@rhinestone/1auth 0.6.8 → 0.6.9

package/dist/headless.d.mts

@@ -0,0 +1,90 @@
+import { P as PasskeyProviderConfig, S as SponsorshipConfig, H as HeadlessIntentOptions, a as HeadlessPrepareResult, b as HeadlessSubmitOptions, c as HeadlessSubmitResult, d as HeadlessIntentStatusResult, I as InstallSmartSessionOptions, e as InstallSmartSessionResult } from './types-1BMD1PSH.mjs';
+export { f as SessionKeyHandle, g as SmartSessionEnableRequest } from './types-1BMD1PSH.mjs';
+import 'viem';
+import '@rhinestone/sdk';
+
+/**
+ * Headless 1auth client.
+ *
+ * Used by integrators that hold their own ECDSA signer in localStorage
+ * and produce signatures for an ERC-7579 validator other than the
+ * passkey one (typically `@rhinestone/sdk` experimental SmartSession).
+ *
+ * Responsibilities:
+ *  - Fetch sponsorship JWTs from the app's own backend.
+ *  - Call `/api/intent/prepare?signingMode=headless` to get an
+ *    orchestrator-quoted `intentOp` + `digestResult`.
+ *  - Forward pre-encoded validator-prefixed signatures to the new
+ *    `/api/intent/headless-execute` route.
+ *  - Drive the existing passkey dialog (via {@link OneAuthClient}) for
+ *    the one-time SmartSession install ceremony.
+ *
+ * 1auth itself stays ignorant of session keys — the on-chain
+ * SmartSession validator is the only authority over what a session key
+ * may sign for. The host app persists `{ sessionKeyAddress, permissionId,
+ * accountAddress, permissions }` in its own storage.
+ */
+
+declare class OneAuthHeadlessClient {
+    private providerUrl;
+    private clientId?;
+    private sponsorship;
+    constructor(config: PasskeyProviderConfig);
+    setSponsorship(sponsorship: SponsorshipConfig | undefined): void;
+    private fetchAccessToken;
+    private fetchExtensionToken;
+    /**
+     * Quote an intent without opening any dialog. Returns the orchestrator's
+     * `intentOp` plus the digest the caller must sign with their own
+     * validator (e.g. SmartSession). The caller is responsible for
+     * encoding signatures and submitting via {@link submitIntent}.
+     */
+    prepareIntent(options: HeadlessIntentOptions): Promise<HeadlessPrepareResult>;
+    /**
+     * Forward a pre-signed intent to the orchestrator. The caller has
+     * already encoded validator-prefixed origin + destination signatures
+     * (one origin signature per intent element); 1auth treats them as
+     * opaque bytes.
+     *
+     * If `sponsor` is omitted or `true`, an extension token is fetched
+     * just-in-time and bound to the intent. Pass `sponsor: false` for
+     * self-paying intents.
+     */
+    submitIntent(options: HeadlessSubmitOptions): Promise<HeadlessSubmitResult>;
+    /**
+     * Fetch the latest known status for a submitted headless intent.
+     * This is a non-blocking read and may return `pending` before a
+     * solver has produced a fill transaction hash.
+     */
+    getIntentStatus(intentId: string): Promise<HeadlessIntentStatusResult>;
+    /**
+     * Wait for a submitted headless intent to produce a status update and,
+     * when available, the final fill transaction hash. The wait endpoint
+     * needs the opaque `transactionResult` returned by submit because 1auth
+     * does not persist that SDK object in its database.
+     */
+    waitForIntent(intentId: string, transactionResult: unknown): Promise<HeadlessIntentStatusResult>;
+    /**
+     * Resolve the SmartSession install call(s) for `sessionKeyAddress`
+     * with the supplied `permissions`.
+     *
+     * Returns `{ install, sessionKeyHandle }`:
+     *
+     *  - `install` is a `{ targetChain, calls }` pair the caller feeds
+     *    straight into `OneAuthClient.sendIntent({ targetChain, calls })`
+     *    so the user passkey-signs the install via the existing dialog.
+     *  - `sessionKeyHandle` contains the deterministic `permissionId`
+     *    plus metadata to persist in localStorage. Persist this BEFORE
+     *    submitting the install so a refresh during signing doesn't
+     *    lose the handle.
+     *
+     * If the validator is already installed on the user's account,
+     * `install.calls` is empty and `install.alreadyInstalled` is true.
+     * The caller should still persist `sessionKeyHandle` — the on-chain
+     * session enabling happens at first headless use via SmartSession's
+     * ENABLE-mode signature wrapping (see follow-up).
+     */
+    installSmartSession(options: InstallSmartSessionOptions): Promise<InstallSmartSessionResult>;
+}
+
+export { HeadlessIntentOptions, HeadlessIntentStatusResult, HeadlessPrepareResult, HeadlessSubmitOptions, HeadlessSubmitResult, InstallSmartSessionOptions, InstallSmartSessionResult, OneAuthHeadlessClient };

package/dist/headless.d.ts

@@ -0,0 +1,90 @@
+import { P as PasskeyProviderConfig, S as SponsorshipConfig, H as HeadlessIntentOptions, a as HeadlessPrepareResult, b as HeadlessSubmitOptions, c as HeadlessSubmitResult, d as HeadlessIntentStatusResult, I as InstallSmartSessionOptions, e as InstallSmartSessionResult } from './types-1BMD1PSH.js';
+export { f as SessionKeyHandle, g as SmartSessionEnableRequest } from './types-1BMD1PSH.js';
+import 'viem';
+import '@rhinestone/sdk';
+
+/**
+ * Headless 1auth client.
+ *
+ * Used by integrators that hold their own ECDSA signer in localStorage
+ * and produce signatures for an ERC-7579 validator other than the
+ * passkey one (typically `@rhinestone/sdk` experimental SmartSession).
+ *
+ * Responsibilities:
+ *  - Fetch sponsorship JWTs from the app's own backend.
+ *  - Call `/api/intent/prepare?signingMode=headless` to get an
+ *    orchestrator-quoted `intentOp` + `digestResult`.
+ *  - Forward pre-encoded validator-prefixed signatures to the new
+ *    `/api/intent/headless-execute` route.
+ *  - Drive the existing passkey dialog (via {@link OneAuthClient}) for
+ *    the one-time SmartSession install ceremony.
+ *
+ * 1auth itself stays ignorant of session keys — the on-chain
+ * SmartSession validator is the only authority over what a session key
+ * may sign for. The host app persists `{ sessionKeyAddress, permissionId,
+ * accountAddress, permissions }` in its own storage.
+ */
+
+declare class OneAuthHeadlessClient {
+    private providerUrl;
+    private clientId?;
+    private sponsorship;
+    constructor(config: PasskeyProviderConfig);
+    setSponsorship(sponsorship: SponsorshipConfig | undefined): void;
+    private fetchAccessToken;
+    private fetchExtensionToken;
+    /**
+     * Quote an intent without opening any dialog. Returns the orchestrator's
+     * `intentOp` plus the digest the caller must sign with their own
+     * validator (e.g. SmartSession). The caller is responsible for
+     * encoding signatures and submitting via {@link submitIntent}.
+     */
+    prepareIntent(options: HeadlessIntentOptions): Promise<HeadlessPrepareResult>;
+    /**
+     * Forward a pre-signed intent to the orchestrator. The caller has
+     * already encoded validator-prefixed origin + destination signatures
+     * (one origin signature per intent element); 1auth treats them as
+     * opaque bytes.
+     *
+     * If `sponsor` is omitted or `true`, an extension token is fetched
+     * just-in-time and bound to the intent. Pass `sponsor: false` for
+     * self-paying intents.
+     */
+    submitIntent(options: HeadlessSubmitOptions): Promise<HeadlessSubmitResult>;
+    /**
+     * Fetch the latest known status for a submitted headless intent.
+     * This is a non-blocking read and may return `pending` before a
+     * solver has produced a fill transaction hash.
+     */
+    getIntentStatus(intentId: string): Promise<HeadlessIntentStatusResult>;
+    /**
+     * Wait for a submitted headless intent to produce a status update and,
+     * when available, the final fill transaction hash. The wait endpoint
+     * needs the opaque `transactionResult` returned by submit because 1auth
+     * does not persist that SDK object in its database.
+     */
+    waitForIntent(intentId: string, transactionResult: unknown): Promise<HeadlessIntentStatusResult>;
+    /**
+     * Resolve the SmartSession install call(s) for `sessionKeyAddress`
+     * with the supplied `permissions`.
+     *
+     * Returns `{ install, sessionKeyHandle }`:
+     *
+     *  - `install` is a `{ targetChain, calls }` pair the caller feeds
+     *    straight into `OneAuthClient.sendIntent({ targetChain, calls })`
+     *    so the user passkey-signs the install via the existing dialog.
+     *  - `sessionKeyHandle` contains the deterministic `permissionId`
+     *    plus metadata to persist in localStorage. Persist this BEFORE
+     *    submitting the install so a refresh during signing doesn't
+     *    lose the handle.
+     *
+     * If the validator is already installed on the user's account,
+     * `install.calls` is empty and `install.alreadyInstalled` is true.
+     * The caller should still persist `sessionKeyHandle` — the on-chain
+     * session enabling happens at first headless use via SmartSession's
+     * ENABLE-mode signature wrapping (see follow-up).
+     */
+    installSmartSession(options: InstallSmartSessionOptions): Promise<InstallSmartSessionResult>;
+}
+
+export { HeadlessIntentOptions, HeadlessIntentStatusResult, HeadlessPrepareResult, HeadlessSubmitOptions, HeadlessSubmitResult, InstallSmartSessionOptions, InstallSmartSessionResult, OneAuthHeadlessClient };

package/dist/headless.js

@@ -0,0 +1,327 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/headless.ts
+var headless_exports = {};
+__export(headless_exports, {
+  OneAuthHeadlessClient: () => OneAuthHeadlessClient
+});
+module.exports = __toCommonJS(headless_exports);
+
+// src/sponsorship-fetch.ts
+async function extractServerReason(response) {
+  try {
+    const text = await response.clone().text();
+    if (!text) return response.statusText;
+    try {
+      const data = JSON.parse(text);
+      const reason = data.error ?? data.message;
+      if (typeof reason === "string" && reason.trim()) return reason;
+    } catch {
+    }
+    return text.slice(0, 200);
+  } catch {
+    return response.statusText;
+  }
+}
+async function tokenFetchError(label, response) {
+  const reason = await extractServerReason(response);
+  const suffix = reason ? `: ${reason}` : "";
+  return new Error(
+    `Failed to fetch ${label} (${response.status} ${response.statusText})${suffix}`
+  );
+}
+
+// src/headless-client.ts
+var DEFAULT_PROVIDER_URL = "https://passkey.1auth.box";
+var MISSING_APP_CREDENTIALS_MESSAGE = "No sponsorship configured on OneAuthHeadlessClient. Every user intent must carry the app's JWT \u2014 pass `sponsorship: { accessToken, getExtensionToken }` (or URL form) to the constructor.";
+function normalizeSponsorship(config) {
+  if (!config) return null;
+  if ("accessToken" in config && "getExtensionToken" in config) {
+    return config;
+  }
+  const { accessTokenUrl, extensionTokenUrl } = config;
+  return {
+    accessToken: async () => {
+      const response = await fetch(accessTokenUrl, { credentials: "include" });
+      if (!response.ok) {
+        throw await tokenFetchError("access token", response);
+      }
+      const data = await response.json();
+      if (!data.token) {
+        throw new Error("Access token response missing `token` field");
+      }
+      return data.token;
+    },
+    getExtensionToken: async (intentOp) => {
+      const response = await fetch(extensionTokenUrl, {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ intentOp })
+      });
+      if (!response.ok) {
+        throw await tokenFetchError("extension token", response);
+      }
+      const data = await response.json();
+      if (!data.token) {
+        throw new Error("Extension token response missing `token` field");
+      }
+      return data.token;
+    }
+  };
+}
+var OneAuthHeadlessClient = class {
+  constructor(config) {
+    this.providerUrl = config.providerUrl || DEFAULT_PROVIDER_URL;
+    this.clientId = config.clientId;
+    this.sponsorship = normalizeSponsorship(config.sponsorship);
+  }
+  setSponsorship(sponsorship) {
+    this.sponsorship = normalizeSponsorship(sponsorship);
+  }
+  // ---------------------------------------------------------------------------
+  // Sponsorship JWT fetchers
+  // ---------------------------------------------------------------------------
+  async fetchAccessToken() {
+    if (!this.sponsorship) {
+      return {
+        ok: false,
+        code: "MISSING_APP_CREDENTIALS",
+        message: MISSING_APP_CREDENTIALS_MESSAGE
+      };
+    }
+    try {
+      const accessToken = await this.sponsorship.accessToken();
+      return { ok: true, accessToken };
+    } catch (err) {
+      return {
+        ok: false,
+        message: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+  async fetchExtensionToken(intentOp, sponsor) {
+    if (!sponsor) return { ok: true, extensionToken: void 0 };
+    if (!this.sponsorship) {
+      return { ok: false, message: MISSING_APP_CREDENTIALS_MESSAGE };
+    }
+    try {
+      const token = await this.sponsorship.getExtensionToken(intentOp);
+      return { ok: true, extensionToken: token };
+    } catch (err) {
+      return {
+        ok: false,
+        message: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // Intent prepare / submit
+  // ---------------------------------------------------------------------------
+  /**
+   * Quote an intent without opening any dialog. Returns the orchestrator's
+   * `intentOp` plus the digest the caller must sign with their own
+   * validator (e.g. SmartSession). The caller is responsible for
+   * encoding signatures and submitting via {@link submitIntent}.
+   */
+  async prepareIntent(options) {
+    if (!options.username && !options.accountAddress) {
+      throw new Error("prepareIntent requires either `username` or `accountAddress`");
+    }
+    const accessTokenResult = await this.fetchAccessToken();
+    if (!accessTokenResult.ok) {
+      throw new Error(`Sponsorship access token fetch failed: ${accessTokenResult.message}`);
+    }
+    const tokenRequests = options.tokenRequests?.map((tr) => ({
+      token: tr.token,
+      amount: tr.amount.toString()
+    }));
+    const body = {
+      username: options.username,
+      accountAddress: options.accountAddress,
+      targetChain: options.targetChain,
+      calls: options.calls,
+      tokenRequests,
+      sourceAssets: options.sourceAssets,
+      sourceChainId: options.sourceChainId,
+      sessionKeyHandle: options.sessionKeyHandle,
+      clientId: this.clientId,
+      signingMode: "headless",
+      auth: { accessToken: accessTokenResult.accessToken }
+    };
+    const response = await fetch(`${this.providerUrl}/api/intent/prepare`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const errorData = await response.json().catch(() => ({}));
+      throw new Error(errorData.error || `Prepare failed (${response.status})`);
+    }
+    return await response.json();
+  }
+  /**
+   * Forward a pre-signed intent to the orchestrator. The caller has
+   * already encoded validator-prefixed origin + destination signatures
+   * (one origin signature per intent element); 1auth treats them as
+   * opaque bytes.
+   *
+   * If `sponsor` is omitted or `true`, an extension token is fetched
+   * just-in-time and bound to the intent. Pass `sponsor: false` for
+   * self-paying intents.
+   */
+  async submitIntent(options) {
+    const sponsor = options.sponsor ?? true;
+    const accessTokenResult = await this.fetchAccessToken();
+    if (!accessTokenResult.ok) {
+      throw new Error(`Sponsorship access token fetch failed: ${accessTokenResult.message}`);
+    }
+    const extensionResult = await this.fetchExtensionToken(options.intentOp, sponsor);
+    if (!extensionResult.ok) {
+      throw new Error(`Sponsorship extension token fetch failed: ${extensionResult.message}`);
+    }
+    const body = {
+      intentOp: options.intentOp,
+      accountAddress: options.accountAddress,
+      targetChain: options.targetChain,
+      calls: options.calls,
+      expiresAt: options.expiresAt,
+      originSignatures: options.originSignatures,
+      destinationSignature: options.destinationSignature,
+      targetExecutionSignature: options.targetExecutionSignature,
+      auth: {
+        accessToken: accessTokenResult.accessToken,
+        ...extensionResult.extensionToken && { extensionToken: extensionResult.extensionToken }
+      }
+    };
+    const response = await fetch(`${this.providerUrl}/api/intent/headless-execute`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const errorData = await response.json().catch(() => ({}));
+      throw new Error(errorData.error || `Headless execute failed (${response.status})`);
+    }
+    return await response.json();
+  }
+  // ---------------------------------------------------------------------------
+  // Status / wait — proxies to the existing routes (no headless variant needed).
+  // ---------------------------------------------------------------------------
+  /**
+   * Fetch the latest known status for a submitted headless intent.
+   * This is a non-blocking read and may return `pending` before a
+   * solver has produced a fill transaction hash.
+   */
+  async getIntentStatus(intentId) {
+    const response = await fetch(`${this.providerUrl}/api/intent/status/${intentId}`);
+    if (!response.ok) {
+      throw new Error(`Status fetch failed (${response.status})`);
+    }
+    return await response.json();
+  }
+  /**
+   * Wait for a submitted headless intent to produce a status update and,
+   * when available, the final fill transaction hash. The wait endpoint
+   * needs the opaque `transactionResult` returned by submit because 1auth
+   * does not persist that SDK object in its database.
+   */
+  async waitForIntent(intentId, transactionResult) {
+    if (!transactionResult) {
+      throw new Error("waitForIntent requires submitResult.transactionResult");
+    }
+    const response = await fetch(`${this.providerUrl}/api/intent/wait/${intentId}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ transactionResult })
+    });
+    if (!response.ok) {
+      const errorData = await response.json().catch(() => ({}));
+      throw new Error(
+        errorData.details || errorData.error || `Wait fetch failed (${response.status})`
+      );
+    }
+    return await response.json();
+  }
+  // ---------------------------------------------------------------------------
+  // SmartSession install (one-time, passkey-signed)
+  // ---------------------------------------------------------------------------
+  /**
+   * Resolve the SmartSession install call(s) for `sessionKeyAddress`
+   * with the supplied `permissions`.
+   *
+   * Returns `{ install, sessionKeyHandle }`:
+   *
+   *  - `install` is a `{ targetChain, calls }` pair the caller feeds
+   *    straight into `OneAuthClient.sendIntent({ targetChain, calls })`
+   *    so the user passkey-signs the install via the existing dialog.
+   *  - `sessionKeyHandle` contains the deterministic `permissionId`
+   *    plus metadata to persist in localStorage. Persist this BEFORE
+   *    submitting the install so a refresh during signing doesn't
+   *    lose the handle.
+   *
+   * If the validator is already installed on the user's account,
+   * `install.calls` is empty and `install.alreadyInstalled` is true.
+   * The caller should still persist `sessionKeyHandle` — the on-chain
+   * session enabling happens at first headless use via SmartSession's
+   * ENABLE-mode signature wrapping (see follow-up).
+   */
+  async installSmartSession(options) {
+    if (!options.username && !options.accountAddress) {
+      throw new Error(
+        "installSmartSession requires either `username` or `accountAddress`"
+      );
+    }
+    const accessTokenResult = await this.fetchAccessToken();
+    if (!accessTokenResult.ok) {
+      throw new Error(
+        `Sponsorship access token fetch failed: ${accessTokenResult.message}`
+      );
+    }
+    const body = {
+      username: options.username,
+      accountAddress: options.accountAddress,
+      targetChain: options.targetChain,
+      sessionKeyAddress: options.sessionKeyAddress,
+      permissions: options.permissions,
+      validUntil: options.validUntil,
+      validAfter: options.validAfter,
+      maxUses: options.maxUses,
+      enableSessionSignature: options.enableSessionSignature,
+      label: options.label,
+      auth: { accessToken: accessTokenResult.accessToken }
+    };
+    const response = await fetch(`${this.providerUrl}/api/sessions/install`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const errorData = await response.json().catch(() => ({}));
+      throw new Error(errorData.error || `Install failed (${response.status})`);
+    }
+    return await response.json();
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OneAuthHeadlessClient
+});
+//# sourceMappingURL=headless.js.map

package/dist/headless.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/headless.ts","../src/sponsorship-fetch.ts","../src/headless-client.ts"],"sourcesContent":["/**\n * Public entry point for the headless 1auth SDK.\n *\n * Exposes {@link OneAuthHeadlessClient} plus the request/response types\n * an integrating app needs when using its own ERC-7579 validator (e.g.\n * the experimental SmartSession from `@rhinestone/sdk`) to sign intents\n * locally instead of going through the passkey dialog.\n */\n\nexport { OneAuthHeadlessClient } from \"./headless-client\";\n\nexport type {\n  HeadlessIntentStatusResult,\n  HeadlessIntentOptions,\n  HeadlessPrepareResult,\n  HeadlessSubmitOptions,\n  HeadlessSubmitResult,\n  InstallSmartSessionOptions,\n  InstallSmartSessionResult,\n  SessionKeyHandle,\n  SmartSessionEnableRequest,\n} from \"./types\";\n","/**\n * Shared helpers for fetching sponsorship tokens (access + extension) from an\n * integrator's backend endpoints.\n *\n * The integrator's token routes return their failure reason in the JSON body\n * (`{ error: \"createSponsorshipSigner: missing env var(s): ...\" }`). Surfacing\n * only the HTTP status — \"Failed to fetch access token (500 ...)\" — hides that\n * reason and turns every misconfiguration into the same opaque dialog error.\n * These helpers read the body and fold the server's message into the thrown\n * Error so the actual cause (missing env var, bad JWK, expired session) is\n * visible at the call site and in the dialog.\n */\n\n/**\n * Pull a human-readable reason out of a failed token response. Tries the JSON\n * `error`/`message` fields first, then falls back to a short text snippet, then\n * to the HTTP status text. Never throws — diagnostics must not mask the original\n * failure with a parse error.\n */\nasync function extractServerReason(response: Response): Promise<string> {\n  try {\n    // Clone so a JSON parse failure can still fall back to reading text.\n    const text = await response.clone().text();\n    if (!text) return response.statusText;\n    try {\n      const data = JSON.parse(text) as { error?: unknown; message?: unknown };\n      const reason = data.error ?? data.message;\n      if (typeof reason === \"string\" && reason.trim()) return reason;\n    } catch {\n      // Body wasn't JSON — fall through to the raw text snippet.\n    }\n    // Cap the snippet so an HTML error page doesn't flood the message.\n    return text.slice(0, 200);\n  } catch {\n    return response.statusText;\n  }\n}\n\n/**\n * Build an Error for a failed token fetch that includes the server's reason.\n * `label` names the token kind, e.g. \"access token\" or \"extension token\".\n */\nexport async function tokenFetchError(\n  label: string,\n  response: Response,\n): Promise<Error> {\n  const reason = await extractServerReason(response);\n  const suffix = reason ? `: ${reason}` : \"\";\n  return new Error(\n    `Failed to fetch ${label} (${response.status} ${response.statusText})${suffix}`,\n  );\n}\n","/**\n * Headless 1auth client.\n *\n * Used by integrators that hold their own ECDSA signer in localStorage\n * and produce signatures for an ERC-7579 validator other than the\n * passkey one (typically `@rhinestone/sdk` experimental SmartSession).\n *\n * Responsibilities:\n *  - Fetch sponsorship JWTs from the app's own backend.\n *  - Call `/api/intent/prepare?signingMode=headless` to get an\n *    orchestrator-quoted `intentOp` + `digestResult`.\n *  - Forward pre-encoded validator-prefixed signatures to the new\n *    `/api/intent/headless-execute` route.\n *  - Drive the existing passkey dialog (via {@link OneAuthClient}) for\n *    the one-time SmartSession install ceremony.\n *\n * 1auth itself stays ignorant of session keys — the on-chain\n * SmartSession validator is the only authority over what a session key\n * may sign for. The host app persists `{ sessionKeyAddress, permissionId,\n * accountAddress, permissions }` in its own storage.\n */\n\nimport type {\n  HeadlessIntentOptions,\n  HeadlessIntentStatusResult,\n  HeadlessPrepareResult,\n  HeadlessSubmitOptions,\n  HeadlessSubmitResult,\n  InstallSmartSessionOptions,\n  InstallSmartSessionResult,\n  IntentTokenRequest,\n  PasskeyProviderConfig,\n  SponsorshipCallbackConfig,\n  SponsorshipConfig,\n} from \"./types\";\nimport { tokenFetchError } from \"./sponsorship-fetch\";\n\nconst DEFAULT_PROVIDER_URL = \"https://passkey.1auth.box\";\n\nconst MISSING_APP_CREDENTIALS_MESSAGE =\n  \"No sponsorship configured on OneAuthHeadlessClient. Every user intent must carry the app's JWT — pass `sponsorship: { accessToken, getExtensionToken }` (or URL form) to the constructor.\";\n\ntype AccessTokenFetchResult =\n  | { ok: true; accessToken: string }\n  | { ok: false; code?: \"MISSING_APP_CREDENTIALS\"; message: string };\n\ntype ExtensionTokenFetchResult =\n  | { ok: true; extensionToken: string | undefined }\n  | { ok: false; message: string };\n\n/**\n * Mirrors `normalizeSponsorship` in `client.ts`. Kept local so the\n * headless entry point doesn't pull in the whole OneAuthClient module\n * graph for callers that only need the headless surface.\n */\nfunction normalizeSponsorship(\n  config: SponsorshipConfig | undefined,\n): SponsorshipCallbackConfig | null {\n  if (!config) return null;\n  if (\"accessToken\" in config && \"getExtensionToken\" in config) {\n    return config;\n  }\n  const { accessTokenUrl, extensionTokenUrl } = config;\n  return {\n    accessToken: async () => {\n      const response = await fetch(accessTokenUrl, { credentials: \"include\" });\n      if (!response.ok) {\n        throw await tokenFetchError(\"access token\", response);\n      }\n      const data = (await response.json()) as { token?: string };\n      if (!data.token) {\n        throw new Error(\"Access token response missing `token` field\");\n      }\n      return data.token;\n    },\n    getExtensionToken: async (intentOp: string) => {\n      const response = await fetch(extensionTokenUrl, {\n        method: \"POST\",\n        credentials: \"include\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({ intentOp }),\n      });\n      if (!response.ok) {\n        throw await tokenFetchError(\"extension token\", response);\n      }\n      const data = (await response.json()) as { token?: string };\n      if (!data.token) {\n        throw new Error(\"Extension token response missing `token` field\");\n      }\n      return data.token;\n    },\n  };\n}\n\nexport class OneAuthHeadlessClient {\n  private providerUrl: string;\n  private clientId?: string;\n  private sponsorship: SponsorshipCallbackConfig | null;\n\n  constructor(config: PasskeyProviderConfig) {\n    this.providerUrl = config.providerUrl || DEFAULT_PROVIDER_URL;\n    this.clientId = config.clientId;\n    this.sponsorship = normalizeSponsorship(config.sponsorship);\n  }\n\n  setSponsorship(sponsorship: SponsorshipConfig | undefined): void {\n    this.sponsorship = normalizeSponsorship(sponsorship);\n  }\n\n  // ---------------------------------------------------------------------------\n  // Sponsorship JWT fetchers\n  // ---------------------------------------------------------------------------\n\n  private async fetchAccessToken(): Promise<AccessTokenFetchResult> {\n    if (!this.sponsorship) {\n      return {\n        ok: false,\n        code: \"MISSING_APP_CREDENTIALS\",\n        message: MISSING_APP_CREDENTIALS_MESSAGE,\n      };\n    }\n    try {\n      const accessToken = await this.sponsorship.accessToken();\n      return { ok: true, accessToken };\n    } catch (err) {\n      return {\n        ok: false,\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  private async fetchExtensionToken(\n    intentOp: string,\n    sponsor: boolean,\n  ): Promise<ExtensionTokenFetchResult> {\n    if (!sponsor) return { ok: true, extensionToken: undefined };\n    if (!this.sponsorship) {\n      return { ok: false, message: MISSING_APP_CREDENTIALS_MESSAGE };\n    }\n    try {\n      const token = await this.sponsorship.getExtensionToken(intentOp);\n      return { ok: true, extensionToken: token };\n    } catch (err) {\n      return {\n        ok: false,\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // Intent prepare / submit\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Quote an intent without opening any dialog. Returns the orchestrator's\n   * `intentOp` plus the digest the caller must sign with their own\n   * validator (e.g. SmartSession). The caller is responsible for\n   * encoding signatures and submitting via {@link submitIntent}.\n   */\n  async prepareIntent(options: HeadlessIntentOptions): Promise<HeadlessPrepareResult> {\n    if (!options.username && !options.accountAddress) {\n      throw new Error(\"prepareIntent requires either `username` or `accountAddress`\");\n    }\n\n    const accessTokenResult = await this.fetchAccessToken();\n    if (!accessTokenResult.ok) {\n      throw new Error(`Sponsorship access token fetch failed: ${accessTokenResult.message}`);\n    }\n\n    // bigint → string conversion for token requests; matches what the\n    // dialog flow does before serializing requestBody.\n    const tokenRequests = options.tokenRequests?.map((tr: IntentTokenRequest) => ({\n      token: tr.token,\n      amount: tr.amount.toString(),\n    }));\n\n    const body = {\n      username: options.username,\n      accountAddress: options.accountAddress,\n      targetChain: options.targetChain,\n      calls: options.calls,\n      tokenRequests,\n      sourceAssets: options.sourceAssets,\n      sourceChainId: options.sourceChainId,\n      sessionKeyHandle: options.sessionKeyHandle,\n      clientId: this.clientId,\n      signingMode: \"headless\" as const,\n      auth: { accessToken: accessTokenResult.accessToken },\n    };\n\n    const response = await fetch(`${this.providerUrl}/api/intent/prepare`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as { error?: string };\n      throw new Error(errorData.error || `Prepare failed (${response.status})`);\n    }\n\n    return (await response.json()) as HeadlessPrepareResult;\n  }\n\n  /**\n   * Forward a pre-signed intent to the orchestrator. The caller has\n   * already encoded validator-prefixed origin + destination signatures\n   * (one origin signature per intent element); 1auth treats them as\n   * opaque bytes.\n   *\n   * If `sponsor` is omitted or `true`, an extension token is fetched\n   * just-in-time and bound to the intent. Pass `sponsor: false` for\n   * self-paying intents.\n   */\n  async submitIntent(options: HeadlessSubmitOptions): Promise<HeadlessSubmitResult> {\n    const sponsor = options.sponsor ?? true;\n    const accessTokenResult = await this.fetchAccessToken();\n    if (!accessTokenResult.ok) {\n      throw new Error(`Sponsorship access token fetch failed: ${accessTokenResult.message}`);\n    }\n\n    const extensionResult = await this.fetchExtensionToken(options.intentOp, sponsor);\n    if (!extensionResult.ok) {\n      throw new Error(`Sponsorship extension token fetch failed: ${extensionResult.message}`);\n    }\n\n    const body = {\n      intentOp: options.intentOp,\n      accountAddress: options.accountAddress,\n      targetChain: options.targetChain,\n      calls: options.calls,\n      expiresAt: options.expiresAt,\n      originSignatures: options.originSignatures,\n      destinationSignature: options.destinationSignature,\n      targetExecutionSignature: options.targetExecutionSignature,\n      auth: {\n        accessToken: accessTokenResult.accessToken,\n        ...(extensionResult.extensionToken && { extensionToken: extensionResult.extensionToken }),\n      },\n    };\n\n    const response = await fetch(`${this.providerUrl}/api/intent/headless-execute`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as { error?: string };\n      throw new Error(errorData.error || `Headless execute failed (${response.status})`);\n    }\n\n    return (await response.json()) as HeadlessSubmitResult;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Status / wait — proxies to the existing routes (no headless variant needed).\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Fetch the latest known status for a submitted headless intent.\n   * This is a non-blocking read and may return `pending` before a\n   * solver has produced a fill transaction hash.\n   */\n  async getIntentStatus(intentId: string): Promise<HeadlessIntentStatusResult> {\n    const response = await fetch(`${this.providerUrl}/api/intent/status/${intentId}`);\n    if (!response.ok) {\n      throw new Error(`Status fetch failed (${response.status})`);\n    }\n    return (await response.json()) as HeadlessIntentStatusResult;\n  }\n\n  /**\n   * Wait for a submitted headless intent to produce a status update and,\n   * when available, the final fill transaction hash. The wait endpoint\n   * needs the opaque `transactionResult` returned by submit because 1auth\n   * does not persist that SDK object in its database.\n   */\n  async waitForIntent(\n    intentId: string,\n    transactionResult: unknown,\n  ): Promise<HeadlessIntentStatusResult> {\n    if (!transactionResult) {\n      throw new Error(\"waitForIntent requires submitResult.transactionResult\");\n    }\n\n    const response = await fetch(`${this.providerUrl}/api/intent/wait/${intentId}`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ transactionResult }),\n    });\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as {\n        error?: string;\n        details?: string;\n      };\n      throw new Error(\n        errorData.details || errorData.error || `Wait fetch failed (${response.status})`,\n      );\n    }\n    return (await response.json()) as HeadlessIntentStatusResult;\n  }\n\n  // ---------------------------------------------------------------------------\n  // SmartSession install (one-time, passkey-signed)\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Resolve the SmartSession install call(s) for `sessionKeyAddress`\n   * with the supplied `permissions`.\n   *\n   * Returns `{ install, sessionKeyHandle }`:\n   *\n   *  - `install` is a `{ targetChain, calls }` pair the caller feeds\n   *    straight into `OneAuthClient.sendIntent({ targetChain, calls })`\n   *    so the user passkey-signs the install via the existing dialog.\n   *  - `sessionKeyHandle` contains the deterministic `permissionId`\n   *    plus metadata to persist in localStorage. Persist this BEFORE\n   *    submitting the install so a refresh during signing doesn't\n   *    lose the handle.\n   *\n   * If the validator is already installed on the user's account,\n   * `install.calls` is empty and `install.alreadyInstalled` is true.\n   * The caller should still persist `sessionKeyHandle` — the on-chain\n   * session enabling happens at first headless use via SmartSession's\n   * ENABLE-mode signature wrapping (see follow-up).\n   */\n  async installSmartSession(\n    options: InstallSmartSessionOptions,\n  ): Promise<InstallSmartSessionResult> {\n    if (!options.username && !options.accountAddress) {\n      throw new Error(\n        \"installSmartSession requires either `username` or `accountAddress`\",\n      );\n    }\n\n    const accessTokenResult = await this.fetchAccessToken();\n    if (!accessTokenResult.ok) {\n      throw new Error(\n        `Sponsorship access token fetch failed: ${accessTokenResult.message}`,\n      );\n    }\n\n    const body = {\n      username: options.username,\n      accountAddress: options.accountAddress,\n      targetChain: options.targetChain,\n      sessionKeyAddress: options.sessionKeyAddress,\n      permissions: options.permissions,\n      validUntil: options.validUntil,\n      validAfter: options.validAfter,\n      maxUses: options.maxUses,\n      enableSessionSignature: options.enableSessionSignature,\n      label: options.label,\n      auth: { accessToken: accessTokenResult.accessToken },\n    };\n\n    const response = await fetch(`${this.providerUrl}/api/sessions/install`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as {\n        error?: string;\n      };\n      throw new Error(errorData.error || `Install failed (${response.status})`);\n    }\n\n    return (await response.json()) as InstallSmartSessionResult;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACmBA,eAAe,oBAAoB,UAAqC;AACtE,MAAI;AAEF,UAAM,OAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AACzC,QAAI,CAAC,KAAM,QAAO,SAAS;AAC3B,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,SAAS,KAAK,SAAS,KAAK;AAClC,UAAI,OAAO,WAAW,YAAY,OAAO,KAAK,EAAG,QAAO;AAAA,IAC1D,QAAQ;AAAA,IAER;AAEA,WAAO,KAAK,MAAM,GAAG,GAAG;AAAA,EAC1B,QAAQ;AACN,WAAO,SAAS;AAAA,EAClB;AACF;AAMA,eAAsB,gBACpB,OACA,UACgB;AAChB,QAAM,SAAS,MAAM,oBAAoB,QAAQ;AACjD,QAAM,SAAS,SAAS,KAAK,MAAM,KAAK;AACxC,SAAO,IAAI;AAAA,IACT,mBAAmB,KAAK,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU,IAAI,MAAM;AAAA,EAC/E;AACF;;;ACdA,IAAM,uBAAuB;AAE7B,IAAM,kCACJ;AAeF,SAAS,qBACP,QACkC;AAClC,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,iBAAiB,UAAU,uBAAuB,QAAQ;AAC5D,WAAO;AAAA,EACT;AACA,QAAM,EAAE,gBAAgB,kBAAkB,IAAI;AAC9C,SAAO;AAAA,IACL,aAAa,YAAY;AACvB,YAAM,WAAW,MAAM,MAAM,gBAAgB,EAAE,aAAa,UAAU,CAAC;AACvE,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,MAAM,gBAAgB,gBAAgB,QAAQ;AAAA,MACtD;AACA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,UAAI,CAAC,KAAK,OAAO;AACf,cAAM,IAAI,MAAM,6CAA6C;AAAA,MAC/D;AACA,aAAO,KAAK;AAAA,IACd;AAAA,IACA,mBAAmB,OAAO,aAAqB;AAC7C,YAAM,WAAW,MAAM,MAAM,mBAAmB;AAAA,QAC9C,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,MACnC,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,MAAM,gBAAgB,mBAAmB,QAAQ;AAAA,MACzD;AACA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,UAAI,CAAC,KAAK,OAAO;AACf,cAAM,IAAI,MAAM,gDAAgD;AAAA,MAClE;AACA,aAAO,KAAK;AAAA,IACd;AAAA,EACF;AACF;AAEO,IAAM,wBAAN,MAA4B;AAAA,EAKjC,YAAY,QAA+B;AACzC,SAAK,cAAc,OAAO,eAAe;AACzC,SAAK,WAAW,OAAO;AACvB,SAAK,cAAc,qBAAqB,OAAO,WAAW;AAAA,EAC5D;AAAA,EAEA,eAAe,aAAkD;AAC/D,SAAK,cAAc,qBAAqB,WAAW;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,mBAAoD;AAChE,QAAI,CAAC,KAAK,aAAa;AACrB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,SAAS;AAAA,MACX;AAAA,IACF;AACA,QAAI;AACF,YAAM,cAAc,MAAM,KAAK,YAAY,YAAY;AACvD,aAAO,EAAE,IAAI,MAAM,YAAY;AAAA,IACjC,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,oBACZ,UACA,SACoC;AACpC,QAAI,CAAC,QAAS,QAAO,EAAE,IAAI,MAAM,gBAAgB,OAAU;AAC3D,QAAI,CAAC,KAAK,aAAa;AACrB,aAAO,EAAE,IAAI,OAAO,SAAS,gCAAgC;AAAA,IAC/D;AACA,QAAI;AACF,YAAM,QAAQ,MAAM,KAAK,YAAY,kBAAkB,QAAQ;AAC/D,aAAO,EAAE,IAAI,MAAM,gBAAgB,MAAM;AAAA,IAC3C,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,cAAc,SAAgE;AAClF,QAAI,CAAC,QAAQ,YAAY,CAAC,QAAQ,gBAAgB;AAChD,YAAM,IAAI,MAAM,8DAA8D;AAAA,IAChF;AAEA,UAAM,oBAAoB,MAAM,KAAK,iBAAiB;AACtD,QAAI,CAAC,kBAAkB,IAAI;AACzB,YAAM,IAAI,MAAM,0CAA0C,kBAAkB,OAAO,EAAE;AAAA,IACvF;AAIA,UAAM,gBAAgB,QAAQ,eAAe,IAAI,CAAC,QAA4B;AAAA,MAC5E,OAAO,GAAG;AAAA,MACV,QAAQ,GAAG,OAAO,SAAS;AAAA,IAC7B,EAAE;AAEF,UAAM,OAAO;AAAA,MACX,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,aAAa,QAAQ;AAAA,MACrB,OAAO,QAAQ;AAAA,MACf;AAAA,MACA,cAAc,QAAQ;AAAA,MACtB,eAAe,QAAQ;AAAA,MACvB,kBAAkB,QAAQ;AAAA,MAC1B,UAAU,KAAK;AAAA,MACf,aAAa;AAAA,MACb,MAAM,EAAE,aAAa,kBAAkB,YAAY;AAAA,IACrD;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,uBAAuB;AAAA,MACrE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACzD,YAAM,IAAI,MAAM,UAAU,SAAS,mBAAmB,SAAS,MAAM,GAAG;AAAA,IAC1E;AAEA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,aAAa,SAA+D;AAChF,UAAM,UAAU,QAAQ,WAAW;AACnC,UAAM,oBAAoB,MAAM,KAAK,iBAAiB;AACtD,QAAI,CAAC,kBAAkB,IAAI;AACzB,YAAM,IAAI,MAAM,0CAA0C,kBAAkB,OAAO,EAAE;AAAA,IACvF;AAEA,UAAM,kBAAkB,MAAM,KAAK,oBAAoB,QAAQ,UAAU,OAAO;AAChF,QAAI,CAAC,gBAAgB,IAAI;AACvB,YAAM,IAAI,MAAM,6CAA6C,gBAAgB,OAAO,EAAE;AAAA,IACxF;AAEA,UAAM,OAAO;AAAA,MACX,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,aAAa,QAAQ;AAAA,MACrB,OAAO,QAAQ;AAAA,MACf,WAAW,QAAQ;AAAA,MACnB,kBAAkB,QAAQ;AAAA,MAC1B,sBAAsB,QAAQ;AAAA,MAC9B,0BAA0B,QAAQ;AAAA,MAClC,MAAM;AAAA,QACJ,aAAa,kBAAkB;AAAA,QAC/B,GAAI,gBAAgB,kBAAkB,EAAE,gBAAgB,gBAAgB,eAAe;AAAA,MACzF;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,gCAAgC;AAAA,MAC9E,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACzD,YAAM,IAAI,MAAM,UAAU,SAAS,4BAA4B,SAAS,MAAM,GAAG;AAAA,IACnF;AAEA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,gBAAgB,UAAuD;AAC3E,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,sBAAsB,QAAQ,EAAE;AAChF,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MAAM,wBAAwB,SAAS,MAAM,GAAG;AAAA,IAC5D;AACA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,cACJ,UACA,mBACqC;AACrC,QAAI,CAAC,mBAAmB;AACtB,YAAM,IAAI,MAAM,uDAAuD;AAAA,IACzE;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,oBAAoB,QAAQ,IAAI;AAAA,MAC9E,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,kBAAkB,CAAC;AAAA,IAC5C,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAIzD,YAAM,IAAI;AAAA,QACR,UAAU,WAAW,UAAU,SAAS,sBAAsB,SAAS,MAAM;AAAA,MAC/E;AAAA,IACF;AACA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,MAAM,oBACJ,SACoC;AACpC,QAAI,CAAC,QAAQ,YAAY,CAAC,QAAQ,gBAAgB;AAChD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,oBAAoB,MAAM,KAAK,iBAAiB;AACtD,QAAI,CAAC,kBAAkB,IAAI;AACzB,YAAM,IAAI;AAAA,QACR,0CAA0C,kBAAkB,OAAO;AAAA,MACrE;AAAA,IACF;AAEA,UAAM,OAAO;AAAA,MACX,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,aAAa,QAAQ;AAAA,MACrB,mBAAmB,QAAQ;AAAA,MAC3B,aAAa,QAAQ;AAAA,MACrB,YAAY,QAAQ;AAAA,MACpB,YAAY,QAAQ;AAAA,MACpB,SAAS,QAAQ;AAAA,MACjB,wBAAwB,QAAQ;AAAA,MAChC,OAAO,QAAQ;AAAA,MACf,MAAM,EAAE,aAAa,kBAAkB,YAAY;AAAA,IACrD;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,WAAW,yBAAyB;AAAA,MACvE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAGzD,YAAM,IAAI,MAAM,UAAU,SAAS,mBAAmB,SAAS,MAAM,GAAG;AAAA,IAC1E;AAEA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AACF;","names":[]}