@shieldedtech/moth-wallet 0.2.0

package/dist/wallet/manager.js

@@ -0,0 +1,474 @@
+import { WalletError } from '../types/errors.js';
+import { generateMnemonic24, validateMnemonic, mnemonicToSeed } from './mnemonic.js';
+import { encryptKeystore, decryptKeystore, keystoreNeedsUpgrade } from './keystore.js';
+import { deriveAllAddressesFromSeed, deriveRawKeys, Roles } from './address.js';
+import { deriveWalletKeys } from '../sync/operations.js';
+import { removeWalletSyncArtifacts } from '../sync/wallet-sync.js';
+const CONFIG_KEY = 'config.json';
+const DEFAULT_CONFIG = {
+    activeWallet: null,
+    wallets: [],
+    defaultNetwork: 'devnet',
+    configVersion: 1,
+};
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+function walletKey(name) {
+    return `wallets/${name}.keystore`;
+}
+// Unencrypted metadata — name, network, and the public receive address. The
+// bech32m address is public (it's what you hand out to receive funds), so it's
+// safe to store in the clear; it lets the wallet list show a real address
+// without unlocking. No private keys or seed material are stored here.
+function metaKey(name) {
+    return `wallets/${name}.meta`;
+}
+/**
+ * Read the per-network birthday, migrating the legacy single value.
+ *
+ * The old `birthday` belonged to whichever network the wallet was on when it
+ * was written, which is `meta.network` — it was discarded on any switch, so a
+ * stored one cannot refer to anywhere else.
+ */
+function birthdayFor(meta, network) {
+    if (meta.birthdays && meta.birthdays[network] !== undefined)
+        return meta.birthdays[network];
+    if (meta.birthday !== undefined && meta.network === network)
+        return meta.birthday;
+    return undefined;
+}
+export class WalletManager {
+    storage;
+    constructor(storage) {
+        this.storage = storage;
+    }
+    async loadConfig() {
+        const data = await this.storage.read(CONFIG_KEY);
+        // Deep-copy the default: a shallow `{ ...DEFAULT_CONFIG }` shares the
+        // `wallets` array with the module-level constant, so the first generate()
+        // on empty storage would push into DEFAULT_CONFIG itself and every later
+        // fresh manager would then see that wallet as already existing.
+        if (!data)
+            return { ...DEFAULT_CONFIG, wallets: [...DEFAULT_CONFIG.wallets] };
+        return JSON.parse(decoder.decode(data));
+    }
+    async saveConfig(config) {
+        await this.storage.write(CONFIG_KEY, encoder.encode(JSON.stringify(config, null, 2)));
+    }
+    async saveMeta(meta) {
+        await this.storage.write(metaKey(meta.name), encoder.encode(JSON.stringify(meta)));
+    }
+    async loadMeta(name) {
+        const data = await this.storage.read(metaKey(name));
+        if (!data)
+            return null;
+        return JSON.parse(decoder.decode(data));
+    }
+    validateName(name) {
+        if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
+            throw new WalletError('WALLET_ERROR', `Invalid wallet name "${name}": must match [a-zA-Z0-9_-]+`);
+        }
+    }
+    seedToHex(seed) {
+        return Array.from(seed).map((b) => b.toString(16).padStart(2, '0')).join('');
+    }
+    deriveAddressesFromSeed(seedHex) {
+        return deriveAllAddressesFromSeed(seedHex);
+    }
+    /** Public night receive address, preferring the wallet's own network. */
+    primaryAddress(addresses, network) {
+        const bech32m = addresses.nightExternal.bech32m;
+        return ((network ? bech32m[network] : undefined) ??
+            bech32m['devnet'] ??
+            bech32m['preprod'] ??
+            Object.values(bech32m)[0] ??
+            '');
+    }
+    async generate(name, passphrase, network = 'devnet', birthday, 
+    // Optionally persist a caller-supplied phrase instead of a fresh one. The
+    // setup flow shows the words before asking for a password, then hands the
+    // same phrase back here so the stored wallet matches what the user wrote down.
+    mnemonic) {
+        this.validateName(name);
+        const config = await this.loadConfig();
+        if (config.wallets.includes(name)) {
+            throw new WalletError('WALLET_ERROR', `Wallet "${name}" already exists`);
+        }
+        if (mnemonic !== undefined && !validateMnemonic(mnemonic)) {
+            throw new WalletError('INVALID_INPUT', 'Invalid BIP-39 mnemonic');
+        }
+        const phrase = mnemonic ?? generateMnemonic24();
+        const seed = await mnemonicToSeed(phrase);
+        const seedHex = this.seedToHex(seed);
+        const addresses = this.deriveAddressesFromSeed(seedHex);
+        const address = this.primaryAddress(addresses, network);
+        const keystore = await encryptKeystore(phrase, passphrase);
+        await this.storage.write(walletKey(name), encoder.encode(JSON.stringify(keystore)));
+        const meta = {
+            name,
+            network,
+            createdAt: new Date().toISOString(),
+            address,
+            createdHere: true,
+            ...(birthday !== undefined ? { birthdays: { [network]: birthday } } : {}),
+        };
+        await this.saveMeta(meta);
+        config.wallets.push(name);
+        if (!config.activeWallet)
+            config.activeWallet = name;
+        await this.saveConfig(config);
+        seed.fill(0);
+        return { name, address, addresses, network, active: config.activeWallet === name, mnemonic: phrase, birthday };
+    }
+    async import(name, mnemonic, passphrase, network = 'devnet') {
+        this.validateName(name);
+        if (!validateMnemonic(mnemonic)) {
+            throw new WalletError('INVALID_INPUT', 'Invalid BIP-39 mnemonic');
+        }
+        const config = await this.loadConfig();
+        if (config.wallets.includes(name)) {
+            throw new WalletError('WALLET_ERROR', `Wallet "${name}" already exists`);
+        }
+        const seed = await mnemonicToSeed(mnemonic);
+        const seedHex = this.seedToHex(seed);
+        const addresses = this.deriveAddressesFromSeed(seedHex);
+        const address = this.primaryAddress(addresses, network);
+        const keystore = await encryptKeystore(mnemonic, passphrase);
+        await this.storage.write(walletKey(name), encoder.encode(JSON.stringify(keystore)));
+        const meta = { name, network, createdAt: new Date().toISOString(), address, createdHere: false };
+        await this.saveMeta(meta);
+        config.wallets.push(name);
+        if (!config.activeWallet)
+            config.activeWallet = name;
+        await this.saveConfig(config);
+        seed.fill(0);
+        return { name, address, addresses, network, active: config.activeWallet === name };
+    }
+    async importFromSeed(name, hexSeed, passphrase, network = 'devnet') {
+        const addresses = this.deriveAddressesFromSeed(hexSeed);
+        const address = this.primaryAddress(addresses, network);
+        const keystore = await encryptKeystore(`seed:${hexSeed}`, passphrase);
+        this.validateName(name);
+        const config = await this.loadConfig();
+        if (config.wallets.includes(name)) {
+            throw new WalletError('WALLET_ERROR', `Wallet "${name}" already exists`);
+        }
+        await this.storage.write(walletKey(name), encoder.encode(JSON.stringify(keystore)));
+        const meta = { name, network, createdAt: new Date().toISOString(), address, createdHere: false };
+        await this.saveMeta(meta);
+        config.wallets.push(name);
+        if (!config.activeWallet)
+            config.activeWallet = name;
+        await this.saveConfig(config);
+        return { name, address, addresses, network, active: config.activeWallet === name };
+    }
+    /** Read and revive a wallet's keystore from storage (JSON round-trips
+     *  Uint8Array fields as index-keyed objects). */
+    async readKeystore(name) {
+        const keystoreData = await this.storage.read(walletKey(name));
+        if (!keystoreData) {
+            throw new WalletError('WALLET_ERROR', `Wallet "${name}" not found`);
+        }
+        const keystore = JSON.parse(decoder.decode(keystoreData));
+        return {
+            ...keystore,
+            salt: new Uint8Array(Object.values(keystore.salt)),
+            nonce: new Uint8Array(Object.values(keystore.nonce)),
+            ciphertext: new Uint8Array(Object.values(keystore.ciphertext)),
+            tag: new Uint8Array(Object.values(keystore.tag)),
+        };
+    }
+    async unlock(name, passphrase) {
+        const restored = await this.readKeystore(name);
+        // Validate field lengths before attempting decryption (CWE-20).
+        // Prevents crafted keystores from reaching the cipher with invalid parameters.
+        if (restored.salt.length !== 32)
+            throw new WalletError('WALLET_ERROR', 'Corrupted keystore: invalid salt length');
+        if (restored.nonce.length !== 12)
+            throw new WalletError('WALLET_ERROR', 'Corrupted keystore: invalid nonce length');
+        if (restored.tag.length !== 16)
+            throw new WalletError('WALLET_ERROR', 'Corrupted keystore: invalid auth tag length');
+        if (restored.ciphertext.length === 0)
+            throw new WalletError('WALLET_ERROR', 'Corrupted keystore: empty ciphertext');
+        const decrypted = await decryptKeystore(restored, passphrase);
+        // Transparent KDF upgrade: re-encrypt with stronger scrypt parameters if needed.
+        // This runs once per v1 keystore, after the first successful unlock.
+        if (keystoreNeedsUpgrade(restored)) {
+            try {
+                const upgraded = await encryptKeystore(decrypted, passphrase);
+                const blob = new TextEncoder().encode(JSON.stringify(upgraded));
+                // Must be walletKey(name) (`wallets/<name>.keystore`), not
+                // `wallets/<name>`: the latter wrote to a phantom key, so the upgrade
+                // never persisted and re-ran on every unlock. unlock() reads
+                // walletKey(name), so write the re-encrypted keystore back there.
+                await this.storage.write(walletKey(name), blob);
+            }
+            catch {
+                // Non-fatal — the wallet still works with the old parameters
+            }
+        }
+        // Derive the seed into the typed key bundle, then drop the raw
+        // string immediately. The seedHex variable stays scoped to this
+        // function — never escapes to the UnlockedWallet object.
+        // See docs/spec/wallet-service/05-key-management.md D-KM-3.
+        let seedHex;
+        if (decrypted.startsWith('seed:')) {
+            seedHex = decrypted.slice(5);
+        }
+        else {
+            const seed = await mnemonicToSeed(decrypted);
+            seedHex = this.seedToHex(seed);
+            seed.fill(0);
+        }
+        const addresses = this.deriveAddressesFromSeed(seedHex);
+        const meta = await this.loadMeta(name);
+        const network = meta?.network ?? (await this.loadConfig()).defaultNetwork;
+        const address = this.primaryAddress(addresses, network);
+        // Backfill the public address for wallets created before it was stored (or
+        // re-derive it after a network change), so the account list can show it
+        // without another unlock.
+        if (meta && meta.address !== address) {
+            await this.saveMeta({ ...meta, address });
+        }
+        const rawKeys = deriveRawKeys(seedHex);
+        const keys = {
+            nightExternal: rawKeys[Roles.NightExternal],
+            nightInternal: rawKeys[Roles.NightInternal],
+            dust: rawKeys[Roles.Dust],
+            zswap: rawKeys[Roles.Zswap],
+            metadata: rawKeys[Roles.Metadata],
+        };
+        const walletKeys = deriveWalletKeys(seedHex);
+        // Seed is no longer needed — overwrite the local variable.
+        seedHex = '';
+        let locked = false;
+        // Actually scrub key material — not just flip a flag. Zero the raw
+        // byte arrays and clear() the WASM-held secret keys so a compromised
+        // process can't recover them after lock. Best-effort and idempotent:
+        // a clear() throw (e.g. already freed) must not stop the rest.
+        const lock = () => {
+            if (locked)
+                return;
+            locked = true;
+            for (const b of [
+                keys.nightExternal,
+                keys.nightInternal,
+                keys.dust,
+                keys.zswap,
+                keys.metadata,
+                walletKeys.nightExternalKey,
+            ]) {
+                try {
+                    b.fill(0);
+                }
+                catch {
+                    /* not a writable view — ignore */
+                }
+            }
+            try {
+                walletKeys.shieldedSecretKeys.clear();
+            }
+            catch {
+                /* already cleared/freed */
+            }
+            try {
+                walletKeys.dustSecretKey.clear();
+            }
+            catch {
+                /* already cleared/freed */
+            }
+        };
+        return {
+            name,
+            label: meta?.label,
+            network,
+            address,
+            addresses,
+            keys,
+            walletKeys,
+            lock,
+        };
+    }
+    /**
+     * Recover the raw BIP-39 hex seed for a wallet.
+     *
+     * This is the ONE deliberate exception to Option A's derive-and-drop
+     * (D-KM-3): the common `unlock()` path derives `walletKeys` and drops the
+     * seed so `UnlockedWallet` is seed-free, and the daemon/CLI/multi-tenant
+     * host never see raw seed material. But the browser extension's offscreen
+     * document is the key-holder, and Chrome tears it down and recreates it at
+     * will — the WASM `walletKeys` cannot cross the runtime-message boundary, so
+     * the offscreen needs a *serializable* secret the background can re-supply to
+     * rebuild the key bundle after each restart. That secret is the seed.
+     *
+     * Kept off `unlock()` on purpose so the seed-free invariant holds for every
+     * caller that doesn't explicitly opt in here.
+     * See docs/spec/wallet-service/05-key-management.md D-KM-3.
+     */
+    async exportSeedHex(name, passphrase) {
+        const restored = await this.readKeystore(name);
+        const decrypted = await decryptKeystore(restored, passphrase);
+        if (decrypted.startsWith('seed:'))
+            return decrypted.slice(5);
+        const seed = await mnemonicToSeed(decrypted);
+        const seedHex = this.seedToHex(seed);
+        seed.fill(0);
+        return seedHex;
+    }
+    /**
+     * Recover the wallet's backup secret for a user-facing reveal: the original
+     * BIP-39 mnemonic when the wallet has one, or the raw hex seed for wallets
+     * imported from hex (no mnemonic ever existed). Passphrase-gated by the
+     * keystore decrypt itself — a wrong passphrase rejects. Same deliberate
+     * D-KM-3 opt-in rationale as exportSeedHex above.
+     */
+    async exportPhrase(name, passphrase) {
+        const restored = await this.readKeystore(name);
+        const decrypted = await decryptKeystore(restored, passphrase);
+        if (decrypted.startsWith('seed:'))
+            return { kind: 'seed', value: decrypted.slice(5) };
+        return { kind: 'mnemonic', value: decrypted };
+    }
+    async remove(name) {
+        const config = await this.loadConfig();
+        if (!config.wallets.includes(name)) {
+            throw new WalletError('WALLET_ERROR', `Wallet "${name}" not found`);
+        }
+        // Read meta BEFORE deleting it so we know which network's sync
+        // artifacts to clean. A wallet records exactly one network at
+        // generation; subsequent unlocks always run on that same id.
+        let networkId = null;
+        try {
+            const metaBuf = await this.storage.read(metaKey(name));
+            if (metaBuf) {
+                const meta = JSON.parse(new TextDecoder().decode(metaBuf));
+                networkId = meta.network ?? null;
+            }
+        }
+        catch {
+            /* meta unreadable — proceed; cache cleanup is best-effort anyway */
+        }
+        await this.storage.delete(walletKey(name));
+        await this.storage.delete(metaKey(name));
+        // Clean per-wallet sync artifacts (~/.moth/sync/<network>/<name>/
+        // and the matching .sock). Without this, regenerating a wallet
+        // under the same name would silently inherit stale sync state
+        // belonging to the prior seed — a real footgun observed during
+        // 2026-06-22 debugging. See docs/spec/wallet-service/COMMANDS.md
+        // §"Wallet lifecycle" for the full list of what remove touches.
+        if (networkId) {
+            await removeWalletSyncArtifacts(name, networkId);
+        }
+        config.wallets = config.wallets.filter(w => w !== name);
+        if (config.activeWallet === name) {
+            config.activeWallet = config.wallets[0] ?? null;
+        }
+        await this.saveConfig(config);
+    }
+    /**
+     * List wallets. Returns the name, network and public receive address (stored
+     * in the clear at create/import time). The full per-role address set and any
+     * key material still require unlock — only the primary night address is here.
+     */
+    async list() {
+        const config = await this.loadConfig();
+        const wallets = [];
+        const emptyAddr = { hex: '', bech32m: {} };
+        const lockedAddresses = {
+            nightExternal: emptyAddr, nightInternal: emptyAddr,
+            dust: emptyAddr, zswap: emptyAddr, metadata: emptyAddr,
+        };
+        for (const name of config.wallets) {
+            const meta = await this.loadMeta(name);
+            wallets.push({
+                name,
+                address: meta?.address ?? '(locked)',
+                addresses: lockedAddresses,
+                network: meta?.network ?? config.defaultNetwork,
+                active: config.activeWallet === name,
+                birthday: meta ? birthdayFor(meta, meta.network) : undefined,
+                label: meta?.label,
+            });
+        }
+        return wallets;
+    }
+    async getActive() {
+        const config = await this.loadConfig();
+        return config.activeWallet;
+    }
+    async setActive(name) {
+        const config = await this.loadConfig();
+        if (!config.wallets.includes(name)) {
+            throw new WalletError('WALLET_ERROR', `Wallet "${name}" not found`);
+        }
+        config.activeWallet = name;
+        await this.saveConfig(config);
+    }
+    /**
+     * Set or clear a wallet's display label. Labels are presentation-only
+     * metadata: the wallet keeps its immutable `name` (the storage key), so
+     * keystores, sync caches and sessions all stay valid across renames.
+     * An empty (or whitespace-only) label reverts to showing the name.
+     */
+    async setLabel(name, label) {
+        const meta = await this.loadMeta(name);
+        if (!meta) {
+            throw new WalletError('WALLET_ERROR', `Wallet "${name}" not found`);
+        }
+        const trimmed = label.trim();
+        const { label: _cleared, ...rest } = meta;
+        await this.saveMeta(trimmed ? { ...rest, label: trimmed } : rest);
+    }
+    /**
+     * Move a wallet to another network. Only this wallet's metadata changes —
+     * other wallets keep their own networks. The public address and chain
+     * birthday are network-scoped, so the old values are discarded. A caller
+     * that already has the unlocked seed may provide the newly derived public
+     * address to keep the locked account list immediately useful.
+     */
+    async setNetwork(name, network, address, birthday) {
+        const meta = await this.loadMeta(name);
+        if (!meta) {
+            throw new WalletError('WALLET_ERROR', `Wallet "${name}" not found`);
+        }
+        if (meta.network === network) {
+            if (address !== undefined && address !== meta.address)
+                await this.saveMeta({ ...meta, address });
+            return;
+        }
+        // The legacy single `birthday` is folded into the per-network map before it
+        // is dropped, so a wallet written before `birthdays` existed keeps the value
+        // for the network it earned it on. Dropping it outright — which is what this
+        // used to do — left the wallet with no birthday anywhere, and the pre-seed
+        // guard (`reference.height <= birthday`) can never pass without one, so
+        // every sync after a switch walked from genesis.
+        const birthdays = { ...(meta.birthdays ?? {}) };
+        if (meta.birthday !== undefined && birthdays[meta.network] === undefined) {
+            birthdays[meta.network] = meta.birthday;
+        }
+        // First arrival at `network`: record the caller-supplied first-existence
+        // height. Two guards, both load-bearing:
+        //
+        //   createdHere — an imported wallet may hold funds on any chain at any
+        //   height, so it never gets a birthday and always scans from genesis. A
+        //   wallet written before this field existed has it undefined, which reads
+        //   as imported: the conservative answer, since the cost of being wrong that
+        //   way is a slow sync, and the cost of the other way is invisible funds.
+        //
+        //   birthdays[network] === undefined — only the FIRST arrival counts.
+        //   Returning to a network reuses the height recorded then, because the
+        //   wallet may have transacted there before leaving; overwriting it with a
+        //   later tip would skip that history.
+        if (birthday !== undefined && meta.createdHere === true && birthdays[network] === undefined) {
+            birthdays[network] = birthday;
+        }
+        const { address: _staleAddress, birthday: _staleBirthday, ...rest } = meta;
+        await this.saveMeta({
+            ...rest,
+            network,
+            ...(Object.keys(birthdays).length > 0 ? { birthdays } : {}),
+            ...(address ? { address } : {}),
+        });
+    }
+}
+//# sourceMappingURL=manager.js.map

package/dist/wallet/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/wallet/manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAuB,MAAM,eAAe,CAAC;AAC1G,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,oBAAoB,EAA0B,MAAM,eAAe,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAmB,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,MAAM,UAAU,GAAG,aAAa,CAAC;AASjC,MAAM,cAAc,GAAiB;IACnC,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,EAAE;IACX,cAAc,EAAE,QAAQ;IACxB,aAAa,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,WAAW,IAAI,WAAW,CAAC;AACpC,CAAC;AAED,4EAA4E;AAC5E,+EAA+E;AAC/E,0EAA0E;AAC1E,uEAAuE;AACvE,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,WAAW,IAAI,OAAO,CAAC;AAChC,CAAC;AAiDD;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,IAAgB,EAAE,OAAe;IACpD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5F,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;IAClF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,aAAa;IACP,OAAO,CAAiB;IAEzC,YAAY,OAAuB;QACjC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,gEAAgE;QAChE,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,GAAG,cAAc,EAAE,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAiB,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAoB;QAC3C,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,IAAgB;QACrC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,IAAY;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAe,CAAC;IACxD,CAAC;IAEO,YAAY,CAAC,IAAY;QAC/B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,wBAAwB,IAAI,8BAA8B,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,IAAgB;QAChC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAEO,uBAAuB,CAAC,OAAe;QAC7C,OAAO,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,yEAAyE;IACjE,cAAc,CAAC,SAA0B,EAAE,OAAgB;QACjE,MAAM,OAAO,GAAG,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC;QAChD,OAAO,CACL,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxC,OAAO,CAAC,QAAQ,CAAC;YACjB,OAAO,CAAC,SAAS,CAAC;YAClB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACzB,EAAE,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,IAAY,EACZ,UAAkB,EAClB,OAAO,GAAG,QAAQ,EAClB,QAAiB;IACjB,0EAA0E;IAC1E,0EAA0E;IAC1E,+EAA+E;IAC/E,QAAiB;QAEjB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAEvC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,WAAW,IAAI,kBAAkB,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,IAAI,kBAAkB,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,IAAI,GAAe;YACvB,IAAI;YACJ,OAAO;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO;YACP,WAAW,EAAE,IAAI;YACjB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC;QACF,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE1B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;QACrD,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAE9B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEb,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACjH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,QAAgB,EAAE,UAAkB,EAAE,OAAO,GAAG,QAAQ;QACjF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAExB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,WAAW,IAAI,kBAAkB,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,IAAI,GAAe,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAC7G,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE1B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;QACrD,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAE9B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEb,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,OAAe,EAAE,UAAkB,EAAE,OAAO,GAAG,QAAQ;QACxF,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;QAEtE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,WAAW,IAAI,kBAAkB,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,IAAI,GAAe,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAC7G,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE1B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;QACrD,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAE9B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;IACrF,CAAC;IAED;qDACiD;IACzC,KAAK,CAAC,YAAY,CAAC,IAAY;QACrC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,WAAW,IAAI,aAAa,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAsB,CAAC;QAC/E,OAAO;YACL,GAAG,QAAQ;YACX,IAAI,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAClD,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACpD,UAAU,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC9D,GAAG,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACjD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,UAAkB;QAC3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAE/C,gEAAgE;QAChE,+EAA+E;QAC/E,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;QAClH,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,0CAA0C,CAAC,CAAC;QACpH,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,6CAA6C,CAAC,CAAC;QACrH,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,sCAAsC,CAAC,CAAC;QAEpH,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE9D,iFAAiF;QACjF,qEAAqE;QACrE,IAAI,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;gBAC9D,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAChE,2DAA2D;gBAC3D,sEAAsE;gBACtE,6DAA6D;gBAC7D,kEAAkE;gBAClE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;YAC/D,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,gEAAgE;QAChE,yDAAyD;QACzD,4DAA4D;QAC5D,IAAI,OAAe,CAAC;QACpB,IAAI,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;YAC7C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,cAAc,CAAC;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACxD,2EAA2E;QAC3E,wEAAwE;QACxE,0BAA0B;QAC1B,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,IAAI,GAAgB;YACxB,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;YAC3C,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;YAC3C,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;YAC3B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;SAClC,CAAC;QACF,MAAM,UAAU,GAAe,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzD,2DAA2D;QAC3D,OAAO,GAAG,EAAE,CAAC;QAEb,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,+DAA+D;QAC/D,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,MAAM,CAAC,IAAI;gBACd,IAAI,CAAC,aAAa;gBAClB,IAAI,CAAC,aAAa;gBAClB,IAAI,CAAC,IAAI;gBACT,IAAI,CAAC,KAAK;gBACV,IAAI,CAAC,QAAQ;gBACb,UAAU,CAAC,gBAAgB;aAC5B,EAAE,CAAC;gBACF,IAAI,CAAC;oBACH,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACZ,CAAC;gBAAC,MAAM,CAAC;oBACP,kCAAkC;gBACpC,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACH,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,2BAA2B;YAC7B,CAAC;YACD,IAAI,CAAC;gBACH,UAAU,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,2BAA2B;YAC7B,CAAC;QACH,CAAC,CAAC;QACF,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,IAAI,EAAE,KAAK;YAClB,OAAO;YACP,OAAO;YACP,SAAS;YACT,IAAI;YACJ,UAAU;YACV,IAAI;SACL,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,UAAkB;QAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,UAAkB;QAElB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,WAAW,IAAI,aAAa,CAAC,CAAC;QACtE,CAAC;QAED,+DAA+D;QAC/D,8DAA8D;QAC9D,6DAA6D;QAC7D,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACvD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAe,CAAC;gBACzE,SAAS,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;YACnC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAEzC,kEAAkE;QAClE,+DAA+D;QAC/D,8DAA8D;QAC9D,+DAA+D;QAC/D,iEAAiE;QACjE,gEAAgE;QAChE,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,yBAAyB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,MAAM,SAAS,GAAoB,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC5D,MAAM,eAAe,GAAoB;YACvC,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS;YAClD,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS;SACvD,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI;gBACJ,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,UAAU;gBACpC,SAAS,EAAE,eAAe;gBAC1B,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,MAAM,CAAC,cAAc;gBAC/C,MAAM,EAAE,MAAM,CAAC,YAAY,KAAK,IAAI;gBACpC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC5D,KAAK,EAAE,IAAI,EAAE,KAAK;aACnB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,WAAW,IAAI,aAAa,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,KAAa;QACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,WAAW,IAAI,aAAa,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;QAC1C,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,OAAe,EAAE,OAAgB,EAAE,QAAiB;QACjF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,WAAW,IAAI,aAAa,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC7B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACjG,OAAO;QACT,CAAC;QACD,4EAA4E;QAC5E,6EAA6E;QAC7E,6EAA6E;QAC7E,2EAA2E;QAC3E,wEAAwE;QACxE,iDAAiD;QACjD,MAAM,SAAS,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YACzE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC1C,CAAC;QAED,yEAAyE;QACzE,yCAAyC;QACzC,EAAE;QACF,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,6EAA6E;QAC7E,0EAA0E;QAC1E,EAAE;QACF,sEAAsE;QACtE,wEAAwE;QACxE,2EAA2E;QAC3E,uCAAuC;QACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5F,SAAS,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC;QAChC,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;QAC3E,MAAM,IAAI,CAAC,QAAQ,CAAC;YAClB,GAAG,IAAI;YACP,OAAO;YACP,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/wallet/mnemonic.d.ts

@@ -0,0 +1,5 @@
+export declare function generateMnemonic24(): string;
+export declare function validateMnemonic(mnemonic: string): boolean;
+export declare function mnemonicToSeed(mnemonic: string): Promise<Uint8Array>;
+export declare function hexSeedToUint8Array(hex: string): Uint8Array;
+//# sourceMappingURL=mnemonic.d.ts.map

package/dist/wallet/mnemonic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mnemonic.d.ts","sourceRoot":"","sources":["../../src/wallet/mnemonic.ts"],"names":[],"mappings":"AAOA,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG1D;AAGD,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAE1E;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAY3D"}

package/dist/wallet/mnemonic.js

@@ -0,0 +1,28 @@
+import * as bip39 from '@scure/bip39';
+import { generateMnemonicWords, joinMnemonicWords, validateMnemonic as sdkValidateMnemonic, } from '@midnightntwrk/wallet-sdk/hd';
+export function generateMnemonic24() {
+    return joinMnemonicWords(generateMnemonicWords(256));
+}
+export function validateMnemonic(mnemonic) {
+    if (!mnemonic || mnemonic.trim().length === 0)
+        return false;
+    return sdkValidateMnemonic(mnemonic);
+}
+// SDK gap: @midnightntwrk/wallet-sdk-* does not expose mnemonic → seed.
+export async function mnemonicToSeed(mnemonic) {
+    return bip39.mnemonicToSeedSync(mnemonic);
+}
+export function hexSeedToUint8Array(hex) {
+    if (!/^[0-9a-fA-F]+$/.test(hex)) {
+        throw new Error('Invalid hex string: contains non-hex characters');
+    }
+    if (hex.length % 2 !== 0) {
+        throw new Error('Invalid hex string: odd length');
+    }
+    const bytes = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < hex.length; i += 2) {
+        bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
+    }
+    return bytes;
+}
+//# sourceMappingURL=mnemonic.js.map

package/dist/wallet/mnemonic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mnemonic.js","sourceRoot":"","sources":["../../src/wallet/mnemonic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,IAAI,mBAAmB,GACxC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,UAAU,kBAAkB;IAChC,OAAO,iBAAiB,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,OAAO,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/wallet/sign-message.d.ts

@@ -0,0 +1,20 @@
+export type SignEncoding = 'hex' | 'base64' | 'text';
+export interface SignedMessage {
+    /** The original data string, echoed back so the caller can correlate. */
+    data: string;
+    /** Signature in the keystore's native hex encoding. connector-api 4.0.1
+     *  leaves the wire format unspecified, so we return the ledger encoding. */
+    signature: string;
+    /** Verifying (public) key in the keystore's native hex encoding. */
+    verifyingKey: string;
+}
+/** The exact byte sequence signed for a message: the domain prefix ++ data.
+ *  Exposed so verifiers (and tests) can reconstruct what was signed. */
+export declare function signedMessageBytes(data: Uint8Array): Uint8Array;
+/**
+ * Sign `data` (interpreted per `encoding`) with the seed's unshielded key,
+ * returning the signature and verifying key. Only `keyType: 'unshielded'` is
+ * supported by the connector, so no key type is threaded here.
+ */
+export declare function signMessage(seedHex: string, networkId: string, data: string, encoding: SignEncoding): SignedMessage;
+//# sourceMappingURL=sign-message.d.ts.map

package/dist/wallet/sign-message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-message.d.ts","sourceRoot":"","sources":["../../src/wallet/sign-message.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAErD,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb;gFAC4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;CACtB;AAuBD;wEACwE;AACxE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAM/D;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,YAAY,GACrB,aAAa,CASf"}

package/dist/wallet/sign-message.js

@@ -0,0 +1,58 @@
+// Message signing for the dApp connector's `signData`. Signs arbitrary data
+// with the wallet's unshielded (NightExternal) key, applying the Midnight
+// domain-separation prefix so a signed message can never also be a valid
+// transaction: the unshielded key authorizes transfers too, and ledger's
+// signData explicitly warns against signing uncontrolled data without such
+// separation.
+//
+// Per the Midnight dApp connector spec, the bytes actually signed are
+//   utf8(`midnight_signed_message:${byteLength}:`) ++ decodedData
+// where byteLength is the length of the decoded data in bytes.
+import { createKeystore } from '@midnightntwrk/wallet-sdk/unshielded';
+import { Roles, deriveRawKeys } from './address.js';
+const MESSAGE_PREFIX = 'midnight_signed_message';
+/** Decode the request payload into the raw bytes to be signed. */
+function decodeData(data, encoding) {
+    switch (encoding) {
+        case 'text':
+            // JS strings are UTF-16; normalize to UTF-8 as the spec requires.
+            return new TextEncoder().encode(data);
+        case 'hex': {
+            const hex = data.startsWith('0x') ? data.slice(2) : data;
+            if (hex.length % 2 !== 0 || /[^0-9a-fA-F]/.test(hex))
+                throw new Error('Invalid hex data');
+            return Uint8Array.from(Buffer.from(hex, 'hex'));
+        }
+        case 'base64': {
+            const clean = data.replace(/\s/g, '');
+            if (!/^[A-Za-z0-9+/]*={0,2}$/.test(clean))
+                throw new Error('Invalid base64 data');
+            return Uint8Array.from(Buffer.from(clean, 'base64'));
+        }
+    }
+}
+/** The exact byte sequence signed for a message: the domain prefix ++ data.
+ *  Exposed so verifiers (and tests) can reconstruct what was signed. */
+export function signedMessageBytes(data) {
+    const prefix = new TextEncoder().encode(`${MESSAGE_PREFIX}:${data.length}:`);
+    const out = new Uint8Array(prefix.length + data.length);
+    out.set(prefix, 0);
+    out.set(data, prefix.length);
+    return out;
+}
+/**
+ * Sign `data` (interpreted per `encoding`) with the seed's unshielded key,
+ * returning the signature and verifying key. Only `keyType: 'unshielded'` is
+ * supported by the connector, so no key type is threaded here.
+ */
+export function signMessage(seedHex, networkId, data, encoding) {
+    const payload = signedMessageBytes(decodeData(data, encoding));
+    const keys = deriveRawKeys(seedHex);
+    const keystore = createKeystore(keys[Roles.NightExternal], networkId);
+    return {
+        data,
+        signature: String(keystore.signData(payload)),
+        verifyingKey: String(keystore.getPublicKey()),
+    };
+}
+//# sourceMappingURL=sign-message.js.map

package/dist/wallet/sign-message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-message.js","sourceRoot":"","sources":["../../src/wallet/sign-message.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,cAAc;AACd,EAAE;AACF,sEAAsE;AACtE,kEAAkE;AAClE,+DAA+D;AAE/D,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAcpD,MAAM,cAAc,GAAG,yBAAyB,CAAC;AAEjD,kEAAkE;AAClE,SAAS,UAAU,CAAC,IAAY,EAAE,QAAsB;IACtD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,MAAM;YACT,kEAAkE;YAClE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAC1F,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAClF,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;AACH,CAAC;AAED;wEACwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,IAAgB;IACjD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,cAAc,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACxD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACnB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,SAAiB,EACjB,IAAY,EACZ,QAAsB;IAEtB,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,SAAS,CAAC,CAAC;IACtE,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7C,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC"}