@renown/sdk 6.2.3-dev.5 → 6.2.3-dev.51

package/dist/signed-message-Cp5oRPLN.js

@@ -0,0 +1,468 @@
+import { a as DEFAULT_RENOWN_NETWORK_ID, o as DEFAULT_RENOWN_URL, r as CREDENTIAL_TYPES } from "./constants-DVOF17NB.js";
+import { c as MissingSwitchboardError, l as SwitchboardClient, n as buildAndSignCredential, o as verifyCredentialSignature, r as fetchDelegationCredential, u as resolveSwitchboardEndpoint } from "./signer-trust-H1rNzUcd.js";
+import { a as verifyAuthBearerToken, i as parsePkhDid } from "./utils-DLQ5VVqT.js";
+import { s as RenownCryptoBuilder, t as RenownCryptoSigner } from "./signer-GzTlZLjR.js";
+//#region src/storage/common.ts
+var BaseStorage = class {};
+var MemoryStorage = class extends BaseStorage {
+	data = /* @__PURE__ */ new Map();
+	get(key) {
+		return this.data.get(key);
+	}
+	set(key, value) {
+		if (value === void 0) this.data.delete(key);
+		else this.data.set(key, value);
+	}
+	delete(key) {
+		this.data.delete(key);
+	}
+};
+//#endregion
+//#region src/common.ts
+var RenownMemoryStorage = class extends MemoryStorage {};
+/**
+* The acting identity an action's signature carries.
+*
+* `User` here is the whole session record — it also holds the DID, the
+* credential, the fetched profile and ENS info — while `UserActionSigner` is
+* what travels on a signed action, and it is deliberately just an address on a
+* chain. The reactor's `ReactorSignerUserInput` declares exactly these three
+* fields, and a GraphQL input object refuses a field it does not declare by
+* rejecting the WHOLE request, so handing the session record to the signer
+* makes every signed push fail before it reaches the reactor.
+*
+* Narrowed here rather than at the transport, because the session record has no
+* business being on an operation in the first place: it is stored on every
+* operation a local reactor writes, not only on the ones that go over a wire.
+*
+* The compiler cannot catch the difference — excess-property checks apply to
+* fresh object literals, never to a variable of a wider type — which is why
+* this is a function rather than a type annotation.
+*/
+function toActionSigner(user) {
+	if (!user) return void 0;
+	return {
+		address: user.address,
+		networkId: user.networkId,
+		chainId: user.chainId
+	};
+}
+var Renown = class {
+	#baseUrl;
+	#store;
+	#eventEmitter;
+	#appName;
+	#crypto;
+	#signer;
+	#profileFetcher;
+	#switchboard;
+	#chainId;
+	#status = "initial";
+	constructor(store, eventEmitter, crypto, appName, baseUrl = DEFAULT_RENOWN_URL, profileFetcher, switchboard, chainId = 1) {
+		this.#store = store;
+		this.#eventEmitter = eventEmitter;
+		this.#baseUrl = baseUrl;
+		this.#crypto = crypto;
+		this.#appName = appName;
+		this.#profileFetcher = profileFetcher;
+		this.#switchboard = switchboard;
+		this.#chainId = chainId;
+		const restoredUser = this.user;
+		this.#signer = new RenownCryptoSigner(crypto, this.#appName, toActionSigner(restoredUser));
+		if (restoredUser) this.#status = "authorized";
+		this.on("user", (user) => {
+			this.#signer.user = toActionSigner(user);
+		});
+	}
+	get baseUrl() {
+		return this.#baseUrl;
+	}
+	/** Chain id this app issues credentials on; a session from another chain is rejected by {@link signIn}. */
+	get chainId() {
+		return this.#chainId;
+	}
+	get user() {
+		return this.#store.get("user");
+	}
+	get status() {
+		return this.#status;
+	}
+	get signer() {
+		return this.#signer;
+	}
+	get crypto() {
+		return this.#crypto;
+	}
+	get did() {
+		return this.#crypto.did;
+	}
+	get profileFetcher() {
+		return this.#profileFetcher;
+	}
+	#updateStatus(status) {
+		this.#status = status;
+		this.#eventEmitter.emit("status", status);
+	}
+	#updateUser(user) {
+		if (user) this.#store.set("user", user);
+		else this.#store.delete("user");
+		this.#eventEmitter.emit("user", user);
+	}
+	async login(userDid) {
+		this.#updateStatus("checking");
+		try {
+			const result = parsePkhDid(userDid);
+			const credential = await this.#getCredential(result.address, result.chainId, this.#crypto.did);
+			if (!credential) {
+				this.#updateUser(void 0);
+				throw new Error("Credential not found");
+			}
+			return await this.#completeLogin(userDid, result, credential);
+		} catch (error) {
+			this.#updateUser(void 0);
+			this.#updateStatus("not-authorized");
+			throw error;
+		}
+	}
+	async signIn(params) {
+		if (!this.#switchboard) throw new MissingSwitchboardError();
+		const { address, chainId, signTypedData, username, userImage, expiresInDays } = params;
+		if (chainId !== this.#chainId) throw new Error(`Renown signIn: wallet is on chain ${chainId}, but this app issues credentials on chain ${this.#chainId}. Switch networks and retry — signing here would create a separate identity for the same address.`);
+		this.#updateStatus("checking");
+		try {
+			const credential = await buildAndSignCredential({
+				signTypedData,
+				address,
+				chainId,
+				app: this.#appName,
+				appId: this.did,
+				expiresInDays
+			});
+			await this.#switchboard.issueCredential(credential);
+			const userDid = `did:pkh:${DEFAULT_RENOWN_NETWORK_ID}:${chainId}:${address.toLowerCase()}`;
+			const user = await this.#completeLogin(userDid, parsePkhDid(userDid), credential);
+			if (username !== void 0 || userImage !== void 0) this.#writeProfile(address, {
+				username,
+				userImage
+			}).catch(() => void 0);
+			return user;
+		} catch (error) {
+			this.#updateUser(void 0);
+			this.#updateStatus("not-authorized");
+			throw error;
+		}
+	}
+	async #writeProfile(address, profile) {
+		if (!this.#switchboard) return;
+		const token = await this.#crypto.getBearerToken(address);
+		const attempts = 5;
+		for (let attempt = 1; attempt <= attempts; attempt++) try {
+			await this.#switchboard.upsertUserProfile(address, profile, { token });
+			return;
+		} catch (error) {
+			if (attempt === attempts) throw error;
+			await new Promise((resolve) => setTimeout(resolve, 600));
+		}
+	}
+	async #completeLogin(userDid, result, credential) {
+		if (!(credential.issuer.id === userDid && credential.credentialSubject.id === this.did)) throw new Error("Invalid credential");
+		const verifiableCredential = credential.proof.eip712?.domain ? credential : {
+			...credential,
+			proof: {
+				...credential.proof,
+				eip712: {
+					domain: {
+						version: "1",
+						chainId: result.chainId
+					},
+					types: CREDENTIAL_TYPES,
+					primaryType: "VerifiableCredential"
+				}
+			}
+		};
+		if (credential.issuer.ethereumAddress.toLowerCase() !== result.address.toLowerCase() || verifiableCredential.proof.eip712.domain.chainId !== result.chainId || !await verifyCredentialSignature(verifiableCredential)) throw new Error("Invalid credential signature");
+		const user = {
+			...result,
+			address: credential.issuer.ethereumAddress,
+			did: userDid,
+			credential: verifiableCredential
+		};
+		this.#updateUser(user);
+		this.#updateStatus("authorized");
+		if (this.#profileFetcher) this.#profileFetcher(user, this.#baseUrl).then((profile) => {
+			if (profile && this.user?.address === user.address && this.user.chainId === user.chainId) this.#updateUser({
+				...this.user,
+				profile,
+				ens: {
+					name: profile.username ?? void 0,
+					avatarUrl: profile.userImage ?? void 0
+				}
+			});
+		}).catch(console.error);
+		return user;
+	}
+	logout() {
+		this.#updateUser(void 0);
+		this.#updateStatus("initial");
+		return Promise.resolve();
+	}
+	async revalidate() {
+		const user = this.user;
+		if (!user) return false;
+		try {
+			if (!await this.#getCredential(user.address, user.chainId, this.#crypto.did)) {
+				await this.logout();
+				return false;
+			}
+			await this.refreshProfile();
+			return true;
+		} catch {
+			return true;
+		}
+	}
+	async refreshProfile() {
+		const user = this.user;
+		if (!user || !this.#profileFetcher) return false;
+		try {
+			const profile = await this.#profileFetcher(user, this.#baseUrl);
+			if (!profile) return false;
+			const current = this.user;
+			if (!current || current.address !== user.address || current.chainId !== user.chainId) return false;
+			if (current.profile !== void 0 && current.profile.documentId === profile.documentId && current.profile.username === profile.username && current.profile.userImage === profile.userImage) return false;
+			this.#updateUser({
+				...current,
+				profile,
+				ens: {
+					name: profile.username ?? void 0,
+					avatarUrl: profile.userImage ?? void 0
+				}
+			});
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	on(event, listener) {
+		return this.#eventEmitter.on(event, listener);
+	}
+	async #getCredential(address, chainId, appDid) {
+		if (this.#switchboard) return this.#switchboard.getCredential({
+			address,
+			chainId,
+			appDid
+		});
+		if (!this.#baseUrl) throw new Error("RENOWN_URL is not set");
+		const url = new URL(`/api/auth/credential?address=${encodeURIComponent(address)}&chainId=${encodeURIComponent(chainId)}&connectId=${encodeURIComponent(appDid)}&appId=${encodeURIComponent(appDid)}`, this.#baseUrl);
+		const response = await fetch(url, { method: "GET" });
+		if (response.ok) return (await response.json()).credential;
+		else throw new Error(`Failed to get credential: ${response.status}`);
+	}
+	async verifyBearerToken(token) {
+		return verifyAuthBearerToken(token);
+	}
+	async getBearerToken(options) {
+		if (!this.user) throw new Error("User not found");
+		return this.#crypto.getBearerToken(this.user.address, options);
+	}
+};
+//#endregion
+//#region src/event/memory.ts
+var MemoryEventEmitter = class {
+	#listeners = /* @__PURE__ */ new Map();
+	on(event, listener) {
+		if (!this.#listeners.has(event)) this.#listeners.set(event, /* @__PURE__ */ new Set());
+		this.#listeners.get(event).add(listener);
+		return () => {
+			this.#listeners.get(event)?.delete(listener);
+		};
+	}
+	emit(event, data) {
+		this.#listeners.get(event)?.forEach((listener) => listener(data));
+	}
+};
+//#endregion
+//#region src/profile.ts
+const fetchRenownProfile = async (user, baseUrl) => {
+	try {
+		const response = await fetch(`${baseUrl.replace(/\/+$/, "")}/api/profile`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ ethAddress: user.address })
+		});
+		if (!response.ok) return;
+		return (await response.json()).profile ?? void 0;
+	} catch {
+		return;
+	}
+};
+//#endregion
+//#region src/renown-builder.ts
+/**
+* Base builder for creating Renown instances.
+* Use platform-specific builders (RenownBuilder from init.browser.js or init.node.js)
+* for pre-configured defaults.
+*/
+var BaseRenownBuilder = class BaseRenownBuilder {
+	#appName;
+	#storage;
+	#eventEmitter;
+	#crypto;
+	#keyPairStorage;
+	#baseUrl;
+	#switchboardUrl;
+	#profileFetcher;
+	#chainId;
+	/**
+	* @param appName - Application name used for signing context
+	*/
+	constructor(appName) {
+		this.#appName = appName;
+	}
+	/**
+	* Set custom storage for user data persistence.
+	* Defaults to in-memory storage if not set.
+	*/
+	withStorage(storage) {
+		this.#storage = storage;
+		return this;
+	}
+	/**
+	* Set custom event emitter for user state changes.
+	* Defaults to in-memory event emitter if not set.
+	*/
+	withEventEmitter(eventEmitter) {
+		this.#eventEmitter = eventEmitter;
+		return this;
+	}
+	/**
+	* Set a pre-built crypto instance.
+	* Either crypto or keyPairStorage must be provided.
+	*/
+	withCrypto(crypto) {
+		this.#crypto = crypto;
+		return this;
+	}
+	/**
+	* Set key pair storage for cryptographic keys.
+	* A crypto instance will be built from this storage.
+	* Either crypto or keyPairStorage must be provided.
+	*/
+	withKeyPairStorage(keyPairStorage) {
+		this.#keyPairStorage = keyPairStorage;
+		return this;
+	}
+	/**
+	* Set the Renown server URL for credential verification.
+	* Defaults to https://www.renown.id
+	*/
+	withBaseUrl(baseUrl) {
+		this.#baseUrl = baseUrl;
+		return this;
+	}
+	withSwitchboardUrl(switchboardUrl) {
+		this.#switchboardUrl = switchboardUrl;
+		return this;
+	}
+	withChainId(chainId) {
+		this.#chainId = chainId;
+		return this;
+	}
+	/**
+	* Set a profile fetcher strategy for enriching user data after login.
+	* The fetcher receives the authenticated user and the base URL,
+	* and returns a RenownProfile. Called in the background after each login.
+	* Defaults to fetchRenownProfile which calls the Renown API.
+	*/
+	withProfileFetcher(profileFetcher) {
+		this.#profileFetcher = profileFetcher;
+		return this;
+	}
+	/**
+	* Build and initialize the Renown instance.
+	* If a user is stored, attempts to re-authenticate them.
+	* @throws Error if neither crypto nor keyPairStorage is provided
+	*/
+	async build() {
+		if (!this.#crypto && !this.#keyPairStorage) throw new Error("Either crypto or keyPairStorage is required. Use withCrypto() or withKeyPairStorage() to set one.");
+		const chainId = this.#chainId ?? 1;
+		const crypto = this.#crypto ?? await new RenownCryptoBuilder().withKeyPairStorage(this.#keyPairStorage).withChainId(chainId).build();
+		if (crypto.chainId !== void 0 && crypto.chainId !== chainId) console.warn(`Renown: the supplied crypto signs bearer tokens for chain ${crypto.chainId}, but credentials are issued on chain ${chainId}.`);
+		const storage = this.#storage ?? new RenownMemoryStorage();
+		const eventEmitter = this.#eventEmitter ?? new MemoryEventEmitter();
+		const baseUrl = this.#baseUrl ?? "https://www.renown.id";
+		const switchboardEndpoint = await resolveSwitchboardEndpoint({
+			switchboardUrl: this.#switchboardUrl,
+			baseUrl
+		});
+		const switchboard = switchboardEndpoint ? new SwitchboardClient(switchboardEndpoint) : void 0;
+		const profileFetcher = this.#profileFetcher ?? (switchboard ? switchboard.profileFetcher : fetchRenownProfile);
+		return new Renown(storage, eventEmitter, crypto, this.#appName, baseUrl, profileFetcher, switchboard, chainId);
+	}
+	/**
+	* Create a BaseRenownBuilder from options object for a more concise API
+	*/
+	static from(options) {
+		const builder = new BaseRenownBuilder(options.appName);
+		if (options.storage) builder.withStorage(options.storage);
+		if (options.eventEmitter) builder.withEventEmitter(options.eventEmitter);
+		if (options.crypto) builder.withCrypto(options.crypto);
+		if (options.keyPairStorage) builder.withKeyPairStorage(options.keyPairStorage);
+		if (options.baseUrl) builder.withBaseUrl(options.baseUrl);
+		if (options.switchboardUrl) builder.withSwitchboardUrl(options.switchboardUrl);
+		if (options.profileFetcher) builder.withProfileFetcher(options.profileFetcher);
+		if (options.chainId !== void 0) builder.withChainId(options.chainId);
+		return builder;
+	}
+};
+//#endregion
+//#region src/local-credential-verifier.ts
+/** A credential check that reads a Switchboard's own renown read model through
+* `execute`, rather than any Renown or Switchboard over HTTP. */
+function createLocalCredentialVerifier(execute, options = {}) {
+	const request = async (query, variables) => {
+		try {
+			return await execute(query, variables);
+		} catch (error) {
+			options.onError?.(error);
+			throw error;
+		}
+	};
+	return async ({ address, chainId, appId }) => {
+		return await fetchDelegationCredential({
+			address,
+			chainId,
+			appDid: appId,
+			switchboardRequest: request
+		}) !== void 0;
+	};
+}
+//#endregion
+//#region src/signed-message.ts
+const SIGNATURE_WINDOW_MS = 6e5;
+function toHex(bytes) {
+	return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function sha256hex(input) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+	return toHex(new Uint8Array(digest));
+}
+/** Canonical message a caller signs to authorize revoking `credentialId`. */
+function revokeMessage(credentialId, timestamp) {
+	return `Revoke Renown credential ${credentialId} at ${timestamp}`;
+}
+/**
+* Canonical message a caller signs to authorize a profile upsert. The payload
+* is hashed (rather than embedded raw) so the signed message has a fixed
+* shape regardless of field content.
+*/
+async function profileMessage(address, profile, timestamp) {
+	const hash = await sha256hex(JSON.stringify({
+		username: profile.username ?? null,
+		userImage: profile.userImage ?? null
+	}));
+	return `Update Renown profile ${address.toLowerCase()} ${hash} at ${timestamp}`;
+}
+//#endregion
+export { BaseRenownBuilder as a, RenownMemoryStorage as c, createLocalCredentialVerifier as i, BaseStorage as l, profileMessage as n, fetchRenownProfile as o, revokeMessage as r, Renown as s, SIGNATURE_WINDOW_MS as t };
+
+//# sourceMappingURL=signed-message-Cp5oRPLN.js.map

package/dist/signed-message-Cp5oRPLN.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-message-Cp5oRPLN.js","names":[],"sources":["../src/storage/common.ts","../src/common.ts","../src/event/memory.ts","../src/profile.ts","../src/renown-builder.ts","../src/local-credential-verifier.ts","../src/signed-message.ts"],"sourcesContent":["export interface IStorage<\n  T extends Record<string, unknown> = Record<string, unknown>,\n  Key extends keyof T = keyof T,\n> {\n  get(key: Key): T[Key] | undefined;\n  set(key: Key, value?: T[Key]): void;\n  delete(key: Key): void;\n}\n\nexport abstract class BaseStorage<\n  T extends Record<string, unknown> = Record<string, unknown>,\n  Key extends keyof T = keyof T,\n> implements IStorage<T> {\n  abstract get(key: Key): T[Key] | undefined;\n  abstract set(key: Key, value?: T[Key]): void;\n  abstract delete(key: Key): void;\n}\n\nexport class MemoryStorage<\n  T extends Record<string, unknown> = Record<string, unknown>,\n  Key extends keyof T = keyof T,\n> extends BaseStorage<T> {\n  private readonly data = new Map<Key, T[Key]>();\n\n  get(key: Key) {\n    return this.data.get(key);\n  }\n\n  set(key: Key, value?: T[Key]): void {\n    if (value === undefined) {\n      this.data.delete(key);\n    } else {\n      this.data.set(key, value);\n    }\n  }\n\n  delete(key: Key): void {\n    this.data.delete(key);\n  }\n}\n","import {\n  CREDENTIAL_TYPES,\n  DEFAULT_RENOWN_CHAIN_ID,\n  DEFAULT_RENOWN_NETWORK_ID,\n  DEFAULT_RENOWN_URL,\n} from \"./constants.js\";\nimport {\n  buildAndSignCredential,\n  verifyCredentialSignature,\n} from \"./credential.js\";\nimport { RenownCryptoSigner, type IRenownCrypto } from \"./crypto/index.js\";\nimport { MemoryStorage } from \"./storage/common.js\";\nimport {\n  MissingSwitchboardError,\n  type SwitchboardClient,\n} from \"./switchboard.js\";\nimport type {\n  CreateBearerTokenOptions,\n  IProof,\n  IRenown,\n  ISigner,\n  LoginStatus,\n  PKHDid,\n  PowerhouseVerifiableCredential,\n  ProfileFetcher,\n  RenownEventEmitter,\n  RenownEvents,\n  RenownStorage,\n  RenownStorageMap,\n  SignInParams,\n  User,\n  UserActionSigner,\n} from \"./types.js\";\nimport { parsePkhDid, verifyAuthBearerToken } from \"./utils.js\";\nexport * from \"./constants.js\";\n\nexport class RenownMemoryStorage extends MemoryStorage<RenownStorageMap> {}\n\n/**\n * The acting identity an action's signature carries.\n *\n * `User` here is the whole session record — it also holds the DID, the\n * credential, the fetched profile and ENS info — while `UserActionSigner` is\n * what travels on a signed action, and it is deliberately just an address on a\n * chain. The reactor's `ReactorSignerUserInput` declares exactly these three\n * fields, and a GraphQL input object refuses a field it does not declare by\n * rejecting the WHOLE request, so handing the session record to the signer\n * makes every signed push fail before it reaches the reactor.\n *\n * Narrowed here rather than at the transport, because the session record has no\n * business being on an operation in the first place: it is stored on every\n * operation a local reactor writes, not only on the ones that go over a wire.\n *\n * The compiler cannot catch the difference — excess-property checks apply to\n * fresh object literals, never to a variable of a wider type — which is why\n * this is a function rather than a type annotation.\n */\nfunction toActionSigner(user: User | undefined): UserActionSigner | undefined {\n  if (!user) return undefined;\n  return {\n    address: user.address,\n    networkId: user.networkId,\n    chainId: user.chainId,\n  };\n}\n\nexport class Renown implements IRenown {\n  #baseUrl: string;\n  #store: RenownStorage;\n  #eventEmitter: RenownEventEmitter;\n  #appName: string;\n  #crypto: IRenownCrypto;\n  #signer: ISigner;\n  #profileFetcher?: ProfileFetcher;\n  #switchboard?: SwitchboardClient;\n  #chainId: number;\n  #status: LoginStatus = \"initial\";\n\n  constructor(\n    store: RenownStorage,\n    eventEmitter: RenownEventEmitter,\n    crypto: IRenownCrypto,\n    appName: string,\n    baseUrl = DEFAULT_RENOWN_URL,\n    profileFetcher?: ProfileFetcher,\n    switchboard?: SwitchboardClient,\n    chainId = Number(DEFAULT_RENOWN_CHAIN_ID),\n  ) {\n    this.#store = store;\n    this.#eventEmitter = eventEmitter;\n    this.#baseUrl = baseUrl;\n    this.#crypto = crypto;\n    this.#appName = appName;\n    this.#profileFetcher = profileFetcher;\n    this.#switchboard = switchboard;\n    this.#chainId = chainId;\n    const restoredUser = this.user;\n    this.#signer = new RenownCryptoSigner(\n      crypto,\n      this.#appName,\n      toActionSigner(restoredUser),\n    );\n\n    // A restored, previously-verified user is an authorized session; otherwise\n    // status stays \"initial\" after a reload while the user is present.\n    if (restoredUser) {\n      this.#status = \"authorized\";\n    }\n\n    this.on(\"user\", (user) => {\n      this.#signer.user = toActionSigner(user);\n    });\n  }\n\n  get baseUrl() {\n    return this.#baseUrl;\n  }\n\n  /** Chain id this app issues credentials on; a session from another chain is rejected by {@link signIn}. */\n  get chainId() {\n    return this.#chainId;\n  }\n\n  get user() {\n    return this.#store.get(\"user\");\n  }\n\n  get status() {\n    return this.#status;\n  }\n\n  get signer() {\n    return this.#signer;\n  }\n\n  get crypto() {\n    return this.#crypto;\n  }\n\n  get did() {\n    return this.#crypto.did;\n  }\n\n  get profileFetcher() {\n    return this.#profileFetcher;\n  }\n\n  #updateStatus(status: LoginStatus) {\n    this.#status = status;\n    this.#eventEmitter.emit(\"status\", status);\n  }\n\n  #updateUser(user: User | undefined) {\n    if (user) {\n      this.#store.set(\"user\", user);\n    } else {\n      this.#store.delete(\"user\");\n    }\n    this.#eventEmitter.emit(\"user\", user);\n  }\n\n  async login(userDid: string): Promise<User> {\n    this.#updateStatus(\"checking\");\n    try {\n      const result = parsePkhDid(userDid);\n      const credential = await this.#getCredential(\n        result.address,\n        result.chainId,\n        this.#crypto.did,\n      );\n\n      if (!credential) {\n        this.#updateUser(undefined);\n        throw new Error(\"Credential not found\");\n      }\n\n      return await this.#completeLogin(userDid, result, credential);\n    } catch (error) {\n      this.#updateUser(undefined);\n      this.#updateStatus(\"not-authorized\");\n      throw error;\n    }\n  }\n\n  // Sign in without the Renown redirect: build + sign a delegation credential\n  // with the caller's wallet signer, write it to the switchboard, then log in.\n  async signIn(params: SignInParams): Promise<User> {\n    if (!this.#switchboard) throw new MissingSwitchboardError();\n    const {\n      address,\n      chainId,\n      signTypedData,\n      username,\n      userImage,\n      expiresInDays,\n    } = params;\n\n    // The chain id goes into the issuer DID and the EIP-712 domain, so signing on\n    // another chain would mint a second identity for the same wallet.\n    if (chainId !== this.#chainId) {\n      throw new Error(\n        `Renown signIn: wallet is on chain ${chainId}, but this app issues credentials on chain ${this.#chainId}. Switch networks and retry — signing here would create a separate identity for the same address.`,\n      );\n    }\n\n    this.#updateStatus(\"checking\");\n    try {\n      const credential = await buildAndSignCredential({\n        signTypedData,\n        address,\n        chainId,\n        app: this.#appName,\n        appId: this.did,\n        expiresInDays,\n      });\n\n      await this.#switchboard.issueCredential(credential);\n\n      const userDid = `did:pkh:${DEFAULT_RENOWN_NETWORK_ID}:${chainId}:${address.toLowerCase()}`;\n      // Authenticate from the freshly signed credential — no read-back, which\n      // avoids racing the read-model processor that indexes the write.\n      const user = await this.#completeLogin(\n        userDid,\n        parsePkhDid(userDid),\n        credential,\n      );\n\n      // Best-effort profile write in the background: sign-in resolves without\n      // waiting for it (it may retry for a few seconds) and never fails on it.\n      if (username !== undefined || userImage !== undefined) {\n        void this.#writeProfile(address, { username, userImage }).catch(\n          () => undefined,\n        );\n      }\n\n      return user;\n    } catch (error) {\n      this.#updateUser(undefined);\n      this.#updateStatus(\"not-authorized\");\n      throw error;\n    }\n  }\n\n  // Write the profile via an authenticated request, retrying while the reactor's\n  // read model catches up to the just-issued credential (needed to authenticate).\n  async #writeProfile(\n    address: string,\n    profile: { username?: string; userImage?: string },\n  ): Promise<void> {\n    if (!this.#switchboard) return;\n    const token = await this.#crypto.getBearerToken(address);\n    const attempts = 5;\n    for (let attempt = 1; attempt <= attempts; attempt++) {\n      try {\n        await this.#switchboard.upsertUserProfile(address, profile, { token });\n        return;\n      } catch (error) {\n        if (attempt === attempts) throw error;\n        await new Promise((resolve) => setTimeout(resolve, 600));\n      }\n    }\n  }\n\n  // Verify a credential binds to userDid + this app key, set the user, and\n  // start the background profile fetch. Throws if the credential is invalid.\n  async #completeLogin(\n    userDid: string,\n    result: PKHDid,\n    credential: PowerhouseVerifiableCredential,\n  ): Promise<User> {\n    if (\n      !(\n        credential.issuer.id === userDid &&\n        credential.credentialSubject.id === this.did\n      )\n    ) {\n      throw new Error(\"Invalid credential\");\n    }\n\n    // The API may return proof.eip712 without domain/types; the domain is\n    // canonical (version \"1\", the chainId), so reconstruct it before verifying.\n    const eip712 = credential.proof.eip712 as\n      | Partial<IProof[\"eip712\"]>\n      | undefined;\n    const verifiableCredential: PowerhouseVerifiableCredential = eip712?.domain\n      ? credential\n      : {\n          ...credential,\n          proof: {\n            ...credential.proof,\n            eip712: {\n              domain: { version: \"1\", chainId: result.chainId },\n              types: CREDENTIAL_TYPES,\n              primaryType: \"VerifiableCredential\",\n            },\n          },\n        };\n\n    // Verify the EIP-712 proof was signed by the DID's address on its chain.\n    if (\n      credential.issuer.ethereumAddress.toLowerCase() !==\n        result.address.toLowerCase() ||\n      verifiableCredential.proof.eip712.domain.chainId !== result.chainId ||\n      !(await verifyCredentialSignature(verifiableCredential))\n    ) {\n      throw new Error(\"Invalid credential signature\");\n    }\n\n    const user: User = {\n      ...result,\n      address: credential.issuer.ethereumAddress,\n      did: userDid,\n      credential: verifiableCredential,\n    };\n\n    this.#updateUser(user);\n    this.#updateStatus(\"authorized\");\n\n    // Fetch profile data in the background if a fetcher is configured\n    if (this.#profileFetcher) {\n      this.#profileFetcher(user, this.#baseUrl)\n        .then((profile) => {\n          if (\n            profile &&\n            this.user?.address === user.address &&\n            this.user.chainId === user.chainId\n          ) {\n            this.#updateUser({\n              ...this.user,\n              profile,\n              ens: {\n                name: profile.username ?? undefined,\n                avatarUrl: profile.userImage ?? undefined,\n              },\n            });\n          }\n        })\n        .catch(console.error);\n    }\n\n    return user;\n  }\n\n  logout() {\n    this.#updateUser(undefined);\n    this.#updateStatus(\"initial\");\n    return Promise.resolve();\n  }\n\n  // Re-check the current user's credential at the source; logs out if it was\n  // revoked or expired. Network errors keep the session (fail open).\n  async revalidate(): Promise<boolean> {\n    const user = this.user;\n    if (!user) return false;\n    try {\n      const credential = await this.#getCredential(\n        user.address,\n        user.chainId,\n        this.#crypto.did,\n      );\n      if (!credential) {\n        await this.logout();\n        return false;\n      }\n      await this.refreshProfile();\n      return true;\n    } catch {\n      return true;\n    }\n  }\n\n  // Re-read profile attributes at the source so a renamed user or changed avatar\n  // shows up on the next load. Carries no logout risk, unlike revalidate().\n  async refreshProfile(): Promise<boolean> {\n    const user = this.user;\n    if (!user || !this.#profileFetcher) return false;\n    try {\n      const profile = await this.#profileFetcher(user, this.#baseUrl);\n      if (!profile) return false;\n      // Asserted because narrowing from the pre-await read would otherwise hide\n      // that a logout during the fetch can clear this.\n      const current = this.user as User | undefined;\n      if (\n        !current ||\n        current.address !== user.address ||\n        current.chainId !== user.chainId\n      ) {\n        return false;\n      }\n      // Narrow `profile` first: the fetched payload is unvalidated JSON, so a\n      // missing documentId must not make the undefined case compare equal.\n      const unchanged =\n        current.profile !== undefined &&\n        current.profile.documentId === profile.documentId &&\n        current.profile.username === profile.username &&\n        current.profile.userImage === profile.userImage;\n      if (unchanged) return false;\n      this.#updateUser({\n        ...current,\n        profile,\n        ens: {\n          name: profile.username ?? undefined,\n          avatarUrl: profile.userImage ?? undefined,\n        },\n      });\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  on<K extends keyof RenownEvents>(\n    event: K,\n    listener: (data: RenownEvents[K]) => void,\n  ): () => void {\n    return this.#eventEmitter.on(event, listener);\n  }\n\n  async #getCredential(\n    address: string,\n    chainId: number,\n    appDid: string,\n  ): Promise<PowerhouseVerifiableCredential | undefined> {\n    // Direct-switchboard flow: read the credential from the reactor subgraph.\n    if (this.#switchboard) {\n      return this.#switchboard.getCredential({ address, chainId, appDid });\n    }\n    if (!this.#baseUrl) {\n      throw new Error(\"RENOWN_URL is not set\");\n    }\n    const url = new URL(\n      `/api/auth/credential?address=${encodeURIComponent(address)}&chainId=${encodeURIComponent(chainId)}&connectId=${encodeURIComponent(appDid)}&appId=${encodeURIComponent(appDid)}`,\n      this.#baseUrl,\n    );\n    const response = await fetch(url, {\n      method: \"GET\",\n    });\n    if (response.ok) {\n      const result = (await response.json()) as {\n        credential: PowerhouseVerifiableCredential;\n      };\n      return result.credential;\n    } else {\n      throw new Error(`Failed to get credential: ${response.status}`);\n    }\n  }\n\n  async verifyBearerToken(token: string) {\n    return verifyAuthBearerToken(token);\n  }\n\n  async getBearerToken(options: CreateBearerTokenOptions) {\n    if (!this.user) {\n      throw new Error(\"User not found\");\n    }\n    return this.#crypto.getBearerToken(this.user.address, options);\n  }\n}\n","import type { RenownEvents } from \"../types.js\";\nimport type { IEventEmitter } from \"./types.js\";\n\nexport class MemoryEventEmitter implements IEventEmitter<RenownEvents> {\n  #listeners = new Map<keyof RenownEvents, Set<(data: unknown) => void>>();\n\n  on<K extends keyof RenownEvents>(\n    event: K,\n    listener: (data: RenownEvents[K]) => void,\n  ): () => void {\n    if (!this.#listeners.has(event)) {\n      this.#listeners.set(event, new Set());\n    }\n    this.#listeners.get(event)!.add(listener as (data: unknown) => void);\n    return () => {\n      this.#listeners.get(event)?.delete(listener as (data: unknown) => void);\n    };\n  }\n\n  emit<K extends keyof RenownEvents>(event: K, data: RenownEvents[K]): void {\n    this.#listeners.get(event)?.forEach((listener) => listener(data));\n  }\n}\n","import type { ProfileFetcher, RenownProfile } from \"./types.js\";\n\nexport const fetchRenownProfile: ProfileFetcher = async (user, baseUrl) => {\n  try {\n    const response = await fetch(`${baseUrl.replace(/\\/+$/, \"\")}/api/profile`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify({\n        ethAddress: user.address,\n      }),\n    });\n\n    if (!response.ok) {\n      return undefined;\n    }\n\n    const result = (await response.json()) as {\n      profile?: RenownProfile;\n    };\n\n    return result.profile ?? undefined;\n  } catch {\n    return undefined;\n  }\n};\n","import { Renown, RenownMemoryStorage } from \"./common.js\";\nimport { DEFAULT_RENOWN_CHAIN_ID, DEFAULT_RENOWN_URL } from \"./constants.js\";\nimport { RenownCryptoBuilder } from \"./crypto/renown-crypto-builder.js\";\nimport type { IRenownCrypto, JsonWebKeyPairStorage } from \"./crypto/types.js\";\nimport { resolveSwitchboardEndpoint } from \"./discovery.js\";\nimport { MemoryEventEmitter } from \"./event/memory.js\";\nimport { fetchRenownProfile } from \"./profile.js\";\nimport { SwitchboardClient } from \"./switchboard.js\";\nimport type {\n  ProfileFetcher,\n  RenownEventEmitter,\n  RenownStorage,\n} from \"./types.js\";\n\nexport interface RenownBuilderOptions {\n  appName: string;\n  storage?: RenownStorage;\n  eventEmitter?: RenownEventEmitter;\n  crypto?: IRenownCrypto;\n  keyPairStorage?: JsonWebKeyPairStorage;\n  baseUrl?: string;\n  switchboardUrl?: string;\n  profileFetcher?: ProfileFetcher;\n  /** Chain id credentials are issued on (default 1). The issuer DID embeds it, so `signIn` rejects a wallet session from another chain. */\n  chainId?: number;\n}\n\n/**\n * Base builder for creating Renown instances.\n * Use platform-specific builders (RenownBuilder from init.browser.js or init.node.js)\n * for pre-configured defaults.\n */\nexport class BaseRenownBuilder {\n  #appName: string;\n  #storage?: RenownStorage;\n  #eventEmitter?: RenownEventEmitter;\n  #crypto?: IRenownCrypto;\n  #keyPairStorage?: JsonWebKeyPairStorage;\n  #baseUrl?: string;\n  #switchboardUrl?: string;\n  #profileFetcher?: ProfileFetcher;\n  #chainId?: number;\n\n  /**\n   * @param appName - Application name used for signing context\n   */\n  constructor(appName: string) {\n    this.#appName = appName;\n  }\n\n  /**\n   * Set custom storage for user data persistence.\n   * Defaults to in-memory storage if not set.\n   */\n  withStorage(storage: RenownStorage): this {\n    this.#storage = storage;\n    return this;\n  }\n\n  /**\n   * Set custom event emitter for user state changes.\n   * Defaults to in-memory event emitter if not set.\n   */\n  withEventEmitter(eventEmitter: RenownEventEmitter): this {\n    this.#eventEmitter = eventEmitter;\n    return this;\n  }\n\n  /**\n   * Set a pre-built crypto instance.\n   * Either crypto or keyPairStorage must be provided.\n   */\n  withCrypto(crypto: IRenownCrypto): this {\n    this.#crypto = crypto;\n    return this;\n  }\n\n  /**\n   * Set key pair storage for cryptographic keys.\n   * A crypto instance will be built from this storage.\n   * Either crypto or keyPairStorage must be provided.\n   */\n  withKeyPairStorage(keyPairStorage: JsonWebKeyPairStorage): this {\n    this.#keyPairStorage = keyPairStorage;\n    return this;\n  }\n\n  /**\n   * Set the Renown server URL for credential verification.\n   * Defaults to https://www.renown.id\n   */\n  withBaseUrl(baseUrl: string): this {\n    this.#baseUrl = baseUrl;\n    return this;\n  }\n\n  // Set the Switchboard GraphQL endpoint to read from the reactor directly.\n  // When unset, the SDK discovers it from the base URL, else uses the REST flow.\n  withSwitchboardUrl(switchboardUrl: string): this {\n    this.#switchboardUrl = switchboardUrl;\n    return this;\n  }\n\n  // Set the chain id credentials are issued on (default 1). It is part of the\n  // issuer DID, so signIn rejects a wallet session from a different chain.\n  withChainId(chainId: number): this {\n    this.#chainId = chainId;\n    return this;\n  }\n\n  /**\n   * Set a profile fetcher strategy for enriching user data after login.\n   * The fetcher receives the authenticated user and the base URL,\n   * and returns a RenownProfile. Called in the background after each login.\n   * Defaults to fetchRenownProfile which calls the Renown API.\n   */\n  withProfileFetcher(profileFetcher: ProfileFetcher): this {\n    this.#profileFetcher = profileFetcher;\n    return this;\n  }\n\n  /**\n   * Build and initialize the Renown instance.\n   * If a user is stored, attempts to re-authenticate them.\n   * @throws Error if neither crypto nor keyPairStorage is provided\n   */\n  async build(): Promise<Renown> {\n    if (!this.#crypto && !this.#keyPairStorage) {\n      throw new Error(\n        \"Either crypto or keyPairStorage is required. Use withCrypto() or withKeyPairStorage() to set one.\",\n      );\n    }\n\n    const chainId = this.#chainId ?? Number(DEFAULT_RENOWN_CHAIN_ID);\n    const crypto =\n      this.#crypto ??\n      (await new RenownCryptoBuilder()\n        .withKeyPairStorage(this.#keyPairStorage!)\n        .withChainId(chainId)\n        .build());\n\n    // A crypto supplied via withCrypto() carries its own chain; the bearer token\n    // it mints would then disagree with the credentials issued here.\n    if (crypto.chainId !== undefined && crypto.chainId !== chainId) {\n      console.warn(\n        `Renown: the supplied crypto signs bearer tokens for chain ${crypto.chainId}, but credentials are issued on chain ${chainId}.`,\n      );\n    }\n\n    const storage = this.#storage ?? new RenownMemoryStorage();\n    const eventEmitter = this.#eventEmitter ?? new MemoryEventEmitter();\n    const baseUrl = this.#baseUrl ?? DEFAULT_RENOWN_URL;\n\n    // Pick the transport once: direct-switchboard when an endpoint resolves,\n    // else the REST flow. A custom profile fetcher always takes precedence.\n    const switchboardEndpoint = await resolveSwitchboardEndpoint({\n      switchboardUrl: this.#switchboardUrl,\n      baseUrl,\n    });\n    const switchboard = switchboardEndpoint\n      ? new SwitchboardClient(switchboardEndpoint)\n      : undefined;\n    const profileFetcher =\n      this.#profileFetcher ??\n      (switchboard ? switchboard.profileFetcher : fetchRenownProfile);\n\n    const renown = new Renown(\n      storage,\n      eventEmitter,\n      crypto,\n      this.#appName,\n      baseUrl,\n      profileFetcher,\n      switchboard,\n      chainId,\n    );\n\n    // A stored user is loaded as-is for an instant, offline-safe start; callers\n    // revalidate against the source separately via renown.revalidate().\n    return renown;\n  }\n\n  /**\n   * Create a BaseRenownBuilder from options object for a more concise API\n   */\n  static from(options: RenownBuilderOptions): BaseRenownBuilder {\n    const builder = new BaseRenownBuilder(options.appName);\n\n    if (options.storage) {\n      builder.withStorage(options.storage);\n    }\n    if (options.eventEmitter) {\n      builder.withEventEmitter(options.eventEmitter);\n    }\n    if (options.crypto) {\n      builder.withCrypto(options.crypto);\n    }\n    if (options.keyPairStorage) {\n      builder.withKeyPairStorage(options.keyPairStorage);\n    }\n    if (options.baseUrl) {\n      builder.withBaseUrl(options.baseUrl);\n    }\n    if (options.switchboardUrl) {\n      builder.withSwitchboardUrl(options.switchboardUrl);\n    }\n    if (options.profileFetcher) {\n      builder.withProfileFetcher(options.profileFetcher);\n    }\n    if (options.chainId !== undefined) {\n      builder.withChainId(options.chainId);\n    }\n\n    return builder;\n  }\n}\n","import { fetchDelegationCredential } from \"./credential.js\";\nimport type { SwitchboardRequestFn } from \"./switchboard.js\";\n\n/** Confirms an authenticated signer's delegation credential is still live. */\nexport type CredentialCheck = (params: {\n  address: string;\n  chainId: number;\n  appId: string;\n}) => Promise<boolean>;\n\nexport interface LocalCredentialVerifierOptions {\n  /** Notified when the read itself fails; the check then fails closed. */\n  onError?: (error: unknown) => void;\n}\n\n/** A credential check that reads a Switchboard's own renown read model through\n * `execute`, rather than any Renown or Switchboard over HTTP. */\nexport function createLocalCredentialVerifier(\n  execute: SwitchboardRequestFn,\n  options: LocalCredentialVerifierOptions = {},\n): CredentialCheck {\n  // fetchDelegationCredential turns a read failure into \"no credential\" — the\n  // right verdict, but silent; surface it before it is swallowed.\n  const request: SwitchboardRequestFn = async (query, variables) => {\n    try {\n      return await execute(query, variables);\n    } catch (error) {\n      options.onError?.(error);\n      throw error;\n    }\n  };\n\n  return async ({ address, chainId, appId }) => {\n    const credential = await fetchDelegationCredential({\n      address,\n      chainId,\n      appDid: appId,\n      switchboardRequest: request,\n    });\n    return credential !== undefined;\n  };\n}\n","// Canonical messages a caller personal_signs (EIP-191) to authorize a Renown\n// write without a login token. Kept byte-identical to renown-package\n// `subgraphs/renown-auth/core/signed-message.ts`, which verifies them; the\n// pinned strings in test/signed-message.test.ts guard both sides.\n\n// Signed actions (revoke, profile update) must carry a timestamp within this\n// window of the server's clock, in either direction. Signing a fresh message\n// and replaying an old one both fail outside this bound.\nexport const SIGNATURE_WINDOW_MS = 600_000;\n\nfunction toHex(bytes: Uint8Array): string {\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\")).join(\n    \"\",\n  );\n}\n\nasync function sha256hex(input: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(input),\n  );\n  return toHex(new Uint8Array(digest));\n}\n\n/** Canonical message a caller signs to authorize revoking `credentialId`. */\nexport function revokeMessage(credentialId: string, timestamp: string): string {\n  return `Revoke Renown credential ${credentialId} at ${timestamp}`;\n}\n\n/**\n * Canonical message a caller signs to authorize a profile upsert. The payload\n * is hashed (rather than embedded raw) so the signed message has a fixed\n * shape regardless of field content.\n */\nexport async function profileMessage(\n  address: string,\n  profile: { username?: string | null; userImage?: string | null },\n  timestamp: string,\n): Promise<string> {\n  const payload = JSON.stringify({\n    username: profile.username ?? null,\n    userImage: profile.userImage ?? null,\n  });\n  const hash = await sha256hex(payload);\n  return `Update Renown profile ${address.toLowerCase()} ${hash} at ${timestamp}`;\n}\n"],"mappings":";;;;;AASA,IAAsB,cAAtB,MAGyB,CAIzB;AAEA,IAAa,gBAAb,cAGU,YAAe;CACvB,uBAAwB,IAAI,IAAiB;CAE7C,IAAI,KAAU;EACZ,OAAO,KAAK,KAAK,IAAI,GAAG;CAC1B;CAEA,IAAI,KAAU,OAAsB;EAClC,IAAI,UAAU,KAAA,GACZ,KAAK,KAAK,OAAO,GAAG;OAEpB,KAAK,KAAK,IAAI,KAAK,KAAK;CAE5B;CAEA,OAAO,KAAgB;EACrB,KAAK,KAAK,OAAO,GAAG;CACtB;AACF;;;ACHA,IAAa,sBAAb,cAAyC,cAAgC,CAAC;;;;;;;;;;;;;;;;;;;;AAqB1E,SAAS,eAAe,MAAsD;CAC5E,IAAI,CAAC,MAAM,OAAO,KAAA;CAClB,OAAO;EACL,SAAS,KAAK;EACd,WAAW,KAAK;EAChB,SAAS,KAAK;CAChB;AACF;AAEA,IAAa,SAAb,MAAuC;CACrC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,UAAuB;CAEvB,YACE,OACA,cACA,QACA,SACA,UAAU,oBACV,gBACA,aACA,UAAU,GACV;EACA,KAAK,SAAS;EACd,KAAK,gBAAgB;EACrB,KAAK,WAAW;EAChB,KAAK,UAAU;EACf,KAAK,WAAW;EAChB,KAAK,kBAAkB;EACvB,KAAK,eAAe;EACpB,KAAK,WAAW;EAChB,MAAM,eAAe,KAAK;EAC1B,KAAK,UAAU,IAAI,mBACjB,QACA,KAAK,UACL,eAAe,YAAY,CAC7B;EAIA,IAAI,cACF,KAAK,UAAU;EAGjB,KAAK,GAAG,SAAS,SAAS;GACxB,KAAK,QAAQ,OAAO,eAAe,IAAI;EACzC,CAAC;CACH;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK;CACd;;CAGA,IAAI,UAAU;EACZ,OAAO,KAAK;CACd;CAEA,IAAI,OAAO;EACT,OAAO,KAAK,OAAO,IAAI,MAAM;CAC/B;CAEA,IAAI,SAAS;EACX,OAAO,KAAK;CACd;CAEA,IAAI,SAAS;EACX,OAAO,KAAK;CACd;CAEA,IAAI,SAAS;EACX,OAAO,KAAK;CACd;CAEA,IAAI,MAAM;EACR,OAAO,KAAK,QAAQ;CACtB;CAEA,IAAI,iBAAiB;EACnB,OAAO,KAAK;CACd;CAEA,cAAc,QAAqB;EACjC,KAAK,UAAU;EACf,KAAK,cAAc,KAAK,UAAU,MAAM;CAC1C;CAEA,YAAY,MAAwB;EAClC,IAAI,MACF,KAAK,OAAO,IAAI,QAAQ,IAAI;OAE5B,KAAK,OAAO,OAAO,MAAM;EAE3B,KAAK,cAAc,KAAK,QAAQ,IAAI;CACtC;CAEA,MAAM,MAAM,SAAgC;EAC1C,KAAK,cAAc,UAAU;EAC7B,IAAI;GACF,MAAM,SAAS,YAAY,OAAO;GAClC,MAAM,aAAa,MAAM,KAAK,eAC5B,OAAO,SACP,OAAO,SACP,KAAK,QAAQ,GACf;GAEA,IAAI,CAAC,YAAY;IACf,KAAK,YAAY,KAAA,CAAS;IAC1B,MAAM,IAAI,MAAM,sBAAsB;GACxC;GAEA,OAAO,MAAM,KAAK,eAAe,SAAS,QAAQ,UAAU;EAC9D,SAAS,OAAO;GACd,KAAK,YAAY,KAAA,CAAS;GAC1B,KAAK,cAAc,gBAAgB;GACnC,MAAM;EACR;CACF;CAIA,MAAM,OAAO,QAAqC;EAChD,IAAI,CAAC,KAAK,cAAc,MAAM,IAAI,wBAAwB;EAC1D,MAAM,EACJ,SACA,SACA,eACA,UACA,WACA,kBACE;EAIJ,IAAI,YAAY,KAAK,UACnB,MAAM,IAAI,MACR,qCAAqC,QAAQ,6CAA6C,KAAK,SAAS,kGAC1G;EAGF,KAAK,cAAc,UAAU;EAC7B,IAAI;GACF,MAAM,aAAa,MAAM,uBAAuB;IAC9C;IACA;IACA;IACA,KAAK,KAAK;IACV,OAAO,KAAK;IACZ;GACF,CAAC;GAED,MAAM,KAAK,aAAa,gBAAgB,UAAU;GAElD,MAAM,UAAU,WAAW,0BAA0B,GAAG,QAAQ,GAAG,QAAQ,YAAY;GAGvF,MAAM,OAAO,MAAM,KAAK,eACtB,SACA,YAAY,OAAO,GACnB,UACF;GAIA,IAAI,aAAa,KAAA,KAAa,cAAc,KAAA,GAC1C,KAAU,cAAc,SAAS;IAAE;IAAU;GAAU,CAAC,CAAC,CAAC,YAClD,KAAA,CACR;GAGF,OAAO;EACT,SAAS,OAAO;GACd,KAAK,YAAY,KAAA,CAAS;GAC1B,KAAK,cAAc,gBAAgB;GACnC,MAAM;EACR;CACF;CAIA,MAAM,cACJ,SACA,SACe;EACf,IAAI,CAAC,KAAK,cAAc;EACxB,MAAM,QAAQ,MAAM,KAAK,QAAQ,eAAe,OAAO;EACvD,MAAM,WAAW;EACjB,KAAK,IAAI,UAAU,GAAG,WAAW,UAAU,WACzC,IAAI;GACF,MAAM,KAAK,aAAa,kBAAkB,SAAS,SAAS,EAAE,MAAM,CAAC;GACrE;EACF,SAAS,OAAO;GACd,IAAI,YAAY,UAAU,MAAM;GAChC,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;EACzD;CAEJ;CAIA,MAAM,eACJ,SACA,QACA,YACe;EACf,IACE,EACE,WAAW,OAAO,OAAO,WACzB,WAAW,kBAAkB,OAAO,KAAK,MAG3C,MAAM,IAAI,MAAM,oBAAoB;EAQtC,MAAM,uBAHS,WAAW,MAAM,QAGqC,SACjE,aACA;GACE,GAAG;GACH,OAAO;IACL,GAAG,WAAW;IACd,QAAQ;KACN,QAAQ;MAAE,SAAS;MAAK,SAAS,OAAO;KAAQ;KAChD,OAAO;KACP,aAAa;IACf;GACF;EACF;EAGJ,IACE,WAAW,OAAO,gBAAgB,YAAY,MAC5C,OAAO,QAAQ,YAAY,KAC7B,qBAAqB,MAAM,OAAO,OAAO,YAAY,OAAO,WAC5D,CAAE,MAAM,0BAA0B,oBAAoB,GAEtD,MAAM,IAAI,MAAM,8BAA8B;EAGhD,MAAM,OAAa;GACjB,GAAG;GACH,SAAS,WAAW,OAAO;GAC3B,KAAK;GACL,YAAY;EACd;EAEA,KAAK,YAAY,IAAI;EACrB,KAAK,cAAc,YAAY;EAG/B,IAAI,KAAK,iBACP,KAAK,gBAAgB,MAAM,KAAK,QAAQ,CAAC,CACtC,MAAM,YAAY;GACjB,IACE,WACA,KAAK,MAAM,YAAY,KAAK,WAC5B,KAAK,KAAK,YAAY,KAAK,SAE3B,KAAK,YAAY;IACf,GAAG,KAAK;IACR;IACA,KAAK;KACH,MAAM,QAAQ,YAAY,KAAA;KAC1B,WAAW,QAAQ,aAAa,KAAA;IAClC;GACF,CAAC;EAEL,CAAC,CAAC,CACD,MAAM,QAAQ,KAAK;EAGxB,OAAO;CACT;CAEA,SAAS;EACP,KAAK,YAAY,KAAA,CAAS;EAC1B,KAAK,cAAc,SAAS;EAC5B,OAAO,QAAQ,QAAQ;CACzB;CAIA,MAAM,aAA+B;EACnC,MAAM,OAAO,KAAK;EAClB,IAAI,CAAC,MAAM,OAAO;EAClB,IAAI;GAMF,IAAI,CAAC,MALoB,KAAK,eAC5B,KAAK,SACL,KAAK,SACL,KAAK,QAAQ,GACf,GACiB;IACf,MAAM,KAAK,OAAO;IAClB,OAAO;GACT;GACA,MAAM,KAAK,eAAe;GAC1B,OAAO;EACT,QAAQ;GACN,OAAO;EACT;CACF;CAIA,MAAM,iBAAmC;EACvC,MAAM,OAAO,KAAK;EAClB,IAAI,CAAC,QAAQ,CAAC,KAAK,iBAAiB,OAAO;EAC3C,IAAI;GACF,MAAM,UAAU,MAAM,KAAK,gBAAgB,MAAM,KAAK,QAAQ;GAC9D,IAAI,CAAC,SAAS,OAAO;GAGrB,MAAM,UAAU,KAAK;GACrB,IACE,CAAC,WACD,QAAQ,YAAY,KAAK,WACzB,QAAQ,YAAY,KAAK,SAEzB,OAAO;GAST,IAJE,QAAQ,YAAY,KAAA,KACpB,QAAQ,QAAQ,eAAe,QAAQ,cACvC,QAAQ,QAAQ,aAAa,QAAQ,YACrC,QAAQ,QAAQ,cAAc,QAAQ,WACzB,OAAO;GACtB,KAAK,YAAY;IACf,GAAG;IACH;IACA,KAAK;KACH,MAAM,QAAQ,YAAY,KAAA;KAC1B,WAAW,QAAQ,aAAa,KAAA;IAClC;GACF,CAAC;GACD,OAAO;EACT,QAAQ;GACN,OAAO;EACT;CACF;CAEA,GACE,OACA,UACY;EACZ,OAAO,KAAK,cAAc,GAAG,OAAO,QAAQ;CAC9C;CAEA,MAAM,eACJ,SACA,SACA,QACqD;EAErD,IAAI,KAAK,cACP,OAAO,KAAK,aAAa,cAAc;GAAE;GAAS;GAAS;EAAO,CAAC;EAErE,IAAI,CAAC,KAAK,UACR,MAAM,IAAI,MAAM,uBAAuB;EAEzC,MAAM,MAAM,IAAI,IACd,gCAAgC,mBAAmB,OAAO,EAAE,WAAW,mBAAmB,OAAO,EAAE,aAAa,mBAAmB,MAAM,EAAE,SAAS,mBAAmB,MAAM,KAC7K,KAAK,QACP;EACA,MAAM,WAAW,MAAM,MAAM,KAAK,EAChC,QAAQ,MACV,CAAC;EACD,IAAI,SAAS,IAIX,QAAO,MAHe,SAAS,KAAK,EAAA,CAGtB;OAEd,MAAM,IAAI,MAAM,6BAA6B,SAAS,QAAQ;CAElE;CAEA,MAAM,kBAAkB,OAAe;EACrC,OAAO,sBAAsB,KAAK;CACpC;CAEA,MAAM,eAAe,SAAmC;EACtD,IAAI,CAAC,KAAK,MACR,MAAM,IAAI,MAAM,gBAAgB;EAElC,OAAO,KAAK,QAAQ,eAAe,KAAK,KAAK,SAAS,OAAO;CAC/D;AACF;;;ACtcA,IAAa,qBAAb,MAAuE;CACrE,6BAAa,IAAI,IAAsD;CAEvE,GACE,OACA,UACY;EACZ,IAAI,CAAC,KAAK,WAAW,IAAI,KAAK,GAC5B,KAAK,WAAW,IAAI,uBAAO,IAAI,IAAI,CAAC;EAEtC,KAAK,WAAW,IAAI,KAAK,CAAC,CAAE,IAAI,QAAmC;EACnE,aAAa;GACX,KAAK,WAAW,IAAI,KAAK,CAAC,EAAE,OAAO,QAAmC;EACxE;CACF;CAEA,KAAmC,OAAU,MAA6B;EACxE,KAAK,WAAW,IAAI,KAAK,CAAC,EAAE,SAAS,aAAa,SAAS,IAAI,CAAC;CAClE;AACF;;;ACpBA,MAAa,qBAAqC,OAAO,MAAM,YAAY;CACzE,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,QAAQ,QAAQ,EAAE,EAAE,eAAe;GACzE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,EACnB,YAAY,KAAK,QACnB,CAAC;EACH,CAAC;EAED,IAAI,CAAC,SAAS,IACZ;EAOF,QAAO,MAJe,SAAS,KAAK,EAAA,CAItB,WAAW,KAAA;CAC3B,QAAQ;EACN;CACF;AACF;;;;;;;;ACMA,IAAa,oBAAb,MAAa,kBAAkB;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;CAKA,YAAY,SAAiB;EAC3B,KAAK,WAAW;CAClB;;;;;CAMA,YAAY,SAA8B;EACxC,KAAK,WAAW;EAChB,OAAO;CACT;;;;;CAMA,iBAAiB,cAAwC;EACvD,KAAK,gBAAgB;EACrB,OAAO;CACT;;;;;CAMA,WAAW,QAA6B;EACtC,KAAK,UAAU;EACf,OAAO;CACT;;;;;;CAOA,mBAAmB,gBAA6C;EAC9D,KAAK,kBAAkB;EACvB,OAAO;CACT;;;;;CAMA,YAAY,SAAuB;EACjC,KAAK,WAAW;EAChB,OAAO;CACT;CAIA,mBAAmB,gBAA8B;EAC/C,KAAK,kBAAkB;EACvB,OAAO;CACT;CAIA,YAAY,SAAuB;EACjC,KAAK,WAAW;EAChB,OAAO;CACT;;;;;;;CAQA,mBAAmB,gBAAsC;EACvD,KAAK,kBAAkB;EACvB,OAAO;CACT;;;;;;CAOA,MAAM,QAAyB;EAC7B,IAAI,CAAC,KAAK,WAAW,CAAC,KAAK,iBACzB,MAAM,IAAI,MACR,mGACF;EAGF,MAAM,UAAU,KAAK,YAAY;EACjC,MAAM,SACJ,KAAK,WACJ,MAAM,IAAI,oBAAoB,CAAC,CAC7B,mBAAmB,KAAK,eAAgB,CAAC,CACzC,YAAY,OAAO,CAAC,CACpB,MAAM;EAIX,IAAI,OAAO,YAAY,KAAA,KAAa,OAAO,YAAY,SACrD,QAAQ,KACN,6DAA6D,OAAO,QAAQ,wCAAwC,QAAQ,EAC9H;EAGF,MAAM,UAAU,KAAK,YAAY,IAAI,oBAAoB;EACzD,MAAM,eAAe,KAAK,iBAAiB,IAAI,mBAAmB;EAClE,MAAM,UAAU,KAAK,YAAA;EAIrB,MAAM,sBAAsB,MAAM,2BAA2B;GAC3D,gBAAgB,KAAK;GACrB;EACF,CAAC;EACD,MAAM,cAAc,sBAChB,IAAI,kBAAkB,mBAAmB,IACzC,KAAA;EACJ,MAAM,iBACJ,KAAK,oBACJ,cAAc,YAAY,iBAAiB;EAe9C,OAAO,IAbY,OACjB,SACA,cACA,QACA,KAAK,UACL,SACA,gBACA,aACA,OAKU;CACd;;;;CAKA,OAAO,KAAK,SAAkD;EAC5D,MAAM,UAAU,IAAI,kBAAkB,QAAQ,OAAO;EAErD,IAAI,QAAQ,SACV,QAAQ,YAAY,QAAQ,OAAO;EAErC,IAAI,QAAQ,cACV,QAAQ,iBAAiB,QAAQ,YAAY;EAE/C,IAAI,QAAQ,QACV,QAAQ,WAAW,QAAQ,MAAM;EAEnC,IAAI,QAAQ,gBACV,QAAQ,mBAAmB,QAAQ,cAAc;EAEnD,IAAI,QAAQ,SACV,QAAQ,YAAY,QAAQ,OAAO;EAErC,IAAI,QAAQ,gBACV,QAAQ,mBAAmB,QAAQ,cAAc;EAEnD,IAAI,QAAQ,gBACV,QAAQ,mBAAmB,QAAQ,cAAc;EAEnD,IAAI,QAAQ,YAAY,KAAA,GACtB,QAAQ,YAAY,QAAQ,OAAO;EAGrC,OAAO;CACT;AACF;;;;;ACtMA,SAAgB,8BACd,SACA,UAA0C,CAAC,GAC1B;CAGjB,MAAM,UAAgC,OAAO,OAAO,cAAc;EAChE,IAAI;GACF,OAAO,MAAM,QAAQ,OAAO,SAAS;EACvC,SAAS,OAAO;GACd,QAAQ,UAAU,KAAK;GACvB,MAAM;EACR;CACF;CAEA,OAAO,OAAO,EAAE,SAAS,SAAS,YAAY;EAO5C,OAAO,MANkB,0BAA0B;GACjD;GACA;GACA,QAAQ;GACR,oBAAoB;EACtB,CAAC,MACqB,KAAA;CACxB;AACF;;;ACjCA,MAAa,sBAAsB;AAEnC,SAAS,MAAM,OAA2B;CACxC,OAAO,MAAM,KAAK,QAAQ,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KACrE,EACF;AACF;AAEA,eAAe,UAAU,OAAgC;CACvD,MAAM,SAAS,MAAM,OAAO,OAAO,OACjC,WACA,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAChC;CACA,OAAO,MAAM,IAAI,WAAW,MAAM,CAAC;AACrC;;AAGA,SAAgB,cAAc,cAAsB,WAA2B;CAC7E,OAAO,4BAA4B,aAAa,MAAM;AACxD;;;;;;AAOA,eAAsB,eACpB,SACA,SACA,WACiB;CAKjB,MAAM,OAAO,MAAM,UAJH,KAAK,UAAU;EAC7B,UAAU,QAAQ,YAAY;EAC9B,WAAW,QAAQ,aAAa;CAClC,CACmC,CAAC;CACpC,OAAO,yBAAyB,QAAQ,YAAY,EAAE,GAAG,KAAK,MAAM;AACtE"}