@dainprotocol/service-sdk 1.2.1 → 1.2.2

package/dist/client/service-auth.js

@@ -0,0 +1,93 @@
+"use strict";
+//File: src/client/service-auth.ts
+/**
+ * Service/Agent Authentication - Legacy Keypair-based
+ *
+ * This class is for SERVICE and AGENT authentication using legacy keypair-based signatures.
+ * End users should NOT use this class - they must use DainUserAuth with JWT tokens.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DainServiceAuth = void 0;
+const client_auth_1 = require("./client-auth");
+/**
+ * DainServiceAuth - Legacy keypair-based authentication for services and agents
+ *
+ * @example
+ * ```typescript
+ * // Authenticate as a service with API key
+ * const serviceAuth = new DainServiceAuth({
+ *   apiKey: "sk_agent_org_123_agent_456_<base58key>"
+ * });
+ *
+ * // OR with individual components
+ * const serviceAuth = new DainServiceAuth({
+ *   privateKeyBase58: "49bhyNKM...",
+ *   agentId: "agent_456",
+ *   orgId: "org_123"
+ * });
+ * ```
+ */
+class DainServiceAuth extends client_auth_1.DainClientAuth {
+    constructor(config) {
+        if (!config.apiKey && !(config.privateKeyBase58 && config.agentId && config.orgId)) {
+            throw new Error('Invalid service authentication configuration.\n' +
+                'Provide either:\n' +
+                '  - apiKey: "sk_agent_org_<orgId>_<agentId>_<keypair>"\n' +
+                '  OR\n' +
+                '  - privateKeyBase58, agentId, and orgId\n\n' +
+                'Note: This is for SERVICES and AGENTS only.\n' +
+                'If you are authenticating as a user, use DainUserAuth with a JWT token instead.');
+        }
+        // Call parent with legacy auth config
+        super({
+            apiKey: config.apiKey,
+            privateKeyBase58: config.privateKeyBase58,
+            agentId: config.agentId,
+            orgId: config.orgId,
+            smartAccountPDA: config.smartAccountPDA,
+            webhookUrl: config.webhookUrl,
+        });
+        // Verify auth method is legacy
+        if (this.getAuthMethod() !== 'legacy') {
+            throw new Error('DainServiceAuth must use legacy authentication');
+        }
+    }
+    /**
+     * Get the service's agent ID
+     */
+    getServiceAgentId() {
+        const agentId = this.getAgentId();
+        if (!agentId) {
+            throw new Error('Agent ID not available');
+        }
+        return agentId;
+    }
+    /**
+     * Get the service's organization ID
+     */
+    getServiceOrgId() {
+        const orgId = this.getOrgId();
+        if (!orgId) {
+            throw new Error('Organization ID not available');
+        }
+        return orgId;
+    }
+    /**
+     * Override to prevent JWT methods
+     * @deprecated Not supported for service authentication
+     */
+    getSmartAccountId() {
+        throw new Error('getSmartAccountId() is not supported for service authentication.\n' +
+            'Use getServiceAgentId() instead.');
+    }
+    /**
+     * Override to prevent JWT methods
+     * @deprecated Not supported for service authentication
+     */
+    getJWT() {
+        throw new Error('getJWT() is not supported for service authentication.\n' +
+            'Services use keypair-based authentication, not JWT.');
+    }
+}
+exports.DainServiceAuth = DainServiceAuth;
+//# sourceMappingURL=service-auth.js.map

package/dist/client/service-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-auth.js","sourceRoot":"","sources":["../../src/client/service-auth.ts"],"names":[],"mappings":";AAAA,kCAAkC;AAClC;;;;;GAKG;;;AAEH,+CAA+C;AAqB/C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAa,eAAgB,SAAQ,4BAAc;IACjD,YAAY,MAA6B;QACvC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CACb,iDAAiD;gBACjD,mBAAmB;gBACnB,0DAA0D;gBAC1D,QAAQ;gBACR,8CAA8C;gBAC9C,+CAA+C;gBAC/C,iFAAiF,CAClF,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,KAAK,CAAC;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CAAC;QAEH,+BAA+B;QAC/B,IAAI,IAAI,CAAC,aAAa,EAAE,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,eAAe;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,iBAAiB;QACf,MAAM,IAAI,KAAK,CACb,oEAAoE;YACpE,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,MAAM,IAAI,KAAK,CACb,yDAAyD;YACzD,qDAAqD,CACtD,CAAC;IACJ,CAAC;CACF;AAzED,0CAyEC"}

package/dist/client/user-auth.d.ts

@@ -0,0 +1,74 @@
+/**
+ * User Authentication - JWT ONLY
+ *
+ * Users authenticate with JWT tokens from DAIN ID OAuth.
+ * NO orgId, NO agentId, NO keypair - completely removed for users.
+ */
+export interface DainUserAuthConfig {
+    /** JWT access token from DAIN ID OAuth */
+    jwt: string;
+    /** Smart Account ID (optional, will be extracted from JWT if not provided) */
+    smartAccountId?: string;
+    /** Smart Account PDA on Solana (optional) */
+    smartAccountPDA?: string;
+    /** Webhook URL for async operations (optional) */
+    webhookUrl?: string;
+}
+/**
+ * DainUserAuth - JWT-only authentication for end users
+ *
+ * Users have:
+ * - JWT token (for authentication)
+ * - Smart Account ID (their unique identifier)
+ * - NO orgId, NO agentId, NO keypair
+ */
+export declare class DainUserAuth {
+    private jwt;
+    private smartAccountId;
+    private smartAccountPDA?;
+    private webhookUrl?;
+    constructor(config: DainUserAuthConfig);
+    /**
+     * Decode JWT payload (without verification)
+     */
+    private decodeJWTPayload;
+    /**
+     * Sign request - NOT NEEDED for JWT, returns empty
+     */
+    signRequest(_method: string, _path: string, _body: string): Promise<{
+        signature: string;
+        timestamp: string;
+    }>;
+    /**
+     * Get headers for HTTP requests
+     */
+    getHeaders(_signature: string, _timestamp: string): Record<string, string>;
+    /**
+     * Get the user's smart account ID
+     */
+    getSmartAccountId(): string;
+    /**
+     * Get JWT token
+     */
+    getJWT(): string;
+    /**
+     * Get smart account PDA
+     */
+    getSmartAccountPDA(): string | undefined;
+    /**
+     * Get webhook URL
+     */
+    getWebhookUrl(): string | undefined;
+    /**
+     * Check if using JWT authentication (always true for users)
+     */
+    isJWT(): boolean;
+    /**
+     * Serialize user auth
+     */
+    serialize(): string;
+    /**
+     * Deserialize user auth
+     */
+    static deserialize(serialized: string): DainUserAuth;
+}

package/dist/client/user-auth.js

@@ -0,0 +1,137 @@
+"use strict";
+//File: src/client/user-auth.ts
+/**
+ * User Authentication - JWT ONLY
+ *
+ * Users authenticate with JWT tokens from DAIN ID OAuth.
+ * NO orgId, NO agentId, NO keypair - completely removed for users.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DainUserAuth = void 0;
+/**
+ * DainUserAuth - JWT-only authentication for end users
+ *
+ * Users have:
+ * - JWT token (for authentication)
+ * - Smart Account ID (their unique identifier)
+ * - NO orgId, NO agentId, NO keypair
+ */
+class DainUserAuth {
+    jwt;
+    smartAccountId;
+    smartAccountPDA;
+    webhookUrl;
+    constructor(config) {
+        if (!config.jwt) {
+            throw new Error('JWT token is required for user authentication');
+        }
+        this.jwt = config.jwt;
+        // Extract smartAccountId from config or decode from JWT
+        if (config.smartAccountId) {
+            this.smartAccountId = config.smartAccountId;
+        }
+        else {
+            const payload = this.decodeJWTPayload(config.jwt);
+            this.smartAccountId = payload.smart_account_id || payload.sub;
+        }
+        this.smartAccountPDA = config.smartAccountPDA;
+        this.webhookUrl = config.webhookUrl;
+    }
+    /**
+     * Decode JWT payload (without verification)
+     */
+    decodeJWTPayload(jwt) {
+        const parts = jwt.split('.');
+        if (parts.length !== 3) {
+            throw new Error('Invalid JWT format');
+        }
+        const payload = Buffer.from(parts[1], 'base64').toString('utf-8');
+        return JSON.parse(payload);
+    }
+    /**
+     * Sign request - NOT NEEDED for JWT, returns empty
+     */
+    async signRequest(_method, _path, _body) {
+        return { signature: '', timestamp: '' };
+    }
+    /**
+     * Get headers for HTTP requests
+     */
+    getHeaders(_signature, _timestamp) {
+        const headers = {
+            "Authorization": `Bearer ${this.jwt}`,
+        };
+        if (this.smartAccountPDA) {
+            headers["X-DAIN-SMART-ACCOUNT-PDA"] = this.smartAccountPDA;
+        }
+        if (this.webhookUrl) {
+            headers["X-DAIN-WEBHOOK-URL"] = this.webhookUrl;
+        }
+        return headers;
+    }
+    /**
+     * Get the user's smart account ID
+     */
+    getSmartAccountId() {
+        return this.smartAccountId;
+    }
+    /**
+     * Get JWT token
+     */
+    getJWT() {
+        return this.jwt;
+    }
+    /**
+     * Get smart account PDA
+     */
+    getSmartAccountPDA() {
+        return this.smartAccountPDA;
+    }
+    /**
+     * Get webhook URL
+     */
+    getWebhookUrl() {
+        return this.webhookUrl;
+    }
+    /**
+     * Check if using JWT authentication (always true for users)
+     */
+    isJWT() {
+        return true;
+    }
+    /**
+     * Serialize user auth
+     */
+    serialize() {
+        const data = {
+            authMethod: 'jwt',
+            jwt: this.jwt,
+            smartAccountId: this.smartAccountId,
+            smartAccountPDA: this.smartAccountPDA,
+            webhookUrl: this.webhookUrl
+        };
+        return Buffer.from(JSON.stringify(data)).toString('base64');
+    }
+    /**
+     * Deserialize user auth
+     */
+    static deserialize(serialized) {
+        try {
+            const data = JSON.parse(Buffer.from(serialized, 'base64').toString());
+            if (data.authMethod !== 'jwt') {
+                throw new Error('Invalid auth method for user');
+            }
+            return new DainUserAuth({
+                jwt: data.jwt,
+                smartAccountId: data.smartAccountId,
+                smartAccountPDA: data.smartAccountPDA,
+                webhookUrl: data.webhookUrl
+            });
+        }
+        catch (error) {
+            throw new Error('Failed to deserialize DainUserAuth: ' + error.message);
+        }
+    }
+}
+exports.DainUserAuth = DainUserAuth;
+//# sourceMappingURL=user-auth.js.map

package/dist/client/user-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-auth.js","sourceRoot":"","sources":["../../src/client/user-auth.ts"],"names":[],"mappings":";AAAA,+BAA+B;AAC/B;;;;;GAKG;;;AAgBH;;;;;;;GAOG;AACH,MAAa,YAAY;IACf,GAAG,CAAS;IACZ,cAAc,CAAS;IACvB,eAAe,CAAU;IACzB,UAAU,CAAU;IAE5B,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QAEtB,wDAAwD;QACxD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACtC,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,GAAW;QAClC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,OAAe,EACf,KAAa,EACb,KAAa;QAEb,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,UAAkB,EAAE,UAAkB;QAC/C,MAAM,OAAO,GAA2B;YACtC,eAAe,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE;SACtC,CAAC;QAEF,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,OAAO,CAAC,0BAA0B,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC;QAC7D,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;QAClD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,SAAS;QACP,MAAM,IAAI,GAAG;YACX,UAAU,EAAE,KAAK;YACjB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,UAAkB;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAEtE,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;YAED,OAAO,IAAI,YAAY,CAAC;gBACtB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAI,KAAe,CAAC,OAAO,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;CACF;AAzID,oCAyIC"}

package/dist/service/auth.d.ts

@@ -1,48 +1,38 @@
+export declare function addressToPublicKeyBytes(address: string): Uint8Array;
+export declare function signatureToBytes(signature: string): Uint8Array;
+export declare function verifySignature(signature: string, message: string, address: string): boolean;
+export declare function sanitizeHeaders(headers: Record<string, unknown>): Record<string, string>;
+export declare function signResponse(privateKey: Uint8Array, responseBody: string): {
+    signature: string;
+    timestamp: string;
+};
+export declare function verifyResponse(publicKey: Uint8Array, responseBody: string, signature: string, timestamp: string): boolean;
+export declare function verifyRequestSignature(signature: string, method: string, path: string, headers: Record<string, string>, body: string, address: string, smartAccountPDA: string): boolean;
+export declare function isValidSolanaAddress(address: string): boolean;
 /**
- * JWT AUTHENTICATION (for users from DAIN ID)
+ * JWT payload structure from DAIN ID OAuth
  */
-export interface JWTPayload {
+export interface DainIDJWTPayload {
     sub: string;
     iss: string;
     aud: string;
     iat: number;
     exp: number;
-    scope: string[];
-    smart_account_id: string;
+    scope?: string[];
+    smart_account_id?: string;
 }
-export interface AuthResult {
-    success: boolean;
+/**
+ * JWT verification result
+ */
+export interface JWTVerificationResult {
+    valid: boolean;
+    payload?: DainIDJWTPayload;
     smartAccountId?: string;
     scope?: string[];
-    agentId?: string;
-    orgId?: string;
-    address?: string;
     error?: string;
 }
-/**
- * Verify JWT token from DAIN ID
- * This should be used with a public key fetched from DAIN ID's JWKS endpoint
- */
-export declare function verifyJWT(token: string, publicKeyOrJWKS: string | any): Promise<AuthResult>;
-/**
- * Extract Bearer token from Authorization header
- */
 export declare function extractBearerToken(authHeader: string | undefined): string | null;
-/**
- * Check if token has required scope
- */
-export declare function hasRequiredScope(tokenScopes: string[], requiredScope: string): boolean;
-/**
- * LEGACY AUTHENTICATION (for service-to-service)
- */
-export declare function addressToPublicKeyBytes(address: string): Uint8Array;
-export declare function signatureToBytes(signature: string): Uint8Array;
-export declare function verifySignature(signature: string, message: string, address: string): boolean;
-export declare function sanitizeHeaders(headers: Record<string, unknown>): Record<string, string>;
-export declare function signResponse(privateKey: Uint8Array, responseBody: string): {
-    signature: string;
-    timestamp: string;
-};
-export declare function verifyResponse(publicKey: Uint8Array, responseBody: string, signature: string, timestamp: string): boolean;
-export declare function verifyRequestSignature(signature: string, method: string, path: string, headers: Record<string, string>, body: string, address: string, smartAccountPDA?: string): boolean;
-export declare function isValidSolanaAddress(address: string): boolean;
+export declare function verifyJWT(token: string, publicKeyPEMOrUrl: string, options?: {
+    issuer?: string;
+    audience?: string;
+}): Promise<JWTVerificationResult>;

package/dist/service/auth.js

@@ -1,9 +1,6 @@
 "use strict";
 // File: src/service/auth.ts
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifyJWT = verifyJWT;
-exports.extractBearerToken = extractBearerToken;
-exports.hasRequiredScope = hasRequiredScope;
 exports.addressToPublicKeyBytes = addressToPublicKeyBytes;
 exports.signatureToBytes = signatureToBytes;
 exports.verifySignature = verifySignature;
@@ -12,82 +9,14 @@ exports.signResponse = signResponse;
 exports.verifyResponse = verifyResponse;
 exports.verifyRequestSignature = verifyRequestSignature;
 exports.isValidSolanaAddress = isValidSolanaAddress;
+exports.extractBearerToken = extractBearerToken;
+exports.verifyJWT = verifyJWT;
 const tslib_1 = require("tslib");
 const ed25519_1 = require("@noble/curves/ed25519");
 const sha256_1 = require("@noble/hashes/sha256");
 const utils_1 = require("@noble/hashes/utils");
 const bs58_1 = tslib_1.__importDefault(require("bs58"));
-/**
- * Verify JWT token from DAIN ID
- * This should be used with a public key fetched from DAIN ID's JWKS endpoint
- */
-async function verifyJWT(token, publicKeyOrJWKS) {
-    try {
-        // In a real implementation, use jsonwebtoken library
-        // For now, we'll decode without verification (services should implement proper verification)
-        const payload = JSON.parse(Buffer.from(token.split('.')[1], 'base64').toString());
-        // Verify issuer
-        if (payload.iss !== 'dainid-oauth') {
-            return {
-                success: false,
-                error: 'Invalid issuer',
-            };
-        }
-        // Verify expiration
-        const now = Math.floor(Date.now() / 1000);
-        if (payload.exp && payload.exp < now) {
-            return {
-                success: false,
-                error: 'Token expired',
-            };
-        }
-        // Extract smart account ID
-        const smartAccountId = payload.smart_account_id || payload.sub;
-        if (!smartAccountId) {
-            return {
-                success: false,
-                error: 'Missing smart_account_id',
-            };
-        }
-        return {
-            success: true,
-            smartAccountId,
-            scope: payload.scope || [],
-        };
-    }
-    catch (error) {
-        return {
-            success: false,
-            error: error instanceof Error ? error.message : 'JWT verification failed',
-        };
-    }
-}
-/**
- * Extract Bearer token from Authorization header
- */
-function extractBearerToken(authHeader) {
-    if (!authHeader || !authHeader.startsWith('Bearer ')) {
-        return null;
-    }
-    return authHeader.substring(7);
-}
-/**
- * Check if token has required scope
- */
-function hasRequiredScope(tokenScopes, requiredScope) {
-    return (tokenScopes.includes(requiredScope) ||
-        tokenScopes.includes('*') ||
-        tokenScopes.some((scope) => {
-            if (scope.endsWith('.*')) {
-                const prefix = scope.slice(0, -2);
-                return requiredScope.startsWith(prefix + '.');
-            }
-            return false;
-        }));
-}
-/**
- * LEGACY AUTHENTICATION (for service-to-service)
- */
+const jsonwebtoken_1 = tslib_1.__importDefault(require("jsonwebtoken"));
 function addressToPublicKeyBytes(address) {
     try {
         return bs58_1.default.decode(address);
@@ -125,10 +54,10 @@ function sanitizeHeaders(headers) {
         else if ((upperKey === "CONTENT-TYPE" || upperKey.startsWith("X-")) &&
             Array.isArray(value) &&
             value.length > 0) {
-            sanitizedHeaders[upperKey] = value.join(", ");
+            sanitizedHeaders[upperKey] = value.join(", "); // Convert array to comma-separated string
         }
     }
-    // Sort headers alphabetically
+    // Sort headers alphabetically by key
     const sortedSanitizedHeaders = Object.keys(sanitizedHeaders)
         .sort()
         .reduce((acc, key) => {
@@ -155,12 +84,14 @@ function verifyResponse(publicKey, responseBody, signature, timestamp) {
     }
 }
 function verifyRequestSignature(signature, method, path, headers, body, address, smartAccountPDA) {
+    //TODO smartAccountPDA check
     const timestamp = headers["X-DAIN-TIMESTAMP"];
     if (!timestamp) {
         return false;
     }
-    // Remove signature headers before verification
+    // remove x-dain-timestamp from headers
     delete headers["X-DAIN-TIMESTAMP"];
+    //delete the signature from headers
     delete headers["X-DAIN-SIGNATURE"];
     const message = `${method.toUpperCase()}:${path}:${timestamp}:${body ? body : "{}"}`;
     return verifySignature(signature, message, address);
@@ -174,4 +105,72 @@ function isValidSolanaAddress(address) {
         return false;
     }
 }
+// Simple JWKS cache (public key strings)
+const jwksCache = new Map();
+const CACHE_TTL = 3600000; // 1 hour
+function extractBearerToken(authHeader) {
+    if (!authHeader)
+        return null;
+    const parts = authHeader.split(" ");
+    if (parts.length !== 2 || parts[0] !== "Bearer")
+        return null;
+    return parts[1];
+}
+/**
+ * Fetch public key from JWKS endpoint (with caching)
+ */
+async function fetchPublicKey(dainIdUrl) {
+    // Check cache
+    const cached = jwksCache.get(dainIdUrl);
+    if (cached && Date.now() - cached.timestamp < CACHE_TTL) {
+        return cached.publicKey;
+    }
+    // Fetch JWKS
+    const jwksUrl = `${dainIdUrl}/api/oauth/.well-known/jwks.json`;
+    const response = await fetch(jwksUrl);
+    if (!response.ok) {
+        throw new Error(`Failed to fetch JWKS: ${response.statusText}`);
+    }
+    const jwks = await response.json();
+    const key = jwks.keys[0]; // Use first key
+    // Convert JWK to PEM
+    const publicKey = jwkToPem(key);
+    // Cache it
+    jwksCache.set(dainIdUrl, { publicKey, timestamp: Date.now() });
+    return publicKey;
+}
+/**
+ * Convert JWK to PEM format (simple RSA only)
+ */
+function jwkToPem(jwk) {
+    const crypto = require("crypto");
+    const keyObject = crypto.createPublicKey({ key: jwk, format: "jwk" });
+    return keyObject.export({ type: "spki", format: "pem" });
+}
+async function verifyJWT(token, publicKeyPEMOrUrl, options) {
+    try {
+        // Fetch public key if URL provided
+        const publicKey = publicKeyPEMOrUrl.startsWith("http")
+            ? await fetchPublicKey(publicKeyPEMOrUrl)
+            : publicKeyPEMOrUrl;
+        // Verify JWT
+        const payload = jsonwebtoken_1.default.verify(token, publicKey, {
+            algorithms: ["RS256"],
+            issuer: options?.issuer,
+            audience: options?.audience,
+        });
+        return {
+            valid: true,
+            payload,
+            smartAccountId: payload.smart_account_id || payload.sub,
+            scope: payload.scope || [],
+        };
+    }
+    catch (error) {
+        return {
+            valid: false,
+            error: error instanceof Error ? error.message : "Invalid token",
+        };
+    }
+}
 //# sourceMappingURL=auth.js.map

package/dist/service/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/service/auth.ts"],"names":[],"mappings":";AAAA,4BAA4B;;AAmC5B,8BAgDC;AAKD,gDAKC;AAKD,4CAeC;AAMD,0DAMC;AAED,4CAKC;AAED,0CAeC;AAED,0CA8BC;AAED,oCAaC;AAED,wCAmBC;AAED,wDAuBC;AAED,oDAOC;;AAzPD,mDAAgD;AAChD,iDAA8C;AAC9C,+CAA0E;AAC1E,wDAAwB;AA0BxB;;;GAGG;AACI,KAAK,UAAU,SAAS,CAC7B,KAAa,EACb,eAA6B;IAE7B,IAAI,CAAC;QACH,qDAAqD;QACrD,6FAA6F;QAC7F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CACxC,CAAC;QAEhB,gBAAgB;QAChB,IAAI,OAAO,CAAC,GAAG,KAAK,cAAc,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,gBAAgB;aACxB,CAAC;QACJ,CAAC;QAED,oBAAoB;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;YACrC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;aACvB,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC;QAC/D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,0BAA0B;aAClC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,cAAc;YACd,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;SAC3B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB;SAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,UAA8B;IAC/D,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAC9B,WAAqB,EACrB,aAAqB;IAErB,OAAO,CACL,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC;QACnC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;QACzB,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACzB,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAClC,OAAO,aAAa,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;GAEG;AAEH,SAAgB,uBAAuB,CAAC,OAAe;IACrD,IAAI,CAAC;QACH,OAAO,cAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB,CAAC,SAAiB;IAChD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAA,kBAAU,EAAC,SAAS,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,eAAe,CAC7B,SAAiB,EACjB,OAAe,EACf,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,cAAc,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,IAAA,eAAM,EAAC,OAAO,CAAC,CAAC;QAEpC,OAAO,iBAAO,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAgB,eAAe,CAC7B,OAAgC;IAEhC,MAAM,gBAAgB,GAA2B,EAAE,CAAC;IAEpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,IACE,CAAC,QAAQ,KAAK,cAAc,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC1D,OAAO,KAAK,KAAK,QAAQ,EACzB,CAAC;YACD,gBAAgB,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QACrC,CAAC;aAAM,IACL,CAAC,QAAQ,KAAK,cAAc,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC1D,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACpB,KAAK,CAAC,MAAM,GAAG,CAAC,EAChB,CAAC;YACD,gBAAgB,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,sBAAsB,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;SACzD,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnB,GAAG,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC;IACb,CAAC,EAAE,EAA4B,CAAC,CAAC;IAEnC,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED,SAAgB,YAAY,CAC1B,UAAsB,EACtB,YAAoB;IAEpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,IAAA,eAAM,EACxB,IAAA,mBAAW,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpC,CACF,CAAC;IACF,MAAM,SAAS,GAAG,iBAAO,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACxD,OAAO,EAAE,SAAS,EAAE,IAAA,kBAAU,EAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;AACzD,CAAC;AAED,SAAgB,cAAc,CAC5B,SAAqB,EACrB,YAAoB,EACpB,SAAiB,EACjB,SAAiB;IAEjB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAA,eAAM,EACxB,IAAA,mBAAW,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpC,CACF,CAAC;QACF,MAAM,cAAc,GAAG,IAAA,kBAAU,EAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,iBAAO,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAgB,sBAAsB,CACpC,SAAiB,EACjB,MAAc,EACd,IAAY,EACZ,OAA+B,EAC/B,IAAY,EACZ,OAAe,EACf,eAAwB;IAExB,MAAM,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+CAA+C;IAC/C,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnC,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEnC,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,SAAS,IAC1D,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAChB,EAAE,CAAC;IAEH,OAAO,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACtD,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAe;IAClD,IAAI,CAAC;QACH,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/service/auth.ts"],"names":[],"mappings":";AAAA,4BAA4B;;AAQ5B,0DAMC;AAED,4CAKC;AAED,0CAeC;AAED,0CA8BC;AACD,oCAaC;AAED,wCAmBC;AACD,wDA4BC;AAED,oDAOC;AAkCD,gDAKC;AAwCD,8BA8BC;;AA1PD,mDAAgD;AAChD,iDAA8C;AAC9C,+CAA0E;AAC1E,wDAAwB;AACxB,wEAA+B;AAE/B,SAAgB,uBAAuB,CAAC,OAAe;IACrD,IAAI,CAAC;QACH,OAAO,cAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB,CAAC,SAAiB;IAChD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAA,kBAAU,EAAC,SAAS,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,eAAe,CAC7B,SAAiB,EACjB,OAAe,EACf,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,cAAc,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,IAAA,eAAM,EAAC,OAAO,CAAC,CAAC;QAEpC,OAAO,iBAAO,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAgB,eAAe,CAC7B,OAAgC;IAEhC,MAAM,gBAAgB,GAA2B,EAAE,CAAC;IAEpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,IACE,CAAC,QAAQ,KAAK,cAAc,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC1D,OAAO,KAAK,KAAK,QAAQ,EACzB,CAAC;YACD,gBAAgB,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QACrC,CAAC;aAAM,IACL,CAAC,QAAQ,KAAK,cAAc,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC1D,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACpB,KAAK,CAAC,MAAM,GAAG,CAAC,EAChB,CAAC;YACD,gBAAgB,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,0CAA0C;QAC3F,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,sBAAsB,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;SACzD,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnB,GAAG,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC;IACb,CAAC,EAAE,EAA4B,CAAC,CAAC;IAEnC,OAAO,sBAAsB,CAAC;AAChC,CAAC;AACD,SAAgB,YAAY,CAC1B,UAAsB,EACtB,YAAoB;IAEpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,IAAA,eAAM,EACxB,IAAA,mBAAW,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpC,CACF,CAAC;IACF,MAAM,SAAS,GAAG,iBAAO,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACxD,OAAO,EAAE,SAAS,EAAE,IAAA,kBAAU,EAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;AACzD,CAAC;AAED,SAAgB,cAAc,CAC5B,SAAqB,EACrB,YAAoB,EACpB,SAAiB,EACjB,SAAiB;IAEjB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAA,eAAM,EACxB,IAAA,mBAAW,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpC,CACF,CAAC;QACF,MAAM,cAAc,GAAG,IAAA,kBAAU,EAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,iBAAO,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,SAAgB,sBAAsB,CACpC,SAAiB,EACjB,MAAc,EACd,IAAY,EACZ,OAA+B,EAC/B,IAAY,EACZ,OAAe,EACf,eAAuB;IAEvB,4BAA4B;IAE5B,MAAM,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uCAAuC;IAEvC,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnC,mCAAmC;IAEnC,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEnC,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,SAAS,IAC1D,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAChB,EAAE,CAAC;IAEH,OAAO,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACtD,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAe;IAClD,IAAI,CAAC;QACH,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AA8BD,yCAAyC;AACzC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoD,CAAC;AAC9E,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,SAAS;AAEpC,SAAgB,kBAAkB,CAAC,UAA8B;IAC/D,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,cAAc,CAAC,SAAiB;IAC7C,cAAc;IACd,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,SAAS,EAAE,CAAC;QACxD,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAED,aAAa;IACb,MAAM,OAAO,GAAG,GAAG,SAAS,kCAAkC,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IAEtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB;IAE1C,qBAAqB;IACrB,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAEhC,WAAW;IACX,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,GAAQ;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,OAAO,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;AACrE,CAAC;AAEM,KAAK,UAAU,SAAS,CAC7B,KAAa,EACb,iBAAyB,EACzB,OAAgD;IAEhD,IAAI,CAAC;QACH,mCAAmC;QACnC,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC;YACpD,CAAC,CAAC,MAAM,cAAc,CAAC,iBAAiB,CAAC;YACzC,CAAC,CAAC,iBAAiB,CAAC;QAEtB,aAAa;QACb,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE;YAC3C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,OAAO,EAAE,MAAM;YACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;SAC5B,CAAqB,CAAC;QAEvB,OAAO;YACL,KAAK,EAAE,IAAI;YACX,OAAO;YACP,cAAc,EAAE,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG;YACvD,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;SAC3B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAChE,CAAC;IACJ,CAAC;AACH,CAAC"}