@sig-net/midnight 0.0.1

package/dist/signet-request-feed.js

@@ -0,0 +1,116 @@
+// The MPC's single entry point for discovering signature requests by event
+// observation: watch the central signet contract's notifications, resolve each
+// to an AUTHENTICATED request read from the named caller's own ledger, and
+// yield only the ones that pass the membership check. Replaces polling a
+// configured list of requester contracts — the feed discovers requesters
+// dynamically, keyed off whose authenticated state it actually read.
+//
+// The requester allow-list is an OPTIONAL policy filter here (drop requests
+// from contracts you choose not to serve), never a security requirement and
+// never the discovery mechanism — attribution comes from the resolver's
+// authenticated read (see signet-request-resolver.ts and
+// knowledge-base/caller-attribution.md).
+import { SignetEventObserver, sleepUnlessAborted, } from "./signet-event-observer.js";
+import { signBidirectionalEventCodec, stripHexPrefix, } from "./signet-events.js";
+import { SignetRequestResolver, } from "./signet-request-resolver.js";
+/** Default gap between poll cycles of {@link SignetRequestFeed.requests}. */
+export const DEFAULT_FEED_POLL_INTERVAL_MS = 3000;
+/** Canonical form for comparing contract addresses: no `0x`, lowercase. */
+function normalizeAddress(address) {
+    return stripHexPrefix(address).toLowerCase();
+}
+/**
+ * The event-driven request feed. Composes a {@link SignetEventObserver}
+ * (discovery) with a {@link SignetRequestResolver} (authentication), yielding
+ * only notifications that resolve to a real, member request. Dedupes by request
+ * id across its lifetime, so a redelivered notification is not re-yielded; call
+ * {@link forget} to re-arm a request whose downstream processing failed.
+ */
+export class SignetRequestFeed {
+    observer;
+    resolver;
+    allowContracts;
+    pollIntervalMs;
+    // Request ids already yielded. NOT the security boundary (the resolver is) —
+    // just an at-most-once gate so one request is not processed twice.
+    yielded = new Set();
+    /**
+     * @param config - The signet contract, combined event/state source, optional
+     *   policy allow-list, and resume floor.
+     */
+    constructor(config) {
+        this.observer = new SignetEventObserver({
+            signetContractAddress: config.signetContractAddress,
+            source: config.source,
+            codec: signBidirectionalEventCodec,
+            fromEventId: config.fromEventId,
+            pollIntervalMs: config.pollIntervalMs,
+        });
+        this.resolver = new SignetRequestResolver({ source: config.source });
+        this.allowContracts = config.allowContracts
+            ? new Set(Array.from(config.allowContracts, normalizeAddress))
+            : undefined;
+        this.pollIntervalMs =
+            config.pollIntervalMs ?? DEFAULT_FEED_POLL_INTERVAL_MS;
+    }
+    /** Whether the policy allow-list admits `callerAddress` (always true when unset). */
+    allowed(callerAddress) {
+        return (this.allowContracts === undefined ||
+            this.allowContracts.has(normalizeAddress(callerAddress)));
+    }
+    /**
+     * One-shot: every currently-visible notification that is admitted by the
+     * allow-list, not already yielded, and resolves to an authenticated member
+     * request. Forged / not-yet-indexed / wrong-field notifications resolve to
+     * nothing and are dropped WITHOUT being marked yielded, so a genuine
+     * request whose ledger write has not indexed yet is retried next cycle.
+     *
+     * @returns The newly-authenticated requests this cycle, in event id order.
+     */
+    async poll() {
+        const events = await this.observer.currentEvents();
+        const out = [];
+        for (const event of events) {
+            if (this.yielded.has(event.requestId))
+                continue;
+            if (!this.allowed(event.callerAddress))
+                continue;
+            const resolved = await this.resolver.resolve(event);
+            if (resolved === undefined)
+                continue;
+            this.yielded.add(event.requestId);
+            out.push(resolved);
+        }
+        return out;
+    }
+    /**
+     * Re-arm `requestId` for redelivery on the next {@link poll} / {@link requests}
+     * cycle — call when downstream processing of a yielded request failed, so it
+     * is retried (mirrors the MPC's delete-on-failure of its processed set).
+     *
+     * @param requestId - The request id to allow through again.
+     */
+    forget(requestId) {
+        this.yielded.delete(requestId);
+    }
+    /**
+     * Live stream: poll + sleep, yielding each authenticated request exactly once
+     * (subject to {@link forget}), until `opts.signal` aborts. The natural
+     * sequential `for await` consumption serializes downstream processing — no
+     * two requests are handed over concurrently.
+     *
+     * @param opts.signal - Abort to stop the stream.
+     * @yields Each authenticated request, in discovery order.
+     */
+    async *requests(opts) {
+        while (!opts?.signal?.aborted) {
+            const batch = await this.poll();
+            for (const resolved of batch)
+                yield resolved;
+            if (opts?.signal?.aborted)
+                break;
+            await sleepUnlessAborted(this.pollIntervalMs, opts?.signal);
+        }
+    }
+}
+//# sourceMappingURL=signet-request-feed.js.map

package/dist/signet-request-feed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signet-request-feed.js","sourceRoot":"","sources":["../src/signet-request-feed.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,+EAA+E;AAC/E,2EAA2E;AAC3E,yEAAyE;AACzE,yEAAyE;AACzE,qEAAqE;AACrE,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,wEAAwE;AACxE,yDAAyD;AACzD,yCAAyC;AAEzC,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,2BAA2B,EAC3B,cAAc,GAEf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,GAEtB,MAAM,8BAA8B,CAAC;AAItC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAuBlD,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,iBAAiB;IACX,QAAQ,CAA8C;IACtD,QAAQ,CAAwB;IAChC,cAAc,CAAe;IAC7B,cAAc,CAAS;IAExC,6EAA6E;IAC7E,mEAAmE;IAClD,OAAO,GAAG,IAAI,GAAG,EAAgB,CAAC;IAEnD;;;OAGG;IACH,YAAY,MAA+B;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,mBAAmB,CAAC;YACtC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACnD,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc;YACzC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;YAC9D,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,cAAc;YACjB,MAAM,CAAC,cAAc,IAAI,6BAA6B,CAAC;IAC3D,CAAC;IAED,qFAAqF;IAC7E,OAAO,CAAC,aAAqB;QACnC,OAAO,CACL,IAAI,CAAC,cAAc,KAAK,SAAS;YACjC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CACzD,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;gBAAE,SAAS;YAChD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;gBAAE,SAAS;YACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpD,IAAI,QAAQ,KAAK,SAAS;gBAAE,SAAS;YACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAClC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,SAAuB;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,CAAC,QAAQ,CAAC,IAEf;QACC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAChC,KAAK,MAAM,QAAQ,IAAI,KAAK;gBAAE,MAAM,QAAQ,CAAC;YAC7C,IAAI,IAAI,EAAE,MAAM,EAAE,OAAO;gBAAE,MAAM;YACjC,MAAM,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;CACF"}

package/dist/signet-request-resolver.d.ts

@@ -0,0 +1,58 @@
+import type { SignBidirectionalEvent } from "./signet-events.ts";
+import type { SignetPublicStateSource } from "./signet-request-response-reader.ts";
+import type { RequestIdHex, SignBidirectionalRequest } from "./signet-requests.ts";
+/**
+ * A {@link SignBidirectionalEvent} resolved to the authenticated request it
+ * refers to: the request record read from `callerAddress`'s own ledger, with
+ * `requestId` confirmed to be a member of that contract's index.
+ */
+export interface ResolvedSignetRequest {
+    /**
+     * The contract whose authenticated state the request was read from — the
+     * epsilon-derivation predecessor. Key derivation keys off THIS, never off a
+     * field taken from the event on faith.
+     */
+    callerAddress: string;
+    /** The request id, confirmed to be a member of `callerAddress`'s index. */
+    requestId: RequestIdHex;
+    /** The authenticated request record to sign. */
+    request: SignBidirectionalRequest;
+}
+/** Everything a {@link SignetRequestResolver} needs. */
+export interface SignetRequestResolverConfig {
+    /** Source of raw contract state, e.g. midnight-js's `indexerPublicDataProvider`. */
+    readonly source: SignetPublicStateSource;
+}
+/**
+ * Resolves {@link SignBidirectionalEvent} notifications to authenticated
+ * {@link ResolvedSignetRequest}s by reading the named caller's ledger and
+ * enforcing the membership check. Construct once and reuse: resolved records
+ * are immutable (their ledger key is their hash), so they are cached by request
+ * id and a repeated notification for the same request costs no query.
+ *
+ * NB the cache is keyed by request id, NOT by contract address: a caller
+ * contract's state grows as it stores new requests, so caching its state would
+ * make the resolver blind to later requests from the same caller. Caching the
+ * immutable resolved record instead is the same pattern
+ * {@link SignetRequestResponseReader.getSignatureRequest} uses.
+ */
+export declare class SignetRequestResolver {
+    private readonly source;
+    private readonly resolvedCache;
+    /**
+     * @param config - The state source to read caller ledgers through.
+     */
+    constructor(config: SignetRequestResolverConfig);
+    /**
+     * Resolve a notification to its authenticated request, or `undefined` when it
+     * cannot be trusted: the caller contract has no state, or `requestId` is not
+     * a member of the index at `requestsIndexField` (forged, stale, wrong field,
+     * or not yet indexed — poll again). Never throws on an untrusted event; a bad
+     * notification is dropped, not surfaced as an error.
+     *
+     * @param event - The decoded event notification.
+     * @returns The authenticated request, or `undefined` to drop the event.
+     */
+    resolve(event: SignBidirectionalEvent): Promise<ResolvedSignetRequest | undefined>;
+}
+//# sourceMappingURL=signet-request-resolver.d.ts.map

package/dist/signet-request-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signet-request-resolver.d.ts","sourceRoot":"","sources":["../src/signet-request-resolver.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,KAAK,EACV,YAAY,EACZ,wBAAwB,EACzB,MAAM,sBAAsB,CAAC;AAE9B;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,SAAS,EAAE,YAAY,CAAC;IACxB,gDAAgD;IAChD,OAAO,EAAE,wBAAwB,CAAC;CACnC;AAED,wDAAwD;AACxD,MAAM,WAAW,2BAA2B;IAC1C,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;CAC1C;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IAIjD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkD;IAEhF;;OAEG;gBACS,MAAM,EAAE,2BAA2B;IAI/C;;;;;;;;;OASG;IACG,OAAO,CACX,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC;CA8B9C"}

package/dist/signet-request-resolver.js

@@ -0,0 +1,76 @@
+// Turn a SignBidirectionalEvent notification into an AUTHENTICATED request
+// record. This is the security core of the event flow (see
+// knowledge-base/caller-attribution.md and the invariants in this task's
+// brief): the event says only WHERE to look; the request that gets signed is
+// read from the named caller's own authenticated ledger, and the event's
+// `requestId` must be a member of that contract's request index. An attacker
+// cannot write into a contract it does not control, so a forged event can at
+// most re-point at a legitimate request that already exists — never inject one.
+//
+// Key derivation stays f(callerAddress, path), keyed off the contract whose
+// authenticated state was actually read — exactly today's guarantee, now
+// reached via an event ping instead of per-contract polling.
+import { lookupSignetRequestAt } from "./signature-requests-state-reader.js";
+/**
+ * Resolves {@link SignBidirectionalEvent} notifications to authenticated
+ * {@link ResolvedSignetRequest}s by reading the named caller's ledger and
+ * enforcing the membership check. Construct once and reuse: resolved records
+ * are immutable (their ledger key is their hash), so they are cached by request
+ * id and a repeated notification for the same request costs no query.
+ *
+ * NB the cache is keyed by request id, NOT by contract address: a caller
+ * contract's state grows as it stores new requests, so caching its state would
+ * make the resolver blind to later requests from the same caller. Caching the
+ * immutable resolved record instead is the same pattern
+ * {@link SignetRequestResponseReader.getSignatureRequest} uses.
+ */
+export class SignetRequestResolver {
+    source;
+    // Resolved records never change; cache them so a redelivered notification for
+    // the same request id does not re-query the caller's state.
+    resolvedCache = new Map();
+    /**
+     * @param config - The state source to read caller ledgers through.
+     */
+    constructor(config) {
+        this.source = config.source;
+    }
+    /**
+     * Resolve a notification to its authenticated request, or `undefined` when it
+     * cannot be trusted: the caller contract has no state, or `requestId` is not
+     * a member of the index at `requestsIndexField` (forged, stale, wrong field,
+     * or not yet indexed — poll again). Never throws on an untrusted event; a bad
+     * notification is dropped, not surfaced as an error.
+     *
+     * @param event - The decoded event notification.
+     * @returns The authenticated request, or `undefined` to drop the event.
+     */
+    async resolve(event) {
+        const cached = this.resolvedCache.get(event.requestId);
+        if (cached !== undefined) {
+            return cached;
+        }
+        let state;
+        try {
+            state = await this.source.queryContractState(event.callerAddress);
+        }
+        catch {
+            return undefined; // caller address not a contract / transient read error
+        }
+        if (!state?.data) {
+            return undefined; // no state at the named caller — cannot authenticate
+        }
+        const request = lookupSignetRequestAt(state.data, event.requestsIndexField, event.requestId);
+        if (request === undefined) {
+            return undefined; // membership check failed — drop the notification
+        }
+        const resolved = {
+            callerAddress: event.callerAddress,
+            requestId: event.requestId,
+            request,
+        };
+        this.resolvedCache.set(event.requestId, resolved);
+        return resolved;
+    }
+}
+//# sourceMappingURL=signet-request-resolver.js.map

package/dist/signet-request-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signet-request-resolver.js","sourceRoot":"","sources":["../src/signet-request-resolver.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,2DAA2D;AAC3D,yEAAyE;AACzE,6EAA6E;AAC7E,yEAAyE;AACzE,6EAA6E;AAC7E,6EAA6E;AAC7E,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,6DAA6D;AAE7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAiC7E;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,qBAAqB;IACf,MAAM,CAA0B;IAEjD,8EAA8E;IAC9E,4DAA4D;IAC3C,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAC;IAEhF;;OAEG;IACH,YAAY,MAAmC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,CACX,KAA6B;QAE7B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,KAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,CAAC,uDAAuD;QAC3E,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;YACjB,OAAO,SAAS,CAAC,CAAC,qDAAqD;QACzE,CAAC;QACD,MAAM,OAAO,GAAG,qBAAqB,CACnC,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,kBAAkB,EACxB,KAAK,CAAC,SAAS,CAChB,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC,CAAC,kDAAkD;QACtE,CAAC;QACD,MAAM,QAAQ,GAA0B;YACtC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO;SACR,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/signet-request-response-reader.d.ts

@@ -0,0 +1,160 @@
+import type { PublicDataProvider } from "@midnight-ntwrk/midnight-js-types";
+import type { Transaction } from "ethers";
+import { type SignatureResponse, type RespondBidirectional } from "./signet-contract-state-reader.ts";
+import type { RawContractState } from "./signature-state-reading.ts";
+import { type SignBidirectionalRequest, type RequestIdHex } from "./signet-requests.ts";
+/**
+ * The least of midnight-js's `PublicDataProvider` the reader needs: raw
+ * contract state by address. Declared structurally (rather than a `Pick`) so
+ * tests can satisfy it with a plain stub; any full `PublicDataProvider`
+ * (e.g. `indexerPublicDataProvider`) is assignable to it.
+ */
+export interface SignetPublicStateSource {
+    /**
+     * Retrieve the on-chain state of a contract at the latest block.
+     *
+     * @param contractAddress - The contract address to query.
+     * @returns The state (its `data` is the raw ledger tree), or `null` when
+     *   the address holds no contract.
+     */
+    queryContractState(contractAddress: Parameters<PublicDataProvider["queryContractState"]>[0]): Promise<{
+        data: RawContractState;
+    } | null>;
+}
+/** Everything a {@link SignetRequestResponseReader} needs to operate. */
+export interface SignetRequestResponseReaderConfig {
+    /** Address of the signet-compliant requester contract (e.g. the vault). */
+    readonly requesterContractAddress: string;
+    /** Address of the central signet contract. */
+    readonly signetContractAddress: string;
+    /** Source of raw contract state, e.g. midnight-js's `indexerPublicDataProvider`. */
+    readonly publicDataProvider: SignetPublicStateSource;
+}
+/** The verdict on one posted response, in `count` order. */
+export interface SignatureResponseVerdict {
+    /** 0-based position of the post in the request's response log. */
+    count: bigint;
+    /** The posted signature record, verbatim. */
+    response: SignatureResponse;
+    /** Recovered signer address — absent when the signature did not decode. */
+    signer?: string;
+    /** Why the post was rejected; absent when the post is valid. */
+    rejectedReason?: string;
+}
+/** Result of {@link SignetRequestResponseReader['getVerifiedSignatureResponse']}. */
+export interface VerifiedSignatureResponseResult {
+    /**
+     * The first valid response (lowest count), or `undefined` when no valid
+     * response has been posted yet — poll again.
+     */
+    verified?: SignatureResponse;
+    /**
+     * One verdict per post, count order. Pure data: the reader never logs, so
+     * callers decide how to surface rejected posts.
+     */
+    verdicts: SignatureResponseVerdict[];
+}
+/**
+ * Reader over one requester contract / signet contract pair.
+ * Construct once per pair and reuse: fetched request records are cached (they
+ * are immutable — the ledger key is their hash), so repeated verification
+ * calls cost one responses-contract query each.
+ */
+export declare class SignetRequestResponseReader {
+    private readonly config;
+    private readonly requestCache;
+    /**
+     * @param config - The contract pair and state source to read through.
+     */
+    constructor(config: SignetRequestResponseReaderConfig);
+    /**
+     * Query one contract's raw state, throwing a uniform error when absent.
+     *
+     * @param contractAddress - The contract to query.
+     * @param role - Human name of the contract for the error message.
+     * @returns The raw ledger state tree.
+     * @throws Error when the address holds no contract state.
+     */
+    private queryRawState;
+    /**
+     * Fetch the request record for `requestId` from the requester contract's
+     * ledger (request index, field 0 by the signet layout convention). Cached
+     * after the first fetch.
+     *
+     * @param requestId - The request id to look up.
+     * @returns The stored request record.
+     * @throws Error when the requester contract has no state or holds no
+     *   request under `requestId`.
+     */
+    getSignatureRequest(requestId: RequestIdHex): Promise<SignBidirectionalRequest>;
+    /**
+     * Fetch every response posted for `requestId`, in post (count) order.
+     * UNVERIFIED — any of them may be garbage; see
+     * {@link getVerifiedSignatureResponse}.
+     *
+     * @param requestId - The request id whose posts to enumerate.
+     * @returns The posted payloads, index = count; empty when none yet.
+     * @throws Error when the responses contract has no state, or its counter
+     *   disagrees with the log (inconsistent ledger).
+     */
+    getSignatureResponses(requestId: RequestIdHex): Promise<SignatureResponse[]>;
+    /**
+     * Fetch and verify the responses posted for `requestId`: each post's
+     * `{ bigR, s, recoveryId }` signature must recover to `expectedSigner`
+     * (compared case-insensitively) over the signing hash of the transaction
+     * the request record describes. The first valid post wins; every post gets
+     * a verdict so callers can report the noise.
+     *
+     * @param requestId - The request id to fetch a verified response for.
+     * @param expectedSigner - The EVM address (0x hex, any case) the genuine
+     *   response must be signed by — the requester's MPC-derived address.
+     * @returns The first valid response (if any) plus per-post verdicts.
+     * @throws Error when either contract has no state, the request is not on
+     *   the requester's ledger, or the responses ledger is inconsistent.
+     */
+    getVerifiedSignatureResponse(requestId: RequestIdHex, expectedSigner: string): Promise<VerifiedSignatureResponseResult>;
+    /**
+     * Rebuild the unsigned EIP-1559 transaction for `requestId` — the exact
+     * transaction the MPC signs, assembled from the request record's decomposed
+     * fields. No responses-contract query: this needs only the request record
+     * (fetched via {@link getSignatureRequest}, cached).
+     *
+     * @param requestId - The request id whose transaction to rebuild.
+     * @returns The unsigned ethers transaction (`unsignedHash` is the MPC's
+     *   signing digest).
+     * @throws Error when the requester contract has no state or holds no
+     *   request under `requestId`.
+     */
+    getUnsignedEVMTransaction(requestId: RequestIdHex): Promise<Transaction>;
+    /**
+     * Assemble the broadcast-ready signed EIP-1559 transaction for `requestId`:
+     * rebuild the request's transaction and attach the first VERIFIED response
+     * signed by `expectedSigner` (see {@link getVerifiedSignatureResponse} — the
+     * response log is unauthenticated, so an `expectedSigner` is required and
+     * unverified posts are never attached).
+     *
+     * @param requestId - The request id to produce a signed transaction for.
+     * @param expectedSigner - The EVM address (0x hex, any case) the genuine
+     *   response must be signed by — the requester's MPC-derived address.
+     * @returns The signed ethers transaction (`serialized` is the payload for
+     *   `eth_sendRawTransaction`), or `undefined` when no valid response has
+     *   been posted yet — poll again.
+     * @throws Error when either contract has no state, the request is not on the
+     *   requester's ledger, or the responses ledger is inconsistent.
+     */
+    getSignedEVMTransaction(requestId: RequestIdHex, expectedSigner: string): Promise<Transaction | undefined>;
+    /**
+     * Fetch the MPC's respond-bidirectional attestation for `requestId`,
+     * if posted. The signet contract verified it IN-CIRCUIT at post time
+     * (Schnorr over `(requestId, hash(serializedOutput, outputLen))` against
+     * the sealed MPC key), so it is single-slot and needs no off-chain
+     * verification or verdicts — `undefined` simply means not posted yet, poll
+     * again.
+     *
+     * @param requestId - The request id whose attestation to fetch.
+     * @returns The attestation record, or `undefined` when none is posted.
+     * @throws Error when the signet contract has no state on-chain.
+     */
+    getRespondBidirectional(requestId: RequestIdHex): Promise<RespondBidirectional | undefined>;
+}
+//# sourceMappingURL=signet-request-response-reader.d.ts.map

package/dist/signet-request-response-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signet-request-response-reader.d.ts","sourceRoot":"","sources":["../src/signet-request-response-reader.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAG1C,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAC1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;OAMG;IACH,kBAAkB,CAChB,eAAe,EAAE,UAAU,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,GACvE,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAC/C;AAED,yEAAyE;AACzE,MAAM,WAAW,iCAAiC;IAChD,2EAA2E;IAC3E,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,8CAA8C;IAC9C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,oFAAoF;IACpF,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;CACtD;AAED,4DAA4D;AAC5D,MAAM,WAAW,wBAAwB;IACvC,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,qFAAqF;AACrF,MAAM,WAAW,+BAA+B;IAC9C;;;OAGG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;OAGG;IACH,QAAQ,EAAE,wBAAwB,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAG3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAGzB;IAEJ;;OAEG;gBACS,MAAM,EAAE,iCAAiC;IAIrD;;;;;;;OAOG;YACW,aAAa;IAc3B;;;;;;;;;OASG;IACG,mBAAmB,CACvB,SAAS,EAAE,YAAY,GACtB,OAAO,CAAC,wBAAwB,CAAC;IAoBpC;;;;;;;;;OASG;IACG,qBAAqB,CACzB,SAAS,EAAE,YAAY,GACtB,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAwB/B;;;;;;;;;;;;;OAaG;IACG,4BAA4B,CAChC,SAAS,EAAE,YAAY,EACvB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,+BAA+B,CAAC;IAiC3C;;;;;;;;;;;OAWG;IACG,yBAAyB,CAC7B,SAAS,EAAE,YAAY,GACtB,OAAO,CAAC,WAAW,CAAC;IAMvB;;;;;;;;;;;;;;;OAeG;IACG,uBAAuB,CAC3B,SAAS,EAAE,YAAY,EACvB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAcnC;;;;;;;;;;;OAWG;IACG,uBAAuB,CAC3B,SAAS,EAAE,YAAY,GACtB,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;CAS7C"}

package/dist/signet-request-response-reader.js

@@ -0,0 +1,198 @@
+// One-stop client-side reader for the signet request/response flow: fetch a
+// request record from the requester contract's ledger, enumerate the posts in
+// the signet contract's signature response log, and verify each candidate
+// against the request.
+// This is the helper the Signet.compact "Response Ledger Layout" comment
+// promises — the log is UNAUTHENTICATED, so a client must verify every post
+// and take the first valid one; this class packages that flow so every
+// consumer (CLI poller, integration tests, a future UI) shares one
+// implementation. Single-shot by design: each call queries state once; the
+// caller owns any poll loop.
+import { readSignetRequestsLedgerFromState } from "./signature-requests-state-reader.js";
+import { readSignetContractLedgerFromState, signetResponseIndexKey, } from "./signet-contract-state-reader.js";
+import { recoverSignatureResponseSigner } from "./signature-response-verification.js";
+import { signBidirectionalRequestToSignedEVMTransaction, signBidirectionalRequestToUnsignedEVMTransaction, } from "./signet-requests.js";
+/**
+ * Reader over one requester contract / signet contract pair.
+ * Construct once per pair and reuse: fetched request records are cached (they
+ * are immutable — the ledger key is their hash), so repeated verification
+ * calls cost one responses-contract query each.
+ */
+export class SignetRequestResponseReader {
+    config;
+    // Request records never change once stored; cache them across calls.
+    requestCache = new Map();
+    /**
+     * @param config - The contract pair and state source to read through.
+     */
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Query one contract's raw state, throwing a uniform error when absent.
+     *
+     * @param contractAddress - The contract to query.
+     * @param role - Human name of the contract for the error message.
+     * @returns The raw ledger state tree.
+     * @throws Error when the address holds no contract state.
+     */
+    async queryRawState(contractAddress, role) {
+        const state = await this.config.publicDataProvider.queryContractState(contractAddress);
+        if (!state?.data) {
+            throw new Error(`no state data found for ${role} contract '${contractAddress}' - is it deployed?`);
+        }
+        return state.data;
+    }
+    /**
+     * Fetch the request record for `requestId` from the requester contract's
+     * ledger (request index, field 0 by the signet layout convention). Cached
+     * after the first fetch.
+     *
+     * @param requestId - The request id to look up.
+     * @returns The stored request record.
+     * @throws Error when the requester contract has no state or holds no
+     *   request under `requestId`.
+     */
+    async getSignatureRequest(requestId) {
+        const cached = this.requestCache.get(requestId);
+        if (cached !== undefined) {
+            return cached;
+        }
+        const raw = await this.queryRawState(this.config.requesterContractAddress, "requester");
+        const { requestsIndex } = readSignetRequestsLedgerFromState(raw);
+        const request = requestsIndex.get(requestId);
+        if (request === undefined) {
+            throw new Error(`request ${requestId} is not on the requester contract's ledger — was it submitted?`);
+        }
+        this.requestCache.set(requestId, request);
+        return request;
+    }
+    /**
+     * Fetch every response posted for `requestId`, in post (count) order.
+     * UNVERIFIED — any of them may be garbage; see
+     * {@link getVerifiedSignatureResponse}.
+     *
+     * @param requestId - The request id whose posts to enumerate.
+     * @returns The posted payloads, index = count; empty when none yet.
+     * @throws Error when the responses contract has no state, or its counter
+     *   disagrees with the log (inconsistent ledger).
+     */
+    async getSignatureResponses(requestId) {
+        const raw = await this.queryRawState(this.config.signetContractAddress, "signet contract");
+        const { signatureResponseCounterIndex, signatureResponseIndex } = readSignetContractLedgerFromState(raw);
+        const totalPosts = signatureResponseCounterIndex.get(requestId) ?? 0n;
+        const responses = [];
+        for (let count = 0n; count < totalPosts; count++) {
+            const response = signatureResponseIndex.get(signetResponseIndexKey(requestId, count));
+            if (response === undefined) {
+                throw new Error(`response log has no entry ${count} for request ${requestId} ` +
+                    `despite its counter reading ${totalPosts} — ledger state is inconsistent`);
+            }
+            responses.push(response);
+        }
+        return responses;
+    }
+    /**
+     * Fetch and verify the responses posted for `requestId`: each post's
+     * `{ bigR, s, recoveryId }` signature must recover to `expectedSigner`
+     * (compared case-insensitively) over the signing hash of the transaction
+     * the request record describes. The first valid post wins; every post gets
+     * a verdict so callers can report the noise.
+     *
+     * @param requestId - The request id to fetch a verified response for.
+     * @param expectedSigner - The EVM address (0x hex, any case) the genuine
+     *   response must be signed by — the requester's MPC-derived address.
+     * @returns The first valid response (if any) plus per-post verdicts.
+     * @throws Error when either contract has no state, the request is not on
+     *   the requester's ledger, or the responses ledger is inconsistent.
+     */
+    async getVerifiedSignatureResponse(requestId, expectedSigner) {
+        const request = await this.getSignatureRequest(requestId);
+        const responses = await this.getSignatureResponses(requestId);
+        const verdicts = responses.map((response, index) => {
+            const count = BigInt(index);
+            let signer;
+            try {
+                signer = recoverSignatureResponseSigner(request, response);
+            }
+            catch (error) {
+                return {
+                    count,
+                    response,
+                    rejectedReason: `not a decodable signature (${String(error)})`,
+                };
+            }
+            if (signer.toLowerCase() !== expectedSigner.toLowerCase()) {
+                return {
+                    count,
+                    response,
+                    signer,
+                    rejectedReason: `signed by ${signer}, expected ${expectedSigner}`,
+                };
+            }
+            return { count, response, signer };
+        });
+        return {
+            verified: verdicts.find((v) => v.rejectedReason === undefined)?.response,
+            verdicts,
+        };
+    }
+    /**
+     * Rebuild the unsigned EIP-1559 transaction for `requestId` — the exact
+     * transaction the MPC signs, assembled from the request record's decomposed
+     * fields. No responses-contract query: this needs only the request record
+     * (fetched via {@link getSignatureRequest}, cached).
+     *
+     * @param requestId - The request id whose transaction to rebuild.
+     * @returns The unsigned ethers transaction (`unsignedHash` is the MPC's
+     *   signing digest).
+     * @throws Error when the requester contract has no state or holds no
+     *   request under `requestId`.
+     */
+    async getUnsignedEVMTransaction(requestId) {
+        return signBidirectionalRequestToUnsignedEVMTransaction(await this.getSignatureRequest(requestId));
+    }
+    /**
+     * Assemble the broadcast-ready signed EIP-1559 transaction for `requestId`:
+     * rebuild the request's transaction and attach the first VERIFIED response
+     * signed by `expectedSigner` (see {@link getVerifiedSignatureResponse} — the
+     * response log is unauthenticated, so an `expectedSigner` is required and
+     * unverified posts are never attached).
+     *
+     * @param requestId - The request id to produce a signed transaction for.
+     * @param expectedSigner - The EVM address (0x hex, any case) the genuine
+     *   response must be signed by — the requester's MPC-derived address.
+     * @returns The signed ethers transaction (`serialized` is the payload for
+     *   `eth_sendRawTransaction`), or `undefined` when no valid response has
+     *   been posted yet — poll again.
+     * @throws Error when either contract has no state, the request is not on the
+     *   requester's ledger, or the responses ledger is inconsistent.
+     */
+    async getSignedEVMTransaction(requestId, expectedSigner) {
+        const { verified } = await this.getVerifiedSignatureResponse(requestId, expectedSigner);
+        if (verified === undefined) {
+            return undefined;
+        }
+        // getSignatureRequest is cached — getVerifiedSignatureResponse already
+        // fetched it, so this is a free lookup, not a second query.
+        const request = await this.getSignatureRequest(requestId);
+        return signBidirectionalRequestToSignedEVMTransaction(request, verified);
+    }
+    /**
+     * Fetch the MPC's respond-bidirectional attestation for `requestId`,
+     * if posted. The signet contract verified it IN-CIRCUIT at post time
+     * (Schnorr over `(requestId, hash(serializedOutput, outputLen))` against
+     * the sealed MPC key), so it is single-slot and needs no off-chain
+     * verification or verdicts — `undefined` simply means not posted yet, poll
+     * again.
+     *
+     * @param requestId - The request id whose attestation to fetch.
+     * @returns The attestation record, or `undefined` when none is posted.
+     * @throws Error when the signet contract has no state on-chain.
+     */
+    async getRespondBidirectional(requestId) {
+        const raw = await this.queryRawState(this.config.signetContractAddress, "signet contract");
+        return readSignetContractLedgerFromState(raw).respondBidirectionalIndex.get(requestId);
+    }
+}
+//# sourceMappingURL=signet-request-response-reader.js.map

package/dist/signet-request-response-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signet-request-response-reader.js","sourceRoot":"","sources":["../src/signet-request-response-reader.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,uBAAuB;AACvB,yEAAyE;AACzE,4EAA4E;AAC5E,uEAAuE;AACvE,mEAAmE;AACnE,2EAA2E;AAC3E,6BAA6B;AAK7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GAGvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAEtF,OAAO,EACL,8CAA8C,EAC9C,gDAAgD,GAGjD,MAAM,sBAAsB,CAAC;AAyD9B;;;;;GAKG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAoC;IAE3D,qEAAqE;IACpD,YAAY,GAAG,IAAI,GAAG,EAGpC,CAAC;IAEJ;;OAEG;IACH,YAAY,MAAyC;QACnD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CACzB,eAAuB,EACvB,IAAY;QAEZ,MAAM,KAAK,GACT,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,cAAc,eAAe,qBAAqB,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,mBAAmB,CACvB,SAAuB;QAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,IAAI,CAAC,MAAM,CAAC,wBAAwB,EACpC,WAAW,CACZ,CAAC;QACF,MAAM,EAAE,aAAa,EAAE,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,gEAAgE,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,qBAAqB,CACzB,SAAuB;QAEvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,IAAI,CAAC,MAAM,CAAC,qBAAqB,EACjC,iBAAiB,CAClB,CAAC;QACF,MAAM,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,GAC7D,iCAAiC,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,6BAA6B,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACtE,MAAM,SAAS,GAAwB,EAAE,CAAC;QAC1C,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CACzC,sBAAsB,CAAC,SAAS,EAAE,KAAK,CAAC,CACzC,CAAC;YACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,gBAAgB,SAAS,GAAG;oBAC5D,+BAA+B,UAAU,iCAAiC,CAC7E,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,4BAA4B,CAChC,SAAuB,EACvB,cAAsB;QAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAC5B,CAAC,QAAQ,EAAE,KAAK,EAA4B,EAAE;YAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,8BAA8B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,KAAK;oBACL,QAAQ;oBACR,cAAc,EAAE,8BAA8B,MAAM,CAAC,KAAK,CAAC,GAAG;iBAC/D,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC1D,OAAO;oBACL,KAAK;oBACL,QAAQ;oBACR,MAAM;oBACN,cAAc,EAAE,aAAa,MAAM,cAAc,cAAc,EAAE;iBAClE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACrC,CAAC,CACF,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,EAAE,QAAQ;YACxE,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,yBAAyB,CAC7B,SAAuB;QAEvB,OAAO,gDAAgD,CACrD,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAC1C,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,uBAAuB,CAC3B,SAAuB,EACvB,cAAsB;QAEtB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAC1D,SAAS,EACT,cAAc,CACf,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,uEAAuE;QACvE,4DAA4D;QAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC1D,OAAO,8CAA8C,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,uBAAuB,CAC3B,SAAuB;QAEvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,IAAI,CAAC,MAAM,CAAC,qBAAqB,EACjC,iBAAiB,CAClB,CAAC;QACF,OAAO,iCAAiC,CAAC,GAAG,CAAC,CAAC,yBAAyB,CAAC,GAAG,CACzE,SAAS,CACV,CAAC;IACJ,CAAC;CACF"}