@provablehq/veil-aleo-sdk 0.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Provable Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,89 @@
+# @provablehq/veil-aleo-sdk
+
+Local signing and proving for the Veil Aleo SDK, backed by the Provable WASM SDK
+(`@provablehq/sdk`).
+
+Reach for this package when the caller holds an Aleo private key directly — bots,
+scripts, tests, and CI — rather than connecting a wallet. It turns a private key
+into an account, wires a wallet client with proving configured (delegated or
+local), builds record scanners, and derives the same account keys (address, view
+key) and blinded claim identity that private flows depend on. Because it loads
+WASM, an app that connects a wallet instead — the wallet holds the keys and
+proves for you — generally does not need this package at all.
+
+## Installation
+
+```sh
+pnpm add @provablehq/veil-aleo-sdk @provablehq/veil-core
+```
+
+## Usage
+
+Load the SDK for a network, then build the account, scanner, and clients from
+the returned handle. `loadNetwork` is async because it fetches the network's WASM
+binaries; the handle it returns is synchronous from there on.
+
+```ts
+import { loadNetwork } from '@provablehq/veil-aleo-sdk'
+
+const aleo = await loadNetwork('testnet')
+
+// A record scanner so the wallet client can find the private records that
+// program calls spend. The first requestRecords registers the view key with the
+// service (one network round-trip); later calls reuse it.
+const scanner = aleo.createRemoteScanner({
+  url: 'https://api.provable.com/scanner',
+  consumerId: CONSUMER_ID,
+  apiKey: DPS_API_KEY, // authenticates + registers the view key for scanning
+})
+
+// A fully-wired client pair: an account from the private key, a public client
+// for reads, and a wallet client with proving + the scanner attached.
+const { publicClient, walletClient, account } = aleo.createAleoClient({
+  privateKey: PRIVATE_KEY,
+  networkUrl: 'https://api.provable.com/v2',
+  provingMode: 'delegated',
+  proverUrl: 'https://api.provable.com/prove/testnet',
+  apiKey: DPS_API_KEY,
+  consumerId: CONSUMER_ID,
+  records: scanner,
+})
+
+account.address // 'aleo1...'
+```
+
+Pass `provingMode: 'local'` to prove in-process instead of delegating to a prover
+service (drop `proverUrl`/`apiKey`/`consumerId`). The `walletClient` composes with
+action packages the same way a wallet-backed client does:
+
+```ts
+import { shieldSwapActions } from '@provablehq/shield-swap-sdk'
+
+const client = walletClient.extend(
+  shieldSwapActions({ api: { baseUrl: 'https://amm-api.dev.provable.com' } }),
+)
+```
+
+The handle also exposes the pieces individually when the caller does not want the
+full pair:
+
+- `aleo.privateKeyToAccount(privateKey)` / `aleo.mnemonicToAccount(mnemonic)` /
+  `aleo.generateAccount()` — build a `LocalAccount`.
+- `aleo.createProvingConfig({ ... })` — the `proving` config for
+  `createWalletClient({ proving })`.
+- `aleo.createStandaloneScanner({ ... })` — a scanner keyed by an explicit view
+  key, with no account attached.
+- `aleo.decryptRecord(viewKey, ciphertext)` / `aleo.verifySignature(...)` —
+  network-agnostic key operations.
+
+For local iteration without a live chain, `createDevnodeClient()` returns the
+same client pair pointed at an Aleo Devnode instance with a pre-funded seeded
+account.
+
+## WASM dependency
+
+`@provablehq/sdk` ships the Aleo cryptography as WebAssembly, and this package
+loads it. That is the cost of holding keys and proving locally. An app that
+connects a wallet — Shield, Leo — should build its client from the wallet adapter
+instead (see `@provablehq/veil-aleo-wallet-adapter`) and skip `@provablehq/veil-aleo-sdk`, keeping the
+WASM out of the bundle.

package/dist/index.d.ts

@@ -0,0 +1,346 @@
+import { loadNetwork as loadNetwork$1 } from '@provablehq/sdk/dynamic.js';
+export { DEVNODE_ADDR, DEVNODE_PRIVATE_KEY } from '@provablehq/veil-aleo-devnode';
+import { LocalAccount, ProvingConfig, RecordProvider, StandaloneRecordScanner, PublicClient, WalletClient } from '@provablehq/veil-core';
+
+/**
+ * Names the derivation-path convention used to turn a seed into Aleo keys.
+ *
+ * `'standard'` uses the SLIP-0044-registered Aleo coin type (`m/44'/683'`);
+ * `'legacy'` uses the pre-registration path (`m/44'/0'`) some older wallets
+ * chose. Pick `'legacy'` only to recover accounts created by such a wallet.
+ */
+type AleoDerivationId = 'standard' | 'legacy';
+/** SLIP-0044 registered Aleo coin type. */
+declare const STANDARD_PATH = "m/44'/683'";
+/** Pre-SLIP-0044-registration derivation path. Some older wallets used this. */
+declare const LEGACY_PATH = "m/44'/0'";
+/**
+ * Hierarchical-deterministic key node for the BLS12-377 curve Aleo uses.
+ *
+ * Follows the SLIP-0010 construction (HMAC-SHA512 chains, hardened-only
+ * derivation) with an Aleo-specific master key tag, matching shield-core.
+ * All operations are pure and local — nothing touches the network. Start
+ * from {@link BLS12377HDKey.fromMasterSeed} (or {@link mnemonicToHDKey})
+ * rather than the constructor; the 32-byte `key` of a derived node is the
+ * seed for an Aleo private key.
+ */
+declare class BLS12377HDKey {
+    readonly key: Uint8Array;
+    readonly chainCode: Uint8Array;
+    /**
+     * Wraps raw node material. Callers normally use
+     * {@link BLS12377HDKey.fromMasterSeed} instead of constructing directly.
+     *
+     * @param key 32-byte private key material of this node.
+     * @param chainCode 32-byte chain code used to derive children.
+     */
+    constructor(key: Uint8Array, chainCode: Uint8Array);
+    /**
+     * Derives the master node from a BIP-39 seed. Pure and local.
+     *
+     * @param seed Seed bytes, typically the 64-byte output of
+     *   {@link mnemonicToSeed}.
+     * @returns The root node from which paths are derived.
+     */
+    static fromMasterSeed(seed: Uint8Array): BLS12377HDKey;
+    /**
+     * Derives the descendant node at a hardened path. Pure and local.
+     *
+     * @param path Path of the form `m/44'/683'` — every segment MUST be
+     *   hardened (trailing `'`) and below 2^31.
+     * @returns A new node; this node is unchanged.
+     * @throws If the path is malformed, contains a non-hardened segment, or a
+     *   segment is out of range.
+     */
+    derive(path: string): BLS12377HDKey;
+    /** Alias for {@link BLS12377HDKey.derive}, kept for HD-key API parity. */
+    derivePath(path: string): BLS12377HDKey;
+    /**
+     * Derives the account node at `m/{index}'/0'` relative to this node. Pure
+     * and local. Applied to a {@link DERIVATION_PATHS} node, this yields the
+     * account at that index.
+     *
+     * @param index Zero-based account index, below 2^31; hardening is applied
+     *   internally.
+     * @returns The account-level node.
+     * @throws If the index is negative, fractional, or 2^31 or greater.
+     */
+    deriveChild(index: number): BLS12377HDKey;
+}
+/**
+ * Generates a fresh BIP-39 mnemonic from the English wordlist.
+ *
+ * Draws entropy from the platform CSPRNG; no network access. The phrase is
+ * the root secret for every account derived from it — the caller MUST store
+ * it securely and never log it.
+ *
+ * @param strength Entropy in bits: 128 yields 12 words, 256 yields 24.
+ *   Defaults to 128.
+ * @returns A space-separated mnemonic phrase.
+ *
+ * @example
+ * import { generateMnemonic, mnemonicToHDKey } from '@provablehq/veil-aleo-sdk'
+ *
+ * const mnemonic = generateMnemonic()
+ * const account0 = mnemonicToHDKey(mnemonic)
+ */
+declare function generateMnemonic(strength?: 128 | 256): string;
+/**
+ * Checks a full mnemonic phrase against BIP-39: English wordlist membership,
+ * word count, and checksum. Pure and local.
+ *
+ * @param mnemonic Space-separated candidate phrase.
+ * @returns True only if the phrase can be used for key derivation; a single
+ *   wrong or reordered word fails the checksum.
+ */
+declare function validateMnemonic(mnemonic: string): boolean;
+/**
+ * Checks whether a single word belongs to the English BIP-39 wordlist. Pure
+ * and local. Use for per-word feedback while a phrase is being typed;
+ * validating the complete phrase still requires {@link validateMnemonic}.
+ *
+ * @param word Candidate word, lowercase.
+ * @returns True if the word is one of the 2048 list entries.
+ */
+declare function validateWord(word: string): boolean;
+/**
+ * Converts a mnemonic to its 64-byte BIP-39 seed via PBKDF2-HMAC-SHA512 with
+ * an empty passphrase. Pure, local, and deterministic.
+ *
+ * The mnemonic is not validated here — call {@link validateMnemonic} first;
+ * an invalid phrase still produces a seed, only for the wrong accounts.
+ *
+ * @param mnemonic Space-separated BIP-39 phrase.
+ * @returns Seed bytes for {@link BLS12377HDKey.fromMasterSeed}.
+ */
+declare function mnemonicToSeed(mnemonic: string): Uint8Array;
+/**
+ * Derives the Aleo account key at the given index from a mnemonic in one
+ * step: seed, master node, derivation path, account child. Pure and local.
+ * This is the usual entry point for turning a stored phrase into key
+ * material.
+ *
+ * @param mnemonic Space-separated BIP-39 phrase.
+ * @param options.index Zero-based account index, below 2^31. Defaults to 0.
+ * @param options.derivation Path convention. Defaults to `'standard'`
+ *   (`m/44'/683'`); pass `'legacy'` to recover accounts from wallets that
+ *   predate the SLIP-0044 registration.
+ * @returns The account node; its `key` bytes seed the Aleo private key.
+ * @throws If the index is out of range.
+ *
+ * @example
+ * import { mnemonicToHDKey } from '@provablehq/veil-aleo-sdk'
+ *
+ * const hdKey = mnemonicToHDKey(mnemonic, { index: 1 })
+ */
+declare function mnemonicToHDKey(mnemonic: string, options?: {
+    index?: number;
+    derivation?: AleoDerivationId;
+}): BLS12377HDKey;
+
+/**
+ * @provablehq/veil-aleo-sdk
+ *
+ * Loads `@provablehq/sdk` for a specific Aleo network and exposes the SDK's
+ * functionality bound to that network's setup parameters.
+ *
+ * Usage:
+ *   import { loadNetwork } from '@provablehq/veil-aleo-sdk'
+ *   import { http } from '@provablehq/veil-core'
+ *
+ *   const aleo = await loadNetwork('mainnet')
+ *
+ *   const account = aleo.privateKeyToAccount('APrivateKey1...')
+ *   const { publicClient, walletClient } = aleo.createAleoClient({
+ *     privateKey: 'APrivateKey1...',
+ *     networkUrl: 'https://api.provable.com/v2',
+ *   })
+ *
+ * Switching networks: load a new handle. Existing accounts remain valid —
+ * Aleo private keys, view keys, and addresses are network-agnostic.
+ */
+
+/** Networks supported by `@provablehq/sdk/dynamic.js`. */
+type SupportedNetwork = 'mainnet' | 'testnet';
+type SdkModule = Awaited<ReturnType<typeof loadNetwork$1<'testnet'>>>;
+/**
+ * A network-bound SDK handle. All functions on this handle use the binary
+ * set loaded for the named network.
+ *
+ * Most key/account operations (`privateKeyToAccount`, `mnemonicToAccount`,
+ * `generateAccount`, `decryptRecord`, `verifySignature`) are mathematically
+ * network-agnostic — the same private key (or mnemonic) derives the same
+ * address and view key regardless of which network's binary was loaded.
+ * Proving and program operations (`createProvingConfig`, `createAleoClient`,
+ * scanners) are network-bound.
+ */
+interface AleoSdk {
+    /** The network this handle is bound to. */
+    readonly network: SupportedNetwork;
+    /** Creates a `LocalAccount` from an Aleo private key. */
+    privateKeyToAccount(privateKey: string): LocalAccount<'privateKey'>;
+    /**
+     * Creates a `LocalAccount` from a BIP39 mnemonic phrase using Aleo's
+     * BLS12-377 HD derivation (matches Shield wallet derivation).
+     *
+     * Defaults to the SLIP-0044 Aleo coin type path `m/44'/683'`, account
+     * index 0. Pass `derivation: 'legacy'` to use the pre-registration path
+     * `m/44'/0'` for compatibility with older wallets.
+     */
+    mnemonicToAccount(mnemonic: string, options?: {
+        index?: number;
+        derivation?: AleoDerivationId;
+    }): LocalAccount<'mnemonic'>;
+    /**
+     * Generates a fresh BIP39 mnemonic and derives its Aleo account in one call.
+     * Pure and local — no network access. The caller MUST persist the returned
+     * mnemonic; it is the only way to re-derive the account.
+     *
+     * @param options.strength Entropy bits: 128 (12 words, default) or 256 (24 words).
+     * @param options.index Account index on the derivation path. Defaults to 0.
+     * @param options.derivation Derivation path id. Defaults to `'standard'`
+     *   (`m/44'/683'`); pass `'legacy'` for pre-registration `m/44'/0'` wallets.
+     * @returns The generated mnemonic and the account derived from it.
+     *
+     * @example
+     * const { mnemonic, account } = aleo.generateMnemonicAccount()
+     * // store `mnemonic` safely; `account.address` is ready to use
+     */
+    generateMnemonicAccount(options?: {
+        strength?: 128 | 256;
+        index?: number;
+        derivation?: AleoDerivationId;
+    }): {
+        mnemonic: string;
+        account: LocalAccount<'mnemonic'>;
+    };
+    /** Creates a new random Aleo account. */
+    generateAccount(): LocalAccount<'privateKey'>;
+    /** Decrypts a record ciphertext using a view key. */
+    decryptRecord(viewKey: string, ciphertext: string): string;
+    /** Verifies a signature against a message and address. */
+    verifySignature(address: string, message: Uint8Array, signature: string): boolean;
+    /** Creates an `AleoNetworkClient` for direct SDK access. */
+    createNetworkClient(url: string): InstanceType<SdkModule['AleoNetworkClient']>;
+    /** Creates a `ProvingConfig` for `createWalletClient({ proving })`. */
+    createProvingConfig(options: {
+        mode: 'delegated' | 'local';
+        networkUrl: string;
+        proverUrl?: string;
+        apiKey?: string;
+        consumerId?: string;
+        account?: LocalAccount<'privateKey'>;
+        confirmationTimeout?: number;
+    }): ProvingConfig;
+    /**
+     * Creates a record scanner backed by Provable's Record Scanner Service.
+     *
+     * The first `requestRecords` call registers the account's view key with the
+     * service (a network round-trip) to obtain the UUID scanning requires;
+     * subsequent calls reuse it. `setAccount` resets the registration.
+     *
+     * The provider implements `switchNetwork`, so a wallet client carrying it
+     * re-targets record scanning when `switchChain` runs — the scanner rebuilds
+     * against the new network and re-registers lazily on the next scan.
+     *
+     * @param options.url Base URL of the service (the SDK appends the network
+     *   segment — do not include it).
+     * @param options.consumerId Consumer id used for JWT refresh.
+     * @param options.apiKey Optional API key for the authenticated service
+     *   (e.g. the hosted Provable RSS). Omit for an open/unauthenticated service.
+     * @param options.startBlock Optional block height to begin scanning from at
+     *   registration. Defaults to 0 (full history).
+     */
+    createRemoteScanner(options: {
+        url: string;
+        consumerId: string;
+        apiKey?: string;
+        startBlock?: number;
+    }): RecordProvider;
+    /**
+     * Creates a standalone record scanner with an explicit view key.
+     *
+     * Like {@link createRemoteScanner}, the first `requestRecords` registers the
+     * view key with the service (a network round-trip) to obtain the scanning UUID.
+     *
+     * @param options.url Base URL of the service (the SDK appends the network segment).
+     * @param options.consumerId Consumer id used for JWT refresh.
+     * @param options.viewKey The view key (`AViewKey1…`) to scan and decrypt with.
+     * @param options.apiKey Optional API key for the authenticated service. Omit
+     *   for an open/unauthenticated service.
+     * @param options.startBlock Optional block height to begin scanning from at
+     *   registration. Defaults to 0 (full history).
+     */
+    createStandaloneScanner(options: {
+        url: string;
+        consumerId: string;
+        viewKey: string;
+        apiKey?: string;
+        startBlock?: number;
+    }): StandaloneRecordScanner;
+    /** Creates a fully-wired Aleo client from a private key and network URL. */
+    createAleoClient(options: {
+        privateKey: string;
+        networkUrl: string;
+        provingMode?: 'delegated' | 'local';
+        proverUrl?: string;
+        apiKey?: string;
+        consumerId?: string;
+        /**
+         * Record provider for `requestRecords`. Not wired by default — pass
+         * `aleo.createRemoteScanner(...)` or any
+         * custom `RecordProvider`. `requestRecords` throws with a setup hint
+         * when no provider is configured.
+         */
+        records?: RecordProvider;
+    }): {
+        publicClient: PublicClient;
+        walletClient: WalletClient;
+        account: LocalAccount<'privateKey'>;
+    };
+}
+/**
+ * Loads `@provablehq/sdk` for the named network and returns a network-bound
+ * handle. The SDK module cache memoizes the load — calling twice for the
+ * same network returns the same binary set without re-instantiating.
+ */
+declare function loadNetwork(name: SupportedNetwork): Promise<AleoSdk>;
+/** Creates a new random Aleo account (uses static SDK binaries). */
+declare function generateAccount(): LocalAccount<'privateKey'>;
+/**
+ * Creates a fully-wired client pair pointing at a local Aleo Devnode instance.
+ *
+ * Devnode is a lightweight local Aleo node (similar to Foundry's Anvil) that
+ * bypasses consensus and skips ZK proof generation, enabling rapid program iteration.
+ * The seeded account is pre-funded; both key and socket address can be overridden.
+ *
+ * The returned wallet client supports `executeContract`. Its confirmation wait
+ * resolves once the devnode includes the transaction in a block — automatic
+ * after broadcast by default; under `manualBlockCreation` the caller must
+ * advance blocks (e.g. a test client's `advanceBlock`) while the call is
+ * pending. Record outputs owned by the client's account are decrypted to
+ * plaintext in the result; foreign records are dropped.
+ *
+ * @example
+ * ```ts
+ * // Zero-config — uses seeded key and localhost:3030
+ * const { publicClient, walletClient, account } = createDevnodeClient()
+ *
+ * // Custom key or socket address
+ * const { publicClient, walletClient, account } = createDevnodeClient({
+ *   privateKey: 'APrivateKey1...',
+ *   socketAddr: '127.0.0.1:4040',
+ * })
+ * ```
+ */
+declare function createDevnodeClient(options?: {
+    privateKey?: string;
+    /** Socket address of the devnode, e.g. "127.0.0.1:3030" */
+    socketAddr?: string;
+}): {
+    publicClient: PublicClient;
+    walletClient: WalletClient;
+    account: LocalAccount<'privateKey'>;
+};
+
+export { type AleoDerivationId, type AleoSdk, BLS12377HDKey, LEGACY_PATH, STANDARD_PATH, type SupportedNetwork, createDevnodeClient, generateAccount, generateMnemonic, loadNetwork, mnemonicToHDKey, mnemonicToSeed, validateMnemonic, validateWord };

package/dist/index.js

@@ -0,0 +1,679 @@
+// src/index.ts
+import { loadNetwork as loadSdk } from "@provablehq/sdk/dynamic.js";
+import {
+  Account,
+  AleoKeyProvider,
+  Program,
+  ProgramManager,
+  RecordCiphertext as StaticRecordCiphertext,
+  ViewKey as StaticViewKey,
+  getOrInitConsensusVersionTestHeights
+} from "@provablehq/sdk";
+import { DEVNODE_PRIVATE_KEY, DEVNODE_ADDR } from "@provablehq/veil-aleo-devnode";
+import {
+  createPublicClient,
+  createWalletClient,
+  http,
+  BaseError,
+  ProvingError,
+  ConfigurationError,
+  classifyBroadcastError,
+  classifyProvingError,
+  waitForConfirmation,
+  extractTransitions
+} from "@provablehq/veil-core";
+
+// src/mnemonic.ts
+import { hmac } from "@noble/hashes/hmac";
+import { sha512 } from "@noble/hashes/sha512";
+import * as bip39 from "@scure/bip39";
+import { wordlist } from "@scure/bip39/wordlists/english";
+var HARDENED_OFFSET = 2147483648;
+var BLS12_377_CURVE = "bls12_377 seed";
+var PATH_REGEX = /^m(\/[0-9]+')+$/;
+var STANDARD_PATH = "m/44'/683'";
+var LEGACY_PATH = "m/44'/0'";
+var DERIVATION_PATHS = {
+  standard: STANDARD_PATH,
+  legacy: LEGACY_PATH
+};
+function uint32BE(n) {
+  if (!Number.isInteger(n) || n < 0 || n > 4294967295) {
+    throw new Error(`uint32BE: value out of range (got ${n})`);
+  }
+  const out = new Uint8Array(4);
+  new DataView(out.buffer).setUint32(0, n, false);
+  return out;
+}
+function concatBytes(...parts) {
+  const total = parts.reduce((sum, p) => sum + p.length, 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const p of parts) {
+    out.set(p, offset);
+    offset += p.length;
+  }
+  return out;
+}
+function ckdPriv({ key, chainCode }, index) {
+  const data = concatBytes(new Uint8Array([0]), key, uint32BE(index));
+  const I = hmac(sha512, chainCode, data);
+  return { key: I.slice(0, 32), chainCode: I.slice(32) };
+}
+function getMasterKeyFromSeed(seed) {
+  const I = hmac(sha512, BLS12_377_CURVE, seed);
+  return { key: I.slice(0, 32), chainCode: I.slice(32) };
+}
+function isValidPath(path) {
+  if (!PATH_REGEX.test(path)) return false;
+  return path.split("/").slice(1).map((s) => s.replace("'", "")).every((s) => Number.isFinite(Number(s)));
+}
+var BLS12377HDKey = class _BLS12377HDKey {
+  /**
+   * Wraps raw node material. Callers normally use
+   * {@link BLS12377HDKey.fromMasterSeed} instead of constructing directly.
+   *
+   * @param key 32-byte private key material of this node.
+   * @param chainCode 32-byte chain code used to derive children.
+   */
+  constructor(key, chainCode) {
+    this.key = key;
+    this.chainCode = chainCode;
+  }
+  key;
+  chainCode;
+  /**
+   * Derives the master node from a BIP-39 seed. Pure and local.
+   *
+   * @param seed Seed bytes, typically the 64-byte output of
+   *   {@link mnemonicToSeed}.
+   * @returns The root node from which paths are derived.
+   */
+  static fromMasterSeed(seed) {
+    const master = getMasterKeyFromSeed(seed);
+    return new _BLS12377HDKey(master.key, master.chainCode);
+  }
+  /**
+   * Derives the descendant node at a hardened path. Pure and local.
+   *
+   * @param path Path of the form `m/44'/683'` — every segment MUST be
+   *   hardened (trailing `'`) and below 2^31.
+   * @returns A new node; this node is unchanged.
+   * @throws If the path is malformed, contains a non-hardened segment, or a
+   *   segment is out of range.
+   */
+  derive(path) {
+    if (!isValidPath(path)) {
+      throw new Error(
+        `Invalid derivation path: ${path} (must match m/N'/N'/... \u2014 hardened only)`
+      );
+    }
+    const segments = path.split("/").slice(1).map((s) => parseInt(s.replace("'", ""), 10));
+    for (const seg of segments) {
+      if (seg >= HARDENED_OFFSET) {
+        throw new Error(
+          `Derivation path segment out of range: ${seg} (must be < 2\xB3\xB9)`
+        );
+      }
+    }
+    const result = segments.reduce(
+      (acc, segment) => ckdPriv(acc, segment + HARDENED_OFFSET),
+      { key: this.key, chainCode: this.chainCode }
+    );
+    return new _BLS12377HDKey(result.key, result.chainCode);
+  }
+  /** Alias for {@link BLS12377HDKey.derive}, kept for HD-key API parity. */
+  derivePath(path) {
+    return this.derive(path);
+  }
+  /**
+   * Derives the account node at `m/{index}'/0'` relative to this node. Pure
+   * and local. Applied to a {@link DERIVATION_PATHS} node, this yields the
+   * account at that index.
+   *
+   * @param index Zero-based account index, below 2^31; hardening is applied
+   *   internally.
+   * @returns The account-level node.
+   * @throws If the index is negative, fractional, or 2^31 or greater.
+   */
+  deriveChild(index) {
+    if (!Number.isInteger(index) || index < 0 || index >= HARDENED_OFFSET) {
+      throw new Error(
+        `Invalid child index: ${index} (must be integer in [0, 2\xB3\xB9))`
+      );
+    }
+    return this.derive(`m/${index}'/0'`);
+  }
+};
+function generateMnemonic2(strength = 128) {
+  return bip39.generateMnemonic(wordlist, strength);
+}
+function validateMnemonic2(mnemonic) {
+  return bip39.validateMnemonic(mnemonic, wordlist);
+}
+function validateWord(word) {
+  return wordlist.includes(word);
+}
+function mnemonicToSeed(mnemonic) {
+  return bip39.mnemonicToSeedSync(mnemonic);
+}
+function mnemonicToHDKey(mnemonic, options = {}) {
+  const { index = 0, derivation = "standard" } = options;
+  const seed = mnemonicToSeed(mnemonic);
+  return BLS12377HDKey.fromMasterSeed(seed).derivePath(DERIVATION_PATHS[derivation]).deriveChild(index);
+}
+
+// src/index.ts
+async function loadNetwork(name) {
+  const sdk = await loadSdk(name);
+  return buildSdk(name, sdk);
+}
+function buildSdk(initialNetwork, initialSdk) {
+  let currentSdk = initialSdk;
+  const network = initialNetwork;
+  const {
+    Account: Account2,
+    PrivateKey,
+    Signature,
+    Address,
+    ViewKey,
+    AleoNetworkClient,
+    RecordScanner,
+    RecordCiphertext
+  } = initialSdk;
+  function mnemonicToAccount(mnemonic, options) {
+    const hd = mnemonicToHDKey(mnemonic, options);
+    const privateKey = PrivateKey.from_seed_unchecked(hd.key).to_string();
+    return { ...privateKeyToAccount(privateKey), source: "mnemonic" };
+  }
+  function generateMnemonicAccount(options) {
+    const mnemonic = generateMnemonic2(options?.strength ?? 128);
+    const { strength: _strength, ...derivationOptions } = options ?? {};
+    return { mnemonic, account: mnemonicToAccount(mnemonic, derivationOptions) };
+  }
+  function generateAccount2() {
+    const sdkAccount = new Account2();
+    return privateKeyToAccount(sdkAccount.privateKey().to_string());
+  }
+  function decryptRecord(viewKeyString, ciphertext) {
+    return ViewKey.from_string(viewKeyString).decrypt(ciphertext);
+  }
+  function verifySignature(addressString, message, signatureString) {
+    const sig = Signature.from_string(signatureString);
+    const addr = Address.from_string(addressString);
+    return sig.verify(addr, message);
+  }
+  function createNetworkClient(url) {
+    return new AleoNetworkClient(url);
+  }
+  function createProvingConfig(options) {
+    let networkUrl = options.networkUrl;
+    let keyProvider = new currentSdk.AleoKeyProvider();
+    keyProvider.useCache(true);
+    return {
+      mode: options.mode,
+      url: options.proverUrl,
+      buildTransaction: async (txOptions) => {
+        const programManager = new currentSdk.ProgramManager(
+          networkUrl,
+          keyProvider,
+          void 0
+        );
+        if (options.account) {
+          const sdkAccount = new currentSdk.Account({ privateKey: options.account.privateKey });
+          programManager.setAccount(sdkAccount);
+        }
+        let resolvedImports;
+        if (txOptions.imports && txOptions.imports.length > 0) {
+          const programSource = await programManager.networkClient.getProgram(txOptions.programName);
+          const staticImports = await programManager.networkClient.getProgramImports(programSource);
+          const merged = { ...staticImports };
+          for (const name of txOptions.imports) {
+            merged[name] = await programManager.networkClient.getProgram(name);
+          }
+          resolvedImports = merged;
+        }
+        const tx = await programManager.buildExecutionTransaction({
+          programName: txOptions.programName,
+          functionName: txOptions.functionName,
+          priorityFee: 0,
+          privateFee: txOptions.privateFee ?? false,
+          inputs: txOptions.inputs,
+          ...resolvedImports ? { imports: resolvedImports } : {}
+        });
+        return JSON.parse(tx.toString());
+      },
+      buildDeployment: async (deployOptions) => {
+        const programManager = new currentSdk.ProgramManager(
+          networkUrl,
+          keyProvider,
+          void 0
+        );
+        if (options.account) {
+          const sdkAccount = new currentSdk.Account({ privateKey: options.account.privateKey });
+          programManager.setAccount(sdkAccount);
+        }
+        const tx = await programManager.buildDeploymentTransaction(
+          deployOptions.program,
+          0,
+          deployOptions.privateFee ?? false
+        );
+        return JSON.parse(tx.toString());
+      },
+      simulate: async (simOptions) => {
+        const programManager = new currentSdk.ProgramManager(networkUrl, keyProvider, void 0);
+        if (options.account) {
+          programManager.setAccount(new currentSdk.Account({ privateKey: options.account.privateKey }));
+        }
+        const accountViewKey = options.account ? ViewKey.from_string(options.account.viewKey) : void 0;
+        const decryptor = accountViewKey ? (ciphertext) => {
+          const ct = RecordCiphertext.fromString(ciphertext);
+          return ct.isOwner(accountViewKey) ? ct.decrypt(accountViewKey).toString() : null;
+        } : void 0;
+        const authorization = await programManager.buildAuthorization({
+          programName: simOptions.programName,
+          functionName: simOptions.functionName,
+          inputs: simOptions.inputs,
+          programSource: simOptions.programSource,
+          programImports: simOptions.programImports
+        });
+        const tx = {
+          execution: {
+            transitions: authorization.transitions().map((t) => {
+              let source = t;
+              if (accountViewKey) {
+                try {
+                  source = t.decryptTransition(t.tvk(accountViewKey));
+                } catch {
+                }
+              }
+              return JSON.parse(source.toString());
+            })
+          }
+        };
+        const { transitions, outputs } = extractTransitions(tx, decryptor);
+        return { transitions, outputs };
+      },
+      execute: async (execOptions) => {
+        const programManager = new currentSdk.ProgramManager(networkUrl, keyProvider, void 0);
+        if (options.account) {
+          programManager.setAccount(new currentSdk.Account({ privateKey: options.account.privateKey }));
+        }
+        const priorityFee = Number(execOptions.fee) / 1e6;
+        const accountViewKey = options.account ? ViewKey.from_string(options.account.viewKey) : void 0;
+        const decryptor = accountViewKey ? (ciphertext) => {
+          const ct = RecordCiphertext.fromString(ciphertext);
+          return ct.isOwner(accountViewKey) ? ct.decrypt(accountViewKey).toString() : null;
+        } : void 0;
+        const buildPollingClient = () => createPublicClient({ transport: http(networkUrl, { network }) });
+        if (options.mode === "delegated") {
+          if (!options.proverUrl) throw new ConfigurationError("Delegated execution requires proverUrl. Pass proverUrl to createProvingConfig or createAleoClient.");
+          let response;
+          try {
+            const provingRequest = await programManager.provingRequest({
+              programName: execOptions.programName,
+              programSource: execOptions.programSource,
+              programImports: execOptions.programImports,
+              functionName: execOptions.functionName,
+              inputs: execOptions.inputs,
+              priorityFee,
+              privateFee: execOptions.privateFee ?? false,
+              broadcast: true
+            });
+            const dpsClient = new AleoNetworkClient(options.proverUrl);
+            response = await dpsClient.submitProvingRequest({
+              provingRequest,
+              url: options.proverUrl,
+              apiKey: options.apiKey,
+              consumerId: options.consumerId
+            });
+          } catch (e) {
+            if (e instanceof BaseError) throw e;
+            throw classifyProvingError(e);
+          }
+          const txId = response.transaction?.id;
+          if (!txId) throw new ConfigurationError("DPS response did not contain a transaction ID \u2014 check prover service configuration.");
+          const confirmedTx = await waitForConfirmation(buildPollingClient(), txId, options.confirmationTimeout);
+          const { transitions, outputs } = extractTransitions(confirmedTx, decryptor);
+          return { transactionId: txId, transitions, outputs };
+        } else {
+          let tx;
+          try {
+            tx = await programManager.buildExecutionTransaction({
+              programName: execOptions.programName,
+              functionName: execOptions.functionName,
+              inputs: execOptions.inputs,
+              priorityFee,
+              privateFee: execOptions.privateFee ?? false,
+              program: execOptions.programSource,
+              imports: execOptions.programImports
+            });
+          } catch (e) {
+            if (e instanceof BaseError) throw e;
+            throw new ProvingError({ message: e instanceof Error ? e.message : String(e), cause: e });
+          }
+          let txId;
+          try {
+            const submitClient = new AleoNetworkClient(networkUrl);
+            submitClient.setVerboseErrors(false);
+            txId = await submitClient.submitTransaction(tx);
+          } catch (e) {
+            if (e instanceof BaseError) throw e;
+            throw classifyBroadcastError(e);
+          }
+          const confirmedTx = await waitForConfirmation(buildPollingClient(), txId, options.confirmationTimeout);
+          const { transitions, outputs } = extractTransitions(confirmedTx, decryptor);
+          return { transactionId: txId, transitions, outputs };
+        }
+      },
+      decrypt: async (cipherText) => {
+        if (!options.account?.viewKey) {
+          throw new Error(
+            "decrypt requires an account with a viewKey on the proving config."
+          );
+        }
+        return currentSdk.ViewKey.from_string(options.account.viewKey).decrypt(cipherText);
+      },
+      switchNetwork: async (newNetwork) => {
+        if (newNetwork !== "mainnet" && newNetwork !== "testnet") {
+          throw new Error(
+            `loadNetwork supports 'mainnet' or 'testnet' (received '${newNetwork}').`
+          );
+        }
+        currentSdk = await loadSdk(newNetwork);
+        keyProvider = new currentSdk.AleoKeyProvider();
+        keyProvider.useCache(true);
+      }
+    };
+  }
+  function toOwnedRecord(raw) {
+    const pick = (snake, camel) => raw[snake] ?? raw[camel];
+    return {
+      blockHeight: pick("block_height", "blockHeight"),
+      blockTimestamp: pick("block_timestamp", "blockTimestamp"),
+      commitment: raw.commitment,
+      functionName: pick("function_name", "functionName"),
+      outputIndex: pick("output_index", "outputIndex"),
+      owner: raw.owner,
+      programName: pick("program_name", "programName"),
+      recordCiphertext: pick("record_ciphertext", "recordCiphertext"),
+      recordName: pick("record_name", "recordName"),
+      sender: raw.sender,
+      spent: raw.spent,
+      tag: raw.tag,
+      transactionId: pick("transaction_id", "transactionId"),
+      transitionId: pick("transition_id", "transitionId"),
+      transactionIndex: pick("transaction_index", "transactionIndex"),
+      transitionIndex: pick("transition_index", "transitionIndex"),
+      recordPlaintext: pick("record_plaintext", "recordPlaintext") ?? ""
+    };
+  }
+  function makeRegisterOnce(startBlock) {
+    let registration;
+    return {
+      ensure(scanner, viewKey) {
+        if (!registration) {
+          registration = (async () => {
+            const result = await scanner.registerEncrypted(viewKey, startBlock);
+            if (!result.ok) {
+              registration = void 0;
+              throw new Error(
+                `Record scanner registration failed (HTTP ${result.status}): ${result.error?.message ?? "unknown error"}`
+              );
+            }
+          })();
+        }
+        return registration;
+      }
+    };
+  }
+  async function scanOwned(scanner, program, statusFilter, canReMint) {
+    const ALWAYS_RETRY = /* @__PURE__ */ new Set([429, 500, 502, 503, 504]);
+    const AUTH_RETRY = /* @__PURE__ */ new Set([401, 403]);
+    const retryable = (status) => ALWAYS_RETRY.has(status) || canReMint && AUTH_RETRY.has(status);
+    const MAX_ATTEMPTS = 4;
+    let last = "";
+    for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+      try {
+        const result = await scanner.owned({
+          unspent: statusFilter !== "spent",
+          filter: { programs: [program] }
+        });
+        if (result.ok) return (result.data ?? []).map((r) => toOwnedRecord(r));
+        last = `HTTP ${result.status}: ${result.error?.message ?? "unknown error"}`;
+        if (!retryable(result.status)) break;
+      } catch (err) {
+        last = err instanceof Error ? err.message : String(err);
+      }
+      if (attempt === MAX_ATTEMPTS - 1) break;
+      scanner.setJwtData(void 0);
+      await new Promise((resolve) => setTimeout(resolve, 500 * 2 ** attempt));
+    }
+    throw new Error(`Record scan failed (${last})`);
+  }
+  function createRemoteScanner(options) {
+    let scannerSdk = { RecordScanner, ViewKey };
+    let scanner;
+    let viewKey;
+    let viewKeyString;
+    let registration = makeRegisterOnce(options.startBlock ?? 0);
+    function buildScanner() {
+      if (!viewKeyString) return;
+      viewKey = scannerSdk.ViewKey.from_string(viewKeyString);
+      scanner = new scannerSdk.RecordScanner({
+        url: options.url,
+        consumerId: options.consumerId,
+        ...options.apiKey ? { apiKey: options.apiKey } : {},
+        viewKeys: [viewKey],
+        decryptEnabled: true,
+        autoReRegister: true
+      });
+      registration = makeRegisterOnce(options.startBlock ?? 0);
+    }
+    return {
+      setAccount: (account) => {
+        viewKeyString = account.viewKey;
+        buildScanner();
+      },
+      requestRecords: async (params) => {
+        if (!scanner) {
+          throw new Error("No active account set on record scanner. Call setAccount() first.");
+        }
+        const activeScanner = scanner;
+        const activeViewKey = viewKey;
+        const activeRegistration = registration;
+        await activeRegistration.ensure(activeScanner, activeViewKey);
+        return scanOwned(activeScanner, params.program, params.statusFilter, !!options.apiKey);
+      },
+      switchNetwork: async (newNetwork) => {
+        if (newNetwork !== "mainnet" && newNetwork !== "testnet") {
+          throw new Error(
+            `Record scanning supports 'mainnet' or 'testnet' (received '${newNetwork}').`
+          );
+        }
+        scannerSdk = await loadSdk(newNetwork);
+        buildScanner();
+      }
+    };
+  }
+  function createStandaloneScanner(options) {
+    const viewKey = ViewKey.from_string(options.viewKey);
+    const scanner = new RecordScanner({
+      url: options.url,
+      consumerId: options.consumerId,
+      ...options.apiKey ? { apiKey: options.apiKey } : {},
+      viewKeys: [viewKey],
+      decryptEnabled: true,
+      autoReRegister: true
+    });
+    const registration = makeRegisterOnce(options.startBlock ?? 0);
+    return {
+      requestRecords: async (params) => {
+        await registration.ensure(scanner, viewKey);
+        return scanOwned(scanner, params.program, params.statusFilter, !!options.apiKey);
+      }
+    };
+  }
+  function createAleoClient(options) {
+    const account = privateKeyToAccount(options.privateKey);
+    const transport = http(options.networkUrl, { network });
+    const proving = createProvingConfig({
+      mode: options.provingMode ?? "delegated",
+      networkUrl: options.networkUrl,
+      proverUrl: options.proverUrl,
+      apiKey: options.apiKey,
+      consumerId: options.consumerId,
+      account
+    });
+    const publicClient = createPublicClient({ transport });
+    if (options.records) {
+      options.records.setAccount({ viewKey: account.viewKey });
+    }
+    const walletClient = createWalletClient({
+      account,
+      transport,
+      proving,
+      ...options.records ? { recordProvider: options.records } : {}
+    });
+    return { publicClient, walletClient, account };
+  }
+  return {
+    network,
+    privateKeyToAccount,
+    mnemonicToAccount,
+    generateMnemonicAccount,
+    generateAccount: generateAccount2,
+    decryptRecord,
+    verifySignature,
+    createNetworkClient,
+    createProvingConfig,
+    createRemoteScanner,
+    createStandaloneScanner,
+    createAleoClient
+  };
+}
+var DEVNODE_CONSENSUS_HEIGHTS = "0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16";
+function privateKeyToAccount(privateKey) {
+  const sdkAccount = new Account({ privateKey });
+  const address = sdkAccount.address().to_string();
+  const viewKey = sdkAccount.viewKey().to_string();
+  const signFn = async (message) => {
+    const sig = sdkAccount.sign(message);
+    return new TextEncoder().encode(sig.to_string());
+  };
+  return {
+    type: "local",
+    source: "privateKey",
+    address,
+    privateKey,
+    viewKey,
+    sign: signFn,
+    signMessage: signFn
+  };
+}
+function generateAccount() {
+  const sdkAccount = new Account();
+  return privateKeyToAccount(sdkAccount.privateKey().to_string());
+}
+function createDevnodeClient(options) {
+  const url = `http://${options?.socketAddr ?? DEVNODE_ADDR}`;
+  const account = privateKeyToAccount(options?.privateKey ?? DEVNODE_PRIVATE_KEY);
+  const sdkAccount = new Account({ privateKey: account.privateKey });
+  const transport = http(url, { network: "testnet" });
+  const keyProvider = new AleoKeyProvider();
+  keyProvider.useCache(true);
+  getOrInitConsensusVersionTestHeights(DEVNODE_CONSENSUS_HEIGHTS);
+  const publicClient = createPublicClient({ transport });
+  const buildExecutionTx = async (opts) => {
+    const programManager = new ProgramManager(url, keyProvider, void 0);
+    programManager.setAccount(sdkAccount);
+    return programManager.buildDevnodeExecutionTransaction({
+      programName: opts.programName,
+      functionName: opts.functionName,
+      priorityFee: 0,
+      privateFee: opts.privateFee ?? false,
+      inputs: opts.inputs,
+      ...opts.imports ? { imports: opts.imports } : {}
+    });
+  };
+  const proving = {
+    mode: "devnode",
+    buildDeployment: async (deployOptions) => {
+      const programManager = new ProgramManager(url, keyProvider, void 0);
+      programManager.setAccount(sdkAccount);
+      const tx = await programManager.buildDevnodeDeploymentTransaction({
+        program: deployOptions.program,
+        priorityFee: 0,
+        privateFee: deployOptions.privateFee ?? false
+      });
+      return JSON.parse(tx.toString());
+    },
+    buildTransaction: async (txOptions) => {
+      let imports;
+      if (txOptions.imports && txOptions.imports.length > 0) {
+        const networkClient = new ProgramManager(url, keyProvider, void 0).networkClient;
+        imports = {};
+        const queue = [...txOptions.imports];
+        const seen = /* @__PURE__ */ new Set();
+        while (queue.length > 0) {
+          const name = queue.shift();
+          if (seen.has(name)) continue;
+          seen.add(name);
+          const source = await networkClient.getProgram(name);
+          imports[name] = source;
+          const importNames = Program.fromString(source).getImports();
+          for (const dep of importNames) {
+            if (dep && !seen.has(dep)) queue.push(dep);
+          }
+        }
+      }
+      const tx = await buildExecutionTx({
+        programName: txOptions.programName,
+        functionName: txOptions.functionName,
+        inputs: txOptions.inputs,
+        privateFee: txOptions.privateFee,
+        imports
+      });
+      return JSON.parse(tx.toString());
+    },
+    execute: async (execOptions) => {
+      const tx = await buildExecutionTx({
+        programName: execOptions.programName,
+        functionName: execOptions.functionName,
+        inputs: execOptions.inputs,
+        privateFee: execOptions.privateFee,
+        imports: execOptions.programImports
+      });
+      const txId = await publicClient.request({
+        method: "sendTransaction",
+        params: { transaction: tx.toString() }
+      });
+      const confirmedTx = await waitForConfirmation(publicClient, txId);
+      const accountViewKey = StaticViewKey.from_string(account.viewKey);
+      const decryptor = (ciphertext) => {
+        const ct = StaticRecordCiphertext.fromString(ciphertext);
+        return ct.isOwner(accountViewKey) ? ct.decrypt(accountViewKey).toString() : ciphertext;
+      };
+      const { transitions, outputs } = extractTransitions(confirmedTx, decryptor);
+      return { transactionId: txId, transitions, outputs };
+    }
+  };
+  const walletClient = createWalletClient({ account, transport, proving });
+  return { publicClient, walletClient, account };
+}
+export {
+  BLS12377HDKey,
+  DEVNODE_ADDR,
+  DEVNODE_PRIVATE_KEY,
+  LEGACY_PATH,
+  STANDARD_PATH,
+  createDevnodeClient,
+  generateAccount,
+  generateMnemonic2 as generateMnemonic,
+  loadNetwork,
+  mnemonicToHDKey,
+  mnemonicToSeed,
+  validateMnemonic2 as validateMnemonic,
+  validateWord
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/mnemonic.ts"],"sourcesContent":["/**\n * @provablehq/veil-aleo-sdk\n *\n * Loads `@provablehq/sdk` for a specific Aleo network and exposes the SDK's\n * functionality bound to that network's setup parameters.\n *\n * Usage:\n *   import { loadNetwork } from '@provablehq/veil-aleo-sdk'\n *   import { http } from '@provablehq/veil-core'\n *\n *   const aleo = await loadNetwork('mainnet')\n *\n *   const account = aleo.privateKeyToAccount('APrivateKey1...')\n *   const { publicClient, walletClient } = aleo.createAleoClient({\n *     privateKey: 'APrivateKey1...',\n *     networkUrl: 'https://api.provable.com/v2',\n *   })\n *\n * Switching networks: load a new handle. Existing accounts remain valid —\n * Aleo private keys, view keys, and addresses are network-agnostic.\n */\n\nimport { loadNetwork as loadSdk } from '@provablehq/sdk/dynamic.js'\nimport {\n  Account,\n  AleoKeyProvider,\n  Program,\n  ProgramManager,\n  RecordCiphertext as StaticRecordCiphertext,\n  ViewKey as StaticViewKey,\n  getOrInitConsensusVersionTestHeights,\n} from '@provablehq/sdk'\nimport { DEVNODE_PRIVATE_KEY, DEVNODE_ADDR } from '@provablehq/veil-aleo-devnode'\nexport { DEVNODE_PRIVATE_KEY, DEVNODE_ADDR }\nimport type { LocalAccount } from '@provablehq/veil-core'\nimport type { ProvingConfig, BuildTransactionOptions, BuildDeploymentOptions, SimulateOptions, ExecuteOptions, RawSimulateResult, RawExecuteResult } from '@provablehq/veil-core'\nimport type { OwnedRecord, RecordProvider, StandaloneRecordScanner, RequestRecordsParameters } from '@provablehq/veil-core'\nimport type { Network, PublicClient, WalletClient } from '@provablehq/veil-core'\nimport {\n  createPublicClient,\n  createWalletClient,\n  http,\n  BaseError,\n  ProvingError,\n  ConfigurationError,\n  classifyBroadcastError,\n  classifyProvingError,\n  waitForConfirmation,\n  extractTransitions,\n} from '@provablehq/veil-core'\nimport type { Decryptor } from '@provablehq/veil-core'\nimport { generateMnemonic, mnemonicToHDKey, type AleoDerivationId } from './mnemonic.js'\n\nexport {\n  BLS12377HDKey,\n  generateMnemonic,\n  validateMnemonic,\n  validateWord,\n  mnemonicToSeed,\n  mnemonicToHDKey,\n  STANDARD_PATH,\n  LEGACY_PATH,\n  type AleoDerivationId,\n} from './mnemonic.js'\n\n/** Networks supported by `@provablehq/sdk/dynamic.js`. */\nexport type SupportedNetwork = 'mainnet' | 'testnet'\n\n// `loadSdk('testnet')` and `loadSdk('mainnet')` return modules whose runtime\n// classes have the same shape. The narrowed-to-testnet type is used as the\n// canonical handle to avoid TS's union-of-modules confusion.\ntype SdkModule = Awaited<ReturnType<typeof loadSdk<'testnet'>>>\n\n/**\n * A network-bound SDK handle. All functions on this handle use the binary\n * set loaded for the named network.\n *\n * Most key/account operations (`privateKeyToAccount`, `mnemonicToAccount`,\n * `generateAccount`, `decryptRecord`, `verifySignature`) are mathematically\n * network-agnostic — the same private key (or mnemonic) derives the same\n * address and view key regardless of which network's binary was loaded.\n * Proving and program operations (`createProvingConfig`, `createAleoClient`,\n * scanners) are network-bound.\n */\nexport interface AleoSdk {\n  /** The network this handle is bound to. */\n  readonly network: SupportedNetwork\n\n  /** Creates a `LocalAccount` from an Aleo private key. */\n  privateKeyToAccount(privateKey: string): LocalAccount<'privateKey'>\n\n  /**\n   * Creates a `LocalAccount` from a BIP39 mnemonic phrase using Aleo's\n   * BLS12-377 HD derivation (matches Shield wallet derivation).\n   *\n   * Defaults to the SLIP-0044 Aleo coin type path `m/44'/683'`, account\n   * index 0. Pass `derivation: 'legacy'` to use the pre-registration path\n   * `m/44'/0'` for compatibility with older wallets.\n   */\n  mnemonicToAccount(\n    mnemonic: string,\n    options?: { index?: number; derivation?: AleoDerivationId },\n  ): LocalAccount<'mnemonic'>\n\n  /**\n   * Generates a fresh BIP39 mnemonic and derives its Aleo account in one call.\n   * Pure and local — no network access. The caller MUST persist the returned\n   * mnemonic; it is the only way to re-derive the account.\n   *\n   * @param options.strength Entropy bits: 128 (12 words, default) or 256 (24 words).\n   * @param options.index Account index on the derivation path. Defaults to 0.\n   * @param options.derivation Derivation path id. Defaults to `'standard'`\n   *   (`m/44'/683'`); pass `'legacy'` for pre-registration `m/44'/0'` wallets.\n   * @returns The generated mnemonic and the account derived from it.\n   *\n   * @example\n   * const { mnemonic, account } = aleo.generateMnemonicAccount()\n   * // store `mnemonic` safely; `account.address` is ready to use\n   */\n  generateMnemonicAccount(options?: {\n    strength?: 128 | 256\n    index?: number\n    derivation?: AleoDerivationId\n  }): { mnemonic: string; account: LocalAccount<'mnemonic'> }\n\n  /** Creates a new random Aleo account. */\n  generateAccount(): LocalAccount<'privateKey'>\n\n  /** Decrypts a record ciphertext using a view key. */\n  decryptRecord(viewKey: string, ciphertext: string): string\n\n  /** Verifies a signature against a message and address. */\n  verifySignature(address: string, message: Uint8Array, signature: string): boolean\n\n  /** Creates an `AleoNetworkClient` for direct SDK access. */\n  createNetworkClient(url: string): InstanceType<SdkModule['AleoNetworkClient']>\n\n  /** Creates a `ProvingConfig` for `createWalletClient({ proving })`. */\n  createProvingConfig(options: {\n    mode: 'delegated' | 'local'\n    networkUrl: string\n    proverUrl?: string\n    apiKey?: string\n    consumerId?: string\n    account?: LocalAccount<'privateKey'>\n    confirmationTimeout?: number\n  }): ProvingConfig\n\n  /**\n   * Creates a record scanner backed by Provable's Record Scanner Service.\n   *\n   * The first `requestRecords` call registers the account's view key with the\n   * service (a network round-trip) to obtain the UUID scanning requires;\n   * subsequent calls reuse it. `setAccount` resets the registration.\n   *\n   * The provider implements `switchNetwork`, so a wallet client carrying it\n   * re-targets record scanning when `switchChain` runs — the scanner rebuilds\n   * against the new network and re-registers lazily on the next scan.\n   *\n   * @param options.url Base URL of the service (the SDK appends the network\n   *   segment — do not include it).\n   * @param options.consumerId Consumer id used for JWT refresh.\n   * @param options.apiKey Optional API key for the authenticated service\n   *   (e.g. the hosted Provable RSS). Omit for an open/unauthenticated service.\n   * @param options.startBlock Optional block height to begin scanning from at\n   *   registration. Defaults to 0 (full history).\n   */\n  createRemoteScanner(options: {\n    url: string\n    consumerId: string\n    apiKey?: string\n    startBlock?: number\n  }): RecordProvider\n\n  /**\n   * Creates a standalone record scanner with an explicit view key.\n   *\n   * Like {@link createRemoteScanner}, the first `requestRecords` registers the\n   * view key with the service (a network round-trip) to obtain the scanning UUID.\n   *\n   * @param options.url Base URL of the service (the SDK appends the network segment).\n   * @param options.consumerId Consumer id used for JWT refresh.\n   * @param options.viewKey The view key (`AViewKey1…`) to scan and decrypt with.\n   * @param options.apiKey Optional API key for the authenticated service. Omit\n   *   for an open/unauthenticated service.\n   * @param options.startBlock Optional block height to begin scanning from at\n   *   registration. Defaults to 0 (full history).\n   */\n  createStandaloneScanner(options: {\n    url: string\n    consumerId: string\n    viewKey: string\n    apiKey?: string\n    startBlock?: number\n  }): StandaloneRecordScanner\n\n  /** Creates a fully-wired Aleo client from a private key and network URL. */\n  createAleoClient(options: {\n    privateKey: string\n    networkUrl: string\n    provingMode?: 'delegated' | 'local'\n    proverUrl?: string\n    apiKey?: string\n    consumerId?: string\n    /**\n     * Record provider for `requestRecords`. Not wired by default — pass\n     * `aleo.createRemoteScanner(...)` or any\n     * custom `RecordProvider`. `requestRecords` throws with a setup hint\n     * when no provider is configured.\n     */\n    records?: RecordProvider\n  }): { publicClient: PublicClient; walletClient: WalletClient; account: LocalAccount<'privateKey'> }\n}\n\n/**\n * Loads `@provablehq/sdk` for the named network and returns a network-bound\n * handle. The SDK module cache memoizes the load — calling twice for the\n * same network returns the same binary set without re-instantiating.\n */\nexport async function loadNetwork(name: SupportedNetwork): Promise<AleoSdk> {\n  const sdk = (await loadSdk(name)) as SdkModule\n  return buildSdk(name, sdk)\n}\n\nfunction buildSdk(initialNetwork: SupportedNetwork, initialSdk: SdkModule): AleoSdk {\n  // Mutable handle so `createProvingConfig().switchNetwork()` can swap the\n  // underlying binary set without rebuilding the wallet client.\n  let currentSdk: SdkModule = initialSdk\n  const network = initialNetwork\n  const {\n    Account,\n    PrivateKey,\n    Signature,\n    Address,\n    ViewKey,\n    AleoNetworkClient,\n    RecordScanner,\n    RecordCiphertext,\n  } = initialSdk\n\n\n\n  function mnemonicToAccount(\n    mnemonic: string,\n    options?: { index?: number; derivation?: AleoDerivationId },\n  ): LocalAccount<'mnemonic'> {\n    const hd = mnemonicToHDKey(mnemonic, options)\n    // wasm-bindgen exports the snake_case name; it is not a typo.\n    const privateKey = (PrivateKey as unknown as {\n      from_seed_unchecked: (seed: Uint8Array) => InstanceType<SdkModule['PrivateKey']>\n    }).from_seed_unchecked(hd.key).to_string()\n    return { ...privateKeyToAccount(privateKey), source: 'mnemonic' }\n  }\n\n  function generateMnemonicAccount(options?: {\n    strength?: 128 | 256\n    index?: number\n    derivation?: AleoDerivationId\n  }): { mnemonic: string; account: LocalAccount<'mnemonic'> } {\n    const mnemonic = generateMnemonic(options?.strength ?? 128)\n    const { strength: _strength, ...derivationOptions } = options ?? {}\n    return { mnemonic, account: mnemonicToAccount(mnemonic, derivationOptions) }\n  }\n\n  function generateAccount(): LocalAccount<'privateKey'> {\n    const sdkAccount = new Account()\n    return privateKeyToAccount(sdkAccount.privateKey().to_string())\n  }\n\n  function decryptRecord(viewKeyString: string, ciphertext: string): string {\n    return ViewKey.from_string(viewKeyString).decrypt(ciphertext)\n  }\n\n  function verifySignature(\n    addressString: string,\n    message: Uint8Array,\n    signatureString: string,\n  ): boolean {\n    const sig = Signature.from_string(signatureString)\n    const addr = Address.from_string(addressString)\n    return sig.verify(addr, message)\n  }\n\n  function createNetworkClient(url: string): InstanceType<SdkModule['AleoNetworkClient']> {\n    return new AleoNetworkClient(url)\n  }\n\n  function createProvingConfig(options: {\n    mode: 'delegated' | 'local'\n    networkUrl: string\n    proverUrl?: string\n    apiKey?: string\n    consumerId?: string\n    account?: LocalAccount<'privateKey'>\n    /** Timeout in ms for waiting for transaction confirmation (default: 300_000 = 5 min) */\n    confirmationTimeout?: number\n  }): ProvingConfig {\n    // Each call reads from currentSdk so switchNetwork can swap the binary set\n    // without rebuilding the wallet client.\n    let networkUrl = options.networkUrl\n    let keyProvider = new currentSdk.AleoKeyProvider()\n    keyProvider.useCache(true)\n\n    return {\n      mode: options.mode,\n      url: options.proverUrl,\n\n      buildTransaction: async (txOptions: BuildTransactionOptions) => {\n        const programManager = new currentSdk.ProgramManager(\n          networkUrl,\n          keyProvider,\n          undefined,\n        )\n\n        if (options.account) {\n          const sdkAccount = new currentSdk.Account({ privateKey: options.account.privateKey })\n          programManager.setAccount(sdkAccount)\n        }\n\n        // The user-facing API takes dynamic-dispatch import names (`string[]`);\n        // the SDK needs a name → source map covering BOTH the program's static\n        // imports (declared in the `import` block) and the user's dynamic ones.\n        // Auto-discover static imports first, then add the user-provided\n        // dynamic ones on top. The SDK's ProgramImports values can be string\n        // or Program; its return type is mirrored instead of reconstructed.\n        type SdkProgramImports = Awaited<\n          ReturnType<InstanceType<SdkModule['AleoNetworkClient']>['getProgramImports']>\n        >\n        let resolvedImports: SdkProgramImports | undefined\n        if (txOptions.imports && txOptions.imports.length > 0) {\n          const programSource = await programManager.networkClient.getProgram(txOptions.programName)\n          const staticImports = await programManager.networkClient.getProgramImports(programSource)\n          const merged: SdkProgramImports = { ...staticImports }\n          for (const name of txOptions.imports) {\n            merged[name] = await programManager.networkClient.getProgram(name)\n          }\n          resolvedImports = merged\n        }\n\n        const tx = await programManager.buildExecutionTransaction({\n          programName: txOptions.programName,\n          functionName: txOptions.functionName,\n          priorityFee: 0,\n          privateFee: txOptions.privateFee ?? false,\n          inputs: txOptions.inputs,\n          ...(resolvedImports ? { imports: resolvedImports } : {}),\n        })\n\n        return JSON.parse(tx.toString())\n      },\n\n      buildDeployment: async (deployOptions: BuildDeploymentOptions) => {\n        const programManager = new currentSdk.ProgramManager(\n          networkUrl,\n          keyProvider,\n          undefined,\n        )\n\n        if (options.account) {\n          const sdkAccount = new currentSdk.Account({ privateKey: options.account.privateKey })\n          programManager.setAccount(sdkAccount)\n        }\n\n        const tx = await programManager.buildDeploymentTransaction(\n          deployOptions.program,\n          0,\n          deployOptions.privateFee ?? false,\n        )\n\n        return JSON.parse(tx.toString())\n      },\n\n      simulate: async (simOptions: SimulateOptions): Promise<RawSimulateResult> => {\n        const programManager = new currentSdk.ProgramManager(networkUrl, keyProvider, undefined)\n        if (options.account) {\n          programManager.setAccount(new currentSdk.Account({ privateKey: options.account.privateKey }))\n        }\n\n        // Self-custody decryptor: same view-key-based decryptor as the execute path.\n        const accountViewKey = options.account ? ViewKey.from_string(options.account.viewKey) : undefined\n        const decryptor: Decryptor | undefined = accountViewKey\n          ? (ciphertext: string) => {\n              const ct = RecordCiphertext.fromString(ciphertext)\n              return ct.isOwner(accountViewKey) ? ct.decrypt(accountViewKey).toString() : null\n            }\n          : undefined\n\n        // `buildAuthorization` runs the function (with cross-program calls) and produces an\n        // Authorization whose transitions carry program/function metadata and the actual\n        // outputs — same structure a confirmed Transaction has, minus the proof.\n        const authorization = await programManager.buildAuthorization({\n          programName: simOptions.programName,\n          functionName: simOptions.functionName,\n          inputs: simOptions.inputs,\n          programSource: simOptions.programSource,\n          programImports: simOptions.programImports,\n        })\n\n        // Convert the wasm Transition objects into the wire-shaped tx that extractTransitions\n        // consumes. Private outputs come back from an Authorization as TVK-encrypted ciphertexts\n        // (Aleo's on-chain privacy model); decrypt with the caller's TVK first so plaintext\n        // values are visible. `transition.toString()` emits the same wire-format JSON the chain\n        // returns from `/transaction/confirmed/{id}` — Aleo-typed string values like '10u32',\n        // 'aleo1...', or 'record1...' under each output's `value`.\n        const tx = {\n          execution: {\n            transitions: authorization.transitions().map((t: any) => {\n              let source = t\n              if (accountViewKey) {\n                try {\n                  source = t.decryptTransition(t.tvk(accountViewKey))\n                } catch {\n                  // Foreign transition signed by another caller — leave outputs encrypted.\n                }\n              }\n              return JSON.parse(source.toString())\n            }),\n          },\n        }\n\n        const { transitions, outputs } = extractTransitions(tx, decryptor)\n        return { transitions, outputs }\n      },\n\n      execute: async (execOptions: ExecuteOptions): Promise<RawExecuteResult> => {\n        const programManager = new currentSdk.ProgramManager(networkUrl, keyProvider, undefined)\n        if (options.account) {\n          programManager.setAccount(new currentSdk.Account({ privateKey: options.account.privateKey }))\n        }\n\n        /** Convert microcredits (Veil API) to credits (SDK API) for priority fee */\n        const priorityFee = Number(execOptions.fee) / 1_000_000\n\n        /** Self-custody decryptor: use the local account's view key to decrypt owned record ciphertexts. */\n        const accountViewKey = options.account ? ViewKey.from_string(options.account.viewKey) : undefined\n        const decryptor: Decryptor | undefined = accountViewKey\n          ? (ciphertext: string) => {\n              const ct = RecordCiphertext.fromString(ciphertext)\n              return ct.isOwner(accountViewKey) ? ct.decrypt(accountViewKey).toString() : null\n            }\n          : undefined\n\n        /** Build a Veil publicClient bound to the current networkUrl for chain polling. */\n        const buildPollingClient = () =>\n          createPublicClient({ transport: http(networkUrl, { network: network as Network }) })\n\n        if (options.mode === 'delegated') {\n          if (!options.proverUrl) throw new ConfigurationError('Delegated execution requires proverUrl. Pass proverUrl to createProvingConfig or createAleoClient.')\n\n          let response: any\n          try {\n            const provingRequest = await programManager.provingRequest({\n              programName: execOptions.programName,\n              programSource: execOptions.programSource,\n              programImports: execOptions.programImports,\n              functionName: execOptions.functionName,\n              inputs: execOptions.inputs,\n              priorityFee,\n              privateFee: execOptions.privateFee ?? false,\n              broadcast: true,\n            })\n\n            const dpsClient = new AleoNetworkClient(options.proverUrl)\n            response = await dpsClient.submitProvingRequest({\n              provingRequest,\n              url: options.proverUrl,\n              apiKey: options.apiKey,\n              consumerId: options.consumerId,\n            })\n          } catch (e) {\n            if (e instanceof BaseError) throw e\n            throw classifyProvingError(e)\n          }\n\n          const txId = response.transaction?.id\n          if (!txId) throw new ConfigurationError('DPS response did not contain a transaction ID — check prover service configuration.')\n\n          const confirmedTx = await waitForConfirmation(buildPollingClient(), txId, options.confirmationTimeout)\n          const { transitions, outputs } = extractTransitions(confirmedTx, decryptor)\n          return { transactionId: txId, transitions, outputs }\n\n        } else {\n          let tx: any\n          try {\n            tx = await programManager.buildExecutionTransaction({\n              programName: execOptions.programName,\n              functionName: execOptions.functionName,\n              inputs: execOptions.inputs,\n              priorityFee,\n              privateFee: execOptions.privateFee ?? false,\n              program: execOptions.programSource,\n              imports: execOptions.programImports,\n            })\n          } catch (e) {\n            if (e instanceof BaseError) throw e\n            throw new ProvingError({ message: e instanceof Error ? e.message : String(e), cause: e as Error })\n          }\n\n          let txId: string\n          try {\n            const submitClient = new AleoNetworkClient(networkUrl)\n            submitClient.setVerboseErrors(false)\n            txId = await submitClient.submitTransaction(tx)\n          } catch (e) {\n            if (e instanceof BaseError) throw e\n            throw classifyBroadcastError(e)\n          }\n\n          const confirmedTx = await waitForConfirmation(buildPollingClient(), txId, options.confirmationTimeout)\n          const { transitions, outputs } = extractTransitions(confirmedTx, decryptor)\n          return { transactionId: txId, transitions, outputs }\n        }\n      },\n\n      decrypt: async (cipherText) => {\n        if (!options.account?.viewKey) {\n          throw new Error(\n            'decrypt requires an account with a viewKey on the proving config.',\n          )\n        }\n        return currentSdk.ViewKey.from_string(options.account.viewKey).decrypt(cipherText)\n      },\n\n      switchNetwork: async (newNetwork) => {\n        if (newNetwork !== 'mainnet' && newNetwork !== 'testnet') {\n          throw new Error(\n            `loadNetwork supports 'mainnet' or 'testnet' (received '${newNetwork}').`,\n          )\n        }\n        currentSdk = (await loadSdk(newNetwork as SupportedNetwork)) as SdkModule\n        keyProvider = new currentSdk.AleoKeyProvider()\n        keyProvider.useCache(true)\n      },\n    }\n  }\n\n  // The RSS returns record fields in snake_case (record_plaintext,\n  // program_name, …); the veil OwnedRecord contract is camelCase. Map them —\n  // a bare cast silently leaves recordPlaintext undefined, which reads as an\n  // unspendable wallet. Fields whose two casings coincide are read directly;\n  // the rest accept either case so a future camelCase SDK build keeps working.\n  // `uid` and `recordView` are privacy-wallet-adapter concepts the RSS does\n  // not supply, so they are intentionally omitted.\n  function toOwnedRecord(raw: Record<string, unknown>): OwnedRecord {\n    const pick = (snake: string, camel: string): unknown => raw[snake] ?? raw[camel]\n    return {\n      blockHeight: pick('block_height', 'blockHeight') as number | undefined,\n      blockTimestamp: pick('block_timestamp', 'blockTimestamp') as number | undefined,\n      commitment: raw.commitment as string | undefined,\n      functionName: pick('function_name', 'functionName') as string | undefined,\n      outputIndex: pick('output_index', 'outputIndex') as number | undefined,\n      owner: raw.owner as string | undefined,\n      programName: pick('program_name', 'programName') as string,\n      recordCiphertext: pick('record_ciphertext', 'recordCiphertext') as string | undefined,\n      recordName: pick('record_name', 'recordName') as string | undefined,\n      sender: raw.sender as string | undefined,\n      spent: raw.spent as boolean | undefined,\n      tag: raw.tag as string,\n      transactionId: pick('transaction_id', 'transactionId') as string | undefined,\n      transitionId: pick('transition_id', 'transitionId') as string | undefined,\n      transactionIndex: pick('transaction_index', 'transactionIndex') as number | undefined,\n      transitionIndex: pick('transition_index', 'transitionIndex') as number | undefined,\n      recordPlaintext: (pick('record_plaintext', 'recordPlaintext') as string | undefined) ?? '',\n    }\n  }\n\n  // A scanner's UUID is issued at registration; owned() rejects locally\n  // without one. Register once, lazily, and memoize the in-flight promise so\n  // concurrent scans share a single round-trip. Account or network changes\n  // replace the whole object (one registration per scanner build).\n  function makeRegisterOnce(startBlock: number) {\n    let registration: Promise<void> | undefined\n    return {\n      ensure(\n        scanner: InstanceType<SdkModule['RecordScanner']>,\n        viewKey: ReturnType<SdkModule['ViewKey']['from_string']>,\n      ): Promise<void> {\n        if (!registration) {\n          registration = (async () => {\n            const result = await scanner.registerEncrypted(viewKey, startBlock)\n            if (!result.ok) {\n              registration = undefined // allow a later retry after a transient failure\n              throw new Error(\n                `Record scanner registration failed (HTTP ${result.status}): ${result.error?.message ?? 'unknown error'}`,\n              )\n            }\n          })()\n        }\n        return registration\n      },\n    }\n  }\n\n  // Scans owned records with bounded retry. owned() returns a discriminated\n  // result on HTTP error but *throws* on a network failure or an invalidated\n  // UUID — both paths are retried here. A freshly-minted JWT can momentarily\n  // hit an RSS backend that has not yet synced the credential (HTTP 401), and\n  // the SDK caches that JWT for the scanner's lifetime — so between attempts it\n  // is dropped (setJwtData(undefined) forces a re-mint), backed off, and retried,\n  // giving the backend time to catch up. A non-transient status surfaces at once.\n  //\n  // 429/5xx are always transient; a 401/403 is only worth retrying when a JWT\n  // can actually be re-minted (apiKey configured) — on an unauthenticated\n  // scanner those are permanent, so retrying just burns backoff.\n  async function scanOwned(\n    scanner: InstanceType<SdkModule['RecordScanner']>,\n    program: string,\n    statusFilter: string | undefined,\n    canReMint: boolean,\n  ): Promise<OwnedRecord[]> {\n    const ALWAYS_RETRY = new Set([429, 500, 502, 503, 504])\n    const AUTH_RETRY = new Set([401, 403])\n    const retryable = (status: number) => ALWAYS_RETRY.has(status) || (canReMint && AUTH_RETRY.has(status))\n    const MAX_ATTEMPTS = 4\n    let last = ''\n    for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {\n      try {\n        const result = await scanner.owned({\n          unspent: statusFilter !== 'spent',\n          filter: { programs: [program] },\n        })\n        if (result.ok) return (result.data ?? []).map((r) => toOwnedRecord(r as Record<string, unknown>))\n        last = `HTTP ${result.status}: ${result.error?.message ?? 'unknown error'}`\n        if (!retryable(result.status)) break\n      } catch (err) {\n        // owned() throws (rather than returning a result) on a network failure\n        // or an invalidated UUID — treat as transient and retry.\n        last = err instanceof Error ? err.message : String(err)\n      }\n      if (attempt === MAX_ATTEMPTS - 1) break\n      scanner.setJwtData(undefined) // drop the cached (rejected) JWT so the next call re-mints\n      await new Promise((resolve) => setTimeout(resolve, 500 * 2 ** attempt))\n    }\n    throw new Error(`Record scan failed (${last})`)\n  }\n\n  function createRemoteScanner(options: {\n    url: string\n    consumerId: string\n    apiKey?: string\n    startBlock?: number\n  }): RecordProvider {\n    // The RecordScanner class is network-bound: a scanner built from a given\n    // SDK module scans that module's network. Network switching rebuilds the\n    // scanner (and the wasm view key) from the target network's module.\n    let scannerSdk: Pick<SdkModule, 'RecordScanner' | 'ViewKey'> = { RecordScanner, ViewKey }\n    let scanner: InstanceType<SdkModule['RecordScanner']> | undefined\n    let viewKey: ReturnType<SdkModule['ViewKey']['from_string']> | undefined\n    let viewKeyString: string | undefined\n    let registration = makeRegisterOnce(options.startBlock ?? 0)\n\n    function buildScanner() {\n      if (!viewKeyString) return // no active account yet — nothing to rebuild\n      viewKey = scannerSdk.ViewKey.from_string(viewKeyString)\n      scanner = new scannerSdk.RecordScanner({\n        url: options.url,\n        consumerId: options.consumerId,\n        ...(options.apiKey ? { apiKey: options.apiKey } : {}),\n        viewKeys: [viewKey],\n        decryptEnabled: true,\n        autoReRegister: true,\n      })\n      // Each build gets its own registration: view keys register per account\n      // AND per network, and the old promise stays bound to the scanner a\n      // concurrent scan may still hold.\n      registration = makeRegisterOnce(options.startBlock ?? 0)\n    }\n\n    return {\n      setAccount: (account: { viewKey: string }) => {\n        viewKeyString = account.viewKey\n        buildScanner()\n      },\n\n      requestRecords: async (params: RequestRecordsParameters): Promise<OwnedRecord[]> => {\n        if (!scanner) {\n          throw new Error('No active account set on record scanner. Call setAccount() first.')\n        }\n\n        // Pin this scan to the current build: a concurrent setAccount or\n        // switchNetwork swaps the closures, and mixing builds mid-scan would\n        // register one scanner and scan another.\n        const activeScanner = scanner\n        const activeViewKey = viewKey!\n        const activeRegistration = registration\n        await activeRegistration.ensure(activeScanner, activeViewKey)\n        return scanOwned(activeScanner, params.program, params.statusFilter, !!options.apiKey)\n      },\n\n      switchNetwork: async (newNetwork: string) => {\n        if (newNetwork !== 'mainnet' && newNetwork !== 'testnet') {\n          throw new Error(\n            `Record scanning supports 'mainnet' or 'testnet' (received '${newNetwork}').`,\n          )\n        }\n        scannerSdk = (await loadSdk(newNetwork as SupportedNetwork)) as SdkModule\n        buildScanner()\n      },\n    }\n  }\n\n  function createStandaloneScanner(options: {\n    url: string\n    consumerId: string\n    viewKey: string\n    apiKey?: string\n    startBlock?: number\n  }): StandaloneRecordScanner {\n    const viewKey = ViewKey.from_string(options.viewKey)\n    const scanner = new RecordScanner({\n      url: options.url,\n      consumerId: options.consumerId,\n      ...(options.apiKey ? { apiKey: options.apiKey } : {}),\n      viewKeys: [viewKey],\n      decryptEnabled: true,\n      autoReRegister: true,\n    })\n    const registration = makeRegisterOnce(options.startBlock ?? 0)\n\n    return {\n      requestRecords: async (params: RequestRecordsParameters): Promise<OwnedRecord[]> => {\n        await registration.ensure(scanner, viewKey)\n        return scanOwned(scanner, params.program, params.statusFilter, !!options.apiKey)\n      },\n    }\n  }\n\n  function createAleoClient(options: {\n    privateKey: string\n    networkUrl: string\n    provingMode?: 'delegated' | 'local'\n    proverUrl?: string\n    apiKey?: string\n    consumerId?: string\n    records?: RecordProvider\n  }): { publicClient: PublicClient; walletClient: WalletClient; account: LocalAccount<'privateKey'> } {\n    const account = privateKeyToAccount(options.privateKey)\n    const transport = http(options.networkUrl, { network: network as Network })\n\n    const proving = createProvingConfig({\n      mode: options.provingMode ?? 'delegated',\n      networkUrl: options.networkUrl,\n      proverUrl: options.proverUrl,\n      apiKey: options.apiKey,\n      consumerId: options.consumerId,\n      account,\n    })\n\n    const publicClient = createPublicClient({ transport })\n\n    if (options.records) {\n      options.records.setAccount({ viewKey: account.viewKey })\n    }\n\n    const walletClient = createWalletClient({\n      account,\n      transport,\n      proving,\n      ...(options.records ? { recordProvider: options.records } : {}),\n    })\n\n    return { publicClient, walletClient, account }\n  }\n\n  return {\n    network,\n    privateKeyToAccount,\n    mnemonicToAccount,\n    generateMnemonicAccount,\n    generateAccount,\n    decryptRecord,\n    verifySignature,\n    createNetworkClient,\n    createProvingConfig,\n    createRemoteScanner,\n    createStandaloneScanner,\n    createAleoClient,\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Standalone exports — synchronous helpers and devnode client factory.\n// These use the statically-imported SDK (testnet binaries) so they work\n// without an awaited loadNetwork() call.\n// ---------------------------------------------------------------------------\n\n// Consensus version activation heights the WASM layer assumes when building\n// devnode transactions. MUST mirror the CONSENSUS_VERSION_HEIGHTS default that\n// @provablehq/veil-aleo-devnode passes to the aleo-devnode process, so the transaction builder\n// and the node agree on which consensus version is active at each height. The\n// entry count must also equal the WASM SDK's consensus-version count exactly —\n// a shorter list panics with an opaque `unreachable` inside the WASM.\nconst DEVNODE_CONSENSUS_HEIGHTS = '0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16'\n\nfunction privateKeyToAccount(privateKey: string): LocalAccount<'privateKey'> {\n  const sdkAccount = new Account({ privateKey })\n  const address = sdkAccount.address().to_string()\n  const viewKey = sdkAccount.viewKey().to_string()\n\n  const signFn = async (message: Uint8Array): Promise<Uint8Array> => {\n    const sig = sdkAccount.sign(message)\n    return new TextEncoder().encode(sig.to_string())\n  }\n\n  return {\n    type: 'local',\n    source: 'privateKey',\n    address,\n    privateKey,\n    viewKey,\n    sign: signFn,\n    signMessage: signFn,\n  }\n}\n\n/** Creates a new random Aleo account (uses static SDK binaries). */\nexport function generateAccount(): LocalAccount<'privateKey'> {\n  const sdkAccount = new Account()\n  return privateKeyToAccount(sdkAccount.privateKey().to_string())\n}\n\n/**\n * Creates a fully-wired client pair pointing at a local Aleo Devnode instance.\n *\n * Devnode is a lightweight local Aleo node (similar to Foundry's Anvil) that\n * bypasses consensus and skips ZK proof generation, enabling rapid program iteration.\n * The seeded account is pre-funded; both key and socket address can be overridden.\n *\n * The returned wallet client supports `executeContract`. Its confirmation wait\n * resolves once the devnode includes the transaction in a block — automatic\n * after broadcast by default; under `manualBlockCreation` the caller must\n * advance blocks (e.g. a test client's `advanceBlock`) while the call is\n * pending. Record outputs owned by the client's account are decrypted to\n * plaintext in the result; foreign records are dropped.\n *\n * @example\n * ```ts\n * // Zero-config — uses seeded key and localhost:3030\n * const { publicClient, walletClient, account } = createDevnodeClient()\n *\n * // Custom key or socket address\n * const { publicClient, walletClient, account } = createDevnodeClient({\n *   privateKey: 'APrivateKey1...',\n *   socketAddr: '127.0.0.1:4040',\n * })\n * ```\n */\nexport function createDevnodeClient(options?: {\n  privateKey?: string\n  /** Socket address of the devnode, e.g. \"127.0.0.1:3030\" */\n  socketAddr?: string\n}): { publicClient: PublicClient; walletClient: WalletClient; account: LocalAccount<'privateKey'> } {\n  const url = `http://${options?.socketAddr ?? DEVNODE_ADDR}`\n  const account = privateKeyToAccount(options?.privateKey ?? DEVNODE_PRIVATE_KEY)\n  const sdkAccount = new Account({ privateKey: account.privateKey })\n  const transport = http(url, { network: 'testnet' })\n\n  const keyProvider = new AleoKeyProvider()\n  keyProvider.useCache(true)\n\n  // Initialize the wasm consensus heights before any wasm build or parse call\n  // this client makes. Idempotent get-or-init: safe to call per client.\n  getOrInitConsensusVersionTestHeights(DEVNODE_CONSENSUS_HEIGHTS)\n\n  // Created before the proving config so `execute` can broadcast and poll\n  // through the same transport-backed client the caller receives.\n  const publicClient = createPublicClient({ transport })\n\n  /**\n   * Builds an unproven devnode execution transaction. `imports` must already\n   * map program id → source; resolution of dynamic-dispatch import names\n   * happens in `buildTransaction`, not here. Priority fees are always 0 on\n   * the devnode path — a caller-supplied fee is ignored.\n   */\n  const buildExecutionTx = async (opts: {\n    programName: string\n    functionName: string\n    inputs: string[]\n    privateFee?: boolean | undefined\n    imports?: Record<string, string> | undefined\n  }) => {\n    const programManager = new ProgramManager(url, keyProvider, undefined)\n    programManager.setAccount(sdkAccount)\n    return programManager.buildDevnodeExecutionTransaction({\n      programName: opts.programName,\n      functionName: opts.functionName,\n      priorityFee: 0,\n      privateFee: opts.privateFee ?? false,\n      inputs: opts.inputs,\n      ...(opts.imports ? { imports: opts.imports } : {}),\n    })\n  }\n\n  const proving: ProvingConfig = {\n    mode: 'devnode',\n    buildDeployment: async (deployOptions: BuildDeploymentOptions) => {\n      const programManager = new ProgramManager(url, keyProvider, undefined)\n      programManager.setAccount(sdkAccount)\n      const tx = await programManager.buildDevnodeDeploymentTransaction({\n        program: deployOptions.program,\n        priorityFee: 0,\n        privateFee: deployOptions.privateFee ?? false,\n      })\n      return JSON.parse(tx.toString())\n    },\n    buildTransaction: async (txOptions: BuildTransactionOptions) => {\n      // Fetch program sources for any call.dynamic targets the caller declared,\n      // and recursively include their static imports as well.\n      // Use direct REST calls instead of the SDK network client to avoid the\n      // /latest_edition endpoint which returns 500 on the devnode.\n      let imports: Record<string, string> | undefined\n      if (txOptions.imports && txOptions.imports.length > 0) {\n        const networkClient = new ProgramManager(url, keyProvider, undefined).networkClient\n        imports = {}\n        const queue = [...txOptions.imports]\n        const seen = new Set<string>()\n        while (queue.length > 0) {\n          const name = queue.shift()!\n          if (seen.has(name)) continue\n          seen.add(name)\n          const source = await networkClient.getProgram(name); // automatically throws.\n          imports[name] = source;\n          const importNames = Program.fromString(source).getImports(); // Invoke `wasm` to avoid regex.\n          for (const dep of importNames) {\n            if (dep && !seen.has(dep)) queue.push(dep)\n          }\n        }\n      }\n\n      const tx = await buildExecutionTx({\n        programName: txOptions.programName,\n        functionName: txOptions.functionName,\n        inputs: txOptions.inputs,\n        privateFee: txOptions.privateFee,\n        imports,\n      })\n      return JSON.parse(tx.toString())\n    },\n    execute: async (execOptions: ExecuteOptions): Promise<RawExecuteResult> => {\n      const tx = await buildExecutionTx({\n        programName: execOptions.programName,\n        functionName: execOptions.functionName,\n        inputs: execOptions.inputs,\n        privateFee: execOptions.privateFee,\n        imports: execOptions.programImports,\n      })\n\n      // Broadcast through the same transport-backed request writeContract uses.\n      const txId = (await publicClient.request({\n        method: 'sendTransaction',\n        params: { transaction: tx.toString() },\n      })) as string\n\n      // The devnode auto-produces a block after broadcast by default; under\n      // manualBlockCreation the caller must advance blocks for this to resolve.\n      const confirmedTx = await waitForConfirmation(publicClient, txId)\n\n      // Self-custody decryptor: records owned by the devnode account surface\n      // as plaintext; records owned by someone else (e.g. a compliance record\n      // minted to an authority) pass through as ciphertext rather than being\n      // dropped, so the outputs keep their transition positions — positional\n      // consumers like the generated contract bindings depend on that.\n      const accountViewKey = StaticViewKey.from_string(account.viewKey)\n      const decryptor: Decryptor = (ciphertext: string) => {\n        const ct = StaticRecordCiphertext.fromString(ciphertext)\n        return ct.isOwner(accountViewKey) ? ct.decrypt(accountViewKey).toString() : ciphertext\n      }\n      const { transitions, outputs } = extractTransitions(confirmedTx, decryptor)\n      return { transactionId: txId, transitions, outputs }\n    },\n  }\n\n  const walletClient = createWalletClient({ account, transport, proving })\n\n  return { publicClient, walletClient, account }\n}\n","import { hmac } from '@noble/hashes/hmac'\nimport { sha512 } from '@noble/hashes/sha512'\nimport * as bip39 from '@scure/bip39'\nimport { wordlist } from '@scure/bip39/wordlists/english'\n\nconst HARDENED_OFFSET = 0x80000000\n\n// Aleo-specific HMAC key for HD master derivation (parallel to BIP32's\n// \"Bitcoin seed\", but for BLS12-377). Matches shield-core.\nconst BLS12_377_CURVE = 'bls12_377 seed'\n\nconst PATH_REGEX = /^m(\\/[0-9]+')+$/\n\n/**\n * Names the derivation-path convention used to turn a seed into Aleo keys.\n *\n * `'standard'` uses the SLIP-0044-registered Aleo coin type (`m/44'/683'`);\n * `'legacy'` uses the pre-registration path (`m/44'/0'`) some older wallets\n * chose. Pick `'legacy'` only to recover accounts created by such a wallet.\n */\nexport type AleoDerivationId = 'standard' | 'legacy'\n\n/** SLIP-0044 registered Aleo coin type. */\nexport const STANDARD_PATH = \"m/44'/683'\"\n\n/** Pre-SLIP-0044-registration derivation path. Some older wallets used this. */\nexport const LEGACY_PATH = \"m/44'/0'\"\n\n/** Maps each {@link AleoDerivationId} to its account-level derivation path. */\nexport const DERIVATION_PATHS: Record<AleoDerivationId, string> = {\n  standard: STANDARD_PATH,\n  legacy: LEGACY_PATH,\n}\n\ninterface IKeys {\n  key: Uint8Array\n  chainCode: Uint8Array\n}\n\nfunction uint32BE(n: number): Uint8Array {\n  if (!Number.isInteger(n) || n < 0 || n > 0xffffffff) {\n    throw new Error(`uint32BE: value out of range (got ${n})`)\n  }\n  const out = new Uint8Array(4)\n  new DataView(out.buffer).setUint32(0, n, false)\n  return out\n}\n\nfunction concatBytes(...parts: Uint8Array[]): Uint8Array {\n  const total = parts.reduce((sum, p) => sum + p.length, 0)\n  const out = new Uint8Array(total)\n  let offset = 0\n  for (const p of parts) {\n    out.set(p, offset)\n    offset += p.length\n  }\n  return out\n}\n\nfunction ckdPriv({ key, chainCode }: IKeys, index: number): IKeys {\n  const data = concatBytes(new Uint8Array([0]), key, uint32BE(index))\n  const I = hmac(sha512, chainCode, data)\n  return { key: I.slice(0, 32), chainCode: I.slice(32) }\n}\n\nfunction getMasterKeyFromSeed(seed: Uint8Array): IKeys {\n  const I = hmac(sha512, BLS12_377_CURVE, seed)\n  return { key: I.slice(0, 32), chainCode: I.slice(32) }\n}\n\nfunction isValidPath(path: string): boolean {\n  if (!PATH_REGEX.test(path)) return false\n  return path\n    .split('/')\n    .slice(1)\n    .map((s) => s.replace(\"'\", ''))\n    .every((s) => Number.isFinite(Number(s)))\n}\n\n/**\n * Hierarchical-deterministic key node for the BLS12-377 curve Aleo uses.\n *\n * Follows the SLIP-0010 construction (HMAC-SHA512 chains, hardened-only\n * derivation) with an Aleo-specific master key tag, matching shield-core.\n * All operations are pure and local — nothing touches the network. Start\n * from {@link BLS12377HDKey.fromMasterSeed} (or {@link mnemonicToHDKey})\n * rather than the constructor; the 32-byte `key` of a derived node is the\n * seed for an Aleo private key.\n */\nexport class BLS12377HDKey {\n  /**\n   * Wraps raw node material. Callers normally use\n   * {@link BLS12377HDKey.fromMasterSeed} instead of constructing directly.\n   *\n   * @param key 32-byte private key material of this node.\n   * @param chainCode 32-byte chain code used to derive children.\n   */\n  constructor(\n    public readonly key: Uint8Array,\n    public readonly chainCode: Uint8Array,\n  ) {}\n\n  /**\n   * Derives the master node from a BIP-39 seed. Pure and local.\n   *\n   * @param seed Seed bytes, typically the 64-byte output of\n   *   {@link mnemonicToSeed}.\n   * @returns The root node from which paths are derived.\n   */\n  static fromMasterSeed(seed: Uint8Array): BLS12377HDKey {\n    const master = getMasterKeyFromSeed(seed)\n    return new BLS12377HDKey(master.key, master.chainCode)\n  }\n\n  /**\n   * Derives the descendant node at a hardened path. Pure and local.\n   *\n   * @param path Path of the form `m/44'/683'` — every segment MUST be\n   *   hardened (trailing `'`) and below 2^31.\n   * @returns A new node; this node is unchanged.\n   * @throws If the path is malformed, contains a non-hardened segment, or a\n   *   segment is out of range.\n   */\n  derive(path: string): BLS12377HDKey {\n    if (!isValidPath(path)) {\n      throw new Error(\n        `Invalid derivation path: ${path} (must match m/N'/N'/... — hardened only)`,\n      )\n    }\n    const segments = path\n      .split('/')\n      .slice(1)\n      .map((s) => parseInt(s.replace(\"'\", ''), 10))\n\n    for (const seg of segments) {\n      if (seg >= HARDENED_OFFSET) {\n        throw new Error(\n          `Derivation path segment out of range: ${seg} (must be < 2³¹)`,\n        )\n      }\n    }\n\n    const result = segments.reduce(\n      (acc, segment) => ckdPriv(acc, segment + HARDENED_OFFSET),\n      { key: this.key, chainCode: this.chainCode } as IKeys,\n    )\n    return new BLS12377HDKey(result.key, result.chainCode)\n  }\n\n  /** Alias for {@link BLS12377HDKey.derive}, kept for HD-key API parity. */\n  derivePath(path: string): BLS12377HDKey {\n    return this.derive(path)\n  }\n\n  /**\n   * Derives the account node at `m/{index}'/0'` relative to this node. Pure\n   * and local. Applied to a {@link DERIVATION_PATHS} node, this yields the\n   * account at that index.\n   *\n   * @param index Zero-based account index, below 2^31; hardening is applied\n   *   internally.\n   * @returns The account-level node.\n   * @throws If the index is negative, fractional, or 2^31 or greater.\n   */\n  deriveChild(index: number): BLS12377HDKey {\n    if (!Number.isInteger(index) || index < 0 || index >= HARDENED_OFFSET) {\n      throw new Error(\n        `Invalid child index: ${index} (must be integer in [0, 2³¹))`,\n      )\n    }\n    return this.derive(`m/${index}'/0'`)\n  }\n}\n\n/**\n * Generates a fresh BIP-39 mnemonic from the English wordlist.\n *\n * Draws entropy from the platform CSPRNG; no network access. The phrase is\n * the root secret for every account derived from it — the caller MUST store\n * it securely and never log it.\n *\n * @param strength Entropy in bits: 128 yields 12 words, 256 yields 24.\n *   Defaults to 128.\n * @returns A space-separated mnemonic phrase.\n *\n * @example\n * import { generateMnemonic, mnemonicToHDKey } from '@provablehq/veil-aleo-sdk'\n *\n * const mnemonic = generateMnemonic()\n * const account0 = mnemonicToHDKey(mnemonic)\n */\nexport function generateMnemonic(strength: 128 | 256 = 128): string {\n  return bip39.generateMnemonic(wordlist, strength)\n}\n\n/**\n * Checks a full mnemonic phrase against BIP-39: English wordlist membership,\n * word count, and checksum. Pure and local.\n *\n * @param mnemonic Space-separated candidate phrase.\n * @returns True only if the phrase can be used for key derivation; a single\n *   wrong or reordered word fails the checksum.\n */\nexport function validateMnemonic(mnemonic: string): boolean {\n  return bip39.validateMnemonic(mnemonic, wordlist)\n}\n\n/**\n * Checks whether a single word belongs to the English BIP-39 wordlist. Pure\n * and local. Use for per-word feedback while a phrase is being typed;\n * validating the complete phrase still requires {@link validateMnemonic}.\n *\n * @param word Candidate word, lowercase.\n * @returns True if the word is one of the 2048 list entries.\n */\nexport function validateWord(word: string): boolean {\n  return wordlist.includes(word)\n}\n\n/**\n * Converts a mnemonic to its 64-byte BIP-39 seed via PBKDF2-HMAC-SHA512 with\n * an empty passphrase. Pure, local, and deterministic.\n *\n * The mnemonic is not validated here — call {@link validateMnemonic} first;\n * an invalid phrase still produces a seed, only for the wrong accounts.\n *\n * @param mnemonic Space-separated BIP-39 phrase.\n * @returns Seed bytes for {@link BLS12377HDKey.fromMasterSeed}.\n */\nexport function mnemonicToSeed(mnemonic: string): Uint8Array {\n  return bip39.mnemonicToSeedSync(mnemonic)\n}\n\n/**\n * Derives the Aleo account key at the given index from a mnemonic in one\n * step: seed, master node, derivation path, account child. Pure and local.\n * This is the usual entry point for turning a stored phrase into key\n * material.\n *\n * @param mnemonic Space-separated BIP-39 phrase.\n * @param options.index Zero-based account index, below 2^31. Defaults to 0.\n * @param options.derivation Path convention. Defaults to `'standard'`\n *   (`m/44'/683'`); pass `'legacy'` to recover accounts from wallets that\n *   predate the SLIP-0044 registration.\n * @returns The account node; its `key` bytes seed the Aleo private key.\n * @throws If the index is out of range.\n *\n * @example\n * import { mnemonicToHDKey } from '@provablehq/veil-aleo-sdk'\n *\n * const hdKey = mnemonicToHDKey(mnemonic, { index: 1 })\n */\nexport function mnemonicToHDKey(\n  mnemonic: string,\n  options: { index?: number; derivation?: AleoDerivationId } = {},\n): BLS12377HDKey {\n  const { index = 0, derivation = 'standard' } = options\n  const seed = mnemonicToSeed(mnemonic)\n  return BLS12377HDKey.fromMasterSeed(seed)\n    .derivePath(DERIVATION_PATHS[derivation])\n    .deriveChild(index)\n}\n"],"mappings":";AAsBA,SAAS,eAAe,eAAe;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,oBAAoB;AAAA,EACpB,WAAW;AAAA,EACX;AAAA,OACK;AACP,SAAS,qBAAqB,oBAAoB;AAMlD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACjDP,SAAS,YAAY;AACrB,SAAS,cAAc;AACvB,YAAY,WAAW;AACvB,SAAS,gBAAgB;AAEzB,IAAM,kBAAkB;AAIxB,IAAM,kBAAkB;AAExB,IAAM,aAAa;AAYZ,IAAM,gBAAgB;AAGtB,IAAM,cAAc;AAGpB,IAAM,mBAAqD;AAAA,EAChE,UAAU;AAAA,EACV,QAAQ;AACV;AAOA,SAAS,SAAS,GAAuB;AACvC,MAAI,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,KAAK,IAAI,YAAY;AACnD,UAAM,IAAI,MAAM,qCAAqC,CAAC,GAAG;AAAA,EAC3D;AACA,QAAM,MAAM,IAAI,WAAW,CAAC;AAC5B,MAAI,SAAS,IAAI,MAAM,EAAE,UAAU,GAAG,GAAG,KAAK;AAC9C,SAAO;AACT;AAEA,SAAS,eAAe,OAAiC;AACvD,QAAM,QAAQ,MAAM,OAAO,CAAC,KAAK,MAAM,MAAM,EAAE,QAAQ,CAAC;AACxD,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,SAAS;AACb,aAAW,KAAK,OAAO;AACrB,QAAI,IAAI,GAAG,MAAM;AACjB,cAAU,EAAE;AAAA,EACd;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,EAAE,KAAK,UAAU,GAAU,OAAsB;AAChE,QAAM,OAAO,YAAY,IAAI,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,KAAK,CAAC;AAClE,QAAM,IAAI,KAAK,QAAQ,WAAW,IAAI;AACtC,SAAO,EAAE,KAAK,EAAE,MAAM,GAAG,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,EAAE;AACvD;AAEA,SAAS,qBAAqB,MAAyB;AACrD,QAAM,IAAI,KAAK,QAAQ,iBAAiB,IAAI;AAC5C,SAAO,EAAE,KAAK,EAAE,MAAM,GAAG,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,EAAE;AACvD;AAEA,SAAS,YAAY,MAAuB;AAC1C,MAAI,CAAC,WAAW,KAAK,IAAI,EAAG,QAAO;AACnC,SAAO,KACJ,MAAM,GAAG,EACT,MAAM,CAAC,EACP,IAAI,CAAC,MAAM,EAAE,QAAQ,KAAK,EAAE,CAAC,EAC7B,MAAM,CAAC,MAAM,OAAO,SAAS,OAAO,CAAC,CAAC,CAAC;AAC5C;AAYO,IAAM,gBAAN,MAAM,eAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQzB,YACkB,KACA,WAChB;AAFgB;AACA;AAAA,EACf;AAAA,EAFe;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlB,OAAO,eAAe,MAAiC;AACrD,UAAM,SAAS,qBAAqB,IAAI;AACxC,WAAO,IAAI,eAAc,OAAO,KAAK,OAAO,SAAS;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAO,MAA6B;AAClC,QAAI,CAAC,YAAY,IAAI,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,4BAA4B,IAAI;AAAA,MAClC;AAAA,IACF;AACA,UAAM,WAAW,KACd,MAAM,GAAG,EACT,MAAM,CAAC,EACP,IAAI,CAAC,MAAM,SAAS,EAAE,QAAQ,KAAK,EAAE,GAAG,EAAE,CAAC;AAE9C,eAAW,OAAO,UAAU;AAC1B,UAAI,OAAO,iBAAiB;AAC1B,cAAM,IAAI;AAAA,UACR,yCAAyC,GAAG;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,SAAS;AAAA,MACtB,CAAC,KAAK,YAAY,QAAQ,KAAK,UAAU,eAAe;AAAA,MACxD,EAAE,KAAK,KAAK,KAAK,WAAW,KAAK,UAAU;AAAA,IAC7C;AACA,WAAO,IAAI,eAAc,OAAO,KAAK,OAAO,SAAS;AAAA,EACvD;AAAA;AAAA,EAGA,WAAW,MAA6B;AACtC,WAAO,KAAK,OAAO,IAAI;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,YAAY,OAA8B;AACxC,QAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,KAAK,SAAS,iBAAiB;AACrE,YAAM,IAAI;AAAA,QACR,wBAAwB,KAAK;AAAA,MAC/B;AAAA,IACF;AACA,WAAO,KAAK,OAAO,KAAK,KAAK,MAAM;AAAA,EACrC;AACF;AAmBO,SAASA,kBAAiB,WAAsB,KAAa;AAClE,SAAa,uBAAiB,UAAU,QAAQ;AAClD;AAUO,SAASC,kBAAiB,UAA2B;AAC1D,SAAa,uBAAiB,UAAU,QAAQ;AAClD;AAUO,SAAS,aAAa,MAAuB;AAClD,SAAO,SAAS,SAAS,IAAI;AAC/B;AAYO,SAAS,eAAe,UAA8B;AAC3D,SAAa,yBAAmB,QAAQ;AAC1C;AAqBO,SAAS,gBACd,UACA,UAA6D,CAAC,GAC/C;AACf,QAAM,EAAE,QAAQ,GAAG,aAAa,WAAW,IAAI;AAC/C,QAAM,OAAO,eAAe,QAAQ;AACpC,SAAO,cAAc,eAAe,IAAI,EACrC,WAAW,iBAAiB,UAAU,CAAC,EACvC,YAAY,KAAK;AACtB;;;AD1CA,eAAsB,YAAY,MAA0C;AAC1E,QAAM,MAAO,MAAM,QAAQ,IAAI;AAC/B,SAAO,SAAS,MAAM,GAAG;AAC3B;AAEA,SAAS,SAAS,gBAAkC,YAAgC;AAGlF,MAAI,aAAwB;AAC5B,QAAM,UAAU;AAChB,QAAM;AAAA,IACJ,SAAAC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAIJ,WAAS,kBACP,UACA,SAC0B;AAC1B,UAAM,KAAK,gBAAgB,UAAU,OAAO;AAE5C,UAAM,aAAc,WAEjB,oBAAoB,GAAG,GAAG,EAAE,UAAU;AACzC,WAAO,EAAE,GAAG,oBAAoB,UAAU,GAAG,QAAQ,WAAW;AAAA,EAClE;AAEA,WAAS,wBAAwB,SAI2B;AAC1D,UAAM,WAAWC,kBAAiB,SAAS,YAAY,GAAG;AAC1D,UAAM,EAAE,UAAU,WAAW,GAAG,kBAAkB,IAAI,WAAW,CAAC;AAClE,WAAO,EAAE,UAAU,SAAS,kBAAkB,UAAU,iBAAiB,EAAE;AAAA,EAC7E;AAEA,WAASC,mBAA8C;AACrD,UAAM,aAAa,IAAIF,SAAQ;AAC/B,WAAO,oBAAoB,WAAW,WAAW,EAAE,UAAU,CAAC;AAAA,EAChE;AAEA,WAAS,cAAc,eAAuB,YAA4B;AACxE,WAAO,QAAQ,YAAY,aAAa,EAAE,QAAQ,UAAU;AAAA,EAC9D;AAEA,WAAS,gBACP,eACA,SACA,iBACS;AACT,UAAM,MAAM,UAAU,YAAY,eAAe;AACjD,UAAM,OAAO,QAAQ,YAAY,aAAa;AAC9C,WAAO,IAAI,OAAO,MAAM,OAAO;AAAA,EACjC;AAEA,WAAS,oBAAoB,KAA2D;AACtF,WAAO,IAAI,kBAAkB,GAAG;AAAA,EAClC;AAEA,WAAS,oBAAoB,SASX;AAGhB,QAAI,aAAa,QAAQ;AACzB,QAAI,cAAc,IAAI,WAAW,gBAAgB;AACjD,gBAAY,SAAS,IAAI;AAEzB,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,KAAK,QAAQ;AAAA,MAEb,kBAAkB,OAAO,cAAuC;AAC9D,cAAM,iBAAiB,IAAI,WAAW;AAAA,UACpC;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAEA,YAAI,QAAQ,SAAS;AACnB,gBAAM,aAAa,IAAI,WAAW,QAAQ,EAAE,YAAY,QAAQ,QAAQ,WAAW,CAAC;AACpF,yBAAe,WAAW,UAAU;AAAA,QACtC;AAWA,YAAI;AACJ,YAAI,UAAU,WAAW,UAAU,QAAQ,SAAS,GAAG;AACrD,gBAAM,gBAAgB,MAAM,eAAe,cAAc,WAAW,UAAU,WAAW;AACzF,gBAAM,gBAAgB,MAAM,eAAe,cAAc,kBAAkB,aAAa;AACxF,gBAAM,SAA4B,EAAE,GAAG,cAAc;AACrD,qBAAW,QAAQ,UAAU,SAAS;AACpC,mBAAO,IAAI,IAAI,MAAM,eAAe,cAAc,WAAW,IAAI;AAAA,UACnE;AACA,4BAAkB;AAAA,QACpB;AAEA,cAAM,KAAK,MAAM,eAAe,0BAA0B;AAAA,UACxD,aAAa,UAAU;AAAA,UACvB,cAAc,UAAU;AAAA,UACxB,aAAa;AAAA,UACb,YAAY,UAAU,cAAc;AAAA,UACpC,QAAQ,UAAU;AAAA,UAClB,GAAI,kBAAkB,EAAE,SAAS,gBAAgB,IAAI,CAAC;AAAA,QACxD,CAAC;AAED,eAAO,KAAK,MAAM,GAAG,SAAS,CAAC;AAAA,MACjC;AAAA,MAEA,iBAAiB,OAAO,kBAA0C;AAChE,cAAM,iBAAiB,IAAI,WAAW;AAAA,UACpC;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAEA,YAAI,QAAQ,SAAS;AACnB,gBAAM,aAAa,IAAI,WAAW,QAAQ,EAAE,YAAY,QAAQ,QAAQ,WAAW,CAAC;AACpF,yBAAe,WAAW,UAAU;AAAA,QACtC;AAEA,cAAM,KAAK,MAAM,eAAe;AAAA,UAC9B,cAAc;AAAA,UACd;AAAA,UACA,cAAc,cAAc;AAAA,QAC9B;AAEA,eAAO,KAAK,MAAM,GAAG,SAAS,CAAC;AAAA,MACjC;AAAA,MAEA,UAAU,OAAO,eAA4D;AAC3E,cAAM,iBAAiB,IAAI,WAAW,eAAe,YAAY,aAAa,MAAS;AACvF,YAAI,QAAQ,SAAS;AACnB,yBAAe,WAAW,IAAI,WAAW,QAAQ,EAAE,YAAY,QAAQ,QAAQ,WAAW,CAAC,CAAC;AAAA,QAC9F;AAGA,cAAM,iBAAiB,QAAQ,UAAU,QAAQ,YAAY,QAAQ,QAAQ,OAAO,IAAI;AACxF,cAAM,YAAmC,iBACrC,CAAC,eAAuB;AACtB,gBAAM,KAAK,iBAAiB,WAAW,UAAU;AACjD,iBAAO,GAAG,QAAQ,cAAc,IAAI,GAAG,QAAQ,cAAc,EAAE,SAAS,IAAI;AAAA,QAC9E,IACA;AAKJ,cAAM,gBAAgB,MAAM,eAAe,mBAAmB;AAAA,UAC5D,aAAa,WAAW;AAAA,UACxB,cAAc,WAAW;AAAA,UACzB,QAAQ,WAAW;AAAA,UACnB,eAAe,WAAW;AAAA,UAC1B,gBAAgB,WAAW;AAAA,QAC7B,CAAC;AAQD,cAAM,KAAK;AAAA,UACT,WAAW;AAAA,YACT,aAAa,cAAc,YAAY,EAAE,IAAI,CAAC,MAAW;AACvD,kBAAI,SAAS;AACb,kBAAI,gBAAgB;AAClB,oBAAI;AACF,2BAAS,EAAE,kBAAkB,EAAE,IAAI,cAAc,CAAC;AAAA,gBACpD,QAAQ;AAAA,gBAER;AAAA,cACF;AACA,qBAAO,KAAK,MAAM,OAAO,SAAS,CAAC;AAAA,YACrC,CAAC;AAAA,UACH;AAAA,QACF;AAEA,cAAM,EAAE,aAAa,QAAQ,IAAI,mBAAmB,IAAI,SAAS;AACjE,eAAO,EAAE,aAAa,QAAQ;AAAA,MAChC;AAAA,MAEA,SAAS,OAAO,gBAA2D;AACzE,cAAM,iBAAiB,IAAI,WAAW,eAAe,YAAY,aAAa,MAAS;AACvF,YAAI,QAAQ,SAAS;AACnB,yBAAe,WAAW,IAAI,WAAW,QAAQ,EAAE,YAAY,QAAQ,QAAQ,WAAW,CAAC,CAAC;AAAA,QAC9F;AAGA,cAAM,cAAc,OAAO,YAAY,GAAG,IAAI;AAG9C,cAAM,iBAAiB,QAAQ,UAAU,QAAQ,YAAY,QAAQ,QAAQ,OAAO,IAAI;AACxF,cAAM,YAAmC,iBACrC,CAAC,eAAuB;AACtB,gBAAM,KAAK,iBAAiB,WAAW,UAAU;AACjD,iBAAO,GAAG,QAAQ,cAAc,IAAI,GAAG,QAAQ,cAAc,EAAE,SAAS,IAAI;AAAA,QAC9E,IACA;AAGJ,cAAM,qBAAqB,MACzB,mBAAmB,EAAE,WAAW,KAAK,YAAY,EAAE,QAA4B,CAAC,EAAE,CAAC;AAErF,YAAI,QAAQ,SAAS,aAAa;AAChC,cAAI,CAAC,QAAQ,UAAW,OAAM,IAAI,mBAAmB,oGAAoG;AAEzJ,cAAI;AACJ,cAAI;AACF,kBAAM,iBAAiB,MAAM,eAAe,eAAe;AAAA,cACzD,aAAa,YAAY;AAAA,cACzB,eAAe,YAAY;AAAA,cAC3B,gBAAgB,YAAY;AAAA,cAC5B,cAAc,YAAY;AAAA,cAC1B,QAAQ,YAAY;AAAA,cACpB;AAAA,cACA,YAAY,YAAY,cAAc;AAAA,cACtC,WAAW;AAAA,YACb,CAAC;AAED,kBAAM,YAAY,IAAI,kBAAkB,QAAQ,SAAS;AACzD,uBAAW,MAAM,UAAU,qBAAqB;AAAA,cAC9C;AAAA,cACA,KAAK,QAAQ;AAAA,cACb,QAAQ,QAAQ;AAAA,cAChB,YAAY,QAAQ;AAAA,YACtB,CAAC;AAAA,UACH,SAAS,GAAG;AACV,gBAAI,aAAa,UAAW,OAAM;AAClC,kBAAM,qBAAqB,CAAC;AAAA,UAC9B;AAEA,gBAAM,OAAO,SAAS,aAAa;AACnC,cAAI,CAAC,KAAM,OAAM,IAAI,mBAAmB,0FAAqF;AAE7H,gBAAM,cAAc,MAAM,oBAAoB,mBAAmB,GAAG,MAAM,QAAQ,mBAAmB;AACrG,gBAAM,EAAE,aAAa,QAAQ,IAAI,mBAAmB,aAAa,SAAS;AAC1E,iBAAO,EAAE,eAAe,MAAM,aAAa,QAAQ;AAAA,QAErD,OAAO;AACL,cAAI;AACJ,cAAI;AACF,iBAAK,MAAM,eAAe,0BAA0B;AAAA,cAClD,aAAa,YAAY;AAAA,cACzB,cAAc,YAAY;AAAA,cAC1B,QAAQ,YAAY;AAAA,cACpB;AAAA,cACA,YAAY,YAAY,cAAc;AAAA,cACtC,SAAS,YAAY;AAAA,cACrB,SAAS,YAAY;AAAA,YACvB,CAAC;AAAA,UACH,SAAS,GAAG;AACV,gBAAI,aAAa,UAAW,OAAM;AAClC,kBAAM,IAAI,aAAa,EAAE,SAAS,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,GAAG,OAAO,EAAW,CAAC;AAAA,UACnG;AAEA,cAAI;AACJ,cAAI;AACF,kBAAM,eAAe,IAAI,kBAAkB,UAAU;AACrD,yBAAa,iBAAiB,KAAK;AACnC,mBAAO,MAAM,aAAa,kBAAkB,EAAE;AAAA,UAChD,SAAS,GAAG;AACV,gBAAI,aAAa,UAAW,OAAM;AAClC,kBAAM,uBAAuB,CAAC;AAAA,UAChC;AAEA,gBAAM,cAAc,MAAM,oBAAoB,mBAAmB,GAAG,MAAM,QAAQ,mBAAmB;AACrG,gBAAM,EAAE,aAAa,QAAQ,IAAI,mBAAmB,aAAa,SAAS;AAC1E,iBAAO,EAAE,eAAe,MAAM,aAAa,QAAQ;AAAA,QACrD;AAAA,MACF;AAAA,MAEA,SAAS,OAAO,eAAe;AAC7B,YAAI,CAAC,QAAQ,SAAS,SAAS;AAC7B,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AACA,eAAO,WAAW,QAAQ,YAAY,QAAQ,QAAQ,OAAO,EAAE,QAAQ,UAAU;AAAA,MACnF;AAAA,MAEA,eAAe,OAAO,eAAe;AACnC,YAAI,eAAe,aAAa,eAAe,WAAW;AACxD,gBAAM,IAAI;AAAA,YACR,0DAA0D,UAAU;AAAA,UACtE;AAAA,QACF;AACA,qBAAc,MAAM,QAAQ,UAA8B;AAC1D,sBAAc,IAAI,WAAW,gBAAgB;AAC7C,oBAAY,SAAS,IAAI;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AASA,WAAS,cAAc,KAA2C;AAChE,UAAM,OAAO,CAAC,OAAe,UAA2B,IAAI,KAAK,KAAK,IAAI,KAAK;AAC/E,WAAO;AAAA,MACL,aAAa,KAAK,gBAAgB,aAAa;AAAA,MAC/C,gBAAgB,KAAK,mBAAmB,gBAAgB;AAAA,MACxD,YAAY,IAAI;AAAA,MAChB,cAAc,KAAK,iBAAiB,cAAc;AAAA,MAClD,aAAa,KAAK,gBAAgB,aAAa;AAAA,MAC/C,OAAO,IAAI;AAAA,MACX,aAAa,KAAK,gBAAgB,aAAa;AAAA,MAC/C,kBAAkB,KAAK,qBAAqB,kBAAkB;AAAA,MAC9D,YAAY,KAAK,eAAe,YAAY;AAAA,MAC5C,QAAQ,IAAI;AAAA,MACZ,OAAO,IAAI;AAAA,MACX,KAAK,IAAI;AAAA,MACT,eAAe,KAAK,kBAAkB,eAAe;AAAA,MACrD,cAAc,KAAK,iBAAiB,cAAc;AAAA,MAClD,kBAAkB,KAAK,qBAAqB,kBAAkB;AAAA,MAC9D,iBAAiB,KAAK,oBAAoB,iBAAiB;AAAA,MAC3D,iBAAkB,KAAK,oBAAoB,iBAAiB,KAA4B;AAAA,IAC1F;AAAA,EACF;AAMA,WAAS,iBAAiB,YAAoB;AAC5C,QAAI;AACJ,WAAO;AAAA,MACL,OACE,SACA,SACe;AACf,YAAI,CAAC,cAAc;AACjB,0BAAgB,YAAY;AAC1B,kBAAM,SAAS,MAAM,QAAQ,kBAAkB,SAAS,UAAU;AAClE,gBAAI,CAAC,OAAO,IAAI;AACd,6BAAe;AACf,oBAAM,IAAI;AAAA,gBACR,4CAA4C,OAAO,MAAM,MAAM,OAAO,OAAO,WAAW,eAAe;AAAA,cACzG;AAAA,YACF;AAAA,UACF,GAAG;AAAA,QACL;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAaA,iBAAe,UACb,SACA,SACA,cACA,WACwB;AACxB,UAAM,eAAe,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AACtD,UAAM,aAAa,oBAAI,IAAI,CAAC,KAAK,GAAG,CAAC;AACrC,UAAM,YAAY,CAAC,WAAmB,aAAa,IAAI,MAAM,KAAM,aAAa,WAAW,IAAI,MAAM;AACrG,UAAM,eAAe;AACrB,QAAI,OAAO;AACX,aAAS,UAAU,GAAG,UAAU,cAAc,WAAW;AACvD,UAAI;AACF,cAAM,SAAS,MAAM,QAAQ,MAAM;AAAA,UACjC,SAAS,iBAAiB;AAAA,UAC1B,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE;AAAA,QAChC,CAAC;AACD,YAAI,OAAO,GAAI,SAAQ,OAAO,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,cAAc,CAA4B,CAAC;AAChG,eAAO,QAAQ,OAAO,MAAM,KAAK,OAAO,OAAO,WAAW,eAAe;AACzE,YAAI,CAAC,UAAU,OAAO,MAAM,EAAG;AAAA,MACjC,SAAS,KAAK;AAGZ,eAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD;AACA,UAAI,YAAY,eAAe,EAAG;AAClC,cAAQ,WAAW,MAAS;AAC5B,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,MAAM,KAAK,OAAO,CAAC;AAAA,IACxE;AACA,UAAM,IAAI,MAAM,uBAAuB,IAAI,GAAG;AAAA,EAChD;AAEA,WAAS,oBAAoB,SAKV;AAIjB,QAAI,aAA2D,EAAE,eAAe,QAAQ;AACxF,QAAI;AACJ,QAAI;AACJ,QAAI;AACJ,QAAI,eAAe,iBAAiB,QAAQ,cAAc,CAAC;AAE3D,aAAS,eAAe;AACtB,UAAI,CAAC,cAAe;AACpB,gBAAU,WAAW,QAAQ,YAAY,aAAa;AACtD,gBAAU,IAAI,WAAW,cAAc;AAAA,QACrC,KAAK,QAAQ;AAAA,QACb,YAAY,QAAQ;AAAA,QACpB,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,QACnD,UAAU,CAAC,OAAO;AAAA,QAClB,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,MAClB,CAAC;AAID,qBAAe,iBAAiB,QAAQ,cAAc,CAAC;AAAA,IACzD;AAEA,WAAO;AAAA,MACL,YAAY,CAAC,YAAiC;AAC5C,wBAAgB,QAAQ;AACxB,qBAAa;AAAA,MACf;AAAA,MAEA,gBAAgB,OAAO,WAA6D;AAClF,YAAI,CAAC,SAAS;AACZ,gBAAM,IAAI,MAAM,mEAAmE;AAAA,QACrF;AAKA,cAAM,gBAAgB;AACtB,cAAM,gBAAgB;AACtB,cAAM,qBAAqB;AAC3B,cAAM,mBAAmB,OAAO,eAAe,aAAa;AAC5D,eAAO,UAAU,eAAe,OAAO,SAAS,OAAO,cAAc,CAAC,CAAC,QAAQ,MAAM;AAAA,MACvF;AAAA,MAEA,eAAe,OAAO,eAAuB;AAC3C,YAAI,eAAe,aAAa,eAAe,WAAW;AACxD,gBAAM,IAAI;AAAA,YACR,8DAA8D,UAAU;AAAA,UAC1E;AAAA,QACF;AACA,qBAAc,MAAM,QAAQ,UAA8B;AAC1D,qBAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,WAAS,wBAAwB,SAML;AAC1B,UAAM,UAAU,QAAQ,YAAY,QAAQ,OAAO;AACnD,UAAM,UAAU,IAAI,cAAc;AAAA,MAChC,KAAK,QAAQ;AAAA,MACb,YAAY,QAAQ;AAAA,MACpB,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,MACnD,UAAU,CAAC,OAAO;AAAA,MAClB,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB,CAAC;AACD,UAAM,eAAe,iBAAiB,QAAQ,cAAc,CAAC;AAE7D,WAAO;AAAA,MACL,gBAAgB,OAAO,WAA6D;AAClF,cAAM,aAAa,OAAO,SAAS,OAAO;AAC1C,eAAO,UAAU,SAAS,OAAO,SAAS,OAAO,cAAc,CAAC,CAAC,QAAQ,MAAM;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AAEA,WAAS,iBAAiB,SAQ0E;AAClG,UAAM,UAAU,oBAAoB,QAAQ,UAAU;AACtD,UAAM,YAAY,KAAK,QAAQ,YAAY,EAAE,QAA4B,CAAC;AAE1E,UAAM,UAAU,oBAAoB;AAAA,MAClC,MAAM,QAAQ,eAAe;AAAA,MAC7B,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,MACnB,QAAQ,QAAQ;AAAA,MAChB,YAAY,QAAQ;AAAA,MACpB;AAAA,IACF,CAAC;AAED,UAAM,eAAe,mBAAmB,EAAE,UAAU,CAAC;AAErD,QAAI,QAAQ,SAAS;AACnB,cAAQ,QAAQ,WAAW,EAAE,SAAS,QAAQ,QAAQ,CAAC;AAAA,IACzD;AAEA,UAAM,eAAe,mBAAmB;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,QAAQ,UAAU,EAAE,gBAAgB,QAAQ,QAAQ,IAAI,CAAC;AAAA,IAC/D,CAAC;AAED,WAAO,EAAE,cAAc,cAAc,QAAQ;AAAA,EAC/C;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAAE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAcA,IAAM,4BAA4B;AAElC,SAAS,oBAAoB,YAAgD;AAC3E,QAAM,aAAa,IAAI,QAAQ,EAAE,WAAW,CAAC;AAC7C,QAAM,UAAU,WAAW,QAAQ,EAAE,UAAU;AAC/C,QAAM,UAAU,WAAW,QAAQ,EAAE,UAAU;AAE/C,QAAM,SAAS,OAAO,YAA6C;AACjE,UAAM,MAAM,WAAW,KAAK,OAAO;AACnC,WAAO,IAAI,YAAY,EAAE,OAAO,IAAI,UAAU,CAAC;AAAA,EACjD;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,aAAa;AAAA,EACf;AACF;AAGO,SAAS,kBAA8C;AAC5D,QAAM,aAAa,IAAI,QAAQ;AAC/B,SAAO,oBAAoB,WAAW,WAAW,EAAE,UAAU,CAAC;AAChE;AA4BO,SAAS,oBAAoB,SAIgE;AAClG,QAAM,MAAM,UAAU,SAAS,cAAc,YAAY;AACzD,QAAM,UAAU,oBAAoB,SAAS,cAAc,mBAAmB;AAC9E,QAAM,aAAa,IAAI,QAAQ,EAAE,YAAY,QAAQ,WAAW,CAAC;AACjE,QAAM,YAAY,KAAK,KAAK,EAAE,SAAS,UAAU,CAAC;AAElD,QAAM,cAAc,IAAI,gBAAgB;AACxC,cAAY,SAAS,IAAI;AAIzB,uCAAqC,yBAAyB;AAI9D,QAAM,eAAe,mBAAmB,EAAE,UAAU,CAAC;AAQrD,QAAM,mBAAmB,OAAO,SAM1B;AACJ,UAAM,iBAAiB,IAAI,eAAe,KAAK,aAAa,MAAS;AACrE,mBAAe,WAAW,UAAU;AACpC,WAAO,eAAe,iCAAiC;AAAA,MACrD,aAAa,KAAK;AAAA,MAClB,cAAc,KAAK;AAAA,MACnB,aAAa;AAAA,MACb,YAAY,KAAK,cAAc;AAAA,MAC/B,QAAQ,KAAK;AAAA,MACb,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAClD,CAAC;AAAA,EACH;AAEA,QAAM,UAAyB;AAAA,IAC7B,MAAM;AAAA,IACN,iBAAiB,OAAO,kBAA0C;AAChE,YAAM,iBAAiB,IAAI,eAAe,KAAK,aAAa,MAAS;AACrE,qBAAe,WAAW,UAAU;AACpC,YAAM,KAAK,MAAM,eAAe,kCAAkC;AAAA,QAChE,SAAS,cAAc;AAAA,QACvB,aAAa;AAAA,QACb,YAAY,cAAc,cAAc;AAAA,MAC1C,CAAC;AACD,aAAO,KAAK,MAAM,GAAG,SAAS,CAAC;AAAA,IACjC;AAAA,IACA,kBAAkB,OAAO,cAAuC;AAK9D,UAAI;AACJ,UAAI,UAAU,WAAW,UAAU,QAAQ,SAAS,GAAG;AACrD,cAAM,gBAAgB,IAAI,eAAe,KAAK,aAAa,MAAS,EAAE;AACtE,kBAAU,CAAC;AACX,cAAM,QAAQ,CAAC,GAAG,UAAU,OAAO;AACnC,cAAM,OAAO,oBAAI,IAAY;AAC7B,eAAO,MAAM,SAAS,GAAG;AACvB,gBAAM,OAAO,MAAM,MAAM;AACzB,cAAI,KAAK,IAAI,IAAI,EAAG;AACpB,eAAK,IAAI,IAAI;AACb,gBAAM,SAAS,MAAM,cAAc,WAAW,IAAI;AAClD,kBAAQ,IAAI,IAAI;AAChB,gBAAM,cAAc,QAAQ,WAAW,MAAM,EAAE,WAAW;AAC1D,qBAAW,OAAO,aAAa;AAC7B,gBAAI,OAAO,CAAC,KAAK,IAAI,GAAG,EAAG,OAAM,KAAK,GAAG;AAAA,UAC3C;AAAA,QACF;AAAA,MACF;AAEA,YAAM,KAAK,MAAM,iBAAiB;AAAA,QAChC,aAAa,UAAU;AAAA,QACvB,cAAc,UAAU;AAAA,QACxB,QAAQ,UAAU;AAAA,QAClB,YAAY,UAAU;AAAA,QACtB;AAAA,MACF,CAAC;AACD,aAAO,KAAK,MAAM,GAAG,SAAS,CAAC;AAAA,IACjC;AAAA,IACA,SAAS,OAAO,gBAA2D;AACzE,YAAM,KAAK,MAAM,iBAAiB;AAAA,QAChC,aAAa,YAAY;AAAA,QACzB,cAAc,YAAY;AAAA,QAC1B,QAAQ,YAAY;AAAA,QACpB,YAAY,YAAY;AAAA,QACxB,SAAS,YAAY;AAAA,MACvB,CAAC;AAGD,YAAM,OAAQ,MAAM,aAAa,QAAQ;AAAA,QACvC,QAAQ;AAAA,QACR,QAAQ,EAAE,aAAa,GAAG,SAAS,EAAE;AAAA,MACvC,CAAC;AAID,YAAM,cAAc,MAAM,oBAAoB,cAAc,IAAI;AAOhE,YAAM,iBAAiB,cAAc,YAAY,QAAQ,OAAO;AAChE,YAAM,YAAuB,CAAC,eAAuB;AACnD,cAAM,KAAK,uBAAuB,WAAW,UAAU;AACvD,eAAO,GAAG,QAAQ,cAAc,IAAI,GAAG,QAAQ,cAAc,EAAE,SAAS,IAAI;AAAA,MAC9E;AACA,YAAM,EAAE,aAAa,QAAQ,IAAI,mBAAmB,aAAa,SAAS;AAC1E,aAAO,EAAE,eAAe,MAAM,aAAa,QAAQ;AAAA,IACrD;AAAA,EACF;AAEA,QAAM,eAAe,mBAAmB,EAAE,SAAS,WAAW,QAAQ,CAAC;AAEvE,SAAO,EAAE,cAAc,cAAc,QAAQ;AAC/C;","names":["generateMnemonic","validateMnemonic","Account","generateMnemonic","generateAccount"]}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@provablehq/veil-aleo-sdk",
+  "version": "0.4.0",
+  "description": "Local signing and proving for the Veil Aleo SDK, backed by the Provable SDK.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ProvableHQ/veil.git",
+    "directory": "packages/provable-sdk"
+  },
+  "homepage": "https://github.com/ProvableHQ/veil#readme",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "sideEffects": false,
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "@provablehq/veil-core": "0.4.0",
+    "@provablehq/veil-aleo-devnode": "0.4.0"
+  },
+  "dependencies": {
+    "@noble/hashes": "^1.7.2",
+    "@provablehq/sdk": "^0.11.3",
+    "@scure/bip39": "^1.4.0"
+  },
+  "devDependencies": {
+    "@provablehq/veil-leo": "0.4.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit"
+  }
+}