@cavos/kit 0.0.1

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/crypto/encoding.ts","../src/crypto/signature.ts","../src/signer/WebCryptoSigner.ts","../src/chains/starknet/constants.ts","../src/chains/starknet/StarknetAdapter.ts","../src/chains/starknet/StarknetDeviceSigner.ts","../src/registry/WalletRegistry.ts","../src/registry/HttpWalletRegistry.ts","../src/recovery/HttpRecoveryClient.ts","../src/recovery/BackupSigner.ts","../src/identity.ts","../src/Cavos.ts","../src/auth/AuthProvider.ts","../src/auth/CavosAuth.ts"],"names":["p256","sha256","hash","num","Signer","toHex","fromHex","randomBytes","pbkdf2","hkdf","RpcProvider","PaymasterRpc","address","Account","account","isSigner"],"mappings":";;;;;;;;;;;;AAIA,IAAM,SAAA,GAAA,CAAa,MAAM,IAAA,IAAQ,EAAA;AAG1B,SAAS,YAAY,KAAA,EAAiC;AAC3D,EAAA,OAAO,CAAC,KAAA,GAAQ,SAAA,EAAW,KAAA,IAAS,IAAI,CAAA;AAC1C;AAGO,SAAS,cAAc,KAAA,EAA2B;AACvD,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO,GAAA,GAAO,GAAA,IAAO,EAAA,GAAM,OAAO,CAAC,CAAA;AACnD,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,WAAW,KAAA,EAA2B;AACpD,EAAA,IAAI,CAAA,GAAI,IAAA;AACR,EAAA,KAAA,MAAW,CAAA,IAAK,OAAO,CAAA,IAAK,CAAA,CAAE,SAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AAC1D,EAAA,OAAO,CAAA;AACT;AAEO,SAAS,WAAW,GAAA,EAAyB;AAClD,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,IAAI,IAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAA,GAAI,GAAA;AACpD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,GAAS,CAAA,GAAI,MAAM,KAAA,GAAQ,KAAA;AAChD,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAA,CAAO,SAAS,CAAC,CAAA;AAC5C,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,IAAI,MAAA,EAAQ,CAAA,EAAA,MAAS,CAAC,CAAA,GAAI,QAAA,CAAS,MAAA,CAAO,MAAM,CAAA,GAAI,CAAA,EAAG,IAAI,CAAA,GAAI,CAAC,GAAG,EAAE,CAAA;AACzF,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,gBAAgB,KAAA,EAA2B;AACzD,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,EAAE,CAAA;AAC7B,EAAA,IAAI,CAAA,GAAI,KAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,EAAA,EAAI,CAAA,IAAK,CAAA,EAAG,CAAA,EAAA,EAAK;AAC5B,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,CAAA,GAAI,KAAK,CAAA;AACzB,IAAA,CAAA,KAAM,EAAA;AAAA,EACR;AACA,EAAA,OAAO,GAAA;AACT;AC7BO,SAAS,iBAAiB,GAAA,EAAgC;AAC/D,EAAA,MAAM,CAAC,IAAA,EAAM,KAAK,CAAA,GAAI,WAAA,CAAY,IAAI,CAAC,CAAA;AACvC,EAAA,MAAM,CAAC,IAAA,EAAM,KAAK,CAAA,GAAI,WAAA,CAAY,IAAI,CAAC,CAAA;AACvC,EAAA,OAAO,CAAC,MAAM,KAAA,EAAO,IAAA,EAAM,OAAO,GAAA,CAAI,OAAA,GAAU,KAAK,EAAE,CAAA;AACzD;AAOO,SAAS,cAAA,CACd,CAAA,EACA,CAAA,EACA,MAAA,EACA,MAAA,EACS;AACT,EAAA,KAAA,MAAW,GAAA,IAAO,CAAC,CAAA,EAAG,CAAC,CAAA,EAAY;AACjC,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,IAAIA,SAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAE,eAAe,GAAG,CAAA;AAC7D,MAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,gBAAA,CAAiB,MAAM,EAAE,QAAA,EAAS;AAC1D,MAAA,IAAI,MAAM,CAAA,KAAM,MAAA,CAAO,KAAK,KAAA,CAAM,CAAA,KAAM,OAAO,CAAA,EAAG;AAChD,QAAA,OAAO,GAAA,KAAQ,CAAA;AAAA,MACjB;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,MAAM,IAAI,MAAM,8DAA8D,CAAA;AAChF;;;ACpCA,IAAM,QAAA,GAAW,WAAA;AACjB,IAAM,SAAA,GAAY,aAAA;AAuBX,IAAM,eAAA,GAAN,MAAM,gBAAA,CAAwC;AAAA,EAC3C,WAAA,CACW,UAAA,EACA,SAAA,EACR,KAAA,EACT;AAHiB,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACR,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EACR;AAAA;AAAA,EAGH,aAAa,OAAO,IAAA,EAAwD;AAC1E,IAAA,mBAAA,EAAoB;AACpB,IAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,MAAA,CAAO,WAAA;AAAA,MAC/B,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,OAAA,EAAQ;AAAA,MACrC,KAAA;AAAA;AAAA,MACA,CAAC,QAAQ,QAAQ;AAAA,KACnB;AACA,IAAA,MAAM,SAAA,GAAY,MAAM,eAAA,CAAgB,IAAA,CAAK,SAAS,CAAA;AACtD,IAAA,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA,EAAO,EAAE,UAAA,EAAY,IAAA,CAAK,UAAA,EAAY,CAAA,EAAG,SAAA,CAAU,CAAA,EAAG,CAAA,EAAG,SAAA,CAAU,GAAG,CAAA;AACxF,IAAA,OAAO,IAAI,gBAAA,CAAgB,IAAA,CAAK,UAAA,EAAY,SAAA,EAAW,KAAK,KAAK,CAAA;AAAA,EACnE;AAAA;AAAA,EAGA,aAAa,KAAK,IAAA,EAA+D;AAC/E,IAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA;AACnC,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,OAAO,IAAI,gBAAA,CAAgB,GAAA,CAAI,UAAA,EAAY,EAAE,CAAA,EAAG,GAAA,CAAI,CAAA,EAAG,CAAA,EAAG,GAAA,CAAI,CAAA,EAAE,EAAG,KAAK,KAAK,CAAA;AAAA,EAC/E;AAAA;AAAA,EAGA,aAAa,aAAa,IAAA,EAAwD;AAChF,IAAA,OAAQ,MAAM,iBAAgB,IAAA,CAAK,IAAI,KAAO,MAAM,gBAAA,CAAgB,OAAO,IAAI,CAAA;AAAA,EACjF;AAAA,EAEA,MAAM,YAAA,GAAyC;AAC7C,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA,EAEA,MAAM,KAAK,MAAA,EAA8C;AAEvD,IAAA,MAAM,MAAM,IAAI,UAAA;AAAA,MACd,MAAM,OAAO,MAAA,CAAO,IAAA;AAAA,QAClB,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,QACjC,IAAA,CAAK,UAAA;AAAA,QACL;AAAA;AACF,KACF;AAEA,IAAA,MAAM,IAAI,aAAA,CAAc,GAAA,CAAI,QAAA,CAAS,CAAA,EAAG,EAAE,CAAC,CAAA;AAC3C,IAAA,MAAM,IAAI,aAAA,CAAc,GAAA,CAAI,QAAA,CAAS,EAAA,EAAI,EAAE,CAAC,CAAA;AAC5C,IAAA,MAAM,MAAA,GAASC,cAAO,MAAM,CAAA;AAC5B,IAAA,MAAM,UAAU,cAAA,CAAe,CAAA,EAAG,CAAA,EAAG,MAAA,EAAQ,KAAK,SAAS,CAAA;AAC3D,IAAA,OAAO,EAAE,CAAA,EAAG,CAAA,EAAG,OAAA,EAAQ;AAAA,EACzB;AACF;AAEA,eAAe,gBAAgB,SAAA,EAAgD;AAC7E,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAM,OAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,SAAS,CAAC,CAAA;AAC1E,EAAA,OAAO,EAAE,CAAA,EAAG,aAAA,CAAc,GAAA,CAAI,QAAA,CAAS,GAAG,EAAE,CAAC,CAAA,EAAG,CAAA,EAAG,cAAc,GAAA,CAAI,QAAA,CAAS,EAAA,EAAI,EAAE,CAAC,CAAA,EAAE;AACzF;AASA,SAAS,mBAAA,GAA4B;AACnC,EAAA,MAAM,EAAA,GACJ,OAAO,MAAA,KAAW,WAAA,IAClB,OAAO,MAAA,CAAO,MAAA,KAAW,WAAA,KACxB,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,eAAA,CAAA;AAC3C,EAAA,IAAI,CAAC,EAAA,EAAI;AACP,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF;AACF;AAIA,SAAS,MAAA,GAA+B;AACtC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,GAAA,GAAM,SAAA,CAAU,IAAA,CAAK,QAAA,EAAU,CAAC,CAAA;AACtC,IAAA,GAAA,CAAI,eAAA,GAAkB,MAAM,GAAA,CAAI,MAAA,CAAO,kBAAkB,SAAS,CAAA;AAClE,IAAA,GAAA,CAAI,SAAA,GAAY,MAAM,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA;AACxC,IAAA,GAAA,CAAI,OAAA,GAAU,MAAM,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA;AAAA,EACtC,CAAC,CAAA;AACH;AAEA,eAAe,MAAA,CAAO,OAAe,KAAA,EAAiC;AACpE,EAAA,MAAM,EAAA,GAAK,MAAM,MAAA,EAAO;AACxB,EAAA,MAAM,EAAA,CAAG,IAAI,WAAA,EAAa,CAAC,UAAU,KAAA,CAAM,GAAA,CAAI,KAAA,EAAO,KAAK,CAAC,CAAA;AAC5D,EAAA,EAAA,CAAG,KAAA,EAAM;AACX;AAEA,eAAe,OAAO,KAAA,EAA0C;AAC9D,EAAA,MAAM,EAAA,GAAK,MAAM,MAAA,EAAO;AACxB,EAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,EAAA,EAAI,UAAA,EAAY,CAAC,KAAA,KAAU,KAAA,CAAM,GAAA,CAAI,KAAK,CAAC,CAAA;AACnE,EAAA,EAAA,CAAG,KAAA,EAAM;AACT,EAAA,OAAQ,MAAA,IAAwB,IAAA;AAClC;AAEA,SAAS,EAAA,CACP,EAAA,EACA,IAAA,EACA,GAAA,EACY;AACZ,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,QAAQ,EAAA,CAAG,WAAA,CAAY,WAAW,IAAI,CAAA,CAAE,YAAY,SAAS,CAAA;AACnE,IAAA,MAAM,GAAA,GAAM,IAAI,KAAK,CAAA;AACrB,IAAA,GAAA,CAAI,SAAA,GAAY,MAAM,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA;AACxC,IAAA,GAAA,CAAI,OAAA,GAAU,MAAM,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA;AAAA,EACtC,CAAC,CAAA;AACH;;;AC7IO,IAAM,iBAAA,GAAoB;AAAA,EAC/B,OAAA,EAAS;AAAA,IACP,OAAA,EAAS,wBAAA;AAAA;AAAA,IACT,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,OAAA,EAAS;AAAA,IACP,OAAA,EAAS,kBAAA;AAAA;AAAA,IACT,MAAA,EAAQ;AAAA;AAEZ;AAKO,IAAM,WAAA,GACX;AAGK,IAAM,mBAAA,GAAuD;AAAA,EAClE,OAAA,EAAS,qCAAA;AAAA,EACT,OAAA,EAAS;AACX,CAAA;AAOO,IAAM,yBAAA,GAA6D;AAAA,EACxE,OAAA,EAAS,mEAAA;AAAA,EACT,OAAA,EAAS;AACX;;;ACjBO,IAAM,kBAAN,MAA8C;AAAA,EAGnD,YAA6B,IAAA,EAA8B;AAA9B,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAF7B,IAAA,IAAA,CAAS,KAAA,GAAQ,UAAA;AAAA,EAE2C;AAAA,EAE5D,cAAA,CAAe,EAAE,WAAA,EAAa,aAAA,EAAe,MAAK,EAAiC;AACjF,IAAA,OAAOC,aAAA,CAAK,gCAAA;AAAA,MACVC,YAAA,CAAI,KAAA,CAAM,IAAA,IAAQ,WAAW,CAAA;AAAA,MAC7B,KAAK,IAAA,CAAK,SAAA;AAAA,MACV,IAAA,CAAK,mBAAA,CAAoB,WAAA,EAAa,aAAa,CAAA;AAAA,MACnD;AAAA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,YAAY,MAAA,EAA2C;AACrD,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,WAAA;AACnC,IAAA,MAAM,WAAW,IAAA,CAAK,mBAAA,CAAoB,MAAA,CAAO,WAAA,EAAa,OAAO,aAAa,CAAA;AAClF,IAAA,OAAO;AAAA,MACL;AAAA,QACE,eAAA,EAAiB,WAAA;AAAA,QACjB,UAAA,EAAY,gBAAA;AAAA,QACZ,QAAA,EAAU;AAAA,UACR,KAAK,IAAA,CAAK,SAAA;AAAA,UACVA,YAAA,CAAI,MAAM,IAAI,CAAA;AAAA,UACd,KAAA;AAAA;AAAA,UACAA,YAAA,CAAI,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA;AAAA,UACzB,GAAG;AAAA;AACL;AACF,KACF;AAAA,EACF;AAAA;AAAA,EAGA,mBAAA,CAAoB,aAAqB,aAAA,EAA0C;AACjF,IAAA,OAAO,CAACA,aAAI,KAAA,CAAM,WAAW,GAAG,GAAG,cAAA,CAAe,aAAa,CAAC,CAAA;AAAA,EAClE;AAAA,EAEA,cAAA,CAAe,gBAAwB,MAAA,EAAoC;AACzE,IAAA,OAAO,EAAE,iBAAiB,cAAA,EAAgB,UAAA,EAAY,cAAc,QAAA,EAAU,cAAA,CAAe,MAAM,CAAA,EAAE;AAAA,EACvG;AAAA,EAEA,iBAAA,CAAkB,gBAAwB,MAAA,EAAoC;AAC5E,IAAA,OAAO,EAAE,iBAAiB,cAAA,EAAgB,UAAA,EAAY,iBAAiB,QAAA,EAAU,cAAA,CAAe,MAAM,CAAA,EAAE;AAAA,EAC1G;AAAA,EAEA,MAAM,kBAAA,CAAmB,cAAA,EAAwB,MAAA,EAA2C;AAC1F,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,UAAU,MAAM,IAAI,MAAM,2CAA2C,CAAA;AACpF,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,IAAA,CAAK,SAAS,YAAA,CAAa;AAAA,MAChD,eAAA,EAAiB,cAAA;AAAA,MACjB,UAAA,EAAY,sBAAA;AAAA,MACZ,QAAA,EAAU,eAAe,MAAM;AAAA,KAChC,CAAA;AACD,IAAA,OAAO,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,IAAK,CAAC,CAAA,KAAM,EAAA;AAAA,EACjC;AAAA,EAEA,MAAM,eAAe,MAAA,EAAmC;AACtD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,QAAQ,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAC9E,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,IAAA,CAAK,OAAO,IAAA,CAAK,eAAA,CAAgB,MAAM,CAAC,CAAA;AAC/D,IAAA,OAAO,gBAAA,CAAiB,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAMA,YAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,EACtD;AACF;AAGA,SAAS,eAAe,EAAA,EAA+B;AACrD,EAAA,MAAM,CAAC,EAAA,EAAI,EAAE,CAAA,GAAI,WAAA,CAAY,GAAG,CAAC,CAAA;AACjC,EAAA,MAAM,CAAC,EAAA,EAAI,EAAE,CAAA,GAAI,WAAA,CAAY,GAAG,CAAC,CAAA;AACjC,EAAA,OAAO,CAACA,YAAA,CAAI,KAAA,CAAM,EAAE,CAAA,EAAGA,aAAI,KAAA,CAAM,EAAE,CAAA,EAAGA,YAAA,CAAI,MAAM,EAAE,CAAA,EAAGA,YAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA;AACpE;ACrEO,IAAM,oBAAA,GAAN,cAAmCC,eAAA,CAAO;AAAA,EAC/C,YAA6B,MAAA,EAAsB;AAEjD,IAAA,KAAA,CAAM,KAAK,CAAA;AAFgB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAG7B;AAAA;AAAA,EAGA,MAAe,SAAA,GAA6B;AAC1C,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAyB,QAAQ,OAAA,EAA8C;AAC7E,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,MAAA,CAAO,KAAK,eAAA,CAAgB,MAAA,CAAO,OAAO,CAAC,CAAC,CAAA;AACnE,IAAA,OAAO,gBAAA,CAAiB,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAMD,YAAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,EACtD;AACF;;;ACQO,IAAM,yBAAN,MAAuD;AAAA,EAAvD,WAAA,GAAA;AACL,IAAA,IAAA,CAAQ,OAAA,uBAAc,GAAA,EAA8B;AAAA,EAAA;AAAA,EAEpD,MAAM,OAAO,MAAA,EAAkD;AAC7D,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,IAAK,IAAA;AAAA,EACrC;AAAA,EACA,MAAM,SAAS,MAAA,EAA6E;AAC1F,IAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,MAAA,EAAQ,EAAE,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,OAAA,EAAS,CAAC,MAAA,CAAO,aAAa,GAAG,CAAA;AAAA,EAC9F;AAAA,EACA,MAAM,UAAU,MAAA,EAAsE;AACpF,IAAA,MAAM,CAAA,GAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,OAAO,MAAM,CAAA;AACxC,IAAA,IAAI,CAAA,EAAG,CAAA,CAAE,OAAA,GAAU,CAAC,GAAI,EAAE,OAAA,IAAW,EAAC,EAAI,MAAA,CAAO,MAAM,CAAA;AAAA,EACzD;AACF;;;ACzCA,SAAS,MAAM,CAAA,EAAmB;AAChC,EAAA,OAAO,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA;AAC7B;AAGA,SAAS,QAAQ,CAAA,EAAmB;AAClC,EAAA,OAAO,OAAO,CAAC,CAAA;AACjB;AAQO,IAAM,qBAAN,MAAmD;AAAA,EACxD,YAA6B,IAAA,EAAiC;AAAjC,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAkC;AAAA,EAE/D,MAAM,OAAO,MAAA,EAAkD;AAC7D,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,cAAA,EAAgB,IAAA,CAAK,KAAK,OAAO,CAAA;AACrD,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,IAAA,CAAK,KAAK,KAAK,CAAA;AAC9C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,gBAAA,EAAkB,MAAM,CAAA;AAC7C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,SAAA,EAAW,IAAA,CAAK,KAAK,OAAO,CAAA;AAEjD,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,SAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB,EAAG,CAAA;AAChF,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AACpE,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,IAAS,CAAC,IAAA,CAAK,SAAS,OAAO,IAAA;AAEzC,IAAA,MAAM,OAAA,GAAyC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,OAAO,IACrE,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,MAAyC;AAAA,MACzD,CAAA,EAAG,OAAA,CAAQ,CAAA,CAAE,KAAK,CAAA;AAAA,MAClB,CAAA,EAAG,OAAA,CAAQ,CAAA,CAAE,KAAK;AAAA,MAClB,CAAA,GACF,MAAA;AAEJ,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,OAAA,EAAQ;AAAA,EAC1C;AAAA,EAEA,MAAM,SAAS,MAAA,EAIG;AAChB,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,IAAI,IAAI,cAAA,EAAgB,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,EAAG;AAAA,MAClE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,MAAA,EAAQ,KAAK,IAAA,CAAK,KAAA;AAAA,QAClB,gBAAgB,MAAA,CAAO,MAAA;AAAA,QACvB,OAAA,EAAS,KAAK,IAAA,CAAK,OAAA;AAAA,QACnB,SAAS,MAAA,CAAO,OAAA;AAAA;AAAA,QAEhB,OAAA,EAAS,CAAC,EAAE,CAAA,EAAG,MAAM,MAAA,CAAO,aAAA,CAAc,CAAC,CAAA,EAAG,GAAG,KAAA,CAAM,MAAA,CAAO,aAAA,CAAc,CAAC,GAAG;AAAA,OACjF;AAAA,KACF,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AACzC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,IAAI,MAAM,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IAChE;AAAA,EACF;AAAA,EAEA,MAAM,UAAW,MAAA,EAIC;AAGX,EACP;AACF;;;AC1EA,SAASE,OAAM,CAAA,EAAmB;AAChC,EAAA,OAAO,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA;AAC7B;AACA,SAASC,SAAQ,CAAA,EAAmB;AAClC,EAAA,OAAO,OAAO,CAAC,CAAA;AACjB;AAEA,SAAS,WAAA,GAAsB;AAC7B,EAAA,IAAI,OAAO,cAAc,WAAA,EAAa;AACpC,IAAA,OAAO,UAAU,SAAA,IAAa,cAAA;AAAA,EAChC;AACA,EAAA,OAAO,cAAA;AACT;AAQO,IAAM,qBAAN,MAAmD;AAAA,EACxD,YAA6B,IAAA,EAAiC;AAAjC,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAkC;AAAA,EAE/D,MAAM,sBAAsB,MAAA,EAMO;AACjC,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,IAAI,IAAI,sBAAA,EAAwB,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,EAAG;AAAA,MAC1E,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,MAAA,EAAQ,KAAK,IAAA,CAAK,KAAA;AAAA,QAClB,gBAAgB,MAAA,CAAO,cAAA;AAAA,QACvB,SAAA,EAAWD,MAAAA,CAAM,MAAA,CAAO,SAAA,CAAU,CAAC,CAAA;AAAA,QACnC,SAAA,EAAWA,MAAAA,CAAM,MAAA,CAAO,SAAA,CAAU,CAAC,CAAA;AAAA,QACnC,YAAA,EAAc,MAAA,CAAO,WAAA,IAAe,WAAA,EAAY;AAAA,QAChD,GAAI,OAAO,KAAA,GAAQ,EAAE,OAAO,MAAA,CAAO,KAAA,KAAU;AAAC,OAC/C;AAAA,KACF,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AACzC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,IAAI,MAAM,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IACpE;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,OAAO,EAAE,SAAA,EAAW,IAAA,CAAK,UAAA,EAAW;AAAA,EACtC;AAAA,EAEA,MAAM,kBAAkB,SAAA,EAAyD;AAC/E,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,sBAAA,EAAwB,IAAA,CAAK,KAAK,OAAO,CAAA;AAC7D,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,IAAA,EAAM,SAAS,CAAA;AACpC,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,SAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB,EAAG,CAAA;AAChF,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AACtE,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,EAAO,OAAO,IAAA;AAExB,IAAA,MAAM,SAAS,IAAA,CAAK,MAAA;AACpB,IAAA,OAAO;AAAA,MACL,WAAW,IAAA,CAAK,UAAA;AAAA,MAChB,OAAO,IAAA,CAAK,MAAA;AAAA,MACZ,MAAA,EAAQ,EAAA;AAAA;AAAA,MACR,gBAAgB,IAAA,CAAK,cAAA;AAAA,MACrB,SAAA,EAAW,EAAE,CAAA,EAAGC,QAAAA,CAAQ,IAAA,CAAK,SAAS,CAAA,EAAG,CAAA,EAAGA,QAAAA,CAAQ,IAAA,CAAK,SAAS,CAAA,EAAE;AAAA,MACpE,WAAW,IAAA,CAAK,UAAA;AAAA,MAChB;AAAA,KACF;AAAA,EACF;AAAA,EAEA,MAAM,sBAAsB,MAAA,EAGV;AAChB,IAAA,MAAM,MAAM,MAAM,KAAA;AAAA,MAChB,IAAI,IAAI,CAAA,qBAAA,EAAwB,MAAA,CAAO,SAAS,CAAA,QAAA,CAAA,EAAY,IAAA,CAAK,KAAK,OAAO,CAAA;AAAA,MAC7E;AAAA,QACE,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,QAC9C,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,OAAA,EAAS,MAAA,CAAO,QAAQ;AAAA;AACjD,KACF;AACA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AACzC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,IAAI,MAAM,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IACpE;AAAA,EACF;AACF;ACrEA,IAAM,eAAA,GAAkB,mBAAA;AAGxB,IAAM,wBAAA,GAA2B,IAAA;AAEjC,IAAM,gBAAA,GAAmB,qBAAA;AAGzB,IAAM,UAAA,GAAa,EAAA;AAQZ,SAAS,oBAAA,GAA+B;AAC7C,EAAA,MAAM,KAAA,GAAQC,kBAAY,UAAU,CAAA;AACpC,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,CAAC,CAAC,CAAA;AAC7C,EAAA,OAAO,KAAA,CAAM,KAAK,GAAG,CAAA;AACvB;AAYO,SAAS,gBAAgB,IAAA,EAG9B;AACA,EAAA,MAAM,UAAA,GAAa,KAAK,IAAA,EAAK,CAAE,QAAQ,MAAA,EAAQ,GAAG,EAAE,WAAA,EAAY;AAChE,EAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAI9D,EAAA,MAAM,SAAA,GAAYC,aAAA;AAAA,IAChBP,aAAAA;AAAA,IACA,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,UAAU,CAAA;AAAA,IACnC,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,eAAe,CAAA;AAAA,IACxC,EAAE,CAAA,EAAG,wBAAA,EAA0B,KAAA,EAAO,EAAA;AAAG,GAC3C;AACA,EAAA,MAAM,OAAOQ,SAAA,CAAKR,aAAAA,EAAQ,SAAA,EAAW,MAAA,EAAW,kBAAkB,EAAE,CAAA;AAKpE,EAAA,MAAM,CAAA,GAAI,aAAA,CAAc,IAAI,CAAA,GAAID,UAAK,KAAA,CAAM,CAAA;AAC3C,EAAA,IAAI,CAAA,KAAM,EAAA,EAAI,MAAM,IAAI,MAAM,yDAAyD,CAAA;AAEvF,EAAA,MAAM,IAAA,GAAO,gBAAgB,CAAC,CAAA;AAI9B,EAAA,MAAM,GAAA,GAAMA,SAAAA,CAAK,YAAA,CAAa,IAAA,EAAM,KAAK,CAAA;AACzC,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,IAAA;AAAA,IACZ,WAAW,EAAE,CAAA,EAAG,aAAA,CAAc,GAAA,CAAI,SAAS,CAAA,EAAG,EAAE,CAAC,CAAA,EAAG,GAAG,aAAA,CAAc,GAAA,CAAI,SAAS,EAAA,EAAI,EAAE,CAAC,CAAA;AAAE,GAC7F;AACF;AASO,IAAM,YAAA,GAAN,MAAM,aAAA,CAAqC;AAAA,EAIhD,WAAA,CAAY,YAAwB,SAAA,EAA4B;AAC9D,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,IAAA,IAAA,CAAK,cAAA,GAAiB,SAAA;AAAA,EACxB;AAAA;AAAA,EAGA,OAAO,SAAS,IAAA,EAA4B;AAC1C,IAAA,MAAM,EAAE,UAAA,EAAY,SAAA,EAAU,GAAI,gBAAgB,IAAI,CAAA;AACtD,IAAA,OAAO,IAAI,aAAA,CAAa,UAAA,EAAY,SAAS,CAAA;AAAA,EAC/C;AAAA,EAEA,MAAM,YAAA,GAAyC;AAC7C,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACd;AAAA,EAEA,MAAM,KAAK,MAAA,EAA8C;AAKvD,IAAA,MAAM,MAAA,GAASC,cAAO,MAAM,CAAA;AAC5B,IAAA,MAAM,GAAA,GAAMD,SAAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,KAAK,UAAU,CAAA;AAC7C,IAAA,MAAM,OAAA,GAAU,eAAe,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,EAAG,MAAA,EAAQ,KAAK,cAAc,CAAA;AACxE,IAAA,OAAO,EAAE,CAAA,EAAG,GAAA,CAAI,GAAG,CAAA,EAAG,GAAA,CAAI,GAAG,OAAA,EAAQ;AAAA,EACvC;AACF;AAOA,IAAM,QAAA,GAAW;AAAA,EACf,MAAA;AAAA,EAAQ,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAC5D,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,MAAA;AAAA,EAAQ,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAC/D,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,OAAA;AAAA,EAChE,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EACjE,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAChE,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,MAAA;AAAA,EAAQ,SAAA;AAAA,EAAW,OAAA;AAAA,EACjE,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,MAAA;AAAA,EAAQ,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,OAAA;AAAA,EAC9D,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,MAAA;AAAA,EAAQ,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,OAAA;AAAA,EAC7D,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,MAAA;AAAA,EAAQ,SAAA;AAAA,EAAW,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAChE,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,MAAA;AAAA,EACnE,SAAA;AAAA,EAAW,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAClE,SAAA;AAAA,EAAW,OAAA;AAAA,EAAS,SAAA;AAAA,EAAW,OAAA;AAAA,EAAS,MAAA;AAAA,EAAQ,QAAA;AAAA,EAAU,SAAA;AAAA,EAAW,MAAA;AAAA,EACrE,QAAA;AAAA,EAAU,SAAA;AAAA,EAAW,QAAA;AAAA,EAAU,UAAA;AAAA,EAAY,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,MAAA;AAAA,EAAQ,OAAA;AAAA,EACtE,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EACjE,QAAA;AAAA,EAAU,SAAA;AAAA,EAAW,SAAA;AAAA,EAAW,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,QAAA;AAAA,EACrE,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,OAAA;AAAA,EAC5D,QAAA;AAAA,EAAU,SAAA;AAAA,EAAW,QAAA;AAAA,EAAU,SAAA;AAAA,EAAW,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,QAAA;AAAA,EACtE,OAAA;AAAA,EAAS,SAAA;AAAA,EAAW,UAAA;AAAA,EAAY,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,UAAA;AAAA,EAAY,SAAA;AAAA,EAAW,OAAA;AAAA,EAC1E,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,MAAA;AAAA,EAAQ,OAAA;AAAA,EAClE,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,MAAA;AAAA,EAAQ,SAAA;AAAA,EAAW,MAAA;AAAA,EAClE,MAAA;AAAA,EAAQ,QAAA;AAAA,EAAU,UAAA;AAAA,EAAY,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,QAAA;AAAA,EACrE,QAAA;AAAA,EAAU,SAAA;AAAA,EAAW,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,UAAA;AAAA,EAAY,OAAA;AAAA,EAAS,OAAA;AAAA,EACtE,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,MAAA;AAAA,EAAQ,SAAA;AAAA,EAAW,UAAA;AAAA,EAAY,QAAA;AAAA,EAAU,SAAA;AAAA,EAAW,QAAA;AAAA,EACxE,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAClE,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,MAAA;AAAA,EACrE,UAAA;AAAA,EAAY,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,MAAA;AAAA,EAAQ,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,OAAA;AAAA,EACrE,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,SAAA;AAAA,EAAW,QAAA;AAAA,EAAU,SAAA;AAAA,EACnE,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,QAAA;AAAA,EACnE,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAC/D,OAAA;AAAA,EAAS,SAAA;AAAA,EAAW,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EAChE,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,QAAA;AAAA,EAClE,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,KAAA;AAAA,EAAO,OAAA;AAAA,EAAS;AAChE,CAAA;AC3JO,SAAS,iBAAA,CAAkB,EAAE,MAAA,EAAQ,OAAA,EAAQ,EAA0B;AAE5E,EAAA,MAAM,CAAA,GAAIE,aAAAA,CAAK,6BAAA,CAA8B,CAAC,cAAA,CAAe,MAAM,CAAA,EAAG,cAAA,CAAe,OAAO,CAAC,CAAC,CAAA;AAC9F,EAAA,OAAO,OAAO,CAAC,CAAA;AACjB;AAGA,SAAS,eAAe,CAAA,EAAmB;AACzC,EAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,CAAC,CAAA;AACxC,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,EAAQ,KAAK,EAAA,EAAI;AACzC,IAAA,IAAI,CAAA,GAAI,EAAA;AACR,IAAA,KAAA,MAAW,CAAA,IAAK,KAAA,CAAM,QAAA,CAAS,CAAA,EAAG,CAAA,GAAI,EAAE,CAAA,EAAG,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,CAAC,CAAA;AACnE,IAAA,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EACf;AACA,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAChC,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,OAAO,CAAC,CAAA;AACxC,EAAA,OAAO,MAAA,CAAOA,aAAAA,CAAK,6BAAA,CAA8B,MAAM,CAAC,CAAA;AAC1D;;;ACsDO,IAAM,KAAA,GAAN,MAAM,MAAA,CAAM;AAAA,EAIT,YACG,QAAA,EACA,OAAA,EACA,MAAA,EACA,OAAA,EACQ,SACA,YAAA,EACjB;AANS,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACQ,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA;AARnB;AAAA,IAAA,IAAA,CAAA,gBAAA,GAAkC,IAAA;AAAA,EAS/B;AAAA,EAEH,aAAa,QAAQ,IAAA,EAAsC;AACzD,IAAA,MAAM,WAAW,IAAA,CAAK,QAAA,IAAa,MAAM,IAAA,CAAK,MAAM,YAAA,EAAa;AACjE,IAAA,IAAI,CAAC,QAAA,EAAU,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAE3E,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,IAAa,yBAAA,CAA0B,KAAK,OAAO,CAAA;AAC1E,IAAA,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,CAAA,qCAAA,EAAwC,IAAA,CAAK,OAAO,CAAA,CAAE,CAAA;AAEtF,IAAA,MAAM,QAAA,GAAW,IAAIQ,oBAAA,CAAY;AAAA,MAC/B,SAAS,IAAA,CAAK,MAAA,IAAU,iBAAA,CAAkB,IAAA,CAAK,OAAO,CAAA,CAAE;AAAA,KACzD,CAAA;AACD,IAAA,MAAM,SAAA,GAAY,IAAIC,qBAAA,CAAa;AAAA,MACjC,OAAA,EAAS,IAAA,CAAK,YAAA,IAAgB,mBAAA,CAAoB,KAAK,OAAO,CAAA;AAAA,MAC9D,OAAA,EAAS,EAAE,qBAAA,EAAuB,IAAA,CAAK,eAAA;AAAgB,KACxD,CAAA;AAED,IAAA,MAAM,WAAA,GAAc,kBAAkB,EAAE,MAAA,EAAQ,SAAS,MAAA,EAAQ,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,CAAA;AAGxF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,YAAA,GAChB,MAAM,IAAA,CAAK,YAAA,CAAa,CAAA,EAAG,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,OAAO,CAAA,CAAE,IAC5D,MAAM,eAAA,CAAgB,YAAA,CAAa,EAAE,KAAA,EAAO,CAAA,EAAG,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,OAAO,CAAA,CAAA,EAAI,CAAA;AACtF,IAAA,MAAM,YAAA,GAAe,MAAM,MAAA,CAAO,YAAA,EAAa;AAE/C,IAAA,MAAM,UAAU,IAAI,eAAA,CAAgB,EAAE,SAAA,EAAW,MAAA,EAAQ,UAAU,CAAA;AACnE,IAAA,MAAM,WAAA,GAAc,CAACC,QAAAA,KACnB,IAAIC,gBAAA,CAAQ;AAAA,MACV,QAAA;AAAA,MACA,OAAA,EAAAD,QAAAA;AAAA,MACA,MAAA,EAAQ,IAAI,oBAAA,CAAqB,MAAM,CAAA;AAAA,MACvC,SAAA;AAAA,MACA,YAAA,EAAc;AAAA,KACf,CAAA;AAKH,IAAA,MAAM,UAAA,GAAa,KAAK,UAAA,IAAc,mBAAA;AACtC,IAAA,MAAM,WACJ,IAAA,CAAK,QAAA,KACJ,IAAA,CAAK,KAAA,GACF,IAAI,kBAAA,CAAmB,EAAE,OAAA,EAAS,UAAA,EAAY,OAAO,IAAA,CAAK,KAAA,EAAO,SAAS,IAAA,CAAK,OAAA,EAAS,CAAA,GACxF,eAAA,CAAA;AACN,IAAA,MAAM,QAAA,GACJ,IAAA,CAAK,QAAA,KAAa,IAAA,CAAK,QAAQ,IAAI,kBAAA,CAAmB,EAAE,OAAA,EAAS,UAAA,EAAY,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,CAAA,GAAI,IAAA,CAAA;AACtG,IAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,MAAA,CAAO,SAAS,MAAM,CAAA;AAEtD,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,MAAME,QAAAA,GAAU,WAAA,CAAY,QAAA,CAAS,OAAO,CAAA;AAC5C,MAAA,MAAMC,YAAW,MAAM,OAAA,CAAQ,kBAAA,CAAmB,QAAA,CAAS,SAAS,YAAY,CAAA;AAChF,MAAA,MAAM,QAAQ,IAAI,MAAA;AAAA,QAChB,QAAA;AAAA,QACA,QAAA,CAAS,OAAA;AAAA,QACTA,YAAW,OAAA,GAAU,uBAAA;AAAA,QACrBD,QAAAA;AAAA,QACA,OAAA;AAAA,QACA;AAAA,OACF;AAWA,MAAA,IAAI,CAACC,aAAY,QAAA,EAAU;AACzB,QAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,GAAA,CAAI,QAAA,CAAS,MAAM,CAAA;AACnD,QAAA,MAAM,QAAQ,KAAA,IAAS,IAAA,CAAK,GAAA,EAAI,GAAI,MAAM,WAAA,GAAc,uBAAA;AACxD,QAAA,IAAI;AACF,UAAA,IAAI,KAAA,EAAO;AACT,YAAA,KAAA,CAAM,mBAAmB,KAAA,CAAO,SAAA;AAAA,UAClC,CAAA,MAAO;AACL,YAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,SAAS,qBAAA,CAAsB;AAAA,cACzD,QAAQ,QAAA,CAAS,MAAA;AAAA,cACjB,gBAAgB,QAAA,CAAS,OAAA;AAAA,cACzB,SAAA,EAAW,YAAA;AAAA,cACX,GAAI,SAAS,KAAA,GAAQ,EAAE,OAAO,QAAA,CAAS,KAAA,KAAU;AAAC,aACnD,CAAA;AACD,YAAA,KAAA,CAAM,gBAAA,GAAmB,SAAA;AACzB,YAAA,iBAAA,CAAkB,GAAA,CAAI,SAAS,MAAA,EAAQ,EAAE,WAAW,WAAA,EAAa,IAAA,CAAK,GAAA,EAAI,EAAG,CAAA;AAAA,UAC/E;AAAA,QACF,SAAS,CAAA,EAAG;AACV,UAAA,OAAA,CAAQ,IAAA,CAAK,yCAAyC,CAAC,CAAA;AAAA,QACzD;AAAA,MACF;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAOA,IAAA,MAAM,UAAU,OAAA,CAAQ,cAAA,CAAe,EAAE,WAAA,EAAa,aAAA,EAAe,cAAc,CAAA;AACnF,IAAA,MAAM,OAAA,GAAU,YAAY,OAAO,CAAA;AACnC,IAAA,MAAM,eAAA,GAAkB,MAAM,UAAA,CAAW,QAAA,EAAU,OAAO,CAAA;AAE1D,IAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,MAAA,MAAM,cAAA,GAAiB;AAAA,QACrB,OAAA;AAAA,QACA,UAAA,EAAY,SAAA;AAAA,QACZ,IAAA,EAAMZ,YAAAA,CAAI,KAAA,CAAM,WAAW,CAAA;AAAA,QAC3B,QAAA,EAAU,OAAA,CAAQ,mBAAA,CAAoB,WAAA,EAAa,YAAY,CAAA;AAAA,QAC/D,OAAA,EAAS;AAAA,OACX;AACA,MAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,2BAAA,CAA4B,EAAC,EAAG;AAAA,QAC9D,OAAA,EAAS,EAAE,IAAA,EAAM,WAAA,EAAY;AAAA,QAC7B;AAAA,OACD,CAAA;AAID,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,CAAS,kBAAA,CAAmB,SAAA,CAAU,gBAAgB,CAAA;AAAA,MAC9D,SAAS,CAAA,EAAG;AACV,QAAA,OAAA,CAAQ,IAAA,CAAK,uCAAuC,CAAC,CAAA;AAAA,MACvD;AAAA,IACF;AAOA,IAAA,MAAM,QAAA,CAAS,SAAS,EAAE,MAAA,EAAQ,SAAS,MAAA,EAAQ,OAAA,EAAS,aAAA,EAAe,YAAA,EAAc,CAAA;AACzF,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,OAAA,CAAQ,kBAAA,CAAmB,OAAA,EAAS,YAAY,CAAA;AAAA,IACnE,SAAS,CAAA,EAAG;AAGV,MAAA,OAAA,CAAQ,IAAA,CAAK,2CAA2C,CAAC,CAAA;AACzD,MAAA,QAAA,GAAW,CAAC,eAAA;AAAA,IACd;AAEA,IAAA,OAAO,IAAI,MAAA;AAAA,MACT,QAAA;AAAA,MACA,OAAA;AAAA,MACA,WAAW,OAAA,GAAU,uBAAA;AAAA,MACrB,OAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,SAAA,GAA6B;AAC/B,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACd;AAAA;AAAA,EAGA,MAAM,QAAQ,KAAA,EAA0D;AACtE,IAAA,IAAI,IAAA,CAAK,WAAW,OAAA,EAAS;AAC3B,MAAA,MAAM,IAAI,MAAM,gEAAgE,CAAA;AAAA,IAClF;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAQ,4BAA4B,KAAA,EAAiB;AAAA,MAC1E,OAAA,EAAS,EAAE,IAAA,EAAM,WAAA;AAAY,KAC9B,CAAA;AACD,IAAA,OAAO,EAAE,eAAA,EAAiB,GAAA,CAAI,gBAAA,EAAiB;AAAA,EACjD;AAAA;AAAA,EAGA,MAAM,UAAU,MAAA,EAA+D;AAC7E,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,CAAC,IAAA,CAAK,OAAA,CAAQ,eAAe,IAAA,CAAK,OAAA,EAAS,MAAM,CAAC,CAAC,CAAA;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,cAAc,IAAA,EAAgE;AAClF,IAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAa,GAAI,gBAAgB,IAAI,CAAA;AAExD,IAAA,MAAM,UAAU,MAAM,IAAA,CAAK,QAAQ,kBAAA,CAAmB,IAAA,CAAK,SAAS,YAAY,CAAA;AAChF,IAAA,IAAI,SAAS,OAAO,MAAA;AACpB,IAAA,OAAO,IAAA,CAAK,UAAU,YAAY,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,aAAa,QAAQ,IAAA,EAAuC;AAC1D,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,IAAa,yBAAA,CAA0B,KAAK,OAAO,CAAA;AAC1E,IAAA,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,CAAA,qCAAA,EAAwC,IAAA,CAAK,OAAO,CAAA,CAAE,CAAA;AAEtF,IAAA,MAAM,QAAA,GAAW,IAAIO,oBAAA,CAAY;AAAA,MAC/B,SAAS,IAAA,CAAK,MAAA,IAAU,iBAAA,CAAkB,IAAA,CAAK,OAAO,CAAA,CAAE;AAAA,KACzD,CAAA;AACD,IAAA,MAAM,SAAA,GAAY,IAAIC,qBAAA,CAAa;AAAA,MACjC,OAAA,EAAS,IAAA,CAAK,YAAA,IAAgB,mBAAA,CAAoB,KAAK,OAAO,CAAA;AAAA,MAC9D,OAAA,EAAS,EAAE,qBAAA,EAAuB,IAAA,CAAK,eAAA;AAAgB,KACxD,CAAA;AAGD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,YAAA,GAChB,MAAM,IAAA,CAAK,YAAA,CAAa,CAAA,EAAG,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,OAAO,CAAA,CAAE,CAAA,GACjE,MAAM,eAAA,CAAgB,YAAA,CAAa,EAAE,KAAA,EAAO,CAAA,EAAG,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,OAAO,CAAA,CAAA,EAAI,CAAA;AAC3F,IAAA,MAAM,YAAA,GAAe,MAAM,MAAA,CAAO,YAAA,EAAa;AAI/C,IAAA,MAAM,MAAA,GAAS,YAAA,CAAa,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA;AAC9C,IAAA,MAAM,aAAA,GAAgB,IAAI,eAAA,CAAgB,EAAE,WAAW,MAAA,EAAQ,MAAA,EAAQ,UAAU,CAAA;AAEjF,IAAA,MAAM,UAAA,GAAa,KAAK,UAAA,IAAc,mBAAA;AACtC,IAAA,MAAM,WACJ,IAAA,CAAK,QAAA,KACJ,IAAA,CAAK,KAAA,GACF,IAAI,kBAAA,CAAmB,EAAE,OAAA,EAAS,UAAA,EAAY,OAAO,IAAA,CAAK,KAAA,EAAO,SAAS,IAAA,CAAK,OAAA,EAAS,CAAA,GACxF,eAAA,CAAA;AACN,IAAA,MAAM,WAAW,MAAM,QAAA,CAAS,MAAA,CAAO,IAAA,CAAK,SAAS,MAAM,CAAA;AAC3D,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,MAAM,mEAA8D,CAAA;AAAA,IAChF;AAGA,IAAA,MAAM,aAAA,GAAgB,IAAIE,gBAAA,CAAQ;AAAA,MAChC,QAAA;AAAA,MACA,SAAS,QAAA,CAAS,OAAA;AAAA,MAClB,MAAA,EAAQ,IAAI,oBAAA,CAAqB,MAAM,CAAA;AAAA,MACvC,SAAA;AAAA,MACA,YAAA,EAAc;AAAA,KACf,CAAA;AACD,IAAA,MAAM,gBAAgB,MAAM,aAAA,CAAc,kBAAA,CAAmB,QAAA,CAAS,SAAS,YAAY,CAAA;AAC3F,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,MAAM,GAAA,GAAM,MAAM,aAAA,CAAc,2BAAA;AAAA,QAC9B,CAAC,aAAA,CAAc,cAAA,CAAe,QAAA,CAAS,OAAA,EAAS,YAAY,CAAC,CAAA;AAAA,QAC7D,EAAE,OAAA,EAAS,EAAE,IAAA,EAAM,aAAY;AAAE,OACnC;AACA,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,CAAS,kBAAA,CAAmB,GAAA,CAAI,gBAAgB,CAAA;AAAA,MACxD,SAAS,CAAA,EAAG;AACV,QAAA,OAAA,CAAQ,IAAA,CAAK,oDAAoD,CAAC,CAAA;AAAA,MACpE;AAAA,IACF;AAGA,IAAA,MAAM,UAAU,IAAI,eAAA,CAAgB,EAAE,SAAA,EAAW,MAAA,EAAQ,UAAU,CAAA;AACnE,IAAA,MAAM,OAAA,GAAU,IAAIA,gBAAA,CAAQ;AAAA,MAC1B,QAAA;AAAA,MACA,SAAS,QAAA,CAAS,OAAA;AAAA,MAClB,MAAA,EAAQ,IAAI,oBAAA,CAAqB,MAAM,CAAA;AAAA,MACvC,SAAA;AAAA,MACA,YAAA,EAAc;AAAA,KACf,CAAA;AACD,IAAA,OAAO,IAAI,OAAM,IAAA,CAAK,QAAA,EAAU,SAAS,OAAA,EAAS,OAAA,EAAS,OAAA,EAAS,OAAA,EAAS,YAAY,CAAA;AAAA,EAC3F;AACF;AAOA,IAAM,eAAA,GAAkB,IAAI,sBAAA,EAAuB;AAQnD,IAAM,uBAAA,GAA0B,IAAI,EAAA,GAAK,GAAA;AACzC,IAAM,iBAAA,uBAAwB,GAAA,EAAwD;AAGtF,eAAe,UAAA,CAAW,UAAuB,OAAA,EAAmC;AAClF,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,MAAM,QAAA,CAAS,cAAA,CAAe,OAAO,CAAA;AACvD,IAAA,OAAO,CAAC,CAAC,SAAA,IAAa,SAAA,KAAc,KAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;ACzWO,IAAM,iBAAN,MAA6C;AAAA,EAClD,YAA6B,QAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAAqB;AAAA,EAClD,MAAM,YAAA,GAAkC;AACtC,IAAA,OAAO,IAAA,CAAK,QAAA;AAAA,EACd;AACF;ACFO,IAAM,YAAN,MAAwC;AAAA,EAM7C,WAAA,CAA6B,IAAA,GAAyB,EAAC,EAAG;AAA7B,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAH7B;AAAA,IAAA,IAAA,CAAQ,YAAA,GAA8B,IAAA;AACtC,IAAA,IAAA,CAAQ,IAAA,GAAwB,IAAA;AAG9B,IAAA,IAAA,CAAK,UAAA,GAAa,KAAK,UAAA,IAAc,mBAAA;AAAA,EACvC;AAAA;AAAA,EAGA,MAAM,kBAAkB,WAAA,EAAuC;AAC7D,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,QAAA,EAAU,WAAW,CAAA;AAAA,EAC5C;AAAA;AAAA,EAGA,MAAM,iBAAiB,WAAA,EAAuC;AAC5D,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,OAAA,EAAS,WAAW,CAAA;AAAA,EAC3C;AAAA,EAEA,MAAc,QAAA,CAAS,QAAA,EAA8B,WAAA,EAAuC;AAC1F,IAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACvF,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MACjC,KAAA,EAAO,KAAK,UAAA,EAAW;AAAA,MACvB,YAAA,EAAc,WAAA,IAAe,MAAA,CAAO,QAAA,CAAS,IAAA;AAAA,MAC7C,GAAI,IAAA,CAAK,IAAA,CAAK,KAAA,GAAQ,EAAE,QAAQ,IAAA,CAAK,IAAA,CAAK,KAAA,EAAM,GAAI;AAAC,KACtD,CAAA;AACD,IAAA,MAAM,EAAE,GAAA,EAAI,GAAI,MAAM,IAAA,CAAK,IAAI,CAAA,WAAA,EAAc,QAAQ,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE,CAAA;AACjE,IAAA,OAAO,GAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,eAAe,gBAAA,EAA6C;AAChE,IAAA,MAAM,QAAA,GAAW,gBAAgB,gBAAgB,CAAA;AACjD,IAAA,OAAO,IAAA,CAAK,oBAAA,CAAqB,QAAA,EAAU,OAAO,CAAA;AAAA,EACpD;AAAA;AAAA,EAGA,MAAM,QAAQ,KAAA,EAA8B;AAC1C,IAAA,MAAM,IAAA,CAAK,KAAK,iCAAA,EAAmC;AAAA,MACjD,KAAA;AAAA,MACA,KAAA,EAAO,KAAK,UAAA,EAAW;AAAA,MACvB,GAAI,IAAA,CAAK,IAAA,CAAK,KAAA,GAAQ,EAAE,QAAQ,IAAA,CAAK,IAAA,CAAK,KAAA,EAAM,GAAI;AAAC,KACtD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,cAAc,KAAA,EAA8B;AAChD,IAAA,MAAM,IAAA,CAAK,KAAK,gCAAA,EAAkC;AAAA,MAChD,KAAA;AAAA,MACA,KAAA,EAAO,KAAK,UAAA,EAAW;AAAA,MACvB,GAAI,IAAA,CAAK,IAAA,CAAK,KAAA,GAAQ,EAAE,QAAQ,IAAA,CAAK,IAAA,CAAK,KAAA,EAAM,GAAI,EAAC;AAAA,MACrD,GAAI,OAAO,MAAA,KAAW,WAAA,GAAc,EAAE,cAAc,MAAA,CAAO,QAAA,CAAS,IAAA,EAAK,GAAI;AAAC,KAC/E,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,SAAA,CAAU,KAAA,EAAe,IAAA,EAAiC;AAC9D,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,IAAA,CAAK,gCAAA,EAAkC;AAAA,MAC5D,KAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA,EAAO,KAAK,YAAA,EAAa;AAAA,MACzB,GAAI,IAAA,CAAK,IAAA,CAAK,KAAA,GAAQ,EAAE,QAAQ,IAAA,CAAK,IAAA,CAAK,KAAA,EAAM,GAAI;AAAC,KACtD,CAAA;AACD,IAAA,OAAO,IAAA,CAAK,oBAAA,CAAqB,GAAA,CAAI,QAAA,IAAY,GAAA,CAAI,GAAA,IAAO,GAAA,CAAI,KAAA,IAAS,IAAA,CAAK,SAAA,CAAU,GAAG,CAAA,EAAG,OAAO,KAAK,CAAA;AAAA,EAC5G;AAAA;AAAA,EAGA,MAAM,YAAA,GAAkC;AACtC,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,yDAAoD,CAAA;AACpF,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,oBAAA,CACZ,QAAA,EACA,QAAA,EACA,aAAA,EACmB;AACnB,IAAA,IAAI,KAAA,GAAQ,QAAA;AACZ,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA;AAClC,MAAA,KAAA,GAAQ,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,GAAA,IAAO,OAAO,KAAA,IAAS,QAAA;AAAA,IAC3D,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,MAAA,GAAS,SAAS,KAAK,CAAA;AAC7B,IAAA,OAAO,KAAK,QAAA,CAAS;AAAA,MACnB,QAAQ,MAAA,CAAO,MAAA,CAAO,OAAO,MAAA,CAAO,OAAA,IAAW,OAAO,GAAG,CAAA;AAAA,MACzD,KAAA,EAAO,OAAO,KAAA,IAAS,aAAA;AAAA,MACvB,QAAA,EAAU,MAAA,CAAO,QAAA,EAAU,gBAAA,IAAoB,OAAO,QAAA,IAAY;AAAA,KACnE,CAAA;AAAA,EACH;AAAA;AAAA,EAGQ,UAAA,GAAqB;AAG3B,IAAA,MAAM,QAAQ,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AACvD,IAAA,MAAM,IAAIX,aAAAA,CAAK,6BAAA,CAA8B,CAAC,aAAA,CAAc,KAAK,CAAC,CAAC,CAAA;AACnE,IAAA,IAAA,CAAK,YAAA,GAAeC,YAAAA,CAAI,KAAA,CAAM,CAAC,CAAA;AAC/B,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACd;AAAA;AAAA,EAGQ,YAAA,GAAuB;AAC7B,IAAA,IAAI,CAAC,IAAA,CAAK,YAAA,EAAc,OAAO,KAAK,UAAA,EAAW;AAC/C,IAAA,MAAM,IAAI,IAAA,CAAK,YAAA;AACf,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,OAAO,CAAA;AAAA,EACT;AAAA,EAEQ,SAAS,EAAA,EAAwB;AACvC,IAAA,IAAA,CAAK,IAAA,GAAO,EAAA;AACZ,IAAA,OAAO,EAAA;AAAA,EACT;AAAA,EAEA,MAAc,IAAI,IAAA,EAA4B;AAC5C,IAAA,MAAM,CAAA,GAAI,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,UAAU,CAAA,EAAG,IAAI,CAAA,CAAE,CAAA;AACjD,IAAA,IAAI,CAAC,CAAA,CAAE,EAAA,EAAI,MAAM,IAAI,MAAM,CAAA,UAAA,EAAa,IAAI,CAAA,IAAA,EAAO,CAAA,CAAE,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,CAAA;AAC/E,IAAA,OAAO,EAAE,IAAA,EAAK;AAAA,EAChB;AAAA,EAEA,MAAc,IAAA,CAAK,IAAA,EAAc,IAAA,EAA6B;AAC5D,IAAA,MAAM,CAAA,GAAI,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,UAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,MACjD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI;AAAA,KAC1B,CAAA;AACD,IAAA,IAAI,CAAC,CAAA,CAAE,EAAA,EAAI,MAAM,IAAI,MAAM,CAAA,UAAA,EAAa,IAAI,CAAA,IAAA,EAAO,CAAA,CAAE,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,CAAA;AAC/E,IAAA,OAAO,EAAE,IAAA,EAAK;AAAA,EAChB;AACF;AAGA,SAAS,gBAAgB,KAAA,EAAuB;AAC9C,EAAA,IAAI,MAAM,QAAA,CAAS,YAAY,KAAK,KAAA,CAAM,QAAA,CAAS,eAAe,CAAA,EAAG;AACnE,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,KAAA,CAAM,UAAA,CAAW,GAAG,CAAA,GAAI,KAAA,GAAQ,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA;AAC9E,IAAA,OAAO,OAAO,GAAA,CAAI,WAAW,KAAK,MAAA,CAAO,GAAA,CAAI,cAAc,CAAA,IAAK,KAAA;AAAA,EAClE;AACA,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,SAAS,GAAA,EAAkB;AAClC,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC7B,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,yBAAyB,CAAA;AACpD,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,CAAA;AAC5D,EAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AACxB;AAGA,SAAS,cAAc,KAAA,EAA2B;AAChD,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,MAAW,CAAA,IAAK,KAAA,CAAM,QAAA,CAAS,CAAA,EAAG,EAAE,GAAG,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,CAAC,CAAA;AAC/D,EAAA,OAAO,CAAA;AACT","file":"index.js","sourcesContent":["/**\n * Low-level encoding helpers shared across the kit.\n */\n\nconst U128_MASK = (1n << 128n) - 1n;\n\n/** Split a u256 into the `[low, high]` felt pair Cairo expects. */\nexport function u256ToFelts(value: bigint): [bigint, bigint] {\n  return [value & U128_MASK, value >> 128n];\n}\n\n/** Big-endian bytes -> bigint. */\nexport function bytesToBigInt(bytes: Uint8Array): bigint {\n  let out = 0n;\n  for (const b of bytes) out = (out << 8n) | BigInt(b);\n  return out;\n}\n\nexport function bytesToHex(bytes: Uint8Array): string {\n  let s = \"0x\";\n  for (const b of bytes) s += b.toString(16).padStart(2, \"0\");\n  return s;\n}\n\nexport function hexToBytes(hex: string): Uint8Array {\n  const clean = hex.startsWith(\"0x\") ? hex.slice(2) : hex;\n  const padded = clean.length % 2 ? \"0\" + clean : clean;\n  const out = new Uint8Array(padded.length / 2);\n  for (let i = 0; i < out.length; i++) out[i] = parseInt(padded.slice(i * 2, i * 2 + 2), 16);\n  return out;\n}\n\n/** A felt/bigint -> 32-byte big-endian Uint8Array (the tx-hash width). */\nexport function bigIntTo32Bytes(value: bigint): Uint8Array {\n  const out = new Uint8Array(32);\n  let v = value;\n  for (let i = 31; i >= 0; i--) {\n    out[i] = Number(v & 0xffn);\n    v >>= 8n;\n  }\n  return out;\n}\n","/**\n * secp256r1 signature helpers for silent device signers.\n */\nimport { p256 } from \"@noble/curves/p256\";\nimport type { DevicePublicKey, DeviceSignature } from \"../signer/DeviceSigner\";\nimport { u256ToFelts } from \"./encoding\";\n\n/**\n * Serialize a device signature to the felt array for `tx_info.signature`:\n *   [ r_low, r_high, s_low, s_high, y_parity ]\n * exactly what DeviceAccount.__validate__ decodes.\n */\nexport function signatureToFelts(sig: DeviceSignature): bigint[] {\n  const [rLow, rHigh] = u256ToFelts(sig.r);\n  const [sLow, sHigh] = u256ToFelts(sig.s);\n  return [rLow, rHigh, sLow, sHigh, sig.yParity ? 1n : 0n];\n}\n\n/**\n * Recover the parity bit of an (r, s) signature over `digest` for a known\n * pubkey. WebCrypto/Secure Enclave don't return a recovery id, so we derive it\n * by trying both candidates and matching the device's public key.\n */\nexport function recoverYParity(\n  r: bigint,\n  s: bigint,\n  digest: Uint8Array,\n  pubkey: DevicePublicKey,\n): boolean {\n  for (const bit of [0, 1] as const) {\n    try {\n      const candidate = new p256.Signature(r, s).addRecoveryBit(bit);\n      const point = candidate.recoverPublicKey(digest).toAffine();\n      if (point.x === pubkey.x && point.y === pubkey.y) {\n        return bit === 1;\n      }\n    } catch {\n      // try the other bit\n    }\n  }\n  throw new Error(\"kit/signature: could not recover parity for the given pubkey\");\n}\n","import { sha256 } from \"@noble/hashes/sha256\";\nimport type { DeviceSigner, DevicePublicKey, DeviceSignature } from \"./DeviceSigner\";\nimport { bytesToBigInt } from \"../crypto/encoding\";\nimport { recoverYParity } from \"../crypto/signature\";\n\nconst IDB_NAME = \"cavos-kit\";\nconst IDB_STORE = \"device-keys\";\n\nexport interface WebCryptoSignerOptions {\n  /**\n   * Storage key for the device's private key (e.g. the account address). One\n   * silent key per (this value, browser profile).\n   */\n  keyId: string;\n}\n\ninterface StoredKey {\n  privateKey: CryptoKey; // non-extractable; structured-cloneable\n  x: bigint;\n  y: bigint;\n}\n\n/**\n * Silent, device-bound signer for the browser. Generates a non-extractable\n * secp256r1 (P-256) key via WebCrypto and stores the `CryptoKey` in IndexedDB.\n * The private key is never exposed to JS and signing produces NO UI — there is\n * no passkey, no Face ID / Touch ID prompt. To the user it is invisible; they\n * only ever see the OAuth / email login used to derive their address.\n */\nexport class WebCryptoSigner implements DeviceSigner {\n  private constructor(\n    private readonly privateKey: CryptoKey,\n    private readonly publicKey: DevicePublicKey,\n    readonly keyId: string,\n  ) {}\n\n  /** Create a fresh device key (first run on this device) and persist it. */\n  static async create(opts: WebCryptoSignerOptions): Promise<WebCryptoSigner> {\n    assertSecureContext();\n    const pair = await crypto.subtle.generateKey(\n      { name: \"ECDSA\", namedCurve: \"P-256\" },\n      false, // private key is NON-extractable\n      [\"sign\", \"verify\"],\n    );\n    const publicKey = await exportPublicKey(pair.publicKey);\n    await idbPut(opts.keyId, { privateKey: pair.privateKey, x: publicKey.x, y: publicKey.y });\n    return new WebCryptoSigner(pair.privateKey, publicKey, opts.keyId);\n  }\n\n  /** Load an existing device key from storage, or null if none exists yet. */\n  static async load(opts: WebCryptoSignerOptions): Promise<WebCryptoSigner | null> {\n    const rec = await idbGet(opts.keyId);\n    if (!rec) return null;\n    return new WebCryptoSigner(rec.privateKey, { x: rec.x, y: rec.y }, opts.keyId);\n  }\n\n  /** Load the device key, creating one on first use. */\n  static async loadOrCreate(opts: WebCryptoSignerOptions): Promise<WebCryptoSigner> {\n    return (await WebCryptoSigner.load(opts)) ?? (await WebCryptoSigner.create(opts));\n  }\n\n  async getPublicKey(): Promise<DevicePublicKey> {\n    return this.publicKey;\n  }\n\n  async sign(txHash: Uint8Array): Promise<DeviceSignature> {\n    // WebCrypto ECDSA hashes the message with SHA-256 internally, then signs.\n    const raw = new Uint8Array(\n      await crypto.subtle.sign(\n        { name: \"ECDSA\", hash: \"SHA-256\" },\n        this.privateKey,\n        txHash as unknown as BufferSource,\n      ),\n    );\n    // IEEE P1363 form: r || s, 32 bytes each.\n    const r = bytesToBigInt(raw.subarray(0, 32));\n    const s = bytesToBigInt(raw.subarray(32, 64));\n    const digest = sha256(txHash);\n    const yParity = recoverYParity(r, s, digest, this.publicKey);\n    return { r, s, yParity };\n  }\n}\n\nasync function exportPublicKey(publicKey: CryptoKey): Promise<DevicePublicKey> {\n  const raw = new Uint8Array(await crypto.subtle.exportKey(\"raw\", publicKey)); // 0x04 || X || Y\n  return { x: bytesToBigInt(raw.subarray(1, 33)), y: bytesToBigInt(raw.subarray(33, 65)) };\n}\n\n/**\n * WebCrypto (`crypto.subtle`) is only available in secure contexts — HTTPS, or\n * `http://localhost`. Accessing the dev server over a LAN IP (e.g.\n * http://192.168.1.24:3000) is NOT secure, so `crypto.subtle` is undefined and\n * device-key generation would crash with a cryptic \"undefined is not an object\".\n * Fail early with an actionable message instead.\n */\nfunction assertSecureContext(): void {\n  const ok =\n    typeof crypto !== \"undefined\" &&\n    typeof crypto.subtle !== \"undefined\" &&\n    (typeof window === \"undefined\" || window.isSecureContext);\n  if (!ok) {\n    throw new Error(\n      \"Cavos: WebCrypto is unavailable. Device keys require a secure context — use HTTPS, or http://localhost. \" +\n        \"(For LAN/mobile dev testing, run `next dev --experimental-https`.)\",\n    );\n  }\n}\n\n// --- minimal IndexedDB wrapper ---\n\nfunction openDb(): Promise<IDBDatabase> {\n  return new Promise((resolve, reject) => {\n    const req = indexedDB.open(IDB_NAME, 1);\n    req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE);\n    req.onsuccess = () => resolve(req.result);\n    req.onerror = () => reject(req.error);\n  });\n}\n\nasync function idbPut(keyId: string, value: StoredKey): Promise<void> {\n  const db = await openDb();\n  await tx(db, \"readwrite\", (store) => store.put(value, keyId));\n  db.close();\n}\n\nasync function idbGet(keyId: string): Promise<StoredKey | null> {\n  const db = await openDb();\n  const result = await tx(db, \"readonly\", (store) => store.get(keyId));\n  db.close();\n  return (result as StoredKey) ?? null;\n}\n\nfunction tx<T>(\n  db: IDBDatabase,\n  mode: IDBTransactionMode,\n  run: (store: IDBObjectStore) => IDBRequest<T>,\n): Promise<T> {\n  return new Promise((resolve, reject) => {\n    const store = db.transaction(IDB_STORE, mode).objectStore(IDB_STORE);\n    const req = run(store);\n    req.onsuccess = () => resolve(req.result);\n    req.onerror = () => reject(req.error);\n  });\n}\n","/** Starknet network presets and well-known addresses for the kit. */\n\nexport const STARKNET_NETWORKS = {\n  sepolia: {\n    chainId: \"0x534e5f5345504f4c4941\", // SN_SEPOLIA\n    rpcUrl: \"https://api.cartridge.gg/x/starknet/sepolia\",\n  },\n  mainnet: {\n    chainId: \"0x534e5f4d41494e\", // SN_MAIN\n    rpcUrl: \"https://api.cartridge.gg/x/starknet/mainnet\",\n  },\n} as const;\n\nexport type StarknetNetwork = keyof typeof STARKNET_NETWORKS;\n\n/** Universal Deployer Contract (same address on mainnet & sepolia). */\nexport const UDC_ADDRESS =\n  \"0x041a78e741e5af2fec34b695679bc6891742439f7afb8484ecd7766661ad02bf\";\n\n/** Cavos-hosted SNIP-29 paymaster (same service @cavos/react uses). */\nexport const CAVOS_PAYMASTER_URL: Record<StarknetNetwork, string> = {\n  sepolia: \"https://sepolia-paymaster.cavos.xyz\",\n  mainnet: \"https://paymaster.cavos.xyz\",\n};\n\n/**\n * DeviceAccount class hash, per network. Populated from\n * `account-contracts/starknet/deployments/<network>.json` after declaring.\n * Left empty until the class is declared on each network.\n */\nexport const DEVICE_ACCOUNT_CLASS_HASH: Record<StarknetNetwork, string> = {\n  sepolia: \"0x6c3c3426667b6d4adda18a0b8d8cc34c495a1ace7276c4470068ad4c324876d\",\n  mainnet: \"\",\n};\n","import { hash, num } from \"starknet\";\nimport type { ChainAdapter, ChainCall, ComputeAddressParams } from \"../ChainAdapter\";\nimport type { DeviceSigner, DevicePublicKey } from \"../../signer/DeviceSigner\";\nimport { signatureToFelts } from \"../../crypto/signature\";\nimport { u256ToFelts, bigIntTo32Bytes } from \"../../crypto/encoding\";\nimport { UDC_ADDRESS } from \"./constants\";\n\nexport interface StarknetAdapterOptions {\n  classHash: string;\n  /** Read provider for `isAuthorizedSigner`. Optional for build-only usage. */\n  provider?: { callContract(call: { contractAddress: string; entrypoint: string; calldata: string[] }): Promise<string[]> };\n  /** Signer used to sign outgoing transactions. */\n  signer?: DeviceSigner;\n}\n\n/** Starknet implementation of the device-signer account adapter. */\nexport class StarknetAdapter implements ChainAdapter {\n  readonly chain = \"starknet\" as const;\n\n  constructor(private readonly opts: StarknetAdapterOptions) {}\n\n  computeAddress({ addressSeed, initialSigner, salt }: ComputeAddressParams): string {\n    return hash.calculateContractAddressFromHash(\n      num.toHex(salt ?? addressSeed),\n      this.opts.classHash,\n      this.constructorCalldata(addressSeed, initialSigner),\n      0, // deployerAddress 0 => deterministic counterfactual address\n    );\n  }\n\n  /** Single UDC deploy; the constructor registers the first device signer, so\n   * the account is ready the moment it is deployed (fits the paymaster's\n   * deploy + execute_from_outside bundle). */\n  buildDeploy(params: ComputeAddressParams): ChainCall[] {\n    const salt = params.salt ?? params.addressSeed;\n    const calldata = this.constructorCalldata(params.addressSeed, params.initialSigner);\n    return [\n      {\n        contractAddress: UDC_ADDRESS,\n        entrypoint: \"deployContract\",\n        calldata: [\n          this.opts.classHash,\n          num.toHex(salt),\n          \"0x0\", // unique = false -> deployer-independent address\n          num.toHex(calldata.length),\n          ...calldata,\n        ],\n      },\n    ];\n  }\n\n  /** Constructor calldata: [address_seed, pub_x_low, pub_x_high, pub_y_low, pub_y_high]. */\n  constructorCalldata(addressSeed: bigint, initialSigner: DevicePublicKey): string[] {\n    return [num.toHex(addressSeed), ...pubkeyCalldata(initialSigner)];\n  }\n\n  buildAddSigner(accountAddress: string, signer: DevicePublicKey): ChainCall {\n    return { contractAddress: accountAddress, entrypoint: \"add_signer\", calldata: pubkeyCalldata(signer) };\n  }\n\n  buildRemoveSigner(accountAddress: string, signer: DevicePublicKey): ChainCall {\n    return { contractAddress: accountAddress, entrypoint: \"remove_signer\", calldata: pubkeyCalldata(signer) };\n  }\n\n  async isAuthorizedSigner(accountAddress: string, signer: DevicePublicKey): Promise<boolean> {\n    if (!this.opts.provider) throw new Error(\"kit/starknet: provider required for reads\");\n    const res = await this.opts.provider.callContract({\n      contractAddress: accountAddress,\n      entrypoint: \"is_authorized_signer\",\n      calldata: pubkeyCalldata(signer),\n    });\n    return BigInt(res[0] ?? 0) !== 0n;\n  }\n\n  async buildSignature(txHash: bigint): Promise<string[]> {\n    if (!this.opts.signer) throw new Error(\"kit/starknet: signer required to sign\");\n    const sig = await this.opts.signer.sign(bigIntTo32Bytes(txHash));\n    return signatureToFelts(sig).map((f) => num.toHex(f));\n  }\n}\n\n/** Encode a P-256 pubkey as `[x_low, x_high, y_low, y_high]` (two u256s). */\nfunction pubkeyCalldata(pk: DevicePublicKey): string[] {\n  const [xl, xh] = u256ToFelts(pk.x);\n  const [yl, yh] = u256ToFelts(pk.y);\n  return [num.toHex(xl), num.toHex(xh), num.toHex(yl), num.toHex(yh)];\n}\n","import { Signer, num, type ArraySignatureType } from \"starknet\";\nimport type { DeviceSigner } from \"../../signer/DeviceSigner\";\nimport { signatureToFelts } from \"../../crypto/signature\";\nimport { bigIntTo32Bytes } from \"../../crypto/encoding\";\n\n/**\n * A starknet.js `SignerInterface` backed by a device signer. Extends the base\n * `Signer` so all transaction/declare hash computation (v3) is reused; only the\n * raw hash-signing primitive is overridden to sign silently with the device key.\n *\n * Usage:\n *   const account = new Account(provider, address, new StarknetDeviceSigner(device), \"1\");\n *   await account.execute(calls); // DeviceAccount validates the device signature\n *\n * For gasless flows, hand this signer to your paymaster SDK (e.g. AVNU) the same\n * way you would any starknet.js signer.\n */\nexport class StarknetDeviceSigner extends Signer {\n  constructor(private readonly device: DeviceSigner) {\n    // Base `pk` is unused: device accounts have no single Stark private key.\n    super(\"0x1\");\n  }\n\n  /** Device accounts are not controlled by a single Stark pubkey. */\n  override async getPubKey(): Promise<string> {\n    return \"0x0\";\n  }\n\n  /** Sign the computed tx hash silently with the device signer. */\n  protected override async signRaw(msgHash: string): Promise<ArraySignatureType> {\n    const sig = await this.device.sign(bigIntTo32Bytes(BigInt(msgHash)));\n    return signatureToFelts(sig).map((f) => num.toHex(f));\n  }\n}\n","import type { DevicePublicKey } from \"../signer/DeviceSigner\";\n\n/**\n * Off-chain map of `user_id -> wallet`. Because the account address is\n * `f(identity, first_device_pubkey)` (unforgeable, secure), it is NOT derivable\n * from the identity alone on a new device. The backend is the source of truth\n * for \"does this user already have a wallet?\" — enabling multi-device:\n *\n *   - First device, unknown user  -> deploy a new wallet, then `register`.\n *   - Same user, new device        -> `lookup` returns the existing wallet; the\n *                                      new device is added as a signer (recovery\n *                                      approval), NOT a new wallet.\n *\n * The backend implements this (it already manages the user<->address binding).\n */\nexport interface WalletRegistry {\n  /** The user's existing wallet, or null if they don't have one yet. */\n  lookup(userId: string): Promise<RegisteredWallet | null>;\n\n  /** Record a freshly deployed wallet for the user (first device). */\n  register(params: {\n    userId: string;\n    address: string;\n    initialSigner: DevicePublicKey;\n  }): Promise<void>;\n\n  /** Note an additional device signer for the user's wallet (after approval). */\n  addDevice?(params: {\n    userId: string;\n    address: string;\n    signer: DevicePublicKey;\n  }): Promise<void>;\n}\n\nexport interface RegisteredWallet {\n  address: string;\n  /** Public keys of the devices registered on this wallet (if tracked). */\n  devices?: DevicePublicKey[];\n}\n\n/** Simple in-memory registry for demos / tests. */\nexport class InMemoryWalletRegistry implements WalletRegistry {\n  private wallets = new Map<string, RegisteredWallet>();\n\n  async lookup(userId: string): Promise<RegisteredWallet | null> {\n    return this.wallets.get(userId) ?? null;\n  }\n  async register(params: { userId: string; address: string; initialSigner: DevicePublicKey }) {\n    this.wallets.set(params.userId, { address: params.address, devices: [params.initialSigner] });\n  }\n  async addDevice(params: { userId: string; address: string; signer: DevicePublicKey }) {\n    const w = this.wallets.get(params.userId);\n    if (w) w.devices = [...(w.devices ?? []), params.signer];\n  }\n}\n","import type { DevicePublicKey } from \"../signer/DeviceSigner\";\nimport type { WalletRegistry, RegisteredWallet } from \"./WalletRegistry\";\n\nexport interface HttpWalletRegistryOptions {\n  /** Cavos backend base URL (e.g. https://cavos.xyz). */\n  baseUrl: string;\n  /** The Cavos App ID — authenticates the SDK calls (verifyAppId). */\n  appId: string;\n  /** Network the wallet lives on (e.g. \"sepolia\"). */\n  network: string;\n}\n\n/** Serialize a bigint pubkey component for transport (hex string). */\nfunction toHex(n: bigint): string {\n  return \"0x\" + n.toString(16);\n}\n\n/** Parse a hex/decimal string back to a bigint pubkey component. */\nfunction fromHex(s: string): bigint {\n  return BigInt(s);\n}\n\n/**\n * WalletRegistry backed by the Cavos backend (`/api/wallets`). This is the\n * persistent, cross-device source of truth for `user_id -> wallet`. The backend\n * stores authorized device signers in `wallet_devices`; the registry maps a\n * backend `userId` (the OAuth `sub`) onto that wallet row.\n */\nexport class HttpWalletRegistry implements WalletRegistry {\n  constructor(private readonly opts: HttpWalletRegistryOptions) {}\n\n  async lookup(userId: string): Promise<RegisteredWallet | null> {\n    const url = new URL(\"/api/wallets\", this.opts.baseUrl);\n    url.searchParams.set(\"app_id\", this.opts.appId);\n    url.searchParams.set(\"user_social_id\", userId);\n    url.searchParams.set(\"network\", this.opts.network);\n\n    const res = await fetch(url, { headers: { \"Content-Type\": \"application/json\" } });\n    if (!res.ok) throw new Error(`registry lookup failed: ${res.status}`);\n    const data = await res.json();\n    if (!data.found || !data.address) return null;\n\n    const devices: DevicePublicKey[] | undefined = Array.isArray(data.devices)\n      ? data.devices.map((d: { pub_x: string; pub_y: string }) => ({\n          x: fromHex(d.pub_x),\n          y: fromHex(d.pub_y),\n        }))\n      : undefined;\n\n    return { address: data.address, devices };\n  }\n\n  async register(params: {\n    userId: string;\n    address: string;\n    initialSigner: DevicePublicKey;\n  }): Promise<void> {\n    const res = await fetch(new URL(\"/api/wallets\", this.opts.baseUrl), {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({\n        app_id: this.opts.appId,\n        user_social_id: params.userId,\n        network: this.opts.network,\n        address: params.address,\n        // Device-signer wallets send their initial signer (no encrypted blob).\n        devices: [{ x: toHex(params.initialSigner.x), y: toHex(params.initialSigner.y) }],\n      }),\n    });\n    if (!res.ok) {\n      const t = await res.text().catch(() => \"\");\n      throw new Error(`registry register failed: ${res.status} ${t}`);\n    }\n  }\n\n  async addDevice?(params: {\n    userId: string;\n    address: string;\n    signer: DevicePublicKey;\n  }): Promise<void> {\n    // The backend mirrors `wallet_devices` via the confirm endpoint after an\n    // on-chain add_signer, so this is a no-op here (kept for interface parity).\n    void params;\n  }\n}\n","import type { DevicePublicKey } from \"../signer/DeviceSigner\";\nimport type { RecoveryClient, PendingDeviceRequest } from \"./RecoveryClient\";\n\nexport interface HttpRecoveryClientOptions {\n  /** Cavos backend base URL (e.g. https://cavos.xyz). */\n  baseUrl: string;\n  /** The Cavos App ID — authenticates SDK calls. */\n  appId: string;\n}\n\nfunction toHex(n: bigint): string {\n  return \"0x\" + n.toString(16);\n}\nfunction fromHex(s: string): bigint {\n  return BigInt(s);\n}\n\nfunction deviceLabel(): string {\n  if (typeof navigator !== \"undefined\") {\n    return navigator.userAgent || \"a new device\";\n  }\n  return \"a new device\";\n}\n\n/**\n * RecoveryClient backed by the Cavos backend's device-approval relay\n * (`/api/devices/request`). The relay holds NO keys — it stores the pending\n * request, emails the wallet owner, and mirrors the on-chain `add_signer` once a\n * registered device confirms.\n */\nexport class HttpRecoveryClient implements RecoveryClient {\n  constructor(private readonly opts: HttpRecoveryClientOptions) {}\n\n  async requestDeviceAddition(params: {\n    userId: string;\n    accountAddress: string;\n    newSigner: DevicePublicKey;\n    email?: string;\n    deviceLabel?: string;\n  }): Promise<{ requestId: string }> {\n    const res = await fetch(new URL(\"/api/devices/request\", this.opts.baseUrl), {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({\n        app_id: this.opts.appId,\n        wallet_address: params.accountAddress,\n        new_pub_x: toHex(params.newSigner.x),\n        new_pub_y: toHex(params.newSigner.y),\n        device_label: params.deviceLabel ?? deviceLabel(),\n        ...(params.email ? { email: params.email } : {}),\n      }),\n    });\n    if (!res.ok) {\n      const t = await res.text().catch(() => \"\");\n      throw new Error(`requestDeviceAddition failed: ${res.status} ${t}`);\n    }\n    const data = await res.json();\n    return { requestId: data.request_id };\n  }\n\n  async getPendingRequest(requestId: string): Promise<PendingDeviceRequest | null> {\n    const url = new URL(\"/api/devices/request\", this.opts.baseUrl);\n    url.searchParams.set(\"id\", requestId);\n    const res = await fetch(url, { headers: { \"Content-Type\": \"application/json\" } });\n    if (!res.ok) throw new Error(`getPendingRequest failed: ${res.status}`);\n    const data = await res.json();\n    if (!data.found) return null;\n\n    const status = data.status as PendingDeviceRequest[\"status\"];\n    return {\n      requestId: data.request_id,\n      appId: data.app_id,\n      userId: \"\", // the approving device already knows its own identity\n      accountAddress: data.wallet_address,\n      newSigner: { x: fromHex(data.new_pub_x), y: fromHex(data.new_pub_y) },\n      createdAt: data.created_at,\n      status,\n    };\n  }\n\n  async confirmDeviceAddition(params: {\n    requestId: string;\n    txHash: string;\n  }): Promise<void> {\n    const res = await fetch(\n      new URL(`/api/devices/request/${params.requestId}/confirm`, this.opts.baseUrl),\n      {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({ tx_hash: params.txHash }),\n      },\n    );\n    if (!res.ok) {\n      const t = await res.text().catch(() => \"\");\n      throw new Error(`confirmDeviceAddition failed: ${res.status} ${t}`);\n    }\n  }\n}\n","import { p256 } from \"@noble/curves/p256\";\nimport { hkdf } from \"@noble/hashes/hkdf\";\nimport { pbkdf2 } from \"@noble/hashes/pbkdf2\";\nimport { sha256 } from \"@noble/hashes/sha256\";\nimport { randomBytes } from \"@noble/hashes/utils\";\nimport type { DeviceSigner, DevicePublicKey, DeviceSignature } from \"../signer/DeviceSigner\";\nimport { bytesToBigInt, bigIntTo32Bytes } from \"../crypto/encoding\";\nimport { recoverYParity } from \"../crypto/signature\";\n\n/**\n * Self-custodial account recovery via a backup signer derived from a code.\n *\n * The user generates a human-readable recovery code once (see\n * `generateRecoveryCode`). That code is stretched with PBKDF2 + HKDF into a\n * deterministic secp256r1 private key — the SAME key on every device that\n * enters the SAME code. The code never leaves the device: the backend and the\n * chain only ever see the derived public key, which is registered on-chain as\n * an ordinary signer via `add_signer`. Recovering access after losing every\n * device is therefore: enter the code → re-derive the backup key → sign an\n * `add_signer` for the new device. No guardian, no timelock, no custodial key.\n *\n * This module is intentionally chain-agnostic and free of WebCrypto/DOM calls:\n * the derivation is pure `@noble/*` math, so the identical code runs in the\n * browser, React Native, and (eventually) Solana / Stellar / EVM adapters.\n */\n\n/** Fixed domain-separation salt for `deriveBackupKey`. Bumped only to re-derive\n *  a new key space (e.g. changing the KDF parameters). Never per-user. */\nconst BACKUP_KDF_SALT = \"cavos-recovery-v1\";\n/** PBKDF2 iteration count. High enough to make brute-forcing a strong code\n *  infeasible, low enough that derivation stays well under a second. */\nconst BACKUP_PBKDF2_ITERATIONS = 210_000;\n/** HKDF info string, scopes the derived material to \"backup-signer\". */\nconst BACKUP_HKDF_INFO = \"cavos-backup-signer\";\n\n/** How many words make up a recovery code. 16 words @ 8 bits/word = 128 bits. */\nconst CODE_WORDS = 16;\n\n/**\n * Generate a fresh, human-readable recovery code. The caller MUST present this\n * to the user exactly once and never persist it server-side. ~128 bits of\n * entropy encoded as words from a fixed wordlist (BIP39-style but our own list,\n * so we don't pull a dependency on a BIP39 wordfile).\n */\nexport function generateRecoveryCode(): string {\n  const bytes = randomBytes(CODE_WORDS);\n  const words: string[] = [];\n  for (const b of bytes) words.push(WORDLIST[b]);\n  return words.join(\" \");\n}\n\n/**\n * Deterministically derive a secp256r1 keypair from a recovery code. Pure\n * function: the same normalised code always yields the same keypair, on any\n * runtime. Returns the raw 32-byte private key (so it can be wrapped in a\n * `BackupSigner` or fed to any chain adapter) plus the public key coordinates\n * the contract stores as an authorised signer.\n *\n * Normalisation trims surrounding whitespace and collapses runs of spaces, so\n * \"a  b\" and \"a b\" derive the same key regardless of how the code was pasted.\n */\nexport function deriveBackupKey(code: string): {\n  privateKey: Uint8Array;\n  publicKey: DevicePublicKey;\n} {\n  const normalised = code.trim().replace(/\\s+/g, \" \").toLowerCase();\n  if (!normalised) throw new Error(\"kit: recovery code is empty\");\n\n  // Stretch the low-entropy-ish human code into 32 bytes with PBKDF2, then mix\n  // into a scoped seed with HKDF. PBKDF2 also serves as the brute-force brake.\n  const stretched = pbkdf2(\n    sha256,\n    new TextEncoder().encode(normalised),\n    new TextEncoder().encode(BACKUP_KDF_SALT),\n    { c: BACKUP_PBKDF2_ITERATIONS, dkLen: 32 },\n  );\n  const seed = hkdf(sha256, stretched, undefined, BACKUP_HKDF_INFO, 32);\n\n  // Reduce the seed to a valid secp256r1 scalar. The seed is 32 bytes (< n with\n  // overwhelming probability); reducing mod n keeps it a valid private key\n  // without bias that matters in practice for an HMAC-stretched 256-bit input.\n  const d = bytesToBigInt(seed) % p256.CURVE.n;\n  if (d === 0n) throw new Error(\"kit: derived backup key is zero (retry with a new code)\");\n\n  const priv = bigIntTo32Bytes(d);\n  // isCompressed = false → uncompressed point (0x04 || X || Y, 65 bytes), so the\n  // X/Y split below is correct. The default would return a 33-byte compressed\n  // point and the Y half would be empty.\n  const pub = p256.getPublicKey(priv, false);\n  return {\n    privateKey: priv,\n    publicKey: { x: bytesToBigInt(pub.subarray(1, 33)), y: bytesToBigInt(pub.subarray(33, 65)) },\n  };\n}\n\n/**\n * A `DeviceSigner` backed by an in-memory backup key derived from a recovery\n * code. Used transiently during recovery to sign the `add_signer` that\n * authorises a new device — it is NOT persisted and should not be reused as a\n * device signer. The key material lives only for the duration of the recovery\n * transaction.\n */\nexport class BackupSigner implements DeviceSigner {\n  private readonly privateKey: Uint8Array;\n  private readonly publicKeyValue: DevicePublicKey;\n\n  constructor(privateKey: Uint8Array, publicKey: DevicePublicKey) {\n    this.privateKey = privateKey;\n    this.publicKeyValue = publicKey;\n  }\n\n  /** Build a signer from a recovery code (derive + wrap in one step). */\n  static fromCode(code: string): BackupSigner {\n    const { privateKey, publicKey } = deriveBackupKey(code);\n    return new BackupSigner(privateKey, publicKey);\n  }\n\n  async getPublicKey(): Promise<DevicePublicKey> {\n    return this.publicKeyValue;\n  }\n\n  async sign(txHash: Uint8Array): Promise<DeviceSignature> {\n    // Mirror the WebCrypto path exactly: WebCrypto's `subtle.sign({ hash:\n    // 'SHA-256' }, key, txHash)` hashes `txHash` with SHA-256 and signs the\n    // digest. `p256.sign(msgHash)` signs the bytes it's given WITHOUT hashing,\n    // so we pre-hash here to produce the same (r, s) the contract verifies.\n    const digest = sha256(txHash);\n    const sig = p256.sign(digest, this.privateKey);\n    const yParity = recoverYParity(sig.r, sig.s, digest, this.publicKeyValue);\n    return { r: sig.r, s: sig.s, yParity };\n  }\n}\n\n// 256 short, unambiguous, lowercase English words. Chosen to be hard to\n// misread and easy to type; not the full BIP39 list (we don't need 2048 — 8\n// bits/word is plenty at 16 words). Keep this list stable: changing it changes\n// the meaning of every existing recovery code. Must stay exactly 256 unique\n// entries so each byte value maps to one word.\nconst WORDLIST = [\n  \"able\", \"acid\", \"amber\", \"apple\", \"arch\", \"arrow\", \"ashen\", \"atlas\",\n  \"axis\", \"badge\", \"baker\", \"balm\", \"banner\", \"basin\", \"beacon\", \"bench\",\n  \"beryl\", \"birch\", \"blade\", \"bloom\", \"bluer\", \"border\", \"brave\", \"brick\",\n  \"brook\", \"cabin\", \"candle\", \"carbon\", \"cargo\", \"cedar\", \"chalk\", \"charm\",\n  \"chrome\", \"cipher\", \"clam\", \"clasp\", \"cliff\", \"clock\", \"cobia\", \"comet\",\n  \"coral\", \"cotton\", \"coves\", \"crane\", \"crest\", \"crow\", \"crystal\", \"curio\",\n  \"dawn\", \"delta\", \"denim\", \"depth\", \"dewy\", \"digger\", \"docks\", \"dover\",\n  \"drift\", \"dunes\", \"eagle\", \"ember\", \"echo\", \"eden\", \"elite\", \"ethic\",\n  \"fable\", \"falcon\", \"fawn\", \"feather\", \"fern\", \"fjord\", \"flame\", \"flint\",\n  \"forest\", \"forge\", \"frost\", \"garnet\", \"gemini\", \"glade\", \"glider\", \"glow\",\n  \"granite\", \"grove\", \"guppy\", \"harbor\", \"haven\", \"hazel\", \"helio\", \"heron\",\n  \"hickory\", \"honey\", \"horizon\", \"ivory\", \"jade\", \"jasper\", \"kestrel\", \"knot\",\n  \"lagoon\", \"lattice\", \"laurel\", \"lavender\", \"lemon\", \"linden\", \"loon\", \"luger\",\n  \"lumen\", \"lunar\", \"mango\", \"maple\", \"marble\", \"marsh\", \"meadow\", \"mercy\",\n  \"mistle\", \"monsoon\", \"morning\", \"moss\", \"nacre\", \"nectar\", \"needle\", \"nimbus\",\n  \"nova\", \"ocean\", \"onyx\", \"orbit\", \"otter\", \"palm\", \"panda\", \"pansy\",\n  \"papaya\", \"passage\", \"pebble\", \"pelican\", \"pepper\", \"petal\", \"piano\", \"pierce\",\n  \"pilot\", \"pioneer\", \"platinum\", \"plume\", \"poplar\", \"porpoise\", \"prairie\", \"prism\",\n  \"pulsar\", \"quartz\", \"quasar\", \"quill\", \"quiver\", \"raven\", \"reef\", \"relic\",\n  \"ridge\", \"ripple\", \"robin\", \"rocket\", \"rouge\", \"ruby\", \"saffron\", \"sage\",\n  \"sail\", \"salmon\", \"sapphire\", \"scarab\", \"shadow\", \"shale\", \"sienna\", \"silica\",\n  \"silver\", \"skyline\", \"slate\", \"sonar\", \"spruce\", \"starling\", \"stone\", \"sugar\",\n  \"summit\", \"sunset\", \"swan\", \"tangent\", \"tarragon\", \"temple\", \"thistle\", \"thrush\",\n  \"tiger\", \"topaz\", \"tundra\", \"turtle\", \"umber\", \"union\", \"valley\", \"vapor\",\n  \"vector\", \"velvet\", \"violet\", \"vortex\", \"walnut\", \"whale\", \"winter\", \"wisp\",\n  \"wisteria\", \"xenon\", \"yarrow\", \"zephyr\", \"zinc\", \"zodiac\", \"anchor\", \"basil\",\n  \"cider\", \"daisy\", \"elfin\", \"ferry\", \"gimlet\", \"halcyon\", \"indigo\", \"juniper\",\n  \"kindle\", \"lilac\", \"mantis\", \"nylon\", \"oracle\", \"parch\", \"quokka\", \"ramble\",\n  \"thatch\", \"ultra\", \"vivid\", \"xylo\", \"yodel\", \"zesty\", \"arbor\", \"bliss\",\n  \"calyx\", \"dwindle\", \"folio\", \"globe\", \"hymn\", \"ionic\", \"jolly\", \"knack\",\n  \"lyric\", \"myrtle\", \"noble\", \"plumb\", \"quaint\", \"rustic\", \"satin\", \"timber\",\n  \"urge\", \"vault\", \"whimsy\", \"yearn\", \"zenith\", \"ash\", \"beach\", \"dusk\",\n];\n","import { hash } from \"starknet\";\n\n/**\n * The address seed binds a wallet to a stable, backend-managed user identity.\n * The deterministic account address is derived from this seed + salt ONLY — never\n * from a device pubkey — so the same user resolves to the same wallet on any\n * device. The backend owns the user_id <-> address mapping off-chain.\n */\nexport interface IdentityInput {\n  /** Stable, backend-managed user identifier (e.g. from email / magic link). */\n  userId: string;\n  /** Per-app salt, so the same user has distinct wallets across apps. */\n  appSalt: string;\n}\n\n/** Derive the felt `address_seed` passed to the contract constructor. */\nexport function deriveAddressSeed({ userId, appSalt }: IdentityInput): bigint {\n  // Poseidon over the identity components; stable and collision-resistant.\n  const h = hash.computePoseidonHashOnElements([feltFromString(userId), feltFromString(appSalt)]);\n  return BigInt(h);\n}\n\n/** Map an arbitrary UTF-8 string into a felt via Poseidon over its byte chunks. */\nfunction feltFromString(s: string): bigint {\n  const bytes = new TextEncoder().encode(s);\n  const chunks: bigint[] = [];\n  for (let i = 0; i < bytes.length; i += 31) {\n    let w = 0n;\n    for (const b of bytes.subarray(i, i + 31)) w = (w << 8n) | BigInt(b);\n    chunks.push(w);\n  }\n  if (chunks.length === 0) return 0n;\n  if (chunks.length === 1) return chunks[0];\n  return BigInt(hash.computePoseidonHashOnElements(chunks));\n}\n","import { Account, RpcProvider, PaymasterRpc, num, type Call } from \"starknet\";\nimport type { AuthProvider, Identity } from \"./auth/AuthProvider\";\nimport type { DeviceSigner, DevicePublicKey } from \"./signer/DeviceSigner\";\nimport { WebCryptoSigner } from \"./signer/WebCryptoSigner\";\nimport { StarknetAdapter } from \"./chains/starknet/StarknetAdapter\";\nimport { StarknetDeviceSigner } from \"./chains/starknet/StarknetDeviceSigner\";\nimport type { ChainCall } from \"./chains/ChainAdapter\";\nimport type { WalletRegistry } from \"./registry/WalletRegistry\";\nimport { InMemoryWalletRegistry } from \"./registry/WalletRegistry\";\nimport { HttpWalletRegistry } from \"./registry/HttpWalletRegistry\";\nimport type { RecoveryClient } from \"./recovery/RecoveryClient\";\nimport { HttpRecoveryClient } from \"./recovery/HttpRecoveryClient\";\nimport { BackupSigner, deriveBackupKey } from \"./recovery/BackupSigner\";\nimport { deriveAddressSeed } from \"./identity\";\nimport {\n  CAVOS_PAYMASTER_URL,\n  DEVICE_ACCOUNT_CLASS_HASH,\n  STARKNET_NETWORKS,\n  type StarknetNetwork,\n} from \"./chains/starknet/constants\";\n\nexport interface ConnectOptions {\n  network: StarknetNetwork;\n  /** Authenticated user (pass `identity` directly, or an `auth` provider). */\n  auth?: AuthProvider;\n  identity?: Identity;\n  appSalt: string;\n  /**\n   * Cavos App ID. When set (with `backendUrl`), the kit uses the hosted\n   * WalletRegistry + RecoveryClient by default for real multi-device support.\n   */\n  appId?: string;\n  /** Cavos backend base URL. Defaults to https://cavos.xyz. */\n  backendUrl?: string;\n  /**\n   * Off-chain user_id -> wallet map. Defaults to the hosted HttpWalletRegistry\n   * when `appId` is set, else an in-memory registry (single-device only).\n   */\n  registry?: WalletRegistry;\n  /**\n   * Device-approval relay. Defaults to HttpRecoveryClient when `appId` is set;\n   * used to request addition of this device when it isn't an authorized signer.\n   */\n  recovery?: RecoveryClient;\n  /** Cavos paymaster API key (sponsors deploy + execute). */\n  paymasterApiKey: string;\n  paymasterUrl?: string;\n  rpcUrl?: string;\n  classHash?: string;\n  /** Override the device signer factory (native / tests); default WebCrypto. */\n  createSigner?: (keyId: string) => Promise<DeviceSigner>;\n}\n\n/** Whether this device can already operate the wallet, or needs to be added. */\nexport type ConnectStatus = \"ready\" | \"needs-device-approval\";\n\n/** Options for recovering an account after losing every device signer. */\nexport interface RecoveryOptions {\n  /** The recovery code the user stored when they ran setupRecovery. */\n  code: string;\n  /** Authenticated identity (same user who owns the account). */\n  identity: Identity;\n  network: StarknetNetwork;\n  appSalt: string;\n  paymasterApiKey: string;\n  appId?: string;\n  backendUrl?: string;\n  rpcUrl?: string;\n  paymasterUrl?: string;\n  classHash?: string;\n  /** Off-chain user_id -> wallet map. Defaults to the hosted registry. */\n  registry?: WalletRegistry;\n  /** Override the new device's signer (native / tests); default WebCrypto. */\n  createSigner?: (keyId: string) => Promise<DeviceSigner>;\n}\n\n/**\n * High-level Cavos wallet. One call logs the user in and returns a ready, gas-\n * sponsored smart account controlled by a silent device key.\n *\n *   const cavos = await Cavos.connect({ network, identity, appSalt, registry, paymasterApiKey });\n *   if (cavos.status === \"ready\") await cavos.execute(calls);\n *\n * The account address is `f(identity, device_pubkey)` — unforgeable, so it can't\n * be hijacked. The `registry` recognizes returning users across devices: a new\n * device on an existing account is flagged `needs-device-approval` (add it via\n * an already-registered device) instead of creating a second wallet.\n */\nexport class Cavos {\n  /** Request id of the pending device-addition, when status is needs-device-approval. */\n  pendingRequestId: string | null = null;\n\n  private constructor(\n    readonly identity: Identity,\n    readonly address: string,\n    readonly status: ConnectStatus,\n    readonly account: Account,\n    private readonly adapter: StarknetAdapter,\n    private readonly devicePubkey: DevicePublicKey,\n  ) {}\n\n  static async connect(opts: ConnectOptions): Promise<Cavos> {\n    const identity = opts.identity ?? (await opts.auth?.authenticate());\n    if (!identity) throw new Error(\"kit: connect requires `identity` or `auth`\");\n\n    const classHash = opts.classHash ?? DEVICE_ACCOUNT_CLASS_HASH[opts.network];\n    if (!classHash) throw new Error(`kit: no DeviceAccount class hash for ${opts.network}`);\n\n    const provider = new RpcProvider({\n      nodeUrl: opts.rpcUrl ?? STARKNET_NETWORKS[opts.network].rpcUrl,\n    });\n    const paymaster = new PaymasterRpc({\n      nodeUrl: opts.paymasterUrl ?? CAVOS_PAYMASTER_URL[opts.network],\n      headers: { \"x-paymaster-api-key\": opts.paymasterApiKey },\n    });\n\n    const addressSeed = deriveAddressSeed({ userId: identity.userId, appSalt: opts.appSalt });\n\n    // This device's silent signer.\n    const signer = opts.createSigner\n      ? await opts.createSigner(`${identity.userId}:${opts.appSalt}`)\n      : await WebCryptoSigner.loadOrCreate({ keyId: `${identity.userId}:${opts.appSalt}` });\n    const devicePubkey = await signer.getPublicKey();\n\n    const adapter = new StarknetAdapter({ classHash, signer, provider });\n    const makeAccount = (address: string) =>\n      new Account({\n        provider,\n        address,\n        signer: new StarknetDeviceSigner(signer),\n        paymaster,\n        cairoVersion: \"1\",\n      });\n\n    // Returning user? The registry knows their wallet (address is device-bound,\n    // so it isn't derivable from identity alone). Default to the hosted\n    // HttpWalletRegistry when appId is provided, else an in-memory map.\n    const backendUrl = opts.backendUrl ?? \"https://cavos.xyz\";\n    const registry =\n      opts.registry ??\n      (opts.appId\n        ? new HttpWalletRegistry({ baseUrl: backendUrl, appId: opts.appId, network: opts.network })\n        : defaultRegistry);\n    const recovery =\n      opts.recovery ?? (opts.appId ? new HttpRecoveryClient({ baseUrl: backendUrl, appId: opts.appId }) : null);\n    const existing = await registry.lookup(identity.userId);\n\n    if (existing) {\n      const account = makeAccount(existing.address);\n      const isSigner = await adapter.isAuthorizedSigner(existing.address, devicePubkey);\n      const cavos = new Cavos(\n        identity,\n        existing.address,\n        isSigner ? \"ready\" : \"needs-device-approval\",\n        account,\n        adapter,\n        devicePubkey,\n      );\n\n      // New device on an existing wallet: ask the backend to email the owner an\n      // approval link. The approving device signs add_signer on-chain; this device\n      // becomes \"ready\" after that. Best-effort: never blocks the connect result.\n      //\n      // De-duplicate within a short window so a page refresh, reconnect, or\n      // rapid retry doesn't spam the owner with one email per attempt. The\n      // backend already dedups by request id within its 24h TTL, but that still\n      // re-sends the email on each fresh request id — this client-side guard\n      // collapses the burst. We keep the last requestId and reuse it.\n      if (!isSigner && recovery) {\n        const dedup = lastDeviceRequest.get(identity.userId);\n        const fresh = dedup && Date.now() - dedup.requestedAt < DEVICE_REQUEST_DEDUP_MS;\n        try {\n          if (fresh) {\n            cavos.pendingRequestId = dedup!.requestId;\n          } else {\n            const { requestId } = await recovery.requestDeviceAddition({\n              userId: identity.userId,\n              accountAddress: existing.address,\n              newSigner: devicePubkey,\n              ...(identity.email ? { email: identity.email } : {}),\n            });\n            cavos.pendingRequestId = requestId;\n            lastDeviceRequest.set(identity.userId, { requestId, requestedAt: Date.now() });\n          }\n        } catch (e) {\n          console.warn(\"[Cavos] requestDeviceAddition failed:\", e);\n        }\n      }\n      return cavos;\n    }\n\n    // Compute the deterministic address for (identity, this device). The address\n    // is device-bound, so it's NOT in the registry for a new device — but it may\n    // already be deployed on-chain (same device reconnecting, or a re-run after a\n    // deploy that succeeded before a timeout). Ask the chain before deploying:\n    // re-deploying an existing account reverts (\"contract already deployed\").\n    const address = adapter.computeAddress({ addressSeed, initialSigner: devicePubkey });\n    const account = makeAccount(address);\n    const alreadyDeployed = await isDeployed(provider, address);\n\n    if (!alreadyDeployed) {\n      const deploymentData = {\n        address,\n        class_hash: classHash,\n        salt: num.toHex(addressSeed),\n        calldata: adapter.constructorCalldata(addressSeed, devicePubkey),\n        version: 1 as const,\n      };\n      const deployRes = await account.executePaymasterTransaction([], {\n        feeMode: { mode: \"sponsored\" },\n        deploymentData,\n      });\n      // Wait for the deploy to land before declaring the device \"ready\". Assuming\n      // readiness here would report \"ready\" if the tx silently failed or hadn't\n      // indexed yet — and the user would hit a confusing error on their first tx.\n      try {\n        await provider.waitForTransaction(deployRes.transaction_hash);\n      } catch (e) {\n        console.warn(\"[Cavos] deploy receipt wait failed:\", e);\n      }\n    }\n\n    // Record the wallet (idempotent for reconnects) and resolve readiness from\n    // the chain: this device is \"ready\" iff its pubkey is an authorized signer.\n    // We re-read even right after a fresh deploy, so a deploy that failed to\n    // index (or silently reverted) surfaces as needs-device-approval rather than\n    // a false \"ready\".\n    await registry.register({ userId: identity.userId, address, initialSigner: devicePubkey });\n    let isSigner: boolean;\n    try {\n      isSigner = await adapter.isAuthorizedSigner(address, devicePubkey);\n    } catch (e) {\n      // Fall back to the deploy assumption only if the chain read itself errors\n      // (e.g. node hiccup right after indexing) — the deploy did submit.\n      console.warn(\"[Cavos] isAuthorizedSigner read failed:\", e);\n      isSigner = !alreadyDeployed;\n    }\n\n    return new Cavos(\n      identity,\n      address,\n      isSigner ? \"ready\" : \"needs-device-approval\",\n      account,\n      adapter,\n      devicePubkey,\n    );\n  }\n\n  /** This device's public key (e.g. to request addition to an existing wallet). */\n  get publicKey(): DevicePublicKey {\n    return this.devicePubkey;\n  }\n\n  /** Execute a sponsored (gasless) multicall, signed silently by the device. */\n  async execute(calls: ChainCall[]): Promise<{ transactionHash: string }> {\n    if (this.status !== \"ready\") {\n      throw new Error(\"kit: this device is not yet an authorized signer of the wallet\");\n    }\n    const res = await this.account.executePaymasterTransaction(calls as Call[], {\n      feeMode: { mode: \"sponsored\" },\n    });\n    return { transactionHash: res.transaction_hash };\n  }\n\n  /** Authorize an additional device signer (sponsored). Self-submitted. */\n  async addSigner(pubkey: DevicePublicKey): Promise<{ transactionHash: string }> {\n    return this.execute([this.adapter.buildAddSigner(this.address, pubkey)]);\n  }\n\n  /**\n   * Register a self-custodial backup signer derived from `code`, so the account\n   * can be recovered after the user loses every device. Idempotent: if the\n   * derived backup key is already an authorised signer, this is a no-op.\n   *\n   * The code never leaves the device — only its deterministic public key is\n   * added on-chain as an ordinary signer. Sponsor this like any other\n   * add_signer (gasless). Returns the transaction hash (or undefined when the\n   * backup was already set up).\n   */\n  async setupRecovery(code: string): Promise<{ transactionHash: string } | undefined> {\n    const { publicKey: backupPubkey } = deriveBackupKey(code);\n    // Skip the on-chain call if the backup signer is already registered.\n    const already = await this.adapter.isAuthorizedSigner(this.address, backupPubkey);\n    if (already) return undefined;\n    return this.addSigner(backupPubkey);\n  }\n\n  /**\n   * Recover an account after losing every device signer. Derives the backup key\n   * from `code`, uses it (not the new device key) to sign an `add_signer` for\n   * the new device, and returns a ready Cavos bound to the new device. The\n   * account address is unchanged.\n   *\n   * Self-custodial: only someone holding the code (i.e. the rightful owner) can\n   * re-derive the backup key. The backend never sees the code.\n   */\n  static async recover(opts: RecoveryOptions): Promise<Cavos> {\n    const classHash = opts.classHash ?? DEVICE_ACCOUNT_CLASS_HASH[opts.network];\n    if (!classHash) throw new Error(`kit: no DeviceAccount class hash for ${opts.network}`);\n\n    const provider = new RpcProvider({\n      nodeUrl: opts.rpcUrl ?? STARKNET_NETWORKS[opts.network].rpcUrl,\n    });\n    const paymaster = new PaymasterRpc({\n      nodeUrl: opts.paymasterUrl ?? CAVOS_PAYMASTER_URL[opts.network],\n      headers: { \"x-paymaster-api-key\": opts.paymasterApiKey },\n    });\n\n    // The new device's signer (created/loaded the same way connect() does).\n    const signer = opts.createSigner\n      ? await opts.createSigner(`${opts.identity.userId}:${opts.appSalt}`)\n      : await WebCryptoSigner.loadOrCreate({ keyId: `${opts.identity.userId}:${opts.appSalt}` });\n    const devicePubkey = await signer.getPublicKey();\n\n    // The backup key drives THIS transaction: it's the only signer that can\n    // authorise adding the new device after all device keys are lost.\n    const backup = BackupSigner.fromCode(opts.code);\n    const backupAdapter = new StarknetAdapter({ classHash, signer: backup, provider });\n\n    const backendUrl = opts.backendUrl ?? \"https://cavos.xyz\";\n    const registry =\n      opts.registry ??\n      (opts.appId\n        ? new HttpWalletRegistry({ baseUrl: backendUrl, appId: opts.appId, network: opts.network })\n        : defaultRegistry);\n    const existing = await registry.lookup(opts.identity.userId);\n    if (!existing) {\n      throw new Error(\"kit: no account found for this identity — nothing to recover\");\n    }\n\n    // Authorise the new device, signed by the backup key (sponsored).\n    const backupAccount = new Account({\n      provider,\n      address: existing.address,\n      signer: new StarknetDeviceSigner(backup),\n      paymaster,\n      cairoVersion: \"1\",\n    });\n    const alreadyAuthed = await backupAdapter.isAuthorizedSigner(existing.address, devicePubkey);\n    if (!alreadyAuthed) {\n      const res = await backupAccount.executePaymasterTransaction(\n        [backupAdapter.buildAddSigner(existing.address, devicePubkey)],\n        { feeMode: { mode: \"sponsored\" } },\n      );\n      try {\n        await provider.waitForTransaction(res.transaction_hash);\n      } catch (e) {\n        console.warn(\"[Cavos] recovery add_signer receipt wait failed:\", e);\n      }\n    }\n\n    // Hand control to the new device's signer for all future operations.\n    const adapter = new StarknetAdapter({ classHash, signer, provider });\n    const account = new Account({\n      provider,\n      address: existing.address,\n      signer: new StarknetDeviceSigner(signer),\n      paymaster,\n      cairoVersion: \"1\",\n    });\n    return new Cavos(opts.identity, existing.address, \"ready\", account, adapter, devicePubkey);\n  }\n}\n\n/**\n * Shared in-memory registry used when `ConnectOptions.registry` is omitted.\n * Module-level so a returning user is recognized within a single browser session\n * (real cross-device recognition needs an HTTP backend implementation).\n */\nconst defaultRegistry = new InMemoryWalletRegistry();\n\n/**\n * Client-side de-duplication of device-addition requests, keyed by user id. A\n * burst of connects (refresh, reconnect, retry) within this window reuses the\n * last requestId instead of emailing the owner again. Runtime-agnostic — works\n * without DOM/localStorage so the same code runs on native.\n */\nconst DEVICE_REQUEST_DEDUP_MS = 5 * 60 * 1000; // 5 minutes\nconst lastDeviceRequest = new Map<string, { requestId: string; requestedAt: number }>();\n\n/** Whether an account contract is already deployed at `address`. */\nasync function isDeployed(provider: RpcProvider, address: string): Promise<boolean> {\n  try {\n    const classHash = await provider.getClassHashAt(address);\n    return !!classHash && classHash !== \"0x0\";\n  } catch {\n    return false;\n  }\n}\n","/**\n * Identity for a Cavos wallet. Login (email / social / OTP) only ever produces a\n * stable `userId`; that's all the wallet needs to derive its address. Auth never\n * touches signing — the device key does that, silently.\n *\n * Privy-style UX: the user \"logs in\" and the wallet is provisioned behind the\n * scenes (device key + auto-deployed smart account). The app never handles keys.\n */\nexport interface Identity {\n  /** Stable, backend-managed user identifier. */\n  userId: string;\n  /** Optional metadata (email, provider) for display only. */\n  email?: string;\n  provider?: \"google\" | \"apple\" | \"email\" | \"otp\" | string;\n}\n\n/**\n * Authenticates a user and returns their stable identity. Implementations:\n * - `CavosAuth` (hosted, mirrors `@cavos/react`: Google/Apple/email/OTP via the\n *   Cavos backend) — the default, Privy-like experience.\n * - any custom provider (the app already authenticated the user elsewhere).\n */\nexport interface AuthProvider {\n  authenticate(): Promise<Identity>;\n}\n\n/** Trivial provider when the app already has the user's stable id. */\nexport class StaticIdentity implements AuthProvider {\n  constructor(private readonly identity: Identity) {}\n  async authenticate(): Promise<Identity> {\n    return this.identity;\n  }\n}\n","import { hash, num } from \"starknet\";\nimport type { AuthProvider, Identity } from \"./AuthProvider\";\n\nexport interface CavosAuthOptions {\n  /** Cavos backend base URL. Defaults to the hosted service (same as @cavos/react). */\n  backendUrl?: string;\n  /** App identifier registered with Cavos (the `appId` from the dashboard). */\n  appId?: string;\n}\n\n/**\n * Hosted login (Privy-like) backed by the Cavos backend — same endpoints\n * `@cavos/react` uses (Google / Apple OAuth + Firebase email OTP). Login only\n * resolves a stable `userId` (the OAuth `sub` claim); it never touches signing.\n * Feed the returned `Identity` to `Cavos.connect`.\n *\n *   const auth = new CavosAuth({ appId });\n *   // social: open the returned URL; user returns, then:\n *   const identity = await auth.handleCallback(window.location.search);\n *   // or email OTP:\n *   await auth.sendOtp(email); const identity = await auth.verifyOtp(email, code);\n *   const cavos = await Cavos.connect({ network, appSalt, identity, paymasterApiKey });\n *\n * Device-signer model note: the backend issues a Cavos JWT (the same one react\n * uses for on-chain RSA verification). Here we only need the stable `sub` claim\n * from it — the RSA/JWKS/nonce machinery react relies on is dead weight for the\n * device model, because the device key (not the JWT) authorizes on-chain calls.\n * We still send a `nonce` (Poseidon over random bytes) since the backend expects\n * it on the request; the value itself is irrelevant to us.\n */\nexport class CavosAuth implements AuthProvider {\n  private readonly backendUrl: string;\n  /** Most recent nonce sent to the backend (for the pending OAuth/OTP request). */\n  private pendingNonce: string | null = null;\n  private last: Identity | null = null;\n\n  constructor(private readonly opts: CavosAuthOptions = {}) {\n    this.backendUrl = opts.backendUrl ?? \"https://cavos.xyz\";\n  }\n\n  /** Redirect URL for Google login (open it; user returns to your redirectUri). */\n  async getGoogleOAuthUrl(redirectUri?: string): Promise<string> {\n    return this.oauthUrl(\"google\", redirectUri);\n  }\n\n  /** Redirect URL for Apple login. */\n  async getAppleOAuthUrl(redirectUri?: string): Promise<string> {\n    return this.oauthUrl(\"apple\", redirectUri);\n  }\n\n  private async oauthUrl(provider: \"google\" | \"apple\", redirectUri?: string): Promise<string> {\n    if (typeof window === \"undefined\") throw new Error(\"kit/auth: OAuth requires a browser\");\n    const params = new URLSearchParams({\n      nonce: this.freshNonce(),\n      redirect_uri: redirectUri ?? window.location.href,\n      ...(this.opts.appId ? { app_id: this.opts.appId } : {}),\n    });\n    const { url } = await this.get(`/api/oauth/${provider}?${params}`);\n    return url;\n  }\n\n  /**\n   * Resolve the identity from an OAuth callback. The auth data is carried in the\n   * `auth_data` (or `zk_auth_data`) query param on return. We only extract `sub`.\n   */\n  async handleCallback(authDataOrSearch: string): Promise<Identity> {\n    const authData = extractAuthData(authDataOrSearch);\n    return this.identityFromAuthData(authData, \"oauth\");\n  }\n\n  /** Send a one-time code to an email (Firebase OTP). */\n  async sendOtp(email: string): Promise<void> {\n    await this.post(\"/api/oauth/firebase/otp/request\", {\n      email,\n      nonce: this.freshNonce(),\n      ...(this.opts.appId ? { app_id: this.opts.appId } : {}),\n    });\n  }\n\n  /** Send a passwordless magic-link sign-in email (Firebase). */\n  async sendMagicLink(email: string): Promise<void> {\n    await this.post(\"/api/oauth/firebase/magic-link\", {\n      email,\n      nonce: this.freshNonce(),\n      ...(this.opts.appId ? { app_id: this.opts.appId } : {}),\n      ...(typeof window !== \"undefined\" ? { redirect_uri: window.location.href } : {}),\n    });\n  }\n\n  /** Verify the OTP and resolve the identity. */\n  async verifyOtp(email: string, code: string): Promise<Identity> {\n    const res = await this.post(\"/api/oauth/firebase/otp/verify\", {\n      email,\n      code,\n      nonce: this.consumeNonce(),\n      ...(this.opts.appId ? { app_id: this.opts.appId } : {}),\n    });\n    return this.identityFromAuthData(res.id_token ?? res.jwt ?? res.token ?? JSON.stringify(res), \"otp\", email);\n  }\n\n  /** AuthProvider: returns the identity resolved by the last login step. */\n  async authenticate(): Promise<Identity> {\n    if (!this.last) throw new Error(\"kit/auth: no identity yet — complete a login first\");\n    return this.last;\n  }\n\n  // ── internals ──────────────────────────────────────────────────────────────\n\n  /**\n   * Build an `Identity` from whatever the backend returned. The Cavos backend\n   * wraps the user id in a JWT (its `sub` claim); for the device model we only\n   * need that stable id — the signature is never checked on-chain.\n   */\n  private async identityFromAuthData(\n    authData: string,\n    provider: string,\n    emailOverride?: string,\n  ): Promise<Identity> {\n    let token = authData;\n    try {\n      const parsed = JSON.parse(authData);\n      token = parsed.id_token ?? parsed.jwt ?? parsed.token ?? authData;\n    } catch {\n      // raw JWT\n    }\n    const claims = parseJwt(token);\n    return this.remember({\n      userId: String(claims.sub ?? claims.user_id ?? claims.uid),\n      email: claims.email ?? emailOverride,\n      provider: claims.firebase?.sign_in_provider ?? claims.provider ?? provider,\n    });\n  }\n\n  /** Generate (and remember) the nonce the Cavos backend expects on requests. */\n  private freshNonce(): string {\n    // 31-byte random felt; matches the shape the backend validates, value is\n    // irrelevant to the device-signer model.\n    const bytes = crypto.getRandomValues(new Uint8Array(31));\n    const h = hash.computePoseidonHashOnElements([bytesToChunks(bytes)]);\n    this.pendingNonce = num.toHex(h);\n    return this.pendingNonce;\n  }\n\n  /** Return the pending nonce (for the verify step), clearing it. */\n  private consumeNonce(): string {\n    if (!this.pendingNonce) return this.freshNonce();\n    const n = this.pendingNonce;\n    this.pendingNonce = null;\n    return n;\n  }\n\n  private remember(id: Identity): Identity {\n    this.last = id;\n    return id;\n  }\n\n  private async get(path: string): Promise<any> {\n    const r = await fetch(`${this.backendUrl}${path}`);\n    if (!r.ok) throw new Error(`kit/auth: ${path} -> ${r.status} ${await r.text()}`);\n    return r.json();\n  }\n\n  private async post(path: string, body: unknown): Promise<any> {\n    const r = await fetch(`${this.backendUrl}${path}`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n    if (!r.ok) throw new Error(`kit/auth: ${path} -> ${r.status} ${await r.text()}`);\n    return r.json();\n  }\n}\n\n/** Pull the `auth_data` / `zk_auth_data` value out of a callback string. */\nfunction extractAuthData(input: string): string {\n  if (input.includes(\"auth_data=\") || input.includes(\"zk_auth_data=\")) {\n    const params = new URLSearchParams(input.startsWith(\"?\") ? input : `?${input}`);\n    return params.get(\"auth_data\") ?? params.get(\"zk_auth_data\") ?? input;\n  }\n  return input;\n}\n\n/** Decode a JWT payload (no verification — the backend already validated it). */\nfunction parseJwt(jwt: string): any {\n  const part = jwt.split(\".\")[1];\n  if (!part) throw new Error(\"kit/auth: malformed JWT\");\n  const json = atob(part.replace(/-/g, \"+\").replace(/_/g, \"/\"));\n  return JSON.parse(json);\n}\n\n/** Pack a byte array into the felt252 chunks Poseidon hashes over. */\nfunction bytesToChunks(bytes: Uint8Array): bigint {\n  let w = 0n;\n  for (const b of bytes.subarray(0, 31)) w = (w << 8n) | BigInt(b);\n  return w;\n}\n"]}

package/dist/index.mjs

@@ -0,0 +1,15 @@
+export { BackupSigner, Cavos, CavosAuth, DEVICE_ACCOUNT_CLASS_HASH, HttpRecoveryClient, HttpWalletRegistry, InMemoryWalletRegistry, STARKNET_NETWORKS, StarknetAdapter, StarknetDeviceSigner, UDC_ADDRESS, WebCryptoSigner, bigIntTo32Bytes, bytesToBigInt, bytesToHex, deriveAddressSeed, deriveBackupKey, generateRecoveryCode, hexToBytes, recoverYParity, signatureToFelts, u256ToFelts } from './chunk-XWBX2ZIO.mjs';
+
+// src/auth/AuthProvider.ts
+var StaticIdentity = class {
+  constructor(identity) {
+    this.identity = identity;
+  }
+  async authenticate() {
+    return this.identity;
+  }
+};
+
+export { StaticIdentity };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth/AuthProvider.ts"],"names":[],"mappings":";;;AA2BO,IAAM,iBAAN,MAA6C;AAAA,EAClD,YAA6B,QAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAAqB;AAAA,EAClD,MAAM,YAAA,GAAkC;AACtC,IAAA,OAAO,IAAA,CAAK,QAAA;AAAA,EACd;AACF","file":"index.mjs","sourcesContent":["/**\n * Identity for a Cavos wallet. Login (email / social / OTP) only ever produces a\n * stable `userId`; that's all the wallet needs to derive its address. Auth never\n * touches signing — the device key does that, silently.\n *\n * Privy-style UX: the user \"logs in\" and the wallet is provisioned behind the\n * scenes (device key + auto-deployed smart account). The app never handles keys.\n */\nexport interface Identity {\n  /** Stable, backend-managed user identifier. */\n  userId: string;\n  /** Optional metadata (email, provider) for display only. */\n  email?: string;\n  provider?: \"google\" | \"apple\" | \"email\" | \"otp\" | string;\n}\n\n/**\n * Authenticates a user and returns their stable identity. Implementations:\n * - `CavosAuth` (hosted, mirrors `@cavos/react`: Google/Apple/email/OTP via the\n *   Cavos backend) — the default, Privy-like experience.\n * - any custom provider (the app already authenticated the user elsewhere).\n */\nexport interface AuthProvider {\n  authenticate(): Promise<Identity>;\n}\n\n/** Trivial provider when the app already has the user's stable id. */\nexport class StaticIdentity implements AuthProvider {\n  constructor(private readonly identity: Identity) {}\n  async authenticate(): Promise<Identity> {\n    return this.identity;\n  }\n}\n"]}

package/dist/react/index.d.mts

@@ -0,0 +1,140 @@
+import * as react from 'react';
+import react__default, { ReactNode } from 'react';
+import { S as StarknetNetwork, C as ChainCall } from '../constants-C530TZFF.mjs';
+
+interface CavosConfig {
+    /** Cavos App ID from the dashboard. */
+    appId?: string;
+    network: StarknetNetwork;
+    /** Per-app salt so the same user has distinct wallets per app. */
+    appSalt: string;
+    /** Cavos paymaster API key (sponsors deploy + execute). */
+    paymasterApiKey: string;
+    /** Override the Cavos auth backend (self-hosted / staging). */
+    authBackendUrl?: string;
+    /** Override the Starknet RPC. */
+    rpcUrl?: string;
+}
+interface CavosModalConfig {
+    appName?: string;
+    appLogo?: string;
+    providers?: ('google' | 'apple' | 'email')[];
+    /** How the built-in email provider authenticates. Defaults to magic link. */
+    emailMode?: 'magic-link' | 'otp';
+    primaryColor?: string;
+    /** 'light' (default) or 'dark'. */
+    theme?: 'light' | 'dark';
+    onSuccess?: (address: string) => void;
+}
+/** Minimal wallet-status surface the React layer (and modal) needs. */
+interface WalletStatus {
+    /** True while the device-signer account is being deployed. */
+    isDeploying: boolean;
+    /** True once deployed and this device is an authorized signer. */
+    isReady: boolean;
+    /** True if this device still needs approval to operate the wallet. */
+    needsDeviceApproval: boolean;
+    /** True while waiting for the owner to approve this device from another device. */
+    awaitingApproval: boolean;
+    /** The pending device-addition request id, when awaitingApproval. */
+    pendingRequestId: string | null;
+}
+interface UserInfo {
+    userId: string;
+    email?: string;
+    provider?: string;
+}
+interface CavosContextValue {
+    /** Open / close the built-in auth modal. */
+    openModal: () => void;
+    closeModal: () => void;
+    isAuthenticated: boolean;
+    user: UserInfo | null;
+    address: string | null;
+    walletStatus: WalletStatus;
+    isLoading: boolean;
+    /** Last unrecoverable auth/connect error surfaced to the UI (e.g. a failed
+     * OAuth callback). Null while things are healthy. Cleared on a new attempt. */
+    authError: string | null;
+    /** Clear `authError` (e.g. when the user starts a new login attempt). */
+    clearAuthError: () => void;
+    /** OAuth social login — opens the provider's hosted flow. */
+    login: (provider: 'google' | 'apple') => Promise<void>;
+    /** Send a passwordless magic-link email. */
+    sendMagicLink: (email: string) => Promise<void>;
+    /** Send an email OTP code. */
+    sendOtp: (email: string) => Promise<void>;
+    /** Verify an email OTP / complete a magic link and deploy the wallet. */
+    verifyOtp: (email: string, code: string) => Promise<void>;
+    /** Resolve identity from an OAuth callback (?auth_data=…) and deploy. */
+    handleCallback: (authData: string) => Promise<void>;
+    /** Execute a sponsored (gasless) multicall, signed by the device key. */
+    execute: (calls: ChainCall[]) => Promise<{
+        transactionHash: string;
+    }>;
+    /** Authorize another device signer on this wallet (sponsored add_signer). */
+    addSigner: (pubkey: {
+        x: bigint;
+        y: bigint;
+    }) => Promise<{
+        transactionHash: string;
+    }>;
+    /** Re-request the device-approval email for the current pending request. */
+    resendDeviceApproval: () => Promise<void>;
+    /**
+     * Register a backup signer derived from `code` on the current account
+     * (gasless). The code is generated by the kit and shown to the user once.
+     * Resolves with the code so the caller can display it.
+     */
+    setupRecovery: () => Promise<string>;
+    /**
+     * Recover access after losing every device. Requires the recovery code. Runs
+     * the full Cavos.recover flow and brings the provider to a ready state.
+     */
+    recover: (code: string) => Promise<void>;
+    logout: () => void;
+}
+interface CavosProviderProps {
+    config: CavosConfig;
+    modal?: CavosModalConfig;
+    children: ReactNode;
+}
+/**
+ * Drop-in Cavos provider. Wrap your app once; descendants call `useCavos()`.
+ *
+ *   <CavosProvider config={{ network: 'sepolia', appSalt, paymasterApiKey }}
+ *                  modal={{ appName: 'My App', theme: 'dark', emailMode: 'otp' }}>
+ *     <App />
+ *   </CavosProvider>
+ *
+ * Behind the scenes: login (social / email) resolves a stable identity, the kit
+ * deploys a device-signer smart account gaslessly, and `execute()` submits
+ * gasless multicalls signed silently by the browser's device key.
+ */
+declare function CavosProvider({ config, modal, children }: CavosProviderProps): react.JSX.Element;
+declare function useCavos(): CavosContextValue;
+
+interface CavosAuthModalProps {
+    open: boolean;
+    onClose: () => void;
+    onSuccess?: (address: string) => void;
+    appName?: string;
+    appLogo?: string;
+    providers?: ('google' | 'apple' | 'email')[];
+    emailMode?: 'magic-link' | 'otp';
+    primaryColor?: string;
+    /** 'light' (default) or 'dark' */
+    theme?: 'light' | 'dark';
+}
+declare function CavosAuthModal({ open, onClose, appName, providers, emailMode, primaryColor, theme, }: CavosAuthModalProps): react__default.JSX.Element | null;
+declare function useCavosAuth(): {
+    openModal: () => void;
+    closeModal: () => void;
+    isAuthenticated: boolean;
+    address: string | null;
+    user: UserInfo | null;
+    walletStatus: WalletStatus;
+    logout: () => void;
+};
+
+export { CavosAuthModal, type CavosAuthModalProps, type CavosConfig, type CavosContextValue, type CavosModalConfig, CavosProvider, type CavosProviderProps, type UserInfo, type WalletStatus, useCavos, useCavosAuth };

package/dist/react/index.d.ts

@@ -0,0 +1,140 @@
+import * as react from 'react';
+import react__default, { ReactNode } from 'react';
+import { S as StarknetNetwork, C as ChainCall } from '../constants-C530TZFF.js';
+
+interface CavosConfig {
+    /** Cavos App ID from the dashboard. */
+    appId?: string;
+    network: StarknetNetwork;
+    /** Per-app salt so the same user has distinct wallets per app. */
+    appSalt: string;
+    /** Cavos paymaster API key (sponsors deploy + execute). */
+    paymasterApiKey: string;
+    /** Override the Cavos auth backend (self-hosted / staging). */
+    authBackendUrl?: string;
+    /** Override the Starknet RPC. */
+    rpcUrl?: string;
+}
+interface CavosModalConfig {
+    appName?: string;
+    appLogo?: string;
+    providers?: ('google' | 'apple' | 'email')[];
+    /** How the built-in email provider authenticates. Defaults to magic link. */
+    emailMode?: 'magic-link' | 'otp';
+    primaryColor?: string;
+    /** 'light' (default) or 'dark'. */
+    theme?: 'light' | 'dark';
+    onSuccess?: (address: string) => void;
+}
+/** Minimal wallet-status surface the React layer (and modal) needs. */
+interface WalletStatus {
+    /** True while the device-signer account is being deployed. */
+    isDeploying: boolean;
+    /** True once deployed and this device is an authorized signer. */
+    isReady: boolean;
+    /** True if this device still needs approval to operate the wallet. */
+    needsDeviceApproval: boolean;
+    /** True while waiting for the owner to approve this device from another device. */
+    awaitingApproval: boolean;
+    /** The pending device-addition request id, when awaitingApproval. */
+    pendingRequestId: string | null;
+}
+interface UserInfo {
+    userId: string;
+    email?: string;
+    provider?: string;
+}
+interface CavosContextValue {
+    /** Open / close the built-in auth modal. */
+    openModal: () => void;
+    closeModal: () => void;
+    isAuthenticated: boolean;
+    user: UserInfo | null;
+    address: string | null;
+    walletStatus: WalletStatus;
+    isLoading: boolean;
+    /** Last unrecoverable auth/connect error surfaced to the UI (e.g. a failed
+     * OAuth callback). Null while things are healthy. Cleared on a new attempt. */
+    authError: string | null;
+    /** Clear `authError` (e.g. when the user starts a new login attempt). */
+    clearAuthError: () => void;
+    /** OAuth social login — opens the provider's hosted flow. */
+    login: (provider: 'google' | 'apple') => Promise<void>;
+    /** Send a passwordless magic-link email. */
+    sendMagicLink: (email: string) => Promise<void>;
+    /** Send an email OTP code. */
+    sendOtp: (email: string) => Promise<void>;
+    /** Verify an email OTP / complete a magic link and deploy the wallet. */
+    verifyOtp: (email: string, code: string) => Promise<void>;
+    /** Resolve identity from an OAuth callback (?auth_data=…) and deploy. */
+    handleCallback: (authData: string) => Promise<void>;
+    /** Execute a sponsored (gasless) multicall, signed by the device key. */
+    execute: (calls: ChainCall[]) => Promise<{
+        transactionHash: string;
+    }>;
+    /** Authorize another device signer on this wallet (sponsored add_signer). */
+    addSigner: (pubkey: {
+        x: bigint;
+        y: bigint;
+    }) => Promise<{
+        transactionHash: string;
+    }>;
+    /** Re-request the device-approval email for the current pending request. */
+    resendDeviceApproval: () => Promise<void>;
+    /**
+     * Register a backup signer derived from `code` on the current account
+     * (gasless). The code is generated by the kit and shown to the user once.
+     * Resolves with the code so the caller can display it.
+     */
+    setupRecovery: () => Promise<string>;
+    /**
+     * Recover access after losing every device. Requires the recovery code. Runs
+     * the full Cavos.recover flow and brings the provider to a ready state.
+     */
+    recover: (code: string) => Promise<void>;
+    logout: () => void;
+}
+interface CavosProviderProps {
+    config: CavosConfig;
+    modal?: CavosModalConfig;
+    children: ReactNode;
+}
+/**
+ * Drop-in Cavos provider. Wrap your app once; descendants call `useCavos()`.
+ *
+ *   <CavosProvider config={{ network: 'sepolia', appSalt, paymasterApiKey }}
+ *                  modal={{ appName: 'My App', theme: 'dark', emailMode: 'otp' }}>
+ *     <App />
+ *   </CavosProvider>
+ *
+ * Behind the scenes: login (social / email) resolves a stable identity, the kit
+ * deploys a device-signer smart account gaslessly, and `execute()` submits
+ * gasless multicalls signed silently by the browser's device key.
+ */
+declare function CavosProvider({ config, modal, children }: CavosProviderProps): react.JSX.Element;
+declare function useCavos(): CavosContextValue;
+
+interface CavosAuthModalProps {
+    open: boolean;
+    onClose: () => void;
+    onSuccess?: (address: string) => void;
+    appName?: string;
+    appLogo?: string;
+    providers?: ('google' | 'apple' | 'email')[];
+    emailMode?: 'magic-link' | 'otp';
+    primaryColor?: string;
+    /** 'light' (default) or 'dark' */
+    theme?: 'light' | 'dark';
+}
+declare function CavosAuthModal({ open, onClose, appName, providers, emailMode, primaryColor, theme, }: CavosAuthModalProps): react__default.JSX.Element | null;
+declare function useCavosAuth(): {
+    openModal: () => void;
+    closeModal: () => void;
+    isAuthenticated: boolean;
+    address: string | null;
+    user: UserInfo | null;
+    walletStatus: WalletStatus;
+    logout: () => void;
+};
+
+export { CavosAuthModal, type CavosAuthModalProps, type CavosConfig, type CavosContextValue, type CavosModalConfig, CavosProvider, type CavosProviderProps, type UserInfo, type WalletStatus, useCavos, useCavosAuth };