@rhinestone/1auth 0.6.8 → 0.6.9

package/README.md

@@ -28,7 +28,7 @@ The SDK provides multiple entry points for different use cases:
 |-------------|--------|----------|
 | Default | `@rhinestone/1auth` | Core client, provider, types |
 | React | `@rhinestone/1auth/react` | PayButton component |
-| Server | `@rhinestone/1auth/server` | Server-side intent signing |
+| Server | `@rhinestone/1auth/server` | JWT signer for app-sponsored intents |
 | Wagmi | `@rhinestone/1auth/wagmi` | Wagmi connector integration |
 
 ## Quick Start
@@ -84,18 +84,22 @@ const config = createConfig({
 });
 ```
 
-### Server-Side Intent Signing
+### Server-Side JWT Sponsorship
 
 ```typescript
-import { signIntent, createSignIntentHandler } from '@rhinestone/1auth/server';
-
-// Sign an intent with Ed25519
-const signedIntent = await signIntent(intent, privateKey);
-
-// Or create a request handler
-const handler = createSignIntentHandler({
-  privateKey: process.env.SIGNING_KEY,
+import { createJwtSigner } from '@rhinestone/1auth/server';
+
+const signer = createJwtSigner({
+  privateKey: JSON.parse(process.env.RHINESTONE_JWT_PRIVATE_KEY),
+  integratorId: process.env.RHINESTONE_INTEGRATOR_ID,
+  projectId: process.env.RHINESTONE_PROJECT_ID,
+  appId: process.env.RHINESTONE_APP_ID,
+  keyId: process.env.RHINESTONE_KEY_ID,
 });
+
+// Use in your API routes
+const accessToken = await signer.accessToken();
+const extensionToken = await signer.getIntentExtensionToken(intentInput);
 ```
 
 ## Core Exports
@@ -118,13 +122,168 @@ const handler = createSignIntentHandler({
 
 ### `@rhinestone/1auth/server`
 
-- `signIntent()` - Server-side intent signing with Ed25519
-- `createSignIntentHandler()` - Express/fetch handler for intent signing
+- `createJwtSigner()` - Create a JWT signer for app-sponsored intents (RS256)
+- `JwtSignerConfig` - Configuration type for the JWT signer
 
 ### `@rhinestone/1auth/wagmi`
 
 - `oneAuth()` - Wagmi connector factory
 
+## App-Sponsored Intents
+
+By default, 1auth sponsors transaction fees for all intents. With sponsorship, your app takes over billing by providing JWT tokens to authorize each intent.
+
+### How It Works
+
+```mermaid
+sequenceDiagram
+    participant App as Your App
+    participant BE as Your Backend
+    participant SDK as @rhinestone/1auth
+    participant PS as 1auth Passkey Service
+
+    Note over App,SDK: 1. Configure the client with sponsorship URLs
+    App->>SDK: new OneAuthClient({<br/>  sponsorship: {<br/>    accessTokenUrl,<br/>    extensionTokenUrl<br/>  }<br/>})
+
+    Note over SDK,BE: 2. Prepare the intent
+    SDK->>PS: POST /api/intent/prepare
+    PS-->>SDK: { intentOp, digestResult, ... }
+
+    Note over SDK,BE: 3. In parallel: fetch tokens (same-origin, with session cookie) + WebAuthn ceremony
+    par
+      SDK->>BE: GET /sponsorship/access-token
+      BE-->>SDK: { token: "eyJhbG..." }
+    and
+      SDK->>BE: POST /sponsorship/extension-token { intentOp }
+      BE-->>SDK: { token: "eyJhbG..." }
+    and
+      SDK->>SDK: WebAuthn signing ceremony
+    end
+
+    Note over SDK,PS: 4. Execute with pre-fetched tokens in request body
+    SDK->>PS: POST /api/intent/execute<br/>{ signature, sponsorship: { accessToken, extensionToken } }
+    PS-->>SDK: { intentId }
+```
+
+### Why this shape
+
+The SDK calls your token endpoints **from the browser, same-origin**. Your app's session cookie naturally authenticates the request — no need to pass bearer tokens through the SDK. The passkey service never fetches from your backend on your behalf, so there's no SSRF surface and no CORS config to worry about.
+
+### Setup
+
+**1. Create two endpoints on your backend, on the same origin as your app**
+
+Gate these with your existing session auth — the user's cookie rides along automatically.
+
+```typescript
+// GET /api/sponsorship/access-token
+import { createJwtSigner } from '@rhinestone/1auth/server';
+
+const signer = createJwtSigner({
+  jwt: {
+    privateKey: JSON.parse(process.env.RHINESTONE_JWT_PRIVATE_KEY),
+    integratorId: process.env.RHINESTONE_INTEGRATOR_ID,
+    projectId: process.env.RHINESTONE_PROJECT_ID,
+    appId: process.env.RHINESTONE_APP_ID,
+    keyId: process.env.RHINESTONE_KEY_ID,
+  },
+});
+
+export async function handleAccessToken(req, res) {
+  const user = await verifySession(req); // your app's auth
+  if (!user) return res.status(401).json({ error: 'Unauthorized' });
+  const token = await signer.accessToken();
+  res.json({ token });
+}
+
+// POST /api/sponsorship/extension-token
+// Body: { intentOp: string }  — JSON-stringified intent operation
+export async function handleExtensionToken(req, res) {
+  const user = await verifySession(req);
+  if (!user) return res.status(401).json({ error: 'Unauthorized' });
+
+  const { intentOp } = req.body;
+  const intentInput = JSON.parse(intentOp);
+
+  // Enforce policies
+  if (await exceedsSpendingLimit(user.id)) {
+    return res.status(403).json({ error: 'Spending limit exceeded' });
+  }
+
+  const token = await signer.getIntentExtensionToken(intentInput);
+  res.json({ token });
+}
+```
+
+**2. Configure `OneAuthClient` with the URL form**
+
+```typescript
+import { OneAuthClient, createOneAuthProvider } from '@rhinestone/1auth';
+
+const client = new OneAuthClient({
+  providerUrl: 'https://passkey.1auth.box',
+  sponsorship: {
+    accessTokenUrl: '/api/sponsorship/access-token',
+    extensionTokenUrl: '/api/sponsorship/extension-token',
+  },
+});
+
+const provider = createOneAuthProvider({ client, chainId: 8453 });
+
+const txHash = await provider.request({
+  method: 'eth_sendTransaction',
+  params: [{ to: '0x...', data: '0x...' }],
+});
+```
+
+**React apps** can use the convenience hook:
+
+```tsx
+import { useSponsorship } from '@rhinestone/1auth/react';
+import { OneAuthClient } from '@rhinestone/1auth';
+
+function MyApp() {
+  const sponsorship = useSponsorship({
+    accessTokenUrl: '/api/sponsorship/access-token',
+    extensionTokenUrl: '/api/sponsorship/extension-token',
+  });
+
+  const client = useMemo(
+    () => new OneAuthClient({ providerUrl, sponsorship }),
+    [sponsorship],
+  );
+  // ...
+}
+```
+
+The hook caches the access token in a ref and refetches on 401 from the extension-token endpoint.
+
+### SponsorshipConfig
+
+`SponsorshipConfig` is a discriminated union — pick whichever form fits:
+
+```typescript
+// Convenience form — SDK does the fetching.
+type SponsorshipUrlConfig = {
+  accessTokenUrl: string;     // GET  → { token }
+  extensionTokenUrl: string;  // POST { intentOp: string } → { token }
+};
+
+// Low-level form — you control token sourcing / refresh / caching.
+type SponsorshipCallbackConfig = {
+  accessToken: () => Promise<string>;
+  getExtensionToken: (intentOp: string) => Promise<string>;
+};
+
+type SponsorshipConfig = SponsorshipUrlConfig | SponsorshipCallbackConfig;
+```
+
+The SDK pre-fetches both tokens in parallel with the WebAuthn signing ceremony and passes them to the passkey service via the execute request body. The passkey service never makes outbound requests to your backend.
+
+### Without Sponsorship
+
+If you don't pass `sponsorship`, 1auth sponsors intents on your behalf using its own API key. No changes needed — this is the default behavior.
+
 ## License
 
 MIT

package/dist/chunk-IHBVEU33.mjs

@@ -0,0 +1,20 @@
+// src/verify.ts
+import { keccak256, toBytes } from "viem";
+var ETHEREUM_MESSAGE_PREFIX = "Ethereum Signed Message:\n";
+function hashMessage(message) {
+  const messageBytes = toBytes(message);
+  const prefixed = ETHEREUM_MESSAGE_PREFIX + messageBytes.length.toString() + message;
+  return keccak256(toBytes(prefixed));
+}
+function verifyMessageHash(message, signedHash) {
+  if (!signedHash) return false;
+  const expectedHash = hashMessage(message);
+  return expectedHash.toLowerCase() === signedHash.toLowerCase();
+}
+
+export {
+  ETHEREUM_MESSAGE_PREFIX,
+  hashMessage,
+  verifyMessageHash
+};
+//# sourceMappingURL=chunk-IHBVEU33.mjs.map

package/dist/chunk-IHBVEU33.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/verify.ts"],"sourcesContent":["import { keccak256, toBytes } from \"viem\";\n\n/**\n * The EIP-191 prefix used for personal message signing.\n * This is the standard Ethereum message prefix for `personal_sign`.\n */\nexport const ETHEREUM_MESSAGE_PREFIX = \"\\x19Ethereum Signed Message:\\n\";\n\n/**\n * Hash a message with the EIP-191 Ethereum prefix.\n *\n * This is the same hashing function used by the passkey sign dialog.\n * Use this to verify that the `signedHash` returned from `signMessage()`\n * matches your original message.\n *\n * Format: keccak256(\"\\x19Ethereum Signed Message:\\n\" + len + message)\n *\n * @example\n * ```typescript\n * const message = \"Sign in to MyApp\\nTimestamp: 1234567890\";\n * const result = await client.signMessage({ username: 'alice', message });\n *\n * // Verify the hash matches\n * const expectedHash = hashMessage(message);\n * if (result.signedHash === expectedHash) {\n *   console.log('Hash matches - signature is for this message');\n * }\n * ```\n */\nexport function hashMessage(message: string): `0x${string}` {\n  const messageBytes = toBytes(message);\n  const prefixed = ETHEREUM_MESSAGE_PREFIX + messageBytes.length.toString() + message;\n  return keccak256(toBytes(prefixed));\n}\n\n/**\n * Verify that a signedHash matches the expected message.\n *\n * This is a convenience wrapper around `hashMessage()` that returns\n * a boolean. For full cryptographic verification of the P256 signature,\n * use on-chain verification via the WebAuthn.sol contract.\n *\n * @example\n * ```typescript\n * const result = await client.signMessage({ username: 'alice', message });\n *\n * if (result.success && verifyMessageHash(message, result.signedHash)) {\n *   // The signature is for this exact message\n *   // For full verification, verify the P256 signature on-chain or server-side\n * }\n * ```\n */\nexport function verifyMessageHash(\n  message: string,\n  signedHash: string | undefined\n): boolean {\n  if (!signedHash) return false;\n  const expectedHash = hashMessage(message);\n  return expectedHash.toLowerCase() === signedHash.toLowerCase();\n}\n"],"mappings":";AAAA,SAAS,WAAW,eAAe;AAM5B,IAAM,0BAA0B;AAuBhC,SAAS,YAAY,SAAgC;AAC1D,QAAM,eAAe,QAAQ,OAAO;AACpC,QAAM,WAAW,0BAA0B,aAAa,OAAO,SAAS,IAAI;AAC5E,SAAO,UAAU,QAAQ,QAAQ,CAAC;AACpC;AAmBO,SAAS,kBACd,SACA,YACS;AACT,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,eAAe,YAAY,OAAO;AACxC,SAAO,aAAa,YAAY,MAAM,WAAW,YAAY;AAC/D;","names":[]}

package/dist/chunk-IIACVHR3.mjs

@@ -0,0 +1,28 @@
+// src/sponsorship-fetch.ts
+async function extractServerReason(response) {
+  try {
+    const text = await response.clone().text();
+    if (!text) return response.statusText;
+    try {
+      const data = JSON.parse(text);
+      const reason = data.error ?? data.message;
+      if (typeof reason === "string" && reason.trim()) return reason;
+    } catch {
+    }
+    return text.slice(0, 200);
+  } catch {
+    return response.statusText;
+  }
+}
+async function tokenFetchError(label, response) {
+  const reason = await extractServerReason(response);
+  const suffix = reason ? `: ${reason}` : "";
+  return new Error(
+    `Failed to fetch ${label} (${response.status} ${response.statusText})${suffix}`
+  );
+}
+
+export {
+  tokenFetchError
+};
+//# sourceMappingURL=chunk-IIACVHR3.mjs.map

package/dist/chunk-IIACVHR3.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sponsorship-fetch.ts"],"sourcesContent":["/**\n * Shared helpers for fetching sponsorship tokens (access + extension) from an\n * integrator's backend endpoints.\n *\n * The integrator's token routes return their failure reason in the JSON body\n * (`{ error: \"createSponsorshipSigner: missing env var(s): ...\" }`). Surfacing\n * only the HTTP status — \"Failed to fetch access token (500 ...)\" — hides that\n * reason and turns every misconfiguration into the same opaque dialog error.\n * These helpers read the body and fold the server's message into the thrown\n * Error so the actual cause (missing env var, bad JWK, expired session) is\n * visible at the call site and in the dialog.\n */\n\n/**\n * Pull a human-readable reason out of a failed token response. Tries the JSON\n * `error`/`message` fields first, then falls back to a short text snippet, then\n * to the HTTP status text. Never throws — diagnostics must not mask the original\n * failure with a parse error.\n */\nasync function extractServerReason(response: Response): Promise<string> {\n  try {\n    // Clone so a JSON parse failure can still fall back to reading text.\n    const text = await response.clone().text();\n    if (!text) return response.statusText;\n    try {\n      const data = JSON.parse(text) as { error?: unknown; message?: unknown };\n      const reason = data.error ?? data.message;\n      if (typeof reason === \"string\" && reason.trim()) return reason;\n    } catch {\n      // Body wasn't JSON — fall through to the raw text snippet.\n    }\n    // Cap the snippet so an HTML error page doesn't flood the message.\n    return text.slice(0, 200);\n  } catch {\n    return response.statusText;\n  }\n}\n\n/**\n * Build an Error for a failed token fetch that includes the server's reason.\n * `label` names the token kind, e.g. \"access token\" or \"extension token\".\n */\nexport async function tokenFetchError(\n  label: string,\n  response: Response,\n): Promise<Error> {\n  const reason = await extractServerReason(response);\n  const suffix = reason ? `: ${reason}` : \"\";\n  return new Error(\n    `Failed to fetch ${label} (${response.status} ${response.statusText})${suffix}`,\n  );\n}\n"],"mappings":";AAmBA,eAAe,oBAAoB,UAAqC;AACtE,MAAI;AAEF,UAAM,OAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AACzC,QAAI,CAAC,KAAM,QAAO,SAAS;AAC3B,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,SAAS,KAAK,SAAS,KAAK;AAClC,UAAI,OAAO,WAAW,YAAY,OAAO,KAAK,EAAG,QAAO;AAAA,IAC1D,QAAQ;AAAA,IAER;AAEA,WAAO,KAAK,MAAM,GAAG,GAAG;AAAA,EAC1B,QAAQ;AACN,WAAO,SAAS;AAAA,EAClB;AACF;AAMA,eAAsB,gBACpB,OACA,UACgB;AAChB,QAAM,SAAS,MAAM,oBAAoB,QAAQ;AACjD,QAAM,SAAS,SAAS,KAAK,MAAM,KAAK;AACxC,SAAO,IAAI;AAAA,IACT,mBAAmB,KAAK,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU,IAAI,MAAM;AAAA,EAC/E;AACF;","names":[]}

package/dist/chunk-N6KE5CII.mjs

@@ -0,0 +1,72 @@
+// src/walletClient/utils.ts
+import { encodeAbiParameters, keccak256 } from "viem";
+var P256_N = BigInt(
+  "0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"
+);
+var P256_N_DIV_2 = P256_N / 2n;
+var WEBAUTHN_AUTH_TYPE = {
+  type: "tuple",
+  components: [
+    { type: "bytes", name: "authenticatorData" },
+    { type: "string", name: "clientDataJSON" },
+    { type: "uint256", name: "challengeIndex" },
+    { type: "uint256", name: "typeIndex" },
+    { type: "uint256", name: "r" },
+    { type: "uint256", name: "s" }
+  ]
+};
+function encodeWebAuthnSignature(sig) {
+  let s = BigInt(sig.s);
+  if (s > P256_N_DIV_2) {
+    s = P256_N - s;
+  }
+  return encodeAbiParameters([WEBAUTHN_AUTH_TYPE], [
+    {
+      authenticatorData: sig.authenticatorData,
+      clientDataJSON: sig.clientDataJSON,
+      challengeIndex: BigInt(sig.challengeIndex),
+      typeIndex: BigInt(sig.typeIndex),
+      r: BigInt(sig.r),
+      s
+    }
+  ]);
+}
+function hashCalls(calls) {
+  const encoded = encodeAbiParameters(
+    [
+      {
+        type: "tuple[]",
+        components: [
+          { type: "address", name: "to" },
+          { type: "bytes", name: "data" },
+          { type: "uint256", name: "value" }
+        ]
+      }
+    ],
+    [
+      calls.map((c) => ({
+        to: c.to,
+        data: c.data || "0x",
+        value: c.value || 0n
+      }))
+    ]
+  );
+  return keccak256(encoded);
+}
+function buildTransactionReview(calls) {
+  return {
+    actions: calls.map((call, i) => ({
+      type: "custom",
+      label: call.label || `Contract Call ${i + 1}`,
+      sublabel: call.sublabel || `To: ${call.to.slice(0, 10)}...${call.to.slice(-8)}`,
+      amount: call.value ? `${call.value} wei` : void 0
+    }))
+  };
+}
+
+export {
+  encodeWebAuthnSignature,
+  hashCalls,
+  buildTransactionReview
+};
+//# sourceMappingURL=chunk-N6KE5CII.mjs.map

package/dist/chunk-N6KE5CII.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/walletClient/utils.ts"],"sourcesContent":["import { encodeAbiParameters, keccak256 } from 'viem';\nimport type { Hex } from 'viem';\nimport type { WebAuthnSignature } from '../types';\nimport type { TransactionCall } from './types';\n\n/**\n * P-256 curve order (n)\n * Used for signature malleability normalization\n */\nconst P256_N = BigInt(\n  '0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551'\n);\nconst P256_N_DIV_2 = P256_N / 2n;\n\n/**\n * WebAuthnAuth struct type for ABI encoding\n */\nconst WEBAUTHN_AUTH_TYPE = {\n  type: 'tuple',\n  components: [\n    { type: 'bytes', name: 'authenticatorData' },\n    { type: 'string', name: 'clientDataJSON' },\n    { type: 'uint256', name: 'challengeIndex' },\n    { type: 'uint256', name: 'typeIndex' },\n    { type: 'uint256', name: 'r' },\n    { type: 'uint256', name: 's' },\n  ],\n} as const;\n\n/**\n * Encode a WebAuthn signature for ERC-1271 verification on-chain\n *\n * @param sig - The WebAuthn signature from the passkey\n * @returns ABI-encoded signature bytes\n */\nexport function encodeWebAuthnSignature(sig: WebAuthnSignature): Hex {\n  // Normalize s to prevent signature malleability\n  let s = BigInt(sig.s);\n  if (s > P256_N_DIV_2) {\n    s = P256_N - s;\n  }\n\n  return encodeAbiParameters([WEBAUTHN_AUTH_TYPE], [\n    {\n      authenticatorData: sig.authenticatorData as Hex,\n      clientDataJSON: sig.clientDataJSON,\n      challengeIndex: BigInt(sig.challengeIndex),\n      typeIndex: BigInt(sig.typeIndex),\n      r: BigInt(sig.r),\n      s,\n    },\n  ]);\n}\n\n/**\n * Hash an array of transaction calls for signing\n *\n * @param calls - Array of transaction calls\n * @returns keccak256 hash of the encoded calls\n */\nexport function hashCalls(calls: TransactionCall[]): Hex {\n  const encoded = encodeAbiParameters(\n    [\n      {\n        type: 'tuple[]',\n        components: [\n          { type: 'address', name: 'to' },\n          { type: 'bytes', name: 'data' },\n          { type: 'uint256', name: 'value' },\n        ],\n      },\n    ],\n    [\n      calls.map((c) => ({\n        to: c.to,\n        data: c.data || '0x',\n        value: c.value || 0n,\n      })),\n    ]\n  );\n  return keccak256(encoded);\n}\n\n/**\n * Build transaction review display data from calls\n *\n * @param calls - Array of transaction calls\n * @returns TransactionDetails for the signing modal\n */\nexport function buildTransactionReview(calls: TransactionCall[]) {\n  return {\n    actions: calls.map((call, i) => ({\n      type: 'custom' as const,\n      label: call.label || `Contract Call ${i + 1}`,\n      sublabel: call.sublabel || `To: ${call.to.slice(0, 10)}...${call.to.slice(-8)}`,\n      amount: call.value ? `${call.value} wei` : undefined,\n    })),\n  };\n}\n"],"mappings":";AAAA,SAAS,qBAAqB,iBAAiB;AAS/C,IAAM,SAAS;AAAA,EACb;AACF;AACA,IAAM,eAAe,SAAS;AAK9B,IAAM,qBAAqB;AAAA,EACzB,MAAM;AAAA,EACN,YAAY;AAAA,IACV,EAAE,MAAM,SAAS,MAAM,oBAAoB;AAAA,IAC3C,EAAE,MAAM,UAAU,MAAM,iBAAiB;AAAA,IACzC,EAAE,MAAM,WAAW,MAAM,iBAAiB;AAAA,IAC1C,EAAE,MAAM,WAAW,MAAM,YAAY;AAAA,IACrC,EAAE,MAAM,WAAW,MAAM,IAAI;AAAA,IAC7B,EAAE,MAAM,WAAW,MAAM,IAAI;AAAA,EAC/B;AACF;AAQO,SAAS,wBAAwB,KAA6B;AAEnE,MAAI,IAAI,OAAO,IAAI,CAAC;AACpB,MAAI,IAAI,cAAc;AACpB,QAAI,SAAS;AAAA,EACf;AAEA,SAAO,oBAAoB,CAAC,kBAAkB,GAAG;AAAA,IAC/C;AAAA,MACE,mBAAmB,IAAI;AAAA,MACvB,gBAAgB,IAAI;AAAA,MACpB,gBAAgB,OAAO,IAAI,cAAc;AAAA,MACzC,WAAW,OAAO,IAAI,SAAS;AAAA,MAC/B,GAAG,OAAO,IAAI,CAAC;AAAA,MACf;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAQO,SAAS,UAAU,OAA+B;AACvD,QAAM,UAAU;AAAA,IACd;AAAA,MACE;AAAA,QACE,MAAM;AAAA,QACN,YAAY;AAAA,UACV,EAAE,MAAM,WAAW,MAAM,KAAK;AAAA,UAC9B,EAAE,MAAM,SAAS,MAAM,OAAO;AAAA,UAC9B,EAAE,MAAM,WAAW,MAAM,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,MAAM,IAAI,CAAC,OAAO;AAAA,QAChB,IAAI,EAAE;AAAA,QACN,MAAM,EAAE,QAAQ;AAAA,QAChB,OAAO,EAAE,SAAS;AAAA,MACpB,EAAE;AAAA,IACJ;AAAA,EACF;AACA,SAAO,UAAU,OAAO;AAC1B;AAQO,SAAS,uBAAuB,OAA0B;AAC/D,SAAO;AAAA,IACL,SAAS,MAAM,IAAI,CAAC,MAAM,OAAO;AAAA,MAC/B,MAAM;AAAA,MACN,OAAO,KAAK,SAAS,iBAAiB,IAAI,CAAC;AAAA,MAC3C,UAAU,KAAK,YAAY,OAAO,KAAK,GAAG,MAAM,GAAG,EAAE,CAAC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;AAAA,MAC7E,QAAQ,KAAK,QAAQ,GAAG,KAAK,KAAK,SAAS;AAAA,IAC7C,EAAE;AAAA,EACJ;AACF;","names":[]}