@soropass/core 0.1.0

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/anchors.ts","../src/internal/encoding.ts","../src/webauthn/createOptions.ts","../src/internal/bytes.ts","../src/internal/cbor.ts","../src/webauthn/authData.ts","../src/webauthn/publicKey.ts","../src/ceremonies/random.ts","../src/ceremonies/browserClient.ts","../src/ceremonies/create.ts","../src/webauthn/clientData.ts","../src/soroban/address.ts","../src/webauthn/signature.ts","../src/webauthn/payload.ts","../src/webauthn/verify.ts","../src/ceremonies/browserSigner.ts","../src/soroban/preimage.ts","../src/soroban/assemble.ts","../src/soroban/smartWallet.ts","../src/soroban/sign.ts","../src/soroban/signer.ts","../src/soroban/checkAuth.ts","../src/adapters/direct.ts","../src/soroban/submit.ts","../src/ceremonies/connect.ts","../src/ceremonies/recover.ts","../src/ceremonies/addDevice.ts","../src/adapters/http.ts","../src/adapters/launchtube.ts","../src/adapters/ozRelayer.ts","../src/adapters/eventsPaging.ts","../src/adapters/events.ts","../src/adapters/mercury.ts","../src/adapters/defaults.ts","../src/adapters/factory.ts","../src/adapters/smartWalletV1.ts"],"names":["sha256","p256","Address","xdr","hash","StrKey","nativeToScVal","Contract","rpc","TransactionBuilder","Keypair","scValToNative","addr","Operation","LEDGERS_PER_DAY"],"mappings":";;;;;;;AAIO,IAAM,eAAA,GAAkB,OAAO,MAAA,CAAO;AAAA,EAC3C,gBAAA;AAAA,EACA,qBAAA;AAAA,EACA,gBAAA;AAAA,EACA,iBAAA;AAAA,EACA,oBAAA;AAAA,EACA,uBAAA;AAAA,EACA,oBAAA;AAAA,EACA,sBAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF,CAAU;AAKH,IAAM,QAAA,GAAN,MAAM,SAAA,SAAiB,KAAA,CAAM;AAAA,EACzB,IAAA;AAAA,EACS,IAAA,GAAO,UAAA;AAAA,EAEzB,WAAA,CAAY,IAAA,EAAoB,OAAA,EAAkB,OAAA,EAA+B;AAC/E,IAAA,KAAA,CAAM,OAAA,IAAW,MAAM,OAAO,CAAA;AAC9B,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAGZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,SAAA,CAAS,SAAS,CAAA;AAAA,EAChD;AACF;AAEO,SAAS,WAAW,KAAA,EAAmC;AAC5D,EAAA,OAAO,KAAA,YAAiB,QAAA;AAC1B;;;AC3BO,IAAM,qBAAA,GAAwB,OAAO,MAAA,CAAO;AAAA;AAAA,EAEjD,mBAAA,EAAqB,qBAAA;AAAA;AAAA,EAErB,eAAA,EAAiB,iBAAA;AAAA;AAAA,EAEjB,kBAAA,EAAoB;AACtB,CAAU;AAKV,IAAM,SAAA,GAAY,EAAA;AAOX,SAAS,YAAY,GAAA,EAAmB;AAC7C,EAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,IAAA,MAAM,IAAI,QAAA,CAAS,qBAAA,EAAuB,CAAA,SAAA,EAAY,GAAG,CAAA,kBAAA,CAAoB,CAAA;AAAA,EAC/E;AACF;AAkBO,SAAS,qBAAqB,UAAA,EAAuC;AAC1E,EAAA,MAAM,EAAA,GACJ,UAAA,IACC,UAAA,CAAW,SAAA,EAAmE,cAAA;AACjF,EAAA,IAAI,EAAA,IAAM,CAAC,EAAA,CAAG,QAAA,EAAU;AACtB,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,gBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACF;;;ACpDO,SAAS,iBAAiB,KAAA,EAA2B;AAC1D,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAC5D,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;AAGO,SAAS,iBAAiB,KAAA,EAAwC;AACvE,EAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACzD,EAAA,MAAM,MAAA,GAAS,SAAS,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,MAAA,CAAO,MAAA,GAAS,KAAM,CAAC,CAAA;AAChE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,MAAM,MAAM,IAAI,UAAA,CAAW,IAAI,WAAA,CAAY,MAAA,CAAO,MAAM,CAAC,CAAA;AACzD,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACvE,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,YAAY,IAAA,EAA0B;AACpD,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA;AACtC;AAEO,SAAS,YAAY,KAAA,EAA2B;AACrD,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA;AACvC;;;ACgBO,SAAS,mBACd,KAAA,EACwC;AACxC,EAAA,MAAM,WAAA,GAAc,MAAM,WAAA,IAAe,UAAA;AACzC,EAAA,OAAO;AAAA,IACL,IAAI,EAAE,EAAA,EAAI,MAAM,IAAA,EAAM,IAAA,EAAM,MAAM,MAAA,EAAO;AAAA,IACzC,IAAA,EAAM;AAAA,MACJ,IAAI,gBAAA,CAAiB,KAAA,CAAM,UAAU,WAAA,CAAY,KAAA,CAAM,QAAQ,CAAC,CAAA;AAAA,MAChE,MAAM,KAAA,CAAM,QAAA;AAAA,MACZ,WAAA,EAAa,KAAA,CAAM,eAAA,IAAmB,KAAA,CAAM;AAAA,KAC9C;AAAA,IACA,SAAA,EAAW,gBAAA,CAAiB,KAAA,CAAM,SAAS,CAAA;AAAA,IAC3C,kBAAkB,CAAC,EAAE,MAAM,YAAA,EAAc,GAAA,EAAK,IAAI,CAAA;AAAA,IAClD,sBAAA,EAAwB;AAAA,MACtB,WAAA;AAAA,MACA,oBAAoB,WAAA,KAAgB,UAAA;AAAA,MACpC,gBAAA,EAAkB,MAAM,gBAAA,IAAoB;AAAA,KAC9C;AAAA,IACA,WAAA,EAAa,MAAA;AAAA,IACb,OAAA,EAAS,MAAM,OAAA,IAAW;AAAA,GAC5B;AACF;;;ACjEO,SAAS,eAAe,MAAA,EAAkC;AAC/D,EAAA,MAAM,KAAA,GAAQ,OAAO,MAAA,CAAO,CAAC,GAAG,CAAA,KAAM,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAC,CAAA;AACrD,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,KAAK,CAAA;AAChC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,IAAA,GAAA,CAAI,GAAA,CAAI,GAAG,MAAM,CAAA;AACjB,IAAA,MAAA,IAAU,CAAA,CAAE,MAAA;AAAA,EACd;AACA,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,UAAA,CAAW,GAAe,CAAA,EAAwB;AAChE,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,IAAK,CAAA,EAAG,IAAA,IAAA,CAAS,CAAA,CAAE,CAAC,CAAA,IAAK,CAAA,KAAM,CAAA,CAAE,CAAC,CAAA,IAAK,CAAA,CAAA;AACrE,EAAA,OAAO,IAAA,KAAS,CAAA;AAClB;;;ACAA,SAAS,MAAA,CAAO,OAAmB,KAAA,EAAuB;AACxD,EAAA,MAAM,KAAA,GAAQ,MAAM,KAAK,CAAA;AACzB,EAAA,IAAI,UAAU,MAAA,EAAW,MAAM,IAAI,KAAA,CAAM,CAAA,sCAAA,EAAyC,KAAK,CAAA,CAAE,CAAA;AACzF,EAAA,OAAO,KAAA;AACT;AAGA,IAAM,SAAA,GAAY,EAAA;AAEX,SAAS,UAAA,CAAW,KAAA,EAAmB,MAAA,GAAS,CAAA,EAAG,QAAQ,CAAA,EAAY;AAC5E,EAAA,IAAI,KAAA,GAAQ,SAAA,EAAW,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAC7E,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,EAAO,MAAM,CAAA;AAClC,EAAA,MAAM,QAAQ,KAAA,IAAS,CAAA;AACvB,EAAA,MAAM,OAAO,KAAA,GAAQ,EAAA;AACrB,EAAA,IAAI,MAAM,MAAA,GAAS,CAAA;AAEnB,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,OAAO,EAAA,EAAI;AACb,IAAA,QAAA,GAAW,IAAA;AAAA,EACb,CAAA,MAAA,IAAW,SAAS,EAAA,EAAI;AACtB,IAAA,QAAA,GAAW,MAAA,CAAO,OAAO,GAAG,CAAA;AAC5B,IAAA,GAAA,IAAO,CAAA;AAAA,EACT,CAAA,MAAA,IAAW,SAAS,EAAA,EAAI;AACtB,IAAA,QAAA,GAAY,MAAA,CAAO,OAAO,GAAG,CAAA,IAAK,IAAK,MAAA,CAAO,KAAA,EAAO,MAAM,CAAC,CAAA;AAC5D,IAAA,GAAA,IAAO,CAAA;AAAA,EACT,CAAA,MAAA,IAAW,SAAS,EAAA,EAAI;AACtB,IAAA,QAAA,GACE,MAAA,CAAO,OAAO,GAAG,CAAA,GAAI,YACpB,MAAA,CAAO,KAAA,EAAO,MAAM,CAAC,CAAA,IAAK,OAC1B,MAAA,CAAO,KAAA,EAAO,MAAM,CAAC,CAAA,IAAK,KAC3B,MAAA,CAAO,KAAA,EAAO,MAAM,CAAC,CAAA;AACvB,IAAA,GAAA,IAAO,CAAA;AAAA,EACT,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mDAAA,EAAsD,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,EAC/E;AAEA,EAAA,QAAQ,KAAA;AAAO,IACb,KAAK,CAAA;AACH,MAAA,OAAO,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAQ,MAAM,MAAA,EAAO;AAAA,IACjD,KAAK,CAAA;AACH,MAAA,OAAO,EAAE,KAAA,EAAO,EAAA,GAAK,QAAA,EAAU,MAAA,EAAQ,MAAM,MAAA,EAAO;AAAA,IACtD,KAAK,CAAA,EAAG;AAEN,MAAA,MAAM,MAAM,GAAA,GAAM,QAAA;AAClB,MAAA,IAAI,MAAM,KAAA,CAAM,MAAA,EAAQ,MAAM,IAAI,MAAM,iCAAiC,CAAA;AACzE,MAAA,OAAO,EAAE,OAAO,KAAA,CAAM,KAAA,CAAM,KAAK,GAAG,CAAA,EAAG,MAAA,EAAQ,GAAA,GAAM,MAAA,EAAO;AAAA,IAC9D;AAAA,IACA,KAAK,CAAA,EAAG;AAEN,MAAA,MAAM,MAAM,GAAA,GAAM,QAAA;AAClB,MAAA,IAAI,MAAM,KAAA,CAAM,MAAA,EAAQ,MAAM,IAAI,MAAM,iCAAiC,CAAA;AACzE,MAAA,OAAO,EAAE,KAAA,EAAO,IAAI,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,KAAA,CAAM,GAAA,EAAK,GAAG,CAAC,CAAA,EAAG,MAAA,EAAQ,MAAM,MAAA,EAAO;AAAA,IACxF;AAAA,IACA,KAAK,CAAA,EAAG;AAEN,MAAA,MAAM,QAAqB,EAAC;AAC5B,MAAA,IAAI,MAAA,GAAS,GAAA;AACb,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,EAAU,KAAK,CAAA,EAAG;AACpC,QAAA,MAAM,IAAA,GAAO,UAAA,CAAW,KAAA,EAAO,MAAA,EAAQ,QAAQ,CAAC,CAAA;AAChD,QAAA,KAAA,CAAM,IAAA,CAAK,KAAK,KAAK,CAAA;AACrB,QAAA,MAAA,IAAU,IAAA,CAAK,MAAA;AAAA,MACjB;AACA,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,SAAS,MAAA,EAAO;AAAA,IACjD;AAAA,IACA,KAAK,CAAA,EAAG;AAEN,MAAA,MAAM,GAAA,uBAAmB,GAAA,EAAI;AAC7B,MAAA,IAAI,MAAA,GAAS,GAAA;AACb,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,EAAU,KAAK,CAAA,EAAG;AACpC,QAAA,MAAM,GAAA,GAAM,UAAA,CAAW,KAAA,EAAO,MAAA,EAAQ,QAAQ,CAAC,CAAA;AAC/C,QAAA,MAAA,IAAU,GAAA,CAAI,MAAA;AACd,QAAA,MAAM,GAAA,GAAM,UAAA,CAAW,KAAA,EAAO,MAAA,EAAQ,QAAQ,CAAC,CAAA;AAC/C,QAAA,MAAA,IAAU,GAAA,CAAI,MAAA;AACd,QAAA,IAAI,OAAO,GAAA,CAAI,KAAA,KAAU,YAAY,OAAO,GAAA,CAAI,UAAU,QAAA,EAAU;AAClE,UAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,QAClD;AACA,QAAA,IAAI,GAAA,CAAI,GAAA,CAAI,GAAA,CAAI,KAAK,CAAA,EAAG;AACtB,UAAA,MAAM,IAAI,MAAM,yCAAyC,CAAA;AAAA,QAC3D;AACA,QAAA,GAAA,CAAI,GAAA,CAAI,GAAA,CAAI,KAAA,EAAO,GAAA,CAAI,KAAK,CAAA;AAAA,MAC9B;AACA,MAAA,OAAO,EAAE,KAAA,EAAO,GAAA,EAAK,MAAA,EAAQ,SAAS,MAAA,EAAO;AAAA,IAC/C;AAAA,IACA;AACE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6BAAA,EAAgC,KAAK,CAAA,CAAE,CAAA;AAAA;AAE7D;AAEO,SAAS,gBAAgB,KAAA,EAA8B;AAC5D,EAAA,OAAO,UAAA,CAAW,KAAA,EAAO,CAAC,CAAA,CAAE,KAAA;AAC9B;;;AC3EA,IAAM,UAAA,GAAa,EAAA;AAGZ,SAAS,uBAAuB,QAAA,EAA+C;AACpF,EAAA,IAAI,QAAA,CAAS,SAAS,UAAA,EAAY;AAChC,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,2BAAA;AAAA,MACA,CAAA,qBAAA,EAAwB,QAAA,CAAS,MAAM,CAAA,0BAAA,EAA6B,UAAU,CAAA;AAAA,KAChF;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,IAAI,QAAA,CAAS,QAAA,CAAS,QAAQ,QAAA,CAAS,UAAA,EAAY,SAAS,UAAU,CAAA;AACnF,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACrC,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,EAAE,CAAA,IAAK,CAAA;AAC7B,EAAA,MAAM,KAAA,GAAgC;AAAA,IACpC,EAAA,EAAA,CAAK,OAAO,CAAA,MAAU,CAAA;AAAA,IACtB,EAAA,EAAA,CAAK,OAAO,CAAA,MAAU,CAAA;AAAA,IACtB,EAAA,EAAA,CAAK,OAAO,CAAA,MAAU,CAAA;AAAA,IACtB,EAAA,EAAA,CAAK,OAAO,EAAA,MAAU,CAAA;AAAA,IACtB,EAAA,EAAA,CAAK,OAAO,EAAA,MAAU,CAAA;AAAA,IACtB,EAAA,EAAA,CAAK,OAAO,GAAA,MAAU,CAAA;AAAA,IACtB;AAAA,GACF;AACA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,CAAU,EAAA,EAAI,KAAK,CAAA;AAE1C,EAAA,MAAM,MAAA,GAAkC,EAAE,QAAA,EAAU,KAAA,EAAO,SAAA,EAAU;AAErE,EAAA,IAAI,MAAM,EAAA,EAAI;AACZ,IAAA,IAAI,QAAA,CAAS,SAAS,EAAA,EAAI;AACxB,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,2BAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAA,CAAO,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA;AACrC,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,SAAA,CAAU,EAAA,EAAI,KAAK,CAAA;AAC7C,IAAA,MAAM,YAAY,EAAA,GAAK,YAAA;AACvB,IAAA,IAAI,QAAA,CAAS,SAAS,SAAA,EAAW;AAC/B,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,2BAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAA,CAAO,YAAA,GAAe,QAAA,CAAS,KAAA,CAAM,EAAA,EAAI,SAAS,CAAA;AAGlD,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,SAAS,CAAA;AACrC,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACrC,IAAA,MAAA,CAAO,mBAAA,GAAsB,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAM,CAAA;AAAA,EACnD;AAEA,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,cAAA,CAAe,UAAsB,IAAA,EAAoB;AACvE,EAAA,MAAM,MAAA,GAAS,sBAAA,CAAuB,QAAQ,CAAA,CAAE,QAAA;AAChD,EAAA,MAAM,QAAA,GAAWA,aAAA,CAAO,WAAA,CAAY,IAAI,CAAC,CAAA;AACzC,EAAA,IAAI,CAAC,UAAA,CAAW,MAAA,EAAQ,QAAQ,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,gBAAA;AAAA,MACA,sDAAsD,IAAI,CAAA,EAAA;AAAA,KAC5D;AAAA,EACF;AACF;;;ACxFA,IAAM,QAAA,GAAW,CAAA;AACjB,IAAM,QAAA,GAAW,CAAA;AACjB,IAAM,QAAA,GAAW,EAAA;AACjB,IAAM,MAAA,GAAS,EAAA;AACf,IAAM,MAAA,GAAS,EAAA;AAEf,IAAM,OAAA,GAAU,CAAA;AAChB,IAAM,QAAA,GAAW,CAAA;AAOV,SAAS,cAAc,OAAA,EAAiC;AAC7D,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,gBAAgB,OAAO,CAAA;AAAA,EACnC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,gCAAA,EAAkC,EAAE,OAAO,CAAA;AAAA,EACtF;AACA,EAAA,IAAI,EAAE,mBAAmB,GAAA,CAAA,EAAM;AAC7B,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,4BAA4B,CAAA;AAAA,EACvE;AACA,EAAA,MAAM,GAAA,GAAM,OAAA;AACZ,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAA;AAC5B,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,MAAM,IAAI,QAAA,CAAS,qBAAA,EAAuB,YAAY,MAAA,CAAO,GAAG,CAAC,CAAA,kBAAA,CAAoB,CAAA;AAAA,EACvF;AACA,EAAA,WAAA,CAAY,GAAG,CAAA;AACf,EAAA,IAAI,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAA,KAAM,OAAA,EAAS;AACjC,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,oBAAA;AAAA,MACA,YAAY,MAAA,CAAO,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAC,CAAC,CAAA,eAAA;AAAA,KACvC;AAAA,EACF;AACA,EAAA,IAAI,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAA,KAAM,QAAA,EAAU;AAClC,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,oBAAA;AAAA,MACA,YAAY,MAAA,CAAO,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAC,CAAC,CAAA,iBAAA;AAAA,KACvC;AAAA,EACF;AACA,EAAA,MAAM,CAAA,GAAI,GAAA,CAAI,GAAA,CAAI,MAAM,CAAA;AACxB,EAAA,MAAM,CAAA,GAAI,GAAA,CAAI,GAAA,CAAI,MAAM,CAAA;AACxB,EAAA,IAAI,EAAE,CAAA,YAAa,UAAA,CAAA,IAAe,CAAA,CAAE,WAAW,EAAA,EAAI;AACjD,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,uCAAuC,CAAA;AAAA,EAClF;AACA,EAAA,IAAI,EAAE,CAAA,YAAa,UAAA,CAAA,IAAe,CAAA,CAAE,WAAW,EAAA,EAAI;AACjD,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,uCAAuC,CAAA;AAAA,EAClF;AACA,EAAA,MAAM,IAAA,GAAO,YAAY,IAAI,UAAA,CAAW,CAAC,CAAI,CAAC,CAAA,EAAG,CAAA,EAAG,CAAC,CAAA;AAErD,EAAA,IAAI;AACF,IAAAC,SAAA,CAAK,KAAA,CAAM,QAAQ,IAAI,CAAA;AAAA,EACzB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,uCAAA,EAAyC,EAAE,OAAO,CAAA;AAAA,EAC7F;AACA,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,6BAA6B,QAAA,EAAkC;AAC7E,EAAA,MAAM,MAAA,GAAS,uBAAuB,QAAQ,CAAA;AAC9C,EAAA,IAAI,CAAC,OAAO,mBAAA,EAAqB;AAC/B,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,oBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,aAAA,CAAc,OAAO,mBAAmB,CAAA;AACjD;AAGO,SAAS,sCAAsC,iBAAA,EAA2C;AAC/F,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,gBAAgB,iBAAiB,CAAA;AAAA,EAC7C,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,yCAAA,EAA2C,EAAE,OAAO,CAAA;AAAA,EAC/F;AACA,EAAA,IAAI,EAAE,mBAAmB,GAAA,CAAA,EAAM;AAC7B,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,qCAAqC,CAAA;AAAA,EAChF;AACA,EAAA,MAAM,QAAA,GAAY,OAAA,CAAoB,GAAA,CAAI,UAAU,CAAA;AACpD,EAAA,IAAI,EAAE,oBAAoB,UAAA,CAAA,EAAa;AACrC,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,+CAA+C,CAAA;AAAA,EAC1F;AACA,EAAA,OAAO,6BAA6B,QAAQ,CAAA;AAC9C;;;ACzFO,SAAS,YAAY,MAAA,EAAyC;AACnE,EAAA,MAAM,YAAY,UAAA,CAAW,MAAA;AAC7B,EAAA,IAAI,OAAO,SAAA,EAAW,eAAA,KAAoB,UAAA,EAAY;AACpD,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,2BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,MAAM,IAAI,UAAA,CAAW,IAAI,WAAA,CAAY,MAAM,CAAC,CAAA;AAClD,EAAA,SAAA,CAAU,gBAAgB,GAAG,CAAA;AAC7B,EAAA,OAAO,GAAA;AACT;;;ACAA,SAAS,WAAW,KAAA,EAA0B;AAC5C,EAAA,IAAI,KAAA,YAAiB,UAAU,OAAO,KAAA;AACtC,EAAA,MAAM,IAAA,GACJ,OAAO,KAAA,KAAU,QAAA,IAAY,UAAU,IAAA,IAAQ,MAAA,IAAU,KAAA,GACpD,KAAA,CAA6B,IAAA,GAC9B,MAAA;AACN,EAAA,IAAI,SAAS,iBAAA,EAAmB;AAC9B,IAAA,OAAO,IAAI,QAAA,CAAS,gBAAA,EAAkB,qCAAqC,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,EAC7F;AACA,EAAA,MAAM,OAAA,GAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,yBAAA;AAGzD,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,KAAS,QAAA,GAAW,GAAG,IAAI,CAAA,EAAA,EAAK,OAAO,CAAA,CAAA,GAAK,OAAA;AAClE,EAAA,OAAO,IAAI,QAAA,CAAS,2BAAA,EAA6B,QAAQ,EAAE,KAAA,EAAO,OAAO,CAAA;AAC3E;AAGO,SAAS,qBAAA,GAAwC;AACtD,EAAA,MAAM,WAAA,GAAe,WAAyC,SAAA,EAAW,WAAA;AACzE,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,IAAI,QAAA,CAAS,2BAAA,EAA6B,sCAAsC,CAAA;AAAA,EACxF;AACA,EAAA,OAAO;AAAA,IACL,MAAM,OAAO,OAAA,EAAgF;AAC3F,MAAA,MAAM,SAAA,GAAgD;AAAA,QACpD,SAAA,EAAW,gBAAA,CAAiB,OAAA,CAAQ,SAAS,CAAA;AAAA,QAC7C,IAAI,OAAA,CAAQ,EAAA;AAAA,QACZ,IAAA,EAAM;AAAA,UACJ,EAAA,EAAI,gBAAA,CAAiB,OAAA,CAAQ,IAAA,CAAK,EAAE,CAAA;AAAA,UACpC,IAAA,EAAM,QAAQ,IAAA,CAAK,IAAA;AAAA,UACnB,WAAA,EAAa,QAAQ,IAAA,CAAK;AAAA,SAC5B;AAAA,QACA,kBAAkB,OAAA,CAAQ,gBAAA;AAAA,QAC1B,wBAAwB,OAAA,CAAQ,sBAAA;AAAA,QAChC,aAAa,OAAA,CAAQ,WAAA;AAAA,QACrB,SAAS,OAAA,CAAQ;AAAA,OACnB;AACA,MAAA,IAAI,UAAA;AACJ,MAAA,IAAI;AACF,QAAA,UAAA,GAAc,MAAM,WAAA,CAAY,MAAA,CAAO,EAAE,WAAW,CAAA;AAAA,MACtD,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,WAAW,KAAK,CAAA;AAAA,MACxB;AACA,MAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,QAAA,CAAS,kBAAkB,mCAAmC,CAAA;AACzF,MAAA,MAAM,WAAW,UAAA,CAAW,QAAA;AAC5B,MAAA,OAAO;AAAA,QACL,IAAI,UAAA,CAAW,EAAA;AAAA,QACf,KAAA,EAAO,IAAI,UAAA,CAAW,UAAA,CAAW,KAAK,CAAA;AAAA,QACtC,iBAAA,EAAmB,IAAI,UAAA,CAAW,QAAA,CAAS,iBAAiB;AAAA,OAC9D;AAAA,IACF,CAAA;AAAA,IACA,MAAM,IAAI,OAAA,EAAyD;AACjE,MAAA,MAAM,SAAA,GAA+C;AAAA,QACnD,MAAM,OAAA,CAAQ,IAAA;AAAA,QACd,SAAA,EAAW,QAAQ,SAAA,GAAY,IAAI,WAAW,OAAA,CAAQ,SAAS,CAAA,GAAI,WAAA,CAAY,EAAE,CAAA;AAAA,QACjF,mBAAmB,OAAA,CAAQ,gBAAA,IAAoB,EAAC,EAAG,GAAA,CAAI,CAAC,EAAA,MAAQ;AAAA,UAC9D,IAAA,EAAM,YAAA;AAAA,UACN,EAAA,EAAI,iBAAiB,EAAE;AAAA,SACzB,CAAE,CAAA;AAAA,QACF,kBAAkB,OAAA,CAAQ;AAAA,OAC5B;AACA,MAAA,MAAM,OAAA,GAAoC,EAAE,SAAA,EAAU;AACtD,MAAA,IAAI,OAAA,CAAQ,SAAA,EAAW,OAAA,CAAQ,SAAA,GAAY,OAAA,CAAQ,SAAA;AACnD,MAAA,IAAI,UAAA;AACJ,MAAA,IAAI;AACF,QAAA,UAAA,GAAc,MAAM,WAAA,CAAY,GAAA,CAAI,OAAO,CAAA;AAAA,MAC7C,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,WAAW,KAAK,CAAA;AAAA,MACxB;AACA,MAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,QAAA,CAAS,kBAAkB,yBAAyB,CAAA;AAC/E,MAAA,MAAM,WAAW,UAAA,CAAW,QAAA;AAC5B,MAAA,OAAO;AAAA,QACL,IAAI,UAAA,CAAW,EAAA;AAAA,QACf,KAAA,EAAO,IAAI,UAAA,CAAW,UAAA,CAAW,KAAK,CAAA;AAAA,QACtC,iBAAA,EAAmB,IAAI,UAAA,CAAW,QAAA,CAAS,iBAAiB,CAAA;AAAA,QAC5D,cAAA,EAAgB,IAAI,UAAA,CAAW,QAAA,CAAS,cAAc,CAAA;AAAA,QACtD,SAAA,EAAW,IAAI,UAAA,CAAW,QAAA,CAAS,SAAS;AAAA,OAC9C;AAAA,IACF;AAAA,GACF;AACF;AAGO,SAAS,wBAAA,GAA8C;AAC5D,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAyB,CAAA,gBAAA,EAAmB,IAAI,CAAA,CAAA;AAC7D,EAAA,MAAM,KAAM,UAAA,CAA0C,YAAA;AACtD,EAAA,IAAI,EAAA,EAAI;AACN,IAAA,OAAO;AAAA,MACL,KAAK,CAAC,IAAA,KAAS,GAAG,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAC,CAAA;AAAA,MACnC,GAAA,EAAK,CAAC,IAAA,EAAM,YAAA,KAAiB;AAC3B,QAAA,EAAA,CAAG,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,EAAG,YAAY,CAAA;AAAA,MACpC;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAoB;AACvC,EAAA,OAAO;AAAA,IACL,KAAK,CAAC,IAAA,KAAS,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA,IAAK,IAAA;AAAA,IACnC,GAAA,EAAK,CAAC,IAAA,EAAM,YAAA,KAAiB;AAC3B,MAAA,MAAA,CAAO,GAAA,CAAI,MAAM,YAAY,CAAA;AAAA,IAC/B;AAAA,GACF;AACF;;;AC7EA,eAAsB,gBAAgB,OAAA,EAA6D;AACjG,EAAA,oBAAA,CAAqB,QAAQ,cAAc,CAAA;AAC3C,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAY,qBAAA,EAAsB;AAE3D,EAAA,MAAM,kBAAkB,kBAAA,CAAmB;AAAA,IACzC,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,SAAA,EAAW,OAAA,CAAQ,SAAA,IAAa,WAAA,CAAY,EAAE,CAAA;AAAA,IAC9C,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,kBAAkB,OAAA,CAAQ;AAAA,GAC3B,CAAA;AAED,EAAA,MAAM,UAAA,GAAa,MAAM,QAAA,CAAS,MAAA,CAAO,eAAe,CAAA;AAExD,EAAA,MAAM,SAAA,GAAY,qCAAA,CAAsC,UAAA,CAAW,iBAAiB,CAAA;AACpF,EAAA,OAAO,EAAE,YAAA,EAAc,UAAA,CAAW,EAAA,EAAI,SAAA,EAAU;AAClD;AAOA,eAAsB,cAAc,OAAA,EAA2D;AAC7F,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,wBAAA,EAAyB;AAC5D,EAAA,MAAM,EAAE,YAAA,EAAc,SAAA,EAAU,GAAI,MAAM,gBAAgB,OAAO,CAAA;AACjE,EAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAA,CAAQ,SAAS,MAAA,CAAO,EAAE,SAAA,EAAW,YAAA,EAAc,CAAA;AAChF,EAAA,OAAA,CAAQ,GAAA,CAAI,OAAA,CAAQ,IAAA,EAAM,YAAY,CAAA;AACtC,EAAA,OAAO,EAAE,UAAA,EAAY,YAAA,EAAc,SAAA,EAAU;AAC/C;;;AC5DO,SAAS,gBAAgB,SAAA,EAA+B;AAC7D,EAAA,OAAO,iBAAiB,SAAS,CAAA;AACnC;AAGO,SAAS,gBAAgB,SAAA,EAA+B;AAC7D,EAAA,OAAO,iBAAiB,SAAS,CAAA;AACnC;AAGO,SAAS,oBAAoB,cAAA,EAAwC;AAC1E,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,WAAA,CAAY,cAAc,CAAC,CAAA;AAAA,EAC9C,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,QAAA,CAAS,2BAAA,EAA6B,kCAAA,EAAoC,EAAE,OAAO,CAAA;AAAA,EAC/F;AACA,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,EAAM;AAC3C,IAAA,MAAM,IAAI,QAAA,CAAS,2BAAA,EAA6B,qCAAqC,CAAA;AAAA,EACvF;AACA,EAAA,MAAM,GAAA,GAAM,GAAA;AACZ,EAAA,MAAM,EAAE,IAAA,EAAM,SAAA,EAAW,MAAA,EAAQ,aAAY,GAAI,GAAA;AACjD,EAAA,IAAI,OAAO,SAAS,QAAA,IAAY,OAAO,cAAc,QAAA,IAAY,OAAO,WAAW,QAAA,EAAU;AAC3F,IAAA,MAAM,IAAI,QAAA,CAAS,2BAAA,EAA6B,2CAA2C,CAAA;AAAA,EAC7F;AACA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAA;AAAA,IACA,WAAA,EAAa,OAAO,WAAA,KAAgB,SAAA,GAAY,WAAA,GAAc;AAAA,GAChE;AACF;AAOO,SAAS,oBAAA,CACd,gBACA,QAAA,EACY;AACZ,EAAA,MAAM,IAAA,GAAO,oBAAoB,cAAc,CAAA;AAC/C,EAAA,IAAI,IAAA,CAAK,SAAS,cAAA,EAAgB;AAChC,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,2BAAA;AAAA,MACA,CAAA,qBAAA,EAAwB,KAAK,IAAI,CAAA,uBAAA;AAAA,KACnC;AAAA,EACF;AACA,EAAA,MAAM,OAAA,GAAU,KAAA,CAAM,OAAA,CAAQ,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,MAAA,GAAS,CAAC,QAAA,CAAS,MAAM,CAAA;AACnF,EAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,CAAS,IAAA,CAAK,MAAM,CAAA,EAAG;AAClC,IAAA,MAAM,IAAI,QAAA,CAAS,iBAAA,EAAmB,CAAA,QAAA,EAAW,IAAA,CAAK,MAAM,CAAA,UAAA,EAAa,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,IAAA,CAAK,SAAA,KAAc,QAAA,CAAS,SAAA,EAAW;AACzC,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,kDAAkD,CAAA;AAAA,EAC7F;AACA,EAAA,OAAO,IAAA;AACT;;;AChEA,SAAS,0BAAA,CACP,QAAA,EACA,IAAA,EACA,iBAAA,EACQ;AACR,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAUC,kBAAA,CAAQ,UAAA,CAAW,QAAQ,CAAA,CAAE,WAAA,EAAY;AAAA,EACrD,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,SAAS,sBAAA,EAAwB,CAAA,0BAAA,EAA6B,QAAQ,CAAA,CAAA,CAAA,EAAK,EAAE,OAAO,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,QAAA,GAAWC,eAAI,cAAA,CAAe,sBAAA;AAAA,IAClC,IAAIA,eAAI,wBAAA,CAAyB;AAAA,MAC/B,SAAA,EAAWC,eAAA,CAAK,MAAA,CAAO,IAAA,CAAK,iBAAiB,CAAC,CAAA;AAAA,MAC9C,kBAAA,EAAoBD,eAAI,kBAAA,CAAmB,6BAAA;AAAA,QACzC,IAAIA,eAAI,6BAAA,CAA8B;AAAA,UACpC,OAAA;AAAA,UACA,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAI;AAAA,SACvB;AAAA;AACH,KACD;AAAA,GACH;AACA,EAAA,OAAOE,kBAAO,cAAA,CAAeD,eAAA,CAAK,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AACrD;AAkBO,SAAS,qBAAqB,OAAA,EAA8C;AACjF,EAAA,MAAM,EAAE,iBAAA,EAAmB,YAAA,EAAc,iBAAA,EAAkB,GAAI,OAAA;AAC/D,EAAA,IAAI,YAAA,CAAa,WAAW,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,2CAA2C,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,0BAAA;AAAA,IACL,iBAAA;AAAA,IACAA,eAAA,CAAK,MAAA,CAAO,IAAA,CAAK,YAAY,CAAC,CAAA;AAAA;AAAA,IAC9B;AAAA,GACF;AACF;AAyBO,SAAS,yBAAyB,OAAA,EAAkD;AACzF,EAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,OAAA,CAAQ,YAAY,CAAA;AAChD,EAAA,IAAI,GAAA,CAAI,WAAW,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,+CAA+C,CAAA;AAAA,EAC5F;AACA,EAAA,OAAO,2BAA2B,OAAA,CAAQ,QAAA,EAAUJ,cAAO,GAAG,CAAA,EAAG,QAAQ,iBAAiB,CAAA;AAC5F;ACpFA,IAAM,cAAA,GAAiB,EAAA;AAUhB,SAAS,aAAa,GAAA,EAA6B;AACxD,EAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC/B,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,uBAAA;AAAA,MACA,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,oBAAA,EAAuB,cAAc,CAAA;AAAA,KACrE;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,OAAOC,SAAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,GAAG,EAAE,iBAAA,EAAkB;AAAA,EACvD,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,QAAA,CAAS,uBAAA,EAAyB,+BAAA,EAAiC,EAAE,OAAO,CAAA;AAAA,EACxF;AACF;AAEA,SAAS,oBAAoB,gBAAA,EAAoC;AAC/D,EAAA,IAAI,gBAAA,CAAiB,WAAW,EAAA,EAAI;AAClC,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,uBAAA;AAAA,MACA,CAAA,wCAAA,EAA2C,iBAAiB,MAAM,CAAA;AAAA,KACpE;AAAA,EACF;AACF;AAGO,SAAS,OAAO,gBAAA,EAAuC;AAC5D,EAAA,mBAAA,CAAoB,gBAAgB,CAAA;AACpC,EAAA,OAAO,CAACA,SAAAA,CAAK,SAAA,CAAU,WAAA,CAAY,gBAAgB,EAAE,QAAA,EAAS;AAChE;AASO,SAAS,cAAc,gBAAA,EAA0C;AACtE,EAAA,mBAAA,CAAoB,gBAAgB,CAAA;AACpC,EAAA,OAAOA,UAAK,SAAA,CAAU,WAAA,CAAY,gBAAgB,CAAA,CAAE,UAAA,GAAa,iBAAA,EAAkB;AACrF;AAGO,SAAS,iBAAiB,GAAA,EAA6B;AAC5D,EAAA,OAAO,aAAA,CAAc,YAAA,CAAa,GAAG,CAAC,CAAA;AACxC;;;ACjDO,SAAS,yBAAyB,KAAA,EAG1B;AACb,EAAA,MAAM,cAAA,GAAiBD,aAAA,CAAO,KAAA,CAAM,cAAc,CAAA;AAClD,EAAA,OAAOA,aAAA,CAAO,WAAA,CAAY,KAAA,CAAM,iBAAA,EAAmB,cAAc,CAAC,CAAA;AACpE;ACIO,SAAS,yBAAyB,KAAA,EAAsC;AAC7E,EAAA,MAAM,OAAA,GAAU,yBAAyB,KAAK,CAAA;AAC9C,EAAA,MAAM,OAAA,GAAU,MAAM,SAAA,CAAU,MAAA,KAAW,KAAK,KAAA,CAAM,SAAA,GAAY,YAAA,CAAa,KAAA,CAAM,SAAS,CAAA;AAG9F,EAAA,OAAOC,SAAAA,CAAK,MAAA,CAAO,OAAA,EAAS,OAAA,EAAS,KAAA,CAAM,SAAA,EAAW,EAAE,IAAA,EAAM,KAAA,EAAO,MAAA,EAAQ,SAAA,EAAW,CAAA;AAC1F;;;ACQO,SAAS,qBAAqB,OAAA,EAAsD;AACzF,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAY,qBAAA,EAAsB;AAC3D,EAAA,OAAO,OAAO,SAAA,KAAgD;AAC5D,IAAA,MAAM,SAAA,GAAY,MAAM,QAAA,CAAS,GAAA,CAAI;AAAA,MACnC,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,SAAA,EAAW,iBAAiB,SAAS,CAAA;AAAA,MACrC,gBAAA,EAAkB,OAAA,CAAQ,gBAAA,IAAoB,EAAC;AAAA,MAC/C,gBAAA,EAAkB,QAAQ,gBAAA,IAAoB;AAAA,KAC/C,CAAA;AACD,IAAA,OAAO;AAAA,MACL,mBAAmB,SAAA,CAAU,iBAAA;AAAA,MAC7B,gBAAgB,SAAA,CAAU,cAAA;AAAA,MAC1B,WAAW,SAAA,CAAU,SAAA;AAAA,MACrB,cAAc,SAAA,CAAU;AAAA,KAC1B;AAAA,EACF,CAAA;AACF;ACtCO,SAAS,uBAAA,CACd,OACA,iBAAA,EACY;AACZ,EAAA,MAAM,WAAA,GAAc,MAAM,WAAA,EAAY;AACtC,EAAA,IAAI,WAAA,CAAY,MAAA,EAAO,CAAE,IAAA,KAAS,2BAAA,EAA6B;AAC7D,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,+CAA+C,CAAA;AAAA,EAC5F;AACA,EAAA,MAAM,OAAA,GAAU,YAAY,OAAA,EAAQ;AACpC,EAAA,MAAM,QAAA,GAAWE,eAAI,cAAA,CAAe,gCAAA;AAAA,IAClC,IAAIA,eAAI,kCAAA,CAAmC;AAAA,MACzC,SAAA,EAAW,MAAA,CAAO,IAAA,CAAKC,eAAAA,CAAK,MAAA,CAAO,KAAK,WAAA,CAAY,iBAAiB,CAAC,CAAC,CAAC,CAAA;AAAA,MACxE,KAAA,EAAO,QAAQ,KAAA,EAAM;AAAA,MACrB,yBAAA,EAA2B,QAAQ,yBAAA,EAA0B;AAAA,MAC7D,UAAA,EAAY,MAAM,cAAA;AAAe,KAClC;AAAA,GACH;AACA,EAAA,OAAO,IAAI,UAAA,CAAWA,eAAAA,CAAK,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AAC9C;AAGO,SAAS,kBAAA,CACd,OACA,iBAAA,EACQ;AACR,EAAA,OAAO,gBAAA,CAAiB,uBAAA,CAAwB,KAAA,EAAO,iBAAiB,CAAC,CAAA;AAC3E;ACtBO,SAAS,qBAAA,CACd,OACA,SAAA,EAC+B;AAC/B,EAAA,KAAA,CAAM,aAAY,CAAE,OAAA,GAAU,SAAA,CAAU,mBAAA,CAAoB,SAAS,CAAC,CAAA;AACtE,EAAA,OAAO,KAAA;AACT;AAGO,SAAS,oBAAoB,SAAA,EAAuC;AACzE,EAAA,OAAOD,cAAAA,CAAI,MAAM,MAAA,CAAO;AAAA,IACtB,UAAA,CAAW,oBAAA,EAAsB,SAAA,CAAU,iBAAiB,CAAA;AAAA,IAC5D,UAAA,CAAW,kBAAA,EAAoB,SAAA,CAAU,cAAc,CAAA;AAAA,IACvD,UAAA,CAAW,WAAA,EAAa,SAAA,CAAU,SAAS;AAAA,GAC5C,CAAA;AACH;AAEA,SAAS,UAAA,CAAW,MAAc,KAAA,EAAmC;AACnE,EAAA,OAAO,IAAIA,eAAI,UAAA,CAAW;AAAA,IACxB,GAAA,EAAKA,cAAAA,CAAI,KAAA,CAAM,SAAA,CAAU,IAAI,CAAA;AAAA,IAC7B,KAAKA,cAAAA,CAAI,KAAA,CAAM,SAAS,MAAA,CAAO,IAAA,CAAK,KAAK,CAAC;AAAA,GAC3C,CAAA;AACH;ACdO,SAAS,oBAAoB,YAAA,EAAqC;AACvE,EAAA,OAAOA,cAAAA,CAAI,MAAM,MAAA,CAAO;AAAA,IACtBA,cAAAA,CAAI,KAAA,CAAM,SAAA,CAAU,WAAW,CAAA;AAAA,IAC/BA,eAAI,KAAA,CAAM,QAAA,CAAS,MAAA,CAAO,IAAA,CAAK,YAAY,CAAC;AAAA,GAC7C,CAAA;AACH;AAGO,SAAS,iCAAiC,SAAA,EAAuC;AACtF,EAAA,OAAOA,cAAAA,CAAI,KAAA,CAAM,MAAA,CAAO,CAACA,cAAAA,CAAI,KAAA,CAAM,SAAA,CAAU,WAAW,CAAA,EAAG,mBAAA,CAAoB,SAAS,CAAC,CAAC,CAAA;AAC5F;AAEA,SAAS,mBAAmB,GAAA,EAA0D;AACpF,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,EAAI;AACpB,EAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,MAAA,GAAS,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,4CAA4C,CAAA;AAAA,EACzF;AACA,EAAA,MAAM,UAAU,GAAA,CAAI,CAAC,CAAA,CAAG,GAAA,GAAM,QAAA,EAAS;AACvC,EAAA,MAAM,EAAA,GAAK,IAAI,CAAC,CAAA;AAGhB,EAAA,MAAM,UACJ,EAAA,CAAG,MAAA,EAAO,CAAE,IAAA,KAAS,aAAa,IAAI,UAAA,CAAW,EAAA,CAAG,KAAA,EAAO,CAAA,GAAI,IAAI,UAAA,CAAW,EAAA,CAAG,OAAO,CAAA;AAC1F,EAAA,OAAO,EAAE,SAAS,OAAA,EAAQ;AAC5B;AAEA,SAAS,YAAA,CAAa,GAAe,CAAA,EAAuB;AAC1D,EAAA,MAAM,IAAI,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,MAAA,EAAQ,EAAE,MAAM,CAAA;AACrC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,IAAI,CAAA,CAAE,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,CAAA,EAAG,OAAO,CAAA,CAAE,CAAC,CAAA,GAAK,CAAA,CAAE,CAAC,IAAK,EAAA,GAAK,CAAA;AAAA,EACjD;AACA,EAAA,OAAO,CAAA,CAAE,SAAS,CAAA,CAAE,MAAA;AACtB;AAgBO,SAAS,qBAAA,CAAsB,GAAc,CAAA,EAAsB;AACxE,EAAA,MAAM,EAAA,GAAK,mBAAmB,CAAC,CAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,mBAAmB,CAAC,CAAA;AAC/B,EAAA,IAAI,EAAA,CAAG,YAAY,EAAA,CAAG,OAAA,SAAgB,EAAA,CAAG,OAAA,GAAU,EAAA,CAAG,OAAA,GAAU,EAAA,GAAK,CAAA;AACrE,EAAA,OAAO,YAAA,CAAa,EAAA,CAAG,OAAA,EAAS,EAAA,CAAG,OAAO,CAAA;AAC5C;AAaO,SAAS,gCAAA,CACd,OACA,SAAA,EAC+B;AAC/B,EAAA,MAAM,WAAA,GAAc,MAAM,WAAA,EAAY;AACtC,EAAA,IAAI,WAAA,CAAY,MAAA,EAAO,CAAE,IAAA,KAAS,2BAAA,EAA6B;AAC7D,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,+CAA+C,CAAA;AAAA,EAC5F;AACA,EAAA,MAAM,GAAA,GAAM,mBAAA,CAAoB,SAAA,CAAU,YAAY,CAAA;AACtD,EAAA,MAAM,QAAA,GAAW,IAAIA,cAAAA,CAAI,UAAA,CAAW,EAAE,KAAK,GAAA,EAAK,gCAAA,CAAiC,SAAS,CAAA,EAAG,CAAA;AAE7F,EAAA,MAAM,OAAA,GAAU,WAAA,CAAY,OAAA,EAAQ,CAAE,SAAA,EAAU;AAChD,EAAA,IAAI,UAAA;AACJ,EAAA,QAAQ,OAAA,CAAQ,MAAA,EAAO,CAAE,IAAA;AAAM,IAC7B,KAAK,SAAA;AACH,MAAA,UAAA,GAAa,CAAC,QAAQ,CAAA;AACtB,MAAA;AAAA,IACF,KAAK,QAAA,EAAU;AAEb,MAAA,MAAM,QAAA,GAAW,QAAQ,GAAA,EAAI,GAAI,CAAC,CAAA,EAAG,GAAA,MAAS,EAAC;AAC/C,MAAA,UAAA,GAAa,QAAA,CAAS,MAAA,CAAO,CAAC,CAAA,KAAM,qBAAA,CAAsB,EAAE,GAAA,EAAI,EAAG,GAAG,CAAA,KAAM,CAAC,CAAA;AAC7E,MAAA,UAAA,CAAW,KAAK,QAAQ,CAAA;AACxB,MAAA;AAAA,IACF;AAAA,IACA;AACE,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,sBAAA;AAAA,QACA;AAAA,OACF;AAAA;AAEJ,EAAA,UAAA,CAAW,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,qBAAA,CAAsB,CAAA,CAAE,GAAA,EAAI,EAAG,CAAA,CAAE,GAAA,EAAK,CAAC,CAAA;AACjE,EAAA,WAAA,CAAY,OAAA,EAAQ,CAAE,SAAA,CAAUA,cAAAA,CAAI,KAAA,CAAM,MAAA,CAAO,CAACA,cAAAA,CAAI,KAAA,CAAM,MAAA,CAAO,UAAU,CAAC,CAAC,CAAC,CAAA;AAChF,EAAA,OAAO,KAAA;AACT;;;AC/CA,SAAS,kBAAA,CACP,SAAA,EACA,SAAA,EACA,MAAA,EACM;AAEN,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI,MAAA,CAAO,WAAW,MAAA,EAAW;AAC/B,IAAA,UAAA,GAAa,oBAAA,CAAqB,UAAU,cAAA,EAAgB;AAAA,MAC1D,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf;AAAA,KACD,CAAA;AAAA,EACH,CAAA,MAAO;AACL,IAAA,UAAA,GAAa,mBAAA,CAAoB,UAAU,cAAc,CAAA;AACzD,IAAA,IAAI,UAAA,CAAW,SAAS,cAAA,EAAgB;AACtC,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,2BAAA;AAAA,QACA,CAAA,qBAAA,EAAwB,WAAW,IAAI,CAAA,uBAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,IAAI,UAAA,CAAW,cAAc,SAAA,EAAW;AACtC,MAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,mDAAmD,CAAA;AAAA,IAC9F;AAAA,EACF;AACA,EAAA,IAAI,UAAA,CAAW,WAAA,KAAgB,IAAA,IAAQ,CAAC,OAAO,gBAAA,EAAkB;AAC/D,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,iBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,sBAAA,CAAuB,SAAA,CAAU,iBAAiB,CAAA;AACjE,EAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,EAAA,EAAI;AACpB,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,2BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,uBAAA,IAA2B,CAAC,MAAA,CAAO,MAAM,EAAA,EAAI;AACtD,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,2BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,SAAS,MAAA,EAAW;AAC7B,IAAA,cAAA,CAAe,SAAA,CAAU,iBAAA,EAAmB,MAAA,CAAO,IAAI,CAAA;AAAA,EACzD;AACA,EAAA,IAAI,MAAA,CAAO,cAAc,MAAA,EAAW;AAClC,IAAA,MAAM,KAAK,wBAAA,CAAyB;AAAA,MAClC,WAAW,MAAA,CAAO,SAAA;AAAA,MAClB,mBAAmB,SAAA,CAAU,iBAAA;AAAA,MAC7B,gBAAgB,SAAA,CAAU,cAAA;AAAA,MAC1B,WAAW,SAAA,CAAU;AAAA,KACtB,CAAA;AACD,IAAA,IAAI,CAAC,EAAA,EAAI;AACP,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,sBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,gBAAA,CACb,OACA,OAAA,EACe;AAGf,EAAA,IAAI,OAAA,CAAQ,8BAA8B,MAAA,EAAW;AACnD,IAAA,MAAM,KAAA,GAAQ,MAAM,WAAA,EAAY;AAChC,IAAA,IAAI,KAAA,CAAM,MAAA,EAAO,CAAE,IAAA,KAAS,2BAAA,EAA6B;AACvD,MAAA,KAAA,CAAM,OAAA,EAAQ,CAAE,yBAAA,CAA0B,OAAA,CAAQ,yBAAyB,CAAA;AAAA,IAC7E;AAAA,EACF;AACA,EAAA,MAAM,SAAA,GAAY,kBAAA,CAAmB,KAAA,EAAO,OAAA,CAAQ,iBAAiB,CAAA;AACrE,EAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA;AAC9C,EAAA,IAAI,QAAQ,MAAA,EAAQ,kBAAA,CAAmB,SAAA,EAAW,SAAA,EAAW,QAAQ,MAAM,CAAA;AAC3E,EAAA,MAAM,SAAA,GACJ,UAAU,SAAA,CAAU,MAAA,KAAW,KAAK,SAAA,CAAU,SAAA,GAAY,gBAAA,CAAiB,SAAA,CAAU,SAAS,CAAA;AAChG,EAAA,MAAM,UAAA,GAAa;AAAA,IACjB,cAAc,SAAA,CAAU,YAAA;AAAA,IACxB,mBAAmB,SAAA,CAAU,iBAAA;AAAA,IAC7B,gBAAgB,SAAA,CAAU,cAAA;AAAA,IAC1B;AAAA,GACF;AACA,EAAA,IAAI,OAAA,CAAQ,WAAW,cAAA,EAAgB;AACrC,IAAA,gCAAA,CAAiC,OAAO,UAAU,CAAA;AAAA,EACpD,CAAA,MAAO;AACL,IAAA,qBAAA,CAAsB,OAAO,UAAU,CAAA;AAAA,EACzC;AACF;AAOA,eAAsB,aAAA,CACpB,UACA,OAAA,EACiB;AACjB,EAAA,MAAM,KAAA,GAAQA,cAAAA,CAAI,yBAAA,CAA0B,OAAA,CAAQ,UAAU,QAAQ,CAAA;AACtE,EAAA,MAAM,gBAAA,CAAiB,OAAO,OAAO,CAAA;AACrC,EAAA,OAAO,KAAA,CAAM,MAAM,QAAQ,CAAA;AAC7B;AAQA,SAAS,qBAAqB,QAAA,EAAoD;AAChF,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,MAAA,EAAO,CAAE,IAAA;AAC/B,EAAA,IAAI,IAAA,KAAS,kBAAkB,OAAO,QAAA,CAAS,IAAG,CAAE,EAAA,GAAK,UAAA,EAAW;AACpE,EAAA,IAAI,SAAS,uBAAA,EAAyB;AACpC,IAAA,MAAM,QAAQ,QAAA,CAAS,OAAA,EAAQ,CAAE,EAAA,GAAK,OAAA,EAAQ;AAC9C,IAAA,IAAI,KAAA,CAAM,MAAA,EAAO,CAAE,IAAA,KAAS,gBAAA,EAAkB;AAC5C,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,sBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,KAAA,CAAM,EAAA,EAAG,CAAE,EAAA,GAAK,UAAA,EAAW;AAAA,EACpC;AACA,EAAA,MAAM,IAAI,QAAA;AAAA,IACR,sBAAA;AAAA,IACA,+CAA+C,IAAI,CAAA,2BAAA;AAAA,GACrD;AACF;AAOA,eAAsB,eAAA,CAAgB,OAAe,OAAA,EAA8C;AACjG,EAAA,MAAM,QAAA,GAAWA,cAAAA,CAAI,mBAAA,CAAoB,OAAA,CAAQ,OAAO,QAAQ,CAAA;AAChE,EAAA,KAAA,MAAW,EAAA,IAAM,oBAAA,CAAqB,QAAQ,CAAA,EAAG;AAC/C,IAAA,IAAI,GAAG,IAAA,EAAK,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAA,EAAsB;AACtD,IAAA,MAAM,UAAU,EAAA,CAAG,IAAA,EAAK,CAAE,oBAAA,GAAuB,IAAA,EAAK;AACtD,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,IAAI,MAAM,WAAA,EAAY,CAAE,MAAA,EAAO,CAAE,SAAS,2BAAA,EAA6B;AACvE,MAAA,MAAM,gBAAA,CAAiB,OAAO,OAAO,CAAA;AAAA,IACvC;AAAA,EACF;AACA,EAAA,OAAO,QAAA,CAAS,MAAM,QAAQ,CAAA;AAChC;ACpLA,SAAS,SAAA,GAAuB;AAC9B,EAAA,OAAOA,cAAAA,CAAI,MAAM,MAAA,CAAO,CAACA,eAAI,KAAA,CAAM,OAAA,EAAS,CAAC,CAAA;AAC/C;AAGA,SAAS,gBAAgB,UAAA,EAAyC;AAChE,EAAA,IAAI,UAAA,KAAe,MAAA,EAAW,OAAO,SAAA,EAAU;AAC/C,EAAA,MAAM,EAAA,GAAK,OAAO,UAAU,CAAA;AAC5B,EAAA,IAAI,KAAK,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,sBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAOA,cAAAA,CAAI,KAAA,CAAM,MAAA,CAAO,CAACG,wBAAA,CAAc,EAAA,EAAI,EAAE,IAAA,EAAM,KAAA,EAAO,CAAC,CAAC,CAAA;AAC9D;AAGA,SAAS,YAAA,CAAa,UAAyB,YAAA,EAAyB;AACtE,EAAA,OAAOH,cAAAA,CAAI,MAAM,MAAA,CAAO,CAACA,eAAI,KAAA,CAAM,SAAA,CAAU,OAAO,CAAC,CAAC,CAAA;AACxD;AAQO,SAAS,qBAAqB,IAAA,EAAsC;AACzE,EAAA,IAAI,IAAA,CAAK,YAAA,CAAa,MAAA,KAAW,CAAA,EAAG;AAClC,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,2CAA2C,CAAA;AAAA,EACxF;AACA,EAAA,IAAI,IAAA,CAAK,UAAU,MAAA,KAAW,EAAA,IAAM,KAAK,SAAA,CAAU,CAAC,MAAM,CAAA,EAAM;AAC9D,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,oBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAOA,cAAAA,CAAI,MAAM,MAAA,CAAO;AAAA,IACtBA,cAAAA,CAAI,KAAA,CAAM,SAAA,CAAU,WAAW,CAAA;AAAA,IAC/BA,eAAI,KAAA,CAAM,QAAA,CAAS,OAAO,IAAA,CAAK,IAAA,CAAK,YAAY,CAAC,CAAA;AAAA,IACjDA,eAAI,KAAA,CAAM,QAAA,CAAS,OAAO,IAAA,CAAK,IAAA,CAAK,SAAS,CAAC,CAAA;AAAA,IAC9C,eAAA,CAAgB,KAAK,UAAU,CAAA;AAAA;AAAA,IAC/B,SAAA,EAAU;AAAA;AAAA,IACV,YAAA,CAAa,KAAK,OAAO;AAAA;AAAA,GAC1B,CAAA;AACH;AAEA,SAAS,YAAA,CAAa,UAAA,EAAoB,MAAA,EAAA,GAAmB,IAAA,EAAkC;AAC7F,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,IAAII,oBAAS,UAAU,CAAA;AAAA,EACpC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,CAAA,kCAAA,EAAqC,UAAU,CAAA,CAAA,CAAA,EAAK;AAAA,MAC7F;AAAA,KACD,CAAA;AAAA,EACH;AACA,EAAA,OAAO,QAAA,CAAS,IAAA,CAAK,MAAA,EAAQ,GAAG,IAAI,CAAA;AACtC;AAgBO,SAAS,wBAAwB,OAAA,EAA+C;AACrF,EAAA,MAAM,WAAA,GACJ,QAAQ,MAAA,YAAkBJ,cAAAA,CAAI,QAAQ,OAAA,CAAQ,MAAA,GAAS,oBAAA,CAAqB,OAAA,CAAQ,MAAM,CAAA;AAC5F,EAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,gBAAA,EAAkB,YAAA,EAAc,WAAW,CAAA;AACzE;AASO,SAAS,2BAA2B,OAAA,EAAkD;AAC3F,EAAA,IAAI,OAAA,CAAQ,YAAA,CAAa,MAAA,KAAW,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,iDAAiD,CAAA;AAAA,EAC9F;AACA,EAAA,OAAO,YAAA;AAAA,IACL,OAAA,CAAQ,gBAAA;AAAA,IACR,eAAA;AAAA,IACA,mBAAA,CAAoB,QAAQ,YAAY;AAAA,GAC1C;AACF;AC3HA,SAAS,KAAK,MAAA,EAAiC;AAC7C,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,gBAAgB,KAAA,EAAO,cAAA,EAAgB,OAAO,MAAA,EAAO;AAChF;AAOA,SAAS,wBAAA,CACP,SAAA,EACA,SAAA,EACA,gBAAA,EACoF;AACpF,EAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,KAAyC;AACtD,IAAA,MAAM,CAAA,GAAI,SAAA,CAAU,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,EAAI,CAAE,GAAA,EAAI,CAAE,QAAA,EAAS,KAAM,IAAI,CAAA;AACjE,IAAA,OAAO,CAAA,GAAI,IAAI,UAAA,CAAW,CAAA,CAAE,KAAI,CAAE,KAAA,EAAO,CAAA,GAAI,MAAA;AAAA,EAC/C,CAAA;AACA,EAAA,MAAM,iBAAA,GAAoB,MAAM,oBAAoB,CAAA;AACpD,EAAA,MAAM,cAAA,GAAiB,MAAM,kBAAkB,CAAA;AAC/C,EAAA,MAAM,SAAA,GAAY,MAAM,WAAW,CAAA;AACnC,EAAA,IAAI,CAAC,iBAAA,IAAqB,CAAC,cAAA,IAAkB,CAAC,SAAA,EAAW;AACvD,IAAA,OAAO,EAAE,IAAI,KAAA,EAAO,cAAA,EAAgB,OAAO,cAAA,EAAgB,KAAA,EAAO,QAAQ,gBAAA,EAAiB;AAAA,EAC7F;AACA,EAAA,IAAI,SAAA,CAAU,WAAW,EAAA,EAAI;AAC3B,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,cAAA,EAAgB,KAAA;AAAA,MAChB,cAAA,EAAgB,KAAA;AAAA,MAChB,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AACA,EAAA,IAAI,cAAA,GAAiB,KAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,WAAA,CAAY,cAAc,CAAC,CAAA;AAClD,IAAA,cAAA,GAAiB,GAAA,CAAI,SAAA,KAAc,gBAAA,CAAiB,gBAAgB,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AACN,IAAA,cAAA,GAAiB,KAAA;AAAA,EACnB;AAEA,EAAA,MAAM,SAASH,aAAA,CAAO,WAAA,CAAY,mBAAmBA,aAAA,CAAO,cAAc,CAAC,CAAC,CAAA;AAC5E,EAAA,MAAM,cAAA,GAAiBC,SAAAA,CAAK,MAAA,CAAO,SAAA,EAAW,QAAQ,SAAA,EAAW;AAAA,IAC/D,IAAA,EAAM,KAAA;AAAA,IACN,MAAA,EAAQ;AAAA,GACT,CAAA;AACD,EAAA,OAAO,EAAE,EAAA,EAAI,cAAA,IAAkB,cAAA,EAAgB,gBAAgB,cAAA,EAAe;AAChF;AAWO,SAAS,kBAAA,CACd,KAAA,EACA,SAAA,EACA,iBAAA,EACiB;AACjB,EAAA,IAAI,MAAM,WAAA,EAAY,CAAE,MAAA,EAAO,CAAE,SAAS,2BAAA,EAA6B;AACrE,IAAA,OAAO,KAAK,wBAAwB,CAAA;AAAA,EACtC;AAGA,EAAA,MAAM,SAAA,GAAY,MAAM,WAAA,EAAY,CAAE,SAAQ,CAAE,SAAA,GAAY,GAAA,EAAI;AAChE,EAAA,IAAI,CAAC,SAAA,EAAW,OAAO,IAAA,CAAK,2CAA2C,CAAA;AAEvE,EAAA,MAAM,gBAAA,GAAmB,uBAAA,CAAwB,KAAA,EAAO,iBAAiB,CAAA;AACzE,EAAA,MAAM,CAAA,GAAI,wBAAA,CAAyB,SAAA,EAAW,SAAA,EAAW,gBAAgB,CAAA;AACzE,EAAA,OAAO,EAAE,SAAS,CAAA,CAAE,EAAA,EAAI,gBAAgB,CAAA,CAAE,cAAA,EAAgB,cAAA,EAAgB,CAAA,CAAE,cAAA,EAAe;AAC7F;AAgBO,SAAS,6BAAA,CACd,KAAA,EACA,YAAA,EACA,iBAAA,EAC4B;AAC5B,EAAA,IAAI,MAAM,WAAA,EAAY,CAAE,MAAA,EAAO,CAAE,SAAS,2BAAA,EAA6B;AACrE,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,SAAS,EAAC,EAAG,QAAQ,wBAAA,EAAyB;AAAA,EACzE;AACA,EAAA,MAAM,MAAM,KAAA,CAAM,WAAA,EAAY,CAAE,OAAA,GAAU,SAAA,EAAU;AACpD,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,EAAO,CAAE,IAAA,KAAS,QAAA,GAAW,GAAA,CAAI,GAAA,EAAI,GAAI,CAAC,CAAA,EAAG,GAAA,EAAI,GAAI,MAAA;AACrE,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,SAAS,EAAC,EAAG,QAAQ,wCAAA,EAAyC;AAAA,EACzF;AACA,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,CAAA,EAAG,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,EAAC,EAAG,MAAA,EAAQ,sBAAA,EAAuB;AAE3F,EAAA,MAAM,gBAAA,GAAmB,uBAAA,CAAwB,KAAA,EAAO,iBAAiB,CAAA;AACzE,EAAA,MAAM,UAAiD,EAAC;AACxD,EAAA,IAAI,KAAA,GAAQ,IAAA;AAEZ,EAAA,KAAA,MAAW,KAAK,GAAA,EAAK;AACnB,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,EAAI,CAAE,GAAA,EAAI;AAC3B,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,CAAC,CAAA,EAAG,KAAA,EAAM;AACnC,IAAA,MAAM,YAAA,GAAe,UAAU,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA,GAAI,EAAA;AAEtE,IAAA,MAAM,SAAA,GAAY,EAAE,GAAA,EAAI,CAAE,KAAI,GAAI,CAAC,GAAG,GAAA,EAAI;AAC1C,IAAA,MAAM,SAAA,GAAY,aAAa,YAAY,CAAA;AAC3C,IAAA,IAAI,CAAC,SAAA,IAAa,CAAC,SAAA,EAAW;AAC5B,MAAA,KAAA,GAAQ,KAAA;AACR,MAAA,OAAA,CAAQ,KAAK,EAAE,YAAA,EAAc,gBAAgB,KAAA,EAAO,cAAA,EAAgB,OAAO,CAAA;AAC3E,MAAA;AAAA,IACF;AACA,IAAA,MAAM,CAAA,GAAI,wBAAA,CAAyB,SAAA,EAAW,SAAA,EAAW,gBAAgB,CAAA;AACzE,IAAA,IAAI,CAAC,CAAA,CAAE,EAAA,EAAI,KAAA,GAAQ,KAAA;AACnB,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,YAAA;AAAA,MACA,gBAAgB,CAAA,CAAE,cAAA;AAAA,MAClB,gBAAgB,CAAA,CAAE;AAAA,KACnB,CAAA;AAAA,EACH;AACA,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAQ;AACnC;AC9HO,SAAS,iBAAiB,OAAA,EAAqD;AACpF,EAAA,MAAM,MAAA,GAAS,IAAIO,cAAA,CAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ;AAAA,IAC5C,WAAW,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,MAAA,CAAO,WAAW,SAAS;AAAA,GACpE,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,QAAQ,YAAA,IAAgB,EAAA;AACzC,EAAA,MAAM,UAAA,GAAa,QAAQ,cAAA,IAAkB,GAAA;AAC7C,EAAA,OAAO;AAAA,IACL,MAAM,KAAK,WAAA,EAA4C;AACrD,MAAA,MAAM,EAAA,GAAKC,6BAAA,CAAmB,OAAA,CAAQ,WAAA,EAAa,QAAQ,iBAAiB,CAAA;AAC5E,MAAA,IAAI,IAAA;AACJ,MAAA,IAAI;AACF,QAAA,IAAA,GAAO,MAAM,MAAA,CAAO,eAAA,CAAgB,EAAE,CAAA;AAAA,MACxC,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,IAAI,QAAA,CAAS,eAAA,EAAiB,6CAAA,EAA+C;AAAA,UACjF;AAAA,SACD,CAAA;AAAA,MACH;AACA,MAAA,IAAI,IAAA,CAAK,WAAW,OAAA,EAAS;AAC3B,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,QAAA;AAAA,UACR,MAAM,IAAA,CAAK,IAAA;AAAA,UACX,cAAA,EAAgB,IAAA,CAAK,WAAA,EAAa,KAAA,CAAM,QAAQ;AAAA,SAClD;AAAA,MACF;AAEA,MAAA,IAAI,KAAA;AACJ,MAAA,IAAI;AACF,QAAA,KAAA,GAAQ,MAAM,MAAA,CAAO,eAAA,CAAgB,IAAA,CAAK,IAAA,EAAM;AAAA,UAC9C,QAAA;AAAA,UACA,eAAe,MAAM;AAAA,SACtB,CAAA;AAAA,MACH,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,IAAI,QAAA;AAAA,UACR,eAAA;AAAA,UACA,eAAe,IAAA,CAAK,IAAI,CAAA,yBAAA,EAA4B,MAAA,CAAO,QAAQ,CAAC,CAAA,MAAA,CAAA;AAAA,UACpE,EAAE,KAAA;AAAM,SACV;AAAA,MACF;AACA,MAAA,IAAI,KAAA,CAAM,MAAA,KAAWD,cAAA,CAAI,GAAA,CAAI,qBAAqB,SAAA,EAAW;AAC3D,QAAA,MAAM,IAAI,QAAA;AAAA,UACR,eAAA;AAAA,UACA,eAAe,IAAA,CAAK,IAAI,CAAA,uBAAA,EAA0B,MAAA,CAAO,QAAQ,CAAC,CAAA,MAAA;AAAA,SACpE;AAAA,MACF;AACA,MAAA,MAAM,OAAA,GAAU,KAAA,CAAM,MAAA,KAAWA,cAAA,CAAI,IAAI,oBAAA,CAAqB,OAAA;AAC9D,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,UAAU,SAAA,GAAY,QAAA;AAAA,QAC9B,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,WAAA,EAAa,OAAA,GAAW,KAAA,CAAoC,WAAA,GAAc;AAAA,OAC5E;AAAA,IACF;AAAA,GACF;AACF;;;ACzCA,IAAM,yBAAA,GAA4B,EAAA;AAoBlC,eAAsB,kBAAkB,OAAA,EAA0D;AAChG,EAAA,MAAM,MAAA,GAAS,IAAIA,cAAAA,CAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ;AAAA,IAC5C,WAAW,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,MAAA,CAAO,WAAW,SAAS;AAAA,GACpE,CAAA;AACD,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAASE,kBAAA,CAAQ,UAAA,CAAW,OAAA,CAAQ,YAAY,CAAA;AAAA,EAClD,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,2BAAA,EAA6B,EAAE,OAAO,CAAA;AAAA,EACnF;AAEA,EAAA,MAAM,UAAU,MAAM,MAAA,CAAO,UAAA,CAAW,MAAA,CAAO,WAAW,CAAA;AAC1D,EAAA,MAAM,EAAA,GAAK,IAAID,6BAAAA,CAAmB,OAAA,EAAS;AAAA,IACzC,GAAA,EAAK,QAAQ,GAAA,IAAO,SAAA;AAAA,IACpB,mBAAmB,OAAA,CAAQ;AAAA,GAC5B,CAAA,CACE,YAAA,CAAa,OAAA,CAAQ,SAAS,CAAA,CAC9B,UAAA,CAAW,OAAA,CAAQ,cAAA,IAAkB,GAAG,CAAA,CACxC,KAAA,EAAM;AAET,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,mBAAA,CAAoB,EAAE,CAAA;AAClD,EAAA,IAAI,CAACD,cAAAA,CAAI,GAAA,CAAI,mBAAA,CAAoB,MAAM,CAAA,EAAG;AACxC,IAAA,MAAM,SAAS,OAAA,IAAW,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,GAAI,0BAAA;AAC1D,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,sBAAA;AAAA,MACA,CAAA,mCAAA,EAAsC,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,KAC5D;AAAA,EACF;AACA,EAAA,MAAM,WAAWA,cAAAA,CAAI,mBAAA,CAAoB,EAAA,EAAI,MAAM,EAAE,KAAA,EAAM;AAE3D,EAAA,MAAM,6BACH,MAAM,MAAA,CAAO,iBAAgB,EAAG,QAAA,IAChC,QAAQ,+BAAA,IAAmC,yBAAA,CAAA;AAC9C,EAAA,MAAM,aAAA,GAAgB,MAAM,eAAA,CAAgB,QAAA,CAAS,OAAM,EAAG;AAAA,IAC5D,mBAAmB,OAAA,CAAQ,iBAAA;AAAA,IAC3B,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,MAAA,EAAQ,cAAA;AAAA,IACR,yBAAA;AAAA,IACA,QAAQ,OAAA,CAAQ;AAAA,GACjB,CAAA;AAED,EAAA,MAAM,QAAA,GAAWC,6BAAAA,CAAmB,OAAA,CAAQ,aAAA,EAAe,QAAQ,iBAAiB,CAAA;AACpF,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,mBAAA,CAAoB,QAAQ,CAAA;AACxD,EAAA,IAAI,CAACD,cAAAA,CAAI,GAAA,CAAI,mBAAA,CAAoB,MAAM,CAAA,EAAG;AACxC,IAAA,MAAM,SAAS,OAAA,IAAW,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,GAAI,0BAAA;AAC1D,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,sBAAA;AAAA,MACA,CAAA,qEAAA,EAAwE,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,KAC9F;AAAA,EACF;AAEA,EAAA,MAAM,UAAUA,cAAAA,CAAI,mBAAA,CAAoB,QAAA,EAAU,MAAM,EAAE,KAAA,EAAM;AAChE,EAAA,OAAA,CAAQ,KAAK,MAAM,CAAA;AACnB,EAAA,MAAM,UAAA,GACJ,OAAA,CAAQ,UAAA,IACR,gBAAA,CAAiB;AAAA,IACf,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,mBAAmB,OAAA,CAAQ,iBAAA;AAAA,IAC3B,WAAW,OAAA,CAAQ;AAAA,GACpB,CAAA;AACH,EAAA,OAAO,UAAA,CAAW,IAAA,CAAK,OAAA,CAAQ,KAAA,EAAO,CAAA;AACxC;;;AC7FA,eAAe,yBAAA,GAA8C;AAC3D,EAAA,MAAM,MACJ,UAAA,CAGA,mBAAA;AACF,EAAA,IAAI,CAAC,GAAA,EAAK,+BAAA,EAAiC,OAAO,KAAA;AAClD,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,IAAI,+BAAA,EAAgC;AAAA,EACnD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AASA,eAAsB,QAAQ,OAAA,EAAwD;AACpF,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,wBAAA,EAAyB;AAC5D,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA;AAC7C,EAAA,IAAI,CAAC,cAAc,OAAO,IAAA;AAE1B,EAAA,MAAM,eAAA,GAAkB,OAAA,CAAQ,wBAAA,IAA6B,MAAM,yBAAA,EAA0B;AAC7F,EAAA,IAAI,eAAA,EAAiB;AACnB,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAY,qBAAA,EAAsB;AAC3D,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,GAAA,CAAI;AAAA,QACjB,MAAM,OAAA,CAAQ,IAAA;AAAA,QACd,gBAAA,EAAkB,CAAC,YAAY,CAAA;AAAA,QAC/B,SAAA,EAAW;AAAA,OACZ,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,OAAA,CAAQ,oBAAoB,YAAY,CAAA;AACvE,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,CAAC,CAAA,EAAG,UAAA;AAChC,EAAA,OAAO,UAAA,GAAa,EAAE,UAAA,EAAY,YAAA,EAAa,GAAI,IAAA;AACrD;;;ACrCA,eAAsB,QAAQ,OAAA,EAAmD;AAC/E,EAAA,oBAAA,CAAqB,QAAQ,cAAc,CAAA;AAC3C,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAY,qBAAA,EAAsB;AAC3D,EAAA,MAAM,SAAA,GAAY,MAAM,QAAA,CAAS,GAAA,CAAI;AAAA,IACnC,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,kBAAkB,EAAC;AAAA,IACnB,SAAA,EAAW,OAAA,CAAQ,SAAA,IAAa,WAAA,CAAY,EAAE;AAAA,GAC/C,CAAA;AACD,EAAA,MAAM,WAAW,MAAM,OAAA,CAAQ,OAAA,CAAQ,mBAAA,CAAoB,UAAU,EAAE,CAAA;AACvE,EAAA,OAAO,QAAA,CAAS,GAAA,CAAI,CAAC,OAAA,MAAa;AAAA,IAChC,YAAY,OAAA,CAAQ,UAAA;AAAA,IACpB,cAAc,SAAA,CAAU;AAAA,GAC1B,CAAE,CAAA;AACJ;;;ACUA,SAAS,kBAAkB,EAAA,EAAqC;AAC9D,EAAA,OAAO,OAAO,EAAA,KAAO,QAAA,GAAW,eAAA,CAAgB,EAAE,CAAA,GAAI,EAAA;AACxD;AAOA,eAAsB,UAAU,OAAA,EAAkD;AAChF,EAAA,MAAM,EAAE,gBAAA,EAAkB,SAAA,EAAW,GAAG,QAAO,GAAI,OAAA;AACnD,EAAA,MAAM,YAAY,uBAAA,CAAwB;AAAA,IACxC,gBAAA;AAAA,IACA,MAAA,EAAQ;AAAA,MACN,YAAA,EAAc,iBAAA,CAAkB,SAAA,CAAU,YAAY,CAAA;AAAA,MACtD,WAAW,SAAA,CAAU,SAAA;AAAA,MACrB,YAAY,SAAA,CAAU,UAAA;AAAA,MACtB,SAAS,SAAA,CAAU;AAAA;AACrB,GACD,CAAA;AACD,EAAA,OAAO,iBAAA,CAAkB,EAAE,GAAG,MAAA,EAAQ,WAAW,CAAA;AACnD;AAGA,eAAsB,aAAa,OAAA,EAAqD;AACtF,EAAA,MAAM,EAAE,gBAAA,EAAkB,YAAA,EAAc,GAAG,QAAO,GAAI,OAAA;AACtD,EAAA,MAAM,YAAY,0BAAA,CAA2B;AAAA,IAC3C,gBAAA;AAAA,IACA,YAAA,EAAc,kBAAkB,YAAY;AAAA,GAC7C,CAAA;AACD,EAAA,OAAO,iBAAA,CAAkB,EAAE,GAAG,MAAA,EAAQ,WAAW,CAAA;AACnD;;;AChEA,IAAM,KAAA,GAAQ,CAAC,EAAA,KACb,EAAA,GAAK,IAAI,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY,WAAW,OAAA,EAAS,EAAE,CAAC,CAAA,GAAI,QAAQ,OAAA,EAAQ;AAGrF,SAAS,kBAAkB,MAAA,EAAyB;AAClD,EAAA,OAAO,MAAA,KAAW,OAAO,MAAA,IAAU,GAAA;AACrC;AASA,eAAsB,QAAA,CACpB,GAAA,EACA,IAAA,EACA,KAAA,EACmB;AACnB,EAAA,MAAM,WAAW,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,KAAA,EAAO,WAAW,CAAC,CAAA;AAChD,EAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAa,GAAA;AACtC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,IAAK,QAAA,EAAU,CAAA,EAAA,EAAK;AAClC,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,QAChC,MAAA,EAAQ,MAAA;AAAA,QACR,SAAS,IAAA,CAAK,OAAA;AAAA,QACd,MAAM,IAAA,CAAK;AAAA,OACZ,CAAA;AACD,MAAA,IAAI,iBAAA,CAAkB,QAAA,CAAS,MAAM,CAAA,IAAK,IAAI,QAAA,EAAU;AACtD,QAAA,MAAM,KAAA,CAAM,YAAY,CAAC,CAAA;AACzB,QAAA;AAAA,MACF;AACA,MAAA,OAAO,QAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,IAAI,QAAA,EAAU;AAChB,QAAA,MAAM,KAAA,CAAM,YAAY,CAAC,CAAA;AACzB,QAAA;AAAA,MACF;AACA,MAAA,MAAM,IAAI,SAAS,eAAA,EAAiB,CAAA,QAAA,EAAW,GAAG,CAAA,OAAA,CAAA,EAAW,EAAE,OAAO,CAAA;AAAA,IACxE;AAAA,EACF;AAEA,EAAA,MAAM,IAAI,QAAA,CAAS,eAAA,EAAiB,CAAA,QAAA,EAAW,GAAG,CAAA,OAAA,CAAS,CAAA;AAC7D;;;ACjCO,SAAS,qBAAqB,OAAA,EAAyD;AAC5F,EAAA,OAAO;AAAA,IACL,MAAM,KAAK,WAAA,EAA4C;AACrD,MAAA,MAAM,OAAA,GAAkC;AAAA,QACtC,cAAA,EAAgB;AAAA,OAClB;AACA,MAAA,IAAI,QAAQ,KAAA,EAAO,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,QAAQ,KAAK,CAAA,CAAA;AACrE,MAAA,MAAM,WAAW,MAAM,QAAA;AAAA,QACrB,OAAA,CAAQ,GAAA;AAAA,QACR,EAAE,OAAA,EAAS,IAAA,EAAM,IAAI,eAAA,CAAgB,EAAE,GAAA,EAAK,WAAA,EAAa,CAAA,CAAE,QAAA,EAAS,EAAE;AAAA,QACtE,OAAA,CAAQ;AAAA,OACV;AACA,MAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACpD,MAAA,IAAI,CAAC,QAAA,CAAS,EAAA,IAAM,KAAK,MAAA,KAAW,QAAA,IAAY,KAAK,KAAA,EAAO;AAC1D,QAAA,OAAO,EAAE,QAAQ,QAAA,EAAU,IAAA,EAAM,KAAK,IAAA,IAAQ,EAAA,EAAI,cAAA,EAAgB,IAAA,CAAK,cAAA,EAAe;AAAA,MACxF;AACA,MAAA,OAAO,EAAE,QAAQ,SAAA,EAAW,IAAA,EAAM,KAAK,IAAA,IAAQ,EAAA,EAAI,aAAa,IAAA,EAAK;AAAA,IACvE;AAAA,GACF;AACF;;;ACtBO,SAAS,8BACd,OAAA,EACmB;AACnB,EAAA,OAAO;AAAA,IACL,MAAM,KAAK,WAAA,EAA4C;AACrD,MAAA,MAAM,OAAA,GAAkC,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAC7E,MAAA,IAAI,QAAQ,MAAA,EAAQ,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,QAAQ,MAAM,CAAA,CAAA;AACvE,MAAA,MAAM,WAAW,MAAM,QAAA;AAAA,QACrB,OAAA,CAAQ,GAAA;AAAA,QACR,EAAE,SAAS,IAAA,EAAM,IAAA,CAAK,UAAU,EAAE,eAAA,EAAiB,WAAA,EAAa,CAAA,EAAE;AAAA,QAClE,OAAA,CAAQ;AAAA,OACV;AACA,MAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACpD,MAAA,IAAI,CAAC,QAAA,CAAS,EAAA,IAAM,IAAA,CAAK,WAAW,QAAA,EAAU;AAC5C,QAAA,OAAO,EAAE,QAAQ,QAAA,EAAU,IAAA,EAAM,KAAK,IAAA,IAAQ,EAAA,EAAI,cAAA,EAAgB,IAAA,CAAK,cAAA,EAAe;AAAA,MACxF;AACA,MAAA,OAAO,EAAE,QAAQ,SAAA,EAAW,IAAA,EAAM,KAAK,IAAA,IAAQ,EAAA,EAAI,aAAa,IAAA,EAAK;AAAA,IACvE;AAAA,GACF;AACF;;;AC5BO,IAAM,iBAAA,GAAoB,GAAA;AAC1B,IAAM,eAAA,GAAkB,EAAA;AAIxB,SAAS,aAAa,MAAA,EAA+B;AAC1D,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAChC,IAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA,IAAK,GAAG,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAIO,SAAS,kBAAkB,KAAA,EAA+B;AAC/D,EAAA,MAAM,GAAA,GACJ,OAAO,KAAA,KAAU,QAAA,IAAY,UAAU,IAAA,IAAQ,SAAA,IAAa,KAAA,GACvD,KAAA,CAAgC,OAAA,GACjC,KAAA;AACN,EAAA,MAAM,UAAU,OAAO,GAAA,KAAQ,QAAA,GAAW,GAAA,GAAM,OAAO,GAAG,CAAA;AAC1D,EAAA,MAAM,KAAA,GAAQ,iCAAA,CAAkC,IAAA,CAAK,OAAO,CAAA;AAC5D,EAAA,OAAO,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAA,GAAI,IAAA;AACpC;AAUA,eAAsB,kBAAA,CACpB,MAAA,EACA,OAAA,EACA,WAAA,EACkC;AAClC,EAAA,MAAM,SAAkC,EAAC;AACzC,EAAA,IAAI,KAAA,GAAQ,WAAA;AACZ,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,cAAA;AAEJ,EAAA,KAAA,IAAS,IAAA,GAAO,CAAA,EAAG,IAAA,GAAO,eAAA,EAAiB,IAAA,EAAA,EAAQ;AACjD,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,MAAA,CAAO,SAAA;AAAA,QACtB,MAAA,GACI,EAAE,OAAA,EAAS,MAAA,EAAQ,KAAA,EAAO,iBAAA,EAAkB,GAC5C,EAAE,OAAA,EAAS,WAAA,EAAa,KAAA,EAAO,KAAA,EAAO,iBAAA;AAAkB,OAC9D;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,MAAA,GAAS,kBAAkB,KAAK,CAAA;AACtC,MAAA,IAAI,CAAC,MAAA,IAAU,MAAA,IAAU,IAAA,IAAQ,SAAS,MAAA,EAAQ;AAChD,QAAA,KAAA,GAAQ,MAAA,GAAS,CAAA;AACjB,QAAA;AAAA,MACF;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AACA,IAAA,MAAA,CAAO,IAAA,CAAK,GAAG,QAAA,CAAS,MAAM,CAAA;AAC9B,IAAA,cAAA,GAAiB,MAAA;AACjB,IAAA,MAAA,GAAS,QAAA,CAAS,MAAA;AAElB,IAAA,IAAI,CAAC,MAAA,IAAU,MAAA,KAAW,cAAA,EAAgB;AAC1C,IAAA,MAAM,OAAA,GAAU,aAAa,MAAM,CAAA;AACnC,IAAA,IAAI,OAAA,IAAW,IAAA,IAAQ,OAAA,IAAW,QAAA,CAAS,YAAA,EAAc;AAAA,EAC3D;AACA,EAAA,OAAO,MAAA;AACT;;;AC/EA,SAAS,aAAa,GAAA,EAAuB;AAC3C,EAAA,IAAI;AACF,IAAA,OAAOG,yBAAc,GAAY,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAkBA,IAAM,eAAA,GAAkB,KAAA;AAQxB,SAAS,YAAA,CAAa,OAA8B,YAAA,EAA8C;AAChG,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,KAAA,IAAS,EAAC;AAC/B,IAAA,IAAI,MAAA,CAAO,UAAU,CAAA,EAAG;AACtB,MAAA,MAAM,GAAA,GAAM,YAAA,CAAa,MAAA,CAAO,CAAC,CAAC,CAAA;AAClC,MAAA,MAAM,OAAA,GAAU,YAAA,CAAa,MAAA,CAAO,CAAC,CAAC,CAAA;AACtC,MAAA,MAAM,IAAA,GACJ,OAAA,YAAmB,UAAA,GAAa,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAA,GAAI,MAAA,CAAO,OAAA,IAAW,EAAE,CAAA;AAC1F,MAAA,IAAI,GAAA,KAAQ,UAAA,IAAc,IAAA,KAAS,YAAA,EAAc;AAC/C,QAAA,MAAMC,KAAAA,GAAO,YAAA,CAAa,KAAA,CAAM,KAAK,CAAA;AACrC,QAAA,IAAI,OAAOA,KAAAA,KAAS,QAAA,IAAYA,KAAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG,OAAO,EAAE,UAAA,EAAYA,KAAAA,EAAK;AAAA,MAClF;AAAA,IACF;AAGA,IAAA,MAAM,WAAW,CAAC,KAAA,CAAM,KAAA,EAAO,GAAG,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,KAAA,CAAM,QAAQ,CAAC,CAAA,CAAE,KAAK,GAAG,CAAA;AAChF,IAAA,IAAI,CAAC,QAAA,CAAS,QAAA,CAAS,YAAY,GAAG,OAAO,IAAA;AAC7C,IAAA,MAAM,IAAA,GAAO,YAAA,CAAa,KAAA,CAAM,KAAK,CAAA;AACrC,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG,OAAO,EAAE,UAAA,EAAY,IAAA,EAAK;AAChF,IAAA,OAAO,KAAA,CAAM,aAAa,EAAE,UAAA,EAAY,MAAM,UAAA,CAAW,QAAA,IAAW,GAAI,IAAA;AAAA,EAC1E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,cAAc,OAAA,EAA+C;AAC3E,EAAA,MAAM,MAAA,GAAS,IAAIJ,cAAAA,CAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ;AAAA,IAC5C,WAAW,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,MAAA,CAAO,WAAW,SAAS;AAAA,GACpE,CAAA;AACD,EAAA,MAAM,KAAA,GAAQ,QAAQ,UAAA,IAAc,YAAA;AACpC,EAAA,OAAO;AAAA,IACL,MAAM,oBAAoB,YAAA,EAAkD;AAC1E,MAAA,MAAM,WAAA,GACJ,OAAA,CAAQ,WAAA,IACR,IAAA,CAAK,GAAA,CAAI,CAAA,EAAA,CAAI,MAAM,MAAA,CAAO,eAAA,EAAgB,EAAG,QAAA,GAAW,eAAe,CAAA;AAGzE,MAAA,MAAM,SAAS,MAAM,kBAAA;AAAA,QACnB,MAAA;AAAA,QACA,CAAC,EAAE,IAAA,EAAM,UAAA,EAAY,aAAa,CAAC,OAAA,CAAQ,iBAAiB,CAAA,EAAG,CAAA;AAAA,QAC/D;AAAA,OACF;AACA,MAAA,MAAM,WAA8B,EAAC;AACrC,MAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,QAAA,MAAM,QAAA,GAAW,KAAA,CAAM,KAAA,EAAO,YAAY,CAAA;AAC1C,QAAA,IAAI,QAAA,EAAU,QAAA,CAAS,IAAA,CAAK,QAAQ,CAAA;AAAA,MACtC;AACA,MAAA,OAAO,QAAA;AAAA,IACT;AAAA,GACF;AACF;;;ACxEO,SAAS,eAAe,OAAA,EAAgD;AAC7E,EAAA,MAAM,KAAA,GACJ,OAAA,CAAQ,KAAA,KACP,CAAC,IAAA,KAAqC;AACrC,IAAA,MAAM,IAAA,GAAQ,IAAA,CAAkD,QAAA,IAAY,EAAC;AAC7E,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,KAAO,EAAE,UAAA,GAAa,CAAC,EAAE,UAAA,EAAY,CAAA,CAAE,UAAA,EAAY,CAAA,GAAI,EAAG,CAAA;AAAA,EACjF,CAAA,CAAA;AACF,EAAA,OAAO;AAAA,IACL,MAAM,oBAAoB,YAAA,EAAkD;AAC1E,MAAA,MAAM,OAAA,GAAkC,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAC7E,MAAA,IAAI,QAAQ,KAAA,EAAO,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,QAAQ,KAAK,CAAA,CAAA;AACrE,MAAA,MAAM,WAAW,MAAM,QAAA;AAAA,QACrB,OAAA,CAAQ,GAAA;AAAA,QACR,EAAE,SAAS,IAAA,EAAM,IAAA,CAAK,UAAU,EAAE,YAAA,EAAc,CAAA,EAAE;AAAA,QAClD,OAAA,CAAQ;AAAA,OACV;AACA,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,QAAA;AAAA,UACR,eAAA;AAAA,UACA,CAAA,8BAAA,EAAiC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,SAC1D;AAAA,MACF;AACA,MAAA,OAAO,KAAA,CAAM,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAC,CAAA;AAAA,IACtD;AAAA,GACF;AACF;;;AChCO,SAAS,gBAAgB,OAAA,EAG9B;AACA,EAAA,OAAO;AAAA,IACL,YAAY,gBAAA,CAAiB;AAAA,MAC3B,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,mBAAmB,OAAA,CAAQ,iBAAA;AAAA,MAC3B,WAAW,OAAA,CAAQ;AAAA,KACpB,CAAA;AAAA,IACD,SAAS,aAAA,CAAc;AAAA,MACrB,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,mBAAmB,OAAA,CAAQ,iBAAA;AAAA,MAC3B,WAAW,OAAA,CAAQ;AAAA,KACpB;AAAA,GACH;AACF;ACMO,SAAS,gBAAgB,OAAA,EAAkD;AAChF,EAAA,MAAM,MAAA,GAAS,IAAIA,cAAAA,CAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ;AAAA,IAC5C,WAAW,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,MAAA,CAAO,WAAW,SAAS;AAAA,GACpE,CAAA;AACD,EAAA,MAAM,MAAA,GAASE,kBAAAA,CAAQ,UAAA,CAAW,OAAA,CAAQ,YAAY,CAAA;AACtD,EAAA,OAAO;AAAA,IACL,MAAM,OAAO,KAAA,EAAO;AAClB,MAAA,MAAM,EAAA,GAAKJ,wBAAAA,CAAc,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,EAAG,EAAE,IAAA,EAAM,OAAA,EAAS,CAAA;AACxE,MAAA,MAAM,IAAA,GAAOA,wBAAAA,CAAc,MAAA,CAAO,IAAA,CAAK,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAA,CAAM,YAAY,CAAC,CAAA,EAAG;AAAA,QACpF,IAAA,EAAM;AAAA,OACP,CAAA;AACD,MAAA,MAAM,UAAU,MAAM,MAAA,CAAO,UAAA,CAAW,MAAA,CAAO,WAAW,CAAA;AAC1D,MAAA,MAAM,EAAA,GAAK,IAAIG,6BAAAA,CAAmB,OAAA,EAAS;AAAA,QACzC,GAAA,EAAK,QAAQ,GAAA,IAAO,SAAA;AAAA,QACpB,mBAAmB,OAAA,CAAQ;AAAA,OAC5B,CAAA,CACE,YAAA,CAAa,IAAIF,mBAAAA,CAAS,QAAQ,iBAAiB,CAAA,CAAE,IAAA,CAAK,QAAA,EAAU,IAAI,IAAI,CAAC,EAC7E,UAAA,CAAW,GAAG,EACd,KAAA,EAAM;AAET,MAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,mBAAA,CAAoB,EAAE,CAAA;AAC/C,MAAA,IAAI,CAACC,cAAAA,CAAI,GAAA,CAAI,mBAAA,CAAoB,GAAG,CAAA,EAAG;AACrC,QAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,kCAAkC,CAAA;AAAA,MAC/E;AACA,MAAA,MAAM,WAAWA,cAAAA,CAAI,mBAAA,CAAoB,EAAA,EAAI,GAAG,EAAE,KAAA,EAAM;AACxD,MAAA,QAAA,CAAS,KAAK,MAAM,CAAA;AAEpB,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,eAAA,CAAgB,QAAQ,CAAA;AAClD,MAAA,IAAI,IAAA,CAAK,WAAW,OAAA,EAAS;AAC3B,QAAA,MAAM,IAAI,QAAA,CAAS,eAAA,EAAiB,6BAA6B,CAAA;AAAA,MACnE;AACA,MAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,eAAA,CAAgB,KAAK,IAAI,CAAA;AACpD,MAAA,IAAI,KAAA,CAAM,MAAA,KAAWA,cAAAA,CAAI,GAAA,CAAI,qBAAqB,OAAA,EAAS;AACzD,QAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,CAAA,eAAA,EAAkB,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA;AAAA,MAC7E;AACA,MAAA,MAAM,MAAO,KAAA,CAAoC,WAAA;AACjD,MAAA,MAAM,aAAa,GAAA,GAAM,MAAA,CAAOG,wBAAAA,CAAc,GAAY,CAAC,CAAA,GAAI,EAAA;AAC/D,MAAA,OAAO,EAAE,UAAA,EAAY,MAAA,EAAQ,IAAA,CAAK,IAAA,EAAK;AAAA,IACzC;AAAA,GACF;AACF;AC9DO,IAAM,yBAAA,GACX;AA2BK,SAAS,sBAAsB,OAAA,EAAwD;AAC5F,EAAA,MAAM,MAAA,GAAS,IAAIH,cAAAA,CAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ;AAAA,IAC5C,WAAW,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,MAAA,CAAO,WAAW,SAAS;AAAA,GACpE,CAAA;AACD,EAAA,MAAM,MAAA,GAASE,kBAAAA,CAAQ,UAAA,CAAW,OAAA,CAAQ,cAAc,CAAA;AACxD,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,yBAAA;AACrC,EAAA,OAAO;AAAA,IACL,MAAM,OAAO,KAAA,EAAO;AAClB,MAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,KAAA,CAAM,YAAY,CAAA;AAC9C,MAAA,MAAM,aAAa,wBAAA,CAAyB;AAAA,QAC1C,QAAA,EAAU,OAAO,SAAA,EAAU;AAAA,QAC3B,cAAc,KAAA,CAAM,YAAA;AAAA,QACpB,mBAAmB,OAAA,CAAQ;AAAA,OAC5B,CAAA;AACD,MAAA,MAAM,EAAA,GAAKG,qBAAU,oBAAA,CAAqB;AAAA,QACxC,OAAA,EAASX,kBAAAA,CAAQ,UAAA,CAAW,MAAA,CAAO,WAAW,CAAA;AAAA,QAC9C,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAA,EAAU,KAAK,CAAA;AAAA,QACrC,IAAA,EAAM,MAAA,CAAO,IAAA,CAAKF,aAAAA,CAAO,GAAG,CAAC,CAAA;AAAA,QAC7B,eAAA,EAAiB,CAAC,oBAAA,CAAqB,EAAE,YAAA,EAAc,KAAK,SAAA,EAAW,KAAA,CAAM,SAAA,EAAW,CAAC;AAAA,OAC1F,CAAA;AACD,MAAA,MAAM,UAAU,MAAM,MAAA,CAAO,UAAA,CAAW,MAAA,CAAO,WAAW,CAAA;AAC1D,MAAA,MAAM,EAAA,GAAK,IAAIS,6BAAAA,CAAmB,OAAA,EAAS;AAAA,QACzC,GAAA,EAAK,QAAQ,GAAA,IAAO,UAAA;AAAA,QACpB,mBAAmB,OAAA,CAAQ;AAAA,OAC5B,EACE,YAAA,CAAa,EAAE,EACf,UAAA,CAAW,GAAG,EACd,KAAA,EAAM;AACT,MAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,mBAAA,CAAoB,EAAE,CAAA;AAC/C,MAAA,IAAI,CAACD,cAAAA,CAAI,GAAA,CAAI,mBAAA,CAAoB,GAAG,CAAA,EAAG;AACrC,QAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,0CAA0C,CAAA;AAAA,MACvF;AACA,MAAA,MAAM,WAAWA,cAAAA,CAAI,mBAAA,CAAoB,EAAA,EAAI,GAAG,EAAE,KAAA,EAAM;AACxD,MAAA,QAAA,CAAS,KAAK,MAAM,CAAA;AACpB,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,eAAA,CAAgB,QAAQ,CAAA;AAClD,MAAA,IAAI,IAAA,CAAK,WAAW,OAAA,EAAS;AAC3B,QAAA,MAAM,IAAI,QAAA,CAAS,eAAA,EAAiB,qCAAqC,CAAA;AAAA,MAC3E;AACA,MAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,eAAA,CAAgB,KAAK,IAAI,CAAA;AACpD,MAAA,IAAI,KAAA,CAAM,MAAA,KAAWA,cAAAA,CAAI,GAAA,CAAI,qBAAqB,OAAA,EAAS;AACzD,QAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,CAAA,uBAAA,EAA0B,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA;AAAA,MACrF;AACA,MAAA,OAAO,EAAE,UAAA,EAAY,MAAA,EAAQ,IAAA,CAAK,IAAA,EAAK;AAAA,IACzC;AAAA,GACF;AACF;AAEA,IAAMM,gBAAAA,GAAkB,KAAA;AAyBjB,SAAS,qBAAqB,OAAA,EAAsD;AACzF,EAAA,MAAM,MAAA,GAAS,IAAIN,cAAAA,CAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ;AAAA,IAC5C,WAAW,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,MAAA,CAAO,WAAW,SAAS;AAAA,GACpE,CAAA;AACD,EAAA,OAAO;AAAA,IACL,MAAM,oBAAoB,YAAA,EAAkD;AAC1E,MAAA,MAAM,GAAA,GAAM,gBAAgB,YAAY,CAAA;AAExC,MAAA,MAAM,OAAA,GAAU;AAAA,QACd;AAAA,UACE,IAAA,EAAM,UAAA;AAAA,UACN,MAAA,EAAQ;AAAA,YACN;AAAA,cACEL,eAAI,KAAA,CAAM,SAAA,CAAU,cAAc,CAAA,CAAE,MAAM,QAAQ,CAAA;AAAA,cAClD,mBAAA,CAAoB,GAAG,CAAA,CAAE,KAAA,CAAM,QAAQ;AAAA;AACzC;AACF;AACF,OACF;AACA,MAAA,MAAM,WAAA,GACJ,OAAA,CAAQ,WAAA,IACR,IAAA,CAAK,GAAA,CAAI,CAAA,EAAA,CAAI,MAAM,MAAA,CAAO,eAAA,EAAgB,EAAG,QAAA,GAAWW,gBAAe,CAAA;AAEzE,MAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,CAAmB,MAAA,EAAQ,SAAS,WAAW,CAAA;AACpE,MAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,MAAA,MAAM,WAA8B,EAAC;AACrC,MAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,QAAA,MAAM,UAAA,GAAa,KAAA,CAAM,UAAA,EAAY,QAAA,EAAS;AAC9C,QAAA,IAAI,UAAA,IAAc,CAAC,IAAA,CAAK,GAAA,CAAI,UAAU,CAAA,EAAG;AACvC,UAAA,IAAA,CAAK,IAAI,UAAU,CAAA;AACnB,UAAA,QAAA,CAAS,IAAA,CAAK,EAAE,UAAA,EAAY,CAAA;AAAA,QAC9B;AAAA,MACF;AACA,MAAA,OAAO,QAAA;AAAA,IACT;AAAA,GACF;AACF","file":"index.cjs","sourcesContent":["/**\n * The frozen taxonomy of error codes the SDK can throw. This union is\n * deliberately closed — every failure path maps to exactly one of these.\n */\nexport const KIT_ERROR_CODES = Object.freeze([\n  'USER_CANCELLED',\n  'ES256_NOT_SUPPORTED',\n  'RP_ID_MISMATCH',\n  'ORIGIN_MISMATCH',\n  'CHALLENGE_MISMATCH',\n  'INVALID_SIGNATURE_DER',\n  'INVALID_PUBLIC_KEY',\n  'CONTRACT_AUTH_FAILED',\n  'NETWORK_ERROR',\n  'UNSUPPORTED_AUTHENTICATOR',\n] as const);\n\nexport type KitErrorCode = (typeof KIT_ERROR_CODES)[number];\n\n/** Structured error carrying a machine-readable {@link KitErrorCode}. */\nexport class KitError extends Error {\n  readonly code: KitErrorCode;\n  override readonly name = 'KitError';\n\n  constructor(code: KitErrorCode, message?: string, options?: { cause?: unknown }) {\n    super(message ?? code, options);\n    this.code = code;\n    // Restore the prototype chain so `instanceof KitError` works after\n    // down-level transpilation to CJS.\n    Object.setPrototypeOf(this, KitError.prototype);\n  }\n}\n\nexport function isKitError(value: unknown): value is KitError {\n  return value instanceof KitError;\n}\n","import { KitError } from './errors';\n\n/**\n * Stable identifiers for the three battle-tested anchors (S04 / YK-430) — the\n * bugs that silently break ~50% of users. Referenced by stable name from the\n * threat model (S14) and the compatibility matrix (S09) so each mitigation has\n * one canonical id across code and docs.\n */\nexport const BATTLE_TESTED_ANCHORS = Object.freeze({\n  /** Apple Touch ID/Face ID emit high-S ~50% of the time; we normalize to low-S. */\n  LOW_S_NORMALIZATION: 'low-s-normalization',\n  /** Non-ES256 credentials (e.g. some Windows Hello configs) cannot verify on-chain. */\n  RS256_HARD_FAIL: 'rs256-hard-fail',\n  /** Safari requires create/get inside a user activation or it silently rejects. */\n  APPLE_USER_GESTURE: 'apple-user-gesture',\n} as const);\n\nexport type BattleTestedAnchor = (typeof BATTLE_TESTED_ANCHORS)[keyof typeof BATTLE_TESTED_ANCHORS];\n\n/** COSE algorithm id for ES256 (ECDSA w/ SHA-256 over P-256). */\nconst ALG_ES256 = -7;\n\n/**\n * Anchor `RS256_HARD_FAIL`. The Soroban webauthn-wallet verifies *only*\n * secp256r1, so a non-ES256 credential would produce an unusable account.\n * Hard-fail rather than continue (invariant #1).\n */\nexport function assertES256(alg: number): void {\n  if (alg !== ALG_ES256) {\n    throw new KitError('ES256_NOT_SUPPORTED', `COSE alg ${alg} is not ES256 (-7)`);\n  }\n}\n\ninterface UserActivationLike {\n  isActive: boolean;\n}\n\n/**\n * Anchor `APPLE_USER_GESTURE`. `navigator.credentials.create/get` on\n * Safari/WebKit must run inside a transient user activation (a real click/tap)\n * or the promise silently rejects. Call this at the very top of a create/sign\n * handler.\n *\n * UI pattern (for S18): never auto-trigger the ceremony from a mount/effect —\n * always gate it behind an explicit user click, and surface `USER_CANCELLED`\n * in the flow state machine. Lenient when `navigator.userActivation` is\n * unavailable (non-browser / older engines) so the SDK stays isomorphic; pass\n * an explicit `{ isActive }` to force the check.\n */\nexport function assertUserActivation(activation?: UserActivationLike): void {\n  const ua =\n    activation ??\n    (globalThis.navigator as { userActivation?: UserActivationLike } | undefined)?.userActivation;\n  if (ua && !ua.isActive) {\n    throw new KitError(\n      'USER_CANCELLED',\n      'WebAuthn ceremony must be invoked inside a user activation (click/tap)',\n    );\n  }\n}\n","/**\n * Isomorphic base64url + UTF-8 codecs. `atob`/`btoa`/`TextEncoder`/`TextDecoder`\n * are globals in modern browsers and Node >= 16, so no platform branch is\n * needed and nothing is bundled.\n */\n\n/** Encode bytes as unpadded base64url. */\nexport function bytesToBase64Url(bytes: Uint8Array): string {\n  let binary = '';\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** Decode base64 or base64url (padding optional) to bytes. */\nexport function base64UrlToBytes(input: string): Uint8Array<ArrayBuffer> {\n  const base64 = input.replace(/-/g, '+').replace(/_/g, '/');\n  const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);\n  const binary = atob(padded);\n  const out = new Uint8Array(new ArrayBuffer(binary.length));\n  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);\n  return out;\n}\n\nexport function utf8ToBytes(text: string): Uint8Array {\n  return new TextEncoder().encode(text);\n}\n\nexport function bytesToUtf8(bytes: Uint8Array): string {\n  return new TextDecoder().decode(bytes);\n}\n","import { bytesToBase64Url } from '../internal/encoding';\nimport { utf8ToBytes } from '../internal/encoding';\n\nexport type ResidentKeyRequirement = 'discouraged' | 'preferred' | 'required';\nexport type UserVerificationRequirement = 'discouraged' | 'preferred' | 'required';\n\nexport interface BuildCreateOptionsInput {\n  rpId: string;\n  rpName: string;\n  userName: string;\n  /** Stable, opaque user handle. Defaults to UTF-8 bytes of `userName`. */\n  userId?: Uint8Array;\n  userDisplayName?: string;\n  /** Raw challenge bytes (base64url-encoded into the options). */\n  challenge: Uint8Array;\n  residentKey?: ResidentKeyRequirement;\n  userVerification?: UserVerificationRequirement;\n  timeout?: number;\n}\n\n/** ES256-only credential parameter. The `alg: -7` literal is non-negotiable. */\nexport interface PubKeyCredParam {\n  type: 'public-key';\n  alg: -7;\n}\n\nexport interface PublicKeyCredentialCreationOptionsJSON {\n  rp: { id: string; name: string };\n  user: { id: string; name: string; displayName: string };\n  challenge: string;\n  pubKeyCredParams: PubKeyCredParam[];\n  authenticatorSelection: {\n    residentKey: ResidentKeyRequirement;\n    requireResidentKey: boolean;\n    userVerification: UserVerificationRequirement;\n  };\n  attestation: 'none';\n  timeout: number;\n}\n\n/**\n * Build WebAuthn registration options that offer ES256 *and only* ES256\n * (`pubKeyCredParams: [{ type: 'public-key', alg: -7 }]`) — invariant #1.\n * Soroban verifies only secp256r1, so we never advertise any other algorithm.\n */\nexport function buildCreateOptions(\n  input: BuildCreateOptionsInput,\n): PublicKeyCredentialCreationOptionsJSON {\n  const residentKey = input.residentKey ?? 'required';\n  return {\n    rp: { id: input.rpId, name: input.rpName },\n    user: {\n      id: bytesToBase64Url(input.userId ?? utf8ToBytes(input.userName)),\n      name: input.userName,\n      displayName: input.userDisplayName ?? input.userName,\n    },\n    challenge: bytesToBase64Url(input.challenge),\n    pubKeyCredParams: [{ type: 'public-key', alg: -7 }],\n    authenticatorSelection: {\n      residentKey,\n      requireResidentKey: residentKey === 'required',\n      userVerification: input.userVerification ?? 'preferred',\n    },\n    attestation: 'none',\n    timeout: input.timeout ?? 60_000,\n  };\n}\n","/** Concatenate byte arrays into one. */\nexport function concatBytes(...arrays: Uint8Array[]): Uint8Array {\n  const total = arrays.reduce((n, a) => n + a.length, 0);\n  const out = new Uint8Array(total);\n  let offset = 0;\n  for (const a of arrays) {\n    out.set(a, offset);\n    offset += a.length;\n  }\n  return out;\n}\n\n/** Length-safe, constant-time-ish byte equality. */\nexport function equalBytes(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i += 1) diff |= (a[i] ?? 0) ^ (b[i] ?? 0);\n  return diff === 0;\n}\n\nexport function bytesToHex(bytes: Uint8Array): string {\n  let hex = '';\n  for (const byte of bytes) hex += byte.toString(16).padStart(2, '0');\n  return hex;\n}\n","/**\n * A minimal CBOR (RFC 8949) decoder — only the major types WebAuthn needs:\n * unsigned ints, negative ints, byte strings, text strings, arrays and maps,\n * with 1/2/4-byte length prefixes. Indefinite lengths, tags, floats and\n * 8-byte lengths are intentionally unsupported (COSE keys and attestation\n * objects never use them) and throw. This keeps the SDK dependency-free while\n * staying robust — it is fully fixture-tested. It replaces passkey-kit's\n * hardcoded byte-offset scanning, which had no bounds checks.\n */\nexport type CborValue = number | bigint | Uint8Array | string | CborValue[] | CborMap;\nexport type CborMap = Map<number | string, CborValue>;\n\ninterface Decoded {\n  value: CborValue;\n  /** Total bytes consumed starting at the requested offset. */\n  length: number;\n}\n\nfunction byteAt(bytes: Uint8Array, index: number): number {\n  const value = bytes[index];\n  if (value === undefined) throw new Error(`CBOR: unexpected end of input at byte ${index}`);\n  return value;\n}\n\n/** Decode the first CBOR item at `offset`, returning its value and byte length. */\nconst MAX_DEPTH = 16; // COSE keys / attestation objects nest at most ~3 levels.\n\nexport function decodeCbor(bytes: Uint8Array, offset = 0, depth = 0): Decoded {\n  if (depth > MAX_DEPTH) throw new Error('CBOR: maximum nesting depth exceeded');\n  const first = byteAt(bytes, offset);\n  const major = first >> 5;\n  const info = first & 0x1f;\n  let pos = offset + 1;\n\n  let argument: number;\n  if (info < 24) {\n    argument = info;\n  } else if (info === 24) {\n    argument = byteAt(bytes, pos);\n    pos += 1;\n  } else if (info === 25) {\n    argument = (byteAt(bytes, pos) << 8) | byteAt(bytes, pos + 1);\n    pos += 2;\n  } else if (info === 26) {\n    argument =\n      byteAt(bytes, pos) * 0x1000000 +\n      (byteAt(bytes, pos + 1) << 16) +\n      (byteAt(bytes, pos + 2) << 8) +\n      byteAt(bytes, pos + 3);\n    pos += 4;\n  } else {\n    throw new Error(`CBOR: unsupported length encoding (additional info ${info})`);\n  }\n\n  switch (major) {\n    case 0: // unsigned integer\n      return { value: argument, length: pos - offset };\n    case 1: // negative integer\n      return { value: -1 - argument, length: pos - offset };\n    case 2: {\n      // byte string\n      const end = pos + argument;\n      if (end > bytes.length) throw new Error('CBOR: byte string exceeds input');\n      return { value: bytes.slice(pos, end), length: end - offset };\n    }\n    case 3: {\n      // text string (UTF-8)\n      const end = pos + argument;\n      if (end > bytes.length) throw new Error('CBOR: text string exceeds input');\n      return { value: new TextDecoder().decode(bytes.slice(pos, end)), length: end - offset };\n    }\n    case 4: {\n      // array\n      const items: CborValue[] = [];\n      let cursor = pos;\n      for (let i = 0; i < argument; i += 1) {\n        const item = decodeCbor(bytes, cursor, depth + 1);\n        items.push(item.value);\n        cursor += item.length;\n      }\n      return { value: items, length: cursor - offset };\n    }\n    case 5: {\n      // map\n      const map: CborMap = new Map();\n      let cursor = pos;\n      for (let i = 0; i < argument; i += 1) {\n        const key = decodeCbor(bytes, cursor, depth + 1);\n        cursor += key.length;\n        const val = decodeCbor(bytes, cursor, depth + 1);\n        cursor += val.length;\n        if (typeof key.value !== 'number' && typeof key.value !== 'string') {\n          throw new Error('CBOR: unsupported map key type');\n        }\n        if (map.has(key.value)) {\n          throw new Error('CBOR: duplicate map key (non-canonical)');\n        }\n        map.set(key.value, val.value);\n      }\n      return { value: map, length: cursor - offset };\n    }\n    default:\n      throw new Error(`CBOR: unsupported major type ${major}`);\n  }\n}\n\nexport function decodeCborFirst(bytes: Uint8Array): CborValue {\n  return decodeCbor(bytes, 0).value;\n}\n","import { KitError } from '../errors';\nimport { decodeCbor } from '../internal/cbor';\nimport { sha256 } from '../internal/sha256';\nimport { equalBytes } from '../internal/bytes';\nimport { utf8ToBytes } from '../internal/encoding';\n\nexport interface AuthenticatorDataFlags {\n  /** User Present */\n  up: boolean;\n  /** User Verified */\n  uv: boolean;\n  /** Backup Eligible */\n  be: boolean;\n  /** Backup State */\n  bs: boolean;\n  /** Attested credential data present */\n  at: boolean;\n  /** Extension data present */\n  ed: boolean;\n  /** Raw flags byte. */\n  bits: number;\n}\n\nexport interface ParsedAuthenticatorData {\n  rpIdHash: Uint8Array;\n  flags: AuthenticatorDataFlags;\n  signCount: number;\n  aaguid?: Uint8Array;\n  credentialId?: Uint8Array;\n  /** Raw CBOR-encoded COSE public key (exact bytes), if attested data present. */\n  credentialPublicKey?: Uint8Array;\n}\n\nconst MIN_LENGTH = 37; // rpIdHash(32) + flags(1) + signCount(4)\n\n/** Parse the authenticatorData byte structure (WebAuthn §6.1). */\nexport function parseAuthenticatorData(authData: Uint8Array): ParsedAuthenticatorData {\n  if (authData.length < MIN_LENGTH) {\n    throw new KitError(\n      'UNSUPPORTED_AUTHENTICATOR',\n      `authenticatorData is ${authData.length} bytes, expected at least ${MIN_LENGTH}`,\n    );\n  }\n  const view = new DataView(authData.buffer, authData.byteOffset, authData.byteLength);\n  const rpIdHash = authData.slice(0, 32);\n  const bits = authData[32] ?? 0;\n  const flags: AuthenticatorDataFlags = {\n    up: (bits & 0x01) !== 0,\n    uv: (bits & 0x04) !== 0,\n    be: (bits & 0x08) !== 0,\n    bs: (bits & 0x10) !== 0,\n    at: (bits & 0x40) !== 0,\n    ed: (bits & 0x80) !== 0,\n    bits,\n  };\n  const signCount = view.getUint32(33, false);\n\n  const result: ParsedAuthenticatorData = { rpIdHash, flags, signCount };\n\n  if (flags.at) {\n    if (authData.length < 55) {\n      throw new KitError(\n        'UNSUPPORTED_AUTHENTICATOR',\n        'authenticatorData truncated in attested data',\n      );\n    }\n    result.aaguid = authData.slice(37, 53);\n    const credIdLength = view.getUint16(53, false);\n    const credIdEnd = 55 + credIdLength;\n    if (authData.length < credIdEnd) {\n      throw new KitError(\n        'UNSUPPORTED_AUTHENTICATOR',\n        'authenticatorData truncated in credentialId',\n      );\n    }\n    result.credentialId = authData.slice(55, credIdEnd);\n    // The COSE public key is the next CBOR item; capture its exact bytes so we\n    // stop cleanly before any extension data (when flags.ed is set).\n    const rest = authData.slice(credIdEnd);\n    const { length } = decodeCbor(rest, 0);\n    result.credentialPublicKey = rest.slice(0, length);\n  }\n\n  return result;\n}\n\n/** Verify that authenticatorData's rpIdHash equals SHA-256(rpId). */\nexport function verifyRpIdHash(authData: Uint8Array, rpId: string): void {\n  const actual = parseAuthenticatorData(authData).rpIdHash;\n  const expected = sha256(utf8ToBytes(rpId));\n  if (!equalBytes(actual, expected)) {\n    throw new KitError(\n      'RP_ID_MISMATCH',\n      `authenticatorData rpIdHash does not match SHA-256(\"${rpId}\")`,\n    );\n  }\n}\n","import { p256 } from '@noble/curves/nist';\nimport { KitError } from '../errors';\nimport { concatBytes } from '../internal/bytes';\nimport { decodeCborFirst, type CborMap } from '../internal/cbor';\nimport { parseAuthenticatorData } from './authData';\nimport { assertES256 } from '../anchors';\n\n// COSE key common parameters (RFC 9052) and EC2 key parameters.\nconst COSE_KTY = 1;\nconst COSE_ALG = 3;\nconst COSE_CRV = -1;\nconst COSE_X = -2;\nconst COSE_Y = -3;\n\nconst KTY_EC2 = 2;\nconst CRV_P256 = 1;\n\n/**\n * Convert a CBOR-encoded COSE EC2 public key to the 65-byte SEC-1 uncompressed\n * point `0x04 ‖ X ‖ Y`. Enforces ES256/P-256 — anything else (e.g. RS256)\n * throws `ES256_NOT_SUPPORTED` (invariant #1).\n */\nexport function coseKeyToSec1(coseKey: Uint8Array): Uint8Array {\n  let decoded: ReturnType<typeof decodeCborFirst>;\n  try {\n    decoded = decodeCborFirst(coseKey);\n  } catch (cause) {\n    throw new KitError('INVALID_PUBLIC_KEY', 'failed to CBOR-decode COSE key', { cause });\n  }\n  if (!(decoded instanceof Map)) {\n    throw new KitError('INVALID_PUBLIC_KEY', 'COSE key is not a CBOR map');\n  }\n  const map = decoded as CborMap;\n  const alg = map.get(COSE_ALG);\n  if (typeof alg !== 'number') {\n    throw new KitError('ES256_NOT_SUPPORTED', `COSE alg ${String(alg)} is not ES256 (-7)`);\n  }\n  assertES256(alg); // anchor RS256_HARD_FAIL\n  if (map.get(COSE_KTY) !== KTY_EC2) {\n    throw new KitError(\n      'INVALID_PUBLIC_KEY',\n      `COSE kty ${String(map.get(COSE_KTY))} is not EC2 (2)`,\n    );\n  }\n  if (map.get(COSE_CRV) !== CRV_P256) {\n    throw new KitError(\n      'INVALID_PUBLIC_KEY',\n      `COSE crv ${String(map.get(COSE_CRV))} is not P-256 (1)`,\n    );\n  }\n  const x = map.get(COSE_X);\n  const y = map.get(COSE_Y);\n  if (!(x instanceof Uint8Array) || x.length !== 32) {\n    throw new KitError('INVALID_PUBLIC_KEY', 'COSE key X coordinate is not 32 bytes');\n  }\n  if (!(y instanceof Uint8Array) || y.length !== 32) {\n    throw new KitError('INVALID_PUBLIC_KEY', 'COSE key Y coordinate is not 32 bytes');\n  }\n  const sec1 = concatBytes(new Uint8Array([0x04]), x, y);\n  // Reject off-curve / invalid points so an invalid key can never be persisted.\n  try {\n    p256.Point.fromHex(sec1);\n  } catch (cause) {\n    throw new KitError('INVALID_PUBLIC_KEY', 'public key is not a valid P-256 point', { cause });\n  }\n  return sec1;\n}\n\n/** Extract the SEC-1 public key from raw authenticatorData (attested data). */\nexport function extractPublicKeyFromAuthData(authData: Uint8Array): Uint8Array {\n  const parsed = parseAuthenticatorData(authData);\n  if (!parsed.credentialPublicKey) {\n    throw new KitError(\n      'INVALID_PUBLIC_KEY',\n      'authenticatorData has no attested credential public key',\n    );\n  }\n  return coseKeyToSec1(parsed.credentialPublicKey);\n}\n\n/** Extract the SEC-1 public key from a CBOR attestationObject (create ceremony). */\nexport function extractPublicKeyFromAttestationObject(attestationObject: Uint8Array): Uint8Array {\n  let decoded: ReturnType<typeof decodeCborFirst>;\n  try {\n    decoded = decodeCborFirst(attestationObject);\n  } catch (cause) {\n    throw new KitError('INVALID_PUBLIC_KEY', 'failed to CBOR-decode attestationObject', { cause });\n  }\n  if (!(decoded instanceof Map)) {\n    throw new KitError('INVALID_PUBLIC_KEY', 'attestationObject is not a CBOR map');\n  }\n  const authData = (decoded as CborMap).get('authData');\n  if (!(authData instanceof Uint8Array)) {\n    throw new KitError('INVALID_PUBLIC_KEY', 'attestationObject has no authData byte string');\n  }\n  return extractPublicKeyFromAuthData(authData);\n}\n","import { KitError } from '../errors';\n\n/**\n * Cryptographically-random bytes, isomorphic (browser + Node global crypto).\n * Throws instead of silently returning all-zero bytes when no secure RNG is\n * present — an all-zero challenge would be catastrophic, not a soft fallback.\n */\nexport function randomBytes(length: number): Uint8Array<ArrayBuffer> {\n  const webcrypto = globalThis.crypto as Crypto | undefined;\n  if (typeof webcrypto?.getRandomValues !== 'function') {\n    throw new KitError(\n      'UNSUPPORTED_AUTHENTICATOR',\n      'no secure random source (globalThis.crypto.getRandomValues) is available in this environment',\n    );\n  }\n  const out = new Uint8Array(new ArrayBuffer(length));\n  webcrypto.getRandomValues(out);\n  return out;\n}\n","import { KitError } from '../errors';\nimport { base64UrlToBytes } from '../internal/encoding';\nimport type { PublicKeyCredentialCreationOptionsJSON } from '../webauthn/createOptions';\nimport { randomBytes } from './random';\nimport type {\n  CredentialStorage,\n  WebAuthnClient,\n  WebAuthnCreateResult,\n  WebAuthnGetOptions,\n  WebAuthnGetResult,\n} from './types';\n\n/**\n * Map a `navigator.credentials` rejection to a `KitError`. Dismissing the OS\n * passkey sheet rejects with a `NotAllowedError` (a DOMException) — surface that\n * as `USER_CANCELLED` so the UI shows the true \"you cancelled\" copy instead of\n * the generic unsupported-authenticator fallback (S20 / S04 polish).\n */\nfunction asKitError(error: unknown): KitError {\n  if (error instanceof KitError) return error;\n  const name =\n    typeof error === 'object' && error !== null && 'name' in error\n      ? (error as { name?: unknown }).name\n      : undefined;\n  if (name === 'NotAllowedError') {\n    return new KitError('USER_CANCELLED', 'The passkey prompt was dismissed.', { cause: error });\n  }\n  const message = error instanceof Error ? error.message : 'WebAuthn request failed';\n  // Preserve the original DOMException name (e.g. InvalidStateError / ConstraintError)\n  // in the message so diagnostics show the true cause, not just the generic bucket.\n  const detail = typeof name === 'string' ? `${name}: ${message}` : message;\n  return new KitError('UNSUPPORTED_AUTHENTICATOR', detail, { cause: error });\n}\n\n/** The browser `WebAuthnClient` backed by `navigator.credentials`. */\nexport function browserWebAuthnClient(): WebAuthnClient {\n  const credentials = (globalThis as { navigator?: Navigator }).navigator?.credentials;\n  if (!credentials) {\n    throw new KitError('UNSUPPORTED_AUTHENTICATOR', 'navigator.credentials is unavailable');\n  }\n  return {\n    async create(options: PublicKeyCredentialCreationOptionsJSON): Promise<WebAuthnCreateResult> {\n      const publicKey: PublicKeyCredentialCreationOptions = {\n        challenge: base64UrlToBytes(options.challenge),\n        rp: options.rp,\n        user: {\n          id: base64UrlToBytes(options.user.id),\n          name: options.user.name,\n          displayName: options.user.displayName,\n        },\n        pubKeyCredParams: options.pubKeyCredParams,\n        authenticatorSelection: options.authenticatorSelection,\n        attestation: options.attestation,\n        timeout: options.timeout,\n      };\n      let credential: PublicKeyCredential | null;\n      try {\n        credential = (await credentials.create({ publicKey })) as PublicKeyCredential | null;\n      } catch (error) {\n        throw asKitError(error);\n      }\n      if (!credential) throw new KitError('USER_CANCELLED', 'credential creation returned null');\n      const response = credential.response as AuthenticatorAttestationResponse;\n      return {\n        id: credential.id,\n        rawId: new Uint8Array(credential.rawId),\n        attestationObject: new Uint8Array(response.attestationObject),\n      };\n    },\n    async get(options: WebAuthnGetOptions): Promise<WebAuthnGetResult> {\n      const publicKey: PublicKeyCredentialRequestOptions = {\n        rpId: options.rpId,\n        challenge: options.challenge ? new Uint8Array(options.challenge) : randomBytes(32),\n        allowCredentials: (options.allowCredentials ?? []).map((id) => ({\n          type: 'public-key',\n          id: base64UrlToBytes(id),\n        })),\n        userVerification: options.userVerification,\n      };\n      const request: CredentialRequestOptions = { publicKey };\n      if (options.mediation) request.mediation = options.mediation;\n      let credential: PublicKeyCredential | null;\n      try {\n        credential = (await credentials.get(request)) as PublicKeyCredential | null;\n      } catch (error) {\n        throw asKitError(error);\n      }\n      if (!credential) throw new KitError('USER_CANCELLED', 'assertion returned null');\n      const response = credential.response as AuthenticatorAssertionResponse;\n      return {\n        id: credential.id,\n        rawId: new Uint8Array(credential.rawId),\n        authenticatorData: new Uint8Array(response.authenticatorData),\n        clientDataJSON: new Uint8Array(response.clientDataJSON),\n        signature: new Uint8Array(response.signature),\n      };\n    },\n  };\n}\n\n/** localStorage-backed credential store, with an in-memory fallback (Node/SSR). */\nexport function defaultCredentialStorage(): CredentialStorage {\n  const key = (rpId: string): string => `stellar-passkey:${rpId}`;\n  const ls = (globalThis as { localStorage?: Storage }).localStorage;\n  if (ls) {\n    return {\n      get: (rpId) => ls.getItem(key(rpId)),\n      set: (rpId, credentialId) => {\n        ls.setItem(key(rpId), credentialId);\n      },\n    };\n  }\n  const memory = new Map<string, string>();\n  return {\n    get: (rpId) => memory.get(rpId) ?? null,\n    set: (rpId, credentialId) => {\n      memory.set(rpId, credentialId);\n    },\n  };\n}\n","import { assertUserActivation } from '../anchors';\nimport { buildCreateOptions } from '../webauthn/createOptions';\nimport { extractPublicKeyFromAttestationObject } from '../webauthn/publicKey';\nimport type { PasskeyCredential } from '../types';\nimport { browserWebAuthnClient, defaultCredentialStorage } from './browserClient';\nimport { randomBytes } from './random';\nimport type { AccountDeployer, CredentialStorage, WebAuthnClient } from './types';\n\nexport interface CreatePasskeyOptions {\n  rpId: string;\n  rpName: string;\n  userName: string;\n  /** Deploys the smart account for the new passkey (contract-specific; see AccountDeployer). */\n  deployer: AccountDeployer;\n  webauthn?: WebAuthnClient;\n  storage?: CredentialStorage;\n  userId?: Uint8Array;\n  challenge?: Uint8Array;\n  residentKey?: 'discouraged' | 'preferred' | 'required';\n  userVerification?: 'discouraged' | 'preferred' | 'required';\n  /** Pass navigator.userActivation to enforce the Safari gesture requirement (S04). */\n  userActivation?: { isActive: boolean };\n}\n\n/** Options for {@link registerPasskey} — a create WITHOUT deploy (see below). */\nexport type RegisterPasskeyOptions = Omit<CreatePasskeyOptions, 'deployer' | 'storage'>;\n\n/** A freshly-registered passkey credential (no account deployed yet). */\nexport interface RegisteredPasskey {\n  /** base64url credential id returned by the authenticator. */\n  credentialId: string;\n  /** SEC-1 uncompressed public key (65 bytes). */\n  publicKey: Uint8Array;\n}\n\n/**\n * `registerPasskey` — register an ES256-only passkey and extract its SEC-1 public\n * key (RS256 hard-fails), but do NOT deploy an account or persist anything. This\n * is the \"new device\" primitive for multi-device recovery: a fresh device\n * produces a `{credentialId, publicKey}` signer spec that an existing device then\n * authorizes on-chain via `addSigner`. (`createPasskey` is this plus a deploy.)\n */\nexport async function registerPasskey(options: RegisterPasskeyOptions): Promise<RegisteredPasskey> {\n  assertUserActivation(options.userActivation); // anchor: apple-user-gesture (S04)\n  const webauthn = options.webauthn ?? browserWebAuthnClient();\n\n  const creationOptions = buildCreateOptions({\n    rpId: options.rpId,\n    rpName: options.rpName,\n    userName: options.userName,\n    userId: options.userId,\n    challenge: options.challenge ?? randomBytes(32),\n    residentKey: options.residentKey,\n    userVerification: options.userVerification,\n  });\n\n  const credential = await webauthn.create(creationOptions);\n  // ES256-only enforcement happens here: a non-ES256 credential throws ES256_NOT_SUPPORTED.\n  const publicKey = extractPublicKeyFromAttestationObject(credential.attestationObject);\n  return { credentialId: credential.id, publicKey };\n}\n\n/**\n * `createPasskey` — register an ES256-only passkey (see {@link registerPasskey}),\n * deploy a smart account for it via the factory, persist the credential id, and\n * return the account.\n */\nexport async function createPasskey(options: CreatePasskeyOptions): Promise<PasskeyCredential> {\n  const storage = options.storage ?? defaultCredentialStorage();\n  const { credentialId, publicKey } = await registerPasskey(options);\n  const { contractId } = await options.deployer.deploy({ publicKey, credentialId });\n  storage.set(options.rpId, credentialId);\n  return { contractId, credentialId, publicKey };\n}\n","import { KitError } from '../errors';\nimport { base64UrlToBytes, bytesToBase64Url, bytesToUtf8 } from '../internal/encoding';\n\n/** The subset of clientDataJSON fields we rely on. */\nexport interface ClientData {\n  type: string;\n  /** base64url-encoded challenge as embedded by the client. */\n  challenge: string;\n  origin: string;\n  crossOrigin?: boolean;\n}\n\n/** Encode a raw challenge as the base64url string embedded in clientDataJSON. */\nexport function encodeChallenge(challenge: Uint8Array): string {\n  return bytesToBase64Url(challenge);\n}\n\n/** Decode the base64url challenge embedded in clientDataJSON back to bytes. */\nexport function decodeChallenge(challenge: string): Uint8Array {\n  return base64UrlToBytes(challenge);\n}\n\n/** Parse clientDataJSON bytes into a typed, validated-shape object. */\nexport function parseClientDataJSON(clientDataJSON: Uint8Array): ClientData {\n  let raw: unknown;\n  try {\n    raw = JSON.parse(bytesToUtf8(clientDataJSON));\n  } catch (cause) {\n    throw new KitError('UNSUPPORTED_AUTHENTICATOR', 'clientDataJSON is not valid JSON', { cause });\n  }\n  if (typeof raw !== 'object' || raw === null) {\n    throw new KitError('UNSUPPORTED_AUTHENTICATOR', 'clientDataJSON is not a JSON object');\n  }\n  const obj = raw as Record<string, unknown>;\n  const { type, challenge, origin, crossOrigin } = obj;\n  if (typeof type !== 'string' || typeof challenge !== 'string' || typeof origin !== 'string') {\n    throw new KitError('UNSUPPORTED_AUTHENTICATOR', 'clientDataJSON is missing required fields');\n  }\n  return {\n    type,\n    challenge,\n    origin,\n    crossOrigin: typeof crossOrigin === 'boolean' ? crossOrigin : undefined,\n  };\n}\n\n/**\n * Parse and verify clientDataJSON for an authentication (`webauthn.get`)\n * assertion: the ceremony type, the origin (exact match against one or more\n * allowed origins), and the embedded challenge (base64url string).\n */\nexport function verifyClientDataJSON(\n  clientDataJSON: Uint8Array,\n  expected: { origin: string | string[]; challenge: string },\n): ClientData {\n  const data = parseClientDataJSON(clientDataJSON);\n  if (data.type !== 'webauthn.get') {\n    throw new KitError(\n      'UNSUPPORTED_AUTHENTICATOR',\n      `clientDataJSON.type \"${data.type}\" is not \"webauthn.get\"`,\n    );\n  }\n  const allowed = Array.isArray(expected.origin) ? expected.origin : [expected.origin];\n  if (!allowed.includes(data.origin)) {\n    throw new KitError('ORIGIN_MISMATCH', `origin \"${data.origin}\" not in [${allowed.join(', ')}]`);\n  }\n  if (data.challenge !== expected.challenge) {\n    throw new KitError('CHALLENGE_MISMATCH', 'clientDataJSON challenge does not match expected');\n  }\n  return data;\n}\n","import { Address, StrKey, hash, xdr } from '@stellar/stellar-sdk';\nimport { sha256 } from '@noble/hashes/sha256';\nimport { KitError } from '../errors';\nimport { decodeChallenge } from '../webauthn/clientData';\n\n/** The createCustomContract C-address from a deployer address + 32-byte salt (no network round-trip). */\nfunction contractIdFromDeployerSalt(\n  deployer: string,\n  salt: Uint8Array,\n  networkPassphrase: string,\n): string {\n  let address: xdr.ScAddress;\n  try {\n    address = Address.fromString(deployer).toScAddress();\n  } catch (cause) {\n    throw new KitError('CONTRACT_AUTH_FAILED', `invalid deployer address \"${deployer}\"`, { cause });\n  }\n  const preimage = xdr.HashIdPreimage.envelopeTypeContractId(\n    new xdr.HashIdPreimageContractId({\n      networkId: hash(Buffer.from(networkPassphrase)),\n      contractIdPreimage: xdr.ContractIdPreimage.contractIdPreimageFromAddress(\n        new xdr.ContractIdPreimageFromAddress({\n          address,\n          salt: Buffer.from(salt),\n        }),\n      ),\n    }),\n  );\n  return StrKey.encodeContract(hash(preimage.toXDR()));\n}\n\nexport interface DeriveAccountAddressOptions {\n  /** The AccountFactory contract C-address — the deployer. */\n  factoryContractId: string;\n  /** The credential-id bytes the factory salts by SHA-256 (utf-8 of the base64url id in our factory). */\n  credentialId: Uint8Array;\n  networkPassphrase: string;\n}\n\n/**\n * Derive the deterministic C-address of the `webauthn-account` our AccountFactory\n * deploys for a passkey — with NO network round-trip. The factory salts by\n * `sha256(credential_id)` and deploys with `deployer().with_current_contract(salt)`.\n * Verified against the on-chain `factoryDeployProof` in `contracts/deployments.json`\n * (credential `democred` → `CAGWE36M…`). For the passkey-kit v1 smart-wallet, use\n * {@link deriveSmartWalletAddress} instead (different deployer + salt-input scheme).\n */\nexport function deriveAccountAddress(options: DeriveAccountAddressOptions): string {\n  const { factoryContractId, credentialId, networkPassphrase } = options;\n  if (credentialId.length === 0) {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'deriveAccountAddress: empty credential id');\n  }\n  return contractIdFromDeployerSalt(\n    factoryContractId,\n    hash(Buffer.from(credentialId)), // e.crypto().sha256(credential_id)\n    networkPassphrase,\n  );\n}\n\nexport interface DeriveSmartWalletAddressOptions {\n  /**\n   * The account that deploys the wallet via `createCustomContract` — a classic\n   * G-address (or a factory C-address). MUST be stable for offline `getAddress`.\n   */\n  deployer: string;\n  /** base64url WebAuthn credential id of the FOUNDING passkey — its RAW bytes are salted. */\n  credentialId: string;\n  networkPassphrase: string;\n}\n\n/**\n * Derive the deterministic C-address of a passkey-kit **v1 smart-wallet** — offline,\n * no network. Mirrors passkey-kit's scheme exactly: `salt = sha256(rawCredentialId)`\n * (the base64url-decoded credential-id bytes), deployed by a fixed `deployer`\n * account via `createCustomContract`. Proven on-chain (`scripts/v1-events-probe.ts`:\n * derived id === deployed id).\n *\n * This only recovers the address for the wallet's FOUNDING credential (the one used\n * as the deploy salt). Signers added later via `add_signer` do not change the\n * address and cannot be reversed into it — resolve those through the events indexer\n * ({@link smartWalletV1Indexer}).\n */\nexport function deriveSmartWalletAddress(options: DeriveSmartWalletAddressOptions): string {\n  const raw = decodeChallenge(options.credentialId);\n  if (raw.length === 0) {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'deriveSmartWalletAddress: empty credential id');\n  }\n  return contractIdFromDeployerSalt(options.deployer, sha256(raw), options.networkPassphrase);\n}\n","import { p256 } from '@noble/curves/nist';\nimport { KitError } from '../errors';\n\n/** Maximum DER length of a P-256 ECDSA signature: SEQ + two 33-byte INTEGERs. */\nconst MAX_DER_LENGTH = 72;\n\n/**\n * Convert an ASN.1 DER ECDSA signature to the 64-byte raw `R‖S` form Soroban's\n * `secp256r1_verify` expects, using noble's audited DER parser (R and S are\n * left-padded to 32 bytes big-endian). Rejects malformed or over-long input.\n *\n * Note: this does NOT enforce low-S — that normalization is added in S04\n * (YK-430). The output here mirrors the signature exactly as parsed.\n */\nexport function derToCompact(der: Uint8Array): Uint8Array {\n  if (der.length > MAX_DER_LENGTH) {\n    throw new KitError(\n      'INVALID_SIGNATURE_DER',\n      `DER signature is ${der.length} bytes, exceeds max ${MAX_DER_LENGTH}`,\n    );\n  }\n  try {\n    return p256.Signature.fromDER(der).toCompactRawBytes();\n  } catch (cause) {\n    throw new KitError('INVALID_SIGNATURE_DER', 'failed to parse DER signature', { cause });\n  }\n}\n\nfunction assertCompactLength(compactSignature: Uint8Array): void {\n  if (compactSignature.length !== 64) {\n    throw new KitError(\n      'INVALID_SIGNATURE_DER',\n      `compact signature must be 64 bytes, got ${compactSignature.length}`,\n    );\n  }\n}\n\n/** True if a 64-byte compact signature is in canonical low-S form (S ≤ n/2). */\nexport function isLowS(compactSignature: Uint8Array): boolean {\n  assertCompactLength(compactSignature);\n  return !p256.Signature.fromCompact(compactSignature).hasHighS();\n}\n\n/**\n * Normalize a 64-byte compact signature to canonical low-S: if S > n/2, replace\n * S with n − S (anchor LOW_S_NORMALIZATION, invariant #2). ~50% of Apple Touch\n * ID / Face ID assertions are high-S and Soroban's `secp256r1_verify` does not\n * enforce low-S, so the SDK MUST emit low-S before a signature reaches a\n * contract. Idempotent: low-S input is returned unchanged.\n */\nexport function normalizeLowS(compactSignature: Uint8Array): Uint8Array {\n  assertCompactLength(compactSignature);\n  return p256.Signature.fromCompact(compactSignature).normalizeS().toCompactRawBytes();\n}\n\n/** DER → 64-byte canonical low-S compact — the conversion the signing ceremony uses. */\nexport function derToCompactLowS(der: Uint8Array): Uint8Array {\n  return normalizeLowS(derToCompact(der));\n}\n","import { sha256 } from '../internal/sha256';\nimport { concatBytes } from '../internal/bytes';\n\n/**\n * Reconstruct the 32-byte payload the authenticator signed and that Soroban's\n * `__check_auth` re-derives on-chain:\n *\n *   SHA256( authenticatorData ‖ SHA256(clientDataJSON) )\n */\nexport function reconstructSignedPayload(input: {\n  authenticatorData: Uint8Array;\n  clientDataJSON: Uint8Array;\n}): Uint8Array {\n  const clientDataHash = sha256(input.clientDataJSON);\n  return sha256(concatBytes(input.authenticatorData, clientDataHash));\n}\n","import { p256 } from '@noble/curves/nist';\nimport { reconstructSignedPayload } from './payload';\nimport { derToCompact } from './signature';\n\nexport interface VerifyAssertionInput {\n  /** SEC-1 uncompressed public key (65 bytes, `0x04 ‖ X ‖ Y`). */\n  publicKey: Uint8Array;\n  authenticatorData: Uint8Array;\n  clientDataJSON: Uint8Array;\n  /** DER-encoded (≤72 B) or already-compact (64 B) signature. */\n  signature: Uint8Array;\n}\n\n/**\n * Verify a WebAuthn assertion the way the on-chain `secp256r1_verify` does:\n * reconstruct `SHA256(authData ‖ SHA256(cdj))` and check ECDSA. `lowS: false`\n * mirrors the host function, which does NOT enforce low-S (we normalize\n * separately before submitting — see S04/YK-430).\n */\nexport function verifyAssertionSignature(input: VerifyAssertionInput): boolean {\n  const payload = reconstructSignedPayload(input);\n  const compact = input.signature.length === 64 ? input.signature : derToCompact(input.signature);\n  // `format: 'compact'` pins the 64-byte interpretation — without it noble tries\n  // DER-first and could misread a compact signature that happens to start 0x30.\n  return p256.verify(compact, payload, input.publicKey, { lowS: false, format: 'compact' });\n}\n","import { base64UrlToBytes } from '../internal/encoding';\nimport type { AssertionResult, WebAuthnSigner } from '../soroban/sign';\nimport { browserWebAuthnClient } from './browserClient';\nimport type { WebAuthnClient } from './types';\n\nexport interface BrowserPasskeySignerOptions {\n  /** The Relying Party ID (your site's registrable domain). */\n  rpId: string;\n  /**\n   * Restrict the prompt to specific credential ids (base64url) — pass the\n   * `credentialId` from `create` / `connect` so the OS offers the right passkey.\n   * Omit (or leave empty) for a discoverable prompt over any resident passkey.\n   */\n  allowCredentials?: string[];\n  userVerification?: 'discouraged' | 'preferred' | 'required';\n  /** Inject a custom client (tests / non-browser). Defaults to `browserWebAuthnClient()`. */\n  webauthn?: WebAuthnClient;\n}\n\n/**\n * Adapt `navigator.credentials.get` into the `WebAuthnSigner` that\n * `signTransaction` / `signAuthEntry` expect — so wiring a passkey is one line:\n *\n * ```ts\n * const sign = browserPasskeySigner({ rpId, allowCredentials: [credentialId] });\n * const signedXdr = await signTransaction(txXdr, { networkPassphrase, sign });\n * ```\n *\n * The SDK hands the signer a base64url challenge (the Soroban auth preimage);\n * this decodes it to the raw bytes WebAuthn signs over, runs the assertion, and\n * returns the fields the auth assembler needs. The DER signature is low-S\n * normalized downstream (invariant #2) — nothing here weakens that.\n */\nexport function browserPasskeySigner(options: BrowserPasskeySignerOptions): WebAuthnSigner {\n  const webauthn = options.webauthn ?? browserWebAuthnClient();\n  return async (challenge: string): Promise<AssertionResult> => {\n    const assertion = await webauthn.get({\n      rpId: options.rpId,\n      challenge: base64UrlToBytes(challenge),\n      allowCredentials: options.allowCredentials ?? [],\n      userVerification: options.userVerification ?? 'preferred',\n    });\n    return {\n      authenticatorData: assertion.authenticatorData,\n      clientDataJSON: assertion.clientDataJSON,\n      signature: assertion.signature,\n      credentialId: assertion.rawId,\n    };\n  };\n}\n","import { xdr, hash } from '@stellar/stellar-sdk';\nimport { KitError } from '../errors';\nimport { bytesToBase64Url, utf8ToBytes } from '../internal/encoding';\n\n/**\n * Compute the auth-entry preimage hash that `__check_auth` reconstructs and that\n * becomes the WebAuthn `challenge`:\n *   SHA256( XDR( HashIdPreimage::SorobanAuthorization{ networkId, nonce,\n *   signatureExpirationLedger, invocation } ) )\n * where networkId = SHA256(networkPassphrase).\n */\nexport function authEntryChallengeBytes(\n  entry: xdr.SorobanAuthorizationEntry,\n  networkPassphrase: string,\n): Uint8Array {\n  const credentials = entry.credentials();\n  if (credentials.switch().name !== 'sorobanCredentialsAddress') {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'auth entry has no address credentials to sign');\n  }\n  const address = credentials.address();\n  const preimage = xdr.HashIdPreimage.envelopeTypeSorobanAuthorization(\n    new xdr.HashIdPreimageSorobanAuthorization({\n      networkId: Buffer.from(hash(Buffer.from(utf8ToBytes(networkPassphrase)))),\n      nonce: address.nonce(),\n      signatureExpirationLedger: address.signatureExpirationLedger(),\n      invocation: entry.rootInvocation(),\n    }),\n  );\n  return new Uint8Array(hash(preimage.toXDR()));\n}\n\n/** The base64url challenge string the authenticator signs (43 chars). */\nexport function authEntryChallenge(\n  entry: xdr.SorobanAuthorizationEntry,\n  networkPassphrase: string,\n): string {\n  return bytesToBase64Url(authEntryChallengeBytes(entry, networkPassphrase));\n}\n","import { xdr } from '@stellar/stellar-sdk';\nimport type { AssertionResult } from './sign';\n\n/**\n * Set an address-credential auth entry's signature to the `Secp256r1Signature`\n * struct the on-chain `__check_auth` consumes:\n *\n *   ScVal::Map { authenticator_data: Bytes, client_data_json: Bytes, signature: BytesN<64> }\n *\n * Map keys are alphabetical, so the ScMap is canonically sorted as Soroban\n * requires. `signature` MUST already be 64-byte low-S compact (`signAuthEntry`\n * normalizes before calling this). This is the exact shape the audited\n * webauthn-verifier reference expects — proven on testnet by the on-chain\n * integration test (scripts/onchain-e2e.ts).\n */\nexport function applyAssertionToEntry(\n  entry: xdr.SorobanAuthorizationEntry,\n  assertion: AssertionResult,\n): xdr.SorobanAuthorizationEntry {\n  entry.credentials().address().signature(buildSignatureScVal(assertion));\n  return entry;\n}\n\n/** The `Secp256r1Signature` ScVal — a contracttype struct → sorted ScMap. */\nexport function buildSignatureScVal(assertion: AssertionResult): xdr.ScVal {\n  return xdr.ScVal.scvMap([\n    bytesField('authenticator_data', assertion.authenticatorData),\n    bytesField('client_data_json', assertion.clientDataJSON),\n    bytesField('signature', assertion.signature),\n  ]);\n}\n\nfunction bytesField(name: string, bytes: Uint8Array): xdr.ScMapEntry {\n  return new xdr.ScMapEntry({\n    key: xdr.ScVal.scvSymbol(name),\n    val: xdr.ScVal.scvBytes(Buffer.from(bytes)),\n  });\n}\n","import { xdr } from '@stellar/stellar-sdk';\nimport { KitError } from '../errors';\nimport { buildSignatureScVal } from './assemble';\nimport type { AssertionResult } from './sign';\n\n/**\n * The passkey-kit / `webauthn-wallet` smart-wallet ABI target.\n *\n * Our own single-signer account declares `type Signature = Secp256r1Signature`\n * and consumes the bare struct (see `assemble.ts`). passkey-kit's smart-wallet\n * declares `type Signature = Signatures`, so authorizing it needs the assertion\n * wrapped as `Signatures(Map<SignerKey, Signature>)`. The exact shape, the raw-\n * credential-id key, and the canonical map ordering below are confirmed by\n * kalepail (passkey-kit author) in issue #32 against v1 / v0.13.0 (Protocol 27,\n * independently audited); the wire shape is unchanged from v0.12.\n */\n\n/**\n * `SignerKey::Secp256r1(Bytes)` → `scvVec([Symbol(\"Secp256r1\"), Bytes(rawId)])`.\n * The key is the RAW WebAuthn credential-id bytes (base64url-decoded `rawId`):\n * never hashed, never the UTF-8 of the base64url string, and never the public\n * key — the SEC-1 public key lives in `SignerVal` on-chain, not in the key.\n */\nexport function buildSignerKeyScVal(credentialId: Uint8Array): xdr.ScVal {\n  return xdr.ScVal.scvVec([\n    xdr.ScVal.scvSymbol('Secp256r1'),\n    xdr.ScVal.scvBytes(Buffer.from(credentialId)),\n  ]);\n}\n\n/** `Signature::Secp256r1(Secp256r1Signature)` → `scvVec([Symbol(\"Secp256r1\"), <bare struct map>])`. */\nexport function buildSmartWalletSignatureVariant(assertion: AssertionResult): xdr.ScVal {\n  return xdr.ScVal.scvVec([xdr.ScVal.scvSymbol('Secp256r1'), buildSignatureScVal(assertion)]);\n}\n\nfunction decomposeSignerKey(key: xdr.ScVal): { variant: string; payload: Uint8Array } {\n  const vec = key.vec();\n  if (!vec || vec.length < 2) {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'malformed SignerKey (expected an enum vec)');\n  }\n  const variant = vec[0]!.sym().toString();\n  const el = vec[1]!;\n  // Secp256r1(Bytes) and Ed25519(BytesN<32>) are scvBytes; Policy(Address) falls\n  // back to its XDR bytes (rare in a passkey SDK — see the ordering note below).\n  const payload =\n    el.switch().name === 'scvBytes' ? new Uint8Array(el.bytes()) : new Uint8Array(el.toXDR());\n  return { variant, payload };\n}\n\nfunction compareBytes(a: Uint8Array, b: Uint8Array): number {\n  const n = Math.min(a.length, b.length);\n  for (let i = 0; i < n; i++) {\n    if (a[i] !== b[i]) return a[i]! < b[i]! ? -1 : 1;\n  }\n  return a.length - b.length;\n}\n\n/**\n * Canonical Soroban-host ordering for `SignerKey` map keys. The host requires\n * `Map<SignerKey, _>` entries sorted by ScVal `Ord` — an **element-wise byte\n * comparison**, NOT a length-major XDR-hex / `localeCompare` string sort. This is\n * the one correctness landmine kalepail flagged in #32: passkey-kit v1 replaced\n * its old string sort with exactly this because the old approach could mis-order\n * same-variant keys of differing length, producing a map the host rejects.\n *\n * We compare the enum variant symbol first, then the payload bytes element-wise,\n * so homogeneous `Secp256r1` keys (the multi-passkey case) sort purely by their\n * raw credential-id bytes. (Ordering across mixed variant types relies on the\n * variant names being capitalized single words, which matches the host's symbol\n * order; a Policy/Address-keyed multi-sig is out of scope for this passkey SDK.)\n */\nexport function compareSignerKeyScVal(a: xdr.ScVal, b: xdr.ScVal): number {\n  const ka = decomposeSignerKey(a);\n  const kb = decomposeSignerKey(b);\n  if (ka.variant !== kb.variant) return ka.variant < kb.variant ? -1 : 1;\n  return compareBytes(ka.payload, kb.payload);\n}\n\n/**\n * Assemble/merge a passkey assertion into an address-credential auth entry as the\n * smart-wallet `Signatures(Map<SignerKey, Signature>)` wire shape\n * (`ScVal::Vec([ScVal::Map(...)])`). `assertion.signature` MUST already be 64-byte\n * low-S compact (`signAuthEntry` normalizes first). Existing map entries — a\n * partially-signed multi-sig entry — are preserved; an entry for the same signer\n * key is replaced; then the whole map is canonically sorted.\n *\n * Use this for the passkey-kit / webauthn-wallet ABI. For our own single-signer\n * account (`type Signature = Secp256r1Signature`) use `applyAssertionToEntry`.\n */\nexport function applyAssertionToSmartWalletEntry(\n  entry: xdr.SorobanAuthorizationEntry,\n  assertion: AssertionResult,\n): xdr.SorobanAuthorizationEntry {\n  const credentials = entry.credentials();\n  if (credentials.switch().name !== 'sorobanCredentialsAddress') {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'auth entry has no address credentials to sign');\n  }\n  const key = buildSignerKeyScVal(assertion.credentialId);\n  const newEntry = new xdr.ScMapEntry({ key, val: buildSmartWalletSignatureVariant(assertion) });\n\n  const current = credentials.address().signature();\n  let mapEntries: xdr.ScMapEntry[];\n  switch (current.switch().name) {\n    case 'scvVoid':\n      mapEntries = [newEntry];\n      break;\n    case 'scvVec': {\n      // Preserve any existing signatures (partial multi-sig); replace same key.\n      const existing = current.vec()?.[0]?.map() ?? [];\n      mapEntries = existing.filter((e) => compareSignerKeyScVal(e.key(), key) !== 0);\n      mapEntries.push(newEntry);\n      break;\n    }\n    default:\n      throw new KitError(\n        'CONTRACT_AUTH_FAILED',\n        'unexpected existing signature shape for a smart-wallet entry',\n      );\n  }\n  mapEntries.sort((a, b) => compareSignerKeyScVal(a.key(), b.key()));\n  credentials.address().signature(xdr.ScVal.scvVec([xdr.ScVal.scvMap(mapEntries)]));\n  return entry;\n}\n","import { xdr } from '@stellar/stellar-sdk';\nimport { KitError } from '../errors';\nimport { derToCompactLowS } from '../webauthn/signature';\nimport { parseClientDataJSON, verifyClientDataJSON, type ClientData } from '../webauthn/clientData';\nimport { parseAuthenticatorData, verifyRpIdHash } from '../webauthn/authData';\nimport { verifyAssertionSignature } from '../webauthn/verify';\nimport { authEntryChallenge } from './preimage';\nimport { applyAssertionToEntry } from './assemble';\nimport { applyAssertionToSmartWalletEntry } from './smartWallet';\n\n/**\n * Which contract ABI the assembled signature targets:\n *  - `single-signer` (default): the bare `Secp256r1Signature` struct our own\n *    webauthn-account consumes (`type Signature = Secp256r1Signature`).\n *  - `smart-wallet`: passkey-kit's `Signatures(Map<SignerKey, Signature>)`\n *    (`type Signature = Signatures`) — see `smartWallet.ts` / kalepail #32.\n * Both reuse the identical low-S, field-packing, and challenge-binding core;\n * only the outer wrapper differs, so the two stay separate ABI targets behind\n * one signing interface.\n */\nexport type WalletTarget = 'single-signer' | 'smart-wallet';\n\n/** The raw WebAuthn assertion a signer returns for a given challenge. */\nexport interface AssertionResult {\n  authenticatorData: Uint8Array;\n  clientDataJSON: Uint8Array;\n  /** DER-encoded (≤72B) or already-compact (64B) ECDSA signature. */\n  signature: Uint8Array;\n  /** base64url credential id → the SignerKey. */\n  credentialId: Uint8Array;\n}\n\n/** Produce a WebAuthn assertion over the base64url `challenge` (e.g. navigator.credentials.get). */\nexport type WebAuthnSigner = (challenge: string) => Promise<AssertionResult> | AssertionResult;\n\n/**\n * Opt-in pre-flight validation of the returned assertion, run BEFORE the entry\n * is assembled and submitted. On-chain `__check_auth` is the real gate, but\n * catching these client-side turns an opaque on-chain failure into a typed\n * `KitError` at the call site. Providing this object always enforces the\n * `webauthn.get` type, the User-Present (UP) flag (required by passkey-kit v1),\n * and challenge-binding; `rpId` / `origin` / `publicKey` add their checks when\n * supplied. Omit the object entirely to skip pre-flight (the default).\n */\nexport interface SignVerifyOptions {\n  /** Verify `authenticatorData.rpIdHash === SHA-256(rpId)`. */\n  rpId?: string;\n  /** Verify `clientDataJSON.origin` is one of these exact origins. */\n  origin?: string | string[];\n  /** SEC-1 (65-byte) public key → verify the ECDSA assertion signature. */\n  publicKey?: Uint8Array;\n  /** Also require the User-Verified (UV) flag (biometric / PIN). Default false. */\n  requireUserVerification?: boolean;\n  /** Allow an assertion made in a cross-origin context (crossOrigin=true). Default false. */\n  allowCrossOrigin?: boolean;\n}\n\nexport interface SorobanSignOptions {\n  networkPassphrase: string;\n  sign: WebAuthnSigner;\n  /** Contract ABI to assemble for. Defaults to `single-signer` (our account). */\n  target?: WalletTarget;\n  /** Opt-in pre-flight assertion validation. Omit to skip. */\n  verify?: SignVerifyOptions;\n  /**\n   * Stamp this `signatureExpirationLedger` onto every address-credential auth\n   * entry BEFORE the challenge is computed, so the signature binds the exact\n   * expiration the contract re-derives in `__check_auth`. Needed for smart-wallet\n   * writes (add/remove signer) where the caller learns the ledger at sign time;\n   * omit when the entry already carries the intended expiration.\n   */\n  signatureExpirationLedger?: number;\n}\n\n/** Validate an assertion against the expected challenge + RP context. Throws KitError. */\nfunction preflightAssertion(\n  assertion: AssertionResult,\n  challenge: string,\n  verify: SignVerifyOptions,\n): void {\n  // Ceremony type + challenge-binding (+ origin when provided).\n  let clientData: ClientData;\n  if (verify.origin !== undefined) {\n    clientData = verifyClientDataJSON(assertion.clientDataJSON, {\n      origin: verify.origin,\n      challenge,\n    });\n  } else {\n    clientData = parseClientDataJSON(assertion.clientDataJSON);\n    if (clientData.type !== 'webauthn.get') {\n      throw new KitError(\n        'UNSUPPORTED_AUTHENTICATOR',\n        `clientDataJSON.type \"${clientData.type}\" is not \"webauthn.get\"`,\n      );\n    }\n    if (clientData.challenge !== challenge) {\n      throw new KitError('CHALLENGE_MISMATCH', 'assertion challenge does not match the auth entry');\n    }\n  }\n  if (clientData.crossOrigin === true && !verify.allowCrossOrigin) {\n    throw new KitError(\n      'ORIGIN_MISMATCH',\n      'assertion was made in a cross-origin context (crossOrigin=true)',\n    );\n  }\n  // User-Present is mandatory (passkey-kit v1 hardening); UV is opt-in.\n  const parsed = parseAuthenticatorData(assertion.authenticatorData);\n  if (!parsed.flags.up) {\n    throw new KitError(\n      'UNSUPPORTED_AUTHENTICATOR',\n      'assertion is missing the User-Present (UP) flag',\n    );\n  }\n  if (verify.requireUserVerification && !parsed.flags.uv) {\n    throw new KitError(\n      'UNSUPPORTED_AUTHENTICATOR',\n      'assertion is missing the required User-Verified (UV) flag',\n    );\n  }\n  if (verify.rpId !== undefined) {\n    verifyRpIdHash(assertion.authenticatorData, verify.rpId);\n  }\n  if (verify.publicKey !== undefined) {\n    const ok = verifyAssertionSignature({\n      publicKey: verify.publicKey,\n      authenticatorData: assertion.authenticatorData,\n      clientDataJSON: assertion.clientDataJSON,\n      signature: assertion.signature,\n    });\n    if (!ok) {\n      throw new KitError(\n        'CONTRACT_AUTH_FAILED',\n        'assertion signature failed pre-flight verification',\n      );\n    }\n  }\n}\n\nasync function signEntryInPlace(\n  entry: xdr.SorobanAuthorizationEntry,\n  options: SorobanSignOptions,\n): Promise<void> {\n  // Stamp the expiration first: the challenge preimage includes\n  // signatureExpirationLedger, so it must be final before we compute it.\n  if (options.signatureExpirationLedger !== undefined) {\n    const creds = entry.credentials();\n    if (creds.switch().name === 'sorobanCredentialsAddress') {\n      creds.address().signatureExpirationLedger(options.signatureExpirationLedger);\n    }\n  }\n  const challenge = authEntryChallenge(entry, options.networkPassphrase);\n  const assertion = await options.sign(challenge);\n  if (options.verify) preflightAssertion(assertion, challenge, options.verify);\n  const signature =\n    assertion.signature.length === 64 ? assertion.signature : derToCompactLowS(assertion.signature);\n  const normalized = {\n    credentialId: assertion.credentialId,\n    authenticatorData: assertion.authenticatorData,\n    clientDataJSON: assertion.clientDataJSON,\n    signature,\n  };\n  if (options.target === 'smart-wallet') {\n    applyAssertionToSmartWalletEntry(entry, normalized);\n  } else {\n    applyAssertionToEntry(entry, normalized);\n  }\n}\n\n/**\n * Sign a single `SorobanAuthorizationEntry` (base64 XDR): compute the challenge,\n * obtain a WebAuthn assertion, low-S-normalize, and assemble the contract\n * signature. Returns the signed entry as base64 XDR.\n */\nexport async function signAuthEntry(\n  entryXdr: string,\n  options: SorobanSignOptions,\n): Promise<string> {\n  const entry = xdr.SorobanAuthorizationEntry.fromXDR(entryXdr, 'base64');\n  await signEntryInPlace(entry, options);\n  return entry.toXDR('base64');\n}\n\n/**\n * The operations whose Soroban auth entries we sign, for a v1 or a fee-bump\n * envelope. (Sign the Soroban auth entries before adding classic tx signatures\n * or fee-bumping; a fee-bump around an already-classic-signed inner tx is the\n * caller's sequencing concern.)\n */\nfunction operationsForSigning(envelope: xdr.TransactionEnvelope): xdr.Operation[] {\n  const kind = envelope.switch().name;\n  if (kind === 'envelopeTypeTx') return envelope.v1().tx().operations();\n  if (kind === 'envelopeTypeTxFeeBump') {\n    const inner = envelope.feeBump().tx().innerTx();\n    if (inner.switch().name !== 'envelopeTypeTx') {\n      throw new KitError(\n        'CONTRACT_AUTH_FAILED',\n        'signTransaction: fee-bump inner transaction is not a v1 transaction',\n      );\n    }\n    return inner.v1().tx().operations();\n  }\n  throw new KitError(\n    'CONTRACT_AUTH_FAILED',\n    `signTransaction: unsupported envelope type \"${kind}\" (expected v1 or fee-bump)`,\n  );\n}\n\n/**\n * Sign every address-credential Soroban auth entry carried by the InvokeHostFunction\n * operations of a transaction (base64 XDR envelope — v1 or fee-bump). Returns the\n * signed envelope XDR.\n */\nexport async function signTransaction(txXdr: string, options: SorobanSignOptions): Promise<string> {\n  const envelope = xdr.TransactionEnvelope.fromXDR(txXdr, 'base64');\n  for (const op of operationsForSigning(envelope)) {\n    if (op.body().switch().name !== 'invokeHostFunction') continue;\n    const entries = op.body().invokeHostFunctionOp().auth();\n    for (const entry of entries) {\n      if (entry.credentials().switch().name !== 'sorobanCredentialsAddress') continue;\n      await signEntryInPlace(entry, options);\n    }\n  }\n  return envelope.toXDR('base64');\n}\n","import { Contract, nativeToScVal, xdr } from '@stellar/stellar-sdk';\nimport { KitError } from '../errors';\nimport { buildSignerKeyScVal } from './smartWallet';\n\n/**\n * passkey-kit v1 (v0.13.0, Protocol 27) smart-wallet SIGNER encoders — the WRITE\n * path (what `add_signer` / `remove_signer` consume), complementing\n * `smartWallet.ts` (the signature READ path the wallet's `__check_auth` reads).\n *\n * A signer is added on-chain as\n *\n *   Signer::Secp256r1(Bytes id, BytesN<65> public_key,\n *                     SignerExpiration, SignerLimits, SignerStorage)\n *\n * which `process_signer` reduces to `SignerKey::Secp256r1(id) ->\n * SignerVal::Secp256r1(public_key, ..)`: the raw credential id is the key, the\n * SEC-1 public key lives in the value. Shape + field order confirmed by kalepail\n * (passkey-kit author) in issue #32 and proven on testnet against the audited v1\n * wasm (`scripts/smartwallet-v1-e2e.ts`).\n *\n * v1 note: `SignerExpiration` is a UNIX-seconds `u64` timestamp (Protocol 27),\n * NOT a ledger sequence as in the pre-v1 kit.\n */\n\n/** `SignerStorage` — where the contract persists the signer entry. */\nexport type SignerStorage = 'Persistent' | 'Temporary';\n\nexport interface Secp256r1SignerSpec {\n  /** Raw WebAuthn credential-id bytes (base64url-decoded `rawId`) — becomes the SignerKey. */\n  credentialId: Uint8Array;\n  /** SEC-1 uncompressed public key (65 bytes, `0x04 ‖ X ‖ Y`) — stored in SignerVal. */\n  publicKey: Uint8Array;\n  /**\n   * `SignerExpiration` — a UNIX-seconds timestamp (v1 / Protocol 27) after which\n   * the signer stops being valid. Omit for `None` (a non-expiring signer, the\n   * usual choice for a recovery / second device).\n   */\n  expiration?: number | bigint;\n  /** `SignerStorage` — defaults to `Persistent`. */\n  storage?: SignerStorage;\n}\n\n/** A tuple-struct `Option` field set to `None` → `scvVec([Void])`. */\nfunction noneTuple(): xdr.ScVal {\n  return xdr.ScVal.scvVec([xdr.ScVal.scvVoid()]);\n}\n\n/** `SignerExpiration(Option<u64>)` — `None` or `Some(unixSeconds)`. */\nfunction expirationScVal(expiration?: number | bigint): xdr.ScVal {\n  if (expiration === undefined) return noneTuple();\n  const ts = BigInt(expiration);\n  if (ts < 0n) {\n    throw new KitError(\n      'CONTRACT_AUTH_FAILED',\n      'signer expiration must be a non-negative UNIX-seconds timestamp (v1)',\n    );\n  }\n  return xdr.ScVal.scvVec([nativeToScVal(ts, { type: 'u64' })]);\n}\n\n/** `SignerStorage::Persistent | Temporary` → `scvVec([Symbol(variant)])`. */\nfunction storageScVal(storage: SignerStorage = 'Persistent'): xdr.ScVal {\n  return xdr.ScVal.scvVec([xdr.ScVal.scvSymbol(storage)]);\n}\n\n/**\n * Encode a `Signer::Secp256r1(..)` for `add_signer`. `SignerLimits` is always\n * `None` (unrestricted) — policy/limited signers are out of scope for this\n * minimal passkey SDK. Validates the credential id and the SEC-1 public key so a\n * malformed signer can never be handed to the contract.\n */\nexport function buildSecp256r1Signer(spec: Secp256r1SignerSpec): xdr.ScVal {\n  if (spec.credentialId.length === 0) {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'buildSecp256r1Signer: empty credential id');\n  }\n  if (spec.publicKey.length !== 65 || spec.publicKey[0] !== 0x04) {\n    throw new KitError(\n      'INVALID_PUBLIC_KEY',\n      'buildSecp256r1Signer: publicKey must be a 65-byte SEC-1 uncompressed point (0x04-prefixed)',\n    );\n  }\n  return xdr.ScVal.scvVec([\n    xdr.ScVal.scvSymbol('Secp256r1'),\n    xdr.ScVal.scvBytes(Buffer.from(spec.credentialId)),\n    xdr.ScVal.scvBytes(Buffer.from(spec.publicKey)),\n    expirationScVal(spec.expiration), // SignerExpiration\n    noneTuple(), // SignerLimits(None)\n    storageScVal(spec.storage), // SignerStorage\n  ]);\n}\n\nfunction contractCall(contractId: string, method: string, ...args: xdr.ScVal[]): xdr.Operation {\n  let contract: Contract;\n  try {\n    contract = new Contract(contractId);\n  } catch (cause) {\n    throw new KitError('CONTRACT_AUTH_FAILED', `invalid smart-wallet contract id \"${contractId}\"`, {\n      cause,\n    });\n  }\n  return contract.call(method, ...args);\n}\n\nexport interface BuildAddSignerOptions {\n  /** The smart-wallet C-address the signer is being added to. */\n  walletContractId: string;\n  /** The signer to add — a `Secp256r1SignerSpec`, or a pre-built `Signer` ScVal. */\n  signer: Secp256r1SignerSpec | xdr.ScVal;\n}\n\n/**\n * Build the `wallet.add_signer(signer)` invocation. The resulting invoke-host\n * operation requires the wallet's OWN auth: an EXISTING signer authorizes adding\n * the new one, which is what keeps a lost device from locking the user out.\n * Sign the produced transaction's auth entry with\n * `signTransaction(.., { target: 'smart-wallet' })`.\n */\nexport function buildAddSignerOperation(options: BuildAddSignerOptions): xdr.Operation {\n  const signerScVal =\n    options.signer instanceof xdr.ScVal ? options.signer : buildSecp256r1Signer(options.signer);\n  return contractCall(options.walletContractId, 'add_signer', signerScVal);\n}\n\nexport interface BuildRemoveSignerOptions {\n  walletContractId: string;\n  /** Raw credential-id bytes of the signer to remove (its `SignerKey`). */\n  credentialId: Uint8Array;\n}\n\n/** Build the `wallet.remove_signer(SignerKey::Secp256r1(id))` invocation (wallet-authorized). */\nexport function buildRemoveSignerOperation(options: BuildRemoveSignerOptions): xdr.Operation {\n  if (options.credentialId.length === 0) {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'buildRemoveSignerOperation: empty credential id');\n  }\n  return contractCall(\n    options.walletContractId,\n    'remove_signer',\n    buildSignerKeyScVal(options.credentialId),\n  );\n}\n","import { xdr } from '@stellar/stellar-sdk';\nimport { p256 } from '@noble/curves/nist';\nimport { sha256 } from '../internal/sha256';\nimport { concatBytes } from '../internal/bytes';\nimport { bytesToBase64Url, bytesToUtf8 } from '../internal/encoding';\nimport { authEntryChallengeBytes } from './preimage';\n\nexport interface CheckAuthResult {\n  success: boolean;\n  /** clientDataJSON.challenge === base64url(preimage hash). */\n  challengeBound: boolean;\n  /** secp256r1_verify over SHA256(authData ‖ SHA256(cdj)) passed. */\n  signatureValid: boolean;\n  reason?: string;\n}\n\nfunction fail(reason: string): CheckAuthResult {\n  return { success: false, challengeBound: false, signatureValid: false, reason };\n}\n\n/**\n * Verify a bare `Secp256r1Signature` ScMap ({ authenticator_data,\n * client_data_json, signature }) against a public key + the expected signature\n * payload. Shared by the single-signer and smart-wallet reference verifiers.\n */\nfunction verifySecp256r1StructMap(\n  structMap: xdr.ScMapEntry[],\n  publicKey: Uint8Array,\n  signaturePayload: Uint8Array,\n): { ok: boolean; challengeBound: boolean; signatureValid: boolean; reason?: string } {\n  const field = (name: string): Uint8Array | undefined => {\n    const e = structMap.find((x) => x.key().sym().toString() === name);\n    return e ? new Uint8Array(e.val().bytes()) : undefined;\n  };\n  const authenticatorData = field('authenticator_data');\n  const clientDataJSON = field('client_data_json');\n  const signature = field('signature');\n  if (!authenticatorData || !clientDataJSON || !signature) {\n    return { ok: false, challengeBound: false, signatureValid: false, reason: 'missing fields' };\n  }\n  if (signature.length !== 64) {\n    return {\n      ok: false,\n      challengeBound: false,\n      signatureValid: false,\n      reason: 'not 64-byte compact',\n    };\n  }\n  let challengeBound = false;\n  try {\n    const cdj = JSON.parse(bytesToUtf8(clientDataJSON)) as { challenge?: string };\n    challengeBound = cdj.challenge === bytesToBase64Url(signaturePayload);\n  } catch {\n    challengeBound = false;\n  }\n  // Host fn semantics: no low-S enforcement (lowS:false), compact format.\n  const digest = sha256(concatBytes(authenticatorData, sha256(clientDataJSON)));\n  const signatureValid = p256.verify(signature, digest, publicKey, {\n    lowS: false,\n    format: 'compact',\n  });\n  return { ok: challengeBound && signatureValid, challengeBound, signatureValid };\n}\n\n/**\n * A faithful JavaScript model of the on-chain `__check_auth` (kalepail\n * `webauthn-wallet` `verify.rs`): reconstruct `SHA256(authenticator_data ‖\n * SHA256(client_data_json))`, run `secp256r1_verify` (which does NOT enforce\n * low-S — hence the client-side normalization), and assert challenge-binding\n * (`clientDataJSON.challenge === base64url(signature_payload)`). Lets us prove\n * the assembly without a live Soroban RPC; the real on-chain run is exercised\n * by the kit integration (S17) and the demo (S21).\n */\nexport function referenceCheckAuth(\n  entry: xdr.SorobanAuthorizationEntry,\n  publicKey: Uint8Array,\n  networkPassphrase: string,\n): CheckAuthResult {\n  if (entry.credentials().switch().name !== 'sorobanCredentialsAddress') {\n    return fail('no address credentials');\n  }\n  // The signature is the Secp256r1Signature struct directly: a sorted ScMap\n  // { authenticator_data, client_data_json, signature } (see assemble.ts).\n  const structMap = entry.credentials().address().signature().map();\n  if (!structMap) return fail('signature is not a Secp256r1Signature map');\n\n  const signaturePayload = authEntryChallengeBytes(entry, networkPassphrase);\n  const r = verifySecp256r1StructMap(structMap, publicKey, signaturePayload);\n  return { success: r.ok, challengeBound: r.challengeBound, signatureValid: r.signatureValid };\n}\n\nexport interface SmartWalletCheckAuthResult {\n  success: boolean;\n  signers: { credentialId: string; challengeBound: boolean; signatureValid: boolean }[];\n  reason?: string;\n}\n\n/**\n * A reference model of passkey-kit's smart-wallet `__check_auth`: unwrap the\n * `Signatures(Map<SignerKey, Signature>)` value (`ScVal::Vec([ScVal::Map(...)])`),\n * and for each `SignerKey::Secp256r1(id) => Signature::Secp256r1(struct)` entry,\n * look up that credential id's SEC-1 public key and verify the struct. Succeeds\n * only when the map is non-empty and every signer verifies + is challenge-bound.\n * `publicKeyFor` receives the lowercase-hex credential id.\n */\nexport function referenceSmartWalletCheckAuth(\n  entry: xdr.SorobanAuthorizationEntry,\n  publicKeyFor: (credentialIdHex: string) => Uint8Array | undefined,\n  networkPassphrase: string,\n): SmartWalletCheckAuthResult {\n  if (entry.credentials().switch().name !== 'sorobanCredentialsAddress') {\n    return { success: false, signers: [], reason: 'no address credentials' };\n  }\n  const sig = entry.credentials().address().signature();\n  const map = sig.switch().name === 'scvVec' ? sig.vec()?.[0]?.map() : undefined;\n  if (!map) {\n    return { success: false, signers: [], reason: 'signature is not a Signatures(Map) vec' };\n  }\n  if (map.length === 0) return { success: false, signers: [], reason: 'empty signatures map' };\n\n  const signaturePayload = authEntryChallengeBytes(entry, networkPassphrase);\n  const signers: SmartWalletCheckAuthResult['signers'] = [];\n  let allOk = true;\n\n  for (const e of map) {\n    const keyVec = e.key().vec();\n    const idBytes = keyVec?.[1]?.bytes();\n    const credentialId = idBytes ? Buffer.from(idBytes).toString('hex') : '';\n    // Signature::Secp256r1(struct) → scvVec([Symbol, structMap]).\n    const structMap = e.val().vec()?.[1]?.map();\n    const publicKey = publicKeyFor(credentialId);\n    if (!structMap || !publicKey) {\n      allOk = false;\n      signers.push({ credentialId, challengeBound: false, signatureValid: false });\n      continue;\n    }\n    const r = verifySecp256r1StructMap(structMap, publicKey, signaturePayload);\n    if (!r.ok) allOk = false;\n    signers.push({\n      credentialId,\n      challengeBound: r.challengeBound,\n      signatureValid: r.signatureValid,\n    });\n  }\n  return { success: allOk, signers };\n}\n","import { rpc, TransactionBuilder } from '@stellar/stellar-sdk';\nimport { KitError } from '../errors';\nimport type { SubmissionAdapter, SubmitResult } from './types';\n\nexport interface DirectSubmissionOptions {\n  rpcUrl: string;\n  networkPassphrase: string;\n  allowHttp?: boolean;\n  /** Max confirmation-poll attempts before failing with NETWORK_ERROR (default 30). */\n  pollAttempts?: number;\n  /** Delay between confirmation polls, in ms (default 1000). */\n  pollIntervalMs?: number;\n}\n\n/**\n * Default, zero-infra submission: send straight to soroban-rpc and poll. No\n * relayer, no API key. Swappable with `launchtube`/`openzeppelinRelayer` with\n * zero ceremony changes (same `SubmissionAdapter` shape).\n */\nexport function directSubmission(options: DirectSubmissionOptions): SubmissionAdapter {\n  const server = new rpc.Server(options.rpcUrl, {\n    allowHttp: options.allowHttp ?? options.rpcUrl.startsWith('http://'),\n  });\n  const attempts = options.pollAttempts ?? 30;\n  const intervalMs = options.pollIntervalMs ?? 1000;\n  return {\n    async send(signedTxXdr: string): Promise<SubmitResult> {\n      const tx = TransactionBuilder.fromXDR(signedTxXdr, options.networkPassphrase);\n      let sent;\n      try {\n        sent = await server.sendTransaction(tx);\n      } catch (cause) {\n        throw new KitError('NETWORK_ERROR', 'failed to submit transaction to soroban-rpc', {\n          cause,\n        });\n      }\n      if (sent.status === 'ERROR') {\n        return {\n          status: 'FAILED',\n          hash: sent.hash,\n          errorResultXdr: sent.errorResult?.toXDR('base64'),\n        };\n      }\n      // Bounded polling: give up (NETWORK_ERROR) instead of hanging forever.\n      let final;\n      try {\n        final = await server.pollTransaction(sent.hash, {\n          attempts,\n          sleepStrategy: () => intervalMs,\n        });\n      } catch (cause) {\n        throw new KitError(\n          'NETWORK_ERROR',\n          `transaction ${sent.hash} was not confirmed after ${String(attempts)} polls`,\n          { cause },\n        );\n      }\n      if (final.status === rpc.Api.GetTransactionStatus.NOT_FOUND) {\n        throw new KitError(\n          'NETWORK_ERROR',\n          `transaction ${sent.hash} still NOT_FOUND after ${String(attempts)} polls`,\n        );\n      }\n      const success = final.status === rpc.Api.GetTransactionStatus.SUCCESS;\n      return {\n        status: success ? 'SUCCESS' : 'FAILED',\n        hash: sent.hash,\n        returnValue: success ? (final as { returnValue?: unknown }).returnValue : undefined,\n      };\n    },\n  };\n}\n","import { Keypair, TransactionBuilder, rpc, xdr } from '@stellar/stellar-sdk';\nimport { KitError } from '../errors';\nimport { directSubmission } from '../adapters/direct';\nimport type { SubmissionAdapter, SubmitResult } from '../adapters/types';\nimport { signTransaction, type SignVerifyOptions, type WebAuthnSigner } from './sign';\n\nexport interface SendSmartWalletTxOptions {\n  /** The single wallet-authorized invocation to run (SAC transfer, contract call, add_signer, …). */\n  operation: xdr.Operation;\n  networkPassphrase: string;\n  rpcUrl: string;\n  /**\n   * Secret of the funded classic account that pays the fee + sequences the tx. The\n   * passkey provides the wallet's AUTH; this only sponsors the envelope\n   * (ephemeral/friendbot-funded in a demo; a relayer key otherwise).\n   */\n  sourceSecret: string;\n  /** The wallet's passkey signer that authorizes the invocation. */\n  sign: WebAuthnSigner;\n  /** Where the signed tx is submitted. Defaults to `direct` (soroban-rpc). */\n  submission?: SubmissionAdapter;\n  /** Opt-in pre-flight validation of the authorizing assertion. */\n  verify?: SignVerifyOptions;\n  fee?: string;\n  timeoutSeconds?: number;\n  /** Ledgers ahead of `latestLedger` to expire the auth signature at (default 60). */\n  signatureExpirationLedgerOffset?: number;\n  allowHttp?: boolean;\n}\n\nconst DEFAULT_EXPIRATION_OFFSET = 60;\n\n/**\n * Sign and submit a single passkey-authorized smart-wallet transaction — the\n * general primitive behind every smart-wallet action (payment, contract call,\n * add/remove signer). The full dance:\n *\n *   1. recording sim → assemble (discovers the wallet's auth requirement);\n *   2. sign the wallet auth entry with the passkey (smart-wallet Signatures map),\n *      binding the expiration ledger the contract re-derives;\n *   3. enforcing re-sim of the SIGNED tx — recording auth never runs the custom\n *      account's `__check_auth`, so it misses the signer-storage reads and\n *      under-counts instructions; the enforcing pass yields the true footprint +\n *      resources, and doubles as a client-side proof the auth is accepted;\n *   4. pay the fee from the classic source and submit via the pluggable adapter.\n *\n * tx.fee + sorobanData are outside the auth preimage, so re-assembling with the\n * enforcing resources never invalidates the signature. Throws a typed KitError on\n * any simulation/validation failure.\n */\nexport async function sendSmartWalletTx(options: SendSmartWalletTxOptions): Promise<SubmitResult> {\n  const server = new rpc.Server(options.rpcUrl, {\n    allowHttp: options.allowHttp ?? options.rpcUrl.startsWith('http://'),\n  });\n  let source: Keypair;\n  try {\n    source = Keypair.fromSecret(options.sourceSecret);\n  } catch (cause) {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'invalid fee-source secret', { cause });\n  }\n\n  const account = await server.getAccount(source.publicKey());\n  const tx = new TransactionBuilder(account, {\n    fee: options.fee ?? '2000000',\n    networkPassphrase: options.networkPassphrase,\n  })\n    .addOperation(options.operation)\n    .setTimeout(options.timeoutSeconds ?? 120)\n    .build();\n\n  const recSim = await server.simulateTransaction(tx);\n  if (!rpc.Api.isSimulationSuccess(recSim)) {\n    const detail = 'error' in recSim ? String(recSim.error) : 'unknown simulation error';\n    throw new KitError(\n      'CONTRACT_AUTH_FAILED',\n      `smart-wallet tx simulation failed: ${detail.slice(0, 300)}`,\n    );\n  }\n  const prepared = rpc.assembleTransaction(tx, recSim).build();\n\n  const signatureExpirationLedger =\n    (await server.getLatestLedger()).sequence +\n    (options.signatureExpirationLedgerOffset ?? DEFAULT_EXPIRATION_OFFSET);\n  const signedAuthXdr = await signTransaction(prepared.toXDR(), {\n    networkPassphrase: options.networkPassphrase,\n    sign: options.sign,\n    target: 'smart-wallet',\n    signatureExpirationLedger,\n    verify: options.verify,\n  });\n\n  const signedTx = TransactionBuilder.fromXDR(signedAuthXdr, options.networkPassphrase);\n  const enfSim = await server.simulateTransaction(signedTx);\n  if (!rpc.Api.isSimulationSuccess(enfSim)) {\n    const detail = 'error' in enfSim ? String(enfSim.error) : 'unknown simulation error';\n    throw new KitError(\n      'CONTRACT_AUTH_FAILED',\n      `signed smart-wallet tx failed enforcing simulation (auth rejected?): ${detail.slice(0, 300)}`,\n    );\n  }\n\n  const finalTx = rpc.assembleTransaction(signedTx, enfSim).build();\n  finalTx.sign(source);\n  const submission =\n    options.submission ??\n    directSubmission({\n      rpcUrl: options.rpcUrl,\n      networkPassphrase: options.networkPassphrase,\n      allowHttp: options.allowHttp,\n    });\n  return submission.send(finalTx.toXDR());\n}\n","import type { IndexerAdapter } from '../adapters/types';\nimport { browserWebAuthnClient, defaultCredentialStorage } from './browserClient';\nimport type { CredentialStorage, WebAuthnClient } from './types';\n\nexport interface ConnectOptions {\n  rpId: string;\n  indexer: IndexerAdapter;\n  webauthn?: WebAuthnClient;\n  storage?: CredentialStorage;\n  /** Override silent-mediation detection (default: probe isConditionalMediationAvailable). */\n  silentMediationSupported?: boolean;\n}\n\nexport interface ConnectResult {\n  contractId: string;\n  credentialId: string;\n}\n\nasync function probeConditionalMediation(): Promise<boolean> {\n  const pkc = (\n    globalThis as {\n      PublicKeyCredential?: { isConditionalMediationAvailable?: () => Promise<boolean> };\n    }\n  ).PublicKeyCredential;\n  if (!pkc?.isConditionalMediationAvailable) return false;\n  try {\n    return await pkc.isConditionalMediationAvailable();\n  } catch {\n    return false;\n  }\n}\n\n/**\n * `connect` — silent reconnect using the stored credential id. Where conditional\n * mediation is available, does a best-effort `mediation:'silent'` liveness check;\n * the C-address is resolved via the IndexerAdapter regardless, so connect\n * degrades gracefully where silent mediation is unsupported. Returns null when\n * there is no stored credential (the caller should `recover`) or no account.\n */\nexport async function connect(options: ConnectOptions): Promise<ConnectResult | null> {\n  const storage = options.storage ?? defaultCredentialStorage();\n  const credentialId = storage.get(options.rpId);\n  if (!credentialId) return null;\n\n  const silentSupported = options.silentMediationSupported ?? (await probeConditionalMediation());\n  if (silentSupported) {\n    const webauthn = options.webauthn ?? browserWebAuthnClient();\n    try {\n      await webauthn.get({\n        rpId: options.rpId,\n        allowCredentials: [credentialId],\n        mediation: 'silent',\n      });\n    } catch {\n      // A silent get may no-op or reject; resolution is via the indexer.\n    }\n  }\n\n  const accounts = await options.indexer.resolveByCredential(credentialId);\n  const contractId = accounts[0]?.contractId;\n  return contractId ? { contractId, credentialId } : null;\n}\n","import { assertUserActivation } from '../anchors';\nimport type { IndexerAdapter } from '../adapters/types';\nimport { browserWebAuthnClient } from './browserClient';\nimport { randomBytes } from './random';\nimport type { WebAuthnClient } from './types';\n\nexport interface RecoverOptions {\n  rpId: string;\n  indexer: IndexerAdapter;\n  webauthn?: WebAuthnClient;\n  challenge?: Uint8Array;\n  userActivation?: { isActive: boolean };\n}\n\nexport interface RecoverResult {\n  contractId: string;\n  credentialId: string;\n}\n\n/**\n * `recover` — the lost-localStorage / new-device path. Performs a\n * discoverable-credential `get()` (no allowCredentials), then resolves every\n * smart account controlled by that credential via the IndexerAdapter.\n */\nexport async function recover(options: RecoverOptions): Promise<RecoverResult[]> {\n  assertUserActivation(options.userActivation); // anchor: apple-user-gesture (S04)\n  const webauthn = options.webauthn ?? browserWebAuthnClient();\n  const assertion = await webauthn.get({\n    rpId: options.rpId,\n    allowCredentials: [],\n    challenge: options.challenge ?? randomBytes(32),\n  });\n  const accounts = await options.indexer.resolveByCredential(assertion.id);\n  return accounts.map((account) => ({\n    contractId: account.contractId,\n    credentialId: assertion.id,\n  }));\n}\n","import { decodeChallenge } from '../webauthn/clientData';\nimport type { SubmitResult } from '../adapters/types';\nimport {\n  buildAddSignerOperation,\n  buildRemoveSignerOperation,\n  type SignerStorage,\n} from '../soroban/signer';\nimport { sendSmartWalletTx, type SendSmartWalletTxOptions } from '../soroban/submit';\n\n/**\n * Multi-device recovery: add (or remove) a passkey signer on an existing\n * smart-wallet, on-chain. Adding a signer from a NEW device — while an existing\n * device is still available — is what keeps a lost device from locking the user\n * out. The new device produces a `{credentialId, publicKey}` via `registerPasskey`;\n * an EXISTING device authorizes `add_signer` here.\n *\n * These are thin wrappers over {@link sendSmartWalletTx}: build the wallet-\n * authorized `add_signer` / `remove_signer` invocation, then sign it with the\n * existing passkey and submit (recording → sign → enforcing re-sim → submit).\n */\n\n/** The new device's signer to enroll. `credentialId` may be base64url or raw bytes. */\nexport interface NewDeviceSigner {\n  credentialId: string | Uint8Array;\n  /** SEC-1 uncompressed public key (65 bytes) from `registerPasskey`. */\n  publicKey: Uint8Array;\n  /** Optional UNIX-seconds expiry (v1). Omit for a non-expiring recovery signer. */\n  expiration?: number | bigint;\n  /** SignerStorage; defaults to `Persistent`. */\n  storage?: SignerStorage;\n}\n\n/** Shared wiring for a wallet-authorized signer change — the submit options minus the operation. */\nexport interface WalletCallOptions extends Omit<SendSmartWalletTxOptions, 'operation'> {\n  /** The smart-wallet C-address being modified. */\n  walletContractId: string;\n}\n\nexport interface AddSignerOptions extends WalletCallOptions {\n  newSigner: NewDeviceSigner;\n}\n\nexport interface RemoveSignerOptions extends WalletCallOptions {\n  /** Credential id of the signer to remove (base64url or raw bytes). */\n  credentialId: string | Uint8Array;\n}\n\nfunction toRawCredentialId(id: string | Uint8Array): Uint8Array {\n  return typeof id === 'string' ? decodeChallenge(id) : id;\n}\n\n/**\n * Add a new passkey signer to a smart-wallet on-chain (multi-device recovery),\n * authorized by an existing device. Returns the submission result (tx hash on\n * success). Throws a typed {@link KitError} on any failure.\n */\nexport async function addSigner(options: AddSignerOptions): Promise<SubmitResult> {\n  const { walletContractId, newSigner, ...wiring } = options;\n  const operation = buildAddSignerOperation({\n    walletContractId,\n    signer: {\n      credentialId: toRawCredentialId(newSigner.credentialId),\n      publicKey: newSigner.publicKey,\n      expiration: newSigner.expiration,\n      storage: newSigner.storage,\n    },\n  });\n  return sendSmartWalletTx({ ...wiring, operation });\n}\n\n/** Remove a passkey signer from a smart-wallet on-chain (authorized by an existing device). */\nexport async function removeSigner(options: RemoveSignerOptions): Promise<SubmitResult> {\n  const { walletContractId, credentialId, ...wiring } = options;\n  const operation = buildRemoveSignerOperation({\n    walletContractId,\n    credentialId: toRawCredentialId(credentialId),\n  });\n  return sendSmartWalletTx({ ...wiring, operation });\n}\n","import { KitError } from '../errors';\n\n/**\n * Bounded retry/backoff for the optional HTTP adapters (Launchtube / OZ Relayer /\n * Mercury). Opt-in: `retries` defaults to 1 (no retry), preserving the plain\n * single-shot behavior unless a caller asks for resilience.\n */\nexport interface RetryOptions {\n  /** Total attempts including the first (default 1 = no retry). */\n  retries?: number;\n  /** Linear backoff base in ms; attempt N waits `backoffMs * N` (default 300). */\n  backoffMs?: number;\n}\n\nconst sleep = (ms: number): Promise<void> =>\n  ms > 0 ? new Promise<void>((resolve) => setTimeout(resolve, ms)) : Promise.resolve();\n\n/** A transient status worth retrying: rate-limit or any server error. */\nfunction isTransientStatus(status: number): boolean {\n  return status === 429 || status >= 500;\n}\n\n/**\n * POST with typed failure semantics: a thrown fetch (DNS/connection/abort) after\n * the last attempt becomes `KitError('NETWORK_ERROR')`; a transient HTTP status\n * (429 / 5xx) is retried up to `retries`, then the response is returned for the\n * caller to interpret (so the failure body is preserved). Non-transient responses\n * return immediately.\n */\nexport async function httpPost(\n  url: string,\n  init: { headers?: Record<string, string>; body?: string },\n  retry?: RetryOptions,\n): Promise<Response> {\n  const attempts = Math.max(1, retry?.retries ?? 1);\n  const backoffMs = retry?.backoffMs ?? 300;\n  for (let i = 1; i <= attempts; i++) {\n    try {\n      const response = await fetch(url, {\n        method: 'POST',\n        headers: init.headers,\n        body: init.body,\n      });\n      if (isTransientStatus(response.status) && i < attempts) {\n        await sleep(backoffMs * i);\n        continue;\n      }\n      return response;\n    } catch (cause) {\n      if (i < attempts) {\n        await sleep(backoffMs * i);\n        continue;\n      }\n      throw new KitError('NETWORK_ERROR', `POST to ${url} failed`, { cause });\n    }\n  }\n  // Unreachable (the loop always returns or throws), but keeps the type total.\n  throw new KitError('NETWORK_ERROR', `POST to ${url} failed`);\n}\n","import { httpPost, type RetryOptions } from './http';\nimport type { SubmissionAdapter, SubmitResult } from './types';\n\nexport interface LaunchtubeSubmissionOptions {\n  url: string;\n  /** Bearer token (Launchtube is invite/credit-gated). */\n  token?: string;\n  /** Optional bounded retry on transient (429 / 5xx / network) failures. */\n  retry?: RetryOptions;\n}\n\ninterface LaunchtubeResponse {\n  hash?: string;\n  status?: string;\n  error?: string;\n  errorResultXdr?: string;\n}\n\n/**\n * Legacy Launchtube relay (optional). Modelled as ONE submission adapter — the\n * SDK does not depend on it; `direct` is the default and `openzeppelinRelayer`\n * is the post-Launchtube direction. A network failure surfaces as a typed\n * `KitError('NETWORK_ERROR')`; an HTTP error becomes a `FAILED` result carrying\n * the relay's error body.\n */\nexport function launchtubeSubmission(options: LaunchtubeSubmissionOptions): SubmissionAdapter {\n  return {\n    async send(signedTxXdr: string): Promise<SubmitResult> {\n      const headers: Record<string, string> = {\n        'content-type': 'application/x-www-form-urlencoded',\n      };\n      if (options.token) headers['authorization'] = `Bearer ${options.token}`;\n      const response = await httpPost(\n        options.url,\n        { headers, body: new URLSearchParams({ xdr: signedTxXdr }).toString() },\n        options.retry,\n      );\n      const body = (await response.json().catch(() => ({}))) as LaunchtubeResponse;\n      if (!response.ok || body.status === 'FAILED' || body.error) {\n        return { status: 'FAILED', hash: body.hash ?? '', errorResultXdr: body.errorResultXdr };\n      }\n      return { status: 'SUCCESS', hash: body.hash ?? '', returnValue: body };\n    },\n  };\n}\n","import { httpPost, type RetryOptions } from './http';\nimport type { SubmissionAdapter, SubmitResult } from './types';\n\nexport interface OpenZeppelinRelayerOptions {\n  url: string;\n  apiKey?: string;\n  /** Optional bounded retry on transient (429 / 5xx / network) failures. */\n  retry?: RetryOptions;\n}\n\ninterface RelayerResponse {\n  hash?: string;\n  status?: string;\n  errorResultXdr?: string;\n}\n\n/**\n * OpenZeppelin Relayer / Channels submission (the post-Launchtube direction).\n * Same `SubmissionAdapter` shape, so swapping it in is a one-line config change.\n * A network failure surfaces as `KitError('NETWORK_ERROR')`; an HTTP error (or a\n * `status: \"failed\"` body) becomes a `FAILED` result.\n */\nexport function openzeppelinRelayerSubmission(\n  options: OpenZeppelinRelayerOptions,\n): SubmissionAdapter {\n  return {\n    async send(signedTxXdr: string): Promise<SubmitResult> {\n      const headers: Record<string, string> = { 'content-type': 'application/json' };\n      if (options.apiKey) headers['authorization'] = `Bearer ${options.apiKey}`;\n      const response = await httpPost(\n        options.url,\n        { headers, body: JSON.stringify({ transaction_xdr: signedTxXdr }) },\n        options.retry,\n      );\n      const body = (await response.json().catch(() => ({}))) as RelayerResponse;\n      if (!response.ok || body.status === 'failed') {\n        return { status: 'FAILED', hash: body.hash ?? '', errorResultXdr: body.errorResultXdr };\n      }\n      return { status: 'SUCCESS', hash: body.hash ?? '', returnValue: body };\n    },\n  };\n}\n","import type { rpc } from '@stellar/stellar-sdk';\n\n/**\n * Shared soroban-rpc `getEvents` pagination.\n *\n * A single `getEvents` call scans only a BOUNDED ledger slice from `startLedger`\n * (not the whole retained window) and returns a `cursor`; a naive one-shot query\n * therefore misses events near the tip. That is precisely why recovering a\n * just-created wallet found nothing: the founding `signer_added` sat ~17k ledgers\n * ahead of `latest - 1 day`, past the first page. `collectEventsToTip` follows the\n * cursor from `startLedger` to the chain tip and returns every matched event.\n */\n\nexport const EVENTS_PAGE_LIMIT = 10_000; // soroban-rpc max page size\nexport const MAX_EVENT_PAGES = 40; // safety backstop; ~1 day is 2-3 pages\n\n/** Decode the ledger sequence out of a getEvents paging cursor (`<toid>-<index>`);\n *  the TOID's top 32 bits are the ledger. Returns `null` if the shape is unexpected. */\nexport function cursorLedger(cursor: string): number | null {\n  try {\n    const toid = cursor.split('-')[0];\n    if (!toid) return null;\n    return Number(BigInt(toid) >> 32n);\n  } catch {\n    return null;\n  }\n}\n\n/** Parse the retained window floor out of the RPC's out-of-range error, e.g.\n *  \"startLedger must be within the ledger range: 3933976 - 4054935\". */\nexport function parseOldestLedger(error: unknown): number | null {\n  const raw =\n    typeof error === 'object' && error !== null && 'message' in error\n      ? (error as { message?: unknown }).message\n      : error;\n  const message = typeof raw === 'string' ? raw : String(raw);\n  const match = /ledger range:\\s*(\\d+)\\s*-\\s*\\d+/.exec(message);\n  return match ? Number(match[1]) : null;\n}\n\ntype EventsServer = Pick<rpc.Server, 'getEvents'>;\n\n/**\n * Page through `getEvents` from `startLedger` to the tip, returning all events.\n * If `startLedger` predates the retained window, clamps just inside the reported\n * floor (+2 absorbs the window advancing mid-round-trip and an exclusive bound)\n * and retries. Bounded by {@link MAX_EVENT_PAGES}.\n */\nexport async function collectEventsToTip(\n  server: EventsServer,\n  filters: rpc.Api.EventFilter[],\n  startLedger: number,\n): Promise<rpc.Api.EventResponse[]> {\n  const events: rpc.Api.EventResponse[] = [];\n  let start = startLedger;\n  let cursor: string | undefined;\n  let previousCursor: string | undefined;\n\n  for (let page = 0; page < MAX_EVENT_PAGES; page++) {\n    let response: rpc.Api.GetEventsResponse;\n    try {\n      response = await server.getEvents(\n        cursor\n          ? { filters, cursor, limit: EVENTS_PAGE_LIMIT }\n          : { filters, startLedger: start, limit: EVENTS_PAGE_LIMIT },\n      );\n    } catch (error) {\n      const oldest = parseOldestLedger(error);\n      if (!cursor && oldest != null && start <= oldest) {\n        start = oldest + 2;\n        continue;\n      }\n      throw error;\n    }\n    events.push(...response.events);\n    previousCursor = cursor;\n    cursor = response.cursor;\n    // Stop once the scan reaches the tip, the cursor stops advancing, or it is gone.\n    if (!cursor || cursor === previousCursor) break;\n    const scanned = cursorLedger(cursor);\n    if (scanned != null && scanned >= response.latestLedger) break;\n  }\n  return events;\n}\n","import { rpc, scValToNative } from '@stellar/stellar-sdk';\nimport { collectEventsToTip } from './eventsPaging';\nimport type { IndexerAdapter, ResolvedAccount } from './types';\n\nfunction decodeNative(scv: unknown): unknown {\n  try {\n    return scValToNative(scv as never);\n  } catch {\n    return undefined;\n  }\n}\n\nexport interface EventsIndexerOptions {\n  rpcUrl: string;\n  /** The passkey factory contract that emits an `add`/deploy event per account. */\n  factoryContractId: string;\n  /** Ledger to scan from; defaults to ~1 day back from the latest ledger. */\n  startLedger?: number;\n  allowHttp?: boolean;\n  /**\n   * Map a factory event → resolved account when it concerns `credentialId`.\n   * Defaults to the deployed `AccountFactory` schema (see contracts/account-factory):\n   * topics `[symbol \"deployed\", bytes credentialId]`, value = the deployed C-address.\n   * Override only for a different factory event shape.\n   */\n  matchEvent?: (event: rpc.Api.EventResponse, credentialId: string) => ResolvedAccount | null;\n}\n\nconst LEDGERS_PER_DAY = 17_280; // ~5s ledgers\n\n/**\n * Parse the `AccountFactory.deploy` event `('deployed', credentialId) -> address`:\n * confirm the second topic (credential-id bytes, utf-8) equals `credentialId` and\n * resolve to the deployed account address carried in the event value. Falls back\n * to a raw-XDR scan if the topics aren't in the expected shape.\n */\nfunction defaultMatch(event: rpc.Api.EventResponse, credentialId: string): ResolvedAccount | null {\n  try {\n    const topics = event.topic ?? [];\n    if (topics.length >= 2) {\n      const tag = decodeNative(topics[0]);\n      const credRaw = decodeNative(topics[1]);\n      const cred =\n        credRaw instanceof Uint8Array ? new TextDecoder().decode(credRaw) : String(credRaw ?? '');\n      if (tag === 'deployed' && cred === credentialId) {\n        const addr = decodeNative(event.value);\n        if (typeof addr === 'string' && addr.startsWith('C')) return { contractId: addr };\n      }\n    }\n    // Fallback: scan the raw XDR for the credential id; prefer the deployed\n    // address in the value, else the emitting contract.\n    const haystack = [event.value, ...topics].map((v) => v.toXDR('base64')).join('|');\n    if (!haystack.includes(credentialId)) return null;\n    const addr = decodeNative(event.value);\n    if (typeof addr === 'string' && addr.startsWith('C')) return { contractId: addr };\n    return event.contractId ? { contractId: event.contractId.toString() } : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Default, zero-infra indexer: soroban-rpc `getEvents` filtered on the factory\n * contract — no external indexing service. `mercury` is an optional alternative;\n * the SDK works with `events` alone.\n */\nexport function eventsIndexer(options: EventsIndexerOptions): IndexerAdapter {\n  const server = new rpc.Server(options.rpcUrl, {\n    allowHttp: options.allowHttp ?? options.rpcUrl.startsWith('http://'),\n  });\n  const match = options.matchEvent ?? defaultMatch;\n  return {\n    async resolveByCredential(credentialId: string): Promise<ResolvedAccount[]> {\n      const startLedger =\n        options.startLedger ??\n        Math.max(1, (await server.getLatestLedger()).sequence - LEDGERS_PER_DAY);\n      // Paginate to the tip: a single getEvents scans only a bounded slice, so a\n      // one-shot query misses factory deploys near the latest ledger.\n      const events = await collectEventsToTip(\n        server,\n        [{ type: 'contract', contractIds: [options.factoryContractId] }],\n        startLedger,\n      );\n      const accounts: ResolvedAccount[] = [];\n      for (const event of events) {\n        const resolved = match(event, credentialId);\n        if (resolved) accounts.push(resolved);\n      }\n      return accounts;\n    },\n  };\n}\n","import { KitError } from '../errors';\nimport { httpPost, type RetryOptions } from './http';\nimport type { IndexerAdapter, ResolvedAccount } from './types';\n\nexport interface MercuryIndexerOptions {\n  url: string;\n  token?: string;\n  /** Map the Mercury/Zephyr JSON response → resolved accounts. */\n  parse?: (json: unknown) => ResolvedAccount[];\n  /** Optional bounded retry on transient (429 / 5xx / network) failures. */\n  retry?: RetryOptions;\n}\n\n/**\n * Optional Mercury (Zephyr) indexer. Entirely optional — `events` is the\n * zero-infra default and the SDK never requires Mercury. A network failure\n * surfaces as `KitError('NETWORK_ERROR')`; an HTTP error throws\n * `NETWORK_ERROR` too, so a server error is never silently read as \"no accounts\".\n */\nexport function mercuryIndexer(options: MercuryIndexerOptions): IndexerAdapter {\n  const parse =\n    options.parse ??\n    ((json: unknown): ResolvedAccount[] => {\n      const rows = (json as { accounts?: { contractId?: string }[] }).accounts ?? [];\n      return rows.flatMap((r) => (r.contractId ? [{ contractId: r.contractId }] : []));\n    });\n  return {\n    async resolveByCredential(credentialId: string): Promise<ResolvedAccount[]> {\n      const headers: Record<string, string> = { 'content-type': 'application/json' };\n      if (options.token) headers['authorization'] = `Bearer ${options.token}`;\n      const response = await httpPost(\n        options.url,\n        { headers, body: JSON.stringify({ credentialId }) },\n        options.retry,\n      );\n      if (!response.ok) {\n        throw new KitError(\n          'NETWORK_ERROR',\n          `mercury indexer returned HTTP ${String(response.status)}`,\n        );\n      }\n      return parse(await response.json().catch(() => ({})));\n    },\n  };\n}\n","import type { IndexerAdapter, SubmissionAdapter } from './types';\nimport { directSubmission } from './direct';\nimport { eventsIndexer } from './events';\n\nexport interface DefaultAdapterOptions {\n  rpcUrl: string;\n  networkPassphrase: string;\n  factoryContractId: string;\n  allowHttp?: boolean;\n}\n\n/** The zero-infra default stack: `direct` submission + `events` indexer. */\nexport function defaultAdapters(options: DefaultAdapterOptions): {\n  submission: SubmissionAdapter;\n  indexer: IndexerAdapter;\n} {\n  return {\n    submission: directSubmission({\n      rpcUrl: options.rpcUrl,\n      networkPassphrase: options.networkPassphrase,\n      allowHttp: options.allowHttp,\n    }),\n    indexer: eventsIndexer({\n      rpcUrl: options.rpcUrl,\n      factoryContractId: options.factoryContractId,\n      allowHttp: options.allowHttp,\n    }),\n  };\n}\n","import {\n  rpc,\n  Contract,\n  Keypair,\n  TransactionBuilder,\n  nativeToScVal,\n  scValToNative,\n} from '@stellar/stellar-sdk';\nimport { KitError } from '../errors';\nimport type { AccountDeployer } from '../ceremonies/types';\n\nexport interface FactoryDeployerOptions {\n  rpcUrl: string;\n  networkPassphrase: string;\n  /** The deployed `AccountFactory` contract id (`C…`) — see contracts/account-factory. */\n  factoryContractId: string;\n  /**\n   * Secret of the testnet account that pays the fee + signs the deploy tx. The\n   * factory's `deploy` is not auth-gated, so this just sources/sponsors the\n   * transaction. In a public demo this is an ephemeral, friendbot-funded key —\n   * never a key with value.\n   */\n  sourceSecret: string;\n  allowHttp?: boolean;\n  fee?: string;\n}\n\n/**\n * `AccountDeployer` backed by the on-chain `AccountFactory`: invokes\n * `factory.deploy(public_key, credential_id)`, which deploys a fresh\n * `webauthn-account` for the passkey and emits the `(deployed, credentialId)`\n * event the `eventsIndexer` resolves. Returns the new smart-account C-address.\n * This is the real \"create a passkey wallet on-chain\" path.\n */\nexport function factoryDeployer(options: FactoryDeployerOptions): AccountDeployer {\n  const server = new rpc.Server(options.rpcUrl, {\n    allowHttp: options.allowHttp ?? options.rpcUrl.startsWith('http://'),\n  });\n  const source = Keypair.fromSecret(options.sourceSecret);\n  return {\n    async deploy(input) {\n      const pk = nativeToScVal(Buffer.from(input.publicKey), { type: 'bytes' });\n      const cred = nativeToScVal(Buffer.from(new TextEncoder().encode(input.credentialId)), {\n        type: 'bytes',\n      });\n      const account = await server.getAccount(source.publicKey());\n      const tx = new TransactionBuilder(account, {\n        fee: options.fee ?? '2000000',\n        networkPassphrase: options.networkPassphrase,\n      })\n        .addOperation(new Contract(options.factoryContractId).call('deploy', pk, cred))\n        .setTimeout(120)\n        .build();\n\n      const sim = await server.simulateTransaction(tx);\n      if (!rpc.Api.isSimulationSuccess(sim)) {\n        throw new KitError('CONTRACT_AUTH_FAILED', 'factory deploy simulation failed');\n      }\n      const prepared = rpc.assembleTransaction(tx, sim).build();\n      prepared.sign(source);\n\n      const sent = await server.sendTransaction(prepared);\n      if (sent.status === 'ERROR') {\n        throw new KitError('NETWORK_ERROR', 'factory deploy submit error');\n      }\n      const final = await server.pollTransaction(sent.hash);\n      if (final.status !== rpc.Api.GetTransactionStatus.SUCCESS) {\n        throw new KitError('CONTRACT_AUTH_FAILED', `factory deploy ${final.status}`);\n      }\n      const ret = (final as { returnValue?: unknown }).returnValue;\n      const contractId = ret ? String(scValToNative(ret as never)) : '';\n      return { contractId, txHash: sent.hash };\n    },\n  };\n}\n","import { Address, Keypair, Operation, TransactionBuilder, rpc, xdr } from '@stellar/stellar-sdk';\nimport { sha256 } from '@noble/hashes/sha256';\nimport { KitError } from '../errors';\nimport { decodeChallenge } from '../webauthn/clientData';\nimport { buildSecp256r1Signer } from '../soroban/signer';\nimport { buildSignerKeyScVal } from '../soroban/smartWallet';\nimport { deriveSmartWalletAddress } from '../soroban/address';\nimport { collectEventsToTip } from './eventsPaging';\nimport type { AccountDeployer } from '../ceremonies/types';\nimport type { IndexerAdapter, ResolvedAccount } from './types';\n\n/** The canonical audited v1 smart-wallet wasm hash on testnet (kalepail #32). */\nexport const SMART_WALLET_V1_WASM_HASH =\n  '84924c53a413318df2ce753e30de53ec651404c916d30e861718ad155c94b319';\n\nexport interface SmartWalletV1DeployerOptions {\n  rpcUrl: string;\n  networkPassphrase: string;\n  /**\n   * Secret of the funded classic account that deploys + pays. It must be STABLE so\n   * the deployed address stays offline-derivable via {@link deriveSmartWalletAddress}\n   * (the deployer is part of the contract-id preimage). In a demo this is a fixed\n   * friendbot-funded key; in production a wallet team's deployer/relayer.\n   */\n  deployerSecret: string;\n  /** v1 smart-wallet wasm hash (hex). Defaults to the canonical testnet hash. */\n  wasmHash?: string;\n  allowHttp?: boolean;\n  fee?: string;\n}\n\n/**\n * `AccountDeployer` for the passkey-kit **v1 smart-wallet**: deploys a fresh wallet\n * from the audited wasm via `createCustomContract`, salted by\n * `sha256(rawCredentialId)` from a fixed deployer — so the address is deterministic\n * and offline-derivable. The contract's first `add_signer` (from `__constructor`)\n * is unauthenticated, so the deploy is a plain source-signed transaction. Pair with\n * {@link deriveSmartWalletAddress} for `getAddress` and {@link smartWalletV1Indexer}\n * for recovery.\n */\nexport function smartWalletV1Deployer(options: SmartWalletV1DeployerOptions): AccountDeployer {\n  const server = new rpc.Server(options.rpcUrl, {\n    allowHttp: options.allowHttp ?? options.rpcUrl.startsWith('http://'),\n  });\n  const source = Keypair.fromSecret(options.deployerSecret);\n  const wasmHash = options.wasmHash ?? SMART_WALLET_V1_WASM_HASH;\n  return {\n    async deploy(input) {\n      const raw = decodeChallenge(input.credentialId);\n      const contractId = deriveSmartWalletAddress({\n        deployer: source.publicKey(),\n        credentialId: input.credentialId,\n        networkPassphrase: options.networkPassphrase,\n      });\n      const op = Operation.createCustomContract({\n        address: Address.fromString(source.publicKey()),\n        wasmHash: Buffer.from(wasmHash, 'hex'),\n        salt: Buffer.from(sha256(raw)),\n        constructorArgs: [buildSecp256r1Signer({ credentialId: raw, publicKey: input.publicKey })],\n      });\n      const account = await server.getAccount(source.publicKey());\n      const tx = new TransactionBuilder(account, {\n        fee: options.fee ?? '10000000',\n        networkPassphrase: options.networkPassphrase,\n      })\n        .addOperation(op)\n        .setTimeout(120)\n        .build();\n      const sim = await server.simulateTransaction(tx);\n      if (!rpc.Api.isSimulationSuccess(sim)) {\n        throw new KitError('CONTRACT_AUTH_FAILED', 'smart-wallet v1 deploy simulation failed');\n      }\n      const prepared = rpc.assembleTransaction(tx, sim).build();\n      prepared.sign(source);\n      const sent = await server.sendTransaction(prepared);\n      if (sent.status === 'ERROR') {\n        throw new KitError('NETWORK_ERROR', 'smart-wallet v1 deploy submit error');\n      }\n      const final = await server.pollTransaction(sent.hash);\n      if (final.status !== rpc.Api.GetTransactionStatus.SUCCESS) {\n        throw new KitError('CONTRACT_AUTH_FAILED', `smart-wallet v1 deploy ${final.status}`);\n      }\n      return { contractId, txHash: sent.hash };\n    },\n  };\n}\n\nconst LEDGERS_PER_DAY = 17_280; // ~5s ledgers\n\nexport interface SmartWalletV1IndexerOptions {\n  rpcUrl: string;\n  /** Ledger to scan from; defaults to ~1 day back. The events RPC retains a limited window. */\n  startLedger?: number;\n  allowHttp?: boolean;\n}\n\n/**\n * `IndexerAdapter` for the v1 smart-wallet: resolves a credential id → wallet\n * address from the on-chain `signer_added` events. Schema confirmed empirically\n * against the deployed v0.13.0 wasm (`scripts/v1-events-probe.ts`):\n * `topic[0]=Symbol(\"signer_added\")`, `topic[1]=SignerKey::Secp256r1(rawCredId)`,\n * and the wallet is the EMITTING contract. Works for BOTH the founding credential\n * (deploy emits `signer_added`) and signers added later via `add_signer`.\n *\n * A single `getEvents` call only scans a bounded ledger slice from `startLedger`\n * (not the whole window) and returns a cursor, so a naive one-shot query misses\n * events near the tip — the exact reason recovery of a just-created wallet found\n * nothing. We therefore PAGINATE by cursor from `startLedger` to the tip,\n * accumulating every wallet the credential signs for. soroban-rpc retains only a\n * limited window, so this is the zero-infra default for recent wallets; use a\n * persistent indexer (Mercury) for older ones.\n */\nexport function smartWalletV1Indexer(options: SmartWalletV1IndexerOptions): IndexerAdapter {\n  const server = new rpc.Server(options.rpcUrl, {\n    allowHttp: options.allowHttp ?? options.rpcUrl.startsWith('http://'),\n  });\n  return {\n    async resolveByCredential(credentialId: string): Promise<ResolvedAccount[]> {\n      const raw = decodeChallenge(credentialId);\n      // Filter directly on the two topics: the event name + this credential's SignerKey.\n      const filters = [\n        {\n          type: 'contract' as const,\n          topics: [\n            [\n              xdr.ScVal.scvSymbol('signer_added').toXDR('base64'),\n              buildSignerKeyScVal(raw).toXDR('base64'),\n            ],\n          ],\n        },\n      ];\n      const startLedger =\n        options.startLedger ??\n        Math.max(1, (await server.getLatestLedger()).sequence - LEDGERS_PER_DAY);\n\n      const events = await collectEventsToTip(server, filters, startLedger);\n      const seen = new Set<string>();\n      const accounts: ResolvedAccount[] = [];\n      for (const event of events) {\n        const contractId = event.contractId?.toString();\n        if (contractId && !seen.has(contractId)) {\n          seen.add(contractId);\n          accounts.push({ contractId });\n        }\n      }\n      return accounts;\n    },\n  };\n}\n"]}

package/dist/index.d.cts

@@ -0,0 +1,197 @@
+export { B as BATTLE_TESTED_ANCHORS, a as BattleTestedAnchor, K as KIT_ERROR_CODES, b as KitError, c as KitErrorCode, P as PasskeyCredential, d as assertES256, e as assertUserActivation, i as isKitError } from './types-dMRWEEo0.cjs';
+export { CreatePasskeyOptions, DeriveAccountAddressOptions, DeriveSmartWalletAddressOptions, RegisterPasskeyOptions, RegisteredPasskey, browserWebAuthnClient, coseKeyToSec1, createPasskey, defaultCredentialStorage, deriveAccountAddress, deriveSmartWalletAddress, extractPublicKeyFromAttestationObject, extractPublicKeyFromAuthData, registerPasskey } from './create.cjs';
+import { S as SubmissionAdapter, b as ResolvedAccount, I as IndexerAdapter, A as AccountDeployer } from './types--WNl-Sda.cjs';
+export { B as BuildCreateOptionsInput, C as CredentialStorage, P as PubKeyCredParam, a as PublicKeyCredentialCreationOptionsJSON, R as ResidentKeyRequirement, c as SubmitResult, U as UserVerificationRequirement, W as WebAuthnClient, d as WebAuthnCreateResult, e as WebAuthnGetOptions, f as WebAuthnGetResult, g as buildCreateOptions } from './types--WNl-Sda.cjs';
+export { BrowserPasskeySignerOptions, applyAssertionToEntry, applyAssertionToSmartWalletEntry, authEntryChallenge, authEntryChallengeBytes, browserPasskeySigner, buildSignerKeyScVal, buildSmartWalletSignatureVariant, compareSignerKeyScVal, derToCompact, derToCompactLowS, isLowS, normalizeLowS, reconstructSignedPayload } from './sign.cjs';
+export { A as AuthenticatorDataFlags, C as CheckAuthResult, a as ClientData, P as ParsedAuthenticatorData, S as SmartWalletCheckAuthResult, V as VerifyAssertionInput, d as decodeChallenge, e as encodeChallenge, p as parseAuthenticatorData, b as parseClientDataJSON, r as referenceCheckAuth, c as referenceSmartWalletCheckAuth, v as verifyAssertionSignature, f as verifyClientDataJSON, g as verifyRpIdHash } from './checkAuth-C2AcXqFe.cjs';
+export { A as AssertionResult, S as SignVerifyOptions, a as SorobanSignOptions, W as WalletTarget, b as WebAuthnSigner, s as signAuthEntry, c as signTransaction } from './sign-Cfg0NM0T.cjs';
+export { B as BuildAddSignerOptions, a as BuildRemoveSignerOptions, S as Secp256r1SignerSpec, b as SendSmartWalletTxOptions, c as SignerStorage, d as buildAddSignerOperation, e as buildRemoveSignerOperation, f as buildSecp256r1Signer, s as sendSmartWalletTx } from './submit-BDKADQq0.cjs';
+export { ConnectOptions, ConnectResult, connect } from './connect.cjs';
+export { R as RecoverOptions, a as RecoverResult, r as recover } from './recover-0wbOXDjR.cjs';
+export { AddSignerOptions, NewDeviceSigner, RemoveSignerOptions, WalletCallOptions, addSigner, removeSigner } from './recover.cjs';
+import { rpc } from '@stellar/stellar-sdk';
+
+interface DirectSubmissionOptions {
+    rpcUrl: string;
+    networkPassphrase: string;
+    allowHttp?: boolean;
+    /** Max confirmation-poll attempts before failing with NETWORK_ERROR (default 30). */
+    pollAttempts?: number;
+    /** Delay between confirmation polls, in ms (default 1000). */
+    pollIntervalMs?: number;
+}
+/**
+ * Default, zero-infra submission: send straight to soroban-rpc and poll. No
+ * relayer, no API key. Swappable with `launchtube`/`openzeppelinRelayer` with
+ * zero ceremony changes (same `SubmissionAdapter` shape).
+ */
+declare function directSubmission(options: DirectSubmissionOptions): SubmissionAdapter;
+
+/**
+ * Bounded retry/backoff for the optional HTTP adapters (Launchtube / OZ Relayer /
+ * Mercury). Opt-in: `retries` defaults to 1 (no retry), preserving the plain
+ * single-shot behavior unless a caller asks for resilience.
+ */
+interface RetryOptions {
+    /** Total attempts including the first (default 1 = no retry). */
+    retries?: number;
+    /** Linear backoff base in ms; attempt N waits `backoffMs * N` (default 300). */
+    backoffMs?: number;
+}
+
+interface LaunchtubeSubmissionOptions {
+    url: string;
+    /** Bearer token (Launchtube is invite/credit-gated). */
+    token?: string;
+    /** Optional bounded retry on transient (429 / 5xx / network) failures. */
+    retry?: RetryOptions;
+}
+/**
+ * Legacy Launchtube relay (optional). Modelled as ONE submission adapter — the
+ * SDK does not depend on it; `direct` is the default and `openzeppelinRelayer`
+ * is the post-Launchtube direction. A network failure surfaces as a typed
+ * `KitError('NETWORK_ERROR')`; an HTTP error becomes a `FAILED` result carrying
+ * the relay's error body.
+ */
+declare function launchtubeSubmission(options: LaunchtubeSubmissionOptions): SubmissionAdapter;
+
+interface OpenZeppelinRelayerOptions {
+    url: string;
+    apiKey?: string;
+    /** Optional bounded retry on transient (429 / 5xx / network) failures. */
+    retry?: RetryOptions;
+}
+/**
+ * OpenZeppelin Relayer / Channels submission (the post-Launchtube direction).
+ * Same `SubmissionAdapter` shape, so swapping it in is a one-line config change.
+ * A network failure surfaces as `KitError('NETWORK_ERROR')`; an HTTP error (or a
+ * `status: "failed"` body) becomes a `FAILED` result.
+ */
+declare function openzeppelinRelayerSubmission(options: OpenZeppelinRelayerOptions): SubmissionAdapter;
+
+interface EventsIndexerOptions {
+    rpcUrl: string;
+    /** The passkey factory contract that emits an `add`/deploy event per account. */
+    factoryContractId: string;
+    /** Ledger to scan from; defaults to ~1 day back from the latest ledger. */
+    startLedger?: number;
+    allowHttp?: boolean;
+    /**
+     * Map a factory event → resolved account when it concerns `credentialId`.
+     * Defaults to the deployed `AccountFactory` schema (see contracts/account-factory):
+     * topics `[symbol "deployed", bytes credentialId]`, value = the deployed C-address.
+     * Override only for a different factory event shape.
+     */
+    matchEvent?: (event: rpc.Api.EventResponse, credentialId: string) => ResolvedAccount | null;
+}
+/**
+ * Default, zero-infra indexer: soroban-rpc `getEvents` filtered on the factory
+ * contract — no external indexing service. `mercury` is an optional alternative;
+ * the SDK works with `events` alone.
+ */
+declare function eventsIndexer(options: EventsIndexerOptions): IndexerAdapter;
+
+interface MercuryIndexerOptions {
+    url: string;
+    token?: string;
+    /** Map the Mercury/Zephyr JSON response → resolved accounts. */
+    parse?: (json: unknown) => ResolvedAccount[];
+    /** Optional bounded retry on transient (429 / 5xx / network) failures. */
+    retry?: RetryOptions;
+}
+/**
+ * Optional Mercury (Zephyr) indexer. Entirely optional — `events` is the
+ * zero-infra default and the SDK never requires Mercury. A network failure
+ * surfaces as `KitError('NETWORK_ERROR')`; an HTTP error throws
+ * `NETWORK_ERROR` too, so a server error is never silently read as "no accounts".
+ */
+declare function mercuryIndexer(options: MercuryIndexerOptions): IndexerAdapter;
+
+interface DefaultAdapterOptions {
+    rpcUrl: string;
+    networkPassphrase: string;
+    factoryContractId: string;
+    allowHttp?: boolean;
+}
+/** The zero-infra default stack: `direct` submission + `events` indexer. */
+declare function defaultAdapters(options: DefaultAdapterOptions): {
+    submission: SubmissionAdapter;
+    indexer: IndexerAdapter;
+};
+
+interface FactoryDeployerOptions {
+    rpcUrl: string;
+    networkPassphrase: string;
+    /** The deployed `AccountFactory` contract id (`C…`) — see contracts/account-factory. */
+    factoryContractId: string;
+    /**
+     * Secret of the testnet account that pays the fee + signs the deploy tx. The
+     * factory's `deploy` is not auth-gated, so this just sources/sponsors the
+     * transaction. In a public demo this is an ephemeral, friendbot-funded key —
+     * never a key with value.
+     */
+    sourceSecret: string;
+    allowHttp?: boolean;
+    fee?: string;
+}
+/**
+ * `AccountDeployer` backed by the on-chain `AccountFactory`: invokes
+ * `factory.deploy(public_key, credential_id)`, which deploys a fresh
+ * `webauthn-account` for the passkey and emits the `(deployed, credentialId)`
+ * event the `eventsIndexer` resolves. Returns the new smart-account C-address.
+ * This is the real "create a passkey wallet on-chain" path.
+ */
+declare function factoryDeployer(options: FactoryDeployerOptions): AccountDeployer;
+
+/** The canonical audited v1 smart-wallet wasm hash on testnet (kalepail #32). */
+declare const SMART_WALLET_V1_WASM_HASH = "84924c53a413318df2ce753e30de53ec651404c916d30e861718ad155c94b319";
+interface SmartWalletV1DeployerOptions {
+    rpcUrl: string;
+    networkPassphrase: string;
+    /**
+     * Secret of the funded classic account that deploys + pays. It must be STABLE so
+     * the deployed address stays offline-derivable via {@link deriveSmartWalletAddress}
+     * (the deployer is part of the contract-id preimage). In a demo this is a fixed
+     * friendbot-funded key; in production a wallet team's deployer/relayer.
+     */
+    deployerSecret: string;
+    /** v1 smart-wallet wasm hash (hex). Defaults to the canonical testnet hash. */
+    wasmHash?: string;
+    allowHttp?: boolean;
+    fee?: string;
+}
+/**
+ * `AccountDeployer` for the passkey-kit **v1 smart-wallet**: deploys a fresh wallet
+ * from the audited wasm via `createCustomContract`, salted by
+ * `sha256(rawCredentialId)` from a fixed deployer — so the address is deterministic
+ * and offline-derivable. The contract's first `add_signer` (from `__constructor`)
+ * is unauthenticated, so the deploy is a plain source-signed transaction. Pair with
+ * {@link deriveSmartWalletAddress} for `getAddress` and {@link smartWalletV1Indexer}
+ * for recovery.
+ */
+declare function smartWalletV1Deployer(options: SmartWalletV1DeployerOptions): AccountDeployer;
+interface SmartWalletV1IndexerOptions {
+    rpcUrl: string;
+    /** Ledger to scan from; defaults to ~1 day back. The events RPC retains a limited window. */
+    startLedger?: number;
+    allowHttp?: boolean;
+}
+/**
+ * `IndexerAdapter` for the v1 smart-wallet: resolves a credential id → wallet
+ * address from the on-chain `signer_added` events. Schema confirmed empirically
+ * against the deployed v0.13.0 wasm (`scripts/v1-events-probe.ts`):
+ * `topic[0]=Symbol("signer_added")`, `topic[1]=SignerKey::Secp256r1(rawCredId)`,
+ * and the wallet is the EMITTING contract. Works for BOTH the founding credential
+ * (deploy emits `signer_added`) and signers added later via `add_signer`.
+ *
+ * A single `getEvents` call only scans a bounded ledger slice from `startLedger`
+ * (not the whole window) and returns a cursor, so a naive one-shot query misses
+ * events near the tip — the exact reason recovery of a just-created wallet found
+ * nothing. We therefore PAGINATE by cursor from `startLedger` to the tip,
+ * accumulating every wallet the credential signs for. soroban-rpc retains only a
+ * limited window, so this is the zero-infra default for recent wallets; use a
+ * persistent indexer (Mercury) for older ones.
+ */
+declare function smartWalletV1Indexer(options: SmartWalletV1IndexerOptions): IndexerAdapter;
+
+export { AccountDeployer, type DefaultAdapterOptions, type DirectSubmissionOptions, type EventsIndexerOptions, type FactoryDeployerOptions, IndexerAdapter, type LaunchtubeSubmissionOptions, type MercuryIndexerOptions, type OpenZeppelinRelayerOptions, ResolvedAccount, SMART_WALLET_V1_WASM_HASH, type SmartWalletV1DeployerOptions, type SmartWalletV1IndexerOptions, SubmissionAdapter, defaultAdapters, directSubmission, eventsIndexer, factoryDeployer, launchtubeSubmission, mercuryIndexer, openzeppelinRelayerSubmission, smartWalletV1Deployer, smartWalletV1Indexer };