@aptos-labs/ts-sdk 6.3.1 → 7.0.0

package/dist/account/EphemeralKeyPair.js

@@ -0,0 +1,246 @@
+// Copyright © Aptos Foundation
+// SPDX-License-Identifier: Apache-2.0
+import { randomBytes } from "@noble/hashes/utils.js";
+import { bytesToBigIntLE, padAndPackBytesWithLen, poseidonHash } from "../core/crypto/poseidon.js";
+import { EphemeralPublicKey, EphemeralSignature } from "../core/crypto/ephemeral.js";
+import { Ed25519PrivateKey } from "../core/crypto/ed25519.js";
+import { Hex } from "../core/hex.js";
+import { EphemeralPublicKeyVariant } from "../types/index.js";
+import { Deserializer, Serializable } from "../bcs/index.js";
+import { floorToWholeHour, nowInSeconds } from "../utils/helpers.js";
+const TWO_WEEKS_IN_SECONDS = 1_209_600;
+/**
+ * Represents an ephemeral key pair used for signing transactions via the Keyless authentication scheme.
+ * This key pair is temporary and includes an expiration time.
+ * For more details on how this class is used, refer to the documentation:
+ * https://aptos.dev/guides/keyless-accounts/#1-present-the-user-with-a-sign-in-with-idp-button-on-the-ui
+ * @group Implementation
+ * @category Account (On-Chain Model)
+ */
+export class EphemeralKeyPair extends Serializable {
+    static BLINDER_LENGTH = 31;
+    /**
+     * A byte array of length BLINDER_LENGTH used to obfuscate the public key from the IdP.
+     * Used in calculating the nonce passed to the IdP and as a secret witness in proof generation.
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    blinder;
+    /**
+     * A timestamp in seconds indicating when the ephemeral key pair is expired.  After expiry, a new
+     * EphemeralKeyPair must be generated and a new JWT needs to be created.
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    expiryDateSecs;
+    /**
+     * The value passed to the IdP when the user authenticates.  It consists of a hash of the
+     * ephemeral public key, expiry date, and blinder.
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    nonce;
+    /**
+     * A private key used to sign transactions.  This private key is not tied to any account on the chain as it
+     * is ephemeral (not permanent) in nature.
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    privateKey;
+    /**
+     * A public key used to verify transactions.  This public key is not tied to any account on the chain as it
+     * is ephemeral (not permanent) in nature.
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    publicKey;
+    /**
+     * Whether the ephemeral key pair has been cleared from memory.
+     * @private
+     */
+    cleared = false;
+    /**
+     * Creates an instance of the class with a specified private key, optional expiry date, and optional blinder.
+     * This constructor initializes the public key, sets the expiry date to a default value if not provided,
+     * generates a blinder if not supplied, and calculates the nonce based on the public key, expiry date, and blinder.
+     *
+     * @param args - The parameters for constructing the instance.
+     * @param args.privateKey - The private key used for creating the instance.
+     * @param args.expiryDateSecs - Optional expiry date in seconds from the current time. Defaults to two weeks from now.
+     * @param args.blinder - Optional blinder value. If not provided, a new blinder will be generated.
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    constructor(args) {
+        super();
+        const { privateKey, expiryDateSecs, blinder } = args;
+        this.privateKey = privateKey;
+        this.publicKey = new EphemeralPublicKey(privateKey.publicKey());
+        // By default, we set the expiry date to be two weeks in the future floored to the nearest hour
+        this.expiryDateSecs = expiryDateSecs || floorToWholeHour(nowInSeconds() + TWO_WEEKS_IN_SECONDS);
+        // Generate the blinder if not provided
+        this.blinder = blinder !== undefined ? Hex.fromHexInput(blinder).toUint8Array() : generateBlinder();
+        // Calculate the nonce
+        const fields = padAndPackBytesWithLen(this.publicKey.bcsToBytes(), 93);
+        fields.push(BigInt(this.expiryDateSecs));
+        fields.push(bytesToBigIntLE(this.blinder));
+        const nonceHash = poseidonHash(fields);
+        this.nonce = nonceHash.toString();
+    }
+    /**
+     * Returns the public key of the key pair.
+     * @return EphemeralPublicKey
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    getPublicKey() {
+        return this.publicKey;
+    }
+    /**
+     * Checks if the current time has surpassed the expiry date of the key pair.
+     * @return boolean - Returns true if the key pair is expired, otherwise false.
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    isExpired() {
+        const currentTimeSecs = Math.floor(Date.now() / 1000);
+        return currentTimeSecs > this.expiryDateSecs;
+    }
+    /**
+     * Clears the ephemeral private key from memory by overwriting it with random bytes.
+     * After calling this method, the ephemeral key pair can no longer be used for signing.
+     *
+     * Note: Due to JavaScript's memory management, this cannot guarantee complete removal of
+     * sensitive data from memory, but it significantly reduces the window of exposure.
+     *
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    clear() {
+        if (!this.cleared) {
+            // Clear the underlying private key if it has a clear method
+            if ("clear" in this.privateKey && typeof this.privateKey.clear === "function") {
+                this.privateKey.clear();
+            }
+            else {
+                // Fallback: multiple overwrite passes for better security
+                const keyBytes = this.privateKey.toUint8Array();
+                crypto.getRandomValues(keyBytes);
+                keyBytes.fill(0xff);
+                crypto.getRandomValues(keyBytes);
+                keyBytes.fill(0);
+            }
+            // Also clear the blinder with multiple passes as it's used in nonce calculation
+            crypto.getRandomValues(this.blinder);
+            this.blinder.fill(0xff);
+            crypto.getRandomValues(this.blinder);
+            this.blinder.fill(0);
+            this.cleared = true;
+        }
+    }
+    /**
+     * Returns whether the ephemeral key pair has been cleared from memory.
+     *
+     * @returns true if the key pair has been cleared, false otherwise
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    isCleared() {
+        return this.cleared;
+    }
+    /**
+     * Serializes the object's properties into a format suitable for transmission or storage.
+     * This function is essential for preparing the object data for serialization processes.
+     *
+     * @param serializer - The serializer instance used to serialize the object's properties.
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    serialize(serializer) {
+        serializer.serializeU32AsUleb128(this.publicKey.variant);
+        serializer.serializeBytes(this.privateKey.toUint8Array());
+        serializer.serializeU64(this.expiryDateSecs);
+        serializer.serializeFixedBytes(this.blinder);
+    }
+    /**
+     * Deserializes an ephemeral key pair from the provided deserializer.
+     * This function helps in reconstructing an ephemeral key pair, which is essential for cryptographic operations.
+     *
+     * @param deserializer - The deserializer instance used to read the serialized data.
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    static deserialize(deserializer) {
+        const variantIndex = deserializer.deserializeUleb128AsU32();
+        let privateKey;
+        switch (variantIndex) {
+            case EphemeralPublicKeyVariant.Ed25519:
+                privateKey = Ed25519PrivateKey.deserialize(deserializer);
+                break;
+            default:
+                throw new Error(`Unknown variant index for EphemeralPublicKey: ${variantIndex}`);
+        }
+        const expiryDateSecs = deserializer.deserializeU64();
+        const blinder = deserializer.deserializeFixedBytes(31);
+        return new EphemeralKeyPair({ privateKey, expiryDateSecs: Number(expiryDateSecs), blinder });
+    }
+    /**
+     * Deserialize a byte array into an EphemeralKeyPair object.
+     * This function allows you to reconstruct an EphemeralKeyPair from its serialized byte representation.
+     *
+     * @param bytes - The byte array representing the serialized EphemeralKeyPair.
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    static fromBytes(bytes) {
+        return EphemeralKeyPair.deserialize(new Deserializer(bytes));
+    }
+    /**
+     * Generates a new ephemeral key pair with an optional expiry date.
+     * This function allows you to create a temporary key pair for secure operations.
+     *
+     * @param args - Optional parameters for key pair generation.
+     * @param args.scheme - The type of key pair to use for the EphemeralKeyPair. Only Ed25519 is supported for now.
+     * @param args.expiryDateSecs - The date of expiry for the key pair in seconds.
+     * @returns An instance of EphemeralKeyPair containing the generated private key and expiry date.
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    static generate(args) {
+        let privateKey;
+        switch (args?.scheme) {
+            default:
+                privateKey = Ed25519PrivateKey.generate();
+        }
+        return new EphemeralKeyPair({ privateKey, expiryDateSecs: args?.expiryDateSecs });
+    }
+    /**
+     * Sign the given data using the private key, returning an ephemeral signature.
+     * This function is essential for creating a secure signature that can be used for authentication or verification purposes.
+     *
+     * @param data - The data to be signed, provided in HexInput format.
+     * @returns EphemeralSignature - The resulting ephemeral signature.
+     * @throws Error - Throws an error if the EphemeralKeyPair has expired or been cleared from memory.
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    sign(data) {
+        if (this.cleared) {
+            throw new Error("EphemeralKeyPair has been cleared from memory and can no longer be used");
+        }
+        if (this.isExpired()) {
+            throw new Error("EphemeralKeyPair has expired");
+        }
+        return new EphemeralSignature(this.privateKey.sign(data));
+    }
+}
+/**
+ * Generates a random byte array of length EphemeralKeyPair.BLINDER_LENGTH.
+ * @returns Uint8Array A random byte array used for blinding.
+ * @group Implementation
+ * @category Account (On-Chain Model)
+ */
+function generateBlinder() {
+    return randomBytes(EphemeralKeyPair.BLINDER_LENGTH);
+}
+//# sourceMappingURL=EphemeralKeyPair.js.map

package/dist/account/EphemeralKeyPair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EphemeralKeyPair.js","sourceRoot":"","sources":["../../src/account/EphemeralKeyPair.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,sCAAsC;AAEtC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,yBAAyB,EAAY,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAc,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAErE,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAiB,SAAQ,YAAY;IAChD,MAAM,CAAU,cAAc,GAAW,EAAE,CAAC;IAE5C;;;;;OAKG;IACM,OAAO,CAAa;IAE7B;;;;;OAKG;IACM,cAAc,CAAS;IAEhC;;;;;OAKG;IACM,KAAK,CAAS;IAEvB;;;;;OAKG;IACK,UAAU,CAAa;IAE/B;;;;;OAKG;IACK,SAAS,CAAqB;IAEtC;;;OAGG;IACK,OAAO,GAAY,KAAK,CAAC;IAEjC;;;;;;;;;;;OAWG;IACH,YAAY,IAA6E;QACvF,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;QAChE,+FAA+F;QAC/F,IAAI,CAAC,cAAc,GAAG,cAAc,IAAI,gBAAgB,CAAC,YAAY,EAAE,GAAG,oBAAoB,CAAC,CAAC;QAChG,uCAAuC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;QACpG,sBAAsB;QACtB,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,SAAS;QACP,MAAM,eAAe,GAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC9D,OAAO,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC;IAC/C,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,4DAA4D;YAC5D,IAAI,OAAO,IAAI,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBAC9E,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,0DAA0D;gBAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;gBAChD,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,gFAAgF;YAChF,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,UAAsB;QAC9B,UAAU,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACzD,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1D,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7C,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,WAAW,CAAC,YAA0B;QAC3C,MAAM,YAAY,GAAG,YAAY,CAAC,uBAAuB,EAAE,CAAC;QAC5D,IAAI,UAAsB,CAAC;QAC3B,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,yBAAyB,CAAC,OAAO;gBACpC,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBACzD,MAAM;YACR;gBACE,MAAM,IAAI,KAAK,CAAC,iDAAiD,YAAY,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,cAAc,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,YAAY,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO,IAAI,gBAAgB,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,SAAS,CAAC,KAAiB;QAChC,OAAO,gBAAgB,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,QAAQ,CAAC,IAAsE;QACpF,IAAI,UAAsB,CAAC;QAE3B,QAAQ,IAAI,EAAE,MAAM,EAAE,CAAC;YACrB;gBACE,UAAU,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC9C,CAAC;QAED,OAAO,IAAI,gBAAgB,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IACpF,CAAC;IAED;;;;;;;;;OASG;IACH,IAAI,CAAC,IAAc;QACjB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;;AAGH;;;;;GAKG;AACH,SAAS,eAAe;IACtB,OAAO,WAAW,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;AACtD,CAAC"}

package/dist/account/FederatedKeylessAccount.d.ts

@@ -0,0 +1,107 @@
+import { HexInput } from "../types/index.js";
+import { AccountAddress, AccountAddressInput } from "../core/accountAddress.js";
+import { Groth16VerificationKey, ZeroKnowledgeSig } from "../core/crypto/keyless.js";
+import { EphemeralKeyPair } from "./EphemeralKeyPair.js";
+import { Deserializer, Serializer } from "../bcs/index.js";
+import { FederatedKeylessPublicKey } from "../core/crypto/federatedKeyless.js";
+import { AbstractKeylessAccount, ProofFetchCallback } from "./AbstractKeylessAccount.js";
+/**
+ * Account implementation for the FederatedKeyless authentication scheme.
+ *
+ * Used to represent a FederatedKeyless based account and sign transactions with it.
+ *
+ * Use `FederatedKeylessAccount.create()` to instantiate a KeylessAccount with a JSON Web Token (JWT), proof, EphemeralKeyPair and the
+ * address the JSON Web Key Set (JWKS) are installed that will be used to verify the JWT.
+ *
+ * When the proof expires or the JWT becomes invalid, the KeylessAccount must be instantiated again with a new JWT,
+ * EphemeralKeyPair, and corresponding proof.
+ * @group Implementation
+ * @category Account (On-Chain Model)
+ */
+export declare class FederatedKeylessAccount extends AbstractKeylessAccount {
+    /**
+     * The FederatedKeylessPublicKey associated with the account
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    readonly publicKey: FederatedKeylessPublicKey;
+    readonly audless: boolean;
+    /**
+     * Use the static generator `FederatedKeylessAccount.create(...)` instead.
+     * Creates a KeylessAccount instance using the provided parameters.
+     * This function allows you to set up a KeylessAccount with specific attributes such as address, proof, and JWT.
+     *
+     * @param args - The parameters for creating a KeylessAccount.
+     * @param args.address - Optional account address associated with the KeylessAccount.
+     * @param args.proof - A Zero Knowledge Signature or a promise that resolves to one.
+     * @param args.jwt - A JSON Web Token used for authentication.
+     * @param args.ephemeralKeyPair - The ephemeral key pair used in the account creation.
+     * @param args.jwkAddress - The address which stores the JSON Web Key Set (JWKS) used to verify the JWT.
+     * @param args.uidKey - Optional key for user identification, defaults to "sub".
+     * @param args.proofFetchCallback - Optional callback function for fetching proof.
+     */
+    constructor(args: {
+        address?: AccountAddress;
+        ephemeralKeyPair: EphemeralKeyPair;
+        iss: string;
+        uidKey: string;
+        uidVal: string;
+        aud: string;
+        pepper: HexInput;
+        jwkAddress: AccountAddress;
+        proof: ZeroKnowledgeSig | Promise<ZeroKnowledgeSig>;
+        proofFetchCallback?: ProofFetchCallback;
+        jwt: string;
+        verificationKeyHash?: HexInput;
+        audless?: boolean;
+    });
+    /**
+     * Serializes the transaction data into a format suitable for transmission or storage.
+     * This function ensures that both the transaction bytes and the proof are properly serialized.
+     *
+     * @param serializer - The serializer instance used to convert the transaction data into bytes.
+     */
+    serialize(serializer: Serializer): void;
+    /**
+     * Deserializes the provided deserializer to create a KeylessAccount instance.
+     * This function extracts necessary components such as the JWT, UID key, pepper, ephemeral key pair, and proof from the deserializer.
+     *
+     * @param deserializer - The deserializer instance used to retrieve the serialized data.
+     * @returns A KeylessAccount instance created from the deserialized data.
+     */
+    static deserialize(deserializer: Deserializer): FederatedKeylessAccount;
+    /**
+     * Deserialize bytes using this account's information.
+     *
+     * @param bytes The bytes being interpreted.
+     * @returns
+     */
+    static fromBytes(bytes: HexInput): FederatedKeylessAccount;
+    /**
+     * Creates a KeylessAccount instance using the provided parameters.
+     * This function allows you to set up a KeylessAccount with specific attributes such as address, proof, and JWT.
+     * This is used instead of the KeylessAccount constructor.
+     *
+     * @param args - The parameters for creating a KeylessAccount.
+     * @param args.address - Optional account address associated with the KeylessAccount.
+     * @param args.proof - A Zero Knowledge Signature or a promise that resolves to one.
+     * @param args.jwt - A JSON Web Token used for authentication.
+     * @param args.ephemeralKeyPair - The ephemeral key pair used in the account creation.
+     * @param args.jwkAddress - The address which stores the JSON Web Key Set (JWKS) used to verify the JWT.
+     * @param args.uidKey - Optional key for user identification, defaults to "sub".
+     * @param args.proofFetchCallback - Optional callback function for fetching proof.
+     */
+    static create(args: {
+        address?: AccountAddress;
+        proof: ZeroKnowledgeSig | Promise<ZeroKnowledgeSig>;
+        jwt: string;
+        ephemeralKeyPair: EphemeralKeyPair;
+        pepper: HexInput;
+        jwkAddress: AccountAddressInput;
+        uidKey?: string;
+        proofFetchCallback?: ProofFetchCallback;
+        verificationKey?: Groth16VerificationKey;
+        verificationKeyHash?: Uint8Array;
+    }): FederatedKeylessAccount;
+}
+//# sourceMappingURL=FederatedKeylessAccount.d.ts.map

package/dist/account/FederatedKeylessAccount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FederatedKeylessAccount.d.ts","sourceRoot":"","sources":["../../src/account/FederatedKeylessAccount.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAsB,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEzG,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEzF;;;;;;;;;;;;GAYG;AACH,qBAAa,uBAAwB,SAAQ,sBAAsB;IACjE;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,yBAAyB,CAAC;IAE9C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B;;;;;;;;;;;;;OAaG;gBACS,IAAI,EAAE;QAChB,OAAO,CAAC,EAAE,cAAc,CAAC;QACzB,gBAAgB,EAAE,gBAAgB,CAAC;QACnC,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,QAAQ,CAAC;QACjB,UAAU,EAAE,cAAc,CAAC;QAC3B,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpD,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;QACxC,GAAG,EAAE,MAAM,CAAC;QACZ,mBAAmB,CAAC,EAAE,QAAQ,CAAC;QAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB;IAOD;;;;;OAKG;IACH,SAAS,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI;IAKvC;;;;;;OAMG;IACH,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,YAAY,GAAG,uBAAuB;IAoBvE;;;;;OAKG;IACH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,GAAG,uBAAuB;IAI1D;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;QAClB,OAAO,CAAC,EAAE,cAAc,CAAC;QACzB,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpD,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,gBAAgB,CAAC;QACnC,MAAM,EAAE,QAAQ,CAAC;QACjB,UAAU,EAAE,mBAAmB,CAAC;QAChC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;QACxC,eAAe,CAAC,EAAE,sBAAsB,CAAC;QACzC,mBAAmB,CAAC,EAAE,UAAU,CAAC;KAClC,GAAG,uBAAuB;CAkC5B"}

package/dist/account/FederatedKeylessAccount.js

@@ -0,0 +1,129 @@
+// Copyright © Aptos Foundation
+// SPDX-License-Identifier: Apache-2.0
+import { AccountAddress } from "../core/accountAddress.js";
+import { getIssAudAndUidVal } from "../core/crypto/keyless.js";
+import { Deserializer } from "../bcs/index.js";
+import { FederatedKeylessPublicKey } from "../core/crypto/federatedKeyless.js";
+import { AbstractKeylessAccount } from "./AbstractKeylessAccount.js";
+/**
+ * Account implementation for the FederatedKeyless authentication scheme.
+ *
+ * Used to represent a FederatedKeyless based account and sign transactions with it.
+ *
+ * Use `FederatedKeylessAccount.create()` to instantiate a KeylessAccount with a JSON Web Token (JWT), proof, EphemeralKeyPair and the
+ * address the JSON Web Key Set (JWKS) are installed that will be used to verify the JWT.
+ *
+ * When the proof expires or the JWT becomes invalid, the KeylessAccount must be instantiated again with a new JWT,
+ * EphemeralKeyPair, and corresponding proof.
+ * @group Implementation
+ * @category Account (On-Chain Model)
+ */
+export class FederatedKeylessAccount extends AbstractKeylessAccount {
+    /**
+     * The FederatedKeylessPublicKey associated with the account
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    publicKey;
+    audless;
+    /**
+     * Use the static generator `FederatedKeylessAccount.create(...)` instead.
+     * Creates a KeylessAccount instance using the provided parameters.
+     * This function allows you to set up a KeylessAccount with specific attributes such as address, proof, and JWT.
+     *
+     * @param args - The parameters for creating a KeylessAccount.
+     * @param args.address - Optional account address associated with the KeylessAccount.
+     * @param args.proof - A Zero Knowledge Signature or a promise that resolves to one.
+     * @param args.jwt - A JSON Web Token used for authentication.
+     * @param args.ephemeralKeyPair - The ephemeral key pair used in the account creation.
+     * @param args.jwkAddress - The address which stores the JSON Web Key Set (JWKS) used to verify the JWT.
+     * @param args.uidKey - Optional key for user identification, defaults to "sub".
+     * @param args.proofFetchCallback - Optional callback function for fetching proof.
+     */
+    constructor(args) {
+        const publicKey = FederatedKeylessPublicKey.create(args);
+        super({ publicKey, ...args });
+        this.publicKey = publicKey;
+        this.audless = args.audless ?? false;
+    }
+    /**
+     * Serializes the transaction data into a format suitable for transmission or storage.
+     * This function ensures that both the transaction bytes and the proof are properly serialized.
+     *
+     * @param serializer - The serializer instance used to convert the transaction data into bytes.
+     */
+    serialize(serializer) {
+        super.serialize(serializer);
+        this.publicKey.jwkAddress.serialize(serializer);
+    }
+    /**
+     * Deserializes the provided deserializer to create a KeylessAccount instance.
+     * This function extracts necessary components such as the JWT, UID key, pepper, ephemeral key pair, and proof from the deserializer.
+     *
+     * @param deserializer - The deserializer instance used to retrieve the serialized data.
+     * @returns A KeylessAccount instance created from the deserialized data.
+     */
+    static deserialize(deserializer) {
+        const { address, proof, ephemeralKeyPair, jwt, uidKey, pepper, verificationKeyHash } = AbstractKeylessAccount.partialDeserialize(deserializer);
+        const jwkAddress = AccountAddress.deserialize(deserializer);
+        const { iss, aud, uidVal } = getIssAudAndUidVal({ jwt, uidKey });
+        return new FederatedKeylessAccount({
+            address,
+            proof,
+            ephemeralKeyPair,
+            iss,
+            uidKey,
+            uidVal,
+            aud,
+            pepper,
+            jwt,
+            verificationKeyHash,
+            jwkAddress,
+        });
+    }
+    /**
+     * Deserialize bytes using this account's information.
+     *
+     * @param bytes The bytes being interpreted.
+     * @returns
+     */
+    static fromBytes(bytes) {
+        return FederatedKeylessAccount.deserialize(Deserializer.fromHex(bytes));
+    }
+    /**
+     * Creates a KeylessAccount instance using the provided parameters.
+     * This function allows you to set up a KeylessAccount with specific attributes such as address, proof, and JWT.
+     * This is used instead of the KeylessAccount constructor.
+     *
+     * @param args - The parameters for creating a KeylessAccount.
+     * @param args.address - Optional account address associated with the KeylessAccount.
+     * @param args.proof - A Zero Knowledge Signature or a promise that resolves to one.
+     * @param args.jwt - A JSON Web Token used for authentication.
+     * @param args.ephemeralKeyPair - The ephemeral key pair used in the account creation.
+     * @param args.jwkAddress - The address which stores the JSON Web Key Set (JWKS) used to verify the JWT.
+     * @param args.uidKey - Optional key for user identification, defaults to "sub".
+     * @param args.proofFetchCallback - Optional callback function for fetching proof.
+     */
+    static create(args) {
+        const { address, proof, jwt, ephemeralKeyPair, pepper, jwkAddress, uidKey = "sub", proofFetchCallback, verificationKey, verificationKeyHash, } = args;
+        if (verificationKeyHash && verificationKey) {
+            throw new Error("Cannot provide both verificationKey and verificationKeyHash");
+        }
+        const { iss, aud, uidVal } = getIssAudAndUidVal({ jwt, uidKey });
+        return new FederatedKeylessAccount({
+            address,
+            proof,
+            ephemeralKeyPair,
+            iss,
+            uidKey,
+            uidVal,
+            aud,
+            pepper,
+            jwkAddress: AccountAddress.from(jwkAddress),
+            jwt,
+            proofFetchCallback,
+            verificationKeyHash: verificationKeyHash ?? (verificationKey ? verificationKey.hash() : undefined),
+        });
+    }
+}
+//# sourceMappingURL=FederatedKeylessAccount.js.map

package/dist/account/FederatedKeylessAccount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FederatedKeylessAccount.js","sourceRoot":"","sources":["../../src/account/FederatedKeylessAccount.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,sCAAsC;AAGtC,OAAO,EAAE,cAAc,EAAuB,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAA4C,MAAM,2BAA2B,CAAC;AAGzG,OAAO,EAAE,YAAY,EAAc,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAsB,MAAM,6BAA6B,CAAC;AAEzF;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,uBAAwB,SAAQ,sBAAsB;IACjE;;;;OAIG;IACM,SAAS,CAA4B;IAErC,OAAO,CAAU;IAE1B;;;;;;;;;;;;;OAaG;IACH,YAAY,IAcX;QACC,MAAM,SAAS,GAAG,yBAAyB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzD,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,UAAsB;QAC9B,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,WAAW,CAAC,YAA0B;QAC3C,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAClF,sBAAsB,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,uBAAuB,CAAC;YACjC,OAAO;YACP,KAAK;YACL,gBAAgB;YAChB,GAAG;YACH,MAAM;YACN,MAAM;YACN,GAAG;YACH,MAAM;YACN,GAAG;YACH,mBAAmB;YACnB,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,SAAS,CAAC,KAAe;QAC9B,OAAO,uBAAuB,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,MAAM,CAAC,IAWb;QACC,MAAM,EACJ,OAAO,EACP,KAAK,EACL,GAAG,EACH,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,MAAM,GAAG,KAAK,EACd,kBAAkB,EAClB,eAAe,EACf,mBAAmB,GACpB,GAAG,IAAI,CAAC;QAET,IAAI,mBAAmB,IAAI,eAAe,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,uBAAuB,CAAC;YACjC,OAAO;YACP,KAAK;YACL,gBAAgB;YAChB,GAAG;YACH,MAAM;YACN,MAAM;YACN,GAAG;YACH,MAAM;YACN,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;YAC3C,GAAG;YACH,kBAAkB;YAClB,mBAAmB,EAAE,mBAAmB,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;SACnG,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/account/KeylessAccount.d.ts

@@ -0,0 +1,112 @@
+import { HexInput } from "../types/index.js";
+import { AccountAddress } from "../core/accountAddress.js";
+import { Groth16VerificationKey, KeylessPublicKey, ZeroKnowledgeSig } from "../core/crypto/keyless.js";
+import { EphemeralKeyPair } from "./EphemeralKeyPair.js";
+import { Deserializer, Serializer } from "../bcs/index.js";
+import { AbstractKeylessAccount, ProofFetchCallback } from "./AbstractKeylessAccount.js";
+/**
+ * Account implementation for the Keyless authentication scheme.
+ *
+ * Used to represent a Keyless based account and sign transactions with it.
+ *
+ * Use `KeylessAccount.create()` to instantiate a KeylessAccount with a JWT, proof and EphemeralKeyPair.
+ *
+ * When the proof expires or the JWT becomes invalid, the KeylessAccount must be instantiated again with a new JWT,
+ * EphemeralKeyPair, and corresponding proof.
+ * @group Implementation
+ * @category Account (On-Chain Model)
+ */
+export declare class KeylessAccount extends AbstractKeylessAccount {
+    /**
+     * The KeylessPublicKey associated with the account
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    readonly publicKey: KeylessPublicKey;
+    /**
+     * Use the static generator `create(...)` instead.
+     * Creates an instance of the KeylessAccount with an optional proof.
+     *
+     * @param args - The parameters for creating a KeylessAccount.
+     * @param args.address - Optional account address associated with the KeylessAccount.
+     * @param args.ephemeralKeyPair - The ephemeral key pair used in the account creation.
+     * @param args.iss - A JWT issuer.
+     * @param args.uidKey - The claim on the JWT to identify a user.  This is typically 'sub' or 'email'.
+     * @param args.uidVal - The unique id for this user, intended to be a stable user identifier.
+     * @param args.aud - The value of the 'aud' claim on the JWT, also known as client ID.  This is the identifier for the dApp's
+     * OIDC registration with the identity provider.
+     * @param args.pepper - A hexadecimal input used for additional security.
+     * @param args.proof - A Zero Knowledge Signature or a promise that resolves to one.
+     * @param args.proofFetchCallback - Optional callback function for fetching proof.
+     * @param args.jwt - A JSON Web Token used for authentication.
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    constructor(args: {
+        address?: AccountAddress;
+        ephemeralKeyPair: EphemeralKeyPair;
+        iss: string;
+        uidKey: string;
+        uidVal: string;
+        aud: string;
+        pepper: HexInput;
+        proof: ZeroKnowledgeSig | Promise<ZeroKnowledgeSig>;
+        proofFetchCallback?: ProofFetchCallback;
+        jwt: string;
+        verificationKeyHash?: HexInput;
+    });
+    /**
+     * Serializes the transaction data into a format suitable for transmission or storage.
+     * This function ensures that both the transaction bytes and the proof are properly serialized.
+     *
+     * @param serializer - The serializer instance used to convert the transaction data into bytes.
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    serialize(serializer: Serializer): void;
+    /**
+     * Deserializes the provided deserializer to create a KeylessAccount instance.
+     * This function extracts necessary components such as the JWT, UID key, pepper, ephemeral key pair, and proof from the deserializer.
+     *
+     * @param deserializer - The deserializer instance used to retrieve the serialized data.
+     * @returns A KeylessAccount instance created from the deserialized data.
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    static deserialize(deserializer: Deserializer): KeylessAccount;
+    /**
+     * Deserialize bytes using this account's information.
+     *
+     * @param bytes The bytes being interpreted.
+     * @returns
+     */
+    static fromBytes(bytes: HexInput): KeylessAccount;
+    /**
+     * Creates a KeylessAccount instance using the provided parameters.
+     * This function allows you to set up a KeylessAccount with specific attributes such as address, proof, and JWT.
+     * This is used instead of the KeylessAccount constructor.
+     *
+     * @param args - The parameters for creating a KeylessAccount.
+     * @param args.address - Optional account address associated with the KeylessAccount.
+     * @param args.proof - A Zero Knowledge Signature or a promise that resolves to one.
+     * @param args.jwt - A JSON Web Token used for authentication.
+     * @param args.ephemeralKeyPair - The ephemeral key pair used in the account creation.
+     * @param args.pepper - A hexadecimal input used for additional security.
+     * @param args.uidKey - Optional key for user identification, defaults to "sub".
+     * @param args.proofFetchCallback - Optional callback function for fetching proof.
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    static create(args: {
+        address?: AccountAddress;
+        proof: ZeroKnowledgeSig | Promise<ZeroKnowledgeSig>;
+        jwt: string;
+        ephemeralKeyPair: EphemeralKeyPair;
+        pepper: HexInput;
+        uidKey?: string;
+        proofFetchCallback?: ProofFetchCallback;
+        verificationKey?: Groth16VerificationKey;
+        verificationKeyHash?: Uint8Array;
+    }): KeylessAccount;
+}
+//# sourceMappingURL=KeylessAccount.d.ts.map

package/dist/account/KeylessAccount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeylessAccount.d.ts","sourceRoot":"","sources":["../../src/account/KeylessAccount.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAEL,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGzF;;;;;;;;;;;GAWG;AACH,qBAAa,cAAe,SAAQ,sBAAsB;IACxD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IAIrC;;;;;;;;;;;;;;;;;;OAkBG;gBACS,IAAI,EAAE;QAChB,OAAO,CAAC,EAAE,cAAc,CAAC;QACzB,gBAAgB,EAAE,gBAAgB,CAAC;QACnC,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,QAAQ,CAAC;QACjB,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpD,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;QACxC,GAAG,EAAE,MAAM,CAAC;QACZ,mBAAmB,CAAC,EAAE,QAAQ,CAAC;KAChC;IAMD;;;;;;;OAOG;IACH,SAAS,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI;IAIvC;;;;;;;;OAQG;IACH,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,YAAY,GAAG,cAAc;IAkB9D;;;;;OAKG;IACH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,GAAG,cAAc;IAIjD;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;QAClB,OAAO,CAAC,EAAE,cAAc,CAAC;QACzB,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpD,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,gBAAgB,CAAC;QACnC,MAAM,EAAE,QAAQ,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;QACxC,eAAe,CAAC,EAAE,sBAAsB,CAAC;QACzC,mBAAmB,CAAC,EAAE,UAAU,CAAC;KAClC,GAAG,cAAc;CAgCnB"}