@tatchi-xyz/sdk 0.31.0 → 0.31.1

package/dist/esm/react/src/core/TatchiPasskey/registration.js

@@ -45,7 +45,7 @@ async function registerPasskeyInternal(context, nearAccountId, options, authenti
 			step: 1,
 			phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,
 			status: RegistrationStatus.PROGRESS,
-			message: "Account available, generating credentials..."
+			message: "Generating passkey credential..."
 		});
 		const confirmationConfig = {
 			uiMode: "modal",
@@ -61,26 +61,13 @@ async function registerPasskeyInternal(context, nearAccountId, options, authenti
 		});
 		const credential = registrationSession.credential;
 		const vrfChallenge = registrationSession.vrfChallenge;
+		const transactionContext = registrationSession.transactionContext;
 		onEvent?.({
 			step: 1,
 			phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,
 			status: RegistrationStatus.SUCCESS,
 			message: "WebAuthn ceremony successful"
 		});
-		const canRegisterUserPromise = webAuthnManager.checkCanRegisterUser({
-			contractId: context.configs.contractId,
-			credential,
-			vrfChallenge,
-			onEvent: (progress) => {
-				console.debug(`Registration progress: ${progress.step} - ${progress.message}`);
-				onEvent?.({
-					step: 3,
-					phase: RegistrationPhase.STEP_3_CONTRACT_PRE_CHECK,
-					status: RegistrationStatus.PROGRESS,
-					message: `${progress.message}`
-				});
-			}
-		});
 		const deterministicVrfKeyResult = await webAuthnManager.deriveVrfKeypair({
 			credential,
 			nearAccountId,
@@ -112,12 +99,6 @@ async function registerPasskeyInternal(context, nearAccountId, options, authenti
 			if (!derived.success || !derived.clientVerifyingShareB64u) throw new Error(derived.error || "Failed to derive threshold client verifying share");
 			thresholdClientVerifyingShareB64u = derived.clientVerifyingShareB64u;
 		}
-		const canRegisterUserResult = await canRegisterUserPromise;
-		if (!canRegisterUserResult.verified) {
-			console.error(canRegisterUserResult);
-			const errorMessage = canRegisterUserResult.error || "User verification failed - account may already exist or contract is unreachable";
-			throw new Error(`Web3Authn contract registration check failed: ${errorMessage}`);
-		}
 		onEvent?.({
 			step: 2,
 			phase: RegistrationPhase.STEP_2_KEY_GENERATION,
@@ -143,15 +124,26 @@ async function registerPasskeyInternal(context, nearAccountId, options, authenti
 		const expectedAccessKeys = [nearPublicKey];
 		const thresholdPublicKey = String(accountAndRegistrationResult?.thresholdEd25519?.publicKey || "").trim();
 		const relayerKeyId = String(accountAndRegistrationResult?.thresholdEd25519?.relayerKeyId || "").trim();
-		const accessKeyVerified = await verifyAccountAccessKeysPresent(context.nearClient, nearAccountId, expectedAccessKeys);
-		if (!accessKeyVerified) throw new Error("On-chain access key mismatch or not found after registration");
-		onEvent?.({
+		const accessKeyVerified = await verifyAccountAccessKeysPresent(context.nearClient, nearAccountId, expectedAccessKeys, {
+			attempts: 3,
+			delayMs: 200,
+			finality: "optimistic"
+		});
+		if (!accessKeyVerified) {
+			console.warn("[Registration] Access key not yet visible after atomic registration; continuing optimistically");
+			onEvent?.({
+				step: 6,
+				phase: RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,
+				status: RegistrationStatus.SUCCESS,
+				message: "Access key verification pending (optimistic); continuing..."
+			});
+		} else onEvent?.({
 			step: 6,
 			phase: RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,
 			status: RegistrationStatus.SUCCESS,
 			message: "Access key verified on-chain"
 		});
-		await activateThresholdEnrollmentPostRegistration({
+		activateThresholdEnrollmentPostRegistration({
 			requestedSignerMode: requestedSignerModeStr,
 			nearAccountId,
 			nearPublicKey,
@@ -166,7 +158,7 @@ async function registerPasskeyInternal(context, nearAccountId, options, authenti
 			webAuthnManager: context.webAuthnManager,
 			nearClient: context.nearClient,
 			onEvent
-		});
+		}).catch(() => {});
 		onEvent?.({
 			step: 7,
 			phase: RegistrationPhase.STEP_7_DATABASE_STORAGE,
@@ -188,31 +180,12 @@ async function registerPasskeyInternal(context, nearAccountId, options, authenti
 			status: RegistrationStatus.SUCCESS,
 			message: "Registration metadata stored successfully"
 		});
-		try {
-			context.webAuthnManager.getNonceManager().initializeUser(nearAccountId, nearPublicKey);
-			await context.webAuthnManager.getNonceManager().prefetchBlockheight(context.nearClient);
-		} catch {}
 		let vrfStatus = await webAuthnManager.checkVrfStatus().catch(() => ({ active: false }));
 		if (!vrfStatus?.active) {
-			const blockInfo = await context.nearClient.viewBlock({ finality: "final" });
-			const txBlockHash = blockInfo?.header?.hash;
-			const txBlockHeight = String(blockInfo.header?.height ?? "");
-			const vrfChallenge2 = await webAuthnManager.generateVrfChallengeOnce({
-				userId: nearAccountId,
-				rpId: webAuthnManager.getRpId(),
-				blockHash: txBlockHash,
-				blockHeight: txBlockHeight
-			});
-			const authenticators = await webAuthnManager.getAuthenticatorsByUser(nearAccountId);
-			const authCredential = await webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({
-				nearAccountId,
-				challenge: vrfChallenge2,
-				credentialIds: authenticators.map((a) => a.credentialId)
-			});
-			const unlockResult = await webAuthnManager.unlockVRFKeypair({
+			const unlockNoPrompt = await webAuthnManager.unlockVRFKeypair({
 				nearAccountId,
 				encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,
-				credential: authCredential
+				credential
 			}).catch((unlockError) => {
 				const message = unlockError && typeof unlockError === "object" && "message" in unlockError ? String(unlockError.message || "") : String(unlockError || "");
 				return {
@@ -220,13 +193,46 @@ async function registerPasskeyInternal(context, nearAccountId, options, authenti
 					error: message
 				};
 			});
-			if (!unlockResult.success) {
-				console.warn("VRF keypair unlock failed:", unlockResult.error);
-				throw new Error(unlockResult.error);
-			}
+			if (!unlockNoPrompt.success) {
+				let txBlockHash = String(transactionContext?.txBlockHash || "").trim();
+				let txBlockHeight = String(transactionContext?.txBlockHeight || "").trim();
+				if (!txBlockHash || !txBlockHeight) {
+					const blockInfo = await context.nearClient.viewBlock({ finality: "final" });
+					txBlockHash = String(blockInfo?.header?.hash || "").trim();
+					txBlockHeight = String(blockInfo?.header?.height ?? "").trim();
+				}
+				const vrfChallenge2 = await webAuthnManager.generateVrfChallengeOnce({
+					userId: nearAccountId,
+					rpId: webAuthnManager.getRpId(),
+					blockHash: txBlockHash,
+					blockHeight: txBlockHeight
+				});
+				const allowCredentialIds = String(credential?.rawId || "").trim() ? [String(credential.rawId)] : (await webAuthnManager.getAuthenticatorsByUser(nearAccountId)).map((a) => a.credentialId);
+				const authCredential = await webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({
+					nearAccountId,
+					challenge: vrfChallenge2,
+					credentialIds: allowCredentialIds
+				});
+				const unlockResult = await webAuthnManager.unlockVRFKeypair({
+					nearAccountId,
+					encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,
+					credential: authCredential
+				}).catch((unlockError) => {
+					const message = unlockError && typeof unlockError === "object" && "message" in unlockError ? String(unlockError.message || "") : String(unlockError || "");
+					return {
+						success: false,
+						error: message
+					};
+				});
+				if (!unlockResult.success) {
+					console.warn("VRF keypair unlock failed:", unlockResult.error);
+					throw new Error(unlockResult.error);
+				}
+			} else console.debug("Registration: VRF unlocked using registration credential; skipping extra Touch ID unlock");
 		} else console.debug("Registration: VRF session already active; skipping extra Touch ID unlock");
 		try {
-			await webAuthnManager.initializeCurrentUser(nearAccountId, context.nearClient);
+			await webAuthnManager.initializeCurrentUser(nearAccountId);
+			webAuthnManager.getNonceManager().prefetchBlockheight(context.nearClient).catch(() => {});
 		} catch (initErr) {
 			console.warn("Failed to initialize current user after registration:", initErr);
 		}
@@ -387,7 +393,11 @@ async function activateThresholdEnrollmentPostRegistration(opts) {
 		const signedTx = signed?.signedTransaction;
 		if (!signedTx) throw new Error("Failed to sign AddKey(thresholdPublicKey) transaction");
 		await opts.nearClient.sendTransaction(signedTx, DEFAULT_WAIT_STATUS.thresholdAddKey);
-		const thresholdKeyVerified = await verifyAccountAccessKeysPresent(opts.nearClient, opts.nearAccountId, [opts.nearPublicKey, thresholdPublicKey]);
+		const thresholdKeyVerified = await verifyAccountAccessKeysPresent(opts.nearClient, opts.nearAccountId, [opts.nearPublicKey, thresholdPublicKey], {
+			attempts: 6,
+			delayMs: 250,
+			finality: "optimistic"
+		});
 		if (!thresholdKeyVerified) throw new Error("Threshold access key not found on-chain after AddKey");
 		await IndexedDBManager.nearKeysDB.storeKeyMaterial({
 			kind: "threshold_ed25519_2p_v1",
@@ -423,14 +433,15 @@ async function verifyAccountAccessKeysPresent(nearClient, nearAccountId, expecte
 	if (!unique.length) return false;
 	const attempts = Math.max(1, Math.floor(opts?.attempts ?? 6));
 	const delayMs = Math.max(50, Math.floor(opts?.delayMs ?? 750));
+	const finality = opts?.finality ?? "optimistic";
 	for (let i = 0; i < attempts; i++) {
 		try {
-			const { fullAccessKeys, functionCallAccessKeys } = await nearClient.getAccessKeys({ account: nearAccountId });
-			const keys = [...fullAccessKeys, ...functionCallAccessKeys].map((k) => ensureEd25519Prefix(k.public_key));
+			const accessKeyList = await nearClient.viewAccessKeyList(nearAccountId, { finality });
+			const keys = accessKeyList.keys.map((k) => ensureEd25519Prefix(k.public_key)).filter(Boolean);
 			const allPresent = unique.every((expected) => keys.includes(expected));
 			if (allPresent) return true;
 		} catch {}
-		await new Promise((res) => setTimeout(res, delayMs));
+		if (i < attempts - 1) await new Promise((res) => setTimeout(res, delayMs));
 	}
 	return false;
 }

package/dist/esm/react/src/core/TatchiPasskey/registration.js.map

@@ -1 +1 @@
-{"version":3,"file":"registration.js","names":["confirmationConfig: Partial<ConfirmationConfig>","thresholdClientVerifyingShareB64u: string | null","expectedAccessKeys: string[]","error: unknown","rollbackError: unknown"],"sources":["../../../../../../src/core/TatchiPasskey/registration.ts"],"sourcesContent":["import type { NearClient } from '../NearClient';\nimport { ensureEd25519Prefix, validateNearAccountId } from '../../utils/validation';\nimport type {\n  RegistrationHooksOptions,\n  RegistrationSSEEvent,\n} from '../types/sdkSentEvents';\nimport type { RegistrationResult, TatchiConfigs } from '../types/tatchi';\nimport type { AuthenticatorOptions } from '../types/authenticatorOptions';\nimport { RegistrationPhase, RegistrationStatus } from '../types/sdkSentEvents';\nimport {\n  createAccountAndRegisterWithRelayServer\n} from './faucets/createAccountRelayServer';\nimport { PasskeyManagerContext } from './index';\nimport { WebAuthnManager } from '../WebAuthnManager';\nimport { IndexedDBManager } from '../IndexedDBManager';\nimport { VRFChallenge } from '../types/vrf-worker';\nimport { type ConfirmationConfig, type SignerMode, mergeSignerMode } from '../types/signer-worker';\nimport type { WebAuthnRegistrationCredential } from '../types/webauthn';\nimport type { AccountId } from '../types/accountIds';\nimport { getUserFriendlyErrorMessage } from '../../utils/errors';\nimport { authenticatorsToAllowCredentials } from '../WebAuthnManager/touchIdPrompt';\nimport { DEFAULT_WAIT_STATUS } from '../types/rpc';\nimport { buildThresholdEd25519Participants2pV1 } from '../../threshold/participants';\n// Registration forces a visible, clickable confirmation for cross‑origin safety\n\n/**\n * Core registration function that handles passkey registration\n *\n * VRF Registration Flow (Single VRF Keypair):\n * 1. Generate VRF keypair (ed25519) using crypto.randomUUID() + persist in worker memory\n * 2. Generate VRF proof + output using the VRF keypair\n *    - VRF input with domain separator + NEAR block height + hash\n * 3. Use VRF output as WebAuthn challenge in registration ceremony\n * 4. Derive AES key from WebAuthn PRF output and encrypt the SAME VRF keypair\n * 5. Store encrypted VRF keypair in IndexedDB\n * 6. Call contract verify_registration_response with VRF proof + WebAuthn registration payload\n * 7. Contract verifies VRF proof and WebAuthn registration (challenges match!)\n * 8. Contract stores VRF pubkey + authenticator credentials on-chain for\n *    future stateless authentication\n */\nexport async function registerPasskeyInternal(\n  context: PasskeyManagerContext,\n  nearAccountId: AccountId,\n  options: RegistrationHooksOptions,\n  authenticatorOptions: AuthenticatorOptions,\n  confirmationConfigOverride?: Partial<ConfirmationConfig>\n): Promise<RegistrationResult> {\n\n  const { onEvent, onError, afterCall } = options;\n  const { webAuthnManager, configs } = context;\n\n  // Track registration progress for rollback\n  const registrationState = {\n    accountCreated: false,\n    contractRegistered: false,\n    databaseStored: false,\n    contractTransactionId: null as string | null,\n  };\n\n  console.log('⚡ Registration: Passkey registration with VRF WebAuthn');\n  onEvent?.({\n    step: 1,\n    phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n    status: RegistrationStatus.PROGRESS,\n    message: `Starting registration for ${nearAccountId}`\n  } as RegistrationSSEEvent);\n\n  try {\n\n    await validateRegistrationInputs(context, nearAccountId, onEvent, onError);\n\n    onEvent?.({\n      step: 1,\n      phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Account available, generating credentials...'\n    });\n\n    const confirmationConfig: Partial<ConfirmationConfig> = {\n      uiMode: 'modal',\n      behavior: 'requireClick', // cross‑origin safari requirement: must requireClick\n      theme: (context.configs?.walletTheme === 'light') ? 'light' : 'dark',\n      ...(confirmationConfigOverride ?? options?.confirmationConfig ?? {}),\n    };\n\n    const registrationSession = await context.webAuthnManager.requestRegistrationCredentialConfirmation({\n      nearAccountId: String(nearAccountId),\n      deviceNumber: 1,\n      confirmerText: options?.confirmerText,\n      confirmationConfigOverride: confirmationConfig,\n    });\n\n    const credential = registrationSession.credential;\n    const vrfChallenge = registrationSession.vrfChallenge;\n\n    onEvent?.({\n      step: 1,\n      phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n      status: RegistrationStatus.SUCCESS,\n      message: 'WebAuthn ceremony successful'\n    });\n\n    // Start the contract pre-check, run it in parallel to key derivation (await later)\n    const canRegisterUserPromise = webAuthnManager.checkCanRegisterUser({\n      contractId: context.configs.contractId,\n      credential,\n      vrfChallenge,\n      onEvent: (progress) => {\n        console.debug(`Registration progress: ${progress.step} - ${progress.message}`);\n        onEvent?.({\n          step: 3,\n          phase: RegistrationPhase.STEP_3_CONTRACT_PRE_CHECK,\n          status: RegistrationStatus.PROGRESS,\n          message: `${progress.message}`\n        });\n      },\n    });\n\n    // 1) Ensure VRF keypair is derived and loaded in-memory\n    // before deriving WrapKeySeed for NEAR key encryption\n    const deterministicVrfKeyResult = await webAuthnManager.deriveVrfKeypair({\n      credential,\n      nearAccountId,\n      saveInMemory: true,\n    });\n    if (!deterministicVrfKeyResult.success || !deterministicVrfKeyResult.vrfPublicKey) {\n      throw new Error('Failed to derive deterministic VRF keypair from PRF');\n    }\n\n    const baseSignerMode = webAuthnManager.getUserPreferences().getSignerMode();\n    const requestedSignerMode = mergeSignerMode(baseSignerMode, options?.signerMode);\n    const requestedSignerModeStr = requestedSignerMode.mode;\n\n    // 2) Derive/enroll the local NEAR key after VRF keypair exists.\n    const nearKeyResult = await webAuthnManager.deriveNearKeypairAndEncryptFromSerialized({\n      credential,\n      nearAccountId,\n      options: { deviceNumber: 1 },\n    });\n    if (!nearKeyResult.success || !nearKeyResult.publicKey) {\n      const reason = nearKeyResult?.error || 'Failed to generate NEAR keypair with PRF';\n      throw new Error(reason);\n    }\n    const nearPublicKey = nearKeyResult.publicKey;\n    const wrapKeySalt = String(nearKeyResult.wrapKeySalt || '').trim();\n    if (!wrapKeySalt) {\n      throw new Error('Missing wrapKeySalt after local key derivation');\n    }\n\n    // Optional: threshold-signer enrollment during registration.\n    // Derive client verifying share (public) and let the relay compute threshold group public key\n    // and include it in the on-chain AddKey set during create_account_and_register_user.\n    let thresholdClientVerifyingShareB64u: string | null = null;\n    if (requestedSignerModeStr === 'threshold-signer') {\n      const derived = await webAuthnManager.deriveThresholdEd25519ClientVerifyingShareFromCredential({\n        credential,\n        nearAccountId,\n        wrapKeySalt,\n      });\n      if (!derived.success || !derived.clientVerifyingShareB64u) {\n        throw new Error(derived.error || 'Failed to derive threshold client verifying share');\n      }\n      thresholdClientVerifyingShareB64u = derived.clientVerifyingShareB64u;\n    }\n\n    // 3) Await contract registration check (main blocker)\n    const canRegisterUserResult = await canRegisterUserPromise;\n    if (!canRegisterUserResult.verified) {\n      console.error(canRegisterUserResult);\n      const errorMessage = canRegisterUserResult.error || 'User verification failed - account may already exist or contract is unreachable';\n      throw new Error(`Web3Authn contract registration check failed: ${errorMessage}`);\n    }\n\n    // Step 4-5: Create account and register with contract using the relay (atomic)\n    onEvent?.({\n      step: 2,\n      phase: RegistrationPhase.STEP_2_KEY_GENERATION,\n      status: RegistrationStatus.SUCCESS,\n      message: 'Wallet derived successfully from Passkey',\n      verified: true,\n      nearAccountId: nearAccountId,\n      nearPublicKey: nearPublicKey,\n      vrfPublicKey: vrfChallenge.vrfPublicKey,\n    });\n\n    let accountAndRegistrationResult;\n    accountAndRegistrationResult = await createAccountAndRegisterWithRelayServer(\n      context,\n      nearAccountId,\n      nearPublicKey,\n      credential,\n      vrfChallenge,\n      deterministicVrfKeyResult.vrfPublicKey,\n      authenticatorOptions,\n      onEvent,\n      {\n        thresholdEd25519: thresholdClientVerifyingShareB64u\n          ? { clientVerifyingShareB64u: thresholdClientVerifyingShareB64u }\n          : undefined,\n      },\n    );\n\n    if (!accountAndRegistrationResult.success) {\n      throw new Error(accountAndRegistrationResult.error || 'Account creation and registration failed');\n    }\n\n    // Update registration state based on results\n    registrationState.accountCreated = true;\n    registrationState.contractRegistered = true;\n    registrationState.contractTransactionId = accountAndRegistrationResult.transactionId || null;\n\n    // Step 6: Post-commit verification: ensure on-chain access key matches expected public key\n    onEvent?.({\n      step: 6,\n      phase: RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Verifying on-chain access key matches expected public key...'\n    });\n\n    const expectedAccessKeys: string[] = [nearPublicKey];\n    const thresholdPublicKey = String(accountAndRegistrationResult?.thresholdEd25519?.publicKey || '').trim();\n    const relayerKeyId = String(accountAndRegistrationResult?.thresholdEd25519?.relayerKeyId || '').trim();\n\n    const accessKeyVerified = await verifyAccountAccessKeysPresent(\n      context.nearClient,\n      nearAccountId,\n      expectedAccessKeys,\n    );\n\n    if (!accessKeyVerified) {\n      throw new Error('On-chain access key mismatch or not found after registration');\n    }\n\n    onEvent?.({\n      step: 6,\n      phase: RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,\n      status: RegistrationStatus.SUCCESS,\n      message: 'Access key verified on-chain'\n    });\n\n    await activateThresholdEnrollmentPostRegistration({\n      requestedSignerMode: requestedSignerModeStr,\n      nearAccountId,\n      nearPublicKey,\n      thresholdPublicKey,\n      relayerKeyId,\n      clientParticipantId: accountAndRegistrationResult?.thresholdEd25519?.clientParticipantId,\n      relayerParticipantId: accountAndRegistrationResult?.thresholdEd25519?.relayerParticipantId,\n      thresholdClientVerifyingShareB64u,\n      relayerVerifyingShareB64u: String(\n        accountAndRegistrationResult?.thresholdEd25519?.relayerVerifyingShareB64u || '',\n      ).trim(),\n      credential,\n      wrapKeySalt,\n      webAuthnManager: context.webAuthnManager,\n      nearClient: context.nearClient,\n      onEvent,\n    });\n\n    // Step 7: Store user data with VRF credentials atomically\n    onEvent?.({\n      step: 7,\n      phase: RegistrationPhase.STEP_7_DATABASE_STORAGE,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Storing passkey wallet metadata...'\n    });\n\n    await webAuthnManager.atomicStoreRegistrationData({\n      nearAccountId,\n      credential,\n      publicKey: nearPublicKey,\n      encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,\n      vrfPublicKey: deterministicVrfKeyResult.vrfPublicKey,\n      serverEncryptedVrfKeypair: deterministicVrfKeyResult.serverEncryptedVrfKeypair,\n    });\n\n    // Mark database as stored for rollback tracking\n    registrationState.databaseStored = true;\n\n    onEvent?.({\n      step: 7,\n      phase: RegistrationPhase.STEP_7_DATABASE_STORAGE,\n      status: RegistrationStatus.SUCCESS,\n      message: 'Registration metadata stored successfully'\n    });\n\n    // Initialize NonceManager with newly stored user before fetching block/nonce\n    try {\n      context.webAuthnManager.getNonceManager().initializeUser(nearAccountId, nearPublicKey);\n      await context.webAuthnManager.getNonceManager().prefetchBlockheight(context.nearClient);\n    } catch {}\n\n    // Step 7: Ensure VRF session is active for auto-login\n    // If VRF keypair is already in-memory (saved earlier), skip an extra Touch ID prompt.\n    let vrfStatus = await webAuthnManager.checkVrfStatus().catch(() => ({ active: false }));\n    if (!vrfStatus?.active) {\n      // Obtain an authentication credential for VRF unlock (separate from registration credential)\n      // IMPORTANT: Immediately after account creation, the new access key may not be queryable yet on some RPC nodes.\n      // We only need fresh block info for the VRF challenge here, so fetch the block directly to avoid AK lookup failures.\n      const blockInfo = await context.nearClient.viewBlock({ finality: 'final' });\n      const txBlockHash = blockInfo?.header?.hash;\n      const txBlockHeight = String(blockInfo.header?.height ?? '');\n      const vrfChallenge2 = await webAuthnManager.generateVrfChallengeOnce({\n        userId: nearAccountId,\n        rpId: webAuthnManager.getRpId(),\n        blockHash: txBlockHash,\n        blockHeight: txBlockHeight,\n      });\n      const authenticators = await webAuthnManager.getAuthenticatorsByUser(nearAccountId);\n      const authCredential = await webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({\n        nearAccountId,\n        challenge: vrfChallenge2,\n        credentialIds: authenticators.map((a) => a.credentialId),\n      });\n      const unlockResult = await webAuthnManager.unlockVRFKeypair({\n        nearAccountId: nearAccountId,\n        encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,\n        credential: authCredential,\n      }).catch((unlockError: unknown) => {\n        const message = (unlockError && typeof unlockError === 'object' && 'message' in unlockError)\n          ? String((unlockError as { message?: unknown }).message || '')\n          : String(unlockError || '');\n        return { success: false, error: message };\n      });\n\n      if (!unlockResult.success) {\n        console.warn('VRF keypair unlock failed:', unlockResult.error);\n        throw new Error(unlockResult.error);\n      }\n    } else {\n      console.debug('Registration: VRF session already active; skipping extra Touch ID unlock');\n    }\n\n    // Initialize current user only after a successful unlock\n    try {\n      await webAuthnManager.initializeCurrentUser(nearAccountId, context.nearClient);\n    } catch (initErr) {\n      console.warn('Failed to initialize current user after registration:', initErr);\n    }\n\n    onEvent?.({\n      step: 8,\n      phase: RegistrationPhase.STEP_8_REGISTRATION_COMPLETE,\n      status: RegistrationStatus.SUCCESS,\n      message: 'Registration completed!'\n    });\n\n    const successResult = {\n      success: true,\n      nearAccountId: nearAccountId,\n      clientNearPublicKey: nearPublicKey,\n      transactionId: registrationState.contractTransactionId,\n      vrfRegistration: {\n        success: true,\n        vrfPublicKey: vrfChallenge.vrfPublicKey,\n        encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,\n        contractVerified: accountAndRegistrationResult.success,\n      }\n    };\n\n    afterCall?.(true, successResult);\n    return successResult;\n\n  } catch (error: unknown) {\n    const message = (error && typeof error === 'object' && 'message' in error)\n      ? String((error as { message?: unknown }).message || '')\n      : String(error || '');\n    const stack = (error && typeof error === 'object' && 'stack' in error)\n      ? String((error as { stack?: unknown }).stack || '')\n      : '';\n    console.error('Registration failed:', message, stack);\n\n    // Perform rollback based on registration state\n    await performRegistrationRollback(\n      registrationState,\n      nearAccountId,\n      webAuthnManager,\n      onEvent\n    );\n\n    // Use centralized error handling\n    const errorMessage = getUserFriendlyErrorMessage(error, 'registration', nearAccountId);\n\n    const errorObject = new Error(errorMessage);\n    onError?.(errorObject);\n\n    onEvent?.({\n      step: 0,\n      phase: RegistrationPhase.REGISTRATION_ERROR,\n      status: RegistrationStatus.ERROR,\n      message: errorMessage,\n      error: errorMessage\n    } as RegistrationSSEEvent);\n\n    const result = { success: false, error: errorMessage };\n    afterCall?.(false);\n    return result;\n  }\n}\n\n// Backward-compatible wrapper without explicit confirmationConfig override\nexport async function registerPasskey(\n  context: PasskeyManagerContext,\n  nearAccountId: AccountId,\n  options: RegistrationHooksOptions,\n  authenticatorOptions: AuthenticatorOptions\n): Promise<RegistrationResult> {\n  return registerPasskeyInternal(context, nearAccountId, options, authenticatorOptions, undefined);\n}\n\n//////////////////////////////////////\n// HELPER FUNCTIONS\n//////////////////////////////////////\n\n/**\n * Generate a VRF keypair + challenge in VRF wasm worker for WebAuthn registration ceremony bootstrapping\n *\n * ARCHITECTURE: This function solves the chicken-and-egg problem with a single VRF keypair:\n * 1. Generate VRF keypair + challenge (no PRF needed)\n * 2. Persist VRF keypair in worker memory (NOT encrypted yet)\n * 3. Use VRF challenge for WebAuthn ceremony → get PRF output\n * 4. Encrypt the SAME VRF keypair (still in memory) with PRF\n *\n * @param webAuthnManager - WebAuthn manager instance\n * @param nearAccountId - NEAR account ID for VRF input\n * @param blockHeight - Current NEAR block height for freshness\n * @param blockHashBytes - Current NEAR block hash bytes for entropy\n * @returns VRF challenge data (VRF keypair persisted in worker memory)\n */\nexport async function generateBootstrapVrfChallenge(\n  context: PasskeyManagerContext,\n  nearAccountId: AccountId,\n): Promise<VRFChallenge> {\n\n  const { webAuthnManager, nearClient } = context;\n\n  const blockInfo = await nearClient.viewBlock({ finality: 'final' });\n\n  // Generate VRF keypair and persist in worker memory\n  const vrfResult = await webAuthnManager.generateVrfKeypairBootstrap({\n    vrfInputData: {\n      userId: nearAccountId,\n      // Keep VRF rpId consistent with WebAuthn rpId selection logic.\n      rpId: webAuthnManager.getRpId(),\n      blockHeight: String(blockInfo.header.height),\n      blockHash: blockInfo.header.hash,\n    },\n    saveInMemory: true,\n    // VRF keypair persists in worker memory until PRF encryption\n  });\n\n  if (!vrfResult.vrfChallenge) {\n    throw new Error('Registration VRF keypair generation failed');\n  }\n  return vrfResult.vrfChallenge;\n}\n\n/**\n * Validates registration inputs and throws errors if invalid\n * @param nearAccountId - NEAR account ID to validate\n * @param onEvent - Optional callback for registration progress events\n * @param onError - Optional callback for error handling\n */\nconst validateRegistrationInputs = async (\n  context: {\n    configs: TatchiConfigs,\n    webAuthnManager: WebAuthnManager,\n    nearClient: NearClient,\n  },\n  nearAccountId: AccountId,\n  onEvent?: (event: RegistrationSSEEvent) => void,\n  onError?: (error: Error) => void,\n) => {\n\n  onEvent?.({\n    step: 1,\n    phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n    status: RegistrationStatus.PROGRESS,\n    message: 'Validating registration inputs...'\n  } as RegistrationSSEEvent);\n\n  // Validation\n  if (!nearAccountId) {\n    const error = new Error('NEAR account ID is required for registration.');\n    onError?.(error);\n    throw error;\n  }\n  // Validate the account ID format\n  const validation = validateNearAccountId(nearAccountId);\n  if (!validation.valid) {\n    const error = new Error(`Invalid NEAR account ID: ${validation.error}`);\n    onError?.(error);\n    throw error;\n  }\n  if (!window.isSecureContext) {\n    const error = new Error('Passkey operations require a secure context (HTTPS or localhost).');\n    onError?.(error);\n    throw error;\n  }\n\n  // on-chain account existence check is performed later via signer worker (checkCanRegisterUser),\n  onEvent?.({\n    step: 1,\n    phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n    status: RegistrationStatus.PROGRESS,\n    message: `Account format validated, preparing confirmation`\n  } as RegistrationSSEEvent);\n  return;\n}\n\n/**\n * Rollback registration data in case of errors\n */\nasync function performRegistrationRollback(\n  registrationState: {\n    accountCreated: boolean;\n    contractRegistered: boolean;\n    databaseStored: boolean;\n    contractTransactionId: string | null;\n  },\n  nearAccountId: AccountId,\n  webAuthnManager: WebAuthnManager,\n  onEvent?: (event: RegistrationSSEEvent) => void\n): Promise<void> {\n  console.debug('Starting registration rollback...', registrationState);\n\n  // Rollback in reverse order\n  try {\n    // 1. Always clear any in-memory VRF session established during bootstrap\n    await webAuthnManager.clearVrfSession();\n\n    // 2. Rollback database storage\n    if (registrationState.databaseStored) {\n      console.debug('Rolling back database storage...');\n      onEvent?.({\n        step: 0,\n        phase: RegistrationPhase.REGISTRATION_ERROR,\n        status: RegistrationStatus.ERROR,\n        message: 'Rolling back database storage...',\n        error: 'Registration failed - rolling back database storage'\n      } as RegistrationSSEEvent);\n\n      await webAuthnManager.rollbackUserRegistration(nearAccountId);\n      console.debug('Database rollback completed');\n    }\n\n    // 3. Contract rollback on the Web3Authn contract\n    // NOT NEEDED - account creation and contract registration are atomic in the relay server flow\n    if (registrationState.contractRegistered) {\n      console.debug('Contract registration cannot be rolled back (immutable blockchain state)');\n      onEvent?.({\n        step: 0,\n        phase: RegistrationPhase.REGISTRATION_ERROR,\n        status: RegistrationStatus.ERROR,\n        message: `Contract registration (tx: ${registrationState.contractTransactionId}) cannot be rolled back`,\n        error: 'Registration failed - contract state is immutable'\n      } as RegistrationSSEEvent);\n    }\n    console.debug('Registration rollback completed');\n\n  } catch (rollbackError: unknown) {\n    console.error('Rollback failed:', rollbackError);\n    onEvent?.({\n      step: 0,\n      phase: RegistrationPhase.REGISTRATION_ERROR,\n      status: RegistrationStatus.ERROR,\n      message: `Rollback failed: ${\n        (rollbackError && typeof rollbackError === 'object' && 'message' in rollbackError)\n          ? String((rollbackError as { message?: unknown }).message || '')\n          : String(rollbackError || '')\n      }`,\n      error: 'Both registration and rollback failed'\n    } as RegistrationSSEEvent);\n  }\n}\n\nasync function activateThresholdEnrollmentPostRegistration(opts: {\n  requestedSignerMode: SignerMode['mode'];\n  nearAccountId: AccountId;\n  nearPublicKey: string;\n  thresholdPublicKey: string;\n  relayerKeyId: string;\n  clientParticipantId?: number;\n  relayerParticipantId?: number;\n  thresholdClientVerifyingShareB64u: string | null;\n  relayerVerifyingShareB64u: string;\n  credential: WebAuthnRegistrationCredential;\n  wrapKeySalt: string;\n  webAuthnManager: WebAuthnManager;\n  nearClient: NearClient;\n  onEvent?: (event: RegistrationSSEEvent) => void;\n}): Promise<void> {\n  // Optional: activate threshold enrollment post-registration by having the client\n  // submit AddKey(thresholdPublicKey) signed with the local key.\n  if (opts.requestedSignerMode !== 'threshold-signer') return;\n\n  const thresholdPublicKey = String(opts.thresholdPublicKey || '').trim();\n  const relayerKeyId = String(opts.relayerKeyId || '').trim();\n  const clientVerifyingShareB64u = String(opts.thresholdClientVerifyingShareB64u || '').trim();\n  const relayerVerifyingShareB64u = String(opts.relayerVerifyingShareB64u || '').trim();\n\n  if (!thresholdPublicKey || !relayerKeyId || !clientVerifyingShareB64u || !relayerVerifyingShareB64u) {\n    console.warn('[Registration] threshold-signer requested but threshold enrollment details are missing; continuing with local-signer only');\n    return;\n  }\n\n  try {\n    opts.onEvent?.({\n      step: 6,\n      phase: RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Activating threshold access key onchain...'\n    });\n\n    // Prepare a single AddKey transaction signed with the local key (no extra TouchID prompt).\n    try {\n      opts.webAuthnManager.getNonceManager().initializeUser(opts.nearAccountId, opts.nearPublicKey);\n    } catch {}\n    const txContext = await opts.webAuthnManager.getNonceManager().getNonceBlockHashAndHeight(\n      opts.nearClient,\n      { force: true },\n    );\n\n    const signed = await opts.webAuthnManager.signAddKeyThresholdPublicKeyNoPrompt({\n      nearAccountId: opts.nearAccountId,\n      credential: opts.credential,\n      wrapKeySalt: opts.wrapKeySalt,\n      transactionContext: txContext,\n      thresholdPublicKey,\n      relayerVerifyingShareB64u,\n      clientParticipantId: opts.clientParticipantId,\n      relayerParticipantId: opts.relayerParticipantId,\n    });\n\n    const signedTx = signed?.signedTransaction;\n    if (!signedTx) throw new Error('Failed to sign AddKey(thresholdPublicKey) transaction');\n\n    await opts.nearClient.sendTransaction(signedTx, DEFAULT_WAIT_STATUS.thresholdAddKey);\n\n    const thresholdKeyVerified = await verifyAccountAccessKeysPresent(\n      opts.nearClient,\n      opts.nearAccountId,\n      [opts.nearPublicKey, thresholdPublicKey],\n    );\n    if (!thresholdKeyVerified) {\n      throw new Error('Threshold access key not found on-chain after AddKey');\n    }\n\n    await IndexedDBManager.nearKeysDB.storeKeyMaterial({\n      kind: 'threshold_ed25519_2p_v1',\n      nearAccountId: opts.nearAccountId,\n      deviceNumber: 1,\n      publicKey: thresholdPublicKey,\n      wrapKeySalt: opts.wrapKeySalt,\n      relayerKeyId,\n      clientShareDerivation: 'prf_first_v1',\n      participants: buildThresholdEd25519Participants2pV1({\n        clientParticipantId: opts.clientParticipantId,\n        relayerParticipantId: opts.relayerParticipantId,\n        relayerKeyId,\n        relayerUrl: opts.webAuthnManager.tatchiPasskeyConfigs?.relayer?.url,\n        clientVerifyingShareB64u,\n        relayerVerifyingShareB64u,\n        clientShareDerivation: 'prf_first_v1',\n      }),\n      timestamp: Date.now(),\n    });\n\n    opts.onEvent?.({\n      step: 6,\n      phase: RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,\n      status: RegistrationStatus.SUCCESS,\n      message: 'Threshold access key activated on-chain'\n    });\n  } catch (e) {\n    console.warn('[Registration] threshold enrollment activation failed; continuing with local-signer only:', e);\n  }\n}\n\nasync function verifyAccountAccessKeysPresent(\n  nearClient: NearClient,\n  nearAccountId: string,\n  expectedPublicKeys: string[],\n  opts?: { attempts?: number; delayMs?: number },\n): Promise<boolean> {\n  const unique = Array.from(\n    new Set(expectedPublicKeys.map((k) => ensureEd25519Prefix(k)).filter(Boolean)),\n  );\n  if (!unique.length) return false;\n\n  const attempts = Math.max(1, Math.floor(opts?.attempts ?? 6));\n  const delayMs = Math.max(50, Math.floor(opts?.delayMs ?? 750));\n\n  for (let i = 0; i < attempts; i++) {\n    try {\n      const { fullAccessKeys, functionCallAccessKeys } = await nearClient.getAccessKeys({ account: nearAccountId });\n      const keys = [...fullAccessKeys, ...functionCallAccessKeys].map((k) => ensureEd25519Prefix(k.public_key));\n      const allPresent = unique.every((expected) => keys.includes(expected));\n      if (allPresent) return true;\n    } catch {\n      // tolerate transient view errors during propagation; retry\n    }\n    await new Promise((res) => setTimeout(res, delayMs));\n  }\n  return false;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,eAAsB,wBACpB,SACA,eACA,SACA,sBACA,4BAC6B;CAE7B,MAAM,EAAE,SAAS,SAAS,cAAc;CACxC,MAAM,EAAE,iBAAiB,YAAY;CAGrC,MAAM,oBAAoB;EACxB,gBAAgB;EAChB,oBAAoB;EACpB,gBAAgB;EAChB,uBAAuB;;AAGzB,SAAQ,IAAI;AACZ,WAAU;EACR,MAAM;EACN,OAAO,kBAAkB;EACzB,QAAQ,mBAAmB;EAC3B,SAAS,6BAA6B;;AAGxC,KAAI;AAEF,QAAM,2BAA2B,SAAS,eAAe,SAAS;AAElE,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;EAGX,MAAMA,qBAAkD;GACtD,QAAQ;GACR,UAAU;GACV,OAAQ,QAAQ,SAAS,gBAAgB,UAAW,UAAU;GAC9D,GAAI,8BAA8B,SAAS,sBAAsB;;EAGnE,MAAM,sBAAsB,MAAM,QAAQ,gBAAgB,0CAA0C;GAClG,eAAe,OAAO;GACtB,cAAc;GACd,eAAe,SAAS;GACxB,4BAA4B;;EAG9B,MAAM,aAAa,oBAAoB;EACvC,MAAM,eAAe,oBAAoB;AAEzC,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;EAIX,MAAM,yBAAyB,gBAAgB,qBAAqB;GAClE,YAAY,QAAQ,QAAQ;GAC5B;GACA;GACA,UAAU,aAAa;AACrB,YAAQ,MAAM,0BAA0B,SAAS,KAAK,KAAK,SAAS;AACpE,cAAU;KACR,MAAM;KACN,OAAO,kBAAkB;KACzB,QAAQ,mBAAmB;KAC3B,SAAS,GAAG,SAAS;;;;EAO3B,MAAM,4BAA4B,MAAM,gBAAgB,iBAAiB;GACvE;GACA;GACA,cAAc;;AAEhB,MAAI,CAAC,0BAA0B,WAAW,CAAC,0BAA0B,aACnE,OAAM,IAAI,MAAM;EAGlB,MAAM,iBAAiB,gBAAgB,qBAAqB;EAC5D,MAAM,sBAAsB,gBAAgB,gBAAgB,SAAS;EACrE,MAAM,yBAAyB,oBAAoB;EAGnD,MAAM,gBAAgB,MAAM,gBAAgB,0CAA0C;GACpF;GACA;GACA,SAAS,EAAE,cAAc;;AAE3B,MAAI,CAAC,cAAc,WAAW,CAAC,cAAc,WAAW;GACtD,MAAM,SAAS,eAAe,SAAS;AACvC,SAAM,IAAI,MAAM;;EAElB,MAAM,gBAAgB,cAAc;EACpC,MAAM,cAAc,OAAO,cAAc,eAAe,IAAI;AAC5D,MAAI,CAAC,YACH,OAAM,IAAI,MAAM;EAMlB,IAAIC,oCAAmD;AACvD,MAAI,2BAA2B,oBAAoB;GACjD,MAAM,UAAU,MAAM,gBAAgB,yDAAyD;IAC7F;IACA;IACA;;AAEF,OAAI,CAAC,QAAQ,WAAW,CAAC,QAAQ,yBAC/B,OAAM,IAAI,MAAM,QAAQ,SAAS;AAEnC,uCAAoC,QAAQ;;EAI9C,MAAM,wBAAwB,MAAM;AACpC,MAAI,CAAC,sBAAsB,UAAU;AACnC,WAAQ,MAAM;GACd,MAAM,eAAe,sBAAsB,SAAS;AACpD,SAAM,IAAI,MAAM,iDAAiD;;AAInE,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;GACT,UAAU;GACK;GACA;GACf,cAAc,aAAa;;EAG7B,IAAI;AACJ,iCAA+B,MAAM,wCACnC,SACA,eACA,eACA,YACA,cACA,0BAA0B,cAC1B,sBACA,SACA,EACE,kBAAkB,oCACd,EAAE,0BAA0B,sCAC5B;AAIR,MAAI,CAAC,6BAA6B,QAChC,OAAM,IAAI,MAAM,6BAA6B,SAAS;AAIxD,oBAAkB,iBAAiB;AACnC,oBAAkB,qBAAqB;AACvC,oBAAkB,wBAAwB,6BAA6B,iBAAiB;AAGxF,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;EAGX,MAAMC,qBAA+B,CAAC;EACtC,MAAM,qBAAqB,OAAO,8BAA8B,kBAAkB,aAAa,IAAI;EACnG,MAAM,eAAe,OAAO,8BAA8B,kBAAkB,gBAAgB,IAAI;EAEhG,MAAM,oBAAoB,MAAM,+BAC9B,QAAQ,YACR,eACA;AAGF,MAAI,CAAC,kBACH,OAAM,IAAI,MAAM;AAGlB,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;AAGX,QAAM,4CAA4C;GAChD,qBAAqB;GACrB;GACA;GACA;GACA;GACA,qBAAqB,8BAA8B,kBAAkB;GACrE,sBAAsB,8BAA8B,kBAAkB;GACtE;GACA,2BAA2B,OACzB,8BAA8B,kBAAkB,6BAA6B,IAC7E;GACF;GACA;GACA,iBAAiB,QAAQ;GACzB,YAAY,QAAQ;GACpB;;AAIF,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;AAGX,QAAM,gBAAgB,4BAA4B;GAChD;GACA;GACA,WAAW;GACX,qBAAqB,0BAA0B;GAC/C,cAAc,0BAA0B;GACxC,2BAA2B,0BAA0B;;AAIvD,oBAAkB,iBAAiB;AAEnC,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;AAIX,MAAI;AACF,WAAQ,gBAAgB,kBAAkB,eAAe,eAAe;AACxE,SAAM,QAAQ,gBAAgB,kBAAkB,oBAAoB,QAAQ;UACtE;EAIR,IAAI,YAAY,MAAM,gBAAgB,iBAAiB,aAAa,EAAE,QAAQ;AAC9E,MAAI,CAAC,WAAW,QAAQ;GAItB,MAAM,YAAY,MAAM,QAAQ,WAAW,UAAU,EAAE,UAAU;GACjE,MAAM,cAAc,WAAW,QAAQ;GACvC,MAAM,gBAAgB,OAAO,UAAU,QAAQ,UAAU;GACzD,MAAM,gBAAgB,MAAM,gBAAgB,yBAAyB;IACnE,QAAQ;IACR,MAAM,gBAAgB;IACtB,WAAW;IACX,aAAa;;GAEf,MAAM,iBAAiB,MAAM,gBAAgB,wBAAwB;GACrE,MAAM,iBAAiB,MAAM,gBAAgB,8CAA8C;IACzF;IACA,WAAW;IACX,eAAe,eAAe,KAAK,MAAM,EAAE;;GAE7C,MAAM,eAAe,MAAM,gBAAgB,iBAAiB;IAC3C;IACf,qBAAqB,0BAA0B;IAC/C,YAAY;MACX,OAAO,gBAAyB;IACjC,MAAM,UAAW,eAAe,OAAO,gBAAgB,YAAY,aAAa,cAC5E,OAAQ,YAAsC,WAAW,MACzD,OAAO,eAAe;AAC1B,WAAO;KAAE,SAAS;KAAO,OAAO;;;AAGlC,OAAI,CAAC,aAAa,SAAS;AACzB,YAAQ,KAAK,8BAA8B,aAAa;AACxD,UAAM,IAAI,MAAM,aAAa;;QAG/B,SAAQ,MAAM;AAIhB,MAAI;AACF,SAAM,gBAAgB,sBAAsB,eAAe,QAAQ;WAC5D,SAAS;AAChB,WAAQ,KAAK,yDAAyD;;AAGxE,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;EAGX,MAAM,gBAAgB;GACpB,SAAS;GACM;GACf,qBAAqB;GACrB,eAAe,kBAAkB;GACjC,iBAAiB;IACf,SAAS;IACT,cAAc,aAAa;IAC3B,qBAAqB,0BAA0B;IAC/C,kBAAkB,6BAA6B;;;AAInD,cAAY,MAAM;AAClB,SAAO;UAEAC,OAAgB;EACvB,MAAM,UAAW,SAAS,OAAO,UAAU,YAAY,aAAa,QAChE,OAAQ,MAAgC,WAAW,MACnD,OAAO,SAAS;EACpB,MAAM,QAAS,SAAS,OAAO,UAAU,YAAY,WAAW,QAC5D,OAAQ,MAA8B,SAAS,MAC/C;AACJ,UAAQ,MAAM,wBAAwB,SAAS;AAG/C,QAAM,4BACJ,mBACA,eACA,iBACA;EAIF,MAAM,eAAe,4BAA4B,OAAO,gBAAgB;EAExE,MAAM,cAAc,IAAI,MAAM;AAC9B,YAAU;AAEV,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;GACT,OAAO;;EAGT,MAAM,SAAS;GAAE,SAAS;GAAO,OAAO;;AACxC,cAAY;AACZ,SAAO;;;AAKX,eAAsB,gBACpB,SACA,eACA,SACA,sBAC6B;AAC7B,QAAO,wBAAwB,SAAS,eAAe,SAAS,sBAAsB;;;;;;;;AAwDxF,MAAM,6BAA6B,OACjC,SAKA,eACA,SACA,YACG;AAEH,WAAU;EACR,MAAM;EACN,OAAO,kBAAkB;EACzB,QAAQ,mBAAmB;EAC3B,SAAS;;AAIX,KAAI,CAAC,eAAe;EAClB,MAAM,wBAAQ,IAAI,MAAM;AACxB,YAAU;AACV,QAAM;;CAGR,MAAM,aAAa,sBAAsB;AACzC,KAAI,CAAC,WAAW,OAAO;EACrB,MAAM,wBAAQ,IAAI,MAAM,4BAA4B,WAAW;AAC/D,YAAU;AACV,QAAM;;AAER,KAAI,CAAC,OAAO,iBAAiB;EAC3B,MAAM,wBAAQ,IAAI,MAAM;AACxB,YAAU;AACV,QAAM;;AAIR,WAAU;EACR,MAAM;EACN,OAAO,kBAAkB;EACzB,QAAQ,mBAAmB;EAC3B,SAAS;;;;;;AAQb,eAAe,4BACb,mBAMA,eACA,iBACA,SACe;AACf,SAAQ,MAAM,qCAAqC;AAGnD,KAAI;AAEF,QAAM,gBAAgB;AAGtB,MAAI,kBAAkB,gBAAgB;AACpC,WAAQ,MAAM;AACd,aAAU;IACR,MAAM;IACN,OAAO,kBAAkB;IACzB,QAAQ,mBAAmB;IAC3B,SAAS;IACT,OAAO;;AAGT,SAAM,gBAAgB,yBAAyB;AAC/C,WAAQ,MAAM;;AAKhB,MAAI,kBAAkB,oBAAoB;AACxC,WAAQ,MAAM;AACd,aAAU;IACR,MAAM;IACN,OAAO,kBAAkB;IACzB,QAAQ,mBAAmB;IAC3B,SAAS,8BAA8B,kBAAkB,sBAAsB;IAC/E,OAAO;;;AAGX,UAAQ,MAAM;UAEPC,eAAwB;AAC/B,UAAQ,MAAM,oBAAoB;AAClC,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS,oBACN,iBAAiB,OAAO,kBAAkB,YAAY,aAAa,gBAChE,OAAQ,cAAwC,WAAW,MAC3D,OAAO,iBAAiB;GAE9B,OAAO;;;;AAKb,eAAe,4CAA4C,MAezC;AAGhB,KAAI,KAAK,wBAAwB,mBAAoB;CAErD,MAAM,qBAAqB,OAAO,KAAK,sBAAsB,IAAI;CACjE,MAAM,eAAe,OAAO,KAAK,gBAAgB,IAAI;CACrD,MAAM,2BAA2B,OAAO,KAAK,qCAAqC,IAAI;CACtF,MAAM,4BAA4B,OAAO,KAAK,6BAA6B,IAAI;AAE/E,KAAI,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,2BAA2B;AACnG,UAAQ,KAAK;AACb;;AAGF,KAAI;AACF,OAAK,UAAU;GACb,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;AAIX,MAAI;AACF,QAAK,gBAAgB,kBAAkB,eAAe,KAAK,eAAe,KAAK;UACzE;EACR,MAAM,YAAY,MAAM,KAAK,gBAAgB,kBAAkB,2BAC7D,KAAK,YACL,EAAE,OAAO;EAGX,MAAM,SAAS,MAAM,KAAK,gBAAgB,qCAAqC;GAC7E,eAAe,KAAK;GACpB,YAAY,KAAK;GACjB,aAAa,KAAK;GAClB,oBAAoB;GACpB;GACA;GACA,qBAAqB,KAAK;GAC1B,sBAAsB,KAAK;;EAG7B,MAAM,WAAW,QAAQ;AACzB,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM;AAE/B,QAAM,KAAK,WAAW,gBAAgB,UAAU,oBAAoB;EAEpE,MAAM,uBAAuB,MAAM,+BACjC,KAAK,YACL,KAAK,eACL,CAAC,KAAK,eAAe;AAEvB,MAAI,CAAC,qBACH,OAAM,IAAI,MAAM;AAGlB,QAAM,iBAAiB,WAAW,iBAAiB;GACjD,MAAM;GACN,eAAe,KAAK;GACpB,cAAc;GACd,WAAW;GACX,aAAa,KAAK;GAClB;GACA,uBAAuB;GACvB,cAAc,sCAAsC;IAClD,qBAAqB,KAAK;IAC1B,sBAAsB,KAAK;IAC3B;IACA,YAAY,KAAK,gBAAgB,sBAAsB,SAAS;IAChE;IACA;IACA,uBAAuB;;GAEzB,WAAW,KAAK;;AAGlB,OAAK,UAAU;GACb,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;UAEJ,GAAG;AACV,UAAQ,KAAK,6FAA6F;;;AAI9G,eAAe,+BACb,YACA,eACA,oBACA,MACkB;CAClB,MAAM,SAAS,MAAM,KACnB,IAAI,IAAI,mBAAmB,KAAK,MAAM,oBAAoB,IAAI,OAAO;AAEvE,KAAI,CAAC,OAAO,OAAQ,QAAO;CAE3B,MAAM,WAAW,KAAK,IAAI,GAAG,KAAK,MAAM,MAAM,YAAY;CAC1D,MAAM,UAAU,KAAK,IAAI,IAAI,KAAK,MAAM,MAAM,WAAW;AAEzD,MAAK,IAAI,IAAI,GAAG,IAAI,UAAU,KAAK;AACjC,MAAI;GACF,MAAM,EAAE,gBAAgB,2BAA2B,MAAM,WAAW,cAAc,EAAE,SAAS;GAC7F,MAAM,OAAO,CAAC,GAAG,gBAAgB,GAAG,wBAAwB,KAAK,MAAM,oBAAoB,EAAE;GAC7F,MAAM,aAAa,OAAO,OAAO,aAAa,KAAK,SAAS;AAC5D,OAAI,WAAY,QAAO;UACjB;AAGR,QAAM,IAAI,SAAS,QAAQ,WAAW,KAAK;;AAE7C,QAAO"}
+{"version":3,"file":"registration.js","names":["confirmationConfig: Partial<ConfirmationConfig>","thresholdClientVerifyingShareB64u: string | null","expectedAccessKeys: string[]","error: unknown","rollbackError: unknown"],"sources":["../../../../../../src/core/TatchiPasskey/registration.ts"],"sourcesContent":["import type { NearClient } from '../NearClient';\nimport { ensureEd25519Prefix, validateNearAccountId } from '../../utils/validation';\nimport type {\n  RegistrationHooksOptions,\n  RegistrationSSEEvent,\n} from '../types/sdkSentEvents';\nimport type { RegistrationResult, TatchiConfigs } from '../types/tatchi';\nimport type { AuthenticatorOptions } from '../types/authenticatorOptions';\nimport { RegistrationPhase, RegistrationStatus } from '../types/sdkSentEvents';\nimport {\n  createAccountAndRegisterWithRelayServer\n} from './faucets/createAccountRelayServer';\nimport { PasskeyManagerContext } from './index';\nimport { WebAuthnManager } from '../WebAuthnManager';\nimport { IndexedDBManager } from '../IndexedDBManager';\nimport { VRFChallenge } from '../types/vrf-worker';\nimport { type ConfirmationConfig, type SignerMode, mergeSignerMode } from '../types/signer-worker';\nimport type { WebAuthnRegistrationCredential } from '../types/webauthn';\nimport type { AccountId } from '../types/accountIds';\nimport { getUserFriendlyErrorMessage } from '../../utils/errors';\nimport { authenticatorsToAllowCredentials } from '../WebAuthnManager/touchIdPrompt';\nimport { DEFAULT_WAIT_STATUS } from '../types/rpc';\nimport { buildThresholdEd25519Participants2pV1 } from '../../threshold/participants';\n// Registration forces a visible, clickable confirmation for cross‑origin safety\n\n/**\n * Core registration function that handles passkey registration\n *\n * VRF Registration Flow (Single VRF Keypair):\n * 1. Generate VRF keypair (ed25519) using crypto.randomUUID() + persist in worker memory\n * 2. Generate VRF proof + output using the VRF keypair\n *    - VRF input with domain separator + NEAR block height + hash\n * 3. Use VRF output as WebAuthn challenge in registration ceremony\n * 4. Derive AES key from WebAuthn PRF output and encrypt the SAME VRF keypair\n * 5. Store encrypted VRF keypair in IndexedDB\n * 6. Call contract verify_registration_response with VRF proof + WebAuthn registration payload\n * 7. Contract verifies VRF proof and WebAuthn registration (challenges match!)\n * 8. Contract stores VRF pubkey + authenticator credentials on-chain for\n *    future stateless authentication\n */\nexport async function registerPasskeyInternal(\n  context: PasskeyManagerContext,\n  nearAccountId: AccountId,\n  options: RegistrationHooksOptions,\n  authenticatorOptions: AuthenticatorOptions,\n  confirmationConfigOverride?: Partial<ConfirmationConfig>\n): Promise<RegistrationResult> {\n\n  const { onEvent, onError, afterCall } = options;\n  const { webAuthnManager, configs } = context;\n\n  // Track registration progress for rollback\n  const registrationState = {\n    accountCreated: false,\n    contractRegistered: false,\n    databaseStored: false,\n    contractTransactionId: null as string | null,\n  };\n\n  console.log('⚡ Registration: Passkey registration with VRF WebAuthn');\n  onEvent?.({\n    step: 1,\n    phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n    status: RegistrationStatus.PROGRESS,\n    message: `Starting registration for ${nearAccountId}`\n  } as RegistrationSSEEvent);\n\n  try {\n\n    await validateRegistrationInputs(context, nearAccountId, onEvent, onError);\n\n    onEvent?.({\n      step: 1,\n      phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Generating passkey credential...'\n    });\n\n    const confirmationConfig: Partial<ConfirmationConfig> = {\n      uiMode: 'modal',\n      behavior: 'requireClick', // cross‑origin safari requirement: must requireClick\n      theme: (context.configs?.walletTheme === 'light') ? 'light' : 'dark',\n      ...(confirmationConfigOverride ?? options?.confirmationConfig ?? {}),\n    };\n\n    const registrationSession = await context.webAuthnManager.requestRegistrationCredentialConfirmation({\n      nearAccountId: String(nearAccountId),\n      deviceNumber: 1,\n      confirmerText: options?.confirmerText,\n      confirmationConfigOverride: confirmationConfig,\n    });\n\n    const credential = registrationSession.credential;\n    const vrfChallenge = registrationSession.vrfChallenge;\n    const transactionContext = registrationSession.transactionContext;\n\n    onEvent?.({\n      step: 1,\n      phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n      status: RegistrationStatus.SUCCESS,\n      message: 'WebAuthn ceremony successful'\n    });\n\n    // 1) Ensure VRF keypair is derived and loaded in-memory\n    // before deriving WrapKeySeed for NEAR key encryption\n    const deterministicVrfKeyResult = await webAuthnManager.deriveVrfKeypair({\n      credential,\n      nearAccountId,\n      saveInMemory: true,\n    });\n    if (!deterministicVrfKeyResult.success || !deterministicVrfKeyResult.vrfPublicKey) {\n      throw new Error('Failed to derive deterministic VRF keypair from PRF');\n    }\n\n    const baseSignerMode = webAuthnManager.getUserPreferences().getSignerMode();\n    const requestedSignerMode = mergeSignerMode(baseSignerMode, options?.signerMode);\n    const requestedSignerModeStr = requestedSignerMode.mode;\n\n    // 2) Derive/enroll the local NEAR key after VRF keypair exists.\n    const nearKeyResult = await webAuthnManager.deriveNearKeypairAndEncryptFromSerialized({\n      credential,\n      nearAccountId,\n      options: { deviceNumber: 1 },\n    });\n    if (!nearKeyResult.success || !nearKeyResult.publicKey) {\n      const reason = nearKeyResult?.error || 'Failed to generate NEAR keypair with PRF';\n      throw new Error(reason);\n    }\n    const nearPublicKey = nearKeyResult.publicKey;\n    const wrapKeySalt = String(nearKeyResult.wrapKeySalt || '').trim();\n    if (!wrapKeySalt) {\n      throw new Error('Missing wrapKeySalt after local key derivation');\n    }\n\n    // Optional: threshold-signer enrollment during registration.\n    // Derive client verifying share (public) and let the relay compute threshold group public key\n    // and include it in the on-chain AddKey set during create_account_and_register_user.\n    let thresholdClientVerifyingShareB64u: string | null = null;\n    if (requestedSignerModeStr === 'threshold-signer') {\n      const derived = await webAuthnManager.deriveThresholdEd25519ClientVerifyingShareFromCredential({\n        credential,\n        nearAccountId,\n        wrapKeySalt,\n      });\n      if (!derived.success || !derived.clientVerifyingShareB64u) {\n        throw new Error(derived.error || 'Failed to derive threshold client verifying share');\n      }\n      thresholdClientVerifyingShareB64u = derived.clientVerifyingShareB64u;\n    }\n\n    // Step 4-5: Create account and register with contract using the relay (atomic)\n    onEvent?.({\n      step: 2,\n      phase: RegistrationPhase.STEP_2_KEY_GENERATION,\n      status: RegistrationStatus.SUCCESS,\n      message: 'Wallet derived successfully from Passkey',\n      verified: true,\n      nearAccountId: nearAccountId,\n      nearPublicKey: nearPublicKey,\n      vrfPublicKey: vrfChallenge.vrfPublicKey,\n    });\n\n    let accountAndRegistrationResult;\n    accountAndRegistrationResult = await createAccountAndRegisterWithRelayServer(\n      context,\n      nearAccountId,\n      nearPublicKey,\n      credential,\n      vrfChallenge,\n      deterministicVrfKeyResult.vrfPublicKey,\n      authenticatorOptions,\n      onEvent,\n      {\n        thresholdEd25519: thresholdClientVerifyingShareB64u\n          ? { clientVerifyingShareB64u: thresholdClientVerifyingShareB64u }\n          : undefined,\n      },\n    );\n\n    if (!accountAndRegistrationResult.success) {\n      throw new Error(accountAndRegistrationResult.error || 'Account creation and registration failed');\n    }\n\n    // Update registration state based on results\n    registrationState.accountCreated = true;\n    registrationState.contractRegistered = true;\n    registrationState.contractTransactionId = accountAndRegistrationResult.transactionId || null;\n\n    // Step 6: Post-commit verification: ensure on-chain access key matches expected public key\n    onEvent?.({\n      step: 6,\n      phase: RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Verifying on-chain access key matches expected public key...'\n    });\n\n    const expectedAccessKeys: string[] = [nearPublicKey];\n    const thresholdPublicKey = String(accountAndRegistrationResult?.thresholdEd25519?.publicKey || '').trim();\n    const relayerKeyId = String(accountAndRegistrationResult?.thresholdEd25519?.relayerKeyId || '').trim();\n\n    const accessKeyVerified = await verifyAccountAccessKeysPresent(\n      context.nearClient,\n      nearAccountId,\n      expectedAccessKeys,\n      { attempts: 3, delayMs: 200, finality: 'optimistic' },\n    );\n\n    if (!accessKeyVerified) {\n      console.warn('[Registration] Access key not yet visible after atomic registration; continuing optimistically');\n      onEvent?.({\n        step: 6,\n        phase: RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,\n        status: RegistrationStatus.SUCCESS,\n        message: 'Access key verification pending (optimistic); continuing...'\n      });\n    } else {\n      onEvent?.({\n        step: 6,\n        phase: RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,\n        status: RegistrationStatus.SUCCESS,\n        message: 'Access key verified on-chain'\n      });\n    }\n\n    // Threshold enrollment can take an extra on-chain tx + key propagation; don't block registration on it.\n    activateThresholdEnrollmentPostRegistration({\n      requestedSignerMode: requestedSignerModeStr,\n      nearAccountId,\n      nearPublicKey,\n      thresholdPublicKey,\n      relayerKeyId,\n      clientParticipantId: accountAndRegistrationResult?.thresholdEd25519?.clientParticipantId,\n      relayerParticipantId: accountAndRegistrationResult?.thresholdEd25519?.relayerParticipantId,\n      thresholdClientVerifyingShareB64u,\n      relayerVerifyingShareB64u: String(\n        accountAndRegistrationResult?.thresholdEd25519?.relayerVerifyingShareB64u || '',\n      ).trim(),\n      credential,\n      wrapKeySalt,\n      webAuthnManager: context.webAuthnManager,\n      nearClient: context.nearClient,\n      onEvent,\n    }).catch(() => {});\n\n    // Step 7: Store user data with VRF credentials atomically\n    onEvent?.({\n      step: 7,\n      phase: RegistrationPhase.STEP_7_DATABASE_STORAGE,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Storing passkey wallet metadata...'\n    });\n\n    await webAuthnManager.atomicStoreRegistrationData({\n      nearAccountId,\n      credential,\n      publicKey: nearPublicKey,\n      encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,\n      vrfPublicKey: deterministicVrfKeyResult.vrfPublicKey,\n      serverEncryptedVrfKeypair: deterministicVrfKeyResult.serverEncryptedVrfKeypair,\n    });\n\n    // Mark database as stored for rollback tracking\n    registrationState.databaseStored = true;\n\n    onEvent?.({\n      step: 7,\n      phase: RegistrationPhase.STEP_7_DATABASE_STORAGE,\n      status: RegistrationStatus.SUCCESS,\n      message: 'Registration metadata stored successfully'\n    });\n\n    // Step 7: Ensure VRF session is active for auto-login\n    // If VRF keypair is already in-memory (saved earlier), skip an extra Touch ID prompt.\n    let vrfStatus = await webAuthnManager.checkVrfStatus().catch(() => ({ active: false }));\n    if (!vrfStatus?.active) {\n      // Prefer a no-prompt unlock using the existing registration credential (PRF already available).\n      // Fallback to an explicit authentication ceremony only if needed.\n      const unlockNoPrompt = await webAuthnManager.unlockVRFKeypair({\n        nearAccountId: nearAccountId,\n        encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,\n        credential,\n      }).catch((unlockError: unknown) => {\n        const message = (unlockError && typeof unlockError === 'object' && 'message' in unlockError)\n          ? String((unlockError as { message?: unknown }).message || '')\n          : String(unlockError || '');\n        return { success: false, error: message };\n      });\n\n      if (!unlockNoPrompt.success) {\n        // Obtain an authentication credential for VRF unlock (separate from registration credential)\n        // IMPORTANT: Immediately after account creation, the new access key may not be queryable yet on some RPC nodes.\n        // We only need fresh block info for the VRF challenge here, so fetch the block directly to avoid AK lookup failures.\n        let txBlockHash = String(transactionContext?.txBlockHash || '').trim();\n        let txBlockHeight = String(transactionContext?.txBlockHeight || '').trim();\n        if (!txBlockHash || !txBlockHeight) {\n          const blockInfo = await context.nearClient.viewBlock({ finality: 'final' });\n          txBlockHash = String(blockInfo?.header?.hash || '').trim();\n          txBlockHeight = String(blockInfo?.header?.height ?? '').trim();\n        }\n        const vrfChallenge2 = await webAuthnManager.generateVrfChallengeOnce({\n          userId: nearAccountId,\n          rpId: webAuthnManager.getRpId(),\n          blockHash: txBlockHash,\n          blockHeight: txBlockHeight,\n        });\n        const allowCredentialIds = String(credential?.rawId || '').trim()\n          ? [String(credential.rawId)]\n          : (await webAuthnManager.getAuthenticatorsByUser(nearAccountId)).map((a) => a.credentialId);\n        const authCredential = await webAuthnManager.getAuthenticationCredentialsSerializedDualPrf({\n          nearAccountId,\n          challenge: vrfChallenge2,\n          credentialIds: allowCredentialIds,\n        });\n        const unlockResult = await webAuthnManager.unlockVRFKeypair({\n          nearAccountId: nearAccountId,\n          encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,\n          credential: authCredential,\n        }).catch((unlockError: unknown) => {\n          const message = (unlockError && typeof unlockError === 'object' && 'message' in unlockError)\n            ? String((unlockError as { message?: unknown }).message || '')\n            : String(unlockError || '');\n          return { success: false, error: message };\n        });\n\n        if (!unlockResult.success) {\n          console.warn('VRF keypair unlock failed:', unlockResult.error);\n          throw new Error(unlockResult.error);\n        }\n      } else {\n        console.debug('Registration: VRF unlocked using registration credential; skipping extra Touch ID unlock');\n      }\n    } else {\n      console.debug('Registration: VRF session already active; skipping extra Touch ID unlock');\n    }\n\n    // Initialize current user only after a successful unlock\n    try {\n      await webAuthnManager.initializeCurrentUser(nearAccountId);\n      webAuthnManager.getNonceManager().prefetchBlockheight(context.nearClient).catch(() => {});\n    } catch (initErr) {\n      console.warn('Failed to initialize current user after registration:', initErr);\n    }\n\n    onEvent?.({\n      step: 8,\n      phase: RegistrationPhase.STEP_8_REGISTRATION_COMPLETE,\n      status: RegistrationStatus.SUCCESS,\n      message: 'Registration completed!'\n    });\n\n    const successResult = {\n      success: true,\n      nearAccountId: nearAccountId,\n      clientNearPublicKey: nearPublicKey,\n      transactionId: registrationState.contractTransactionId,\n      vrfRegistration: {\n        success: true,\n        vrfPublicKey: vrfChallenge.vrfPublicKey,\n        encryptedVrfKeypair: deterministicVrfKeyResult.encryptedVrfKeypair,\n        contractVerified: accountAndRegistrationResult.success,\n      }\n    };\n\n    afterCall?.(true, successResult);\n    return successResult;\n\n  } catch (error: unknown) {\n    const message = (error && typeof error === 'object' && 'message' in error)\n      ? String((error as { message?: unknown }).message || '')\n      : String(error || '');\n    const stack = (error && typeof error === 'object' && 'stack' in error)\n      ? String((error as { stack?: unknown }).stack || '')\n      : '';\n    console.error('Registration failed:', message, stack);\n\n    // Perform rollback based on registration state\n    await performRegistrationRollback(\n      registrationState,\n      nearAccountId,\n      webAuthnManager,\n      onEvent\n    );\n\n    // Use centralized error handling\n    const errorMessage = getUserFriendlyErrorMessage(error, 'registration', nearAccountId);\n\n    const errorObject = new Error(errorMessage);\n    onError?.(errorObject);\n\n    onEvent?.({\n      step: 0,\n      phase: RegistrationPhase.REGISTRATION_ERROR,\n      status: RegistrationStatus.ERROR,\n      message: errorMessage,\n      error: errorMessage\n    } as RegistrationSSEEvent);\n\n    const result = { success: false, error: errorMessage };\n    afterCall?.(false);\n    return result;\n  }\n}\n\n// Backward-compatible wrapper without explicit confirmationConfig override\nexport async function registerPasskey(\n  context: PasskeyManagerContext,\n  nearAccountId: AccountId,\n  options: RegistrationHooksOptions,\n  authenticatorOptions: AuthenticatorOptions\n): Promise<RegistrationResult> {\n  return registerPasskeyInternal(context, nearAccountId, options, authenticatorOptions, undefined);\n}\n\n//////////////////////////////////////\n// HELPER FUNCTIONS\n//////////////////////////////////////\n\n/**\n * Generate a VRF keypair + challenge in VRF wasm worker for WebAuthn registration ceremony bootstrapping\n *\n * ARCHITECTURE: This function solves the chicken-and-egg problem with a single VRF keypair:\n * 1. Generate VRF keypair + challenge (no PRF needed)\n * 2. Persist VRF keypair in worker memory (NOT encrypted yet)\n * 3. Use VRF challenge for WebAuthn ceremony → get PRF output\n * 4. Encrypt the SAME VRF keypair (still in memory) with PRF\n *\n * @param webAuthnManager - WebAuthn manager instance\n * @param nearAccountId - NEAR account ID for VRF input\n * @param blockHeight - Current NEAR block height for freshness\n * @param blockHashBytes - Current NEAR block hash bytes for entropy\n * @returns VRF challenge data (VRF keypair persisted in worker memory)\n */\nexport async function generateBootstrapVrfChallenge(\n  context: PasskeyManagerContext,\n  nearAccountId: AccountId,\n): Promise<VRFChallenge> {\n\n  const { webAuthnManager, nearClient } = context;\n\n  const blockInfo = await nearClient.viewBlock({ finality: 'final' });\n\n  // Generate VRF keypair and persist in worker memory\n  const vrfResult = await webAuthnManager.generateVrfKeypairBootstrap({\n    vrfInputData: {\n      userId: nearAccountId,\n      // Keep VRF rpId consistent with WebAuthn rpId selection logic.\n      rpId: webAuthnManager.getRpId(),\n      blockHeight: String(blockInfo.header.height),\n      blockHash: blockInfo.header.hash,\n    },\n    saveInMemory: true,\n    // VRF keypair persists in worker memory until PRF encryption\n  });\n\n  if (!vrfResult.vrfChallenge) {\n    throw new Error('Registration VRF keypair generation failed');\n  }\n  return vrfResult.vrfChallenge;\n}\n\n/**\n * Validates registration inputs and throws errors if invalid\n * @param nearAccountId - NEAR account ID to validate\n * @param onEvent - Optional callback for registration progress events\n * @param onError - Optional callback for error handling\n */\nconst validateRegistrationInputs = async (\n  context: {\n    configs: TatchiConfigs,\n    webAuthnManager: WebAuthnManager,\n    nearClient: NearClient,\n  },\n  nearAccountId: AccountId,\n  onEvent?: (event: RegistrationSSEEvent) => void,\n  onError?: (error: Error) => void,\n) => {\n\n  onEvent?.({\n    step: 1,\n    phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n    status: RegistrationStatus.PROGRESS,\n    message: 'Validating registration inputs...'\n  } as RegistrationSSEEvent);\n\n  // Validation\n  if (!nearAccountId) {\n    const error = new Error('NEAR account ID is required for registration.');\n    onError?.(error);\n    throw error;\n  }\n  // Validate the account ID format\n  const validation = validateNearAccountId(nearAccountId);\n  if (!validation.valid) {\n    const error = new Error(`Invalid NEAR account ID: ${validation.error}`);\n    onError?.(error);\n    throw error;\n  }\n  if (!window.isSecureContext) {\n    const error = new Error('Passkey operations require a secure context (HTTPS or localhost).');\n    onError?.(error);\n    throw error;\n  }\n\n  // On-chain account existence / contract validation is performed by the relay + contract\n  // during the atomic create_account_and_register_user call.\n  onEvent?.({\n    step: 1,\n    phase: RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n    status: RegistrationStatus.PROGRESS,\n    message: `Account format validated, preparing confirmation`\n  } as RegistrationSSEEvent);\n  return;\n}\n\n/**\n * Rollback registration data in case of errors\n */\nasync function performRegistrationRollback(\n  registrationState: {\n    accountCreated: boolean;\n    contractRegistered: boolean;\n    databaseStored: boolean;\n    contractTransactionId: string | null;\n  },\n  nearAccountId: AccountId,\n  webAuthnManager: WebAuthnManager,\n  onEvent?: (event: RegistrationSSEEvent) => void\n): Promise<void> {\n  console.debug('Starting registration rollback...', registrationState);\n\n  // Rollback in reverse order\n  try {\n    // 1. Always clear any in-memory VRF session established during bootstrap\n    await webAuthnManager.clearVrfSession();\n\n    // 2. Rollback database storage\n    if (registrationState.databaseStored) {\n      console.debug('Rolling back database storage...');\n      onEvent?.({\n        step: 0,\n        phase: RegistrationPhase.REGISTRATION_ERROR,\n        status: RegistrationStatus.ERROR,\n        message: 'Rolling back database storage...',\n        error: 'Registration failed - rolling back database storage'\n      } as RegistrationSSEEvent);\n\n      await webAuthnManager.rollbackUserRegistration(nearAccountId);\n      console.debug('Database rollback completed');\n    }\n\n    // 3. Contract rollback on the Web3Authn contract\n    // NOT NEEDED - account creation and contract registration are atomic in the relay server flow\n    if (registrationState.contractRegistered) {\n      console.debug('Contract registration cannot be rolled back (immutable blockchain state)');\n      onEvent?.({\n        step: 0,\n        phase: RegistrationPhase.REGISTRATION_ERROR,\n        status: RegistrationStatus.ERROR,\n        message: `Contract registration (tx: ${registrationState.contractTransactionId}) cannot be rolled back`,\n        error: 'Registration failed - contract state is immutable'\n      } as RegistrationSSEEvent);\n    }\n    console.debug('Registration rollback completed');\n\n  } catch (rollbackError: unknown) {\n    console.error('Rollback failed:', rollbackError);\n    onEvent?.({\n      step: 0,\n      phase: RegistrationPhase.REGISTRATION_ERROR,\n      status: RegistrationStatus.ERROR,\n      message: `Rollback failed: ${\n        (rollbackError && typeof rollbackError === 'object' && 'message' in rollbackError)\n          ? String((rollbackError as { message?: unknown }).message || '')\n          : String(rollbackError || '')\n      }`,\n      error: 'Both registration and rollback failed'\n    } as RegistrationSSEEvent);\n  }\n}\n\nasync function activateThresholdEnrollmentPostRegistration(opts: {\n  requestedSignerMode: SignerMode['mode'];\n  nearAccountId: AccountId;\n  nearPublicKey: string;\n  thresholdPublicKey: string;\n  relayerKeyId: string;\n  clientParticipantId?: number;\n  relayerParticipantId?: number;\n  thresholdClientVerifyingShareB64u: string | null;\n  relayerVerifyingShareB64u: string;\n  credential: WebAuthnRegistrationCredential;\n  wrapKeySalt: string;\n  webAuthnManager: WebAuthnManager;\n  nearClient: NearClient;\n  onEvent?: (event: RegistrationSSEEvent) => void;\n}): Promise<void> {\n  // Optional: activate threshold enrollment post-registration by having the client\n  // submit AddKey(thresholdPublicKey) signed with the local key.\n  if (opts.requestedSignerMode !== 'threshold-signer') return;\n\n  const thresholdPublicKey = String(opts.thresholdPublicKey || '').trim();\n  const relayerKeyId = String(opts.relayerKeyId || '').trim();\n  const clientVerifyingShareB64u = String(opts.thresholdClientVerifyingShareB64u || '').trim();\n  const relayerVerifyingShareB64u = String(opts.relayerVerifyingShareB64u || '').trim();\n\n  if (!thresholdPublicKey || !relayerKeyId || !clientVerifyingShareB64u || !relayerVerifyingShareB64u) {\n    console.warn('[Registration] threshold-signer requested but threshold enrollment details are missing; continuing with local-signer only');\n    return;\n  }\n\n  try {\n    opts.onEvent?.({\n      step: 6,\n      phase: RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,\n      status: RegistrationStatus.PROGRESS,\n      message: 'Activating threshold access key onchain...'\n    });\n\n    // Prepare a single AddKey transaction signed with the local key (no extra TouchID prompt).\n    try {\n      opts.webAuthnManager.getNonceManager().initializeUser(opts.nearAccountId, opts.nearPublicKey);\n    } catch {}\n    const txContext = await opts.webAuthnManager.getNonceManager().getNonceBlockHashAndHeight(\n      opts.nearClient,\n      { force: true },\n    );\n\n    const signed = await opts.webAuthnManager.signAddKeyThresholdPublicKeyNoPrompt({\n      nearAccountId: opts.nearAccountId,\n      credential: opts.credential,\n      wrapKeySalt: opts.wrapKeySalt,\n      transactionContext: txContext,\n      thresholdPublicKey,\n      relayerVerifyingShareB64u,\n      clientParticipantId: opts.clientParticipantId,\n      relayerParticipantId: opts.relayerParticipantId,\n    });\n\n    const signedTx = signed?.signedTransaction;\n    if (!signedTx) throw new Error('Failed to sign AddKey(thresholdPublicKey) transaction');\n\n    await opts.nearClient.sendTransaction(signedTx, DEFAULT_WAIT_STATUS.thresholdAddKey);\n\n    const thresholdKeyVerified = await verifyAccountAccessKeysPresent(\n      opts.nearClient,\n      opts.nearAccountId,\n      [opts.nearPublicKey, thresholdPublicKey],\n      { attempts: 6, delayMs: 250, finality: 'optimistic' },\n    );\n    if (!thresholdKeyVerified) {\n      throw new Error('Threshold access key not found on-chain after AddKey');\n    }\n\n    await IndexedDBManager.nearKeysDB.storeKeyMaterial({\n      kind: 'threshold_ed25519_2p_v1',\n      nearAccountId: opts.nearAccountId,\n      deviceNumber: 1,\n      publicKey: thresholdPublicKey,\n      wrapKeySalt: opts.wrapKeySalt,\n      relayerKeyId,\n      clientShareDerivation: 'prf_first_v1',\n      participants: buildThresholdEd25519Participants2pV1({\n        clientParticipantId: opts.clientParticipantId,\n        relayerParticipantId: opts.relayerParticipantId,\n        relayerKeyId,\n        relayerUrl: opts.webAuthnManager.tatchiPasskeyConfigs?.relayer?.url,\n        clientVerifyingShareB64u,\n        relayerVerifyingShareB64u,\n        clientShareDerivation: 'prf_first_v1',\n      }),\n      timestamp: Date.now(),\n    });\n\n    opts.onEvent?.({\n      step: 6,\n      phase: RegistrationPhase.STEP_6_ACCOUNT_VERIFICATION,\n      status: RegistrationStatus.SUCCESS,\n      message: 'Threshold access key activated on-chain'\n    });\n  } catch (e) {\n    console.warn('[Registration] threshold enrollment activation failed; continuing with local-signer only:', e);\n  }\n}\n\nasync function verifyAccountAccessKeysPresent(\n  nearClient: NearClient,\n  nearAccountId: string,\n  expectedPublicKeys: string[],\n  opts?: { attempts?: number; delayMs?: number; finality?: 'optimistic' | 'final' },\n): Promise<boolean> {\n  const unique = Array.from(\n    new Set(expectedPublicKeys.map((k) => ensureEd25519Prefix(k)).filter(Boolean)),\n  );\n  if (!unique.length) return false;\n\n  const attempts = Math.max(1, Math.floor(opts?.attempts ?? 6));\n  const delayMs = Math.max(50, Math.floor(opts?.delayMs ?? 750));\n  const finality = opts?.finality ?? 'optimistic';\n\n  for (let i = 0; i < attempts; i++) {\n    try {\n      const accessKeyList = await nearClient.viewAccessKeyList(\n        nearAccountId,\n        { finality } as any,\n      );\n      const keys = accessKeyList.keys.map((k) => ensureEd25519Prefix(k.public_key)).filter(Boolean);\n      const allPresent = unique.every((expected) => keys.includes(expected));\n      if (allPresent) return true;\n    } catch {\n      // tolerate transient view errors during propagation; retry\n    }\n    if (i < attempts - 1) {\n      await new Promise((res) => setTimeout(res, delayMs));\n    }\n  }\n  return false;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,eAAsB,wBACpB,SACA,eACA,SACA,sBACA,4BAC6B;CAE7B,MAAM,EAAE,SAAS,SAAS,cAAc;CACxC,MAAM,EAAE,iBAAiB,YAAY;CAGrC,MAAM,oBAAoB;EACxB,gBAAgB;EAChB,oBAAoB;EACpB,gBAAgB;EAChB,uBAAuB;;AAGzB,SAAQ,IAAI;AACZ,WAAU;EACR,MAAM;EACN,OAAO,kBAAkB;EACzB,QAAQ,mBAAmB;EAC3B,SAAS,6BAA6B;;AAGxC,KAAI;AAEF,QAAM,2BAA2B,SAAS,eAAe,SAAS;AAElE,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;EAGX,MAAMA,qBAAkD;GACtD,QAAQ;GACR,UAAU;GACV,OAAQ,QAAQ,SAAS,gBAAgB,UAAW,UAAU;GAC9D,GAAI,8BAA8B,SAAS,sBAAsB;;EAGnE,MAAM,sBAAsB,MAAM,QAAQ,gBAAgB,0CAA0C;GAClG,eAAe,OAAO;GACtB,cAAc;GACd,eAAe,SAAS;GACxB,4BAA4B;;EAG9B,MAAM,aAAa,oBAAoB;EACvC,MAAM,eAAe,oBAAoB;EACzC,MAAM,qBAAqB,oBAAoB;AAE/C,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;EAKX,MAAM,4BAA4B,MAAM,gBAAgB,iBAAiB;GACvE;GACA;GACA,cAAc;;AAEhB,MAAI,CAAC,0BAA0B,WAAW,CAAC,0BAA0B,aACnE,OAAM,IAAI,MAAM;EAGlB,MAAM,iBAAiB,gBAAgB,qBAAqB;EAC5D,MAAM,sBAAsB,gBAAgB,gBAAgB,SAAS;EACrE,MAAM,yBAAyB,oBAAoB;EAGnD,MAAM,gBAAgB,MAAM,gBAAgB,0CAA0C;GACpF;GACA;GACA,SAAS,EAAE,cAAc;;AAE3B,MAAI,CAAC,cAAc,WAAW,CAAC,cAAc,WAAW;GACtD,MAAM,SAAS,eAAe,SAAS;AACvC,SAAM,IAAI,MAAM;;EAElB,MAAM,gBAAgB,cAAc;EACpC,MAAM,cAAc,OAAO,cAAc,eAAe,IAAI;AAC5D,MAAI,CAAC,YACH,OAAM,IAAI,MAAM;EAMlB,IAAIC,oCAAmD;AACvD,MAAI,2BAA2B,oBAAoB;GACjD,MAAM,UAAU,MAAM,gBAAgB,yDAAyD;IAC7F;IACA;IACA;;AAEF,OAAI,CAAC,QAAQ,WAAW,CAAC,QAAQ,yBAC/B,OAAM,IAAI,MAAM,QAAQ,SAAS;AAEnC,uCAAoC,QAAQ;;AAI9C,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;GACT,UAAU;GACK;GACA;GACf,cAAc,aAAa;;EAG7B,IAAI;AACJ,iCAA+B,MAAM,wCACnC,SACA,eACA,eACA,YACA,cACA,0BAA0B,cAC1B,sBACA,SACA,EACE,kBAAkB,oCACd,EAAE,0BAA0B,sCAC5B;AAIR,MAAI,CAAC,6BAA6B,QAChC,OAAM,IAAI,MAAM,6BAA6B,SAAS;AAIxD,oBAAkB,iBAAiB;AACnC,oBAAkB,qBAAqB;AACvC,oBAAkB,wBAAwB,6BAA6B,iBAAiB;AAGxF,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;EAGX,MAAMC,qBAA+B,CAAC;EACtC,MAAM,qBAAqB,OAAO,8BAA8B,kBAAkB,aAAa,IAAI;EACnG,MAAM,eAAe,OAAO,8BAA8B,kBAAkB,gBAAgB,IAAI;EAEhG,MAAM,oBAAoB,MAAM,+BAC9B,QAAQ,YACR,eACA,oBACA;GAAE,UAAU;GAAG,SAAS;GAAK,UAAU;;AAGzC,MAAI,CAAC,mBAAmB;AACtB,WAAQ,KAAK;AACb,aAAU;IACR,MAAM;IACN,OAAO,kBAAkB;IACzB,QAAQ,mBAAmB;IAC3B,SAAS;;QAGX,WAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;AAKb,8CAA4C;GAC1C,qBAAqB;GACrB;GACA;GACA;GACA;GACA,qBAAqB,8BAA8B,kBAAkB;GACrE,sBAAsB,8BAA8B,kBAAkB;GACtE;GACA,2BAA2B,OACzB,8BAA8B,kBAAkB,6BAA6B,IAC7E;GACF;GACA;GACA,iBAAiB,QAAQ;GACzB,YAAY,QAAQ;GACpB;KACC,YAAY;AAGf,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;AAGX,QAAM,gBAAgB,4BAA4B;GAChD;GACA;GACA,WAAW;GACX,qBAAqB,0BAA0B;GAC/C,cAAc,0BAA0B;GACxC,2BAA2B,0BAA0B;;AAIvD,oBAAkB,iBAAiB;AAEnC,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;EAKX,IAAI,YAAY,MAAM,gBAAgB,iBAAiB,aAAa,EAAE,QAAQ;AAC9E,MAAI,CAAC,WAAW,QAAQ;GAGtB,MAAM,iBAAiB,MAAM,gBAAgB,iBAAiB;IAC7C;IACf,qBAAqB,0BAA0B;IAC/C;MACC,OAAO,gBAAyB;IACjC,MAAM,UAAW,eAAe,OAAO,gBAAgB,YAAY,aAAa,cAC5E,OAAQ,YAAsC,WAAW,MACzD,OAAO,eAAe;AAC1B,WAAO;KAAE,SAAS;KAAO,OAAO;;;AAGlC,OAAI,CAAC,eAAe,SAAS;IAI3B,IAAI,cAAc,OAAO,oBAAoB,eAAe,IAAI;IAChE,IAAI,gBAAgB,OAAO,oBAAoB,iBAAiB,IAAI;AACpE,QAAI,CAAC,eAAe,CAAC,eAAe;KAClC,MAAM,YAAY,MAAM,QAAQ,WAAW,UAAU,EAAE,UAAU;AACjE,mBAAc,OAAO,WAAW,QAAQ,QAAQ,IAAI;AACpD,qBAAgB,OAAO,WAAW,QAAQ,UAAU,IAAI;;IAE1D,MAAM,gBAAgB,MAAM,gBAAgB,yBAAyB;KACnE,QAAQ;KACR,MAAM,gBAAgB;KACtB,WAAW;KACX,aAAa;;IAEf,MAAM,qBAAqB,OAAO,YAAY,SAAS,IAAI,SACvD,CAAC,OAAO,WAAW,WAClB,MAAM,gBAAgB,wBAAwB,gBAAgB,KAAK,MAAM,EAAE;IAChF,MAAM,iBAAiB,MAAM,gBAAgB,8CAA8C;KACzF;KACA,WAAW;KACX,eAAe;;IAEjB,MAAM,eAAe,MAAM,gBAAgB,iBAAiB;KAC3C;KACf,qBAAqB,0BAA0B;KAC/C,YAAY;OACX,OAAO,gBAAyB;KACjC,MAAM,UAAW,eAAe,OAAO,gBAAgB,YAAY,aAAa,cAC5E,OAAQ,YAAsC,WAAW,MACzD,OAAO,eAAe;AAC1B,YAAO;MAAE,SAAS;MAAO,OAAO;;;AAGlC,QAAI,CAAC,aAAa,SAAS;AACzB,aAAQ,KAAK,8BAA8B,aAAa;AACxD,WAAM,IAAI,MAAM,aAAa;;SAG/B,SAAQ,MAAM;QAGhB,SAAQ,MAAM;AAIhB,MAAI;AACF,SAAM,gBAAgB,sBAAsB;AAC5C,mBAAgB,kBAAkB,oBAAoB,QAAQ,YAAY,YAAY;WAC/E,SAAS;AAChB,WAAQ,KAAK,yDAAyD;;AAGxE,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;EAGX,MAAM,gBAAgB;GACpB,SAAS;GACM;GACf,qBAAqB;GACrB,eAAe,kBAAkB;GACjC,iBAAiB;IACf,SAAS;IACT,cAAc,aAAa;IAC3B,qBAAqB,0BAA0B;IAC/C,kBAAkB,6BAA6B;;;AAInD,cAAY,MAAM;AAClB,SAAO;UAEAC,OAAgB;EACvB,MAAM,UAAW,SAAS,OAAO,UAAU,YAAY,aAAa,QAChE,OAAQ,MAAgC,WAAW,MACnD,OAAO,SAAS;EACpB,MAAM,QAAS,SAAS,OAAO,UAAU,YAAY,WAAW,QAC5D,OAAQ,MAA8B,SAAS,MAC/C;AACJ,UAAQ,MAAM,wBAAwB,SAAS;AAG/C,QAAM,4BACJ,mBACA,eACA,iBACA;EAIF,MAAM,eAAe,4BAA4B,OAAO,gBAAgB;EAExE,MAAM,cAAc,IAAI,MAAM;AAC9B,YAAU;AAEV,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;GACT,OAAO;;EAGT,MAAM,SAAS;GAAE,SAAS;GAAO,OAAO;;AACxC,cAAY;AACZ,SAAO;;;AAKX,eAAsB,gBACpB,SACA,eACA,SACA,sBAC6B;AAC7B,QAAO,wBAAwB,SAAS,eAAe,SAAS,sBAAsB;;;;;;;;AAwDxF,MAAM,6BAA6B,OACjC,SAKA,eACA,SACA,YACG;AAEH,WAAU;EACR,MAAM;EACN,OAAO,kBAAkB;EACzB,QAAQ,mBAAmB;EAC3B,SAAS;;AAIX,KAAI,CAAC,eAAe;EAClB,MAAM,wBAAQ,IAAI,MAAM;AACxB,YAAU;AACV,QAAM;;CAGR,MAAM,aAAa,sBAAsB;AACzC,KAAI,CAAC,WAAW,OAAO;EACrB,MAAM,wBAAQ,IAAI,MAAM,4BAA4B,WAAW;AAC/D,YAAU;AACV,QAAM;;AAER,KAAI,CAAC,OAAO,iBAAiB;EAC3B,MAAM,wBAAQ,IAAI,MAAM;AACxB,YAAU;AACV,QAAM;;AAKR,WAAU;EACR,MAAM;EACN,OAAO,kBAAkB;EACzB,QAAQ,mBAAmB;EAC3B,SAAS;;;;;;AAQb,eAAe,4BACb,mBAMA,eACA,iBACA,SACe;AACf,SAAQ,MAAM,qCAAqC;AAGnD,KAAI;AAEF,QAAM,gBAAgB;AAGtB,MAAI,kBAAkB,gBAAgB;AACpC,WAAQ,MAAM;AACd,aAAU;IACR,MAAM;IACN,OAAO,kBAAkB;IACzB,QAAQ,mBAAmB;IAC3B,SAAS;IACT,OAAO;;AAGT,SAAM,gBAAgB,yBAAyB;AAC/C,WAAQ,MAAM;;AAKhB,MAAI,kBAAkB,oBAAoB;AACxC,WAAQ,MAAM;AACd,aAAU;IACR,MAAM;IACN,OAAO,kBAAkB;IACzB,QAAQ,mBAAmB;IAC3B,SAAS,8BAA8B,kBAAkB,sBAAsB;IAC/E,OAAO;;;AAGX,UAAQ,MAAM;UAEPC,eAAwB;AAC/B,UAAQ,MAAM,oBAAoB;AAClC,YAAU;GACR,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS,oBACN,iBAAiB,OAAO,kBAAkB,YAAY,aAAa,gBAChE,OAAQ,cAAwC,WAAW,MAC3D,OAAO,iBAAiB;GAE9B,OAAO;;;;AAKb,eAAe,4CAA4C,MAezC;AAGhB,KAAI,KAAK,wBAAwB,mBAAoB;CAErD,MAAM,qBAAqB,OAAO,KAAK,sBAAsB,IAAI;CACjE,MAAM,eAAe,OAAO,KAAK,gBAAgB,IAAI;CACrD,MAAM,2BAA2B,OAAO,KAAK,qCAAqC,IAAI;CACtF,MAAM,4BAA4B,OAAO,KAAK,6BAA6B,IAAI;AAE/E,KAAI,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,2BAA2B;AACnG,UAAQ,KAAK;AACb;;AAGF,KAAI;AACF,OAAK,UAAU;GACb,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;AAIX,MAAI;AACF,QAAK,gBAAgB,kBAAkB,eAAe,KAAK,eAAe,KAAK;UACzE;EACR,MAAM,YAAY,MAAM,KAAK,gBAAgB,kBAAkB,2BAC7D,KAAK,YACL,EAAE,OAAO;EAGX,MAAM,SAAS,MAAM,KAAK,gBAAgB,qCAAqC;GAC7E,eAAe,KAAK;GACpB,YAAY,KAAK;GACjB,aAAa,KAAK;GAClB,oBAAoB;GACpB;GACA;GACA,qBAAqB,KAAK;GAC1B,sBAAsB,KAAK;;EAG7B,MAAM,WAAW,QAAQ;AACzB,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM;AAE/B,QAAM,KAAK,WAAW,gBAAgB,UAAU,oBAAoB;EAEpE,MAAM,uBAAuB,MAAM,+BACjC,KAAK,YACL,KAAK,eACL,CAAC,KAAK,eAAe,qBACrB;GAAE,UAAU;GAAG,SAAS;GAAK,UAAU;;AAEzC,MAAI,CAAC,qBACH,OAAM,IAAI,MAAM;AAGlB,QAAM,iBAAiB,WAAW,iBAAiB;GACjD,MAAM;GACN,eAAe,KAAK;GACpB,cAAc;GACd,WAAW;GACX,aAAa,KAAK;GAClB;GACA,uBAAuB;GACvB,cAAc,sCAAsC;IAClD,qBAAqB,KAAK;IAC1B,sBAAsB,KAAK;IAC3B;IACA,YAAY,KAAK,gBAAgB,sBAAsB,SAAS;IAChE;IACA;IACA,uBAAuB;;GAEzB,WAAW,KAAK;;AAGlB,OAAK,UAAU;GACb,MAAM;GACN,OAAO,kBAAkB;GACzB,QAAQ,mBAAmB;GAC3B,SAAS;;UAEJ,GAAG;AACV,UAAQ,KAAK,6FAA6F;;;AAI9G,eAAe,+BACb,YACA,eACA,oBACA,MACkB;CAClB,MAAM,SAAS,MAAM,KACnB,IAAI,IAAI,mBAAmB,KAAK,MAAM,oBAAoB,IAAI,OAAO;AAEvE,KAAI,CAAC,OAAO,OAAQ,QAAO;CAE3B,MAAM,WAAW,KAAK,IAAI,GAAG,KAAK,MAAM,MAAM,YAAY;CAC1D,MAAM,UAAU,KAAK,IAAI,IAAI,KAAK,MAAM,MAAM,WAAW;CACzD,MAAM,WAAW,MAAM,YAAY;AAEnC,MAAK,IAAI,IAAI,GAAG,IAAI,UAAU,KAAK;AACjC,MAAI;GACF,MAAM,gBAAgB,MAAM,WAAW,kBACrC,eACA,EAAE;GAEJ,MAAM,OAAO,cAAc,KAAK,KAAK,MAAM,oBAAoB,EAAE,aAAa,OAAO;GACrF,MAAM,aAAa,OAAO,OAAO,aAAa,KAAK,SAAS;AAC5D,OAAI,WAAY,QAAO;UACjB;AAGR,MAAI,IAAI,WAAW,EACjB,OAAM,IAAI,SAAS,QAAQ,WAAW,KAAK;;AAG/C,QAAO"}

package/dist/esm/react/src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/adapters/session.js

@@ -31,20 +31,11 @@ function createConfirmSession({ adapters, worker, request, confirmationConfig, t
 			adapters.ui.closeModalSafely(!!decision.confirmed, confirmHandle);
 		}
 	};
-	const cleanupAndRethrow = (err) => {
-		try {
-			adapters.near.releaseReservedNonces(reservedNonces);
-			adapters.ui.closeModalSafely(false, confirmHandle);
-		} finally {
-			throw err;
-		}
-	};
 	return {
 		setReservedNonces,
 		updateUI,
 		promptUser,
-		confirmAndCloseModal,
-		cleanupAndRethrow
+		confirmAndCloseModal
 	};
 }
 

package/dist/esm/react/src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/adapters/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","names":["reservedNonces: string[] | undefined","confirmHandle: ConfirmUIHandle | undefined"],"sources":["../../../../../../../../../src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/adapters/session.ts"],"sourcesContent":["import type { ConfirmationConfig } from '../../../../types/signer-worker';\nimport type { ConfirmUIHandle, ConfirmUIUpdate } from '../../../LitComponents/confirm-ui';\nimport type { KnownSecureConfirmRequest, SecureConfirmDecision, TransactionSummary } from '../types';\nimport type { VRFChallenge } from '../../../../types';\nimport { sendConfirmResponse } from './common';\nimport type { ConfirmTxFlowAdapters } from './interfaces';\n\nexport function createConfirmSession({\n  adapters,\n  worker,\n  request,\n  confirmationConfig,\n  transactionSummary,\n}: {\n  adapters: ConfirmTxFlowAdapters;\n  worker: Worker;\n  request: KnownSecureConfirmRequest;\n  confirmationConfig: ConfirmationConfig;\n  transactionSummary: TransactionSummary;\n}): {\n  setReservedNonces: (nonces?: string[]) => void;\n  updateUI: (props: ConfirmUIUpdate) => void;\n  promptUser: (args: { vrfChallenge?: Partial<VRFChallenge> }) => Promise<{ confirmed: boolean; error?: string }>;\n  /**\n   * Send decision back to worker and perform standard cleanup.\n   * - On `confirmed: false`, releases any reserved nonces.\n   * - Always closes the confirm UI handle when present.\n   */\n  confirmAndCloseModal: (decision: SecureConfirmDecision) => void;\n  /**\n   * Cleanup + rethrow helper for invariant failures (e.g. missing PRF outputs),\n   * where tests/logic expect no worker response envelope.\n   */\n  cleanupAndRethrow: (err: unknown) => never;\n} {\n  let reservedNonces: string[] | undefined;\n  let confirmHandle: ConfirmUIHandle | undefined;\n\n  const setReservedNonces = (nonces?: string[]) => {\n    reservedNonces = nonces;\n  };\n\n  const updateUI = (props: ConfirmUIUpdate) => {\n    confirmHandle?.update?.(props);\n  };\n\n  const promptUser = async ({ vrfChallenge }: { vrfChallenge?: Partial<VRFChallenge> }) => {\n    const { confirmed, confirmHandle: handle, error } = await adapters.ui.renderConfirmUI({\n      request,\n      confirmationConfig,\n      transactionSummary,\n      vrfChallenge,\n    });\n    confirmHandle = handle;\n    return { confirmed, error };\n  };\n\n  const confirmAndCloseModal = (decision: SecureConfirmDecision) => {\n    try {\n      sendConfirmResponse(worker, decision);\n    } finally {\n      if (!decision.confirmed) {\n        adapters.near.releaseReservedNonces(reservedNonces);\n      }\n      adapters.ui.closeModalSafely(!!decision.confirmed, confirmHandle);\n    }\n  };\n\n  const cleanupAndRethrow = (err: unknown): never => {\n    try {\n      adapters.near.releaseReservedNonces(reservedNonces);\n      adapters.ui.closeModalSafely(false, confirmHandle);\n    } finally {\n      throw err;\n    }\n  };\n\n  return {\n    setReservedNonces,\n    updateUI,\n    promptUser,\n    confirmAndCloseModal,\n    cleanupAndRethrow,\n  };\n}\n"],"mappings":";;;AAOA,SAAgB,qBAAqB,EACnC,UACA,QACA,SACA,oBACA,sBAsBA;CACA,IAAIA;CACJ,IAAIC;CAEJ,MAAM,qBAAqB,WAAsB;AAC/C,mBAAiB;;CAGnB,MAAM,YAAY,UAA2B;AAC3C,iBAAe,SAAS;;CAG1B,MAAM,aAAa,OAAO,EAAE,mBAA6D;EACvF,MAAM,EAAE,WAAW,eAAe,QAAQ,UAAU,MAAM,SAAS,GAAG,gBAAgB;GACpF;GACA;GACA;GACA;;AAEF,kBAAgB;AAChB,SAAO;GAAE;GAAW;;;CAGtB,MAAM,wBAAwB,aAAoC;AAChE,MAAI;AACF,uBAAoB,QAAQ;YACpB;AACR,OAAI,CAAC,SAAS,UACZ,UAAS,KAAK,sBAAsB;AAEtC,YAAS,GAAG,iBAAiB,CAAC,CAAC,SAAS,WAAW;;;CAIvD,MAAM,qBAAqB,QAAwB;AACjD,MAAI;AACF,YAAS,KAAK,sBAAsB;AACpC,YAAS,GAAG,iBAAiB,OAAO;YAC5B;AACR,SAAM;;;AAIV,QAAO;EACL;EACA;EACA;EACA;EACA"}
+{"version":3,"file":"session.js","names":["reservedNonces: string[] | undefined","confirmHandle: ConfirmUIHandle | undefined"],"sources":["../../../../../../../../../src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/adapters/session.ts"],"sourcesContent":["import type { ConfirmationConfig } from '../../../../types/signer-worker';\nimport type { ConfirmUIHandle, ConfirmUIUpdate } from '../../../LitComponents/confirm-ui';\nimport type { KnownSecureConfirmRequest, SecureConfirmDecision, TransactionSummary } from '../types';\nimport type { VRFChallenge } from '../../../../types';\nimport { sendConfirmResponse } from './common';\nimport type { ConfirmTxFlowAdapters } from './interfaces';\n\nexport function createConfirmSession({\n  adapters,\n  worker,\n  request,\n  confirmationConfig,\n  transactionSummary,\n}: {\n  adapters: ConfirmTxFlowAdapters;\n  worker: Worker;\n  request: KnownSecureConfirmRequest;\n  confirmationConfig: ConfirmationConfig;\n  transactionSummary: TransactionSummary;\n}): {\n  setReservedNonces: (nonces?: string[]) => void;\n  updateUI: (props: ConfirmUIUpdate) => void;\n  promptUser: (args: { vrfChallenge?: Partial<VRFChallenge> }) => Promise<{ confirmed: boolean; error?: string }>;\n  /**\n   * Send decision back to worker and perform standard cleanup.\n   * - On `confirmed: false`, releases any reserved nonces.\n   * - Always closes the confirm UI handle when present.\n   */\n  confirmAndCloseModal: (decision: SecureConfirmDecision) => void;\n} {\n  let reservedNonces: string[] | undefined;\n  let confirmHandle: ConfirmUIHandle | undefined;\n\n  const setReservedNonces = (nonces?: string[]) => {\n    reservedNonces = nonces;\n  };\n\n  const updateUI = (props: ConfirmUIUpdate) => {\n    confirmHandle?.update?.(props);\n  };\n\n  const promptUser = async ({ vrfChallenge }: { vrfChallenge?: Partial<VRFChallenge> }) => {\n    const { confirmed, confirmHandle: handle, error } = await adapters.ui.renderConfirmUI({\n      request,\n      confirmationConfig,\n      transactionSummary,\n      vrfChallenge,\n    });\n    confirmHandle = handle;\n    return { confirmed, error };\n  };\n\n  const confirmAndCloseModal = (decision: SecureConfirmDecision) => {\n    try {\n      sendConfirmResponse(worker, decision);\n    } finally {\n      if (!decision.confirmed) {\n        adapters.near.releaseReservedNonces(reservedNonces);\n      }\n      adapters.ui.closeModalSafely(!!decision.confirmed, confirmHandle);\n    }\n  };\n\n  return {\n    setReservedNonces,\n    updateUI,\n    promptUser,\n    confirmAndCloseModal,\n  };\n}\n"],"mappings":";;;AAOA,SAAgB,qBAAqB,EACnC,UACA,QACA,SACA,oBACA,sBAiBA;CACA,IAAIA;CACJ,IAAIC;CAEJ,MAAM,qBAAqB,WAAsB;AAC/C,mBAAiB;;CAGnB,MAAM,YAAY,UAA2B;AAC3C,iBAAe,SAAS;;CAG1B,MAAM,aAAa,OAAO,EAAE,mBAA6D;EACvF,MAAM,EAAE,WAAW,eAAe,QAAQ,UAAU,MAAM,SAAS,GAAG,gBAAgB;GACpF;GACA;GACA;GACA;;AAEF,kBAAgB;AAChB,SAAO;GAAE;GAAW;;;CAGtB,MAAM,wBAAwB,aAAoC;AAChE,MAAI;AACF,uBAAoB,QAAQ;YACpB;AACR,OAAI,CAAC,SAAS,UACZ,UAAS,KAAK,sBAAsB;AAEtC,YAAS,GAAG,iBAAiB,CAAC,CAAC,SAAS,WAAW;;;AAIvD,QAAO;EACL;EACA;EACA;EACA"}

package/dist/esm/react/src/core/WebAuthnManager/VrfWorkerManager/confirmTxFlow/flows/registration.js

@@ -18,78 +18,70 @@ async function handleRegistrationFlow(ctx, request, worker, opts) {
 		transactionSummary
 	});
 	const nearAccountId = getNearAccountId(request);
-	console.debug("[RegistrationFlow] start", {
-		nearAccountId,
-		uiMode: confirmationConfig?.uiMode,
-		behavior: confirmationConfig?.behavior,
-		theme: confirmationConfig?.theme,
-		intentDigest: transactionSummary?.intentDigest
-	});
-	const nearRpc = await adapters.near.fetchNearContext({
-		nearAccountId,
-		txCount: 1,
-		reserveNonces: true
-	});
-	if (nearRpc.error && !nearRpc.transactionContext) return session.confirmAndCloseModal({
-		requestId: request.requestId,
-		intentDigest: getIntentDigest(request),
-		confirmed: false,
-		error: `${ERROR_MESSAGES.nearRpcFailed}: ${nearRpc.details}`
-	});
-	const transactionContext = nearRpc.transactionContext;
-	session.setReservedNonces(nearRpc.reservedNonces);
-	const computeBoundIntentDigestB64u = async () => {
-		const uiIntentDigest = getIntentDigest(request);
-		if (!uiIntentDigest) throw new Error("Missing intentDigest for registration flow");
-		return sha256Base64UrlUtf8(uiIntentDigest);
-	};
-	const rpId = adapters.vrf.getRpId();
-	const boundIntentDigestB64u = await computeBoundIntentDigestB64u();
-	const bootstrap = await adapters.vrf.generateVrfKeypairBootstrap({
-		vrfInputData: {
-			userId: nearAccountId,
-			rpId,
-			blockHeight: transactionContext.txBlockHeight,
-			blockHash: transactionContext.txBlockHash,
-			intentDigest: boundIntentDigestB64u
-		},
-		saveInMemory: true,
-		sessionId: request.requestId
-	});
-	let uiVrfChallenge = bootstrap.vrfChallenge;
-	console.debug("[RegistrationFlow] VRF bootstrap ok", { blockHeight: uiVrfChallenge.blockHeight });
-	const { confirmed, error: uiError } = await session.promptUser({ vrfChallenge: uiVrfChallenge });
-	if (!confirmed) {
-		console.debug("[RegistrationFlow] user cancelled");
-		return session.confirmAndCloseModal({
+	try {
+		const nearRpc = await adapters.near.fetchNearContext({
+			nearAccountId,
+			txCount: 1,
+			reserveNonces: true
+		});
+		if (nearRpc.error && !nearRpc.transactionContext) return session.confirmAndCloseModal({
 			requestId: request.requestId,
 			intentDigest: getIntentDigest(request),
 			confirmed: false,
-			error: uiError
+			error: `${ERROR_MESSAGES.nearRpcFailed}: ${nearRpc.details}`
 		});
-	}
-	try {
-		const refreshed = await adapters.vrf.maybeRefreshVrfChallenge(request, nearAccountId);
-		uiVrfChallenge = refreshed.vrfChallenge;
-		session.updateUI({ vrfChallenge: uiVrfChallenge });
-		console.debug("[RegistrationFlow] VRF JIT refresh ok", { blockHeight: uiVrfChallenge.blockHeight });
-	} catch (e) {
-		console.debug("[RegistrationFlow] VRF JIT refresh skipped", e);
-	}
-	let credential;
-	let deviceNumber = request.payload?.deviceNumber ?? 1;
-	const tryCreate = async (dn) => {
-		console.debug("[RegistrationFlow] navigator.credentials.create start", { deviceNumber: dn });
-		return await adapters.webauthn.createRegistrationCredential({
-			nearAccountId,
-			challenge: uiVrfChallenge,
-			deviceNumber: dn
+		const transactionContext = nearRpc.transactionContext;
+		session.setReservedNonces(nearRpc.reservedNonces);
+		const computeBoundIntentDigestB64u = async () => {
+			const uiIntentDigest = getIntentDigest(request);
+			if (!uiIntentDigest) throw new Error("Missing intentDigest for registration flow");
+			return sha256Base64UrlUtf8(uiIntentDigest);
+		};
+		const rpId = adapters.vrf.getRpId();
+		const boundIntentDigestB64u = await computeBoundIntentDigestB64u();
+		const bootstrap = await adapters.vrf.generateVrfKeypairBootstrap({
+			vrfInputData: {
+				userId: nearAccountId,
+				rpId,
+				blockHeight: transactionContext.txBlockHeight,
+				blockHash: transactionContext.txBlockHash,
+				intentDigest: boundIntentDigestB64u
+			},
+			saveInMemory: true,
+			sessionId: request.requestId
 		});
-	};
-	try {
+		let uiVrfChallenge = bootstrap.vrfChallenge;
+		console.debug("[RegistrationFlow] VRF bootstrap ok", { blockHeight: uiVrfChallenge.blockHeight });
+		const { confirmed, error: uiError } = await session.promptUser({ vrfChallenge: uiVrfChallenge });
+		if (!confirmed) {
+			console.debug("[RegistrationFlow] user cancelled");
+			return session.confirmAndCloseModal({
+				requestId: request.requestId,
+				intentDigest: getIntentDigest(request),
+				confirmed: false,
+				error: uiError
+			});
+		}
+		try {
+			const refreshed = await adapters.vrf.maybeRefreshVrfChallenge(request, nearAccountId);
+			uiVrfChallenge = refreshed.vrfChallenge;
+			session.updateUI({ vrfChallenge: uiVrfChallenge });
+			console.debug("[RegistrationFlow] VRF JIT refresh ok", { blockHeight: uiVrfChallenge.blockHeight });
+		} catch (e) {
+			console.debug("[RegistrationFlow] VRF JIT refresh skipped", e);
+		}
+		let credential;
+		let deviceNumber = request.payload?.deviceNumber ?? 1;
+		const tryCreate = async (dn) => {
+			console.debug("[RegistrationFlow] navigator.credentials.create start", { deviceNumber: dn });
+			return await adapters.webauthn.createRegistrationCredential({
+				nearAccountId,
+				challenge: uiVrfChallenge,
+				deviceNumber: dn
+			});
+		};
 		try {
 			credential = await tryCreate(deviceNumber);
-			console.debug("[RegistrationFlow] credentials.create ok");
 		} catch (e) {
 			const err = toError(e);
 			const name = String(err?.name || "");
@@ -140,14 +132,13 @@ async function handleRegistrationFlow(ctx, request, worker, opts) {
 	} catch (err) {
 		const cancelled = isUserCancelledSecureConfirm(err);
 		const msg = String(toError(err)?.message || err || "");
-		if (/Missing PRF result/i.test(msg) || /Missing PRF results/i.test(msg)) return session.cleanupAndRethrow(err);
 		if (cancelled) window.parent?.postMessage({ type: "WALLET_UI_CLOSED" }, "*");
 		const isPrfBrowserUnsupported = /WebAuthn PRF output is missing from navigator\.credentials\.create\(\)/i.test(msg) || /does not fully support the WebAuthn PRF extension during registration/i.test(msg) || /roaming hardware authenticators .* not supported in this flow/i.test(msg);
 		return session.confirmAndCloseModal({
 			requestId: request.requestId,
 			intentDigest: getIntentDigest(request),
 			confirmed: false,
-			error: cancelled ? ERROR_MESSAGES.cancelled : isPrfBrowserUnsupported ? msg : ERROR_MESSAGES.collectCredentialsFailed
+			error: cancelled ? ERROR_MESSAGES.cancelled : isPrfBrowserUnsupported ? msg : msg || ERROR_MESSAGES.collectCredentialsFailed
 		});
 	}
 }