@solana/keychain-aws-kms 0.0.0 → 0.2.1

package/README.md

@@ -0,0 +1,176 @@
+# @solana/keychain-aws-kms
+
+AWS KMS-based signer for Solana transactions using EdDSA (Ed25519) signing.
+
+## Installation
+
+```bash
+pnpm add @solana/keychain-aws-kms @aws-sdk/client-kms
+```
+
+## Prerequisites
+
+1. An AWS KMS key with:
+   - **Key spec**: `ECC_NIST_EDWARDS25519`
+   - **Key usage**: `SIGN_VERIFY`
+
+2. AWS credentials configured (see [AWS Credentials](#aws-credentials) below)
+
+## AWS Credentials
+
+The signer uses the **AWS default credential provider chain** to authenticate. You don't need to pass credentials explicitly unless you want to override the defaults.
+
+### Credential Resolution Order
+
+The AWS SDK looks for credentials in this order:
+
+1. **Environment variables**
+   ```bash
+   export AWS_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE"
+   export AWS_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+   export AWS_SESSION_TOKEN="..." # Optional, for temporary credentials
+   export AWS_REGION="us-east-1"  # Optional
+   ```
+
+2. **Shared credentials file** (`~/.aws/credentials`)
+   ```ini
+   [default]
+   aws_access_key_id = AKIAIOSFODNN7EXAMPLE
+   aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
+   ```
+
+3. **IAM role** (automatic when running on AWS EC2, ECS, or Lambda)
+
+4. **Web identity token** (for EKS/Kubernetes with IRSA)
+
+### Recommended Setup
+
+| Environment | Recommended Method |
+|-------------|-------------------|
+| **Production on AWS** | IAM role attached to EC2/ECS/Lambda (no explicit creds needed) |
+| **Local development** | Environment variables or `~/.aws/credentials` file |
+| **CI/CD pipelines** | Environment variables or OIDC |
+| **Explicit control** | Pass `credentials` in config (TypeScript only) |
+
+### Security Best Practices
+
+- **Never commit credentials** to source control
+- **Use IAM roles** in production instead of long-lived access keys
+- **Use least-privilege IAM policies** - only grant `kms:Sign` and `kms:DescribeKey`
+- **Enable CloudTrail** to audit KMS key usage
+
+## Creating an AWS KMS Key
+
+Use the AWS CLI to create a key suitable for Solana signing:
+
+```bash
+aws kms create-key \
+  --key-spec ECC_NIST_EDWARDS25519 \
+  --key-usage SIGN_VERIFY \
+  --description "Solana signing key"
+```
+
+Or use the AWS Console:
+1. Go to AWS KMS → Customer managed keys
+2. Click "Create key"
+3. Select "Asymmetric" key type
+4. Select "ECC_NIST_EDWARDS25519" key spec
+5. Select "Sign and verify" key usage
+6. Complete the key creation process
+
+## Usage
+
+### Basic Example
+
+```typescript
+import { AwsKmsSigner } from '@solana/keychain-aws-kms';
+
+const signer = new AwsKmsSigner({
+    keyId: 'arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012',
+    publicKey: 'YourSolanaPublicKeyBase58',
+    region: 'us-east-1', // Optional, defaults to AWS config default
+});
+
+// Sign a message
+const message = { content: new Uint8Array([1, 2, 3, 4]) };
+const signatures = await signer.signMessages([message]);
+
+// Sign a transaction
+const signatures = await signer.signTransactions([transaction]);
+```
+
+### With Custom Credentials
+
+```typescript
+const signer = new AwsKmsSigner({
+    keyId: 'arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012',
+    publicKey: 'YourSolanaPublicKeyBase58',
+    region: 'us-east-1',
+    credentials: {
+        accessKeyId: 'your-access-key-id',
+        secretAccessKey: 'your-secret-access-key',
+        sessionToken: 'optional-session-token', // For temporary credentials
+    },
+});
+```
+
+### With Request Delay (Rate Limiting)
+
+```typescript
+const signer = new AwsKmsSigner({
+    keyId: 'arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012',
+    publicKey: 'YourSolanaPublicKeyBase58',
+    requestDelayMs: 100, // 100ms delay between concurrent requests
+});
+```
+
+## API Reference
+
+### `AwsKmsSigner`
+
+#### Constructor
+
+```typescript
+new AwsKmsSigner(config: AwsKmsSignerConfig)
+```
+
+**Config Options:**
+- `keyId` (required): AWS KMS key ID or ARN
+- `publicKey` (required): Solana public key (base58-encoded)
+- `region` (optional): AWS region (defaults to AWS config default)
+- `requestDelayMs` (optional): Delay in ms between concurrent requests (default: 0)
+- `credentials` (optional): AWS credentials object
+
+#### Methods
+
+- `signMessages(messages)`: Sign multiple messages
+- `signTransactions(transactions)`: Sign multiple transactions
+- `isAvailable()`: Check if the signer is available and the key is valid
+
+## AWS IAM Permissions
+
+The AWS credentials used must have the following permissions:
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": [
+                "kms:Sign",
+                "kms:DescribeKey"
+            ],
+            "Resource": "arn:aws:kms:*:*:key/*"
+        }
+    ]
+}
+```
+
+## Notes
+
+- Ed25519 signatures are 64 bytes
+- The signer uses `ED25519_SHA_512` algorithm with `RAW` message type
+- The key must be in `Enabled` state to sign
+- Rate limiting can be configured via `requestDelayMs` to avoid AWS KMS throttling
+

package/dist/__tests__/aws-kms-signer.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=aws-kms-signer.test.d.ts.map

package/dist/__tests__/aws-kms-signer.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-kms-signer.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/aws-kms-signer.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/aws-kms-signer.test.js

@@ -0,0 +1,333 @@
+import { generateKeyPairSigner } from '@solana/signers';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { assertIsSolanaSigner } from '@solana/keychain-core';
+import { AwsKmsSigner } from '../aws-kms-signer.js';
+// Mock AWS SDK
+const mockSend = vi.fn();
+vi.mock('@aws-sdk/client-kms', () => {
+    // Create proper constructor mock classes
+    class MockKMSClient {
+        constructor() {
+            this.send = mockSend;
+        }
+    }
+    class MockSignCommand {
+        constructor(params) {
+            this.input = params;
+        }
+    }
+    class MockDescribeKeyCommand {
+        constructor(params) {
+            this.input = params;
+        }
+    }
+    return {
+        KMSClient: MockKMSClient,
+        SignCommand: MockSignCommand,
+        DescribeKeyCommand: MockDescribeKeyCommand,
+        MessageType: {
+            RAW: 'RAW',
+            DIGEST: 'DIGEST',
+        },
+        SigningAlgorithmSpec: {
+            ED25519_SHA_512: 'ED25519_SHA_512',
+            ED25519_PH_SHA_512: 'ED25519_PH_SHA_512',
+        },
+    };
+});
+describe('AwsKmsSigner', () => {
+    const TEST_KEY_ID = 'arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012';
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    describe('constructor', () => {
+        it('creates an AwsKmsSigner with valid config', async () => {
+            const keyPair = await generateKeyPairSigner();
+            const config = {
+                keyId: TEST_KEY_ID,
+                publicKey: keyPair.address,
+            };
+            const signer = new AwsKmsSigner(config);
+            expect(signer.address).toBe(keyPair.address);
+            assertIsSolanaSigner(signer);
+            expect(signer.signMessages).toBeDefined();
+            expect(signer.signTransactions).toBeDefined();
+            expect(signer.isAvailable).toBeDefined();
+        });
+        it('sets address field correctly from config', async () => {
+            const keyPair = await generateKeyPairSigner();
+            const config = {
+                keyId: TEST_KEY_ID,
+                publicKey: keyPair.address,
+            };
+            const signer = new AwsKmsSigner(config);
+            expect(signer.address).toBe(keyPair.address);
+        });
+        it('should throw error for missing keyId', async () => {
+            const keyPair = await generateKeyPairSigner();
+            expect(() => {
+                new AwsKmsSigner({
+                    keyId: '',
+                    publicKey: keyPair.address,
+                });
+            }).toThrow('Missing required keyId field');
+        });
+        it('should throw error for missing publicKey', () => {
+            expect(() => {
+                new AwsKmsSigner({
+                    keyId: TEST_KEY_ID,
+                    publicKey: '',
+                });
+            }).toThrow('Missing required publicKey field');
+        });
+        it('should throw error for invalid public key', () => {
+            expect(() => {
+                new AwsKmsSigner({
+                    keyId: TEST_KEY_ID,
+                    publicKey: 'invalid-key',
+                });
+            }).toThrow('Invalid Solana public key format');
+        });
+        it('should validate requestDelayMs', async () => {
+            const keyPair = await generateKeyPairSigner();
+            expect(() => {
+                new AwsKmsSigner({
+                    keyId: TEST_KEY_ID,
+                    publicKey: keyPair.address,
+                    requestDelayMs: -1,
+                });
+            }).toThrow('requestDelayMs must not be negative');
+        });
+        it('should warn for high requestDelayMs', async () => {
+            const keyPair = await generateKeyPairSigner();
+            const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => { });
+            new AwsKmsSigner({
+                keyId: TEST_KEY_ID,
+                publicKey: keyPair.address,
+                requestDelayMs: 5000,
+            });
+            expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('requestDelayMs is greater than 3000ms'));
+            warnSpy.mockRestore();
+        });
+        it('should accept region configuration', async () => {
+            const keyPair = await generateKeyPairSigner();
+            const signer = new AwsKmsSigner({
+                keyId: TEST_KEY_ID,
+                publicKey: keyPair.address,
+                region: 'us-west-2',
+            });
+            expect(signer).toBeDefined();
+        });
+        it('should accept credentials configuration', async () => {
+            const keyPair = await generateKeyPairSigner();
+            const signer = new AwsKmsSigner({
+                keyId: TEST_KEY_ID,
+                publicKey: keyPair.address,
+                credentials: {
+                    accessKeyId: 'test-access-key',
+                    secretAccessKey: 'test-secret-key',
+                },
+            });
+            expect(signer).toBeDefined();
+        });
+        it('should accept session token in credentials', async () => {
+            const keyPair = await generateKeyPairSigner();
+            const signer = new AwsKmsSigner({
+                keyId: TEST_KEY_ID,
+                publicKey: keyPair.address,
+                credentials: {
+                    accessKeyId: 'test-access-key',
+                    secretAccessKey: 'test-secret-key',
+                    sessionToken: 'test-session-token',
+                },
+            });
+            expect(signer).toBeDefined();
+        });
+    });
+    describe('signMessages', () => {
+        it('should sign a message successfully', async () => {
+            const keyPair = await generateKeyPairSigner();
+            mockSend.mockResolvedValue({
+                Signature: new Uint8Array(64).fill(0x42),
+            });
+            const signer = new AwsKmsSigner({
+                keyId: TEST_KEY_ID,
+                publicKey: keyPair.address,
+            });
+            // Provide required 'signatures' property to satisfy the type
+            const message = {
+                content: new Uint8Array([1, 2, 3, 4]),
+                signatures: {},
+            };
+            const result = await signer.signMessages([message]);
+            expect(result).toHaveLength(1);
+            expect(result[0]?.[signer.address]).toBeDefined();
+            expect(mockSend).toHaveBeenCalledTimes(1);
+        });
+        it('should handle multiple messages with delay', async () => {
+            const keyPair = await generateKeyPairSigner();
+            mockSend.mockResolvedValue({
+                Signature: new Uint8Array(64).fill(0x42),
+            });
+            const signer = new AwsKmsSigner({
+                keyId: TEST_KEY_ID,
+                publicKey: keyPair.address,
+                requestDelayMs: 10,
+            });
+            const messages = [
+                { content: new Uint8Array([1]) },
+                { content: new Uint8Array([2]) },
+                { content: new Uint8Array([3]) },
+            ];
+            // Add missing 'signatures' property for each message to satisfy the type requirement
+            const messagesWithSignatures = messages.map(msg => ({
+                ...msg,
+                signatures: {},
+            }));
+            const startTime = Date.now();
+            const result = await signer.signMessages(messagesWithSignatures);
+            const endTime = Date.now();
+            expect(result).toHaveLength(3);
+            expect(mockSend).toHaveBeenCalledTimes(3);
+            // Should have some delay (at least 15ms for 2 delays of 10ms each)
+            expect(endTime - startTime).toBeGreaterThanOrEqual(15);
+        });
+        it('should throw error on invalid signature length', async () => {
+            const keyPair = await generateKeyPairSigner();
+            mockSend.mockResolvedValue({
+                Signature: new Uint8Array(32), // Wrong length
+            });
+            const signer = new AwsKmsSigner({
+                keyId: TEST_KEY_ID,
+                publicKey: keyPair.address,
+            });
+            const message = { content: new Uint8Array([1, 2, 3, 4]), signatures: {} };
+            await expect(signer.signMessages([message])).rejects.toThrow('Invalid signature length');
+        });
+        it('should throw error on missing signature', async () => {
+            const keyPair = await generateKeyPairSigner();
+            mockSend.mockResolvedValue({
+                Signature: undefined,
+            });
+            const signer = new AwsKmsSigner({
+                keyId: TEST_KEY_ID,
+                publicKey: keyPair.address,
+            });
+            const message = { content: new Uint8Array([1, 2, 3, 4]), signatures: {} };
+            await expect(signer.signMessages([message])).rejects.toThrow('No signature in AWS KMS response');
+        });
+    });
+    describe('signTransactions', () => {
+        it('should sign a transaction successfully', async () => {
+            const keyPair = await generateKeyPairSigner();
+            mockSend.mockResolvedValue({
+                Signature: new Uint8Array(64).fill(0x42),
+            });
+            const signer = new AwsKmsSigner({
+                keyId: TEST_KEY_ID,
+                publicKey: keyPair.address,
+            });
+            const transaction = {
+                messageBytes: new Uint8Array([1, 2, 3, 4]),
+                signatures: {},
+            };
+            const result = await signer.signTransactions([transaction]);
+            expect(result).toHaveLength(1);
+            expect(result[0]).toHaveProperty(signer.address);
+            expect(mockSend).toHaveBeenCalledTimes(1);
+        });
+    });
+    describe('isAvailable', () => {
+        it('should return true for valid Ed25519 key', async () => {
+            const keyPair = await generateKeyPairSigner();
+            mockSend.mockResolvedValue({
+                KeyMetadata: {
+                    KeyId: TEST_KEY_ID,
+                    KeySpec: 'ECC_NIST_EDWARDS25519',
+                    KeyUsage: 'SIGN_VERIFY',
+                    KeyState: 'Enabled',
+                },
+            });
+            const signer = new AwsKmsSigner({
+                keyId: TEST_KEY_ID,
+                publicKey: keyPair.address,
+            });
+            const available = await signer.isAvailable();
+            expect(available).toBe(true);
+        });
+        it('should return false for wrong key spec', async () => {
+            const keyPair = await generateKeyPairSigner();
+            mockSend.mockResolvedValue({
+                KeyMetadata: {
+                    KeyId: TEST_KEY_ID,
+                    KeySpec: 'RSA_2048',
+                    KeyUsage: 'SIGN_VERIFY',
+                    KeyState: 'Enabled',
+                },
+            });
+            const signer = new AwsKmsSigner({
+                keyId: TEST_KEY_ID,
+                publicKey: keyPair.address,
+            });
+            const available = await signer.isAvailable();
+            expect(available).toBe(false);
+        });
+        it('should return false for wrong key usage', async () => {
+            const keyPair = await generateKeyPairSigner();
+            mockSend.mockResolvedValue({
+                KeyMetadata: {
+                    KeyId: TEST_KEY_ID,
+                    KeySpec: 'ECC_NIST_EDWARDS25519',
+                    KeyUsage: 'ENCRYPT_DECRYPT',
+                    KeyState: 'Enabled',
+                },
+            });
+            const signer = new AwsKmsSigner({
+                keyId: TEST_KEY_ID,
+                publicKey: keyPair.address,
+            });
+            const available = await signer.isAvailable();
+            expect(available).toBe(false);
+        });
+        it('should return false for disabled key', async () => {
+            const keyPair = await generateKeyPairSigner();
+            mockSend.mockResolvedValue({
+                KeyMetadata: {
+                    KeyId: TEST_KEY_ID,
+                    KeySpec: 'ECC_NIST_EDWARDS25519',
+                    KeyUsage: 'SIGN_VERIFY',
+                    KeyState: 'Disabled',
+                },
+            });
+            const signer = new AwsKmsSigner({
+                keyId: TEST_KEY_ID,
+                publicKey: keyPair.address,
+            });
+            const available = await signer.isAvailable();
+            expect(available).toBe(false);
+        });
+        it('should return false on error', async () => {
+            const keyPair = await generateKeyPairSigner();
+            mockSend.mockRejectedValue(new Error('AWS error'));
+            const signer = new AwsKmsSigner({
+                keyId: TEST_KEY_ID,
+                publicKey: keyPair.address,
+            });
+            const available = await signer.isAvailable();
+            expect(available).toBe(false);
+        });
+        it('should return false on missing metadata', async () => {
+            const keyPair = await generateKeyPairSigner();
+            mockSend.mockResolvedValue({
+                KeyMetadata: undefined,
+            });
+            const signer = new AwsKmsSigner({
+                keyId: TEST_KEY_ID,
+                publicKey: keyPair.address,
+            });
+            const available = await signer.isAvailable();
+            expect(available).toBe(false);
+        });
+    });
+});
+//# sourceMappingURL=aws-kms-signer.test.js.map

package/dist/__tests__/aws-kms-signer.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-kms-signer.test.js","sourceRoot":"","sources":["../../src/__tests__/aws-kms-signer.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,eAAe;AACf,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAEzB,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE;IAChC,yCAAyC;IACzC,MAAM,aAAa;QAAnB;YACI,SAAI,GAAG,QAAQ,CAAC;QACpB,CAAC;KAAA;IAED,MAAM,eAAe;QAEjB,YAAY,MAAe;YACvB,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACxB,CAAC;KACJ;IAED,MAAM,sBAAsB;QAExB,YAAY,MAAe;YACvB,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACxB,CAAC;KACJ;IAED,OAAO;QACH,SAAS,EAAE,aAAa;QACxB,WAAW,EAAE,eAAe;QAC5B,kBAAkB,EAAE,sBAAsB;QAC1C,WAAW,EAAE;YACT,GAAG,EAAE,KAAK;YACV,MAAM,EAAE,QAAQ;SACnB;QACD,oBAAoB,EAAE;YAClB,eAAe,EAAE,iBAAiB;YAClC,kBAAkB,EAAE,oBAAoB;SAC3C;KACJ,CAAC;AACN,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC1B,MAAM,WAAW,GAAG,6EAA6E,CAAC;IAElG,UAAU,CAAC,GAAG,EAAE;QACZ,EAAE,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QACzB,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,MAAM,MAAM,GAAuB;gBAC/B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;aAC7B,CAAC;YAEF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YAExC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7C,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,MAAM,MAAM,GAAuB;gBAC/B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;aAC7B,CAAC;YAEF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YAClD,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,MAAM,CAAC,GAAG,EAAE;gBACR,IAAI,YAAY,CAAC;oBACb,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,OAAO,CAAC,OAAO;iBAC7B,CAAC,CAAC;YACP,CAAC,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAChD,MAAM,CAAC,GAAG,EAAE;gBACR,IAAI,YAAY,CAAC;oBACb,KAAK,EAAE,WAAW;oBAClB,SAAS,EAAE,EAAE;iBAChB,CAAC,CAAC;YACP,CAAC,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACjD,MAAM,CAAC,GAAG,EAAE;gBACR,IAAI,YAAY,CAAC;oBACb,KAAK,EAAE,WAAW;oBAClB,SAAS,EAAE,aAAa;iBAC3B,CAAC,CAAC;YACP,CAAC,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,MAAM,CAAC,GAAG,EAAE;gBACR,IAAI,YAAY,CAAC;oBACb,KAAK,EAAE,WAAW;oBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;oBAC1B,cAAc,EAAE,CAAC,CAAC;iBACrB,CAAC,CAAC;YACP,CAAC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAEvE,IAAI,YAAY,CAAC;gBACb,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;gBAC1B,cAAc,EAAE,IAAI;aACvB,CAAC,CAAC;YAEH,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,uCAAuC,CAAC,CAAC,CAAC;YAEvG,OAAO,CAAC,WAAW,EAAE,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAChD,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;gBAC5B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;gBAC1B,MAAM,EAAE,WAAW;aACtB,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;gBAC5B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;gBAC1B,WAAW,EAAE;oBACT,WAAW,EAAE,iBAAiB;oBAC9B,eAAe,EAAE,iBAAiB;iBACrC;aACJ,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;gBAC5B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;gBAC1B,WAAW,EAAE;oBACT,WAAW,EAAE,iBAAiB;oBAC9B,eAAe,EAAE,iBAAiB;oBAClC,YAAY,EAAE,oBAAoB;iBACrC;aACJ,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAChD,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,QAAQ,CAAC,iBAAiB,CAAC;gBACvB,SAAS,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;aAC3C,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;gBAC5B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;aAC7B,CAAC,CAAC;YAEH,6DAA6D;YAC7D,MAAM,OAAO,GAAG;gBACZ,OAAO,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrC,UAAU,EAAE,EAAE;aACjB,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAEpD,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAClD,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,QAAQ,CAAC,iBAAiB,CAAC;gBACvB,SAAS,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;aAC3C,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;gBAC5B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;gBAC1B,cAAc,EAAE,EAAE;aACrB,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG;gBACb,EAAE,OAAO,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;gBAChC,EAAE,OAAO,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;gBAChC,EAAE,OAAO,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;aACnC,CAAC;YAEF,qFAAqF;YACrF,MAAM,sBAAsB,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChD,GAAG,GAAG;gBACN,UAAU,EAAE,EAAE;aACjB,CAAC,CAAC,CAAC;YAEJ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE3B,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/B,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;YAC1C,mEAAmE;YACnE,MAAM,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,QAAQ,CAAC,iBAAiB,CAAC;gBACvB,SAAS,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,eAAe;aACjD,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;gBAC5B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;aAC7B,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAE1E,MAAM,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,QAAQ,CAAC,iBAAiB,CAAC;gBACvB,SAAS,EAAE,SAAS;aACvB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;gBAC5B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;aAC7B,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAE1E,MAAM,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;QACrG,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,QAAQ,CAAC,iBAAiB,CAAC;gBACvB,SAAS,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;aAC3C,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;gBAC5B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;aAC7B,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG;gBAChB,YAAY,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC1C,UAAU,EAAE,EAAE;aAC8C,CAAC;YAEjE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;YAE5D,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QACzB,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,QAAQ,CAAC,iBAAiB,CAAC;gBACvB,WAAW,EAAE;oBACT,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,uBAAuB;oBAChC,QAAQ,EAAE,aAAa;oBACvB,QAAQ,EAAE,SAAS;iBACtB;aACJ,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;gBAC5B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;aAC7B,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAE7C,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,QAAQ,CAAC,iBAAiB,CAAC;gBACvB,WAAW,EAAE;oBACT,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,UAAU;oBACnB,QAAQ,EAAE,aAAa;oBACvB,QAAQ,EAAE,SAAS;iBACtB;aACJ,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;gBAC5B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;aAC7B,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAE7C,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,QAAQ,CAAC,iBAAiB,CAAC;gBACvB,WAAW,EAAE;oBACT,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,uBAAuB;oBAChC,QAAQ,EAAE,iBAAiB;oBAC3B,QAAQ,EAAE,SAAS;iBACtB;aACJ,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;gBAC5B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;aAC7B,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAE7C,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YAClD,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,QAAQ,CAAC,iBAAiB,CAAC;gBACvB,WAAW,EAAE;oBACT,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,uBAAuB;oBAChC,QAAQ,EAAE,aAAa;oBACvB,QAAQ,EAAE,UAAU;iBACvB;aACJ,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;gBAC5B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;aAC7B,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAE7C,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,QAAQ,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAEnD,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;gBAC5B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;aAC7B,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAE7C,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAE9C,QAAQ,CAAC,iBAAiB,CAAC;gBACvB,WAAW,EAAE,SAAS;aACzB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;gBAC5B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,OAAO,CAAC,OAAO;aAC7B,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAE7C,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/__tests__/setup.d.ts

@@ -0,0 +1,3 @@
+export declare const TEST_KEY_ID = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012";
+export declare const TEST_REGION = "us-east-1";
+//# sourceMappingURL=setup.d.ts.map

package/dist/__tests__/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/__tests__/setup.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,WAAW,gFAAgF,CAAC;AACzG,eAAO,MAAM,WAAW,cAAc,CAAC"}

package/dist/__tests__/setup.js

@@ -0,0 +1,5 @@
+// Test setup for AWS KMS signer tests
+// This file can be used for shared test utilities or setup
+export const TEST_KEY_ID = 'arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012';
+export const TEST_REGION = 'us-east-1';
+//# sourceMappingURL=setup.js.map

package/dist/__tests__/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../src/__tests__/setup.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,2DAA2D;AAE3D,MAAM,CAAC,MAAM,WAAW,GAAG,6EAA6E,CAAC;AACzG,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC"}

package/dist/aws-kms-signer.d.ts

@@ -0,0 +1,52 @@
+import { Address } from '@solana/addresses';
+import { SolanaSigner } from '@solana/keychain-core';
+import { SignableMessage, SignatureDictionary } from '@solana/signers';
+import { Transaction, TransactionWithinSizeLimit, TransactionWithLifetime } from '@solana/transactions';
+import type { AwsKmsSignerConfig } from './types.js';
+/**
+ * AWS KMS-based signer using EdDSA (Ed25519) signing
+ *
+ * The AWS KMS key must be created with:
+ * - Key spec: ECC_NIST_EDWARDS25519
+ * - Key usage: SIGN_VERIFY
+ *
+ * Example AWS CLI command to create a key:
+ * ```bash
+ * aws kms create-key \
+ *   --key-spec ECC_NIST_EDWARDS25519 \
+ *   --key-usage SIGN_VERIFY \
+ *   --description "Solana signing key"
+ * ```
+ */
+export declare class AwsKmsSigner<TAddress extends string = string> implements SolanaSigner<TAddress> {
+    readonly address: Address<TAddress>;
+    private readonly keyId;
+    private readonly client;
+    private readonly requestDelayMs;
+    constructor(config: AwsKmsSignerConfig);
+    /**
+     * Validate request delay ms
+     */
+    private validateRequestDelayMs;
+    /**
+     * Add delay between concurrent requests
+     */
+    private delay;
+    /**
+     * Sign message bytes using AWS KMS EdDSA signing
+     */
+    private signBytes;
+    /**
+     * Sign multiple messages using AWS KMS
+     */
+    signMessages(messages: readonly SignableMessage[]): Promise<readonly SignatureDictionary[]>;
+    /**
+     * Sign multiple transactions using AWS KMS
+     */
+    signTransactions(transactions: readonly (Transaction & TransactionWithinSizeLimit & TransactionWithLifetime)[]): Promise<readonly SignatureDictionary[]>;
+    /**
+     * Check if AWS KMS is available and the key is accessible
+     */
+    isAvailable(): Promise<boolean>;
+}
+//# sourceMappingURL=aws-kms-signer.d.ts.map

package/dist/aws-kms-signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-kms-signer.d.ts","sourceRoot":"","sources":["../src/aws-kms-signer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAmB,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAA8C,YAAY,EAAoB,MAAM,uBAAuB,CAAC;AAEnH,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAExG,OAAO,KAAK,EAAkB,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErE;;;;;;;;;;;;;;GAcG;AACH,qBAAa,YAAY,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM,CAAE,YAAW,YAAY,CAAC,QAAQ,CAAC;IACzF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;gBAE5B,MAAM,EAAE,kBAAkB;IA4CtC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAa9B;;OAEG;YACW,KAAK;IAMnB;;OAEG;YACW,SAAS;IA+CvB;;OAEG;IACG,YAAY,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,GAAG,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC;IAiBjG;;OAEG;IACG,gBAAgB,CAClB,YAAY,EAAE,SAAS,CAAC,WAAW,GAAG,0BAA0B,GAAG,uBAAuB,CAAC,EAAE,GAC9F,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC;IAc1C;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;CAsBxC"}