@chipi-stack/backend 14.16.0 → 14.17.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (20) hide show
  1. package/README.md +48 -0
  2. package/dist/index.d.mts +396 -67
  3. package/dist/index.d.ts +396 -67
  4. package/dist/index.js +632 -161
  5. package/dist/index.js.map +1 -1
  6. package/dist/index.mjs +613 -163
  7. package/dist/index.mjs.map +1 -1
  8. package/dist/skuPurchases.js +16 -2
  9. package/dist/skuPurchases.js.map +1 -1
  10. package/dist/skuPurchases.mjs +16 -2
  11. package/dist/skuPurchases.mjs.map +1 -1
  12. package/dist/transactions.js +16 -2
  13. package/dist/transactions.js.map +1 -1
  14. package/dist/transactions.mjs +16 -2
  15. package/dist/transactions.mjs.map +1 -1
  16. package/dist/wallets.js +25 -3
  17. package/dist/wallets.js.map +1 -1
  18. package/dist/wallets.mjs +25 -3
  19. package/dist/wallets.mjs.map +1 -1
  20. package/package.json +4 -4
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/shhh/compute-wallet-address.ts","../src/shhh/snip12-hash.ts","../src/shhh/threshold.ts","../src/shhh/oe.ts","../src/shhh/signers/ed25519.ts","../src/lib/encryption.ts","../src/encryption.ts","../src/shhh/signers/stark.ts","../src/shhh/execute-paymaster-raw.ts","../src/client.ts","../src/wallets.ts","../src/migrate-to-shhh.ts","../src/execute-paymaster-transaction.ts","../src/paymaster-adapter.ts","../src/shhh/migrate.ts","../src/transactions.ts","../src/exchanges.ts","../src/sku-purchases.ts","../src/skus.ts","../src/sessions.ts","../src/session-codec.ts","../src/session-calls.ts","../src/treasury.ts","../src/wait-for-transaction.ts","../src/x402/session-tx-verifier.ts","../src/ai.ts","../src/starknet-signature.ts","../src/x402/facilitator.ts","../src/sign-typed-data.ts","../src/chipi-sdk.ts","../src/chipi-server-sdk.ts","../src/chipi-browser-sdk.ts","../src/index.ts","../src/x402/shhh-client.ts","../src/x402/middleware.ts","../src/siws.ts","../src/shhh/index.ts","../src/shhh/signers/eip191.ts","../src/shhh/signers/webauthn.ts","../src/shhh/signers/jwt_apple_sub.ts","../src/shhh/recovery.ts","../src/shhh/account.ts"],"names":["hash","shortString","ISIGNER_CANONICAL_LABEL","CallData","OE_DOMAIN_NAME","OE_DOMAIN_VERSION","OE_DOMAIN_REVISION","STARKNET_MESSAGE_PREFIX","SIG_VERSION_V1_HEX_ASCII","SIG_VERSION_V2_SNIP12","SIG_VERSION_V2_THRESHOLD","ISRC9_V2_ID","ISIGNER_ID","MIN_THRESHOLD_OWNERS","SHHH_KIND_GAS_OVERHEAD","ANY_CALLER_FELT","MAX_OE_VALIDITY_WINDOW_SECONDS","encryptPrivateKey","decryptPrivateKey","CryptoES","init_encryption","ec","isValidApiKey","ChipiAuthError","STARKNET_NETWORKS","API_VERSIONING","validateErrorResponse","ChipiApiError","handleApiError","getWalletTypeFromClassHash","WALLET_CLASS_HASHES","typedData","withRpcFallback","provider","WALLET_RPC_ENDPOINTS","executeShhhSponsoredRaw","RpcProvider","Account","apiMessage","ChipiSessionError","SESSION_ERRORS","buildOutsideExecution","computeOeHash","resolveShhhChainId","serializeExecuteFromOutsideV2Calldata","r","s","sessionSignature","num","randomBytes","SHHH_VERIFIER_CLASS_HASHES","API_ENDPOINTS","ChipiTransactionError","CairoCustomEnum","CairoOption","CairoOptionVariant","STARKNET_CONTRACTS","formatAmount","Chain","SKU_CONTRACTS","cairo","CARRIER_IDS","SERVICE_TYPES","SESSION_ENTRYPOINTS","SESSION_DEFAULTS","toBigInt","CONTRACT_ADDRESSES","TRANSFER_SELECTOR","buildX402TypedData","starknetTypedData","uint256","toFeltHex","typedDataUtil","buildStarkEnvelope","TOKEN_DECIMALS","requirement","assertBytes","bytesBeToU256","bigintToBe32","normalizePrivateKey","U128_MASK","_felt","generateNonce"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAkCA,SAAS,SAAS,MAAA,EAAwC;AACxD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,KAAO,OAAO,CAAA,KAAM,QAAA,GAAW,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,IAAI,CAAE,CAAA;AACnF,EAAA,OAAO,MAAA,CAAOA,aAAA,CAAK,6BAAA,CAA8B,KAAK,CAAC,CAAA;AACzD;AAGO,SAAS,eAAA,CAAgB,SAAiB,MAAA,EAA0B;AACzE,EAAA,OAAO,QAAA,CAAS,CAAC,OAAA,EAAS,GAAG,MAAM,CAAC,CAAA;AACtC;AASO,SAAS,kBAAA,CAAmB,aAAqB,MAAA,EAA0B;AAChF,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AAIvB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAOC,oBAAA,CAAY,iBAAA,CAAkB,WAAW,CAAC,CAAA;AACjE,EAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,OAAA,EAAS,MAAM,CAAA;AAClD,EAAA,OAAO,QAAA,CAAS,CAAC,OAAA,EAAS,UAAU,CAAC,CAAA;AACvC;AAGO,SAAS,mBAAmB,KAAA,EAAoC;AACrE,EAAA,MAAM;AAAA,IACJ,SAAA;AAAA,IACA,WAAA;AAAA,IACA,MAAA;AAAA,IACA,iBAAA;AAAA,IACA,KAAA,GAAQ,SAAA;AAAA,IACR,eAAA,GAAkB;AAAA,GACpB,GAAI,KAAA;AAEJ,EAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,WAAA,EAAa,MAAM,CAAA;AACnD,EAAA,MAAM,OAAA,GAAU,MAAA,CAAOA,oBAAA,CAAY,iBAAA,CAAkB,WAAW,CAAC,CAAA;AACjE,EAAA,MAAM,SAAA,GAAY,MAAA,CAAOA,oBAAA,CAAY,iBAAA,CAAkB,KAAK,CAAC,CAAA;AAG7D,EAAA,MAAM,IAAA,GAA+B;AAAA,IACnC,OAAA;AAAA,IACA,iBAAA;AAAA,IACA,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,IACpB,GAAG,MAAA;AAAA,IACH;AAAA,GACF;AAEA,EAAA,MAAM,aAAaD,aAAA,CAAK,gCAAA;AAAA,IACtB,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,EAAE,CAAA;AAAA,IACvB,IAAA,GAAO,SAAA,CAAU,QAAA,CAAS,EAAE,CAAA;AAAA,IAC5B,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAO,OAAO,CAAA,KAAM,QAAA,GAAW,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,GAAI,CAAE,CAAA;AAAA,IACnE,IAAA,GAAO,eAAA,CAAgB,QAAA,CAAS,EAAE;AAAA,GACpC;AACA,EAAA,OAAO,OAAO,UAAU,CAAA;AAC1B;AAhGA,IAAA,2BAAA,GAAA,KAAA,CAAA;AAAA,EAAA,oCAAA,GAAA;AAAA,EAAA;AAAA,CAAA,CAAA;ACiDO,SAAS,gBAAA,GAA2B;AACzC,EAAA,OAAO,MAAA,CAAOA,aAAAA,CAAK,cAAA,CAAeE,+BAAuB,CAAC,CAAA;AAC5D;AAkBA,SAAS,SAAS,CAAA,EAAqC;AACrD,EAAA,IAAI,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,CAAA;AAClC,EAAA,IAAI,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,OAAO,CAAC,CAAA;AAC1C,EAAA,OAAO,OAAO,CAAC,CAAA;AACjB;AAEA,SAAS,aAAa,MAAA,EAAwC;AAC5D,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,KAAO,OAAO,CAAA,KAAM,QAAA,GAAW,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,IAAI,CAAE,CAAA;AACnF,EAAA,OAAO,MAAA,CAAOF,aAAAA,CAAK,6BAAA,CAA8B,KAAK,CAAC,CAAA;AACzD;AAEO,SAAS,SAAS,IAAA,EAAoB;AAC3C,EAAA,MAAM,gBAA0BG,iBAAA,CAAS,KAAA;AAAA,IACtC,KAAA,CAAM,QAAQ,IAAA,CAAK,QAAQ,IAAI,IAAA,CAAK,QAAA,GAAW,CAAC,IAAA,CAAK,QAAQ;AAAA,GAChE;AACA,EAAA,MAAM,gBAAgB,aAAA,CAAc,GAAA,CAAI,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AACxD,EAAA,MAAM,YAAA,GAAe,aAAa,aAAa,CAAA;AAC/C,EAAA,OAAO,YAAA,CAAa;AAAA,IAClB,mBAAA;AAAA,IACA,QAAA,CAAS,KAAK,eAAe,CAAA;AAAA,IAC7B,QAAA,CAASH,aAAAA,CAAK,WAAA,CAAY,IAAA,CAAK,UAAU,CAAC,CAAA;AAAA,IAC1C;AAAA,GACD,CAAA;AACH;AAEO,SAAS,UAAU,KAAA,EAAuB;AAC/C,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,GAAA,CAAI,QAAQ,CAAA;AACrC,EAAA,OAAO,aAAa,UAAU,CAAA;AAChC;AAEO,SAAS,mBAAmB,WAAA,EAAsC;AACvE,EAAA,OAAO,YAAA,CAAa;AAAA,IAClB,8BAAA;AAAA,IACA,OAAOI,sBAAc,CAAA;AAAA,IACrBC,yBAAA;AAAA,IACA,SAAS,WAAW,CAAA;AAAA,IACpBC;AAAA,GACD,CAAA;AACH;AAEO,SAAS,2BAA2B,EAAA,EAA8B;AACvE,EAAA,MAAM,cAAA,GAAiB,SAAA,CAAU,EAAA,CAAG,KAAK,CAAA;AACzC,EAAA,OAAO,YAAA,CAAa;AAAA,IAClB,gCAAA;AAAA,IACA,QAAA,CAAS,GAAG,MAAM,CAAA;AAAA,IAClB,QAAA,CAAS,GAAG,KAAK,CAAA;AAAA,IACjB,EAAA,CAAG,aAAA;AAAA,IACH,EAAA,CAAG,cAAA;AAAA,IACH;AAAA,GACD,CAAA;AACH;AAOO,SAAS,iBAAA,CACd,EAAA,EACA,eAAA,EACA,WAAA,EACQ;AACR,EAAA,MAAM,UAAA,GAAa,mBAAmB,WAAW,CAAA;AACjD,EAAA,MAAM,UAAA,GAAa,2BAA2B,EAAE,CAAA;AAChD,EAAA,OAAO,YAAA,CAAa;AAAA,IAClB,OAAOC,+BAAuB,CAAA;AAAA,IAC9B,UAAA;AAAA,IACA,SAAS,eAAe,CAAA;AAAA,IACxB;AAAA,GACD,CAAA;AACH;AAOO,SAAS,0BAA0B,CAAA,EAAuB;AAC/D,EAAA,MAAM,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,IAAI,GAAG,CAAA;AAC3C,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAA;AACrC;AArJA,IAmBa,gCAAA,CAAA,CAGA,mBAAA,CAAA,CAGA,8BAAA,CAAA,CAGAA,wCAAA,CAAA,CAEAH,+BAAA,CAAA,CACAC,kCAAA,CAAA,CACAC,mCAAA,CAAA,CAEAE,yCAAA,CAAA,CACAC,sCAAA,CAAA,CACAC,yCAAA,CAAA,CAGAC,4BAAA,CAAA,CAGAC,2BAAA,CAAA,CAIAV;AA9Cb,IAAA,gBAAA,GAAA,KAAA,CAAA;AAAA,EAAA,yBAAA,GAAA;AAmBO,IAAM,gCAAA,GACX,iEAAA;AAEK,IAAM,mBAAA,GACX,kEAAA;AAEK,IAAM,8BAAA,GACX,kEAAA;AAEK,IAAMK,+BAAA,GAA0BN,oBAAAA,CAAY,iBAAA,CAAkB,kBAAkB,CAAA;AAEhF,IAAMG,sBAAA,GAAiBH,oBAAAA,CAAY,iBAAA,CAAkB,8BAA8B,CAAA;AACnF,IAAMI,yBAAA,GAAoB,EAAA;AAC1B,IAAMC,0BAAA,GAAqB,EAAA;AAE3B,IAAME,gCAAA,GAA2BP,oBAAAA,CAAY,iBAAA,CAAkB,cAAc,CAAA;AAC7E,IAAMQ,6BAAA,GAAwBR,oBAAAA,CAAY,iBAAA,CAAkB,WAAW,CAAA;AACvE,IAAMS,gCAAA,GAA2BT,oBAAAA,CAAY,iBAAA,CAAkB,cAAc,CAAA;AAG7E,IAAMU,mBAAA,GAAc,MAAA;AAAA,MACzB;AAAA,KACF;AACO,IAAMC,kBAAA,GAAa,MAAA;AAAA,MACxB;AAAA,KACF;AAEO,IAAMV,+BAAA,GAA0B,YAAA;AAAA,EAAA;AAAA,CAAA,CAAA;AC+BhC,SAAS,4BAA4B,QAAA,EAA4B;AACtE,EAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,wEAAA,EAA2E,SAAS,MAAM,CAAA;AAAA,KAC5F;AAAA,EACF;AACA,EAAA,MAAM,GAAA,GAAM,SAAS,CAAC,CAAA;AACtB,EAAA,IAAI,QAAQ,aAAA,EAAe;AACzB,IAAA,IAAI,QAAQ,gBAAA,EAAkB;AAC5B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,sBAAsB,GAAG,CAAA;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,qDAAqD,OAAA,IAAW,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,EAAE,CAAC,CAAA;AAAA,KACzF;AAAA,EACF;AACA,EAAA,OAAO,SAAS,CAAC,CAAA;AACnB;AAEA,SAAS,sBAAsB,IAAA,EAA6B;AAC1D,EAAA,IAAI;AACF,IAAA,OAAOD,qBAAY,iBAAA,CAAkB,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAuBO,SAAS,uBAAuB,IAAA,EAAgD;AACrF,EAAA,MAAM,EAAE,gBAAe,GAAI,IAAA;AAE3B,EAAA,IAAI,cAAA,CAAe,SAASY,4BAAA,EAAsB;AAChD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,sBAAA,EAAyBA,4BAAoB,CAAA,sBAAA,EACpC,cAAA,CAAe,MAAM,CAAA,mDAAA;AAAA,KAEhC;AAAA,EACF;AAQA,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AACnC,EAAA,MAAM,MAAgB,CAAC,gBAAA,EAAkB,MAAA,CAAO,cAAA,CAAe,MAAM,CAAC,CAAA;AAEtE,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,cAAA,CAAe,QAAQ,CAAA,EAAA,EAAK;AAC9C,IAAA,MAAM,GAAA,GAAM,eAAe,CAAC,CAAA;AAC5B,IAAA,MAAM,OAAA,GAAU,4BAA4B,GAAG,CAAA;AAC/C,IAAA,MAAM,GAAA,GAAM,QAAQ,QAAA,EAAS;AAC7B,IAAA,IAAI,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA,EAAG;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,8BAA8B,IAAA,GAAO,OAAA,CAAQ,SAAS,EAAE,CAAC,sBAAsB,CAAC,CAAA;AAAA,OAClF;AAAA,IACF;AACA,IAAA,UAAA,CAAW,IAAI,GAAG,CAAA;AAClB,IAAA,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,MAAM,CAAC,CAAA;AAC3B,IAAA,KAAA,MAAW,QAAQ,GAAA,EAAK;AACtB,MAAA,IAAI,OAAO,EAAA,EAAI;AACb,QAAA,MAAM,IAAI,UAAA;AAAA,UACR,oBAAoB,CAAC,CAAA,qDAAA;AAAA,SACvB;AAAA,MACF;AACA,MAAA,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA,IACf;AAAA,EACF;AAEA,EAAA,OAAO,GAAA;AACT;AAmBO,SAAS,uBAAuB,QAAA,EAErC;AACA,EAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yDAAA,EAA4D,QAAA,CAAS,MAAM,CAAA,CAAE,CAAA;AAAA,EAC/F;AACA,EAAA,IAAI,QAAA,CAAS,CAAC,CAAA,KAAM,gBAAA,EAAkB;AACpC,IAAA,MAAM,IAAI,MAAM,CAAA,iDAAA,EAAoD,QAAA,CAAS,CAAC,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA,CAAE,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,QAAA,CAAS,CAAC,CAAC,CAAA;AAC5B,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,CAAC,CAAA,IAAK,IAAIA,4BAAA,EAAsB;AACpD,IAAA,MAAM,IAAI,MAAM,CAAA,gCAAA,EAAmCA,4BAAoB,SAAS,QAAA,CAAS,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/F;AAMA,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AACnC,EAAA,MAAM,iBAA6B,EAAC;AACpC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,IAAI,MAAA,IAAU,SAAS,MAAA,EAAQ;AAC7B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oCAAA,EAAuC,CAAC,CAAA,iBAAA,CAAmB,CAAA;AAAA,IAC7E;AACA,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,MAAM,CAAC,CAAA;AACtC,IAAA,MAAA,IAAU,CAAA;AACV,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA,IAAK,SAAS,CAAA,EAAG;AAC3C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,cAAA,EAAiB,CAAC,CAAA,2BAAA,EAA8B,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1E;AACA,IAAA,IAAI,MAAA,GAAS,MAAA,GAAS,QAAA,CAAS,MAAA,EAAQ;AACrC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,cAAA,EAAiB,CAAC,CAAA,kCAAA,EAAqC,MAAM,YACjD,MAAM,CAAA,QAAA,EAAW,SAAS,MAAM,CAAA,CAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,MAAA,EAAQ,SAAS,MAAM,CAAA;AACpD,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,IAAI,OAAO,EAAA,EAAI;AACb,QAAA,MAAM,IAAI,UAAA;AAAA,UACR,iBAAiB,CAAC,CAAA,qDAAA;AAAA,SACpB;AAAA,MACF;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,4BAA4B,KAAK,CAAA;AACjD,IAAA,MAAM,GAAA,GAAM,QAAQ,QAAA,EAAS;AAC7B,IAAA,IAAI,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA,EAAG;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,8BAA8B,IAAA,GAAO,OAAA,CAAQ,SAAS,EAAE,CAAC,sBAAsB,CAAC,CAAA;AAAA,OAClF;AAAA,IACF;AACA,IAAA,UAAA,CAAW,IAAI,GAAG,CAAA;AAClB,IAAA,cAAA,CAAe,KAAK,KAAK,CAAA;AACzB,IAAA,MAAA,IAAU,MAAA;AAAA,EACZ;AACA,EAAA,IAAI,MAAA,KAAW,SAAS,MAAA,EAAQ;AAC9B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,sCAAsC,CAAA,GAAI,CAAC,YAAY,MAAM,CAAA,SAAA,EACjD,SAAS,MAAM,CAAA,CAAA;AAAA,KAC7B;AAAA,EACF;AACA,EAAA,OAAO,EAAE,cAAA,EAAe;AAC1B;AAsBO,SAAS,6BACd,MAAA,EACQ;AACR,EAAA,IAAI,MAAA,CAAO,SAASA,4BAAA,EAAsB;AACxC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,sBAAA,EAAyBA,4BAAoB,CAAA,uCAAA,EACrB,MAAA,CAAO,MAAM,CAAA;AAAA,KACvC;AAAA,EACF;AACA,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,KAAA,MAAW,EAAE,UAAA,EAAW,IAAK,MAAA,EAAQ;AACnC,IAAA,MAAM,QAAA,GAAWC,8BAAuB,UAAU,CAAA;AAClD,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,+BAA+B,UAAU,CAAA,2CAAA;AAAA,OAC3C;AAAA,IACF;AACA,IAAA,KAAA,IAAS,QAAA;AAAA,EACX;AACA,EAAA,OAAO,KAAA;AACT;AApSA,IA0DM,eACA,gBAAA,CAAA,CAGOD;AA9Db,IAAA,cAAA,GAAA,KAAA,CAAA;AAAA,EAAA,uBAAA,GAAA;AAoDA,IAAA,gBAAA,EAAA;AAMA,IAAM,aAAA,GAAgB,OAAOJ,6BAAqB,CAAA;AAClD,IAAM,gBAAA,GAAmB,OAAOC,gCAAwB,CAAA;AAGjD,IAAMG,4BAAA,GAAuB,CAAA;AAAA,EAAA;AAAA,CAAA,CAAA;;;AC9DpC,IAAA,UAAA,GAAA,EAAA;AAAA,QAAA,CAAA,UAAA,EAAA;AAAA,EAAA,eAAA,EAAA,MAAAE,uBAAA;AAAA,EAAA,8BAAA,EAAA,MAAAC,sCAAA;AAAA,EAAA,kCAAA,EAAA,MAAA,kCAAA;AAAA,EAAA,qBAAA,EAAA,MAAA,qBAAA;AAAA,EAAA,aAAA,EAAA,MAAA,aAAA;AAAA,EAAA,oBAAA,EAAA,MAAA,oBAAA;AAAA,EAAA,uBAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AA0DO,SAAS,sBAAsB,MAAA,EAqBjB;AACnB,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAC,CAAA;AACnD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,YAAA,IAAgB,MAAA,GAAS,OAAO,kCAAkC,CAAA;AAOvF,EAAA,MAAM,MAAA,GACJ,OAAO,aAAA,IACP,MAAA,GAAS,OAAOA,sCAA8B,CAAA,GAAI,OAAO,kCAAkC,CAAA;AAC7F,EAAA,IAAI,UAAU,KAAA,EAAO;AAGnB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,CAAA,8CAAA,EAAiD,KAAK,CAAA,EAAA;AAAA,KAChF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,GAAS,KAAA,GAAQ,MAAA,CAAOA,sCAA8B,CAAA,EAAG;AAC3D,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mBAAA,EAAsB,MAAA,GAAS,KAAK,CAAA,cAAA,EAAiBA,sCAA8B,CAAA,oCAAA;AAAA,KACrF;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,OAAO,MAAA,IAAUD,uBAAA;AAAA,IACzB,OAAO,MAAA,CAAO,KAAA;AAAA,IACd,aAAA,EAAe,KAAA;AAAA,IACf,cAAA,EAAgB,MAAA;AAAA,IAChB,OAAO,MAAA,CAAO;AAAA,GAChB;AACF;AAUO,SAAS,aAAA,CACd,EAAA,EACA,cAAA,EACA,OAAA,EACQ;AACR,EAAA,OAAO,iBAAA,CAAkB,EAAA,EAAI,cAAA,EAAgB,OAAO,CAAA;AACtD;AAyBO,SAAS,qBAAqB,MAAA,EAKxB;AACX,EAAA,MAAM,GAAA,GACJ,OAAO,MAAA,CAAO,OAAA,KAAY,QAAA,GACtB,MAAA,CAAO,OAAA,GACP,MAAA,CAAOd,oBAAAA,CAAY,iBAAA,CAAkB,MAAA,CAAO,OAAO,CAAC,CAAA;AAC1D,EAAA,OAAO;AAAA,IACL,OAAOQ,6BAAqB,CAAA;AAAA,IAC5B,MAAA,CAAO,OAAA;AAAA,IACP,GAAA;AAAA,IACA,GAAG,MAAA,CAAO,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA,CAAO,CAAC,CAAE;AAAA,GACtE;AACF;AA0BO,SAAS,wBAAwB,cAAA,EAAsC;AAC5E,EAAA,OAAO,sBAAA,CAAuB,EAAE,cAAA,EAAgB,CAAA;AAClD;AAtKaM,kCAOAC,+CAAA,CAAA,KAeA;AAnDb,IAAA,OAAA,GAAA,KAAA,CAAA;AAAA,EAAA,gBAAA,GAAA;AAiBA,IAAA,gBAAA,EAAA;AAmKA,IAAA,cAAA,EAAA;AAvJO,IAAMD,uBAAA,GAAkB,MAAA,CAAOd,oBAAAA,CAAY,iBAAA,CAAkB,YAAY,CAAC,CAAA;AAO1E,IAAMe,sCAAA,GAAiC,IAAI,EAAA,GAAK,EAAA;AAehD,IAAM,kCAAA,GAAqC,EAAA;AAAA,EAAA;AAAA,CAAA,CAAA;ACTlD,eAAe,gBAAA,GAAqD;AAClE,EAAA,IAAI,mBAAmB,OAAO,iBAAA;AAC9B,EAAA,MAAM,WAAW,YAAY;AAC3B,IAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAQ,CAAA;AACpC,IAAA,MAAM,OAAO,IAAA,EAAK;AAClB,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,GAAG;AACH,EAAA,iBAAA,GAAoB,OAAA;AACpB,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA;AAAA,EACf,SAAS,GAAA,EAAK;AAGZ,IAAA,IAAI,iBAAA,KAAsB,SAAS,iBAAA,GAAoB,IAAA;AACvD,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAOA,SAAS,cAAc,KAAA,EAAkD;AACvE,EAAA,IAAI,KAAA,CAAM,WAAW,EAAA,EAAI;AACvB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4CAAA,EAA+C,KAAA,CAAM,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAChF;AACA,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,IAAI,IAAA,GAAO,EAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK,GAAA,IAAO,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAA,IAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AACpE,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,KAAK,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,EAAA,GAAK,CAAC,CAAC,CAAA,IAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAC1E,EAAA,OAAO,EAAE,KAAK,IAAA,EAAK;AACrB;AAEA,SAAS,gBAAgB,KAAA,EAA2B;AAClD,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG,CAAA,IAAK,CAAA,EAAG,CAAA,EAAA,EAAK,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAA;AAC3E,EAAA,OAAO,CAAA;AACT;AAUO,SAAS,mBAAmB,WAAA,EAAiC;AAClE,EAAA,OAAO,0BAA0B,WAAW,CAAA;AAC9C;AAQO,SAAS,eAAe,SAAA,EAA+B;AAC5D,EAAA,MAAM,EAAE,GAAA,EAAK,IAAA,EAAK,GAAI,cAAc,SAAS,CAAA;AAC7C,EAAA,OAAO,eAAA,CAAgB,qBAAA,EAAuB,CAAC,GAAA,EAAK,IAAI,CAAC,CAAA;AAC3D;AAOO,SAAS,mBAAmB,SAAA,EAAiC;AAClE,EAAA,MAAM,EAAE,GAAA,EAAK,IAAA,EAAK,GAAI,cAAc,SAAS,CAAA;AAC7C,EAAA,OAAO,CAAC,KAAK,IAAI,CAAA;AACnB;AAUO,SAAS,wBAAwB,SAAA,EAA+B;AACrE,EAAA,OAAO,kBAAA,CAAmB,SAAS,CAAA,CAChC,GAAA,CAAI,CAAC,CAAA,KAAM,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA,CAChC,KAAK,GAAG,CAAA;AACb;AAeA,eAAsB,qBAAqB,MAAA,EAYrB;AAIpB,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AACjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,oCAAoC,UAAU,CAAA,0KAAA;AAAA,KAGhD;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,MAAA,KAAW,EAAA,EAAI;AACnC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,kDAAA,EAAqD,MAAA,CAAO,UAAA,CAAW,MAAM,CAAA,CAAA;AAAA,KAC/E;AAAA,EACF;AAGA,EAAA,MAAM,EAAA,GAAK,MAAM,OAAO,gBAAgB,CAAA;AAExC,EAAA,MAAM,SAAA,GAAY,MAAM,EAAA,CAAG,iBAAA,CAAkB,OAAO,UAAU,CAAA;AAC9D,EAAA,MAAM,WAAA,GAAc,kBAAA,CAAmB,MAAA,CAAO,WAAW,CAAA;AACzD,EAAA,MAAM,YAAY,MAAM,EAAA,CAAG,SAAA,CAAU,WAAA,EAAa,OAAO,UAAU,CAAA;AAGnE,EAAA,OAAO,uBAAA,CAAwB;AAAA,IAC7B,CAAA,EAAG,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,IACxB,CAAA,EAAG,SAAA,CAAU,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA;AAAA,IACzB,SAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAiCA,eAAsB,kCAAkC,MAAA,EAalC;AAEpB,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AACjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,iDAAiD,UAAU,CAAA,sJAAA;AAAA,KAG7D;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,SAAA,CAAU,MAAA,KAAW,EAAA,EAAI;AAClC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,2DAAA,EAAyD,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA,CAAA;AAAA,KAClF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,SAAA,CAAU,MAAA,KAAW,EAAA,EAAI;AAClC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iDAAA,EAAoD,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAChG;AAEA,EAAA,MAAM,WAAA,GAAc,kBAAA,CAAmB,MAAA,CAAO,WAAW,CAAA;AACzD,EAAA,OAAO,uBAAA,CAAwB;AAAA,IAC7B,CAAA,EAAG,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,GAAG,EAAE,CAAA;AAAA,IAC/B,CAAA,EAAG,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,IAAI,EAAE,CAAA;AAAA,IAChC,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,WAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AASA,eAAe,wBAAwB,KAAA,EAMjB;AACpB,EAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,EAAiB;AAOtC,EAAA,MAAM,UAAW,MAAA,CAAe,oBAAA;AAAA,IAC9B,eAAA,CAAgB,MAAM,CAAC,CAAA;AAAA,IACvB,eAAA,CAAgB,MAAM,CAAC,CAAA;AAAA,IACvB,eAAA,CAAgB,MAAM,SAAS,CAAA;AAAA,IAC/B,KAAA,CAAM,WAAA;AAAA,IACN;AAAA,GACF;AAEA,EAAA,OAAO,oBAAA,CAAqB;AAAA,IAC1B,SAAS,KAAA,CAAM,UAAA;AAAA,IACf,OAAA,EAAS,gBAAA;AAAA,IACT;AAAA,GACD,CAAA;AACH;AAxSA,IA8BM,kBACA,qBAAA,EAEF,iBAAA;AAjCJ,IAAA,YAAA,GAAA,KAAA,CAAA;AAAA,EAAA,6BAAA,GAAA;AA0BA,IAAA,2BAAA,EAAA;AACA,IAAA,OAAA,EAAA;AACA,IAAA,gBAAA,EAAA;AAEA,IAAM,gBAAA,GAAmB,SAAA;AACzB,IAAM,qBAAA,GAAwB,MAAA,CAAOf,oBAAAA,CAAY,iBAAA,CAAkB,gBAAgB,CAAC,CAAA;AAEpF,IAAI,iBAAA,GAA6D,IAAA;AAAA,EAAA;AAAA,CAAA,CAAA;AC/BpDgB,kCAAA,CAAA,CAQAC;AAVb,IAAA,eAAA,GAAA,KAAA,CAAA;AAAA,EAAA,uBAAA,GAAA;AAEO,IAAMD,yBAAA,GAAoB,CAAC,UAAA,EAAoB,QAAA,KAA6B;AACjF,MAAA,IAAI,CAAC,UAAA,IAAc,CAAC,QAAA,EAAU;AAC5B,QAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,MACzD;AAEA,MAAA,OAAOE,0BAAS,GAAA,CAAI,OAAA,CAAQ,UAAA,EAAY,QAAQ,EAAE,QAAA,EAAS;AAAA,IAC7D,CAAA;AAEO,IAAMD,yBAAA,GAAoB,CAAC,mBAAA,EAA6B,QAAA,KAA6B;AAC1F,MAAA,IAAI,CAAC,mBAAA,IAAuB,CAAC,QAAA,EAAU;AACrC,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MACnE;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAQC,yBAAA,CAAS,GAAA,CAAI,OAAA,CAAQ,qBAAqB,QAAQ,CAAA;AAChE,QAAA,MAAM,SAAA,GAAY,KAAA,CAAM,QAAA,CAASA,yBAAA,CAAS,IAAI,IAAI,CAAA;AAClD,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,QACvD;AACA,QAAA,OAAO,SAAA;AAAA,MACT,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,UAAA,MAAM,KAAA;AAAA,QACR;AACA,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,MAC/C;AAAA,IACF,CAAA;AAAA,EAAA;AAAA,CAAA,CAAA;;;AC5BA,IAAAC,gBAAAA,GAAA,KAAA,CAAA;AAAA,EAAA,mBAAA,GAAA;AAAA,IAAA,eAAA,EAAA;AAAA,EAAA;AAAA,CAAA,CAAA;;;ACAA,IAAA,aAAA,GAAA,EAAA;AAAA,QAAA,CAAA,aAAA,EAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,gBAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AAwCO,SAAS,mBAAmB,MAAA,EAatB;AAGX,EAAA,MAAM,QACJ,IAAA,GAAA,CACC,OAAO,MAAA,CAAO,UAAA,KAAe,WAAW,MAAA,CAAO,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,UAAU,CAAA,EAClF,QAAA,CAAS,EAAE,CAAA,CACX,QAAA,CAAS,IAAI,GAAG,CAAA;AAErB,EAAA,MAAM,GAAA,GAAMC,WAAA,CAAG,UAAA,CAAW,IAAA,CAAK,IAAA,GAAO,OAAO,WAAA,CAAY,QAAA,CAAS,EAAE,CAAA,EAAG,KAAK,CAAA;AAE5E,EAAA,MAAM,IAAI,MAAA,CAAO,IAAA,GAAO,IAAI,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA;AAC1C,EAAA,MAAM,IAAI,MAAA,CAAO,IAAA,GAAO,IAAI,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA;AAE1C,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AAGjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,kCAAkC,UAAU,CAAA,0KAAA;AAAA,KAG9C;AAAA,EACF;AAEA,EAAA,OAAO,oBAAA,CAAqB;AAAA,IAC1B,OAAA,EAAS,UAAA;AAAA,IACT,OAAA,EAAS,cAAA;AAAA,IACT,OAAA,EAAS,CAAC,CAAA,EAAG,CAAC;AAAA,GACf,CAAA;AACH;AAQO,SAAS,aAAa,WAAA,EAA6B;AACxD,EAAA,OAAO,eAAA,CAAgB,mBAAA,EAAqB,CAAC,WAAW,CAAC,CAAA;AAC3D;AAQO,SAAS,iBAAiB,WAAA,EAAwC;AACvE,EAAA,OAAO,CAAC,OAAO,WAAA,KAAgB,WAAW,WAAA,GAAc,MAAA,CAAO,WAAW,CAAC,CAAA;AAC7E;AAvGA,IAiBM,cAAA,EACA,mBAAA;AAlBN,IAAA,UAAA,GAAA,KAAA,CAAA;AAAA,EAAA,2BAAA,GAAA;AAcA,IAAA,2BAAA,EAAA;AACA,IAAA,OAAA,EAAA;AAEA,IAAM,cAAA,GAAiB,OAAA;AACvB,IAAM,mBAAA,GAAsB,MAAA,CAAOpB,oBAAAA,CAAY,iBAAA,CAAkB,cAAc,CAAC,CAAA;AAAA,EAAA;AAAA,CAAA,CAAA;;;AClBhF,IAAA,6BAAA,GAAA,EAAA;AAAA,QAAA,CAAA,6BAAA,EAAA;AAAA,EAAA,uBAAA,EAAA,MAAA,uBAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,qCAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AAmDO,SAAS,mBAAmB,MAAA,EAGxB;AACT,EAAA,IAAI,MAAA,CAAO,aAAa,MAAA,EAAW;AACjC,IAAA,OAAO,OAAO,MAAA,CAAO,QAAA,KAAa,QAAA,GAC9B,IAAA,GAAO,OAAO,QAAA,CAAS,QAAA,CAAS,EAAE,CAAA,GAClC,MAAA,CAAO,QAAA;AAAA,EACb;AACA,EAAA,MAAM,GAAA,GAAA,CAAO,MAAA,CAAO,OAAA,IAAW,EAAA,EAAI,WAAA,EAAY;AAC/C,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,SAAS,CAAA,EAAG,OAAO,mBAAA;AACpC,EAAA,OAAO,gBAAA;AACT;AAyBO,SAAS,sCAAsC,MAAA,EASzC;AACX,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,MAAM,KAAK,MAAA,CAAO,gBAAA;AAElB,EAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,KAAgC,OAAO,MAAM,QAAA,GAAW,CAAA,GAAI,OAAO,CAAC,CAAA;AAEnF,EAAA,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,EAAA,CAAG,MAAM,CAAC,CAAA;AACzB,EAAA,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,EAAA,CAAG,KAAK,CAAC,CAAA;AACxB,EAAA,GAAA,CAAI,IAAA,CAAK,GAAG,aAAa,CAAA;AACzB,EAAA,GAAA,CAAI,IAAA,CAAK,GAAG,cAAc,CAAA;AAE1B,EAAA,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,EAAA,CAAG,KAAA,CAAM,MAAM,CAAC,CAAA;AAChC,EAAA,KAAA,MAAW,IAAA,IAAQ,GAAG,KAAA,EAAO;AAC3B,IAAA,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,eAAe,CAAC,CAAA;AACrC,IAAA,GAAA,CAAI,KAAK,MAAA,CAAOD,aAAAA,CAAK,YAAY,IAAA,CAAK,UAAU,CAAC,CAAC,CAAA;AAClD,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,IAAA,CAAK,QAAQ,CAAA,GACvC,IAAA,CAAK,WACN,EAAC;AACL,IAAA,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,MAAM,CAAC,CAAA;AAChC,IAAA,KAAA,MAAW,SAAS,QAAA,EAAU;AAC5B,MAAA,GAAA,CAAI,KAAK,OAAO,KAAA,KAAU,WAAW,KAAA,GAAQ,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,IAC5D;AAAA,EACF;AAEA,EAAA,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,MAAM,CAAC,CAAA;AACxC,EAAA,KAAA,MAAW,OAAA,IAAW,OAAO,SAAA,EAAW;AACtC,IAAA,GAAA,CAAI,KAAK,OAAO,CAAA;AAAA,EAClB;AAEA,EAAA,OAAO,GAAA,CAAI,IAAI,CAAC,CAAA,KAAM,OAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA;AAC7C;AASA,SAAS,UAAA,GAAqB;AAC5B,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,CAAA;AAC9B,EAAA,MAAM,IAAA,GAAO,OAAO,IAAA,CAAK,KAAA,CAAM,KAAK,MAAA,EAAO,GAAI,QAAQ,CAAC,CAAA;AAIxD,EAAA,OAAQ,QAAQ,GAAA,GAAO,IAAA;AACzB;AAqBA,eAAsB,wBAAwB,MAAA,EA2B1B;AAClB,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,OAAA;AACxC,EAAA,MAAM,oBAAA,GAAuB,CAAC,OAAA,EAAS,SAAS,CAAA;AAChD,EAAA,IAAI,CAAC,oBAAA,CAAqB,QAAA,CAAS,UAAmD,CAAA,EAAG;AACvF,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,oBAAoB,UAAU,CAAA,kKAAA;AAAA,KAGhC;AAAA,EACF;AAEA,EAAA,MAAM,gBAAgBkB,yBAAA,CAAkB,MAAA,CAAO,MAAA,CAAO,mBAAA,EAAqB,OAAO,UAAU,CAAA;AAC5F,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,KAAK,qBAAA,CAAsB;AAAA,IAC/B,KAAA,EAAO,MAAA,CAAO,KAAA,IAAS,UAAA,EAAW;AAAA,IAClC,OAAO,MAAA,CAAO,KAAA;AAAA,IACd,MAAA,EAAQH;AAAA,GACT,CAAA;AAED,EAAA,MAAM,UAAU,kBAAA,CAAmB;AAAA,IACjC,UAAU,MAAA,CAAO,OAAA;AAAA,IACjB,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,GACxB,CAAA;AACD,EAAA,MAAM,cAAc,aAAA,CAAc,EAAA,EAAI,MAAA,CAAO,MAAA,CAAO,WAAW,OAAO,CAAA;AAEtE,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,eAAe,OAAA,EAAS;AAC1B,IAAA,SAAA,GAAY,kBAAA,CAAmB;AAAA,MAC7B,UAAA,EAAY,aAAA;AAAA,MACZ;AAAA,KACD,CAAA;AAAA,EACH,CAAA,MAAO;AAUL,IAAA,MAAM,QAAA,GAAW,cAAc,UAAA,CAAW,IAAI,IAAI,aAAA,CAAc,KAAA,CAAM,CAAC,CAAA,GAAI,aAAA;AAC3E,IAAA,IAAI,QAAA,CAAS,WAAW,EAAA,EAAI;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,4BAAA,EAA+B,SAAS,MAAM,CAAA,yIAAA;AAAA,OAEhD;AAAA,IACF;AACA,IAAA,MAAM,YAAY,UAAA,CAAW,IAAA,CAAK,OAAO,IAAA,CAAK,QAAA,EAAU,KAAK,CAAC,CAAA;AAC9D,IAAA,SAAA,GAAY,MAAM,oBAAA,CAAqB;AAAA,MACrC,UAAA,EAAY,SAAA;AAAA,MACZ;AAAA,KACD,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,WAAW,qCAAA,CAAsC;AAAA,IACrD,gBAAA,EAAkB,EAAA;AAAA,IAClB;AAAA,GACD,CAAA;AAMD,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAGlC;AAAA,IACD,QAAA,EAAU,qCAAA;AAAA,IACV,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,IAAA,EAAM;AAAA,MACJ,cAAA,EAAgB,OAAO,MAAA,CAAO,SAAA;AAAA,MAC9B,QAAA;AAAA,MACA,UAAA;AAAA,MACA,GAAI,OAAO,cAAA,GAAiB,EAAE,gBAAgB,MAAA,CAAO,cAAA,KAAmB;AAAC;AAC3E,GACD,CAAA;AAKD,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,QAAA,CAAS,eAAA,EAAiB;AAC1C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,QAAA,CAAS,eAAA;AAClB;AA3RA,IAwCM,gBAAA,EACA,mBAAA;AAzCN,IAAA,0BAAA,GAAA,KAAA,CAAA;AAAA,EAAA,mCAAA,GAAA;AA4BA,IAAAK,gBAAAA,EAAAA;AAEA,IAAA,OAAA,EAAA;AACA,IAAA,UAAA,EAAA;AACA,IAAA,YAAA,EAAA;AAQA,IAAM,gBAAA,GAAmB,kBAAA;AACzB,IAAM,mBAAA,GAAsB,wBAAA;AAAA,EAAA;AAAA,CAAA,CAAA;AC5BrB,IAAM,cAAN,MAAkB;AAAA,EAOvB,YAAY,MAAA,EAAwB;AAClC,IAAA,IAAI,CAACE,oBAAA,CAAc,MAAA,CAAO,YAAY,CAAA,EAAG;AACvC,MAAA,MAAM,IAAIC,sBAAe,wBAAwB,CAAA;AAAA,IACnD;AAEA,IAAA,IAAA,CAAK,eAAe,MAAA,CAAO,YAAA;AAC3B,IAAA,IAAA,CAAK,iBAAiB,MAAA,CAAO,QAAA;AAC7B,IAAA,IAAA,CAAK,OAAA,GAAU,KAAK,UAAA,EAAW;AAC/B,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA,CAAO,OAAA,IAAWC,wBAAA,CAAkB,OAAA;AACnD,IAAA,IAAA,CAAK,UAAA,GAAa,QAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA,EAKA,eAAA,GAA0B;AACxB,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACd;AAAA,EAEQ,UAAA,GAAqB;AAC3B,IAAA,MAAM,OAAA,GAAU,CAAA,CAAA,EAAIC,qBAAA,CAAe,OAAO,CAAA,CAAA;AAE1C,IAAA,IAAI,KAAK,cAAA,EAAgB;AAEvB,MAAA,MAAM,QAAA,GAAW,KAAK,cAAA,CAAe,OAAA,CAAQ,cAAc,EAAE,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAChF,MAAA,OAAO,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AAAA,IAC/B;AAEA,IAAA,OAAO,4BAA4B,OAAO,CAAA,CAAA;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,iBAAiB,GAAA,EAAgB;AACvC,IAAA,GAAA,CAAI,YAAA,CAAa,MAAA,CAAO,qBAAA,EAAuBA,qBAAA,CAAe,YAAY,CAAA;AAAA,EAC5E;AAAA,EAEQ,WAAW,WAAA,EAA8C;AAC/D,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,cAAA,EAAgB,kBAAA;AAAA,MAChB,aAAa,IAAA,CAAK;AAAA,KACpB;AAEA,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,WAAW,CAAA,CAAA;AAAA,IAClD;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAM,GAAA,CAAO;AAAA,IACX,QAAA;AAAA,IACA,MAAA;AAAA,IACA;AAAA,GACF,EAIe;AACb,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,EAAG,KAAK,OAAO,CAAA,EAAG,QAAQ,CAAA,CAAE,CAAA;AAGhD,MAAA,IAAA,CAAK,iBAAiB,GAAG,CAAA;AAEzB,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,OAAA,CAAQ,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM;AAC/C,UAAA,IAAI,KAAA,KAAU,KAAA,CAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACzC,YAAA,GAAA,CAAI,YAAA,CAAa,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,UAC5C;AAAA,QACF,CAAC,CAAA;AAAA,MACH;AAEA,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,UAAS,EAAG;AAAA,QAC3C,MAAA,EAAQ,KAAA;AAAA,QACR,OAAA,EAAS,IAAA,CAAK,UAAA,CAAW,WAAW;AAAA,OACrC,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,SAAA,GAAYC,6BAAsB,IAAI,CAAA;AAC5C,QAAA,MAAM,IAAIC,oBAAA;AAAA,UACR,SAAA,CAAU,OAAA;AAAA,UACV,SAAA,CAAU,IAAA,IAAQ,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAAA,UACzC,QAAA,CAAS,MAAA;AAAA,UACT;AAAA,SACF;AAAA,MACF;AAEA,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAMC,sBAAe,KAAK,CAAA;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,IAAA,CAAQ;AAAA,IACZ,QAAA;AAAA,IACA,WAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACF,EAMe;AACb,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,EAAG,KAAK,OAAO,CAAA,EAAG,QAAQ,CAAA,CAAE,CAAA;AAGhD,MAAA,IAAA,CAAK,iBAAiB,GAAG,CAAA;AAEzB,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,UAAS,EAAG;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,GAAG,OAAA,EAAS,GAAG,IAAA,CAAK,UAAA,CAAW,WAAW,CAAA,EAAE;AAAA,QACvD,IAAA,EAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,GAAI,KAAA;AAAA,OACrC,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,SAAA,GAAYF,6BAAsB,IAAI,CAAA;AAC5C,QAAA,MAAM,IAAIC,oBAAA;AAAA,UACR,SAAA,CAAU,OAAA;AAAA,UACV,SAAA,CAAU,IAAA,IAAQ,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAAA,UACzC,QAAA,CAAS,MAAA;AAAA,UACT;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAMC,sBAAe,KAAK,CAAA;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,GAAA,CAAO;AAAA,IACX,QAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF,EAIe;AACb,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,EAAG,KAAK,OAAO,CAAA,EAAG,QAAQ,CAAA,CAAE,CAAA;AAGhD,MAAA,IAAA,CAAK,iBAAiB,GAAG,CAAA;AAEzB,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,UAAS,EAAG;AAAA,QAC3C,MAAA,EAAQ,KAAA;AAAA,QACR,OAAA,EAAS,IAAA,CAAK,UAAA,CAAW,WAAW,CAAA;AAAA,QACpC,IAAA,EAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,GAAI,KAAA;AAAA,OACrC,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,SAAA,GAAYF,6BAAsB,IAAI,CAAA;AAC5C,QAAA,MAAM,IAAIC,oBAAA;AAAA,UACR,SAAA,CAAU,OAAA;AAAA,UACV,SAAA,CAAU,IAAA,IAAQ,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAAA,UACzC,QAAA,CAAS,MAAA;AAAA,UACT;AAAA,SACF;AAAA,MACF;AAEA,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAMC,sBAAe,KAAK,CAAA;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,KAAA,CAAS;AAAA,IACb,QAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF,EAIe;AACb,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,EAAG,KAAK,OAAO,CAAA,EAAG,QAAQ,CAAA,CAAE,CAAA;AAGhD,MAAA,IAAA,CAAK,iBAAiB,GAAG,CAAA;AAEzB,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,UAAS,EAAG;AAAA,QAC3C,MAAA,EAAQ,OAAA;AAAA,QACR,OAAA,EAAS,IAAA,CAAK,UAAA,CAAW,WAAW,CAAA;AAAA,QACpC,IAAA,EAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,GAAI,KAAA;AAAA,OACrC,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,SAAA,GAAYF,6BAAsB,IAAI,CAAA;AAC5C,QAAA,MAAM,IAAIC,oBAAA;AAAA,UACR,SAAA,CAAU,OAAA;AAAA,UACV,SAAA,CAAU,IAAA,IAAQ,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAAA,UACzC,QAAA,CAAS,MAAA;AAAA,UACT;AAAA,SACF;AAAA,MACF;AAEA,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAMC,sBAAe,KAAK,CAAA;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,MAAA,CAAU;AAAA,IACd,QAAA;AAAA,IACA;AAAA,GACF,EAGe;AACb,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,EAAG,KAAK,OAAO,CAAA,EAAG,QAAQ,CAAA,CAAE,CAAA;AAGhD,MAAA,IAAA,CAAK,iBAAiB,GAAG,CAAA;AAEzB,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,UAAS,EAAG;AAAA,QAC3C,MAAA,EAAQ,QAAA;AAAA,QACR,OAAA,EAAS,IAAA,CAAK,UAAA,CAAW,WAAW;AAAA,OACrC,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,SAAA,GAAYF,6BAAsB,IAAI,CAAA;AAC5C,QAAA,MAAM,IAAIC,oBAAA;AAAA,UACR,SAAA,CAAU,OAAA;AAAA,UACV,SAAA,CAAU,IAAA,IAAQ,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAAA,UACzC,QAAA,CAAS,MAAA;AAAA,UACT;AAAA,SACF;AAAA,MACF;AAEA,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAMC,sBAAe,KAAK,CAAA;AAAA,IAC5B;AAAA,EACF;AACF;;;ACnPA,2BAAA,EAAA;AACA,YAAA,EAAA;AAeAR,gBAAAA,EAAAA;;;ACKAA,gBAAAA,EAAAA;;;ACzCAA,gBAAAA,EAAAA;ACMA,SAAS,sBAAsB,QAAA,EAG7B;AACA,EAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AAC7C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,eAAe,QAAA,EAAU;AAC3B,IAAA,MAAM,IAAA,GAAO,QAAA;AACb,IAAA,IACE,CAAC,IAAA,CAAK,SAAA,IACN,OAAO,KAAK,SAAA,KAAc,QAAA,IAC1B,EAAE,OAAA,IAAW,IAAA,CAAK,SAAA,CAAA,IAClB,EAAE,SAAA,IAAa,KAAK,SAAA,CAAA,EACpB;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,EAAW,UAAA,EAAY,KAAK,UAAA,EAAW;AAAA,EAClE;AAGA,EAAA,IAAI,OAAA,IAAW,QAAA,IAAY,SAAA,IAAa,QAAA,EAAU;AAChD,IAAA,OAAO,EAAE,WAAW,QAAA,EAAsB;AAAA,EAC5C;AAGA,EAAA,MAAM,aACJ,OAAQ,QAAA,CAAiB,OAAA,KAAY,QAAA,GAAY,SAAiB,OAAA,GAAU,MAAA;AAE9E,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,UAAA,IAAc;AAAA,GAChB;AACF;AAMO,SAAS,mBAAmB,SAAA,EAA8C;AAE/E,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC5B,IAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACxB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mDAAA,EAAsD,SAAA,CAAU,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1F;AACA,IAAA,MAAM,CAAA,GAAI,UAAU,CAAC,CAAA;AACrB,IAAA,MAAM,CAAA,GAAI,UAAU,CAAC,CAAA;AACrB,IAAA,IAAI,CAAA,IAAK,IAAA,IAAQ,CAAA,IAAK,IAAA,EAAM;AAC1B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qDAAA,EAAwD,CAAC,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,IACrF;AACA,IAAA,OAAO,EAAE,GAAG,MAAA,CAAO,CAAC,GAAG,CAAA,EAAG,MAAA,CAAO,CAAC,CAAA,EAAE;AAAA,EACtC;AAGA,EAAA,IAAI,aAAa,OAAO,SAAA,KAAc,YAAY,GAAA,IAAO,SAAA,IAAa,OAAO,SAAA,EAAW;AACtF,IAAA,MAAM,GAAA,GAAM,SAAA;AACZ,IAAA,IAAI,GAAA,CAAI,CAAA,IAAK,IAAA,IAAQ,GAAA,CAAI,KAAK,IAAA,EAAM;AAClC,MAAA,MAAM,IAAI,MAAM,CAAA,kDAAA,EAAqD,GAAA,CAAI,CAAC,CAAA,IAAA,EAAO,GAAA,CAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IAC1F;AACA,IAAA,OAAO;AAAA,MACL,CAAA,EAAG,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA;AAAA,MACf,CAAA,EAAG,MAAA,CAAO,GAAA,CAAI,CAAC;AAAA,KACjB;AAAA,EACF;AAEA,EAAA,MAAM,IAAI,MAAM,0DAA0D,CAAA;AAC5E;AAYO,IAAM,wBAAN,MAAwD;AAAA,EAI7D,WAAA,CAAY,QAAqB,WAAA,EAAqB;AACpD,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AAAA,EACrB;AAAA,EAEA,MAAM,OAAA,CAAQ,EAAE,OAAA,EAAS,OAAM,EAAkE;AAE/F,IAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,cAAA,CAAe,QAAQ,OAAO,CAAA;AAC9D,IAAA,MAAM,UAAA,GAAaS,kCAA2B,SAAS,CAAA;AAKvD,IAAA,MAAM,gBAAA,GAAmB,UAAA,GAAaC,0BAAA,CAAoB,UAAU,CAAA,GAAI,SAAA;AAGxE,IAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAA+B;AAAA,MACvE,QAAA,EAAU,kCAAA;AAAA,MACV,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,IAAA,EAAM;AAAA,QACJ,WAAW,OAAA,CAAQ,OAAA;AAAA,QACnB,KAAA;AAAA,QACA;AAAA;AACF,KACD,CAAA;AAGD,IAAA,MAAM,EAAE,SAAA,EAAAC,UAAAA,EAAW,YAAY,kBAAA,EAAmB,GAAI,sBAAsB,eAAe,CAAA;AAG3F,IAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,WAAA,CAAYA,UAAS,CAAA;AAGrD,IAAA,MAAM,aAAA,GAAgB,mBAAmB,SAAS,CAAA;AAGlD,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAA0C;AAAA,MACzE,QAAA,EAAU,6CAAA;AAAA,MACV,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,IAAA,EAAM;AAAA,QACJ,WAAW,OAAA,CAAQ,OAAA;AAAA,QACnB,SAAA,EAAAA,UAAAA;AAAA,QACA,aAAA,EAAe,aAAA;AAAA,QACf,YAAY,kBAAA,IAAsB,UAAA;AAAA,QAClC,cAAA,EAAgB;AAAA;AAClB,KACD,CAAA;AAED,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,aACJ,OAAQ,MAAA,CAAe,OAAA,KAAY,QAAA,GAAY,OAAe,OAAA,GAAU,MAAA;AAE1E,IAAA,IAAI,CAAC,OAAO,eAAA,EAAiB;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,UAAA,IAAc,4CAA4C,CAAA;AAAA,IAC5E;AAEA,IAAA,OAAO,MAAA,CAAO,eAAA;AAAA,EAChB;AACF;;;ADjIO,IAAM,8BAA8B,OAAO;AAAA,EAChD,MAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF,CAAA,KAIuB;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,KAAA,EAAO,cAAA,EAAgB,YAAW,GAAI,MAAA;AAGlE,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,aACI,4GAAA,GACA;AAAA,OACN;AAAA,IACF;AAUA,IAAA,IAAI,UAAA,GAAyB,OAAO,UAAA,IAAc,OAAA;AAClD,IAAA,IAAI,CAAC,OAAO,UAAA,EAAY;AACtB,MAAA,IAAI;AAEF,QAAA,MAAM,mBAAmB,MAAMC,sBAAA;AAAA,UAC7B,CAACC,SAAAA,KAAaA,SAAAA,CAAS,cAAA,CAAe,MAAA,CAAO,WAAW,QAAQ,CAAA;AAAA,UAChE,EAAE,WAAA,EAAaC,2BAAA,CAAqB,KAAA;AAAM,SAC5C;AACA,QAAA,UAAA,GAAaL,iCAAAA,CAA2B,gBAAgB,CAAA,IAAK,OAAA;AAAA,MAC/D,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AASA,IAAA,IAAI,eAAe,MAAA,EAAQ;AACzB,MAAA,MAAM,EAAE,uBAAA,EAAAM,wBAAAA,EAAwB,GAAI,MAAM,OAAA,CAAA,OAAA,EAAA,CAAA,IAAA,CAAA,OAAA,0BAAA,EAAA,EAAA,6BAAA,CAAA,CAAA;AAK1C,MAAA,MAAM,cAAA,GAAA,CAAmB,MAAA,CAAO,UAAA,IAAc,OAAA,KAAY,OAAA;AAC1D,MAAA,OAAO,MAAMA,wBAAAA,CAAwB;AAAA,QACnC,MAAA;AAAA,QACA,WAAA;AAAA,QACA,MAAA,EAAQ;AAAA,UACN,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,qBAAqB,MAAA,CAAO,mBAAA;AAAA,UAC5B,YAAY,MAAA,CAAO;AAAA,SACrB;AAAA,QACA,UAAA;AAAA,QACA,KAAA;AAAA,QACA,UAAA,EAAY;AAAA,OACb,CAAA;AAAA,IACH;AAKA,IAAA,MAAM,WAAA,GACJ,MAAA,CAAO,SAAA,CAAU,cAAA,CAAe,IAAA,CAAKD,2BAAA,EAAsB,UAAU,CAAA,IACrE,MAAA,CAAO,SAAA,CAAU,cAAA,CAAe,IAAA,CAAKJ,4BAAqB,UAAU,CAAA;AAEtE,IAAA,MAAM,SAAS,WAAA,GAAcI,2BAAA,CAAqB,UAAU,CAAA,GAAIA,4BAAqB,OAAO,CAAA;AAC5F,IAAA,MAAM,mBAAmB,WAAA,GACrBJ,0BAAAA,CAAoB,UAAU,CAAA,GAC9BA,2BAAoB,OAAO,CAAA;AAG/B,IAAA,IAAI,mBAAA;AACJ,IAAA,IAAI;AACF,MAAA,mBAAA,GAAsBZ,yBAAA,CAAkB,MAAA,CAAO,mBAAA,EAAqB,UAAU,CAAA;AAAA,IAChF,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,MAAM,kEAAkE,CAAA;AAAA,IACpF;AAEA,IAAA,MAAM,WAAW,IAAIkB,oBAAA,CAAY,EAAE,OAAA,EAAS,QAAQ,CAAA;AAEpD,IAAA,MAAM,OAAA,GAAU,IAAIC,gBAAA,CAAQ;AAAA,MAC1B,QAAA;AAAA,MACA,SAAS,MAAA,CAAO,SAAA;AAAA,MAChB,MAAA,EAAQ;AAAA,KACT,CAAA;AAGD,IAAA,MAAM,eAAA,GAAkB,MAAM,MAAA,CAAO,IAAA,CAA+B;AAAA,MAClE,QAAA,EAAU,kCAAA;AAAA,MACV,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,QACJ,WAAW,MAAA,CAAO,SAAA;AAAA,QAClB,KAAA;AAAA,QACA;AAAA;AACF,KACD,CAAA;AAGD,IAAA,IAAI,CAAC,eAAA,IAAmB,OAAO,eAAA,KAAoB,QAAA,EAAU;AAC3D,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAKA,IAAA,IAAIN,UAAAA;AACJ,IAAA,IAAI,kBAAA;AAEJ,IAAA,IAAI,eAAe,eAAA,EAAiB;AAClC,MAAA,MAAM,IAAA,GAAO,eAAA;AACb,MAAAA,aAAY,IAAA,CAAK,SAAA;AAEjB,MAAA,IACE,IAAA,CAAK,cACL,MAAA,CAAO,SAAA,CAAU,eAAe,IAAA,CAAKD,0BAAAA,EAAqB,IAAA,CAAK,UAAU,CAAA,EACzE;AACA,QAAA,kBAAA,GAAqB,IAAA,CAAK,UAAA;AAAA,MAC5B;AAAA,IACF,CAAA,MAAA,IAAW,eAAA,IAAmB,OAAA,IAAW,eAAA,IAAmB,aAAa,eAAA,EAAiB;AAExF,MAAAC,UAAAA,GAAY,eAAA;AAAA,IACd,CAAA,MAAO;AAEL,MAAA,MAAMO,cACJ,eAAA,IAAmB,OAAQ,gBAAwB,OAAA,KAAY,QAAA,GAC1D,gBAAwB,OAAA,GACzB,KAAA,CAAA;AAEN,MAAA,MAAM,IAAI,KAAA;AAAA,QACRA,WAAAA,IACE;AAAA,OAGJ;AAAA,IACF;AAGA,IAAA,IACE,CAACP,UAAAA,IACD,OAAOA,UAAAA,KAAc,QAAA,IACrB,EAAE,OAAA,IAAWA,UAAAA,CAAAA,IACb,EAAE,SAAA,IAAaA,UAAAA,CAAAA,EACf;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OAEF;AAAA,IACF;AAGA,IAAA,MAAM,aAAA,GAAgB,MAAM,OAAA,CAAQ,WAAA,CAAYA,UAAS,CAAA;AAGzD,IAAA,MAAM,aAAA,GAAgB,mBAAmB,aAAa,CAAA;AAGtD,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAA0C;AAAA,MACpE,QAAA,EAAU,6CAAA;AAAA,MACV,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,QACJ,WAAW,MAAA,CAAO,SAAA;AAAA,QAClB,SAAA,EAAAA,UAAAA;AAAA,QACA,aAAA,EAAe,aAAA;AAAA,QACf,cAAA;AAAA,QACA,YAAY,kBAAA,IAAsB;AAAA;AACpC,KACD,CAAA;AAED,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,aACJ,OAAQ,MAAA,CAAe,OAAA,KAAY,QAAA,GAAY,OAAe,OAAA,GAAU,KAAA,CAAA;AAE1E,IAAA,IAAI,OAAO,OAAO,eAAA,KAAoB,QAAA,IAAY,OAAO,eAAA,CAAgB,IAAA,EAAK,CAAE,MAAA,KAAW,CAAA,EAAG;AAC5F,MAAA,MAAM,IAAI,KAAA,CAAM,UAAA,IAAc,4CAA4C,CAAA;AAAA,IAC5E;AAEA,IAAA,OAAO,MAAA,CAAO,eAAA;AAAA,EAChB,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,4CAA4C,KAAK,CAAA;AAC/D,IAAA,MAAM,KAAA;AAAA,EACR;AACF,CAAA;AAwBO,IAAM,yCAAyC,OAAO;AAAA,EAC3D,MAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF,CAAA,KAIuB;AACrB,EAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,OAAA,EAAS,KAAA,EAAO,gBAAe,GAAI,MAAA;AAK/D,EAAA,IAAI,MAAA,CAAO,UAAA,KAAe,OAAA,IAAW,MAAA,CAAO,eAAe,MAAA,EAAQ;AACjE,IAAA,OAAA,CAAQ,MAAM,sEAAA,EAAwE;AAAA,MACpF,UAAU,MAAA,CAAO,UAAA;AAAA,MACjB,QAAA,EAAU,eAAA;AAAA,MACV,eAAe,MAAA,CAAO,SAAA,EAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,MAChD,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA,MAAM,IAAIQ,wBAAA;AAAA,MACR,CAAA,4DAAA,EAA+D,MAAA,CAAO,UAAA,IAAc,WAAW,CAAA,CAAA,CAAA;AAAA,MAC/FC,qBAAA,CAAe;AAAA,KACjB;AAAA,EACF;AAGA,EAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC/C,EAAA,IAAI,OAAA,CAAQ,aAAa,UAAA,EAAY;AACnC,IAAA,OAAA,CAAQ,MAAM,gDAAA,EAAkD;AAAA,MAC9D,eAAe,IAAI,IAAA,CAAK,QAAQ,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY;AAAA,MAC/D,aAAa,IAAI,IAAA,CAAK,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY;AAAA,MACrD,UAAA,EAAY,CAAA,EAAG,UAAA,GAAa,OAAA,CAAQ,UAAU,CAAA,QAAA;AAAA,KAC/C,CAAA;AACD,IAAA,MAAM,IAAID,wBAAA;AAAA,MACR,CAAA,mBAAA,EAAsB,IAAI,IAAA,CAAK,OAAA,CAAQ,aAAa,GAAI,CAAA,CAAE,aAAa,CAAA,2BAAA,CAAA;AAAA,MAEvEC,qBAAA,CAAe;AAAA,KACjB;AAAA,EACF;AAEA,EAAA,IAAI;AASF,IAAA,IAAI,iBAAA;AACJ,IAAA,IAAI;AACF,MAAA,iBAAA,GAAoBtB,yBAAA,CAAkB,OAAA,CAAQ,mBAAA,EAAqB,UAAU,CAAA;AAAA,IAC/E,CAAA,CAAA,MAAQ;AACN,MAAA,OAAA,CAAQ,MAAM,kEAAA,EAAoE;AAAA,QAChF,eAAe,OAAA,CAAQ,SAAA,EAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QACjD,IAAA,EAAM;AAAA,OACP,CAAA;AACD,MAAA,MAAM,IAAIqB,wBAAA;AAAA,QACR,0EAAA;AAAA,QACAC,qBAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAGA,IAAA,MAAM,aAAA,GAAgBnB,WAAAA,CAAG,UAAA,CAAW,WAAA,CAAY,iBAAiB,CAAA;AACjE,IAAA,IAAI,cAAc,WAAA,EAAY,KAAM,OAAA,CAAQ,SAAA,CAAU,aAAY,EAAG;AACnE,MAAA,OAAA,CAAQ,MAAM,iDAAA,EAAmD;AAAA,QAC/D,UAAU,OAAA,CAAQ,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC3C,OAAA,EAAS,aAAA,CAAc,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QACtC,IAAA,EAAM;AAAA,OACP,CAAA;AACD,MAAA,MAAM,IAAIkB,wBAAA;AAAA,QACR,2EAAA;AAAA,QACAC,qBAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,CAAO,eAAe,MAAA,EAAQ;AAchC,MAAA,MAAM,EAAE,uBAAAC,sBAAAA,EAAuB,aAAA,EAAAC,gBAAe,eAAA,EAAA3B,gBAAAA,KAAoB,MAAM,OAAA,CAAA,OAAA,EAAA,CAAA,IAAA,CAAA,OAAA,OAAA,EAAA,EAAA,UAAA,CAAA,CAAA;AACxE,MAAA,MAAM,EAAE,kBAAA,EAAA4B,mBAAAA,EAAoB,qCAAA,EAAAC,sCAAAA,KAA0C,MAAM,OAAA,CAAA,OAAA,EAAA,CAAA,IAAA,CAAA,OAAA,0BAAA,EAAA,EAAA,6BAAA,CAAA,CAAA;AAI5E,MAAA,MAAM,KAAKH,sBAAAA,CAAsB;AAAA,QAC/B,KAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,CAAA,IAAK,GAAA,GAAO,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,EAAO,GAAI,QAAQ,CAAC,CAAA;AAAA,QAChF,KAAA;AAAA,QACA,MAAA,EAAQ1B;AAAA,OACT,CAAA;AAED,MAAA,MAAM,UAAU4B,mBAAAA,CAAmB,EAAE,OAAA,EAAS,MAAA,CAAO,SAAS,CAAA;AAC9D,MAAA,MAAM,WAAA,GAAcD,cAAAA,CAAc,EAAA,EAAI,MAAA,CAAO,WAAW,OAAO,CAAA;AAI/D,MAAA,MAAM,cAAA,GAAiB,IAAA,GAAO,WAAA,CAAY,QAAA,CAAS,EAAE,CAAA;AACrD,MAAA,MAAM,EAAE,CAAA,EAAAG,EAAAA,EAAG,CAAA,EAAAC,EAAAA,KAAMzB,WAAAA,CAAG,UAAA,CAAW,IAAA,CAAK,cAAA,EAAgB,iBAAiB,CAAA;AAQrE,MAAA,MAAM0B,iBAAAA,GAA6B;AAAA,QACjC,MAAA,CAAO,QAAQ,SAAS,CAAA;AAAA,QACxB,OAAOF,EAAC,CAAA;AAAA,QACR,OAAOC,EAAC,CAAA;AAAA,QACR,MAAA,CAAO,QAAQ,UAAU;AAAA,OAC3B;AAEA,MAAA,MAAM,WAAWF,sCAAAA,CAAsC;AAAA,QACrD,gBAAA,EAAkB,EAAA;AAAA,QAClB,SAAA,EAAWG;AAAA,OACZ,CAAA;AAED,MAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,IAAA,CAG3B;AAAA,QACD,QAAA,EAAU,qCAAA;AAAA,QACV,WAAA;AAAA,QACA,IAAA,EAAM;AAAA,UACJ,gBAAgB,MAAA,CAAO,SAAA;AAAA,UACvB,QAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAQA,UAAA,EAAY;AAAA;AACd,OACD,CAAA;AAED,MAAA,IAAI,CAAC,UAAU,eAAA,EAAiB;AAC9B,QAAA,MAAM,IAAIR,wBAAA;AAAA,UACR,8GAAA;AAAA,UACAC,qBAAA,CAAe;AAAA,SACjB;AAAA,MACF;AACA,MAAA,OAAO,QAAA,CAAS,eAAA;AAAA,IAClB;AAGA,IAAA,MAAM,mBAAmBV,0BAAAA,CAAoB,KAAA;AAG7C,IAAA,MAAM,eAAA,GAAkB,MAAM,MAAA,CAAO,IAAA,CAA+B;AAAA,MAClE,QAAA,EAAU,kCAAA;AAAA,MACV,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,QACJ,WAAW,MAAA,CAAO,SAAA;AAAA,QAClB,KAAA;AAAA,QACA,gBAAA;AAAA,QACA,UAAA,EAAY;AAAA;AACd,KACD,CAAA;AAGD,IAAA,IAAI,CAAC,eAAA,IAAmB,OAAO,eAAA,KAAoB,QAAA,EAAU;AAC3D,MAAA,MAAM,IAAIS,wBAAA;AAAA,QACR,mFAAA;AAAA,QACAC,qBAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,IAAI,gBAAA;AACJ,IAAA,IAAI,WAAA,IAAe,eAAA,IAAoB,eAAA,CAA6C,SAAA,EAAW;AAC7F,MAAA,MAAM,YAAa,eAAA,CAA6C,SAAA;AAChE,MAAA,IACE,CAAC,SAAA,IACD,OAAO,SAAA,KAAc,QAAA,IACrB,EAAE,OAAA,IAAW,SAAA,CAAA,IACb,EAAE,SAAA,IAAa,SAAA,CAAA,EACf;AACA,QAAA,MAAM,IAAID,wBAAA;AAAA,UACR,wFAAA;AAAA,UACAC,qBAAA,CAAe;AAAA,SACjB;AAAA,MACF;AACA,MAAA,gBAAA,GAAmB,SAAA;AAAA,IACrB,CAAA,MAAA,IAAW,OAAA,IAAW,eAAA,IAAmB,SAAA,IAAa,eAAA,EAAiB;AACrE,MAAA,gBAAA,GAAmB,eAAA;AAAA,IACrB,CAAA,MAAO;AACL,MAAA,MAAM,IAAID,wBAAA;AAAA,QACR,8EAAA;AAAA,QACAC,qBAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAGA,IAAA,MAAM,OAAA,GAAUT,kBAAA,CAAU,cAAA,CAAe,gBAAA,EAAkB,OAAO,SAAS,CAAA;AAG3E,IAAA,MAAM,EAAE,GAAG,CAAA,EAAE,GAAIV,YAAG,UAAA,CAAW,IAAA,CAAK,SAAS,iBAAiB,CAAA;AAG9D,IAAA,MAAM,gBAAA,GAAmB;AAAA,MACvB,OAAA,CAAQ,SAAA;AAAA,MACR2B,YAAA,CAAI,MAAM,CAAC,CAAA;AAAA,MACXA,YAAA,CAAI,MAAM,CAAC,CAAA;AAAA,MACXA,YAAA,CAAI,KAAA,CAAM,OAAA,CAAQ,UAAU;AAAA,KAC9B;AAGA,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAA0C;AAAA,MACpE,QAAA,EAAU,6CAAA;AAAA,MACV,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,QACJ,WAAW,MAAA,CAAO,SAAA;AAAA,QAClB,SAAA,EAAW,gBAAA;AAAA;AAAA,QAEX,aAAA,EAAe,gBAAA;AAAA,QACf,cAAA;AAAA,QACA,UAAA,EAAY,OAAA;AAAA,QACZ,kBAAA,EAAoB;AAAA;AAAA;AACtB,KACD,CAAA;AAED,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,MAAA,MAAM,IAAIT,wBAAA;AAAA,QACR,8FAAA;AAAA,QACAC,qBAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,OAAO,eAAA,KAAoB,QAAA,IAAY,OAAO,eAAA,CAAgB,IAAA,EAAK,CAAE,MAAA,KAAW,CAAA,EAAG;AAC5F,MAAA,MAAM,aACJ,OAAQ,MAAA,CAAe,OAAA,KAAY,QAAA,GAAY,OAAe,OAAA,GAAU,KAAA,CAAA;AAC1E,MAAA,OAAA,CAAQ,MAAM,4DAAA,EAA8D;AAAA,QAC1E;AAAA,OACD,CAAA;AACD,MAAA,MAAM,IAAID,wBAAA;AAAA,QACR,UAAA,IAAc,4CAAA;AAAA,QACdC,qBAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,OAAO,MAAA,CAAO,eAAA;AAAA,EAChB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AAGpE,IAAA,IAAI,iBAAiBD,wBAAA,EAAmB;AACtC,MAAA,MAAM,KAAA;AAAA,IACR;AAEA,IAAA,OAAA,CAAQ,MAAM,6CAAA,EAA+C;AAAA,MAC3D,OAAO,GAAA,CAAI,OAAA;AAAA,MACX,eAAe,MAAA,CAAO,SAAA,EAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,MAChD,eAAe,OAAA,CAAQ,SAAA,EAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,KAClD,CAAA;AACD,IAAA,MAAM,KAAA;AAAA,EACR;AACF,CAAA;AErcO,IAAM,0BAAA,GAA6B,MAAA;AAAA,EACxCtC,oBAAAA,CAAY,kBAAkB,qBAAqB;AACrD;AAGA,IAAM,kBAAA,GAAqB,SAAA;AAG3B,IAAM,oBAAA,GAAuB,yBAAA;AAG7B,IAAM,2BAAA,GAA8B,gCAAA;AAMpC,SAAS,OAAO,CAAA,EAA4B;AAC1C,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,OAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,GAAI,CAAA;AACzD;AAEA,SAAS,MAAM,CAAA,EAAqC;AAClD,EAAA,IAAI,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,CAAA;AAClC,EAAA,OAAO,OAAO,CAAC,CAAA;AACjB;AAaO,SAAS,YAAY,KAAA,EAAuB;AACjD,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAI/B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,IAAI,KAAA,CAAM,UAAA,CAAW,CAAC,CAAA,GAAI,GAAA,EAAM;AAC9B,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,CAAA,qFAAA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,KAAA,CAAM,SAAS,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI,UAAA;AAAA,MACR,CAAA,gFAAA,EAA8E,MAAM,MAAM,CAAA;AAAA,KAC5F;AAAA,EACF;AACA,EAAA,OAAO,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,KAAK,CAAC,CAAA;AACpD;AAqCO,SAAS,oBAAoB,MAAA,EAA2C;AAC7E,EAAA,MAAM,WAAA,GAAoB;AAAA,IACxB,eAAA,EAAiB,MAAA,CAAO,MAAA,CAAO,oBAAoB,CAAA;AAAA,IACnD,UAAA,EAAY,kBAAA;AAAA,IACZ,QAAA,EAAU,CAAC,MAAA,CAAO,MAAA,CAAO,oBAAoB,CAAC;AAAA,GAChD;AAEA,EAAA,MAAM,SAAA,GAAY,WAAA,CAAY,MAAA,CAAO,KAAA,IAAS,UAAU,CAAA;AAExD,EAAA,MAAM,aAAA,GAAsB;AAAA,IAC1B,eAAA,EAAiB,MAAA,CAAO,MAAA,CAAO,oBAAoB,CAAA;AAAA,IACnD,UAAA,EAAY,oBAAA;AAAA,IACZ,QAAA,EAAU;AAAA,MACR,MAAA,CAAO,OAAO,eAAe,CAAA;AAAA,MAC7B,MAAA,CAAO,OAAO,sBAAsB,CAAA;AAAA,MACpC,IAAA,GAAO,SAAA,CAAU,QAAA,CAAS,EAAE;AAAA;AAC9B,GACF;AAEA,EAAA,OAAO,CAAC,aAAa,aAAa,CAAA;AACpC;AAkCO,SAAS,wBAAwB,MAAA,EAAwC;AAC9E,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,MAAA,CAAO,cAAc,CAAA;AAC/C,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,MAAA,CAAO,SAAS,CAAA;AACzC,EAAA,MAAM,YAAA,GAAe,KAAA,CAAM,MAAA,CAAO,sBAAsB,CAAA;AACxD,EAAA,MAAM,SAAA,GAAY,WAAA,CAAY,MAAA,CAAO,KAAA,IAAS,UAAU,CAAA;AAExD,EAAA,OAAO,MAAA;AAAA,IACLD,cAAK,6BAAA,CAA8B;AAAA,MACjC,IAAA,GAAO,0BAAA,CAA2B,QAAA,CAAS,EAAE,CAAA;AAAA,MAC7C,IAAA,GAAO,WAAA,CAAY,QAAA,CAAS,EAAE,CAAA;AAAA,MAC9B,IAAA,GAAO,UAAA,CAAW,QAAA,CAAS,EAAE,CAAA;AAAA,MAC7B,IAAA,GAAO,YAAA,CAAa,QAAA,CAAS,EAAE,CAAA;AAAA,MAC/B,IAAA,GAAO,SAAA,CAAU,QAAA,CAAS,EAAE;AAAA,KAC7B;AAAA,GACH;AACF;AAeO,SAAS,qBAAqB,MAAA,EAGR;AAC3B,EAAA,MAAM,WAAA,GAAc,uBAAA,CAAwB,MAAA,CAAO,OAAO,CAAA;AAC1D,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,UAAU,CAAC,CAAA;AAC7C,EAAA,MAAM,GAAA,GAAMqB,YAAG,UAAA,CAAW,IAAA,CAAK,OAAO,WAAA,CAAY,QAAA,CAAS,EAAE,CAAA,EAAG,KAAK,CAAA;AACrE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA,CAAO,IAAA,GAAO,IAAI,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA;AAAA,IACnC,GAAG,MAAA,CAAO,IAAA,GAAO,IAAI,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC;AAAA,GACrC;AACF;AA6BO,SAAS,yBAAyB,MAAA,EAA8C;AACrF,EAAA,MAAM,SAAA,GAAY,WAAA,CAAY,MAAA,CAAO,KAAA,IAAS,UAAU,CAAA;AACxD,EAAA,OAAO;AAAA,IACL,eAAA,EAAiB,MAAA,CAAO,MAAA,CAAO,cAAc,CAAA;AAAA,IAC7C,UAAA,EAAY,2BAAA;AAAA,IACZ,QAAA,EAAU;AAAA,MACR,MAAA,CAAO,OAAO,SAAS,CAAA;AAAA,MACvB,MAAA,CAAO,OAAO,sBAAsB,CAAA;AAAA,MACpC,IAAA,GAAO,SAAA,CAAU,QAAA,CAAS,EAAE,CAAA;AAAA,MAC5B,MAAA,CAAO,OAAO,UAAU,CAAA;AAAA,MACxB,MAAA,CAAO,OAAO,UAAU;AAAA;AAC1B,GACF;AACF;;;AHnKA,eAAsB,yBACpB,MAAA,EAC2B;AAC3B,EAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAA6B;AAAA,IAC/D,QAAA,EAAU,wCAAA;AAAA,IACV,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,IAAA,EAAM;AAAA,MACJ,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,gBAAgB,MAAA,CAAO;AAAA;AACzB,GACD,CAAA;AAED,EAAA,IAAI,OAAA,CAAQ,kBAAkB,kBAAA,EAAoB;AAChD,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,kBAAA;AAAA,MACN,eAAe,OAAA,CAAQ,aAAA;AAAA,MACvB,kBAAkB,OAAA,CAAQ,gBAAA;AAAA,MAC1B,aAAa,OAAA,CAAQ;AAAA,KACvB;AAAA,EACF;AAEA,EAAA,IAAI,OAAA,CAAQ,kBAAkB,UAAA,EAAY;AACxC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAMF;AAAA,EACF;AAOA,EAAA,IAAI,OAAA,CAAQ,kBAAkB,OAAA,EAAS;AACrC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,2CAAA,GACE,IAAA,CAAK,SAAA,CAAW,OAAA,CAAuC,aAAa,CAAA,GACpE;AAAA,KAGJ;AAAA,EACF;AAYA,EAAA,MAAM,gBAAgBH,yBAAA,CAAkB,MAAA,CAAO,MAAA,CAAO,mBAAA,EAAqB,OAAO,UAAU,CAAA;AAC5F,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF;AACA,EAAA,MAAM,cAAc,MAAA,CAAOG,WAAAA,CAAG,UAAA,CAAW,WAAA,CAAY,aAAa,CAAC,CAAA;AAEnE,EAAA,MAAM,QAAQ,mBAAA,CAAoB;AAAA,IAChC,oBAAA,EAAsB,OAAO,MAAA,CAAO,SAAA;AAAA,IACpC,eAAA,EAAiB,WAAA;AAAA,IACjB,oBAAA,EAAsB,MAAA,CAAO,OAAA,CAAQ,aAAa,CAAA;AAAA,IAClD,sBAAA,EAAwB,MAAA,CAAO,OAAA,CAAQ,qBAAqB,CAAA;AAAA,IAC5D,OAAO,OAAA,CAAQ;AAAA,GAChB,CAAA;AAQD,EAAA,MAAM,eAAA,GAAkB,MAAM,2BAAA,CAA4B;AAAA,IACxD,MAAA,EAAQ;AAAA,MACN,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,MAAA,EAAQ;AAAA,QACN,SAAA,EAAW,OAAO,MAAA,CAAO,SAAA;AAAA,QACzB,mBAAA,EAAqB,OAAO,MAAA,CAAO,mBAAA;AAAA;AAAA;AAAA;AAAA,QAInC,UAAA,EAAY;AAAA,OACd;AAAA,MACA,KAAA;AAAA;AAAA;AAAA;AAAA,MAIA,cAAA,EAAgB;AAAA,KAClB;AAAA,IACA,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,QAAQ,MAAA,CAAO;AAAA,GAChB,CAAA;AAOD,EAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAA6B;AAAA,IAC/D,QAAA,EAAU,wCAAA;AAAA,IACV,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,IAAA,EAAM;AAAA,MACJ,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,gBAAgB,MAAA,CAAO,cAAA;AAAA,MACvB;AAAA;AACF,GACD,CAAA;AAED,EAAA,OAAO,EAAE,IAAA,EAAM,UAAA,EAAY,GAAG,OAAA,EAAQ;AACxC;;;AD7MO,IAAM,eAAN,MAAmB;AAAA,EACxB,YAAoB,MAAA,EAAqB;AAArB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAkfpB,IAAA,IAAA,CAAA,eAAA,GAAkB,MAAM;AAGtB,MAAA,MAAM,eAAA,GAAkBF,yBAAAA,CAAS,GAAA,CAAI,SAAA,CAAU,OAAO,EAAE,CAAA;AAExD,MAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,QAAA,CAASA,yBAAAA,CAAS,IAAI,GAAG,CAAA;AAG5D,MAAA,MAAM,cAAA,GAAiB,KAAK,UAAU,CAAA,CAAA;AAItC,MAAA,MAAM,gBAAA,GAAmB,MAAA;AAAA,QACvB;AAAA,OACF;AACA,MAAA,MAAM,gBAAA,GAAmB,MAAA,CAAO,cAAc,CAAA,GAAI,gBAAA;AAGlD,MAAA,OAAO,CAAA,EAAA,EAAK,gBAAA,CAAiB,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AAAA,IAC3C,CAAA;AAAA,EArgB0C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgB1C,MAAM,aACJ,MAAA,EAC+B;AAC/B,IAAA,IAAI;AACF,MAAA,MAAM;AAAA,QACJ,UAAA;AAAA,QACA,cAAA;AAAA,QACA,WAAA;AAAA,QACA,MAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAmBA,UAAA,GAAa,MAAA;AAAA,QACb,SAAA,EAAW,eAAA;AAAA,QACX,UAAA;AAAA,QACA;AAAA,OACF,GAAI,MAAA;AAEJ,MAAA,IAAI,CAAC,UAAA,EAAY;AACf,QAAA,IAAI,UAAA,EAAY;AACd,UAAA,MAAM,IAAI,KAAA;AAAA,YACR;AAAA,WACF;AAAA,QACF;AACA,QAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,MAC9D;AAYA,MAAA,MAAM,SAAS,UAAA,KAAe,MAAA;AAC9B,MAAA,MAAM,mBAAA,GAAsB,MAAA,GAAU,MAAA,CAAO,UAAA,IAAc,OAAA,GAAW,KAAA,CAAA;AACtE,MAAA,MAAM,sBAAA,GAAyB;AAAA,QAC7B,OAAA;AAAA,QACA,SAAA;AAAA,QACA,eAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IACE,MAAA,IACA,CAAC,sBAAA,CAAuB,QAAA;AAAA,QACtB;AAAA,OACF,EACA;AACA,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,mBAAmB,mBAAmB,CAAA,qMAAA;AAAA,SAIxC;AAAA,MACF;AAKA,MAAA,MAAM,MAAA,GACJ,UAAA,KAAe,OAAA,GAAUe,2BAAAA,CAAqB,QAAQA,2BAAAA,CAAqB,KAAA;AAE7E,MAAA,MAAM,WAAW,IAAIE,oBAAAA,CAAY,EAAE,OAAA,EAAS,QAAQ,CAAA;AAMpD,MAAA,MAAM,YAAA,GAAe,KAAK,eAAA,EAAgB;AAC1C,MAAA,MAAM,aAAA,GAAgBf,WAAAA,CAAG,UAAA,CAAW,WAAA,CAAY,YAAY,CAAA;AAE5D,MAAA,IAAI,mBAAA;AACJ,MAAA,IAAI,gBAAA;AACJ,MAAA,IAAI,SAAA;AACJ,MAAA,IAAI,cAAA;AAGJ,MAAA,IAAI,oBAAA;AAKJ,MAAA,IAAI,oBAAA,GAA+B,YAAA;AAEnC,MAAA,IAAI,MAAA,EAAQ;AAMV,QAAA,IAAI,WAAA;AACJ,QAAA,IAAI,iBAAA;AACJ,QAAA,IAAI,wBAAwB,OAAA,EAAS;AAEnC,UAAA,WAAA,GAAc,CAAC,MAAA,CAAO,aAAa,CAAC,CAAA;AACpC,UAAA,iBAAA,GAAoB,YAAA;AAAA,QACtB,CAAA,MAAA,IAAW,wBAAwB,SAAA,EAAW;AAC5C,UAAA,IAAI,MAAA,CAAO,gBAAA,IAAoB,MAAA,CAAO,gBAAA,CAAiB,SAAS,CAAA,EAAG;AAMjE,YAAA,IAAI,MAAA,CAAO,gBAAA,CAAiB,MAAA,KAAW,CAAA,EAAG;AACxC,cAAA,MAAM,IAAI,KAAA;AAAA,gBACR,CAAA,2EAAA,EAA8E,MAAA,CAAO,gBAAA,CAAiB,MAAM,CAAA,CAAA;AAAA,eAC9G;AAAA,YACF;AACA,YAAA,WAAA,GAAc,OAAO,gBAAA,CAAiB,GAAA,CAAI,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AAC1D,YAAA,iBAAA,GAAoB,EAAA;AAAA,UACtB,CAAA,MAAO;AAKL,YAAA,MAAM,SAAA,GAAwB4B,mBAAY,EAAE,CAAA;AAC5C,YAAA,MAAM,EAAA,GAAK,MAAM,OAAO,gBAAgB,CAAA;AACxC,YAAA,MAAM,QAAA,GAAW,MAAM,EAAA,CAAG,iBAAA,CAAkB,SAAS,CAAA;AACrD,YAAA,WAAA,GAAc,mBAAmB,QAAQ,CAAA;AACzC,YAAA,iBAAA,GAAoB,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,CAAE,SAAS,KAAK,CAAA;AAAA,UAC3D;AAAA,QACF,CAAA,MAAA,IACE,mBAAA,KAAwB,eAAA,IACxB,mBAAA,KAAwB,kBAAA,EACxB;AAOA,UAAA,IAAI,CAAC,MAAA,CAAO,gBAAA,IAAoB,MAAA,CAAO,gBAAA,CAAiB,WAAW,CAAA,EAAG;AACpE,YAAA,MAAM,IAAI,KAAA;AAAA,cACR,QAAQ,mBAAmB,CAAA,wEAAA,EAEtB,MAAA,CAAO,gBAAA,EAAkB,UAAU,CAAC,CAAA,CAAA;AAAA,aAC3C;AAAA,UACF;AACA,UAAA,WAAA,GAAc,OAAO,gBAAA,CAAiB,GAAA,CAAI,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AAC1D,UAAA,iBAAA,GAAoB,EAAA;AAAA,QACtB,CAAA,MAAO;AAIL,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,mBAAmB,mBAAmB,CAAA,gEAAA;AAAA,WACxC;AAAA,QACF;AAEA,QAAA,oBAAA,GAAuB,WAAA,CAAY,IAAI,CAAC,CAAA,KAAM,OAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA;AAKnE,QAAA,oBAAA,GAAuB,iBAAA;AAEvB,QAAA,MAAM,iBAAA,GAAoB,MAAA;AAAA,UACxBC,kCAA2B,mBAA8D;AAAA,SAC3F;AACA,QAAA,MAAM,aAAA,GAAgB,mBAAmBpB,0BAAAA,CAAoB,IAAA;AAM7D,QAAA,MAAM,kBAAkB,kBAAA,CAAmB;AAAA,UACzC,SAAA,EAAW,OAAO,aAAa,CAAA;AAAA,UAC/B,WAAA,EAAa,mBAAA;AAAA,UACb,MAAA,EAAQ,WAAA;AAAA,UACR;AAAA,SACD,CAAA;AACD,QAAA,SAAA,GAAY,IAAA,GAAO,eAAA,CAAgB,QAAA,CAAS,EAAE,CAAA;AAC9C,QAAA,gBAAA,GAAmB,aAAA;AAMnB,QAAA,MAAM,SAAA,GAAY,MAAA,CAAO7B,oBAAAA,CAAY,iBAAA,CAAkB,SAAS,CAAC,CAAA;AACjE,QAAA,MAAM,WAAA,GAAc,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,mBAAoB,CAAC,CAAA;AAC9E,QAAA,mBAAA,GAAsB;AAAA,UACpB,YAAY,QAAA,EAAS;AAAA,UACrB,kBAAkB,QAAA,EAAS;AAAA,UAC3B,WAAA,CAAY,OAAO,QAAA,EAAS;AAAA,UAC5B,GAAG,WAAA,CAAY,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,UAAU,CAAA;AAAA,UACtC,UAAU,QAAA;AAAS,SACrB;AAKA,QAAA,MAAM,QAAQ,MAAM;AAClB,UAAA,MAAM,WAAA,GAAc,MAAA;AAAA,YAClBD,cAAK,6BAAA,CAA8B;AAAA,cACjC,IAAA,GAAO,WAAA,CAAY,QAAA,CAAS,EAAE,CAAA;AAAA,cAC9B,GAAG,YAAY,GAAA,CAAI,CAAC,MAAM,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC;AAAA,aAChD;AAAA,WACH;AACA,UAAA,OAAO,MAAA;AAAA,YACLA,cAAK,6BAAA,CAA8B;AAAA,cACjC,IAAA,GAAO,WAAA,CAAY,QAAA,CAAS,EAAE,CAAA;AAAA,cAC9B,IAAA,GAAO,WAAA,CAAY,QAAA,CAAS,EAAE;AAAA,aAC/B;AAAA,WACH;AAAA,QACF,CAAA,GAAG;AACH,QAAA,cAAA,GAAiB,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,EAAE,CAAA;AAAA,MAC1C,CAAA,MAAO;AAEL,QAAA,mBAAA,GAAsB,IAAA,CAAK,wBAAA,CAAyB,UAAA,EAAY,aAAa,CAAA;AAC7E,QAAA,gBAAA,GACE,eAAA,KACC,UAAA,KAAe,OAAA,GAAU8B,0BAAAA,CAAoB,QAAQA,0BAAAA,CAAoB,KAAA,CAAA;AAC5E,QAAA,SAAA,GAAY9B,aAAAA,CAAK,gCAAA;AAAA,UACf,aAAA;AAAA,UACA,gBAAA;AAAA,UACA,mBAAA;AAAA,UACA;AAAA,SACF;AACA,QAAA,cAAA,GAAiB,aAAA;AAAA,MACnB;AAGA,MAAA,MAAM,OAAA,GAAU,IAAIqC,gBAAAA,CAAQ,EAAE,UAAU,OAAA,EAAS,SAAA,EAAW,MAAA,EAAQ,YAAA,EAAc,CAAA;AAElF,MAAA,MAAM,iBAAA,GAAoB,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAoC;AAAA,QAC9E,QAAA,EAAU,CAAA,EAAGc,oBAAA,CAAc,aAAa,CAAA,iBAAA,CAAA;AAAA,QACxC,WAAA;AAAA,QACA,IAAA,EAAM;AAAA,UACJ,KAAA;AAAA,UACA,SAAA;AAAA,UACA,UAAA;AAAA,UACA,aAAA;AAAA,UACA,GAAI,eAAA,IAAmB,EAAE,SAAA,EAAW,eAAA,EAAgB;AAAA;AAAA;AAAA;AAAA;AAAA,UAKpD,GAAI,MAAA,IAAU;AAAA,YACZ,UAAA,EAAY,mBAAA;AAAA,YACZ,gBAAA,EAAkB;AAAA;AACpB;AACF,OACD,CAAA;AAED,MAAA,MAAM,EAAE,SAAA,EAAApB,UAAAA,EAAW,gBAAA,EAAkB,0BAAyB,GAAI,iBAAA;AAmBlE,MAAA,IAAI,oBAAA;AACJ,MAAA,IAAI,MAAA,EAAQ;AAIV,QAAA,oBAAA,GAAuB;AAAA,UACrB,CAAA,EAAG,KAAA;AAAA,UACH,CAAA,EAAG,KAAA;AAAA,UACH,QAAA,EAAU;AAAA,SACZ;AAAA,MACF,CAAA,MAAO;AACL,QAAA,MAAM,aAAA,GAAgB,MAAM,OAAA,CAAQ,WAAA,CAAYA,UAAS,CAAA;AACzD,QAAA,oBAAA,GAAuB;AAAA,UACrB,CAAA,EAAI,aAAA,CAAsB,CAAA,CAAE,QAAA,EAAS;AAAA,UACrC,CAAA,EAAI,aAAA,CAAsB,CAAA,CAAE,QAAA,EAAS;AAAA,UACrC,UAAW,aAAA,CAAsB;AAAA,SACnC;AAAA,MACF;AAEA,MAAA,MAAM,cAAA,GAAiC;AAAA,QACrC,UAAA,EAAY,wBAAA;AAAA,QACZ,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,CAAA,EAAGiB,YAAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA;AAAA,QACvB,QAAA,EAAU,oBAAoB,GAAA,CAAI,CAAC,UAAUA,YAAAA,CAAI,KAAA,CAAM,KAAK,CAAC;AAAA,OAC/D;AAOA,MAAA,MAAM,sBACJ,oBAAA,KAAyB,EAAA,GACrB,KAAA,CAAA,GACA/B,yBAAA,CAAkB,sBAAsB,UAAU,CAAA;AAGxD,MAAA,MAAM,yBAAA,GACJ,OAAO,gBAAA,IAAoB,oBAAA,KAAyB,KAChDA,yBAAA,CAAkB,oBAAA,EAAsB,MAAA,CAAO,gBAAgB,CAAA,GAC/D,KAAA,CAAA;AAGN,MAAA,MAAM,0BAAA,GAA6B,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAA2B;AAAA,QAC9E,QAAA,EAAU,CAAA,EAAGkC,oBAAA,CAAc,aAAa,CAAA,CAAA;AAAA,QACxC,WAAA;AAAA,QACA,IAAA,EAAM;AAAA,UACJ,cAAA;AAAA,UACA,MAAA;AAAA,UACA,SAAA;AAAA,UACA,UAAA;AAAA,UACA,KAAA;AAAA,UACA,aAAA,EAAe,oBAAA;AAAA,UACf,SAAA,EAAApB,UAAAA;AAAA,UACA,GAAI,mBAAA,KAAwB,KAAA,CAAA,IAAa,EAAE,mBAAA,EAAoB;AAAA;AAAA,UAE/D,GAAI,MAAA,IAAU,EAAE,UAAA,EAAY,mBAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAOhD,GAAI,MAAA,IACF,mBAAA,KAAwB,KAAA,CAAA,IACxB,oBAAA,IAAwB;AAAA,YACtB,gBAAA,EAAkB,oBAAA;AAAA,YAClB,cAAA,EAAgB,oBAAA,CAAqB,IAAA,CAAK,GAAG;AAAA,WAC/C;AAAA,UACF,GAAI,yBAAA,IAA6B,EAAE,yBAAA,EAA0B;AAAA,UAC7D,GAAI,MAAA,CAAO,UAAA,IAAc,EAAE,UAAA,EAAY,OAAO,UAAA,EAAW;AAAA,UACzD,GAAI,MAAA,CAAO,YAAA,IAAgB,EAAE,YAAA,EAAc,OAAO,YAAA,EAAa;AAAA,UAC/D,GAAI,MAAA,CAAO,YAAA,IAAgB,QAAQ,EAAE,YAAA,EAAc,OAAO,YAAA,EAAa;AAAA,UACvE,GAAI,MAAA,CAAO,UAAA,IAAc,EAAE,UAAA,EAAY,OAAO,UAAA,EAAW;AAAA,UACzD,cAAA,EAAgB;AAAA,YACd,GAAG,cAAA;AAAA,YACH,IAAA,EAAM,CAAA,EAAG,cAAA,CAAe,IAAI,CAAA,CAAA;AAAA,YAC5B,QAAA,EAAU,eAAe,QAAA,CAAS,GAAA,CAAI,CAAC,IAAA,KAAS,CAAA,EAAG,IAAI,CAAA,CAAE;AAAA;AAC3D;AACF,OACD,CAAA;AAED,MAAA,OAAO,0BAAA;AAAA,IACT,SAAS,KAAA,EAAgB;AACvB,MAAA,OAAA,CAAQ,KAAA,CAAM,mBAAmB,KAAK,CAAA;AAEtC,MAAA,IAAI,iBAAiB,KAAA,IAAS,KAAA,CAAM,OAAA,CAAQ,QAAA,CAAS,KAAK,CAAA,EAAG;AAC3D,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,IAAIqB,4BAAA;AAAA,QACR,CAAA,yBAAA,EAA4B,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,UAAU,eAAe,CAAA,CAAA;AAAA,QACpF;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,wBAAA,CAAyB,YAAwB,aAAA,EAAiC;AACxF,IAAA,IAAI,eAAe,OAAA,EAAS;AAE1B,MAAA,MAAM,QAAA,GAAW,IAAIC,wBAAA,CAAgB;AAAA,QACnC,QAAA,EAAU,EAAE,MAAA,EAAQ,aAAA;AAAc,OACnC,CAAA;AACD,MAAA,MAAM,UAAA,GAAa,IAAIC,oBAAA,CAAqBC,2BAAA,CAAmB,IAAI,CAAA;AAEnE,MAAA,OAAOpD,kBAAS,OAAA,CAAQ;AAAA,QACtB,KAAA,EAAO,QAAA;AAAA,QACP,QAAA,EAAU;AAAA,OACX,CAAA;AAAA,IACH;AAGA,IAAA,OAAOA,kBAAS,OAAA,CAAQ;AAAA,MACtB,UAAA,EAAY;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAA,CAAsB;AAAA,IAC1B,MAAA;AAAA,IACA;AAAA,GACF,EAGwB;AACtB,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAiB;AAAA,MAClD,QAAA,EAAU,CAAA,EAAGgD,oBAAA,CAAc,aAAa,CAAA,UAAA,CAAA;AAAA,MACxC,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAED,IAAA,OAAO,QAAA;AAAA,EACT;AAAA,EAEA,MAAM,SAAA,CAAU,MAAA,EAAyB,WAAA,EAAwD;AAC/F,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,gBAAe,GAAI,MAAA;AAC3B,MAAA,MAAM,iBAAA,GAAoB,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAAuB;AAAA,QACjE,QAAA,EAAU,CAAA,EAAGA,oBAAA,CAAc,aAAa,CAAA,QAAA,CAAA;AAAA,QACxC,MAAA,EAAQ,EAAE,cAAA,EAAe;AAAA,QACzB;AAAA,OACD,CAAA;AAED,MAAA,OAAO,iBAAA;AAAA,IACT,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAI,GAAA,YAAexB,oBAAAA,IAAiB,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK;AACtD,QAAA,OAAO,IAAA;AAAA,MACT;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,qBAAA,CACJ,MAAA,EACA,WAAA,EAMC;AACD,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAI;AAAA,MACrB,QAAA,EAAU,CAAA,EAAGwB,oBAAA,CAAc,aAAa,CAAA,oBAAA,CAAA;AAAA,MACxC,MAAA,EAAQ,EAAE,cAAA,EAAgB,MAAA,CAAO,cAAA,EAAe;AAAA,MAChD;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,sBAAA,CACJ,MAAA,EACA,WAAA,EACyC;AACzC,IAAA,MAAM,IAAA,GAA+B;AAAA,MACnC,gBAAgB,MAAA,CAAO,cAAA;AAAA,MACvB,wBAAwB,MAAA,CAAO;AAAA,KACjC;AAEA,IAAA,IAAI,MAAA,CAAO,aAAa,IAAA,EAAM;AAC5B,MAAA,IAAA,CAAK,YAAY,MAAA,CAAO,SAAA;AAAA,IAC1B;AAEA,IAAA,OAAO,IAAA,CAAK,OAAO,KAAA,CAAsC;AAAA,MACvD,QAAA,EAAU,CAAA,EAAGA,oBAAA,CAAc,aAAa,CAAA,0BAAA,CAAA;AAAA,MACxC,WAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAuBA,MAAM,eAAA,CAAgB;AAAA,IACpB,MAAA;AAAA,IACA;AAAA,GACF,EAGqC;AACnC,IAAA,MAAM,kBAAA,GAAqB,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAA6B;AAAA,MACxE,QAAA,EAAU,CAAA,EAAGA,oBAAA,CAAc,aAAa,CAAA,cAAA,CAAA;AAAA,MACxC,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,OAAO,kBAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAA,CACJ,MAAA,EACA,WAAA,EACuC;AACvC,IAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAmC;AAAA,MACpD,QAAA,EAAU,CAAA,EAAGA,oBAAA,CAAc,aAAa,CAAA,gBAAA,CAAA;AAAA,MACxC,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAA,CACJ,MAAA,EACA,WAAA,EACuC;AACvC,IAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAmC;AAAA,MACpD,QAAA,EAAU,CAAA,EAAGA,oBAAA,CAAc,aAAa,CAAA,QAAA,CAAA;AAAA,MACxC,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAM,aAAA,CACJ,MAAA,EACA,WAAA,EAC2B;AAC3B,IAAA,OAAO,wBAAA,CAAyB;AAAA,MAC9B,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,WAAA;AAAA,MACA,GAAG;AAAA,KACJ,CAAA;AAAA,EACH;AACF;AKpnBO,IAAM,oBAAN,MAAwB;AAAA,EAC7B,YAAoB,MAAA,EAAqB;AAArB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAsB;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1C,MAAM,kBAAA,CAAmB;AAAA,IACvB,MAAA;AAAA,IACA,WAAA;AAAA,IACA,cAAA,GAAiB;AAAA;AAAA,GACnB,EAIoB;AAClB,IAAA,OAAO,2BAAA,CAA4B;AAAA,MACjC,MAAA,EAAQ;AAAA,QACN,GAAG,MAAA;AAAA,QACH;AAAA,OACF;AAAA,MACA,WAAA;AAAA,MACA,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAA,CAAS;AAAA,IACb,MAAA;AAAA,IACA;AAAA,GACF,EAGoB;AAClB,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,OAAO,UAAA,EAAY,SAAA,EAAW,QAAO,GAAI,MAAA;AACrE,IAAA,MAAM,QAAA,GAAWK,yBAAmB,KAAK,CAAA;AACzC,IAAA,IAAI,kBAAkB,QAAA,CAAS,eAAA;AAC/B,IAAA,IAAI,WAAW,QAAA,CAAS,QAAA;AACxB,IAAA,IAAI,UAAU,OAAA,EAAS;AACrB,MAAA,IAAI,CAAC,UAAA,EAAY;AACf,QAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,MAC/D;AACA,MAAA,eAAA,GAAkB,UAAA,CAAW,eAAA;AAC7B,MAAA,QAAA,GAAW,UAAA,CAAW,QAAA;AAAA,IACxB;AACA,IAAA,MAAM,eAAA,GAAkBC,mBAAA,CAAa,MAAA,EAAQ,QAAQ,CAAA;AACrD,IAAA,OAAO,KAAK,kBAAA,CAAmB;AAAA,MAC7B,MAAA,EAAQ;AAAA,QACN,UAAA;AAAA,QACA,MAAA;AAAA,QACA,KAAA,EAAO;AAAA,UACL;AAAA,YACE,eAAA;AAAA,YACA,UAAA,EAAY,UAAA;AAAA,YACZ,QAAA,EAAU,CAAC,SAAA,EAAW,eAAA,EAAiB,KAAK;AAAA;AAC9C;AACF,OACF;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAQ,MAAA,EAQM;AAClB,IAAA,MAAM,eAAA,GAAkBA,mBAAA,CAAa,MAAA,CAAO,MAAA,EAAQ,OAAO,QAAQ,CAAA;AAEnE,IAAA,OAAO,KAAK,kBAAA,CAAmB;AAAA,MAC7B,MAAA,EAAQ;AAAA,QACN,YAAY,MAAA,CAAO,UAAA;AAAA,QACnB,QAAQ,MAAA,CAAO,MAAA;AAAA,QACf,KAAA,EAAO;AAAA,UACL;AAAA,YACE,iBAAiB,MAAA,CAAO,eAAA;AAAA,YACxB,UAAA,EAAY,SAAA;AAAA,YACZ,QAAA,EAAU,CAAC,MAAA,CAAO,OAAA,EAAS,iBAAiB,KAAK;AAAA;AACnD;AACF,OACF;AAAA,MACA,aAAa,MAAA,CAAO;AAAA,KACrB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,eAAA,CAAgB;AAAA,IACpB,MAAA;AAAA,IACA;AAAA,GACF,EAGoB;AAClB,IAAA,OAAO,KAAK,kBAAA,CAAmB;AAAA,MAC7B,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAA,CAAsB;AAAA,IAC1B,MAAA;AAAA,IACA;AAAA,GACF,EAGyB;AACvB,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAkB;AAAA,MACnD,QAAA,EAAU,CAAA,EAAGN,oBAAAA,CAAc,YAAY,CAAA,YAAA,CAAA;AAAA,MACvC,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAA,CACJ,KAAA,EACA,WAAA,EACyC;AACzC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAAoC;AAAA,MACrE,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,YAAY,CAAA,iBAAA,CAAA;AAAA,MACvC,MAAA,EAAQ,KAAA;AAAA,MACR;AAAA,KACD,CAAA;AACD,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAA,CAAe,QAAA,EAAkB,WAAA,EAA2C;AAChF,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAiB;AAAA,MAClC,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,YAAY,IAAI,QAAQ,CAAA,CAAA;AAAA,MACnD;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAA,CACJnD,MAAAA,EACA,WAAA,EACoC;AACpC,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAA+B;AAAA,MAChD,QAAA,EAAU,CAAA,EAAGmD,oBAAAA,CAAc,YAAY,IAAInD,MAAI,CAAA,OAAA,CAAA;AAAA,MAC/C;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,oBAAA,CACJ,MAAA,EACA,WAAA,EACuC;AACvC,IAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAmC;AAAA,MACpD,QAAA,EAAU,CAAA,EAAGmD,oBAAAA,CAAc,YAAY,CAAA,cAAA,CAAA;AAAA,MACvC,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF;AC5MO,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YAAoB,MAAA,EAAqB;AAArB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAsB;AAAA,EAE1C,MAAM,YAAA,CACJ,cAAA,EACA,QAAA,EACA,WAAA,EACiB;AACjB,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAY;AAAA,MAC7B,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,SAAS,CAAA,WAAA,CAAA;AAAA,MACpC,WAAA;AAAA,MACA,MAAA,EAAQ,EAAE,cAAA,EAAgB,QAAA;AAAS,KACpC,CAAA;AAAA,EACH;AACF,CAAA;;;ACMO,IAAM,oBAAN,MAAwB;AAAA,EAI7B,YAAoB,MAAA,EAAqB;AAArB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAClB,IAAA,IAAA,CAAK,YAAA,GAAe,IAAI,iBAAA,CAAkB,MAAM,CAAA;AAChD,IAAA,IAAA,CAAK,SAAA,GAAY,IAAI,cAAA,CAAe,MAAM,CAAA;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,WAAA,CAAY,MAAA,EAAiC,WAAA,EAA2C;AAC5F,IAAA,MAAM,EAAE,OAAO,YAAA,EAAc,cAAA,EAAgB,UAAU,KAAA,EAAO,KAAA,EAAO,UAAA,EAAY,MAAA,EAAO,GACtF,MAAA;AAEF,IAAA,IAAI,KAAA,KAAUO,YAAM,QAAA,EAAU;AAC5B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qCAAA,EAAwC,KAAK,CAAA,CAAE,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,WAAA,GAAcF,yBAAmB,KAAK,CAAA;AAC5C,IAAA,IAAI,CAAC,aAAa,eAAA,EAAiB;AACjC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8CAAA,EAAiD,KAAK,CAAA,CAAE,CAAA;AAAA,IAC1E;AAEA,IAAA,MAAM,YAAY,MAAM,IAAA,CAAK,UAAU,YAAA,CAAa,cAAA,EAAgB,UAAU,WAAW,CAAA;AACzF,IAAA,MAAM,eAAe,WAAA,CAAY,eAAA;AAEjC,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,IAAK,aAAa,CAAA,EAAG;AACjD,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,SAAS,CAAA,0BAAA,CAA4B,CAAA;AAAA,IAC9E;AAEA,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,GAAA,CAAI,SAAA,EAAW,IAAQ,CAAA;AACjD,IAAA,MAAM,eAAeC,mBAAAA,CAAa,YAAA,CAAa,QAAA,EAAS,EAAG,YAAY,QAAQ,CAAA;AAE/E,IAAA,MAAM,KAAA,GAAgB;AAAA,MACpB;AAAA,QACE,eAAA,EAAiB,YAAA;AAAA,QACjB,UAAA,EAAY,SAAA;AAAA,QACZ,QAAA,EAAUtD,kBAAS,OAAA,CAAQ;AAAA,UACzB,SAASwD,oBAAA,CAAc,2BAAA;AAAA,UACvB,MAAA,EAAQC,cAAA,CAAM,OAAA,CAAQ,YAAY;AAAA,SACnC;AAAA,OACH;AAAA,MACA;AAAA,QACE,iBAAiBD,oBAAA,CAAc,2BAAA;AAAA,QAC/B,UAAA,EAAY,kBAAA;AAAA,QACZ,QAAA,EAAUxD,kBAAS,OAAA,CAAQ;AAAA,UACzB,KAAA,EAAO,YAAA;AAAA,UACP,MAAA,EAAQyD,cAAA,CAAM,OAAA,CAAQ,YAAY,CAAA;AAAA,UAClC,aAAazC,yBAAAA,CAAS,MAAA;AAAA,YACpBA,yBAAAA,CAAS,GAAA,CAAI,SAAA,CAAU,MAAA,CAAO,EAAE;AAAA;AAAA,WAClC,CACG,QAAA,EAAS,CACT,KAAA,CAAM,GAAG,EAAE,CAAA;AAAA,UACd,YAAA,EAAc,KAAA;AAAA,UACd,eAAe0C,kBAAA,CAAY;AAAA,SAC5B;AAAA,OACH;AAAA,MACA;AAAA,QACE,iBAAiBF,oBAAA,CAAc,kBAAA;AAAA,QAC/B,UAAA,EAAY,WAAA;AAAA,QACZ,QAAA,EAAUxD,kBAAS,OAAA,CAAQ;AAAA,UACzB,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,QAAA,EAAU;AAAA,YACR,cAAc2D,oBAAA,CAAc,WAAA;AAAA,YAC5B,SAAA,EAAW,KAAK,GAAA,EAAI;AAAA,YACpB,eAAe9D,aAAAA,CAAK,cAAA,CAAe,OAAO,SAAA,IAAa,KAAK,EAAE,QAAA,EAAS;AAAA,YACvE,GAAA,EAAK,IAAA;AAAA,YACL,MAAA,EAAQ4D,cAAA,CAAM,OAAA,CAAQ,YAAY;AAAA;AACpC,SACD;AAAA;AACH,KACF;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,YAAA,CAAa,kBAAA,CAAmB;AAAA,MACxD,MAAA,EAAQ;AAAA,QACN,UAAA;AAAA,QACA,MAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,WAAA;AAAA,MACA,cAAA,EAAgB;AAAA,KACjB,CAAA;AAED,IAAA,MAAM,IAAA,GAA8B;AAAA,MAClC,eAAA,EAAiB,MAAA;AAAA,MACjB,eAAe,MAAA,CAAO,SAAA;AAAA,MACtB,KAAA;AAAA,MACA,YAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA;AAAA,KACF;AAGA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAkB;AAAA,MACnD,QAAA,EAAU,CAAA,EAAGT,oBAAAA,CAAc,aAAa,CAAA,CAAA;AAAA,MACxC,WAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,cAAA,CAAe,EAAA,EAAY,WAAA,EAA2C;AAC1E,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAAiB;AAAA,MAClD,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,aAAa,IAAI,EAAE,CAAA,CAAA;AAAA,MAC9C;AAAA,KACD,CAAA;AACD,IAAA,OAAO,QAAA;AAAA,EACT;AACF;AC1IO,IAAM,YAAN,MAAgB;AAAA,EACrB,YAAoB,MAAA,EAAqB;AAArB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO1C,MAAM,UAAA,CAAW,MAAA,EAAyB,WAAA,EAAsD;AAC9F,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAA4B;AAAA,MAC7D,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,IAAI,CAAA,CAAA;AAAA,MAC/B,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,MAAA,CAAO,EAAA,EAAY,WAAA,EAAmC;AAC1D,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAS;AAAA,MAC1B,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,IAAI,IAAI,EAAE,CAAA,CAAA;AAAA,MACrC;AAAA,KACD,CAAA;AAAA,EACH;AACF;;;ACrBA/B,gBAAAA,EAAAA;ACZA,IAAM,WAAA,GAAc,EAAA,IAAM,IAAA,GAAO,GAAA,GAAM,MAAM,IAAA,GAAO,EAAA;AAEpD,IAAM,QAAA,GAAW,uBAAA;AACjB,IAAM,YAAA,GAAe,OAAA;AACrB,IAAM,gBAAA,GAAmB,0BAAA;AAelB,SAAS,qBAAqB,WAAA,EAA0C;AAC7E,EAAA,OAAO,WAAA,CAAY,GAAA,CAAI,CAAC,KAAA,KAAU;AAChC,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAK,CAAA,CAAE,IAAA,EAAK;AAEjC,IAAA,IAAI,SAAS,IAAA,CAAK,KAAK,KAAK,YAAA,CAAa,IAAA,CAAK,KAAK,CAAA,EAAG;AACpD,MAAA,MAAM,IAAA,GAAO,OAAO,KAAK,CAAA;AACzB,MAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,QAAA,MAAM,IAAImB,wBAAAA;AAAA,UACR,sBAAsB,KAAK,CAAA,sCAAA,CAAA;AAAA,UAC3BC,qBAAAA,CAAe;AAAA,SACjB;AAAA,MACF;AACA,MAAA,OAAOQ,YAAAA,CAAI,MAAM,IAAI,CAAA;AAAA,IACvB;AAEA,IAAA,IAAI,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAChC,MAAA,OAAOhD,aAAAA,CAAK,oBAAoB,KAAK,CAAA;AAAA,IACvC;AAEA,IAAA,MAAM,IAAIuC,wBAAAA;AAAA,MACR,uBAAuB,KAAK,CAAA,uDAAA,CAAA;AAAA,MAC5BC,qBAAAA,CAAe;AAAA,KACjB;AAAA,EACF,CAAC,CAAA;AACH;AAoBO,SAAS,iBAAA,CACd,QACA,UAAA,EACoB;AACpB,EAAA,MAAM,aAAa,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AAC3C,EAAA,MAAM,WAAW,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACzC,EAAA,MAAM,YAAY,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AAE1C,EAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,GAAA,CAAI,QAAA,GAAW,WAAW,CAAC,CAAA;AACvD,EAAA,MAAM,QAAA,GAAW,UAAA,KAAe,CAAA,IAAK,UAAA,IAAc,cAAc,cAAA,GAAiB,CAAA;AAElF,EAAA,OAAO,EAAE,QAAA,EAAU,UAAA,EAAY,cAAA,EAAgB,kBAAA,EAAoB,EAAC,EAAE;AACxE;AC/DA,IAAM,SAAA,GAAA,CAAa,MAAM,IAAA,IAAQ,EAAA;AACjC,IAAM,QAAA,GAAA,CAAY,MAAM,IAAA,IAAQ,EAAA;AAChC,IAAM,OAAA,GAAA,CAAW,MAAM,GAAA,IAAO,EAAA;AAE9B,SAAS,UAAU,KAAA,EAAiC;AAClD,EAAA,OAAO,CAACQ,YAAAA,CAAI,KAAA,CAAM,KAAA,GAAQ,SAAS,GAAGA,YAAAA,CAAI,KAAA,CAAM,KAAA,IAAS,IAAI,CAAC,CAAA;AAChE;AAGO,SAAS,sBAAA,CAAuB,eAAuB,aAAA,EAAoC;AAChG,EAAA,MAAM,kBAAA,GAAqB,oBAAA,CAAqB,aAAA,CAAc,kBAAkB,CAAA;AAChF,EAAA,OAAO;AAAA,IACL,eAAA,EAAiB,aAAA;AAAA,IACjB,YAAYe,0BAAA,CAAoB,aAAA;AAAA,IAChC,QAAA,EAAU;AAAA,MACR,aAAA,CAAc,gBAAA;AAAA,MACdf,YAAAA,CAAI,KAAA,CAAM,aAAA,CAAc,UAAU,CAAA;AAAA,MAClCA,YAAAA,CAAI,KAAA,CAAM,aAAA,CAAc,QAAQ,CAAA;AAAA,MAChCA,YAAAA,CAAI,KAAA,CAAM,kBAAA,CAAmB,MAAM,CAAA;AAAA,MACnC,GAAG;AAAA;AACL,GACF;AACF;AAGO,SAAS,yBAAA,CAA0B,eAAuB,gBAAA,EAAgC;AAC/F,EAAA,OAAO;AAAA,IACL,eAAA,EAAiB,aAAA;AAAA,IACjB,YAAYe,0BAAA,CAAoB,MAAA;AAAA,IAChC,QAAA,EAAU,CAAC,gBAAgB;AAAA,GAC7B;AACF;AAMO,SAAS,6BAA6B,MAAA,EAAoC;AAC/E,EAAA,MAAM,EAAE,KAAA,EAAO,UAAA,EAAY,YAAA,EAAc,eAAc,GAAI,MAAA;AAE3D,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,IAAA,EAAK,CAAE,WAAW,CAAA,EAAG;AACvC,IAAA,MAAM,IAAIxB,wBAAAA;AAAA,MACR,+CAA+C,KAAK,CAAA,CAAA,CAAA;AAAA,MACpDC,qBAAAA,CAAe;AAAA,KACjB;AAAA,EACF;AACA,EAAA,IACE,OAAO,aAAA,KAAkB,QAAA,IACzB,CAAC,MAAA,CAAO,QAAA,CAAS,aAAa,CAAA,IAC9B,CAAC,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA,IAC/B,aAAA,IAAiB,KACjB,MAAA,CAAO,aAAa,IAAI,OAAA,EACxB;AACA,IAAA,MAAM,IAAID,wBAAAA;AAAA,MACR,4BAA4B,aAAa,CAAA,8CAAA,CAAA;AAAA,MACzCC,qBAAAA,CAAe;AAAA,KACjB;AAAA,EACF;AACA,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,GAAa,QAAA,EAAU;AAC5C,IAAA,MAAM,IAAID,wBAAAA;AAAA,MACR,CAAA,iDAAA,CAAA;AAAA,MACAC,qBAAAA,CAAe;AAAA,KACjB;AAAA,EACF;AACA,EAAA,IAAI,YAAA,GAAe,EAAA,IAAM,YAAA,GAAe,QAAA,EAAU;AAChD,IAAA,MAAM,IAAID,wBAAAA;AAAA,MACR,CAAA,mDAAA,CAAA;AAAA,MACAC,qBAAAA,CAAe;AAAA,KACjB;AAAA,EACF;AACA,EAAA,IAAI,YAAA,GAAe,EAAA,IAAM,UAAA,GAAa,YAAA,EAAc;AAClD,IAAA,MAAM,IAAID,wBAAAA;AAAA,MACR,CAAA,qCAAA,EAAwC,UAAU,CAAA,8BAAA,EAAiC,YAAY,CAAA,CAAA,CAAA;AAAA,MAC/FC,qBAAAA,CAAe;AAAA,KACjB;AAAA,EACF;AACF;AASO,SAAS,0BAAA,CACd,eACA,MAAA,EACM;AACN,EAAA,4BAAA,CAA6B,MAAM,CAAA;AACnC,EAAA,MAAM,CAAC,aAAA,EAAe,cAAc,CAAA,GAAI,SAAA,CAAU,OAAO,UAAU,CAAA;AACnE,EAAA,MAAM,CAAC,eAAA,EAAiB,gBAAgB,CAAA,GAAI,SAAA,CAAU,OAAO,YAAY,CAAA;AACzE,EAAA,OAAO;AAAA,IACL,eAAA,EAAiB,aAAA;AAAA,IACjB,YAAYuB,0BAAA,CAAoB,mBAAA;AAAA,IAChC,QAAA,EAAU;AAAA,MACR,MAAA,CAAO,gBAAA;AAAA,MACP,MAAA,CAAO,KAAA;AAAA,MACP,aAAA;AAAA,MACA,cAAA;AAAA,MACA,eAAA;AAAA,MACA,gBAAA;AAAA,MACAf,YAAAA,CAAI,KAAA,CAAM,MAAA,CAAO,aAAa;AAAA;AAChC,GACF;AACF;AAGO,SAAS,6BAAA,CACd,aAAA,EACA,gBAAA,EACA,KAAA,EACM;AACN,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,IAAA,EAAK,CAAE,WAAW,CAAA,EAAG;AACvC,IAAA,MAAM,IAAIT,wBAAAA;AAAA,MACR,uDAAuD,KAAK,CAAA,CAAA,CAAA;AAAA,MAC5DC,qBAAAA,CAAe;AAAA,KACjB;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,eAAA,EAAiB,aAAA;AAAA,IACjB,YAAYuB,0BAAA,CAAoB,sBAAA;AAAA,IAChC,QAAA,EAAU,CAAC,gBAAA,EAAkB,KAAK;AAAA,GACpC;AACF;AAOO,SAAS,sBAAA,CACd,aAAA,EACA,aAAA,EACA,gBAAA,GAAkF,EAAC,EAC3E;AACR,EAAA,OAAO;AAAA,IACL,sBAAA,CAAuB,eAAe,aAAa,CAAA;AAAA,IACnD,GAAG,gBAAA,CAAiB,GAAA;AAAA,MAAI,CAAC,MAAA,KACvB,0BAAA,CAA2B,aAAA,EAAe;AAAA,QACxC,GAAG,MAAA;AAAA,QACH,kBAAkB,aAAA,CAAc;AAAA,OACjC;AAAA;AACH,GACF;AACF;;;AFhHO,IAAM,gBAAN,MAAoB;AAAA,EACzB,YAAoB,MAAA,EAAqB;AAArB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBlC,8BAAA,CACN,UAAA,EACA,SAAA,EACA,eAAA,EACM;AACN,IAAA,IAAI,UAAA,KAAe,OAAA,IAAW,UAAA,KAAe,MAAA,EAAQ;AACnD,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,kBAAA,EAAqB,SAAS,CAAA,qBAAA,CAAA,EAAyB;AAAA,QACnE,QAAA,EAAU,UAAA;AAAA,QACV,QAAA,EAAU,eAAA;AAAA,QACV,eAAe,eAAA,GAAkB,eAAA,CAAgB,MAAM,CAAA,EAAG,EAAE,IAAI,KAAA,GAAQ,gBAAA;AAAA,QACxE,IAAA,EAAM;AAAA,OACP,CAAA;AACD,MAAA,MAAM,IAAIxB,wBAAAA;AAAA,QACR,CAAA,sDAAA,EAAyD,cAAc,WAAW,CAAA,EAAA,CAAA;AAAA,QAClFC,qBAAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,MAAM,KAAA,EAA2B;AACvC,IAAA,OACE,OACA,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA,CACb,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AAAA,EAEd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiCA,iBAAiB,MAAA,EAAgD;AAC/D,IAAA,MAAM,EAAE,UAAA,EAAY,eAAA,GAAkBwB,uBAAA,CAAiB,kBAAiB,GAAI,MAAA;AAE5E,IAAA,IACE,OAAO,eAAA,KAAoB,QAAA,IAC3B,CAAC,OAAO,QAAA,CAAS,eAAe,CAAA,IAChC,CAAC,MAAA,CAAO,SAAA,CAAU,eAAe,CAAA,IACjC,mBAAmB,CAAA,EACnB;AACA,MAAA,MAAM,IAAIzB,wBAAAA;AAAA,QACR,6BAA6B,eAAe,CAAA,6BAAA,CAAA;AAAA,QAC5CC,qBAAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,IAAI;AAEF,MAAA,MAAM,aAAA,GAAgBnB,WAAAA,CAAG,UAAA,CAAW,KAAA,CAAM,gBAAA,EAAiB;AAC3D,MAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,KAAA,CAAM,aAAa,CAAA;AAG9C,MAAA,MAAM,SAAA,GAAYA,WAAAA,CAAG,UAAA,CAAW,WAAA,CAAY,aAAa,CAAA;AAGzD,MAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAA,GAAI,eAAA;AAGnD,MAAA,MAAM,mBAAA,GAAsBJ,yBAAA,CAAkB,aAAA,EAAe,UAAU,CAAA;AAQvE,MAAA,OAAO;AAAA,QACL,SAAA;AAAA,QACA,mBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AACpE,MAAA,OAAA,CAAQ,MAAM,0DAAA,EAA4D;AAAA,QACxE,OAAO,GAAA,CAAI,OAAA;AAAA,QACX,iBAAA,EAAmB;AAAA,OACpB,CAAA;AACD,MAAA,MAAM,IAAIsB,wBAAAA;AAAA,QACR,CAAA,8BAAA,EAAiC,IAAI,OAAO,CAAA,CAAA;AAAA,QAC5CC,qBAAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BA,MAAM,uBAAA,CAAwB,MAAA,EAA6B,WAAA,EAAsC;AAC/F,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,aAAA,EAAc,GAAI,MAAA;AAG9C,IAAA,IAAA,CAAK,8BAAA,CAA+B,MAAA,CAAO,UAAA,EAAY,eAAA,EAAiB,OAAO,SAAS,CAAA;AAExF,IAAA,IAAI;AACF,MAAA,OAAA,CAAQ,IAAI,+DAAA,EAAiE;AAAA,QAC3E,eAAe,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,eAAe,aAAA,CAAc,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC7D,YAAY,IAAI,IAAA,CAAK,cAAc,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY;AAAA,QAClE,UAAU,aAAA,CAAc,QAAA;AAAA,QACxB,kBAAA,EAAoB,cAAc,kBAAA,CAAmB;AAAA,OACtD,CAAA;AAID,MAAA,MAAM,OAAA,GAAU,sBAAA,CAAuB,MAAA,CAAO,SAAA,EAAW,aAAa,CAAA;AAQtE,MAAA,MAAM,MAAA,GAAS,MAAM,2BAAA,CAA4B;AAAA,QAC/C,MAAA,EAAQ;AAAA,UACN,UAAA;AAAA,UACA,MAAA;AAAA,UACA,KAAA,EAAO,CAAC,OAAO,CAAA;AAAA,UACf,cAAA,EAAgB;AAAA;AAAA,SAClB;AAAA,QACA,WAAA;AAAA,QACA,QAAQ,IAAA,CAAK;AAAA,OACd,CAAA;AAED,MAAA,OAAA,CAAQ,IAAI,kEAAA,EAAoE;AAAA,QAC9E,MAAA;AAAA,QACA,eAAe,aAAA,CAAc,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAC9D,CAAA;AAED,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AACpE,MAAA,OAAA,CAAQ,MAAM,sDAAA,EAAwD;AAAA,QACpE,OAAO,GAAA,CAAI,OAAA;AAAA,QACX,eAAe,MAAA,CAAO,SAAA,EAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAChD,eAAe,aAAA,CAAc,gBAAA,EAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC9D,YAAY,IAAI,IAAA,CAAK,cAAc,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY;AAAA,QAClE,UAAU,aAAA,CAAc;AAAA,OACzB,CAAA;AACD,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,MAAM,YAAA,CAAa,MAAA,EAA4B,WAAA,EAAsC;AACnF,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,eAAe,gBAAA,GAAmB,IAAG,GAAI,MAAA;AAErE,IAAA,IAAA,CAAK,8BAAA,CAA+B,MAAA,CAAO,UAAA,EAAY,OAAA,EAAS,OAAO,SAAS,CAAA;AAGhF,IAAA,MAAM,KAAA,GAAQ,sBAAA,CAAuB,MAAA,CAAO,SAAA,EAAW,eAAe,gBAAgB,CAAA;AAEtF,IAAA,OAAA,CAAQ,IAAI,qEAAA,EAAuE;AAAA,MACjF,eAAe,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,MAC/C,eAAe,aAAA,CAAc,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,MAC7D,YAAY,IAAI,IAAA,CAAK,cAAc,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY;AAAA,MAClE,UAAU,aAAA,CAAc,QAAA;AAAA,MACxB,kBAAA,EAAoB,cAAc,kBAAA,CAAmB,MAAA;AAAA,MACrD,kBAAkB,gBAAA,CAAiB;AAAA,KACpC,CAAA;AAED,IAAA,OAAO,2BAAA,CAA4B;AAAA,MACjC,MAAA,EAAQ;AAAA,QACN,UAAA;AAAA,QACA,MAAA;AAAA,QACA,KAAA;AAAA,QACA,cAAA,EAAgB;AAAA;AAAA,OAClB;AAAA,MACA,WAAA;AAAA,MACA,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAM,gBAAA,CAAiB,MAAA,EAAgC,WAAA,EAAsC;AAC3F,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,gBAAA,EAAiB,GAAI,MAAA;AAGjD,IAAA,IAAA,CAAK,8BAAA,CAA+B,MAAA,CAAO,UAAA,EAAY,QAAA,EAAU,OAAO,SAAS,CAAA;AAEjF,IAAA,IAAI;AACF,MAAA,OAAA,CAAQ,IAAI,0DAAA,EAA4D;AAAA,QACtE,eAAe,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,eAAA,EAAiB,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAClD,CAAA;AAQD,MAAA,MAAM,MAAA,GAAS,MAAM,2BAAA,CAA4B;AAAA,QAC/C,MAAA,EAAQ;AAAA,UACN,UAAA;AAAA,UACA,MAAA;AAAA,UACA,OAAO,CAAC,yBAAA,CAA0B,MAAA,CAAO,SAAA,EAAW,gBAAgB,CAAC,CAAA;AAAA,UACrE,cAAA,EAAgB;AAAA;AAAA,SAClB;AAAA,QACA,WAAA;AAAA,QACA,QAAQ,IAAA,CAAK;AAAA,OACd,CAAA;AAED,MAAA,OAAA,CAAQ,IAAI,wDAAA,EAA0D;AAAA,QACpE,MAAA;AAAA,QACA,cAAA,EAAgB,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OACjD,CAAA;AAED,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AACpE,MAAA,OAAA,CAAQ,MAAM,6CAAA,EAA+C;AAAA,QAC3D,OAAO,GAAA,CAAI,OAAA;AAAA,QACX,eAAe,MAAA,CAAO,SAAA,EAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAChD,eAAA,EAAiB,gBAAA,EAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OACnD,CAAA;AACD,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2BA,MAAM,eAAe,MAAA,EAA4D;AAC/E,IAAA,MAAM,EAAE,aAAA,EAAe,gBAAA,EAAiB,GAAI,MAAA;AAE5C,IAAA,IAAI;AACF,MAAA,OAAA,CAAQ,IAAI,kDAAA,EAAoD;AAAA,QAC9D,aAAA,EAAe,aAAA,CAAc,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC5C,aAAA,EAAe,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAChD,CAAA;AAGD,MAAA,MAAM,SAAS,MAAMR,sBAAAA;AAAA,QACnB,CAAC,QAAA,KACC,QAAA,CAAS,YAAA,CAAa;AAAA,UACpB,eAAA,EAAiB,aAAA;AAAA,UACjB,YAAY+B,0BAAAA,CAAoB,QAAA;AAAA,UAChC,QAAA,EAAU,CAAC,gBAAgB;AAAA,SAC5B,CAAA;AAAA,QACH,EAAE,WAAA,EAAa7B,2BAAAA,CAAqB,OAAO,CAAA;AAAE,OAC/C;AAKA,MAAA,MAAM,WAAA,GAAc,MAAM,OAAA,CAAQ,MAAM,IACpC,MAAA,GACC,MAAA,CAAiC,UAAU,EAAC;AAEjD,MAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1B,QAAA,OAAA,CAAQ,KAAK,uDAAA,EAAyD;AAAA,UACpE,cAAc,WAAA,CAAY,MAAA;AAAA,UAC1B,MAAA,EAAQ;AAAA,SACT,CAAA;AACD,QAAA,OAAO;AAAA,UACL,QAAA,EAAU,KAAA;AAAA,UACV,UAAA,EAAY,CAAA;AAAA,UACZ,cAAA,EAAgB,CAAA;AAAA,UAChB,oBAAoB;AAAC,SACvB;AAAA,MACF;AAEA,MAAA,MAAM,EAAE,QAAA,EAAU,UAAA,EAAY,cAAA,EAAgB,oBAAmB,GAAI,iBAAA;AAAA,QACnE,WAAA;AAAA,QACA,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI;AAAA,OAC9B;AAEA,MAAA,MAAM,WAAA,GAAmC;AAAA,QACvC,QAAA;AAAA,QACA,UAAA;AAAA,QACA,cAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,OAAA,CAAQ,IAAI,mDAAA,EAAqD;AAAA,QAC/D,QAAA;AAAA,QACA,YAAY,IAAI,IAAA,CAAK,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY;AAAA,QACpD,cAAA;AAAA;AAAA,QAEA,uBAAuB,MAAA,CAAO,MAAA,CAAO,WAAA,CAAY,CAAC,CAAC,CAAC;AAAA,OACrD,CAAA;AAED,MAAA,OAAO,WAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AAGpE,MAAA,MAAM,uBAAA,GAA0B;AAAA,QAC9B,yBAAA;AAAA,QACA,qCAAA;AAAA,QACA,2BAAA;AAAA,QACA,qBAAA;AAAA,QACA,kBAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,MAAM,iBAAA,GAAoB,wBAAwB,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,IAAA,CAAK,GAAA,CAAI,OAAO,CAAC,CAAA;AAEjF,MAAA,IAAI,iBAAA,EAAmB;AACrB,QAAA,OAAA,CAAQ,IAAI,0DAAA,EAA4D;AAAA,UACtE,aAAA,EAAe,aAAA,EAAe,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,UAC7C,aAAA,EAAe,gBAAA,EAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,SACjD,CAAA;AACD,QAAA,OAAO;AAAA,UACL,QAAA,EAAU,KAAA;AAAA,UACV,UAAA,EAAY,CAAA;AAAA,UACZ,cAAA,EAAgB,CAAA;AAAA,UAChB,oBAAoB;AAAC,SACvB;AAAA,MACF;AAGA,MAAA,OAAA,CAAQ,MAAM,8CAAA,EAAgD;AAAA,QAC5D,OAAO,GAAA,CAAI,OAAA;AAAA,QACX,aAAA,EAAe,aAAA,EAAe,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC7C,aAAA,EAAe,gBAAA,EAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OACjD,CAAA;AACD,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4CA,MAAM,6BAAA,CACJ,MAAA,EACA,WAAA,EACiB;AACjB,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,OAAA,EAAS,OAAM,GAAI,MAAA;AAQ/C,IAAA,IAAI,OAAO,UAAA,IAAc,MAAA,CAAO,eAAe,OAAA,IAAW,MAAA,CAAO,eAAe,MAAA,EAAQ;AACtF,MAAA,MAAM,IAAIK,wBAAAA;AAAA,QACR,CAAA,2DAAA,EAA8D,OAAO,UAAU,CAAA,CAAA;AAAA,QAC/EC,qBAAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAKA,IAAA,OAAO,sCAAA,CAAuC;AAAA,MAC5C,MAAA,EAAQ;AAAA,QACN,UAAA;AAAA,QACA,QAAQ,EAAE,GAAG,QAAQ,UAAA,EAAY,MAAA,CAAO,cAAc,OAAA,EAAQ;AAAA,QAC9D,OAAA;AAAA,QACA,KAAA;AAAA,QACA,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,WAAA;AAAA,MACA,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,QAAA,CAAS,KAAa,IAAA,EAAsB;AAClD,IAAA,OAAO,MAAA,CAAO,GAAG,CAAA,IAAK,MAAA,CAAO,IAAI,CAAA,IAAK,IAAA,CAAA;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA+BA,MAAM,iBAAA,CAAkB,MAAA,EAAiC,WAAA,EAAsC;AAC7F,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,oBAAA,EAAqB,GAAI,MAAA;AACrD,IAAA,MAAM,EAAE,gBAAA,EAAkB,KAAA,EAAO,UAAA,EAAY,YAAA,EAAc,eAAc,GACvE,oBAAA;AAKF,IAAA,IAAI,OAAO,UAAA,IAAc,MAAA,CAAO,eAAe,OAAA,IAAW,MAAA,CAAO,eAAe,MAAA,EAAQ;AACtF,MAAA,MAAM,IAAID,wBAAAA;AAAA,QACR,CAAA,0DAAA,EAA6D,OAAO,UAAU,CAAA,CAAA;AAAA,QAC9EC,qBAAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAGA,IAAA,4BAAA,CAA6B,oBAAoB,CAAA;AAEjD,IAAA,IAAI;AACF,MAAA,OAAA,CAAQ,IAAI,8DAAA,EAAgE;AAAA,QAC1E,eAAe,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,aAAA,EAAe,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,KAAA,EAAO,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC5B,UAAA,EAAY,WAAW,QAAA,EAAS;AAAA,QAChC,YAAA,EAAc,aAAa,QAAA,EAAS;AAAA,QACpC;AAAA,OACD,CAAA;AAGD,MAAA,MAAM,aAAA,GAAgB,0BAAA,CAA2B,MAAA,CAAO,SAAA,EAAW,oBAAoB,CAAA;AAUvF,MAAA,MAAM,MAAA,GAAS,MAAM,2BAAA,CAA4B;AAAA,QAC/C,MAAA,EAAQ;AAAA,UACN,UAAA;AAAA,UACA,MAAA;AAAA,UACA,KAAA,EAAO,CAAC,aAAa,CAAA;AAAA,UACrB,cAAA,EAAgB;AAAA,SAClB;AAAA,QACA,WAAA;AAAA,QACA,QAAQ,IAAA,CAAK;AAAA,OACd,CAAA;AAED,MAAA,OAAA,CAAQ,IAAI,uEAAA,EAAyE;AAAA,QACnF,MAAA;AAAA,QACA,aAAA,EAAe,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,KAAA,EAAO,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAC7B,CAAA;AAED,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AACpE,MAAA,OAAA,CAAQ,MAAM,oEAAA,EAAsE;AAAA,QAClF,OAAO,GAAA,CAAI,OAAA;AAAA,QACX,eAAe,MAAA,CAAO,SAAA,EAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAChD,aAAA,EAAe,gBAAA,EAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAChD,KAAA,EAAO,KAAA,EAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAC9B,CAAA;AACD,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAM,kBAAkB,MAAA,EAA8D;AACpF,IAAA,MAAM,EAAE,aAAA,EAAe,gBAAA,EAAkB,KAAA,EAAM,GAAI,MAAA;AAEnD,IAAA,IAAI;AACF,MAAA,OAAA,CAAQ,IAAI,+DAAA,EAAiE;AAAA,QAC3E,aAAA,EAAe,aAAA,CAAc,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC5C,aAAA,EAAe,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,KAAA,EAAO,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAC7B,CAAA;AAGD,MAAA,MAAM,SAAS,MAAMR,sBAAAA;AAAA,QACnB,CAAC,QAAA,KACC,QAAA,CAAS,YAAA,CAAa;AAAA,UACpB,eAAA,EAAiB,aAAA;AAAA,UACjB,YAAY+B,0BAAAA,CAAoB,mBAAA;AAAA,UAChC,QAAA,EAAU,CAAC,gBAAA,EAAkB,KAAK;AAAA,SACnC,CAAA;AAAA,QACH,EAAE,WAAA,EAAa7B,2BAAAA,CAAqB,OAAO,CAAA;AAAE,OAC/C;AAIA,MAAA,MAAM,WAAA,GAAc,MAAM,OAAA,CAAQ,MAAM,IACpC,MAAA,GACC,MAAA,CAAiC,UAAU,EAAC;AAEjD,MAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1B,QAAA,OAAA,CAAQ,KAAK,iEAAA,EAAmE;AAAA,UAC9E,cAAc,WAAA,CAAY,MAAA;AAAA,UAC1B,MAAA,EAAQ;AAAA,SACT,CAAA;AACD,QAAA,OAAO;AAAA,UACL,UAAA,EAAY,EAAA;AAAA,UACZ,YAAA,EAAc,EAAA;AAAA,UACd,aAAA,EAAe,CAAA;AAAA,UACf,aAAA,EAAe,EAAA;AAAA,UACf,WAAA,EAAa;AAAA,SACf;AAAA,MACF;AAEA,MAAA,MAAM,UAAA,GAAiC;AAAA,QACrC,UAAA,EAAY,KAAK,QAAA,CAAS,WAAA,CAAY,CAAC,CAAA,EAAG,WAAA,CAAY,CAAC,CAAC,CAAA;AAAA,QACxD,YAAA,EAAc,KAAK,QAAA,CAAS,WAAA,CAAY,CAAC,CAAA,EAAG,WAAA,CAAY,CAAC,CAAC,CAAA;AAAA,QAC1D,eAAe,MAAA,CAAO,MAAA,CAAO,WAAA,CAAY,CAAC,CAAC,CAAC,CAAA;AAAA,QAC5C,aAAA,EAAe,KAAK,QAAA,CAAS,WAAA,CAAY,CAAC,CAAA,EAAG,WAAA,CAAY,CAAC,CAAC,CAAA;AAAA,QAC3D,aAAa,MAAA,CAAO,MAAA,CAAO,WAAA,CAAY,CAAC,CAAC,CAAC;AAAA,OAC5C;AAEA,MAAA,OAAA,CAAQ,IAAI,gEAAA,EAAkE;AAAA,QAC5E,UAAA,EAAY,UAAA,CAAW,UAAA,CAAW,QAAA,EAAS;AAAA,QAC3C,YAAA,EAAc,UAAA,CAAW,YAAA,CAAa,QAAA,EAAS;AAAA,QAC/C,eAAe,UAAA,CAAW,aAAA;AAAA,QAC1B,aAAA,EAAe,UAAA,CAAW,aAAA,CAAc,QAAA,EAAS;AAAA,QACjD,aAAa,UAAA,CAAW;AAAA,OACzB,CAAA;AAED,MAAA,OAAO,UAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AAGpE,MAAA,MAAM,gBAAA,GAAmB;AAAA,QACvB,yBAAA;AAAA,QACA,qCAAA;AAAA,QACA,2BAAA;AAAA,QACA,qBAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,MAAM,UAAA,GAAa,iBAAiB,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,IAAA,CAAK,GAAA,CAAI,OAAO,CAAC,CAAA;AAEnE,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,OAAA,CAAQ,GAAA;AAAA,UACN,uFAAA;AAAA,UACA;AAAA,YACE,aAAA,EAAe,aAAA,EAAe,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,YAC7C,aAAA,EAAe,gBAAA,EAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,YAChD,KAAA,EAAO,KAAA,EAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA;AAC/B,SACF;AACA,QAAA,OAAO;AAAA,UACL,UAAA,EAAY,EAAA;AAAA,UACZ,YAAA,EAAc,EAAA;AAAA,UACd,aAAA,EAAe,CAAA;AAAA,UACf,aAAA,EAAe,EAAA;AAAA,UACf,WAAA,EAAa;AAAA,SACf;AAAA,MACF;AAEA,MAAA,OAAA,CAAQ,MAAM,wDAAA,EAA0D;AAAA,QACtE,OAAO,GAAA,CAAI,OAAA;AAAA,QACX,aAAA,EAAe,aAAA,EAAe,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC7C,aAAA,EAAe,gBAAA,EAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAChD,KAAA,EAAO,KAAA,EAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAC9B,CAAA;AACD,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,MAAM,oBAAA,CACJ,MAAA,EACA,WAAA,EACiB;AACjB,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,gBAAA,EAAkB,OAAM,GAAI,MAAA;AAKxD,IAAA,IAAI,OAAO,UAAA,IAAc,MAAA,CAAO,eAAe,OAAA,IAAW,MAAA,CAAO,eAAe,MAAA,EAAQ;AACtF,MAAA,MAAM,IAAIK,wBAAAA;AAAA,QACR,CAAA,0DAAA,EAA6D,OAAO,UAAU,CAAA,CAAA;AAAA,QAC9EC,qBAAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,IAAA,EAAK,CAAE,WAAW,CAAA,EAAG;AACvC,MAAA,MAAM,IAAID,wBAAAA;AAAA,QACR,uDAAuD,KAAK,CAAA,CAAA,CAAA;AAAA,QAC5DC,qBAAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,OAAA,CAAQ,IAAI,kEAAA,EAAoE;AAAA,QAC9E,eAAe,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,aAAA,EAAe,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,KAAA,EAAO,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAC7B,CAAA;AAGD,MAAA,MAAM,UAAA,GAAa,6BAAA,CAA8B,MAAA,CAAO,SAAA,EAAW,kBAAkB,KAAK,CAAA;AAU1F,MAAA,MAAM,MAAA,GAAS,MAAM,2BAAA,CAA4B;AAAA,QAC/C,MAAA,EAAQ;AAAA,UACN,UAAA;AAAA,UACA,MAAA;AAAA,UACA,KAAA,EAAO,CAAC,UAAU,CAAA;AAAA,UAClB,cAAA,EAAgB;AAAA,SAClB;AAAA,QACA,WAAA;AAAA,QACA,QAAQ,IAAA,CAAK;AAAA,OACd,CAAA;AAED,MAAA,OAAA,CAAQ,IAAI,8EAAA,EAAgF;AAAA,QAC1F,MAAA;AAAA,QACA,aAAA,EAAe,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,KAAA,EAAO,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAC7B,CAAA;AAED,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AACpE,MAAA,OAAA,CAAQ,MAAM,0EAAA,EAA4E;AAAA,QACxF,OAAO,GAAA,CAAI,OAAA;AAAA,QACX,eAAe,MAAA,CAAO,SAAA,EAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAChD,aAAA,EAAe,gBAAA,EAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAChD,KAAA,EAAO,KAAA,EAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAC9B,CAAA;AACD,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AACF;AGlrBO,IAAM,gBAAN,MAAoB;AAAA,EACzB,WAAA,CACU,QACA,YAAA,EACR;AAFQ,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA;AAAA,EACP;AAAA,EAEK,KAAK,UAAA,EAA4B;AACvC,IAAA,OAAO,CAAA,EAAGW,oBAAAA,CAAc,UAAU,CAAA,CAAA,EAAI,UAAU,CAAA,aAAA,CAAA;AAAA,EAClD;AAAA;AAAA,EAGQ,OAAO,WAAA,EAA8B;AAC3C,IAAA,MAAM,KAAA,GAAQ,eAAe,IAAA,CAAK,YAAA;AAClC,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OAGF;AAAA,IACF;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAM,IAAA,CAAK,OAAA,GAAiC,EAAC,EAAkC;AAC7E,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,eAAA,EAAiB,aAAY,GAAI,OAAA;AACtD,IAAA,MAAM,SAAiC,EAAC;AACxC,IAAA,IAAI,IAAA,KAAS,MAAA,EAAW,MAAA,CAAO,IAAA,GAAO,OAAO,IAAI,CAAA;AACjD,IAAA,IAAI,KAAA,KAAU,MAAA,EAAW,MAAA,CAAO,KAAA,GAAQ,OAAO,KAAK,CAAA;AACpD,IAAA,IAAI,oBAAoB,MAAA,EAAW;AACjC,MAAA,MAAA,CAAO,eAAA,GAAkB,OAAO,eAAe,CAAA;AAAA,IACjD;AAEA,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAA0B;AAAA,MACtD,UAAUA,oBAAAA,CAAc,UAAA;AAAA,MACxB,MAAA;AAAA,MACA,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,WAAW;AAAA,KACrC,CAAA;AAED,IAAA,OAAO,EAAE,GAAG,GAAA,EAAK,OAAO,GAAA,CAAI,KAAA,IAAS,EAAC,EAAE;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAA,CACJ,UAAA,EACA,OAAA,GAAoC,EAAC,EACZ;AACzB,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAoB;AAAA,MACrC,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,UAAU,IAAI,UAAU,CAAA,OAAA,CAAA;AAAA,MACnD,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,WAAW;AAAA,KAC7C,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,MAAM,SAAA,CACJ,UAAA,EACA,OAAA,GAAoC,EAAC,EACZ;AACzB,IAAA,MAAM,EAAE,aAAA,EAAe,eAAA,EAAiB,WAAA,EAAY,GAAI,OAAA;AACxD,IAAA,MAAM,OAAsC,EAAC;AAG7C,IAAA,IAAI,aAAA,KAAkB,MAAA,EAAW,IAAA,CAAK,aAAA,GAAgB,aAAA;AACtD,IAAA,IAAI,eAAA,KAAoB,MAAA,EAAW,IAAA,CAAK,eAAA,GAAkB,eAAA;AAE1D,IAAA,OAAO,IAAA,CAAK,OAAO,KAAA,CAAsB;AAAA,MACvC,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,UAAU,IAAI,UAAU,CAAA,OAAA,CAAA;AAAA,MACnD,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,WAAW,CAAA;AAAA,MACpC;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAY,MAAA,EAA8C;AACxD,IAAA,MAAM,EAAE,UAAA,EAAY,WAAA,EAAY,GAAI,MAAA;AACpC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,UAAU,CAAA;AAEjC,IAAA,OAAO;AAAA;AAAA;AAAA,MAGL,MAAM,YAAY;AAChB,QAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAAmC;AAAA,UAC/D,QAAA,EAAU,IAAA;AAAA,UACV,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,WAAW;AAAA,SAC5C,CAAA;AACD,QAAA,OAAO,EAAE,GAAG,GAAA,EAAK,OAAO,GAAA,CAAI,KAAA,IAAS,EAAC,EAAE;AAAA,MAC1C,CAAA;AAAA;AAAA;AAAA,MAIA,OAAA,EAAS,OAAO,IAAA,KAAsB;AACpC,QAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAuB;AAAA,UACxC,QAAA,EAAU,IAAA;AAAA;AAAA;AAAA,UAGV,WAAA,EAAa,EAAA;AAAA,UACb,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,WAAA;AAAY,SAC9B,CAAA;AAAA,MACH,CAAA;AAAA;AAAA,MAGA,IAAA,EAAM,OAAO,UAAA,EAAoB,IAAA,KAAsB;AACrD,QAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAc;AAAA,UAC/B,QAAA,EAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,UAAU,CAAA,KAAA,CAAA;AAAA,UAC/B,WAAA,EAAa,EAAA;AAAA,UACb,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,WAAA;AAAY,SAC9B,CAAA;AAAA,MACH,CAAA;AAAA;AAAA,MAGA,OAAA,EAAS,OAAO,UAAA,EAAoB,QAAA,KAAuB;AACzD,QAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAoB;AAAA,UACrC,QAAA,EAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,UAAU,CAAA,QAAA,CAAA;AAAA,UAC/B,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,WAAW,CAAA;AAAA,UAC3C,IAAA,EAAM,EAAE,QAAA;AAAS,SAClB,CAAA;AAAA,MACH,CAAA;AAAA;AAAA,MAGA,sBAAsB,YAAY;AAChC,QAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAuB;AAAA,UACxC,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,UAAU,IAAI,UAAU,CAAA,mBAAA,CAAA;AAAA,UACnD,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,WAAW;AAAA,SAC5C,CAAA;AAAA,MACH;AAAA,KACF;AAAA,EACF;AACF;ACjVA,IAAM,yBAAA,GAA4B,GAAA;AAClC,IAAM,kBAAA,GAAqB,GAAA;AAG3B,SAAS,UAAU,cAAA,EAAkC;AACnD,EAAA,OACE,mBAAmB,MAAA,IACnB,cAAA,KAAmB,UAAA,IACnB,cAAA,KAAmB,aACnB,cAAA,KAAmB,eAAA;AAEvB;AAsBA,eAAsB,kBAAA,CACpB,eAAA,EACA,OAAA,GAAqC,EAAC,EACH;AACnC,EAAA,MAAM;AAAA,IACJ,UAAUjB,2BAAAA,CAAqB,KAAA;AAAA,IAC/B,eAAA,GAAkB,yBAAA;AAAA,IAClB,SAAA,GAAY;AAAA,GACd,GAAI,OAAA;AAEJ,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAG9B,EAAA,IAAI,SAAA;AAEJ,EAAA,WAAS;AACP,IAAA,IAAI;AAGF,MAAA,MAAM,UAAW,MAAMF,sBAAAA;AAAA,QACrB,CAAC,QAAA,KAAa,QAAA,CAAS,qBAAA,CAAsB,eAAe,CAAA;AAAA,QAC5D,EAAE,aAAa,OAAA;AAAQ,OACzB;AAQA,MAAA,IAAI,CAAC,SAAA,CAAU,OAAA,EAAS,eAAe,CAAA,EAAG;AACxC,QAAA,MAAM,QAAA,GAAW,QAAQ,gBAAA,KAAqB,UAAA;AAC9C,QAAA,OAAO;AAAA,UACL,eAAA;AAAA,UACA,SAAS,CAAC,QAAA;AAAA,UACV,iBAAiB,OAAA,CAAQ,gBAAA;AAAA,UACzB,gBAAgB,OAAA,CAAQ,eAAA;AAAA,UACxB,GAAI,WAAW,EAAE,YAAA,EAAc,QAAQ,aAAA,IAAiB,mBAAA,KAAwB,EAAC;AAAA,UACjF,MAAA,EAAQ,OAAA,CAAQ,MAAA,IAAU,EAAC;AAAA,UAC3B,GAAI,QAAQ,YAAA,KAAiB,KAAA,CAAA,GAAY,EAAE,WAAA,EAAa,OAAA,CAAQ,YAAA,EAAa,GAAI;AAAC,SACpF;AAAA,MACF;AAAA,IACF,SAAS,GAAA,EAAK;AAGZ,MAAA,SAAA,GAAY,GAAA;AAAA,IACd;AAEA,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,eAAA,IAAmB,QAAA,EAAU;AAC5C,MAAA,MAAM,SAAS,SAAA,YAAqB,KAAA,GAAQ,CAAA,EAAA,EAAK,SAAA,CAAU,OAAO,CAAA,CAAA,GAAK,EAAA;AACvE,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,gBAAA,EAAmB,SAAS,CAAA,eAAA,EAAkB,eAAe,GAAG,MAAM,CAAA,wEAAA;AAAA,OAExE;AAAA,IACF;AAEA,IAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,eAAe,CAAC,CAAA;AAAA,EACrE;AACF;AC5HA,IAAM,sBAAN,MAAiD;AAAA,EAAjD,WAAA,GAAA;AACE,IAAA,IAAA,CAAiB,IAAA,uBAAW,GAAA,EAAY;AAAA,EAAA;AAAA,EAExC,QAAQ,eAAA,EAAkC;AACxC,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,eAAe,GAAG,OAAO,KAAA;AAC3C,IAAA,IAAA,CAAK,IAAA,CAAK,IAAI,eAAe,CAAA;AAC7B,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAA;AAuCA,IAAM,iBAAA,GAAoB,MAAA,CAAOhC,aAAAA,CAAK,mBAAA,CAAoB,UAAU,CAAC,CAAA;AAErE,SAASiE,UAAS,KAAA,EAA+C;AAC/D,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,MAAA;AAChC,EAAA,IAAI;AACF,IAAA,OAAO,OAAO,KAAK,CAAA;AAAA,EACrB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAOA,SAAS,eACP,KAAA,EAC0D;AAC1D,EAAA,IAAIA,UAAS,KAAA,CAAM,IAAA,CAAK,CAAC,CAAC,CAAA,KAAM,mBAAmB,OAAO,MAAA;AAE1D,EAAA,MAAM,CAAC,MAAM,EAAA,EAAI,GAAA,EAAK,IAAI,CAAA,GACxB,KAAA,CAAM,KAAK,MAAA,IAAU,CAAA,GACjB,CAAC,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAG,KAAA,CAAM,KAAK,CAAC,CAAA,EAAG,MAAM,IAAA,CAAK,CAAC,GAAG,KAAA,CAAM,IAAA,CAAK,CAAC,CAAC,CAAA,GAC3D,CAAC,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAG,KAAA,CAAM,KAAK,CAAC,CAAA,EAAG,MAAM,IAAA,CAAK,CAAC,GAAG,KAAA,CAAM,IAAA,CAAK,CAAC,CAAC,CAAA;AAEjE,EAAA,MAAM,MAAA,GAAS,CAAC,IAAA,EAAM,EAAA,EAAI,KAAK,IAAI,CAAA,CAAE,IAAIA,SAAQ,CAAA;AACjD,EAAA,IAAI,OAAO,IAAA,CAAK,CAAC,MAAM,CAAA,KAAM,MAAS,GAAG,OAAO,MAAA;AAChD,EAAA,MAAM,CAAC,CAAA,EAAG,CAAA,EAAG,CAAA,EAAG,CAAC,CAAA,GAAI,MAAA;AACrB,EAAA,OAAO,EAAE,MAAM,CAAA,EAAG,EAAA,EAAI,GAAG,MAAA,EAAQ,CAAA,IAAK,KAAK,IAAA,CAAA,EAAM;AACnD;AAwCO,IAAM,oBAAN,MAAwB;AAAA,EAK7B,WAAA,CAAY,MAAA,GAAkC,EAAC,EAAG;AAChD,IAAA,MAAM,EAAE,WAAA,EAAa,UAAA,EAAY,GAAG,gBAAe,GAAI,MAAA;AACvD,IAAA,IAAA,CAAK,KAAA,GAAQ,WAAA,IAAe,IAAI,mBAAA,EAAoB;AACpD,IAAA,IAAA,CAAK,aAAa,UAAA,IAAc,kBAAA;AAChC,IAAA,IAAA,CAAK,cAAA,GAAiB,cAAA;AAAA,EACxB;AAAA,EAEA,MAAM,eAAe,MAAA,EAA6D;AAChF,IAAA,MAAM,EAAE,eAAA,EAAiB,KAAA,EAAO,IAAA,EAAM,EAAA,EAAI,WAAU,GAAI,MAAA;AACxD,IAAA,MAAM,UAAU,MAAM,IAAA,CAAK,UAAA,CAAW,eAAA,EAAiB,KAAK,cAAc,CAAA;AAE1E,IAAA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACpB,MAAA,OAAO,EAAE,OAAO,KAAA,EAAO,eAAA,EAAiB,QAAQ,UAAA,EAAY,MAAA,EAAQ,QAAQ,YAAA,EAAa;AAAA,IAC3F;AAEA,IAAA,MAAM,YAAA,GAAe,OAAO,KAAK,CAAA;AACjC,IAAA,MAAM,WAAA,GAAc,OAAO,IAAI,CAAA;AAC/B,IAAA,MAAM,SAAA,GAAY,OAAO,EAAE,CAAA;AAE3B,IAAA,IAAI,IAAA;AACJ,IAAA,KAAA,MAAW,KAAA,IAAS,QAAQ,MAAA,EAAQ;AAClC,MAAA,IAAIA,SAAAA,CAAS,KAAA,CAAM,YAAY,CAAA,KAAM,YAAA,EAAc;AACnD,MAAA,MAAM,QAAA,GAAW,eAAe,KAAK,CAAA;AACrC,MAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,SAAS,WAAA,IAAe,QAAA,CAAS,OAAO,SAAA,EAAW;AAC7E,MAAA,IAAI,SAAS,MAAA,IAAa,QAAA,CAAS,MAAA,GAAS,IAAA,SAAa,QAAA,CAAS,MAAA;AAAA,IACpE;AAEA,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,eAAA,EAAiB,QAAQ,oBAAA,EAAqB;AAAA,IACvE;AACA,IAAA,IAAI,OAAO,SAAA,EAAW;AACpB,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,eAAA;AAAA,QACA,MAAA,EAAQ,gBAAA;AAAA,QACR,MAAA,EAAQ,CAAA,KAAA,EAAQ,IAAI,CAAA,oBAAA,EAAuB,SAAS,CAAA;AAAA,OACtD;AAAA,IACF;AAGA,IAAA,MAAM,MAAM,IAAA,GAAO,MAAA,CAAO,eAAe,CAAA,CAAE,SAAS,EAAE,CAAA;AACtD,IAAA,IAAI,CAAE,MAAM,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAI;AACpC,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,eAAA,EAAiB,QAAQ,cAAA,EAAe;AAAA,IACjE;AAEA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,IAAA;AAAA,MACP,eAAA;AAAA,MACA,MAAA,EAAQ,IAAA;AAAA,MACR,GAAI,QAAQ,WAAA,KAAgB,MAAA,GAAY,EAAE,WAAA,EAAa,OAAA,CAAQ,WAAA,EAAY,GAAI;AAAC,KAClF;AAAA,EACF;AACF;;;AChLA,IAAM,OAAA,GAAU,KAAA;AAChB,IAAM,aAAA,uBAAoB,GAAA,CAAI,CAAC,QAAQ,QAAA,EAAU,UAAA,EAAY,MAAM,CAAC,CAAA;AAGpE,IAAM,iBAAA,GAAoB,CAAA;AAC1B,IAAM,mBAAA,GAAsB,GAAA;AAG5B,IAAM,OAAA,GAAU,CAAC,KAAA,KAAkB,IAAA,GAAO,MAAA,CAAO,KAAK,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,EAAA,EAAI,GAAG,CAAA;AAErF,SAAS,QAAA,CAAS,GAAW,CAAA,EAAoB;AAC/C,EAAA,IAAI;AACF,IAAA,OAAO,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAA;AAAA,EAC/B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAMA,SAAS,qBAAqB,GAAA,EAA8C;AAC1E,EAAA,IAAI,EAAE,GAAA,YAAetC,oBAAAA,CAAAA,IAAkB,GAAA,CAAI,MAAA,KAAW,KAAK,OAAO,MAAA;AAClE,EAAA,MAAM,UAAU,GAAA,CAAI,OAAA;AACpB,EAAA,OAAO,OAAA,EAAS,MAAM,OAAA,EAAS,IAAA;AAAA,IAC7B,CAAC,CAAA,KACC,CAAA,CAAE,MAAA,KAAW,OAAA,IACb,EAAE,OAAA,KAAY,kBAAA,IACd,CAAA,CAAE,KAAA,EAAO,kBAAkB,kBAAA,IAC3B,QAAA,CAAS,CAAA,CAAE,KAAA,EAAOuC,0BAAmB,YAAY;AAAA,GACrD;AACF;AAQA,SAAS,gBAAgB,MAAA,EAA6B;AACpD,EAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,KAAiB,IAAI,aAAY,CAAE,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA;AAC/D,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,IAAS,UAAA;AAC9B,EAAA,OACE,KAAA,CAAM,KAAK,SAAA,CAAU,MAAA,CAAO,WAAW,IAAA,EAAM,CAAC,CAAC,CAAA,IAC9C,MAAA,CAAO,OAAA,EAAS,kBAAkB,KAAA,CAAM,MAAA,CAAO,OAAO,OAAA,CAAQ,eAAe,CAAC,CAAA,GAAI,CAAA,CAAA,GACnF,CAAA,GAAI,KAAA,CAAM,KAAK,CAAA;AAEnB;AAEA,IAAM,KAAA,GAAQ,CAAC,EAAA,KAAe,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AASvE,SAAS,gBAAgB,QAAA,EAA8C;AAC5E,EAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,KAAa,UAAU,OAAO,KAAA;AACtD,EAAA,MAAM,CAAA,GAAI,QAAA;AACV,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,IAAY,CAAC,cAAc,GAAA,CAAI,CAAA,CAAE,MAAM,CAAA,EAAG,OAAO,KAAA;AACzE,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,EAAU,OAAO,KAAA;AACzC,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,MAAA,KAAc,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,CAAA,CAAE,MAAM,CAAA,CAAA;AACtF,IAAA,OAAO,KAAA;AACT,EAAA,IAAI,EAAE,UAAA,KAAe,MAAA,IAAa,OAAO,CAAA,CAAE,UAAA,KAAe,UAAU,OAAO,KAAA;AAC3E,EAAA,IAAI,EAAE,IAAA,KAAS,MAAA,IAAa,OAAO,CAAA,CAAE,IAAA,KAAS,UAAU,OAAO,KAAA;AAC/D,EAAA,IAAI,EAAE,EAAA,KAAO,MAAA,IAAa,OAAO,CAAA,CAAE,EAAA,KAAO,UAAU,OAAO,KAAA;AAC3D,EAAA,OAAO,IAAA;AACT;AAgCO,IAAM,UAAN,MAAc;AAAA,EACnB,WAAA,CACU,MAAA,EACA,YAAA,EAEA,QAAA,EACR;AAJQ,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA;AAEA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EACP;AAAA,EAEK,MAAA,GAAiB;AACvB,IAAA,MAAM,MAAM,IAAA,CAAK,YAAA;AACjB,IAAA,IAAI,CAAC,GAAA,IAAO,CAAC,GAAA,CAAI,UAAA,CAAW,KAAK,CAAA,EAAG;AAClC,MAAA,MAAM,IAAI3C,qBAAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAA,CAAQ,MAAA,GAA0B,EAAC,EAAuB;AAC9D,IAAA,MAAM,QAAgC,EAAC;AACvC,IAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ,KAAA,CAAM,SAAS,MAAA,CAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AAChE,IAAA,IAAI,MAAA,CAAO,KAAA,EAAO,KAAA,CAAM,KAAA,GAAQ,MAAA,CAAO,KAAA;AACvC,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAe;AAAA,MAChC,QAAA,EAAU,GAAG,OAAO,CAAA,QAAA,CAAA;AAAA,MACpB,MAAA,EAAQ,KAAA;AAAA,MACR,WAAA,EAAa,KAAK,MAAA;AAAO,KAC1B,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA+BA,MAAM,KAAA,CAAM,MAAA,EAAqB,OAAA,GAAwB,EAAC,EAA2B;AAGnF,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI,OAAA,CAAQ,cAAA,IAAkB,CAAC,OAAA,CAAQ,QAAA,EAAU;AAC/C,MAAA,IAAI;AACF,QAAA,KAAA,GAAQ,OAAA,CAAQ,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,SAAS,CAAA;AAAA,MACzD,CAAA,CAAA,MAAQ;AACN,QAAA,KAAA,GAAQ,MAAA;AAAA,MACV;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,MAAA,EAAQ,OAAA,CAAQ,UAAU,KAAK,CAAA;AAAA,IAC7D,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,cAAA,GAAiB,oBAAA,CAAqB,GAAG,CAAA,GAAI,MAAA;AACnE,MAAA,IAAI,CAAC,KAAA,IAAS,CAAC,OAAA,CAAQ,gBAAgB,MAAM,GAAA;AAC7C,MAAA,OAAO,IAAA,CAAK,WAAA,CAAY,MAAA,EAAQ,KAAA,EAAO,QAAQ,cAAc,CAAA;AAAA,IAC/D;AAAA,EACF;AAAA,EAEQ,SAAA,CACN,MAAA,EACA,QAAA,EACA,KAAA,EACwB;AACxB,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,GAAI,QAAA,GAAW,EAAE,WAAA,EAAa,QAAA,KAAa,EAAC;AAAA,MAC5C,GAAI,KAAA,GAAQ,EAAE,SAAA,EAAW,KAAA,KAAU;AAAC,KACtC;AACA,IAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAoB;AAAA,MACrC,QAAA,EAAU,GAAG,OAAO,CAAA,MAAA,CAAA;AAAA,MACpB,WAAA,EAAa,KAAK,MAAA,EAAO;AAAA,MACzB,IAAA,EAAM,MAAA;AAAA,MACN,GAAI,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,SAAS,CAAA,GAAI,EAAE,OAAA,EAAQ,GAAI;AAAC,KACtD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,WAAA,CACZ,MAAA,EACA,KAAA,EACA,GAAA,EACwB;AACxB,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAII,oBAAAA;AAAA,QACR,+CAAA;AAAA,QACA,qBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,SAAA;AACJ,IAAA,IAAI;AACF,MAAA,SAAA,GAAY,MAAA,CAAO,IAAI,SAAS,CAAA;AAAA,IAClC,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAIA,oBAAAA;AAAA,QACR,CAAA,kEAAA,EAAqE,MAAA,CAAO,GAAA,CAAI,SAAS,CAAC,CAAA,kBAAA,CAAA;AAAA,QAC1F,yBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,iBAAiB,CAAA;AAC7C,IAAA,IAAI,SAAS,SAAA,EAAW;AACtB,MAAA,MAAM,IAAIA,oBAAAA;AAAA,QACR,CAAA,gBAAA,EAAmB,MAAM,CAAA,sCAAA,EAAyC,GAAA,CAAI,SAAS,CAAA,mBAAA,CAAA;AAAA,QAC/E,sBAAA;AAAA,QACA,GAAA;AAAA,QACA,EAAE,IAAA,EAAM,EAAE,SAAS,CAAC,KAAK,GAAE;AAAE,OAC/B;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,MAAM,KAAA,EAAO,aAAA;AAC7B,IAAA,IAAI,MAAA,CAAO,KAAA,IAAS,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,IAAK,CAAC,OAAA,CAAQ,QAAA,CAAS,MAAA,CAAO,KAAK,CAAA,EAAG;AAC7E,MAAA,MAAM,IAAIA,oBAAAA;AAAA,QACR,SAAS,MAAA,CAAO,KAAK,uCAAuC,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,mBAAA,CAAA;AAAA,QAC9E,wBAAA;AAAA,QACA,GAAA;AAAA,QACA,EAAE,IAAA,EAAM,EAAE,SAAS,CAAC,KAAK,GAAE;AAAE,OAC/B;AAAA,IACF;AACA,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,EAAO,cAAA;AAC9B,IAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,eAAA,CAAgB,MAAM,IAAI,QAAA,EAAU;AACtE,MAAA,MAAM,IAAIA,oBAAAA;AAAA,QACR,6BAA6B,QAAQ,CAAA,wDAAA,CAAA;AAAA,QACrC,wBAAA;AAAA,QACA,GAAA;AAAA,QACA,EAAE,IAAA,EAAM,EAAE,SAAS,CAAC,KAAK,GAAE;AAAE,OAC/B;AAAA,IACF;AAMA,IAAA,MAAM,UAAA,GAAa,MAAM,KAAA,EAAO,KAAA;AAChC,IAAA,IACE,UAAA,EAAY,QAAA,KAAa,KAAA,IACzB,OAAO,UAAA,CAAW,OAAA,KAAY,QAAA,IAC9B,QAAA,CAAS,UAAA,CAAW,OAAA,EAAS,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA,EACjD;AACA,MAAA,MAAM,IAAIA,oBAAAA;AAAA,QACR,CAAA,OAAA,EAAU,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA,2JAAA,CAAA;AAAA,QAC9B,uBAAA;AAAA,QACA,GAAA;AAAA,QACA,EAAE,IAAA,EAAM,EAAE,SAAS,CAAC,KAAK,GAAE;AAAE,OAC/B;AAAA,IACF;AAGA,IAAA,MAAM,KAAA,GAAQ,IAAI,MAAA,CAAO,SAAA;AACzB,IAAA,MAAM,IAAA,GAAA,CAAQ,MAAM,IAAA,IAAQ,EAAA;AAC5B,IAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,QAAA,CAAS,6BAAA;AAAA,MAC1C;AAAA,QACE,YAAY,GAAA,CAAI,UAAA;AAAA,QAChB,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,SAAS,GAAA,CAAI,OAAA;AAAA,QACb,KAAA,EAAO;AAAA,UACL;AAAA,YACE,iBAAiB,KAAA,CAAM,KAAA;AAAA,YACvB,UAAA,EAAY,UAAA;AAAA,YACZ,QAAA,EAAU,CAAC,KAAA,CAAM,KAAA,EAAA,CAAQ,MAAA,GAAS,IAAA,EAAM,QAAA,EAAS,EAAA,CAAI,MAAA,IAAU,IAAA,EAAM,QAAA,EAAU;AAAA;AACjF;AACF,OACF;AAAA,MACA,KAAK,MAAA;AAAO,KACd;AACA,IAAA,MAAM,MAAA,GAAyB;AAAA,MAC7B,WAAA,EAAa,CAAA;AAAA,MACb,MAAA,EAAQ,OAAA;AAAA,MACR,OAAA,EAAS,kBAAA;AAAA,MACT,OAAA,EAAS;AAAA,QACP,WAAW,EAAE,CAAA,EAAG,QAAQ,eAAe,CAAA,EAAG,GAAG,SAAA,EAAU;AAAA,QACvD,WAAA,EAAa,QAAQ,KAAK,CAAA;AAAA,QAC1B,SAAA,EAAW,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA;AAAA,QAC9B,MAAA,EAAQ,OAAO,QAAA,EAAS;AAAA,QACxB,OAAO,KAAA,CAAM,KAAA;AAAA,QACb,UAAA,EAAY,KAAK,KAAA,CAAM,IAAA,CAAK,KAAI,GAAI,GAAI,IAAI,KAAA,CAAM,iBAAA;AAAA,QAClD,KAAA,EAAO,QAAQ,eAAe;AAAA;AAChC,KACF;AACA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAGtC,IAAA,MAAM,SAAA,GAAY,CAAC,OAAA,EAAiB,IAAA,EAAc,KAAA,GAAiC,EAAC,KAClF,IAAIA,oBAAAA,CAAc,OAAA,EAAS,IAAA,EAAM,GAAA,EAAK;AAAA,MACpC,IAAA,EAAM,EAAE,OAAA,EAAS,CAAC,KAAK,CAAA,EAAE;AAAA,MACzB,eAAA,EAAiB,eAAA;AAAA,MACjB,GAAG;AAAA,KACJ,CAAA;AACH,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,MAAM,kBAAA,CAAmB,eAAA,EAAiB,EAAE,SAAA,EAAW,MAAS,CAAA;AAAA,IAC5E,SAAS,GAAA,EAAK;AAEZ,MAAA,MAAM,SAAA;AAAA,QACJ,CAAA,oCAAA,EAAuC,eAAe,CAAA,EAAA,EAAK,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,QAC3G,sBAAA;AAAA,QACA,EAAE,QAAA;AAAS,OACb;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAO,MAAM,IAAI,iBAAA,CAAkB;AAAA,MACvC,WAAA,EAAa,EAAE,OAAA,EAAS,MAAM,IAAA,EAAK;AAAA,MACnC,YAAY,YAAY;AAAA,KACzB,EAAE,cAAA,CAAe;AAAA,MAChB,eAAA;AAAA,MACA,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,IAAA,EAAM,KAAA;AAAA,MACN,IAAI,KAAA,CAAM,KAAA;AAAA,MACV,SAAA,EAAW;AAAA,KACZ,CAAA;AACD,IAAA,IAAI,CAAC,KAAK,KAAA,EAAO;AACf,MAAA,MAAM,SAAA;AAAA,QACJ,CAAA,8BAAA,EAAiC,MAAM,CAAA,2BAAA,EAA8B,IAAA,CAAK,MAAM,CAAA,6DAAA,CAAA;AAAA,QAChF,qBAAA;AAAA,QACA,EAAE,MAAA,EAAQ,IAAA,CAAK,MAAA;AAAO,OACxB;AAAA,IACF;AAGA,IAAA,KAAA,IAAS,OAAA,GAAU,KAAK,OAAA,EAAA,EAAW;AACjC,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,MAAA,EAAQ,QAAQ,CAAA;AAAA,MAC9C,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,SAAA,GACJ,GAAA,YAAeA,oBAAAA,KACd,GAAA,CAAI,MAAA,KAAW,GAAA,IACb,GAAA,CAAI,MAAA,KAAW,GAAA,IAAQ,GAAA,CAAI,OAAA,EAAqC,SAAA,KAAc,IAAA,CAAA;AACnF,QAAA,IAAI,SAAA,IAAa,UAAU,iBAAA,EAAmB;AAC5C,UAAA,MAAM,MAAM,mBAAmB,CAAA;AAC/B,UAAA;AAAA,QACF;AACA,QAAA,IAAI,eAAeA,oBAAAA,EAAe;AAEhC,UAAA,MAAM,IAAIA,qBAAc,GAAA,CAAI,OAAA,EAAS,IAAI,IAAA,EAAM,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,YAChE,GAAI,OAAO,GAAA,CAAI,OAAA,KAAY,QAAA,IAAY,IAAI,OAAA,KAAY,IAAA,GAAO,GAAA,CAAI,OAAA,GAAU,EAAC;AAAA,YAC7E,eAAA,EAAiB,eAAA;AAAA,YACjB;AAAA,WACD,CAAA;AAAA,QACH;AACA,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,QAAQ,MAAA,EAAqD;AACjE,IAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAwB;AAAA,MACzC,QAAA,EAAU,GAAG,OAAO,CAAA,QAAA,CAAA;AAAA,MACpB,WAAA,EAAa,KAAK,MAAA,EAAO;AAAA,MACzB,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,KAAK,MAAA,EAA+C;AACxD,IAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAqB;AAAA,MACtC,QAAA,EAAU,GAAG,OAAO,CAAA,KAAA,CAAA;AAAA,MACpB,WAAA,EAAa,KAAK,MAAA,EAAO;AAAA,MACzB,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,MAAA,CAAO,MAAA,GAAyB,EAAC,EAAsB;AAC3D,IAAA,MAAM,QAAgC,EAAC;AACvC,IAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ,KAAA,CAAM,SAAS,MAAA,CAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AAChE,IAAA,IAAI,MAAA,CAAO,KAAA,EAAO,KAAA,CAAM,KAAA,GAAQ,MAAA,CAAO,KAAA;AACvC,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAc;AAAA,MAC/B,QAAA,EAAU,GAAG,OAAO,CAAA,OAAA,CAAA;AAAA,MACpB,MAAA,EAAQ,KAAA;AAAA,MACR,WAAA,EAAa,KAAK,MAAA;AAAO,KAC1B,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,GAAoC;AACxC,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAsB;AAAA,MACvC,QAAA,EAAU,GAAG,OAAO,CAAA,OAAA,CAAA;AAAA,MACpB,WAAA,EAAa,KAAK,MAAA;AAAO,KAC1B,CAAA;AAAA,EACH;AACF;ACtbO,IAAM,wBAAA,GAA2B;AAgBjC,SAAS,UAAU,KAAA,EAAyC;AACjE,EAAA,OAAOqB,YAAAA,CAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AAChC;AAGO,SAAS,yBAAyB,OAAA,EAAyB;AAChE,EAAA,OAAO,CAAA,EAAA,EAAK,MAAA,CAAO,OAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,EAAA,EAAI,GAAG,CAAC,CAAA,CAAA;AAC5D;AAEA,SAAS,mBAAmB,GAAA,EAAuB;AACjD,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,GAAG,SAAA,EAAW,IAAA,KAAS,MAAM,CAAA,EAAG,IAAA,KAAS,IAAI,OAAO,IAAA;AACxD,EAAA,OAAO,sBAAsB,IAAA,CAAK,CAAA,EAAG,OAAA,IAAW,MAAA,CAAO,GAAG,CAAC,CAAA;AAC7D;AAYA,eAAsB,wBAAA,CACpB,QAAA,EACA,cAAA,EACA,WAAA,EACA,SAAA,EACiC;AACjC,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,SAAA,CAAU,GAAA,CAAI,SAAS,CAAA;AACnC,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,YAAA,CAAa;AAAA,MACzC,eAAA,EAAiB,yBAAyB,cAAc,CAAA;AAAA,MACxD,UAAA,EAAY,oBAAA;AAAA,MACZ,QAAA,EAAU,CAAC,SAAA,CAAU,WAAW,CAAA,EAAG,UAAU,GAAA,CAAI,MAAM,CAAA,EAAG,GAAG,GAAG;AAAA,KACjE,CAAA;AACD,IAAA,MAAM,KAAA,GAAQ,SAAS,CAAC,CAAA;AACxB,IAAA,IAAI,UAAU,KAAA,CAAA,IAAa,MAAA,CAAO,KAAK,CAAA,KAAM,MAAA,CAAO,wBAAwB,CAAA,EAAG;AAC7E,MAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AAAA,IACvB;AACA,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,EACrD,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,kBAAA,CAAmB,GAAG,CAAA,EAAG,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,sBAAA,EAAuB;AAEnF,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ,mBAAA;AAAA,MACR,QAAQ,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACzD;AAAA,EACF;AACF;AAGO,IAAM,8BAAA,GAAiC;AAAA;AAAA,EAE5C,eAAA,EAAiB,oEAAA;AAAA;AAAA,EAEjB,WAAA,EAAa;AACf;AAiBA,SAAS,WAAA,CAAY,CAAA,EAAW,CAAA,EAAW,WAAA,EAAqB,SAAA,EAA4B;AAE1F,EAAA,MAAM,CAAA,GAAI,OAAO,SAAS,CAAA,CAAE,SAAS,EAAE,CAAA,CAAE,QAAA,CAAS,EAAA,EAAI,GAAG,CAAA;AACzD,EAAA,MAAM,GAAA,GAAM,IAAI3B,WAAAA,CAAG,UAAA,CAAW,SAAA,CAAU,OAAO,CAAC,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAC5D,EAAA,KAAA,MAAW,MAAA,IAAU,CAAC,IAAA,EAAM,IAAI,CAAA,EAAG;AACjC,IAAA,IAAI;AACF,MAAA,IAAIA,WAAAA,CAAG,UAAA,CAAW,MAAA,CAAO,GAAA,EAAK,SAAA,CAAU,WAAW,CAAA,EAAG,MAAA,GAAS,CAAC,CAAA,EAAG,OAAO,IAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAYO,SAAS,iCAAA,CACd,UAAA,EACA,WAAA,EACA,SAAA,EAC0B;AAC1B,EAAA,MAAM,SAAA,GAAY,wBAAA,CAAyB,UAAA,CAAW,UAAU,CAAA;AAChE,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,QAAA,CAAS,GAAA,CAAI,SAAS,CAAA;AAClD,EAAA,MAAM,GAAA,GAAM,SAAA,CAAU,GAAA,CAAI,SAAS,CAAA;AAEnC,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,CAAA;AACJ,EAAA,IAAI,CAAA;AACJ,EAAA,IAAI,SAAA,KAAc,+BAA+B,eAAA,EAAiB;AAEhE,IAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,IAAK,GAAA,CAAI,WAAW,CAAA,EAAG;AAC7C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,IACrD;AACA,IAAA,CAAC,SAAS,CAAA,GAAI,QAAA;AACd,IAAA,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,GAAA;AAAA,EACX,CAAA,MAAA,IAAW,SAAA,KAAc,8BAAA,CAA+B,WAAA,EAAa;AAInE,IAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,IAAK,MAAA,CAAO,SAAS,CAAC,CAAC,CAAA,KAAM,EAAA,IAAM,MAAA,CAAO,QAAA,CAAS,CAAC,CAAC,MAAM,EAAA,EAAI;AACrF,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,2BAAA,EAA4B;AAAA,IAC7D;AACA,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,CAAA,IAAK,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA,KAAM,EAAA,IAAM,MAAA,CAAO,GAAA,CAAI,CAAC,CAAC,MAAM,EAAA,EAAI;AACtE,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,IACrD;AACA,IAAA,IAAI,MAAA,CAAO,IAAI,CAAC,CAAC,MAAM,MAAA,CAAO,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG;AAC1C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,IACrD;AACA,IAAA,SAAA,GAAY,SAAS,CAAC,CAAA;AACtB,IAAA,OAAO,CAAA,EAAG,CAAC,CAAA,GAAI,GAAA;AAAA,EACjB,CAAA,MAAO;AACL,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,2BAAA,EAA4B;AAAA,EAC7D;AAEA,EAAA,MAAM,WAAWrB,aAAAA,CAAK,gCAAA;AAAA,IACpB,SAAA,CAAU,WAAW,IAAI,CAAA;AAAA,IACzB,SAAA;AAAA,IACA,QAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,yBAAyB,QAAQ,CAAA,KAAM,wBAAA,CAAyB,UAAA,CAAW,OAAO,CAAA,EAAG;AACvF,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,kBAAA,EAAmB;AAAA,EACpD;AAEA,EAAA,OAAO,WAAA,CAAY,CAAA,EAAG,CAAA,EAAG,WAAA,EAAa,SAAS,CAAA,GAC3C,EAAE,KAAA,EAAO,IAAA,EAAK,GACd,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,mBAAA,EAAoB;AAClD;;;AC1JA,IAAMmE,kBAAAA,GAAoB,MAAA,CAAOnE,aAAAA,CAAK,mBAAA,CAAoB,UAAU,CAAC,CAAA;AASrE,SAAS,mBAAA,CACP,YACA,OAAA,EAC8C;AAC9C,EAAA,IAAI;AACF,IAAA,MAAM,QAAQ,UAAA,CAAW,GAAA,CAAI,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AAC7C,IAAA,MAAM,OAAO,aAAA,EAAe,QAAQ,CAAA,GAAI,KAAA;AACxC,IAAA,IAAI,aAAa,EAAA,EAAI,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,2CAAA,EAA4C;AAC7F,IAAA,MAAM,CAAC,EAAA,EAAI,QAAA,EAAU,GAAA,EAAK,SAAA,EAAW,GAAA,EAAK,IAAI,CAAA,GAAI,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACnE,IAAA,IAAI,EAAA,KAAO,OAAO,OAAA,CAAQ,KAAK,KAAK,QAAA,KAAamE,kBAAAA,IAAqB,QAAQ,EAAA,EAAI;AAChF,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,0DAAA,EAA2D;AAAA,IACzF;AACA,IAAA,IAAI,SAAA,KAAc,MAAA,CAAO,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC3C,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,yCAAA,EAA0C;AAAA,IACxE;AACA,IAAA,IAAI,OAAO,IAAA,IAAQ,IAAA,CAAA,KAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACnD,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,sDAAA,EAAuD;AAAA,IACrF;AACA,IAAA,IAAI,aAAA,IAAiB,OAAO,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAC,CAAA,EAAG;AAC1D,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,uDAAA,EAAwD;AAAA,IACtF;AACA,IAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,EACpB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,2BAAA,EAA4B;AAAA,EAC1D;AACF;AAGA,IAAM,qBAAN,MAA+C;AAAA,EAA/C,WAAA,GAAA;AACE,IAAA,IAAA,CAAiB,IAAA,uBAAW,GAAA,EAAY;AAAA,EAAA;AAAA,EAExC,IAAI,KAAA,EAAwB;AAC1B,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA;AAAA,EAC5B;AAAA,EAEA,QAAQ,KAAA,EAAwB;AAC9B,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,KAAK,GAAG,OAAO,KAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAK,CAAA;AACnB,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAA;AAwBO,IAAM,eAAA,GAAN,MAAM,gBAAA,CAAgB;AAAA,EAM3B,WAAA,CAAY,MAAA,EAAqB,WAAA,EAAqB,MAAA,EAAgC;AACpF,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,UAAA,GAAa,MAAA,EAAQ,UAAA,IAAc,IAAI,kBAAA,EAAmB;AAC/D,IAAA,IAAA,CAAK,WAAW,MAAA,EAAQ,QAAA;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,OAAO,OAAO,OAAA,EAAwD;AACpE,IAAA,MAAM,SAAS,IAAI,WAAA,CAAY,EAAE,YAAA,EAAc,OAAA,CAAQ,QAAQ,CAAA;AAC/D,IAAA,OAAO,IAAI,gBAAA,CAAgB,MAAA,EAAQ,OAAA,CAAQ,WAAA,EAAa;AAAA,MACtD,YAAY,OAAA,CAAQ,UAAA;AAAA,MACpB,UAAU,OAAA,CAAQ;AAAA,KACnB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,OAAO,OAAA,EAAkD;AAC7D,IAAA,MAAM,EAAE,SAAQ,GAAI,OAAA;AAGpB,IAAA,IAAI,OAAA,CAAQ,gBAAgB,CAAA,EAAG;AAC7B,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,eAAe,CAAA,0BAAA,EAA6B,OAAA,CAAQ,WAAW,CAAA,CAAA,EAAG;AAAA,IAC7F;AAGA,IAAA,IAAI,OAAA,CAAQ,YAAY,kBAAA,EAAoB;AAC1C,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,eAAe,CAAA,qBAAA,EAAwB,OAAA,CAAQ,OAAO,CAAA,CAAA,EAAG;AAAA,IACpF;AAGA,IAAA,IAAI,MAAM,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC5C,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,aAAA,EAAe,6BAAA,EAA8B;AAAA,IACxE;AAGA,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,IAAI,OAAA,CAAQ,cAAc,GAAA,EAAK;AAC7B,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,aAAA,EAAe,8CAAA,EAA+C;AAAA,IACzF;AAGA,IAAA,MAAM,kBAAkB,OAAA,CAAQ,KAAA,CAAM,aAAY,CAAE,OAAA,CAAQ,SAAS,IAAI,CAAA;AACzE,IAAA,MAAM,iBAAiBD,yBAAAA,CAAmB,YAAA,CAAa,aAAY,CAAE,OAAA,CAAQ,SAAS,IAAI,CAAA;AAC1F,IAAA,IAAI,oBAAoB,cAAA,EAAgB;AACtC,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,KAAA;AAAA,QACT,aAAA,EAAe,CAAA,mBAAA,EAAsB,OAAA,CAAQ,KAAK,CAAA,wBAAA;AAAA,OACpD;AAAA,IACF;AAGA,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,IAChC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,aAAA,EAAe,+BAAA,EAAgC;AAAA,IAC1E;AACA,IAAA,IAAI,UAAU,EAAA,EAAI;AAChB,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,aAAA,EAAe,iCAAA,EAAkC;AAAA,IAC5E;AAGA,IAAA,IAAI,CAAC,OAAA,CAAQ,WAAA,IAAe,CAAC,QAAQ,SAAA,EAAW;AAC9C,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,aAAA,EAAe,kCAAA,EAAmC;AAAA,IAC7E;AAGA,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,eAAA,CAAgB,OAAO,CAAA;AACpD,IAAA,IAAI,CAAC,UAAU,KAAA,EAAO;AACpB,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,aAAA,EAAe,UAAU,MAAA,EAAO;AAAA,IAC3D;AAEA,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,gBACZ,OAAA,EAC8C;AAW9C,IAAA,IAAI,OAAA,CAAQ,SAAS,IAAA,EAAM;AACzB,MAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,UAAA;AACxC,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA,IAAK,UAAA,CAAW,WAAW,CAAA,EAAG;AACzD,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,yBAAA,EAA0B;AAAA,MAC3D;AAIA,MAAA,MAAM,KAAA,GAAQ,mBAAA,CAAoB,UAAA,EAAY,OAAA,CAAQ,OAAO,CAAA;AAC7D,MAAA,IAAI,CAAC,MAAM,EAAA,EAAI,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAO;AAC3D,MAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AAAA,IACvB;AAEA,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAElB,MAAA,IAAI,CAAC,QAAQ,OAAA,EAAS,SAAA,EAAW,KAAK,CAAC,OAAA,CAAQ,OAAA,EAAS,SAAA,EAAW,CAAA,EAAG;AACpE,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,MACrD;AACA,MAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AAAA,IACvB;AAEA,IAAA,MAAM,UAAU,OAAA,CAAQ,OAAA;AAExB,IAAA,IAAI,CAAC,OAAA,EAAS,SAAA,EAAW,KAAK,CAAC,OAAA,EAAS,WAAW,CAAA,EAAG;AACpD,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,IACrD;AAGA,IAAA,MAAM,mBAAmBE,uBAAA,CAAmB;AAAA,MAC1C,cAAc,OAAA,CAAQ,WAAA;AAAA,MACtB,YAAY,OAAA,CAAQ,SAAA;AAAA,MACpB,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,WAAA,EAAa,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA;AAAA,MACtC,OAAO,OAAA,CAAQ;AAAA,KAChB,CAAA;AAGD,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAUC,kBAAA,CAAkB,cAAA,CAAe,gBAAA,EAAkB,OAAA,CAAQ,WAAW,CAAA;AAAA,IAClF,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,CAAA,mBAAA,EAAsB,OAAO,CAAA,CAAA,EAAG;AAAA,IACjE;AAGA,IAAA,MAAM,QAAQ,MAAM,wBAAA,CAAyB,KAAK,QAAA,EAAU,OAAA,CAAQ,aAAa,OAAA,EAAS;AAAA,MACxF,QAAQ,SAAA,CAAU,CAAA;AAAA,MAClB,QAAQ,SAAA,CAAU;AAAA,KACnB,CAAA;AACD,IAAA,IAAI,KAAA,CAAM,KAAA,EAAO,OAAO,EAAE,OAAO,IAAA,EAAK;AACtC,IAAA,IAAI,KAAA,CAAM,WAAW,sBAAA,EAAwB;AAC3C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,+BAAA,EAAgC;AAAA,IACjE;AACA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,QAAQ,KAAA,CAAM,MAAA,GACV,CAAA,+BAAA,EAAkC,KAAA,CAAM,MAAM,CAAA,CAAA,GAC9C;AAAA,KACN;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,OAAO,OAAA,EAAkD;AAC7D,IAAA,MAAM,EAAE,SAAQ,GAAI,OAAA;AAGpB,IAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA;AAC9C,IAAA,IAAI,CAAC,aAAa,OAAA,EAAS;AACzB,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,WAAA,EAAa,aAAa,aAAA,EAAc;AAAA,IACnE;AAGA,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,UAAA,CAAW,OAAA,CAAQ,QAAQ,KAAK,CAAA;AAC5D,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,WAAA,EAAa,4CAAA,EAA6C;AAAA,IACrF;AAEA,IAAA,IAAI;AAaF,MAAA,IAAI,QAAQ,IAAA,EAAM;AAChB,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAmC;AAAA,UACtE,QAAA,EAAU,qCAAA;AAAA,UACV,aAAa,IAAA,CAAK,WAAA;AAAA,UAClB,IAAA,EAAM;AAAA,YACJ,gBAAgB,OAAA,CAAQ,WAAA;AAAA,YACxB,QAAA,EAAU,QAAQ,IAAA,CAAK,UAAA;AAAA,YACvB,UAAA,EAAY,QAAQ,IAAA,CAAK;AAAA;AAC3B,SACD,CAAA;AAED,QAAA,IAAI,OAAO,YAAY,eAAA,KAAoB,QAAA,IAAY,CAAC,UAAA,CAAW,eAAA,CAAgB,MAAK,EAAG;AACzF,UAAA,OAAO;AAAA,YACL,OAAA,EAAS,KAAA;AAAA,YACT,WAAA,EACG,YAAoB,OAAA,IAAW;AAAA,WACpC;AAAA,QACF;AAEA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS,IAAA;AAAA,UACT,iBAAiB,UAAA,CAAW,eAAA;AAAA,UAC5B,SAAA,EAAW;AAAA,SACb;AAAA,MACF;AAIA,MAAA,MAAM,aAAaC,gBAAA,CAAQ,WAAA,CAAY,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAC,CAAA;AAC7D,MAAA,MAAM,YAAA,GAAe;AAAA,QACnB,iBAAiB,OAAA,CAAQ,KAAA;AAAA,QACzB,UAAA,EAAY,UAAA;AAAA,QACZ,QAAA,EAAU,CAAC,OAAA,CAAQ,SAAA,EAAW,UAAA,CAAW,GAAA,CAAI,QAAA,EAAS,EAAG,UAAA,CAAW,IAAA,CAAK,QAAA,EAAU;AAAA,OACrF;AAGA,MAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAA+B;AAAA,QACvE,QAAA,EAAU,kCAAA;AAAA,QACV,aAAa,IAAA,CAAK,WAAA;AAAA,QAClB,IAAA,EAAM;AAAA,UACJ,WAAW,OAAA,CAAQ,WAAA;AAAA,UACnB,KAAA,EAAO,CAAC,YAAY;AAAA;AACtB,OACD,CAAA;AAGD,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAA0C;AAAA,QACzE,QAAA,EAAU,6CAAA;AAAA,QACV,aAAa,IAAA,CAAK,WAAA;AAAA,QAClB,IAAA,EAAM;AAAA,UACJ,WAAW,OAAA,CAAQ,WAAA;AAAA,UACnB,WAAW,eAAA,CAAgB,SAAA;AAAA,UAC3B,eAAe,OAAA,CAAQ,SAAA;AAAA,UACvB,YAAY,eAAA,CAAgB,UAAA;AAAA,UAC5B,cAAA,EAAgB;AAAA;AAClB,OACD,CAAA;AAED,MAAA,IAAI,OAAO,QAAQ,eAAA,KAAoB,QAAA,IAAY,CAAC,MAAA,CAAO,eAAA,CAAgB,MAAK,EAAG;AACjF,QAAA,OAAO;AAAA,UACL,OAAA,EAAS,KAAA;AAAA,UACT,WAAA,EAAc,QAAgB,OAAA,IAAW;AAAA,SAC3C;AAAA,MACF;AAEA,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,IAAA;AAAA,QACT,iBAAiB,MAAA,CAAO,eAAA;AAAA,QACxB,SAAA,EAAW;AAAA,OACb;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,UAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACrE,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,KAAA;AAAA,QACT,WAAA,EAAa,sBAAsB,OAAO,CAAA;AAAA,OAC5C;AAAA,IACF;AAAA,EACF;AACF;;;ACxYAlD,gBAAAA,EAAAA;AAiBO,IAAM,gBAAgB,OAAO;AAAA,EAClC;AACF,CAAA,KAEoC;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,SAAA,EAAAW,YAAU,GAAI,MAAA;AAE1C,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAAA,IACjE;AAEA,IAAA,IAAI,CAAC,MAAA,IAAU,CAAC,OAAO,mBAAA,IAAuB,CAAC,OAAO,SAAA,EAAW;AAC/D,MAAA,MAAM,IAAI,MAAM,2DAA2D,CAAA;AAAA,IAC7E;AAEA,IAAA,IAAI,CAACA,UAAAA,EAAW;AACd,MAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,IACrD;AAEA,IAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,OAAA;AAExC,IAAA,IACE,CAAC,MAAA,CAAO,SAAA,CAAU,cAAA,CAAe,KAAKG,2BAAAA,EAAsB,UAAU,CAAA,IACtE,CAAC,OAAO,SAAA,CAAU,cAAA,CAAe,IAAA,CAAKJ,0BAAAA,EAAqB,UAAU,CAAA,EACrE;AACA,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,MAAA,CAAO,UAAU,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,IACpE;AAEA,IAAA,MAAM,MAAA,GAASI,4BAAqB,UAAU,CAAA;AAG9C,IAAA,IAAI,mBAAA;AACJ,IAAA,IAAI;AACF,MAAA,mBAAA,GAAsBhB,yBAAA,CAAkB,MAAA,CAAO,mBAAA,EAAqB,UAAU,CAAA;AAAA,IAChF,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,MAAM,kEAAkE,CAAA;AAAA,IACpF;AAEA,IAAA,MAAM,WAAW,IAAIkB,oBAAAA,CAAY,EAAE,OAAA,EAAS,QAAQ,CAAA;AAEpD,IAAA,MAAM,OAAA,GAAU,IAAIC,gBAAAA,CAAQ;AAAA,MAC1B,QAAA;AAAA,MACA,SAAS,MAAA,CAAO,SAAA;AAAA,MAChB,MAAA,EAAQ;AAAA,KACT,CAAA;AAGD,IAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,WAAA,CAAYN,UAAS,CAAA;AAGrD,IAAA,MAAM,aAAA,GAAgB,mBAAmB,SAAS,CAAA;AAElD,IAAA,OAAO,aAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,4BAA4B,KAAK,CAAA;AAC/C,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAIA,SAASwC,WAAU,CAAA,EAAmB;AACpC,EAAA,OAAO,OAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,IAAI,GAAG,CAAA;AAC/C;AAgBO,IAAM,qBAAqB,OAAO;AAAA,EACvC;AACF,CAAA,KAEyB;AACvB,EAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,SAAA,EAAAxC,YAAU,GAAI,MAAA;AAE1C,EAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAChF,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,OAAO,mBAAA,IAAuB,CAAC,OAAO,SAAA,EAAW;AAC/D,IAAA,MAAM,IAAI,MAAM,2DAA2D,CAAA;AAAA,EAC7E;AACA,EAAA,IAAI,CAACA,UAAAA,EAAW,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAEnE,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,OAAA;AACxC,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,eAAe,IAAA,CAAKG,2BAAAA,EAAsB,UAAU,CAAA,EAAG;AAC3E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,MAAA,CAAO,UAAU,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,EACpE;AAEA,EAAA,IAAI,mBAAA;AACJ,EAAA,IAAI;AACF,IAAA,mBAAA,GAAsBhB,yBAAA,CAAkB,MAAA,CAAO,mBAAA,EAAqB,UAAU,CAAA;AAAA,EAChF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,kEAAkE,CAAA;AAAA,EACpF;AAIA,EAAA,MAAM,cAAc,MAAA,CAAOsD,kBAAA,CAAc,eAAezC,UAAAA,EAAW,MAAA,CAAO,SAAS,CAAC,CAAA;AAEpF,EAAA,IAAI,eAAe,MAAA,EAAQ;AAKzB,IAAA,MAAM,EAAE,kBAAA,EAAA0C,mBAAAA,EAAmB,GAAI,MAAM,OAAA,CAAA,OAAA,EAAA,CAAA,IAAA,CAAA,OAAA,UAAA,EAAA,EAAA,aAAA,CAAA,CAAA;AACrC,IAAA,MAAM,WAAWA,mBAAAA,CAAmB;AAAA,MAClC,UAAA,EAAY,mBAAA;AAAA,MACZ,WAAA;AAAA,MACA,UAAA,EAAY;AAAA,KACb,CAAA;AACD,IAAA,OAAO,QAAA,CAAS,IAAIF,UAAS,CAAA;AAAA,EAC/B;AAGA,EAAA,MAAM,QAAA,GAAW,IAAInC,oBAAAA,CAAY,EAAE,SAASF,2BAAAA,CAAqB,UAAU,GAAG,CAAA;AAC9E,EAAA,MAAM,OAAA,GAAU,IAAIG,gBAAAA,CAAQ,EAAE,QAAA,EAAU,SAAS,MAAA,CAAO,SAAA,EAAW,MAAA,EAAQ,mBAAA,EAAqB,CAAA;AAChG,EAAA,MAAM,EAAE,GAAG,CAAA,EAAE,GAAI,mBAAmB,MAAM,OAAA,CAAQ,WAAA,CAAYN,UAAS,CAAC,CAAA;AACxE,EAAA,OAAO,CAAC,GAAG,CAAC,CAAA;AACd;;;ACpGO,IAAM,WAAN,MAAe;AAAA,EAepB,YAAY,MAAA,EAAwB;AAClC,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,WAAA,CAAY,MAAM,CAAA;AACpC,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA,CAAO,OAAA,IAAWP,wBAAAA,CAAkB,OAAA;AACnD,IAAA,IAAA,CAAK,eAAe,MAAA,CAAO,YAAA;AAG3B,IAAA,IAAA,CAAK,OAAA,GAAU,IAAI,YAAA,CAAa,IAAA,CAAK,MAAM,CAAA;AAC3C,IAAA,IAAA,CAAK,YAAA,GAAe,IAAI,iBAAA,CAAkB,IAAA,CAAK,MAAM,CAAA;AACrD,IAAA,IAAA,CAAK,YAAA,GAAe,IAAI,iBAAA,CAAkB,IAAA,CAAK,MAAM,CAAA;AACrD,IAAA,IAAA,CAAK,IAAA,GAAO,IAAI,SAAA,CAAU,IAAA,CAAK,MAAM,CAAA;AACrC,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,aAAA,CAAc,IAAA,CAAK,MAAM,CAAA;AAC7C,IAAA,IAAA,CAAK,SAAA,GAAY,IAAI,cAAA,CAAe,IAAA,CAAK,MAAM,CAAA;AAC/C,IAAA,IAAA,CAAK,WAAW,IAAI,aAAA,CAAc,IAAA,CAAK,MAAA,EAAQ,OAAO,YAAY,CAAA;AAClE,IAAA,IAAA,CAAK,EAAA,GAAK,IAAI,OAAA,CAAQ,IAAA,CAAK,QAAQ,MAAA,CAAO,YAAA,EAAc,KAAK,QAAQ,CAAA;AAGrE,IAAA,IAAA,CAAK,kBAAA,GAAqB,IAAA,CAAK,kBAAA,CAAmB,IAAA,CAAK,IAAI,CAAA;AAC3D,IAAA,IAAA,CAAK,6BAAA,GAAgC,IAAA,CAAK,6BAAA,CAA8B,IAAA,CAAK,IAAI,CAAA;AACjF,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA;AACvC,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA;AAGrC,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA,CAAK,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAA;AACrD,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA,CAAK,YAAA,CAAa,IAAA,CAAK,IAAI,CAAA;AAC/C,IAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA,CAAK,qBAAA,CAAsB,IAAA,CAAK,IAAI,CAAA;AACjE,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,WAAA,CAAY,IAAA,CAAK,IAAI,CAAA;AAC7C,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA,CAAK,YAAA,CAAa,IAAA,CAAK,IAAI,CAAA;AAC/C,IAAA,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACjD,IAAA,IAAA,CAAK,kBAAA,GAAqB,IAAA,CAAK,kBAAA,CAAmB,IAAA,CAAK,IAAI,CAAA;AAC3D,IAAA,IAAA,CAAK,sBAAA,GAAyB,IAAA,CAAK,sBAAA,CAAuB,IAAA,CAAK,IAAI,CAAA;AACnE,IAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA,CAAK,qBAAA,CAAsB,IAAA,CAAK,IAAI,CAAA;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA,EAKQ,mBAAmB,WAAA,EAA8B;AACvD,IAAA,MAAM,KAAA,GAAQ,eAAe,IAAA,CAAK,YAAA;AAElC,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,uBAAuB,WAAA,EAA6C;AAClE,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAA;AACjD,IAAA,OAAO,IAAI,qBAAA,CAAsB,IAAA,CAAK,MAAA,EAAQ,KAAK,CAAA;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,qBAAA,CAAsB,aAAsB,MAAA,EAAiD;AAC3F,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAA;AACjD,IAAA,OAAO,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAA,EAAQ,OAAO,MAAM,CAAA;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAA,CAAmB;AAAA,IACvB,MAAA;AAAA,IACA;AAAA,GACF,EAGoB;AAClB,IAAA,OAAO,IAAA,CAAK,aAAa,kBAAA,CAAmB;AAAA,MAC1C,MAAA;AAAA,MACA,WAAA,EAAa,IAAA,CAAK,kBAAA,CAAmB,WAAW;AAAA,KACjD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoCA,MAAM,6BAAA,CAA8B;AAAA,IAClC,MAAA;AAAA,IACA;AAAA,GACF,EAGoB;AAClB,IAAA,OAAO,KAAK,QAAA,CAAS,6BAAA;AAAA,MACnB,MAAA;AAAA,MACA,IAAA,CAAK,mBAAmB,WAAW;AAAA,KACrC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAM,aAAA,CAAc,EAAE,MAAA,EAAO,EAAkE;AAC7F,IAAA,OAAO,aAAA,CAAc,EAAE,MAAA,EAAQ,CAAA;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBAAA,CAAmB,EAAE,MAAA,EAAO,EAAuD;AACvF,IAAA,OAAO,kBAAA,CAAmB,EAAE,MAAA,EAAQ,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAA,CAAS;AAAA,IACb,MAAA;AAAA,IACA;AAAA,GACF,EAGoB;AAClB,IAAA,OAAO,IAAA,CAAK,aAAa,QAAA,CAAS;AAAA,MAChC,MAAA;AAAA,MACA,WAAA,EAAa,IAAA,CAAK,kBAAA,CAAmB,WAAW;AAAA,KACjD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,CAAQ;AAAA,IACZ,MAAA;AAAA,IACA;AAAA,GACF,EAGoB;AAClB,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,iBAAiB,OAAA,EAAS,MAAA,EAAQ,UAAS,GAAI,MAAA;AAC3E,IAAA,OAAO,KAAK,kBAAA,CAAmB;AAAA,MAC7B,MAAA,EAAQ;AAAA,QACN,UAAA;AAAA,QACA,MAAA;AAAA,QACA,KAAA,EAAO;AAAA,UACL;AAAA,YACE,eAAA;AAAA,YACA,UAAA,EAAY,SAAA;AAAA,YACZ,UAAU,CAAC,OAAA,EAASiC,oBAAa,MAAA,EAAQ,QAAQ,GAAG,KAAK;AAAA;AAC3D;AACF,OACF;AAAA,MACA,WAAA,EAAa,IAAA,CAAK,kBAAA,CAAmB,WAAW;AAAA,KACjD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAA,CAAgB;AAAA,IACpB,MAAA;AAAA,IACA;AAAA,GACF,EAGoB;AAClB,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,KAAA,EAAM,GAAI,MAAA;AACtC,IAAA,OAAO,KAAK,kBAAA,CAAmB;AAAA,MAC7B,MAAA,EAAQ;AAAA,QACN,UAAA;AAAA,QACA,MAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,WAAA,EAAa,IAAA,CAAK,kBAAA,CAAmB,WAAW;AAAA,KACjD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAA,CAAa;AAAA,IACjB,MAAA;AAAA,IACA;AAAA,GACF,EAGkC;AAChC,IAAA,OAAO,IAAA,CAAK,QAAQ,YAAA,CAAa;AAAA,MAC/B,GAAG,MAAA;AAAA,MACH,WAAA,EAAa,IAAA,CAAK,kBAAA,CAAmB,WAAW;AAAA,KACjD,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,qBAAA,CAAsB;AAAA,IAC1B,MAAA;AAAA,IACA;AAAA,GACF,EAGyB;AACvB,IAAA,OAAO,IAAA,CAAK,aAAa,qBAAA,CAAsB;AAAA,MAC7C,MAAA;AAAA,MACA,WAAA,EAAa,IAAA,CAAK,kBAAA,CAAmB,WAAW;AAAA,KACjD,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,kBAAA,CACJ,KAAA,EACA,WAAA,EACyC;AACzC,IAAA,OAAO,KAAK,YAAA,CAAa,kBAAA,CAAmB,OAAO,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EACzF;AAAA,EAEA,MAAM,SAAA,CAAU,MAAA,EAAyB,WAAA,EAAsB;AAC7D,IAAA,OAAO,KAAK,OAAA,CAAQ,SAAA,CAAU,QAAQ,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EAC5E;AAAA,EAEA,MAAM,eAAA,CACJ,MAAA,EACA,WAAA,EACkC;AAClC,IAAA,OAAO,IAAA,CAAK,QAAQ,eAAA,CAAgB;AAAA,MAClC,MAAA;AAAA,MACA,WAAA,EAAa,IAAA,CAAK,kBAAA,CAAmB,WAAW;AAAA,KACjD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAA,CAAY;AAAA,IAChB,MAAA;AAAA,IACA;AAAA,GACF,EAGyB;AACvB,IAAA,OAAO,KAAK,YAAA,CAAa,WAAA,CAAY,QAAQ,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAA,CAAe,EAAA,EAAY,WAAA,EAA4C;AAC3E,IAAA,OAAO,KAAK,YAAA,CAAa,cAAA,CAAe,IAAI,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EAClF;AAAA;AAAA,EAGA,MAAM,UAAA,CAAW,MAAA,EAAyB,WAAA,EAAuD;AAC/F,IAAA,OAAO,KAAK,IAAA,CAAK,UAAA,CAAW,QAAQ,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EAC1E;AAAA,EAEA,MAAM,MAAA,CAAO,EAAA,EAAY,WAAA,EAAoC;AAC3D,IAAA,OAAO,KAAK,IAAA,CAAK,MAAA,CAAO,IAAI,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAA,CAAe,QAAA,EAAkB,WAAA,EAA4C;AACjF,IAAA,OAAO,KAAK,YAAA,CAAa,cAAA,CAAe,UAAU,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAA,CACJzD,MAAAA,EACA,WAAA,EACoC;AACpC,IAAA,OAAO,KAAK,YAAA,CAAa,oBAAA,CAAqBA,QAAM,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,oBAAA,CACJ,MAAA,EACA,WAAA,EACuC;AACvC,IAAA,OAAO,KAAK,OAAA,CAAQ,oBAAA,CAAqB,QAAQ,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EACvF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAA,CACJ,MAAA,EACA,WAAA,EACuC;AACvC,IAAA,OAAO,KAAK,OAAA,CAAQ,oBAAA,CAAqB,QAAQ,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EACvF;AAAA,EAEA,MAAM,YAAA,CACJ,cAAA,EACA,QAAA,EACA,WAAA,EACiB;AACjB,IAAA,OAAO,KAAK,SAAA,CAAU,YAAA;AAAA,MACpB,cAAA;AAAA,MACA,QAAA;AAAA,MACA,IAAA,CAAK,mBAAmB,WAAW;AAAA,KACrC;AAAA,EACF;AACF;;;ACpZO,IAAM,cAAA,GAAN,cAA6B,QAAA,CAAS;AAAA,EAC3C,YAAY,MAAA,EAA8B;AACxC,IAAA,IAAI,CAAC,OAAO,YAAA,EAAc;AACxB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,MAAM,CAAA;AAAA,EACd;AAAA;AAAA;AAIF;;;ACRO,IAAM,eAAA,GAAN,cAA8B,QAAA,CAAS;AAAA,EAC5C,YAAY,MAAA,EAA+B;AACzC,IAAA,KAAA,CAAM,MAAM,CAAA;AAAA,EACd;AAAA;AAAA;AAIF;;;ACmBAoB,gBAAAA,EAAAA;;;ACzBAA,gBAAAA,EAAAA;AACA,OAAA,EAAA;AACA,UAAA,EAAA;AACA,0BAAA,EAAA;AAKA,IAAM,uBAAA,GAA0B,kBAAA;AAChC,IAAM,sBAAA,GAAyB,WAAA;AAwCxB,IAAM,iBAAN,MAAqB;AAAA,EAQ1B,YAAY,IAAA,EAaT;AACD,IAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACnB,IAAA,IAAA,CAAK,aAAa,IAAA,CAAK,UAAA;AACvB,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AACxB,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AACxB,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACZ,UAAA,EAAY,sBAAA;AAAA,MACZ,GAAG,IAAA,CAAK;AAAA,KACV;AACA,IAAA,IAAA,CAAK,UAAW,UAAA,CAAmB,KAAA;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAA,CAAM,GAAA,EAAa,IAAA,EAAoD;AAC3E,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAK,IAAI,CAAA;AAC7C,IAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,MAAA,OAAO,QAAA;AAAA,IACT;AAEA,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,oBAAA,CAAqB,QAAQ,CAAA;AACtD,IAAA,IAAA,CAAK,oBAAoB,WAAW,CAAA;AACpC,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,WAAA,CAAY,WAAW,CAAA;AAClD,IAAA,OAAO,IAAA,CAAK,gBAAA,CAAiB,GAAA,EAAK,IAAA,EAAM,OAAO,CAAA;AAAA,EACjD;AAAA,EAEA,qBAAqB,QAAA,EAA6C;AAChE,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,uBAAuB,CAAA;AAChE,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI;AACF,MAAA,WAAA,GAAc,IAAA,CAAK,MAAM,WAAW,CAAA;AAAA,IACtC,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,uDAAA,EAA0D,WAAA,CAAY,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAAA,OACrF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,YAAY,MAAA,IAAU,CAAC,YAAY,OAAA,IAAW,CAAC,YAAY,iBAAA,EAAmB;AACjF,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,WAAA,CAAY,WAAW,OAAA,EAAS;AAClC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,6BAAA,EAAgC,YAAY,MAAM,CAAA,qCAAA;AAAA,OACpD;AAAA,IACF;AACA,IAAA,IAAI,WAAA,CAAY,YAAY,kBAAA,EAAoB;AAC9C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,8BAAA,EAAiC,YAAY,OAAO,CAAA,8DAAA;AAAA,OACtD;AAAA,IACF;AACA,IAAA,OAAO,WAAA;AAAA,EACT;AAAA,EAEQ,oBAAoB,GAAA,EAA+B;AACzD,IAAA,IACE,IAAA,CAAK,MAAA,CAAO,iBAAA,IACZ,IAAA,CAAK,OAAO,iBAAA,CAAkB,MAAA,GAAS,CAAA,IACvC,CAAC,KAAK,MAAA,CAAO,iBAAA,CAAkB,QAAA,CAAS,GAAA,CAAI,KAAK,CAAA,EACjD;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,kBAAA,EAAqB,IAAI,KAAK,CAAA,0FAAA;AAAA,OAChC;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,OAAO,gBAAA,EAAkB;AAChC,MAAA,MAAM,YAAA,GAAe,oBAAA,CAAqB,IAAA,CAAK,MAAA,CAAO,kBAAkB,CAAC,CAAA;AACzE,MAAA,IAAI,MAAA,CAAO,GAAA,CAAI,iBAAiB,CAAA,GAAI,YAAA,EAAc;AAChD,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,kBAAkB,GAAA,CAAI,iBAAiB,CAAA,oBAAA,EAAuB,IAAA,CAAK,OAAO,gBAAgB,CAAA,MAAA;AAAA,SAC5F;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,YAAY,WAAA,EAA0D;AAC1E,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,MAAA,CAAO,UAAA,IAAc,OAAA;AAC7C,IAAA,IAAI,eAAe,OAAA,EAAS;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,mEAAmE,UAAU,CAAA,oGAAA;AAAA,OAG/E;AAAA,IACF;AAEA,IAAA,MAAM,QAAQ,aAAA,EAAc;AAC5B,IAAA,MAAM,UAAA,GAAa,KAAK,KAAA,CAAM,IAAA,CAAK,KAAI,GAAI,GAAI,IAAI,WAAA,CAAY,iBAAA;AAG/D,IAAA,MAAM,aAAakD,gBAAAA,CAAQ,WAAA,CAAY,MAAA,CAAO,WAAA,CAAY,iBAAiB,CAAC,CAAA;AAC5E,IAAA,MAAM,YAAA,GAAe;AAAA,MACnB,iBAAiB,WAAA,CAAY,KAAA;AAAA,MAC7B,UAAA,EAAY,UAAA;AAAA,MACZ,QAAA,EAAU,CAAC,WAAA,CAAY,KAAA,EAAO,UAAA,CAAW,GAAA,CAAI,QAAA,EAAS,EAAG,UAAA,CAAW,IAAA,CAAK,QAAA,EAAU;AAAA,KACrF;AAMA,IAAA,MAAM,KAAK,qBAAA,CAAsB;AAAA,MAC/B,KAAA,EAAO,MAAA,CAAO,IAAA,GAAO,cAAA,CAAe,KAAK,CAAC,CAAA;AAAA,MAC1C,KAAA,EAAO,CAAC,YAAY,CAAA;AAAA,MACpB,MAAA,EAAQvD;AAAA,KACT,CAAA;AAED,IAAA,MAAM,UAAU,kBAAA,CAAmB;AAAA,MACjC,QAAA,EAAU,KAAK,MAAA,CAAO,OAAA;AAAA,MACtB,OAAA,EAAS,KAAK,WAAA,CAAY;AAAA,KAC3B,CAAA;AACD,IAAA,MAAM,cAAc,aAAA,CAAc,EAAA,EAAI,IAAA,CAAK,MAAA,CAAO,WAAW,OAAO,CAAA;AAKpE,IAAA,MAAM,gBAAgBG,yBAAA,CAAkB,IAAA,CAAK,MAAA,CAAO,mBAAA,EAAqB,KAAK,UAAU,CAAA;AACxF,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,WAAW,kBAAA,CAAmB;AAAA,MAClC,UAAA,EAAY,aAAA;AAAA,MACZ;AAAA,KACD,CAAA;AAED,IAAA,MAAM,aAAa,qCAAA,CAAsC;AAAA,MACvD,gBAAA,EAAkB,EAAA;AAAA,MAClB,SAAA,EAAW;AAAA,KACZ,CAAA;AAKD,IAAA,MAAM,CAAA,GAAI,QAAA,CAAS,QAAA,CAAS,MAAA,GAAS,CAAC,CAAA,IAAK,EAAA;AAC3C,IAAA,MAAM,CAAA,GAAI,QAAA,CAAS,QAAA,CAAS,MAAA,GAAS,CAAC,CAAA,IAAK,EAAA;AAE3C,IAAA,OAAO;AAAA,MACL,WAAA,EAAa,CAAA;AAAA,MACb,MAAA,EAAQ,OAAA;AAAA,MACR,OAAA,EAAS,kBAAA;AAAA,MACT,OAAA,EAAS;AAAA,QACP,SAAA,EAAW;AAAA,UACT,CAAA,EAAG,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA;AAAA,UACvB,CAAA,EAAG,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE;AAAA,SACzB;AAAA,QACA,WAAA,EAAa,KAAK,MAAA,CAAO,SAAA;AAAA,QACzB,WAAW,WAAA,CAAY,KAAA;AAAA,QACvB,QAAQ,WAAA,CAAY,iBAAA;AAAA,QACpB,OAAO,WAAA,CAAY,KAAA;AAAA,QACnB,UAAA;AAAA,QACA,KAAA;AAAA,QACA,IAAA,EAAM;AAAA,UACJ,UAAA,EAAY,MAAA;AAAA,UACZ,UAAA;AAAA,UACA;AAAA;AACF;AACF,KACF;AAAA,EACF;AAAA,EAEA,MAAc,gBAAA,CACZ,GAAA,EACA,IAAA,EACA,OAAA,EACwB;AAMxB,IAAA,MAAM,cAAe,UAAA,CAAmB,OAAA;AACxC,IAAA,MAAM,UAAA,GAAa,KAAK,MAAA,CAAO,UAAA;AAC/B,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA;AAE1C,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI,OAAO,gBAAgB,UAAA,EAAY;AACrC,MAAA,MAAM,MAAA,GAAS,IAAI,WAAA,CAAY,IAAA,EAAM,OAAO,CAAA;AAC5C,MAAA,MAAA,CAAO,GAAA,CAAI,YAAY,WAAW,CAAA;AAClC,MAAA,OAAA,GAAU,MAAA;AAAA,IACZ,CAAA,MAAO;AAEL,MAAA,MAAM,QAAA,GAAoC,IAAA,EAAM,OAAA,IAAmB,EAAC;AACpE,MAAA,OAAA,GAAU,EAAE,GAAG,QAAA,EAAU,CAAC,UAAU,GAAG,WAAA,EAAY;AAAA,IACrD;AACA,IAAA,OAAO,KAAK,OAAA,CAAQ,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAAA,EAC/C;AACF;AAEA,SAAS,oBAAA,CAAqB,QAAgB,QAAA,EAA0B;AACtE,EAAA,MAAM,CAAC,OAAO,IAAA,GAAO,EAAE,IAAI,MAAA,CAAO,IAAA,EAAK,CAAE,KAAA,CAAM,GAAG,CAAA;AAClD,EAAA,MAAM,UAAA,GAAA,CAAc,OAAO,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,EAAG,KAAA,CAAM,GAAG,QAAQ,CAAA;AAClE,EAAA,OAAO,MAAA,CAAA,CAAQ,KAAA,IAAS,GAAA,IAAO,UAAU,CAAA;AAC3C;AAEA,SAAS,aAAA,GAAwB;AAC/B,EAAA,IAAI,OAAQ,UAAA,CAAmB,MAAA,EAAQ,UAAA,KAAe,UAAA,EAAY;AAChE,IAAA,OAAQ,UAAA,CAAmB,OAAO,UAAA,EAAW;AAAA,EAC/C;AACA,EAAA,OAAO,CAAA,EAAG,IAAA,CAAK,GAAA,EAAK,IAAI,IAAA,CAAK,MAAA,EAAO,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AACjE;AAcA,SAAS,eAAe,KAAA,EAAuB;AAC7C,EAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,KAAK,CAAA;AAC5C,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,GAAA,IAAO,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,IAAI,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,CAAE,QAAA,CAAS,IAAI,GAAG,CAAA;AAC1C;AClUA,SAAS,iBAAA,CAAkB,QAAgB,QAAA,EAA0B;AACnE,EAAA,MAAM,CAAC,KAAA,EAAO,IAAA,GAAO,EAAE,CAAA,GAAI,MAAA,CAAO,MAAM,GAAG,CAAA;AAC3C,EAAA,MAAM,UAAA,GAAA,CAAc,OAAO,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,EAAG,KAAA,CAAM,GAAG,QAAQ,CAAA;AAClE,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,GAAQ,UAAU,CAAC,CAAA;AAC1C;AAKA,SAAS,uBAAA,CAAwB,QAA2B,QAAA,EAAsC;AAChG,EAAA,MAAM,eAAA,GAAkB,iBAAA,CAAkB,MAAA,CAAO,MAAA,EAAQwD,sBAAe,IAAI,CAAA;AAE5E,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,OAAA;AAAA,IACR,OAAA,EAAS,kBAAA;AAAA,IACT,iBAAA,EAAmB,eAAA;AAAA,IACnB,QAAA;AAAA,IACA,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,OAAO,MAAA,CAAO,KAAA;AAAA,IACd,iBAAA,EAAmB,GAAA;AAAA,IACnB,OAAOR,yBAAAA,CAAmB;AAAA,GAC5B;AACF;AAEA,SAAS,aACP,MAAA,EACoC;AACpC,EAAA,OAAO,QAAA,IAAY,UAAU,WAAA,IAAe,MAAA;AAC9C;AAEA,SAAS,cACP,MAAA,EACsB;AACtB,EAAA,IAAI,YAAA,CAAa,MAAM,CAAA,EAAG;AACxB,IAAA,OAAO;AAAA,MACL,aAAa,MAAA,CAAO,WAAA;AAAA,MACpB,aAAA,EAAe;AAAA,QACb,QAAQ,MAAA,CAAO,MAAA;AAAA,QACf,OAAO,MAAA,CAAO,SAAA;AAAA,QACd,aAAa,MAAA,CAAO;AAAA,OACtB;AAAA,MACA,YAAY,MAAA,CAAO;AAAA,KACrB;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAyBO,SAAS,eAAe,MAAA,EAAyD;AACtF,EAAA,MAAM,QAAA,GAAW,cAAc,MAAM,CAAA;AACrC,EAAA,OAAO,OAAO,GAAA,EAAU,GAAA,EAAU,IAAA,KAAc;AAE9C,IAAA,IAAI,GAAA,CAAI,WAAW,SAAA,EAAW;AAC5B,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAEA,IAAA,MAAM,gBAAgB,GAAA,CAAI,OAAA,GAAU,WAAW,CAAA,IAAK,GAAA,CAAI,UAAU,WAAW,CAAA;AAE7E,IAAA,IAAI,CAAC,aAAA,EAAe;AAElB,MAAA,MAAM,WACJ,GAAA,CAAI,QAAA,IAAY,IAAI,GAAA,GAChB,CAAA,EAAG,IAAI,QAAQ,CAAA,GAAA,EAAM,GAAA,CAAI,GAAA,CAAI,MAAM,CAAC,CAAA,EAAG,IAAI,WAAW,CAAA,CAAA,GACrD,IAAI,GAAA,IAAO,EAAA;AAClB,MAAA,MAAMS,YAAAA,GAAc,uBAAA,CAAwB,QAAA,CAAS,aAAA,EAAe,QAAQ,CAAA;AAE5E,MAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,CAAI,kBAAA,EAAoB,IAAA,CAAK,SAAA,CAAUA,YAAW,CAAC,CAAA,CAAE,IAAA,CAAK;AAAA,QAC/E,KAAA,EAAO,kBAAA;AAAA,QACP,kBAAA,EAAoBA;AAAA,OACrB,CAAA;AAAA,IACH;AAGA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,OAAO,aAAA,KAAkB,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,aAAa,CAAA,GAAI,aAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,4CAA4C,CAAA;AAAA,IACnF;AAGA,IAAA,MAAM,UAAU,OAAA,EAAS,OAAA;AACzB,IAAA,MAAM,YAAY,OAAO,OAAA,EAAS,SAAA,KAAc,QAAA,GAAW,QAAQ,SAAA,GAAY,IAAA;AAC/E,IAAA,MAAM,SAAS,OAAO,OAAA,EAAS,MAAA,KAAW,QAAA,GAAW,QAAQ,MAAA,GAAS,IAAA;AACtE,IAAA,MAAM,QAAQ,OAAO,OAAA,EAAS,KAAA,KAAU,QAAA,GAAW,QAAQ,KAAA,GAAQ,IAAA;AAEnE,IAAA,IAAI,CAAC,SAAA,IAAa,CAAC,MAAA,IAAU,CAAC,KAAA,EAAO;AACnC,MAAA,OAAO,GAAA,CACJ,OAAO,GAAG,CAAA,CACV,KAAK,EAAE,KAAA,EAAO,wDAAwD,CAAA;AAAA,IAC3E;AAGA,IAAA,MAAM,WAAA,GAAc,uBAAA,CAAwB,QAAA,CAAS,aAAA,EAAe,EAAE,CAAA;AACtE,IAAA,MAAM,aAAA,GAAgB,CAAC,CAAA,KAAc,CAAA,CAAE,aAAY,CAAE,OAAA,CAAQ,SAAS,IAAI,CAAA;AAE1E,IAAA,IAAI,cAAc,SAAS,CAAA,KAAM,cAAc,QAAA,CAAS,aAAA,CAAc,KAAK,CAAA,EAAG;AAC5E,MAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,QAC1B,KAAA,EAAO,4BAAA;AAAA,QACP,QAAQ,CAAA,SAAA,EAAY,QAAA,CAAS,aAAA,CAAc,KAAK,SAAS,SAAS,CAAA;AAAA,OACnE,CAAA;AAAA,IACH;AAEA,IAAA,IAAI,UAAA;AACJ,IAAA,IAAI;AACF,MAAA,UAAA,GAAa,OAAO,MAAM,CAAA;AAAA,IAC5B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,GAAA,CACJ,MAAA,CAAO,GAAG,CAAA,CACV,IAAA,CAAK,EAAE,KAAA,EAAO,6BAAA,EAA+B,MAAA,EAAQ,kCAAA,EAAoC,CAAA;AAAA,IAC9F;AAEA,IAAA,IAAI,UAAA,GAAa,MAAA,CAAO,WAAA,CAAY,iBAAiB,CAAA,EAAG;AACtD,MAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,QAC1B,KAAA,EAAO,6BAAA;AAAA,QACP,MAAA,EAAQ,CAAA,SAAA,EAAY,WAAA,CAAY,iBAAiB,oBAAoB,MAAM,CAAA;AAAA,OAC5E,CAAA;AAAA,IACH;AAEA,IAAA,IAAI,cAAc,KAAK,CAAA,KAAM,aAAA,CAAc,WAAA,CAAY,KAAK,CAAA,EAAG;AAC7D,MAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,QAC1B,KAAA,EAAO,wBAAA;AAAA,QACP,MAAA,EAAQ,sBAAsB,KAAK,CAAA;AAAA,OACpC,CAAA;AAAA,IACH;AAGA,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,WAAA,CAAY,OAAO,OAAO,CAAA;AAC1D,MAAA,IAAI,CAAC,SAAS,OAAA,EAAS;AACrB,QAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,UAC1B,KAAA,EAAO,6BAAA;AAAA,UACP,QAAQ,QAAA,CAAS;AAAA,SAClB,CAAA;AAAA,MACH;AAGA,MAAA,IAAI,CAAC,SAAS,UAAA,EAAY;AACxB,QAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,WAAA,CAAY,OAAO,OAAO,CAAA;AACzD,QAAA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACpB,UAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,YAC1B,KAAA,EAAO,2BAAA;AAAA,YACP,QAAQ,OAAA,CAAQ;AAAA,WACjB,CAAA;AAAA,QACH;AAGA,QAAA,GAAA,CAAI,IAAA,GAAO;AAAA,UACT,QAAQ,OAAA,CAAQ,eAAA;AAAA,UAChB,OAAA;AAAA,UACA,WAAW,OAAA,CAAQ;AAAA,SACrB;AAAA,MACF,CAAA,MAAO;AACL,QAAA,GAAA,CAAI,IAAA,GAAO,EAAE,OAAA,EAAQ;AAAA,MACvB;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,QAC1B,KAAA,EAAO,0BAAA;AAAA,QACP,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AACF;ACzMO,IAAM,gBAAA,GAAmB;AACzB,IAAM,mBAAA,GAAsB;AAC5B,IAAM,aAAA,GAAgB;AA6B7B,IAAM,iBAAA,GAAoB,yDAAA;AAE1B,SAAS,oBAAA,CAAqB,OAAe,KAAA,EAAqB;AAChE,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,KAAK,CAAA,oCAAA,CAAsC,CAAA;AAAA,EACrE;AACF;AAGO,SAAS,8BAA8B,MAAA,EAAyC;AACrF,EAAA,MAAM,OAAA,GAAiC;AAAA,IACrC,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,OAAA,EAAS,wBAAA,CAAyB,MAAA,CAAO,OAAO,CAAA;AAAA,IAChD,SAAA,EAAW,OAAO,SAAA,IAAa,iBAAA;AAAA,IAC/B,KAAK,MAAA,CAAO,GAAA;AAAA,IACZ,OAAO,MAAA,CAAO,KAAA;AAAA,IACd,QAAA,EAAU,OAAO,QAAA,IAAY,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAAA,IACzD,gBAAgB,MAAA,CAAO;AAAA,GACzB;AACA,EAAA,KAAA,MAAW,SAAS,CAAC,QAAA,EAAU,WAAA,EAAa,KAAA,EAAO,OAAO,CAAA,EAAY;AACpE,IAAA,oBAAA,CAAqB,KAAA,EAAO,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAC5C;AACA,EAAA,IAAI,CAAC,mBAAA,CAAoB,IAAA,CAAK,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,OAAA,CAAQ,QAAQ,CAAA,IAAK,CAAC,MAAA,CAAO,SAAA,CAAU,OAAA,CAAQ,cAAc,CAAA,EAAG;AACpF,IAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,EACzD;AACA,EAAA,IAAI,OAAA,CAAQ,cAAA,IAAkB,OAAA,CAAQ,QAAA,EAAU;AAC9C,IAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,EAC9D;AAEA,EAAA,OAAO;AAAA,IACL,KAAA,EAAO;AAAA,MACL,cAAA,EAAgB;AAAA,QACd,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,aAAA,EAAc;AAAA,QACpC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,aAAA,EAAc;AAAA,QACvC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,aAAA,EAAc;AAAA,QACvC,EAAE,IAAA,EAAM,UAAA,EAAY,IAAA,EAAM,aAAA;AAAc,OAC1C;AAAA,MACA,MAAA,EAAQ;AAAA,QACN,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,QAAA,EAAS;AAAA,QACjC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,iBAAA,EAAkB;AAAA,QAC3C,EAAE,IAAA,EAAM,WAAA,EAAa,IAAA,EAAM,QAAA,EAAS;AAAA,QACpC,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,QAAA,EAAS;AAAA,QAC9B,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,QAAA,EAAS;AAAA,QAChC,EAAE,IAAA,EAAM,UAAA,EAAY,IAAA,EAAM,WAAA,EAAY;AAAA,QACtC,EAAE,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,WAAA;AAAY;AAC9C,KACF;AAAA,IACA,WAAA,EAAa,QAAA;AAAA,IACb,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,gBAAA;AAAA,MACN,OAAA,EAAS,mBAAA;AAAA,MACT,OAAA,EAAS,aAAA;AAAA,MACT,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,OAAA,EAAS,EAAE,GAAG,OAAA;AAAQ,GACxB;AACF;AAqCA,IAAM,gBAAA,GAAmB,EAAA;AAWzB,eAAsB,qBACpB,MAAA,EACqC;AACrC,EAAA,MAAM,EAAE,SAAA,EAAA5C,UAAAA,EAAW,WAAW,QAAA,EAAU,QAAA,EAAU,gBAAe,GAAI,MAAA;AACrE,EAAA,MAAM,MAAMA,UAAAA,EAAW,OAAA;AACvB,EAAA,IAAI,CAAC,OAAO,CAAC,KAAA,CAAM,QAAQ,SAAS,CAAA,IAAK,SAAA,CAAU,MAAA,KAAW,CAAA,EAAG;AAC/D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC1C;AACA,EAAA,IAAIA,UAAAA,CAAU,QAAQ,OAAA,KAAY,aAAA,SAAsB,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,aAAA,EAAc;AAE3F,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,6BAAA,CAA8B;AAAA,MACxC,MAAA,EAAQ,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAAA,MACzB,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAAA,MACnB,OAAA,EAAS,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA;AAAA,MAC3B,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA;AAAA,MACvB,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA;AAAA,MAC/B,QAAA,EAAU,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA;AAAA,MAC7B,cAAA,EAAgB,MAAA,CAAO,GAAA,CAAI,cAAc;AAAA,KAC1C,CAAA;AACD,IAAA,OAAA,GAAU,SAAA,CAAU,OAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC1C;AAEA,EAAA,IAAI,OAAA,CAAQ,WAAW,QAAA,CAAS,MAAA,SAAe,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,cAAA,EAAe;AACnF,EAAA,IAAI,OAAA,CAAQ,QAAQ,QAAA,CAAS,GAAA,SAAY,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAC1E,EAAA,IAAI,OAAA,CAAQ,UAAU,QAAA,CAAS,KAAA,SAAc,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,aAAA,EAAc;AAChF,EAAA,MAAM,GAAA,GAAM,SAAS,GAAA,IAAO,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxD,EAAA,IAAI,GAAA,IAAO,QAAQ,cAAA,EAAgB,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,SAAA,EAAU;AACzE,EAAA,IAAI,OAAA,CAAQ,WAAW,GAAA,GAAM,gBAAA,SAAyB,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,eAAA,EAAgB;AAE3F,EAAA,MAAM,WAAA,GAAcsC,kBAAAA,CAAkB,cAAA,CAAe,SAAA,EAAW,QAAQ,OAAO,CAAA;AAC/E,EAAA,MAAM,UAAU,MAAM,wBAAA,CAAyB,UAAU,OAAA,CAAQ,OAAA,EAAS,aAAa,SAAS,CAAA;AAChG,EAAA,IAAI,OAAA,CAAQ,OAAO,OAAO,EAAE,IAAI,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,OAAA,EAAQ;AACxE,EAAA,IAAI,OAAA,CAAQ,WAAW,sBAAA,EAAwB,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,mBAAA,EAAoB;AAE/F,EAAA,IAAI,CAAC,cAAA,EAAgB,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,sBAAA,EAAuB;AACxE,EAAA,IAAI,wBAAA,CAAyB,cAAA,CAAe,OAAO,CAAA,KAAM,QAAQ,OAAA,EAAS;AACxE,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,kBAAA,EAAmB;AAAA,EACjD;AACA,EAAA,MAAM,QAAA,GAAW,iCAAA,CAAkC,cAAA,EAAgB,WAAA,EAAa,SAAS,CAAA;AACzF,EAAA,OAAO,QAAA,CAAS,KAAA,GACZ,EAAE,EAAA,EAAI,MAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,OAAA,KACtC,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,SAAS,MAAA,EAAO;AAC3C;;;AC/LA,gBAAA,EAAA;AAqBA,2BAAA,EAAA;AAOA,OAAA,EAAA;AASA,UAAA,EAAA;AAEA,YAAA,EAAA;;;ACxBA,2BAAA,EAAA;AACA,OAAA,EAAA;AAEA,IAAM,eAAA,GAAkB,kBAAA;AACxB,IAAM,oBAAA,GAAuB,MAAA,CAAOpE,oBAAAA,CAAY,iBAAA,CAAkB,eAAe,CAAC,CAAA;AAElF,IAAM,eAAA,GAAkB,mEAAA;AAexB,SAAS,WAAA,CAAY,IAAA,EAAc,CAAA,EAAe,GAAA,EAAmB;AACnE,EAAA,IAAI,CAAA,CAAE,WAAW,GAAA,EAAK;AACpB,IAAA,MAAM,IAAI,MAAM,CAAA,EAAG,IAAI,oBAAoB,GAAG,CAAA,YAAA,EAAe,CAAA,CAAE,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAC1E;AACF;AAEA,SAAS,cAAc,CAAA,EAA8C;AACnE,EAAA,WAAA,CAAY,qBAAA,EAAuB,GAAG,EAAE,CAAA;AACxC,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,EAAA,EAAK,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA;AAC9D,EAAA,OAAO,EAAE,KAAK,CAAA,GAAA,CAAM,EAAA,IAAM,QAAQ,EAAA,EAAK,IAAA,EAAM,KAAK,IAAA,EAAK;AACzD;AAMO,SAAS,kBAAkB,MAAA,EAAgC;AAChE,EAAA,MAAM,CAAA,GAAI,aAAA,CAAc,MAAA,CAAO,CAAC,CAAA;AAChC,EAAA,MAAM,CAAA,GAAI,aAAA,CAAc,MAAA,CAAO,CAAC,CAAA;AAChC,EAAA,OAAO,CAAC,EAAE,GAAA,EAAK,CAAA,CAAE,MAAM,CAAA,CAAE,GAAA,EAAK,EAAE,IAAI,CAAA;AACtC;AAMO,SAAS,cAAc,MAAA,EAA8B;AAC1D,EAAA,OAAO,eAAA,CAAgB,oBAAA,EAAsB,iBAAA,CAAkB,MAAM,CAAC,CAAA;AACxE;AAUO,SAAS,uBAAuB,MAAA,EAA8B;AACnE,EAAA,WAAA,CAAY,wBAAA,EAA0B,MAAA,CAAO,CAAA,EAAG,EAAE,CAAA;AAClD,EAAA,WAAA,CAAY,wBAAA,EAA0B,MAAA,CAAO,CAAA,EAAG,EAAE,CAAA;AAClD,EAAA,MAAM,QAAQ,CAAC,CAAA,KACb,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AACtE,EAAA,OAAO,CAAA,EAAG,MAAM,MAAA,CAAO,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,MAAA,CAAO,CAAC,CAAC,CAAA,CAAA;AAC9C;AASO,SAAS,qBAAqB,YAAA,EAAgC;AACnE,EAAA,MAAM,GAAA,GAAM,aAAa,UAAA,CAAW,IAAI,IAAI,YAAA,CAAa,KAAA,CAAM,CAAC,CAAA,GAAI,YAAA;AACpE,EAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wDAAA,EAA2D,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAC1F;AAGA,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,GAAG,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,EAClE;AACA,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAC/B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,IAAA,KAAA,CAAM,CAAC,CAAA,GAAI,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EACrD;AACA,EAAA,MAAM,IAAI,aAAA,CAAc,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,MAAM,IAAI,aAAA,CAAc,KAAA,CAAM,KAAA,CAAM,EAAA,EAAI,EAAE,CAAC,CAAA;AAC3C,EAAA,MAAM,CAAA,GAAI,MAAM,EAAE,CAAA;AAElB,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,CAAA,KAAM,IAAI,OAAA,GAAU,EAAA;AAAA,OAAA,IACf,CAAA,KAAM,IAAI,OAAA,GAAU,EAAA;AAAA,OAAA,IACpB,CAAA,KAAM,GAAG,OAAA,GAAU,EAAA;AAAA,OAAA,IACnB,CAAA,KAAM,GAAG,OAAA,GAAU,EAAA;AAAA,OACvB,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAC,CAAA,gDAAA,CAAkD,CAAA;AAE7F,EAAA,IAAI,CAAA,CAAE,GAAA,KAAQ,EAAA,IAAM,CAAA,CAAE,SAAS,EAAA,EAAI;AACjC,IAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,EACzD;AACA,EAAA,OAAO,CAAC,EAAE,GAAA,EAAK,CAAA,CAAE,MAAM,CAAA,CAAE,GAAA,EAAK,CAAA,CAAE,IAAA,EAAM,OAAO,CAAA;AAC/C;AAOO,SAAS,iCAAiC,MAAA,EAWpC;AACX,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AACjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,gDAAgD,UAAU,CAAA,+BAAA;AAAA,KAC5D;AAAA,EACF;AACA,EAAA,MAAM,OAAA,GAAU,oBAAA,CAAqB,MAAA,CAAO,YAAY,CAAA;AACxD,EAAA,OAAO,oBAAA,CAAqB;AAAA,IAC1B,OAAA,EAAS,UAAA;AAAA,IACT,OAAA,EAAS,eAAA;AAAA,IACT;AAAA,GACD,CAAA;AACH;AAUA,eAAsB,kCAAkC,MAAA,EAUlC;AACpB,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AACjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,iDAAiD,UAAU,CAAA,+BAAA;AAAA,KAC7D;AAAA,EACF;AACA,EAAA,MAAM,SAAA,GAAY,mBAAA,CAAoB,MAAA,CAAO,UAAU,CAAA;AAEvD,EAAA,MAAM,CAAC,IAAA,EAAM,MAAM,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,IACvC,OAAO,kBAAkB,CAAA;AAAA;AAAA;AAAA,IAGzB,OAAO,uBAAuB;AAAA,GAC/B,CAAA;AAGD,EAAA,MAAM,OAAA,GAAU,YAAA,CAAa,MAAA,CAAO,WAAW,CAAA;AAC/C,EAAA,MAAM,MAAA,GAAS,IAAI,WAAA,EAAY,CAAE,OAAO,+BAAkC,CAAA;AAC1E,EAAA,MAAM,WAAA,GAAc,IAAI,UAAA,CAAW,MAAA,CAAO,SAAS,EAAE,CAAA;AACrD,EAAA,WAAA,CAAY,GAAA,CAAI,QAAQ,CAAC,CAAA;AACzB,EAAA,WAAA,CAAY,GAAA,CAAI,OAAA,EAAS,MAAA,CAAO,MAAM,CAAA;AACtC,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,UAAA,CAAW,WAAW,CAAA;AAInD,EAAA,MAAM,GAAA,GAAW,MAAO,IAAA,CAAa,SAAA,CAAU,eAAe,SAAA,EAAW;AAAA,IACvE,IAAA,EAAM;AAAA,GACP,CAAA;AAED,EAAA,IAAI,CAAA,GAAY,OAAO,GAAA,CAAI,CAAA,KAAM,WAAW,GAAA,CAAI,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA;AAChE,EAAA,IAAI,CAAA,GAAY,OAAO,GAAA,CAAI,CAAA,KAAM,WAAW,GAAA,CAAI,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA;AAChE,EAAA,IAAI,QAAA,GACF,OAAO,GAAA,CAAI,QAAA,KAAa,QAAA,GAAW,IAAI,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,QAAA,IAAY,CAAC,CAAA;AAE5E,EAAA,MAAM,YAAY,eAAA,IAAmB,EAAA;AACrC,EAAA,IAAI,IAAI,SAAA,EAAW;AACjB,IAAA,CAAA,GAAI,eAAA,GAAkB,CAAA;AACtB,IAAA,QAAA,IAAY,CAAA;AAAA,EACd;AAEA,EAAA,MAAM,MAAA,GAAS,aAAa,CAAC,CAAA;AAC7B,EAAA,MAAM,MAAA,GAAS,aAAa,CAAC,CAAA;AAE7B,EAAA,MAAM,KAAA,GAAQ,cAAc,MAAM,CAAA;AAClC,EAAA,MAAM,KAAA,GAAQ,cAAc,MAAM,CAAA;AAElC,EAAA,OAAO,oBAAA,CAAqB;AAAA,IAC1B,OAAA,EAAS,UAAA;AAAA,IACT,OAAA,EAAS,eAAA;AAAA,IACT,OAAA,EAAS,CAAC,KAAA,CAAM,GAAA,EAAK,KAAA,CAAM,IAAA,EAAM,KAAA,CAAM,GAAA,EAAK,KAAA,CAAM,IAAA,EAAM,MAAA,CAAO,QAAQ,CAAC;AAAA,GACzE,CAAA;AACH;AAEA,SAAS,oBAAoB,KAAA,EAAwC;AACnE,EAAA,IAAI,iBAAiB,UAAA,EAAY;AAC/B,IAAA,WAAA,CAAY,qBAAA,EAAuB,OAAO,EAAE,CAAA;AAC5C,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,IAAI,IAAI,KAAA,CAAM,KAAA,CAAM,CAAC,CAAA,GAAI,KAAA;AACtD,EAAA,IAAI,GAAA,CAAI,WAAW,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yDAAA,EAA4D,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAC3F;AAEA,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,GAAG,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACpE;AACA,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,EAAE,CAAA;AAC7B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EACnD;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,aAAa,CAAA,EAAuB;AAC3C,EAAA,IAAI,CAAA,GAAI,EAAA,EAAI,MAAM,IAAI,MAAM,8BAA8B,CAAA;AAC1D,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,EAAE,CAAA;AAC7B,EAAA,KAAA,IAAS,CAAA,GAAI,EAAA,EAAI,CAAA,IAAK,CAAA,EAAG,CAAA,EAAA,EAAK;AAC5B,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,CAAA,GAAI,KAAK,CAAA;AACzB,IAAA,CAAA,KAAM,EAAA;AAAA,EACR;AACA,EAAA,IAAI,CAAA,KAAM,EAAA,EAAI,MAAM,IAAI,MAAM,sCAAsC,CAAA;AACpE,EAAA,OAAO,GAAA;AACT;;;ACnOA,2BAAA,EAAA;AACA,OAAA,EAAA;AAEA,IAAM,iBAAA,GAAoB,eAAA;AAC1B,IAAM,sBAAA,GAAyB,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,iBAAiB,CAAC,CAAA;AAEtF,IAAM,UAAA,GAAa,mEAAA;AASnB,SAAS2E,YAAAA,CAAY,IAAA,EAAc,CAAA,EAAe,GAAA,EAAmB;AACnE,EAAA,IAAI,CAAA,CAAE,WAAW,GAAA,EAAK;AACpB,IAAA,MAAM,IAAI,MAAM,CAAA,EAAG,IAAI,oBAAoB,GAAG,CAAA,YAAA,EAAe,CAAA,CAAE,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAC1E;AACF;AAEA,SAASC,eAAc,CAAA,EAA8C;AACnE,EAAAD,YAAAA,CAAY,WAAA,EAAa,CAAA,EAAG,EAAE,CAAA;AAC9B,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,EAAA,EAAK,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA;AAC9D,EAAA,OAAO,EAAE,KAAK,CAAA,GAAA,CAAM,EAAA,IAAM,QAAQ,EAAA,EAAK,IAAA,EAAM,KAAK,IAAA,EAAK;AACzD;AAEA,SAASE,cAAa,CAAA,EAAuB;AAC3C,EAAA,IAAI,CAAA,GAAI,EAAA,EAAI,MAAM,IAAI,MAAM,8BAA8B,CAAA;AAC1D,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,EAAE,CAAA;AAC7B,EAAA,KAAA,IAAS,CAAA,GAAI,EAAA,EAAI,CAAA,IAAK,CAAA,EAAG,CAAA,EAAA,EAAK;AAC5B,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,CAAA,GAAI,KAAK,CAAA;AACzB,IAAA,CAAA,KAAM,EAAA;AAAA,EACR;AACA,EAAA,IAAI,CAAA,KAAM,EAAA,EAAI,MAAM,IAAI,MAAM,sCAAsC,CAAA;AACpE,EAAA,OAAO,GAAA;AACT;AAGA,SAAS,gBAAgB,KAAA,EAA2B;AAElD,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,IAAO,MAAA,CAAO,YAAA,CAAa,KAAA,CAAM,CAAC,CAAC,CAAA;AAC1E,EAAA,MAAM,GAAA,GAAM,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA,GAAI,IAAA,CAAK,GAAG,CAAA;AAC5F,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACtE;AAUO,SAAS,iBAAiB,KAAA,EAA6B;AAC5D,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,SAAS,EAAE,CAAA;AAC9C,EAAA,MAAM,GAAA,GAAgB,CAAC,MAAA,CAAO,SAAS,CAAC,CAAA;AACxC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,SAAA,EAAW,CAAA,EAAA,EAAK;AAClC,IAAA,IAAI,CAAA,GAAI,EAAA;AACR,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,KAAA,CAAM,CAAA,GAAI,EAAA,GAAK,CAAC,CAAC,CAAA;AACrE,IAAA,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,EACZ;AACA,EAAA,MAAM,WAAW,SAAA,GAAY,EAAA;AAC7B,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,GAAS,QAAA;AAC9B,EAAA,IAAI,OAAA,GAAU,EAAA;AACd,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,EAAQ,CAAA,EAAA,EAAK;AAC/B,IAAA,OAAA,GAAW,WAAW,EAAA,GAAM,MAAA,CAAO,KAAA,CAAM,QAAA,GAAW,CAAC,CAAC,CAAA;AAAA,EACxD;AACA,EAAA,GAAA,CAAI,KAAK,OAAO,CAAA;AAChB,EAAA,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,CAAA;AACvB,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,uBAAuB,GAAA,EAGrC;AAWA,EAAA,IAAI,GAAA,CAAI,SAAS,CAAA,EAAG;AAClB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,GAAA,CAAI,MAAM,CAAA,OAAA,CAAS,CAAA;AAAA,EAC9D;AACA,EAAA,IAAI,IAAI,CAAC,CAAA,KAAM,IAAM,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAEpE,EAAA,MAAM,MAAA,GAAS,IAAI,CAAC,CAAA;AACpB,EAAA,IAAI,SAAS,GAAA,EAAM;AACjB,IAAA,MAAM,IAAI,MAAM,8CAA8C,CAAA;AAAA,EAChE;AACA,EAAA,IAAI,CAAA,GAAI,MAAA,KAAW,GAAA,CAAI,MAAA,EAAQ;AAC7B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,8BAAA,EAAiC,MAAM,CAAA,wBAAA,EAA2B,GAAA,CAAI,SAAS,CAAC,CAAA,CAAA;AAAA,KAClF;AAAA,EACF;AAEA,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,IAAI,IAAI,GAAG,CAAA,KAAM,GAAM,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAC3E,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,GAAA,GAAM,CAAC,CAAA;AACxB,EAAA,IAAI,IAAA,KAAS,CAAA,EAAG,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAClE,EAAA,IAAI,GAAA,GAAM,CAAA,GAAI,IAAA,GAAO,GAAA,CAAI,MAAA,EAAQ;AAC/B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,cAAA,EAAiB,IAAI,CAAA,2BAAA,EAA8B,GAAA,GAAM,CAAC,CAAA,CAAE,CAAA;AAAA,EAC9E;AACA,EAAA,GAAA,IAAO,CAAA;AACP,EAAA,IAAI,MAAA,GAAS,IAAI,UAAA,CAAW,IAAI,CAAA;AAChC,EAAA,MAAA,CAAO,IAAI,GAAA,CAAI,QAAA,CAAS,GAAA,EAAK,GAAA,GAAM,IAAI,CAAC,CAAA;AACxC,EAAA,GAAA,IAAO,IAAA;AAEP,EAAA,IAAI,GAAA,GAAM,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ;AACxB,IAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,EACrD;AACA,EAAA,IAAI,IAAI,GAAG,CAAA,KAAM,GAAM,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAC3E,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,GAAA,GAAM,CAAC,CAAA;AACxB,EAAA,IAAI,IAAA,KAAS,CAAA,EAAG,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAClE,EAAA,IAAI,GAAA,GAAM,CAAA,GAAI,IAAA,GAAO,GAAA,CAAI,MAAA,EAAQ;AAC/B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,cAAA,EAAiB,IAAI,CAAA,2BAAA,EAA8B,GAAA,GAAM,CAAC,CAAA,CAAE,CAAA;AAAA,EAC9E;AACA,EAAA,GAAA,IAAO,CAAA;AACP,EAAA,IAAI,MAAA,GAAS,IAAI,UAAA,CAAW,IAAI,CAAA;AAChC,EAAA,MAAA,CAAO,IAAI,GAAA,CAAI,QAAA,CAAS,GAAA,EAAK,GAAA,GAAM,IAAI,CAAC,CAAA;AAGxC,EAAA,MAAA,GAAS,WAAA,CAAY,gBAAA,CAAiB,MAAM,CAAC,CAAA;AAC7C,EAAA,MAAA,GAAS,WAAA,CAAY,gBAAA,CAAiB,MAAM,CAAC,CAAA;AAC7C,EAAA,OAAO,EAAE,CAAA,EAAG,MAAA,EAAQ,CAAA,EAAG,MAAA,EAAO;AAChC;AAEA,SAAS,iBAAiB,CAAA,EAAwC;AAEhE,EAAA,MAAM,KAAA,GAAQ,EAAE,MAAA,GAAS,CAAA,IAAK,EAAE,CAAC,CAAA,KAAM,IAAO,CAAA,GAAI,CAAA;AAClD,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,CAAA,CAAE,SAAS,KAAK,CAAA;AAC3C,EAAA,GAAA,CAAI,GAAA,CAAI,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA;AACzB,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,YAAY,CAAA,EAAwC;AAC3D,EAAA,IAAI,CAAA,CAAE,SAAS,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,sCAAA,EAAyC,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AACtF,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,EAAE,CAAA;AAC7B,EAAA,GAAA,CAAI,GAAA,CAAI,CAAA,EAAG,EAAA,GAAK,CAAA,CAAE,MAAM,CAAA;AACxB,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,oBAAoB,GAAA,EAA+B;AACjE,EAAA,MAAM,CAAA,GAAID,cAAAA,CAAc,GAAA,CAAI,CAAC,CAAA;AAC7B,EAAA,MAAM,CAAA,GAAIA,cAAAA,CAAc,GAAA,CAAI,CAAC,CAAA;AAC7B,EAAA,OAAO,CAAC,EAAE,GAAA,EAAK,CAAA,CAAE,MAAM,CAAA,CAAE,GAAA,EAAK,EAAE,IAAI,CAAA;AACtC;AAEO,SAAS,gBAAgB,GAAA,EAA6B;AAC3D,EAAA,OAAO,eAAA,CAAgB,sBAAA,EAAwB,mBAAA,CAAoB,GAAG,CAAC,CAAA;AACzE;AASO,SAAS,yBAAyB,GAAA,EAA6B;AACpE,EAAAD,YAAAA,CAAY,oBAAA,EAAsB,GAAA,CAAI,CAAA,EAAG,EAAE,CAAA;AAC3C,EAAAA,YAAAA,CAAY,oBAAA,EAAsB,GAAA,CAAI,CAAA,EAAG,EAAE,CAAA;AAC3C,EAAA,MAAM,QAAQ,CAAC,CAAA,KACb,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AACtE,EAAA,OAAO,CAAA,EAAG,MAAM,GAAA,CAAI,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,GAAA,CAAI,CAAC,CAAC,CAAA,CAAA;AACxC;AAiBO,SAAS,mCAAmC,MAAA,EAqBtC;AACX,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AACjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,kDAAkD,UAAU,CAAA,+BAAA;AAAA,KAC9D;AAAA,EACF;AACA,EAAA,MAAM,EAAE,CAAA,EAAG,CAAA,EAAE,GAAI,sBAAA,CAAuB,OAAO,YAAY,CAAA;AAE3D,EAAA,MAAM,iBAAA,GAAoB,eAAA,CAAgBE,aAAAA,CAAa,MAAA,CAAO,WAAW,CAAC,CAAA;AAG1E,EAAA,MAAM,MAAA,GAAS,gBAAgB,iBAAiB,CAAA,CAAA,CAAA;AAChD,EAAA,MAAM,gBAAgB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,cAAc,CAAA;AACpE,EAAA,MAAM,WAAA,GAAc,aAAA,CAAc,OAAA,CAAQ,MAAM,CAAA;AAChD,EAAA,IAAI,cAAc,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,eAAA,GAAkB,cAAc,eAAA,CAAgB,MAAA;AAEtD,EAAA,MAAM,EAAA,GAAKD,eAAc,CAAC,CAAA;AAC1B,EAAA,MAAM,EAAA,GAAKA,eAAc,CAAC,CAAA;AAE1B,EAAA,MAAM,OAAA,GAAoB;AAAA,IACxB,GAAG,gBAAA,CAAiB,MAAA,CAAO,iBAAiB,CAAA;AAAA,IAC5C,GAAG,gBAAA,CAAiB,MAAA,CAAO,cAAc,CAAA;AAAA,IACzC,OAAO,eAAe,CAAA;AAAA,IACtB,EAAA,CAAG,GAAA;AAAA,IACH,EAAA,CAAG,IAAA;AAAA,IACH,EAAA,CAAG,GAAA;AAAA,IACH,EAAA,CAAG,IAAA;AAAA,IACH,OAAO,OAAA,IAAW;AAAA,GACpB;AAEA,EAAA,OAAO,oBAAA,CAAqB;AAAA,IAC1B,OAAA,EAAS,UAAA;AAAA,IACT,OAAA,EAAS,iBAAA;AAAA,IACT;AAAA,GACD,CAAA;AACH;AAWA,eAAsB,oCAAoC,MAAA,EAkBpC;AACpB,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AACjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,mDAAmD,UAAU,CAAA,+BAAA;AAAA,KAC/D;AAAA,EACF;AACA,EAAA,MAAM,SAAA,GAAYE,oBAAAA,CAAoB,MAAA,CAAO,UAAU,CAAA;AACvD,EAAA,MAAM,IAAA,GAAO,OAAO,IAAA,IAAQ,UAAA;AAC5B,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,IAAU,kBAAA;AAChC,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,IAAS,CAAA;AAC9B,EAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAa,EAAA;AAKtC,EAAA,IAAI,CAAC,OAAO,SAAA,CAAU,KAAK,KAAK,KAAA,GAAQ,CAAA,IAAK,QAAQ,GAAA,EAAM;AACzD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mDAAA,EAAsD,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EAChF;AACA,EAAA,IAAI,CAAC,OAAO,SAAA,CAAU,SAAS,KAAK,SAAA,GAAY,CAAA,IAAK,YAAY,UAAA,EAAY;AAC3E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8DAAA,EAAiE,SAAS,CAAA,CAAA,CAAG,CAAA;AAAA,EAC/F;AAEA,EAAA,MAAM,CAAC,EAAE,IAAA,EAAK,EAAG,IAAI,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,IACzC,OAAO,uBAAuB,CAAA;AAAA,IAC9B,OAAO,uBAAuB;AAAA,GAC/B,CAAA;AAGD,EAAA,MAAM,SAAA,GAAYD,aAAAA,CAAa,MAAA,CAAO,WAAW,CAAA;AACjD,EAAA,MAAM,YAAA,GAAe,gBAAgB,SAAS,CAAA;AAE9C,EAAA,MAAM,aAAA,GACJ,CAAA,oCAAA,EAAuC,YAAY,CAAA,YAAA,EACtC,MAAM,CAAA,sBAAA,CAAA;AACrB,EAAA,MAAM,UAAA,GAAa,IAAI,WAAA,EAAY,CAAE,OAAO,aAAa,CAAA;AACzD,EAAA,MAAM,kBACJ,aAAA,CAAc,OAAA,CAAQ,gBAAgB,YAAY,CAAA,CAAA,CAAG,IAAI,eAAA,CAAgB,MAAA;AAG3E,EAAA,MAAM,QAAA,GAAW,KAAK,MAAA,CAAO,IAAI,aAAY,CAAE,MAAA,CAAO,IAAI,CAAC,CAAA;AAC3D,EAAA,MAAM,QAAA,GAAW,IAAI,UAAA,CAAW,EAAA,GAAK,IAAI,CAAC,CAAA;AAC1C,EAAA,QAAA,CAAS,GAAA,CAAI,UAAU,CAAC,CAAA;AACxB,EAAA,QAAA,CAAS,EAAE,CAAA,GAAI,KAAA;AAEf,EAAA,QAAA,CAAS,EAAE,CAAA,GAAK,SAAA,KAAc,EAAA,GAAM,GAAA;AACpC,EAAA,QAAA,CAAS,EAAE,CAAA,GAAK,SAAA,KAAc,EAAA,GAAM,GAAA;AACpC,EAAA,QAAA,CAAS,EAAE,CAAA,GAAK,SAAA,KAAc,CAAA,GAAK,GAAA;AACnC,EAAA,QAAA,CAAS,EAAE,IAAI,SAAA,GAAY,GAAA;AAG3B,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,MAAA,CAAO,UAAU,CAAA;AACtC,EAAA,MAAM,cAAc,IAAI,UAAA,CAAW,QAAA,CAAS,MAAA,GAAS,QAAQ,MAAM,CAAA;AACnE,EAAA,WAAA,CAAY,GAAA,CAAI,UAAU,CAAC,CAAA;AAC3B,EAAA,WAAA,CAAY,GAAA,CAAI,OAAA,EAAS,QAAA,CAAS,MAAM,CAAA;AACxC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,WAAW,CAAA;AAGzC,EAAA,MAAM,QAAA,GAAwB,IAAA,CAAa,IAAA,CAAK,SAAA,EAAW,SAAA,EAAW;AAAA,IACpE,OAAA,EAAS;AAAA,GACV,CAAA;AACD,EAAA,IAAI,QAAA,CAAS,WAAW,EAAA,EAAI;AAC1B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,QAAA,CAAS,MAAM,CAAA,mBAAA,CAAqB,CAAA;AAAA,EAC5E;AACA,EAAA,IAAI,IAAI,eAAA,CAAgB,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAC7C,EAAA,IAAI,IAAI,eAAA,CAAgB,QAAA,CAAS,KAAA,CAAM,EAAA,EAAI,EAAE,CAAC,CAAA;AAG9C,EAAA,MAAM,YAAY,UAAA,IAAc,EAAA;AAChC,EAAA,IAAI,CAAA,GAAI,SAAA,EAAW,CAAA,GAAI,UAAA,GAAa,CAAA;AAEpC,EAAA,MAAM,MAAA,GAASA,cAAa,CAAC,CAAA;AAC7B,EAAA,MAAM,MAAA,GAASA,cAAa,CAAC,CAAA;AAE7B,EAAA,MAAM,EAAA,GAAKD,eAAc,MAAM,CAAA;AAC/B,EAAA,MAAM,EAAA,GAAKA,eAAc,MAAM,CAAA;AAE/B,EAAA,MAAM,OAAA,GAAoB;AAAA,IACxB,GAAG,iBAAiB,QAAQ,CAAA;AAAA,IAC5B,GAAG,iBAAiB,UAAU,CAAA;AAAA,IAC9B,OAAO,eAAe,CAAA;AAAA,IACtB,EAAA,CAAG,GAAA;AAAA,IACH,EAAA,CAAG,IAAA;AAAA,IACH,EAAA,CAAG,GAAA;AAAA,IACH,EAAA,CAAG,IAAA;AAAA,IACH;AAAA;AAAA,GACF;AAEA,EAAA,OAAO,oBAAA,CAAqB;AAAA,IAC1B,OAAA,EAAS,UAAA;AAAA,IACT,OAAA,EAAS,iBAAA;AAAA,IACT;AAAA,GACD,CAAA;AACH;AAEA,SAASE,qBAAoB,KAAA,EAAwC;AACnE,EAAA,IAAI,iBAAiB,UAAA,EAAY;AAC/B,IAAAH,YAAAA,CAAY,mBAAA,EAAqB,KAAA,EAAO,EAAE,CAAA;AAC1C,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,IAAI,IAAI,KAAA,CAAM,KAAA,CAAM,CAAC,CAAA,GAAI,KAAA;AACtD,EAAA,IAAI,GAAA,CAAI,WAAW,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uDAAA,EAA0D,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EACzF;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,GAAG,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,EAClE;AACA,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,EAAE,CAAA;AAC7B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EACnD;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,gBAAgB,CAAA,EAAuB;AAC9C,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,EAAA,EAAK,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA;AAC9D,EAAA,OAAO,CAAA;AACT;;;AC/YA,2BAAA,EAAA;AACA,OAAA,EAAA;AAGA,IAAM,sBAAA,GAAyB,qBAAA;AAC/B,IAAM,2BAAA,GAA8B,MAAA,CAAO3E,oBAAAA,CAAY,iBAAA,CAAkB,sBAAsB,CAAC,CAAA;AAGzF,IAAM,YAAA,GAAe;AAG5B,IAAM,gBAAA,GAAmB,EAAA;AAiCzB,IAAM+E,UAAAA,GAAAA,CAAa,MAAM,IAAA,IAAQ,EAAA;AAEjC,SAASJ,YAAAA,CAAY,IAAA,EAAc,CAAA,EAAe,GAAA,EAAmB;AACnE,EAAA,IAAI,CAAA,CAAE,WAAW,GAAA,EAAK;AACpB,IAAA,MAAM,IAAI,MAAM,CAAA,EAAG,IAAI,oBAAoB,GAAG,CAAA,YAAA,EAAe,CAAA,CAAE,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAC1E;AACF;AAEA,SAASC,eAAc,CAAA,EAA8C;AACnE,EAAAD,YAAAA,CAAY,qBAAA,EAAuB,CAAA,EAAG,EAAE,CAAA;AACxC,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,EAAA,EAAK,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA;AAC9D,EAAA,OAAO,EAAE,GAAA,EAAK,CAAA,GAAII,UAAAA,EAAW,IAAA,EAAM,KAAK,IAAA,EAAK;AAC/C;AAOO,SAAS,gBAAgB,GAAA,EAAqB;AACnD,EAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,GAAG,CAAA;AAC1C,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AACpD,EAAA,OAAO,MAAA,CAAOhF,aAAAA,CAAK,6BAAA,CAA8B,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC,CAAC,CAAC,CAAA;AAC3F;AAMO,SAAS,uBAAuB,MAAA,EAAqC;AAC1E,EAAA,MAAM,CAAA,GAAI6E,cAAAA,CAAc,MAAA,CAAO,CAAC,CAAA;AAChC,EAAA,MAAM,CAAA,GAAIA,cAAAA,CAAc,MAAA,CAAO,CAAC,CAAA;AAChC,EAAA,MAAM,OAAA,GAAU,eAAA,CAAgB,MAAA,CAAO,GAAG,CAAA;AAC1C,EAAA,OAAO,CAAC,EAAE,GAAA,EAAK,CAAA,CAAE,MAAM,CAAA,CAAE,GAAA,EAAK,CAAA,CAAE,IAAA,EAAM,OAAO,CAAA;AAC/C;AAGO,SAAS,mBAAmB,MAAA,EAAmC;AACpE,EAAA,OAAO,eAAA,CAAgB,2BAAA,EAA6B,sBAAA,CAAuB,MAAM,CAAC,CAAA;AACpF;AAMA,SAAS,gBAAgB,KAAA,EAA2B;AAIlD,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,GAAA,IAAO,MAAA,CAAO,aAAa,CAAC,CAAA;AAEnD,EAAA,MAAM,GAAA,GAAM,aAAa,GAAG,CAAA;AAC5B,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACtE;AAEA,SAAS,aAAa,GAAA,EAAqB;AACzC,EAAA,IAAI,OAAO,IAAA,KAAS,UAAA,EAAY,OAAO,KAAK,GAAG,CAAA;AAG/C,EAAA,MAAM,MAAO,UAAA,CAAmB,MAAA;AAChC,EAAA,IAAI,GAAA,SAAY,GAAA,CAAI,IAAA,CAAK,KAAK,QAAQ,CAAA,CAAE,SAAS,QAAQ,CAAA;AACzD,EAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAC9E;AAEA,SAAS,gBAAgB,CAAA,EAAuB;AAE9C,EAAA,MAAM,GAAA,GAAM,EAAE,MAAA,GAAS,CAAA,KAAM,IAAI,CAAA,GAAI,CAAA,GAAK,EAAE,MAAA,GAAS,CAAA;AACrD,EAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,GAAI,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA;AACpE,EAAA,MAAM,GAAA,GAAM,aAAa,GAAG,CAAA;AAC5B,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,aAAa,CAAA,EAAmB;AACvC,EAAA,IAAI,OAAO,IAAA,KAAS,UAAA,EAAY,OAAO,KAAK,CAAC,CAAA;AAE7C,EAAA,MAAM,MAAO,UAAA,CAAmB,MAAA;AAChC,EAAA,IAAI,GAAA,SAAY,GAAA,CAAI,IAAA,CAAK,GAAG,QAAQ,CAAA,CAAE,SAAS,QAAQ,CAAA;AACvD,EAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAC9E;AAQO,SAAS,yBAAyB,WAAA,EAA6B;AACpE,EAAA,MAAM,OAAA,GAAU,IAAI,UAAA,CAAW,EAAE,CAAA;AACjC,EAAA,IAAI,CAAA,GAAI,WAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,EAAA,EAAI,CAAA,IAAK,CAAA,EAAG,CAAA,EAAA,EAAK;AAC5B,IAAA,OAAA,CAAQ,CAAC,CAAA,GAAI,MAAA,CAAO,CAAA,GAAI,KAAK,CAAA;AAC7B,IAAA,CAAA,KAAM,EAAA;AAAA,EACR;AACA,EAAA,IAAI,MAAM,EAAA,EAAI;AACZ,IAAA,MAAM,IAAI,WAAW,8BAA8B,CAAA;AAAA,EACrD;AACA,EAAA,MAAM,GAAA,GAAM,gBAAgB,OAAO,CAAA;AACnC,EAAA,IAAI,GAAA,CAAI,WAAW,gBAAA,EAAkB;AACnC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,SAAA,EAAY,gBAAgB,CAAA,wBAAA,EAA2B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,EACrF;AACA,EAAA,OAAO,GAAA;AACT;AAQA,SAAS,cAAA,CAAe,QAAA,EAAsB,MAAA,EAAoB,KAAA,EAAuB;AACvF,EAAA,KAAA,EAAO,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,OAAO,MAAA,IAAU,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AAChE,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACtC,MAAA,IAAI,SAAS,CAAA,GAAI,CAAC,MAAM,MAAA,CAAO,CAAC,GAAG,SAAS,KAAA;AAAA,IAC9C;AACA,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,KAAK,CAAA,6CAAA,CAA+C,CAAA;AACxF;AAoBA,SAAS,2BAAA,CACP,OAAA,EACA,KAAA,EACA,aAAA,EACQ;AAIR,EAAA,MAAM,OAAA,GAAU,CAAA,CAAA,EAAI,KAAK,CAAA,GAAA,EAAM,aAAa,CAAA,CAAA,CAAA;AAC5C,EAAA,MAAM,YAAA,GAAe,IAAI,WAAA,EAAY,CAAE,OAAO,OAAO,CAAA;AACrD,EAAA,MAAM,GAAA,GAAM,wBAAA,CAAyB,OAAA,EAAS,YAAY,CAAA;AAC1D,EAAA,IAAI,MAAM,CAAA,EAAG;AACX,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,kBAAkB,KAAK,CAAA,uEAAA;AAAA,KACzB;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,IAAI,KAAK,CAAA,GAAA,CAAA;AACxB,EAAA,OAAO,MAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,CAAE,MAAA;AAChD;AAEA,SAAS,wBAAA,CAAyB,UAAsB,MAAA,EAA4B;AAClF,EAAA,KAAA,EAAO,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,OAAO,MAAA,IAAU,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AAChE,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACtC,MAAA,IAAI,SAAS,CAAA,GAAI,CAAC,MAAM,MAAA,CAAO,CAAC,GAAG,SAAS,KAAA;AAAA,IAC9C;AACA,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,OAAO,EAAA;AACT;AAOO,SAAS,kBAAkB,OAAA,EAIhC;AACA,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,gEAAA,EAAmE,MAAM,MAAM,CAAA;AAAA,KACjF;AAAA,EACF;AACA,EAAA,MAAM,CAAC,SAAA,EAAW,UAAA,EAAY,MAAM,CAAA,GAAI,KAAA;AACxC,EAAA,MAAM,cAAA,GAAiB,gBAAgB,UAAU,CAAA;AACjD,EAAA,MAAM,YAAA,GAAe,gBAAgB,MAAM,CAAA;AAC3C,EAAA,IAAI,YAAA,CAAa,WAAW,EAAA,EAAI;AAC9B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,gEAAA,EAAmE,aAAa,MAAM,CAAA,uFAAA;AAAA,KAExF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,SAAA,EAAW,cAAA,EAAgB,YAAA,EAAa;AACnD;AAYO,SAAS,eAAe,OAAA,EAG7B;AAIA,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY,CAAE,OAAO,SAAS,CAAA;AAClD,EAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AACxD,EAAA,MAAM,UAAA,GAAa,QAAQ,OAAA,CAAQ,MAAA;AACnC,EAAA,IAAI,GAAA,GAAM,UAAA;AACV,EAAA,OAAO,MAAM,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,GAAG,MAAM,EAAA,EAAgB;AAC9D,IAAA,IAAI,OAAA,CAAQ,GAAG,CAAA,KAAM,EAAA,EAAiB;AACpC,MAAA,MAAM,IAAI,MAAM,kEAAkE,CAAA;AAAA,IACpF;AACA,IAAA,GAAA,IAAO,CAAA;AAAA,EACT;AACA,EAAA,IAAI,GAAA,IAAO,QAAQ,MAAA,EAAQ;AACzB,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,EAC5D;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,MAAA,EAAQ,MAAM,UAAA,EAAW;AACxD;AAmBA,SAAS,eAAe,KAAA,EAA6B;AACnD,EAAA,OAAO,iBAAiB,KAAK,CAAA;AAC/B;AAEA,SAAS,qBAAqB,MAAA,EAA6C;AACzE,EAAA,MAAM,cAAc,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,SAAS,CAAA;AAC7D,EAAA,MAAM,WAAA,GAAc,eAAe,WAAW,CAAA;AAC9C,EAAA,MAAM,YAAA,GAAe,cAAA,CAAe,MAAA,CAAO,cAAc,CAAA;AAEzD,EAAA,OAAO;AAAA,IACL,GAAG,WAAA;AAAA,IACH,GAAG,YAAA;AAAA,IACH,MAAA,CAAO,OAAO,WAAW,CAAA;AAAA,IACzB,MAAA,CAAO,OAAO,SAAS,CAAA;AAAA,IACvB,MAAA,CAAO,OAAO,SAAS,CAAA;AAAA,IACvB,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,IACpB,OAAO,CAAA,GAAIG,UAAAA;AAAA,IACX,OAAO,CAAA,IAAK,IAAA;AAAA,IACZ,OAAO,CAAA,GAAIA,UAAAA;AAAA,IACX,OAAO,CAAA,IAAK,IAAA;AAAA,IACZ,MAAA,CAAO,OAAO,OAAO;AAAA,GACvB;AACF;AAYO,SAAS,0CAA0C,MAAA,EAa7C;AACX,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AACjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,yDAAyD,UAAU,CAAA,+BAAA;AAAA,KACrE;AAAA,EACF;AACA,EAAA,MAAM,EAAE,SAAA,EAAW,cAAA,EAAgB,cAAa,GAAI,iBAAA,CAAkB,OAAO,OAAO,CAAA;AAMpF,EAAA,MAAM,aAAA,GAAgB,wBAAA,CAAyB,MAAA,CAAO,WAAW,CAAA;AACjE,EAAA,MAAM,WAAA,GAAc,2BAAA,CAA4B,cAAA,EAAgB,OAAA,EAAS,aAAa,CAAA;AAGtF,EAAA,MAAM,SAAA,GAAY,2BAAA,CAA4B,cAAA,EAAgB,KAAA,EAAO,YAAY,CAAA;AAGjF,EAAA,MAAM,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAQ,MAAA,EAAO,GAAI,eAAe,cAAc,CAAA;AAC3E,EAAA,MAAM,SAAA,GAAY,IAAI,WAAA,EAAY,CAAE,MAAA;AAAA,IAClC,cAAA,CAAe,QAAA,CAAS,SAAA,EAAW,SAAA,GAAY,MAAM;AAAA,GACvD;AACA,EAAA,IAAI,SAAA,KAAc,MAAA,CAAO,MAAA,CAAO,GAAA,EAAK;AACnC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,6BAAA,EAAgC,SAAS,CAAA,4BAAA,EACnC,MAAA,CAAO,OAAO,GAAG,CAAA,6BAAA;AAAA,KACzB;AAAA,EACF;AAGA,EAAA,MAAM,EAAE,CAAA,EAAG,CAAA,EAAE,GAAI,uBAAuB,YAAY,CAAA;AAMpD,EAAA,MAAM,OAAA,GAAiB,CAAA;AAEvB,EAAA,OAAO,oBAAA,CAAqB;AAAA,IAC1B,OAAA,EAAS,UAAA;AAAA,IACT,OAAA,EAAS,sBAAA;AAAA,IACT,SAAS,oBAAA,CAAqB;AAAA,MAC5B,SAAA;AAAA,MACA,cAAA;AAAA,MACA,WAAA;AAAA,MACA,SAAA;AAAA,MACA,SAAA;AAAA,MACA,MAAA;AAAA,MACA,CAAA;AAAA,MACA,CAAA;AAAA,MACA;AAAA,KACD;AAAA,GACF,CAAA;AACH;AAEA,SAAS,uBAAuB,GAAA,EAA2C;AACzE,EAAA,IAAI,GAAA,CAAI,WAAW,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qDAAA,EAAwD,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,EACtF;AACA,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,GAAA,CAAI,CAAC,CAAC,CAAA;AAC1D,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,EAAA,EAAI,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,GAAA,CAAI,CAAC,CAAC,CAAA;AAC3D,EAAA,OAAO,EAAE,GAAG,CAAA,EAAE;AAChB;AAiBA,eAAsB,oCAAoC,MAAA,EAkBvD;AACD,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AACjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,mDAAmD,UAAU,CAAA,+BAAA;AAAA,KAC/D;AAAA,EACF;AACA,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,OAAO,uBAAuB,CAAA;AACrD,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,OAAO,uBAAuB,CAAA;AAEvD,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,MAAA,KAAW,EAAA,EAAI;AACnC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,uDAAA,EAA0D,MAAA,CAAO,UAAA,CAAW,MAAM,CAAA;AAAA,KACpF;AAAA,EACF;AAIA,EAAA,MAAM,eAAA,GAA+B,IAAA,CAAa,YAAA,CAAa,MAAA,CAAO,YAAY,KAAK,CAAA;AACvF,EAAA,IAAI,gBAAgB,MAAA,KAAW,EAAA,IAAM,eAAA,CAAgB,CAAC,MAAM,CAAA,EAAM;AAChE,IAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,EAC9D;AACA,EAAA,MAAM,MAAA,GAA4B;AAAA,IAChC,CAAA,EAAG,eAAA,CAAgB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,IAC9B,CAAA,EAAG,eAAA,CAAgB,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA;AAAA,IAC/B,KAAK,MAAA,CAAO;AAAA,GACd;AAGA,EAAA,MAAM,UAAA,GAAa,KAAK,SAAA,CAAU,EAAE,KAAK,OAAA,EAAS,GAAA,EAAK,eAAe,CAAA;AACtE,EAAA,MAAM,YAAY,eAAA,CAAgB,IAAI,aAAY,CAAE,MAAA,CAAO,UAAU,CAAC,CAAA;AAUtE,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,MAAM,KAAA,GAAQ,wBAAA,CAAyB,MAAA,CAAO,WAAW,CAAA;AACzD,EAAA,MAAM,aAAA,GAAgB;AAAA,IACpB,GAAA,EAAK,YAAA;AAAA,IACL,KAAK,MAAA,CAAO,GAAA;AAAA,IACZ,KAAK,MAAA,CAAO,GAAA;AAAA,IACZ,GAAA,EAAK,GAAA;AAAA,IACL,KAAK,GAAA,GAAM,GAAA;AAAA,IACX;AAAA,GACF;AACA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,CAAU,aAAa,CAAA;AAChD,EAAA,MAAM,cAAA,GAAiB,IAAI,WAAA,EAAY,CAAE,OAAO,WAAW,CAAA;AAC3D,EAAA,MAAM,UAAA,GAAa,gBAAgB,cAAc,CAAA;AAGjD,EAAA,MAAM,YAAA,GAAe,IAAI,WAAA,EAAY,CAAE,OAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAE,CAAA;AAC1E,EAAA,MAAM,MAAA,GAAS,OAAO,YAAY,CAAA;AAMlC,EAAA,MAAM,MAAA,GAAsB,IAAA,CAAa,IAAA,CAAK,MAAA,EAAQ,OAAO,UAAA,EAAY;AAAA,IACvE,IAAA,EAAM;AAAA,GACP,CAAA;AACD,EAAA,IAAI,MAAA,CAAO,WAAW,EAAA,EAAI;AACxB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yDAAA,EAA4D,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAAA,EAC7F;AACA,EAAA,MAAM,EAAE,CAAA,EAAG,CAAA,EAAE,GAAI,uBAAuB,MAAM,CAAA;AAI9C,EAAA,MAAM,OAAA,GAAU,GAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA,EAAI,eAAA,CAAgB,MAAM,CAAC,CAAA,CAAA;AAKrE,EAAA,MAAM,WAAA,GAAc,2BAAA,CAA4B,cAAA,EAAgB,OAAA,EAAS,KAAK,CAAA;AAC9E,EAAA,MAAM,SAAA,GAAY,2BAAA,CAA4B,cAAA,EAAgB,KAAA,EAAO,YAAY,CAAA;AACjF,EAAA,MAAM,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAQ,MAAA,EAAO,GAAI,eAAe,cAAc,CAAA;AAE3E,EAAA,MAAM,WAAW,oBAAA,CAAqB;AAAA,IACpC,OAAA,EAAS,UAAA;AAAA,IACT,OAAA,EAAS,sBAAA;AAAA,IACT,SAAS,oBAAA,CAAqB;AAAA,MAC5B,SAAA;AAAA,MACA,cAAA;AAAA,MACA,WAAA;AAAA,MACA,SAAA;AAAA,MACA,SAAA;AAAA,MACA,MAAA;AAAA,MACA,CAAA;AAAA,MACA,CAAA;AAAA,MACA,OAAA,EAAS;AAAA,KACV;AAAA,GACF,CAAA;AAED,EAAA,OAAO,EAAE,QAAA,EAAU,MAAA,EAAQ,OAAA,EAAQ;AACrC;AC9gBO,IAAM,UAAA,GAAa,MAAA,CAAO/E,oBAAAA,CAAY,iBAAA,CAAkB,OAAO,CAAC;AAGhE,IAAM,aAAA,GAAgB,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,UAAU,CAAC;AAGtE,IAAM,YAAA,GAAe,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,WAAW,CAAC;AACtE,IAAM,eAAA,GAAkB,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,cAAc,CAAC;AAC5E,IAAM,eAAA,GAAkB,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,cAAc,CAAC;AAC5E,IAAM,gBAAA,GAAmB,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,eAAe,CAAC;AAO9E,IAAM,gBAAA,GAAmB;AAAA,EAC9B,SAAA,EAAW,MAAA;AAAA;AAAA,EACX,YAAA,EAAc,KAAA;AAAA;AAAA,EACd,YAAA,EAAc,KAAA;AAAA;AAAA,EACd,aAAA,EAAe,MAAA;AAAA;AAAA,EACf,YAAA,EAAc,MAAA;AAAA;AAAA,EACd,eAAA,EAAiB,KAAA;AAAA;AAAA,EACjB,YAAA,EAAc,KAAA;AAAA;AAAA,EACd,eAAA,EAAiB,KAAA;AAAA;AAAA,EACjB,QAAA,EAAU;AAAA;AACZ;AAUO,IAAM,yBAAA,GAA4B;AAoCzC,SAASgF,MAAAA,CAAM,CAAA,EAA6B,KAAA,GAAQ,MAAA,EAAgB;AAClE,EAAA,MAAM,IAAI,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,OAAO,CAAC,CAAA;AAC9C,EAAA,IAAI,IAAI,EAAA,EAAI;AACV,IAAA,MAAM,IAAI,WAAW,CAAA,EAAG,KAAK,qCAAqC,CAAA,CAAE,QAAA,EAAU,CAAA,CAAE,CAAA;AAAA,EAClF;AACA,EAAA,OAAO,CAAA;AACT;AAEA,SAAS,kBAAkB,KAAA,EAAgC;AACzD,EAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,+CAAA,EAAkD,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA;AAAA,EACvF;AACA,EAAA,MAAM,QAAA,GAAWA,OAAM,MAAA,CAAOhF,oBAAAA,CAAY,kBAAkB,KAAA,CAAM,IAAI,CAAC,CAAA,EAAG,MAAM,CAAA;AAChF,EAAA,MAAM,QAAA,GAAW,KAAA,CAAM,IAAA,KAAS,OAAA,GAAU,UAAA,GAAa,aAAA;AACvD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,CAAC,CAAA,EAAG,CAAA,KAAMgF,MAAAA,CAAM,CAAA,EAAG,CAAA,YAAA,EAAe,CAAC,CAAA,CAAA,CAAG,CAAC,CAAA;AAE5E,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,IACpB,GAAG,MAAA;AAAA,IACH,QAAA;AAAA,IACA,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,IACnBA,MAAAA,CAAM,OAAOhF,oBAAAA,CAAY,iBAAA,CAAkB,MAAM,KAAK,CAAC,GAAG,OAAO;AAAA,GACnE;AACF;AAEA,SAAS,KAAA,CAAM,aAAA,EAAgC,UAAA,EAAoB,QAAA,EAA0B;AAG3F,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AACxC,IAAA,IAAI,QAAA,CAAS,CAAC,CAAA,GAAI,EAAA,EAAI;AACpB,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,YAAY,CAAC,CAAA,mCAAA,EAAsC,SAAS,CAAC,CAAA,CAAE,UAAU,CAAA;AAAA,OAC3E;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,eAAA,EACE,OAAO,aAAA,KAAkB,QAAA,GAAW,OAAO,aAAA,CAAc,QAAA,CAAS,EAAE,CAAA,GAAI,aAAA;AAAA,IAC1E,UAAA;AAAA,IACA,QAAA,EAAU,SAAS,GAAA,CAAI,CAAC,MAAM,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC;AAAA,GACrD;AACF;AAaO,SAAS,yBAAyB,IAAA,EAIhC;AACP,EAAA,MAAM,QAAA,GAAqB,CAAC,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAG,GAAG,iBAAA,CAAkB,IAAA,CAAK,QAAQ,CAAC,CAAA;AACtF,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,mBAAA,EAAqB,QAAQ,CAAA;AAChE;AAQO,SAAS,yBAAyB,IAAA,EAIhC;AACP,EAAA,MAAM,QAAA,GAAqB,CAACgF,MAAAA,CAAM,IAAA,CAAK,IAAI,GAAG,GAAG,iBAAA,CAAkB,IAAA,CAAK,QAAQ,CAAC,CAAA;AACjF,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,mBAAA,EAAqB,QAAQ,CAAA;AAChE;AAEO,SAAS,4BAA4B,IAAA,EAInC;AACP,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,sBAAA,EAAwB;AAAA,IACvD,MAAA,CAAO,KAAK,QAAQ,CAAA;AAAA,IACpB,MAAA,CAAO,KAAK,OAAO;AAAA,GACpB,CAAA;AACH;AAEO,SAAS,4BAA4B,IAAA,EAInC;AACP,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,sBAAA,EAAwB;AAAA,IACvDA,MAAAA,CAAM,KAAK,IAAI,CAAA;AAAA,IACf,MAAA,CAAO,KAAK,OAAO;AAAA,GACpB,CAAA;AACH;AAEO,SAAS,4BAA4B,IAAA,EAKnC;AACP,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,sBAAA,EAAwB;AAAA,IACvD,MAAA,CAAO,KAAK,QAAQ,CAAA;AAAA,IACpB,MAAA,CAAO,KAAK,OAAO,CAAA;AAAA,IACnB,MAAA,CAAO,IAAA,CAAK,cAAA,CAAe,MAAM,CAAA;AAAA,IACjC,GAAG,IAAA,CAAK;AAAA,GACT,CAAA;AACH;AAEO,SAAS,4BAA4B,IAAA,EAKnC;AACP,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,sBAAA,EAAwB;AAAA,IACvDA,MAAAA,CAAM,KAAK,IAAI,CAAA;AAAA,IACf,MAAA,CAAO,KAAK,OAAO,CAAA;AAAA,IACnB,MAAA,CAAO,IAAA,CAAK,cAAA,CAAe,MAAM,CAAA;AAAA,IACjC,GAAG,IAAA,CAAK;AAAA,GACT,CAAA;AACH;AAEO,SAAS,6BAA6B,IAAA,EAIpC;AACP,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,uBAAA,EAAyB;AAAA,IACxD,MAAA,CAAO,KAAK,QAAQ,CAAA;AAAA,IACpB,MAAA,CAAO,KAAK,YAAY;AAAA,GACzB,CAAA;AACH;AAEO,SAAS,6BAA6B,IAAA,EAIpC;AACP,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,uBAAA,EAAyB;AAAA,IACxDA,MAAAA,CAAM,KAAK,IAAI,CAAA;AAAA,IACf,MAAA,CAAO,KAAK,YAAY;AAAA,GACzB,CAAA;AACH;AAMO,SAAS,yBAAyB,IAAA,EAGhC;AACP,EAAA,OAAO,KAAA,CAAM,KAAK,aAAA,EAAe,mBAAA,EAAqB,CAACA,MAAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAC,CAAA;AAC1E;AAoBO,SAAS,0BAA0B,IAAA,EAKjC;AACP,EAAA,MAAM,QAAA,GAAqB,CAAC,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAG,GAAG,iBAAA,CAAkB,IAAA,CAAK,QAAQ,CAAC,CAAA;AACtF,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,mBAAA,EAAqB,QAAQ,CAAA;AAChE;AAQO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,OAAO,KAAA,CAAM,KAAK,aAAA,EAAe,iBAAA,EAAmB,CAAC,MAAA,CAAO,IAAA,CAAK,OAAO,CAAC,CAAC,CAAA;AAC5E;AAmBO,SAAS,0BAA0B,IAAA,EAGjC;AACP,EAAA,OAAO,MAAM,IAAA,CAAK,aAAA,EAAe,qBAAqB,iBAAA,CAAkB,IAAA,CAAK,QAAQ,CAAC,CAAA;AACxF;AAYO,IAAM,cAAA,GAAiB;AAAA,EAC5B,cAAA,EAAgBjF,aAAAA,CAAK,mBAAA,CAAoB,gBAAgB,CAAA;AAAA,EACzD,oBAAA,EAAsBA,aAAAA,CAAK,mBAAA,CAAoB,sBAAsB,CAAA;AAAA,EACrE,SAAA,EAAWA,aAAAA,CAAK,mBAAA,CAAoB,WAAW;AACjD;AAQA,SAAS,gBAAA,CAAiB,OAAwB,KAAA,EAAuB;AACvE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA;AACtC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,EAAG,KAAK,CAAA,iCAAA,EAAoC,KAAK,CAAA,CAAE,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA;AACjC;AASO,SAAS,gBAAA,CAAiB,gBAAiC,OAAA,EAA0B;AAC1F,EAAA,OAAO,iBAAiB,OAAA,EAAS,SAAS,CAAA,IAAK,gBAAA,CAAiB,gBAAgB,gBAAgB,CAAA;AAClG;AAQO,SAAS,sBAAA,CAAuB,gBAAiC,OAAA,EAAyB;AAC/F,EAAA,MAAM,YACJ,gBAAA,CAAiB,cAAA,EAAgB,gBAAgB,CAAA,GAAI,gBAAA,CAAiB,SAAS,SAAS,CAAA;AAC1F,EAAA,OAAO,SAAA,IAAa,EAAA,GAAK,CAAA,GAAI,MAAA,CAAO,SAAS,CAAA;AAC/C;;;AJxRA,cAAA,EAAA;AA0CA,0BAAA,EAAA;;;AK1IA,OAAA,EAAA;AAMA,UAAA,EAAA;AACA,0BAAA,EAAA;AAyDA,SAASkF,cAAAA,GAAwB;AAI/B,EAAA,OAAQ,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,CAAA,IAAK,GAAA,GAAO,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,EAAO,GAAI,QAAS,CAAC,CAAA;AACnF;AAEO,IAAM,cAAN,MAAkB;AAAA,EAUvB,YACE,QAAA,EACA,OAAA,EACA,UAAA,EACA,OAAA,GAA8B,EAAC,EAC/B;AACA,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,IAAA,IAAA,CAAK,UAAA,GAAa,QAAQ,UAAA,IAAc,EAAA;AACxC,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,kBAAA,CAAmB,EAAE,CAAA;AACvD,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,MAAA;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAA,CACJ,KAAA,EACA,OAAA,GAA8B,EAAC,EACD;AAC9B,IAAA,IAAI,OAAA,CAAQ,oBAAoB,MAAA,EAAW;AAOzC,MAAA,MAAM,WAAWlE,sCAAA,GAAiC,kCAAA;AAClD,MAAA,IAAI,CAAC,OAAO,QAAA,CAAS,OAAA,CAAQ,eAAe,CAAA,IAAK,OAAA,CAAQ,mBAAmB,CAAA,EAAG;AAC7E,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,IAAI,OAAA,CAAQ,kBAAkB,QAAA,EAAU;AACtC,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,8BAAA,EAAiC,QAAQ,eAAe,CAAA,kBAAA,EAAqB,QAAQ,CAAA,qCAAA,EAC7CA,sCAA8B,SACjE,kCAAkC,CAAA,8BAAA;AAAA,SACzC;AAAA,MACF;AAAA,IACF;AACA,IAAA,MAAM,mBAAmB,qBAAA,CAAsB;AAAA,MAC7C,KAAA,EAAO,OAAA,CAAQ,KAAA,IAASkE,cAAAA,EAAc;AAAA,MACtC,KAAA;AAAA,MACA,GAAI,OAAA,CAAQ,eAAA,KAAoB,SAC5B,EAAE,aAAA,EAAe,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA,GAAI,QAAQ,eAAe,CAAA,KAC/E;AAAC,KACN,CAAA;AACD,IAAA,MAAM,cAAc,aAAA,CAAc,gBAAA,EAAkB,IAAA,CAAK,OAAA,EAAS,KAAK,OAAO,CAAA;AAC9E,IAAA,MAAM,YAAY,kBAAA,CAAmB;AAAA,MACnC,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,WAAA;AAAA,MACA,YAAY,IAAA,CAAK;AAAA,KAClB,CAAA;AACD,IAAA,MAAM,QAAA,GAAW,qCAAA,CAAsC,EAAE,gBAAA,EAAkB,WAAW,CAAA;AACtF,IAAA,OAAO,EAAE,gBAAA,EAAkB,SAAA,EAAW,WAAA,EAAa,QAAA,EAAS;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CACJ,KAAA,EACA,OAAA,GAA8B,EAAC,EACO;AACtC,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OAIF;AAAA,IACF;AACA,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,MAAM,IAAA,CAAK,aAAA,CAAc,OAAO,OAAO,CAAA;AAC5D,IAAA,OAAO,KAAK,QAAA,CAAS,EAAE,gBAAgB,IAAA,CAAK,OAAA,EAAS,UAAU,CAAA;AAAA,EACjE;AACF;AAQO,SAAS,iBAAiB,MAAA,EAA6B;AAC5D,EAAA,OAAO,OAAO,EAAE,cAAA,EAAgB,QAAA,EAAS,KAAM;AAC7C,IAAA,MAAM,EAAE,gBAAA,EAAiB,GAAI,MAAM,OAAO,OAAA,CAAQ;AAAA,MAChD,eAAA,EAAiB,cAAA;AAAA,MACjB,UAAA,EAAY,yBAAA;AAAA,MACZ;AAAA,KACD,CAAA;AACD,IAAA,OAAO,EAAE,iBAAiB,gBAAA,EAAiB;AAAA,EAC7C,CAAA;AACF","file":"index.js","sourcesContent":["/**\n * Deterministic ShhhAccount (V8.4) address derivation.\n *\n * Vendored from haycarlitos/shhh-wallet-cairo @ v8.4 commit 3975532\n * source: scripts/ts/compute-wallet-address.ts\n * license: MIT (Copyright (c) 2026 Carlos Castillo and contributors)\n *\n * Given the primary owner (kind + raw pubkey bytes) and the\n * ShhhAccount class hash, returns the Starknet address the account\n * will deploy to.\n *\n * MUST match `src/account.cairo::constructor` at the same commit. If\n * the upstream constructor changes shape, the Shhh maintainer will\n * open a PR against this file.\n */\n\nimport { hash, shortString } from \"starknet\";\n\nexport type ComputeAddressInput = {\n /** SHHH ShhhAccount class hash — see WALLET_CLASS_HASHES.SHHH in @chipi-stack/shared. */\n classHash: bigint;\n /** Primary signer kind, e.g. 'STARK' / 'ED25519' / 'WEBAUTHN_P256'. */\n primaryKind: string;\n /** Raw pubkey bytes interpreted as felt252-sized halves (kind-specific layout). */\n pubkey: bigint[];\n /** Verifier class hash for primaryKind — see SHHH_VERIFIER_CLASS_HASHES. */\n verifierClassHash: bigint;\n /** Optional user-facing tag bound into the constructor (default 'primary'). */\n label?: string;\n /** Factory / UDC address; default 0 for self-deploy. */\n deployerAddress?: bigint;\n};\n\n// poseidon_hash_span matches core::poseidon::poseidon_hash_span on-chain.\nfunction poseidon(values: Array<bigint | string>): bigint {\n const felts = values.map((v) => (typeof v === \"bigint\" ? \"0x\" + v.toString(16) : v));\n return BigInt(hash.computePoseidonHashOnElements(felts));\n}\n\n/** Mirrors `src/signer/interface.cairo::owner_commitment` = poseidon(kind_tag, pubkey...). */\nexport function ownerCommitment(kindTag: bigint, pubkey: bigint[]): bigint {\n return poseidon([kindTag, ...pubkey]);\n}\n\n/**\n * Mirrors the V8.4 constructor's salt derivation:\n * salt = poseidon(primary_kind, primary_pubkey_hash)\n * where primary_pubkey_hash = owner_commitment(primary_kind, pubkey).\n * Binding kind into the salt ensures the same raw key under two\n * different kinds produces two distinct addresses.\n */\nexport function computeAddressSalt(primaryKind: string, pubkey: bigint[]): bigint {\n if (pubkey.length === 0) {\n // Fail-fast: an empty pubkey array would still produce a deterministic\n // (but unsignable) address. Reject up front so callers can't silently\n // ship a wallet that no signer can ever authorize.\n throw new Error(\n \"computeAddressSalt: pubkey must contain at least one felt — empty signer material is rejected to prevent silent address mismatch.\"\n );\n }\n const kindTag = BigInt(shortString.encodeShortString(primaryKind));\n const pubkeyHash = ownerCommitment(kindTag, pubkey);\n return poseidon([kindTag, pubkeyHash]);\n}\n\n/** Computes the deterministic deployment address for a SHHH ShhhAccount. */\nexport function computeShhhAddress(input: ComputeAddressInput): bigint {\n const {\n classHash,\n primaryKind,\n pubkey,\n verifierClassHash,\n label = \"primary\",\n deployerAddress = 0n,\n } = input;\n\n const salt = computeAddressSalt(primaryKind, pubkey);\n const kindTag = BigInt(shortString.encodeShortString(primaryKind));\n const labelFelt = BigInt(shortString.encodeShortString(label));\n\n // Constructor calldata: [primary_kind, primary_verifier, pubkey_len, pubkey..., label]\n const ctor: Array<bigint | string> = [\n kindTag,\n verifierClassHash,\n BigInt(pubkey.length),\n ...pubkey,\n labelFelt,\n ];\n\n const addressHex = hash.calculateContractAddressFromHash(\n \"0x\" + salt.toString(16),\n \"0x\" + classHash.toString(16),\n ctor.map((x) => (typeof x === \"bigint\" ? \"0x\" + x.toString(16) : x)),\n \"0x\" + deployerAddress.toString(16)\n );\n return BigInt(addressHex);\n}\n","/**\n * SNIP-12 typed-data hash for `OutsideExecution` — TypeScript reference.\n *\n * Vendored from haycarlitos/shhh-wallet-cairo @ v8.4 commit 3975532\n * source: scripts/ts/snip12-hash.ts\n * license: MIT (Copyright (c) 2026 Carlos Castillo and contributors)\n *\n * MUST produce byte-identical output to `compute_snip12_hash` in\n * `src/outside_execution.cairo` at the same commit. If the canonical\n * Cairo source ships a breaking change, the upstream Shhh maintainer\n * will open a PR against this file (per Q3 of SHHH_INTEGRATION_ANSWERS.md).\n */\n\nimport { hash, shortString, CallData, type Call, type RawArgs } from \"starknet\";\n\n// ================================================================\n// Constants — MUST match src/outside_execution.cairo exactly.\n// ================================================================\n\nexport const OUTSIDE_EXECUTION_TYPE_HASH_REV1 =\n 0x5a4b49e17039355cd95d1f0981d75901191d1319b1f4b05a9a791d218d7e0cn;\n\nexport const CALL_TYPE_HASH_REV1 =\n 0x3635c7f2a7ba93844c0d064e18e487f35ab90f7c39d00f186a781fc3f0c2ca9n;\n\nexport const STARKNET_DOMAIN_TYPE_HASH_REV1 =\n 0x1ff2f602e42168014d405a94f75e8a93d640751d71d16311266e140d8b0a210n;\n\nexport const STARKNET_MESSAGE_PREFIX = shortString.encodeShortString(\"StarkNet Message\");\n\nexport const OE_DOMAIN_NAME = shortString.encodeShortString(\"Account.execute_from_outside\");\nexport const OE_DOMAIN_VERSION = 2n;\nexport const OE_DOMAIN_REVISION = 1n;\n\nexport const SIG_VERSION_V1_HEX_ASCII = shortString.encodeShortString(\"V1_HEX_ASCII\");\nexport const SIG_VERSION_V2_SNIP12 = shortString.encodeShortString(\"V2_SNIP12\");\nexport const SIG_VERSION_V2_THRESHOLD = shortString.encodeShortString(\"V2_THRESHOLD\");\n\n// SRC-5 interface IDs — see Cairo `src/signer/interface.cairo::ISIGNER_ID`.\nexport const ISRC9_V2_ID = BigInt(\n \"0x1d1144bb2138366ff28d8e9ab57456b1d332ac42196230c3a602003c89872\"\n);\nexport const ISIGNER_ID = BigInt(\n \"0x94c5a761f34b25a4e603c651ac0e1fc4fad9cdb5517f7fa1bb54044c7e5ef8\"\n);\n\nexport const ISIGNER_CANONICAL_LABEL = \"ISigner_V1\";\n\n/** Recomputes the canonical `ISIGNER_ID` at runtime. */\nexport function computeISignerId(): bigint {\n return BigInt(hash.starknetKeccak(ISIGNER_CANONICAL_LABEL));\n}\n\n// ================================================================\n// Types\n// ================================================================\n\nexport type OutsideExecution = {\n caller: bigint | string; // ContractAddress (hex or bigint)\n nonce: bigint | string;\n execute_after: bigint; // u64\n execute_before: bigint; // u64\n calls: Call[];\n};\n\n// ================================================================\n// Hash functions\n// ================================================================\n\nfunction toBigInt(x: bigint | string | number): bigint {\n if (typeof x === \"bigint\") return x;\n if (typeof x === \"number\") return BigInt(x);\n return BigInt(x); // accepts \"0x...\" or decimal strings\n}\n\nfunction poseidonSpan(values: Array<bigint | string>): bigint {\n const felts = values.map((v) => (typeof v === \"bigint\" ? \"0x\" + v.toString(16) : v));\n return BigInt(hash.computePoseidonHashOnElements(felts));\n}\n\nexport function hashCall(call: Call): bigint {\n const calldataFelts: string[] = CallData.toHex(\n (Array.isArray(call.calldata) ? call.calldata : [call.calldata]) as RawArgs\n );\n const calldataItems = calldataFelts.map((x) => BigInt(x));\n const calldataHash = poseidonSpan(calldataItems);\n return poseidonSpan([\n CALL_TYPE_HASH_REV1,\n toBigInt(call.contractAddress),\n toBigInt(hash.getSelector(call.entrypoint)),\n calldataHash,\n ]);\n}\n\nexport function hashCalls(calls: Call[]): bigint {\n const callHashes = calls.map(hashCall);\n return poseidonSpan(callHashes);\n}\n\nexport function hashStarknetDomain(chainIdFelt: bigint | string): bigint {\n return poseidonSpan([\n STARKNET_DOMAIN_TYPE_HASH_REV1,\n BigInt(OE_DOMAIN_NAME),\n OE_DOMAIN_VERSION,\n toBigInt(chainIdFelt),\n OE_DOMAIN_REVISION,\n ]);\n}\n\nexport function hashOutsideExecutionStruct(oe: OutsideExecution): bigint {\n const callsArrayHash = hashCalls(oe.calls);\n return poseidonSpan([\n OUTSIDE_EXECUTION_TYPE_HASH_REV1,\n toBigInt(oe.caller),\n toBigInt(oe.nonce),\n oe.execute_after,\n oe.execute_before,\n callsArrayHash,\n ]);\n}\n\n/**\n * The authoritative SNIP-12 message hash for an OutsideExecution.\n * Signers sign over this felt252 (or its hex-ASCII re-encoding for\n * Phantom UX compatibility — see snip12HashToHexAsciiBytes).\n */\nexport function computeSnip12Hash(\n oe: OutsideExecution,\n contractAddress: bigint | string,\n chainIdFelt: bigint | string\n): bigint {\n const domainHash = hashStarknetDomain(chainIdFelt);\n const structHash = hashOutsideExecutionStruct(oe);\n return poseidonSpan([\n BigInt(STARKNET_MESSAGE_PREFIX),\n domainHash,\n toBigInt(contractAddress),\n structHash,\n ]);\n}\n\n/**\n * Phantom hex-ASCII envelope helper. Phantom signs a string; we give it\n * a 64-byte hex-ASCII representation of the SNIP-12 hash, and the Cairo\n * verifier re-computes the hash and compares byte-by-byte.\n */\nexport function snip12HashToHexAsciiBytes(h: bigint): Uint8Array {\n const hex = h.toString(16).padStart(64, \"0\"); // 32 bytes -> 64 ASCII chars\n return new TextEncoder().encode(hex);\n}\n","/**\n * SHHH V8.4 threshold envelope assembly + gas estimation.\n *\n * Wave B PR B2. The single-owner OE flow already ships via\n * `wrap_v2_snip12_envelope` in `oe.ts`. This module adds the\n * multi-owner threshold flow: N owners (possibly with mixed signer\n * kinds) co-sign a single OE, and the wallet's\n * `execute_from_outside_v2` walks the envelope to verify each owner\n * independently before checking total weight against the configured\n * threshold.\n *\n * Cairo dispatch shape (`src/account.cairo:418-460`):\n *\n * signature = [\n * V2_THRESHOLD, // tag\n * n, // u32, MUST be >= 2 and <= owner_count\n * env_1_len, // u32\n * ...env_1 (env_1_len felts),\n * env_2_len,\n * ...env_2,\n * ...\n * env_n_len,\n * ...env_n,\n * ]\n *\n * Each inner envelope is a V2_SNIP12 single-owner envelope\n * (`wrap_v2_snip12_envelope` output) from a different owner. Nested\n * threshold envelopes are NOT permitted — the Cairo `_verify_sub_envelope`\n * recursively checks the inner tag and rejects anything except\n * V2_SNIP12.\n *\n * Cairo-enforced invariants this module replicates client-side so\n * mis-shaped envelopes fail at the SDK boundary with a clear message\n * instead of with an opaque \"THRESH: …\" Starknet revert:\n *\n * - signature.len() >= 2\n * - n >= 2 (n=1 is invalid — use V2_SNIP12 directly for single-owner)\n * - each inner env_len >= 2\n * - no buffer overflow / truncation\n * - no trailing bytes after the last inner envelope\n * - no duplicate owner_id across inner envelopes (extracted from\n * envelope[1] of each inner)\n *\n * Total-weight vs threshold is enforced ON-CHAIN (the SDK can't know\n * the configured threshold without reading on-chain state). Use\n * `estimateThresholdGasOverhead` to predict paymaster fees.\n */\n\nimport { SHHH_KIND_GAS_OVERHEAD } from \"@chipi-stack/shared\";\nimport type { ShhhSignerKind } from \"@chipi-stack/types\";\nimport { shortString } from \"starknet\";\n\nimport { SIG_VERSION_V2_SNIP12, SIG_VERSION_V2_THRESHOLD } from \"./snip12-hash\";\n\n// ================================================================\n// Constants — encode-shortstring values matched against snip12-hash.ts\n// ================================================================\n\nconst V2_SNIP12_TAG = BigInt(SIG_VERSION_V2_SNIP12);\nconst V2_THRESHOLD_TAG = BigInt(SIG_VERSION_V2_THRESHOLD);\n\n/** Minimum number of inner envelopes in a threshold (Cairo enforces >= 2). */\nexport const MIN_THRESHOLD_OWNERS = 2;\n\n// ================================================================\n// Validation\n// ================================================================\n\n/**\n * Validate that an envelope is a well-formed V2_SNIP12 single-owner\n * envelope suitable for inclusion in a threshold envelope. Returns\n * the extracted `owner_id` (envelope[1]) so the caller can dedupe.\n *\n * Rejects nested threshold envelopes (`signature[0] == V2_THRESHOLD`)\n * — V8.4 does not allow nesting; the Cairo `_verify_sub_envelope`\n * would revert with `'SRC9: bad tag'`.\n */\nexport function assertValidV2Snip12Envelope(envelope: bigint[]): bigint {\n if (envelope.length < 2) {\n throw new Error(\n `THRESH: inner envelope must have at least 2 felts (tag + owner_id); got ${envelope.length}`\n );\n }\n const tag = envelope[0];\n if (tag !== V2_SNIP12_TAG) {\n if (tag === V2_THRESHOLD_TAG) {\n throw new Error(\n \"THRESH: nested threshold envelopes are not allowed; \" + \"inner envelopes must be V2_SNIP12\"\n );\n }\n const decoded = _tryDecodeShortString(tag);\n throw new Error(\n `THRESH: inner envelope tag must be V2_SNIP12; got ${decoded ?? \"0x\" + tag.toString(16)}`\n );\n }\n return envelope[1];\n}\n\nfunction _tryDecodeShortString(felt: bigint): string | null {\n try {\n return shortString.decodeShortString(\"0x\" + felt.toString(16));\n } catch {\n return null;\n }\n}\n\n// ================================================================\n// Assembly\n// ================================================================\n\n/**\n * Build a V2_THRESHOLD envelope from a list of pre-signed V2_SNIP12\n * inner envelopes. Each inner envelope must come from a DIFFERENT\n * owner — duplicates fail loudly here instead of on-chain.\n *\n * The typical UI flow:\n * 1. Compute the OE message hash once (computeOeHash from oe.ts)\n * 2. Distribute the hash to N owners (push notification, QR, etc.)\n * 3. Each owner signs with their kind's envelope builder and\n * returns the resulting `bigint[]`\n * 4. UI collects the envelopes and calls this function\n * 5. UI submits the resulting threshold envelope as the\n * `signature` field of `paymaster_executeSponsoredRaw.calldata`\n *\n * `buildThresholdEnvelope` does NOT submit anything. It returns the\n * felt span that goes into the OE calldata.\n */\nexport function buildThresholdEnvelope(args: { innerEnvelopes: bigint[][] }): bigint[] {\n const { innerEnvelopes } = args;\n\n if (innerEnvelopes.length < MIN_THRESHOLD_OWNERS) {\n throw new Error(\n `THRESH: need at least ${MIN_THRESHOLD_OWNERS} inner envelopes; ` +\n `got ${innerEnvelopes.length}. Use wrap_v2_snip12_envelope ` +\n `for single-owner OEs.`\n );\n }\n\n // Single pass: validate, dedup owner_id, append interleaved\n // [env_len, ...env_data] per inner envelope. Layout matches Cairo\n // `src/account.cairo:418-454` (cursor reads env_len, then env_data,\n // then advances) — NOT the grouped [...lens, ...flat] shape an\n // earlier latent `wrapV2ThresholdEnvelope` produced. That function\n // was never called in production; removed in this PR.\n const seenOwners = new Set<string>();\n const out: bigint[] = [V2_THRESHOLD_TAG, BigInt(innerEnvelopes.length)];\n\n for (let i = 0; i < innerEnvelopes.length; i++) {\n const env = innerEnvelopes[i];\n const ownerId = assertValidV2Snip12Envelope(env);\n const key = ownerId.toString();\n if (seenOwners.has(key)) {\n throw new Error(\n `THRESH: duplicate owner_id ${\"0x\" + ownerId.toString(16)} at inner envelope ${i}`\n );\n }\n seenOwners.add(key);\n out.push(BigInt(env.length));\n for (const felt of env) {\n if (felt < 0n) {\n throw new RangeError(\n `THRESH: envelope ${i} contains negative felt (cannot serialize as felt252)`\n );\n }\n out.push(felt);\n }\n }\n\n return out;\n}\n\n// ================================================================\n// Parsing\n// ================================================================\n\n/**\n * Split a V2_THRESHOLD envelope back into its constituent inner\n * V2_SNIP12 envelopes. Inverse of `buildThresholdEnvelope`.\n *\n * Useful for UI flows that need to display \"N of M signers signed\n * so far\" status without re-deriving from individual envelopes. Also\n * useful in tests for round-trip validation.\n *\n * Throws if the envelope is malformed (tag mismatch, n < 2, length\n * mismatch, trailing bytes). Mirrors the Cairo dispatch's structural\n * checks (`src/account.cairo:418-456`) so the same envelope that\n * would parse-fail here would also revert on-chain.\n */\nexport function parseThresholdEnvelope(envelope: bigint[]): {\n innerEnvelopes: bigint[][];\n} {\n if (envelope.length < 2) {\n throw new Error(`THRESH: envelope too short (need at least [tag, n]); got ${envelope.length}`);\n }\n if (envelope[0] !== V2_THRESHOLD_TAG) {\n throw new Error(`THRESH: envelope tag must be V2_THRESHOLD; got 0x${envelope[0].toString(16)}`);\n }\n const n = Number(envelope[1]);\n if (!Number.isInteger(n) || n < MIN_THRESHOLD_OWNERS) {\n throw new Error(`THRESH: n must be an integer >= ${MIN_THRESHOLD_OWNERS}; got ${envelope[1]}`);\n }\n\n // Re-validate each inner envelope while parsing so a framed-but-\n // malformed envelope (nested V2_THRESHOLD, duplicate owner_id,\n // negative felts) fails here with the same error as the builder\n // would have raised. Keeps parse / build symmetric.\n const seenOwners = new Set<string>();\n const innerEnvelopes: bigint[][] = [];\n let cursor = 2;\n for (let i = 0; i < n; i++) {\n if (cursor >= envelope.length) {\n throw new Error(`THRESH: envelope truncated at inner ${i} (no length felt)`);\n }\n const envLen = Number(envelope[cursor]);\n cursor += 1;\n if (!Number.isInteger(envLen) || envLen < 2) {\n throw new Error(`THRESH: inner ${i} env_len must be >= 2; got ${envLen}`);\n }\n if (cursor + envLen > envelope.length) {\n throw new Error(\n `THRESH: inner ${i} would overflow envelope (env_len ${envLen}, ` +\n `cursor ${cursor}, total ${envelope.length})`\n );\n }\n const inner = envelope.slice(cursor, cursor + envLen);\n for (const felt of inner) {\n if (felt < 0n) {\n throw new RangeError(\n `THRESH: inner ${i} contains negative felt (cannot serialize as felt252)`\n );\n }\n }\n const ownerId = assertValidV2Snip12Envelope(inner);\n const key = ownerId.toString();\n if (seenOwners.has(key)) {\n throw new Error(\n `THRESH: duplicate owner_id ${\"0x\" + ownerId.toString(16)} at inner envelope ${i}`\n );\n }\n seenOwners.add(key);\n innerEnvelopes.push(inner);\n cursor += envLen;\n }\n if (cursor !== envelope.length) {\n throw new Error(\n `THRESH: trailing bytes after inner ${n - 1} (cursor ${cursor}, ` +\n `length ${envelope.length})`\n );\n }\n return { innerEnvelopes };\n}\n\n// ================================================================\n// Gas estimation\n// ================================================================\n\n/**\n * Predict the on-chain L2 gas overhead a threshold envelope will\n * consume. Each inner envelope dispatches to its kind's verifier\n * class via `library_call`, so total overhead is the sum of\n * per-kind overheads.\n *\n * Returned value is the same unit as `SHHH_KIND_GAS_OVERHEAD` in\n * `@chipi-stack/shared` (raw L2 gas units). Use to predict paymaster\n * fees:\n * estimatedFee = baselineOEGas + estimateThresholdGasOverhead(owners)\n *\n * Does NOT include the wallet's threshold-validation loop overhead\n * (the deduplication walk and weight summation) — that's a constant\n * ~50K L2 gas regardless of N, and the paymaster's fee predictor\n * already accounts for it.\n */\nexport function estimateThresholdGasOverhead(\n owners: Array<{ signerKind: ShhhSignerKind }>\n): number {\n if (owners.length < MIN_THRESHOLD_OWNERS) {\n throw new Error(\n `THRESH: need at least ${MIN_THRESHOLD_OWNERS} owners to estimate ` +\n `threshold gas; got ${owners.length}`\n );\n }\n let total = 0;\n for (const { signerKind } of owners) {\n const overhead = SHHH_KIND_GAS_OVERHEAD[signerKind];\n if (overhead === undefined) {\n throw new Error(\n `THRESH: unknown signer kind ${signerKind} — missing from ` + `SHHH_KIND_GAS_OVERHEAD`\n );\n }\n total += overhead;\n }\n return total;\n}\n","/**\n * Outside-Execution construction for SHHH V8.4 ShhhAccount.\n *\n * Wraps the canonical SNIP-12 hash + envelope assembly so SDK callers\n * never touch the underlying felt-array shapes directly. Implements\n * the envelope routing per V8.4 handover §5:\n *\n * [ signature[0] ]\n * ├─ 'V2_SNIP12' → [owner_id, kind_tag, ...payload] (single-owner)\n * ├─ 'V2_THRESHOLD' → [n, env_1_len, ..., env_n_len, ...] (multisig)\n * └─ (else, len==4) → SNIP-163 session-key envelope\n *\n * Source of truth: `src/account.cairo::execute_from_outside_v2` at\n * shhh-wallet-cairo v8.4 commit 3975532.\n */\n\nimport { shortString, type Call } from \"starknet\";\nimport {\n computeSnip12Hash,\n SIG_VERSION_V2_SNIP12,\n SIG_VERSION_V2_THRESHOLD,\n type OutsideExecution,\n} from \"./snip12-hash\";\n\n/**\n * The `caller` sentinel used for paymaster-sponsored OE flows. Any\n * forwarder may submit the OE; binding `caller = ANY_CALLER` lifts the\n * usual caller-equality check inside the account.\n */\nexport const ANY_CALLER_FELT = BigInt(shortString.encodeShortString(\"ANY_CALLER\"));\n\n/**\n * Per audit M-2, OE validity windows must not exceed 2 hours. The\n * V8.4 account enforces this on-chain; we expose the constant so SDK\n * callers can default sensibly.\n */\nexport const MAX_OE_VALIDITY_WINDOW_SECONDS = 2 * 60 * 60;\n\n/**\n * Clock-skew buffer (seconds) subtracted from `now` when defaulting\n * the OE's `execute_after`. The wallet's check at\n * `sessions-smart-contract/src/account.cairo:377` (and the matching\n * V8.4 line in `shhh-wallet-cairo/src/account.cairo`) is strict\n * `assert(execute_after < now, 'SRC9: now <= execute_after')`. If\n * the OE is built and submitted within the same second the\n * sequencer mints the next block, `execute_after == now` and the\n * wallet panics with `'SRC9: too early'`, which CHIPI v29's\n * `_execute_calls` then swallows silently. 60s is well within the\n * audit-M-2 window (2h max) and well above any realistic SDK ↔\n * sequencer clock drift.\n */\nexport const OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER = 60;\n\n/**\n * Build a standard paymaster-sponsored OutsideExecution with sensible\n * defaults. Callers can override any field; the typical happy path is\n * to pass only `nonce` + `calls`.\n */\nexport function buildOutsideExecution(params: {\n /** Unique per-account replay nonce. The account stores these in `oe_nonces`. */\n nonce: bigint | string;\n /** The calls the account should execute on success. */\n calls: Call[];\n /** Override `caller`; defaults to ANY_CALLER for paymaster flows. */\n caller?: bigint | string;\n /**\n * UNIX seconds. Defaults to `now - OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER`\n * (60s in the past) so the OE is valid by the time the next block is\n * minted regardless of small clock drifts between the SDK host and\n * the sequencer. The wallet's check is strict `<` (`account.cairo:377`\n * `'SRC9: now <= execute_after'`) — without the buffer, a fast\n * SDK→paymaster round trip can land in the SAME block as the OE\n * was built in and revert with `'SRC9: too early'`. PR sdks#289\n * (this builder fix) made the buffer the default after the first\n * session smoke run reproduced the race.\n */\n executeAfter?: bigint;\n /** UNIX seconds; defaults to now + 2h (the maximum window per audit M-2). */\n executeBefore?: bigint;\n}): OutsideExecution {\n const nowSec = BigInt(Math.floor(Date.now() / 1000));\n const after = params.executeAfter ?? nowSec - BigInt(OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER);\n // When defaulting both endpoints, keep `before - after` exactly at\n // the audit-M-2 cap. Pulling `after` back by the clock-skew buffer\n // without pulling `before` back by the same amount would push the\n // span over MAX_OE_VALIDITY_WINDOW_SECONDS and trip the validator\n // below. The explicit-override branches keep their independent\n // values (caller still gets the M-2 check).\n const before =\n params.executeBefore ??\n nowSec + BigInt(MAX_OE_VALIDITY_WINDOW_SECONDS) - BigInt(OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER);\n if (before <= after) {\n // An inverted or zero-length window passes the max-span check but produces\n // an OE that can never be valid on-chain. Reject up front.\n throw new Error(\n `executeBefore (${before}) must be strictly greater than executeAfter (${after}).`\n );\n }\n if (before - after > BigInt(MAX_OE_VALIDITY_WINDOW_SECONDS)) {\n throw new Error(\n `OE validity window ${before - after}s exceeds max ${MAX_OE_VALIDITY_WINDOW_SECONDS}s (audit M-2). Adjust executeBefore.`\n );\n }\n return {\n caller: params.caller ?? ANY_CALLER_FELT,\n nonce: params.nonce,\n execute_after: after,\n execute_before: before,\n calls: params.calls,\n };\n}\n\n/**\n * Compute the SNIP-12 hash for the given OutsideExecution against\n * a specific account address and chain. This is what the signer\n * (STARK / Ed25519 / EIP-191 / WebAuthn / etc.) commits to.\n *\n * For Phantom UX where the user signs a string, hex-encode the\n * resulting hash via `snip12HashToHexAsciiBytes` from snip12-hash.\n */\nexport function computeOeHash(\n oe: OutsideExecution,\n accountAddress: bigint | string,\n chainId: bigint | string\n): bigint {\n return computeSnip12Hash(oe, accountAddress, chainId);\n}\n\n// ================================================================\n// Envelope assembly\n// ================================================================\n\n/**\n * Single-owner V2_SNIP12 envelope.\n *\n * The account strips signature[0..2] = ['V2_SNIP12', owner_id, kind_tag]\n * and library_calls the matching verifier with `payload`. Chipi\n * paymaster passes the entire envelope verbatim to\n * `execute_from_outside_v2`; it does NOT need to know the kind.\n *\n * **`ownerId` is a u32 INDEX into the wallet's owner_set**, NOT the\n * poseidon `owner_commitment`. Primary owner = `0n`; subsequent owners\n * added via `propose_add_owner` get `1n`, `2n`, etc. The V8.4\n * dispatcher (`src/account.cairo:480`) panics with `'SHHH: bad\n * owner_id'` if signature[1] does not fit in u32 — which happens\n * silently at the wallet level (outer paymaster tx still reports\n * SUCCEEDED). Discovered 2026-05-27 in a production trace audit.\n *\n * Returns the `signature: felt252[]` span you pass to\n * `paymaster_executeSponsoredRaw.calldata`.\n */\nexport function wrapV2Snip12Envelope(params: {\n /** u32 INDEX into owner_set (0n for primary). NOT the commitment. */\n ownerId: bigint;\n kindTag: string | bigint;\n payload: Array<bigint | string>;\n}): bigint[] {\n const tag =\n typeof params.kindTag === \"bigint\"\n ? params.kindTag\n : BigInt(shortString.encodeShortString(params.kindTag));\n return [\n BigInt(SIG_VERSION_V2_SNIP12),\n params.ownerId,\n tag,\n ...params.payload.map((v) => (typeof v === \"bigint\" ? v : BigInt(v))),\n ];\n}\n\n// Threshold envelope (V2_THRESHOLD): see `./threshold.ts:buildThresholdEnvelope`\n// for the canonical builder with validation + deduplication + Cairo-\n// matching interleaved layout.\n//\n// `wrapV2ThresholdEnvelope` below is kept as a deprecated compat shim\n// for v13.x integrators who imported it directly. Wave A shipped this\n// function with the WRONG layout (grouped lens before data, instead\n// of interleaved per Cairo dispatch); it was never called in\n// production. The shim now delegates to the correct builder so any\n// existing call sites get the fixed shape with no SDK API break.\n\nimport { buildThresholdEnvelope } from \"./threshold\";\n\n/**\n * @deprecated since Wave B B2 — use `buildThresholdEnvelope` from\n * `@chipi-stack/backend/shhh/threshold` instead. This wrapper exists\n * for backward compat with v13.x and will be removed one minor\n * release after `chipi-stack@14.5.0` ships.\n *\n * Forwards to the validated builder. Note that callers passing\n * fewer than 2 envelopes (which the old version silently accepted\n * with a bogus layout) will now correctly throw — Cairo rejects\n * `n < 2` thresholds.\n */\nexport function wrapV2ThresholdEnvelope(innerEnvelopes: bigint[][]): bigint[] {\n return buildThresholdEnvelope({ innerEnvelopes });\n}\n","/**\n * Ed25519 signer for SHHH V8.4 ShhhAccount.\n *\n * Used by Phantom (Solana) flows and any generic Ed25519 signer. The\n * V8.4 verifier (class `0x030a7dfc…949f74`) consumes a Cairo-ready\n * calldata array produced by Garaga's `eddsaCalldataBuilder` — it\n * contains the signature halves plus elliptic-curve hints the Cairo\n * verifier needs to keep gas bounded.\n *\n * Reference: shhh-wallet-cairo/scripts/ts/regen-ed25519-fixtures.mjs\n *\n * Verifier overhead: ~33M l2_gas (per SHHH_KIND_GAS_OVERHEAD).\n *\n * IMPORTANT — dynamic imports\n *\n * Garaga ships a ~1.2MB WASM bundle. We dynamic-import it so callers\n * who never touch Ed25519 don't pay the bundle cost. The first call\n * to `buildEd25519Envelope` will lazy-load + initialize Garaga; this\n * is irreversible and cached for the process lifetime. Cold-start\n * cost is ~200-400ms on Android, ~80-150ms on iPhone 13+.\n *\n * `@noble/ed25519` is also dynamic-imported for symmetry, though it\n * tree-shakes cleanly as a static import too.\n */\n\nimport { shortString } from \"starknet\";\nimport { ownerCommitment } from \"../compute-wallet-address\";\nimport { wrapV2Snip12Envelope } from \"../oe\";\nimport { snip12HashToHexAsciiBytes } from \"../snip12-hash\";\n\nconst ED25519_KIND_TAG = \"ED25519\";\nconst ED25519_KIND_TAG_FELT = BigInt(shortString.encodeShortString(ED25519_KIND_TAG));\n\nlet garagaInitPromise: Promise<typeof import(\"garaga\")> | null = null;\n\n/**\n * Lazy + memoized Garaga WASM init. Safe to call repeatedly.\n *\n * On failure (e.g. transient WASM fetch error) we clear the memoized\n * promise so subsequent calls retry; otherwise a single bad init would\n * brick the SDK for the process lifetime.\n */\nasync function ensureGaragaInit(): Promise<typeof import(\"garaga\")> {\n if (garagaInitPromise) return garagaInitPromise;\n const attempt = (async () => {\n const garaga = await import(\"garaga\");\n await garaga.init();\n return garaga;\n })();\n garagaInitPromise = attempt;\n try {\n return await attempt;\n } catch (err) {\n // Reset so the next caller gets a fresh attempt instead of the\n // cached rejection.\n if (garagaInitPromise === attempt) garagaInitPromise = null;\n throw err;\n }\n}\n\n/**\n * Split a 32-byte little-endian Ed25519 value into two felt252-sized\n * halves matching Cairo's `u256` storage layout (low_u128, high_u128).\n * bytes[0] is the LSB of `low`.\n */\nfunction bytesToLeU256(bytes: Uint8Array): { low: bigint; high: bigint } {\n if (bytes.length !== 32) {\n throw new Error(`Ed25519 value must be exactly 32 bytes; got ${bytes.length}.`);\n }\n let low = 0n;\n let high = 0n;\n for (let i = 0; i < 16; i++) low += BigInt(bytes[i]) << BigInt(8 * i);\n for (let i = 0; i < 16; i++) high += BigInt(bytes[16 + i]) << BigInt(8 * i);\n return { low, high };\n}\n\nfunction bytesToLeBigInt(bytes: Uint8Array): bigint {\n let x = 0n;\n for (let i = bytes.length - 1; i >= 0; i--) x = (x << 8n) | BigInt(bytes[i]);\n return x;\n}\n\n/**\n * The Cairo Ed25519 verifier reads the SNIP-12 hash via its hex-ASCII\n * 64-byte encoding so the signature commits to a string that Phantom\n * (and any \"sign-this-string\" UX) can display. This helper is exposed\n * here for parity with the Cairo-side decoder; it's the same function\n * as `snip12HashToHexAsciiBytes` in snip12-hash.ts, re-exported under\n * a kind-specific name for discoverability.\n */\nexport function ed25519SignedBytes(messageHash: bigint): Uint8Array {\n return snip12HashToHexAsciiBytes(messageHash);\n}\n\n/**\n * Compute the V8.4 owner_id for an Ed25519-kind owner from its public\n * key. owner_id = owner_commitment(ED25519_tag, [pub_low, pub_high])\n * — the same shape as `src/signer/ed25519/verifier.cairo` expects in\n * `validate_pubkey`.\n */\nexport function ed25519OwnerId(publicKey: Uint8Array): bigint {\n const { low, high } = bytesToLeU256(publicKey);\n return ownerCommitment(ED25519_KIND_TAG_FELT, [low, high]);\n}\n\n/**\n * Ed25519 pubkey felt layout for the V8.4 constructor / propose_add_owner.\n * Returns the low/high u128 halves of the 32-byte public key in that\n * order — what the Cairo `kind == ED25519` branch reads.\n */\nexport function ed25519PubkeyFelts(publicKey: Uint8Array): bigint[] {\n const { low, high } = bytesToLeU256(publicKey);\n return [low, high];\n}\n\n/**\n * The `ownerPubkey` string for the treasury coordination endpoints\n * (`sdk.treasury.forTreasury({ ownerPubkey })`): `\"0x<low>,0x<high>\"` —\n * the comma-joined `ed25519PubkeyFelts` halves. chipi-back's\n * OwnerSignatureVerifier parses exactly this shape for ED25519 owners,\n * so use this helper rather than hand-formatting (the LE-halves split is\n * easy to get backwards).\n */\nexport function ed25519OwnerPubkeyParam(publicKey: Uint8Array): string {\n return ed25519PubkeyFelts(publicKey)\n .map((f) => \"0x\" + f.toString(16))\n .join(\",\");\n}\n\n/**\n * Build a V2_SNIP12 envelope for the Ed25519 kind. Async because the\n * underlying Garaga WASM must be initialized; subsequent calls reuse\n * the cached init.\n *\n * Inputs:\n * privateKey — 32-byte Ed25519 secret (Uint8Array, NOT hex/bigint:\n * the noble lib refuses anything else).\n * messageHash — the SNIP-12 hash of the OE (see oe.ts::computeOeHash).\n *\n * Output: the `signature` span you pass to\n * `paymaster_executeSponsoredRaw.calldata`.\n */\nexport async function buildEd25519Envelope(params: {\n privateKey: Uint8Array;\n messageHash: bigint;\n /**\n * Owner index in the wallet's owner_set. **Defaults to 0n (primary).**\n * Override for additional owners added via `propose_add_owner`.\n * MUST fit in u32 (i.e., < 2^32). Passing the poseidon\n * `owner_commitment` (e.g. via `ed25519OwnerId`) here will revert\n * on chain with `'SHHH: bad owner_id'` — the bug Shhh team caught\n * 2026-05-27 + audit-trail 2026-05-28.\n */\n ownerIndex?: bigint;\n}): Promise<bigint[]> {\n // Validate cheap params BEFORE Garaga init + signing. An out-of-range\n // ownerIndex should not pay for the ~80-400ms WASM warm-up or an ECDSA\n // sign that we will discard.\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n throw new Error(\n `buildEd25519Envelope: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32). ` +\n \"owner_id is the u32 INDEX into the wallet's owner_set (0 for primary, \" +\n \"1 for second, etc.); do NOT pass an owner_commitment or pubkey here.\"\n );\n }\n if (params.privateKey.length !== 32) {\n throw new Error(\n `Ed25519 private key must be exactly 32 bytes; got ${params.privateKey.length}.`\n );\n }\n\n // @noble/ed25519 ≥ 3.x is async-by-default and ships as ESM.\n const ed = await import(\"@noble/ed25519\");\n\n const publicKey = await ed.getPublicKeyAsync(params.privateKey);\n const signedBytes = ed25519SignedBytes(params.messageHash);\n const signature = await ed.signAsync(signedBytes, params.privateKey);\n\n // Per RFC 8032: signature = R (32B) || s (32B).\n return assembleEd25519Envelope({\n R: signature.slice(0, 32),\n s: signature.slice(32, 64),\n publicKey,\n signedBytes,\n ownerIndex,\n });\n}\n\n/**\n * Build a V2_SNIP12 Ed25519 envelope from an **externally-produced**\n * signature — the Phantom / Solana flow. Phantom (and every external\n * Ed25519 wallet) never exposes the private key: the user signs via\n * `window.solana.signMessage(...)`, which returns a 64-byte signature\n * (R‖s). This is the from-signature counterpart of\n * `buildEd25519Envelope`, mirroring `buildEip191EnvelopeFromSignature`\n * for MetaMask.\n *\n * IMPORTANT — what the wallet MUST sign:\n * The wallet must sign the EXACT bytes returned by\n * `ed25519SignedBytes(messageHash)` — the 64-byte hex-ASCII encoding\n * of the SNIP-12 OE hash — NOT the raw 32-byte `messageHash`. The\n * Cairo verifier reconstructs those same bytes from `messageHash`, so\n * a mismatch fails on chain. The dashboard adapter does:\n * await window.solana.connect();\n * // Phantom returns the 32-byte Ed25519 pubkey as a Solana PublicKey;\n * // `.toBytes()` is the Uint8Array this API expects.\n * const publicKey = window.solana.publicKey.toBytes();\n * const msg = ed25519SignedBytes(messageHash);\n * // Phantom's signMessage returns { signature: Uint8Array (64B), publicKey }.\n * const { signature } = await window.solana.signMessage(msg);\n * const env = await buildEd25519EnvelopeFromSignature({\n * signature, publicKey, messageHash,\n * });\n *\n * Async (unlike the synchronous EIP-191 from-signature path): the\n * Garaga WASM hint builder must be initialized to produce the EC hints\n * the Cairo Ed25519 verifier needs. The issue sketch (#311) showed a\n * sync return; Ed25519 cannot avoid the WASM init that secp256k1 does.\n */\nexport async function buildEd25519EnvelopeFromSignature(params: {\n /** 64-byte Ed25519 signature R(32)‖s(32) from the wallet's signMessage. */\n signature: Uint8Array;\n /** 32-byte Ed25519 public key (as Phantom returns it). */\n publicKey: Uint8Array;\n /** SNIP-12 hash of the OutsideExecution — see oe.ts::computeOeHash. */\n messageHash: bigint;\n /**\n * Owner index in the wallet's owner_set. **Defaults to 0n (primary).**\n * MUST fit in u32. Same semantics + footgun as `buildEd25519Envelope`:\n * pass the INDEX, never an `ed25519OwnerId` commitment.\n */\n ownerIndex?: bigint;\n}): Promise<bigint[]> {\n // Validate cheap params BEFORE the ~80-400ms Garaga warm-up.\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n throw new Error(\n `buildEd25519EnvelopeFromSignature: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32). ` +\n \"owner_id is the u32 INDEX into the wallet's owner_set (0 for primary); \" +\n \"do NOT pass an owner_commitment or pubkey here.\"\n );\n }\n if (params.signature.length !== 64) {\n throw new Error(\n `Ed25519 signature must be exactly 64 bytes (R‖s); got ${params.signature.length}.`\n );\n }\n if (params.publicKey.length !== 32) {\n throw new Error(`Ed25519 public key must be exactly 32 bytes; got ${params.publicKey.length}.`);\n }\n\n const signedBytes = ed25519SignedBytes(params.messageHash);\n return assembleEd25519Envelope({\n R: params.signature.slice(0, 32),\n s: params.signature.slice(32, 64),\n publicKey: params.publicKey,\n signedBytes,\n ownerIndex,\n });\n}\n\n/**\n * Shared core for both Ed25519 builders: run Garaga's hint builder over\n * the signature halves + pubkey + signed message, then wrap in the\n * V2_SNIP12 envelope. The locally-signed and from-signature paths differ\n * ONLY in where (R, s, publicKey) come from — everything downstream is\n * identical, which is exactly what the parity test asserts.\n */\nasync function assembleEd25519Envelope(parts: {\n R: Uint8Array;\n s: Uint8Array;\n publicKey: Uint8Array;\n signedBytes: Uint8Array;\n ownerIndex: bigint;\n}): Promise<bigint[]> {\n const garaga = await ensureGaragaInit();\n\n // Garaga's eddsaCalldataBuilder(Ry_le_bigint, s_le_bigint, Py_le_bigint, msg, prependPublickey=false)\n // returns the calldata array Cairo's Ed25519 verifier consumes:\n // [ Ry_low, Ry_high, s_low, s_high,\n // msg_len, msg_byte_0, ..., msg_byte_{msg_len-1},\n // ...msm_hint..., ...sqrt_Rx_hint..., ...sqrt_Px_hint... ]\n const payload = (garaga as any).eddsaCalldataBuilder(\n bytesToLeBigInt(parts.R),\n bytesToLeBigInt(parts.s),\n bytesToLeBigInt(parts.publicKey),\n parts.signedBytes,\n false\n );\n\n return wrapV2Snip12Envelope({\n ownerId: parts.ownerIndex,\n kindTag: ED25519_KIND_TAG,\n payload: payload as Array<bigint | string>,\n });\n}\n","import CryptoES from \"crypto-es\";\n\nexport const encryptPrivateKey = (privateKey: string, password: string): string => {\n if (!privateKey || !password) {\n throw new Error(\"Private key and password are required\");\n }\n\n return CryptoES.AES.encrypt(privateKey, password).toString();\n};\n\nexport const decryptPrivateKey = (encryptedPrivateKey: string, password: string): string => {\n if (!encryptedPrivateKey || !password) {\n throw new Error(\"Encrypted private key and password are required\");\n }\n\n try {\n const bytes = CryptoES.AES.decrypt(encryptedPrivateKey, password);\n const decrypted = bytes.toString(CryptoES.enc.Utf8);\n if (!decrypted) {\n throw new Error(\"Decryption resulted in empty string\");\n }\n return decrypted;\n } catch (error) {\n if (error instanceof Error) {\n throw error;\n }\n throw new Error(`Decryption failed: ${error}`);\n }\n};\n","export { encryptPrivateKey, decryptPrivateKey } from \"./lib/encryption\";\n","/**\n * STARK ECDSA signer for SHHH V8.4 ShhhAccount.\n *\n * Cheapest verifier path (~2M l2_gas). Native Stark-curve ECDSA over\n * the SNIP-12 hash; the verifier class is a thin syscall wrapper.\n *\n * Reference: shhh-wallet-cairo/scripts/ts/gen-phase3-account-fixture.mjs\n * (same Stark signature shape, wrapped in V2_SNIP12).\n *\n * For non-STARK kinds (Ed25519, EIP-191, WebAuthn, JWT, BLS) the\n * envelope payload is per-kind — see sibling files in this directory.\n */\n\nimport { ec, shortString } from \"starknet\";\nimport { ownerCommitment } from \"../compute-wallet-address\";\nimport { wrapV2Snip12Envelope } from \"../oe\";\n\nconst STARK_KIND_TAG = \"STARK\";\nconst STARK_KIND_TAG_FELT = BigInt(shortString.encodeShortString(STARK_KIND_TAG));\n\n/**\n * Build a V2_SNIP12 envelope for the STARK kind from a private key +\n * the OE's SNIP-12 hash. The envelope is the `signature` span you\n * pass to `paymaster_executeSponsoredRaw.calldata`.\n *\n * Payload for STARK is exactly `[r, s]` — the verifier reads these\n * two felts and invokes the chain's `ec_op` syscall.\n *\n * **Envelope layout (V8.4):** `[V2_SNIP12, owner_id, kind_tag, ...payload]`\n *\n * `owner_id` at position [1] is a **u32 INDEX into the owner_set**,\n * NOT the poseidon `owner_commitment`. For the primary owner of a\n * fresh deploy that index is `0n`; for additional owners added via\n * `propose_add_owner` it's `1n`, `2n`, etc. The V8.4 dispatcher\n * (`src/account.cairo:480`) does `(*signature.at(1)).try_into::<u32>()`\n * and panics with `'SHHH: bad owner_id'` if the felt exceeds u32 MAX —\n * which is exactly what happens if a poseidon commitment is passed\n * here instead of the index. (Discovered 2026-05-27 trace audit on\n * tx 0x1d1ee02e0dd1ffdbc6f0dddb426098d0dc87800eee3d0d0201e74d97ddc0a55.)\n */\nexport function buildStarkEnvelope(params: {\n /** STARK private key as bigint or 0x-prefixed hex. */\n privateKey: bigint | string;\n /** SNIP-12 hash of the OutsideExecution — see oe.ts::computeOeHash. */\n messageHash: bigint;\n /**\n * Owner index in the wallet's owner_set. **Defaults to 0n (primary).**\n * Override for additional owners added via `propose_add_owner`.\n * MUST fit in u32 (i.e., < 2^32). Passing the poseidon\n * `owner_commitment` here will revert on chain with\n * `'SHHH: bad owner_id'`.\n */\n ownerIndex?: bigint;\n}): bigint[] {\n // starknet.js getStarkKey/sign accept hex strings, not raw bigints.\n // Normalize to 0x-prefixed 64-char hex regardless of input form.\n const pkHex =\n \"0x\" +\n (typeof params.privateKey === \"bigint\" ? params.privateKey : BigInt(params.privateKey))\n .toString(16)\n .padStart(64, \"0\");\n\n const sig = ec.starkCurve.sign(\"0x\" + params.messageHash.toString(16), pkHex);\n\n const r = BigInt(\"0x\" + sig.r.toString(16));\n const s = BigInt(\"0x\" + sig.s.toString(16));\n\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n // u32 range check matches the on-chain try_into bound; surface as\n // a loud SDK-side error instead of a silent on-chain revert.\n throw new Error(\n `buildStarkEnvelope: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32). ` +\n \"owner_id is the u32 INDEX into the wallet's owner_set (0 for primary, \" +\n \"1 for second, etc.); do NOT pass an owner_commitment or pubkey here.\"\n );\n }\n\n return wrapV2Snip12Envelope({\n ownerId: ownerIndex,\n kindTag: STARK_KIND_TAG,\n payload: [r, s],\n });\n}\n\n/**\n * Compute the V8.4 owner_id for a STARK-kind owner from its public\n * key. owner_id = owner_commitment(kind_tag, [pubkey]) per\n * `src/signer/interface.cairo::owner_commitment`. The account uses\n * this to dedupe owners and select the verifier class.\n */\nexport function starkOwnerId(starkPubKey: bigint): bigint {\n return ownerCommitment(STARK_KIND_TAG_FELT, [starkPubKey]);\n}\n\n/**\n * STARK pubkey layout for the V8.4 constructor / propose_add_owner.\n * The Stark curve pubkey fits in one felt252, so this is a 1-element\n * array. Kept as a function for parity with kinds that split the\n * pubkey into multiple felts (Ed25519, secp256k1, P-256, BLS).\n */\nexport function starkPubkeyFelts(starkPubKey: bigint | string): bigint[] {\n return [typeof starkPubKey === \"bigint\" ? starkPubKey : BigInt(starkPubKey)];\n}\n","/**\n * High-level SHHH V8.4 OE execution path for the backend SDK.\n *\n * This module is the glue between the low-level OE builders in\n * `oe.ts` + `signers/*.ts` and chipi-back's\n * `POST /transactions/execute-sponsored-raw` endpoint.\n *\n * Why this exists separately from the legacy\n * `executePaymasterTransaction` flow:\n *\n * - The Chipi paymaster cannot synthesize SHHH envelopes server-side\n * (each of the 10 V8.4 signer kinds has a different envelope\n * shape; the paymaster's design — see chipi-pay/paymaster#16 — is\n * to pass the signature span verbatim to `execute_from_outside_v2`).\n * - Therefore SHHH clients MUST build + sign the OE locally and\n * submit it pre-signed to a forwarding endpoint\n * (`/transactions/execute-sponsored-raw`).\n * - The legacy flow (`prepare-typed-data` → sign → `execute-sponsored-\n * transaction`) is unchanged and continues to serve CHIPI / READY\n * wallets.\n *\n * Scope (Wave B, this PR): STARK + ED25519 signer kinds.\n * EIP-191 / WEBAUTHN_P256 / JWT_ES256_APPLE_SUB still throw the\n * deferred-feature error until the external-rooted wallet adapter\n * flow lands.\n */\n\nimport { hash, type Call } from \"starknet\";\nimport { decryptPrivateKey } from \"../encryption\";\nimport type { ChipiClient } from \"../client\";\nimport { buildOutsideExecution, computeOeHash, ANY_CALLER_FELT } from \"./oe\";\nimport { buildStarkEnvelope } from \"./signers/stark\";\nimport { buildEd25519Envelope } from \"./signers/ed25519\";\n\n// Default chain ID for SHHH OE signing. Chipi Pay operates exclusively\n// on Starknet mainnet per CLAUDE.md (\"ALWAYS mainnet — Chipi Pay\n// operates exclusively on Starknet mainnet. Staging, tests, and\n// production all use mainnet\"). Callers on non-mainnet environments\n// can override via the `chainId` param on `executeShhhSponsoredRaw`.\n// Drift here = SNIP-12 signature mismatch and on-chain rejection.\nconst SN_MAIN_CHAIN_ID = \"0x534e5f4d41494e\"; // shortString.encodeShortString(\"SN_MAIN\")\nconst SN_SEPOLIA_CHAIN_ID = \"0x534e5f5345504f4c4941\"; // shortString.encodeShortString(\"SN_SEPOLIA\")\n\n/**\n * Pick the chain ID for SNIP-12 hashing. If the caller did not provide\n * an explicit override, infer from the chipi-back base URL (sepolia\n * hostnames map to SN_SEPOLIA; everything else maps to SN_MAIN per\n * the project's mainnet-only invariant).\n *\n * Exported for unit-testing the resolver in isolation.\n */\nexport function resolveShhhChainId(params: {\n override?: bigint | string;\n baseUrl?: string;\n}): string {\n if (params.override !== undefined) {\n return typeof params.override === \"bigint\"\n ? \"0x\" + params.override.toString(16)\n : params.override;\n }\n const url = (params.baseUrl ?? \"\").toLowerCase();\n if (url.includes(\"sepolia\")) return SN_SEPOLIA_CHAIN_ID;\n return SN_MAIN_CHAIN_ID;\n}\n\n/**\n * Serialize an OutsideExecution struct + signature span into the\n * flat felt-array calldata that `execute_from_outside_v2` expects.\n *\n * Cairo's serde order (per shhh-wallet-cairo v8.4\n * `src/account.cairo::execute_from_outside_v2`):\n *\n * caller\n * nonce\n * execute_after (u64, 1 felt)\n * execute_before (u64, 1 felt)\n * calls.len()\n * for each Call:\n * to (felt)\n * selector (felt)\n * calldata.len()\n * ...calldata felts\n * signature.len()\n * ...signature felts\n *\n * Returns 0x-prefixed lowercase hex strings ready for direct\n * JSON-RPC submission via the chipi-back forwarder.\n */\nexport function serializeExecuteFromOutsideV2Calldata(params: {\n outsideExecution: {\n caller: bigint | string;\n nonce: bigint | string;\n execute_after: bigint;\n execute_before: bigint;\n calls: Call[];\n };\n signature: bigint[];\n}): string[] {\n const out: bigint[] = [];\n const oe = params.outsideExecution;\n\n const toBig = (v: bigint | string): bigint => (typeof v === \"bigint\" ? v : BigInt(v));\n\n out.push(toBig(oe.caller));\n out.push(toBig(oe.nonce));\n out.push(oe.execute_after);\n out.push(oe.execute_before);\n\n out.push(BigInt(oe.calls.length));\n for (const call of oe.calls) {\n out.push(BigInt(call.contractAddress));\n out.push(BigInt(hash.getSelector(call.entrypoint)));\n const callData = Array.isArray(call.calldata)\n ? (call.calldata as Array<string | number | bigint>)\n : [];\n out.push(BigInt(callData.length));\n for (const datum of callData) {\n out.push(typeof datum === \"bigint\" ? datum : BigInt(datum));\n }\n }\n\n out.push(BigInt(params.signature.length));\n for (const sigFelt of params.signature) {\n out.push(sigFelt);\n }\n\n return out.map((v) => \"0x\" + v.toString(16));\n}\n\n/**\n * Generate a unique OE nonce. The V8.4 account stores consumed nonces\n * in `oe_nonces` and rejects replays, so we need something with enough\n * entropy to avoid collisions across concurrent SDK calls. Combines\n * `Date.now()` (ms) with a 24-bit random suffix; both fit comfortably\n * in a felt252.\n */\nfunction newOeNonce(): bigint {\n const tsMs = BigInt(Date.now());\n const rand = BigInt(Math.floor(Math.random() * 0xffffff));\n // Shift the timestamp left by 24 bits and OR the random suffix to\n // produce a single felt-sized value. ~85 years of millisecond range\n // before the high bits push past 252 bits.\n return (tsMs << 24n) | rand;\n}\n\n/**\n * Decrypt the wallet's STARK private key from its\n * `encryptedPrivateKey` ciphertext + the per-wallet `encryptKey` (PIN\n * or passkey-derived secret), build a SHHH V8.4 OE around the given\n * inner calls, sign it with the wallet's STARK key, serialize the\n * calldata for `execute_from_outside_v2`, and forward to chipi-back's\n * `/transactions/execute-sponsored-raw` endpoint.\n *\n * Returns the on-chain transaction hash.\n *\n * Pre-conditions:\n * - `wallet.walletType === \"SHHH\"`.\n * - `wallet.publicKey` is the deployed account address (NOT the raw\n * STARK pubkey; V8.4 deployment derives address from kind-bound\n * salt + verifier).\n * - `wallet.encryptedPrivateKey` decrypts cleanly with `encryptKey`.\n * - The wallet is already deployed (no deploy_and_invoke variant\n * here; that flow stays inside `createWallet`).\n */\nexport async function executeShhhSponsoredRaw(params: {\n client: ChipiClient;\n bearerToken: string;\n wallet: {\n publicKey: string;\n encryptedPrivateKey: string;\n walletType?: string;\n };\n encryptKey: string;\n calls: Call[];\n /**\n * Defaults to `\"STARK\"`. Wave B ships STARK + ED25519. EIP-191 /\n * WEBAUTHN_P256 / JWT_ES256_APPLE_SUB are deferred to the\n * external-rooted wallet adapter PRs.\n */\n signerKind?: \"STARK\" | \"ED25519\";\n /** Override the OE nonce; default = `Date.now() << 24 | random24bit`. */\n nonce?: bigint;\n /** Optional externalUserId for the audit-log hint. */\n externalUserId?: string;\n /**\n * Override the chain ID used for SNIP-12 hashing. Defaults to\n * mainnet per CLAUDE.md's mainnet-only invariant; sepolia is auto-\n * inferred from the chipi-back base URL when present. Drift here\n * = the V8.4 account rejects the signature on chain.\n */\n chainId?: bigint | string;\n}): Promise<string> {\n const signerKind = params.signerKind ?? \"STARK\";\n const SDK_SHIPPED_OE_KINDS = [\"STARK\", \"ED25519\"] as const;\n if (!SDK_SHIPPED_OE_KINDS.includes(signerKind as (typeof SDK_SHIPPED_OE_KINDS)[number])) {\n throw new Error(\n `SHHH signerKind=\"${signerKind}\" is not yet shipped from the SDK ` +\n \"(Wave B ships STARK + ED25519). Wait for the follow-up PR that \" +\n \"adds external-rooted (MetaMask, Phantom, passkey, Apple) signing.\"\n );\n }\n\n const privateKeyHex = decryptPrivateKey(params.wallet.encryptedPrivateKey, params.encryptKey);\n if (!privateKeyHex) {\n throw new Error(\n \"Failed to decrypt private key for SHHH OE. Verify the encryptKey matches the one used at wallet creation.\"\n );\n }\n\n const oe = buildOutsideExecution({\n nonce: params.nonce ?? newOeNonce(),\n calls: params.calls,\n caller: ANY_CALLER_FELT,\n });\n\n const chainId = resolveShhhChainId({\n override: params.chainId,\n baseUrl: params.client.baseUrl,\n });\n const messageHash = computeOeHash(oe, params.wallet.publicKey, chainId);\n\n let signature: bigint[];\n if (signerKind === \"STARK\") {\n signature = buildStarkEnvelope({\n privateKey: privateKeyHex,\n messageHash,\n });\n } else {\n // ED25519 — decode the stored hex private key back to 32 raw bytes\n // and route through the Ed25519 envelope builder. The builder\n // generates RFC 8032 deterministic signatures + the Garaga\n // calldata hints the Cairo verifier requires.\n //\n // Defensive 0x prefix strip: today the wallet-creation path stores\n // bare hex (no prefix), but a future storage migration might add\n // one. Normalizing here keeps the validator's error message\n // accurate either way.\n const edKeyHex = privateKeyHex.startsWith(\"0x\") ? privateKeyHex.slice(2) : privateKeyHex;\n if (edKeyHex.length !== 64) {\n throw new Error(\n `SHHH ED25519 private key is ${edKeyHex.length} hex chars; expected 64 (32 raw bytes). ` +\n \"The stored ciphertext does not look like a Chipi-held Ed25519 key — check wallet provenance.\"\n );\n }\n const edPrivKey = Uint8Array.from(Buffer.from(edKeyHex, \"hex\"));\n signature = await buildEd25519Envelope({\n privateKey: edPrivKey,\n messageHash,\n });\n }\n\n const calldata = serializeExecuteFromOutsideV2Calldata({\n outsideExecution: oe,\n signature,\n });\n\n // Forward to chipi-back's /transactions/execute-sponsored-raw. The\n // endpoint owns the paymaster JSON-RPC call (paymaster cannot be\n // hit directly without the paymaster API key, which lives only on\n // chipi-back). chipi-back also records the resulting Transaction.\n const response = await params.client.post<{\n transactionHash?: string;\n id?: string;\n }>({\n endpoint: \"/transactions/execute-sponsored-raw\",\n bearerToken: params.bearerToken,\n body: {\n accountAddress: params.wallet.publicKey,\n calldata,\n signerKind,\n ...(params.externalUserId ? { externalUserId: params.externalUserId } : {}),\n },\n });\n\n // The endpoint returns either a saved Transaction row (with\n // `transactionHash`) or `{ transactionHash, trackingId }` when\n // saveToDatabase=false. Either way the hash is at the top level.\n if (!response || !response.transactionHash) {\n throw new Error(\n \"execute-sponsored-raw response missing transactionHash. Check the chipi-back logs for upstream paymaster errors.\"\n );\n }\n return response.transactionHash;\n}\n","import type { ChipiSDKConfig } from \"@chipi-stack/types\";\nimport {\n isValidApiKey,\n handleApiError,\n validateErrorResponse,\n STARKNET_NETWORKS,\n API_VERSIONING,\n} from \"@chipi-stack/shared\";\nimport { ChipiAuthError, ChipiApiError } from \"@chipi-stack/shared\";\n\n/**\n * HTTP client for Chipi API interactions\n */\nexport class ChipiClient {\n private apiPublicKey: string;\n baseUrl: string;\n nodeUrl: string;\n private customAlphaUrl?: string;\n private sdkVersion: string;\n\n constructor(config: ChipiSDKConfig) {\n if (!isValidApiKey(config.apiPublicKey)) {\n throw new ChipiAuthError(\"Invalid API key format\");\n }\n\n this.apiPublicKey = config.apiPublicKey;\n this.customAlphaUrl = config.alphaUrl;\n this.baseUrl = this.getBaseUrl();\n this.nodeUrl = config.nodeUrl || STARKNET_NETWORKS.MAINNET;\n this.sdkVersion = \"14.0.0\";\n }\n\n /**\n * Get the API public key (for internal SDK use)\n */\n getApiPublicKey(): string {\n return this.apiPublicKey;\n }\n\n private getBaseUrl(): string {\n const version = `v${API_VERSIONING.VERSION}`;\n\n if (this.customAlphaUrl) {\n // Remove any existing version suffix and add the current one\n const cleanUrl = this.customAlphaUrl.replace(/\\/v\\d+\\/?$/, \"\").replace(/\\/$/, \"\");\n return `${cleanUrl}/${version}`;\n }\n\n return `https://api.chipipay.com/${version}`;\n }\n\n /**\n * Add API version query parameters to track the API version being used\n * This helps the backend handle versioning and track which SDK versions are in use\n */\n private addVersionParams(url: URL): void {\n url.searchParams.append(\"__chipi_api_version\", API_VERSIONING.VERSION_DATE);\n }\n\n private getHeaders(bearerToken?: string): Record<string, string> {\n const headers: Record<string, string> = {\n \"Content-Type\": \"application/json\",\n \"x-api-key\": this.apiPublicKey,\n };\n\n if (bearerToken) {\n headers[\"Authorization\"] = `Bearer ${bearerToken}`;\n }\n\n return headers;\n }\n\n async get<T>({\n endpoint,\n params,\n bearerToken,\n }: {\n endpoint: string;\n params?: Record<string, any>;\n bearerToken?: string;\n }): Promise<T> {\n try {\n const url = new URL(`${this.baseUrl}${endpoint}`);\n\n // Add version tracking parameters\n this.addVersionParams(url);\n\n if (params) {\n Object.entries(params).forEach(([key, value]) => {\n if (value !== undefined && value !== null) {\n url.searchParams.append(key, String(value));\n }\n });\n }\n\n const response = await fetch(url.toString(), {\n method: \"GET\",\n headers: this.getHeaders(bearerToken),\n });\n\n const data = await response.json();\n\n if (!response.ok) {\n const errorData = validateErrorResponse(data);\n throw new ChipiApiError(\n errorData.message,\n errorData.code || `HTTP_${response.status}`,\n response.status,\n data\n );\n }\n\n return data as T;\n } catch (error) {\n throw handleApiError(error);\n }\n }\n\n async post<T>({\n endpoint,\n bearerToken,\n body,\n headers,\n }: {\n endpoint: string;\n bearerToken: string;\n body?: Record<string, any>;\n /** Extra request headers, e.g. `X-PAYMENT`. Cannot override auth or content type. */\n headers?: Record<string, string>;\n }): Promise<T> {\n try {\n const url = new URL(`${this.baseUrl}${endpoint}`);\n\n // Add version tracking parameters\n this.addVersionParams(url);\n\n const response = await fetch(url.toString(), {\n method: \"POST\",\n headers: { ...headers, ...this.getHeaders(bearerToken) },\n body: body ? JSON.stringify(body) : undefined,\n });\n\n const data = await response.json();\n\n if (!response.ok) {\n const errorData = validateErrorResponse(data);\n throw new ChipiApiError(\n errorData.message,\n errorData.code || `HTTP_${response.status}`,\n response.status,\n data\n );\n }\n return data as T;\n } catch (error) {\n throw handleApiError(error);\n }\n }\n\n async put<T>({\n endpoint,\n bearerToken,\n body,\n }: {\n endpoint: string;\n bearerToken: string;\n body?: Record<string, any>;\n }): Promise<T> {\n try {\n const url = new URL(`${this.baseUrl}${endpoint}`);\n\n // Add version tracking parameters\n this.addVersionParams(url);\n\n const response = await fetch(url.toString(), {\n method: \"PUT\",\n headers: this.getHeaders(bearerToken),\n body: body ? JSON.stringify(body) : undefined,\n });\n\n const data = await response.json();\n\n if (!response.ok) {\n const errorData = validateErrorResponse(data);\n throw new ChipiApiError(\n errorData.message,\n errorData.code || `HTTP_${response.status}`,\n response.status,\n data\n );\n }\n\n return data as T;\n } catch (error) {\n throw handleApiError(error);\n }\n }\n\n async patch<T>({\n endpoint,\n bearerToken,\n body,\n }: {\n endpoint: string;\n bearerToken: string;\n body?: Record<string, any>;\n }): Promise<T> {\n try {\n const url = new URL(`${this.baseUrl}${endpoint}`);\n\n // Add version tracking parameters\n this.addVersionParams(url);\n\n const response = await fetch(url.toString(), {\n method: \"PATCH\",\n headers: this.getHeaders(bearerToken),\n body: body ? JSON.stringify(body) : undefined,\n });\n\n const data = await response.json();\n\n if (!response.ok) {\n const errorData = validateErrorResponse(data);\n throw new ChipiApiError(\n errorData.message,\n errorData.code || `HTTP_${response.status}`,\n response.status,\n data\n );\n }\n\n return data as T;\n } catch (error) {\n throw handleApiError(error);\n }\n }\n\n async delete<T>({\n endpoint,\n bearerToken,\n }: {\n endpoint: string;\n bearerToken: string;\n }): Promise<T> {\n try {\n const url = new URL(`${this.baseUrl}${endpoint}`);\n\n // Add version tracking parameters\n this.addVersionParams(url);\n\n const response = await fetch(url.toString(), {\n method: \"DELETE\",\n headers: this.getHeaders(bearerToken),\n });\n\n const data = await response.json();\n\n if (!response.ok) {\n const errorData = validateErrorResponse(data);\n throw new ChipiApiError(\n errorData.message,\n errorData.code || `HTTP_${response.status}`,\n response.status,\n data\n );\n }\n\n return data as T;\n } catch (error) {\n throw handleApiError(error);\n }\n }\n}\n","import type {\n CreateWalletParams,\n CreateWalletResponse,\n PrepareWalletCreationResponse,\n CreateCustodialWalletParams,\n GetWalletParams,\n WalletData,\n GetWalletResponse,\n GetTokenBalanceParams,\n GetTokenBalanceResponse,\n WalletType,\n DeploymentData,\n UpdateWalletEncryptionParams,\n UpdateWalletEncryptionResponse,\n PrepareWalletUpgradeParams,\n PrepareWalletUpgradeResponse,\n ExecuteWalletUpgradeParams,\n ExecuteWalletUpgradeResponse,\n} from \"@chipi-stack/types\";\nimport {\n API_ENDPOINTS,\n SHHH_VERIFIER_CLASS_HASHES,\n WALLET_CLASS_HASHES,\n WALLET_RPC_ENDPOINTS,\n} from \"@chipi-stack/shared\";\nimport { ChipiClient } from \"./client\";\nimport CryptoES from \"crypto-es\";\n\nimport { ChipiTransactionError, ChipiApiError } from \"@chipi-stack/shared\";\nimport { computeShhhAddress } from \"./shhh/compute-wallet-address\";\nimport { ed25519PubkeyFelts } from \"./shhh/signers/ed25519\";\nimport { shortString } from \"starknet\";\nimport { randomBytes } from \"crypto\";\nimport {\n Account,\n CairoCustomEnum,\n CairoOption,\n CairoOptionVariant,\n CallData,\n ec,\n hash,\n num,\n RpcProvider,\n stark,\n} from \"starknet\";\nimport { encryptPrivateKey } from \"./encryption\";\nimport {\n migrateChipiWalletToShhh,\n type MigrateChipiWalletToShhhParams,\n type MigrationOutcome,\n} from \"./migrate-to-shhh\";\n\n// Local DeploymentData type (replacing @avnu/gasless-sdk dependency)\n/**\n * Wallet management utilities\n */\nexport class ChipiWallets {\n constructor(private client: ChipiClient) {}\n\n /**\n * Create a new wallet on Starknet (gasless, paymaster-sponsored).\n *\n * **PIN is weak — not recommended for production.** `encryptKey` here\n * doubles as the only thing decrypting the wallet's private key. A\n * user-typed PIN is short, low-entropy, and trivially compromised\n * by shoulder-surfing or phishing. Production embedded-wallet apps\n * should derive `encryptKey` from a platform passkey\n * (`@chipi-stack/chipi-passkey` `getWalletEncryptKey` for the legacy\n * PRF flow, or — preferred — `createShhhPasskey` for new SHHH\n * V8.4 wallets where the P-256 key never leaves the platform\n * authenticator at all). PIN remains only as a last-resort\n * recovery surface for users without WebAuthn / biometrics.\n */\n async createWallet(\n params: CreateWalletParams & { bearerToken: string }\n ): Promise<CreateWalletResponse> {\n try {\n const {\n encryptKey,\n externalUserId,\n bearerToken,\n userId,\n // P2.2 default flip (re-applied 2026-05-29 after #270 revert and\n // the post-revert SHHH bug-fix run #271–#296). New wallets\n // default to SHHH V8.4 instead of legacy CHIPI v29 — pluggable-\n // signer Starknet account, guardian recovery, threshold support\n // out of the box. Existing wallets unaffected; this only\n // changes the default for callers that omit `walletType`.\n // Callers who explicitly pass `walletType: \"CHIPI\"` or\n // `\"READY\"` continue producing those.\n //\n // Server-side override: chipi-back's CHIPI_SHHH_DEFAULT env\n // var (chipi-back#267) lets ops force the legacy default back\n // for callers that bypass the SDK and POST to /chipi-wallets\n // directly without walletType.\n //\n // signerKind under the SHHH branch defaults to \"STARK\" further\n // down — same kind the original #267 P2.2 used and the same\n // kind every mainnet smoke since 2026-05-26 has been signing\n // under.\n walletType = \"SHHH\",\n classHash: customClassHash,\n usePasskey,\n chain,\n } = params;\n\n if (!encryptKey) {\n if (usePasskey) {\n throw new Error(\n \"encryptKey is required when using passkey. The passkey authentication should have provided the encryptKey.\"\n );\n }\n throw new Error(\"encryptKey is required for wallet creation\");\n }\n\n // SHHH V8.4 wallets use a different address derivation\n // (computeShhhAddress) and a different constructor calldata\n // shape ([kind, verifier, pubkey_len, *pubkey, label]). They\n // also use the SHHH paymaster lane on the same Chipi RPC.\n //\n // Wave B (this PR) ships ED25519 on top of the STARK default.\n // EIP-191 / WEBAUTHN_P256 / JWT_ES256_APPLE_SUB still throw the\n // deferred-feature error until their respective follow-up PRs\n // wire the wallet-adapter pubkey input (browser / OAuth context\n // the backend SDK doesn't have).\n const isShhh = walletType === \"SHHH\";\n const effectiveSignerKind = isShhh ? (params.signerKind ?? \"STARK\") : undefined;\n const SDK_SHIPPED_SHHH_KINDS = [\n \"STARK\",\n \"ED25519\",\n \"WEBAUTHN_P256\",\n \"EIP191_SECP256K1\",\n ] as const;\n if (\n isShhh &&\n !SDK_SHIPPED_SHHH_KINDS.includes(\n effectiveSignerKind as (typeof SDK_SHIPPED_SHHH_KINDS)[number]\n )\n ) {\n throw new Error(\n `SHHH signerKind=${effectiveSignerKind} is not yet shipped from the SDK ` +\n `(supports STARK, ED25519, WEBAUTHN_P256, EIP191_SECP256K1). ` +\n `JWT_ES256_APPLE_SUB and others remain deferred to their ` +\n \"follow-up PRs (OAuth / Apple-Developer context).\"\n );\n }\n\n // Select RPC endpoint based on wallet type. SHHH uses the same\n // RPC pool as CHIPI today; if the V8.4 paymaster ever moves to\n // its own lane this becomes a third branch.\n const rpcUrl =\n walletType === \"READY\" ? WALLET_RPC_ENDPOINTS.READY : WALLET_RPC_ENDPOINTS.CHIPI;\n\n const provider = new RpcProvider({ nodeUrl: rpcUrl });\n\n // Generating the private key with Stark Curve. For SHHH STARK\n // this is exactly the same as CHIPI/READY: Chipi generates and\n // holds the STARK key, encrypts it with encryptKey, and the\n // user's passkey/PIN unwraps it at sign time.\n const privateKeyAX = this.getPrivateKeyAX();\n const starkKeyPubAX = ec.starkCurve.getStarkKey(privateKeyAX);\n\n let constructorCallData: string[];\n let accountClassHash: string;\n let publicKey: string;\n let deploymentSalt: string;\n // SHHH-only metadata sent through to chipi-back so the new\n // signerKind / ownerPublicKey columns get populated.\n let shhhOwnerPubkeyFelts: string[] | undefined;\n // For SHHH non-STARK kinds the Chipi-held key isn't the STARK\n // key. Default to STARK so CHIPI/READY/SHHH-STARK keep using\n // privateKeyAX (the existing behavior). ED25519 overrides this.\n // Empty string = external-rooted (no Chipi-held key to store).\n let shhhKeyForEncryption: string = privateKeyAX;\n\n if (isShhh) {\n // Resolve the pubkey felts + the Chipi-held private key (if any)\n // for the chosen signer kind. STARK and ED25519 both have\n // Chipi-held paths today; ED25519 also accepts caller-supplied\n // `ownerPubkeyFelts` (external-rooted, Phantom shape) which we\n // surface via the same code path.\n let pubkeyFelts: bigint[];\n let shhhPrivateKeyHex: string;\n if (effectiveSignerKind === \"STARK\") {\n // Chipi-held STARK: reuse the STARK key we already generated.\n pubkeyFelts = [BigInt(starkKeyPubAX)];\n shhhPrivateKeyHex = privateKeyAX;\n } else if (effectiveSignerKind === \"ED25519\") {\n if (params.ownerPubkeyFelts && params.ownerPubkeyFelts.length > 0) {\n // External-rooted ED25519 (Phantom). Caller supplies the\n // 2-felt [low, high] LE u128 split of the 32-byte pubkey.\n // Chipi does not hold a signing key in this branch — the\n // user signs OEs via their wallet adapter and the SDK just\n // wraps the signature in an envelope.\n if (params.ownerPubkeyFelts.length !== 2) {\n throw new Error(\n `SHHH ED25519 ownerPubkeyFelts must be [low_u128, high_u128] (2 felts); got ${params.ownerPubkeyFelts.length}.`\n );\n }\n pubkeyFelts = params.ownerPubkeyFelts.map((s) => BigInt(s));\n shhhPrivateKeyHex = \"\"; // No Chipi-held key for external-rooted.\n } else {\n // Chipi-held ED25519 (mirrors STARK pattern). Generate a\n // 32-byte random secret + derive the 32-byte public key\n // via @noble/ed25519. The private key is stored as hex\n // through the same encryption helper the STARK path uses.\n const edPrivKey: Uint8Array = randomBytes(32);\n const ed = await import(\"@noble/ed25519\");\n const edPubKey = await ed.getPublicKeyAsync(edPrivKey);\n pubkeyFelts = ed25519PubkeyFelts(edPubKey);\n shhhPrivateKeyHex = Buffer.from(edPrivKey).toString(\"hex\");\n }\n } else if (\n effectiveSignerKind === \"WEBAUTHN_P256\" ||\n effectiveSignerKind === \"EIP191_SECP256K1\"\n ) {\n // External-rooted ONLY: a passkey (P-256) / MetaMask\n // (secp256k1) holds the key — Chipi never does. The caller\n // supplies the 4-felt pubkey [x_low, x_high, y_low, y_high]\n // from `webauthnPubkeyFelts` / `eip191PubkeyFelts`. The user\n // signs OEs via their authenticator/wallet adapter; the SDK\n // wraps the assertion/signature in an envelope at sign time.\n if (!params.ownerPubkeyFelts || params.ownerPubkeyFelts.length !== 4) {\n throw new Error(\n `SHHH ${effectiveSignerKind} ownerPubkeyFelts must be ` +\n `[x_low, x_high, y_low, y_high] (4 felts); got ` +\n `${params.ownerPubkeyFelts?.length ?? 0}.`\n );\n }\n pubkeyFelts = params.ownerPubkeyFelts.map((s) => BigInt(s));\n shhhPrivateKeyHex = \"\"; // No Chipi-held key for external-rooted.\n } else {\n // Defense-in-depth: SDK_SHIPPED_SHHH_KINDS already filtered\n // upstream, but assert here so a future kind addition doesn't\n // silently land with no implementation.\n throw new Error(\n `SHHH signerKind=${effectiveSignerKind} reached the address-derivation block without an implementation.`\n );\n }\n\n shhhOwnerPubkeyFelts = pubkeyFelts.map((f) => \"0x\" + f.toString(16));\n\n // Stash the per-kind private key on a closure variable so the\n // encryption step below knows what to encrypt (replaces the\n // hardcoded `privateKeyAX` for non-STARK kinds).\n shhhKeyForEncryption = shhhPrivateKeyHex;\n\n const verifierClassHash = BigInt(\n SHHH_VERIFIER_CLASS_HASHES[effectiveSignerKind as keyof typeof SHHH_VERIFIER_CLASS_HASHES]\n );\n const shhhClassHash = customClassHash ?? WALLET_CLASS_HASHES.SHHH;\n\n // computeShhhAddress reproduces the on-chain constructor's\n // address derivation, including the kind-bound salt that\n // prevents the same raw pubkey from colliding across signer\n // kinds.\n const computedAddress = computeShhhAddress({\n classHash: BigInt(shhhClassHash),\n primaryKind: effectiveSignerKind as string,\n pubkey: pubkeyFelts,\n verifierClassHash,\n });\n publicKey = \"0x\" + computedAddress.toString(16);\n accountClassHash = shhhClassHash;\n\n // Constructor calldata shape: [kindTag, verifierClass,\n // pubkey_len, *pubkey, label]. Must match\n // computeShhhAddress's `ctor` shape byte-for-byte or the\n // deployment address mismatches.\n const labelFelt = BigInt(shortString.encodeShortString(\"primary\"));\n const kindTagFelt = BigInt(shortString.encodeShortString(effectiveSignerKind!));\n constructorCallData = [\n kindTagFelt.toString(),\n verifierClassHash.toString(),\n pubkeyFelts.length.toString(),\n ...pubkeyFelts.map((f) => f.toString()),\n labelFelt.toString(),\n ];\n\n // SHHH paymaster_deploy_and_invoke salt is poseidon(kind,\n // owner_commitment), not the raw pubkey. Recompute it the same\n // way computeShhhAddress did.\n const salt = (() => {\n const ownerCommit = BigInt(\n hash.computePoseidonHashOnElements([\n \"0x\" + kindTagFelt.toString(16),\n ...pubkeyFelts.map((f) => \"0x\" + f.toString(16)),\n ])\n );\n return BigInt(\n hash.computePoseidonHashOnElements([\n \"0x\" + kindTagFelt.toString(16),\n \"0x\" + ownerCommit.toString(16),\n ])\n );\n })();\n deploymentSalt = \"0x\" + salt.toString(16);\n } else {\n // CHIPI / READY path: unchanged from before this PR.\n constructorCallData = this.buildConstructorCallData(walletType, starkKeyPubAX);\n accountClassHash =\n customClassHash ??\n (walletType === \"READY\" ? WALLET_CLASS_HASHES.READY : WALLET_CLASS_HASHES.CHIPI);\n publicKey = hash.calculateContractAddressFromHash(\n starkKeyPubAX,\n accountClassHash,\n constructorCallData,\n 0\n );\n deploymentSalt = starkKeyPubAX;\n }\n\n // Initiating Account\n const account = new Account({ provider, address: publicKey, signer: privateKeyAX });\n\n const typedDataResponse = await this.client.post<PrepareWalletCreationResponse>({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}/prepare-creation`,\n bearerToken,\n body: {\n chain,\n publicKey,\n walletType,\n starkKeyPubAX,\n ...(customClassHash && { classHash: customClassHash }),\n // SHHH: tell chipi-back which signer kind + pubkey felts\n // produced this deployment so it can validate against the\n // expected SHHH constructor shape and populate the new\n // wallet row columns.\n ...(isShhh && {\n signerKind: effectiveSignerKind,\n ownerPubkeyFelts: shhhOwnerPubkeyFelts,\n }),\n },\n });\n\n const { typedData, accountClassHash: accountClassHashResponse } = typedDataResponse;\n\n // SHHH V8.4 wallets use the chipi-back pure-deploy path\n // (paymaster_executeTransaction with type:\"deploy\"). No signature\n // is required — the paymaster signs its own forwarder tx and\n // calls UDC.deployContract directly. We skip account.signMessage\n // entirely; the userSignature + typedData fields in the create\n // body are kept only for DTO-shape compatibility and are ignored\n // server-side for SHHH.\n //\n // Why not deploy_and_invoke for SHHH: the paymaster's typedData\n // domain shape doesn't agree with V8.4's SNIP-12 V2 OE hashing,\n // so the bundled inner OE's STARK verifier always rejects the\n // signature with \"SHHH: signature invalid\" — silently, because\n // the outer paymaster tx still reports SUCCEEDED (2026-05-27\n // production trace audit, deploy tx 0x672fd5f6...).\n //\n // CHIPI / READY paths unchanged: signMessage(typedData) →\n // {r, s, recovery} → server-side formatOwnerSignature.\n let userSignaturePayload: { r: string; s: string; recovery: number };\n if (isShhh) {\n // Dummy placeholder. chipi-back's createWallet branches on\n // walletType=SHHH and never reads this field; the DTO still\n // requires `userSignature` for shape parity.\n userSignaturePayload = {\n r: \"0x0\",\n s: \"0x0\",\n recovery: 0,\n };\n } else {\n const userSignature = await account.signMessage(typedData);\n userSignaturePayload = {\n r: (userSignature as any).r.toString(),\n s: (userSignature as any).s.toString(),\n recovery: (userSignature as any).recovery,\n };\n }\n\n const deploymentData: DeploymentData = {\n class_hash: accountClassHashResponse,\n salt: deploymentSalt,\n unique: `${num.toHex(0)}`,\n calldata: constructorCallData.map((value) => num.toHex(value)),\n };\n\n // External-rooted SHHH wallets (e.g. Phantom ED25519 via\n // ownerPubkeyFelts) have no Chipi-held key. We omit\n // `encryptedPrivateKey` from the request body entirely in that\n // case so chipi-back stores `null` (per its DTO contract). All\n // other paths encrypt the per-kind private key.\n const encryptedPrivateKey =\n shhhKeyForEncryption === \"\"\n ? undefined\n : encryptPrivateKey(shhhKeyForEncryption, encryptKey);\n\n // Dual-key wrapping: if encryptKeyBackup provided (PIN), encrypt a second copy\n const encryptedPrivateKeyBackup =\n params.encryptKeyBackup && shhhKeyForEncryption !== \"\"\n ? encryptPrivateKey(shhhKeyForEncryption, params.encryptKeyBackup)\n : undefined;\n\n // Call the API to save the wallet in dashboard\n const executeTransactionResponse = await this.client.post<CreateWalletResponse>({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}`,\n bearerToken,\n body: {\n externalUserId,\n userId,\n publicKey,\n walletType,\n chain,\n userSignature: userSignaturePayload,\n typedData,\n ...(encryptedPrivateKey !== undefined && { encryptedPrivateKey }),\n // SHHH: write the signer kind to the new wallet row.\n ...(isShhh && { signerKind: effectiveSignerKind }),\n // External-rooted SHHH (passkey / MetaMask / Phantom): no\n // Chipi-held key, so chipi-back needs the pubkey felts (address\n // derivation) + `ownerPublicKey` as the credential source it\n // stores (encryptedPrivateKey stays null). Canonical\n // ownerPublicKey = comma-joined felts. STARK / Chipi-held kinds\n // are untouched — encryptedPrivateKey is their credential source.\n ...(isShhh &&\n encryptedPrivateKey === undefined &&\n shhhOwnerPubkeyFelts && {\n ownerPubkeyFelts: shhhOwnerPubkeyFelts,\n ownerPublicKey: shhhOwnerPubkeyFelts.join(\",\"),\n }),\n ...(encryptedPrivateKeyBackup && { encryptedPrivateKeyBackup }),\n ...(params.authMethod && { authMethod: params.authMethod }),\n ...(params.credentialId && { credentialId: params.credentialId }),\n ...(params.prfSupported != null && { prfSupported: params.prfSupported }),\n ...(params.deviceType && { deviceType: params.deviceType }),\n deploymentData: {\n ...deploymentData,\n salt: `${deploymentData.salt}`,\n calldata: deploymentData.calldata.map((data) => `${data}`),\n },\n },\n });\n\n return executeTransactionResponse;\n } catch (error: unknown) {\n console.error(\"Detailed error:\", error);\n\n if (error instanceof Error && error.message.includes(\"SSL\")) {\n throw new Error(\n \"SSL connection error. Try using NODE_TLS_REJECT_UNAUTHORIZED=0 or verify the RPC URL\"\n );\n }\n throw new ChipiTransactionError(\n `Failed to create wallet: ${error instanceof Error ? error.message : \"Unknown error\"}`,\n \"WALLET_CREATION_FAILED\"\n );\n }\n }\n\n /**\n * Build constructor calldata based on wallet type\n * - CHIPI: Simple OpenZeppelin account with just public_key\n * - ARGENT: Argent X Account with owner/guardian structure\n */\n private buildConstructorCallData(walletType: WalletType, starkKeyPubAX: string): string[] {\n if (walletType === \"READY\") {\n // Argent X Account: owner (CairoCustomEnum) + guardian (CairoOption None)\n const axSigner = new CairoCustomEnum({\n Starknet: { pubkey: starkKeyPubAX },\n });\n const axGuardian = new CairoOption<unknown>(CairoOptionVariant.None);\n\n return CallData.compile({\n owner: axSigner,\n guardian: axGuardian,\n });\n }\n\n // ChipiWallet (default): Simple OpenZeppelin account with just public_key\n return CallData.compile({\n public_key: starkKeyPubAX,\n });\n }\n\n /**\n * Create a custodial merchant wallet\n */\n async createCustodialWallet({\n params,\n bearerToken,\n }: {\n params: Omit<CreateCustodialWalletParams, \"orgId\">;\n bearerToken: string;\n }): Promise<WalletData> {\n const response = await this.client.post<WalletData>({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}/custodial`,\n bearerToken,\n body: params,\n });\n\n return response!;\n }\n\n async getWallet(params: GetWalletParams, bearerToken: string): Promise<GetWalletResponse | null> {\n try {\n const { externalUserId } = params;\n const getWalletResponse = await this.client.get<GetWalletResponse>({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}/by-user`,\n params: { externalUserId },\n bearerToken,\n });\n\n return getWalletResponse;\n } catch (err) {\n // Check if it's a 404 error (wallet not found)\n if (err instanceof ChipiApiError && err.status === 404) {\n return null;\n }\n throw err;\n }\n }\n\n /**\n * Recover passkey credential metadata for a wallet.\n * Used when localStorage is cleared — SDK recovers credentialId from backend.\n */\n async getCredentialRecovery(\n params: { externalUserId: string },\n bearerToken: string\n ): Promise<{\n credentialId: string | null;\n authMethod: string | null;\n prfSupported: boolean | null;\n deviceType: string | null;\n }> {\n return this.client.get({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}/credential-recovery`,\n params: { externalUserId: params.externalUserId },\n bearerToken,\n });\n }\n\n async updateWalletEncryption(\n params: UpdateWalletEncryptionParams,\n bearerToken: string\n ): Promise<UpdateWalletEncryptionResponse> {\n const body: Record<string, string> = {\n externalUserId: params.externalUserId,\n newEncryptedPrivateKey: params.newEncryptedPrivateKey,\n };\n\n if (params.publicKey != null) {\n body.publicKey = params.publicKey;\n }\n\n return this.client.patch<UpdateWalletEncryptionResponse>({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}/update-encryption-details`,\n bearerToken,\n body,\n });\n }\n\n getPrivateKeyAX = () => {\n // Generate 32 random bytes (256 bits)\n // const privateKeyBytes = Crypto.getRandomBytes(32); old implementation\n const privateKeyBytes = CryptoES.lib.WordArray.random(32);\n // Convert to hex string and ensure it's 64 characters (32 bytes)\n const privateKey = privateKeyBytes.toString(CryptoES.enc.Hex);\n\n // Add '0x' prefix\n const fullPrivateKey = `0x${privateKey}`;\n\n // Ensure the private key is within Starknet's valid range (0 to 2^251 - 1)\n // Convert to BigInt and take modulo 2^251\n const maxStarknetValue = BigInt(\n \"0x800000000000000000000000000000000000000000000000000000000000000\"\n );\n const privateKeyBigInt = BigInt(fullPrivateKey) % maxStarknetValue;\n\n // Convert back to hex string with '0x' prefix\n return `0x${privateKeyBigInt.toString(16)}`;\n };\n\n async getTokenBalance({\n params,\n bearerToken,\n }: {\n params: GetTokenBalanceParams;\n bearerToken: string;\n }): Promise<GetTokenBalanceResponse> {\n const getBalanceResponse = await this.client.get<GetTokenBalanceResponse>({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}/token-balance`,\n params,\n bearerToken,\n });\n\n return getBalanceResponse;\n }\n\n /**\n * Prepare a wallet upgrade (e.g., READY → CHIPI or CHIPI v29 → v33).\n * Returns typed data that must be signed by the wallet owner.\n */\n async prepareWalletUpgrade(\n params: PrepareWalletUpgradeParams,\n bearerToken: string\n ): Promise<PrepareWalletUpgradeResponse> {\n return this.client.post<PrepareWalletUpgradeResponse>({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}/prepare-upgrade`,\n bearerToken,\n body: params,\n });\n }\n\n /**\n * Execute a wallet upgrade after the owner has signed the typed data.\n */\n async executeWalletUpgrade(\n params: ExecuteWalletUpgradeParams,\n bearerToken: string\n ): Promise<ExecuteWalletUpgradeResponse> {\n return this.client.post<ExecuteWalletUpgradeResponse>({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}/upgrade`,\n bearerToken,\n body: params,\n });\n }\n\n /**\n * Migrate a CHIPI v29 wallet to SHHH V8.4 in-place at the same\n * on-chain address. Composes the two-phase chipi-back endpoint:\n * prepare returns the path decision + parameters, then this method\n * builds the [upgrade, bootstrap_from_sessions] multicall locally,\n * signs the V8.4 OE with the wallet's STARK key (decrypted via\n * the user's encryptKey), and sends the signed calldata to the\n * execute endpoint. Server forwards verbatim to the paymaster.\n *\n * Returns `{kind: \"ALREADY_MIGRATED\"}` if the wallet is already\n * SHHH on chain (DB row gets patched server-side; no on-chain tx\n * fires); otherwise `{kind: \"MIGRATED\", transactionHash, ...}`.\n *\n * Throws on STRANDED-state recovery, UNDEPLOYED wallets, and\n * other deferred-feature paths with actionable error messages.\n *\n * Endpoints contract shipped in chipi-back task #28 (PR #272).\n */\n async migrateToShhh(\n params: Omit<MigrateChipiWalletToShhhParams, \"client\" | \"bearerToken\">,\n bearerToken: string\n ): Promise<MigrationOutcome> {\n return migrateChipiWalletToShhh({\n client: this.client,\n bearerToken,\n ...params,\n });\n }\n}\n","/**\n * SDK-side orchestrator for the CHIPI v29 → SHHH V8.4 migration flow.\n *\n * 1. POST /chipi-wallets/prepare-migrate-to-shhh\n * Returns the path decision (HAPPY / STRANDED / ALREADY_MIGRATED)\n * plus the parameters the SDK uses to build the [upgrade(SHHH),\n * bootstrap_from_sessions] multicall locally.\n *\n * 2. Build the multicall via `buildMigrationCalls`. Targets the\n * wallet itself (CHIPI v29 sessions account → V8.4 ShhhAccount).\n *\n * 3. Broadcast the multicall through the **existing CHIPI v29\n * transaction flow** (`executePaymasterTransaction` →\n * `/transactions/prepare-typed-data` → SDK signs `(r, s)` locally\n * → `/transactions/execute-sponsored` → paymaster relay). The\n * wallet is still CHIPI v29 at sign time, so the signature must\n * use CHIPI v29's `(r, s)` SNIP-12 format — not V8.4's V2_SNIP12\n * envelope.\n *\n * This is the historical bug fixed by this refactor. The\n * original orchestrator (PR #282) used V8.4's\n * `buildStarkEnvelope` + `serializeExecuteFromOutsideV2Calldata`\n * and sent a 5-felt envelope `[V2_SNIP12, KIND_TAG, len, r, s]`\n * to the wallet. CHIPI v29's\n * `sessions-smart-contract/src/account.cairo::execute_from_outside_v2`\n * read `sig[0:2]` as `(r, s)`, got bogus values, panicked with\n * `SRC9: invalid signature` (line 430). Because CHIPI v29's\n * `_execute_calls` swallows `Result::Err` at line 684, the outer\n * tx still SUCCEEDED but the upgrade(SHHH) call never ran. The\n * class hash stayed CHIPI v29. The wallet panic was confirmed by\n * reading the inner-call `result` field: ASCII-decoded to\n * literal `SRC9: invalid signature`. Reference receipt:\n * `0x0535ed9ca8628f1c82ee2005d84017e59a02436597df371d516b97c2c93a516a`\n * (staging wallet `0x1434aadce…`).\n *\n * 4. POST /chipi-wallets/execute-migrate-to-shhh with the tx hash.\n * chipi-back verifies the on-chain class hash flipped to SHHH\n * V8.4 and patches the DB row.\n *\n * Stranded-state recovery (STRANDED path) is NOT shipped here. The\n * SDK has the builders (`buildBootstrapSignedCall`,\n * `computeBootstrapMessage`, `signBootstrapMessage`) but the flow is\n * sufficiently different from HAPPY that surfacing it cleanly needs\n * its own UI affordance. Throws a clear deferred-feature error so\n * the calling dashboard can route to a stranded-recovery UI.\n */\n\nimport { ec } from \"starknet\";\n\nimport type { ChipiClient } from \"./client\";\nimport { decryptPrivateKey } from \"./encryption\";\nimport { executePaymasterTransaction } from \"./execute-paymaster-transaction\";\nimport { buildMigrationCalls } from \"./shhh/migrate\";\n\n/**\n * Response shape from chipi-back's `prepare-migrate-to-shhh`. Mirrors\n * the union the server returns; the SDK orchestrator switches on\n * `migrationPath` to decide what to do next.\n */\nexport type PrepareMigrateResponse =\n | {\n migrationPath: \"HAPPY\";\n walletAddress: string;\n onChainClassHash: string;\n shhhClassHash: string;\n shhhVerifierClassHash: string;\n label: string;\n auditLogId: string;\n }\n | {\n migrationPath: \"STRANDED\";\n walletAddress: string;\n onChainClassHash: string;\n shhhVerifierClassHash: string;\n label: string;\n auditLogId: string;\n }\n | {\n migrationPath: \"ALREADY_MIGRATED\";\n walletAddress: string;\n onChainClassHash: string;\n primaryKind: string;\n };\n\n/**\n * Response shape from chipi-back's `execute-migrate-to-shhh`.\n *\n * On terminal success, the server returns the patched wallet shape.\n * On PARTIAL failure (on-chain succeeded + DB patch failed) the\n * server still returns 200 with `partial: true` — the migration tx\n * landed but the calling dashboard should surface \"we'll catch up on\n * our end shortly\" until the reconciler cron (task #30) patches the\n * row.\n */\nexport interface ExecuteMigrateResponse {\n walletId: string;\n walletType: \"SHHH\";\n signerKind: \"STARK\";\n classHash: string;\n migratedFromClassHash: string;\n transactionHash: string;\n partial?: boolean;\n}\n\n/**\n * Final result returned by `migrateChipiWalletToShhh`. Either a\n * full migration completed end-to-end, OR an ALREADY_MIGRATED\n * short-circuit where the server patched the DB row but no on-chain\n * tx was needed. Both are terminal; both leave the wallet in SHHH\n * state for subsequent SDK operations.\n */\nexport type MigrationOutcome =\n | (ExecuteMigrateResponse & { kind: \"MIGRATED\" })\n | {\n kind: \"ALREADY_MIGRATED\";\n walletAddress: string;\n onChainClassHash: string;\n primaryKind: string;\n };\n\nexport interface MigrateChipiWalletToShhhParams {\n client: ChipiClient;\n bearerToken: string;\n /** Chipi-back wallet row id + the wallet's tenant scope. */\n walletId: string;\n externalUserId: string;\n /** Wallet shape the SDK passes through from its `wallets.getWallet` cache. */\n wallet: {\n publicKey: string;\n encryptedPrivateKey: string;\n };\n /** PIN or passkey-derived secret that decrypts `encryptedPrivateKey`. */\n encryptKey: string;\n /**\n * @deprecated The pre-refactor orchestrator (sdks #282) used this to\n * override the V8.4 SNIP-12 chain id. The new flow inherits chain\n * config from `executePaymasterTransaction`'s RPC endpoint\n * resolution, so this field is ignored. Kept for source-compat with\n * any v14.5.0-rc callers that may have copied the older signature\n * into their codebase before publish.\n */\n chainId?: bigint | string;\n}\n\nexport async function migrateChipiWalletToShhh(\n params: MigrateChipiWalletToShhhParams\n): Promise<MigrationOutcome> {\n const prepare = await params.client.post<PrepareMigrateResponse>({\n endpoint: \"/chipi-wallets/prepare-migrate-to-shhh\",\n bearerToken: params.bearerToken,\n body: {\n walletId: params.walletId,\n externalUserId: params.externalUserId,\n },\n });\n\n if (prepare.migrationPath === \"ALREADY_MIGRATED\") {\n return {\n kind: \"ALREADY_MIGRATED\",\n walletAddress: prepare.walletAddress,\n onChainClassHash: prepare.onChainClassHash,\n primaryKind: prepare.primaryKind,\n };\n }\n\n if (prepare.migrationPath === \"STRANDED\") {\n throw new Error(\n \"SHHH stranded-state recovery is not yet shipped in the SDK client. \" +\n \"The wallet is at V8.4 class hash but primary_kind == 0, which \" +\n \"means a prior migration completed `upgrade(SHHH)` but the \" +\n \"`bootstrap_from_sessions` call silently reverted. Recovery \" +\n \"requires `bootstrap_from_sessions_signed`; see \" +\n \"`buildBootstrapSignedCall` in @chipi-stack/backend/src/shhh/migrate.ts.\"\n );\n }\n\n // Defensive guard: if chipi-back ever folds UNDEPLOYED / DEFERRED /\n // WRONG_CLASS / RPC_ERROR into the 200 union (today they're HTTP\n // 4xx), the HAPPY-shaped field reads below would NaN/undefined\n // their way into a malformed multicall. Fail fast with a clear\n // \"upgrade your SDK\" message instead.\n if (prepare.migrationPath !== \"HAPPY\") {\n throw new Error(\n \"SHHH migration: unexpected migrationPath \" +\n JSON.stringify((prepare as { migrationPath: unknown }).migrationPath) +\n \" returned by chipi-back. This SDK build only handles HAPPY / \" +\n \"STRANDED / ALREADY_MIGRATED; upgrade @chipi-stack/backend to a \" +\n \"version that knows this path.\"\n );\n }\n\n // Derive the STARK pubkey from the decrypted private key — V8.4's\n // `bootstrap_from_sessions` call needs the pubkey as its first\n // argument so the contract can stamp the owner_commitment.\n //\n // Decryption happens here in the orchestrator AND a second time\n // inside executePaymasterTransaction. Both decryptions stay local\n // — the cleartext key never crosses the wire. The double-decrypt\n // is the cost of using `executePaymasterTransaction` as a black\n // box; a future refactor could expose a \"derive STARK pubkey from\n // wallet\" helper on ChipiWallets to avoid it.\n const privateKeyHex = decryptPrivateKey(params.wallet.encryptedPrivateKey, params.encryptKey);\n if (!privateKeyHex) {\n throw new Error(\n \"Failed to decrypt STARK private key for migration. Verify the \" +\n \"encryptKey matches the one used at wallet creation.\"\n );\n }\n const starkKeyPub = BigInt(ec.starkCurve.getStarkKey(privateKeyHex));\n\n const calls = buildMigrationCalls({\n legacyAccountAddress: params.wallet.publicKey,\n legacyPublicKey: starkKeyPub,\n shhhAccountClassHash: BigInt(prepare.shhhClassHash),\n starkVerifierClassHash: BigInt(prepare.shhhVerifierClassHash),\n label: prepare.label,\n });\n\n // Broadcast through the existing CHIPI v29 transaction flow. The\n // wallet is still CHIPI v29 at sign time, so the OE signature must\n // use CHIPI v29's `(r, s)` SNIP-12 format. executePaymasterTransaction\n // routes to `/transactions/prepare-typed-data` → SDK signs locally\n // → `/transactions/execute-sponsored` for CHIPI walletType, which\n // is exactly what the wallet's `execute_from_outside_v2` validates.\n const transactionHash = await executePaymasterTransaction({\n params: {\n encryptKey: params.encryptKey,\n wallet: {\n publicKey: params.wallet.publicKey,\n encryptedPrivateKey: params.wallet.encryptedPrivateKey,\n // Explicit walletType: the wallet IS still CHIPI v29 at sign\n // time. The upgrade(SHHH) inside the multicall changes the\n // class hash mid-tx; that's after signature verification.\n walletType: \"CHIPI\",\n },\n calls,\n // Persist the migration tx so it shows up in the user's tx\n // history. The on-chain receipt is the load-bearing artifact;\n // the DB row is convenience surfacing.\n saveToDatabase: true,\n },\n bearerToken: params.bearerToken,\n client: params.client,\n });\n\n // Notify chipi-back to verify on chain + patch the DB row. The\n // execute endpoint reads the live class hash and asserts it\n // flipped to SHHH V8.4 — if the migration tx silently reverted at\n // the wallet sub-call (the original bug), this surfaces a clear\n // BadRequestException rather than letting the DB drift.\n const execute = await params.client.post<ExecuteMigrateResponse>({\n endpoint: \"/chipi-wallets/execute-migrate-to-shhh\",\n bearerToken: params.bearerToken,\n body: {\n walletId: params.walletId,\n externalUserId: params.externalUserId,\n transactionHash,\n },\n });\n\n return { kind: \"MIGRATED\", ...execute };\n}\n","import type {\n ExecuteSponsoredTransactionResponse,\n WalletData,\n WalletType,\n SessionKeyData,\n PrepareTypedDataResponse,\n} from \"@chipi-stack/types\";\nimport type { Call } from \"starknet\";\nimport { Account, RpcProvider, TypedData, ec, typedData, num } from \"starknet\";\nimport { decryptPrivateKey } from \"./encryption\";\nimport {\n WALLET_CLASS_HASHES,\n WALLET_RPC_ENDPOINTS,\n SESSION_ERRORS,\n ChipiSessionError,\n getWalletTypeFromClassHash,\n withRpcFallback,\n} from \"@chipi-stack/shared\";\nimport { ChipiClient } from \"./client\";\nimport { normalizeSignature } from \"./paymaster-adapter\";\n\n// Extended WalletData with optional wallet type for transactions\n\n// Internal type - not exported to users\ninterface ExecutePaymasterTransactionParams {\n encryptKey?: string;\n wallet: WalletData;\n calls: Call[];\n saveToDatabase: boolean; // Internal only - always set by SDK, users cannot control this\n usePasskey?: boolean;\n}\n\n/**\n * Execute a paymaster transaction (gasless) via Chipi's paymaster\n * Supports both CHIPI and ARGENT wallet types\n */\nexport const executePaymasterTransaction = async ({\n params,\n bearerToken,\n client,\n}: {\n params: ExecutePaymasterTransactionParams;\n bearerToken: string;\n client: ChipiClient;\n}): Promise<string> => {\n try {\n const { encryptKey, wallet, calls, saveToDatabase, usePasskey } = params;\n\n // Validate encryptKey is provided\n if (!encryptKey) {\n throw new Error(\n usePasskey\n ? \"encryptKey is required when using passkey. The passkey authentication should have provided the encryptKey.\"\n : \"encryptKey is required for transaction execution\"\n );\n }\n\n // Resolve the wallet type. If the caller omitted `walletType`, do NOT\n // blindly default to \"READY\": a SHHH wallet routed down the CHIPI/READY\n // prepare-typed-data path gets estimated as a *direct sender*, which trips\n // the SHHH `__execute__` version guard ('C1: invalid tx version') and the\n // transfer fails. Resolve the type from the on-chain class hash so SHHH →\n // OE, CHIPI/READY → prepare-typed-data, regardless of what WalletData the\n // caller passed (integrators and our own export-key flows can drop this\n // field). Only costs one extra RPC read, and only when it's absent.\n let walletType: WalletType = wallet.walletType ?? \"READY\";\n if (!wallet.walletType) {\n try {\n // Idempotent read → safe to retry across the endpoint chain.\n const onChainClassHash = await withRpcFallback(\n (provider) => provider.getClassHashAt(wallet.publicKey, \"latest\"),\n { fallbackUrl: WALLET_RPC_ENDPOINTS.CHIPI }\n );\n walletType = getWalletTypeFromClassHash(onChainClassHash) ?? \"READY\";\n } catch {\n // Undeployed wallet or RPC error — keep the historical \"READY\" default.\n }\n }\n\n // SHHH V8.4 ShhhAccount wallets cannot use the legacy\n // prepare-typed-data → sign → execute-sponsored-transaction flow\n // because the Chipi paymaster cannot synthesize SHHH envelopes\n // server-side (each V8.4 signer kind has a different envelope\n // shape — see chipi-pay/paymaster#16). Route SHHH OEs through the\n // execute-sponsored-raw forwarder which expects pre-signed\n // calldata. The legacy flow below is unchanged for CHIPI/READY.\n if (walletType === \"SHHH\") {\n const { executeShhhSponsoredRaw } = await import(\"./shhh/execute-paymaster-raw\");\n // Auto-route to the right envelope builder. Default to STARK to\n // preserve pre-Wave-B behavior when the caller's WalletData was\n // populated from an older response (or from a non-SHHH row where\n // chipi-back returns null for signerKind).\n const shhhSignerKind = ((wallet.signerKind ?? \"STARK\") || \"STARK\") as \"STARK\" | \"ED25519\";\n return await executeShhhSponsoredRaw({\n client,\n bearerToken,\n wallet: {\n publicKey: wallet.publicKey,\n encryptedPrivateKey: wallet.encryptedPrivateKey,\n walletType: wallet.walletType,\n },\n encryptKey,\n calls,\n signerKind: shhhSignerKind,\n });\n }\n\n // For known types, use mapped RPC and class hash.\n // For custom types, fall back to default CHIPI RPC (all StarkNet accounts use the same RPC)\n // and use the wallet's classHash if available.\n const isKnownType =\n Object.prototype.hasOwnProperty.call(WALLET_RPC_ENDPOINTS, walletType) &&\n Object.prototype.hasOwnProperty.call(WALLET_CLASS_HASHES, walletType);\n\n const rpcUrl = isKnownType ? WALLET_RPC_ENDPOINTS[walletType] : WALLET_RPC_ENDPOINTS[\"CHIPI\"];\n const accountClassHash = isKnownType\n ? WALLET_CLASS_HASHES[walletType]\n : WALLET_CLASS_HASHES[\"CHIPI\"];\n\n // Decrypt the private key\n let privateKeyDecrypted: string;\n try {\n privateKeyDecrypted = decryptPrivateKey(wallet.encryptedPrivateKey, encryptKey);\n } catch {\n throw new Error(\"Failed to decrypt private key. Verify the encryptKey is correct.\");\n }\n\n const provider = new RpcProvider({ nodeUrl: rpcUrl });\n\n const account = new Account({\n provider,\n address: wallet.publicKey,\n signer: privateKeyDecrypted,\n });\n\n // Build the type data via Chipi's backend\n const prepareResponse = await client.post<PrepareTypedDataResponse>({\n endpoint: \"/transactions/prepare-typed-data\",\n bearerToken,\n body: {\n publicKey: wallet.publicKey,\n calls: calls,\n accountClassHash,\n },\n });\n\n // Validate response structure\n if (!prepareResponse || typeof prepareResponse !== \"object\") {\n throw new Error(\n \"Invalid response from /transactions/prepare-typed-data: response is not an object\"\n );\n }\n\n // Support both current and legacy API response shapes:\n // - Current: { typedData: TypedData, walletType: WalletType }\n // - Legacy: TypedData directly (domain/types/primaryType/message)\n let typedData: TypedData | undefined;\n let resolvedWalletType: WalletType | undefined;\n\n if (\"typedData\" in prepareResponse) {\n const resp = prepareResponse as PrepareTypedDataResponse;\n typedData = resp.typedData;\n // Only accept known wallet types from the backend\n if (\n resp.walletType &&\n Object.prototype.hasOwnProperty.call(WALLET_CLASS_HASHES, resp.walletType)\n ) {\n resolvedWalletType = resp.walletType;\n }\n } else if (prepareResponse && \"types\" in prepareResponse && \"message\" in prepareResponse) {\n // Legacy shape: the response itself is the TypedData\n typedData = prepareResponse as TypedData;\n } else {\n // Likely an API error shape like { message: string }\n const apiMessage =\n prepareResponse && typeof (prepareResponse as any).message === \"string\"\n ? (prepareResponse as any).message\n : undefined;\n\n throw new Error(\n apiMessage ??\n \"Invalid response from /transactions/prepare-typed-data: typedData is missing. \" +\n \"This may occur for older STARKNET wallets that don't support paymaster transactions. \" +\n \"Please ensure the wallet is a CHIPI wallet type.\"\n );\n }\n\n // Validate typedData structure before signing\n if (\n !typedData ||\n typeof typedData !== \"object\" ||\n !(\"types\" in typedData) ||\n !(\"message\" in typedData)\n ) {\n throw new Error(\n \"Invalid typedData received from backend: missing 'types' or 'message' field. \" +\n \"This may occur for older STARKNET wallets that don't support paymaster transactions.\"\n );\n }\n\n // Sign the message\n const userSignature = await account.signMessage(typedData);\n\n // Normalize signature format (handles both Weierstrass and Array types)\n const normalizedSig = normalizeSignature(userSignature);\n\n // Execute the sponsored transaction via Chipi's paymaster\n const result = await client.post<ExecuteSponsoredTransactionResponse>({\n endpoint: \"/transactions/execute-sponsored-transaction\",\n bearerToken,\n body: {\n publicKey: wallet.publicKey,\n typedData,\n userSignature: normalizedSig,\n saveToDatabase,\n walletType: resolvedWalletType ?? walletType,\n },\n });\n\n if (!result || typeof result !== \"object\") {\n throw new Error(\n \"Invalid response from /transactions/execute-sponsored-transaction: response is not an object\"\n );\n }\n\n const apiMessage =\n typeof (result as any).message === \"string\" ? (result as any).message : undefined;\n\n if (typeof result.transactionHash !== \"string\" || result.transactionHash.trim().length === 0) {\n throw new Error(apiMessage ?? \"Response does not contain transaction hash\");\n }\n\n return result.transactionHash;\n } catch (error) {\n console.error(\"Error sending transaction with paymaster\", error);\n throw error;\n }\n};\n\n// Internal type for session-based paymaster transactions\ninterface ExecutePaymasterTransactionWithSessionParams {\n encryptKey: string;\n wallet: WalletData;\n session: SessionKeyData;\n calls: Call[];\n saveToDatabase: boolean;\n}\n\n/**\n * Execute a paymaster transaction (gasless) using a session key.\n *\n * This function uses the 4-element session signature format:\n * [sessionPubKey, r, s, validUntil]\n *\n * The session key must be registered on the contract before use via\n * `addSessionKeyToContract()`.\n *\n * CHIPI wallets only - will throw if wallet type is not CHIPI.\n *\n * @internal\n */\nexport const executePaymasterTransactionWithSession = async ({\n params,\n bearerToken,\n client,\n}: {\n params: ExecutePaymasterTransactionWithSessionParams;\n bearerToken: string;\n client: ChipiClient;\n}): Promise<string> => {\n const { encryptKey, wallet, session, calls, saveToDatabase } = params;\n\n // Accept CHIPI v29 + SHHH V8.4 (both embed SNIP-163 sessions; the\n // 4-felt session sig fast path at account.cairo:389 runs the same\n // on either class).\n if (wallet.walletType !== \"CHIPI\" && wallet.walletType !== \"SHHH\") {\n console.error(\"[ChipiSDK:Session:Execute] Invalid wallet type for session execution\", {\n provided: wallet.walletType,\n required: \"CHIPI or SHHH\",\n walletAddress: wallet.publicKey?.slice(0, 15) + \"...\",\n hint: \"Session keys require a SNIP-163 sessions component (CHIPI v29 or SHHH V8.4).\",\n });\n throw new ChipiSessionError(\n `Session execution requires CHIPI or SHHH wallet type. Got: \"${wallet.walletType || \"undefined\"}\"`,\n SESSION_ERRORS.INVALID_WALLET_TYPE_FOR_SESSION\n );\n }\n\n // Check if session has expired\n const nowSeconds = Math.floor(Date.now() / 1000);\n if (session.validUntil < nowSeconds) {\n console.error(\"[ChipiSDK:Session:Execute] Session has expired\", {\n sessionExpiry: new Date(session.validUntil * 1000).toISOString(),\n currentTime: new Date(nowSeconds * 1000).toISOString(),\n expiredAgo: `${nowSeconds - session.validUntil} seconds`,\n });\n throw new ChipiSessionError(\n `Session expired at ${new Date(session.validUntil * 1000).toISOString()}. ` +\n `Create a new session key.`,\n SESSION_ERRORS.SESSION_EXPIRED\n );\n }\n\n try {\n // console.log(\"[ChipiSDK:Session:Execute] Starting session transaction\", {\n // walletAddress: wallet.publicKey.slice(0, 15) + \"...\",\n // sessionPubKey: session.publicKey.slice(0, 15) + \"...\",\n // sessionExpiry: new Date(session.validUntil * 1000).toISOString(),\n // callCount: calls.length,\n // });\n\n // Decrypt the session private key\n let sessionPrivateKey: string;\n try {\n sessionPrivateKey = decryptPrivateKey(session.encryptedPrivateKey, encryptKey);\n } catch {\n console.error(\"[ChipiSDK:Session:Execute] Failed to decrypt session private key\", {\n sessionPubKey: session.publicKey?.slice(0, 15) + \"...\",\n hint: \"Ensure the encryptKey matches the one used when creating the session\",\n });\n throw new ChipiSessionError(\n \"Failed to decrypt session private key. Verify the encryptKey is correct.\",\n SESSION_ERRORS.SESSION_DECRYPTION_FAILED\n );\n }\n\n // Verify the session private key matches the public key\n const derivedPubKey = ec.starkCurve.getStarkKey(sessionPrivateKey);\n if (derivedPubKey.toLowerCase() !== session.publicKey.toLowerCase()) {\n console.error(\"[ChipiSDK:Session:Execute] Session key mismatch\", {\n expected: session.publicKey.slice(0, 15) + \"...\",\n derived: derivedPubKey.slice(0, 15) + \"...\",\n hint: \"The encrypted private key does not match the stored public key\",\n });\n throw new ChipiSessionError(\n \"Session key mismatch: decrypted private key does not match the public key\",\n SESSION_ERRORS.SESSION_DECRYPTION_FAILED\n );\n }\n\n if (wallet.walletType === \"SHHH\") {\n // V8.4 session OE path. Bypass chipi-back's prepare-typed-data +\n // execute-sponsored-transaction (which are shaped for CHIPI v29\n // wallets — they hardcode the CHIPI typedData domain + the\n // `isSessionSignature` flag the CHIPI controller reads). Route\n // the session OE through `/transactions/execute-sponsored-raw`\n // with the 4-felt session sig as the signature span.\n //\n // V8.4's `execute_from_outside_v2` checks `signature.len() == 4`\n // at `account.cairo:389` BEFORE the V2_SNIP12 envelope dispatch,\n // so the session-sig path runs the same way as on CHIPI v29 —\n // session whitelist + spending-policy enforcement + signature\n // verification against the SESSION pubkey (NOT the primary\n // owner), all inside the SNIP-163 component.\n const { buildOutsideExecution, computeOeHash, ANY_CALLER_FELT } = await import(\"./shhh/oe\");\n const { resolveShhhChainId, serializeExecuteFromOutsideV2Calldata } = await import(\n \"./shhh/execute-paymaster-raw\"\n );\n\n const oe = buildOutsideExecution({\n nonce: (BigInt(Date.now()) << 24n) | BigInt(Math.floor(Math.random() * 0xffffff)),\n calls,\n caller: ANY_CALLER_FELT,\n });\n\n const chainId = resolveShhhChainId({ baseUrl: client.baseUrl });\n const messageHash = computeOeHash(oe, wallet.publicKey, chainId);\n\n // ec.starkCurve.sign expects a Hex string (0x-prefixed). The\n // V8.4 OE message hash from computeOeHash is a bigint; convert.\n const messageHashHex = \"0x\" + messageHash.toString(16);\n const { r, s } = ec.starkCurve.sign(messageHashHex, sessionPrivateKey);\n\n // 4-felt session signature span: [session_pubkey, r, s, valid_until].\n // The wallet reads sig[0] as session_pubkey, enforces the whitelist\n // + spending policy, and validates (r, s) against session_pubkey\n // via the SNIP-163 component (NOT the primary signer's verifier\n // class). See `sessions-smart-contract/src/account.cairo:387-433`\n // and `shhh-wallet-cairo/src/account.cairo:389-405`.\n const sessionSignature: bigint[] = [\n BigInt(session.publicKey),\n BigInt(r),\n BigInt(s),\n BigInt(session.validUntil),\n ];\n\n const calldata = serializeExecuteFromOutsideV2Calldata({\n outsideExecution: oe,\n signature: sessionSignature,\n });\n\n const response = await client.post<{\n transactionHash?: string;\n id?: string;\n }>({\n endpoint: \"/transactions/execute-sponsored-raw\",\n bearerToken,\n body: {\n accountAddress: wallet.publicKey,\n calldata,\n // Gas budget for the session-sig path is the same as STARK\n // primary (~2M l2_gas). The paymaster's kind-detection\n // branch reads signature[0] == 'V2_SNIP12' to look up the\n // per-kind gas overhead; signature[0] here is the\n // session_pubkey (not the V2_SNIP12 prefix), so the\n // detection falls through to the STARK default — which is\n // correct, since the session verifier is STARK ECDSA.\n signerKind: \"STARK\" as const,\n },\n });\n\n if (!response?.transactionHash) {\n throw new ChipiSessionError(\n \"execute-sponsored-raw response missing transactionHash. Check chipi-back logs for upstream paymaster errors.\",\n SESSION_ERRORS.SESSION_INVALID_RESPONSE\n );\n }\n return response.transactionHash;\n }\n\n // CHIPI v29 path (unchanged).\n const accountClassHash = WALLET_CLASS_HASHES.CHIPI;\n\n // Build the type data via Chipi's backend\n const prepareResponse = await client.post<PrepareTypedDataResponse>({\n endpoint: \"/transactions/prepare-typed-data\",\n bearerToken,\n body: {\n publicKey: wallet.publicKey,\n calls: calls,\n accountClassHash,\n walletType: \"CHIPI\",\n },\n });\n\n // Unwrap the response — backend returns { typedData, walletType } for CHIPI wallets\n if (!prepareResponse || typeof prepareResponse !== \"object\") {\n throw new ChipiSessionError(\n \"Invalid response from /transactions/prepare-typed-data: response is not an object\",\n SESSION_ERRORS.SESSION_INVALID_RESPONSE\n );\n }\n\n let sessionTypedData: TypedData;\n if (\"typedData\" in prepareResponse && (prepareResponse as PrepareTypedDataResponse).typedData) {\n const candidate = (prepareResponse as PrepareTypedDataResponse).typedData;\n if (\n !candidate ||\n typeof candidate !== \"object\" ||\n !(\"types\" in candidate) ||\n !(\"message\" in candidate)\n ) {\n throw new ChipiSessionError(\n \"Invalid response from /transactions/prepare-typed-data: typedData structure is invalid\",\n SESSION_ERRORS.SESSION_INVALID_RESPONSE\n );\n }\n sessionTypedData = candidate;\n } else if (\"types\" in prepareResponse && \"message\" in prepareResponse) {\n sessionTypedData = prepareResponse as unknown as TypedData;\n } else {\n throw new ChipiSessionError(\n \"Invalid response from /transactions/prepare-typed-data: typedData is missing\",\n SESSION_ERRORS.SESSION_INVALID_RESPONSE\n );\n }\n\n // Compute the message hash from typed data\n const msgHash = typedData.getMessageHash(sessionTypedData, wallet.publicKey);\n\n // Sign with session private key using ECDSA\n const { r, s } = ec.starkCurve.sign(msgHash, sessionPrivateKey);\n\n // Build 4-element session signature: [sessionPubKey, r, s, validUntil]\n const sessionSignature = [\n session.publicKey,\n num.toHex(r),\n num.toHex(s),\n num.toHex(session.validUntil),\n ];\n\n // Execute the sponsored transaction via Chipi's paymaster\n const result = await client.post<ExecuteSponsoredTransactionResponse>({\n endpoint: \"/transactions/execute-sponsored-transaction\",\n bearerToken,\n body: {\n publicKey: wallet.publicKey,\n typedData: sessionTypedData,\n // Session signature format - array of 4 hex strings\n userSignature: sessionSignature,\n saveToDatabase: saveToDatabase,\n walletType: \"CHIPI\",\n isSessionSignature: true, // Flag to indicate session signature format\n },\n });\n\n if (!result || typeof result !== \"object\") {\n throw new ChipiSessionError(\n \"Invalid response from /transactions/execute-sponsored-transaction: response is not an object\",\n SESSION_ERRORS.SESSION_INVALID_RESPONSE\n );\n }\n\n if (typeof result.transactionHash !== \"string\" || result.transactionHash.trim().length === 0) {\n const apiMessage =\n typeof (result as any).message === \"string\" ? (result as any).message : undefined;\n console.error(\"[ChipiSDK:Session:Execute] No transaction hash in response\", {\n result,\n });\n throw new ChipiSessionError(\n apiMessage ?? \"Response does not contain transaction hash\",\n SESSION_ERRORS.SESSION_INVALID_RESPONSE\n );\n }\n\n return result.transactionHash;\n } catch (error) {\n const err = error instanceof Error ? error : new Error(String(error));\n\n // Re-throw ChipiSessionError as-is\n if (error instanceof ChipiSessionError) {\n throw error;\n }\n\n console.error(\"[ChipiSDK:Session:Execute] Unexpected error\", {\n error: err.message,\n walletAddress: wallet.publicKey?.slice(0, 15) + \"...\",\n sessionPubKey: session.publicKey?.slice(0, 15) + \"...\",\n });\n throw error;\n }\n};\n","import type {\n PaymasterAdapter,\n PaymasterAccount,\n PrepareTypedDataResponse,\n ExecuteSponsoredTransactionResponse,\n WalletType,\n} from \"@chipi-stack/types\";\nimport type { Call, TypedData } from \"starknet\";\nimport { WALLET_CLASS_HASHES, getWalletTypeFromClassHash } from \"@chipi-stack/shared\";\nimport { ChipiClient } from \"./client\";\n\n/**\n * Unwrap the /prepare-typed-data response.\n * Supports both current shape ({ typedData, walletType }) and legacy (raw TypedData).\n */\nfunction unwrapPrepareResponse(response: unknown): {\n typedData: TypedData;\n walletType?: WalletType;\n} {\n if (!response || typeof response !== \"object\") {\n throw new Error(\n \"Invalid response from /transactions/prepare-typed-data: response is not an object\"\n );\n }\n\n // Current shape: { typedData: TypedData, walletType: WalletType }\n if (\"typedData\" in response) {\n const resp = response as PrepareTypedDataResponse;\n if (\n !resp.typedData ||\n typeof resp.typedData !== \"object\" ||\n !(\"types\" in resp.typedData) ||\n !(\"message\" in resp.typedData)\n ) {\n throw new Error(\n \"Invalid response from /transactions/prepare-typed-data: typedData structure is invalid\"\n );\n }\n return { typedData: resp.typedData, walletType: resp.walletType };\n }\n\n // Legacy shape: the response itself is the TypedData\n if (\"types\" in response && \"message\" in response) {\n return { typedData: response as TypedData };\n }\n\n // Possibly an API error shape\n const apiMessage =\n typeof (response as any).message === \"string\" ? (response as any).message : undefined;\n\n throw new Error(\n apiMessage ?? \"Invalid response from /transactions/prepare-typed-data: typedData is missing\"\n );\n}\n\n/**\n * Normalize signature to { r: string, s: string } format.\n * Handles WeierstrassSignatureType ({r, s} as bigint) and ArraySignatureType ([r, s]).\n */\nexport function normalizeSignature(signature: unknown): { r: string; s: string } {\n // ArraySignatureType: string[]\n if (Array.isArray(signature)) {\n if (signature.length < 2) {\n throw new Error(`Array signature must have at least 2 elements, got ${signature.length}`);\n }\n const r = signature[0];\n const s = signature[1];\n if (r == null || s == null) {\n throw new Error(`Signature elements must not be null/undefined. Got r=${r}, s=${s}`);\n }\n return { r: String(r), s: String(s) };\n }\n\n // WeierstrassSignatureType: { r: bigint, s: bigint }\n if (signature && typeof signature === \"object\" && \"r\" in signature && \"s\" in signature) {\n const sig = signature as { r: unknown; s: unknown; recovery?: unknown };\n if (sig.r == null || sig.s == null) {\n throw new Error(`Object signature has null/undefined fields. Got r=${sig.r}, s=${sig.s}`);\n }\n return {\n r: String(sig.r),\n s: String(sig.s),\n };\n }\n\n throw new Error(\"Unrecognized signature format from account.signMessage()\");\n}\n\n/**\n * PaymasterAdapter implementation that uses Chipi's backend API for gasless transactions.\n *\n * Flow:\n * 1. Detect wallet type from on-chain class hash\n * 2. Call /transactions/prepare-typed-data to get TypedData\n * 3. Call account.signMessage(typedData) — triggers wallet popup for external wallets\n * 4. Call /transactions/execute-sponsored-transaction with signature\n * 5. Return transaction hash\n */\nexport class ChipiPaymasterAdapter implements PaymasterAdapter {\n private readonly client: ChipiClient;\n private readonly bearerToken: string;\n\n constructor(client: ChipiClient, bearerToken: string) {\n this.client = client;\n this.bearerToken = bearerToken;\n }\n\n async execute({ account, calls }: { account: PaymasterAccount; calls: Call[] }): Promise<string> {\n // 1. Detect wallet type from on-chain class hash\n const classHash = await account.getClassHashAt(account.address);\n const walletType = getWalletTypeFromClassHash(classHash);\n\n // Use mapped class hash for known types, on-chain hash for custom accounts.\n // The Rust paymaster auto-detects the interface version (V1/V2) from the class,\n // so custom SNIP-9 accounts work without an allowlist.\n const accountClassHash = walletType ? WALLET_CLASS_HASHES[walletType] : classHash;\n\n // 2. Prepare typed data via Chipi's backend\n const prepareResponse = await this.client.post<PrepareTypedDataResponse>({\n endpoint: \"/transactions/prepare-typed-data\",\n bearerToken: this.bearerToken,\n body: {\n publicKey: account.address,\n calls,\n accountClassHash,\n },\n });\n\n // 3. Unwrap response\n const { typedData, walletType: resolvedWalletType } = unwrapPrepareResponse(prepareResponse);\n\n // 4. Sign — triggers wallet popup for Argent X / Braavos\n const signature = await account.signMessage(typedData);\n\n // 5. Normalize signature format\n const normalizedSig = normalizeSignature(signature);\n\n // 6. Execute sponsored transaction\n const result = await this.client.post<ExecuteSponsoredTransactionResponse>({\n endpoint: \"/transactions/execute-sponsored-transaction\",\n bearerToken: this.bearerToken,\n body: {\n publicKey: account.address,\n typedData,\n userSignature: normalizedSig,\n walletType: resolvedWalletType ?? walletType,\n saveToDatabase: true,\n },\n });\n\n if (!result || typeof result !== \"object\") {\n throw new Error(\n \"Invalid response from /transactions/execute-sponsored-transaction: response is not an object\"\n );\n }\n\n const apiMessage =\n typeof (result as any).message === \"string\" ? (result as any).message : undefined;\n\n if (!result.transactionHash) {\n throw new Error(apiMessage ?? \"Response does not contain transaction hash\");\n }\n\n return result.transactionHash;\n }\n}\n","/**\n * SHHH V8.4 migration builders — sessions / OZ → V8.4.\n *\n * Wave B PR B4. Covers two paths:\n *\n * 1. Happy-path atomic multicall (`buildMigrationCalls`)\n * Used when the legacy wallet is still operational and can sign\n * an OutsideExecution. The wallet emits one OE containing two\n * calls in order:\n *\n * upgrade(SHHH_ACCOUNT_CLASS_HASH)\n * bootstrap_from_sessions(public_key, STARK_VERIFIER_CLASS_HASH, label)\n *\n * Atomicity is the security property — between `upgrade` and\n * `bootstrap_from_sessions` an attacker watching the mempool\n * could call `bootstrap_from_sessions(attacker_pk, ...)` first\n * and seize the account. The OE bundles them so that race\n * window doesn't exist.\n *\n * 2. Stranded-state recovery (`buildBootstrapSignedCall` +\n * `computeBootstrapMessage` + `signBootstrapMessage`)\n * Used when the legacy multicall ran but `bootstrap_from_sessions`\n * silently reverted (the old chipi-pay/sessions-smart-contract's\n * `_execute_calls` swallowed subcall errors at a\n * `Result::Err(_) => res.append(array![].span())` site). The\n * account is at V8.4 class but `primary_kind == 0`.\n *\n * Recovery: anyone calls\n *\n * bootstrap_from_sessions_signed(\n * public_key, stark_verifier_class, label, signature_r, signature_s\n * )\n *\n * where (r, s) is a STARK ECDSA signature over\n *\n * bootstrap_msg = poseidon([\n * 'SHHH_BOOTSTRAP_V8_4',\n * account_address,\n * public_key,\n * stark_verifier_class,\n * label,\n * ])\n *\n * Authorization comes from two independent checks on-chain:\n * - the preserved `LEGACY_OZ_ACCOUNT_PUBKEY_SLOT` storage slot\n * must equal `public_key` (audit C-1 binding to the original\n * owner)\n * - the signature must verify under `public_key`\n *\n * So this entrypoint is callable from any sponsor / relayer\n * without a self-call channel, but is non-transferable: only the\n * original owner who controls the STARK private key can produce\n * a valid signature.\n *\n * Cairo source of truth:\n * shhh-wallet-cairo/src/account.cairo:1024 bootstrap_from_sessions\n * shhh-wallet-cairo/src/account.cairo:1113 bootstrap_from_sessions_signed\n * shhh-wallet-cairo/scripts/ts/migrate-sessions-wallet.ts (happy-path ref)\n *\n * What this module does NOT cover (out of scope for B4):\n * - The upstream OE-build + sign step. Caller wraps these `Call`s\n * with `buildOutsideExecution` + `buildStarkEnvelope` and submits\n * via the paymaster. Same flow as B1's governance builders.\n * - Verifying on-chain whether a wallet is stranded. Done by the\n * dashboard / UI; here we just produce the recovery call.\n */\n\nimport { ec, hash, shortString, type Call } from \"starknet\";\n\n// ================================================================\n// Constants — MUST match shhh-wallet-cairo/src/account.cairo exactly\n// ================================================================\n\n/**\n * Domain separator the on-chain signed-bootstrap message uses as its\n * first felt. Mirrors `'SHHH_BOOTSTRAP_V8_4'` literal at\n * `src/account.cairo:1170`.\n */\nexport const BOOTSTRAP_DOMAIN_SEPARATOR = BigInt(\n shortString.encodeShortString(\"SHHH_BOOTSTRAP_V8_4\")\n);\n\n/** Cairo Account-component `upgrade` entrypoint name (OpenZeppelin v3). */\nconst UPGRADE_ENTRYPOINT = \"upgrade\";\n\n/** `src/account.cairo:1026` */\nconst BOOTSTRAP_ENTRYPOINT = \"bootstrap_from_sessions\";\n\n/** `src/account.cairo:1114` */\nconst BOOTSTRAP_SIGNED_ENTRYPOINT = \"bootstrap_from_sessions_signed\";\n\n// ================================================================\n// Helpers\n// ================================================================\n\nfunction _asHex(x: string | bigint): string {\n return typeof x === \"bigint\" ? \"0x\" + x.toString(16) : x;\n}\n\nfunction _felt(x: bigint | string | number): bigint {\n if (typeof x === \"bigint\") return x;\n return BigInt(x);\n}\n\n/**\n * Encode a label string as a Starknet short-string felt252.\n *\n * starknet.js `shortString.encodeShortString` accepts only ASCII\n * characters and rejects strings longer than 31 characters (it\n * stuffs one character per byte, and felt252 has 251 useful bits).\n * We pre-validate here so callers get a clear error instead of the\n * generic encoder revert; the previous \"≤31 bytes\" message was\n * misleading because non-ASCII strings would silently slip past a\n * UTF-16 `.length` check.\n */\nexport function labelToFelt(label: string): bigint {\n if (label.length === 0) return 0n;\n // ASCII check via charCodeAt rather than `/^[\\x00-\\x7F]*$/` to keep\n // ESLint's `no-control-regex` happy. Equivalent semantics: every\n // UTF-16 code unit must fit in 7 bits.\n for (let i = 0; i < label.length; i++) {\n if (label.charCodeAt(i) > 0x7f) {\n throw new RangeError(\n `migrate label must be ASCII-only (starknet.js short-string encoder rejects non-ASCII)`\n );\n }\n }\n if (label.length > 31) {\n throw new RangeError(\n `migrate label must fit in felt252 short-string (≤31 ASCII characters); got ${label.length}`\n );\n }\n return BigInt(shortString.encodeShortString(label));\n}\n\n// ================================================================\n// Happy path: atomic multicall\n// ================================================================\n\nexport interface BuildMigrationCallsParams {\n /** Address of the legacy CHIPI v29 / sessions wallet being migrated. */\n legacyAccountAddress: bigint | string;\n /** STARK public key currently stored in the legacy wallet's OZ slot. */\n legacyPublicKey: bigint | string;\n /** Target SHHH ShhhAccount class hash (e.g. `WALLET_CLASS_HASHES.SHHH`). */\n shhhAccountClassHash: bigint | string;\n /** STARK verifier class hash (`SHHH_VERIFIER_CLASS_HASHES.STARK`). */\n starkVerifierClassHash: bigint | string;\n /** Optional user-facing tag bound into the V8.4 owner record (≤31 ASCII characters). */\n label?: string;\n}\n\n/**\n * Build the two-call atomic multicall that migrates a legacy\n * CHIPI v29 (chipi-pay/sessions-smart-contract) wallet to SHHH V8.4.\n *\n * Caller's responsibility:\n * 1. Wrap the returned `Call[]` in a single `OutsideExecution`\n * against the legacy wallet's address.\n * 2. Sign the OE with the legacy wallet's STARK key (the SDK's\n * legacy CHIPI flow already does this; use that signer here).\n * 3. Submit via the paymaster.\n *\n * The multicall MUST be atomic — if any call between the two could\n * land independently on chain (e.g. via mempool front-running), the\n * resulting `upgrade`-but-not-`bootstrap` state is exploitable.\n * Bundling them in a single OE makes both calls land atomically.\n *\n * Returns the calls in order: [upgrade, bootstrap_from_sessions].\n */\nexport function buildMigrationCalls(params: BuildMigrationCallsParams): Call[] {\n const upgradeCall: Call = {\n contractAddress: _asHex(params.legacyAccountAddress),\n entrypoint: UPGRADE_ENTRYPOINT,\n calldata: [_asHex(params.shhhAccountClassHash)],\n };\n\n const labelFelt = labelToFelt(params.label ?? \"migrated\");\n\n const bootstrapCall: Call = {\n contractAddress: _asHex(params.legacyAccountAddress),\n entrypoint: BOOTSTRAP_ENTRYPOINT,\n calldata: [\n _asHex(params.legacyPublicKey),\n _asHex(params.starkVerifierClassHash),\n \"0x\" + labelFelt.toString(16),\n ],\n };\n\n return [upgradeCall, bootstrapCall];\n}\n\n// ================================================================\n// Stranded-state recovery: signed bootstrap\n// ================================================================\n\nexport interface BootstrapMessageParams {\n /** The (already-upgraded) SHHH wallet's contract address. */\n accountAddress: bigint | string;\n /** STARK public key originally stored in the legacy OZ slot. */\n publicKey: bigint | string;\n /** STARK verifier class hash to set as primary. */\n starkVerifierClassHash: bigint | string;\n /** User-facing tag bound into the V8.4 owner record (≤31 ASCII characters). */\n label?: string;\n}\n\n/**\n * Compute the canonical bootstrap message the on-chain\n * `bootstrap_from_sessions_signed` verifier will check the STARK\n * ECDSA signature against:\n *\n * poseidon([\n * 'SHHH_BOOTSTRAP_V8_4',\n * account_address,\n * public_key,\n * stark_verifier_class,\n * label,\n * ])\n *\n * Domain separation via the literal prefix means a signature produced\n * for this message can never be replayed as a different intent\n * (audit point — covered in `audit_poc_attacker_can_seize_any_stranded_wallet`).\n */\nexport function computeBootstrapMessage(params: BootstrapMessageParams): bigint {\n const accountFelt = _felt(params.accountAddress);\n const pubkeyFelt = _felt(params.publicKey);\n const verifierFelt = _felt(params.starkVerifierClassHash);\n const labelFelt = labelToFelt(params.label ?? \"migrated\");\n\n return BigInt(\n hash.computePoseidonHashOnElements([\n \"0x\" + BOOTSTRAP_DOMAIN_SEPARATOR.toString(16),\n \"0x\" + accountFelt.toString(16),\n \"0x\" + pubkeyFelt.toString(16),\n \"0x\" + verifierFelt.toString(16),\n \"0x\" + labelFelt.toString(16),\n ])\n );\n}\n\n/**\n * Sign the canonical bootstrap message with a STARK private key.\n *\n * Used in two situations:\n * - Server-side test fixtures + the Wave B B9 mainnet smoke\n * - \"Recovery as a service\" flows where the SDK is allowed to hold\n * a temporary STARK key custodied for the user\n *\n * Most production flows will instead sign via the user's wallet\n * (e.g. by exposing the message hash to the legacy wallet's STARK\n * signing endpoint) and pass `(r, s)` directly to\n * `buildBootstrapSignedCall`.\n */\nexport function signBootstrapMessage(params: {\n privateKey: bigint | string;\n message: BootstrapMessageParams;\n}): { r: bigint; s: bigint } {\n const messageHash = computeBootstrapMessage(params.message);\n const pkHex = _asHex(_felt(params.privateKey));\n const sig = ec.starkCurve.sign(\"0x\" + messageHash.toString(16), pkHex);\n return {\n r: BigInt(\"0x\" + sig.r.toString(16)),\n s: BigInt(\"0x\" + sig.s.toString(16)),\n };\n}\n\nexport interface BuildBootstrapSignedCallParams {\n /** The stranded SHHH wallet's contract address. */\n accountAddress: bigint | string;\n /** STARK public key originally stored in the legacy OZ slot. */\n publicKey: bigint | string;\n /** STARK verifier class hash. Must match the value the original migration intended. */\n starkVerifierClassHash: bigint | string;\n /** User-facing tag (≤31 ASCII characters). Must match the original migration intent. */\n label?: string;\n /** STARK ECDSA signature r component over `computeBootstrapMessage(...)`. */\n signatureR: bigint | string;\n /** STARK ECDSA signature s component. */\n signatureS: bigint | string;\n}\n\n/**\n * Build a `bootstrap_from_sessions_signed(public_key, stark_verifier_class,\n * label, signature_r, signature_s)` call against a stranded SHHH wallet.\n *\n * Permissionless on-chain — anyone (typically a sponsor / relayer)\n * can dispatch this call. The signature is the auth. So the integrator\n * does NOT need to wrap it in an OE from the wallet itself; it goes\n * out as a regular invoke from any STARK account.\n *\n * Returns the `Call` for the integrator's account-abstraction layer\n * (e.g. a chipi-back service account, or a one-off operator wallet).\n */\nexport function buildBootstrapSignedCall(params: BuildBootstrapSignedCallParams): Call {\n const labelFelt = labelToFelt(params.label ?? \"migrated\");\n return {\n contractAddress: _asHex(params.accountAddress),\n entrypoint: BOOTSTRAP_SIGNED_ENTRYPOINT,\n calldata: [\n _asHex(params.publicKey),\n _asHex(params.starkVerifierClassHash),\n \"0x\" + labelFelt.toString(16),\n _asHex(params.signatureR),\n _asHex(params.signatureS),\n ],\n };\n}\n","import {\n CallAnyContractParams,\n STARKNET_CONTRACTS,\n WalletData,\n type ExecuteTransactionParams,\n type RecordSendTransactionParams,\n type Transaction,\n type TransferParams,\n type GetTransactionListQuery,\n type PaginatedResponse,\n type TransactionStatusResponse,\n type SyncOnChainTransfersParams,\n type SyncOnChainTransfersResponse,\n} from \"@chipi-stack/types\";\nimport { API_ENDPOINTS, formatAmount } from \"@chipi-stack/shared\";\nimport { ChipiClient } from \"./client\";\nimport { executePaymasterTransaction } from \"./execute-paymaster-transaction\";\n\n/**\n * Transaction management utilities\n */\nexport class ChipiTransactions {\n constructor(private client: ChipiClient) {}\n /**\n * Execute a gasless transaction using paymaster\n * @internal saveToDatabase - Internal only, not exposed to clients\n */\n async executeTransaction({\n params,\n bearerToken,\n saveToDatabase = true, // Internal only - defaults to true, can be overridden internally\n }: {\n params: ExecuteTransactionParams;\n bearerToken: string;\n saveToDatabase?: boolean; // Internal only - not part of public API\n }): Promise<string> {\n return executePaymasterTransaction({\n params: {\n ...params,\n saveToDatabase,\n },\n bearerToken,\n client: this.client,\n });\n }\n\n /**\n * Transfer tokens\n */\n async transfer({\n params,\n bearerToken,\n }: {\n params: TransferParams;\n bearerToken: string;\n }): Promise<string> {\n const { encryptKey, wallet, token, otherToken, recipient, amount } = params;\n const contract = STARKNET_CONTRACTS[token];\n let contractAddress = contract.contractAddress;\n let decimals = contract.decimals;\n if (token === \"OTHER\") {\n if (!otherToken) {\n throw new Error(\"Other token is required when token is OTHER\");\n }\n contractAddress = otherToken.contractAddress;\n decimals = otherToken.decimals;\n }\n const formattedAmount = formatAmount(amount, decimals);\n return this.executeTransaction({\n params: {\n encryptKey,\n wallet,\n calls: [\n {\n contractAddress,\n entrypoint: \"transfer\",\n calldata: [recipient, formattedAmount, \"0x0\"],\n },\n ],\n },\n bearerToken,\n });\n }\n\n /**\n * Approve token spending\n */\n async approve(params: {\n encryptKey: string;\n wallet: WalletData;\n contractAddress: string;\n spender: string;\n amount: string;\n decimals?: number;\n bearerToken: string;\n }): Promise<string> {\n const formattedAmount = formatAmount(params.amount, params.decimals);\n\n return this.executeTransaction({\n params: {\n encryptKey: params.encryptKey,\n wallet: params.wallet,\n calls: [\n {\n contractAddress: params.contractAddress,\n entrypoint: \"approve\",\n calldata: [params.spender, formattedAmount, \"0x0\"],\n },\n ],\n },\n bearerToken: params.bearerToken,\n });\n }\n\n /**\n * Call any contract method\n */\n // {\n // encryptKey: string;\n // wallet: any;\n // calls: any[];\n // bearerToken: string;\n // }\n\n async callAnyContract({\n params,\n bearerToken,\n }: {\n params: CallAnyContractParams;\n bearerToken: string;\n }): Promise<string> {\n return this.executeTransaction({\n params,\n bearerToken,\n });\n }\n\n /**\n * Record a send transaction\n */\n async recordSendTransaction({\n params,\n bearerToken,\n }: {\n params: RecordSendTransactionParams;\n bearerToken: string;\n }): Promise<Transaction> {\n const response = await this.client.post<Transaction>({\n endpoint: `${API_ENDPOINTS.TRANSACTIONS}/record-send`,\n bearerToken,\n body: params,\n });\n return response;\n }\n\n /**\n * Get paginated transaction history\n */\n async getTransactionList(\n query: GetTransactionListQuery,\n bearerToken: string\n ): Promise<PaginatedResponse<Transaction>> {\n const response = await this.client.get<PaginatedResponse<Transaction>>({\n endpoint: `${API_ENDPOINTS.TRANSACTIONS}/transaction-list`,\n params: query,\n bearerToken,\n });\n return response;\n }\n\n /**\n * Get a single transaction by hash or internal ID\n */\n async getTransaction(hashOrId: string, bearerToken: string): Promise<Transaction> {\n return this.client.get<Transaction>({\n endpoint: `${API_ENDPOINTS.TRANSACTIONS}/${hashOrId}`,\n bearerToken,\n });\n }\n\n /**\n * Get on-chain transaction status\n */\n async getTransactionStatus(\n hash: string,\n bearerToken: string\n ): Promise<TransactionStatusResponse> {\n return this.client.get<TransactionStatusResponse>({\n endpoint: `${API_ENDPOINTS.TRANSACTIONS}/${hash}/status`,\n bearerToken,\n });\n }\n\n /**\n * Sync on-chain transfers (Starknet Transfer events) into the DB (read-through cache).\n * Discovers transactions not made through the SDK (e.g., external USDC receives).\n * After sync, getTransactionList returns the newly discovered transactions.\n */\n async syncOnChainTransfers(\n params: SyncOnChainTransfersParams,\n bearerToken: string\n ): Promise<SyncOnChainTransfersResponse> {\n return this.client.post<SyncOnChainTransfersResponse>({\n endpoint: `${API_ENDPOINTS.TRANSACTIONS}/sync-on-chain`,\n bearerToken,\n body: params,\n });\n }\n}\n","import { Currency } from \"@chipi-stack/types\";\nimport { ChipiClient } from \"./client\";\nimport { API_ENDPOINTS } from \"@chipi-stack/shared\";\n\nexport class ChipiExchanges {\n constructor(private client: ChipiClient) {}\n\n async getUsdAmount(\n currencyAmount: number,\n currency: Currency,\n bearerToken: string\n ): Promise<number> {\n return this.client.get<number>({\n endpoint: `${API_ENDPOINTS.EXCHANGES}/usd-amount`,\n bearerToken,\n params: { currencyAmount, currency },\n });\n }\n}\n","import {\n CreateSkuPurchaseParams,\n Transaction,\n STARKNET_CONTRACTS,\n Chain,\n ChainToken,\n CreateSkuPurchaseBody,\n} from \"@chipi-stack/types\";\nimport { ChipiClient } from \"./client\";\nimport { ChipiTransactions } from \"./transactions\";\n\nimport {\n CARRIER_IDS,\n CHAIN_TOKEN_TYPES,\n CHAIN_TYPES,\n SERVICE_TYPES,\n SKU_CONTRACTS,\n formatAmount,\n} from \"@chipi-stack/shared\";\nimport { Call, CallData, cairo, hash } from \"starknet\";\nimport { API_ENDPOINTS } from \"@chipi-stack/shared\";\nimport CryptoES from \"crypto-es\";\nimport { ChipiExchanges } from \"./exchanges\";\n\nexport class ChipiSkuPurchases {\n private transactions: ChipiTransactions;\n private exchanges: ChipiExchanges;\n\n constructor(private client: ChipiClient) {\n this.transactions = new ChipiTransactions(client);\n this.exchanges = new ChipiExchanges(client);\n }\n\n /**\n * Purchase a SKU with gasless execution\n * @param params - Purchase parameters including transaction hash, SKU ID, wallet, etc.\n * @param bearerToken - Authentication token for API calls\n * @returns Promise<SkuPurchaseResponse> - The purchase response with transaction details\n */\n async purchaseSku(params: CreateSkuPurchaseParams, bearerToken: string): Promise<Transaction> {\n const { skuId, skuReference, currencyAmount, currency, chain, token, encryptKey, wallet } =\n params;\n\n if (chain !== Chain.STARKNET) {\n throw new Error(`Unsupported chain for SKU purchases: ${chain}`);\n }\n\n const tokenConfig = STARKNET_CONTRACTS[token];\n if (!tokenConfig?.contractAddress) {\n throw new Error(`Unsupported token for Starknet SKU purchases: ${token}`);\n }\n\n const usdAmount = await this.exchanges.getUsdAmount(currencyAmount, currency, bearerToken);\n const tokenAddress = tokenConfig.contractAddress as `0x${string}`;\n\n if (!Number.isFinite(usdAmount) || usdAmount <= 0) {\n throw new Error(`Invalid USD amount: ${usdAmount}. Amount must be positive.`);\n }\n\n const minUsdAmount = Math.max(usdAmount, 0.000001);\n const parsedAmount = formatAmount(minUsdAmount.toString(), tokenConfig.decimals);\n\n const calls: Call[] = [\n {\n contractAddress: tokenAddress,\n entrypoint: \"approve\",\n calldata: CallData.compile({\n spender: SKU_CONTRACTS.RECHARGER_WITH_STRK_MAINNET,\n amount: cairo.uint256(parsedAmount),\n }),\n },\n {\n contractAddress: SKU_CONTRACTS.RECHARGER_WITH_STRK_MAINNET,\n entrypoint: \"process_recharge\",\n calldata: CallData.compile({\n token: tokenAddress,\n amount: cairo.uint256(parsedAmount),\n recharge_id: CryptoES.SHA256(\n CryptoES.lib.WordArray.random(32) // 32 bytes = 256 bits entropy\n )\n .toString()\n .slice(0, 20),\n product_code: skuId,\n merchant_slug: CARRIER_IDS.CHIPI_PAY,\n }),\n },\n {\n contractAddress: SKU_CONTRACTS.CHIPI_BILL_SERVICE,\n entrypoint: \"mint_item\",\n calldata: CallData.compile({\n recipient: wallet.publicKey,\n metadata: {\n service_type: SERVICE_TYPES.BUY_SERVICE,\n timestamp: Date.now(),\n chipi_user_id: hash.starknetKeccak(wallet.publicKey || \"0x0\").toString(),\n kyc: true,\n amount: cairo.uint256(parsedAmount),\n },\n }),\n },\n ];\n\n const txHash = await this.transactions.executeTransaction({\n params: {\n encryptKey: encryptKey,\n wallet: wallet,\n calls: calls,\n },\n bearerToken: bearerToken,\n saveToDatabase: false,\n });\n\n const body: CreateSkuPurchaseBody = {\n transactionHash: txHash,\n walletAddress: wallet.publicKey,\n skuId: skuId,\n skuReference: skuReference,\n chain: chain,\n token: token,\n currencyAmount: currencyAmount,\n };\n\n // Record the SKU purchase and fetch the purchase result\n const response = await this.client.post<Transaction>({\n endpoint: `${API_ENDPOINTS.SKU_PURCHASES}`,\n bearerToken,\n body,\n });\n\n return response;\n }\n\n /**\n * Get a SKU purchase by id\n * @param id - The SKU purchase id\n * @param bearerToken - Authentication token for API calls\n * @returns Promise<SkuPurchaseResponse> - Single SKU purchase\n */\n async getSkuPurchase(id: string, bearerToken: string): Promise<Transaction> {\n const response = await this.client.get<Transaction>({\n endpoint: `${API_ENDPOINTS.SKU_PURCHASES}/${id}`,\n bearerToken,\n });\n return response;\n }\n}\n","import type { PaginatedResponse, Sku, GetSkuListQuery } from \"@chipi-stack/types\";\nimport { API_ENDPOINTS } from \"@chipi-stack/shared\";\nimport { ChipiClient } from \"./client\";\n\n/**\n * SKU (Stock Keeping Unit) management utilities\n */\nexport class ChipiSkus {\n constructor(private client: ChipiClient) {}\n /**\n * Get available SKUs for purchase with pagination\n * @param bearerToken - Authentication token for API calls\n * @param query - Pagination query parameters\n * @returns Promise<PaginatedResponse<Sku>> - Paginated list of available SKUs\n */\n async getSkuList(params: GetSkuListQuery, bearerToken: string): Promise<PaginatedResponse<Sku>> {\n const response = await this.client.get<PaginatedResponse<Sku>>({\n endpoint: `${API_ENDPOINTS.SKUS}`,\n params,\n bearerToken,\n });\n\n return response;\n }\n\n /**\n * Get a single SKU by ID\n * @param bearerToken - Authentication token for API calls\n * @param id - SKU ID\n * @returns Promise<Sku> - Single SKU\n */\n async getSku(id: string, bearerToken: string): Promise<Sku> {\n return this.client.get<Sku>({\n endpoint: `${API_ENDPOINTS.SKUS}/${id}`,\n bearerToken,\n });\n }\n}\n","import type {\n SessionKeyData,\n CreateSessionKeyParams,\n AddSessionKeyParams,\n RevokeSessionKeyParams,\n GetSessionDataParams,\n SessionDataResponse,\n WalletType,\n ExecuteWithSessionParams,\n SetSpendingPolicyParams,\n GetSpendingPolicyParams,\n RemoveSpendingPolicyParams,\n SpendingPolicyData,\n SetupSessionParams,\n} from \"@chipi-stack/types\";\nimport { ec, num } from \"starknet\";\nimport { encryptPrivateKey } from \"./encryption\";\nimport { ChipiClient } from \"./client\";\nimport {\n WALLET_CLASS_HASHES,\n WALLET_RPC_ENDPOINTS,\n SESSION_DEFAULTS,\n SESSION_ERRORS,\n SESSION_ENTRYPOINTS,\n ChipiSessionError,\n withRpcFallback,\n} from \"@chipi-stack/shared\";\nimport { decodeSessionData } from \"./session-codec\";\nimport {\n buildAddSessionKeyCall,\n buildRemoveSpendingPolicyCall,\n buildRevokeSessionKeyCall,\n buildSessionSetupCalls,\n buildSetSpendingPolicyCall,\n validateSpendingPolicyConfig,\n} from \"./session-calls\";\nimport {\n executePaymasterTransaction,\n executePaymasterTransactionWithSession,\n} from \"./execute-paymaster-transaction\";\n\n/**\n * Session key management for CHIPI wallets (SNIP-9 compatible).\n *\n * Session keys enable temporary, delegated access to execute transactions\n * without requiring the owner's private key for each operation.\n *\n * @see https://github.com/chipi-pay/sessions-smart-contract\n */\nexport class ChipiSessions {\n constructor(private client: ChipiClient) {}\n\n /**\n * Validate that the wallet supports SNIP-163 session keys.\n *\n * Both CHIPI v29 (sessions-smart-contract) and SHHH V8.4\n * (ShhhAccount) embed the same SNIP-163 SessionKeyComponent, so\n * `add_or_update_session_key` / `revoke_session_key` /\n * `get_session_data` selectors exist on both. The 4-felt session\n * signature shape (`[session_pubkey, r, s, valid_until]`) is the\n * same on both — V8.4's `execute_from_outside_v2` checks\n * `signature.len() == 4` at account.cairo:389 BEFORE the\n * V2_SNIP12 envelope dispatch, so sessions land through the\n * legacy fast path on V8.4 wallets too.\n *\n * READY (Argent X v0.4.0) does NOT implement SNIP-163; reject with\n * a clear error.\n */\n private validateWalletSupportsSessions(\n walletType: WalletType | undefined,\n operation: string,\n walletPublicKey?: string\n ): void {\n if (walletType !== \"CHIPI\" && walletType !== \"SHHH\") {\n console.error(`[ChipiSDK:Session:${operation}] Invalid wallet type`, {\n provided: walletType,\n required: \"CHIPI or SHHH\",\n walletAddress: walletPublicKey ? walletPublicKey.slice(0, 15) + \"...\" : \"(not provided)\",\n hint: \"Session keys require a SNIP-163 sessions component. CHIPI v29 + SHHH V8.4 both embed it; READY (Argent X) does not.\",\n });\n throw new ChipiSessionError(\n `Session keys require CHIPI or SHHH wallet type. Got: \"${walletType || \"undefined\"}\".`,\n SESSION_ERRORS.INVALID_WALLET_TYPE_FOR_SESSION\n );\n }\n }\n\n /**\n * Convert a Uint8Array to hex string with 0x prefix.\n */\n private toHex(uint8: Uint8Array): string {\n return (\n \"0x\" +\n Array.from(uint8)\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\")\n );\n }\n\n /**\n * Generate a new session keypair locally.\n *\n * This method generates the session keys but does NOT register them on-chain.\n * The returned SessionKeyData should be stored by the developer externally\n * (e.g., in Clerk metadata, database, etc.) - the SDK does NOT persist this.\n *\n * After generating, call `addSessionKeyToContract()` to register the session on-chain.\n *\n * **PIN is weak — not recommended for production.** `encryptKey` here\n * is the symmetric key the SDK uses to encrypt the session's private\n * key at rest. If you're passing a user-typed PIN, anyone who\n * observes that PIN can decrypt the session. Derive `encryptKey`\n * from a platform passkey (`@chipi-stack/chipi-passkey`) — for SHHH\n * V8.4 wallets prefer `createShhhPasskey` + `signShhhMessage`, where\n * the wallet's primary key never needs to be decrypted client-side\n * at all.\n *\n * @param params - Session creation parameters\n * @returns SessionKeyData for external storage\n *\n * @example\n * ```typescript\n * const session = sdk.sessions.createSessionKey({\n * encryptKey: userEncryptKey,\n * durationSeconds: 21600 // 6 hours\n * });\n * // Store session externally (e.g., in Clerk metadata)\n * await saveToClerk(session);\n * ```\n */\n createSessionKey(params: CreateSessionKeyParams): SessionKeyData {\n const { encryptKey, durationSeconds = SESSION_DEFAULTS.DURATION_SECONDS } = params;\n\n if (\n typeof durationSeconds !== \"number\" ||\n !Number.isFinite(durationSeconds) ||\n !Number.isInteger(durationSeconds) ||\n durationSeconds <= 0\n ) {\n throw new ChipiSessionError(\n `Invalid session duration: ${durationSeconds}. Must be a positive integer.`,\n SESSION_ERRORS.SESSION_CREATION_FAILED\n );\n }\n\n try {\n // Generate Stark curve private key\n const rawPrivateKey = ec.starkCurve.utils.randomPrivateKey();\n const privateKeyHex = this.toHex(rawPrivateKey);\n\n // Derive public key\n const publicKey = ec.starkCurve.getStarkKey(privateKeyHex);\n\n // Calculate expiration timestamp\n const validUntil = Math.floor(Date.now() / 1000) + durationSeconds;\n\n // Encrypt the private key for storage\n const encryptedPrivateKey = encryptPrivateKey(privateKeyHex, encryptKey);\n\n // console.log(\"[ChipiSDK:Session:Create] Session key generated\", {\n // publicKey: publicKey.slice(0, 15) + \"...\",\n // validUntil: new Date(validUntil * 1000).toISOString(),\n // durationSeconds,\n // });\n\n return {\n publicKey,\n encryptedPrivateKey,\n validUntil,\n };\n } catch (error) {\n const err = error instanceof Error ? error : new Error(String(error));\n console.error(\"[ChipiSDK:Session:Create] Failed to generate session key\", {\n error: err.message,\n durationRequested: durationSeconds,\n });\n throw new ChipiSessionError(\n `Failed to create session key: ${err.message}`,\n SESSION_ERRORS.SESSION_CREATION_FAILED\n );\n }\n }\n\n /**\n * Register a session key on the smart contract.\n *\n * This executes a sponsored transaction (using owner signature) to call\n * `add_or_update_session_key` on the CHIPI wallet contract.\n *\n * The session must be registered before it can be used for transactions.\n *\n * @param params - Session registration parameters\n * @param bearerToken - Authentication token\n * @returns Transaction hash\n *\n * @example\n * ```typescript\n * const txHash = await sdk.sessions.addSessionKeyToContract({\n * encryptKey: userEncryptKey,\n * wallet: userWallet,\n * sessionConfig: {\n * sessionPublicKey: session.publicKey,\n * validUntil: session.validUntil,\n * maxCalls: 1000,\n * allowedEntrypoints: [] // empty = all allowed\n * }\n * }, bearerToken);\n * ```\n */\n async addSessionKeyToContract(params: AddSessionKeyParams, bearerToken: string): Promise<string> {\n const { encryptKey, wallet, sessionConfig } = params;\n\n // Validate the wallet embeds SNIP-163 sessions (CHIPI v29 or SHHH V8.4).\n this.validateWalletSupportsSessions(wallet.walletType, \"AddToContract\", wallet.publicKey);\n\n try {\n console.log(\"[ChipiSDK:Session:AddToContract] Registering session on-chain\", {\n walletAddress: wallet.publicKey.slice(0, 15) + \"...\",\n sessionPubKey: sessionConfig.sessionPublicKey.slice(0, 15) + \"...\",\n validUntil: new Date(sessionConfig.validUntil * 1000).toISOString(),\n maxCalls: sessionConfig.maxCalls,\n allowedEntrypoints: sessionConfig.allowedEntrypoints.length,\n });\n\n // add_or_update_session_key(session_key, valid_until, max_calls, allowed_entrypoints).\n // Function names in the whitelist are converted to selectors.\n const addCall = buildAddSessionKeyCall(wallet.publicKey, sessionConfig);\n\n // Execute via paymaster (owner signature). Pass through the\n // actual walletType so executePaymasterTransaction routes to\n // the right OE path: CHIPI → typedData + (r, s), SHHH → V8.4\n // V2_SNIP12 envelope via executeShhhSponsoredRaw. Both wallets\n // expose the SNIP-163 selectors on the embedded sessions\n // component, so the inner call lands on either class.\n const txHash = await executePaymasterTransaction({\n params: {\n encryptKey,\n wallet,\n calls: [addCall],\n saveToDatabase: false, // Don't record session management txs\n },\n bearerToken,\n client: this.client,\n });\n\n console.log(\"[ChipiSDK:Session:AddToContract] Session registered successfully\", {\n txHash,\n sessionPubKey: sessionConfig.sessionPublicKey.slice(0, 15) + \"...\",\n });\n\n return txHash;\n } catch (error) {\n const err = error instanceof Error ? error : new Error(String(error));\n console.error(\"[ChipiSDK:Session:AddToContract] Registration failed\", {\n error: err.message,\n walletAddress: wallet.publicKey?.slice(0, 15) + \"...\",\n sessionPubKey: sessionConfig.sessionPublicKey?.slice(0, 15) + \"...\",\n validUntil: new Date(sessionConfig.validUntil * 1000).toISOString(),\n maxCalls: sessionConfig.maxCalls,\n });\n throw error;\n }\n }\n\n /**\n * Register a session and its spending policies in ONE owner-signed transaction.\n *\n * Equivalent to `addSessionKeyToContract` followed by one `setSpendingPolicy`\n * per token, but the owner signs once (one passkey prompt) and the session\n * never exists on-chain without its caps.\n *\n * @example\n * ```typescript\n * const txHash = await sdk.sessions.setupSession({\n * encryptKey,\n * wallet,\n * sessionConfig: {\n * sessionPublicKey: session.publicKey,\n * validUntil: session.validUntil,\n * maxCalls: 500,\n * allowedEntrypoints: [\"transfer\", \"approve\"],\n * },\n * spendingPolicies: [\n * { token: USDC, maxPerCall: 5_000_000n, maxPerWindow: 20_000_000n, windowSeconds: 86400 },\n * ],\n * }, bearerToken);\n * ```\n */\n async setupSession(params: SetupSessionParams, bearerToken: string): Promise<string> {\n const { encryptKey, wallet, sessionConfig, spendingPolicies = [] } = params;\n\n this.validateWalletSupportsSessions(wallet.walletType, \"Setup\", wallet.publicKey);\n\n // Builds (and validates) every call before anything is signed.\n const calls = buildSessionSetupCalls(wallet.publicKey, sessionConfig, spendingPolicies);\n\n console.log(\"[ChipiSDK:Session:Setup] Registering session with spending policies\", {\n walletAddress: wallet.publicKey.slice(0, 15) + \"...\",\n sessionPubKey: sessionConfig.sessionPublicKey.slice(0, 15) + \"...\",\n validUntil: new Date(sessionConfig.validUntil * 1000).toISOString(),\n maxCalls: sessionConfig.maxCalls,\n allowedEntrypoints: sessionConfig.allowedEntrypoints.length,\n spendingPolicies: spendingPolicies.length,\n });\n\n return executePaymasterTransaction({\n params: {\n encryptKey,\n wallet,\n calls,\n saveToDatabase: false, // Don't record session management txs\n },\n bearerToken,\n client: this.client,\n });\n }\n\n /**\n * Revoke a session key from the smart contract.\n *\n * This executes a sponsored transaction (using owner signature) to call\n * `revoke_session_key` on the CHIPI wallet contract.\n *\n * After revocation, the session key can no longer be used for transactions.\n *\n * @param params - Session revocation parameters\n * @param bearerToken - Authentication token\n * @returns Transaction hash\n *\n * @example\n * ```typescript\n * const txHash = await sdk.sessions.revokeSessionKey({\n * encryptKey: userEncryptKey,\n * wallet: userWallet,\n * sessionPublicKey: session.publicKey\n * }, bearerToken);\n * ```\n */\n async revokeSessionKey(params: RevokeSessionKeyParams, bearerToken: string): Promise<string> {\n const { encryptKey, wallet, sessionPublicKey } = params;\n\n // Validate CHIPI wallet\n this.validateWalletSupportsSessions(wallet.walletType, \"Revoke\", wallet.publicKey);\n\n try {\n console.log(\"[ChipiSDK:Session:Revoke] Revoking session from contract\", {\n walletAddress: wallet.publicKey.slice(0, 15) + \"...\",\n sessionToRevoke: sessionPublicKey.slice(0, 15) + \"...\",\n });\n\n // Execute via paymaster (owner signature). Pass through the\n // actual walletType so executePaymasterTransaction routes to\n // the right OE path: CHIPI → typedData + (r, s), SHHH → V8.4\n // V2_SNIP12 envelope via executeShhhSponsoredRaw. Both wallets\n // expose the SNIP-163 selectors on the embedded sessions\n // component, so the inner call lands on either class.\n const txHash = await executePaymasterTransaction({\n params: {\n encryptKey,\n wallet,\n calls: [buildRevokeSessionKeyCall(wallet.publicKey, sessionPublicKey)],\n saveToDatabase: false, // Don't record session management txs\n },\n bearerToken,\n client: this.client,\n });\n\n console.log(\"[ChipiSDK:Session:Revoke] Session revoked successfully\", {\n txHash,\n sessionRevoked: sessionPublicKey.slice(0, 15) + \"...\",\n });\n\n return txHash;\n } catch (error) {\n const err = error instanceof Error ? error : new Error(String(error));\n console.error(\"[ChipiSDK:Session:Revoke] Revocation failed\", {\n error: err.message,\n walletAddress: wallet.publicKey?.slice(0, 15) + \"...\",\n sessionToRevoke: sessionPublicKey?.slice(0, 15) + \"...\",\n });\n throw error;\n }\n }\n\n /**\n * Query session data from the smart contract.\n *\n * This is a read-only call that does not require signing or gas.\n *\n * @param params - Query parameters\n * @returns Session data including status, remaining calls, and allowed entrypoints\n *\n * @example\n * ```typescript\n * const sessionData = await sdk.sessions.getSessionData({\n * walletAddress: userWallet.publicKey,\n * sessionPublicKey: session.publicKey\n * });\n * if (sessionData.isActive) {\n * console.log(`Session has ${sessionData.remainingCalls} calls remaining`);\n * }\n * ```\n *\n * NOTE: This method intentionally does NOT validate walletType because:\n * 1. It's a read-only query - no state change or risk\n * 2. Non-CHIPI wallets will simply return isActive=false (graceful failure)\n * 3. It doesn't require walletType parameter at all - only walletAddress\n * Adding validation would require changing the interface for no functional benefit.\n */\n async getSessionData(params: GetSessionDataParams): Promise<SessionDataResponse> {\n const { walletAddress, sessionPublicKey } = params;\n\n try {\n console.log(\"[ChipiSDK:Session:GetData] Querying session data\", {\n walletAddress: walletAddress.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey.slice(0, 15) + \"...\",\n });\n\n // Read-only contract call → safe to retry across the endpoint chain.\n const result = await withRpcFallback(\n (provider) =>\n provider.callContract({\n contractAddress: walletAddress,\n entrypoint: SESSION_ENTRYPOINTS.GET_DATA,\n calldata: [sessionPublicKey],\n }),\n { fallbackUrl: WALLET_RPC_ENDPOINTS[\"CHIPI\"] }\n );\n\n // `get_session_data` returns the stored `SessionData` struct, identical on\n // CHIPI v29, v33 and SHHH V8.4:\n // [valid_until: u64, max_calls: u32, calls_used: u32, allowed_entrypoints_len: u32]\n const resultArray = Array.isArray(result)\n ? result\n : (result as { result?: string[] }).result || [];\n\n if (resultArray.length < 4) {\n console.warn(\"[ChipiSDK:Session:GetData] Unexpected response format\", {\n resultLength: resultArray.length,\n result: resultArray,\n });\n return {\n isActive: false,\n validUntil: 0,\n remainingCalls: 0,\n allowedEntrypoints: [],\n };\n }\n\n const { isActive, validUntil, remainingCalls, allowedEntrypoints } = decodeSessionData(\n resultArray,\n Math.floor(Date.now() / 1000)\n );\n\n const sessionData: SessionDataResponse = {\n isActive,\n validUntil,\n remainingCalls,\n allowedEntrypoints,\n };\n\n console.log(\"[ChipiSDK:Session:GetData] Session data retrieved\", {\n isActive,\n validUntil: new Date(validUntil * 1000).toISOString(),\n remainingCalls,\n // The struct carries the whitelist length, not the selectors.\n allowedEntrypointsLen: Number(BigInt(resultArray[3])),\n });\n\n return sessionData;\n } catch (error) {\n const err = error instanceof Error ? error : new Error(String(error));\n\n // Contract revert or empty result = session doesn't exist (expected)\n const sessionNotFoundPatterns = [\n /entry point.*not found/i,\n /requested entrypoint was not found/i,\n /invalid message selector/i,\n /contract not found/i,\n /is not deployed/i,\n /revert.*get_session_data/i,\n ];\n const isSessionNotFound = sessionNotFoundPatterns.some((p) => p.test(err.message));\n\n if (isSessionNotFound) {\n console.log(\"[ChipiSDK:Session:GetData] Session not found on contract\", {\n walletAddress: walletAddress?.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey?.slice(0, 15) + \"...\",\n });\n return {\n isActive: false,\n validUntil: 0,\n remainingCalls: 0,\n allowedEntrypoints: [],\n };\n }\n\n // Infrastructure errors should propagate\n console.error(\"[ChipiSDK:Session:GetData] RPC/network error\", {\n error: err.message,\n walletAddress: walletAddress?.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey?.slice(0, 15) + \"...\",\n });\n throw err;\n }\n }\n\n /**\n * Execute a gasless transaction using a session key.\n *\n * This uses the 4-element session signature format instead of owner signature.\n * The session must be:\n * 1. Generated via `createSessionKey()`\n * 2. Registered on-chain via `addSessionKeyToContract()`\n *\n * CHIPI v29 and SHHH V8.4 only: both embed the SNIP-163 sessions\n * component. Throws for any other wallet type, notably READY (Argent X),\n * which does not. See `validateWalletSupportsSessions`.\n *\n * @param params - Session execution parameters\n * @param bearerToken - Authentication token\n * @returns Transaction hash\n *\n * @example\n * ```typescript\n * // 1. Create session key (store externally)\n * const session = sdk.sessions.createSessionKey({ encryptKey });\n *\n * // 2. Register on contract (one-time)\n * await sdk.sessions.addSessionKeyToContract({\n * encryptKey,\n * wallet,\n * sessionConfig: {\n * sessionPublicKey: session.publicKey,\n * validUntil: session.validUntil,\n * maxCalls: 1000,\n * allowedEntrypoints: []\n * }\n * }, bearerToken);\n *\n * // 3. Execute transactions with session (no owner key needed)\n * const txHash = await sdk.sessions.executeTransactionWithSession({\n * encryptKey,\n * wallet,\n * session,\n * calls\n * }, bearerToken);\n * ```\n */\n async executeTransactionWithSession(\n params: ExecuteWithSessionParams,\n bearerToken: string\n ): Promise<string> {\n const { encryptKey, wallet, session, calls } = params;\n\n // Accept CHIPI v29 + SHHH V8.4 (both embed the SNIP-163 sessions\n // component; D9 Phase 1 sdks#287). Reject everything else with a\n // clear error. Mirrors the validator the inner\n // executePaymasterTransactionWithSession applies — kept here as\n // well so callers using `sdk.sessions.executeTransactionWithSession`\n // directly fail fast before the inner function runs.\n if (wallet.walletType && wallet.walletType !== \"CHIPI\" && wallet.walletType !== \"SHHH\") {\n throw new ChipiSessionError(\n `Session execution requires CHIPI or SHHH wallet type. Got: ${wallet.walletType}`,\n SESSION_ERRORS.INVALID_WALLET_TYPE_FOR_SESSION\n );\n }\n\n // Pass the wallet through verbatim so the SHHH path picks up its\n // walletType (the inner function routes on it). undefined defaults\n // to CHIPI inside the inner function for backward compat.\n return executePaymasterTransactionWithSession({\n params: {\n encryptKey,\n wallet: { ...wallet, walletType: wallet.walletType ?? \"CHIPI\" },\n session,\n calls,\n saveToDatabase: true,\n },\n bearerToken,\n client: this.client,\n });\n }\n\n // --- Spending Policy Methods ---\n // Wraps ISessionSpendingPolicy contract interface.\n // Spending policies enforce per-token limits on ERC-20 operations\n // (transfer, approve, increase_allowance) executed by session keys.\n\n /**\n * Reconstruct a bigint from Cairo u256 (low, high) hex strings.\n */\n private joinU256(low: string, high: string): bigint {\n return BigInt(low) + (BigInt(high) << 128n);\n }\n\n /**\n * Set a spending policy for a session key + token pair.\n *\n * This executes a sponsored transaction (using owner signature) to call\n * `set_spending_policy` on the wallet contract (CHIPI v29 or SHHH V8.4).\n *\n * The contract enforces these limits automatically during `__execute__()` on\n * ERC-20 operations (transfer, approve, increase_allowance) made by the session.\n *\n * @param params - Spending policy parameters\n * @param bearerToken - Authentication token\n * @returns Transaction hash\n *\n * @example\n * ```typescript\n * // Set a spending limit: max 1 USDC per call, 50 USDC per day\n * const txHash = await sdk.sessions.setSpendingPolicy({\n * encryptKey: userEncryptKey,\n * wallet: userWallet,\n * spendingPolicyConfig: {\n * sessionPublicKey: session.publicKey,\n * token: USDC_ADDRESS,\n * maxPerCall: 1_000_000n, // 1 USDC (6 decimals)\n * maxPerWindow: 50_000_000n, // 50 USDC\n * windowSeconds: 86400, // 24 hours\n * }\n * }, bearerToken);\n * ```\n */\n async setSpendingPolicy(params: SetSpendingPolicyParams, bearerToken: string): Promise<string> {\n const { encryptKey, wallet, spendingPolicyConfig } = params;\n const { sessionPublicKey, token, maxPerCall, maxPerWindow, windowSeconds } =\n spendingPolicyConfig;\n\n // Validate wallet type if provided (backward compat: omitted = assume CHIPI).\n // CHIPI v29 + SHHH V8.4 both embed the same SNIP-163 SessionKeyComponent, so\n // set_spending_policy lands on either class; READY (Argent X) does not.\n if (wallet.walletType && wallet.walletType !== \"CHIPI\" && wallet.walletType !== \"SHHH\") {\n throw new ChipiSessionError(\n `Spending policies require CHIPI or SHHH wallet type. Got: ${wallet.walletType}`,\n SESSION_ERRORS.INVALID_WALLET_TYPE_FOR_SESSION\n );\n }\n\n // Validate against the contract's interpretation (same errors as before).\n validateSpendingPolicyConfig(spendingPolicyConfig);\n\n try {\n console.log(\"[ChipiSDK:Session:SetSpendingPolicy] Setting spending policy\", {\n walletAddress: wallet.publicKey.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey.slice(0, 15) + \"...\",\n token: token.slice(0, 15) + \"...\",\n maxPerCall: maxPerCall.toString(),\n maxPerWindow: maxPerWindow.toString(),\n windowSeconds,\n });\n\n // set_spending_policy(session_key, token, max_per_call: u256, max_per_window: u256, window_seconds: u64)\n const setPolicyCall = buildSetSpendingPolicyCall(wallet.publicKey, spendingPolicyConfig);\n\n // Execute via paymaster (owner signature). Pass `wallet` verbatim so\n // executePaymasterTransaction routes on walletType — CHIPI → typedData,\n // SHHH → V8.4 V2_SNIP12 owner envelope (executeShhhSponsoredRaw) — and so\n // an OMITTED walletType reaches its on-chain class-hash resolution. Do NOT\n // coerce undefined → \"CHIPI\" here: that bypasses the resolution and\n // mis-routes an omitted-walletType SHHH wallet into the CHIPI path (the\n // #356 'C1: invalid tx version' failure). set_spending_policy is\n // owner-self-gated and lives on the same SNIP-163 component on both classes.\n const txHash = await executePaymasterTransaction({\n params: {\n encryptKey,\n wallet,\n calls: [setPolicyCall],\n saveToDatabase: false,\n },\n bearerToken,\n client: this.client,\n });\n\n console.log(\"[ChipiSDK:Session:SetSpendingPolicy] Spending policy set successfully\", {\n txHash,\n sessionPubKey: sessionPublicKey.slice(0, 15) + \"...\",\n token: token.slice(0, 15) + \"...\",\n });\n\n return txHash;\n } catch (error) {\n const err = error instanceof Error ? error : new Error(String(error));\n console.error(\"[ChipiSDK:Session:SetSpendingPolicy] Failed to set spending policy\", {\n error: err.message,\n walletAddress: wallet.publicKey?.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey?.slice(0, 15) + \"...\",\n token: token?.slice(0, 15) + \"...\",\n });\n throw error;\n }\n }\n\n /**\n * Query a spending policy from the smart contract.\n *\n * This is a read-only call that does not require signing or gas.\n * Returns zeroed data if no policy is set (meaning no enforcement).\n *\n * @param params - Query parameters\n * @returns Spending policy data including limits and current window state\n *\n * @example\n * ```typescript\n * const policy = await sdk.sessions.getSpendingPolicy({\n * walletAddress: userWallet.publicKey,\n * sessionPublicKey: session.publicKey,\n * token: USDC_ADDRESS,\n * });\n * if (policy.maxPerWindow > 0n) {\n * console.log(`Spent ${policy.spentInWindow} of ${policy.maxPerWindow} this window`);\n * }\n * ```\n */\n async getSpendingPolicy(params: GetSpendingPolicyParams): Promise<SpendingPolicyData> {\n const { walletAddress, sessionPublicKey, token } = params;\n\n try {\n console.log(\"[ChipiSDK:Session:GetSpendingPolicy] Querying spending policy\", {\n walletAddress: walletAddress.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey.slice(0, 15) + \"...\",\n token: token.slice(0, 15) + \"...\",\n });\n\n // Read-only contract call → safe to retry across the endpoint chain.\n const result = await withRpcFallback(\n (provider) =>\n provider.callContract({\n contractAddress: walletAddress,\n entrypoint: SESSION_ENTRYPOINTS.GET_SPENDING_POLICY,\n calldata: [sessionPublicKey, token],\n }),\n { fallbackUrl: WALLET_RPC_ENDPOINTS[\"CHIPI\"] }\n );\n\n // Parse response: [max_per_call_low, max_per_call_high, max_per_window_low, max_per_window_high,\n // window_seconds, spent_in_window_low, spent_in_window_high, window_start]\n const resultArray = Array.isArray(result)\n ? result\n : (result as { result?: string[] }).result || [];\n\n if (resultArray.length < 8) {\n console.warn(\"[ChipiSDK:Session:GetSpendingPolicy] Unexpected response format\", {\n resultLength: resultArray.length,\n result: resultArray,\n });\n return {\n maxPerCall: 0n,\n maxPerWindow: 0n,\n windowSeconds: 0,\n spentInWindow: 0n,\n windowStart: 0,\n };\n }\n\n const policyData: SpendingPolicyData = {\n maxPerCall: this.joinU256(resultArray[0], resultArray[1]),\n maxPerWindow: this.joinU256(resultArray[2], resultArray[3]),\n windowSeconds: Number(BigInt(resultArray[4])),\n spentInWindow: this.joinU256(resultArray[5], resultArray[6]),\n windowStart: Number(BigInt(resultArray[7])),\n };\n\n console.log(\"[ChipiSDK:Session:GetSpendingPolicy] Spending policy retrieved\", {\n maxPerCall: policyData.maxPerCall.toString(),\n maxPerWindow: policyData.maxPerWindow.toString(),\n windowSeconds: policyData.windowSeconds,\n spentInWindow: policyData.spentInWindow.toString(),\n windowStart: policyData.windowStart,\n });\n\n return policyData;\n } catch (error) {\n const err = error instanceof Error ? error : new Error(String(error));\n\n // Contract revert or entry not found = no policy set (expected)\n const notFoundPatterns = [\n /entry point.*not found/i,\n /requested entrypoint was not found/i,\n /invalid message selector/i,\n /contract not found/i,\n /is not deployed/i,\n ];\n const isNotFound = notFoundPatterns.some((p) => p.test(err.message));\n\n if (isNotFound) {\n console.log(\n \"[ChipiSDK:Session:GetSpendingPolicy] No policy found (contract or entrypoint missing)\",\n {\n walletAddress: walletAddress?.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey?.slice(0, 15) + \"...\",\n token: token?.slice(0, 15) + \"...\",\n }\n );\n return {\n maxPerCall: 0n,\n maxPerWindow: 0n,\n windowSeconds: 0,\n spentInWindow: 0n,\n windowStart: 0,\n };\n }\n\n console.error(\"[ChipiSDK:Session:GetSpendingPolicy] RPC/network error\", {\n error: err.message,\n walletAddress: walletAddress?.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey?.slice(0, 15) + \"...\",\n token: token?.slice(0, 15) + \"...\",\n });\n throw err;\n }\n }\n\n /**\n * Remove a spending policy for a session key + token pair.\n *\n * This executes a sponsored transaction (using owner signature) to call\n * `remove_spending_policy` on the wallet contract (CHIPI v29 or SHHH V8.4).\n *\n * After removal, the session key has no spending limits for this token.\n *\n * @param params - Policy removal parameters\n * @param bearerToken - Authentication token\n * @returns Transaction hash\n *\n * @example\n * ```typescript\n * const txHash = await sdk.sessions.removeSpendingPolicy({\n * encryptKey: userEncryptKey,\n * wallet: userWallet,\n * sessionPublicKey: session.publicKey,\n * token: USDC_ADDRESS,\n * }, bearerToken);\n * ```\n */\n async removeSpendingPolicy(\n params: RemoveSpendingPolicyParams,\n bearerToken: string\n ): Promise<string> {\n const { encryptKey, wallet, sessionPublicKey, token } = params;\n\n // Validate wallet type if provided (backward compat: omitted = assume CHIPI).\n // CHIPI v29 + SHHH V8.4 both embed the same SNIP-163 SessionKeyComponent, so\n // remove_spending_policy lands on either class; READY (Argent X) does not.\n if (wallet.walletType && wallet.walletType !== \"CHIPI\" && wallet.walletType !== \"SHHH\") {\n throw new ChipiSessionError(\n `Spending policies require CHIPI or SHHH wallet type. Got: ${wallet.walletType}`,\n SESSION_ERRORS.INVALID_WALLET_TYPE_FOR_SESSION\n );\n }\n\n if (!token || token.trim().length === 0) {\n throw new ChipiSessionError(\n `Invalid token address for spending policy removal: \"${token}\"`,\n SESSION_ERRORS.INVALID_SPENDING_POLICY\n );\n }\n\n try {\n console.log(\"[ChipiSDK:Session:RemoveSpendingPolicy] Removing spending policy\", {\n walletAddress: wallet.publicKey.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey.slice(0, 15) + \"...\",\n token: token.slice(0, 15) + \"...\",\n });\n\n // remove_spending_policy(session_key, token)\n const removeCall = buildRemoveSpendingPolicyCall(wallet.publicKey, sessionPublicKey, token);\n\n // Execute via paymaster (owner signature). Pass `wallet` verbatim so\n // executePaymasterTransaction routes on walletType — CHIPI → typedData,\n // SHHH → V8.4 V2_SNIP12 owner envelope (executeShhhSponsoredRaw) — and so\n // an OMITTED walletType reaches its on-chain class-hash resolution. Do NOT\n // coerce undefined → \"CHIPI\" here: that bypasses the resolution and\n // mis-routes an omitted-walletType SHHH wallet into the CHIPI path (the\n // #356 'C1: invalid tx version' failure). remove_spending_policy is\n // owner-self-gated and lives on the same SNIP-163 component on both classes.\n const txHash = await executePaymasterTransaction({\n params: {\n encryptKey,\n wallet,\n calls: [removeCall],\n saveToDatabase: false,\n },\n bearerToken,\n client: this.client,\n });\n\n console.log(\"[ChipiSDK:Session:RemoveSpendingPolicy] Spending policy removed successfully\", {\n txHash,\n sessionPubKey: sessionPublicKey.slice(0, 15) + \"...\",\n token: token.slice(0, 15) + \"...\",\n });\n\n return txHash;\n } catch (error) {\n const err = error instanceof Error ? error : new Error(String(error));\n console.error(\"[ChipiSDK:Session:RemoveSpendingPolicy] Failed to remove spending policy\", {\n error: err.message,\n walletAddress: wallet.publicKey?.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey?.slice(0, 15) + \"...\",\n token: token?.slice(0, 15) + \"...\",\n });\n throw error;\n }\n }\n}\n","import { hash, num } from \"starknet\";\nimport { ChipiSessionError, SESSION_ERRORS } from \"@chipi-stack/shared\";\n\n/** Starknet field prime. A selector is a felt, so it must be below it. */\nconst FIELD_PRIME = 2n ** 251n + 17n * 2n ** 192n + 1n;\n\nconst HEX_FELT = /^0x[0-9a-fA-F]{1,64}$/;\nconst DECIMAL_FELT = /^\\d+$/;\nconst CAIRO_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;\n\n/**\n * Normalize a session whitelist to the hex selectors the contract compares against.\n *\n * `add_or_update_session_key` stores raw felts and the account matches them\n * against `call.selector`, so every entry must be a selector. Names were\n * previously forwarded unchanged: on CHIPI the paymaster encoded `\"transfer\"`\n * as a short string (registration succeeded, every session call then failed the\n * whitelist); on SHHH `BigInt(\"transfer\")` threw while serialising calldata.\n *\n * - `0x…` hex and decimal felts pass through (as hex).\n * - Cairo identifiers (`\"transfer\"`, `\"multi_route_swap\"`) become their selector.\n * - Anything else throws `SESSION_ENTRYPOINT_NOT_ALLOWED`.\n */\nexport function normalizeEntrypoints(entrypoints: readonly string[]): string[] {\n return entrypoints.map((entry) => {\n const value = String(entry).trim();\n\n if (HEX_FELT.test(value) || DECIMAL_FELT.test(value)) {\n const felt = BigInt(value);\n if (felt >= FIELD_PRIME) {\n throw new ChipiSessionError(\n `Session entrypoint ${value} is not a valid felt (>= field prime).`,\n SESSION_ERRORS.SESSION_ENTRYPOINT_NOT_ALLOWED\n );\n }\n return num.toHex(felt);\n }\n\n if (CAIRO_IDENTIFIER.test(value)) {\n return hash.getSelectorFromName(value);\n }\n\n throw new ChipiSessionError(\n `Session entrypoint \"${value}\" is neither a selector (0x…) nor a function name.`,\n SESSION_ERRORS.SESSION_ENTRYPOINT_NOT_ALLOWED\n );\n });\n}\n\nexport interface DecodedSessionData {\n isActive: boolean;\n validUntil: number;\n remainingCalls: number;\n allowedEntrypoints: string[];\n}\n\n/**\n * Decode `get_session_data`, which returns the stored `SessionData` struct.\n * The layout is identical on CHIPI v29, v33 and SHHH V8.4:\n *\n * [valid_until: u64, max_calls: u32, calls_used: u32, allowed_entrypoints_len: u32]\n *\n * A revoked or never-registered key reads back as all zeros. `isActive`\n * mirrors the contract's own check: registered, not expired, calls left.\n * The struct carries the whitelist length only, so `allowedEntrypoints` is\n * always empty here (see `SessionDataResponse`).\n */\nexport function decodeSessionData(\n result: readonly string[],\n nowSeconds: number\n): DecodedSessionData {\n const validUntil = Number(BigInt(result[0]));\n const maxCalls = Number(BigInt(result[1]));\n const callsUsed = Number(BigInt(result[2]));\n\n const remainingCalls = Math.max(maxCalls - callsUsed, 0);\n const isActive = validUntil !== 0 && nowSeconds <= validUntil && remainingCalls > 0;\n\n return { isActive, validUntil, remainingCalls, allowedEntrypoints: [] };\n}\n","import { num } from \"starknet\";\nimport type { Call, SessionConfig, SpendingPolicyConfig } from \"@chipi-stack/types\";\nimport { ChipiSessionError, SESSION_ERRORS, SESSION_ENTRYPOINTS } from \"@chipi-stack/shared\";\nimport { normalizeEntrypoints } from \"./session-codec\";\n\n/**\n * Pure builders for the owner-signed session management calls.\n *\n * Every call targets the wallet itself (`add_or_update_session_key`,\n * `set_spending_policy`, ...), which the contract only accepts from the\n * owner. Sign and submit them with any owner path: `sdk.sessions.*`,\n * `executeTransaction`, `useCallAnyContract`, or your own signer. Building\n * them separately lets you batch a session and its spending policies into\n * one transaction (one passkey prompt).\n */\n\nconst U128_MASK = (1n << 128n) - 1n;\nconst U256_MAX = (1n << 256n) - 1n;\nconst U64_MAX = (1n << 64n) - 1n;\n\nfunction splitU256(value: bigint): [string, string] {\n return [num.toHex(value & U128_MASK), num.toHex(value >> 128n)];\n}\n\n/** `add_or_update_session_key(session_key, valid_until, max_calls, allowed_entrypoints)` */\nexport function buildAddSessionKeyCall(walletAddress: string, sessionConfig: SessionConfig): Call {\n const allowedEntrypoints = normalizeEntrypoints(sessionConfig.allowedEntrypoints);\n return {\n contractAddress: walletAddress,\n entrypoint: SESSION_ENTRYPOINTS.ADD_OR_UPDATE,\n calldata: [\n sessionConfig.sessionPublicKey,\n num.toHex(sessionConfig.validUntil),\n num.toHex(sessionConfig.maxCalls),\n num.toHex(allowedEntrypoints.length),\n ...allowedEntrypoints,\n ],\n };\n}\n\n/** `revoke_session_key(session_key)` */\nexport function buildRevokeSessionKeyCall(walletAddress: string, sessionPublicKey: string): Call {\n return {\n contractAddress: walletAddress,\n entrypoint: SESSION_ENTRYPOINTS.REVOKE,\n calldata: [sessionPublicKey],\n };\n}\n\n/**\n * Validate a spending policy the way the contract interprets it.\n * Throws `INVALID_SPENDING_POLICY`.\n */\nexport function validateSpendingPolicyConfig(config: SpendingPolicyConfig): void {\n const { token, maxPerCall, maxPerWindow, windowSeconds } = config;\n\n if (!token || token.trim().length === 0) {\n throw new ChipiSessionError(\n `Invalid token address for spending policy: \"${token}\"`,\n SESSION_ERRORS.INVALID_SPENDING_POLICY\n );\n }\n if (\n typeof windowSeconds !== \"number\" ||\n !Number.isFinite(windowSeconds) ||\n !Number.isInteger(windowSeconds) ||\n windowSeconds <= 0 ||\n BigInt(windowSeconds) > U64_MAX\n ) {\n throw new ChipiSessionError(\n `Invalid window duration: ${windowSeconds}. Must be a positive integer within u64 range.`,\n SESSION_ERRORS.INVALID_SPENDING_POLICY\n );\n }\n if (maxPerCall < 0n || maxPerCall > U256_MAX) {\n throw new ChipiSessionError(\n `Invalid maxPerCall: must be >= 0 and <= 2^256 - 1`,\n SESSION_ERRORS.INVALID_SPENDING_POLICY\n );\n }\n if (maxPerWindow < 0n || maxPerWindow > U256_MAX) {\n throw new ChipiSessionError(\n `Invalid maxPerWindow: must be >= 0 and <= 2^256 - 1`,\n SESSION_ERRORS.INVALID_SPENDING_POLICY\n );\n }\n if (maxPerWindow > 0n && maxPerCall > maxPerWindow) {\n throw new ChipiSessionError(\n `Invalid spending policy: maxPerCall (${maxPerCall}) cannot exceed maxPerWindow (${maxPerWindow})`,\n SESSION_ERRORS.INVALID_SPENDING_POLICY\n );\n }\n}\n\n/**\n * `set_spending_policy(session_key, token, max_per_call: u256, max_per_window: u256, window_seconds: u64)`\n *\n * Contract semantics worth knowing: `maxPerWindow = 0` disables the policy\n * (unlimited), `maxPerCall = 0` with a window blocks every metered spend, and\n * only `transfer` / `approve` / `increase_allowance` are metered.\n */\nexport function buildSetSpendingPolicyCall(\n walletAddress: string,\n config: SpendingPolicyConfig\n): Call {\n validateSpendingPolicyConfig(config);\n const [maxPerCallLow, maxPerCallHigh] = splitU256(config.maxPerCall);\n const [maxPerWindowLow, maxPerWindowHigh] = splitU256(config.maxPerWindow);\n return {\n contractAddress: walletAddress,\n entrypoint: SESSION_ENTRYPOINTS.SET_SPENDING_POLICY,\n calldata: [\n config.sessionPublicKey,\n config.token,\n maxPerCallLow,\n maxPerCallHigh,\n maxPerWindowLow,\n maxPerWindowHigh,\n num.toHex(config.windowSeconds),\n ],\n };\n}\n\n/** `remove_spending_policy(session_key, token)` */\nexport function buildRemoveSpendingPolicyCall(\n walletAddress: string,\n sessionPublicKey: string,\n token: string\n): Call {\n if (!token || token.trim().length === 0) {\n throw new ChipiSessionError(\n `Invalid token address for spending policy removal: \"${token}\"`,\n SESSION_ERRORS.INVALID_SPENDING_POLICY\n );\n }\n return {\n contractAddress: walletAddress,\n entrypoint: SESSION_ENTRYPOINTS.REMOVE_SPENDING_POLICY,\n calldata: [sessionPublicKey, token],\n };\n}\n\n/**\n * Register a session and cap it per token in one multicall: the session is\n * added first, then one `set_spending_policy` per entry. Each policy's\n * `sessionPublicKey` must match the session being registered.\n */\nexport function buildSessionSetupCalls(\n walletAddress: string,\n sessionConfig: SessionConfig,\n spendingPolicies: ReadonlyArray<Omit<SpendingPolicyConfig, \"sessionPublicKey\">> = []\n): Call[] {\n return [\n buildAddSessionKeyCall(walletAddress, sessionConfig),\n ...spendingPolicies.map((policy) =>\n buildSetSpendingPolicyCall(walletAddress, {\n ...policy,\n sessionPublicKey: sessionConfig.sessionPublicKey,\n })\n ),\n ];\n}\n","import { API_ENDPOINTS } from \"@chipi-stack/shared\";\nimport { ChipiClient } from \"./client\";\n\n/**\n * SHHH multisig treasury coordination client (Plus Wave 9 / P1).\n *\n * A thin, typed HTTP client for the chipi-back `/v1/treasuries/:id/...`\n * endpoints. It implements the same transport contract `@chipi-stack/chipi-react`\n * injects into `useProposeAction` / `useTreasuryProposals` (`MultisigTransport`),\n * so an integrator can wire `sdk.treasury.forTreasury(...)` straight into those\n * hooks instead of hand-writing fetch glue.\n *\n * Auth model (decision §11.2 — owner-signature-as-authorization):\n * - propose / sign: `pk_` (the public api key) PLUS the owner's V2_SNIP12\n * envelope (already inside the proposal body) AND the owner's\n * `ownerPubkey` (kind-specific — see {@link ForTreasuryConfig.ownerPubkey}).\n * chipi-back's OwnerSignatureVerifier proves the request came from a\n * current on-chain owner, so no secret is needed — these are safe to\n * call from the browser.\n * - execute / list / allowance: `sk_` (a secret key bearer). execute relays\n * through the paymaster and meters; reads are org-private. Call these from\n * a server (a Next.js route handler / your backend), never the browser.\n *\n * The types below mirror `@chipi-stack/chipi-react/multisig`'s `TreasuryProposal`\n * / `ProposeBody` field-for-field (post-#324: OE `executeAfter` is derived from\n * `executeBefore`, never sent or stored). They're duplicated (not imported) so\n * the server SDK never depends on the React package; TypeScript's structural\n * typing makes a `TreasuryTransport` assignable to the hook's `MultisigTransport`.\n */\n\n/** One owner's collected signature on a proposal. */\nexport interface TreasuryProposalSignature {\n ownerId: number;\n signerKind: string;\n /** The owner's serialized inner V2_SNIP12 envelope (comma-joined felts). */\n signature: string;\n}\n\n/** A treasury proposal as returned by the coordination backend. */\nexport interface TreasuryProposal {\n id: string;\n /** Set for generalized actions (vote / call any contract); null for payments. */\n calls?: { to: string; entrypoint: string; calldata: string[] }[] | null;\n /** Human label for an action (\"Vote YES on Proposal #5\"). */\n title?: string | null;\n /** Arbitrary integrator context persisted with the proposal (chipi-back\n * #301, `meta Json?`) — e.g. `{ poolId }`, read by the approver app's\n * `renderContext`. Null on payments and pre-#301 rows. */\n meta?: Record<string, string | number> | null;\n /** App-level risk tier the proposal was filed under (chipi-back #302;\n * null = none). */\n risk?: \"ROUTINE\" | \"SENSITIVE\" | null;\n oeMessageHash: string;\n oeNonce: string | null;\n /** chipi-back persists only `oeExecuteBefore`; the OE `executeAfter` is\n * re-derived as `executeBefore - 2h` by executors (see chipi-react #324). */\n oeExecuteBefore: string | null;\n requiredApprovals: number;\n status: \"PROPOSED\" | \"APPROVED\" | \"EXECUTED\" | \"CANCELED\" | \"EXPIRED\";\n executedTxHash?: string | null;\n signatures: TreasuryProposalSignature[];\n}\n\n/** The body the coordination backend's `propose` endpoint accepts. */\nexport interface ProposeBody {\n proposerOwnerId: number;\n recipient: string;\n tokenAddress: string;\n amount: string;\n title: string;\n calls: { to: string; entrypoint: string; calldata: string[] }[];\n /** Arbitrary integrator context persisted with the proposal (chipi-back\n * #301). Flat string|number values, bounded server-side: ≤16 keys, key\n * ≤40 chars, string values ≤200 chars. */\n meta?: Record<string, string | number>;\n /** Template risk tier (chipi-back #302): when the treasury configured the\n * matching quorum, the server overrides requiredApprovals at propose. */\n risk?: \"ROUTINE\" | \"SENSITIVE\";\n oeMessageHash: string;\n oeNonce: string;\n oeExecuteBefore: string;\n requiredApprovals: number;\n proposerSignature: string;\n proposerSignerKind: string;\n}\n\n/** The approver's body for `sign` (mirrors chipi-react's call site). */\nexport interface ApproveBody {\n ownerId: number;\n signature: string;\n signerKind: string;\n}\n\n/** Result of relaying an execute through the paymaster. */\nexport interface ExecuteResult {\n executedTxHash?: string;\n transactionHash?: string;\n}\n\n/** Free-execute meter for the org (shape owned by chipi-back's treasury svc). */\nexport interface MultisigAllowance {\n freeExecutesRemaining?: number;\n priceUsd?: number;\n creditsUsd?: number;\n canExecuteNow?: boolean;\n [key: string]: unknown;\n}\n\n/** One treasury as returned by `list()`. Mirrors chipi-back's `OrgTreasury`\n * row plus the joined wallet projection. Dates arrive as ISO strings. */\nexport interface TreasurySummary {\n /** The id `forTreasury({ treasuryId })` expects. */\n id: string;\n organizationId: string;\n name: string;\n walletId: string;\n createdAt: string;\n updatedAt: string;\n /** Non-null once archived. Archived treasuries are excluded unless\n * `includeArchived` is set. */\n archivedAt: string | null;\n routineQuorum: number | null;\n sensitiveQuorum: number | null;\n wallet: {\n id: string;\n publicKey: string;\n walletType: string;\n isDeployed: boolean;\n chain: string;\n };\n}\n\n/** Page of treasuries owned by the api key's org. */\nexport interface ListTreasuriesResult {\n items: TreasurySummary[];\n total: number;\n page: number;\n limit: number;\n hasMore: boolean;\n}\n\n/**\n * Risk-tier quorum policy for one treasury.\n *\n * A proposal filed with `risk: \"ROUTINE\" | \"SENSITIVE\"` gets its\n * `requiredApprovals` overridden server-side from the matching quorum, so you\n * can require more signatures for `borrow` than for `repay` without changing\n * the wallet's on-chain threshold.\n *\n * `null` means the tier has no policy and the client's `requiredApprovals`\n * stands.\n */\nexport interface TreasuryPolicy {\n treasuryId: string;\n name: string;\n routineQuorum: number | null;\n sensitiveQuorum: number | null;\n}\n\nexport interface SetTreasuryPolicyOptions {\n /** Omit to leave unchanged. Pass `null` to clear the tier. */\n routineQuorum?: number | null;\n /** Omit to leave unchanged. Pass `null` to clear the tier. */\n sensitiveQuorum?: number | null;\n /** A `sk_`. Falls back to the SDK's configured `apiSecretKey`. */\n bearerToken?: string;\n}\n\nexport interface ListTreasuriesOptions {\n /** 1-based. Defaults to 1 server-side. */\n page?: number;\n /** Server clamps to 1..100; defaults to 25. */\n limit?: number;\n /** Include archived treasuries. Defaults to false. */\n includeArchived?: boolean;\n /** A `sk_`. Falls back to the SDK's configured `apiSecretKey`. */\n bearerToken?: string;\n}\n\n/**\n * A transport bound to one treasury + the local owner's public key.\n * Structurally compatible with `@chipi-stack/chipi-react`'s `MultisigTransport`.\n */\nexport interface TreasuryTransport {\n list(): Promise<{ items: TreasuryProposal[] }>;\n propose(body: ProposeBody): Promise<TreasuryProposal>;\n sign(proposalId: string, body: ApproveBody): Promise<unknown>;\n execute(proposalId: string, calldata: string[]): Promise<ExecuteResult>;\n /** Read the org's free-execute meter (sk_). Not part of MultisigTransport. */\n getMultisigAllowance(): Promise<MultisigAllowance>;\n}\n\nexport interface ForTreasuryConfig {\n /** The org treasury id (the multisig wallet's row id in chipi-back). */\n treasuryId: string;\n /**\n * The local owner's public key, sent with propose / sign so the backend can\n * verify the envelope commits to a current on-chain owner. Kind-specific\n * format (must match the `signerKind` of the envelopes this transport sends):\n * - STARK: one 0x-hex felt (the stark key) — `starkPubkeyFelts(pub)[0]`.\n * - WEBAUTHN_P256: `\"0x<x>,0x<y>\"` (full 32-byte BE P-256 coordinates) —\n * use `webauthnOwnerPubkeyParam(pubkey)`.\n * - EIP191_SECP256K1 (MetaMask): `\"0x<x>,0x<y>\"` (full 32-byte BE\n * secp256k1 coordinates) — use `eip191OwnerPubkeyParam(pubkey)`.\n * - ED25519 (Phantom): `\"0x<low>,0x<high>\"` (LE u128 halves of the\n * 32-byte key) — use `ed25519OwnerPubkeyParam(publicKey)`.\n * NOTE: the coordinate-based kinds take the FULL x/y values, never the\n * 4-felt `*PubkeyFelts` form (the backend rejects more than 2 values).\n */\n ownerPubkey: string;\n /** A secret key (`sk_`) for execute / list / allowance. Falls back to the\n * SDK's configured `apiSecretKey`. Required only for those three; propose /\n * sign authenticate with `pk_` + the owner signature. */\n bearerToken?: string;\n}\n\nexport class ChipiTreasury {\n constructor(\n private client: ChipiClient,\n private apiSecretKey?: string\n ) {}\n\n private base(treasuryId: string): string {\n return `${API_ENDPOINTS.TREASURIES}/${treasuryId}/transactions`;\n }\n\n /** Resolve a `sk_` for the secret-gated reads/execute, or fail loudly. */\n private secret(bearerToken?: string): string {\n const token = bearerToken ?? this.apiSecretKey;\n if (!token) {\n throw new Error(\n \"A secret key (sk_) is required for treasury execute / list / allowance. \" +\n \"Pass `bearerToken` to forTreasury(...) or configure the SDK with apiSecretKey. \" +\n \"Call these from a server, never the browser.\"\n );\n }\n return token;\n }\n\n /**\n * List every treasury owned by the api key's organization (`sk_`).\n *\n * This is the discovery entry point for {@link ForTreasuryConfig.treasuryId}.\n * The secret key resolves the org server-side, so there is no org id to\n * pass and nothing to look up in the dashboard first. Use it to recover a\n * `treasuryId` that fell out of your config, or to avoid pinning one in an\n * environment variable at all.\n *\n * Server-only: it needs a `sk_`, so never call it from the browser.\n *\n * @example\n * ```typescript\n * const { items } = await sdk.treasury.list();\n * const ops = items.find((t) => t.name === \"Ops Treasury\");\n * const transport = sdk.treasury.forTreasury({\n * treasuryId: ops.id,\n * ownerPubkey,\n * });\n * ```\n */\n async list(options: ListTreasuriesOptions = {}): Promise<ListTreasuriesResult> {\n const { page, limit, includeArchived, bearerToken } = options;\n const params: Record<string, string> = {};\n if (page !== undefined) params.page = String(page);\n if (limit !== undefined) params.limit = String(limit);\n if (includeArchived !== undefined) {\n params.includeArchived = String(includeArchived);\n }\n\n const res = await this.client.get<ListTreasuriesResult>({\n endpoint: API_ENDPOINTS.TREASURIES,\n params,\n bearerToken: this.secret(bearerToken),\n });\n // Defensive: the hook-facing shape always has an array.\n return { ...res, items: res.items ?? [] };\n }\n\n /**\n * Read a treasury's risk-tier quorum policy (`sk_`).\n */\n async getPolicy(\n treasuryId: string,\n options: { bearerToken?: string } = {}\n ): Promise<TreasuryPolicy> {\n return this.client.get<TreasuryPolicy>({\n endpoint: `${API_ENDPOINTS.TREASURIES}/${treasuryId}/policy`,\n bearerToken: this.secret(options.bearerToken),\n });\n }\n\n /**\n * Set a treasury's risk-tier quorums (`sk_`).\n *\n * An omitted tier is left unchanged; passing `null` clears it. Configuring\n * this used to require the dashboard, so an integrator driving governance\n * from their own server could see a quorum applied to a proposal but never\n * choose it.\n *\n * IMPORTANT: a quorum can only RAISE `requiredApprovals`, never lower it\n * below the wallet's on-chain threshold. Set one below and it is SILENTLY\n * RAISED at propose time, not rejected and not reverted: a `routineQuorum`\n * of 1 on a 2-of-3 wallet is clamped to 2 and executes normally. The risk is\n * a policy that reads 1 everywhere while the system uses 2.\n *\n * The server now rejects that outright so the stored value means what it\n * says (server-side enforcement, live since 2026-08; no SDK upgrade\n * needed). To genuinely lower the requirement, lower the on-chain\n * threshold first with `propose_set_threshold` (48h timelock).\n *\n * Server-only: it needs a `sk_`.\n *\n * @example\n * ```typescript\n * // Founding a pool and borrowing need 3 owners; repaying needs the\n * // wallet's own threshold.\n * await sdk.treasury.setPolicy(treasuryId, { sensitiveQuorum: 3 });\n * ```\n */\n async setPolicy(\n treasuryId: string,\n options: SetTreasuryPolicyOptions = {}\n ): Promise<TreasuryPolicy> {\n const { routineQuorum, sensitiveQuorum, bearerToken } = options;\n const body: Record<string, number | null> = {};\n // `undefined` means \"leave unchanged\", so only send what was supplied.\n // An explicit null must survive, which rules out a truthiness check.\n if (routineQuorum !== undefined) body.routineQuorum = routineQuorum;\n if (sensitiveQuorum !== undefined) body.sensitiveQuorum = sensitiveQuorum;\n\n return this.client.patch<TreasuryPolicy>({\n endpoint: `${API_ENDPOINTS.TREASURIES}/${treasuryId}/policy`,\n bearerToken: this.secret(bearerToken),\n body,\n });\n }\n\n /**\n * Build a {@link TreasuryTransport} for one treasury + owner. Wire the\n * returned object directly into chipi-react's `useProposeAction` /\n * `useTreasuryProposals` `transport` prop, or call its methods yourself.\n */\n forTreasury(config: ForTreasuryConfig): TreasuryTransport {\n const { treasuryId, ownerPubkey } = config;\n const base = this.base(treasuryId);\n\n return {\n // sk_ — read the proposal list. chipi-back returns\n // { items, total, page, limit, hasMore }; the hook only reads `items`.\n list: async () => {\n const res = await this.client.get<{ items: TreasuryProposal[] }>({\n endpoint: base,\n bearerToken: this.secret(config.bearerToken),\n });\n return { ...res, items: res.items ?? [] };\n },\n\n // pk_ + owner sig — no secret. `ownerPubkey` lets the backend verify the\n // proposer envelope. `meta` (if present) is stripped server-side.\n propose: async (body: ProposeBody) => {\n return this.client.post<TreasuryProposal>({\n endpoint: base,\n // Empty string → no Authorization header; the pk_ travels in\n // x-api-key, which ApiKeyGuard accepts for propose.\n bearerToken: \"\",\n body: { ...body, ownerPubkey },\n });\n },\n\n // pk_ + owner sig — approve an existing proposal.\n sign: async (proposalId: string, body: ApproveBody) => {\n return this.client.post<unknown>({\n endpoint: `${base}/${proposalId}/sign`,\n bearerToken: \"\",\n body: { ...body, ownerPubkey },\n });\n },\n\n // sk_ — relay the assembled threshold calldata through the paymaster.\n execute: async (proposalId: string, calldata: string[]) => {\n return this.client.post<ExecuteResult>({\n endpoint: `${base}/${proposalId}/execute`,\n bearerToken: this.secret(config.bearerToken),\n body: { calldata },\n });\n },\n\n // sk_ — the free-execute meter (org-scoped).\n getMultisigAllowance: async () => {\n return this.client.get<MultisigAllowance>({\n endpoint: `${API_ENDPOINTS.TREASURIES}/${treasuryId}/multisig-allowance`,\n bearerToken: this.secret(config.bearerToken),\n });\n },\n };\n }\n}\n","import { WALLET_RPC_ENDPOINTS, withRpcFallback } from \"@chipi-stack/shared\";\n\n/**\n * Wait for a Starknet transaction and report what happened, without throwing\n * on an on-chain revert.\n *\n * Every gasless write in this SDK returns a transaction hash and nothing else,\n * so integrators were each writing the same receipt-polling loop to answer two\n * questions: did it actually succeed, and what events did it emit. Getting that\n * loop wrong is expensive in a money flow. A revert that reads as success\n * double-credits a ledger; a timeout treated as failure strands a confirmed\n * transfer.\n *\n * The contract here is deliberately narrow: a REVERTED transaction is a\n * RESULT, not an exception, because a revert is a normal outcome your code\n * must branch on. Exceptions are reserved for \"we do not know yet\": a timeout\n * or a transport failure, where retrying is the correct response and treating\n * it as failure would be wrong.\n */\n\n/** One raw event from the receipt. Decode against your own ABI. */\nexport interface ContractEventLog {\n /** Emitting contract address. Filter on this before matching keys. */\n from_address: string;\n /** Indexed fields. `keys[0]` is the selector of the event name. */\n keys: string[];\n /** Non-indexed fields, in declaration order. */\n data: string[];\n}\n\nexport interface WaitForTransactionResult {\n transactionHash: string;\n /** True only for an accepted, non-reverted transaction. */\n success: boolean;\n /** Raw `execution_status` from the node, when it reported one. */\n executionStatus?: string;\n /** Raw `finality_status` from the node, when it reported one. */\n finalityStatus?: string;\n /** Present when `success` is false and the node gave a reason. */\n revertReason?: string;\n /** Empty on a revert: reverted transactions emit no events. */\n events: ContractEventLog[];\n blockNumber?: number;\n}\n\nexport interface WaitForTransactionOptions {\n /**\n * Preferred endpoint. It is the caller's slot in the ordered RPC chain, not\n * the only endpoint tried: reading a receipt is idempotent, so a transport\n * failure falls through to the next endpoint rather than aborting the wait.\n * Defaults to the endpoint the SDK already uses for CHIPI wallets.\n */\n nodeUrl?: string;\n /** Poll interval. Default 3000ms, roughly Starknet's block cadence. */\n retryIntervalMs?: number;\n /** Total budget before giving up. Default 300000ms (5 minutes). */\n timeoutMs?: number;\n}\n\nconst DEFAULT_RETRY_INTERVAL_MS = 3_000;\nconst DEFAULT_TIMEOUT_MS = 300_000;\n\n/** A receipt is only meaningful once the node has sequenced it. */\nfunction isPending(finalityStatus?: string): boolean {\n return (\n finalityStatus === undefined ||\n finalityStatus === \"RECEIVED\" ||\n finalityStatus === \"PENDING\" ||\n finalityStatus === \"PRE_CONFIRMED\"\n );\n}\n\n/**\n * Poll until `transactionHash` reaches a terminal state.\n *\n * @throws if the timeout elapses before the node sequences the transaction.\n * It does NOT throw when the transaction reverted: check `success`.\n *\n * @example\n * ```typescript\n * const txHash = await sdk.callAnyContract({ params, bearerToken });\n * const receipt = await sdk.waitForTransaction(txHash);\n *\n * if (!receipt.success) {\n * throw new Error(receipt.revertReason ?? \"reverted on chain\");\n * }\n *\n * const created = receipt.events.find(\n * (e) => e.from_address === FACTORY && e.keys[0] === POOL_CREATED_SELECTOR\n * );\n * ```\n */\nexport async function waitForTransaction(\n transactionHash: string,\n options: WaitForTransactionOptions = {}\n): Promise<WaitForTransactionResult> {\n const {\n nodeUrl = WALLET_RPC_ENDPOINTS.CHIPI,\n retryIntervalMs = DEFAULT_RETRY_INTERVAL_MS,\n timeoutMs = DEFAULT_TIMEOUT_MS,\n } = options;\n\n const deadline = Date.now() + timeoutMs;\n // Surfaced only if we time out, so the caller learns why we kept polling\n // (transaction genuinely not found vs the node erroring every time).\n let lastError: unknown;\n\n for (;;) {\n try {\n // Idempotent read, so it is safe to advance down the endpoint chain on a\n // transport-class failure. Never wrap the submit side this way.\n const receipt = (await withRpcFallback(\n (provider) => provider.getTransactionReceipt(transactionHash),\n { fallbackUrl: nodeUrl }\n )) as unknown as {\n execution_status?: string;\n finality_status?: string;\n revert_reason?: string;\n events?: ContractEventLog[];\n block_number?: number;\n };\n\n if (!isPending(receipt?.finality_status)) {\n const reverted = receipt.execution_status === \"REVERTED\";\n return {\n transactionHash,\n success: !reverted,\n executionStatus: receipt.execution_status,\n finalityStatus: receipt.finality_status,\n ...(reverted ? { revertReason: receipt.revert_reason ?? \"reverted on chain\" } : {}),\n events: receipt.events ?? [],\n ...(receipt.block_number !== undefined ? { blockNumber: receipt.block_number } : {}),\n };\n }\n } catch (err) {\n // A not-yet-propagated transaction reads as an error on most nodes, so\n // this is the normal path for the first few polls, not an exception.\n lastError = err;\n }\n\n if (Date.now() + retryIntervalMs >= deadline) {\n const detail = lastError instanceof Error ? `: ${lastError.message}` : \"\";\n throw new Error(\n `Timed out after ${timeoutMs}ms waiting for ${transactionHash}${detail}. ` +\n `The transaction may still land; re-check before treating it as failed.`\n );\n }\n\n await new Promise((resolve) => setTimeout(resolve, retryIntervalMs));\n }\n}\n","import { hash } from \"starknet\";\nimport {\n waitForTransaction,\n type ContractEventLog,\n type WaitForTransactionOptions,\n type WaitForTransactionResult,\n} from \"../wait-for-transaction\";\n\n/**\n * Remembers which transaction hashes already paid for something.\n *\n * `consume` must be atomic: return `true` the first time a hash is seen and\n * `false` on every later call, also across concurrent requests. Back it with a\n * unique index in your database (`INSERT ... ON CONFLICT DO NOTHING`) in\n * production; the default in-memory store forgets everything on restart and is\n * not shared between instances.\n */\nexport interface TxHashStore {\n /**\n * `transactionHash` arrives normalised: lowercase `0x` hex without leading\n * zeros, so `0x0abc` and `0x000…abc` are the same key. Pad it yourself if you\n * compare it with RPC output.\n */\n consume(transactionHash: string): boolean | Promise<boolean>;\n}\n\nclass InMemoryTxHashStore implements TxHashStore {\n private readonly used = new Set<string>();\n\n consume(transactionHash: string): boolean {\n if (this.used.has(transactionHash)) return false;\n this.used.add(transactionHash);\n return true;\n }\n}\n\nexport interface SessionTxVerifierConfig extends WaitForTransactionOptions {\n /** Default: in memory (single process, lost on restart). */\n txHashStore?: TxHashStore;\n /** Receipt source. Default: `waitForTransaction` with the options above. */\n getReceipt?: (\n transactionHash: string,\n options: WaitForTransactionOptions\n ) => Promise<WaitForTransactionResult>;\n}\n\nexport interface VerifyTransferParams {\n /** The hash the payer sent you, e.g. from `executeTransactionWithSession`. */\n transactionHash: string;\n /** ERC-20 contract, e.g. USDC. */\n token: string;\n /** The paying wallet. */\n from: string;\n /** Your receiving address. */\n to: string;\n /** Smallest acceptable amount, in the token's base units. */\n minAmount: bigint;\n}\n\nexport type VerifyTransferFailure =\n /** The transaction reverted on chain. */\n | \"REVERTED\"\n /** No `Transfer` from `token` with this `from` and `to`. */\n | \"TRANSFER_NOT_FOUND\"\n /** A matching `Transfer` exists but moved less than `minAmount`. */\n | \"AMOUNT_TOO_LOW\"\n /** This hash already paid for something (replay). */\n | \"ALREADY_USED\";\n\nexport type VerifyTransferResult =\n | { valid: true; transactionHash: string; amount: bigint; blockNumber?: number }\n | { valid: false; transactionHash: string; reason: VerifyTransferFailure; detail?: string };\n\nconst TRANSFER_SELECTOR = BigInt(hash.getSelectorFromName(\"Transfer\"));\n\nfunction toBigInt(value: string | undefined): bigint | undefined {\n if (value === undefined) return undefined;\n try {\n return BigInt(value);\n } catch {\n return undefined;\n }\n}\n\n/**\n * Decode an ERC-20 `Transfer` event in either layout:\n * - Cairo 1 (OpenZeppelin, native USDC): keys `[selector, from, to]`, data `[low, high]`;\n * - Cairo 0: keys `[selector]`, data `[from, to, low, high]`.\n */\nfunction decodeTransfer(\n event: ContractEventLog\n): { from: bigint; to: bigint; amount: bigint } | undefined {\n if (toBigInt(event.keys[0]) !== TRANSFER_SELECTOR) return undefined;\n\n const [from, to, low, high] =\n event.keys.length >= 3\n ? [event.keys[1], event.keys[2], event.data[0], event.data[1]]\n : [event.data[0], event.data[1], event.data[2], event.data[3]];\n\n const values = [from, to, low, high].map(toBigInt);\n if (values.some((v) => v === undefined)) return undefined;\n const [f, t, l, h] = values as bigint[];\n return { from: f, to: t, amount: l + (h << 128n) };\n}\n\n/**\n * Check on chain that a transaction paid you, and that it pays only once.\n *\n * Use it when a client pays by sending the transfer itself (for example an\n * agent with a session key calling `executeTransactionWithSession`) and hands\n * you the hash. A transaction hash, or a `SUCCESS` status from an API, is not\n * proof of payment: the transfer may have reverted, gone elsewhere, moved less,\n * or already been used for an earlier request. This reads the receipt and\n * accepts only a successful transaction whose `Transfer` event from `token`\n * moves at least `minAmount` from `from` to `to`, then consumes the hash.\n *\n * Opt-in and independent of `X402Facilitator`, whose behaviour is unchanged.\n *\n * **Who is `from`.** Transaction hashes and `Transfer` events are public. If\n * `from` comes from the request, anyone watching your address can submit a\n * payer's hash first and consume it: they get the service, the payer gets\n * `ALREADY_USED`. Take `from` from the caller's authenticated identity (your\n * session, an API key bound to a wallet) whenever you have one. For anonymous\n * payers this is first-come-first-served; keep it to low-value calls.\n *\n * `verifyTransfer` waits for the transaction to be sequenced and throws only\n * when it cannot tell (timeout, RPC failure): retry those. Every other outcome\n * is a result.\n *\n * @example\n * ```typescript\n * const verifier = new SessionTxVerifier({ txHashStore: dbStore });\n *\n * const result = await verifier.verifyTransfer({\n * transactionHash,\n * token: USDC,\n * from: agentWallet,\n * to: TREASURY,\n * minAmount: 1_000n, // $0.001 in USDC base units\n * });\n * if (!result.valid) return new Response(result.reason, { status: 402 });\n * ```\n */\nexport class SessionTxVerifier {\n private readonly store: TxHashStore;\n private readonly getReceipt: NonNullable<SessionTxVerifierConfig[\"getReceipt\"]>;\n private readonly receiptOptions: WaitForTransactionOptions;\n\n constructor(config: SessionTxVerifierConfig = {}) {\n const { txHashStore, getReceipt, ...receiptOptions } = config;\n this.store = txHashStore ?? new InMemoryTxHashStore();\n this.getReceipt = getReceipt ?? waitForTransaction;\n this.receiptOptions = receiptOptions;\n }\n\n async verifyTransfer(params: VerifyTransferParams): Promise<VerifyTransferResult> {\n const { transactionHash, token, from, to, minAmount } = params;\n const receipt = await this.getReceipt(transactionHash, this.receiptOptions);\n\n if (!receipt.success) {\n return { valid: false, transactionHash, reason: \"REVERTED\", detail: receipt.revertReason };\n }\n\n const tokenAddress = BigInt(token);\n const fromAddress = BigInt(from);\n const toAddress = BigInt(to);\n\n let best: bigint | undefined;\n for (const event of receipt.events) {\n if (toBigInt(event.from_address) !== tokenAddress) continue;\n const transfer = decodeTransfer(event);\n if (!transfer || transfer.from !== fromAddress || transfer.to !== toAddress) continue;\n if (best === undefined || transfer.amount > best) best = transfer.amount;\n }\n\n if (best === undefined) {\n return { valid: false, transactionHash, reason: \"TRANSFER_NOT_FOUND\" };\n }\n if (best < minAmount) {\n return {\n valid: false,\n transactionHash,\n reason: \"AMOUNT_TOO_LOW\",\n detail: `paid ${best}, expected at least ${minAmount}`,\n };\n }\n\n // Normalise so 0x0abc and 0xabc are the same key.\n const key = \"0x\" + BigInt(transactionHash).toString(16);\n if (!(await this.store.consume(key))) {\n return { valid: false, transactionHash, reason: \"ALREADY_USED\" };\n }\n\n return {\n valid: true,\n transactionHash,\n amount: best,\n ...(receipt.blockNumber !== undefined ? { blockNumber: receipt.blockNumber } : {}),\n };\n }\n}\n","import type {\n AiChatParams,\n AiChatResponse,\n AiExecuteParams,\n AiExecuteResponse,\n AiModelsResponse,\n AiPrices,\n AiPricesParams,\n AiSignals,\n AiSignalsParams,\n PaymentPayload,\n PaymentRequirement,\n ThinkDecision,\n ThinkOptions,\n ThinkParams,\n ThinkResponse,\n ThinkSessionPayment,\n} from \"@chipi-stack/types\";\nimport { ChipiApiError, ChipiAuthError, CONTRACT_ADDRESSES } from \"@chipi-stack/shared\";\nimport { ChipiClient } from \"./client\";\nimport type { ChipiSessions } from \"./sessions\";\nimport { waitForTransaction, type WaitForTransactionResult } from \"./wait-for-transaction\";\nimport { SessionTxVerifier } from \"./x402/session-tx-verifier\";\n\nconst AI_BASE = \"/ai\";\nconst THINK_ACTIONS = new Set([\"swap\", \"supply\", \"withdraw\", \"hold\"]);\n\n/** Attempts at a paid call the API says to retry (503 verification unavailable, 409 in progress). */\nconst PAID_MAX_ATTEMPTS = 3;\nconst PAID_RETRY_DELAY_MS = 5_000;\n\n/** Canonical felt252: 0x plus 64 hex digits, leading zeros kept. */\nconst padFelt = (value: string) => \"0x\" + BigInt(value).toString(16).padStart(64, \"0\");\n\nfunction sameFelt(a: string, b: string): boolean {\n try {\n return BigInt(a) === BigInt(b);\n } catch {\n return false;\n }\n}\n\n/**\n * The session-transfer x402 offer in a 402 from the AI API, if there is one.\n * Only `exact` USDC on Starknet mainnet paid by a session transfer qualifies.\n */\nfunction sessionTransferOffer(err: unknown): PaymentRequirement | undefined {\n if (!(err instanceof ChipiApiError) || err.status !== 402) return undefined;\n const details = err.details as { x402?: { accepts?: PaymentRequirement[] } } | undefined;\n return details?.x402?.accepts?.find(\n (r) =>\n r.scheme === \"exact\" &&\n r.network === \"starknet-mainnet\" &&\n r.extra?.paymentMethod === \"session-transfer\" &&\n sameFelt(r.asset, CONTRACT_ADDRESSES.USDC_MAINNET)\n );\n}\n\n/**\n * Caller input as think prints it in the prompt, in UTF-8 bytes (what\n * `maxPromptBytes` limits), measured the way chipi-back measures it: the\n * portfolio as pretty JSON, `recentDecisions` (a number) as printed, and\n * `chain`, which the system prompt prints twice.\n */\nfunction thinkInputBytes(params: ThinkParams): number {\n const bytes = (text: string) => new TextEncoder().encode(text).length;\n const chain = params.chain ?? \"starknet\";\n return (\n bytes(JSON.stringify(params.portfolio, null, 2)) +\n (params.history?.recentDecisions ? bytes(String(params.history.recentDecisions)) : 0) +\n 2 * bytes(chain)\n );\n}\n\nconst sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\n\n/**\n * Whether `/v1/ai/think` returned a structured decision you can act on.\n *\n * `false` for a non-JSON reply (`{ raw }`) and for any `action` outside\n * `swap | supply | withdraw | hold`. Treat `false` as `hold`. This checks the\n * shape only: the amounts and tokens are still yours to validate.\n */\nexport function isThinkDecision(decision: unknown): decision is ThinkDecision {\n if (!decision || typeof decision !== \"object\") return false;\n const d = decision as Record<string, unknown>;\n if (typeof d.action !== \"string\" || !THINK_ACTIONS.has(d.action)) return false;\n if (typeof d.reason !== \"string\") return false;\n if (d.amount !== undefined && (typeof d.amount !== \"number\" || !Number.isFinite(d.amount)))\n return false;\n if (d.confidence !== undefined && typeof d.confidence !== \"number\") return false;\n if (d.from !== undefined && typeof d.from !== \"string\") return false;\n if (d.to !== undefined && typeof d.to !== \"string\") return false;\n return true;\n}\n\n/**\n * Chipi AI API: prices, market signals, a DeFi decision engine, swap call\n * building and general chat, billed to your organization's credits.\n *\n * Server-only. Every method authenticates with the SDK's secret key (`sk_`)\n * and refuses to run without one, so a public key in the browser can never\n * spend your credits through this client.\n *\n * Errors come back as `ChipiApiError` with the API's code and HTTP status:\n * `INSUFFICIENT_BALANCE` (402) when credits run out, `MODEL_RATE_LIMITED`\n * (429), `SIGNALS_UNAVAILABLE` (503) while signals warm up after a backend restart.\n *\n * @example\n * ```typescript\n * const sdk = new ChipiServerSDK({ apiPublicKey, apiSecretKey });\n *\n * const signals = await sdk.ai.signals({ tokens: [\"ETH\", \"STRK\"] });\n * const { decision } = await sdk.ai.think({ portfolio, riskScore: 4 });\n * if (isThinkDecision(decision) && decision.action === \"swap\") {\n * const { calls } = await sdk.ai.execute({\n * chain: \"starknet\",\n * action: \"swap\",\n * from: decision.from!,\n * to: decision.to!,\n * amountUsd: 10,\n * walletAddress,\n * });\n * }\n * ```\n */\nexport class ChipiAi {\n constructor(\n private client: ChipiClient,\n private apiSecretKey?: string,\n /** Needed only to pay think calls with `payWithSession`. */\n private sessions?: ChipiSessions\n ) {}\n\n private secret(): string {\n const key = this.apiSecretKey;\n if (!key || !key.startsWith(\"sk_\")) {\n throw new ChipiAuthError(\n \"sdk.ai needs a secret key (sk_): configure the SDK with apiSecretKey and call it from a server, never the browser.\"\n );\n }\n return key;\n }\n\n /**\n * `GET /v1/ai/signals`: technical signals per token, market sentiment and\n * DeFi yields. Free up to a monthly quota per organization, then billed per call.\n */\n async signals(params: AiSignalsParams = {}): Promise<AiSignals> {\n const query: Record<string, string> = {};\n if (params.tokens?.length) query.tokens = params.tokens.join(\",\");\n if (params.chain) query.chain = params.chain;\n return this.client.get<AiSignals>({\n endpoint: `${AI_BASE}/signals`,\n params: query,\n bearerToken: this.secret(),\n });\n }\n\n /**\n * `POST /v1/ai/think`: one DeFi decision for a portfolio, with the latest\n * signals and your risk parameters injected into the prompt.\n *\n * The decision is advice, not an order: check it with `isThinkDecision` and\n * enforce your own limits before executing anything.\n *\n * **Paying per call (x402).** With `payWithSession`, a 402 that carries a\n * session-transfer offer (credits short, x402 on) is paid with the agent's\n * session key: a USDC `transfer` to the offer's `payTo`, then the same call\n * again with `X-PAYMENT`. The price must be at most `maxAmount`, `model`\n * must be payable and the input within `maxPromptBytes`, all checked before\n * paying. The wallet must be a wallet of the organization that owns the\n * `sk_`: the first request names it in `X-PAYER`, and when the API answers\n * that a payment from it would be refused, nothing is paid\n * (`X402_PAYER_NOT_IN_ORG`). The session must whitelist `transfer` and cap\n * USDC. A payment that was made but not served is reported in\n * `error.details.xPayment`; pass it back as `options.xPayment` to retry\n * without paying again.\n *\n * @example\n * ```typescript\n * const res = await sdk.ai.think(\n * { portfolio, model: \"haiku\" },\n * { payWithSession: { encryptKey, wallet, session, maxAmount: 20_000n } } // $0.02 at most\n * );\n * res.x402Payment; // set when the call was paid over x402\n * ```\n */\n async think(params: ThinkParams, options: ThinkOptions = {}): Promise<ThinkResponse> {\n // X-PAYER: the API says in its offer whether a payment from this wallet\n // would be accepted, so a wallet of another org is never charged.\n let payer: string | undefined;\n if (options.payWithSession && !options.xPayment) {\n try {\n payer = padFelt(options.payWithSession.wallet.publicKey);\n } catch {\n payer = undefined; // not a felt: send nothing, the payment checks still run\n }\n }\n try {\n return await this.postThink(params, options.xPayment, payer);\n } catch (err) {\n const offer = options.payWithSession ? sessionTransferOffer(err) : undefined;\n if (!offer || !options.payWithSession) throw err;\n return this.payAndThink(params, offer, options.payWithSession);\n }\n }\n\n private postThink(\n params: ThinkParams,\n xPayment?: string,\n payer?: string\n ): Promise<ThinkResponse> {\n const headers: Record<string, string> = {\n ...(xPayment ? { \"X-PAYMENT\": xPayment } : {}),\n ...(payer ? { \"X-PAYER\": payer } : {}),\n };\n return this.client.post<ThinkResponse>({\n endpoint: `${AI_BASE}/think`,\n bearerToken: this.secret(),\n body: params,\n ...(Object.keys(headers).length > 0 ? { headers } : {}),\n });\n }\n\n /**\n * Pay one think call with a session-key USDC transfer, then send it again\n * with `X-PAYMENT`. Every check that can refuse the call runs before the\n * transfer; the transfer counts only once its receipt shows the USDC moved.\n */\n private async payAndThink(\n params: ThinkParams,\n offer: PaymentRequirement,\n pay: ThinkSessionPayment\n ): Promise<ThinkResponse> {\n if (!this.sessions) {\n throw new ChipiApiError(\n \"payWithSession needs the SDK's session client\",\n \"X402_NOT_CONFIGURED\",\n 402\n );\n }\n let maxAmount: bigint;\n try {\n maxAmount = BigInt(pay.maxAmount);\n } catch {\n throw new ChipiApiError(\n `maxAmount must be an integer of USDC base units (6 decimals), got ${String(pay.maxAmount)}; nothing was paid`,\n \"X402_INVALID_MAX_AMOUNT\",\n 400\n );\n }\n const amount = BigInt(offer.maxAmountRequired);\n if (amount > maxAmount) {\n throw new ChipiApiError(\n `The x402 price (${amount} USDC base units) is above maxAmount (${pay.maxAmount}); nothing was paid`,\n \"X402_PRICE_ABOVE_MAX\",\n 402,\n { x402: { accepts: [offer] } }\n );\n }\n const payable = offer.extra?.payableModels;\n if (params.model && Array.isArray(payable) && !payable.includes(params.model)) {\n throw new ChipiApiError(\n `Model ${params.model} cannot be paid with x402 (payable: ${payable.join(\", \")}); nothing was paid`,\n \"X402_MODEL_NOT_PAYABLE\",\n 402,\n { x402: { accepts: [offer] } }\n );\n }\n const maxBytes = offer.extra?.maxPromptBytes;\n if (typeof maxBytes === \"number\" && thinkInputBytes(params) > maxBytes) {\n throw new ChipiApiError(\n `Paid calls accept at most ${maxBytes} bytes of portfolio, history and chain; nothing was paid`,\n \"X402_PAYLOAD_TOO_LARGE\",\n 402,\n { x402: { accepts: [offer] } }\n );\n }\n // The API refuses a payment from a wallet outside the sk_'s org\n // (PAYER_NOT_IN_ORG) after the USDC has moved. An API that knows this\n // answers X-PAYER in `extra.payer` (chipi-back always sets `address`);\n // one that does not leaves it unset. Only a refusal naming this wallet\n // stops the payment: anything else pays as 14.15.0 did.\n const payerCheck = offer.extra?.payer as { address?: unknown; accepted?: unknown } | undefined;\n if (\n payerCheck?.accepted === false &&\n typeof payerCheck.address === \"string\" &&\n sameFelt(payerCheck.address, pay.wallet.publicKey)\n ) {\n throw new ChipiApiError(\n `Wallet ${pay.wallet.publicKey} is not a wallet of the organization that owns this API key, so the API would refuse its payment; nothing was paid. Pay from a wallet of this organization.`,\n \"X402_PAYER_NOT_IN_ORG\",\n 402,\n { x402: { accepts: [offer] } }\n );\n }\n\n // Pay: a session-signed USDC transfer to payTo, then its receipt.\n const payer = pay.wallet.publicKey;\n const mask = (1n << 128n) - 1n;\n const transactionHash = await this.sessions.executeTransactionWithSession(\n {\n encryptKey: pay.encryptKey,\n wallet: pay.wallet,\n session: pay.session,\n calls: [\n {\n contractAddress: offer.asset,\n entrypoint: \"transfer\",\n calldata: [offer.payTo, (amount & mask).toString(), (amount >> 128n).toString()],\n },\n ],\n },\n this.secret()\n );\n const header: PaymentPayload = {\n x402Version: 1,\n scheme: \"exact\",\n network: \"starknet-mainnet\",\n payload: {\n signature: { r: padFelt(transactionHash), s: \"session\" },\n fromAddress: padFelt(payer),\n toAddress: padFelt(offer.payTo),\n amount: amount.toString(),\n asset: offer.asset,\n validUntil: Math.floor(Date.now() / 1000) + offer.maxTimeoutSeconds,\n nonce: padFelt(transactionHash),\n },\n };\n const xPayment = JSON.stringify(header);\n\n // Sent: from here on the hash is the payment, so every failure reports it.\n const paidError = (message: string, code: string, extra: Record<string, unknown> = {}) =>\n new ChipiApiError(message, code, 402, {\n x402: { accepts: [offer] },\n x402PaymentHash: transactionHash,\n ...extra,\n });\n let receipt: WaitForTransactionResult;\n try {\n receipt = await waitForTransaction(transactionHash, { timeoutMs: 120_000 });\n } catch (err) {\n // It may still land: retry later with `xPayment`, the hash pays once.\n throw paidError(\n `No receipt yet for the x402 payment ${transactionHash}: ${err instanceof Error ? err.message : String(err)}`,\n \"X402_PAYMENT_PENDING\",\n { xPayment }\n );\n }\n // On a session wallet a refused call (over a cap, not whitelisted) can\n // still come back SUCCEEDED: only a Transfer to payTo is a payment.\n const paid = await new SessionTxVerifier({\n txHashStore: { consume: () => true },\n getReceipt: async () => receipt,\n }).verifyTransfer({\n transactionHash,\n token: offer.asset,\n from: payer,\n to: offer.payTo,\n minAmount: amount,\n });\n if (!paid.valid) {\n throw paidError(\n `The x402 payment did not move ${amount} USDC base units to payTo (${paid.reason}). Check the session's whitelist (transfer) and its USDC cap.`,\n \"X402_PAYMENT_FAILED\",\n { reason: paid.reason }\n );\n }\n\n // The payment is spent only once a call is served, so retrying is safe.\n for (let attempt = 1; ; attempt++) {\n try {\n return await this.postThink(params, xPayment);\n } catch (err) {\n const retryable =\n err instanceof ChipiApiError &&\n (err.status === 409 ||\n (err.status === 503 && (err.details as { retryable?: boolean })?.retryable === true));\n if (retryable && attempt < PAID_MAX_ATTEMPTS) {\n await sleep(PAID_RETRY_DELAY_MS);\n continue;\n }\n if (err instanceof ChipiApiError) {\n // Paid but not served: hand back the hash so the caller can retry with `xPayment`.\n throw new ChipiApiError(err.message, err.code, err.status ?? 402, {\n ...(typeof err.details === \"object\" && err.details !== null ? err.details : {}),\n x402PaymentHash: transactionHash,\n xPayment,\n });\n }\n throw err;\n }\n }\n }\n\n /**\n * `POST /v1/ai/execute`: unsigned AVNU swap calls (approve + swap) for\n * `walletAddress`. Nothing is submitted; sign the calls with a session key\n * or the owner's key.\n */\n async execute(params: AiExecuteParams): Promise<AiExecuteResponse> {\n return this.client.post<AiExecuteResponse>({\n endpoint: `${AI_BASE}/execute`,\n bearerToken: this.secret(),\n body: params,\n });\n }\n\n /** `POST /v1/ai/chat`: general-purpose chat, billed per token. */\n async chat(params: AiChatParams): Promise<AiChatResponse> {\n return this.client.post<AiChatResponse>({\n endpoint: `${AI_BASE}/chat`,\n bearerToken: this.secret(),\n body: params,\n });\n }\n\n /**\n * `GET /v1/ai/prices`: USD prices and 1h / 24h / 7d changes, refreshed about\n * every 30 seconds. No credits are charged, but like every `sdk.ai` method it\n * needs the SDK's secret key (`sk_`).\n */\n async prices(params: AiPricesParams = {}): Promise<AiPrices> {\n const query: Record<string, string> = {};\n if (params.tokens?.length) query.tokens = params.tokens.join(\",\");\n if (params.chain) query.chain = params.chain;\n return this.client.get<AiPrices>({\n endpoint: `${AI_BASE}/prices`,\n params: query,\n bearerToken: this.secret(),\n });\n }\n\n /** `GET /v1/ai/models`: available models, prices and limits. */\n async models(): Promise<AiModelsResponse> {\n return this.client.get<AiModelsResponse>({\n endpoint: `${AI_BASE}/models`,\n bearerToken: this.secret(),\n });\n }\n}\n","import { ec, hash, num } from \"starknet\";\n\n/** SRC-6 `is_valid_signature` magic value: the short string 'VALID'. */\nexport const STARKNET_SIGNATURE_VALID = \"0x56414c4944\";\n\n/** Anything with a starknet.js-style `callContract` (e.g. `RpcProvider`). */\nexport interface StarknetCallProvider {\n callContract(call: {\n contractAddress: string;\n entrypoint: string;\n calldata?: string[];\n }): Promise<string[]>;\n}\n\nexport type StarknetSignatureCheck =\n | { valid: true }\n | { valid: false; reason: \"INVALID_SIGNATURE\" | \"ACCOUNT_NOT_DEPLOYED\"; detail?: string };\n\n/** Felts as `0x` hex, accepting decimal (\"1\") and hex (\"0x1\") inputs alike. */\nexport function toFeltHex(value: string | number | bigint): string {\n return num.toHex(BigInt(value));\n}\n\n/** `0x` + 64 hex, lowercase. Wallets differ on padding; compare on this. */\nexport function normalizeStarknetAddress(address: string): string {\n return `0x${BigInt(address).toString(16).padStart(64, \"0\")}`;\n}\n\nfunction isContractNotFound(err: unknown): boolean {\n const e = err as { baseError?: { code?: number }; code?: number; message?: string };\n if (e?.baseError?.code === 20 || e?.code === 20) return true;\n return /contract not found/i.test(e?.message ?? String(err));\n}\n\n/**\n * Asks the account itself (SRC-6 `is_valid_signature`) whether `signature`\n * signs `messageHash`. The full signature array is passed through, so\n * multi-felt signatures (Argent, Braavos, multisig) work.\n *\n * Only 'VALID' counts: accounts return 0 or panic on a bad signature, and a\n * lax \"anything non-zero\" check would accept garbage. An account that is not\n * deployed yet comes back as ACCOUNT_NOT_DEPLOYED so the caller can fall back\n * to `verifyUndeployedStarknetSignature`.\n */\nexport async function isValidStarknetSignature(\n provider: StarknetCallProvider,\n accountAddress: string,\n messageHash: string,\n signature: Array<string | number | bigint>\n): Promise<StarknetSignatureCheck> {\n try {\n const sig = signature.map(toFeltHex);\n const result = await provider.callContract({\n contractAddress: normalizeStarknetAddress(accountAddress),\n entrypoint: \"is_valid_signature\",\n calldata: [toFeltHex(messageHash), toFeltHex(sig.length), ...sig],\n });\n const first = result?.[0];\n if (first !== undefined && BigInt(first) === BigInt(STARKNET_SIGNATURE_VALID)) {\n return { valid: true };\n }\n return { valid: false, reason: \"INVALID_SIGNATURE\" };\n } catch (err) {\n if (isContractNotFound(err)) return { valid: false, reason: \"ACCOUNT_NOT_DEPLOYED\" };\n // Braavos and Argent 0.5 panic on a bad signature instead of returning 0.\n return {\n valid: false,\n reason: \"INVALID_SIGNATURE\",\n detail: err instanceof Error ? err.message : String(err),\n };\n }\n}\n\n/** Account classes whose undeployed signatures we can check off-chain. */\nexport const COUNTERFACTUAL_ACCOUNT_CLASSES = {\n /** OpenZeppelin AccountUpgradeable 3.0 (Bramble's default account). */\n OPENZEPPELIN_V3: \"0x01d1777db36cdd06dd62cfde77b1b6ae06412af95d57a13dc40ac77b8a702381\",\n /** Argent X / Ready 0.4 (`WALLET_CLASS_HASHES.READY`). */\n ARGENT_V0_4: \"0x036078334509b514626504edc9fb252328d1a240e4e948bef8d0c08dff45927f\",\n} as const;\n\n/** What a wallet returns from `wallet_deploymentData`. */\nexport interface StarknetDeploymentData {\n address: string;\n class_hash: string;\n salt: string;\n calldata: string[];\n}\n\nexport type UndeployedSignatureCheck =\n | { valid: true }\n | {\n valid: false;\n reason: \"UNSUPPORTED_ACCOUNT_CLASS\" | \"ADDRESS_MISMATCH\" | \"INVALID_SIGNATURE\";\n };\n\nfunction starkVerify(r: string, s: string, messageHash: string, publicKey: string): boolean {\n // Accounts store only the x coordinate; either y parity is the same key.\n const x = BigInt(publicKey).toString(16).padStart(64, \"0\");\n const sig = new ec.starkCurve.Signature(BigInt(r), BigInt(s));\n for (const prefix of [\"02\", \"03\"]) {\n try {\n if (ec.starkCurve.verify(sig, toFeltHex(messageHash), prefix + x)) return true;\n } catch {\n // not a point for this parity\n }\n }\n return false;\n}\n\n/**\n * Checks a signature from an account that is not deployed yet (new Bramble\n * and Ready accounts stay counterfactual until their first transaction), using\n * the wallet's `wallet_deploymentData`:\n *\n * 1. The class must be one we know how to read: OpenZeppelin 3.0 or Argent 0.4\n * without a guardian.\n * 2. The address must be the one those exact constructor arguments deploy to.\n * 3. The signature must be the owner key's ECDSA signature of the hash.\n */\nexport function verifyUndeployedStarknetSignature(\n deployment: StarknetDeploymentData,\n messageHash: string,\n signature: Array<string | number | bigint>\n): UndeployedSignatureCheck {\n const classHash = normalizeStarknetAddress(deployment.class_hash);\n const calldata = deployment.calldata.map(toFeltHex);\n const sig = signature.map(toFeltHex);\n\n let publicKey: string;\n let r: string;\n let s: string;\n if (classHash === COUNTERFACTUAL_ACCOUNT_CLASSES.OPENZEPPELIN_V3) {\n // constructor(public_key); signature [r, s]\n if (calldata.length !== 1 || sig.length !== 2) {\n return { valid: false, reason: \"INVALID_SIGNATURE\" };\n }\n [publicKey] = calldata;\n [r, s] = sig;\n } else if (classHash === COUNTERFACTUAL_ACCOUNT_CLASSES.ARGENT_V0_4) {\n // constructor(owner: Signer::Starknet(pub), guardian: Option::None) = [0, pub, 1];\n // signature: one Starknet signer = [1, 0, pub, r, s]. A guardian would\n // need a second signature we can't check here, so it is refused.\n if (calldata.length !== 3 || BigInt(calldata[0]) !== 0n || BigInt(calldata[2]) !== 1n) {\n return { valid: false, reason: \"UNSUPPORTED_ACCOUNT_CLASS\" };\n }\n if (sig.length !== 5 || BigInt(sig[0]) !== 1n || BigInt(sig[1]) !== 0n) {\n return { valid: false, reason: \"INVALID_SIGNATURE\" };\n }\n if (BigInt(sig[2]) !== BigInt(calldata[1])) {\n return { valid: false, reason: \"INVALID_SIGNATURE\" };\n }\n publicKey = calldata[1];\n [, , , r, s] = sig;\n } else {\n return { valid: false, reason: \"UNSUPPORTED_ACCOUNT_CLASS\" };\n }\n\n const expected = hash.calculateContractAddressFromHash(\n toFeltHex(deployment.salt),\n classHash,\n calldata,\n 0\n );\n if (normalizeStarknetAddress(expected) !== normalizeStarknetAddress(deployment.address)) {\n return { valid: false, reason: \"ADDRESS_MISMATCH\" };\n }\n\n return starkVerify(r, s, messageHash, publicKey)\n ? { valid: true }\n : { valid: false, reason: \"INVALID_SIGNATURE\" };\n}\n","import type {\n PaymentPayload,\n VerifyResponse,\n SettleResponse,\n NonceStore,\n X402FacilitatorConfig,\n} from \"@chipi-stack/types\";\nimport { CONTRACT_ADDRESSES } from \"@chipi-stack/shared\";\nimport { buildX402TypedData } from \"@chipi-stack/core\";\nimport { hash, uint256, typedData as starknetTypedData } from \"starknet\";\nimport { ChipiClient } from \"../client\";\nimport { isValidStarknetSignature } from \"../starknet-signature\";\nimport type {\n ExecuteSponsoredTransactionResponse,\n PrepareTypedDataResponse,\n} from \"@chipi-stack/types\";\n\nconst TRANSFER_SELECTOR = BigInt(hash.getSelectorFromName(\"transfer\"));\n\n/**\n * Checks that a SHHH `execute_from_outside_v2` calldata span is exactly one\n * `transfer(toAddress, amount)` on the payment's asset, and still valid. Span\n * layout (serializeExecuteFromOutsideV2Calldata): caller, nonce,\n * execute_after, execute_before, calls_len, then per call\n * (to, selector, calldata_len, ...calldata), then the signature.\n */\nfunction shhhTransferMatches(\n oeCalldata: string[],\n payload: PaymentPayload[\"payload\"]\n): { ok: true } | { ok: false; reason: string } {\n try {\n const felts = oeCalldata.map((v) => BigInt(v));\n const [, , , executeBefore, callsLen] = felts;\n if (callsLen !== 1n) return { ok: false, reason: \"SHHH payment must be exactly one transfer\" };\n const [to, selector, len, recipient, low, high] = felts.slice(5, 11);\n if (to !== BigInt(payload.asset) || selector !== TRANSFER_SELECTOR || len !== 3n) {\n return { ok: false, reason: \"SHHH payment call is not a transfer of the payment asset\" };\n }\n if (recipient !== BigInt(payload.toAddress)) {\n return { ok: false, reason: \"SHHH payment pays a different recipient\" };\n }\n if (low + (high << 128n) !== BigInt(payload.amount)) {\n return { ok: false, reason: \"SHHH payment amount differs from the declared amount\" };\n }\n if (executeBefore <= BigInt(Math.floor(Date.now() / 1000))) {\n return { ok: false, reason: \"SHHH payment has expired (execute_before in the past)\" };\n }\n return { ok: true };\n } catch {\n return { ok: false, reason: \"Malformed SHHH oeCalldata\" };\n }\n}\n\n/** Default in-memory nonce store. Resets on server restart. */\nclass InMemoryNonceStore implements NonceStore {\n private readonly used = new Set<string>();\n\n has(nonce: string): boolean {\n return this.used.has(nonce);\n }\n\n consume(nonce: string): boolean {\n if (this.used.has(nonce)) return false;\n this.used.add(nonce);\n return true;\n }\n}\n\n/** Options for the static X402Facilitator.create() factory */\nexport interface X402FacilitatorCreateOptions {\n /** API public key for ChipiClient */\n apiKey: string;\n /** Bearer token for paymaster API calls */\n bearerToken: string;\n /** Custom nonce store (default: in-memory) */\n nonceStore?: NonceStore;\n /** RPC provider for on-chain signature verification */\n provider?: X402FacilitatorConfig[\"provider\"];\n}\n\n/**\n * x402 Payment Facilitator for Starknet.\n *\n * Implements the \"facilitator\" role in the x402 protocol:\n * - verify(): Validate payment signature, amount, asset, nonce replay\n * - settle(): Execute the USDC transfer via Chipi's paymaster\n *\n * Settlement reuses Chipi's existing gasless infrastructure\n * (prepare-typed-data → sign → execute-sponsored-transaction).\n */\nexport class X402Facilitator {\n private readonly client: ChipiClient;\n private readonly bearerToken: string;\n private readonly nonceStore: NonceStore;\n private readonly provider: X402FacilitatorConfig[\"provider\"];\n\n constructor(client: ChipiClient, bearerToken: string, config?: X402FacilitatorConfig) {\n this.client = client;\n this.bearerToken = bearerToken;\n this.nonceStore = config?.nonceStore ?? new InMemoryNonceStore();\n this.provider = config?.provider;\n }\n\n /**\n * Factory method for simpler instantiation.\n *\n * @example\n * ```typescript\n * const facilitator = X402Facilitator.create({\n * apiKey: process.env.CHIPI_API_KEY!,\n * bearerToken: process.env.CHIPI_BEARER_TOKEN!,\n * });\n * ```\n */\n static create(options: X402FacilitatorCreateOptions): X402Facilitator {\n const client = new ChipiClient({ apiPublicKey: options.apiKey });\n return new X402Facilitator(client, options.bearerToken, {\n nonceStore: options.nonceStore,\n provider: options.provider,\n });\n }\n\n /**\n * Verify a payment signature is valid (doesn't execute the transfer).\n *\n * Checks:\n * 1. x402 version is 1\n * 2. Network is starknet-mainnet\n * 3. Nonce has not been used (replay protection)\n * 4. Payment has not expired (validUntil > now)\n * 5. Asset is USDC mainnet\n * 6. Amount is positive\n * 7. Addresses are non-empty\n * 8. Signature: with a `provider`, the payer account's `is_valid_signature`\n * must return 'VALID'. Without one, only its presence is checked (not a\n * cryptographic check). SHHH payloads must sign exactly one transfer\n * of `amount` of `asset` to `toAddress`; their signature is checked\n * on-chain at settle.\n */\n async verify(payment: PaymentPayload): Promise<VerifyResponse> {\n const { payload } = payment;\n\n // 1. Check x402 version\n if (payment.x402Version !== 1) {\n return { isValid: false, invalidReason: `Unsupported x402 version: ${payment.x402Version}` };\n }\n\n // 2. Check network\n if (payment.network !== \"starknet-mainnet\") {\n return { isValid: false, invalidReason: `Unsupported network: ${payment.network}` };\n }\n\n // 3. Check nonce replay\n if (await this.nonceStore.has(payload.nonce)) {\n return { isValid: false, invalidReason: \"Nonce already used (replay)\" };\n }\n\n // 4. Check expiry\n const now = Math.floor(Date.now() / 1000);\n if (payload.validUntil <= now) {\n return { isValid: false, invalidReason: \"Payment has expired (validUntil in the past)\" };\n }\n\n // 5. Validate asset is USDC\n const normalizedAsset = payload.asset.toLowerCase().replace(/^0x0+/, \"0x\");\n const normalizedUsdc = CONTRACT_ADDRESSES.USDC_MAINNET.toLowerCase().replace(/^0x0+/, \"0x\");\n if (normalizedAsset !== normalizedUsdc) {\n return {\n isValid: false,\n invalidReason: `Unsupported asset: ${payload.asset}. Only USDC is accepted.`,\n };\n }\n\n // 6. Validate amount is positive\n let amount: bigint;\n try {\n amount = BigInt(payload.amount);\n } catch {\n return { isValid: false, invalidReason: \"Invalid payment amount format\" };\n }\n if (amount <= 0n) {\n return { isValid: false, invalidReason: \"Payment amount must be positive\" };\n }\n\n // 7. Validate addresses are non-empty\n if (!payload.fromAddress || !payload.toAddress) {\n return { isValid: false, invalidReason: \"Missing fromAddress or toAddress\" };\n }\n\n // 8. Verify SNIP-12 signature (cryptographic if provider available, presence-only otherwise)\n const sigResult = await this.verifySignature(payment);\n if (!sigResult.valid) {\n return { isValid: false, invalidReason: sigResult.reason };\n }\n\n return { isValid: true };\n }\n\n /**\n * Verify the SNIP-12 signature on a payment payload.\n *\n * If an RPC provider is configured, reconstructs the typed data, computes the\n * message hash, and calls `is_valid_signature()` on the sender's account contract.\n * Otherwise falls back to a presence-only check (backwards compatible).\n */\n private async verifySignature(\n payment: PaymentPayload\n ): Promise<{ valid: boolean; reason?: string }> {\n // SHHH V8.4 buyers ship a pre-signed execute_from_outside_v2\n // span; the wallet's on-chain dispatch at account.cairo:389\n // validates the V2_SNIP12 envelope (or 4-felt session sig)\n // itself when the paymaster calls execute_from_outside_v2.\n // `is_valid_signature(hash, [r, s])` is NOT how V8.4 validates —\n // calling it with the legacy (r, s) compatibility surface would\n // return invalid for any well-formed SHHH payment and block\n // settlement. Defer to on-chain validation; we still require\n // the oeCalldata span to be present and non-empty so a totally\n // empty payload can't bypass the check.\n if (payment.payload?.shhh) {\n const oeCalldata = payment.payload.shhh.oeCalldata;\n if (!Array.isArray(oeCalldata) || oeCalldata.length === 0) {\n return { valid: false, reason: \"Missing SHHH oeCalldata\" };\n }\n // The contract checks the signature at settle, but not that the signed\n // calls are the payment declared in the payload: bind them here, or a\n // payer could declare 1 USDC and sign a transfer of 1 base unit.\n const bound = shhhTransferMatches(oeCalldata, payment.payload);\n if (!bound.ok) return { valid: false, reason: bound.reason };\n return { valid: true };\n }\n\n if (!this.provider) {\n // No provider configured — fall back to presence-only check\n if (!payment.payload?.signature?.r || !payment.payload?.signature?.s) {\n return { valid: false, reason: \"Missing signature\" };\n }\n return { valid: true };\n }\n\n const payload = payment.payload;\n\n if (!payload?.signature?.r || !payload?.signature?.s) {\n return { valid: false, reason: \"Missing signature\" };\n }\n\n // Reconstruct the SNIP-12 typed data (must match client's signPayment())\n const paymentTypedData = buildX402TypedData({\n from_address: payload.fromAddress,\n to_address: payload.toAddress,\n amount: payload.amount,\n asset: payload.asset,\n valid_until: String(payload.validUntil),\n nonce: payload.nonce,\n });\n\n // Compute the message hash\n let msgHash: string;\n try {\n msgHash = starknetTypedData.getMessageHash(paymentTypedData, payload.fromAddress);\n } catch (err) {\n const message = err instanceof Error ? err.message : String(err);\n return { valid: false, reason: `Malformed payment: ${message}` };\n }\n\n // Ask the account (SRC-6 is_valid_signature); only 'VALID' counts.\n const check = await isValidStarknetSignature(this.provider, payload.fromAddress, msgHash, [\n payload.signature.r,\n payload.signature.s,\n ]);\n if (check.valid) return { valid: true };\n if (check.reason === \"ACCOUNT_NOT_DEPLOYED\") {\n return { valid: false, reason: \"Payer account is not deployed\" };\n }\n return {\n valid: false,\n reason: check.detail\n ? `Signature verification failed: ${check.detail}`\n : \"Invalid SNIP-12 signature\",\n };\n }\n\n /**\n * Settle a verified payment by executing the USDC transfer via paymaster.\n *\n * IMPORTANT: Mark nonce as consumed BEFORE executing to prevent concurrent replays.\n * If the transfer fails after nonce consumption, the nonce is still burned\n * (caller should implement idempotency at a higher level if needed).\n */\n async settle(payment: PaymentPayload): Promise<SettleResponse> {\n const { payload } = payment;\n\n // 1. Verify before settling\n const verification = await this.verify(payment);\n if (!verification.isValid) {\n return { success: false, errorReason: verification.invalidReason };\n }\n\n // 2. Atomically consume nonce (prevents concurrent replays)\n const consumed = await this.nonceStore.consume(payload.nonce);\n if (!consumed) {\n return { success: false, errorReason: \"Nonce already consumed (concurrent replay)\" };\n }\n\n try {\n // SHHH V8.4 buyers ship a pre-built execute_from_outside_v2\n // calldata span. The V8.4 wallet cannot validate a raw `{r, s}`\n // signature — `execute_from_outside_v2` at `account.cairo:389`\n // expects either a 5-felt V2_SNIP12 envelope or a 4-felt\n // session sig, never a bare 2-felt span. The CHIPI v29\n // prepare-typed-data + execute-sponsored-transaction round-trip\n // simply does not apply. Forward the buyer's pre-signed\n // calldata verbatim through the execute-sponsored-raw endpoint\n // (same path SHHH primary STARK + ED25519 OEs take in\n // sdks#268). chipi-back routes it to the paymaster which calls\n // the wallet's execute_from_outside_v2; the envelope validates\n // on chain via the buyer's primary verifier class.\n if (payload.shhh) {\n const shhhResult = await this.client.post<{ transactionHash?: string }>({\n endpoint: \"/transactions/execute-sponsored-raw\",\n bearerToken: this.bearerToken,\n body: {\n accountAddress: payload.fromAddress,\n calldata: payload.shhh.oeCalldata,\n signerKind: payload.shhh.signerKind,\n },\n });\n\n if (typeof shhhResult?.transactionHash !== \"string\" || !shhhResult.transactionHash.trim()) {\n return {\n success: false,\n errorReason:\n (shhhResult as any)?.message ?? \"execute-sponsored-raw returned no transactionHash\",\n };\n }\n\n return {\n success: true,\n transactionHash: shhhResult.transactionHash,\n networkId: \"starknet-mainnet\",\n };\n }\n\n // 3. Build ERC20 transfer call: fromAddress → toAddress\n // ERC20 transfer expects u256 (low, high) for the amount\n const amountU256 = uint256.bnToUint256(BigInt(payload.amount));\n const transferCall = {\n contractAddress: payload.asset,\n entrypoint: \"transfer\",\n calldata: [payload.toAddress, amountU256.low.toString(), amountU256.high.toString()],\n };\n\n // 4. Prepare typed data for sponsored execution\n const prepareResponse = await this.client.post<PrepareTypedDataResponse>({\n endpoint: \"/transactions/prepare-typed-data\",\n bearerToken: this.bearerToken,\n body: {\n publicKey: payload.fromAddress,\n calls: [transferCall],\n },\n });\n\n // 5. Execute sponsored transaction using the payment signature\n const result = await this.client.post<ExecuteSponsoredTransactionResponse>({\n endpoint: \"/transactions/execute-sponsored-transaction\",\n bearerToken: this.bearerToken,\n body: {\n publicKey: payload.fromAddress,\n typedData: prepareResponse.typedData,\n userSignature: payload.signature,\n walletType: prepareResponse.walletType,\n saveToDatabase: true,\n },\n });\n\n if (typeof result?.transactionHash !== \"string\" || !result.transactionHash.trim()) {\n return {\n success: false,\n errorReason: (result as any)?.message ?? \"No transaction hash returned from paymaster\",\n };\n }\n\n return {\n success: true,\n transactionHash: result.transactionHash,\n networkId: \"starknet-mainnet\",\n };\n } catch (error) {\n const message = error instanceof Error ? error.message : String(error);\n return {\n success: false,\n errorReason: `Settlement failed: ${message}`,\n };\n }\n }\n}\n","import type { SignTypedDataParams, SignTypedDataResult } from \"@chipi-stack/types\";\nimport { Account, RpcProvider, typedData as typedDataUtil } from \"starknet\";\nimport { decryptPrivateKey } from \"./encryption\";\nimport { WALLET_CLASS_HASHES, WALLET_RPC_ENDPOINTS } from \"@chipi-stack/shared\";\nimport { normalizeSignature } from \"./paymaster-adapter\";\n\n/**\n * Sign SNIP-12 typed data without executing a transaction.\n *\n * This is a purely local operation:\n * 1. Decrypt the private key using the encryption key (PIN)\n * 2. Create a starknet Account\n * 3. Sign the typed data with account.signMessage()\n * 4. Normalize and return { r, s }\n *\n * No API calls are made. Useful for x402 payment signatures and other\n * off-chain signing flows where you need a SNIP-12 signature but don't\n * want to execute a transaction.\n */\nexport const signTypedData = async ({\n params,\n}: {\n params: SignTypedDataParams;\n}): Promise<SignTypedDataResult> => {\n try {\n const { encryptKey, wallet, typedData } = params;\n\n if (!encryptKey) {\n throw new Error(\"encryptKey is required for signing typed data\");\n }\n\n if (!wallet || !wallet.encryptedPrivateKey || !wallet.publicKey) {\n throw new Error(\"wallet with publicKey and encryptedPrivateKey is required\");\n }\n\n if (!typedData) {\n throw new Error(\"typedData is required for signing\");\n }\n\n const walletType = wallet.walletType ?? \"READY\";\n\n if (\n !Object.prototype.hasOwnProperty.call(WALLET_RPC_ENDPOINTS, walletType) ||\n !Object.prototype.hasOwnProperty.call(WALLET_CLASS_HASHES, walletType)\n ) {\n throw new Error(`Unsupported wallet type: \"${String(walletType)}\"`);\n }\n\n const rpcUrl = WALLET_RPC_ENDPOINTS[walletType];\n\n // Decrypt the private key\n let privateKeyDecrypted: string;\n try {\n privateKeyDecrypted = decryptPrivateKey(wallet.encryptedPrivateKey, encryptKey);\n } catch {\n throw new Error(\"Failed to decrypt private key. Verify the encryptKey is correct.\");\n }\n\n const provider = new RpcProvider({ nodeUrl: rpcUrl });\n\n const account = new Account({\n provider,\n address: wallet.publicKey,\n signer: privateKeyDecrypted,\n });\n\n // Sign the typed data\n const signature = await account.signMessage(typedData);\n\n // Normalize signature format (handles both Weierstrass and Array types)\n const normalizedSig = normalizeSignature(signature);\n\n return normalizedSig;\n } catch (error) {\n console.error(\"Error signing typed data\", error);\n throw error;\n }\n};\n\n// Canonical felt form: 0x + 64 hex chars (leading zeros preserved) — matches\n// the repo's felt-formatting rule so signature spans are consistent.\nfunction toFeltHex(x: bigint): string {\n return \"0x\" + x.toString(16).padStart(64, \"0\");\n}\n\n/**\n * Sign SNIP-12 typed data and return the full signature SPAN as felt strings —\n * the shape a dApp's `wallet_signTypedData` expects (wallet-api `Signature`).\n *\n * Wallet-type aware (this is the part the plain `signTypedData` {r,s} can't do):\n * - **SHHH V8.4**: `__validate__` is disabled and the account verifies a\n * V2_SNIP12 envelope `[V2_SNIP12, owner_id, 'STARK', r, s]`. We hash the\n * typed data per SNIP-12, sign with the STARK owner key, and wrap it so the\n * account's `is_valid_signature` accepts it. Purely local (no API call).\n * - **READY / standard**: a bare `[r, s]` from `account.signMessage`.\n *\n * Phase 0 covers the primary STARK owner (ownerIndex 0). WebAuthn-rooted\n * owners (interactive passkey assertion) are a follow-up.\n */\nexport const signTypedDataArray = async ({\n params,\n}: {\n params: SignTypedDataParams;\n}): Promise<string[]> => {\n const { encryptKey, wallet, typedData } = params;\n\n if (!encryptKey) throw new Error(\"encryptKey is required for signing typed data\");\n if (!wallet || !wallet.encryptedPrivateKey || !wallet.publicKey) {\n throw new Error(\"wallet with publicKey and encryptedPrivateKey is required\");\n }\n if (!typedData) throw new Error(\"typedData is required for signing\");\n\n const walletType = wallet.walletType ?? \"READY\";\n if (!Object.prototype.hasOwnProperty.call(WALLET_RPC_ENDPOINTS, walletType)) {\n throw new Error(`Unsupported wallet type: \"${String(walletType)}\"`);\n }\n\n let privateKeyDecrypted: string;\n try {\n privateKeyDecrypted = decryptPrivateKey(wallet.encryptedPrivateKey, encryptKey);\n } catch {\n throw new Error(\"Failed to decrypt private key. Verify the encryptKey is correct.\");\n }\n\n // SNIP-12 message hash of the dApp's typed data against this account — the\n // same hash the account's verifier checks the signature against.\n const messageHash = BigInt(typedDataUtil.getMessageHash(typedData, wallet.publicKey));\n\n if (walletType === \"SHHH\") {\n // Dynamic import: keep the shhh signer modules (which run module-level\n // starknet crypto) out of the static load graph, so partially-mocked\n // starknet in other tests doesn't break at import — same pattern as\n // execute-paymaster-transaction.ts.\n const { buildStarkEnvelope } = await import(\"./shhh/signers/stark\");\n const envelope = buildStarkEnvelope({\n privateKey: privateKeyDecrypted,\n messageHash,\n ownerIndex: 0n,\n });\n return envelope.map(toFeltHex);\n }\n\n // Standard accounts: bare [r, s].\n const provider = new RpcProvider({ nodeUrl: WALLET_RPC_ENDPOINTS[walletType] });\n const account = new Account({ provider, address: wallet.publicKey, signer: privateKeyDecrypted });\n const { r, s } = normalizeSignature(await account.signMessage(typedData));\n return [r, s];\n};\n","import type {\n ChipiSDKConfig,\n CreateWalletParams,\n CreateWalletResponse,\n GetWalletParams,\n TransferParams,\n ApproveParams,\n CallAnyContractParams,\n ExecuteTransactionParams,\n RecordSendTransactionParams,\n Transaction,\n CreateSkuPurchaseParams,\n GetTokenBalanceParams,\n GetTokenBalanceResponse,\n PaginatedResponse,\n Sku,\n GetSkuListQuery,\n GetTransactionListQuery,\n ExecuteWithSessionParams,\n Currency,\n X402FacilitatorConfig,\n SignTypedDataParams,\n SignTypedDataResult,\n TransactionStatusResponse,\n PrepareWalletUpgradeParams,\n PrepareWalletUpgradeResponse,\n ExecuteWalletUpgradeParams,\n ExecuteWalletUpgradeResponse,\n} from \"@chipi-stack/types\";\nimport { STARKNET_NETWORKS, CONTRACT_ADDRESSES, formatAmount } from \"@chipi-stack/shared\";\nimport { ChipiClient } from \"./client\";\nimport { ChipiWallets } from \"./wallets\";\nimport { ChipiTransactions } from \"./transactions\";\nimport { ChipiSkuPurchases } from \"./sku-purchases\";\nimport { ChipiSkus } from \"./skus\";\n\nimport { ChipiSessions } from \"./sessions\";\nimport { ChipiExchanges } from \"./exchanges\";\nimport { ChipiTreasury } from \"./treasury\";\nimport { ChipiAi } from \"./ai\";\nimport { ChipiPaymasterAdapter } from \"./paymaster-adapter\";\nimport { X402Facilitator } from \"./x402/facilitator\";\nimport { signTypedData, signTypedDataArray } from \"./sign-typed-data\";\n\n/**\n * Main Chipi SDK class\n */\nexport class ChipiSDK {\n private client: ChipiClient;\n private nodeUrl: string;\n private apiSecretKey?: string;\n\n public readonly wallets: ChipiWallets;\n public readonly transactions: ChipiTransactions;\n public readonly skuPurchases: ChipiSkuPurchases;\n public readonly skus: ChipiSkus;\n public readonly sessions: ChipiSessions;\n public readonly exchanges: ChipiExchanges;\n public readonly treasury: ChipiTreasury;\n /** AI API (`/v1/ai/*`). Server-only: needs `apiSecretKey` (`sk_`). */\n public readonly ai: ChipiAi;\n\n constructor(config: ChipiSDKConfig) {\n this.client = new ChipiClient(config);\n this.nodeUrl = config.nodeUrl || STARKNET_NETWORKS.MAINNET;\n this.apiSecretKey = config.apiSecretKey;\n\n // Initialize service classes\n this.wallets = new ChipiWallets(this.client);\n this.transactions = new ChipiTransactions(this.client);\n this.skuPurchases = new ChipiSkuPurchases(this.client);\n this.skus = new ChipiSkus(this.client);\n this.sessions = new ChipiSessions(this.client);\n this.exchanges = new ChipiExchanges(this.client);\n this.treasury = new ChipiTreasury(this.client, config.apiSecretKey);\n this.ai = new ChipiAi(this.client, config.apiSecretKey, this.sessions);\n\n // Bind methods to preserve context\n this.executeTransaction = this.executeTransaction.bind(this);\n this.executeTransactionWithSession = this.executeTransactionWithSession.bind(this);\n this.transfer = this.transfer.bind(this);\n this.approve = this.approve.bind(this);\n // this.stakeVesuUsdc = this.stakeVesuUsdc.bind(this);\n // this.withdrawVesuUsdc = this.withdrawVesuUsdc.bind(this);\n this.callAnyContract = this.callAnyContract.bind(this);\n this.createWallet = this.createWallet.bind(this);\n this.recordSendTransaction = this.recordSendTransaction.bind(this);\n this.purchaseSku = this.purchaseSku.bind(this);\n this.getUsdAmount = this.getUsdAmount.bind(this);\n this.signTypedData = this.signTypedData.bind(this);\n this.signTypedDataArray = this.signTypedDataArray.bind(this);\n this.createPaymasterAdapter = this.createPaymasterAdapter.bind(this);\n this.createX402Facilitator = this.createX402Facilitator.bind(this);\n }\n\n /**\n * Resolve bearer token - uses provided token or falls back to apiSecretKey\n */\n private resolveBearerToken(bearerToken?: string): string {\n const token = bearerToken ?? this.apiSecretKey;\n\n if (!token) {\n throw new Error(\n \"Authentication required: either pass a bearerToken or configure the SDK with an apiSecretKey\"\n );\n }\n\n return token;\n }\n\n /**\n * Create a PaymasterAdapter for use with TxBuilder.sendSponsored().\n *\n * @example\n * ```typescript\n * const sdk = new ChipiServerSDK({ apiPublicKey: \"pk_...\", apiSecretKey: \"sk_...\" });\n * const paymaster = sdk.createPaymasterAdapter();\n *\n * const txHash = await new TxBuilder(account, { paymaster })\n * .transfer(USDC, [{ to, amount }])\n * .sendSponsored(); // gasless!\n * ```\n */\n createPaymasterAdapter(bearerToken?: string): ChipiPaymasterAdapter {\n const token = this.resolveBearerToken(bearerToken);\n return new ChipiPaymasterAdapter(this.client, token);\n }\n\n /**\n * Create an X402Facilitator for verifying and settling x402 payments.\n *\n * @example\n * ```typescript\n * const facilitator = sdk.createX402Facilitator();\n *\n * // With custom nonce store (Redis)\n * const facilitator = sdk.createX402Facilitator(bearerToken, {\n * nonceStore: {\n * has: async (nonce) => (await redis.sismember(\"x402:nonces\", nonce)) === 1,\n * consume: async (nonce) => (await redis.sadd(\"x402:nonces\", nonce)) === 1,\n * },\n * });\n * ```\n */\n createX402Facilitator(bearerToken?: string, config?: X402FacilitatorConfig): X402Facilitator {\n const token = this.resolveBearerToken(bearerToken);\n return new X402Facilitator(this.client, token, config);\n }\n\n /**\n * Execute a gasless transaction\n */\n async executeTransaction({\n params,\n bearerToken,\n }: {\n params: ExecuteTransactionParams;\n bearerToken?: string;\n }): Promise<string> {\n return this.transactions.executeTransaction({\n params,\n bearerToken: this.resolveBearerToken(bearerToken),\n });\n }\n\n /**\n * Execute a gasless transaction using a session key.\n *\n * This uses the 4-element session signature format instead of owner signature.\n * The session must be:\n * 1. Generated via `sessions.createSessionKey()`\n * 2. Registered on-chain via `sessions.addSessionKeyToContract()`\n *\n * CHIPI wallets only - will throw if wallet type is not CHIPI.\n *\n * @example\n * ```typescript\n * // 1. Create session key (store externally)\n * const session = sdk.sessions.createSessionKey({ encryptKey });\n *\n * // 2. Register on contract (one-time)\n * await sdk.sessions.addSessionKeyToContract({\n * encryptKey,\n * wallet,\n * sessionConfig: {\n * sessionPublicKey: session.publicKey,\n * validUntil: session.validUntil,\n * maxCalls: 1000,\n * allowedEntrypoints: []\n * }\n * }, bearerToken);\n *\n * // 3. Execute transactions with session (no owner key needed)\n * const txHash = await sdk.executeTransactionWithSession({\n * params: { encryptKey, wallet, session, calls },\n * bearerToken\n * });\n * ```\n */\n async executeTransactionWithSession({\n params,\n bearerToken,\n }: {\n params: ExecuteWithSessionParams;\n bearerToken?: string;\n }): Promise<string> {\n return this.sessions.executeTransactionWithSession(\n params,\n this.resolveBearerToken(bearerToken)\n );\n }\n\n /**\n * Sign SNIP-12 typed data without executing a transaction.\n *\n * Purely local operation: decrypt private key → sign → return { r, s }.\n * No API calls are made. Useful for x402 payment signatures and other\n * off-chain signing flows.\n *\n * @example\n * ```typescript\n * const { r, s } = await sdk.signTypedData({\n * params: {\n * encryptKey: pin,\n * wallet,\n * typedData: snip12TypedData,\n * },\n * });\n * ```\n */\n async signTypedData({ params }: { params: SignTypedDataParams }): Promise<SignTypedDataResult> {\n return signTypedData({ params });\n }\n\n /**\n * Sign SNIP-12 typed data and return the full signature span (felt strings) —\n * the shape a dApp's `wallet_signTypedData` expects. Wallet-type aware:\n * SHHH returns the V2_SNIP12 owner envelope; standard accounts return [r, s].\n */\n async signTypedDataArray({ params }: { params: SignTypedDataParams }): Promise<string[]> {\n return signTypedDataArray({ params });\n }\n\n /**\n * Transfer tokens\n */\n async transfer({\n params,\n bearerToken,\n }: {\n params: TransferParams;\n bearerToken?: string;\n }): Promise<string> {\n return this.transactions.transfer({\n params,\n bearerToken: this.resolveBearerToken(bearerToken),\n });\n }\n\n /**\n * Approve token spending\n */\n async approve({\n params,\n bearerToken,\n }: {\n params: ApproveParams;\n bearerToken?: string;\n }): Promise<string> {\n const { encryptKey, wallet, contractAddress, spender, amount, decimals } = params;\n return this.executeTransaction({\n params: {\n encryptKey,\n wallet,\n calls: [\n {\n contractAddress,\n entrypoint: \"approve\",\n calldata: [spender, formatAmount(amount, decimals), \"0x0\"],\n },\n ],\n },\n bearerToken: this.resolveBearerToken(bearerToken),\n });\n }\n\n /**\n * Call any contract method\n */\n async callAnyContract({\n params,\n bearerToken,\n }: {\n params: CallAnyContractParams;\n bearerToken?: string;\n }): Promise<string> {\n const { encryptKey, wallet, calls } = params;\n return this.executeTransaction({\n params: {\n encryptKey,\n wallet,\n calls,\n },\n bearerToken: this.resolveBearerToken(bearerToken),\n });\n }\n\n /**\n * Create a new wallet\n */\n async createWallet({\n params,\n bearerToken,\n }: {\n params: CreateWalletParams;\n bearerToken?: string;\n }): Promise<CreateWalletResponse> {\n return this.wallets.createWallet({\n ...params,\n bearerToken: this.resolveBearerToken(bearerToken),\n });\n }\n\n async recordSendTransaction({\n params,\n bearerToken,\n }: {\n params: RecordSendTransactionParams;\n bearerToken?: string;\n }): Promise<Transaction> {\n return this.transactions.recordSendTransaction({\n params,\n bearerToken: this.resolveBearerToken(bearerToken),\n });\n }\n\n async getTransactionList(\n query: GetTransactionListQuery,\n bearerToken?: string\n ): Promise<PaginatedResponse<Transaction>> {\n return this.transactions.getTransactionList(query, this.resolveBearerToken(bearerToken));\n }\n\n async getWallet(params: GetWalletParams, bearerToken?: string) {\n return this.wallets.getWallet(params, this.resolveBearerToken(bearerToken));\n }\n\n async getTokenBalance(\n params: GetTokenBalanceParams,\n bearerToken?: string\n ): Promise<GetTokenBalanceResponse> {\n return this.wallets.getTokenBalance({\n params,\n bearerToken: this.resolveBearerToken(bearerToken),\n });\n }\n\n /**\n * Purchase a SKU\n */\n async purchaseSku({\n params,\n bearerToken,\n }: {\n params: CreateSkuPurchaseParams;\n bearerToken?: string;\n }): Promise<Transaction> {\n return this.skuPurchases.purchaseSku(params, this.resolveBearerToken(bearerToken));\n }\n\n /**\n * Get a SKU purchase by id\n */\n async getSkuPurchase(id: string, bearerToken?: string): Promise<Transaction> {\n return this.skuPurchases.getSkuPurchase(id, this.resolveBearerToken(bearerToken));\n }\n\n /// SKUS\n async getSkuList(params: GetSkuListQuery, bearerToken?: string): Promise<PaginatedResponse<Sku>> {\n return this.skus.getSkuList(params, this.resolveBearerToken(bearerToken));\n }\n\n async getSku(id: string, bearerToken?: string): Promise<Sku> {\n return this.skus.getSku(id, this.resolveBearerToken(bearerToken));\n }\n\n /**\n * Get a single transaction by hash or internal ID\n */\n async getTransaction(hashOrId: string, bearerToken?: string): Promise<Transaction> {\n return this.transactions.getTransaction(hashOrId, this.resolveBearerToken(bearerToken));\n }\n\n /**\n * Get on-chain transaction status (supports polling for confirmation)\n */\n async getTransactionStatus(\n hash: string,\n bearerToken?: string\n ): Promise<TransactionStatusResponse> {\n return this.transactions.getTransactionStatus(hash, this.resolveBearerToken(bearerToken));\n }\n\n /**\n * Prepare a wallet upgrade (e.g., READY → CHIPI or CHIPI v29 → v33).\n * Returns typed data that must be signed by the wallet owner.\n * Server-only: requires API secret key.\n */\n async prepareWalletUpgrade(\n params: PrepareWalletUpgradeParams,\n bearerToken?: string\n ): Promise<PrepareWalletUpgradeResponse> {\n return this.wallets.prepareWalletUpgrade(params, this.resolveBearerToken(bearerToken));\n }\n\n /**\n * Execute a wallet upgrade after signing.\n * Server-only: requires API secret key.\n */\n async executeWalletUpgrade(\n params: ExecuteWalletUpgradeParams,\n bearerToken?: string\n ): Promise<ExecuteWalletUpgradeResponse> {\n return this.wallets.executeWalletUpgrade(params, this.resolveBearerToken(bearerToken));\n }\n\n async getUsdAmount(\n currencyAmount: number,\n currency: Currency,\n bearerToken?: string\n ): Promise<number> {\n return this.exchanges.getUsdAmount(\n currencyAmount,\n currency,\n this.resolveBearerToken(bearerToken)\n );\n }\n}\n","import type { ChipiServerSDKConfig } from \"@chipi-stack/types\";\nimport { ChipiSDK } from \"./chipi-sdk\";\n\n/**\n * Server-side Chipi SDK with built-in API Secret Key authentication\n *\n * This class is designed for server-side environments where you can safely store\n * the API Secret Key. All methods automatically use the secret key for authentication,\n * so you don't need to pass a bearer token with each call.\n *\n * The apiSecretKey is stored internally and used automatically for all authenticated requests.\n * All methods from ChipiSDK are inherited and work without requiring a bearerToken parameter.\n *\n * @example\n * ```typescript\n * const chipiServer = new ChipiServerSDK({\n * apiPublicKey: \"pk_...\",\n * apiSecretKey: \"sk_...\",\n * environment: \"production\"\n * });\n *\n * // No bearer token needed - automatically uses apiSecretKey!\n * const wallet = await chipiServer.createWallet({\n * params: {\n * encryptKey: \"user-encryption-key\",\n * externalUserId: \"user-123\"\n * }\n * });\n *\n * const userWallet = await chipiServer.getWallet({ externalUserId: \"user-123\" });\n * const txHash = await chipiServer.transfer({ params: { ... } });\n * ```\n */\nexport class ChipiServerSDK extends ChipiSDK {\n constructor(config: ChipiServerSDKConfig) {\n if (!config.apiSecretKey) {\n throw new Error(\n \"apiSecretKey is required for ChipiServerSDK. Use ChipiBrowserSDK for client-side applications.\"\n );\n }\n\n super(config);\n }\n\n // All methods are inherited from ChipiSDK\n // The apiSecretKey from config is automatically used via resolveBearerToken()\n}\n","import type { ChipiBrowserSDKConfig } from \"@chipi-stack/types\";\nimport { ChipiSDK } from \"./chipi-sdk\";\n\n/**\n * Browser-side Chipi SDK for client-side applications\n *\n * This class is designed for browser environments (Vue, Svelte, Angular, vanilla JS, etc.)\n * where you need to pass a bearer token (JWT) with each authenticated request.\n *\n * All methods require a bearerToken parameter since browser environments should not\n * store API Secret Keys.\n *\n * ⚠️ SECURITY WARNING: DO NOT use your API Secret Key in browser environments!\n * The secret key should only be used server-side with ChipiServerSDK.\n *\n * @example\n * ```typescript\n * const chipiBrowser = new ChipiBrowserSDK({\n * apiPublicKey: \"pk_...\",\n * environment: \"production\"\n * });\n *\n * // Get user's JWT token from your auth system\n * const userToken = await getUserJWT();\n *\n * // Pass bearer token with each call\n * const wallet = await chipiBrowser.createWallet({\n * params: {\n * encryptKey: \"user-encryption-key\",\n * externalUserId: \"user-123\"\n * },\n * bearerToken: userToken\n * });\n *\n * const userWallet = await chipiBrowser.getWallet({ externalUserId: \"user-123\" }, userToken);\n * const txHash = await chipiBrowser.transfer({ params: {...}, bearerToken: userToken });\n * ```\n */\nexport class ChipiBrowserSDK extends ChipiSDK {\n constructor(config: ChipiBrowserSDKConfig) {\n super(config);\n }\n\n // All methods are inherited from ChipiSDK\n // bearerToken parameter is required for each authenticated request\n}\n","// Main Chipi SDK class\nexport { ChipiSDK } from \"./chipi-sdk\";\n\nexport { ChipiServerSDK } from \"./chipi-server-sdk\";\nexport { ChipiBrowserSDK } from \"./chipi-browser-sdk\";\n\n// Paymaster adapter\nexport { ChipiPaymasterAdapter } from \"./paymaster-adapter\";\n\n// Wallet utilities\nexport * from \"./wallets\";\n\n// Transaction utilities\nexport * from \"./transactions\";\n\n// CHIPI → SHHH migration orchestrator (Phase 1 client for the\n// chipi-back endpoints shipped in task #28).\nexport {\n migrateChipiWalletToShhh,\n type MigrateChipiWalletToShhhParams,\n type MigrationOutcome,\n type PrepareMigrateResponse,\n type ExecuteMigrateResponse,\n} from \"./migrate-to-shhh\";\n\n// Sign typed data (local signing, no API calls)\nexport { signTypedData, signTypedDataArray } from \"./sign-typed-data\";\n\n// Session utilities (CHIPI and SHHH wallets)\nexport * from \"./sessions\";\n// Pure builders for owner-signed session management calls (batch a session and\n// its spending policies into one transaction, or sign with your own signer).\nexport {\n buildAddSessionKeyCall,\n buildRevokeSessionKeyCall,\n buildSetSpendingPolicyCall,\n buildRemoveSpendingPolicyCall,\n buildSessionSetupCalls,\n validateSpendingPolicyConfig,\n} from \"./session-calls\";\nexport { normalizeEntrypoints } from \"./session-codec\";\n\n// SKU purchase utilities\nexport * from \"./sku-purchases\";\n\n// SKU utilities\nexport * from \"./skus\";\n\n// SHHH multisig treasury coordination (Plus Wave 9 / P1): the transport client\n// that backs `sdk.treasury` and chipi-react's MultisigTransport contract.\nexport * from \"./treasury\";\n\n// AI API client behind `sdk.ai` (server-only, `sk_`), plus the decision guard.\nexport { ChipiAi, isThinkDecision } from \"./ai\";\n\n// Receipt polling for the hashes every gasless write returns. A revert is a\n// result (`success: false`), not an exception; only \"we don't know yet\"\n// (timeout, transport) throws.\nexport * from \"./wait-for-transaction\";\n\n// Client utilities\nexport * from \"./client\";\n\n// Encryption utilities\nexport * from \"./encryption\";\n\n// x402 Payment Protocol\nexport { X402Facilitator, type X402FacilitatorCreateOptions } from \"./x402/facilitator\";\nexport { X402ShhhClient, type ShhhX402Wallet, type X402ShhhClientConfig } from \"./x402/shhh-client\";\nexport {\n x402Middleware,\n type X402MiddlewareConfig,\n type X402MiddlewareFlatConfig,\n} from \"./x402/middleware\";\n// Opt-in on-chain proof of a payment the payer sent themselves (Transfer event\n// + single use per tx hash). Independent of X402Facilitator.\nexport {\n SessionTxVerifier,\n type SessionTxVerifierConfig,\n type TxHashStore,\n type VerifyTransferParams,\n type VerifyTransferResult,\n type VerifyTransferFailure,\n} from \"./x402/session-tx-verifier\";\n\n// Sign in with Starknet (SNIP-12 login) and account signature checks,\n// including counterfactual (not yet deployed) OpenZeppelin and Argent accounts.\nexport {\n createStarknetSignInTypedData,\n verifyStarknetSignIn,\n SIWS_CHAIN_ID,\n SIWS_DOMAIN_NAME,\n SIWS_DOMAIN_VERSION,\n type StarknetSignInParams,\n type StarknetSignInMessage,\n type VerifyStarknetSignInParams,\n type VerifyStarknetSignInResult,\n type StarknetSignInFailure,\n} from \"./siws\";\nexport {\n isValidStarknetSignature,\n verifyUndeployedStarknetSignature,\n normalizeStarknetAddress,\n COUNTERFACTUAL_ACCOUNT_CLASSES,\n STARKNET_SIGNATURE_VALID,\n type StarknetCallProvider,\n type StarknetDeploymentData,\n type StarknetSignatureCheck,\n type UndeployedSignatureCheck,\n} from \"./starknet-signature\";\n\n// SHHH V8.4 ShhhAccount surface (Wave A + Wave B B1 through B4):\n// pluggable-signer Starknet account. STARK, ED25519, EIP-191, WebAuthn,\n// JWT_APPLE_SUB envelopes, plus recovery, threshold, and migration\n// builders. See `./shhh/` for per-kind sources.\nexport * from \"./shhh\";\n\n// Re-export types\nexport type * from \"@chipi-stack/types\";\n\n// Re-export enums and constants (these need to be exported as values, not just types)\nexport { Chain, ChainToken, Currency } from \"@chipi-stack/types\";\n","/**\n * SHHH V8.4 buyer client for the x402 payment protocol.\n *\n * The CHIPI v29 / Argent `X402Client` (in `@chipi-stack/core`) signs\n * a SNIP-12 typed-data message with `account.signMessage()` and lets\n * the facilitator build the on-chain USDC transfer. That path does\n * not work for SHHH V8.4 wallets: V8.4's\n * `execute_from_outside_v2` at `account.cairo:389` rejects raw\n * `{r, s}` (2-felt) signatures and dispatches based on\n * `signature[0]` to either the V2_SNIP12 envelope path (single-owner\n * primary verifier) or the 4-felt session-sig fast path.\n *\n * `X402ShhhClient` builds the full execute_from_outside_v2 calldata\n * + signs the V8.4 SNIP-12 hash locally with the primary STARK key,\n * then ships the pre-signed span in the `payload.shhh.oeCalldata`\n * field. The facilitator (`X402Facilitator.settle`) detects\n * `payload.shhh` and forwards verbatim through\n * `/transactions/execute-sponsored-raw`. Self-custodial:\n * `encryptKey` decrypts the wallet's STARK key client-side; chipi-\n * back never sees the cleartext.\n *\n * Same `fetch(url, init)` surface as `X402Client` so an integrator\n * can pick the right client at construction time based on their\n * wallet type:\n *\n * const client = wallet.walletType === \"SHHH\"\n * ? new X402ShhhClient({ wallet, encryptKey, chipiClient, bearerToken })\n * : new X402Client(account);\n *\n * Wave B ships STARK + ED25519 primary signers; the SDK rejects\n * other kinds with a clear error so a future external-rooted SHHH\n * wallet (MetaMask, Phantom, passkey, Apple) doesn't silently\n * produce a sig that reverts on chain.\n */\n\nimport { uint256 } from \"starknet\";\nimport type { PaymentRequirement, PaymentPayload, X402ClientConfig } from \"@chipi-stack/types\";\n\nimport { ChipiClient } from \"../client\";\nimport { decryptPrivateKey } from \"../encryption\";\nimport { ANY_CALLER_FELT, buildOutsideExecution, computeOeHash } from \"../shhh/oe\";\nimport { buildStarkEnvelope } from \"../shhh/signers/stark\";\nimport {\n resolveShhhChainId,\n serializeExecuteFromOutsideV2Calldata,\n} from \"../shhh/execute-paymaster-raw\";\n\nconst PAYMENT_REQUIRED_HEADER = \"payment-required\";\nconst DEFAULT_PAYMENT_HEADER = \"X-PAYMENT\";\n\ninterface FetchResponse {\n status: number;\n headers: { get(name: string): string | null };\n}\n\ntype FetchFn = (url: string, init?: any) => Promise<FetchResponse>;\n\n/**\n * The minimal wallet shape the SHHH client needs to sign payments.\n * Matches the `WalletData`-derived row callers already pass to the\n * rest of the SDK.\n */\nexport interface ShhhX402Wallet {\n /** Deployed account address (NOT the raw STARK pubkey). */\n publicKey: string;\n /** Wallet's PIN/passkey-encrypted STARK private key (ciphertext). */\n encryptedPrivateKey: string;\n /**\n * Defaults to `\"STARK\"`. Future external-rooted kinds will need\n * their own signing path; the client throws when handed an\n * unsupported kind so silent on-chain reverts are impossible.\n */\n signerKind?: \"STARK\" | \"ED25519\";\n}\n\nexport interface X402ShhhClientConfig extends X402ClientConfig {\n /**\n * Override the chain id used for SHHH SNIP-12 hashing. Defaults to\n * Starknet mainnet per CLAUDE.md; sepolia is auto-inferred from\n * the chipi-back base URL when present. Drift here = the on-chain\n * V8.4 wallet rejects the signature.\n */\n chainId?: bigint | string;\n}\n\n/**\n * SHHH-aware buyer client.\n */\nexport class X402ShhhClient {\n private readonly wallet: ShhhX402Wallet;\n private readonly encryptKey: string;\n private readonly chipiClient: ChipiClient;\n private readonly bearerToken: string;\n private readonly config: Required<Pick<X402ClientConfig, \"headerName\">> & X402ShhhClientConfig;\n private readonly fetchFn: FetchFn;\n\n constructor(opts: {\n /** The SHHH wallet making the payment. */\n wallet: ShhhX402Wallet;\n /** PIN / passkey-derived encryption key for the wallet's STARK key. */\n encryptKey: string;\n /** Chipi HTTP client; only used by the facilitator side. The client side\n * keeps it for forward-compat if a future verifier flow needs to\n * query chipi-back's chain-id helper at sign-time. */\n chipiClient: ChipiClient;\n /** Bearer token for chipi-back. Server-side only; never crosses the wire\n * to an x402 seller. */\n bearerToken: string;\n config?: X402ShhhClientConfig;\n }) {\n this.wallet = opts.wallet;\n this.encryptKey = opts.encryptKey;\n this.chipiClient = opts.chipiClient;\n this.bearerToken = opts.bearerToken;\n this.config = {\n headerName: DEFAULT_PAYMENT_HEADER,\n ...opts.config,\n };\n this.fetchFn = (globalThis as any).fetch;\n }\n\n /**\n * Drop-in `fetch` replacement. If the seller returns 402, signs a\n * payment + retries with the X-PAYMENT header. Same surface as\n * `X402Client.fetch`.\n */\n async fetch(url: string, init?: Record<string, any>): Promise<FetchResponse> {\n const response = await this.fetchFn(url, init);\n if (response.status !== 402) {\n return response;\n }\n\n const requirement = this.parsePaymentRequired(response);\n this.validateRequirement(requirement);\n const payment = await this.signPayment(requirement);\n return this.retryWithPayment(url, init, payment);\n }\n\n parsePaymentRequired(response: FetchResponse): PaymentRequirement {\n const headerValue = response.headers.get(PAYMENT_REQUIRED_HEADER);\n if (!headerValue) {\n throw new Error(\n \"Server returned 402 but no PAYMENT-REQUIRED header. The server may not support x402 or is misconfigured.\"\n );\n }\n let requirement: PaymentRequirement;\n try {\n requirement = JSON.parse(headerValue);\n } catch {\n throw new Error(\n `Malformed PAYMENT-REQUIRED header: invalid JSON. Got: \"${headerValue.slice(0, 100)}\"`\n );\n }\n if (!requirement.scheme || !requirement.network || !requirement.maxAmountRequired) {\n throw new Error(\n \"Invalid payment requirement: missing required fields (scheme, network, maxAmountRequired)\"\n );\n }\n if (requirement.scheme !== \"exact\") {\n throw new Error(\n `Unsupported payment scheme: \"${requirement.scheme}\". This client only supports \"exact\".`\n );\n }\n if (requirement.network !== \"starknet-mainnet\") {\n throw new Error(\n `Unsupported payment network: \"${requirement.network}\". This client only supports \"starknet-mainnet\" per CLAUDE.md.`\n );\n }\n return requirement;\n }\n\n private validateRequirement(req: PaymentRequirement): void {\n if (\n this.config.allowedRecipients &&\n this.config.allowedRecipients.length > 0 &&\n !this.config.allowedRecipients.includes(req.payTo)\n ) {\n throw new Error(\n `Payment recipient ${req.payTo} not in allowed list. Update X402ShhhClientConfig.allowedRecipients to permit this seller.`\n );\n }\n if (this.config.maxPaymentAmount) {\n const maxBaseUnits = humanUsdcToBaseUnits(this.config.maxPaymentAmount, 6);\n if (BigInt(req.maxAmountRequired) > maxBaseUnits) {\n throw new Error(\n `Payment amount ${req.maxAmountRequired} exceeds client max ${this.config.maxPaymentAmount} USDC.`\n );\n }\n }\n }\n\n /**\n * Sign an x402 payment as a SHHH V8.4 buyer. Builds the V8.4 OE\n * containing the single USDC.transfer call, computes the SNIP-12\n * hash against the wallet address + chain id, signs locally with\n * the decrypted STARK private key, wraps the result in a V2_SNIP12\n * envelope, and serializes the full execute_from_outside_v2\n * calldata. Returns a PaymentPayload with the `shhh` extension\n * populated; the facilitator's settle branch forwards\n * `payload.shhh.oeCalldata` verbatim to\n * `/transactions/execute-sponsored-raw`.\n *\n * The `signature: {r, s}` field is also populated with the inner\n * `(r, s)` pair so the wire format stays valid for receivers that\n * only inspect the legacy field. The facilitator uses the SHHH\n * branch when `payload.shhh` is present, so the redundant `{r, s}`\n * is informational, not load-bearing.\n */\n async signPayment(requirement: PaymentRequirement): Promise<PaymentPayload> {\n const signerKind = this.wallet.signerKind ?? \"STARK\";\n if (signerKind !== \"STARK\") {\n throw new Error(\n `X402ShhhClient currently supports signerKind=\"STARK\" only; got \"${signerKind}\". ` +\n `ED25519 + external-rooted (MetaMask, Phantom, passkey, Apple) x402 buyers ` +\n `ship in a follow-on PR.`\n );\n }\n\n const nonce = generateNonce();\n const validUntil = Math.floor(Date.now() / 1000) + requirement.maxTimeoutSeconds;\n\n // Build the USDC.transfer(toAddress, amount) call.\n const amountU256 = uint256.bnToUint256(BigInt(requirement.maxAmountRequired));\n const transferCall = {\n contractAddress: requirement.asset,\n entrypoint: \"transfer\",\n calldata: [requirement.payTo, amountU256.low.toString(), amountU256.high.toString()],\n };\n\n // V8.4 OE. Caller is ANY (paymaster sponsorship). nonce → hex via\n // TextEncoder (UTF-8) instead of Node's Buffer so X402ShhhClient\n // works in browser bundles too (it's re-exported from\n // @chipi-stack/x402 which integrators pull in client-side).\n const oe = buildOutsideExecution({\n nonce: BigInt(\"0x\" + nonceToHexFelt(nonce)),\n calls: [transferCall],\n caller: ANY_CALLER_FELT,\n });\n\n const chainId = resolveShhhChainId({\n override: this.config.chainId,\n baseUrl: this.chipiClient.baseUrl,\n });\n const messageHash = computeOeHash(oe, this.wallet.publicKey, chainId);\n\n // Self-custodial: decrypt the STARK key client-side, sign, throw\n // the cleartext away one async tick later. Cleartext never crosses\n // the wire.\n const privateKeyHex = decryptPrivateKey(this.wallet.encryptedPrivateKey, this.encryptKey);\n if (!privateKeyHex) {\n throw new Error(\n \"Failed to decrypt SHHH STARK private key for x402 payment. Verify the encryptKey matches the wallet creation key.\"\n );\n }\n\n const envelope = buildStarkEnvelope({\n privateKey: privateKeyHex,\n messageHash,\n });\n\n const oeCalldata = serializeExecuteFromOutsideV2Calldata({\n outsideExecution: oe,\n signature: envelope,\n });\n\n // Surface (r, s) on the wire-format compatibility field. The\n // envelope's last two felts are r, s in build order:\n // [V2_SNIP12, owner_id, kind_tag, r, s] for STARK.\n const r = envelope[envelope.length - 2] ?? 0n;\n const s = envelope[envelope.length - 1] ?? 0n;\n\n return {\n x402Version: 1,\n scheme: \"exact\",\n network: \"starknet-mainnet\",\n payload: {\n signature: {\n r: \"0x\" + r.toString(16),\n s: \"0x\" + s.toString(16),\n },\n fromAddress: this.wallet.publicKey,\n toAddress: requirement.payTo,\n amount: requirement.maxAmountRequired,\n asset: requirement.asset,\n validUntil,\n nonce,\n shhh: {\n walletType: \"SHHH\",\n signerKind,\n oeCalldata,\n },\n },\n };\n }\n\n private async retryWithPayment(\n url: string,\n init: Record<string, any> | undefined,\n payment: PaymentPayload\n ): Promise<FetchResponse> {\n // init.headers may be a Record, a Headers instance, or string[][] per\n // the fetch HeadersInit type. A naive object spread silently drops\n // Headers and string[][] entries. Normalize through the runtime\n // Headers API when available so all three input shapes round-trip\n // and the X-PAYMENT header is appended without clobbering callers.\n const HeadersCtor = (globalThis as any).Headers;\n const headerName = this.config.headerName;\n const paymentJson = JSON.stringify(payment);\n\n let headers: any;\n if (typeof HeadersCtor === \"function\") {\n const merged = new HeadersCtor(init?.headers);\n merged.set(headerName, paymentJson);\n headers = merged;\n } else {\n // Node fallback (Headers always exists on 18+ but stay defensive)\n const existing: Record<string, string> = (init?.headers as any) ?? {};\n headers = { ...existing, [headerName]: paymentJson };\n }\n return this.fetchFn(url, { ...init, headers });\n }\n}\n\nfunction humanUsdcToBaseUnits(amount: string, decimals: number): bigint {\n const [whole, frac = \"\"] = amount.trim().split(\".\");\n const fracPadded = (frac + \"0\".repeat(decimals)).slice(0, decimals);\n return BigInt((whole || \"0\") + fracPadded);\n}\n\nfunction generateNonce(): string {\n if (typeof (globalThis as any).crypto?.randomUUID === \"function\") {\n return (globalThis as any).crypto.randomUUID();\n }\n return `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;\n}\n\n/**\n * Convert a string nonce into a felt-safe hex prefix.\n *\n * Equivalent to `Buffer.from(s).toString(\"hex\").slice(0, 60).padStart(60, \"0\")`\n * but uses TextEncoder so the function works in both Node and browsers\n * (Buffer is a Node-only global; X402ShhhClient is re-exported from\n * @chipi-stack/x402 and may land in browser bundles).\n *\n * The 60-hex-char slice keeps the resulting BigInt comfortably below\n * 2^248 — well inside the felt252 field. Matches the construction the\n * V8.4 reference scripts use in shhh-wallet-cairo.\n */\nfunction nonceToHexFelt(nonce: string): string {\n const bytes = new TextEncoder().encode(nonce);\n let hex = \"\";\n for (const b of bytes) {\n hex += b.toString(16).padStart(2, \"0\");\n }\n return hex.slice(0, 60).padStart(60, \"0\");\n}\n","import type { PaymentRequirement, X402PaymentConfig } from \"@chipi-stack/types\";\nimport { CONTRACT_ADDRESSES, TOKEN_DECIMALS } from \"@chipi-stack/shared\";\nimport type { X402Facilitator } from \"./facilitator\";\n\nexport interface X402MiddlewareConfig {\n /** x402 facilitator instance for verify + settle */\n facilitator: X402Facilitator;\n /** Payment configuration for this endpoint */\n paymentConfig: X402PaymentConfig;\n /** Verify-only mode: verify payment but don't settle (default: false) */\n verifyOnly?: boolean;\n}\n\n/**\n * Flat convenience config — detected when `amount` + `recipient` are present.\n * Avoids nesting paymentConfig.\n */\nexport interface X402MiddlewareFlatConfig {\n /** x402 facilitator instance */\n facilitator: X402Facilitator;\n /** Amount in human-readable USDC (e.g. \"0.01\") */\n amount: string;\n /** Recipient (merchant) address */\n recipient: string;\n /** Human-readable description */\n description?: string;\n /** Verify-only mode (default: false) */\n verifyOnly?: boolean;\n}\n\n/**\n * Convert human-readable USDC amount to base units using string arithmetic (no float).\n */\nfunction amountToBaseUnits(amount: string, decimals: number): string {\n const [whole, frac = \"\"] = amount.split(\".\");\n const fracPadded = (frac + \"0\".repeat(decimals)).slice(0, decimals);\n return String(BigInt(whole + fracPadded));\n}\n\n/**\n * Build a PaymentRequirement from middleware config + request URL.\n */\nfunction buildPaymentRequirement(config: X402PaymentConfig, resource: string): PaymentRequirement {\n const amountBaseUnits = amountToBaseUnits(config.amount, TOKEN_DECIMALS.USDC);\n\n return {\n scheme: \"exact\",\n network: \"starknet-mainnet\",\n maxAmountRequired: amountBaseUnits,\n resource,\n description: config.description,\n payTo: config.payTo,\n maxTimeoutSeconds: 300,\n asset: CONTRACT_ADDRESSES.USDC_MAINNET,\n };\n}\n\nfunction isFlatConfig(\n config: X402MiddlewareConfig | X402MiddlewareFlatConfig\n): config is X402MiddlewareFlatConfig {\n return \"amount\" in config && \"recipient\" in config;\n}\n\nfunction resolveConfig(\n config: X402MiddlewareConfig | X402MiddlewareFlatConfig\n): X402MiddlewareConfig {\n if (isFlatConfig(config)) {\n return {\n facilitator: config.facilitator,\n paymentConfig: {\n amount: config.amount,\n payTo: config.recipient,\n description: config.description,\n },\n verifyOnly: config.verifyOnly,\n };\n }\n return config;\n}\n\n/**\n * Express-compatible middleware for monetizing API endpoints with x402.\n *\n * When no X-PAYMENT header is present, returns 402 with payment requirement.\n * When a valid payment is present, verifies and settles it, then calls next().\n * The settled transaction info is attached to `req.x402`.\n *\n * @example\n * ```typescript\n * // Nested config (original)\n * x402Middleware({\n * facilitator,\n * paymentConfig: { amount: \"0.01\", payTo: \"0xYOUR_ADDRESS\" },\n * })\n *\n * // Flat config (convenience)\n * x402Middleware({\n * facilitator,\n * amount: \"0.01\",\n * recipient: \"0xYOUR_ADDRESS\",\n * })\n * ```\n */\nexport function x402Middleware(config: X402MiddlewareConfig | X402MiddlewareFlatConfig) {\n const resolved = resolveConfig(config);\n return async (req: any, res: any, next: any) => {\n // Skip CORS preflight\n if (req.method === \"OPTIONS\") {\n return next();\n }\n\n const paymentHeader = req.headers?.[\"x-payment\"] ?? req.headers?.[\"X-PAYMENT\"];\n\n if (!paymentHeader) {\n // Return 402 with payment requirement\n const resource =\n req.protocol && req.get\n ? `${req.protocol}://${req.get(\"host\")}${req.originalUrl}`\n : (req.url ?? \"\");\n const requirement = buildPaymentRequirement(resolved.paymentConfig, resource);\n\n return res.status(402).set(\"Payment-Required\", JSON.stringify(requirement)).json({\n error: \"Payment Required\",\n paymentRequirement: requirement,\n });\n }\n\n // Parse payment\n let payment;\n try {\n payment = typeof paymentHeader === \"string\" ? JSON.parse(paymentHeader) : paymentHeader;\n } catch {\n return res.status(400).json({ error: \"Malformed X-PAYMENT header: invalid JSON\" });\n }\n\n // Validate payload shape before accessing fields\n const payload = payment?.payload;\n const toAddress = typeof payload?.toAddress === \"string\" ? payload.toAddress : null;\n const amount = typeof payload?.amount === \"string\" ? payload.amount : null;\n const asset = typeof payload?.asset === \"string\" ? payload.asset : null;\n\n if (!toAddress || !amount || !asset) {\n return res\n .status(400)\n .json({ error: \"Malformed X-PAYMENT payload: missing required fields\" });\n }\n\n // Enforce payment matches endpoint config (amount, recipient, asset)\n const requirement = buildPaymentRequirement(resolved.paymentConfig, \"\");\n const normalizeAddr = (a: string) => a.toLowerCase().replace(/^0x0+/, \"0x\");\n\n if (normalizeAddr(toAddress) !== normalizeAddr(resolved.paymentConfig.payTo)) {\n return res.status(402).json({\n error: \"Payment recipient mismatch\",\n reason: `Expected ${resolved.paymentConfig.payTo}, got ${toAddress}`,\n });\n }\n\n let paidAmount: bigint;\n try {\n paidAmount = BigInt(amount);\n } catch {\n return res\n .status(400)\n .json({ error: \"Malformed X-PAYMENT payload\", reason: \"amount must be an integer string\" });\n }\n\n if (paidAmount < BigInt(requirement.maxAmountRequired)) {\n return res.status(402).json({\n error: \"Payment amount insufficient\",\n reason: `Required ${requirement.maxAmountRequired} base units, got ${amount}`,\n });\n }\n\n if (normalizeAddr(asset) !== normalizeAddr(requirement.asset)) {\n return res.status(402).json({\n error: \"Payment asset mismatch\",\n reason: `Expected USDC, got ${asset}`,\n });\n }\n\n // Verify + Settle with error boundary\n try {\n const verified = await resolved.facilitator.verify(payment);\n if (!verified.isValid) {\n return res.status(402).json({\n error: \"Payment verification failed\",\n reason: verified.invalidReason,\n });\n }\n\n // Settle (unless verify-only mode)\n if (!resolved.verifyOnly) {\n const settled = await resolved.facilitator.settle(payment);\n if (!settled.success) {\n return res.status(402).json({\n error: \"Payment settlement failed\",\n reason: settled.errorReason,\n });\n }\n\n // Attach payment info to request\n req.x402 = {\n txHash: settled.transactionHash,\n payment,\n networkId: settled.networkId,\n };\n } else {\n req.x402 = { payment };\n }\n } catch (err) {\n const message = err instanceof Error ? err.message : String(err);\n return res.status(500).json({\n error: \"Payment processing error\",\n reason: message,\n });\n }\n\n next();\n };\n}\n","import { typedData as starknetTypedData, type TypedData } from \"starknet\";\nimport {\n isValidStarknetSignature,\n normalizeStarknetAddress,\n verifyUndeployedStarknetSignature,\n type StarknetCallProvider,\n type StarknetDeploymentData,\n} from \"./starknet-signature\";\n\n/**\n * Sign in with Starknet (SIWS): the SNIP-12 equivalent of Sign-In with\n * Ethereum. The server issues a one-time nonce, the wallet signs this typed\n * data, and the server checks the signature with the account itself.\n *\n * The typed data is kept to what every wallet accepts: SNIP-12 revision 1,\n * mainnet chain id in the domain, single-line printable ASCII strings (Bramble\n * refuses anything else), and no custom `u256`.\n */\n\nexport const SIWS_DOMAIN_NAME = \"Sign in with Starknet\";\nexport const SIWS_DOMAIN_VERSION = \"1\";\nexport const SIWS_CHAIN_ID = \"SN_MAIN\";\n\nexport interface StarknetSignInParams {\n /** Host asking for the sign-in, e.g. \"vela-starknet.vercel.app\". */\n domain: string;\n /** Full URL of the app, e.g. \"https://vela-starknet.vercel.app\". */\n uri: string;\n /** Account that signs. Any padding; stored as 0x + 64 hex. */\n address: string;\n /** One-time server nonce (letters and digits). */\n nonce: string;\n /** Shown to the user in the wallet. */\n statement?: string;\n /** Unix seconds. Defaults to now. */\n issuedAt?: number;\n /** Unix seconds. */\n expirationTime: number;\n}\n\nexport interface StarknetSignInMessage {\n domain: string;\n address: string;\n statement: string;\n uri: string;\n nonce: string;\n issuedAt: number;\n expirationTime: number;\n}\n\nconst DEFAULT_STATEMENT = \"Sign in. This request costs nothing and moves no funds.\";\n\nfunction assertPrintableAscii(field: string, value: string): void {\n if (!/^[\\x20-\\x7e]*$/.test(value)) {\n throw new Error(`SIWS ${field} must be single-line printable ASCII`);\n }\n}\n\n/** Typed data for the wallet's `wallet_signTypedData`. */\nexport function createStarknetSignInTypedData(params: StarknetSignInParams): TypedData {\n const message: StarknetSignInMessage = {\n domain: params.domain,\n address: normalizeStarknetAddress(params.address),\n statement: params.statement ?? DEFAULT_STATEMENT,\n uri: params.uri,\n nonce: params.nonce,\n issuedAt: params.issuedAt ?? Math.floor(Date.now() / 1000),\n expirationTime: params.expirationTime,\n };\n for (const field of [\"domain\", \"statement\", \"uri\", \"nonce\"] as const) {\n assertPrintableAscii(field, message[field]);\n }\n if (!/^[A-Za-z0-9]{8,}$/.test(message.nonce)) {\n throw new Error(\"SIWS nonce must be at least 8 letters or digits\");\n }\n if (!Number.isInteger(message.issuedAt) || !Number.isInteger(message.expirationTime)) {\n throw new Error(\"SIWS times must be whole unix seconds\");\n }\n if (message.expirationTime <= message.issuedAt) {\n throw new Error(\"SIWS expirationTime must be after issuedAt\");\n }\n\n return {\n types: {\n StarknetDomain: [\n { name: \"name\", type: \"shortstring\" },\n { name: \"version\", type: \"shortstring\" },\n { name: \"chainId\", type: \"shortstring\" },\n { name: \"revision\", type: \"shortstring\" },\n ],\n SignIn: [\n { name: \"domain\", type: \"string\" },\n { name: \"address\", type: \"ContractAddress\" },\n { name: \"statement\", type: \"string\" },\n { name: \"uri\", type: \"string\" },\n { name: \"nonce\", type: \"string\" },\n { name: \"issuedAt\", type: \"timestamp\" },\n { name: \"expirationTime\", type: \"timestamp\" },\n ],\n },\n primaryType: \"SignIn\",\n domain: {\n name: SIWS_DOMAIN_NAME,\n version: SIWS_DOMAIN_VERSION,\n chainId: SIWS_CHAIN_ID,\n revision: \"1\",\n },\n message: { ...message },\n };\n}\n\nexport interface VerifyStarknetSignInParams {\n /** The typed data the wallet signed, as returned to the client. */\n typedData: TypedData;\n /** The wallet's `wallet_signTypedData` result (hex or decimal felts). */\n signature: Array<string | number | bigint>;\n /** Mainnet RPC (starknet.js `RpcProvider` or anything with `callContract`). */\n provider: StarknetCallProvider;\n /** What this server issued. Anything else is refused. */\n expected: { domain: string; uri: string; nonce: string; now?: number };\n /**\n * The wallet's `wallet_deploymentData`, for accounts not deployed yet\n * (new Bramble/Ready accounts). Only used when the RPC says the account\n * does not exist.\n */\n deploymentData?: StarknetDeploymentData;\n}\n\nexport type StarknetSignInFailure =\n | \"MALFORMED\"\n | \"WRONG_CHAIN\"\n | \"WRONG_DOMAIN\"\n | \"WRONG_URI\"\n | \"WRONG_NONCE\"\n | \"EXPIRED\"\n | \"NOT_YET_VALID\"\n | \"INVALID_SIGNATURE\"\n | \"ACCOUNT_NOT_DEPLOYED\"\n | \"UNSUPPORTED_ACCOUNT_CLASS\"\n | \"ADDRESS_MISMATCH\";\n\nexport type VerifyStarknetSignInResult =\n | { ok: true; address: string; message: StarknetSignInMessage }\n | { ok: false; reason: StarknetSignInFailure };\n\n/** Clock skew tolerated on `issuedAt`. */\nconst MAX_SKEW_SECONDS = 60;\n\n/**\n * Verifies a SIWS signature. The typed data is rebuilt from its message with\n * `createStarknetSignInTypedData`, so a client can't swap in other types or a\n * testnet domain; then the account is asked with `is_valid_signature`, or, if\n * it isn't deployed yet and `deploymentData` is given, checked off-chain.\n *\n * The caller still owns the nonce: issue it once, and consume it before or\n * right after calling this (never accept the same nonce twice).\n */\nexport async function verifyStarknetSignIn(\n params: VerifyStarknetSignInParams\n): Promise<VerifyStarknetSignInResult> {\n const { typedData, signature, provider, expected, deploymentData } = params;\n const raw = typedData?.message as Partial<StarknetSignInMessage> | undefined;\n if (!raw || !Array.isArray(signature) || signature.length === 0) {\n return { ok: false, reason: \"MALFORMED\" };\n }\n if (typedData.domain?.chainId !== SIWS_CHAIN_ID) return { ok: false, reason: \"WRONG_CHAIN\" };\n\n let canonical: TypedData;\n let message: StarknetSignInMessage;\n try {\n canonical = createStarknetSignInTypedData({\n domain: String(raw.domain),\n uri: String(raw.uri),\n address: String(raw.address),\n nonce: String(raw.nonce),\n statement: String(raw.statement),\n issuedAt: Number(raw.issuedAt),\n expirationTime: Number(raw.expirationTime),\n });\n message = canonical.message as unknown as StarknetSignInMessage;\n } catch {\n return { ok: false, reason: \"MALFORMED\" };\n }\n\n if (message.domain !== expected.domain) return { ok: false, reason: \"WRONG_DOMAIN\" };\n if (message.uri !== expected.uri) return { ok: false, reason: \"WRONG_URI\" };\n if (message.nonce !== expected.nonce) return { ok: false, reason: \"WRONG_NONCE\" };\n const now = expected.now ?? Math.floor(Date.now() / 1000);\n if (now >= message.expirationTime) return { ok: false, reason: \"EXPIRED\" };\n if (message.issuedAt > now + MAX_SKEW_SECONDS) return { ok: false, reason: \"NOT_YET_VALID\" };\n\n const messageHash = starknetTypedData.getMessageHash(canonical, message.address);\n const onChain = await isValidStarknetSignature(provider, message.address, messageHash, signature);\n if (onChain.valid) return { ok: true, address: message.address, message };\n if (onChain.reason !== \"ACCOUNT_NOT_DEPLOYED\") return { ok: false, reason: \"INVALID_SIGNATURE\" };\n\n if (!deploymentData) return { ok: false, reason: \"ACCOUNT_NOT_DEPLOYED\" };\n if (normalizeStarknetAddress(deploymentData.address) !== message.address) {\n return { ok: false, reason: \"ADDRESS_MISMATCH\" };\n }\n const offChain = verifyUndeployedStarknetSignature(deploymentData, messageHash, signature);\n return offChain.valid\n ? { ok: true, address: message.address, message }\n : { ok: false, reason: offChain.reason };\n}\n","/**\n * @chipi-stack/backend SHHH V8.4 ShhhAccount integration surface.\n *\n * Wave A PR 1: SNIP-12 hashing, deterministic address derivation, OE\n * construction, and the STARK signer. Cycle 1 kinds (ED25519,\n * EIP191_SECP256K1, WEBAUTHN_P256) ship in follow-up PRs.\n *\n * Class hashes + per-kind gas overhead live in @chipi-stack/shared\n * (WALLET_CLASS_HASHES.SHHH, SHHH_VERIFIER_CLASS_HASHES,\n * SHHH_KIND_GAS_OVERHEAD). The kill switch is enforced by\n * chipi-back's wallets.service.ts (CHIPI_SHHH_ENABLED env var).\n */\n\nexport {\n computeSnip12Hash,\n hashCall,\n hashCalls,\n hashOutsideExecutionStruct,\n hashStarknetDomain,\n snip12HashToHexAsciiBytes,\n ISIGNER_CANONICAL_LABEL,\n ISIGNER_ID,\n ISRC9_V2_ID,\n OE_DOMAIN_NAME,\n OE_DOMAIN_REVISION,\n OE_DOMAIN_VERSION,\n STARKNET_MESSAGE_PREFIX,\n SIG_VERSION_V1_HEX_ASCII,\n SIG_VERSION_V2_SNIP12,\n SIG_VERSION_V2_THRESHOLD,\n computeISignerId,\n type OutsideExecution,\n} from \"./snip12-hash\";\n\nexport {\n computeAddressSalt,\n computeShhhAddress,\n ownerCommitment,\n type ComputeAddressInput,\n} from \"./compute-wallet-address\";\n\nexport {\n buildOutsideExecution,\n computeOeHash,\n wrapV2Snip12Envelope,\n wrapV2ThresholdEnvelope,\n ANY_CALLER_FELT,\n MAX_OE_VALIDITY_WINDOW_SECONDS,\n} from \"./oe\";\n\nexport { buildStarkEnvelope, starkOwnerId, starkPubkeyFelts } from \"./signers/stark\";\n\nexport {\n buildEd25519Envelope,\n buildEd25519EnvelopeFromSignature,\n ed25519OwnerId,\n ed25519OwnerPubkeyParam,\n ed25519PubkeyFelts,\n ed25519SignedBytes,\n} from \"./signers/ed25519\";\n\nexport {\n buildEip191EnvelopeFromPrivateKey,\n buildEip191EnvelopeFromSignature,\n eip191OwnerId,\n eip191OwnerPubkeyParam,\n eip191PubkeyFelts,\n parseEip191Signature,\n type Eip191Pubkey,\n} from \"./signers/eip191\";\n\nexport {\n buildWebAuthnEnvelopeFromAssertion,\n buildWebAuthnEnvelopeFromPrivateKey,\n byteArrayToFelts,\n parseDerEcdsaSignature,\n webauthnOwnerId,\n webauthnOwnerPubkeyParam,\n webauthnPubkeyFelts,\n type WebAuthnPubkey,\n} from \"./signers/webauthn\";\n\nexport {\n APPLE_ISSUER,\n buildJwtAppleSubEnvelopeFromTestKey,\n buildJwtAppleSubEnvelopeFromTokenResponse,\n jwtAppleSubHash,\n jwtAppleSubOwnerId,\n jwtAppleSubPubkeyFelts,\n locateSubClaim,\n messageHashToNonceB64url,\n parseAppleIdToken,\n type AppleTokenResponse,\n type JwtAppleSubPubkey,\n} from \"./signers/jwt_apple_sub\";\n\nexport {\n // Multi-owner governance builders\n buildProposeAddOwnerCall,\n buildExecuteAddOwnerCall,\n buildProposeRemoveOwnerCall,\n buildExecuteRemoveOwnerCall,\n buildProposeRotateOwnerCall,\n buildExecuteRotateOwnerCall,\n buildProposeSetThresholdCall,\n buildExecuteSetThresholdCall,\n buildCancelPendingOpCall,\n // Recovery builders\n buildInitiateRecoveryCall,\n buildCancelRecoveryCall,\n buildFinalizeRecoveryCall,\n // Constants\n OP_ADD_OWNER,\n OP_REMOVE_OWNER,\n OP_ROTATE_OWNER,\n OP_SET_THRESHOLD,\n ROLE_OWNER,\n ROLE_GUARDIAN,\n TIMELOCK_SECONDS,\n DEFAULT_OP_EXPIRY_SECONDS,\n VIEW_SELECTORS,\n // Helpers\n isReadyToExecute,\n secondsUntilExecutable,\n type NewOwnerInput,\n type OwnerRole,\n} from \"./recovery\";\n\nexport {\n MIN_THRESHOLD_OWNERS,\n assertValidV2Snip12Envelope,\n buildThresholdEnvelope,\n estimateThresholdGasOverhead,\n parseThresholdEnvelope,\n} from \"./threshold\";\n\nexport {\n BOOTSTRAP_DOMAIN_SEPARATOR,\n buildBootstrapSignedCall,\n buildMigrationCalls,\n computeBootstrapMessage,\n labelToFelt,\n signBootstrapMessage,\n type BootstrapMessageParams,\n type BuildBootstrapSignedCallParams,\n type BuildMigrationCallsParams,\n} from \"./migrate\";\n\n// Paymaster-sponsored OE execution path. `executeShhhSponsoredRaw` is\n// the one-call orchestrator that integrators reach for when they want\n// to fire an arbitrary call list against an already-deployed SHHH\n// wallet:\n//\n// 1. decrypts the wallet's stored encrypted STARK (or Ed25519)\n// private key using the supplied PIN / passkey-derived secret\n// 2. builds the V8.4 OutsideExecution wrapping the call list\n// 3. signs the SNIP-12 hash with the matching signer envelope\n// 4. serializes the calldata for `execute_from_outside_v2`\n// 5. POSTs to chipi-back's `/transactions/execute-sponsored-raw`\n// and returns the on-chain transaction hash\n//\n// The two lower-level helpers are surfaced for advanced flows:\n// - `serializeExecuteFromOutsideV2Calldata` — Cairo serde of an\n// OE + signature span into the felt-array calldata expected by\n// the V8.4 `execute_from_outside_v2` selector. Use when you need\n// to build the calldata yourself (e.g. external signing path).\n// - `resolveShhhChainId` — chain-id resolver for SNIP-12 hashing.\n// Defaults to Starknet mainnet (`SN_MAIN`); auto-infers\n// `SN_SEPOLIA` from a sepolia chipi-back base URL when present;\n// pass an explicit override to force a value.\nexport {\n executeShhhSponsoredRaw,\n serializeExecuteFromOutsideV2Calldata,\n resolveShhhChainId,\n} from \"./execute-paymaster-raw\";\n\n// ShhhAccount — drop-in adapter that signs as a SHHH owner from a raw\n// STARK private key and broadcasts via `execute_from_outside_v2` (the\n// standard starknet.js `Account.execute` path is disabled on a SHHH\n// account). Pairs with the wallet's \"export private key\" flow.\nexport {\n ShhhAccount,\n submitViaAccount,\n type ShhhSubmit,\n type ShhhAccountOptions,\n type ShhhSignedExecution,\n type ShhhExecuteOptions,\n} from \"./account\";\n","/**\n * EIP-191 secp256k1 signer for SHHH V8.4 ShhhAccount.\n *\n * The signer kind for MetaMask + any EVM wallet that exposes the\n * `personal_sign` RPC. The wallet computes\n * keccak256(\"\\x19Ethereum Signed Message:\\n32\" || msg_be32)\n * internally and signs with secp256k1; the V8.4 EIP191Secp256k1Verifier\n * (class `0x03a75997…084e6`) reproduces the same prefix-and-hash and\n * recovers the signing key from (r, s, y_parity) to compare to the\n * stored pubkey.\n *\n * Reference: shhh-wallet-cairo/scripts/ts/gen-eip191-fixture.mjs\n *\n * Verifier overhead: ~10M l2_gas (per SHHH_KIND_GAS_OVERHEAD).\n *\n * Two builder entry points:\n * - buildEip191EnvelopeFromSignature: production / MetaMask flow.\n * Caller already has the 65-byte signature back from `personal_sign`\n * and the wallet's pubkey (either pre-known or recovered).\n * - buildEip191EnvelopeFromPrivateKey: test / Chipi-held-key flow.\n * Sign locally with a known secp256k1 private key.\n *\n * Both produce the identical V2_SNIP12 envelope shape:\n * [V2_SNIP12, owner_id, EIP191_SECP256K1_tag,\n * r.low, r.high, s.low, s.high, y_parity]\n */\n\nimport { shortString } from \"starknet\";\nimport { ownerCommitment } from \"../compute-wallet-address\";\nimport { wrapV2Snip12Envelope } from \"../oe\";\n\nconst EIP191_KIND_TAG = \"EIP191_SECP256K1\";\nconst EIP191_KIND_TAG_FELT = BigInt(shortString.encodeShortString(EIP191_KIND_TAG));\n\nconst SECP256K1_ORDER = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n;\n\n/**\n * Uncompressed secp256k1 public key, split into 4 felt252-sized halves\n * matching what Cairo's EIP191 verifier expects in\n * `validate_pubkey` — `[x.low, x.high, y.low, y.high]` (big-endian\n * scalar, low_u128 first).\n */\nexport interface Eip191Pubkey {\n /** 32-byte big-endian X coordinate. */\n x: Uint8Array;\n /** 32-byte big-endian Y coordinate. */\n y: Uint8Array;\n}\n\nfunction assertBytes(name: string, b: Uint8Array, len: number): void {\n if (b.length !== len) {\n throw new Error(`${name} must be exactly ${len} bytes; got ${b.length}.`);\n }\n}\n\nfunction bytesBeToU256(b: Uint8Array): { low: bigint; high: bigint } {\n assertBytes(\"secp256k1 32B value\", b, 32);\n let x = 0n;\n for (let i = 0; i < b.length; i++) x = (x << 8n) | BigInt(b[i]);\n return { low: x & ((1n << 128n) - 1n), high: x >> 128n };\n}\n\n/**\n * Pubkey felt layout for the V8.4 constructor / propose_add_owner.\n * Returns `[x.low, x.high, y.low, y.high]` (each u128).\n */\nexport function eip191PubkeyFelts(pubkey: Eip191Pubkey): bigint[] {\n const x = bytesBeToU256(pubkey.x);\n const y = bytesBeToU256(pubkey.y);\n return [x.low, x.high, y.low, y.high];\n}\n\n/**\n * Compute the V8.4 owner_id for an EIP-191 owner.\n * owner_id = owner_commitment(EIP191_tag, [x.low, x.high, y.low, y.high]).\n */\nexport function eip191OwnerId(pubkey: Eip191Pubkey): bigint {\n return ownerCommitment(EIP191_KIND_TAG_FELT, eip191PubkeyFelts(pubkey));\n}\n\n/**\n * The `ownerPubkey` string for the treasury coordination endpoints\n * (`sdk.treasury.forTreasury({ ownerPubkey })`): `\"0x<x>,0x<y>\"` — the\n * FULL 32-byte BE coordinates of the uncompressed secp256k1 point, NOT\n * the 4 `eip191PubkeyFelts` halves. chipi-back's OwnerSignatureVerifier\n * splits the coordinates into commitment felts itself; sending the\n * 4-felt form fails its DTO validation (max 2 comma-joined values).\n */\nexport function eip191OwnerPubkeyParam(pubkey: Eip191Pubkey): string {\n assertBytes(\"secp256k1 x coordinate\", pubkey.x, 32);\n assertBytes(\"secp256k1 y coordinate\", pubkey.y, 32);\n const toHex = (b: Uint8Array) =>\n \"0x\" + Array.from(b, (v) => v.toString(16).padStart(2, \"0\")).join(\"\");\n return `${toHex(pubkey.x)},${toHex(pubkey.y)}`;\n}\n\n/**\n * Parse a 65-byte `personal_sign`/`eth_sign` signature hex string into\n * the Cairo-shaped envelope payload `[r.low, r.high, s.low, s.high, y_parity]`.\n *\n * Accepts both `v ∈ {27, 28}` (EIP-191 wallet convention) and\n * `y_parity ∈ {0, 1}` raw forms.\n */\nexport function parseEip191Signature(signatureHex: string): bigint[] {\n const hex = signatureHex.startsWith(\"0x\") ? signatureHex.slice(2) : signatureHex;\n if (hex.length !== 130) {\n throw new Error(`EIP-191 signature must be 65 bytes (130 hex chars); got ${hex.length}.`);\n }\n // Validate hex BEFORE parseInt — parseInt returns NaN for non-hex which\n // Uint8Array would silently coerce to 0, masking a malformed signature.\n if (!/^[0-9a-fA-F]+$/.test(hex)) {\n throw new Error(\"EIP-191 signature contains non-hex characters.\");\n }\n const bytes = new Uint8Array(65);\n for (let i = 0; i < 65; i++) {\n bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n }\n const r = bytesBeToU256(bytes.slice(0, 32));\n const s = bytesBeToU256(bytes.slice(32, 64));\n const v = bytes[64];\n // v ∈ {27, 28} → y_parity ∈ {0, 1}; raw {0, 1} passes through.\n let yParity: bigint;\n if (v === 27) yParity = 0n;\n else if (v === 28) yParity = 1n;\n else if (v === 0) yParity = 0n;\n else if (v === 1) yParity = 1n;\n else throw new Error(`Unexpected v byte ${v} in EIP-191 signature; expected 27, 28, 0, or 1.`);\n\n if (s.low === 0n && s.high === 0n) {\n throw new Error(\"EIP-191 signature s component is zero\");\n }\n return [r.low, r.high, s.low, s.high, yParity];\n}\n\n/**\n * Production / MetaMask flow. Caller already has the 65-byte signature\n * from `personal_sign` (e.g., `await provider.send(\"personal_sign\", [...])`)\n * and the wallet's public key.\n */\nexport function buildEip191EnvelopeFromSignature(params: {\n /** 65-byte `personal_sign` signature, 0x-prefixed hex. */\n signatureHex: string;\n /** Uncompressed secp256k1 pubkey (x, y) as 32 BE bytes each. */\n pubkey: Eip191Pubkey;\n /**\n * Owner index in the wallet's owner_set. **Defaults to 0n (primary).**\n * MUST fit in u32. Passing `eip191OwnerId(pubkey)` (the commitment)\n * here will revert on chain with `'SHHH: bad owner_id'`.\n */\n ownerIndex?: bigint;\n}): bigint[] {\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n throw new Error(\n `buildEip191EnvelopeFromSignature: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32).`\n );\n }\n const payload = parseEip191Signature(params.signatureHex);\n return wrapV2Snip12Envelope({\n ownerId: ownerIndex,\n kindTag: EIP191_KIND_TAG,\n payload,\n });\n}\n\n/**\n * Test / Chipi-held-key flow. Sign locally with a known secp256k1\n * private key using the exact `personal_sign` recipe MetaMask uses\n * (keccak256(\"\\x19Ethereum Signed Message:\\n32\" || msg_be32),\n * secp256k1 sign of that hash).\n *\n * Async because @noble/secp256k1 v3 ships ESM and we dynamic-import.\n */\nexport async function buildEip191EnvelopeFromPrivateKey(params: {\n /** 32-byte secp256k1 private key (Uint8Array OR 0x-prefixed hex). */\n privateKey: Uint8Array | string;\n /** SNIP-12 hash of the OutsideExecution — see oe.ts::computeOeHash. */\n messageHash: bigint;\n /**\n * Owner index in the wallet's owner_set. **Defaults to 0n (primary).**\n * MUST fit in u32. Same semantics as `buildEip191EnvelopeFromSignature`.\n */\n ownerIndex?: bigint;\n}): Promise<bigint[]> {\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n throw new Error(\n `buildEip191EnvelopeFromPrivateKey: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32).`\n );\n }\n const privBytes = normalizePrivateKey(params.privateKey);\n\n const [secp, keccak] = await Promise.all([\n import(\"@noble/secp256k1\"),\n // @noble/hashes@2.x ESM exports use the .js suffix per their package.json\n // exports map.\n import(\"@noble/hashes/sha3.js\"),\n ]);\n\n // ethSignedMessageHash = keccak256(\"\\x19Ethereum Signed Message:\\n32\" || msg_be32)\n const msgBe32 = bigintToBe32(params.messageHash);\n const prefix = new TextEncoder().encode(\"\\x19Ethereum Signed Message:\\n32\");\n const prefixedMsg = new Uint8Array(prefix.length + 32);\n prefixedMsg.set(prefix, 0);\n prefixedMsg.set(msgBe32, prefix.length);\n const ethSignedHash = keccak.keccak_256(prefixedMsg);\n\n // secp256k1.sign returns a Signature with .r, .s, .recovery (0|1).\n // Cast through `any` to tolerate version drift in the @noble surface.\n const sig: any = await (secp as any).signAsync(ethSignedHash, privBytes, {\n lowS: true,\n });\n\n let r: bigint = typeof sig.r === \"bigint\" ? sig.r : BigInt(sig.r);\n let s: bigint = typeof sig.s === \"bigint\" ? sig.s : BigInt(sig.s);\n let recovery: number =\n typeof sig.recovery === \"number\" ? sig.recovery : Number(sig.recovery ?? 0);\n // lowS canonicalization to match what MetaMask / ethers emit.\n const halfOrder = SECP256K1_ORDER >> 1n;\n if (s > halfOrder) {\n s = SECP256K1_ORDER - s;\n recovery ^= 1;\n }\n\n const rBytes = bigintToBe32(r);\n const sBytes = bigintToBe32(s);\n\n const rU256 = bytesBeToU256(rBytes);\n const sU256 = bytesBeToU256(sBytes);\n\n return wrapV2Snip12Envelope({\n ownerId: ownerIndex,\n kindTag: EIP191_KIND_TAG,\n payload: [rU256.low, rU256.high, sU256.low, sU256.high, BigInt(recovery)],\n });\n}\n\nfunction normalizePrivateKey(input: Uint8Array | string): Uint8Array {\n if (input instanceof Uint8Array) {\n assertBytes(\"EIP-191 private key\", input, 32);\n return input;\n }\n const hex = input.startsWith(\"0x\") ? input.slice(2) : input;\n if (hex.length !== 64) {\n throw new Error(`EIP-191 private key hex must be 64 chars (32 bytes); got ${hex.length}.`);\n }\n // Validate hex BEFORE parseInt — see parseEip191Signature for rationale.\n if (!/^[0-9a-fA-F]+$/.test(hex)) {\n throw new Error(\"EIP-191 private key contains non-hex characters.\");\n }\n const out = new Uint8Array(32);\n for (let i = 0; i < 32; i++) {\n out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n }\n return out;\n}\n\nfunction bigintToBe32(x: bigint): Uint8Array {\n if (x < 0n) throw new Error(\"bigintToBe32: negative input\");\n const out = new Uint8Array(32);\n for (let i = 31; i >= 0; i--) {\n out[i] = Number(x & 0xffn);\n x >>= 8n;\n }\n if (x !== 0n) throw new Error(\"bigintToBe32: input exceeds 256 bits\");\n return out;\n}\n","/**\n * WebAuthn P-256 signer for SHHH V8.4 ShhhAccount.\n *\n * The SHHH default signer kind in the browser. Wraps a WebAuthn\n * `navigator.credentials.get()` assertion (or a synthesized equivalent\n * in tests) into the V2_SNIP12 envelope the on-chain\n * WebAuthnP256Verifier (class `0x074f6efd…44657`) consumes.\n *\n * The verifier reproduces the WebAuthn assertion check on-chain:\n * 1. Parse `authData` (rpIdHash 32B || flags 1B || signCount 4B || …).\n * Require UP flag (bit 0) set.\n * 2. Compute `outer = sha256(authData ‖ sha256(clientDataJSON))`.\n * 3. Verify P-256 ECDSA `(r, s, y_parity)` against `outer` and the\n * stored pubkey.\n * 4. At `challenge_offset` in `clientDataJSON`, base64url-decode the\n * next 43 chars to 32 bytes and compare equal to the SNIP-12 hash.\n * 5. Sanity-check the `clientDataJSON` prefix\n * `{\"type\":\"webauthn.get\",…` (rejects webauthn.create / missing\n * type).\n *\n * Reference: shhh-wallet-cairo/scripts/ts/gen-webauthn-fixture.mjs\n * and tests/signer_webauthn_fixture.cairo\n *\n * Verifier overhead: ~35M l2_gas (per SHHH_KIND_GAS_OVERHEAD).\n *\n * Envelope shape (after the V2_SNIP12 + owner_id + kind_tag wrap):\n * ByteArray(authData)\n * ByteArray(clientDataJSON)\n * challenge_offset: u32\n * r.low, r.high, s.low, s.high, y_parity\n *\n * Cairo ByteArray serde:\n * num_full_words: u32\n * full_words: felt252[num_full_words] // 31 bytes packed MSB-first\n * pending_word: felt252 // <31 remaining bytes\n * pending_word_len: u32\n */\n\nimport { shortString } from \"starknet\";\nimport { ownerCommitment } from \"../compute-wallet-address\";\nimport { wrapV2Snip12Envelope } from \"../oe\";\n\nconst WEBAUTHN_KIND_TAG = \"WEBAUTHN_P256\";\nconst WEBAUTHN_KIND_TAG_FELT = BigInt(shortString.encodeShortString(WEBAUTHN_KIND_TAG));\n\nconst P256_ORDER = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551n;\n\nexport interface WebAuthnPubkey {\n /** 32-byte big-endian P-256 X coordinate. */\n x: Uint8Array;\n /** 32-byte big-endian P-256 Y coordinate. */\n y: Uint8Array;\n}\n\nfunction assertBytes(name: string, b: Uint8Array, len: number): void {\n if (b.length !== len) {\n throw new Error(`${name} must be exactly ${len} bytes; got ${b.length}.`);\n }\n}\n\nfunction bytesBeToU256(b: Uint8Array): { low: bigint; high: bigint } {\n assertBytes(\"32B value\", b, 32);\n let x = 0n;\n for (let i = 0; i < b.length; i++) x = (x << 8n) | BigInt(b[i]);\n return { low: x & ((1n << 128n) - 1n), high: x >> 128n };\n}\n\nfunction bigintToBe32(x: bigint): Uint8Array {\n if (x < 0n) throw new Error(\"bigintToBe32: negative input\");\n const out = new Uint8Array(32);\n for (let i = 31; i >= 0; i--) {\n out[i] = Number(x & 0xffn);\n x >>= 8n;\n }\n if (x !== 0n) throw new Error(\"bigintToBe32: input exceeds 256 bits\");\n return out;\n}\n\n/** base64url encode (no padding) — RFC 4648 §5. */\nfunction base64UrlEncode(bytes: Uint8Array): string {\n // btoa on browser / Buffer in node. Use a portable approach.\n let bin = \"\";\n for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);\n const b64 = typeof Buffer !== \"undefined\" ? Buffer.from(bytes).toString(\"base64\") : btoa(bin);\n return b64.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n/**\n * Serialize a byte string as Cairo's `ByteArray` serde — must match\n * what the Cairo runtime would produce when this same bytes value is\n * passed as a `ByteArray` parameter.\n *\n * Layout: `[num_full_words, ...full_words, pending_word, pending_word_len]`.\n * Each full word packs 31 bytes MSB-first (network order) into a felt252.\n */\nexport function byteArrayToFelts(bytes: Uint8Array): bigint[] {\n const totalFull = Math.floor(bytes.length / 31);\n const out: bigint[] = [BigInt(totalFull)];\n for (let i = 0; i < totalFull; i++) {\n let v = 0n;\n for (let j = 0; j < 31; j++) v = (v << 8n) | BigInt(bytes[i * 31 + j]);\n out.push(v);\n }\n const remStart = totalFull * 31;\n const remLen = bytes.length - remStart;\n let pending = 0n;\n for (let j = 0; j < remLen; j++) {\n pending = (pending << 8n) | BigInt(bytes[remStart + j]);\n }\n out.push(pending);\n out.push(BigInt(remLen));\n return out;\n}\n\n/**\n * Parse a DER-encoded ECDSA signature into raw (r, s) 32-byte BE values.\n * WebAuthn assertions return DER per spec; we strip it to the raw\n * P-256 components the Cairo verifier expects.\n */\nexport function parseDerEcdsaSignature(der: Uint8Array): {\n r: Uint8Array<ArrayBuffer>;\n s: Uint8Array<ArrayBuffer>;\n} {\n // Minimal DER:\n // 0x30 SEQ_LEN\n // 0x02 LEN_R R_BYTES\n // 0x02 LEN_S S_BYTES\n //\n // Bounds-checked at every step: a truncated/corrupted signature\n // could otherwise produce a zero-padded bogus (r, s) that would\n // skip on-chain verification.\n\n // Minimum legal DER ECDSA signature: 0x30 0x06 0x02 0x01 R 0x02 0x01 S = 8 bytes.\n if (der.length < 8) {\n throw new Error(`DER: input too short (${der.length} bytes)`);\n }\n if (der[0] !== 0x30) throw new Error(\"DER: expected SEQUENCE (0x30)\");\n // Short-form length only (DER for P-256 r/s is always short-form, max 70 bytes).\n const seqLen = der[1];\n if (seqLen & 0x80) {\n throw new Error(\"DER: long-form sequence length not supported\");\n }\n if (2 + seqLen !== der.length) {\n throw new Error(\n `DER: declared sequence length ${seqLen} does not match buffer (${der.length - 2})`\n );\n }\n\n let off = 2;\n if (der[off] !== 0x02) throw new Error(\"DER: expected INTEGER (0x02) for r\");\n const rLen = der[off + 1];\n if (rLen === 0) throw new Error(\"DER: r component has zero length\");\n if (off + 2 + rLen > der.length) {\n throw new Error(`DER: r length ${rLen} overruns buffer at offset ${off + 2}`);\n }\n off += 2;\n let rBytes = new Uint8Array(rLen);\n rBytes.set(der.subarray(off, off + rLen));\n off += rLen;\n\n if (off + 2 > der.length) {\n throw new Error(\"DER: no room for s INTEGER header\");\n }\n if (der[off] !== 0x02) throw new Error(\"DER: expected INTEGER (0x02) for s\");\n const sLen = der[off + 1];\n if (sLen === 0) throw new Error(\"DER: s component has zero length\");\n if (off + 2 + sLen > der.length) {\n throw new Error(`DER: s length ${sLen} overruns buffer at offset ${off + 2}`);\n }\n off += 2;\n let sBytes = new Uint8Array(sLen);\n sBytes.set(der.subarray(off, off + sLen));\n\n // DER pads leading 0x00 on signed-int negative-bit avoidance; strip + left-pad to 32.\n rBytes = leftPadTo32(stripLeadingZero(rBytes));\n sBytes = leftPadTo32(stripLeadingZero(sBytes));\n return { r: rBytes, s: sBytes };\n}\n\nfunction stripLeadingZero(b: Uint8Array): Uint8Array<ArrayBuffer> {\n // DER may prepend a single 0x00 to keep the integer positive — strip.\n const start = b.length > 0 && b[0] === 0x00 ? 1 : 0;\n const out = new Uint8Array(b.length - start);\n out.set(b.subarray(start));\n return out;\n}\n\nfunction leftPadTo32(b: Uint8Array): Uint8Array<ArrayBuffer> {\n if (b.length > 32) throw new Error(`P-256 component longer than 32 bytes: ${b.length}`);\n const out = new Uint8Array(32);\n out.set(b, 32 - b.length);\n return out;\n}\n\nexport function webauthnPubkeyFelts(pub: WebAuthnPubkey): bigint[] {\n const x = bytesBeToU256(pub.x);\n const y = bytesBeToU256(pub.y);\n return [x.low, x.high, y.low, y.high];\n}\n\nexport function webauthnOwnerId(pub: WebAuthnPubkey): bigint {\n return ownerCommitment(WEBAUTHN_KIND_TAG_FELT, webauthnPubkeyFelts(pub));\n}\n\n/**\n * The `ownerPubkey` string for the treasury coordination endpoints\n * (`sdk.treasury.forTreasury({ ownerPubkey })`): `\"0x<x>,0x<y>\"` — the\n * FULL 32-byte BE P-256 coordinates, NOT the 4 `webauthnPubkeyFelts`\n * halves. chipi-back's OwnerSignatureVerifier splits the coordinates\n * into commitment felts itself.\n */\nexport function webauthnOwnerPubkeyParam(pub: WebAuthnPubkey): string {\n assertBytes(\"P-256 x coordinate\", pub.x, 32);\n assertBytes(\"P-256 y coordinate\", pub.y, 32);\n const toHex = (b: Uint8Array) =>\n \"0x\" + Array.from(b, (v) => v.toString(16).padStart(2, \"0\")).join(\"\");\n return `${toHex(pub.x)},${toHex(pub.y)}`;\n}\n\n/**\n * Production / browser flow. The caller has run\n * `navigator.credentials.get({ publicKey: { challenge: msgBe32, ... } })`\n * and now has the assertion's `authenticatorData`, `clientDataJSON`,\n * and DER-encoded `signature` (plus the wallet's stored P-256 pubkey).\n *\n * This builder:\n * 1. Parses the DER signature into raw r, s.\n * 2. Recovers y_parity from the signature (always 0; WebAuthn does\n * not expose recovery — the on-chain verifier compares the recovered\n * pubkey against the stored one and tries both parities if needed).\n * 3. Locates the challenge in clientDataJSON to compute challenge_offset.\n * 4. Encodes authData + clientDataJSON as Cairo ByteArrays.\n * 5. Wraps everything in the V2_SNIP12 envelope.\n */\nexport function buildWebAuthnEnvelopeFromAssertion(params: {\n authenticatorData: Uint8Array;\n clientDataJSON: Uint8Array;\n /** DER-encoded ECDSA signature from `assertion.response.signature`. */\n signatureDer: Uint8Array;\n /** P-256 pubkey stored at registration time. */\n pubkey: WebAuthnPubkey;\n /** SNIP-12 hash the challenge was constructed from. */\n messageHash: bigint;\n /**\n * y_parity recovery bit. WebAuthn assertions don't include this — pass\n * 0 (the verifier tries both parities internally when needed). Override\n * only if you know the bit independently.\n */\n yParity?: 0n | 1n;\n /**\n * Owner index in the wallet's owner_set. Defaults to 0n (primary).\n * MUST fit in u32. Passing `webauthnOwnerId(pubkey)` (the commitment)\n * here will revert on chain with `'SHHH: bad owner_id'`.\n */\n ownerIndex?: bigint;\n}): bigint[] {\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n throw new Error(\n `buildWebAuthnEnvelopeFromAssertion: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32).`\n );\n }\n const { r, s } = parseDerEcdsaSignature(params.signatureDer);\n\n const expectedChallenge = base64UrlEncode(bigintToBe32(params.messageHash));\n // The challenge appears in clientDataJSON as `\"challenge\":\"<expectedChallenge>\"`.\n // challenge_offset is the byte index of the FIRST character of the b64url string.\n const needle = `\"challenge\":\"${expectedChallenge}\"`;\n const clientDataStr = new TextDecoder().decode(params.clientDataJSON);\n const needleStart = clientDataStr.indexOf(needle);\n if (needleStart < 0) {\n throw new Error(\n 'WebAuthn clientDataJSON does not contain a `\"challenge\":\"<expected>\"` substring for the given messageHash.'\n );\n }\n const challengeOffset = needleStart + '\"challenge\":\"'.length;\n\n const rU = bytesBeToU256(r);\n const sU = bytesBeToU256(s);\n\n const payload: bigint[] = [\n ...byteArrayToFelts(params.authenticatorData),\n ...byteArrayToFelts(params.clientDataJSON),\n BigInt(challengeOffset),\n rU.low,\n rU.high,\n sU.low,\n sU.high,\n params.yParity ?? 0n,\n ];\n\n return wrapV2Snip12Envelope({\n ownerId: ownerIndex,\n kindTag: WEBAUTHN_KIND_TAG,\n payload,\n });\n}\n\n/**\n * Test / Chipi-held-key flow. Synthesizes a WebAuthn assertion under\n * a known P-256 private key, then builds the envelope. Matches the\n * exact recipe in `gen-webauthn-fixture.mjs` so the resulting envelope\n * byte-for-byte matches `signer_webauthn_fixture.cairo`.\n *\n * Defaults match the canonical Shhh fixture: rpId=\"cifra.mx\",\n * origin=\"https://cifra.mx\", flags=0x05 (UP+UV), signCount=42.\n */\nexport async function buildWebAuthnEnvelopeFromPrivateKey(params: {\n /** 32-byte P-256 private key (Uint8Array or 0x-prefixed hex). */\n privateKey: Uint8Array | string;\n /** SNIP-12 hash of the OutsideExecution. */\n messageHash: bigint;\n /** WebAuthn relying-party ID (the rpId field). Default: \"cifra.mx\". */\n rpId?: string;\n /** WebAuthn origin string. Default: \"https://cifra.mx\". */\n origin?: string;\n /** WebAuthn authData flags byte. Default 0x05 (UP+UV). */\n flags?: number;\n /** 32-bit sign count. Default 42. */\n signCount?: number;\n /**\n * Owner index in the wallet's owner_set. Defaults to 0n (primary).\n * MUST fit in u32. Same semantics as `buildWebAuthnEnvelopeFromAssertion`.\n */\n ownerIndex?: bigint;\n}): Promise<bigint[]> {\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n throw new Error(\n `buildWebAuthnEnvelopeFromPrivateKey: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32).`\n );\n }\n const privBytes = normalizePrivateKey(params.privateKey);\n const rpId = params.rpId ?? \"cifra.mx\";\n const origin = params.origin ?? \"https://cifra.mx\";\n const flags = params.flags ?? 0x05;\n const signCount = params.signCount ?? 42;\n\n // Validate flags and signCount before any bitwise packing — out-of-range\n // values would silently truncate via `& 0xff` / `& 0xffffffff`, which is\n // exactly the kind of footgun we want to catch at the public API.\n if (!Number.isInteger(flags) || flags < 0 || flags > 0xff) {\n throw new Error(`WebAuthn flags must be an integer in [0, 255]; got ${flags}.`);\n }\n if (!Number.isInteger(signCount) || signCount < 0 || signCount > 0xffffffff) {\n throw new Error(`WebAuthn signCount must be an integer in [0, 0xFFFFFFFF]; got ${signCount}.`);\n }\n\n const [{ p256 }, sha2] = await Promise.all([\n import(\"@noble/curves/nist.js\"),\n import(\"@noble/hashes/sha2.js\"),\n ]);\n\n // ---- clientDataJSON ----\n const hashBytes = bigintToBe32(params.messageHash);\n const challengeStr = base64UrlEncode(hashBytes);\n // Use a fixed field order matching gen-webauthn-fixture.mjs.\n const clientDataStr =\n `{\"type\":\"webauthn.get\",\"challenge\":\"${challengeStr}\",` +\n `\"origin\":\"${origin}\",\"crossOrigin\":false}`;\n const clientData = new TextEncoder().encode(clientDataStr);\n const challengeOffset =\n clientDataStr.indexOf(`\"challenge\":\"${challengeStr}\"`) + '\"challenge\":\"'.length;\n\n // ---- authenticatorData = rpIdHash(32) || flags(1) || signCount(4) ----\n const rpIdHash = sha2.sha256(new TextEncoder().encode(rpId));\n const authData = new Uint8Array(32 + 1 + 4);\n authData.set(rpIdHash, 0);\n authData[32] = flags;\n // signCount as big-endian u32.\n authData[33] = (signCount >>> 24) & 0xff;\n authData[34] = (signCount >>> 16) & 0xff;\n authData[35] = (signCount >>> 8) & 0xff;\n authData[36] = signCount & 0xff;\n\n // ---- P-256 signing (sha256(authData || sha256(clientData))) ----\n const hClient = sha2.sha256(clientData);\n const signingBase = new Uint8Array(authData.length + hClient.length);\n signingBase.set(authData, 0);\n signingBase.set(hClient, authData.length);\n const outerHash = sha2.sha256(signingBase);\n\n // p256.sign(hash, priv, { prehash: false }) returns 64 raw bytes (r ‖ s).\n const sigBytes: Uint8Array = (p256 as any).sign(outerHash, privBytes, {\n prehash: false,\n });\n if (sigBytes.length !== 64) {\n throw new Error(`p256.sign returned ${sigBytes.length} bytes; expected 64`);\n }\n let r = bytesBeToBigint(sigBytes.slice(0, 32));\n let s = bytesBeToBigint(sigBytes.slice(32, 64));\n\n // lowS canonicalization for parity with what Cairo expects.\n const halfOrder = P256_ORDER >> 1n;\n if (s > halfOrder) s = P256_ORDER - s;\n\n const rBytes = bigintToBe32(r);\n const sBytes = bigintToBe32(s);\n\n const rU = bytesBeToU256(rBytes);\n const sU = bytesBeToU256(sBytes);\n\n const payload: bigint[] = [\n ...byteArrayToFelts(authData),\n ...byteArrayToFelts(clientData),\n BigInt(challengeOffset),\n rU.low,\n rU.high,\n sU.low,\n sU.high,\n 0n, // y_parity — Cairo verifier handles parity recovery internally\n ];\n\n return wrapV2Snip12Envelope({\n ownerId: ownerIndex,\n kindTag: WEBAUTHN_KIND_TAG,\n payload,\n });\n}\n\nfunction normalizePrivateKey(input: Uint8Array | string): Uint8Array {\n if (input instanceof Uint8Array) {\n assertBytes(\"P-256 private key\", input, 32);\n return input;\n }\n const hex = input.startsWith(\"0x\") ? input.slice(2) : input;\n if (hex.length !== 64) {\n throw new Error(`P-256 private key hex must be 64 chars (32 bytes); got ${hex.length}.`);\n }\n if (!/^[0-9a-fA-F]+$/.test(hex)) {\n throw new Error(\"P-256 private key contains non-hex characters.\");\n }\n const out = new Uint8Array(32);\n for (let i = 0; i < 32; i++) {\n out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n }\n return out;\n}\n\nfunction bytesBeToBigint(b: Uint8Array): bigint {\n let x = 0n;\n for (let i = 0; i < b.length; i++) x = (x << 8n) | BigInt(b[i]);\n return x;\n}\n","/**\n * JWT ES256 \"Sign in with Apple\" sub-bound signer for SHHH V8.4.\n *\n * Wave B PR B3. Adds the Apple Sign In signer kind\n * (`JWT_ES256_APPLE_SUB`, verifier class `0x06b67762...`). The headline\n * UX value is iOS-native onboarding: users without MetaMask but with\n * an iPhone authenticate with Apple, and the resulting JWT becomes a\n * SHHH owner. Multi-tenant safe via the `sub` claim binding.\n *\n * Cairo source of truth:\n * shhh-wallet-cairo/src/signer/jwt_es256_apple_sub/verifier.cairo\n *\n * Envelope layout (Cairo Serde over Span<felt252>):\n * header_b64 ByteArray // base64url JOSE header bytes\n * payload_decoded ByteArray // raw JSON claims (NOT base64url)\n * nonce_offset u32 // index of the 43-byte b64url nonce\n * iss_offset u32 // index of \"https://appleid.apple.com\"\n * sub_offset u32 // index of the sub claim VALUE\n * sub_len u32 // byte length of the sub claim VALUE\n * r u256 // low | high\n * s u256 // low | high\n * y_parity felt252 // 0 | 1\n *\n * Pubkey layout (5 felts):\n * [x_low, x_high, y_low, y_high, sub_hash]\n *\n * where sub_hash = poseidon_hash_span over the user's stable Apple\n * `sub` identifier, one felt per byte. The 5th felt binds the\n * on-chain owner to a SPECIFIC end-user — so multiple Chipi accounts\n * sharing Apple's same signing key can't be co-controlled by an\n * arbitrary Apple-authenticated user.\n *\n * Two flows:\n * - `buildJwtAppleSubEnvelopeFromTokenResponse` — production. Caller\n * drops in the Apple-issued `id_token` + the SNIP-12 message hash\n * that was committed to via the OE nonce.\n * - `buildJwtAppleSubEnvelopeFromTestKey` — synthesized test path.\n * Generates an ES256 keypair, constructs a JWT shaped like\n * Apple's, and signs it locally. Used for unit tests + the Wave\n * B B9 mainnet smoke. Real Apple-issued fixture upgrade comes\n * post-Wave-B (per plan D18).\n */\n\nimport { hash, shortString } from \"starknet\";\nimport { ownerCommitment } from \"../compute-wallet-address\";\nimport { wrapV2Snip12Envelope } from \"../oe\";\nimport { byteArrayToFelts } from \"./webauthn\";\n\nconst JWT_APPLE_SUB_KIND_TAG = \"JWT_ES256_APPLE_SUB\";\nconst JWT_APPLE_SUB_KIND_TAG_FELT = BigInt(shortString.encodeShortString(JWT_APPLE_SUB_KIND_TAG));\n\n/** The hardcoded `iss` claim every Apple JWT carries. 25 ASCII bytes. */\nexport const APPLE_ISSUER = \"https://appleid.apple.com\";\n\n/** Cairo's `CHALLENGE_B64URL_LEN`. base64url-no-padding of 32 BE bytes = 43 chars. */\nconst NONCE_B64URL_LEN = 43;\n\n// ================================================================\n// Types\n// ================================================================\n\n/**\n * Uncompressed P-256 public key for Apple's current ES256 signing key.\n * Apple rotates this periodically — see the JWKS endpoint at\n * `https://appleid.apple.com/auth/keys`.\n */\nexport interface JwtAppleSubPubkey {\n /** 32-byte big-endian X coordinate. */\n x: Uint8Array;\n /** 32-byte big-endian Y coordinate. */\n y: Uint8Array;\n /** The user's stable Apple `sub` identifier (ASCII), e.g. \"001234.abc.5678\". */\n sub: string;\n}\n\n/**\n * What you get back from `https://appleid.apple.com/auth/token` after\n * a Sign-in-with-Apple OAuth flow. Only `id_token` is signature-bearing;\n * `access_token` and friends are out of scope here.\n */\nexport interface AppleTokenResponse {\n id_token: string;\n}\n\n// ================================================================\n// Pubkey helpers\n// ================================================================\n\nconst U128_MASK = (1n << 128n) - 1n;\n\nfunction assertBytes(name: string, b: Uint8Array, len: number): void {\n if (b.length !== len) {\n throw new Error(`${name} must be exactly ${len} bytes; got ${b.length}.`);\n }\n}\n\nfunction bytesBeToU256(b: Uint8Array): { low: bigint; high: bigint } {\n assertBytes(\"secp256r1 32B value\", b, 32);\n let x = 0n;\n for (let i = 0; i < b.length; i++) x = (x << 8n) | BigInt(b[i]);\n return { low: x & U128_MASK, high: x >> 128n };\n}\n\n/**\n * Compute the sub_hash that the Cairo verifier checks against.\n * Equals `poseidon_hash_span` over the bytes of the sub string, one\n * felt per byte. The SDK and the verifier must agree byte-for-byte.\n */\nexport function jwtAppleSubHash(sub: string): bigint {\n const bytes = new TextEncoder().encode(sub);\n const felts = Array.from(bytes).map((b) => BigInt(b));\n return BigInt(hash.computePoseidonHashOnElements(felts.map((f) => \"0x\" + f.toString(16))));\n}\n\n/**\n * Pubkey felt layout for the V8.4 constructor / propose_add_owner.\n * Returns `[x.low, x.high, y.low, y.high, sub_hash]` (5 felts).\n */\nexport function jwtAppleSubPubkeyFelts(pubkey: JwtAppleSubPubkey): bigint[] {\n const x = bytesBeToU256(pubkey.x);\n const y = bytesBeToU256(pubkey.y);\n const subHash = jwtAppleSubHash(pubkey.sub);\n return [x.low, x.high, y.low, y.high, subHash];\n}\n\n/** owner_commitment for an Apple JWT owner. */\nexport function jwtAppleSubOwnerId(pubkey: JwtAppleSubPubkey): bigint {\n return ownerCommitment(JWT_APPLE_SUB_KIND_TAG_FELT, jwtAppleSubPubkeyFelts(pubkey));\n}\n\n// ================================================================\n// JWT parsing helpers\n// ================================================================\n\nfunction base64urlEncode(bytes: Uint8Array): string {\n // Node Buffer / browser btoa both work; using a portable inline\n // encoder so this module has no env-conditional behavior.\n const STD = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\n let bin = \"\";\n for (const b of bytes) bin += String.fromCharCode(b);\n // Convert binary string to standard base64 then transform.\n const b64 = btoaPortable(bin);\n return b64.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction btoaPortable(bin: string): string {\n if (typeof btoa === \"function\") return btoa(bin);\n // Node has Buffer; if neither, throw a clear error.\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n const buf = (globalThis as any).Buffer;\n if (buf) return buf.from(bin, \"binary\").toString(\"base64\");\n throw new Error(\"no base64 encoder available (need btoa or Buffer in scope)\");\n}\n\nfunction base64urlDecode(s: string): Uint8Array {\n // pad to multiple of 4\n const pad = s.length % 4 === 0 ? 0 : 4 - (s.length % 4);\n const std = s.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"=\".repeat(pad);\n const bin = atobPortable(std);\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n}\n\nfunction atobPortable(s: string): string {\n if (typeof atob === \"function\") return atob(s);\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n const buf = (globalThis as any).Buffer;\n if (buf) return buf.from(s, \"base64\").toString(\"binary\");\n throw new Error(\"no base64 decoder available (need atob or Buffer in scope)\");\n}\n\n/**\n * base64url-no-padding encoding of a 32 BE-byte SNIP-12 hash. The\n * Cairo verifier asserts the 43 ASCII bytes at\n * `payload_decoded[nonce_offset .. nonce_offset+43]` equal exactly\n * this string. Format must match RFC 4648 §5 (no padding `=`).\n */\nexport function messageHashToNonceB64url(messageHash: bigint): string {\n const beBytes = new Uint8Array(32);\n let x = messageHash;\n for (let i = 31; i >= 0; i--) {\n beBytes[i] = Number(x & 0xffn);\n x >>= 8n;\n }\n if (x !== 0n) {\n throw new RangeError(\"messageHash exceeds 256 bits\");\n }\n const out = base64urlEncode(beBytes);\n if (out.length !== NONCE_B64URL_LEN) {\n throw new Error(`expected ${NONCE_B64URL_LEN}-char nonce b64url, got ${out.length}`);\n }\n return out;\n}\n\n/**\n * Locate a literal substring in a byte array. Returns the byte offset\n * (UTF-8-safe, both inputs treated as bytes). Throws if not found\n * with a clear message; the on-chain verifier would otherwise return\n * `false` silently, producing an unhelpful revert.\n */\nfunction findByteOffset(haystack: Uint8Array, needle: Uint8Array, label: string): number {\n outer: for (let i = 0; i + needle.length <= haystack.length; i++) {\n for (let j = 0; j < needle.length; j++) {\n if (haystack[i + j] !== needle[j]) continue outer;\n }\n return i;\n }\n throw new Error(`JWT_APPLE_SUB: ${label} not found in payload (verifier would reject)`);\n}\n\n/**\n * Locate the byte offset of a JSON string claim's value within a JWT\n * payload. Binds the offset to the actual `\"<key>\":\"<value>\"` pattern\n * (with the value's closing `\"`) rather than searching for the bare\n * value bytes, which could match anywhere in the payload — including\n * inside an attacker-controlled field. The Cairo verifier only does\n * a bytes-at-offset equality check, so the offset MUST point at a\n * value bound to the right key, or the JWT is unbound.\n *\n * Returns the offset of the first character of the value (i.e. just\n * after the opening `\"`). The verifier then reads exactly\n * `expectedValue.length` bytes from there.\n *\n * Whitespace policy: Apple's id_token payload is canonical JSON with\n * no insignificant whitespace between key, colon, and value. We\n * enforce that here. Any whitespace tolerance would have to be\n * mirrored in the Cairo verifier; right now it isn't.\n */\nfunction locateExactClaimValueOffset(\n payload: Uint8Array,\n claim: string,\n expectedValue: string\n): number {\n // Build the literal `\"<claim>\":\"<value>\"` pattern. We search for\n // the full pattern (including the trailing `\"`) so a substring of\n // a longer value can't also match.\n const literal = `\"${claim}\":\"${expectedValue}\"`;\n const literalBytes = new TextEncoder().encode(literal);\n const idx = findByteOffsetOrMinusOne(payload, literalBytes);\n if (idx < 0) {\n throw new Error(\n `JWT_APPLE_SUB: ${claim} claim with expected value not found in payload (verifier would reject)`\n );\n }\n // Offset of the value's first character = idx + |\"<claim>\":\"| .\n const prefix = `\"${claim}\":\"`;\n return idx + new TextEncoder().encode(prefix).length;\n}\n\nfunction findByteOffsetOrMinusOne(haystack: Uint8Array, needle: Uint8Array): number {\n outer: for (let i = 0; i + needle.length <= haystack.length; i++) {\n for (let j = 0; j < needle.length; j++) {\n if (haystack[i + j] !== needle[j]) continue outer;\n }\n return i;\n }\n return -1;\n}\n\n/**\n * Split an Apple-issued `id_token` into its three base64url parts.\n * Returns the decoded payload bytes + the header b64url + the\n * 64-byte raw ECDSA signature (r || s).\n */\nexport function parseAppleIdToken(idToken: string): {\n headerB64: string;\n payloadDecoded: Uint8Array;\n rawSignature: Uint8Array; // 64 bytes: r || s, big-endian\n} {\n const parts = idToken.split(\".\");\n if (parts.length !== 3) {\n throw new Error(\n `JWT_APPLE_SUB: id_token must have 3 parts separated by '.'; got ${parts.length}`\n );\n }\n const [headerB64, payloadB64, sigB64] = parts;\n const payloadDecoded = base64urlDecode(payloadB64);\n const rawSignature = base64urlDecode(sigB64);\n if (rawSignature.length !== 64) {\n throw new Error(\n `JWT_APPLE_SUB: ECDSA signature must be 64 bytes (raw r||s); got ${rawSignature.length}. ` +\n `Apple returns raw 64-byte signatures; if you have a DER-encoded one, decode it first.`\n );\n }\n return { headerB64, payloadDecoded, rawSignature };\n}\n\n/**\n * Locate the sub claim's VALUE bytes in a decoded JSON payload.\n * Searches for the literal `\"sub\":\"<value>\"` pattern. JSON allows\n * whitespace, but Apple's id_token always uses canonical\n * no-whitespace form, so we don't try to handle pretty-printed JSON.\n *\n * Returns `{ offset, length }` of the value bytes (not including the\n * surrounding quotes), suitable for `sub_offset` + `sub_len` in the\n * envelope.\n */\nexport function locateSubClaim(payload: Uint8Array): {\n offset: number;\n length: number;\n} {\n // We can't rely on regex over bytes; do it manually. Find `\"sub\":\"`,\n // then read until the closing `\"` (assuming no escape sequences —\n // Apple's sub IDs are ASCII alphanumeric + dots, never quoted).\n const SUB_KEY = new TextEncoder().encode('\"sub\":\"');\n const start = findByteOffset(payload, SUB_KEY, '\"sub\":\"');\n const valueStart = start + SUB_KEY.length;\n let end = valueStart;\n while (end < payload.length && payload[end] !== 0x22 /* '\"' */) {\n if (payload[end] === 0x5c /* '\\\\' */) {\n throw new Error(\"JWT_APPLE_SUB: sub claim contains escape sequence; not supported\");\n }\n end += 1;\n }\n if (end >= payload.length) {\n throw new Error(\"JWT_APPLE_SUB: sub claim is unterminated\");\n }\n return { offset: valueStart, length: end - valueStart };\n}\n\n// ================================================================\n// Envelope assembly\n// ================================================================\n\ninterface JwtAppleSubEnvelopeFields {\n headerB64: string;\n payloadDecoded: Uint8Array;\n nonceOffset: number;\n issOffset: number;\n subOffset: number;\n subLen: number;\n r: bigint; // u256\n s: bigint; // u256\n yParity: 0 | 1;\n}\n\n/** Helper: serialize a bytes blob as Cairo ByteArray. */\nfunction serdeByteArray(bytes: Uint8Array): bigint[] {\n return byteArrayToFelts(bytes);\n}\n\nfunction buildEnvelopePayload(fields: JwtAppleSubEnvelopeFields): bigint[] {\n const headerBytes = new TextEncoder().encode(fields.headerB64);\n const headerSerde = serdeByteArray(headerBytes);\n const payloadSerde = serdeByteArray(fields.payloadDecoded);\n\n return [\n ...headerSerde,\n ...payloadSerde,\n BigInt(fields.nonceOffset),\n BigInt(fields.issOffset),\n BigInt(fields.subOffset),\n BigInt(fields.subLen),\n fields.r & U128_MASK,\n fields.r >> 128n,\n fields.s & U128_MASK,\n fields.s >> 128n,\n BigInt(fields.yParity),\n ];\n}\n\n/**\n * Production flow. Build a V2_SNIP12 envelope wrapping an actual\n * Apple-issued JWT. Caller has invoked the OAuth flow client-side\n * (e.g. via `appleid.com` JS SDK or AuthenticationServices on iOS)\n * and received an `id_token` whose `nonce` claim equals\n * `messageHashToNonceB64url(oeMessageHash)`.\n *\n * Returns the `signature` felt span you pass to\n * `paymaster_executeSponsoredRaw.calldata`.\n */\nexport function buildJwtAppleSubEnvelopeFromTokenResponse(params: {\n /** Apple OAuth token endpoint response (we only need `id_token`). */\n idToken: string;\n /** Owner's full pubkey including sub — same as registered on-chain. */\n pubkey: JwtAppleSubPubkey;\n /** SNIP-12 hash of the OE — the nonce in the id_token MUST encode this. */\n messageHash: bigint;\n /**\n * Owner index in the wallet's owner_set. Defaults to 0n (primary).\n * MUST fit in u32. Passing `jwtAppleSubOwnerId(pubkey)` (the commitment)\n * here will revert on chain with `'SHHH: bad owner_id'`.\n */\n ownerIndex?: bigint;\n}): bigint[] {\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n throw new Error(\n `buildJwtAppleSubEnvelopeFromTokenResponse: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32).`\n );\n }\n const { headerB64, payloadDecoded, rawSignature } = parseAppleIdToken(params.idToken);\n\n // Sanity check 1: nonce claim equals base64url(messageHash 32 BE bytes).\n // CRITICAL: bind the offset to the `\"nonce\":\"<value>\"` literal — searching\n // for the bare value bytes would match inside any attacker-controlled\n // claim, and the Cairo verifier only checks bytes-at-offset.\n const expectedNonce = messageHashToNonceB64url(params.messageHash);\n const nonceOffset = locateExactClaimValueOffset(payloadDecoded, \"nonce\", expectedNonce);\n\n // Sanity check 2: iss claim equals APPLE_ISSUER (bound to claim key).\n const issOffset = locateExactClaimValueOffset(payloadDecoded, \"iss\", APPLE_ISSUER);\n\n // Sanity check 3: sub claim present + matches pubkey.sub.\n const { offset: subOffset, length: subLen } = locateSubClaim(payloadDecoded);\n const actualSub = new TextDecoder().decode(\n payloadDecoded.subarray(subOffset, subOffset + subLen)\n );\n if (actualSub !== params.pubkey.sub) {\n throw new Error(\n `JWT_APPLE_SUB: id_token sub \"${actualSub}\" doesn't match pubkey.sub ` +\n `\"${params.pubkey.sub}\" — wrong user signed in`\n );\n }\n\n // Split raw signature into (r, s, y_parity).\n const { r, s } = parseRawEcdsaSignature(rawSignature);\n // ES256 doesn't include y_parity in the signature (unlike Ethereum's\n // EIP-191). The Cairo verifier uses ECDSA *verify* not recovery, so\n // it tries both y_parity values and accepts the one that succeeds.\n // We always pass 0 here; the verifier flips if needed.\n // (Reference: Cairo `is_valid_signature` semantics in secp256r1.)\n const yParity: 0 | 1 = 0;\n\n return wrapV2Snip12Envelope({\n ownerId: ownerIndex,\n kindTag: JWT_APPLE_SUB_KIND_TAG,\n payload: buildEnvelopePayload({\n headerB64,\n payloadDecoded,\n nonceOffset,\n issOffset,\n subOffset,\n subLen,\n r,\n s,\n yParity,\n }),\n });\n}\n\nfunction parseRawEcdsaSignature(raw: Uint8Array): { r: bigint; s: bigint } {\n if (raw.length !== 64) {\n throw new Error(`JWT_APPLE_SUB: ECDSA signature must be 64 bytes; got ${raw.length}`);\n }\n let r = 0n;\n for (let i = 0; i < 32; i++) r = (r << 8n) | BigInt(raw[i]);\n let s = 0n;\n for (let i = 32; i < 64; i++) s = (s << 8n) | BigInt(raw[i]);\n return { r, s };\n}\n\n/**\n * Test / synthesized-fixture flow. Generate an ES256 P-256 keypair,\n * construct a JWT shaped like an Apple-issued one, sign it locally,\n * and wrap into a SHHH envelope.\n *\n * Used by unit tests + the Wave B B9 mainnet smoke. The wallet\n * deployed for the smoke must be registered with the SAME synthesized\n * pubkey returned here (`{ x, y, sub }`); production wallets register\n * Apple's actual JWKS pubkey + the user's real sub.\n *\n * Async because `@noble/curves` ESM imports.\n *\n * Real-Apple-Developer-issued fixture upgrade is tracked as a separate\n * post-Wave-B item (plan D18).\n */\nexport async function buildJwtAppleSubEnvelopeFromTestKey(params: {\n /** 32-byte raw P-256 private key. */\n privateKey: Uint8Array;\n /** Stable Apple-style sub identifier (e.g. \"001234.synthesized.5678\"). */\n sub: string;\n /** Audience claim — typically the integrator's Apple Developer team ID + bundle ID. */\n aud: string;\n /** SNIP-12 hash of the OE; encoded as the nonce claim. */\n messageHash: bigint;\n /**\n * Owner index in the wallet's owner_set. Defaults to 0n (primary).\n * MUST fit in u32. Same semantics as `buildJwtAppleSubEnvelopeFromTokenResponse`.\n */\n ownerIndex?: bigint;\n}): Promise<{\n envelope: bigint[];\n pubkey: JwtAppleSubPubkey;\n idToken: string;\n}> {\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n throw new Error(\n `buildJwtAppleSubEnvelopeFromTestKey: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32).`\n );\n }\n const { p256 } = await import(\"@noble/curves/nist.js\");\n const { sha256 } = await import(\"@noble/hashes/sha2.js\");\n\n if (params.privateKey.length !== 32) {\n throw new Error(\n `JWT_APPLE_SUB: P-256 private key must be 32 bytes; got ${params.privateKey.length}`\n );\n }\n\n // Derive uncompressed pubkey (65 bytes: 0x04 || x || y).\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n const pubUncompressed: Uint8Array = (p256 as any).getPublicKey(params.privateKey, false);\n if (pubUncompressed.length !== 65 || pubUncompressed[0] !== 0x04) {\n throw new Error(\"expected 65-byte uncompressed P-256 pubkey\");\n }\n const pubkey: JwtAppleSubPubkey = {\n x: pubUncompressed.slice(1, 33),\n y: pubUncompressed.slice(33, 65),\n sub: params.sub,\n };\n\n // JWT header — Apple's looks like {\"alg\":\"ES256\",\"kid\":\"<key id>\"}.\n const headerJson = JSON.stringify({ alg: \"ES256\", kid: \"synthesized\" });\n const headerB64 = base64urlEncode(new TextEncoder().encode(headerJson));\n\n // JWT payload — claims that the Cairo verifier scans:\n // iss: hardcoded APPLE_ISSUER\n // aud: caller-provided\n // sub: caller-provided (used by sub-bound binding)\n // nonce: base64url(messageHash, 32 BE bytes)\n // Plus iat / exp for realism (not checked on-chain but real Apple\n // tokens always carry them — including them keeps the offset\n // calculations representative).\n const now = Math.floor(Date.now() / 1000);\n const nonce = messageHashToNonceB64url(params.messageHash);\n const payloadObject = {\n iss: APPLE_ISSUER,\n aud: params.aud,\n sub: params.sub,\n iat: now,\n exp: now + 600,\n nonce,\n };\n const payloadJson = JSON.stringify(payloadObject);\n const payloadDecoded = new TextEncoder().encode(payloadJson);\n const payloadB64 = base64urlEncode(payloadDecoded);\n\n // Sign: ES256 over sha256(header_b64 || \".\" || payload_b64).\n const signingInput = new TextEncoder().encode(`${headerB64}.${payloadB64}`);\n const digest = sha256(signingInput);\n // @noble/curves v2 returns a 64-byte Uint8Array directly from\n // `p256.sign(...)` — raw r||s big-endian. No Signature object with\n // `.r`/`.s` fields the way @noble/secp256k1 has. Parse r and s out\n // of the raw bytes ourselves.\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n const rawSig: Uint8Array = (p256 as any).sign(digest, params.privateKey, {\n lowS: true,\n });\n if (rawSig.length !== 64) {\n throw new Error(`expected 64-byte raw ECDSA signature from p256.sign; got ${rawSig.length}`);\n }\n const { r, s } = parseRawEcdsaSignature(rawSig);\n\n // Compose the synthesized JWT so callers can also exercise the\n // production parser path on the same fixture.\n const idToken = `${headerB64}.${payloadB64}.${base64urlEncode(rawSig)}`;\n\n // Compute offsets directly from the synthesized payload, bound to\n // the `\"<claim>\":\"<value>\"` literal — same hardening as the\n // production builder so the fixture exercises the real lookup path.\n const nonceOffset = locateExactClaimValueOffset(payloadDecoded, \"nonce\", nonce);\n const issOffset = locateExactClaimValueOffset(payloadDecoded, \"iss\", APPLE_ISSUER);\n const { offset: subOffset, length: subLen } = locateSubClaim(payloadDecoded);\n\n const envelope = wrapV2Snip12Envelope({\n ownerId: ownerIndex,\n kindTag: JWT_APPLE_SUB_KIND_TAG,\n payload: buildEnvelopePayload({\n headerB64,\n payloadDecoded,\n nonceOffset,\n issOffset,\n subOffset,\n subLen,\n r,\n s,\n yParity: 0,\n }),\n });\n\n return { envelope, pubkey, idToken };\n}\n","/**\n * SHHH V8.4 governance + recovery call builders.\n *\n * Wave B PR B1. The V8.4 ShhhAccount gates every owner-set mutation\n * through a propose → wait-timelock → execute flow (`@external` fns\n * in `src/account.cairo`). Each entrypoint is `_assert_self_call`-gated,\n * which means callers wrap these `Call`s inside an OutsideExecution and\n * submit through the paymaster.\n *\n * This module produces the `Call` (`{ contractAddress, entrypoint,\n * calldata }`) shape that `oe.ts:buildOutsideExecution` expects. It\n * does NOT sign — that's the integrator's choice of signer kind. For\n * recovery initiation specifically, the signer MUST be a guardian owner\n * (`role == ROLE_GUARDIAN` on-chain).\n *\n * Sources of truth on the Cairo side:\n *\n * src/account.cairo:616 propose_add_owner\n * src/account.cairo:634 propose_remove_owner\n * src/account.cairo:649 propose_rotate_owner\n * src/account.cairo:670 propose_set_threshold\n * src/account.cairo:731 execute_add_owner\n * src/account.cairo:760 execute_remove_owner\n * src/account.cairo:769 execute_rotate_owner\n * src/account.cairo:786 execute_set_threshold\n * src/account.cairo:828 cancel_pending_op\n * src/account.cairo:864 initiate_recovery\n * src/account.cairo:888 cancel_recovery\n * src/account.cairo:897 finalize_recovery\n * src/governance/pending_ops.cairo OP_* + TIMELOCK_* felt constants\n * src/owner_set/interface.cairo ROLE_* felt constants\n *\n * Timelock semantics\n\n * propose_add_owner 48h\n * propose_remove_owner 24h\n * propose_rotate_owner 24h\n * propose_set_threshold 48h\n * initiate_recovery 7d (longest — the headline UX gate)\n *\n * Recovery is ADDITIVE on V8.4: `finalize_recovery` adds the new owner\n * but does not remove existing ones. The integrator's UI is expected\n * to follow with `propose_remove_owner` for stale devices.\n *\n * finalize_recovery is the only entrypoint here that is NOT\n * `_assert_self_call`-gated — it's permissionless after the 7d window,\n * so anyone can call it directly without an OE wrapper. The function\n * still returns a Call so the integrator can dispatch via their\n * normal account abstraction layer.\n */\n\nimport { hash, shortString, type Call } from \"starknet\";\n\n// ================================================================\n// Felt constants — MUST match the Cairo source exactly.\n// ================================================================\n\n/** `src/owner_set/interface.cairo:10` — `pub const ROLE_OWNER: felt252 = 'OWNER'`. */\nexport const ROLE_OWNER = BigInt(shortString.encodeShortString(\"OWNER\"));\n\n/** `src/owner_set/interface.cairo:11` — `pub const ROLE_GUARDIAN: felt252 = 'GUARDIAN'`. */\nexport const ROLE_GUARDIAN = BigInt(shortString.encodeShortString(\"GUARDIAN\"));\n\n/** `src/governance/pending_ops.cairo:19` — `OP_ADD_OWNER: felt252 = 'ADD_OWNER'`. */\nexport const OP_ADD_OWNER = BigInt(shortString.encodeShortString(\"ADD_OWNER\"));\nexport const OP_REMOVE_OWNER = BigInt(shortString.encodeShortString(\"REMOVE_OWNER\"));\nexport const OP_ROTATE_OWNER = BigInt(shortString.encodeShortString(\"ROTATE_OWNER\"));\nexport const OP_SET_THRESHOLD = BigInt(shortString.encodeShortString(\"SET_THRESHOLD\"));\n\n/**\n * Per-op timelocks in seconds. Match `src/governance/pending_ops.cairo:42-50`\n * exactly. Exposed so SDK consumers can predict timelock expiry without\n * an extra on-chain call after `proposeAddOwner` succeeds.\n */\nexport const TIMELOCK_SECONDS = {\n ADD_OWNER: 172_800, // 48h\n REMOVE_OWNER: 86_400, // 24h\n ROTATE_OWNER: 86_400, // 24h\n SET_THRESHOLD: 172_800, // 48h\n ADD_VERIFIER: 172_800, // 48h\n REMOVE_VERIFIER: 86_400, // 24h\n ADD_GUARDIAN: 86_400, // 24h\n REMOVE_GUARDIAN: 86_400, // 24h\n RECOVERY: 604_800, // 7d — `TIMELOCK_RECOVERY`, the headline UX gate\n} as const;\n\n/** `DEFAULT_OP_EXPIRY_SECONDS` from `pending_ops.cairo:78`. The window is\n * measured from `valid_after`, not from propose time:\n * `expires_at = now + timelock + DEFAULT_OP_EXPIRY_SECONDS`\n * (governance/component.cairo). So a 48h op (add_owner, set_threshold) lives\n * 16 days from propose and a 7d recovery lives 21. Read `get_pending_op` for\n * the exact `expires_at` instead of adding 14d to the propose timestamp. The\n * op auto-expires at that point even if no one calls cancel; UI should\n * reflect it so users don't sit on a stale op. */\nexport const DEFAULT_OP_EXPIRY_SECONDS = 1_209_600; // 14d\n\n// ================================================================\n// Types\n// ================================================================\n\n/** Owner role on-chain. ROLE_OWNER can sign OEs; ROLE_GUARDIAN can\n * only `initiate_recovery` (no general signing power). */\nexport type OwnerRole = \"OWNER\" | \"GUARDIAN\";\n\n/**\n * Inputs shared across add-owner / rotate / initiate-recovery — they\n * all encode a (kind, pubkey, role, weight, label) tuple.\n *\n * `pubkeyBytes` is the per-kind felt-array layout exposed by the\n * matching `*PubkeyFelts` helper in `signers/{stark,ed25519,eip191,\n * webauthn}.ts`. The Cairo verifier calls `owner_commitment(kind,\n * pubkeyBytes)` to derive the on-chain owner_id; if the bytes\n * disagree with the kind's verifier expectation,\n * `_validate_pubkey_via_verifier` panics at execute time (audit M-1).\n */\nexport interface NewOwnerInput {\n kind: string;\n pubkeyBytes: bigint[];\n role: OwnerRole;\n weight: number;\n label: string;\n}\n\n/**\n * Coerce any felt-like to a non-negative bigint. Negative inputs are\n * rejected at this boundary because `(-1n).toString(16) === \"-1\"` —\n * the resulting calldata `\"0x-1\"` is not valid hex and would fail\n * at invoke time with an opaque \"could not deserialize\" error from\n * the RPC. Failing here gives the caller a clear, actionable message.\n */\nfunction _felt(x: bigint | string | number, field = \"felt\"): bigint {\n const v = typeof x === \"bigint\" ? x : BigInt(x);\n if (v < 0n) {\n throw new RangeError(`${field} must be a non-negative felt; got ${v.toString()}`);\n }\n return v;\n}\n\nfunction _encodeOwnerInput(input: NewOwnerInput): bigint[] {\n if (input.weight < 0) {\n throw new RangeError(`NewOwnerInput.weight must be non-negative; got ${input.weight}`);\n }\n const kindFelt = _felt(BigInt(shortString.encodeShortString(input.kind)), \"kind\");\n const roleFelt = input.role === \"OWNER\" ? ROLE_OWNER : ROLE_GUARDIAN;\n const pubkey = input.pubkeyBytes.map((p, i) => _felt(p, `pubkeyBytes[${i}]`));\n // Cairo Array<felt252> serializes as [len, ...elements].\n return [\n kindFelt,\n BigInt(pubkey.length),\n ...pubkey,\n roleFelt,\n BigInt(input.weight),\n _felt(BigInt(shortString.encodeShortString(input.label)), \"label\"),\n ];\n}\n\nfunction _call(walletAddress: bigint | string, entrypoint: string, calldata: bigint[]): Call {\n // Final defense in depth: catch any caller that constructs calldata\n // outside the helpers above. Cheap loop, runs once per builder call.\n for (let i = 0; i < calldata.length; i++) {\n if (calldata[i] < 0n) {\n throw new RangeError(\n `calldata[${i}] must be a non-negative felt; got ${calldata[i].toString()}`\n );\n }\n }\n return {\n contractAddress:\n typeof walletAddress === \"bigint\" ? \"0x\" + walletAddress.toString(16) : walletAddress,\n entrypoint,\n calldata: calldata.map((v) => \"0x\" + v.toString(16)),\n };\n}\n\n// ================================================================\n// Multi-owner governance: propose / execute / cancel\n// ================================================================\n\n/**\n * Build a `propose_add_owner(proposer, kind, pubkey_bytes, role,\n * weight, label)` call. Wrap in an OE signed by `proposer` and submit\n * through the paymaster. After confirmation, watch for the\n * `OpProposed` event to learn the `op_id`; then wait\n * `TIMELOCK_SECONDS.ADD_OWNER` and call `buildExecuteAddOwnerCall`.\n */\nexport function buildProposeAddOwnerCall(args: {\n walletAddress: bigint | string;\n proposer: number;\n newOwner: NewOwnerInput;\n}): Call {\n const calldata: bigint[] = [BigInt(args.proposer), ..._encodeOwnerInput(args.newOwner)];\n return _call(args.walletAddress, \"propose_add_owner\", calldata);\n}\n\n/**\n * Build an `execute_add_owner(op_id, kind, pubkey_bytes, role, weight,\n * label)` call. MUST be called after the 48h timelock from the matching\n * propose. The wallet recomputes the payload and asserts equality\n * before mutating `owner_set`.\n */\nexport function buildExecuteAddOwnerCall(args: {\n walletAddress: bigint | string;\n opId: bigint | string;\n newOwner: NewOwnerInput;\n}): Call {\n const calldata: bigint[] = [_felt(args.opId), ..._encodeOwnerInput(args.newOwner)];\n return _call(args.walletAddress, \"execute_add_owner\", calldata);\n}\n\nexport function buildProposeRemoveOwnerCall(args: {\n walletAddress: bigint | string;\n proposer: number;\n ownerId: number;\n}): Call {\n return _call(args.walletAddress, \"propose_remove_owner\", [\n BigInt(args.proposer),\n BigInt(args.ownerId),\n ]);\n}\n\nexport function buildExecuteRemoveOwnerCall(args: {\n walletAddress: bigint | string;\n opId: bigint | string;\n ownerId: number;\n}): Call {\n return _call(args.walletAddress, \"execute_remove_owner\", [\n _felt(args.opId),\n BigInt(args.ownerId),\n ]);\n}\n\nexport function buildProposeRotateOwnerCall(args: {\n walletAddress: bigint | string;\n proposer: number;\n ownerId: number;\n newPubkeyBytes: bigint[];\n}): Call {\n return _call(args.walletAddress, \"propose_rotate_owner\", [\n BigInt(args.proposer),\n BigInt(args.ownerId),\n BigInt(args.newPubkeyBytes.length),\n ...args.newPubkeyBytes,\n ]);\n}\n\nexport function buildExecuteRotateOwnerCall(args: {\n walletAddress: bigint | string;\n opId: bigint | string;\n ownerId: number;\n newPubkeyBytes: bigint[];\n}): Call {\n return _call(args.walletAddress, \"execute_rotate_owner\", [\n _felt(args.opId),\n BigInt(args.ownerId),\n BigInt(args.newPubkeyBytes.length),\n ...args.newPubkeyBytes,\n ]);\n}\n\nexport function buildProposeSetThresholdCall(args: {\n walletAddress: bigint | string;\n proposer: number;\n newThreshold: number;\n}): Call {\n return _call(args.walletAddress, \"propose_set_threshold\", [\n BigInt(args.proposer),\n BigInt(args.newThreshold),\n ]);\n}\n\nexport function buildExecuteSetThresholdCall(args: {\n walletAddress: bigint | string;\n opId: bigint | string;\n newThreshold: number;\n}): Call {\n return _call(args.walletAddress, \"execute_set_threshold\", [\n _felt(args.opId),\n BigInt(args.newThreshold),\n ]);\n}\n\n/**\n * Build a `cancel_pending_op(op_id)` call. Valid any time before the\n * op is executed; signed by any current owner via OE.\n */\nexport function buildCancelPendingOpCall(args: {\n walletAddress: bigint | string;\n opId: bigint | string;\n}): Call {\n return _call(args.walletAddress, \"cancel_pending_op\", [_felt(args.opId)]);\n}\n\n// ================================================================\n// Recovery: initiate / cancel / finalize\n// ================================================================\n\n/**\n * Build an `initiate_recovery(proposer, new_owner_kind, new_pubkey_bytes,\n * new_role, new_weight, new_label)` call.\n *\n * IMPORTANT: `proposer` MUST be an owner with `role == ROLE_GUARDIAN`.\n * If it's a regular owner, the wallet panics with\n * `'RECOVERY: not a guardian'`. The new owner being recovered to is\n * typically `role: \"OWNER\"` so it can sign after the timelock.\n *\n * After confirmation, the wallet starts a 7-day timelock\n * (`TIMELOCK_SECONDS.RECOVERY`). During the window:\n * - Any current ROLE_OWNER can call `cancel_recovery` to abort.\n * - After the window, anyone can call `finalize_recovery`.\n */\nexport function buildInitiateRecoveryCall(args: {\n walletAddress: bigint | string;\n /** owner_id of the guardian that's initiating */\n proposer: number;\n newOwner: NewOwnerInput;\n}): Call {\n const calldata: bigint[] = [BigInt(args.proposer), ..._encodeOwnerInput(args.newOwner)];\n return _call(args.walletAddress, \"initiate_recovery\", calldata);\n}\n\n/**\n * Build a `cancel_recovery(owner_id)` call. Signed by any current\n * ROLE_OWNER via OE — the canceler must hold a working signing key.\n * The owner_id arg identifies which owner is canceling (used by the\n * wallet for event attribution and the not-revoked / role-OWNER check).\n */\nexport function buildCancelRecoveryCall(args: {\n walletAddress: bigint | string;\n ownerId: number;\n}): Call {\n return _call(args.walletAddress, \"cancel_recovery\", [BigInt(args.ownerId)]);\n}\n\n/**\n * Build a `finalize_recovery(new_owner_kind, new_pubkey_bytes, new_role,\n * new_weight, new_label)` call.\n *\n * Permissionless after the 7-day timelock. The wallet recomputes the\n * pubkey commitment and asserts equality against the stored value\n * from `initiate_recovery`. Per audit H-1, the recovery path also\n * library-calls the per-kind verifier so a poison-pill pubkey from a\n * compromised guardian still fails at finalize time, not silently.\n *\n * Recovery is additive — existing owners stay. Follow up with\n * `buildProposeRemoveOwnerCall` for the stale devices.\n *\n * Because this call is NOT `_assert_self_call`-gated, the integrator\n * can either wrap it in an OE (signed by anyone) or dispatch directly\n * via a regular invoke. The Call shape is the same.\n */\nexport function buildFinalizeRecoveryCall(args: {\n walletAddress: bigint | string;\n newOwner: NewOwnerInput;\n}): Call {\n return _call(args.walletAddress, \"finalize_recovery\", _encodeOwnerInput(args.newOwner));\n}\n\n// ================================================================\n// State queries — read-only views\n// ================================================================\n\n/**\n * Compute the selector for a view; convenient for `provider.callContract`.\n * Exposed so SDK consumers can build their own `{ contractAddress,\n * entryPointSelector, calldata }` `Call`-shaped views without\n * re-deriving selectors.\n */\nexport const VIEW_SELECTORS = {\n get_pending_op: hash.getSelectorFromName(\"get_pending_op\"),\n get_pending_recovery: hash.getSelectorFromName(\"get_pending_recovery\"),\n get_owner: hash.getSelectorFromName(\"get_owner\"),\n} as const;\n\n/**\n * Coerce a timestamp argument (number or bigint) to a non-negative\n * bigint of whole seconds. Truncates fractional seconds via Math.floor\n * — important because `BigInt(Date.now() / 1000)` would otherwise\n * throw on a non-integer. NaN / ±Infinity are rejected.\n */\nfunction _toSecondsBigInt(value: number | bigint, field: string): bigint {\n if (typeof value === \"bigint\") return value;\n if (!Number.isFinite(value)) {\n throw new TypeError(`${field} must be a finite timestamp; got ${value}`);\n }\n return BigInt(Math.floor(value));\n}\n\n/**\n * Given a `valid_after` block timestamp (seconds) returned from\n * `get_pending_op` or `get_pending_recovery`, compute whether the\n * timelock has elapsed against a given clock reading. Cheap UI helper\n * so consumers don't reach for a date library. Accepts fractional\n * `number` seconds (e.g., `Date.now() / 1000`) — truncates via floor.\n */\nexport function isReadyToExecute(validAfterSecs: number | bigint, nowSecs: number): boolean {\n return _toSecondsBigInt(nowSecs, \"nowSecs\") >= _toSecondsBigInt(validAfterSecs, \"validAfterSecs\");\n}\n\n/**\n * Seconds remaining until a pending op / recovery becomes executable.\n * Returns 0 when the timelock has already elapsed. Useful for showing\n * a countdown in UI without a separate clock import. Accepts fractional\n * `number` seconds — truncates via floor.\n */\nexport function secondsUntilExecutable(validAfterSecs: number | bigint, nowSecs: number): number {\n const remaining =\n _toSecondsBigInt(validAfterSecs, \"validAfterSecs\") - _toSecondsBigInt(nowSecs, \"nowSecs\");\n return remaining <= 0n ? 0 : Number(remaining);\n}\n","/**\n * ShhhAccount — ergonomic drop-in adapter for signing as a SHHH V8.4\n * owner from a raw owner private key.\n *\n * Why this exists: a SHHH account is account-abstracted and its\n * `__validate__` is DISABLED (shhh-wallet-cairo `src/account.cairo`\n * panics with `'SHHH: __validate__ disabled'`), so the standard\n * starknet.js path — `new Account(provider, addr, key).execute(calls)`\n * — does NOT work. The only authorized execution path is\n * `execute_from_outside_v2`: you sign an OutsideExecution and submit it.\n *\n * This wrapper hides that plumbing so a holder of an exported STARK\n * owner key can write the familiar:\n *\n * const account = new ShhhAccount(provider, address, privateKey, {\n * submit: submitViaAccount(fundedRelayer),\n * });\n * const { transactionHash } = await account.execute(calls);\n *\n * It signs the OE with the owner key (ownerIndex 0 = primary) and\n * broadcasts via the configured `submit` strategy — either a funded\n * Starknet account you control (fully self-sovereign, no Chipi servers)\n * or a paymaster relay (gasless). If you don't configure `submit`, call\n * `signExecution()` and broadcast the calldata yourself.\n *\n * Scope: STARK-kind owners. Other signer kinds (Ed25519 / EIP-191 /\n * WebAuthn) have their own envelope builders; this adapter targets the\n * exported-private-key use case, which is always a STARK owner.\n */\n\nimport { Account, type Call, type ProviderInterface } from \"starknet\";\n\nimport {\n buildOutsideExecution,\n computeOeHash,\n MAX_OE_VALIDITY_WINDOW_SECONDS,\n OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER,\n} from \"./oe\";\nimport { buildStarkEnvelope } from \"./signers/stark\";\nimport { serializeExecuteFromOutsideV2Calldata, resolveShhhChainId } from \"./execute-paymaster-raw\";\nimport type { OutsideExecution } from \"./snip12-hash\";\n\n/**\n * How a signed `execute_from_outside_v2` calldata is broadcast. The\n * account itself can never pay gas (`__validate__` is disabled), so the\n * broadcaster is always a separate party: a funded relayer you control,\n * or a paymaster service. It only pays gas — it is NOT the signer.\n */\nexport type ShhhSubmit = (input: {\n accountAddress: string;\n calldata: string[];\n}) => Promise<{ transactionHash: string }>;\n\nexport interface ShhhAccountOptions {\n /**\n * Owner index into the wallet's owner_set. Defaults to `0n` (the\n * primary owner — what an exported private key controls). Override\n * for additional owners added via `propose_add_owner`.\n */\n ownerIndex?: bigint;\n /**\n * Chain id used for SNIP-12 hashing. Defaults to Starknet mainnet\n * (Chipi is mainnet-only). A wrong value makes the account reject the\n * signature on chain.\n */\n chainId?: bigint | string;\n /** Broadcast strategy. Omit to sign-only via {@link ShhhAccount.signExecution}. */\n submit?: ShhhSubmit;\n}\n\nexport interface ShhhSignedExecution {\n /** The OutsideExecution that was signed. */\n outsideExecution: OutsideExecution;\n /** The owner signature envelope `[V2_SNIP12, owner_id, 'STARK', r, s]`. */\n signature: bigint[];\n /** The SNIP-12 message hash that was signed. */\n messageHash: bigint;\n /** Flat felt calldata for the `execute_from_outside_v2` selector. */\n calldata: string[];\n}\n\nexport interface ShhhExecuteOptions {\n /** Override the replay nonce. Default: `(Date.now() << 24) | random24`. */\n nonce?: bigint | string;\n /**\n * How long (seconds from now) the OE stays valid. Default: the account\n * max (~2h). The builder backdates `execute_after` by a 60s clock-skew\n * buffer, and the account caps the total window at 2h, so the usable\n * max here is `MAX_OE_VALIDITY_WINDOW_SECONDS - 60` (7140s). Values\n * above that throw with a clear message rather than a cryptic builder\n * error.\n */\n validForSeconds?: number;\n}\n\n/** Unique-enough OE nonce: ms timestamp shifted left 24 bits, OR a 24-bit random suffix. */\nfunction generateNonce(): bigint {\n // 0x1000000 (2^24), not 0xffffff, so the suffix spans the full 24-bit\n // range [0, 2^24) — Math.random() is [0, 1), so * 0xffffff would never\n // reach the top value.\n return (BigInt(Date.now()) << 24n) | BigInt(Math.floor(Math.random() * 0x1000000));\n}\n\nexport class ShhhAccount {\n /** The provider, exposed for convenience (e.g. `account.provider.waitForTransaction`). */\n readonly provider: ProviderInterface;\n readonly address: string;\n readonly ownerIndex: bigint;\n readonly chainId: bigint | string;\n\n private readonly privateKey: bigint | string;\n private readonly submitFn?: ShhhSubmit;\n\n constructor(\n provider: ProviderInterface,\n address: string,\n privateKey: bigint | string,\n options: ShhhAccountOptions = {}\n ) {\n this.provider = provider;\n this.address = address;\n this.privateKey = privateKey;\n this.ownerIndex = options.ownerIndex ?? 0n;\n this.chainId = options.chainId ?? resolveShhhChainId({});\n this.submitFn = options.submit;\n }\n\n /**\n * Build + sign an OutsideExecution for `calls` and return the\n * serialized `execute_from_outside_v2` calldata (plus the underlying\n * pieces). Use this when you want to broadcast the calldata yourself.\n */\n async signExecution(\n calls: Call[],\n options: ShhhExecuteOptions = {}\n ): Promise<ShhhSignedExecution> {\n if (options.validForSeconds !== undefined) {\n // The builder defaults `execute_after` to `now - 60s` (clock-skew\n // buffer) and the account caps the total span at\n // MAX_OE_VALIDITY_WINDOW_SECONDS. So the usable validity measured\n // from now is `max - 60`. Validate here with a clear message instead\n // of letting `buildOutsideExecution` throw a cryptic window error at\n // the boundary (e.g. validForSeconds === MAX would overflow by 60s).\n const maxValid = MAX_OE_VALIDITY_WINDOW_SECONDS - OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER;\n if (!Number.isFinite(options.validForSeconds) || options.validForSeconds <= 0) {\n throw new Error(\n \"ShhhAccount: validForSeconds must be a positive finite number of seconds.\"\n );\n }\n if (options.validForSeconds > maxValid) {\n throw new Error(\n `ShhhAccount: validForSeconds (${options.validForSeconds}) exceeds the max ${maxValid}s ` +\n `(the account caps the OE window at ${MAX_OE_VALIDITY_WINDOW_SECONDS}s and ` +\n `${OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER}s is reserved for clock skew).`\n );\n }\n }\n const outsideExecution = buildOutsideExecution({\n nonce: options.nonce ?? generateNonce(),\n calls,\n ...(options.validForSeconds !== undefined\n ? { executeBefore: BigInt(Math.floor(Date.now() / 1000) + options.validForSeconds) }\n : {}),\n });\n const messageHash = computeOeHash(outsideExecution, this.address, this.chainId);\n const signature = buildStarkEnvelope({\n privateKey: this.privateKey,\n messageHash,\n ownerIndex: this.ownerIndex,\n });\n const calldata = serializeExecuteFromOutsideV2Calldata({ outsideExecution, signature });\n return { outsideExecution, signature, messageHash, calldata };\n }\n\n /**\n * Sign `calls` and broadcast them via the configured `submit` strategy.\n * Mirrors starknet.js `Account.execute` ergonomically. Returns the\n * transaction hash without waiting for inclusion — use\n * `provider.waitForTransaction(transactionHash)` if you need to block.\n */\n async execute(\n calls: Call[],\n options: ShhhExecuteOptions = {}\n ): Promise<{ transactionHash: string }> {\n if (!this.submitFn) {\n throw new Error(\n \"ShhhAccount.execute: no submit strategy configured. Pass `submit` in the \" +\n \"ShhhAccount constructor options (e.g. submitViaAccount(fundedAccount) for \" +\n \"self-sovereign, or a paymaster relay for gasless), or call signExecution() \" +\n \"and broadcast the calldata yourself.\"\n );\n }\n const { calldata } = await this.signExecution(calls, options);\n return this.submitFn({ accountAddress: this.address, calldata });\n }\n}\n\n/**\n * Self-sovereign submit strategy: relay the signed OE through any funded\n * Starknet account you control. The funded account only pays gas — it is\n * NOT the signer, and never sees the SHHH owner key. This is the path\n * that needs no Chipi servers at all.\n */\nexport function submitViaAccount(funded: Account): ShhhSubmit {\n return async ({ accountAddress, calldata }) => {\n const { transaction_hash } = await funded.execute({\n contractAddress: accountAddress,\n entrypoint: \"execute_from_outside_v2\",\n calldata,\n });\n return { transactionHash: transaction_hash };\n };\n}\n"]}
1
+ {"version":3,"sources":["../src/shhh/compute-wallet-address.ts","../src/shhh/snip12-hash.ts","../src/shhh/threshold.ts","../src/shhh/oe.ts","../src/shhh/signers/ed25519.ts","../src/lib/encryption.ts","../src/encryption.ts","../src/shhh/signers/stark.ts","../src/shhh/execute-paymaster-raw.ts","../src/client.ts","../src/wallets.ts","../src/migrate-to-shhh.ts","../src/execute-paymaster-transaction.ts","../src/paymaster-adapter.ts","../src/shhh/migrate.ts","../src/transactions.ts","../src/exchanges.ts","../src/sku-purchases.ts","../src/skus.ts","../src/sessions.ts","../src/session-codec.ts","../src/session-calls.ts","../src/treasury.ts","../src/wait-for-transaction.ts","../src/x402/session-tx-verifier.ts","../src/ai.ts","../src/starknet-signature.ts","../src/x402/facilitator.ts","../src/sign-typed-data.ts","../src/shhh/execute-external-owner.ts","../src/shhh/signers/stark-snip12.ts","../src/shhh/recovery.ts","../src/chipi-sdk.ts","../src/chipi-server-sdk.ts","../src/chipi-browser-sdk.ts","../src/index.ts","../src/x402/shhh-client.ts","../src/x402/middleware.ts","../src/siws.ts","../src/shhh/index.ts","../src/shhh/verifier-classes.ts","../src/shhh/signers/eip191.ts","../src/shhh/signers/webauthn.ts","../src/shhh/signers/jwt_apple_sub.ts","../src/shhh/account.ts"],"names":["hash","shortString","ISIGNER_CANONICAL_LABEL","CallData","OE_DOMAIN_NAME","OE_DOMAIN_VERSION","OE_DOMAIN_REVISION","STARKNET_MESSAGE_PREFIX","SIG_VERSION_V1_HEX_ASCII","SIG_VERSION_V2_SNIP12","SIG_VERSION_V2_THRESHOLD","ISRC9_V2_ID","ISIGNER_ID","felt","MIN_THRESHOLD_OWNERS","SHHH_KIND_GAS_OVERHEAD","ANY_CALLER_FELT","MAX_OE_VALIDITY_WINDOW_SECONDS","encryptPrivateKey","decryptPrivateKey","CryptoES","init_encryption","ec","isValidApiKey","ChipiAuthError","STARKNET_NETWORKS","API_VERSIONING","validateErrorResponse","ChipiApiError","handleApiError","getWalletTypeFromClassHash","WALLET_CLASS_HASHES","typedData","withRpcFallback","provider","WALLET_RPC_ENDPOINTS","executeShhhSponsoredRaw","RpcProvider","Account","apiMessage","ChipiSessionError","SESSION_ERRORS","buildOutsideExecution","computeOeHash","resolveShhhChainId","serializeExecuteFromOutsideV2Calldata","r","s","sessionSignature","num","randomBytes","SHHH_VERIFIER_CLASS_HASHES","API_ENDPOINTS","ChipiTransactionError","CairoCustomEnum","CairoOption","CairoOptionVariant","STARKNET_CONTRACTS","formatAmount","Chain","SKU_CONTRACTS","cairo","CARRIER_IDS","SERVICE_TYPES","SESSION_ENTRYPOINTS","SESSION_DEFAULTS","toBigInt","CONTRACT_ADDRESSES","TRANSFER_SELECTOR","buildX402TypedData","starknetTypedData","uint256","toFeltHex","typedDataUtil","buildStarkEnvelope","_felt","STARK_KIND_TAG_FELT","key","TOKEN_DECIMALS","requirement","assertBytes","bytesBeToU256","bigintToBe32","normalizePrivateKey","U128_MASK","generateNonce"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAkCA,SAAS,SAAS,MAAA,EAAwC;AACxD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,KAAO,OAAO,CAAA,KAAM,QAAA,GAAW,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,IAAI,CAAE,CAAA;AACnF,EAAA,OAAO,MAAA,CAAOA,aAAA,CAAK,6BAAA,CAA8B,KAAK,CAAC,CAAA;AACzD;AAGO,SAAS,eAAA,CAAgB,SAAiB,MAAA,EAA0B;AACzE,EAAA,OAAO,QAAA,CAAS,CAAC,OAAA,EAAS,GAAG,MAAM,CAAC,CAAA;AACtC;AASO,SAAS,kBAAA,CAAmB,aAAqB,MAAA,EAA0B;AAChF,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AAIvB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAOC,oBAAA,CAAY,iBAAA,CAAkB,WAAW,CAAC,CAAA;AACjE,EAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,OAAA,EAAS,MAAM,CAAA;AAClD,EAAA,OAAO,QAAA,CAAS,CAAC,OAAA,EAAS,UAAU,CAAC,CAAA;AACvC;AAGO,SAAS,mBAAmB,KAAA,EAAoC;AACrE,EAAA,MAAM;AAAA,IACJ,SAAA;AAAA,IACA,WAAA;AAAA,IACA,MAAA;AAAA,IACA,iBAAA;AAAA,IACA,KAAA,GAAQ,SAAA;AAAA,IACR,eAAA,GAAkB;AAAA,GACpB,GAAI,KAAA;AAEJ,EAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,WAAA,EAAa,MAAM,CAAA;AACnD,EAAA,MAAM,OAAA,GAAU,MAAA,CAAOA,oBAAA,CAAY,iBAAA,CAAkB,WAAW,CAAC,CAAA;AACjE,EAAA,MAAM,SAAA,GAAY,MAAA,CAAOA,oBAAA,CAAY,iBAAA,CAAkB,KAAK,CAAC,CAAA;AAG7D,EAAA,MAAM,IAAA,GAA+B;AAAA,IACnC,OAAA;AAAA,IACA,iBAAA;AAAA,IACA,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,IACpB,GAAG,MAAA;AAAA,IACH;AAAA,GACF;AAEA,EAAA,MAAM,aAAaD,aAAA,CAAK,gCAAA;AAAA,IACtB,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,EAAE,CAAA;AAAA,IACvB,IAAA,GAAO,SAAA,CAAU,QAAA,CAAS,EAAE,CAAA;AAAA,IAC5B,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAO,OAAO,CAAA,KAAM,QAAA,GAAW,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,GAAI,CAAE,CAAA;AAAA,IACnE,IAAA,GAAO,eAAA,CAAgB,QAAA,CAAS,EAAE;AAAA,GACpC;AACA,EAAA,OAAO,OAAO,UAAU,CAAA;AAC1B;AAhGA,IAAA,2BAAA,GAAA,KAAA,CAAA;AAAA,EAAA,oCAAA,GAAA;AAAA,EAAA;AAAA,CAAA,CAAA;ACiDO,SAAS,gBAAA,GAA2B;AACzC,EAAA,OAAO,MAAA,CAAOA,aAAAA,CAAK,cAAA,CAAeE,+BAAuB,CAAC,CAAA;AAC5D;AAkBA,SAAS,SAAS,CAAA,EAAqC;AACrD,EAAA,IAAI,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,CAAA;AAClC,EAAA,IAAI,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,OAAO,CAAC,CAAA;AAC1C,EAAA,OAAO,OAAO,CAAC,CAAA;AACjB;AAEA,SAAS,aAAa,MAAA,EAAwC;AAC5D,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,KAAO,OAAO,CAAA,KAAM,QAAA,GAAW,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,IAAI,CAAE,CAAA;AACnF,EAAA,OAAO,MAAA,CAAOF,aAAAA,CAAK,6BAAA,CAA8B,KAAK,CAAC,CAAA;AACzD;AAEO,SAAS,SAAS,IAAA,EAAoB;AAC3C,EAAA,MAAM,gBAA0BG,iBAAA,CAAS,KAAA;AAAA,IACtC,KAAA,CAAM,QAAQ,IAAA,CAAK,QAAQ,IAAI,IAAA,CAAK,QAAA,GAAW,CAAC,IAAA,CAAK,QAAQ;AAAA,GAChE;AACA,EAAA,MAAM,gBAAgB,aAAA,CAAc,GAAA,CAAI,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AACxD,EAAA,MAAM,YAAA,GAAe,aAAa,aAAa,CAAA;AAC/C,EAAA,OAAO,YAAA,CAAa;AAAA,IAClB,mBAAA;AAAA,IACA,QAAA,CAAS,KAAK,eAAe,CAAA;AAAA,IAC7B,QAAA,CAASH,aAAAA,CAAK,WAAA,CAAY,IAAA,CAAK,UAAU,CAAC,CAAA;AAAA,IAC1C;AAAA,GACD,CAAA;AACH;AAEO,SAAS,UAAU,KAAA,EAAuB;AAC/C,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,GAAA,CAAI,QAAQ,CAAA;AACrC,EAAA,OAAO,aAAa,UAAU,CAAA;AAChC;AAEO,SAAS,mBAAmB,WAAA,EAAsC;AACvE,EAAA,OAAO,YAAA,CAAa;AAAA,IAClB,8BAAA;AAAA,IACA,OAAOI,sBAAc,CAAA;AAAA,IACrBC,yBAAA;AAAA,IACA,SAAS,WAAW,CAAA;AAAA,IACpBC;AAAA,GACD,CAAA;AACH;AAEO,SAAS,2BAA2B,EAAA,EAA8B;AACvE,EAAA,MAAM,cAAA,GAAiB,SAAA,CAAU,EAAA,CAAG,KAAK,CAAA;AACzC,EAAA,OAAO,YAAA,CAAa;AAAA,IAClB,gCAAA;AAAA,IACA,QAAA,CAAS,GAAG,MAAM,CAAA;AAAA,IAClB,QAAA,CAAS,GAAG,KAAK,CAAA;AAAA,IACjB,EAAA,CAAG,aAAA;AAAA,IACH,EAAA,CAAG,cAAA;AAAA,IACH;AAAA,GACD,CAAA;AACH;AAOO,SAAS,iBAAA,CACd,EAAA,EACA,eAAA,EACA,WAAA,EACQ;AACR,EAAA,MAAM,UAAA,GAAa,mBAAmB,WAAW,CAAA;AACjD,EAAA,MAAM,UAAA,GAAa,2BAA2B,EAAE,CAAA;AAChD,EAAA,OAAO,YAAA,CAAa;AAAA,IAClB,OAAOC,+BAAuB,CAAA;AAAA,IAC9B,UAAA;AAAA,IACA,SAAS,eAAe,CAAA;AAAA,IACxB;AAAA,GACD,CAAA;AACH;AAOO,SAAS,0BAA0B,CAAA,EAAuB;AAC/D,EAAA,MAAM,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,IAAI,GAAG,CAAA;AAC3C,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAA;AACrC;AArJA,IAmBa,gCAAA,CAAA,CAGA,mBAAA,CAAA,CAGA,8BAAA,CAAA,CAGAA,wCAAA,CAAA,CAEAH,+BAAA,CAAA,CACAC,kCAAA,CAAA,CACAC,mCAAA,CAAA,CAEAE,yCAAA,CAAA,CACAC,sCAAA,CAAA,CACAC,yCAAA,CAAA,CAGAC,4BAAA,CAAA,CAGAC,2BAAA,CAAA,CAIAV;AA9Cb,IAAA,gBAAA,GAAA,KAAA,CAAA;AAAA,EAAA,yBAAA,GAAA;AAmBO,IAAM,gCAAA,GACX,iEAAA;AAEK,IAAM,mBAAA,GACX,kEAAA;AAEK,IAAM,8BAAA,GACX,kEAAA;AAEK,IAAMK,+BAAA,GAA0BN,oBAAAA,CAAY,iBAAA,CAAkB,kBAAkB,CAAA;AAEhF,IAAMG,sBAAA,GAAiBH,oBAAAA,CAAY,iBAAA,CAAkB,8BAA8B,CAAA;AACnF,IAAMI,yBAAA,GAAoB,EAAA;AAC1B,IAAMC,0BAAA,GAAqB,EAAA;AAE3B,IAAME,gCAAA,GAA2BP,oBAAAA,CAAY,iBAAA,CAAkB,cAAc,CAAA;AAC7E,IAAMQ,6BAAA,GAAwBR,oBAAAA,CAAY,iBAAA,CAAkB,WAAW,CAAA;AACvE,IAAMS,gCAAA,GAA2BT,oBAAAA,CAAY,iBAAA,CAAkB,cAAc,CAAA;AAG7E,IAAMU,mBAAA,GAAc,MAAA;AAAA,MACzB;AAAA,KACF;AACO,IAAMC,kBAAA,GAAa,MAAA;AAAA,MACxB;AAAA,KACF;AAEO,IAAMV,+BAAA,GAA0B,YAAA;AAAA,EAAA;AAAA,CAAA,CAAA;ACgChC,SAAS,4BAA4B,QAAA,EAA4B;AACtE,EAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,wEAAA,EAA2E,SAAS,MAAM,CAAA;AAAA,KAC5F;AAAA,EACF;AACA,EAAA,MAAM,GAAA,GAAM,SAAS,CAAC,CAAA;AACtB,EAAA,IAAI,QAAQ,aAAA,EAAe;AACzB,IAAA,IAAI,QAAQ,gBAAA,EAAkB;AAC5B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,sBAAsB,GAAG,CAAA;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,qDAAqD,OAAA,IAAW,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,EAAE,CAAC,CAAA;AAAA,KACzF;AAAA,EACF;AACA,EAAA,OAAO,SAAS,CAAC,CAAA;AACnB;AAEA,SAAS,sBAAsBW,KAAAA,EAA6B;AAC1D,EAAA,IAAI;AACF,IAAA,OAAOZ,qBAAY,iBAAA,CAAkB,IAAA,GAAOY,KAAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAuBO,SAAS,uBAAuB,IAAA,EAAgD;AACrF,EAAA,MAAM,EAAE,gBAAe,GAAI,IAAA;AAE3B,EAAA,IAAI,cAAA,CAAe,SAASC,4BAAA,EAAsB;AAChD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,sBAAA,EAAyBA,4BAAoB,CAAA,sBAAA,EACpC,cAAA,CAAe,MAAM,CAAA,mDAAA;AAAA,KAEhC;AAAA,EACF;AAWA,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AACnC,EAAA,MAAM,MAAgB,CAAC,gBAAA,EAAkB,MAAA,CAAO,cAAA,CAAe,MAAM,CAAC,CAAA;AAEtE,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,cAAA,CAAe,QAAQ,CAAA,EAAA,EAAK;AAC9C,IAAA,MAAM,GAAA,GAAM,eAAe,CAAC,CAAA;AAC5B,IAAA,MAAM,OAAA,GAAU,4BAA4B,GAAG,CAAA;AAC/C,IAAA,MAAM,GAAA,GAAM,QAAQ,QAAA,EAAS;AAC7B,IAAA,IAAI,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA,EAAG;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,8BAA8B,IAAA,GAAO,OAAA,CAAQ,SAAS,EAAE,CAAC,sBAAsB,CAAC,CAAA;AAAA,OAClF;AAAA,IACF;AACA,IAAA,UAAA,CAAW,IAAI,GAAG,CAAA;AAClB,IAAA,IAAI,GAAA,CAAI,SAAS,CAAA,EAAG;AAClB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,uBAAA,EAA0B,CAAC,CAAA,mDAAA,EAAsD,GAAA,CAAI,MAAM,CAAA,MAAA;AAAA,OAC7F;AAAA,IACF;AACA,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,CAAC,CAAA;AACzB,IAAA,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,MAAM,CAAC,CAAA;AAC7B,IAAA,KAAA,MAAWD,SAAQ,KAAA,EAAO;AACxB,MAAA,IAAIA,QAAO,EAAA,EAAI;AACb,QAAA,MAAM,IAAI,UAAA;AAAA,UACR,oBAAoB,CAAC,CAAA,qDAAA;AAAA,SACvB;AAAA,MACF;AACA,MAAA,GAAA,CAAI,KAAKA,KAAI,CAAA;AAAA,IACf;AAAA,EACF;AAEA,EAAA,OAAO,GAAA;AACT;AAoBO,SAAS,uBAAuB,QAAA,EAErC;AACA,EAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yDAAA,EAA4D,QAAA,CAAS,MAAM,CAAA,CAAE,CAAA;AAAA,EAC/F;AACA,EAAA,IAAI,QAAA,CAAS,CAAC,CAAA,KAAM,gBAAA,EAAkB;AACpC,IAAA,MAAM,IAAI,MAAM,CAAA,iDAAA,EAAoD,QAAA,CAAS,CAAC,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA,CAAE,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,QAAA,CAAS,CAAC,CAAC,CAAA;AAC5B,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,CAAC,CAAA,IAAK,IAAIC,4BAAA,EAAsB;AACpD,IAAA,MAAM,IAAI,MAAM,CAAA,gCAAA,EAAmCA,4BAAoB,SAAS,QAAA,CAAS,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/F;AAMA,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AACnC,EAAA,MAAM,iBAA6B,EAAC;AACpC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,IAAI,MAAA,IAAU,SAAS,MAAA,EAAQ;AAC7B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oCAAA,EAAuC,CAAC,CAAA,iBAAA,CAAmB,CAAA;AAAA,IAC7E;AACA,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,MAAM,CAAC,CAAA;AACtC,IAAA,MAAA,IAAU,CAAA;AACV,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA,IAAK,SAAS,CAAA,EAAG;AAC3C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,cAAA,EAAiB,CAAC,CAAA,2BAAA,EAA8B,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1E;AACA,IAAA,IAAI,MAAA,GAAS,MAAA,GAAS,QAAA,CAAS,MAAA,EAAQ;AACrC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,cAAA,EAAiB,CAAC,CAAA,kCAAA,EAAqC,MAAM,YACjD,MAAM,CAAA,QAAA,EAAW,SAAS,MAAM,CAAA,CAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,MAAA,EAAQ,SAAS,MAAM,CAAA;AACpD,IAAA,KAAA,MAAWD,SAAQ,KAAA,EAAO;AACxB,MAAA,IAAIA,QAAO,EAAA,EAAI;AACb,QAAA,MAAM,IAAI,UAAA;AAAA,UACR,iBAAiB,CAAC,CAAA,qDAAA;AAAA,SACpB;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,OAAA,GAAU,MAAM,CAAC,CAAA;AACvB,IAAA,IAAI,WAAW,YAAA,EAAc;AAC3B,MAAA,IAAI,YAAY,gBAAA,EAAkB;AAChC,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,iBAAiB,CAAC,CAAA,+FAAA;AAAA,SACpB;AAAA,MACF;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,iBAAiB,CAAC,CAAA,YAAA,EAAe,OAAA,CAAQ,QAAA,CAAS,EAAE,CAAC,CAAA,sFAAA;AAAA,OACvD;AAAA,IACF;AACA,IAAA,MAAM,KAAA,GAAQ,CAAC,aAAA,EAAe,GAAG,KAAK,CAAA;AACtC,IAAA,MAAM,GAAA,GAAM,QAAQ,QAAA,EAAS;AAC7B,IAAA,IAAI,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA,EAAG;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,8BAA8B,IAAA,GAAO,OAAA,CAAQ,SAAS,EAAE,CAAC,sBAAsB,CAAC,CAAA;AAAA,OAClF;AAAA,IACF;AACA,IAAA,UAAA,CAAW,IAAI,GAAG,CAAA;AAClB,IAAA,cAAA,CAAe,KAAK,KAAK,CAAA;AACzB,IAAA,MAAA,IAAU,MAAA;AAAA,EACZ;AACA,EAAA,IAAI,MAAA,KAAW,SAAS,MAAA,EAAQ;AAC9B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,sCAAsC,CAAA,GAAI,CAAC,YAAY,MAAM,CAAA,SAAA,EACjD,SAAS,MAAM,CAAA,CAAA;AAAA,KAC7B;AAAA,EACF;AACA,EAAA,OAAO,EAAE,cAAA,EAAe;AAC1B;AAsBO,SAAS,6BACd,MAAA,EACQ;AACR,EAAA,IAAI,MAAA,CAAO,SAASC,4BAAA,EAAsB;AACxC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,sBAAA,EAAyBA,4BAAoB,CAAA,uCAAA,EACrB,MAAA,CAAO,MAAM,CAAA;AAAA,KACvC;AAAA,EACF;AACA,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,KAAA,MAAW,EAAE,UAAA,EAAW,IAAK,MAAA,EAAQ;AACnC,IAAA,MAAM,QAAA,GAAWC,8BAAuB,UAAU,CAAA;AAClD,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,+BAA+B,UAAU,CAAA,2CAAA;AAAA,OAC3C;AAAA,IACF;AACA,IAAA,KAAA,IAAS,QAAA;AAAA,EACX;AACA,EAAA,OAAO,KAAA;AACT;AA5TA,IA2DM,eACA,gBAAA,CAAA,CAGOD;AA/Db,IAAA,cAAA,GAAA,KAAA,CAAA;AAAA,EAAA,uBAAA,GAAA;AAqDA,IAAA,gBAAA,EAAA;AAMA,IAAM,aAAA,GAAgB,OAAOL,6BAAqB,CAAA;AAClD,IAAM,gBAAA,GAAmB,OAAOC,gCAAwB,CAAA;AAGjD,IAAMI,4BAAA,GAAuB,CAAA;AAAA,EAAA;AAAA,CAAA,CAAA;;;AC/DpC,IAAA,UAAA,GAAA,EAAA;AAAA,QAAA,CAAA,UAAA,EAAA;AAAA,EAAA,eAAA,EAAA,MAAAE,uBAAA;AAAA,EAAA,8BAAA,EAAA,MAAAC,sCAAA;AAAA,EAAA,kCAAA,EAAA,MAAA,kCAAA;AAAA,EAAA,qBAAA,EAAA,MAAA,qBAAA;AAAA,EAAA,aAAA,EAAA,MAAA,aAAA;AAAA,EAAA,oBAAA,EAAA,MAAA,oBAAA;AAAA,EAAA,uBAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AA0DO,SAAS,sBAAsB,MAAA,EAqBjB;AACnB,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAC,CAAA;AACnD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,YAAA,IAAgB,MAAA,GAAS,OAAO,kCAAkC,CAAA;AAOvF,EAAA,MAAM,MAAA,GACJ,OAAO,aAAA,IACP,MAAA,GAAS,OAAOA,sCAA8B,CAAA,GAAI,OAAO,kCAAkC,CAAA;AAC7F,EAAA,IAAI,UAAU,KAAA,EAAO;AAGnB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,CAAA,8CAAA,EAAiD,KAAK,CAAA,EAAA;AAAA,KAChF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,GAAS,KAAA,GAAQ,MAAA,CAAOA,sCAA8B,CAAA,EAAG;AAC3D,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mBAAA,EAAsB,MAAA,GAAS,KAAK,CAAA,cAAA,EAAiBA,sCAA8B,CAAA,oCAAA;AAAA,KACrF;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,OAAO,MAAA,IAAUD,uBAAA;AAAA,IACzB,OAAO,MAAA,CAAO,KAAA;AAAA,IACd,aAAA,EAAe,KAAA;AAAA,IACf,cAAA,EAAgB,MAAA;AAAA,IAChB,OAAO,MAAA,CAAO;AAAA,GAChB;AACF;AAUO,SAAS,aAAA,CACd,EAAA,EACA,cAAA,EACA,OAAA,EACQ;AACR,EAAA,OAAO,iBAAA,CAAkB,EAAA,EAAI,cAAA,EAAgB,OAAO,CAAA;AACtD;AAyBO,SAAS,qBAAqB,MAAA,EAKxB;AACX,EAAA,MAAM,GAAA,GACJ,OAAO,MAAA,CAAO,OAAA,KAAY,QAAA,GACtB,MAAA,CAAO,OAAA,GACP,MAAA,CAAOf,oBAAAA,CAAY,iBAAA,CAAkB,MAAA,CAAO,OAAO,CAAC,CAAA;AAC1D,EAAA,OAAO;AAAA,IACL,OAAOQ,6BAAqB,CAAA;AAAA,IAC5B,MAAA,CAAO,OAAA;AAAA,IACP,GAAA;AAAA,IACA,GAAG,MAAA,CAAO,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA,CAAO,CAAC,CAAE;AAAA,GACtE;AACF;AA0BO,SAAS,wBAAwB,cAAA,EAAsC;AAC5E,EAAA,OAAO,sBAAA,CAAuB,EAAE,cAAA,EAAgB,CAAA;AAClD;AAtKaO,kCAOAC,+CAAA,CAAA,KAeA;AAnDb,IAAA,OAAA,GAAA,KAAA,CAAA;AAAA,EAAA,gBAAA,GAAA;AAiBA,IAAA,gBAAA,EAAA;AAmKA,IAAA,cAAA,EAAA;AAvJO,IAAMD,uBAAA,GAAkB,MAAA,CAAOf,oBAAAA,CAAY,iBAAA,CAAkB,YAAY,CAAC,CAAA;AAO1E,IAAMgB,sCAAA,GAAiC,IAAI,EAAA,GAAK,EAAA;AAehD,IAAM,kCAAA,GAAqC,EAAA;AAAA,EAAA;AAAA,CAAA,CAAA;ACTlD,eAAe,gBAAA,GAAqD;AAClE,EAAA,IAAI,mBAAmB,OAAO,iBAAA;AAC9B,EAAA,MAAM,WAAW,YAAY;AAC3B,IAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAQ,CAAA;AACpC,IAAA,MAAM,OAAO,IAAA,EAAK;AAClB,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,GAAG;AACH,EAAA,iBAAA,GAAoB,OAAA;AACpB,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA;AAAA,EACf,SAAS,GAAA,EAAK;AAGZ,IAAA,IAAI,iBAAA,KAAsB,SAAS,iBAAA,GAAoB,IAAA;AACvD,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAOA,SAAS,cAAc,KAAA,EAAkD;AACvE,EAAA,IAAI,KAAA,CAAM,WAAW,EAAA,EAAI;AACvB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4CAAA,EAA+C,KAAA,CAAM,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAChF;AACA,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,IAAI,IAAA,GAAO,EAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK,GAAA,IAAO,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAA,IAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AACpE,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,KAAK,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,EAAA,GAAK,CAAC,CAAC,CAAA,IAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAC1E,EAAA,OAAO,EAAE,KAAK,IAAA,EAAK;AACrB;AAEA,SAAS,gBAAgB,KAAA,EAA2B;AAClD,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG,CAAA,IAAK,CAAA,EAAG,CAAA,EAAA,EAAK,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAA;AAC3E,EAAA,OAAO,CAAA;AACT;AAUO,SAAS,mBAAmB,WAAA,EAAiC;AAClE,EAAA,OAAO,0BAA0B,WAAW,CAAA;AAC9C;AAQO,SAAS,eAAe,SAAA,EAA+B;AAC5D,EAAA,MAAM,EAAE,GAAA,EAAK,IAAA,EAAK,GAAI,cAAc,SAAS,CAAA;AAC7C,EAAA,OAAO,eAAA,CAAgB,qBAAA,EAAuB,CAAC,GAAA,EAAK,IAAI,CAAC,CAAA;AAC3D;AAOO,SAAS,mBAAmB,SAAA,EAAiC;AAClE,EAAA,MAAM,EAAE,GAAA,EAAK,IAAA,EAAK,GAAI,cAAc,SAAS,CAAA;AAC7C,EAAA,OAAO,CAAC,KAAK,IAAI,CAAA;AACnB;AAUO,SAAS,wBAAwB,SAAA,EAA+B;AACrE,EAAA,OAAO,kBAAA,CAAmB,SAAS,CAAA,CAChC,GAAA,CAAI,CAAC,CAAA,KAAM,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA,CAChC,KAAK,GAAG,CAAA;AACb;AAeA,eAAsB,qBAAqB,MAAA,EAYrB;AAIpB,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AACjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,oCAAoC,UAAU,CAAA,0KAAA;AAAA,KAGhD;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,MAAA,KAAW,EAAA,EAAI;AACnC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,kDAAA,EAAqD,MAAA,CAAO,UAAA,CAAW,MAAM,CAAA,CAAA;AAAA,KAC/E;AAAA,EACF;AAGA,EAAA,MAAM,EAAA,GAAK,MAAM,OAAO,gBAAgB,CAAA;AAExC,EAAA,MAAM,SAAA,GAAY,MAAM,EAAA,CAAG,iBAAA,CAAkB,OAAO,UAAU,CAAA;AAC9D,EAAA,MAAM,WAAA,GAAc,kBAAA,CAAmB,MAAA,CAAO,WAAW,CAAA;AACzD,EAAA,MAAM,YAAY,MAAM,EAAA,CAAG,SAAA,CAAU,WAAA,EAAa,OAAO,UAAU,CAAA;AAGnE,EAAA,OAAO,uBAAA,CAAwB;AAAA,IAC7B,CAAA,EAAG,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,IACxB,CAAA,EAAG,SAAA,CAAU,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA;AAAA,IACzB,SAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAiCA,eAAsB,kCAAkC,MAAA,EAalC;AAEpB,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AACjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,iDAAiD,UAAU,CAAA,sJAAA;AAAA,KAG7D;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,SAAA,CAAU,MAAA,KAAW,EAAA,EAAI;AAClC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,2DAAA,EAAyD,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA,CAAA;AAAA,KAClF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,SAAA,CAAU,MAAA,KAAW,EAAA,EAAI;AAClC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iDAAA,EAAoD,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAChG;AAEA,EAAA,MAAM,WAAA,GAAc,kBAAA,CAAmB,MAAA,CAAO,WAAW,CAAA;AACzD,EAAA,OAAO,uBAAA,CAAwB;AAAA,IAC7B,CAAA,EAAG,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,GAAG,EAAE,CAAA;AAAA,IAC/B,CAAA,EAAG,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,IAAI,EAAE,CAAA;AAAA,IAChC,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,WAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AASA,eAAe,wBAAwB,KAAA,EAMjB;AACpB,EAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,EAAiB;AAOtC,EAAA,MAAM,UAAW,MAAA,CAAe,oBAAA;AAAA,IAC9B,eAAA,CAAgB,MAAM,CAAC,CAAA;AAAA,IACvB,eAAA,CAAgB,MAAM,CAAC,CAAA;AAAA,IACvB,eAAA,CAAgB,MAAM,SAAS,CAAA;AAAA,IAC/B,KAAA,CAAM,WAAA;AAAA,IACN;AAAA,GACF;AAEA,EAAA,OAAO,oBAAA,CAAqB;AAAA,IAC1B,SAAS,KAAA,CAAM,UAAA;AAAA,IACf,OAAA,EAAS,gBAAA;AAAA,IACT;AAAA,GACD,CAAA;AACH;AAxSA,IA8BM,kBACA,qBAAA,EAEF,iBAAA;AAjCJ,IAAA,YAAA,GAAA,KAAA,CAAA;AAAA,EAAA,6BAAA,GAAA;AA0BA,IAAA,2BAAA,EAAA;AACA,IAAA,OAAA,EAAA;AACA,IAAA,gBAAA,EAAA;AAEA,IAAM,gBAAA,GAAmB,SAAA;AACzB,IAAM,qBAAA,GAAwB,MAAA,CAAOhB,oBAAAA,CAAY,iBAAA,CAAkB,gBAAgB,CAAC,CAAA;AAEpF,IAAI,iBAAA,GAA6D,IAAA;AAAA,EAAA;AAAA,CAAA,CAAA;AC/BpDiB,kCAAA,CAAA,CAQAC;AAVb,IAAA,eAAA,GAAA,KAAA,CAAA;AAAA,EAAA,uBAAA,GAAA;AAEO,IAAMD,yBAAA,GAAoB,CAAC,UAAA,EAAoB,QAAA,KAA6B;AACjF,MAAA,IAAI,CAAC,UAAA,IAAc,CAAC,QAAA,EAAU;AAC5B,QAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,MACzD;AAEA,MAAA,OAAOE,0BAAS,GAAA,CAAI,OAAA,CAAQ,UAAA,EAAY,QAAQ,EAAE,QAAA,EAAS;AAAA,IAC7D,CAAA;AAEO,IAAMD,yBAAA,GAAoB,CAAC,mBAAA,EAA6B,QAAA,KAA6B;AAC1F,MAAA,IAAI,CAAC,mBAAA,IAAuB,CAAC,QAAA,EAAU;AACrC,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MACnE;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAQC,yBAAA,CAAS,GAAA,CAAI,OAAA,CAAQ,qBAAqB,QAAQ,CAAA;AAChE,QAAA,MAAM,SAAA,GAAY,KAAA,CAAM,QAAA,CAASA,yBAAA,CAAS,IAAI,IAAI,CAAA;AAClD,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,QACvD;AACA,QAAA,OAAO,SAAA;AAAA,MACT,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,UAAA,MAAM,KAAA;AAAA,QACR;AACA,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,MAC/C;AAAA,IACF,CAAA;AAAA,EAAA;AAAA,CAAA,CAAA;;;AC5BA,IAAAC,gBAAAA,GAAA,KAAA,CAAA;AAAA,EAAA,mBAAA,GAAA;AAAA,IAAA,eAAA,EAAA;AAAA,EAAA;AAAA,CAAA,CAAA;;;ACAA,IAAA,aAAA,GAAA,EAAA;AAAA,QAAA,CAAA,aAAA,EAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,gBAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AAwCO,SAAS,mBAAmB,MAAA,EAatB;AAGX,EAAA,MAAM,QACJ,IAAA,GAAA,CACC,OAAO,MAAA,CAAO,UAAA,KAAe,WAAW,MAAA,CAAO,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,UAAU,CAAA,EAClF,QAAA,CAAS,EAAE,CAAA,CACX,QAAA,CAAS,IAAI,GAAG,CAAA;AAErB,EAAA,MAAM,GAAA,GAAMC,WAAA,CAAG,UAAA,CAAW,IAAA,CAAK,IAAA,GAAO,OAAO,WAAA,CAAY,QAAA,CAAS,EAAE,CAAA,EAAG,KAAK,CAAA;AAE5E,EAAA,MAAM,IAAI,MAAA,CAAO,IAAA,GAAO,IAAI,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA;AAC1C,EAAA,MAAM,IAAI,MAAA,CAAO,IAAA,GAAO,IAAI,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA;AAE1C,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AAGjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,kCAAkC,UAAU,CAAA,0KAAA;AAAA,KAG9C;AAAA,EACF;AAEA,EAAA,OAAO,oBAAA,CAAqB;AAAA,IAC1B,OAAA,EAAS,UAAA;AAAA,IACT,OAAA,EAAS,cAAA;AAAA,IACT,OAAA,EAAS,CAAC,CAAA,EAAG,CAAC;AAAA,GACf,CAAA;AACH;AAQO,SAAS,aAAa,WAAA,EAA6B;AACxD,EAAA,OAAO,eAAA,CAAgB,mBAAA,EAAqB,CAAC,WAAW,CAAC,CAAA;AAC3D;AAQO,SAAS,iBAAiB,WAAA,EAAwC;AACvE,EAAA,OAAO,CAAC,OAAO,WAAA,KAAgB,WAAW,WAAA,GAAc,MAAA,CAAO,WAAW,CAAC,CAAA;AAC7E;AAvGA,IAiBM,cAAA,EACA,mBAAA;AAlBN,IAAA,UAAA,GAAA,KAAA,CAAA;AAAA,EAAA,2BAAA,GAAA;AAcA,IAAA,2BAAA,EAAA;AACA,IAAA,OAAA,EAAA;AAEA,IAAM,cAAA,GAAiB,OAAA;AACvB,IAAM,mBAAA,GAAsB,MAAA,CAAOrB,oBAAAA,CAAY,iBAAA,CAAkB,cAAc,CAAC,CAAA;AAAA,EAAA;AAAA,CAAA,CAAA;;;AClBhF,IAAA,6BAAA,GAAA,EAAA;AAAA,QAAA,CAAA,6BAAA,EAAA;AAAA,EAAA,uBAAA,EAAA,MAAA,uBAAA;AAAA,EAAA,UAAA,EAAA,MAAA,UAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,qCAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AAmDO,SAAS,mBAAmB,MAAA,EAGxB;AACT,EAAA,IAAI,MAAA,CAAO,aAAa,MAAA,EAAW;AACjC,IAAA,OAAO,OAAO,MAAA,CAAO,QAAA,KAAa,QAAA,GAC9B,IAAA,GAAO,OAAO,QAAA,CAAS,QAAA,CAAS,EAAE,CAAA,GAClC,MAAA,CAAO,QAAA;AAAA,EACb;AACA,EAAA,MAAM,GAAA,GAAA,CAAO,MAAA,CAAO,OAAA,IAAW,EAAA,EAAI,WAAA,EAAY;AAC/C,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,SAAS,CAAA,EAAG,OAAO,mBAAA;AACpC,EAAA,OAAO,gBAAA;AACT;AAyBO,SAAS,sCAAsC,MAAA,EASzC;AACX,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,MAAM,KAAK,MAAA,CAAO,gBAAA;AAElB,EAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,KAAgC,OAAO,MAAM,QAAA,GAAW,CAAA,GAAI,OAAO,CAAC,CAAA;AAEnF,EAAA,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,EAAA,CAAG,MAAM,CAAC,CAAA;AACzB,EAAA,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,EAAA,CAAG,KAAK,CAAC,CAAA;AACxB,EAAA,GAAA,CAAI,IAAA,CAAK,GAAG,aAAa,CAAA;AACzB,EAAA,GAAA,CAAI,IAAA,CAAK,GAAG,cAAc,CAAA;AAE1B,EAAA,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,EAAA,CAAG,KAAA,CAAM,MAAM,CAAC,CAAA;AAChC,EAAA,KAAA,MAAW,IAAA,IAAQ,GAAG,KAAA,EAAO;AAC3B,IAAA,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,eAAe,CAAC,CAAA;AACrC,IAAA,GAAA,CAAI,KAAK,MAAA,CAAOD,aAAAA,CAAK,YAAY,IAAA,CAAK,UAAU,CAAC,CAAC,CAAA;AAClD,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,IAAA,CAAK,QAAQ,CAAA,GACvC,IAAA,CAAK,WACN,EAAC;AACL,IAAA,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,MAAM,CAAC,CAAA;AAChC,IAAA,KAAA,MAAW,SAAS,QAAA,EAAU;AAC5B,MAAA,GAAA,CAAI,KAAK,OAAO,KAAA,KAAU,WAAW,KAAA,GAAQ,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,IAC5D;AAAA,EACF;AAEA,EAAA,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,MAAM,CAAC,CAAA;AACxC,EAAA,KAAA,MAAW,OAAA,IAAW,OAAO,SAAA,EAAW;AACtC,IAAA,GAAA,CAAI,KAAK,OAAO,CAAA;AAAA,EAClB;AAEA,EAAA,OAAO,GAAA,CAAI,IAAI,CAAC,CAAA,KAAM,OAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA;AAC7C;AASO,SAAS,UAAA,GAAqB;AACnC,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,CAAA;AAC9B,EAAA,MAAM,IAAA,GAAO,OAAO,IAAA,CAAK,KAAA,CAAM,KAAK,MAAA,EAAO,GAAI,QAAQ,CAAC,CAAA;AAIxD,EAAA,OAAQ,QAAQ,GAAA,GAAO,IAAA;AACzB;AAqBA,eAAsB,wBAAwB,MAAA,EA2B1B;AAClB,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,OAAA;AACxC,EAAA,MAAM,oBAAA,GAAuB,CAAC,OAAA,EAAS,SAAS,CAAA;AAChD,EAAA,IAAI,CAAC,oBAAA,CAAqB,QAAA,CAAS,UAAmD,CAAA,EAAG;AACvF,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,oBAAoB,UAAU,CAAA,kKAAA;AAAA,KAGhC;AAAA,EACF;AAEA,EAAA,MAAM,gBAAgBmB,yBAAA,CAAkB,MAAA,CAAO,MAAA,CAAO,mBAAA,EAAqB,OAAO,UAAU,CAAA;AAC5F,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,KAAK,qBAAA,CAAsB;AAAA,IAC/B,KAAA,EAAO,MAAA,CAAO,KAAA,IAAS,UAAA,EAAW;AAAA,IAClC,OAAO,MAAA,CAAO,KAAA;AAAA,IACd,MAAA,EAAQH;AAAA,GACT,CAAA;AAED,EAAA,MAAM,UAAU,kBAAA,CAAmB;AAAA,IACjC,UAAU,MAAA,CAAO,OAAA;AAAA,IACjB,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,GACxB,CAAA;AACD,EAAA,MAAM,cAAc,aAAA,CAAc,EAAA,EAAI,MAAA,CAAO,MAAA,CAAO,WAAW,OAAO,CAAA;AAEtE,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,eAAe,OAAA,EAAS;AAC1B,IAAA,SAAA,GAAY,kBAAA,CAAmB;AAAA,MAC7B,UAAA,EAAY,aAAA;AAAA,MACZ;AAAA,KACD,CAAA;AAAA,EACH,CAAA,MAAO;AAUL,IAAA,MAAM,QAAA,GAAW,cAAc,UAAA,CAAW,IAAI,IAAI,aAAA,CAAc,KAAA,CAAM,CAAC,CAAA,GAAI,aAAA;AAC3E,IAAA,IAAI,QAAA,CAAS,WAAW,EAAA,EAAI;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,4BAAA,EAA+B,SAAS,MAAM,CAAA,yIAAA;AAAA,OAEhD;AAAA,IACF;AACA,IAAA,MAAM,YAAY,UAAA,CAAW,IAAA,CAAK,OAAO,IAAA,CAAK,QAAA,EAAU,KAAK,CAAC,CAAA;AAC9D,IAAA,SAAA,GAAY,MAAM,oBAAA,CAAqB;AAAA,MACrC,UAAA,EAAY,SAAA;AAAA,MACZ;AAAA,KACD,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,WAAW,qCAAA,CAAsC;AAAA,IACrD,gBAAA,EAAkB,EAAA;AAAA,IAClB;AAAA,GACD,CAAA;AAMD,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAGlC;AAAA,IACD,QAAA,EAAU,qCAAA;AAAA,IACV,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,IAAA,EAAM;AAAA,MACJ,cAAA,EAAgB,OAAO,MAAA,CAAO,SAAA;AAAA,MAC9B,QAAA;AAAA,MACA,UAAA;AAAA,MACA,GAAI,OAAO,cAAA,GAAiB,EAAE,gBAAgB,MAAA,CAAO,cAAA,KAAmB;AAAC;AAC3E,GACD,CAAA;AAKD,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,QAAA,CAAS,eAAA,EAAiB;AAC1C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,QAAA,CAAS,eAAA;AAClB;AA3RA,IAwCM,gBAAA,EACA,mBAAA;AAzCN,IAAA,0BAAA,GAAA,KAAA,CAAA;AAAA,EAAA,mCAAA,GAAA;AA4BA,IAAAK,gBAAAA,EAAAA;AAEA,IAAA,OAAA,EAAA;AACA,IAAA,UAAA,EAAA;AACA,IAAA,YAAA,EAAA;AAQA,IAAM,gBAAA,GAAmB,kBAAA;AACzB,IAAM,mBAAA,GAAsB,wBAAA;AAAA,EAAA;AAAA,CAAA,CAAA;AC5BrB,IAAM,cAAN,MAAkB;AAAA,EAOvB,YAAY,MAAA,EAAwB;AAClC,IAAA,IAAI,CAACE,oBAAA,CAAc,MAAA,CAAO,YAAY,CAAA,EAAG;AACvC,MAAA,MAAM,IAAIC,sBAAe,wBAAwB,CAAA;AAAA,IACnD;AAEA,IAAA,IAAA,CAAK,eAAe,MAAA,CAAO,YAAA;AAC3B,IAAA,IAAA,CAAK,iBAAiB,MAAA,CAAO,QAAA;AAC7B,IAAA,IAAA,CAAK,OAAA,GAAU,KAAK,UAAA,EAAW;AAC/B,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA,CAAO,OAAA,IAAWC,wBAAA,CAAkB,OAAA;AACnD,IAAA,IAAA,CAAK,UAAA,GAAa,QAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA,EAKA,eAAA,GAA0B;AACxB,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACd;AAAA,EAEQ,UAAA,GAAqB;AAC3B,IAAA,MAAM,OAAA,GAAU,CAAA,CAAA,EAAIC,qBAAA,CAAe,OAAO,CAAA,CAAA;AAE1C,IAAA,IAAI,KAAK,cAAA,EAAgB;AAEvB,MAAA,MAAM,QAAA,GAAW,KAAK,cAAA,CAAe,OAAA,CAAQ,cAAc,EAAE,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAChF,MAAA,OAAO,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AAAA,IAC/B;AAEA,IAAA,OAAO,4BAA4B,OAAO,CAAA,CAAA;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,iBAAiB,GAAA,EAAgB;AACvC,IAAA,GAAA,CAAI,YAAA,CAAa,MAAA,CAAO,qBAAA,EAAuBA,qBAAA,CAAe,YAAY,CAAA;AAAA,EAC5E;AAAA,EAEQ,WAAW,WAAA,EAA8C;AAC/D,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,cAAA,EAAgB,kBAAA;AAAA,MAChB,aAAa,IAAA,CAAK;AAAA,KACpB;AAEA,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,WAAW,CAAA,CAAA;AAAA,IAClD;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAM,GAAA,CAAO;AAAA,IACX,QAAA;AAAA,IACA,MAAA;AAAA,IACA;AAAA,GACF,EAIe;AACb,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,EAAG,KAAK,OAAO,CAAA,EAAG,QAAQ,CAAA,CAAE,CAAA;AAGhD,MAAA,IAAA,CAAK,iBAAiB,GAAG,CAAA;AAEzB,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,OAAA,CAAQ,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM;AAC/C,UAAA,IAAI,KAAA,KAAU,KAAA,CAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACzC,YAAA,GAAA,CAAI,YAAA,CAAa,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,UAC5C;AAAA,QACF,CAAC,CAAA;AAAA,MACH;AAEA,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,UAAS,EAAG;AAAA,QAC3C,MAAA,EAAQ,KAAA;AAAA,QACR,OAAA,EAAS,IAAA,CAAK,UAAA,CAAW,WAAW;AAAA,OACrC,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,SAAA,GAAYC,6BAAsB,IAAI,CAAA;AAC5C,QAAA,MAAM,IAAIC,oBAAA;AAAA,UACR,SAAA,CAAU,OAAA;AAAA,UACV,SAAA,CAAU,IAAA,IAAQ,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAAA,UACzC,QAAA,CAAS,MAAA;AAAA,UACT;AAAA,SACF;AAAA,MACF;AAEA,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAMC,sBAAe,KAAK,CAAA;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,IAAA,CAAQ;AAAA,IACZ,QAAA;AAAA,IACA,WAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACF,EAMe;AACb,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,EAAG,KAAK,OAAO,CAAA,EAAG,QAAQ,CAAA,CAAE,CAAA;AAGhD,MAAA,IAAA,CAAK,iBAAiB,GAAG,CAAA;AAEzB,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,UAAS,EAAG;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,GAAG,OAAA,EAAS,GAAG,IAAA,CAAK,UAAA,CAAW,WAAW,CAAA,EAAE;AAAA,QACvD,IAAA,EAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,GAAI,KAAA;AAAA,OACrC,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,SAAA,GAAYF,6BAAsB,IAAI,CAAA;AAC5C,QAAA,MAAM,IAAIC,oBAAA;AAAA,UACR,SAAA,CAAU,OAAA;AAAA,UACV,SAAA,CAAU,IAAA,IAAQ,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAAA,UACzC,QAAA,CAAS,MAAA;AAAA,UACT;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAMC,sBAAe,KAAK,CAAA;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,GAAA,CAAO;AAAA,IACX,QAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF,EAIe;AACb,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,EAAG,KAAK,OAAO,CAAA,EAAG,QAAQ,CAAA,CAAE,CAAA;AAGhD,MAAA,IAAA,CAAK,iBAAiB,GAAG,CAAA;AAEzB,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,UAAS,EAAG;AAAA,QAC3C,MAAA,EAAQ,KAAA;AAAA,QACR,OAAA,EAAS,IAAA,CAAK,UAAA,CAAW,WAAW,CAAA;AAAA,QACpC,IAAA,EAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,GAAI,KAAA;AAAA,OACrC,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,SAAA,GAAYF,6BAAsB,IAAI,CAAA;AAC5C,QAAA,MAAM,IAAIC,oBAAA;AAAA,UACR,SAAA,CAAU,OAAA;AAAA,UACV,SAAA,CAAU,IAAA,IAAQ,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAAA,UACzC,QAAA,CAAS,MAAA;AAAA,UACT;AAAA,SACF;AAAA,MACF;AAEA,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAMC,sBAAe,KAAK,CAAA;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,KAAA,CAAS;AAAA,IACb,QAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF,EAIe;AACb,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,EAAG,KAAK,OAAO,CAAA,EAAG,QAAQ,CAAA,CAAE,CAAA;AAGhD,MAAA,IAAA,CAAK,iBAAiB,GAAG,CAAA;AAEzB,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,UAAS,EAAG;AAAA,QAC3C,MAAA,EAAQ,OAAA;AAAA,QACR,OAAA,EAAS,IAAA,CAAK,UAAA,CAAW,WAAW,CAAA;AAAA,QACpC,IAAA,EAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,GAAI,KAAA;AAAA,OACrC,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,SAAA,GAAYF,6BAAsB,IAAI,CAAA;AAC5C,QAAA,MAAM,IAAIC,oBAAA;AAAA,UACR,SAAA,CAAU,OAAA;AAAA,UACV,SAAA,CAAU,IAAA,IAAQ,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAAA,UACzC,QAAA,CAAS,MAAA;AAAA,UACT;AAAA,SACF;AAAA,MACF;AAEA,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAMC,sBAAe,KAAK,CAAA;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,MAAA,CAAU;AAAA,IACd,QAAA;AAAA,IACA;AAAA,GACF,EAGe;AACb,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,EAAG,KAAK,OAAO,CAAA,EAAG,QAAQ,CAAA,CAAE,CAAA;AAGhD,MAAA,IAAA,CAAK,iBAAiB,GAAG,CAAA;AAEzB,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,UAAS,EAAG;AAAA,QAC3C,MAAA,EAAQ,QAAA;AAAA,QACR,OAAA,EAAS,IAAA,CAAK,UAAA,CAAW,WAAW;AAAA,OACrC,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,SAAA,GAAYF,6BAAsB,IAAI,CAAA;AAC5C,QAAA,MAAM,IAAIC,oBAAA;AAAA,UACR,SAAA,CAAU,OAAA;AAAA,UACV,SAAA,CAAU,IAAA,IAAQ,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAAA,UACzC,QAAA,CAAS,MAAA;AAAA,UACT;AAAA,SACF;AAAA,MACF;AAEA,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAMC,sBAAe,KAAK,CAAA;AAAA,IAC5B;AAAA,EACF;AACF;;;ACnPA,2BAAA,EAAA;AACA,YAAA,EAAA;AAeAR,gBAAAA,EAAAA;;;ACKAA,gBAAAA,EAAAA;;;ACzCAA,gBAAAA,EAAAA;ACMA,SAAS,sBAAsB,QAAA,EAG7B;AACA,EAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AAC7C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,eAAe,QAAA,EAAU;AAC3B,IAAA,MAAM,IAAA,GAAO,QAAA;AACb,IAAA,IACE,CAAC,IAAA,CAAK,SAAA,IACN,OAAO,KAAK,SAAA,KAAc,QAAA,IAC1B,EAAE,OAAA,IAAW,IAAA,CAAK,SAAA,CAAA,IAClB,EAAE,SAAA,IAAa,KAAK,SAAA,CAAA,EACpB;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,EAAW,UAAA,EAAY,KAAK,UAAA,EAAW;AAAA,EAClE;AAGA,EAAA,IAAI,OAAA,IAAW,QAAA,IAAY,SAAA,IAAa,QAAA,EAAU;AAChD,IAAA,OAAO,EAAE,WAAW,QAAA,EAAsB;AAAA,EAC5C;AAGA,EAAA,MAAM,aACJ,OAAQ,QAAA,CAAiB,OAAA,KAAY,QAAA,GAAY,SAAiB,OAAA,GAAU,MAAA;AAE9E,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,UAAA,IAAc;AAAA,GAChB;AACF;AAOA,SAAS,UAAA,CAAW,OAAgB,QAAA,EAA2B;AAC7D,EAAA,IAAI;AACF,IAAA,OAAO,MAAA,CAAO,KAAiC,CAAA,KAAM,QAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEO,SAAS,mBAAmB,SAAA,EAA8C;AAE/E,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC5B,IAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACxB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mDAAA,EAAsD,SAAA,CAAU,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1F;AAGA,IAAA,MAAM,cAAA,GACJ,SAAA,CAAU,MAAA,KAAW,CAAA,IAAK,WAAW,SAAA,CAAU,CAAC,CAAA,EAAG,EAAE,CAAA,IAAK,UAAA,CAAW,SAAA,CAAU,CAAC,GAAG,EAAE,CAAA;AACvF,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,CAAA,IAAK,CAAC,cAAA,EAAgB;AAC7C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,YAAA,EAAe,UAAU,MAAM,CAAA,gEAAA;AAAA,OACjC;AAAA,IACF;AACA,IAAA,MAAM,IAAI,cAAA,GAAiB,SAAA,CAAU,CAAC,CAAA,GAAI,UAAU,CAAC,CAAA;AACrD,IAAA,MAAM,IAAI,cAAA,GAAiB,SAAA,CAAU,CAAC,CAAA,GAAI,UAAU,CAAC,CAAA;AACrD,IAAA,IAAI,CAAA,IAAK,IAAA,IAAQ,CAAA,IAAK,IAAA,EAAM;AAC1B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qDAAA,EAAwD,CAAC,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,IACrF;AACA,IAAA,OAAO,EAAE,GAAG,MAAA,CAAO,CAAC,GAAG,CAAA,EAAG,MAAA,CAAO,CAAC,CAAA,EAAE;AAAA,EACtC;AAGA,EAAA,IAAI,aAAa,OAAO,SAAA,KAAc,YAAY,GAAA,IAAO,SAAA,IAAa,OAAO,SAAA,EAAW;AACtF,IAAA,MAAM,GAAA,GAAM,SAAA;AACZ,IAAA,IAAI,GAAA,CAAI,CAAA,IAAK,IAAA,IAAQ,GAAA,CAAI,KAAK,IAAA,EAAM;AAClC,MAAA,MAAM,IAAI,MAAM,CAAA,kDAAA,EAAqD,GAAA,CAAI,CAAC,CAAA,IAAA,EAAO,GAAA,CAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IAC1F;AACA,IAAA,OAAO;AAAA,MACL,CAAA,EAAG,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA;AAAA,MACf,CAAA,EAAG,MAAA,CAAO,GAAA,CAAI,CAAC;AAAA,KACjB;AAAA,EACF;AAEA,EAAA,MAAM,IAAI,MAAM,0DAA0D,CAAA;AAC5E;AAYO,IAAM,wBAAN,MAAwD;AAAA,EAI7D,WAAA,CAAY,QAAqB,WAAA,EAAqB;AACpD,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AAAA,EACrB;AAAA,EAEA,MAAM,OAAA,CAAQ,EAAE,OAAA,EAAS,OAAM,EAAkE;AAE/F,IAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,cAAA,CAAe,QAAQ,OAAO,CAAA;AAC9D,IAAA,MAAM,UAAA,GAAaS,kCAA2B,SAAS,CAAA;AAKvD,IAAA,MAAM,gBAAA,GAAmB,UAAA,GAAaC,0BAAA,CAAoB,UAAU,CAAA,GAAI,SAAA;AAGxE,IAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAA+B;AAAA,MACvE,QAAA,EAAU,kCAAA;AAAA,MACV,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,IAAA,EAAM;AAAA,QACJ,WAAW,OAAA,CAAQ,OAAA;AAAA,QACnB,KAAA;AAAA,QACA;AAAA;AACF,KACD,CAAA;AAGD,IAAA,MAAM,EAAE,SAAA,EAAAC,UAAAA,EAAW,YAAY,kBAAA,EAAmB,GAAI,sBAAsB,eAAe,CAAA;AAG3F,IAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,WAAA,CAAYA,UAAS,CAAA;AAGrD,IAAA,MAAM,aAAA,GAAgB,mBAAmB,SAAS,CAAA;AAGlD,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAA0C;AAAA,MACzE,QAAA,EAAU,6CAAA;AAAA,MACV,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,IAAA,EAAM;AAAA,QACJ,WAAW,OAAA,CAAQ,OAAA;AAAA,QACnB,SAAA,EAAAA,UAAAA;AAAA,QACA,aAAA,EAAe,aAAA;AAAA,QACf,YAAY,kBAAA,IAAsB,UAAA;AAAA,QAClC,cAAA,EAAgB;AAAA;AAClB,KACD,CAAA;AAED,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,aACJ,OAAQ,MAAA,CAAe,OAAA,KAAY,QAAA,GAAY,OAAe,OAAA,GAAU,MAAA;AAE1E,IAAA,IAAI,CAAC,OAAO,eAAA,EAAiB;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,UAAA,IAAc,4CAA4C,CAAA;AAAA,IAC5E;AAEA,IAAA,OAAO,MAAA,CAAO,eAAA;AAAA,EAChB;AACF;;;ADnJO,IAAM,8BAA8B,OAAO;AAAA,EAChD,MAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF,CAAA,KAIuB;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,KAAA,EAAO,cAAA,EAAgB,YAAW,GAAI,MAAA;AAGlE,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,aACI,4GAAA,GACA;AAAA,OACN;AAAA,IACF;AAUA,IAAA,IAAI,UAAA,GAAyB,OAAO,UAAA,IAAc,OAAA;AAClD,IAAA,IAAI,CAAC,OAAO,UAAA,EAAY;AACtB,MAAA,IAAI;AAEF,QAAA,MAAM,mBAAmB,MAAMC,sBAAA;AAAA,UAC7B,CAACC,SAAAA,KAAaA,SAAAA,CAAS,cAAA,CAAe,MAAA,CAAO,WAAW,QAAQ,CAAA;AAAA,UAChE,EAAE,WAAA,EAAaC,2BAAA,CAAqB,KAAA;AAAM,SAC5C;AACA,QAAA,UAAA,GAAaL,iCAAAA,CAA2B,gBAAgB,CAAA,IAAK,OAAA;AAAA,MAC/D,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AASA,IAAA,IAAI,eAAe,MAAA,EAAQ;AACzB,MAAA,MAAM,EAAE,uBAAA,EAAAM,wBAAAA,EAAwB,GAAI,MAAM,OAAA,CAAA,OAAA,EAAA,CAAA,IAAA,CAAA,OAAA,0BAAA,EAAA,EAAA,6BAAA,CAAA,CAAA;AAK1C,MAAA,MAAM,cAAA,GAAA,CAAmB,MAAA,CAAO,UAAA,IAAc,OAAA,KAAY,OAAA;AAC1D,MAAA,OAAO,MAAMA,wBAAAA,CAAwB;AAAA,QACnC,MAAA;AAAA,QACA,WAAA;AAAA,QACA,MAAA,EAAQ;AAAA,UACN,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,qBAAqB,MAAA,CAAO,mBAAA;AAAA,UAC5B,YAAY,MAAA,CAAO;AAAA,SACrB;AAAA,QACA,UAAA;AAAA,QACA,KAAA;AAAA,QACA,UAAA,EAAY;AAAA,OACb,CAAA;AAAA,IACH;AAKA,IAAA,MAAM,WAAA,GACJ,MAAA,CAAO,SAAA,CAAU,cAAA,CAAe,IAAA,CAAKD,2BAAA,EAAsB,UAAU,CAAA,IACrE,MAAA,CAAO,SAAA,CAAU,cAAA,CAAe,IAAA,CAAKJ,4BAAqB,UAAU,CAAA;AAEtE,IAAA,MAAM,SAAS,WAAA,GAAcI,2BAAA,CAAqB,UAAU,CAAA,GAAIA,4BAAqB,OAAO,CAAA;AAC5F,IAAA,MAAM,mBAAmB,WAAA,GACrBJ,0BAAAA,CAAoB,UAAU,CAAA,GAC9BA,2BAAoB,OAAO,CAAA;AAG/B,IAAA,IAAI,mBAAA;AACJ,IAAA,IAAI;AACF,MAAA,mBAAA,GAAsBZ,yBAAA,CAAkB,MAAA,CAAO,mBAAA,EAAqB,UAAU,CAAA;AAAA,IAChF,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,MAAM,kEAAkE,CAAA;AAAA,IACpF;AAEA,IAAA,MAAM,WAAW,IAAIkB,oBAAA,CAAY,EAAE,OAAA,EAAS,QAAQ,CAAA;AAEpD,IAAA,MAAM,OAAA,GAAU,IAAIC,gBAAA,CAAQ;AAAA,MAC1B,QAAA;AAAA,MACA,SAAS,MAAA,CAAO,SAAA;AAAA,MAChB,MAAA,EAAQ;AAAA,KACT,CAAA;AAGD,IAAA,MAAM,eAAA,GAAkB,MAAM,MAAA,CAAO,IAAA,CAA+B;AAAA,MAClE,QAAA,EAAU,kCAAA;AAAA,MACV,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,QACJ,WAAW,MAAA,CAAO,SAAA;AAAA,QAClB,KAAA;AAAA,QACA;AAAA;AACF,KACD,CAAA;AAGD,IAAA,IAAI,CAAC,eAAA,IAAmB,OAAO,eAAA,KAAoB,QAAA,EAAU;AAC3D,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAKA,IAAA,IAAIN,UAAAA;AACJ,IAAA,IAAI,kBAAA;AAEJ,IAAA,IAAI,eAAe,eAAA,EAAiB;AAClC,MAAA,MAAM,IAAA,GAAO,eAAA;AACb,MAAAA,aAAY,IAAA,CAAK,SAAA;AAEjB,MAAA,IACE,IAAA,CAAK,cACL,MAAA,CAAO,SAAA,CAAU,eAAe,IAAA,CAAKD,0BAAAA,EAAqB,IAAA,CAAK,UAAU,CAAA,EACzE;AACA,QAAA,kBAAA,GAAqB,IAAA,CAAK,UAAA;AAAA,MAC5B;AAAA,IACF,CAAA,MAAA,IAAW,eAAA,IAAmB,OAAA,IAAW,eAAA,IAAmB,aAAa,eAAA,EAAiB;AAExF,MAAAC,UAAAA,GAAY,eAAA;AAAA,IACd,CAAA,MAAO;AAEL,MAAA,MAAMO,cACJ,eAAA,IAAmB,OAAQ,gBAAwB,OAAA,KAAY,QAAA,GAC1D,gBAAwB,OAAA,GACzB,KAAA,CAAA;AAEN,MAAA,MAAM,IAAI,KAAA;AAAA,QACRA,WAAAA,IACE;AAAA,OAGJ;AAAA,IACF;AAGA,IAAA,IACE,CAACP,UAAAA,IACD,OAAOA,UAAAA,KAAc,QAAA,IACrB,EAAE,OAAA,IAAWA,UAAAA,CAAAA,IACb,EAAE,SAAA,IAAaA,UAAAA,CAAAA,EACf;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OAEF;AAAA,IACF;AAGA,IAAA,MAAM,aAAA,GAAgB,MAAM,OAAA,CAAQ,WAAA,CAAYA,UAAS,CAAA;AAGzD,IAAA,MAAM,aAAA,GAAgB,mBAAmB,aAAa,CAAA;AAGtD,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAA0C;AAAA,MACpE,QAAA,EAAU,6CAAA;AAAA,MACV,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,QACJ,WAAW,MAAA,CAAO,SAAA;AAAA,QAClB,SAAA,EAAAA,UAAAA;AAAA,QACA,aAAA,EAAe,aAAA;AAAA,QACf,cAAA;AAAA,QACA,YAAY,kBAAA,IAAsB;AAAA;AACpC,KACD,CAAA;AAED,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,aACJ,OAAQ,MAAA,CAAe,OAAA,KAAY,QAAA,GAAY,OAAe,OAAA,GAAU,KAAA,CAAA;AAE1E,IAAA,IAAI,OAAO,OAAO,eAAA,KAAoB,QAAA,IAAY,OAAO,eAAA,CAAgB,IAAA,EAAK,CAAE,MAAA,KAAW,CAAA,EAAG;AAC5F,MAAA,MAAM,IAAI,KAAA,CAAM,UAAA,IAAc,4CAA4C,CAAA;AAAA,IAC5E;AAEA,IAAA,OAAO,MAAA,CAAO,eAAA;AAAA,EAChB,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,4CAA4C,KAAK,CAAA;AAC/D,IAAA,MAAM,KAAA;AAAA,EACR;AACF,CAAA;AAwBO,IAAM,yCAAyC,OAAO;AAAA,EAC3D,MAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF,CAAA,KAIuB;AACrB,EAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,OAAA,EAAS,KAAA,EAAO,gBAAe,GAAI,MAAA;AAK/D,EAAA,IAAI,MAAA,CAAO,UAAA,KAAe,OAAA,IAAW,MAAA,CAAO,eAAe,MAAA,EAAQ;AACjE,IAAA,OAAA,CAAQ,MAAM,sEAAA,EAAwE;AAAA,MACpF,UAAU,MAAA,CAAO,UAAA;AAAA,MACjB,QAAA,EAAU,eAAA;AAAA,MACV,eAAe,MAAA,CAAO,SAAA,EAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,MAChD,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA,MAAM,IAAIQ,wBAAA;AAAA,MACR,CAAA,4DAAA,EAA+D,MAAA,CAAO,UAAA,IAAc,WAAW,CAAA,CAAA,CAAA;AAAA,MAC/FC,qBAAA,CAAe;AAAA,KACjB;AAAA,EACF;AAGA,EAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC/C,EAAA,IAAI,OAAA,CAAQ,aAAa,UAAA,EAAY;AACnC,IAAA,OAAA,CAAQ,MAAM,gDAAA,EAAkD;AAAA,MAC9D,eAAe,IAAI,IAAA,CAAK,QAAQ,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY;AAAA,MAC/D,aAAa,IAAI,IAAA,CAAK,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY;AAAA,MACrD,UAAA,EAAY,CAAA,EAAG,UAAA,GAAa,OAAA,CAAQ,UAAU,CAAA,QAAA;AAAA,KAC/C,CAAA;AACD,IAAA,MAAM,IAAID,wBAAA;AAAA,MACR,CAAA,mBAAA,EAAsB,IAAI,IAAA,CAAK,OAAA,CAAQ,aAAa,GAAI,CAAA,CAAE,aAAa,CAAA,2BAAA,CAAA;AAAA,MAEvEC,qBAAA,CAAe;AAAA,KACjB;AAAA,EACF;AAEA,EAAA,IAAI;AASF,IAAA,IAAI,iBAAA;AACJ,IAAA,IAAI;AACF,MAAA,iBAAA,GAAoBtB,yBAAA,CAAkB,OAAA,CAAQ,mBAAA,EAAqB,UAAU,CAAA;AAAA,IAC/E,CAAA,CAAA,MAAQ;AACN,MAAA,OAAA,CAAQ,MAAM,kEAAA,EAAoE;AAAA,QAChF,eAAe,OAAA,CAAQ,SAAA,EAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QACjD,IAAA,EAAM;AAAA,OACP,CAAA;AACD,MAAA,MAAM,IAAIqB,wBAAA;AAAA,QACR,0EAAA;AAAA,QACAC,qBAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAGA,IAAA,MAAM,aAAA,GAAgBnB,WAAAA,CAAG,UAAA,CAAW,WAAA,CAAY,iBAAiB,CAAA;AACjE,IAAA,IAAI,cAAc,WAAA,EAAY,KAAM,OAAA,CAAQ,SAAA,CAAU,aAAY,EAAG;AACnE,MAAA,OAAA,CAAQ,MAAM,iDAAA,EAAmD;AAAA,QAC/D,UAAU,OAAA,CAAQ,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC3C,OAAA,EAAS,aAAA,CAAc,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QACtC,IAAA,EAAM;AAAA,OACP,CAAA;AACD,MAAA,MAAM,IAAIkB,wBAAA;AAAA,QACR,2EAAA;AAAA,QACAC,qBAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,CAAO,eAAe,MAAA,EAAQ;AAchC,MAAA,MAAM,EAAE,uBAAAC,sBAAAA,EAAuB,aAAA,EAAAC,gBAAe,eAAA,EAAA3B,gBAAAA,KAAoB,MAAM,OAAA,CAAA,OAAA,EAAA,CAAA,IAAA,CAAA,OAAA,OAAA,EAAA,EAAA,UAAA,CAAA,CAAA;AACxE,MAAA,MAAM,EAAE,kBAAA,EAAA4B,mBAAAA,EAAoB,qCAAA,EAAAC,sCAAAA,KAA0C,MAAM,OAAA,CAAA,OAAA,EAAA,CAAA,IAAA,CAAA,OAAA,0BAAA,EAAA,EAAA,6BAAA,CAAA,CAAA;AAI5E,MAAA,MAAM,KAAKH,sBAAAA,CAAsB;AAAA,QAC/B,KAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,CAAA,IAAK,GAAA,GAAO,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,EAAO,GAAI,QAAQ,CAAC,CAAA;AAAA,QAChF,KAAA;AAAA,QACA,MAAA,EAAQ1B;AAAA,OACT,CAAA;AAED,MAAA,MAAM,UAAU4B,mBAAAA,CAAmB,EAAE,OAAA,EAAS,MAAA,CAAO,SAAS,CAAA;AAC9D,MAAA,MAAM,WAAA,GAAcD,cAAAA,CAAc,EAAA,EAAI,MAAA,CAAO,WAAW,OAAO,CAAA;AAI/D,MAAA,MAAM,cAAA,GAAiB,IAAA,GAAO,WAAA,CAAY,QAAA,CAAS,EAAE,CAAA;AACrD,MAAA,MAAM,EAAE,CAAA,EAAAG,EAAAA,EAAG,CAAA,EAAAC,EAAAA,KAAMzB,WAAAA,CAAG,UAAA,CAAW,IAAA,CAAK,cAAA,EAAgB,iBAAiB,CAAA;AAQrE,MAAA,MAAM0B,iBAAAA,GAA6B;AAAA,QACjC,MAAA,CAAO,QAAQ,SAAS,CAAA;AAAA,QACxB,OAAOF,EAAC,CAAA;AAAA,QACR,OAAOC,EAAC,CAAA;AAAA,QACR,MAAA,CAAO,QAAQ,UAAU;AAAA,OAC3B;AAEA,MAAA,MAAM,WAAWF,sCAAAA,CAAsC;AAAA,QACrD,gBAAA,EAAkB,EAAA;AAAA,QAClB,SAAA,EAAWG;AAAA,OACZ,CAAA;AAED,MAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,IAAA,CAG3B;AAAA,QACD,QAAA,EAAU,qCAAA;AAAA,QACV,WAAA;AAAA,QACA,IAAA,EAAM;AAAA,UACJ,gBAAgB,MAAA,CAAO,SAAA;AAAA,UACvB,QAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAQA,UAAA,EAAY;AAAA;AACd,OACD,CAAA;AAED,MAAA,IAAI,CAAC,UAAU,eAAA,EAAiB;AAC9B,QAAA,MAAM,IAAIR,wBAAA;AAAA,UACR,8GAAA;AAAA,UACAC,qBAAA,CAAe;AAAA,SACjB;AAAA,MACF;AACA,MAAA,OAAO,QAAA,CAAS,eAAA;AAAA,IAClB;AAGA,IAAA,MAAM,mBAAmBV,0BAAAA,CAAoB,KAAA;AAG7C,IAAA,MAAM,eAAA,GAAkB,MAAM,MAAA,CAAO,IAAA,CAA+B;AAAA,MAClE,QAAA,EAAU,kCAAA;AAAA,MACV,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,QACJ,WAAW,MAAA,CAAO,SAAA;AAAA,QAClB,KAAA;AAAA,QACA,gBAAA;AAAA,QACA,UAAA,EAAY;AAAA;AACd,KACD,CAAA;AAGD,IAAA,IAAI,CAAC,eAAA,IAAmB,OAAO,eAAA,KAAoB,QAAA,EAAU;AAC3D,MAAA,MAAM,IAAIS,wBAAA;AAAA,QACR,mFAAA;AAAA,QACAC,qBAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,IAAI,gBAAA;AACJ,IAAA,IAAI,WAAA,IAAe,eAAA,IAAoB,eAAA,CAA6C,SAAA,EAAW;AAC7F,MAAA,MAAM,YAAa,eAAA,CAA6C,SAAA;AAChE,MAAA,IACE,CAAC,SAAA,IACD,OAAO,SAAA,KAAc,QAAA,IACrB,EAAE,OAAA,IAAW,SAAA,CAAA,IACb,EAAE,SAAA,IAAa,SAAA,CAAA,EACf;AACA,QAAA,MAAM,IAAID,wBAAA;AAAA,UACR,wFAAA;AAAA,UACAC,qBAAA,CAAe;AAAA,SACjB;AAAA,MACF;AACA,MAAA,gBAAA,GAAmB,SAAA;AAAA,IACrB,CAAA,MAAA,IAAW,OAAA,IAAW,eAAA,IAAmB,SAAA,IAAa,eAAA,EAAiB;AACrE,MAAA,gBAAA,GAAmB,eAAA;AAAA,IACrB,CAAA,MAAO;AACL,MAAA,MAAM,IAAID,wBAAA;AAAA,QACR,8EAAA;AAAA,QACAC,qBAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAGA,IAAA,MAAM,OAAA,GAAUT,kBAAA,CAAU,cAAA,CAAe,gBAAA,EAAkB,OAAO,SAAS,CAAA;AAG3E,IAAA,MAAM,EAAE,GAAG,CAAA,EAAE,GAAIV,YAAG,UAAA,CAAW,IAAA,CAAK,SAAS,iBAAiB,CAAA;AAG9D,IAAA,MAAM,gBAAA,GAAmB;AAAA,MACvB,OAAA,CAAQ,SAAA;AAAA,MACR2B,YAAA,CAAI,MAAM,CAAC,CAAA;AAAA,MACXA,YAAA,CAAI,MAAM,CAAC,CAAA;AAAA,MACXA,YAAA,CAAI,KAAA,CAAM,OAAA,CAAQ,UAAU;AAAA,KAC9B;AAGA,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAA0C;AAAA,MACpE,QAAA,EAAU,6CAAA;AAAA,MACV,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,QACJ,WAAW,MAAA,CAAO,SAAA;AAAA,QAClB,SAAA,EAAW,gBAAA;AAAA;AAAA,QAEX,aAAA,EAAe,gBAAA;AAAA,QACf,cAAA;AAAA,QACA,UAAA,EAAY,OAAA;AAAA,QACZ,kBAAA,EAAoB;AAAA;AAAA;AACtB,KACD,CAAA;AAED,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,MAAA,MAAM,IAAIT,wBAAA;AAAA,QACR,8FAAA;AAAA,QACAC,qBAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,OAAO,eAAA,KAAoB,QAAA,IAAY,OAAO,eAAA,CAAgB,IAAA,EAAK,CAAE,MAAA,KAAW,CAAA,EAAG;AAC5F,MAAA,MAAM,aACJ,OAAQ,MAAA,CAAe,OAAA,KAAY,QAAA,GAAY,OAAe,OAAA,GAAU,KAAA,CAAA;AAC1E,MAAA,OAAA,CAAQ,MAAM,4DAAA,EAA8D;AAAA,QAC1E;AAAA,OACD,CAAA;AACD,MAAA,MAAM,IAAID,wBAAA;AAAA,QACR,UAAA,IAAc,4CAAA;AAAA,QACdC,qBAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,OAAO,MAAA,CAAO,eAAA;AAAA,EAChB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AAGpE,IAAA,IAAI,iBAAiBD,wBAAA,EAAmB;AACtC,MAAA,MAAM,KAAA;AAAA,IACR;AAEA,IAAA,OAAA,CAAQ,MAAM,6CAAA,EAA+C;AAAA,MAC3D,OAAO,GAAA,CAAI,OAAA;AAAA,MACX,eAAe,MAAA,CAAO,SAAA,EAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,MAChD,eAAe,OAAA,CAAQ,SAAA,EAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,KAClD,CAAA;AACD,IAAA,MAAM,KAAA;AAAA,EACR;AACF,CAAA;AErcO,IAAM,0BAAA,GAA6B,MAAA;AAAA,EACxCvC,oBAAAA,CAAY,kBAAkB,qBAAqB;AACrD;AAGA,IAAM,kBAAA,GAAqB,SAAA;AAG3B,IAAM,oBAAA,GAAuB,yBAAA;AAG7B,IAAM,2BAAA,GAA8B,gCAAA;AAMpC,SAAS,OAAO,CAAA,EAA4B;AAC1C,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,OAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,GAAI,CAAA;AACzD;AAEA,SAAS,MAAM,CAAA,EAAqC;AAClD,EAAA,IAAI,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,CAAA;AAClC,EAAA,OAAO,OAAO,CAAC,CAAA;AACjB;AAaO,SAAS,YAAY,KAAA,EAAuB;AACjD,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAI/B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,IAAI,KAAA,CAAM,UAAA,CAAW,CAAC,CAAA,GAAI,GAAA,EAAM;AAC9B,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,CAAA,qFAAA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,KAAA,CAAM,SAAS,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI,UAAA;AAAA,MACR,CAAA,gFAAA,EAA8E,MAAM,MAAM,CAAA;AAAA,KAC5F;AAAA,EACF;AACA,EAAA,OAAO,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,KAAK,CAAC,CAAA;AACpD;AAqCO,SAAS,oBAAoB,MAAA,EAA2C;AAC7E,EAAA,MAAM,WAAA,GAAoB;AAAA,IACxB,eAAA,EAAiB,MAAA,CAAO,MAAA,CAAO,oBAAoB,CAAA;AAAA,IACnD,UAAA,EAAY,kBAAA;AAAA,IACZ,QAAA,EAAU,CAAC,MAAA,CAAO,MAAA,CAAO,oBAAoB,CAAC;AAAA,GAChD;AAEA,EAAA,MAAM,SAAA,GAAY,WAAA,CAAY,MAAA,CAAO,KAAA,IAAS,UAAU,CAAA;AAExD,EAAA,MAAM,aAAA,GAAsB;AAAA,IAC1B,eAAA,EAAiB,MAAA,CAAO,MAAA,CAAO,oBAAoB,CAAA;AAAA,IACnD,UAAA,EAAY,oBAAA;AAAA,IACZ,QAAA,EAAU;AAAA,MACR,MAAA,CAAO,OAAO,eAAe,CAAA;AAAA,MAC7B,MAAA,CAAO,OAAO,sBAAsB,CAAA;AAAA,MACpC,IAAA,GAAO,SAAA,CAAU,QAAA,CAAS,EAAE;AAAA;AAC9B,GACF;AAEA,EAAA,OAAO,CAAC,aAAa,aAAa,CAAA;AACpC;AAkCO,SAAS,wBAAwB,MAAA,EAAwC;AAC9E,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,MAAA,CAAO,cAAc,CAAA;AAC/C,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,MAAA,CAAO,SAAS,CAAA;AACzC,EAAA,MAAM,YAAA,GAAe,KAAA,CAAM,MAAA,CAAO,sBAAsB,CAAA;AACxD,EAAA,MAAM,SAAA,GAAY,WAAA,CAAY,MAAA,CAAO,KAAA,IAAS,UAAU,CAAA;AAExD,EAAA,OAAO,MAAA;AAAA,IACLD,cAAK,6BAAA,CAA8B;AAAA,MACjC,IAAA,GAAO,0BAAA,CAA2B,QAAA,CAAS,EAAE,CAAA;AAAA,MAC7C,IAAA,GAAO,WAAA,CAAY,QAAA,CAAS,EAAE,CAAA;AAAA,MAC9B,IAAA,GAAO,UAAA,CAAW,QAAA,CAAS,EAAE,CAAA;AAAA,MAC7B,IAAA,GAAO,YAAA,CAAa,QAAA,CAAS,EAAE,CAAA;AAAA,MAC/B,IAAA,GAAO,SAAA,CAAU,QAAA,CAAS,EAAE;AAAA,KAC7B;AAAA,GACH;AACF;AAeO,SAAS,qBAAqB,MAAA,EAGR;AAC3B,EAAA,MAAM,WAAA,GAAc,uBAAA,CAAwB,MAAA,CAAO,OAAO,CAAA;AAC1D,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,UAAU,CAAC,CAAA;AAC7C,EAAA,MAAM,GAAA,GAAMsB,YAAG,UAAA,CAAW,IAAA,CAAK,OAAO,WAAA,CAAY,QAAA,CAAS,EAAE,CAAA,EAAG,KAAK,CAAA;AACrE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA,CAAO,IAAA,GAAO,IAAI,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA;AAAA,IACnC,GAAG,MAAA,CAAO,IAAA,GAAO,IAAI,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC;AAAA,GACrC;AACF;AA6BO,SAAS,yBAAyB,MAAA,EAA8C;AACrF,EAAA,MAAM,SAAA,GAAY,WAAA,CAAY,MAAA,CAAO,KAAA,IAAS,UAAU,CAAA;AACxD,EAAA,OAAO;AAAA,IACL,eAAA,EAAiB,MAAA,CAAO,MAAA,CAAO,cAAc,CAAA;AAAA,IAC7C,UAAA,EAAY,2BAAA;AAAA,IACZ,QAAA,EAAU;AAAA,MACR,MAAA,CAAO,OAAO,SAAS,CAAA;AAAA,MACvB,MAAA,CAAO,OAAO,sBAAsB,CAAA;AAAA,MACpC,IAAA,GAAO,SAAA,CAAU,QAAA,CAAS,EAAE,CAAA;AAAA,MAC5B,MAAA,CAAO,OAAO,UAAU,CAAA;AAAA,MACxB,MAAA,CAAO,OAAO,UAAU;AAAA;AAC1B,GACF;AACF;;;AHnKA,eAAsB,yBACpB,MAAA,EAC2B;AAC3B,EAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAA6B;AAAA,IAC/D,QAAA,EAAU,wCAAA;AAAA,IACV,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,IAAA,EAAM;AAAA,MACJ,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,gBAAgB,MAAA,CAAO;AAAA;AACzB,GACD,CAAA;AAED,EAAA,IAAI,OAAA,CAAQ,kBAAkB,kBAAA,EAAoB;AAChD,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,kBAAA;AAAA,MACN,eAAe,OAAA,CAAQ,aAAA;AAAA,MACvB,kBAAkB,OAAA,CAAQ,gBAAA;AAAA,MAC1B,aAAa,OAAA,CAAQ;AAAA,KACvB;AAAA,EACF;AAEA,EAAA,IAAI,OAAA,CAAQ,kBAAkB,UAAA,EAAY;AACxC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAMF;AAAA,EACF;AAOA,EAAA,IAAI,OAAA,CAAQ,kBAAkB,OAAA,EAAS;AACrC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,2CAAA,GACE,IAAA,CAAK,SAAA,CAAW,OAAA,CAAuC,aAAa,CAAA,GACpE;AAAA,KAGJ;AAAA,EACF;AAYA,EAAA,MAAM,gBAAgBH,yBAAA,CAAkB,MAAA,CAAO,MAAA,CAAO,mBAAA,EAAqB,OAAO,UAAU,CAAA;AAC5F,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF;AACA,EAAA,MAAM,cAAc,MAAA,CAAOG,WAAAA,CAAG,UAAA,CAAW,WAAA,CAAY,aAAa,CAAC,CAAA;AAEnE,EAAA,MAAM,QAAQ,mBAAA,CAAoB;AAAA,IAChC,oBAAA,EAAsB,OAAO,MAAA,CAAO,SAAA;AAAA,IACpC,eAAA,EAAiB,WAAA;AAAA,IACjB,oBAAA,EAAsB,MAAA,CAAO,OAAA,CAAQ,aAAa,CAAA;AAAA,IAClD,sBAAA,EAAwB,MAAA,CAAO,OAAA,CAAQ,qBAAqB,CAAA;AAAA,IAC5D,OAAO,OAAA,CAAQ;AAAA,GAChB,CAAA;AAQD,EAAA,MAAM,eAAA,GAAkB,MAAM,2BAAA,CAA4B;AAAA,IACxD,MAAA,EAAQ;AAAA,MACN,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,MAAA,EAAQ;AAAA,QACN,SAAA,EAAW,OAAO,MAAA,CAAO,SAAA;AAAA,QACzB,mBAAA,EAAqB,OAAO,MAAA,CAAO,mBAAA;AAAA;AAAA;AAAA;AAAA,QAInC,UAAA,EAAY;AAAA,OACd;AAAA,MACA,KAAA;AAAA;AAAA;AAAA;AAAA,MAIA,cAAA,EAAgB;AAAA,KAClB;AAAA,IACA,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,QAAQ,MAAA,CAAO;AAAA,GAChB,CAAA;AAOD,EAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAA6B;AAAA,IAC/D,QAAA,EAAU,wCAAA;AAAA,IACV,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,IAAA,EAAM;AAAA,MACJ,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,gBAAgB,MAAA,CAAO,cAAA;AAAA,MACvB;AAAA;AACF,GACD,CAAA;AAED,EAAA,OAAO,EAAE,IAAA,EAAM,UAAA,EAAY,GAAG,OAAA,EAAQ;AACxC;;;AD7MO,IAAM,eAAN,MAAmB;AAAA,EACxB,YAAoB,MAAA,EAAqB;AAArB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAkgBpB,IAAA,IAAA,CAAA,eAAA,GAAkB,MAAM;AAGtB,MAAA,MAAM,eAAA,GAAkBF,yBAAAA,CAAS,GAAA,CAAI,SAAA,CAAU,OAAO,EAAE,CAAA;AAExD,MAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,QAAA,CAASA,yBAAAA,CAAS,IAAI,GAAG,CAAA;AAG5D,MAAA,MAAM,cAAA,GAAiB,KAAK,UAAU,CAAA,CAAA;AAItC,MAAA,MAAM,gBAAA,GAAmB,MAAA;AAAA,QACvB;AAAA,OACF;AACA,MAAA,MAAM,gBAAA,GAAmB,MAAA,CAAO,cAAc,CAAA,GAAI,gBAAA;AAGlD,MAAA,OAAO,CAAA,EAAA,EAAK,gBAAA,CAAiB,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AAAA,IAC3C,CAAA;AAAA,EArhB0C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgB1C,MAAM,aACJ,MAAA,EAC+B;AAC/B,IAAA,IAAI;AACF,MAAA,MAAM;AAAA,QACJ,UAAA;AAAA,QACA,cAAA;AAAA,QACA,WAAA;AAAA,QACA,MAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAmBA,UAAA,GAAa,MAAA;AAAA,QACb,SAAA,EAAW,eAAA;AAAA,QACX,UAAA;AAAA,QACA;AAAA,OACF,GAAI,MAAA;AAEJ,MAAA,IAAI,CAAC,UAAA,EAAY;AACf,QAAA,IAAI,UAAA,EAAY;AACd,UAAA,MAAM,IAAI,KAAA;AAAA,YACR;AAAA,WACF;AAAA,QACF;AACA,QAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,MAC9D;AAYA,MAAA,MAAM,SAAS,UAAA,KAAe,MAAA;AAC9B,MAAA,MAAM,mBAAA,GAAsB,MAAA,GAAU,MAAA,CAAO,UAAA,IAAc,OAAA,GAAW,KAAA,CAAA;AACtE,MAAA,MAAM,sBAAA,GAAyB;AAAA,QAC7B,OAAA;AAAA,QACA,SAAA;AAAA,QACA,eAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IACE,MAAA,IACA,CAAC,sBAAA,CAAuB,QAAA;AAAA,QACtB;AAAA,OACF,EACA;AACA,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,mBAAmB,mBAAmB,CAAA,qMAAA;AAAA,SAIxC;AAAA,MACF;AAKA,MAAA,MAAM,MAAA,GACJ,UAAA,KAAe,OAAA,GAAUe,2BAAAA,CAAqB,QAAQA,2BAAAA,CAAqB,KAAA;AAE7E,MAAA,MAAM,WAAW,IAAIE,oBAAAA,CAAY,EAAE,OAAA,EAAS,QAAQ,CAAA;AAMpD,MAAA,MAAM,YAAA,GAAe,KAAK,eAAA,EAAgB;AAC1C,MAAA,MAAM,aAAA,GAAgBf,WAAAA,CAAG,UAAA,CAAW,WAAA,CAAY,YAAY,CAAA;AAE5D,MAAA,IAAI,mBAAA;AACJ,MAAA,IAAI,gBAAA;AACJ,MAAA,IAAI,SAAA;AACJ,MAAA,IAAI,cAAA;AAGJ,MAAA,IAAI,oBAAA;AAKJ,MAAA,IAAI,oBAAA,GAA+B,YAAA;AAEnC,MAAA,IAAI,MAAA,EAAQ;AAMV,QAAA,IAAI,WAAA;AACJ,QAAA,IAAI,iBAAA;AACJ,QAAA,IAAI,wBAAwB,OAAA,EAAS;AAEnC,UAAA,WAAA,GAAc,CAAC,MAAA,CAAO,aAAa,CAAC,CAAA;AACpC,UAAA,iBAAA,GAAoB,YAAA;AAAA,QACtB,CAAA,MAAA,IAAW,wBAAwB,SAAA,EAAW;AAC5C,UAAA,IAAI,MAAA,CAAO,gBAAA,IAAoB,MAAA,CAAO,gBAAA,CAAiB,SAAS,CAAA,EAAG;AAMjE,YAAA,IAAI,MAAA,CAAO,gBAAA,CAAiB,MAAA,KAAW,CAAA,EAAG;AACxC,cAAA,MAAM,IAAI,KAAA;AAAA,gBACR,CAAA,2EAAA,EAA8E,MAAA,CAAO,gBAAA,CAAiB,MAAM,CAAA,CAAA;AAAA,eAC9G;AAAA,YACF;AACA,YAAA,WAAA,GAAc,OAAO,gBAAA,CAAiB,GAAA,CAAI,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AAC1D,YAAA,iBAAA,GAAoB,EAAA;AAAA,UACtB,CAAA,MAAO;AAKL,YAAA,MAAM,SAAA,GAAwB4B,mBAAY,EAAE,CAAA;AAC5C,YAAA,MAAM,EAAA,GAAK,MAAM,OAAO,gBAAgB,CAAA;AACxC,YAAA,MAAM,QAAA,GAAW,MAAM,EAAA,CAAG,iBAAA,CAAkB,SAAS,CAAA;AACrD,YAAA,WAAA,GAAc,mBAAmB,QAAQ,CAAA;AACzC,YAAA,iBAAA,GAAoB,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,CAAE,SAAS,KAAK,CAAA;AAAA,UAC3D;AAAA,QACF,CAAA,MAAA,IACE,mBAAA,KAAwB,eAAA,IACxB,mBAAA,KAAwB,kBAAA,EACxB;AAOA,UAAA,IAAI,CAAC,MAAA,CAAO,gBAAA,IAAoB,MAAA,CAAO,gBAAA,CAAiB,WAAW,CAAA,EAAG;AACpE,YAAA,MAAM,IAAI,KAAA;AAAA,cACR,QAAQ,mBAAmB,CAAA,wEAAA,EAEtB,MAAA,CAAO,gBAAA,EAAkB,UAAU,CAAC,CAAA,CAAA;AAAA,aAC3C;AAAA,UACF;AACA,UAAA,WAAA,GAAc,OAAO,gBAAA,CAAiB,GAAA,CAAI,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AAC1D,UAAA,iBAAA,GAAoB,EAAA;AAAA,QACtB,CAAA,MAAO;AAIL,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,mBAAmB,mBAAmB,CAAA,gEAAA;AAAA,WACxC;AAAA,QACF;AAEA,QAAA,oBAAA,GAAuB,WAAA,CAAY,IAAI,CAAC,CAAA,KAAM,OAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA;AAKnE,QAAA,oBAAA,GAAuB,iBAAA;AAEvB,QAAA,MAAM,iBAAA,GAAoB,MAAA;AAAA,UACxBC,kCAA2B,mBAA8D;AAAA,SAC3F;AACA,QAAA,MAAM,aAAA,GAAgB,mBAAmBpB,0BAAAA,CAAoB,IAAA;AAM7D,QAAA,MAAM,kBAAkB,kBAAA,CAAmB;AAAA,UACzC,SAAA,EAAW,OAAO,aAAa,CAAA;AAAA,UAC/B,WAAA,EAAa,mBAAA;AAAA,UACb,MAAA,EAAQ,WAAA;AAAA,UACR;AAAA,SACD,CAAA;AACD,QAAA,SAAA,GAAY,IAAA,GAAO,eAAA,CAAgB,QAAA,CAAS,EAAE,CAAA;AAC9C,QAAA,gBAAA,GAAmB,aAAA;AAMnB,QAAA,MAAM,SAAA,GAAY,MAAA,CAAO9B,oBAAAA,CAAY,iBAAA,CAAkB,SAAS,CAAC,CAAA;AACjE,QAAA,MAAM,WAAA,GAAc,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,mBAAoB,CAAC,CAAA;AAC9E,QAAA,mBAAA,GAAsB;AAAA,UACpB,YAAY,QAAA,EAAS;AAAA,UACrB,kBAAkB,QAAA,EAAS;AAAA,UAC3B,WAAA,CAAY,OAAO,QAAA,EAAS;AAAA,UAC5B,GAAG,WAAA,CAAY,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,UAAU,CAAA;AAAA,UACtC,UAAU,QAAA;AAAS,SACrB;AAKA,QAAA,MAAM,QAAQ,MAAM;AAClB,UAAA,MAAM,WAAA,GAAc,MAAA;AAAA,YAClBD,cAAK,6BAAA,CAA8B;AAAA,cACjC,IAAA,GAAO,WAAA,CAAY,QAAA,CAAS,EAAE,CAAA;AAAA,cAC9B,GAAG,YAAY,GAAA,CAAI,CAAC,MAAM,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC;AAAA,aAChD;AAAA,WACH;AACA,UAAA,OAAO,MAAA;AAAA,YACLA,cAAK,6BAAA,CAA8B;AAAA,cACjC,IAAA,GAAO,WAAA,CAAY,QAAA,CAAS,EAAE,CAAA;AAAA,cAC9B,IAAA,GAAO,WAAA,CAAY,QAAA,CAAS,EAAE;AAAA,aAC/B;AAAA,WACH;AAAA,QACF,CAAA,GAAG;AACH,QAAA,cAAA,GAAiB,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,EAAE,CAAA;AAAA,MAC1C,CAAA,MAAO;AAEL,QAAA,mBAAA,GAAsB,IAAA,CAAK,wBAAA,CAAyB,UAAA,EAAY,aAAa,CAAA;AAC7E,QAAA,gBAAA,GACE,eAAA,KACC,UAAA,KAAe,OAAA,GAAU+B,0BAAAA,CAAoB,QAAQA,0BAAAA,CAAoB,KAAA,CAAA;AAC5E,QAAA,SAAA,GAAY/B,aAAAA,CAAK,gCAAA;AAAA,UACf,aAAA;AAAA,UACA,gBAAA;AAAA,UACA,mBAAA;AAAA,UACA;AAAA,SACF;AACA,QAAA,cAAA,GAAiB,aAAA;AAAA,MACnB;AAGA,MAAA,MAAM,OAAA,GAAU,IAAIsC,gBAAAA,CAAQ,EAAE,UAAU,OAAA,EAAS,SAAA,EAAW,MAAA,EAAQ,YAAA,EAAc,CAAA;AAElF,MAAA,MAAM,iBAAA,GAAoB,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAoC;AAAA,QAC9E,QAAA,EAAU,CAAA,EAAGc,oBAAA,CAAc,aAAa,CAAA,iBAAA,CAAA;AAAA,QACxC,WAAA;AAAA,QACA,IAAA,EAAM;AAAA,UACJ,KAAA;AAAA,UACA,SAAA;AAAA,UACA,UAAA;AAAA,UACA,aAAA;AAAA;AAAA;AAAA;AAAA,UAIA,GAAA,CAAK,eAAA,IAAmB,MAAA,KAAW,EAAE,WAAW,gBAAA,EAAiB;AAAA;AAAA;AAAA;AAAA;AAAA,UAKjE,GAAI,MAAA,IAAU;AAAA,YACZ,UAAA,EAAY,mBAAA;AAAA,YACZ,gBAAA,EAAkB;AAAA;AACpB;AACF,OACD,CAAA;AAED,MAAA,MAAM,EAAE,SAAA,EAAApB,UAAAA,EAAW,gBAAA,EAAkB,0BAAyB,GAAI,iBAAA;AAKlE,MAAA,IACE,MAAA,KACC,CAAC,wBAAA,IAA4B,MAAA,CAAO,wBAAwB,CAAA,KAAM,MAAA,CAAO,gBAAgB,CAAA,CAAA,EAC1F;AACA,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,gCAAA,EAAmC,wBAAA,IAA4B,QAAQ,CAAA,2CAAA,EACxC,gBAAgB,CAAA,gBAAA;AAAA,SACjD;AAAA,MACF;AAmBA,MAAA,IAAI,oBAAA;AACJ,MAAA,IAAI,MAAA,EAAQ;AAIV,QAAA,oBAAA,GAAuB;AAAA,UACrB,CAAA,EAAG,KAAA;AAAA,UACH,CAAA,EAAG,KAAA;AAAA,UACH,QAAA,EAAU;AAAA,SACZ;AAAA,MACF,CAAA,MAAO;AACL,QAAA,MAAM,aAAA,GAAgB,MAAM,OAAA,CAAQ,WAAA,CAAYA,UAAS,CAAA;AACzD,QAAA,oBAAA,GAAuB;AAAA,UACrB,CAAA,EAAI,aAAA,CAAsB,CAAA,CAAE,QAAA,EAAS;AAAA,UACrC,CAAA,EAAI,aAAA,CAAsB,CAAA,CAAE,QAAA,EAAS;AAAA,UACrC,UAAW,aAAA,CAAsB;AAAA,SACnC;AAAA,MACF;AAEA,MAAA,MAAM,cAAA,GAAiC;AAAA,QACrC,UAAA,EAAY,wBAAA;AAAA,QACZ,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,CAAA,EAAGiB,YAAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA;AAAA,QACvB,QAAA,EAAU,oBAAoB,GAAA,CAAI,CAAC,UAAUA,YAAAA,CAAI,KAAA,CAAM,KAAK,CAAC;AAAA,OAC/D;AAOA,MAAA,MAAM,sBACJ,oBAAA,KAAyB,EAAA,GACrB,KAAA,CAAA,GACA/B,yBAAA,CAAkB,sBAAsB,UAAU,CAAA;AAGxD,MAAA,MAAM,yBAAA,GACJ,OAAO,gBAAA,IAAoB,oBAAA,KAAyB,KAChDA,yBAAA,CAAkB,oBAAA,EAAsB,MAAA,CAAO,gBAAgB,CAAA,GAC/D,KAAA,CAAA;AAGN,MAAA,MAAM,0BAAA,GAA6B,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAA2B;AAAA,QAC9E,QAAA,EAAU,CAAA,EAAGkC,oBAAA,CAAc,aAAa,CAAA,CAAA;AAAA,QACxC,WAAA;AAAA,QACA,IAAA,EAAM;AAAA,UACJ,cAAA;AAAA,UACA,MAAA;AAAA,UACA,SAAA;AAAA,UACA,UAAA;AAAA,UACA,KAAA;AAAA,UACA,aAAA,EAAe,oBAAA;AAAA,UACf,SAAA,EAAApB,UAAAA;AAAA,UACA,GAAI,mBAAA,KAAwB,KAAA,CAAA,IAAa,EAAE,mBAAA,EAAoB;AAAA;AAAA,UAE/D,GAAI,MAAA,IAAU,EAAE,UAAA,EAAY,mBAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAOhD,GAAI,MAAA,IACF,mBAAA,KAAwB,KAAA,CAAA,IACxB,oBAAA,IAAwB;AAAA,YACtB,gBAAA,EAAkB,oBAAA;AAAA,YAClB,cAAA,EAAgB,oBAAA,CAAqB,IAAA,CAAK,GAAG;AAAA,WAC/C;AAAA,UACF,GAAI,yBAAA,IAA6B,EAAE,yBAAA,EAA0B;AAAA,UAC7D,GAAI,MAAA,CAAO,UAAA,IAAc,EAAE,UAAA,EAAY,OAAO,UAAA,EAAW;AAAA,UACzD,GAAI,MAAA,CAAO,YAAA,IAAgB,EAAE,YAAA,EAAc,OAAO,YAAA,EAAa;AAAA,UAC/D,GAAI,MAAA,CAAO,YAAA,IAAgB,QAAQ,EAAE,YAAA,EAAc,OAAO,YAAA,EAAa;AAAA,UACvE,GAAI,MAAA,CAAO,UAAA,IAAc,EAAE,UAAA,EAAY,OAAO,UAAA,EAAW;AAAA,UACzD,cAAA,EAAgB;AAAA,YACd,GAAG,cAAA;AAAA,YACH,IAAA,EAAM,CAAA,EAAG,cAAA,CAAe,IAAI,CAAA,CAAA;AAAA,YAC5B,QAAA,EAAU,eAAe,QAAA,CAAS,GAAA,CAAI,CAAC,IAAA,KAAS,CAAA,EAAG,IAAI,CAAA,CAAE;AAAA;AAC3D;AACF,OACD,CAAA;AAED,MAAA,OAAO,0BAAA;AAAA,IACT,SAAS,KAAA,EAAgB;AACvB,MAAA,OAAA,CAAQ,KAAA,CAAM,mBAAmB,KAAK,CAAA;AAEtC,MAAA,IAAI,iBAAiB,KAAA,IAAS,KAAA,CAAM,OAAA,CAAQ,QAAA,CAAS,KAAK,CAAA,EAAG;AAC3D,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,IAAIqB,4BAAA;AAAA,QACR,CAAA,yBAAA,EAA4B,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,UAAU,eAAe,CAAA,CAAA;AAAA,QACpF;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,wBAAA,CAAyB,YAAwB,aAAA,EAAiC;AACxF,IAAA,IAAI,eAAe,OAAA,EAAS;AAE1B,MAAA,MAAM,QAAA,GAAW,IAAIC,wBAAA,CAAgB;AAAA,QACnC,QAAA,EAAU,EAAE,MAAA,EAAQ,aAAA;AAAc,OACnC,CAAA;AACD,MAAA,MAAM,UAAA,GAAa,IAAIC,oBAAA,CAAqBC,2BAAA,CAAmB,IAAI,CAAA;AAEnE,MAAA,OAAOrD,kBAAS,OAAA,CAAQ;AAAA,QACtB,KAAA,EAAO,QAAA;AAAA,QACP,QAAA,EAAU;AAAA,OACX,CAAA;AAAA,IACH;AAGA,IAAA,OAAOA,kBAAS,OAAA,CAAQ;AAAA,MACtB,UAAA,EAAY;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAA,CAAsB;AAAA,IAC1B,MAAA;AAAA,IACA;AAAA,GACF,EAGwB;AACtB,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAiB;AAAA,MAClD,QAAA,EAAU,CAAA,EAAGiD,oBAAA,CAAc,aAAa,CAAA,UAAA,CAAA;AAAA,MACxC,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAED,IAAA,OAAO,QAAA;AAAA,EACT;AAAA,EAEA,MAAM,SAAA,CAAU,MAAA,EAAyB,WAAA,EAAwD;AAC/F,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,gBAAe,GAAI,MAAA;AAC3B,MAAA,MAAM,iBAAA,GAAoB,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAAuB;AAAA,QACjE,QAAA,EAAU,CAAA,EAAGA,oBAAA,CAAc,aAAa,CAAA,QAAA,CAAA;AAAA,QACxC,MAAA,EAAQ,EAAE,cAAA,EAAe;AAAA,QACzB;AAAA,OACD,CAAA;AAED,MAAA,OAAO,iBAAA;AAAA,IACT,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAI,GAAA,YAAexB,oBAAAA,IAAiB,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK;AACtD,QAAA,OAAO,IAAA;AAAA,MACT;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,qBAAA,CACJ,MAAA,EACA,WAAA,EAMC;AACD,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAI;AAAA,MACrB,QAAA,EAAU,CAAA,EAAGwB,oBAAA,CAAc,aAAa,CAAA,oBAAA,CAAA;AAAA,MACxC,MAAA,EAAQ,EAAE,cAAA,EAAgB,MAAA,CAAO,cAAA,EAAe;AAAA,MAChD;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,sBAAA,CACJ,MAAA,EACA,WAAA,EACyC;AACzC,IAAA,MAAM,IAAA,GAA+B;AAAA,MACnC,gBAAgB,MAAA,CAAO,cAAA;AAAA,MACvB,wBAAwB,MAAA,CAAO;AAAA,KACjC;AAEA,IAAA,IAAI,MAAA,CAAO,aAAa,IAAA,EAAM;AAC5B,MAAA,IAAA,CAAK,YAAY,MAAA,CAAO,SAAA;AAAA,IAC1B;AAEA,IAAA,OAAO,IAAA,CAAK,OAAO,KAAA,CAAsC;AAAA,MACvD,QAAA,EAAU,CAAA,EAAGA,oBAAA,CAAc,aAAa,CAAA,0BAAA,CAAA;AAAA,MACxC,WAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAuBA,MAAM,eAAA,CAAgB;AAAA,IACpB,MAAA;AAAA,IACA;AAAA,GACF,EAGqC;AACnC,IAAA,MAAM,kBAAA,GAAqB,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAA6B;AAAA,MACxE,QAAA,EAAU,CAAA,EAAGA,oBAAA,CAAc,aAAa,CAAA,cAAA,CAAA;AAAA,MACxC,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,OAAO,kBAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAA,CACJ,MAAA,EACA,WAAA,EACuC;AACvC,IAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAmC;AAAA,MACpD,QAAA,EAAU,CAAA,EAAGA,oBAAA,CAAc,aAAa,CAAA,gBAAA,CAAA;AAAA,MACxC,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAA,CACJ,MAAA,EACA,WAAA,EACuC;AACvC,IAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAmC;AAAA,MACpD,QAAA,EAAU,CAAA,EAAGA,oBAAA,CAAc,aAAa,CAAA,QAAA,CAAA;AAAA,MACxC,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAM,aAAA,CACJ,MAAA,EACA,WAAA,EAC2B;AAC3B,IAAA,OAAO,wBAAA,CAAyB;AAAA,MAC9B,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,WAAA;AAAA,MACA,GAAG;AAAA,KACJ,CAAA;AAAA,EACH;AACF;AKpoBO,IAAM,oBAAN,MAAwB;AAAA,EAC7B,YAAoB,MAAA,EAAqB;AAArB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAsB;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1C,MAAM,kBAAA,CAAmB;AAAA,IACvB,MAAA;AAAA,IACA,WAAA;AAAA,IACA,cAAA,GAAiB;AAAA;AAAA,GACnB,EAIoB;AAClB,IAAA,OAAO,2BAAA,CAA4B;AAAA,MACjC,MAAA,EAAQ;AAAA,QACN,GAAG,MAAA;AAAA,QACH;AAAA,OACF;AAAA,MACA,WAAA;AAAA,MACA,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAA,CAAS;AAAA,IACb,MAAA;AAAA,IACA;AAAA,GACF,EAGoB;AAClB,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,OAAO,UAAA,EAAY,SAAA,EAAW,QAAO,GAAI,MAAA;AACrE,IAAA,MAAM,QAAA,GAAWK,yBAAmB,KAAK,CAAA;AACzC,IAAA,IAAI,kBAAkB,QAAA,CAAS,eAAA;AAC/B,IAAA,IAAI,WAAW,QAAA,CAAS,QAAA;AACxB,IAAA,IAAI,UAAU,OAAA,EAAS;AACrB,MAAA,IAAI,CAAC,UAAA,EAAY;AACf,QAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,MAC/D;AACA,MAAA,eAAA,GAAkB,UAAA,CAAW,eAAA;AAC7B,MAAA,QAAA,GAAW,UAAA,CAAW,QAAA;AAAA,IACxB;AACA,IAAA,MAAM,eAAA,GAAkBC,mBAAA,CAAa,MAAA,EAAQ,QAAQ,CAAA;AACrD,IAAA,OAAO,KAAK,kBAAA,CAAmB;AAAA,MAC7B,MAAA,EAAQ;AAAA,QACN,UAAA;AAAA,QACA,MAAA;AAAA,QACA,KAAA,EAAO;AAAA,UACL;AAAA,YACE,eAAA;AAAA,YACA,UAAA,EAAY,UAAA;AAAA,YACZ,QAAA,EAAU,CAAC,SAAA,EAAW,eAAA,EAAiB,KAAK;AAAA;AAC9C;AACF,OACF;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAQ,MAAA,EAQM;AAClB,IAAA,MAAM,eAAA,GAAkBA,mBAAA,CAAa,MAAA,CAAO,MAAA,EAAQ,OAAO,QAAQ,CAAA;AAEnE,IAAA,OAAO,KAAK,kBAAA,CAAmB;AAAA,MAC7B,MAAA,EAAQ;AAAA,QACN,YAAY,MAAA,CAAO,UAAA;AAAA,QACnB,QAAQ,MAAA,CAAO,MAAA;AAAA,QACf,KAAA,EAAO;AAAA,UACL;AAAA,YACE,iBAAiB,MAAA,CAAO,eAAA;AAAA,YACxB,UAAA,EAAY,SAAA;AAAA,YACZ,QAAA,EAAU,CAAC,MAAA,CAAO,OAAA,EAAS,iBAAiB,KAAK;AAAA;AACnD;AACF,OACF;AAAA,MACA,aAAa,MAAA,CAAO;AAAA,KACrB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,eAAA,CAAgB;AAAA,IACpB,MAAA;AAAA,IACA;AAAA,GACF,EAGoB;AAClB,IAAA,OAAO,KAAK,kBAAA,CAAmB;AAAA,MAC7B,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAA,CAAsB;AAAA,IAC1B,MAAA;AAAA,IACA;AAAA,GACF,EAGyB;AACvB,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAkB;AAAA,MACnD,QAAA,EAAU,CAAA,EAAGN,oBAAAA,CAAc,YAAY,CAAA,YAAA,CAAA;AAAA,MACvC,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAA,CACJ,KAAA,EACA,WAAA,EACyC;AACzC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAAoC;AAAA,MACrE,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,YAAY,CAAA,iBAAA,CAAA;AAAA,MACvC,MAAA,EAAQ,KAAA;AAAA,MACR;AAAA,KACD,CAAA;AACD,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAA,CAAe,QAAA,EAAkB,WAAA,EAA2C;AAChF,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAiB;AAAA,MAClC,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,YAAY,IAAI,QAAQ,CAAA,CAAA;AAAA,MACnD;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAA,CACJpD,MAAAA,EACA,WAAA,EACoC;AACpC,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAA+B;AAAA,MAChD,QAAA,EAAU,CAAA,EAAGoD,oBAAAA,CAAc,YAAY,IAAIpD,MAAI,CAAA,OAAA,CAAA;AAAA,MAC/C;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,oBAAA,CACJ,MAAA,EACA,WAAA,EACuC;AACvC,IAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAmC;AAAA,MACpD,QAAA,EAAU,CAAA,EAAGoD,oBAAAA,CAAc,YAAY,CAAA,cAAA,CAAA;AAAA,MACvC,WAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF;AC5MO,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YAAoB,MAAA,EAAqB;AAArB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAsB;AAAA,EAE1C,MAAM,YAAA,CACJ,cAAA,EACA,QAAA,EACA,WAAA,EACiB;AACjB,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAY;AAAA,MAC7B,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,SAAS,CAAA,WAAA,CAAA;AAAA,MACpC,WAAA;AAAA,MACA,MAAA,EAAQ,EAAE,cAAA,EAAgB,QAAA;AAAS,KACpC,CAAA;AAAA,EACH;AACF,CAAA;;;ACMO,IAAM,oBAAN,MAAwB;AAAA,EAI7B,YAAoB,MAAA,EAAqB;AAArB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAClB,IAAA,IAAA,CAAK,YAAA,GAAe,IAAI,iBAAA,CAAkB,MAAM,CAAA;AAChD,IAAA,IAAA,CAAK,SAAA,GAAY,IAAI,cAAA,CAAe,MAAM,CAAA;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,WAAA,CAAY,MAAA,EAAiC,WAAA,EAA2C;AAC5F,IAAA,MAAM,EAAE,OAAO,YAAA,EAAc,cAAA,EAAgB,UAAU,KAAA,EAAO,KAAA,EAAO,UAAA,EAAY,MAAA,EAAO,GACtF,MAAA;AAEF,IAAA,IAAI,KAAA,KAAUO,YAAM,QAAA,EAAU;AAC5B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qCAAA,EAAwC,KAAK,CAAA,CAAE,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,WAAA,GAAcF,yBAAmB,KAAK,CAAA;AAC5C,IAAA,IAAI,CAAC,aAAa,eAAA,EAAiB;AACjC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8CAAA,EAAiD,KAAK,CAAA,CAAE,CAAA;AAAA,IAC1E;AAEA,IAAA,MAAM,YAAY,MAAM,IAAA,CAAK,UAAU,YAAA,CAAa,cAAA,EAAgB,UAAU,WAAW,CAAA;AACzF,IAAA,MAAM,eAAe,WAAA,CAAY,eAAA;AAEjC,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,IAAK,aAAa,CAAA,EAAG;AACjD,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,SAAS,CAAA,0BAAA,CAA4B,CAAA;AAAA,IAC9E;AAEA,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,GAAA,CAAI,SAAA,EAAW,IAAQ,CAAA;AACjD,IAAA,MAAM,eAAeC,mBAAAA,CAAa,YAAA,CAAa,QAAA,EAAS,EAAG,YAAY,QAAQ,CAAA;AAE/E,IAAA,MAAM,KAAA,GAAgB;AAAA,MACpB;AAAA,QACE,eAAA,EAAiB,YAAA;AAAA,QACjB,UAAA,EAAY,SAAA;AAAA,QACZ,QAAA,EAAUvD,kBAAS,OAAA,CAAQ;AAAA,UACzB,SAASyD,oBAAA,CAAc,2BAAA;AAAA,UACvB,MAAA,EAAQC,cAAA,CAAM,OAAA,CAAQ,YAAY;AAAA,SACnC;AAAA,OACH;AAAA,MACA;AAAA,QACE,iBAAiBD,oBAAA,CAAc,2BAAA;AAAA,QAC/B,UAAA,EAAY,kBAAA;AAAA,QACZ,QAAA,EAAUzD,kBAAS,OAAA,CAAQ;AAAA,UACzB,KAAA,EAAO,YAAA;AAAA,UACP,MAAA,EAAQ0D,cAAA,CAAM,OAAA,CAAQ,YAAY,CAAA;AAAA,UAClC,aAAazC,yBAAAA,CAAS,MAAA;AAAA,YACpBA,yBAAAA,CAAS,GAAA,CAAI,SAAA,CAAU,MAAA,CAAO,EAAE;AAAA;AAAA,WAClC,CACG,QAAA,EAAS,CACT,KAAA,CAAM,GAAG,EAAE,CAAA;AAAA,UACd,YAAA,EAAc,KAAA;AAAA,UACd,eAAe0C,kBAAA,CAAY;AAAA,SAC5B;AAAA,OACH;AAAA,MACA;AAAA,QACE,iBAAiBF,oBAAA,CAAc,kBAAA;AAAA,QAC/B,UAAA,EAAY,WAAA;AAAA,QACZ,QAAA,EAAUzD,kBAAS,OAAA,CAAQ;AAAA,UACzB,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,QAAA,EAAU;AAAA,YACR,cAAc4D,oBAAA,CAAc,WAAA;AAAA,YAC5B,SAAA,EAAW,KAAK,GAAA,EAAI;AAAA,YACpB,eAAe/D,aAAAA,CAAK,cAAA,CAAe,OAAO,SAAA,IAAa,KAAK,EAAE,QAAA,EAAS;AAAA,YACvE,GAAA,EAAK,IAAA;AAAA,YACL,MAAA,EAAQ6D,cAAA,CAAM,OAAA,CAAQ,YAAY;AAAA;AACpC,SACD;AAAA;AACH,KACF;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,YAAA,CAAa,kBAAA,CAAmB;AAAA,MACxD,MAAA,EAAQ;AAAA,QACN,UAAA;AAAA,QACA,MAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,WAAA;AAAA,MACA,cAAA,EAAgB;AAAA,KACjB,CAAA;AAED,IAAA,MAAM,IAAA,GAA8B;AAAA,MAClC,eAAA,EAAiB,MAAA;AAAA,MACjB,eAAe,MAAA,CAAO,SAAA;AAAA,MACtB,KAAA;AAAA,MACA,YAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA;AAAA,KACF;AAGA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAkB;AAAA,MACnD,QAAA,EAAU,CAAA,EAAGT,oBAAAA,CAAc,aAAa,CAAA,CAAA;AAAA,MACxC,WAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,cAAA,CAAe,EAAA,EAAY,WAAA,EAA2C;AAC1E,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAAiB;AAAA,MAClD,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,aAAa,IAAI,EAAE,CAAA,CAAA;AAAA,MAC9C;AAAA,KACD,CAAA;AACD,IAAA,OAAO,QAAA;AAAA,EACT;AACF;AC1IO,IAAM,YAAN,MAAgB;AAAA,EACrB,YAAoB,MAAA,EAAqB;AAArB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO1C,MAAM,UAAA,CAAW,MAAA,EAAyB,WAAA,EAAsD;AAC9F,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAA4B;AAAA,MAC7D,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,IAAI,CAAA,CAAA;AAAA,MAC/B,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,MAAA,CAAO,EAAA,EAAY,WAAA,EAAmC;AAC1D,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAS;AAAA,MAC1B,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,IAAI,IAAI,EAAE,CAAA,CAAA;AAAA,MACrC;AAAA,KACD,CAAA;AAAA,EACH;AACF;;;ACrBA/B,gBAAAA,EAAAA;ACZA,IAAM,WAAA,GAAc,EAAA,IAAM,IAAA,GAAO,GAAA,GAAM,MAAM,IAAA,GAAO,EAAA;AAEpD,IAAM,QAAA,GAAW,uBAAA;AACjB,IAAM,YAAA,GAAe,OAAA;AACrB,IAAM,gBAAA,GAAmB,0BAAA;AAelB,SAAS,qBAAqB,WAAA,EAA0C;AAC7E,EAAA,OAAO,WAAA,CAAY,GAAA,CAAI,CAAC,KAAA,KAAU;AAChC,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAK,CAAA,CAAE,IAAA,EAAK;AAEjC,IAAA,IAAI,SAAS,IAAA,CAAK,KAAK,KAAK,YAAA,CAAa,IAAA,CAAK,KAAK,CAAA,EAAG;AACpD,MAAA,MAAMR,KAAAA,GAAO,OAAO,KAAK,CAAA;AACzB,MAAA,IAAIA,SAAQ,WAAA,EAAa;AACvB,QAAA,MAAM,IAAI2B,wBAAAA;AAAA,UACR,sBAAsB,KAAK,CAAA,sCAAA,CAAA;AAAA,UAC3BC,qBAAAA,CAAe;AAAA,SACjB;AAAA,MACF;AACA,MAAA,OAAOQ,YAAAA,CAAI,MAAMpC,KAAI,CAAA;AAAA,IACvB;AAEA,IAAA,IAAI,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAChC,MAAA,OAAOb,aAAAA,CAAK,oBAAoB,KAAK,CAAA;AAAA,IACvC;AAEA,IAAA,MAAM,IAAIwC,wBAAAA;AAAA,MACR,uBAAuB,KAAK,CAAA,uDAAA,CAAA;AAAA,MAC5BC,qBAAAA,CAAe;AAAA,KACjB;AAAA,EACF,CAAC,CAAA;AACH;AAoBO,SAAS,iBAAA,CACd,QACA,UAAA,EACoB;AACpB,EAAA,MAAM,aAAa,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AAC3C,EAAA,MAAM,WAAW,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACzC,EAAA,MAAM,YAAY,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AAE1C,EAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,GAAA,CAAI,QAAA,GAAW,WAAW,CAAC,CAAA;AACvD,EAAA,MAAM,QAAA,GAAW,UAAA,KAAe,CAAA,IAAK,UAAA,IAAc,cAAc,cAAA,GAAiB,CAAA;AAElF,EAAA,OAAO,EAAE,QAAA,EAAU,UAAA,EAAY,cAAA,EAAgB,kBAAA,EAAoB,EAAC,EAAE;AACxE;AC/DA,IAAM,SAAA,GAAA,CAAa,MAAM,IAAA,IAAQ,EAAA;AACjC,IAAM,QAAA,GAAA,CAAY,MAAM,IAAA,IAAQ,EAAA;AAChC,IAAM,OAAA,GAAA,CAAW,MAAM,GAAA,IAAO,EAAA;AAE9B,SAAS,UAAU,KAAA,EAAiC;AAClD,EAAA,OAAO,CAACQ,YAAAA,CAAI,KAAA,CAAM,KAAA,GAAQ,SAAS,GAAGA,YAAAA,CAAI,KAAA,CAAM,KAAA,IAAS,IAAI,CAAC,CAAA;AAChE;AAGO,SAAS,sBAAA,CAAuB,eAAuB,aAAA,EAAoC;AAChG,EAAA,MAAM,kBAAA,GAAqB,oBAAA,CAAqB,aAAA,CAAc,kBAAkB,CAAA;AAChF,EAAA,OAAO;AAAA,IACL,eAAA,EAAiB,aAAA;AAAA,IACjB,YAAYe,0BAAA,CAAoB,aAAA;AAAA,IAChC,QAAA,EAAU;AAAA,MACR,aAAA,CAAc,gBAAA;AAAA,MACdf,YAAAA,CAAI,KAAA,CAAM,aAAA,CAAc,UAAU,CAAA;AAAA,MAClCA,YAAAA,CAAI,KAAA,CAAM,aAAA,CAAc,QAAQ,CAAA;AAAA,MAChCA,YAAAA,CAAI,KAAA,CAAM,kBAAA,CAAmB,MAAM,CAAA;AAAA,MACnC,GAAG;AAAA;AACL,GACF;AACF;AAGO,SAAS,yBAAA,CAA0B,eAAuB,gBAAA,EAAgC;AAC/F,EAAA,OAAO;AAAA,IACL,eAAA,EAAiB,aAAA;AAAA,IACjB,YAAYe,0BAAA,CAAoB,MAAA;AAAA,IAChC,QAAA,EAAU,CAAC,gBAAgB;AAAA,GAC7B;AACF;AAMO,SAAS,6BAA6B,MAAA,EAAoC;AAC/E,EAAA,MAAM,EAAE,KAAA,EAAO,UAAA,EAAY,YAAA,EAAc,eAAc,GAAI,MAAA;AAE3D,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,IAAA,EAAK,CAAE,WAAW,CAAA,EAAG;AACvC,IAAA,MAAM,IAAIxB,wBAAAA;AAAA,MACR,+CAA+C,KAAK,CAAA,CAAA,CAAA;AAAA,MACpDC,qBAAAA,CAAe;AAAA,KACjB;AAAA,EACF;AACA,EAAA,IACE,OAAO,aAAA,KAAkB,QAAA,IACzB,CAAC,MAAA,CAAO,QAAA,CAAS,aAAa,CAAA,IAC9B,CAAC,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA,IAC/B,aAAA,IAAiB,KACjB,MAAA,CAAO,aAAa,IAAI,OAAA,EACxB;AACA,IAAA,MAAM,IAAID,wBAAAA;AAAA,MACR,4BAA4B,aAAa,CAAA,8CAAA,CAAA;AAAA,MACzCC,qBAAAA,CAAe;AAAA,KACjB;AAAA,EACF;AACA,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,GAAa,QAAA,EAAU;AAC5C,IAAA,MAAM,IAAID,wBAAAA;AAAA,MACR,CAAA,iDAAA,CAAA;AAAA,MACAC,qBAAAA,CAAe;AAAA,KACjB;AAAA,EACF;AACA,EAAA,IAAI,YAAA,GAAe,EAAA,IAAM,YAAA,GAAe,QAAA,EAAU;AAChD,IAAA,MAAM,IAAID,wBAAAA;AAAA,MACR,CAAA,mDAAA,CAAA;AAAA,MACAC,qBAAAA,CAAe;AAAA,KACjB;AAAA,EACF;AACA,EAAA,IAAI,YAAA,GAAe,EAAA,IAAM,UAAA,GAAa,YAAA,EAAc;AAClD,IAAA,MAAM,IAAID,wBAAAA;AAAA,MACR,CAAA,qCAAA,EAAwC,UAAU,CAAA,8BAAA,EAAiC,YAAY,CAAA,CAAA,CAAA;AAAA,MAC/FC,qBAAAA,CAAe;AAAA,KACjB;AAAA,EACF;AACF;AASO,SAAS,0BAAA,CACd,eACA,MAAA,EACM;AACN,EAAA,4BAAA,CAA6B,MAAM,CAAA;AACnC,EAAA,MAAM,CAAC,aAAA,EAAe,cAAc,CAAA,GAAI,SAAA,CAAU,OAAO,UAAU,CAAA;AACnE,EAAA,MAAM,CAAC,eAAA,EAAiB,gBAAgB,CAAA,GAAI,SAAA,CAAU,OAAO,YAAY,CAAA;AACzE,EAAA,OAAO;AAAA,IACL,eAAA,EAAiB,aAAA;AAAA,IACjB,YAAYuB,0BAAA,CAAoB,mBAAA;AAAA,IAChC,QAAA,EAAU;AAAA,MACR,MAAA,CAAO,gBAAA;AAAA,MACP,MAAA,CAAO,KAAA;AAAA,MACP,aAAA;AAAA,MACA,cAAA;AAAA,MACA,eAAA;AAAA,MACA,gBAAA;AAAA,MACAf,YAAAA,CAAI,KAAA,CAAM,MAAA,CAAO,aAAa;AAAA;AAChC,GACF;AACF;AAGO,SAAS,6BAAA,CACd,aAAA,EACA,gBAAA,EACA,KAAA,EACM;AACN,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,IAAA,EAAK,CAAE,WAAW,CAAA,EAAG;AACvC,IAAA,MAAM,IAAIT,wBAAAA;AAAA,MACR,uDAAuD,KAAK,CAAA,CAAA,CAAA;AAAA,MAC5DC,qBAAAA,CAAe;AAAA,KACjB;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,eAAA,EAAiB,aAAA;AAAA,IACjB,YAAYuB,0BAAA,CAAoB,sBAAA;AAAA,IAChC,QAAA,EAAU,CAAC,gBAAA,EAAkB,KAAK;AAAA,GACpC;AACF;AAOO,SAAS,sBAAA,CACd,aAAA,EACA,aAAA,EACA,gBAAA,GAAkF,EAAC,EAC3E;AACR,EAAA,OAAO;AAAA,IACL,sBAAA,CAAuB,eAAe,aAAa,CAAA;AAAA,IACnD,GAAG,gBAAA,CAAiB,GAAA;AAAA,MAAI,CAAC,MAAA,KACvB,0BAAA,CAA2B,aAAA,EAAe;AAAA,QACxC,GAAG,MAAA;AAAA,QACH,kBAAkB,aAAA,CAAc;AAAA,OACjC;AAAA;AACH,GACF;AACF;;;AFhHO,IAAM,gBAAN,MAAoB;AAAA,EACzB,YAAoB,MAAA,EAAqB;AAArB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBlC,8BAAA,CACN,UAAA,EACA,SAAA,EACA,eAAA,EACM;AACN,IAAA,IAAI,UAAA,KAAe,OAAA,IAAW,UAAA,KAAe,MAAA,EAAQ;AACnD,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,kBAAA,EAAqB,SAAS,CAAA,qBAAA,CAAA,EAAyB;AAAA,QACnE,QAAA,EAAU,UAAA;AAAA,QACV,QAAA,EAAU,eAAA;AAAA,QACV,eAAe,eAAA,GAAkB,eAAA,CAAgB,MAAM,CAAA,EAAG,EAAE,IAAI,KAAA,GAAQ,gBAAA;AAAA,QACxE,IAAA,EAAM;AAAA,OACP,CAAA;AACD,MAAA,MAAM,IAAIxB,wBAAAA;AAAA,QACR,CAAA,sDAAA,EAAyD,cAAc,WAAW,CAAA,EAAA,CAAA;AAAA,QAClFC,qBAAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,MAAM,KAAA,EAA2B;AACvC,IAAA,OACE,OACA,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA,CACb,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AAAA,EAEd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiCA,iBAAiB,MAAA,EAAgD;AAC/D,IAAA,MAAM,EAAE,UAAA,EAAY,eAAA,GAAkBwB,uBAAA,CAAiB,kBAAiB,GAAI,MAAA;AAE5E,IAAA,IACE,OAAO,eAAA,KAAoB,QAAA,IAC3B,CAAC,OAAO,QAAA,CAAS,eAAe,CAAA,IAChC,CAAC,MAAA,CAAO,SAAA,CAAU,eAAe,CAAA,IACjC,mBAAmB,CAAA,EACnB;AACA,MAAA,MAAM,IAAIzB,wBAAAA;AAAA,QACR,6BAA6B,eAAe,CAAA,6BAAA,CAAA;AAAA,QAC5CC,qBAAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,IAAI;AAEF,MAAA,MAAM,aAAA,GAAgBnB,WAAAA,CAAG,UAAA,CAAW,KAAA,CAAM,gBAAA,EAAiB;AAC3D,MAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,KAAA,CAAM,aAAa,CAAA;AAG9C,MAAA,MAAM,SAAA,GAAYA,WAAAA,CAAG,UAAA,CAAW,WAAA,CAAY,aAAa,CAAA;AAGzD,MAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAA,GAAI,eAAA;AAGnD,MAAA,MAAM,mBAAA,GAAsBJ,yBAAA,CAAkB,aAAA,EAAe,UAAU,CAAA;AAQvE,MAAA,OAAO;AAAA,QACL,SAAA;AAAA,QACA,mBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AACpE,MAAA,OAAA,CAAQ,MAAM,0DAAA,EAA4D;AAAA,QACxE,OAAO,GAAA,CAAI,OAAA;AAAA,QACX,iBAAA,EAAmB;AAAA,OACpB,CAAA;AACD,MAAA,MAAM,IAAIsB,wBAAAA;AAAA,QACR,CAAA,8BAAA,EAAiC,IAAI,OAAO,CAAA,CAAA;AAAA,QAC5CC,qBAAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BA,MAAM,uBAAA,CAAwB,MAAA,EAA6B,WAAA,EAAsC;AAC/F,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,aAAA,EAAc,GAAI,MAAA;AAG9C,IAAA,IAAA,CAAK,8BAAA,CAA+B,MAAA,CAAO,UAAA,EAAY,eAAA,EAAiB,OAAO,SAAS,CAAA;AAExF,IAAA,IAAI;AACF,MAAA,OAAA,CAAQ,IAAI,+DAAA,EAAiE;AAAA,QAC3E,eAAe,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,eAAe,aAAA,CAAc,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC7D,YAAY,IAAI,IAAA,CAAK,cAAc,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY;AAAA,QAClE,UAAU,aAAA,CAAc,QAAA;AAAA,QACxB,kBAAA,EAAoB,cAAc,kBAAA,CAAmB;AAAA,OACtD,CAAA;AAID,MAAA,MAAM,OAAA,GAAU,sBAAA,CAAuB,MAAA,CAAO,SAAA,EAAW,aAAa,CAAA;AAQtE,MAAA,MAAM,MAAA,GAAS,MAAM,2BAAA,CAA4B;AAAA,QAC/C,MAAA,EAAQ;AAAA,UACN,UAAA;AAAA,UACA,MAAA;AAAA,UACA,KAAA,EAAO,CAAC,OAAO,CAAA;AAAA,UACf,cAAA,EAAgB;AAAA;AAAA,SAClB;AAAA,QACA,WAAA;AAAA,QACA,QAAQ,IAAA,CAAK;AAAA,OACd,CAAA;AAED,MAAA,OAAA,CAAQ,IAAI,kEAAA,EAAoE;AAAA,QAC9E,MAAA;AAAA,QACA,eAAe,aAAA,CAAc,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAC9D,CAAA;AAED,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AACpE,MAAA,OAAA,CAAQ,MAAM,sDAAA,EAAwD;AAAA,QACpE,OAAO,GAAA,CAAI,OAAA;AAAA,QACX,eAAe,MAAA,CAAO,SAAA,EAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAChD,eAAe,aAAA,CAAc,gBAAA,EAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC9D,YAAY,IAAI,IAAA,CAAK,cAAc,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY;AAAA,QAClE,UAAU,aAAA,CAAc;AAAA,OACzB,CAAA;AACD,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,MAAM,YAAA,CAAa,MAAA,EAA4B,WAAA,EAAsC;AACnF,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,eAAe,gBAAA,GAAmB,IAAG,GAAI,MAAA;AAErE,IAAA,IAAA,CAAK,8BAAA,CAA+B,MAAA,CAAO,UAAA,EAAY,OAAA,EAAS,OAAO,SAAS,CAAA;AAGhF,IAAA,MAAM,KAAA,GAAQ,sBAAA,CAAuB,MAAA,CAAO,SAAA,EAAW,eAAe,gBAAgB,CAAA;AAEtF,IAAA,OAAA,CAAQ,IAAI,qEAAA,EAAuE;AAAA,MACjF,eAAe,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,MAC/C,eAAe,aAAA,CAAc,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,MAC7D,YAAY,IAAI,IAAA,CAAK,cAAc,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY;AAAA,MAClE,UAAU,aAAA,CAAc,QAAA;AAAA,MACxB,kBAAA,EAAoB,cAAc,kBAAA,CAAmB,MAAA;AAAA,MACrD,kBAAkB,gBAAA,CAAiB;AAAA,KACpC,CAAA;AAED,IAAA,OAAO,2BAAA,CAA4B;AAAA,MACjC,MAAA,EAAQ;AAAA,QACN,UAAA;AAAA,QACA,MAAA;AAAA,QACA,KAAA;AAAA,QACA,cAAA,EAAgB;AAAA;AAAA,OAClB;AAAA,MACA,WAAA;AAAA,MACA,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAM,gBAAA,CAAiB,MAAA,EAAgC,WAAA,EAAsC;AAC3F,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,gBAAA,EAAiB,GAAI,MAAA;AAGjD,IAAA,IAAA,CAAK,8BAAA,CAA+B,MAAA,CAAO,UAAA,EAAY,QAAA,EAAU,OAAO,SAAS,CAAA;AAEjF,IAAA,IAAI;AACF,MAAA,OAAA,CAAQ,IAAI,0DAAA,EAA4D;AAAA,QACtE,eAAe,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,eAAA,EAAiB,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAClD,CAAA;AAQD,MAAA,MAAM,MAAA,GAAS,MAAM,2BAAA,CAA4B;AAAA,QAC/C,MAAA,EAAQ;AAAA,UACN,UAAA;AAAA,UACA,MAAA;AAAA,UACA,OAAO,CAAC,yBAAA,CAA0B,MAAA,CAAO,SAAA,EAAW,gBAAgB,CAAC,CAAA;AAAA,UACrE,cAAA,EAAgB;AAAA;AAAA,SAClB;AAAA,QACA,WAAA;AAAA,QACA,QAAQ,IAAA,CAAK;AAAA,OACd,CAAA;AAED,MAAA,OAAA,CAAQ,IAAI,wDAAA,EAA0D;AAAA,QACpE,MAAA;AAAA,QACA,cAAA,EAAgB,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OACjD,CAAA;AAED,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AACpE,MAAA,OAAA,CAAQ,MAAM,6CAAA,EAA+C;AAAA,QAC3D,OAAO,GAAA,CAAI,OAAA;AAAA,QACX,eAAe,MAAA,CAAO,SAAA,EAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAChD,eAAA,EAAiB,gBAAA,EAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OACnD,CAAA;AACD,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2BA,MAAM,eAAe,MAAA,EAA4D;AAC/E,IAAA,MAAM,EAAE,aAAA,EAAe,gBAAA,EAAiB,GAAI,MAAA;AAE5C,IAAA,IAAI;AACF,MAAA,OAAA,CAAQ,IAAI,kDAAA,EAAoD;AAAA,QAC9D,aAAA,EAAe,aAAA,CAAc,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC5C,aAAA,EAAe,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAChD,CAAA;AAGD,MAAA,MAAM,SAAS,MAAMR,sBAAAA;AAAA,QACnB,CAAC,QAAA,KACC,QAAA,CAAS,YAAA,CAAa;AAAA,UACpB,eAAA,EAAiB,aAAA;AAAA,UACjB,YAAY+B,0BAAAA,CAAoB,QAAA;AAAA,UAChC,QAAA,EAAU,CAAC,gBAAgB;AAAA,SAC5B,CAAA;AAAA,QACH,EAAE,WAAA,EAAa7B,2BAAAA,CAAqB,OAAO,CAAA;AAAE,OAC/C;AAKA,MAAA,MAAM,WAAA,GAAc,MAAM,OAAA,CAAQ,MAAM,IACpC,MAAA,GACC,MAAA,CAAiC,UAAU,EAAC;AAEjD,MAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1B,QAAA,OAAA,CAAQ,KAAK,uDAAA,EAAyD;AAAA,UACpE,cAAc,WAAA,CAAY,MAAA;AAAA,UAC1B,MAAA,EAAQ;AAAA,SACT,CAAA;AACD,QAAA,OAAO;AAAA,UACL,QAAA,EAAU,KAAA;AAAA,UACV,UAAA,EAAY,CAAA;AAAA,UACZ,cAAA,EAAgB,CAAA;AAAA,UAChB,oBAAoB;AAAC,SACvB;AAAA,MACF;AAEA,MAAA,MAAM,EAAE,QAAA,EAAU,UAAA,EAAY,cAAA,EAAgB,oBAAmB,GAAI,iBAAA;AAAA,QACnE,WAAA;AAAA,QACA,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI;AAAA,OAC9B;AAEA,MAAA,MAAM,WAAA,GAAmC;AAAA,QACvC,QAAA;AAAA,QACA,UAAA;AAAA,QACA,cAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,OAAA,CAAQ,IAAI,mDAAA,EAAqD;AAAA,QAC/D,QAAA;AAAA,QACA,YAAY,IAAI,IAAA,CAAK,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY;AAAA,QACpD,cAAA;AAAA;AAAA,QAEA,uBAAuB,MAAA,CAAO,MAAA,CAAO,WAAA,CAAY,CAAC,CAAC,CAAC;AAAA,OACrD,CAAA;AAED,MAAA,OAAO,WAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AAGpE,MAAA,MAAM,uBAAA,GAA0B;AAAA,QAC9B,yBAAA;AAAA,QACA,qCAAA;AAAA,QACA,2BAAA;AAAA,QACA,qBAAA;AAAA,QACA,kBAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,MAAM,iBAAA,GAAoB,wBAAwB,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,IAAA,CAAK,GAAA,CAAI,OAAO,CAAC,CAAA;AAEjF,MAAA,IAAI,iBAAA,EAAmB;AACrB,QAAA,OAAA,CAAQ,IAAI,0DAAA,EAA4D;AAAA,UACtE,aAAA,EAAe,aAAA,EAAe,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,UAC7C,aAAA,EAAe,gBAAA,EAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,SACjD,CAAA;AACD,QAAA,OAAO;AAAA,UACL,QAAA,EAAU,KAAA;AAAA,UACV,UAAA,EAAY,CAAA;AAAA,UACZ,cAAA,EAAgB,CAAA;AAAA,UAChB,oBAAoB;AAAC,SACvB;AAAA,MACF;AAGA,MAAA,OAAA,CAAQ,MAAM,8CAAA,EAAgD;AAAA,QAC5D,OAAO,GAAA,CAAI,OAAA;AAAA,QACX,aAAA,EAAe,aAAA,EAAe,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC7C,aAAA,EAAe,gBAAA,EAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OACjD,CAAA;AACD,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4CA,MAAM,6BAAA,CACJ,MAAA,EACA,WAAA,EACiB;AACjB,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,OAAA,EAAS,OAAM,GAAI,MAAA;AAQ/C,IAAA,IAAI,OAAO,UAAA,IAAc,MAAA,CAAO,eAAe,OAAA,IAAW,MAAA,CAAO,eAAe,MAAA,EAAQ;AACtF,MAAA,MAAM,IAAIK,wBAAAA;AAAA,QACR,CAAA,2DAAA,EAA8D,OAAO,UAAU,CAAA,CAAA;AAAA,QAC/EC,qBAAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAKA,IAAA,OAAO,sCAAA,CAAuC;AAAA,MAC5C,MAAA,EAAQ;AAAA,QACN,UAAA;AAAA,QACA,QAAQ,EAAE,GAAG,QAAQ,UAAA,EAAY,MAAA,CAAO,cAAc,OAAA,EAAQ;AAAA,QAC9D,OAAA;AAAA,QACA,KAAA;AAAA,QACA,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,WAAA;AAAA,MACA,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,QAAA,CAAS,KAAa,IAAA,EAAsB;AAClD,IAAA,OAAO,MAAA,CAAO,GAAG,CAAA,IAAK,MAAA,CAAO,IAAI,CAAA,IAAK,IAAA,CAAA;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA+BA,MAAM,iBAAA,CAAkB,MAAA,EAAiC,WAAA,EAAsC;AAC7F,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,oBAAA,EAAqB,GAAI,MAAA;AACrD,IAAA,MAAM,EAAE,gBAAA,EAAkB,KAAA,EAAO,UAAA,EAAY,YAAA,EAAc,eAAc,GACvE,oBAAA;AAKF,IAAA,IAAI,OAAO,UAAA,IAAc,MAAA,CAAO,eAAe,OAAA,IAAW,MAAA,CAAO,eAAe,MAAA,EAAQ;AACtF,MAAA,MAAM,IAAID,wBAAAA;AAAA,QACR,CAAA,0DAAA,EAA6D,OAAO,UAAU,CAAA,CAAA;AAAA,QAC9EC,qBAAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAGA,IAAA,4BAAA,CAA6B,oBAAoB,CAAA;AAEjD,IAAA,IAAI;AACF,MAAA,OAAA,CAAQ,IAAI,8DAAA,EAAgE;AAAA,QAC1E,eAAe,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,aAAA,EAAe,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,KAAA,EAAO,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC5B,UAAA,EAAY,WAAW,QAAA,EAAS;AAAA,QAChC,YAAA,EAAc,aAAa,QAAA,EAAS;AAAA,QACpC;AAAA,OACD,CAAA;AAGD,MAAA,MAAM,aAAA,GAAgB,0BAAA,CAA2B,MAAA,CAAO,SAAA,EAAW,oBAAoB,CAAA;AAUvF,MAAA,MAAM,MAAA,GAAS,MAAM,2BAAA,CAA4B;AAAA,QAC/C,MAAA,EAAQ;AAAA,UACN,UAAA;AAAA,UACA,MAAA;AAAA,UACA,KAAA,EAAO,CAAC,aAAa,CAAA;AAAA,UACrB,cAAA,EAAgB;AAAA,SAClB;AAAA,QACA,WAAA;AAAA,QACA,QAAQ,IAAA,CAAK;AAAA,OACd,CAAA;AAED,MAAA,OAAA,CAAQ,IAAI,uEAAA,EAAyE;AAAA,QACnF,MAAA;AAAA,QACA,aAAA,EAAe,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,KAAA,EAAO,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAC7B,CAAA;AAED,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AACpE,MAAA,OAAA,CAAQ,MAAM,oEAAA,EAAsE;AAAA,QAClF,OAAO,GAAA,CAAI,OAAA;AAAA,QACX,eAAe,MAAA,CAAO,SAAA,EAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAChD,aAAA,EAAe,gBAAA,EAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAChD,KAAA,EAAO,KAAA,EAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAC9B,CAAA;AACD,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAM,kBAAkB,MAAA,EAA8D;AACpF,IAAA,MAAM,EAAE,aAAA,EAAe,gBAAA,EAAkB,KAAA,EAAM,GAAI,MAAA;AAEnD,IAAA,IAAI;AACF,MAAA,OAAA,CAAQ,IAAI,+DAAA,EAAiE;AAAA,QAC3E,aAAA,EAAe,aAAA,CAAc,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC5C,aAAA,EAAe,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,KAAA,EAAO,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAC7B,CAAA;AAGD,MAAA,MAAM,SAAS,MAAMR,sBAAAA;AAAA,QACnB,CAAC,QAAA,KACC,QAAA,CAAS,YAAA,CAAa;AAAA,UACpB,eAAA,EAAiB,aAAA;AAAA,UACjB,YAAY+B,0BAAAA,CAAoB,mBAAA;AAAA,UAChC,QAAA,EAAU,CAAC,gBAAA,EAAkB,KAAK;AAAA,SACnC,CAAA;AAAA,QACH,EAAE,WAAA,EAAa7B,2BAAAA,CAAqB,OAAO,CAAA;AAAE,OAC/C;AAIA,MAAA,MAAM,WAAA,GAAc,MAAM,OAAA,CAAQ,MAAM,IACpC,MAAA,GACC,MAAA,CAAiC,UAAU,EAAC;AAEjD,MAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1B,QAAA,OAAA,CAAQ,KAAK,iEAAA,EAAmE;AAAA,UAC9E,cAAc,WAAA,CAAY,MAAA;AAAA,UAC1B,MAAA,EAAQ;AAAA,SACT,CAAA;AACD,QAAA,OAAO;AAAA,UACL,UAAA,EAAY,EAAA;AAAA,UACZ,YAAA,EAAc,EAAA;AAAA,UACd,aAAA,EAAe,CAAA;AAAA,UACf,aAAA,EAAe,EAAA;AAAA,UACf,WAAA,EAAa;AAAA,SACf;AAAA,MACF;AAEA,MAAA,MAAM,UAAA,GAAiC;AAAA,QACrC,UAAA,EAAY,KAAK,QAAA,CAAS,WAAA,CAAY,CAAC,CAAA,EAAG,WAAA,CAAY,CAAC,CAAC,CAAA;AAAA,QACxD,YAAA,EAAc,KAAK,QAAA,CAAS,WAAA,CAAY,CAAC,CAAA,EAAG,WAAA,CAAY,CAAC,CAAC,CAAA;AAAA,QAC1D,eAAe,MAAA,CAAO,MAAA,CAAO,WAAA,CAAY,CAAC,CAAC,CAAC,CAAA;AAAA,QAC5C,aAAA,EAAe,KAAK,QAAA,CAAS,WAAA,CAAY,CAAC,CAAA,EAAG,WAAA,CAAY,CAAC,CAAC,CAAA;AAAA,QAC3D,aAAa,MAAA,CAAO,MAAA,CAAO,WAAA,CAAY,CAAC,CAAC,CAAC;AAAA,OAC5C;AAEA,MAAA,OAAA,CAAQ,IAAI,gEAAA,EAAkE;AAAA,QAC5E,UAAA,EAAY,UAAA,CAAW,UAAA,CAAW,QAAA,EAAS;AAAA,QAC3C,YAAA,EAAc,UAAA,CAAW,YAAA,CAAa,QAAA,EAAS;AAAA,QAC/C,eAAe,UAAA,CAAW,aAAA;AAAA,QAC1B,aAAA,EAAe,UAAA,CAAW,aAAA,CAAc,QAAA,EAAS;AAAA,QACjD,aAAa,UAAA,CAAW;AAAA,OACzB,CAAA;AAED,MAAA,OAAO,UAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AAGpE,MAAA,MAAM,gBAAA,GAAmB;AAAA,QACvB,yBAAA;AAAA,QACA,qCAAA;AAAA,QACA,2BAAA;AAAA,QACA,qBAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,MAAM,UAAA,GAAa,iBAAiB,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,IAAA,CAAK,GAAA,CAAI,OAAO,CAAC,CAAA;AAEnE,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,OAAA,CAAQ,GAAA;AAAA,UACN,uFAAA;AAAA,UACA;AAAA,YACE,aAAA,EAAe,aAAA,EAAe,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,YAC7C,aAAA,EAAe,gBAAA,EAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,YAChD,KAAA,EAAO,KAAA,EAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA;AAC/B,SACF;AACA,QAAA,OAAO;AAAA,UACL,UAAA,EAAY,EAAA;AAAA,UACZ,YAAA,EAAc,EAAA;AAAA,UACd,aAAA,EAAe,CAAA;AAAA,UACf,aAAA,EAAe,EAAA;AAAA,UACf,WAAA,EAAa;AAAA,SACf;AAAA,MACF;AAEA,MAAA,OAAA,CAAQ,MAAM,wDAAA,EAA0D;AAAA,QACtE,OAAO,GAAA,CAAI,OAAA;AAAA,QACX,aAAA,EAAe,aAAA,EAAe,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC7C,aAAA,EAAe,gBAAA,EAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAChD,KAAA,EAAO,KAAA,EAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAC9B,CAAA;AACD,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,MAAM,oBAAA,CACJ,MAAA,EACA,WAAA,EACiB;AACjB,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,gBAAA,EAAkB,OAAM,GAAI,MAAA;AAKxD,IAAA,IAAI,OAAO,UAAA,IAAc,MAAA,CAAO,eAAe,OAAA,IAAW,MAAA,CAAO,eAAe,MAAA,EAAQ;AACtF,MAAA,MAAM,IAAIK,wBAAAA;AAAA,QACR,CAAA,0DAAA,EAA6D,OAAO,UAAU,CAAA,CAAA;AAAA,QAC9EC,qBAAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,IAAA,EAAK,CAAE,WAAW,CAAA,EAAG;AACvC,MAAA,MAAM,IAAID,wBAAAA;AAAA,QACR,uDAAuD,KAAK,CAAA,CAAA,CAAA;AAAA,QAC5DC,qBAAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,OAAA,CAAQ,IAAI,kEAAA,EAAoE;AAAA,QAC9E,eAAe,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,aAAA,EAAe,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,KAAA,EAAO,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAC7B,CAAA;AAGD,MAAA,MAAM,UAAA,GAAa,6BAAA,CAA8B,MAAA,CAAO,SAAA,EAAW,kBAAkB,KAAK,CAAA;AAU1F,MAAA,MAAM,MAAA,GAAS,MAAM,2BAAA,CAA4B;AAAA,QAC/C,MAAA,EAAQ;AAAA,UACN,UAAA;AAAA,UACA,MAAA;AAAA,UACA,KAAA,EAAO,CAAC,UAAU,CAAA;AAAA,UAClB,cAAA,EAAgB;AAAA,SAClB;AAAA,QACA,WAAA;AAAA,QACA,QAAQ,IAAA,CAAK;AAAA,OACd,CAAA;AAED,MAAA,OAAA,CAAQ,IAAI,8EAAA,EAAgF;AAAA,QAC1F,MAAA;AAAA,QACA,aAAA,EAAe,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAC/C,KAAA,EAAO,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAC7B,CAAA;AAED,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AACpE,MAAA,OAAA,CAAQ,MAAM,0EAAA,EAA4E;AAAA,QACxF,OAAO,GAAA,CAAI,OAAA;AAAA,QACX,eAAe,MAAA,CAAO,SAAA,EAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAChD,aAAA,EAAe,gBAAA,EAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AAAA,QAChD,KAAA,EAAO,KAAA,EAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI;AAAA,OAC9B,CAAA;AACD,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AACF;AGlrBO,IAAM,gBAAN,MAAoB;AAAA,EACzB,WAAA,CACU,QACA,YAAA,EACR;AAFQ,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA;AAAA,EACP;AAAA,EAEK,KAAK,UAAA,EAA4B;AACvC,IAAA,OAAO,CAAA,EAAGW,oBAAAA,CAAc,UAAU,CAAA,CAAA,EAAI,UAAU,CAAA,aAAA,CAAA;AAAA,EAClD;AAAA;AAAA,EAGQ,OAAO,WAAA,EAA8B;AAC3C,IAAA,MAAM,KAAA,GAAQ,eAAe,IAAA,CAAK,YAAA;AAClC,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OAGF;AAAA,IACF;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAM,IAAA,CAAK,OAAA,GAAiC,EAAC,EAAkC;AAC7E,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,eAAA,EAAiB,aAAY,GAAI,OAAA;AACtD,IAAA,MAAM,SAAiC,EAAC;AACxC,IAAA,IAAI,IAAA,KAAS,MAAA,EAAW,MAAA,CAAO,IAAA,GAAO,OAAO,IAAI,CAAA;AACjD,IAAA,IAAI,KAAA,KAAU,MAAA,EAAW,MAAA,CAAO,KAAA,GAAQ,OAAO,KAAK,CAAA;AACpD,IAAA,IAAI,oBAAoB,MAAA,EAAW;AACjC,MAAA,MAAA,CAAO,eAAA,GAAkB,OAAO,eAAe,CAAA;AAAA,IACjD;AAEA,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAA0B;AAAA,MACtD,UAAUA,oBAAAA,CAAc,UAAA;AAAA,MACxB,MAAA;AAAA,MACA,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,WAAW;AAAA,KACrC,CAAA;AAED,IAAA,OAAO,EAAE,GAAG,GAAA,EAAK,OAAO,GAAA,CAAI,KAAA,IAAS,EAAC,EAAE;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAA,CACJ,UAAA,EACA,OAAA,GAAoC,EAAC,EACZ;AACzB,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAoB;AAAA,MACrC,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,UAAU,IAAI,UAAU,CAAA,OAAA,CAAA;AAAA,MACnD,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,WAAW;AAAA,KAC7C,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,MAAM,SAAA,CACJ,UAAA,EACA,OAAA,GAAoC,EAAC,EACZ;AACzB,IAAA,MAAM,EAAE,aAAA,EAAe,eAAA,EAAiB,WAAA,EAAY,GAAI,OAAA;AACxD,IAAA,MAAM,OAAsC,EAAC;AAG7C,IAAA,IAAI,aAAA,KAAkB,MAAA,EAAW,IAAA,CAAK,aAAA,GAAgB,aAAA;AACtD,IAAA,IAAI,eAAA,KAAoB,MAAA,EAAW,IAAA,CAAK,eAAA,GAAkB,eAAA;AAE1D,IAAA,OAAO,IAAA,CAAK,OAAO,KAAA,CAAsB;AAAA,MACvC,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,UAAU,IAAI,UAAU,CAAA,OAAA,CAAA;AAAA,MACnD,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,WAAW,CAAA;AAAA,MACpC;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAY,MAAA,EAA8C;AACxD,IAAA,MAAM,EAAE,UAAA,EAAY,WAAA,EAAY,GAAI,MAAA;AACpC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,UAAU,CAAA;AAEjC,IAAA,OAAO;AAAA;AAAA;AAAA,MAGL,MAAM,YAAY;AAChB,QAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAAmC;AAAA,UAC/D,QAAA,EAAU,IAAA;AAAA,UACV,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,WAAW;AAAA,SAC5C,CAAA;AACD,QAAA,OAAO,EAAE,GAAG,GAAA,EAAK,OAAO,GAAA,CAAI,KAAA,IAAS,EAAC,EAAE;AAAA,MAC1C,CAAA;AAAA;AAAA;AAAA,MAIA,OAAA,EAAS,OAAO,IAAA,KAAsB;AACpC,QAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAuB;AAAA,UACxC,QAAA,EAAU,IAAA;AAAA;AAAA;AAAA,UAGV,WAAA,EAAa,EAAA;AAAA,UACb,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,WAAA;AAAY,SAC9B,CAAA;AAAA,MACH,CAAA;AAAA;AAAA,MAGA,IAAA,EAAM,OAAO,UAAA,EAAoB,IAAA,KAAsB;AACrD,QAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAc;AAAA,UAC/B,QAAA,EAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,UAAU,CAAA,KAAA,CAAA;AAAA,UAC/B,WAAA,EAAa,EAAA;AAAA,UACb,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,WAAA;AAAY,SAC9B,CAAA;AAAA,MACH,CAAA;AAAA;AAAA,MAGA,OAAA,EAAS,OAAO,UAAA,EAAoB,QAAA,KAAuB;AACzD,QAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAoB;AAAA,UACrC,QAAA,EAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,UAAU,CAAA,QAAA,CAAA;AAAA,UAC/B,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,WAAW,CAAA;AAAA,UAC3C,IAAA,EAAM,EAAE,QAAA;AAAS,SAClB,CAAA;AAAA,MACH,CAAA;AAAA;AAAA,MAGA,sBAAsB,YAAY;AAChC,QAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAuB;AAAA,UACxC,QAAA,EAAU,CAAA,EAAGA,oBAAAA,CAAc,UAAU,IAAI,UAAU,CAAA,mBAAA,CAAA;AAAA,UACnD,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,WAAW;AAAA,SAC5C,CAAA;AAAA,MACH;AAAA,KACF;AAAA,EACF;AACF;ACjVA,IAAM,yBAAA,GAA4B,GAAA;AAClC,IAAM,kBAAA,GAAqB,GAAA;AAG3B,SAAS,UAAU,cAAA,EAAkC;AACnD,EAAA,OACE,mBAAmB,MAAA,IACnB,cAAA,KAAmB,UAAA,IACnB,cAAA,KAAmB,aACnB,cAAA,KAAmB,eAAA;AAEvB;AAsBA,eAAsB,kBAAA,CACpB,eAAA,EACA,OAAA,GAAqC,EAAC,EACH;AACnC,EAAA,MAAM;AAAA,IACJ,UAAUjB,2BAAAA,CAAqB,KAAA;AAAA,IAC/B,eAAA,GAAkB,yBAAA;AAAA,IAClB,SAAA,GAAY;AAAA,GACd,GAAI,OAAA;AAEJ,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAG9B,EAAA,IAAI,SAAA;AAEJ,EAAA,WAAS;AACP,IAAA,IAAI;AAGF,MAAA,MAAM,UAAW,MAAMF,sBAAAA;AAAA,QACrB,CAAC,QAAA,KAAa,QAAA,CAAS,qBAAA,CAAsB,eAAe,CAAA;AAAA,QAC5D,EAAE,aAAa,OAAA;AAAQ,OACzB;AAQA,MAAA,IAAI,CAAC,SAAA,CAAU,OAAA,EAAS,eAAe,CAAA,EAAG;AACxC,QAAA,MAAM,QAAA,GAAW,QAAQ,gBAAA,KAAqB,UAAA;AAC9C,QAAA,OAAO;AAAA,UACL,eAAA;AAAA,UACA,SAAS,CAAC,QAAA;AAAA,UACV,iBAAiB,OAAA,CAAQ,gBAAA;AAAA,UACzB,gBAAgB,OAAA,CAAQ,eAAA;AAAA,UACxB,GAAI,WAAW,EAAE,YAAA,EAAc,QAAQ,aAAA,IAAiB,mBAAA,KAAwB,EAAC;AAAA,UACjF,MAAA,EAAQ,OAAA,CAAQ,MAAA,IAAU,EAAC;AAAA,UAC3B,GAAI,QAAQ,YAAA,KAAiB,KAAA,CAAA,GAAY,EAAE,WAAA,EAAa,OAAA,CAAQ,YAAA,EAAa,GAAI;AAAC,SACpF;AAAA,MACF;AAAA,IACF,SAAS,GAAA,EAAK;AAGZ,MAAA,SAAA,GAAY,GAAA;AAAA,IACd;AAEA,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,eAAA,IAAmB,QAAA,EAAU;AAC5C,MAAA,MAAM,SAAS,SAAA,YAAqB,KAAA,GAAQ,CAAA,EAAA,EAAK,SAAA,CAAU,OAAO,CAAA,CAAA,GAAK,EAAA;AACvE,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,gBAAA,EAAmB,SAAS,CAAA,eAAA,EAAkB,eAAe,GAAG,MAAM,CAAA,wEAAA;AAAA,OAExE;AAAA,IACF;AAEA,IAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,eAAe,CAAC,CAAA;AAAA,EACrE;AACF;AC5HA,IAAM,sBAAN,MAAiD;AAAA,EAAjD,WAAA,GAAA;AACE,IAAA,IAAA,CAAiB,IAAA,uBAAW,GAAA,EAAY;AAAA,EAAA;AAAA,EAExC,QAAQ,eAAA,EAAkC;AACxC,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,eAAe,GAAG,OAAO,KAAA;AAC3C,IAAA,IAAA,CAAK,IAAA,CAAK,IAAI,eAAe,CAAA;AAC7B,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAA;AAuCA,IAAM,iBAAA,GAAoB,MAAA,CAAOjC,aAAAA,CAAK,mBAAA,CAAoB,UAAU,CAAC,CAAA;AAErE,SAASkE,UAAS,KAAA,EAA+C;AAC/D,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,MAAA;AAChC,EAAA,IAAI;AACF,IAAA,OAAO,OAAO,KAAK,CAAA;AAAA,EACrB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAOA,SAAS,eACP,KAAA,EAC0D;AAC1D,EAAA,IAAIA,UAAS,KAAA,CAAM,IAAA,CAAK,CAAC,CAAC,CAAA,KAAM,mBAAmB,OAAO,MAAA;AAE1D,EAAA,MAAM,CAAC,MAAM,EAAA,EAAI,GAAA,EAAK,IAAI,CAAA,GACxB,KAAA,CAAM,KAAK,MAAA,IAAU,CAAA,GACjB,CAAC,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAG,KAAA,CAAM,KAAK,CAAC,CAAA,EAAG,MAAM,IAAA,CAAK,CAAC,GAAG,KAAA,CAAM,IAAA,CAAK,CAAC,CAAC,CAAA,GAC3D,CAAC,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAG,KAAA,CAAM,KAAK,CAAC,CAAA,EAAG,MAAM,IAAA,CAAK,CAAC,GAAG,KAAA,CAAM,IAAA,CAAK,CAAC,CAAC,CAAA;AAEjE,EAAA,MAAM,MAAA,GAAS,CAAC,IAAA,EAAM,EAAA,EAAI,KAAK,IAAI,CAAA,CAAE,IAAIA,SAAQ,CAAA;AACjD,EAAA,IAAI,OAAO,IAAA,CAAK,CAAC,MAAM,CAAA,KAAM,MAAS,GAAG,OAAO,MAAA;AAChD,EAAA,MAAM,CAAC,CAAA,EAAG,CAAA,EAAG,CAAA,EAAG,CAAC,CAAA,GAAI,MAAA;AACrB,EAAA,OAAO,EAAE,MAAM,CAAA,EAAG,EAAA,EAAI,GAAG,MAAA,EAAQ,CAAA,IAAK,KAAK,IAAA,CAAA,EAAM;AACnD;AAwCO,IAAM,oBAAN,MAAwB;AAAA,EAK7B,WAAA,CAAY,MAAA,GAAkC,EAAC,EAAG;AAChD,IAAA,MAAM,EAAE,WAAA,EAAa,UAAA,EAAY,GAAG,gBAAe,GAAI,MAAA;AACvD,IAAA,IAAA,CAAK,KAAA,GAAQ,WAAA,IAAe,IAAI,mBAAA,EAAoB;AACpD,IAAA,IAAA,CAAK,aAAa,UAAA,IAAc,kBAAA;AAChC,IAAA,IAAA,CAAK,cAAA,GAAiB,cAAA;AAAA,EACxB;AAAA,EAEA,MAAM,eAAe,MAAA,EAA6D;AAChF,IAAA,MAAM,EAAE,eAAA,EAAiB,KAAA,EAAO,IAAA,EAAM,EAAA,EAAI,WAAU,GAAI,MAAA;AACxD,IAAA,MAAM,UAAU,MAAM,IAAA,CAAK,UAAA,CAAW,eAAA,EAAiB,KAAK,cAAc,CAAA;AAE1E,IAAA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACpB,MAAA,OAAO,EAAE,OAAO,KAAA,EAAO,eAAA,EAAiB,QAAQ,UAAA,EAAY,MAAA,EAAQ,QAAQ,YAAA,EAAa;AAAA,IAC3F;AAEA,IAAA,MAAM,YAAA,GAAe,OAAO,KAAK,CAAA;AACjC,IAAA,MAAM,WAAA,GAAc,OAAO,IAAI,CAAA;AAC/B,IAAA,MAAM,SAAA,GAAY,OAAO,EAAE,CAAA;AAE3B,IAAA,IAAI,IAAA;AACJ,IAAA,KAAA,MAAW,KAAA,IAAS,QAAQ,MAAA,EAAQ;AAClC,MAAA,IAAIA,SAAAA,CAAS,KAAA,CAAM,YAAY,CAAA,KAAM,YAAA,EAAc;AACnD,MAAA,MAAM,QAAA,GAAW,eAAe,KAAK,CAAA;AACrC,MAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,SAAS,WAAA,IAAe,QAAA,CAAS,OAAO,SAAA,EAAW;AAC7E,MAAA,IAAI,SAAS,MAAA,IAAa,QAAA,CAAS,MAAA,GAAS,IAAA,SAAa,QAAA,CAAS,MAAA;AAAA,IACpE;AAEA,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,eAAA,EAAiB,QAAQ,oBAAA,EAAqB;AAAA,IACvE;AACA,IAAA,IAAI,OAAO,SAAA,EAAW;AACpB,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,eAAA;AAAA,QACA,MAAA,EAAQ,gBAAA;AAAA,QACR,MAAA,EAAQ,CAAA,KAAA,EAAQ,IAAI,CAAA,oBAAA,EAAuB,SAAS,CAAA;AAAA,OACtD;AAAA,IACF;AAGA,IAAA,MAAM,MAAM,IAAA,GAAO,MAAA,CAAO,eAAe,CAAA,CAAE,SAAS,EAAE,CAAA;AACtD,IAAA,IAAI,CAAE,MAAM,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAI;AACpC,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,eAAA,EAAiB,QAAQ,cAAA,EAAe;AAAA,IACjE;AAEA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,IAAA;AAAA,MACP,eAAA;AAAA,MACA,MAAA,EAAQ,IAAA;AAAA,MACR,GAAI,QAAQ,WAAA,KAAgB,MAAA,GAAY,EAAE,WAAA,EAAa,OAAA,CAAQ,WAAA,EAAY,GAAI;AAAC,KAClF;AAAA,EACF;AACF;;;AChLA,IAAM,OAAA,GAAU,KAAA;AAChB,IAAM,aAAA,uBAAoB,GAAA,CAAI,CAAC,QAAQ,QAAA,EAAU,UAAA,EAAY,MAAM,CAAC,CAAA;AAGpE,IAAM,iBAAA,GAAoB,CAAA;AAC1B,IAAM,mBAAA,GAAsB,GAAA;AAG5B,IAAM,OAAA,GAAU,CAAC,KAAA,KAAkB,IAAA,GAAO,MAAA,CAAO,KAAK,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,EAAA,EAAI,GAAG,CAAA;AAErF,SAAS,QAAA,CAAS,GAAW,CAAA,EAAoB;AAC/C,EAAA,IAAI;AACF,IAAA,OAAO,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAA;AAAA,EAC/B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAMA,SAAS,qBAAqB,GAAA,EAA8C;AAC1E,EAAA,IAAI,EAAE,GAAA,YAAetC,oBAAAA,CAAAA,IAAkB,GAAA,CAAI,MAAA,KAAW,KAAK,OAAO,MAAA;AAClE,EAAA,MAAM,UAAU,GAAA,CAAI,OAAA;AACpB,EAAA,OAAO,OAAA,EAAS,MAAM,OAAA,EAAS,IAAA;AAAA,IAC7B,CAAC,CAAA,KACC,CAAA,CAAE,MAAA,KAAW,OAAA,IACb,EAAE,OAAA,KAAY,kBAAA,IACd,CAAA,CAAE,KAAA,EAAO,kBAAkB,kBAAA,IAC3B,QAAA,CAAS,CAAA,CAAE,KAAA,EAAOuC,0BAAmB,YAAY;AAAA,GACrD;AACF;AAQA,SAAS,gBAAgB,MAAA,EAA6B;AACpD,EAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,KAAiB,IAAI,aAAY,CAAE,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA;AAC/D,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,IAAS,UAAA;AAC9B,EAAA,OACE,KAAA,CAAM,KAAK,SAAA,CAAU,MAAA,CAAO,WAAW,IAAA,EAAM,CAAC,CAAC,CAAA,IAC9C,MAAA,CAAO,OAAA,EAAS,kBAAkB,KAAA,CAAM,MAAA,CAAO,OAAO,OAAA,CAAQ,eAAe,CAAC,CAAA,GAAI,CAAA,CAAA,GACnF,CAAA,GAAI,KAAA,CAAM,KAAK,CAAA;AAEnB;AAEA,IAAM,KAAA,GAAQ,CAAC,EAAA,KAAe,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AASvE,SAAS,gBAAgB,QAAA,EAA8C;AAC5E,EAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,KAAa,UAAU,OAAO,KAAA;AACtD,EAAA,MAAM,CAAA,GAAI,QAAA;AACV,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,IAAY,CAAC,cAAc,GAAA,CAAI,CAAA,CAAE,MAAM,CAAA,EAAG,OAAO,KAAA;AACzE,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,EAAU,OAAO,KAAA;AACzC,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,MAAA,KAAc,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,CAAA,CAAE,MAAM,CAAA,CAAA;AACtF,IAAA,OAAO,KAAA;AACT,EAAA,IAAI,EAAE,UAAA,KAAe,MAAA,IAAa,OAAO,CAAA,CAAE,UAAA,KAAe,UAAU,OAAO,KAAA;AAC3E,EAAA,IAAI,EAAE,IAAA,KAAS,MAAA,IAAa,OAAO,CAAA,CAAE,IAAA,KAAS,UAAU,OAAO,KAAA;AAC/D,EAAA,IAAI,EAAE,EAAA,KAAO,MAAA,IAAa,OAAO,CAAA,CAAE,EAAA,KAAO,UAAU,OAAO,KAAA;AAC3D,EAAA,OAAO,IAAA;AACT;AAgCO,IAAM,UAAN,MAAc;AAAA,EACnB,WAAA,CACU,MAAA,EACA,YAAA,EAEA,QAAA,EACR;AAJQ,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA;AAEA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EACP;AAAA,EAEK,MAAA,GAAiB;AACvB,IAAA,MAAM,MAAM,IAAA,CAAK,YAAA;AACjB,IAAA,IAAI,CAAC,GAAA,IAAO,CAAC,GAAA,CAAI,UAAA,CAAW,KAAK,CAAA,EAAG;AAClC,MAAA,MAAM,IAAI3C,qBAAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAA,CAAQ,MAAA,GAA0B,EAAC,EAAuB;AAC9D,IAAA,MAAM,QAAgC,EAAC;AACvC,IAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ,KAAA,CAAM,SAAS,MAAA,CAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AAChE,IAAA,IAAI,MAAA,CAAO,KAAA,EAAO,KAAA,CAAM,KAAA,GAAQ,MAAA,CAAO,KAAA;AACvC,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAe;AAAA,MAChC,QAAA,EAAU,GAAG,OAAO,CAAA,QAAA,CAAA;AAAA,MACpB,MAAA,EAAQ,KAAA;AAAA,MACR,WAAA,EAAa,KAAK,MAAA;AAAO,KAC1B,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA+BA,MAAM,KAAA,CAAM,MAAA,EAAqB,OAAA,GAAwB,EAAC,EAA2B;AAGnF,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI,OAAA,CAAQ,cAAA,IAAkB,CAAC,OAAA,CAAQ,QAAA,EAAU;AAC/C,MAAA,IAAI;AACF,QAAA,KAAA,GAAQ,OAAA,CAAQ,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,SAAS,CAAA;AAAA,MACzD,CAAA,CAAA,MAAQ;AACN,QAAA,KAAA,GAAQ,MAAA;AAAA,MACV;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,MAAA,EAAQ,OAAA,CAAQ,UAAU,KAAK,CAAA;AAAA,IAC7D,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,cAAA,GAAiB,oBAAA,CAAqB,GAAG,CAAA,GAAI,MAAA;AACnE,MAAA,IAAI,CAAC,KAAA,IAAS,CAAC,OAAA,CAAQ,gBAAgB,MAAM,GAAA;AAC7C,MAAA,OAAO,IAAA,CAAK,WAAA,CAAY,MAAA,EAAQ,KAAA,EAAO,QAAQ,cAAc,CAAA;AAAA,IAC/D;AAAA,EACF;AAAA,EAEQ,SAAA,CACN,MAAA,EACA,QAAA,EACA,KAAA,EACwB;AACxB,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,GAAI,QAAA,GAAW,EAAE,WAAA,EAAa,QAAA,KAAa,EAAC;AAAA,MAC5C,GAAI,KAAA,GAAQ,EAAE,SAAA,EAAW,KAAA,KAAU;AAAC,KACtC;AACA,IAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAoB;AAAA,MACrC,QAAA,EAAU,GAAG,OAAO,CAAA,MAAA,CAAA;AAAA,MACpB,WAAA,EAAa,KAAK,MAAA,EAAO;AAAA,MACzB,IAAA,EAAM,MAAA;AAAA,MACN,GAAI,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,SAAS,CAAA,GAAI,EAAE,OAAA,EAAQ,GAAI;AAAC,KACtD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,WAAA,CACZ,MAAA,EACA,KAAA,EACA,GAAA,EACwB;AACxB,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAII,oBAAAA;AAAA,QACR,+CAAA;AAAA,QACA,qBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,SAAA;AACJ,IAAA,IAAI;AACF,MAAA,SAAA,GAAY,MAAA,CAAO,IAAI,SAAS,CAAA;AAAA,IAClC,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAIA,oBAAAA;AAAA,QACR,CAAA,kEAAA,EAAqE,MAAA,CAAO,GAAA,CAAI,SAAS,CAAC,CAAA,kBAAA,CAAA;AAAA,QAC1F,yBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,iBAAiB,CAAA;AAC7C,IAAA,IAAI,SAAS,SAAA,EAAW;AACtB,MAAA,MAAM,IAAIA,oBAAAA;AAAA,QACR,CAAA,gBAAA,EAAmB,MAAM,CAAA,sCAAA,EAAyC,GAAA,CAAI,SAAS,CAAA,mBAAA,CAAA;AAAA,QAC/E,sBAAA;AAAA,QACA,GAAA;AAAA,QACA,EAAE,IAAA,EAAM,EAAE,SAAS,CAAC,KAAK,GAAE;AAAE,OAC/B;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,MAAM,KAAA,EAAO,aAAA;AAC7B,IAAA,IAAI,MAAA,CAAO,KAAA,IAAS,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,IAAK,CAAC,OAAA,CAAQ,QAAA,CAAS,MAAA,CAAO,KAAK,CAAA,EAAG;AAC7E,MAAA,MAAM,IAAIA,oBAAAA;AAAA,QACR,SAAS,MAAA,CAAO,KAAK,uCAAuC,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,mBAAA,CAAA;AAAA,QAC9E,wBAAA;AAAA,QACA,GAAA;AAAA,QACA,EAAE,IAAA,EAAM,EAAE,SAAS,CAAC,KAAK,GAAE;AAAE,OAC/B;AAAA,IACF;AACA,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,EAAO,cAAA;AAC9B,IAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,eAAA,CAAgB,MAAM,IAAI,QAAA,EAAU;AACtE,MAAA,MAAM,IAAIA,oBAAAA;AAAA,QACR,6BAA6B,QAAQ,CAAA,wDAAA,CAAA;AAAA,QACrC,wBAAA;AAAA,QACA,GAAA;AAAA,QACA,EAAE,IAAA,EAAM,EAAE,SAAS,CAAC,KAAK,GAAE;AAAE,OAC/B;AAAA,IACF;AAMA,IAAA,MAAM,UAAA,GAAa,MAAM,KAAA,EAAO,KAAA;AAChC,IAAA,IACE,UAAA,EAAY,QAAA,KAAa,KAAA,IACzB,OAAO,UAAA,CAAW,OAAA,KAAY,QAAA,IAC9B,QAAA,CAAS,UAAA,CAAW,OAAA,EAAS,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA,EACjD;AACA,MAAA,MAAM,IAAIA,oBAAAA;AAAA,QACR,CAAA,OAAA,EAAU,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA,2JAAA,CAAA;AAAA,QAC9B,uBAAA;AAAA,QACA,GAAA;AAAA,QACA,EAAE,IAAA,EAAM,EAAE,SAAS,CAAC,KAAK,GAAE;AAAE,OAC/B;AAAA,IACF;AAGA,IAAA,MAAM,KAAA,GAAQ,IAAI,MAAA,CAAO,SAAA;AACzB,IAAA,MAAM,IAAA,GAAA,CAAQ,MAAM,IAAA,IAAQ,EAAA;AAC5B,IAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,QAAA,CAAS,6BAAA;AAAA,MAC1C;AAAA,QACE,YAAY,GAAA,CAAI,UAAA;AAAA,QAChB,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,SAAS,GAAA,CAAI,OAAA;AAAA,QACb,KAAA,EAAO;AAAA,UACL;AAAA,YACE,iBAAiB,KAAA,CAAM,KAAA;AAAA,YACvB,UAAA,EAAY,UAAA;AAAA,YACZ,QAAA,EAAU,CAAC,KAAA,CAAM,KAAA,EAAA,CAAQ,MAAA,GAAS,IAAA,EAAM,QAAA,EAAS,EAAA,CAAI,MAAA,IAAU,IAAA,EAAM,QAAA,EAAU;AAAA;AACjF;AACF,OACF;AAAA,MACA,KAAK,MAAA;AAAO,KACd;AACA,IAAA,MAAM,MAAA,GAAyB;AAAA,MAC7B,WAAA,EAAa,CAAA;AAAA,MACb,MAAA,EAAQ,OAAA;AAAA,MACR,OAAA,EAAS,kBAAA;AAAA,MACT,OAAA,EAAS;AAAA,QACP,WAAW,EAAE,CAAA,EAAG,QAAQ,eAAe,CAAA,EAAG,GAAG,SAAA,EAAU;AAAA,QACvD,WAAA,EAAa,QAAQ,KAAK,CAAA;AAAA,QAC1B,SAAA,EAAW,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA;AAAA,QAC9B,MAAA,EAAQ,OAAO,QAAA,EAAS;AAAA,QACxB,OAAO,KAAA,CAAM,KAAA;AAAA,QACb,UAAA,EAAY,KAAK,KAAA,CAAM,IAAA,CAAK,KAAI,GAAI,GAAI,IAAI,KAAA,CAAM,iBAAA;AAAA,QAClD,KAAA,EAAO,QAAQ,eAAe;AAAA;AAChC,KACF;AACA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAGtC,IAAA,MAAM,SAAA,GAAY,CAAC,OAAA,EAAiB,IAAA,EAAc,KAAA,GAAiC,EAAC,KAClF,IAAIA,oBAAAA,CAAc,OAAA,EAAS,IAAA,EAAM,GAAA,EAAK;AAAA,MACpC,IAAA,EAAM,EAAE,OAAA,EAAS,CAAC,KAAK,CAAA,EAAE;AAAA,MACzB,eAAA,EAAiB,eAAA;AAAA,MACjB,GAAG;AAAA,KACJ,CAAA;AACH,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,MAAM,kBAAA,CAAmB,eAAA,EAAiB,EAAE,SAAA,EAAW,MAAS,CAAA;AAAA,IAC5E,SAAS,GAAA,EAAK;AAEZ,MAAA,MAAM,SAAA;AAAA,QACJ,CAAA,oCAAA,EAAuC,eAAe,CAAA,EAAA,EAAK,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,QAC3G,sBAAA;AAAA,QACA,EAAE,QAAA;AAAS,OACb;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAO,MAAM,IAAI,iBAAA,CAAkB;AAAA,MACvC,WAAA,EAAa,EAAE,OAAA,EAAS,MAAM,IAAA,EAAK;AAAA,MACnC,YAAY,YAAY;AAAA,KACzB,EAAE,cAAA,CAAe;AAAA,MAChB,eAAA;AAAA,MACA,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,IAAA,EAAM,KAAA;AAAA,MACN,IAAI,KAAA,CAAM,KAAA;AAAA,MACV,SAAA,EAAW;AAAA,KACZ,CAAA;AACD,IAAA,IAAI,CAAC,KAAK,KAAA,EAAO;AACf,MAAA,MAAM,SAAA;AAAA,QACJ,CAAA,8BAAA,EAAiC,MAAM,CAAA,2BAAA,EAA8B,IAAA,CAAK,MAAM,CAAA,6DAAA,CAAA;AAAA,QAChF,qBAAA;AAAA,QACA,EAAE,MAAA,EAAQ,IAAA,CAAK,MAAA;AAAO,OACxB;AAAA,IACF;AAGA,IAAA,KAAA,IAAS,OAAA,GAAU,KAAK,OAAA,EAAA,EAAW;AACjC,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,MAAA,EAAQ,QAAQ,CAAA;AAAA,MAC9C,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,SAAA,GACJ,GAAA,YAAeA,oBAAAA,KACd,GAAA,CAAI,MAAA,KAAW,GAAA,IACb,GAAA,CAAI,MAAA,KAAW,GAAA,IAAQ,GAAA,CAAI,OAAA,EAAqC,SAAA,KAAc,IAAA,CAAA;AACnF,QAAA,IAAI,SAAA,IAAa,UAAU,iBAAA,EAAmB;AAC5C,UAAA,MAAM,MAAM,mBAAmB,CAAA;AAC/B,UAAA;AAAA,QACF;AACA,QAAA,IAAI,eAAeA,oBAAAA,EAAe;AAEhC,UAAA,MAAM,IAAIA,qBAAc,GAAA,CAAI,OAAA,EAAS,IAAI,IAAA,EAAM,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,YAChE,GAAI,OAAO,GAAA,CAAI,OAAA,KAAY,QAAA,IAAY,IAAI,OAAA,KAAY,IAAA,GAAO,GAAA,CAAI,OAAA,GAAU,EAAC;AAAA,YAC7E,eAAA,EAAiB,eAAA;AAAA,YACjB;AAAA,WACD,CAAA;AAAA,QACH;AACA,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,QAAQ,MAAA,EAAqD;AACjE,IAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAwB;AAAA,MACzC,QAAA,EAAU,GAAG,OAAO,CAAA,QAAA,CAAA;AAAA,MACpB,WAAA,EAAa,KAAK,MAAA,EAAO;AAAA,MACzB,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,KAAK,MAAA,EAA+C;AACxD,IAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAqB;AAAA,MACtC,QAAA,EAAU,GAAG,OAAO,CAAA,KAAA,CAAA;AAAA,MACpB,WAAA,EAAa,KAAK,MAAA,EAAO;AAAA,MACzB,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,MAAA,CAAO,MAAA,GAAyB,EAAC,EAAsB;AAC3D,IAAA,MAAM,QAAgC,EAAC;AACvC,IAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ,KAAA,CAAM,SAAS,MAAA,CAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AAChE,IAAA,IAAI,MAAA,CAAO,KAAA,EAAO,KAAA,CAAM,KAAA,GAAQ,MAAA,CAAO,KAAA;AACvC,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAc;AAAA,MAC/B,QAAA,EAAU,GAAG,OAAO,CAAA,OAAA,CAAA;AAAA,MACpB,MAAA,EAAQ,KAAA;AAAA,MACR,WAAA,EAAa,KAAK,MAAA;AAAO,KAC1B,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,GAAoC;AACxC,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAsB;AAAA,MACvC,QAAA,EAAU,GAAG,OAAO,CAAA,OAAA,CAAA;AAAA,MACpB,WAAA,EAAa,KAAK,MAAA;AAAO,KAC1B,CAAA;AAAA,EACH;AACF;ACtbO,IAAM,wBAAA,GAA2B;AAgBjC,SAAS,UAAU,KAAA,EAAyC;AACjE,EAAA,OAAOqB,YAAAA,CAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AAChC;AAGO,SAAS,yBAAyB,OAAA,EAAyB;AAChE,EAAA,OAAO,CAAA,EAAA,EAAK,MAAA,CAAO,OAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,EAAA,EAAI,GAAG,CAAC,CAAA,CAAA;AAC5D;AAEA,SAAS,mBAAmB,GAAA,EAAuB;AACjD,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,GAAG,SAAA,EAAW,IAAA,KAAS,MAAM,CAAA,EAAG,IAAA,KAAS,IAAI,OAAO,IAAA;AACxD,EAAA,OAAO,sBAAsB,IAAA,CAAK,CAAA,EAAG,OAAA,IAAW,MAAA,CAAO,GAAG,CAAC,CAAA;AAC7D;AAYA,eAAsB,wBAAA,CACpB,QAAA,EACA,cAAA,EACA,WAAA,EACA,SAAA,EACiC;AACjC,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,SAAA,CAAU,GAAA,CAAI,SAAS,CAAA;AACnC,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,YAAA,CAAa;AAAA,MACzC,eAAA,EAAiB,yBAAyB,cAAc,CAAA;AAAA,MACxD,UAAA,EAAY,oBAAA;AAAA,MACZ,QAAA,EAAU,CAAC,SAAA,CAAU,WAAW,CAAA,EAAG,UAAU,GAAA,CAAI,MAAM,CAAA,EAAG,GAAG,GAAG;AAAA,KACjE,CAAA;AACD,IAAA,MAAM,KAAA,GAAQ,SAAS,CAAC,CAAA;AACxB,IAAA,IAAI,UAAU,KAAA,CAAA,IAAa,MAAA,CAAO,KAAK,CAAA,KAAM,MAAA,CAAO,wBAAwB,CAAA,EAAG;AAC7E,MAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AAAA,IACvB;AACA,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,EACrD,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,kBAAA,CAAmB,GAAG,CAAA,EAAG,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,sBAAA,EAAuB;AAEnF,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ,mBAAA;AAAA,MACR,QAAQ,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACzD;AAAA,EACF;AACF;AAGO,IAAM,8BAAA,GAAiC;AAAA;AAAA,EAE5C,eAAA,EAAiB,oEAAA;AAAA;AAAA,EAEjB,WAAA,EAAa;AACf;AAiBA,SAAS,WAAA,CAAY,CAAA,EAAW,CAAA,EAAW,WAAA,EAAqB,SAAA,EAA4B;AAE1F,EAAA,MAAM,CAAA,GAAI,OAAO,SAAS,CAAA,CAAE,SAAS,EAAE,CAAA,CAAE,QAAA,CAAS,EAAA,EAAI,GAAG,CAAA;AACzD,EAAA,MAAM,GAAA,GAAM,IAAI3B,WAAAA,CAAG,UAAA,CAAW,SAAA,CAAU,OAAO,CAAC,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAC5D,EAAA,KAAA,MAAW,MAAA,IAAU,CAAC,IAAA,EAAM,IAAI,CAAA,EAAG;AACjC,IAAA,IAAI;AACF,MAAA,IAAIA,WAAAA,CAAG,UAAA,CAAW,MAAA,CAAO,GAAA,EAAK,SAAA,CAAU,WAAW,CAAA,EAAG,MAAA,GAAS,CAAC,CAAA,EAAG,OAAO,IAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAYO,SAAS,iCAAA,CACd,UAAA,EACA,WAAA,EACA,SAAA,EAC0B;AAC1B,EAAA,MAAM,SAAA,GAAY,wBAAA,CAAyB,UAAA,CAAW,UAAU,CAAA;AAChE,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,QAAA,CAAS,GAAA,CAAI,SAAS,CAAA;AAClD,EAAA,MAAM,GAAA,GAAM,SAAA,CAAU,GAAA,CAAI,SAAS,CAAA;AAEnC,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,CAAA;AACJ,EAAA,IAAI,CAAA;AACJ,EAAA,IAAI,SAAA,KAAc,+BAA+B,eAAA,EAAiB;AAEhE,IAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,IAAK,GAAA,CAAI,WAAW,CAAA,EAAG;AAC7C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,IACrD;AACA,IAAA,CAAC,SAAS,CAAA,GAAI,QAAA;AACd,IAAA,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,GAAA;AAAA,EACX,CAAA,MAAA,IAAW,SAAA,KAAc,8BAAA,CAA+B,WAAA,EAAa;AAInE,IAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,IAAK,MAAA,CAAO,SAAS,CAAC,CAAC,CAAA,KAAM,EAAA,IAAM,MAAA,CAAO,QAAA,CAAS,CAAC,CAAC,MAAM,EAAA,EAAI;AACrF,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,2BAAA,EAA4B;AAAA,IAC7D;AACA,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,CAAA,IAAK,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA,KAAM,EAAA,IAAM,MAAA,CAAO,GAAA,CAAI,CAAC,CAAC,MAAM,EAAA,EAAI;AACtE,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,IACrD;AACA,IAAA,IAAI,MAAA,CAAO,IAAI,CAAC,CAAC,MAAM,MAAA,CAAO,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG;AAC1C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,IACrD;AACA,IAAA,SAAA,GAAY,SAAS,CAAC,CAAA;AACtB,IAAA,OAAO,CAAA,EAAG,CAAC,CAAA,GAAI,GAAA;AAAA,EACjB,CAAA,MAAO;AACL,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,2BAAA,EAA4B;AAAA,EAC7D;AAEA,EAAA,MAAM,WAAWtB,aAAAA,CAAK,gCAAA;AAAA,IACpB,SAAA,CAAU,WAAW,IAAI,CAAA;AAAA,IACzB,SAAA;AAAA,IACA,QAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,yBAAyB,QAAQ,CAAA,KAAM,wBAAA,CAAyB,UAAA,CAAW,OAAO,CAAA,EAAG;AACvF,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,kBAAA,EAAmB;AAAA,EACpD;AAEA,EAAA,OAAO,WAAA,CAAY,CAAA,EAAG,CAAA,EAAG,WAAA,EAAa,SAAS,CAAA,GAC3C,EAAE,KAAA,EAAO,IAAA,EAAK,GACd,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,mBAAA,EAAoB;AAClD;;;AC1JA,IAAMoE,kBAAAA,GAAoB,MAAA,CAAOpE,aAAAA,CAAK,mBAAA,CAAoB,UAAU,CAAC,CAAA;AASrE,SAAS,mBAAA,CACP,YACA,OAAA,EAC8C;AAC9C,EAAA,IAAI;AACF,IAAA,MAAM,QAAQ,UAAA,CAAW,GAAA,CAAI,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AAC7C,IAAA,MAAM,OAAO,aAAA,EAAe,QAAQ,CAAA,GAAI,KAAA;AACxC,IAAA,IAAI,aAAa,EAAA,EAAI,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,2CAAA,EAA4C;AAC7F,IAAA,MAAM,CAAC,EAAA,EAAI,QAAA,EAAU,GAAA,EAAK,SAAA,EAAW,GAAA,EAAK,IAAI,CAAA,GAAI,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACnE,IAAA,IAAI,EAAA,KAAO,OAAO,OAAA,CAAQ,KAAK,KAAK,QAAA,KAAaoE,kBAAAA,IAAqB,QAAQ,EAAA,EAAI;AAChF,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,0DAAA,EAA2D;AAAA,IACzF;AACA,IAAA,IAAI,SAAA,KAAc,MAAA,CAAO,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC3C,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,yCAAA,EAA0C;AAAA,IACxE;AACA,IAAA,IAAI,OAAO,IAAA,IAAQ,IAAA,CAAA,KAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACnD,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,sDAAA,EAAuD;AAAA,IACrF;AACA,IAAA,IAAI,aAAA,IAAiB,OAAO,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAC,CAAA,EAAG;AAC1D,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,uDAAA,EAAwD;AAAA,IACtF;AACA,IAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,EACpB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,2BAAA,EAA4B;AAAA,EAC1D;AACF;AAGA,IAAM,qBAAN,MAA+C;AAAA,EAA/C,WAAA,GAAA;AACE,IAAA,IAAA,CAAiB,IAAA,uBAAW,GAAA,EAAY;AAAA,EAAA;AAAA,EAExC,IAAI,KAAA,EAAwB;AAC1B,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA;AAAA,EAC5B;AAAA,EAEA,QAAQ,KAAA,EAAwB;AAC9B,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,KAAK,GAAG,OAAO,KAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAK,CAAA;AACnB,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAA;AAwBO,IAAM,eAAA,GAAN,MAAM,gBAAA,CAAgB;AAAA,EAM3B,WAAA,CAAY,MAAA,EAAqB,WAAA,EAAqB,MAAA,EAAgC;AACpF,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,UAAA,GAAa,MAAA,EAAQ,UAAA,IAAc,IAAI,kBAAA,EAAmB;AAC/D,IAAA,IAAA,CAAK,WAAW,MAAA,EAAQ,QAAA;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,OAAO,OAAO,OAAA,EAAwD;AACpE,IAAA,MAAM,SAAS,IAAI,WAAA,CAAY,EAAE,YAAA,EAAc,OAAA,CAAQ,QAAQ,CAAA;AAC/D,IAAA,OAAO,IAAI,gBAAA,CAAgB,MAAA,EAAQ,OAAA,CAAQ,WAAA,EAAa;AAAA,MACtD,YAAY,OAAA,CAAQ,UAAA;AAAA,MACpB,UAAU,OAAA,CAAQ;AAAA,KACnB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,OAAO,OAAA,EAAkD;AAC7D,IAAA,MAAM,EAAE,SAAQ,GAAI,OAAA;AAGpB,IAAA,IAAI,OAAA,CAAQ,gBAAgB,CAAA,EAAG;AAC7B,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,eAAe,CAAA,0BAAA,EAA6B,OAAA,CAAQ,WAAW,CAAA,CAAA,EAAG;AAAA,IAC7F;AAGA,IAAA,IAAI,OAAA,CAAQ,YAAY,kBAAA,EAAoB;AAC1C,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,eAAe,CAAA,qBAAA,EAAwB,OAAA,CAAQ,OAAO,CAAA,CAAA,EAAG;AAAA,IACpF;AAGA,IAAA,IAAI,MAAM,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC5C,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,aAAA,EAAe,6BAAA,EAA8B;AAAA,IACxE;AAGA,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,IAAI,OAAA,CAAQ,cAAc,GAAA,EAAK;AAC7B,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,aAAA,EAAe,8CAAA,EAA+C;AAAA,IACzF;AAGA,IAAA,MAAM,kBAAkB,OAAA,CAAQ,KAAA,CAAM,aAAY,CAAE,OAAA,CAAQ,SAAS,IAAI,CAAA;AACzE,IAAA,MAAM,iBAAiBD,yBAAAA,CAAmB,YAAA,CAAa,aAAY,CAAE,OAAA,CAAQ,SAAS,IAAI,CAAA;AAC1F,IAAA,IAAI,oBAAoB,cAAA,EAAgB;AACtC,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,KAAA;AAAA,QACT,aAAA,EAAe,CAAA,mBAAA,EAAsB,OAAA,CAAQ,KAAK,CAAA,wBAAA;AAAA,OACpD;AAAA,IACF;AAGA,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,IAChC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,aAAA,EAAe,+BAAA,EAAgC;AAAA,IAC1E;AACA,IAAA,IAAI,UAAU,EAAA,EAAI;AAChB,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,aAAA,EAAe,iCAAA,EAAkC;AAAA,IAC5E;AAGA,IAAA,IAAI,CAAC,OAAA,CAAQ,WAAA,IAAe,CAAC,QAAQ,SAAA,EAAW;AAC9C,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,aAAA,EAAe,kCAAA,EAAmC;AAAA,IAC7E;AAGA,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,eAAA,CAAgB,OAAO,CAAA;AACpD,IAAA,IAAI,CAAC,UAAU,KAAA,EAAO;AACpB,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,aAAA,EAAe,UAAU,MAAA,EAAO;AAAA,IAC3D;AAEA,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,gBACZ,OAAA,EAC8C;AAW9C,IAAA,IAAI,OAAA,CAAQ,SAAS,IAAA,EAAM;AACzB,MAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,UAAA;AACxC,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA,IAAK,UAAA,CAAW,WAAW,CAAA,EAAG;AACzD,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,yBAAA,EAA0B;AAAA,MAC3D;AAIA,MAAA,MAAM,KAAA,GAAQ,mBAAA,CAAoB,UAAA,EAAY,OAAA,CAAQ,OAAO,CAAA;AAC7D,MAAA,IAAI,CAAC,MAAM,EAAA,EAAI,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAO;AAC3D,MAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AAAA,IACvB;AAEA,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAElB,MAAA,IAAI,CAAC,QAAQ,OAAA,EAAS,SAAA,EAAW,KAAK,CAAC,OAAA,CAAQ,OAAA,EAAS,SAAA,EAAW,CAAA,EAAG;AACpE,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,MACrD;AACA,MAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AAAA,IACvB;AAEA,IAAA,MAAM,UAAU,OAAA,CAAQ,OAAA;AAExB,IAAA,IAAI,CAAC,OAAA,EAAS,SAAA,EAAW,KAAK,CAAC,OAAA,EAAS,WAAW,CAAA,EAAG;AACpD,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,IACrD;AAGA,IAAA,MAAM,mBAAmBE,uBAAA,CAAmB;AAAA,MAC1C,cAAc,OAAA,CAAQ,WAAA;AAAA,MACtB,YAAY,OAAA,CAAQ,SAAA;AAAA,MACpB,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,WAAA,EAAa,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA;AAAA,MACtC,OAAO,OAAA,CAAQ;AAAA,KAChB,CAAA;AAGD,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAUC,kBAAA,CAAkB,cAAA,CAAe,gBAAA,EAAkB,OAAA,CAAQ,WAAW,CAAA;AAAA,IAClF,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,CAAA,mBAAA,EAAsB,OAAO,CAAA,CAAA,EAAG;AAAA,IACjE;AAGA,IAAA,MAAM,QAAQ,MAAM,wBAAA,CAAyB,KAAK,QAAA,EAAU,OAAA,CAAQ,aAAa,OAAA,EAAS;AAAA,MACxF,QAAQ,SAAA,CAAU,CAAA;AAAA,MAClB,QAAQ,SAAA,CAAU;AAAA,KACnB,CAAA;AACD,IAAA,IAAI,KAAA,CAAM,KAAA,EAAO,OAAO,EAAE,OAAO,IAAA,EAAK;AACtC,IAAA,IAAI,KAAA,CAAM,WAAW,sBAAA,EAAwB;AAC3C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,+BAAA,EAAgC;AAAA,IACjE;AACA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,QAAQ,KAAA,CAAM,MAAA,GACV,CAAA,+BAAA,EAAkC,KAAA,CAAM,MAAM,CAAA,CAAA,GAC9C;AAAA,KACN;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,OAAO,OAAA,EAAkD;AAC7D,IAAA,MAAM,EAAE,SAAQ,GAAI,OAAA;AAGpB,IAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA;AAC9C,IAAA,IAAI,CAAC,aAAa,OAAA,EAAS;AACzB,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,WAAA,EAAa,aAAa,aAAA,EAAc;AAAA,IACnE;AAGA,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,UAAA,CAAW,OAAA,CAAQ,QAAQ,KAAK,CAAA;AAC5D,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,WAAA,EAAa,4CAAA,EAA6C;AAAA,IACrF;AAEA,IAAA,IAAI;AAaF,MAAA,IAAI,QAAQ,IAAA,EAAM;AAChB,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAmC;AAAA,UACtE,QAAA,EAAU,qCAAA;AAAA,UACV,aAAa,IAAA,CAAK,WAAA;AAAA,UAClB,IAAA,EAAM;AAAA,YACJ,gBAAgB,OAAA,CAAQ,WAAA;AAAA,YACxB,QAAA,EAAU,QAAQ,IAAA,CAAK,UAAA;AAAA,YACvB,UAAA,EAAY,QAAQ,IAAA,CAAK;AAAA;AAC3B,SACD,CAAA;AAED,QAAA,IAAI,OAAO,YAAY,eAAA,KAAoB,QAAA,IAAY,CAAC,UAAA,CAAW,eAAA,CAAgB,MAAK,EAAG;AACzF,UAAA,OAAO;AAAA,YACL,OAAA,EAAS,KAAA;AAAA,YACT,WAAA,EACG,YAAoB,OAAA,IAAW;AAAA,WACpC;AAAA,QACF;AAEA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS,IAAA;AAAA,UACT,iBAAiB,UAAA,CAAW,eAAA;AAAA,UAC5B,SAAA,EAAW;AAAA,SACb;AAAA,MACF;AAIA,MAAA,MAAM,aAAaC,gBAAA,CAAQ,WAAA,CAAY,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAC,CAAA;AAC7D,MAAA,MAAM,YAAA,GAAe;AAAA,QACnB,iBAAiB,OAAA,CAAQ,KAAA;AAAA,QACzB,UAAA,EAAY,UAAA;AAAA,QACZ,QAAA,EAAU,CAAC,OAAA,CAAQ,SAAA,EAAW,UAAA,CAAW,GAAA,CAAI,QAAA,EAAS,EAAG,UAAA,CAAW,IAAA,CAAK,QAAA,EAAU;AAAA,OACrF;AAGA,MAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAA+B;AAAA,QACvE,QAAA,EAAU,kCAAA;AAAA,QACV,aAAa,IAAA,CAAK,WAAA;AAAA,QAClB,IAAA,EAAM;AAAA,UACJ,WAAW,OAAA,CAAQ,WAAA;AAAA,UACnB,KAAA,EAAO,CAAC,YAAY;AAAA;AACtB,OACD,CAAA;AAGD,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAA0C;AAAA,QACzE,QAAA,EAAU,6CAAA;AAAA,QACV,aAAa,IAAA,CAAK,WAAA;AAAA,QAClB,IAAA,EAAM;AAAA,UACJ,WAAW,OAAA,CAAQ,WAAA;AAAA,UACnB,WAAW,eAAA,CAAgB,SAAA;AAAA,UAC3B,eAAe,OAAA,CAAQ,SAAA;AAAA,UACvB,YAAY,eAAA,CAAgB,UAAA;AAAA,UAC5B,cAAA,EAAgB;AAAA;AAClB,OACD,CAAA;AAED,MAAA,IAAI,OAAO,QAAQ,eAAA,KAAoB,QAAA,IAAY,CAAC,MAAA,CAAO,eAAA,CAAgB,MAAK,EAAG;AACjF,QAAA,OAAO;AAAA,UACL,OAAA,EAAS,KAAA;AAAA,UACT,WAAA,EAAc,QAAgB,OAAA,IAAW;AAAA,SAC3C;AAAA,MACF;AAEA,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,IAAA;AAAA,QACT,iBAAiB,MAAA,CAAO,eAAA;AAAA,QACxB,SAAA,EAAW;AAAA,OACb;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,UAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACrE,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,KAAA;AAAA,QACT,WAAA,EAAa,sBAAsB,OAAO,CAAA;AAAA,OAC5C;AAAA,IACF;AAAA,EACF;AACF;;;ACxYAlD,gBAAAA,EAAAA;AAiBO,IAAM,gBAAgB,OAAO;AAAA,EAClC;AACF,CAAA,KAEoC;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,SAAA,EAAAW,YAAU,GAAI,MAAA;AAE1C,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAAA,IACjE;AAEA,IAAA,IAAI,CAAC,MAAA,IAAU,CAAC,OAAO,mBAAA,IAAuB,CAAC,OAAO,SAAA,EAAW;AAC/D,MAAA,MAAM,IAAI,MAAM,2DAA2D,CAAA;AAAA,IAC7E;AAEA,IAAA,IAAI,CAACA,UAAAA,EAAW;AACd,MAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,IACrD;AAEA,IAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,OAAA;AAExC,IAAA,IACE,CAAC,MAAA,CAAO,SAAA,CAAU,cAAA,CAAe,KAAKG,2BAAAA,EAAsB,UAAU,CAAA,IACtE,CAAC,OAAO,SAAA,CAAU,cAAA,CAAe,IAAA,CAAKJ,0BAAAA,EAAqB,UAAU,CAAA,EACrE;AACA,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,MAAA,CAAO,UAAU,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,IACpE;AAEA,IAAA,MAAM,MAAA,GAASI,4BAAqB,UAAU,CAAA;AAG9C,IAAA,IAAI,mBAAA;AACJ,IAAA,IAAI;AACF,MAAA,mBAAA,GAAsBhB,yBAAA,CAAkB,MAAA,CAAO,mBAAA,EAAqB,UAAU,CAAA;AAAA,IAChF,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,MAAM,kEAAkE,CAAA;AAAA,IACpF;AAEA,IAAA,MAAM,WAAW,IAAIkB,oBAAAA,CAAY,EAAE,OAAA,EAAS,QAAQ,CAAA;AAEpD,IAAA,MAAM,OAAA,GAAU,IAAIC,gBAAAA,CAAQ;AAAA,MAC1B,QAAA;AAAA,MACA,SAAS,MAAA,CAAO,SAAA;AAAA,MAChB,MAAA,EAAQ;AAAA,KACT,CAAA;AAGD,IAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,WAAA,CAAYN,UAAS,CAAA;AAGrD,IAAA,MAAM,aAAA,GAAgB,mBAAmB,SAAS,CAAA;AAElD,IAAA,OAAO,aAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,4BAA4B,KAAK,CAAA;AAC/C,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAIA,SAASwC,WAAU,CAAA,EAAmB;AACpC,EAAA,OAAO,OAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,IAAI,GAAG,CAAA;AAC/C;AAgBO,IAAM,qBAAqB,OAAO;AAAA,EACvC;AACF,CAAA,KAEyB;AACvB,EAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,SAAA,EAAAxC,YAAU,GAAI,MAAA;AAE1C,EAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAChF,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,OAAO,mBAAA,IAAuB,CAAC,OAAO,SAAA,EAAW;AAC/D,IAAA,MAAM,IAAI,MAAM,2DAA2D,CAAA;AAAA,EAC7E;AACA,EAAA,IAAI,CAACA,UAAAA,EAAW,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAEnE,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,OAAA;AACxC,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,eAAe,IAAA,CAAKG,2BAAAA,EAAsB,UAAU,CAAA,EAAG;AAC3E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,MAAA,CAAO,UAAU,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,EACpE;AAEA,EAAA,IAAI,mBAAA;AACJ,EAAA,IAAI;AACF,IAAA,mBAAA,GAAsBhB,yBAAA,CAAkB,MAAA,CAAO,mBAAA,EAAqB,UAAU,CAAA;AAAA,EAChF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,kEAAkE,CAAA;AAAA,EACpF;AAIA,EAAA,MAAM,cAAc,MAAA,CAAOsD,kBAAA,CAAc,eAAezC,UAAAA,EAAW,MAAA,CAAO,SAAS,CAAC,CAAA;AAEpF,EAAA,IAAI,eAAe,MAAA,EAAQ;AAKzB,IAAA,MAAM,EAAE,kBAAA,EAAA0C,mBAAAA,EAAmB,GAAI,MAAM,OAAA,CAAA,OAAA,EAAA,CAAA,IAAA,CAAA,OAAA,UAAA,EAAA,EAAA,aAAA,CAAA,CAAA;AACrC,IAAA,MAAM,WAAWA,mBAAAA,CAAmB;AAAA,MAClC,UAAA,EAAY,mBAAA;AAAA,MACZ,WAAA;AAAA,MACA,UAAA,EAAY;AAAA,KACb,CAAA;AACD,IAAA,OAAO,QAAA,CAAS,IAAIF,UAAS,CAAA;AAAA,EAC/B;AAGA,EAAA,MAAM,QAAA,GAAW,IAAInC,oBAAAA,CAAY,EAAE,SAASF,2BAAAA,CAAqB,UAAU,GAAG,CAAA;AAC9E,EAAA,MAAM,OAAA,GAAU,IAAIG,gBAAAA,CAAQ,EAAE,QAAA,EAAU,SAAS,MAAA,CAAO,SAAA,EAAW,MAAA,EAAQ,mBAAA,EAAqB,CAAA;AAChG,EAAA,MAAM,EAAE,GAAG,CAAA,EAAE,GAAI,mBAAmB,MAAM,OAAA,CAAQ,WAAA,CAAYN,UAAS,CAAC,CAAA;AACxE,EAAA,OAAO,CAAC,GAAG,CAAC,CAAA;AACd;;;AC/HA,OAAA,EAAA;AAEA,0BAAA,EAAA;AAKA,UAAA,EAAA;;;ACRA,2BAAA,EAAA;AACA,OAAA,EAAA;AC8CO,IAAM,UAAA,GAAa,MAAA,CAAO/B,oBAAAA,CAAY,iBAAA,CAAkB,OAAO,CAAC;AAGhE,IAAM,aAAA,GAAgB,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,UAAU,CAAC;AAGtE,IAAM,YAAA,GAAe,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,WAAW,CAAC;AACtE,IAAM,eAAA,GAAkB,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,cAAc,CAAC;AAC5E,IAAM,eAAA,GAAkB,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,cAAc,CAAC;AAC5E,IAAM,gBAAA,GAAmB,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,eAAe,CAAC;AAE9E,IAAM,qBAAA,GAAwB,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,cAAc,CAAC;AAOlF,IAAM,gBAAA,GAAmB;AAAA,EAC9B,SAAA,EAAW,MAAA;AAAA;AAAA,EACX,YAAA,EAAc,KAAA;AAAA;AAAA,EACd,YAAA,EAAc,KAAA;AAAA;AAAA,EACd,aAAA,EAAe,MAAA;AAAA;AAAA,EACf,YAAA,EAAc,MAAA;AAAA;AAAA,EACd,eAAA,EAAiB,KAAA;AAAA;AAAA,EACjB,YAAA,EAAc,KAAA;AAAA;AAAA,EACd,eAAA,EAAiB,KAAA;AAAA;AAAA,EACjB,QAAA,EAAU;AAAA;AACZ;AAeO,IAAM,yBAAA,GAA4B;AAoCzC,SAAS0E,MAAAA,CAAM,CAAA,EAA6B,KAAA,GAAQ,MAAA,EAAgB;AAClE,EAAA,MAAM,IAAI,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,OAAO,CAAC,CAAA;AAC9C,EAAA,IAAI,IAAI,EAAA,EAAI;AACV,IAAA,MAAM,IAAI,WAAW,CAAA,EAAG,KAAK,qCAAqC,CAAA,CAAE,QAAA,EAAU,CAAA,CAAE,CAAA;AAAA,EAClF;AACA,EAAA,OAAO,CAAA;AACT;AAEA,SAAS,kBAAkB,KAAA,EAAgC;AACzD,EAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,+CAAA,EAAkD,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA;AAAA,EACvF;AACA,EAAA,MAAM,QAAA,GAAWA,OAAM,MAAA,CAAO1E,oBAAAA,CAAY,kBAAkB,KAAA,CAAM,IAAI,CAAC,CAAA,EAAG,MAAM,CAAA;AAChF,EAAA,MAAM,QAAA,GAAW,KAAA,CAAM,IAAA,KAAS,OAAA,GAAU,UAAA,GAAa,aAAA;AACvD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,CAAC,CAAA,EAAG,CAAA,KAAM0E,MAAAA,CAAM,CAAA,EAAG,CAAA,YAAA,EAAe,CAAC,CAAA,CAAA,CAAG,CAAC,CAAA;AAE5E,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,IACpB,GAAG,MAAA;AAAA,IACH,QAAA;AAAA,IACA,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,IACnBA,MAAAA,CAAM,OAAO1E,oBAAAA,CAAY,iBAAA,CAAkB,MAAM,KAAK,CAAC,GAAG,OAAO;AAAA,GACnE;AACF;AAEA,SAAS,KAAA,CAAM,aAAA,EAAgC,UAAA,EAAoB,QAAA,EAA0B;AAG3F,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AACxC,IAAA,IAAI,QAAA,CAAS,CAAC,CAAA,GAAI,EAAA,EAAI;AACpB,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,YAAY,CAAC,CAAA,mCAAA,EAAsC,SAAS,CAAC,CAAA,CAAE,UAAU,CAAA;AAAA,OAC3E;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,eAAA,EACE,OAAO,aAAA,KAAkB,QAAA,GAAW,OAAO,aAAA,CAAc,QAAA,CAAS,EAAE,CAAA,GAAI,aAAA;AAAA,IAC1E,UAAA;AAAA,IACA,QAAA,EAAU,SAAS,GAAA,CAAI,CAAC,MAAM,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC;AAAA,GACrD;AACF;AAaO,SAAS,yBAAyB,IAAA,EAIhC;AACP,EAAA,MAAM,QAAA,GAAqB,CAAC,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAG,GAAG,iBAAA,CAAkB,IAAA,CAAK,QAAQ,CAAC,CAAA;AACtF,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,mBAAA,EAAqB,QAAQ,CAAA;AAChE;AAQO,SAAS,yBAAyB,IAAA,EAIhC;AACP,EAAA,MAAM,QAAA,GAAqB,CAAC0E,MAAAA,CAAM,IAAA,CAAK,IAAI,GAAG,GAAG,iBAAA,CAAkB,IAAA,CAAK,QAAQ,CAAC,CAAA;AACjF,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,mBAAA,EAAqB,QAAQ,CAAA;AAChE;AAEO,SAAS,4BAA4B,IAAA,EAInC;AACP,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,sBAAA,EAAwB;AAAA,IACvD,MAAA,CAAO,KAAK,QAAQ,CAAA;AAAA,IACpB,MAAA,CAAO,KAAK,OAAO;AAAA,GACpB,CAAA;AACH;AAEO,SAAS,4BAA4B,IAAA,EAInC;AACP,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,sBAAA,EAAwB;AAAA,IACvDA,MAAAA,CAAM,KAAK,IAAI,CAAA;AAAA,IACf,MAAA,CAAO,KAAK,OAAO;AAAA,GACpB,CAAA;AACH;AAEO,SAAS,4BAA4B,IAAA,EAKnC;AACP,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,sBAAA,EAAwB;AAAA,IACvD,MAAA,CAAO,KAAK,QAAQ,CAAA;AAAA,IACpB,MAAA,CAAO,KAAK,OAAO,CAAA;AAAA,IACnB,MAAA,CAAO,IAAA,CAAK,cAAA,CAAe,MAAM,CAAA;AAAA,IACjC,GAAG,IAAA,CAAK;AAAA,GACT,CAAA;AACH;AAEO,SAAS,4BAA4B,IAAA,EAKnC;AACP,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,sBAAA,EAAwB;AAAA,IACvDA,MAAAA,CAAM,KAAK,IAAI,CAAA;AAAA,IACf,MAAA,CAAO,KAAK,OAAO,CAAA;AAAA,IACnB,MAAA,CAAO,IAAA,CAAK,cAAA,CAAe,MAAM,CAAA;AAAA,IACjC,GAAG,IAAA,CAAK;AAAA,GACT,CAAA;AACH;AAEO,SAAS,6BAA6B,IAAA,EAIpC;AACP,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,uBAAA,EAAyB;AAAA,IACxD,MAAA,CAAO,KAAK,QAAQ,CAAA;AAAA,IACpB,MAAA,CAAO,KAAK,YAAY;AAAA,GACzB,CAAA;AACH;AAEO,SAAS,6BAA6B,IAAA,EAIpC;AACP,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,uBAAA,EAAyB;AAAA,IACxDA,MAAAA,CAAM,KAAK,IAAI,CAAA;AAAA,IACf,MAAA,CAAO,KAAK,YAAY;AAAA,GACzB,CAAA;AACH;AAMO,SAAS,yBAAyB,IAAA,EAGhC;AACP,EAAA,OAAO,KAAA,CAAM,KAAK,aAAA,EAAe,mBAAA,EAAqB,CAACA,MAAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAC,CAAA;AAC1E;AAMA,SAAS,kBAAA,CAAmB,MAAsB,SAAA,EAAqC;AACrF,EAAA,MAAM,CAAA,GAAI,SAAA,IAAaxB,iCAAAA,CAA2B,IAAI,CAAA;AACtD,EAAA,IAAI,CAAC,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,uCAAA,EAA0C,IAAI,CAAA,EAAA,CAAI,CAAA;AAC1E,EAAA,OAAOwB,MAAAA,CAAM,GAAG,WAAW,CAAA;AAC7B;AAcO,SAAS,iCAAiC,IAAA,EAMxC;AACP,EAAA,MAAM,WAAW,MAAA,CAAO1E,oBAAAA,CAAY,iBAAA,CAAkB,IAAA,CAAK,IAAI,CAAC,CAAA;AAChE,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,4BAAA,EAA8B;AAAA,IAC7D,MAAA,CAAO,KAAK,QAAQ,CAAA;AAAA,IACpB,QAAA;AAAA,IACA,kBAAA,CAAmB,IAAA,CAAK,IAAA,EAAM,IAAA,CAAK,SAAS;AAAA,GAC7C,CAAA;AACH;AAGO,SAAS,iCAAiC,IAAA,EAKxC;AACP,EAAA,MAAM,WAAW,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,IAAA,CAAK,IAAI,CAAC,CAAA;AAChE,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,4BAAA,EAA8B;AAAA,IAC7D0E,MAAAA,CAAM,KAAK,IAAI,CAAA;AAAA,IACf,QAAA;AAAA,IACA,kBAAA,CAAmB,IAAA,CAAK,IAAA,EAAM,IAAA,CAAK,SAAS;AAAA,GAC7C,CAAA;AACH;AAoBO,SAAS,0BAA0B,IAAA,EAKjC;AACP,EAAA,MAAM,QAAA,GAAqB,CAAC,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAG,GAAG,iBAAA,CAAkB,IAAA,CAAK,QAAQ,CAAC,CAAA;AACtF,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe,mBAAA,EAAqB,QAAQ,CAAA;AAChE;AAQO,SAAS,wBAAwB,IAAA,EAG/B;AACP,EAAA,OAAO,KAAA,CAAM,KAAK,aAAA,EAAe,iBAAA,EAAmB,CAAC,MAAA,CAAO,IAAA,CAAK,OAAO,CAAC,CAAC,CAAA;AAC5E;AAmBO,SAAS,0BAA0B,IAAA,EAGjC;AACP,EAAA,OAAO,MAAM,IAAA,CAAK,aAAA,EAAe,qBAAqB,iBAAA,CAAkB,IAAA,CAAK,QAAQ,CAAC,CAAA;AACxF;AAYO,IAAM,cAAA,GAAiB;AAAA,EAC5B,cAAA,EAAgB3E,aAAAA,CAAK,mBAAA,CAAoB,gBAAgB,CAAA;AAAA,EACzD,oBAAA,EAAsBA,aAAAA,CAAK,mBAAA,CAAoB,sBAAsB,CAAA;AAAA,EACrE,SAAA,EAAWA,aAAAA,CAAK,mBAAA,CAAoB,WAAW;AACjD;AAQA,SAAS,gBAAA,CAAiB,OAAwB,KAAA,EAAuB;AACvE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA;AACtC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,EAAG,KAAK,CAAA,iCAAA,EAAoC,KAAK,CAAA,CAAE,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA;AACjC;AASO,SAAS,gBAAA,CAAiB,gBAAiC,OAAA,EAA0B;AAC1F,EAAA,OAAO,iBAAiB,OAAA,EAAS,SAAS,CAAA,IAAK,gBAAA,CAAiB,gBAAgB,gBAAgB,CAAA;AAClG;AAQO,SAAS,sBAAA,CAAuB,gBAAiC,OAAA,EAAyB;AAC/F,EAAA,MAAM,YACJ,gBAAA,CAAiB,cAAA,EAAgB,gBAAgB,CAAA,GAAI,gBAAA,CAAiB,SAAS,SAAS,CAAA;AAC1F,EAAA,OAAO,SAAA,IAAa,EAAA,GAAK,CAAA,GAAI,MAAA,CAAO,SAAS,CAAA;AAC/C;AAsCA,SAAS,aAAa,KAAA,EAAgC;AACpD,EAAA,MAAM,CAAA,GAAI,OAAO,KAAK,CAAA;AACtB,EAAA,OAAO,CAAA,KAAM,KAAK,EAAA,GAAKC,oBAAAA,CAAY,kBAAkBgD,YAAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AACnE;AAEA,SAAS,MACP,QAAA,EACA,aAAA,EACA,UAAA,EACA,QAAA,GAA4C,EAAC,EAC1B;AACnB,EAAA,OAAO,SAAS,YAAA,CAAa;AAAA,IAC3B,iBAAiB,OAAO,aAAA,KAAkB,WAAWA,YAAAA,CAAI,KAAA,CAAM,aAAa,CAAA,GAAI,aAAA;AAAA,IAChF,UAAA;AAAA,IACA,QAAA,EAAU,QAAA,CAAS,GAAA,CAAI,CAAC,CAAA,KAAMA,aAAI,KAAA,CAAM,MAAA,CAAO,CAAC,CAAC,CAAC;AAAA,GACnD,CAAA;AACH;AAGA,eAAsB,cAAA,CACpB,UACA,aAAA,EAC4B;AAC5B,EAAA,MAAM,CAAC,SAAS,CAAA,GAAI,MAAM,KAAA,CAAM,QAAA,EAAU,eAAe,aAAa,CAAA;AACtE,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,SAAS,CAAC,CAAA;AACtC,EAAA,MAAM,SAA4B,EAAC;AACnC,EAAA,KAAA,IAAS,EAAA,GAAK,CAAA,EAAG,EAAA,GAAK,KAAA,EAAO,EAAA,EAAA,EAAM;AACjC,IAAA,MAAA,CAAO,IAAA,CAAK,qBAAA,CAAsB,EAAA,EAAI,MAAM,KAAA,CAAM,QAAA,EAAU,aAAA,EAAe,WAAA,EAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAAA,EAChG;AACA,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,qBAAA,CAAsB,SAAiB,KAAA,EAAkC;AACvF,EAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAA,CAAM,MAAM,CAAA,iCAAA,CAAmC,CAAA;AAAA,EACvF;AACA,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,IAAA,EAAM,YAAA,CAAa,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,IAC3B,UAAA,EAAY,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,IAC3B,IAAA,EAAM,YAAA,CAAa,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,IAC3B,QAAQ,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAC,CAAA;AAAA,IAC/B,SAAS,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAC,CAAA;AAAA,IAChC,KAAA,EAAO,YAAA,CAAa,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,IAC5B,OAAA,EAAS,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAA,KAAM;AAAA,GAChC;AACF;AAGA,eAAsB,iBAAA,CACpB,QAAA,EACA,aAAA,EACA,IAAA,EACiB;AACjB,EAAA,MAAM,CAAC,CAAC,CAAA,GAAI,MAAM,KAAA,CAAM,QAAA,EAAU,eAAe,oBAAA,EAAsB;AAAA,IACrE,MAAA,CAAOhD,oBAAAA,CAAY,iBAAA,CAAkB,IAAI,CAAC;AAAA,GAC3C,CAAA;AACD,EAAA,OAAO,MAAA,CAAO,KAAK,CAAC,CAAA;AACtB;AAGA,eAAsB,mBAAA,CACpB,UACA,aAAA,EAC8B;AAC9B,EAAA,MAAM,CAAA,GAAI,MAAM,KAAA,CAAM,QAAA,EAAU,eAAe,sBAAsB,CAAA;AACrE,EAAA,OAAO;AAAA,IACL,aAAa,MAAA,CAAO,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAC,CAAA;AAAA,IAChC,YAAY,MAAA,CAAO,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAC,CAAA;AAAA,IAC/B,YAAA,EAAc,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA;AAAA,IACzB,QAAA,EAAU,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA,KAAM;AAAA,GAC7B;AACF;AAEA,IAAM,eAAA,GAAkB,MAAA,CAAOD,aAAAA,CAAK,mBAAA,CAAoB,YAAY,CAAC,CAAA;AAO9D,SAAS,qBAAA,CACd,QACA,aAAA,EACkB;AAClB,EAAA,MAAM,MAAA,GAAS,aAAA,KAAkB,MAAA,GAAY,MAAA,GAAY,OAAO,aAAa,CAAA;AAC7E,EAAA,OAAO,MAAA,CACJ,MAAA;AAAA,IACC,CAAC,MACC,CAAA,CAAE,IAAA,CAAK,UAAU,CAAA,IACjB,MAAA,CAAO,EAAE,IAAA,CAAK,CAAC,CAAC,CAAA,KAAM,eAAA,KACrB,WAAW,MAAA,IACT,CAAA,CAAE,iBAAiB,MAAA,IAAa,MAAA,CAAO,CAAA,CAAE,YAAY,CAAA,KAAM,MAAA;AAAA,GAClE,CACC,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,IACX,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,IACtB,MAAA,EAAQ,YAAA,CAAa,CAAA,CAAE,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,IAC9B,UAAU,MAAA,CAAO,MAAA,CAAO,EAAE,IAAA,CAAK,CAAC,CAAC,CAAC,CAAA;AAAA,IAClC,OAAA,EAAS,MAAA,CAAO,CAAA,CAAE,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,IACzB,YAAY,MAAA,CAAO,MAAA,CAAO,EAAE,IAAA,CAAK,CAAC,CAAC,CAAC,CAAA;AAAA,IACpC,WAAW,MAAA,CAAO,MAAA,CAAO,EAAE,IAAA,CAAK,CAAC,CAAC,CAAC;AAAA,GACrC,CAAE,CAAA;AACN;;;AD7kBO,IAAM,qBAAA,GAAwB;AAErC,IAAM4E,oBAAAA,GAAsB,MAAA,CAAO3E,oBAAAA,CAAY,iBAAA,CAAkB,OAAO,CAAC,CAAA;AACzE,IAAM,cAAA,GAAiB,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,WAAW,CAAC,CAAA;AAGxE,SAAS,cAAc,OAAA,EAAkC;AACvD,EAAA,IAAI,OAAO,YAAY,QAAA,IAAY,CAAC,QAAQ,UAAA,CAAW,IAAI,GAAG,OAAO,OAAA;AACrE,EAAA,OAAOA,oBAAAA,CAAY,iBAAA,CAAkB,SAAA,CAAU,OAAO,CAAC,CAAA;AACzD;AAEA,SAAS,KAAK,KAAA,EAAyC;AACrD,EAAA,OAAO,OAAO,KAAK,CAAA;AACrB;AAOO,SAAS,6BAA6B,MAAA,EAO/B;AACZ,EAAA,OAAO;AAAA,IACL,KAAA,EAAO;AAAA,MACL,cAAA,EAAgB;AAAA,QACd,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,aAAA,EAAc;AAAA,QACpC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,aAAA,EAAc;AAAA,QACvC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,aAAA,EAAc;AAAA,QACvC,EAAE,IAAA,EAAM,UAAA,EAAY,IAAA,EAAM,aAAA;AAAc,OAC1C;AAAA,MACA,QAAA,EAAU;AAAA,QACR,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,iBAAA,EAAkB;AAAA,QAC1C,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,MAAA;AAAO;AAC/B,KACF;AAAA,IACA,WAAA,EAAa,UAAA;AAAA,IACb,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,MAAA;AAAA,MACN,OAAA,EAAS,GAAA;AAAA,MACT,OAAA,EAAS,aAAA,CAAc,MAAA,CAAO,OAAA,IAAW,SAAS,CAAA;AAAA,MAClD,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,OAAA,EAAS;AAAA,MACP,MAAA,EAAQ,wBAAA,CAAyB,MAAA,CAAO,aAAa,CAAA;AAAA,MACrD,IAAA,EAAM,SAAA,CAAU,MAAA,CAAO,WAAW;AAAA;AACpC,GACF;AACF;AAGO,SAAS,wBAAwB,MAAA,EAM7B;AACT,EAAA,MAAM,EAAA,GAAK,6BAA6B,MAAM,CAAA;AAC9C,EAAA,OAAO,MAAA,CAAOwE,mBAAc,cAAA,CAAe,EAAA,EAAI,yBAAyB,MAAA,CAAO,aAAa,CAAC,CAAC,CAAA;AAChG;AAGO,SAAS,sBAAA,CACd,aACA,aAAA,EACU;AACV,EAAA,MAAM,GAAA,GAAM,KAAK,WAAW,CAAA;AAC5B,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,wBAAA,CAAyB,aAAa,CAAC,CAAA;AAC9D,EAAA,IAAI,GAAA,KAAQ,EAAA,IAAM,OAAA,KAAY,EAAA,EAAI;AAChC,IAAA,MAAM,IAAI,MAAM,2EAA2E,CAAA;AAAA,EAC7F;AACA,EAAA,OAAO,CAAC,KAAK,OAAO,CAAA;AACtB;AAGO,SAAS,0BAAA,CACd,aACA,aAAA,EACQ;AACR,EAAA,OAAO,eAAA;AAAA,IACL,MAAA,CAAOxE,oBAAAA,CAAY,iBAAA,CAAkB,qBAAqB,CAAC,CAAA;AAAA,IAC3D,sBAAA,CAAuB,aAAa,aAAa;AAAA,GACnD;AACF;AAmBO,SAAS,6BACd,SAAA,EAC+B;AAC/B,EAAA,MAAM,MAAM,SAAA,CAAU,GAAA,CAAI,CAAC,CAAA,KAAM,IAAA,CAAK,CAAC,CAAC,CAAA;AACxC,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,CAAA,EAAG,OAAO,EAAE,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,EAAG,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,EAAE;AACpD,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,CAAA,IAAK,GAAA,CAAI,CAAC,MAAM,EAAA,IAAM,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,EAAI;AACtD,IAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,CAAI,CAAC,CAAA,EAAG,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,EAAG,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,EAAE;AAAA,EAChD;AACA,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,CAAA,IAAK,GAAA,CAAI,CAAC,MAAM,cAAA,IAAkB,GAAA,CAAI,CAAC,CAAA,KAAM2E,oBAAAA,EAAqB;AACnF,IAAA,OAAO,EAAE,WAAA,EAAa,GAAA,CAAI,CAAC,CAAA,EAAG,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,EAAG,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,EAAE;AAAA,EACrD;AACA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA,uBAAA,EAA0B,IAAI,MAAM,CAAA,8HAAA;AAAA,GAEtC;AACF;AAEA,SAAS,YAAA,CAAa,CAAA,EAAW,CAAA,EAAW,OAAA,EAAiB,OAAA,EAA0B;AACrF,EAAA,MAAM,IAAI,OAAA,CAAQ,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,IAAI,GAAG,CAAA;AAC/C,EAAA,MAAM,MAAM,IAAItD,WAAAA,CAAG,UAAA,CAAW,SAAA,CAAU,GAAG,CAAC,CAAA;AAC5C,EAAA,KAAA,MAAW,MAAA,IAAU,CAAC,IAAA,EAAM,IAAI,CAAA,EAAG;AACjC,IAAA,IAAI;AACF,MAAA,IAAIA,WAAAA,CAAG,UAAA,CAAW,MAAA,CAAO,GAAA,EAAK,SAAA,CAAU,OAAO,CAAA,EAAG,MAAA,GAAS,CAAC,CAAA,EAAG,OAAO,IAAA;AAAA,IACxE,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAGO,SAAS,0BAA0B,MAAA,EAO9B;AACV,EAAA,MAAM,EAAE,CAAA,EAAG,CAAA,EAAE,GAAI,4BAAA,CAA6B,OAAO,SAAS,CAAA;AAC9D,EAAA,MAAM,CAAA,GAAI,wBAAwB,MAAM,CAAA;AACxC,EAAA,OAAO,aAAa,CAAA,EAAG,CAAA,EAAG,GAAG,IAAA,CAAK,MAAA,CAAO,WAAW,CAAC,CAAA;AACvD;AAMO,SAAS,yBAAyB,MAAA,EAI5B;AACX,EAAA,IAAI,MAAA,CAAO,UAAA,GAAa,EAAA,IAAM,MAAA,CAAO,cAAc,YAAA,EAAc;AAC/D,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,qCAAA,EAAwC,OAAO,UAAU,CAAA,kFAAA;AAAA,KAE3D;AAAA,EACF;AACA,EAAA,MAAM,EAAE,CAAA,EAAG,CAAA,EAAE,GAAI,4BAAA,CAA6B,OAAO,SAAS,CAAA;AAC9D,EAAA,OAAO,oBAAA,CAAqB;AAAA,IAC1B,SAAS,MAAA,CAAO,UAAA;AAAA,IAChB,OAAA,EAAS,qBAAA;AAAA,IACT,OAAA,EAAS,CAAC,CAAA,EAAG,CAAC;AAAA,GACf,CAAA;AACH;AAGA,SAAS,gBAAA,CAAiB,CAAA,EAAW,CAAA,EAAW,OAAA,EAA2B;AACzE,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,KAAA,MAAW,GAAA,IAAO,CAAC,CAAA,EAAG,CAAC,CAAA,EAAG;AACxB,IAAA,IAAI;AACF,MAAA,MAAM,QAAQ,IAAIA,WAAAA,CAAG,WAAW,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA,CAC3C,cAAA,CAAe,GAAG,CAAA,CAClB,gBAAA,CAAiB,QAAQ,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,EAAA,EAAI,GAAG,CAAC,CAAA;AAC1D,MAAA,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,QAAA,EAAS,CAAE,CAAC,CAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAEA,eAAe,QACb,QAAA,EACA,eAAA,EACA,UAAA,EACA,QAAA,GAAqB,EAAC,EACI;AAC1B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,QAAA,CAAS,YAAA,CAAa,EAAE,eAAA,EAAiB,UAAA,EAAY,UAAU,CAAA;AAAA,EAC9E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAaA,eAAsB,yBAAyB,MAAA,EAQa;AAC1D,EAAA,MAAM,MAAA,GAAS,wBAAA,CAAyB,MAAA,CAAO,aAAa,CAAA;AAC5D,EAAA,MAAM,MAAA,GAAS,4BAAA,CAA6B,MAAA,CAAO,SAAS,CAAA;AAC5D,EAAA,MAAM,YAAA,GAAe,wBAAwB,MAAM,CAAA;AACnD,EAAA,MAAM,aAAuB,EAAC;AAE9B,EAAA,IAAI,OAAO,MAAA,KAAW,MAAA,EAAW,UAAA,CAAW,IAAA,CAAK,OAAO,MAAM,CAAA;AAE9D,EAAA,IAAI,MAAA,CAAO,gBAAgB,MAAA,EAAW;AAGpC,IAAA,MAAM,QAAQ,MAAM,OAAA,CAAQ,MAAA,CAAO,QAAA,EAAU,QAAQ,WAAA,EAAa;AAAA,MAChE,SAAA,CAAU,OAAO,WAAW;AAAA,KAC7B,CAAA;AACD,IAAA,MAAM,MAAA,GAAS,SAAS,KAAA,CAAM,MAAA,IAAU,IAAI,qBAAA,CAAsB,CAAA,EAAG,KAAK,CAAA,GAAI,IAAA;AAC9E,IAAA,IAAI,MAAA,IAAU,CAAC,MAAA,CAAO,OAAA,IAAW,OAAO,IAAA,KAAS,OAAA,IAAW,MAAA,CAAO,IAAA,KAAS,OAAA,EAAS;AACnF,MAAA,KAAA,MAAWuD,QAAO,gBAAA,CAAiB,MAAA,CAAO,GAAG,MAAA,CAAO,CAAA,EAAG,YAAY,CAAA,EAAG;AACpE,QAAA,IAAI,eAAA,CAAgBD,oBAAAA,EAAqB,CAACC,IAAG,CAAC,MAAM,MAAA,CAAO,UAAA,EAAY,UAAA,CAAW,IAAA,CAAKA,IAAG,CAAA;AAAA,MAC5F;AAAA,IACF;AACA,IAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,kDAAA,EAAqD,MAAA,CAAO,WAAW,CAAA,IAAA,EAAO,MAAM,CAAA,4DAAA;AAAA,OAEtF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,OAAO,cAAA,IAAkB,wBAAA,CAAyB,OAAO,cAAA,CAAe,OAAO,MAAM,MAAA,EAAQ;AAC/F,IAAA,MAAM,GAAA,GAAM,wBAAA,CAAyB,MAAA,CAAO,cAAA,CAAe,UAAU,CAAA;AACrE,IAAA,MAAM,EAAA,GAAK,OAAO,cAAA,CAAe,QAAA;AACjC,IAAA,IAAI,GAAA,KAAQ,8BAAA,CAA+B,eAAA,IAAmB,EAAA,CAAG,WAAW,CAAA,EAAG;AAC7E,MAAA,UAAA,CAAW,IAAA,CAAK,IAAA,CAAK,EAAA,CAAG,CAAC,CAAC,CAAC,CAAA;AAAA,IAC7B;AACA,IAAA,IAAI,GAAA,KAAQ,8BAAA,CAA+B,WAAA,IAAe,EAAA,CAAG,WAAW,CAAA,EAAG;AACzE,MAAA,UAAA,CAAW,IAAA,CAAK,IAAA,CAAK,EAAA,CAAG,CAAC,CAAC,CAAC,CAAA;AAAA,IAC7B;AAAA,EACF;AAEA,EAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,IAAA,MAAM,KAAK,MAAM,OAAA,CAAQ,MAAA,CAAO,QAAA,EAAU,QAAQ,gBAAgB,CAAA;AAClE,IAAA,IAAI,EAAA,IAAM,EAAA,CAAG,MAAA,IAAU,CAAA,EAAG,UAAA,CAAW,KAAK,IAAA,CAAK,EAAA,CAAG,CAAC,CAAC,CAAC,CAAA;AAAA,EACvD;AAEA,EAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAE3B,IAAA,MAAM,UAAU,MAAM,OAAA,CAAQ,MAAA,CAAO,QAAA,EAAU,QAAQ,aAAa,CAAA;AACpE,IAAA,IAAI,OAAA,IAAW,OAAA,CAAQ,MAAA,IAAU,CAAA,EAAG;AAClC,MAAA,MAAM,WAAW,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,CAAC,CAAC,CAAC,CAAA;AAC1C,MAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,KAAA,CAAM,CAAA,GAAI,QAAQ,CAAA;AACvC,MAAA,MAAM,SAAA,GAAY,KAAK,KAAA,CAAM,CAAC,MAAM,MAAA,CAAO,CAAC,MAAM,EAAE,CAAA;AACpD,MAAA,IAAI,QAAA,KAAa,KAAK,SAAA,EAAW,UAAA,CAAW,KAAK,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAC,CAAC,CAAA;AAAA,IACnE;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,IAAA,CAAK,CAAC,CAAA,KAAM,YAAA,CAAa,MAAA,CAAO,CAAA,EAAG,MAAA,CAAO,CAAA,EAAG,YAAA,EAAc,CAAC,CAAC,CAAA;AACpF,EAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,WAAA,EAAa,GAAA,EAAK,aAAa,sBAAA,CAAuB,GAAA,EAAK,MAAM,CAAA,EAAE;AAC9E;;;AD/QO,SAAS,8BAA8B,MAAA,EAOX;AACjC,EAAA,MAAM,aAAA,GAAgB,wBAAA,CAAyB,MAAA,CAAO,aAAa,CAAA;AACnE,EAAA,MAAM,mBAAmB,qBAAA,CAAsB;AAAA,IAC7C,KAAA,EAAO,MAAA,CAAO,KAAA,IAAS,UAAA,EAAW;AAAA,IAClC,OAAO,MAAA,CAAO,KAAA;AAAA,IACd,MAAA,EAAQ7D;AAAA,GACT,CAAA;AACD,EAAA,MAAM,UAAU,kBAAA,CAAmB,EAAE,QAAA,EAAU,MAAA,CAAO,SAAS,CAAA;AAC/D,EAAA,MAAM,WAAA,GAAc,aAAA,CAAc,gBAAA,EAAkB,aAAA,EAAe,OAAO,CAAA;AAC1E,EAAA,MAAMgB,aAAY,4BAAA,CAA6B,EAAE,aAAA,EAAe,WAAA,EAAa,SAAS,CAAA;AACtF,EAAA,OAAO,EAAE,aAAA,EAAe,gBAAA,EAAkB,WAAA,EAAa,SAAA,EAAAA,YAAW,OAAA,EAAQ;AAC5E;AAOA,eAAsB,6BAA6B,MAAA,EAgB/B;AAClB,EAAA,MAAM,EAAE,UAAS,GAAI,MAAA;AACrB,EAAA,IACE,MAAA,CAAO,MAAA,IACP,CAAC,yBAAA,CAA0B;AAAA,IACzB,eAAe,QAAA,CAAS,aAAA;AAAA,IACxB,aAAa,QAAA,CAAS,WAAA;AAAA,IACtB,aAAA,EAAe,OAAO,MAAA,CAAO,OAAA;AAAA,IAC7B,WAAA,EAAa,OAAO,MAAA,CAAO,WAAA;AAAA,IAC3B,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,SAAS,QAAA,CAAS;AAAA,GACnB,CAAA,EACD;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,WAAW,wBAAA,CAAyB;AAAA,IACxC,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,UAAA,EAAY,MAAA,CAAO,MAAA,CAAO,UAAU;AAAA,GACrC,CAAA;AACD,EAAA,MAAM,WAAW,qCAAA,CAAsC;AAAA,IACrD,kBAAkB,QAAA,CAAS,gBAAA;AAAA,IAC3B,SAAA,EAAW;AAAA,GACZ,CAAA;AAED,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAmC;AAAA,IACtE,QAAA,EAAU,qCAAA;AAAA,IACV,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,IAAA,EAAM;AAAA,MACJ,gBAAgB,QAAA,CAAS,aAAA;AAAA,MACzB,QAAA;AAAA,MACA,GAAI,OAAO,cAAA,GAAiB,EAAE,gBAAgB,MAAA,CAAO,cAAA,KAAmB;AAAC;AAC3E,GACD,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,eAAA,EAAiB;AAC9B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,QAAA,CAAS,eAAA;AAClB;AAGA,eAAsB,8BAA8B,MAAA,EAWhC;AAClB,EAAA,MAAM,QAAA,GAAW,8BAA8B,MAAM,CAAA;AACrD,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,aAAA,CAAc,SAAS,SAAS,CAAA;AAC/D,EAAA,OAAO,6BAA6B,EAAE,GAAG,MAAA,EAAQ,QAAA,EAAU,WAAW,CAAA;AACxE;AASA,eAAsB,wBAAwB,MAAA,EAU1B;AAClB,EAAA,MAAM,aAAA,GAAgB,wBAAA,CAAyB,MAAA,CAAO,aAAa,CAAA;AACnE,EAAA,MAAM,mBAAmB,qBAAA,CAAsB;AAAA,IAC7C,KAAA,EAAO,MAAA,CAAO,KAAA,IAAS,UAAA,EAAW;AAAA,IAClC,OAAO,MAAA,CAAO,KAAA;AAAA,IACd,MAAA,EAAQhB;AAAA,GACT,CAAA;AACD,EAAA,MAAM,UAAU,kBAAA,CAAmB,EAAE,QAAA,EAAU,MAAA,CAAO,SAAS,CAAA;AAC/D,EAAA,MAAM,WAAA,GAAc,aAAA,CAAc,gBAAA,EAAkB,aAAA,EAAe,OAAO,CAAA;AAC1E,EAAA,MAAM,YAAY,kBAAA,CAAmB;AAAA,IACnC,YAAY,MAAA,CAAO,UAAA;AAAA,IACnB,WAAA;AAAA,IACA,UAAA,EAAY,MAAA,CAAO,MAAA,CAAO,UAAU;AAAA,GACrC,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,qCAAA,CAAsC,EAAE,gBAAA,EAAkB,WAAW,CAAA;AACtF,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAmC;AAAA,IACtE,QAAA,EAAU,qCAAA;AAAA,IACV,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,IAAA,EAAM;AAAA,MACJ,cAAA,EAAgB,aAAA;AAAA,MAChB,QAAA;AAAA,MACA,UAAA,EAAY,OAAA;AAAA,MACZ,GAAI,OAAO,cAAA,GAAiB,EAAE,gBAAgB,MAAA,CAAO,cAAA,KAAmB;AAAC;AAC3E,GACD,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,eAAA,EAAiB;AAC9B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,QAAA,CAAS,eAAA;AAClB;;;AGpJO,IAAM,WAAN,MAAe;AAAA,EAepB,YAAY,MAAA,EAAwB;AAClC,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,WAAA,CAAY,MAAM,CAAA;AACpC,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA,CAAO,OAAA,IAAWS,wBAAAA,CAAkB,OAAA;AACnD,IAAA,IAAA,CAAK,eAAe,MAAA,CAAO,YAAA;AAG3B,IAAA,IAAA,CAAK,OAAA,GAAU,IAAI,YAAA,CAAa,IAAA,CAAK,MAAM,CAAA;AAC3C,IAAA,IAAA,CAAK,YAAA,GAAe,IAAI,iBAAA,CAAkB,IAAA,CAAK,MAAM,CAAA;AACrD,IAAA,IAAA,CAAK,YAAA,GAAe,IAAI,iBAAA,CAAkB,IAAA,CAAK,MAAM,CAAA;AACrD,IAAA,IAAA,CAAK,IAAA,GAAO,IAAI,SAAA,CAAU,IAAA,CAAK,MAAM,CAAA;AACrC,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,aAAA,CAAc,IAAA,CAAK,MAAM,CAAA;AAC7C,IAAA,IAAA,CAAK,SAAA,GAAY,IAAI,cAAA,CAAe,IAAA,CAAK,MAAM,CAAA;AAC/C,IAAA,IAAA,CAAK,WAAW,IAAI,aAAA,CAAc,IAAA,CAAK,MAAA,EAAQ,OAAO,YAAY,CAAA;AAClE,IAAA,IAAA,CAAK,EAAA,GAAK,IAAI,OAAA,CAAQ,IAAA,CAAK,QAAQ,MAAA,CAAO,YAAA,EAAc,KAAK,QAAQ,CAAA;AAGrE,IAAA,IAAA,CAAK,kBAAA,GAAqB,IAAA,CAAK,kBAAA,CAAmB,IAAA,CAAK,IAAI,CAAA;AAC3D,IAAA,IAAA,CAAK,6BAAA,GAAgC,IAAA,CAAK,6BAAA,CAA8B,IAAA,CAAK,IAAI,CAAA;AACjF,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA;AACvC,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA;AAGrC,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA,CAAK,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAA;AACrD,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA,CAAK,YAAA,CAAa,IAAA,CAAK,IAAI,CAAA;AAC/C,IAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA,CAAK,qBAAA,CAAsB,IAAA,CAAK,IAAI,CAAA;AACjE,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,WAAA,CAAY,IAAA,CAAK,IAAI,CAAA;AAC7C,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA,CAAK,YAAA,CAAa,IAAA,CAAK,IAAI,CAAA;AAC/C,IAAA,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACjD,IAAA,IAAA,CAAK,kBAAA,GAAqB,IAAA,CAAK,kBAAA,CAAmB,IAAA,CAAK,IAAI,CAAA;AAC3D,IAAA,IAAA,CAAK,yBAAA,GAA4B,IAAA,CAAK,yBAAA,CAA0B,IAAA,CAAK,IAAI,CAAA;AACzE,IAAA,IAAA,CAAK,sBAAA,GAAyB,IAAA,CAAK,sBAAA,CAAuB,IAAA,CAAK,IAAI,CAAA;AACnE,IAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA,CAAK,qBAAA,CAAsB,IAAA,CAAK,IAAI,CAAA;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA,EAKQ,mBAAmB,WAAA,EAA8B;AACvD,IAAA,MAAM,KAAA,GAAQ,eAAe,IAAA,CAAK,YAAA;AAElC,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,uBAAuB,WAAA,EAA6C;AAClE,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAA;AACjD,IAAA,OAAO,IAAI,qBAAA,CAAsB,IAAA,CAAK,MAAA,EAAQ,KAAK,CAAA;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,qBAAA,CAAsB,aAAsB,MAAA,EAAiD;AAC3F,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAA;AACjD,IAAA,OAAO,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAA,EAAQ,OAAO,MAAM,CAAA;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAA,CAAmB;AAAA,IACvB,MAAA;AAAA,IACA;AAAA,GACF,EAGoB;AAClB,IAAA,OAAO,IAAA,CAAK,aAAa,kBAAA,CAAmB;AAAA,MAC1C,MAAA;AAAA,MACA,WAAA,EAAa,IAAA,CAAK,kBAAA,CAAmB,WAAW;AAAA,KACjD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoCA,MAAM,6BAAA,CAA8B;AAAA,IAClC,MAAA;AAAA,IACA;AAAA,GACF,EAGoB;AAClB,IAAA,OAAO,KAAK,QAAA,CAAS,6BAAA;AAAA,MACnB,MAAA;AAAA,MACA,IAAA,CAAK,mBAAmB,WAAW;AAAA,KACrC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAM,aAAA,CAAc,EAAE,MAAA,EAAO,EAAkE;AAC7F,IAAA,OAAO,aAAA,CAAc,EAAE,MAAA,EAAQ,CAAA;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBAAA,CAAmB,EAAE,MAAA,EAAO,EAAuD;AACvF,IAAA,OAAO,kBAAA,CAAmB,EAAE,MAAA,EAAQ,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,MAAM,yBAAA,CAA0B;AAAA,IAC9B,MAAA;AAAA,IACA;AAAA,GACF,EAGoB;AAClB,IAAA,OAAO,6BAAA,CAA8B;AAAA,MACnC,GAAG,MAAA;AAAA,MACH,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,WAAA,EAAa,IAAA,CAAK,kBAAA,CAAmB,WAAW;AAAA,KACjD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAA,CAAS;AAAA,IACb,MAAA;AAAA,IACA;AAAA,GACF,EAGoB;AAClB,IAAA,OAAO,IAAA,CAAK,aAAa,QAAA,CAAS;AAAA,MAChC,MAAA;AAAA,MACA,WAAA,EAAa,IAAA,CAAK,kBAAA,CAAmB,WAAW;AAAA,KACjD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,CAAQ;AAAA,IACZ,MAAA;AAAA,IACA;AAAA,GACF,EAGoB;AAClB,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,iBAAiB,OAAA,EAAS,MAAA,EAAQ,UAAS,GAAI,MAAA;AAC3E,IAAA,OAAO,KAAK,kBAAA,CAAmB;AAAA,MAC7B,MAAA,EAAQ;AAAA,QACN,UAAA;AAAA,QACA,MAAA;AAAA,QACA,KAAA,EAAO;AAAA,UACL;AAAA,YACE,eAAA;AAAA,YACA,UAAA,EAAY,SAAA;AAAA,YACZ,UAAU,CAAC,OAAA,EAASiC,oBAAa,MAAA,EAAQ,QAAQ,GAAG,KAAK;AAAA;AAC3D;AACF,OACF;AAAA,MACA,WAAA,EAAa,IAAA,CAAK,kBAAA,CAAmB,WAAW;AAAA,KACjD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAA,CAAgB;AAAA,IACpB,MAAA;AAAA,IACA;AAAA,GACF,EAGoB;AAClB,IAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,KAAA,EAAM,GAAI,MAAA;AACtC,IAAA,OAAO,KAAK,kBAAA,CAAmB;AAAA,MAC7B,MAAA,EAAQ;AAAA,QACN,UAAA;AAAA,QACA,MAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,WAAA,EAAa,IAAA,CAAK,kBAAA,CAAmB,WAAW;AAAA,KACjD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAA,CAAa;AAAA,IACjB,MAAA;AAAA,IACA;AAAA,GACF,EAGkC;AAChC,IAAA,OAAO,IAAA,CAAK,QAAQ,YAAA,CAAa;AAAA,MAC/B,GAAG,MAAA;AAAA,MACH,WAAA,EAAa,IAAA,CAAK,kBAAA,CAAmB,WAAW;AAAA,KACjD,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,qBAAA,CAAsB;AAAA,IAC1B,MAAA;AAAA,IACA;AAAA,GACF,EAGyB;AACvB,IAAA,OAAO,IAAA,CAAK,aAAa,qBAAA,CAAsB;AAAA,MAC7C,MAAA;AAAA,MACA,WAAA,EAAa,IAAA,CAAK,kBAAA,CAAmB,WAAW;AAAA,KACjD,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,kBAAA,CACJ,KAAA,EACA,WAAA,EACyC;AACzC,IAAA,OAAO,KAAK,YAAA,CAAa,kBAAA,CAAmB,OAAO,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EACzF;AAAA,EAEA,MAAM,SAAA,CAAU,MAAA,EAAyB,WAAA,EAAsB;AAC7D,IAAA,OAAO,KAAK,OAAA,CAAQ,SAAA,CAAU,QAAQ,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EAC5E;AAAA,EAEA,MAAM,eAAA,CACJ,MAAA,EACA,WAAA,EACkC;AAClC,IAAA,OAAO,IAAA,CAAK,QAAQ,eAAA,CAAgB;AAAA,MAClC,MAAA;AAAA,MACA,WAAA,EAAa,IAAA,CAAK,kBAAA,CAAmB,WAAW;AAAA,KACjD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAA,CAAY;AAAA,IAChB,MAAA;AAAA,IACA;AAAA,GACF,EAGyB;AACvB,IAAA,OAAO,KAAK,YAAA,CAAa,WAAA,CAAY,QAAQ,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAA,CAAe,EAAA,EAAY,WAAA,EAA4C;AAC3E,IAAA,OAAO,KAAK,YAAA,CAAa,cAAA,CAAe,IAAI,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EAClF;AAAA;AAAA,EAGA,MAAM,UAAA,CAAW,MAAA,EAAyB,WAAA,EAAuD;AAC/F,IAAA,OAAO,KAAK,IAAA,CAAK,UAAA,CAAW,QAAQ,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EAC1E;AAAA,EAEA,MAAM,MAAA,CAAO,EAAA,EAAY,WAAA,EAAoC;AAC3D,IAAA,OAAO,KAAK,IAAA,CAAK,MAAA,CAAO,IAAI,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAA,CAAe,QAAA,EAAkB,WAAA,EAA4C;AACjF,IAAA,OAAO,KAAK,YAAA,CAAa,cAAA,CAAe,UAAU,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAA,CACJ1D,MAAAA,EACA,WAAA,EACoC;AACpC,IAAA,OAAO,KAAK,YAAA,CAAa,oBAAA,CAAqBA,QAAM,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,oBAAA,CACJ,MAAA,EACA,WAAA,EACuC;AACvC,IAAA,OAAO,KAAK,OAAA,CAAQ,oBAAA,CAAqB,QAAQ,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EACvF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAA,CACJ,MAAA,EACA,WAAA,EACuC;AACvC,IAAA,OAAO,KAAK,OAAA,CAAQ,oBAAA,CAAqB,QAAQ,IAAA,CAAK,kBAAA,CAAmB,WAAW,CAAC,CAAA;AAAA,EACvF;AAAA,EAEA,MAAM,YAAA,CACJ,cAAA,EACA,QAAA,EACA,WAAA,EACiB;AACjB,IAAA,OAAO,KAAK,SAAA,CAAU,YAAA;AAAA,MACpB,cAAA;AAAA,MACA,QAAA;AAAA,MACA,IAAA,CAAK,mBAAmB,WAAW;AAAA,KACrC;AAAA,EACF;AACF;;;AC3bO,IAAM,cAAA,GAAN,cAA6B,QAAA,CAAS;AAAA,EAC3C,YAAY,MAAA,EAA8B;AACxC,IAAA,IAAI,CAAC,OAAO,YAAA,EAAc;AACxB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,MAAM,CAAA;AAAA,EACd;AAAA;AAAA;AAIF;;;ACRO,IAAM,eAAA,GAAN,cAA8B,QAAA,CAAS;AAAA,EAC5C,YAAY,MAAA,EAA+B;AACzC,IAAA,KAAA,CAAM,MAAM,CAAA;AAAA,EACd;AAAA;AAAA;AAIF;;;ACmBAqB,gBAAAA,EAAAA;;;ACzBAA,gBAAAA,EAAAA;AACA,OAAA,EAAA;AACA,UAAA,EAAA;AACA,0BAAA,EAAA;AAKA,IAAM,uBAAA,GAA0B,kBAAA;AAChC,IAAM,sBAAA,GAAyB,WAAA;AAwCxB,IAAM,iBAAN,MAAqB;AAAA,EAQ1B,YAAY,IAAA,EAaT;AACD,IAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACnB,IAAA,IAAA,CAAK,aAAa,IAAA,CAAK,UAAA;AACvB,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AACxB,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AACxB,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACZ,UAAA,EAAY,sBAAA;AAAA,MACZ,GAAG,IAAA,CAAK;AAAA,KACV;AACA,IAAA,IAAA,CAAK,UAAW,UAAA,CAAmB,KAAA;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAA,CAAM,GAAA,EAAa,IAAA,EAAoD;AAC3E,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAK,IAAI,CAAA;AAC7C,IAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,MAAA,OAAO,QAAA;AAAA,IACT;AAEA,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,oBAAA,CAAqB,QAAQ,CAAA;AACtD,IAAA,IAAA,CAAK,oBAAoB,WAAW,CAAA;AACpC,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,WAAA,CAAY,WAAW,CAAA;AAClD,IAAA,OAAO,IAAA,CAAK,gBAAA,CAAiB,GAAA,EAAK,IAAA,EAAM,OAAO,CAAA;AAAA,EACjD;AAAA,EAEA,qBAAqB,QAAA,EAA6C;AAChE,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,uBAAuB,CAAA;AAChE,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI;AACF,MAAA,WAAA,GAAc,IAAA,CAAK,MAAM,WAAW,CAAA;AAAA,IACtC,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,uDAAA,EAA0D,WAAA,CAAY,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAAA,OACrF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,YAAY,MAAA,IAAU,CAAC,YAAY,OAAA,IAAW,CAAC,YAAY,iBAAA,EAAmB;AACjF,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,WAAA,CAAY,WAAW,OAAA,EAAS;AAClC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,6BAAA,EAAgC,YAAY,MAAM,CAAA,qCAAA;AAAA,OACpD;AAAA,IACF;AACA,IAAA,IAAI,WAAA,CAAY,YAAY,kBAAA,EAAoB;AAC9C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,8BAAA,EAAiC,YAAY,OAAO,CAAA,8DAAA;AAAA,OACtD;AAAA,IACF;AACA,IAAA,OAAO,WAAA;AAAA,EACT;AAAA,EAEQ,oBAAoB,GAAA,EAA+B;AACzD,IAAA,IACE,IAAA,CAAK,MAAA,CAAO,iBAAA,IACZ,IAAA,CAAK,OAAO,iBAAA,CAAkB,MAAA,GAAS,CAAA,IACvC,CAAC,KAAK,MAAA,CAAO,iBAAA,CAAkB,QAAA,CAAS,GAAA,CAAI,KAAK,CAAA,EACjD;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,kBAAA,EAAqB,IAAI,KAAK,CAAA,0FAAA;AAAA,OAChC;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,OAAO,gBAAA,EAAkB;AAChC,MAAA,MAAM,YAAA,GAAe,oBAAA,CAAqB,IAAA,CAAK,MAAA,CAAO,kBAAkB,CAAC,CAAA;AACzE,MAAA,IAAI,MAAA,CAAO,GAAA,CAAI,iBAAiB,CAAA,GAAI,YAAA,EAAc;AAChD,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,kBAAkB,GAAA,CAAI,iBAAiB,CAAA,oBAAA,EAAuB,IAAA,CAAK,OAAO,gBAAgB,CAAA,MAAA;AAAA,SAC5F;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,YAAY,WAAA,EAA0D;AAC1E,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,MAAA,CAAO,UAAA,IAAc,OAAA;AAC7C,IAAA,IAAI,eAAe,OAAA,EAAS;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,mEAAmE,UAAU,CAAA,oGAAA;AAAA,OAG/E;AAAA,IACF;AAEA,IAAA,MAAM,QAAQ,aAAA,EAAc;AAC5B,IAAA,MAAM,UAAA,GAAa,KAAK,KAAA,CAAM,IAAA,CAAK,KAAI,GAAI,GAAI,IAAI,WAAA,CAAY,iBAAA;AAG/D,IAAA,MAAM,aAAakD,gBAAAA,CAAQ,WAAA,CAAY,MAAA,CAAO,WAAA,CAAY,iBAAiB,CAAC,CAAA;AAC5E,IAAA,MAAM,YAAA,GAAe;AAAA,MACnB,iBAAiB,WAAA,CAAY,KAAA;AAAA,MAC7B,UAAA,EAAY,UAAA;AAAA,MACZ,QAAA,EAAU,CAAC,WAAA,CAAY,KAAA,EAAO,UAAA,CAAW,GAAA,CAAI,QAAA,EAAS,EAAG,UAAA,CAAW,IAAA,CAAK,QAAA,EAAU;AAAA,KACrF;AAMA,IAAA,MAAM,KAAK,qBAAA,CAAsB;AAAA,MAC/B,KAAA,EAAO,MAAA,CAAO,IAAA,GAAO,cAAA,CAAe,KAAK,CAAC,CAAA;AAAA,MAC1C,KAAA,EAAO,CAAC,YAAY,CAAA;AAAA,MACpB,MAAA,EAAQvD;AAAA,KACT,CAAA;AAED,IAAA,MAAM,UAAU,kBAAA,CAAmB;AAAA,MACjC,QAAA,EAAU,KAAK,MAAA,CAAO,OAAA;AAAA,MACtB,OAAA,EAAS,KAAK,WAAA,CAAY;AAAA,KAC3B,CAAA;AACD,IAAA,MAAM,cAAc,aAAA,CAAc,EAAA,EAAI,IAAA,CAAK,MAAA,CAAO,WAAW,OAAO,CAAA;AAKpE,IAAA,MAAM,gBAAgBG,yBAAA,CAAkB,IAAA,CAAK,MAAA,CAAO,mBAAA,EAAqB,KAAK,UAAU,CAAA;AACxF,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,WAAW,kBAAA,CAAmB;AAAA,MAClC,UAAA,EAAY,aAAA;AAAA,MACZ;AAAA,KACD,CAAA;AAED,IAAA,MAAM,aAAa,qCAAA,CAAsC;AAAA,MACvD,gBAAA,EAAkB,EAAA;AAAA,MAClB,SAAA,EAAW;AAAA,KACZ,CAAA;AAKD,IAAA,MAAM,CAAA,GAAI,QAAA,CAAS,QAAA,CAAS,MAAA,GAAS,CAAC,CAAA,IAAK,EAAA;AAC3C,IAAA,MAAM,CAAA,GAAI,QAAA,CAAS,QAAA,CAAS,MAAA,GAAS,CAAC,CAAA,IAAK,EAAA;AAE3C,IAAA,OAAO;AAAA,MACL,WAAA,EAAa,CAAA;AAAA,MACb,MAAA,EAAQ,OAAA;AAAA,MACR,OAAA,EAAS,kBAAA;AAAA,MACT,OAAA,EAAS;AAAA,QACP,SAAA,EAAW;AAAA,UACT,CAAA,EAAG,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA;AAAA,UACvB,CAAA,EAAG,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE;AAAA,SACzB;AAAA,QACA,WAAA,EAAa,KAAK,MAAA,CAAO,SAAA;AAAA,QACzB,WAAW,WAAA,CAAY,KAAA;AAAA,QACvB,QAAQ,WAAA,CAAY,iBAAA;AAAA,QACpB,OAAO,WAAA,CAAY,KAAA;AAAA,QACnB,UAAA;AAAA,QACA,KAAA;AAAA,QACA,IAAA,EAAM;AAAA,UACJ,UAAA,EAAY,MAAA;AAAA,UACZ,UAAA;AAAA,UACA;AAAA;AACF;AACF,KACF;AAAA,EACF;AAAA,EAEA,MAAc,gBAAA,CACZ,GAAA,EACA,IAAA,EACA,OAAA,EACwB;AAMxB,IAAA,MAAM,cAAe,UAAA,CAAmB,OAAA;AACxC,IAAA,MAAM,UAAA,GAAa,KAAK,MAAA,CAAO,UAAA;AAC/B,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA;AAE1C,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI,OAAO,gBAAgB,UAAA,EAAY;AACrC,MAAA,MAAM,MAAA,GAAS,IAAI,WAAA,CAAY,IAAA,EAAM,OAAO,CAAA;AAC5C,MAAA,MAAA,CAAO,GAAA,CAAI,YAAY,WAAW,CAAA;AAClC,MAAA,OAAA,GAAU,MAAA;AAAA,IACZ,CAAA,MAAO;AAEL,MAAA,MAAM,QAAA,GAAoC,IAAA,EAAM,OAAA,IAAmB,EAAC;AACpE,MAAA,OAAA,GAAU,EAAE,GAAG,QAAA,EAAU,CAAC,UAAU,GAAG,WAAA,EAAY;AAAA,IACrD;AACA,IAAA,OAAO,KAAK,OAAA,CAAQ,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAAA,EAC/C;AACF;AAEA,SAAS,oBAAA,CAAqB,QAAgB,QAAA,EAA0B;AACtE,EAAA,MAAM,CAAC,OAAO,IAAA,GAAO,EAAE,IAAI,MAAA,CAAO,IAAA,EAAK,CAAE,KAAA,CAAM,GAAG,CAAA;AAClD,EAAA,MAAM,UAAA,GAAA,CAAc,OAAO,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,EAAG,KAAA,CAAM,GAAG,QAAQ,CAAA;AAClE,EAAA,OAAO,MAAA,CAAA,CAAQ,KAAA,IAAS,GAAA,IAAO,UAAU,CAAA;AAC3C;AAEA,SAAS,aAAA,GAAwB;AAC/B,EAAA,IAAI,OAAQ,UAAA,CAAmB,MAAA,EAAQ,UAAA,KAAe,UAAA,EAAY;AAChE,IAAA,OAAQ,UAAA,CAAmB,OAAO,UAAA,EAAW;AAAA,EAC/C;AACA,EAAA,OAAO,CAAA,EAAG,IAAA,CAAK,GAAA,EAAK,IAAI,IAAA,CAAK,MAAA,EAAO,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AACjE;AAcA,SAAS,eAAe,KAAA,EAAuB;AAC7C,EAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,KAAK,CAAA;AAC5C,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,GAAA,IAAO,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,IAAI,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,CAAE,QAAA,CAAS,IAAI,GAAG,CAAA;AAC1C;AClUA,SAAS,iBAAA,CAAkB,QAAgB,QAAA,EAA0B;AACnE,EAAA,MAAM,CAAC,KAAA,EAAO,IAAA,GAAO,EAAE,CAAA,GAAI,MAAA,CAAO,MAAM,GAAG,CAAA;AAC3C,EAAA,MAAM,UAAA,GAAA,CAAc,OAAO,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,EAAG,KAAA,CAAM,GAAG,QAAQ,CAAA;AAClE,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,GAAQ,UAAU,CAAC,CAAA;AAC1C;AAKA,SAAS,uBAAA,CAAwB,QAA2B,QAAA,EAAsC;AAChG,EAAA,MAAM,eAAA,GAAkB,iBAAA,CAAkB,MAAA,CAAO,MAAA,EAAQ2D,sBAAe,IAAI,CAAA;AAE5E,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,OAAA;AAAA,IACR,OAAA,EAAS,kBAAA;AAAA,IACT,iBAAA,EAAmB,eAAA;AAAA,IACnB,QAAA;AAAA,IACA,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,OAAO,MAAA,CAAO,KAAA;AAAA,IACd,iBAAA,EAAmB,GAAA;AAAA,IACnB,OAAOX,yBAAAA,CAAmB;AAAA,GAC5B;AACF;AAEA,SAAS,aACP,MAAA,EACoC;AACpC,EAAA,OAAO,QAAA,IAAY,UAAU,WAAA,IAAe,MAAA;AAC9C;AAEA,SAAS,cACP,MAAA,EACsB;AACtB,EAAA,IAAI,YAAA,CAAa,MAAM,CAAA,EAAG;AACxB,IAAA,OAAO;AAAA,MACL,aAAa,MAAA,CAAO,WAAA;AAAA,MACpB,aAAA,EAAe;AAAA,QACb,QAAQ,MAAA,CAAO,MAAA;AAAA,QACf,OAAO,MAAA,CAAO,SAAA;AAAA,QACd,aAAa,MAAA,CAAO;AAAA,OACtB;AAAA,MACA,YAAY,MAAA,CAAO;AAAA,KACrB;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAyBO,SAAS,eAAe,MAAA,EAAyD;AACtF,EAAA,MAAM,QAAA,GAAW,cAAc,MAAM,CAAA;AACrC,EAAA,OAAO,OAAO,GAAA,EAAU,GAAA,EAAU,IAAA,KAAc;AAE9C,IAAA,IAAI,GAAA,CAAI,WAAW,SAAA,EAAW;AAC5B,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAEA,IAAA,MAAM,gBAAgB,GAAA,CAAI,OAAA,GAAU,WAAW,CAAA,IAAK,GAAA,CAAI,UAAU,WAAW,CAAA;AAE7E,IAAA,IAAI,CAAC,aAAA,EAAe;AAElB,MAAA,MAAM,WACJ,GAAA,CAAI,QAAA,IAAY,IAAI,GAAA,GAChB,CAAA,EAAG,IAAI,QAAQ,CAAA,GAAA,EAAM,GAAA,CAAI,GAAA,CAAI,MAAM,CAAC,CAAA,EAAG,IAAI,WAAW,CAAA,CAAA,GACrD,IAAI,GAAA,IAAO,EAAA;AAClB,MAAA,MAAMY,YAAAA,GAAc,uBAAA,CAAwB,QAAA,CAAS,aAAA,EAAe,QAAQ,CAAA;AAE5E,MAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,CAAI,kBAAA,EAAoB,IAAA,CAAK,SAAA,CAAUA,YAAW,CAAC,CAAA,CAAE,IAAA,CAAK;AAAA,QAC/E,KAAA,EAAO,kBAAA;AAAA,QACP,kBAAA,EAAoBA;AAAA,OACrB,CAAA;AAAA,IACH;AAGA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,OAAO,aAAA,KAAkB,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,aAAa,CAAA,GAAI,aAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,4CAA4C,CAAA;AAAA,IACnF;AAGA,IAAA,MAAM,UAAU,OAAA,EAAS,OAAA;AACzB,IAAA,MAAM,YAAY,OAAO,OAAA,EAAS,SAAA,KAAc,QAAA,GAAW,QAAQ,SAAA,GAAY,IAAA;AAC/E,IAAA,MAAM,SAAS,OAAO,OAAA,EAAS,MAAA,KAAW,QAAA,GAAW,QAAQ,MAAA,GAAS,IAAA;AACtE,IAAA,MAAM,QAAQ,OAAO,OAAA,EAAS,KAAA,KAAU,QAAA,GAAW,QAAQ,KAAA,GAAQ,IAAA;AAEnE,IAAA,IAAI,CAAC,SAAA,IAAa,CAAC,MAAA,IAAU,CAAC,KAAA,EAAO;AACnC,MAAA,OAAO,GAAA,CACJ,OAAO,GAAG,CAAA,CACV,KAAK,EAAE,KAAA,EAAO,wDAAwD,CAAA;AAAA,IAC3E;AAGA,IAAA,MAAM,WAAA,GAAc,uBAAA,CAAwB,QAAA,CAAS,aAAA,EAAe,EAAE,CAAA;AACtE,IAAA,MAAM,aAAA,GAAgB,CAAC,CAAA,KAAc,CAAA,CAAE,aAAY,CAAE,OAAA,CAAQ,SAAS,IAAI,CAAA;AAE1E,IAAA,IAAI,cAAc,SAAS,CAAA,KAAM,cAAc,QAAA,CAAS,aAAA,CAAc,KAAK,CAAA,EAAG;AAC5E,MAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,QAC1B,KAAA,EAAO,4BAAA;AAAA,QACP,QAAQ,CAAA,SAAA,EAAY,QAAA,CAAS,aAAA,CAAc,KAAK,SAAS,SAAS,CAAA;AAAA,OACnE,CAAA;AAAA,IACH;AAEA,IAAA,IAAI,UAAA;AACJ,IAAA,IAAI;AACF,MAAA,UAAA,GAAa,OAAO,MAAM,CAAA;AAAA,IAC5B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,GAAA,CACJ,MAAA,CAAO,GAAG,CAAA,CACV,IAAA,CAAK,EAAE,KAAA,EAAO,6BAAA,EAA+B,MAAA,EAAQ,kCAAA,EAAoC,CAAA;AAAA,IAC9F;AAEA,IAAA,IAAI,UAAA,GAAa,MAAA,CAAO,WAAA,CAAY,iBAAiB,CAAA,EAAG;AACtD,MAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,QAC1B,KAAA,EAAO,6BAAA;AAAA,QACP,MAAA,EAAQ,CAAA,SAAA,EAAY,WAAA,CAAY,iBAAiB,oBAAoB,MAAM,CAAA;AAAA,OAC5E,CAAA;AAAA,IACH;AAEA,IAAA,IAAI,cAAc,KAAK,CAAA,KAAM,aAAA,CAAc,WAAA,CAAY,KAAK,CAAA,EAAG;AAC7D,MAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,QAC1B,KAAA,EAAO,wBAAA;AAAA,QACP,MAAA,EAAQ,sBAAsB,KAAK,CAAA;AAAA,OACpC,CAAA;AAAA,IACH;AAGA,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,WAAA,CAAY,OAAO,OAAO,CAAA;AAC1D,MAAA,IAAI,CAAC,SAAS,OAAA,EAAS;AACrB,QAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,UAC1B,KAAA,EAAO,6BAAA;AAAA,UACP,QAAQ,QAAA,CAAS;AAAA,SAClB,CAAA;AAAA,MACH;AAGA,MAAA,IAAI,CAAC,SAAS,UAAA,EAAY;AACxB,QAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,WAAA,CAAY,OAAO,OAAO,CAAA;AACzD,QAAA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACpB,UAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,YAC1B,KAAA,EAAO,2BAAA;AAAA,YACP,QAAQ,OAAA,CAAQ;AAAA,WACjB,CAAA;AAAA,QACH;AAGA,QAAA,GAAA,CAAI,IAAA,GAAO;AAAA,UACT,QAAQ,OAAA,CAAQ,eAAA;AAAA,UAChB,OAAA;AAAA,UACA,WAAW,OAAA,CAAQ;AAAA,SACrB;AAAA,MACF,CAAA,MAAO;AACL,QAAA,GAAA,CAAI,IAAA,GAAO,EAAE,OAAA,EAAQ;AAAA,MACvB;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,QAC1B,KAAA,EAAO,0BAAA;AAAA,QACP,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AACF;ACzMO,IAAM,gBAAA,GAAmB;AACzB,IAAM,mBAAA,GAAsB;AAC5B,IAAM,aAAA,GAAgB;AA6B7B,IAAM,iBAAA,GAAoB,yDAAA;AAE1B,SAAS,oBAAA,CAAqB,OAAe,KAAA,EAAqB;AAChE,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,KAAK,CAAA,oCAAA,CAAsC,CAAA;AAAA,EACrE;AACF;AAGO,SAAS,8BAA8B,MAAA,EAAyC;AACrF,EAAA,MAAM,OAAA,GAAiC;AAAA,IACrC,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,OAAA,EAAS,wBAAA,CAAyB,MAAA,CAAO,OAAO,CAAA;AAAA,IAChD,SAAA,EAAW,OAAO,SAAA,IAAa,iBAAA;AAAA,IAC/B,KAAK,MAAA,CAAO,GAAA;AAAA,IACZ,OAAO,MAAA,CAAO,KAAA;AAAA,IACd,QAAA,EAAU,OAAO,QAAA,IAAY,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAAA,IACzD,gBAAgB,MAAA,CAAO;AAAA,GACzB;AACA,EAAA,KAAA,MAAW,SAAS,CAAC,QAAA,EAAU,WAAA,EAAa,KAAA,EAAO,OAAO,CAAA,EAAY;AACpE,IAAA,oBAAA,CAAqB,KAAA,EAAO,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAC5C;AACA,EAAA,IAAI,CAAC,mBAAA,CAAoB,IAAA,CAAK,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,OAAA,CAAQ,QAAQ,CAAA,IAAK,CAAC,MAAA,CAAO,SAAA,CAAU,OAAA,CAAQ,cAAc,CAAA,EAAG;AACpF,IAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,EACzD;AACA,EAAA,IAAI,OAAA,CAAQ,cAAA,IAAkB,OAAA,CAAQ,QAAA,EAAU;AAC9C,IAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,EAC9D;AAEA,EAAA,OAAO;AAAA,IACL,KAAA,EAAO;AAAA,MACL,cAAA,EAAgB;AAAA,QACd,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,aAAA,EAAc;AAAA,QACpC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,aAAA,EAAc;AAAA,QACvC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,aAAA,EAAc;AAAA,QACvC,EAAE,IAAA,EAAM,UAAA,EAAY,IAAA,EAAM,aAAA;AAAc,OAC1C;AAAA,MACA,MAAA,EAAQ;AAAA,QACN,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,QAAA,EAAS;AAAA,QACjC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,iBAAA,EAAkB;AAAA,QAC3C,EAAE,IAAA,EAAM,WAAA,EAAa,IAAA,EAAM,QAAA,EAAS;AAAA,QACpC,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,QAAA,EAAS;AAAA,QAC9B,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,QAAA,EAAS;AAAA,QAChC,EAAE,IAAA,EAAM,UAAA,EAAY,IAAA,EAAM,WAAA,EAAY;AAAA,QACtC,EAAE,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,WAAA;AAAY;AAC9C,KACF;AAAA,IACA,WAAA,EAAa,QAAA;AAAA,IACb,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,gBAAA;AAAA,MACN,OAAA,EAAS,mBAAA;AAAA,MACT,OAAA,EAAS,aAAA;AAAA,MACT,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,OAAA,EAAS,EAAE,GAAG,OAAA;AAAQ,GACxB;AACF;AAqCA,IAAM,gBAAA,GAAmB,EAAA;AAEzB,IAAM,kBAAA,GAAqB,MAAA,CAAO9E,oBAAAA,CAAY,iBAAA,CAAkB,aAAa,CAAC,CAAA;AAQ9E,SAAS,iBAAiB,OAAA,EAA2B;AACnD,EAAA,IAAI,OAAA,KAAY,eAAe,OAAO,IAAA;AACtC,EAAA,IAAI,OAAO,OAAA,KAAY,QAAA,EAAU,OAAO,OAAA,KAAY,kBAAA;AACpD,EAAA,IAAI,OAAO,YAAY,QAAA,IAAY,CAAC,0BAA0B,IAAA,CAAK,OAAO,GAAG,OAAO,KAAA;AACpF,EAAA,OAAO,MAAA,CAAO,OAAO,CAAA,KAAM,kBAAA;AAC7B;AAWA,eAAsB,qBACpB,MAAA,EACqC;AACrC,EAAA,MAAM,EAAE,SAAA,EAAA+B,UAAAA,EAAW,WAAW,QAAA,EAAU,QAAA,EAAU,gBAAe,GAAI,MAAA;AACrE,EAAA,MAAM,MAAMA,UAAAA,EAAW,OAAA;AACvB,EAAA,IAAI,CAAC,OAAO,CAAC,KAAA,CAAM,QAAQ,SAAS,CAAA,IAAK,SAAA,CAAU,MAAA,KAAW,CAAA,EAAG;AAC/D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC1C;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiBA,UAAAA,CAAU,MAAA,EAAQ,OAAO,CAAA,EAAG,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,aAAA,EAAc;AAE5F,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,6BAAA,CAA8B;AAAA,MACxC,MAAA,EAAQ,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAAA,MACzB,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAAA,MACnB,OAAA,EAAS,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA;AAAA,MAC3B,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA;AAAA,MACvB,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA;AAAA,MAC/B,QAAA,EAAU,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA;AAAA,MAC7B,cAAA,EAAgB,MAAA,CAAO,GAAA,CAAI,cAAc;AAAA,KAC1C,CAAA;AACD,IAAA,OAAA,GAAU,SAAA,CAAU,OAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC1C;AAEA,EAAA,IAAI,OAAA,CAAQ,WAAW,QAAA,CAAS,MAAA,SAAe,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,cAAA,EAAe;AACnF,EAAA,IAAI,OAAA,CAAQ,QAAQ,QAAA,CAAS,GAAA,SAAY,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAC1E,EAAA,IAAI,OAAA,CAAQ,UAAU,QAAA,CAAS,KAAA,SAAc,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,aAAA,EAAc;AAChF,EAAA,MAAM,GAAA,GAAM,SAAS,GAAA,IAAO,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxD,EAAA,IAAI,GAAA,IAAO,QAAQ,cAAA,EAAgB,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,SAAA,EAAU;AACzE,EAAA,IAAI,OAAA,CAAQ,WAAW,GAAA,GAAM,gBAAA,SAAyB,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,eAAA,EAAgB;AAE3F,EAAA,MAAM,WAAA,GAAcsC,kBAAAA,CAAkB,cAAA,CAAe,SAAA,EAAW,QAAQ,OAAO,CAAA;AAC/E,EAAA,MAAM,UAAU,MAAM,wBAAA,CAAyB,UAAU,OAAA,CAAQ,OAAA,EAAS,aAAa,SAAS,CAAA;AAChG,EAAA,IAAI,OAAA,CAAQ,OAAO,OAAO,EAAE,IAAI,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,OAAA,EAAQ;AACxE,EAAA,IAAI,OAAA,CAAQ,WAAW,sBAAA,EAAwB,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,mBAAA,EAAoB;AAE/F,EAAA,IAAI,CAAC,cAAA,EAAgB,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,sBAAA,EAAuB;AACxE,EAAA,IAAI,wBAAA,CAAyB,cAAA,CAAe,OAAO,CAAA,KAAM,QAAQ,OAAA,EAAS;AACxE,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,kBAAA,EAAmB;AAAA,EACjD;AACA,EAAA,MAAM,QAAA,GAAW,iCAAA,CAAkC,cAAA,EAAgB,WAAA,EAAa,SAAS,CAAA;AACzF,EAAA,OAAO,QAAA,CAAS,KAAA,GACZ,EAAE,EAAA,EAAI,MAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,OAAA,KACtC,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,SAAS,MAAA,EAAO;AAC3C;;;AC9MA,gBAAA,EAAA;AAqBA,2BAAA,EAAA;AAOA,OAAA,EAAA;AASA,UAAA,EAAA;AClCA,SAAS,oBAAoB,GAAA,EAAuB;AAClD,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,GAAG,SAAA,EAAW,IAAA,KAAS,MAAM,CAAA,EAAG,IAAA,KAAS,IAAI,OAAO,IAAA;AACxD,EAAA,OAAO,wBAAwB,IAAA,CAAK,CAAA,EAAG,OAAA,IAAW,MAAA,CAAO,GAAG,CAAC,CAAA;AAC/D;AAOA,eAAsB,uBACpB,QAAA,EACA,IAAA,EACA,SAAA,GAAoBnB,iCAAAA,CAA2B,IAAI,CAAA,EACjC;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,CAAS,eAAe,SAAS,CAAA;AACvC,IAAA,OAAO,IAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,mBAAA,CAAoB,GAAG,CAAA,EAAG,OAAO,KAAA;AACrC,IAAA,MAAM,GAAA;AAAA,EACR;AACF;;;ADoCA,YAAA,EAAA;;;AE/CA,2BAAA,EAAA;AACA,OAAA,EAAA;AAEA,IAAM,eAAA,GAAkB,kBAAA;AACxB,IAAM,oBAAA,GAAuB,MAAA,CAAOlD,oBAAAA,CAAY,iBAAA,CAAkB,eAAe,CAAC,CAAA;AAElF,IAAM,eAAA,GAAkB,mEAAA;AAexB,SAAS,WAAA,CAAY,IAAA,EAAc,CAAA,EAAe,GAAA,EAAmB;AACnE,EAAA,IAAI,CAAA,CAAE,WAAW,GAAA,EAAK;AACpB,IAAA,MAAM,IAAI,MAAM,CAAA,EAAG,IAAI,oBAAoB,GAAG,CAAA,YAAA,EAAe,CAAA,CAAE,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAC1E;AACF;AAEA,SAAS,cAAc,CAAA,EAA8C;AACnE,EAAA,WAAA,CAAY,qBAAA,EAAuB,GAAG,EAAE,CAAA;AACxC,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,EAAA,EAAK,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA;AAC9D,EAAA,OAAO,EAAE,KAAK,CAAA,GAAA,CAAM,EAAA,IAAM,QAAQ,EAAA,EAAK,IAAA,EAAM,KAAK,IAAA,EAAK;AACzD;AAMO,SAAS,kBAAkB,MAAA,EAAgC;AAChE,EAAA,MAAM,CAAA,GAAI,aAAA,CAAc,MAAA,CAAO,CAAC,CAAA;AAChC,EAAA,MAAM,CAAA,GAAI,aAAA,CAAc,MAAA,CAAO,CAAC,CAAA;AAChC,EAAA,OAAO,CAAC,EAAE,GAAA,EAAK,CAAA,CAAE,MAAM,CAAA,CAAE,GAAA,EAAK,EAAE,IAAI,CAAA;AACtC;AAMO,SAAS,cAAc,MAAA,EAA8B;AAC1D,EAAA,OAAO,eAAA,CAAgB,oBAAA,EAAsB,iBAAA,CAAkB,MAAM,CAAC,CAAA;AACxE;AAUO,SAAS,uBAAuB,MAAA,EAA8B;AACnE,EAAA,WAAA,CAAY,wBAAA,EAA0B,MAAA,CAAO,CAAA,EAAG,EAAE,CAAA;AAClD,EAAA,WAAA,CAAY,wBAAA,EAA0B,MAAA,CAAO,CAAA,EAAG,EAAE,CAAA;AAClD,EAAA,MAAM,QAAQ,CAAC,CAAA,KACb,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AACtE,EAAA,OAAO,CAAA,EAAG,MAAM,MAAA,CAAO,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,MAAA,CAAO,CAAC,CAAC,CAAA,CAAA;AAC9C;AASO,SAAS,qBAAqB,YAAA,EAAgC;AACnE,EAAA,MAAM,GAAA,GAAM,aAAa,UAAA,CAAW,IAAI,IAAI,YAAA,CAAa,KAAA,CAAM,CAAC,CAAA,GAAI,YAAA;AACpE,EAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wDAAA,EAA2D,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAC1F;AAGA,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,GAAG,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,EAClE;AACA,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAC/B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,IAAA,KAAA,CAAM,CAAC,CAAA,GAAI,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EACrD;AACA,EAAA,MAAM,IAAI,aAAA,CAAc,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAC1C,EAAA,MAAM,IAAI,aAAA,CAAc,KAAA,CAAM,KAAA,CAAM,EAAA,EAAI,EAAE,CAAC,CAAA;AAC3C,EAAA,MAAM,CAAA,GAAI,MAAM,EAAE,CAAA;AAElB,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,CAAA,KAAM,IAAI,OAAA,GAAU,EAAA;AAAA,OAAA,IACf,CAAA,KAAM,IAAI,OAAA,GAAU,EAAA;AAAA,OAAA,IACpB,CAAA,KAAM,GAAG,OAAA,GAAU,EAAA;AAAA,OAAA,IACnB,CAAA,KAAM,GAAG,OAAA,GAAU,EAAA;AAAA,OACvB,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAC,CAAA,gDAAA,CAAkD,CAAA;AAE7F,EAAA,IAAI,CAAA,CAAE,GAAA,KAAQ,EAAA,IAAM,CAAA,CAAE,SAAS,EAAA,EAAI;AACjC,IAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,EACzD;AACA,EAAA,OAAO,CAAC,EAAE,GAAA,EAAK,CAAA,CAAE,MAAM,CAAA,CAAE,GAAA,EAAK,CAAA,CAAE,IAAA,EAAM,OAAO,CAAA;AAC/C;AAOO,SAAS,iCAAiC,MAAA,EAWpC;AACX,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AACjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,gDAAgD,UAAU,CAAA,+BAAA;AAAA,KAC5D;AAAA,EACF;AACA,EAAA,MAAM,OAAA,GAAU,oBAAA,CAAqB,MAAA,CAAO,YAAY,CAAA;AACxD,EAAA,OAAO,oBAAA,CAAqB;AAAA,IAC1B,OAAA,EAAS,UAAA;AAAA,IACT,OAAA,EAAS,eAAA;AAAA,IACT;AAAA,GACD,CAAA;AACH;AAUA,eAAsB,kCAAkC,MAAA,EAUlC;AACpB,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AACjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,iDAAiD,UAAU,CAAA,+BAAA;AAAA,KAC7D;AAAA,EACF;AACA,EAAA,MAAM,SAAA,GAAY,mBAAA,CAAoB,MAAA,CAAO,UAAU,CAAA;AAEvD,EAAA,MAAM,CAAC,IAAA,EAAM,MAAM,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,IACvC,OAAO,kBAAkB,CAAA;AAAA;AAAA;AAAA,IAGzB,OAAO,uBAAuB;AAAA,GAC/B,CAAA;AAGD,EAAA,MAAM,OAAA,GAAU,YAAA,CAAa,MAAA,CAAO,WAAW,CAAA;AAC/C,EAAA,MAAM,MAAA,GAAS,IAAI,WAAA,EAAY,CAAE,OAAO,+BAAkC,CAAA;AAC1E,EAAA,MAAM,WAAA,GAAc,IAAI,UAAA,CAAW,MAAA,CAAO,SAAS,EAAE,CAAA;AACrD,EAAA,WAAA,CAAY,GAAA,CAAI,QAAQ,CAAC,CAAA;AACzB,EAAA,WAAA,CAAY,GAAA,CAAI,OAAA,EAAS,MAAA,CAAO,MAAM,CAAA;AACtC,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,UAAA,CAAW,WAAW,CAAA;AAInD,EAAA,MAAM,GAAA,GAAW,MAAO,IAAA,CAAa,SAAA,CAAU,eAAe,SAAA,EAAW;AAAA,IACvE,IAAA,EAAM;AAAA,GACP,CAAA;AAED,EAAA,IAAI,CAAA,GAAY,OAAO,GAAA,CAAI,CAAA,KAAM,WAAW,GAAA,CAAI,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA;AAChE,EAAA,IAAI,CAAA,GAAY,OAAO,GAAA,CAAI,CAAA,KAAM,WAAW,GAAA,CAAI,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA;AAChE,EAAA,IAAI,QAAA,GACF,OAAO,GAAA,CAAI,QAAA,KAAa,QAAA,GAAW,IAAI,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,QAAA,IAAY,CAAC,CAAA;AAE5E,EAAA,MAAM,YAAY,eAAA,IAAmB,EAAA;AACrC,EAAA,IAAI,IAAI,SAAA,EAAW;AACjB,IAAA,CAAA,GAAI,eAAA,GAAkB,CAAA;AACtB,IAAA,QAAA,IAAY,CAAA;AAAA,EACd;AAEA,EAAA,MAAM,MAAA,GAAS,aAAa,CAAC,CAAA;AAC7B,EAAA,MAAM,MAAA,GAAS,aAAa,CAAC,CAAA;AAE7B,EAAA,MAAM,KAAA,GAAQ,cAAc,MAAM,CAAA;AAClC,EAAA,MAAM,KAAA,GAAQ,cAAc,MAAM,CAAA;AAElC,EAAA,OAAO,oBAAA,CAAqB;AAAA,IAC1B,OAAA,EAAS,UAAA;AAAA,IACT,OAAA,EAAS,eAAA;AAAA,IACT,OAAA,EAAS,CAAC,KAAA,CAAM,GAAA,EAAK,KAAA,CAAM,IAAA,EAAM,KAAA,CAAM,GAAA,EAAK,KAAA,CAAM,IAAA,EAAM,MAAA,CAAO,QAAQ,CAAC;AAAA,GACzE,CAAA;AACH;AAEA,SAAS,oBAAoB,KAAA,EAAwC;AACnE,EAAA,IAAI,iBAAiB,UAAA,EAAY;AAC/B,IAAA,WAAA,CAAY,qBAAA,EAAuB,OAAO,EAAE,CAAA;AAC5C,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,IAAI,IAAI,KAAA,CAAM,KAAA,CAAM,CAAC,CAAA,GAAI,KAAA;AACtD,EAAA,IAAI,GAAA,CAAI,WAAW,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yDAAA,EAA4D,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAC3F;AAEA,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,GAAG,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACpE;AACA,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,EAAE,CAAA;AAC7B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EACnD;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,aAAa,CAAA,EAAuB;AAC3C,EAAA,IAAI,CAAA,GAAI,EAAA,EAAI,MAAM,IAAI,MAAM,8BAA8B,CAAA;AAC1D,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,EAAE,CAAA;AAC7B,EAAA,KAAA,IAAS,CAAA,GAAI,EAAA,EAAI,CAAA,IAAK,CAAA,EAAG,CAAA,EAAA,EAAK;AAC5B,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,CAAA,GAAI,KAAK,CAAA;AACzB,IAAA,CAAA,KAAM,EAAA;AAAA,EACR;AACA,EAAA,IAAI,CAAA,KAAM,EAAA,EAAI,MAAM,IAAI,MAAM,sCAAsC,CAAA;AACpE,EAAA,OAAO,GAAA;AACT;;;ACnOA,2BAAA,EAAA;AACA,OAAA,EAAA;AAEA,IAAM,iBAAA,GAAoB,eAAA;AAC1B,IAAM,sBAAA,GAAyB,MAAA,CAAOA,oBAAAA,CAAY,iBAAA,CAAkB,iBAAiB,CAAC,CAAA;AAEtF,IAAM,UAAA,GAAa,mEAAA;AASnB,SAAS+E,YAAAA,CAAY,IAAA,EAAc,CAAA,EAAe,GAAA,EAAmB;AACnE,EAAA,IAAI,CAAA,CAAE,WAAW,GAAA,EAAK;AACpB,IAAA,MAAM,IAAI,MAAM,CAAA,EAAG,IAAI,oBAAoB,GAAG,CAAA,YAAA,EAAe,CAAA,CAAE,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAC1E;AACF;AAEA,SAASC,eAAc,CAAA,EAA8C;AACnE,EAAAD,YAAAA,CAAY,WAAA,EAAa,CAAA,EAAG,EAAE,CAAA;AAC9B,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,EAAA,EAAK,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA;AAC9D,EAAA,OAAO,EAAE,KAAK,CAAA,GAAA,CAAM,EAAA,IAAM,QAAQ,EAAA,EAAK,IAAA,EAAM,KAAK,IAAA,EAAK;AACzD;AAEA,SAASE,cAAa,CAAA,EAAuB;AAC3C,EAAA,IAAI,CAAA,GAAI,EAAA,EAAI,MAAM,IAAI,MAAM,8BAA8B,CAAA;AAC1D,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,EAAE,CAAA;AAC7B,EAAA,KAAA,IAAS,CAAA,GAAI,EAAA,EAAI,CAAA,IAAK,CAAA,EAAG,CAAA,EAAA,EAAK;AAC5B,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,CAAA,GAAI,KAAK,CAAA;AACzB,IAAA,CAAA,KAAM,EAAA;AAAA,EACR;AACA,EAAA,IAAI,CAAA,KAAM,EAAA,EAAI,MAAM,IAAI,MAAM,sCAAsC,CAAA;AACpE,EAAA,OAAO,GAAA;AACT;AAGA,SAAS,gBAAgB,KAAA,EAA2B;AAElD,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,IAAO,MAAA,CAAO,YAAA,CAAa,KAAA,CAAM,CAAC,CAAC,CAAA;AAC1E,EAAA,MAAM,GAAA,GAAM,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA,GAAI,IAAA,CAAK,GAAG,CAAA;AAC5F,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACtE;AAUO,SAAS,iBAAiB,KAAA,EAA6B;AAC5D,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,SAAS,EAAE,CAAA;AAC9C,EAAA,MAAM,GAAA,GAAgB,CAAC,MAAA,CAAO,SAAS,CAAC,CAAA;AACxC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,SAAA,EAAW,CAAA,EAAA,EAAK;AAClC,IAAA,IAAI,CAAA,GAAI,EAAA;AACR,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,KAAA,CAAM,CAAA,GAAI,EAAA,GAAK,CAAC,CAAC,CAAA;AACrE,IAAA,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,EACZ;AACA,EAAA,MAAM,WAAW,SAAA,GAAY,EAAA;AAC7B,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,GAAS,QAAA;AAC9B,EAAA,IAAI,OAAA,GAAU,EAAA;AACd,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,EAAQ,CAAA,EAAA,EAAK;AAC/B,IAAA,OAAA,GAAW,WAAW,EAAA,GAAM,MAAA,CAAO,KAAA,CAAM,QAAA,GAAW,CAAC,CAAC,CAAA;AAAA,EACxD;AACA,EAAA,GAAA,CAAI,KAAK,OAAO,CAAA;AAChB,EAAA,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,CAAA;AACvB,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,uBAAuB,GAAA,EAGrC;AAWA,EAAA,IAAI,GAAA,CAAI,SAAS,CAAA,EAAG;AAClB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,GAAA,CAAI,MAAM,CAAA,OAAA,CAAS,CAAA;AAAA,EAC9D;AACA,EAAA,IAAI,IAAI,CAAC,CAAA,KAAM,IAAM,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAEpE,EAAA,MAAM,MAAA,GAAS,IAAI,CAAC,CAAA;AACpB,EAAA,IAAI,SAAS,GAAA,EAAM;AACjB,IAAA,MAAM,IAAI,MAAM,8CAA8C,CAAA;AAAA,EAChE;AACA,EAAA,IAAI,CAAA,GAAI,MAAA,KAAW,GAAA,CAAI,MAAA,EAAQ;AAC7B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,8BAAA,EAAiC,MAAM,CAAA,wBAAA,EAA2B,GAAA,CAAI,SAAS,CAAC,CAAA,CAAA;AAAA,KAClF;AAAA,EACF;AAEA,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,IAAI,IAAI,GAAG,CAAA,KAAM,GAAM,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAC3E,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,GAAA,GAAM,CAAC,CAAA;AACxB,EAAA,IAAI,IAAA,KAAS,CAAA,EAAG,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAClE,EAAA,IAAI,GAAA,GAAM,CAAA,GAAI,IAAA,GAAO,GAAA,CAAI,MAAA,EAAQ;AAC/B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,cAAA,EAAiB,IAAI,CAAA,2BAAA,EAA8B,GAAA,GAAM,CAAC,CAAA,CAAE,CAAA;AAAA,EAC9E;AACA,EAAA,GAAA,IAAO,CAAA;AACP,EAAA,IAAI,MAAA,GAAS,IAAI,UAAA,CAAW,IAAI,CAAA;AAChC,EAAA,MAAA,CAAO,IAAI,GAAA,CAAI,QAAA,CAAS,GAAA,EAAK,GAAA,GAAM,IAAI,CAAC,CAAA;AACxC,EAAA,GAAA,IAAO,IAAA;AAEP,EAAA,IAAI,GAAA,GAAM,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ;AACxB,IAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,EACrD;AACA,EAAA,IAAI,IAAI,GAAG,CAAA,KAAM,GAAM,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAC3E,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,GAAA,GAAM,CAAC,CAAA;AACxB,EAAA,IAAI,IAAA,KAAS,CAAA,EAAG,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAClE,EAAA,IAAI,GAAA,GAAM,CAAA,GAAI,IAAA,GAAO,GAAA,CAAI,MAAA,EAAQ;AAC/B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,cAAA,EAAiB,IAAI,CAAA,2BAAA,EAA8B,GAAA,GAAM,CAAC,CAAA,CAAE,CAAA;AAAA,EAC9E;AACA,EAAA,GAAA,IAAO,CAAA;AACP,EAAA,IAAI,MAAA,GAAS,IAAI,UAAA,CAAW,IAAI,CAAA;AAChC,EAAA,MAAA,CAAO,IAAI,GAAA,CAAI,QAAA,CAAS,GAAA,EAAK,GAAA,GAAM,IAAI,CAAC,CAAA;AAGxC,EAAA,MAAA,GAAS,WAAA,CAAY,gBAAA,CAAiB,MAAM,CAAC,CAAA;AAC7C,EAAA,MAAA,GAAS,WAAA,CAAY,gBAAA,CAAiB,MAAM,CAAC,CAAA;AAC7C,EAAA,OAAO,EAAE,CAAA,EAAG,MAAA,EAAQ,CAAA,EAAG,MAAA,EAAO;AAChC;AAEA,SAAS,iBAAiB,CAAA,EAAwC;AAEhE,EAAA,MAAM,KAAA,GAAQ,EAAE,MAAA,GAAS,CAAA,IAAK,EAAE,CAAC,CAAA,KAAM,IAAO,CAAA,GAAI,CAAA;AAClD,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,CAAA,CAAE,SAAS,KAAK,CAAA;AAC3C,EAAA,GAAA,CAAI,GAAA,CAAI,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA;AACzB,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,YAAY,CAAA,EAAwC;AAC3D,EAAA,IAAI,CAAA,CAAE,SAAS,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,sCAAA,EAAyC,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AACtF,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,EAAE,CAAA;AAC7B,EAAA,GAAA,CAAI,GAAA,CAAI,CAAA,EAAG,EAAA,GAAK,CAAA,CAAE,MAAM,CAAA;AACxB,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,oBAAoB,GAAA,EAA+B;AACjE,EAAA,MAAM,CAAA,GAAID,cAAAA,CAAc,GAAA,CAAI,CAAC,CAAA;AAC7B,EAAA,MAAM,CAAA,GAAIA,cAAAA,CAAc,GAAA,CAAI,CAAC,CAAA;AAC7B,EAAA,OAAO,CAAC,EAAE,GAAA,EAAK,CAAA,CAAE,MAAM,CAAA,CAAE,GAAA,EAAK,EAAE,IAAI,CAAA;AACtC;AAEO,SAAS,gBAAgB,GAAA,EAA6B;AAC3D,EAAA,OAAO,eAAA,CAAgB,sBAAA,EAAwB,mBAAA,CAAoB,GAAG,CAAC,CAAA;AACzE;AASO,SAAS,yBAAyB,GAAA,EAA6B;AACpE,EAAAD,YAAAA,CAAY,oBAAA,EAAsB,GAAA,CAAI,CAAA,EAAG,EAAE,CAAA;AAC3C,EAAAA,YAAAA,CAAY,oBAAA,EAAsB,GAAA,CAAI,CAAA,EAAG,EAAE,CAAA;AAC3C,EAAA,MAAM,QAAQ,CAAC,CAAA,KACb,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AACtE,EAAA,OAAO,CAAA,EAAG,MAAM,GAAA,CAAI,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,GAAA,CAAI,CAAC,CAAC,CAAA,CAAA;AACxC;AAiBO,SAAS,mCAAmC,MAAA,EAqBtC;AACX,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AACjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,kDAAkD,UAAU,CAAA,+BAAA;AAAA,KAC9D;AAAA,EACF;AACA,EAAA,MAAM,EAAE,CAAA,EAAG,CAAA,EAAE,GAAI,sBAAA,CAAuB,OAAO,YAAY,CAAA;AAE3D,EAAA,MAAM,iBAAA,GAAoB,eAAA,CAAgBE,aAAAA,CAAa,MAAA,CAAO,WAAW,CAAC,CAAA;AAG1E,EAAA,MAAM,MAAA,GAAS,gBAAgB,iBAAiB,CAAA,CAAA,CAAA;AAChD,EAAA,MAAM,gBAAgB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,cAAc,CAAA;AACpE,EAAA,MAAM,WAAA,GAAc,aAAA,CAAc,OAAA,CAAQ,MAAM,CAAA;AAChD,EAAA,IAAI,cAAc,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,eAAA,GAAkB,cAAc,eAAA,CAAgB,MAAA;AAEtD,EAAA,MAAM,EAAA,GAAKD,eAAc,CAAC,CAAA;AAC1B,EAAA,MAAM,EAAA,GAAKA,eAAc,CAAC,CAAA;AAE1B,EAAA,MAAM,OAAA,GAAoB;AAAA,IACxB,GAAG,gBAAA,CAAiB,MAAA,CAAO,iBAAiB,CAAA;AAAA,IAC5C,GAAG,gBAAA,CAAiB,MAAA,CAAO,cAAc,CAAA;AAAA,IACzC,OAAO,eAAe,CAAA;AAAA,IACtB,EAAA,CAAG,GAAA;AAAA,IACH,EAAA,CAAG,IAAA;AAAA,IACH,EAAA,CAAG,GAAA;AAAA,IACH,EAAA,CAAG,IAAA;AAAA,IACH,OAAO,OAAA,IAAW;AAAA,GACpB;AAEA,EAAA,OAAO,oBAAA,CAAqB;AAAA,IAC1B,OAAA,EAAS,UAAA;AAAA,IACT,OAAA,EAAS,iBAAA;AAAA,IACT;AAAA,GACD,CAAA;AACH;AAWA,eAAsB,oCAAoC,MAAA,EAkBpC;AACpB,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AACjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,mDAAmD,UAAU,CAAA,+BAAA;AAAA,KAC/D;AAAA,EACF;AACA,EAAA,MAAM,SAAA,GAAYE,oBAAAA,CAAoB,MAAA,CAAO,UAAU,CAAA;AACvD,EAAA,MAAM,IAAA,GAAO,OAAO,IAAA,IAAQ,UAAA;AAC5B,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,IAAU,kBAAA;AAChC,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,IAAS,CAAA;AAC9B,EAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAa,EAAA;AAKtC,EAAA,IAAI,CAAC,OAAO,SAAA,CAAU,KAAK,KAAK,KAAA,GAAQ,CAAA,IAAK,QAAQ,GAAA,EAAM;AACzD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mDAAA,EAAsD,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EAChF;AACA,EAAA,IAAI,CAAC,OAAO,SAAA,CAAU,SAAS,KAAK,SAAA,GAAY,CAAA,IAAK,YAAY,UAAA,EAAY;AAC3E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8DAAA,EAAiE,SAAS,CAAA,CAAA,CAAG,CAAA;AAAA,EAC/F;AAEA,EAAA,MAAM,CAAC,EAAE,IAAA,EAAK,EAAG,IAAI,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,IACzC,OAAO,uBAAuB,CAAA;AAAA,IAC9B,OAAO,uBAAuB;AAAA,GAC/B,CAAA;AAGD,EAAA,MAAM,SAAA,GAAYD,aAAAA,CAAa,MAAA,CAAO,WAAW,CAAA;AACjD,EAAA,MAAM,YAAA,GAAe,gBAAgB,SAAS,CAAA;AAE9C,EAAA,MAAM,aAAA,GACJ,CAAA,oCAAA,EAAuC,YAAY,CAAA,YAAA,EACtC,MAAM,CAAA,sBAAA,CAAA;AACrB,EAAA,MAAM,UAAA,GAAa,IAAI,WAAA,EAAY,CAAE,OAAO,aAAa,CAAA;AACzD,EAAA,MAAM,kBACJ,aAAA,CAAc,OAAA,CAAQ,gBAAgB,YAAY,CAAA,CAAA,CAAG,IAAI,eAAA,CAAgB,MAAA;AAG3E,EAAA,MAAM,QAAA,GAAW,KAAK,MAAA,CAAO,IAAI,aAAY,CAAE,MAAA,CAAO,IAAI,CAAC,CAAA;AAC3D,EAAA,MAAM,QAAA,GAAW,IAAI,UAAA,CAAW,EAAA,GAAK,IAAI,CAAC,CAAA;AAC1C,EAAA,QAAA,CAAS,GAAA,CAAI,UAAU,CAAC,CAAA;AACxB,EAAA,QAAA,CAAS,EAAE,CAAA,GAAI,KAAA;AAEf,EAAA,QAAA,CAAS,EAAE,CAAA,GAAK,SAAA,KAAc,EAAA,GAAM,GAAA;AACpC,EAAA,QAAA,CAAS,EAAE,CAAA,GAAK,SAAA,KAAc,EAAA,GAAM,GAAA;AACpC,EAAA,QAAA,CAAS,EAAE,CAAA,GAAK,SAAA,KAAc,CAAA,GAAK,GAAA;AACnC,EAAA,QAAA,CAAS,EAAE,IAAI,SAAA,GAAY,GAAA;AAG3B,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,MAAA,CAAO,UAAU,CAAA;AACtC,EAAA,MAAM,cAAc,IAAI,UAAA,CAAW,QAAA,CAAS,MAAA,GAAS,QAAQ,MAAM,CAAA;AACnE,EAAA,WAAA,CAAY,GAAA,CAAI,UAAU,CAAC,CAAA;AAC3B,EAAA,WAAA,CAAY,GAAA,CAAI,OAAA,EAAS,QAAA,CAAS,MAAM,CAAA;AACxC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,WAAW,CAAA;AAGzC,EAAA,MAAM,QAAA,GAAwB,IAAA,CAAa,IAAA,CAAK,SAAA,EAAW,SAAA,EAAW;AAAA,IACpE,OAAA,EAAS;AAAA,GACV,CAAA;AACD,EAAA,IAAI,QAAA,CAAS,WAAW,EAAA,EAAI;AAC1B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,QAAA,CAAS,MAAM,CAAA,mBAAA,CAAqB,CAAA;AAAA,EAC5E;AACA,EAAA,IAAI,IAAI,eAAA,CAAgB,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAC7C,EAAA,IAAI,IAAI,eAAA,CAAgB,QAAA,CAAS,KAAA,CAAM,EAAA,EAAI,EAAE,CAAC,CAAA;AAG9C,EAAA,MAAM,YAAY,UAAA,IAAc,EAAA;AAChC,EAAA,IAAI,CAAA,GAAI,SAAA,EAAW,CAAA,GAAI,UAAA,GAAa,CAAA;AAEpC,EAAA,MAAM,MAAA,GAASA,cAAa,CAAC,CAAA;AAC7B,EAAA,MAAM,MAAA,GAASA,cAAa,CAAC,CAAA;AAE7B,EAAA,MAAM,EAAA,GAAKD,eAAc,MAAM,CAAA;AAC/B,EAAA,MAAM,EAAA,GAAKA,eAAc,MAAM,CAAA;AAE/B,EAAA,MAAM,OAAA,GAAoB;AAAA,IACxB,GAAG,iBAAiB,QAAQ,CAAA;AAAA,IAC5B,GAAG,iBAAiB,UAAU,CAAA;AAAA,IAC9B,OAAO,eAAe,CAAA;AAAA,IACtB,EAAA,CAAG,GAAA;AAAA,IACH,EAAA,CAAG,IAAA;AAAA,IACH,EAAA,CAAG,GAAA;AAAA,IACH,EAAA,CAAG,IAAA;AAAA,IACH;AAAA;AAAA,GACF;AAEA,EAAA,OAAO,oBAAA,CAAqB;AAAA,IAC1B,OAAA,EAAS,UAAA;AAAA,IACT,OAAA,EAAS,iBAAA;AAAA,IACT;AAAA,GACD,CAAA;AACH;AAEA,SAASE,qBAAoB,KAAA,EAAwC;AACnE,EAAA,IAAI,iBAAiB,UAAA,EAAY;AAC/B,IAAAH,YAAAA,CAAY,mBAAA,EAAqB,KAAA,EAAO,EAAE,CAAA;AAC1C,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,IAAI,IAAI,KAAA,CAAM,KAAA,CAAM,CAAC,CAAA,GAAI,KAAA;AACtD,EAAA,IAAI,GAAA,CAAI,WAAW,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uDAAA,EAA0D,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EACzF;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,GAAG,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,EAClE;AACA,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,EAAE,CAAA;AAC7B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EACnD;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,gBAAgB,CAAA,EAAuB;AAC9C,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,EAAA,EAAK,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA;AAC9D,EAAA,OAAO,CAAA;AACT;;;AC/YA,2BAAA,EAAA;AACA,OAAA,EAAA;AAGA,IAAM,sBAAA,GAAyB,qBAAA;AAC/B,IAAM,2BAAA,GAA8B,MAAA,CAAO/E,oBAAAA,CAAY,iBAAA,CAAkB,sBAAsB,CAAC,CAAA;AAGzF,IAAM,YAAA,GAAe;AAG5B,IAAM,gBAAA,GAAmB,EAAA;AAiCzB,IAAMmF,UAAAA,GAAAA,CAAa,MAAM,IAAA,IAAQ,EAAA;AAEjC,SAASJ,YAAAA,CAAY,IAAA,EAAc,CAAA,EAAe,GAAA,EAAmB;AACnE,EAAA,IAAI,CAAA,CAAE,WAAW,GAAA,EAAK;AACpB,IAAA,MAAM,IAAI,MAAM,CAAA,EAAG,IAAI,oBAAoB,GAAG,CAAA,YAAA,EAAe,CAAA,CAAE,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EAC1E;AACF;AAEA,SAASC,eAAc,CAAA,EAA8C;AACnE,EAAAD,YAAAA,CAAY,qBAAA,EAAuB,CAAA,EAAG,EAAE,CAAA;AACxC,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,EAAA,EAAK,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA;AAC9D,EAAA,OAAO,EAAE,GAAA,EAAK,CAAA,GAAII,UAAAA,EAAW,IAAA,EAAM,KAAK,IAAA,EAAK;AAC/C;AAOO,SAAS,gBAAgB,GAAA,EAAqB;AACnD,EAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,GAAG,CAAA;AAC1C,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AACpD,EAAA,OAAO,MAAA,CAAOpF,aAAAA,CAAK,6BAAA,CAA8B,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,IAAA,GAAO,CAAA,CAAE,QAAA,CAAS,EAAE,CAAC,CAAC,CAAC,CAAA;AAC3F;AAMO,SAAS,uBAAuB,MAAA,EAAqC;AAC1E,EAAA,MAAM,CAAA,GAAIiF,cAAAA,CAAc,MAAA,CAAO,CAAC,CAAA;AAChC,EAAA,MAAM,CAAA,GAAIA,cAAAA,CAAc,MAAA,CAAO,CAAC,CAAA;AAChC,EAAA,MAAM,OAAA,GAAU,eAAA,CAAgB,MAAA,CAAO,GAAG,CAAA;AAC1C,EAAA,OAAO,CAAC,EAAE,GAAA,EAAK,CAAA,CAAE,MAAM,CAAA,CAAE,GAAA,EAAK,CAAA,CAAE,IAAA,EAAM,OAAO,CAAA;AAC/C;AAGO,SAAS,mBAAmB,MAAA,EAAmC;AACpE,EAAA,OAAO,eAAA,CAAgB,2BAAA,EAA6B,sBAAA,CAAuB,MAAM,CAAC,CAAA;AACpF;AAMA,SAAS,gBAAgB,KAAA,EAA2B;AAIlD,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,GAAA,IAAO,MAAA,CAAO,aAAa,CAAC,CAAA;AAEnD,EAAA,MAAM,GAAA,GAAM,aAAa,GAAG,CAAA;AAC5B,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACtE;AAEA,SAAS,aAAa,GAAA,EAAqB;AACzC,EAAA,IAAI,OAAO,IAAA,KAAS,UAAA,EAAY,OAAO,KAAK,GAAG,CAAA;AAG/C,EAAA,MAAM,MAAO,UAAA,CAAmB,MAAA;AAChC,EAAA,IAAI,GAAA,SAAY,GAAA,CAAI,IAAA,CAAK,KAAK,QAAQ,CAAA,CAAE,SAAS,QAAQ,CAAA;AACzD,EAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAC9E;AAEA,SAAS,gBAAgB,CAAA,EAAuB;AAE9C,EAAA,MAAM,GAAA,GAAM,EAAE,MAAA,GAAS,CAAA,KAAM,IAAI,CAAA,GAAI,CAAA,GAAK,EAAE,MAAA,GAAS,CAAA;AACrD,EAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,GAAI,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA;AACpE,EAAA,MAAM,GAAA,GAAM,aAAa,GAAG,CAAA;AAC5B,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,aAAa,CAAA,EAAmB;AACvC,EAAA,IAAI,OAAO,IAAA,KAAS,UAAA,EAAY,OAAO,KAAK,CAAC,CAAA;AAE7C,EAAA,MAAM,MAAO,UAAA,CAAmB,MAAA;AAChC,EAAA,IAAI,GAAA,SAAY,GAAA,CAAI,IAAA,CAAK,GAAG,QAAQ,CAAA,CAAE,SAAS,QAAQ,CAAA;AACvD,EAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAC9E;AAQO,SAAS,yBAAyB,WAAA,EAA6B;AACpE,EAAA,MAAM,OAAA,GAAU,IAAI,UAAA,CAAW,EAAE,CAAA;AACjC,EAAA,IAAI,CAAA,GAAI,WAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,EAAA,EAAI,CAAA,IAAK,CAAA,EAAG,CAAA,EAAA,EAAK;AAC5B,IAAA,OAAA,CAAQ,CAAC,CAAA,GAAI,MAAA,CAAO,CAAA,GAAI,KAAK,CAAA;AAC7B,IAAA,CAAA,KAAM,EAAA;AAAA,EACR;AACA,EAAA,IAAI,MAAM,EAAA,EAAI;AACZ,IAAA,MAAM,IAAI,WAAW,8BAA8B,CAAA;AAAA,EACrD;AACA,EAAA,MAAM,GAAA,GAAM,gBAAgB,OAAO,CAAA;AACnC,EAAA,IAAI,GAAA,CAAI,WAAW,gBAAA,EAAkB;AACnC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,SAAA,EAAY,gBAAgB,CAAA,wBAAA,EAA2B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,EACrF;AACA,EAAA,OAAO,GAAA;AACT;AAQA,SAAS,cAAA,CAAe,QAAA,EAAsB,MAAA,EAAoB,KAAA,EAAuB;AACvF,EAAA,KAAA,EAAO,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,OAAO,MAAA,IAAU,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AAChE,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACtC,MAAA,IAAI,SAAS,CAAA,GAAI,CAAC,MAAM,MAAA,CAAO,CAAC,GAAG,SAAS,KAAA;AAAA,IAC9C;AACA,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,KAAK,CAAA,6CAAA,CAA+C,CAAA;AACxF;AAoBA,SAAS,2BAAA,CACP,OAAA,EACA,KAAA,EACA,aAAA,EACQ;AAIR,EAAA,MAAM,OAAA,GAAU,CAAA,CAAA,EAAI,KAAK,CAAA,GAAA,EAAM,aAAa,CAAA,CAAA,CAAA;AAC5C,EAAA,MAAM,YAAA,GAAe,IAAI,WAAA,EAAY,CAAE,OAAO,OAAO,CAAA;AACrD,EAAA,MAAM,GAAA,GAAM,wBAAA,CAAyB,OAAA,EAAS,YAAY,CAAA;AAC1D,EAAA,IAAI,MAAM,CAAA,EAAG;AACX,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,kBAAkB,KAAK,CAAA,uEAAA;AAAA,KACzB;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,IAAI,KAAK,CAAA,GAAA,CAAA;AACxB,EAAA,OAAO,MAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,CAAE,MAAA;AAChD;AAEA,SAAS,wBAAA,CAAyB,UAAsB,MAAA,EAA4B;AAClF,EAAA,KAAA,EAAO,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,OAAO,MAAA,IAAU,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AAChE,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACtC,MAAA,IAAI,SAAS,CAAA,GAAI,CAAC,MAAM,MAAA,CAAO,CAAC,GAAG,SAAS,KAAA;AAAA,IAC9C;AACA,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,OAAO,EAAA;AACT;AAOO,SAAS,kBAAkB,OAAA,EAIhC;AACA,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,gEAAA,EAAmE,MAAM,MAAM,CAAA;AAAA,KACjF;AAAA,EACF;AACA,EAAA,MAAM,CAAC,SAAA,EAAW,UAAA,EAAY,MAAM,CAAA,GAAI,KAAA;AACxC,EAAA,MAAM,cAAA,GAAiB,gBAAgB,UAAU,CAAA;AACjD,EAAA,MAAM,YAAA,GAAe,gBAAgB,MAAM,CAAA;AAC3C,EAAA,IAAI,YAAA,CAAa,WAAW,EAAA,EAAI;AAC9B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,gEAAA,EAAmE,aAAa,MAAM,CAAA,uFAAA;AAAA,KAExF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,SAAA,EAAW,cAAA,EAAgB,YAAA,EAAa;AACnD;AAYO,SAAS,eAAe,OAAA,EAG7B;AAIA,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY,CAAE,OAAO,SAAS,CAAA;AAClD,EAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AACxD,EAAA,MAAM,UAAA,GAAa,QAAQ,OAAA,CAAQ,MAAA;AACnC,EAAA,IAAI,GAAA,GAAM,UAAA;AACV,EAAA,OAAO,MAAM,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,GAAG,MAAM,EAAA,EAAgB;AAC9D,IAAA,IAAI,OAAA,CAAQ,GAAG,CAAA,KAAM,EAAA,EAAiB;AACpC,MAAA,MAAM,IAAI,MAAM,kEAAkE,CAAA;AAAA,IACpF;AACA,IAAA,GAAA,IAAO,CAAA;AAAA,EACT;AACA,EAAA,IAAI,GAAA,IAAO,QAAQ,MAAA,EAAQ;AACzB,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,EAC5D;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,MAAA,EAAQ,MAAM,UAAA,EAAW;AACxD;AAmBA,SAAS,eAAe,KAAA,EAA6B;AACnD,EAAA,OAAO,iBAAiB,KAAK,CAAA;AAC/B;AAEA,SAAS,qBAAqB,MAAA,EAA6C;AACzE,EAAA,MAAM,cAAc,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,SAAS,CAAA;AAC7D,EAAA,MAAM,WAAA,GAAc,eAAe,WAAW,CAAA;AAC9C,EAAA,MAAM,YAAA,GAAe,cAAA,CAAe,MAAA,CAAO,cAAc,CAAA;AAEzD,EAAA,OAAO;AAAA,IACL,GAAG,WAAA;AAAA,IACH,GAAG,YAAA;AAAA,IACH,MAAA,CAAO,OAAO,WAAW,CAAA;AAAA,IACzB,MAAA,CAAO,OAAO,SAAS,CAAA;AAAA,IACvB,MAAA,CAAO,OAAO,SAAS,CAAA;AAAA,IACvB,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,IACpB,OAAO,CAAA,GAAIG,UAAAA;AAAA,IACX,OAAO,CAAA,IAAK,IAAA;AAAA,IACZ,OAAO,CAAA,GAAIA,UAAAA;AAAA,IACX,OAAO,CAAA,IAAK,IAAA;AAAA,IACZ,MAAA,CAAO,OAAO,OAAO;AAAA,GACvB;AACF;AAYO,SAAS,0CAA0C,MAAA,EAa7C;AACX,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AACjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,yDAAyD,UAAU,CAAA,+BAAA;AAAA,KACrE;AAAA,EACF;AACA,EAAA,MAAM,EAAE,SAAA,EAAW,cAAA,EAAgB,cAAa,GAAI,iBAAA,CAAkB,OAAO,OAAO,CAAA;AAMpF,EAAA,MAAM,aAAA,GAAgB,wBAAA,CAAyB,MAAA,CAAO,WAAW,CAAA;AACjE,EAAA,MAAM,WAAA,GAAc,2BAAA,CAA4B,cAAA,EAAgB,OAAA,EAAS,aAAa,CAAA;AAGtF,EAAA,MAAM,SAAA,GAAY,2BAAA,CAA4B,cAAA,EAAgB,KAAA,EAAO,YAAY,CAAA;AAGjF,EAAA,MAAM,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAQ,MAAA,EAAO,GAAI,eAAe,cAAc,CAAA;AAC3E,EAAA,MAAM,SAAA,GAAY,IAAI,WAAA,EAAY,CAAE,MAAA;AAAA,IAClC,cAAA,CAAe,QAAA,CAAS,SAAA,EAAW,SAAA,GAAY,MAAM;AAAA,GACvD;AACA,EAAA,IAAI,SAAA,KAAc,MAAA,CAAO,MAAA,CAAO,GAAA,EAAK;AACnC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,6BAAA,EAAgC,SAAS,CAAA,4BAAA,EACnC,MAAA,CAAO,OAAO,GAAG,CAAA,6BAAA;AAAA,KACzB;AAAA,EACF;AAGA,EAAA,MAAM,EAAE,CAAA,EAAG,CAAA,EAAE,GAAI,uBAAuB,YAAY,CAAA;AAMpD,EAAA,MAAM,OAAA,GAAiB,CAAA;AAEvB,EAAA,OAAO,oBAAA,CAAqB;AAAA,IAC1B,OAAA,EAAS,UAAA;AAAA,IACT,OAAA,EAAS,sBAAA;AAAA,IACT,SAAS,oBAAA,CAAqB;AAAA,MAC5B,SAAA;AAAA,MACA,cAAA;AAAA,MACA,WAAA;AAAA,MACA,SAAA;AAAA,MACA,SAAA;AAAA,MACA,MAAA;AAAA,MACA,CAAA;AAAA,MACA,CAAA;AAAA,MACA;AAAA,KACD;AAAA,GACF,CAAA;AACH;AAEA,SAAS,uBAAuB,GAAA,EAA2C;AACzE,EAAA,IAAI,GAAA,CAAI,WAAW,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qDAAA,EAAwD,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,EACtF;AACA,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,GAAA,CAAI,CAAC,CAAC,CAAA;AAC1D,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,EAAA,EAAI,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK,CAAA,GAAK,CAAA,IAAK,EAAA,GAAM,MAAA,CAAO,GAAA,CAAI,CAAC,CAAC,CAAA;AAC3D,EAAA,OAAO,EAAE,GAAG,CAAA,EAAE;AAChB;AAiBA,eAAsB,oCAAoC,MAAA,EAkBvD;AACD,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,EAAA;AACxC,EAAA,IAAI,UAAA,GAAa,EAAA,IAAM,UAAA,IAAc,YAAA,EAAc;AACjD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,mDAAmD,UAAU,CAAA,+BAAA;AAAA,KAC/D;AAAA,EACF;AACA,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,OAAO,uBAAuB,CAAA;AACrD,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,OAAO,uBAAuB,CAAA;AAEvD,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,MAAA,KAAW,EAAA,EAAI;AACnC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,uDAAA,EAA0D,MAAA,CAAO,UAAA,CAAW,MAAM,CAAA;AAAA,KACpF;AAAA,EACF;AAIA,EAAA,MAAM,eAAA,GAA+B,IAAA,CAAa,YAAA,CAAa,MAAA,CAAO,YAAY,KAAK,CAAA;AACvF,EAAA,IAAI,gBAAgB,MAAA,KAAW,EAAA,IAAM,eAAA,CAAgB,CAAC,MAAM,CAAA,EAAM;AAChE,IAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,EAC9D;AACA,EAAA,MAAM,MAAA,GAA4B;AAAA,IAChC,CAAA,EAAG,eAAA,CAAgB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,IAC9B,CAAA,EAAG,eAAA,CAAgB,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA;AAAA,IAC/B,KAAK,MAAA,CAAO;AAAA,GACd;AAGA,EAAA,MAAM,UAAA,GAAa,KAAK,SAAA,CAAU,EAAE,KAAK,OAAA,EAAS,GAAA,EAAK,eAAe,CAAA;AACtE,EAAA,MAAM,YAAY,eAAA,CAAgB,IAAI,aAAY,CAAE,MAAA,CAAO,UAAU,CAAC,CAAA;AAUtE,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,MAAM,KAAA,GAAQ,wBAAA,CAAyB,MAAA,CAAO,WAAW,CAAA;AACzD,EAAA,MAAM,aAAA,GAAgB;AAAA,IACpB,GAAA,EAAK,YAAA;AAAA,IACL,KAAK,MAAA,CAAO,GAAA;AAAA,IACZ,KAAK,MAAA,CAAO,GAAA;AAAA,IACZ,GAAA,EAAK,GAAA;AAAA,IACL,KAAK,GAAA,GAAM,GAAA;AAAA,IACX;AAAA,GACF;AACA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,CAAU,aAAa,CAAA;AAChD,EAAA,MAAM,cAAA,GAAiB,IAAI,WAAA,EAAY,CAAE,OAAO,WAAW,CAAA;AAC3D,EAAA,MAAM,UAAA,GAAa,gBAAgB,cAAc,CAAA;AAGjD,EAAA,MAAM,YAAA,GAAe,IAAI,WAAA,EAAY,CAAE,OAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAE,CAAA;AAC1E,EAAA,MAAM,MAAA,GAAS,OAAO,YAAY,CAAA;AAMlC,EAAA,MAAM,MAAA,GAAsB,IAAA,CAAa,IAAA,CAAK,MAAA,EAAQ,OAAO,UAAA,EAAY;AAAA,IACvE,IAAA,EAAM;AAAA,GACP,CAAA;AACD,EAAA,IAAI,MAAA,CAAO,WAAW,EAAA,EAAI;AACxB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yDAAA,EAA4D,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAAA,EAC7F;AACA,EAAA,MAAM,EAAE,CAAA,EAAG,CAAA,EAAE,GAAI,uBAAuB,MAAM,CAAA;AAI9C,EAAA,MAAM,OAAA,GAAU,GAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA,EAAI,eAAA,CAAgB,MAAM,CAAC,CAAA,CAAA;AAKrE,EAAA,MAAM,WAAA,GAAc,2BAAA,CAA4B,cAAA,EAAgB,OAAA,EAAS,KAAK,CAAA;AAC9E,EAAA,MAAM,SAAA,GAAY,2BAAA,CAA4B,cAAA,EAAgB,KAAA,EAAO,YAAY,CAAA;AACjF,EAAA,MAAM,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAQ,MAAA,EAAO,GAAI,eAAe,cAAc,CAAA;AAE3E,EAAA,MAAM,WAAW,oBAAA,CAAqB;AAAA,IACpC,OAAA,EAAS,UAAA;AAAA,IACT,OAAA,EAAS,sBAAA;AAAA,IACT,SAAS,oBAAA,CAAqB;AAAA,MAC5B,SAAA;AAAA,MACA,cAAA;AAAA,MACA,WAAA;AAAA,MACA,SAAA;AAAA,MACA,SAAA;AAAA,MACA,MAAA;AAAA,MACA,CAAA;AAAA,MACA,CAAA;AAAA,MACA,OAAA,EAAS;AAAA,KACV;AAAA,GACF,CAAA;AAED,EAAA,OAAO,EAAE,QAAA,EAAU,MAAA,EAAQ,OAAA,EAAQ;AACrC;;;AJraA,cAAA,EAAA;AA0CA,0BAAA,EAAA;;;AK7KA,OAAA,EAAA;AAMA,UAAA,EAAA;AACA,0BAAA,EAAA;AAyDA,SAASC,cAAAA,GAAwB;AAI/B,EAAA,OAAQ,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,CAAA,IAAK,GAAA,GAAO,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,EAAO,GAAI,QAAS,CAAC,CAAA;AACnF;AAEO,IAAM,cAAN,MAAkB;AAAA,EAUvB,YACE,QAAA,EACA,OAAA,EACA,UAAA,EACA,OAAA,GAA8B,EAAC,EAC/B;AACA,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,IAAA,IAAA,CAAK,UAAA,GAAa,QAAQ,UAAA,IAAc,EAAA;AACxC,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,kBAAA,CAAmB,EAAE,CAAA;AACvD,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,MAAA;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAA,CACJ,KAAA,EACA,OAAA,GAA8B,EAAC,EACD;AAC9B,IAAA,IAAI,OAAA,CAAQ,oBAAoB,MAAA,EAAW;AAOzC,MAAA,MAAM,WAAWpE,sCAAA,GAAiC,kCAAA;AAClD,MAAA,IAAI,CAAC,OAAO,QAAA,CAAS,OAAA,CAAQ,eAAe,CAAA,IAAK,OAAA,CAAQ,mBAAmB,CAAA,EAAG;AAC7E,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,IAAI,OAAA,CAAQ,kBAAkB,QAAA,EAAU;AACtC,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,8BAAA,EAAiC,QAAQ,eAAe,CAAA,kBAAA,EAAqB,QAAQ,CAAA,qCAAA,EAC7CA,sCAA8B,SACjE,kCAAkC,CAAA,8BAAA;AAAA,SACzC;AAAA,MACF;AAAA,IACF;AACA,IAAA,MAAM,mBAAmB,qBAAA,CAAsB;AAAA,MAC7C,KAAA,EAAO,OAAA,CAAQ,KAAA,IAASoE,cAAAA,EAAc;AAAA,MACtC,KAAA;AAAA,MACA,GAAI,OAAA,CAAQ,eAAA,KAAoB,SAC5B,EAAE,aAAA,EAAe,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA,GAAI,QAAQ,eAAe,CAAA,KAC/E;AAAC,KACN,CAAA;AACD,IAAA,MAAM,cAAc,aAAA,CAAc,gBAAA,EAAkB,IAAA,CAAK,OAAA,EAAS,KAAK,OAAO,CAAA;AAC9E,IAAA,MAAM,YAAY,kBAAA,CAAmB;AAAA,MACnC,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,WAAA;AAAA,MACA,YAAY,IAAA,CAAK;AAAA,KAClB,CAAA;AACD,IAAA,MAAM,QAAA,GAAW,qCAAA,CAAsC,EAAE,gBAAA,EAAkB,WAAW,CAAA;AACtF,IAAA,OAAO,EAAE,gBAAA,EAAkB,SAAA,EAAW,WAAA,EAAa,QAAA,EAAS;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CACJ,KAAA,EACA,OAAA,GAA8B,EAAC,EACO;AACtC,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OAIF;AAAA,IACF;AACA,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,MAAM,IAAA,CAAK,aAAA,CAAc,OAAO,OAAO,CAAA;AAC5D,IAAA,OAAO,KAAK,QAAA,CAAS,EAAE,gBAAgB,IAAA,CAAK,OAAA,EAAS,UAAU,CAAA;AAAA,EACjE;AACF;AAQO,SAAS,iBAAiB,MAAA,EAA6B;AAC5D,EAAA,OAAO,OAAO,EAAE,cAAA,EAAgB,QAAA,EAAS,KAAM;AAC7C,IAAA,MAAM,EAAE,gBAAA,EAAiB,GAAI,MAAM,OAAO,OAAA,CAAQ;AAAA,MAChD,eAAA,EAAiB,cAAA;AAAA,MACjB,UAAA,EAAY,yBAAA;AAAA,MACZ;AAAA,KACD,CAAA;AACD,IAAA,OAAO,EAAE,iBAAiB,gBAAA,EAAiB;AAAA,EAC7C,CAAA;AACF","file":"index.js","sourcesContent":["/**\n * Deterministic ShhhAccount (V8.4) address derivation.\n *\n * Vendored from haycarlitos/shhh-wallet-cairo @ v8.4 commit 3975532\n * source: scripts/ts/compute-wallet-address.ts\n * license: MIT (Copyright (c) 2026 Carlos Castillo and contributors)\n *\n * Given the primary owner (kind + raw pubkey bytes) and the\n * ShhhAccount class hash, returns the Starknet address the account\n * will deploy to.\n *\n * MUST match `src/account.cairo::constructor` at the same commit. If\n * the upstream constructor changes shape, the Shhh maintainer will\n * open a PR against this file.\n */\n\nimport { hash, shortString } from \"starknet\";\n\nexport type ComputeAddressInput = {\n /** SHHH ShhhAccount class hash — see WALLET_CLASS_HASHES.SHHH in @chipi-stack/shared. */\n classHash: bigint;\n /** Primary signer kind, e.g. 'STARK' / 'ED25519' / 'WEBAUTHN_P256'. */\n primaryKind: string;\n /** Raw pubkey bytes interpreted as felt252-sized halves (kind-specific layout). */\n pubkey: bigint[];\n /** Verifier class hash for primaryKind — see SHHH_VERIFIER_CLASS_HASHES. */\n verifierClassHash: bigint;\n /** Optional user-facing tag bound into the constructor (default 'primary'). */\n label?: string;\n /** Factory / UDC address; default 0 for self-deploy. */\n deployerAddress?: bigint;\n};\n\n// poseidon_hash_span matches core::poseidon::poseidon_hash_span on-chain.\nfunction poseidon(values: Array<bigint | string>): bigint {\n const felts = values.map((v) => (typeof v === \"bigint\" ? \"0x\" + v.toString(16) : v));\n return BigInt(hash.computePoseidonHashOnElements(felts));\n}\n\n/** Mirrors `src/signer/interface.cairo::owner_commitment` = poseidon(kind_tag, pubkey...). */\nexport function ownerCommitment(kindTag: bigint, pubkey: bigint[]): bigint {\n return poseidon([kindTag, ...pubkey]);\n}\n\n/**\n * Mirrors the V8.4 constructor's salt derivation:\n * salt = poseidon(primary_kind, primary_pubkey_hash)\n * where primary_pubkey_hash = owner_commitment(primary_kind, pubkey).\n * Binding kind into the salt ensures the same raw key under two\n * different kinds produces two distinct addresses.\n */\nexport function computeAddressSalt(primaryKind: string, pubkey: bigint[]): bigint {\n if (pubkey.length === 0) {\n // Fail-fast: an empty pubkey array would still produce a deterministic\n // (but unsignable) address. Reject up front so callers can't silently\n // ship a wallet that no signer can ever authorize.\n throw new Error(\n \"computeAddressSalt: pubkey must contain at least one felt — empty signer material is rejected to prevent silent address mismatch.\"\n );\n }\n const kindTag = BigInt(shortString.encodeShortString(primaryKind));\n const pubkeyHash = ownerCommitment(kindTag, pubkey);\n return poseidon([kindTag, pubkeyHash]);\n}\n\n/** Computes the deterministic deployment address for a SHHH ShhhAccount. */\nexport function computeShhhAddress(input: ComputeAddressInput): bigint {\n const {\n classHash,\n primaryKind,\n pubkey,\n verifierClassHash,\n label = \"primary\",\n deployerAddress = 0n,\n } = input;\n\n const salt = computeAddressSalt(primaryKind, pubkey);\n const kindTag = BigInt(shortString.encodeShortString(primaryKind));\n const labelFelt = BigInt(shortString.encodeShortString(label));\n\n // Constructor calldata: [primary_kind, primary_verifier, pubkey_len, pubkey..., label]\n const ctor: Array<bigint | string> = [\n kindTag,\n verifierClassHash,\n BigInt(pubkey.length),\n ...pubkey,\n labelFelt,\n ];\n\n const addressHex = hash.calculateContractAddressFromHash(\n \"0x\" + salt.toString(16),\n \"0x\" + classHash.toString(16),\n ctor.map((x) => (typeof x === \"bigint\" ? \"0x\" + x.toString(16) : x)),\n \"0x\" + deployerAddress.toString(16)\n );\n return BigInt(addressHex);\n}\n","/**\n * SNIP-12 typed-data hash for `OutsideExecution` — TypeScript reference.\n *\n * Vendored from haycarlitos/shhh-wallet-cairo @ v8.4 commit 3975532\n * source: scripts/ts/snip12-hash.ts\n * license: MIT (Copyright (c) 2026 Carlos Castillo and contributors)\n *\n * MUST produce byte-identical output to `compute_snip12_hash` in\n * `src/outside_execution.cairo` at the same commit. If the canonical\n * Cairo source ships a breaking change, the upstream Shhh maintainer\n * will open a PR against this file (per Q3 of SHHH_INTEGRATION_ANSWERS.md).\n */\n\nimport { hash, shortString, CallData, type Call, type RawArgs } from \"starknet\";\n\n// ================================================================\n// Constants — MUST match src/outside_execution.cairo exactly.\n// ================================================================\n\nexport const OUTSIDE_EXECUTION_TYPE_HASH_REV1 =\n 0x5a4b49e17039355cd95d1f0981d75901191d1319b1f4b05a9a791d218d7e0cn;\n\nexport const CALL_TYPE_HASH_REV1 =\n 0x3635c7f2a7ba93844c0d064e18e487f35ab90f7c39d00f186a781fc3f0c2ca9n;\n\nexport const STARKNET_DOMAIN_TYPE_HASH_REV1 =\n 0x1ff2f602e42168014d405a94f75e8a93d640751d71d16311266e140d8b0a210n;\n\nexport const STARKNET_MESSAGE_PREFIX = shortString.encodeShortString(\"StarkNet Message\");\n\nexport const OE_DOMAIN_NAME = shortString.encodeShortString(\"Account.execute_from_outside\");\nexport const OE_DOMAIN_VERSION = 2n;\nexport const OE_DOMAIN_REVISION = 1n;\n\nexport const SIG_VERSION_V1_HEX_ASCII = shortString.encodeShortString(\"V1_HEX_ASCII\");\nexport const SIG_VERSION_V2_SNIP12 = shortString.encodeShortString(\"V2_SNIP12\");\nexport const SIG_VERSION_V2_THRESHOLD = shortString.encodeShortString(\"V2_THRESHOLD\");\n\n// SRC-5 interface IDs — see Cairo `src/signer/interface.cairo::ISIGNER_ID`.\nexport const ISRC9_V2_ID = BigInt(\n \"0x1d1144bb2138366ff28d8e9ab57456b1d332ac42196230c3a602003c89872\"\n);\nexport const ISIGNER_ID = BigInt(\n \"0x94c5a761f34b25a4e603c651ac0e1fc4fad9cdb5517f7fa1bb54044c7e5ef8\"\n);\n\nexport const ISIGNER_CANONICAL_LABEL = \"ISigner_V1\";\n\n/** Recomputes the canonical `ISIGNER_ID` at runtime. */\nexport function computeISignerId(): bigint {\n return BigInt(hash.starknetKeccak(ISIGNER_CANONICAL_LABEL));\n}\n\n// ================================================================\n// Types\n// ================================================================\n\nexport type OutsideExecution = {\n caller: bigint | string; // ContractAddress (hex or bigint)\n nonce: bigint | string;\n execute_after: bigint; // u64\n execute_before: bigint; // u64\n calls: Call[];\n};\n\n// ================================================================\n// Hash functions\n// ================================================================\n\nfunction toBigInt(x: bigint | string | number): bigint {\n if (typeof x === \"bigint\") return x;\n if (typeof x === \"number\") return BigInt(x);\n return BigInt(x); // accepts \"0x...\" or decimal strings\n}\n\nfunction poseidonSpan(values: Array<bigint | string>): bigint {\n const felts = values.map((v) => (typeof v === \"bigint\" ? \"0x\" + v.toString(16) : v));\n return BigInt(hash.computePoseidonHashOnElements(felts));\n}\n\nexport function hashCall(call: Call): bigint {\n const calldataFelts: string[] = CallData.toHex(\n (Array.isArray(call.calldata) ? call.calldata : [call.calldata]) as RawArgs\n );\n const calldataItems = calldataFelts.map((x) => BigInt(x));\n const calldataHash = poseidonSpan(calldataItems);\n return poseidonSpan([\n CALL_TYPE_HASH_REV1,\n toBigInt(call.contractAddress),\n toBigInt(hash.getSelector(call.entrypoint)),\n calldataHash,\n ]);\n}\n\nexport function hashCalls(calls: Call[]): bigint {\n const callHashes = calls.map(hashCall);\n return poseidonSpan(callHashes);\n}\n\nexport function hashStarknetDomain(chainIdFelt: bigint | string): bigint {\n return poseidonSpan([\n STARKNET_DOMAIN_TYPE_HASH_REV1,\n BigInt(OE_DOMAIN_NAME),\n OE_DOMAIN_VERSION,\n toBigInt(chainIdFelt),\n OE_DOMAIN_REVISION,\n ]);\n}\n\nexport function hashOutsideExecutionStruct(oe: OutsideExecution): bigint {\n const callsArrayHash = hashCalls(oe.calls);\n return poseidonSpan([\n OUTSIDE_EXECUTION_TYPE_HASH_REV1,\n toBigInt(oe.caller),\n toBigInt(oe.nonce),\n oe.execute_after,\n oe.execute_before,\n callsArrayHash,\n ]);\n}\n\n/**\n * The authoritative SNIP-12 message hash for an OutsideExecution.\n * Signers sign over this felt252 (or its hex-ASCII re-encoding for\n * Phantom UX compatibility — see snip12HashToHexAsciiBytes).\n */\nexport function computeSnip12Hash(\n oe: OutsideExecution,\n contractAddress: bigint | string,\n chainIdFelt: bigint | string\n): bigint {\n const domainHash = hashStarknetDomain(chainIdFelt);\n const structHash = hashOutsideExecutionStruct(oe);\n return poseidonSpan([\n BigInt(STARKNET_MESSAGE_PREFIX),\n domainHash,\n toBigInt(contractAddress),\n structHash,\n ]);\n}\n\n/**\n * Phantom hex-ASCII envelope helper. Phantom signs a string; we give it\n * a 64-byte hex-ASCII representation of the SNIP-12 hash, and the Cairo\n * verifier re-computes the hash and compares byte-by-byte.\n */\nexport function snip12HashToHexAsciiBytes(h: bigint): Uint8Array {\n const hex = h.toString(16).padStart(64, \"0\"); // 32 bytes -> 64 ASCII chars\n return new TextEncoder().encode(hex);\n}\n","/**\n * SHHH V8.4 threshold envelope assembly + gas estimation.\n *\n * Wave B PR B2. The single-owner OE flow already ships via\n * `wrap_v2_snip12_envelope` in `oe.ts`. This module adds the\n * multi-owner threshold flow: N owners (possibly with mixed signer\n * kinds) co-sign a single OE, and the wallet's\n * `execute_from_outside_v2` walks the envelope to verify each owner\n * independently before checking total weight against the configured\n * threshold.\n *\n * Cairo dispatch shape (`src/account.cairo:418-460`):\n *\n * signature = [\n * V2_THRESHOLD, // tag\n * n, // u32, MUST be >= 2 and <= owner_count\n * env_1_len, // u32\n * ...env_1 (env_1_len felts),\n * env_2_len,\n * ...env_2,\n * ...\n * env_n_len,\n * ...env_n,\n * ]\n *\n * Each inner frame is `[owner_id, kind_tag, ...payload]`: a single-owner\n * envelope WITHOUT its V2_SNIP12 tag, which the outer V2_THRESHOLD tag\n * replaces (`_verify_sub_envelope` reads `owner_id` at index 0). Callers\n * still pass the per-kind builders' V2_SNIP12 envelopes; the builder strips\n * the tag and `parseThresholdEnvelope` puts it back. Nested threshold\n * envelopes are not permitted.\n *\n * Cairo-enforced invariants this module replicates client-side so\n * mis-shaped envelopes fail at the SDK boundary with a clear message\n * instead of with an opaque \"THRESH: …\" Starknet revert:\n *\n * - signature.len() >= 2\n * - n >= 2 (n=1 is invalid — use V2_SNIP12 directly for single-owner)\n * - each inner env_len >= 2\n * - no buffer overflow / truncation\n * - no trailing bytes after the last inner envelope\n * - no duplicate owner_id across inner envelopes (extracted from\n * envelope[1] of each inner)\n *\n * Total-weight vs threshold is enforced ON-CHAIN (the SDK can't know\n * the configured threshold without reading on-chain state). Use\n * `estimateThresholdGasOverhead` to predict paymaster fees.\n */\n\nimport { SHHH_KIND_GAS_OVERHEAD } from \"@chipi-stack/shared\";\nimport type { ShhhSignerKind } from \"@chipi-stack/types\";\nimport { shortString } from \"starknet\";\n\nimport { SIG_VERSION_V2_SNIP12, SIG_VERSION_V2_THRESHOLD } from \"./snip12-hash\";\n\n// ================================================================\n// Constants — encode-shortstring values matched against snip12-hash.ts\n// ================================================================\n\nconst V2_SNIP12_TAG = BigInt(SIG_VERSION_V2_SNIP12);\nconst V2_THRESHOLD_TAG = BigInt(SIG_VERSION_V2_THRESHOLD);\n\n/** Minimum number of inner envelopes in a threshold (Cairo enforces >= 2). */\nexport const MIN_THRESHOLD_OWNERS = 2;\n\n// ================================================================\n// Validation\n// ================================================================\n\n/**\n * Validate that an envelope is a well-formed V2_SNIP12 single-owner\n * envelope suitable for inclusion in a threshold envelope. Returns\n * the extracted `owner_id` (envelope[1]) so the caller can dedupe.\n *\n * Rejects nested threshold envelopes (`signature[0] == V2_THRESHOLD`)\n * — V8.4 does not allow nesting; the Cairo `_verify_sub_envelope`\n * would revert with `'SRC9: bad tag'`.\n */\nexport function assertValidV2Snip12Envelope(envelope: bigint[]): bigint {\n if (envelope.length < 2) {\n throw new Error(\n `THRESH: inner envelope must have at least 2 felts (tag + owner_id); got ${envelope.length}`\n );\n }\n const tag = envelope[0];\n if (tag !== V2_SNIP12_TAG) {\n if (tag === V2_THRESHOLD_TAG) {\n throw new Error(\n \"THRESH: nested threshold envelopes are not allowed; \" + \"inner envelopes must be V2_SNIP12\"\n );\n }\n const decoded = _tryDecodeShortString(tag);\n throw new Error(\n `THRESH: inner envelope tag must be V2_SNIP12; got ${decoded ?? \"0x\" + tag.toString(16)}`\n );\n }\n return envelope[1];\n}\n\nfunction _tryDecodeShortString(felt: bigint): string | null {\n try {\n return shortString.decodeShortString(\"0x\" + felt.toString(16));\n } catch {\n return null;\n }\n}\n\n// ================================================================\n// Assembly\n// ================================================================\n\n/**\n * Build a V2_THRESHOLD envelope from a list of pre-signed V2_SNIP12\n * inner envelopes. Each inner envelope must come from a DIFFERENT\n * owner — duplicates fail loudly here instead of on-chain.\n *\n * The typical UI flow:\n * 1. Compute the OE message hash once (computeOeHash from oe.ts)\n * 2. Distribute the hash to N owners (push notification, QR, etc.)\n * 3. Each owner signs with their kind's envelope builder and\n * returns the resulting `bigint[]`\n * 4. UI collects the envelopes and calls this function\n * 5. UI submits the resulting threshold envelope as the\n * `signature` field of `paymaster_executeSponsoredRaw.calldata`\n *\n * `buildThresholdEnvelope` does NOT submit anything. It returns the\n * felt span that goes into the OE calldata.\n */\nexport function buildThresholdEnvelope(args: { innerEnvelopes: bigint[][] }): bigint[] {\n const { innerEnvelopes } = args;\n\n if (innerEnvelopes.length < MIN_THRESHOLD_OWNERS) {\n throw new Error(\n `THRESH: need at least ${MIN_THRESHOLD_OWNERS} inner envelopes; ` +\n `got ${innerEnvelopes.length}. Use wrap_v2_snip12_envelope ` +\n `for single-owner OEs.`\n );\n }\n\n // Single pass: validate, dedup owner_id, append interleaved\n // [frame_len, owner_id, kind_tag, ...payload] per inner envelope: the\n // V2_SNIP12 tag is dropped, because the contract reads owner_id at the\n // frame's first felt (`_verify_sub_envelope`; a tagged frame reverts with\n // 'THRESH: bad owner_id'). Layout matches Cairo\n // `src/account.cairo:418-454` (cursor reads env_len, then env_data,\n // then advances) — NOT the grouped [...lens, ...flat] shape an\n // earlier latent `wrapV2ThresholdEnvelope` produced. That function\n // was never called in production; removed in this PR.\n const seenOwners = new Set<string>();\n const out: bigint[] = [V2_THRESHOLD_TAG, BigInt(innerEnvelopes.length)];\n\n for (let i = 0; i < innerEnvelopes.length; i++) {\n const env = innerEnvelopes[i];\n const ownerId = assertValidV2Snip12Envelope(env);\n const key = ownerId.toString();\n if (seenOwners.has(key)) {\n throw new Error(\n `THRESH: duplicate owner_id ${\"0x\" + ownerId.toString(16)} at inner envelope ${i}`\n );\n }\n seenOwners.add(key);\n if (env.length < 3) {\n throw new Error(\n `THRESH: inner envelope ${i} must have at least [tag, owner_id, kind_tag]; got ${env.length} felts`\n );\n }\n const frame = env.slice(1);\n out.push(BigInt(frame.length));\n for (const felt of frame) {\n if (felt < 0n) {\n throw new RangeError(\n `THRESH: envelope ${i} contains negative felt (cannot serialize as felt252)`\n );\n }\n out.push(felt);\n }\n }\n\n return out;\n}\n\n// ================================================================\n// Parsing\n// ================================================================\n\n/**\n * Split a V2_THRESHOLD envelope back into its constituent inner\n * V2_SNIP12 envelopes (the tag is restored on each frame). Inverse of\n * `buildThresholdEnvelope`.\n *\n * Useful for UI flows that need to display \"N of M signers signed\n * so far\" status without re-deriving from individual envelopes. Also\n * useful in tests for round-trip validation.\n *\n * Throws if the envelope is malformed (tag mismatch, n < 2, length\n * mismatch, trailing bytes). Mirrors the Cairo dispatch's structural\n * checks (`src/account.cairo:418-456`) so the same envelope that\n * would parse-fail here would also revert on-chain.\n */\nexport function parseThresholdEnvelope(envelope: bigint[]): {\n innerEnvelopes: bigint[][];\n} {\n if (envelope.length < 2) {\n throw new Error(`THRESH: envelope too short (need at least [tag, n]); got ${envelope.length}`);\n }\n if (envelope[0] !== V2_THRESHOLD_TAG) {\n throw new Error(`THRESH: envelope tag must be V2_THRESHOLD; got 0x${envelope[0].toString(16)}`);\n }\n const n = Number(envelope[1]);\n if (!Number.isInteger(n) || n < MIN_THRESHOLD_OWNERS) {\n throw new Error(`THRESH: n must be an integer >= ${MIN_THRESHOLD_OWNERS}; got ${envelope[1]}`);\n }\n\n // Re-validate each inner envelope while parsing so a framed-but-\n // malformed envelope (nested V2_THRESHOLD, duplicate owner_id,\n // negative felts) fails here with the same error as the builder\n // would have raised. Keeps parse / build symmetric.\n const seenOwners = new Set<string>();\n const innerEnvelopes: bigint[][] = [];\n let cursor = 2;\n for (let i = 0; i < n; i++) {\n if (cursor >= envelope.length) {\n throw new Error(`THRESH: envelope truncated at inner ${i} (no length felt)`);\n }\n const envLen = Number(envelope[cursor]);\n cursor += 1;\n if (!Number.isInteger(envLen) || envLen < 2) {\n throw new Error(`THRESH: inner ${i} env_len must be >= 2; got ${envLen}`);\n }\n if (cursor + envLen > envelope.length) {\n throw new Error(\n `THRESH: inner ${i} would overflow envelope (env_len ${envLen}, ` +\n `cursor ${cursor}, total ${envelope.length})`\n );\n }\n const frame = envelope.slice(cursor, cursor + envLen);\n for (const felt of frame) {\n if (felt < 0n) {\n throw new RangeError(\n `THRESH: inner ${i} contains negative felt (cannot serialize as felt252)`\n );\n }\n }\n // Frame = [owner_id, kind_tag, ...payload]; owner_id is a u32 index.\n // A tag here (V2_SNIP12 or a nested V2_THRESHOLD) is not a u32.\n const ownerId = frame[0];\n if (ownerId >= 0x100000000n) {\n if (ownerId === V2_THRESHOLD_TAG) {\n throw new Error(\n `THRESH: inner ${i}: nested threshold envelopes are not allowed; inner frames are [owner_id, kind_tag, ...payload]`\n );\n }\n throw new Error(\n `THRESH: inner ${i} owner_id 0x${ownerId.toString(16)} is not a u32; inner frames are [owner_id, kind_tag, ...payload] with no V2_SNIP12 tag`\n );\n }\n const inner = [V2_SNIP12_TAG, ...frame];\n const key = ownerId.toString();\n if (seenOwners.has(key)) {\n throw new Error(\n `THRESH: duplicate owner_id ${\"0x\" + ownerId.toString(16)} at inner envelope ${i}`\n );\n }\n seenOwners.add(key);\n innerEnvelopes.push(inner);\n cursor += envLen;\n }\n if (cursor !== envelope.length) {\n throw new Error(\n `THRESH: trailing bytes after inner ${n - 1} (cursor ${cursor}, ` +\n `length ${envelope.length})`\n );\n }\n return { innerEnvelopes };\n}\n\n// ================================================================\n// Gas estimation\n// ================================================================\n\n/**\n * Predict the on-chain L2 gas overhead a threshold envelope will\n * consume. Each inner envelope dispatches to its kind's verifier\n * class via `library_call`, so total overhead is the sum of\n * per-kind overheads.\n *\n * Returned value is the same unit as `SHHH_KIND_GAS_OVERHEAD` in\n * `@chipi-stack/shared` (raw L2 gas units). Use to predict paymaster\n * fees:\n * estimatedFee = baselineOEGas + estimateThresholdGasOverhead(owners)\n *\n * Does NOT include the wallet's threshold-validation loop overhead\n * (the deduplication walk and weight summation) — that's a constant\n * ~50K L2 gas regardless of N, and the paymaster's fee predictor\n * already accounts for it.\n */\nexport function estimateThresholdGasOverhead(\n owners: Array<{ signerKind: ShhhSignerKind }>\n): number {\n if (owners.length < MIN_THRESHOLD_OWNERS) {\n throw new Error(\n `THRESH: need at least ${MIN_THRESHOLD_OWNERS} owners to estimate ` +\n `threshold gas; got ${owners.length}`\n );\n }\n let total = 0;\n for (const { signerKind } of owners) {\n const overhead = SHHH_KIND_GAS_OVERHEAD[signerKind];\n if (overhead === undefined) {\n throw new Error(\n `THRESH: unknown signer kind ${signerKind} — missing from ` + `SHHH_KIND_GAS_OVERHEAD`\n );\n }\n total += overhead;\n }\n return total;\n}\n","/**\n * Outside-Execution construction for SHHH V8.4 ShhhAccount.\n *\n * Wraps the canonical SNIP-12 hash + envelope assembly so SDK callers\n * never touch the underlying felt-array shapes directly. Implements\n * the envelope routing per V8.4 handover §5:\n *\n * [ signature[0] ]\n * ├─ 'V2_SNIP12' → [owner_id, kind_tag, ...payload] (single-owner)\n * ├─ 'V2_THRESHOLD' → [n, env_1_len, ..., env_n_len, ...] (multisig)\n * └─ (else, len==4) → SNIP-163 session-key envelope\n *\n * Source of truth: `src/account.cairo::execute_from_outside_v2` at\n * shhh-wallet-cairo v8.4 commit 3975532.\n */\n\nimport { shortString, type Call } from \"starknet\";\nimport {\n computeSnip12Hash,\n SIG_VERSION_V2_SNIP12,\n SIG_VERSION_V2_THRESHOLD,\n type OutsideExecution,\n} from \"./snip12-hash\";\n\n/**\n * The `caller` sentinel used for paymaster-sponsored OE flows. Any\n * forwarder may submit the OE; binding `caller = ANY_CALLER` lifts the\n * usual caller-equality check inside the account.\n */\nexport const ANY_CALLER_FELT = BigInt(shortString.encodeShortString(\"ANY_CALLER\"));\n\n/**\n * Per audit M-2, OE validity windows must not exceed 2 hours. The\n * V8.4 account enforces this on-chain; we expose the constant so SDK\n * callers can default sensibly.\n */\nexport const MAX_OE_VALIDITY_WINDOW_SECONDS = 2 * 60 * 60;\n\n/**\n * Clock-skew buffer (seconds) subtracted from `now` when defaulting\n * the OE's `execute_after`. The wallet's check at\n * `sessions-smart-contract/src/account.cairo:377` (and the matching\n * V8.4 line in `shhh-wallet-cairo/src/account.cairo`) is strict\n * `assert(execute_after < now, 'SRC9: now <= execute_after')`. If\n * the OE is built and submitted within the same second the\n * sequencer mints the next block, `execute_after == now` and the\n * wallet panics with `'SRC9: too early'`, which CHIPI v29's\n * `_execute_calls` then swallows silently. 60s is well within the\n * audit-M-2 window (2h max) and well above any realistic SDK ↔\n * sequencer clock drift.\n */\nexport const OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER = 60;\n\n/**\n * Build a standard paymaster-sponsored OutsideExecution with sensible\n * defaults. Callers can override any field; the typical happy path is\n * to pass only `nonce` + `calls`.\n */\nexport function buildOutsideExecution(params: {\n /** Unique per-account replay nonce. The account stores these in `oe_nonces`. */\n nonce: bigint | string;\n /** The calls the account should execute on success. */\n calls: Call[];\n /** Override `caller`; defaults to ANY_CALLER for paymaster flows. */\n caller?: bigint | string;\n /**\n * UNIX seconds. Defaults to `now - OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER`\n * (60s in the past) so the OE is valid by the time the next block is\n * minted regardless of small clock drifts between the SDK host and\n * the sequencer. The wallet's check is strict `<` (`account.cairo:377`\n * `'SRC9: now <= execute_after'`) — without the buffer, a fast\n * SDK→paymaster round trip can land in the SAME block as the OE\n * was built in and revert with `'SRC9: too early'`. PR sdks#289\n * (this builder fix) made the buffer the default after the first\n * session smoke run reproduced the race.\n */\n executeAfter?: bigint;\n /** UNIX seconds; defaults to now + 2h (the maximum window per audit M-2). */\n executeBefore?: bigint;\n}): OutsideExecution {\n const nowSec = BigInt(Math.floor(Date.now() / 1000));\n const after = params.executeAfter ?? nowSec - BigInt(OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER);\n // When defaulting both endpoints, keep `before - after` exactly at\n // the audit-M-2 cap. Pulling `after` back by the clock-skew buffer\n // without pulling `before` back by the same amount would push the\n // span over MAX_OE_VALIDITY_WINDOW_SECONDS and trip the validator\n // below. The explicit-override branches keep their independent\n // values (caller still gets the M-2 check).\n const before =\n params.executeBefore ??\n nowSec + BigInt(MAX_OE_VALIDITY_WINDOW_SECONDS) - BigInt(OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER);\n if (before <= after) {\n // An inverted or zero-length window passes the max-span check but produces\n // an OE that can never be valid on-chain. Reject up front.\n throw new Error(\n `executeBefore (${before}) must be strictly greater than executeAfter (${after}).`\n );\n }\n if (before - after > BigInt(MAX_OE_VALIDITY_WINDOW_SECONDS)) {\n throw new Error(\n `OE validity window ${before - after}s exceeds max ${MAX_OE_VALIDITY_WINDOW_SECONDS}s (audit M-2). Adjust executeBefore.`\n );\n }\n return {\n caller: params.caller ?? ANY_CALLER_FELT,\n nonce: params.nonce,\n execute_after: after,\n execute_before: before,\n calls: params.calls,\n };\n}\n\n/**\n * Compute the SNIP-12 hash for the given OutsideExecution against\n * a specific account address and chain. This is what the signer\n * (STARK / Ed25519 / EIP-191 / WebAuthn / etc.) commits to.\n *\n * For Phantom UX where the user signs a string, hex-encode the\n * resulting hash via `snip12HashToHexAsciiBytes` from snip12-hash.\n */\nexport function computeOeHash(\n oe: OutsideExecution,\n accountAddress: bigint | string,\n chainId: bigint | string\n): bigint {\n return computeSnip12Hash(oe, accountAddress, chainId);\n}\n\n// ================================================================\n// Envelope assembly\n// ================================================================\n\n/**\n * Single-owner V2_SNIP12 envelope.\n *\n * The account strips signature[0..2] = ['V2_SNIP12', owner_id, kind_tag]\n * and library_calls the matching verifier with `payload`. Chipi\n * paymaster passes the entire envelope verbatim to\n * `execute_from_outside_v2`; it does NOT need to know the kind.\n *\n * **`ownerId` is a u32 INDEX into the wallet's owner_set**, NOT the\n * poseidon `owner_commitment`. Primary owner = `0n`; subsequent owners\n * added via `propose_add_owner` get `1n`, `2n`, etc. The V8.4\n * dispatcher (`src/account.cairo:480`) panics with `'SHHH: bad\n * owner_id'` if signature[1] does not fit in u32 — which happens\n * silently at the wallet level (outer paymaster tx still reports\n * SUCCEEDED). Discovered 2026-05-27 in a production trace audit.\n *\n * Returns the `signature: felt252[]` span you pass to\n * `paymaster_executeSponsoredRaw.calldata`.\n */\nexport function wrapV2Snip12Envelope(params: {\n /** u32 INDEX into owner_set (0n for primary). NOT the commitment. */\n ownerId: bigint;\n kindTag: string | bigint;\n payload: Array<bigint | string>;\n}): bigint[] {\n const tag =\n typeof params.kindTag === \"bigint\"\n ? params.kindTag\n : BigInt(shortString.encodeShortString(params.kindTag));\n return [\n BigInt(SIG_VERSION_V2_SNIP12),\n params.ownerId,\n tag,\n ...params.payload.map((v) => (typeof v === \"bigint\" ? v : BigInt(v))),\n ];\n}\n\n// Threshold envelope (V2_THRESHOLD): see `./threshold.ts:buildThresholdEnvelope`\n// for the canonical builder with validation + deduplication + Cairo-\n// matching interleaved layout.\n//\n// `wrapV2ThresholdEnvelope` below is kept as a deprecated compat shim\n// for v13.x integrators who imported it directly. Wave A shipped this\n// function with the WRONG layout (grouped lens before data, instead\n// of interleaved per Cairo dispatch); it was never called in\n// production. The shim now delegates to the correct builder so any\n// existing call sites get the fixed shape with no SDK API break.\n\nimport { buildThresholdEnvelope } from \"./threshold\";\n\n/**\n * @deprecated since Wave B B2 — use `buildThresholdEnvelope` from\n * `@chipi-stack/backend/shhh/threshold` instead. This wrapper exists\n * for backward compat with v13.x and will be removed one minor\n * release after `chipi-stack@14.5.0` ships.\n *\n * Forwards to the validated builder. Note that callers passing\n * fewer than 2 envelopes (which the old version silently accepted\n * with a bogus layout) will now correctly throw — Cairo rejects\n * `n < 2` thresholds.\n */\nexport function wrapV2ThresholdEnvelope(innerEnvelopes: bigint[][]): bigint[] {\n return buildThresholdEnvelope({ innerEnvelopes });\n}\n","/**\n * Ed25519 signer for SHHH V8.4 ShhhAccount.\n *\n * Used by Phantom (Solana) flows and any generic Ed25519 signer. The\n * V8.4 verifier (class `0x030a7dfc…949f74`) consumes a Cairo-ready\n * calldata array produced by Garaga's `eddsaCalldataBuilder` — it\n * contains the signature halves plus elliptic-curve hints the Cairo\n * verifier needs to keep gas bounded.\n *\n * Reference: shhh-wallet-cairo/scripts/ts/regen-ed25519-fixtures.mjs\n *\n * Verifier overhead: ~33M l2_gas (per SHHH_KIND_GAS_OVERHEAD).\n *\n * IMPORTANT — dynamic imports\n *\n * Garaga ships a ~1.2MB WASM bundle. We dynamic-import it so callers\n * who never touch Ed25519 don't pay the bundle cost. The first call\n * to `buildEd25519Envelope` will lazy-load + initialize Garaga; this\n * is irreversible and cached for the process lifetime. Cold-start\n * cost is ~200-400ms on Android, ~80-150ms on iPhone 13+.\n *\n * `@noble/ed25519` is also dynamic-imported for symmetry, though it\n * tree-shakes cleanly as a static import too.\n */\n\nimport { shortString } from \"starknet\";\nimport { ownerCommitment } from \"../compute-wallet-address\";\nimport { wrapV2Snip12Envelope } from \"../oe\";\nimport { snip12HashToHexAsciiBytes } from \"../snip12-hash\";\n\nconst ED25519_KIND_TAG = \"ED25519\";\nconst ED25519_KIND_TAG_FELT = BigInt(shortString.encodeShortString(ED25519_KIND_TAG));\n\nlet garagaInitPromise: Promise<typeof import(\"garaga\")> | null = null;\n\n/**\n * Lazy + memoized Garaga WASM init. Safe to call repeatedly.\n *\n * On failure (e.g. transient WASM fetch error) we clear the memoized\n * promise so subsequent calls retry; otherwise a single bad init would\n * brick the SDK for the process lifetime.\n */\nasync function ensureGaragaInit(): Promise<typeof import(\"garaga\")> {\n if (garagaInitPromise) return garagaInitPromise;\n const attempt = (async () => {\n const garaga = await import(\"garaga\");\n await garaga.init();\n return garaga;\n })();\n garagaInitPromise = attempt;\n try {\n return await attempt;\n } catch (err) {\n // Reset so the next caller gets a fresh attempt instead of the\n // cached rejection.\n if (garagaInitPromise === attempt) garagaInitPromise = null;\n throw err;\n }\n}\n\n/**\n * Split a 32-byte little-endian Ed25519 value into two felt252-sized\n * halves matching Cairo's `u256` storage layout (low_u128, high_u128).\n * bytes[0] is the LSB of `low`.\n */\nfunction bytesToLeU256(bytes: Uint8Array): { low: bigint; high: bigint } {\n if (bytes.length !== 32) {\n throw new Error(`Ed25519 value must be exactly 32 bytes; got ${bytes.length}.`);\n }\n let low = 0n;\n let high = 0n;\n for (let i = 0; i < 16; i++) low += BigInt(bytes[i]) << BigInt(8 * i);\n for (let i = 0; i < 16; i++) high += BigInt(bytes[16 + i]) << BigInt(8 * i);\n return { low, high };\n}\n\nfunction bytesToLeBigInt(bytes: Uint8Array): bigint {\n let x = 0n;\n for (let i = bytes.length - 1; i >= 0; i--) x = (x << 8n) | BigInt(bytes[i]);\n return x;\n}\n\n/**\n * The Cairo Ed25519 verifier reads the SNIP-12 hash via its hex-ASCII\n * 64-byte encoding so the signature commits to a string that Phantom\n * (and any \"sign-this-string\" UX) can display. This helper is exposed\n * here for parity with the Cairo-side decoder; it's the same function\n * as `snip12HashToHexAsciiBytes` in snip12-hash.ts, re-exported under\n * a kind-specific name for discoverability.\n */\nexport function ed25519SignedBytes(messageHash: bigint): Uint8Array {\n return snip12HashToHexAsciiBytes(messageHash);\n}\n\n/**\n * Compute the V8.4 owner_id for an Ed25519-kind owner from its public\n * key. owner_id = owner_commitment(ED25519_tag, [pub_low, pub_high])\n * — the same shape as `src/signer/ed25519/verifier.cairo` expects in\n * `validate_pubkey`.\n */\nexport function ed25519OwnerId(publicKey: Uint8Array): bigint {\n const { low, high } = bytesToLeU256(publicKey);\n return ownerCommitment(ED25519_KIND_TAG_FELT, [low, high]);\n}\n\n/**\n * Ed25519 pubkey felt layout for the V8.4 constructor / propose_add_owner.\n * Returns the low/high u128 halves of the 32-byte public key in that\n * order — what the Cairo `kind == ED25519` branch reads.\n */\nexport function ed25519PubkeyFelts(publicKey: Uint8Array): bigint[] {\n const { low, high } = bytesToLeU256(publicKey);\n return [low, high];\n}\n\n/**\n * The `ownerPubkey` string for the treasury coordination endpoints\n * (`sdk.treasury.forTreasury({ ownerPubkey })`): `\"0x<low>,0x<high>\"` —\n * the comma-joined `ed25519PubkeyFelts` halves. chipi-back's\n * OwnerSignatureVerifier parses exactly this shape for ED25519 owners,\n * so use this helper rather than hand-formatting (the LE-halves split is\n * easy to get backwards).\n */\nexport function ed25519OwnerPubkeyParam(publicKey: Uint8Array): string {\n return ed25519PubkeyFelts(publicKey)\n .map((f) => \"0x\" + f.toString(16))\n .join(\",\");\n}\n\n/**\n * Build a V2_SNIP12 envelope for the Ed25519 kind. Async because the\n * underlying Garaga WASM must be initialized; subsequent calls reuse\n * the cached init.\n *\n * Inputs:\n * privateKey — 32-byte Ed25519 secret (Uint8Array, NOT hex/bigint:\n * the noble lib refuses anything else).\n * messageHash — the SNIP-12 hash of the OE (see oe.ts::computeOeHash).\n *\n * Output: the `signature` span you pass to\n * `paymaster_executeSponsoredRaw.calldata`.\n */\nexport async function buildEd25519Envelope(params: {\n privateKey: Uint8Array;\n messageHash: bigint;\n /**\n * Owner index in the wallet's owner_set. **Defaults to 0n (primary).**\n * Override for additional owners added via `propose_add_owner`.\n * MUST fit in u32 (i.e., < 2^32). Passing the poseidon\n * `owner_commitment` (e.g. via `ed25519OwnerId`) here will revert\n * on chain with `'SHHH: bad owner_id'` — the bug Shhh team caught\n * 2026-05-27 + audit-trail 2026-05-28.\n */\n ownerIndex?: bigint;\n}): Promise<bigint[]> {\n // Validate cheap params BEFORE Garaga init + signing. An out-of-range\n // ownerIndex should not pay for the ~80-400ms WASM warm-up or an ECDSA\n // sign that we will discard.\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n throw new Error(\n `buildEd25519Envelope: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32). ` +\n \"owner_id is the u32 INDEX into the wallet's owner_set (0 for primary, \" +\n \"1 for second, etc.); do NOT pass an owner_commitment or pubkey here.\"\n );\n }\n if (params.privateKey.length !== 32) {\n throw new Error(\n `Ed25519 private key must be exactly 32 bytes; got ${params.privateKey.length}.`\n );\n }\n\n // @noble/ed25519 ≥ 3.x is async-by-default and ships as ESM.\n const ed = await import(\"@noble/ed25519\");\n\n const publicKey = await ed.getPublicKeyAsync(params.privateKey);\n const signedBytes = ed25519SignedBytes(params.messageHash);\n const signature = await ed.signAsync(signedBytes, params.privateKey);\n\n // Per RFC 8032: signature = R (32B) || s (32B).\n return assembleEd25519Envelope({\n R: signature.slice(0, 32),\n s: signature.slice(32, 64),\n publicKey,\n signedBytes,\n ownerIndex,\n });\n}\n\n/**\n * Build a V2_SNIP12 Ed25519 envelope from an **externally-produced**\n * signature — the Phantom / Solana flow. Phantom (and every external\n * Ed25519 wallet) never exposes the private key: the user signs via\n * `window.solana.signMessage(...)`, which returns a 64-byte signature\n * (R‖s). This is the from-signature counterpart of\n * `buildEd25519Envelope`, mirroring `buildEip191EnvelopeFromSignature`\n * for MetaMask.\n *\n * IMPORTANT — what the wallet MUST sign:\n * The wallet must sign the EXACT bytes returned by\n * `ed25519SignedBytes(messageHash)` — the 64-byte hex-ASCII encoding\n * of the SNIP-12 OE hash — NOT the raw 32-byte `messageHash`. The\n * Cairo verifier reconstructs those same bytes from `messageHash`, so\n * a mismatch fails on chain. The dashboard adapter does:\n * await window.solana.connect();\n * // Phantom returns the 32-byte Ed25519 pubkey as a Solana PublicKey;\n * // `.toBytes()` is the Uint8Array this API expects.\n * const publicKey = window.solana.publicKey.toBytes();\n * const msg = ed25519SignedBytes(messageHash);\n * // Phantom's signMessage returns { signature: Uint8Array (64B), publicKey }.\n * const { signature } = await window.solana.signMessage(msg);\n * const env = await buildEd25519EnvelopeFromSignature({\n * signature, publicKey, messageHash,\n * });\n *\n * Async (unlike the synchronous EIP-191 from-signature path): the\n * Garaga WASM hint builder must be initialized to produce the EC hints\n * the Cairo Ed25519 verifier needs. The issue sketch (#311) showed a\n * sync return; Ed25519 cannot avoid the WASM init that secp256k1 does.\n */\nexport async function buildEd25519EnvelopeFromSignature(params: {\n /** 64-byte Ed25519 signature R(32)‖s(32) from the wallet's signMessage. */\n signature: Uint8Array;\n /** 32-byte Ed25519 public key (as Phantom returns it). */\n publicKey: Uint8Array;\n /** SNIP-12 hash of the OutsideExecution — see oe.ts::computeOeHash. */\n messageHash: bigint;\n /**\n * Owner index in the wallet's owner_set. **Defaults to 0n (primary).**\n * MUST fit in u32. Same semantics + footgun as `buildEd25519Envelope`:\n * pass the INDEX, never an `ed25519OwnerId` commitment.\n */\n ownerIndex?: bigint;\n}): Promise<bigint[]> {\n // Validate cheap params BEFORE the ~80-400ms Garaga warm-up.\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n throw new Error(\n `buildEd25519EnvelopeFromSignature: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32). ` +\n \"owner_id is the u32 INDEX into the wallet's owner_set (0 for primary); \" +\n \"do NOT pass an owner_commitment or pubkey here.\"\n );\n }\n if (params.signature.length !== 64) {\n throw new Error(\n `Ed25519 signature must be exactly 64 bytes (R‖s); got ${params.signature.length}.`\n );\n }\n if (params.publicKey.length !== 32) {\n throw new Error(`Ed25519 public key must be exactly 32 bytes; got ${params.publicKey.length}.`);\n }\n\n const signedBytes = ed25519SignedBytes(params.messageHash);\n return assembleEd25519Envelope({\n R: params.signature.slice(0, 32),\n s: params.signature.slice(32, 64),\n publicKey: params.publicKey,\n signedBytes,\n ownerIndex,\n });\n}\n\n/**\n * Shared core for both Ed25519 builders: run Garaga's hint builder over\n * the signature halves + pubkey + signed message, then wrap in the\n * V2_SNIP12 envelope. The locally-signed and from-signature paths differ\n * ONLY in where (R, s, publicKey) come from — everything downstream is\n * identical, which is exactly what the parity test asserts.\n */\nasync function assembleEd25519Envelope(parts: {\n R: Uint8Array;\n s: Uint8Array;\n publicKey: Uint8Array;\n signedBytes: Uint8Array;\n ownerIndex: bigint;\n}): Promise<bigint[]> {\n const garaga = await ensureGaragaInit();\n\n // Garaga's eddsaCalldataBuilder(Ry_le_bigint, s_le_bigint, Py_le_bigint, msg, prependPublickey=false)\n // returns the calldata array Cairo's Ed25519 verifier consumes:\n // [ Ry_low, Ry_high, s_low, s_high,\n // msg_len, msg_byte_0, ..., msg_byte_{msg_len-1},\n // ...msm_hint..., ...sqrt_Rx_hint..., ...sqrt_Px_hint... ]\n const payload = (garaga as any).eddsaCalldataBuilder(\n bytesToLeBigInt(parts.R),\n bytesToLeBigInt(parts.s),\n bytesToLeBigInt(parts.publicKey),\n parts.signedBytes,\n false\n );\n\n return wrapV2Snip12Envelope({\n ownerId: parts.ownerIndex,\n kindTag: ED25519_KIND_TAG,\n payload: payload as Array<bigint | string>,\n });\n}\n","import CryptoES from \"crypto-es\";\n\nexport const encryptPrivateKey = (privateKey: string, password: string): string => {\n if (!privateKey || !password) {\n throw new Error(\"Private key and password are required\");\n }\n\n return CryptoES.AES.encrypt(privateKey, password).toString();\n};\n\nexport const decryptPrivateKey = (encryptedPrivateKey: string, password: string): string => {\n if (!encryptedPrivateKey || !password) {\n throw new Error(\"Encrypted private key and password are required\");\n }\n\n try {\n const bytes = CryptoES.AES.decrypt(encryptedPrivateKey, password);\n const decrypted = bytes.toString(CryptoES.enc.Utf8);\n if (!decrypted) {\n throw new Error(\"Decryption resulted in empty string\");\n }\n return decrypted;\n } catch (error) {\n if (error instanceof Error) {\n throw error;\n }\n throw new Error(`Decryption failed: ${error}`);\n }\n};\n","export { encryptPrivateKey, decryptPrivateKey } from \"./lib/encryption\";\n","/**\n * STARK ECDSA signer for SHHH V8.4 ShhhAccount.\n *\n * Cheapest verifier path (~2M l2_gas). Native Stark-curve ECDSA over\n * the SNIP-12 hash; the verifier class is a thin syscall wrapper.\n *\n * Reference: shhh-wallet-cairo/scripts/ts/gen-phase3-account-fixture.mjs\n * (same Stark signature shape, wrapped in V2_SNIP12).\n *\n * For non-STARK kinds (Ed25519, EIP-191, WebAuthn, JWT, BLS) the\n * envelope payload is per-kind — see sibling files in this directory.\n */\n\nimport { ec, shortString } from \"starknet\";\nimport { ownerCommitment } from \"../compute-wallet-address\";\nimport { wrapV2Snip12Envelope } from \"../oe\";\n\nconst STARK_KIND_TAG = \"STARK\";\nconst STARK_KIND_TAG_FELT = BigInt(shortString.encodeShortString(STARK_KIND_TAG));\n\n/**\n * Build a V2_SNIP12 envelope for the STARK kind from a private key +\n * the OE's SNIP-12 hash. The envelope is the `signature` span you\n * pass to `paymaster_executeSponsoredRaw.calldata`.\n *\n * Payload for STARK is exactly `[r, s]` — the verifier reads these\n * two felts and invokes the chain's `ec_op` syscall.\n *\n * **Envelope layout (V8.4):** `[V2_SNIP12, owner_id, kind_tag, ...payload]`\n *\n * `owner_id` at position [1] is a **u32 INDEX into the owner_set**,\n * NOT the poseidon `owner_commitment`. For the primary owner of a\n * fresh deploy that index is `0n`; for additional owners added via\n * `propose_add_owner` it's `1n`, `2n`, etc. The V8.4 dispatcher\n * (`src/account.cairo:480`) does `(*signature.at(1)).try_into::<u32>()`\n * and panics with `'SHHH: bad owner_id'` if the felt exceeds u32 MAX —\n * which is exactly what happens if a poseidon commitment is passed\n * here instead of the index. (Discovered 2026-05-27 trace audit on\n * tx 0x1d1ee02e0dd1ffdbc6f0dddb426098d0dc87800eee3d0d0201e74d97ddc0a55.)\n */\nexport function buildStarkEnvelope(params: {\n /** STARK private key as bigint or 0x-prefixed hex. */\n privateKey: bigint | string;\n /** SNIP-12 hash of the OutsideExecution — see oe.ts::computeOeHash. */\n messageHash: bigint;\n /**\n * Owner index in the wallet's owner_set. **Defaults to 0n (primary).**\n * Override for additional owners added via `propose_add_owner`.\n * MUST fit in u32 (i.e., < 2^32). Passing the poseidon\n * `owner_commitment` here will revert on chain with\n * `'SHHH: bad owner_id'`.\n */\n ownerIndex?: bigint;\n}): bigint[] {\n // starknet.js getStarkKey/sign accept hex strings, not raw bigints.\n // Normalize to 0x-prefixed 64-char hex regardless of input form.\n const pkHex =\n \"0x\" +\n (typeof params.privateKey === \"bigint\" ? params.privateKey : BigInt(params.privateKey))\n .toString(16)\n .padStart(64, \"0\");\n\n const sig = ec.starkCurve.sign(\"0x\" + params.messageHash.toString(16), pkHex);\n\n const r = BigInt(\"0x\" + sig.r.toString(16));\n const s = BigInt(\"0x\" + sig.s.toString(16));\n\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n // u32 range check matches the on-chain try_into bound; surface as\n // a loud SDK-side error instead of a silent on-chain revert.\n throw new Error(\n `buildStarkEnvelope: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32). ` +\n \"owner_id is the u32 INDEX into the wallet's owner_set (0 for primary, \" +\n \"1 for second, etc.); do NOT pass an owner_commitment or pubkey here.\"\n );\n }\n\n return wrapV2Snip12Envelope({\n ownerId: ownerIndex,\n kindTag: STARK_KIND_TAG,\n payload: [r, s],\n });\n}\n\n/**\n * Compute the V8.4 owner_id for a STARK-kind owner from its public\n * key. owner_id = owner_commitment(kind_tag, [pubkey]) per\n * `src/signer/interface.cairo::owner_commitment`. The account uses\n * this to dedupe owners and select the verifier class.\n */\nexport function starkOwnerId(starkPubKey: bigint): bigint {\n return ownerCommitment(STARK_KIND_TAG_FELT, [starkPubKey]);\n}\n\n/**\n * STARK pubkey layout for the V8.4 constructor / propose_add_owner.\n * The Stark curve pubkey fits in one felt252, so this is a 1-element\n * array. Kept as a function for parity with kinds that split the\n * pubkey into multiple felts (Ed25519, secp256k1, P-256, BLS).\n */\nexport function starkPubkeyFelts(starkPubKey: bigint | string): bigint[] {\n return [typeof starkPubKey === \"bigint\" ? starkPubKey : BigInt(starkPubKey)];\n}\n","/**\n * High-level SHHH V8.4 OE execution path for the backend SDK.\n *\n * This module is the glue between the low-level OE builders in\n * `oe.ts` + `signers/*.ts` and chipi-back's\n * `POST /transactions/execute-sponsored-raw` endpoint.\n *\n * Why this exists separately from the legacy\n * `executePaymasterTransaction` flow:\n *\n * - The Chipi paymaster cannot synthesize SHHH envelopes server-side\n * (each of the 10 V8.4 signer kinds has a different envelope\n * shape; the paymaster's design — see chipi-pay/paymaster#16 — is\n * to pass the signature span verbatim to `execute_from_outside_v2`).\n * - Therefore SHHH clients MUST build + sign the OE locally and\n * submit it pre-signed to a forwarding endpoint\n * (`/transactions/execute-sponsored-raw`).\n * - The legacy flow (`prepare-typed-data` → sign → `execute-sponsored-\n * transaction`) is unchanged and continues to serve CHIPI / READY\n * wallets.\n *\n * Scope (Wave B, this PR): STARK + ED25519 signer kinds.\n * EIP-191 / WEBAUTHN_P256 / JWT_ES256_APPLE_SUB still throw the\n * deferred-feature error until the external-rooted wallet adapter\n * flow lands.\n */\n\nimport { hash, type Call } from \"starknet\";\nimport { decryptPrivateKey } from \"../encryption\";\nimport type { ChipiClient } from \"../client\";\nimport { buildOutsideExecution, computeOeHash, ANY_CALLER_FELT } from \"./oe\";\nimport { buildStarkEnvelope } from \"./signers/stark\";\nimport { buildEd25519Envelope } from \"./signers/ed25519\";\n\n// Default chain ID for SHHH OE signing. Chipi Pay operates exclusively\n// on Starknet mainnet per CLAUDE.md (\"ALWAYS mainnet — Chipi Pay\n// operates exclusively on Starknet mainnet. Staging, tests, and\n// production all use mainnet\"). Callers on non-mainnet environments\n// can override via the `chainId` param on `executeShhhSponsoredRaw`.\n// Drift here = SNIP-12 signature mismatch and on-chain rejection.\nconst SN_MAIN_CHAIN_ID = \"0x534e5f4d41494e\"; // shortString.encodeShortString(\"SN_MAIN\")\nconst SN_SEPOLIA_CHAIN_ID = \"0x534e5f5345504f4c4941\"; // shortString.encodeShortString(\"SN_SEPOLIA\")\n\n/**\n * Pick the chain ID for SNIP-12 hashing. If the caller did not provide\n * an explicit override, infer from the chipi-back base URL (sepolia\n * hostnames map to SN_SEPOLIA; everything else maps to SN_MAIN per\n * the project's mainnet-only invariant).\n *\n * Exported for unit-testing the resolver in isolation.\n */\nexport function resolveShhhChainId(params: {\n override?: bigint | string;\n baseUrl?: string;\n}): string {\n if (params.override !== undefined) {\n return typeof params.override === \"bigint\"\n ? \"0x\" + params.override.toString(16)\n : params.override;\n }\n const url = (params.baseUrl ?? \"\").toLowerCase();\n if (url.includes(\"sepolia\")) return SN_SEPOLIA_CHAIN_ID;\n return SN_MAIN_CHAIN_ID;\n}\n\n/**\n * Serialize an OutsideExecution struct + signature span into the\n * flat felt-array calldata that `execute_from_outside_v2` expects.\n *\n * Cairo's serde order (per shhh-wallet-cairo v8.4\n * `src/account.cairo::execute_from_outside_v2`):\n *\n * caller\n * nonce\n * execute_after (u64, 1 felt)\n * execute_before (u64, 1 felt)\n * calls.len()\n * for each Call:\n * to (felt)\n * selector (felt)\n * calldata.len()\n * ...calldata felts\n * signature.len()\n * ...signature felts\n *\n * Returns 0x-prefixed lowercase hex strings ready for direct\n * JSON-RPC submission via the chipi-back forwarder.\n */\nexport function serializeExecuteFromOutsideV2Calldata(params: {\n outsideExecution: {\n caller: bigint | string;\n nonce: bigint | string;\n execute_after: bigint;\n execute_before: bigint;\n calls: Call[];\n };\n signature: bigint[];\n}): string[] {\n const out: bigint[] = [];\n const oe = params.outsideExecution;\n\n const toBig = (v: bigint | string): bigint => (typeof v === \"bigint\" ? v : BigInt(v));\n\n out.push(toBig(oe.caller));\n out.push(toBig(oe.nonce));\n out.push(oe.execute_after);\n out.push(oe.execute_before);\n\n out.push(BigInt(oe.calls.length));\n for (const call of oe.calls) {\n out.push(BigInt(call.contractAddress));\n out.push(BigInt(hash.getSelector(call.entrypoint)));\n const callData = Array.isArray(call.calldata)\n ? (call.calldata as Array<string | number | bigint>)\n : [];\n out.push(BigInt(callData.length));\n for (const datum of callData) {\n out.push(typeof datum === \"bigint\" ? datum : BigInt(datum));\n }\n }\n\n out.push(BigInt(params.signature.length));\n for (const sigFelt of params.signature) {\n out.push(sigFelt);\n }\n\n return out.map((v) => \"0x\" + v.toString(16));\n}\n\n/**\n * Generate a unique OE nonce. The V8.4 account stores consumed nonces\n * in `oe_nonces` and rejects replays, so we need something with enough\n * entropy to avoid collisions across concurrent SDK calls. Combines\n * `Date.now()` (ms) with a 24-bit random suffix; both fit comfortably\n * in a felt252.\n */\nexport function newOeNonce(): bigint {\n const tsMs = BigInt(Date.now());\n const rand = BigInt(Math.floor(Math.random() * 0xffffff));\n // Shift the timestamp left by 24 bits and OR the random suffix to\n // produce a single felt-sized value. ~85 years of millisecond range\n // before the high bits push past 252 bits.\n return (tsMs << 24n) | rand;\n}\n\n/**\n * Decrypt the wallet's STARK private key from its\n * `encryptedPrivateKey` ciphertext + the per-wallet `encryptKey` (PIN\n * or passkey-derived secret), build a SHHH V8.4 OE around the given\n * inner calls, sign it with the wallet's STARK key, serialize the\n * calldata for `execute_from_outside_v2`, and forward to chipi-back's\n * `/transactions/execute-sponsored-raw` endpoint.\n *\n * Returns the on-chain transaction hash.\n *\n * Pre-conditions:\n * - `wallet.walletType === \"SHHH\"`.\n * - `wallet.publicKey` is the deployed account address (NOT the raw\n * STARK pubkey; V8.4 deployment derives address from kind-bound\n * salt + verifier).\n * - `wallet.encryptedPrivateKey` decrypts cleanly with `encryptKey`.\n * - The wallet is already deployed (no deploy_and_invoke variant\n * here; that flow stays inside `createWallet`).\n */\nexport async function executeShhhSponsoredRaw(params: {\n client: ChipiClient;\n bearerToken: string;\n wallet: {\n publicKey: string;\n encryptedPrivateKey: string;\n walletType?: string;\n };\n encryptKey: string;\n calls: Call[];\n /**\n * Defaults to `\"STARK\"`. Wave B ships STARK + ED25519. EIP-191 /\n * WEBAUTHN_P256 / JWT_ES256_APPLE_SUB are deferred to the\n * external-rooted wallet adapter PRs.\n */\n signerKind?: \"STARK\" | \"ED25519\";\n /** Override the OE nonce; default = `Date.now() << 24 | random24bit`. */\n nonce?: bigint;\n /** Optional externalUserId for the audit-log hint. */\n externalUserId?: string;\n /**\n * Override the chain ID used for SNIP-12 hashing. Defaults to\n * mainnet per CLAUDE.md's mainnet-only invariant; sepolia is auto-\n * inferred from the chipi-back base URL when present. Drift here\n * = the V8.4 account rejects the signature on chain.\n */\n chainId?: bigint | string;\n}): Promise<string> {\n const signerKind = params.signerKind ?? \"STARK\";\n const SDK_SHIPPED_OE_KINDS = [\"STARK\", \"ED25519\"] as const;\n if (!SDK_SHIPPED_OE_KINDS.includes(signerKind as (typeof SDK_SHIPPED_OE_KINDS)[number])) {\n throw new Error(\n `SHHH signerKind=\"${signerKind}\" is not yet shipped from the SDK ` +\n \"(Wave B ships STARK + ED25519). Wait for the follow-up PR that \" +\n \"adds external-rooted (MetaMask, Phantom, passkey, Apple) signing.\"\n );\n }\n\n const privateKeyHex = decryptPrivateKey(params.wallet.encryptedPrivateKey, params.encryptKey);\n if (!privateKeyHex) {\n throw new Error(\n \"Failed to decrypt private key for SHHH OE. Verify the encryptKey matches the one used at wallet creation.\"\n );\n }\n\n const oe = buildOutsideExecution({\n nonce: params.nonce ?? newOeNonce(),\n calls: params.calls,\n caller: ANY_CALLER_FELT,\n });\n\n const chainId = resolveShhhChainId({\n override: params.chainId,\n baseUrl: params.client.baseUrl,\n });\n const messageHash = computeOeHash(oe, params.wallet.publicKey, chainId);\n\n let signature: bigint[];\n if (signerKind === \"STARK\") {\n signature = buildStarkEnvelope({\n privateKey: privateKeyHex,\n messageHash,\n });\n } else {\n // ED25519 — decode the stored hex private key back to 32 raw bytes\n // and route through the Ed25519 envelope builder. The builder\n // generates RFC 8032 deterministic signatures + the Garaga\n // calldata hints the Cairo verifier requires.\n //\n // Defensive 0x prefix strip: today the wallet-creation path stores\n // bare hex (no prefix), but a future storage migration might add\n // one. Normalizing here keeps the validator's error message\n // accurate either way.\n const edKeyHex = privateKeyHex.startsWith(\"0x\") ? privateKeyHex.slice(2) : privateKeyHex;\n if (edKeyHex.length !== 64) {\n throw new Error(\n `SHHH ED25519 private key is ${edKeyHex.length} hex chars; expected 64 (32 raw bytes). ` +\n \"The stored ciphertext does not look like a Chipi-held Ed25519 key — check wallet provenance.\"\n );\n }\n const edPrivKey = Uint8Array.from(Buffer.from(edKeyHex, \"hex\"));\n signature = await buildEd25519Envelope({\n privateKey: edPrivKey,\n messageHash,\n });\n }\n\n const calldata = serializeExecuteFromOutsideV2Calldata({\n outsideExecution: oe,\n signature,\n });\n\n // Forward to chipi-back's /transactions/execute-sponsored-raw. The\n // endpoint owns the paymaster JSON-RPC call (paymaster cannot be\n // hit directly without the paymaster API key, which lives only on\n // chipi-back). chipi-back also records the resulting Transaction.\n const response = await params.client.post<{\n transactionHash?: string;\n id?: string;\n }>({\n endpoint: \"/transactions/execute-sponsored-raw\",\n bearerToken: params.bearerToken,\n body: {\n accountAddress: params.wallet.publicKey,\n calldata,\n signerKind,\n ...(params.externalUserId ? { externalUserId: params.externalUserId } : {}),\n },\n });\n\n // The endpoint returns either a saved Transaction row (with\n // `transactionHash`) or `{ transactionHash, trackingId }` when\n // saveToDatabase=false. Either way the hash is at the top level.\n if (!response || !response.transactionHash) {\n throw new Error(\n \"execute-sponsored-raw response missing transactionHash. Check the chipi-back logs for upstream paymaster errors.\"\n );\n }\n return response.transactionHash;\n}\n","import type { ChipiSDKConfig } from \"@chipi-stack/types\";\nimport {\n isValidApiKey,\n handleApiError,\n validateErrorResponse,\n STARKNET_NETWORKS,\n API_VERSIONING,\n} from \"@chipi-stack/shared\";\nimport { ChipiAuthError, ChipiApiError } from \"@chipi-stack/shared\";\n\n/**\n * HTTP client for Chipi API interactions\n */\nexport class ChipiClient {\n private apiPublicKey: string;\n baseUrl: string;\n nodeUrl: string;\n private customAlphaUrl?: string;\n private sdkVersion: string;\n\n constructor(config: ChipiSDKConfig) {\n if (!isValidApiKey(config.apiPublicKey)) {\n throw new ChipiAuthError(\"Invalid API key format\");\n }\n\n this.apiPublicKey = config.apiPublicKey;\n this.customAlphaUrl = config.alphaUrl;\n this.baseUrl = this.getBaseUrl();\n this.nodeUrl = config.nodeUrl || STARKNET_NETWORKS.MAINNET;\n this.sdkVersion = \"14.0.0\";\n }\n\n /**\n * Get the API public key (for internal SDK use)\n */\n getApiPublicKey(): string {\n return this.apiPublicKey;\n }\n\n private getBaseUrl(): string {\n const version = `v${API_VERSIONING.VERSION}`;\n\n if (this.customAlphaUrl) {\n // Remove any existing version suffix and add the current one\n const cleanUrl = this.customAlphaUrl.replace(/\\/v\\d+\\/?$/, \"\").replace(/\\/$/, \"\");\n return `${cleanUrl}/${version}`;\n }\n\n return `https://api.chipipay.com/${version}`;\n }\n\n /**\n * Add API version query parameters to track the API version being used\n * This helps the backend handle versioning and track which SDK versions are in use\n */\n private addVersionParams(url: URL): void {\n url.searchParams.append(\"__chipi_api_version\", API_VERSIONING.VERSION_DATE);\n }\n\n private getHeaders(bearerToken?: string): Record<string, string> {\n const headers: Record<string, string> = {\n \"Content-Type\": \"application/json\",\n \"x-api-key\": this.apiPublicKey,\n };\n\n if (bearerToken) {\n headers[\"Authorization\"] = `Bearer ${bearerToken}`;\n }\n\n return headers;\n }\n\n async get<T>({\n endpoint,\n params,\n bearerToken,\n }: {\n endpoint: string;\n params?: Record<string, any>;\n bearerToken?: string;\n }): Promise<T> {\n try {\n const url = new URL(`${this.baseUrl}${endpoint}`);\n\n // Add version tracking parameters\n this.addVersionParams(url);\n\n if (params) {\n Object.entries(params).forEach(([key, value]) => {\n if (value !== undefined && value !== null) {\n url.searchParams.append(key, String(value));\n }\n });\n }\n\n const response = await fetch(url.toString(), {\n method: \"GET\",\n headers: this.getHeaders(bearerToken),\n });\n\n const data = await response.json();\n\n if (!response.ok) {\n const errorData = validateErrorResponse(data);\n throw new ChipiApiError(\n errorData.message,\n errorData.code || `HTTP_${response.status}`,\n response.status,\n data\n );\n }\n\n return data as T;\n } catch (error) {\n throw handleApiError(error);\n }\n }\n\n async post<T>({\n endpoint,\n bearerToken,\n body,\n headers,\n }: {\n endpoint: string;\n bearerToken: string;\n body?: Record<string, any>;\n /** Extra request headers, e.g. `X-PAYMENT`. Cannot override auth or content type. */\n headers?: Record<string, string>;\n }): Promise<T> {\n try {\n const url = new URL(`${this.baseUrl}${endpoint}`);\n\n // Add version tracking parameters\n this.addVersionParams(url);\n\n const response = await fetch(url.toString(), {\n method: \"POST\",\n headers: { ...headers, ...this.getHeaders(bearerToken) },\n body: body ? JSON.stringify(body) : undefined,\n });\n\n const data = await response.json();\n\n if (!response.ok) {\n const errorData = validateErrorResponse(data);\n throw new ChipiApiError(\n errorData.message,\n errorData.code || `HTTP_${response.status}`,\n response.status,\n data\n );\n }\n return data as T;\n } catch (error) {\n throw handleApiError(error);\n }\n }\n\n async put<T>({\n endpoint,\n bearerToken,\n body,\n }: {\n endpoint: string;\n bearerToken: string;\n body?: Record<string, any>;\n }): Promise<T> {\n try {\n const url = new URL(`${this.baseUrl}${endpoint}`);\n\n // Add version tracking parameters\n this.addVersionParams(url);\n\n const response = await fetch(url.toString(), {\n method: \"PUT\",\n headers: this.getHeaders(bearerToken),\n body: body ? JSON.stringify(body) : undefined,\n });\n\n const data = await response.json();\n\n if (!response.ok) {\n const errorData = validateErrorResponse(data);\n throw new ChipiApiError(\n errorData.message,\n errorData.code || `HTTP_${response.status}`,\n response.status,\n data\n );\n }\n\n return data as T;\n } catch (error) {\n throw handleApiError(error);\n }\n }\n\n async patch<T>({\n endpoint,\n bearerToken,\n body,\n }: {\n endpoint: string;\n bearerToken: string;\n body?: Record<string, any>;\n }): Promise<T> {\n try {\n const url = new URL(`${this.baseUrl}${endpoint}`);\n\n // Add version tracking parameters\n this.addVersionParams(url);\n\n const response = await fetch(url.toString(), {\n method: \"PATCH\",\n headers: this.getHeaders(bearerToken),\n body: body ? JSON.stringify(body) : undefined,\n });\n\n const data = await response.json();\n\n if (!response.ok) {\n const errorData = validateErrorResponse(data);\n throw new ChipiApiError(\n errorData.message,\n errorData.code || `HTTP_${response.status}`,\n response.status,\n data\n );\n }\n\n return data as T;\n } catch (error) {\n throw handleApiError(error);\n }\n }\n\n async delete<T>({\n endpoint,\n bearerToken,\n }: {\n endpoint: string;\n bearerToken: string;\n }): Promise<T> {\n try {\n const url = new URL(`${this.baseUrl}${endpoint}`);\n\n // Add version tracking parameters\n this.addVersionParams(url);\n\n const response = await fetch(url.toString(), {\n method: \"DELETE\",\n headers: this.getHeaders(bearerToken),\n });\n\n const data = await response.json();\n\n if (!response.ok) {\n const errorData = validateErrorResponse(data);\n throw new ChipiApiError(\n errorData.message,\n errorData.code || `HTTP_${response.status}`,\n response.status,\n data\n );\n }\n\n return data as T;\n } catch (error) {\n throw handleApiError(error);\n }\n }\n}\n","import type {\n CreateWalletParams,\n CreateWalletResponse,\n PrepareWalletCreationResponse,\n CreateCustodialWalletParams,\n GetWalletParams,\n WalletData,\n GetWalletResponse,\n GetTokenBalanceParams,\n GetTokenBalanceResponse,\n WalletType,\n DeploymentData,\n UpdateWalletEncryptionParams,\n UpdateWalletEncryptionResponse,\n PrepareWalletUpgradeParams,\n PrepareWalletUpgradeResponse,\n ExecuteWalletUpgradeParams,\n ExecuteWalletUpgradeResponse,\n} from \"@chipi-stack/types\";\nimport {\n API_ENDPOINTS,\n SHHH_VERIFIER_CLASS_HASHES,\n WALLET_CLASS_HASHES,\n WALLET_RPC_ENDPOINTS,\n} from \"@chipi-stack/shared\";\nimport { ChipiClient } from \"./client\";\nimport CryptoES from \"crypto-es\";\n\nimport { ChipiTransactionError, ChipiApiError } from \"@chipi-stack/shared\";\nimport { computeShhhAddress } from \"./shhh/compute-wallet-address\";\nimport { ed25519PubkeyFelts } from \"./shhh/signers/ed25519\";\nimport { shortString } from \"starknet\";\nimport { randomBytes } from \"crypto\";\nimport {\n Account,\n CairoCustomEnum,\n CairoOption,\n CairoOptionVariant,\n CallData,\n ec,\n hash,\n num,\n RpcProvider,\n stark,\n} from \"starknet\";\nimport { encryptPrivateKey } from \"./encryption\";\nimport {\n migrateChipiWalletToShhh,\n type MigrateChipiWalletToShhhParams,\n type MigrationOutcome,\n} from \"./migrate-to-shhh\";\n\n// Local DeploymentData type (replacing @avnu/gasless-sdk dependency)\n/**\n * Wallet management utilities\n */\nexport class ChipiWallets {\n constructor(private client: ChipiClient) {}\n\n /**\n * Create a new wallet on Starknet (gasless, paymaster-sponsored).\n *\n * **PIN is weak — not recommended for production.** `encryptKey` here\n * doubles as the only thing decrypting the wallet's private key. A\n * user-typed PIN is short, low-entropy, and trivially compromised\n * by shoulder-surfing or phishing. Production embedded-wallet apps\n * should derive `encryptKey` from a platform passkey\n * (`@chipi-stack/chipi-passkey` `getWalletEncryptKey` for the legacy\n * PRF flow, or — preferred — `createShhhPasskey` for new SHHH\n * V8.4 wallets where the P-256 key never leaves the platform\n * authenticator at all). PIN remains only as a last-resort\n * recovery surface for users without WebAuthn / biometrics.\n */\n async createWallet(\n params: CreateWalletParams & { bearerToken: string }\n ): Promise<CreateWalletResponse> {\n try {\n const {\n encryptKey,\n externalUserId,\n bearerToken,\n userId,\n // P2.2 default flip (re-applied 2026-05-29 after #270 revert and\n // the post-revert SHHH bug-fix run #271–#296). New wallets\n // default to SHHH V8.4 instead of legacy CHIPI v29 — pluggable-\n // signer Starknet account, guardian recovery, threshold support\n // out of the box. Existing wallets unaffected; this only\n // changes the default for callers that omit `walletType`.\n // Callers who explicitly pass `walletType: \"CHIPI\"` or\n // `\"READY\"` continue producing those.\n //\n // Server-side override: chipi-back's CHIPI_SHHH_DEFAULT env\n // var (chipi-back#267) lets ops force the legacy default back\n // for callers that bypass the SDK and POST to /chipi-wallets\n // directly without walletType.\n //\n // signerKind under the SHHH branch defaults to \"STARK\" further\n // down — same kind the original #267 P2.2 used and the same\n // kind every mainnet smoke since 2026-05-26 has been signing\n // under.\n walletType = \"SHHH\",\n classHash: customClassHash,\n usePasskey,\n chain,\n } = params;\n\n if (!encryptKey) {\n if (usePasskey) {\n throw new Error(\n \"encryptKey is required when using passkey. The passkey authentication should have provided the encryptKey.\"\n );\n }\n throw new Error(\"encryptKey is required for wallet creation\");\n }\n\n // SHHH V8.4 wallets use a different address derivation\n // (computeShhhAddress) and a different constructor calldata\n // shape ([kind, verifier, pubkey_len, *pubkey, label]). They\n // also use the SHHH paymaster lane on the same Chipi RPC.\n //\n // Wave B (this PR) ships ED25519 on top of the STARK default.\n // EIP-191 / WEBAUTHN_P256 / JWT_ES256_APPLE_SUB still throw the\n // deferred-feature error until their respective follow-up PRs\n // wire the wallet-adapter pubkey input (browser / OAuth context\n // the backend SDK doesn't have).\n const isShhh = walletType === \"SHHH\";\n const effectiveSignerKind = isShhh ? (params.signerKind ?? \"STARK\") : undefined;\n const SDK_SHIPPED_SHHH_KINDS = [\n \"STARK\",\n \"ED25519\",\n \"WEBAUTHN_P256\",\n \"EIP191_SECP256K1\",\n ] as const;\n if (\n isShhh &&\n !SDK_SHIPPED_SHHH_KINDS.includes(\n effectiveSignerKind as (typeof SDK_SHIPPED_SHHH_KINDS)[number]\n )\n ) {\n throw new Error(\n `SHHH signerKind=${effectiveSignerKind} is not yet shipped from the SDK ` +\n `(supports STARK, ED25519, WEBAUTHN_P256, EIP191_SECP256K1). ` +\n `JWT_ES256_APPLE_SUB and others remain deferred to their ` +\n \"follow-up PRs (OAuth / Apple-Developer context).\"\n );\n }\n\n // Select RPC endpoint based on wallet type. SHHH uses the same\n // RPC pool as CHIPI today; if the V8.4 paymaster ever moves to\n // its own lane this becomes a third branch.\n const rpcUrl =\n walletType === \"READY\" ? WALLET_RPC_ENDPOINTS.READY : WALLET_RPC_ENDPOINTS.CHIPI;\n\n const provider = new RpcProvider({ nodeUrl: rpcUrl });\n\n // Generating the private key with Stark Curve. For SHHH STARK\n // this is exactly the same as CHIPI/READY: Chipi generates and\n // holds the STARK key, encrypts it with encryptKey, and the\n // user's passkey/PIN unwraps it at sign time.\n const privateKeyAX = this.getPrivateKeyAX();\n const starkKeyPubAX = ec.starkCurve.getStarkKey(privateKeyAX);\n\n let constructorCallData: string[];\n let accountClassHash: string;\n let publicKey: string;\n let deploymentSalt: string;\n // SHHH-only metadata sent through to chipi-back so the new\n // signerKind / ownerPublicKey columns get populated.\n let shhhOwnerPubkeyFelts: string[] | undefined;\n // For SHHH non-STARK kinds the Chipi-held key isn't the STARK\n // key. Default to STARK so CHIPI/READY/SHHH-STARK keep using\n // privateKeyAX (the existing behavior). ED25519 overrides this.\n // Empty string = external-rooted (no Chipi-held key to store).\n let shhhKeyForEncryption: string = privateKeyAX;\n\n if (isShhh) {\n // Resolve the pubkey felts + the Chipi-held private key (if any)\n // for the chosen signer kind. STARK and ED25519 both have\n // Chipi-held paths today; ED25519 also accepts caller-supplied\n // `ownerPubkeyFelts` (external-rooted, Phantom shape) which we\n // surface via the same code path.\n let pubkeyFelts: bigint[];\n let shhhPrivateKeyHex: string;\n if (effectiveSignerKind === \"STARK\") {\n // Chipi-held STARK: reuse the STARK key we already generated.\n pubkeyFelts = [BigInt(starkKeyPubAX)];\n shhhPrivateKeyHex = privateKeyAX;\n } else if (effectiveSignerKind === \"ED25519\") {\n if (params.ownerPubkeyFelts && params.ownerPubkeyFelts.length > 0) {\n // External-rooted ED25519 (Phantom). Caller supplies the\n // 2-felt [low, high] LE u128 split of the 32-byte pubkey.\n // Chipi does not hold a signing key in this branch — the\n // user signs OEs via their wallet adapter and the SDK just\n // wraps the signature in an envelope.\n if (params.ownerPubkeyFelts.length !== 2) {\n throw new Error(\n `SHHH ED25519 ownerPubkeyFelts must be [low_u128, high_u128] (2 felts); got ${params.ownerPubkeyFelts.length}.`\n );\n }\n pubkeyFelts = params.ownerPubkeyFelts.map((s) => BigInt(s));\n shhhPrivateKeyHex = \"\"; // No Chipi-held key for external-rooted.\n } else {\n // Chipi-held ED25519 (mirrors STARK pattern). Generate a\n // 32-byte random secret + derive the 32-byte public key\n // via @noble/ed25519. The private key is stored as hex\n // through the same encryption helper the STARK path uses.\n const edPrivKey: Uint8Array = randomBytes(32);\n const ed = await import(\"@noble/ed25519\");\n const edPubKey = await ed.getPublicKeyAsync(edPrivKey);\n pubkeyFelts = ed25519PubkeyFelts(edPubKey);\n shhhPrivateKeyHex = Buffer.from(edPrivKey).toString(\"hex\");\n }\n } else if (\n effectiveSignerKind === \"WEBAUTHN_P256\" ||\n effectiveSignerKind === \"EIP191_SECP256K1\"\n ) {\n // External-rooted ONLY: a passkey (P-256) / MetaMask\n // (secp256k1) holds the key — Chipi never does. The caller\n // supplies the 4-felt pubkey [x_low, x_high, y_low, y_high]\n // from `webauthnPubkeyFelts` / `eip191PubkeyFelts`. The user\n // signs OEs via their authenticator/wallet adapter; the SDK\n // wraps the assertion/signature in an envelope at sign time.\n if (!params.ownerPubkeyFelts || params.ownerPubkeyFelts.length !== 4) {\n throw new Error(\n `SHHH ${effectiveSignerKind} ownerPubkeyFelts must be ` +\n `[x_low, x_high, y_low, y_high] (4 felts); got ` +\n `${params.ownerPubkeyFelts?.length ?? 0}.`\n );\n }\n pubkeyFelts = params.ownerPubkeyFelts.map((s) => BigInt(s));\n shhhPrivateKeyHex = \"\"; // No Chipi-held key for external-rooted.\n } else {\n // Defense-in-depth: SDK_SHIPPED_SHHH_KINDS already filtered\n // upstream, but assert here so a future kind addition doesn't\n // silently land with no implementation.\n throw new Error(\n `SHHH signerKind=${effectiveSignerKind} reached the address-derivation block without an implementation.`\n );\n }\n\n shhhOwnerPubkeyFelts = pubkeyFelts.map((f) => \"0x\" + f.toString(16));\n\n // Stash the per-kind private key on a closure variable so the\n // encryption step below knows what to encrypt (replaces the\n // hardcoded `privateKeyAX` for non-STARK kinds).\n shhhKeyForEncryption = shhhPrivateKeyHex;\n\n const verifierClassHash = BigInt(\n SHHH_VERIFIER_CLASS_HASHES[effectiveSignerKind as keyof typeof SHHH_VERIFIER_CLASS_HASHES]\n );\n const shhhClassHash = customClassHash ?? WALLET_CLASS_HASHES.SHHH;\n\n // computeShhhAddress reproduces the on-chain constructor's\n // address derivation, including the kind-bound salt that\n // prevents the same raw pubkey from colliding across signer\n // kinds.\n const computedAddress = computeShhhAddress({\n classHash: BigInt(shhhClassHash),\n primaryKind: effectiveSignerKind as string,\n pubkey: pubkeyFelts,\n verifierClassHash,\n });\n publicKey = \"0x\" + computedAddress.toString(16);\n accountClassHash = shhhClassHash;\n\n // Constructor calldata shape: [kindTag, verifierClass,\n // pubkey_len, *pubkey, label]. Must match\n // computeShhhAddress's `ctor` shape byte-for-byte or the\n // deployment address mismatches.\n const labelFelt = BigInt(shortString.encodeShortString(\"primary\"));\n const kindTagFelt = BigInt(shortString.encodeShortString(effectiveSignerKind!));\n constructorCallData = [\n kindTagFelt.toString(),\n verifierClassHash.toString(),\n pubkeyFelts.length.toString(),\n ...pubkeyFelts.map((f) => f.toString()),\n labelFelt.toString(),\n ];\n\n // SHHH paymaster_deploy_and_invoke salt is poseidon(kind,\n // owner_commitment), not the raw pubkey. Recompute it the same\n // way computeShhhAddress did.\n const salt = (() => {\n const ownerCommit = BigInt(\n hash.computePoseidonHashOnElements([\n \"0x\" + kindTagFelt.toString(16),\n ...pubkeyFelts.map((f) => \"0x\" + f.toString(16)),\n ])\n );\n return BigInt(\n hash.computePoseidonHashOnElements([\n \"0x\" + kindTagFelt.toString(16),\n \"0x\" + ownerCommit.toString(16),\n ])\n );\n })();\n deploymentSalt = \"0x\" + salt.toString(16);\n } else {\n // CHIPI / READY path: unchanged from before this PR.\n constructorCallData = this.buildConstructorCallData(walletType, starkKeyPubAX);\n accountClassHash =\n customClassHash ??\n (walletType === \"READY\" ? WALLET_CLASS_HASHES.READY : WALLET_CLASS_HASHES.CHIPI);\n publicKey = hash.calculateContractAddressFromHash(\n starkKeyPubAX,\n accountClassHash,\n constructorCallData,\n 0\n );\n deploymentSalt = starkKeyPubAX;\n }\n\n // Initiating Account\n const account = new Account({ provider, address: publicKey, signer: privateKeyAX });\n\n const typedDataResponse = await this.client.post<PrepareWalletCreationResponse>({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}/prepare-creation`,\n bearerToken,\n body: {\n chain,\n publicKey,\n walletType,\n starkKeyPubAX,\n // The class the address above was computed with. SHHH always\n // names it: chipi-back's default for clients that name none is\n // the class SDKs up to 14.16 used (V8.4), not ours.\n ...((customClassHash || isShhh) && { classHash: accountClassHash }),\n // SHHH: tell chipi-back which signer kind + pubkey felts\n // produced this deployment so it can validate against the\n // expected SHHH constructor shape and populate the new\n // wallet row columns.\n ...(isShhh && {\n signerKind: effectiveSignerKind,\n ownerPubkeyFelts: shhhOwnerPubkeyFelts,\n }),\n },\n });\n\n const { typedData, accountClassHash: accountClassHashResponse } = typedDataResponse;\n\n // The deploy below uses the class chipi-back returns, but the SHHH\n // address was computed with accountClassHash. If they differ the\n // wallet would land at an address nobody computed: stop here.\n if (\n isShhh &&\n (!accountClassHashResponse || BigInt(accountClassHashResponse) !== BigInt(accountClassHash))\n ) {\n throw new Error(\n `prepare-creation returned class ${accountClassHashResponse ?? \"(none)\"}, but the wallet ` +\n `address was computed with ${accountClassHash}. Not deploying.`\n );\n }\n\n // SHHH wallets use the chipi-back pure-deploy path\n // (paymaster_executeTransaction with type:\"deploy\"). No signature\n // is required — the paymaster signs its own forwarder tx and\n // calls UDC.deployContract directly. We skip account.signMessage\n // entirely; the userSignature + typedData fields in the create\n // body are kept only for DTO-shape compatibility and are ignored\n // server-side for SHHH.\n //\n // Why not deploy_and_invoke for SHHH: the paymaster's typedData\n // domain shape doesn't agree with V8.4's SNIP-12 V2 OE hashing,\n // so the bundled inner OE's STARK verifier always rejects the\n // signature with \"SHHH: signature invalid\" — silently, because\n // the outer paymaster tx still reports SUCCEEDED (2026-05-27\n // production trace audit, deploy tx 0x672fd5f6...).\n //\n // CHIPI / READY paths unchanged: signMessage(typedData) →\n // {r, s, recovery} → server-side formatOwnerSignature.\n let userSignaturePayload: { r: string; s: string; recovery: number };\n if (isShhh) {\n // Dummy placeholder. chipi-back's createWallet branches on\n // walletType=SHHH and never reads this field; the DTO still\n // requires `userSignature` for shape parity.\n userSignaturePayload = {\n r: \"0x0\",\n s: \"0x0\",\n recovery: 0,\n };\n } else {\n const userSignature = await account.signMessage(typedData);\n userSignaturePayload = {\n r: (userSignature as any).r.toString(),\n s: (userSignature as any).s.toString(),\n recovery: (userSignature as any).recovery,\n };\n }\n\n const deploymentData: DeploymentData = {\n class_hash: accountClassHashResponse,\n salt: deploymentSalt,\n unique: `${num.toHex(0)}`,\n calldata: constructorCallData.map((value) => num.toHex(value)),\n };\n\n // External-rooted SHHH wallets (e.g. Phantom ED25519 via\n // ownerPubkeyFelts) have no Chipi-held key. We omit\n // `encryptedPrivateKey` from the request body entirely in that\n // case so chipi-back stores `null` (per its DTO contract). All\n // other paths encrypt the per-kind private key.\n const encryptedPrivateKey =\n shhhKeyForEncryption === \"\"\n ? undefined\n : encryptPrivateKey(shhhKeyForEncryption, encryptKey);\n\n // Dual-key wrapping: if encryptKeyBackup provided (PIN), encrypt a second copy\n const encryptedPrivateKeyBackup =\n params.encryptKeyBackup && shhhKeyForEncryption !== \"\"\n ? encryptPrivateKey(shhhKeyForEncryption, params.encryptKeyBackup)\n : undefined;\n\n // Call the API to save the wallet in dashboard\n const executeTransactionResponse = await this.client.post<CreateWalletResponse>({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}`,\n bearerToken,\n body: {\n externalUserId,\n userId,\n publicKey,\n walletType,\n chain,\n userSignature: userSignaturePayload,\n typedData,\n ...(encryptedPrivateKey !== undefined && { encryptedPrivateKey }),\n // SHHH: write the signer kind to the new wallet row.\n ...(isShhh && { signerKind: effectiveSignerKind }),\n // External-rooted SHHH (passkey / MetaMask / Phantom): no\n // Chipi-held key, so chipi-back needs the pubkey felts (address\n // derivation) + `ownerPublicKey` as the credential source it\n // stores (encryptedPrivateKey stays null). Canonical\n // ownerPublicKey = comma-joined felts. STARK / Chipi-held kinds\n // are untouched — encryptedPrivateKey is their credential source.\n ...(isShhh &&\n encryptedPrivateKey === undefined &&\n shhhOwnerPubkeyFelts && {\n ownerPubkeyFelts: shhhOwnerPubkeyFelts,\n ownerPublicKey: shhhOwnerPubkeyFelts.join(\",\"),\n }),\n ...(encryptedPrivateKeyBackup && { encryptedPrivateKeyBackup }),\n ...(params.authMethod && { authMethod: params.authMethod }),\n ...(params.credentialId && { credentialId: params.credentialId }),\n ...(params.prfSupported != null && { prfSupported: params.prfSupported }),\n ...(params.deviceType && { deviceType: params.deviceType }),\n deploymentData: {\n ...deploymentData,\n salt: `${deploymentData.salt}`,\n calldata: deploymentData.calldata.map((data) => `${data}`),\n },\n },\n });\n\n return executeTransactionResponse;\n } catch (error: unknown) {\n console.error(\"Detailed error:\", error);\n\n if (error instanceof Error && error.message.includes(\"SSL\")) {\n throw new Error(\n \"SSL connection error. Try using NODE_TLS_REJECT_UNAUTHORIZED=0 or verify the RPC URL\"\n );\n }\n throw new ChipiTransactionError(\n `Failed to create wallet: ${error instanceof Error ? error.message : \"Unknown error\"}`,\n \"WALLET_CREATION_FAILED\"\n );\n }\n }\n\n /**\n * Build constructor calldata based on wallet type\n * - CHIPI: Simple OpenZeppelin account with just public_key\n * - ARGENT: Argent X Account with owner/guardian structure\n */\n private buildConstructorCallData(walletType: WalletType, starkKeyPubAX: string): string[] {\n if (walletType === \"READY\") {\n // Argent X Account: owner (CairoCustomEnum) + guardian (CairoOption None)\n const axSigner = new CairoCustomEnum({\n Starknet: { pubkey: starkKeyPubAX },\n });\n const axGuardian = new CairoOption<unknown>(CairoOptionVariant.None);\n\n return CallData.compile({\n owner: axSigner,\n guardian: axGuardian,\n });\n }\n\n // ChipiWallet (default): Simple OpenZeppelin account with just public_key\n return CallData.compile({\n public_key: starkKeyPubAX,\n });\n }\n\n /**\n * Create a custodial merchant wallet\n */\n async createCustodialWallet({\n params,\n bearerToken,\n }: {\n params: Omit<CreateCustodialWalletParams, \"orgId\">;\n bearerToken: string;\n }): Promise<WalletData> {\n const response = await this.client.post<WalletData>({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}/custodial`,\n bearerToken,\n body: params,\n });\n\n return response!;\n }\n\n async getWallet(params: GetWalletParams, bearerToken: string): Promise<GetWalletResponse | null> {\n try {\n const { externalUserId } = params;\n const getWalletResponse = await this.client.get<GetWalletResponse>({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}/by-user`,\n params: { externalUserId },\n bearerToken,\n });\n\n return getWalletResponse;\n } catch (err) {\n // Check if it's a 404 error (wallet not found)\n if (err instanceof ChipiApiError && err.status === 404) {\n return null;\n }\n throw err;\n }\n }\n\n /**\n * Recover passkey credential metadata for a wallet.\n * Used when localStorage is cleared — SDK recovers credentialId from backend.\n */\n async getCredentialRecovery(\n params: { externalUserId: string },\n bearerToken: string\n ): Promise<{\n credentialId: string | null;\n authMethod: string | null;\n prfSupported: boolean | null;\n deviceType: string | null;\n }> {\n return this.client.get({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}/credential-recovery`,\n params: { externalUserId: params.externalUserId },\n bearerToken,\n });\n }\n\n async updateWalletEncryption(\n params: UpdateWalletEncryptionParams,\n bearerToken: string\n ): Promise<UpdateWalletEncryptionResponse> {\n const body: Record<string, string> = {\n externalUserId: params.externalUserId,\n newEncryptedPrivateKey: params.newEncryptedPrivateKey,\n };\n\n if (params.publicKey != null) {\n body.publicKey = params.publicKey;\n }\n\n return this.client.patch<UpdateWalletEncryptionResponse>({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}/update-encryption-details`,\n bearerToken,\n body,\n });\n }\n\n getPrivateKeyAX = () => {\n // Generate 32 random bytes (256 bits)\n // const privateKeyBytes = Crypto.getRandomBytes(32); old implementation\n const privateKeyBytes = CryptoES.lib.WordArray.random(32);\n // Convert to hex string and ensure it's 64 characters (32 bytes)\n const privateKey = privateKeyBytes.toString(CryptoES.enc.Hex);\n\n // Add '0x' prefix\n const fullPrivateKey = `0x${privateKey}`;\n\n // Ensure the private key is within Starknet's valid range (0 to 2^251 - 1)\n // Convert to BigInt and take modulo 2^251\n const maxStarknetValue = BigInt(\n \"0x800000000000000000000000000000000000000000000000000000000000000\"\n );\n const privateKeyBigInt = BigInt(fullPrivateKey) % maxStarknetValue;\n\n // Convert back to hex string with '0x' prefix\n return `0x${privateKeyBigInt.toString(16)}`;\n };\n\n async getTokenBalance({\n params,\n bearerToken,\n }: {\n params: GetTokenBalanceParams;\n bearerToken: string;\n }): Promise<GetTokenBalanceResponse> {\n const getBalanceResponse = await this.client.get<GetTokenBalanceResponse>({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}/token-balance`,\n params,\n bearerToken,\n });\n\n return getBalanceResponse;\n }\n\n /**\n * Prepare a wallet upgrade (e.g., READY → CHIPI or CHIPI v29 → v33).\n * Returns typed data that must be signed by the wallet owner.\n */\n async prepareWalletUpgrade(\n params: PrepareWalletUpgradeParams,\n bearerToken: string\n ): Promise<PrepareWalletUpgradeResponse> {\n return this.client.post<PrepareWalletUpgradeResponse>({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}/prepare-upgrade`,\n bearerToken,\n body: params,\n });\n }\n\n /**\n * Execute a wallet upgrade after the owner has signed the typed data.\n */\n async executeWalletUpgrade(\n params: ExecuteWalletUpgradeParams,\n bearerToken: string\n ): Promise<ExecuteWalletUpgradeResponse> {\n return this.client.post<ExecuteWalletUpgradeResponse>({\n endpoint: `${API_ENDPOINTS.CHIPI_WALLETS}/upgrade`,\n bearerToken,\n body: params,\n });\n }\n\n /**\n * Migrate a CHIPI v29 wallet to SHHH V8.4 in-place at the same\n * on-chain address. Composes the two-phase chipi-back endpoint:\n * prepare returns the path decision + parameters, then this method\n * builds the [upgrade, bootstrap_from_sessions] multicall locally,\n * signs the V8.4 OE with the wallet's STARK key (decrypted via\n * the user's encryptKey), and sends the signed calldata to the\n * execute endpoint. Server forwards verbatim to the paymaster.\n *\n * Returns `{kind: \"ALREADY_MIGRATED\"}` if the wallet is already\n * SHHH on chain (DB row gets patched server-side; no on-chain tx\n * fires); otherwise `{kind: \"MIGRATED\", transactionHash, ...}`.\n *\n * Throws on STRANDED-state recovery, UNDEPLOYED wallets, and\n * other deferred-feature paths with actionable error messages.\n *\n * Endpoints contract shipped in chipi-back task #28 (PR #272).\n */\n async migrateToShhh(\n params: Omit<MigrateChipiWalletToShhhParams, \"client\" | \"bearerToken\">,\n bearerToken: string\n ): Promise<MigrationOutcome> {\n return migrateChipiWalletToShhh({\n client: this.client,\n bearerToken,\n ...params,\n });\n }\n}\n","/**\n * SDK-side orchestrator for the CHIPI v29 → SHHH V8.4 migration flow.\n *\n * 1. POST /chipi-wallets/prepare-migrate-to-shhh\n * Returns the path decision (HAPPY / STRANDED / ALREADY_MIGRATED)\n * plus the parameters the SDK uses to build the [upgrade(SHHH),\n * bootstrap_from_sessions] multicall locally.\n *\n * 2. Build the multicall via `buildMigrationCalls`. Targets the\n * wallet itself (CHIPI v29 sessions account → V8.4 ShhhAccount).\n *\n * 3. Broadcast the multicall through the **existing CHIPI v29\n * transaction flow** (`executePaymasterTransaction` →\n * `/transactions/prepare-typed-data` → SDK signs `(r, s)` locally\n * → `/transactions/execute-sponsored` → paymaster relay). The\n * wallet is still CHIPI v29 at sign time, so the signature must\n * use CHIPI v29's `(r, s)` SNIP-12 format — not V8.4's V2_SNIP12\n * envelope.\n *\n * This is the historical bug fixed by this refactor. The\n * original orchestrator (PR #282) used V8.4's\n * `buildStarkEnvelope` + `serializeExecuteFromOutsideV2Calldata`\n * and sent a 5-felt envelope `[V2_SNIP12, KIND_TAG, len, r, s]`\n * to the wallet. CHIPI v29's\n * `sessions-smart-contract/src/account.cairo::execute_from_outside_v2`\n * read `sig[0:2]` as `(r, s)`, got bogus values, panicked with\n * `SRC9: invalid signature` (line 430). Because CHIPI v29's\n * `_execute_calls` swallows `Result::Err` at line 684, the outer\n * tx still SUCCEEDED but the upgrade(SHHH) call never ran. The\n * class hash stayed CHIPI v29. The wallet panic was confirmed by\n * reading the inner-call `result` field: ASCII-decoded to\n * literal `SRC9: invalid signature`. Reference receipt:\n * `0x0535ed9ca8628f1c82ee2005d84017e59a02436597df371d516b97c2c93a516a`\n * (staging wallet `0x1434aadce…`).\n *\n * 4. POST /chipi-wallets/execute-migrate-to-shhh with the tx hash.\n * chipi-back verifies the on-chain class hash flipped to SHHH\n * V8.4 and patches the DB row.\n *\n * Stranded-state recovery (STRANDED path) is NOT shipped here. The\n * SDK has the builders (`buildBootstrapSignedCall`,\n * `computeBootstrapMessage`, `signBootstrapMessage`) but the flow is\n * sufficiently different from HAPPY that surfacing it cleanly needs\n * its own UI affordance. Throws a clear deferred-feature error so\n * the calling dashboard can route to a stranded-recovery UI.\n */\n\nimport { ec } from \"starknet\";\n\nimport type { ChipiClient } from \"./client\";\nimport { decryptPrivateKey } from \"./encryption\";\nimport { executePaymasterTransaction } from \"./execute-paymaster-transaction\";\nimport { buildMigrationCalls } from \"./shhh/migrate\";\n\n/**\n * Response shape from chipi-back's `prepare-migrate-to-shhh`. Mirrors\n * the union the server returns; the SDK orchestrator switches on\n * `migrationPath` to decide what to do next.\n */\nexport type PrepareMigrateResponse =\n | {\n migrationPath: \"HAPPY\";\n walletAddress: string;\n onChainClassHash: string;\n shhhClassHash: string;\n shhhVerifierClassHash: string;\n label: string;\n auditLogId: string;\n }\n | {\n migrationPath: \"STRANDED\";\n walletAddress: string;\n onChainClassHash: string;\n shhhVerifierClassHash: string;\n label: string;\n auditLogId: string;\n }\n | {\n migrationPath: \"ALREADY_MIGRATED\";\n walletAddress: string;\n onChainClassHash: string;\n primaryKind: string;\n };\n\n/**\n * Response shape from chipi-back's `execute-migrate-to-shhh`.\n *\n * On terminal success, the server returns the patched wallet shape.\n * On PARTIAL failure (on-chain succeeded + DB patch failed) the\n * server still returns 200 with `partial: true` — the migration tx\n * landed but the calling dashboard should surface \"we'll catch up on\n * our end shortly\" until the reconciler cron (task #30) patches the\n * row.\n */\nexport interface ExecuteMigrateResponse {\n walletId: string;\n walletType: \"SHHH\";\n signerKind: \"STARK\";\n classHash: string;\n migratedFromClassHash: string;\n transactionHash: string;\n partial?: boolean;\n}\n\n/**\n * Final result returned by `migrateChipiWalletToShhh`. Either a\n * full migration completed end-to-end, OR an ALREADY_MIGRATED\n * short-circuit where the server patched the DB row but no on-chain\n * tx was needed. Both are terminal; both leave the wallet in SHHH\n * state for subsequent SDK operations.\n */\nexport type MigrationOutcome =\n | (ExecuteMigrateResponse & { kind: \"MIGRATED\" })\n | {\n kind: \"ALREADY_MIGRATED\";\n walletAddress: string;\n onChainClassHash: string;\n primaryKind: string;\n };\n\nexport interface MigrateChipiWalletToShhhParams {\n client: ChipiClient;\n bearerToken: string;\n /** Chipi-back wallet row id + the wallet's tenant scope. */\n walletId: string;\n externalUserId: string;\n /** Wallet shape the SDK passes through from its `wallets.getWallet` cache. */\n wallet: {\n publicKey: string;\n encryptedPrivateKey: string;\n };\n /** PIN or passkey-derived secret that decrypts `encryptedPrivateKey`. */\n encryptKey: string;\n /**\n * @deprecated The pre-refactor orchestrator (sdks #282) used this to\n * override the V8.4 SNIP-12 chain id. The new flow inherits chain\n * config from `executePaymasterTransaction`'s RPC endpoint\n * resolution, so this field is ignored. Kept for source-compat with\n * any v14.5.0-rc callers that may have copied the older signature\n * into their codebase before publish.\n */\n chainId?: bigint | string;\n}\n\nexport async function migrateChipiWalletToShhh(\n params: MigrateChipiWalletToShhhParams\n): Promise<MigrationOutcome> {\n const prepare = await params.client.post<PrepareMigrateResponse>({\n endpoint: \"/chipi-wallets/prepare-migrate-to-shhh\",\n bearerToken: params.bearerToken,\n body: {\n walletId: params.walletId,\n externalUserId: params.externalUserId,\n },\n });\n\n if (prepare.migrationPath === \"ALREADY_MIGRATED\") {\n return {\n kind: \"ALREADY_MIGRATED\",\n walletAddress: prepare.walletAddress,\n onChainClassHash: prepare.onChainClassHash,\n primaryKind: prepare.primaryKind,\n };\n }\n\n if (prepare.migrationPath === \"STRANDED\") {\n throw new Error(\n \"SHHH stranded-state recovery is not yet shipped in the SDK client. \" +\n \"The wallet is at V8.4 class hash but primary_kind == 0, which \" +\n \"means a prior migration completed `upgrade(SHHH)` but the \" +\n \"`bootstrap_from_sessions` call silently reverted. Recovery \" +\n \"requires `bootstrap_from_sessions_signed`; see \" +\n \"`buildBootstrapSignedCall` in @chipi-stack/backend/src/shhh/migrate.ts.\"\n );\n }\n\n // Defensive guard: if chipi-back ever folds UNDEPLOYED / DEFERRED /\n // WRONG_CLASS / RPC_ERROR into the 200 union (today they're HTTP\n // 4xx), the HAPPY-shaped field reads below would NaN/undefined\n // their way into a malformed multicall. Fail fast with a clear\n // \"upgrade your SDK\" message instead.\n if (prepare.migrationPath !== \"HAPPY\") {\n throw new Error(\n \"SHHH migration: unexpected migrationPath \" +\n JSON.stringify((prepare as { migrationPath: unknown }).migrationPath) +\n \" returned by chipi-back. This SDK build only handles HAPPY / \" +\n \"STRANDED / ALREADY_MIGRATED; upgrade @chipi-stack/backend to a \" +\n \"version that knows this path.\"\n );\n }\n\n // Derive the STARK pubkey from the decrypted private key — V8.4's\n // `bootstrap_from_sessions` call needs the pubkey as its first\n // argument so the contract can stamp the owner_commitment.\n //\n // Decryption happens here in the orchestrator AND a second time\n // inside executePaymasterTransaction. Both decryptions stay local\n // — the cleartext key never crosses the wire. The double-decrypt\n // is the cost of using `executePaymasterTransaction` as a black\n // box; a future refactor could expose a \"derive STARK pubkey from\n // wallet\" helper on ChipiWallets to avoid it.\n const privateKeyHex = decryptPrivateKey(params.wallet.encryptedPrivateKey, params.encryptKey);\n if (!privateKeyHex) {\n throw new Error(\n \"Failed to decrypt STARK private key for migration. Verify the \" +\n \"encryptKey matches the one used at wallet creation.\"\n );\n }\n const starkKeyPub = BigInt(ec.starkCurve.getStarkKey(privateKeyHex));\n\n const calls = buildMigrationCalls({\n legacyAccountAddress: params.wallet.publicKey,\n legacyPublicKey: starkKeyPub,\n shhhAccountClassHash: BigInt(prepare.shhhClassHash),\n starkVerifierClassHash: BigInt(prepare.shhhVerifierClassHash),\n label: prepare.label,\n });\n\n // Broadcast through the existing CHIPI v29 transaction flow. The\n // wallet is still CHIPI v29 at sign time, so the OE signature must\n // use CHIPI v29's `(r, s)` SNIP-12 format. executePaymasterTransaction\n // routes to `/transactions/prepare-typed-data` → SDK signs locally\n // → `/transactions/execute-sponsored` for CHIPI walletType, which\n // is exactly what the wallet's `execute_from_outside_v2` validates.\n const transactionHash = await executePaymasterTransaction({\n params: {\n encryptKey: params.encryptKey,\n wallet: {\n publicKey: params.wallet.publicKey,\n encryptedPrivateKey: params.wallet.encryptedPrivateKey,\n // Explicit walletType: the wallet IS still CHIPI v29 at sign\n // time. The upgrade(SHHH) inside the multicall changes the\n // class hash mid-tx; that's after signature verification.\n walletType: \"CHIPI\",\n },\n calls,\n // Persist the migration tx so it shows up in the user's tx\n // history. The on-chain receipt is the load-bearing artifact;\n // the DB row is convenience surfacing.\n saveToDatabase: true,\n },\n bearerToken: params.bearerToken,\n client: params.client,\n });\n\n // Notify chipi-back to verify on chain + patch the DB row. The\n // execute endpoint reads the live class hash and asserts it\n // flipped to SHHH V8.4 — if the migration tx silently reverted at\n // the wallet sub-call (the original bug), this surfaces a clear\n // BadRequestException rather than letting the DB drift.\n const execute = await params.client.post<ExecuteMigrateResponse>({\n endpoint: \"/chipi-wallets/execute-migrate-to-shhh\",\n bearerToken: params.bearerToken,\n body: {\n walletId: params.walletId,\n externalUserId: params.externalUserId,\n transactionHash,\n },\n });\n\n return { kind: \"MIGRATED\", ...execute };\n}\n","import type {\n ExecuteSponsoredTransactionResponse,\n WalletData,\n WalletType,\n SessionKeyData,\n PrepareTypedDataResponse,\n} from \"@chipi-stack/types\";\nimport type { Call } from \"starknet\";\nimport { Account, RpcProvider, TypedData, ec, typedData, num } from \"starknet\";\nimport { decryptPrivateKey } from \"./encryption\";\nimport {\n WALLET_CLASS_HASHES,\n WALLET_RPC_ENDPOINTS,\n SESSION_ERRORS,\n ChipiSessionError,\n getWalletTypeFromClassHash,\n withRpcFallback,\n} from \"@chipi-stack/shared\";\nimport { ChipiClient } from \"./client\";\nimport { normalizeSignature } from \"./paymaster-adapter\";\n\n// Extended WalletData with optional wallet type for transactions\n\n// Internal type - not exported to users\ninterface ExecutePaymasterTransactionParams {\n encryptKey?: string;\n wallet: WalletData;\n calls: Call[];\n saveToDatabase: boolean; // Internal only - always set by SDK, users cannot control this\n usePasskey?: boolean;\n}\n\n/**\n * Execute a paymaster transaction (gasless) via Chipi's paymaster\n * Supports both CHIPI and ARGENT wallet types\n */\nexport const executePaymasterTransaction = async ({\n params,\n bearerToken,\n client,\n}: {\n params: ExecutePaymasterTransactionParams;\n bearerToken: string;\n client: ChipiClient;\n}): Promise<string> => {\n try {\n const { encryptKey, wallet, calls, saveToDatabase, usePasskey } = params;\n\n // Validate encryptKey is provided\n if (!encryptKey) {\n throw new Error(\n usePasskey\n ? \"encryptKey is required when using passkey. The passkey authentication should have provided the encryptKey.\"\n : \"encryptKey is required for transaction execution\"\n );\n }\n\n // Resolve the wallet type. If the caller omitted `walletType`, do NOT\n // blindly default to \"READY\": a SHHH wallet routed down the CHIPI/READY\n // prepare-typed-data path gets estimated as a *direct sender*, which trips\n // the SHHH `__execute__` version guard ('C1: invalid tx version') and the\n // transfer fails. Resolve the type from the on-chain class hash so SHHH →\n // OE, CHIPI/READY → prepare-typed-data, regardless of what WalletData the\n // caller passed (integrators and our own export-key flows can drop this\n // field). Only costs one extra RPC read, and only when it's absent.\n let walletType: WalletType = wallet.walletType ?? \"READY\";\n if (!wallet.walletType) {\n try {\n // Idempotent read → safe to retry across the endpoint chain.\n const onChainClassHash = await withRpcFallback(\n (provider) => provider.getClassHashAt(wallet.publicKey, \"latest\"),\n { fallbackUrl: WALLET_RPC_ENDPOINTS.CHIPI }\n );\n walletType = getWalletTypeFromClassHash(onChainClassHash) ?? \"READY\";\n } catch {\n // Undeployed wallet or RPC error — keep the historical \"READY\" default.\n }\n }\n\n // SHHH V8.4 ShhhAccount wallets cannot use the legacy\n // prepare-typed-data → sign → execute-sponsored-transaction flow\n // because the Chipi paymaster cannot synthesize SHHH envelopes\n // server-side (each V8.4 signer kind has a different envelope\n // shape — see chipi-pay/paymaster#16). Route SHHH OEs through the\n // execute-sponsored-raw forwarder which expects pre-signed\n // calldata. The legacy flow below is unchanged for CHIPI/READY.\n if (walletType === \"SHHH\") {\n const { executeShhhSponsoredRaw } = await import(\"./shhh/execute-paymaster-raw\");\n // Auto-route to the right envelope builder. Default to STARK to\n // preserve pre-Wave-B behavior when the caller's WalletData was\n // populated from an older response (or from a non-SHHH row where\n // chipi-back returns null for signerKind).\n const shhhSignerKind = ((wallet.signerKind ?? \"STARK\") || \"STARK\") as \"STARK\" | \"ED25519\";\n return await executeShhhSponsoredRaw({\n client,\n bearerToken,\n wallet: {\n publicKey: wallet.publicKey,\n encryptedPrivateKey: wallet.encryptedPrivateKey,\n walletType: wallet.walletType,\n },\n encryptKey,\n calls,\n signerKind: shhhSignerKind,\n });\n }\n\n // For known types, use mapped RPC and class hash.\n // For custom types, fall back to default CHIPI RPC (all StarkNet accounts use the same RPC)\n // and use the wallet's classHash if available.\n const isKnownType =\n Object.prototype.hasOwnProperty.call(WALLET_RPC_ENDPOINTS, walletType) &&\n Object.prototype.hasOwnProperty.call(WALLET_CLASS_HASHES, walletType);\n\n const rpcUrl = isKnownType ? WALLET_RPC_ENDPOINTS[walletType] : WALLET_RPC_ENDPOINTS[\"CHIPI\"];\n const accountClassHash = isKnownType\n ? WALLET_CLASS_HASHES[walletType]\n : WALLET_CLASS_HASHES[\"CHIPI\"];\n\n // Decrypt the private key\n let privateKeyDecrypted: string;\n try {\n privateKeyDecrypted = decryptPrivateKey(wallet.encryptedPrivateKey, encryptKey);\n } catch {\n throw new Error(\"Failed to decrypt private key. Verify the encryptKey is correct.\");\n }\n\n const provider = new RpcProvider({ nodeUrl: rpcUrl });\n\n const account = new Account({\n provider,\n address: wallet.publicKey,\n signer: privateKeyDecrypted,\n });\n\n // Build the type data via Chipi's backend\n const prepareResponse = await client.post<PrepareTypedDataResponse>({\n endpoint: \"/transactions/prepare-typed-data\",\n bearerToken,\n body: {\n publicKey: wallet.publicKey,\n calls: calls,\n accountClassHash,\n },\n });\n\n // Validate response structure\n if (!prepareResponse || typeof prepareResponse !== \"object\") {\n throw new Error(\n \"Invalid response from /transactions/prepare-typed-data: response is not an object\"\n );\n }\n\n // Support both current and legacy API response shapes:\n // - Current: { typedData: TypedData, walletType: WalletType }\n // - Legacy: TypedData directly (domain/types/primaryType/message)\n let typedData: TypedData | undefined;\n let resolvedWalletType: WalletType | undefined;\n\n if (\"typedData\" in prepareResponse) {\n const resp = prepareResponse as PrepareTypedDataResponse;\n typedData = resp.typedData;\n // Only accept known wallet types from the backend\n if (\n resp.walletType &&\n Object.prototype.hasOwnProperty.call(WALLET_CLASS_HASHES, resp.walletType)\n ) {\n resolvedWalletType = resp.walletType;\n }\n } else if (prepareResponse && \"types\" in prepareResponse && \"message\" in prepareResponse) {\n // Legacy shape: the response itself is the TypedData\n typedData = prepareResponse as TypedData;\n } else {\n // Likely an API error shape like { message: string }\n const apiMessage =\n prepareResponse && typeof (prepareResponse as any).message === \"string\"\n ? (prepareResponse as any).message\n : undefined;\n\n throw new Error(\n apiMessage ??\n \"Invalid response from /transactions/prepare-typed-data: typedData is missing. \" +\n \"This may occur for older STARKNET wallets that don't support paymaster transactions. \" +\n \"Please ensure the wallet is a CHIPI wallet type.\"\n );\n }\n\n // Validate typedData structure before signing\n if (\n !typedData ||\n typeof typedData !== \"object\" ||\n !(\"types\" in typedData) ||\n !(\"message\" in typedData)\n ) {\n throw new Error(\n \"Invalid typedData received from backend: missing 'types' or 'message' field. \" +\n \"This may occur for older STARKNET wallets that don't support paymaster transactions.\"\n );\n }\n\n // Sign the message\n const userSignature = await account.signMessage(typedData);\n\n // Normalize signature format (handles both Weierstrass and Array types)\n const normalizedSig = normalizeSignature(userSignature);\n\n // Execute the sponsored transaction via Chipi's paymaster\n const result = await client.post<ExecuteSponsoredTransactionResponse>({\n endpoint: \"/transactions/execute-sponsored-transaction\",\n bearerToken,\n body: {\n publicKey: wallet.publicKey,\n typedData,\n userSignature: normalizedSig,\n saveToDatabase,\n walletType: resolvedWalletType ?? walletType,\n },\n });\n\n if (!result || typeof result !== \"object\") {\n throw new Error(\n \"Invalid response from /transactions/execute-sponsored-transaction: response is not an object\"\n );\n }\n\n const apiMessage =\n typeof (result as any).message === \"string\" ? (result as any).message : undefined;\n\n if (typeof result.transactionHash !== \"string\" || result.transactionHash.trim().length === 0) {\n throw new Error(apiMessage ?? \"Response does not contain transaction hash\");\n }\n\n return result.transactionHash;\n } catch (error) {\n console.error(\"Error sending transaction with paymaster\", error);\n throw error;\n }\n};\n\n// Internal type for session-based paymaster transactions\ninterface ExecutePaymasterTransactionWithSessionParams {\n encryptKey: string;\n wallet: WalletData;\n session: SessionKeyData;\n calls: Call[];\n saveToDatabase: boolean;\n}\n\n/**\n * Execute a paymaster transaction (gasless) using a session key.\n *\n * This function uses the 4-element session signature format:\n * [sessionPubKey, r, s, validUntil]\n *\n * The session key must be registered on the contract before use via\n * `addSessionKeyToContract()`.\n *\n * CHIPI wallets only - will throw if wallet type is not CHIPI.\n *\n * @internal\n */\nexport const executePaymasterTransactionWithSession = async ({\n params,\n bearerToken,\n client,\n}: {\n params: ExecutePaymasterTransactionWithSessionParams;\n bearerToken: string;\n client: ChipiClient;\n}): Promise<string> => {\n const { encryptKey, wallet, session, calls, saveToDatabase } = params;\n\n // Accept CHIPI v29 + SHHH V8.4 (both embed SNIP-163 sessions; the\n // 4-felt session sig fast path at account.cairo:389 runs the same\n // on either class).\n if (wallet.walletType !== \"CHIPI\" && wallet.walletType !== \"SHHH\") {\n console.error(\"[ChipiSDK:Session:Execute] Invalid wallet type for session execution\", {\n provided: wallet.walletType,\n required: \"CHIPI or SHHH\",\n walletAddress: wallet.publicKey?.slice(0, 15) + \"...\",\n hint: \"Session keys require a SNIP-163 sessions component (CHIPI v29 or SHHH V8.4).\",\n });\n throw new ChipiSessionError(\n `Session execution requires CHIPI or SHHH wallet type. Got: \"${wallet.walletType || \"undefined\"}\"`,\n SESSION_ERRORS.INVALID_WALLET_TYPE_FOR_SESSION\n );\n }\n\n // Check if session has expired\n const nowSeconds = Math.floor(Date.now() / 1000);\n if (session.validUntil < nowSeconds) {\n console.error(\"[ChipiSDK:Session:Execute] Session has expired\", {\n sessionExpiry: new Date(session.validUntil * 1000).toISOString(),\n currentTime: new Date(nowSeconds * 1000).toISOString(),\n expiredAgo: `${nowSeconds - session.validUntil} seconds`,\n });\n throw new ChipiSessionError(\n `Session expired at ${new Date(session.validUntil * 1000).toISOString()}. ` +\n `Create a new session key.`,\n SESSION_ERRORS.SESSION_EXPIRED\n );\n }\n\n try {\n // console.log(\"[ChipiSDK:Session:Execute] Starting session transaction\", {\n // walletAddress: wallet.publicKey.slice(0, 15) + \"...\",\n // sessionPubKey: session.publicKey.slice(0, 15) + \"...\",\n // sessionExpiry: new Date(session.validUntil * 1000).toISOString(),\n // callCount: calls.length,\n // });\n\n // Decrypt the session private key\n let sessionPrivateKey: string;\n try {\n sessionPrivateKey = decryptPrivateKey(session.encryptedPrivateKey, encryptKey);\n } catch {\n console.error(\"[ChipiSDK:Session:Execute] Failed to decrypt session private key\", {\n sessionPubKey: session.publicKey?.slice(0, 15) + \"...\",\n hint: \"Ensure the encryptKey matches the one used when creating the session\",\n });\n throw new ChipiSessionError(\n \"Failed to decrypt session private key. Verify the encryptKey is correct.\",\n SESSION_ERRORS.SESSION_DECRYPTION_FAILED\n );\n }\n\n // Verify the session private key matches the public key\n const derivedPubKey = ec.starkCurve.getStarkKey(sessionPrivateKey);\n if (derivedPubKey.toLowerCase() !== session.publicKey.toLowerCase()) {\n console.error(\"[ChipiSDK:Session:Execute] Session key mismatch\", {\n expected: session.publicKey.slice(0, 15) + \"...\",\n derived: derivedPubKey.slice(0, 15) + \"...\",\n hint: \"The encrypted private key does not match the stored public key\",\n });\n throw new ChipiSessionError(\n \"Session key mismatch: decrypted private key does not match the public key\",\n SESSION_ERRORS.SESSION_DECRYPTION_FAILED\n );\n }\n\n if (wallet.walletType === \"SHHH\") {\n // V8.4 session OE path. Bypass chipi-back's prepare-typed-data +\n // execute-sponsored-transaction (which are shaped for CHIPI v29\n // wallets — they hardcode the CHIPI typedData domain + the\n // `isSessionSignature` flag the CHIPI controller reads). Route\n // the session OE through `/transactions/execute-sponsored-raw`\n // with the 4-felt session sig as the signature span.\n //\n // V8.4's `execute_from_outside_v2` checks `signature.len() == 4`\n // at `account.cairo:389` BEFORE the V2_SNIP12 envelope dispatch,\n // so the session-sig path runs the same way as on CHIPI v29 —\n // session whitelist + spending-policy enforcement + signature\n // verification against the SESSION pubkey (NOT the primary\n // owner), all inside the SNIP-163 component.\n const { buildOutsideExecution, computeOeHash, ANY_CALLER_FELT } = await import(\"./shhh/oe\");\n const { resolveShhhChainId, serializeExecuteFromOutsideV2Calldata } = await import(\n \"./shhh/execute-paymaster-raw\"\n );\n\n const oe = buildOutsideExecution({\n nonce: (BigInt(Date.now()) << 24n) | BigInt(Math.floor(Math.random() * 0xffffff)),\n calls,\n caller: ANY_CALLER_FELT,\n });\n\n const chainId = resolveShhhChainId({ baseUrl: client.baseUrl });\n const messageHash = computeOeHash(oe, wallet.publicKey, chainId);\n\n // ec.starkCurve.sign expects a Hex string (0x-prefixed). The\n // V8.4 OE message hash from computeOeHash is a bigint; convert.\n const messageHashHex = \"0x\" + messageHash.toString(16);\n const { r, s } = ec.starkCurve.sign(messageHashHex, sessionPrivateKey);\n\n // 4-felt session signature span: [session_pubkey, r, s, valid_until].\n // The wallet reads sig[0] as session_pubkey, enforces the whitelist\n // + spending policy, and validates (r, s) against session_pubkey\n // via the SNIP-163 component (NOT the primary signer's verifier\n // class). See `sessions-smart-contract/src/account.cairo:387-433`\n // and `shhh-wallet-cairo/src/account.cairo:389-405`.\n const sessionSignature: bigint[] = [\n BigInt(session.publicKey),\n BigInt(r),\n BigInt(s),\n BigInt(session.validUntil),\n ];\n\n const calldata = serializeExecuteFromOutsideV2Calldata({\n outsideExecution: oe,\n signature: sessionSignature,\n });\n\n const response = await client.post<{\n transactionHash?: string;\n id?: string;\n }>({\n endpoint: \"/transactions/execute-sponsored-raw\",\n bearerToken,\n body: {\n accountAddress: wallet.publicKey,\n calldata,\n // Gas budget for the session-sig path is the same as STARK\n // primary (~2M l2_gas). The paymaster's kind-detection\n // branch reads signature[0] == 'V2_SNIP12' to look up the\n // per-kind gas overhead; signature[0] here is the\n // session_pubkey (not the V2_SNIP12 prefix), so the\n // detection falls through to the STARK default — which is\n // correct, since the session verifier is STARK ECDSA.\n signerKind: \"STARK\" as const,\n },\n });\n\n if (!response?.transactionHash) {\n throw new ChipiSessionError(\n \"execute-sponsored-raw response missing transactionHash. Check chipi-back logs for upstream paymaster errors.\",\n SESSION_ERRORS.SESSION_INVALID_RESPONSE\n );\n }\n return response.transactionHash;\n }\n\n // CHIPI v29 path (unchanged).\n const accountClassHash = WALLET_CLASS_HASHES.CHIPI;\n\n // Build the type data via Chipi's backend\n const prepareResponse = await client.post<PrepareTypedDataResponse>({\n endpoint: \"/transactions/prepare-typed-data\",\n bearerToken,\n body: {\n publicKey: wallet.publicKey,\n calls: calls,\n accountClassHash,\n walletType: \"CHIPI\",\n },\n });\n\n // Unwrap the response — backend returns { typedData, walletType } for CHIPI wallets\n if (!prepareResponse || typeof prepareResponse !== \"object\") {\n throw new ChipiSessionError(\n \"Invalid response from /transactions/prepare-typed-data: response is not an object\",\n SESSION_ERRORS.SESSION_INVALID_RESPONSE\n );\n }\n\n let sessionTypedData: TypedData;\n if (\"typedData\" in prepareResponse && (prepareResponse as PrepareTypedDataResponse).typedData) {\n const candidate = (prepareResponse as PrepareTypedDataResponse).typedData;\n if (\n !candidate ||\n typeof candidate !== \"object\" ||\n !(\"types\" in candidate) ||\n !(\"message\" in candidate)\n ) {\n throw new ChipiSessionError(\n \"Invalid response from /transactions/prepare-typed-data: typedData structure is invalid\",\n SESSION_ERRORS.SESSION_INVALID_RESPONSE\n );\n }\n sessionTypedData = candidate;\n } else if (\"types\" in prepareResponse && \"message\" in prepareResponse) {\n sessionTypedData = prepareResponse as unknown as TypedData;\n } else {\n throw new ChipiSessionError(\n \"Invalid response from /transactions/prepare-typed-data: typedData is missing\",\n SESSION_ERRORS.SESSION_INVALID_RESPONSE\n );\n }\n\n // Compute the message hash from typed data\n const msgHash = typedData.getMessageHash(sessionTypedData, wallet.publicKey);\n\n // Sign with session private key using ECDSA\n const { r, s } = ec.starkCurve.sign(msgHash, sessionPrivateKey);\n\n // Build 4-element session signature: [sessionPubKey, r, s, validUntil]\n const sessionSignature = [\n session.publicKey,\n num.toHex(r),\n num.toHex(s),\n num.toHex(session.validUntil),\n ];\n\n // Execute the sponsored transaction via Chipi's paymaster\n const result = await client.post<ExecuteSponsoredTransactionResponse>({\n endpoint: \"/transactions/execute-sponsored-transaction\",\n bearerToken,\n body: {\n publicKey: wallet.publicKey,\n typedData: sessionTypedData,\n // Session signature format - array of 4 hex strings\n userSignature: sessionSignature,\n saveToDatabase: saveToDatabase,\n walletType: \"CHIPI\",\n isSessionSignature: true, // Flag to indicate session signature format\n },\n });\n\n if (!result || typeof result !== \"object\") {\n throw new ChipiSessionError(\n \"Invalid response from /transactions/execute-sponsored-transaction: response is not an object\",\n SESSION_ERRORS.SESSION_INVALID_RESPONSE\n );\n }\n\n if (typeof result.transactionHash !== \"string\" || result.transactionHash.trim().length === 0) {\n const apiMessage =\n typeof (result as any).message === \"string\" ? (result as any).message : undefined;\n console.error(\"[ChipiSDK:Session:Execute] No transaction hash in response\", {\n result,\n });\n throw new ChipiSessionError(\n apiMessage ?? \"Response does not contain transaction hash\",\n SESSION_ERRORS.SESSION_INVALID_RESPONSE\n );\n }\n\n return result.transactionHash;\n } catch (error) {\n const err = error instanceof Error ? error : new Error(String(error));\n\n // Re-throw ChipiSessionError as-is\n if (error instanceof ChipiSessionError) {\n throw error;\n }\n\n console.error(\"[ChipiSDK:Session:Execute] Unexpected error\", {\n error: err.message,\n walletAddress: wallet.publicKey?.slice(0, 15) + \"...\",\n sessionPubKey: session.publicKey?.slice(0, 15) + \"...\",\n });\n throw error;\n }\n};\n","import type {\n PaymasterAdapter,\n PaymasterAccount,\n PrepareTypedDataResponse,\n ExecuteSponsoredTransactionResponse,\n WalletType,\n} from \"@chipi-stack/types\";\nimport type { Call, TypedData } from \"starknet\";\nimport { WALLET_CLASS_HASHES, getWalletTypeFromClassHash } from \"@chipi-stack/shared\";\nimport { ChipiClient } from \"./client\";\n\n/**\n * Unwrap the /prepare-typed-data response.\n * Supports both current shape ({ typedData, walletType }) and legacy (raw TypedData).\n */\nfunction unwrapPrepareResponse(response: unknown): {\n typedData: TypedData;\n walletType?: WalletType;\n} {\n if (!response || typeof response !== \"object\") {\n throw new Error(\n \"Invalid response from /transactions/prepare-typed-data: response is not an object\"\n );\n }\n\n // Current shape: { typedData: TypedData, walletType: WalletType }\n if (\"typedData\" in response) {\n const resp = response as PrepareTypedDataResponse;\n if (\n !resp.typedData ||\n typeof resp.typedData !== \"object\" ||\n !(\"types\" in resp.typedData) ||\n !(\"message\" in resp.typedData)\n ) {\n throw new Error(\n \"Invalid response from /transactions/prepare-typed-data: typedData structure is invalid\"\n );\n }\n return { typedData: resp.typedData, walletType: resp.walletType };\n }\n\n // Legacy shape: the response itself is the TypedData\n if (\"types\" in response && \"message\" in response) {\n return { typedData: response as TypedData };\n }\n\n // Possibly an API error shape\n const apiMessage =\n typeof (response as any).message === \"string\" ? (response as any).message : undefined;\n\n throw new Error(\n apiMessage ?? \"Invalid response from /transactions/prepare-typed-data: typedData is missing\"\n );\n}\n\n/**\n * Normalize signature to { r: string, s: string } format.\n * Handles WeierstrassSignatureType ({r, s} as bigint) and ArraySignatureType ([r, s]).\n */\n/** `BigInt(value) === expected`, false (not a throw) for null or non-numeric values. */\nfunction feltEquals(value: unknown, expected: bigint): boolean {\n try {\n return BigInt(value as string | number | bigint) === expected;\n } catch {\n return false;\n }\n}\n\nexport function normalizeSignature(signature: unknown): { r: string; s: string } {\n // ArraySignatureType: string[]\n if (Array.isArray(signature)) {\n if (signature.length < 2) {\n throw new Error(`Array signature must have at least 2 elements, got ${signature.length}`);\n }\n // Argent / Ready return [1, 0, publicKey, r, s] (one Starknet signer):\n // taking the first two felts would send r=1, s=0.\n const isArgentSingle =\n signature.length === 5 && feltEquals(signature[0], 1n) && feltEquals(signature[1], 0n);\n if (signature.length !== 2 && !isArgentSingle) {\n throw new Error(\n `Unsupported ${signature.length}-felt signature: expected [r, s] or Argent [1, 0, pubkey, r, s].`\n );\n }\n const r = isArgentSingle ? signature[3] : signature[0];\n const s = isArgentSingle ? signature[4] : signature[1];\n if (r == null || s == null) {\n throw new Error(`Signature elements must not be null/undefined. Got r=${r}, s=${s}`);\n }\n return { r: String(r), s: String(s) };\n }\n\n // WeierstrassSignatureType: { r: bigint, s: bigint }\n if (signature && typeof signature === \"object\" && \"r\" in signature && \"s\" in signature) {\n const sig = signature as { r: unknown; s: unknown; recovery?: unknown };\n if (sig.r == null || sig.s == null) {\n throw new Error(`Object signature has null/undefined fields. Got r=${sig.r}, s=${sig.s}`);\n }\n return {\n r: String(sig.r),\n s: String(sig.s),\n };\n }\n\n throw new Error(\"Unrecognized signature format from account.signMessage()\");\n}\n\n/**\n * PaymasterAdapter implementation that uses Chipi's backend API for gasless transactions.\n *\n * Flow:\n * 1. Detect wallet type from on-chain class hash\n * 2. Call /transactions/prepare-typed-data to get TypedData\n * 3. Call account.signMessage(typedData) — triggers wallet popup for external wallets\n * 4. Call /transactions/execute-sponsored-transaction with signature\n * 5. Return transaction hash\n */\nexport class ChipiPaymasterAdapter implements PaymasterAdapter {\n private readonly client: ChipiClient;\n private readonly bearerToken: string;\n\n constructor(client: ChipiClient, bearerToken: string) {\n this.client = client;\n this.bearerToken = bearerToken;\n }\n\n async execute({ account, calls }: { account: PaymasterAccount; calls: Call[] }): Promise<string> {\n // 1. Detect wallet type from on-chain class hash\n const classHash = await account.getClassHashAt(account.address);\n const walletType = getWalletTypeFromClassHash(classHash);\n\n // Use mapped class hash for known types, on-chain hash for custom accounts.\n // The Rust paymaster auto-detects the interface version (V1/V2) from the class,\n // so custom SNIP-9 accounts work without an allowlist.\n const accountClassHash = walletType ? WALLET_CLASS_HASHES[walletType] : classHash;\n\n // 2. Prepare typed data via Chipi's backend\n const prepareResponse = await this.client.post<PrepareTypedDataResponse>({\n endpoint: \"/transactions/prepare-typed-data\",\n bearerToken: this.bearerToken,\n body: {\n publicKey: account.address,\n calls,\n accountClassHash,\n },\n });\n\n // 3. Unwrap response\n const { typedData, walletType: resolvedWalletType } = unwrapPrepareResponse(prepareResponse);\n\n // 4. Sign — triggers wallet popup for Argent X / Braavos\n const signature = await account.signMessage(typedData);\n\n // 5. Normalize signature format\n const normalizedSig = normalizeSignature(signature);\n\n // 6. Execute sponsored transaction\n const result = await this.client.post<ExecuteSponsoredTransactionResponse>({\n endpoint: \"/transactions/execute-sponsored-transaction\",\n bearerToken: this.bearerToken,\n body: {\n publicKey: account.address,\n typedData,\n userSignature: normalizedSig,\n walletType: resolvedWalletType ?? walletType,\n saveToDatabase: true,\n },\n });\n\n if (!result || typeof result !== \"object\") {\n throw new Error(\n \"Invalid response from /transactions/execute-sponsored-transaction: response is not an object\"\n );\n }\n\n const apiMessage =\n typeof (result as any).message === \"string\" ? (result as any).message : undefined;\n\n if (!result.transactionHash) {\n throw new Error(apiMessage ?? \"Response does not contain transaction hash\");\n }\n\n return result.transactionHash;\n }\n}\n","/**\n * SHHH V8.4 migration builders — sessions / OZ → V8.4.\n *\n * Wave B PR B4. Covers two paths:\n *\n * 1. Happy-path atomic multicall (`buildMigrationCalls`)\n * Used when the legacy wallet is still operational and can sign\n * an OutsideExecution. The wallet emits one OE containing two\n * calls in order:\n *\n * upgrade(SHHH_ACCOUNT_CLASS_HASH)\n * bootstrap_from_sessions(public_key, STARK_VERIFIER_CLASS_HASH, label)\n *\n * Atomicity is the security property — between `upgrade` and\n * `bootstrap_from_sessions` an attacker watching the mempool\n * could call `bootstrap_from_sessions(attacker_pk, ...)` first\n * and seize the account. The OE bundles them so that race\n * window doesn't exist.\n *\n * 2. Stranded-state recovery (`buildBootstrapSignedCall` +\n * `computeBootstrapMessage` + `signBootstrapMessage`)\n * Used when the legacy multicall ran but `bootstrap_from_sessions`\n * silently reverted (the old chipi-pay/sessions-smart-contract's\n * `_execute_calls` swallowed subcall errors at a\n * `Result::Err(_) => res.append(array![].span())` site). The\n * account is at V8.4 class but `primary_kind == 0`.\n *\n * Recovery: anyone calls\n *\n * bootstrap_from_sessions_signed(\n * public_key, stark_verifier_class, label, signature_r, signature_s\n * )\n *\n * where (r, s) is a STARK ECDSA signature over\n *\n * bootstrap_msg = poseidon([\n * 'SHHH_BOOTSTRAP_V8_4',\n * account_address,\n * public_key,\n * stark_verifier_class,\n * label,\n * ])\n *\n * Authorization comes from two independent checks on-chain:\n * - the preserved `LEGACY_OZ_ACCOUNT_PUBKEY_SLOT` storage slot\n * must equal `public_key` (audit C-1 binding to the original\n * owner)\n * - the signature must verify under `public_key`\n *\n * So this entrypoint is callable from any sponsor / relayer\n * without a self-call channel, but is non-transferable: only the\n * original owner who controls the STARK private key can produce\n * a valid signature.\n *\n * Cairo source of truth:\n * shhh-wallet-cairo/src/account.cairo:1024 bootstrap_from_sessions\n * shhh-wallet-cairo/src/account.cairo:1113 bootstrap_from_sessions_signed\n * shhh-wallet-cairo/scripts/ts/migrate-sessions-wallet.ts (happy-path ref)\n *\n * What this module does NOT cover (out of scope for B4):\n * - The upstream OE-build + sign step. Caller wraps these `Call`s\n * with `buildOutsideExecution` + `buildStarkEnvelope` and submits\n * via the paymaster. Same flow as B1's governance builders.\n * - Verifying on-chain whether a wallet is stranded. Done by the\n * dashboard / UI; here we just produce the recovery call.\n */\n\nimport { ec, hash, shortString, type Call } from \"starknet\";\n\n// ================================================================\n// Constants — MUST match shhh-wallet-cairo/src/account.cairo exactly\n// ================================================================\n\n/**\n * Domain separator the on-chain signed-bootstrap message uses as its\n * first felt. Mirrors `'SHHH_BOOTSTRAP_V8_4'` literal at\n * `src/account.cairo:1170`.\n */\nexport const BOOTSTRAP_DOMAIN_SEPARATOR = BigInt(\n shortString.encodeShortString(\"SHHH_BOOTSTRAP_V8_4\")\n);\n\n/** Cairo Account-component `upgrade` entrypoint name (OpenZeppelin v3). */\nconst UPGRADE_ENTRYPOINT = \"upgrade\";\n\n/** `src/account.cairo:1026` */\nconst BOOTSTRAP_ENTRYPOINT = \"bootstrap_from_sessions\";\n\n/** `src/account.cairo:1114` */\nconst BOOTSTRAP_SIGNED_ENTRYPOINT = \"bootstrap_from_sessions_signed\";\n\n// ================================================================\n// Helpers\n// ================================================================\n\nfunction _asHex(x: string | bigint): string {\n return typeof x === \"bigint\" ? \"0x\" + x.toString(16) : x;\n}\n\nfunction _felt(x: bigint | string | number): bigint {\n if (typeof x === \"bigint\") return x;\n return BigInt(x);\n}\n\n/**\n * Encode a label string as a Starknet short-string felt252.\n *\n * starknet.js `shortString.encodeShortString` accepts only ASCII\n * characters and rejects strings longer than 31 characters (it\n * stuffs one character per byte, and felt252 has 251 useful bits).\n * We pre-validate here so callers get a clear error instead of the\n * generic encoder revert; the previous \"≤31 bytes\" message was\n * misleading because non-ASCII strings would silently slip past a\n * UTF-16 `.length` check.\n */\nexport function labelToFelt(label: string): bigint {\n if (label.length === 0) return 0n;\n // ASCII check via charCodeAt rather than `/^[\\x00-\\x7F]*$/` to keep\n // ESLint's `no-control-regex` happy. Equivalent semantics: every\n // UTF-16 code unit must fit in 7 bits.\n for (let i = 0; i < label.length; i++) {\n if (label.charCodeAt(i) > 0x7f) {\n throw new RangeError(\n `migrate label must be ASCII-only (starknet.js short-string encoder rejects non-ASCII)`\n );\n }\n }\n if (label.length > 31) {\n throw new RangeError(\n `migrate label must fit in felt252 short-string (≤31 ASCII characters); got ${label.length}`\n );\n }\n return BigInt(shortString.encodeShortString(label));\n}\n\n// ================================================================\n// Happy path: atomic multicall\n// ================================================================\n\nexport interface BuildMigrationCallsParams {\n /** Address of the legacy CHIPI v29 / sessions wallet being migrated. */\n legacyAccountAddress: bigint | string;\n /** STARK public key currently stored in the legacy wallet's OZ slot. */\n legacyPublicKey: bigint | string;\n /** Target SHHH ShhhAccount class hash (e.g. `WALLET_CLASS_HASHES.SHHH`). */\n shhhAccountClassHash: bigint | string;\n /** STARK verifier class hash (`SHHH_VERIFIER_CLASS_HASHES.STARK`). */\n starkVerifierClassHash: bigint | string;\n /** Optional user-facing tag bound into the V8.4 owner record (≤31 ASCII characters). */\n label?: string;\n}\n\n/**\n * Build the two-call atomic multicall that migrates a legacy\n * CHIPI v29 (chipi-pay/sessions-smart-contract) wallet to SHHH V8.4.\n *\n * Caller's responsibility:\n * 1. Wrap the returned `Call[]` in a single `OutsideExecution`\n * against the legacy wallet's address.\n * 2. Sign the OE with the legacy wallet's STARK key (the SDK's\n * legacy CHIPI flow already does this; use that signer here).\n * 3. Submit via the paymaster.\n *\n * The multicall MUST be atomic — if any call between the two could\n * land independently on chain (e.g. via mempool front-running), the\n * resulting `upgrade`-but-not-`bootstrap` state is exploitable.\n * Bundling them in a single OE makes both calls land atomically.\n *\n * Returns the calls in order: [upgrade, bootstrap_from_sessions].\n */\nexport function buildMigrationCalls(params: BuildMigrationCallsParams): Call[] {\n const upgradeCall: Call = {\n contractAddress: _asHex(params.legacyAccountAddress),\n entrypoint: UPGRADE_ENTRYPOINT,\n calldata: [_asHex(params.shhhAccountClassHash)],\n };\n\n const labelFelt = labelToFelt(params.label ?? \"migrated\");\n\n const bootstrapCall: Call = {\n contractAddress: _asHex(params.legacyAccountAddress),\n entrypoint: BOOTSTRAP_ENTRYPOINT,\n calldata: [\n _asHex(params.legacyPublicKey),\n _asHex(params.starkVerifierClassHash),\n \"0x\" + labelFelt.toString(16),\n ],\n };\n\n return [upgradeCall, bootstrapCall];\n}\n\n// ================================================================\n// Stranded-state recovery: signed bootstrap\n// ================================================================\n\nexport interface BootstrapMessageParams {\n /** The (already-upgraded) SHHH wallet's contract address. */\n accountAddress: bigint | string;\n /** STARK public key originally stored in the legacy OZ slot. */\n publicKey: bigint | string;\n /** STARK verifier class hash to set as primary. */\n starkVerifierClassHash: bigint | string;\n /** User-facing tag bound into the V8.4 owner record (≤31 ASCII characters). */\n label?: string;\n}\n\n/**\n * Compute the canonical bootstrap message the on-chain\n * `bootstrap_from_sessions_signed` verifier will check the STARK\n * ECDSA signature against:\n *\n * poseidon([\n * 'SHHH_BOOTSTRAP_V8_4',\n * account_address,\n * public_key,\n * stark_verifier_class,\n * label,\n * ])\n *\n * Domain separation via the literal prefix means a signature produced\n * for this message can never be replayed as a different intent\n * (audit point — covered in `audit_poc_attacker_can_seize_any_stranded_wallet`).\n */\nexport function computeBootstrapMessage(params: BootstrapMessageParams): bigint {\n const accountFelt = _felt(params.accountAddress);\n const pubkeyFelt = _felt(params.publicKey);\n const verifierFelt = _felt(params.starkVerifierClassHash);\n const labelFelt = labelToFelt(params.label ?? \"migrated\");\n\n return BigInt(\n hash.computePoseidonHashOnElements([\n \"0x\" + BOOTSTRAP_DOMAIN_SEPARATOR.toString(16),\n \"0x\" + accountFelt.toString(16),\n \"0x\" + pubkeyFelt.toString(16),\n \"0x\" + verifierFelt.toString(16),\n \"0x\" + labelFelt.toString(16),\n ])\n );\n}\n\n/**\n * Sign the canonical bootstrap message with a STARK private key.\n *\n * Used in two situations:\n * - Server-side test fixtures + the Wave B B9 mainnet smoke\n * - \"Recovery as a service\" flows where the SDK is allowed to hold\n * a temporary STARK key custodied for the user\n *\n * Most production flows will instead sign via the user's wallet\n * (e.g. by exposing the message hash to the legacy wallet's STARK\n * signing endpoint) and pass `(r, s)` directly to\n * `buildBootstrapSignedCall`.\n */\nexport function signBootstrapMessage(params: {\n privateKey: bigint | string;\n message: BootstrapMessageParams;\n}): { r: bigint; s: bigint } {\n const messageHash = computeBootstrapMessage(params.message);\n const pkHex = _asHex(_felt(params.privateKey));\n const sig = ec.starkCurve.sign(\"0x\" + messageHash.toString(16), pkHex);\n return {\n r: BigInt(\"0x\" + sig.r.toString(16)),\n s: BigInt(\"0x\" + sig.s.toString(16)),\n };\n}\n\nexport interface BuildBootstrapSignedCallParams {\n /** The stranded SHHH wallet's contract address. */\n accountAddress: bigint | string;\n /** STARK public key originally stored in the legacy OZ slot. */\n publicKey: bigint | string;\n /** STARK verifier class hash. Must match the value the original migration intended. */\n starkVerifierClassHash: bigint | string;\n /** User-facing tag (≤31 ASCII characters). Must match the original migration intent. */\n label?: string;\n /** STARK ECDSA signature r component over `computeBootstrapMessage(...)`. */\n signatureR: bigint | string;\n /** STARK ECDSA signature s component. */\n signatureS: bigint | string;\n}\n\n/**\n * Build a `bootstrap_from_sessions_signed(public_key, stark_verifier_class,\n * label, signature_r, signature_s)` call against a stranded SHHH wallet.\n *\n * Permissionless on-chain — anyone (typically a sponsor / relayer)\n * can dispatch this call. The signature is the auth. So the integrator\n * does NOT need to wrap it in an OE from the wallet itself; it goes\n * out as a regular invoke from any STARK account.\n *\n * Returns the `Call` for the integrator's account-abstraction layer\n * (e.g. a chipi-back service account, or a one-off operator wallet).\n */\nexport function buildBootstrapSignedCall(params: BuildBootstrapSignedCallParams): Call {\n const labelFelt = labelToFelt(params.label ?? \"migrated\");\n return {\n contractAddress: _asHex(params.accountAddress),\n entrypoint: BOOTSTRAP_SIGNED_ENTRYPOINT,\n calldata: [\n _asHex(params.publicKey),\n _asHex(params.starkVerifierClassHash),\n \"0x\" + labelFelt.toString(16),\n _asHex(params.signatureR),\n _asHex(params.signatureS),\n ],\n };\n}\n","import {\n CallAnyContractParams,\n STARKNET_CONTRACTS,\n WalletData,\n type ExecuteTransactionParams,\n type RecordSendTransactionParams,\n type Transaction,\n type TransferParams,\n type GetTransactionListQuery,\n type PaginatedResponse,\n type TransactionStatusResponse,\n type SyncOnChainTransfersParams,\n type SyncOnChainTransfersResponse,\n} from \"@chipi-stack/types\";\nimport { API_ENDPOINTS, formatAmount } from \"@chipi-stack/shared\";\nimport { ChipiClient } from \"./client\";\nimport { executePaymasterTransaction } from \"./execute-paymaster-transaction\";\n\n/**\n * Transaction management utilities\n */\nexport class ChipiTransactions {\n constructor(private client: ChipiClient) {}\n /**\n * Execute a gasless transaction using paymaster\n * @internal saveToDatabase - Internal only, not exposed to clients\n */\n async executeTransaction({\n params,\n bearerToken,\n saveToDatabase = true, // Internal only - defaults to true, can be overridden internally\n }: {\n params: ExecuteTransactionParams;\n bearerToken: string;\n saveToDatabase?: boolean; // Internal only - not part of public API\n }): Promise<string> {\n return executePaymasterTransaction({\n params: {\n ...params,\n saveToDatabase,\n },\n bearerToken,\n client: this.client,\n });\n }\n\n /**\n * Transfer tokens\n */\n async transfer({\n params,\n bearerToken,\n }: {\n params: TransferParams;\n bearerToken: string;\n }): Promise<string> {\n const { encryptKey, wallet, token, otherToken, recipient, amount } = params;\n const contract = STARKNET_CONTRACTS[token];\n let contractAddress = contract.contractAddress;\n let decimals = contract.decimals;\n if (token === \"OTHER\") {\n if (!otherToken) {\n throw new Error(\"Other token is required when token is OTHER\");\n }\n contractAddress = otherToken.contractAddress;\n decimals = otherToken.decimals;\n }\n const formattedAmount = formatAmount(amount, decimals);\n return this.executeTransaction({\n params: {\n encryptKey,\n wallet,\n calls: [\n {\n contractAddress,\n entrypoint: \"transfer\",\n calldata: [recipient, formattedAmount, \"0x0\"],\n },\n ],\n },\n bearerToken,\n });\n }\n\n /**\n * Approve token spending\n */\n async approve(params: {\n encryptKey: string;\n wallet: WalletData;\n contractAddress: string;\n spender: string;\n amount: string;\n decimals?: number;\n bearerToken: string;\n }): Promise<string> {\n const formattedAmount = formatAmount(params.amount, params.decimals);\n\n return this.executeTransaction({\n params: {\n encryptKey: params.encryptKey,\n wallet: params.wallet,\n calls: [\n {\n contractAddress: params.contractAddress,\n entrypoint: \"approve\",\n calldata: [params.spender, formattedAmount, \"0x0\"],\n },\n ],\n },\n bearerToken: params.bearerToken,\n });\n }\n\n /**\n * Call any contract method\n */\n // {\n // encryptKey: string;\n // wallet: any;\n // calls: any[];\n // bearerToken: string;\n // }\n\n async callAnyContract({\n params,\n bearerToken,\n }: {\n params: CallAnyContractParams;\n bearerToken: string;\n }): Promise<string> {\n return this.executeTransaction({\n params,\n bearerToken,\n });\n }\n\n /**\n * Record a send transaction\n */\n async recordSendTransaction({\n params,\n bearerToken,\n }: {\n params: RecordSendTransactionParams;\n bearerToken: string;\n }): Promise<Transaction> {\n const response = await this.client.post<Transaction>({\n endpoint: `${API_ENDPOINTS.TRANSACTIONS}/record-send`,\n bearerToken,\n body: params,\n });\n return response;\n }\n\n /**\n * Get paginated transaction history\n */\n async getTransactionList(\n query: GetTransactionListQuery,\n bearerToken: string\n ): Promise<PaginatedResponse<Transaction>> {\n const response = await this.client.get<PaginatedResponse<Transaction>>({\n endpoint: `${API_ENDPOINTS.TRANSACTIONS}/transaction-list`,\n params: query,\n bearerToken,\n });\n return response;\n }\n\n /**\n * Get a single transaction by hash or internal ID\n */\n async getTransaction(hashOrId: string, bearerToken: string): Promise<Transaction> {\n return this.client.get<Transaction>({\n endpoint: `${API_ENDPOINTS.TRANSACTIONS}/${hashOrId}`,\n bearerToken,\n });\n }\n\n /**\n * Get on-chain transaction status\n */\n async getTransactionStatus(\n hash: string,\n bearerToken: string\n ): Promise<TransactionStatusResponse> {\n return this.client.get<TransactionStatusResponse>({\n endpoint: `${API_ENDPOINTS.TRANSACTIONS}/${hash}/status`,\n bearerToken,\n });\n }\n\n /**\n * Sync on-chain transfers (Starknet Transfer events) into the DB (read-through cache).\n * Discovers transactions not made through the SDK (e.g., external USDC receives).\n * After sync, getTransactionList returns the newly discovered transactions.\n */\n async syncOnChainTransfers(\n params: SyncOnChainTransfersParams,\n bearerToken: string\n ): Promise<SyncOnChainTransfersResponse> {\n return this.client.post<SyncOnChainTransfersResponse>({\n endpoint: `${API_ENDPOINTS.TRANSACTIONS}/sync-on-chain`,\n bearerToken,\n body: params,\n });\n }\n}\n","import { Currency } from \"@chipi-stack/types\";\nimport { ChipiClient } from \"./client\";\nimport { API_ENDPOINTS } from \"@chipi-stack/shared\";\n\nexport class ChipiExchanges {\n constructor(private client: ChipiClient) {}\n\n async getUsdAmount(\n currencyAmount: number,\n currency: Currency,\n bearerToken: string\n ): Promise<number> {\n return this.client.get<number>({\n endpoint: `${API_ENDPOINTS.EXCHANGES}/usd-amount`,\n bearerToken,\n params: { currencyAmount, currency },\n });\n }\n}\n","import {\n CreateSkuPurchaseParams,\n Transaction,\n STARKNET_CONTRACTS,\n Chain,\n ChainToken,\n CreateSkuPurchaseBody,\n} from \"@chipi-stack/types\";\nimport { ChipiClient } from \"./client\";\nimport { ChipiTransactions } from \"./transactions\";\n\nimport {\n CARRIER_IDS,\n CHAIN_TOKEN_TYPES,\n CHAIN_TYPES,\n SERVICE_TYPES,\n SKU_CONTRACTS,\n formatAmount,\n} from \"@chipi-stack/shared\";\nimport { Call, CallData, cairo, hash } from \"starknet\";\nimport { API_ENDPOINTS } from \"@chipi-stack/shared\";\nimport CryptoES from \"crypto-es\";\nimport { ChipiExchanges } from \"./exchanges\";\n\nexport class ChipiSkuPurchases {\n private transactions: ChipiTransactions;\n private exchanges: ChipiExchanges;\n\n constructor(private client: ChipiClient) {\n this.transactions = new ChipiTransactions(client);\n this.exchanges = new ChipiExchanges(client);\n }\n\n /**\n * Purchase a SKU with gasless execution\n * @param params - Purchase parameters including transaction hash, SKU ID, wallet, etc.\n * @param bearerToken - Authentication token for API calls\n * @returns Promise<SkuPurchaseResponse> - The purchase response with transaction details\n */\n async purchaseSku(params: CreateSkuPurchaseParams, bearerToken: string): Promise<Transaction> {\n const { skuId, skuReference, currencyAmount, currency, chain, token, encryptKey, wallet } =\n params;\n\n if (chain !== Chain.STARKNET) {\n throw new Error(`Unsupported chain for SKU purchases: ${chain}`);\n }\n\n const tokenConfig = STARKNET_CONTRACTS[token];\n if (!tokenConfig?.contractAddress) {\n throw new Error(`Unsupported token for Starknet SKU purchases: ${token}`);\n }\n\n const usdAmount = await this.exchanges.getUsdAmount(currencyAmount, currency, bearerToken);\n const tokenAddress = tokenConfig.contractAddress as `0x${string}`;\n\n if (!Number.isFinite(usdAmount) || usdAmount <= 0) {\n throw new Error(`Invalid USD amount: ${usdAmount}. Amount must be positive.`);\n }\n\n const minUsdAmount = Math.max(usdAmount, 0.000001);\n const parsedAmount = formatAmount(minUsdAmount.toString(), tokenConfig.decimals);\n\n const calls: Call[] = [\n {\n contractAddress: tokenAddress,\n entrypoint: \"approve\",\n calldata: CallData.compile({\n spender: SKU_CONTRACTS.RECHARGER_WITH_STRK_MAINNET,\n amount: cairo.uint256(parsedAmount),\n }),\n },\n {\n contractAddress: SKU_CONTRACTS.RECHARGER_WITH_STRK_MAINNET,\n entrypoint: \"process_recharge\",\n calldata: CallData.compile({\n token: tokenAddress,\n amount: cairo.uint256(parsedAmount),\n recharge_id: CryptoES.SHA256(\n CryptoES.lib.WordArray.random(32) // 32 bytes = 256 bits entropy\n )\n .toString()\n .slice(0, 20),\n product_code: skuId,\n merchant_slug: CARRIER_IDS.CHIPI_PAY,\n }),\n },\n {\n contractAddress: SKU_CONTRACTS.CHIPI_BILL_SERVICE,\n entrypoint: \"mint_item\",\n calldata: CallData.compile({\n recipient: wallet.publicKey,\n metadata: {\n service_type: SERVICE_TYPES.BUY_SERVICE,\n timestamp: Date.now(),\n chipi_user_id: hash.starknetKeccak(wallet.publicKey || \"0x0\").toString(),\n kyc: true,\n amount: cairo.uint256(parsedAmount),\n },\n }),\n },\n ];\n\n const txHash = await this.transactions.executeTransaction({\n params: {\n encryptKey: encryptKey,\n wallet: wallet,\n calls: calls,\n },\n bearerToken: bearerToken,\n saveToDatabase: false,\n });\n\n const body: CreateSkuPurchaseBody = {\n transactionHash: txHash,\n walletAddress: wallet.publicKey,\n skuId: skuId,\n skuReference: skuReference,\n chain: chain,\n token: token,\n currencyAmount: currencyAmount,\n };\n\n // Record the SKU purchase and fetch the purchase result\n const response = await this.client.post<Transaction>({\n endpoint: `${API_ENDPOINTS.SKU_PURCHASES}`,\n bearerToken,\n body,\n });\n\n return response;\n }\n\n /**\n * Get a SKU purchase by id\n * @param id - The SKU purchase id\n * @param bearerToken - Authentication token for API calls\n * @returns Promise<SkuPurchaseResponse> - Single SKU purchase\n */\n async getSkuPurchase(id: string, bearerToken: string): Promise<Transaction> {\n const response = await this.client.get<Transaction>({\n endpoint: `${API_ENDPOINTS.SKU_PURCHASES}/${id}`,\n bearerToken,\n });\n return response;\n }\n}\n","import type { PaginatedResponse, Sku, GetSkuListQuery } from \"@chipi-stack/types\";\nimport { API_ENDPOINTS } from \"@chipi-stack/shared\";\nimport { ChipiClient } from \"./client\";\n\n/**\n * SKU (Stock Keeping Unit) management utilities\n */\nexport class ChipiSkus {\n constructor(private client: ChipiClient) {}\n /**\n * Get available SKUs for purchase with pagination\n * @param bearerToken - Authentication token for API calls\n * @param query - Pagination query parameters\n * @returns Promise<PaginatedResponse<Sku>> - Paginated list of available SKUs\n */\n async getSkuList(params: GetSkuListQuery, bearerToken: string): Promise<PaginatedResponse<Sku>> {\n const response = await this.client.get<PaginatedResponse<Sku>>({\n endpoint: `${API_ENDPOINTS.SKUS}`,\n params,\n bearerToken,\n });\n\n return response;\n }\n\n /**\n * Get a single SKU by ID\n * @param bearerToken - Authentication token for API calls\n * @param id - SKU ID\n * @returns Promise<Sku> - Single SKU\n */\n async getSku(id: string, bearerToken: string): Promise<Sku> {\n return this.client.get<Sku>({\n endpoint: `${API_ENDPOINTS.SKUS}/${id}`,\n bearerToken,\n });\n }\n}\n","import type {\n SessionKeyData,\n CreateSessionKeyParams,\n AddSessionKeyParams,\n RevokeSessionKeyParams,\n GetSessionDataParams,\n SessionDataResponse,\n WalletType,\n ExecuteWithSessionParams,\n SetSpendingPolicyParams,\n GetSpendingPolicyParams,\n RemoveSpendingPolicyParams,\n SpendingPolicyData,\n SetupSessionParams,\n} from \"@chipi-stack/types\";\nimport { ec, num } from \"starknet\";\nimport { encryptPrivateKey } from \"./encryption\";\nimport { ChipiClient } from \"./client\";\nimport {\n WALLET_CLASS_HASHES,\n WALLET_RPC_ENDPOINTS,\n SESSION_DEFAULTS,\n SESSION_ERRORS,\n SESSION_ENTRYPOINTS,\n ChipiSessionError,\n withRpcFallback,\n} from \"@chipi-stack/shared\";\nimport { decodeSessionData } from \"./session-codec\";\nimport {\n buildAddSessionKeyCall,\n buildRemoveSpendingPolicyCall,\n buildRevokeSessionKeyCall,\n buildSessionSetupCalls,\n buildSetSpendingPolicyCall,\n validateSpendingPolicyConfig,\n} from \"./session-calls\";\nimport {\n executePaymasterTransaction,\n executePaymasterTransactionWithSession,\n} from \"./execute-paymaster-transaction\";\n\n/**\n * Session key management for CHIPI wallets (SNIP-9 compatible).\n *\n * Session keys enable temporary, delegated access to execute transactions\n * without requiring the owner's private key for each operation.\n *\n * @see https://github.com/chipi-pay/sessions-smart-contract\n */\nexport class ChipiSessions {\n constructor(private client: ChipiClient) {}\n\n /**\n * Validate that the wallet supports SNIP-163 session keys.\n *\n * Both CHIPI v29 (sessions-smart-contract) and SHHH V8.4\n * (ShhhAccount) embed the same SNIP-163 SessionKeyComponent, so\n * `add_or_update_session_key` / `revoke_session_key` /\n * `get_session_data` selectors exist on both. The 4-felt session\n * signature shape (`[session_pubkey, r, s, valid_until]`) is the\n * same on both — V8.4's `execute_from_outside_v2` checks\n * `signature.len() == 4` at account.cairo:389 BEFORE the\n * V2_SNIP12 envelope dispatch, so sessions land through the\n * legacy fast path on V8.4 wallets too.\n *\n * READY (Argent X v0.4.0) does NOT implement SNIP-163; reject with\n * a clear error.\n */\n private validateWalletSupportsSessions(\n walletType: WalletType | undefined,\n operation: string,\n walletPublicKey?: string\n ): void {\n if (walletType !== \"CHIPI\" && walletType !== \"SHHH\") {\n console.error(`[ChipiSDK:Session:${operation}] Invalid wallet type`, {\n provided: walletType,\n required: \"CHIPI or SHHH\",\n walletAddress: walletPublicKey ? walletPublicKey.slice(0, 15) + \"...\" : \"(not provided)\",\n hint: \"Session keys require a SNIP-163 sessions component. CHIPI v29 + SHHH V8.4 both embed it; READY (Argent X) does not.\",\n });\n throw new ChipiSessionError(\n `Session keys require CHIPI or SHHH wallet type. Got: \"${walletType || \"undefined\"}\".`,\n SESSION_ERRORS.INVALID_WALLET_TYPE_FOR_SESSION\n );\n }\n }\n\n /**\n * Convert a Uint8Array to hex string with 0x prefix.\n */\n private toHex(uint8: Uint8Array): string {\n return (\n \"0x\" +\n Array.from(uint8)\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\")\n );\n }\n\n /**\n * Generate a new session keypair locally.\n *\n * This method generates the session keys but does NOT register them on-chain.\n * The returned SessionKeyData should be stored by the developer externally\n * (e.g., in Clerk metadata, database, etc.) - the SDK does NOT persist this.\n *\n * After generating, call `addSessionKeyToContract()` to register the session on-chain.\n *\n * **PIN is weak — not recommended for production.** `encryptKey` here\n * is the symmetric key the SDK uses to encrypt the session's private\n * key at rest. If you're passing a user-typed PIN, anyone who\n * observes that PIN can decrypt the session. Derive `encryptKey`\n * from a platform passkey (`@chipi-stack/chipi-passkey`) — for SHHH\n * V8.4 wallets prefer `createShhhPasskey` + `signShhhMessage`, where\n * the wallet's primary key never needs to be decrypted client-side\n * at all.\n *\n * @param params - Session creation parameters\n * @returns SessionKeyData for external storage\n *\n * @example\n * ```typescript\n * const session = sdk.sessions.createSessionKey({\n * encryptKey: userEncryptKey,\n * durationSeconds: 21600 // 6 hours\n * });\n * // Store session externally (e.g., in Clerk metadata)\n * await saveToClerk(session);\n * ```\n */\n createSessionKey(params: CreateSessionKeyParams): SessionKeyData {\n const { encryptKey, durationSeconds = SESSION_DEFAULTS.DURATION_SECONDS } = params;\n\n if (\n typeof durationSeconds !== \"number\" ||\n !Number.isFinite(durationSeconds) ||\n !Number.isInteger(durationSeconds) ||\n durationSeconds <= 0\n ) {\n throw new ChipiSessionError(\n `Invalid session duration: ${durationSeconds}. Must be a positive integer.`,\n SESSION_ERRORS.SESSION_CREATION_FAILED\n );\n }\n\n try {\n // Generate Stark curve private key\n const rawPrivateKey = ec.starkCurve.utils.randomPrivateKey();\n const privateKeyHex = this.toHex(rawPrivateKey);\n\n // Derive public key\n const publicKey = ec.starkCurve.getStarkKey(privateKeyHex);\n\n // Calculate expiration timestamp\n const validUntil = Math.floor(Date.now() / 1000) + durationSeconds;\n\n // Encrypt the private key for storage\n const encryptedPrivateKey = encryptPrivateKey(privateKeyHex, encryptKey);\n\n // console.log(\"[ChipiSDK:Session:Create] Session key generated\", {\n // publicKey: publicKey.slice(0, 15) + \"...\",\n // validUntil: new Date(validUntil * 1000).toISOString(),\n // durationSeconds,\n // });\n\n return {\n publicKey,\n encryptedPrivateKey,\n validUntil,\n };\n } catch (error) {\n const err = error instanceof Error ? error : new Error(String(error));\n console.error(\"[ChipiSDK:Session:Create] Failed to generate session key\", {\n error: err.message,\n durationRequested: durationSeconds,\n });\n throw new ChipiSessionError(\n `Failed to create session key: ${err.message}`,\n SESSION_ERRORS.SESSION_CREATION_FAILED\n );\n }\n }\n\n /**\n * Register a session key on the smart contract.\n *\n * This executes a sponsored transaction (using owner signature) to call\n * `add_or_update_session_key` on the CHIPI wallet contract.\n *\n * The session must be registered before it can be used for transactions.\n *\n * @param params - Session registration parameters\n * @param bearerToken - Authentication token\n * @returns Transaction hash\n *\n * @example\n * ```typescript\n * const txHash = await sdk.sessions.addSessionKeyToContract({\n * encryptKey: userEncryptKey,\n * wallet: userWallet,\n * sessionConfig: {\n * sessionPublicKey: session.publicKey,\n * validUntil: session.validUntil,\n * maxCalls: 1000,\n * allowedEntrypoints: [] // empty = all allowed\n * }\n * }, bearerToken);\n * ```\n */\n async addSessionKeyToContract(params: AddSessionKeyParams, bearerToken: string): Promise<string> {\n const { encryptKey, wallet, sessionConfig } = params;\n\n // Validate the wallet embeds SNIP-163 sessions (CHIPI v29 or SHHH V8.4).\n this.validateWalletSupportsSessions(wallet.walletType, \"AddToContract\", wallet.publicKey);\n\n try {\n console.log(\"[ChipiSDK:Session:AddToContract] Registering session on-chain\", {\n walletAddress: wallet.publicKey.slice(0, 15) + \"...\",\n sessionPubKey: sessionConfig.sessionPublicKey.slice(0, 15) + \"...\",\n validUntil: new Date(sessionConfig.validUntil * 1000).toISOString(),\n maxCalls: sessionConfig.maxCalls,\n allowedEntrypoints: sessionConfig.allowedEntrypoints.length,\n });\n\n // add_or_update_session_key(session_key, valid_until, max_calls, allowed_entrypoints).\n // Function names in the whitelist are converted to selectors.\n const addCall = buildAddSessionKeyCall(wallet.publicKey, sessionConfig);\n\n // Execute via paymaster (owner signature). Pass through the\n // actual walletType so executePaymasterTransaction routes to\n // the right OE path: CHIPI → typedData + (r, s), SHHH → V8.4\n // V2_SNIP12 envelope via executeShhhSponsoredRaw. Both wallets\n // expose the SNIP-163 selectors on the embedded sessions\n // component, so the inner call lands on either class.\n const txHash = await executePaymasterTransaction({\n params: {\n encryptKey,\n wallet,\n calls: [addCall],\n saveToDatabase: false, // Don't record session management txs\n },\n bearerToken,\n client: this.client,\n });\n\n console.log(\"[ChipiSDK:Session:AddToContract] Session registered successfully\", {\n txHash,\n sessionPubKey: sessionConfig.sessionPublicKey.slice(0, 15) + \"...\",\n });\n\n return txHash;\n } catch (error) {\n const err = error instanceof Error ? error : new Error(String(error));\n console.error(\"[ChipiSDK:Session:AddToContract] Registration failed\", {\n error: err.message,\n walletAddress: wallet.publicKey?.slice(0, 15) + \"...\",\n sessionPubKey: sessionConfig.sessionPublicKey?.slice(0, 15) + \"...\",\n validUntil: new Date(sessionConfig.validUntil * 1000).toISOString(),\n maxCalls: sessionConfig.maxCalls,\n });\n throw error;\n }\n }\n\n /**\n * Register a session and its spending policies in ONE owner-signed transaction.\n *\n * Equivalent to `addSessionKeyToContract` followed by one `setSpendingPolicy`\n * per token, but the owner signs once (one passkey prompt) and the session\n * never exists on-chain without its caps.\n *\n * @example\n * ```typescript\n * const txHash = await sdk.sessions.setupSession({\n * encryptKey,\n * wallet,\n * sessionConfig: {\n * sessionPublicKey: session.publicKey,\n * validUntil: session.validUntil,\n * maxCalls: 500,\n * allowedEntrypoints: [\"transfer\", \"approve\"],\n * },\n * spendingPolicies: [\n * { token: USDC, maxPerCall: 5_000_000n, maxPerWindow: 20_000_000n, windowSeconds: 86400 },\n * ],\n * }, bearerToken);\n * ```\n */\n async setupSession(params: SetupSessionParams, bearerToken: string): Promise<string> {\n const { encryptKey, wallet, sessionConfig, spendingPolicies = [] } = params;\n\n this.validateWalletSupportsSessions(wallet.walletType, \"Setup\", wallet.publicKey);\n\n // Builds (and validates) every call before anything is signed.\n const calls = buildSessionSetupCalls(wallet.publicKey, sessionConfig, spendingPolicies);\n\n console.log(\"[ChipiSDK:Session:Setup] Registering session with spending policies\", {\n walletAddress: wallet.publicKey.slice(0, 15) + \"...\",\n sessionPubKey: sessionConfig.sessionPublicKey.slice(0, 15) + \"...\",\n validUntil: new Date(sessionConfig.validUntil * 1000).toISOString(),\n maxCalls: sessionConfig.maxCalls,\n allowedEntrypoints: sessionConfig.allowedEntrypoints.length,\n spendingPolicies: spendingPolicies.length,\n });\n\n return executePaymasterTransaction({\n params: {\n encryptKey,\n wallet,\n calls,\n saveToDatabase: false, // Don't record session management txs\n },\n bearerToken,\n client: this.client,\n });\n }\n\n /**\n * Revoke a session key from the smart contract.\n *\n * This executes a sponsored transaction (using owner signature) to call\n * `revoke_session_key` on the CHIPI wallet contract.\n *\n * After revocation, the session key can no longer be used for transactions.\n *\n * @param params - Session revocation parameters\n * @param bearerToken - Authentication token\n * @returns Transaction hash\n *\n * @example\n * ```typescript\n * const txHash = await sdk.sessions.revokeSessionKey({\n * encryptKey: userEncryptKey,\n * wallet: userWallet,\n * sessionPublicKey: session.publicKey\n * }, bearerToken);\n * ```\n */\n async revokeSessionKey(params: RevokeSessionKeyParams, bearerToken: string): Promise<string> {\n const { encryptKey, wallet, sessionPublicKey } = params;\n\n // Validate CHIPI wallet\n this.validateWalletSupportsSessions(wallet.walletType, \"Revoke\", wallet.publicKey);\n\n try {\n console.log(\"[ChipiSDK:Session:Revoke] Revoking session from contract\", {\n walletAddress: wallet.publicKey.slice(0, 15) + \"...\",\n sessionToRevoke: sessionPublicKey.slice(0, 15) + \"...\",\n });\n\n // Execute via paymaster (owner signature). Pass through the\n // actual walletType so executePaymasterTransaction routes to\n // the right OE path: CHIPI → typedData + (r, s), SHHH → V8.4\n // V2_SNIP12 envelope via executeShhhSponsoredRaw. Both wallets\n // expose the SNIP-163 selectors on the embedded sessions\n // component, so the inner call lands on either class.\n const txHash = await executePaymasterTransaction({\n params: {\n encryptKey,\n wallet,\n calls: [buildRevokeSessionKeyCall(wallet.publicKey, sessionPublicKey)],\n saveToDatabase: false, // Don't record session management txs\n },\n bearerToken,\n client: this.client,\n });\n\n console.log(\"[ChipiSDK:Session:Revoke] Session revoked successfully\", {\n txHash,\n sessionRevoked: sessionPublicKey.slice(0, 15) + \"...\",\n });\n\n return txHash;\n } catch (error) {\n const err = error instanceof Error ? error : new Error(String(error));\n console.error(\"[ChipiSDK:Session:Revoke] Revocation failed\", {\n error: err.message,\n walletAddress: wallet.publicKey?.slice(0, 15) + \"...\",\n sessionToRevoke: sessionPublicKey?.slice(0, 15) + \"...\",\n });\n throw error;\n }\n }\n\n /**\n * Query session data from the smart contract.\n *\n * This is a read-only call that does not require signing or gas.\n *\n * @param params - Query parameters\n * @returns Session data including status, remaining calls, and allowed entrypoints\n *\n * @example\n * ```typescript\n * const sessionData = await sdk.sessions.getSessionData({\n * walletAddress: userWallet.publicKey,\n * sessionPublicKey: session.publicKey\n * });\n * if (sessionData.isActive) {\n * console.log(`Session has ${sessionData.remainingCalls} calls remaining`);\n * }\n * ```\n *\n * NOTE: This method intentionally does NOT validate walletType because:\n * 1. It's a read-only query - no state change or risk\n * 2. Non-CHIPI wallets will simply return isActive=false (graceful failure)\n * 3. It doesn't require walletType parameter at all - only walletAddress\n * Adding validation would require changing the interface for no functional benefit.\n */\n async getSessionData(params: GetSessionDataParams): Promise<SessionDataResponse> {\n const { walletAddress, sessionPublicKey } = params;\n\n try {\n console.log(\"[ChipiSDK:Session:GetData] Querying session data\", {\n walletAddress: walletAddress.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey.slice(0, 15) + \"...\",\n });\n\n // Read-only contract call → safe to retry across the endpoint chain.\n const result = await withRpcFallback(\n (provider) =>\n provider.callContract({\n contractAddress: walletAddress,\n entrypoint: SESSION_ENTRYPOINTS.GET_DATA,\n calldata: [sessionPublicKey],\n }),\n { fallbackUrl: WALLET_RPC_ENDPOINTS[\"CHIPI\"] }\n );\n\n // `get_session_data` returns the stored `SessionData` struct, identical on\n // CHIPI v29, v33 and SHHH V8.4:\n // [valid_until: u64, max_calls: u32, calls_used: u32, allowed_entrypoints_len: u32]\n const resultArray = Array.isArray(result)\n ? result\n : (result as { result?: string[] }).result || [];\n\n if (resultArray.length < 4) {\n console.warn(\"[ChipiSDK:Session:GetData] Unexpected response format\", {\n resultLength: resultArray.length,\n result: resultArray,\n });\n return {\n isActive: false,\n validUntil: 0,\n remainingCalls: 0,\n allowedEntrypoints: [],\n };\n }\n\n const { isActive, validUntil, remainingCalls, allowedEntrypoints } = decodeSessionData(\n resultArray,\n Math.floor(Date.now() / 1000)\n );\n\n const sessionData: SessionDataResponse = {\n isActive,\n validUntil,\n remainingCalls,\n allowedEntrypoints,\n };\n\n console.log(\"[ChipiSDK:Session:GetData] Session data retrieved\", {\n isActive,\n validUntil: new Date(validUntil * 1000).toISOString(),\n remainingCalls,\n // The struct carries the whitelist length, not the selectors.\n allowedEntrypointsLen: Number(BigInt(resultArray[3])),\n });\n\n return sessionData;\n } catch (error) {\n const err = error instanceof Error ? error : new Error(String(error));\n\n // Contract revert or empty result = session doesn't exist (expected)\n const sessionNotFoundPatterns = [\n /entry point.*not found/i,\n /requested entrypoint was not found/i,\n /invalid message selector/i,\n /contract not found/i,\n /is not deployed/i,\n /revert.*get_session_data/i,\n ];\n const isSessionNotFound = sessionNotFoundPatterns.some((p) => p.test(err.message));\n\n if (isSessionNotFound) {\n console.log(\"[ChipiSDK:Session:GetData] Session not found on contract\", {\n walletAddress: walletAddress?.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey?.slice(0, 15) + \"...\",\n });\n return {\n isActive: false,\n validUntil: 0,\n remainingCalls: 0,\n allowedEntrypoints: [],\n };\n }\n\n // Infrastructure errors should propagate\n console.error(\"[ChipiSDK:Session:GetData] RPC/network error\", {\n error: err.message,\n walletAddress: walletAddress?.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey?.slice(0, 15) + \"...\",\n });\n throw err;\n }\n }\n\n /**\n * Execute a gasless transaction using a session key.\n *\n * This uses the 4-element session signature format instead of owner signature.\n * The session must be:\n * 1. Generated via `createSessionKey()`\n * 2. Registered on-chain via `addSessionKeyToContract()`\n *\n * CHIPI v29 and SHHH V8.4 only: both embed the SNIP-163 sessions\n * component. Throws for any other wallet type, notably READY (Argent X),\n * which does not. See `validateWalletSupportsSessions`.\n *\n * @param params - Session execution parameters\n * @param bearerToken - Authentication token\n * @returns Transaction hash\n *\n * @example\n * ```typescript\n * // 1. Create session key (store externally)\n * const session = sdk.sessions.createSessionKey({ encryptKey });\n *\n * // 2. Register on contract (one-time)\n * await sdk.sessions.addSessionKeyToContract({\n * encryptKey,\n * wallet,\n * sessionConfig: {\n * sessionPublicKey: session.publicKey,\n * validUntil: session.validUntil,\n * maxCalls: 1000,\n * allowedEntrypoints: []\n * }\n * }, bearerToken);\n *\n * // 3. Execute transactions with session (no owner key needed)\n * const txHash = await sdk.sessions.executeTransactionWithSession({\n * encryptKey,\n * wallet,\n * session,\n * calls\n * }, bearerToken);\n * ```\n */\n async executeTransactionWithSession(\n params: ExecuteWithSessionParams,\n bearerToken: string\n ): Promise<string> {\n const { encryptKey, wallet, session, calls } = params;\n\n // Accept CHIPI v29 + SHHH V8.4 (both embed the SNIP-163 sessions\n // component; D9 Phase 1 sdks#287). Reject everything else with a\n // clear error. Mirrors the validator the inner\n // executePaymasterTransactionWithSession applies — kept here as\n // well so callers using `sdk.sessions.executeTransactionWithSession`\n // directly fail fast before the inner function runs.\n if (wallet.walletType && wallet.walletType !== \"CHIPI\" && wallet.walletType !== \"SHHH\") {\n throw new ChipiSessionError(\n `Session execution requires CHIPI or SHHH wallet type. Got: ${wallet.walletType}`,\n SESSION_ERRORS.INVALID_WALLET_TYPE_FOR_SESSION\n );\n }\n\n // Pass the wallet through verbatim so the SHHH path picks up its\n // walletType (the inner function routes on it). undefined defaults\n // to CHIPI inside the inner function for backward compat.\n return executePaymasterTransactionWithSession({\n params: {\n encryptKey,\n wallet: { ...wallet, walletType: wallet.walletType ?? \"CHIPI\" },\n session,\n calls,\n saveToDatabase: true,\n },\n bearerToken,\n client: this.client,\n });\n }\n\n // --- Spending Policy Methods ---\n // Wraps ISessionSpendingPolicy contract interface.\n // Spending policies enforce per-token limits on ERC-20 operations\n // (transfer, approve, increase_allowance) executed by session keys.\n\n /**\n * Reconstruct a bigint from Cairo u256 (low, high) hex strings.\n */\n private joinU256(low: string, high: string): bigint {\n return BigInt(low) + (BigInt(high) << 128n);\n }\n\n /**\n * Set a spending policy for a session key + token pair.\n *\n * This executes a sponsored transaction (using owner signature) to call\n * `set_spending_policy` on the wallet contract (CHIPI v29 or SHHH V8.4).\n *\n * The contract enforces these limits automatically during `__execute__()` on\n * ERC-20 operations (transfer, approve, increase_allowance) made by the session.\n *\n * @param params - Spending policy parameters\n * @param bearerToken - Authentication token\n * @returns Transaction hash\n *\n * @example\n * ```typescript\n * // Set a spending limit: max 1 USDC per call, 50 USDC per day\n * const txHash = await sdk.sessions.setSpendingPolicy({\n * encryptKey: userEncryptKey,\n * wallet: userWallet,\n * spendingPolicyConfig: {\n * sessionPublicKey: session.publicKey,\n * token: USDC_ADDRESS,\n * maxPerCall: 1_000_000n, // 1 USDC (6 decimals)\n * maxPerWindow: 50_000_000n, // 50 USDC\n * windowSeconds: 86400, // 24 hours\n * }\n * }, bearerToken);\n * ```\n */\n async setSpendingPolicy(params: SetSpendingPolicyParams, bearerToken: string): Promise<string> {\n const { encryptKey, wallet, spendingPolicyConfig } = params;\n const { sessionPublicKey, token, maxPerCall, maxPerWindow, windowSeconds } =\n spendingPolicyConfig;\n\n // Validate wallet type if provided (backward compat: omitted = assume CHIPI).\n // CHIPI v29 + SHHH V8.4 both embed the same SNIP-163 SessionKeyComponent, so\n // set_spending_policy lands on either class; READY (Argent X) does not.\n if (wallet.walletType && wallet.walletType !== \"CHIPI\" && wallet.walletType !== \"SHHH\") {\n throw new ChipiSessionError(\n `Spending policies require CHIPI or SHHH wallet type. Got: ${wallet.walletType}`,\n SESSION_ERRORS.INVALID_WALLET_TYPE_FOR_SESSION\n );\n }\n\n // Validate against the contract's interpretation (same errors as before).\n validateSpendingPolicyConfig(spendingPolicyConfig);\n\n try {\n console.log(\"[ChipiSDK:Session:SetSpendingPolicy] Setting spending policy\", {\n walletAddress: wallet.publicKey.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey.slice(0, 15) + \"...\",\n token: token.slice(0, 15) + \"...\",\n maxPerCall: maxPerCall.toString(),\n maxPerWindow: maxPerWindow.toString(),\n windowSeconds,\n });\n\n // set_spending_policy(session_key, token, max_per_call: u256, max_per_window: u256, window_seconds: u64)\n const setPolicyCall = buildSetSpendingPolicyCall(wallet.publicKey, spendingPolicyConfig);\n\n // Execute via paymaster (owner signature). Pass `wallet` verbatim so\n // executePaymasterTransaction routes on walletType — CHIPI → typedData,\n // SHHH → V8.4 V2_SNIP12 owner envelope (executeShhhSponsoredRaw) — and so\n // an OMITTED walletType reaches its on-chain class-hash resolution. Do NOT\n // coerce undefined → \"CHIPI\" here: that bypasses the resolution and\n // mis-routes an omitted-walletType SHHH wallet into the CHIPI path (the\n // #356 'C1: invalid tx version' failure). set_spending_policy is\n // owner-self-gated and lives on the same SNIP-163 component on both classes.\n const txHash = await executePaymasterTransaction({\n params: {\n encryptKey,\n wallet,\n calls: [setPolicyCall],\n saveToDatabase: false,\n },\n bearerToken,\n client: this.client,\n });\n\n console.log(\"[ChipiSDK:Session:SetSpendingPolicy] Spending policy set successfully\", {\n txHash,\n sessionPubKey: sessionPublicKey.slice(0, 15) + \"...\",\n token: token.slice(0, 15) + \"...\",\n });\n\n return txHash;\n } catch (error) {\n const err = error instanceof Error ? error : new Error(String(error));\n console.error(\"[ChipiSDK:Session:SetSpendingPolicy] Failed to set spending policy\", {\n error: err.message,\n walletAddress: wallet.publicKey?.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey?.slice(0, 15) + \"...\",\n token: token?.slice(0, 15) + \"...\",\n });\n throw error;\n }\n }\n\n /**\n * Query a spending policy from the smart contract.\n *\n * This is a read-only call that does not require signing or gas.\n * Returns zeroed data if no policy is set (meaning no enforcement).\n *\n * @param params - Query parameters\n * @returns Spending policy data including limits and current window state\n *\n * @example\n * ```typescript\n * const policy = await sdk.sessions.getSpendingPolicy({\n * walletAddress: userWallet.publicKey,\n * sessionPublicKey: session.publicKey,\n * token: USDC_ADDRESS,\n * });\n * if (policy.maxPerWindow > 0n) {\n * console.log(`Spent ${policy.spentInWindow} of ${policy.maxPerWindow} this window`);\n * }\n * ```\n */\n async getSpendingPolicy(params: GetSpendingPolicyParams): Promise<SpendingPolicyData> {\n const { walletAddress, sessionPublicKey, token } = params;\n\n try {\n console.log(\"[ChipiSDK:Session:GetSpendingPolicy] Querying spending policy\", {\n walletAddress: walletAddress.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey.slice(0, 15) + \"...\",\n token: token.slice(0, 15) + \"...\",\n });\n\n // Read-only contract call → safe to retry across the endpoint chain.\n const result = await withRpcFallback(\n (provider) =>\n provider.callContract({\n contractAddress: walletAddress,\n entrypoint: SESSION_ENTRYPOINTS.GET_SPENDING_POLICY,\n calldata: [sessionPublicKey, token],\n }),\n { fallbackUrl: WALLET_RPC_ENDPOINTS[\"CHIPI\"] }\n );\n\n // Parse response: [max_per_call_low, max_per_call_high, max_per_window_low, max_per_window_high,\n // window_seconds, spent_in_window_low, spent_in_window_high, window_start]\n const resultArray = Array.isArray(result)\n ? result\n : (result as { result?: string[] }).result || [];\n\n if (resultArray.length < 8) {\n console.warn(\"[ChipiSDK:Session:GetSpendingPolicy] Unexpected response format\", {\n resultLength: resultArray.length,\n result: resultArray,\n });\n return {\n maxPerCall: 0n,\n maxPerWindow: 0n,\n windowSeconds: 0,\n spentInWindow: 0n,\n windowStart: 0,\n };\n }\n\n const policyData: SpendingPolicyData = {\n maxPerCall: this.joinU256(resultArray[0], resultArray[1]),\n maxPerWindow: this.joinU256(resultArray[2], resultArray[3]),\n windowSeconds: Number(BigInt(resultArray[4])),\n spentInWindow: this.joinU256(resultArray[5], resultArray[6]),\n windowStart: Number(BigInt(resultArray[7])),\n };\n\n console.log(\"[ChipiSDK:Session:GetSpendingPolicy] Spending policy retrieved\", {\n maxPerCall: policyData.maxPerCall.toString(),\n maxPerWindow: policyData.maxPerWindow.toString(),\n windowSeconds: policyData.windowSeconds,\n spentInWindow: policyData.spentInWindow.toString(),\n windowStart: policyData.windowStart,\n });\n\n return policyData;\n } catch (error) {\n const err = error instanceof Error ? error : new Error(String(error));\n\n // Contract revert or entry not found = no policy set (expected)\n const notFoundPatterns = [\n /entry point.*not found/i,\n /requested entrypoint was not found/i,\n /invalid message selector/i,\n /contract not found/i,\n /is not deployed/i,\n ];\n const isNotFound = notFoundPatterns.some((p) => p.test(err.message));\n\n if (isNotFound) {\n console.log(\n \"[ChipiSDK:Session:GetSpendingPolicy] No policy found (contract or entrypoint missing)\",\n {\n walletAddress: walletAddress?.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey?.slice(0, 15) + \"...\",\n token: token?.slice(0, 15) + \"...\",\n }\n );\n return {\n maxPerCall: 0n,\n maxPerWindow: 0n,\n windowSeconds: 0,\n spentInWindow: 0n,\n windowStart: 0,\n };\n }\n\n console.error(\"[ChipiSDK:Session:GetSpendingPolicy] RPC/network error\", {\n error: err.message,\n walletAddress: walletAddress?.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey?.slice(0, 15) + \"...\",\n token: token?.slice(0, 15) + \"...\",\n });\n throw err;\n }\n }\n\n /**\n * Remove a spending policy for a session key + token pair.\n *\n * This executes a sponsored transaction (using owner signature) to call\n * `remove_spending_policy` on the wallet contract (CHIPI v29 or SHHH V8.4).\n *\n * After removal, the session key has no spending limits for this token.\n *\n * @param params - Policy removal parameters\n * @param bearerToken - Authentication token\n * @returns Transaction hash\n *\n * @example\n * ```typescript\n * const txHash = await sdk.sessions.removeSpendingPolicy({\n * encryptKey: userEncryptKey,\n * wallet: userWallet,\n * sessionPublicKey: session.publicKey,\n * token: USDC_ADDRESS,\n * }, bearerToken);\n * ```\n */\n async removeSpendingPolicy(\n params: RemoveSpendingPolicyParams,\n bearerToken: string\n ): Promise<string> {\n const { encryptKey, wallet, sessionPublicKey, token } = params;\n\n // Validate wallet type if provided (backward compat: omitted = assume CHIPI).\n // CHIPI v29 + SHHH V8.4 both embed the same SNIP-163 SessionKeyComponent, so\n // remove_spending_policy lands on either class; READY (Argent X) does not.\n if (wallet.walletType && wallet.walletType !== \"CHIPI\" && wallet.walletType !== \"SHHH\") {\n throw new ChipiSessionError(\n `Spending policies require CHIPI or SHHH wallet type. Got: ${wallet.walletType}`,\n SESSION_ERRORS.INVALID_WALLET_TYPE_FOR_SESSION\n );\n }\n\n if (!token || token.trim().length === 0) {\n throw new ChipiSessionError(\n `Invalid token address for spending policy removal: \"${token}\"`,\n SESSION_ERRORS.INVALID_SPENDING_POLICY\n );\n }\n\n try {\n console.log(\"[ChipiSDK:Session:RemoveSpendingPolicy] Removing spending policy\", {\n walletAddress: wallet.publicKey.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey.slice(0, 15) + \"...\",\n token: token.slice(0, 15) + \"...\",\n });\n\n // remove_spending_policy(session_key, token)\n const removeCall = buildRemoveSpendingPolicyCall(wallet.publicKey, sessionPublicKey, token);\n\n // Execute via paymaster (owner signature). Pass `wallet` verbatim so\n // executePaymasterTransaction routes on walletType — CHIPI → typedData,\n // SHHH → V8.4 V2_SNIP12 owner envelope (executeShhhSponsoredRaw) — and so\n // an OMITTED walletType reaches its on-chain class-hash resolution. Do NOT\n // coerce undefined → \"CHIPI\" here: that bypasses the resolution and\n // mis-routes an omitted-walletType SHHH wallet into the CHIPI path (the\n // #356 'C1: invalid tx version' failure). remove_spending_policy is\n // owner-self-gated and lives on the same SNIP-163 component on both classes.\n const txHash = await executePaymasterTransaction({\n params: {\n encryptKey,\n wallet,\n calls: [removeCall],\n saveToDatabase: false,\n },\n bearerToken,\n client: this.client,\n });\n\n console.log(\"[ChipiSDK:Session:RemoveSpendingPolicy] Spending policy removed successfully\", {\n txHash,\n sessionPubKey: sessionPublicKey.slice(0, 15) + \"...\",\n token: token.slice(0, 15) + \"...\",\n });\n\n return txHash;\n } catch (error) {\n const err = error instanceof Error ? error : new Error(String(error));\n console.error(\"[ChipiSDK:Session:RemoveSpendingPolicy] Failed to remove spending policy\", {\n error: err.message,\n walletAddress: wallet.publicKey?.slice(0, 15) + \"...\",\n sessionPubKey: sessionPublicKey?.slice(0, 15) + \"...\",\n token: token?.slice(0, 15) + \"...\",\n });\n throw error;\n }\n }\n}\n","import { hash, num } from \"starknet\";\nimport { ChipiSessionError, SESSION_ERRORS } from \"@chipi-stack/shared\";\n\n/** Starknet field prime. A selector is a felt, so it must be below it. */\nconst FIELD_PRIME = 2n ** 251n + 17n * 2n ** 192n + 1n;\n\nconst HEX_FELT = /^0x[0-9a-fA-F]{1,64}$/;\nconst DECIMAL_FELT = /^\\d+$/;\nconst CAIRO_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;\n\n/**\n * Normalize a session whitelist to the hex selectors the contract compares against.\n *\n * `add_or_update_session_key` stores raw felts and the account matches them\n * against `call.selector`, so every entry must be a selector. Names were\n * previously forwarded unchanged: on CHIPI the paymaster encoded `\"transfer\"`\n * as a short string (registration succeeded, every session call then failed the\n * whitelist); on SHHH `BigInt(\"transfer\")` threw while serialising calldata.\n *\n * - `0x…` hex and decimal felts pass through (as hex).\n * - Cairo identifiers (`\"transfer\"`, `\"multi_route_swap\"`) become their selector.\n * - Anything else throws `SESSION_ENTRYPOINT_NOT_ALLOWED`.\n */\nexport function normalizeEntrypoints(entrypoints: readonly string[]): string[] {\n return entrypoints.map((entry) => {\n const value = String(entry).trim();\n\n if (HEX_FELT.test(value) || DECIMAL_FELT.test(value)) {\n const felt = BigInt(value);\n if (felt >= FIELD_PRIME) {\n throw new ChipiSessionError(\n `Session entrypoint ${value} is not a valid felt (>= field prime).`,\n SESSION_ERRORS.SESSION_ENTRYPOINT_NOT_ALLOWED\n );\n }\n return num.toHex(felt);\n }\n\n if (CAIRO_IDENTIFIER.test(value)) {\n return hash.getSelectorFromName(value);\n }\n\n throw new ChipiSessionError(\n `Session entrypoint \"${value}\" is neither a selector (0x…) nor a function name.`,\n SESSION_ERRORS.SESSION_ENTRYPOINT_NOT_ALLOWED\n );\n });\n}\n\nexport interface DecodedSessionData {\n isActive: boolean;\n validUntil: number;\n remainingCalls: number;\n allowedEntrypoints: string[];\n}\n\n/**\n * Decode `get_session_data`, which returns the stored `SessionData` struct.\n * The layout is identical on CHIPI v29, v33 and SHHH V8.4:\n *\n * [valid_until: u64, max_calls: u32, calls_used: u32, allowed_entrypoints_len: u32]\n *\n * A revoked or never-registered key reads back as all zeros. `isActive`\n * mirrors the contract's own check: registered, not expired, calls left.\n * The struct carries the whitelist length only, so `allowedEntrypoints` is\n * always empty here (see `SessionDataResponse`).\n */\nexport function decodeSessionData(\n result: readonly string[],\n nowSeconds: number\n): DecodedSessionData {\n const validUntil = Number(BigInt(result[0]));\n const maxCalls = Number(BigInt(result[1]));\n const callsUsed = Number(BigInt(result[2]));\n\n const remainingCalls = Math.max(maxCalls - callsUsed, 0);\n const isActive = validUntil !== 0 && nowSeconds <= validUntil && remainingCalls > 0;\n\n return { isActive, validUntil, remainingCalls, allowedEntrypoints: [] };\n}\n","import { num } from \"starknet\";\nimport type { Call, SessionConfig, SpendingPolicyConfig } from \"@chipi-stack/types\";\nimport { ChipiSessionError, SESSION_ERRORS, SESSION_ENTRYPOINTS } from \"@chipi-stack/shared\";\nimport { normalizeEntrypoints } from \"./session-codec\";\n\n/**\n * Pure builders for the owner-signed session management calls.\n *\n * Every call targets the wallet itself (`add_or_update_session_key`,\n * `set_spending_policy`, ...), which the contract only accepts from the\n * owner. Sign and submit them with any owner path: `sdk.sessions.*`,\n * `executeTransaction`, `useCallAnyContract`, or your own signer. Building\n * them separately lets you batch a session and its spending policies into\n * one transaction (one passkey prompt).\n */\n\nconst U128_MASK = (1n << 128n) - 1n;\nconst U256_MAX = (1n << 256n) - 1n;\nconst U64_MAX = (1n << 64n) - 1n;\n\nfunction splitU256(value: bigint): [string, string] {\n return [num.toHex(value & U128_MASK), num.toHex(value >> 128n)];\n}\n\n/** `add_or_update_session_key(session_key, valid_until, max_calls, allowed_entrypoints)` */\nexport function buildAddSessionKeyCall(walletAddress: string, sessionConfig: SessionConfig): Call {\n const allowedEntrypoints = normalizeEntrypoints(sessionConfig.allowedEntrypoints);\n return {\n contractAddress: walletAddress,\n entrypoint: SESSION_ENTRYPOINTS.ADD_OR_UPDATE,\n calldata: [\n sessionConfig.sessionPublicKey,\n num.toHex(sessionConfig.validUntil),\n num.toHex(sessionConfig.maxCalls),\n num.toHex(allowedEntrypoints.length),\n ...allowedEntrypoints,\n ],\n };\n}\n\n/** `revoke_session_key(session_key)` */\nexport function buildRevokeSessionKeyCall(walletAddress: string, sessionPublicKey: string): Call {\n return {\n contractAddress: walletAddress,\n entrypoint: SESSION_ENTRYPOINTS.REVOKE,\n calldata: [sessionPublicKey],\n };\n}\n\n/**\n * Validate a spending policy the way the contract interprets it.\n * Throws `INVALID_SPENDING_POLICY`.\n */\nexport function validateSpendingPolicyConfig(config: SpendingPolicyConfig): void {\n const { token, maxPerCall, maxPerWindow, windowSeconds } = config;\n\n if (!token || token.trim().length === 0) {\n throw new ChipiSessionError(\n `Invalid token address for spending policy: \"${token}\"`,\n SESSION_ERRORS.INVALID_SPENDING_POLICY\n );\n }\n if (\n typeof windowSeconds !== \"number\" ||\n !Number.isFinite(windowSeconds) ||\n !Number.isInteger(windowSeconds) ||\n windowSeconds <= 0 ||\n BigInt(windowSeconds) > U64_MAX\n ) {\n throw new ChipiSessionError(\n `Invalid window duration: ${windowSeconds}. Must be a positive integer within u64 range.`,\n SESSION_ERRORS.INVALID_SPENDING_POLICY\n );\n }\n if (maxPerCall < 0n || maxPerCall > U256_MAX) {\n throw new ChipiSessionError(\n `Invalid maxPerCall: must be >= 0 and <= 2^256 - 1`,\n SESSION_ERRORS.INVALID_SPENDING_POLICY\n );\n }\n if (maxPerWindow < 0n || maxPerWindow > U256_MAX) {\n throw new ChipiSessionError(\n `Invalid maxPerWindow: must be >= 0 and <= 2^256 - 1`,\n SESSION_ERRORS.INVALID_SPENDING_POLICY\n );\n }\n if (maxPerWindow > 0n && maxPerCall > maxPerWindow) {\n throw new ChipiSessionError(\n `Invalid spending policy: maxPerCall (${maxPerCall}) cannot exceed maxPerWindow (${maxPerWindow})`,\n SESSION_ERRORS.INVALID_SPENDING_POLICY\n );\n }\n}\n\n/**\n * `set_spending_policy(session_key, token, max_per_call: u256, max_per_window: u256, window_seconds: u64)`\n *\n * Contract semantics worth knowing: `maxPerWindow = 0` disables the policy\n * (unlimited), `maxPerCall = 0` with a window blocks every metered spend, and\n * only `transfer` / `approve` / `increase_allowance` are metered.\n */\nexport function buildSetSpendingPolicyCall(\n walletAddress: string,\n config: SpendingPolicyConfig\n): Call {\n validateSpendingPolicyConfig(config);\n const [maxPerCallLow, maxPerCallHigh] = splitU256(config.maxPerCall);\n const [maxPerWindowLow, maxPerWindowHigh] = splitU256(config.maxPerWindow);\n return {\n contractAddress: walletAddress,\n entrypoint: SESSION_ENTRYPOINTS.SET_SPENDING_POLICY,\n calldata: [\n config.sessionPublicKey,\n config.token,\n maxPerCallLow,\n maxPerCallHigh,\n maxPerWindowLow,\n maxPerWindowHigh,\n num.toHex(config.windowSeconds),\n ],\n };\n}\n\n/** `remove_spending_policy(session_key, token)` */\nexport function buildRemoveSpendingPolicyCall(\n walletAddress: string,\n sessionPublicKey: string,\n token: string\n): Call {\n if (!token || token.trim().length === 0) {\n throw new ChipiSessionError(\n `Invalid token address for spending policy removal: \"${token}\"`,\n SESSION_ERRORS.INVALID_SPENDING_POLICY\n );\n }\n return {\n contractAddress: walletAddress,\n entrypoint: SESSION_ENTRYPOINTS.REMOVE_SPENDING_POLICY,\n calldata: [sessionPublicKey, token],\n };\n}\n\n/**\n * Register a session and cap it per token in one multicall: the session is\n * added first, then one `set_spending_policy` per entry. Each policy's\n * `sessionPublicKey` must match the session being registered.\n */\nexport function buildSessionSetupCalls(\n walletAddress: string,\n sessionConfig: SessionConfig,\n spendingPolicies: ReadonlyArray<Omit<SpendingPolicyConfig, \"sessionPublicKey\">> = []\n): Call[] {\n return [\n buildAddSessionKeyCall(walletAddress, sessionConfig),\n ...spendingPolicies.map((policy) =>\n buildSetSpendingPolicyCall(walletAddress, {\n ...policy,\n sessionPublicKey: sessionConfig.sessionPublicKey,\n })\n ),\n ];\n}\n","import { API_ENDPOINTS } from \"@chipi-stack/shared\";\nimport { ChipiClient } from \"./client\";\n\n/**\n * SHHH multisig treasury coordination client (Plus Wave 9 / P1).\n *\n * A thin, typed HTTP client for the chipi-back `/v1/treasuries/:id/...`\n * endpoints. It implements the same transport contract `@chipi-stack/chipi-react`\n * injects into `useProposeAction` / `useTreasuryProposals` (`MultisigTransport`),\n * so an integrator can wire `sdk.treasury.forTreasury(...)` straight into those\n * hooks instead of hand-writing fetch glue.\n *\n * Auth model (decision §11.2 — owner-signature-as-authorization):\n * - propose / sign: `pk_` (the public api key) PLUS the owner's V2_SNIP12\n * envelope (already inside the proposal body) AND the owner's\n * `ownerPubkey` (kind-specific — see {@link ForTreasuryConfig.ownerPubkey}).\n * chipi-back's OwnerSignatureVerifier proves the request came from a\n * current on-chain owner, so no secret is needed — these are safe to\n * call from the browser.\n * - execute / list / allowance: `sk_` (a secret key bearer). execute relays\n * through the paymaster and meters; reads are org-private. Call these from\n * a server (a Next.js route handler / your backend), never the browser.\n *\n * The types below mirror `@chipi-stack/chipi-react/multisig`'s `TreasuryProposal`\n * / `ProposeBody` field-for-field (post-#324: OE `executeAfter` is derived from\n * `executeBefore`, never sent or stored). They're duplicated (not imported) so\n * the server SDK never depends on the React package; TypeScript's structural\n * typing makes a `TreasuryTransport` assignable to the hook's `MultisigTransport`.\n */\n\n/** One owner's collected signature on a proposal. */\nexport interface TreasuryProposalSignature {\n ownerId: number;\n signerKind: string;\n /** The owner's serialized inner V2_SNIP12 envelope (comma-joined felts). */\n signature: string;\n}\n\n/** A treasury proposal as returned by the coordination backend. */\nexport interface TreasuryProposal {\n id: string;\n /** Set for generalized actions (vote / call any contract); null for payments. */\n calls?: { to: string; entrypoint: string; calldata: string[] }[] | null;\n /** Human label for an action (\"Vote YES on Proposal #5\"). */\n title?: string | null;\n /** Arbitrary integrator context persisted with the proposal (chipi-back\n * #301, `meta Json?`) — e.g. `{ poolId }`, read by the approver app's\n * `renderContext`. Null on payments and pre-#301 rows. */\n meta?: Record<string, string | number> | null;\n /** App-level risk tier the proposal was filed under (chipi-back #302;\n * null = none). */\n risk?: \"ROUTINE\" | \"SENSITIVE\" | null;\n oeMessageHash: string;\n oeNonce: string | null;\n /** chipi-back persists only `oeExecuteBefore`; the OE `executeAfter` is\n * re-derived as `executeBefore - 2h` by executors (see chipi-react #324). */\n oeExecuteBefore: string | null;\n requiredApprovals: number;\n status: \"PROPOSED\" | \"APPROVED\" | \"EXECUTED\" | \"CANCELED\" | \"EXPIRED\";\n executedTxHash?: string | null;\n signatures: TreasuryProposalSignature[];\n}\n\n/** The body the coordination backend's `propose` endpoint accepts. */\nexport interface ProposeBody {\n proposerOwnerId: number;\n recipient: string;\n tokenAddress: string;\n amount: string;\n title: string;\n calls: { to: string; entrypoint: string; calldata: string[] }[];\n /** Arbitrary integrator context persisted with the proposal (chipi-back\n * #301). Flat string|number values, bounded server-side: ≤16 keys, key\n * ≤40 chars, string values ≤200 chars. */\n meta?: Record<string, string | number>;\n /** Template risk tier (chipi-back #302): when the treasury configured the\n * matching quorum, the server overrides requiredApprovals at propose. */\n risk?: \"ROUTINE\" | \"SENSITIVE\";\n oeMessageHash: string;\n oeNonce: string;\n oeExecuteBefore: string;\n requiredApprovals: number;\n proposerSignature: string;\n proposerSignerKind: string;\n}\n\n/** The approver's body for `sign` (mirrors chipi-react's call site). */\nexport interface ApproveBody {\n ownerId: number;\n signature: string;\n signerKind: string;\n}\n\n/** Result of relaying an execute through the paymaster. */\nexport interface ExecuteResult {\n executedTxHash?: string;\n transactionHash?: string;\n}\n\n/** Free-execute meter for the org (shape owned by chipi-back's treasury svc). */\nexport interface MultisigAllowance {\n freeExecutesRemaining?: number;\n priceUsd?: number;\n creditsUsd?: number;\n canExecuteNow?: boolean;\n [key: string]: unknown;\n}\n\n/** One treasury as returned by `list()`. Mirrors chipi-back's `OrgTreasury`\n * row plus the joined wallet projection. Dates arrive as ISO strings. */\nexport interface TreasurySummary {\n /** The id `forTreasury({ treasuryId })` expects. */\n id: string;\n organizationId: string;\n name: string;\n walletId: string;\n createdAt: string;\n updatedAt: string;\n /** Non-null once archived. Archived treasuries are excluded unless\n * `includeArchived` is set. */\n archivedAt: string | null;\n routineQuorum: number | null;\n sensitiveQuorum: number | null;\n wallet: {\n id: string;\n publicKey: string;\n walletType: string;\n isDeployed: boolean;\n chain: string;\n };\n}\n\n/** Page of treasuries owned by the api key's org. */\nexport interface ListTreasuriesResult {\n items: TreasurySummary[];\n total: number;\n page: number;\n limit: number;\n hasMore: boolean;\n}\n\n/**\n * Risk-tier quorum policy for one treasury.\n *\n * A proposal filed with `risk: \"ROUTINE\" | \"SENSITIVE\"` gets its\n * `requiredApprovals` overridden server-side from the matching quorum, so you\n * can require more signatures for `borrow` than for `repay` without changing\n * the wallet's on-chain threshold.\n *\n * `null` means the tier has no policy and the client's `requiredApprovals`\n * stands.\n */\nexport interface TreasuryPolicy {\n treasuryId: string;\n name: string;\n routineQuorum: number | null;\n sensitiveQuorum: number | null;\n}\n\nexport interface SetTreasuryPolicyOptions {\n /** Omit to leave unchanged. Pass `null` to clear the tier. */\n routineQuorum?: number | null;\n /** Omit to leave unchanged. Pass `null` to clear the tier. */\n sensitiveQuorum?: number | null;\n /** A `sk_`. Falls back to the SDK's configured `apiSecretKey`. */\n bearerToken?: string;\n}\n\nexport interface ListTreasuriesOptions {\n /** 1-based. Defaults to 1 server-side. */\n page?: number;\n /** Server clamps to 1..100; defaults to 25. */\n limit?: number;\n /** Include archived treasuries. Defaults to false. */\n includeArchived?: boolean;\n /** A `sk_`. Falls back to the SDK's configured `apiSecretKey`. */\n bearerToken?: string;\n}\n\n/**\n * A transport bound to one treasury + the local owner's public key.\n * Structurally compatible with `@chipi-stack/chipi-react`'s `MultisigTransport`.\n */\nexport interface TreasuryTransport {\n list(): Promise<{ items: TreasuryProposal[] }>;\n propose(body: ProposeBody): Promise<TreasuryProposal>;\n sign(proposalId: string, body: ApproveBody): Promise<unknown>;\n execute(proposalId: string, calldata: string[]): Promise<ExecuteResult>;\n /** Read the org's free-execute meter (sk_). Not part of MultisigTransport. */\n getMultisigAllowance(): Promise<MultisigAllowance>;\n}\n\nexport interface ForTreasuryConfig {\n /** The org treasury id (the multisig wallet's row id in chipi-back). */\n treasuryId: string;\n /**\n * The local owner's public key, sent with propose / sign so the backend can\n * verify the envelope commits to a current on-chain owner. Kind-specific\n * format (must match the `signerKind` of the envelopes this transport sends):\n * - STARK: one 0x-hex felt (the stark key) — `starkPubkeyFelts(pub)[0]`.\n * - WEBAUTHN_P256: `\"0x<x>,0x<y>\"` (full 32-byte BE P-256 coordinates) —\n * use `webauthnOwnerPubkeyParam(pubkey)`.\n * - EIP191_SECP256K1 (MetaMask): `\"0x<x>,0x<y>\"` (full 32-byte BE\n * secp256k1 coordinates) — use `eip191OwnerPubkeyParam(pubkey)`.\n * - ED25519 (Phantom): `\"0x<low>,0x<high>\"` (LE u128 halves of the\n * 32-byte key) — use `ed25519OwnerPubkeyParam(publicKey)`.\n * NOTE: the coordinate-based kinds take the FULL x/y values, never the\n * 4-felt `*PubkeyFelts` form (the backend rejects more than 2 values).\n */\n ownerPubkey: string;\n /** A secret key (`sk_`) for execute / list / allowance. Falls back to the\n * SDK's configured `apiSecretKey`. Required only for those three; propose /\n * sign authenticate with `pk_` + the owner signature. */\n bearerToken?: string;\n}\n\nexport class ChipiTreasury {\n constructor(\n private client: ChipiClient,\n private apiSecretKey?: string\n ) {}\n\n private base(treasuryId: string): string {\n return `${API_ENDPOINTS.TREASURIES}/${treasuryId}/transactions`;\n }\n\n /** Resolve a `sk_` for the secret-gated reads/execute, or fail loudly. */\n private secret(bearerToken?: string): string {\n const token = bearerToken ?? this.apiSecretKey;\n if (!token) {\n throw new Error(\n \"A secret key (sk_) is required for treasury execute / list / allowance. \" +\n \"Pass `bearerToken` to forTreasury(...) or configure the SDK with apiSecretKey. \" +\n \"Call these from a server, never the browser.\"\n );\n }\n return token;\n }\n\n /**\n * List every treasury owned by the api key's organization (`sk_`).\n *\n * This is the discovery entry point for {@link ForTreasuryConfig.treasuryId}.\n * The secret key resolves the org server-side, so there is no org id to\n * pass and nothing to look up in the dashboard first. Use it to recover a\n * `treasuryId` that fell out of your config, or to avoid pinning one in an\n * environment variable at all.\n *\n * Server-only: it needs a `sk_`, so never call it from the browser.\n *\n * @example\n * ```typescript\n * const { items } = await sdk.treasury.list();\n * const ops = items.find((t) => t.name === \"Ops Treasury\");\n * const transport = sdk.treasury.forTreasury({\n * treasuryId: ops.id,\n * ownerPubkey,\n * });\n * ```\n */\n async list(options: ListTreasuriesOptions = {}): Promise<ListTreasuriesResult> {\n const { page, limit, includeArchived, bearerToken } = options;\n const params: Record<string, string> = {};\n if (page !== undefined) params.page = String(page);\n if (limit !== undefined) params.limit = String(limit);\n if (includeArchived !== undefined) {\n params.includeArchived = String(includeArchived);\n }\n\n const res = await this.client.get<ListTreasuriesResult>({\n endpoint: API_ENDPOINTS.TREASURIES,\n params,\n bearerToken: this.secret(bearerToken),\n });\n // Defensive: the hook-facing shape always has an array.\n return { ...res, items: res.items ?? [] };\n }\n\n /**\n * Read a treasury's risk-tier quorum policy (`sk_`).\n */\n async getPolicy(\n treasuryId: string,\n options: { bearerToken?: string } = {}\n ): Promise<TreasuryPolicy> {\n return this.client.get<TreasuryPolicy>({\n endpoint: `${API_ENDPOINTS.TREASURIES}/${treasuryId}/policy`,\n bearerToken: this.secret(options.bearerToken),\n });\n }\n\n /**\n * Set a treasury's risk-tier quorums (`sk_`).\n *\n * An omitted tier is left unchanged; passing `null` clears it. Configuring\n * this used to require the dashboard, so an integrator driving governance\n * from their own server could see a quorum applied to a proposal but never\n * choose it.\n *\n * IMPORTANT: a quorum can only RAISE `requiredApprovals`, never lower it\n * below the wallet's on-chain threshold. Set one below and it is SILENTLY\n * RAISED at propose time, not rejected and not reverted: a `routineQuorum`\n * of 1 on a 2-of-3 wallet is clamped to 2 and executes normally. The risk is\n * a policy that reads 1 everywhere while the system uses 2.\n *\n * The server now rejects that outright so the stored value means what it\n * says (server-side enforcement, live since 2026-08; no SDK upgrade\n * needed). To genuinely lower the requirement, lower the on-chain\n * threshold first with `propose_set_threshold` (48h timelock).\n *\n * Server-only: it needs a `sk_`.\n *\n * @example\n * ```typescript\n * // Founding a pool and borrowing need 3 owners; repaying needs the\n * // wallet's own threshold.\n * await sdk.treasury.setPolicy(treasuryId, { sensitiveQuorum: 3 });\n * ```\n */\n async setPolicy(\n treasuryId: string,\n options: SetTreasuryPolicyOptions = {}\n ): Promise<TreasuryPolicy> {\n const { routineQuorum, sensitiveQuorum, bearerToken } = options;\n const body: Record<string, number | null> = {};\n // `undefined` means \"leave unchanged\", so only send what was supplied.\n // An explicit null must survive, which rules out a truthiness check.\n if (routineQuorum !== undefined) body.routineQuorum = routineQuorum;\n if (sensitiveQuorum !== undefined) body.sensitiveQuorum = sensitiveQuorum;\n\n return this.client.patch<TreasuryPolicy>({\n endpoint: `${API_ENDPOINTS.TREASURIES}/${treasuryId}/policy`,\n bearerToken: this.secret(bearerToken),\n body,\n });\n }\n\n /**\n * Build a {@link TreasuryTransport} for one treasury + owner. Wire the\n * returned object directly into chipi-react's `useProposeAction` /\n * `useTreasuryProposals` `transport` prop, or call its methods yourself.\n */\n forTreasury(config: ForTreasuryConfig): TreasuryTransport {\n const { treasuryId, ownerPubkey } = config;\n const base = this.base(treasuryId);\n\n return {\n // sk_ — read the proposal list. chipi-back returns\n // { items, total, page, limit, hasMore }; the hook only reads `items`.\n list: async () => {\n const res = await this.client.get<{ items: TreasuryProposal[] }>({\n endpoint: base,\n bearerToken: this.secret(config.bearerToken),\n });\n return { ...res, items: res.items ?? [] };\n },\n\n // pk_ + owner sig — no secret. `ownerPubkey` lets the backend verify the\n // proposer envelope. `meta` (if present) is stripped server-side.\n propose: async (body: ProposeBody) => {\n return this.client.post<TreasuryProposal>({\n endpoint: base,\n // Empty string → no Authorization header; the pk_ travels in\n // x-api-key, which ApiKeyGuard accepts for propose.\n bearerToken: \"\",\n body: { ...body, ownerPubkey },\n });\n },\n\n // pk_ + owner sig — approve an existing proposal.\n sign: async (proposalId: string, body: ApproveBody) => {\n return this.client.post<unknown>({\n endpoint: `${base}/${proposalId}/sign`,\n bearerToken: \"\",\n body: { ...body, ownerPubkey },\n });\n },\n\n // sk_ — relay the assembled threshold calldata through the paymaster.\n execute: async (proposalId: string, calldata: string[]) => {\n return this.client.post<ExecuteResult>({\n endpoint: `${base}/${proposalId}/execute`,\n bearerToken: this.secret(config.bearerToken),\n body: { calldata },\n });\n },\n\n // sk_ — the free-execute meter (org-scoped).\n getMultisigAllowance: async () => {\n return this.client.get<MultisigAllowance>({\n endpoint: `${API_ENDPOINTS.TREASURIES}/${treasuryId}/multisig-allowance`,\n bearerToken: this.secret(config.bearerToken),\n });\n },\n };\n }\n}\n","import { WALLET_RPC_ENDPOINTS, withRpcFallback } from \"@chipi-stack/shared\";\n\n/**\n * Wait for a Starknet transaction and report what happened, without throwing\n * on an on-chain revert.\n *\n * Every gasless write in this SDK returns a transaction hash and nothing else,\n * so integrators were each writing the same receipt-polling loop to answer two\n * questions: did it actually succeed, and what events did it emit. Getting that\n * loop wrong is expensive in a money flow. A revert that reads as success\n * double-credits a ledger; a timeout treated as failure strands a confirmed\n * transfer.\n *\n * The contract here is deliberately narrow: a REVERTED transaction is a\n * RESULT, not an exception, because a revert is a normal outcome your code\n * must branch on. Exceptions are reserved for \"we do not know yet\": a timeout\n * or a transport failure, where retrying is the correct response and treating\n * it as failure would be wrong.\n */\n\n/** One raw event from the receipt. Decode against your own ABI. */\nexport interface ContractEventLog {\n /** Emitting contract address. Filter on this before matching keys. */\n from_address: string;\n /** Indexed fields. `keys[0]` is the selector of the event name. */\n keys: string[];\n /** Non-indexed fields, in declaration order. */\n data: string[];\n}\n\nexport interface WaitForTransactionResult {\n transactionHash: string;\n /** True only for an accepted, non-reverted transaction. */\n success: boolean;\n /** Raw `execution_status` from the node, when it reported one. */\n executionStatus?: string;\n /** Raw `finality_status` from the node, when it reported one. */\n finalityStatus?: string;\n /** Present when `success` is false and the node gave a reason. */\n revertReason?: string;\n /** Empty on a revert: reverted transactions emit no events. */\n events: ContractEventLog[];\n blockNumber?: number;\n}\n\nexport interface WaitForTransactionOptions {\n /**\n * Preferred endpoint. It is the caller's slot in the ordered RPC chain, not\n * the only endpoint tried: reading a receipt is idempotent, so a transport\n * failure falls through to the next endpoint rather than aborting the wait.\n * Defaults to the endpoint the SDK already uses for CHIPI wallets.\n */\n nodeUrl?: string;\n /** Poll interval. Default 3000ms, roughly Starknet's block cadence. */\n retryIntervalMs?: number;\n /** Total budget before giving up. Default 300000ms (5 minutes). */\n timeoutMs?: number;\n}\n\nconst DEFAULT_RETRY_INTERVAL_MS = 3_000;\nconst DEFAULT_TIMEOUT_MS = 300_000;\n\n/** A receipt is only meaningful once the node has sequenced it. */\nfunction isPending(finalityStatus?: string): boolean {\n return (\n finalityStatus === undefined ||\n finalityStatus === \"RECEIVED\" ||\n finalityStatus === \"PENDING\" ||\n finalityStatus === \"PRE_CONFIRMED\"\n );\n}\n\n/**\n * Poll until `transactionHash` reaches a terminal state.\n *\n * @throws if the timeout elapses before the node sequences the transaction.\n * It does NOT throw when the transaction reverted: check `success`.\n *\n * @example\n * ```typescript\n * const txHash = await sdk.callAnyContract({ params, bearerToken });\n * const receipt = await sdk.waitForTransaction(txHash);\n *\n * if (!receipt.success) {\n * throw new Error(receipt.revertReason ?? \"reverted on chain\");\n * }\n *\n * const created = receipt.events.find(\n * (e) => e.from_address === FACTORY && e.keys[0] === POOL_CREATED_SELECTOR\n * );\n * ```\n */\nexport async function waitForTransaction(\n transactionHash: string,\n options: WaitForTransactionOptions = {}\n): Promise<WaitForTransactionResult> {\n const {\n nodeUrl = WALLET_RPC_ENDPOINTS.CHIPI,\n retryIntervalMs = DEFAULT_RETRY_INTERVAL_MS,\n timeoutMs = DEFAULT_TIMEOUT_MS,\n } = options;\n\n const deadline = Date.now() + timeoutMs;\n // Surfaced only if we time out, so the caller learns why we kept polling\n // (transaction genuinely not found vs the node erroring every time).\n let lastError: unknown;\n\n for (;;) {\n try {\n // Idempotent read, so it is safe to advance down the endpoint chain on a\n // transport-class failure. Never wrap the submit side this way.\n const receipt = (await withRpcFallback(\n (provider) => provider.getTransactionReceipt(transactionHash),\n { fallbackUrl: nodeUrl }\n )) as unknown as {\n execution_status?: string;\n finality_status?: string;\n revert_reason?: string;\n events?: ContractEventLog[];\n block_number?: number;\n };\n\n if (!isPending(receipt?.finality_status)) {\n const reverted = receipt.execution_status === \"REVERTED\";\n return {\n transactionHash,\n success: !reverted,\n executionStatus: receipt.execution_status,\n finalityStatus: receipt.finality_status,\n ...(reverted ? { revertReason: receipt.revert_reason ?? \"reverted on chain\" } : {}),\n events: receipt.events ?? [],\n ...(receipt.block_number !== undefined ? { blockNumber: receipt.block_number } : {}),\n };\n }\n } catch (err) {\n // A not-yet-propagated transaction reads as an error on most nodes, so\n // this is the normal path for the first few polls, not an exception.\n lastError = err;\n }\n\n if (Date.now() + retryIntervalMs >= deadline) {\n const detail = lastError instanceof Error ? `: ${lastError.message}` : \"\";\n throw new Error(\n `Timed out after ${timeoutMs}ms waiting for ${transactionHash}${detail}. ` +\n `The transaction may still land; re-check before treating it as failed.`\n );\n }\n\n await new Promise((resolve) => setTimeout(resolve, retryIntervalMs));\n }\n}\n","import { hash } from \"starknet\";\nimport {\n waitForTransaction,\n type ContractEventLog,\n type WaitForTransactionOptions,\n type WaitForTransactionResult,\n} from \"../wait-for-transaction\";\n\n/**\n * Remembers which transaction hashes already paid for something.\n *\n * `consume` must be atomic: return `true` the first time a hash is seen and\n * `false` on every later call, also across concurrent requests. Back it with a\n * unique index in your database (`INSERT ... ON CONFLICT DO NOTHING`) in\n * production; the default in-memory store forgets everything on restart and is\n * not shared between instances.\n */\nexport interface TxHashStore {\n /**\n * `transactionHash` arrives normalised: lowercase `0x` hex without leading\n * zeros, so `0x0abc` and `0x000…abc` are the same key. Pad it yourself if you\n * compare it with RPC output.\n */\n consume(transactionHash: string): boolean | Promise<boolean>;\n}\n\nclass InMemoryTxHashStore implements TxHashStore {\n private readonly used = new Set<string>();\n\n consume(transactionHash: string): boolean {\n if (this.used.has(transactionHash)) return false;\n this.used.add(transactionHash);\n return true;\n }\n}\n\nexport interface SessionTxVerifierConfig extends WaitForTransactionOptions {\n /** Default: in memory (single process, lost on restart). */\n txHashStore?: TxHashStore;\n /** Receipt source. Default: `waitForTransaction` with the options above. */\n getReceipt?: (\n transactionHash: string,\n options: WaitForTransactionOptions\n ) => Promise<WaitForTransactionResult>;\n}\n\nexport interface VerifyTransferParams {\n /** The hash the payer sent you, e.g. from `executeTransactionWithSession`. */\n transactionHash: string;\n /** ERC-20 contract, e.g. USDC. */\n token: string;\n /** The paying wallet. */\n from: string;\n /** Your receiving address. */\n to: string;\n /** Smallest acceptable amount, in the token's base units. */\n minAmount: bigint;\n}\n\nexport type VerifyTransferFailure =\n /** The transaction reverted on chain. */\n | \"REVERTED\"\n /** No `Transfer` from `token` with this `from` and `to`. */\n | \"TRANSFER_NOT_FOUND\"\n /** A matching `Transfer` exists but moved less than `minAmount`. */\n | \"AMOUNT_TOO_LOW\"\n /** This hash already paid for something (replay). */\n | \"ALREADY_USED\";\n\nexport type VerifyTransferResult =\n | { valid: true; transactionHash: string; amount: bigint; blockNumber?: number }\n | { valid: false; transactionHash: string; reason: VerifyTransferFailure; detail?: string };\n\nconst TRANSFER_SELECTOR = BigInt(hash.getSelectorFromName(\"Transfer\"));\n\nfunction toBigInt(value: string | undefined): bigint | undefined {\n if (value === undefined) return undefined;\n try {\n return BigInt(value);\n } catch {\n return undefined;\n }\n}\n\n/**\n * Decode an ERC-20 `Transfer` event in either layout:\n * - Cairo 1 (OpenZeppelin, native USDC): keys `[selector, from, to]`, data `[low, high]`;\n * - Cairo 0: keys `[selector]`, data `[from, to, low, high]`.\n */\nfunction decodeTransfer(\n event: ContractEventLog\n): { from: bigint; to: bigint; amount: bigint } | undefined {\n if (toBigInt(event.keys[0]) !== TRANSFER_SELECTOR) return undefined;\n\n const [from, to, low, high] =\n event.keys.length >= 3\n ? [event.keys[1], event.keys[2], event.data[0], event.data[1]]\n : [event.data[0], event.data[1], event.data[2], event.data[3]];\n\n const values = [from, to, low, high].map(toBigInt);\n if (values.some((v) => v === undefined)) return undefined;\n const [f, t, l, h] = values as bigint[];\n return { from: f, to: t, amount: l + (h << 128n) };\n}\n\n/**\n * Check on chain that a transaction paid you, and that it pays only once.\n *\n * Use it when a client pays by sending the transfer itself (for example an\n * agent with a session key calling `executeTransactionWithSession`) and hands\n * you the hash. A transaction hash, or a `SUCCESS` status from an API, is not\n * proof of payment: the transfer may have reverted, gone elsewhere, moved less,\n * or already been used for an earlier request. This reads the receipt and\n * accepts only a successful transaction whose `Transfer` event from `token`\n * moves at least `minAmount` from `from` to `to`, then consumes the hash.\n *\n * Opt-in and independent of `X402Facilitator`, whose behaviour is unchanged.\n *\n * **Who is `from`.** Transaction hashes and `Transfer` events are public. If\n * `from` comes from the request, anyone watching your address can submit a\n * payer's hash first and consume it: they get the service, the payer gets\n * `ALREADY_USED`. Take `from` from the caller's authenticated identity (your\n * session, an API key bound to a wallet) whenever you have one. For anonymous\n * payers this is first-come-first-served; keep it to low-value calls.\n *\n * `verifyTransfer` waits for the transaction to be sequenced and throws only\n * when it cannot tell (timeout, RPC failure): retry those. Every other outcome\n * is a result.\n *\n * @example\n * ```typescript\n * const verifier = new SessionTxVerifier({ txHashStore: dbStore });\n *\n * const result = await verifier.verifyTransfer({\n * transactionHash,\n * token: USDC,\n * from: agentWallet,\n * to: TREASURY,\n * minAmount: 1_000n, // $0.001 in USDC base units\n * });\n * if (!result.valid) return new Response(result.reason, { status: 402 });\n * ```\n */\nexport class SessionTxVerifier {\n private readonly store: TxHashStore;\n private readonly getReceipt: NonNullable<SessionTxVerifierConfig[\"getReceipt\"]>;\n private readonly receiptOptions: WaitForTransactionOptions;\n\n constructor(config: SessionTxVerifierConfig = {}) {\n const { txHashStore, getReceipt, ...receiptOptions } = config;\n this.store = txHashStore ?? new InMemoryTxHashStore();\n this.getReceipt = getReceipt ?? waitForTransaction;\n this.receiptOptions = receiptOptions;\n }\n\n async verifyTransfer(params: VerifyTransferParams): Promise<VerifyTransferResult> {\n const { transactionHash, token, from, to, minAmount } = params;\n const receipt = await this.getReceipt(transactionHash, this.receiptOptions);\n\n if (!receipt.success) {\n return { valid: false, transactionHash, reason: \"REVERTED\", detail: receipt.revertReason };\n }\n\n const tokenAddress = BigInt(token);\n const fromAddress = BigInt(from);\n const toAddress = BigInt(to);\n\n let best: bigint | undefined;\n for (const event of receipt.events) {\n if (toBigInt(event.from_address) !== tokenAddress) continue;\n const transfer = decodeTransfer(event);\n if (!transfer || transfer.from !== fromAddress || transfer.to !== toAddress) continue;\n if (best === undefined || transfer.amount > best) best = transfer.amount;\n }\n\n if (best === undefined) {\n return { valid: false, transactionHash, reason: \"TRANSFER_NOT_FOUND\" };\n }\n if (best < minAmount) {\n return {\n valid: false,\n transactionHash,\n reason: \"AMOUNT_TOO_LOW\",\n detail: `paid ${best}, expected at least ${minAmount}`,\n };\n }\n\n // Normalise so 0x0abc and 0xabc are the same key.\n const key = \"0x\" + BigInt(transactionHash).toString(16);\n if (!(await this.store.consume(key))) {\n return { valid: false, transactionHash, reason: \"ALREADY_USED\" };\n }\n\n return {\n valid: true,\n transactionHash,\n amount: best,\n ...(receipt.blockNumber !== undefined ? { blockNumber: receipt.blockNumber } : {}),\n };\n }\n}\n","import type {\n AiChatParams,\n AiChatResponse,\n AiExecuteParams,\n AiExecuteResponse,\n AiModelsResponse,\n AiPrices,\n AiPricesParams,\n AiSignals,\n AiSignalsParams,\n PaymentPayload,\n PaymentRequirement,\n ThinkDecision,\n ThinkOptions,\n ThinkParams,\n ThinkResponse,\n ThinkSessionPayment,\n} from \"@chipi-stack/types\";\nimport { ChipiApiError, ChipiAuthError, CONTRACT_ADDRESSES } from \"@chipi-stack/shared\";\nimport { ChipiClient } from \"./client\";\nimport type { ChipiSessions } from \"./sessions\";\nimport { waitForTransaction, type WaitForTransactionResult } from \"./wait-for-transaction\";\nimport { SessionTxVerifier } from \"./x402/session-tx-verifier\";\n\nconst AI_BASE = \"/ai\";\nconst THINK_ACTIONS = new Set([\"swap\", \"supply\", \"withdraw\", \"hold\"]);\n\n/** Attempts at a paid call the API says to retry (503 verification unavailable, 409 in progress). */\nconst PAID_MAX_ATTEMPTS = 3;\nconst PAID_RETRY_DELAY_MS = 5_000;\n\n/** Canonical felt252: 0x plus 64 hex digits, leading zeros kept. */\nconst padFelt = (value: string) => \"0x\" + BigInt(value).toString(16).padStart(64, \"0\");\n\nfunction sameFelt(a: string, b: string): boolean {\n try {\n return BigInt(a) === BigInt(b);\n } catch {\n return false;\n }\n}\n\n/**\n * The session-transfer x402 offer in a 402 from the AI API, if there is one.\n * Only `exact` USDC on Starknet mainnet paid by a session transfer qualifies.\n */\nfunction sessionTransferOffer(err: unknown): PaymentRequirement | undefined {\n if (!(err instanceof ChipiApiError) || err.status !== 402) return undefined;\n const details = err.details as { x402?: { accepts?: PaymentRequirement[] } } | undefined;\n return details?.x402?.accepts?.find(\n (r) =>\n r.scheme === \"exact\" &&\n r.network === \"starknet-mainnet\" &&\n r.extra?.paymentMethod === \"session-transfer\" &&\n sameFelt(r.asset, CONTRACT_ADDRESSES.USDC_MAINNET)\n );\n}\n\n/**\n * Caller input as think prints it in the prompt, in UTF-8 bytes (what\n * `maxPromptBytes` limits), measured the way chipi-back measures it: the\n * portfolio as pretty JSON, `recentDecisions` (a number) as printed, and\n * `chain`, which the system prompt prints twice.\n */\nfunction thinkInputBytes(params: ThinkParams): number {\n const bytes = (text: string) => new TextEncoder().encode(text).length;\n const chain = params.chain ?? \"starknet\";\n return (\n bytes(JSON.stringify(params.portfolio, null, 2)) +\n (params.history?.recentDecisions ? bytes(String(params.history.recentDecisions)) : 0) +\n 2 * bytes(chain)\n );\n}\n\nconst sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\n\n/**\n * Whether `/v1/ai/think` returned a structured decision you can act on.\n *\n * `false` for a non-JSON reply (`{ raw }`) and for any `action` outside\n * `swap | supply | withdraw | hold`. Treat `false` as `hold`. This checks the\n * shape only: the amounts and tokens are still yours to validate.\n */\nexport function isThinkDecision(decision: unknown): decision is ThinkDecision {\n if (!decision || typeof decision !== \"object\") return false;\n const d = decision as Record<string, unknown>;\n if (typeof d.action !== \"string\" || !THINK_ACTIONS.has(d.action)) return false;\n if (typeof d.reason !== \"string\") return false;\n if (d.amount !== undefined && (typeof d.amount !== \"number\" || !Number.isFinite(d.amount)))\n return false;\n if (d.confidence !== undefined && typeof d.confidence !== \"number\") return false;\n if (d.from !== undefined && typeof d.from !== \"string\") return false;\n if (d.to !== undefined && typeof d.to !== \"string\") return false;\n return true;\n}\n\n/**\n * Chipi AI API: prices, market signals, a DeFi decision engine, swap call\n * building and general chat, billed to your organization's credits.\n *\n * Server-only. Every method authenticates with the SDK's secret key (`sk_`)\n * and refuses to run without one, so a public key in the browser can never\n * spend your credits through this client.\n *\n * Errors come back as `ChipiApiError` with the API's code and HTTP status:\n * `INSUFFICIENT_BALANCE` (402) when credits run out, `MODEL_RATE_LIMITED`\n * (429), `SIGNALS_UNAVAILABLE` (503) while signals warm up after a backend restart.\n *\n * @example\n * ```typescript\n * const sdk = new ChipiServerSDK({ apiPublicKey, apiSecretKey });\n *\n * const signals = await sdk.ai.signals({ tokens: [\"ETH\", \"STRK\"] });\n * const { decision } = await sdk.ai.think({ portfolio, riskScore: 4 });\n * if (isThinkDecision(decision) && decision.action === \"swap\") {\n * const { calls } = await sdk.ai.execute({\n * chain: \"starknet\",\n * action: \"swap\",\n * from: decision.from!,\n * to: decision.to!,\n * amountUsd: 10,\n * walletAddress,\n * });\n * }\n * ```\n */\nexport class ChipiAi {\n constructor(\n private client: ChipiClient,\n private apiSecretKey?: string,\n /** Needed only to pay think calls with `payWithSession`. */\n private sessions?: ChipiSessions\n ) {}\n\n private secret(): string {\n const key = this.apiSecretKey;\n if (!key || !key.startsWith(\"sk_\")) {\n throw new ChipiAuthError(\n \"sdk.ai needs a secret key (sk_): configure the SDK with apiSecretKey and call it from a server, never the browser.\"\n );\n }\n return key;\n }\n\n /**\n * `GET /v1/ai/signals`: technical signals per token, market sentiment and\n * DeFi yields. Free up to a monthly quota per organization, then billed per call.\n */\n async signals(params: AiSignalsParams = {}): Promise<AiSignals> {\n const query: Record<string, string> = {};\n if (params.tokens?.length) query.tokens = params.tokens.join(\",\");\n if (params.chain) query.chain = params.chain;\n return this.client.get<AiSignals>({\n endpoint: `${AI_BASE}/signals`,\n params: query,\n bearerToken: this.secret(),\n });\n }\n\n /**\n * `POST /v1/ai/think`: one DeFi decision for a portfolio, with the latest\n * signals and your risk parameters injected into the prompt.\n *\n * The decision is advice, not an order: check it with `isThinkDecision` and\n * enforce your own limits before executing anything.\n *\n * **Paying per call (x402).** With `payWithSession`, a 402 that carries a\n * session-transfer offer (credits short, x402 on) is paid with the agent's\n * session key: a USDC `transfer` to the offer's `payTo`, then the same call\n * again with `X-PAYMENT`. The price must be at most `maxAmount`, `model`\n * must be payable and the input within `maxPromptBytes`, all checked before\n * paying. The wallet must be a wallet of the organization that owns the\n * `sk_`: the first request names it in `X-PAYER`, and when the API answers\n * that a payment from it would be refused, nothing is paid\n * (`X402_PAYER_NOT_IN_ORG`). The session must whitelist `transfer` and cap\n * USDC. A payment that was made but not served is reported in\n * `error.details.xPayment`; pass it back as `options.xPayment` to retry\n * without paying again.\n *\n * @example\n * ```typescript\n * const res = await sdk.ai.think(\n * { portfolio, model: \"haiku\" },\n * { payWithSession: { encryptKey, wallet, session, maxAmount: 20_000n } } // $0.02 at most\n * );\n * res.x402Payment; // set when the call was paid over x402\n * ```\n */\n async think(params: ThinkParams, options: ThinkOptions = {}): Promise<ThinkResponse> {\n // X-PAYER: the API says in its offer whether a payment from this wallet\n // would be accepted, so a wallet of another org is never charged.\n let payer: string | undefined;\n if (options.payWithSession && !options.xPayment) {\n try {\n payer = padFelt(options.payWithSession.wallet.publicKey);\n } catch {\n payer = undefined; // not a felt: send nothing, the payment checks still run\n }\n }\n try {\n return await this.postThink(params, options.xPayment, payer);\n } catch (err) {\n const offer = options.payWithSession ? sessionTransferOffer(err) : undefined;\n if (!offer || !options.payWithSession) throw err;\n return this.payAndThink(params, offer, options.payWithSession);\n }\n }\n\n private postThink(\n params: ThinkParams,\n xPayment?: string,\n payer?: string\n ): Promise<ThinkResponse> {\n const headers: Record<string, string> = {\n ...(xPayment ? { \"X-PAYMENT\": xPayment } : {}),\n ...(payer ? { \"X-PAYER\": payer } : {}),\n };\n return this.client.post<ThinkResponse>({\n endpoint: `${AI_BASE}/think`,\n bearerToken: this.secret(),\n body: params,\n ...(Object.keys(headers).length > 0 ? { headers } : {}),\n });\n }\n\n /**\n * Pay one think call with a session-key USDC transfer, then send it again\n * with `X-PAYMENT`. Every check that can refuse the call runs before the\n * transfer; the transfer counts only once its receipt shows the USDC moved.\n */\n private async payAndThink(\n params: ThinkParams,\n offer: PaymentRequirement,\n pay: ThinkSessionPayment\n ): Promise<ThinkResponse> {\n if (!this.sessions) {\n throw new ChipiApiError(\n \"payWithSession needs the SDK's session client\",\n \"X402_NOT_CONFIGURED\",\n 402\n );\n }\n let maxAmount: bigint;\n try {\n maxAmount = BigInt(pay.maxAmount);\n } catch {\n throw new ChipiApiError(\n `maxAmount must be an integer of USDC base units (6 decimals), got ${String(pay.maxAmount)}; nothing was paid`,\n \"X402_INVALID_MAX_AMOUNT\",\n 400\n );\n }\n const amount = BigInt(offer.maxAmountRequired);\n if (amount > maxAmount) {\n throw new ChipiApiError(\n `The x402 price (${amount} USDC base units) is above maxAmount (${pay.maxAmount}); nothing was paid`,\n \"X402_PRICE_ABOVE_MAX\",\n 402,\n { x402: { accepts: [offer] } }\n );\n }\n const payable = offer.extra?.payableModels;\n if (params.model && Array.isArray(payable) && !payable.includes(params.model)) {\n throw new ChipiApiError(\n `Model ${params.model} cannot be paid with x402 (payable: ${payable.join(\", \")}); nothing was paid`,\n \"X402_MODEL_NOT_PAYABLE\",\n 402,\n { x402: { accepts: [offer] } }\n );\n }\n const maxBytes = offer.extra?.maxPromptBytes;\n if (typeof maxBytes === \"number\" && thinkInputBytes(params) > maxBytes) {\n throw new ChipiApiError(\n `Paid calls accept at most ${maxBytes} bytes of portfolio, history and chain; nothing was paid`,\n \"X402_PAYLOAD_TOO_LARGE\",\n 402,\n { x402: { accepts: [offer] } }\n );\n }\n // The API refuses a payment from a wallet outside the sk_'s org\n // (PAYER_NOT_IN_ORG) after the USDC has moved. An API that knows this\n // answers X-PAYER in `extra.payer` (chipi-back always sets `address`);\n // one that does not leaves it unset. Only a refusal naming this wallet\n // stops the payment: anything else pays as 14.15.0 did.\n const payerCheck = offer.extra?.payer as { address?: unknown; accepted?: unknown } | undefined;\n if (\n payerCheck?.accepted === false &&\n typeof payerCheck.address === \"string\" &&\n sameFelt(payerCheck.address, pay.wallet.publicKey)\n ) {\n throw new ChipiApiError(\n `Wallet ${pay.wallet.publicKey} is not a wallet of the organization that owns this API key, so the API would refuse its payment; nothing was paid. Pay from a wallet of this organization.`,\n \"X402_PAYER_NOT_IN_ORG\",\n 402,\n { x402: { accepts: [offer] } }\n );\n }\n\n // Pay: a session-signed USDC transfer to payTo, then its receipt.\n const payer = pay.wallet.publicKey;\n const mask = (1n << 128n) - 1n;\n const transactionHash = await this.sessions.executeTransactionWithSession(\n {\n encryptKey: pay.encryptKey,\n wallet: pay.wallet,\n session: pay.session,\n calls: [\n {\n contractAddress: offer.asset,\n entrypoint: \"transfer\",\n calldata: [offer.payTo, (amount & mask).toString(), (amount >> 128n).toString()],\n },\n ],\n },\n this.secret()\n );\n const header: PaymentPayload = {\n x402Version: 1,\n scheme: \"exact\",\n network: \"starknet-mainnet\",\n payload: {\n signature: { r: padFelt(transactionHash), s: \"session\" },\n fromAddress: padFelt(payer),\n toAddress: padFelt(offer.payTo),\n amount: amount.toString(),\n asset: offer.asset,\n validUntil: Math.floor(Date.now() / 1000) + offer.maxTimeoutSeconds,\n nonce: padFelt(transactionHash),\n },\n };\n const xPayment = JSON.stringify(header);\n\n // Sent: from here on the hash is the payment, so every failure reports it.\n const paidError = (message: string, code: string, extra: Record<string, unknown> = {}) =>\n new ChipiApiError(message, code, 402, {\n x402: { accepts: [offer] },\n x402PaymentHash: transactionHash,\n ...extra,\n });\n let receipt: WaitForTransactionResult;\n try {\n receipt = await waitForTransaction(transactionHash, { timeoutMs: 120_000 });\n } catch (err) {\n // It may still land: retry later with `xPayment`, the hash pays once.\n throw paidError(\n `No receipt yet for the x402 payment ${transactionHash}: ${err instanceof Error ? err.message : String(err)}`,\n \"X402_PAYMENT_PENDING\",\n { xPayment }\n );\n }\n // On a session wallet a refused call (over a cap, not whitelisted) can\n // still come back SUCCEEDED: only a Transfer to payTo is a payment.\n const paid = await new SessionTxVerifier({\n txHashStore: { consume: () => true },\n getReceipt: async () => receipt,\n }).verifyTransfer({\n transactionHash,\n token: offer.asset,\n from: payer,\n to: offer.payTo,\n minAmount: amount,\n });\n if (!paid.valid) {\n throw paidError(\n `The x402 payment did not move ${amount} USDC base units to payTo (${paid.reason}). Check the session's whitelist (transfer) and its USDC cap.`,\n \"X402_PAYMENT_FAILED\",\n { reason: paid.reason }\n );\n }\n\n // The payment is spent only once a call is served, so retrying is safe.\n for (let attempt = 1; ; attempt++) {\n try {\n return await this.postThink(params, xPayment);\n } catch (err) {\n const retryable =\n err instanceof ChipiApiError &&\n (err.status === 409 ||\n (err.status === 503 && (err.details as { retryable?: boolean })?.retryable === true));\n if (retryable && attempt < PAID_MAX_ATTEMPTS) {\n await sleep(PAID_RETRY_DELAY_MS);\n continue;\n }\n if (err instanceof ChipiApiError) {\n // Paid but not served: hand back the hash so the caller can retry with `xPayment`.\n throw new ChipiApiError(err.message, err.code, err.status ?? 402, {\n ...(typeof err.details === \"object\" && err.details !== null ? err.details : {}),\n x402PaymentHash: transactionHash,\n xPayment,\n });\n }\n throw err;\n }\n }\n }\n\n /**\n * `POST /v1/ai/execute`: unsigned AVNU swap calls (approve + swap) for\n * `walletAddress`. Nothing is submitted; sign the calls with a session key\n * or the owner's key.\n */\n async execute(params: AiExecuteParams): Promise<AiExecuteResponse> {\n return this.client.post<AiExecuteResponse>({\n endpoint: `${AI_BASE}/execute`,\n bearerToken: this.secret(),\n body: params,\n });\n }\n\n /** `POST /v1/ai/chat`: general-purpose chat, billed per token. */\n async chat(params: AiChatParams): Promise<AiChatResponse> {\n return this.client.post<AiChatResponse>({\n endpoint: `${AI_BASE}/chat`,\n bearerToken: this.secret(),\n body: params,\n });\n }\n\n /**\n * `GET /v1/ai/prices`: USD prices and 1h / 24h / 7d changes, refreshed about\n * every 30 seconds. No credits are charged, but like every `sdk.ai` method it\n * needs the SDK's secret key (`sk_`).\n */\n async prices(params: AiPricesParams = {}): Promise<AiPrices> {\n const query: Record<string, string> = {};\n if (params.tokens?.length) query.tokens = params.tokens.join(\",\");\n if (params.chain) query.chain = params.chain;\n return this.client.get<AiPrices>({\n endpoint: `${AI_BASE}/prices`,\n params: query,\n bearerToken: this.secret(),\n });\n }\n\n /** `GET /v1/ai/models`: available models, prices and limits. */\n async models(): Promise<AiModelsResponse> {\n return this.client.get<AiModelsResponse>({\n endpoint: `${AI_BASE}/models`,\n bearerToken: this.secret(),\n });\n }\n}\n","import { ec, hash, num } from \"starknet\";\n\n/** SRC-6 `is_valid_signature` magic value: the short string 'VALID'. */\nexport const STARKNET_SIGNATURE_VALID = \"0x56414c4944\";\n\n/** Anything with a starknet.js-style `callContract` (e.g. `RpcProvider`). */\nexport interface StarknetCallProvider {\n callContract(call: {\n contractAddress: string;\n entrypoint: string;\n calldata?: string[];\n }): Promise<string[]>;\n}\n\nexport type StarknetSignatureCheck =\n | { valid: true }\n | { valid: false; reason: \"INVALID_SIGNATURE\" | \"ACCOUNT_NOT_DEPLOYED\"; detail?: string };\n\n/** Felts as `0x` hex, accepting decimal (\"1\") and hex (\"0x1\") inputs alike. */\nexport function toFeltHex(value: string | number | bigint): string {\n return num.toHex(BigInt(value));\n}\n\n/** `0x` + 64 hex, lowercase. Wallets differ on padding; compare on this. */\nexport function normalizeStarknetAddress(address: string): string {\n return `0x${BigInt(address).toString(16).padStart(64, \"0\")}`;\n}\n\nfunction isContractNotFound(err: unknown): boolean {\n const e = err as { baseError?: { code?: number }; code?: number; message?: string };\n if (e?.baseError?.code === 20 || e?.code === 20) return true;\n return /contract not found/i.test(e?.message ?? String(err));\n}\n\n/**\n * Asks the account itself (SRC-6 `is_valid_signature`) whether `signature`\n * signs `messageHash`. The full signature array is passed through, so\n * multi-felt signatures (Argent, Braavos, multisig) work.\n *\n * Only 'VALID' counts: accounts return 0 or panic on a bad signature, and a\n * lax \"anything non-zero\" check would accept garbage. An account that is not\n * deployed yet comes back as ACCOUNT_NOT_DEPLOYED so the caller can fall back\n * to `verifyUndeployedStarknetSignature`.\n */\nexport async function isValidStarknetSignature(\n provider: StarknetCallProvider,\n accountAddress: string,\n messageHash: string,\n signature: Array<string | number | bigint>\n): Promise<StarknetSignatureCheck> {\n try {\n const sig = signature.map(toFeltHex);\n const result = await provider.callContract({\n contractAddress: normalizeStarknetAddress(accountAddress),\n entrypoint: \"is_valid_signature\",\n calldata: [toFeltHex(messageHash), toFeltHex(sig.length), ...sig],\n });\n const first = result?.[0];\n if (first !== undefined && BigInt(first) === BigInt(STARKNET_SIGNATURE_VALID)) {\n return { valid: true };\n }\n return { valid: false, reason: \"INVALID_SIGNATURE\" };\n } catch (err) {\n if (isContractNotFound(err)) return { valid: false, reason: \"ACCOUNT_NOT_DEPLOYED\" };\n // Braavos and Argent 0.5 panic on a bad signature instead of returning 0.\n return {\n valid: false,\n reason: \"INVALID_SIGNATURE\",\n detail: err instanceof Error ? err.message : String(err),\n };\n }\n}\n\n/** Account classes whose undeployed signatures we can check off-chain. */\nexport const COUNTERFACTUAL_ACCOUNT_CLASSES = {\n /** OpenZeppelin AccountUpgradeable 3.0 (Bramble's default account). */\n OPENZEPPELIN_V3: \"0x01d1777db36cdd06dd62cfde77b1b6ae06412af95d57a13dc40ac77b8a702381\",\n /** Argent X / Ready 0.4 (`WALLET_CLASS_HASHES.READY`). */\n ARGENT_V0_4: \"0x036078334509b514626504edc9fb252328d1a240e4e948bef8d0c08dff45927f\",\n} as const;\n\n/** What a wallet returns from `wallet_deploymentData`. */\nexport interface StarknetDeploymentData {\n address: string;\n class_hash: string;\n salt: string;\n calldata: string[];\n}\n\nexport type UndeployedSignatureCheck =\n | { valid: true }\n | {\n valid: false;\n reason: \"UNSUPPORTED_ACCOUNT_CLASS\" | \"ADDRESS_MISMATCH\" | \"INVALID_SIGNATURE\";\n };\n\nfunction starkVerify(r: string, s: string, messageHash: string, publicKey: string): boolean {\n // Accounts store only the x coordinate; either y parity is the same key.\n const x = BigInt(publicKey).toString(16).padStart(64, \"0\");\n const sig = new ec.starkCurve.Signature(BigInt(r), BigInt(s));\n for (const prefix of [\"02\", \"03\"]) {\n try {\n if (ec.starkCurve.verify(sig, toFeltHex(messageHash), prefix + x)) return true;\n } catch {\n // not a point for this parity\n }\n }\n return false;\n}\n\n/**\n * Checks a signature from an account that is not deployed yet (new Bramble\n * and Ready accounts stay counterfactual until their first transaction), using\n * the wallet's `wallet_deploymentData`:\n *\n * 1. The class must be one we know how to read: OpenZeppelin 3.0 or Argent 0.4\n * without a guardian.\n * 2. The address must be the one those exact constructor arguments deploy to.\n * 3. The signature must be the owner key's ECDSA signature of the hash.\n */\nexport function verifyUndeployedStarknetSignature(\n deployment: StarknetDeploymentData,\n messageHash: string,\n signature: Array<string | number | bigint>\n): UndeployedSignatureCheck {\n const classHash = normalizeStarknetAddress(deployment.class_hash);\n const calldata = deployment.calldata.map(toFeltHex);\n const sig = signature.map(toFeltHex);\n\n let publicKey: string;\n let r: string;\n let s: string;\n if (classHash === COUNTERFACTUAL_ACCOUNT_CLASSES.OPENZEPPELIN_V3) {\n // constructor(public_key); signature [r, s]\n if (calldata.length !== 1 || sig.length !== 2) {\n return { valid: false, reason: \"INVALID_SIGNATURE\" };\n }\n [publicKey] = calldata;\n [r, s] = sig;\n } else if (classHash === COUNTERFACTUAL_ACCOUNT_CLASSES.ARGENT_V0_4) {\n // constructor(owner: Signer::Starknet(pub), guardian: Option::None) = [0, pub, 1];\n // signature: one Starknet signer = [1, 0, pub, r, s]. A guardian would\n // need a second signature we can't check here, so it is refused.\n if (calldata.length !== 3 || BigInt(calldata[0]) !== 0n || BigInt(calldata[2]) !== 1n) {\n return { valid: false, reason: \"UNSUPPORTED_ACCOUNT_CLASS\" };\n }\n if (sig.length !== 5 || BigInt(sig[0]) !== 1n || BigInt(sig[1]) !== 0n) {\n return { valid: false, reason: \"INVALID_SIGNATURE\" };\n }\n if (BigInt(sig[2]) !== BigInt(calldata[1])) {\n return { valid: false, reason: \"INVALID_SIGNATURE\" };\n }\n publicKey = calldata[1];\n [, , , r, s] = sig;\n } else {\n return { valid: false, reason: \"UNSUPPORTED_ACCOUNT_CLASS\" };\n }\n\n const expected = hash.calculateContractAddressFromHash(\n toFeltHex(deployment.salt),\n classHash,\n calldata,\n 0\n );\n if (normalizeStarknetAddress(expected) !== normalizeStarknetAddress(deployment.address)) {\n return { valid: false, reason: \"ADDRESS_MISMATCH\" };\n }\n\n return starkVerify(r, s, messageHash, publicKey)\n ? { valid: true }\n : { valid: false, reason: \"INVALID_SIGNATURE\" };\n}\n","import type {\n PaymentPayload,\n VerifyResponse,\n SettleResponse,\n NonceStore,\n X402FacilitatorConfig,\n} from \"@chipi-stack/types\";\nimport { CONTRACT_ADDRESSES } from \"@chipi-stack/shared\";\nimport { buildX402TypedData } from \"@chipi-stack/core\";\nimport { hash, uint256, typedData as starknetTypedData } from \"starknet\";\nimport { ChipiClient } from \"../client\";\nimport { isValidStarknetSignature } from \"../starknet-signature\";\nimport type {\n ExecuteSponsoredTransactionResponse,\n PrepareTypedDataResponse,\n} from \"@chipi-stack/types\";\n\nconst TRANSFER_SELECTOR = BigInt(hash.getSelectorFromName(\"transfer\"));\n\n/**\n * Checks that a SHHH `execute_from_outside_v2` calldata span is exactly one\n * `transfer(toAddress, amount)` on the payment's asset, and still valid. Span\n * layout (serializeExecuteFromOutsideV2Calldata): caller, nonce,\n * execute_after, execute_before, calls_len, then per call\n * (to, selector, calldata_len, ...calldata), then the signature.\n */\nfunction shhhTransferMatches(\n oeCalldata: string[],\n payload: PaymentPayload[\"payload\"]\n): { ok: true } | { ok: false; reason: string } {\n try {\n const felts = oeCalldata.map((v) => BigInt(v));\n const [, , , executeBefore, callsLen] = felts;\n if (callsLen !== 1n) return { ok: false, reason: \"SHHH payment must be exactly one transfer\" };\n const [to, selector, len, recipient, low, high] = felts.slice(5, 11);\n if (to !== BigInt(payload.asset) || selector !== TRANSFER_SELECTOR || len !== 3n) {\n return { ok: false, reason: \"SHHH payment call is not a transfer of the payment asset\" };\n }\n if (recipient !== BigInt(payload.toAddress)) {\n return { ok: false, reason: \"SHHH payment pays a different recipient\" };\n }\n if (low + (high << 128n) !== BigInt(payload.amount)) {\n return { ok: false, reason: \"SHHH payment amount differs from the declared amount\" };\n }\n if (executeBefore <= BigInt(Math.floor(Date.now() / 1000))) {\n return { ok: false, reason: \"SHHH payment has expired (execute_before in the past)\" };\n }\n return { ok: true };\n } catch {\n return { ok: false, reason: \"Malformed SHHH oeCalldata\" };\n }\n}\n\n/** Default in-memory nonce store. Resets on server restart. */\nclass InMemoryNonceStore implements NonceStore {\n private readonly used = new Set<string>();\n\n has(nonce: string): boolean {\n return this.used.has(nonce);\n }\n\n consume(nonce: string): boolean {\n if (this.used.has(nonce)) return false;\n this.used.add(nonce);\n return true;\n }\n}\n\n/** Options for the static X402Facilitator.create() factory */\nexport interface X402FacilitatorCreateOptions {\n /** API public key for ChipiClient */\n apiKey: string;\n /** Bearer token for paymaster API calls */\n bearerToken: string;\n /** Custom nonce store (default: in-memory) */\n nonceStore?: NonceStore;\n /** RPC provider for on-chain signature verification */\n provider?: X402FacilitatorConfig[\"provider\"];\n}\n\n/**\n * x402 Payment Facilitator for Starknet.\n *\n * Implements the \"facilitator\" role in the x402 protocol:\n * - verify(): Validate payment signature, amount, asset, nonce replay\n * - settle(): Execute the USDC transfer via Chipi's paymaster\n *\n * Settlement reuses Chipi's existing gasless infrastructure\n * (prepare-typed-data → sign → execute-sponsored-transaction).\n */\nexport class X402Facilitator {\n private readonly client: ChipiClient;\n private readonly bearerToken: string;\n private readonly nonceStore: NonceStore;\n private readonly provider: X402FacilitatorConfig[\"provider\"];\n\n constructor(client: ChipiClient, bearerToken: string, config?: X402FacilitatorConfig) {\n this.client = client;\n this.bearerToken = bearerToken;\n this.nonceStore = config?.nonceStore ?? new InMemoryNonceStore();\n this.provider = config?.provider;\n }\n\n /**\n * Factory method for simpler instantiation.\n *\n * @example\n * ```typescript\n * const facilitator = X402Facilitator.create({\n * apiKey: process.env.CHIPI_API_KEY!,\n * bearerToken: process.env.CHIPI_BEARER_TOKEN!,\n * });\n * ```\n */\n static create(options: X402FacilitatorCreateOptions): X402Facilitator {\n const client = new ChipiClient({ apiPublicKey: options.apiKey });\n return new X402Facilitator(client, options.bearerToken, {\n nonceStore: options.nonceStore,\n provider: options.provider,\n });\n }\n\n /**\n * Verify a payment signature is valid (doesn't execute the transfer).\n *\n * Checks:\n * 1. x402 version is 1\n * 2. Network is starknet-mainnet\n * 3. Nonce has not been used (replay protection)\n * 4. Payment has not expired (validUntil > now)\n * 5. Asset is USDC mainnet\n * 6. Amount is positive\n * 7. Addresses are non-empty\n * 8. Signature: with a `provider`, the payer account's `is_valid_signature`\n * must return 'VALID'. Without one, only its presence is checked (not a\n * cryptographic check). SHHH payloads must sign exactly one transfer\n * of `amount` of `asset` to `toAddress`; their signature is checked\n * on-chain at settle.\n */\n async verify(payment: PaymentPayload): Promise<VerifyResponse> {\n const { payload } = payment;\n\n // 1. Check x402 version\n if (payment.x402Version !== 1) {\n return { isValid: false, invalidReason: `Unsupported x402 version: ${payment.x402Version}` };\n }\n\n // 2. Check network\n if (payment.network !== \"starknet-mainnet\") {\n return { isValid: false, invalidReason: `Unsupported network: ${payment.network}` };\n }\n\n // 3. Check nonce replay\n if (await this.nonceStore.has(payload.nonce)) {\n return { isValid: false, invalidReason: \"Nonce already used (replay)\" };\n }\n\n // 4. Check expiry\n const now = Math.floor(Date.now() / 1000);\n if (payload.validUntil <= now) {\n return { isValid: false, invalidReason: \"Payment has expired (validUntil in the past)\" };\n }\n\n // 5. Validate asset is USDC\n const normalizedAsset = payload.asset.toLowerCase().replace(/^0x0+/, \"0x\");\n const normalizedUsdc = CONTRACT_ADDRESSES.USDC_MAINNET.toLowerCase().replace(/^0x0+/, \"0x\");\n if (normalizedAsset !== normalizedUsdc) {\n return {\n isValid: false,\n invalidReason: `Unsupported asset: ${payload.asset}. Only USDC is accepted.`,\n };\n }\n\n // 6. Validate amount is positive\n let amount: bigint;\n try {\n amount = BigInt(payload.amount);\n } catch {\n return { isValid: false, invalidReason: \"Invalid payment amount format\" };\n }\n if (amount <= 0n) {\n return { isValid: false, invalidReason: \"Payment amount must be positive\" };\n }\n\n // 7. Validate addresses are non-empty\n if (!payload.fromAddress || !payload.toAddress) {\n return { isValid: false, invalidReason: \"Missing fromAddress or toAddress\" };\n }\n\n // 8. Verify SNIP-12 signature (cryptographic if provider available, presence-only otherwise)\n const sigResult = await this.verifySignature(payment);\n if (!sigResult.valid) {\n return { isValid: false, invalidReason: sigResult.reason };\n }\n\n return { isValid: true };\n }\n\n /**\n * Verify the SNIP-12 signature on a payment payload.\n *\n * If an RPC provider is configured, reconstructs the typed data, computes the\n * message hash, and calls `is_valid_signature()` on the sender's account contract.\n * Otherwise falls back to a presence-only check (backwards compatible).\n */\n private async verifySignature(\n payment: PaymentPayload\n ): Promise<{ valid: boolean; reason?: string }> {\n // SHHH V8.4 buyers ship a pre-signed execute_from_outside_v2\n // span; the wallet's on-chain dispatch at account.cairo:389\n // validates the V2_SNIP12 envelope (or 4-felt session sig)\n // itself when the paymaster calls execute_from_outside_v2.\n // `is_valid_signature(hash, [r, s])` is NOT how V8.4 validates —\n // calling it with the legacy (r, s) compatibility surface would\n // return invalid for any well-formed SHHH payment and block\n // settlement. Defer to on-chain validation; we still require\n // the oeCalldata span to be present and non-empty so a totally\n // empty payload can't bypass the check.\n if (payment.payload?.shhh) {\n const oeCalldata = payment.payload.shhh.oeCalldata;\n if (!Array.isArray(oeCalldata) || oeCalldata.length === 0) {\n return { valid: false, reason: \"Missing SHHH oeCalldata\" };\n }\n // The contract checks the signature at settle, but not that the signed\n // calls are the payment declared in the payload: bind them here, or a\n // payer could declare 1 USDC and sign a transfer of 1 base unit.\n const bound = shhhTransferMatches(oeCalldata, payment.payload);\n if (!bound.ok) return { valid: false, reason: bound.reason };\n return { valid: true };\n }\n\n if (!this.provider) {\n // No provider configured — fall back to presence-only check\n if (!payment.payload?.signature?.r || !payment.payload?.signature?.s) {\n return { valid: false, reason: \"Missing signature\" };\n }\n return { valid: true };\n }\n\n const payload = payment.payload;\n\n if (!payload?.signature?.r || !payload?.signature?.s) {\n return { valid: false, reason: \"Missing signature\" };\n }\n\n // Reconstruct the SNIP-12 typed data (must match client's signPayment())\n const paymentTypedData = buildX402TypedData({\n from_address: payload.fromAddress,\n to_address: payload.toAddress,\n amount: payload.amount,\n asset: payload.asset,\n valid_until: String(payload.validUntil),\n nonce: payload.nonce,\n });\n\n // Compute the message hash\n let msgHash: string;\n try {\n msgHash = starknetTypedData.getMessageHash(paymentTypedData, payload.fromAddress);\n } catch (err) {\n const message = err instanceof Error ? err.message : String(err);\n return { valid: false, reason: `Malformed payment: ${message}` };\n }\n\n // Ask the account (SRC-6 is_valid_signature); only 'VALID' counts.\n const check = await isValidStarknetSignature(this.provider, payload.fromAddress, msgHash, [\n payload.signature.r,\n payload.signature.s,\n ]);\n if (check.valid) return { valid: true };\n if (check.reason === \"ACCOUNT_NOT_DEPLOYED\") {\n return { valid: false, reason: \"Payer account is not deployed\" };\n }\n return {\n valid: false,\n reason: check.detail\n ? `Signature verification failed: ${check.detail}`\n : \"Invalid SNIP-12 signature\",\n };\n }\n\n /**\n * Settle a verified payment by executing the USDC transfer via paymaster.\n *\n * IMPORTANT: Mark nonce as consumed BEFORE executing to prevent concurrent replays.\n * If the transfer fails after nonce consumption, the nonce is still burned\n * (caller should implement idempotency at a higher level if needed).\n */\n async settle(payment: PaymentPayload): Promise<SettleResponse> {\n const { payload } = payment;\n\n // 1. Verify before settling\n const verification = await this.verify(payment);\n if (!verification.isValid) {\n return { success: false, errorReason: verification.invalidReason };\n }\n\n // 2. Atomically consume nonce (prevents concurrent replays)\n const consumed = await this.nonceStore.consume(payload.nonce);\n if (!consumed) {\n return { success: false, errorReason: \"Nonce already consumed (concurrent replay)\" };\n }\n\n try {\n // SHHH V8.4 buyers ship a pre-built execute_from_outside_v2\n // calldata span. The V8.4 wallet cannot validate a raw `{r, s}`\n // signature — `execute_from_outside_v2` at `account.cairo:389`\n // expects either a 5-felt V2_SNIP12 envelope or a 4-felt\n // session sig, never a bare 2-felt span. The CHIPI v29\n // prepare-typed-data + execute-sponsored-transaction round-trip\n // simply does not apply. Forward the buyer's pre-signed\n // calldata verbatim through the execute-sponsored-raw endpoint\n // (same path SHHH primary STARK + ED25519 OEs take in\n // sdks#268). chipi-back routes it to the paymaster which calls\n // the wallet's execute_from_outside_v2; the envelope validates\n // on chain via the buyer's primary verifier class.\n if (payload.shhh) {\n const shhhResult = await this.client.post<{ transactionHash?: string }>({\n endpoint: \"/transactions/execute-sponsored-raw\",\n bearerToken: this.bearerToken,\n body: {\n accountAddress: payload.fromAddress,\n calldata: payload.shhh.oeCalldata,\n signerKind: payload.shhh.signerKind,\n },\n });\n\n if (typeof shhhResult?.transactionHash !== \"string\" || !shhhResult.transactionHash.trim()) {\n return {\n success: false,\n errorReason:\n (shhhResult as any)?.message ?? \"execute-sponsored-raw returned no transactionHash\",\n };\n }\n\n return {\n success: true,\n transactionHash: shhhResult.transactionHash,\n networkId: \"starknet-mainnet\",\n };\n }\n\n // 3. Build ERC20 transfer call: fromAddress → toAddress\n // ERC20 transfer expects u256 (low, high) for the amount\n const amountU256 = uint256.bnToUint256(BigInt(payload.amount));\n const transferCall = {\n contractAddress: payload.asset,\n entrypoint: \"transfer\",\n calldata: [payload.toAddress, amountU256.low.toString(), amountU256.high.toString()],\n };\n\n // 4. Prepare typed data for sponsored execution\n const prepareResponse = await this.client.post<PrepareTypedDataResponse>({\n endpoint: \"/transactions/prepare-typed-data\",\n bearerToken: this.bearerToken,\n body: {\n publicKey: payload.fromAddress,\n calls: [transferCall],\n },\n });\n\n // 5. Execute sponsored transaction using the payment signature\n const result = await this.client.post<ExecuteSponsoredTransactionResponse>({\n endpoint: \"/transactions/execute-sponsored-transaction\",\n bearerToken: this.bearerToken,\n body: {\n publicKey: payload.fromAddress,\n typedData: prepareResponse.typedData,\n userSignature: payload.signature,\n walletType: prepareResponse.walletType,\n saveToDatabase: true,\n },\n });\n\n if (typeof result?.transactionHash !== \"string\" || !result.transactionHash.trim()) {\n return {\n success: false,\n errorReason: (result as any)?.message ?? \"No transaction hash returned from paymaster\",\n };\n }\n\n return {\n success: true,\n transactionHash: result.transactionHash,\n networkId: \"starknet-mainnet\",\n };\n } catch (error) {\n const message = error instanceof Error ? error.message : String(error);\n return {\n success: false,\n errorReason: `Settlement failed: ${message}`,\n };\n }\n }\n}\n","import type { SignTypedDataParams, SignTypedDataResult } from \"@chipi-stack/types\";\nimport { Account, RpcProvider, typedData as typedDataUtil } from \"starknet\";\nimport { decryptPrivateKey } from \"./encryption\";\nimport { WALLET_CLASS_HASHES, WALLET_RPC_ENDPOINTS } from \"@chipi-stack/shared\";\nimport { normalizeSignature } from \"./paymaster-adapter\";\n\n/**\n * Sign SNIP-12 typed data without executing a transaction.\n *\n * This is a purely local operation:\n * 1. Decrypt the private key using the encryption key (PIN)\n * 2. Create a starknet Account\n * 3. Sign the typed data with account.signMessage()\n * 4. Normalize and return { r, s }\n *\n * No API calls are made. Useful for x402 payment signatures and other\n * off-chain signing flows where you need a SNIP-12 signature but don't\n * want to execute a transaction.\n */\nexport const signTypedData = async ({\n params,\n}: {\n params: SignTypedDataParams;\n}): Promise<SignTypedDataResult> => {\n try {\n const { encryptKey, wallet, typedData } = params;\n\n if (!encryptKey) {\n throw new Error(\"encryptKey is required for signing typed data\");\n }\n\n if (!wallet || !wallet.encryptedPrivateKey || !wallet.publicKey) {\n throw new Error(\"wallet with publicKey and encryptedPrivateKey is required\");\n }\n\n if (!typedData) {\n throw new Error(\"typedData is required for signing\");\n }\n\n const walletType = wallet.walletType ?? \"READY\";\n\n if (\n !Object.prototype.hasOwnProperty.call(WALLET_RPC_ENDPOINTS, walletType) ||\n !Object.prototype.hasOwnProperty.call(WALLET_CLASS_HASHES, walletType)\n ) {\n throw new Error(`Unsupported wallet type: \"${String(walletType)}\"`);\n }\n\n const rpcUrl = WALLET_RPC_ENDPOINTS[walletType];\n\n // Decrypt the private key\n let privateKeyDecrypted: string;\n try {\n privateKeyDecrypted = decryptPrivateKey(wallet.encryptedPrivateKey, encryptKey);\n } catch {\n throw new Error(\"Failed to decrypt private key. Verify the encryptKey is correct.\");\n }\n\n const provider = new RpcProvider({ nodeUrl: rpcUrl });\n\n const account = new Account({\n provider,\n address: wallet.publicKey,\n signer: privateKeyDecrypted,\n });\n\n // Sign the typed data\n const signature = await account.signMessage(typedData);\n\n // Normalize signature format (handles both Weierstrass and Array types)\n const normalizedSig = normalizeSignature(signature);\n\n return normalizedSig;\n } catch (error) {\n console.error(\"Error signing typed data\", error);\n throw error;\n }\n};\n\n// Canonical felt form: 0x + 64 hex chars (leading zeros preserved) — matches\n// the repo's felt-formatting rule so signature spans are consistent.\nfunction toFeltHex(x: bigint): string {\n return \"0x\" + x.toString(16).padStart(64, \"0\");\n}\n\n/**\n * Sign SNIP-12 typed data and return the full signature SPAN as felt strings —\n * the shape a dApp's `wallet_signTypedData` expects (wallet-api `Signature`).\n *\n * Wallet-type aware (this is the part the plain `signTypedData` {r,s} can't do):\n * - **SHHH V8.4**: `__validate__` is disabled and the account verifies a\n * V2_SNIP12 envelope `[V2_SNIP12, owner_id, 'STARK', r, s]`. We hash the\n * typed data per SNIP-12, sign with the STARK owner key, and wrap it so the\n * account's `is_valid_signature` accepts it. Purely local (no API call).\n * - **READY / standard**: a bare `[r, s]` from `account.signMessage`.\n *\n * Phase 0 covers the primary STARK owner (ownerIndex 0). WebAuthn-rooted\n * owners (interactive passkey assertion) are a follow-up.\n */\nexport const signTypedDataArray = async ({\n params,\n}: {\n params: SignTypedDataParams;\n}): Promise<string[]> => {\n const { encryptKey, wallet, typedData } = params;\n\n if (!encryptKey) throw new Error(\"encryptKey is required for signing typed data\");\n if (!wallet || !wallet.encryptedPrivateKey || !wallet.publicKey) {\n throw new Error(\"wallet with publicKey and encryptedPrivateKey is required\");\n }\n if (!typedData) throw new Error(\"typedData is required for signing\");\n\n const walletType = wallet.walletType ?? \"READY\";\n if (!Object.prototype.hasOwnProperty.call(WALLET_RPC_ENDPOINTS, walletType)) {\n throw new Error(`Unsupported wallet type: \"${String(walletType)}\"`);\n }\n\n let privateKeyDecrypted: string;\n try {\n privateKeyDecrypted = decryptPrivateKey(wallet.encryptedPrivateKey, encryptKey);\n } catch {\n throw new Error(\"Failed to decrypt private key. Verify the encryptKey is correct.\");\n }\n\n // SNIP-12 message hash of the dApp's typed data against this account — the\n // same hash the account's verifier checks the signature against.\n const messageHash = BigInt(typedDataUtil.getMessageHash(typedData, wallet.publicKey));\n\n if (walletType === \"SHHH\") {\n // Dynamic import: keep the shhh signer modules (which run module-level\n // starknet crypto) out of the static load graph, so partially-mocked\n // starknet in other tests doesn't break at import — same pattern as\n // execute-paymaster-transaction.ts.\n const { buildStarkEnvelope } = await import(\"./shhh/signers/stark\");\n const envelope = buildStarkEnvelope({\n privateKey: privateKeyDecrypted,\n messageHash,\n ownerIndex: 0n,\n });\n return envelope.map(toFeltHex);\n }\n\n // Standard accounts: bare [r, s].\n const provider = new RpcProvider({ nodeUrl: WALLET_RPC_ENDPOINTS[walletType] });\n const account = new Account({ provider, address: wallet.publicKey, signer: privateKeyDecrypted });\n const { r, s } = normalizeSignature(await account.signMessage(typedData));\n return [r, s];\n};\n","/**\n * Run calls on a SHHH wallet signed by an EXTERNAL Starknet wallet that is\n * one of its owners or guardians: Bramble, Braavos, Ready/Argent, an\n * OpenZeppelin account or another Chipi wallet, registered with the\n * `STARK_SNIP12` kind.\n *\n * The external wallet signs an `Approval { Wallet, Hash }` typed data with\n * `wallet_signTypedData` (see `signers/stark-snip12.ts`). Nothing is\n * decrypted: the key stays in the external wallet. Chipi's paymaster\n * relays the outside execution gaslessly, like any other SHHH OE.\n *\n * Two steps so the signing can happen wherever the wallet lives:\n * 1. `prepareExternalOwnerExecution` → `{ outsideExecution, typedData }`\n * 2. `submitExternalOwnerExecution` with the wallet's signature\n * `executeShhhWithExternalSigner` does both with a `signTypedData` callback.\n */\n\nimport type { Call, TypedData } from \"starknet\";\nimport type { ChipiClient } from \"../client\";\nimport { normalizeStarknetAddress } from \"../starknet-signature\";\nimport { ANY_CALLER_FELT, buildOutsideExecution, computeOeHash } from \"./oe\";\nimport type { OutsideExecution } from \"./snip12-hash\";\nimport {\n newOeNonce,\n resolveShhhChainId,\n serializeExecuteFromOutsideV2Calldata,\n} from \"./execute-paymaster-raw\";\nimport { buildStarkEnvelope } from \"./signers/stark\";\nimport {\n buildStarkSnip12Envelope,\n starkSnip12ApprovalTypedData,\n verifyStarkSnip12Approval,\n} from \"./signers/stark-snip12\";\n\nexport interface PreparedExternalOwnerExecution {\n walletAddress: string;\n outsideExecution: OutsideExecution;\n /** SNIP-12 hash of the OE (what the Approval carries as `Hash`). */\n messageHash: bigint;\n /** What the external wallet signs with `wallet_signTypedData`. */\n typedData: TypedData;\n chainId: string;\n}\n\n/** Step 1: build the OE (max 2h window) and the typed data to sign. */\nexport function prepareExternalOwnerExecution(params: {\n /** The SHHH wallet's address. */\n walletAddress: string;\n calls: Call[];\n nonce?: bigint;\n /** Defaults to mainnet. */\n chainId?: bigint | string;\n}): PreparedExternalOwnerExecution {\n const walletAddress = normalizeStarknetAddress(params.walletAddress);\n const outsideExecution = buildOutsideExecution({\n nonce: params.nonce ?? newOeNonce(),\n calls: params.calls,\n caller: ANY_CALLER_FELT,\n });\n const chainId = resolveShhhChainId({ override: params.chainId });\n const messageHash = computeOeHash(outsideExecution, walletAddress, chainId);\n const typedData = starkSnip12ApprovalTypedData({ walletAddress, messageHash, chainId });\n return { walletAddress, outsideExecution, messageHash, typedData, chainId };\n}\n\n/**\n * Step 2: wrap the wallet's signature and relay the OE through Chipi's\n * paymaster (`/transactions/execute-sponsored-raw`). Returns the tx hash;\n * wait for it before treating the call as done.\n */\nexport async function submitExternalOwnerExecution(params: {\n client: ChipiClient;\n bearerToken: string;\n prepared: PreparedExternalOwnerExecution;\n /** The external wallet's `wallet_signTypedData` result, as returned. */\n signature: Array<string | number | bigint>;\n /** u32 index of the external wallet in the SHHH wallet's owner_set. */\n ownerIndex: number | bigint;\n /**\n * The external wallet's address and STARK key (from `resolveStarkSnip12Signer`).\n * When given, the signature is checked off-chain first, so a wrong wallet or\n * key fails here. Without it nothing is checked before relaying, and a wrong\n * signature only shows up as a reverted transaction. Pass it whenever you can.\n */\n signer?: { address: string; starkPubkey: bigint | string };\n externalUserId?: string;\n}): Promise<string> {\n const { prepared } = params;\n if (\n params.signer &&\n !verifyStarkSnip12Approval({\n walletAddress: prepared.walletAddress,\n messageHash: prepared.messageHash,\n signerAddress: params.signer.address,\n starkPubkey: params.signer.starkPubkey,\n signature: params.signature,\n chainId: prepared.chainId,\n })\n ) {\n throw new Error(\n \"The signature doesn't match this wallet's registered key. Sign with the same wallet and account you added.\"\n );\n }\n\n const envelope = buildStarkSnip12Envelope({\n signature: params.signature,\n ownerIndex: BigInt(params.ownerIndex),\n });\n const calldata = serializeExecuteFromOutsideV2Calldata({\n outsideExecution: prepared.outsideExecution,\n signature: envelope,\n });\n\n const response = await params.client.post<{ transactionHash?: string }>({\n endpoint: \"/transactions/execute-sponsored-raw\",\n bearerToken: params.bearerToken,\n body: {\n accountAddress: prepared.walletAddress,\n calldata,\n ...(params.externalUserId ? { externalUserId: params.externalUserId } : {}),\n },\n });\n if (!response?.transactionHash) {\n throw new Error(\n \"execute-sponsored-raw response missing transactionHash. Check the chipi-back logs for upstream paymaster errors.\"\n );\n }\n return response.transactionHash;\n}\n\n/** Both steps, with the external wallet's `signTypedData` as a callback. */\nexport async function executeShhhWithExternalSigner(params: {\n client: ChipiClient;\n bearerToken: string;\n walletAddress: string;\n calls: Call[];\n ownerIndex: number | bigint;\n signTypedData: (typedData: TypedData) => Promise<Array<string | number | bigint>>;\n signer?: { address: string; starkPubkey: bigint | string };\n nonce?: bigint;\n chainId?: bigint | string;\n externalUserId?: string;\n}): Promise<string> {\n const prepared = prepareExternalOwnerExecution(params);\n const signature = await params.signTypedData(prepared.typedData);\n return submitExternalOwnerExecution({ ...params, prepared, signature });\n}\n\n/**\n * Run calls signed by a raw STARK key that is owner `ownerIndex` of the\n * wallet, relayed gaslessly. For the step right after a guardian recovery:\n * the recovered key is a new owner (recovery adds, it never replaces), and\n * it signs `propose_rotate_owner` to move owner 0 onto a fresh key, which is\n * the key every other SDK call signs with. Keep `privateKey` in memory only.\n */\nexport async function executeShhhWithStarkKey(params: {\n client: ChipiClient;\n bearerToken: string;\n walletAddress: string;\n calls: Call[];\n privateKey: string | bigint;\n ownerIndex: number | bigint;\n nonce?: bigint;\n chainId?: bigint | string;\n externalUserId?: string;\n}): Promise<string> {\n const walletAddress = normalizeStarknetAddress(params.walletAddress);\n const outsideExecution = buildOutsideExecution({\n nonce: params.nonce ?? newOeNonce(),\n calls: params.calls,\n caller: ANY_CALLER_FELT,\n });\n const chainId = resolveShhhChainId({ override: params.chainId });\n const messageHash = computeOeHash(outsideExecution, walletAddress, chainId);\n const signature = buildStarkEnvelope({\n privateKey: params.privateKey,\n messageHash,\n ownerIndex: BigInt(params.ownerIndex),\n });\n const calldata = serializeExecuteFromOutsideV2Calldata({ outsideExecution, signature });\n const response = await params.client.post<{ transactionHash?: string }>({\n endpoint: \"/transactions/execute-sponsored-raw\",\n bearerToken: params.bearerToken,\n body: {\n accountAddress: walletAddress,\n calldata,\n signerKind: \"STARK\",\n ...(params.externalUserId ? { externalUserId: params.externalUserId } : {}),\n },\n });\n if (!response?.transactionHash) {\n throw new Error(\n \"execute-sponsored-raw response missing transactionHash. Check the chipi-back logs for upstream paymaster errors.\"\n );\n }\n return response.transactionHash;\n}\n","/**\n * STARK_SNIP12 signer for SHHH V8.4 ShhhAccount: Starknet browser wallets\n * (Bramble, Braavos, Ready/Argent, OpenZeppelin accounts) and Chipi wallets\n * as co-owners or guardians of a SHHH wallet.\n *\n * Why not the `STARK` kind: these wallets never sign a raw hash. Their only\n * signing method, `wallet_signTypedData`, signs the SNIP-12 message hash,\n * which always folds in the signing wallet's own address. So the OE hash is\n * wrapped in an `Approval { Wallet, Hash }` typed data that the wallet signs\n * as-is, and `StarkSnip12Verifier` rebuilds it on-chain (the Starknet twin of\n * the EIP-712 verifier MetaMask uses).\n *\n * Reference: shhh-wallet-cairo `src/signer/stark_snip12/verifier.cairo` and\n * `scripts/ts/gen-stark-snip12-fixture.mjs` (same typed data, same hash).\n *\n * Pubkey layout: `[stark_pubkey, signer_account_address]`. Payload: `[r, s]`.\n */\n\nimport { ec, shortString, typedData as typedDataUtil, type TypedData } from \"starknet\";\nimport { ownerCommitment } from \"../compute-wallet-address\";\nimport { wrapV2Snip12Envelope } from \"../oe\";\nimport { decodeShhhOwnerRecord } from \"../recovery\";\nimport {\n COUNTERFACTUAL_ACCOUNT_CLASSES,\n normalizeStarknetAddress,\n toFeltHex,\n type StarknetCallProvider,\n type StarknetDeploymentData,\n} from \"../../starknet-signature\";\n\nexport const STARK_SNIP12_KIND_TAG = \"STARK_SNIP12\";\n\nconst STARK_KIND_TAG_FELT = BigInt(shortString.encodeShortString(\"STARK\"));\nconst V2_SNIP12_FELT = BigInt(shortString.encodeShortString(\"V2_SNIP12\"));\n\n/** A chain id as the SNIP-12 domain carries it: the short string (\"SN_MAIN\"). */\nfunction domainChainId(chainId: bigint | string): string {\n if (typeof chainId === \"string\" && !chainId.startsWith(\"0x\")) return chainId;\n return shortString.decodeShortString(toFeltHex(chainId));\n}\n\nfunction felt(value: bigint | string | number): bigint {\n return BigInt(value);\n}\n\n/**\n * The typed data the external wallet signs (`wallet_signTypedData`) to\n * approve the OE whose SNIP-12 hash is `messageHash` on `walletAddress`.\n * Plain ASCII, revision 1, `chainId` in the domain: Bramble's strict rules.\n */\nexport function starkSnip12ApprovalTypedData(params: {\n /** The SHHH wallet being approved (the account address). */\n walletAddress: string;\n /** SNIP-12 hash of the OutsideExecution (`computeOeHash`). */\n messageHash: bigint | string;\n /** Defaults to \"SN_MAIN\". Hex chain ids are converted. */\n chainId?: bigint | string;\n}): TypedData {\n return {\n types: {\n StarknetDomain: [\n { name: \"name\", type: \"shortstring\" },\n { name: \"version\", type: \"shortstring\" },\n { name: \"chainId\", type: \"shortstring\" },\n { name: \"revision\", type: \"shortstring\" },\n ],\n Approval: [\n { name: \"Wallet\", type: \"ContractAddress\" },\n { name: \"Hash\", type: \"felt\" },\n ],\n },\n primaryType: \"Approval\",\n domain: {\n name: \"Shhh\",\n version: \"1\",\n chainId: domainChainId(params.chainId ?? \"SN_MAIN\"),\n revision: \"1\",\n },\n message: {\n Wallet: normalizeStarknetAddress(params.walletAddress),\n Hash: toFeltHex(params.messageHash),\n },\n };\n}\n\n/** The hash the external wallet's key signs (what the verifier checks). */\nexport function starkSnip12ApprovalHash(params: {\n walletAddress: string;\n messageHash: bigint | string;\n /** The external wallet's account address. */\n signerAddress: string;\n chainId?: bigint | string;\n}): bigint {\n const td = starkSnip12ApprovalTypedData(params);\n return BigInt(typedDataUtil.getMessageHash(td, normalizeStarknetAddress(params.signerAddress)));\n}\n\n/** Pubkey felts for `propose_add_owner` / `initiate_recovery`. */\nexport function starkSnip12PubkeyFelts(\n starkPubkey: bigint | string,\n signerAddress: string\n): bigint[] {\n const pub = felt(starkPubkey);\n const account = BigInt(normalizeStarknetAddress(signerAddress));\n if (pub === 0n || account === 0n) {\n throw new Error(\"starkSnip12PubkeyFelts: the key and the account address must be non-zero.\");\n }\n return [pub, account];\n}\n\n/** On-chain owner id commitment for a STARK_SNIP12 owner (dedupe key). */\nexport function starkSnip12OwnerCommitment(\n starkPubkey: bigint | string,\n signerAddress: string\n): bigint {\n return ownerCommitment(\n BigInt(shortString.encodeShortString(STARK_SNIP12_KIND_TAG)),\n starkSnip12PubkeyFelts(starkPubkey, signerAddress)\n );\n}\n\n/** What a wallet returned from `wallet_signTypedData`, split into its parts. */\nexport interface ParsedStarknetWalletSignature {\n r: bigint;\n s: bigint;\n /** Argent / Ready include the signer's public key. */\n pubkey?: bigint;\n /** A Chipi (SHHH) wallet returns its own V2_SNIP12 envelope: the owner index. */\n shhhOwnerId?: bigint;\n}\n\n/**\n * Reads the signature shapes Starknet wallets return:\n * - `[r, s]`: OpenZeppelin (Bramble), Braavos with a STARK signer;\n * - `[1, 0, pubkey, r, s]`: Argent / Ready (one Starknet signer);\n * - `[V2_SNIP12, owner_id, 'STARK', r, s]`: a Chipi (SHHH) wallet.\n * Anything else (multisig, hardware or webauthn signers) is refused.\n */\nexport function parseStarknetWalletSignature(\n signature: Array<string | number | bigint>\n): ParsedStarknetWalletSignature {\n const sig = signature.map((v) => felt(v));\n if (sig.length === 2) return { r: sig[0], s: sig[1] };\n if (sig.length === 5 && sig[0] === 1n && sig[1] === 0n) {\n return { pubkey: sig[2], r: sig[3], s: sig[4] };\n }\n if (sig.length === 5 && sig[0] === V2_SNIP12_FELT && sig[2] === STARK_KIND_TAG_FELT) {\n return { shhhOwnerId: sig[1], r: sig[3], s: sig[4] };\n }\n throw new Error(\n `This wallet returned a ${sig.length}-felt signature that isn't a single STARK key ` +\n \"(multisig, hardware or passkey signers aren't supported as a SHHH co-owner yet).\"\n );\n}\n\nfunction starkVerifyX(r: bigint, s: bigint, msgHash: bigint, pubkeyX: bigint): boolean {\n const x = pubkeyX.toString(16).padStart(64, \"0\");\n const sig = new ec.starkCurve.Signature(r, s);\n for (const prefix of [\"02\", \"03\"]) {\n try {\n if (ec.starkCurve.verify(sig, toFeltHex(msgHash), prefix + x)) return true;\n } catch {\n // not a curve point for this parity\n }\n }\n return false;\n}\n\n/** Off-chain check of an approval signature, before relaying it. */\nexport function verifyStarkSnip12Approval(params: {\n walletAddress: string;\n messageHash: bigint | string;\n signerAddress: string;\n starkPubkey: bigint | string;\n signature: Array<string | number | bigint>;\n chainId?: bigint | string;\n}): boolean {\n const { r, s } = parseStarknetWalletSignature(params.signature);\n const h = starkSnip12ApprovalHash(params);\n return starkVerifyX(r, s, h, felt(params.starkPubkey));\n}\n\n/**\n * The V2_SNIP12 envelope for a STARK_SNIP12 owner: pass the wallet's raw\n * `wallet_signTypedData` result; it is normalized to `[r, s]`.\n */\nexport function buildStarkSnip12Envelope(params: {\n signature: Array<string | number | bigint>;\n /** u32 index of this owner in the SHHH wallet's owner_set. */\n ownerIndex: bigint;\n}): bigint[] {\n if (params.ownerIndex < 0n || params.ownerIndex >= 0x100000000n) {\n throw new Error(\n `buildStarkSnip12Envelope: ownerIndex ${params.ownerIndex} is out of u32 range. ` +\n \"Pass the owner's index in the owner_set, not its commitment.\"\n );\n }\n const { r, s } = parseStarknetWalletSignature(params.signature);\n return wrapV2Snip12Envelope({\n ownerId: params.ownerIndex,\n kindTag: STARK_SNIP12_KIND_TAG,\n payload: [r, s],\n });\n}\n\n/** Both public keys an (r, s) signature of `msgHash` could come from. */\nfunction recoverStarkKeys(r: bigint, s: bigint, msgHash: bigint): bigint[] {\n const out: bigint[] = [];\n for (const bit of [0, 1]) {\n try {\n const point = new ec.starkCurve.Signature(r, s)\n .addRecoveryBit(bit)\n .recoverPublicKey(msgHash.toString(16).padStart(64, \"0\"));\n out.push(point.toAffine().x);\n } catch {\n // no point for this recovery bit\n }\n }\n return out;\n}\n\nasync function tryCall(\n provider: StarknetCallProvider,\n contractAddress: string,\n entrypoint: string,\n calldata: string[] = []\n): Promise<string[] | null> {\n try {\n return await provider.callContract({ contractAddress, entrypoint, calldata });\n } catch {\n return null;\n }\n}\n\n/**\n * Which STARK key signs for `signerAddress`, proven by an approval signature\n * the wallet just produced (e.g. for the \"add trusted wallet\" step). Sources,\n * in order:\n * - Argent / Ready: the key inside the signature;\n * - Chipi (SHHH) wallet: the key whose commitment matches `get_owner(id)`;\n * - an undeployed account: `wallet_deploymentData` (OpenZeppelin, Argent 0.4);\n * - OpenZeppelin (Bramble): `get_public_key`;\n * - Braavos: `get_signers` (STARK only, no hardware or webauthn signers).\n * The chosen key must verify the approval, or this throws.\n */\nexport async function resolveStarkSnip12Signer(params: {\n provider: StarknetCallProvider;\n signerAddress: string;\n walletAddress: string;\n messageHash: bigint | string;\n signature: Array<string | number | bigint>;\n deploymentData?: StarknetDeploymentData;\n chainId?: bigint | string;\n}): Promise<{ starkPubkey: bigint; pubkeyFelts: bigint[] }> {\n const signer = normalizeStarknetAddress(params.signerAddress);\n const parsed = parseStarknetWalletSignature(params.signature);\n const approvalHash = starkSnip12ApprovalHash(params);\n const candidates: bigint[] = [];\n\n if (parsed.pubkey !== undefined) candidates.push(parsed.pubkey);\n\n if (parsed.shhhOwnerId !== undefined) {\n // A Chipi (SHHH) wallet's own envelope: only its owner record can name the\n // key. Never fall back to the OpenZeppelin or Braavos getters for it.\n const felts = await tryCall(params.provider, signer, \"get_owner\", [\n toFeltHex(parsed.shhhOwnerId),\n ]);\n const record = felts && felts.length >= 9 ? decodeShhhOwnerRecord(0, felts) : null;\n if (record && !record.revoked && record.kind === \"STARK\" && record.role === \"OWNER\") {\n for (const key of recoverStarkKeys(parsed.r, parsed.s, approvalHash)) {\n if (ownerCommitment(STARK_KIND_TAG_FELT, [key]) === record.pubkeyHash) candidates.push(key);\n }\n }\n if (candidates.length === 0) {\n throw new Error(\n `Couldn't confirm the Chipi wallet's signer: owner ${parsed.shhhOwnerId} of ${signer} ` +\n \"is not an active STARK owner whose key made this signature.\"\n );\n }\n }\n\n if (params.deploymentData && normalizeStarknetAddress(params.deploymentData.address) === signer) {\n const cls = normalizeStarknetAddress(params.deploymentData.class_hash);\n const cd = params.deploymentData.calldata;\n if (cls === COUNTERFACTUAL_ACCOUNT_CLASSES.OPENZEPPELIN_V3 && cd.length === 1) {\n candidates.push(felt(cd[0]));\n }\n if (cls === COUNTERFACTUAL_ACCOUNT_CLASSES.ARGENT_V0_4 && cd.length === 3) {\n candidates.push(felt(cd[1]));\n }\n }\n\n if (candidates.length === 0) {\n const oz = await tryCall(params.provider, signer, \"get_public_key\");\n if (oz && oz.length >= 1) candidates.push(felt(oz[0]));\n }\n\n if (candidates.length === 0) {\n // Braavos get_signers -> [stark_len, ...stark, secp256r1_len, ..., webauthn_len, ...]\n const signers = await tryCall(params.provider, signer, \"get_signers\");\n if (signers && signers.length >= 1) {\n const starkLen = Number(BigInt(signers[0]));\n const rest = signers.slice(1 + starkLen);\n const onlyStark = rest.every((v) => BigInt(v) === 0n);\n if (starkLen === 1 && onlyStark) candidates.push(felt(signers[1]));\n }\n }\n\n const key = candidates.find((k) => starkVerifyX(parsed.r, parsed.s, approvalHash, k));\n if (key === undefined) {\n throw new Error(\n \"Couldn't confirm which key signs for this wallet. It may use a hardware or passkey \" +\n \"signer, a multisig, or an account type we don't read yet.\"\n );\n }\n return { starkPubkey: key, pubkeyFelts: starkSnip12PubkeyFelts(key, signer) };\n}\n","/**\n * SHHH V8.4 governance + recovery call builders.\n *\n * Wave B PR B1. The V8.4 ShhhAccount gates every owner-set mutation\n * through a propose → wait-timelock → execute flow (`@external` fns\n * in `src/account.cairo`). The propose and cancel entrypoints are\n * `_assert_self_call`-gated, which means callers wrap these `Call`s inside\n * an OutsideExecution and submit through the paymaster (see below for the\n * permissionless ones).\n *\n * This module produces the `Call` (`{ contractAddress, entrypoint,\n * calldata }`) shape that `oe.ts:buildOutsideExecution` expects. It\n * does NOT sign — that's the integrator's choice of signer kind. For\n * recovery initiation specifically, the signer MUST be a guardian owner\n * (`role == ROLE_GUARDIAN` on-chain).\n *\n * Sources of truth on the Cairo side:\n *\n * src/account.cairo:616 propose_add_owner\n * src/account.cairo:634 propose_remove_owner\n * src/account.cairo:649 propose_rotate_owner\n * src/account.cairo:670 propose_set_threshold\n * src/account.cairo:731 execute_add_owner\n * src/account.cairo:760 execute_remove_owner\n * src/account.cairo:769 execute_rotate_owner\n * src/account.cairo:786 execute_set_threshold\n * src/account.cairo:828 cancel_pending_op\n * src/account.cairo:864 initiate_recovery\n * src/account.cairo:888 cancel_recovery\n * src/account.cairo:897 finalize_recovery\n * src/governance/pending_ops.cairo OP_* + TIMELOCK_* felt constants\n * src/owner_set/interface.cairo ROLE_* felt constants\n *\n * Timelock semantics\n\n * propose_add_owner 48h\n * propose_remove_owner 24h\n * propose_rotate_owner 24h\n * propose_set_threshold 48h\n * initiate_recovery 7d (longest — the headline UX gate)\n *\n * Recovery is ADDITIVE on V8.4: `finalize_recovery` adds the new owner\n * but does not remove existing ones. The integrator's UI is expected\n * to follow with `propose_remove_owner` for stale devices.\n *\n * Not every entrypoint here is `_assert_self_call`-gated. The\n * propose_* calls, cancel_pending_op, initiate_recovery and\n * cancel_recovery are (they need an OE signed by an owner, or by a\n * guardian for a single-call initiate_recovery). Every execute_* call\n * and finalize_recovery are permissionless once their timelock has\n * elapsed: anyone can submit them, directly or inside an owner's OE, because\n * the wallet re-checks the stored payload commitment. The builders still\n * return a Call so the integrator can dispatch via their normal account\n * abstraction layer.\n */\n\nimport { hash, num, shortString, type Call } from \"starknet\";\nimport { SHHH_VERIFIER_CLASS_HASHES } from \"@chipi-stack/shared\";\nimport type { ShhhSignerKind } from \"@chipi-stack/types\";\nimport type { StarknetCallProvider } from \"../starknet-signature\";\n\n// ================================================================\n// Felt constants — MUST match the Cairo source exactly.\n// ================================================================\n\n/** `src/owner_set/interface.cairo:10` — `pub const ROLE_OWNER: felt252 = 'OWNER'`. */\nexport const ROLE_OWNER = BigInt(shortString.encodeShortString(\"OWNER\"));\n\n/** `src/owner_set/interface.cairo:11` — `pub const ROLE_GUARDIAN: felt252 = 'GUARDIAN'`. */\nexport const ROLE_GUARDIAN = BigInt(shortString.encodeShortString(\"GUARDIAN\"));\n\n/** `src/governance/pending_ops.cairo:19` — `OP_ADD_OWNER: felt252 = 'ADD_OWNER'`. */\nexport const OP_ADD_OWNER = BigInt(shortString.encodeShortString(\"ADD_OWNER\"));\nexport const OP_REMOVE_OWNER = BigInt(shortString.encodeShortString(\"REMOVE_OWNER\"));\nexport const OP_ROTATE_OWNER = BigInt(shortString.encodeShortString(\"ROTATE_OWNER\"));\nexport const OP_SET_THRESHOLD = BigInt(shortString.encodeShortString(\"SET_THRESHOLD\"));\n/** `src/governance/pending_ops.cairo:23` — `OP_ADD_VERIFIER_CLASS: felt252 = 'ADD_VERIFIER'`. */\nexport const OP_ADD_VERIFIER_CLASS = BigInt(shortString.encodeShortString(\"ADD_VERIFIER\"));\n\n/**\n * Per-op timelocks in seconds. Match `src/governance/pending_ops.cairo:42-50`\n * exactly. Exposed so SDK consumers can predict timelock expiry without\n * an extra on-chain call after `proposeAddOwner` succeeds.\n */\nexport const TIMELOCK_SECONDS = {\n ADD_OWNER: 172_800, // 48h\n REMOVE_OWNER: 86_400, // 24h\n ROTATE_OWNER: 86_400, // 24h\n SET_THRESHOLD: 172_800, // 48h\n ADD_VERIFIER: 172_800, // 48h\n REMOVE_VERIFIER: 86_400, // 24h\n ADD_GUARDIAN: 86_400, // 24h\n REMOVE_GUARDIAN: 86_400, // 24h\n RECOVERY: 604_800, // 7d — `TIMELOCK_RECOVERY`, the headline UX gate\n} as const;\n\n/** `DEFAULT_OP_EXPIRY_SECONDS` from `pending_ops.cairo:78`. The window is\n * measured from `valid_after`, not from propose time:\n * `expires_at = now + timelock + DEFAULT_OP_EXPIRY_SECONDS`\n * (governance/component.cairo). So a 48h op (add_owner, set_threshold,\n * add_verifier) lives 16 days from propose and a 24h op 15. Read\n * `get_pending_op` (or the `OpProposed` event, `parseOpProposedEvents`) for\n * the exact `expires_at` instead of adding 14d to the propose timestamp. The\n * op auto-expires at that point even if no one calls cancel; UI should\n * reflect it so users don't sit on a stale op.\n *\n * Recovery is not a pending op and has no expiry: an initiated recovery\n * stays pending until an owner cancels it or anyone finalizes it after the\n * 7d timelock. */\nexport const DEFAULT_OP_EXPIRY_SECONDS = 1_209_600; // 14d\n\n// ================================================================\n// Types\n// ================================================================\n\n/** Owner role on-chain. ROLE_OWNER can sign OEs; ROLE_GUARDIAN can\n * only `initiate_recovery` (no general signing power). */\nexport type OwnerRole = \"OWNER\" | \"GUARDIAN\";\n\n/**\n * Inputs shared across add-owner / rotate / initiate-recovery — they\n * all encode a (kind, pubkey, role, weight, label) tuple.\n *\n * `pubkeyBytes` is the per-kind felt-array layout exposed by the\n * matching `*PubkeyFelts` helper in `signers/{stark,ed25519,eip191,\n * webauthn}.ts`. The Cairo verifier calls `owner_commitment(kind,\n * pubkeyBytes)` to derive the on-chain owner_id; if the bytes\n * disagree with the kind's verifier expectation,\n * `_validate_pubkey_via_verifier` panics at execute time (audit M-1).\n */\nexport interface NewOwnerInput {\n kind: string;\n pubkeyBytes: bigint[];\n role: OwnerRole;\n weight: number;\n label: string;\n}\n\n/**\n * Coerce any felt-like to a non-negative bigint. Negative inputs are\n * rejected at this boundary because `(-1n).toString(16) === \"-1\"` —\n * the resulting calldata `\"0x-1\"` is not valid hex and would fail\n * at invoke time with an opaque \"could not deserialize\" error from\n * the RPC. Failing here gives the caller a clear, actionable message.\n */\nfunction _felt(x: bigint | string | number, field = \"felt\"): bigint {\n const v = typeof x === \"bigint\" ? x : BigInt(x);\n if (v < 0n) {\n throw new RangeError(`${field} must be a non-negative felt; got ${v.toString()}`);\n }\n return v;\n}\n\nfunction _encodeOwnerInput(input: NewOwnerInput): bigint[] {\n if (input.weight < 0) {\n throw new RangeError(`NewOwnerInput.weight must be non-negative; got ${input.weight}`);\n }\n const kindFelt = _felt(BigInt(shortString.encodeShortString(input.kind)), \"kind\");\n const roleFelt = input.role === \"OWNER\" ? ROLE_OWNER : ROLE_GUARDIAN;\n const pubkey = input.pubkeyBytes.map((p, i) => _felt(p, `pubkeyBytes[${i}]`));\n // Cairo Array<felt252> serializes as [len, ...elements].\n return [\n kindFelt,\n BigInt(pubkey.length),\n ...pubkey,\n roleFelt,\n BigInt(input.weight),\n _felt(BigInt(shortString.encodeShortString(input.label)), \"label\"),\n ];\n}\n\nfunction _call(walletAddress: bigint | string, entrypoint: string, calldata: bigint[]): Call {\n // Final defense in depth: catch any caller that constructs calldata\n // outside the helpers above. Cheap loop, runs once per builder call.\n for (let i = 0; i < calldata.length; i++) {\n if (calldata[i] < 0n) {\n throw new RangeError(\n `calldata[${i}] must be a non-negative felt; got ${calldata[i].toString()}`\n );\n }\n }\n return {\n contractAddress:\n typeof walletAddress === \"bigint\" ? \"0x\" + walletAddress.toString(16) : walletAddress,\n entrypoint,\n calldata: calldata.map((v) => \"0x\" + v.toString(16)),\n };\n}\n\n// ================================================================\n// Multi-owner governance: propose / execute / cancel\n// ================================================================\n\n/**\n * Build a `propose_add_owner(proposer, kind, pubkey_bytes, role,\n * weight, label)` call. Wrap in an OE signed by `proposer` and submit\n * through the paymaster. After confirmation, watch for the\n * `OpProposed` event to learn the `op_id`; then wait\n * `TIMELOCK_SECONDS.ADD_OWNER` and call `buildExecuteAddOwnerCall`.\n */\nexport function buildProposeAddOwnerCall(args: {\n walletAddress: bigint | string;\n proposer: number;\n newOwner: NewOwnerInput;\n}): Call {\n const calldata: bigint[] = [BigInt(args.proposer), ..._encodeOwnerInput(args.newOwner)];\n return _call(args.walletAddress, \"propose_add_owner\", calldata);\n}\n\n/**\n * Build an `execute_add_owner(op_id, kind, pubkey_bytes, role, weight,\n * label)` call. MUST be called after the 48h timelock from the matching\n * propose. The wallet recomputes the payload and asserts equality\n * before mutating `owner_set`.\n */\nexport function buildExecuteAddOwnerCall(args: {\n walletAddress: bigint | string;\n opId: bigint | string;\n newOwner: NewOwnerInput;\n}): Call {\n const calldata: bigint[] = [_felt(args.opId), ..._encodeOwnerInput(args.newOwner)];\n return _call(args.walletAddress, \"execute_add_owner\", calldata);\n}\n\nexport function buildProposeRemoveOwnerCall(args: {\n walletAddress: bigint | string;\n proposer: number;\n ownerId: number;\n}): Call {\n return _call(args.walletAddress, \"propose_remove_owner\", [\n BigInt(args.proposer),\n BigInt(args.ownerId),\n ]);\n}\n\nexport function buildExecuteRemoveOwnerCall(args: {\n walletAddress: bigint | string;\n opId: bigint | string;\n ownerId: number;\n}): Call {\n return _call(args.walletAddress, \"execute_remove_owner\", [\n _felt(args.opId),\n BigInt(args.ownerId),\n ]);\n}\n\nexport function buildProposeRotateOwnerCall(args: {\n walletAddress: bigint | string;\n proposer: number;\n ownerId: number;\n newPubkeyBytes: bigint[];\n}): Call {\n return _call(args.walletAddress, \"propose_rotate_owner\", [\n BigInt(args.proposer),\n BigInt(args.ownerId),\n BigInt(args.newPubkeyBytes.length),\n ...args.newPubkeyBytes,\n ]);\n}\n\nexport function buildExecuteRotateOwnerCall(args: {\n walletAddress: bigint | string;\n opId: bigint | string;\n ownerId: number;\n newPubkeyBytes: bigint[];\n}): Call {\n return _call(args.walletAddress, \"execute_rotate_owner\", [\n _felt(args.opId),\n BigInt(args.ownerId),\n BigInt(args.newPubkeyBytes.length),\n ...args.newPubkeyBytes,\n ]);\n}\n\nexport function buildProposeSetThresholdCall(args: {\n walletAddress: bigint | string;\n proposer: number;\n newThreshold: number;\n}): Call {\n return _call(args.walletAddress, \"propose_set_threshold\", [\n BigInt(args.proposer),\n BigInt(args.newThreshold),\n ]);\n}\n\nexport function buildExecuteSetThresholdCall(args: {\n walletAddress: bigint | string;\n opId: bigint | string;\n newThreshold: number;\n}): Call {\n return _call(args.walletAddress, \"execute_set_threshold\", [\n _felt(args.opId),\n BigInt(args.newThreshold),\n ]);\n}\n\n/**\n * Build a `cancel_pending_op(op_id)` call. Valid any time before the\n * op is executed; signed by any current owner via OE.\n */\nexport function buildCancelPendingOpCall(args: {\n walletAddress: bigint | string;\n opId: bigint | string;\n}): Call {\n return _call(args.walletAddress, \"cancel_pending_op\", [_felt(args.opId)]);\n}\n\n// ================================================================\n// Verifier classes: teach a deployed wallet a new signer kind\n// ================================================================\n\nfunction _verifierClassHash(kind: ShhhSignerKind, classHash?: bigint | string): bigint {\n const h = classHash ?? SHHH_VERIFIER_CLASS_HASHES[kind];\n if (!h) throw new Error(`No verifier class hash known for kind \"${kind}\".`);\n return _felt(h, \"classHash\");\n}\n\n/**\n * Build a `propose_add_verifier_class(proposer, kind, class_hash)` call.\n *\n * A wallet only verifies the kinds in its `verifier_classes` map; a Chipi\n * passkey wallet starts with `STARK` only. To add an owner or guardian of\n * another kind (e.g. `STARK_SNIP12` for Bramble), put this call and\n * `buildProposeAddOwnerCall` in the same owner-signed OE, wait 48h, then\n * run `buildExecuteAddVerifierClassCall` BEFORE `buildExecuteAddOwnerCall`\n * (execute_add_owner validates the new pubkey through the verifier).\n * Reverts with `'SHHH: verifier already set'` if the kind is registered;\n * check `readVerifierClass` first.\n */\nexport function buildProposeAddVerifierClassCall(args: {\n walletAddress: bigint | string;\n proposer: number;\n kind: ShhhSignerKind;\n /** Defaults to `SHHH_VERIFIER_CLASS_HASHES[kind]`. */\n classHash?: bigint | string;\n}): Call {\n const kindFelt = BigInt(shortString.encodeShortString(args.kind));\n return _call(args.walletAddress, \"propose_add_verifier_class\", [\n BigInt(args.proposer),\n kindFelt,\n _verifierClassHash(args.kind, args.classHash),\n ]);\n}\n\n/** Build an `execute_add_verifier_class(op_id, kind, class_hash)` call (permissionless after 48h). */\nexport function buildExecuteAddVerifierClassCall(args: {\n walletAddress: bigint | string;\n opId: bigint | string;\n kind: ShhhSignerKind;\n classHash?: bigint | string;\n}): Call {\n const kindFelt = BigInt(shortString.encodeShortString(args.kind));\n return _call(args.walletAddress, \"execute_add_verifier_class\", [\n _felt(args.opId),\n kindFelt,\n _verifierClassHash(args.kind, args.classHash),\n ]);\n}\n\n// ================================================================\n// Recovery: initiate / cancel / finalize\n// ================================================================\n\n/**\n * Build an `initiate_recovery(proposer, new_owner_kind, new_pubkey_bytes,\n * new_role, new_weight, new_label)` call.\n *\n * IMPORTANT: `proposer` MUST be an owner with `role == ROLE_GUARDIAN`.\n * If it's a regular owner, the wallet panics with\n * `'RECOVERY: not a guardian'`. The new owner being recovered to is\n * typically `role: \"OWNER\"` so it can sign after the timelock.\n *\n * After confirmation, the wallet starts a 7-day timelock\n * (`TIMELOCK_SECONDS.RECOVERY`). During the window:\n * - Any current ROLE_OWNER can call `cancel_recovery` to abort.\n * - After the window, anyone can call `finalize_recovery`.\n */\nexport function buildInitiateRecoveryCall(args: {\n walletAddress: bigint | string;\n /** owner_id of the guardian that's initiating */\n proposer: number;\n newOwner: NewOwnerInput;\n}): Call {\n const calldata: bigint[] = [BigInt(args.proposer), ..._encodeOwnerInput(args.newOwner)];\n return _call(args.walletAddress, \"initiate_recovery\", calldata);\n}\n\n/**\n * Build a `cancel_recovery(owner_id)` call. Signed by any current\n * ROLE_OWNER via OE — the canceler must hold a working signing key.\n * The owner_id arg identifies which owner is canceling (used by the\n * wallet for event attribution and the not-revoked / role-OWNER check).\n */\nexport function buildCancelRecoveryCall(args: {\n walletAddress: bigint | string;\n ownerId: number;\n}): Call {\n return _call(args.walletAddress, \"cancel_recovery\", [BigInt(args.ownerId)]);\n}\n\n/**\n * Build a `finalize_recovery(new_owner_kind, new_pubkey_bytes, new_role,\n * new_weight, new_label)` call.\n *\n * Permissionless after the 7-day timelock. The wallet recomputes the\n * pubkey commitment and asserts equality against the stored value\n * from `initiate_recovery`. Per audit H-1, the recovery path also\n * library-calls the per-kind verifier so a poison-pill pubkey from a\n * compromised guardian still fails at finalize time, not silently.\n *\n * Recovery is additive — existing owners stay. Follow up with\n * `buildProposeRemoveOwnerCall` for the stale devices.\n *\n * Because this call is NOT `_assert_self_call`-gated, the integrator\n * can either wrap it in an OE (signed by anyone) or dispatch directly\n * via a regular invoke. The Call shape is the same.\n */\nexport function buildFinalizeRecoveryCall(args: {\n walletAddress: bigint | string;\n newOwner: NewOwnerInput;\n}): Call {\n return _call(args.walletAddress, \"finalize_recovery\", _encodeOwnerInput(args.newOwner));\n}\n\n// ================================================================\n// State queries — read-only views\n// ================================================================\n\n/**\n * Compute the selector for a view; convenient for `provider.callContract`.\n * Exposed so SDK consumers can build their own `{ contractAddress,\n * entryPointSelector, calldata }` `Call`-shaped views without\n * re-deriving selectors.\n */\nexport const VIEW_SELECTORS = {\n get_pending_op: hash.getSelectorFromName(\"get_pending_op\"),\n get_pending_recovery: hash.getSelectorFromName(\"get_pending_recovery\"),\n get_owner: hash.getSelectorFromName(\"get_owner\"),\n} as const;\n\n/**\n * Coerce a timestamp argument (number or bigint) to a non-negative\n * bigint of whole seconds. Truncates fractional seconds via Math.floor\n * — important because `BigInt(Date.now() / 1000)` would otherwise\n * throw on a non-integer. NaN / ±Infinity are rejected.\n */\nfunction _toSecondsBigInt(value: number | bigint, field: string): bigint {\n if (typeof value === \"bigint\") return value;\n if (!Number.isFinite(value)) {\n throw new TypeError(`${field} must be a finite timestamp; got ${value}`);\n }\n return BigInt(Math.floor(value));\n}\n\n/**\n * Given a `valid_after` block timestamp (seconds) returned from\n * `get_pending_op` or `get_pending_recovery`, compute whether the\n * timelock has elapsed against a given clock reading. Cheap UI helper\n * so consumers don't reach for a date library. Accepts fractional\n * `number` seconds (e.g., `Date.now() / 1000`) — truncates via floor.\n */\nexport function isReadyToExecute(validAfterSecs: number | bigint, nowSecs: number): boolean {\n return _toSecondsBigInt(nowSecs, \"nowSecs\") >= _toSecondsBigInt(validAfterSecs, \"validAfterSecs\");\n}\n\n/**\n * Seconds remaining until a pending op / recovery becomes executable.\n * Returns 0 when the timelock has already elapsed. Useful for showing\n * a countdown in UI without a separate clock import. Accepts fractional\n * `number` seconds — truncates via floor.\n */\nexport function secondsUntilExecutable(validAfterSecs: number | bigint, nowSecs: number): number {\n const remaining =\n _toSecondsBigInt(validAfterSecs, \"validAfterSecs\") - _toSecondsBigInt(nowSecs, \"nowSecs\");\n return remaining <= 0n ? 0 : Number(remaining);\n}\n\n// ================================================================\n// On-chain reads (any starknet.js-style provider with `callContract`)\n// ================================================================\n\n/** One entry of a wallet's owner_set (`get_owner`). */\nexport interface ShhhOwnerRecord {\n /** u32 index: what `owner_id` means in envelopes and governance calls. */\n ownerId: number;\n kind: string;\n /** poseidon(kind, pubkey...) — compare with `ownerCommitment`. */\n pubkeyHash: bigint;\n role: \"OWNER\" | \"GUARDIAN\" | \"RECOVERY_ONLY\" | string;\n weight: number;\n addedAt: number;\n label: string;\n revoked: boolean;\n}\n\n/** A governance op from an `OpProposed` event. */\nexport interface ShhhProposedOp {\n opId: bigint;\n opKind: string;\n proposer: number;\n payload: bigint;\n validAfter: number;\n expiresAt: number;\n}\n\n/** `get_pending_recovery` decoded. */\nexport interface ShhhPendingRecovery {\n initiatedAt: number;\n validAfter: number;\n newOwnerHash: bigint;\n isActive: boolean;\n}\n\nfunction _decodeShort(value: string | bigint): string {\n const v = BigInt(value);\n return v === 0n ? \"\" : shortString.decodeShortString(num.toHex(v));\n}\n\nfunction _view(\n provider: StarknetCallProvider,\n walletAddress: bigint | string,\n entrypoint: string,\n calldata: Array<bigint | string | number> = []\n): Promise<string[]> {\n return provider.callContract({\n contractAddress: typeof walletAddress === \"bigint\" ? num.toHex(walletAddress) : walletAddress,\n entrypoint,\n calldata: calldata.map((v) => num.toHex(BigInt(v))),\n });\n}\n\n/** Every owner and guardian of a SHHH wallet, revoked ones included (ids stay stable). */\nexport async function readShhhOwners(\n provider: StarknetCallProvider,\n walletAddress: bigint | string\n): Promise<ShhhOwnerRecord[]> {\n const [countFelt] = await _view(provider, walletAddress, \"owner_count\");\n const count = Number(BigInt(countFelt));\n const owners: ShhhOwnerRecord[] = [];\n for (let id = 0; id < count; id++) {\n owners.push(decodeShhhOwnerRecord(id, await _view(provider, walletAddress, \"get_owner\", [id])));\n }\n return owners;\n}\n\n/**\n * Decode a `get_owner` result: `OwnerRecord { kind, pubkey_hash, pubkey_len,\n * pubkey_slot, role, weight, added_at, label, revoked }` (owner_set/interface.cairo).\n */\nexport function decodeShhhOwnerRecord(ownerId: number, felts: string[]): ShhhOwnerRecord {\n if (felts.length < 9) {\n throw new Error(`get_owner returned ${felts.length} felts; expected 9 (OwnerRecord).`);\n }\n return {\n ownerId,\n kind: _decodeShort(felts[0]),\n pubkeyHash: BigInt(felts[1]),\n role: _decodeShort(felts[4]),\n weight: Number(BigInt(felts[5])),\n addedAt: Number(BigInt(felts[6])),\n label: _decodeShort(felts[7]),\n revoked: BigInt(felts[8]) !== 0n,\n };\n}\n\n/** The class hash registered for `kind` on this wallet, or 0n if none. */\nexport async function readVerifierClass(\n provider: StarknetCallProvider,\n walletAddress: bigint | string,\n kind: ShhhSignerKind\n): Promise<bigint> {\n const [h] = await _view(provider, walletAddress, \"get_verifier_class\", [\n BigInt(shortString.encodeShortString(kind)),\n ]);\n return BigInt(h ?? 0);\n}\n\n/** The wallet's pending recovery (`isActive: false` when there is none). */\nexport async function readPendingRecovery(\n provider: StarknetCallProvider,\n walletAddress: bigint | string\n): Promise<ShhhPendingRecovery> {\n const r = await _view(provider, walletAddress, \"get_pending_recovery\");\n return {\n initiatedAt: Number(BigInt(r[0])),\n validAfter: Number(BigInt(r[1])),\n newOwnerHash: BigInt(r[2]),\n isActive: BigInt(r[3]) !== 0n,\n };\n}\n\nconst OP_PROPOSED_KEY = BigInt(hash.getSelectorFromName(\"OpProposed\"));\n\n/**\n * Governance ops proposed in a transaction, from its receipt events. The\n * op_id mixes in the block timestamp and a counter, so it can only be read\n * back after the propose lands: pass `receipt.events` here.\n */\nexport function parseOpProposedEvents(\n events: Array<{ from_address?: string; keys: string[]; data: string[] }>,\n walletAddress?: bigint | string\n): ShhhProposedOp[] {\n const wallet = walletAddress === undefined ? undefined : BigInt(walletAddress);\n return events\n .filter(\n (e) =>\n e.keys.length >= 3 &&\n BigInt(e.keys[0]) === OP_PROPOSED_KEY &&\n (wallet === undefined ||\n (e.from_address !== undefined && BigInt(e.from_address) === wallet))\n )\n .map((e) => ({\n opId: BigInt(e.keys[1]),\n opKind: _decodeShort(e.keys[2]),\n proposer: Number(BigInt(e.data[0])),\n payload: BigInt(e.data[1]),\n validAfter: Number(BigInt(e.data[2])),\n expiresAt: Number(BigInt(e.data[3])),\n }));\n}\n","import type {\n ChipiSDKConfig,\n CreateWalletParams,\n CreateWalletResponse,\n GetWalletParams,\n TransferParams,\n ApproveParams,\n CallAnyContractParams,\n ExecuteTransactionParams,\n RecordSendTransactionParams,\n Transaction,\n CreateSkuPurchaseParams,\n GetTokenBalanceParams,\n GetTokenBalanceResponse,\n PaginatedResponse,\n Sku,\n GetSkuListQuery,\n GetTransactionListQuery,\n ExecuteWithSessionParams,\n Currency,\n X402FacilitatorConfig,\n SignTypedDataParams,\n SignTypedDataResult,\n TransactionStatusResponse,\n PrepareWalletUpgradeParams,\n PrepareWalletUpgradeResponse,\n ExecuteWalletUpgradeParams,\n ExecuteWalletUpgradeResponse,\n} from \"@chipi-stack/types\";\nimport { STARKNET_NETWORKS, CONTRACT_ADDRESSES, formatAmount } from \"@chipi-stack/shared\";\nimport { ChipiClient } from \"./client\";\nimport { ChipiWallets } from \"./wallets\";\nimport { ChipiTransactions } from \"./transactions\";\nimport { ChipiSkuPurchases } from \"./sku-purchases\";\nimport { ChipiSkus } from \"./skus\";\n\nimport { ChipiSessions } from \"./sessions\";\nimport { ChipiExchanges } from \"./exchanges\";\nimport { ChipiTreasury } from \"./treasury\";\nimport { ChipiAi } from \"./ai\";\nimport { ChipiPaymasterAdapter } from \"./paymaster-adapter\";\nimport { X402Facilitator } from \"./x402/facilitator\";\nimport { signTypedData, signTypedDataArray } from \"./sign-typed-data\";\nimport { executeShhhWithExternalSigner } from \"./shhh/execute-external-owner\";\n\n/**\n * Main Chipi SDK class\n */\nexport class ChipiSDK {\n private client: ChipiClient;\n private nodeUrl: string;\n private apiSecretKey?: string;\n\n public readonly wallets: ChipiWallets;\n public readonly transactions: ChipiTransactions;\n public readonly skuPurchases: ChipiSkuPurchases;\n public readonly skus: ChipiSkus;\n public readonly sessions: ChipiSessions;\n public readonly exchanges: ChipiExchanges;\n public readonly treasury: ChipiTreasury;\n /** AI API (`/v1/ai/*`). Server-only: needs `apiSecretKey` (`sk_`). */\n public readonly ai: ChipiAi;\n\n constructor(config: ChipiSDKConfig) {\n this.client = new ChipiClient(config);\n this.nodeUrl = config.nodeUrl || STARKNET_NETWORKS.MAINNET;\n this.apiSecretKey = config.apiSecretKey;\n\n // Initialize service classes\n this.wallets = new ChipiWallets(this.client);\n this.transactions = new ChipiTransactions(this.client);\n this.skuPurchases = new ChipiSkuPurchases(this.client);\n this.skus = new ChipiSkus(this.client);\n this.sessions = new ChipiSessions(this.client);\n this.exchanges = new ChipiExchanges(this.client);\n this.treasury = new ChipiTreasury(this.client, config.apiSecretKey);\n this.ai = new ChipiAi(this.client, config.apiSecretKey, this.sessions);\n\n // Bind methods to preserve context\n this.executeTransaction = this.executeTransaction.bind(this);\n this.executeTransactionWithSession = this.executeTransactionWithSession.bind(this);\n this.transfer = this.transfer.bind(this);\n this.approve = this.approve.bind(this);\n // this.stakeVesuUsdc = this.stakeVesuUsdc.bind(this);\n // this.withdrawVesuUsdc = this.withdrawVesuUsdc.bind(this);\n this.callAnyContract = this.callAnyContract.bind(this);\n this.createWallet = this.createWallet.bind(this);\n this.recordSendTransaction = this.recordSendTransaction.bind(this);\n this.purchaseSku = this.purchaseSku.bind(this);\n this.getUsdAmount = this.getUsdAmount.bind(this);\n this.signTypedData = this.signTypedData.bind(this);\n this.signTypedDataArray = this.signTypedDataArray.bind(this);\n this.executeWithExternalSigner = this.executeWithExternalSigner.bind(this);\n this.createPaymasterAdapter = this.createPaymasterAdapter.bind(this);\n this.createX402Facilitator = this.createX402Facilitator.bind(this);\n }\n\n /**\n * Resolve bearer token - uses provided token or falls back to apiSecretKey\n */\n private resolveBearerToken(bearerToken?: string): string {\n const token = bearerToken ?? this.apiSecretKey;\n\n if (!token) {\n throw new Error(\n \"Authentication required: either pass a bearerToken or configure the SDK with an apiSecretKey\"\n );\n }\n\n return token;\n }\n\n /**\n * Create a PaymasterAdapter for use with TxBuilder.sendSponsored().\n *\n * @example\n * ```typescript\n * const sdk = new ChipiServerSDK({ apiPublicKey: \"pk_...\", apiSecretKey: \"sk_...\" });\n * const paymaster = sdk.createPaymasterAdapter();\n *\n * const txHash = await new TxBuilder(account, { paymaster })\n * .transfer(USDC, [{ to, amount }])\n * .sendSponsored(); // gasless!\n * ```\n */\n createPaymasterAdapter(bearerToken?: string): ChipiPaymasterAdapter {\n const token = this.resolveBearerToken(bearerToken);\n return new ChipiPaymasterAdapter(this.client, token);\n }\n\n /**\n * Create an X402Facilitator for verifying and settling x402 payments.\n *\n * @example\n * ```typescript\n * const facilitator = sdk.createX402Facilitator();\n *\n * // With custom nonce store (Redis)\n * const facilitator = sdk.createX402Facilitator(bearerToken, {\n * nonceStore: {\n * has: async (nonce) => (await redis.sismember(\"x402:nonces\", nonce)) === 1,\n * consume: async (nonce) => (await redis.sadd(\"x402:nonces\", nonce)) === 1,\n * },\n * });\n * ```\n */\n createX402Facilitator(bearerToken?: string, config?: X402FacilitatorConfig): X402Facilitator {\n const token = this.resolveBearerToken(bearerToken);\n return new X402Facilitator(this.client, token, config);\n }\n\n /**\n * Execute a gasless transaction\n */\n async executeTransaction({\n params,\n bearerToken,\n }: {\n params: ExecuteTransactionParams;\n bearerToken?: string;\n }): Promise<string> {\n return this.transactions.executeTransaction({\n params,\n bearerToken: this.resolveBearerToken(bearerToken),\n });\n }\n\n /**\n * Execute a gasless transaction using a session key.\n *\n * This uses the 4-element session signature format instead of owner signature.\n * The session must be:\n * 1. Generated via `sessions.createSessionKey()`\n * 2. Registered on-chain via `sessions.addSessionKeyToContract()`\n *\n * CHIPI wallets only - will throw if wallet type is not CHIPI.\n *\n * @example\n * ```typescript\n * // 1. Create session key (store externally)\n * const session = sdk.sessions.createSessionKey({ encryptKey });\n *\n * // 2. Register on contract (one-time)\n * await sdk.sessions.addSessionKeyToContract({\n * encryptKey,\n * wallet,\n * sessionConfig: {\n * sessionPublicKey: session.publicKey,\n * validUntil: session.validUntil,\n * maxCalls: 1000,\n * allowedEntrypoints: []\n * }\n * }, bearerToken);\n *\n * // 3. Execute transactions with session (no owner key needed)\n * const txHash = await sdk.executeTransactionWithSession({\n * params: { encryptKey, wallet, session, calls },\n * bearerToken\n * });\n * ```\n */\n async executeTransactionWithSession({\n params,\n bearerToken,\n }: {\n params: ExecuteWithSessionParams;\n bearerToken?: string;\n }): Promise<string> {\n return this.sessions.executeTransactionWithSession(\n params,\n this.resolveBearerToken(bearerToken)\n );\n }\n\n /**\n * Sign SNIP-12 typed data without executing a transaction.\n *\n * Purely local operation: decrypt private key → sign → return { r, s }.\n * No API calls are made. Useful for x402 payment signatures and other\n * off-chain signing flows.\n *\n * @example\n * ```typescript\n * const { r, s } = await sdk.signTypedData({\n * params: {\n * encryptKey: pin,\n * wallet,\n * typedData: snip12TypedData,\n * },\n * });\n * ```\n */\n async signTypedData({ params }: { params: SignTypedDataParams }): Promise<SignTypedDataResult> {\n return signTypedData({ params });\n }\n\n /**\n * Sign SNIP-12 typed data and return the full signature span (felt strings) —\n * the shape a dApp's `wallet_signTypedData` expects. Wallet-type aware:\n * SHHH returns the V2_SNIP12 owner envelope; standard accounts return [r, s].\n */\n async signTypedDataArray({ params }: { params: SignTypedDataParams }): Promise<string[]> {\n return signTypedDataArray({ params });\n }\n\n /**\n * Run calls on a SHHH wallet, signed by an external Starknet wallet that is\n * one of its `STARK_SNIP12` owners (Bramble, Braavos, Ready/Argent, OZ, or\n * another Chipi wallet). The wallet signs an `Approval` typed data through\n * `signTypedData` (its `wallet_signTypedData`); Chipi's paymaster relays the\n * outside execution gaslessly. Returns the tx hash: wait for it.\n *\n * @example\n * ```typescript\n * // Bramble approves an agent session on the user's Chipi wallet.\n * const bramble = window.starknet_bramble;\n * const txHash = await sdk.executeWithExternalSigner({\n * params: {\n * walletAddress: wallet.publicKey,\n * ownerIndex: 1, // Bramble's index in the wallet's owner set\n * calls: buildSessionSetupCalls(wallet.publicKey, sessionConfig, policies),\n * signTypedData: (typedData) =>\n * bramble.request({ type: \"wallet_signTypedData\", params: typedData }),\n * },\n * bearerToken,\n * });\n * ```\n */\n async executeWithExternalSigner({\n params,\n bearerToken,\n }: {\n params: Omit<Parameters<typeof executeShhhWithExternalSigner>[0], \"client\" | \"bearerToken\">;\n bearerToken?: string;\n }): Promise<string> {\n return executeShhhWithExternalSigner({\n ...params,\n client: this.client,\n bearerToken: this.resolveBearerToken(bearerToken),\n });\n }\n\n /**\n * Transfer tokens\n */\n async transfer({\n params,\n bearerToken,\n }: {\n params: TransferParams;\n bearerToken?: string;\n }): Promise<string> {\n return this.transactions.transfer({\n params,\n bearerToken: this.resolveBearerToken(bearerToken),\n });\n }\n\n /**\n * Approve token spending\n */\n async approve({\n params,\n bearerToken,\n }: {\n params: ApproveParams;\n bearerToken?: string;\n }): Promise<string> {\n const { encryptKey, wallet, contractAddress, spender, amount, decimals } = params;\n return this.executeTransaction({\n params: {\n encryptKey,\n wallet,\n calls: [\n {\n contractAddress,\n entrypoint: \"approve\",\n calldata: [spender, formatAmount(amount, decimals), \"0x0\"],\n },\n ],\n },\n bearerToken: this.resolveBearerToken(bearerToken),\n });\n }\n\n /**\n * Call any contract method\n */\n async callAnyContract({\n params,\n bearerToken,\n }: {\n params: CallAnyContractParams;\n bearerToken?: string;\n }): Promise<string> {\n const { encryptKey, wallet, calls } = params;\n return this.executeTransaction({\n params: {\n encryptKey,\n wallet,\n calls,\n },\n bearerToken: this.resolveBearerToken(bearerToken),\n });\n }\n\n /**\n * Create a new wallet\n */\n async createWallet({\n params,\n bearerToken,\n }: {\n params: CreateWalletParams;\n bearerToken?: string;\n }): Promise<CreateWalletResponse> {\n return this.wallets.createWallet({\n ...params,\n bearerToken: this.resolveBearerToken(bearerToken),\n });\n }\n\n async recordSendTransaction({\n params,\n bearerToken,\n }: {\n params: RecordSendTransactionParams;\n bearerToken?: string;\n }): Promise<Transaction> {\n return this.transactions.recordSendTransaction({\n params,\n bearerToken: this.resolveBearerToken(bearerToken),\n });\n }\n\n async getTransactionList(\n query: GetTransactionListQuery,\n bearerToken?: string\n ): Promise<PaginatedResponse<Transaction>> {\n return this.transactions.getTransactionList(query, this.resolveBearerToken(bearerToken));\n }\n\n async getWallet(params: GetWalletParams, bearerToken?: string) {\n return this.wallets.getWallet(params, this.resolveBearerToken(bearerToken));\n }\n\n async getTokenBalance(\n params: GetTokenBalanceParams,\n bearerToken?: string\n ): Promise<GetTokenBalanceResponse> {\n return this.wallets.getTokenBalance({\n params,\n bearerToken: this.resolveBearerToken(bearerToken),\n });\n }\n\n /**\n * Purchase a SKU\n */\n async purchaseSku({\n params,\n bearerToken,\n }: {\n params: CreateSkuPurchaseParams;\n bearerToken?: string;\n }): Promise<Transaction> {\n return this.skuPurchases.purchaseSku(params, this.resolveBearerToken(bearerToken));\n }\n\n /**\n * Get a SKU purchase by id\n */\n async getSkuPurchase(id: string, bearerToken?: string): Promise<Transaction> {\n return this.skuPurchases.getSkuPurchase(id, this.resolveBearerToken(bearerToken));\n }\n\n /// SKUS\n async getSkuList(params: GetSkuListQuery, bearerToken?: string): Promise<PaginatedResponse<Sku>> {\n return this.skus.getSkuList(params, this.resolveBearerToken(bearerToken));\n }\n\n async getSku(id: string, bearerToken?: string): Promise<Sku> {\n return this.skus.getSku(id, this.resolveBearerToken(bearerToken));\n }\n\n /**\n * Get a single transaction by hash or internal ID\n */\n async getTransaction(hashOrId: string, bearerToken?: string): Promise<Transaction> {\n return this.transactions.getTransaction(hashOrId, this.resolveBearerToken(bearerToken));\n }\n\n /**\n * Get on-chain transaction status (supports polling for confirmation)\n */\n async getTransactionStatus(\n hash: string,\n bearerToken?: string\n ): Promise<TransactionStatusResponse> {\n return this.transactions.getTransactionStatus(hash, this.resolveBearerToken(bearerToken));\n }\n\n /**\n * Prepare a wallet upgrade (e.g., READY → CHIPI or CHIPI v29 → v33).\n * Returns typed data that must be signed by the wallet owner.\n * Server-only: requires API secret key.\n */\n async prepareWalletUpgrade(\n params: PrepareWalletUpgradeParams,\n bearerToken?: string\n ): Promise<PrepareWalletUpgradeResponse> {\n return this.wallets.prepareWalletUpgrade(params, this.resolveBearerToken(bearerToken));\n }\n\n /**\n * Execute a wallet upgrade after signing.\n * Server-only: requires API secret key.\n */\n async executeWalletUpgrade(\n params: ExecuteWalletUpgradeParams,\n bearerToken?: string\n ): Promise<ExecuteWalletUpgradeResponse> {\n return this.wallets.executeWalletUpgrade(params, this.resolveBearerToken(bearerToken));\n }\n\n async getUsdAmount(\n currencyAmount: number,\n currency: Currency,\n bearerToken?: string\n ): Promise<number> {\n return this.exchanges.getUsdAmount(\n currencyAmount,\n currency,\n this.resolveBearerToken(bearerToken)\n );\n }\n}\n","import type { ChipiServerSDKConfig } from \"@chipi-stack/types\";\nimport { ChipiSDK } from \"./chipi-sdk\";\n\n/**\n * Server-side Chipi SDK with built-in API Secret Key authentication\n *\n * This class is designed for server-side environments where you can safely store\n * the API Secret Key. All methods automatically use the secret key for authentication,\n * so you don't need to pass a bearer token with each call.\n *\n * The apiSecretKey is stored internally and used automatically for all authenticated requests.\n * All methods from ChipiSDK are inherited and work without requiring a bearerToken parameter.\n *\n * @example\n * ```typescript\n * const chipiServer = new ChipiServerSDK({\n * apiPublicKey: \"pk_...\",\n * apiSecretKey: \"sk_...\",\n * environment: \"production\"\n * });\n *\n * // No bearer token needed - automatically uses apiSecretKey!\n * const wallet = await chipiServer.createWallet({\n * params: {\n * encryptKey: \"user-encryption-key\",\n * externalUserId: \"user-123\"\n * }\n * });\n *\n * const userWallet = await chipiServer.getWallet({ externalUserId: \"user-123\" });\n * const txHash = await chipiServer.transfer({ params: { ... } });\n * ```\n */\nexport class ChipiServerSDK extends ChipiSDK {\n constructor(config: ChipiServerSDKConfig) {\n if (!config.apiSecretKey) {\n throw new Error(\n \"apiSecretKey is required for ChipiServerSDK. Use ChipiBrowserSDK for client-side applications.\"\n );\n }\n\n super(config);\n }\n\n // All methods are inherited from ChipiSDK\n // The apiSecretKey from config is automatically used via resolveBearerToken()\n}\n","import type { ChipiBrowserSDKConfig } from \"@chipi-stack/types\";\nimport { ChipiSDK } from \"./chipi-sdk\";\n\n/**\n * Browser-side Chipi SDK for client-side applications\n *\n * This class is designed for browser environments (Vue, Svelte, Angular, vanilla JS, etc.)\n * where you need to pass a bearer token (JWT) with each authenticated request.\n *\n * All methods require a bearerToken parameter since browser environments should not\n * store API Secret Keys.\n *\n * ⚠️ SECURITY WARNING: DO NOT use your API Secret Key in browser environments!\n * The secret key should only be used server-side with ChipiServerSDK.\n *\n * @example\n * ```typescript\n * const chipiBrowser = new ChipiBrowserSDK({\n * apiPublicKey: \"pk_...\",\n * environment: \"production\"\n * });\n *\n * // Get user's JWT token from your auth system\n * const userToken = await getUserJWT();\n *\n * // Pass bearer token with each call\n * const wallet = await chipiBrowser.createWallet({\n * params: {\n * encryptKey: \"user-encryption-key\",\n * externalUserId: \"user-123\"\n * },\n * bearerToken: userToken\n * });\n *\n * const userWallet = await chipiBrowser.getWallet({ externalUserId: \"user-123\" }, userToken);\n * const txHash = await chipiBrowser.transfer({ params: {...}, bearerToken: userToken });\n * ```\n */\nexport class ChipiBrowserSDK extends ChipiSDK {\n constructor(config: ChipiBrowserSDKConfig) {\n super(config);\n }\n\n // All methods are inherited from ChipiSDK\n // bearerToken parameter is required for each authenticated request\n}\n","// Main Chipi SDK class\nexport { ChipiSDK } from \"./chipi-sdk\";\n\nexport { ChipiServerSDK } from \"./chipi-server-sdk\";\nexport { ChipiBrowserSDK } from \"./chipi-browser-sdk\";\n\n// Paymaster adapter\nexport { ChipiPaymasterAdapter } from \"./paymaster-adapter\";\n\n// Wallet utilities\nexport * from \"./wallets\";\n\n// Transaction utilities\nexport * from \"./transactions\";\n\n// CHIPI → SHHH migration orchestrator (Phase 1 client for the\n// chipi-back endpoints shipped in task #28).\nexport {\n migrateChipiWalletToShhh,\n type MigrateChipiWalletToShhhParams,\n type MigrationOutcome,\n type PrepareMigrateResponse,\n type ExecuteMigrateResponse,\n} from \"./migrate-to-shhh\";\n\n// Sign typed data (local signing, no API calls)\nexport { signTypedData, signTypedDataArray } from \"./sign-typed-data\";\n\n// Session utilities (CHIPI and SHHH wallets)\nexport * from \"./sessions\";\n// Pure builders for owner-signed session management calls (batch a session and\n// its spending policies into one transaction, or sign with your own signer).\nexport {\n buildAddSessionKeyCall,\n buildRevokeSessionKeyCall,\n buildSetSpendingPolicyCall,\n buildRemoveSpendingPolicyCall,\n buildSessionSetupCalls,\n validateSpendingPolicyConfig,\n} from \"./session-calls\";\nexport { normalizeEntrypoints } from \"./session-codec\";\n\n// SKU purchase utilities\nexport * from \"./sku-purchases\";\n\n// SKU utilities\nexport * from \"./skus\";\n\n// SHHH multisig treasury coordination (Plus Wave 9 / P1): the transport client\n// that backs `sdk.treasury` and chipi-react's MultisigTransport contract.\nexport * from \"./treasury\";\n\n// AI API client behind `sdk.ai` (server-only, `sk_`), plus the decision guard.\nexport { ChipiAi, isThinkDecision } from \"./ai\";\n\n// Receipt polling for the hashes every gasless write returns. A revert is a\n// result (`success: false`), not an exception; only \"we don't know yet\"\n// (timeout, transport) throws.\nexport * from \"./wait-for-transaction\";\n\n// Client utilities\nexport * from \"./client\";\n\n// Encryption utilities\nexport * from \"./encryption\";\n\n// x402 Payment Protocol\nexport { X402Facilitator, type X402FacilitatorCreateOptions } from \"./x402/facilitator\";\nexport { X402ShhhClient, type ShhhX402Wallet, type X402ShhhClientConfig } from \"./x402/shhh-client\";\nexport {\n x402Middleware,\n type X402MiddlewareConfig,\n type X402MiddlewareFlatConfig,\n} from \"./x402/middleware\";\n// Opt-in on-chain proof of a payment the payer sent themselves (Transfer event\n// + single use per tx hash). Independent of X402Facilitator.\nexport {\n SessionTxVerifier,\n type SessionTxVerifierConfig,\n type TxHashStore,\n type VerifyTransferParams,\n type VerifyTransferResult,\n type VerifyTransferFailure,\n} from \"./x402/session-tx-verifier\";\n\n// Sign in with Starknet (SNIP-12 login) and account signature checks,\n// including counterfactual (not yet deployed) OpenZeppelin and Argent accounts.\nexport {\n createStarknetSignInTypedData,\n verifyStarknetSignIn,\n SIWS_CHAIN_ID,\n SIWS_DOMAIN_NAME,\n SIWS_DOMAIN_VERSION,\n type StarknetSignInParams,\n type StarknetSignInMessage,\n type VerifyStarknetSignInParams,\n type VerifyStarknetSignInResult,\n type StarknetSignInFailure,\n} from \"./siws\";\nexport {\n isValidStarknetSignature,\n verifyUndeployedStarknetSignature,\n normalizeStarknetAddress,\n COUNTERFACTUAL_ACCOUNT_CLASSES,\n STARKNET_SIGNATURE_VALID,\n type StarknetCallProvider,\n type StarknetDeploymentData,\n type StarknetSignatureCheck,\n type UndeployedSignatureCheck,\n} from \"./starknet-signature\";\n\n// SHHH V8.4 ShhhAccount surface (Wave A + Wave B B1 through B4):\n// pluggable-signer Starknet account. STARK, ED25519, EIP-191, WebAuthn,\n// JWT_APPLE_SUB envelopes, plus recovery, threshold, and migration\n// builders. See `./shhh/` for per-kind sources.\nexport * from \"./shhh\";\n\n// Re-export types\nexport type * from \"@chipi-stack/types\";\n\n// Re-export enums and constants (these need to be exported as values, not just types)\nexport { Chain, ChainToken, Currency } from \"@chipi-stack/types\";\n","/**\n * SHHH V8.4 buyer client for the x402 payment protocol.\n *\n * The CHIPI v29 / Argent `X402Client` (in `@chipi-stack/core`) signs\n * a SNIP-12 typed-data message with `account.signMessage()` and lets\n * the facilitator build the on-chain USDC transfer. That path does\n * not work for SHHH V8.4 wallets: V8.4's\n * `execute_from_outside_v2` at `account.cairo:389` rejects raw\n * `{r, s}` (2-felt) signatures and dispatches based on\n * `signature[0]` to either the V2_SNIP12 envelope path (single-owner\n * primary verifier) or the 4-felt session-sig fast path.\n *\n * `X402ShhhClient` builds the full execute_from_outside_v2 calldata\n * + signs the V8.4 SNIP-12 hash locally with the primary STARK key,\n * then ships the pre-signed span in the `payload.shhh.oeCalldata`\n * field. The facilitator (`X402Facilitator.settle`) detects\n * `payload.shhh` and forwards verbatim through\n * `/transactions/execute-sponsored-raw`. Self-custodial:\n * `encryptKey` decrypts the wallet's STARK key client-side; chipi-\n * back never sees the cleartext.\n *\n * Same `fetch(url, init)` surface as `X402Client` so an integrator\n * can pick the right client at construction time based on their\n * wallet type:\n *\n * const client = wallet.walletType === \"SHHH\"\n * ? new X402ShhhClient({ wallet, encryptKey, chipiClient, bearerToken })\n * : new X402Client(account);\n *\n * Wave B ships STARK + ED25519 primary signers; the SDK rejects\n * other kinds with a clear error so a future external-rooted SHHH\n * wallet (MetaMask, Phantom, passkey, Apple) doesn't silently\n * produce a sig that reverts on chain.\n */\n\nimport { uint256 } from \"starknet\";\nimport type { PaymentRequirement, PaymentPayload, X402ClientConfig } from \"@chipi-stack/types\";\n\nimport { ChipiClient } from \"../client\";\nimport { decryptPrivateKey } from \"../encryption\";\nimport { ANY_CALLER_FELT, buildOutsideExecution, computeOeHash } from \"../shhh/oe\";\nimport { buildStarkEnvelope } from \"../shhh/signers/stark\";\nimport {\n resolveShhhChainId,\n serializeExecuteFromOutsideV2Calldata,\n} from \"../shhh/execute-paymaster-raw\";\n\nconst PAYMENT_REQUIRED_HEADER = \"payment-required\";\nconst DEFAULT_PAYMENT_HEADER = \"X-PAYMENT\";\n\ninterface FetchResponse {\n status: number;\n headers: { get(name: string): string | null };\n}\n\ntype FetchFn = (url: string, init?: any) => Promise<FetchResponse>;\n\n/**\n * The minimal wallet shape the SHHH client needs to sign payments.\n * Matches the `WalletData`-derived row callers already pass to the\n * rest of the SDK.\n */\nexport interface ShhhX402Wallet {\n /** Deployed account address (NOT the raw STARK pubkey). */\n publicKey: string;\n /** Wallet's PIN/passkey-encrypted STARK private key (ciphertext). */\n encryptedPrivateKey: string;\n /**\n * Defaults to `\"STARK\"`. Future external-rooted kinds will need\n * their own signing path; the client throws when handed an\n * unsupported kind so silent on-chain reverts are impossible.\n */\n signerKind?: \"STARK\" | \"ED25519\";\n}\n\nexport interface X402ShhhClientConfig extends X402ClientConfig {\n /**\n * Override the chain id used for SHHH SNIP-12 hashing. Defaults to\n * Starknet mainnet per CLAUDE.md; sepolia is auto-inferred from\n * the chipi-back base URL when present. Drift here = the on-chain\n * V8.4 wallet rejects the signature.\n */\n chainId?: bigint | string;\n}\n\n/**\n * SHHH-aware buyer client.\n */\nexport class X402ShhhClient {\n private readonly wallet: ShhhX402Wallet;\n private readonly encryptKey: string;\n private readonly chipiClient: ChipiClient;\n private readonly bearerToken: string;\n private readonly config: Required<Pick<X402ClientConfig, \"headerName\">> & X402ShhhClientConfig;\n private readonly fetchFn: FetchFn;\n\n constructor(opts: {\n /** The SHHH wallet making the payment. */\n wallet: ShhhX402Wallet;\n /** PIN / passkey-derived encryption key for the wallet's STARK key. */\n encryptKey: string;\n /** Chipi HTTP client; only used by the facilitator side. The client side\n * keeps it for forward-compat if a future verifier flow needs to\n * query chipi-back's chain-id helper at sign-time. */\n chipiClient: ChipiClient;\n /** Bearer token for chipi-back. Server-side only; never crosses the wire\n * to an x402 seller. */\n bearerToken: string;\n config?: X402ShhhClientConfig;\n }) {\n this.wallet = opts.wallet;\n this.encryptKey = opts.encryptKey;\n this.chipiClient = opts.chipiClient;\n this.bearerToken = opts.bearerToken;\n this.config = {\n headerName: DEFAULT_PAYMENT_HEADER,\n ...opts.config,\n };\n this.fetchFn = (globalThis as any).fetch;\n }\n\n /**\n * Drop-in `fetch` replacement. If the seller returns 402, signs a\n * payment + retries with the X-PAYMENT header. Same surface as\n * `X402Client.fetch`.\n */\n async fetch(url: string, init?: Record<string, any>): Promise<FetchResponse> {\n const response = await this.fetchFn(url, init);\n if (response.status !== 402) {\n return response;\n }\n\n const requirement = this.parsePaymentRequired(response);\n this.validateRequirement(requirement);\n const payment = await this.signPayment(requirement);\n return this.retryWithPayment(url, init, payment);\n }\n\n parsePaymentRequired(response: FetchResponse): PaymentRequirement {\n const headerValue = response.headers.get(PAYMENT_REQUIRED_HEADER);\n if (!headerValue) {\n throw new Error(\n \"Server returned 402 but no PAYMENT-REQUIRED header. The server may not support x402 or is misconfigured.\"\n );\n }\n let requirement: PaymentRequirement;\n try {\n requirement = JSON.parse(headerValue);\n } catch {\n throw new Error(\n `Malformed PAYMENT-REQUIRED header: invalid JSON. Got: \"${headerValue.slice(0, 100)}\"`\n );\n }\n if (!requirement.scheme || !requirement.network || !requirement.maxAmountRequired) {\n throw new Error(\n \"Invalid payment requirement: missing required fields (scheme, network, maxAmountRequired)\"\n );\n }\n if (requirement.scheme !== \"exact\") {\n throw new Error(\n `Unsupported payment scheme: \"${requirement.scheme}\". This client only supports \"exact\".`\n );\n }\n if (requirement.network !== \"starknet-mainnet\") {\n throw new Error(\n `Unsupported payment network: \"${requirement.network}\". This client only supports \"starknet-mainnet\" per CLAUDE.md.`\n );\n }\n return requirement;\n }\n\n private validateRequirement(req: PaymentRequirement): void {\n if (\n this.config.allowedRecipients &&\n this.config.allowedRecipients.length > 0 &&\n !this.config.allowedRecipients.includes(req.payTo)\n ) {\n throw new Error(\n `Payment recipient ${req.payTo} not in allowed list. Update X402ShhhClientConfig.allowedRecipients to permit this seller.`\n );\n }\n if (this.config.maxPaymentAmount) {\n const maxBaseUnits = humanUsdcToBaseUnits(this.config.maxPaymentAmount, 6);\n if (BigInt(req.maxAmountRequired) > maxBaseUnits) {\n throw new Error(\n `Payment amount ${req.maxAmountRequired} exceeds client max ${this.config.maxPaymentAmount} USDC.`\n );\n }\n }\n }\n\n /**\n * Sign an x402 payment as a SHHH V8.4 buyer. Builds the V8.4 OE\n * containing the single USDC.transfer call, computes the SNIP-12\n * hash against the wallet address + chain id, signs locally with\n * the decrypted STARK private key, wraps the result in a V2_SNIP12\n * envelope, and serializes the full execute_from_outside_v2\n * calldata. Returns a PaymentPayload with the `shhh` extension\n * populated; the facilitator's settle branch forwards\n * `payload.shhh.oeCalldata` verbatim to\n * `/transactions/execute-sponsored-raw`.\n *\n * The `signature: {r, s}` field is also populated with the inner\n * `(r, s)` pair so the wire format stays valid for receivers that\n * only inspect the legacy field. The facilitator uses the SHHH\n * branch when `payload.shhh` is present, so the redundant `{r, s}`\n * is informational, not load-bearing.\n */\n async signPayment(requirement: PaymentRequirement): Promise<PaymentPayload> {\n const signerKind = this.wallet.signerKind ?? \"STARK\";\n if (signerKind !== \"STARK\") {\n throw new Error(\n `X402ShhhClient currently supports signerKind=\"STARK\" only; got \"${signerKind}\". ` +\n `ED25519 + external-rooted (MetaMask, Phantom, passkey, Apple) x402 buyers ` +\n `ship in a follow-on PR.`\n );\n }\n\n const nonce = generateNonce();\n const validUntil = Math.floor(Date.now() / 1000) + requirement.maxTimeoutSeconds;\n\n // Build the USDC.transfer(toAddress, amount) call.\n const amountU256 = uint256.bnToUint256(BigInt(requirement.maxAmountRequired));\n const transferCall = {\n contractAddress: requirement.asset,\n entrypoint: \"transfer\",\n calldata: [requirement.payTo, amountU256.low.toString(), amountU256.high.toString()],\n };\n\n // V8.4 OE. Caller is ANY (paymaster sponsorship). nonce → hex via\n // TextEncoder (UTF-8) instead of Node's Buffer so X402ShhhClient\n // works in browser bundles too (it's re-exported from\n // @chipi-stack/x402 which integrators pull in client-side).\n const oe = buildOutsideExecution({\n nonce: BigInt(\"0x\" + nonceToHexFelt(nonce)),\n calls: [transferCall],\n caller: ANY_CALLER_FELT,\n });\n\n const chainId = resolveShhhChainId({\n override: this.config.chainId,\n baseUrl: this.chipiClient.baseUrl,\n });\n const messageHash = computeOeHash(oe, this.wallet.publicKey, chainId);\n\n // Self-custodial: decrypt the STARK key client-side, sign, throw\n // the cleartext away one async tick later. Cleartext never crosses\n // the wire.\n const privateKeyHex = decryptPrivateKey(this.wallet.encryptedPrivateKey, this.encryptKey);\n if (!privateKeyHex) {\n throw new Error(\n \"Failed to decrypt SHHH STARK private key for x402 payment. Verify the encryptKey matches the wallet creation key.\"\n );\n }\n\n const envelope = buildStarkEnvelope({\n privateKey: privateKeyHex,\n messageHash,\n });\n\n const oeCalldata = serializeExecuteFromOutsideV2Calldata({\n outsideExecution: oe,\n signature: envelope,\n });\n\n // Surface (r, s) on the wire-format compatibility field. The\n // envelope's last two felts are r, s in build order:\n // [V2_SNIP12, owner_id, kind_tag, r, s] for STARK.\n const r = envelope[envelope.length - 2] ?? 0n;\n const s = envelope[envelope.length - 1] ?? 0n;\n\n return {\n x402Version: 1,\n scheme: \"exact\",\n network: \"starknet-mainnet\",\n payload: {\n signature: {\n r: \"0x\" + r.toString(16),\n s: \"0x\" + s.toString(16),\n },\n fromAddress: this.wallet.publicKey,\n toAddress: requirement.payTo,\n amount: requirement.maxAmountRequired,\n asset: requirement.asset,\n validUntil,\n nonce,\n shhh: {\n walletType: \"SHHH\",\n signerKind,\n oeCalldata,\n },\n },\n };\n }\n\n private async retryWithPayment(\n url: string,\n init: Record<string, any> | undefined,\n payment: PaymentPayload\n ): Promise<FetchResponse> {\n // init.headers may be a Record, a Headers instance, or string[][] per\n // the fetch HeadersInit type. A naive object spread silently drops\n // Headers and string[][] entries. Normalize through the runtime\n // Headers API when available so all three input shapes round-trip\n // and the X-PAYMENT header is appended without clobbering callers.\n const HeadersCtor = (globalThis as any).Headers;\n const headerName = this.config.headerName;\n const paymentJson = JSON.stringify(payment);\n\n let headers: any;\n if (typeof HeadersCtor === \"function\") {\n const merged = new HeadersCtor(init?.headers);\n merged.set(headerName, paymentJson);\n headers = merged;\n } else {\n // Node fallback (Headers always exists on 18+ but stay defensive)\n const existing: Record<string, string> = (init?.headers as any) ?? {};\n headers = { ...existing, [headerName]: paymentJson };\n }\n return this.fetchFn(url, { ...init, headers });\n }\n}\n\nfunction humanUsdcToBaseUnits(amount: string, decimals: number): bigint {\n const [whole, frac = \"\"] = amount.trim().split(\".\");\n const fracPadded = (frac + \"0\".repeat(decimals)).slice(0, decimals);\n return BigInt((whole || \"0\") + fracPadded);\n}\n\nfunction generateNonce(): string {\n if (typeof (globalThis as any).crypto?.randomUUID === \"function\") {\n return (globalThis as any).crypto.randomUUID();\n }\n return `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;\n}\n\n/**\n * Convert a string nonce into a felt-safe hex prefix.\n *\n * Equivalent to `Buffer.from(s).toString(\"hex\").slice(0, 60).padStart(60, \"0\")`\n * but uses TextEncoder so the function works in both Node and browsers\n * (Buffer is a Node-only global; X402ShhhClient is re-exported from\n * @chipi-stack/x402 and may land in browser bundles).\n *\n * The 60-hex-char slice keeps the resulting BigInt comfortably below\n * 2^248 — well inside the felt252 field. Matches the construction the\n * V8.4 reference scripts use in shhh-wallet-cairo.\n */\nfunction nonceToHexFelt(nonce: string): string {\n const bytes = new TextEncoder().encode(nonce);\n let hex = \"\";\n for (const b of bytes) {\n hex += b.toString(16).padStart(2, \"0\");\n }\n return hex.slice(0, 60).padStart(60, \"0\");\n}\n","import type { PaymentRequirement, X402PaymentConfig } from \"@chipi-stack/types\";\nimport { CONTRACT_ADDRESSES, TOKEN_DECIMALS } from \"@chipi-stack/shared\";\nimport type { X402Facilitator } from \"./facilitator\";\n\nexport interface X402MiddlewareConfig {\n /** x402 facilitator instance for verify + settle */\n facilitator: X402Facilitator;\n /** Payment configuration for this endpoint */\n paymentConfig: X402PaymentConfig;\n /** Verify-only mode: verify payment but don't settle (default: false) */\n verifyOnly?: boolean;\n}\n\n/**\n * Flat convenience config — detected when `amount` + `recipient` are present.\n * Avoids nesting paymentConfig.\n */\nexport interface X402MiddlewareFlatConfig {\n /** x402 facilitator instance */\n facilitator: X402Facilitator;\n /** Amount in human-readable USDC (e.g. \"0.01\") */\n amount: string;\n /** Recipient (merchant) address */\n recipient: string;\n /** Human-readable description */\n description?: string;\n /** Verify-only mode (default: false) */\n verifyOnly?: boolean;\n}\n\n/**\n * Convert human-readable USDC amount to base units using string arithmetic (no float).\n */\nfunction amountToBaseUnits(amount: string, decimals: number): string {\n const [whole, frac = \"\"] = amount.split(\".\");\n const fracPadded = (frac + \"0\".repeat(decimals)).slice(0, decimals);\n return String(BigInt(whole + fracPadded));\n}\n\n/**\n * Build a PaymentRequirement from middleware config + request URL.\n */\nfunction buildPaymentRequirement(config: X402PaymentConfig, resource: string): PaymentRequirement {\n const amountBaseUnits = amountToBaseUnits(config.amount, TOKEN_DECIMALS.USDC);\n\n return {\n scheme: \"exact\",\n network: \"starknet-mainnet\",\n maxAmountRequired: amountBaseUnits,\n resource,\n description: config.description,\n payTo: config.payTo,\n maxTimeoutSeconds: 300,\n asset: CONTRACT_ADDRESSES.USDC_MAINNET,\n };\n}\n\nfunction isFlatConfig(\n config: X402MiddlewareConfig | X402MiddlewareFlatConfig\n): config is X402MiddlewareFlatConfig {\n return \"amount\" in config && \"recipient\" in config;\n}\n\nfunction resolveConfig(\n config: X402MiddlewareConfig | X402MiddlewareFlatConfig\n): X402MiddlewareConfig {\n if (isFlatConfig(config)) {\n return {\n facilitator: config.facilitator,\n paymentConfig: {\n amount: config.amount,\n payTo: config.recipient,\n description: config.description,\n },\n verifyOnly: config.verifyOnly,\n };\n }\n return config;\n}\n\n/**\n * Express-compatible middleware for monetizing API endpoints with x402.\n *\n * When no X-PAYMENT header is present, returns 402 with payment requirement.\n * When a valid payment is present, verifies and settles it, then calls next().\n * The settled transaction info is attached to `req.x402`.\n *\n * @example\n * ```typescript\n * // Nested config (original)\n * x402Middleware({\n * facilitator,\n * paymentConfig: { amount: \"0.01\", payTo: \"0xYOUR_ADDRESS\" },\n * })\n *\n * // Flat config (convenience)\n * x402Middleware({\n * facilitator,\n * amount: \"0.01\",\n * recipient: \"0xYOUR_ADDRESS\",\n * })\n * ```\n */\nexport function x402Middleware(config: X402MiddlewareConfig | X402MiddlewareFlatConfig) {\n const resolved = resolveConfig(config);\n return async (req: any, res: any, next: any) => {\n // Skip CORS preflight\n if (req.method === \"OPTIONS\") {\n return next();\n }\n\n const paymentHeader = req.headers?.[\"x-payment\"] ?? req.headers?.[\"X-PAYMENT\"];\n\n if (!paymentHeader) {\n // Return 402 with payment requirement\n const resource =\n req.protocol && req.get\n ? `${req.protocol}://${req.get(\"host\")}${req.originalUrl}`\n : (req.url ?? \"\");\n const requirement = buildPaymentRequirement(resolved.paymentConfig, resource);\n\n return res.status(402).set(\"Payment-Required\", JSON.stringify(requirement)).json({\n error: \"Payment Required\",\n paymentRequirement: requirement,\n });\n }\n\n // Parse payment\n let payment;\n try {\n payment = typeof paymentHeader === \"string\" ? JSON.parse(paymentHeader) : paymentHeader;\n } catch {\n return res.status(400).json({ error: \"Malformed X-PAYMENT header: invalid JSON\" });\n }\n\n // Validate payload shape before accessing fields\n const payload = payment?.payload;\n const toAddress = typeof payload?.toAddress === \"string\" ? payload.toAddress : null;\n const amount = typeof payload?.amount === \"string\" ? payload.amount : null;\n const asset = typeof payload?.asset === \"string\" ? payload.asset : null;\n\n if (!toAddress || !amount || !asset) {\n return res\n .status(400)\n .json({ error: \"Malformed X-PAYMENT payload: missing required fields\" });\n }\n\n // Enforce payment matches endpoint config (amount, recipient, asset)\n const requirement = buildPaymentRequirement(resolved.paymentConfig, \"\");\n const normalizeAddr = (a: string) => a.toLowerCase().replace(/^0x0+/, \"0x\");\n\n if (normalizeAddr(toAddress) !== normalizeAddr(resolved.paymentConfig.payTo)) {\n return res.status(402).json({\n error: \"Payment recipient mismatch\",\n reason: `Expected ${resolved.paymentConfig.payTo}, got ${toAddress}`,\n });\n }\n\n let paidAmount: bigint;\n try {\n paidAmount = BigInt(amount);\n } catch {\n return res\n .status(400)\n .json({ error: \"Malformed X-PAYMENT payload\", reason: \"amount must be an integer string\" });\n }\n\n if (paidAmount < BigInt(requirement.maxAmountRequired)) {\n return res.status(402).json({\n error: \"Payment amount insufficient\",\n reason: `Required ${requirement.maxAmountRequired} base units, got ${amount}`,\n });\n }\n\n if (normalizeAddr(asset) !== normalizeAddr(requirement.asset)) {\n return res.status(402).json({\n error: \"Payment asset mismatch\",\n reason: `Expected USDC, got ${asset}`,\n });\n }\n\n // Verify + Settle with error boundary\n try {\n const verified = await resolved.facilitator.verify(payment);\n if (!verified.isValid) {\n return res.status(402).json({\n error: \"Payment verification failed\",\n reason: verified.invalidReason,\n });\n }\n\n // Settle (unless verify-only mode)\n if (!resolved.verifyOnly) {\n const settled = await resolved.facilitator.settle(payment);\n if (!settled.success) {\n return res.status(402).json({\n error: \"Payment settlement failed\",\n reason: settled.errorReason,\n });\n }\n\n // Attach payment info to request\n req.x402 = {\n txHash: settled.transactionHash,\n payment,\n networkId: settled.networkId,\n };\n } else {\n req.x402 = { payment };\n }\n } catch (err) {\n const message = err instanceof Error ? err.message : String(err);\n return res.status(500).json({\n error: \"Payment processing error\",\n reason: message,\n });\n }\n\n next();\n };\n}\n","import { shortString, typedData as starknetTypedData, type TypedData } from \"starknet\";\nimport {\n isValidStarknetSignature,\n normalizeStarknetAddress,\n verifyUndeployedStarknetSignature,\n type StarknetCallProvider,\n type StarknetDeploymentData,\n} from \"./starknet-signature\";\n\n/**\n * Sign in with Starknet (SIWS): the SNIP-12 equivalent of Sign-In with\n * Ethereum. The server issues a one-time nonce, the wallet signs this typed\n * data, and the server checks the signature with the account itself.\n *\n * The typed data is kept to what every wallet accepts: SNIP-12 revision 1,\n * mainnet chain id in the domain, single-line printable ASCII strings (Bramble\n * refuses anything else), and no custom `u256`.\n */\n\nexport const SIWS_DOMAIN_NAME = \"Sign in with Starknet\";\nexport const SIWS_DOMAIN_VERSION = \"1\";\nexport const SIWS_CHAIN_ID = \"SN_MAIN\";\n\nexport interface StarknetSignInParams {\n /** Host asking for the sign-in, e.g. \"vela-starknet.vercel.app\". */\n domain: string;\n /** Full URL of the app, e.g. \"https://vela-starknet.vercel.app\". */\n uri: string;\n /** Account that signs. Any padding; stored as 0x + 64 hex. */\n address: string;\n /** One-time server nonce (letters and digits). */\n nonce: string;\n /** Shown to the user in the wallet. */\n statement?: string;\n /** Unix seconds. Defaults to now. */\n issuedAt?: number;\n /** Unix seconds. */\n expirationTime: number;\n}\n\nexport interface StarknetSignInMessage {\n domain: string;\n address: string;\n statement: string;\n uri: string;\n nonce: string;\n issuedAt: number;\n expirationTime: number;\n}\n\nconst DEFAULT_STATEMENT = \"Sign in. This request costs nothing and moves no funds.\";\n\nfunction assertPrintableAscii(field: string, value: string): void {\n if (!/^[\\x20-\\x7e]*$/.test(value)) {\n throw new Error(`SIWS ${field} must be single-line printable ASCII`);\n }\n}\n\n/** Typed data for the wallet's `wallet_signTypedData`. */\nexport function createStarknetSignInTypedData(params: StarknetSignInParams): TypedData {\n const message: StarknetSignInMessage = {\n domain: params.domain,\n address: normalizeStarknetAddress(params.address),\n statement: params.statement ?? DEFAULT_STATEMENT,\n uri: params.uri,\n nonce: params.nonce,\n issuedAt: params.issuedAt ?? Math.floor(Date.now() / 1000),\n expirationTime: params.expirationTime,\n };\n for (const field of [\"domain\", \"statement\", \"uri\", \"nonce\"] as const) {\n assertPrintableAscii(field, message[field]);\n }\n if (!/^[A-Za-z0-9]{8,}$/.test(message.nonce)) {\n throw new Error(\"SIWS nonce must be at least 8 letters or digits\");\n }\n if (!Number.isInteger(message.issuedAt) || !Number.isInteger(message.expirationTime)) {\n throw new Error(\"SIWS times must be whole unix seconds\");\n }\n if (message.expirationTime <= message.issuedAt) {\n throw new Error(\"SIWS expirationTime must be after issuedAt\");\n }\n\n return {\n types: {\n StarknetDomain: [\n { name: \"name\", type: \"shortstring\" },\n { name: \"version\", type: \"shortstring\" },\n { name: \"chainId\", type: \"shortstring\" },\n { name: \"revision\", type: \"shortstring\" },\n ],\n SignIn: [\n { name: \"domain\", type: \"string\" },\n { name: \"address\", type: \"ContractAddress\" },\n { name: \"statement\", type: \"string\" },\n { name: \"uri\", type: \"string\" },\n { name: \"nonce\", type: \"string\" },\n { name: \"issuedAt\", type: \"timestamp\" },\n { name: \"expirationTime\", type: \"timestamp\" },\n ],\n },\n primaryType: \"SignIn\",\n domain: {\n name: SIWS_DOMAIN_NAME,\n version: SIWS_DOMAIN_VERSION,\n chainId: SIWS_CHAIN_ID,\n revision: \"1\",\n },\n message: { ...message },\n };\n}\n\nexport interface VerifyStarknetSignInParams {\n /** The typed data the wallet signed, as returned to the client. */\n typedData: TypedData;\n /** The wallet's `wallet_signTypedData` result (hex or decimal felts). */\n signature: Array<string | number | bigint>;\n /** Mainnet RPC (starknet.js `RpcProvider` or anything with `callContract`). */\n provider: StarknetCallProvider;\n /** What this server issued. Anything else is refused. */\n expected: { domain: string; uri: string; nonce: string; now?: number };\n /**\n * The wallet's `wallet_deploymentData`, for accounts not deployed yet\n * (new Bramble/Ready accounts). Only used when the RPC says the account\n * does not exist.\n */\n deploymentData?: StarknetDeploymentData;\n}\n\nexport type StarknetSignInFailure =\n | \"MALFORMED\"\n | \"WRONG_CHAIN\"\n | \"WRONG_DOMAIN\"\n | \"WRONG_URI\"\n | \"WRONG_NONCE\"\n | \"EXPIRED\"\n | \"NOT_YET_VALID\"\n | \"INVALID_SIGNATURE\"\n | \"ACCOUNT_NOT_DEPLOYED\"\n | \"UNSUPPORTED_ACCOUNT_CLASS\"\n | \"ADDRESS_MISMATCH\";\n\nexport type VerifyStarknetSignInResult =\n | { ok: true; address: string; message: StarknetSignInMessage }\n | { ok: false; reason: StarknetSignInFailure };\n\n/** Clock skew tolerated on `issuedAt`. */\nconst MAX_SKEW_SECONDS = 60;\n\nconst SIWS_CHAIN_ID_FELT = BigInt(shortString.encodeShortString(SIWS_CHAIN_ID));\n\n/**\n * Whether a typed-data domain `chainId` names mainnet. Wallets echo it either\n * as the short string (\"SN_MAIN\") or as its felt (\"0x534e5f4d41494e\", or the\n * same value in decimal); SNIP-12 hashes all three the same way. Anything\n * else, including other short strings, is another chain.\n */\nfunction isMainnetChainId(chainId: unknown): boolean {\n if (chainId === SIWS_CHAIN_ID) return true;\n if (typeof chainId === \"bigint\") return chainId === SIWS_CHAIN_ID_FELT;\n if (typeof chainId !== \"string\" || !/^(0x[0-9a-f]+|[0-9]+)$/i.test(chainId)) return false;\n return BigInt(chainId) === SIWS_CHAIN_ID_FELT;\n}\n\n/**\n * Verifies a SIWS signature. The typed data is rebuilt from its message with\n * `createStarknetSignInTypedData`, so a client can't swap in other types or a\n * testnet domain; then the account is asked with `is_valid_signature`, or, if\n * it isn't deployed yet and `deploymentData` is given, checked off-chain.\n *\n * The caller still owns the nonce: issue it once, and consume it before or\n * right after calling this (never accept the same nonce twice).\n */\nexport async function verifyStarknetSignIn(\n params: VerifyStarknetSignInParams\n): Promise<VerifyStarknetSignInResult> {\n const { typedData, signature, provider, expected, deploymentData } = params;\n const raw = typedData?.message as Partial<StarknetSignInMessage> | undefined;\n if (!raw || !Array.isArray(signature) || signature.length === 0) {\n return { ok: false, reason: \"MALFORMED\" };\n }\n if (!isMainnetChainId(typedData.domain?.chainId)) return { ok: false, reason: \"WRONG_CHAIN\" };\n\n let canonical: TypedData;\n let message: StarknetSignInMessage;\n try {\n canonical = createStarknetSignInTypedData({\n domain: String(raw.domain),\n uri: String(raw.uri),\n address: String(raw.address),\n nonce: String(raw.nonce),\n statement: String(raw.statement),\n issuedAt: Number(raw.issuedAt),\n expirationTime: Number(raw.expirationTime),\n });\n message = canonical.message as unknown as StarknetSignInMessage;\n } catch {\n return { ok: false, reason: \"MALFORMED\" };\n }\n\n if (message.domain !== expected.domain) return { ok: false, reason: \"WRONG_DOMAIN\" };\n if (message.uri !== expected.uri) return { ok: false, reason: \"WRONG_URI\" };\n if (message.nonce !== expected.nonce) return { ok: false, reason: \"WRONG_NONCE\" };\n const now = expected.now ?? Math.floor(Date.now() / 1000);\n if (now >= message.expirationTime) return { ok: false, reason: \"EXPIRED\" };\n if (message.issuedAt > now + MAX_SKEW_SECONDS) return { ok: false, reason: \"NOT_YET_VALID\" };\n\n const messageHash = starknetTypedData.getMessageHash(canonical, message.address);\n const onChain = await isValidStarknetSignature(provider, message.address, messageHash, signature);\n if (onChain.valid) return { ok: true, address: message.address, message };\n if (onChain.reason !== \"ACCOUNT_NOT_DEPLOYED\") return { ok: false, reason: \"INVALID_SIGNATURE\" };\n\n if (!deploymentData) return { ok: false, reason: \"ACCOUNT_NOT_DEPLOYED\" };\n if (normalizeStarknetAddress(deploymentData.address) !== message.address) {\n return { ok: false, reason: \"ADDRESS_MISMATCH\" };\n }\n const offChain = verifyUndeployedStarknetSignature(deploymentData, messageHash, signature);\n return offChain.valid\n ? { ok: true, address: message.address, message }\n : { ok: false, reason: offChain.reason };\n}\n","/**\n * @chipi-stack/backend SHHH V8.4 ShhhAccount integration surface.\n *\n * Wave A PR 1: SNIP-12 hashing, deterministic address derivation, OE\n * construction, and the STARK signer. Cycle 1 kinds (ED25519,\n * EIP191_SECP256K1, WEBAUTHN_P256) ship in follow-up PRs.\n *\n * Class hashes + per-kind gas overhead live in @chipi-stack/shared\n * (WALLET_CLASS_HASHES.SHHH, SHHH_VERIFIER_CLASS_HASHES,\n * SHHH_KIND_GAS_OVERHEAD). The kill switch is enforced by\n * chipi-back's wallets.service.ts (CHIPI_SHHH_ENABLED env var).\n */\n\nexport {\n computeSnip12Hash,\n hashCall,\n hashCalls,\n hashOutsideExecutionStruct,\n hashStarknetDomain,\n snip12HashToHexAsciiBytes,\n ISIGNER_CANONICAL_LABEL,\n ISIGNER_ID,\n ISRC9_V2_ID,\n OE_DOMAIN_NAME,\n OE_DOMAIN_REVISION,\n OE_DOMAIN_VERSION,\n STARKNET_MESSAGE_PREFIX,\n SIG_VERSION_V1_HEX_ASCII,\n SIG_VERSION_V2_SNIP12,\n SIG_VERSION_V2_THRESHOLD,\n computeISignerId,\n type OutsideExecution,\n} from \"./snip12-hash\";\n\nexport {\n computeAddressSalt,\n computeShhhAddress,\n ownerCommitment,\n type ComputeAddressInput,\n} from \"./compute-wallet-address\";\n\nexport {\n buildOutsideExecution,\n computeOeHash,\n wrapV2Snip12Envelope,\n wrapV2ThresholdEnvelope,\n ANY_CALLER_FELT,\n MAX_OE_VALIDITY_WINDOW_SECONDS,\n} from \"./oe\";\n\nexport { buildStarkEnvelope, starkOwnerId, starkPubkeyFelts } from \"./signers/stark\";\n\nexport {\n STARK_SNIP12_KIND_TAG,\n buildStarkSnip12Envelope,\n parseStarknetWalletSignature,\n resolveStarkSnip12Signer,\n starkSnip12ApprovalHash,\n starkSnip12ApprovalTypedData,\n starkSnip12OwnerCommitment,\n starkSnip12PubkeyFelts,\n verifyStarkSnip12Approval,\n type ParsedStarknetWalletSignature,\n} from \"./signers/stark-snip12\";\n\nexport { isShhhVerifierDeclared, type StarknetClassProvider } from \"./verifier-classes\";\n\nexport {\n executeShhhWithExternalSigner,\n executeShhhWithStarkKey,\n prepareExternalOwnerExecution,\n submitExternalOwnerExecution,\n type PreparedExternalOwnerExecution,\n} from \"./execute-external-owner\";\n\nexport {\n buildEd25519Envelope,\n buildEd25519EnvelopeFromSignature,\n ed25519OwnerId,\n ed25519OwnerPubkeyParam,\n ed25519PubkeyFelts,\n ed25519SignedBytes,\n} from \"./signers/ed25519\";\n\nexport {\n buildEip191EnvelopeFromPrivateKey,\n buildEip191EnvelopeFromSignature,\n eip191OwnerId,\n eip191OwnerPubkeyParam,\n eip191PubkeyFelts,\n parseEip191Signature,\n type Eip191Pubkey,\n} from \"./signers/eip191\";\n\nexport {\n buildWebAuthnEnvelopeFromAssertion,\n buildWebAuthnEnvelopeFromPrivateKey,\n byteArrayToFelts,\n parseDerEcdsaSignature,\n webauthnOwnerId,\n webauthnOwnerPubkeyParam,\n webauthnPubkeyFelts,\n type WebAuthnPubkey,\n} from \"./signers/webauthn\";\n\nexport {\n APPLE_ISSUER,\n buildJwtAppleSubEnvelopeFromTestKey,\n buildJwtAppleSubEnvelopeFromTokenResponse,\n jwtAppleSubHash,\n jwtAppleSubOwnerId,\n jwtAppleSubPubkeyFelts,\n locateSubClaim,\n messageHashToNonceB64url,\n parseAppleIdToken,\n type AppleTokenResponse,\n type JwtAppleSubPubkey,\n} from \"./signers/jwt_apple_sub\";\n\nexport {\n // Multi-owner governance builders\n buildProposeAddOwnerCall,\n buildExecuteAddOwnerCall,\n buildProposeRemoveOwnerCall,\n buildExecuteRemoveOwnerCall,\n buildProposeRotateOwnerCall,\n buildExecuteRotateOwnerCall,\n buildProposeSetThresholdCall,\n buildExecuteSetThresholdCall,\n buildCancelPendingOpCall,\n // Verifier classes (new signer kinds on a deployed wallet)\n buildProposeAddVerifierClassCall,\n buildExecuteAddVerifierClassCall,\n // Recovery builders\n buildInitiateRecoveryCall,\n buildCancelRecoveryCall,\n buildFinalizeRecoveryCall,\n // Constants\n OP_ADD_OWNER,\n OP_REMOVE_OWNER,\n OP_ROTATE_OWNER,\n OP_SET_THRESHOLD,\n OP_ADD_VERIFIER_CLASS,\n ROLE_OWNER,\n ROLE_GUARDIAN,\n TIMELOCK_SECONDS,\n DEFAULT_OP_EXPIRY_SECONDS,\n VIEW_SELECTORS,\n // Helpers\n isReadyToExecute,\n secondsUntilExecutable,\n // On-chain reads\n readShhhOwners,\n readVerifierClass,\n readPendingRecovery,\n parseOpProposedEvents,\n type NewOwnerInput,\n type OwnerRole,\n type ShhhOwnerRecord,\n type ShhhPendingRecovery,\n type ShhhProposedOp,\n} from \"./recovery\";\n\nexport {\n MIN_THRESHOLD_OWNERS,\n assertValidV2Snip12Envelope,\n buildThresholdEnvelope,\n estimateThresholdGasOverhead,\n parseThresholdEnvelope,\n} from \"./threshold\";\n\nexport {\n BOOTSTRAP_DOMAIN_SEPARATOR,\n buildBootstrapSignedCall,\n buildMigrationCalls,\n computeBootstrapMessage,\n labelToFelt,\n signBootstrapMessage,\n type BootstrapMessageParams,\n type BuildBootstrapSignedCallParams,\n type BuildMigrationCallsParams,\n} from \"./migrate\";\n\n// Paymaster-sponsored OE execution path. `executeShhhSponsoredRaw` is\n// the one-call orchestrator that integrators reach for when they want\n// to fire an arbitrary call list against an already-deployed SHHH\n// wallet:\n//\n// 1. decrypts the wallet's stored encrypted STARK (or Ed25519)\n// private key using the supplied PIN / passkey-derived secret\n// 2. builds the V8.4 OutsideExecution wrapping the call list\n// 3. signs the SNIP-12 hash with the matching signer envelope\n// 4. serializes the calldata for `execute_from_outside_v2`\n// 5. POSTs to chipi-back's `/transactions/execute-sponsored-raw`\n// and returns the on-chain transaction hash\n//\n// The two lower-level helpers are surfaced for advanced flows:\n// - `serializeExecuteFromOutsideV2Calldata` — Cairo serde of an\n// OE + signature span into the felt-array calldata expected by\n// the V8.4 `execute_from_outside_v2` selector. Use when you need\n// to build the calldata yourself (e.g. external signing path).\n// - `resolveShhhChainId` — chain-id resolver for SNIP-12 hashing.\n// Defaults to Starknet mainnet (`SN_MAIN`); auto-infers\n// `SN_SEPOLIA` from a sepolia chipi-back base URL when present;\n// pass an explicit override to force a value.\nexport {\n executeShhhSponsoredRaw,\n serializeExecuteFromOutsideV2Calldata,\n resolveShhhChainId,\n} from \"./execute-paymaster-raw\";\n\n// ShhhAccount — drop-in adapter that signs as a SHHH owner from a raw\n// STARK private key and broadcasts via `execute_from_outside_v2` (the\n// standard starknet.js `Account.execute` path is disabled on a SHHH\n// account). Pairs with the wallet's \"export private key\" flow.\nexport {\n ShhhAccount,\n submitViaAccount,\n type ShhhSubmit,\n type ShhhAccountOptions,\n type ShhhSignedExecution,\n type ShhhExecuteOptions,\n} from \"./account\";\n","/**\n * Whether a SHHH verifier class is declared on the network. A wallet can\n * register a kind whose class is not declared (`propose_add_verifier_class`\n * stores only the hash), and every signature of that kind would then fail.\n * Check before proposing a kind that is new on the network, such as\n * `STARK_SNIP12` before its mainnet declare.\n */\n\nimport { SHHH_VERIFIER_CLASS_HASHES } from \"@chipi-stack/shared\";\nimport type { ShhhSignerKind } from \"@chipi-stack/types\";\n\n/** Anything with a starknet.js-style `getClassByHash` (e.g. `RpcProvider`). */\nexport interface StarknetClassProvider {\n getClassByHash(classHash: string): Promise<unknown>;\n}\n\nfunction isClassHashNotFound(err: unknown): boolean {\n const e = err as { baseError?: { code?: number }; code?: number; message?: string };\n if (e?.baseError?.code === 28 || e?.code === 28) return true;\n return /class hash not found/i.test(e?.message ?? String(err));\n}\n\n/**\n * `true` when the verifier class for `kind` (or `classHash`) is declared,\n * `false` when the RPC answers CLASS_HASH_NOT_FOUND (28). Other RPC errors\n * are thrown: an outage is not \"not declared\".\n */\nexport async function isShhhVerifierDeclared(\n provider: StarknetClassProvider,\n kind: ShhhSignerKind,\n classHash: string = SHHH_VERIFIER_CLASS_HASHES[kind]\n): Promise<boolean> {\n try {\n await provider.getClassByHash(classHash);\n return true;\n } catch (err) {\n if (isClassHashNotFound(err)) return false;\n throw err;\n }\n}\n","/**\n * EIP-191 secp256k1 signer for SHHH V8.4 ShhhAccount.\n *\n * The signer kind for MetaMask + any EVM wallet that exposes the\n * `personal_sign` RPC. The wallet computes\n * keccak256(\"\\x19Ethereum Signed Message:\\n32\" || msg_be32)\n * internally and signs with secp256k1; the V8.4 EIP191Secp256k1Verifier\n * (class `0x03a75997…084e6`) reproduces the same prefix-and-hash and\n * recovers the signing key from (r, s, y_parity) to compare to the\n * stored pubkey.\n *\n * Reference: shhh-wallet-cairo/scripts/ts/gen-eip191-fixture.mjs\n *\n * Verifier overhead: ~10M l2_gas (per SHHH_KIND_GAS_OVERHEAD).\n *\n * Two builder entry points:\n * - buildEip191EnvelopeFromSignature: production / MetaMask flow.\n * Caller already has the 65-byte signature back from `personal_sign`\n * and the wallet's pubkey (either pre-known or recovered).\n * - buildEip191EnvelopeFromPrivateKey: test / Chipi-held-key flow.\n * Sign locally with a known secp256k1 private key.\n *\n * Both produce the identical V2_SNIP12 envelope shape:\n * [V2_SNIP12, owner_id, EIP191_SECP256K1_tag,\n * r.low, r.high, s.low, s.high, y_parity]\n */\n\nimport { shortString } from \"starknet\";\nimport { ownerCommitment } from \"../compute-wallet-address\";\nimport { wrapV2Snip12Envelope } from \"../oe\";\n\nconst EIP191_KIND_TAG = \"EIP191_SECP256K1\";\nconst EIP191_KIND_TAG_FELT = BigInt(shortString.encodeShortString(EIP191_KIND_TAG));\n\nconst SECP256K1_ORDER = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n;\n\n/**\n * Uncompressed secp256k1 public key, split into 4 felt252-sized halves\n * matching what Cairo's EIP191 verifier expects in\n * `validate_pubkey` — `[x.low, x.high, y.low, y.high]` (big-endian\n * scalar, low_u128 first).\n */\nexport interface Eip191Pubkey {\n /** 32-byte big-endian X coordinate. */\n x: Uint8Array;\n /** 32-byte big-endian Y coordinate. */\n y: Uint8Array;\n}\n\nfunction assertBytes(name: string, b: Uint8Array, len: number): void {\n if (b.length !== len) {\n throw new Error(`${name} must be exactly ${len} bytes; got ${b.length}.`);\n }\n}\n\nfunction bytesBeToU256(b: Uint8Array): { low: bigint; high: bigint } {\n assertBytes(\"secp256k1 32B value\", b, 32);\n let x = 0n;\n for (let i = 0; i < b.length; i++) x = (x << 8n) | BigInt(b[i]);\n return { low: x & ((1n << 128n) - 1n), high: x >> 128n };\n}\n\n/**\n * Pubkey felt layout for the V8.4 constructor / propose_add_owner.\n * Returns `[x.low, x.high, y.low, y.high]` (each u128).\n */\nexport function eip191PubkeyFelts(pubkey: Eip191Pubkey): bigint[] {\n const x = bytesBeToU256(pubkey.x);\n const y = bytesBeToU256(pubkey.y);\n return [x.low, x.high, y.low, y.high];\n}\n\n/**\n * Compute the V8.4 owner_id for an EIP-191 owner.\n * owner_id = owner_commitment(EIP191_tag, [x.low, x.high, y.low, y.high]).\n */\nexport function eip191OwnerId(pubkey: Eip191Pubkey): bigint {\n return ownerCommitment(EIP191_KIND_TAG_FELT, eip191PubkeyFelts(pubkey));\n}\n\n/**\n * The `ownerPubkey` string for the treasury coordination endpoints\n * (`sdk.treasury.forTreasury({ ownerPubkey })`): `\"0x<x>,0x<y>\"` — the\n * FULL 32-byte BE coordinates of the uncompressed secp256k1 point, NOT\n * the 4 `eip191PubkeyFelts` halves. chipi-back's OwnerSignatureVerifier\n * splits the coordinates into commitment felts itself; sending the\n * 4-felt form fails its DTO validation (max 2 comma-joined values).\n */\nexport function eip191OwnerPubkeyParam(pubkey: Eip191Pubkey): string {\n assertBytes(\"secp256k1 x coordinate\", pubkey.x, 32);\n assertBytes(\"secp256k1 y coordinate\", pubkey.y, 32);\n const toHex = (b: Uint8Array) =>\n \"0x\" + Array.from(b, (v) => v.toString(16).padStart(2, \"0\")).join(\"\");\n return `${toHex(pubkey.x)},${toHex(pubkey.y)}`;\n}\n\n/**\n * Parse a 65-byte `personal_sign`/`eth_sign` signature hex string into\n * the Cairo-shaped envelope payload `[r.low, r.high, s.low, s.high, y_parity]`.\n *\n * Accepts both `v ∈ {27, 28}` (EIP-191 wallet convention) and\n * `y_parity ∈ {0, 1}` raw forms.\n */\nexport function parseEip191Signature(signatureHex: string): bigint[] {\n const hex = signatureHex.startsWith(\"0x\") ? signatureHex.slice(2) : signatureHex;\n if (hex.length !== 130) {\n throw new Error(`EIP-191 signature must be 65 bytes (130 hex chars); got ${hex.length}.`);\n }\n // Validate hex BEFORE parseInt — parseInt returns NaN for non-hex which\n // Uint8Array would silently coerce to 0, masking a malformed signature.\n if (!/^[0-9a-fA-F]+$/.test(hex)) {\n throw new Error(\"EIP-191 signature contains non-hex characters.\");\n }\n const bytes = new Uint8Array(65);\n for (let i = 0; i < 65; i++) {\n bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n }\n const r = bytesBeToU256(bytes.slice(0, 32));\n const s = bytesBeToU256(bytes.slice(32, 64));\n const v = bytes[64];\n // v ∈ {27, 28} → y_parity ∈ {0, 1}; raw {0, 1} passes through.\n let yParity: bigint;\n if (v === 27) yParity = 0n;\n else if (v === 28) yParity = 1n;\n else if (v === 0) yParity = 0n;\n else if (v === 1) yParity = 1n;\n else throw new Error(`Unexpected v byte ${v} in EIP-191 signature; expected 27, 28, 0, or 1.`);\n\n if (s.low === 0n && s.high === 0n) {\n throw new Error(\"EIP-191 signature s component is zero\");\n }\n return [r.low, r.high, s.low, s.high, yParity];\n}\n\n/**\n * Production / MetaMask flow. Caller already has the 65-byte signature\n * from `personal_sign` (e.g., `await provider.send(\"personal_sign\", [...])`)\n * and the wallet's public key.\n */\nexport function buildEip191EnvelopeFromSignature(params: {\n /** 65-byte `personal_sign` signature, 0x-prefixed hex. */\n signatureHex: string;\n /** Uncompressed secp256k1 pubkey (x, y) as 32 BE bytes each. */\n pubkey: Eip191Pubkey;\n /**\n * Owner index in the wallet's owner_set. **Defaults to 0n (primary).**\n * MUST fit in u32. Passing `eip191OwnerId(pubkey)` (the commitment)\n * here will revert on chain with `'SHHH: bad owner_id'`.\n */\n ownerIndex?: bigint;\n}): bigint[] {\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n throw new Error(\n `buildEip191EnvelopeFromSignature: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32).`\n );\n }\n const payload = parseEip191Signature(params.signatureHex);\n return wrapV2Snip12Envelope({\n ownerId: ownerIndex,\n kindTag: EIP191_KIND_TAG,\n payload,\n });\n}\n\n/**\n * Test / Chipi-held-key flow. Sign locally with a known secp256k1\n * private key using the exact `personal_sign` recipe MetaMask uses\n * (keccak256(\"\\x19Ethereum Signed Message:\\n32\" || msg_be32),\n * secp256k1 sign of that hash).\n *\n * Async because @noble/secp256k1 v3 ships ESM and we dynamic-import.\n */\nexport async function buildEip191EnvelopeFromPrivateKey(params: {\n /** 32-byte secp256k1 private key (Uint8Array OR 0x-prefixed hex). */\n privateKey: Uint8Array | string;\n /** SNIP-12 hash of the OutsideExecution — see oe.ts::computeOeHash. */\n messageHash: bigint;\n /**\n * Owner index in the wallet's owner_set. **Defaults to 0n (primary).**\n * MUST fit in u32. Same semantics as `buildEip191EnvelopeFromSignature`.\n */\n ownerIndex?: bigint;\n}): Promise<bigint[]> {\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n throw new Error(\n `buildEip191EnvelopeFromPrivateKey: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32).`\n );\n }\n const privBytes = normalizePrivateKey(params.privateKey);\n\n const [secp, keccak] = await Promise.all([\n import(\"@noble/secp256k1\"),\n // @noble/hashes@2.x ESM exports use the .js suffix per their package.json\n // exports map.\n import(\"@noble/hashes/sha3.js\"),\n ]);\n\n // ethSignedMessageHash = keccak256(\"\\x19Ethereum Signed Message:\\n32\" || msg_be32)\n const msgBe32 = bigintToBe32(params.messageHash);\n const prefix = new TextEncoder().encode(\"\\x19Ethereum Signed Message:\\n32\");\n const prefixedMsg = new Uint8Array(prefix.length + 32);\n prefixedMsg.set(prefix, 0);\n prefixedMsg.set(msgBe32, prefix.length);\n const ethSignedHash = keccak.keccak_256(prefixedMsg);\n\n // secp256k1.sign returns a Signature with .r, .s, .recovery (0|1).\n // Cast through `any` to tolerate version drift in the @noble surface.\n const sig: any = await (secp as any).signAsync(ethSignedHash, privBytes, {\n lowS: true,\n });\n\n let r: bigint = typeof sig.r === \"bigint\" ? sig.r : BigInt(sig.r);\n let s: bigint = typeof sig.s === \"bigint\" ? sig.s : BigInt(sig.s);\n let recovery: number =\n typeof sig.recovery === \"number\" ? sig.recovery : Number(sig.recovery ?? 0);\n // lowS canonicalization to match what MetaMask / ethers emit.\n const halfOrder = SECP256K1_ORDER >> 1n;\n if (s > halfOrder) {\n s = SECP256K1_ORDER - s;\n recovery ^= 1;\n }\n\n const rBytes = bigintToBe32(r);\n const sBytes = bigintToBe32(s);\n\n const rU256 = bytesBeToU256(rBytes);\n const sU256 = bytesBeToU256(sBytes);\n\n return wrapV2Snip12Envelope({\n ownerId: ownerIndex,\n kindTag: EIP191_KIND_TAG,\n payload: [rU256.low, rU256.high, sU256.low, sU256.high, BigInt(recovery)],\n });\n}\n\nfunction normalizePrivateKey(input: Uint8Array | string): Uint8Array {\n if (input instanceof Uint8Array) {\n assertBytes(\"EIP-191 private key\", input, 32);\n return input;\n }\n const hex = input.startsWith(\"0x\") ? input.slice(2) : input;\n if (hex.length !== 64) {\n throw new Error(`EIP-191 private key hex must be 64 chars (32 bytes); got ${hex.length}.`);\n }\n // Validate hex BEFORE parseInt — see parseEip191Signature for rationale.\n if (!/^[0-9a-fA-F]+$/.test(hex)) {\n throw new Error(\"EIP-191 private key contains non-hex characters.\");\n }\n const out = new Uint8Array(32);\n for (let i = 0; i < 32; i++) {\n out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n }\n return out;\n}\n\nfunction bigintToBe32(x: bigint): Uint8Array {\n if (x < 0n) throw new Error(\"bigintToBe32: negative input\");\n const out = new Uint8Array(32);\n for (let i = 31; i >= 0; i--) {\n out[i] = Number(x & 0xffn);\n x >>= 8n;\n }\n if (x !== 0n) throw new Error(\"bigintToBe32: input exceeds 256 bits\");\n return out;\n}\n","/**\n * WebAuthn P-256 signer for SHHH V8.4 ShhhAccount.\n *\n * The SHHH default signer kind in the browser. Wraps a WebAuthn\n * `navigator.credentials.get()` assertion (or a synthesized equivalent\n * in tests) into the V2_SNIP12 envelope the on-chain\n * WebAuthnP256Verifier (class `0x074f6efd…44657`) consumes.\n *\n * The verifier reproduces the WebAuthn assertion check on-chain:\n * 1. Parse `authData` (rpIdHash 32B || flags 1B || signCount 4B || …).\n * Require UP flag (bit 0) set.\n * 2. Compute `outer = sha256(authData ‖ sha256(clientDataJSON))`.\n * 3. Verify P-256 ECDSA `(r, s, y_parity)` against `outer` and the\n * stored pubkey.\n * 4. At `challenge_offset` in `clientDataJSON`, base64url-decode the\n * next 43 chars to 32 bytes and compare equal to the SNIP-12 hash.\n * 5. Sanity-check the `clientDataJSON` prefix\n * `{\"type\":\"webauthn.get\",…` (rejects webauthn.create / missing\n * type).\n *\n * Reference: shhh-wallet-cairo/scripts/ts/gen-webauthn-fixture.mjs\n * and tests/signer_webauthn_fixture.cairo\n *\n * Verifier overhead: ~35M l2_gas (per SHHH_KIND_GAS_OVERHEAD).\n *\n * Envelope shape (after the V2_SNIP12 + owner_id + kind_tag wrap):\n * ByteArray(authData)\n * ByteArray(clientDataJSON)\n * challenge_offset: u32\n * r.low, r.high, s.low, s.high, y_parity\n *\n * Cairo ByteArray serde:\n * num_full_words: u32\n * full_words: felt252[num_full_words] // 31 bytes packed MSB-first\n * pending_word: felt252 // <31 remaining bytes\n * pending_word_len: u32\n */\n\nimport { shortString } from \"starknet\";\nimport { ownerCommitment } from \"../compute-wallet-address\";\nimport { wrapV2Snip12Envelope } from \"../oe\";\n\nconst WEBAUTHN_KIND_TAG = \"WEBAUTHN_P256\";\nconst WEBAUTHN_KIND_TAG_FELT = BigInt(shortString.encodeShortString(WEBAUTHN_KIND_TAG));\n\nconst P256_ORDER = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551n;\n\nexport interface WebAuthnPubkey {\n /** 32-byte big-endian P-256 X coordinate. */\n x: Uint8Array;\n /** 32-byte big-endian P-256 Y coordinate. */\n y: Uint8Array;\n}\n\nfunction assertBytes(name: string, b: Uint8Array, len: number): void {\n if (b.length !== len) {\n throw new Error(`${name} must be exactly ${len} bytes; got ${b.length}.`);\n }\n}\n\nfunction bytesBeToU256(b: Uint8Array): { low: bigint; high: bigint } {\n assertBytes(\"32B value\", b, 32);\n let x = 0n;\n for (let i = 0; i < b.length; i++) x = (x << 8n) | BigInt(b[i]);\n return { low: x & ((1n << 128n) - 1n), high: x >> 128n };\n}\n\nfunction bigintToBe32(x: bigint): Uint8Array {\n if (x < 0n) throw new Error(\"bigintToBe32: negative input\");\n const out = new Uint8Array(32);\n for (let i = 31; i >= 0; i--) {\n out[i] = Number(x & 0xffn);\n x >>= 8n;\n }\n if (x !== 0n) throw new Error(\"bigintToBe32: input exceeds 256 bits\");\n return out;\n}\n\n/** base64url encode (no padding) — RFC 4648 §5. */\nfunction base64UrlEncode(bytes: Uint8Array): string {\n // btoa on browser / Buffer in node. Use a portable approach.\n let bin = \"\";\n for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);\n const b64 = typeof Buffer !== \"undefined\" ? Buffer.from(bytes).toString(\"base64\") : btoa(bin);\n return b64.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n/**\n * Serialize a byte string as Cairo's `ByteArray` serde — must match\n * what the Cairo runtime would produce when this same bytes value is\n * passed as a `ByteArray` parameter.\n *\n * Layout: `[num_full_words, ...full_words, pending_word, pending_word_len]`.\n * Each full word packs 31 bytes MSB-first (network order) into a felt252.\n */\nexport function byteArrayToFelts(bytes: Uint8Array): bigint[] {\n const totalFull = Math.floor(bytes.length / 31);\n const out: bigint[] = [BigInt(totalFull)];\n for (let i = 0; i < totalFull; i++) {\n let v = 0n;\n for (let j = 0; j < 31; j++) v = (v << 8n) | BigInt(bytes[i * 31 + j]);\n out.push(v);\n }\n const remStart = totalFull * 31;\n const remLen = bytes.length - remStart;\n let pending = 0n;\n for (let j = 0; j < remLen; j++) {\n pending = (pending << 8n) | BigInt(bytes[remStart + j]);\n }\n out.push(pending);\n out.push(BigInt(remLen));\n return out;\n}\n\n/**\n * Parse a DER-encoded ECDSA signature into raw (r, s) 32-byte BE values.\n * WebAuthn assertions return DER per spec; we strip it to the raw\n * P-256 components the Cairo verifier expects.\n */\nexport function parseDerEcdsaSignature(der: Uint8Array): {\n r: Uint8Array<ArrayBuffer>;\n s: Uint8Array<ArrayBuffer>;\n} {\n // Minimal DER:\n // 0x30 SEQ_LEN\n // 0x02 LEN_R R_BYTES\n // 0x02 LEN_S S_BYTES\n //\n // Bounds-checked at every step: a truncated/corrupted signature\n // could otherwise produce a zero-padded bogus (r, s) that would\n // skip on-chain verification.\n\n // Minimum legal DER ECDSA signature: 0x30 0x06 0x02 0x01 R 0x02 0x01 S = 8 bytes.\n if (der.length < 8) {\n throw new Error(`DER: input too short (${der.length} bytes)`);\n }\n if (der[0] !== 0x30) throw new Error(\"DER: expected SEQUENCE (0x30)\");\n // Short-form length only (DER for P-256 r/s is always short-form, max 70 bytes).\n const seqLen = der[1];\n if (seqLen & 0x80) {\n throw new Error(\"DER: long-form sequence length not supported\");\n }\n if (2 + seqLen !== der.length) {\n throw new Error(\n `DER: declared sequence length ${seqLen} does not match buffer (${der.length - 2})`\n );\n }\n\n let off = 2;\n if (der[off] !== 0x02) throw new Error(\"DER: expected INTEGER (0x02) for r\");\n const rLen = der[off + 1];\n if (rLen === 0) throw new Error(\"DER: r component has zero length\");\n if (off + 2 + rLen > der.length) {\n throw new Error(`DER: r length ${rLen} overruns buffer at offset ${off + 2}`);\n }\n off += 2;\n let rBytes = new Uint8Array(rLen);\n rBytes.set(der.subarray(off, off + rLen));\n off += rLen;\n\n if (off + 2 > der.length) {\n throw new Error(\"DER: no room for s INTEGER header\");\n }\n if (der[off] !== 0x02) throw new Error(\"DER: expected INTEGER (0x02) for s\");\n const sLen = der[off + 1];\n if (sLen === 0) throw new Error(\"DER: s component has zero length\");\n if (off + 2 + sLen > der.length) {\n throw new Error(`DER: s length ${sLen} overruns buffer at offset ${off + 2}`);\n }\n off += 2;\n let sBytes = new Uint8Array(sLen);\n sBytes.set(der.subarray(off, off + sLen));\n\n // DER pads leading 0x00 on signed-int negative-bit avoidance; strip + left-pad to 32.\n rBytes = leftPadTo32(stripLeadingZero(rBytes));\n sBytes = leftPadTo32(stripLeadingZero(sBytes));\n return { r: rBytes, s: sBytes };\n}\n\nfunction stripLeadingZero(b: Uint8Array): Uint8Array<ArrayBuffer> {\n // DER may prepend a single 0x00 to keep the integer positive — strip.\n const start = b.length > 0 && b[0] === 0x00 ? 1 : 0;\n const out = new Uint8Array(b.length - start);\n out.set(b.subarray(start));\n return out;\n}\n\nfunction leftPadTo32(b: Uint8Array): Uint8Array<ArrayBuffer> {\n if (b.length > 32) throw new Error(`P-256 component longer than 32 bytes: ${b.length}`);\n const out = new Uint8Array(32);\n out.set(b, 32 - b.length);\n return out;\n}\n\nexport function webauthnPubkeyFelts(pub: WebAuthnPubkey): bigint[] {\n const x = bytesBeToU256(pub.x);\n const y = bytesBeToU256(pub.y);\n return [x.low, x.high, y.low, y.high];\n}\n\nexport function webauthnOwnerId(pub: WebAuthnPubkey): bigint {\n return ownerCommitment(WEBAUTHN_KIND_TAG_FELT, webauthnPubkeyFelts(pub));\n}\n\n/**\n * The `ownerPubkey` string for the treasury coordination endpoints\n * (`sdk.treasury.forTreasury({ ownerPubkey })`): `\"0x<x>,0x<y>\"` — the\n * FULL 32-byte BE P-256 coordinates, NOT the 4 `webauthnPubkeyFelts`\n * halves. chipi-back's OwnerSignatureVerifier splits the coordinates\n * into commitment felts itself.\n */\nexport function webauthnOwnerPubkeyParam(pub: WebAuthnPubkey): string {\n assertBytes(\"P-256 x coordinate\", pub.x, 32);\n assertBytes(\"P-256 y coordinate\", pub.y, 32);\n const toHex = (b: Uint8Array) =>\n \"0x\" + Array.from(b, (v) => v.toString(16).padStart(2, \"0\")).join(\"\");\n return `${toHex(pub.x)},${toHex(pub.y)}`;\n}\n\n/**\n * Production / browser flow. The caller has run\n * `navigator.credentials.get({ publicKey: { challenge: msgBe32, ... } })`\n * and now has the assertion's `authenticatorData`, `clientDataJSON`,\n * and DER-encoded `signature` (plus the wallet's stored P-256 pubkey).\n *\n * This builder:\n * 1. Parses the DER signature into raw r, s.\n * 2. Recovers y_parity from the signature (always 0; WebAuthn does\n * not expose recovery — the on-chain verifier compares the recovered\n * pubkey against the stored one and tries both parities if needed).\n * 3. Locates the challenge in clientDataJSON to compute challenge_offset.\n * 4. Encodes authData + clientDataJSON as Cairo ByteArrays.\n * 5. Wraps everything in the V2_SNIP12 envelope.\n */\nexport function buildWebAuthnEnvelopeFromAssertion(params: {\n authenticatorData: Uint8Array;\n clientDataJSON: Uint8Array;\n /** DER-encoded ECDSA signature from `assertion.response.signature`. */\n signatureDer: Uint8Array;\n /** P-256 pubkey stored at registration time. */\n pubkey: WebAuthnPubkey;\n /** SNIP-12 hash the challenge was constructed from. */\n messageHash: bigint;\n /**\n * y_parity recovery bit. WebAuthn assertions don't include this — pass\n * 0 (the verifier tries both parities internally when needed). Override\n * only if you know the bit independently.\n */\n yParity?: 0n | 1n;\n /**\n * Owner index in the wallet's owner_set. Defaults to 0n (primary).\n * MUST fit in u32. Passing `webauthnOwnerId(pubkey)` (the commitment)\n * here will revert on chain with `'SHHH: bad owner_id'`.\n */\n ownerIndex?: bigint;\n}): bigint[] {\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n throw new Error(\n `buildWebAuthnEnvelopeFromAssertion: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32).`\n );\n }\n const { r, s } = parseDerEcdsaSignature(params.signatureDer);\n\n const expectedChallenge = base64UrlEncode(bigintToBe32(params.messageHash));\n // The challenge appears in clientDataJSON as `\"challenge\":\"<expectedChallenge>\"`.\n // challenge_offset is the byte index of the FIRST character of the b64url string.\n const needle = `\"challenge\":\"${expectedChallenge}\"`;\n const clientDataStr = new TextDecoder().decode(params.clientDataJSON);\n const needleStart = clientDataStr.indexOf(needle);\n if (needleStart < 0) {\n throw new Error(\n 'WebAuthn clientDataJSON does not contain a `\"challenge\":\"<expected>\"` substring for the given messageHash.'\n );\n }\n const challengeOffset = needleStart + '\"challenge\":\"'.length;\n\n const rU = bytesBeToU256(r);\n const sU = bytesBeToU256(s);\n\n const payload: bigint[] = [\n ...byteArrayToFelts(params.authenticatorData),\n ...byteArrayToFelts(params.clientDataJSON),\n BigInt(challengeOffset),\n rU.low,\n rU.high,\n sU.low,\n sU.high,\n params.yParity ?? 0n,\n ];\n\n return wrapV2Snip12Envelope({\n ownerId: ownerIndex,\n kindTag: WEBAUTHN_KIND_TAG,\n payload,\n });\n}\n\n/**\n * Test / Chipi-held-key flow. Synthesizes a WebAuthn assertion under\n * a known P-256 private key, then builds the envelope. Matches the\n * exact recipe in `gen-webauthn-fixture.mjs` so the resulting envelope\n * byte-for-byte matches `signer_webauthn_fixture.cairo`.\n *\n * Defaults match the canonical Shhh fixture: rpId=\"cifra.mx\",\n * origin=\"https://cifra.mx\", flags=0x05 (UP+UV), signCount=42.\n */\nexport async function buildWebAuthnEnvelopeFromPrivateKey(params: {\n /** 32-byte P-256 private key (Uint8Array or 0x-prefixed hex). */\n privateKey: Uint8Array | string;\n /** SNIP-12 hash of the OutsideExecution. */\n messageHash: bigint;\n /** WebAuthn relying-party ID (the rpId field). Default: \"cifra.mx\". */\n rpId?: string;\n /** WebAuthn origin string. Default: \"https://cifra.mx\". */\n origin?: string;\n /** WebAuthn authData flags byte. Default 0x05 (UP+UV). */\n flags?: number;\n /** 32-bit sign count. Default 42. */\n signCount?: number;\n /**\n * Owner index in the wallet's owner_set. Defaults to 0n (primary).\n * MUST fit in u32. Same semantics as `buildWebAuthnEnvelopeFromAssertion`.\n */\n ownerIndex?: bigint;\n}): Promise<bigint[]> {\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n throw new Error(\n `buildWebAuthnEnvelopeFromPrivateKey: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32).`\n );\n }\n const privBytes = normalizePrivateKey(params.privateKey);\n const rpId = params.rpId ?? \"cifra.mx\";\n const origin = params.origin ?? \"https://cifra.mx\";\n const flags = params.flags ?? 0x05;\n const signCount = params.signCount ?? 42;\n\n // Validate flags and signCount before any bitwise packing — out-of-range\n // values would silently truncate via `& 0xff` / `& 0xffffffff`, which is\n // exactly the kind of footgun we want to catch at the public API.\n if (!Number.isInteger(flags) || flags < 0 || flags > 0xff) {\n throw new Error(`WebAuthn flags must be an integer in [0, 255]; got ${flags}.`);\n }\n if (!Number.isInteger(signCount) || signCount < 0 || signCount > 0xffffffff) {\n throw new Error(`WebAuthn signCount must be an integer in [0, 0xFFFFFFFF]; got ${signCount}.`);\n }\n\n const [{ p256 }, sha2] = await Promise.all([\n import(\"@noble/curves/nist.js\"),\n import(\"@noble/hashes/sha2.js\"),\n ]);\n\n // ---- clientDataJSON ----\n const hashBytes = bigintToBe32(params.messageHash);\n const challengeStr = base64UrlEncode(hashBytes);\n // Use a fixed field order matching gen-webauthn-fixture.mjs.\n const clientDataStr =\n `{\"type\":\"webauthn.get\",\"challenge\":\"${challengeStr}\",` +\n `\"origin\":\"${origin}\",\"crossOrigin\":false}`;\n const clientData = new TextEncoder().encode(clientDataStr);\n const challengeOffset =\n clientDataStr.indexOf(`\"challenge\":\"${challengeStr}\"`) + '\"challenge\":\"'.length;\n\n // ---- authenticatorData = rpIdHash(32) || flags(1) || signCount(4) ----\n const rpIdHash = sha2.sha256(new TextEncoder().encode(rpId));\n const authData = new Uint8Array(32 + 1 + 4);\n authData.set(rpIdHash, 0);\n authData[32] = flags;\n // signCount as big-endian u32.\n authData[33] = (signCount >>> 24) & 0xff;\n authData[34] = (signCount >>> 16) & 0xff;\n authData[35] = (signCount >>> 8) & 0xff;\n authData[36] = signCount & 0xff;\n\n // ---- P-256 signing (sha256(authData || sha256(clientData))) ----\n const hClient = sha2.sha256(clientData);\n const signingBase = new Uint8Array(authData.length + hClient.length);\n signingBase.set(authData, 0);\n signingBase.set(hClient, authData.length);\n const outerHash = sha2.sha256(signingBase);\n\n // p256.sign(hash, priv, { prehash: false }) returns 64 raw bytes (r ‖ s).\n const sigBytes: Uint8Array = (p256 as any).sign(outerHash, privBytes, {\n prehash: false,\n });\n if (sigBytes.length !== 64) {\n throw new Error(`p256.sign returned ${sigBytes.length} bytes; expected 64`);\n }\n let r = bytesBeToBigint(sigBytes.slice(0, 32));\n let s = bytesBeToBigint(sigBytes.slice(32, 64));\n\n // lowS canonicalization for parity with what Cairo expects.\n const halfOrder = P256_ORDER >> 1n;\n if (s > halfOrder) s = P256_ORDER - s;\n\n const rBytes = bigintToBe32(r);\n const sBytes = bigintToBe32(s);\n\n const rU = bytesBeToU256(rBytes);\n const sU = bytesBeToU256(sBytes);\n\n const payload: bigint[] = [\n ...byteArrayToFelts(authData),\n ...byteArrayToFelts(clientData),\n BigInt(challengeOffset),\n rU.low,\n rU.high,\n sU.low,\n sU.high,\n 0n, // y_parity — Cairo verifier handles parity recovery internally\n ];\n\n return wrapV2Snip12Envelope({\n ownerId: ownerIndex,\n kindTag: WEBAUTHN_KIND_TAG,\n payload,\n });\n}\n\nfunction normalizePrivateKey(input: Uint8Array | string): Uint8Array {\n if (input instanceof Uint8Array) {\n assertBytes(\"P-256 private key\", input, 32);\n return input;\n }\n const hex = input.startsWith(\"0x\") ? input.slice(2) : input;\n if (hex.length !== 64) {\n throw new Error(`P-256 private key hex must be 64 chars (32 bytes); got ${hex.length}.`);\n }\n if (!/^[0-9a-fA-F]+$/.test(hex)) {\n throw new Error(\"P-256 private key contains non-hex characters.\");\n }\n const out = new Uint8Array(32);\n for (let i = 0; i < 32; i++) {\n out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n }\n return out;\n}\n\nfunction bytesBeToBigint(b: Uint8Array): bigint {\n let x = 0n;\n for (let i = 0; i < b.length; i++) x = (x << 8n) | BigInt(b[i]);\n return x;\n}\n","/**\n * JWT ES256 \"Sign in with Apple\" sub-bound signer for SHHH V8.4.\n *\n * Wave B PR B3. Adds the Apple Sign In signer kind\n * (`JWT_ES256_APPLE_SUB`, verifier class `0x06b67762...`). The headline\n * UX value is iOS-native onboarding: users without MetaMask but with\n * an iPhone authenticate with Apple, and the resulting JWT becomes a\n * SHHH owner. Multi-tenant safe via the `sub` claim binding.\n *\n * Cairo source of truth:\n * shhh-wallet-cairo/src/signer/jwt_es256_apple_sub/verifier.cairo\n *\n * Envelope layout (Cairo Serde over Span<felt252>):\n * header_b64 ByteArray // base64url JOSE header bytes\n * payload_decoded ByteArray // raw JSON claims (NOT base64url)\n * nonce_offset u32 // index of the 43-byte b64url nonce\n * iss_offset u32 // index of \"https://appleid.apple.com\"\n * sub_offset u32 // index of the sub claim VALUE\n * sub_len u32 // byte length of the sub claim VALUE\n * r u256 // low | high\n * s u256 // low | high\n * y_parity felt252 // 0 | 1\n *\n * Pubkey layout (5 felts):\n * [x_low, x_high, y_low, y_high, sub_hash]\n *\n * where sub_hash = poseidon_hash_span over the user's stable Apple\n * `sub` identifier, one felt per byte. The 5th felt binds the\n * on-chain owner to a SPECIFIC end-user — so multiple Chipi accounts\n * sharing Apple's same signing key can't be co-controlled by an\n * arbitrary Apple-authenticated user.\n *\n * Two flows:\n * - `buildJwtAppleSubEnvelopeFromTokenResponse` — production. Caller\n * drops in the Apple-issued `id_token` + the SNIP-12 message hash\n * that was committed to via the OE nonce.\n * - `buildJwtAppleSubEnvelopeFromTestKey` — synthesized test path.\n * Generates an ES256 keypair, constructs a JWT shaped like\n * Apple's, and signs it locally. Used for unit tests + the Wave\n * B B9 mainnet smoke. Real Apple-issued fixture upgrade comes\n * post-Wave-B (per plan D18).\n */\n\nimport { hash, shortString } from \"starknet\";\nimport { ownerCommitment } from \"../compute-wallet-address\";\nimport { wrapV2Snip12Envelope } from \"../oe\";\nimport { byteArrayToFelts } from \"./webauthn\";\n\nconst JWT_APPLE_SUB_KIND_TAG = \"JWT_ES256_APPLE_SUB\";\nconst JWT_APPLE_SUB_KIND_TAG_FELT = BigInt(shortString.encodeShortString(JWT_APPLE_SUB_KIND_TAG));\n\n/** The hardcoded `iss` claim every Apple JWT carries. 25 ASCII bytes. */\nexport const APPLE_ISSUER = \"https://appleid.apple.com\";\n\n/** Cairo's `CHALLENGE_B64URL_LEN`. base64url-no-padding of 32 BE bytes = 43 chars. */\nconst NONCE_B64URL_LEN = 43;\n\n// ================================================================\n// Types\n// ================================================================\n\n/**\n * Uncompressed P-256 public key for Apple's current ES256 signing key.\n * Apple rotates this periodically — see the JWKS endpoint at\n * `https://appleid.apple.com/auth/keys`.\n */\nexport interface JwtAppleSubPubkey {\n /** 32-byte big-endian X coordinate. */\n x: Uint8Array;\n /** 32-byte big-endian Y coordinate. */\n y: Uint8Array;\n /** The user's stable Apple `sub` identifier (ASCII), e.g. \"001234.abc.5678\". */\n sub: string;\n}\n\n/**\n * What you get back from `https://appleid.apple.com/auth/token` after\n * a Sign-in-with-Apple OAuth flow. Only `id_token` is signature-bearing;\n * `access_token` and friends are out of scope here.\n */\nexport interface AppleTokenResponse {\n id_token: string;\n}\n\n// ================================================================\n// Pubkey helpers\n// ================================================================\n\nconst U128_MASK = (1n << 128n) - 1n;\n\nfunction assertBytes(name: string, b: Uint8Array, len: number): void {\n if (b.length !== len) {\n throw new Error(`${name} must be exactly ${len} bytes; got ${b.length}.`);\n }\n}\n\nfunction bytesBeToU256(b: Uint8Array): { low: bigint; high: bigint } {\n assertBytes(\"secp256r1 32B value\", b, 32);\n let x = 0n;\n for (let i = 0; i < b.length; i++) x = (x << 8n) | BigInt(b[i]);\n return { low: x & U128_MASK, high: x >> 128n };\n}\n\n/**\n * Compute the sub_hash that the Cairo verifier checks against.\n * Equals `poseidon_hash_span` over the bytes of the sub string, one\n * felt per byte. The SDK and the verifier must agree byte-for-byte.\n */\nexport function jwtAppleSubHash(sub: string): bigint {\n const bytes = new TextEncoder().encode(sub);\n const felts = Array.from(bytes).map((b) => BigInt(b));\n return BigInt(hash.computePoseidonHashOnElements(felts.map((f) => \"0x\" + f.toString(16))));\n}\n\n/**\n * Pubkey felt layout for the V8.4 constructor / propose_add_owner.\n * Returns `[x.low, x.high, y.low, y.high, sub_hash]` (5 felts).\n */\nexport function jwtAppleSubPubkeyFelts(pubkey: JwtAppleSubPubkey): bigint[] {\n const x = bytesBeToU256(pubkey.x);\n const y = bytesBeToU256(pubkey.y);\n const subHash = jwtAppleSubHash(pubkey.sub);\n return [x.low, x.high, y.low, y.high, subHash];\n}\n\n/** owner_commitment for an Apple JWT owner. */\nexport function jwtAppleSubOwnerId(pubkey: JwtAppleSubPubkey): bigint {\n return ownerCommitment(JWT_APPLE_SUB_KIND_TAG_FELT, jwtAppleSubPubkeyFelts(pubkey));\n}\n\n// ================================================================\n// JWT parsing helpers\n// ================================================================\n\nfunction base64urlEncode(bytes: Uint8Array): string {\n // Node Buffer / browser btoa both work; using a portable inline\n // encoder so this module has no env-conditional behavior.\n const STD = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\n let bin = \"\";\n for (const b of bytes) bin += String.fromCharCode(b);\n // Convert binary string to standard base64 then transform.\n const b64 = btoaPortable(bin);\n return b64.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction btoaPortable(bin: string): string {\n if (typeof btoa === \"function\") return btoa(bin);\n // Node has Buffer; if neither, throw a clear error.\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n const buf = (globalThis as any).Buffer;\n if (buf) return buf.from(bin, \"binary\").toString(\"base64\");\n throw new Error(\"no base64 encoder available (need btoa or Buffer in scope)\");\n}\n\nfunction base64urlDecode(s: string): Uint8Array {\n // pad to multiple of 4\n const pad = s.length % 4 === 0 ? 0 : 4 - (s.length % 4);\n const std = s.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"=\".repeat(pad);\n const bin = atobPortable(std);\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n}\n\nfunction atobPortable(s: string): string {\n if (typeof atob === \"function\") return atob(s);\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n const buf = (globalThis as any).Buffer;\n if (buf) return buf.from(s, \"base64\").toString(\"binary\");\n throw new Error(\"no base64 decoder available (need atob or Buffer in scope)\");\n}\n\n/**\n * base64url-no-padding encoding of a 32 BE-byte SNIP-12 hash. The\n * Cairo verifier asserts the 43 ASCII bytes at\n * `payload_decoded[nonce_offset .. nonce_offset+43]` equal exactly\n * this string. Format must match RFC 4648 §5 (no padding `=`).\n */\nexport function messageHashToNonceB64url(messageHash: bigint): string {\n const beBytes = new Uint8Array(32);\n let x = messageHash;\n for (let i = 31; i >= 0; i--) {\n beBytes[i] = Number(x & 0xffn);\n x >>= 8n;\n }\n if (x !== 0n) {\n throw new RangeError(\"messageHash exceeds 256 bits\");\n }\n const out = base64urlEncode(beBytes);\n if (out.length !== NONCE_B64URL_LEN) {\n throw new Error(`expected ${NONCE_B64URL_LEN}-char nonce b64url, got ${out.length}`);\n }\n return out;\n}\n\n/**\n * Locate a literal substring in a byte array. Returns the byte offset\n * (UTF-8-safe, both inputs treated as bytes). Throws if not found\n * with a clear message; the on-chain verifier would otherwise return\n * `false` silently, producing an unhelpful revert.\n */\nfunction findByteOffset(haystack: Uint8Array, needle: Uint8Array, label: string): number {\n outer: for (let i = 0; i + needle.length <= haystack.length; i++) {\n for (let j = 0; j < needle.length; j++) {\n if (haystack[i + j] !== needle[j]) continue outer;\n }\n return i;\n }\n throw new Error(`JWT_APPLE_SUB: ${label} not found in payload (verifier would reject)`);\n}\n\n/**\n * Locate the byte offset of a JSON string claim's value within a JWT\n * payload. Binds the offset to the actual `\"<key>\":\"<value>\"` pattern\n * (with the value's closing `\"`) rather than searching for the bare\n * value bytes, which could match anywhere in the payload — including\n * inside an attacker-controlled field. The Cairo verifier only does\n * a bytes-at-offset equality check, so the offset MUST point at a\n * value bound to the right key, or the JWT is unbound.\n *\n * Returns the offset of the first character of the value (i.e. just\n * after the opening `\"`). The verifier then reads exactly\n * `expectedValue.length` bytes from there.\n *\n * Whitespace policy: Apple's id_token payload is canonical JSON with\n * no insignificant whitespace between key, colon, and value. We\n * enforce that here. Any whitespace tolerance would have to be\n * mirrored in the Cairo verifier; right now it isn't.\n */\nfunction locateExactClaimValueOffset(\n payload: Uint8Array,\n claim: string,\n expectedValue: string\n): number {\n // Build the literal `\"<claim>\":\"<value>\"` pattern. We search for\n // the full pattern (including the trailing `\"`) so a substring of\n // a longer value can't also match.\n const literal = `\"${claim}\":\"${expectedValue}\"`;\n const literalBytes = new TextEncoder().encode(literal);\n const idx = findByteOffsetOrMinusOne(payload, literalBytes);\n if (idx < 0) {\n throw new Error(\n `JWT_APPLE_SUB: ${claim} claim with expected value not found in payload (verifier would reject)`\n );\n }\n // Offset of the value's first character = idx + |\"<claim>\":\"| .\n const prefix = `\"${claim}\":\"`;\n return idx + new TextEncoder().encode(prefix).length;\n}\n\nfunction findByteOffsetOrMinusOne(haystack: Uint8Array, needle: Uint8Array): number {\n outer: for (let i = 0; i + needle.length <= haystack.length; i++) {\n for (let j = 0; j < needle.length; j++) {\n if (haystack[i + j] !== needle[j]) continue outer;\n }\n return i;\n }\n return -1;\n}\n\n/**\n * Split an Apple-issued `id_token` into its three base64url parts.\n * Returns the decoded payload bytes + the header b64url + the\n * 64-byte raw ECDSA signature (r || s).\n */\nexport function parseAppleIdToken(idToken: string): {\n headerB64: string;\n payloadDecoded: Uint8Array;\n rawSignature: Uint8Array; // 64 bytes: r || s, big-endian\n} {\n const parts = idToken.split(\".\");\n if (parts.length !== 3) {\n throw new Error(\n `JWT_APPLE_SUB: id_token must have 3 parts separated by '.'; got ${parts.length}`\n );\n }\n const [headerB64, payloadB64, sigB64] = parts;\n const payloadDecoded = base64urlDecode(payloadB64);\n const rawSignature = base64urlDecode(sigB64);\n if (rawSignature.length !== 64) {\n throw new Error(\n `JWT_APPLE_SUB: ECDSA signature must be 64 bytes (raw r||s); got ${rawSignature.length}. ` +\n `Apple returns raw 64-byte signatures; if you have a DER-encoded one, decode it first.`\n );\n }\n return { headerB64, payloadDecoded, rawSignature };\n}\n\n/**\n * Locate the sub claim's VALUE bytes in a decoded JSON payload.\n * Searches for the literal `\"sub\":\"<value>\"` pattern. JSON allows\n * whitespace, but Apple's id_token always uses canonical\n * no-whitespace form, so we don't try to handle pretty-printed JSON.\n *\n * Returns `{ offset, length }` of the value bytes (not including the\n * surrounding quotes), suitable for `sub_offset` + `sub_len` in the\n * envelope.\n */\nexport function locateSubClaim(payload: Uint8Array): {\n offset: number;\n length: number;\n} {\n // We can't rely on regex over bytes; do it manually. Find `\"sub\":\"`,\n // then read until the closing `\"` (assuming no escape sequences —\n // Apple's sub IDs are ASCII alphanumeric + dots, never quoted).\n const SUB_KEY = new TextEncoder().encode('\"sub\":\"');\n const start = findByteOffset(payload, SUB_KEY, '\"sub\":\"');\n const valueStart = start + SUB_KEY.length;\n let end = valueStart;\n while (end < payload.length && payload[end] !== 0x22 /* '\"' */) {\n if (payload[end] === 0x5c /* '\\\\' */) {\n throw new Error(\"JWT_APPLE_SUB: sub claim contains escape sequence; not supported\");\n }\n end += 1;\n }\n if (end >= payload.length) {\n throw new Error(\"JWT_APPLE_SUB: sub claim is unterminated\");\n }\n return { offset: valueStart, length: end - valueStart };\n}\n\n// ================================================================\n// Envelope assembly\n// ================================================================\n\ninterface JwtAppleSubEnvelopeFields {\n headerB64: string;\n payloadDecoded: Uint8Array;\n nonceOffset: number;\n issOffset: number;\n subOffset: number;\n subLen: number;\n r: bigint; // u256\n s: bigint; // u256\n yParity: 0 | 1;\n}\n\n/** Helper: serialize a bytes blob as Cairo ByteArray. */\nfunction serdeByteArray(bytes: Uint8Array): bigint[] {\n return byteArrayToFelts(bytes);\n}\n\nfunction buildEnvelopePayload(fields: JwtAppleSubEnvelopeFields): bigint[] {\n const headerBytes = new TextEncoder().encode(fields.headerB64);\n const headerSerde = serdeByteArray(headerBytes);\n const payloadSerde = serdeByteArray(fields.payloadDecoded);\n\n return [\n ...headerSerde,\n ...payloadSerde,\n BigInt(fields.nonceOffset),\n BigInt(fields.issOffset),\n BigInt(fields.subOffset),\n BigInt(fields.subLen),\n fields.r & U128_MASK,\n fields.r >> 128n,\n fields.s & U128_MASK,\n fields.s >> 128n,\n BigInt(fields.yParity),\n ];\n}\n\n/**\n * Production flow. Build a V2_SNIP12 envelope wrapping an actual\n * Apple-issued JWT. Caller has invoked the OAuth flow client-side\n * (e.g. via `appleid.com` JS SDK or AuthenticationServices on iOS)\n * and received an `id_token` whose `nonce` claim equals\n * `messageHashToNonceB64url(oeMessageHash)`.\n *\n * Returns the `signature` felt span you pass to\n * `paymaster_executeSponsoredRaw.calldata`.\n */\nexport function buildJwtAppleSubEnvelopeFromTokenResponse(params: {\n /** Apple OAuth token endpoint response (we only need `id_token`). */\n idToken: string;\n /** Owner's full pubkey including sub — same as registered on-chain. */\n pubkey: JwtAppleSubPubkey;\n /** SNIP-12 hash of the OE — the nonce in the id_token MUST encode this. */\n messageHash: bigint;\n /**\n * Owner index in the wallet's owner_set. Defaults to 0n (primary).\n * MUST fit in u32. Passing `jwtAppleSubOwnerId(pubkey)` (the commitment)\n * here will revert on chain with `'SHHH: bad owner_id'`.\n */\n ownerIndex?: bigint;\n}): bigint[] {\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n throw new Error(\n `buildJwtAppleSubEnvelopeFromTokenResponse: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32).`\n );\n }\n const { headerB64, payloadDecoded, rawSignature } = parseAppleIdToken(params.idToken);\n\n // Sanity check 1: nonce claim equals base64url(messageHash 32 BE bytes).\n // CRITICAL: bind the offset to the `\"nonce\":\"<value>\"` literal — searching\n // for the bare value bytes would match inside any attacker-controlled\n // claim, and the Cairo verifier only checks bytes-at-offset.\n const expectedNonce = messageHashToNonceB64url(params.messageHash);\n const nonceOffset = locateExactClaimValueOffset(payloadDecoded, \"nonce\", expectedNonce);\n\n // Sanity check 2: iss claim equals APPLE_ISSUER (bound to claim key).\n const issOffset = locateExactClaimValueOffset(payloadDecoded, \"iss\", APPLE_ISSUER);\n\n // Sanity check 3: sub claim present + matches pubkey.sub.\n const { offset: subOffset, length: subLen } = locateSubClaim(payloadDecoded);\n const actualSub = new TextDecoder().decode(\n payloadDecoded.subarray(subOffset, subOffset + subLen)\n );\n if (actualSub !== params.pubkey.sub) {\n throw new Error(\n `JWT_APPLE_SUB: id_token sub \"${actualSub}\" doesn't match pubkey.sub ` +\n `\"${params.pubkey.sub}\" — wrong user signed in`\n );\n }\n\n // Split raw signature into (r, s, y_parity).\n const { r, s } = parseRawEcdsaSignature(rawSignature);\n // ES256 doesn't include y_parity in the signature (unlike Ethereum's\n // EIP-191). The Cairo verifier uses ECDSA *verify* not recovery, so\n // it tries both y_parity values and accepts the one that succeeds.\n // We always pass 0 here; the verifier flips if needed.\n // (Reference: Cairo `is_valid_signature` semantics in secp256r1.)\n const yParity: 0 | 1 = 0;\n\n return wrapV2Snip12Envelope({\n ownerId: ownerIndex,\n kindTag: JWT_APPLE_SUB_KIND_TAG,\n payload: buildEnvelopePayload({\n headerB64,\n payloadDecoded,\n nonceOffset,\n issOffset,\n subOffset,\n subLen,\n r,\n s,\n yParity,\n }),\n });\n}\n\nfunction parseRawEcdsaSignature(raw: Uint8Array): { r: bigint; s: bigint } {\n if (raw.length !== 64) {\n throw new Error(`JWT_APPLE_SUB: ECDSA signature must be 64 bytes; got ${raw.length}`);\n }\n let r = 0n;\n for (let i = 0; i < 32; i++) r = (r << 8n) | BigInt(raw[i]);\n let s = 0n;\n for (let i = 32; i < 64; i++) s = (s << 8n) | BigInt(raw[i]);\n return { r, s };\n}\n\n/**\n * Test / synthesized-fixture flow. Generate an ES256 P-256 keypair,\n * construct a JWT shaped like an Apple-issued one, sign it locally,\n * and wrap into a SHHH envelope.\n *\n * Used by unit tests + the Wave B B9 mainnet smoke. The wallet\n * deployed for the smoke must be registered with the SAME synthesized\n * pubkey returned here (`{ x, y, sub }`); production wallets register\n * Apple's actual JWKS pubkey + the user's real sub.\n *\n * Async because `@noble/curves` ESM imports.\n *\n * Real-Apple-Developer-issued fixture upgrade is tracked as a separate\n * post-Wave-B item (plan D18).\n */\nexport async function buildJwtAppleSubEnvelopeFromTestKey(params: {\n /** 32-byte raw P-256 private key. */\n privateKey: Uint8Array;\n /** Stable Apple-style sub identifier (e.g. \"001234.synthesized.5678\"). */\n sub: string;\n /** Audience claim — typically the integrator's Apple Developer team ID + bundle ID. */\n aud: string;\n /** SNIP-12 hash of the OE; encoded as the nonce claim. */\n messageHash: bigint;\n /**\n * Owner index in the wallet's owner_set. Defaults to 0n (primary).\n * MUST fit in u32. Same semantics as `buildJwtAppleSubEnvelopeFromTokenResponse`.\n */\n ownerIndex?: bigint;\n}): Promise<{\n envelope: bigint[];\n pubkey: JwtAppleSubPubkey;\n idToken: string;\n}> {\n const ownerIndex = params.ownerIndex ?? 0n;\n if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {\n throw new Error(\n `buildJwtAppleSubEnvelopeFromTestKey: ownerIndex ${ownerIndex} is out of u32 range [0, 2^32).`\n );\n }\n const { p256 } = await import(\"@noble/curves/nist.js\");\n const { sha256 } = await import(\"@noble/hashes/sha2.js\");\n\n if (params.privateKey.length !== 32) {\n throw new Error(\n `JWT_APPLE_SUB: P-256 private key must be 32 bytes; got ${params.privateKey.length}`\n );\n }\n\n // Derive uncompressed pubkey (65 bytes: 0x04 || x || y).\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n const pubUncompressed: Uint8Array = (p256 as any).getPublicKey(params.privateKey, false);\n if (pubUncompressed.length !== 65 || pubUncompressed[0] !== 0x04) {\n throw new Error(\"expected 65-byte uncompressed P-256 pubkey\");\n }\n const pubkey: JwtAppleSubPubkey = {\n x: pubUncompressed.slice(1, 33),\n y: pubUncompressed.slice(33, 65),\n sub: params.sub,\n };\n\n // JWT header — Apple's looks like {\"alg\":\"ES256\",\"kid\":\"<key id>\"}.\n const headerJson = JSON.stringify({ alg: \"ES256\", kid: \"synthesized\" });\n const headerB64 = base64urlEncode(new TextEncoder().encode(headerJson));\n\n // JWT payload — claims that the Cairo verifier scans:\n // iss: hardcoded APPLE_ISSUER\n // aud: caller-provided\n // sub: caller-provided (used by sub-bound binding)\n // nonce: base64url(messageHash, 32 BE bytes)\n // Plus iat / exp for realism (not checked on-chain but real Apple\n // tokens always carry them — including them keeps the offset\n // calculations representative).\n const now = Math.floor(Date.now() / 1000);\n const nonce = messageHashToNonceB64url(params.messageHash);\n const payloadObject = {\n iss: APPLE_ISSUER,\n aud: params.aud,\n sub: params.sub,\n iat: now,\n exp: now + 600,\n nonce,\n };\n const payloadJson = JSON.stringify(payloadObject);\n const payloadDecoded = new TextEncoder().encode(payloadJson);\n const payloadB64 = base64urlEncode(payloadDecoded);\n\n // Sign: ES256 over sha256(header_b64 || \".\" || payload_b64).\n const signingInput = new TextEncoder().encode(`${headerB64}.${payloadB64}`);\n const digest = sha256(signingInput);\n // @noble/curves v2 returns a 64-byte Uint8Array directly from\n // `p256.sign(...)` — raw r||s big-endian. No Signature object with\n // `.r`/`.s` fields the way @noble/secp256k1 has. Parse r and s out\n // of the raw bytes ourselves.\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n const rawSig: Uint8Array = (p256 as any).sign(digest, params.privateKey, {\n lowS: true,\n });\n if (rawSig.length !== 64) {\n throw new Error(`expected 64-byte raw ECDSA signature from p256.sign; got ${rawSig.length}`);\n }\n const { r, s } = parseRawEcdsaSignature(rawSig);\n\n // Compose the synthesized JWT so callers can also exercise the\n // production parser path on the same fixture.\n const idToken = `${headerB64}.${payloadB64}.${base64urlEncode(rawSig)}`;\n\n // Compute offsets directly from the synthesized payload, bound to\n // the `\"<claim>\":\"<value>\"` literal — same hardening as the\n // production builder so the fixture exercises the real lookup path.\n const nonceOffset = locateExactClaimValueOffset(payloadDecoded, \"nonce\", nonce);\n const issOffset = locateExactClaimValueOffset(payloadDecoded, \"iss\", APPLE_ISSUER);\n const { offset: subOffset, length: subLen } = locateSubClaim(payloadDecoded);\n\n const envelope = wrapV2Snip12Envelope({\n ownerId: ownerIndex,\n kindTag: JWT_APPLE_SUB_KIND_TAG,\n payload: buildEnvelopePayload({\n headerB64,\n payloadDecoded,\n nonceOffset,\n issOffset,\n subOffset,\n subLen,\n r,\n s,\n yParity: 0,\n }),\n });\n\n return { envelope, pubkey, idToken };\n}\n","/**\n * ShhhAccount — ergonomic drop-in adapter for signing as a SHHH V8.4\n * owner from a raw owner private key.\n *\n * Why this exists: a SHHH account is account-abstracted and its\n * `__validate__` is DISABLED (shhh-wallet-cairo `src/account.cairo`\n * panics with `'SHHH: __validate__ disabled'`), so the standard\n * starknet.js path — `new Account(provider, addr, key).execute(calls)`\n * — does NOT work. The only authorized execution path is\n * `execute_from_outside_v2`: you sign an OutsideExecution and submit it.\n *\n * This wrapper hides that plumbing so a holder of an exported STARK\n * owner key can write the familiar:\n *\n * const account = new ShhhAccount(provider, address, privateKey, {\n * submit: submitViaAccount(fundedRelayer),\n * });\n * const { transactionHash } = await account.execute(calls);\n *\n * It signs the OE with the owner key (ownerIndex 0 = primary) and\n * broadcasts via the configured `submit` strategy — either a funded\n * Starknet account you control (fully self-sovereign, no Chipi servers)\n * or a paymaster relay (gasless). If you don't configure `submit`, call\n * `signExecution()` and broadcast the calldata yourself.\n *\n * Scope: STARK-kind owners. Other signer kinds (Ed25519 / EIP-191 /\n * WebAuthn) have their own envelope builders; this adapter targets the\n * exported-private-key use case, which is always a STARK owner.\n */\n\nimport { Account, type Call, type ProviderInterface } from \"starknet\";\n\nimport {\n buildOutsideExecution,\n computeOeHash,\n MAX_OE_VALIDITY_WINDOW_SECONDS,\n OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER,\n} from \"./oe\";\nimport { buildStarkEnvelope } from \"./signers/stark\";\nimport { serializeExecuteFromOutsideV2Calldata, resolveShhhChainId } from \"./execute-paymaster-raw\";\nimport type { OutsideExecution } from \"./snip12-hash\";\n\n/**\n * How a signed `execute_from_outside_v2` calldata is broadcast. The\n * account itself can never pay gas (`__validate__` is disabled), so the\n * broadcaster is always a separate party: a funded relayer you control,\n * or a paymaster service. It only pays gas — it is NOT the signer.\n */\nexport type ShhhSubmit = (input: {\n accountAddress: string;\n calldata: string[];\n}) => Promise<{ transactionHash: string }>;\n\nexport interface ShhhAccountOptions {\n /**\n * Owner index into the wallet's owner_set. Defaults to `0n` (the\n * primary owner — what an exported private key controls). Override\n * for additional owners added via `propose_add_owner`.\n */\n ownerIndex?: bigint;\n /**\n * Chain id used for SNIP-12 hashing. Defaults to Starknet mainnet\n * (Chipi is mainnet-only). A wrong value makes the account reject the\n * signature on chain.\n */\n chainId?: bigint | string;\n /** Broadcast strategy. Omit to sign-only via {@link ShhhAccount.signExecution}. */\n submit?: ShhhSubmit;\n}\n\nexport interface ShhhSignedExecution {\n /** The OutsideExecution that was signed. */\n outsideExecution: OutsideExecution;\n /** The owner signature envelope `[V2_SNIP12, owner_id, 'STARK', r, s]`. */\n signature: bigint[];\n /** The SNIP-12 message hash that was signed. */\n messageHash: bigint;\n /** Flat felt calldata for the `execute_from_outside_v2` selector. */\n calldata: string[];\n}\n\nexport interface ShhhExecuteOptions {\n /** Override the replay nonce. Default: `(Date.now() << 24) | random24`. */\n nonce?: bigint | string;\n /**\n * How long (seconds from now) the OE stays valid. Default: the account\n * max (~2h). The builder backdates `execute_after` by a 60s clock-skew\n * buffer, and the account caps the total window at 2h, so the usable\n * max here is `MAX_OE_VALIDITY_WINDOW_SECONDS - 60` (7140s). Values\n * above that throw with a clear message rather than a cryptic builder\n * error.\n */\n validForSeconds?: number;\n}\n\n/** Unique-enough OE nonce: ms timestamp shifted left 24 bits, OR a 24-bit random suffix. */\nfunction generateNonce(): bigint {\n // 0x1000000 (2^24), not 0xffffff, so the suffix spans the full 24-bit\n // range [0, 2^24) — Math.random() is [0, 1), so * 0xffffff would never\n // reach the top value.\n return (BigInt(Date.now()) << 24n) | BigInt(Math.floor(Math.random() * 0x1000000));\n}\n\nexport class ShhhAccount {\n /** The provider, exposed for convenience (e.g. `account.provider.waitForTransaction`). */\n readonly provider: ProviderInterface;\n readonly address: string;\n readonly ownerIndex: bigint;\n readonly chainId: bigint | string;\n\n private readonly privateKey: bigint | string;\n private readonly submitFn?: ShhhSubmit;\n\n constructor(\n provider: ProviderInterface,\n address: string,\n privateKey: bigint | string,\n options: ShhhAccountOptions = {}\n ) {\n this.provider = provider;\n this.address = address;\n this.privateKey = privateKey;\n this.ownerIndex = options.ownerIndex ?? 0n;\n this.chainId = options.chainId ?? resolveShhhChainId({});\n this.submitFn = options.submit;\n }\n\n /**\n * Build + sign an OutsideExecution for `calls` and return the\n * serialized `execute_from_outside_v2` calldata (plus the underlying\n * pieces). Use this when you want to broadcast the calldata yourself.\n */\n async signExecution(\n calls: Call[],\n options: ShhhExecuteOptions = {}\n ): Promise<ShhhSignedExecution> {\n if (options.validForSeconds !== undefined) {\n // The builder defaults `execute_after` to `now - 60s` (clock-skew\n // buffer) and the account caps the total span at\n // MAX_OE_VALIDITY_WINDOW_SECONDS. So the usable validity measured\n // from now is `max - 60`. Validate here with a clear message instead\n // of letting `buildOutsideExecution` throw a cryptic window error at\n // the boundary (e.g. validForSeconds === MAX would overflow by 60s).\n const maxValid = MAX_OE_VALIDITY_WINDOW_SECONDS - OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER;\n if (!Number.isFinite(options.validForSeconds) || options.validForSeconds <= 0) {\n throw new Error(\n \"ShhhAccount: validForSeconds must be a positive finite number of seconds.\"\n );\n }\n if (options.validForSeconds > maxValid) {\n throw new Error(\n `ShhhAccount: validForSeconds (${options.validForSeconds}) exceeds the max ${maxValid}s ` +\n `(the account caps the OE window at ${MAX_OE_VALIDITY_WINDOW_SECONDS}s and ` +\n `${OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER}s is reserved for clock skew).`\n );\n }\n }\n const outsideExecution = buildOutsideExecution({\n nonce: options.nonce ?? generateNonce(),\n calls,\n ...(options.validForSeconds !== undefined\n ? { executeBefore: BigInt(Math.floor(Date.now() / 1000) + options.validForSeconds) }\n : {}),\n });\n const messageHash = computeOeHash(outsideExecution, this.address, this.chainId);\n const signature = buildStarkEnvelope({\n privateKey: this.privateKey,\n messageHash,\n ownerIndex: this.ownerIndex,\n });\n const calldata = serializeExecuteFromOutsideV2Calldata({ outsideExecution, signature });\n return { outsideExecution, signature, messageHash, calldata };\n }\n\n /**\n * Sign `calls` and broadcast them via the configured `submit` strategy.\n * Mirrors starknet.js `Account.execute` ergonomically. Returns the\n * transaction hash without waiting for inclusion — use\n * `provider.waitForTransaction(transactionHash)` if you need to block.\n */\n async execute(\n calls: Call[],\n options: ShhhExecuteOptions = {}\n ): Promise<{ transactionHash: string }> {\n if (!this.submitFn) {\n throw new Error(\n \"ShhhAccount.execute: no submit strategy configured. Pass `submit` in the \" +\n \"ShhhAccount constructor options (e.g. submitViaAccount(fundedAccount) for \" +\n \"self-sovereign, or a paymaster relay for gasless), or call signExecution() \" +\n \"and broadcast the calldata yourself.\"\n );\n }\n const { calldata } = await this.signExecution(calls, options);\n return this.submitFn({ accountAddress: this.address, calldata });\n }\n}\n\n/**\n * Self-sovereign submit strategy: relay the signed OE through any funded\n * Starknet account you control. The funded account only pays gas — it is\n * NOT the signer, and never sees the SHHH owner key. This is the path\n * that needs no Chipi servers at all.\n */\nexport function submitViaAccount(funded: Account): ShhhSubmit {\n return async ({ accountAddress, calldata }) => {\n const { transaction_hash } = await funded.execute({\n contractAddress: accountAddress,\n entrypoint: \"execute_from_outside_v2\",\n calldata,\n });\n return { transactionHash: transaction_hash };\n };\n}\n"]}