@paybox-sh/sdk 0.4.0 → 0.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/README.md +43 -7
  2. package/dist/{chunk-7RGQEEY3.js → chunk-EBB4HNOB.js} +264 -17
  3. package/dist/chunk-EBB4HNOB.js.map +1 -0
  4. package/dist/cli.js +140 -25
  5. package/dist/cli.js.map +1 -1
  6. package/dist/index.d.ts +175 -2
  7. package/dist/index.js +1 -1
  8. package/package.json +1 -1
  9. package/dist/chunk-7RGQEEY3.js.map +0 -1
package/dist/chunk-7RGQEEY3.js.map DELETED
@@ -1 +0,0 @@
1
- {"version":3,"sources":["../src/auth.ts","../src/config.ts","../node_modules/.pnpm/@paybox+mcp-app@file+..+mcp-app_@modelcontextprotocol+sdk@1.29.0_zod@4.4.3__bn.js@5.2.3_ac1e09a20c76a1143611be5dd3d4f9db/node_modules/@paybox/mcp-app/src/creds.ts","../node_modules/.pnpm/@paybox+mcp-app@file+..+mcp-app_@modelcontextprotocol+sdk@1.29.0_zod@4.4.3__bn.js@5.2.3_ac1e09a20c76a1143611be5dd3d4f9db/node_modules/@paybox/mcp-app/src/sign.ts","../src/signer.ts","../src/client.ts"],"sourcesContent":["// OAuth 2.1 + PKCE loopback login for the CLI, and refresh-token rotation.\n//\n// The server allows http://127.0.0.1:* loopback redirects, dynamic ports, public\n// (no-secret) PKCE clients, and refresh tokens for `offline_access` — so this is\n// a standard loopback flow needing no server changes. The user approves with a\n// passkey in the browser (the existing app consent flow); the CLI never sees a\n// secret to copy.\n\nimport { spawn } from \"node:child_process\";\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { createServer } from \"node:http\";\nimport type { AddressInfo } from \"node:net\";\n\nimport type { OAuthTokens } from \"./config.js\";\n\n/** The MCP resource the access token is audience-bound to. */\nexport function mcpResource(baseUrl: string): string {\n return `${baseUrl.replace(/\\/+$/, \"\")}/mcp`;\n}\n\n/** The Paybox app origin (where signing keys are provisioned), derived from the\n * API origin by swapping the `api.` subdomain for `app.` (e.g.\n * api.paybox.sh → app.paybox.sh). Returns null when it can't be derived (e.g.\n * localhost) — pass an explicit override then. */\nexport function appBaseFrom(baseUrl: string, override?: string): string | null {\n if (override) return override.replace(/\\/+$/, \"\");\n const m = baseUrl.replace(/\\/+$/, \"\").match(/^(https?:\\/\\/)api\\.(.+)$/);\n return m ? `${m[1]}app.${m[2]}` : null;\n}\n\n/** Read the paybox agent client id (`cid`) from an OAuth access token (JWT). */\nexport function agentClientId(accessToken: string): string | null {\n const payload = accessToken.split(\".\")[1];\n if (!payload) return null;\n try {\n const claims = JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf8\")) as {\n cid?: string;\n };\n return claims.cid ?? null;\n } catch {\n return null;\n }\n}\n\ninterface AsMetadata {\n registration_endpoint: string;\n authorization_endpoint: string;\n token_endpoint: string;\n}\n\nasync function metadata(baseUrl: string): Promise<AsMetadata> {\n const url = `${baseUrl.replace(/\\/+$/, \"\")}/.well-known/oauth-authorization-server`;\n const res = await fetch(url);\n if (!res.ok) {\n throw new Error(`could not read OAuth metadata from ${url} (${res.status})`);\n }\n return (await res.json()) as AsMetadata;\n}\n\nfunction base64url(b: Buffer): string {\n return b.toString(\"base64url\");\n}\n\nfunction pkce(): { verifier: string; challenge: string } {\n const verifier = base64url(randomBytes(32));\n const challenge = base64url(createHash(\"sha256\").update(verifier).digest());\n return { verifier, challenge };\n}\n\nexport function openBrowser(url: string): void {\n // On Windows, `cmd /c start <url>` mis-parses the OAuth URL: cmd treats the\n // `&` before each query param as a command separator. rundll32 opens the\n // default browser with the URL passed verbatim, no shell parsing.\n const [cmd, args] =\n process.platform === \"darwin\"\n ? ([\"open\", [url]] as const)\n : process.platform === \"win32\"\n ? ([\"rundll32\", [\"url.dll,FileProtocolHandler\", url]] as const)\n : ([\"xdg-open\", [url]] as const);\n try {\n spawn(cmd, [...args], { stdio: \"ignore\", detached: true }).unref();\n } catch {\n /* fall back to the printed URL */\n }\n}\n\nconst CALLBACK_PAGE =\n \"<!doctype html><meta charset=utf-8><title>Paybox</title>\" +\n \"<body style=\\\"font:16px system-ui;padding:3rem;text-align:center\\\">\" +\n \"<h2>Paybox CLI connected</h2><p>You can close this tab and return to the terminal.</p>\";\n\nexport interface LoginOptions {\n scope?: string;\n clientName?: string;\n /** Sink for the \"open this URL\" prompt; defaults to console.error. */\n log?: (msg: string) => void;\n /** Abort with an error if no approval arrives in this long. Default 5 min. */\n timeoutMs?: number;\n}\n\nexport async function loginLoopback(\n baseUrl: string,\n opts: LoginOptions = {},\n): Promise<OAuthTokens> {\n const scope = opts.scope ?? \"mcp offline_access\";\n const clientName = opts.clientName ?? \"Paybox CLI\";\n const log = opts.log ?? ((m: string) => console.error(m));\n const meta = await metadata(baseUrl);\n const resource = mcpResource(baseUrl);\n\n let resolveCode: (v: { code: string; state: string | null }) => void;\n let rejectCode: (e: Error) => void;\n const codePromise = new Promise<{ code: string; state: string | null }>((res, rej) => {\n resolveCode = res;\n rejectCode = rej;\n });\n\n const server = createServer((req, res) => {\n const u = new URL(req.url ?? \"/\", \"http://127.0.0.1\");\n if (u.pathname !== \"/callback\") {\n res.writeHead(404).end();\n return;\n }\n res.writeHead(200, { \"content-type\": \"text/html\" }).end(CALLBACK_PAGE);\n const code = u.searchParams.get(\"code\");\n if (code) resolveCode({ code, state: u.searchParams.get(\"state\") });\n else rejectCode(new Error(u.searchParams.get(\"error\") ?? \"authorization failed\"));\n });\n await new Promise<void>((r) => server.listen(0, \"127.0.0.1\", r));\n const port = (server.address() as AddressInfo).port;\n const redirectUri = `http://127.0.0.1:${port}/callback`;\n\n const timeoutMs = opts.timeoutMs ?? 300_000;\n const timer = setTimeout(\n () => rejectCode(new Error(`login timed out after ${Math.round(timeoutMs / 1000)}s — no approval received`)),\n timeoutMs,\n );\n timer.unref();\n\n try {\n const reg = await fetch(meta.registration_endpoint, {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify({\n client_name: clientName,\n redirect_uris: [redirectUri],\n token_endpoint_auth_method: \"none\",\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n }),\n });\n if (!reg.ok) throw new Error(`client registration failed (${reg.status}): ${await reg.text()}`);\n const { client_id: clientId } = (await reg.json()) as { client_id: string };\n\n const { verifier, challenge } = pkce();\n const state = base64url(randomBytes(16));\n const authUrl =\n `${meta.authorization_endpoint}?response_type=code` +\n `&client_id=${encodeURIComponent(clientId)}` +\n `&redirect_uri=${encodeURIComponent(redirectUri)}` +\n `&code_challenge=${challenge}&code_challenge_method=S256` +\n `&scope=${encodeURIComponent(scope)}` +\n `&state=${state}&resource=${encodeURIComponent(resource)}`;\n\n log(`Opening your browser to approve access:\\n ${authUrl}\\n`);\n openBrowser(authUrl);\n\n const { code, state: returnedState } = await codePromise;\n if (returnedState !== state) throw new Error(\"OAuth state mismatch — aborting\");\n\n const form = new URLSearchParams({\n grant_type: \"authorization_code\",\n code,\n redirect_uri: redirectUri,\n client_id: clientId,\n code_verifier: verifier,\n resource,\n });\n const tok = await fetch(meta.token_endpoint, {\n method: \"POST\",\n headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n body: form,\n });\n if (!tok.ok) throw new Error(`token exchange failed (${tok.status}): ${await tok.text()}`);\n const t = (await tok.json()) as {\n access_token: string;\n refresh_token?: string;\n expires_in?: number;\n };\n return {\n clientId,\n accessToken: t.access_token,\n refreshToken: t.refresh_token,\n expiresAt: t.expires_in ? Date.now() + t.expires_in * 1000 : undefined,\n resource,\n };\n } finally {\n clearTimeout(timer);\n server.close();\n }\n}\n\nexport async function refreshTokens(baseUrl: string, current: OAuthTokens): Promise<OAuthTokens> {\n if (!current.refreshToken) throw new Error(\"no refresh token — run `paybox login` again\");\n const meta = await metadata(baseUrl);\n const resource = current.resource ?? mcpResource(baseUrl);\n const form = new URLSearchParams({\n grant_type: \"refresh_token\",\n refresh_token: current.refreshToken,\n client_id: current.clientId,\n resource,\n });\n const res = await fetch(meta.token_endpoint, {\n method: \"POST\",\n headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n body: form,\n });\n if (!res.ok) throw new Error(`token refresh failed (${res.status}): ${await res.text()}`);\n const t = (await res.json()) as {\n access_token: string;\n refresh_token?: string;\n expires_in?: number;\n };\n return {\n ...current,\n accessToken: t.access_token,\n refreshToken: t.refresh_token ?? current.refreshToken,\n expiresAt: t.expires_in ? Date.now() + t.expires_in * 1000 : undefined,\n resource,\n };\n}\n","// On-disk config: OAuth tokens, an optional pbx_live_ key, and an optional\n// pbxk1. signing key. Stored at ~/.config/paybox/config.json, mode 0600 (the\n// signing key is as sensitive as the iframe's localStorage copy).\n\nimport { chmodSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\nexport interface OAuthTokens {\n clientId: string;\n accessToken: string;\n refreshToken?: string;\n /** Epoch millis the access token expires. */\n expiresAt?: number;\n /** The audience the token is bound to (`<baseUrl>/mcp`). */\n resource: string;\n}\n\nexport interface StoredConfig {\n baseUrl?: string;\n /** Paybox app origin used for signing-key provisioning (derived from baseUrl\n * when unset). */\n appUrl?: string;\n apiKey?: string;\n oauth?: OAuthTokens;\n signingKey?: string;\n}\n\nexport function configDir(): string {\n if (process.env.PAYBOX_CONFIG_DIR) return process.env.PAYBOX_CONFIG_DIR;\n const base = process.env.XDG_CONFIG_HOME ?? join(homedir(), \".config\");\n return join(base, \"paybox\");\n}\n\nexport function configFile(): string {\n return join(configDir(), \"config.json\");\n}\n\nexport function loadConfig(): StoredConfig {\n try {\n return JSON.parse(readFileSync(configFile(), \"utf8\")) as StoredConfig;\n } catch {\n return {};\n }\n}\n\nexport function saveConfig(config: StoredConfig): void {\n // 0700/0600 protect the signing key + refresh token on POSIX. On Windows the\n // mode bits don't set ACLs (see README) — the file is not access-restricted.\n mkdirSync(configDir(), { recursive: true, mode: 0o700 });\n writeFileSync(configFile(), `${JSON.stringify(config, null, 2)}\\n`, { mode: 0o600 });\n // writeFileSync's mode only applies on create; chmod also re-tightens an\n // existing file on overwrite. Skip it on Windows where it's a no-op.\n if (process.platform !== \"win32\") chmodSync(configFile(), 0o600);\n}\n","// localStorage-backed credential store.\n//\n// The agent's MoonX ephemeral-signer KEYPAIR lives ONLY here, in this iframe's\n// localStorage, scoped to the server-declared stable origin (`_meta.ui.domain`).\n// It is read into memory only to produce a signature and is sent ONLY to the\n// MoonX API — never to paybox or the AI assistant.\n//\n// Note what is NOT here: the `walletId` (MoonX `provider_wallet_id`). That is\n// not secret and paybox already holds it from the granted credential, so it\n// rides the `request_wallet_sign` operation instead of the pasted key. The user\n// therefore only pastes one thing: a single token carrying the keypair.\n\nconst STORAGE_KEY = \"paybox.walletSign.creds.v2\";\n\n/** The one-string token prefix. The body is base64url(JSON{p,s}). */\nexport const TOKEN_PREFIX = \"pbxk1.\";\n\n/** The agent's MoonX ephemeral-signer keypair. */\nexport interface Creds {\n /** Ephemeral-signer API public key, hex (optional 0x prefix). */\n apiPubHex: string;\n /** Ephemeral-signer API private key, hex (optional 0x prefix). */\n apiPrivHex: string;\n /** Epoch millis the credential was saved. */\n savedAt: number;\n}\n\n/**\n * Feature-detect a usable localStorage. Some hosts sandbox the iframe with an\n * opaque origin where storage access throws; we degrade to in-session entry.\n */\nexport function hasStorage(): boolean {\n try {\n const probe = \"__paybox_probe__\";\n window.localStorage.setItem(probe, \"1\");\n window.localStorage.removeItem(probe);\n return true;\n } catch {\n return false;\n }\n}\n\n/** Load saved creds, or null if absent / unreadable / malformed. */\nexport function load(): Creds | null {\n try {\n const raw = window.localStorage.getItem(STORAGE_KEY);\n if (!raw) return null;\n const parsed = JSON.parse(raw) as Partial<Creds>;\n if (\n typeof parsed.apiPubHex === \"string\" &&\n typeof parsed.apiPrivHex === \"string\" &&\n parsed.apiPubHex &&\n parsed.apiPrivHex\n ) {\n return {\n apiPubHex: parsed.apiPubHex,\n apiPrivHex: parsed.apiPrivHex,\n savedAt: typeof parsed.savedAt === \"number\" ? parsed.savedAt : 0,\n };\n }\n return null;\n } catch {\n return null;\n }\n}\n\n/** Persist creds. Silently no-ops if storage is unavailable. */\nexport function save(c: Omit<Creds, \"savedAt\"> & { savedAt?: number }): void {\n try {\n const toStore: Creds = {\n apiPubHex: c.apiPubHex,\n apiPrivHex: c.apiPrivHex,\n savedAt: c.savedAt ?? Date.now(),\n };\n window.localStorage.setItem(STORAGE_KEY, JSON.stringify(toStore));\n } catch {\n /* storage unavailable — caller keeps creds in memory for this session */\n }\n}\n\n/** Forget the credential on this device. */\nexport function clear(): void {\n try {\n window.localStorage.removeItem(STORAGE_KEY);\n } catch {\n /* nothing to clear if storage is unavailable */\n }\n}\n\n/**\n * Validate a hex string (optional 0x prefix, even length, hex digits only).\n * Returns an error string for display, or null when valid.\n */\nexport function validateHex(s: string, label: string): string | null {\n const trimmed = s.trim();\n if (!trimmed) return `${label} is required`;\n const body = trimmed.startsWith(\"0x\") || trimmed.startsWith(\"0X\") ? trimmed.slice(2) : trimmed;\n if (body.length === 0) return `${label} is empty`;\n if (body.length % 2 !== 0) return `${label} must have an even number of hex digits`;\n if (!/^[0-9a-fA-F]+$/.test(body)) return `${label} must be hexadecimal`;\n return null;\n}\n\n// ---------------------------------------------------------------------------\n// One-string token codec — the single value the user copies from the paybox\n// app (OAuth consent / Agents) and pastes here. Format:\n// pbxk1.<base64url(JSON.stringify({ p: apiPubHex, s: apiPrivHex }))>\n// It carries the keypair only — no walletId, no publishable key. It is the raw\n// secret in transit (same trust model as showing the key): it leaves the app\n// via the clipboard and is pasted here; it never goes to paybox.\n// ---------------------------------------------------------------------------\n\nfunction b64urlEncode(s: string): string {\n return btoa(s).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction b64urlDecode(s: string): string {\n let b = s.replace(/-/g, \"+\").replace(/_/g, \"/\");\n while (b.length % 4) b += \"=\";\n return atob(b);\n}\n\n/** Encode a keypair into the one-string token (mirrors the app side). */\nexport function encodeToken(c: { apiPubHex: string; apiPrivHex: string }): string {\n return TOKEN_PREFIX + b64urlEncode(JSON.stringify({ p: c.apiPubHex, s: c.apiPrivHex }));\n}\n\n/**\n * Parse a pasted token into a keypair, or null if it isn't a well-formed token\n * with two hex values. Accepts the canonical `pbxk1.` token and also tolerates\n * a bare base64url(JSON) body (in case the prefix is stripped on copy/paste).\n */\nexport function parseToken(input: string): { apiPubHex: string; apiPrivHex: string } | null {\n const t = input.trim();\n if (!t) return null;\n const body = t.startsWith(TOKEN_PREFIX) ? t.slice(TOKEN_PREFIX.length) : t;\n let obj: unknown;\n try {\n obj = JSON.parse(b64urlDecode(body));\n } catch {\n return null;\n }\n if (!obj || typeof obj !== \"object\") return null;\n const o = obj as Record<string, unknown>;\n const apiPubHex = String(o.p ?? o.apiPubHex ?? \"\").trim();\n const apiPrivHex = String(o.s ?? o.apiPrivHex ?? \"\").trim();\n if (!apiPubHex || !apiPrivHex) return null;\n if (validateHex(apiPubHex, \"key\") || validateHex(apiPrivHex, \"key\")) return null;\n return { apiPubHex, apiPrivHex };\n}\n","// The signing core: intent → MoonX ephemeral-signer signature → artifact.\n//\n// SPLIT-TRUST signing (the whole point of this design):\n// - This iframe holds the agent KEYPAIR (apiPub/apiPriv, from the pasted\n// pbxk1 token) and NOTHING ELSE. It builds the chain-specific digest, then\n// builds the MoonX request envelope and ed25519-signs it with apiPriv.\n// - It does NOT call MoonX and does NOT hold the MoonX secret key. The\n// secret-gated `/sign` HTTP call happens SERVER-SIDE, via the paybox\n// `moonx_sign` MCP tool (see `transport`). paybox adds the secret key,\n// which never reaches the browser.\n//\n// We reuse the @moon-x adapters purely for their CHAIN LOGIC (digest building +\n// signature assembly) by constructing them with a custom sign fn:\n// - EVM: new MoonXEvmSigner(ecdsaSign) — ecdsaSign: (digest) => {r,s,yParity}\n// - Solana: new MoonXSolanaSigner(ed25519Sign, address) — (bytes) => Uint8Array\n// Our custom fns build + ed25519-sign the envelope and delegate the actual\n// signing to `transport` (the moonx_sign tool). The envelope format mirrors\n// @moon-x/core's signWithEphemeralSigner exactly.\n//\n// The artifact returned is EXACTLY the old shape per op, so the paybox server\n// (which stores it via submit_signature) is unaffected.\n\nimport { Buffer } from \"buffer\";\nimport nacl from \"tweetnacl\";\nimport { MoonXEvmSigner, EvmSchemeMismatchError } from \"@moon-x/evm-adapter\";\nimport { MoonXSolanaSigner, SolanaSchemeMismatchError } from \"@moon-x/solana-adapter\";\nimport { Transaction } from \"@solana/web3.js\";\nimport { keccak256, serializeTransaction } from \"viem\";\nimport type {\n Authorization,\n TransactionSerializable,\n TypedDataDefinition,\n} from \"viem\";\n\nimport type { Creds } from \"./creds.js\";\n\n// Transactions carry bigints (value/gas/fees), which JSON can't represent —\n// they arrive as decimal strings and are revived here. Mirrors the old path.\nexport interface WireTx {\n to: `0x${string}`;\n value: string;\n data?: `0x${string}`;\n chainId: number;\n gas: string;\n maxPriorityFeePerGas: string;\n maxFeePerGas: string;\n nonce: number;\n}\n\n/**\n * The intent to sign — the `op` discriminator + op-specific fields. The host\n * delivers this as `operation.intent` in the `request_wallet_sign` tool result.\n */\nexport type SignIntent =\n | { op: \"message\"; message: string }\n | { op: \"typedData\"; typedData: TypedDataDefinition }\n | { op: \"transaction\"; transaction: WireTx }\n | { op: \"authorization\"; authorization: Authorization }\n | { op: \"solanaMessage\"; address: string; message: string }\n | { op: \"solanaTransaction\"; address: string; transactionBase64: string }\n | { op: \"raw\"; rawSigningPayloadHex: string };\n\n/** The wallet's MoonX binding, supplied by paybox on the request (NOT the\n * pasted key). `keyId`/`derivationPath` are captured at provision time. */\nexport interface WalletBinding {\n walletId: string;\n keyId: string;\n derivationPath: string;\n}\n\n/** MoonX's raw `/sign` response, relayed back through the moonx_sign tool. */\nexport interface MoonxSignResult {\n scheme: string;\n signature: {\n /** ECDSA: lowercase-hex r/s (no 0x) + recovery_id 0..3. */\n r?: string;\n s?: string;\n recovery_id?: number;\n /** Ed25519: lowercase-hex 64-byte signature. */\n signature?: string;\n };\n}\n\n/**\n * Performs the secret-gated MoonX `/sign` call on the server. Given the envelope\n * this iframe built + signed, it returns MoonX's raw signature. Implemented by\n * the UI layer as a `moonx_sign` MCP tool call (the server adds the secret key\n * + the request_id/api_pub binding).\n */\nexport type MoonxSignTransport = (envelope: {\n signed_body: string;\n agent_signature: string;\n}) => Promise<MoonxSignResult>;\n\nexport type SignArtifactResult =\n | { ok: true; artifact: Record<string, unknown> }\n | { ok: false; error: string };\n\nfunction reviveTx(w: WireTx): TransactionSerializable {\n return {\n type: \"eip1559\",\n to: w.to,\n value: BigInt(w.value),\n data: w.data,\n chainId: w.chainId,\n gas: BigInt(w.gas),\n maxPriorityFeePerGas: BigInt(w.maxPriorityFeePerGas),\n maxFeePerGas: BigInt(w.maxFeePerGas),\n nonce: w.nonce,\n };\n}\n\nfunction hexToBytes(hex: string): Uint8Array {\n return new Uint8Array(Buffer.from(hex.replace(/^0x/, \"\"), \"hex\"));\n}\nfunction bytesToHex(bytes: Uint8Array): string {\n return Buffer.from(bytes).toString(\"hex\");\n}\n\n/**\n * Build the MoonX `/sign` envelope and ed25519-sign it with the agent key.\n * Mirrors @moon-x/core `signWithEphemeralSigner` byte-for-byte: the signature\n * is over the UTF-8 JSON `{raw_signing_payload, key_id, derivation_path,\n * issued_at}` and `signed_body` is the hex of those exact bytes.\n */\nfunction buildEnvelope(\n rawSigningPayloadHex: string,\n binding: WalletBinding,\n creds: Creds,\n): { signed_body: string; agent_signature: string } {\n const signedPayload = {\n raw_signing_payload: rawSigningPayloadHex.replace(/^0x/, \"\").toLowerCase(),\n key_id: binding.keyId,\n derivation_path: binding.derivationPath,\n issued_at: new Date().toISOString(),\n };\n const signedBodyBytes = new TextEncoder().encode(JSON.stringify(signedPayload));\n // apiPrivHex is the 32-byte Ed25519 seed (64 hex chars).\n const keyPair = nacl.sign.keyPair.fromSeed(hexToBytes(creds.apiPrivHex));\n const agentSig = nacl.sign.detached(signedBodyBytes, keyPair.secretKey);\n return {\n signed_body: bytesToHex(signedBodyBytes),\n agent_signature: bytesToHex(agentSig),\n };\n}\n\n/**\n * The EIP-1559 signing hash for an unsigned tx — `keccak256` of the typed,\n * RLP-serialized unsigned transaction. Matches the server's\n * `eth_tx::signing_hash` (alloy) byte-for-byte, so the agent signature is over\n * the exact digest the server re-derives, validates, and asks MoonX to sign.\n */\nexport function eip1559SigningHash(tx: WireTx): `0x${string}` {\n return keccak256(serializeTransaction(reviveTx(tx)));\n}\n\n/**\n * The Solana signing payload (hex): the tx message — everything after the single\n * zeroed signature slot in `[shortvec sig_count=1][64-byte slot][message…]`.\n * MUST match the server's `solana::signing_payload` byte-for-byte.\n */\nexport function solanaSigningPayload(base64Tx: string): string {\n const raw = Buffer.from(base64Tx, \"base64\");\n // Decode the compact-u16 (\"shortvec\") signature count.\n let i = 0;\n let sigCount = 0;\n let shift = 0;\n for (;;) {\n const b = raw[i++];\n sigCount |= (b & 0x7f) << shift;\n if ((b & 0x80) === 0) break;\n shift += 7;\n }\n if (sigCount !== 1) {\n throw new Error(`expected a single-signer solana tx, got ${sigCount} signature slot(s)`);\n }\n return bytesToHex(new Uint8Array(raw.subarray(i + 64)));\n}\n\n/** One agent-signed signing envelope for the server-completes swap path. */\nexport interface TxEnvelope {\n api_pub: string;\n signed_body: string;\n agent_signature: string;\n}\n\n/** A sign-ready tx from the swap plan: an EVM `WireTx` (eip1559 fields), or a\n * base64 Solana tx string tagged `vm:\"solana\"`. */\nexport interface PlanTx {\n vm?: string;\n transaction: WireTx | string;\n}\n\n/**\n * One agent-signed envelope per parked tx for `submit_envelope` — NO tx bytes,\n * just the agent signature over each tx's payload (EVM: EIP-1559 sighash;\n * Solana: the tx message). Throws if the wallet isn't provisioned.\n */\nexport function buildSwapEnvelopes(\n txs: PlanTx[],\n binding: WalletBinding,\n creds: Creds,\n): TxEnvelope[] {\n if (!binding.walletId) {\n throw new Error(\"paybox did not supply a wallet id for this operation.\");\n }\n if (!binding.keyId || !binding.derivationPath) {\n throw new Error(\n \"This wallet isn't provisioned for signing yet (missing key binding). \" +\n \"Re-provision it in the paybox app, then retry.\",\n );\n }\n return txs.map((t) => {\n const payload =\n t.vm === \"solana\"\n ? solanaSigningPayload(t.transaction as string)\n : eip1559SigningHash(t.transaction as WireTx);\n const { signed_body, agent_signature } = buildEnvelope(payload, binding, creds);\n return { api_pub: creds.apiPubHex, signed_body, agent_signature };\n });\n}\n\n/** A gasless (SPE-248) prepared digest the iframe must sign: the runtime digest\n * `wallet_prepareCalls` returned (`signatureRequest.rawPayload`) plus its kind.\n * `userOp` is the ERC-4337 UserOp hash; `authorization` is the EIP-7702\n * authorization hash, present only on a wallet's first (delegating) gasless op. */\nexport interface GaslessDigest {\n kind: \"userOp\" | \"authorization\";\n /** The 32-byte digest as hex (Alchemy's `signatureRequest.rawPayload`). */\n rawPayloadHex: string;\n}\n\n/**\n * Build one agent-signed envelope per gasless digest, for the server-completes\n * gasless path (SPE-248). The UserOp hash and the EIP-7702 authorization hash\n * are produced SERVER-SIDE at runtime by Alchemy's `wallet_prepareCalls`, so —\n * unlike a raw EVM tx — the iframe can't derive them; it signs the digests\n * Alchemy already computed (`signatureRequest.rawPayload`), exactly the\n * `WalletSignIntent::Raw` mechanism (`buildEnvelope(rawSigningPayloadHex)`). The\n * server (`gasless::sign_digest`) matches each envelope to a prepared item by\n * `raw_signing_payload`, runs the secret-gated MoonX `/sign`, assembles the\n * secp256k1 `r‖s‖v`, and submits via `wallet_sendPreparedCalls`.\n *\n * Both kinds sign as a raw digest here — the server already has Alchemy's auth\n * hash, so the iframe does NOT re-derive it from an `Authorization` object (the\n * interactive `request_wallet_sign` `authorization` op does that, for an agent\n * signing a standalone 7702 auth; the gasless batch path signs the prepared\n * digest directly). `runSwap` calls this (over `plan.gasless`) instead of\n * `buildSwapEnvelopes` for a gasless-quoted swap. Throws if the wallet isn't\n * provisioned.\n */\nexport function buildGaslessEnvelopes(\n digests: GaslessDigest[],\n binding: WalletBinding,\n creds: Creds,\n): TxEnvelope[] {\n if (!binding.walletId) {\n throw new Error(\"paybox did not supply a wallet id for this operation.\");\n }\n if (!binding.keyId || !binding.derivationPath) {\n throw new Error(\n \"This wallet isn't provisioned for signing yet (missing key binding). \" +\n \"Re-provision it in the paybox app, then retry.\",\n );\n }\n return digests.map((d) => {\n const { signed_body, agent_signature } = buildEnvelope(d.rawPayloadHex, binding, creds);\n return { api_pub: creds.apiPubHex, signed_body, agent_signature };\n });\n}\n\n/** Resolve a wallet binding (`key_id` + `derivation_path`) the authoritative\n * way — via the server's secret-gated `/me/wallets`. Used when paybox hasn't\n * pre-captured the binding (ambiguous grant). The iframe ed25519-signs an\n * `{issued_at}` envelope; `resolve` (a `moonx_resolve_binding` tool call)\n * returns the binding for the request's wallet. */\nexport type ResolveBindingTransport = (envelope: {\n signed_body: string;\n agent_signature: string;\n}) => Promise<{ key_id?: string; derivation_path?: string }>;\n\n/**\n * Build + ed25519-sign an `{issued_at}` envelope with the agent key. Used for\n * the secret-gated tools that authenticate the signer without a chain payload —\n * `moonx_resolve_binding` and `prepare_swap`. Mirrors the server's expectation:\n * the signature is over the UTF-8 JSON `{issued_at}` and `signed_body` is its hex.\n */\nexport function buildIssuedAtEnvelope(creds: Creds): {\n signed_body: string;\n agent_signature: string;\n} {\n const signedBodyBytes = new TextEncoder().encode(\n JSON.stringify({ issued_at: new Date().toISOString() }),\n );\n const keyPair = nacl.sign.keyPair.fromSeed(hexToBytes(creds.apiPrivHex));\n const agentSig = nacl.sign.detached(signedBodyBytes, keyPair.secretKey);\n return {\n signed_body: bytesToHex(signedBodyBytes),\n agent_signature: bytesToHex(agentSig),\n };\n}\n\nexport async function resolveWalletBinding(\n creds: Creds,\n resolve: ResolveBindingTransport,\n): Promise<{ keyId: string; derivationPath: string }> {\n const res = await resolve(buildIssuedAtEnvelope(creds));\n if (!res.key_id || !res.derivation_path) {\n throw new Error(\"MoonX returned no binding for this wallet\");\n }\n return { keyId: res.key_id, derivationPath: res.derivation_path };\n}\n\n/**\n * Sign `intent` for `binding` using the agent `creds`, delegating the\n * secret-gated MoonX call to `transport` (the server). Returns the artifact —\n * exactly the old per-op shape — or an error string. Never throws; never logs\n * the key.\n */\nexport async function signIntent(\n intent: SignIntent,\n creds: Creds,\n binding: WalletBinding,\n transport: MoonxSignTransport,\n): Promise<SignArtifactResult> {\n if (!binding.walletId) {\n return { ok: false, error: \"paybox did not supply a wallet id for this operation.\" };\n }\n if (!binding.keyId || !binding.derivationPath) {\n return {\n ok: false,\n error:\n \"This wallet isn't provisioned for signing yet (missing key binding). \" +\n \"Re-provision it in the paybox app, then retry.\",\n };\n }\n\n // EVM: the adapter builds the digest + assembles the signature; we own only\n // the transport (envelope build + ed25519 + the server sign call).\n const ecdsaSign = async (digest: `0x${string}`) => {\n const result = await transport(buildEnvelope(digest, binding, creds));\n const { r, s, recovery_id } = result.signature;\n if (r == null || s == null || recovery_id == null) {\n throw new Error(\"MoonX returned an ECDSA result without {r, s, recovery_id}\");\n }\n return {\n r: `0x${r}` as `0x${string}`,\n s: `0x${s}` as `0x${string}`,\n yParity: recovery_id as 0 | 1,\n };\n };\n // Solana: sign fn takes the raw message bytes, returns the 64-byte signature.\n const ed25519Sign = async (message: Uint8Array) => {\n const result = await transport(buildEnvelope(bytesToHex(message), binding, creds));\n const sig = result.signature.signature;\n if (!sig) throw new Error(\"MoonX returned an Ed25519 result without a signature\");\n return hexToBytes(sig);\n };\n\n try {\n switch (intent.op) {\n case \"message\":\n return {\n ok: true,\n artifact: { signature: await new MoonXEvmSigner(ecdsaSign).signMessage(intent.message) },\n };\n case \"typedData\":\n return {\n ok: true,\n artifact: {\n signature: await new MoonXEvmSigner(ecdsaSign).signTypedData(intent.typedData),\n },\n };\n case \"transaction\":\n return {\n ok: true,\n artifact: {\n serializedTransaction: await new MoonXEvmSigner(ecdsaSign).signTransaction(\n reviveTx(intent.transaction),\n ),\n },\n };\n case \"authorization\":\n return {\n ok: true,\n artifact: {\n authorization: await new MoonXEvmSigner(ecdsaSign).signAuthorization(\n intent.authorization,\n ),\n },\n };\n case \"solanaMessage\": {\n const sig = await new MoonXSolanaSigner(ed25519Sign, intent.address).signMessage(\n intent.message,\n );\n return { ok: true, artifact: { signature: bytesToHex(sig) } };\n }\n case \"solanaTransaction\": {\n const tx = Transaction.from(Buffer.from(intent.transactionBase64, \"base64\"));\n const signed = await new MoonXSolanaSigner(ed25519Sign, intent.address).signTransaction(\n tx,\n );\n return {\n ok: true,\n artifact: { signedTransactionBase64: Buffer.from(signed).toString(\"base64\") },\n };\n }\n case \"raw\": {\n // No chain logic — the digest is given. Build + sign + relay directly.\n const result = await transport(buildEnvelope(intent.rawSigningPayloadHex, binding, creds));\n return { ok: true, artifact: { scheme: result.scheme, signature: result.signature } };\n }\n default:\n return { ok: false, error: `unknown op: ${(intent as { op?: string }).op}` };\n }\n } catch (err) {\n if (err instanceof EvmSchemeMismatchError || err instanceof SolanaSchemeMismatchError) {\n return { ok: false, error: err.message };\n }\n const message = err instanceof Error ? err.message : String(err);\n return { ok: false, error: message };\n }\n}\n","// In-process, non-custodial wallet signing — the SDK's replacement for the MCP\n// host iframe. The signing CORE is reused verbatim from the iframe\n// (@paybox/mcp-app/sign): it builds the chain digest, ed25519-signs the MoonX\n// envelope with the agent's pbxk1. keypair, and delegates the secret-gated MoonX\n// /sign to the server (the secret never reaches the client). Here we only swap\n// the iframe's MCP-tool transport for the SDK's REST calls.\n\nimport { parseToken } from \"@paybox/mcp-app/creds\";\nimport type { Creds } from \"@paybox/mcp-app/creds\";\nimport {\n buildIssuedAtEnvelope,\n buildSwapEnvelopes,\n signIntent,\n} from \"@paybox/mcp-app/sign\";\nimport type {\n MoonxSignResult,\n SignIntent,\n TxEnvelope,\n WalletBinding,\n} from \"@paybox/mcp-app/sign\";\n\nimport type { BindingResponse, SwapPlan } from \"./types.js\";\n\n/** POST `{path}` (relative to the API base) with a JSON body, returning parsed\n * JSON. Supplied by the client so the signer reuses its auth + base URL. */\nexport type Poster = (path: string, body: unknown) => Promise<unknown>;\n\n/** Parse the one-string `pbxk1.` token into the agent keypair the core expects. */\nexport function credsFromToken(token: string): Creds {\n const kp = parseToken(token);\n if (!kp) {\n throw new Error(\"invalid signing key: expected a `pbxk1.` token (keypair only)\");\n }\n return { apiPubHex: kp.apiPubHex, apiPrivHex: kp.apiPrivHex, savedAt: Date.now() };\n}\n\nfunction toBinding(b: BindingResponse): WalletBinding {\n return { walletId: b.wallet_id, keyId: b.key_id ?? \"\", derivationPath: b.derivation_path ?? \"\" };\n}\n\n/** Resolve the wallet binding (key_id + derivation_path) for a parked request via\n * the server's secret-gated `/binding` route (the `moonx_resolve_binding` twin). */\nasync function resolveBinding(\n post: Poster,\n requestId: string,\n creds: Creds,\n): Promise<WalletBinding> {\n const env = buildIssuedAtEnvelope(creds);\n const r = (await post(`/agent/requests/${requestId}/binding`, {\n api_pub: creds.apiPubHex,\n signed_body: env.signed_body,\n agent_signature: env.agent_signature,\n })) as BindingResponse;\n return toBinding(r);\n}\n\n/** Sign a parked `request_wallet_sign` and submit the artifact. Uses the binding\n * the server echoed on the wallet-sign response when it's complete (avoiding an\n * extra secret-gated resolve), and only resolves when it isn't. The MoonX\n * secret call runs server-side via `/moonx-sign`; the artifact lands via\n * `/signature`. */\nexport async function signWalletRequest(\n post: Poster,\n requestId: string,\n intent: SignIntent,\n creds: Creds,\n binding?: BindingResponse | null,\n): Promise<Record<string, unknown>> {\n const resolved =\n binding && binding.key_id && binding.derivation_path\n ? toBinding(binding)\n : await resolveBinding(post, requestId, creds);\n const transport = (envelope: { signed_body: string; agent_signature: string }) =>\n post(`/agent/requests/${requestId}/moonx-sign`, {\n api_pub: creds.apiPubHex,\n ...envelope,\n }) as Promise<MoonxSignResult>;\n const result = await signIntent(intent, creds, resolved, transport);\n if (!result.ok) throw new Error(result.error);\n await post(`/agent/requests/${requestId}/signature`, { artifact: result.artifact });\n return result.artifact;\n}\n\n/** Sign every tx of a parked swap plan, in order, and submit the envelopes;\n * the server verifies, signs (secret-gated), encodes, and broadcasts. */\nexport async function signSwapRequest(\n post: Poster,\n requestId: string,\n plan: SwapPlan,\n creds: Creds,\n): Promise<void> {\n let binding: WalletBinding = {\n walletId: plan.binding.wallet_id,\n keyId: plan.binding.key_id ?? \"\",\n derivationPath: plan.binding.derivation_path ?? \"\",\n };\n if (binding.walletId && (!binding.keyId || !binding.derivationPath)) {\n binding = await resolveBinding(post, requestId, creds);\n }\n const envelopes: TxEnvelope[] = buildSwapEnvelopes(plan.txs, binding, creds);\n await post(`/agent/requests/${requestId}/envelopes`, { envelopes });\n}\n","// PayboxClient — the typed REST client mirroring the MCP agent tools. Each method\n// maps to a `/agent/*` route; `request_wallet_sign` / `request_swap` additionally\n// drive in-process signing when a `pbxk1.` signing key is configured.\n\nimport { refreshTokens } from \"./auth.js\";\nimport { loadConfig, saveConfig, type OAuthTokens } from \"./config.js\";\nimport { credsFromToken, signSwapRequest, signWalletRequest, type Poster } from \"./signer.js\";\nimport type {\n RequestPaymentArgs,\n RequestSecretArgs,\n RequestSwapArgs,\n RequestWalletSignArgs,\n} from \"./types.generated.js\";\nimport type {\n AgentResponse,\n ClientGrantSummary,\n PaymentArgs,\n PortfolioArgs,\n SecretArgs,\n SwapArgs,\n SwapResult,\n WalletSignArgs,\n WalletSignResult,\n} from \"./types.js\";\n\nconst DEFAULT_BASE_URL = \"https://api.paybox.sh\";\nconst EXPIRY_SKEW_MS = 60_000;\n\nexport class PayboxError extends Error {\n constructor(\n readonly status: number,\n readonly body: string,\n context: string,\n ) {\n super(`paybox ${context} failed (${status}): ${body}`);\n this.name = \"PayboxError\";\n }\n}\n\nexport interface PayboxClientOptions {\n /** API origin (the OAuth issuer). Default `https://api.paybox.sh`. */\n baseUrl?: string;\n /** A `pbx_live_*` personal API key. */\n apiKey?: string;\n /** A raw OAuth access token (skips the stored-token path). */\n token?: string;\n /** A `pbxk1.` signing key token; enables in-process wallet/swap signing. */\n signingKey?: string;\n fetchImpl?: typeof fetch;\n}\n\nexport interface SignOptions {\n /** Sign in-process when the request clears to `pending_signature`. Default true. */\n autoSign?: boolean;\n}\n\nexport class PayboxClient {\n readonly baseUrl: string;\n private readonly opts: PayboxClientOptions;\n private readonly fetchImpl: typeof fetch;\n private oauth?: OAuthTokens;\n private configBacked = false;\n\n constructor(options: PayboxClientOptions = {}) {\n this.opts = options;\n this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/+$/, \"\");\n this.fetchImpl = options.fetchImpl ?? fetch;\n }\n\n /** Build a client from `~/.config/paybox/config.json` + env, with overrides. */\n static fromConfig(overrides: PayboxClientOptions = {}): PayboxClient {\n const cfg = loadConfig();\n const client = new PayboxClient({\n baseUrl: overrides.baseUrl ?? process.env.PAYBOX_API_URL ?? cfg.baseUrl,\n apiKey: overrides.apiKey ?? process.env.PAYBOX_API_KEY ?? cfg.apiKey,\n token: overrides.token ?? process.env.PAYBOX_ACCESS_TOKEN,\n signingKey: overrides.signingKey ?? process.env.PAYBOX_SIGNING_KEY ?? cfg.signingKey,\n fetchImpl: overrides.fetchImpl,\n });\n if (!client.opts.apiKey && !client.opts.token && cfg.oauth) {\n client.oauth = cfg.oauth;\n client.configBacked = true;\n }\n return client;\n }\n\n /** Whether in-process signing is available (a `pbxk1.` key is configured). */\n get canSign(): boolean {\n return Boolean(this.opts.signingKey);\n }\n\n private async bearer(): Promise<string> {\n if (this.opts.token) return this.opts.token;\n if (this.opts.apiKey) return this.opts.apiKey;\n if (this.oauth) {\n if (this.oauth.expiresAt && Date.now() > this.oauth.expiresAt - EXPIRY_SKEW_MS) {\n this.oauth = await refreshTokens(this.baseUrl, this.oauth);\n if (this.configBacked) {\n const cfg = loadConfig();\n cfg.oauth = this.oauth;\n saveConfig(cfg);\n }\n }\n return this.oauth.accessToken;\n }\n throw new Error(\n \"not authenticated — run `paybox login`, set PAYBOX_API_KEY, or pass { apiKey } / { token }\",\n );\n }\n\n private async request<T>(\n method: string,\n path: string,\n init: { query?: Record<string, string | undefined>; body?: unknown } = {},\n ): Promise<T> {\n const url = new URL(this.baseUrl + path);\n for (const [k, v] of Object.entries(init.query ?? {})) {\n if (v != null) url.searchParams.set(k, v);\n }\n const headers: Record<string, string> = { authorization: `Bearer ${await this.bearer()}` };\n let body: string | undefined;\n if (init.body !== undefined) {\n headers[\"content-type\"] = \"application/json\";\n body = JSON.stringify(init.body);\n }\n const res = await this.fetchImpl(url, { method, headers, body });\n const text = await res.text();\n if (!res.ok) throw new PayboxError(res.status, text, `${method} ${path}`);\n return (text ? JSON.parse(text) : undefined) as T;\n }\n\n private readonly poster: Poster = (path, body) => this.request<unknown>(\"POST\", path, { body });\n\n /** List the credentials this client may use (the `list_credentials` tool). */\n listCredentials(): Promise<ClientGrantSummary[]> {\n return this.request(\"GET\", \"/agent/grants\");\n }\n\n /** Token balances across chains (the `get_portfolio` tool). */\n getPortfolio(args: PortfolioArgs): Promise<unknown> {\n return this.request(\"GET\", \"/agent/portfolio\", {\n query: { address: args.address, network_ids: args.networkIds },\n });\n }\n\n /** Charge a card credential (the `request_payment` tool). */\n requestPayment(args: PaymentArgs): Promise<AgentResponse> {\n const operation: RequestPaymentArgs & { type: \"payment\" } = {\n type: \"payment\",\n credential_id: args.credentialId,\n merchant: args.merchant,\n merchant_url: args.merchantUrl,\n amount_cents: args.amountCents,\n currency: args.currency ?? \"USD\",\n };\n return this.request(\"POST\", \"/agent/request\", { body: { operation } });\n }\n\n /** Reveal a secret credential (the `request_secret` tool). */\n requestSecret(args: SecretArgs): Promise<AgentResponse> {\n const operation: RequestSecretArgs & { type: \"secret\" } = {\n type: \"secret\",\n credential_id: args.credentialId,\n raw: args.raw ?? false,\n purpose: args.purpose ?? null,\n };\n return this.request(\"POST\", \"/agent/request\", { body: { operation } });\n }\n\n /** Sign with a wallet credential (the `request_wallet_sign` tool). Signs\n * in-process and returns the completed request when a signing key is set and\n * the request clears immediately; otherwise returns the pending response.\n * Uses `/agent/wallet-sign`, which echoes the wallet binding so the signer\n * need not resolve it separately. */\n async requestWalletSign(args: WalletSignArgs, opts: SignOptions = {}): Promise<AgentResponse> {\n const operation: RequestWalletSignArgs & { type: \"wallet_sign\" } = {\n type: \"wallet_sign\",\n credential_id: args.credentialId,\n intent: args.intent,\n };\n const { response, binding } = await this.request<WalletSignResult>(\n \"POST\",\n \"/agent/wallet-sign\",\n { body: { operation } },\n );\n if (\n (opts.autoSign ?? true) &&\n response.status === \"pending_signature\" &&\n this.opts.signingKey\n ) {\n await signWalletRequest(\n this.poster,\n response.request_id,\n args.intent,\n credsFromToken(this.opts.signingKey),\n binding,\n );\n return this.getRequest(response.request_id);\n }\n return response;\n }\n\n /** Swap tokens from a wallet credential (the `request_swap` tool). Returns the\n * parked response + sign-ready plan; signs + submits in-process when a signing\n * key is set and the swap cleared immediately. */\n async requestSwap(args: SwapArgs, opts: SignOptions = {}): Promise<SwapResult> {\n const operation: RequestSwapArgs & { type: \"swap\" } = {\n type: \"swap\",\n credential_id: args.credentialId,\n src_chain: args.srcChain,\n dst_chain: args.dstChain ?? args.srcChain,\n src_token: args.srcToken,\n dst_token: args.dstToken,\n amount: args.amount,\n swap_direction: args.swapDirection ?? \"exact-amount-in\",\n slippage_bps: args.slippageBps ?? 50,\n recipient: args.recipient ?? null,\n value_cents: args.valueCents ?? null,\n };\n const result = await this.request<SwapResult>(\"POST\", \"/agent/swap\", { body: { operation } });\n if (\n (opts.autoSign ?? true) &&\n result.response.status === \"pending_signature\" &&\n this.opts.signingKey\n ) {\n await signSwapRequest(\n this.poster,\n result.response.request_id,\n result.plan,\n credsFromToken(this.opts.signingKey),\n );\n return { ...result, response: await this.getRequest(result.response.request_id) };\n }\n return result;\n }\n\n /** Poll a request's status (the `get_request` tool). */\n getRequest(requestId: string): Promise<AgentResponse> {\n return this.request(\"GET\", `/agent/requests/${requestId}`);\n }\n\n /** Poll until the request leaves a pending state (or the timeout elapses). */\n async waitForRequest(\n requestId: string,\n opts: { intervalMs?: number; timeoutMs?: number } = {},\n ): Promise<AgentResponse> {\n const interval = opts.intervalMs ?? 2000;\n const deadline = Date.now() + (opts.timeoutMs ?? 300_000);\n for (;;) {\n const r = await this.getRequest(requestId);\n const pending = r.status === \"pending_approval\" || r.status === \"pending_signature\";\n if (!pending || Date.now() > deadline) return r;\n await new Promise((res) => setTimeout(res, interval));\n }\n }\n}\n"],"mappings":";AAQA,SAAS,aAAa;AACtB,SAAS,YAAY,mBAAmB;AACxC,SAAS,oBAAoB;AAMtB,SAAS,YAAY,SAAyB;AACnD,SAAO,GAAG,QAAQ,QAAQ,QAAQ,EAAE,CAAC;AACvC;AAMO,SAAS,YAAY,SAAiB,UAAkC;AAC7E,MAAI,SAAU,QAAO,SAAS,QAAQ,QAAQ,EAAE;AAChD,QAAM,IAAI,QAAQ,QAAQ,QAAQ,EAAE,EAAE,MAAM,0BAA0B;AACtE,SAAO,IAAI,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK;AACpC;AAGO,SAAS,cAAc,aAAoC;AAChE,QAAM,UAAU,YAAY,MAAM,GAAG,EAAE,CAAC;AACxC,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,MAAM,CAAC;AAG5E,WAAO,OAAO,OAAO;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,eAAe,SAAS,SAAsC;AAC5D,QAAM,MAAM,GAAG,QAAQ,QAAQ,QAAQ,EAAE,CAAC;AAC1C,QAAM,MAAM,MAAM,MAAM,GAAG;AAC3B,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,MAAM,sCAAsC,GAAG,KAAK,IAAI,MAAM,GAAG;AAAA,EAC7E;AACA,SAAQ,MAAM,IAAI,KAAK;AACzB;AAEA,SAAS,UAAU,GAAmB;AACpC,SAAO,EAAE,SAAS,WAAW;AAC/B;AAEA,SAAS,OAAgD;AACvD,QAAM,WAAW,UAAU,YAAY,EAAE,CAAC;AAC1C,QAAM,YAAY,UAAU,WAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,CAAC;AAC1E,SAAO,EAAE,UAAU,UAAU;AAC/B;AAEO,SAAS,YAAY,KAAmB;AAI7C,QAAM,CAAC,KAAK,IAAI,IACd,QAAQ,aAAa,WAChB,CAAC,QAAQ,CAAC,GAAG,CAAC,IACf,QAAQ,aAAa,UAClB,CAAC,YAAY,CAAC,+BAA+B,GAAG,CAAC,IACjD,CAAC,YAAY,CAAC,GAAG,CAAC;AAC3B,MAAI;AACF,UAAM,KAAK,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,UAAU,UAAU,KAAK,CAAC,EAAE,MAAM;AAAA,EACnE,QAAQ;AAAA,EAER;AACF;AAEA,IAAM,gBACJ;AAaF,eAAsB,cACpB,SACA,OAAqB,CAAC,GACA;AACtB,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,MAAM,KAAK,QAAQ,CAAC,MAAc,QAAQ,MAAM,CAAC;AACvD,QAAM,OAAO,MAAM,SAAS,OAAO;AACnC,QAAM,WAAW,YAAY,OAAO;AAEpC,MAAI;AACJ,MAAI;AACJ,QAAM,cAAc,IAAI,QAAgD,CAAC,KAAK,QAAQ;AACpF,kBAAc;AACd,iBAAa;AAAA,EACf,CAAC;AAED,QAAM,SAAS,aAAa,CAAC,KAAK,QAAQ;AACxC,UAAM,IAAI,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AACpD,QAAI,EAAE,aAAa,aAAa;AAC9B,UAAI,UAAU,GAAG,EAAE,IAAI;AACvB;AAAA,IACF;AACA,QAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC,EAAE,IAAI,aAAa;AACrE,UAAM,OAAO,EAAE,aAAa,IAAI,MAAM;AACtC,QAAI,KAAM,aAAY,EAAE,MAAM,OAAO,EAAE,aAAa,IAAI,OAAO,EAAE,CAAC;AAAA,QAC7D,YAAW,IAAI,MAAM,EAAE,aAAa,IAAI,OAAO,KAAK,sBAAsB,CAAC;AAAA,EAClF,CAAC;AACD,QAAM,IAAI,QAAc,CAAC,MAAM,OAAO,OAAO,GAAG,aAAa,CAAC,CAAC;AAC/D,QAAM,OAAQ,OAAO,QAAQ,EAAkB;AAC/C,QAAM,cAAc,oBAAoB,IAAI;AAE5C,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,QAAQ;AAAA,IACZ,MAAM,WAAW,IAAI,MAAM,yBAAyB,KAAK,MAAM,YAAY,GAAI,CAAC,+BAA0B,CAAC;AAAA,IAC3G;AAAA,EACF;AACA,QAAM,MAAM;AAEZ,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,KAAK,uBAAuB;AAAA,MAClD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,aAAa;AAAA,QACb,eAAe,CAAC,WAAW;AAAA,QAC3B,4BAA4B;AAAA,QAC5B,aAAa,CAAC,sBAAsB,eAAe;AAAA,QACnD,gBAAgB,CAAC,MAAM;AAAA,MACzB,CAAC;AAAA,IACH,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,+BAA+B,IAAI,MAAM,MAAM,MAAM,IAAI,KAAK,CAAC,EAAE;AAC9F,UAAM,EAAE,WAAW,SAAS,IAAK,MAAM,IAAI,KAAK;AAEhD,UAAM,EAAE,UAAU,UAAU,IAAI,KAAK;AACrC,UAAM,QAAQ,UAAU,YAAY,EAAE,CAAC;AACvC,UAAM,UACJ,GAAG,KAAK,sBAAsB,iCAChB,mBAAmB,QAAQ,CAAC,iBACzB,mBAAmB,WAAW,CAAC,mBAC7B,SAAS,qCAClB,mBAAmB,KAAK,CAAC,UACzB,KAAK,aAAa,mBAAmB,QAAQ,CAAC;AAE1D,QAAI;AAAA,IAA8C,OAAO;AAAA,CAAI;AAC7D,gBAAY,OAAO;AAEnB,UAAM,EAAE,MAAM,OAAO,cAAc,IAAI,MAAM;AAC7C,QAAI,kBAAkB,MAAO,OAAM,IAAI,MAAM,sCAAiC;AAE9E,UAAM,OAAO,IAAI,gBAAgB;AAAA,MAC/B,YAAY;AAAA,MACZ;AAAA,MACA,cAAc;AAAA,MACd,WAAW;AAAA,MACX,eAAe;AAAA,MACf;AAAA,IACF,CAAC;AACD,UAAM,MAAM,MAAM,MAAM,KAAK,gBAAgB;AAAA,MAC3C,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM;AAAA,IACR,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,MAAM,MAAM,IAAI,KAAK,CAAC,EAAE;AACzF,UAAM,IAAK,MAAM,IAAI,KAAK;AAK1B,WAAO;AAAA,MACL;AAAA,MACA,aAAa,EAAE;AAAA,MACf,cAAc,EAAE;AAAA,MAChB,WAAW,EAAE,aAAa,KAAK,IAAI,IAAI,EAAE,aAAa,MAAO;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,UAAE;AACA,iBAAa,KAAK;AAClB,WAAO,MAAM;AAAA,EACf;AACF;AAEA,eAAsB,cAAc,SAAiB,SAA4C;AAC/F,MAAI,CAAC,QAAQ,aAAc,OAAM,IAAI,MAAM,kDAA6C;AACxF,QAAM,OAAO,MAAM,SAAS,OAAO;AACnC,QAAM,WAAW,QAAQ,YAAY,YAAY,OAAO;AACxD,QAAM,OAAO,IAAI,gBAAgB;AAAA,IAC/B,YAAY;AAAA,IACZ,eAAe,QAAQ;AAAA,IACvB,WAAW,QAAQ;AAAA,IACnB;AAAA,EACF,CAAC;AACD,QAAM,MAAM,MAAM,MAAM,KAAK,gBAAgB;AAAA,IAC3C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,IAC/D,MAAM;AAAA,EACR,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,yBAAyB,IAAI,MAAM,MAAM,MAAM,IAAI,KAAK,CAAC,EAAE;AACxF,QAAM,IAAK,MAAM,IAAI,KAAK;AAK1B,SAAO;AAAA,IACL,GAAG;AAAA,IACH,aAAa,EAAE;AAAA,IACf,cAAc,EAAE,iBAAiB,QAAQ;AAAA,IACzC,WAAW,EAAE,aAAa,KAAK,IAAI,IAAI,EAAE,aAAa,MAAO;AAAA,IAC7D;AAAA,EACF;AACF;;;AClOA,SAAS,WAAW,WAAW,cAAc,qBAAqB;AAClE,SAAS,eAAe;AACxB,SAAS,YAAY;AAsBd,SAAS,YAAoB;AAClC,MAAI,QAAQ,IAAI,kBAAmB,QAAO,QAAQ,IAAI;AACtD,QAAM,OAAO,QAAQ,IAAI,mBAAmB,KAAK,QAAQ,GAAG,SAAS;AACrE,SAAO,KAAK,MAAM,QAAQ;AAC5B;AAEO,SAAS,aAAqB;AACnC,SAAO,KAAK,UAAU,GAAG,aAAa;AACxC;AAEO,SAAS,aAA2B;AACzC,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,WAAW,GAAG,MAAM,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEO,SAAS,WAAW,QAA4B;AAGrD,YAAU,UAAU,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACvD,gBAAc,WAAW,GAAG,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAGnF,MAAI,QAAQ,aAAa,QAAS,WAAU,WAAW,GAAG,GAAK;AACjE;;;ACvCO,IAAM,eAAe;AA8ErB,SAAS,YAAY,GAAW,OAA8B;AACnE,QAAM,UAAU,EAAE,KAAK;AACvB,MAAI,CAAC,QAAS,QAAO,GAAG,KAAK;AAC7B,QAAM,OAAO,QAAQ,WAAW,IAAI,KAAK,QAAQ,WAAW,IAAI,IAAI,QAAQ,MAAM,CAAC,IAAI;AACvF,MAAI,KAAK,WAAW,EAAG,QAAO,GAAG,KAAK;AACtC,MAAI,KAAK,SAAS,MAAM,EAAG,QAAO,GAAG,KAAK;AAC1C,MAAI,CAAC,iBAAiB,KAAK,IAAI,EAAG,QAAO,GAAG,KAAK;AACjD,SAAO;AACT;AAeA,SAAS,aAAa,GAAmB;AACvC,MAAI,IAAI,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC9C,SAAO,EAAE,SAAS,EAAG,MAAK;AAC1B,SAAO,KAAK,CAAC;AACf;AAYO,SAAS,WAAW,OAAiE;AAC1F,QAAM,IAAI,MAAM,KAAK;AACrB,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,OAAO,EAAE,WAAW,YAAY,IAAI,EAAE,MAAM,aAAa,MAAM,IAAI;AACzE,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,aAAa,IAAI,CAAC;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,IAAI;AACV,QAAM,YAAY,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,KAAK;AACxD,QAAM,aAAa,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,KAAK;AAC1D,MAAI,CAAC,aAAa,CAAC,WAAY,QAAO;AACtC,MAAI,YAAY,WAAW,KAAK,KAAK,YAAY,YAAY,KAAK,EAAG,QAAO;AAC5E,SAAO,EAAE,WAAW,WAAW;AACjC;;;AC/HA,SAAS,UAAAA,eAAc;AACvB,OAAO,UAAU;AACjB,SAAS,gBAAgB,8BAA8B;AACvD,SAAS,mBAAmB,iCAAiC;AAC7D,SAAS,mBAAmB;AAC5B,SAAS,WAAW,4BAA4B;AAuEhD,SAAS,SAAS,GAAoC;AACpD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,IAAI,EAAE;AAAA,IACN,OAAO,OAAO,EAAE,KAAK;AAAA,IACrB,MAAM,EAAE;AAAA,IACR,SAAS,EAAE;AAAA,IACX,KAAK,OAAO,EAAE,GAAG;AAAA,IACjB,sBAAsB,OAAO,EAAE,oBAAoB;AAAA,IACnD,cAAc,OAAO,EAAE,YAAY;AAAA,IACnC,OAAO,EAAE;AAAA,EACX;AACF;AAEA,SAAS,WAAW,KAAyB;AAC3C,SAAO,IAAI,WAAWA,QAAO,KAAK,IAAI,QAAQ,OAAO,EAAE,GAAG,KAAK,CAAC;AAClE;AACA,SAAS,WAAW,OAA2B;AAC7C,SAAOA,QAAO,KAAK,KAAK,EAAE,SAAS,KAAK;AAC1C;AAQA,SAAS,cACP,sBACA,SACA,OACkD;AAClD,QAAM,gBAAgB;AAAA,IACpB,qBAAqB,qBAAqB,QAAQ,OAAO,EAAE,EAAE,YAAY;AAAA,IACzE,QAAQ,QAAQ;AAAA,IAChB,iBAAiB,QAAQ;AAAA,IACzB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,kBAAkB,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,aAAa,CAAC;AAE9E,QAAM,UAAU,KAAK,KAAK,QAAQ,SAAS,WAAW,MAAM,UAAU,CAAC;AACvE,QAAM,WAAW,KAAK,KAAK,SAAS,iBAAiB,QAAQ,SAAS;AACtE,SAAO;AAAA,IACL,aAAa,WAAW,eAAe;AAAA,IACvC,iBAAiB,WAAW,QAAQ;AAAA,EACtC;AACF;AAQO,SAAS,mBAAmB,IAA2B;AAC5D,SAAO,UAAU,qBAAqB,SAAS,EAAE,CAAC,CAAC;AACrD;AAOO,SAAS,qBAAqB,UAA0B;AAC7D,QAAM,MAAMA,QAAO,KAAK,UAAU,QAAQ;AAE1C,MAAI,IAAI;AACR,MAAI,WAAW;AACf,MAAI,QAAQ;AACZ,aAAS;AACP,UAAM,IAAI,IAAI,GAAG;AACjB,iBAAa,IAAI,QAAS;AAC1B,SAAK,IAAI,SAAU,EAAG;AACtB,aAAS;AAAA,EACX;AACA,MAAI,aAAa,GAAG;AAClB,UAAM,IAAI,MAAM,2CAA2C,QAAQ,oBAAoB;AAAA,EACzF;AACA,SAAO,WAAW,IAAI,WAAW,IAAI,SAAS,IAAI,EAAE,CAAC,CAAC;AACxD;AAqBO,SAAS,mBACd,KACA,SACA,OACc;AACd,MAAI,CAAC,QAAQ,UAAU;AACrB,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,MAAI,CAAC,QAAQ,SAAS,CAAC,QAAQ,gBAAgB;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,SAAO,IAAI,IAAI,CAAC,MAAM;AACpB,UAAM,UACJ,EAAE,OAAO,WACL,qBAAqB,EAAE,WAAqB,IAC5C,mBAAmB,EAAE,WAAqB;AAChD,UAAM,EAAE,aAAa,gBAAgB,IAAI,cAAc,SAAS,SAAS,KAAK;AAC9E,WAAO,EAAE,SAAS,MAAM,WAAW,aAAa,gBAAgB;AAAA,EAClE,CAAC;AACH;AAmEO,SAAS,sBAAsB,OAGpC;AACA,QAAM,kBAAkB,IAAI,YAAY,EAAE;AAAA,IACxC,KAAK,UAAU,EAAE,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE,CAAC;AAAA,EACxD;AACA,QAAM,UAAU,KAAK,KAAK,QAAQ,SAAS,WAAW,MAAM,UAAU,CAAC;AACvE,QAAM,WAAW,KAAK,KAAK,SAAS,iBAAiB,QAAQ,SAAS;AACtE,SAAO;AAAA,IACL,aAAa,WAAW,eAAe;AAAA,IACvC,iBAAiB,WAAW,QAAQ;AAAA,EACtC;AACF;AAmBA,eAAsB,WACpB,QACA,OACA,SACA,WAC6B;AAC7B,MAAI,CAAC,QAAQ,UAAU;AACrB,WAAO,EAAE,IAAI,OAAO,OAAO,wDAAwD;AAAA,EACrF;AACA,MAAI,CAAC,QAAQ,SAAS,CAAC,QAAQ,gBAAgB;AAC7C,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OACE;AAAA,IAEJ;AAAA,EACF;AAIA,QAAM,YAAY,OAAO,WAA0B;AACjD,UAAM,SAAS,MAAM,UAAU,cAAc,QAAQ,SAAS,KAAK,CAAC;AACpE,UAAM,EAAE,GAAG,GAAG,YAAY,IAAI,OAAO;AACrC,QAAI,KAAK,QAAQ,KAAK,QAAQ,eAAe,MAAM;AACjD,YAAM,IAAI,MAAM,4DAA4D;AAAA,IAC9E;AACA,WAAO;AAAA,MACL,GAAG,KAAK,CAAC;AAAA,MACT,GAAG,KAAK,CAAC;AAAA,MACT,SAAS;AAAA,IACX;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,YAAwB;AACjD,UAAM,SAAS,MAAM,UAAU,cAAc,WAAW,OAAO,GAAG,SAAS,KAAK,CAAC;AACjF,UAAM,MAAM,OAAO,UAAU;AAC7B,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,sDAAsD;AAChF,WAAO,WAAW,GAAG;AAAA,EACvB;AAEA,MAAI;AACF,YAAQ,OAAO,IAAI;AAAA,MACjB,KAAK;AACH,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU,EAAE,WAAW,MAAM,IAAI,eAAe,SAAS,EAAE,YAAY,OAAO,OAAO,EAAE;AAAA,QACzF;AAAA,MACF,KAAK;AACH,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU;AAAA,YACR,WAAW,MAAM,IAAI,eAAe,SAAS,EAAE,cAAc,OAAO,SAAS;AAAA,UAC/E;AAAA,QACF;AAAA,MACF,KAAK;AACH,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU;AAAA,YACR,uBAAuB,MAAM,IAAI,eAAe,SAAS,EAAE;AAAA,cACzD,SAAS,OAAO,WAAW;AAAA,YAC7B;AAAA,UACF;AAAA,QACF;AAAA,MACF,KAAK;AACH,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU;AAAA,YACR,eAAe,MAAM,IAAI,eAAe,SAAS,EAAE;AAAA,cACjD,OAAO;AAAA,YACT;AAAA,UACF;AAAA,QACF;AAAA,MACF,KAAK,iBAAiB;AACpB,cAAM,MAAM,MAAM,IAAI,kBAAkB,aAAa,OAAO,OAAO,EAAE;AAAA,UACnE,OAAO;AAAA,QACT;AACA,eAAO,EAAE,IAAI,MAAM,UAAU,EAAE,WAAW,WAAW,GAAG,EAAE,EAAE;AAAA,MAC9D;AAAA,MACA,KAAK,qBAAqB;AACxB,cAAM,KAAK,YAAY,KAAKC,QAAO,KAAK,OAAO,mBAAmB,QAAQ,CAAC;AAC3E,cAAM,SAAS,MAAM,IAAI,kBAAkB,aAAa,OAAO,OAAO,EAAE;AAAA,UACtE;AAAA,QACF;AACA,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU,EAAE,yBAAyBA,QAAO,KAAK,MAAM,EAAE,SAAS,QAAQ,EAAE;AAAA,QAC9E;AAAA,MACF;AAAA,MACA,KAAK,OAAO;AAEV,cAAM,SAAS,MAAM,UAAU,cAAc,OAAO,sBAAsB,SAAS,KAAK,CAAC;AACzF,eAAO,EAAE,IAAI,MAAM,UAAU,EAAE,QAAQ,OAAO,QAAQ,WAAW,OAAO,UAAU,EAAE;AAAA,MACtF;AAAA,MACA;AACE,eAAO,EAAE,IAAI,OAAO,OAAO,eAAgB,OAA2B,EAAE,GAAG;AAAA,IAC/E;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,0BAA0B,eAAe,2BAA2B;AACrF,aAAO,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ;AAAA,IACzC;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,WAAO,EAAE,IAAI,OAAO,OAAO,QAAQ;AAAA,EACrC;AACF;;;AC1YO,SAAS,eAAe,OAAsB;AACnD,QAAM,KAAK,WAAW,KAAK;AAC3B,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO,EAAE,WAAW,GAAG,WAAW,YAAY,GAAG,YAAY,SAAS,KAAK,IAAI,EAAE;AACnF;AAEA,SAAS,UAAU,GAAmC;AACpD,SAAO,EAAE,UAAU,EAAE,WAAW,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,mBAAmB,GAAG;AACjG;AAIA,eAAe,eACb,MACA,WACA,OACwB;AACxB,QAAM,MAAM,sBAAsB,KAAK;AACvC,QAAM,IAAK,MAAM,KAAK,mBAAmB,SAAS,YAAY;AAAA,IAC5D,SAAS,MAAM;AAAA,IACf,aAAa,IAAI;AAAA,IACjB,iBAAiB,IAAI;AAAA,EACvB,CAAC;AACD,SAAO,UAAU,CAAC;AACpB;AAOA,eAAsB,kBACpB,MACA,WACA,QACA,OACA,SACkC;AAClC,QAAM,WACJ,WAAW,QAAQ,UAAU,QAAQ,kBACjC,UAAU,OAAO,IACjB,MAAM,eAAe,MAAM,WAAW,KAAK;AACjD,QAAM,YAAY,CAAC,aACjB,KAAK,mBAAmB,SAAS,eAAe;AAAA,IAC9C,SAAS,MAAM;AAAA,IACf,GAAG;AAAA,EACL,CAAC;AACH,QAAM,SAAS,MAAM,WAAW,QAAQ,OAAO,UAAU,SAAS;AAClE,MAAI,CAAC,OAAO,GAAI,OAAM,IAAI,MAAM,OAAO,KAAK;AAC5C,QAAM,KAAK,mBAAmB,SAAS,cAAc,EAAE,UAAU,OAAO,SAAS,CAAC;AAClF,SAAO,OAAO;AAChB;AAIA,eAAsB,gBACpB,MACA,WACA,MACA,OACe;AACf,MAAI,UAAyB;AAAA,IAC3B,UAAU,KAAK,QAAQ;AAAA,IACvB,OAAO,KAAK,QAAQ,UAAU;AAAA,IAC9B,gBAAgB,KAAK,QAAQ,mBAAmB;AAAA,EAClD;AACA,MAAI,QAAQ,aAAa,CAAC,QAAQ,SAAS,CAAC,QAAQ,iBAAiB;AACnE,cAAU,MAAM,eAAe,MAAM,WAAW,KAAK;AAAA,EACvD;AACA,QAAM,YAA0B,mBAAmB,KAAK,KAAK,SAAS,KAAK;AAC3E,QAAM,KAAK,mBAAmB,SAAS,cAAc,EAAE,UAAU,CAAC;AACpE;;;AC5EA,IAAM,mBAAmB;AACzB,IAAM,iBAAiB;AAEhB,IAAM,cAAN,cAA0B,MAAM;AAAA,EACrC,YACW,QACA,MACT,SACA;AACA,UAAM,UAAU,OAAO,YAAY,MAAM,MAAM,IAAI,EAAE;AAJ5C;AACA;AAIT,SAAK,OAAO;AAAA,EACd;AACF;AAmBO,IAAM,eAAN,MAAM,cAAa;AAAA,EACf;AAAA,EACQ;AAAA,EACA;AAAA,EACT;AAAA,EACA,eAAe;AAAA,EAEvB,YAAY,UAA+B,CAAC,GAAG;AAC7C,SAAK,OAAO;AACZ,SAAK,WAAW,QAAQ,WAAW,kBAAkB,QAAQ,QAAQ,EAAE;AACvE,SAAK,YAAY,QAAQ,aAAa;AAAA,EACxC;AAAA;AAAA,EAGA,OAAO,WAAW,YAAiC,CAAC,GAAiB;AACnE,UAAM,MAAM,WAAW;AACvB,UAAM,SAAS,IAAI,cAAa;AAAA,MAC9B,SAAS,UAAU,WAAW,QAAQ,IAAI,kBAAkB,IAAI;AAAA,MAChE,QAAQ,UAAU,UAAU,QAAQ,IAAI,kBAAkB,IAAI;AAAA,MAC9D,OAAO,UAAU,SAAS,QAAQ,IAAI;AAAA,MACtC,YAAY,UAAU,cAAc,QAAQ,IAAI,sBAAsB,IAAI;AAAA,MAC1E,WAAW,UAAU;AAAA,IACvB,CAAC;AACD,QAAI,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO;AAC1D,aAAO,QAAQ,IAAI;AACnB,aAAO,eAAe;AAAA,IACxB;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,IAAI,UAAmB;AACrB,WAAO,QAAQ,KAAK,KAAK,UAAU;AAAA,EACrC;AAAA,EAEA,MAAc,SAA0B;AACtC,QAAI,KAAK,KAAK,MAAO,QAAO,KAAK,KAAK;AACtC,QAAI,KAAK,KAAK,OAAQ,QAAO,KAAK,KAAK;AACvC,QAAI,KAAK,OAAO;AACd,UAAI,KAAK,MAAM,aAAa,KAAK,IAAI,IAAI,KAAK,MAAM,YAAY,gBAAgB;AAC9E,aAAK,QAAQ,MAAM,cAAc,KAAK,SAAS,KAAK,KAAK;AACzD,YAAI,KAAK,cAAc;AACrB,gBAAM,MAAM,WAAW;AACvB,cAAI,QAAQ,KAAK;AACjB,qBAAW,GAAG;AAAA,QAChB;AAAA,MACF;AACA,aAAO,KAAK,MAAM;AAAA,IACpB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,QACZ,QACA,MACA,OAAuE,CAAC,GAC5D;AACZ,UAAM,MAAM,IAAI,IAAI,KAAK,UAAU,IAAI;AACvC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,GAAG;AACrD,UAAI,KAAK,KAAM,KAAI,aAAa,IAAI,GAAG,CAAC;AAAA,IAC1C;AACA,UAAM,UAAkC,EAAE,eAAe,UAAU,MAAM,KAAK,OAAO,CAAC,GAAG;AACzF,QAAI;AACJ,QAAI,KAAK,SAAS,QAAW;AAC3B,cAAQ,cAAc,IAAI;AAC1B,aAAO,KAAK,UAAU,KAAK,IAAI;AAAA,IACjC;AACA,UAAM,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,QAAQ,SAAS,KAAK,CAAC;AAC/D,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,YAAY,IAAI,QAAQ,MAAM,GAAG,MAAM,IAAI,IAAI,EAAE;AACxE,WAAQ,OAAO,KAAK,MAAM,IAAI,IAAI;AAAA,EACpC;AAAA,EAEiB,SAAiB,CAAC,MAAM,SAAS,KAAK,QAAiB,QAAQ,MAAM,EAAE,KAAK,CAAC;AAAA;AAAA,EAG9F,kBAAiD;AAC/C,WAAO,KAAK,QAAQ,OAAO,eAAe;AAAA,EAC5C;AAAA;AAAA,EAGA,aAAa,MAAuC;AAClD,WAAO,KAAK,QAAQ,OAAO,oBAAoB;AAAA,MAC7C,OAAO,EAAE,SAAS,KAAK,SAAS,aAAa,KAAK,WAAW;AAAA,IAC/D,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,eAAe,MAA2C;AACxD,UAAM,YAAsD;AAAA,MAC1D,MAAM;AAAA,MACN,eAAe,KAAK;AAAA,MACpB,UAAU,KAAK;AAAA,MACf,cAAc,KAAK;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,UAAU,KAAK,YAAY;AAAA,IAC7B;AACA,WAAO,KAAK,QAAQ,QAAQ,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAAA,EACvE;AAAA;AAAA,EAGA,cAAc,MAA0C;AACtD,UAAM,YAAoD;AAAA,MACxD,MAAM;AAAA,MACN,eAAe,KAAK;AAAA,MACpB,KAAK,KAAK,OAAO;AAAA,MACjB,SAAS,KAAK,WAAW;AAAA,IAC3B;AACA,WAAO,KAAK,QAAQ,QAAQ,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBAAkB,MAAsB,OAAoB,CAAC,GAA2B;AAC5F,UAAM,YAA6D;AAAA,MACjE,MAAM;AAAA,MACN,eAAe,KAAK;AAAA,MACpB,QAAQ,KAAK;AAAA,IACf;AACA,UAAM,EAAE,UAAU,QAAQ,IAAI,MAAM,KAAK;AAAA,MACvC;AAAA,MACA;AAAA,MACA,EAAE,MAAM,EAAE,UAAU,EAAE;AAAA,IACxB;AACA,SACG,KAAK,YAAY,SAClB,SAAS,WAAW,uBACpB,KAAK,KAAK,YACV;AACA,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,SAAS;AAAA,QACT,KAAK;AAAA,QACL,eAAe,KAAK,KAAK,UAAU;AAAA,QACnC;AAAA,MACF;AACA,aAAO,KAAK,WAAW,SAAS,UAAU;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,MAAgB,OAAoB,CAAC,GAAwB;AAC7E,UAAM,YAAgD;AAAA,MACpD,MAAM;AAAA,MACN,eAAe,KAAK;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK,YAAY,KAAK;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,QAAQ,KAAK;AAAA,MACb,gBAAgB,KAAK,iBAAiB;AAAA,MACtC,cAAc,KAAK,eAAe;AAAA,MAClC,WAAW,KAAK,aAAa;AAAA,MAC7B,aAAa,KAAK,cAAc;AAAA,IAClC;AACA,UAAM,SAAS,MAAM,KAAK,QAAoB,QAAQ,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC5F,SACG,KAAK,YAAY,SAClB,OAAO,SAAS,WAAW,uBAC3B,KAAK,KAAK,YACV;AACA,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,OAAO,SAAS;AAAA,QAChB,OAAO;AAAA,QACP,eAAe,KAAK,KAAK,UAAU;AAAA,MACrC;AACA,aAAO,EAAE,GAAG,QAAQ,UAAU,MAAM,KAAK,WAAW,OAAO,SAAS,UAAU,EAAE;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,WAAW,WAA2C;AACpD,WAAO,KAAK,QAAQ,OAAO,mBAAmB,SAAS,EAAE;AAAA,EAC3D;AAAA;AAAA,EAGA,MAAM,eACJ,WACA,OAAoD,CAAC,GAC7B;AACxB,UAAM,WAAW,KAAK,cAAc;AACpC,UAAM,WAAW,KAAK,IAAI,KAAK,KAAK,aAAa;AACjD,eAAS;AACP,YAAM,IAAI,MAAM,KAAK,WAAW,SAAS;AACzC,YAAM,UAAU,EAAE,WAAW,sBAAsB,EAAE,WAAW;AAChE,UAAI,CAAC,WAAW,KAAK,IAAI,IAAI,SAAU,QAAO;AAC9C,YAAM,IAAI,QAAQ,CAAC,QAAQ,WAAW,KAAK,QAAQ,CAAC;AAAA,IACtD;AAAA,EACF;AACF;","names":["Buffer","Buffer"]}