@dynamic-labs-wallet/node 1.0.60 → 1.0.61

package/index.cjs

@@ -8,6 +8,7 @@ var logger = require('@dynamic-labs/logger');
 var forwardMpcClient = require('@dynamic-labs-wallet/forward-mpc-client');
 var uuid = require('uuid');
 var crypto = require('node:crypto');
+var sdkApiCore = require('@dynamic-labs/sdk-api-core');
 
 // Removed duplicate exports - these are already exported from #internal/core
 const getMPCSignatureScheme = ({ signingAlgorithm, baseRelayUrl = core$1.MPC_RELAY_PROD_API_URL })=>{
@@ -314,7 +315,7 @@ const CEREMONY_COMPLETE_WAIT_MS = 5000;
 class DynamicWalletClient {
     ensureApiClientAuthenticated() {
         if (!this.isApiClientAuthenticated) {
-            throw new Error('Client must be authenticated before making API calls. Call authenticateApiToken first.');
+            throw new Error('Client must be authenticated before making API calls. Call authenticateApiToken or authenticateJwt first.');
         }
     }
     /**
@@ -344,6 +345,24 @@ class DynamicWalletClient {
             throw new Error('accountAddress mismatch: parameter does not match walletMetadata.accountAddress. ' + 'Pass them consistently — preferably read from walletMetadata.accountAddress.');
         }
     }
+    /**
+   * Installs a Dynamic JWT as the bearer token for all subsequent API calls
+   * and rebuilds the API client, preserving the forward-MPC client.
+   */ setAuthenticatedJwt(jwt) {
+        this.baseJWTAuthToken = jwt;
+        this.apiClient = new core$1.DynamicApiClient({
+            environmentId: this.environmentId,
+            authToken: jwt,
+            baseApiUrl: this.baseApiUrl,
+            forwardMPCClient: this.resolvedForwardMPCClient,
+            logger: this.logger
+        });
+        this.isApiClientAuthenticated = true;
+        // Auth context changed — drop session-scoped nonces from the prior session.
+        this.nonceCache.length = 0;
+        this.nonceRefill = undefined;
+        this.nonceAuthGeneration += 1;
+    }
     async authenticateApiToken(authToken) {
         const tmpClient = new core$1.DynamicApiClient({
             environmentId: this.environmentId,
@@ -354,16 +373,95 @@ class DynamicWalletClient {
         const response = await tmpClient.authenticateApiToken({
             environmentId: this.environmentId
         });
-        const jwtTokenAuth = response.data.encodedJwts.minifiedJwt;
-        this.baseJWTAuthToken = jwtTokenAuth;
-        this.apiClient = new core$1.DynamicApiClient({
-            environmentId: this.environmentId,
-            authToken: jwtTokenAuth,
-            baseApiUrl: this.baseApiUrl,
-            forwardMPCClient: this.resolvedForwardMPCClient,
-            logger: this.logger
-        });
-        this.isApiClientAuthenticated = true;
+        this.setAuthenticatedJwt(response.data.encodedJwts.minifiedJwt);
+        this.getSessionSignature = undefined; // drop any signer left from a prior authenticateJwt
+    }
+    /**
+   * Authenticates the client with a Dynamic user JWT obtained outside the SDK —
+   * e.g. by an agent that completed a Dynamic sign-in (external auth, email OTP)
+   * on behalf of a user. Unlike authenticateApiToken, no token exchange happens:
+   * the JWT is used directly as the bearer token. The server validates it on
+   * every request; this method only checks the token's structure.
+   *
+   * `options.getSessionSignature` must return the signature as lowercase hex
+   * (raw ECDSA r‖s, as produced by `signSessionMessage`). Other encodings —
+   * notably base64, which can contain `/` — corrupt the `/`-delimited
+   * signed-session composite sent to the keyshares relay.
+   */ async authenticateJwt(jwt, options) {
+        const segments = jwt.split('.');
+        if (segments.length !== 3 || segments.some((segment)=>segment.length === 0)) {
+            throw new Error('Invalid JWT: expected a compact JWS with three dot-separated segments');
+        }
+        this.setAuthenticatedJwt(jwt);
+        this.getSessionSignature = options == null ? void 0 : options.getSessionSignature;
+    }
+    async buildSignedSessionId() {
+        if (!this.getSessionSignature) {
+            throw new Error('Session signature callback not configured');
+        }
+        if (!this.baseJWTAuthToken) {
+            throw new Error('Client is not authenticated');
+        }
+        let payload;
+        try {
+            payload = JSON.parse(Buffer.from(this.baseJWTAuthToken.split('.')[1], 'base64url').toString());
+        } catch (e) {
+            throw new Error('JWT payload is not a valid JSON object');
+        }
+        if (typeof payload !== 'object' || payload === null || Array.isArray(payload)) {
+            throw new Error('JWT payload is not a valid JSON object');
+        }
+        const parsedPayload = payload;
+        const sid = parsedPayload.sid;
+        if (typeof sid !== 'string' || sid.length === 0) {
+            throw new Error('JWT is missing a valid sid claim required for the signed session');
+        }
+        const nonce = await this.takeNonce();
+        const [sidSig, nonceSig] = await Promise.all([
+            this.getSessionSignature(sid),
+            this.getSessionSignature(nonce)
+        ]);
+        return `${sidSig}/${nonceSig}/${nonce}`;
+    }
+    // Nonces are single-use; fetch them in batches and hand out one per signed
+    // session so we don't round-trip to the relay on every signature.
+    async takeNonce() {
+        for(;;){
+            const cached = this.nonceCache.shift();
+            if (cached) return cached;
+            // Cache empty (initial, depleted, or drained by concurrent callers): refill
+            // once (coalesced) and retry. Only the server returning no nonces is an error.
+            // A refill that lands after a re-auth belongs to the old session — drop it
+            // (and leave the new session's refill slot alone) so stale nonces are never used.
+            const generation = this.nonceAuthGeneration;
+            var _this_nonceRefill;
+            (_this_nonceRefill = this.nonceRefill) != null ? _this_nonceRefill : this.nonceRefill = this.apiClient.getNonces({
+                count: this.nonceBatchSize
+            }).then(({ nonces })=>{
+                if (!(nonces == null ? void 0 : nonces.length)) throw new Error('No session nonce available');
+                if (generation === this.nonceAuthGeneration) this.nonceCache.push(...nonces);
+            }).finally(()=>{
+                if (generation === this.nonceAuthGeneration) this.nonceRefill = undefined;
+            });
+            await this.nonceRefill;
+        }
+    }
+    /**
+   * Refreshes the Dynamic JWT using the current session and installs the new
+   * token for all subsequent API calls. Returns the new JWT so callers can
+   * persist it. The server enforces a hard refresh limit (the JWT's
+   * `refreshExp` claim) — once reached, this rejects with a 401 and the user
+   * must re-authenticate.
+   */ async refreshAuthToken() {
+        this.ensureApiClientAuthenticated();
+        const data = await this.apiClient.refreshUser();
+        var _data_minifiedJwt;
+        const refreshedJwt = (_data_minifiedJwt = data == null ? void 0 : data.minifiedJwt) != null ? _data_minifiedJwt : data == null ? void 0 : data.jwt;
+        if (typeof refreshedJwt !== 'string' || refreshedJwt.length === 0) {
+            throw new Error('Token refresh returned no JWT. The environment may be configured for cookie-based auth; agent flows require header-based JWTs.');
+        }
+        this.setAuthenticatedJwt(refreshedJwt);
+        return refreshedJwt;
     }
     /**
    * Fetches non-sensitive wallet identity (walletId, accountAddress, chainName,
@@ -1350,6 +1448,7 @@ class DynamicWalletClient {
             // Upload first share to Dynamic if requested
             if (backUpToDynamic) {
                 const keyShareToBackupToDynamic = keySharesToBackup[0];
+                const signedSessionId = this.getSessionSignature ? await this.buildSignedSessionId() : undefined;
                 const data = await this.apiClient.storeEncryptedBackupByWallet({
                     walletId,
                     shareSetId: resolvedShareSetId,
@@ -1358,7 +1457,8 @@ class DynamicWalletClient {
                     ],
                     passwordEncrypted: passwordEncryptedFlag,
                     encryptionVersion: ENCRYPTION_VERSION_CURRENT,
-                    requiresSignedSessionId: false,
+                    signedSessionId,
+                    requiresSignedSessionId: Boolean(this.getSessionSignature),
                     dynamicRequestId
                 });
                 const keygenId = await this.getExportId({
@@ -1605,11 +1705,13 @@ class DynamicWalletClient {
             this.logger.debug('No DYNAMIC shares available for recovery');
             return [];
         }
+        const signedSessionId = this.getSessionSignature ? await this.buildSignedSessionId() : undefined;
         const data = await this.apiClient.recoverEncryptedBackupByWallet({
             walletId,
             shareSetId: walletMetadata.shareSetId,
             externalKeyShareIds: dynamicKeyShareIds,
-            requiresSignedSessionId: false
+            signedSessionId,
+            requiresSignedSessionId: Boolean(this.getSessionSignature)
         });
         const dynamicKeyShares = data.keyShares.filter((keyShare)=>keyShare.encryptedAccountCredential !== null && keyShare.backupLocation === core$1.BackupLocation.DYNAMIC);
         var _externalServerKeySharesBackupInfo_passwordEncrypted;
@@ -1819,6 +1921,11 @@ class DynamicWalletClient {
     constructor({ environmentId, baseApiUrl, baseMPCRelayApiUrl, debug, forwardMPCClient, enableMPCAccelerator = true, logger: logger$1 }){
         this.isApiClientAuthenticated = false;
         this.forwardMPCEnabled = true;
+        // The nonces endpoint caps count at 5 (400 "query/count must be <= 5" above that).
+        this.nonceBatchSize = 5;
+        this.nonceCache = [];
+        // Bumped on every re-auth so an in-flight refill from a prior session is discarded.
+        this.nonceAuthGeneration = 0;
         if (logger$1) {
             this.logger = logger$1;
         } else {
@@ -1856,6 +1963,67 @@ class DynamicWalletClient {
     }
 }
 
+const subtle = crypto.webcrypto.subtle;
+const ALGO = {
+    name: 'ECDSA',
+    namedCurve: 'P-256'
+};
+const SIGN_ALGO = {
+    name: 'ECDSA',
+    hash: 'SHA-256'
+};
+/** Compress a 65-byte uncompressed SEC1 P-256 point to 33-byte compressed lowercase hex. */ const compress = (raw)=>{
+    if (raw.length !== 65 || raw[0] !== 0x04) {
+        throw new Error('expected a 65-byte uncompressed P-256 public key');
+    }
+    const x = Buffer.from(raw.slice(1, 33));
+    const prefix = (raw[64] & 1) === 0 ? 0x02 : 0x03;
+    return Buffer.concat([
+        Buffer.from([
+            prefix
+        ]),
+        x
+    ]).toString('hex');
+};
+/**
+ * Generates a P-256 session key pair for the signed-session flow.
+ *
+ * Returns the compressed public-key hex (bind it into the Dynamic JWT via the
+ * `x-dyn-session-public-key` header when you sign in) and the private JWK.
+ *
+ * Stateless and custody-agnostic: the SDK does NOT persist the key. YOU store
+ * `privateKeyJwk` wherever you keep secrets. The returned JWK is extractable
+ * (so it can be handed back to you) and is therefore a convenience path, not a
+ * security boundary — if you need a non-extractable key (so a host/operator
+ * cannot exfiltrate it), generate it in a KMS/HSM/enclave instead and supply a
+ * `getSessionSignature` that signs there.
+ */ async function generateSessionKeyPair() {
+    const keyPair = await subtle.generateKey(ALGO, true, [
+        'sign',
+        'verify'
+    ]);
+    const rawPublicKey = await subtle.exportKey('raw', keyPair.publicKey);
+    const exportedJwk = await subtle.exportKey('jwk', keyPair.privateKey);
+    const privateKeyJwk = exportedJwk;
+    return {
+        publicKeyHex: compress(new Uint8Array(rawPublicKey)),
+        privateKeyJwk
+    };
+}
+/**
+ * Signs a message with a P-256 session private JWK using the exact encoding the
+ * keyshares relay expects: ECDSA P-256 / SHA-256 over UTF-8(message), raw r‖s
+ * (64 bytes), lowercase hex. Use it to implement `getSessionSignature`:
+ *   getSessionSignature: (message) => signSessionMessage(message, privateKeyJwk)
+ * The JWK is imported non-extractable for signing.
+ */ async function signSessionMessage(message, privateKeyJwk) {
+    const key = await subtle.importKey('jwk', privateKeyJwk, ALGO, false, [
+        'sign'
+    ]);
+    const signature = await subtle.sign(SIGN_ALGO, key, new TextEncoder().encode(message));
+    return Buffer.from(new Uint8Array(signature)).toString('hex');
+}
+
 const createCore = ({ environmentId, baseApiUrl, baseMPCRelayApiUrl, debug = false, logger: logger$1 })=>{
     let coreLogger;
     if (logger$1) {
@@ -2048,6 +2216,141 @@ function decryptDelegatedWebhookData({ privateKeyPem, encryptedDelegatedKeyShare
     }
 }
 
+const toAuthResult = (response)=>{
+    var _response_user;
+    if (response.mfaToken && !response.minifiedJwt && !response.jwt) {
+        throw new Error('account requires MFA, which the headless auth client does not support');
+    }
+    var _response_minifiedJwt;
+    const jwt = (_response_minifiedJwt = response.minifiedJwt) != null ? _response_minifiedJwt : response.jwt;
+    if (!jwt) {
+        throw new Error('sign-in returned no JWT in the response body; the environment likely uses cookie auth, which headless clients cannot consume');
+    }
+    return {
+        jwt,
+        expiresAt: response.expiresAt,
+        userId: (_response_user = response.user) == null ? void 0 : _response_user.id
+    };
+};
+// The sdk-api-core runtime throws the raw fetch Response on non-2xx; duck-type it.
+const httpStatus = (error)=>!(error instanceof Error) && typeof error === 'object' && error !== null && 'status' in error && typeof error.status === 'number' ? error.status : undefined;
+const readServerError = async (error)=>{
+    try {
+        const text = await error.text();
+        const parsed = JSON.parse(text);
+        return typeof parsed.error === 'string' ? parsed.error : undefined;
+    } catch (e) {
+        return undefined;
+    }
+};
+const asAuthError = async (error, operation)=>{
+    const status = httpStatus(error);
+    if (status !== undefined) {
+        if (status === 401) return new Error(`${operation} failed: the code or signature is invalid or expired`);
+        const serverError = await readServerError(error);
+        const detail = serverError ? `${serverError} (status ${status})` : `status ${status}`;
+        return new Error(`${operation} failed: ${detail}`);
+    }
+    return error instanceof Error ? error : new Error(String(error));
+};
+/**
+ * Headless auth client: mints a Dynamic user JWT (email OTP or SIWE) for use
+ * with authenticateJwt. Holds configuration only — no secrets, no persistence.
+ */ function createAuthClient(options) {
+    const { environmentId } = options;
+    var _options_baseUrl;
+    const baseUrl = ((_options_baseUrl = options.baseUrl) != null ? _options_baseUrl : core$1.DYNAMIC_AUTH_PROD_BASE_API_URL).replace(/\/$/, '');
+    const api = new sdkApiCore.SDKApi(new sdkApiCore.Configuration({
+        basePath: `${baseUrl}/api/v0`,
+        // Makes the backend return the JWT in the body instead of an httpOnly cookie.
+        headers: {
+            'x-dynamic-platform': 'react-native'
+        },
+        fetchApi: options.fetchApi
+    }));
+    return {
+        email: {
+            async sendOtp (email) {
+                try {
+                    const { verificationUUID } = await api.createEmailVerification({
+                        environmentId,
+                        emailVerificationCreateRequest: {
+                            email
+                        }
+                    });
+                    return {
+                        verificationUUID
+                    };
+                } catch (error) {
+                    throw await asAuthError(error, 'email OTP request');
+                }
+            },
+            async verifyOtp ({ verificationUUID, code, sessionPublicKeyHex }) {
+                try {
+                    const response = await api.signInWithEmailVerification({
+                        environmentId,
+                        emailVerificationVerifyRequest: {
+                            verificationUUID,
+                            verificationToken: code,
+                            sessionPublicKey: sessionPublicKeyHex
+                        }
+                    });
+                    return toAuthResult(response);
+                } catch (error) {
+                    throw await asAuthError(error, 'email OTP sign-in');
+                }
+            }
+        },
+        siwe: {
+            async getNonce () {
+                try {
+                    const { nonce } = await api.getNonce({
+                        environmentId
+                    });
+                    if (!nonce) throw new Error('nonce endpoint returned no nonce');
+                    return {
+                        nonce
+                    };
+                } catch (error) {
+                    throw await asAuthError(error, 'SIWE nonce request');
+                }
+            },
+            createMessage (params) {
+                const header = `${params.domain} wants you to sign in with your Ethereum account:`;
+                var _params_issuedAt;
+                const fields = [
+                    `URI: ${params.uri}`,
+                    'Version: 1',
+                    `Chain ID: ${params.chainId}`,
+                    `Nonce: ${params.nonce}`,
+                    `Issued At: ${(_params_issuedAt = params.issuedAt) != null ? _params_issuedAt : new Date().toISOString()}`
+                ].join('\n');
+                const statement = params.statement ? `${params.statement}\n\n` : '';
+                return `${header}\n${params.address}\n\n${statement}${fields}`;
+            },
+            async verify ({ message, signature, walletAddress, sessionPublicKeyHex, walletName = 'unknown', walletProvider = sdkApiCore.WalletProviderEnum.BrowserExtension, chain = sdkApiCore.ChainEnum.Evm }) {
+                try {
+                    const response = await api.verify({
+                        environmentId,
+                        verifyRequest: {
+                            messageToSign: message,
+                            signedMessage: signature,
+                            publicWalletAddress: walletAddress,
+                            chain,
+                            walletName,
+                            walletProvider,
+                            sessionPublicKey: sessionPublicKeyHex
+                        }
+                    });
+                    return toAuthResult(response);
+                } catch (error) {
+                    throw await asAuthError(error, 'SIWE sign-in');
+                }
+            }
+        }
+    };
+}
+
 Object.defineProperty(exports, "SOLANA_RPC_URL", {
   enumerable: true,
   get: function () { return core$1.SOLANA_RPC_URL; }
@@ -2067,6 +2370,7 @@ Object.defineProperty(exports, "getMPCChainConfig", {
 exports.DynamicWalletClient = DynamicWalletClient;
 exports.base64ToBytes = base64ToBytes;
 exports.bytesToBase64 = bytesToBase64;
+exports.createAuthClient = createAuthClient;
 exports.createDelegatedWalletClient = createDelegatedWalletClient;
 exports.createLogError = createLogError;
 exports.decryptDelegatedWebhookData = decryptDelegatedWebhookData;
@@ -2074,6 +2378,7 @@ exports.delegatedSignMessage = delegatedSignMessage;
 exports.ensureBase64Padding = ensureBase64Padding;
 exports.formatEvmMessage = formatEvmMessage;
 exports.formatMessage = formatMessage;
+exports.generateSessionKeyPair = generateSessionKeyPair;
 exports.getExternalServerKeyShareBackupInfo = getExternalServerKeyShareBackupInfo;
 exports.getMPCSignatureScheme = getMPCSignatureScheme;
 exports.getMPCSigner = getMPCSigner;
@@ -2082,6 +2387,7 @@ exports.logError = logError;
 exports.mergeUniqueKeyShares = mergeUniqueKeyShares;
 exports.retryPromise = retryPromise;
 exports.revokeDelegation = revokeDelegation;
+exports.signSessionMessage = signSessionMessage;
 exports.stringToBytes = stringToBytes;
 exports.stripHexPrefix = stripHexPrefix;
 Object.keys(core).forEach(function (k) {

package/index.esm.js

@@ -6,7 +6,8 @@ import { BIP340, ExportableEd25519, Ecdsa, MessageHash, EcdsaSignature, EcdsaKey
 import { Logger as Logger$1 } from '@dynamic-labs/logger';
 import { ForwardMPCClientV2 } from '@dynamic-labs-wallet/forward-mpc-client';
 import { v4 } from 'uuid';
-import crypto from 'node:crypto';
+import crypto, { webcrypto } from 'node:crypto';
+import { SDKApi, Configuration, WalletProviderEnum, ChainEnum } from '@dynamic-labs/sdk-api-core';
 
 // Removed duplicate exports - these are already exported from #internal/core
 const getMPCSignatureScheme = ({ signingAlgorithm, baseRelayUrl = MPC_RELAY_PROD_API_URL })=>{
@@ -313,7 +314,7 @@ const CEREMONY_COMPLETE_WAIT_MS = 5000;
 class DynamicWalletClient {
     ensureApiClientAuthenticated() {
         if (!this.isApiClientAuthenticated) {
-            throw new Error('Client must be authenticated before making API calls. Call authenticateApiToken first.');
+            throw new Error('Client must be authenticated before making API calls. Call authenticateApiToken or authenticateJwt first.');
         }
     }
     /**
@@ -343,6 +344,24 @@ class DynamicWalletClient {
             throw new Error('accountAddress mismatch: parameter does not match walletMetadata.accountAddress. ' + 'Pass them consistently — preferably read from walletMetadata.accountAddress.');
         }
     }
+    /**
+   * Installs a Dynamic JWT as the bearer token for all subsequent API calls
+   * and rebuilds the API client, preserving the forward-MPC client.
+   */ setAuthenticatedJwt(jwt) {
+        this.baseJWTAuthToken = jwt;
+        this.apiClient = new DynamicApiClient({
+            environmentId: this.environmentId,
+            authToken: jwt,
+            baseApiUrl: this.baseApiUrl,
+            forwardMPCClient: this.resolvedForwardMPCClient,
+            logger: this.logger
+        });
+        this.isApiClientAuthenticated = true;
+        // Auth context changed — drop session-scoped nonces from the prior session.
+        this.nonceCache.length = 0;
+        this.nonceRefill = undefined;
+        this.nonceAuthGeneration += 1;
+    }
     async authenticateApiToken(authToken) {
         const tmpClient = new DynamicApiClient({
             environmentId: this.environmentId,
@@ -353,16 +372,95 @@ class DynamicWalletClient {
         const response = await tmpClient.authenticateApiToken({
             environmentId: this.environmentId
         });
-        const jwtTokenAuth = response.data.encodedJwts.minifiedJwt;
-        this.baseJWTAuthToken = jwtTokenAuth;
-        this.apiClient = new DynamicApiClient({
-            environmentId: this.environmentId,
-            authToken: jwtTokenAuth,
-            baseApiUrl: this.baseApiUrl,
-            forwardMPCClient: this.resolvedForwardMPCClient,
-            logger: this.logger
-        });
-        this.isApiClientAuthenticated = true;
+        this.setAuthenticatedJwt(response.data.encodedJwts.minifiedJwt);
+        this.getSessionSignature = undefined; // drop any signer left from a prior authenticateJwt
+    }
+    /**
+   * Authenticates the client with a Dynamic user JWT obtained outside the SDK —
+   * e.g. by an agent that completed a Dynamic sign-in (external auth, email OTP)
+   * on behalf of a user. Unlike authenticateApiToken, no token exchange happens:
+   * the JWT is used directly as the bearer token. The server validates it on
+   * every request; this method only checks the token's structure.
+   *
+   * `options.getSessionSignature` must return the signature as lowercase hex
+   * (raw ECDSA r‖s, as produced by `signSessionMessage`). Other encodings —
+   * notably base64, which can contain `/` — corrupt the `/`-delimited
+   * signed-session composite sent to the keyshares relay.
+   */ async authenticateJwt(jwt, options) {
+        const segments = jwt.split('.');
+        if (segments.length !== 3 || segments.some((segment)=>segment.length === 0)) {
+            throw new Error('Invalid JWT: expected a compact JWS with three dot-separated segments');
+        }
+        this.setAuthenticatedJwt(jwt);
+        this.getSessionSignature = options == null ? void 0 : options.getSessionSignature;
+    }
+    async buildSignedSessionId() {
+        if (!this.getSessionSignature) {
+            throw new Error('Session signature callback not configured');
+        }
+        if (!this.baseJWTAuthToken) {
+            throw new Error('Client is not authenticated');
+        }
+        let payload;
+        try {
+            payload = JSON.parse(Buffer.from(this.baseJWTAuthToken.split('.')[1], 'base64url').toString());
+        } catch (e) {
+            throw new Error('JWT payload is not a valid JSON object');
+        }
+        if (typeof payload !== 'object' || payload === null || Array.isArray(payload)) {
+            throw new Error('JWT payload is not a valid JSON object');
+        }
+        const parsedPayload = payload;
+        const sid = parsedPayload.sid;
+        if (typeof sid !== 'string' || sid.length === 0) {
+            throw new Error('JWT is missing a valid sid claim required for the signed session');
+        }
+        const nonce = await this.takeNonce();
+        const [sidSig, nonceSig] = await Promise.all([
+            this.getSessionSignature(sid),
+            this.getSessionSignature(nonce)
+        ]);
+        return `${sidSig}/${nonceSig}/${nonce}`;
+    }
+    // Nonces are single-use; fetch them in batches and hand out one per signed
+    // session so we don't round-trip to the relay on every signature.
+    async takeNonce() {
+        for(;;){
+            const cached = this.nonceCache.shift();
+            if (cached) return cached;
+            // Cache empty (initial, depleted, or drained by concurrent callers): refill
+            // once (coalesced) and retry. Only the server returning no nonces is an error.
+            // A refill that lands after a re-auth belongs to the old session — drop it
+            // (and leave the new session's refill slot alone) so stale nonces are never used.
+            const generation = this.nonceAuthGeneration;
+            var _this_nonceRefill;
+            (_this_nonceRefill = this.nonceRefill) != null ? _this_nonceRefill : this.nonceRefill = this.apiClient.getNonces({
+                count: this.nonceBatchSize
+            }).then(({ nonces })=>{
+                if (!(nonces == null ? void 0 : nonces.length)) throw new Error('No session nonce available');
+                if (generation === this.nonceAuthGeneration) this.nonceCache.push(...nonces);
+            }).finally(()=>{
+                if (generation === this.nonceAuthGeneration) this.nonceRefill = undefined;
+            });
+            await this.nonceRefill;
+        }
+    }
+    /**
+   * Refreshes the Dynamic JWT using the current session and installs the new
+   * token for all subsequent API calls. Returns the new JWT so callers can
+   * persist it. The server enforces a hard refresh limit (the JWT's
+   * `refreshExp` claim) — once reached, this rejects with a 401 and the user
+   * must re-authenticate.
+   */ async refreshAuthToken() {
+        this.ensureApiClientAuthenticated();
+        const data = await this.apiClient.refreshUser();
+        var _data_minifiedJwt;
+        const refreshedJwt = (_data_minifiedJwt = data == null ? void 0 : data.minifiedJwt) != null ? _data_minifiedJwt : data == null ? void 0 : data.jwt;
+        if (typeof refreshedJwt !== 'string' || refreshedJwt.length === 0) {
+            throw new Error('Token refresh returned no JWT. The environment may be configured for cookie-based auth; agent flows require header-based JWTs.');
+        }
+        this.setAuthenticatedJwt(refreshedJwt);
+        return refreshedJwt;
     }
     /**
    * Fetches non-sensitive wallet identity (walletId, accountAddress, chainName,
@@ -1349,6 +1447,7 @@ class DynamicWalletClient {
             // Upload first share to Dynamic if requested
             if (backUpToDynamic) {
                 const keyShareToBackupToDynamic = keySharesToBackup[0];
+                const signedSessionId = this.getSessionSignature ? await this.buildSignedSessionId() : undefined;
                 const data = await this.apiClient.storeEncryptedBackupByWallet({
                     walletId,
                     shareSetId: resolvedShareSetId,
@@ -1357,7 +1456,8 @@ class DynamicWalletClient {
                     ],
                     passwordEncrypted: passwordEncryptedFlag,
                     encryptionVersion: ENCRYPTION_VERSION_CURRENT,
-                    requiresSignedSessionId: false,
+                    signedSessionId,
+                    requiresSignedSessionId: Boolean(this.getSessionSignature),
                     dynamicRequestId
                 });
                 const keygenId = await this.getExportId({
@@ -1604,11 +1704,13 @@ class DynamicWalletClient {
             this.logger.debug('No DYNAMIC shares available for recovery');
             return [];
         }
+        const signedSessionId = this.getSessionSignature ? await this.buildSignedSessionId() : undefined;
         const data = await this.apiClient.recoverEncryptedBackupByWallet({
             walletId,
             shareSetId: walletMetadata.shareSetId,
             externalKeyShareIds: dynamicKeyShareIds,
-            requiresSignedSessionId: false
+            signedSessionId,
+            requiresSignedSessionId: Boolean(this.getSessionSignature)
         });
         const dynamicKeyShares = data.keyShares.filter((keyShare)=>keyShare.encryptedAccountCredential !== null && keyShare.backupLocation === BackupLocation.DYNAMIC);
         var _externalServerKeySharesBackupInfo_passwordEncrypted;
@@ -1818,6 +1920,11 @@ class DynamicWalletClient {
     constructor({ environmentId, baseApiUrl, baseMPCRelayApiUrl, debug, forwardMPCClient, enableMPCAccelerator = true, logger }){
         this.isApiClientAuthenticated = false;
         this.forwardMPCEnabled = true;
+        // The nonces endpoint caps count at 5 (400 "query/count must be <= 5" above that).
+        this.nonceBatchSize = 5;
+        this.nonceCache = [];
+        // Bumped on every re-auth so an in-flight refill from a prior session is discarded.
+        this.nonceAuthGeneration = 0;
         if (logger) {
             this.logger = logger;
         } else {
@@ -1855,6 +1962,67 @@ class DynamicWalletClient {
     }
 }
 
+const subtle = webcrypto.subtle;
+const ALGO = {
+    name: 'ECDSA',
+    namedCurve: 'P-256'
+};
+const SIGN_ALGO = {
+    name: 'ECDSA',
+    hash: 'SHA-256'
+};
+/** Compress a 65-byte uncompressed SEC1 P-256 point to 33-byte compressed lowercase hex. */ const compress = (raw)=>{
+    if (raw.length !== 65 || raw[0] !== 0x04) {
+        throw new Error('expected a 65-byte uncompressed P-256 public key');
+    }
+    const x = Buffer.from(raw.slice(1, 33));
+    const prefix = (raw[64] & 1) === 0 ? 0x02 : 0x03;
+    return Buffer.concat([
+        Buffer.from([
+            prefix
+        ]),
+        x
+    ]).toString('hex');
+};
+/**
+ * Generates a P-256 session key pair for the signed-session flow.
+ *
+ * Returns the compressed public-key hex (bind it into the Dynamic JWT via the
+ * `x-dyn-session-public-key` header when you sign in) and the private JWK.
+ *
+ * Stateless and custody-agnostic: the SDK does NOT persist the key. YOU store
+ * `privateKeyJwk` wherever you keep secrets. The returned JWK is extractable
+ * (so it can be handed back to you) and is therefore a convenience path, not a
+ * security boundary — if you need a non-extractable key (so a host/operator
+ * cannot exfiltrate it), generate it in a KMS/HSM/enclave instead and supply a
+ * `getSessionSignature` that signs there.
+ */ async function generateSessionKeyPair() {
+    const keyPair = await subtle.generateKey(ALGO, true, [
+        'sign',
+        'verify'
+    ]);
+    const rawPublicKey = await subtle.exportKey('raw', keyPair.publicKey);
+    const exportedJwk = await subtle.exportKey('jwk', keyPair.privateKey);
+    const privateKeyJwk = exportedJwk;
+    return {
+        publicKeyHex: compress(new Uint8Array(rawPublicKey)),
+        privateKeyJwk
+    };
+}
+/**
+ * Signs a message with a P-256 session private JWK using the exact encoding the
+ * keyshares relay expects: ECDSA P-256 / SHA-256 over UTF-8(message), raw r‖s
+ * (64 bytes), lowercase hex. Use it to implement `getSessionSignature`:
+ *   getSessionSignature: (message) => signSessionMessage(message, privateKeyJwk)
+ * The JWK is imported non-extractable for signing.
+ */ async function signSessionMessage(message, privateKeyJwk) {
+    const key = await subtle.importKey('jwk', privateKeyJwk, ALGO, false, [
+        'sign'
+    ]);
+    const signature = await subtle.sign(SIGN_ALGO, key, new TextEncoder().encode(message));
+    return Buffer.from(new Uint8Array(signature)).toString('hex');
+}
+
 const createCore = ({ environmentId, baseApiUrl, baseMPCRelayApiUrl, debug = false, logger })=>{
     let coreLogger;
     if (logger) {
@@ -2047,4 +2215,139 @@ function decryptDelegatedWebhookData({ privateKeyPem, encryptedDelegatedKeyShare
     }
 }
 
-export { DynamicWalletClient, base64ToBytes, bytesToBase64, createDelegatedWalletClient, createLogError, decryptDelegatedWebhookData, delegatedSignMessage, ensureBase64Padding, formatEvmMessage, formatMessage, getExternalServerKeyShareBackupInfo, getMPCSignatureScheme, getMPCSigner, isHexString, logError, mergeUniqueKeyShares, retryPromise, revokeDelegation, stringToBytes, stripHexPrefix };
+const toAuthResult = (response)=>{
+    var _response_user;
+    if (response.mfaToken && !response.minifiedJwt && !response.jwt) {
+        throw new Error('account requires MFA, which the headless auth client does not support');
+    }
+    var _response_minifiedJwt;
+    const jwt = (_response_minifiedJwt = response.minifiedJwt) != null ? _response_minifiedJwt : response.jwt;
+    if (!jwt) {
+        throw new Error('sign-in returned no JWT in the response body; the environment likely uses cookie auth, which headless clients cannot consume');
+    }
+    return {
+        jwt,
+        expiresAt: response.expiresAt,
+        userId: (_response_user = response.user) == null ? void 0 : _response_user.id
+    };
+};
+// The sdk-api-core runtime throws the raw fetch Response on non-2xx; duck-type it.
+const httpStatus = (error)=>!(error instanceof Error) && typeof error === 'object' && error !== null && 'status' in error && typeof error.status === 'number' ? error.status : undefined;
+const readServerError = async (error)=>{
+    try {
+        const text = await error.text();
+        const parsed = JSON.parse(text);
+        return typeof parsed.error === 'string' ? parsed.error : undefined;
+    } catch (e) {
+        return undefined;
+    }
+};
+const asAuthError = async (error, operation)=>{
+    const status = httpStatus(error);
+    if (status !== undefined) {
+        if (status === 401) return new Error(`${operation} failed: the code or signature is invalid or expired`);
+        const serverError = await readServerError(error);
+        const detail = serverError ? `${serverError} (status ${status})` : `status ${status}`;
+        return new Error(`${operation} failed: ${detail}`);
+    }
+    return error instanceof Error ? error : new Error(String(error));
+};
+/**
+ * Headless auth client: mints a Dynamic user JWT (email OTP or SIWE) for use
+ * with authenticateJwt. Holds configuration only — no secrets, no persistence.
+ */ function createAuthClient(options) {
+    const { environmentId } = options;
+    var _options_baseUrl;
+    const baseUrl = ((_options_baseUrl = options.baseUrl) != null ? _options_baseUrl : DYNAMIC_AUTH_PROD_BASE_API_URL).replace(/\/$/, '');
+    const api = new SDKApi(new Configuration({
+        basePath: `${baseUrl}/api/v0`,
+        // Makes the backend return the JWT in the body instead of an httpOnly cookie.
+        headers: {
+            'x-dynamic-platform': 'react-native'
+        },
+        fetchApi: options.fetchApi
+    }));
+    return {
+        email: {
+            async sendOtp (email) {
+                try {
+                    const { verificationUUID } = await api.createEmailVerification({
+                        environmentId,
+                        emailVerificationCreateRequest: {
+                            email
+                        }
+                    });
+                    return {
+                        verificationUUID
+                    };
+                } catch (error) {
+                    throw await asAuthError(error, 'email OTP request');
+                }
+            },
+            async verifyOtp ({ verificationUUID, code, sessionPublicKeyHex }) {
+                try {
+                    const response = await api.signInWithEmailVerification({
+                        environmentId,
+                        emailVerificationVerifyRequest: {
+                            verificationUUID,
+                            verificationToken: code,
+                            sessionPublicKey: sessionPublicKeyHex
+                        }
+                    });
+                    return toAuthResult(response);
+                } catch (error) {
+                    throw await asAuthError(error, 'email OTP sign-in');
+                }
+            }
+        },
+        siwe: {
+            async getNonce () {
+                try {
+                    const { nonce } = await api.getNonce({
+                        environmentId
+                    });
+                    if (!nonce) throw new Error('nonce endpoint returned no nonce');
+                    return {
+                        nonce
+                    };
+                } catch (error) {
+                    throw await asAuthError(error, 'SIWE nonce request');
+                }
+            },
+            createMessage (params) {
+                const header = `${params.domain} wants you to sign in with your Ethereum account:`;
+                var _params_issuedAt;
+                const fields = [
+                    `URI: ${params.uri}`,
+                    'Version: 1',
+                    `Chain ID: ${params.chainId}`,
+                    `Nonce: ${params.nonce}`,
+                    `Issued At: ${(_params_issuedAt = params.issuedAt) != null ? _params_issuedAt : new Date().toISOString()}`
+                ].join('\n');
+                const statement = params.statement ? `${params.statement}\n\n` : '';
+                return `${header}\n${params.address}\n\n${statement}${fields}`;
+            },
+            async verify ({ message, signature, walletAddress, sessionPublicKeyHex, walletName = 'unknown', walletProvider = WalletProviderEnum.BrowserExtension, chain = ChainEnum.Evm }) {
+                try {
+                    const response = await api.verify({
+                        environmentId,
+                        verifyRequest: {
+                            messageToSign: message,
+                            signedMessage: signature,
+                            publicWalletAddress: walletAddress,
+                            chain,
+                            walletName,
+                            walletProvider,
+                            sessionPublicKey: sessionPublicKeyHex
+                        }
+                    });
+                    return toAuthResult(response);
+                } catch (error) {
+                    throw await asAuthError(error, 'SIWE sign-in');
+                }
+            }
+        }
+    };
+}
+
+export { DynamicWalletClient, base64ToBytes, bytesToBase64, createAuthClient, createDelegatedWalletClient, createLogError, decryptDelegatedWebhookData, delegatedSignMessage, ensureBase64Padding, formatEvmMessage, formatMessage, generateSessionKeyPair, getExternalServerKeyShareBackupInfo, getMPCSignatureScheme, getMPCSigner, isHexString, logError, mergeUniqueKeyShares, retryPromise, revokeDelegation, signSessionMessage, stringToBytes, stripHexPrefix };

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@dynamic-labs-wallet/node",
-  "version": "1.0.60",
+  "version": "1.0.61",
   "license": "Licensed under the Dynamic Labs, Inc. Terms Of Service (https://www.dynamic.xyz/terms-conditions)",
   "type": "module",
   "dependencies": {
-    "@dynamic-labs-wallet/core": "1.0.60",
+    "@dynamic-labs-wallet/core": "1.0.61",
     "@dynamic-labs-wallet/forward-mpc-client": "1.0.1",
-    "@dynamic-labs-wallet/primitives": "1.0.60",
+    "@dynamic-labs-wallet/primitives": "1.0.61",
     "@dynamic-labs/logger": "^4.81.0",
     "@dynamic-labs/sdk-api-core": "^0.0.984",
     "uuid": "11.1.0",

package/src/authClient.d.ts

@@ -0,0 +1,55 @@
+import { ChainEnum, WalletProviderEnum, type FetchAPI } from '@dynamic-labs/sdk-api-core';
+export interface CreateAuthClientOptions {
+    environmentId: string;
+    baseUrl?: string;
+    /** Custom fetch implementation (tests, proxies). */
+    fetchApi?: FetchAPI;
+}
+export interface AuthResult {
+    /** Pass to DynamicWalletClient.authenticateJwt. Custody is yours; never log it. */
+    jwt: string;
+    expiresAt: number;
+    userId?: string;
+}
+export interface DynamicAuthClient {
+    email: {
+        sendOtp(email: string): Promise<{
+            verificationUUID: string;
+        }>;
+        verifyOtp(params: {
+            verificationUUID: string;
+            code: string;
+            /** Compressed P-256 hex from generateSessionKeyPair — binds the session key into the minted JWT. */
+            sessionPublicKeyHex?: string;
+        }): Promise<AuthResult>;
+    };
+    siwe: {
+        getNonce(): Promise<{
+            nonce: string;
+        }>;
+        createMessage(params: {
+            domain: string;
+            address: string;
+            uri: string;
+            chainId: number;
+            nonce: string;
+            statement?: string;
+            issuedAt?: string;
+        }): string;
+        verify(params: {
+            message: string;
+            signature: string;
+            walletAddress: string;
+            sessionPublicKeyHex?: string;
+            walletName?: string;
+            walletProvider?: WalletProviderEnum;
+            chain?: ChainEnum;
+        }): Promise<AuthResult>;
+    };
+}
+/**
+ * Headless auth client: mints a Dynamic user JWT (email OTP or SIWE) for use
+ * with authenticateJwt. Holds configuration only — no secrets, no persistence.
+ */
+export declare function createAuthClient(options: CreateAuthClientOptions): DynamicAuthClient;
+//# sourceMappingURL=authClient.d.ts.map

package/src/authClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authClient.d.ts","sourceRoot":"","sources":["../../packages/src/authClient.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EAGT,kBAAkB,EAClB,KAAK,QAAQ,EAEd,MAAM,4BAA4B,CAAC;AAGpC,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE;QACL,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;YAAE,gBAAgB,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC9D,SAAS,CAAC,MAAM,EAAE;YAChB,gBAAgB,EAAE,MAAM,CAAC;YACzB,IAAI,EAAE,MAAM,CAAC;YACb,oGAAoG;YACpG,mBAAmB,CAAC,EAAE,MAAM,CAAC;SAC9B,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;KACzB,CAAC;IACF,IAAI,EAAE;QACJ,QAAQ,IAAI,OAAO,CAAC;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACvC,aAAa,CAAC,MAAM,EAAE;YACpB,MAAM,EAAE,MAAM,CAAC;YACf,OAAO,EAAE,MAAM,CAAC;YAChB,GAAG,EAAE,MAAM,CAAC;YACZ,OAAO,EAAE,MAAM,CAAC;YAChB,KAAK,EAAE,MAAM,CAAC;YACd,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;SACnB,GAAG,MAAM,CAAC;QACX,MAAM,CAAC,MAAM,EAAE;YACb,OAAO,EAAE,MAAM,CAAC;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,aAAa,EAAE,MAAM,CAAC;YACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;YAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;YACpB,cAAc,CAAC,EAAE,kBAAkB,CAAC;YACpC,KAAK,CAAC,EAAE,SAAS,CAAC;SACnB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;KACzB,CAAC;CACH;AA8CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,iBAAiB,CA4FpF"}

package/src/client.d.ts

@@ -17,6 +17,11 @@ export declare class DynamicWalletClient {
     protected isApiClientAuthenticated: boolean;
     protected forwardMPCEnabled: boolean;
     protected resolvedForwardMPCClient: ForwardMPCClientV2 | undefined;
+    protected getSessionSignature?: (message: string) => Promise<string>;
+    private readonly nonceBatchSize;
+    private readonly nonceCache;
+    private nonceRefill?;
+    private nonceAuthGeneration;
     constructor({ environmentId, baseApiUrl, baseMPCRelayApiUrl, debug, forwardMPCClient, enableMPCAccelerator, logger, }: DynamicWalletClientProps);
     private ensureApiClientAuthenticated;
     /**
@@ -30,7 +35,37 @@ export declare class DynamicWalletClient {
      * in case are different addresses.
      */
     private assertAddressMatchesMetadata;
+    /**
+     * Installs a Dynamic JWT as the bearer token for all subsequent API calls
+     * and rebuilds the API client, preserving the forward-MPC client.
+     */
+    private setAuthenticatedJwt;
     authenticateApiToken(authToken: string): Promise<void>;
+    /**
+     * Authenticates the client with a Dynamic user JWT obtained outside the SDK —
+     * e.g. by an agent that completed a Dynamic sign-in (external auth, email OTP)
+     * on behalf of a user. Unlike authenticateApiToken, no token exchange happens:
+     * the JWT is used directly as the bearer token. The server validates it on
+     * every request; this method only checks the token's structure.
+     *
+     * `options.getSessionSignature` must return the signature as lowercase hex
+     * (raw ECDSA r‖s, as produced by `signSessionMessage`). Other encodings —
+     * notably base64, which can contain `/` — corrupt the `/`-delimited
+     * signed-session composite sent to the keyshares relay.
+     */
+    authenticateJwt(jwt: string, options?: {
+        getSessionSignature?: (message: string) => Promise<string>;
+    }): Promise<void>;
+    private buildSignedSessionId;
+    private takeNonce;
+    /**
+     * Refreshes the Dynamic JWT using the current session and installs the new
+     * token for all subsequent API calls. Returns the new JWT so callers can
+     * persist it. The server enforces a hard refresh limit (the JWT's
+     * `refreshExp` claim) — once reached, this rejects with a 401 and the user
+     * must re-authenticate.
+     */
+    refreshAuthToken(): Promise<string>;
     /**
      * Fetches non-sensitive wallet identity (walletId, accountAddress, chainName,
      * derivationPath, thresholdSignatureScheme) from the Dynamic API by

package/src/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../packages/src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,kBAAkB,EAElB,iBAAiB,EACjB,cAAc,EAGd,WAAW,EACX,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,cAAc,EAGd,gBAAgB,EAIhB,wBAAwB,EACxB,KAAK,OAAO,EAEZ,eAAe,EAUf,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,8BAA8B,EACnC,KAAK,YAAY,EAGlB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,KAAK,EAAyB,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAI5F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAE,wBAAwB,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG7F,KAAK,YAAY,GAAG,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;AAErE,qBAAa,mBAAmB;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IAEtB,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC;IAE1B,SAAS,CAAC,SAAS,EAAG,gBAAgB,CAAC;IACvC,SAAS,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACtC,SAAS,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACpC,SAAS,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAS,CAAC,wBAAwB,UAAS;IAC3C,SAAS,CAAC,iBAAiB,UAAQ;IACnC,SAAS,CAAC,wBAAwB,EAAE,kBAAkB,GAAG,SAAS,CAAC;gBAEvD,EACV,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,KAAK,EACL,gBAAgB,EAChB,oBAA2B,EAC3B,MAAM,GACP,EAAE,wBAAwB;IA4C3B,OAAO,CAAC,4BAA4B;IAMpC;;;;;;;;;OASG;IACH,OAAO,CAAC,4BAA4B;IAqB9B,oBAAoB,CAAC,SAAS,EAAE,MAAM;IAuB5C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAkB1E;;;;;;;;;OASG;cACa,iBAAiB,CAAC,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAWxF,6BAA6B,CAAC,EAClC,SAAS,EACT,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,QAAQ,EACR,aAAa,EACb,OAAO,EACP,kBAAkB,GACnB,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,uBAAuB,EAAE,MAAM,EAAE,CAAC;QAClC,wBAAwB,EAAE,wBAAwB,CAAC;QACnD,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;QACjC,kBAAkB,CAAC,EAAE,CACnB,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,YAAY,KACxB,IAAI,CAAC;KACX;IAqBK,8BAA8B,CAAC,EACnC,SAAS,EACT,wBAAwB,EACxB,aAAa,GACd,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,wBAAwB,EAAE,wBAAwB,CAAC;QACnD,aAAa,CAAC,EAAE,aAAa,CAAC;KAC/B,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAqB/B,eAAe,CAAC,EACpB,SAAS,EACT,QAAQ,EACR,cAAc,EACd,aAAa,GACd,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,cAAc,CAAC;QACzB,cAAc,EAAE,WAAW,GAAG,SAAS,CAAC;QACxC,aAAa,CAAC,EAAE,aAAa,CAAC;KAC/B;IAsBK,8BAA8B,CAAC,EACnC,SAAS,EACT,MAAM,EACN,sBAAsB,EACtB,+BAA+B,EAC/B,wBAAwB,EACxB,aAAa,GACd,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,sBAAsB,EAAE,MAAM,EAAE,CAAC;QACjC,+BAA+B,EAAE,sBAAsB,EAAE,CAAC;QAC1D,wBAAwB,EAAE,wBAAwB,CAAC;QACnD,aAAa,CAAC,EAAE,aAAa,CAAC;KAC/B,GAAG,OAAO,CAAC;QACV,YAAY,EAAE,YAAY,CAAC;QAC3B,2BAA2B,EAAE,cAAc,EAAE,CAAC;KAC/C,CAAC;IAgEI,oBAAoB,CAAC,EACzB,SAAS,EACT,MAAM,EACN,sBAAsB,EACtB,+BAA+B,EAC/B,wBAAwB,EACxB,aAAa,GACd,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,sBAAsB,EAAE,MAAM,EAAE,CAAC;QACjC,+BAA+B,EAAE,sBAAsB,EAAE,CAAC;QAC1D,wBAAwB,EAAE,wBAAwB,CAAC;QACnD,aAAa,CAAC,EAAE,aAAa,CAAC;KAC/B,GAAG,OAAO,CAAC;QACV,YAAY,EAAE,YAAY,CAAC;QAC3B,2BAA2B,EAAE,cAAc,EAAE,CAAC;KAC/C,CAAC;IA0FF,SAAS,CAAC,yBAAyB,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;IAS7G,MAAM,CAAC,EACX,SAAS,EACT,wBAAwB,EACxB,QAAQ,EACR,aAAa,EACb,QAAQ,EACR,eAAe,EACf,OAAO,EACP,kBAAkB,GACnB,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,wBAAwB,EAAE,wBAAwB,CAAC;QACnD,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;QACjC,kBAAkB,CAAC,EAAE,CACnB,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,YAAY,KACxB,IAAI,CAAC;KACX,GAAG,OAAO,CAAC;QACV,YAAY,EAAE,YAAY,CAAC;QAC3B,uBAAuB,EAAE,cAAc,EAAE,CAAC;KAC3C,CAAC;IAsCI,mBAAmB,CAAC,EACxB,SAAS,EACT,UAAU,EACV,wBAAwB,EACxB,aAAa,EACb,QAAQ,EACR,eAAe,EACf,OAAO,EACP,kBAAkB,GACnB,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,wBAAwB,EAAE,wBAAwB,CAAC;QACnD,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;QACjC,kBAAkB,CAAC,EAAE,CACnB,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,YAAY,KACxB,IAAI,CAAC;KACX,GAAG,OAAO,CAAC;QACV,YAAY,EAAE,YAAY,CAAC;QAC3B,uBAAuB,EAAE,cAAc,EAAE,CAAC;KAC3C,CAAC;IAwEI,iBAAiB,CAAC,EACtB,QAAQ,EACR,OAAO,EACP,WAAW,EACX,OAAO,EACP,aAAa,EACb,OAAO,EACP,gBAAgB,EAAE,iBAAiB,GACpC,EAAE;QACD,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;QAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,OAAO,CAAC,EAAE,kBAAkB,CAAC;QAC7B,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;QACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B;;;;;IAwBK,kBAAkB,CAAC,EACvB,SAAS,EACT,OAAO,EACP,MAAM,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,GACd,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,cAAc,CAAC;QACzB,cAAc,EAAE,WAAW,GAAG,SAAS,CAAC;QACxC,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,aAAa,CAAC,EAAE,aAAa,CAAC;KAC/B,GAAG,OAAO,CAAC,UAAU,GAAG,cAAc,CAAC;IAmBlC,oBAAoB,CAAC,EACzB,SAAS,EACT,OAAO,EACP,MAAM,EACN,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,QAAQ,GACT,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,cAAc,CAAC;QACzB,cAAc,EAAE,WAAW,GAAG,SAAS,CAAC;QACxC,gBAAgB,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC;QACpD,gBAAgB,EAAE,MAAM,CAAC;QACzB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,UAAU,GAAG,cAAc,CAAC;IAoDxC;;;;OAIG;YACW,oBAAoB;IAkD5B,IAAI,CAAC,EACT,cAAc,EACd,uBAAuB,EACvB,OAAO,EACP,SAAS,EACT,QAAoB,EACpB,WAAmB,EACnB,OAAO,EACP,OAAO,EACP,aAAa,EACb,cAAc,EACd,eAA8C,EAC9C,mBAA2B,GAC5B,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3C,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,OAAO,CAAC,EAAE,kBAAkB,CAAC;QAC7B,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;QACjC,cAAc,EAAE,cAAc,CAAC;QAC/B,qEAAqE;QACrE,eAAe,CAAC,EAAE,eAAe,CAAC;QAClC;;;;;WAKG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GAAG,OAAO,CAAC,UAAU,GAAG,cAAc,CAAC;IA+FlC,0BAA0B,CAAC,EAC/B,cAAc,EACd,SAAS,EACT,QAAoB,EACpB,uBAAuB,EACvB,eAAuB,EACvB,cAAc,GACf,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3C,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,cAAc,EAAE,cAAc,CAAC;KAChC;;;;;IA4IK,WAAW,CAAC,EAChB,SAAS,EACT,cAAc,EACd,aAAa,GACd,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,cAAc,CAAC;QAC/B,aAAa,CAAC,EAAE,aAAa,CAAC;KAC/B;IAUD;;;;;;;;;;;;;OAaG;IACG,eAAe,CAAC,EACpB,SAAS,EACT,MAAM,EACN,2BAA2B,EAC3B,2BAA2B,GAC5B,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,aAAa,GAAG,yBAAyB,CAAC,CAAC;QAC1E,2BAA2B,EAAE,wBAAwB,CAAC;QACtD,2BAA2B,EAAE,wBAAwB,CAAC;KACvD,GAAG,OAAO,CAAC;QACV,kCAAkC,EAAE,sBAAsB,EAAE,CAAC;QAC7D,0BAA0B,EAAE,MAAM,EAAE,CAAC;QACrC,+BAA+B,EAAE,MAAM,EAAE,CAAC;QAC1C,+BAA+B,EAAE,cAAc,EAAE,CAAC;KACnD,CAAC;IA4CI,OAAO,CAAC,EACZ,SAAS,EACT,cAAc,EACd,2BAA2B,EAC3B,2BAA2B,EAC3B,QAAoB,EACpB,uBAAuB,EACvB,eAAuB,EACvB,cAAc,GACf,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,2BAA2B,EAAE,wBAAwB,CAAC;QACtD,2BAA2B,EAAE,wBAAwB,CAAC;QACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3C,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,cAAc,EAAE,cAAc,CAAC;KAChC;;;;;IA4KK,SAAS,CAAC,EACd,cAAc,EACd,SAAS,EACT,QAAoB,EACpB,uBAAuB,EACvB,aAAa,EACb,mBAAmB,EACnB,cAAc,GACf,EAAE,8BAA8B,CAAC;QAChC,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3C,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,cAAc,EAAE,cAAc,CAAC;KAChC,CAAC;;;IAiFI,gBAAgB,CAAC,EACrB,SAAS,EACT,SAAS,EACT,cAAc,GACf,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,cAAc,EAAE,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB;;;IA4CK,eAAe,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QAAE,QAAQ,EAAE,cAAc,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IAWvF,4BAA4B,CAAC,EACjC,cAAc,EACd,uBAAmC,EACnC,QAAoB,EACpB,eAAe,EACf,cAAc,EACd,UAAU,GACX,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,cAAc,CAAC;QAO/B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB;;mBA8BgC,cAAc;6CAAmC,OAAO;;;;IA2HnF,qCAAqC,CAAC,EAC1C,cAAc,EACd,uBAAuB,EACvB,QAAQ,EACR,eAAe,EACf,cAAc,GACf,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,cAAc,CAAC;KAChC,GAAG,OAAO,CAAC;QACV,yBAAyB,EAAE,KAAK,CAAC;YAAE,KAAK,EAAE,cAAc,CAAC;YAAC,+BAA+B,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACtG,UAAU,EAAE,kBAAkB,CAAC;KAChC,CAAC;IAmBI,0BAA0B,CAAC,EAC/B,cAAc,EACd,QAAQ,EACR,cAAc,EACd,UAAU,GACX,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,cAAc,CAAC;QAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAC;KACjC;IA2BK,cAAc,CAAC,EACnB,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,uBAAuB,EACvB,cAAc,GACf,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,OAAO,CAAC;QACzB,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3C,cAAc,EAAE,cAAc,CAAC;KAChC;;;IAsBK,eAAe,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC;IAW/G;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EACd,iCAAiC,EACjC,wBAAwB,EACxB,eAAe,EACf,UAAsB,GACvB,EAAE;QACD,iCAAiC,EAAE,kBAAkB,CAAC;QACtD,wBAAwB,EAAE,wBAAwB,CAAC;QACnD,eAAe,EAAE,eAAe,CAAC;QACjC,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG;QACF,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAClD,kBAAkB,EAAE,MAAM,CAAC;KAC5B;IAoCD;;;;;;;;;;;OAWG;cACa,gBAAgB,CAAC,EAC/B,cAAc,EACd,QAAQ,EACR,eAAe,EACf,uBAAuB,EACvB,YAAY,EACZ,cAAc,EACd,UAAU,GACX,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,eAAe,CAAC;QACjC,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3C,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,cAAc,CAAC;QAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAC;KACjC,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAoBvB,8BAA8B,CAAC,EACnC,cAAc,EACd,QAAQ,EACR,eAAe,EACf,UAAsB,EACtB,cAAc,EACd,UAAU,GACX,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,eAAe,CAAC;QACjC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,cAAc,CAAC;QAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAC;KACjC;IAwDK,6BAA6B,CAAC,EAClC,cAAc,EACd,QAAQ,EACR,cAAc,GACf,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,cAAc,CAAC;KAChC;IAmBD;;;;OAIG;IACG,cAAc,CAAC,EACnB,cAAc,EACd,QAAoB,EACpB,cAAc,EACd,UAAU,GACX,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,cAAc,CAAC;QAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAC;KACjC;IAkDK,mBAAmB,CAAC,EACxB,cAAc,EACd,cAAc,EACd,UAAU,GACX,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,cAAc,CAAC;QAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAC;KACjC,GAAG,OAAO,CAAC,OAAO,CAAC;IAMpB;;OAEG;IACG,4BAA4B,CAAC,EACjC,cAAc,EACd,eAAiD,EACjD,cAAc,EACd,UAAU,GACX,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,eAAe,CAAC;QAClC,cAAc,EAAE,cAAc,CAAC;QAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAC;KACjC,GAAG,OAAO,CAAC,OAAO,CAAC;IAcpB;;OAEG;IACG,uCAAuC,CAAC,EAC5C,cAAc,EACd,eAAiD,EACjD,cAAc,EACd,UAAU,GACX,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,eAAe,CAAC;QAClC,cAAc,EAAE,cAAc,CAAC;QAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAC;KACjC,GAAG,OAAO,CAAC,OAAO,CAAC;IAgCd,yCAAyC,CAAC,EAC9C,cAAc,GACf,EAAE;QACD,cAAc,EAAE,cAAc,CAAC;KAChC,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAK/B;;;;;;;;;;;;;;OAcG;IACG,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IA6ClF;;;OAGG;IACG,UAAU;;;;;;;kCAsB8B,wBAAwB;;CAGvE"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../packages/src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,kBAAkB,EAElB,iBAAiB,EACjB,cAAc,EAGd,WAAW,EACX,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,cAAc,EAGd,gBAAgB,EAIhB,wBAAwB,EACxB,KAAK,OAAO,EAEZ,eAAe,EAUf,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,8BAA8B,EACnC,KAAK,YAAY,EAGlB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,KAAK,EAAyB,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAI5F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAE,wBAAwB,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG7F,KAAK,YAAY,GAAG,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;AAErE,qBAAa,mBAAmB;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IAEtB,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC;IAE1B,SAAS,CAAC,SAAS,EAAG,gBAAgB,CAAC;IACvC,SAAS,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACtC,SAAS,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACpC,SAAS,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAS,CAAC,wBAAwB,UAAS;IAC3C,SAAS,CAAC,iBAAiB,UAAQ;IACnC,SAAS,CAAC,wBAAwB,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACnE,SAAS,CAAC,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAErE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAK;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAC3C,OAAO,CAAC,WAAW,CAAC,CAAgB;IAEpC,OAAO,CAAC,mBAAmB,CAAK;gBAEpB,EACV,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,KAAK,EACL,gBAAgB,EAChB,oBAA2B,EAC3B,MAAM,GACP,EAAE,wBAAwB;IA4C3B,OAAO,CAAC,4BAA4B;IAQpC;;;;;;;;;OASG;IACH,OAAO,CAAC,4BAA4B;IAqBpC;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAgBrB,oBAAoB,CAAC,SAAS,EAAE,MAAM;IAc5C;;;;;;;;;;;OAWG;IACG,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE;YAS7F,oBAAoB;YA4BpB,SAAS;IAsBvB;;;;;;OAMG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAazC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAkB1E;;;;;;;;;OASG;cACa,iBAAiB,CAAC,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAWxF,6BAA6B,CAAC,EAClC,SAAS,EACT,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,QAAQ,EACR,aAAa,EACb,OAAO,EACP,kBAAkB,GACnB,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,uBAAuB,EAAE,MAAM,EAAE,CAAC;QAClC,wBAAwB,EAAE,wBAAwB,CAAC;QACnD,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;QACjC,kBAAkB,CAAC,EAAE,CACnB,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,YAAY,KACxB,IAAI,CAAC;KACX;IAqBK,8BAA8B,CAAC,EACnC,SAAS,EACT,wBAAwB,EACxB,aAAa,GACd,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,wBAAwB,EAAE,wBAAwB,CAAC;QACnD,aAAa,CAAC,EAAE,aAAa,CAAC;KAC/B,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAqB/B,eAAe,CAAC,EACpB,SAAS,EACT,QAAQ,EACR,cAAc,EACd,aAAa,GACd,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,cAAc,CAAC;QACzB,cAAc,EAAE,WAAW,GAAG,SAAS,CAAC;QACxC,aAAa,CAAC,EAAE,aAAa,CAAC;KAC/B;IAsBK,8BAA8B,CAAC,EACnC,SAAS,EACT,MAAM,EACN,sBAAsB,EACtB,+BAA+B,EAC/B,wBAAwB,EACxB,aAAa,GACd,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,sBAAsB,EAAE,MAAM,EAAE,CAAC;QACjC,+BAA+B,EAAE,sBAAsB,EAAE,CAAC;QAC1D,wBAAwB,EAAE,wBAAwB,CAAC;QACnD,aAAa,CAAC,EAAE,aAAa,CAAC;KAC/B,GAAG,OAAO,CAAC;QACV,YAAY,EAAE,YAAY,CAAC;QAC3B,2BAA2B,EAAE,cAAc,EAAE,CAAC;KAC/C,CAAC;IAgEI,oBAAoB,CAAC,EACzB,SAAS,EACT,MAAM,EACN,sBAAsB,EACtB,+BAA+B,EAC/B,wBAAwB,EACxB,aAAa,GACd,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,sBAAsB,EAAE,MAAM,EAAE,CAAC;QACjC,+BAA+B,EAAE,sBAAsB,EAAE,CAAC;QAC1D,wBAAwB,EAAE,wBAAwB,CAAC;QACnD,aAAa,CAAC,EAAE,aAAa,CAAC;KAC/B,GAAG,OAAO,CAAC;QACV,YAAY,EAAE,YAAY,CAAC;QAC3B,2BAA2B,EAAE,cAAc,EAAE,CAAC;KAC/C,CAAC;IA0FF,SAAS,CAAC,yBAAyB,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;IAS7G,MAAM,CAAC,EACX,SAAS,EACT,wBAAwB,EACxB,QAAQ,EACR,aAAa,EACb,QAAQ,EACR,eAAe,EACf,OAAO,EACP,kBAAkB,GACnB,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,wBAAwB,EAAE,wBAAwB,CAAC;QACnD,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;QACjC,kBAAkB,CAAC,EAAE,CACnB,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,YAAY,KACxB,IAAI,CAAC;KACX,GAAG,OAAO,CAAC;QACV,YAAY,EAAE,YAAY,CAAC;QAC3B,uBAAuB,EAAE,cAAc,EAAE,CAAC;KAC3C,CAAC;IAsCI,mBAAmB,CAAC,EACxB,SAAS,EACT,UAAU,EACV,wBAAwB,EACxB,aAAa,EACb,QAAQ,EACR,eAAe,EACf,OAAO,EACP,kBAAkB,GACnB,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,wBAAwB,EAAE,wBAAwB,CAAC;QACnD,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;QACjC,kBAAkB,CAAC,EAAE,CACnB,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,YAAY,KACxB,IAAI,CAAC;KACX,GAAG,OAAO,CAAC;QACV,YAAY,EAAE,YAAY,CAAC;QAC3B,uBAAuB,EAAE,cAAc,EAAE,CAAC;KAC3C,CAAC;IAwEI,iBAAiB,CAAC,EACtB,QAAQ,EACR,OAAO,EACP,WAAW,EACX,OAAO,EACP,aAAa,EACb,OAAO,EACP,gBAAgB,EAAE,iBAAiB,GACpC,EAAE;QACD,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;QAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,OAAO,CAAC,EAAE,kBAAkB,CAAC;QAC7B,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;QACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B;;;;;IAwBK,kBAAkB,CAAC,EACvB,SAAS,EACT,OAAO,EACP,MAAM,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,GACd,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,cAAc,CAAC;QACzB,cAAc,EAAE,WAAW,GAAG,SAAS,CAAC;QACxC,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,aAAa,CAAC,EAAE,aAAa,CAAC;KAC/B,GAAG,OAAO,CAAC,UAAU,GAAG,cAAc,CAAC;IAmBlC,oBAAoB,CAAC,EACzB,SAAS,EACT,OAAO,EACP,MAAM,EACN,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,QAAQ,GACT,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,cAAc,CAAC;QACzB,cAAc,EAAE,WAAW,GAAG,SAAS,CAAC;QACxC,gBAAgB,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC;QACpD,gBAAgB,EAAE,MAAM,CAAC;QACzB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,UAAU,GAAG,cAAc,CAAC;IAoDxC;;;;OAIG;YACW,oBAAoB;IAkD5B,IAAI,CAAC,EACT,cAAc,EACd,uBAAuB,EACvB,OAAO,EACP,SAAS,EACT,QAAoB,EACpB,WAAmB,EACnB,OAAO,EACP,OAAO,EACP,aAAa,EACb,cAAc,EACd,eAA8C,EAC9C,mBAA2B,GAC5B,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3C,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,OAAO,CAAC,EAAE,kBAAkB,CAAC;QAC7B,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;QACjC,cAAc,EAAE,cAAc,CAAC;QAC/B,qEAAqE;QACrE,eAAe,CAAC,EAAE,eAAe,CAAC;QAClC;;;;;WAKG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GAAG,OAAO,CAAC,UAAU,GAAG,cAAc,CAAC;IA+FlC,0BAA0B,CAAC,EAC/B,cAAc,EACd,SAAS,EACT,QAAoB,EACpB,uBAAuB,EACvB,eAAuB,EACvB,cAAc,GACf,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3C,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,cAAc,EAAE,cAAc,CAAC;KAChC;;;;;IA4IK,WAAW,CAAC,EAChB,SAAS,EACT,cAAc,EACd,aAAa,GACd,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,cAAc,CAAC;QAC/B,aAAa,CAAC,EAAE,aAAa,CAAC;KAC/B;IAUD;;;;;;;;;;;;;OAaG;IACG,eAAe,CAAC,EACpB,SAAS,EACT,MAAM,EACN,2BAA2B,EAC3B,2BAA2B,GAC5B,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,aAAa,GAAG,yBAAyB,CAAC,CAAC;QAC1E,2BAA2B,EAAE,wBAAwB,CAAC;QACtD,2BAA2B,EAAE,wBAAwB,CAAC;KACvD,GAAG,OAAO,CAAC;QACV,kCAAkC,EAAE,sBAAsB,EAAE,CAAC;QAC7D,0BAA0B,EAAE,MAAM,EAAE,CAAC;QACrC,+BAA+B,EAAE,MAAM,EAAE,CAAC;QAC1C,+BAA+B,EAAE,cAAc,EAAE,CAAC;KACnD,CAAC;IA4CI,OAAO,CAAC,EACZ,SAAS,EACT,cAAc,EACd,2BAA2B,EAC3B,2BAA2B,EAC3B,QAAoB,EACpB,uBAAuB,EACvB,eAAuB,EACvB,cAAc,GACf,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,2BAA2B,EAAE,wBAAwB,CAAC;QACtD,2BAA2B,EAAE,wBAAwB,CAAC;QACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3C,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,cAAc,EAAE,cAAc,CAAC;KAChC;;;;;IA4KK,SAAS,CAAC,EACd,cAAc,EACd,SAAS,EACT,QAAoB,EACpB,uBAAuB,EACvB,aAAa,EACb,mBAAmB,EACnB,cAAc,GACf,EAAE,8BAA8B,CAAC;QAChC,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3C,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,cAAc,EAAE,cAAc,CAAC;KAChC,CAAC;;;IAiFI,gBAAgB,CAAC,EACrB,SAAS,EACT,SAAS,EACT,cAAc,GACf,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,cAAc,EAAE,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB;;;IA4CK,eAAe,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QAAE,QAAQ,EAAE,cAAc,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IAWvF,4BAA4B,CAAC,EACjC,cAAc,EACd,uBAAmC,EACnC,QAAoB,EACpB,eAAe,EACf,cAAc,EACd,UAAU,GACX,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,cAAc,CAAC;QAO/B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB;;mBA8BgC,cAAc;6CAAmC,OAAO;;;;IA6HnF,qCAAqC,CAAC,EAC1C,cAAc,EACd,uBAAuB,EACvB,QAAQ,EACR,eAAe,EACf,cAAc,GACf,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,cAAc,CAAC;KAChC,GAAG,OAAO,CAAC;QACV,yBAAyB,EAAE,KAAK,CAAC;YAAE,KAAK,EAAE,cAAc,CAAC;YAAC,+BAA+B,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACtG,UAAU,EAAE,kBAAkB,CAAC;KAChC,CAAC;IAmBI,0BAA0B,CAAC,EAC/B,cAAc,EACd,QAAQ,EACR,cAAc,EACd,UAAU,GACX,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,cAAc,CAAC;QAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAC;KACjC;IA2BK,cAAc,CAAC,EACnB,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,uBAAuB,EACvB,cAAc,GACf,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,OAAO,CAAC;QACzB,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3C,cAAc,EAAE,cAAc,CAAC;KAChC;;;IAsBK,eAAe,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC;IAW/G;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EACd,iCAAiC,EACjC,wBAAwB,EACxB,eAAe,EACf,UAAsB,GACvB,EAAE;QACD,iCAAiC,EAAE,kBAAkB,CAAC;QACtD,wBAAwB,EAAE,wBAAwB,CAAC;QACnD,eAAe,EAAE,eAAe,CAAC;QACjC,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG;QACF,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAClD,kBAAkB,EAAE,MAAM,CAAC;KAC5B;IAoCD;;;;;;;;;;;OAWG;cACa,gBAAgB,CAAC,EAC/B,cAAc,EACd,QAAQ,EACR,eAAe,EACf,uBAAuB,EACvB,YAAY,EACZ,cAAc,EACd,UAAU,GACX,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,eAAe,CAAC;QACjC,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3C,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,cAAc,CAAC;QAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAC;KACjC,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAoBvB,8BAA8B,CAAC,EACnC,cAAc,EACd,QAAQ,EACR,eAAe,EACf,UAAsB,EACtB,cAAc,EACd,UAAU,GACX,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,eAAe,CAAC;QACjC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,cAAc,CAAC;QAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAC;KACjC;IA0DK,6BAA6B,CAAC,EAClC,cAAc,EACd,QAAQ,EACR,cAAc,GACf,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,cAAc,CAAC;KAChC;IAmBD;;;;OAIG;IACG,cAAc,CAAC,EACnB,cAAc,EACd,QAAoB,EACpB,cAAc,EACd,UAAU,GACX,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,cAAc,CAAC;QAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAC;KACjC;IAkDK,mBAAmB,CAAC,EACxB,cAAc,EACd,cAAc,EACd,UAAU,GACX,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,cAAc,CAAC;QAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAC;KACjC,GAAG,OAAO,CAAC,OAAO,CAAC;IAMpB;;OAEG;IACG,4BAA4B,CAAC,EACjC,cAAc,EACd,eAAiD,EACjD,cAAc,EACd,UAAU,GACX,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,eAAe,CAAC;QAClC,cAAc,EAAE,cAAc,CAAC;QAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAC;KACjC,GAAG,OAAO,CAAC,OAAO,CAAC;IAcpB;;OAEG;IACG,uCAAuC,CAAC,EAC5C,cAAc,EACd,eAAiD,EACjD,cAAc,EACd,UAAU,GACX,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,eAAe,CAAC;QAClC,cAAc,EAAE,cAAc,CAAC;QAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAC;KACjC,GAAG,OAAO,CAAC,OAAO,CAAC;IAgCd,yCAAyC,CAAC,EAC9C,cAAc,GACf,EAAE;QACD,cAAc,EAAE,cAAc,CAAC;KAChC,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAK/B;;;;;;;;;;;;;;OAcG;IACG,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IA6ClF;;;OAGG;IACG,UAAU;;;;;;;kCAsB8B,wBAAwB;;CAGvE"}

package/src/index.d.ts

@@ -7,7 +7,10 @@ export type { ServerInitKeygenResult, ServerKeyShare, SignMessage } from './mpc/
 export * from './client.js';
 export * from './types.js';
 export * from './utils.js';
+export { generateSessionKeyPair, signSessionMessage } from './sessionKeys.js';
 export * from './mpc/index.js';
 export { createDelegatedWalletClient, delegatedSignMessage, revokeDelegation, decryptDelegatedWebhookData, } from './delegatedClient/index.js';
 export type { DelegatedWalletClient, DelegatedClientConfig, EncryptedDelegatedPayload, } from './delegatedClient/index.js';
+export { createAuthClient } from './authClient.js';
+export type { AuthResult, CreateAuthClientOptions, DynamicAuthClient } from './authClient.js';
 //# sourceMappingURL=index.d.ts.map

package/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../packages/src/index.ts"],"names":[],"mappings":"AACA,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,YAAY,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG/F,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACrE,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG1F,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../packages/src/index.ts"],"names":[],"mappings":"AACA,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,YAAY,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG/F,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACrE,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG1F,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAE3B,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,YAAY,EAAE,UAAU,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC"}

package/src/sessionKeys.d.ts

@@ -0,0 +1,27 @@
+import type { JsonWebKey } from 'node:crypto';
+/**
+ * Generates a P-256 session key pair for the signed-session flow.
+ *
+ * Returns the compressed public-key hex (bind it into the Dynamic JWT via the
+ * `x-dyn-session-public-key` header when you sign in) and the private JWK.
+ *
+ * Stateless and custody-agnostic: the SDK does NOT persist the key. YOU store
+ * `privateKeyJwk` wherever you keep secrets. The returned JWK is extractable
+ * (so it can be handed back to you) and is therefore a convenience path, not a
+ * security boundary — if you need a non-extractable key (so a host/operator
+ * cannot exfiltrate it), generate it in a KMS/HSM/enclave instead and supply a
+ * `getSessionSignature` that signs there.
+ */
+export declare function generateSessionKeyPair(): Promise<{
+    publicKeyHex: string;
+    privateKeyJwk: JsonWebKey;
+}>;
+/**
+ * Signs a message with a P-256 session private JWK using the exact encoding the
+ * keyshares relay expects: ECDSA P-256 / SHA-256 over UTF-8(message), raw r‖s
+ * (64 bytes), lowercase hex. Use it to implement `getSessionSignature`:
+ *   getSessionSignature: (message) => signSessionMessage(message, privateKeyJwk)
+ * The JWK is imported non-extractable for signing.
+ */
+export declare function signSessionMessage(message: string, privateKeyJwk: JsonWebKey): Promise<string>;
+//# sourceMappingURL=sessionKeys.d.ts.map

package/src/sessionKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionKeys.d.ts","sourceRoot":"","sources":["../../packages/src/sessionKeys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAgB9C;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,UAAU,CAAA;CAAE,CAAC,CAM3G;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAIpG"}