@sidhujag/sysweb3-keyring 1.0.628 → 2.0.0

package/esm/ledger/index.js

@@ -0,0 +1,268 @@
+import { SignTypedDataVersion, TypedDataUtils } from '@metamask/eth-sig-util';
+import { computeAddress, getAddress, hashMessage, recoverAddress, Signature, Transaction, } from 'ethers';
+import { ConnectionStatus, HardwareWalletType, } from '../hardware-wallet-manager';
+import { ledgerCancelledError, ledgerHostError } from './host-types';
+const invalidRequest = () => ledgerHostError('LEDGER_INVALID_REQUEST', 'Invalid Ledger signing request');
+const invalidSignature = () => ledgerHostError('LEDGER_INVALID_SIGNATURE', 'Ledger returned an invalid signature for this request');
+const accountIndex = (value) => {
+    if (!Number.isSafeInteger(value) || value < 0 || value > 0x7fffffff)
+        throw invalidRequest();
+    return value;
+};
+const hexBytes = (value) => {
+    if (typeof value !== 'string' || !/^(?:0x)?(?:[0-9a-f]{2})*$/i.test(value))
+        throw invalidRequest();
+    return Uint8Array.from(Buffer.from(value.replace(/^0x/i, ''), 'hex'));
+};
+const approvedAddress = (value) => {
+    try {
+        return getAddress(value);
+    }
+    catch {
+        throw invalidRequest();
+    }
+};
+const checkedSignature = (value, digest, expected) => {
+    try {
+        let signature;
+        if (typeof value === 'string') {
+            if (!/^0x[0-9a-f]{130}$/i.test(value))
+                throw invalidSignature();
+            signature = Signature.from(value);
+        }
+        else {
+            if (!value ||
+                !/^[0-9a-f]{64}$/i.test(value.r) ||
+                !/^[0-9a-f]{64}$/i.test(value.s) ||
+                !/^[0-9a-f]+$/i.test(value.v))
+                throw invalidSignature();
+            const v = Number.parseInt(value.v, 16);
+            if (!Number.isSafeInteger(v) || v < 0)
+                throw invalidSignature();
+            signature = Signature.from({ r: `0x${value.r}`, s: `0x${value.s}`, v });
+        }
+        if (recoverAddress(digest, signature) !== expected)
+            throw invalidSignature();
+        return signature;
+    }
+    catch {
+        throw invalidSignature();
+    }
+};
+// Detach the approved typed data before connection or host code can await/mutate it.
+const copyTypedData = (value, seen = new WeakSet(), depth = 0) => {
+    if (depth > 64)
+        throw invalidRequest();
+    if (value === null || typeof value === 'string' || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'bigint')
+        return value.toString();
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            throw invalidRequest();
+        return value;
+    }
+    if (value instanceof Uint8Array)
+        return `0x${Buffer.from(value).toString('hex')}`;
+    if (!value || typeof value !== 'object' || seen.has(value))
+        throw invalidRequest();
+    const array = Array.isArray(value);
+    const prototype = Object.getPrototypeOf(value);
+    if (!array && prototype !== Object.prototype && prototype !== null)
+        throw invalidRequest();
+    seen.add(value);
+    try {
+        const result = array ? [] : Object.create(null);
+        for (const key of Object.keys(value)) {
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (!('value' in descriptor))
+                throw invalidRequest();
+            if (descriptor.value !== undefined)
+                result[key] = copyTypedData(descriptor.value, seen, depth + 1);
+        }
+        return Object.freeze(result);
+    }
+    finally {
+        seen.delete(value);
+    }
+};
+/** Small authority-side facade. Device SDKs belong exclusively in ledger-host. */
+export class LedgerKeyring {
+    // Retain the first constructor position for existing shared-manager callers.
+    // A manager alone cannot grant a new device capability.
+    constructor(sharedHardwareWalletManager, host) {
+        this.sharedHardwareWalletManager = sharedHardwareWalletManager;
+        this.host = host;
+        this.generation = 0;
+        this.ensureConnection = async () => this.run(async () => undefined);
+        this.verifyUtxoAddress = (accountIndex, currency, slip44) => this.run((host) => host.utxo.getAddress({
+            accountIndex,
+            currency,
+            slip44,
+            checkOnDevice: true,
+        }));
+        this.signUtxoMessage = (request) => {
+            const approved = Object.freeze({
+                currency: request.currency,
+                slip44: request.slip44,
+                accountIndex: request.accountIndex,
+                message: request.message,
+                addressIndex: request.addressIndex,
+                change: request.change,
+                accountXpub: request.accountXpub,
+            });
+            return this.run((host) => host.utxo.signMessage(approved));
+        };
+        this.signPsbt = (request) => {
+            const approved = Object.freeze({
+                currency: request.currency,
+                slip44: request.slip44,
+                accountIndex: request.accountIndex,
+                accountXpub: request.accountXpub,
+                psbtBase64: request.psbtBase64,
+            });
+            return this.run((host) => host.utxo.signPsbt(approved));
+        };
+        this.evm = {
+            getEvmAddressAndPubKey: async (request) => {
+                const approved = { accountIndex: accountIndex(request.accountIndex) };
+                return this.run(async (host, assertCurrent) => {
+                    const result = await host.evm.getAddress(approved);
+                    assertCurrent();
+                    try {
+                        const address = getAddress(result.address);
+                        const publicKey = result.publicKey.replace(/^0x/i, '');
+                        if (computeAddress(`0x${publicKey}`) !== address)
+                            throw invalidRequest();
+                        return { address, publicKey };
+                    }
+                    catch {
+                        throw ledgerHostError('LEDGER_INVALID_RESPONSE', 'Ledger returned an invalid address or public key');
+                    }
+                });
+            },
+            signEVMTransaction: async (request) => {
+                const index = accountIndex(request.accountIndex);
+                const expected = approvedAddress(request.expectedAddress);
+                let transaction;
+                try {
+                    transaction = Transaction.from(`0x${Buffer.from(hexBytes(request.rawTx)).toString('hex')}`);
+                    if (transaction.signature || transaction.chainId <= 0n)
+                        throw invalidRequest();
+                }
+                catch {
+                    throw invalidRequest();
+                }
+                const approved = {
+                    accountIndex: index,
+                    expectedAddress: expected,
+                    unsignedTxHex: transaction.unsignedSerialized.replace(/^0x/, ''),
+                };
+                const digest = transaction.unsignedHash;
+                return this.run(async (host, assertCurrent) => {
+                    const result = await host.evm.signTransaction(approved);
+                    assertCurrent();
+                    const signature = checkedSignature(result, digest, expected);
+                    if (signature.legacyChainId !== null &&
+                        signature.legacyChainId !== transaction.chainId)
+                        throw invalidSignature();
+                    return {
+                        r: signature.r.slice(2),
+                        s: signature.s.slice(2),
+                        v: signature.v.toString(16),
+                    };
+                });
+            },
+            signPersonalMessage: async (request) => {
+                const expected = approvedAddress(request.expectedAddress);
+                const messageHex = Buffer.from(hexBytes(request.message)).toString('hex');
+                const digest = hashMessage(hexBytes(messageHex));
+                const approved = {
+                    accountIndex: accountIndex(request.accountIndex),
+                    expectedAddress: expected,
+                    messageHex,
+                };
+                return this.run(async (host) => checkedSignature(await host.evm.signPersonalMessage(approved), digest, expected).serialized);
+            },
+            signTypedData: async (request) => {
+                const { version } = request;
+                if (version !== SignTypedDataVersion.V3 &&
+                    version !== SignTypedDataVersion.V4)
+                    throw invalidRequest();
+                const expected = approvedAddress(request.expectedAddress);
+                const index = accountIndex(request.accountIndex);
+                let data, digest;
+                try {
+                    data = copyTypedData(request.data);
+                    digest = `0x${TypedDataUtils.eip712Hash(data, version).toString('hex')}`;
+                }
+                catch {
+                    throw invalidRequest();
+                }
+                const approved = {
+                    accountIndex: index,
+                    expectedAddress: expected,
+                    data,
+                    version,
+                };
+                return this.run(async (host) => checkedSignature(await host.evm.signTypedData(approved), digest, expected).serialized);
+            },
+        };
+        this.utxo = {
+            getUtxoAddress: ({ coin, index, slip44 }) => this.run((host) => host.utxo.getAddress({ currency: coin, accountIndex: index, slip44 })),
+            getXpub: ({ coin, index, slip44 }) => this.run((host) => host.utxo.getXpub({
+                currency: coin,
+                accountIndex: index,
+                slip44,
+                // Import must remain available for paths the device classifies as
+                // unusual. Ask for its confirmation once, without retrying denial.
+                checkOnDevice: true,
+            })),
+            verifyUtxoAddress: this.verifyUtxoAddress,
+        };
+    }
+    requireHost() {
+        if (!this.host)
+            throw ledgerHostError('HARDWARE_SIGNER_UNAVAILABLE', 'Ledger requires an authorized device host');
+        return this.host;
+    }
+    async run(operation) {
+        const generation = this.generation;
+        const host = this.requireHost();
+        // A visible platform host owns discovery, permission and device selection.
+        if (!host.getStatus().connected)
+            await host.connect({ useGrantedDevices: true });
+        const assertCurrent = () => {
+            if (generation !== this.generation)
+                throw ledgerCancelledError();
+        };
+        assertCurrent();
+        try {
+            const result = await operation(host, assertCurrent);
+            assertCurrent();
+            return result;
+        }
+        catch (error) {
+            assertCurrent();
+            throw error;
+        }
+    }
+    getStatus() {
+        const connected = this.host?.getStatus().connected === true;
+        return {
+            type: HardwareWalletType.LEDGER,
+            connected,
+            status: connected
+                ? ConnectionStatus.CONNECTED
+                : ConnectionStatus.DISCONNECTED,
+        };
+    }
+    async destroy() {
+        // Revoke pending responses synchronously, before platform teardown awaits.
+        this.generation++;
+        const cleanup = this.sharedHardwareWalletManager?.destroy();
+        const disconnect = this.host?.disconnect();
+        await Promise.all([cleanup, disconnect]);
+    }
+}
+//# sourceMappingURL=index.js.map

package/esm/ledger/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/ledger/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,cAAc,EACd,UAAU,EACV,WAAW,EACX,cAAc,EACd,SAAS,EACT,WAAW,GACZ,MAAM,QAAQ,CAAC;AAEhB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAMrE,MAAM,cAAc,GAAG,GAAG,EAAE,CAC1B,eAAe,CAAC,wBAAwB,EAAE,gCAAgC,CAAC,CAAC;AAC9E,MAAM,gBAAgB,GAAG,GAAG,EAAE,CAC5B,eAAe,CACb,0BAA0B,EAC1B,uDAAuD,CACxD,CAAC;AAEJ,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,EAAE;IACrC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,UAAU;QACjE,MAAM,cAAc,EAAE,CAAC;IACzB,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAc,EAAE;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC;QACxE,MAAM,cAAc,EAAE,CAAC;IACzB,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC,CAAC;AACF,MAAM,eAAe,GAAG,CAAC,KAAa,EAAE,EAAE;IACxC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,cAAc,EAAE,CAAC;IACzB,CAAC;AACH,CAAC,CAAC;AACF,MAAM,gBAAgB,GAAG,CACvB,KAAmD,EACnD,MAAc,EACd,QAAgB,EAChB,EAAE;IACF,IAAI,CAAC;QACH,IAAI,SAAoB,CAAC;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,gBAAgB,EAAE,CAAC;YAChE,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,IACE,CAAC,KAAK;gBACN,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChC,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAE7B,MAAM,gBAAgB,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,gBAAgB,EAAE,CAAC;YAChE,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,QAAQ;YAChD,MAAM,gBAAgB,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,gBAAgB,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC,CAAC;AACF,qFAAqF;AACrF,MAAM,aAAa,GAAG,CACpB,KAAc,EACd,OAAO,IAAI,OAAO,EAAU,EAC5B,KAAK,GAAG,CAAC,EACJ,EAAE;IACP,IAAI,KAAK,GAAG,EAAE;QAAE,MAAM,cAAc,EAAE,CAAC;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAC3E,OAAO,KAAK,CAAC;IACf,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,cAAc,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,YAAY,UAAU;QAC7B,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACnD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QACxD,MAAM,cAAc,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;QAChE,MAAM,cAAc,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,MAAM,GAAQ,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAE,CAAC;YAChE,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC;gBAAE,MAAM,cAAc,EAAE,CAAC;YACrD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS;gBAChC,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;AACH,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,OAAO,aAAa;IAKxB,6EAA6E;IAC7E,wDAAwD;IACxD,YACmB,2BAAmD,EACnD,IAAiB;QADjB,gCAA2B,GAA3B,2BAA2B,CAAwB;QACnD,SAAI,GAAJ,IAAI,CAAa;QAN5B,eAAU,GAAG,CAAC,CAAC;QAyKhB,qBAAgB,GAAG,KAAK,IAAmB,EAAE,CAClD,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC;QAE3B,sBAAiB,GAAG,CACzB,YAAoB,EACpB,QAAgB,EAChB,MAAc,EACG,EAAE,CACnB,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAChB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;YACnB,YAAY;YACZ,QAAQ;YACR,MAAM;YACN,aAAa,EAAE,IAAI;SACpB,CAAC,CACH,CAAC;QAEG,oBAAe,GAAG,CACvB,OAAqD,EACpC,EAAE;YACnB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7D,CAAC,CAAC;QAEK,aAAQ,GAAG,CAChB,OAAkD,EACV,EAAE;YAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1D,CAAC,CAAC;QA5MA,IAAI,CAAC,GAAG,GAAG;YACT,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACxC,MAAM,QAAQ,GAAG,EAAE,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBACtE,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;oBAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;oBACnD,aAAa,EAAE,CAAC;oBAChB,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;wBAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;wBACvD,IAAI,cAAc,CAAC,KAAK,SAAS,EAAE,CAAC,KAAK,OAAO;4BAC9C,MAAM,cAAc,EAAE,CAAC;wBACzB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;oBAChC,CAAC;oBAAC,MAAM,CAAC;wBACP,MAAM,eAAe,CACnB,yBAAyB,EACzB,kDAAkD,CACnD,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;YACD,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACpC,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBACjD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBAC1D,IAAI,WAAwB,CAAC;gBAC7B,IAAI,CAAC;oBACH,WAAW,GAAG,WAAW,CAAC,IAAI,CAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC5D,CAAC;oBACF,IAAI,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,OAAO,IAAI,EAAE;wBACpD,MAAM,cAAc,EAAE,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,cAAc,EAAE,CAAC;gBACzB,CAAC;gBACD,MAAM,QAAQ,GAAG;oBACf,YAAY,EAAE,KAAK;oBACnB,eAAe,EAAE,QAAQ;oBACzB,aAAa,EAAE,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;iBACjE,CAAC;gBACF,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC;gBACxC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;oBAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;oBACxD,aAAa,EAAE,CAAC;oBAChB,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;oBAC7D,IACE,SAAS,CAAC,aAAa,KAAK,IAAI;wBAChC,SAAS,CAAC,aAAa,KAAK,WAAW,CAAC,OAAO;wBAE/C,MAAM,gBAAgB,EAAE,CAAC;oBAC3B,OAAO;wBACL,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;wBACvB,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;wBACvB,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;qBAC5B,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC;YACD,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACrC,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAChE,KAAK,CACN,CAAC;gBACF,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;gBACjD,MAAM,QAAQ,GAAG;oBACf,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC;oBAChD,eAAe,EAAE,QAAQ;oBACzB,UAAU;iBACX,CAAC;gBACF,OAAO,IAAI,CAAC,GAAG,CACb,KAAK,EAAE,IAAI,EAAE,EAAE,CACb,gBAAgB,CACd,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAC5C,MAAM,EACN,QAAQ,CACT,CAAC,UAAU,CACf,CAAC;YACJ,CAAC;YACD,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;gBAC5B,IACE,OAAO,KAAK,oBAAoB,CAAC,EAAE;oBACnC,OAAO,KAAK,oBAAoB,CAAC,EAAE;oBAEnC,MAAM,cAAc,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBAC1D,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBACjD,IAAI,IAAqB,EAAE,MAAc,CAAC;gBAC1C,IAAI,CAAC;oBACH,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACnC,MAAM,GAAG,KAAK,cAAc,CAAC,UAAU,CACrC,IAAW,EACX,OAAO,CACR,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,cAAc,EAAE,CAAC;gBACzB,CAAC;gBACD,MAAM,QAAQ,GAAG;oBACf,YAAY,EAAE,KAAK;oBACnB,eAAe,EAAE,QAAQ;oBACzB,IAAI;oBACJ,OAAO;iBACR,CAAC;gBACF,OAAO,IAAI,CAAC,GAAG,CACb,KAAK,EAAE,IAAI,EAAE,EAAE,CACb,gBAAgB,CACd,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,EACtC,MAAM,EACN,QAAQ,CACT,CAAC,UAAU,CACf,CAAC;YACJ,CAAC;SACF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG;YACV,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAC1C,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAChB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CACtE;YACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CACnC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAChB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;gBAChB,QAAQ,EAAE,IAAI;gBACd,YAAY,EAAE,KAAK;gBACnB,MAAM;gBACN,kEAAkE;gBAClE,mEAAmE;gBACnE,aAAa,EAAE,IAAI;aACpB,CAAC,CACH;YACH,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC;IACJ,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI;YACZ,MAAM,eAAe,CACnB,6BAA6B,EAC7B,2CAA2C,CAC5C,CAAC;QACJ,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,GAAG,CACf,SAAsE;QAEtE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,2EAA2E;QAC3E,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,SAAS;YAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,GAAG,EAAE;YACzB,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU;gBAAE,MAAM,oBAAoB,EAAE,CAAC;QACnE,CAAC,CAAC;QACF,aAAa,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YACpD,aAAa,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,aAAa,EAAE,CAAC;YAChB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IA+CM,SAAS;QACd,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,SAAS,KAAK,IAAI,CAAC;QAC5D,OAAO;YACL,IAAI,EAAE,kBAAkB,CAAC,MAAM;YAC/B,SAAS;YACT,MAAM,EAAE,SAAS;gBACf,CAAC,CAAC,gBAAgB,CAAC,SAAS;gBAC5B,CAAC,CAAC,gBAAgB,CAAC,YAAY;SAClC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,2EAA2E;QAC3E,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,2BAA2B,EAAE,OAAO,EAAE,CAAC;QAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;QAC3C,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/esm/ledger/prepare-psbt.js

@@ -0,0 +1,141 @@
+import { Buffer } from 'buffer';
+import * as syscoinjs from 'syscoinjs-lib';
+import { getAccountDerivationPath } from '../utils/derivation-paths';
+import { parsePsbtAccountXpub } from '../utils/psbt-account-scope';
+const Transaction = syscoinjs.utils.bitcoinjs.Transaction;
+/** Enrich public PSBT metadata only. Callers must also enforce account scope. */
+export function prepareLedgerPsbt(psbt, accountXpub, accountId, currency, slip44, fingerprint) {
+    if (!/^[0-9a-fA-F]{8}$/.test(fingerprint))
+        throw new Error('Invalid Ledger master fingerprint');
+    const accountNode = parsePsbtAccountXpub(accountXpub);
+    // Enhance each input with bip32Derivation
+    const missingInputDerivations = [];
+    for (let i = 0; i < psbt.inputCount; i++) {
+        const dataInput = psbt.data.inputs[i];
+        // External inputs are already authorized by their final scripts. Do
+        // not invent wallet derivations or ask the device to sign them again.
+        if (dataInput.finalScriptSig || dataInput.finalScriptWitness)
+            continue;
+        // Skip if already has bip32Derivation
+        if (dataInput.bip32Derivation && dataInput.bip32Derivation.length > 0) {
+            // Scope validation has already limited these hints to the approved account.
+            for (const derivation of dataInput.bip32Derivation)
+                derivation.masterFingerprint = Buffer.from(fingerprint, 'hex');
+            continue;
+        }
+        // Ensure witnessUtxo is present if nonWitnessUtxo exists
+        if (!dataInput.witnessUtxo && dataInput.nonWitnessUtxo) {
+            const txBuffer = dataInput.nonWitnessUtxo;
+            const tx = Transaction.fromBuffer(txBuffer);
+            const vout = psbt.txInputs[i].index;
+            if (tx.outs[vout]) {
+                dataInput.witnessUtxo = {
+                    script: tx.outs[vout].script,
+                    value: tx.outs[vout].value,
+                };
+            }
+        }
+        // Extract path from unknownKeyVals by searching for the key, not using hardcoded index
+        let pathFromInput = null;
+        if (dataInput.unknownKeyVals && dataInput.unknownKeyVals.length > 0) {
+            for (const kv of dataInput.unknownKeyVals) {
+                const keyStr = Buffer.from(kv.key).toString();
+                if (keyStr === 'path') {
+                    pathFromInput = Buffer.from(kv.value).toString();
+                    break;
+                }
+            }
+        }
+        let bip32Derivation = null;
+        if (pathFromInput) {
+            const fullPath = pathFromInput;
+            const accountPath = getAccountDerivationPath(currency, slip44, accountId);
+            const relativePath = fullPath.replace(accountPath, '').replace(/^\//, '');
+            const derivationTokens = relativePath.split('/').filter((t) => t);
+            const derivedAccount = derivationTokens.reduce((acc, token) => {
+                const index = parseInt(token);
+                if (isNaN(index)) {
+                    return acc;
+                }
+                return acc.derive(index);
+            }, accountNode);
+            const rawPubkey = derivedAccount.publicKey;
+            const pubkeyBuf = Buffer.isBuffer(rawPubkey)
+                ? rawPubkey
+                : Buffer.from(rawPubkey);
+            if (pubkeyBuf && pubkeyBuf.length === 33) {
+                // Add the bip32Derivation that Ledger needs
+                bip32Derivation = {
+                    masterFingerprint: Buffer.from(fingerprint, 'hex'),
+                    path: fullPath,
+                    pubkey: pubkeyBuf,
+                };
+                psbt.updateInput(i, {
+                    bip32Derivation: [bip32Derivation],
+                });
+            }
+        }
+        // Check the updated PSBT state (avoid stale local references)
+        const updatedInput = psbt.data.inputs[i];
+        if (!updatedInput.bip32Derivation ||
+            updatedInput.bip32Derivation.length === 0) {
+            missingInputDerivations.push(i);
+        }
+    }
+    // Enhance each output with bip32Derivation when it's a change/output owned by the wallet
+    for (let i = 0; i < psbt.data.outputs.length; i++) {
+        const dataOutput = psbt.data.outputs[i];
+        // Skip if derivation already present
+        if (dataOutput.bip32Derivation && dataOutput.bip32Derivation.length > 0) {
+            continue;
+        }
+        // Extract path from unknownKeyVals by searching for the key 'path'
+        let pathFromOutput = null;
+        if (dataOutput.unknownKeyVals && dataOutput.unknownKeyVals.length > 0) {
+            for (const kv of dataOutput.unknownKeyVals) {
+                const keyStr = Buffer.from(kv.key).toString();
+                if (keyStr === 'path') {
+                    pathFromOutput = Buffer.from(kv.value).toString();
+                    break;
+                }
+            }
+        }
+        if (pathFromOutput) {
+            let bip32Derivation = null;
+            const fullPath = pathFromOutput;
+            const accountPath = getAccountDerivationPath(currency, slip44, accountId);
+            const relativePath = fullPath.replace(accountPath, '').replace(/^\//, '');
+            const derivationTokens = relativePath.split('/').filter((t) => t);
+            const derivedAccount = derivationTokens.reduce((acc, token) => {
+                const index = parseInt(token);
+                if (isNaN(index)) {
+                    return acc;
+                }
+                return acc.derive(index);
+            }, accountNode);
+            const rawOutPubkey = derivedAccount.publicKey;
+            const outPubkeyBuf = Buffer.isBuffer(rawOutPubkey)
+                ? rawOutPubkey
+                : Buffer.from(rawOutPubkey);
+            if (outPubkeyBuf && outPubkeyBuf.length === 33) {
+                bip32Derivation = {
+                    masterFingerprint: Buffer.from(fingerprint, 'hex'),
+                    path: fullPath,
+                    pubkey: outPubkeyBuf,
+                };
+                psbt.updateOutput(i, {
+                    bip32Derivation: [bip32Derivation],
+                });
+            }
+            // Outputs without valid derivation are allowed (external recipients)
+        }
+    }
+    // If any wallet-owned inputs/outputs are missing bip32Derivation, fail early with a clear error
+    if (missingInputDerivations.length > 0) {
+        const parts = [];
+        parts.push(`inputs [${missingInputDerivations.join(', ')}]`);
+        throw new Error(`convertToLedgerFormat: Missing bip32Derivation for ${parts.join(' and ')}. Ensure PSBT includes a 'path' unknownKeyVal or BIP32_DERIVATION for wallet-owned entries.`);
+    }
+    return psbt;
+}
+//# sourceMappingURL=prepare-psbt.js.map

package/esm/ledger/prepare-psbt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepare-psbt.js","sourceRoot":"","sources":["../../../src/ledger/prepare-psbt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,KAAK,SAAS,MAAM,eAAe,CAAC;AAE3C,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,MAAM,WAAW,GAAI,SAAS,CAAC,KAAa,CAAC,SAAS,CAAC,WAAW,CAAC;AAEnE,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAC/B,IAAU,EACV,WAAmB,EACnB,SAAiB,EACjB,QAAgB,EAChB,MAAc,EACd,WAAmB;IAEnB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAEtD,0CAA0C;IAC1C,MAAM,uBAAuB,GAAa,EAAE,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAEtC,oEAAoE;QACpE,sEAAsE;QACtE,IAAI,SAAS,CAAC,cAAc,IAAI,SAAS,CAAC,kBAAkB;YAAE,SAAS;QAEvE,sCAAsC;QACtC,IAAI,SAAS,CAAC,eAAe,IAAI,SAAS,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,4EAA4E;YAC5E,KAAK,MAAM,UAAU,IAAI,SAAS,CAAC,eAAe;gBAChD,UAAU,CAAC,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QAED,yDAAyD;QACzD,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,cAAc,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAG,SAAS,CAAC,cAAc,CAAC;YAC1C,MAAM,EAAE,GAAG,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAEpC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClB,SAAS,CAAC,WAAW,GAAG;oBACtB,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;oBAC5B,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK;iBAC3B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,uFAAuF;QACvF,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,IAAI,SAAS,CAAC,cAAc,IAAI,SAAS,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,cAAc,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC9C,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACtB,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACjD,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,eAAe,GAAQ,IAAI,CAAC;QAChC,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC/B,MAAM,WAAW,GAAG,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YAC1E,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1E,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAElE,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAC5C,CAAC,GAAQ,EAAE,KAAa,EAAE,EAAE;gBAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC9B,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjB,OAAO,GAAG,CAAC;gBACb,CAAC;gBACD,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC,EACD,WAAW,CACZ,CAAC;YAEF,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC;YAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC1C,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAE3B,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACzC,4CAA4C;gBAC5C,eAAe,GAAG;oBAChB,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC;oBAClD,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,SAAS;iBAClB,CAAC;gBAEF,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE;oBAClB,eAAe,EAAE,CAAC,eAAe,CAAC;iBACnC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,8DAA8D;QAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzC,IACE,CAAC,YAAY,CAAC,eAAe;YAC7B,YAAY,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EACzC,CAAC;YACD,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,yFAAyF;IACzF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAExC,qCAAqC;QACrC,IAAI,UAAU,CAAC,eAAe,IAAI,UAAU,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxE,SAAS;QACX,CAAC;QAED,mEAAmE;QACnE,IAAI,cAAc,GAAkB,IAAI,CAAC;QACzC,IAAI,UAAU,CAAC,cAAc,IAAI,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;gBAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC9C,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACtB,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;oBAClD,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,eAAe,GAAQ,IAAI,CAAC;YAChC,MAAM,QAAQ,GAAG,cAAc,CAAC;YAChC,MAAM,WAAW,GAAG,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YAC1E,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1E,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAElE,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAC5C,CAAC,GAAQ,EAAE,KAAa,EAAE,EAAE;gBAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC9B,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjB,OAAO,GAAG,CAAC;gBACb,CAAC;gBACD,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC,EACD,WAAW,CACZ,CAAC;YAEF,MAAM,YAAY,GAAG,cAAc,CAAC,SAAS,CAAC;YAC9C,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAChD,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAE9B,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC/C,eAAe,GAAG;oBAChB,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC;oBAClD,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,YAAY;iBACrB,CAAC;gBAEF,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE;oBACnB,eAAe,EAAE,CAAC,eAAe,CAAC;iBACnC,CAAC,CAAC;YACL,CAAC;YACD,qEAAqE;QACvE,CAAC;IACH,CAAC;IAED,gGAAgG;IAChG,IAAI,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,WAAW,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,sDAAsD,KAAK,CAAC,IAAI,CAC9D,OAAO,CACR,6FAA6F,CAC/F,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/esm/ledger/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/esm/ledger/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/ledger/types.ts"],"names":[],"mappings":""}

package/esm/ledger-host.js

@@ -0,0 +1,36 @@
+/** Heavy browser host entry. Do not import from the wallet worker or software entry. */
+import { DeviceManagementKitBuilder, } from '@ledgerhq/device-management-kit';
+import { webHidTransportFactory } from '@ledgerhq/device-transport-kit-web-hid';
+import { createLedgerEvmAdapter } from './ledger/dmk-evm';
+import { LedgerDmkSession } from './ledger/dmk-session';
+import { createLedgerUtxoAdapter } from './ledger/dmk-utxo';
+import { ledgerHostError } from './ledger/host-types';
+export function createLedgerDmkHost(config = {}) {
+    const candidate = config.dmk ??
+        new DeviceManagementKitBuilder()
+            .addTransport(webHidTransportFactory)
+            .build();
+    for (const method of [
+        'connect',
+        'disconnect',
+        'executeDeviceAction',
+        'startDiscovering',
+        'listenToAvailableDevices',
+        'getDeviceSessionState',
+    ]) {
+        if (typeof candidate[method] !== 'function')
+            throw ledgerHostError('LEDGER_INVALID_HOST', 'Invalid Ledger device manager');
+    }
+    // Keep upstream exports-only types out of this public declaration. A trusted
+    // platform supplies its concrete DMK here; dapps cannot select this object.
+    const dmk = candidate;
+    const session = new LedgerDmkSession(dmk);
+    return {
+        connect: (request, options) => session.connect(request, options),
+        disconnect: () => session.disconnect(),
+        getStatus: () => session.getStatus(),
+        evm: createLedgerEvmAdapter(session, config),
+        utxo: createLedgerUtxoAdapter(session),
+    };
+}
+//# sourceMappingURL=ledger-host.js.map

package/esm/ledger-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-host.js","sourceRoot":"","sources":["../../src/ledger-host.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,OAAO,EACL,0BAA0B,GAE3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAEhF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAStD,MAAM,UAAU,mBAAmB,CACjC,SAA8B,EAAE;IAEhC,MAAM,SAAS,GACb,MAAM,CAAC,GAAG;QACV,IAAI,0BAA0B,EAAE;aAC7B,YAAY,CAAC,sBAAsB,CAAC;aACpC,KAAK,EAAE,CAAC;IACb,KAAK,MAAM,MAAM,IAAI;QACnB,SAAS;QACT,YAAY;QACZ,qBAAqB;QACrB,kBAAkB;QAClB,0BAA0B;QAC1B,uBAAuB;KACxB,EAAE,CAAC;QACF,IAAI,OAAQ,SAAqC,CAAC,MAAM,CAAC,KAAK,UAAU;YACtE,MAAM,eAAe,CACnB,qBAAqB,EACrB,+BAA+B,CAChC,CAAC;IACN,CAAC;IACD,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,GAAG,GAAG,SAAgC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO;QACL,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC;QAChE,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE;QACtC,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE;QACpC,GAAG,EAAE,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC;QAC5C,IAAI,EAAE,uBAAuB,CAAC,OAAO,CAAC;KACvC,CAAC;AACJ,CAAC"}

package/esm/private-records.js

@@ -0,0 +1,153 @@
+export const MAX_PRIVATE_RECORD_BYTES = 64 * 1024;
+export const MAX_PRIVATE_RECORD_LABEL_BYTES = 128;
+const NAMESPACE = 'sysweb3/private-record/v1';
+const NONCE_BYTES = 12;
+const TAG_BYTES = 16;
+const encoder = new TextEncoder();
+const LABEL_START = /^[A-Za-z0-9]/;
+const INVALID_LABEL_CHARACTER = /[^A-Za-z0-9._:/-]/;
+const PROFILE = /^0x[0-9a-f]{64}$/;
+const BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+// Views passed to WebCrypto are owned, non-shared copies. This cast supports
+// DOM typings both before and after generic ArrayBufferLike typed arrays.
+const bufferSource = (bytes) => bytes;
+function cryptoProvider() {
+    if (!globalThis.crypto?.subtle || !globalThis.crypto.getRandomValues) {
+        throw new Error('Private record cryptography unavailable');
+    }
+    return globalThis.crypto;
+}
+function label(value) {
+    if (typeof value !== 'string' ||
+        value.length > MAX_PRIVATE_RECORD_LABEL_BYTES ||
+        !LABEL_START.test(value) ||
+        INVALID_LABEL_CHARACTER.test(value)) {
+        throw new Error('Invalid private record context');
+    }
+    return value;
+}
+function encodeBase64(bytes) {
+    return Buffer.from(bytes).toString('base64');
+}
+function decodeBase64(value, min, max) {
+    if (typeof value !== 'string' ||
+        value.length > 4 * Math.ceil(max / 3) ||
+        !BASE64.test(value)) {
+        throw new Error('Invalid private record envelope');
+    }
+    const bytes = new Uint8Array(Buffer.from(value, 'base64'));
+    if (bytes.length < min ||
+        bytes.length > max ||
+        encodeBase64(bytes) !== value) {
+        throw new Error('Invalid private record envelope');
+    }
+    return bytes;
+}
+async function importRoot(secret, guard) {
+    const key = await cryptoProvider().subtle.importKey('raw', bufferSource(secret), 'HKDF', false, ['deriveBits', 'deriveKey']);
+    guard();
+    return key;
+}
+async function profileId(key, guard) {
+    const bits = await cryptoProvider().subtle.deriveBits({
+        name: 'HKDF',
+        hash: 'SHA-256',
+        salt: bufferSource(encoder.encode(NAMESPACE)),
+        info: bufferSource(encoder.encode(JSON.stringify([NAMESPACE, 'profile-id']))),
+    }, key, 256);
+    guard();
+    return `0x${Buffer.from(bits).toString('hex')}`;
+}
+async function domainKey(key, domain, guard) {
+    const derived = await cryptoProvider().subtle.deriveKey({
+        name: 'HKDF',
+        hash: 'SHA-256',
+        salt: bufferSource(encoder.encode(NAMESPACE)),
+        info: bufferSource(encoder.encode(JSON.stringify([NAMESPACE, 'encryption-key', domain]))),
+    }, key, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+    guard();
+    return derived;
+}
+function additionalData(domain, recordId, profile) {
+    return encoder.encode(JSON.stringify([NAMESPACE, 1, domain, recordId, profile]));
+}
+// Internal helpers accept ephemeral bytes and never access wallet storage.
+// Only the envelope types and limits are exported from the package entrypoint.
+export async function privateRecordProfileId(secret, guard) {
+    return profileId(await importRoot(secret, guard), guard);
+}
+export async function encryptPrivateRecordBytes(secret, params, guard) {
+    const domain = label(params.domain);
+    const recordId = label(params.recordId);
+    if (!(params.plaintext instanceof Uint8Array) ||
+        params.plaintext.length > MAX_PRIVATE_RECORD_BYTES) {
+        throw new Error('Invalid private record size');
+    }
+    // Own the input before the first await; caller mutations cannot change it.
+    const plaintext = new Uint8Array(params.plaintext);
+    try {
+        const key = await importRoot(secret, guard);
+        const profile = await profileId(key, guard);
+        const aesKey = await domainKey(key, domain, guard);
+        const nonce = cryptoProvider().getRandomValues(new Uint8Array(NONCE_BYTES));
+        const encrypted = await cryptoProvider().subtle.encrypt({
+            name: 'AES-GCM',
+            iv: bufferSource(nonce),
+            tagLength: 128,
+            additionalData: bufferSource(additionalData(domain, recordId, profile)),
+        }, aesKey, bufferSource(plaintext));
+        guard();
+        return {
+            version: 1,
+            domain,
+            recordId,
+            profileId: profile,
+            nonce: encodeBase64(nonce),
+            ciphertext: encodeBase64(new Uint8Array(encrypted)),
+        };
+    }
+    finally {
+        plaintext.fill(0);
+    }
+}
+export async function decryptPrivateRecordBytes(secret, params, guard) {
+    const domain = label(params.domain);
+    const recordId = label(params.recordId);
+    // Copy primitive fields before awaiting. No caller-owned object is retained.
+    const envelope = params.envelope && { ...params.envelope };
+    if (!envelope ||
+        Object.keys(envelope).length !== 6 ||
+        envelope.version !== 1 ||
+        envelope.domain !== domain ||
+        envelope.recordId !== recordId ||
+        typeof envelope.profileId !== 'string' ||
+        envelope.profileId.length !== 66 ||
+        !PROFILE.test(envelope.profileId)) {
+        throw new Error('Invalid private record envelope');
+    }
+    const nonce = decodeBase64(envelope.nonce, NONCE_BYTES, NONCE_BYTES);
+    const ciphertext = decodeBase64(envelope.ciphertext, TAG_BYTES, MAX_PRIVATE_RECORD_BYTES + TAG_BYTES);
+    const key = await importRoot(secret, guard);
+    const profile = await profileId(key, guard);
+    if (profile !== envelope.profileId) {
+        throw new Error('Private record profile mismatch');
+    }
+    const aesKey = await domainKey(key, domain, guard);
+    let plaintext;
+    try {
+        plaintext = new Uint8Array(await cryptoProvider().subtle.decrypt({
+            name: 'AES-GCM',
+            iv: bufferSource(nonce),
+            tagLength: 128,
+            additionalData: bufferSource(additionalData(domain, recordId, profile)),
+        }, aesKey, bufferSource(ciphertext)));
+        guard();
+        return plaintext;
+    }
+    catch {
+        plaintext?.fill(0);
+        guard();
+        throw new Error('Private record authentication failed');
+    }
+}
+//# sourceMappingURL=private-records.js.map

package/esm/private-records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-records.js","sourceRoot":"","sources":["../../src/private-records.ts"],"names":[],"mappings":"AAsBA,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAClD,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,MAAM,SAAS,GAAG,2BAA2B,CAAC;AAC9C,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,WAAW,GAAG,cAAc,CAAC;AACnC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AACpD,MAAM,OAAO,GAAG,kBAAkB,CAAC;AACnC,MAAM,MAAM,GACV,kEAAkE,CAAC;AAGrE,6EAA6E;AAC7E,0EAA0E;AAC1E,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAgB,EAAE,CACvD,KAAgC,CAAC;AAEnC,SAAS,cAAc;IACrB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,KAAa;IAC1B,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,GAAG,8BAA8B;QAC7C,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QACxB,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EACnC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,GAAW,EAAE,GAAW;IAC3D,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QACrC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3D,IACE,KAAK,CAAC,MAAM,GAAG,GAAG;QAClB,KAAK,CAAC,MAAM,GAAG,GAAG;QAClB,YAAY,CAAC,KAAK,CAAC,KAAK,KAAK,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAkB,EAClB,KAAY;IAEZ,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC,MAAM,CAAC,SAAS,CACjD,KAAK,EACL,YAAY,CAAC,MAAM,CAAC,EACpB,MAAM,EACN,KAAK,EACL,CAAC,YAAY,EAAE,WAAW,CAAC,CAC5B,CAAC;IACF,KAAK,EAAE,CAAC;IACR,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAc,EAAE,KAAY;IACnD,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC,MAAM,CAAC,UAAU,CACnD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,EAAE,YAAY,CAChB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,CAC1D;KACF,EACD,GAAG,EACH,GAAG,CACJ,CAAC;IACF,KAAK,EAAE,CAAC;IACR,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,GAAc,EACd,MAAc,EACd,KAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC,MAAM,CAAC,SAAS,CACrD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,EAAE,YAAY,CAChB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,CACtE;KACF,EACD,GAAG,EACH,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IACF,KAAK,EAAE,CAAC;IACR,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,QAAgB,EAAE,OAAe;IACvE,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAkB,EAClB,KAAY;IAEZ,OAAO,SAAS,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAkB,EAClB,MAAmC,EACnC,KAAY;IAEZ,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,IACE,CAAC,CAAC,MAAM,CAAC,SAAS,YAAY,UAAU,CAAC;QACzC,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,wBAAwB,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,2EAA2E;IAC3E,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,MAAM,cAAc,EAAE,CAAC,MAAM,CAAC,OAAO,CACrD;YACE,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC;YACvB,SAAS,EAAE,GAAG;YACd,cAAc,EAAE,YAAY,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;SACxE,EACD,MAAM,EACN,YAAY,CAAC,SAAS,CAAC,CACxB,CAAC;QACF,KAAK,EAAE,CAAC;QACR,OAAO;YACL,OAAO,EAAE,CAAC;YACV,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,OAAO;YAClB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;YAC1B,UAAU,EAAE,YAAY,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;SACpD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAkB,EAClB,MAAmC,EACnC,KAAY;IAEZ,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3D,IACE,CAAC,QAAQ;QACT,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAClC,QAAQ,CAAC,OAAO,KAAK,CAAC;QACtB,QAAQ,CAAC,MAAM,KAAK,MAAM;QAC1B,QAAQ,CAAC,QAAQ,KAAK,QAAQ;QAC9B,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ;QACtC,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE;QAChC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,YAAY,CAC7B,QAAQ,CAAC,UAAU,EACnB,SAAS,EACT,wBAAwB,GAAG,SAAS,CACrC,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,SAAiC,CAAC;IACtC,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,UAAU,CACxB,MAAM,cAAc,EAAE,CAAC,MAAM,CAAC,OAAO,CACnC;YACE,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC;YACvB,SAAS,EAAE,GAAG;YACd,cAAc,EAAE,YAAY,CAC1B,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAC1C;SACF,EACD,MAAM,EACN,YAAY,CAAC,UAAU,CAAC,CACzB,CACF,CAAC;QACF,KAAK,EAAE,CAAC;QACR,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,KAAK,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC"}