@tatchi-xyz/sdk 0.21.0 → 0.31.1

package/dist/esm/react/sdk/src/core/TatchiPasskey/linkDevice.js

@@ -1,710 +0,0 @@
-import { IndexedDBManager, init_IndexedDBManager } from "../IndexedDBManager/index.js";
-import { DEVICE_LINKING_CONFIG } from "../../config.js";
-import { DeviceLinkingPhase, DeviceLinkingStatus, init_sdkSentEvents } from "../types/sdkSentEvents.js";
-import { ActionType, init_actions } from "../types/actions.js";
-import { DEFAULT_WAIT_STATUS, init_rpc } from "../types/rpc.js";
-import { getDeviceLinkingAccountContractCall, init_rpcCalls } from "../rpcCalls.js";
-import { init_getDeviceNumber, parseDeviceNumber } from "../WebAuthnManager/SignerWorkerManager/getDeviceNumber.js";
-import { createNearKeypair, init_nearCrypto } from "../nearCrypto.js";
-import { getLoginSession, init_login } from "./login.js";
-import { DeviceLinkingError, DeviceLinkingErrorCode } from "../types/linkDevice.js";
-
-//#region src/core/TatchiPasskey/linkDevice.ts
-init_nearCrypto();
-init_IndexedDBManager();
-init_actions();
-init_login();
-init_rpc();
-init_rpcCalls();
-init_sdkSentEvents();
-init_getDeviceNumber();
-async function generateQRCodeDataURL(data) {
-	const { default: QRCode } = await import("qrcode");
-	return QRCode.toDataURL(data, {
-		width: 256,
-		margin: 2,
-		color: {
-			dark: "#000000",
-			light: "#ffffff"
-		},
-		errorCorrectionLevel: "M"
-	});
-}
-/**
-* Device linking flow class - manages the complete device linking process
-*
-* Usage:
-* ```typescript
-* // Device2: Generate QR and start polling
-* const flow = new LinkDeviceFlow(context, options);
-* const { qrData, qrCodeDataURL } = await flow.generateQR(accountId);
-*
-* // Device1: Scan and authorize
-* const result = await LinkDeviceFlow.scanAndLink(context, options);
-*
-* // Device2: Flow automatically completes when AddKey is detected
-* const state = flow.getState();
-* ```
-*/
-var LinkDeviceFlow = class {
-	context;
-	options;
-	session = null;
-	error;
-	cancelled = false;
-	pollingInterval;
-	pollGeneration = 0;
-	KEY_POLLING_INTERVAL = DEVICE_LINKING_CONFIG.TIMEOUTS.POLLING_INTERVAL_MS;
-	registrationRetryTimeout;
-	registrationRetryCount = 0;
-	MAX_REGISTRATION_RETRIES = DEVICE_LINKING_CONFIG.RETRY.MAX_REGISTRATION_ATTEMPTS;
-	RETRY_DELAY_MS = DEVICE_LINKING_CONFIG.TIMEOUTS.REGISTRATION_RETRY_DELAY_MS;
-	tempKeyCleanupTimer;
-	TEMP_KEY_CLEANUP_DELAY_MS = DEVICE_LINKING_CONFIG.TIMEOUTS.TEMP_KEY_CLEANUP_MS;
-	get hookOptions() {
-		return this.options?.options;
-	}
-	constructor(context, options) {
-		this.context = context;
-		this.options = options;
-	}
-	ifActive(fn) {
-		if (this.cancelled) return;
-		return fn();
-	}
-	safeOnEvent(evt) {
-		this.ifActive(() => this.hookOptions?.onEvent?.(evt));
-	}
-	/**
-	* Device2 (companion device): Generate QR code and start polling for AddKey transaction
-	*
-	* Single flow:
-	* - Generate a temporary NEAR keypair, discover the real account via AddKey mapping,
-	*   then swap the temporary key for a deterministic key derived from a passkey.
-	*/
-	async generateQR() {
-		try {
-			const tempNearKeyResult = await this.generateTemporaryNearKeypair();
-			this.session = {
-				accountId: null,
-				deviceNumber: void 0,
-				nearPublicKey: tempNearKeyResult.publicKey,
-				credential: null,
-				vrfChallenge: null,
-				phase: DeviceLinkingPhase.IDLE,
-				createdAt: Date.now(),
-				expiresAt: Date.now() + DEVICE_LINKING_CONFIG.TIMEOUTS.SESSION_EXPIRATION_MS,
-				tempPrivateKey: tempNearKeyResult.privateKey
-			};
-			const qrData = {
-				device2PublicKey: this.session.nearPublicKey,
-				accountId: this.session.accountId || void 0,
-				timestamp: Date.now(),
-				version: "1.0"
-			};
-			const qrDataString = JSON.stringify(qrData);
-			const qrCodeDataURL = await generateQRCodeDataURL(qrDataString);
-			this.safeOnEvent({
-				step: 1,
-				phase: DeviceLinkingPhase.STEP_1_QR_CODE_GENERATED,
-				status: DeviceLinkingStatus.PROGRESS,
-				message: `QR code generated for device linking, waiting for Device1 to scan and authorize...`
-			});
-			if (!this.cancelled) this.startPolling();
-			this.safeOnEvent({
-				step: 4,
-				phase: DeviceLinkingPhase.STEP_4_POLLING,
-				status: DeviceLinkingStatus.PROGRESS,
-				message: `Polling contract for linked account...`
-			});
-			return {
-				qrData,
-				qrCodeDataURL
-			};
-		} catch (error) {
-			this.error = error;
-			this.safeOnEvent({
-				step: 0,
-				phase: DeviceLinkingPhase.DEVICE_LINKING_ERROR,
-				status: DeviceLinkingStatus.ERROR,
-				error: error.message,
-				message: error.message
-			});
-			throw new DeviceLinkingError(`Failed to generate device linking QR: ${error.message}`, DeviceLinkingErrorCode.REGISTRATION_FAILED, "generation");
-		}
-	}
-	/**
-	* Generate temporary NEAR keypair without TouchID/VRF for Option F flow
-	* This creates a proper Ed25519 keypair that can be used for the QR code
-	* Includes memory cleanup and automatic expiration
-	*/
-	async generateTemporaryNearKeypair() {
-		const { publicKey: publicKeyNear, privateKey: privateKeyNear } = await createNearKeypair();
-		this.scheduleTemporaryKeyCleanup(publicKeyNear);
-		return {
-			publicKey: publicKeyNear,
-			privateKey: privateKeyNear
-		};
-	}
-	/**
-	* Schedule automatic cleanup of temporary private key from memory
-	* This provides defense-in-depth against memory exposure
-	*/
-	scheduleTemporaryKeyCleanup(publicKey) {
-		if (this.tempKeyCleanupTimer) clearTimeout(this.tempKeyCleanupTimer);
-		this.tempKeyCleanupTimer = setTimeout(() => {
-			this.cleanupTemporaryKeyFromMemory();
-		}, this.TEMP_KEY_CLEANUP_DELAY_MS);
-	}
-	/**
-	* Immediately clean up temporary private key from memory
-	* Called on successful completion, cancellation, or timeout
-	*/
-	cleanupTemporaryKeyFromMemory() {
-		if (this.session?.tempPrivateKey) {
-			const keyLength = this.session.tempPrivateKey.length;
-			this.session.tempPrivateKey = "0".repeat(keyLength);
-			this.session.tempPrivateKey = "";
-		}
-		if (this.tempKeyCleanupTimer) {
-			clearTimeout(this.tempKeyCleanupTimer);
-			this.tempKeyCleanupTimer = void 0;
-		}
-	}
-	/**
-	* Device2: Start polling blockchain for AddKey transaction
-	*/
-	startPolling() {
-		if (!this.session || this.cancelled) return;
-		this.stopPolling();
-		const myGen = ++this.pollGeneration;
-		const tick = async () => {
-			if (this.cancelled || this.pollGeneration !== myGen) return;
-			if (!this.shouldContinuePolling()) {
-				this.stopPolling();
-				return;
-			}
-			try {
-				const hasKeyAdded = await this.checkForDeviceKeyAdded();
-				if (this.cancelled || this.pollGeneration !== myGen) return;
-				if (hasKeyAdded && this.session) {
-					this.stopPolling();
-					this.safeOnEvent({
-						step: 5,
-						phase: DeviceLinkingPhase.STEP_5_ADDKEY_DETECTED,
-						status: DeviceLinkingStatus.PROGRESS,
-						message: "AddKey transaction detected, starting registration..."
-					});
-					this.session.phase = DeviceLinkingPhase.STEP_5_ADDKEY_DETECTED;
-					this.startRegistrationWithRetries();
-					return;
-				}
-			} catch (error) {
-				if (this.cancelled || this.pollGeneration !== myGen) return;
-				console.error("Polling error:", error);
-				if (error.message?.includes("Account not found")) {
-					console.warn("Account not found - stopping polling");
-					this.stopPolling();
-					return;
-				}
-			}
-			if (!this.cancelled && this.pollGeneration === myGen) this.pollingInterval = setTimeout(tick, this.KEY_POLLING_INTERVAL);
-		};
-		this.pollingInterval = setTimeout(tick, this.KEY_POLLING_INTERVAL);
-	}
-	shouldContinuePolling() {
-		if (!this.session) return false;
-		if (this.session.phase === DeviceLinkingPhase.STEP_5_ADDKEY_DETECTED) return false;
-		if (this.session.phase === DeviceLinkingPhase.STEP_7_LINKING_COMPLETE) return false;
-		if (Date.now() > this.session.expiresAt) {
-			this.error = /* @__PURE__ */ new Error("Session expired");
-			this.safeOnEvent({
-				step: 0,
-				phase: DeviceLinkingPhase.DEVICE_LINKING_ERROR,
-				status: DeviceLinkingStatus.ERROR,
-				error: this.error?.message,
-				message: "Device linking session expired"
-			});
-			return false;
-		}
-		return true;
-	}
-	/**
-	* Device2: Check if device key has been added by polling contract HashMap
-	*/
-	async checkForDeviceKeyAdded() {
-		if (this.cancelled || !this.pollingInterval) return false;
-		if (!this.session?.nearPublicKey) {
-			console.error(`LinkDeviceFlow: No session or public key available for polling`);
-			return false;
-		}
-		try {
-			const linkingResult = await getDeviceLinkingAccountContractCall(this.context.nearClient, this.context.configs.contractId, this.session.nearPublicKey);
-			if (this.cancelled || !this.pollingInterval) return false;
-			this.safeOnEvent({
-				step: 4,
-				phase: DeviceLinkingPhase.STEP_4_POLLING,
-				status: DeviceLinkingStatus.PROGRESS,
-				message: "Polling contract for linked account..."
-			});
-			if (linkingResult && linkingResult.linkedAccountId && linkingResult.deviceNumber !== void 0) {
-				const currentCounter = parseDeviceNumber(linkingResult.deviceNumber, { min: 0 });
-				if (currentCounter === null) {
-					console.warn("LinkDeviceFlow: Invalid deviceNumber counter returned from contract:", linkingResult.deviceNumber);
-					return false;
-				}
-				const nextDeviceNumber = currentCounter + 1;
-				console.debug(`LinkDeviceFlow: Success! Discovered linked account:`, {
-					linkedAccountId: linkingResult.linkedAccountId,
-					currentCounter,
-					nextDeviceNumber
-				});
-				this.session.accountId = linkingResult.linkedAccountId;
-				this.session.deviceNumber = nextDeviceNumber;
-				return true;
-			} else if (!this.cancelled) console.log(`LinkDeviceFlow: No mapping found yet...`);
-			return false;
-		} catch (error) {
-			console.error(`LinkDeviceFlow: Error checking for device key addition:`, {
-				error: error.message,
-				stack: error.stack,
-				name: error.name,
-				code: error.code
-			});
-			return false;
-		}
-	}
-	/**
-	* Device2: Start registration process with retry logic
-	*/
-	startRegistrationWithRetries() {
-		this.registrationRetryCount = 0;
-		this.attemptRegistration();
-	}
-	/**
-	* Device2: Attempt registration with retry logic
-	*/
-	attemptRegistration() {
-		this.swapKeysAndRegisterAccount().catch((error) => {
-			if (this.isRetryableError(error)) {
-				this.registrationRetryCount++;
-				if (this.registrationRetryCount > this.MAX_REGISTRATION_RETRIES) {
-					console.error("LinkDeviceFlow: Max registration retries exceeded, failing permanently");
-					this.session.phase = DeviceLinkingPhase.REGISTRATION_ERROR;
-					this.error = error;
-					this.hookOptions?.onEvent?.({
-						step: 0,
-						phase: DeviceLinkingPhase.REGISTRATION_ERROR,
-						status: DeviceLinkingStatus.ERROR,
-						error: error.message,
-						message: error.message
-					});
-				} else {
-					console.warn(`LinkDeviceFlow: Registration failed with retryable error (attempt ${this.registrationRetryCount}/${this.MAX_REGISTRATION_RETRIES}), will retry in ${this.RETRY_DELAY_MS}ms:`, error.message);
-					this.hookOptions?.onEvent?.({
-						step: 5,
-						phase: DeviceLinkingPhase.STEP_5_ADDKEY_DETECTED,
-						status: DeviceLinkingStatus.PROGRESS,
-						message: `Registration failed (${error.message}), retrying in ${this.RETRY_DELAY_MS}ms... (${this.registrationRetryCount}/${this.MAX_REGISTRATION_RETRIES})`
-					});
-					this.registrationRetryTimeout = setTimeout(() => {
-						this.attemptRegistration();
-					}, this.RETRY_DELAY_MS);
-				}
-			} else {
-				this.session.phase = DeviceLinkingPhase.REGISTRATION_ERROR;
-				this.error = error;
-				this.hookOptions?.onEvent?.({
-					step: 0,
-					phase: DeviceLinkingPhase.REGISTRATION_ERROR,
-					status: DeviceLinkingStatus.ERROR,
-					error: error.message,
-					message: error.message
-				});
-			}
-		});
-	}
-	/**
-	* Device2: Complete device linking
-	* 1. Derives deterministic VRF and NEAR keys using real accountID (instead of temporary keys)
-	* 2. Executes Key Replacement transaction to replace temporary key with the real key
-	* 3. Stores authenticator and VRF data locally, performs on-chain Device2 registration, and then auto-login.
-	*/
-	async swapKeysAndRegisterAccount() {
-		if (!this.session || !this.session.accountId) throw new Error("AccountID not available for registration");
-		const realAccountId = this.session.accountId;
-		this.safeOnEvent({
-			step: 6,
-			phase: DeviceLinkingPhase.STEP_6_REGISTRATION,
-			status: DeviceLinkingStatus.PROGRESS,
-			message: "Storing device authenticator data locally..."
-		});
-		const deterministicKeysResult = await this.deriveDeterministicKeysAndRegisterAccount();
-		if (!deterministicKeysResult) throw new Error("Failed to derive deterministic keys");
-		if (!deterministicKeysResult.vrfChallenge) throw new Error("Missing VRF challenge from deterministic key derivation");
-		await this.storeDeviceAuthenticator(deterministicKeysResult);
-		const registrationResult = await this.context.webAuthnManager.signDevice2RegistrationWithStoredKey({
-			nearAccountId: realAccountId,
-			credential: deterministicKeysResult.credential,
-			vrfChallenge: deterministicKeysResult.vrfChallenge,
-			deterministicVrfPublicKey: deterministicKeysResult.vrfPublicKey,
-			deviceNumber: this.session.deviceNumber
-		});
-		if (!registrationResult.success || !registrationResult.signedTransaction) throw new Error(registrationResult.error || "Device2 registration failed");
-		await this.context.nearClient.sendTransaction(registrationResult.signedTransaction, DEFAULT_WAIT_STATUS.linkDeviceRegistration);
-		this.session.phase = DeviceLinkingPhase.STEP_7_LINKING_COMPLETE;
-		this.registrationRetryCount = 0;
-		this.safeOnEvent({
-			step: 7,
-			phase: DeviceLinkingPhase.STEP_7_LINKING_COMPLETE,
-			status: DeviceLinkingStatus.SUCCESS,
-			message: "Device linking completed successfully"
-		});
-		await this.attemptAutoLogin(deterministicKeysResult, this.options);
-	}
-	/**
-	* Check if an error is retryable (temporary issues that can be resolved)
-	*/
-	isRetryableError(error) {
-		const retryableErrorMessages = [
-			"page does not have focus",
-			"a request is already pending",
-			"request is already pending",
-			"operationerror",
-			"notallowederror",
-			"the operation is not allowed at this time",
-			"network error",
-			"timeout",
-			"temporary",
-			"transient"
-		];
-		const errorMessage = error.message?.toLowerCase() || "";
-		const errorName = error.name?.toLowerCase() || "";
-		return retryableErrorMessages.some((msg) => errorMessage.includes(msg.toLowerCase()) || errorName.includes(msg.toLowerCase()));
-	}
-	/**
-	* Device2: Attempt auto-login after successful device linking
-	*/
-	async attemptAutoLogin(deterministicKeysResult, options) {
-		try {
-			if (this.cancelled) {
-				console.warn("LinkDeviceFlow: Auto-login aborted because flow was cancelled");
-				return;
-			}
-			const sessionSnapshot = this.session;
-			options?.options?.onEvent?.({
-				step: 8,
-				phase: DeviceLinkingPhase.STEP_8_AUTO_LOGIN,
-				status: DeviceLinkingStatus.PROGRESS,
-				message: "Logging in..."
-			});
-			if (!sessionSnapshot || !sessionSnapshot.accountId || !sessionSnapshot.credential || !deterministicKeysResult) {
-				const missing = [];
-				if (!sessionSnapshot) missing.push("session");
-				if (!sessionSnapshot?.accountId) missing.push("accountId");
-				if (!sessionSnapshot?.credential) missing.push("credential");
-				if (!deterministicKeysResult) missing.push("deterministicKeysResult");
-				throw new Error(`Missing required data for auto-login: ${missing.join(", ")}`);
-			}
-			const { accountId } = sessionSnapshot;
-			const deviceNumberRaw = sessionSnapshot.deviceNumber;
-			if (deviceNumberRaw == null) throw new Error("Device number missing for auto-login");
-			const deviceNumber = parseDeviceNumber(deviceNumberRaw, { min: 1 });
-			if (deviceNumber === null) throw new Error(`Invalid device number for auto-login: ${String(deviceNumberRaw)}`);
-			if (deterministicKeysResult.serverEncryptedVrfKeypair && deterministicKeysResult.serverEncryptedVrfKeypair.serverKeyId && this.context.configs.vrfWorkerConfigs?.shamir3pass?.relayServerUrl) try {
-				const unlockResult = await this.context.webAuthnManager.shamir3PassDecryptVrfKeypair({
-					nearAccountId: accountId,
-					kek_s_b64u: deterministicKeysResult.serverEncryptedVrfKeypair.kek_s_b64u,
-					ciphertextVrfB64u: deterministicKeysResult.serverEncryptedVrfKeypair.ciphertextVrfB64u,
-					serverKeyId: deterministicKeysResult.serverEncryptedVrfKeypair.serverKeyId
-				});
-				if (unlockResult.success) {
-					console.log("LinkDeviceFlow: Shamir 3-pass unlock successful for auto-login");
-					if (this.cancelled) {
-						console.warn("LinkDeviceFlow: Auto-login aborted after Shamir unlock because flow was cancelled");
-						return;
-					}
-					await this.context.webAuthnManager.initializeCurrentUser(accountId, this.context.nearClient);
-					await this.context.webAuthnManager.setLastUser(accountId, deviceNumber);
-					this.hookOptions?.onEvent?.({
-						step: 8,
-						phase: DeviceLinkingPhase.STEP_8_AUTO_LOGIN,
-						status: DeviceLinkingStatus.SUCCESS,
-						message: `Welcome ${accountId}`
-					});
-					return;
-				} else console.log("LinkDeviceFlow: Shamir 3-pass unlock failed, falling back to TouchID");
-			} catch (error) {
-				console.log("LinkDeviceFlow: Shamir 3-pass unlock error, falling back to TouchID:", error);
-			}
-			try {
-				const nonceManager = this.context.webAuthnManager.getNonceManager();
-				const { nextNonce: _nextNonce, txBlockHash, txBlockHeight } = await nonceManager.getNonceBlockHashAndHeight(this.context.nearClient);
-				const authChallenge = await this.context.webAuthnManager.generateVrfChallengeOnce({
-					userId: accountId,
-					rpId: this.context.webAuthnManager.getRpId(),
-					blockHash: txBlockHash,
-					blockHeight: txBlockHeight
-				});
-				const authenticators = await this.context.webAuthnManager.getAuthenticatorsByUser(accountId);
-				const authCredential = await this.context.webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({
-					nearAccountId: accountId,
-					challenge: authChallenge,
-					credentialIds: authenticators.map((a) => a.credentialId)
-				});
-				const vrfUnlockResult = await this.context.webAuthnManager.unlockVRFKeypair({
-					nearAccountId: accountId,
-					encryptedVrfKeypair: deterministicKeysResult.encryptedVrfKeypair,
-					credential: authCredential
-				});
-				if (!vrfUnlockResult.success) throw new Error(vrfUnlockResult.error || "VRF unlock failed during auto-login");
-				await this.context.webAuthnManager.initializeCurrentUser(accountId, this.context.nearClient);
-				await this.context.webAuthnManager.setLastUser(accountId, deviceNumber);
-				this.hookOptions?.onEvent?.({
-					step: 8,
-					phase: DeviceLinkingPhase.STEP_8_AUTO_LOGIN,
-					status: DeviceLinkingStatus.SUCCESS,
-					message: `Welcome ${accountId}`
-				});
-				try {
-					await getLoginSession(this.context, accountId);
-				} catch {}
-			} catch (unlockError) {
-				console.warn("LinkDeviceFlow: TouchID VRF unlock failed during auto-login:", unlockError);
-				await this.context.webAuthnManager.initializeCurrentUser(accountId, this.context.nearClient);
-				await this.context.webAuthnManager.setLastUser(accountId, deviceNumber);
-				this.hookOptions?.onEvent?.({
-					step: 0,
-					phase: DeviceLinkingPhase.LOGIN_ERROR,
-					status: DeviceLinkingStatus.ERROR,
-					error: unlockError.message,
-					message: unlockError.message
-				});
-			}
-		} catch (loginError) {
-			console.warn("Login failed after device linking:", loginError);
-			options?.options?.onEvent?.({
-				step: 0,
-				phase: DeviceLinkingPhase.LOGIN_ERROR,
-				status: DeviceLinkingStatus.ERROR,
-				error: loginError.message,
-				message: loginError.message
-			});
-		}
-	}
-	/**
-	* Device2: Store authenticator data locally on Device2
-	*/
-	async storeDeviceAuthenticator(deterministicKeysResult) {
-		if (!this.session || !this.session.accountId) throw new Error("Session or account ID not available for storing authenticator");
-		try {
-			const { webAuthnManager } = this.context;
-			const { credential, accountId } = this.session;
-			if (!credential) throw new Error("WebAuthn credential not available after VRF migration");
-			if (!deterministicKeysResult?.encryptedVrfKeypair) throw new Error("VRF credentials not available after migration");
-			if (this.session.deviceNumber === void 0 || this.session.deviceNumber === null) throw new Error("Device number not available - cannot determine device-specific account ID");
-			const deviceNumber = parseDeviceNumber(this.session.deviceNumber, { min: 1 });
-			if (deviceNumber === null) throw new Error(`Invalid device number in session: ${String(this.session.deviceNumber)}`);
-			this.session.deviceNumber = deviceNumber;
-			console.debug("Storing device authenticator data with device number: ", deviceNumber);
-			await webAuthnManager.storeUserData({
-				nearAccountId: accountId,
-				deviceNumber,
-				clientNearPublicKey: deterministicKeysResult.nearPublicKey,
-				lastUpdated: Date.now(),
-				passkeyCredential: {
-					id: credential.id,
-					rawId: credential.rawId
-				},
-				encryptedVrfKeypair: {
-					encryptedVrfDataB64u: deterministicKeysResult.encryptedVrfKeypair.encryptedVrfDataB64u,
-					chacha20NonceB64u: deterministicKeysResult.encryptedVrfKeypair.chacha20NonceB64u
-				},
-				serverEncryptedVrfKeypair: deterministicKeysResult.serverEncryptedVrfKeypair || void 0
-			});
-			const attestationB64u = credential.response.attestationObject;
-			const credentialPublicKey = await webAuthnManager.extractCosePublicKey(attestationB64u);
-			await webAuthnManager.storeAuthenticator({
-				nearAccountId: accountId,
-				deviceNumber,
-				credentialId: credential.rawId,
-				credentialPublicKey,
-				transports: ["internal"],
-				name: `Device ${deviceNumber} Passkey for ${accountId.split(".")[0]}`,
-				registered: (/* @__PURE__ */ new Date()).toISOString(),
-				syncedAt: (/* @__PURE__ */ new Date()).toISOString(),
-				vrfPublicKey: deterministicKeysResult.vrfPublicKey
-			});
-		} catch (error) {
-			console.error(`LinkDeviceFlow: Failed to store authenticator data:`, error);
-			await this.cleanupFailedLinkingAttempt();
-			throw error;
-		}
-	}
-	/**
-	* 1. Derives deterministic VRF and NEAR keys using real accountID (instead of temporary keys)
-	* 2. Executes Key Replacement transaction to replace temporary key with the real key
-	* 3. Stores authenticator and VRF data; on-chain registration is handled separately via VRF-driven flow.
-	*/
-	async deriveDeterministicKeysAndRegisterAccount() {
-		if (!this.session || !this.session.accountId) throw new Error("Session account ID not available for migration");
-		const realAccountId = this.session.accountId;
-		const confirmerText = this.hookOptions?.confirmerText;
-		const confirmationConfigOverride = this.hookOptions?.confirmationConfig;
-		const confirm = await this.context.webAuthnManager.requestRegistrationCredentialConfirmation({
-			nearAccountId: realAccountId,
-			deviceNumber: this.session.deviceNumber,
-			confirmerText,
-			confirmationConfigOverride
-		});
-		if (!confirm.confirmed || !confirm.credential) throw new Error("User cancelled link-device confirmation");
-		this.session.credential = confirm.credential;
-		this.session.vrfChallenge = confirm.vrfChallenge || null;
-		const vrfDerivationResult = await this.context.webAuthnManager.deriveVrfKeypair({
-			credential: confirm.credential,
-			nearAccountId: realAccountId
-		});
-		if (!vrfDerivationResult.success || !vrfDerivationResult.encryptedVrfKeypair) throw new Error("Failed to derive VRF keypair from PRF for real account");
-		const nearKeyResultStep1 = await this.context.webAuthnManager.deriveNearKeypairAndEncryptFromSerialized({
-			nearAccountId: realAccountId,
-			credential: confirm.credential,
-			options: { deviceNumber: this.session.deviceNumber }
-		});
-		if (!nearKeyResultStep1.success || !nearKeyResultStep1.publicKey) throw new Error("Failed to derive NEAR keypair in step 1");
-		this.context.webAuthnManager.getNonceManager().initializeUser(realAccountId, this.session.nearPublicKey);
-		const { nextNonce, txBlockHash } = await this.context.webAuthnManager.getNonceManager().getNonceBlockHashAndHeight(this.context.nearClient);
-		await this.executeKeySwapTransaction(nearKeyResultStep1.publicKey, nextNonce, txBlockHash);
-		this.context.webAuthnManager.getNonceManager().initializeUser(realAccountId, nearKeyResultStep1.publicKey);
-		if (this.session?.tempPrivateKey) {
-			try {
-				await IndexedDBManager.nearKeysDB.deleteEncryptedKey("temp-device-linking.testnet");
-			} catch {}
-			this.cleanupTemporaryKeyFromMemory();
-		}
-		if (!this.session.credential) throw new Error("WebAuthn credential not available after VRF migration");
-		const result = {
-			encryptedVrfKeypair: vrfDerivationResult.encryptedVrfKeypair,
-			serverEncryptedVrfKeypair: vrfDerivationResult.serverEncryptedVrfKeypair,
-			vrfPublicKey: vrfDerivationResult.vrfPublicKey,
-			nearPublicKey: nearKeyResultStep1.publicKey,
-			credential: this.session.credential,
-			vrfChallenge: this.session.vrfChallenge
-		};
-		return result;
-	}
-	/**
-	* Execute key replacement transaction for Option F flow
-	* Replace temporary key with properly derived key using AddKey + DeleteKey
-	*/
-	async executeKeySwapTransaction(newPublicKey, nextNonce, txBlockHash) {
-		if (!this.session?.tempPrivateKey || !this.session?.accountId) throw new Error("Missing temporary private key or account ID for key replacement");
-		const { tempPrivateKey, accountId, nearPublicKey: oldPublicKey } = this.session;
-		try {
-			const actions = [{
-				action_type: ActionType.AddKey,
-				public_key: newPublicKey,
-				access_key: JSON.stringify({
-					nonce: 0,
-					permission: { FullAccess: {} }
-				})
-			}, {
-				action_type: ActionType.DeleteKey,
-				public_key: oldPublicKey
-			}];
-			const keySwapResult = await this.context.webAuthnManager.signTransactionWithKeyPair({
-				nearPrivateKey: tempPrivateKey,
-				signerAccountId: accountId,
-				receiverId: accountId,
-				nonce: nextNonce,
-				blockHash: txBlockHash,
-				actions
-			});
-			await this.context.nearClient.sendTransaction(keySwapResult.signedTransaction, DEFAULT_WAIT_STATUS.linkDeviceSwapKey);
-			try {
-				await this.context.webAuthnManager.getNonceManager().updateNonceFromBlockchain(this.context.nearClient, nextNonce);
-			} catch (e) {
-				console.warn("[LinkDeviceFlow]: Failed to update nonce after key swap broadcast:", e);
-			}
-		} catch (error) {
-			console.error(`LinkDeviceFlow: Key replacement transaction failed:`, error);
-			throw new Error(`Key replacement failed: ${error instanceof Error ? error.message : "Unknown error"}`);
-		}
-	}
-	/**
-	* Clean up failed linking attempts - remove any partially stored data
-	*/
-	async cleanupFailedLinkingAttempt() {
-		if (!this.session) return;
-		try {
-			const { credential, accountId, nearPublicKey } = this.session;
-			this.cleanupTemporaryKeyFromMemory();
-			if (accountId && credential) {
-				try {
-					await IndexedDBManager.clientDB.deleteAllAuthenticatorsForUser(accountId);
-				} catch {}
-				try {
-					await IndexedDBManager.clientDB.deleteUser(accountId);
-				} catch {}
-				try {
-					await IndexedDBManager.nearKeysDB.deleteEncryptedKey(accountId);
-				} catch {}
-			}
-			try {
-				await IndexedDBManager.nearKeysDB.deleteEncryptedKey("temp-device-linking.testnet");
-			} catch {}
-		} catch (error) {
-			console.error(`LinkDeviceFlow: Error during cleanup:`, error);
-		}
-	}
-	/**
-	* Stop polling - guaranteed to clear any existing interval
-	*/
-	stopPolling() {
-		if (this.pollingInterval) {
-			clearTimeout(this.pollingInterval);
-			this.pollingInterval = void 0;
-		}
-		this.pollGeneration++;
-	}
-	/**
-	* Stop registration retry timeout
-	*/
-	stopRegistrationRetry() {
-		if (this.registrationRetryTimeout) {
-			clearTimeout(this.registrationRetryTimeout);
-			this.registrationRetryTimeout = void 0;
-		}
-	}
-	/**
-	* Get current flow state
-	*/
-	getState() {
-		return {
-			phase: this.session?.phase,
-			session: this.session,
-			error: this.error
-		};
-	}
-	/**
-	* Cancel the flow and cleanup
-	*/
-	cancel() {
-		this.cancelled = true;
-		this.stopPolling();
-		this.stopRegistrationRetry();
-		this.cleanupTemporaryKeyFromMemory();
-		this.session = null;
-		this.error = void 0;
-		this.registrationRetryCount = 0;
-	}
-	/**
-	* Reset flow to initial state
-	*/
-	reset() {
-		this.cancel();
-	}
-};
-
-//#endregion
-export { LinkDeviceFlow };
-//# sourceMappingURL=linkDevice.js.map