@tatchi-xyz/sdk 0.21.0 → 0.31.1

package/dist/cjs/react/sdk/src/core/TatchiPasskey/registration.js

@@ -1,340 +0,0 @@
-const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.js');
-const require_validation = require('../../utils/validation.js');
-const require_errors = require('../../utils/errors.js');
-const require_sdkSentEvents = require('../types/sdkSentEvents.js');
-const require_createAccountRelayServer = require('./faucets/createAccountRelayServer.js');
-
-//#region src/core/TatchiPasskey/registration.ts
-require_validation.init_validation();
-require_sdkSentEvents.init_sdkSentEvents();
-require_errors.init_errors();
-/**
-* Core registration function that handles passkey registration
-*
-* VRF Registration Flow (Single VRF Keypair):
-* 1. Generate VRF keypair (ed25519) using crypto.randomUUID() + persist in worker memory
-* 2. Generate VRF proof + output using the VRF keypair
-*    - VRF input with domain separator + NEAR block height + hash
-* 3. Use VRF output as WebAuthn challenge in registration ceremony
-* 4. Derive AES key from WebAuthn PRF output and encrypt the SAME VRF keypair
-* 5. Store encrypted VRF keypair in IndexedDB
-* 6. Call contract verify_registration_response with VRF proof + WebAuthn registration payload
-* 7. Contract verifies VRF proof and WebAuthn registration (challenges match!)
-* 8. Contract stores VRF pubkey + authenticator credentials on-chain for
-*    future stateless authentication
-*/
-async function registerPasskeyInternal(context, nearAccountId, options, authenticatorOptions, confirmationConfigOverride) {
-	const { onEvent, onError, afterCall } = options;
-	const { webAuthnManager, configs } = context;
-	const registrationState = {
-		accountCreated: false,
-		contractRegistered: false,
-		databaseStored: false,
-		contractTransactionId: null
-	};
-	console.log("⚡ Registration: Passkey registration with VRF WebAuthn");
-	onEvent?.({
-		step: 1,
-		phase: require_sdkSentEvents.RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,
-		status: require_sdkSentEvents.RegistrationStatus.PROGRESS,
-		message: `Starting registration for ${nearAccountId}`
-	});
-	try {
-		await validateRegistrationInputs(context, nearAccountId, onEvent, onError);
-		onEvent?.({
-			step: 1,
-			phase: require_sdkSentEvents.RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,
-			status: require_sdkSentEvents.RegistrationStatus.PROGRESS,
-			message: "Account available - generating VRF credentials..."
-		});
-		const confirmationConfig = {
-			uiMode: "modal",
-			behavior: "requireClick",
-			theme: context.configs?.walletTheme === "light" ? "light" : "dark",
-			...confirmationConfigOverride ?? options?.confirmationConfig ?? {}
-		};
-		const registrationSession = await context.webAuthnManager.requestRegistrationCredentialConfirmation({
-			nearAccountId: String(nearAccountId),
-			deviceNumber: 1,
-			confirmerText: options?.confirmerText,
-			confirmationConfigOverride: confirmationConfig
-		});
-		const credential = registrationSession.credential;
-		const vrfChallenge = registrationSession.vrfChallenge;
-		onEvent?.({
-			step: 1,
-			phase: require_sdkSentEvents.RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,
-			status: require_sdkSentEvents.RegistrationStatus.SUCCESS,
-			message: "WebAuthn ceremony successful"
-		});
-		const canRegisterUserPromise = webAuthnManager.checkCanRegisterUser({
-			contractId: context.configs.contractId,
-			credential,
-			vrfChallenge,
-			onEvent: (progress) => {
-				console.debug(`Registration progress: ${progress.step} - ${progress.message}`);
-				onEvent?.({
-					step: 3,
-					phase: require_sdkSentEvents.RegistrationPhase.STEP_3_CONTRACT_PRE_CHECK,
-					status: require_sdkSentEvents.RegistrationStatus.PROGRESS,
-					message: `Pre-check: ${progress.message}`
-				});
-			}
-		});
-		const deterministicVrfKeyResult = await webAuthnManager.deriveVrfKeypair({
-			credential,
-			nearAccountId,
-			saveInMemory: true
-		});
-		if (!deterministicVrfKeyResult.success || !deterministicVrfKeyResult.vrfPublicKey) throw new Error("Failed to derive deterministic VRF keypair from PRF");
-		const nearKeyResult = await webAuthnManager.deriveNearKeypairAndEncryptFromSerialized({
-			credential,
-			nearAccountId,
-			options: { deviceNumber: 1 }
-		});
-		if (!nearKeyResult.success || !nearKeyResult.publicKey) {
-			const reason = nearKeyResult?.error || "Failed to generate NEAR keypair with PRF";
-			throw new Error(reason);
-		}
-		const canRegisterUserResult = await canRegisterUserPromise;
-		if (!canRegisterUserResult.verified) {
-			console.error(canRegisterUserResult);
-			const errorMessage = canRegisterUserResult.error || "User verification failed - account may already exist or contract is unreachable";
-			throw new Error(`Web3Authn contract registration check failed: ${errorMessage}`);
-		}
-		onEvent?.({
-			step: 2,
-			phase: require_sdkSentEvents.RegistrationPhase.STEP_2_KEY_GENERATION,
-			status: require_sdkSentEvents.RegistrationStatus.SUCCESS,
-			message: "Wallet keys derived successfully from TouchId",
-			verified: true,
-			nearAccountId,
-			nearPublicKey: nearKeyResult.publicKey,
-			vrfPublicKey: vrfChallenge.vrfPublicKey
-		});
-		let accountAndRegistrationResult;
-		accountAndRegistrationResult = await require_createAccountRelayServer.createAccountAndRegisterWithRelayServer(context, nearAccountId, nearKeyResult.publicKey, credential, vrfChallenge, deterministicVrfKeyResult.vrfPublicKey, authenticatorOptions, onEvent);
-		if (!accountAndRegistrationResult.success) throw new Error(accountAndRegistrationResult.error || "Account creation and registration failed");
-		registrationState.accountCreated = true;
-		registrationState.contractRegistered = true;
-		registrationState.contractTransactionId = accountAndRegistrationResult.transactionId || null;
-		onEvent?.({
-			step: 6,
-			phase: require_sdkSentEvents.RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,
-			status: require_sdkSentEvents.RegistrationStatus.PROGRESS,
-			message: "Verifying on-chain access key matches expected public key..."
-		});
-		const accessKeyVerified = await verifyAccountAccessKeyMatches(context.nearClient, nearAccountId, nearKeyResult.publicKey);
-		if (!accessKeyVerified) throw new Error("On-chain access key mismatch or not found after registration");
-		onEvent?.({
-			step: 6,
-			phase: require_sdkSentEvents.RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,
-			status: require_sdkSentEvents.RegistrationStatus.SUCCESS,
-			message: "Access key verified on-chain"
-		});
-		onEvent?.({
-			step: 7,
-			phase: require_sdkSentEvents.RegistrationPhase.STEP_7_DATABASE_STORAGE,
-			status: require_sdkSentEvents.RegistrationStatus.PROGRESS,
-			message: "Storing VRF registration data"
-		});
-		await webAuthnManager.atomicStoreRegistrationData({
-			nearAccountId,
-			credential,
-			publicKey: nearKeyResult.publicKey,
-			encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,
-			vrfPublicKey: deterministicVrfKeyResult.vrfPublicKey,
-			serverEncryptedVrfKeypair: deterministicVrfKeyResult.serverEncryptedVrfKeypair
-		});
-		registrationState.databaseStored = true;
-		onEvent?.({
-			step: 7,
-			phase: require_sdkSentEvents.RegistrationPhase.STEP_7_DATABASE_STORAGE,
-			status: require_sdkSentEvents.RegistrationStatus.SUCCESS,
-			message: "VRF registration data stored successfully"
-		});
-		try {
-			context.webAuthnManager.getNonceManager().initializeUser(nearAccountId, nearKeyResult.publicKey);
-			await context.webAuthnManager.getNonceManager().prefetchBlockheight(context.nearClient);
-		} catch {}
-		let vrfStatus = await webAuthnManager.checkVrfStatus().catch(() => ({ active: false }));
-		if (!vrfStatus?.active) {
-			const blockInfo = await context.nearClient.viewBlock({ finality: "final" });
-			const txBlockHash = blockInfo?.header?.hash;
-			const txBlockHeight = String(blockInfo.header?.height ?? "");
-			const vrfChallenge2 = await webAuthnManager.generateVrfChallengeOnce({
-				userId: nearAccountId,
-				rpId: webAuthnManager.getRpId(),
-				blockHash: txBlockHash,
-				blockHeight: txBlockHeight
-			});
-			const authenticators = await webAuthnManager.getAuthenticatorsByUser(nearAccountId);
-			const authCredential = await webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({
-				nearAccountId,
-				challenge: vrfChallenge2,
-				credentialIds: authenticators.map((a) => a.credentialId)
-			});
-			const unlockResult = await webAuthnManager.unlockVRFKeypair({
-				nearAccountId,
-				encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,
-				credential: authCredential
-			}).catch((unlockError) => {
-				return {
-					success: false,
-					error: unlockError.message
-				};
-			});
-			if (!unlockResult.success) {
-				console.warn("VRF keypair unlock failed:", unlockResult.error);
-				throw new Error(unlockResult.error);
-			}
-		} else console.debug("Registration: VRF session already active; skipping extra Touch ID unlock");
-		try {
-			await webAuthnManager.initializeCurrentUser(nearAccountId, context.nearClient);
-		} catch (initErr) {
-			console.warn("Failed to initialize current user after registration:", initErr);
-		}
-		onEvent?.({
-			step: 8,
-			phase: require_sdkSentEvents.RegistrationPhase.STEP_8_REGISTRATION_COMPLETE,
-			status: require_sdkSentEvents.RegistrationStatus.SUCCESS,
-			message: "Registration completed!"
-		});
-		const successResult = {
-			success: true,
-			nearAccountId,
-			clientNearPublicKey: nearKeyResult.publicKey,
-			transactionId: registrationState.contractTransactionId,
-			vrfRegistration: {
-				success: true,
-				vrfPublicKey: vrfChallenge.vrfPublicKey,
-				encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,
-				contractVerified: accountAndRegistrationResult.success
-			}
-		};
-		afterCall?.(true, successResult);
-		return successResult;
-	} catch (error) {
-		console.error("Registration failed:", error.message, error.stack);
-		await performRegistrationRollback(registrationState, nearAccountId, webAuthnManager, configs.nearRpcUrl, onEvent);
-		const errorMessage = require_errors.getUserFriendlyErrorMessage(error, "registration", nearAccountId);
-		const errorObject = new Error(errorMessage);
-		onError?.(errorObject);
-		onEvent?.({
-			step: 0,
-			phase: require_sdkSentEvents.RegistrationPhase.REGISTRATION_ERROR,
-			status: require_sdkSentEvents.RegistrationStatus.ERROR,
-			message: errorMessage,
-			error: errorMessage
-		});
-		const result = {
-			success: false,
-			error: errorMessage
-		};
-		afterCall?.(false);
-		return result;
-	}
-}
-async function registerPasskey(context, nearAccountId, options, authenticatorOptions) {
-	return registerPasskeyInternal(context, nearAccountId, options, authenticatorOptions, void 0);
-}
-/**
-* Validates registration inputs and throws errors if invalid
-* @param nearAccountId - NEAR account ID to validate
-* @param onEvent - Optional callback for registration progress events
-* @param onError - Optional callback for error handling
-*/
-const validateRegistrationInputs = async (context, nearAccountId, onEvent, onError) => {
-	onEvent?.({
-		step: 1,
-		phase: require_sdkSentEvents.RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,
-		status: require_sdkSentEvents.RegistrationStatus.PROGRESS,
-		message: "Validating registration inputs..."
-	});
-	if (!nearAccountId) {
-		const error = /* @__PURE__ */ new Error("NEAR account ID is required for registration.");
-		onError?.(error);
-		throw error;
-	}
-	const validation = require_validation.validateNearAccountId(nearAccountId);
-	if (!validation.valid) {
-		const error = /* @__PURE__ */ new Error(`Invalid NEAR account ID: ${validation.error}`);
-		onError?.(error);
-		throw error;
-	}
-	if (!window.isSecureContext) {
-		const error = /* @__PURE__ */ new Error("Passkey operations require a secure context (HTTPS or localhost).");
-		onError?.(error);
-		throw error;
-	}
-	onEvent?.({
-		step: 1,
-		phase: require_sdkSentEvents.RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,
-		status: require_sdkSentEvents.RegistrationStatus.PROGRESS,
-		message: `Account format validated, preparing confirmation`
-	});
-};
-/**
-* Rollback registration data in case of errors
-*/
-async function performRegistrationRollback(registrationState, nearAccountId, webAuthnManager, rpcNodeUrl, onEvent) {
-	console.debug("Starting registration rollback...", registrationState);
-	try {
-		await webAuthnManager.clearVrfSession();
-		if (registrationState.databaseStored) {
-			console.debug("Rolling back database storage...");
-			onEvent?.({
-				step: 0,
-				phase: require_sdkSentEvents.RegistrationPhase.REGISTRATION_ERROR,
-				status: require_sdkSentEvents.RegistrationStatus.ERROR,
-				message: "Rolling back database storage...",
-				error: "Registration failed - rolling back database storage"
-			});
-			await webAuthnManager.rollbackUserRegistration(nearAccountId);
-			console.debug("Database rollback completed");
-		}
-		if (registrationState.contractRegistered) {
-			console.debug("Contract registration cannot be rolled back (immutable blockchain state)");
-			onEvent?.({
-				step: 0,
-				phase: require_sdkSentEvents.RegistrationPhase.REGISTRATION_ERROR,
-				status: require_sdkSentEvents.RegistrationStatus.ERROR,
-				message: `Contract registration (tx: ${registrationState.contractTransactionId}) cannot be rolled back`,
-				error: "Registration failed - contract state is immutable"
-			});
-		}
-		console.debug("Registration rollback completed");
-	} catch (rollbackError) {
-		console.error("Rollback failed:", rollbackError);
-		onEvent?.({
-			step: 0,
-			phase: require_sdkSentEvents.RegistrationPhase.REGISTRATION_ERROR,
-			status: require_sdkSentEvents.RegistrationStatus.ERROR,
-			message: `Rollback failed: ${rollbackError.message}`,
-			error: "Both registration and rollback failed"
-		});
-	}
-}
-/**
-* Poll the NEAR RPC to verify the newly created account exposes the expected public key
-* Retries a few times to tolerate RPC indexing delays after transaction finalization.
-*/
-async function verifyAccountAccessKeyMatches(nearClient, nearAccountId, expectedPublicKey, opts) {
-	const attempts = Math.max(1, Math.floor(opts?.attempts ?? 5));
-	const delayMs = Math.max(50, Math.floor(opts?.delayMs ?? 750));
-	for (let i = 0; i < attempts; i++) {
-		try {
-			const { fullAccessKeys, functionCallAccessKeys } = await nearClient.getAccessKeys({ account: nearAccountId });
-			const keys = [...fullAccessKeys, ...functionCallAccessKeys];
-			const found = keys.some((k) => String(k?.public_key || "") === expectedPublicKey);
-			if (found) return true;
-		} catch (e) {}
-		await new Promise((res) => setTimeout(res, delayMs));
-	}
-	return false;
-}
-
-//#endregion
-exports.registerPasskey = registerPasskey;
-exports.registerPasskeyInternal = registerPasskeyInternal;
-//# sourceMappingURL=registration.js.map

package/dist/cjs/react/sdk/src/core/TatchiPasskey/registration.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"registration.js","names":["RegistrationPhase","RegistrationStatus","confirmationConfig: Partial<ConfirmationConfig>","createAccountAndRegisterWithRelayServer","error: any","getUserFriendlyErrorMessage","validateNearAccountId","rollbackError: any"],"sources":["../../../../../../../src/core/TatchiPasskey/registration.ts"],"sourcesContent":["import type { NearClient, SignedTransaction } from '../NearClient';\nimport { validateNearAccountId } from '../../utils/validation';\nimport type {\n  RegistrationHooksOptions,\n  RegistrationSSEEvent,\n} from '../types/sdkSentEvents';\nimport type { RegistrationResult, TatchiConfigs } from '../types/tatchi';\nimport type { AuthenticatorOptions } from '../types/authenticatorOptions';\nimport { RegistrationPhase, RegistrationStatus } from '../types/sdkSentEvents';\nimport {\n  createAccountAndRegisterWithRelayServer\n} from './faucets/createAccountRelayServer';\nimport { PasskeyManagerContext } from './index';\nimport { WebAuthnManager } from '../WebAuthnManager';\nimport { VRFChallenge } from '../types/vrf-worker';\nimport type { ConfirmationConfig } from '../types/signer-worker';\nimport type { WebAuthnRegistrationCredential } from '../types/webauthn';\nimport type { AccountId } from '../types/accountIds';\nimport { getUserFriendlyErrorMessage } from '../../utils/errors';\nimport { authenticatorsToAllowCredentials } from '../WebAuthnManager/touchIdPrompt';\n// Registration forces a visible, clickable confirmation for cross‑origin safety\n\n/**\n * Core registration function that handles passkey registration\n *\n * VRF Registration Flow (Single VRF Keypair):\n * 1. Generate VRF keypair (ed25519) using crypto.randomUUID() + persist in worker memory\n * 2. Generate VRF proof + output using the VRF keypair\n *    - VRF input with domain separator + NEAR block height + hash\n * 3. Use VRF output as WebAuthn challenge in registration ceremony\n * 4. Derive AES key from WebAuthn PRF output and encrypt the SAME VRF keypair\n * 5. Store encrypted VRF keypair in IndexedDB\n * 6. Call contract verify_registration_response with VRF proof + WebAuthn registration payload\n * 7. Contract verifies VRF proof and WebAuthn registration (challenges match!)\n * 8. Contract stores VRF pubkey + authenticator credentials on-chain for\n *    future stateless authentication\n */\nexport async function registerPasskeyInternal(\n  context: PasskeyManagerContext,\n  nearAccountId: AccountId,\n  options: RegistrationHooksOptions,\n  authenticatorOptions: AuthenticatorOptions,\n  confirmationConfigOverride?: Partial<ConfirmationConfig>\n): Promise<RegistrationResult> {\n\n  const { onEvent, onError, afterCall } = options;\n  const { webAuthnManager, configs } = context;\n\n  // Track registration progress for rollback\n  const registrationState = {\n    accountCreated: false,\n    contractRegistered: false,\n    databaseStored: false,\n    contractTransactionId: null as string | null,\n  };\n\n  console.log('⚡ Registration: Passkey registration with VRF WebAuthn');\n  onEvent?.({\n    step: 1,\n    phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n    status: RegistrationStatus.PROGRESS,\n    message: `Starting registration for ${nearAccountId}`\n  } as RegistrationSSEEvent);\n\n  try {\n\n    await validateRegistrationInputs(context, nearAccountId, onEvent, onError);\n\n    onEvent?.({\n      step: 1,\n      phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Account available - generating VRF credentials...'\n    });\n\n    const confirmationConfig: Partial<ConfirmationConfig> = {\n      uiMode: 'modal',\n      behavior: 'requireClick', // cross‑origin safari requirement: must requireClick\n      theme: (context.configs?.walletTheme === 'light') ? 'light' : 'dark',\n      ...(confirmationConfigOverride ?? options?.confirmationConfig ?? {}),\n    };\n\n    const registrationSession = await context.webAuthnManager.requestRegistrationCredentialConfirmation({\n      nearAccountId: String(nearAccountId),\n      deviceNumber: 1,\n      confirmerText: options?.confirmerText,\n      confirmationConfigOverride: confirmationConfig,\n    });\n\n    const credential = registrationSession.credential;\n    const vrfChallenge = registrationSession.vrfChallenge;\n\n    onEvent?.({\n      step: 1,\n      phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n      status: RegistrationStatus.SUCCESS,\n      message: 'WebAuthn ceremony successful'\n    });\n\n    // Start the contract pre-check, run it in parallel to key derivation (await later)\n    const canRegisterUserPromise = webAuthnManager.checkCanRegisterUser({\n      contractId: context.configs.contractId,\n      credential,\n      vrfChallenge,\n      onEvent: (progress) => {\n        console.debug(`Registration progress: ${progress.step} - ${progress.message}`);\n        onEvent?.({\n          step: 3,\n          phase: RegistrationPhase.STEP_3_CONTRACT_PRE_CHECK,\n          status: RegistrationStatus.PROGRESS,\n          message: `Pre-check: ${progress.message}`\n        });\n      },\n    });\n\n    // 1) Ensure VRF keypair is derived and loaded in-memory\n    // before deriving WrapKeySeed for NEAR key encryption\n    const deterministicVrfKeyResult = await webAuthnManager.deriveVrfKeypair({\n      credential,\n      nearAccountId,\n      saveInMemory: true,\n    });\n    if (!deterministicVrfKeyResult.success || !deterministicVrfKeyResult.vrfPublicKey) {\n      throw new Error('Failed to derive deterministic VRF keypair from PRF');\n    }\n\n    // 2) Derive NEAR key after VRF keypair exists\n    const nearKeyResult = await webAuthnManager.deriveNearKeypairAndEncryptFromSerialized({\n      credential,\n      nearAccountId,\n      options: { deviceNumber: 1 },\n    });\n    if (!nearKeyResult.success || !nearKeyResult.publicKey) {\n      const reason = nearKeyResult?.error || 'Failed to generate NEAR keypair with PRF';\n      throw new Error(reason);\n    }\n\n    // 3) Await contract registration check (main blocker)\n    const canRegisterUserResult = await canRegisterUserPromise;\n    if (!canRegisterUserResult.verified) {\n      console.error(canRegisterUserResult);\n      const errorMessage = canRegisterUserResult.error || 'User verification failed - account may already exist or contract is unreachable';\n      throw new Error(`Web3Authn contract registration check failed: ${errorMessage}`);\n    }\n\n    // Step 4-5: Create account and register with contract using the relay (atomic)\n    onEvent?.({\n      step: 2,\n      phase: RegistrationPhase.STEP_2_KEY_GENERATION,\n      status: RegistrationStatus.SUCCESS,\n      message: 'Wallet keys derived successfully from TouchId',\n      verified: true,\n      nearAccountId: nearAccountId,\n      nearPublicKey: nearKeyResult.publicKey,\n      vrfPublicKey: vrfChallenge.vrfPublicKey,\n    });\n\n    let accountAndRegistrationResult;\n    accountAndRegistrationResult = await createAccountAndRegisterWithRelayServer(\n      context,\n      nearAccountId,\n      nearKeyResult.publicKey,\n      credential,\n      vrfChallenge,\n      deterministicVrfKeyResult.vrfPublicKey,\n      authenticatorOptions,\n      onEvent,\n    );\n\n    if (!accountAndRegistrationResult.success) {\n      throw new Error(accountAndRegistrationResult.error || 'Account creation and registration failed');\n    }\n\n    // Update registration state based on results\n    registrationState.accountCreated = true;\n    registrationState.contractRegistered = true;\n    registrationState.contractTransactionId = accountAndRegistrationResult.transactionId || null;\n\n    // Step 6: Post-commit verification: ensure on-chain access key matches expected public key\n    onEvent?.({\n      step: 6,\n      phase: RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Verifying on-chain access key matches expected public key...'\n    });\n\n    const accessKeyVerified = await verifyAccountAccessKeyMatches(\n      context.nearClient,\n      nearAccountId,\n      nearKeyResult.publicKey\n    );\n\n    if (!accessKeyVerified) {\n      throw new Error('On-chain access key mismatch or not found after registration');\n    }\n\n    onEvent?.({\n      step: 6,\n      phase: RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,\n      status: RegistrationStatus.SUCCESS,\n      message: 'Access key verified on-chain'\n    });\n\n    // Step 7: Store user data with VRF credentials atomically\n    onEvent?.({\n      step: 7,\n      phase: RegistrationPhase.STEP_7_DATABASE_STORAGE,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Storing VRF registration data'\n    });\n\n    await webAuthnManager.atomicStoreRegistrationData({\n      nearAccountId,\n      credential,\n      publicKey: nearKeyResult.publicKey,\n      encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,\n      vrfPublicKey: deterministicVrfKeyResult.vrfPublicKey,\n      serverEncryptedVrfKeypair: deterministicVrfKeyResult.serverEncryptedVrfKeypair,\n    });\n\n    // Mark database as stored for rollback tracking\n    registrationState.databaseStored = true;\n\n    onEvent?.({\n      step: 7,\n      phase: RegistrationPhase.STEP_7_DATABASE_STORAGE,\n      status: RegistrationStatus.SUCCESS,\n      message: 'VRF registration data stored successfully'\n    });\n\n    // Initialize NonceManager with newly stored user before fetching block/nonce\n    try {\n      context.webAuthnManager.getNonceManager().initializeUser(nearAccountId, nearKeyResult.publicKey);\n      await context.webAuthnManager.getNonceManager().prefetchBlockheight(context.nearClient);\n    } catch {}\n\n    // Step 7: Ensure VRF session is active for auto-login\n    // If VRF keypair is already in-memory (saved earlier), skip an extra Touch ID prompt.\n    let vrfStatus = await webAuthnManager.checkVrfStatus().catch(() => ({ active: false }));\n    if (!vrfStatus?.active) {\n      // Obtain an authentication credential for VRF unlock (separate from registration credential)\n      // IMPORTANT: Immediately after account creation, the new access key may not be queryable yet on some RPC nodes.\n      // We only need fresh block info for the VRF challenge here, so fetch the block directly to avoid AK lookup failures.\n      const blockInfo = await context.nearClient.viewBlock({ finality: 'final' });\n      const txBlockHash = blockInfo?.header?.hash;\n      const txBlockHeight = String(blockInfo.header?.height ?? '');\n      const vrfChallenge2 = await webAuthnManager.generateVrfChallengeOnce({\n        userId: nearAccountId,\n        rpId: webAuthnManager.getRpId(),\n        blockHash: txBlockHash,\n        blockHeight: txBlockHeight,\n      });\n      const authenticators = await webAuthnManager.getAuthenticatorsByUser(nearAccountId);\n      const authCredential = await webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({\n        nearAccountId,\n        challenge: vrfChallenge2,\n        credentialIds: authenticators.map((a) => a.credentialId),\n      });\n      const unlockResult = await webAuthnManager.unlockVRFKeypair({\n        nearAccountId: nearAccountId,\n        encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,\n        credential: authCredential,\n      }).catch((unlockError: any) => {\n        return { success: false, error: unlockError.message };\n      });\n\n      if (!unlockResult.success) {\n        console.warn('VRF keypair unlock failed:', unlockResult.error);\n        throw new Error(unlockResult.error);\n      }\n    } else {\n      console.debug('Registration: VRF session already active; skipping extra Touch ID unlock');\n    }\n\n    // Initialize current user only after a successful unlock\n    try {\n      await webAuthnManager.initializeCurrentUser(nearAccountId, context.nearClient);\n    } catch (initErr) {\n      console.warn('Failed to initialize current user after registration:', initErr);\n    }\n\n    onEvent?.({\n      step: 8,\n      phase: RegistrationPhase.STEP_8_REGISTRATION_COMPLETE,\n      status: RegistrationStatus.SUCCESS,\n      message: 'Registration completed!'\n    });\n\n    const successResult = {\n      success: true,\n      nearAccountId: nearAccountId,\n      clientNearPublicKey: nearKeyResult.publicKey,\n      transactionId: registrationState.contractTransactionId,\n      vrfRegistration: {\n        success: true,\n        vrfPublicKey: vrfChallenge.vrfPublicKey,\n        encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,\n        contractVerified: accountAndRegistrationResult.success,\n      }\n    };\n\n    afterCall?.(true, successResult);\n    return successResult;\n\n  } catch (error: any) {\n    console.error('Registration failed:', error.message, error.stack);\n\n    // Perform rollback based on registration state\n    await performRegistrationRollback(\n      registrationState,\n      nearAccountId,\n      webAuthnManager,\n      configs.nearRpcUrl,\n      onEvent\n    );\n\n    // Use centralized error handling\n    const errorMessage = getUserFriendlyErrorMessage(error, 'registration', nearAccountId);\n\n    const errorObject = new Error(errorMessage);\n    onError?.(errorObject);\n\n    onEvent?.({\n      step: 0,\n      phase: RegistrationPhase.REGISTRATION_ERROR,\n      status: RegistrationStatus.ERROR,\n      message: errorMessage,\n      error: errorMessage\n    } as RegistrationSSEEvent);\n\n    const result = { success: false, error: errorMessage };\n    afterCall?.(false);\n    return result;\n  }\n}\n\n// Backward-compatible wrapper without explicit confirmationConfig override\nexport async function registerPasskey(\n  context: PasskeyManagerContext,\n  nearAccountId: AccountId,\n  options: RegistrationHooksOptions,\n  authenticatorOptions: AuthenticatorOptions\n): Promise<RegistrationResult> {\n  return registerPasskeyInternal(context, nearAccountId, options, authenticatorOptions, undefined);\n}\n\n//////////////////////////////////////\n// HELPER FUNCTIONS\n//////////////////////////////////////\n\n/**\n * Generate a VRF keypair + challenge in VRF wasm worker for WebAuthn registration ceremony bootstrapping\n *\n * ARCHITECTURE: This function solves the chicken-and-egg problem with a single VRF keypair:\n * 1. Generate VRF keypair + challenge (no PRF needed)\n * 2. Persist VRF keypair in worker memory (NOT encrypted yet)\n * 3. Use VRF challenge for WebAuthn ceremony → get PRF output\n * 4. Encrypt the SAME VRF keypair (still in memory) with PRF\n *\n * @param webAuthnManager - WebAuthn manager instance\n * @param nearAccountId - NEAR account ID for VRF input\n * @param blockHeight - Current NEAR block height for freshness\n * @param blockHashBytes - Current NEAR block hash bytes for entropy\n * @returns VRF challenge data (VRF keypair persisted in worker memory)\n */\nexport async function generateBootstrapVrfChallenge(\n  context: PasskeyManagerContext,\n  nearAccountId: AccountId,\n): Promise<VRFChallenge> {\n\n  const { webAuthnManager, nearClient } = context;\n\n  const blockInfo = await nearClient.viewBlock({ finality: 'final' });\n\n  // Generate VRF keypair and persist in worker memory\n  const vrfResult = await webAuthnManager.generateVrfKeypairBootstrap({\n    vrfInputData: {\n      userId: nearAccountId,\n      // Keep VRF rpId consistent with WebAuthn rpId selection logic.\n      rpId: webAuthnManager.getRpId(),\n      blockHeight: String(blockInfo.header.height),\n      blockHash: blockInfo.header.hash,\n    },\n    saveInMemory: true,\n    // VRF keypair persists in worker memory until PRF encryption\n  });\n\n  if (!vrfResult.vrfChallenge) {\n    throw new Error('Registration VRF keypair generation failed');\n  }\n  return vrfResult.vrfChallenge;\n}\n\n/**\n * Validates registration inputs and throws errors if invalid\n * @param nearAccountId - NEAR account ID to validate\n * @param onEvent - Optional callback for registration progress events\n * @param onError - Optional callback for error handling\n */\nconst validateRegistrationInputs = async (\n  context: {\n    configs: TatchiConfigs,\n    webAuthnManager: WebAuthnManager,\n    nearClient: NearClient,\n  },\n  nearAccountId: AccountId,\n  onEvent?: (event: RegistrationSSEEvent) => void,\n  onError?: (error: Error) => void,\n) => {\n\n  onEvent?.({\n    step: 1,\n    phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n    status: RegistrationStatus.PROGRESS,\n    message: 'Validating registration inputs...'\n  } as RegistrationSSEEvent);\n\n  // Validation\n  if (!nearAccountId) {\n    const error = new Error('NEAR account ID is required for registration.');\n    onError?.(error);\n    throw error;\n  }\n  // Validate the account ID format\n  const validation = validateNearAccountId(nearAccountId);\n  if (!validation.valid) {\n    const error = new Error(`Invalid NEAR account ID: ${validation.error}`);\n    onError?.(error);\n    throw error;\n  }\n  if (!window.isSecureContext) {\n    const error = new Error('Passkey operations require a secure context (HTTPS or localhost).');\n    onError?.(error);\n    throw error;\n  }\n\n  // on-chain account existence check is performed later via signer worker (checkCanRegisterUser),\n  onEvent?.({\n    step: 1,\n    phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n    status: RegistrationStatus.PROGRESS,\n    message: `Account format validated, preparing confirmation`\n  } as RegistrationSSEEvent);\n  return;\n}\n\n/**\n * Rollback registration data in case of errors\n */\nasync function performRegistrationRollback(\n  registrationState: {\n    accountCreated: boolean;\n    contractRegistered: boolean;\n    databaseStored: boolean;\n    contractTransactionId: string | null;\n  },\n  nearAccountId: AccountId,\n  webAuthnManager: WebAuthnManager,\n  rpcNodeUrl: string,\n  onEvent?: (event: RegistrationSSEEvent) => void\n): Promise<void> {\n  console.debug('Starting registration rollback...', registrationState);\n\n  // Rollback in reverse order\n  try {\n    // 1. Always clear any in-memory VRF session established during bootstrap\n    await webAuthnManager.clearVrfSession();\n\n    // 2. Rollback database storage\n    if (registrationState.databaseStored) {\n      console.debug('Rolling back database storage...');\n      onEvent?.({\n        step: 0,\n        phase: RegistrationPhase.REGISTRATION_ERROR,\n        status: RegistrationStatus.ERROR,\n        message: 'Rolling back database storage...',\n        error: 'Registration failed - rolling back database storage'\n      } as RegistrationSSEEvent);\n\n      await webAuthnManager.rollbackUserRegistration(nearAccountId);\n      console.debug('Database rollback completed');\n    }\n\n    // 3. Contract rollback on the Web3Authn contract\n    // NOT NEEDED - account creation and contract registration are atomic in the relay server flow\n    if (registrationState.contractRegistered) {\n      console.debug('Contract registration cannot be rolled back (immutable blockchain state)');\n      onEvent?.({\n        step: 0,\n        phase: RegistrationPhase.REGISTRATION_ERROR,\n        status: RegistrationStatus.ERROR,\n        message: `Contract registration (tx: ${registrationState.contractTransactionId}) cannot be rolled back`,\n        error: 'Registration failed - contract state is immutable'\n      } as RegistrationSSEEvent);\n    }\n    console.debug('Registration rollback completed');\n\n  } catch (rollbackError: any) {\n    console.error('Rollback failed:', rollbackError);\n    onEvent?.({\n      step: 0,\n      phase: RegistrationPhase.REGISTRATION_ERROR,\n      status: RegistrationStatus.ERROR,\n      message: `Rollback failed: ${rollbackError.message}`,\n      error: 'Both registration and rollback failed'\n    } as RegistrationSSEEvent);\n  }\n}\n\n/**\n * Poll the NEAR RPC to verify the newly created account exposes the expected public key\n * Retries a few times to tolerate RPC indexing delays after transaction finalization.\n */\nasync function verifyAccountAccessKeyMatches(\n  nearClient: NearClient,\n  nearAccountId: string,\n  expectedPublicKey: string,\n  opts?: { attempts?: number; delayMs?: number }\n): Promise<boolean> {\n  const attempts = Math.max(1, Math.floor(opts?.attempts ?? 5));\n  const delayMs = Math.max(50, Math.floor(opts?.delayMs ?? 750));\n\n  for (let i = 0; i < attempts; i++) {\n    try {\n      const { fullAccessKeys, functionCallAccessKeys } = await nearClient.getAccessKeys({ account: nearAccountId });\n      const keys = [...fullAccessKeys, ...functionCallAccessKeys];\n      const found = keys.some(k => String((k as any)?.public_key || '') === expectedPublicKey);\n      if (found) return true;\n    } catch (e) {\n      // Tolerate transient view errors during propagation; retry\n    }\n    await new Promise(res => setTimeout(res, delayMs));\n  }\n  return false;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,eAAsB,wBACpB,SACA,eACA,SACA,sBACA,4BAC6B;CAE7B,MAAM,EAAE,SAAS,SAAS,cAAc;CACxC,MAAM,EAAE,iBAAiB,YAAY;CAGrC,MAAM,oBAAoB;EACxB,gBAAgB;EAChB,oBAAoB;EACpB,gBAAgB;EAChB,uBAAuB;;AAGzB,SAAQ,IAAI;AACZ,WAAU;EACR,MAAM;EACN,OAAOA,wCAAkB;EACzB,QAAQC,yCAAmB;EAC3B,SAAS,6BAA6B;;AAGxC,KAAI;AAEF,QAAM,2BAA2B,SAAS,eAAe,SAAS;AAElE,YAAU;GACR,MAAM;GACN,OAAOD,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;EAGX,MAAMC,qBAAkD;GACtD,QAAQ;GACR,UAAU;GACV,OAAQ,QAAQ,SAAS,gBAAgB,UAAW,UAAU;GAC9D,GAAI,8BAA8B,SAAS,sBAAsB;;EAGnE,MAAM,sBAAsB,MAAM,QAAQ,gBAAgB,0CAA0C;GAClG,eAAe,OAAO;GACtB,cAAc;GACd,eAAe,SAAS;GACxB,4BAA4B;;EAG9B,MAAM,aAAa,oBAAoB;EACvC,MAAM,eAAe,oBAAoB;AAEzC,YAAU;GACR,MAAM;GACN,OAAOF,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;EAIX,MAAM,yBAAyB,gBAAgB,qBAAqB;GAClE,YAAY,QAAQ,QAAQ;GAC5B;GACA;GACA,UAAU,aAAa;AACrB,YAAQ,MAAM,0BAA0B,SAAS,KAAK,KAAK,SAAS;AACpE,cAAU;KACR,MAAM;KACN,OAAOD,wCAAkB;KACzB,QAAQC,yCAAmB;KAC3B,SAAS,cAAc,SAAS;;;;EAOtC,MAAM,4BAA4B,MAAM,gBAAgB,iBAAiB;GACvE;GACA;GACA,cAAc;;AAEhB,MAAI,CAAC,0BAA0B,WAAW,CAAC,0BAA0B,aACnE,OAAM,IAAI,MAAM;EAIlB,MAAM,gBAAgB,MAAM,gBAAgB,0CAA0C;GACpF;GACA;GACA,SAAS,EAAE,cAAc;;AAE3B,MAAI,CAAC,cAAc,WAAW,CAAC,cAAc,WAAW;GACtD,MAAM,SAAS,eAAe,SAAS;AACvC,SAAM,IAAI,MAAM;;EAIlB,MAAM,wBAAwB,MAAM;AACpC,MAAI,CAAC,sBAAsB,UAAU;AACnC,WAAQ,MAAM;GACd,MAAM,eAAe,sBAAsB,SAAS;AACpD,SAAM,IAAI,MAAM,iDAAiD;;AAInE,YAAU;GACR,MAAM;GACN,OAAOD,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;GACT,UAAU;GACK;GACf,eAAe,cAAc;GAC7B,cAAc,aAAa;;EAG7B,IAAI;AACJ,iCAA+B,MAAME,yEACnC,SACA,eACA,cAAc,WACd,YACA,cACA,0BAA0B,cAC1B,sBACA;AAGF,MAAI,CAAC,6BAA6B,QAChC,OAAM,IAAI,MAAM,6BAA6B,SAAS;AAIxD,oBAAkB,iBAAiB;AACnC,oBAAkB,qBAAqB;AACvC,oBAAkB,wBAAwB,6BAA6B,iBAAiB;AAGxF,YAAU;GACR,MAAM;GACN,OAAOH,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;EAGX,MAAM,oBAAoB,MAAM,8BAC9B,QAAQ,YACR,eACA,cAAc;AAGhB,MAAI,CAAC,kBACH,OAAM,IAAI,MAAM;AAGlB,YAAU;GACR,MAAM;GACN,OAAOD,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;AAIX,YAAU;GACR,MAAM;GACN,OAAOD,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;AAGX,QAAM,gBAAgB,4BAA4B;GAChD;GACA;GACA,WAAW,cAAc;GACzB,qBAAqB,0BAA0B;GAC/C,cAAc,0BAA0B;GACxC,2BAA2B,0BAA0B;;AAIvD,oBAAkB,iBAAiB;AAEnC,YAAU;GACR,MAAM;GACN,OAAOD,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;AAIX,MAAI;AACF,WAAQ,gBAAgB,kBAAkB,eAAe,eAAe,cAAc;AACtF,SAAM,QAAQ,gBAAgB,kBAAkB,oBAAoB,QAAQ;UACtE;EAIR,IAAI,YAAY,MAAM,gBAAgB,iBAAiB,aAAa,EAAE,QAAQ;AAC9E,MAAI,CAAC,WAAW,QAAQ;GAItB,MAAM,YAAY,MAAM,QAAQ,WAAW,UAAU,EAAE,UAAU;GACjE,MAAM,cAAc,WAAW,QAAQ;GACvC,MAAM,gBAAgB,OAAO,UAAU,QAAQ,UAAU;GACzD,MAAM,gBAAgB,MAAM,gBAAgB,yBAAyB;IACnE,QAAQ;IACR,MAAM,gBAAgB;IACtB,WAAW;IACX,aAAa;;GAEf,MAAM,iBAAiB,MAAM,gBAAgB,wBAAwB;GACrE,MAAM,iBAAiB,MAAM,gBAAgB,8CAA8C;IACzF;IACA,WAAW;IACX,eAAe,eAAe,KAAK,MAAM,EAAE;;GAE7C,MAAM,eAAe,MAAM,gBAAgB,iBAAiB;IAC3C;IACf,qBAAqB,0BAA0B;IAC/C,YAAY;MACX,OAAO,gBAAqB;AAC7B,WAAO;KAAE,SAAS;KAAO,OAAO,YAAY;;;AAG9C,OAAI,CAAC,aAAa,SAAS;AACzB,YAAQ,KAAK,8BAA8B,aAAa;AACxD,UAAM,IAAI,MAAM,aAAa;;QAG/B,SAAQ,MAAM;AAIhB,MAAI;AACF,SAAM,gBAAgB,sBAAsB,eAAe,QAAQ;WAC5D,SAAS;AAChB,WAAQ,KAAK,yDAAyD;;AAGxE,YAAU;GACR,MAAM;GACN,OAAOD,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;;EAGX,MAAM,gBAAgB;GACpB,SAAS;GACM;GACf,qBAAqB,cAAc;GACnC,eAAe,kBAAkB;GACjC,iBAAiB;IACf,SAAS;IACT,cAAc,aAAa;IAC3B,qBAAqB,0BAA0B;IAC/C,kBAAkB,6BAA6B;;;AAInD,cAAY,MAAM;AAClB,SAAO;UAEAG,OAAY;AACnB,UAAQ,MAAM,wBAAwB,MAAM,SAAS,MAAM;AAG3D,QAAM,4BACJ,mBACA,eACA,iBACA,QAAQ,YACR;EAIF,MAAM,eAAeC,2CAA4B,OAAO,gBAAgB;EAExE,MAAM,cAAc,IAAI,MAAM;AAC9B,YAAU;AAEV,YAAU;GACR,MAAM;GACN,OAAOL,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS;GACT,OAAO;;EAGT,MAAM,SAAS;GAAE,SAAS;GAAO,OAAO;;AACxC,cAAY;AACZ,SAAO;;;AAKX,eAAsB,gBACpB,SACA,eACA,SACA,sBAC6B;AAC7B,QAAO,wBAAwB,SAAS,eAAe,SAAS,sBAAsB;;;;;;;;AAwDxF,MAAM,6BAA6B,OACjC,SAKA,eACA,SACA,YACG;AAEH,WAAU;EACR,MAAM;EACN,OAAOD,wCAAkB;EACzB,QAAQC,yCAAmB;EAC3B,SAAS;;AAIX,KAAI,CAAC,eAAe;EAClB,MAAM,wBAAQ,IAAI,MAAM;AACxB,YAAU;AACV,QAAM;;CAGR,MAAM,aAAaK,yCAAsB;AACzC,KAAI,CAAC,WAAW,OAAO;EACrB,MAAM,wBAAQ,IAAI,MAAM,4BAA4B,WAAW;AAC/D,YAAU;AACV,QAAM;;AAER,KAAI,CAAC,OAAO,iBAAiB;EAC3B,MAAM,wBAAQ,IAAI,MAAM;AACxB,YAAU;AACV,QAAM;;AAIR,WAAU;EACR,MAAM;EACN,OAAON,wCAAkB;EACzB,QAAQC,yCAAmB;EAC3B,SAAS;;;;;;AAQb,eAAe,4BACb,mBAMA,eACA,iBACA,YACA,SACe;AACf,SAAQ,MAAM,qCAAqC;AAGnD,KAAI;AAEF,QAAM,gBAAgB;AAGtB,MAAI,kBAAkB,gBAAgB;AACpC,WAAQ,MAAM;AACd,aAAU;IACR,MAAM;IACN,OAAOD,wCAAkB;IACzB,QAAQC,yCAAmB;IAC3B,SAAS;IACT,OAAO;;AAGT,SAAM,gBAAgB,yBAAyB;AAC/C,WAAQ,MAAM;;AAKhB,MAAI,kBAAkB,oBAAoB;AACxC,WAAQ,MAAM;AACd,aAAU;IACR,MAAM;IACN,OAAOD,wCAAkB;IACzB,QAAQC,yCAAmB;IAC3B,SAAS,8BAA8B,kBAAkB,sBAAsB;IAC/E,OAAO;;;AAGX,UAAQ,MAAM;UAEPM,eAAoB;AAC3B,UAAQ,MAAM,oBAAoB;AAClC,YAAU;GACR,MAAM;GACN,OAAOP,wCAAkB;GACzB,QAAQC,yCAAmB;GAC3B,SAAS,oBAAoB,cAAc;GAC3C,OAAO;;;;;;;;AASb,eAAe,8BACb,YACA,eACA,mBACA,MACkB;CAClB,MAAM,WAAW,KAAK,IAAI,GAAG,KAAK,MAAM,MAAM,YAAY;CAC1D,MAAM,UAAU,KAAK,IAAI,IAAI,KAAK,MAAM,MAAM,WAAW;AAEzD,MAAK,IAAI,IAAI,GAAG,IAAI,UAAU,KAAK;AACjC,MAAI;GACF,MAAM,EAAE,gBAAgB,2BAA2B,MAAM,WAAW,cAAc,EAAE,SAAS;GAC7F,MAAM,OAAO,CAAC,GAAG,gBAAgB,GAAG;GACpC,MAAM,QAAQ,KAAK,MAAK,MAAK,OAAQ,GAAW,cAAc,QAAQ;AACtE,OAAI,MAAO,QAAO;WACX,GAAG;AAGZ,QAAM,IAAI,SAAQ,QAAO,WAAW,KAAK;;AAE3C,QAAO"}

package/dist/cjs/react/sdk/src/core/TatchiPasskey/relay.js

@@ -1,112 +0,0 @@
-const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.js');
-const require_sdkSentEvents = require('../types/sdkSentEvents.js');
-
-//#region src/core/TatchiPasskey/relay.ts
-require_sdkSentEvents.init_sdkSentEvents();
-const toNumberArray = (value) => Array.isArray(value) ? value : Array.from(value);
-const normalizeSignedDelegateForRelay = (signedDelegate) => {
-	const delegateAction = signedDelegate.delegateAction;
-	const signature = signedDelegate.signature;
-	return {
-		delegateAction: {
-			...delegateAction,
-			publicKey: {
-				...delegateAction.publicKey,
-				keyData: toNumberArray(delegateAction.publicKey.keyData)
-			}
-		},
-		signature: {
-			...signature,
-			signatureData: toNumberArray(signature.signatureData)
-		}
-	};
-};
-async function sendDelegateActionViaRelayer(args) {
-	const { url, payload, signal, options } = args;
-	const normalizedPayload = {
-		...payload,
-		signedDelegate: normalizeSignedDelegateForRelay(payload.signedDelegate)
-	};
-	const emit = (event) => options?.onEvent?.(event);
-	const emitError = (message) => {
-		emit({
-			step: 0,
-			phase: require_sdkSentEvents.ActionPhase.ACTION_ERROR,
-			status: require_sdkSentEvents.ActionStatus.ERROR,
-			message,
-			error: message
-		});
-	};
-	emit({
-		step: 7,
-		phase: require_sdkSentEvents.ActionPhase.STEP_7_BROADCASTING,
-		status: require_sdkSentEvents.ActionStatus.PROGRESS,
-		message: "Submitting delegate to relayer..."
-	});
-	let res;
-	try {
-		res = await fetch(url, {
-			method: "POST",
-			headers: { "content-type": "application/json" },
-			body: JSON.stringify(normalizedPayload),
-			signal
-		});
-	} catch (err) {
-		const error = err instanceof Error ? err : new Error(String(err));
-		options?.onError?.(error);
-		emitError(error.message);
-		await options?.afterCall?.(false);
-		throw error;
-	}
-	if (!res.ok) {
-		const response$1 = {
-			ok: false,
-			error: `Relayer HTTP ${res.status}`
-		};
-		options?.onError?.(new Error(response$1.error));
-		emitError(response$1.error);
-		await options?.afterCall?.(false);
-		return response$1;
-	}
-	let json;
-	try {
-		json = await res.json();
-	} catch (err) {
-		const response$1 = {
-			ok: false,
-			error: "Relayer returned non-JSON response"
-		};
-		const error = err instanceof Error ? err : new Error(String(err));
-		options?.onError?.(error);
-		emitError(response$1.error);
-		await options?.afterCall?.(false);
-		return response$1;
-	}
-	const response = {
-		ok: Boolean(json?.ok ?? true),
-		relayerTxHash: json?.relayerTxHash ?? json?.transactionId ?? json?.txHash,
-		status: json?.status,
-		outcome: json?.outcome,
-		error: json?.error
-	};
-	const success = response.ok !== false;
-	if (success) {
-		emit({
-			step: 8,
-			phase: require_sdkSentEvents.ActionPhase.STEP_8_ACTION_COMPLETE,
-			status: require_sdkSentEvents.ActionStatus.SUCCESS,
-			message: "Delegate relayed successfully"
-		});
-		await options?.afterCall?.(true, response);
-	} else {
-		const message = response.error || "Relayer execution failed";
-		options?.onError?.(new Error(message));
-		emitError(message);
-		await options?.afterCall?.(false);
-	}
-	return response;
-}
-
-//#endregion
-exports.sendDelegateActionViaRelayer = sendDelegateActionViaRelayer;
-//# sourceMappingURL=relay.js.map

package/dist/cjs/react/sdk/src/core/TatchiPasskey/relay.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"relay.js","names":["normalizedPayload: RelayDelegateRequest","ActionPhase","ActionStatus","res: Response","err: unknown","response: DelegateRelayResult","response","json: any"],"sources":["../../../../../../../src/core/TatchiPasskey/relay.ts"],"sourcesContent":["import { ActionPhase, ActionStatus, type ActionSSEEvent, type DelegateRelayHooksOptions } from '../types/sdkSentEvents';\nimport type { DelegateRelayResult } from '../types/tatchi';\nimport type { SignedDelegate } from '../types/delegate';\nimport type { WasmSignedDelegate } from '../types/signer-worker';\n\nexport interface RelayDelegateRequest {\n  hash: string;\n  signedDelegate: SignedDelegate | WasmSignedDelegate;\n}\n\nconst toNumberArray = (value: number[] | Uint8Array): number[] =>\n  Array.isArray(value) ? value : Array.from(value);\n\nconst normalizeSignedDelegateForRelay = (\n  signedDelegate: SignedDelegate | WasmSignedDelegate\n): SignedDelegate => {\n  const delegateAction = signedDelegate.delegateAction as SignedDelegate['delegateAction'] & {\n    publicKey: { keyType: number; keyData: number[] | Uint8Array };\n  };\n  const signature = signedDelegate.signature as SignedDelegate['signature'] & {\n    keyType: number;\n    signatureData: number[] | Uint8Array;\n  };\n\n  return {\n    delegateAction: {\n      ...delegateAction,\n      publicKey: {\n        ...delegateAction.publicKey,\n        keyData: toNumberArray(delegateAction.publicKey.keyData),\n      },\n    },\n    signature: {\n      ...signature,\n      signatureData: toNumberArray(signature.signatureData),\n    },\n  };\n};\n\nexport async function sendDelegateActionViaRelayer(args: {\n  url: string;\n  payload: RelayDelegateRequest;\n  signal?: AbortSignal;\n  options?: DelegateRelayHooksOptions;\n}): Promise<DelegateRelayResult> {\n\n  const { url, payload, signal, options } = args;\n  const normalizedPayload: RelayDelegateRequest = {\n    ...payload,\n    signedDelegate: normalizeSignedDelegateForRelay(payload.signedDelegate),\n  };\n\n  const emit = (event: ActionSSEEvent) => options?.onEvent?.(event);\n  const emitError = (message: string) => {\n    emit({\n      step: 0,\n      phase: ActionPhase.ACTION_ERROR,\n      status: ActionStatus.ERROR,\n      message,\n      error: message,\n    });\n  };\n\n  emit({\n    step: 7,\n    phase: ActionPhase.STEP_7_BROADCASTING,\n    status: ActionStatus.PROGRESS,\n    message: 'Submitting delegate to relayer...',\n  });\n\n  let res: Response;\n  try {\n    res = await fetch(url, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify(normalizedPayload),\n      signal,\n    });\n  } catch (err: unknown) {\n    const error = err instanceof Error ? err : new Error(String(err));\n    options?.onError?.(error);\n    emitError(error.message);\n    await options?.afterCall?.(false);\n    throw error;\n  }\n\n  if (!res.ok) {\n    const response: DelegateRelayResult = {\n      ok: false,\n      error: `Relayer HTTP ${res.status}`,\n    };\n    options?.onError?.(new Error(response.error));\n    emitError(response.error!);\n    await options?.afterCall?.(false);\n    return response;\n  }\n\n  let json: any;\n  try {\n    json = await res.json();\n  } catch (err: unknown) {\n    const response: DelegateRelayResult = {\n      ok: false,\n      error: 'Relayer returned non-JSON response',\n    };\n    const error = err instanceof Error ? err : new Error(String(err));\n    options?.onError?.(error);\n    emitError(response.error!);\n    await options?.afterCall?.(false);\n    return response;\n  }\n\n  const response: DelegateRelayResult = {\n    ok: Boolean(json?.ok ?? true),\n    relayerTxHash: json?.relayerTxHash ?? json?.transactionId ?? json?.txHash,\n    status: json?.status,\n    outcome: json?.outcome,\n    error: json?.error,\n  };\n\n  const success = response.ok !== false;\n  if (success) {\n    emit({\n      step: 8,\n      phase: ActionPhase.STEP_8_ACTION_COMPLETE,\n      status: ActionStatus.SUCCESS,\n      message: 'Delegate relayed successfully',\n    });\n    await options?.afterCall?.(true, response);\n  } else {\n    const message = response.error || 'Relayer execution failed';\n    options?.onError?.(new Error(message));\n    emitError(message);\n    await options?.afterCall?.(false);\n  }\n\n  return response;\n}\n"],"mappings":";;;;;AAUA,MAAM,iBAAiB,UACrB,MAAM,QAAQ,SAAS,QAAQ,MAAM,KAAK;AAE5C,MAAM,mCACJ,mBACmB;CACnB,MAAM,iBAAiB,eAAe;CAGtC,MAAM,YAAY,eAAe;AAKjC,QAAO;EACL,gBAAgB;GACd,GAAG;GACH,WAAW;IACT,GAAG,eAAe;IAClB,SAAS,cAAc,eAAe,UAAU;;;EAGpD,WAAW;GACT,GAAG;GACH,eAAe,cAAc,UAAU;;;;AAK7C,eAAsB,6BAA6B,MAKlB;CAE/B,MAAM,EAAE,KAAK,SAAS,QAAQ,YAAY;CAC1C,MAAMA,oBAA0C;EAC9C,GAAG;EACH,gBAAgB,gCAAgC,QAAQ;;CAG1D,MAAM,QAAQ,UAA0B,SAAS,UAAU;CAC3D,MAAM,aAAa,YAAoB;AACrC,OAAK;GACH,MAAM;GACN,OAAOC,kCAAY;GACnB,QAAQC,mCAAa;GACrB;GACA,OAAO;;;AAIX,MAAK;EACH,MAAM;EACN,OAAOD,kCAAY;EACnB,QAAQC,mCAAa;EACrB,SAAS;;CAGX,IAAIC;AACJ,KAAI;AACF,QAAM,MAAM,MAAM,KAAK;GACrB,QAAQ;GACR,SAAS,EAAE,gBAAgB;GAC3B,MAAM,KAAK,UAAU;GACrB;;UAEKC,KAAc;EACrB,MAAM,QAAQ,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO;AAC5D,WAAS,UAAU;AACnB,YAAU,MAAM;AAChB,QAAM,SAAS,YAAY;AAC3B,QAAM;;AAGR,KAAI,CAAC,IAAI,IAAI;EACX,MAAMC,aAAgC;GACpC,IAAI;GACJ,OAAO,gBAAgB,IAAI;;AAE7B,WAAS,UAAU,IAAI,MAAMC,WAAS;AACtC,YAAUA,WAAS;AACnB,QAAM,SAAS,YAAY;AAC3B,SAAOA;;CAGT,IAAIC;AACJ,KAAI;AACF,SAAO,MAAM,IAAI;UACVH,KAAc;EACrB,MAAMC,aAAgC;GACpC,IAAI;GACJ,OAAO;;EAET,MAAM,QAAQ,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO;AAC5D,WAAS,UAAU;AACnB,YAAUC,WAAS;AACnB,QAAM,SAAS,YAAY;AAC3B,SAAOA;;CAGT,MAAMD,WAAgC;EACpC,IAAI,QAAQ,MAAM,MAAM;EACxB,eAAe,MAAM,iBAAiB,MAAM,iBAAiB,MAAM;EACnE,QAAQ,MAAM;EACd,SAAS,MAAM;EACf,OAAO,MAAM;;CAGf,MAAM,UAAU,SAAS,OAAO;AAChC,KAAI,SAAS;AACX,OAAK;GACH,MAAM;GACN,OAAOJ,kCAAY;GACnB,QAAQC,mCAAa;GACrB,SAAS;;AAEX,QAAM,SAAS,YAAY,MAAM;QAC5B;EACL,MAAM,UAAU,SAAS,SAAS;AAClC,WAAS,UAAU,IAAI,MAAM;AAC7B,YAAU;AACV,QAAM,SAAS,YAAY;;AAG7B,QAAO"}

package/dist/cjs/react/sdk/src/core/TatchiPasskey/scanDevice.js

@@ -1,106 +0,0 @@
-const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.js');
-const require_validation = require('../../utils/validation.js');
-const require_config = require('../../config.js');
-const require_sdkSentEvents = require('../types/sdkSentEvents.js');
-const require_rpcCalls = require('../rpcCalls.js');
-const require_nearCrypto = require('../nearCrypto.js');
-const require_login = require('./login.js');
-const require_linkDevice = require('../types/linkDevice.js');
-
-//#region src/core/TatchiPasskey/scanDevice.ts
-require_validation.init_validation();
-require_login.init_login();
-require_sdkSentEvents.init_sdkSentEvents();
-require_rpcCalls.init_rpcCalls();
-require_nearCrypto.init_nearCrypto();
-/**
-* Device1 (original device): Link device using pre-scanned QR data
-*/
-async function linkDeviceWithScannedQRData(context, qrData, options) {
-	const { onEvent, onError } = options || {};
-	try {
-		onEvent?.({
-			step: 2,
-			phase: require_sdkSentEvents.DeviceLinkingPhase.STEP_2_SCANNING,
-			status: require_sdkSentEvents.DeviceLinkingStatus.PROGRESS,
-			message: "Validating QR data..."
-		});
-		validateDeviceLinkingQRData(qrData);
-		const { login: device1LoginState } = await require_login.getLoginSession(context);
-		if (!device1LoginState.isLoggedIn || !device1LoginState.nearAccountId) throw new Error("Device1 must be logged in to authorize device linking");
-		const device1AccountId = device1LoginState.nearAccountId;
-		const fundingAmount = options.fundingAmount;
-		const device2PublicKey = require_nearCrypto.ensureEd25519Prefix(qrData.device2PublicKey);
-		if (!device2PublicKey || !/^ed25519:/i.test(device2PublicKey)) throw new Error("Invalid device public key format");
-		onEvent?.({
-			step: 3,
-			phase: require_sdkSentEvents.DeviceLinkingPhase.STEP_3_AUTHORIZATION,
-			status: require_sdkSentEvents.DeviceLinkingStatus.PROGRESS,
-			message: `Performing TouchID authentication for device linking...`
-		});
-		const userData = await context.webAuthnManager.getLastUser();
-		const nearPublicKeyStr = userData?.clientNearPublicKey;
-		if (!nearPublicKeyStr) throw new Error("Client NEAR public key not found in user data");
-		const { accessKeyInfo, nextNonce, txBlockHeight, txBlockHash } = await context.webAuthnManager.getNonceManager().getNonceBlockHashAndHeight(context.nearClient);
-		const nextNextNonce = (BigInt(nextNonce) + BigInt(1)).toString();
-		const nextNextNextNonce = (BigInt(nextNonce) + BigInt(2)).toString();
-		const vrfInputData = {
-			userId: device1AccountId,
-			rpId: context.webAuthnManager.getRpId(),
-			blockHeight: txBlockHeight,
-			blockHash: txBlockHash
-		};
-		const vrfChallenge = await context.webAuthnManager.generateVrfChallengeOnce(vrfInputData);
-		onEvent?.({
-			step: 6,
-			phase: require_sdkSentEvents.DeviceLinkingPhase.STEP_6_REGISTRATION,
-			status: require_sdkSentEvents.DeviceLinkingStatus.PROGRESS,
-			message: "TouchID successful! Signing AddKey transaction..."
-		});
-		const { addKeyTxResult, storeDeviceLinkingTxResult, signedDeleteKeyTransaction } = await require_rpcCalls.executeDeviceLinkingContractCalls({
-			context,
-			device1AccountId,
-			device2PublicKey,
-			nextNonce,
-			nextNextNonce,
-			nextNextNextNonce,
-			txBlockHash,
-			vrfChallenge,
-			onEvent,
-			confirmationConfigOverride: options?.confirmationConfig,
-			confirmerText: options?.confirmerText
-		});
-		const result = {
-			success: true,
-			device2PublicKey,
-			transactionId: addKeyTxResult?.transaction?.hash || storeDeviceLinkingTxResult?.transaction?.hash || "unknown",
-			fundingAmount,
-			linkedToAccount: device1AccountId,
-			signedDeleteKeyTransaction
-		};
-		onEvent?.({
-			step: 6,
-			phase: require_sdkSentEvents.DeviceLinkingPhase.STEP_6_REGISTRATION,
-			status: require_sdkSentEvents.DeviceLinkingStatus.SUCCESS,
-			message: `Device2's key added to ${device1AccountId} successfully!`
-		});
-		return result;
-	} catch (error) {
-		console.error("LinkDeviceFlow: linkDeviceWithQRData caught error:", error);
-		const errorMessage = `Failed to scan and link device: ${error.message}`;
-		onError?.(new Error(errorMessage));
-		throw new require_linkDevice.DeviceLinkingError(errorMessage, require_linkDevice.DeviceLinkingErrorCode.AUTHORIZATION_TIMEOUT, "authorization");
-	}
-}
-function validateDeviceLinkingQRData(qrData) {
-	if (!qrData.device2PublicKey) throw new require_linkDevice.DeviceLinkingError("Missing device public key", require_linkDevice.DeviceLinkingErrorCode.INVALID_QR_DATA, "authorization");
-	if (!qrData.timestamp) throw new require_linkDevice.DeviceLinkingError("Missing timestamp", require_linkDevice.DeviceLinkingErrorCode.INVALID_QR_DATA, "authorization");
-	const maxAge = require_config.DEVICE_LINKING_CONFIG.TIMEOUTS.QR_CODE_MAX_AGE_MS;
-	if (Date.now() - qrData.timestamp > maxAge) throw new require_linkDevice.DeviceLinkingError("QR code expired", require_linkDevice.DeviceLinkingErrorCode.SESSION_EXPIRED, "authorization");
-	if (qrData.accountId) require_validation.validateNearAccountId(qrData.accountId);
-}
-
-//#endregion
-exports.linkDeviceWithScannedQRData = linkDeviceWithScannedQRData;
-exports.validateDeviceLinkingQRData = validateDeviceLinkingQRData;
-//# sourceMappingURL=scanDevice.js.map

package/dist/cjs/react/sdk/src/core/TatchiPasskey/scanDevice.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"scanDevice.js","names":["DeviceLinkingPhase","DeviceLinkingStatus","getLoginSession","ensureEd25519Prefix","vrfInputData: VRFInputData","executeDeviceLinkingContractCalls","error: any","DeviceLinkingError","DeviceLinkingErrorCode","DEVICE_LINKING_CONFIG"],"sources":["../../../../../../../src/core/TatchiPasskey/scanDevice.ts"],"sourcesContent":["import type { PasskeyManagerContext } from './index';\nimport { validateNearAccountId } from '../../utils/validation';\nimport { getLoginSession } from './login';\nimport type { VRFInputData } from '../types/vrf-worker';\nimport type {\n  DeviceLinkingQRData,\n  LinkDeviceResult,\n  ScanAndLinkDeviceOptionsDevice1,\n} from '../types/linkDevice';\nimport { DeviceLinkingPhase, DeviceLinkingStatus } from '../types/sdkSentEvents';\nimport { DeviceLinkingError, DeviceLinkingErrorCode } from '../types/linkDevice';\nimport { DEVICE_LINKING_CONFIG } from '../../config.js';\nimport { executeDeviceLinkingContractCalls } from '../rpcCalls';\nimport { ensureEd25519Prefix } from '../nearCrypto';\n\n/**\n * Device1 (original device): Link device using pre-scanned QR data\n */\nexport async function linkDeviceWithScannedQRData(\n  context: PasskeyManagerContext,\n  qrData: DeviceLinkingQRData,\n  options: ScanAndLinkDeviceOptionsDevice1\n): Promise<LinkDeviceResult> {\n  const { onEvent, onError } = options || {};\n\n  try {\n    onEvent?.({\n      step: 2,\n      phase: DeviceLinkingPhase.STEP_2_SCANNING,\n      status: DeviceLinkingStatus.PROGRESS,\n      message: 'Validating QR data...'\n    });\n\n    // Validate QR data\n    validateDeviceLinkingQRData(qrData);\n\n    // 3. Get Device1's current account (the account that will receive the new key)\n    const { login: device1LoginState } = await getLoginSession(context);\n\n    if (!device1LoginState.isLoggedIn || !device1LoginState.nearAccountId) {\n      throw new Error('Device1 must be logged in to authorize device linking');\n    }\n\n    const device1AccountId = device1LoginState.nearAccountId;\n\n    // 4. Execute batched transaction: AddKey + Contract notification\n    const fundingAmount = options.fundingAmount;\n\n    // Parse the device public key for AddKey action\n    const device2PublicKey = ensureEd25519Prefix(qrData.device2PublicKey);\n    if (!device2PublicKey || !/^ed25519:/i.test(device2PublicKey)) {\n      throw new Error('Invalid device public key format');\n    }\n\n    onEvent?.({\n      step: 3,\n      phase: DeviceLinkingPhase.STEP_3_AUTHORIZATION,\n      status: DeviceLinkingStatus.PROGRESS,\n      message: `Performing TouchID authentication for device linking...`\n    });\n\n    const userData = await context.webAuthnManager.getLastUser();\n    const nearPublicKeyStr = userData?.clientNearPublicKey;\n    if (!nearPublicKeyStr) {\n      throw new Error('Client NEAR public key not found in user data');\n    }\n    // Generate VRF challenge once for both transactions\n    const {\n      accessKeyInfo,\n      nextNonce,\n      txBlockHeight,\n      txBlockHash\n    } = await context.webAuthnManager.getNonceManager().getNonceBlockHashAndHeight(context.nearClient);\n    const nextNextNonce = (BigInt(nextNonce) + BigInt(1)).toString();\n    const nextNextNextNonce = (BigInt(nextNonce) + BigInt(2)).toString();\n\n    const vrfInputData: VRFInputData = {\n      userId: device1AccountId,\n      rpId: context.webAuthnManager.getRpId(),\n      blockHeight: txBlockHeight,\n      blockHash: txBlockHash,\n    };\n\n    const vrfChallenge = await context.webAuthnManager.generateVrfChallengeOnce(vrfInputData);\n\n    onEvent?.({\n      step: 6,\n      phase: DeviceLinkingPhase.STEP_6_REGISTRATION,\n      status: DeviceLinkingStatus.PROGRESS,\n      message: 'TouchID successful! Signing AddKey transaction...'\n    });\n\n    // Execute device linking transactions using the centralized RPC function\n    const {\n      addKeyTxResult,\n      storeDeviceLinkingTxResult,\n      signedDeleteKeyTransaction\n    } = await executeDeviceLinkingContractCalls({\n      context,\n      device1AccountId,\n      device2PublicKey,\n      nextNonce,\n      nextNextNonce,\n      nextNextNextNonce,\n      txBlockHash,\n      vrfChallenge,\n      onEvent,\n      confirmationConfigOverride: options?.confirmationConfig,\n      confirmerText: options?.confirmerText,\n    });\n\n    const result = {\n      success: true,\n      device2PublicKey,\n      transactionId: addKeyTxResult?.transaction?.hash\n        || storeDeviceLinkingTxResult?.transaction?.hash\n        || 'unknown',\n      fundingAmount,\n      linkedToAccount: device1AccountId, // Include which account the key was added to\n      signedDeleteKeyTransaction\n    };\n\n    onEvent?.({\n      step: 6,\n      phase: DeviceLinkingPhase.STEP_6_REGISTRATION,\n      status: DeviceLinkingStatus.SUCCESS,\n      message: `Device2's key added to ${device1AccountId} successfully!`\n    });\n\n    return result;\n\n  } catch (error: any) {\n    console.error('LinkDeviceFlow: linkDeviceWithQRData caught error:', error);\n\n    const errorMessage = `Failed to scan and link device: ${error.message}`;\n    onError?.(new Error(errorMessage));\n\n    throw new DeviceLinkingError(\n      errorMessage,\n      DeviceLinkingErrorCode.AUTHORIZATION_TIMEOUT,\n      'authorization'\n    );\n  }\n}\n\nexport function validateDeviceLinkingQRData(qrData: DeviceLinkingQRData): void {\n  if (!qrData.device2PublicKey) {\n    throw new DeviceLinkingError(\n      'Missing device public key',\n      DeviceLinkingErrorCode.INVALID_QR_DATA,\n      'authorization'\n    );\n  }\n\n  if (!qrData.timestamp) {\n    throw new DeviceLinkingError(\n      'Missing timestamp',\n      DeviceLinkingErrorCode.INVALID_QR_DATA,\n      'authorization'\n    );\n  }\n\n  // Check timestamp is not too old (max 15 minutes)\n  const maxAge = DEVICE_LINKING_CONFIG.TIMEOUTS.QR_CODE_MAX_AGE_MS;\n  if (Date.now() - qrData.timestamp > maxAge) {\n    throw new DeviceLinkingError(\n      'QR code expired',\n      DeviceLinkingErrorCode.SESSION_EXPIRED,\n      'authorization'\n    );\n  }\n\n  // Account ID is optional - Device2 discovers it from contract logs\n  if (qrData.accountId) {\n    validateNearAccountId(qrData.accountId);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkBA,eAAsB,4BACpB,SACA,QACA,SAC2B;CAC3B,MAAM,EAAE,SAAS,YAAY,WAAW;AAExC,KAAI;AACF,YAAU;GACR,MAAM;GACN,OAAOA,yCAAmB;GAC1B,QAAQC,0CAAoB;GAC5B,SAAS;;AAIX,8BAA4B;EAG5B,MAAM,EAAE,OAAO,sBAAsB,MAAMC,8BAAgB;AAE3D,MAAI,CAAC,kBAAkB,cAAc,CAAC,kBAAkB,cACtD,OAAM,IAAI,MAAM;EAGlB,MAAM,mBAAmB,kBAAkB;EAG3C,MAAM,gBAAgB,QAAQ;EAG9B,MAAM,mBAAmBC,uCAAoB,OAAO;AACpD,MAAI,CAAC,oBAAoB,CAAC,aAAa,KAAK,kBAC1C,OAAM,IAAI,MAAM;AAGlB,YAAU;GACR,MAAM;GACN,OAAOH,yCAAmB;GAC1B,QAAQC,0CAAoB;GAC5B,SAAS;;EAGX,MAAM,WAAW,MAAM,QAAQ,gBAAgB;EAC/C,MAAM,mBAAmB,UAAU;AACnC,MAAI,CAAC,iBACH,OAAM,IAAI,MAAM;EAGlB,MAAM,EACJ,eACA,WACA,eACA,gBACE,MAAM,QAAQ,gBAAgB,kBAAkB,2BAA2B,QAAQ;EACvF,MAAM,iBAAiB,OAAO,aAAa,OAAO,IAAI;EACtD,MAAM,qBAAqB,OAAO,aAAa,OAAO,IAAI;EAE1D,MAAMG,eAA6B;GACjC,QAAQ;GACR,MAAM,QAAQ,gBAAgB;GAC9B,aAAa;GACb,WAAW;;EAGb,MAAM,eAAe,MAAM,QAAQ,gBAAgB,yBAAyB;AAE5E,YAAU;GACR,MAAM;GACN,OAAOJ,yCAAmB;GAC1B,QAAQC,0CAAoB;GAC5B,SAAS;;EAIX,MAAM,EACJ,gBACA,4BACA,+BACE,MAAMI,mDAAkC;GAC1C;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA,4BAA4B,SAAS;GACrC,eAAe,SAAS;;EAG1B,MAAM,SAAS;GACb,SAAS;GACT;GACA,eAAe,gBAAgB,aAAa,QACvC,4BAA4B,aAAa,QACzC;GACL;GACA,iBAAiB;GACjB;;AAGF,YAAU;GACR,MAAM;GACN,OAAOL,yCAAmB;GAC1B,QAAQC,0CAAoB;GAC5B,SAAS,0BAA0B,iBAAiB;;AAGtD,SAAO;UAEAK,OAAY;AACnB,UAAQ,MAAM,sDAAsD;EAEpE,MAAM,eAAe,mCAAmC,MAAM;AAC9D,YAAU,IAAI,MAAM;AAEpB,QAAM,IAAIC,sCACR,cACAC,0CAAuB,uBACvB;;;AAKN,SAAgB,4BAA4B,QAAmC;AAC7E,KAAI,CAAC,OAAO,iBACV,OAAM,IAAID,sCACR,6BACAC,0CAAuB,iBACvB;AAIJ,KAAI,CAAC,OAAO,UACV,OAAM,IAAID,sCACR,qBACAC,0CAAuB,iBACvB;CAKJ,MAAM,SAASC,qCAAsB,SAAS;AAC9C,KAAI,KAAK,QAAQ,OAAO,YAAY,OAClC,OAAM,IAAIF,sCACR,mBACAC,0CAAuB,iBACvB;AAKJ,KAAI,OAAO,UACT,0CAAsB,OAAO"}