import { createVaultClient } from "@railman/zero-vault";

const vault = createVaultClient({ userId: session.user.id });

const created = await vault.createVault({
  password: vaultPassword, // optional daily method
  // prfSecret + encryptionCredentialId after WebAuthn get
  accountRecovery: false, // set true for Mode B account+vault
});

// Force export before continuing
created.init.exportRecoveryPhrase();

// Persist:
// POST created.mekBody → /zero-access/mek
// POST each created.dailySlots → /zero-access/wrap-slots

const slots = await fetchWrapSlots(); // GET /zero-access/wrap-slots

const result = await vault.unlockDaily({
  slots,
  prfSecret, // from extractPrfSecret after WebAuthn
  password, // vault password, never sent to server
});

if (!result.ok) {
  // not_provisioned | no_daily_method | password_required | ...
}

const unlocked = await vault.resetWithRecoveryPhrase({
  slots,
  mnemonic,
});

// Immediately re-enroll daily methods so the user is not phrase-dependent
const newDaily = await vault.reenrollDailyMethods({
  slots,
  mnemonic,
  prfSecret,
  password,
});
// POST new wraps; revoke lost PRF slots if needed