@rhinestone/1auth 0.6.8 → 0.6.10

package/dist/server.d.mts

@@ -0,0 +1,118 @@
+import { Address, Hex } from 'viem';
+export { e as encodeWebAuthnSignature, a as hashMessage, v as verifyMessageHash } from './verify-C8-a5c3K.mjs';
+export { W as WebAuthnSignature } from './types-U_dwxbtS.mjs';
+import '@rhinestone/sdk';
+
+/**
+ * Server-side utilities for JWT sponsorship.
+ *
+ * The recommended entry point is `createSponsorshipSigner`, a
+ * framework-agnostic factory that reads credentials from environment
+ * variables and exposes the two operations each sponsorship endpoint
+ * needs: `accessToken()` and `extensionToken(intentOp)`.
+ *
+ * For custom claims or non-standard flows, `createJwtSigner` is exposed as
+ * an escape hatch. The implementation lives here instead of re-exporting
+ * `@rhinestone/sdk/jwt-server` directly so downstream app builds do not need
+ * to resolve the SDK's optional Express adapter surface.
+ *
+ * @example Next.js App Router
+ * ```ts
+ * // app/api/sponsorship/access-token/route.ts
+ * import { createSponsorshipSigner } from "@rhinestone/1auth/server";
+ *
+ * const signer = createSponsorshipSigner();
+ *
+ * export async function GET() {
+ *   // Guard with your own session/auth before minting.
+ *   return Response.json({ token: await signer.accessToken() });
+ * }
+ * ```
+ */
+
+interface JwtCredentials {
+    privateKey: JsonWebKey;
+    integratorId: string;
+    projectId: string;
+    appId: string;
+    keyId: string;
+    audience?: string;
+}
+interface SponsorshipFilter {
+    chain?: (chain: {
+        id: number;
+    }) => boolean | Promise<boolean>;
+    account?: (address: Address) => boolean | Promise<boolean>;
+    calls?: (calls: {
+        to: Address;
+        value: bigint;
+        data: Hex;
+    }[]) => boolean | Promise<boolean>;
+}
+interface JwtSignerConfig {
+    jwt: JwtCredentials;
+    shouldSponsor?: SponsorshipFilter;
+}
+declare class SponsorshipDeniedError extends Error {
+    constructor();
+}
+/**
+ * Sponsorship signer used by the two endpoints the SDK client calls:
+ *
+ * - `accessToken()` — mints the app's identity token; return as
+ *   `{ token }` from `GET /sponsorship/access-token`.
+ * - `extensionToken(intentOp)` — mints a per-intent sponsorship grant;
+ *   return as `{ token }` from `POST /sponsorship/extension-token`.
+ *   Accepts either the JSON-stringified `intentOp` the SDK sends or a
+ *   pre-parsed object.
+ */
+interface SponsorshipSigner {
+    accessToken(): Promise<string>;
+    extensionToken(intentOp: string | object): Promise<string>;
+}
+interface CreateSponsorshipSignerOptions {
+    /** Override all credentials explicitly (skips env lookup). */
+    credentials?: JwtCredentials;
+    /** Override the env source (defaults to `process.env`). */
+    env?: NodeJS.ProcessEnv;
+    /** Optional per-intent sponsorship filter (see `@rhinestone/sdk/jwt-server`). */
+    shouldSponsor?: SponsorshipFilter;
+}
+interface VerifyOneAuthAccountOptions {
+    /** 1auth provider origin, for example `https://passkey.1auth.box`. */
+    providerUrl: string;
+    /** Smart account address returned by a successful 1auth auth result. */
+    address: Address;
+    /** Optional app client id forwarded to provider APIs that scope by app. */
+    clientId?: string;
+    /** Injectable fetch implementation for tests and non-standard runtimes. */
+    fetch?: typeof fetch;
+}
+interface VerifiedOneAuthAccount {
+    address: Address;
+    deployed?: boolean;
+    chainId?: number;
+}
+/** Error raised when the provider cannot bind an address to a 1auth account. */
+declare class OneAuthAccountVerificationError extends Error {
+    constructor(message: string);
+}
+/**
+ * Verify that an address belongs to a 1auth account known by the configured
+ * provider. This is intended for server-side app sessions that already have a
+ * fresh challenge signature and need to reject arbitrary ERC-1271 contracts.
+ */
+declare function verifyOneAuthAccount(options: VerifyOneAuthAccountOptions): Promise<VerifiedOneAuthAccount>;
+/**
+ * Create a low-level JWT signer compatible with Rhinestone sponsorship flows.
+ *
+ * This mirrors the upstream SDK behavior while keeping our public server entry
+ * point self-contained for app bundlers.
+ */
+declare function createJwtSigner(config: JwtSignerConfig): {
+    accessToken: () => Promise<string>;
+    getIntentExtensionToken: (intentInput: unknown) => Promise<string>;
+};
+declare function createSponsorshipSigner(options?: CreateSponsorshipSignerOptions): SponsorshipSigner;
+
+export { type CreateSponsorshipSignerOptions, type JwtCredentials, type JwtSignerConfig, OneAuthAccountVerificationError, SponsorshipDeniedError, type SponsorshipFilter, type SponsorshipSigner, type VerifiedOneAuthAccount, type VerifyOneAuthAccountOptions, createJwtSigner, createSponsorshipSigner, verifyOneAuthAccount };

package/dist/server.d.ts

@@ -0,0 +1,118 @@
+import { Address, Hex } from 'viem';
+export { e as encodeWebAuthnSignature, a as hashMessage, v as verifyMessageHash } from './verify-BLgZzwmJ.js';
+export { W as WebAuthnSignature } from './types-U_dwxbtS.js';
+import '@rhinestone/sdk';
+
+/**
+ * Server-side utilities for JWT sponsorship.
+ *
+ * The recommended entry point is `createSponsorshipSigner`, a
+ * framework-agnostic factory that reads credentials from environment
+ * variables and exposes the two operations each sponsorship endpoint
+ * needs: `accessToken()` and `extensionToken(intentOp)`.
+ *
+ * For custom claims or non-standard flows, `createJwtSigner` is exposed as
+ * an escape hatch. The implementation lives here instead of re-exporting
+ * `@rhinestone/sdk/jwt-server` directly so downstream app builds do not need
+ * to resolve the SDK's optional Express adapter surface.
+ *
+ * @example Next.js App Router
+ * ```ts
+ * // app/api/sponsorship/access-token/route.ts
+ * import { createSponsorshipSigner } from "@rhinestone/1auth/server";
+ *
+ * const signer = createSponsorshipSigner();
+ *
+ * export async function GET() {
+ *   // Guard with your own session/auth before minting.
+ *   return Response.json({ token: await signer.accessToken() });
+ * }
+ * ```
+ */
+
+interface JwtCredentials {
+    privateKey: JsonWebKey;
+    integratorId: string;
+    projectId: string;
+    appId: string;
+    keyId: string;
+    audience?: string;
+}
+interface SponsorshipFilter {
+    chain?: (chain: {
+        id: number;
+    }) => boolean | Promise<boolean>;
+    account?: (address: Address) => boolean | Promise<boolean>;
+    calls?: (calls: {
+        to: Address;
+        value: bigint;
+        data: Hex;
+    }[]) => boolean | Promise<boolean>;
+}
+interface JwtSignerConfig {
+    jwt: JwtCredentials;
+    shouldSponsor?: SponsorshipFilter;
+}
+declare class SponsorshipDeniedError extends Error {
+    constructor();
+}
+/**
+ * Sponsorship signer used by the two endpoints the SDK client calls:
+ *
+ * - `accessToken()` — mints the app's identity token; return as
+ *   `{ token }` from `GET /sponsorship/access-token`.
+ * - `extensionToken(intentOp)` — mints a per-intent sponsorship grant;
+ *   return as `{ token }` from `POST /sponsorship/extension-token`.
+ *   Accepts either the JSON-stringified `intentOp` the SDK sends or a
+ *   pre-parsed object.
+ */
+interface SponsorshipSigner {
+    accessToken(): Promise<string>;
+    extensionToken(intentOp: string | object): Promise<string>;
+}
+interface CreateSponsorshipSignerOptions {
+    /** Override all credentials explicitly (skips env lookup). */
+    credentials?: JwtCredentials;
+    /** Override the env source (defaults to `process.env`). */
+    env?: NodeJS.ProcessEnv;
+    /** Optional per-intent sponsorship filter (see `@rhinestone/sdk/jwt-server`). */
+    shouldSponsor?: SponsorshipFilter;
+}
+interface VerifyOneAuthAccountOptions {
+    /** 1auth provider origin, for example `https://passkey.1auth.box`. */
+    providerUrl: string;
+    /** Smart account address returned by a successful 1auth auth result. */
+    address: Address;
+    /** Optional app client id forwarded to provider APIs that scope by app. */
+    clientId?: string;
+    /** Injectable fetch implementation for tests and non-standard runtimes. */
+    fetch?: typeof fetch;
+}
+interface VerifiedOneAuthAccount {
+    address: Address;
+    deployed?: boolean;
+    chainId?: number;
+}
+/** Error raised when the provider cannot bind an address to a 1auth account. */
+declare class OneAuthAccountVerificationError extends Error {
+    constructor(message: string);
+}
+/**
+ * Verify that an address belongs to a 1auth account known by the configured
+ * provider. This is intended for server-side app sessions that already have a
+ * fresh challenge signature and need to reject arbitrary ERC-1271 contracts.
+ */
+declare function verifyOneAuthAccount(options: VerifyOneAuthAccountOptions): Promise<VerifiedOneAuthAccount>;
+/**
+ * Create a low-level JWT signer compatible with Rhinestone sponsorship flows.
+ *
+ * This mirrors the upstream SDK behavior while keeping our public server entry
+ * point self-contained for app bundlers.
+ */
+declare function createJwtSigner(config: JwtSignerConfig): {
+    accessToken: () => Promise<string>;
+    getIntentExtensionToken: (intentInput: unknown) => Promise<string>;
+};
+declare function createSponsorshipSigner(options?: CreateSponsorshipSignerOptions): SponsorshipSigner;
+
+export { type CreateSponsorshipSignerOptions, type JwtCredentials, type JwtSignerConfig, OneAuthAccountVerificationError, SponsorshipDeniedError, type SponsorshipFilter, type SponsorshipSigner, type VerifiedOneAuthAccount, type VerifyOneAuthAccountOptions, createJwtSigner, createSponsorshipSigner, verifyOneAuthAccount };

package/dist/server.js

@@ -0,0 +1,356 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  OneAuthAccountVerificationError: () => OneAuthAccountVerificationError,
+  SponsorshipDeniedError: () => SponsorshipDeniedError,
+  createJwtSigner: () => createJwtSigner,
+  createSponsorshipSigner: () => createSponsorshipSigner,
+  encodeWebAuthnSignature: () => encodeWebAuthnSignature,
+  hashMessage: () => hashMessage,
+  verifyMessageHash: () => verifyMessageHash,
+  verifyOneAuthAccount: () => verifyOneAuthAccount
+});
+module.exports = __toCommonJS(server_exports);
+var import_jose = require("jose");
+var import_viem3 = require("viem");
+
+// src/verify.ts
+var import_viem = require("viem");
+var ETHEREUM_MESSAGE_PREFIX = "Ethereum Signed Message:\n";
+function hashMessage(message) {
+  const messageBytes = (0, import_viem.toBytes)(message);
+  const prefixed = ETHEREUM_MESSAGE_PREFIX + messageBytes.length.toString() + message;
+  return (0, import_viem.keccak256)((0, import_viem.toBytes)(prefixed));
+}
+function verifyMessageHash(message, signedHash) {
+  if (!signedHash) return false;
+  const expectedHash = hashMessage(message);
+  return expectedHash.toLowerCase() === signedHash.toLowerCase();
+}
+
+// src/walletClient/utils.ts
+var import_viem2 = require("viem");
+var P256_N = BigInt(
+  "0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"
+);
+var P256_N_DIV_2 = P256_N / 2n;
+var WEBAUTHN_AUTH_TYPE = {
+  type: "tuple",
+  components: [
+    { type: "bytes", name: "authenticatorData" },
+    { type: "string", name: "clientDataJSON" },
+    { type: "uint256", name: "challengeIndex" },
+    { type: "uint256", name: "typeIndex" },
+    { type: "uint256", name: "r" },
+    { type: "uint256", name: "s" }
+  ]
+};
+function encodeWebAuthnSignature(sig) {
+  let s = BigInt(sig.s);
+  if (s > P256_N_DIV_2) {
+    s = P256_N - s;
+  }
+  return (0, import_viem2.encodeAbiParameters)([WEBAUTHN_AUTH_TYPE], [
+    {
+      authenticatorData: sig.authenticatorData,
+      clientDataJSON: sig.clientDataJSON,
+      challengeIndex: BigInt(sig.challengeIndex),
+      typeIndex: BigInt(sig.typeIndex),
+      r: BigInt(sig.r),
+      s
+    }
+  ]);
+}
+
+// src/server.ts
+var SponsorshipDeniedError = class extends Error {
+  constructor() {
+    super("Sponsorship denied");
+    this.name = "SponsorshipDeniedError";
+  }
+};
+var OneAuthAccountVerificationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "OneAuthAccountVerificationError";
+  }
+};
+var ENV_KEYS = {
+  privateKey: "RHINESTONE_JWT_PRIVATE_KEY",
+  integratorId: "RHINESTONE_INTEGRATOR_ID",
+  projectId: "RHINESTONE_PROJECT_ID",
+  appId: "RHINESTONE_APP_ID",
+  keyId: "RHINESTONE_KEY_ID"
+};
+function accountLookupUrl(providerUrl, address) {
+  return new URL(`/api/account/${address.toLowerCase()}`, providerUrl).toString();
+}
+async function parseAccountLookupResponse(response) {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+async function verifyOneAuthAccount(options) {
+  if (!(0, import_viem3.isAddress)(options.address)) {
+    throw new OneAuthAccountVerificationError(
+      "A valid 1auth account address is required"
+    );
+  }
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") {
+    throw new OneAuthAccountVerificationError(
+      "No fetch implementation is available to verify the 1auth account"
+    );
+  }
+  const url = accountLookupUrl(options.providerUrl, options.address);
+  const headers = { accept: "application/json" };
+  if (options.clientId) headers["x-client-id"] = options.clientId;
+  let response;
+  try {
+    response = await fetchImpl(url, {
+      headers,
+      cache: "no-store"
+    });
+  } catch (error) {
+    throw new OneAuthAccountVerificationError(
+      `Unable to reach the configured 1auth provider: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  const body = await parseAccountLookupResponse(response);
+  if (!response.ok) {
+    const message = body && typeof body === "object" && "error" in body ? String(body.error) : response.statusText || "account lookup failed";
+    throw new OneAuthAccountVerificationError(
+      `Configured 1auth provider did not recognize this account (${response.status}: ${message})`
+    );
+  }
+  const account = body;
+  if (!account?.address || !(0, import_viem3.isAddress)(account.address)) {
+    throw new OneAuthAccountVerificationError(
+      "Configured 1auth provider returned a malformed account record"
+    );
+  }
+  if (account.address.toLowerCase() !== options.address.toLowerCase()) {
+    throw new OneAuthAccountVerificationError(
+      "Configured 1auth provider returned a different account address"
+    );
+  }
+  return {
+    address: account.address,
+    deployed: typeof account.deployed === "boolean" ? account.deployed : void 0,
+    chainId: typeof account.chainId === "number" ? account.chainId : void 0
+  };
+}
+function jcsCanonicalise(value) {
+  return serialize(value);
+}
+function serialize(value) {
+  if (value === null || value === void 0) {
+    return "null";
+  }
+  switch (typeof value) {
+    case "boolean":
+      return value ? "true" : "false";
+    case "number":
+      if (!Number.isFinite(value)) {
+        throw new Error(`JCS: non-finite number: ${value}`);
+      }
+      return Object.is(value, -0) ? "0" : String(value);
+    case "string":
+      return JSON.stringify(value);
+    case "bigint":
+      if (value > BigInt(Number.MAX_SAFE_INTEGER) || value < BigInt(-Number.MAX_SAFE_INTEGER)) {
+        throw new Error(
+          `JCS: BigInt ${value} exceeds safe integer range \u2014 convert to string before calling`
+        );
+      }
+      return String(value);
+    default:
+      break;
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => serialize(item)).join(",")}]`;
+  }
+  const obj = value;
+  const members = [];
+  for (const key of Object.keys(obj).sort()) {
+    const item = obj[key];
+    if (item === void 0) continue;
+    members.push(`${JSON.stringify(key)}:${serialize(item)}`);
+  }
+  return `{${members.join(",")}}`;
+}
+async function computeIntentInputDigest(intentInput) {
+  const canonical = jcsCanonicalise(intentInput);
+  const encoded = new TextEncoder().encode(canonical);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", encoded);
+  return Array.from(new Uint8Array(hashBuffer)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function parseIntentInput(intentInput) {
+  if (typeof intentInput !== "object" || intentInput === null) {
+    throw new Error("intentInput must be a non-null object");
+  }
+  const input = intentInput;
+  if (typeof input.destinationChainId !== "number") {
+    throw new Error("intentInput.destinationChainId must be a number");
+  }
+  if (typeof input.account !== "object" || input.account === null) {
+    throw new Error("intentInput.account must be a non-null object");
+  }
+  if (typeof input.account.address !== "string") {
+    throw new Error("intentInput.account.address must be a string");
+  }
+  if (!Array.isArray(input.destinationExecutions)) {
+    throw new Error("intentInput.destinationExecutions must be an array");
+  }
+  return {
+    chain: { id: input.destinationChainId },
+    account: input.account.address,
+    calls: input.destinationExecutions.map((execution) => ({
+      to: execution.to,
+      value: BigInt(execution.value),
+      data: execution.data
+    }))
+  };
+}
+async function shouldSponsor(intentInput, filters) {
+  const parsed = parseIntentInput(intentInput);
+  if (filters.chain && !await filters.chain(parsed.chain)) {
+    return false;
+  }
+  if (filters.account && !await filters.account(parsed.account)) {
+    return false;
+  }
+  if (filters.calls && !await filters.calls(parsed.calls)) {
+    return false;
+  }
+  return true;
+}
+function pickAlg(jwk) {
+  if (jwk.kty === "EC") {
+    if (jwk.crv === "P-256") return "ES256";
+    if (jwk.crv === "P-384") return "ES384";
+    if (jwk.crv === "P-521") return "ES512";
+    throw new Error(`Unsupported EC curve: ${jwk.crv}`);
+  }
+  if (jwk.kty === "RSA") return "RS256";
+  throw new Error(`Unsupported JWK kty: ${jwk.kty}`);
+}
+function createJwtSigner(config) {
+  const {
+    jwt: {
+      privateKey,
+      integratorId,
+      projectId,
+      appId,
+      keyId,
+      audience = "rhinestone-api"
+    },
+    shouldSponsor: filters
+  } = config;
+  const alg = pickAlg(privateKey);
+  let cachedKey = null;
+  async function getKey() {
+    if (!cachedKey) {
+      cachedKey = await (0, import_jose.importJWK)(privateKey, alg);
+    }
+    return cachedKey;
+  }
+  return {
+    accessToken: async () => {
+      const key = await getKey();
+      return new import_jose.SignJWT({ typ: "access", app_id: appId }).setProtectedHeader({ alg, kid: keyId }).setIssuer(integratorId).setSubject(projectId).setAudience(audience).setIssuedAt().setExpirationTime("1h").sign(key);
+    },
+    getIntentExtensionToken: async (intentInput) => {
+      if (filters && !await shouldSponsor(intentInput, filters)) {
+        throw new SponsorshipDeniedError();
+      }
+      const key = await getKey();
+      const digest = await computeIntentInputDigest(intentInput);
+      return new import_jose.SignJWT({
+        typ: "intent_extension",
+        app_id: appId,
+        jti: crypto.randomUUID(),
+        policy: {
+          sponsorship: {
+            scope: "intent",
+            intent_input: { digest }
+          }
+        }
+      }).setProtectedHeader({ alg, kid: keyId }).setIssuer(integratorId).setSubject(projectId).setAudience(audience).setIssuedAt().setExpirationTime("5m").sign(key);
+    }
+  };
+}
+function readCredentialsFromEnv(env) {
+  const missing = [];
+  const read = (key) => {
+    const value = env[key];
+    if (!value) missing.push(key);
+    return value ?? "";
+  };
+  const privateKeyRaw = read(ENV_KEYS.privateKey);
+  const integratorId = read(ENV_KEYS.integratorId);
+  const projectId = read(ENV_KEYS.projectId);
+  const appId = read(ENV_KEYS.appId);
+  const keyId = read(ENV_KEYS.keyId);
+  if (missing.length > 0) {
+    throw new Error(
+      `createSponsorshipSigner: missing env var(s): ${missing.join(", ")}`
+    );
+  }
+  let privateKey;
+  try {
+    privateKey = JSON.parse(privateKeyRaw);
+  } catch {
+    throw new Error(
+      `createSponsorshipSigner: ${ENV_KEYS.privateKey} must be a JSON-encoded JWK`
+    );
+  }
+  return { privateKey, integratorId, projectId, appId, keyId };
+}
+function createSponsorshipSigner(options = {}) {
+  const credentials = options.credentials ?? readCredentialsFromEnv(options.env ?? process.env);
+  const inner = createJwtSigner({
+    jwt: credentials,
+    shouldSponsor: options.shouldSponsor
+  });
+  return {
+    accessToken: () => inner.accessToken(),
+    extensionToken: (intentOp) => {
+      const intentInput = typeof intentOp === "string" ? JSON.parse(intentOp) : intentOp;
+      return inner.getIntentExtensionToken(intentInput);
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OneAuthAccountVerificationError,
+  SponsorshipDeniedError,
+  createJwtSigner,
+  createSponsorshipSigner,
+  encodeWebAuthnSignature,
+  hashMessage,
+  verifyMessageHash,
+  verifyOneAuthAccount
+});
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts","../src/verify.ts","../src/walletClient/utils.ts"],"sourcesContent":["/**\n * Server-side utilities for JWT sponsorship.\n *\n * The recommended entry point is `createSponsorshipSigner`, a\n * framework-agnostic factory that reads credentials from environment\n * variables and exposes the two operations each sponsorship endpoint\n * needs: `accessToken()` and `extensionToken(intentOp)`.\n *\n * For custom claims or non-standard flows, `createJwtSigner` is exposed as\n * an escape hatch. The implementation lives here instead of re-exporting\n * `@rhinestone/sdk/jwt-server` directly so downstream app builds do not need\n * to resolve the SDK's optional Express adapter surface.\n *\n * @example Next.js App Router\n * ```ts\n * // app/api/sponsorship/access-token/route.ts\n * import { createSponsorshipSigner } from \"@rhinestone/1auth/server\";\n *\n * const signer = createSponsorshipSigner();\n *\n * export async function GET() {\n *   // Guard with your own session/auth before minting.\n *   return Response.json({ token: await signer.accessToken() });\n * }\n * ```\n */\n\nimport { SignJWT, importJWK } from \"jose\";\nimport { isAddress, type Address, type Hex } from \"viem\";\n\nexport { hashMessage, verifyMessageHash } from \"./verify\";\nexport { encodeWebAuthnSignature } from \"./walletClient/utils\";\nexport type { WebAuthnSignature } from \"./types\";\n\nexport interface JwtCredentials {\n  privateKey: JsonWebKey;\n  integratorId: string;\n  projectId: string;\n  appId: string;\n  keyId: string;\n  audience?: string;\n}\n\nexport interface SponsorshipFilter {\n  chain?: (chain: { id: number }) => boolean | Promise<boolean>;\n  account?: (address: Address) => boolean | Promise<boolean>;\n  calls?: (\n    calls: {\n      to: Address;\n      value: bigint;\n      data: Hex;\n    }[],\n  ) => boolean | Promise<boolean>;\n}\n\nexport interface JwtSignerConfig {\n  jwt: JwtCredentials;\n  shouldSponsor?: SponsorshipFilter;\n}\n\nexport class SponsorshipDeniedError extends Error {\n  constructor() {\n    super(\"Sponsorship denied\");\n    this.name = \"SponsorshipDeniedError\";\n  }\n}\n\n/**\n * Sponsorship signer used by the two endpoints the SDK client calls:\n *\n * - `accessToken()` — mints the app's identity token; return as\n *   `{ token }` from `GET /sponsorship/access-token`.\n * - `extensionToken(intentOp)` — mints a per-intent sponsorship grant;\n *   return as `{ token }` from `POST /sponsorship/extension-token`.\n *   Accepts either the JSON-stringified `intentOp` the SDK sends or a\n *   pre-parsed object.\n */\nexport interface SponsorshipSigner {\n  accessToken(): Promise<string>;\n  extensionToken(intentOp: string | object): Promise<string>;\n}\n\nexport interface CreateSponsorshipSignerOptions {\n  /** Override all credentials explicitly (skips env lookup). */\n  credentials?: JwtCredentials;\n  /** Override the env source (defaults to `process.env`). */\n  env?: NodeJS.ProcessEnv;\n  /** Optional per-intent sponsorship filter (see `@rhinestone/sdk/jwt-server`). */\n  shouldSponsor?: SponsorshipFilter;\n}\n\nexport interface VerifyOneAuthAccountOptions {\n  /** 1auth provider origin, for example `https://passkey.1auth.box`. */\n  providerUrl: string;\n  /** Smart account address returned by a successful 1auth auth result. */\n  address: Address;\n  /** Optional app client id forwarded to provider APIs that scope by app. */\n  clientId?: string;\n  /** Injectable fetch implementation for tests and non-standard runtimes. */\n  fetch?: typeof fetch;\n}\n\nexport interface VerifiedOneAuthAccount {\n  address: Address;\n  deployed?: boolean;\n  chainId?: number;\n}\n\n/** Error raised when the provider cannot bind an address to a 1auth account. */\nexport class OneAuthAccountVerificationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"OneAuthAccountVerificationError\";\n  }\n}\n\nconst ENV_KEYS = {\n  privateKey: \"RHINESTONE_JWT_PRIVATE_KEY\",\n  integratorId: \"RHINESTONE_INTEGRATOR_ID\",\n  projectId: \"RHINESTONE_PROJECT_ID\",\n  appId: \"RHINESTONE_APP_ID\",\n  keyId: \"RHINESTONE_KEY_ID\",\n} as const;\n\n/** Build the documented account-lookup URL for a 1auth provider. */\nfunction accountLookupUrl(providerUrl: string, address: Address): string {\n  return new URL(`/api/account/${address.toLowerCase()}`, providerUrl).toString();\n}\n\n/** Safely parse a provider account lookup response. */\nasync function parseAccountLookupResponse(response: Response): Promise<unknown> {\n  try {\n    return await response.json();\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Verify that an address belongs to a 1auth account known by the configured\n * provider. This is intended for server-side app sessions that already have a\n * fresh challenge signature and need to reject arbitrary ERC-1271 contracts.\n */\nexport async function verifyOneAuthAccount(\n  options: VerifyOneAuthAccountOptions,\n): Promise<VerifiedOneAuthAccount> {\n  if (!isAddress(options.address)) {\n    throw new OneAuthAccountVerificationError(\n      \"A valid 1auth account address is required\",\n    );\n  }\n\n  const fetchImpl = options.fetch ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") {\n    throw new OneAuthAccountVerificationError(\n      \"No fetch implementation is available to verify the 1auth account\",\n    );\n  }\n\n  const url = accountLookupUrl(options.providerUrl, options.address);\n  const headers: HeadersInit = { accept: \"application/json\" };\n  if (options.clientId) headers[\"x-client-id\"] = options.clientId;\n\n  let response: Response;\n  try {\n    response = await fetchImpl(url, {\n      headers,\n      cache: \"no-store\",\n    });\n  } catch (error) {\n    throw new OneAuthAccountVerificationError(\n      `Unable to reach the configured 1auth provider: ${\n        error instanceof Error ? error.message : String(error)\n      }`,\n    );\n  }\n\n  const body = await parseAccountLookupResponse(response);\n  if (!response.ok) {\n    const message =\n      body && typeof body === \"object\" && \"error\" in body\n        ? String((body as { error: unknown }).error)\n        : response.statusText || \"account lookup failed\";\n    throw new OneAuthAccountVerificationError(\n      `Configured 1auth provider did not recognize this account (${response.status}: ${message})`,\n    );\n  }\n\n  const account = body as Partial<VerifiedOneAuthAccount> | null;\n  if (!account?.address || !isAddress(account.address)) {\n    throw new OneAuthAccountVerificationError(\n      \"Configured 1auth provider returned a malformed account record\",\n    );\n  }\n  if (account.address.toLowerCase() !== options.address.toLowerCase()) {\n    throw new OneAuthAccountVerificationError(\n      \"Configured 1auth provider returned a different account address\",\n    );\n  }\n\n  return {\n    address: account.address,\n    deployed:\n      typeof account.deployed === \"boolean\" ? account.deployed : undefined,\n    chainId: typeof account.chainId === \"number\" ? account.chainId : undefined,\n  };\n}\n\n/**\n * RFC 8785 JSON Canonicalization Scheme (JCS).\n *\n * The digest embedded in extension tokens must be byte-for-byte stable across\n * environments, so we canonicalize JSON before hashing instead of trusting\n * ordinary `JSON.stringify` object key order.\n */\nfunction jcsCanonicalise(value: unknown): string {\n  return serialize(value);\n}\n\nfunction serialize(value: unknown): string {\n  if (value === null || value === undefined) {\n    return \"null\";\n  }\n\n  switch (typeof value) {\n    case \"boolean\":\n      return value ? \"true\" : \"false\";\n    case \"number\":\n      if (!Number.isFinite(value)) {\n        throw new Error(`JCS: non-finite number: ${value}`);\n      }\n      return Object.is(value, -0) ? \"0\" : String(value);\n    case \"string\":\n      return JSON.stringify(value);\n    case \"bigint\":\n      if (\n        value > BigInt(Number.MAX_SAFE_INTEGER) ||\n        value < BigInt(-Number.MAX_SAFE_INTEGER)\n      ) {\n        throw new Error(\n          `JCS: BigInt ${value} exceeds safe integer range — convert to string before calling`,\n        );\n      }\n      return String(value);\n    default:\n      break;\n  }\n\n  if (Array.isArray(value)) {\n    return `[${value.map((item) => serialize(item)).join(\",\")}]`;\n  }\n\n  const obj = value as Record<string, unknown>;\n  const members: string[] = [];\n  for (const key of Object.keys(obj).sort()) {\n    const item = obj[key];\n    if (item === undefined) continue;\n    members.push(`${JSON.stringify(key)}:${serialize(item)}`);\n  }\n  return `{${members.join(\",\")}}`;\n}\n\n/**\n * Compute the canonical digest embedded in per-intent sponsorship grants.\n */\nasync function computeIntentInputDigest(intentInput: unknown): Promise<string> {\n  const canonical = jcsCanonicalise(intentInput);\n  const encoded = new TextEncoder().encode(canonical);\n  const hashBuffer = await crypto.subtle.digest(\"SHA-256\", encoded);\n  return Array.from(new Uint8Array(hashBuffer))\n    .map((byte) => byte.toString(16).padStart(2, \"0\"))\n    .join(\"\");\n}\n\nfunction parseIntentInput(intentInput: unknown) {\n  if (typeof intentInput !== \"object\" || intentInput === null) {\n    throw new Error(\"intentInput must be a non-null object\");\n  }\n\n  const input = intentInput as {\n    destinationChainId?: number;\n    account?: { address?: string };\n    destinationExecutions?: { to: Address; value: string; data: Hex }[];\n  };\n\n  if (typeof input.destinationChainId !== \"number\") {\n    throw new Error(\"intentInput.destinationChainId must be a number\");\n  }\n\n  if (typeof input.account !== \"object\" || input.account === null) {\n    throw new Error(\"intentInput.account must be a non-null object\");\n  }\n\n  if (typeof input.account.address !== \"string\") {\n    throw new Error(\"intentInput.account.address must be a string\");\n  }\n\n  if (!Array.isArray(input.destinationExecutions)) {\n    throw new Error(\"intentInput.destinationExecutions must be an array\");\n  }\n\n  return {\n    chain: { id: input.destinationChainId },\n    account: input.account.address as Address,\n    calls: input.destinationExecutions.map((execution) => ({\n      to: execution.to,\n      value: BigInt(execution.value),\n      data: execution.data,\n    })),\n  };\n}\n\nasync function shouldSponsor(\n  intentInput: unknown,\n  filters: SponsorshipFilter,\n): Promise<boolean> {\n  const parsed = parseIntentInput(intentInput);\n  if (filters.chain && !(await filters.chain(parsed.chain))) {\n    return false;\n  }\n  if (filters.account && !(await filters.account(parsed.account))) {\n    return false;\n  }\n  if (filters.calls && !(await filters.calls(parsed.calls))) {\n    return false;\n  }\n  return true;\n}\n\nfunction pickAlg(jwk: JsonWebKey): \"ES256\" | \"ES384\" | \"ES512\" | \"RS256\" {\n  if (jwk.kty === \"EC\") {\n    if (jwk.crv === \"P-256\") return \"ES256\";\n    if (jwk.crv === \"P-384\") return \"ES384\";\n    if (jwk.crv === \"P-521\") return \"ES512\";\n    throw new Error(`Unsupported EC curve: ${jwk.crv}`);\n  }\n  if (jwk.kty === \"RSA\") return \"RS256\";\n  throw new Error(`Unsupported JWK kty: ${jwk.kty}`);\n}\n\n/**\n * Create a low-level JWT signer compatible with Rhinestone sponsorship flows.\n *\n * This mirrors the upstream SDK behavior while keeping our public server entry\n * point self-contained for app bundlers.\n */\nexport function createJwtSigner(config: JwtSignerConfig) {\n  const {\n    jwt: {\n      privateKey,\n      integratorId,\n      projectId,\n      appId,\n      keyId,\n      audience = \"rhinestone-api\",\n    },\n    shouldSponsor: filters,\n  } = config;\n\n  const alg = pickAlg(privateKey);\n  let cachedKey: Awaited<ReturnType<typeof importJWK>> | null = null;\n\n  async function getKey() {\n    if (!cachedKey) {\n      cachedKey = await importJWK(privateKey, alg);\n    }\n    return cachedKey;\n  }\n\n  return {\n    accessToken: async () => {\n      const key = await getKey();\n      return new SignJWT({ typ: \"access\", app_id: appId })\n        .setProtectedHeader({ alg, kid: keyId })\n        .setIssuer(integratorId)\n        .setSubject(projectId)\n        .setAudience(audience)\n        .setIssuedAt()\n        .setExpirationTime(\"1h\")\n        .sign(key);\n    },\n    getIntentExtensionToken: async (intentInput: unknown) => {\n      if (filters && !(await shouldSponsor(intentInput, filters))) {\n        throw new SponsorshipDeniedError();\n      }\n\n      const key = await getKey();\n      const digest = await computeIntentInputDigest(intentInput);\n      return new SignJWT({\n        typ: \"intent_extension\",\n        app_id: appId,\n        jti: crypto.randomUUID(),\n        policy: {\n          sponsorship: {\n            scope: \"intent\",\n            intent_input: { digest },\n          },\n        },\n      })\n        .setProtectedHeader({ alg, kid: keyId })\n        .setIssuer(integratorId)\n        .setSubject(projectId)\n        .setAudience(audience)\n        .setIssuedAt()\n        .setExpirationTime(\"5m\")\n        .sign(key);\n    },\n  };\n}\n\nfunction readCredentialsFromEnv(env: NodeJS.ProcessEnv): JwtCredentials {\n  const missing: string[] = [];\n  const read = (key: string) => {\n    const value = env[key];\n    if (!value) missing.push(key);\n    return value ?? \"\";\n  };\n\n  const privateKeyRaw = read(ENV_KEYS.privateKey);\n  const integratorId = read(ENV_KEYS.integratorId);\n  const projectId = read(ENV_KEYS.projectId);\n  const appId = read(ENV_KEYS.appId);\n  const keyId = read(ENV_KEYS.keyId);\n\n  if (missing.length > 0) {\n    throw new Error(\n      `createSponsorshipSigner: missing env var(s): ${missing.join(\", \")}`,\n    );\n  }\n\n  let privateKey: JsonWebKey;\n  try {\n    privateKey = JSON.parse(privateKeyRaw) as JsonWebKey;\n  } catch {\n    throw new Error(\n      `createSponsorshipSigner: ${ENV_KEYS.privateKey} must be a JSON-encoded JWK`,\n    );\n  }\n\n  return { privateKey, integratorId, projectId, appId, keyId };\n}\n\nexport function createSponsorshipSigner(\n  options: CreateSponsorshipSignerOptions = {},\n): SponsorshipSigner {\n  const credentials =\n    options.credentials ?? readCredentialsFromEnv(options.env ?? process.env);\n\n  const inner = createJwtSigner({\n    jwt: credentials,\n    shouldSponsor: options.shouldSponsor,\n  });\n\n  return {\n    accessToken: () => inner.accessToken(),\n    extensionToken: (intentOp) => {\n      const intentInput =\n        typeof intentOp === \"string\" ? JSON.parse(intentOp) : intentOp;\n      return inner.getIntentExtensionToken(intentInput);\n    },\n  };\n}\n","import { keccak256, toBytes } from \"viem\";\n\n/**\n * The EIP-191 prefix used for personal message signing.\n * This is the standard Ethereum message prefix for `personal_sign`.\n */\nexport const ETHEREUM_MESSAGE_PREFIX = \"\\x19Ethereum Signed Message:\\n\";\n\n/**\n * Hash a message with the EIP-191 Ethereum prefix.\n *\n * This is the same hashing function used by the passkey sign dialog.\n * Use this to verify that the `signedHash` returned from `signMessage()`\n * matches your original message.\n *\n * Format: keccak256(\"\\x19Ethereum Signed Message:\\n\" + len + message)\n *\n * @example\n * ```typescript\n * const message = \"Sign in to MyApp\\nTimestamp: 1234567890\";\n * const result = await client.signMessage({ username: 'alice', message });\n *\n * // Verify the hash matches\n * const expectedHash = hashMessage(message);\n * if (result.signedHash === expectedHash) {\n *   console.log('Hash matches - signature is for this message');\n * }\n * ```\n */\nexport function hashMessage(message: string): `0x${string}` {\n  const messageBytes = toBytes(message);\n  const prefixed = ETHEREUM_MESSAGE_PREFIX + messageBytes.length.toString() + message;\n  return keccak256(toBytes(prefixed));\n}\n\n/**\n * Verify that a signedHash matches the expected message.\n *\n * This is a convenience wrapper around `hashMessage()` that returns\n * a boolean. For full cryptographic verification of the P256 signature,\n * use on-chain verification via the WebAuthn.sol contract.\n *\n * @example\n * ```typescript\n * const result = await client.signMessage({ username: 'alice', message });\n *\n * if (result.success && verifyMessageHash(message, result.signedHash)) {\n *   // The signature is for this exact message\n *   // For full verification, verify the P256 signature on-chain or server-side\n * }\n * ```\n */\nexport function verifyMessageHash(\n  message: string,\n  signedHash: string | undefined\n): boolean {\n  if (!signedHash) return false;\n  const expectedHash = hashMessage(message);\n  return expectedHash.toLowerCase() === signedHash.toLowerCase();\n}\n","import { encodeAbiParameters, keccak256 } from 'viem';\nimport type { Hex } from 'viem';\nimport type { WebAuthnSignature } from '../types';\nimport type { TransactionCall } from './types';\n\n/**\n * P-256 curve order (n)\n * Used for signature malleability normalization\n */\nconst P256_N = BigInt(\n  '0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551'\n);\nconst P256_N_DIV_2 = P256_N / 2n;\n\n/**\n * WebAuthnAuth struct type for ABI encoding\n */\nconst WEBAUTHN_AUTH_TYPE = {\n  type: 'tuple',\n  components: [\n    { type: 'bytes', name: 'authenticatorData' },\n    { type: 'string', name: 'clientDataJSON' },\n    { type: 'uint256', name: 'challengeIndex' },\n    { type: 'uint256', name: 'typeIndex' },\n    { type: 'uint256', name: 'r' },\n    { type: 'uint256', name: 's' },\n  ],\n} as const;\n\n/**\n * Encode a WebAuthn signature for ERC-1271 verification on-chain\n *\n * @param sig - The WebAuthn signature from the passkey\n * @returns ABI-encoded signature bytes\n */\nexport function encodeWebAuthnSignature(sig: WebAuthnSignature): Hex {\n  // Normalize s to prevent signature malleability\n  let s = BigInt(sig.s);\n  if (s > P256_N_DIV_2) {\n    s = P256_N - s;\n  }\n\n  return encodeAbiParameters([WEBAUTHN_AUTH_TYPE], [\n    {\n      authenticatorData: sig.authenticatorData as Hex,\n      clientDataJSON: sig.clientDataJSON,\n      challengeIndex: BigInt(sig.challengeIndex),\n      typeIndex: BigInt(sig.typeIndex),\n      r: BigInt(sig.r),\n      s,\n    },\n  ]);\n}\n\n/**\n * Hash an array of transaction calls for signing\n *\n * @param calls - Array of transaction calls\n * @returns keccak256 hash of the encoded calls\n */\nexport function hashCalls(calls: TransactionCall[]): Hex {\n  const encoded = encodeAbiParameters(\n    [\n      {\n        type: 'tuple[]',\n        components: [\n          { type: 'address', name: 'to' },\n          { type: 'bytes', name: 'data' },\n          { type: 'uint256', name: 'value' },\n        ],\n      },\n    ],\n    [\n      calls.map((c) => ({\n        to: c.to,\n        data: c.data || '0x',\n        value: c.value || 0n,\n      })),\n    ]\n  );\n  return keccak256(encoded);\n}\n\n/**\n * Build transaction review display data from calls\n *\n * @param calls - Array of transaction calls\n * @returns TransactionDetails for the signing modal\n */\nexport function buildTransactionReview(calls: TransactionCall[]) {\n  return {\n    actions: calls.map((call, i) => ({\n      type: 'custom' as const,\n      label: call.label || `Contract Call ${i + 1}`,\n      sublabel: call.sublabel || `To: ${call.to.slice(0, 10)}...${call.to.slice(-8)}`,\n      amount: call.value ? `${call.value} wei` : undefined,\n    })),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA2BA,kBAAmC;AACnC,IAAAA,eAAkD;;;AC5BlD,kBAAmC;AAM5B,IAAM,0BAA0B;AAuBhC,SAAS,YAAY,SAAgC;AAC1D,QAAM,mBAAe,qBAAQ,OAAO;AACpC,QAAM,WAAW,0BAA0B,aAAa,OAAO,SAAS,IAAI;AAC5E,aAAO,2BAAU,qBAAQ,QAAQ,CAAC;AACpC;AAmBO,SAAS,kBACd,SACA,YACS;AACT,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,eAAe,YAAY,OAAO;AACxC,SAAO,aAAa,YAAY,MAAM,WAAW,YAAY;AAC/D;;;AC3DA,IAAAC,eAA+C;AAS/C,IAAM,SAAS;AAAA,EACb;AACF;AACA,IAAM,eAAe,SAAS;AAK9B,IAAM,qBAAqB;AAAA,EACzB,MAAM;AAAA,EACN,YAAY;AAAA,IACV,EAAE,MAAM,SAAS,MAAM,oBAAoB;AAAA,IAC3C,EAAE,MAAM,UAAU,MAAM,iBAAiB;AAAA,IACzC,EAAE,MAAM,WAAW,MAAM,iBAAiB;AAAA,IAC1C,EAAE,MAAM,WAAW,MAAM,YAAY;AAAA,IACrC,EAAE,MAAM,WAAW,MAAM,IAAI;AAAA,IAC7B,EAAE,MAAM,WAAW,MAAM,IAAI;AAAA,EAC/B;AACF;AAQO,SAAS,wBAAwB,KAA6B;AAEnE,MAAI,IAAI,OAAO,IAAI,CAAC;AACpB,MAAI,IAAI,cAAc;AACpB,QAAI,SAAS;AAAA,EACf;AAEA,aAAO,kCAAoB,CAAC,kBAAkB,GAAG;AAAA,IAC/C;AAAA,MACE,mBAAmB,IAAI;AAAA,MACvB,gBAAgB,IAAI;AAAA,MACpB,gBAAgB,OAAO,IAAI,cAAc;AAAA,MACzC,WAAW,OAAO,IAAI,SAAS;AAAA,MAC/B,GAAG,OAAO,IAAI,CAAC;AAAA,MACf;AAAA,IACF;AAAA,EACF,CAAC;AACH;;;AFQO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,cAAc;AACZ,UAAM,oBAAoB;AAC1B,SAAK,OAAO;AAAA,EACd;AACF;AA4CO,IAAM,kCAAN,cAA8C,MAAM;AAAA,EACzD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,WAAW;AAAA,EACf,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,WAAW;AAAA,EACX,OAAO;AAAA,EACP,OAAO;AACT;AAGA,SAAS,iBAAiB,aAAqB,SAA0B;AACvE,SAAO,IAAI,IAAI,gBAAgB,QAAQ,YAAY,CAAC,IAAI,WAAW,EAAE,SAAS;AAChF;AAGA,eAAe,2BAA2B,UAAsC;AAC9E,MAAI;AACF,WAAO,MAAM,SAAS,KAAK;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,eAAsB,qBACpB,SACiC;AACjC,MAAI,KAAC,wBAAU,QAAQ,OAAO,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,QAAQ,SAAS,WAAW;AAC9C,MAAI,OAAO,cAAc,YAAY;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,iBAAiB,QAAQ,aAAa,QAAQ,OAAO;AACjE,QAAM,UAAuB,EAAE,QAAQ,mBAAmB;AAC1D,MAAI,QAAQ,SAAU,SAAQ,aAAa,IAAI,QAAQ;AAEvD,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,UAAU,KAAK;AAAA,MAC9B;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,kDACE,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACvD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,MAAM,2BAA2B,QAAQ;AACtD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,UACJ,QAAQ,OAAO,SAAS,YAAY,WAAW,OAC3C,OAAQ,KAA4B,KAAK,IACzC,SAAS,cAAc;AAC7B,UAAM,IAAI;AAAA,MACR,6DAA6D,SAAS,MAAM,KAAK,OAAO;AAAA,IAC1F;AAAA,EACF;AAEA,QAAM,UAAU;AAChB,MAAI,CAAC,SAAS,WAAW,KAAC,wBAAU,QAAQ,OAAO,GAAG;AACpD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,QAAQ,YAAY,MAAM,QAAQ,QAAQ,YAAY,GAAG;AACnE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,QAAQ;AAAA,IACjB,UACE,OAAO,QAAQ,aAAa,YAAY,QAAQ,WAAW;AAAA,IAC7D,SAAS,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU;AAAA,EACnE;AACF;AASA,SAAS,gBAAgB,OAAwB;AAC/C,SAAO,UAAU,KAAK;AACxB;AAEA,SAAS,UAAU,OAAwB;AACzC,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO,QAAQ,SAAS;AAAA,IAC1B,KAAK;AACH,UAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,cAAM,IAAI,MAAM,2BAA2B,KAAK,EAAE;AAAA,MACpD;AACA,aAAO,OAAO,GAAG,OAAO,EAAE,IAAI,MAAM,OAAO,KAAK;AAAA,IAClD,KAAK;AACH,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B,KAAK;AACH,UACE,QAAQ,OAAO,OAAO,gBAAgB,KACtC,QAAQ,OAAO,CAAC,OAAO,gBAAgB,GACvC;AACA,cAAM,IAAI;AAAA,UACR,eAAe,KAAK;AAAA,QACtB;AAAA,MACF;AACA,aAAO,OAAO,KAAK;AAAA,IACrB;AACE;AAAA,EACJ;AAEA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,IAAI,MAAM,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,EAC3D;AAEA,QAAM,MAAM;AACZ,QAAM,UAAoB,CAAC;AAC3B,aAAW,OAAO,OAAO,KAAK,GAAG,EAAE,KAAK,GAAG;AACzC,UAAM,OAAO,IAAI,GAAG;AACpB,QAAI,SAAS,OAAW;AACxB,YAAQ,KAAK,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE;AAAA,EAC1D;AACA,SAAO,IAAI,QAAQ,KAAK,GAAG,CAAC;AAC9B;AAKA,eAAe,yBAAyB,aAAuC;AAC7E,QAAM,YAAY,gBAAgB,WAAW;AAC7C,QAAM,UAAU,IAAI,YAAY,EAAE,OAAO,SAAS;AAClD,QAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,OAAO;AAChE,SAAO,MAAM,KAAK,IAAI,WAAW,UAAU,CAAC,EACzC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE;AACZ;AAEA,SAAS,iBAAiB,aAAsB;AAC9C,MAAI,OAAO,gBAAgB,YAAY,gBAAgB,MAAM;AAC3D,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAEA,QAAM,QAAQ;AAMd,MAAI,OAAO,MAAM,uBAAuB,UAAU;AAChD,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AAEA,MAAI,OAAO,MAAM,YAAY,YAAY,MAAM,YAAY,MAAM;AAC/D,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAEA,MAAI,OAAO,MAAM,QAAQ,YAAY,UAAU;AAC7C,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AAEA,MAAI,CAAC,MAAM,QAAQ,MAAM,qBAAqB,GAAG;AAC/C,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AAEA,SAAO;AAAA,IACL,OAAO,EAAE,IAAI,MAAM,mBAAmB;AAAA,IACtC,SAAS,MAAM,QAAQ;AAAA,IACvB,OAAO,MAAM,sBAAsB,IAAI,CAAC,eAAe;AAAA,MACrD,IAAI,UAAU;AAAA,MACd,OAAO,OAAO,UAAU,KAAK;AAAA,MAC7B,MAAM,UAAU;AAAA,IAClB,EAAE;AAAA,EACJ;AACF;AAEA,eAAe,cACb,aACA,SACkB;AAClB,QAAM,SAAS,iBAAiB,WAAW;AAC3C,MAAI,QAAQ,SAAS,CAAE,MAAM,QAAQ,MAAM,OAAO,KAAK,GAAI;AACzD,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,WAAW,CAAE,MAAM,QAAQ,QAAQ,OAAO,OAAO,GAAI;AAC/D,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,SAAS,CAAE,MAAM,QAAQ,MAAM,OAAO,KAAK,GAAI;AACzD,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,KAAwD;AACvE,MAAI,IAAI,QAAQ,MAAM;AACpB,QAAI,IAAI,QAAQ,QAAS,QAAO;AAChC,QAAI,IAAI,QAAQ,QAAS,QAAO;AAChC,QAAI,IAAI,QAAQ,QAAS,QAAO;AAChC,UAAM,IAAI,MAAM,yBAAyB,IAAI,GAAG,EAAE;AAAA,EACpD;AACA,MAAI,IAAI,QAAQ,MAAO,QAAO;AAC9B,QAAM,IAAI,MAAM,wBAAwB,IAAI,GAAG,EAAE;AACnD;AAQO,SAAS,gBAAgB,QAAyB;AACvD,QAAM;AAAA,IACJ,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb;AAAA,IACA,eAAe;AAAA,EACjB,IAAI;AAEJ,QAAM,MAAM,QAAQ,UAAU;AAC9B,MAAI,YAA0D;AAE9D,iBAAe,SAAS;AACtB,QAAI,CAAC,WAAW;AACd,kBAAY,UAAM,uBAAU,YAAY,GAAG;AAAA,IAC7C;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,aAAa,YAAY;AACvB,YAAM,MAAM,MAAM,OAAO;AACzB,aAAO,IAAI,oBAAQ,EAAE,KAAK,UAAU,QAAQ,MAAM,CAAC,EAChD,mBAAmB,EAAE,KAAK,KAAK,MAAM,CAAC,EACtC,UAAU,YAAY,EACtB,WAAW,SAAS,EACpB,YAAY,QAAQ,EACpB,YAAY,EACZ,kBAAkB,IAAI,EACtB,KAAK,GAAG;AAAA,IACb;AAAA,IACA,yBAAyB,OAAO,gBAAyB;AACvD,UAAI,WAAW,CAAE,MAAM,cAAc,aAAa,OAAO,GAAI;AAC3D,cAAM,IAAI,uBAAuB;AAAA,MACnC;AAEA,YAAM,MAAM,MAAM,OAAO;AACzB,YAAM,SAAS,MAAM,yBAAyB,WAAW;AACzD,aAAO,IAAI,oBAAQ;AAAA,QACjB,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,KAAK,OAAO,WAAW;AAAA,QACvB,QAAQ;AAAA,UACN,aAAa;AAAA,YACX,OAAO;AAAA,YACP,cAAc,EAAE,OAAO;AAAA,UACzB;AAAA,QACF;AAAA,MACF,CAAC,EACE,mBAAmB,EAAE,KAAK,KAAK,MAAM,CAAC,EACtC,UAAU,YAAY,EACtB,WAAW,SAAS,EACpB,YAAY,QAAQ,EACpB,YAAY,EACZ,kBAAkB,IAAI,EACtB,KAAK,GAAG;AAAA,IACb;AAAA,EACF;AACF;AAEA,SAAS,uBAAuB,KAAwC;AACtE,QAAM,UAAoB,CAAC;AAC3B,QAAM,OAAO,CAAC,QAAgB;AAC5B,UAAM,QAAQ,IAAI,GAAG;AACrB,QAAI,CAAC,MAAO,SAAQ,KAAK,GAAG;AAC5B,WAAO,SAAS;AAAA,EAClB;AAEA,QAAM,gBAAgB,KAAK,SAAS,UAAU;AAC9C,QAAM,eAAe,KAAK,SAAS,YAAY;AAC/C,QAAM,YAAY,KAAK,SAAS,SAAS;AACzC,QAAM,QAAQ,KAAK,SAAS,KAAK;AACjC,QAAM,QAAQ,KAAK,SAAS,KAAK;AAEjC,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI;AAAA,MACR,gDAAgD,QAAQ,KAAK,IAAI,CAAC;AAAA,IACpE;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,MAAM,aAAa;AAAA,EACvC,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,4BAA4B,SAAS,UAAU;AAAA,IACjD;AAAA,EACF;AAEA,SAAO,EAAE,YAAY,cAAc,WAAW,OAAO,MAAM;AAC7D;AAEO,SAAS,wBACd,UAA0C,CAAC,GACxB;AACnB,QAAM,cACJ,QAAQ,eAAe,uBAAuB,QAAQ,OAAO,QAAQ,GAAG;AAE1E,QAAM,QAAQ,gBAAgB;AAAA,IAC5B,KAAK;AAAA,IACL,eAAe,QAAQ;AAAA,EACzB,CAAC;AAED,SAAO;AAAA,IACL,aAAa,MAAM,MAAM,YAAY;AAAA,IACrC,gBAAgB,CAAC,aAAa;AAC5B,YAAM,cACJ,OAAO,aAAa,WAAW,KAAK,MAAM,QAAQ,IAAI;AACxD,aAAO,MAAM,wBAAwB,WAAW;AAAA,IAClD;AAAA,EACF;AACF;","names":["import_viem","import_viem"]}