@prism-ing/wallet 0.1.0

package/dist/signers/ows-adapter.d.ts

@@ -0,0 +1,70 @@
+/**
+ * OWS Signer Adapter — wraps platform-specific OWS APIs behind PrismSigner.
+ *
+ * @remarks
+ * On iOS, this calls the Swift bridge to the Secure Enclave.
+ * On Node.js, it uses OWS's software signing path.
+ * The interface is identical on all platforms.
+ *
+ * @packageDocumentation
+ */
+import type { Address, Hex, Result } from '../result.js';
+import type { PrismSigner, TypedDataPayload, Platform } from '../types.js';
+import type { WalletError } from '../errors.js';
+/**
+ * The OWS adapter implements PrismSigner for all platforms.
+ *
+ * @remarks
+ * Created via the platform-specific factory. Never instantiate directly.
+ */
+export interface OWSAdapter extends PrismSigner {
+    /** The platform this adapter was created for. */
+    readonly platform: Platform;
+    /** Zero all key material held by the underlying backend. */
+    destroy?(): void;
+}
+/** Key material returned by OWS key generation. */
+export interface OWSKeyPair {
+    readonly evmAddress: Address;
+    readonly solanaAddress: string;
+    readonly platform: Platform;
+}
+/**
+ * Platform-specific signing backend.
+ *
+ * @remarks
+ * Each platform provides its own implementation:
+ * - iOS: Swift bridge to Secure Enclave
+ * - Node: OWS CLI or npm package
+ * - Browser: Software signing fallback
+ */
+export interface SigningBackend {
+    generateKeyPair(): Promise<Result<OWSKeyPair, WalletError>>;
+    signMessage(keys: OWSKeyPair, message: Hex): Promise<Result<Hex, WalletError>>;
+    signTypedData(keys: OWSKeyPair, payload: TypedDataPayload): Promise<Result<Hex, WalletError>>;
+    signTransaction<T>(keys: OWSKeyPair, tx: T): Promise<Result<T, WalletError>>;
+    /**
+     * Execute a function within a single authentication context.
+     * On Secure Enclave, this means one biometric prompt for all
+     * signing operations within fn(). On other backends, passthrough.
+     */
+    withAuthContext?<T>(prompt: string, fn: () => Promise<T>): Promise<Result<T, WalletError>>;
+    /** Zero all in-memory key material. No-op for hardware-backed backends. */
+    destroy?(): void;
+    /** Zero and remove a specific key pair by EVM address. */
+    removeKeyPair?(evmAddress: string): Result<void, WalletError>;
+}
+/**
+ * Create an OWSAdapter from a platform-specific SigningBackend.
+ *
+ * @remarks
+ * Generates a key pair via the backend, then wraps all signing operations
+ * behind the PrismSigner interface. The adapter is the "imperative shell" —
+ * Result errors from the backend are unwrapped and thrown here, since
+ * PrismSigner methods return plain `Promise<Hex>`.
+ *
+ * @param backend - The platform-specific signing backend.
+ * @returns A Result containing the OWSAdapter or a WalletError.
+ */
+export declare function createOWSAdapter(backend: SigningBackend): Promise<Result<OWSAdapter, WalletError>>;
+//# sourceMappingURL=ows-adapter.d.ts.map

package/dist/signers/ows-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ows-adapter.d.ts","sourceRoot":"","sources":["../../src/signers/ows-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,4DAA4D;IAC5D,OAAO,CAAC,IAAI,IAAI,CAAC;CAClB;AAED,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;IAC5D,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/E,aAAa,CACX,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IACrC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IAC7E;;;;OAIG;IACH,eAAe,CAAC,CAAC,CAAC,EAChB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IACnC,2EAA2E;IAC3E,OAAO,CAAC,IAAI,IAAI,CAAC;IACjB,0DAA0D;IAC1D,aAAa,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;CAC/D;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAwC1C"}

package/dist/signers/ows-adapter.js

@@ -0,0 +1,53 @@
+import { Ok } from '../result.js';
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Create an OWSAdapter from a platform-specific SigningBackend.
+ *
+ * @remarks
+ * Generates a key pair via the backend, then wraps all signing operations
+ * behind the PrismSigner interface. The adapter is the "imperative shell" —
+ * Result errors from the backend are unwrapped and thrown here, since
+ * PrismSigner methods return plain `Promise<Hex>`.
+ *
+ * @param backend - The platform-specific signing backend.
+ * @returns A Result containing the OWSAdapter or a WalletError.
+ */
+export async function createOWSAdapter(backend) {
+    const keyResult = await backend.generateKeyPair();
+    if (!keyResult.ok)
+        return keyResult;
+    const keys = keyResult.value;
+    const adapter = {
+        evmAddress: keys.evmAddress,
+        solanaAddress: keys.solanaAddress,
+        platform: keys.platform,
+        async signMessage(message) {
+            const result = await backend.signMessage(keys, message);
+            if (!result.ok) {
+                throw new Error(`Signing failed: ${result.error.code}`);
+            }
+            return result.value;
+        },
+        async signTypedData(payload) {
+            const result = await backend.signTypedData(keys, payload);
+            if (!result.ok) {
+                throw new Error(`Signing failed: ${result.error.code}`);
+            }
+            return result.value;
+        },
+        async signTransaction(tx) {
+            const result = await backend.signTransaction(keys, tx);
+            if (!result.ok) {
+                throw new Error(`Signing failed: ${result.error.code}`);
+            }
+            return result.value;
+        },
+        destroy() {
+            backend.destroy?.();
+        },
+    };
+    return Ok(adapter);
+}
+//# sourceMappingURL=ows-adapter.js.map

package/dist/signers/ows-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ows-adapter.js","sourceRoot":"","sources":["../../src/signers/ows-adapter.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAwDlC,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAuB;IAEvB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC;IAE7B,MAAM,OAAO,GAAe;QAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QAEvB,KAAK,CAAC,WAAW,CAAC,OAAY;YAC5B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,OAAyB;YAC3C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,KAAK,CAAC,eAAe,CAAI,EAAK;YAC5B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,OAAO;YACL,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;IAEF,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC"}

package/dist/signers/ows-signing-backend.d.ts

@@ -0,0 +1,25 @@
+import type { SigningBackend } from './ows-adapter.js';
+/** Configuration for the OWS signing backend. */
+export interface OWSBackendConfig {
+    /** OWS wallet name. Same name = same wallet across sessions. */
+    readonly walletName: string;
+    /** Owner passphrase for OWS vault. Omit to use OWS_PASSPHRASE env var or apiKey. */
+    readonly passphrase?: string;
+    /** Agent API key (ows_key_...). Enables policy-gated, scoped access. */
+    readonly apiKey?: string;
+    /** Custom vault path. Defaults to ~/.ows/. Useful for testing. */
+    readonly vaultPath?: string;
+}
+/**
+ * Create a persistent OWS signing backend.
+ *
+ * @remarks
+ * On first call with a given wallet name, creates a new OWS wallet
+ * (BIP-39 mnemonic → secp256k1 + ed25519 accounts, encrypted at rest).
+ * On subsequent calls, loads the existing wallet — same keys, same addresses.
+ *
+ * @param config - Wallet name, auth credentials, and optional vault path.
+ * @returns A `SigningBackend` backed by OWS persistent storage.
+ */
+export declare function createOWSSigningBackend(config: OWSBackendConfig): SigningBackend;
+//# sourceMappingURL=ows-signing-backend.d.ts.map

package/dist/signers/ows-signing-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ows-signing-backend.d.ts","sourceRoot":"","sources":["../../src/signers/ows-signing-backend.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,kBAAkB,CAAC;AAOnE,iDAAiD;AACjD,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAeD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,gBAAgB,GAAG,cAAc,CAwGhF"}

package/dist/signers/ows-signing-backend.js

@@ -0,0 +1,192 @@
+/**
+ * OWS signing backend — persistent key storage via Open Wallet Standard.
+ *
+ * @remarks
+ * Uses `@open-wallet-standard/core` (native NAPI bindings) for encrypted
+ * key persistence at `~/.ows/`. Same wallet name = same keys across sessions.
+ *
+ * Two access modes:
+ * - **Owner mode**: passphrase decrypts the vault (scrypt + AES-256-GCM)
+ * - **Agent mode**: API key token (`ows_key_...`) enables policy-gated signing
+ *
+ * All OWS functions are synchronous (Rust NAPI). This module wraps them
+ * in the async `SigningBackend` interface with `Result` error handling.
+ *
+ * @packageDocumentation
+ */
+import { createWallet as owsCreateWallet, getWallet as owsGetWallet, signMessage as owsSignMessage, signTypedData as owsSignTypedData, signTransaction as owsSignTransaction, } from '@open-wallet-standard/core';
+import { Ok, Err, toAddress } from '../result.js';
+import { walletErrors } from '../errors.js';
+import { inferDomainType, isSolanaTransaction, hexToBytes } from '../internal/eip712.js';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+const EVM_CHAIN_ID = 'eip155:1';
+const SOLANA_CHAIN_PREFIX = 'solana:';
+const OWS_CHAIN_EVM = 'ethereum';
+const OWS_CHAIN_SOLANA = 'solana';
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Create a persistent OWS signing backend.
+ *
+ * @remarks
+ * On first call with a given wallet name, creates a new OWS wallet
+ * (BIP-39 mnemonic → secp256k1 + ed25519 accounts, encrypted at rest).
+ * On subsequent calls, loads the existing wallet — same keys, same addresses.
+ *
+ * @param config - Wallet name, auth credentials, and optional vault path.
+ * @returns A `SigningBackend` backed by OWS persistent storage.
+ */
+export function createOWSSigningBackend(config) {
+    const auth = resolveAuth(config);
+    const backend = {
+        async generateKeyPair() {
+            try {
+                const wallet = getOrCreateWallet(config);
+                return extractKeyPair(wallet);
+            }
+            catch (e) {
+                return Err(mapOWSError(e));
+            }
+        },
+        async signMessage(_keys, message) {
+            try {
+                // Strip 0x prefix — OWS expects raw hex
+                const hexMsg = message.startsWith('0x')
+                    ? message.slice(2)
+                    : message;
+                const result = owsSignMessage(config.walletName, OWS_CHAIN_EVM, hexMsg, auth, 'hex', null, config.vaultPath ?? null);
+                return Ok(formatEvmSignature(result.signature, result.recoveryId));
+            }
+            catch (e) {
+                return Err(mapOWSError(e));
+            }
+        },
+        async signTypedData(_keys, payload) {
+            try {
+                // OWS requires EIP712Domain in the types object
+                const typedDataWithDomain = {
+                    ...payload,
+                    types: {
+                        ...payload.types,
+                        EIP712Domain: inferDomainType(payload.domain),
+                    },
+                };
+                const result = owsSignTypedData(config.walletName, OWS_CHAIN_EVM, JSON.stringify(typedDataWithDomain), auth, null, config.vaultPath ?? null);
+                return Ok(formatEvmSignature(result.signature, result.recoveryId));
+            }
+            catch (e) {
+                return Err(mapOWSError(e));
+            }
+        },
+        async signTransaction(_keys, tx) {
+            try {
+                if (!isSolanaTransaction(tx)) {
+                    return Err(walletErrors.signingRejected('Unsupported transaction type'));
+                }
+                const messageBytes = tx.message.serialize();
+                const messageHex = bytesToHex(messageBytes);
+                const result = owsSignTransaction(config.walletName, OWS_CHAIN_SOLANA, messageHex, auth, null, config.vaultPath ?? null);
+                // OWS returns hex-encoded ed25519 signature (128 hex chars = 64 bytes)
+                tx.signatures[0] = hexToBytes(result.signature);
+                return Ok(tx);
+            }
+            catch (e) {
+                return Err(mapOWSError(e));
+            }
+        },
+        async withAuthContext(_prompt, fn) {
+            return Ok(await fn());
+        },
+        destroy() {
+            // OWS keys live in encrypted vault on disk, not in JS memory.
+        },
+    };
+    return backend;
+}
+// ---------------------------------------------------------------------------
+// Wallet Management
+// ---------------------------------------------------------------------------
+/**
+ * Get an existing OWS wallet or create a new one.
+ * This is the persistence mechanism — same name = same wallet.
+ */
+function getOrCreateWallet(config) {
+    try {
+        return owsGetWallet(config.walletName, config.vaultPath ?? null);
+    }
+    catch {
+        // Wallet doesn't exist yet — create it
+        const auth = resolveAuth(config);
+        return owsCreateWallet(config.walletName, auth, 12, // 12-word mnemonic
+        config.vaultPath ?? null);
+    }
+}
+/**
+ * Extract EVM and Solana addresses from OWS wallet accounts.
+ */
+function extractKeyPair(wallet) {
+    const evmAccount = wallet.accounts.find((a) => a.chainId === EVM_CHAIN_ID);
+    const solanaAccount = wallet.accounts.find((a) => a.chainId.startsWith(SOLANA_CHAIN_PREFIX));
+    if (!evmAccount) {
+        return Err(walletErrors.keyNotFound('No EVM account in OWS wallet'));
+    }
+    const evmAddressResult = toAddress(evmAccount.address);
+    if (!evmAddressResult.ok) {
+        return Err(walletErrors.keyNotFound(evmAccount.address));
+    }
+    return Ok({
+        evmAddress: evmAddressResult.value,
+        solanaAddress: solanaAccount?.address ?? '',
+        platform: 'node',
+    });
+}
+// ---------------------------------------------------------------------------
+// Auth Resolution
+// ---------------------------------------------------------------------------
+function resolveAuth(config) {
+    return config.apiKey ?? config.passphrase ?? process.env.OWS_PASSPHRASE ?? null;
+}
+// ---------------------------------------------------------------------------
+// Signature Formatting
+// ---------------------------------------------------------------------------
+/**
+ * Format an OWS EVM signature as a 0x-prefixed 65-byte hex string.
+ *
+ * @remarks
+ * OWS returns the signature as a hex string (no 0x prefix) with v already
+ * encoded as the last byte. The recoveryId (27 or 28) confirms this.
+ */
+function formatEvmSignature(sigHex, _recoveryId) {
+    // OWS signature is already r + s + v (65 bytes = 130 hex chars)
+    return `0x${sigHex}`;
+}
+// ---------------------------------------------------------------------------
+// Hex Utilities
+// ---------------------------------------------------------------------------
+function bytesToHex(bytes) {
+    return Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+// ---------------------------------------------------------------------------
+// Error Mapping
+// ---------------------------------------------------------------------------
+/**
+ * Map OWS errors to WalletError.
+ * OWS throws plain Error objects with descriptive messages.
+ */
+function mapOWSError(e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    const lower = msg.toLowerCase();
+    if (lower.includes('not found') || lower.includes('no such')) {
+        return walletErrors.keyNotFound(msg);
+    }
+    if (lower.includes('passphrase') || lower.includes('authentication') || lower.includes('decrypt')) {
+        return walletErrors.signingRejected(msg);
+    }
+    return walletErrors.signingRejected(`OWS error: ${msg}`);
+}
+//# sourceMappingURL=ows-signing-backend.js.map

package/dist/signers/ows-signing-backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ows-signing-backend.js","sourceRoot":"","sources":["../../src/signers/ows-signing-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,YAAY,IAAI,eAAe,EAC/B,SAAS,IAAI,YAAY,EACzB,WAAW,IAAI,cAAc,EAC7B,aAAa,IAAI,gBAAgB,EACjC,eAAe,IAAI,kBAAkB,GACtC,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGlD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAkBzF,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AACtC,MAAM,aAAa,GAAG,UAAU,CAAC;AACjC,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAwB;IAC9D,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEjC,MAAM,OAAO,GAAmB;QAC9B,KAAK,CAAC,eAAe;YACnB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACzC,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CACf,KAAiB,EACjB,OAAY;YAEZ,IAAI,CAAC;gBACH,wCAAwC;gBACxC,MAAM,MAAM,GAAI,OAAkB,CAAC,UAAU,CAAC,IAAI,CAAC;oBACjD,CAAC,CAAE,OAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC9B,CAAC,CAAE,OAAkB,CAAC;gBACxB,MAAM,MAAM,GAAG,cAAc,CAC3B,MAAM,CAAC,UAAU,EACjB,aAAa,EACb,MAAM,EACN,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,MAAM,CAAC,SAAS,IAAI,IAAI,CACzB,CAAC;gBACF,OAAO,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAQ,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,KAAK,CAAC,aAAa,CACjB,KAAiB,EACjB,OAAyB;YAEzB,IAAI,CAAC;gBACH,gDAAgD;gBAChD,MAAM,mBAAmB,GAAG;oBAC1B,GAAG,OAAO;oBACV,KAAK,EAAE;wBACL,GAAG,OAAO,CAAC,KAAK;wBAChB,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;qBAC9C;iBACF,CAAC;gBACF,MAAM,MAAM,GAAG,gBAAgB,CAC7B,MAAM,CAAC,UAAU,EACjB,aAAa,EACb,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,EACnC,IAAI,EACJ,IAAI,EACJ,MAAM,CAAC,SAAS,IAAI,IAAI,CACzB,CAAC;gBACF,OAAO,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAQ,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,KAAK,CAAC,eAAe,CACnB,KAAiB,EACjB,EAAK;YAEL,IAAI,CAAC;gBACH,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7B,OAAO,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,8BAA8B,CAAC,CAAC,CAAC;gBAC3E,CAAC;gBAED,MAAM,YAAY,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC5C,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;gBAC5C,MAAM,MAAM,GAAG,kBAAkB,CAC/B,MAAM,CAAC,UAAU,EACjB,gBAAgB,EAChB,UAAU,EACV,IAAI,EACJ,IAAI,EACJ,MAAM,CAAC,SAAS,IAAI,IAAI,CACzB,CAAC;gBACF,uEAAuE;gBACvE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAChD,OAAO,EAAE,CAAC,EAAO,CAAC,CAAC;YACrB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,KAAK,CAAC,eAAe,CACnB,OAAe,EACf,EAAoB;YAEpB,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxB,CAAC;QAED,OAAO;YACL,8DAA8D;QAChE,CAAC;KACF,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,iBAAiB,CAAC,MAAwB;IACjD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;QACvC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,eAAe,CACpB,MAAM,CAAC,UAAU,EACjB,IAAI,EACJ,EAAE,EAAE,mBAAmB;QACvB,MAAM,CAAC,SAAS,IAAI,IAAI,CACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,MAAkB;IACxC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAC1C,CAAC;IAEF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,8BAA8B,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,gBAAgB,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,EAAE,CAAC;QACR,UAAU,EAAE,gBAAgB,CAAC,KAAK;QAClC,aAAa,EAAE,aAAa,EAAE,OAAO,IAAI,EAAE;QAC3C,QAAQ,EAAE,MAAe;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,SAAS,WAAW,CAAC,MAAwB;IAC3C,OAAO,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC;AAClF,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAS,kBAAkB,CACzB,MAAc,EACd,WAA+B;IAE/B,gEAAgE;IAChE,OAAO,KAAK,MAAM,EAAE,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAAC,CAAU;IAC7B,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAEhC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,OAAO,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClG,OAAO,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,YAAY,CAAC,eAAe,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC;AAC3D,CAAC"}

package/dist/signers/secure-enclave-backend.d.ts

@@ -0,0 +1,19 @@
+import type { SigningBackend } from './ows-adapter.js';
+import type { SecureEnclaveConfig } from './secure-enclave-types.js';
+/**
+ * Create an iOS Secure Enclave signing backend.
+ *
+ * @remarks
+ * Uses the iOS Secure Enclave for hardware-backed key protection.
+ * Private keys are encrypted by the Secure Enclave's P-256 key and stored
+ * in the iOS Keychain. All signing operations require biometric authentication.
+ *
+ * The backend delegates all cryptographic operations to the native bridge.
+ * TypeScript handles EIP-191/EIP-712 hash computation before passing the
+ * hash to the native layer for signing.
+ *
+ * @param config - Secure Enclave configuration including the native bridge.
+ * @returns A {@link SigningBackend} backed by the iOS Secure Enclave.
+ */
+export declare function createSecureEnclaveBackend(config: SecureEnclaveConfig): SigningBackend;
+//# sourceMappingURL=secure-enclave-backend.d.ts.map

package/dist/signers/secure-enclave-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-enclave-backend.d.ts","sourceRoot":"","sources":["../../src/signers/secure-enclave-backend.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,kBAAkB,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAA6B,MAAM,2BAA2B,CAAC;AAmFhG;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,mBAAmB,GAC1B,cAAc,CA6IhB"}

package/dist/signers/secure-enclave-backend.js

@@ -0,0 +1,201 @@
+/**
+ * iOS Secure Enclave signing backend.
+ *
+ * @remarks
+ * Implements the {@link SigningBackend} interface using the iOS Secure Enclave
+ * for hardware-backed key protection. Private keys (secp256k1 for EVM,
+ * ed25519 for Solana) are encrypted by the Secure Enclave's P-256 key and
+ * stored in the iOS Keychain. Signing requires biometric authentication
+ * (Face ID / Touch ID) before the key is decrypted in-process.
+ *
+ * The TypeScript layer handles EVM address derivation, EIP-191/EIP-712
+ * hashing, and signature encoding. The native bridge handles key storage,
+ * encryption/decryption, and biometric gating.
+ *
+ * @internal
+ */
+import { keccak_256 } from '@noble/hashes/sha3';
+import { bytesToHex } from '@noble/hashes/utils';
+import { Ok, Err, fromPromise } from '../result.js';
+import { walletErrors } from '../errors.js';
+import { base58Encode } from '../internal/base58.js';
+import { hashTypedData, personalSignHash, isSolanaTransaction } from '../internal/eip712.js';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+const DEFAULT_KEY_TAG = 'prism-wallet-default';
+const DEFAULT_BIOMETRIC_PROMPT = 'Authorize transaction';
+// ---------------------------------------------------------------------------
+// EVM Helpers
+// ---------------------------------------------------------------------------
+/** Derive an EVM address from an uncompressed secp256k1 public key. */
+function deriveEvmAddress(publicKey) {
+    // Drop the 0x04 prefix byte if present, hash the remaining 64 bytes
+    const keyBytes = publicKey.length === 65 ? publicKey.subarray(1) : publicKey;
+    const hash = keccak_256(keyBytes);
+    return `0x${bytesToHex(hash.subarray(12))}`;
+}
+// ---------------------------------------------------------------------------
+// Signature Encoding
+// ---------------------------------------------------------------------------
+/**
+ * Encode a raw secp256k1 signature (64 bytes: r || s) with recovery ID
+ * into the standard 65-byte Ethereum format (r || s || v).
+ *
+ * @remarks
+ * The native bridge returns a 65-byte signature with recovery ID appended,
+ * matching the format from `secp256k1.sign()`.
+ */
+function encodeSignature(rawSig) {
+    // rawSig is expected to be 65 bytes: r(32) || s(32) || v(1)
+    return `0x${bytesToHex(rawSig)}`;
+}
+// ---------------------------------------------------------------------------
+// Error Mapping
+// ---------------------------------------------------------------------------
+function mapNativeError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    // Biometric cancellation / failure patterns from iOS
+    const biometricPatterns = [
+        'user cancel',
+        'biometric',
+        'authentication failed',
+        'passcode',
+        'LAError',
+    ];
+    if (biometricPatterns.some((p) => message.toLowerCase().includes(p))) {
+        return walletErrors.signingRejected(message);
+    }
+    // Secure Enclave unavailability
+    const enclavePatterns = [
+        'secure enclave',
+        'not available',
+        'no hardware',
+        'errSecUnimplemented',
+    ];
+    if (enclavePatterns.some((p) => message.toLowerCase().includes(p))) {
+        return walletErrors.enclaveUnavailable('ios');
+    }
+    // Key not found
+    if (message.toLowerCase().includes('key not found') || message.includes('errSecItemNotFound')) {
+        return walletErrors.keyNotFound('secure-enclave');
+    }
+    // Default: signing rejected
+    return walletErrors.signingRejected(message);
+}
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Create an iOS Secure Enclave signing backend.
+ *
+ * @remarks
+ * Uses the iOS Secure Enclave for hardware-backed key protection.
+ * Private keys are encrypted by the Secure Enclave's P-256 key and stored
+ * in the iOS Keychain. All signing operations require biometric authentication.
+ *
+ * The backend delegates all cryptographic operations to the native bridge.
+ * TypeScript handles EIP-191/EIP-712 hash computation before passing the
+ * hash to the native layer for signing.
+ *
+ * @param config - Secure Enclave configuration including the native bridge.
+ * @returns A {@link SigningBackend} backed by the iOS Secure Enclave.
+ */
+export function createSecureEnclaveBackend(config) {
+    const bridge = config.nativeBridge;
+    const keyTag = config.keyTag ?? DEFAULT_KEY_TAG;
+    const biometricPrompt = config.biometricPrompt ?? DEFAULT_BIOMETRIC_PROMPT;
+    let storedKeyPair;
+    const backend = {
+        async generateKeyPair() {
+            // Check if key already exists (idempotent)
+            const existsResult = await fromPromise(bridge.keyExists(keyTag), (e) => mapNativeError(e));
+            if (!existsResult.ok)
+                return existsResult;
+            if (existsResult.value && storedKeyPair !== undefined) {
+                return Ok(storedKeyPair);
+            }
+            // Generate or retrieve key pair via native bridge
+            const genResult = await fromPromise(bridge.generateKey(keyTag), (e) => mapNativeError(e));
+            if (!genResult.ok)
+                return genResult;
+            const { evmPublicKey, solanaPublicKey } = genResult.value;
+            const evmAddress = deriveEvmAddress(evmPublicKey);
+            const solanaAddress = base58Encode(solanaPublicKey);
+            const keyPair = {
+                evmAddress,
+                solanaAddress,
+                platform: 'ios',
+            };
+            storedKeyPair = keyPair;
+            return Ok(keyPair);
+        },
+        async signMessage(keys, message) {
+            if (storedKeyPair === undefined || keys.evmAddress !== storedKeyPair.evmAddress) {
+                return Err(walletErrors.keyNotFound(keys.evmAddress));
+            }
+            // Compute EIP-191 hash, then sign via native bridge
+            const hash = personalSignHash(message);
+            const signResult = await fromPromise(bridge.sign(keyTag, hash, biometricPrompt), (e) => mapNativeError(e));
+            if (!signResult.ok)
+                return signResult;
+            return Ok(encodeSignature(signResult.value.signature));
+        },
+        async signTypedData(keys, payload) {
+            if (storedKeyPair === undefined || keys.evmAddress !== storedKeyPair.evmAddress) {
+                return Err(walletErrors.keyNotFound(keys.evmAddress));
+            }
+            // Compute EIP-712 hash, then sign via native bridge
+            const hash = hashTypedData(payload);
+            const signResult = await fromPromise(bridge.sign(keyTag, hash, biometricPrompt), (e) => mapNativeError(e));
+            if (!signResult.ok)
+                return signResult;
+            return Ok(encodeSignature(signResult.value.signature));
+        },
+        async signTransaction(keys, tx) {
+            if (storedKeyPair === undefined || keys.evmAddress !== storedKeyPair.evmAddress) {
+                return Err(walletErrors.keyNotFound(keys.evmAddress));
+            }
+            if (!isSolanaTransaction(tx)) {
+                return Err(walletErrors.signingRejected('Unsupported transaction type'));
+            }
+            const messageBytes = tx.message.serialize();
+            const signResult = await fromPromise(bridge.signSolana(keyTag, messageBytes, biometricPrompt), (e) => mapNativeError(e));
+            if (!signResult.ok)
+                return signResult;
+            tx.signatures[0] = signResult.value.signature;
+            return Ok(tx);
+        },
+        async withAuthContext(prompt, fn) {
+            if (bridge.beginAuthContext === undefined || bridge.endAuthContext === undefined) {
+                // Bridge doesn't support auth context — passthrough
+                try {
+                    return Ok(await fn());
+                }
+                catch (e) {
+                    return Err(mapNativeError(e));
+                }
+            }
+            const contextResult = await fromPromise(bridge.beginAuthContext(prompt), (e) => mapNativeError(e));
+            if (!contextResult.ok)
+                return contextResult;
+            try {
+                const result = await fn();
+                return Ok(result);
+            }
+            catch (e) {
+                return Err(mapNativeError(e));
+            }
+            finally {
+                await bridge.endAuthContext(contextResult.value.contextId).catch(() => {
+                    // Best-effort cleanup — context will expire naturally
+                });
+            }
+        },
+        destroy() {
+            storedKeyPair = undefined;
+        },
+    };
+    return backend;
+}
+//# sourceMappingURL=secure-enclave-backend.js.map

package/dist/signers/secure-enclave-backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-enclave-backend.js","sourceRoot":"","sources":["../../src/signers/secure-enclave-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE7F,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAC/C,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAEzD,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,uEAAuE;AACvE,SAAS,gBAAgB,CAAC,SAAqB;IAC7C,oEAAoE;IACpE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,KAAK,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAa,CAAC;AACzD,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,MAAkB;IACzC,4DAA4D;IAC5D,OAAO,KAAK,UAAU,CAAC,MAAM,CAAC,EAAS,CAAC;AAC1C,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEvE,qDAAqD;IACrD,MAAM,iBAAiB,GAAG;QACxB,aAAa;QACb,WAAW;QACX,uBAAuB;QACvB,UAAU;QACV,SAAS;KACV,CAAC;IACF,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,gCAAgC;IAChC,MAAM,eAAe,GAAG;QACtB,gBAAgB;QAChB,eAAe;QACf,aAAa;QACb,qBAAqB;KACtB,CAAC;IACF,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,gBAAgB;IAChB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC9F,OAAO,YAAY,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC;IAED,4BAA4B;IAC5B,OAAO,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAA2B;IAE3B,MAAM,MAAM,GAA8B,MAAM,CAAC,YAAY,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC;IAChD,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,wBAAwB,CAAC;IAE3E,IAAI,aAAqC,CAAC;IAE1C,MAAM,OAAO,GAAmB;QAC9B,KAAK,CAAC,eAAe;YACnB,2CAA2C;YAC3C,MAAM,YAAY,GAAG,MAAM,WAAW,CACpC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EACxB,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CACzB,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,EAAE;gBAAE,OAAO,YAAY,CAAC;YAE1C,IAAI,YAAY,CAAC,KAAK,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBACtD,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;YAC3B,CAAC;YAED,kDAAkD;YAClD,MAAM,SAAS,GAAG,MAAM,WAAW,CACjC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CACzB,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,EAAE;gBAAE,OAAO,SAAS,CAAC;YAEpC,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC;YAC1D,MAAM,UAAU,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,aAAa,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;YAEpD,MAAM,OAAO,GAAe;gBAC1B,UAAU;gBACV,aAAa;gBACb,QAAQ,EAAE,KAAc;aACzB,CAAC;YAEF,aAAa,GAAG,OAAO,CAAC;YACxB,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,WAAW,CACf,IAAgB,EAChB,OAAY;YAEZ,IAAI,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,aAAa,CAAC,UAAU,EAAE,CAAC;gBAChF,OAAO,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,UAAoB,CAAC,CAAC,CAAC;YAClE,CAAC;YAED,oDAAoD;YACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,UAAU,GAAG,MAAM,WAAW,CAClC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,EAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CACzB,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC;YAEtC,OAAO,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,KAAK,CAAC,aAAa,CACjB,IAAgB,EAChB,OAAyB;YAEzB,IAAI,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,aAAa,CAAC,UAAU,EAAE,CAAC;gBAChF,OAAO,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,UAAoB,CAAC,CAAC,CAAC;YAClE,CAAC;YAED,oDAAoD;YACpD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,UAAU,GAAG,MAAM,WAAW,CAClC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,EAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CACzB,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC;YAEtC,OAAO,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,KAAK,CAAC,eAAe,CACnB,IAAgB,EAChB,EAAK;YAEL,IAAI,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,aAAa,CAAC,UAAU,EAAE,CAAC;gBAChF,OAAO,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,UAAoB,CAAC,CAAC,CAAC;YAClE,CAAC;YAED,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7B,OAAO,GAAG,CACR,YAAY,CAAC,eAAe,CAAC,8BAA8B,CAAC,CAC7D,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,UAAU,GAAG,MAAM,WAAW,CAClC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,eAAe,CAAC,EACxD,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CACzB,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC;YAEtC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;YAC9C,OAAO,EAAE,CAAC,EAAO,CAAC,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,EAAoB;YAEpB,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjF,oDAAoD;gBACpD,IAAI,CAAC;oBACH,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACxB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,WAAW,CACrC,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CACzB,CAAC;YACF,IAAI,CAAC,aAAa,CAAC,EAAE;gBAAE,OAAO,aAAa,CAAC;YAE5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBACpE,sDAAsD;gBACxD,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO;YACL,aAAa,GAAG,SAAS,CAAC;QAC5B,CAAC;KACF,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC"}