created; please send the recovery email from your registered address.',\n      data: {\n        accountId: rec.accountId,\n        ...(rec.recoveryEmail ? { recoveryEmail: rec.recoveryEmail } : {}),\n        nearPublicKey: rec.nearPublicKey,\n        requestId: rec.requestId,\n        mailtoUrl,\n      },\n    } as EmailRecoverySSEEvent & { data: Record<string, unknown> });\n  }\n\n  private emitAutoLoginEvent(\n    status: EmailRecoveryStatus,\n    message: string,\n    data: Record<string, unknown>\n  ): void {\n    this.emit({\n      step: 5,\n      phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,\n      status,\n      message,\n      data,\n    } as EmailRecoverySSEEvent & { data: Record<string, unknown> });\n  }\n\n  private async checkViaEmailRecovererAttempt(\n    rec: PendingEmailRecovery\n  ): Promise<{ completed: boolean; success: boolean; missing?: boolean; errorMessage?: string; } | null> {\n    try {\n      const attempt = await getEmailRecoveryAttempt(\n        this.context.nearClient,\n        rec.accountId,\n        rec.requestId\n      );\n\n      if (!attempt) {\n        return { completed: false, success: false, missing: true };\n      }\n\n      // Optional safety checks: ensure the bound request/key match expectations when available.\n      if (attempt.request_id && attempt.request_id !== rec.requestId) {\n        return {\n          completed: true,\n          success: false,\n          errorMessage: 'Email recovery attempt request_id does not match requested requestId.',\n        };\n      }\n\n      if (attempt.new_public_key && attempt.new_public_key !== rec.nearPublicKey) {\n        const expected = ensureEd25519Prefix(rec.nearPublicKey);\n        const actual = ensureEd25519Prefix(attempt.new_public_key);\n\n        // The relayer/prover often forwards only the base58 part while the SDK\n        // persists `ed25519:<base58>`. Compare normalized forms to avoid false\n        // mismatches from prefix formatting differences.\n        if (actual === expected) {\n          // no-op; treat as matching\n        } else {\n          return {\n            completed: true,\n            success: false,\n            errorMessage:\n              `Email recovery new_public_key mismatch for request ${rec.requestId}. ` +\n              `Expected ${expected}; got ${actual}. ` +\n              'This usually means the recovery email you sent was generated for a different device/attempt.',\n          };\n        }\n      }\n\n      const normalized = attempt.status.toLowerCase();\n\n      if (normalized === 'complete' || normalized === 'completed') {\n        return {\n          completed: true,\n          success: true,\n        };\n      }\n\n      if (normalized.includes('failed')) {\n        return {\n          completed: true,\n          success: false,\n          errorMessage: attempt.error || `Email recovery failed (${attempt.status || 'unknown status'})`,\n        };\n      }\n\n      return {\n        completed: false,\n        success: false,\n      };\n    } catch (err) {\n      // Treat view errors as retryable; keep polling the view method.\n      // eslint-disable-next-line no-console\n      console.warn('[EmailRecoveryFlow] get_recovery_attempt view failed; will retry', err);\n      return null;\n    }\n  }\n\n  private async isRecoveryAccessKeyPresent(rec: PendingEmailRecovery): Promise<boolean | null> {\n    try {\n      await this.context.nearClient.viewAccessKey(rec.accountId, rec.nearPublicKey);\n      return true;\n    } catch (err: any) {\n      const kind = typeof err?.kind === 'string' ? String(err.kind) : '';\n      const short = typeof err?.short === 'string' ? String(err.short) : '';\n      const msg = typeof err?.message === 'string' ? String(err.message) : '';\n\n      if (\n        /AccessKeyDoesNotExist/i.test(kind) ||\n        /AccessKeyDoesNotExist/i.test(short) ||\n        /access key does not exist/i.test(msg) ||\n        /access key .*does not exist/i.test(msg)\n      ) {\n        return false;\n      }\n\n      // Unexpected view error: retryable; treat as unknown to avoid failing the flow.\n      // eslint-disable-next-line no-console\n      console.warn('[EmailRecoveryFlow] view_access_key failed while checking recovery key; will retry', err);\n      return null;\n    }\n  }\n\n  private buildPollingEventData(\n    rec: PendingEmailRecovery,\n    details: { transactionHash?: string; elapsedMs: number; pollCount: number }\n  ): Record<string, unknown> {\n    return {\n      accountId: rec.accountId,\n      requestId: rec.requestId,\n      nearPublicKey: rec.nearPublicKey,\n      transactionHash: details.transactionHash,\n      elapsedMs: details.elapsedMs,\n      pollCount: details.pollCount,\n    };\n  }\n\n  private async sleepForPollInterval(ms: number): Promise<void> {\n    await new Promise<void>(resolve => {\n      this.pollIntervalResolver = resolve;\n      this.pollingTimer = setTimeout(() => {\n        this.pollIntervalResolver = undefined;\n        this.pollingTimer = undefined;\n        resolve();\n      }, ms);\n    }).finally(() => {\n      this.pollIntervalResolver = undefined;\n    });\n  }\n\n  private async pollUntil<T>(args: {\n    intervalMs: number;\n    timeoutMs: number;\n    isCancelled: () => boolean;\n    tick: (ctx: { elapsedMs: number; pollCount: number }) => Promise<PollTickResult<T>>;\n    sleep?: (ms: number) => Promise<void>;\n    now?: () => number;\n  }): Promise<PollUntilResult<T>> {\n    const now = args.now ?? Date.now;\n    const sleep = args.sleep ?? this.sleepForPollInterval.bind(this);\n    const startedAt = now();\n    let pollCount = 0;\n\n    while (!args.isCancelled()) {\n      pollCount += 1;\n      const elapsedMs = now() - startedAt;\n      if (elapsedMs > args.timeoutMs) {\n        return { status: 'timedOut', elapsedMs, pollCount };\n      }\n\n      const result = await args.tick({ elapsedMs, pollCount });\n      if (result.done) {\n        return { status: 'completed', value: result.value, elapsedMs, pollCount };\n      }\n\n      if (args.isCancelled()) {\n        return { status: 'cancelled', elapsedMs, pollCount };\n      }\n\n      await sleep(args.intervalMs);\n    }\n\n    const elapsedMs = now() - startedAt;\n    return { status: 'cancelled', elapsedMs, pollCount };\n  }\n\n  private async loadPending(\n    accountId: AccountId,\n    nearPublicKey?: string\n  ): Promise<PendingEmailRecovery | null> {\n    return this.pendingStore.get(accountId, nearPublicKey);\n  }\n\n  private async savePending(rec: PendingEmailRecovery): Promise<void> {\n    await this.pendingStore.set(rec);\n    this.pending = rec;\n  }\n\n  private async clearPending(accountId: AccountId, nearPublicKey?: string): Promise<void> {\n    await this.pendingStore.clear(accountId, nearPublicKey);\n\n    if (\n      this.pending\n      && this.pending.accountId === accountId\n      && (!nearPublicKey || this.pending.nearPublicKey === nearPublicKey)\n    ) {\n      this.pending = null;\n    }\n  }\n\n  getState() {\n    return {\n      phase: this.phase,\n      pending: this.pending,\n      error: this.error,\n    };\n  }\n\n  async buildMailtoUrl(args: { accountId: string; nearPublicKey?: string }): Promise<string> {\n    const { accountId, nearPublicKey } = args;\n    this.cancelled = false;\n    this.error = undefined;\n\n    const nearAccountId = await this.assertValidAccountIdOrFail(3, accountId);\n    const rec = await this.resolvePendingOrFail(\n      3,\n      { accountId: nearAccountId, nearPublicKey },\n      { allowErrorStatus: false }\n    );\n\n    if (rec.status === 'finalizing' || rec.status === 'complete') {\n      await this.fail(3, 'Recovery email has already been processed on-chain for this request');\n    }\n\n    const mailtoUrl =\n      rec.status === 'awaiting-email'\n        ? await this.buildMailtoUrlAndUpdateStatus(rec)\n        : this.buildMailtoUrlInternal(rec);\n    this.emitAwaitEmail(rec, mailtoUrl);\n    await this.options?.afterCall?.(true, undefined);\n    return mailtoUrl;\n  }\n\n  async start(args: { accountId: string; recoveryEmail?: string }): Promise<{ mailtoUrl: string; nearPublicKey: string }> {\n    const { accountId, recoveryEmail } = args;\n    this.cancelled = false;\n    this.error = undefined;\n    this.phase = EmailRecoveryPhase.STEP_1_PREPARATION;\n\n    this.emit({\n      step: 1,\n      phase: EmailRecoveryPhase.STEP_1_PREPARATION,\n      status: EmailRecoveryStatus.PROGRESS,\n      message: 'Preparing email recovery...',\n    });\n\n    const nearAccountId = await this.assertValidAccountIdOrFail(1, accountId);\n    await this.assertSufficientBalance(nearAccountId);\n    const canonicalEmail = this.getCanonicalRecoveryEmail(recoveryEmail);\n\n    // Determine deviceNumber from on-chain authenticators\n    const deviceNumber = await this.getNextDeviceNumberFromContract(nearAccountId);\n\n    this.phase = EmailRecoveryPhase.STEP_2_TOUCH_ID_REGISTRATION;\n    this.emit({\n      step: 2,\n      phase: EmailRecoveryPhase.STEP_2_TOUCH_ID_REGISTRATION,\n      status: EmailRecoveryStatus.PROGRESS,\n      message: 'Collecting passkey for email recovery...',\n    });\n\n    try {\n      const confirm = await this.collectRecoveryCredentialOrFail(nearAccountId, deviceNumber);\n      const derivedKeys = await this.deriveRecoveryKeysOrFail(nearAccountId, deviceNumber, confirm.credential);\n\n      const rec: PendingEmailRecovery = {\n        accountId: nearAccountId,\n        recoveryEmail: canonicalEmail,\n        deviceNumber,\n        nearPublicKey: derivedKeys.nearPublicKey,\n        requestId: generateEmailRecoveryRequestId(),\n        encryptedVrfKeypair: derivedKeys.encryptedVrfKeypair,\n        serverEncryptedVrfKeypair: derivedKeys.serverEncryptedVrfKeypair,\n        vrfPublicKey: derivedKeys.vrfPublicKey,\n        credential: confirm.credential,\n        vrfChallenge: confirm.vrfChallenge || undefined,\n        createdAt: Date.now(),\n        status: 'awaiting-email',\n      };\n\n      const mailtoUrl = await this.buildMailtoUrlAndUpdateStatus(rec);\n\n      this.emitAwaitEmail(rec, mailtoUrl);\n\n      await this.options?.afterCall?.(true, undefined);\n\n      return { mailtoUrl, nearPublicKey: rec.nearPublicKey };\n    } catch (e: unknown) {\n      const err = this.emitError(2, errorMessage(e) || 'Email recovery TouchID/derivation failed');\n      await this.options?.afterCall?.(false);\n      throw err;\n    }\n  }\n\n  private buildMailtoUrlInternal(rec: PendingEmailRecovery): string {\n    const { mailtoAddress } = this.getConfig();\n    const to = encodeURIComponent(mailtoAddress);\n    const subject = encodeURIComponent(`recover-${rec.requestId} ${rec.accountId} ${rec.nearPublicKey}`);\n    const body = encodeURIComponent(`Recovering account ${rec.accountId} with a new passkey.`);\n    return `mailto:${to}?subject=${subject}&body=${body}`;\n  }\n\n  private async buildMailtoUrlAndUpdateStatus(rec: PendingEmailRecovery): Promise<string> {\n    rec.status = 'awaiting-add-key';\n    await this.savePending(rec);\n    return this.buildMailtoUrlInternal(rec);\n  }\n\n  async startPolling(args: { accountId: string; nearPublicKey?: string }): Promise<void> {\n    const { accountId, nearPublicKey } = args;\n    this.cancelled = false;\n    this.error = undefined;\n\n    const nearAccountId = await this.assertValidAccountIdOrFail(4, accountId);\n    const rec = await this.resolvePendingOrFail(\n      4,\n      { accountId: nearAccountId, nearPublicKey },\n      { allowErrorStatus: false }\n    );\n    if (rec.status === 'complete' || rec.status === 'finalizing') {\n      await this.options?.afterCall?.(true, undefined);\n      return;\n    }\n    if (rec.status === 'awaiting-email') {\n      await this.buildMailtoUrlAndUpdateStatus(rec);\n    }\n\n    await this.pollUntilAddKey(rec);\n    await this.options?.afterCall?.(true, undefined);\n  }\n\n  stopPolling(): void {\n    this.cancelled = true;\n    if (this.pollingTimer) {\n      clearTimeout(this.pollingTimer);\n      this.pollingTimer = undefined;\n    }\n    if (this.pollIntervalResolver) {\n      this.pollIntervalResolver();\n      this.pollIntervalResolver = undefined;\n    }\n  }\n\n  /**\n   * Best-effort cancellation and local state reset so callers can retry.\n   * This does not remove any passkey created in the browser/OS (WebAuthn has no delete API),\n   * but it will stop polling and clear the pending IndexedDB record for the given key.\n   */\n  async cancelAndReset(args?: { accountId?: string; nearPublicKey?: string }): Promise<void> {\n    this.stopPolling();\n\n    const normalizedAccountId = (args?.accountId || this.pending?.accountId || '').toString().trim();\n    const nearPublicKey = (args?.nearPublicKey || this.pending?.nearPublicKey || '').toString().trim();\n\n    if (normalizedAccountId) {\n      try {\n        await this.clearPending(toAccountId(normalizedAccountId), nearPublicKey);\n      } catch {\n        // best-effort\n      }\n    }\n\n    this.pending = null;\n    this.error = undefined;\n    this.phase = EmailRecoveryPhase.STEP_1_PREPARATION;\n  }\n\n  async finalize(args: { accountId: string; nearPublicKey?: string }): Promise<void> {\n    const { accountId, nearPublicKey } = args;\n    this.cancelled = false;\n    this.error = undefined;\n\n    const nearAccountId = await this.assertValidAccountIdOrFail(4, accountId);\n    const rec = await this.resolvePendingOrFail(\n      4,\n      { accountId: nearAccountId, nearPublicKey },\n      { allowErrorStatus: true }\n    );\n\n    this.emit({\n      step: 0,\n      phase: EmailRecoveryPhase.RESUMED_FROM_PENDING,\n      status: EmailRecoveryStatus.PROGRESS,\n      message: 'Resuming email recovery from pending state...',\n      data: {\n        accountId: rec.accountId,\n        nearPublicKey: rec.nearPublicKey,\n        status: rec.status,\n      },\n    } as EmailRecoverySSEEvent & { data: Record<string, unknown> });\n\n    if (rec.status === 'complete') {\n      this.phase = EmailRecoveryPhase.STEP_6_COMPLETE;\n      this.emit({\n        step: 6,\n        phase: EmailRecoveryPhase.STEP_6_COMPLETE,\n        status: EmailRecoveryStatus.SUCCESS,\n        message: 'Email recovery already completed for this key.',\n      });\n      await this.options?.afterCall?.(true, undefined);\n      return;\n    }\n\n    // Ensure verification has completed successfully before finalizing registration.\n    await this.pollUntilAddKey(rec);\n    await this.finalizeRegistration(rec);\n    await this.options?.afterCall?.(true, undefined);\n  }\n\n  private async pollUntilAddKey(rec: PendingEmailRecovery): Promise<void> {\n    const { pollingIntervalMs, maxPollingDurationMs } = this.getConfig();\n    this.phase = EmailRecoveryPhase.STEP_4_POLLING_VERIFICATION_RESULT;\n    this.pollingStartedAt = Date.now();\n    let sawAttempt = false;\n\n    const pollResult = await this.pollUntil<VerificationOutcome>({\n      intervalMs: pollingIntervalMs,\n      timeoutMs: maxPollingDurationMs,\n      isCancelled: () => this.cancelled,\n      tick: async ({ elapsedMs, pollCount }) => {\n        const verification = await this.checkViaEmailRecovererAttempt(rec);\n        if (verification && !verification.missing) {\n          sawAttempt = true;\n        }\n\n        let completed = verification?.completed === true;\n        let success = verification?.success === true;\n        let errorMessage = verification?.errorMessage;\n        let transactionHash: string | undefined;\n\n        if (verification?.missing) {\n          const hasKey = await this.isRecoveryAccessKeyPresent(rec);\n          if (hasKey === true) {\n            completed = true;\n            success = true;\n          } else if (hasKey === false && sawAttempt) {\n            completed = true;\n            success = false;\n            errorMessage =\n              'Email recovery attempt was cleared on-chain before completion. Please resend the recovery email or restart the flow.';\n          } else if (hasKey === null) {\n            // Retry on unexpected view errors while checking access key presence.\n            return { done: false };\n          }\n        }\n\n        this.emit({\n          step: 4,\n          phase: EmailRecoveryPhase.STEP_4_POLLING_VERIFICATION_RESULT,\n          status: EmailRecoveryStatus.PROGRESS,\n          message: completed && success\n            ? `Email recovery completed for request ${rec.requestId}; finalizing registration`\n            : `Waiting for email recovery for request ${rec.requestId}`,\n          data: this.buildPollingEventData(rec, {\n            transactionHash,\n            elapsedMs,\n            pollCount,\n          }),\n        } as EmailRecoverySSEEvent & { data: Record<string, unknown> });\n\n        if (!completed) {\n          return { done: false };\n        }\n\n        if (!success) {\n          return {\n            done: true,\n            value: {\n              outcome: 'failed',\n              errorMessage: errorMessage || 'Email recovery failed',\n            },\n          };\n        }\n\n        return { done: true, value: { outcome: 'verified' } };\n      },\n    });\n\n    if (pollResult.status === 'completed') {\n      if (pollResult.value.outcome === 'failed') {\n        const err = this.emitError(4, pollResult.value.errorMessage);\n        rec.status = 'error';\n        await this.savePending(rec);\n        await this.options?.afterCall?.(false);\n        throw err;\n      }\n\n      rec.status = 'finalizing';\n      await this.savePending(rec);\n      return;\n    }\n\n    if (pollResult.status === 'timedOut') {\n      const err = this.emitError(4, 'Timed out waiting for recovery email to be processed on-chain');\n      rec.status = 'error';\n      await this.savePending(rec);\n      await this.options?.afterCall?.(false);\n      throw err;\n    }\n\n    const err = this.emitError(4, 'Email recovery polling was cancelled');\n    await this.options?.afterCall?.(false);\n    throw err;\n  }\n\n  private initializeNonceManager(\n    rec: PendingEmailRecovery\n  ): {\n    nonceManager: ReturnType<PasskeyManagerContext['webAuthnManager']['getNonceManager']>;\n    accountId: AccountId;\n  } {\n    const nonceManager = this.context.webAuthnManager.getNonceManager();\n    const accountId = toAccountId(rec.accountId);\n    nonceManager.initializeUser(accountId, rec.nearPublicKey);\n    return { nonceManager, accountId };\n  }\n\n  /*\n   * Signs a `link_device_register_user` contract call\n   */\n  private async signNewDevice2RegistrationTx(rec: PendingEmailRecovery, accountId: AccountId): Promise<SignedTransaction> {\n    const vrfChallenge = rec.vrfChallenge;\n    if (!vrfChallenge) {\n      return this.fail(5, 'Missing VRF challenge for email recovery registration');\n    }\n\n    const registrationResult = await this.context.webAuthnManager.signDevice2RegistrationWithStoredKey({\n      nearAccountId: accountId,\n      credential: rec.credential,\n      vrfChallenge,\n      deterministicVrfPublicKey: rec.vrfPublicKey,\n      deviceNumber: rec.deviceNumber,\n    });\n\n    if (!registrationResult.success || !registrationResult.signedTransaction) {\n      await this.fail(5, registrationResult.error || 'Failed to sign email recovery registration transaction');\n    }\n\n    return registrationResult.signedTransaction;\n  }\n\n  private async broadcastRegistrationTxAndWaitFinal(\n    rec: PendingEmailRecovery,\n    signedTx: SignedTransaction\n  ): Promise<string | undefined> {\n    let txResult: FinalExecutionOutcome;\n    try {\n      txResult = await this.context.nearClient.sendTransaction(\n        signedTx,\n        DEFAULT_WAIT_STATUS.linkDeviceRegistration\n      );\n    } catch (err: unknown) {\n      const msg = errorMessage(err) || 'Failed to broadcast email recovery registration transaction (insufficient funds or RPC error)';\n      throw new Error(msg);\n    }\n\n    const txHash = this.getTxHash(txResult);\n\n    // Contract can return `{ verified: false, registration_info: null }` without failing the tx.\n    // When that happens, the authenticator was NOT registered on-chain, so we must not proceed\n    // with local persistence + auto-login.\n    const linkDeviceResult = parseLinkDeviceRegisterUserResponse(txResult);\n    if (linkDeviceResult?.verified === false) {\n      const logs = this.extractNearExecutionLogs(txResult);\n      const isStaleChallenge = logs.some((log) => /StaleChallenge|freshness validation failed/i.test(log));\n      const txHint = txHash ? ` (tx: ${txHash})` : '';\n      const code = isStaleChallenge\n        ? EmailRecoveryErrorCode.VRF_CHALLENGE_EXPIRED\n        : EmailRecoveryErrorCode.REGISTRATION_NOT_VERIFIED;\n      const message = isStaleChallenge\n        ? `Timed out finalizing registration (VRF challenge expired). Please restart email recovery and try again${txHint}.`\n        : `Registration did not verify on-chain. Please try again${txHint}.`;\n      throw new EmailRecoveryError(message, code, {\n        accountId: rec.accountId,\n        nearPublicKey: rec.nearPublicKey,\n        transactionHash: txHash,\n        logs,\n        result: linkDeviceResult,\n      });\n    }\n\n    if (txHash) {\n      this.emit({\n        step: 5,\n        phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,\n        status: EmailRecoveryStatus.PROGRESS,\n        message: 'Registration transaction confirmed',\n        data: {\n          accountId: rec.accountId,\n          nearPublicKey: rec.nearPublicKey,\n          transactionHash: txHash,\n        },\n      } as EmailRecoverySSEEvent & { data: Record<string, unknown> });\n    }\n\n    return txHash;\n  }\n\n  private getTxHash(outcome: FinalExecutionOutcome): string | undefined {\n    const txUnknown: unknown = outcome.transaction;\n    if (txUnknown && typeof txUnknown === 'object') {\n      const hash = (txUnknown as Record<string, unknown>).hash;\n      if (typeof hash === 'string' && hash.length > 0) return hash;\n    }\n\n    const fallback = (outcome as unknown as Record<string, unknown>).transaction_hash;\n    return typeof fallback === 'string' && fallback.length > 0 ? fallback : undefined;\n  }\n\n  private extractNearExecutionLogs(outcome: FinalExecutionOutcome): string[] {\n    const logs: string[] = [];\n    for (const entry of outcome.transaction_outcome.outcome.logs) {\n      logs.push(String(entry));\n    }\n    for (const receipt of outcome.receipts_outcome) {\n      for (const entry of receipt.outcome.logs) {\n        logs.push(String(entry));\n      }\n    }\n    return logs;\n  }\n\n  private mapAuthenticatorsFromContract(\n    authenticators: Array<{ credentialId: string; authenticator: StoredAuthenticator }>\n  ) {\n    return authenticators.map(({ authenticator }) => ({\n      credentialId: authenticator.credentialId,\n      credentialPublicKey: authenticator.credentialPublicKey,\n      transports: authenticator.transports,\n      name: authenticator.name,\n      registered: authenticator.registered.toISOString(),\n      vrfPublicKey: authenticator.vrfPublicKeys?.[0] || '',\n      deviceNumber: authenticator.deviceNumber,\n    }));\n  }\n\n  private async syncAuthenticatorsBestEffort(accountId: AccountId): Promise<boolean> {\n    try {\n      const { syncAuthenticatorsContractCall } = await import('../rpcCalls');\n      const authenticators = await syncAuthenticatorsContractCall(\n        this.context.nearClient,\n        this.context.configs.contractId,\n        accountId\n      );\n\n      const mappedAuthenticators = this.mapAuthenticatorsFromContract(authenticators);\n      await IndexedDBManager.clientDB.syncAuthenticatorsFromContract(accountId, mappedAuthenticators);\n      return true;\n    } catch (err) {\n      console.warn('[EmailRecoveryFlow] Failed to sync authenticators after recovery:', err);\n      return false;\n    }\n  }\n\n  private async setLastUserBestEffort(accountId: AccountId, deviceNumber: number): Promise<boolean> {\n    try {\n      await IndexedDBManager.clientDB.setLastUser(accountId, deviceNumber);\n      return true;\n    } catch (err) {\n      console.warn('[EmailRecoveryFlow] Failed to set last user after recovery:', err);\n      return false;\n    }\n  }\n\n  private async updateNonceBestEffort(\n    nonceManager: ReturnType<PasskeyManagerContext['webAuthnManager']['getNonceManager']>,\n    signedTx: SignedTransaction\n  ): Promise<void> {\n    try {\n      const txNonce = signedTx.transaction.nonce;\n      if (txNonce != null) {\n        await nonceManager.updateNonceFromBlockchain(\n          this.context.nearClient,\n          String(txNonce)\n        );\n      }\n    } catch {\n      // best-effort; do not fail flow\n    }\n  }\n\n  private async persistRecoveredUserData(rec: PendingEmailRecovery, accountId: AccountId): Promise<void> {\n    const { webAuthnManager } = this.context;\n\n    const payload: StoreUserDataPayload = {\n      nearAccountId: accountId,\n      deviceNumber: rec.deviceNumber,\n      clientNearPublicKey: rec.nearPublicKey,\n      lastUpdated: Date.now(),\n      passkeyCredential: {\n        id: rec.credential.id,\n        rawId: rec.credential.rawId,\n      },\n      encryptedVrfKeypair: {\n        encryptedVrfDataB64u: rec.encryptedVrfKeypair.encryptedVrfDataB64u,\n        chacha20NonceB64u: rec.encryptedVrfKeypair.chacha20NonceB64u,\n      },\n      serverEncryptedVrfKeypair: rec.serverEncryptedVrfKeypair || undefined,\n    };\n\n    await webAuthnManager.storeUserData(payload);\n  }\n\n  /**\n   * Explicitly persist the authenticator from the recovery record into the local cache.\n   * This ensures the key is available immediately, bridging the gap before RPC sync sees it.\n   */\n  private async persistAuthenticatorBestEffort(rec: PendingEmailRecovery, accountId: AccountId): Promise<void> {\n    try {\n      const { webAuthnManager } = this.context;\n      const attestationB64u = rec.credential.response.attestationObject;\n      const credentialPublicKey = await webAuthnManager.extractCosePublicKey(attestationB64u);\n\n      await webAuthnManager.storeAuthenticator({\n        nearAccountId: accountId,\n        deviceNumber: rec.deviceNumber,\n        credentialId: rec.credential.rawId,\n        credentialPublicKey,\n        transports: ['internal'],\n        name: `Device ${rec.deviceNumber} Passkey for ${rec.accountId.split('.')[0]}`,\n        registered: new Date().toISOString(),\n        syncedAt: new Date().toISOString(), // Local truth is fresh\n        vrfPublicKey: rec.vrfPublicKey,\n      });\n      console.log('[EmailRecoveryFlow] Locally persisted recovered authenticator for immediate use.');\n    } catch (e) {\n      console.error('[EmailRecoveryFlow] Failed to locally persist authenticator (critical for immediate export):', e);\n      // We log error but don't rethrow to avoid crashing the final success UI.\n    }\n  }\n\n  private async markCompleteAndClearPending(rec: PendingEmailRecovery): Promise<void> {\n    rec.status = 'complete';\n    await this.savePending(rec);\n    await this.clearPending(rec.accountId, rec.nearPublicKey);\n  }\n\n  private async assertVrfActiveForAccount(accountId: AccountId, message: string): Promise<void> {\n    const vrfStatus = await this.context.webAuthnManager.checkVrfStatus();\n    const vrfActiveForAccount =\n      vrfStatus.active\n      && vrfStatus.nearAccountId\n      && String(vrfStatus.nearAccountId) === String(accountId);\n    if (!vrfActiveForAccount) {\n      throw new Error(message);\n    }\n  }\n\n  private async finalizeLocalLoginState(accountId: AccountId, deviceNumber: number): Promise<void> {\n    const { webAuthnManager } = this.context;\n    await webAuthnManager.setLastUser(accountId, deviceNumber);\n    await webAuthnManager.initializeCurrentUser(accountId, this.context.nearClient);\n    try { await getLoginSession(this.context, accountId); } catch { }\n  }\n\n  private async tryShamirUnlock(\n    rec: PendingEmailRecovery,\n    accountId: AccountId,\n    deviceNumber: number\n  ): Promise<boolean> {\n    if (\n      !rec.serverEncryptedVrfKeypair\n      || !rec.serverEncryptedVrfKeypair.serverKeyId\n      || !this.context.configs.vrfWorkerConfigs?.shamir3pass?.relayServerUrl\n    ) {\n      return false;\n    }\n\n    try {\n      const { webAuthnManager } = this.context;\n      const unlockResult = await webAuthnManager.shamir3PassDecryptVrfKeypair({\n        nearAccountId: accountId,\n        kek_s_b64u: rec.serverEncryptedVrfKeypair.kek_s_b64u,\n        ciphertextVrfB64u: rec.serverEncryptedVrfKeypair.ciphertextVrfB64u,\n        serverKeyId: rec.serverEncryptedVrfKeypair.serverKeyId,\n      });\n\n      if (!unlockResult.success) {\n        return false;\n      }\n\n      await this.assertVrfActiveForAccount(accountId, 'VRF session inactive after Shamir3Pass unlock');\n      await this.finalizeLocalLoginState(accountId, deviceNumber);\n      return true;\n    } catch (err) {\n      console.warn('[EmailRecoveryFlow] Shamir 3-pass unlock failed, falling back to TouchID', err);\n      return false;\n    }\n  }\n\n  private async tryTouchIdUnlock(\n    rec: PendingEmailRecovery,\n    accountId: AccountId,\n    deviceNumber: number\n  ): Promise<{ success: boolean; reason?: string }> {\n    try {\n      const { webAuthnManager } = this.context;\n      const authChallenge = createRandomVRFChallenge() as VRFChallenge;\n\n      const storedCredentialId = String(rec.credential?.rawId || rec.credential?.id || '').trim();\n      const credentialIds = storedCredentialId ? [storedCredentialId] : [];\n      const authenticators = credentialIds.length > 0\n        ? []\n        : await webAuthnManager.getAuthenticatorsByUser(accountId);\n      const authCredential = await webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({\n        nearAccountId: accountId,\n        challenge: authChallenge,\n        credentialIds: credentialIds.length > 0 ? credentialIds : authenticators.map((a) => a.credentialId),\n      });\n\n      if (storedCredentialId && authCredential.rawId !== storedCredentialId) {\n        return {\n          success: false,\n          reason: 'Wrong passkey selected during recovery auto-login; please use the newly recovered passkey.',\n        };\n      }\n\n      const vrfUnlockResult = await webAuthnManager.unlockVRFKeypair({\n        nearAccountId: accountId,\n        encryptedVrfKeypair: rec.encryptedVrfKeypair,\n        credential: authCredential,\n      });\n\n      if (!vrfUnlockResult.success) {\n        return { success: false, reason: vrfUnlockResult.error || 'VRF unlock failed during auto-login' };\n      }\n\n      await this.assertVrfActiveForAccount(accountId, 'VRF session inactive after TouchID unlock');\n      await this.finalizeLocalLoginState(accountId, deviceNumber);\n      return { success: true };\n    } catch (err: unknown) {\n      return { success: false, reason: errorMessage(err) || String(err) };\n    }\n  }\n\n  private async handleAutoLoginFailure(reason: string, err?: unknown): Promise<AutoLoginResult> {\n    console.warn('[EmailRecoveryFlow] Auto-login failed after recovery', err ?? reason);\n    try {\n      await this.context.webAuthnManager.clearVrfSession();\n    } catch { }\n    return { success: false, reason };\n  }\n\n  private async finalizeRegistration(rec: PendingEmailRecovery): Promise<void> {\n    this.phase = EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION;\n    this.emit({\n      step: 5,\n      phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,\n      status: EmailRecoveryStatus.PROGRESS,\n      message: 'Finalizing email recovery registration...',\n      data: {\n        accountId: rec.accountId,\n        nearPublicKey: rec.nearPublicKey,\n      },\n    } as EmailRecoverySSEEvent & { data: Record<string, unknown> });\n\n    try {\n      const { nonceManager, accountId } = this.initializeNonceManager(rec);\n      const signedTx = await this.signNewDevice2RegistrationTx(rec, accountId);\n      const txHash = await this.broadcastRegistrationTxAndWaitFinal(rec, signedTx);\n      if (!txHash) {\n        console.warn('[EmailRecoveryFlow] Registration transaction confirmed without hash; continuing local persistence');\n      }\n\n      // CRITICAL: Persist local state immediately.\n      // 1. Store the new user record (Device N) so that `getLastUser()` finds it.\n      await this.persistRecoveredUserData(rec, accountId);\n\n      // 2. Sync authenticators (RPC might be stale, but we try).\n      await this.syncAuthenticatorsBestEffort(accountId);\n\n      // 3. FORCE-SAVE the local authenticator from our recovery record.\n      // This is crucial because RPC sync might be slow/empty immediately after TX.\n      // We must ensure the new key is in the DB so `ensureCurrentPasskey` finds it.\n      // We do this AFTER sync to ensure it's not wiped by a stale sync.\n      await this.persistAuthenticatorBestEffort(rec, accountId);\n\n      // 4. Set as active user to ensure immediate subsequent calls use this identity.\n      await this.setLastUserBestEffort(accountId, rec.deviceNumber);\n\n      await this.updateNonceBestEffort(nonceManager, signedTx);\n\n      this.emitAutoLoginEvent(EmailRecoveryStatus.PROGRESS, 'Attempting auto-login with recovered device...', {\n        autoLogin: 'progress',\n      });\n\n      const autoLoginResult = await this.attemptAutoLogin(rec);\n      if (autoLoginResult.success) {\n        this.emitAutoLoginEvent(EmailRecoveryStatus.SUCCESS, `Welcome ${accountId}`, {\n          autoLogin: 'success',\n        });\n      } else {\n        this.emitAutoLoginEvent(EmailRecoveryStatus.ERROR, 'Auto-login failed; please log in manually on this device.', {\n          error: autoLoginResult.reason,\n          autoLogin: 'error',\n        });\n      }\n\n      await this.markCompleteAndClearPending(rec);\n\n      this.phase = EmailRecoveryPhase.STEP_6_COMPLETE;\n      this.emit({\n        step: 6,\n        phase: EmailRecoveryPhase.STEP_6_COMPLETE,\n        status: EmailRecoveryStatus.SUCCESS,\n        message: 'Email recovery completed successfully',\n        data: {\n          accountId: rec.accountId,\n          nearPublicKey: rec.nearPublicKey,\n        },\n      } as EmailRecoverySSEEvent & { data: Record<string, unknown> });\n    } catch (e: unknown) {\n      rec.status = 'error';\n      await this.savePending(rec).catch(() => { });\n      const original = e instanceof Error\n        ? e\n        : new Error(errorMessage(e) || 'Email recovery finalization failed');\n      const err = this.emitError(5, original);\n      await this.options?.afterCall?.(false);\n      throw err;\n    }\n  }\n\n  private async attemptAutoLogin(rec: PendingEmailRecovery): Promise<AutoLoginResult> {\n    try {\n      const accountId = toAccountId(rec.accountId);\n      const deviceNumber = parseDeviceNumber(rec.deviceNumber, { min: 1 });\n      if (deviceNumber === null) {\n        return this.handleAutoLoginFailure(\n          `Invalid deviceNumber for auto-login: ${String(rec.deviceNumber)}`\n        );\n      }\n\n      const shamirUnlocked = await this.tryShamirUnlock(rec, accountId, deviceNumber);\n      if (shamirUnlocked) {\n        return { success: true, method: 'shamir' };\n      }\n\n      const touchIdResult = await this.tryTouchIdUnlock(rec, accountId, deviceNumber);\n      if (touchIdResult.success) {\n        return { success: true, method: 'touchid' };\n      }\n\n      return this.handleAutoLoginFailure(touchIdResult.reason || 'Auto-login failed');\n    } catch (err: unknown) {\n      return this.handleAutoLoginFailure(errorMessage(err) || String(err), err);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqGA,SAAS,uBAAuB,SAM9B;CACA,MAAM,kBAAkB,QAAQ,QAAQ;CACxC,MAAM,kBAAkB,OAAO,gBAAgB;CAC/C,MAAM,oBAAoB,OAAO,gBAAgB;CACjD,MAAM,uBAAuB,OAAO,gBAAgB;CACpD,MAAM,eAAe,OAAO,gBAAgB;CAC5C,MAAM,gBAAgB,OAAO,gBAAgB;AAC7C,QAAO;EACL;EACA;EACA;EACA;EACA;;;AAIJ,SAAgB,iCAAyC;CAEvD,MAAM,WAAW;CACjB,MAAM,SAAS;CACf,MAAM,QAAQ,IAAI,WAAW;AAC7B,EAAC,WAAW,UAAU,OAAO,QAAQ,gBAAgB;CACrD,IAAI,MAAM;AACV,MAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,IAC1B,QAAO,SAAS,MAAM,KAAK;AAE7B,QAAO;;;;;;;;;;;;;;;;;CAGI,oBAAb,MAA+B;EAC7B,AAAQ;EACR,AAAQ;EACR,AAAQ;EACR,AAAQ,UAAuC;EAC/C,AAAQ,QAA4BA,yCAAmB;EACvD,AAAQ;EACR,AAAQ;EACR,AAAQ,mBAAkC;EAC1C,AAAQ,YAAY;EACpB,AAAQ;EAER,YAAY,SAAgC,SAAoC;AAC9E,QAAK,UAAU;AACf,QAAK,UAAU;AACf,QAAK,eAAe,SAAS,gBAAgB,IAAIC,4DAA0B,EACzE,uBAAuB,KAAK,YAAY;;EAI5C,WAAW,SAAoC;AAC7C,OAAI,CAAC,QAAS;AACd,QAAK,UAAU;IAAE,GAAI,KAAK,WAAW;IAAK,GAAG;;AAC7C,OAAI,QAAQ,aACV,MAAK,eAAe,QAAQ;;EAGhC,AAAQ,KAAK,OAA8B;AACzC,QAAK,SAAS,UAAU;;EAG1B,AAAQ,UAAU,MAAc,gBAAuC;GACrE,MAAM,MAAM,OAAO,mBAAmB,WAAW,IAAI,MAAM,kBAAkB;GAC7E,MAAM,UAAU,IAAI,YAAY,OAAO,mBAAmB,WAAW,iBAAiB;AACtF,QAAK,QAAQD,yCAAmB;AAChC,QAAK,QAAQ;AACb,QAAK,KAAK;IACR;IACA,OAAOA,yCAAmB;IAC1B,QAAQE,0CAAoB;IAC5B;IACA,OAAO;;AAET,QAAK,SAAS,UAAU;AACxB,UAAO;;EAGT,MAAc,KAAK,MAAc,SAAiC;GAChE,MAAM,MAAM,KAAK,UAAU,MAAM;AACjC,SAAM,KAAK,SAAS,YAAY;AAChC,SAAM;;EAGR,MAAc,2BAA2B,MAAc,WAAuC;GAC5F,MAAM,aAAaC,yCAAsB;AACzC,OAAI,CAAC,WAAW,MACd,OAAM,KAAK,KAAK,MAAM,4BAA4B,WAAW;AAE/D,UAAOC,+BAAY;;EAGrB,MAAc,qBACZ,MACA,MACA,SAK+B;GAC/B,MAAM,EACJ,mBAAmB,MACnB,iBAAiB,2DACjB,qBAAqB,2EACnB,WAAW;GAEf,IAAI,MAAM,KAAK;AACf,OAAI,CAAC,OAAO,IAAI,cAAc,KAAK,aAAc,KAAK,iBAAiB,IAAI,kBAAkB,KAAK,eAAgB;AAChH,UAAM,MAAM,KAAK,YAAY,KAAK,WAAW,KAAK;AAClD,SAAK,UAAU;;AAGjB,OAAI,CAAC,IACH,OAAM,KAAK,KAAK,MAAM;GAGxB,MAAM,WAAW;AACjB,OAAI,CAAC,oBAAoB,SAAS,WAAW,QAC3C,OAAM,KAAK,KAAK,MAAM;AAGxB,UAAO;;EAGT,AAAQ,YAAY;AAClB,UAAO,uBAAuB,KAAK,QAAQ;;EAG7C,AAAQ,SAAS,OAA4D;AAC3E,OAAI,OAAO,UAAU,SAAU,QAAO;AACtC,OAAI,OAAO,UAAU,SAAU,QAAO,OAAO;AAC7C,OAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO,OAAO;AACjE,UAAO,OAAO;;EAGhB,AAAQ,wBAAwB,aAAsC;GACpE,MAAM,yBAAyB,OAAO;GACtC,MAAM,SAAS,KAAK,SAAS,YAAY;GACzC,MAAM,SAAS,KAAK,SAAS,YAAY;GACzC,MAAM,eAAe,KAAK,SAAS,YAAY;GAC/C,MAAM,cAAc,eAAe;GACnC,MAAM,eAAe,SAAS,SAAS;AACvC,UAAO,eAAe,IAAI,eAAe,OAAO;;EAGlD,MAAc,wBAAwB,eAAyC;GAC7E,MAAM,EAAE,oBAAoB,KAAK;AAEjC,OAAI;IACF,MAAM,cAAc,MAAM,KAAK,QAAQ,WAAW,YAAY;IAC9D,MAAM,YAAY,KAAK,wBAAwB;AAC/C,QAAI,YAAY,OAAO,iBACrB,OAAM,KAAK,KACT,GACA,2EAA2E,UAAU,WAAW,oBAAoB,OAAO,iBAAiB;YAGzIC,KAAc;AACrB,UAAM,KAAK,KAAK,GAAGC,4BAAa,QAAQ;;;EAI5C,AAAQ,0BAA0B,eAA4C;GAC5E,MAAM,iBAAiB,OAAO,iBAAiB,IAAI,OAAO;AAC1D,UAAO,kBAAkB;;EAG3B,MAAc,gCAAgC,eAA2C;AACvF,OAAI;IACF,MAAM,EAAE,mCAAmC,2CAAM;IACjD,MAAM,iBAAiB,MAAM,+BAC3B,KAAK,QAAQ,YACb,KAAK,QAAQ,QAAQ,YACrB;IAEF,MAAM,UAAU,eACb,KAAK,EAAE,oBAAoB,cAAc,cACzC,QAAQ,MAAmB,OAAO,MAAM,YAAY,OAAO,SAAS;IACvE,MAAM,MAAM,QAAQ,SAAS,IAAI,KAAK,IAAI,GAAG,WAAW;AACxD,WAAO,MAAM;WACP;AACN,WAAO;;;EAIX,MAAc,gCACZ,eACA,cACsC;GACtC,MAAM,gBAAgB;IACpB,OAAO,KAAK,SAAS,eAAe,SAAS;IAC7C,MAAM,KAAK,SAAS,eAAe,QAAQ;;GAE7C,MAAM,UAAU,MAAM,KAAK,QAAQ,gBAAgB,0CAA0C;IAC3F;IACA;IACA;IACA,4BAA4B,KAAK,SAAS;;AAG5C,OAAI,CAAC,QAAQ,aAAa,CAAC,QAAQ,WACjC,OAAM,KAAK,KAAK,GAAG;AAGrB,UAAO;IACL,YAAY,QAAQ;IACpB,cAAc,QAAQ,gBAAgB;;;EAI1C,MAAc,yBACZ,eACA,cACA,YAC8B;GAC9B,MAAM,sBAAsB,MAAM,KAAK,QAAQ,gBAAgB,iBAAiB;IAC9E;IACA;;AAGF,OAAI,CAAC,oBAAoB,WAAW,CAAC,oBAAoB,oBACvD,OAAM,KAAK,KAAK,GAAG;GAGrB,MAAM,gBAAgB,MAAM,KAAK,QAAQ,gBAAgB,0CAA0C;IACjG;IACA;IACA,SAAS,EAAE;;AAGb,OAAI,CAAC,cAAc,WAAW,CAAC,cAAc,UAC3C,OAAM,KAAK,KAAK,GAAG;AAGrB,UAAO;IACL,qBAAqB,oBAAoB;IACzC,2BAA2B,oBAAoB,6BAA6B;IAC5E,cAAc,oBAAoB;IAClC,eAAe,cAAc;;;EAIjC,AAAQ,eAAe,KAA2B,WAAyB;AACzE,QAAK,QAAQN,yCAAmB;AAChC,QAAK,KAAK;IACR,MAAM;IACN,OAAOA,yCAAmB;IAC1B,QAAQE,0CAAoB;IAC5B,SAAS;IACT,MAAM;KACJ,WAAW,IAAI;KACf,GAAI,IAAI,gBAAgB,EAAE,eAAe,IAAI,kBAAkB;KAC/D,eAAe,IAAI;KACnB,WAAW,IAAI;KACf;;;;EAKN,AAAQ,mBACN,QACA,SACA,MACM;AACN,QAAK,KAAK;IACR,MAAM;IACN,OAAOF,yCAAmB;IAC1B;IACA;IACA;;;EAIJ,MAAc,8BACZ,KACqG;AACrG,OAAI;IACF,MAAM,UAAU,MAAMO,yCACpB,KAAK,QAAQ,YACb,IAAI,WACJ,IAAI;AAGN,QAAI,CAAC,QACH,QAAO;KAAE,WAAW;KAAO,SAAS;KAAO,SAAS;;AAItD,QAAI,QAAQ,cAAc,QAAQ,eAAe,IAAI,UACnD,QAAO;KACL,WAAW;KACX,SAAS;KACT,cAAc;;AAIlB,QAAI,QAAQ,kBAAkB,QAAQ,mBAAmB,IAAI,eAAe;KAC1E,MAAM,WAAWC,uCAAoB,IAAI;KACzC,MAAM,SAASA,uCAAoB,QAAQ;AAK3C,SAAI,WAAW,UAAU,OAGvB,QAAO;MACL,WAAW;MACX,SAAS;MACT,cACE,sDAAsD,IAAI,UAAU,aACxD,SAAS,QAAQ,OAAO;;;IAM5C,MAAM,aAAa,QAAQ,OAAO;AAElC,QAAI,eAAe,cAAc,eAAe,YAC9C,QAAO;KACL,WAAW;KACX,SAAS;;AAIb,QAAI,WAAW,SAAS,UACtB,QAAO;KACL,WAAW;KACX,SAAS;KACT,cAAc,QAAQ,SAAS,0BAA0B,QAAQ,UAAU,iBAAiB;;AAIhG,WAAO;KACL,WAAW;KACX,SAAS;;YAEJ,KAAK;AAGZ,YAAQ,KAAK,oEAAoE;AACjF,WAAO;;;EAIX,MAAc,2BAA2B,KAAoD;AAC3F,OAAI;AACF,UAAM,KAAK,QAAQ,WAAW,cAAc,IAAI,WAAW,IAAI;AAC/D,WAAO;YACAC,KAAU;IACjB,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,OAAO,IAAI,QAAQ;IAChE,MAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,OAAO,IAAI,SAAS;IACnE,MAAM,MAAM,OAAO,KAAK,YAAY,WAAW,OAAO,IAAI,WAAW;AAErE,QACE,yBAAyB,KAAK,SAC9B,yBAAyB,KAAK,UAC9B,6BAA6B,KAAK,QAClC,+BAA+B,KAAK,KAEpC,QAAO;AAKT,YAAQ,KAAK,sFAAsF;AACnG,WAAO;;;EAIX,AAAQ,sBACN,KACA,SACyB;AACzB,UAAO;IACL,WAAW,IAAI;IACf,WAAW,IAAI;IACf,eAAe,IAAI;IACnB,iBAAiB,QAAQ;IACzB,WAAW,QAAQ;IACnB,WAAW,QAAQ;;;EAIvB,MAAc,qBAAqB,IAA2B;AAC5D,SAAM,IAAI,SAAc,YAAW;AACjC,SAAK,uBAAuB;AAC5B,SAAK,eAAe,iBAAiB;AACnC,UAAK,uBAAuB;AAC5B,UAAK,eAAe;AACpB;OACC;MACF,cAAc;AACf,SAAK,uBAAuB;;;EAIhC,MAAc,UAAa,MAOK;GAC9B,MAAM,MAAM,KAAK,OAAO,KAAK;GAC7B,MAAM,QAAQ,KAAK,SAAS,KAAK,qBAAqB,KAAK;GAC3D,MAAM,YAAY;GAClB,IAAI,YAAY;AAEhB,UAAO,CAAC,KAAK,eAAe;AAC1B,iBAAa;IACb,MAAMC,cAAY,QAAQ;AAC1B,QAAIA,cAAY,KAAK,UACnB,QAAO;KAAE,QAAQ;KAAY;KAAW;;IAG1C,MAAM,SAAS,MAAM,KAAK,KAAK;KAAE;KAAW;;AAC5C,QAAI,OAAO,KACT,QAAO;KAAE,QAAQ;KAAa,OAAO,OAAO;KAAO;KAAW;;AAGhE,QAAI,KAAK,cACP,QAAO;KAAE,QAAQ;KAAa;KAAW;;AAG3C,UAAM,MAAM,KAAK;;GAGnB,MAAM,YAAY,QAAQ;AAC1B,UAAO;IAAE,QAAQ;IAAa;IAAW;;;EAG3C,MAAc,YACZ,WACA,eACsC;AACtC,UAAO,KAAK,aAAa,IAAI,WAAW;;EAG1C,MAAc,YAAY,KAA0C;AAClE,SAAM,KAAK,aAAa,IAAI;AAC5B,QAAK,UAAU;;EAGjB,MAAc,aAAa,WAAsB,eAAuC;AACtF,SAAM,KAAK,aAAa,MAAM,WAAW;AAEzC,OACE,KAAK,WACF,KAAK,QAAQ,cAAc,cAC1B,CAAC,iBAAiB,KAAK,QAAQ,kBAAkB,eAErD,MAAK,UAAU;;EAInB,WAAW;AACT,UAAO;IACL,OAAO,KAAK;IACZ,SAAS,KAAK;IACd,OAAO,KAAK;;;EAIhB,MAAM,eAAe,MAAsE;GACzF,MAAM,EAAE,WAAW,kBAAkB;AACrC,QAAK,YAAY;AACjB,QAAK,QAAQ;GAEb,MAAM,gBAAgB,MAAM,KAAK,2BAA2B,GAAG;GAC/D,MAAM,MAAM,MAAM,KAAK,qBACrB,GACA;IAAE,WAAW;IAAe;MAC5B,EAAE,kBAAkB;AAGtB,OAAI,IAAI,WAAW,gBAAgB,IAAI,WAAW,WAChD,OAAM,KAAK,KAAK,GAAG;GAGrB,MAAM,YACJ,IAAI,WAAW,mBACX,MAAM,KAAK,8BAA8B,OACzC,KAAK,uBAAuB;AAClC,QAAK,eAAe,KAAK;AACzB,SAAM,KAAK,SAAS,YAAY,MAAM;AACtC,UAAO;;EAGT,MAAM,MAAM,MAA4G;GACtH,MAAM,EAAE,WAAW,kBAAkB;AACrC,QAAK,YAAY;AACjB,QAAK,QAAQ;AACb,QAAK,QAAQV,yCAAmB;AAEhC,QAAK,KAAK;IACR,MAAM;IACN,OAAOA,yCAAmB;IAC1B,QAAQE,0CAAoB;IAC5B,SAAS;;GAGX,MAAM,gBAAgB,MAAM,KAAK,2BAA2B,GAAG;AAC/D,SAAM,KAAK,wBAAwB;GACnC,MAAM,iBAAiB,KAAK,0BAA0B;GAGtD,MAAM,eAAe,MAAM,KAAK,gCAAgC;AAEhE,QAAK,QAAQF,yCAAmB;AAChC,QAAK,KAAK;IACR,MAAM;IACN,OAAOA,yCAAmB;IAC1B,QAAQE,0CAAoB;IAC5B,SAAS;;AAGX,OAAI;IACF,MAAM,UAAU,MAAM,KAAK,gCAAgC,eAAe;IAC1E,MAAM,cAAc,MAAM,KAAK,yBAAyB,eAAe,cAAc,QAAQ;IAE7F,MAAMS,MAA4B;KAChC,WAAW;KACX,eAAe;KACf;KACA,eAAe,YAAY;KAC3B,WAAW;KACX,qBAAqB,YAAY;KACjC,2BAA2B,YAAY;KACvC,cAAc,YAAY;KAC1B,YAAY,QAAQ;KACpB,cAAc,QAAQ,gBAAgB;KACtC,WAAW,KAAK;KAChB,QAAQ;;IAGV,MAAM,YAAY,MAAM,KAAK,8BAA8B;AAE3D,SAAK,eAAe,KAAK;AAEzB,UAAM,KAAK,SAAS,YAAY,MAAM;AAEtC,WAAO;KAAE;KAAW,eAAe,IAAI;;YAChCC,GAAY;IACnB,MAAM,MAAM,KAAK,UAAU,GAAGN,4BAAa,MAAM;AACjD,UAAM,KAAK,SAAS,YAAY;AAChC,UAAM;;;EAIV,AAAQ,uBAAuB,KAAmC;GAChE,MAAM,EAAE,kBAAkB,KAAK;GAC/B,MAAM,KAAK,mBAAmB;GAC9B,MAAM,UAAU,mBAAmB,WAAW,IAAI,UAAU,GAAG,IAAI,UAAU,GAAG,IAAI;GACpF,MAAM,OAAO,mBAAmB,sBAAsB,IAAI,UAAU;AACpE,UAAO,UAAU,GAAG,WAAW,QAAQ,QAAQ;;EAGjD,MAAc,8BAA8B,KAA4C;AACtF,OAAI,SAAS;AACb,SAAM,KAAK,YAAY;AACvB,UAAO,KAAK,uBAAuB;;EAGrC,MAAM,aAAa,MAAoE;GACrF,MAAM,EAAE,WAAW,kBAAkB;AACrC,QAAK,YAAY;AACjB,QAAK,QAAQ;GAEb,MAAM,gBAAgB,MAAM,KAAK,2BAA2B,GAAG;GAC/D,MAAM,MAAM,MAAM,KAAK,qBACrB,GACA;IAAE,WAAW;IAAe;MAC5B,EAAE,kBAAkB;AAEtB,OAAI,IAAI,WAAW,cAAc,IAAI,WAAW,cAAc;AAC5D,UAAM,KAAK,SAAS,YAAY,MAAM;AACtC;;AAEF,OAAI,IAAI,WAAW,iBACjB,OAAM,KAAK,8BAA8B;AAG3C,SAAM,KAAK,gBAAgB;AAC3B,SAAM,KAAK,SAAS,YAAY,MAAM;;EAGxC,cAAoB;AAClB,QAAK,YAAY;AACjB,OAAI,KAAK,cAAc;AACrB,iBAAa,KAAK;AAClB,SAAK,eAAe;;AAEtB,OAAI,KAAK,sBAAsB;AAC7B,SAAK;AACL,SAAK,uBAAuB;;;;;;;;EAShC,MAAM,eAAe,MAAsE;AACzF,QAAK;GAEL,MAAM,uBAAuB,MAAM,aAAa,KAAK,SAAS,aAAa,IAAI,WAAW;GAC1F,MAAM,iBAAiB,MAAM,iBAAiB,KAAK,SAAS,iBAAiB,IAAI,WAAW;AAE5F,OAAI,oBACF,KAAI;AACF,UAAM,KAAK,aAAaF,+BAAY,sBAAsB;WACpD;AAKV,QAAK,UAAU;AACf,QAAK,QAAQ;AACb,QAAK,QAAQJ,yCAAmB;;EAGlC,MAAM,SAAS,MAAoE;GACjF,MAAM,EAAE,WAAW,kBAAkB;AACrC,QAAK,YAAY;AACjB,QAAK,QAAQ;GAEb,MAAM,gBAAgB,MAAM,KAAK,2BAA2B,GAAG;GAC/D,MAAM,MAAM,MAAM,KAAK,qBACrB,GACA;IAAE,WAAW;IAAe;MAC5B,EAAE,kBAAkB;AAGtB,QAAK,KAAK;IACR,MAAM;IACN,OAAOA,yCAAmB;IAC1B,QAAQE,0CAAoB;IAC5B,SAAS;IACT,MAAM;KACJ,WAAW,IAAI;KACf,eAAe,IAAI;KACnB,QAAQ,IAAI;;;AAIhB,OAAI,IAAI,WAAW,YAAY;AAC7B,SAAK,QAAQF,yCAAmB;AAChC,SAAK,KAAK;KACR,MAAM;KACN,OAAOA,yCAAmB;KAC1B,QAAQE,0CAAoB;KAC5B,SAAS;;AAEX,UAAM,KAAK,SAAS,YAAY,MAAM;AACtC;;AAIF,SAAM,KAAK,gBAAgB;AAC3B,SAAM,KAAK,qBAAqB;AAChC,SAAM,KAAK,SAAS,YAAY,MAAM;;EAGxC,MAAc,gBAAgB,KAA0C;GACtE,MAAM,EAAE,mBAAmB,yBAAyB,KAAK;AACzD,QAAK,QAAQF,yCAAmB;AAChC,QAAK,mBAAmB,KAAK;GAC7B,IAAI,aAAa;GAEjB,MAAM,aAAa,MAAM,KAAK,UAA+B;IAC3D,YAAY;IACZ,WAAW;IACX,mBAAmB,KAAK;IACxB,MAAM,OAAO,EAAE,WAAW,gBAAgB;KACxC,MAAM,eAAe,MAAM,KAAK,8BAA8B;AAC9D,SAAI,gBAAgB,CAAC,aAAa,QAChC,cAAa;KAGf,IAAI,YAAY,cAAc,cAAc;KAC5C,IAAI,UAAU,cAAc,YAAY;KACxC,IAAIM,iBAAe,cAAc;KACjC,IAAIO;AAEJ,SAAI,cAAc,SAAS;MACzB,MAAM,SAAS,MAAM,KAAK,2BAA2B;AACrD,UAAI,WAAW,MAAM;AACnB,mBAAY;AACZ,iBAAU;iBACD,WAAW,SAAS,YAAY;AACzC,mBAAY;AACZ,iBAAU;AACV,wBACE;iBACO,WAAW,KAEpB,QAAO,EAAE,MAAM;;AAInB,UAAK,KAAK;MACR,MAAM;MACN,OAAOb,yCAAmB;MAC1B,QAAQE,0CAAoB;MAC5B,SAAS,aAAa,UAClB,wCAAwC,IAAI,UAAU,6BACtD,0CAA0C,IAAI;MAClD,MAAM,KAAK,sBAAsB,KAAK;OACpC;OACA;OACA;;;AAIJ,SAAI,CAAC,UACH,QAAO,EAAE,MAAM;AAGjB,SAAI,CAAC,QACH,QAAO;MACL,MAAM;MACN,OAAO;OACL,SAAS;OACT,cAAcI,kBAAgB;;;AAKpC,YAAO;MAAE,MAAM;MAAM,OAAO,EAAE,SAAS;;;;AAI3C,OAAI,WAAW,WAAW,aAAa;AACrC,QAAI,WAAW,MAAM,YAAY,UAAU;KACzC,MAAMQ,QAAM,KAAK,UAAU,GAAG,WAAW,MAAM;AAC/C,SAAI,SAAS;AACb,WAAM,KAAK,YAAY;AACvB,WAAM,KAAK,SAAS,YAAY;AAChC,WAAMA;;AAGR,QAAI,SAAS;AACb,UAAM,KAAK,YAAY;AACvB;;AAGF,OAAI,WAAW,WAAW,YAAY;IACpC,MAAMA,QAAM,KAAK,UAAU,GAAG;AAC9B,QAAI,SAAS;AACb,UAAM,KAAK,YAAY;AACvB,UAAM,KAAK,SAAS,YAAY;AAChC,UAAMA;;GAGR,MAAM,MAAM,KAAK,UAAU,GAAG;AAC9B,SAAM,KAAK,SAAS,YAAY;AAChC,SAAM;;EAGR,AAAQ,uBACN,KAIA;GACA,MAAM,eAAe,KAAK,QAAQ,gBAAgB;GAClD,MAAM,YAAYV,+BAAY,IAAI;AAClC,gBAAa,eAAe,WAAW,IAAI;AAC3C,UAAO;IAAE;IAAc;;;EAMzB,MAAc,6BAA6B,KAA2B,WAAkD;GACtH,MAAM,eAAe,IAAI;AACzB,OAAI,CAAC,aACH,QAAO,KAAK,KAAK,GAAG;GAGtB,MAAM,qBAAqB,MAAM,KAAK,QAAQ,gBAAgB,qCAAqC;IACjG,eAAe;IACf,YAAY,IAAI;IAChB;IACA,2BAA2B,IAAI;IAC/B,cAAc,IAAI;;AAGpB,OAAI,CAAC,mBAAmB,WAAW,CAAC,mBAAmB,kBACrD,OAAM,KAAK,KAAK,GAAG,mBAAmB,SAAS;AAGjD,UAAO,mBAAmB;;EAG5B,MAAc,oCACZ,KACA,UAC6B;GAC7B,IAAIW;AACJ,OAAI;AACF,eAAW,MAAM,KAAK,QAAQ,WAAW,gBACvC,UACAC,gCAAoB;YAEfX,KAAc;IACrB,MAAM,MAAMC,4BAAa,QAAQ;AACjC,UAAM,IAAI,MAAM;;GAGlB,MAAM,SAAS,KAAK,UAAU;GAK9B,MAAM,mBAAmBW,oDAAoC;AAC7D,OAAI,kBAAkB,aAAa,OAAO;IACxC,MAAM,OAAO,KAAK,yBAAyB;IAC3C,MAAM,mBAAmB,KAAK,MAAM,QAAQ,8CAA8C,KAAK;IAC/F,MAAM,SAAS,SAAS,SAAS,OAAO,KAAK;IAC7C,MAAM,OAAO,mBACTC,6CAAuB,wBACvBA,6CAAuB;IAC3B,MAAM,UAAU,mBACZ,yGAAyG,OAAO,KAChH,yDAAyD,OAAO;AACpE,UAAM,IAAIC,yCAAmB,SAAS,MAAM;KAC1C,WAAW,IAAI;KACf,eAAe,IAAI;KACnB,iBAAiB;KACjB;KACA,QAAQ;;;AAIZ,OAAI,OACF,MAAK,KAAK;IACR,MAAM;IACN,OAAOnB,yCAAmB;IAC1B,QAAQE,0CAAoB;IAC5B,SAAS;IACT,MAAM;KACJ,WAAW,IAAI;KACf,eAAe,IAAI;KACnB,iBAAiB;;;AAKvB,UAAO;;EAGT,AAAQ,UAAU,SAAoD;GACpE,MAAMkB,YAAqB,QAAQ;AACnC,OAAI,aAAa,OAAO,cAAc,UAAU;IAC9C,MAAM,OAAQ,UAAsC;AACpD,QAAI,OAAO,SAAS,YAAY,KAAK,SAAS,EAAG,QAAO;;GAG1D,MAAM,WAAY,QAA+C;AACjE,UAAO,OAAO,aAAa,YAAY,SAAS,SAAS,IAAI,WAAW;;EAG1E,AAAQ,yBAAyB,SAA0C;GACzE,MAAMC,OAAiB;AACvB,QAAK,MAAM,SAAS,QAAQ,oBAAoB,QAAQ,KACtD,MAAK,KAAK,OAAO;AAEnB,QAAK,MAAM,WAAW,QAAQ,iBAC5B,MAAK,MAAM,SAAS,QAAQ,QAAQ,KAClC,MAAK,KAAK,OAAO;AAGrB,UAAO;;EAGT,AAAQ,8BACN,gBACA;AACA,UAAO,eAAe,KAAK,EAAE,qBAAqB;IAChD,cAAc,cAAc;IAC5B,qBAAqB,cAAc;IACnC,YAAY,cAAc;IAC1B,MAAM,cAAc;IACpB,YAAY,cAAc,WAAW;IACrC,cAAc,cAAc,gBAAgB,MAAM;IAClD,cAAc,cAAc;;;EAIhC,MAAc,6BAA6B,WAAwC;AACjF,OAAI;IACF,MAAM,EAAE,mCAAmC,2CAAM;IACjD,MAAM,iBAAiB,MAAM,+BAC3B,KAAK,QAAQ,YACb,KAAK,QAAQ,QAAQ,YACrB;IAGF,MAAM,uBAAuB,KAAK,8BAA8B;AAChE,UAAMC,+BAAiB,SAAS,+BAA+B,WAAW;AAC1E,WAAO;YACA,KAAK;AACZ,YAAQ,KAAK,qEAAqE;AAClF,WAAO;;;EAIX,MAAc,sBAAsB,WAAsB,cAAwC;AAChG,OAAI;AACF,UAAMA,+BAAiB,SAAS,YAAY,WAAW;AACvD,WAAO;YACA,KAAK;AACZ,YAAQ,KAAK,+DAA+D;AAC5E,WAAO;;;EAIX,MAAc,sBACZ,cACA,UACe;AACf,OAAI;IACF,MAAM,UAAU,SAAS,YAAY;AACrC,QAAI,WAAW,KACb,OAAM,aAAa,0BACjB,KAAK,QAAQ,YACb,OAAO;WAGL;;EAKV,MAAc,yBAAyB,KAA2B,WAAqC;GACrG,MAAM,EAAE,oBAAoB,KAAK;GAEjC,MAAMC,UAAgC;IACpC,eAAe;IACf,cAAc,IAAI;IAClB,qBAAqB,IAAI;IACzB,aAAa,KAAK;IAClB,mBAAmB;KACjB,IAAI,IAAI,WAAW;KACnB,OAAO,IAAI,WAAW;;IAExB,qBAAqB;KACnB,sBAAsB,IAAI,oBAAoB;KAC9C,mBAAmB,IAAI,oBAAoB;;IAE7C,2BAA2B,IAAI,6BAA6B;;AAG9D,SAAM,gBAAgB,cAAc;;;;;;EAOtC,MAAc,+BAA+B,KAA2B,WAAqC;AAC3G,OAAI;IACF,MAAM,EAAE,oBAAoB,KAAK;IACjC,MAAM,kBAAkB,IAAI,WAAW,SAAS;IAChD,MAAM,sBAAsB,MAAM,gBAAgB,qBAAqB;AAEvE,UAAM,gBAAgB,mBAAmB;KACvC,eAAe;KACf,cAAc,IAAI;KAClB,cAAc,IAAI,WAAW;KAC7B;KACA,YAAY,CAAC;KACb,MAAM,UAAU,IAAI,aAAa,eAAe,IAAI,UAAU,MAAM,KAAK;KACzE,6BAAY,IAAI,QAAO;KACvB,2BAAU,IAAI,QAAO;KACrB,cAAc,IAAI;;AAEpB,YAAQ,IAAI;YACL,GAAG;AACV,YAAQ,MAAM,gGAAgG;;;EAKlH,MAAc,4BAA4B,KAA0C;AAClF,OAAI,SAAS;AACb,SAAM,KAAK,YAAY;AACvB,SAAM,KAAK,aAAa,IAAI,WAAW,IAAI;;EAG7C,MAAc,0BAA0B,WAAsB,SAAgC;GAC5F,MAAM,YAAY,MAAM,KAAK,QAAQ,gBAAgB;GACrD,MAAM,sBACJ,UAAU,UACP,UAAU,iBACV,OAAO,UAAU,mBAAmB,OAAO;AAChD,OAAI,CAAC,oBACH,OAAM,IAAI,MAAM;;EAIpB,MAAc,wBAAwB,WAAsB,cAAqC;GAC/F,MAAM,EAAE,oBAAoB,KAAK;AACjC,SAAM,gBAAgB,YAAY,WAAW;AAC7C,SAAM,gBAAgB,sBAAsB,WAAW,KAAK,QAAQ;AACpE,OAAI;AAAE,UAAMC,8BAAgB,KAAK,SAAS;WAAoB;;EAGhE,MAAc,gBACZ,KACA,WACA,cACkB;AAClB,OACE,CAAC,IAAI,6BACF,CAAC,IAAI,0BAA0B,eAC/B,CAAC,KAAK,QAAQ,QAAQ,kBAAkB,aAAa,eAExD,QAAO;AAGT,OAAI;IACF,MAAM,EAAE,oBAAoB,KAAK;IACjC,MAAM,eAAe,MAAM,gBAAgB,6BAA6B;KACtE,eAAe;KACf,YAAY,IAAI,0BAA0B;KAC1C,mBAAmB,IAAI,0BAA0B;KACjD,aAAa,IAAI,0BAA0B;;AAG7C,QAAI,CAAC,aAAa,QAChB,QAAO;AAGT,UAAM,KAAK,0BAA0B,WAAW;AAChD,UAAM,KAAK,wBAAwB,WAAW;AAC9C,WAAO;YACA,KAAK;AACZ,YAAQ,KAAK,4EAA4E;AACzF,WAAO;;;EAIX,MAAc,iBACZ,KACA,WACA,cACgD;AAChD,OAAI;IACF,MAAM,EAAE,oBAAoB,KAAK;IACjC,MAAM,gBAAgBC;IAEtB,MAAM,qBAAqB,OAAO,IAAI,YAAY,SAAS,IAAI,YAAY,MAAM,IAAI;IACrF,MAAM,gBAAgB,qBAAqB,CAAC,sBAAsB;IAClE,MAAM,iBAAiB,cAAc,SAAS,IAC1C,KACA,MAAM,gBAAgB,wBAAwB;IAClD,MAAM,iBAAiB,MAAM,gBAAgB,8CAA8C;KACzF,eAAe;KACf,WAAW;KACX,eAAe,cAAc,SAAS,IAAI,gBAAgB,eAAe,KAAK,MAAM,EAAE;;AAGxF,QAAI,sBAAsB,eAAe,UAAU,mBACjD,QAAO;KACL,SAAS;KACT,QAAQ;;IAIZ,MAAM,kBAAkB,MAAM,gBAAgB,iBAAiB;KAC7D,eAAe;KACf,qBAAqB,IAAI;KACzB,YAAY;;AAGd,QAAI,CAAC,gBAAgB,QACnB,QAAO;KAAE,SAAS;KAAO,QAAQ,gBAAgB,SAAS;;AAG5D,UAAM,KAAK,0BAA0B,WAAW;AAChD,UAAM,KAAK,wBAAwB,WAAW;AAC9C,WAAO,EAAE,SAAS;YACXpB,KAAc;AACrB,WAAO;KAAE,SAAS;KAAO,QAAQC,4BAAa,QAAQ,OAAO;;;;EAIjE,MAAc,uBAAuB,QAAgB,KAAyC;AAC5F,WAAQ,KAAK,wDAAwD,OAAO;AAC5E,OAAI;AACF,UAAM,KAAK,QAAQ,gBAAgB;WAC7B;AACR,UAAO;IAAE,SAAS;IAAO;;;EAG3B,MAAc,qBAAqB,KAA0C;AAC3E,QAAK,QAAQN,yCAAmB;AAChC,QAAK,KAAK;IACR,MAAM;IACN,OAAOA,yCAAmB;IAC1B,QAAQE,0CAAoB;IAC5B,SAAS;IACT,MAAM;KACJ,WAAW,IAAI;KACf,eAAe,IAAI;;;AAIvB,OAAI;IACF,MAAM,EAAE,cAAc,cAAc,KAAK,uBAAuB;IAChE,MAAM,WAAW,MAAM,KAAK,6BAA6B,KAAK;IAC9D,MAAM,SAAS,MAAM,KAAK,oCAAoC,KAAK;AACnE,QAAI,CAAC,OACH,SAAQ,KAAK;AAKf,UAAM,KAAK,yBAAyB,KAAK;AAGzC,UAAM,KAAK,6BAA6B;AAMxC,UAAM,KAAK,+BAA+B,KAAK;AAG/C,UAAM,KAAK,sBAAsB,WAAW,IAAI;AAEhD,UAAM,KAAK,sBAAsB,cAAc;AAE/C,SAAK,mBAAmBA,0CAAoB,UAAU,kDAAkD,EACtG,WAAW;IAGb,MAAM,kBAAkB,MAAM,KAAK,iBAAiB;AACpD,QAAI,gBAAgB,QAClB,MAAK,mBAAmBA,0CAAoB,SAAS,WAAW,aAAa,EAC3E,WAAW;QAGb,MAAK,mBAAmBA,0CAAoB,OAAO,6DAA6D;KAC9G,OAAO,gBAAgB;KACvB,WAAW;;AAIf,UAAM,KAAK,4BAA4B;AAEvC,SAAK,QAAQF,yCAAmB;AAChC,SAAK,KAAK;KACR,MAAM;KACN,OAAOA,yCAAmB;KAC1B,QAAQE,0CAAoB;KAC5B,SAAS;KACT,MAAM;MACJ,WAAW,IAAI;MACf,eAAe,IAAI;;;YAGhBU,GAAY;AACnB,QAAI,SAAS;AACb,UAAM,KAAK,YAAY,KAAK,YAAY;IACxC,MAAM,WAAW,aAAa,QAC1B,IACA,IAAI,MAAMN,4BAAa,MAAM;IACjC,MAAM,MAAM,KAAK,UAAU,GAAG;AAC9B,UAAM,KAAK,SAAS,YAAY;AAChC,UAAM;;;EAIV,MAAc,iBAAiB,KAAqD;AAClF,OAAI;IACF,MAAM,YAAYF,+BAAY,IAAI;IAClC,MAAM,eAAesB,0CAAkB,IAAI,cAAc,EAAE,KAAK;AAChE,QAAI,iBAAiB,KACnB,QAAO,KAAK,uBACV,wCAAwC,OAAO,IAAI;IAIvD,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,KAAK,WAAW;AAClE,QAAI,eACF,QAAO;KAAE,SAAS;KAAM,QAAQ;;IAGlC,MAAM,gBAAgB,MAAM,KAAK,iBAAiB,KAAK,WAAW;AAClE,QAAI,cAAc,QAChB,QAAO;KAAE,SAAS;KAAM,QAAQ;;AAGlC,WAAO,KAAK,uBAAuB,cAAc,UAAU;YACpDrB,KAAc;AACrB,WAAO,KAAK,uBAAuBC,4BAAa,QAAQ,OAAO,MAAM"}
+{"version":3,"file":"emailRecovery.js","names":["EmailRecoveryPhase","EmailRecoveryPendingStore","EmailRecoveryStatus","validateNearAccountId","toAccountId","err: unknown","errorMessage","syncAuthenticatorsContractCall","getEmailRecoveryAttempt","ensureEd25519Prefix","err: any","elapsedMs","rec: PendingEmailRecovery","generateEmailRecoveryRequestId","e: unknown","transactionHash: string | undefined","err","txResult: FinalExecutionOutcome","DEFAULT_WAIT_STATUS","parseLinkDeviceRegisterUserResponse","EmailRecoveryErrorCode","EmailRecoveryError","txUnknown: unknown","logs: string[]","IndexedDBManager","payload: StoreUserDataPayload","getLoginSession","createRandomVRFChallenge","parseDeviceNumber","thresholdEd25519KeygenFromRegistrationTx","buildThresholdEd25519Participants2pV1"],"sources":["../../../../src/core/TatchiPasskey/emailRecovery.ts"],"sourcesContent":["import type { PasskeyManagerContext } from './index';\nimport { IndexedDBManager } from '../IndexedDBManager';\nimport { validateNearAccountId } from '../../utils/validation';\nimport { errorMessage } from '../../utils/errors';\nimport { toAccountId, type AccountId } from '../types/accountIds';\nimport {\n  EmailRecoveryPhase,\n  EmailRecoveryStatus,\n  type EmailRecoverySSEEvent,\n} from '../types/sdkSentEvents';\nimport type { TatchiConfigs } from '../types/tatchi';\nimport {\n  createRandomVRFChallenge,\n  type VRFChallenge,\n} from '../types/vrf-worker';\nimport type { FinalExecutionOutcome } from '@near-js/types';\nimport type { StoredAuthenticator, WebAuthnRegistrationCredential } from '../types';\nimport { DEFAULT_WAIT_STATUS } from '../types/rpc';\nimport { parseDeviceNumber } from '../WebAuthnManager/SignerWorkerManager/getDeviceNumber';\nimport { getLoginSession } from './login';\nimport type { SignedTransaction } from '../NearClient';\nimport {\n  EmailRecoveryPendingStore,\n  parseLinkDeviceRegisterUserResponse,\n  type PendingStore,\n} from '../EmailRecovery';\nimport {\n  EmailRecoveryError,\n  EmailRecoveryErrorCode,\n  generateEmailRecoveryRequestId,\n  type EmailRecoveryFlowOptions,\n  type PendingEmailRecovery,\n  type PendingEmailRecoveryStatus,\n  type PollTickResult,\n  type PollUntilResult,\n  type VerificationOutcome,\n  type AutoLoginResult,\n  type StoreUserDataPayload,\n  type AccountViewLike,\n  type CollectedRecoveryCredential,\n  type DerivedRecoveryKeys,\n} from '../types/emailRecovery';\nimport {\n  syncAuthenticatorsContractCall,\n  getEmailRecoveryAttempt,\n  thresholdEd25519KeygenFromRegistrationTx\n} from '../rpcCalls';\nimport { ensureEd25519Prefix } from '../nearCrypto';\nimport { buildThresholdEd25519Participants2pV1 } from '../../threshold/participants';\n\n\nexport class EmailRecoveryFlow {\n  private context: PasskeyManagerContext;\n  private options?: EmailRecoveryFlowOptions;\n  private pendingStore: PendingStore;\n  private pending: PendingEmailRecovery | null = null;\n  private phase: EmailRecoveryPhase = EmailRecoveryPhase.STEP_1_PREPARATION;\n  private pollingTimer: ReturnType<typeof setTimeout> | undefined;\n  private pollIntervalResolver?: () => void;\n  private pollingStartedAt: number | null = null;\n  private cancelled = false;\n  private error?: Error;\n\n  constructor(context: PasskeyManagerContext, options?: EmailRecoveryFlowOptions) {\n    this.context = context;\n    this.options = options;\n    this.pendingStore = options?.pendingStore ?? new EmailRecoveryPendingStore({\n      getPendingTtlMs: () => this.getConfig().pendingTtlMs,\n    });\n  }\n\n  setOptions(options?: EmailRecoveryFlowOptions) {\n    if (!options) return;\n    this.options = { ...(this.options || {}), ...options };\n    if (options.pendingStore) {\n      this.pendingStore = options.pendingStore;\n    }\n  }\n  private emit(event: EmailRecoverySSEEvent) {\n    this.options?.onEvent?.(event);\n  }\n\n  private emitError(step: number, messageOrError: string | Error): Error {\n    const err = typeof messageOrError === 'string' ? new Error(messageOrError) : messageOrError;\n    const message = err.message || (typeof messageOrError === 'string' ? messageOrError : 'Unknown error');\n    this.phase = EmailRecoveryPhase.ERROR;\n    this.error = err;\n    this.emit({\n      step,\n      phase: EmailRecoveryPhase.ERROR,\n      status: EmailRecoveryStatus.ERROR,\n      message,\n      error: message,\n    } as EmailRecoverySSEEvent & { error: string });\n    this.options?.onError?.(err);\n    return err;\n  }\n\n  private async fail(step: number, message: string): Promise<never> {\n    const err = this.emitError(step, message);\n    await this.options?.afterCall?.(false);\n    throw err;\n  }\n\n  private async assertValidAccountIdOrFail(step: number, accountId: string): Promise<AccountId> {\n    const validation = validateNearAccountId(accountId as AccountId);\n    if (!validation.valid) {\n      await this.fail(step, `Invalid NEAR account ID: ${validation.error}`);\n    }\n    return toAccountId(accountId as string);\n  }\n\n  private async resolvePendingOrFail(\n    step: number,\n    args: { accountId: AccountId; nearPublicKey?: string },\n    options?: {\n      allowErrorStatus?: boolean;\n      missingMessage?: string;\n      errorStatusMessage?: string;\n    }\n  ): Promise<PendingEmailRecovery> {\n    const {\n      allowErrorStatus = true,\n      missingMessage = 'No pending email recovery record found for this account',\n      errorStatusMessage = 'Pending email recovery is in an error state; please restart the flow',\n    } = options ?? {};\n\n    let rec = this.pending;\n    if (!rec || rec.accountId !== args.accountId || (args.nearPublicKey && rec.nearPublicKey !== args.nearPublicKey)) {\n      rec = await this.loadPending(args.accountId, args.nearPublicKey);\n      this.pending = rec;\n    }\n\n    if (!rec) {\n      await this.fail(step, missingMessage);\n    }\n\n    const resolved = rec as PendingEmailRecovery;\n    if (!allowErrorStatus && resolved.status === 'error') {\n      await this.fail(step, errorStatusMessage);\n    }\n\n    return resolved;\n  }\n\n  private getConfig() {\n    const relayConfig = this.context.configs.relayer.emailRecovery;\n    return {\n      minBalanceYocto: String(relayConfig.minBalanceYocto),\n      pollingIntervalMs: Number(relayConfig.pollingIntervalMs),\n      maxPollingDurationMs: Number(relayConfig.maxPollingDurationMs),\n      pendingTtlMs: Number(relayConfig.pendingTtlMs),\n      mailtoAddress: String(relayConfig.mailtoAddress),\n    };\n  }\n\n  private toBigInt(value: bigint | number | string | null | undefined): bigint {\n    if (typeof value === 'bigint') return value;\n    if (typeof value === 'number') return BigInt(value);\n    if (typeof value === 'string' && value.length > 0) return BigInt(value);\n    return BigInt(0);\n  }\n\n  private computeAvailableBalance(accountView: AccountViewLike): bigint {\n    const STORAGE_PRICE_PER_BYTE = BigInt('10000000000000000000'); // 1e19 yocto NEAR per byte\n    const amount = this.toBigInt(accountView.amount);\n    const locked = this.toBigInt(accountView.locked);\n    const storageUsage = this.toBigInt(accountView.storage_usage);\n    const storageCost = storageUsage * STORAGE_PRICE_PER_BYTE;\n    const rawAvailable = amount - locked - storageCost;\n    return rawAvailable > 0 ? rawAvailable : BigInt(0);\n  }\n\n  private async assertSufficientBalance(nearAccountId: AccountId): Promise<void> {\n    const { minBalanceYocto } = this.getConfig();\n\n    try {\n      const accountView = await this.context.nearClient.viewAccount(nearAccountId);\n      const available = this.computeAvailableBalance(accountView);\n      if (available < BigInt(minBalanceYocto)) {\n        await this.fail(\n          1,\n          `This account does not have enough NEAR to finalize recovery. Available: ${available.toString()} yocto; required: ${String(minBalanceYocto)}. Please top up and try again.`\n        );\n      }\n    } catch (err: unknown) {\n      await this.fail(1, errorMessage(err) || 'Failed to fetch account balance for recovery');\n    }\n  }\n\n  private async getNextDeviceNumberFromContract(nearAccountId: AccountId): Promise<number> {\n    try {\n      const authenticators = await syncAuthenticatorsContractCall(\n        this.context.nearClient,\n        this.context.configs.contractId,\n        nearAccountId\n      );\n      const numbers = authenticators\n        .map(({ authenticator }) => authenticator.deviceNumber)\n        .filter((n): n is number => typeof n === 'number' && Number.isFinite(n));\n      const max = numbers.length > 0 ? Math.max(...numbers) : 0;\n      return max + 1;\n    } catch {\n      return 1;\n    }\n  }\n\n  private async collectRecoveryCredentialOrFail(\n    nearAccountId: AccountId,\n    deviceNumber: number\n  ): Promise<CollectedRecoveryCredential> {\n    const confirmerText = {\n      title: this.options?.confirmerText?.title ?? 'Register New Recovery Account',\n      body: this.options?.confirmerText?.body ?? 'Create a recovery account and send an encrypted email to recover your account.',\n    };\n    const confirm = await this.context.webAuthnManager.requestRegistrationCredentialConfirmation({\n      nearAccountId,\n      deviceNumber,\n      confirmerText,\n      confirmationConfigOverride: this.options?.confirmationConfig,\n    });\n\n    if (!confirm.confirmed || !confirm.credential) {\n      await this.fail(2, 'User cancelled email recovery TouchID confirmation');\n    }\n\n    return {\n      credential: confirm.credential,\n      vrfChallenge: confirm.vrfChallenge || undefined,\n    };\n  }\n\n  private async deriveRecoveryKeysOrFail(\n    nearAccountId: AccountId,\n    deviceNumber: number,\n    credential: WebAuthnRegistrationCredential\n  ): Promise<DerivedRecoveryKeys> {\n    const vrfDerivationResult = await this.context.webAuthnManager.deriveVrfKeypair({\n      credential,\n      nearAccountId,\n    });\n\n    if (!vrfDerivationResult.success || !vrfDerivationResult.encryptedVrfKeypair) {\n      await this.fail(2, 'Failed to derive VRF keypair from PRF for email recovery');\n    }\n\n    const nearKeyResult = await this.context.webAuthnManager.deriveNearKeypairAndEncryptFromSerialized({\n      nearAccountId,\n      credential,\n      options: { deviceNumber },\n    });\n\n    if (!nearKeyResult.success || !nearKeyResult.publicKey) {\n      await this.fail(2, 'Failed to derive NEAR keypair for email recovery');\n    }\n\n    return {\n      encryptedVrfKeypair: vrfDerivationResult.encryptedVrfKeypair,\n      serverEncryptedVrfKeypair: vrfDerivationResult.serverEncryptedVrfKeypair || null,\n      vrfPublicKey: vrfDerivationResult.vrfPublicKey,\n      nearPublicKey: nearKeyResult.publicKey,\n    };\n  }\n\n  private emitAwaitEmail(rec: PendingEmailRecovery, mailtoUrl: string): void {\n    this.phase = EmailRecoveryPhase.STEP_3_AWAIT_EMAIL;\n    this.emit({\n      step: 3,\n      phase: EmailRecoveryPhase.STEP_3_AWAIT_EMAIL,\n      status: EmailRecoveryStatus.PROGRESS,\n      message: 'New device key created; please send the recovery email from your registered address.',\n      data: {\n        accountId: rec.accountId,\n        nearPublicKey: rec.nearPublicKey,\n        requestId: rec.requestId,\n        mailtoUrl,\n      },\n    } as EmailRecoverySSEEvent & { data: Record<string, unknown> });\n  }\n\n  private emitAutoLoginEvent(\n    status: EmailRecoveryStatus,\n    message: string,\n    data: Record<string, unknown>\n  ): void {\n    this.emit({\n      step: 5,\n      phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,\n      status,\n      message,\n      data,\n    } as EmailRecoverySSEEvent & { data: Record<string, unknown> });\n  }\n\n  private async checkViaEmailRecovererAttempt(\n    rec: PendingEmailRecovery\n  ): Promise<{ completed: boolean; success: boolean; missing?: boolean; errorMessage?: string; } | null> {\n    try {\n      const attempt = await getEmailRecoveryAttempt(\n        this.context.nearClient,\n        rec.accountId,\n        rec.requestId\n      );\n\n      if (!attempt) {\n        return { completed: false, success: false, missing: true };\n      }\n\n      // Optional safety checks: ensure the bound request/key match expectations when available.\n      if (attempt.request_id && attempt.request_id !== rec.requestId) {\n        return {\n          completed: true,\n          success: false,\n          errorMessage: 'Email recovery attempt request_id does not match requested requestId.',\n        };\n      }\n\n      if (attempt.new_public_key && attempt.new_public_key !== rec.nearPublicKey) {\n        const expected = ensureEd25519Prefix(rec.nearPublicKey);\n        const actual = ensureEd25519Prefix(attempt.new_public_key);\n\n        // The relayer/prover often forwards only the base58 part while the SDK\n        // persists `ed25519:<base58>`. Compare normalized forms to avoid false\n        // mismatches from prefix formatting differences.\n        if (actual === expected) {\n          // no-op; treat as matching\n        } else {\n          return {\n            completed: true,\n            success: false,\n            errorMessage:\n              `Email recovery new_public_key mismatch for request ${rec.requestId}. ` +\n              `Expected ${expected}; got ${actual}. ` +\n              'This usually means the recovery email you sent was generated for a different device/attempt.',\n          };\n        }\n      }\n\n      const normalized = attempt.status.toLowerCase();\n\n      if (normalized === 'complete' || normalized === 'completed') {\n        return {\n          completed: true,\n          success: true,\n        };\n      }\n\n      if (normalized.includes('failed')) {\n        return {\n          completed: true,\n          success: false,\n          errorMessage: attempt.error || `Email recovery failed (${attempt.status || 'unknown status'})`,\n        };\n      }\n\n      return {\n        completed: false,\n        success: false,\n      };\n    } catch (err) {\n      // Treat view errors as retryable; keep polling the view method.\n      // eslint-disable-next-line no-console\n      console.warn('[EmailRecoveryFlow] get_recovery_attempt view failed; will retry', err);\n      return null;\n    }\n  }\n\n  private async isRecoveryAccessKeyPresent(rec: PendingEmailRecovery): Promise<boolean | null> {\n    try {\n      await this.context.nearClient.viewAccessKey(rec.accountId, rec.nearPublicKey);\n      return true;\n    } catch (err: any) {\n      const kind = typeof err?.kind === 'string' ? String(err.kind) : '';\n      const short = typeof err?.short === 'string' ? String(err.short) : '';\n      const msg = typeof err?.message === 'string' ? String(err.message) : '';\n\n      if (\n        /AccessKeyDoesNotExist/i.test(kind) ||\n        /AccessKeyDoesNotExist/i.test(short) ||\n        /access key does not exist/i.test(msg) ||\n        /access key .*does not exist/i.test(msg)\n      ) {\n        return false;\n      }\n\n      // Unexpected view error: retryable; treat as unknown to avoid failing the flow.\n      // eslint-disable-next-line no-console\n      console.warn('[EmailRecoveryFlow] view_access_key failed while checking recovery key; will retry', err);\n      return null;\n    }\n  }\n\n  private buildPollingEventData(\n    rec: PendingEmailRecovery,\n    details: { transactionHash?: string; elapsedMs: number; pollCount: number }\n  ): Record<string, unknown> {\n    return {\n      accountId: rec.accountId,\n      requestId: rec.requestId,\n      nearPublicKey: rec.nearPublicKey,\n      transactionHash: details.transactionHash,\n      elapsedMs: details.elapsedMs,\n      pollCount: details.pollCount,\n    };\n  }\n\n  private async sleepForPollInterval(ms: number): Promise<void> {\n    await new Promise<void>(resolve => {\n      this.pollIntervalResolver = resolve;\n      this.pollingTimer = setTimeout(() => {\n        this.pollIntervalResolver = undefined;\n        this.pollingTimer = undefined;\n        resolve();\n      }, ms);\n    }).finally(() => {\n      this.pollIntervalResolver = undefined;\n    });\n  }\n\n  private async pollUntil<T>(args: {\n    intervalMs: number;\n    timeoutMs: number;\n    isCancelled: () => boolean;\n    tick: (ctx: { elapsedMs: number; pollCount: number }) => Promise<PollTickResult<T>>;\n    sleep?: (ms: number) => Promise<void>;\n    now?: () => number;\n  }): Promise<PollUntilResult<T>> {\n    const now = args.now ?? Date.now;\n    const sleep = args.sleep ?? this.sleepForPollInterval.bind(this);\n    const startedAt = now();\n    let pollCount = 0;\n\n    while (!args.isCancelled()) {\n      pollCount += 1;\n      const elapsedMs = now() - startedAt;\n      if (elapsedMs > args.timeoutMs) {\n        return { status: 'timedOut', elapsedMs, pollCount };\n      }\n\n      const result = await args.tick({ elapsedMs, pollCount });\n      if (result.done) {\n        return { status: 'completed', value: result.value, elapsedMs, pollCount };\n      }\n\n      if (args.isCancelled()) {\n        return { status: 'cancelled', elapsedMs, pollCount };\n      }\n\n      await sleep(args.intervalMs);\n    }\n\n    const elapsedMs = now() - startedAt;\n    return { status: 'cancelled', elapsedMs, pollCount };\n  }\n\n  private async loadPending(\n    accountId: AccountId,\n    nearPublicKey?: string\n  ): Promise<PendingEmailRecovery | null> {\n    return this.pendingStore.get(accountId, nearPublicKey);\n  }\n\n  private async savePending(rec: PendingEmailRecovery): Promise<void> {\n    await this.pendingStore.set(rec);\n    this.pending = rec;\n  }\n\n  private async clearPending(accountId: AccountId, nearPublicKey?: string): Promise<void> {\n    await this.pendingStore.clear(accountId, nearPublicKey);\n\n    if (\n      this.pending\n      && this.pending.accountId === accountId\n      && (!nearPublicKey || this.pending.nearPublicKey === nearPublicKey)\n    ) {\n      this.pending = null;\n    }\n  }\n\n  getState() {\n    return {\n      phase: this.phase,\n      pending: this.pending,\n      error: this.error,\n    };\n  }\n\n  async buildMailtoUrl(args: { accountId: string; nearPublicKey?: string }): Promise<string> {\n    const { accountId, nearPublicKey } = args;\n    this.cancelled = false;\n    this.error = undefined;\n\n    const nearAccountId = await this.assertValidAccountIdOrFail(3, accountId);\n    const rec = await this.resolvePendingOrFail(\n      3,\n      { accountId: nearAccountId, nearPublicKey },\n      { allowErrorStatus: false }\n    );\n\n    if (rec.status === 'finalizing' || rec.status === 'complete') {\n      await this.fail(3, 'Recovery email has already been processed on-chain for this request');\n    }\n\n    const mailtoUrl =\n      rec.status === 'awaiting-email'\n        ? await this.buildMailtoUrlAndUpdateStatus(rec)\n        : this.buildMailtoUrlInternal(rec);\n    this.emitAwaitEmail(rec, mailtoUrl);\n    await this.options?.afterCall?.(true, undefined);\n    return mailtoUrl;\n  }\n\n  async start(args: { accountId: string }): Promise<{ mailtoUrl: string; nearPublicKey: string }> {\n    const { accountId } = args;\n    this.cancelled = false;\n    this.error = undefined;\n    this.phase = EmailRecoveryPhase.STEP_1_PREPARATION;\n\n    this.emit({\n      step: 1,\n      phase: EmailRecoveryPhase.STEP_1_PREPARATION,\n      status: EmailRecoveryStatus.PROGRESS,\n      message: 'Preparing email recovery...',\n    });\n\n    const nearAccountId = await this.assertValidAccountIdOrFail(1, accountId);\n    await this.assertSufficientBalance(nearAccountId);\n\n    // Determine deviceNumber from on-chain authenticators\n    const deviceNumber = await this.getNextDeviceNumberFromContract(nearAccountId);\n\n    this.phase = EmailRecoveryPhase.STEP_2_TOUCH_ID_REGISTRATION;\n    this.emit({\n      step: 2,\n      phase: EmailRecoveryPhase.STEP_2_TOUCH_ID_REGISTRATION,\n      status: EmailRecoveryStatus.PROGRESS,\n      message: 'Collecting passkey for email recovery...',\n    });\n\n    try {\n      const confirm = await this.collectRecoveryCredentialOrFail(nearAccountId, deviceNumber);\n      const derivedKeys = await this.deriveRecoveryKeysOrFail(nearAccountId, deviceNumber, confirm.credential);\n\n      const rec: PendingEmailRecovery = {\n        accountId: nearAccountId,\n        deviceNumber,\n        nearPublicKey: derivedKeys.nearPublicKey,\n        requestId: generateEmailRecoveryRequestId(),\n        encryptedVrfKeypair: derivedKeys.encryptedVrfKeypair,\n        serverEncryptedVrfKeypair: derivedKeys.serverEncryptedVrfKeypair,\n        vrfPublicKey: derivedKeys.vrfPublicKey,\n        credential: confirm.credential,\n        vrfChallenge: confirm.vrfChallenge || undefined,\n        createdAt: Date.now(),\n        status: 'awaiting-email',\n      };\n\n      const mailtoUrl = await this.buildMailtoUrlAndUpdateStatus(rec);\n\n      this.emitAwaitEmail(rec, mailtoUrl);\n\n      await this.options?.afterCall?.(true, undefined);\n\n      return { mailtoUrl, nearPublicKey: rec.nearPublicKey };\n    } catch (e: unknown) {\n      const err = this.emitError(2, errorMessage(e) || 'Email recovery TouchID/derivation failed');\n      await this.options?.afterCall?.(false);\n      throw err;\n    }\n  }\n\n  private buildMailtoUrlInternal(rec: PendingEmailRecovery): string {\n    const { mailtoAddress } = this.getConfig();\n    const to = encodeURIComponent(mailtoAddress);\n    const subject = encodeURIComponent(`recover-${rec.requestId} ${rec.accountId} ${rec.nearPublicKey}`);\n    const body = encodeURIComponent(`Recovering account ${rec.accountId} with a new passkey.`);\n    return `mailto:${to}?subject=${subject}&body=${body}`;\n  }\n\n  private async buildMailtoUrlAndUpdateStatus(rec: PendingEmailRecovery): Promise<string> {\n    rec.status = 'awaiting-add-key';\n    await this.savePending(rec);\n    return this.buildMailtoUrlInternal(rec);\n  }\n\n  async startPolling(args: { accountId: string; nearPublicKey?: string }): Promise<void> {\n    const { accountId, nearPublicKey } = args;\n    this.cancelled = false;\n    this.error = undefined;\n\n    const nearAccountId = await this.assertValidAccountIdOrFail(4, accountId);\n    const rec = await this.resolvePendingOrFail(\n      4,\n      { accountId: nearAccountId, nearPublicKey },\n      { allowErrorStatus: false }\n    );\n    if (rec.status === 'complete' || rec.status === 'finalizing') {\n      await this.options?.afterCall?.(true, undefined);\n      return;\n    }\n    if (rec.status === 'awaiting-email') {\n      await this.buildMailtoUrlAndUpdateStatus(rec);\n    }\n\n    await this.pollUntilAddKey(rec);\n    await this.options?.afterCall?.(true, undefined);\n  }\n\n  stopPolling(): void {\n    this.cancelled = true;\n    if (this.pollingTimer) {\n      clearTimeout(this.pollingTimer);\n      this.pollingTimer = undefined;\n    }\n    if (this.pollIntervalResolver) {\n      this.pollIntervalResolver();\n      this.pollIntervalResolver = undefined;\n    }\n  }\n\n  /**\n   * Best-effort cancellation and local state reset so callers can retry.\n   * This does not remove any passkey created in the browser/OS (WebAuthn has no delete API),\n   * but it will stop polling and clear the pending IndexedDB record for the given key.\n   */\n  async cancelAndReset(args?: { accountId?: string; nearPublicKey?: string }): Promise<void> {\n    this.stopPolling();\n\n    const normalizedAccountId = (args?.accountId || this.pending?.accountId || '').toString().trim();\n    const nearPublicKey = (args?.nearPublicKey || this.pending?.nearPublicKey || '').toString().trim();\n\n    if (normalizedAccountId) {\n      try {\n        await this.clearPending(toAccountId(normalizedAccountId), nearPublicKey);\n      } catch {\n        // best-effort\n      }\n    }\n\n    this.pending = null;\n    this.error = undefined;\n    this.phase = EmailRecoveryPhase.STEP_1_PREPARATION;\n  }\n\n  async finalize(args: { accountId: string; nearPublicKey?: string }): Promise<void> {\n    const { accountId, nearPublicKey } = args;\n    this.cancelled = false;\n    this.error = undefined;\n\n    const nearAccountId = await this.assertValidAccountIdOrFail(4, accountId);\n    const rec = await this.resolvePendingOrFail(\n      4,\n      { accountId: nearAccountId, nearPublicKey },\n      { allowErrorStatus: true }\n    );\n\n    this.emit({\n      step: 0,\n      phase: EmailRecoveryPhase.RESUMED_FROM_PENDING,\n      status: EmailRecoveryStatus.PROGRESS,\n      message: 'Resuming email recovery from pending state...',\n      data: {\n        accountId: rec.accountId,\n        nearPublicKey: rec.nearPublicKey,\n        status: rec.status,\n      },\n    } as EmailRecoverySSEEvent & { data: Record<string, unknown> });\n\n    if (rec.status === 'complete') {\n      this.phase = EmailRecoveryPhase.STEP_6_COMPLETE;\n      this.emit({\n        step: 6,\n        phase: EmailRecoveryPhase.STEP_6_COMPLETE,\n        status: EmailRecoveryStatus.SUCCESS,\n        message: 'Email recovery already completed for this key.',\n      });\n      await this.options?.afterCall?.(true, undefined);\n      return;\n    }\n\n    // Ensure verification has completed successfully before finalizing registration.\n    await this.pollUntilAddKey(rec);\n    await this.finalizeRegistration(rec);\n    await this.options?.afterCall?.(true, undefined);\n  }\n\n  private async pollUntilAddKey(rec: PendingEmailRecovery): Promise<void> {\n    const { pollingIntervalMs, maxPollingDurationMs } = this.getConfig();\n    this.phase = EmailRecoveryPhase.STEP_4_POLLING_VERIFICATION_RESULT;\n    this.pollingStartedAt = Date.now();\n    let sawAttempt = false;\n\n    const pollResult = await this.pollUntil<VerificationOutcome>({\n      intervalMs: pollingIntervalMs,\n      timeoutMs: maxPollingDurationMs,\n      isCancelled: () => this.cancelled,\n      tick: async ({ elapsedMs, pollCount }) => {\n        const verification = await this.checkViaEmailRecovererAttempt(rec);\n        if (verification && !verification.missing) {\n          sawAttempt = true;\n        }\n\n        let completed = verification?.completed === true;\n        let success = verification?.success === true;\n        let errorMessage = verification?.errorMessage;\n        let transactionHash: string | undefined;\n\n        if (verification?.missing) {\n          const hasKey = await this.isRecoveryAccessKeyPresent(rec);\n          if (hasKey === true) {\n            completed = true;\n            success = true;\n          } else if (hasKey === false && sawAttempt) {\n            completed = true;\n            success = false;\n            errorMessage =\n              'Email recovery attempt was cleared on-chain before completion. Please resend the recovery email or restart the flow.';\n          } else if (hasKey === null) {\n            // Retry on unexpected view errors while checking access key presence.\n            return { done: false };\n          }\n        }\n\n        this.emit({\n          step: 4,\n          phase: EmailRecoveryPhase.STEP_4_POLLING_VERIFICATION_RESULT,\n          status: EmailRecoveryStatus.PROGRESS,\n          message: completed && success\n            ? `Email recovery completed for request ${rec.requestId}; finalizing registration`\n            : `Waiting for email recovery for request ${rec.requestId}`,\n          data: this.buildPollingEventData(rec, {\n            transactionHash,\n            elapsedMs,\n            pollCount,\n          }),\n        } as EmailRecoverySSEEvent & { data: Record<string, unknown> });\n\n        if (!completed) {\n          return { done: false };\n        }\n\n        if (!success) {\n          return {\n            done: true,\n            value: {\n              outcome: 'failed',\n              errorMessage: errorMessage || 'Email recovery failed',\n            },\n          };\n        }\n\n        return { done: true, value: { outcome: 'verified' } };\n      },\n    });\n\n    if (pollResult.status === 'completed') {\n      if (pollResult.value.outcome === 'failed') {\n        const err = this.emitError(4, pollResult.value.errorMessage);\n        rec.status = 'error';\n        await this.savePending(rec);\n        await this.options?.afterCall?.(false);\n        throw err;\n      }\n\n      rec.status = 'finalizing';\n      await this.savePending(rec);\n      return;\n    }\n\n    if (pollResult.status === 'timedOut') {\n      const err = this.emitError(4, 'Timed out waiting for recovery email to be processed on-chain');\n      rec.status = 'error';\n      await this.savePending(rec);\n      await this.options?.afterCall?.(false);\n      throw err;\n    }\n\n    const err = this.emitError(4, 'Email recovery polling was cancelled');\n    await this.options?.afterCall?.(false);\n    throw err;\n  }\n\n  private initializeNonceManager(\n    rec: PendingEmailRecovery\n  ): {\n    nonceManager: ReturnType<PasskeyManagerContext['webAuthnManager']['getNonceManager']>;\n    accountId: AccountId;\n  } {\n    const nonceManager = this.context.webAuthnManager.getNonceManager();\n    const accountId = toAccountId(rec.accountId);\n    nonceManager.initializeUser(accountId, rec.nearPublicKey);\n    return { nonceManager, accountId };\n  }\n\n  /*\n   * Signs a `link_device_register_user` contract call\n   */\n  private async signNewDevice2RegistrationTx(rec: PendingEmailRecovery, accountId: AccountId): Promise<SignedTransaction> {\n    const vrfChallenge = rec.vrfChallenge;\n    if (!vrfChallenge) {\n      return this.fail(5, 'Missing VRF challenge for email recovery registration');\n    }\n\n    const registrationResult = await this.context.webAuthnManager.signDevice2RegistrationWithStoredKey({\n      nearAccountId: accountId,\n      credential: rec.credential,\n      vrfChallenge,\n      deterministicVrfPublicKey: rec.vrfPublicKey,\n      deviceNumber: rec.deviceNumber,\n    });\n\n    if (!registrationResult.success || !registrationResult.signedTransaction) {\n      await this.fail(5, registrationResult.error || 'Failed to sign email recovery registration transaction');\n    }\n\n    return registrationResult.signedTransaction;\n  }\n\n  private async broadcastRegistrationTxAndWaitFinal(\n    rec: PendingEmailRecovery,\n    signedTx: SignedTransaction\n  ): Promise<string | undefined> {\n    let txResult: FinalExecutionOutcome;\n    try {\n      txResult = await this.context.nearClient.sendTransaction(\n        signedTx,\n        DEFAULT_WAIT_STATUS.linkDeviceRegistration\n      );\n    } catch (err: unknown) {\n      const msg = errorMessage(err) || 'Failed to broadcast email recovery registration transaction (insufficient funds or RPC error)';\n      throw new Error(msg);\n    }\n\n    const txHash = this.getTxHash(txResult);\n\n    // Contract can return `{ verified: false, registration_info: null }` without failing the tx.\n    // When that happens, the authenticator was NOT registered on-chain, so we must not proceed\n    // with local persistence + auto-login.\n    const linkDeviceResult = parseLinkDeviceRegisterUserResponse(txResult);\n    if (linkDeviceResult?.verified === false) {\n      const logs = this.extractNearExecutionLogs(txResult);\n      const isStaleChallenge = logs.some((log) => /StaleChallenge|freshness validation failed/i.test(log));\n      const txHint = txHash ? ` (tx: ${txHash})` : '';\n      const code = isStaleChallenge\n        ? EmailRecoveryErrorCode.VRF_CHALLENGE_EXPIRED\n        : EmailRecoveryErrorCode.REGISTRATION_NOT_VERIFIED;\n      const message = isStaleChallenge\n        ? `Timed out finalizing registration (VRF challenge expired). Please restart email recovery and try again${txHint}.`\n        : `Registration did not verify on-chain. Please try again${txHint}.`;\n      throw new EmailRecoveryError(message, code, {\n        accountId: rec.accountId,\n        nearPublicKey: rec.nearPublicKey,\n        transactionHash: txHash,\n        logs,\n        result: linkDeviceResult,\n      });\n    }\n\n    if (txHash) {\n      this.emit({\n        step: 5,\n        phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,\n        status: EmailRecoveryStatus.PROGRESS,\n        message: 'Registration transaction confirmed',\n        data: {\n          accountId: rec.accountId,\n          nearPublicKey: rec.nearPublicKey,\n          transactionHash: txHash,\n        },\n      } as EmailRecoverySSEEvent & { data: Record<string, unknown> });\n    }\n\n    return txHash;\n  }\n\n  private getTxHash(outcome: FinalExecutionOutcome): string | undefined {\n    const txUnknown: unknown = outcome.transaction;\n    if (txUnknown && typeof txUnknown === 'object') {\n      const hash = (txUnknown as Record<string, unknown>).hash;\n      if (typeof hash === 'string' && hash.length > 0) return hash;\n    }\n\n    const txOutcomeId = (outcome as unknown as { transaction_outcome?: unknown })?.transaction_outcome;\n    if (txOutcomeId && typeof txOutcomeId === 'object') {\n      const id = (txOutcomeId as Record<string, unknown>).id;\n      if (typeof id === 'string' && id.length > 0) return id;\n    }\n\n    const fallback = (outcome as unknown as Record<string, unknown>).transaction_hash;\n    return typeof fallback === 'string' && fallback.length > 0 ? fallback : undefined;\n  }\n\n  private extractNearExecutionLogs(outcome: FinalExecutionOutcome): string[] {\n    const logs: string[] = [];\n    for (const entry of outcome.transaction_outcome.outcome.logs) {\n      logs.push(String(entry));\n    }\n    for (const receipt of outcome.receipts_outcome) {\n      for (const entry of receipt.outcome.logs) {\n        logs.push(String(entry));\n      }\n    }\n    return logs;\n  }\n\n  private mapAuthenticatorsFromContract(\n    authenticators: Array<{ credentialId: string; authenticator: StoredAuthenticator }>\n  ) {\n    return authenticators.map(({ authenticator }) => ({\n      credentialId: authenticator.credentialId,\n      credentialPublicKey: authenticator.credentialPublicKey,\n      transports: authenticator.transports,\n      name: authenticator.name,\n      registered: authenticator.registered.toISOString(),\n      vrfPublicKey: authenticator.vrfPublicKeys?.[0] || '',\n      deviceNumber: authenticator.deviceNumber,\n    }));\n  }\n\n  private async syncAuthenticatorsBestEffort(accountId: AccountId): Promise<boolean> {\n    try {\n      const authenticators = await syncAuthenticatorsContractCall(\n        this.context.nearClient,\n        this.context.configs.contractId,\n        accountId\n      );\n\n      const mappedAuthenticators = this.mapAuthenticatorsFromContract(authenticators);\n      await IndexedDBManager.clientDB.syncAuthenticatorsFromContract(accountId, mappedAuthenticators);\n      return true;\n    } catch (err) {\n      console.warn('[EmailRecoveryFlow] Failed to sync authenticators after recovery:', err);\n      return false;\n    }\n  }\n\n  private async setLastUserBestEffort(accountId: AccountId, deviceNumber: number): Promise<boolean> {\n    try {\n      await IndexedDBManager.clientDB.setLastUser(accountId, deviceNumber);\n      return true;\n    } catch (err) {\n      console.warn('[EmailRecoveryFlow] Failed to set last user after recovery:', err);\n      return false;\n    }\n  }\n\n  private async updateNonceBestEffort(\n    nonceManager: ReturnType<PasskeyManagerContext['webAuthnManager']['getNonceManager']>,\n    signedTx: SignedTransaction\n  ): Promise<void> {\n    try {\n      const txNonce = signedTx.transaction.nonce;\n      if (txNonce != null) {\n        await nonceManager.updateNonceFromBlockchain(\n          this.context.nearClient,\n          String(txNonce)\n        );\n      }\n    } catch {\n      // best-effort; do not fail flow\n    }\n  }\n\n  private async persistRecoveredUserData(rec: PendingEmailRecovery, accountId: AccountId): Promise<void> {\n    const { webAuthnManager } = this.context;\n\n    const payload: StoreUserDataPayload = {\n      nearAccountId: accountId,\n      deviceNumber: rec.deviceNumber,\n      clientNearPublicKey: rec.nearPublicKey,\n      lastUpdated: Date.now(),\n      passkeyCredential: {\n        id: rec.credential.id,\n        rawId: rec.credential.rawId,\n      },\n      encryptedVrfKeypair: {\n        encryptedVrfDataB64u: rec.encryptedVrfKeypair.encryptedVrfDataB64u,\n        chacha20NonceB64u: rec.encryptedVrfKeypair.chacha20NonceB64u,\n      },\n      serverEncryptedVrfKeypair: rec.serverEncryptedVrfKeypair || undefined,\n    };\n\n    await webAuthnManager.storeUserData(payload);\n  }\n\n  /**\n   * Explicitly persist the authenticator from the recovery record into the local cache.\n   * This ensures the key is available immediately, bridging the gap before RPC sync sees it.\n   */\n  private async persistAuthenticatorBestEffort(rec: PendingEmailRecovery, accountId: AccountId): Promise<void> {\n    try {\n      const { webAuthnManager } = this.context;\n      const attestationB64u = rec.credential.response.attestationObject;\n      const credentialPublicKey = await webAuthnManager.extractCosePublicKey(attestationB64u);\n\n      await webAuthnManager.storeAuthenticator({\n        nearAccountId: accountId,\n        deviceNumber: rec.deviceNumber,\n        credentialId: rec.credential.rawId,\n        credentialPublicKey,\n        transports: ['internal'],\n        name: `Device ${rec.deviceNumber} Passkey for ${rec.accountId.split('.')[0]}`,\n        registered: new Date().toISOString(),\n        syncedAt: new Date().toISOString(), // Local truth is fresh\n        vrfPublicKey: rec.vrfPublicKey,\n      });\n      console.log('[EmailRecoveryFlow] Locally persisted recovered authenticator for immediate use.');\n    } catch (e) {\n      console.error('[EmailRecoveryFlow] Failed to locally persist authenticator (critical for immediate export):', e);\n      // We log error but don't rethrow to avoid crashing the final success UI.\n    }\n  }\n\n  private async markCompleteAndClearPending(rec: PendingEmailRecovery): Promise<void> {\n    rec.status = 'complete';\n    await this.savePending(rec);\n    await this.clearPending(rec.accountId, rec.nearPublicKey);\n  }\n\n  private async assertVrfActiveForAccount(accountId: AccountId, message: string): Promise<void> {\n    const vrfStatus = await this.context.webAuthnManager.checkVrfStatus();\n    const vrfActiveForAccount =\n      vrfStatus.active\n      && vrfStatus.nearAccountId\n      && String(vrfStatus.nearAccountId) === String(accountId);\n    if (!vrfActiveForAccount) {\n      throw new Error(message);\n    }\n  }\n\n  private async finalizeLocalLoginState(accountId: AccountId, deviceNumber: number): Promise<void> {\n    const { webAuthnManager } = this.context;\n    await webAuthnManager.setLastUser(accountId, deviceNumber);\n    await webAuthnManager.initializeCurrentUser(accountId, this.context.nearClient);\n    try { await getLoginSession(this.context, accountId); } catch { }\n  }\n\n  private async tryShamirUnlock(\n    rec: PendingEmailRecovery,\n    accountId: AccountId,\n    deviceNumber: number\n  ): Promise<boolean> {\n    if (\n      !rec.serverEncryptedVrfKeypair\n      || !rec.serverEncryptedVrfKeypair.serverKeyId\n      || !this.context.configs.vrfWorkerConfigs?.shamir3pass?.relayServerUrl\n    ) {\n      return false;\n    }\n\n    try {\n      const { webAuthnManager } = this.context;\n      const unlockResult = await webAuthnManager.shamir3PassDecryptVrfKeypair({\n        nearAccountId: accountId,\n        kek_s_b64u: rec.serverEncryptedVrfKeypair.kek_s_b64u,\n        ciphertextVrfB64u: rec.serverEncryptedVrfKeypair.ciphertextVrfB64u,\n        serverKeyId: rec.serverEncryptedVrfKeypair.serverKeyId,\n      });\n\n      if (!unlockResult.success) {\n        return false;\n      }\n\n      await this.assertVrfActiveForAccount(accountId, 'VRF session inactive after Shamir3Pass unlock');\n      await this.finalizeLocalLoginState(accountId, deviceNumber);\n      return true;\n    } catch (err) {\n      console.warn('[EmailRecoveryFlow] Shamir 3-pass unlock failed, falling back to TouchID', err);\n      return false;\n    }\n  }\n\n  private async tryTouchIdUnlock(\n    rec: PendingEmailRecovery,\n    accountId: AccountId,\n    deviceNumber: number\n  ): Promise<{ success: boolean; reason?: string }> {\n    try {\n      const { webAuthnManager } = this.context;\n      const authChallenge = createRandomVRFChallenge() as VRFChallenge;\n\n      const storedCredentialId = String(rec.credential?.rawId || rec.credential?.id || '').trim();\n      const credentialIds = storedCredentialId ? [storedCredentialId] : [];\n      const authenticators = credentialIds.length > 0\n        ? []\n        : await webAuthnManager.getAuthenticatorsByUser(accountId);\n      const authCredential = await webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({\n        nearAccountId: accountId,\n        challenge: authChallenge,\n        credentialIds: credentialIds.length > 0 ? credentialIds : authenticators.map((a) => a.credentialId),\n      });\n\n      if (storedCredentialId && authCredential.rawId !== storedCredentialId) {\n        return {\n          success: false,\n          reason: 'Wrong passkey selected during recovery auto-login; please use the newly recovered passkey.',\n        };\n      }\n\n      const vrfUnlockResult = await webAuthnManager.unlockVRFKeypair({\n        nearAccountId: accountId,\n        encryptedVrfKeypair: rec.encryptedVrfKeypair,\n        credential: authCredential,\n      });\n\n      if (!vrfUnlockResult.success) {\n        return { success: false, reason: vrfUnlockResult.error || 'VRF unlock failed during auto-login' };\n      }\n\n      await this.assertVrfActiveForAccount(accountId, 'VRF session inactive after TouchID unlock');\n      await this.finalizeLocalLoginState(accountId, deviceNumber);\n      return { success: true };\n    } catch (err: unknown) {\n      return { success: false, reason: errorMessage(err) || String(err) };\n    }\n  }\n\n  private async handleAutoLoginFailure(reason: string, err?: unknown): Promise<AutoLoginResult> {\n    console.warn('[EmailRecoveryFlow] Auto-login failed after recovery', err ?? reason);\n    try {\n      await this.context.webAuthnManager.clearVrfSession();\n    } catch { }\n    return { success: false, reason };\n  }\n\n  private async finalizeRegistration(rec: PendingEmailRecovery): Promise<void> {\n    this.phase = EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION;\n    this.emit({\n      step: 5,\n      phase: EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,\n      status: EmailRecoveryStatus.PROGRESS,\n      message: 'Finalizing email recovery registration...',\n      data: {\n        accountId: rec.accountId,\n        nearPublicKey: rec.nearPublicKey,\n      },\n    } as EmailRecoverySSEEvent & { data: Record<string, unknown> });\n\n    try {\n      const { nonceManager, accountId } = this.initializeNonceManager(rec);\n      const signedTx = await this.signNewDevice2RegistrationTx(rec, accountId);\n      const txHash = await this.broadcastRegistrationTxAndWaitFinal(rec, signedTx);\n      if (!txHash) {\n        console.warn('[EmailRecoveryFlow] Registration transaction confirmed without hash; continuing local persistence');\n      }\n\n      // CRITICAL: Persist local state immediately.\n      // 1. Store the new user record (Device N) so that `getLastUser()` finds it.\n      await this.persistRecoveredUserData(rec, accountId);\n\n      // 2. Sync authenticators (RPC might be stale, but we try).\n      await this.syncAuthenticatorsBestEffort(accountId);\n\n      // 3. FORCE-SAVE the local authenticator from our recovery record.\n      // This is crucial because RPC sync might be slow/empty immediately after TX.\n      // We must ensure the new key is in the DB so `ensureCurrentPasskey` finds it.\n      // We do this AFTER sync to ensure it's not wiped by a stale sync.\n      await this.persistAuthenticatorBestEffort(rec, accountId);\n\n      // 4. Set as active user to ensure immediate subsequent calls use this identity.\n      await this.setLastUserBestEffort(accountId, rec.deviceNumber);\n\n      await this.updateNonceBestEffort(nonceManager, signedTx);\n\n      // Activate threshold enrollment for this device by ensuring threshold key\n      // material is available locally (and AddKey if needed).\n      if (txHash) {\n        await this.activateThresholdEnrollment(accountId, rec, txHash);\n      }\n\n      this.emitAutoLoginEvent(EmailRecoveryStatus.PROGRESS, 'Attempting auto-login with recovered device...', {\n        autoLogin: 'progress',\n      });\n\n      const autoLoginResult = await this.attemptAutoLogin(rec);\n      if (autoLoginResult.success) {\n        this.emitAutoLoginEvent(EmailRecoveryStatus.SUCCESS, `Welcome ${accountId}`, {\n          autoLogin: 'success',\n        });\n      } else {\n        this.emitAutoLoginEvent(EmailRecoveryStatus.ERROR, 'Auto-login failed; please log in manually on this device.', {\n          error: autoLoginResult.reason,\n          autoLogin: 'error',\n        });\n      }\n\n      await this.markCompleteAndClearPending(rec);\n\n      this.phase = EmailRecoveryPhase.STEP_6_COMPLETE;\n      this.emit({\n        step: 6,\n        phase: EmailRecoveryPhase.STEP_6_COMPLETE,\n        status: EmailRecoveryStatus.SUCCESS,\n        message: 'Email recovery completed successfully',\n        data: {\n          accountId: rec.accountId,\n          nearPublicKey: rec.nearPublicKey,\n        },\n      } as EmailRecoverySSEEvent & { data: Record<string, unknown> });\n    } catch (e: unknown) {\n      rec.status = 'error';\n      await this.savePending(rec).catch(() => { });\n      const original = e instanceof Error\n        ? e\n        : new Error(errorMessage(e) || 'Email recovery finalization failed');\n      const err = this.emitError(5, original);\n      await this.options?.afterCall?.(false);\n      throw err;\n    }\n  }\n\n  private async activateThresholdEnrollment(\n    accountId: AccountId,\n    rec: PendingEmailRecovery,\n    registrationTxHash: string,\n  ): Promise<void> {\n    const deviceNumber = parseDeviceNumber(rec.deviceNumber, { min: 1 });\n    if (deviceNumber === null) {\n      throw new Error(`Invalid deviceNumber for threshold enrollment: ${String(rec.deviceNumber)}`);\n    }\n\n    // Ensure WebAuthn allowCredentials selection prefers this device's passkey\n    // when multiple authenticators exist for the account.\n    try {\n      await this.context.webAuthnManager.setLastUser(accountId, deviceNumber);\n    } catch {}\n\n    const existing = await IndexedDBManager.nearKeysDB.getThresholdKeyMaterial(accountId, deviceNumber);\n    if (existing) {\n      return;\n    }\n\n    const relayerUrl = this.context.configs.relayer.url;\n    if (!relayerUrl) {\n      throw new Error('Missing configs.relayer.url (required for threshold enrollment)');\n    }\n\n    const localKeyMaterial = await IndexedDBManager.nearKeysDB.getLocalKeyMaterial(accountId, deviceNumber);\n    if (!localKeyMaterial) {\n      throw new Error(`Missing local key material for ${String(accountId)} device ${deviceNumber}`);\n    }\n\n    const derived = await this.context.webAuthnManager.deriveThresholdEd25519ClientVerifyingShareFromCredential({\n      credential: rec.credential,\n      nearAccountId: accountId,\n      wrapKeySalt: localKeyMaterial.wrapKeySalt,\n    });\n    if (!derived.success) {\n      throw new Error(derived.error || 'Failed to derive threshold client verifying share');\n    }\n\n    const keygen = await thresholdEd25519KeygenFromRegistrationTx(relayerUrl, {\n      nearAccountId: accountId,\n      clientVerifyingShareB64u: derived.clientVerifyingShareB64u,\n      registrationTxHash,\n    });\n    if (!keygen.ok) {\n      throw new Error(keygen.error || keygen.message || keygen.code || 'Threshold registration keygen failed');\n    }\n\n    const thresholdPublicKey = ensureEd25519Prefix(keygen.publicKey || '');\n    if (!thresholdPublicKey) throw new Error('Threshold registration keygen returned empty publicKey');\n    const relayerKeyId = String(keygen.relayerKeyId || '').trim();\n    if (!relayerKeyId) throw new Error('Threshold registration keygen returned empty relayerKeyId');\n    const relayerVerifyingShareB64u = String(keygen.relayerVerifyingShareB64u || '').trim();\n    if (!relayerVerifyingShareB64u) throw new Error('Threshold registration keygen returned empty relayerVerifyingShareB64u');\n\n    // Activate threshold enrollment on-chain by submitting AddKey(thresholdPublicKey) signed with the local key.\n    try {\n      this.context.webAuthnManager.getNonceManager().initializeUser(accountId, localKeyMaterial.publicKey);\n    } catch {}\n    const txContext = await this.context.webAuthnManager.getNonceManager().getNonceBlockHashAndHeight(\n      this.context.nearClient,\n      { force: true },\n    );\n    const signed = await this.context.webAuthnManager.signAddKeyThresholdPublicKeyNoPrompt({\n      nearAccountId: accountId,\n      credential: rec.credential,\n      wrapKeySalt: localKeyMaterial.wrapKeySalt,\n      transactionContext: txContext,\n      thresholdPublicKey,\n      relayerVerifyingShareB64u,\n      clientParticipantId: keygen.clientParticipantId,\n      relayerParticipantId: keygen.relayerParticipantId,\n      deviceNumber,\n    });\n    const signedTx = signed?.signedTransaction;\n    if (!signedTx) throw new Error('Failed to sign AddKey(thresholdPublicKey) transaction');\n\n    await this.context.nearClient.sendTransaction(\n      signedTx,\n      DEFAULT_WAIT_STATUS.thresholdAddKey,\n    );\n\n    await IndexedDBManager.nearKeysDB.storeKeyMaterial({\n      kind: 'threshold_ed25519_2p_v1',\n      nearAccountId: String(accountId),\n      deviceNumber,\n      publicKey: thresholdPublicKey,\n      wrapKeySalt: derived.wrapKeySalt,\n      relayerKeyId,\n      clientShareDerivation: 'prf_first_v1',\n      participants: buildThresholdEd25519Participants2pV1({\n        clientParticipantId: keygen.clientParticipantId,\n        relayerParticipantId: keygen.relayerParticipantId,\n        relayerKeyId,\n        relayerUrl,\n        clientVerifyingShareB64u: derived.clientVerifyingShareB64u,\n        relayerVerifyingShareB64u,\n        clientShareDerivation: 'prf_first_v1',\n      }),\n      timestamp: Date.now(),\n    });\n  }\n\n  private async attemptAutoLogin(rec: PendingEmailRecovery): Promise<AutoLoginResult> {\n    try {\n      const accountId = toAccountId(rec.accountId);\n      const deviceNumber = parseDeviceNumber(rec.deviceNumber, { min: 1 });\n      if (deviceNumber === null) {\n        return this.handleAutoLoginFailure(\n          `Invalid deviceNumber for auto-login: ${String(rec.deviceNumber)}`\n        );\n      }\n\n      const shamirUnlocked = await this.tryShamirUnlock(rec, accountId, deviceNumber);\n      if (shamirUnlocked) {\n        return { success: true, method: 'shamir' };\n      }\n\n      const touchIdResult = await this.tryTouchIdUnlock(rec, accountId, deviceNumber);\n      if (touchIdResult.success) {\n        return { success: true, method: 'touchid' };\n      }\n\n      return this.handleAutoLoginFailure(touchIdResult.reason || 'Auto-login failed');\n    } catch (err: unknown) {\n      return this.handleAutoLoginFailure(errorMessage(err) || String(err), err);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAmDA,IAAa,oBAAb,MAA+B;CAC7B,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ,UAAuC;CAC/C,AAAQ,QAA4BA,yCAAmB;CACvD,AAAQ;CACR,AAAQ;CACR,AAAQ,mBAAkC;CAC1C,AAAQ,YAAY;CACpB,AAAQ;CAER,YAAY,SAAgC,SAAoC;AAC9E,OAAK,UAAU;AACf,OAAK,UAAU;AACf,OAAK,eAAe,SAAS,gBAAgB,IAAIC,4DAA0B,EACzE,uBAAuB,KAAK,YAAY;;CAI5C,WAAW,SAAoC;AAC7C,MAAI,CAAC,QAAS;AACd,OAAK,UAAU;GAAE,GAAI,KAAK,WAAW;GAAK,GAAG;;AAC7C,MAAI,QAAQ,aACV,MAAK,eAAe,QAAQ;;CAGhC,AAAQ,KAAK,OAA8B;AACzC,OAAK,SAAS,UAAU;;CAG1B,AAAQ,UAAU,MAAc,gBAAuC;EACrE,MAAM,MAAM,OAAO,mBAAmB,WAAW,IAAI,MAAM,kBAAkB;EAC7E,MAAM,UAAU,IAAI,YAAY,OAAO,mBAAmB,WAAW,iBAAiB;AACtF,OAAK,QAAQD,yCAAmB;AAChC,OAAK,QAAQ;AACb,OAAK,KAAK;GACR;GACA,OAAOA,yCAAmB;GAC1B,QAAQE,0CAAoB;GAC5B;GACA,OAAO;;AAET,OAAK,SAAS,UAAU;AACxB,SAAO;;CAGT,MAAc,KAAK,MAAc,SAAiC;EAChE,MAAM,MAAM,KAAK,UAAU,MAAM;AACjC,QAAM,KAAK,SAAS,YAAY;AAChC,QAAM;;CAGR,MAAc,2BAA2B,MAAc,WAAuC;EAC5F,MAAM,aAAaC,yCAAsB;AACzC,MAAI,CAAC,WAAW,MACd,OAAM,KAAK,KAAK,MAAM,4BAA4B,WAAW;AAE/D,SAAOC,+BAAY;;CAGrB,MAAc,qBACZ,MACA,MACA,SAK+B;EAC/B,MAAM,EACJ,mBAAmB,MACnB,iBAAiB,2DACjB,qBAAqB,2EACnB,WAAW;EAEf,IAAI,MAAM,KAAK;AACf,MAAI,CAAC,OAAO,IAAI,cAAc,KAAK,aAAc,KAAK,iBAAiB,IAAI,kBAAkB,KAAK,eAAgB;AAChH,SAAM,MAAM,KAAK,YAAY,KAAK,WAAW,KAAK;AAClD,QAAK,UAAU;;AAGjB,MAAI,CAAC,IACH,OAAM,KAAK,KAAK,MAAM;EAGxB,MAAM,WAAW;AACjB,MAAI,CAAC,oBAAoB,SAAS,WAAW,QAC3C,OAAM,KAAK,KAAK,MAAM;AAGxB,SAAO;;CAGT,AAAQ,YAAY;EAClB,MAAM,cAAc,KAAK,QAAQ,QAAQ,QAAQ;AACjD,SAAO;GACL,iBAAiB,OAAO,YAAY;GACpC,mBAAmB,OAAO,YAAY;GACtC,sBAAsB,OAAO,YAAY;GACzC,cAAc,OAAO,YAAY;GACjC,eAAe,OAAO,YAAY;;;CAItC,AAAQ,SAAS,OAA4D;AAC3E,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO;AAC7C,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO,OAAO;AACjE,SAAO,OAAO;;CAGhB,AAAQ,wBAAwB,aAAsC;EACpE,MAAM,yBAAyB,OAAO;EACtC,MAAM,SAAS,KAAK,SAAS,YAAY;EACzC,MAAM,SAAS,KAAK,SAAS,YAAY;EACzC,MAAM,eAAe,KAAK,SAAS,YAAY;EAC/C,MAAM,cAAc,eAAe;EACnC,MAAM,eAAe,SAAS,SAAS;AACvC,SAAO,eAAe,IAAI,eAAe,OAAO;;CAGlD,MAAc,wBAAwB,eAAyC;EAC7E,MAAM,EAAE,oBAAoB,KAAK;AAEjC,MAAI;GACF,MAAM,cAAc,MAAM,KAAK,QAAQ,WAAW,YAAY;GAC9D,MAAM,YAAY,KAAK,wBAAwB;AAC/C,OAAI,YAAY,OAAO,iBACrB,OAAM,KAAK,KACT,GACA,2EAA2E,UAAU,WAAW,oBAAoB,OAAO,iBAAiB;WAGzIC,KAAc;AACrB,SAAM,KAAK,KAAK,GAAGC,4BAAa,QAAQ;;;CAI5C,MAAc,gCAAgC,eAA2C;AACvF,MAAI;GACF,MAAM,iBAAiB,MAAMC,gDAC3B,KAAK,QAAQ,YACb,KAAK,QAAQ,QAAQ,YACrB;GAEF,MAAM,UAAU,eACb,KAAK,EAAE,oBAAoB,cAAc,cACzC,QAAQ,MAAmB,OAAO,MAAM,YAAY,OAAO,SAAS;GACvE,MAAM,MAAM,QAAQ,SAAS,IAAI,KAAK,IAAI,GAAG,WAAW;AACxD,UAAO,MAAM;UACP;AACN,UAAO;;;CAIX,MAAc,gCACZ,eACA,cACsC;EACtC,MAAM,gBAAgB;GACpB,OAAO,KAAK,SAAS,eAAe,SAAS;GAC7C,MAAM,KAAK,SAAS,eAAe,QAAQ;;EAE7C,MAAM,UAAU,MAAM,KAAK,QAAQ,gBAAgB,0CAA0C;GAC3F;GACA;GACA;GACA,4BAA4B,KAAK,SAAS;;AAG5C,MAAI,CAAC,QAAQ,aAAa,CAAC,QAAQ,WACjC,OAAM,KAAK,KAAK,GAAG;AAGrB,SAAO;GACL,YAAY,QAAQ;GACpB,cAAc,QAAQ,gBAAgB;;;CAI1C,MAAc,yBACZ,eACA,cACA,YAC8B;EAC9B,MAAM,sBAAsB,MAAM,KAAK,QAAQ,gBAAgB,iBAAiB;GAC9E;GACA;;AAGF,MAAI,CAAC,oBAAoB,WAAW,CAAC,oBAAoB,oBACvD,OAAM,KAAK,KAAK,GAAG;EAGrB,MAAM,gBAAgB,MAAM,KAAK,QAAQ,gBAAgB,0CAA0C;GACjG;GACA;GACA,SAAS,EAAE;;AAGb,MAAI,CAAC,cAAc,WAAW,CAAC,cAAc,UAC3C,OAAM,KAAK,KAAK,GAAG;AAGrB,SAAO;GACL,qBAAqB,oBAAoB;GACzC,2BAA2B,oBAAoB,6BAA6B;GAC5E,cAAc,oBAAoB;GAClC,eAAe,cAAc;;;CAIjC,AAAQ,eAAe,KAA2B,WAAyB;AACzE,OAAK,QAAQP,yCAAmB;AAChC,OAAK,KAAK;GACR,MAAM;GACN,OAAOA,yCAAmB;GAC1B,QAAQE,0CAAoB;GAC5B,SAAS;GACT,MAAM;IACJ,WAAW,IAAI;IACf,eAAe,IAAI;IACnB,WAAW,IAAI;IACf;;;;CAKN,AAAQ,mBACN,QACA,SACA,MACM;AACN,OAAK,KAAK;GACR,MAAM;GACN,OAAOF,yCAAmB;GAC1B;GACA;GACA;;;CAIJ,MAAc,8BACZ,KACqG;AACrG,MAAI;GACF,MAAM,UAAU,MAAMQ,yCACpB,KAAK,QAAQ,YACb,IAAI,WACJ,IAAI;AAGN,OAAI,CAAC,QACH,QAAO;IAAE,WAAW;IAAO,SAAS;IAAO,SAAS;;AAItD,OAAI,QAAQ,cAAc,QAAQ,eAAe,IAAI,UACnD,QAAO;IACL,WAAW;IACX,SAAS;IACT,cAAc;;AAIlB,OAAI,QAAQ,kBAAkB,QAAQ,mBAAmB,IAAI,eAAe;IAC1E,MAAM,WAAWC,uCAAoB,IAAI;IACzC,MAAM,SAASA,uCAAoB,QAAQ;AAK3C,QAAI,WAAW,UAAU,OAGvB,QAAO;KACL,WAAW;KACX,SAAS;KACT,cACE,sDAAsD,IAAI,UAAU,aACxD,SAAS,QAAQ,OAAO;;;GAM5C,MAAM,aAAa,QAAQ,OAAO;AAElC,OAAI,eAAe,cAAc,eAAe,YAC9C,QAAO;IACL,WAAW;IACX,SAAS;;AAIb,OAAI,WAAW,SAAS,UACtB,QAAO;IACL,WAAW;IACX,SAAS;IACT,cAAc,QAAQ,SAAS,0BAA0B,QAAQ,UAAU,iBAAiB;;AAIhG,UAAO;IACL,WAAW;IACX,SAAS;;WAEJ,KAAK;AAGZ,WAAQ,KAAK,oEAAoE;AACjF,UAAO;;;CAIX,MAAc,2BAA2B,KAAoD;AAC3F,MAAI;AACF,SAAM,KAAK,QAAQ,WAAW,cAAc,IAAI,WAAW,IAAI;AAC/D,UAAO;WACAC,KAAU;GACjB,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,OAAO,IAAI,QAAQ;GAChE,MAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,OAAO,IAAI,SAAS;GACnE,MAAM,MAAM,OAAO,KAAK,YAAY,WAAW,OAAO,IAAI,WAAW;AAErE,OACE,yBAAyB,KAAK,SAC9B,yBAAyB,KAAK,UAC9B,6BAA6B,KAAK,QAClC,+BAA+B,KAAK,KAEpC,QAAO;AAKT,WAAQ,KAAK,sFAAsF;AACnG,UAAO;;;CAIX,AAAQ,sBACN,KACA,SACyB;AACzB,SAAO;GACL,WAAW,IAAI;GACf,WAAW,IAAI;GACf,eAAe,IAAI;GACnB,iBAAiB,QAAQ;GACzB,WAAW,QAAQ;GACnB,WAAW,QAAQ;;;CAIvB,MAAc,qBAAqB,IAA2B;AAC5D,QAAM,IAAI,SAAc,YAAW;AACjC,QAAK,uBAAuB;AAC5B,QAAK,eAAe,iBAAiB;AACnC,SAAK,uBAAuB;AAC5B,SAAK,eAAe;AACpB;MACC;KACF,cAAc;AACf,QAAK,uBAAuB;;;CAIhC,MAAc,UAAa,MAOK;EAC9B,MAAM,MAAM,KAAK,OAAO,KAAK;EAC7B,MAAM,QAAQ,KAAK,SAAS,KAAK,qBAAqB,KAAK;EAC3D,MAAM,YAAY;EAClB,IAAI,YAAY;AAEhB,SAAO,CAAC,KAAK,eAAe;AAC1B,gBAAa;GACb,MAAMC,cAAY,QAAQ;AAC1B,OAAIA,cAAY,KAAK,UACnB,QAAO;IAAE,QAAQ;IAAY;IAAW;;GAG1C,MAAM,SAAS,MAAM,KAAK,KAAK;IAAE;IAAW;;AAC5C,OAAI,OAAO,KACT,QAAO;IAAE,QAAQ;IAAa,OAAO,OAAO;IAAO;IAAW;;AAGhE,OAAI,KAAK,cACP,QAAO;IAAE,QAAQ;IAAa;IAAW;;AAG3C,SAAM,MAAM,KAAK;;EAGnB,MAAM,YAAY,QAAQ;AAC1B,SAAO;GAAE,QAAQ;GAAa;GAAW;;;CAG3C,MAAc,YACZ,WACA,eACsC;AACtC,SAAO,KAAK,aAAa,IAAI,WAAW;;CAG1C,MAAc,YAAY,KAA0C;AAClE,QAAM,KAAK,aAAa,IAAI;AAC5B,OAAK,UAAU;;CAGjB,MAAc,aAAa,WAAsB,eAAuC;AACtF,QAAM,KAAK,aAAa,MAAM,WAAW;AAEzC,MACE,KAAK,WACF,KAAK,QAAQ,cAAc,cAC1B,CAAC,iBAAiB,KAAK,QAAQ,kBAAkB,eAErD,MAAK,UAAU;;CAInB,WAAW;AACT,SAAO;GACL,OAAO,KAAK;GACZ,SAAS,KAAK;GACd,OAAO,KAAK;;;CAIhB,MAAM,eAAe,MAAsE;EACzF,MAAM,EAAE,WAAW,kBAAkB;AACrC,OAAK,YAAY;AACjB,OAAK,QAAQ;EAEb,MAAM,gBAAgB,MAAM,KAAK,2BAA2B,GAAG;EAC/D,MAAM,MAAM,MAAM,KAAK,qBACrB,GACA;GAAE,WAAW;GAAe;KAC5B,EAAE,kBAAkB;AAGtB,MAAI,IAAI,WAAW,gBAAgB,IAAI,WAAW,WAChD,OAAM,KAAK,KAAK,GAAG;EAGrB,MAAM,YACJ,IAAI,WAAW,mBACX,MAAM,KAAK,8BAA8B,OACzC,KAAK,uBAAuB;AAClC,OAAK,eAAe,KAAK;AACzB,QAAM,KAAK,SAAS,YAAY,MAAM;AACtC,SAAO;;CAGT,MAAM,MAAM,MAAoF;EAC9F,MAAM,EAAE,cAAc;AACtB,OAAK,YAAY;AACjB,OAAK,QAAQ;AACb,OAAK,QAAQX,yCAAmB;AAEhC,OAAK,KAAK;GACR,MAAM;GACN,OAAOA,yCAAmB;GAC1B,QAAQE,0CAAoB;GAC5B,SAAS;;EAGX,MAAM,gBAAgB,MAAM,KAAK,2BAA2B,GAAG;AAC/D,QAAM,KAAK,wBAAwB;EAGnC,MAAM,eAAe,MAAM,KAAK,gCAAgC;AAEhE,OAAK,QAAQF,yCAAmB;AAChC,OAAK,KAAK;GACR,MAAM;GACN,OAAOA,yCAAmB;GAC1B,QAAQE,0CAAoB;GAC5B,SAAS;;AAGX,MAAI;GACF,MAAM,UAAU,MAAM,KAAK,gCAAgC,eAAe;GAC1E,MAAM,cAAc,MAAM,KAAK,yBAAyB,eAAe,cAAc,QAAQ;GAE7F,MAAMU,MAA4B;IAChC,WAAW;IACX;IACA,eAAe,YAAY;IAC3B,WAAWC;IACX,qBAAqB,YAAY;IACjC,2BAA2B,YAAY;IACvC,cAAc,YAAY;IAC1B,YAAY,QAAQ;IACpB,cAAc,QAAQ,gBAAgB;IACtC,WAAW,KAAK;IAChB,QAAQ;;GAGV,MAAM,YAAY,MAAM,KAAK,8BAA8B;AAE3D,QAAK,eAAe,KAAK;AAEzB,SAAM,KAAK,SAAS,YAAY,MAAM;AAEtC,UAAO;IAAE;IAAW,eAAe,IAAI;;WAChCC,GAAY;GACnB,MAAM,MAAM,KAAK,UAAU,GAAGR,4BAAa,MAAM;AACjD,SAAM,KAAK,SAAS,YAAY;AAChC,SAAM;;;CAIV,AAAQ,uBAAuB,KAAmC;EAChE,MAAM,EAAE,kBAAkB,KAAK;EAC/B,MAAM,KAAK,mBAAmB;EAC9B,MAAM,UAAU,mBAAmB,WAAW,IAAI,UAAU,GAAG,IAAI,UAAU,GAAG,IAAI;EACpF,MAAM,OAAO,mBAAmB,sBAAsB,IAAI,UAAU;AACpE,SAAO,UAAU,GAAG,WAAW,QAAQ,QAAQ;;CAGjD,MAAc,8BAA8B,KAA4C;AACtF,MAAI,SAAS;AACb,QAAM,KAAK,YAAY;AACvB,SAAO,KAAK,uBAAuB;;CAGrC,MAAM,aAAa,MAAoE;EACrF,MAAM,EAAE,WAAW,kBAAkB;AACrC,OAAK,YAAY;AACjB,OAAK,QAAQ;EAEb,MAAM,gBAAgB,MAAM,KAAK,2BAA2B,GAAG;EAC/D,MAAM,MAAM,MAAM,KAAK,qBACrB,GACA;GAAE,WAAW;GAAe;KAC5B,EAAE,kBAAkB;AAEtB,MAAI,IAAI,WAAW,cAAc,IAAI,WAAW,cAAc;AAC5D,SAAM,KAAK,SAAS,YAAY,MAAM;AACtC;;AAEF,MAAI,IAAI,WAAW,iBACjB,OAAM,KAAK,8BAA8B;AAG3C,QAAM,KAAK,gBAAgB;AAC3B,QAAM,KAAK,SAAS,YAAY,MAAM;;CAGxC,cAAoB;AAClB,OAAK,YAAY;AACjB,MAAI,KAAK,cAAc;AACrB,gBAAa,KAAK;AAClB,QAAK,eAAe;;AAEtB,MAAI,KAAK,sBAAsB;AAC7B,QAAK;AACL,QAAK,uBAAuB;;;;;;;;CAShC,MAAM,eAAe,MAAsE;AACzF,OAAK;EAEL,MAAM,uBAAuB,MAAM,aAAa,KAAK,SAAS,aAAa,IAAI,WAAW;EAC1F,MAAM,iBAAiB,MAAM,iBAAiB,KAAK,SAAS,iBAAiB,IAAI,WAAW;AAE5F,MAAI,oBACF,KAAI;AACF,SAAM,KAAK,aAAaF,+BAAY,sBAAsB;UACpD;AAKV,OAAK,UAAU;AACf,OAAK,QAAQ;AACb,OAAK,QAAQJ,yCAAmB;;CAGlC,MAAM,SAAS,MAAoE;EACjF,MAAM,EAAE,WAAW,kBAAkB;AACrC,OAAK,YAAY;AACjB,OAAK,QAAQ;EAEb,MAAM,gBAAgB,MAAM,KAAK,2BAA2B,GAAG;EAC/D,MAAM,MAAM,MAAM,KAAK,qBACrB,GACA;GAAE,WAAW;GAAe;KAC5B,EAAE,kBAAkB;AAGtB,OAAK,KAAK;GACR,MAAM;GACN,OAAOA,yCAAmB;GAC1B,QAAQE,0CAAoB;GAC5B,SAAS;GACT,MAAM;IACJ,WAAW,IAAI;IACf,eAAe,IAAI;IACnB,QAAQ,IAAI;;;AAIhB,MAAI,IAAI,WAAW,YAAY;AAC7B,QAAK,QAAQF,yCAAmB;AAChC,QAAK,KAAK;IACR,MAAM;IACN,OAAOA,yCAAmB;IAC1B,QAAQE,0CAAoB;IAC5B,SAAS;;AAEX,SAAM,KAAK,SAAS,YAAY,MAAM;AACtC;;AAIF,QAAM,KAAK,gBAAgB;AAC3B,QAAM,KAAK,qBAAqB;AAChC,QAAM,KAAK,SAAS,YAAY,MAAM;;CAGxC,MAAc,gBAAgB,KAA0C;EACtE,MAAM,EAAE,mBAAmB,yBAAyB,KAAK;AACzD,OAAK,QAAQF,yCAAmB;AAChC,OAAK,mBAAmB,KAAK;EAC7B,IAAI,aAAa;EAEjB,MAAM,aAAa,MAAM,KAAK,UAA+B;GAC3D,YAAY;GACZ,WAAW;GACX,mBAAmB,KAAK;GACxB,MAAM,OAAO,EAAE,WAAW,gBAAgB;IACxC,MAAM,eAAe,MAAM,KAAK,8BAA8B;AAC9D,QAAI,gBAAgB,CAAC,aAAa,QAChC,cAAa;IAGf,IAAI,YAAY,cAAc,cAAc;IAC5C,IAAI,UAAU,cAAc,YAAY;IACxC,IAAIM,iBAAe,cAAc;IACjC,IAAIS;AAEJ,QAAI,cAAc,SAAS;KACzB,MAAM,SAAS,MAAM,KAAK,2BAA2B;AACrD,SAAI,WAAW,MAAM;AACnB,kBAAY;AACZ,gBAAU;gBACD,WAAW,SAAS,YAAY;AACzC,kBAAY;AACZ,gBAAU;AACV,uBACE;gBACO,WAAW,KAEpB,QAAO,EAAE,MAAM;;AAInB,SAAK,KAAK;KACR,MAAM;KACN,OAAOf,yCAAmB;KAC1B,QAAQE,0CAAoB;KAC5B,SAAS,aAAa,UAClB,wCAAwC,IAAI,UAAU,6BACtD,0CAA0C,IAAI;KAClD,MAAM,KAAK,sBAAsB,KAAK;MACpC;MACA;MACA;;;AAIJ,QAAI,CAAC,UACH,QAAO,EAAE,MAAM;AAGjB,QAAI,CAAC,QACH,QAAO;KACL,MAAM;KACN,OAAO;MACL,SAAS;MACT,cAAcI,kBAAgB;;;AAKpC,WAAO;KAAE,MAAM;KAAM,OAAO,EAAE,SAAS;;;;AAI3C,MAAI,WAAW,WAAW,aAAa;AACrC,OAAI,WAAW,MAAM,YAAY,UAAU;IACzC,MAAMU,QAAM,KAAK,UAAU,GAAG,WAAW,MAAM;AAC/C,QAAI,SAAS;AACb,UAAM,KAAK,YAAY;AACvB,UAAM,KAAK,SAAS,YAAY;AAChC,UAAMA;;AAGR,OAAI,SAAS;AACb,SAAM,KAAK,YAAY;AACvB;;AAGF,MAAI,WAAW,WAAW,YAAY;GACpC,MAAMA,QAAM,KAAK,UAAU,GAAG;AAC9B,OAAI,SAAS;AACb,SAAM,KAAK,YAAY;AACvB,SAAM,KAAK,SAAS,YAAY;AAChC,SAAMA;;EAGR,MAAM,MAAM,KAAK,UAAU,GAAG;AAC9B,QAAM,KAAK,SAAS,YAAY;AAChC,QAAM;;CAGR,AAAQ,uBACN,KAIA;EACA,MAAM,eAAe,KAAK,QAAQ,gBAAgB;EAClD,MAAM,YAAYZ,+BAAY,IAAI;AAClC,eAAa,eAAe,WAAW,IAAI;AAC3C,SAAO;GAAE;GAAc;;;CAMzB,MAAc,6BAA6B,KAA2B,WAAkD;EACtH,MAAM,eAAe,IAAI;AACzB,MAAI,CAAC,aACH,QAAO,KAAK,KAAK,GAAG;EAGtB,MAAM,qBAAqB,MAAM,KAAK,QAAQ,gBAAgB,qCAAqC;GACjG,eAAe;GACf,YAAY,IAAI;GAChB;GACA,2BAA2B,IAAI;GAC/B,cAAc,IAAI;;AAGpB,MAAI,CAAC,mBAAmB,WAAW,CAAC,mBAAmB,kBACrD,OAAM,KAAK,KAAK,GAAG,mBAAmB,SAAS;AAGjD,SAAO,mBAAmB;;CAG5B,MAAc,oCACZ,KACA,UAC6B;EAC7B,IAAIa;AACJ,MAAI;AACF,cAAW,MAAM,KAAK,QAAQ,WAAW,gBACvC,UACAC,gCAAoB;WAEfb,KAAc;GACrB,MAAM,MAAMC,4BAAa,QAAQ;AACjC,SAAM,IAAI,MAAM;;EAGlB,MAAM,SAAS,KAAK,UAAU;EAK9B,MAAM,mBAAmBa,oDAAoC;AAC7D,MAAI,kBAAkB,aAAa,OAAO;GACxC,MAAM,OAAO,KAAK,yBAAyB;GAC3C,MAAM,mBAAmB,KAAK,MAAM,QAAQ,8CAA8C,KAAK;GAC/F,MAAM,SAAS,SAAS,SAAS,OAAO,KAAK;GAC7C,MAAM,OAAO,mBACTC,6CAAuB,wBACvBA,6CAAuB;GAC3B,MAAM,UAAU,mBACZ,yGAAyG,OAAO,KAChH,yDAAyD,OAAO;AACpE,SAAM,IAAIC,yCAAmB,SAAS,MAAM;IAC1C,WAAW,IAAI;IACf,eAAe,IAAI;IACnB,iBAAiB;IACjB;IACA,QAAQ;;;AAIZ,MAAI,OACF,MAAK,KAAK;GACR,MAAM;GACN,OAAOrB,yCAAmB;GAC1B,QAAQE,0CAAoB;GAC5B,SAAS;GACT,MAAM;IACJ,WAAW,IAAI;IACf,eAAe,IAAI;IACnB,iBAAiB;;;AAKvB,SAAO;;CAGT,AAAQ,UAAU,SAAoD;EACpE,MAAMoB,YAAqB,QAAQ;AACnC,MAAI,aAAa,OAAO,cAAc,UAAU;GAC9C,MAAM,OAAQ,UAAsC;AACpD,OAAI,OAAO,SAAS,YAAY,KAAK,SAAS,EAAG,QAAO;;EAG1D,MAAM,cAAe,SAA0D;AAC/E,MAAI,eAAe,OAAO,gBAAgB,UAAU;GAClD,MAAM,KAAM,YAAwC;AACpD,OAAI,OAAO,OAAO,YAAY,GAAG,SAAS,EAAG,QAAO;;EAGtD,MAAM,WAAY,QAA+C;AACjE,SAAO,OAAO,aAAa,YAAY,SAAS,SAAS,IAAI,WAAW;;CAG1E,AAAQ,yBAAyB,SAA0C;EACzE,MAAMC,OAAiB;AACvB,OAAK,MAAM,SAAS,QAAQ,oBAAoB,QAAQ,KACtD,MAAK,KAAK,OAAO;AAEnB,OAAK,MAAM,WAAW,QAAQ,iBAC5B,MAAK,MAAM,SAAS,QAAQ,QAAQ,KAClC,MAAK,KAAK,OAAO;AAGrB,SAAO;;CAGT,AAAQ,8BACN,gBACA;AACA,SAAO,eAAe,KAAK,EAAE,qBAAqB;GAChD,cAAc,cAAc;GAC5B,qBAAqB,cAAc;GACnC,YAAY,cAAc;GAC1B,MAAM,cAAc;GACpB,YAAY,cAAc,WAAW;GACrC,cAAc,cAAc,gBAAgB,MAAM;GAClD,cAAc,cAAc;;;CAIhC,MAAc,6BAA6B,WAAwC;AACjF,MAAI;GACF,MAAM,iBAAiB,MAAMhB,gDAC3B,KAAK,QAAQ,YACb,KAAK,QAAQ,QAAQ,YACrB;GAGF,MAAM,uBAAuB,KAAK,8BAA8B;AAChE,SAAMiB,+BAAiB,SAAS,+BAA+B,WAAW;AAC1E,UAAO;WACA,KAAK;AACZ,WAAQ,KAAK,qEAAqE;AAClF,UAAO;;;CAIX,MAAc,sBAAsB,WAAsB,cAAwC;AAChG,MAAI;AACF,SAAMA,+BAAiB,SAAS,YAAY,WAAW;AACvD,UAAO;WACA,KAAK;AACZ,WAAQ,KAAK,+DAA+D;AAC5E,UAAO;;;CAIX,MAAc,sBACZ,cACA,UACe;AACf,MAAI;GACF,MAAM,UAAU,SAAS,YAAY;AACrC,OAAI,WAAW,KACb,OAAM,aAAa,0BACjB,KAAK,QAAQ,YACb,OAAO;UAGL;;CAKV,MAAc,yBAAyB,KAA2B,WAAqC;EACrG,MAAM,EAAE,oBAAoB,KAAK;EAEjC,MAAMC,UAAgC;GACpC,eAAe;GACf,cAAc,IAAI;GAClB,qBAAqB,IAAI;GACzB,aAAa,KAAK;GAClB,mBAAmB;IACjB,IAAI,IAAI,WAAW;IACnB,OAAO,IAAI,WAAW;;GAExB,qBAAqB;IACnB,sBAAsB,IAAI,oBAAoB;IAC9C,mBAAmB,IAAI,oBAAoB;;GAE7C,2BAA2B,IAAI,6BAA6B;;AAG9D,QAAM,gBAAgB,cAAc;;;;;;CAOtC,MAAc,+BAA+B,KAA2B,WAAqC;AAC3G,MAAI;GACF,MAAM,EAAE,oBAAoB,KAAK;GACjC,MAAM,kBAAkB,IAAI,WAAW,SAAS;GAChD,MAAM,sBAAsB,MAAM,gBAAgB,qBAAqB;AAEvE,SAAM,gBAAgB,mBAAmB;IACvC,eAAe;IACf,cAAc,IAAI;IAClB,cAAc,IAAI,WAAW;IAC7B;IACA,YAAY,CAAC;IACb,MAAM,UAAU,IAAI,aAAa,eAAe,IAAI,UAAU,MAAM,KAAK;IACzE,6BAAY,IAAI,QAAO;IACvB,2BAAU,IAAI,QAAO;IACrB,cAAc,IAAI;;AAEpB,WAAQ,IAAI;WACL,GAAG;AACV,WAAQ,MAAM,gGAAgG;;;CAKlH,MAAc,4BAA4B,KAA0C;AAClF,MAAI,SAAS;AACb,QAAM,KAAK,YAAY;AACvB,QAAM,KAAK,aAAa,IAAI,WAAW,IAAI;;CAG7C,MAAc,0BAA0B,WAAsB,SAAgC;EAC5F,MAAM,YAAY,MAAM,KAAK,QAAQ,gBAAgB;EACrD,MAAM,sBACJ,UAAU,UACP,UAAU,iBACV,OAAO,UAAU,mBAAmB,OAAO;AAChD,MAAI,CAAC,oBACH,OAAM,IAAI,MAAM;;CAIpB,MAAc,wBAAwB,WAAsB,cAAqC;EAC/F,MAAM,EAAE,oBAAoB,KAAK;AACjC,QAAM,gBAAgB,YAAY,WAAW;AAC7C,QAAM,gBAAgB,sBAAsB,WAAW,KAAK,QAAQ;AACpE,MAAI;AAAE,SAAMC,8BAAgB,KAAK,SAAS;UAAoB;;CAGhE,MAAc,gBACZ,KACA,WACA,cACkB;AAClB,MACE,CAAC,IAAI,6BACF,CAAC,IAAI,0BAA0B,eAC/B,CAAC,KAAK,QAAQ,QAAQ,kBAAkB,aAAa,eAExD,QAAO;AAGT,MAAI;GACF,MAAM,EAAE,oBAAoB,KAAK;GACjC,MAAM,eAAe,MAAM,gBAAgB,6BAA6B;IACtE,eAAe;IACf,YAAY,IAAI,0BAA0B;IAC1C,mBAAmB,IAAI,0BAA0B;IACjD,aAAa,IAAI,0BAA0B;;AAG7C,OAAI,CAAC,aAAa,QAChB,QAAO;AAGT,SAAM,KAAK,0BAA0B,WAAW;AAChD,SAAM,KAAK,wBAAwB,WAAW;AAC9C,UAAO;WACA,KAAK;AACZ,WAAQ,KAAK,4EAA4E;AACzF,UAAO;;;CAIX,MAAc,iBACZ,KACA,WACA,cACgD;AAChD,MAAI;GACF,MAAM,EAAE,oBAAoB,KAAK;GACjC,MAAM,gBAAgBC;GAEtB,MAAM,qBAAqB,OAAO,IAAI,YAAY,SAAS,IAAI,YAAY,MAAM,IAAI;GACrF,MAAM,gBAAgB,qBAAqB,CAAC,sBAAsB;GAClE,MAAM,iBAAiB,cAAc,SAAS,IAC1C,KACA,MAAM,gBAAgB,wBAAwB;GAClD,MAAM,iBAAiB,MAAM,gBAAgB,8CAA8C;IACzF,eAAe;IACf,WAAW;IACX,eAAe,cAAc,SAAS,IAAI,gBAAgB,eAAe,KAAK,MAAM,EAAE;;AAGxF,OAAI,sBAAsB,eAAe,UAAU,mBACjD,QAAO;IACL,SAAS;IACT,QAAQ;;GAIZ,MAAM,kBAAkB,MAAM,gBAAgB,iBAAiB;IAC7D,eAAe;IACf,qBAAqB,IAAI;IACzB,YAAY;;AAGd,OAAI,CAAC,gBAAgB,QACnB,QAAO;IAAE,SAAS;IAAO,QAAQ,gBAAgB,SAAS;;AAG5D,SAAM,KAAK,0BAA0B,WAAW;AAChD,SAAM,KAAK,wBAAwB,WAAW;AAC9C,UAAO,EAAE,SAAS;WACXtB,KAAc;AACrB,UAAO;IAAE,SAAS;IAAO,QAAQC,4BAAa,QAAQ,OAAO;;;;CAIjE,MAAc,uBAAuB,QAAgB,KAAyC;AAC5F,UAAQ,KAAK,wDAAwD,OAAO;AAC5E,MAAI;AACF,SAAM,KAAK,QAAQ,gBAAgB;UAC7B;AACR,SAAO;GAAE,SAAS;GAAO;;;CAG3B,MAAc,qBAAqB,KAA0C;AAC3E,OAAK,QAAQN,yCAAmB;AAChC,OAAK,KAAK;GACR,MAAM;GACN,OAAOA,yCAAmB;GAC1B,QAAQE,0CAAoB;GAC5B,SAAS;GACT,MAAM;IACJ,WAAW,IAAI;IACf,eAAe,IAAI;;;AAIvB,MAAI;GACF,MAAM,EAAE,cAAc,cAAc,KAAK,uBAAuB;GAChE,MAAM,WAAW,MAAM,KAAK,6BAA6B,KAAK;GAC9D,MAAM,SAAS,MAAM,KAAK,oCAAoC,KAAK;AACnE,OAAI,CAAC,OACH,SAAQ,KAAK;AAKf,SAAM,KAAK,yBAAyB,KAAK;AAGzC,SAAM,KAAK,6BAA6B;AAMxC,SAAM,KAAK,+BAA+B,KAAK;AAG/C,SAAM,KAAK,sBAAsB,WAAW,IAAI;AAEhD,SAAM,KAAK,sBAAsB,cAAc;AAI/C,OAAI,OACF,OAAM,KAAK,4BAA4B,WAAW,KAAK;AAGzD,QAAK,mBAAmBA,0CAAoB,UAAU,kDAAkD,EACtG,WAAW;GAGb,MAAM,kBAAkB,MAAM,KAAK,iBAAiB;AACpD,OAAI,gBAAgB,QAClB,MAAK,mBAAmBA,0CAAoB,SAAS,WAAW,aAAa,EAC3E,WAAW;OAGb,MAAK,mBAAmBA,0CAAoB,OAAO,6DAA6D;IAC9G,OAAO,gBAAgB;IACvB,WAAW;;AAIf,SAAM,KAAK,4BAA4B;AAEvC,QAAK,QAAQF,yCAAmB;AAChC,QAAK,KAAK;IACR,MAAM;IACN,OAAOA,yCAAmB;IAC1B,QAAQE,0CAAoB;IAC5B,SAAS;IACT,MAAM;KACJ,WAAW,IAAI;KACf,eAAe,IAAI;;;WAGhBY,GAAY;AACnB,OAAI,SAAS;AACb,SAAM,KAAK,YAAY,KAAK,YAAY;GACxC,MAAM,WAAW,aAAa,QAC1B,IACA,IAAI,MAAMR,4BAAa,MAAM;GACjC,MAAM,MAAM,KAAK,UAAU,GAAG;AAC9B,SAAM,KAAK,SAAS,YAAY;AAChC,SAAM;;;CAIV,MAAc,4BACZ,WACA,KACA,oBACe;EACf,MAAM,eAAesB,0CAAkB,IAAI,cAAc,EAAE,KAAK;AAChE,MAAI,iBAAiB,KACnB,OAAM,IAAI,MAAM,kDAAkD,OAAO,IAAI;AAK/E,MAAI;AACF,SAAM,KAAK,QAAQ,gBAAgB,YAAY,WAAW;UACpD;EAER,MAAM,WAAW,MAAMJ,+BAAiB,WAAW,wBAAwB,WAAW;AACtF,MAAI,SACF;EAGF,MAAM,aAAa,KAAK,QAAQ,QAAQ,QAAQ;AAChD,MAAI,CAAC,WACH,OAAM,IAAI,MAAM;EAGlB,MAAM,mBAAmB,MAAMA,+BAAiB,WAAW,oBAAoB,WAAW;AAC1F,MAAI,CAAC,iBACH,OAAM,IAAI,MAAM,kCAAkC,OAAO,WAAW,UAAU;EAGhF,MAAM,UAAU,MAAM,KAAK,QAAQ,gBAAgB,yDAAyD;GAC1G,YAAY,IAAI;GAChB,eAAe;GACf,aAAa,iBAAiB;;AAEhC,MAAI,CAAC,QAAQ,QACX,OAAM,IAAI,MAAM,QAAQ,SAAS;EAGnC,MAAM,SAAS,MAAMK,0DAAyC,YAAY;GACxE,eAAe;GACf,0BAA0B,QAAQ;GAClC;;AAEF,MAAI,CAAC,OAAO,GACV,OAAM,IAAI,MAAM,OAAO,SAAS,OAAO,WAAW,OAAO,QAAQ;EAGnE,MAAM,qBAAqBpB,uCAAoB,OAAO,aAAa;AACnE,MAAI,CAAC,mBAAoB,OAAM,IAAI,MAAM;EACzC,MAAM,eAAe,OAAO,OAAO,gBAAgB,IAAI;AACvD,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM;EACnC,MAAM,4BAA4B,OAAO,OAAO,6BAA6B,IAAI;AACjF,MAAI,CAAC,0BAA2B,OAAM,IAAI,MAAM;AAGhD,MAAI;AACF,QAAK,QAAQ,gBAAgB,kBAAkB,eAAe,WAAW,iBAAiB;UACpF;EACR,MAAM,YAAY,MAAM,KAAK,QAAQ,gBAAgB,kBAAkB,2BACrE,KAAK,QAAQ,YACb,EAAE,OAAO;EAEX,MAAM,SAAS,MAAM,KAAK,QAAQ,gBAAgB,qCAAqC;GACrF,eAAe;GACf,YAAY,IAAI;GAChB,aAAa,iBAAiB;GAC9B,oBAAoB;GACpB;GACA;GACA,qBAAqB,OAAO;GAC5B,sBAAsB,OAAO;GAC7B;;EAEF,MAAM,WAAW,QAAQ;AACzB,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM;AAE/B,QAAM,KAAK,QAAQ,WAAW,gBAC5B,UACAS,gCAAoB;AAGtB,QAAMM,+BAAiB,WAAW,iBAAiB;GACjD,MAAM;GACN,eAAe,OAAO;GACtB;GACA,WAAW;GACX,aAAa,QAAQ;GACrB;GACA,uBAAuB;GACvB,cAAcM,2DAAsC;IAClD,qBAAqB,OAAO;IAC5B,sBAAsB,OAAO;IAC7B;IACA;IACA,0BAA0B,QAAQ;IAClC;IACA,uBAAuB;;GAEzB,WAAW,KAAK;;;CAIpB,MAAc,iBAAiB,KAAqD;AAClF,MAAI;GACF,MAAM,YAAY1B,+BAAY,IAAI;GAClC,MAAM,eAAewB,0CAAkB,IAAI,cAAc,EAAE,KAAK;AAChE,OAAI,iBAAiB,KACnB,QAAO,KAAK,uBACV,wCAAwC,OAAO,IAAI;GAIvD,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,KAAK,WAAW;AAClE,OAAI,eACF,QAAO;IAAE,SAAS;IAAM,QAAQ;;GAGlC,MAAM,gBAAgB,MAAM,KAAK,iBAAiB,KAAK,WAAW;AAClE,OAAI,cAAc,QAChB,QAAO;IAAE,SAAS;IAAM,QAAQ;;AAGlC,UAAO,KAAK,uBAAuB,cAAc,UAAU;WACpDvB,KAAc;AACrB,UAAO,KAAK,uBAAuBC,4BAAa,QAAQ,OAAO,MAAM"}

package/dist/cjs/core/TatchiPasskey/faucets/createAccountRelayServer.js

@@ -1,23 +1,22 @@
-const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.js');
-const require_validation = require('../../WalletIframe/validation.js');
+const require_validation = require('../../../utils/validation.js');
 const require_base64 = require('../../../utils/base64.js');
-const require_encoders = require('../../../utils/encoders.js');
 const require_errors = require('../../../utils/errors.js');
 const require_credentialsHelpers = require('../../WebAuthnManager/credentialsHelpers.js');
 const require_sdkSentEvents = require('../../types/sdkSentEvents.js');
 
 //#region src/core/TatchiPasskey/faucets/createAccountRelayServer.ts
-require_sdkSentEvents.init_sdkSentEvents();
-require_encoders.init_encoders();
-require_credentialsHelpers.init_credentialsHelpers();
-require_validation.init_validation();
-require_errors.init_errors();
+function isSerializedRegistrationCredential(credential) {
+	if (!require_validation.isObject(credential)) return false;
+	const resp = credential.response;
+	if (!require_validation.isObject(resp)) return false;
+	return typeof resp.attestationObject === "string";
+}
 /**
 * Create account and register user using relay-server atomic endpoint
 * Makes a single call to the relay-server's /create_account_and_register_user endpoint
 * which calls the contract's atomic create_account_and_register_user function
 */
-async function createAccountAndRegisterWithRelayServer(context, nearAccountId, publicKey, credential, vrfChallenge, deterministicVrfPublicKey, authenticatorOptions, onEvent) {
+async function createAccountAndRegisterWithRelayServer(context, nearAccountId, publicKey, credential, vrfChallenge, deterministicVrfPublicKey, authenticatorOptions, onEvent, opts) {
 	const { configs } = context;
 	if (!configs.relayer.url) throw new Error("Relay server URL is required for atomic registration");
 	try {
@@ -27,14 +26,17 @@ async function createAccountAndRegisterWithRelayServer(context, nearAccountId, p
 			status: require_sdkSentEvents.RegistrationStatus.PROGRESS,
 			message: "Creating account and adding access key..."
 		});
-		const isSerialized = require_validation.isObject(credential) && typeof credential?.response?.attestationObject === "string";
+		const isSerialized = isSerializedRegistrationCredential(credential);
 		const serialized = isSerialized ? require_credentialsHelpers.normalizeRegistrationCredential(credential) : require_credentialsHelpers.serializeRegistrationCredential(credential);
 		const serializedCredential = require_credentialsHelpers.removePrfOutputGuard(serialized);
 		if (!Array.isArray(serializedCredential?.response?.transports)) serializedCredential.response.transports = [];
+		const intent_digest_32 = Array.from(require_base64.base64UrlDecode(vrfChallenge.intentDigest || ""));
+		if (intent_digest_32.length !== 32) throw new Error("Missing or invalid vrfChallenge.intentDigest (expected base64url-encoded 32 bytes)");
 		const requestData = {
 			new_account_id: nearAccountId,
 			new_public_key: publicKey,
 			device_number: 1,
+			...opts?.thresholdEd25519?.clientVerifyingShareB64u ? { threshold_ed25519: { client_verifying_share_b64u: opts.thresholdEd25519.clientVerifyingShareB64u } } : {},
 			vrf_data: {
 				vrf_input_data: Array.from(require_base64.base64UrlDecode(vrfChallenge.vrfInput)),
 				vrf_output: Array.from(require_base64.base64UrlDecode(vrfChallenge.vrfOutput)),
@@ -43,7 +45,8 @@ async function createAccountAndRegisterWithRelayServer(context, nearAccountId, p
 				user_id: vrfChallenge.userId,
 				rp_id: vrfChallenge.rpId,
 				block_height: Number(vrfChallenge.blockHeight),
-				block_hash: Array.from(require_base64.base64UrlDecode(vrfChallenge.blockHash))
+				block_hash: Array.from(require_base64.base64UrlDecode(vrfChallenge.blockHash)),
+				intent_digest_32
 			},
 			webauthn_registration: serializedCredential,
 			deterministic_vrf_public_key: Array.from(require_base64.base64UrlDecode(deterministicVrfPublicKey)),
@@ -74,7 +77,15 @@ async function createAccountAndRegisterWithRelayServer(context, nearAccountId, p
 		});
 		return {
 			success: true,
-			transactionId: result.transactionHash
+			transactionId: result.transactionHash,
+			thresholdEd25519: result.thresholdEd25519 ? {
+				publicKey: result.thresholdEd25519.publicKey,
+				relayerKeyId: result.thresholdEd25519.relayerKeyId,
+				relayerVerifyingShareB64u: result.thresholdEd25519.relayerVerifyingShareB64u,
+				clientParticipantId: result.thresholdEd25519.clientParticipantId,
+				relayerParticipantId: result.thresholdEd25519.relayerParticipantId,
+				participantIds: result.thresholdEd25519.participantIds
+			} : void 0
 		};
 	} catch (error) {
 		console.error("Atomic registration failed:", error);

package/dist/cjs/core/TatchiPasskey/faucets/createAccountRelayServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"createAccountRelayServer.js","names":["RegistrationPhase","RegistrationStatus","isObject","serialized: WebAuthnRegistrationCredential","normalizeRegistrationCredential","serializeRegistrationCredential","removePrfOutputGuard","requestData: CreateAccountAndRegisterUserRequest","base64UrlDecode","result: CreateAccountAndRegisterResult","errorMessage","error: unknown"],"sources":["../../../../../src/core/TatchiPasskey/faucets/createAccountRelayServer.ts"],"sourcesContent":["import { VRFChallenge } from '../../types/vrf-worker';\nimport { RegistrationSSEEvent, RegistrationPhase, RegistrationStatus } from '../../types/sdkSentEvents';\nimport { PasskeyManagerContext } from '..';\nimport { base64UrlDecode, base64UrlEncode } from '../../../utils/encoders';\nimport type { SignedTransaction } from '../../NearClient';\nimport { removePrfOutputGuard, serializeRegistrationCredential, normalizeRegistrationCredential } from '../../WebAuthnManager/credentialsHelpers';\nimport type { WebAuthnRegistrationCredential } from '../../types/webauthn';\nimport type { AuthenticatorOptions } from '../../types/authenticatorOptions';\nimport type { CreateAccountAndRegisterResult } from '../../../server/core/types';\nimport { isObject } from '../../WalletIframe/validation';\nimport { errorMessage } from '../../../utils/errors';\n\n/**\n * HTTP Request body for the relay server's /create_account_and_register_user endpoint\n */\nexport interface CreateAccountAndRegisterUserRequest {\n  new_account_id: string;\n  new_public_key: string;\n  device_number: number;\n  vrf_data: {\n    vrf_input_data: number[];\n    vrf_output: number[];\n    vrf_proof: number[];\n    public_key: number[];\n    user_id: string;\n    rp_id: string;\n    block_height: number;\n    block_hash: number[];\n  };\n  webauthn_registration: WebAuthnRegistrationCredential;\n  deterministic_vrf_public_key: number[];\n  authenticator_options?: AuthenticatorOptions;\n}\n\n/**\n * Create account and register user using relay-server atomic endpoint\n * Makes a single call to the relay-server's /create_account_and_register_user endpoint\n * which calls the contract's atomic create_account_and_register_user function\n */\nexport async function createAccountAndRegisterWithRelayServer(\n  context: PasskeyManagerContext,\n  nearAccountId: string,\n  publicKey: string,\n  credential: WebAuthnRegistrationCredential | PublicKeyCredential,\n  vrfChallenge: VRFChallenge,\n  deterministicVrfPublicKey: string,\n  authenticatorOptions?: AuthenticatorOptions,\n  onEvent?: (event: RegistrationSSEEvent) => void,\n): Promise<{\n  success: boolean;\n  transactionId?: string;\n  error?: string;\n}> {\n  const { configs } = context;\n\n  if (!configs.relayer.url) {\n    throw new Error('Relay server URL is required for atomic registration');\n  }\n\n  try {\n    onEvent?.({\n      step: 4,\n      phase: RegistrationPhase.STEP_4_ACCESS_KEY_ADDITION,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Creating account and adding access key...',\n    });\n\n    // Serialize the WebAuthn credential properly for the contract.\n    // Accept both live PublicKeyCredential and already-serialized credentials from secureConfirm.\n    const isSerialized = isObject(credential)\n      && typeof (credential as any)?.response?.attestationObject === 'string';\n\n    // Ensure proper serialization + normalization regardless of source\n    const serialized: WebAuthnRegistrationCredential = isSerialized\n      ? normalizeRegistrationCredential(credential as WebAuthnRegistrationCredential)\n      : serializeRegistrationCredential(credential as PublicKeyCredential);\n\n    // Strip PRF outputs before sending to relay/contract\n    const serializedCredential = removePrfOutputGuard<WebAuthnRegistrationCredential>(serialized);\n    // Normalize transports to an array (avoid null)\n    if (!Array.isArray(serializedCredential?.response?.transports)) {\n      serializedCredential.response.transports = [];\n    }\n\n    // Prepare data for atomic endpoint\n    const requestData: CreateAccountAndRegisterUserRequest = {\n      new_account_id: nearAccountId,\n      new_public_key: publicKey,\n      device_number: 1, // First device gets device number 1 (1-indexed)\n      vrf_data: {\n        vrf_input_data: Array.from(base64UrlDecode(vrfChallenge.vrfInput)),\n        vrf_output: Array.from(base64UrlDecode(vrfChallenge.vrfOutput)),\n        vrf_proof: Array.from(base64UrlDecode(vrfChallenge.vrfProof)),\n        public_key: Array.from(base64UrlDecode(vrfChallenge.vrfPublicKey)),\n        user_id: vrfChallenge.userId,\n        rp_id: vrfChallenge.rpId,\n        block_height: Number(vrfChallenge.blockHeight),\n        block_hash: Array.from(base64UrlDecode(vrfChallenge.blockHash)),\n      },\n      webauthn_registration: serializedCredential,\n      deterministic_vrf_public_key: Array.from(base64UrlDecode(deterministicVrfPublicKey)),\n      authenticator_options: authenticatorOptions || context.configs.authenticatorOptions,\n    };\n\n    onEvent?.({\n      step: 5,\n      phase: RegistrationPhase.STEP_5_CONTRACT_REGISTRATION,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Registering user with Web3Authn contract...',\n    });\n\n    // Call the atomic endpoint\n    const response = await fetch(`${configs.relayer.url}/create_account_and_register_user`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify(requestData)\n    });\n\n    // Handle both successful and failed responses\n    const result: CreateAccountAndRegisterResult = await response.json();\n\n    if (!response.ok) {\n      // Extract specific error message from relay server response\n      const errorMessage = result.error || result.message || `HTTP ${response.status}: ${response.statusText}`;\n      throw new Error(errorMessage);\n    }\n\n    if (!result.success) {\n      throw new Error(result.error || 'Atomic registration failed');\n    }\n\n    onEvent?.({\n      step: 5,\n      phase: RegistrationPhase.STEP_5_CONTRACT_REGISTRATION,\n      status: RegistrationStatus.SUCCESS,\n      message: 'User registered with Web3Authn contract successfully',\n    });\n\n    return {\n      success: true,\n      transactionId: result.transactionHash,\n    };\n\n  } catch (error: unknown) {\n    console.error('Atomic registration failed:', error);\n\n    onEvent?.({\n      step: 0,\n      phase: RegistrationPhase.REGISTRATION_ERROR,\n      status: RegistrationStatus.ERROR,\n      message: 'Registration failed',\n      error: errorMessage(error),\n    });\n\n    return {\n      success: false,\n      error: errorMessage(error),\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAuCA,eAAsB,wCACpB,SACA,eACA,WACA,YACA,cACA,2BACA,sBACA,SAKC;CACD,MAAM,EAAE,YAAY;AAEpB,KAAI,CAAC,QAAQ,QAAQ,IACnB,OAAM,IAAI,MAAM;AAGlB,KAAI;AACF,YAAU;GACR,MAAM;GACN,OAAOA,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;EAKX,MAAM,eAAeC,4BAAS,eACzB,OAAQ,YAAoB,UAAU,sBAAsB;EAGjE,MAAMC,aAA6C,eAC/CC,2DAAgC,cAChCC,2DAAgC;EAGpC,MAAM,uBAAuBC,gDAAqD;AAElF,MAAI,CAAC,MAAM,QAAQ,sBAAsB,UAAU,YACjD,sBAAqB,SAAS,aAAa;EAI7C,MAAMC,cAAmD;GACvD,gBAAgB;GAChB,gBAAgB;GAChB,eAAe;GACf,UAAU;IACR,gBAAgB,MAAM,KAAKC,+BAAgB,aAAa;IACxD,YAAY,MAAM,KAAKA,+BAAgB,aAAa;IACpD,WAAW,MAAM,KAAKA,+BAAgB,aAAa;IACnD,YAAY,MAAM,KAAKA,+BAAgB,aAAa;IACpD,SAAS,aAAa;IACtB,OAAO,aAAa;IACpB,cAAc,OAAO,aAAa;IAClC,YAAY,MAAM,KAAKA,+BAAgB,aAAa;;GAEtD,uBAAuB;GACvB,8BAA8B,MAAM,KAAKA,+BAAgB;GACzD,uBAAuB,wBAAwB,QAAQ,QAAQ;;AAGjE,YAAU;GACR,MAAM;GACN,OAAOR,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;EAIX,MAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,QAAQ,IAAI,oCAAoC;GACtF,QAAQ;GACR,SAAS,EAAE,gBAAgB;GAC3B,MAAM,KAAK,UAAU;;EAIvB,MAAMQ,SAAyC,MAAM,SAAS;AAE9D,MAAI,CAAC,SAAS,IAAI;GAEhB,MAAMC,iBAAe,OAAO,SAAS,OAAO,WAAW,QAAQ,SAAS,OAAO,IAAI,SAAS;AAC5F,SAAM,IAAI,MAAMA;;AAGlB,MAAI,CAAC,OAAO,QACV,OAAM,IAAI,MAAM,OAAO,SAAS;AAGlC,YAAU;GACR,MAAM;GACN,OAAOV,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;AAGX,SAAO;GACL,SAAS;GACT,eAAe,OAAO;;UAGjBU,OAAgB;AACvB,UAAQ,MAAM,+BAA+B;AAE7C,YAAU;GACR,MAAM;GACN,OAAOX,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;GACT,OAAOS,4BAAa;;AAGtB,SAAO;GACL,SAAS;GACT,OAAOA,4BAAa"}
+{"version":3,"file":"createAccountRelayServer.js","names":["isObject","RegistrationPhase","RegistrationStatus","serialized: WebAuthnRegistrationCredential","normalizeRegistrationCredential","serializeRegistrationCredential","removePrfOutputGuard","base64UrlDecode","requestData: CreateAccountAndRegisterUserRequest","result: CreateAccountAndRegisterResult","errorMessage","error: unknown"],"sources":["../../../../../src/core/TatchiPasskey/faucets/createAccountRelayServer.ts"],"sourcesContent":["import { VRFChallenge } from '../../types/vrf-worker';\nimport { RegistrationSSEEvent, RegistrationPhase, RegistrationStatus } from '../../types/sdkSentEvents';\nimport { PasskeyManagerContext } from '..';\nimport { base64UrlDecode } from '../../../utils/encoders';\nimport { removePrfOutputGuard, serializeRegistrationCredential, normalizeRegistrationCredential } from '../../WebAuthnManager/credentialsHelpers';\nimport type { WebAuthnRegistrationCredential } from '../../types/webauthn';\nimport type { AuthenticatorOptions } from '../../types/authenticatorOptions';\nimport type { CreateAccountAndRegisterResult } from '../../../server/core/types';\nimport { isObject } from '@/utils/validation';\nimport { errorMessage } from '../../../utils/errors';\n\nfunction isSerializedRegistrationCredential(\n  credential: WebAuthnRegistrationCredential | PublicKeyCredential,\n): credential is WebAuthnRegistrationCredential {\n  if (!isObject(credential)) return false;\n  const resp = (credential as { response?: unknown }).response;\n  if (!isObject(resp)) return false;\n  return typeof (resp as { attestationObject?: unknown }).attestationObject === 'string';\n}\n\n/**\n * HTTP Request body for the relay server's /create_account_and_register_user endpoint\n */\nexport interface CreateAccountAndRegisterUserRequest {\n  new_account_id: string;\n  new_public_key: string;\n  device_number: number;\n  threshold_ed25519?: {\n    client_verifying_share_b64u: string;\n  };\n  vrf_data: {\n    vrf_input_data: number[];\n    vrf_output: number[];\n    vrf_proof: number[];\n    public_key: number[];\n    user_id: string;\n    rp_id: string;\n    block_height: number;\n    block_hash: number[];\n    intent_digest_32: number[];\n  };\n  webauthn_registration: WebAuthnRegistrationCredential;\n  deterministic_vrf_public_key: number[];\n  authenticator_options?: AuthenticatorOptions;\n}\n\n/**\n * Create account and register user using relay-server atomic endpoint\n * Makes a single call to the relay-server's /create_account_and_register_user endpoint\n * which calls the contract's atomic create_account_and_register_user function\n */\nexport async function createAccountAndRegisterWithRelayServer(\n  context: PasskeyManagerContext,\n  nearAccountId: string,\n  publicKey: string,\n  credential: WebAuthnRegistrationCredential | PublicKeyCredential,\n  vrfChallenge: VRFChallenge,\n  deterministicVrfPublicKey: string,\n  authenticatorOptions?: AuthenticatorOptions,\n  onEvent?: (event: RegistrationSSEEvent) => void,\n  opts?: {\n    thresholdEd25519?: {\n      clientVerifyingShareB64u: string;\n    };\n  },\n): Promise<{\n  success: boolean;\n  transactionId?: string;\n  thresholdEd25519?: {\n    publicKey: string;\n    relayerKeyId: string;\n    relayerVerifyingShareB64u?: string;\n    clientParticipantId?: number;\n    relayerParticipantId?: number;\n    participantIds?: number[];\n  };\n  error?: string;\n}> {\n  const { configs } = context;\n\n  if (!configs.relayer.url) {\n    throw new Error('Relay server URL is required for atomic registration');\n  }\n\n  try {\n    onEvent?.({\n      step: 4,\n      phase: RegistrationPhase.STEP_4_ACCESS_KEY_ADDITION,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Creating account and adding access key...',\n    });\n\n    // Serialize the WebAuthn credential properly for the contract.\n    // Accept both live PublicKeyCredential and already-serialized credentials from secureConfirm.\n    const isSerialized = isSerializedRegistrationCredential(credential);\n\n    // Ensure proper serialization + normalization regardless of source\n    const serialized: WebAuthnRegistrationCredential = isSerialized\n      ? normalizeRegistrationCredential(credential)\n      : serializeRegistrationCredential(credential);\n\n    // Strip PRF outputs before sending to relay/contract\n    const serializedCredential = removePrfOutputGuard<WebAuthnRegistrationCredential>(serialized);\n    // Normalize transports to an array (avoid null)\n    if (!Array.isArray(serializedCredential?.response?.transports)) {\n      serializedCredential.response.transports = [];\n    }\n\n    // Prepare data for atomic endpoint\n    const intent_digest_32 = Array.from(base64UrlDecode(vrfChallenge.intentDigest || ''));\n    if (intent_digest_32.length !== 32) {\n      throw new Error('Missing or invalid vrfChallenge.intentDigest (expected base64url-encoded 32 bytes)');\n    }\n    const requestData: CreateAccountAndRegisterUserRequest = {\n      new_account_id: nearAccountId,\n      new_public_key: publicKey,\n      device_number: 1, // First device gets device number 1 (1-indexed)\n      ...(opts?.thresholdEd25519?.clientVerifyingShareB64u\n        ? {\n          threshold_ed25519: {\n            client_verifying_share_b64u: opts.thresholdEd25519.clientVerifyingShareB64u,\n          },\n        }\n        : {}),\n      vrf_data: {\n        vrf_input_data: Array.from(base64UrlDecode(vrfChallenge.vrfInput)),\n        vrf_output: Array.from(base64UrlDecode(vrfChallenge.vrfOutput)),\n        vrf_proof: Array.from(base64UrlDecode(vrfChallenge.vrfProof)),\n        public_key: Array.from(base64UrlDecode(vrfChallenge.vrfPublicKey)),\n        user_id: vrfChallenge.userId,\n        rp_id: vrfChallenge.rpId,\n        block_height: Number(vrfChallenge.blockHeight),\n        block_hash: Array.from(base64UrlDecode(vrfChallenge.blockHash)),\n        intent_digest_32,\n      },\n      webauthn_registration: serializedCredential,\n      deterministic_vrf_public_key: Array.from(base64UrlDecode(deterministicVrfPublicKey)),\n      authenticator_options: authenticatorOptions || context.configs.authenticatorOptions,\n    };\n\n    onEvent?.({\n      step: 5,\n      phase: RegistrationPhase.STEP_5_CONTRACT_REGISTRATION,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Registering user with Web3Authn contract...',\n    });\n\n    // Call the atomic endpoint\n    const response = await fetch(`${configs.relayer.url}/create_account_and_register_user`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify(requestData)\n    });\n\n    // Handle both successful and failed responses\n    const result: CreateAccountAndRegisterResult = await response.json();\n\n    if (!response.ok) {\n      // Extract specific error message from relay server response\n      const errorMessage = result.error || result.message || `HTTP ${response.status}: ${response.statusText}`;\n      throw new Error(errorMessage);\n    }\n\n    if (!result.success) {\n      throw new Error(result.error || 'Atomic registration failed');\n    }\n\n    onEvent?.({\n      step: 5,\n      phase: RegistrationPhase.STEP_5_CONTRACT_REGISTRATION,\n      status: RegistrationStatus.SUCCESS,\n      message: 'User registered with Web3Authn contract successfully',\n    });\n\n    return {\n      success: true,\n      transactionId: result.transactionHash,\n      thresholdEd25519: result.thresholdEd25519\n        ? {\n          publicKey: result.thresholdEd25519.publicKey,\n          relayerKeyId: result.thresholdEd25519.relayerKeyId,\n          relayerVerifyingShareB64u: result.thresholdEd25519.relayerVerifyingShareB64u,\n          clientParticipantId: result.thresholdEd25519.clientParticipantId,\n          relayerParticipantId: result.thresholdEd25519.relayerParticipantId,\n          participantIds: result.thresholdEd25519.participantIds,\n        }\n        : undefined,\n    };\n\n  } catch (error: unknown) {\n    console.error('Atomic registration failed:', error);\n\n    onEvent?.({\n      step: 0,\n      phase: RegistrationPhase.REGISTRATION_ERROR,\n      status: RegistrationStatus.ERROR,\n      message: 'Registration failed',\n      error: errorMessage(error),\n    });\n\n    return {\n      success: false,\n      error: errorMessage(error),\n    };\n  }\n}\n"],"mappings":";;;;;;;AAWA,SAAS,mCACP,YAC8C;AAC9C,KAAI,CAACA,4BAAS,YAAa,QAAO;CAClC,MAAM,OAAQ,WAAsC;AACpD,KAAI,CAACA,4BAAS,MAAO,QAAO;AAC5B,QAAO,OAAQ,KAAyC,sBAAsB;;;;;;;AAkChF,eAAsB,wCACpB,SACA,eACA,WACA,YACA,cACA,2BACA,sBACA,SACA,MAiBC;CACD,MAAM,EAAE,YAAY;AAEpB,KAAI,CAAC,QAAQ,QAAQ,IACnB,OAAM,IAAI,MAAM;AAGlB,KAAI;AACF,YAAU;GACR,MAAM;GACN,OAAOC,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;EAKX,MAAM,eAAe,mCAAmC;EAGxD,MAAMC,aAA6C,eAC/CC,2DAAgC,cAChCC,2DAAgC;EAGpC,MAAM,uBAAuBC,gDAAqD;AAElF,MAAI,CAAC,MAAM,QAAQ,sBAAsB,UAAU,YACjD,sBAAqB,SAAS,aAAa;EAI7C,MAAM,mBAAmB,MAAM,KAAKC,+BAAgB,aAAa,gBAAgB;AACjF,MAAI,iBAAiB,WAAW,GAC9B,OAAM,IAAI,MAAM;EAElB,MAAMC,cAAmD;GACvD,gBAAgB;GAChB,gBAAgB;GAChB,eAAe;GACf,GAAI,MAAM,kBAAkB,2BACxB,EACA,mBAAmB,EACjB,6BAA6B,KAAK,iBAAiB,+BAGrD;GACJ,UAAU;IACR,gBAAgB,MAAM,KAAKD,+BAAgB,aAAa;IACxD,YAAY,MAAM,KAAKA,+BAAgB,aAAa;IACpD,WAAW,MAAM,KAAKA,+BAAgB,aAAa;IACnD,YAAY,MAAM,KAAKA,+BAAgB,aAAa;IACpD,SAAS,aAAa;IACtB,OAAO,aAAa;IACpB,cAAc,OAAO,aAAa;IAClC,YAAY,MAAM,KAAKA,+BAAgB,aAAa;IACpD;;GAEF,uBAAuB;GACvB,8BAA8B,MAAM,KAAKA,+BAAgB;GACzD,uBAAuB,wBAAwB,QAAQ,QAAQ;;AAGjE,YAAU;GACR,MAAM;GACN,OAAON,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;EAIX,MAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,QAAQ,IAAI,oCAAoC;GACtF,QAAQ;GACR,SAAS,EAAE,gBAAgB;GAC3B,MAAM,KAAK,UAAU;;EAIvB,MAAMO,SAAyC,MAAM,SAAS;AAE9D,MAAI,CAAC,SAAS,IAAI;GAEhB,MAAMC,iBAAe,OAAO,SAAS,OAAO,WAAW,QAAQ,SAAS,OAAO,IAAI,SAAS;AAC5F,SAAM,IAAI,MAAMA;;AAGlB,MAAI,CAAC,OAAO,QACV,OAAM,IAAI,MAAM,OAAO,SAAS;AAGlC,YAAU;GACR,MAAM;GACN,OAAOT,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;AAGX,SAAO;GACL,SAAS;GACT,eAAe,OAAO;GACtB,kBAAkB,OAAO,mBACrB;IACA,WAAW,OAAO,iBAAiB;IACnC,cAAc,OAAO,iBAAiB;IACtC,2BAA2B,OAAO,iBAAiB;IACnD,qBAAqB,OAAO,iBAAiB;IAC7C,sBAAsB,OAAO,iBAAiB;IAC9C,gBAAgB,OAAO,iBAAiB;OAExC;;UAGCS,OAAgB;AACvB,UAAQ,MAAM,+BAA+B;AAE7C,YAAU;GACR,MAAM;GACN,OAAOV,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;GACT,OAAOQ,4BAAa;;AAGtB,SAAO;GACL,SAAS;GACT,OAAOA,4BAAa"}