@tatchi-xyz/sdk 0.20.0 → 0.31.0

package/dist/cjs/server/core/AuthService.js

@@ -1,12 +1,16 @@
 const require_rolldown_runtime = require('../_virtual/rolldown_runtime.js');
+const require_validation = require('../sdk/src/utils/validation.js');
 const require_config = require('./config.js');
 const require_actions = require('../sdk/src/core/types/actions.js');
+const require_errors = require('../sdk/src/utils/errors.js');
 const require_NearClient = require('../sdk/src/core/NearClient.js');
-const require_nearCrypto = require('../sdk/src/core/nearCrypto.js');
+const require_nearKeys = require('./nearKeys.js');
 const require_utils = require('./utils.js');
-const require_errors = require('./errors.js');
+const require_errors$1 = require('./errors.js');
 const require_defaultConfigs = require('../sdk/src/core/defaultConfigs.js');
+const require_config$1 = require('./ThresholdService/config.js');
 const require_logger = require('./logger.js');
+const require_createThresholdSigningService = require('./ThresholdService/createThresholdSigningService.js');
 const require_index = require('../email-recovery/index.js');
 const require_ShamirService = require('./ShamirService.js');
 const require_index$1 = require('../delegateAction/index.js');
@@ -14,6 +18,9 @@ let src_wasm_signer_worker_pkg_wasm_signer_worker_js = require("../../wasm_signe
 src_wasm_signer_worker_pkg_wasm_signer_worker_js = require_rolldown_runtime.__toESM(src_wasm_signer_worker_pkg_wasm_signer_worker_js);
 
 //#region src/server/core/AuthService.ts
+function isObject(v) {
+	return !!v && typeof v === "object" && !Array.isArray(v);
+}
 const SIGNER_WASM_MAIN_PATH = "../../wasm_signer_worker/pkg/wasm_signer_worker_bg.wasm";
 const SIGNER_WASM_FALLBACK_PATH = "../../../workers/wasm_signer_worker_bg.wasm";
 function getSignerWasmUrls(logger) {
@@ -29,6 +36,34 @@ function getSignerWasmUrls(logger) {
 	if (!resolved.length) throw new Error("Unable to resolve signer WASM location from import.meta.url. Provide AuthServiceConfig.signerWasm.moduleOrPath in this runtime.");
 	return resolved;
 }
+function summarizeThresholdEd25519Config(cfg) {
+	if (!cfg) return "thresholdEd25519: not configured";
+	const nodeRole = require_config$1.coerceThresholdNodeRole(cfg.THRESHOLD_NODE_ROLE);
+	const shareMode = require_config$1.coerceThresholdEd25519ShareMode(cfg.THRESHOLD_ED25519_SHARE_MODE);
+	const masterSecretSet = (() => {
+		if ("kind" in cfg) return false;
+		return Boolean(require_validation.toOptionalTrimmedString(cfg.THRESHOLD_ED25519_MASTER_SECRET_B64U));
+	})();
+	const store = (() => {
+		if ("kind" in cfg) {
+			if (cfg.kind === "upstash-redis-rest") return "upstash";
+			if (cfg.kind === "redis-tcp") return "redis";
+			return "in-memory";
+		}
+		const upstashUrl = require_validation.toOptionalTrimmedString(cfg.UPSTASH_REDIS_REST_URL);
+		const upstashToken = require_validation.toOptionalTrimmedString(cfg.UPSTASH_REDIS_REST_TOKEN);
+		const redisUrl = require_validation.toOptionalTrimmedString(cfg.REDIS_URL);
+		return upstashUrl || upstashToken ? "upstash" : redisUrl ? "redis" : "in-memory";
+	})();
+	const parts = [
+		`thresholdEd25519: configured`,
+		`nodeRole=${nodeRole}`,
+		`shareMode=${shareMode}`,
+		`store=${store}`
+	];
+	if (masterSecretSet) parts.push("masterSecret=set");
+	return parts.join(" ");
+}
 /**
 * Framework-agnostic NEAR account service
 * Core business logic for account creation and registration operations
@@ -40,6 +75,8 @@ var AuthService = class {
 	relayerPublicKey = "";
 	signerWasmReady = false;
 	logger;
+	thresholdSigningServiceInitialized = false;
+	thresholdSigningService = null;
 	transactionQueue = Promise.resolve();
 	queueStats = {
 		pending: 0,
@@ -50,7 +87,7 @@ var AuthService = class {
 	emailRecovery = null;
 	constructor(config) {
 		this.config = require_config.createAuthServiceConfig(config);
-		this.logger = require_logger.normalizeLogger(this.config.logger);
+		this.logger = require_logger.coerceLogger(this.config.logger);
 		const graceFileCandidate = (this.config.shamir?.graceShamirKeysFile || "").trim();
 		this.shamirService = new require_ShamirService.ShamirService(this.config.shamir, graceFileCandidate || "grace-keys.json");
 		this.nearClient = new require_NearClient.MinimalNearClient(this.config.nearRpcUrl);
@@ -77,6 +114,7 @@ var AuthService = class {
     • accountInitialBalance: ${this.config.accountInitialBalance} (${require_utils.formatYoctoToNear(this.config.accountInitialBalance)} NEAR)
     • createAccountAndRegisterGas: ${this.config.createAccountAndRegisterGas} (${require_utils.formatGasToTGas(this.config.createAccountAndRegisterGas)})
     ${this.config.shamir ? `• shamir_p_b64u: ${this.config.shamir.shamir_p_b64u.slice(0, 10)}...\n    • shamir_e_s_b64u: ${this.config.shamir.shamir_e_s_b64u.slice(0, 10)}...\n    • shamir_d_s_b64u: ${this.config.shamir.shamir_d_s_b64u.slice(0, 10)}...` : "• shamir: not configured"}
+    • ${summarizeThresholdEd25519Config(this.config.thresholdEd25519KeyStore)}
     ${this.config.zkEmailProver?.baseUrl ? `• zkEmailProver: ${this.config.zkEmailProver.baseUrl}` : `• zkEmailProver: not configured`}
     `);
 	}
@@ -87,6 +125,36 @@ var AuthService = class {
 			publicKey: this.relayerPublicKey
 		};
 	}
+	async viewAccessKeyList(accountId) {
+		await this._ensureSignerAndRelayerAccount();
+		return this.nearClient.viewAccessKeyList(accountId);
+	}
+	/**
+	* Lazily constructs the threshold signing service when `thresholdEd25519KeyStore` is configured.
+	* Routers may call this to auto-enable `/threshold-ed25519/*` endpoints.
+	*/
+	getThresholdSigningService() {
+		if (this.thresholdSigningServiceInitialized) return this.thresholdSigningService;
+		this.thresholdSigningServiceInitialized = true;
+		if (!this.config.thresholdEd25519KeyStore) {
+			this.thresholdSigningService = null;
+			return null;
+		}
+		this.thresholdSigningService = require_createThresholdSigningService.createThresholdSigningService({
+			authService: this,
+			thresholdEd25519KeyStore: this.config.thresholdEd25519KeyStore,
+			logger: this.logger,
+			isNode: this.isNodeEnvironment()
+		});
+		return this.thresholdSigningService;
+	}
+	getWebAuthnContractId() {
+		return this.config.webAuthnContractId;
+	}
+	async txStatus(txHash, senderAccountId) {
+		await this._ensureSignerAndRelayerAccount();
+		return this.nearClient.txStatus(txHash, senderAccountId);
+	}
 	/**
 	* Configure Shamir WASM module override for serverless environments
 	* Required for Cloudflare Workers where import.meta.url doesn't work
@@ -103,8 +171,7 @@ var AuthService = class {
 			await this.shamirService.ensureReady();
 		}
 		try {
-			const { seed, pub } = require_nearCrypto.parseNearSecretKey(this.config.relayerPrivateKey);
-			this.relayerPublicKey = require_nearCrypto.toPublicKeyString(pub);
+			this.relayerPublicKey = require_nearKeys.toPublicKeyStringFromSecretKey(this.config.relayerPrivateKey);
 		} catch (e) {
 			this.logger.warn("Failed to derive public key from relayerPrivateKey; ensure it is in ed25519:<base58> format");
 			this.relayerPublicKey = "";
@@ -153,8 +220,11 @@ var AuthService = class {
 		}
 	}
 	isNodeEnvironment() {
-		const isNode = Boolean(globalThis.process?.versions?.node);
-		const isCloudflareWorker = typeof globalThis.WebSocketPair !== "undefined" || typeof navigator !== "undefined" && navigator.userAgent?.includes?.("Cloudflare-Workers");
+		const processObj = globalThis.process;
+		const isNode = Boolean(processObj?.versions?.node);
+		const webSocketPair = globalThis.WebSocketPair;
+		const nav = globalThis.navigator;
+		const isCloudflareWorker = typeof webSocketPair !== "undefined" || typeof nav?.userAgent === "string" && nav.userAgent.includes("Cloudflare-Workers");
 		return isNode && !isCloudflareWorker;
 	}
 	async resolveSignerWasmOverride(override) {
@@ -172,8 +242,8 @@ var AuthService = class {
 		for (const url of candidates) try {
 			const filePath = fileURLToPath(url);
 			const bytes = await readFile(filePath);
-			const u8 = bytes instanceof Uint8Array ? new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength) : new Uint8Array(bytes);
-			const ab = u8.buffer.slice(u8.byteOffset, u8.byteOffset + u8.byteLength);
+			const ab = new ArrayBuffer(bytes.byteLength);
+			new Uint8Array(ab).set(bytes);
 			const module$1 = await WebAssembly.compile(ab);
 			await (0, src_wasm_signer_worker_pkg_wasm_signer_worker_js.default)({ module_or_path: module$1 });
 			return;
@@ -198,7 +268,7 @@ var AuthService = class {
 		await this._ensureSignerAndRelayerAccount();
 		return this.queueTransaction(async () => {
 			try {
-				if (!this.isValidAccountId(request.accountId)) throw new Error(`Invalid account ID format: ${request.accountId}`);
+				if (!require_validation.isValidAccountId(request.accountId)) throw new Error(`Invalid account ID format: ${request.accountId}`);
 				this.logger.info(`Checking if account ${request.accountId} already exists...`);
 				const accountExists = await this.checkAccountExists(request.accountId);
 				if (accountExists) throw new Error(`Account ${request.accountId} already exists. Cannot create duplicate account.`);
@@ -210,7 +280,7 @@ var AuthService = class {
 					{ action_type: require_actions.ActionType.CreateAccount },
 					{
 						action_type: require_actions.ActionType.Transfer,
-						deposit: initialBalance
+						deposit: String(initialBalance)
 					},
 					{
 						action_type: require_actions.ActionType.AddKey,
@@ -242,10 +312,11 @@ var AuthService = class {
 				};
 			} catch (error) {
 				this.logger.error(`Account creation failed for ${request.accountId}:`, error);
+				const msg = require_errors.errorMessage(error) || "Unknown account creation error";
 				return {
 					success: false,
-					error: error.message || "Unknown account creation error",
-					message: `Failed to create account ${request.accountId}: ${error.message}`
+					error: msg,
+					message: `Failed to create account ${request.accountId}: ${msg}`
 				};
 			}
 		}, `create account ${request.accountId}`);
@@ -257,7 +328,7 @@ var AuthService = class {
 		await this._ensureSignerAndRelayerAccount();
 		return this.queueTransaction(async () => {
 			try {
-				if (!this.isValidAccountId(request.new_account_id)) throw new Error(`Invalid account ID format: ${request.new_account_id}`);
+				if (!require_validation.isValidAccountId(request.new_account_id)) throw new Error(`Invalid account ID format: ${request.new_account_id}`);
 				this.logger.info(`Checking if account ${request.new_account_id} already exists...`);
 				const accountExists = await this.checkAccountExists(request.new_account_id);
 				if (accountExists) throw new Error(`Account ${request.new_account_id} already exists. Cannot create duplicate account.`);
@@ -276,8 +347,8 @@ var AuthService = class {
 					action_type: require_actions.ActionType.FunctionCall,
 					method_name: "create_account_and_register_user",
 					args: JSON.stringify(contractArgs),
-					gas: this.config.createAccountAndRegisterGas,
-					deposit: this.config.accountInitialBalance
+					gas: String(this.config.createAccountAndRegisterGas),
+					deposit: String(this.config.accountInitialBalance)
 				}];
 				actions.forEach(require_actions.validateActionArgsWasm);
 				const { nextNonce, blockHash } = await this.fetchTxContext(this.config.relayerAccountId, this.relayerPublicKey);
@@ -290,7 +361,7 @@ var AuthService = class {
 					actions
 				});
 				const result = await this.nearClient.sendTransaction(signed);
-				const contractError = require_errors.parseContractExecutionError(result, request.new_account_id);
+				const contractError = require_errors$1.parseContractExecutionError(result, request.new_account_id);
 				if (contractError) {
 					this.logger.error(`Contract execution failed for ${request.new_account_id}:`, contractError);
 					throw new Error(contractError);
@@ -304,10 +375,11 @@ var AuthService = class {
 				};
 			} catch (error) {
 				this.logger.error(`Atomic registration failed for ${request.new_account_id}:`, error);
+				const msg = require_errors.errorMessage(error) || "Unknown atomic registration error";
 				return {
 					success: false,
-					error: error.message || "Unknown atomic registration error",
-					message: `Failed to create and register account ${request.new_account_id}: ${error.message}`
+					error: msg,
+					message: `Failed to create and register account ${request.new_account_id}: ${msg}`
 				};
 			}
 		}, `atomic create and register ${request.new_account_id}`);
@@ -320,6 +392,22 @@ var AuthService = class {
 	async verifyAuthenticationResponse(request) {
 		try {
 			await this._ensureSignerAndRelayerAccount();
+			const intentDigest32 = request?.vrf_data?.intent_digest_32;
+			if (!Array.isArray(intentDigest32) || intentDigest32.length !== 32) return {
+				success: false,
+				verified: false,
+				code: "invalid_intent_digest",
+				message: "Missing or invalid vrf_data.intent_digest_32 (expected 32 bytes)"
+			};
+			const sessionPolicyDigest32 = (request?.vrf_data)?.session_policy_digest_32;
+			if (sessionPolicyDigest32 !== void 0) {
+				if (!Array.isArray(sessionPolicyDigest32) || sessionPolicyDigest32.length !== 32) return {
+					success: false,
+					verified: false,
+					code: "invalid_session_policy_digest",
+					message: "Invalid vrf_data.session_policy_digest_32 (expected 32 bytes when present)"
+				};
+			}
 			const args = {
 				vrf_data: request.vrf_data,
 				webauthn_authentication: request.webauthn_authentication
@@ -329,7 +417,7 @@ var AuthService = class {
 				method: "verify_authentication_response",
 				args
 			});
-			const verified = Boolean(contractResponse && contractResponse.verified === true);
+			const verified = isObject(contractResponse) && contractResponse.verified === true;
 			if (!verified) return {
 				success: false,
 				verified: false,
@@ -362,23 +450,9 @@ var AuthService = class {
 	* Returns a sanitized, deduplicated list of absolute origins.
 	*/
 	async getRorOrigins(opts) {
-		const contractId = (opts?.contractId || this.config.webAuthnContractId).trim();
-		const method = (opts?.method || "get_allowed_origins").trim();
+		const contractId = require_validation.toOptionalTrimmedString(opts?.contractId) || this.config.webAuthnContractId.trim();
+		const method = require_validation.toOptionalTrimmedString(opts?.method) || "get_allowed_origins";
 		const args = opts?.args ?? {};
-		const isValidOrigin = (s) => {
-			if (typeof s !== "string" || !s) return null;
-			try {
-				const u = new URL(s.trim());
-				const scheme = u.protocol;
-				const host = u.hostname.toLowerCase();
-				const port = u.port ? `:${u.port}` : "";
-				if (scheme !== "https:" && !(scheme === "http:" && host === "localhost")) return null;
-				if (u.pathname && u.pathname !== "/" || u.search || u.hash) return null;
-				return `${scheme}//${host}${port}`;
-			} catch {
-				return null;
-			}
-		};
 		try {
 			const result = await this.nearClient.view({
 				account: contractId,
@@ -387,10 +461,10 @@ var AuthService = class {
 			});
 			let list = [];
 			if (Array.isArray(result)) list = result;
-			else if (result && typeof result === "object" && Array.isArray(result.origins)) list = result.origins;
+			else if (isObject(result) && Array.isArray(result.origins)) list = result.origins;
 			const out = /* @__PURE__ */ new Set();
 			for (const item of list) {
-				const norm = isValidOrigin(item);
+				const norm = require_validation.toRorOriginOrNull(item);
 				if (norm) out.add(norm);
 			}
 			return Array.from(out);
@@ -399,11 +473,6 @@ var AuthService = class {
 			return [];
 		}
 	}
-	isValidAccountId(accountId) {
-		if (!accountId || accountId.length < 2 || accountId.length > 64) return false;
-		const validPattern = /^[a-z0-9_.-]+$/;
-		return validPattern.test(accountId);
-	}
 	/**
 	* Account existence helper used by registration flows.
 	*/
@@ -417,17 +486,16 @@ var AuthService = class {
 			const view = await this.nearClient.viewAccount(accountId);
 			return !!view;
 		} catch (error) {
-			lastErr = error;
-			const msg = String(error?.message || "");
-			const detailsBlob = (() => {
-				try {
-					const d = error && typeof error === "object" && "details" in error ? error.details : void 0;
-					if (!d) return "";
-					return typeof d === "string" ? d : JSON.stringify(d);
-				} catch {
-					return "";
-				}
-			})();
+			const err = require_errors.toError(error);
+			lastErr = err;
+			const msg = err.message;
+			const details = err.details;
+			let detailsBlob = "";
+			if (details) try {
+				detailsBlob = typeof details === "string" ? details : JSON.stringify(details);
+			} catch {
+				detailsBlob = "";
+			}
 			const combined = `${msg}\n${detailsBlob}`;
 			if (isNotFound(combined)) return false;
 			if (isRetryable(msg) && i < attempts) {
@@ -439,10 +507,10 @@ var AuthService = class {
 				this.logger.warn(`[AuthService] Assuming account '${accountId}' not found after retryable RPC errors:`, msg);
 				return false;
 			}
-			this.logger.error(`Error checking account existence for ${accountId}:`, error);
-			throw error;
+			this.logger.error(`Error checking account existence for ${accountId}:`, err);
+			throw err;
 		}
-		throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+		throw lastErr || /* @__PURE__ */ new Error("Unknown error");
 	}
 	/**
 	* ===== Delegate actions & transaction execution =====
@@ -508,7 +576,18 @@ var AuthService = class {
 				actions: input.actions
 			}
 		};
-		const response = await (0, src_wasm_signer_worker_pkg_wasm_signer_worker_js.handle_signer_message)(message);
+		let response;
+		try {
+			response = await (0, src_wasm_signer_worker_pkg_wasm_signer_worker_js.handle_signer_message)(message);
+		} catch (e) {
+			const msg = require_errors.errorMessage(e);
+			this.logger.error("Signer WASM rejected message:", {
+				error: msg,
+				payload: JSON.stringify(message, (key, value) => key === "nearPrivateKey" ? "[REDACTED]" : value)
+			});
+			if (msg.includes("Invalid payload for SIGN_TRANSACTION_WITH_KEYPAIR")) throw new Error(`Signer WASM rejected SIGN_TRANSACTION_WITH_KEYPAIR payload: ${msg}. Rebuild + redeploy the relayer so the bundled \`wasm_signer_worker.js\` and \`wasm_signer_worker_bg.wasm\` come from the same build.`);
+			throw e instanceof Error ? e : new Error(msg || "Signing failed");
+		}
 		const { transaction, signature, borshBytes } = extractFirstSignedTransactionFromWorkerResponse(response);
 		return new require_NearClient.SignedTransaction({
 			transaction,
@@ -586,7 +665,7 @@ var AuthService = class {
 			} catch (error) {
 				this.queueStats.failed++;
 				this.queueStats.pending--;
-				this.logger.error(`[AuthService] Failed: ${description} (failed: ${this.queueStats.failed}):`, error?.message);
+				this.logger.error(`[AuthService] Failed: ${description} (failed: ${this.queueStats.failed}):`, require_errors.errorMessage(error) || "unknown error");
 				throw error;
 			}
 		}).catch((error) => {

package/dist/cjs/server/core/AuthService.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthService.js","names":["resolved: URL[]","createAuthServiceConfig","normalizeLogger","ShamirService","MinimalNearClient","EmailRecoveryService","DEFAULT_EMAIL_RECOVERY_CONTRACTS","formatYoctoToNear","formatGasToTGas","parseNearSecretKey","toPublicKeyString","candidates: URL[]","lastError: unknown","module","actions: ActionArgsWasm[]","ActionType","validateActionArgsWasm","error: any","parseContractExecutionError","list: string[]","lastErr: any","executeSignedDelegateWithRelayer","WorkerRequestType","SignedTransaction","body: VerifyAuthenticationRequest","WorkerResponseType"],"sources":["../../../../src/server/core/AuthService.ts"],"sourcesContent":["import { ActionType, type ActionArgsWasm, validateActionArgsWasm } from '../../core/types/actions';\nimport { MinimalNearClient, SignedTransaction } from '../../core/NearClient';\nimport { parseNearSecretKey, toPublicKeyString } from '../../core/nearCrypto';\nimport { createAuthServiceConfig } from './config';\nimport { formatGasToTGas, formatYoctoToNear } from './utils';\nimport { parseContractExecutionError } from './errors';\n\nimport initSignerWasm, {\n  handle_signer_message,\n  WorkerRequestType,\n  WorkerResponseType,\n  type InitInput,\n  type WasmTransaction,\n  type WasmSignature,\n} from '../../wasm_signer_worker/pkg/wasm_signer_worker.js';\n\nimport type {\n  AuthServiceConfig,\n  AuthServiceConfigInput,\n  AccountCreationRequest,\n  AccountCreationResult,\n  CreateAccountAndRegisterRequest,\n  CreateAccountAndRegisterResult,\n  VerifyAuthenticationRequest,\n  VerifyAuthenticationResponse,\n  SignerWasmModuleSupplier,\n} from './types';\n\nimport { DEFAULT_EMAIL_RECOVERY_CONTRACTS } from '../../core/defaultConfigs';\nimport { EmailRecoveryService } from '../email-recovery';\nimport { ShamirService } from './ShamirService';\nimport { SignedDelegate } from '../../core/types/delegate';\nimport {\n  type ExecuteSignedDelegateResult,\n  executeSignedDelegateWithRelayer,\n  type DelegateActionPolicy,\n} from '../delegateAction';\nimport { normalizeLogger, type NormalizedLogger } from './logger';\n\n// =============================\n// WASM URL CONSTANTS + HELPERS\n// =============================\n\n// Primary location (preserveModules output)\nconst SIGNER_WASM_MAIN_PATH = '../../wasm_signer_worker/pkg/wasm_signer_worker_bg.wasm';\n// Fallback location (dist/workers copy step)\nconst SIGNER_WASM_FALLBACK_PATH = '../../../workers/wasm_signer_worker_bg.wasm';\n\nfunction getSignerWasmUrls(logger: NormalizedLogger): URL[] {\n  const paths = [SIGNER_WASM_MAIN_PATH, SIGNER_WASM_FALLBACK_PATH];\n  const resolved: URL[] = [];\n  const baseUrl = import.meta.url;\n\n  for (const path of paths) {\n    try {\n      if (!baseUrl) throw new Error('import.meta.url is undefined');\n      resolved.push(new URL(path, baseUrl));\n    } catch (err) {\n      logger.warn(`Failed to resolve signer WASM relative URL for path \"${path}\":`, err);\n    }\n  }\n\n  if (!resolved.length) {\n    throw new Error('Unable to resolve signer WASM location from import.meta.url. Provide AuthServiceConfig.signerWasm.moduleOrPath in this runtime.');\n  }\n\n  return resolved;\n}\n\n/**\n * Framework-agnostic NEAR account service\n * Core business logic for account creation and registration operations\n */\nexport class AuthService {\n  private config: AuthServiceConfig;\n  private isInitialized = false;\n  private nearClient: MinimalNearClient;\n  private relayerPublicKey: string = '';\n  private signerWasmReady = false;\n  private readonly logger: NormalizedLogger;\n\n  // Transaction queue to prevent nonce conflicts\n  private transactionQueue: Promise<any> = Promise.resolve();\n  private queueStats = { pending: 0, completed: 0, failed: 0 };\n\n  // Shamir 3-pass key management (delegated to ShamirService)\n  public readonly shamirService: ShamirService | null = null;\n  // DKIM/TEE email recovery logic (delegated to EmailRecoveryService)\n  public readonly emailRecovery: EmailRecoveryService | null = null;\n\n  constructor(config: AuthServiceConfigInput) {\n    this.config = createAuthServiceConfig(config);\n    this.logger = normalizeLogger(this.config.logger);\n    const graceFileCandidate = (this.config.shamir?.graceShamirKeysFile || '').trim();\n    this.shamirService = new ShamirService(this.config.shamir, graceFileCandidate || 'grace-keys.json');\n    this.nearClient = new MinimalNearClient(this.config.nearRpcUrl);\n    this.emailRecovery = new EmailRecoveryService({\n      relayerAccountId: this.config.relayerAccountId,\n      relayerPrivateKey: this.config.relayerPrivateKey,\n      networkId: this.config.networkId,\n      emailDkimVerifierContract: DEFAULT_EMAIL_RECOVERY_CONTRACTS.emailDkimVerifierContract,\n      nearClient: this.nearClient,\n      logger: this.config.logger,\n      ensureSignerAndRelayerAccount: () => this._ensureSignerAndRelayerAccount(),\n      queueTransaction: <T>(fn: () => Promise<T>, label: string) => this.queueTransaction(fn, label),\n      fetchTxContext: (accountId: string, publicKey: string) => this.fetchTxContext(accountId, publicKey),\n      signWithPrivateKey: (input) => this.signWithPrivateKey(input),\n      getRelayerPublicKey: () => this.relayerPublicKey,\n      zkEmailProver: this.config.zkEmailProver,\n    });\n\n    // Log effective configuration at construction time so operators can\n    // verify wiring immediately when the service is created.\n    this.logger.info(`\n    AuthService initialized with:\n    • networkId: ${this.config.networkId}\n    • nearRpcUrl: ${this.config.nearRpcUrl}\n    • relayerAccountId: ${this.config.relayerAccountId}\n    • webAuthnContractId: ${this.config.webAuthnContractId}\n    • accountInitialBalance: ${this.config.accountInitialBalance} (${formatYoctoToNear(this.config.accountInitialBalance)} NEAR)\n    • createAccountAndRegisterGas: ${this.config.createAccountAndRegisterGas} (${formatGasToTGas(this.config.createAccountAndRegisterGas)})\n    ${\n      this.config.shamir\n        ? `• shamir_p_b64u: ${this.config.shamir.shamir_p_b64u.slice(0, 10)}...\\n    • shamir_e_s_b64u: ${this.config.shamir.shamir_e_s_b64u.slice(0, 10)}...\\n    • shamir_d_s_b64u: ${this.config.shamir.shamir_d_s_b64u.slice(0, 10)}...`\n        : '• shamir: not configured'\n    }\n    ${\n      this.config.zkEmailProver?.baseUrl\n        ? `• zkEmailProver: ${this.config.zkEmailProver.baseUrl}`\n        : `• zkEmailProver: not configured`\n    }\n    `);\n  }\n\n  async getRelayerAccount(): Promise<{ accountId: string; publicKey: string }> {\n    await this._ensureSignerAndRelayerAccount();\n    return {\n      accountId: this.config.relayerAccountId,\n      publicKey: this.relayerPublicKey\n    };\n  }\n\n  /**\n   * Configure Shamir WASM module override for serverless environments\n   * Required for Cloudflare Workers where import.meta.url doesn't work\n   */\n  private async configureShamirWasmForServerless(): Promise<void> {\n    if (!this.config.shamir?.moduleOrPath) {\n      return;\n    }\n\n    const { setShamirWasmModuleOverride } = await import('./shamirWorker.js');\n    setShamirWasmModuleOverride(this.config.shamir.moduleOrPath);\n  }\n\n  private async _ensureSignerAndRelayerAccount(): Promise<void> {\n    if (this.isInitialized) {\n      return;\n    }\n\n    // Initialize Shamir 3-pass via ShamirService (if configured)\n    if (this.config.shamir && this.shamirService) {\n      await this.configureShamirWasmForServerless();\n      await this.shamirService.ensureReady();\n    }\n\n    // Derive public key from configured relayer private key\n    try {\n      const { seed, pub } = parseNearSecretKey(this.config.relayerPrivateKey);\n      this.relayerPublicKey = toPublicKeyString(pub);\n    } catch (e) {\n      this.logger.warn('Failed to derive public key from relayerPrivateKey; ensure it is in ed25519:<base58> format');\n      this.relayerPublicKey = '';\n    }\n\n    // Prepare signer WASM for transaction building/signing\n    await this.ensureSignerWasm();\n    this.isInitialized = true;\n  }\n\n  private async ensureSignerWasm(): Promise<void> {\n    if (this.signerWasmReady) return;\n    const override = this.config.signerWasm?.moduleOrPath;\n    if (override) {\n      try {\n        const moduleOrPath = await this.resolveSignerWasmOverride(override);\n        await initSignerWasm({ module_or_path: moduleOrPath as InitInput });\n        this.signerWasmReady = true;\n        return;\n      } catch (e) {\n        this.logger.error('Failed to initialize signer WASM via provided override:', e);\n        throw e;\n      }\n    }\n\n    let candidates: URL[];\n    try {\n      candidates = getSignerWasmUrls(this.logger);\n    } catch (err) {\n      this.logger.error('Failed to resolve signer WASM URLs:', err);\n      throw err;\n    }\n\n    try {\n      if (this.isNodeEnvironment()) {\n        await this.initSignerWasmForNode(candidates);\n        this.signerWasmReady = true;\n        return;\n      }\n\n      let lastError: unknown = null;\n      for (const candidate of candidates) {\n        try {\n          await initSignerWasm({ module_or_path: candidate as InitInput });\n          this.signerWasmReady = true;\n          return;\n        } catch (err) {\n          lastError = err;\n          this.logger.warn(`Failed to initialize signer WASM from ${candidate.toString()}, trying next candidate...`);\n        }\n      }\n\n      throw lastError ?? new Error('Unable to initialize signer WASM from any candidate URL');\n    } catch (e) {\n      this.logger.error('Failed to initialize signer WASM:', e);\n      throw e instanceof Error ? e : new Error(String(e));\n    }\n  }\n\n  private isNodeEnvironment(): boolean {\n    // Detect true Node.js, not Cloudflare Workers with nodejs_compat polyfills.\n    const isNode = Boolean((globalThis as any).process?.versions?.node);\n    // Cloudflare Workers expose WebSocketPair and may polyfill process.\n    const isCloudflareWorker = typeof (globalThis as any).WebSocketPair !== 'undefined'\n      || (typeof navigator !== 'undefined' && (navigator as any).userAgent?.includes?.('Cloudflare-Workers'));\n    return isNode && !isCloudflareWorker;\n  }\n\n  private async resolveSignerWasmOverride(override: SignerWasmModuleSupplier): Promise<InitInput> {\n    const candidate = typeof override === 'function'\n      ? await (override as () => InitInput | Promise<InitInput>)()\n      : await override;\n\n    if (!candidate) {\n      throw new Error('Signer WASM override resolved to an empty value');\n    }\n\n    return candidate;\n  }\n\n  /**\n   * Initialize signer WASM in Node by loading the wasm file from disk.\n   * Tries multiple candidate locations and falls back to path-based init if needed.\n   */\n  private async initSignerWasmForNode(candidates: URL[]): Promise<void> {\n    const { fileURLToPath } = await import('node:url');\n    const { readFile } = await import('node:fs/promises');\n\n    // 1) Try reading and compiling bytes\n    for (const url of candidates) {\n      try {\n        const filePath = fileURLToPath(url);\n        const bytes = await readFile(filePath);\n        // Ensure we pass an ArrayBuffer, not a Node Buffer (type mismatch)\n        const u8 = bytes instanceof Uint8Array ? new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength) : new Uint8Array(bytes as any);\n        const ab = u8.buffer.slice(u8.byteOffset, u8.byteOffset + u8.byteLength);\n        const module = await WebAssembly.compile(ab as ArrayBuffer);\n        await initSignerWasm({ module_or_path: module as any });\n        return;\n      } catch {} // throw at end of function\n    }\n\n    // 2) Fallback: pass file path directly (supported in some environments)\n    for (const url of candidates) {\n      try {\n        const filePath = fileURLToPath(url);\n        await initSignerWasm({ module_or_path: filePath as any });\n        return;\n      } catch {} // throw at end of function\n    }\n\n    throw new Error('[AuthService] Failed to initialize signer WASM from filesystem candidates');\n  }\n\n  /**\n   * ===== Registration & authentication =====\n   *\n   * Helpers for creating accounts, registering WebAuthn credentials,\n   * and verifying authentication responses.\n   */\n\n  /**\n   * Create a new account with the specified balance\n   */\n  async createAccount(request: AccountCreationRequest): Promise<AccountCreationResult> {\n    await this._ensureSignerAndRelayerAccount();\n\n    return this.queueTransaction(async () => {\n      try {\n        if (!this.isValidAccountId(request.accountId)) {\n          throw new Error(`Invalid account ID format: ${request.accountId}`);\n        }\n\n        // Check if account already exists\n        this.logger.info(`Checking if account ${request.accountId} already exists...`);\n        const accountExists = await this.checkAccountExists(request.accountId);\n        if (accountExists) {\n          throw new Error(`Account ${request.accountId} already exists. Cannot create duplicate account.`);\n        }\n        this.logger.info(`Account ${request.accountId} is available for creation`);\n\n        const initialBalance = this.config.accountInitialBalance;\n\n        this.logger.info(`Creating account: ${request.accountId}`);\n        this.logger.info(`Initial balance: ${initialBalance} yoctoNEAR`);\n\n        // Build actions for CreateAccount + Transfer + AddKey(FullAccess)\n        const actions: ActionArgsWasm[] = [\n          { action_type: ActionType.CreateAccount },\n          { action_type: ActionType.Transfer, deposit: initialBalance },\n          {\n            action_type: ActionType.AddKey,\n            public_key: request.publicKey,\n            access_key: JSON.stringify({\n              nonce: 0,\n              permission: { FullAccess: {} },\n            }),\n          }\n        ];\n\n        actions.forEach(validateActionArgsWasm);\n\n        // Fetch nonce and block hash for relayer\n        const { nextNonce, blockHash } = await this.fetchTxContext(this.config.relayerAccountId, this.relayerPublicKey);\n\n        // Sign with relayer private key using WASM\n        const signed = await this.signWithPrivateKey({\n          nearPrivateKey: this.config.relayerPrivateKey,\n          signerAccountId: this.config.relayerAccountId,\n          receiverId: request.accountId,\n          nonce: nextNonce,\n          blockHash: blockHash,\n          actions\n        });\n\n        // Broadcast transaction via MinimalNearClient using a strongly typed SignedTransaction\n        const result = await this.nearClient.sendTransaction(signed);\n\n        this.logger.info(`Account creation completed: ${result.transaction.hash}`);\n        const nearAmount = (Number(BigInt(initialBalance)) / 1e24).toFixed(6);\n        return {\n          success: true,\n          transactionHash: result.transaction.hash,\n          accountId: request.accountId,\n          message: `Account ${request.accountId} created with ${nearAmount} NEAR initial balance`\n        };\n\n      } catch (error: any) {\n        this.logger.error(`Account creation failed for ${request.accountId}:`, error);\n        return {\n          success: false,\n          error: error.message || 'Unknown account creation error',\n          message: `Failed to create account ${request.accountId}: ${error.message}`\n        };\n      }\n    }, `create account ${request.accountId}`);\n  }\n\n  /**\n   * Create account and register user with WebAuthn in a single atomic transaction\n   */\n  async createAccountAndRegisterUser(request: CreateAccountAndRegisterRequest): Promise<CreateAccountAndRegisterResult> {\n    await this._ensureSignerAndRelayerAccount();\n\n    return this.queueTransaction(async () => {\n      try {\n        if (!this.isValidAccountId(request.new_account_id)) {\n          throw new Error(`Invalid account ID format: ${request.new_account_id}`);\n        }\n\n        // Check if account already exists\n        this.logger.info(`Checking if account ${request.new_account_id} already exists...`);\n        const accountExists = await this.checkAccountExists(request.new_account_id);\n        if (accountExists) {\n          throw new Error(`Account ${request.new_account_id} already exists. Cannot create duplicate account.`);\n        }\n        this.logger.info(`Account ${request.new_account_id} is available for atomic creation and registration`);\n        this.logger.info(`Registering account: ${request.new_account_id}`);\n        this.logger.info(`Contract: ${this.config.webAuthnContractId}`);\n\n        // Prepare contract arguments\n        const contractArgs = {\n          new_account_id: request.new_account_id,\n          new_public_key: request.new_public_key,\n          vrf_data: request.vrf_data,\n          webauthn_registration: request.webauthn_registration,\n          deterministic_vrf_public_key: request.deterministic_vrf_public_key,\n          authenticator_options: request.authenticator_options,\n        };\n\n        // Build single FunctionCall action\n        const actions: ActionArgsWasm[] = [\n          {\n            action_type: ActionType.FunctionCall,\n            method_name: 'create_account_and_register_user',\n            args: JSON.stringify(contractArgs),\n            gas: this.config.createAccountAndRegisterGas,\n            deposit: this.config.accountInitialBalance\n          }\n        ];\n        actions.forEach(validateActionArgsWasm);\n\n        const { nextNonce, blockHash } = await this.fetchTxContext(this.config.relayerAccountId, this.relayerPublicKey);\n        const signed = await this.signWithPrivateKey({\n          nearPrivateKey: this.config.relayerPrivateKey,\n          signerAccountId: this.config.relayerAccountId,\n          receiverId: this.config.webAuthnContractId,\n          nonce: nextNonce,\n          blockHash,\n          actions\n        });\n        const result = await this.nearClient.sendTransaction(signed);\n\n        // Parse contract execution results to detect failures\n        const contractError = parseContractExecutionError(result, request.new_account_id);\n        if (contractError) {\n          this.logger.error(`Contract execution failed for ${request.new_account_id}:`, contractError);\n          throw new Error(contractError);\n        }\n\n        this.logger.info(`Registration completed: ${result.transaction.hash}`);\n        return {\n          success: true,\n          transactionHash: result.transaction.hash,\n          message: `Account ${request.new_account_id} created and registered successfully`,\n          contractResult: result,\n        };\n\n      } catch (error: any) {\n        this.logger.error(`Atomic registration failed for ${request.new_account_id}:`, error);\n        return {\n          success: false,\n          error: error.message || 'Unknown atomic registration error',\n          message: `Failed to create and register account ${request.new_account_id}: ${error.message}`\n        };\n      }\n    }, `atomic create and register ${request.new_account_id}`);\n  }\n\n  /**\n   * Verify authentication response and issue JWT (VIEW call)\n   * Calls the web3authn contract's verify_authentication_response method via view\n   * and issues a JWT or session credential upon successful verification\n   */\n  async verifyAuthenticationResponse(\n    request: VerifyAuthenticationRequest\n  ): Promise<VerifyAuthenticationResponse> {\n    try {\n      await this._ensureSignerAndRelayerAccount();\n\n      const args = {\n        vrf_data: request.vrf_data,\n        webauthn_authentication: request.webauthn_authentication,\n      };\n\n      // Perform a VIEW function call (no gas) and parse the contract response\n      const contractResponse = await this.nearClient.view<typeof args, any>({\n        account: this.config.webAuthnContractId,\n        method: 'verify_authentication_response',\n        args\n      });\n\n      const verified = Boolean((contractResponse && (contractResponse.verified === true)));\n      if (!verified) {\n        return {\n          success: false,\n          verified: false,\n          code: 'not_verified',\n          message: 'Authentication verification failed',\n          contractResponse,\n        };\n      }\n\n      return {\n        success: true,\n        verified: true,\n        sessionCredential: {\n          userId: request.vrf_data.user_id,\n          issuedAt: new Date().toISOString(),\n          expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString(),\n        },\n        contractResponse,\n      };\n    } catch (error: any) {\n      return {\n        success: false,\n        verified: false,\n        code: 'internal',\n        message: error?.message || 'Verification failed',\n      };\n    }\n  }\n\n  /**\n   * Fetch Related Origin Requests (ROR) allowed origins from a NEAR view method.\n   * Defaults: contractId = webAuthnContractId, method = 'get_allowed_origins', args = {}.\n   * Returns a sanitized, deduplicated list of absolute origins.\n   */\n  public async getRorOrigins(opts?: { contractId?: string; method?: string; args?: any }): Promise<string[]> {\n    const contractId = (opts?.contractId || this.config.webAuthnContractId).trim();\n    const method = (opts?.method || 'get_allowed_origins').trim();\n    const args = opts?.args ?? {};\n\n    const isValidOrigin = (s: unknown): string | null => {\n      if (typeof s !== 'string' || !s) return null;\n      try {\n        const u = new URL(s.trim());\n        const scheme = u.protocol;\n        const host = u.hostname.toLowerCase();\n        const port = u.port ? `:${u.port}` : '';\n        if (scheme !== 'https:' && !(scheme === 'http:' && host === 'localhost')) return null;\n        if ((u.pathname && u.pathname !== '/') || u.search || u.hash) return null;\n        return `${scheme}//${host}${port}`;\n      } catch { return null; }\n    };\n\n    try {\n      const result = await this.nearClient.view<{ } , unknown>({ account: contractId, method, args });\n      let list: string[] = [];\n      if (Array.isArray(result)) {\n        list = result as string[];\n      } else if (result && typeof result === 'object' && Array.isArray((result as any).origins)) {\n        list = (result as any).origins as string[];\n      }\n      const out = new Set<string>();\n      for (const item of list) {\n        const norm = isValidOrigin(item);\n        if (norm) out.add(norm);\n      }\n      return Array.from(out);\n    } catch (e) {\n      this.logger.warn('[AuthService] getRorOrigins failed:', e);\n      return [];\n    }\n  }\n\n  private isValidAccountId(accountId: string): boolean {\n    if (!accountId || accountId.length < 2 || accountId.length > 64) {\n      return false;\n    }\n    const validPattern = /^[a-z0-9_.-]+$/;\n    return validPattern.test(accountId);\n  }\n\n  /**\n   * Account existence helper used by registration flows.\n   */\n  async checkAccountExists(accountId: string): Promise<boolean> {\n    await this._ensureSignerAndRelayerAccount();\n    const isNotFound = (m: string) => /does not exist|UNKNOWN_ACCOUNT|unknown\\s+account/i.test(m);\n    const isRetryable = (m: string) => /server error|internal|temporar|timeout|too many requests|429|empty response|rpc request failed/i.test(m);\n    const attempts = 3;\n    let lastErr: any = null;\n    for (let i = 1; i <= attempts; i++) {\n      try {\n        const view = await this.nearClient.viewAccount(accountId);\n        return !!view;\n      } catch (error: any) {\n        lastErr = error;\n        const msg = String(error?.message || '');\n        // Some providers embed the useful string only inside a nested JSON `details` object.\n        // Normalize both message and details (if available) into one searchable blob.\n        const detailsBlob = (() => {\n          try {\n            const d = (error && typeof error === 'object' && 'details' in error) ? (error as any).details : undefined;\n            if (!d) return '';\n            return typeof d === 'string' ? d : JSON.stringify(d);\n          } catch { return ''; }\n        })();\n        const combined = `${msg}\\n${detailsBlob}`;\n        if (isNotFound(combined)) return false;\n        if (isRetryable(msg) && i < attempts) {\n          const backoff = 150 * Math.pow(2, i - 1);\n          await new Promise((r) => setTimeout(r, backoff));\n          continue;\n        }\n        // As a safety valve for flaky RPCs, treat persistent retryable errors as not-found\n        if (isRetryable(msg)) {\n          this.logger.warn(`[AuthService] Assuming account '${accountId}' not found after retryable RPC errors:`, msg);\n          return false;\n        }\n        this.logger.error(`Error checking account existence for ${accountId}:`, error);\n        throw error;\n      }\n    }\n    throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));\n  }\n\n  /**\n   * ===== Delegate actions & transaction execution =====\n   *\n   * Flows that build and submit on-chain transactions, including NEP-461\n   * SignedDelegate meta-transactions.\n   */\n\n  /**\n   * Execute a NEP-461 SignedDelegate by wrapping it in an outer transaction\n   * from the relayer account. This method is intended to be called by\n   * example relayers (Node/Cloudflare) once a SignedDelegate has been\n   * produced by the signer worker and returned to the application.\n   *\n   * Notes:\n   * - Signature and hash computation are performed by the signer worker.\n   *   This method focuses on expiry/policy enforcement and meta-tx submission.\n   * - Nonce/replay protection is left to the integrator; see docs for guidance.\n   */\n  async executeSignedDelegate(input: {\n    hash: string;\n    signedDelegate: SignedDelegate;\n    policy?: DelegateActionPolicy;\n  }): Promise<ExecuteSignedDelegateResult> {\n    await this._ensureSignerAndRelayerAccount();\n\n    if (!input?.hash || !input?.signedDelegate) {\n      return {\n        ok: false,\n        code: 'invalid_delegate_request',\n        error: 'hash and signedDelegate are required',\n      };\n    }\n\n    const senderId = input.signedDelegate?.delegateAction?.senderId ?? 'unknown-sender';\n\n    return this.queueTransaction(\n      () => executeSignedDelegateWithRelayer({\n        nearClient: this.nearClient,\n        relayerAccountId: this.config.relayerAccountId,\n        relayerPublicKey: this.relayerPublicKey,\n        relayerPrivateKey: this.config.relayerPrivateKey,\n        hash: input.hash,\n        signedDelegate: input.signedDelegate,\n        signWithPrivateKey: (args) => this.signWithPrivateKey(args),\n      }),\n      `execute signed delegate for ${senderId}`,\n    );\n  }\n\n  // === Internal helpers for signing & RPC ===\n  private async fetchTxContext(accountId: string, publicKey: string): Promise<{ nextNonce: string; blockHash: string }> {\n    // Access key (if missing, assume nonce=0)\n    let nonce = 0n;\n    try {\n      const ak = await this.nearClient.viewAccessKey(accountId, publicKey);\n      nonce = BigInt(ak?.nonce ?? 0);\n    } catch {\n      nonce = 0n;\n    }\n    // Block\n    const block = await this.nearClient.viewBlock({ finality: 'final' });\n    const txBlockHash = block.header.hash;\n    const nextNonce = (nonce + 1n).toString();\n    return { nextNonce, blockHash: txBlockHash };\n  }\n\n  private async signWithPrivateKey(input: {\n    nearPrivateKey: string;\n    signerAccountId: string;\n    receiverId: string;\n    nonce: string;\n    blockHash: string;\n    actions: ActionArgsWasm[];\n  }): Promise<SignedTransaction> {\n    await this.ensureSignerWasm();\n    const message = {\n      type: WorkerRequestType.SignTransactionWithKeyPair,\n      payload: {\n        nearPrivateKey: input.nearPrivateKey,\n        signerAccountId: input.signerAccountId,\n        receiverId: input.receiverId,\n        nonce: input.nonce,\n        blockHash: input.blockHash,\n        actions: input.actions\n      }\n    };\n    // uses wasm signer worker's SignTransactionWithKeyPair action,\n    // which doesn't require VRF worker session\n    const response = await handle_signer_message(message);\n    const {\n      transaction,\n      signature,\n      borshBytes\n    } = extractFirstSignedTransactionFromWorkerResponse(response);\n\n    return new SignedTransaction({\n      transaction: transaction,\n      signature: signature,\n      borsh_bytes: borshBytes,\n    });\n  }\n\n  /**\n   * Framework-agnostic: handle verify-authentication request\n   * Converts a generic ServerRequest to ServerResponse using this service\n   */\n  async handleVerifyAuthenticationResponse(request: VerifyAuthenticationRequest): Promise<VerifyAuthenticationResponse> {\n    return this.verifyAuthenticationResponse(request);\n  }\n\n  /**\n   * ZK-email recovery helper (stub).\n   * Intended to call the global ZkEmailVerifier and per-user recovery contract\n   * once zk-email proofs and public inputs are wired through.\n   */\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  async recoverAccountFromZkEmailVerifier(_request: {\n    accountId: string;\n    proof: unknown;\n    publicInputs: unknown;\n  }): Promise<{\n    success: boolean;\n    transactionHash?: string;\n    message?: string;\n    error?: string;\n  }> {\n    return {\n      success: false,\n      error: 'recoverAccountFromZkEmailVerifier is not yet implemented',\n      message: 'recoverAccountFromZkEmailVerifier is not yet implemented',\n    };\n  }\n\n  /**\n   * Express-style middleware factory for verify-authentication\n   */\n  verifyAuthenticationMiddleware() {\n    return async (req: any, res: any) => {\n      try {\n        if (!req?.body) {\n          res.status(400).json({ error: 'Request body is required' });\n          return;\n        }\n        const body: VerifyAuthenticationRequest = req.body;\n        if (!body.vrf_data || !body.webauthn_authentication) {\n          res.status(400).json({ code: 'invalid_body', message: 'vrf_data and webauthn_authentication are required' });\n          return;\n        }\n        const result = await this.verifyAuthenticationResponse(body);\n        const status = result.success ? 200 : 400;\n        if (status !== 200) {\n          res.status(status).json({ code: 'not_verified', message: result.message || 'Authentication verification failed' });\n        } else {\n          res.status(status).json(result);\n        }\n      } catch (error: any) {\n        this.logger.error('Error in verify authentication middleware:', error);\n        res.status(500).json({ code: 'internal', message: error?.message || 'Internal server error' });\n      }\n    };\n  }\n\n  /**\n   * Queue transactions to prevent nonce conflicts\n   */\n  private async queueTransaction<T>(operation: () => Promise<T>, description: string): Promise<T> {\n    this.queueStats.pending++;\n    this.logger.debug(`[AuthService] Queueing: ${description} (pending: ${this.queueStats.pending})`);\n\n    this.transactionQueue = this.transactionQueue\n      .then(async () => {\n        try {\n          this.logger.debug(`[AuthService] Executing: ${description}`);\n          const result = await operation();\n          this.queueStats.completed++;\n          this.queueStats.pending--;\n          this.logger.debug(`[AuthService] Completed: ${description} (pending: ${this.queueStats.pending})`);\n          return result;\n        } catch (error: any) {\n          this.queueStats.failed++;\n          this.queueStats.pending--;\n          this.logger.error(`[AuthService] Failed: ${description} (failed: ${this.queueStats.failed}):`, error?.message);\n          throw error;\n        }\n      })\n      .catch((error) => {\n        throw error;\n      });\n\n    return this.transactionQueue;\n  }\n}\n\ninterface WorkerSignedTransactionPayload {\n  transaction: WasmTransaction;\n  signature: WasmSignature;\n  borshBytes?: number[];\n  borsh_bytes?: number[];\n}\n\nfunction extractFirstSignedTransactionFromWorkerResponse(response: any): {\n  transaction: WasmTransaction;\n  signature: WasmSignature;\n  borshBytes: number[];\n} {\n  const res = (typeof response === 'string' ? JSON.parse(response) : response) as {\n    type?: WorkerResponseType;\n    payload?: { signedTransactions?: WorkerSignedTransactionPayload[]; error?: string };\n  } | undefined;\n\n  if (res?.type !== WorkerResponseType.SignTransactionWithKeyPairSuccess) {\n    const errMsg = res?.payload?.error || 'Signing failed';\n    throw new Error(errMsg);\n  }\n\n  const payload = res?.payload;\n  const signedTxs = (payload?.signedTransactions ?? []) as WorkerSignedTransactionPayload[];\n  if (!Array.isArray(signedTxs) || signedTxs.length === 0) {\n    throw new Error('No signed transaction returned');\n  }\n  const first = signedTxs[0];\n  const borshBytes = first?.borshBytes ?? first?.borsh_bytes;\n  if (!Array.isArray(borshBytes)) {\n    throw new Error('Missing borsh bytes');\n  }\n  return {\n    transaction: first.transaction,\n    signature: first.signature,\n    borshBytes,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA4CA,MAAM,wBAAwB;AAE9B,MAAM,4BAA4B;AAElC,SAAS,kBAAkB,QAAiC;CAC1D,MAAM,QAAQ,CAAC,uBAAuB;CACtC,MAAMA,WAAkB;CACxB,MAAM;AAEN,MAAK,MAAM,QAAQ,MACjB,KAAI;AACF,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM;AAC9B,WAAS,KAAK,IAAI,IAAI,MAAM;UACrB,KAAK;AACZ,SAAO,KAAK,wDAAwD,KAAK,KAAK;;AAIlF,KAAI,CAAC,SAAS,OACZ,OAAM,IAAI,MAAM;AAGlB,QAAO;;;;;;AAOT,IAAa,cAAb,MAAyB;CACvB,AAAQ;CACR,AAAQ,gBAAgB;CACxB,AAAQ;CACR,AAAQ,mBAA2B;CACnC,AAAQ,kBAAkB;CAC1B,AAAiB;CAGjB,AAAQ,mBAAiC,QAAQ;CACjD,AAAQ,aAAa;EAAE,SAAS;EAAG,WAAW;EAAG,QAAQ;;CAGzD,AAAgB,gBAAsC;CAEtD,AAAgB,gBAA6C;CAE7D,YAAY,QAAgC;AAC1C,OAAK,SAASC,uCAAwB;AACtC,OAAK,SAASC,+BAAgB,KAAK,OAAO;EAC1C,MAAM,sBAAsB,KAAK,OAAO,QAAQ,uBAAuB,IAAI;AAC3E,OAAK,gBAAgB,IAAIC,oCAAc,KAAK,OAAO,QAAQ,sBAAsB;AACjF,OAAK,aAAa,IAAIC,qCAAkB,KAAK,OAAO;AACpD,OAAK,gBAAgB,IAAIC,mCAAqB;GAC5C,kBAAkB,KAAK,OAAO;GAC9B,mBAAmB,KAAK,OAAO;GAC/B,WAAW,KAAK,OAAO;GACvB,2BAA2BC,wDAAiC;GAC5D,YAAY,KAAK;GACjB,QAAQ,KAAK,OAAO;GACpB,qCAAqC,KAAK;GAC1C,mBAAsB,IAAsB,UAAkB,KAAK,iBAAiB,IAAI;GACxF,iBAAiB,WAAmB,cAAsB,KAAK,eAAe,WAAW;GACzF,qBAAqB,UAAU,KAAK,mBAAmB;GACvD,2BAA2B,KAAK;GAChC,eAAe,KAAK,OAAO;;AAK7B,OAAK,OAAO,KAAK;;mBAEF,KAAK,OAAO,UAAU;oBACrB,KAAK,OAAO,WAAW;0BACjB,KAAK,OAAO,iBAAiB;4BAC3B,KAAK,OAAO,mBAAmB;+BAC5B,KAAK,OAAO,sBAAsB,IAAIC,gCAAkB,KAAK,OAAO,uBAAuB;qCACrF,KAAK,OAAO,4BAA4B,IAAIC,8BAAgB,KAAK,OAAO,6BAA6B;MAEpI,KAAK,OAAO,SACR,oBAAoB,KAAK,OAAO,OAAO,cAAc,MAAM,GAAG,IAAI,8BAA8B,KAAK,OAAO,OAAO,gBAAgB,MAAM,GAAG,IAAI,8BAA8B,KAAK,OAAO,OAAO,gBAAgB,MAAM,GAAG,IAAI,OAC9N,2BACL;MAEC,KAAK,OAAO,eAAe,UACvB,oBAAoB,KAAK,OAAO,cAAc,YAC9C,kCACL;;;CAIH,MAAM,oBAAuE;AAC3E,QAAM,KAAK;AACX,SAAO;GACL,WAAW,KAAK,OAAO;GACvB,WAAW,KAAK;;;;;;;CAQpB,MAAc,mCAAkD;AAC9D,MAAI,CAAC,KAAK,OAAO,QAAQ,aACvB;EAGF,MAAM,EAAE,gCAAgC,2CAAM;AAC9C,8BAA4B,KAAK,OAAO,OAAO;;CAGjD,MAAc,iCAAgD;AAC5D,MAAI,KAAK,cACP;AAIF,MAAI,KAAK,OAAO,UAAU,KAAK,eAAe;AAC5C,SAAM,KAAK;AACX,SAAM,KAAK,cAAc;;AAI3B,MAAI;GACF,MAAM,EAAE,MAAM,QAAQC,sCAAmB,KAAK,OAAO;AACrD,QAAK,mBAAmBC,qCAAkB;WACnC,GAAG;AACV,QAAK,OAAO,KAAK;AACjB,QAAK,mBAAmB;;AAI1B,QAAM,KAAK;AACX,OAAK,gBAAgB;;CAGvB,MAAc,mBAAkC;AAC9C,MAAI,KAAK,gBAAiB;EAC1B,MAAM,WAAW,KAAK,OAAO,YAAY;AACzC,MAAI,SACF,KAAI;GACF,MAAM,eAAe,MAAM,KAAK,0BAA0B;AAC1D,uEAAqB,EAAE,gBAAgB;AACvC,QAAK,kBAAkB;AACvB;WACO,GAAG;AACV,QAAK,OAAO,MAAM,2DAA2D;AAC7E,SAAM;;EAIV,IAAIC;AACJ,MAAI;AACF,gBAAa,kBAAkB,KAAK;WAC7B,KAAK;AACZ,QAAK,OAAO,MAAM,uCAAuC;AACzD,SAAM;;AAGR,MAAI;AACF,OAAI,KAAK,qBAAqB;AAC5B,UAAM,KAAK,sBAAsB;AACjC,SAAK,kBAAkB;AACvB;;GAGF,IAAIC,YAAqB;AACzB,QAAK,MAAM,aAAa,WACtB,KAAI;AACF,wEAAqB,EAAE,gBAAgB;AACvC,SAAK,kBAAkB;AACvB;YACO,KAAK;AACZ,gBAAY;AACZ,SAAK,OAAO,KAAK,yCAAyC,UAAU,WAAW;;AAInF,SAAM,6BAAa,IAAI,MAAM;WACtB,GAAG;AACV,QAAK,OAAO,MAAM,qCAAqC;AACvD,SAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO;;;CAIpD,AAAQ,oBAA6B;EAEnC,MAAM,SAAS,QAAS,WAAmB,SAAS,UAAU;EAE9D,MAAM,qBAAqB,OAAQ,WAAmB,kBAAkB,eAClE,OAAO,cAAc,eAAgB,UAAkB,WAAW,WAAW;AACnF,SAAO,UAAU,CAAC;;CAGpB,MAAc,0BAA0B,UAAwD;EAC9F,MAAM,YAAY,OAAO,aAAa,aAClC,MAAO,aACP,MAAM;AAEV,MAAI,CAAC,UACH,OAAM,IAAI,MAAM;AAGlB,SAAO;;;;;;CAOT,MAAc,sBAAsB,YAAkC;EACpE,MAAM,EAAE,kBAAkB,MAAM,OAAO;EACvC,MAAM,EAAE,aAAa,MAAM,OAAO;AAGlC,OAAK,MAAM,OAAO,WAChB,KAAI;GACF,MAAM,WAAW,cAAc;GAC/B,MAAM,QAAQ,MAAM,SAAS;GAE7B,MAAM,KAAK,iBAAiB,aAAa,IAAI,WAAW,MAAM,QAAQ,MAAM,YAAY,MAAM,cAAc,IAAI,WAAW;GAC3H,MAAM,KAAK,GAAG,OAAO,MAAM,GAAG,YAAY,GAAG,aAAa,GAAG;GAC7D,MAAMC,WAAS,MAAM,YAAY,QAAQ;AACzC,uEAAqB,EAAE,gBAAgBA;AACvC;UACM;AAIV,OAAK,MAAM,OAAO,WAChB,KAAI;GACF,MAAM,WAAW,cAAc;AAC/B,uEAAqB,EAAE,gBAAgB;AACvC;UACM;AAGV,QAAM,IAAI,MAAM;;;;;;;;;;;CAalB,MAAM,cAAc,SAAiE;AACnF,QAAM,KAAK;AAEX,SAAO,KAAK,iBAAiB,YAAY;AACvC,OAAI;AACF,QAAI,CAAC,KAAK,iBAAiB,QAAQ,WACjC,OAAM,IAAI,MAAM,8BAA8B,QAAQ;AAIxD,SAAK,OAAO,KAAK,uBAAuB,QAAQ,UAAU;IAC1D,MAAM,gBAAgB,MAAM,KAAK,mBAAmB,QAAQ;AAC5D,QAAI,cACF,OAAM,IAAI,MAAM,WAAW,QAAQ,UAAU;AAE/C,SAAK,OAAO,KAAK,WAAW,QAAQ,UAAU;IAE9C,MAAM,iBAAiB,KAAK,OAAO;AAEnC,SAAK,OAAO,KAAK,qBAAqB,QAAQ;AAC9C,SAAK,OAAO,KAAK,oBAAoB,eAAe;IAGpD,MAAMC,UAA4B;KAChC,EAAE,aAAaC,2BAAW;KAC1B;MAAE,aAAaA,2BAAW;MAAU,SAAS;;KAC7C;MACE,aAAaA,2BAAW;MACxB,YAAY,QAAQ;MACpB,YAAY,KAAK,UAAU;OACzB,OAAO;OACP,YAAY,EAAE,YAAY;;;;AAKhC,YAAQ,QAAQC;IAGhB,MAAM,EAAE,WAAW,cAAc,MAAM,KAAK,eAAe,KAAK,OAAO,kBAAkB,KAAK;IAG9F,MAAM,SAAS,MAAM,KAAK,mBAAmB;KAC3C,gBAAgB,KAAK,OAAO;KAC5B,iBAAiB,KAAK,OAAO;KAC7B,YAAY,QAAQ;KACpB,OAAO;KACI;KACX;;IAIF,MAAM,SAAS,MAAM,KAAK,WAAW,gBAAgB;AAErD,SAAK,OAAO,KAAK,+BAA+B,OAAO,YAAY;IACnE,MAAM,cAAc,OAAO,OAAO,mBAAmB,MAAM,QAAQ;AACnE,WAAO;KACL,SAAS;KACT,iBAAiB,OAAO,YAAY;KACpC,WAAW,QAAQ;KACnB,SAAS,WAAW,QAAQ,UAAU,gBAAgB,WAAW;;YAG5DC,OAAY;AACnB,SAAK,OAAO,MAAM,+BAA+B,QAAQ,UAAU,IAAI;AACvE,WAAO;KACL,SAAS;KACT,OAAO,MAAM,WAAW;KACxB,SAAS,4BAA4B,QAAQ,UAAU,IAAI,MAAM;;;KAGpE,kBAAkB,QAAQ;;;;;CAM/B,MAAM,6BAA6B,SAAmF;AACpH,QAAM,KAAK;AAEX,SAAO,KAAK,iBAAiB,YAAY;AACvC,OAAI;AACF,QAAI,CAAC,KAAK,iBAAiB,QAAQ,gBACjC,OAAM,IAAI,MAAM,8BAA8B,QAAQ;AAIxD,SAAK,OAAO,KAAK,uBAAuB,QAAQ,eAAe;IAC/D,MAAM,gBAAgB,MAAM,KAAK,mBAAmB,QAAQ;AAC5D,QAAI,cACF,OAAM,IAAI,MAAM,WAAW,QAAQ,eAAe;AAEpD,SAAK,OAAO,KAAK,WAAW,QAAQ,eAAe;AACnD,SAAK,OAAO,KAAK,wBAAwB,QAAQ;AACjD,SAAK,OAAO,KAAK,aAAa,KAAK,OAAO;IAG1C,MAAM,eAAe;KACnB,gBAAgB,QAAQ;KACxB,gBAAgB,QAAQ;KACxB,UAAU,QAAQ;KAClB,uBAAuB,QAAQ;KAC/B,8BAA8B,QAAQ;KACtC,uBAAuB,QAAQ;;IAIjC,MAAMH,UAA4B,CAChC;KACE,aAAaC,2BAAW;KACxB,aAAa;KACb,MAAM,KAAK,UAAU;KACrB,KAAK,KAAK,OAAO;KACjB,SAAS,KAAK,OAAO;;AAGzB,YAAQ,QAAQC;IAEhB,MAAM,EAAE,WAAW,cAAc,MAAM,KAAK,eAAe,KAAK,OAAO,kBAAkB,KAAK;IAC9F,MAAM,SAAS,MAAM,KAAK,mBAAmB;KAC3C,gBAAgB,KAAK,OAAO;KAC5B,iBAAiB,KAAK,OAAO;KAC7B,YAAY,KAAK,OAAO;KACxB,OAAO;KACP;KACA;;IAEF,MAAM,SAAS,MAAM,KAAK,WAAW,gBAAgB;IAGrD,MAAM,gBAAgBE,2CAA4B,QAAQ,QAAQ;AAClE,QAAI,eAAe;AACjB,UAAK,OAAO,MAAM,iCAAiC,QAAQ,eAAe,IAAI;AAC9E,WAAM,IAAI,MAAM;;AAGlB,SAAK,OAAO,KAAK,2BAA2B,OAAO,YAAY;AAC/D,WAAO;KACL,SAAS;KACT,iBAAiB,OAAO,YAAY;KACpC,SAAS,WAAW,QAAQ,eAAe;KAC3C,gBAAgB;;YAGXD,OAAY;AACnB,SAAK,OAAO,MAAM,kCAAkC,QAAQ,eAAe,IAAI;AAC/E,WAAO;KACL,SAAS;KACT,OAAO,MAAM,WAAW;KACxB,SAAS,yCAAyC,QAAQ,eAAe,IAAI,MAAM;;;KAGtF,8BAA8B,QAAQ;;;;;;;CAQ3C,MAAM,6BACJ,SACuC;AACvC,MAAI;AACF,SAAM,KAAK;GAEX,MAAM,OAAO;IACX,UAAU,QAAQ;IAClB,yBAAyB,QAAQ;;GAInC,MAAM,mBAAmB,MAAM,KAAK,WAAW,KAAuB;IACpE,SAAS,KAAK,OAAO;IACrB,QAAQ;IACR;;GAGF,MAAM,WAAW,QAAS,oBAAqB,iBAAiB,aAAa;AAC7E,OAAI,CAAC,SACH,QAAO;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,SAAS;IACT;;AAIJ,UAAO;IACL,SAAS;IACT,UAAU;IACV,mBAAmB;KACjB,QAAQ,QAAQ,SAAS;KACzB,2BAAU,IAAI,QAAO;KACrB,WAAW,IAAI,KAAK,KAAK,QAAQ,OAAU,KAAK,KAAM;;IAExD;;WAEKA,OAAY;AACnB,UAAO;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,SAAS,OAAO,WAAW;;;;;;;;;CAUjC,MAAa,cAAc,MAAgF;EACzG,MAAM,cAAc,MAAM,cAAc,KAAK,OAAO,oBAAoB;EACxE,MAAM,UAAU,MAAM,UAAU,uBAAuB;EACvD,MAAM,OAAO,MAAM,QAAQ;EAE3B,MAAM,iBAAiB,MAA8B;AACnD,OAAI,OAAO,MAAM,YAAY,CAAC,EAAG,QAAO;AACxC,OAAI;IACF,MAAM,IAAI,IAAI,IAAI,EAAE;IACpB,MAAM,SAAS,EAAE;IACjB,MAAM,OAAO,EAAE,SAAS;IACxB,MAAM,OAAO,EAAE,OAAO,IAAI,EAAE,SAAS;AACrC,QAAI,WAAW,YAAY,EAAE,WAAW,WAAW,SAAS,aAAc,QAAO;AACjF,QAAK,EAAE,YAAY,EAAE,aAAa,OAAQ,EAAE,UAAU,EAAE,KAAM,QAAO;AACrE,WAAO,GAAG,OAAO,IAAI,OAAO;WACtB;AAAE,WAAO;;;AAGnB,MAAI;GACF,MAAM,SAAS,MAAM,KAAK,WAAW,KAAoB;IAAE,SAAS;IAAY;IAAQ;;GACxF,IAAIE,OAAiB;AACrB,OAAI,MAAM,QAAQ,QAChB,QAAO;YACE,UAAU,OAAO,WAAW,YAAY,MAAM,QAAS,OAAe,SAC/E,QAAQ,OAAe;GAEzB,MAAM,sBAAM,IAAI;AAChB,QAAK,MAAM,QAAQ,MAAM;IACvB,MAAM,OAAO,cAAc;AAC3B,QAAI,KAAM,KAAI,IAAI;;AAEpB,UAAO,MAAM,KAAK;WACX,GAAG;AACV,QAAK,OAAO,KAAK,uCAAuC;AACxD,UAAO;;;CAIX,AAAQ,iBAAiB,WAA4B;AACnD,MAAI,CAAC,aAAa,UAAU,SAAS,KAAK,UAAU,SAAS,GAC3D,QAAO;EAET,MAAM,eAAe;AACrB,SAAO,aAAa,KAAK;;;;;CAM3B,MAAM,mBAAmB,WAAqC;AAC5D,QAAM,KAAK;EACX,MAAM,cAAc,MAAc,oDAAoD,KAAK;EAC3F,MAAM,eAAe,MAAc,kGAAkG,KAAK;EAC1I,MAAM,WAAW;EACjB,IAAIC,UAAe;AACnB,OAAK,IAAI,IAAI,GAAG,KAAK,UAAU,IAC7B,KAAI;GACF,MAAM,OAAO,MAAM,KAAK,WAAW,YAAY;AAC/C,UAAO,CAAC,CAAC;WACFH,OAAY;AACnB,aAAU;GACV,MAAM,MAAM,OAAO,OAAO,WAAW;GAGrC,MAAM,qBAAqB;AACzB,QAAI;KACF,MAAM,IAAK,SAAS,OAAO,UAAU,YAAY,aAAa,QAAU,MAAc,UAAU;AAChG,SAAI,CAAC,EAAG,QAAO;AACf,YAAO,OAAO,MAAM,WAAW,IAAI,KAAK,UAAU;YAC5C;AAAE,YAAO;;;GAEnB,MAAM,WAAW,GAAG,IAAI,IAAI;AAC5B,OAAI,WAAW,UAAW,QAAO;AACjC,OAAI,YAAY,QAAQ,IAAI,UAAU;IACpC,MAAM,UAAU,MAAM,KAAK,IAAI,GAAG,IAAI;AACtC,UAAM,IAAI,SAAS,MAAM,WAAW,GAAG;AACvC;;AAGF,OAAI,YAAY,MAAM;AACpB,SAAK,OAAO,KAAK,mCAAmC,UAAU,0CAA0C;AACxG,WAAO;;AAET,QAAK,OAAO,MAAM,wCAAwC,UAAU,IAAI;AACxE,SAAM;;AAGV,QAAM,mBAAmB,QAAQ,UAAU,IAAI,MAAM,OAAO;;;;;;;;;;;;;;;;;;;CAqB9D,MAAM,sBAAsB,OAIa;AACvC,QAAM,KAAK;AAEX,MAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,eAC1B,QAAO;GACL,IAAI;GACJ,MAAM;GACN,OAAO;;EAIX,MAAM,WAAW,MAAM,gBAAgB,gBAAgB,YAAY;AAEnE,SAAO,KAAK,uBACJI,iDAAiC;GACrC,YAAY,KAAK;GACjB,kBAAkB,KAAK,OAAO;GAC9B,kBAAkB,KAAK;GACvB,mBAAmB,KAAK,OAAO;GAC/B,MAAM,MAAM;GACZ,gBAAgB,MAAM;GACtB,qBAAqB,SAAS,KAAK,mBAAmB;MAExD,+BAA+B;;CAKnC,MAAc,eAAe,WAAmB,WAAsE;EAEpH,IAAI,QAAQ;AACZ,MAAI;GACF,MAAM,KAAK,MAAM,KAAK,WAAW,cAAc,WAAW;AAC1D,WAAQ,OAAO,IAAI,SAAS;UACtB;AACN,WAAQ;;EAGV,MAAM,QAAQ,MAAM,KAAK,WAAW,UAAU,EAAE,UAAU;EAC1D,MAAM,cAAc,MAAM,OAAO;EACjC,MAAM,aAAa,QAAQ,IAAI;AAC/B,SAAO;GAAE;GAAW,WAAW;;;CAGjC,MAAc,mBAAmB,OAOF;AAC7B,QAAM,KAAK;EACX,MAAM,UAAU;GACd,MAAMC,mEAAkB;GACxB,SAAS;IACP,gBAAgB,MAAM;IACtB,iBAAiB,MAAM;IACvB,YAAY,MAAM;IAClB,OAAO,MAAM;IACb,WAAW,MAAM;IACjB,SAAS,MAAM;;;EAKnB,MAAM,WAAW,kFAA4B;EAC7C,MAAM,EACJ,aACA,WACA,eACE,gDAAgD;AAEpD,SAAO,IAAIC,qCAAkB;GACd;GACF;GACX,aAAa;;;;;;;CAQjB,MAAM,mCAAmC,SAA6E;AACpH,SAAO,KAAK,6BAA6B;;;;;;;CAS3C,MAAM,kCAAkC,UASrC;AACD,SAAO;GACL,SAAS;GACT,OAAO;GACP,SAAS;;;;;;CAOb,iCAAiC;AAC/B,SAAO,OAAO,KAAU,QAAa;AACnC,OAAI;AACF,QAAI,CAAC,KAAK,MAAM;AACd,SAAI,OAAO,KAAK,KAAK,EAAE,OAAO;AAC9B;;IAEF,MAAMC,OAAoC,IAAI;AAC9C,QAAI,CAAC,KAAK,YAAY,CAAC,KAAK,yBAAyB;AACnD,SAAI,OAAO,KAAK,KAAK;MAAE,MAAM;MAAgB,SAAS;;AACtD;;IAEF,MAAM,SAAS,MAAM,KAAK,6BAA6B;IACvD,MAAM,SAAS,OAAO,UAAU,MAAM;AACtC,QAAI,WAAW,IACb,KAAI,OAAO,QAAQ,KAAK;KAAE,MAAM;KAAgB,SAAS,OAAO,WAAW;;QAE3E,KAAI,OAAO,QAAQ,KAAK;YAEnBP,OAAY;AACnB,SAAK,OAAO,MAAM,8CAA8C;AAChE,QAAI,OAAO,KAAK,KAAK;KAAE,MAAM;KAAY,SAAS,OAAO,WAAW;;;;;;;;CAQ1E,MAAc,iBAAoB,WAA6B,aAAiC;AAC9F,OAAK,WAAW;AAChB,OAAK,OAAO,MAAM,2BAA2B,YAAY,aAAa,KAAK,WAAW,QAAQ;AAE9F,OAAK,mBAAmB,KAAK,iBAC1B,KAAK,YAAY;AAChB,OAAI;AACF,SAAK,OAAO,MAAM,4BAA4B;IAC9C,MAAM,SAAS,MAAM;AACrB,SAAK,WAAW;AAChB,SAAK,WAAW;AAChB,SAAK,OAAO,MAAM,4BAA4B,YAAY,aAAa,KAAK,WAAW,QAAQ;AAC/F,WAAO;YACAA,OAAY;AACnB,SAAK,WAAW;AAChB,SAAK,WAAW;AAChB,SAAK,OAAO,MAAM,yBAAyB,YAAY,YAAY,KAAK,WAAW,OAAO,KAAK,OAAO;AACtG,UAAM;;KAGT,OAAO,UAAU;AAChB,SAAM;;AAGV,SAAO,KAAK;;;AAWhB,SAAS,gDAAgD,UAIvD;CACA,MAAM,MAAO,OAAO,aAAa,WAAW,KAAK,MAAM,YAAY;AAKnE,KAAI,KAAK,SAASQ,oEAAmB,mCAAmC;EACtE,MAAM,SAAS,KAAK,SAAS,SAAS;AACtC,QAAM,IAAI,MAAM;;CAGlB,MAAM,UAAU,KAAK;CACrB,MAAM,YAAa,SAAS,sBAAsB;AAClD,KAAI,CAAC,MAAM,QAAQ,cAAc,UAAU,WAAW,EACpD,OAAM,IAAI,MAAM;CAElB,MAAM,QAAQ,UAAU;CACxB,MAAM,aAAa,OAAO,cAAc,OAAO;AAC/C,KAAI,CAAC,MAAM,QAAQ,YACjB,OAAM,IAAI,MAAM;AAElB,QAAO;EACL,aAAa,MAAM;EACnB,WAAW,MAAM;EACjB"}
+{"version":3,"file":"AuthService.js","names":["resolved: URL[]","coerceThresholdNodeRole","coerceThresholdEd25519ShareMode","toOptionalTrimmedString","createAuthServiceConfig","coerceLogger","ShamirService","MinimalNearClient","EmailRecoveryService","DEFAULT_EMAIL_RECOVERY_CONTRACTS","formatYoctoToNear","formatGasToTGas","createThresholdSigningService","toPublicKeyStringFromSecretKey","candidates: URL[]","lastError: unknown","module","isValidAccountId","actions: ActionArgsWasm[]","ActionType","validateActionArgsWasm","error: any","errorMessage","parseContractExecutionError","list: unknown[]","toRorOriginOrNull","lastErr: Error | null","error: unknown","toError","executeSignedDelegateWithRelayer","WorkerRequestType","response: unknown","e: unknown","SignedTransaction","body: VerifyAuthenticationRequest","WorkerResponseType"],"sources":["../../../../src/server/core/AuthService.ts"],"sourcesContent":["import { ActionType, type ActionArgsWasm, validateActionArgsWasm } from '../../core/types/actions';\nimport { MinimalNearClient, SignedTransaction, type AccessKeyList } from '../../core/NearClient';\nimport type { FinalExecutionOutcome } from '@near-js/types';\nimport { toPublicKeyStringFromSecretKey } from './nearKeys';\nimport { createAuthServiceConfig } from './config';\nimport { formatGasToTGas, formatYoctoToNear } from './utils';\nimport { parseContractExecutionError } from './errors';\nimport { isValidAccountId, toOptionalTrimmedString, toRorOriginOrNull } from '../../utils/validation';\nimport { coerceThresholdEd25519ShareMode, coerceThresholdNodeRole } from './ThresholdService/config';\nimport type { ThresholdSigningService as ThresholdSigningServiceType } from './ThresholdService';\nimport { createThresholdSigningService } from './ThresholdService';\nimport initSignerWasm, {\n  handle_signer_message,\n  WorkerRequestType,\n  WorkerResponseType,\n  type InitInput,\n  type WasmTransaction,\n  type WasmSignature,\n} from '../../wasm_signer_worker/pkg/wasm_signer_worker.js';\n\nimport type {\n  AuthServiceConfig,\n  AuthServiceConfigInput,\n  AccountCreationRequest,\n  AccountCreationResult,\n  CreateAccountAndRegisterRequest,\n  CreateAccountAndRegisterResult,\n  VerifyAuthenticationRequest,\n  VerifyAuthenticationResponse,\n  SignerWasmModuleSupplier,\n} from './types';\n\nimport { DEFAULT_EMAIL_RECOVERY_CONTRACTS } from '../../core/defaultConfigs';\nimport { EmailRecoveryService } from '../email-recovery';\nimport { ShamirService } from './ShamirService';\nimport { SignedDelegate } from '../../core/types/delegate';\nimport {\n  type ExecuteSignedDelegateResult,\n  executeSignedDelegateWithRelayer,\n  type DelegateActionPolicy,\n} from '../delegateAction';\nimport { coerceLogger, type NormalizedLogger } from './logger';\nimport { errorMessage, toError } from '../../utils/errors';\n\nfunction isObject(v: unknown): v is Record<string, unknown> {\n  return !!v && typeof v === 'object' && !Array.isArray(v);\n}\n\n// =============================\n// WASM URL CONSTANTS + HELPERS\n// =============================\n\n// Primary location (preserveModules output)\nconst SIGNER_WASM_MAIN_PATH = '../../wasm_signer_worker/pkg/wasm_signer_worker_bg.wasm';\n// Fallback location (dist/workers copy step)\nconst SIGNER_WASM_FALLBACK_PATH = '../../../workers/wasm_signer_worker_bg.wasm';\n\nfunction getSignerWasmUrls(logger: NormalizedLogger): URL[] {\n  const paths = [SIGNER_WASM_MAIN_PATH, SIGNER_WASM_FALLBACK_PATH];\n  const resolved: URL[] = [];\n  const baseUrl = import.meta.url;\n\n  for (const path of paths) {\n    try {\n      if (!baseUrl) throw new Error('import.meta.url is undefined');\n      resolved.push(new URL(path, baseUrl));\n    } catch (err) {\n      logger.warn(`Failed to resolve signer WASM relative URL for path \"${path}\":`, err);\n    }\n  }\n\n  if (!resolved.length) {\n    throw new Error('Unable to resolve signer WASM location from import.meta.url. Provide AuthServiceConfig.signerWasm.moduleOrPath in this runtime.');\n  }\n\n  return resolved;\n}\n\nfunction summarizeThresholdEd25519Config(cfg: AuthServiceConfig['thresholdEd25519KeyStore']): string {\n  if (!cfg) return 'thresholdEd25519: not configured';\n\n  const nodeRole = coerceThresholdNodeRole(cfg.THRESHOLD_NODE_ROLE);\n  const shareMode = coerceThresholdEd25519ShareMode(cfg.THRESHOLD_ED25519_SHARE_MODE);\n\n  const masterSecretSet = (() => {\n    if ('kind' in cfg) return false;\n    return Boolean(toOptionalTrimmedString(cfg.THRESHOLD_ED25519_MASTER_SECRET_B64U));\n  })();\n\n  const store = (() => {\n    if ('kind' in cfg) {\n      if (cfg.kind === 'upstash-redis-rest') return 'upstash';\n      if (cfg.kind === 'redis-tcp') return 'redis';\n      return 'in-memory';\n    }\n    const upstashUrl = toOptionalTrimmedString(cfg.UPSTASH_REDIS_REST_URL);\n    const upstashToken = toOptionalTrimmedString(cfg.UPSTASH_REDIS_REST_TOKEN);\n    const redisUrl = toOptionalTrimmedString(cfg.REDIS_URL);\n    return (upstashUrl || upstashToken) ? 'upstash' : (redisUrl ? 'redis' : 'in-memory');\n  })();\n\n  const parts = [`thresholdEd25519: configured`, `nodeRole=${nodeRole}`, `shareMode=${shareMode}`, `store=${store}`];\n  if (masterSecretSet) parts.push('masterSecret=set');\n  return parts.join(' ');\n}\n\n/**\n * Framework-agnostic NEAR account service\n * Core business logic for account creation and registration operations\n */\nexport class AuthService {\n  private config: AuthServiceConfig;\n  private isInitialized = false;\n  private nearClient: MinimalNearClient;\n  private relayerPublicKey: string = '';\n  private signerWasmReady = false;\n  private readonly logger: NormalizedLogger;\n  private thresholdSigningServiceInitialized = false;\n  private thresholdSigningService: ThresholdSigningServiceType | null = null;\n\n  // Transaction queue to prevent nonce conflicts\n  private transactionQueue: Promise<any> = Promise.resolve();\n  private queueStats = { pending: 0, completed: 0, failed: 0 };\n\n  // Shamir 3-pass key management (delegated to ShamirService)\n  public readonly shamirService: ShamirService | null = null;\n  // DKIM/TEE email recovery logic (delegated to EmailRecoveryService)\n  public readonly emailRecovery: EmailRecoveryService | null = null;\n\n  constructor(config: AuthServiceConfigInput) {\n    this.config = createAuthServiceConfig(config);\n    this.logger = coerceLogger(this.config.logger);\n    const graceFileCandidate = (this.config.shamir?.graceShamirKeysFile || '').trim();\n    this.shamirService = new ShamirService(this.config.shamir, graceFileCandidate || 'grace-keys.json');\n    this.nearClient = new MinimalNearClient(this.config.nearRpcUrl);\n    this.emailRecovery = new EmailRecoveryService({\n      relayerAccountId: this.config.relayerAccountId,\n      relayerPrivateKey: this.config.relayerPrivateKey,\n      networkId: this.config.networkId,\n      emailDkimVerifierContract: DEFAULT_EMAIL_RECOVERY_CONTRACTS.emailDkimVerifierContract,\n      nearClient: this.nearClient,\n      logger: this.config.logger,\n      ensureSignerAndRelayerAccount: () => this._ensureSignerAndRelayerAccount(),\n      queueTransaction: <T>(fn: () => Promise<T>, label: string) => this.queueTransaction(fn, label),\n      fetchTxContext: (accountId: string, publicKey: string) => this.fetchTxContext(accountId, publicKey),\n      signWithPrivateKey: (input) => this.signWithPrivateKey(input),\n      getRelayerPublicKey: () => this.relayerPublicKey,\n      zkEmailProver: this.config.zkEmailProver,\n    });\n\n    // Log effective configuration at construction time so operators can\n    // verify wiring immediately when the service is created.\n    this.logger.info(`\n    AuthService initialized with:\n    • networkId: ${this.config.networkId}\n    • nearRpcUrl: ${this.config.nearRpcUrl}\n    • relayerAccountId: ${this.config.relayerAccountId}\n    • webAuthnContractId: ${this.config.webAuthnContractId}\n    • accountInitialBalance: ${this.config.accountInitialBalance} (${formatYoctoToNear(this.config.accountInitialBalance)} NEAR)\n    • createAccountAndRegisterGas: ${this.config.createAccountAndRegisterGas} (${formatGasToTGas(this.config.createAccountAndRegisterGas)})\n    ${this.config.shamir\n        ? `• shamir_p_b64u: ${this.config.shamir.shamir_p_b64u.slice(0, 10)}...\\n    • shamir_e_s_b64u: ${this.config.shamir.shamir_e_s_b64u.slice(0, 10)}...\\n    • shamir_d_s_b64u: ${this.config.shamir.shamir_d_s_b64u.slice(0, 10)}...`\n        : '• shamir: not configured'\n      }\n    • ${summarizeThresholdEd25519Config(this.config.thresholdEd25519KeyStore)}\n    ${this.config.zkEmailProver?.baseUrl\n        ? `• zkEmailProver: ${this.config.zkEmailProver.baseUrl}`\n        : `• zkEmailProver: not configured`\n      }\n    `);\n  }\n\n  async getRelayerAccount(): Promise<{ accountId: string; publicKey: string }> {\n    await this._ensureSignerAndRelayerAccount();\n    return {\n      accountId: this.config.relayerAccountId,\n      publicKey: this.relayerPublicKey\n    };\n  }\n\n  async viewAccessKeyList(accountId: string): Promise<AccessKeyList> {\n    await this._ensureSignerAndRelayerAccount();\n    return this.nearClient.viewAccessKeyList(accountId);\n  }\n\n  /**\n   * Lazily constructs the threshold signing service when `thresholdEd25519KeyStore` is configured.\n   * Routers may call this to auto-enable `/threshold-ed25519/*` endpoints.\n   */\n  getThresholdSigningService(): ThresholdSigningServiceType | null {\n    if (this.thresholdSigningServiceInitialized) return this.thresholdSigningService;\n    this.thresholdSigningServiceInitialized = true;\n\n    if (!this.config.thresholdEd25519KeyStore) {\n      this.thresholdSigningService = null;\n      return null;\n    }\n\n    this.thresholdSigningService = createThresholdSigningService({\n      authService: this,\n      thresholdEd25519KeyStore: this.config.thresholdEd25519KeyStore,\n      logger: this.logger,\n      isNode: this.isNodeEnvironment(),\n    });\n    return this.thresholdSigningService;\n  }\n\n  getWebAuthnContractId(): string {\n    return this.config.webAuthnContractId;\n  }\n\n  async txStatus(txHash: string, senderAccountId: string): Promise<FinalExecutionOutcome> {\n    await this._ensureSignerAndRelayerAccount();\n    return this.nearClient.txStatus(txHash, senderAccountId);\n  }\n\n  /**\n   * Configure Shamir WASM module override for serverless environments\n   * Required for Cloudflare Workers where import.meta.url doesn't work\n   */\n  private async configureShamirWasmForServerless(): Promise<void> {\n    if (!this.config.shamir?.moduleOrPath) {\n      return;\n    }\n\n    const { setShamirWasmModuleOverride } = await import('./shamirWorker.js');\n    setShamirWasmModuleOverride(this.config.shamir.moduleOrPath);\n  }\n\n  private async _ensureSignerAndRelayerAccount(): Promise<void> {\n    if (this.isInitialized) {\n      return;\n    }\n\n    // Initialize Shamir 3-pass via ShamirService (if configured)\n    if (this.config.shamir && this.shamirService) {\n      await this.configureShamirWasmForServerless();\n      await this.shamirService.ensureReady();\n    }\n\n    // Derive public key from configured relayer private key\n    try {\n      this.relayerPublicKey = toPublicKeyStringFromSecretKey(this.config.relayerPrivateKey);\n    } catch (e) {\n      this.logger.warn('Failed to derive public key from relayerPrivateKey; ensure it is in ed25519:<base58> format');\n      this.relayerPublicKey = '';\n    }\n\n    // Prepare signer WASM for transaction building/signing\n    await this.ensureSignerWasm();\n    this.isInitialized = true;\n  }\n\n  private async ensureSignerWasm(): Promise<void> {\n    if (this.signerWasmReady) return;\n    const override = this.config.signerWasm?.moduleOrPath;\n    if (override) {\n      try {\n        const moduleOrPath = await this.resolveSignerWasmOverride(override);\n        await initSignerWasm({ module_or_path: moduleOrPath as InitInput });\n        this.signerWasmReady = true;\n        return;\n      } catch (e) {\n        this.logger.error('Failed to initialize signer WASM via provided override:', e);\n        throw e;\n      }\n    }\n\n    let candidates: URL[];\n    try {\n      candidates = getSignerWasmUrls(this.logger);\n    } catch (err) {\n      this.logger.error('Failed to resolve signer WASM URLs:', err);\n      throw err;\n    }\n\n    try {\n      if (this.isNodeEnvironment()) {\n        await this.initSignerWasmForNode(candidates);\n        this.signerWasmReady = true;\n        return;\n      }\n\n      let lastError: unknown = null;\n      for (const candidate of candidates) {\n        try {\n          await initSignerWasm({ module_or_path: candidate as InitInput });\n          this.signerWasmReady = true;\n          return;\n        } catch (err) {\n          lastError = err;\n          this.logger.warn(`Failed to initialize signer WASM from ${candidate.toString()}, trying next candidate...`);\n        }\n      }\n\n      throw lastError ?? new Error('Unable to initialize signer WASM from any candidate URL');\n    } catch (e) {\n      this.logger.error('Failed to initialize signer WASM:', e);\n      throw e instanceof Error ? e : new Error(String(e));\n    }\n  }\n\n  private isNodeEnvironment(): boolean {\n    // Detect true Node.js, not Cloudflare Workers with nodejs_compat polyfills.\n    const processObj = (globalThis as unknown as { process?: { versions?: { node?: string } } }).process;\n    const isNode = Boolean(processObj?.versions?.node);\n    // Cloudflare Workers expose WebSocketPair and may polyfill process.\n    const webSocketPair = (globalThis as unknown as { WebSocketPair?: unknown }).WebSocketPair;\n    const nav = (globalThis as unknown as { navigator?: { userAgent?: unknown } }).navigator;\n    const isCloudflareWorker = typeof webSocketPair !== 'undefined'\n      || (typeof nav?.userAgent === 'string' && nav.userAgent.includes('Cloudflare-Workers'));\n    return isNode && !isCloudflareWorker;\n  }\n\n  private async resolveSignerWasmOverride(override: SignerWasmModuleSupplier): Promise<InitInput> {\n    const candidate = typeof override === 'function'\n      ? await (override as () => InitInput | Promise<InitInput>)()\n      : await override;\n\n    if (!candidate) {\n      throw new Error('Signer WASM override resolved to an empty value');\n    }\n\n    return candidate;\n  }\n\n  /**\n   * Initialize signer WASM in Node by loading the wasm file from disk.\n   * Tries multiple candidate locations and falls back to path-based init if needed.\n   */\n  private async initSignerWasmForNode(candidates: URL[]): Promise<void> {\n    const { fileURLToPath } = await import('node:url');\n    const { readFile } = await import('node:fs/promises');\n\n    // 1) Try reading and compiling bytes\n    for (const url of candidates) {\n      try {\n        const filePath = fileURLToPath(url);\n        const bytes = await readFile(filePath);\n        // Ensure we pass an ArrayBuffer (not Buffer / SharedArrayBuffer) for WebAssembly.compile\n        const ab = new ArrayBuffer(bytes.byteLength);\n        new Uint8Array(ab).set(bytes);\n        const module = await WebAssembly.compile(ab);\n        await initSignerWasm({ module_or_path: module });\n        return;\n      } catch { } // throw at end of function\n    }\n\n    // 2) Fallback: pass file path directly (supported in some environments)\n    for (const url of candidates) {\n      try {\n        const filePath = fileURLToPath(url);\n        await initSignerWasm({ module_or_path: filePath as unknown as InitInput });\n        return;\n      } catch { } // throw at end of function\n    }\n\n    throw new Error('[AuthService] Failed to initialize signer WASM from filesystem candidates');\n  }\n\n  /**\n   * ===== Registration & authentication =====\n   *\n   * Helpers for creating accounts, registering WebAuthn credentials,\n   * and verifying authentication responses.\n   */\n\n  /**\n   * Create a new account with the specified balance\n   */\n  async createAccount(request: AccountCreationRequest): Promise<AccountCreationResult> {\n    await this._ensureSignerAndRelayerAccount();\n\n    return this.queueTransaction(async () => {\n      try {\n        if (!isValidAccountId(request.accountId)) {\n          throw new Error(`Invalid account ID format: ${request.accountId}`);\n        }\n\n        // Check if account already exists\n        this.logger.info(`Checking if account ${request.accountId} already exists...`);\n        const accountExists = await this.checkAccountExists(request.accountId);\n        if (accountExists) {\n          throw new Error(`Account ${request.accountId} already exists. Cannot create duplicate account.`);\n        }\n        this.logger.info(`Account ${request.accountId} is available for creation`);\n\n        const initialBalance = this.config.accountInitialBalance;\n\n        this.logger.info(`Creating account: ${request.accountId}`);\n        this.logger.info(`Initial balance: ${initialBalance} yoctoNEAR`);\n\n        // Build actions for CreateAccount + Transfer + AddKey(FullAccess)\n        const actions: ActionArgsWasm[] = [\n          { action_type: ActionType.CreateAccount },\n          { action_type: ActionType.Transfer, deposit: String(initialBalance) },\n          {\n            action_type: ActionType.AddKey,\n            public_key: request.publicKey,\n            access_key: JSON.stringify({\n              nonce: 0,\n              permission: { FullAccess: {} },\n            }),\n          }\n        ];\n\n        actions.forEach(validateActionArgsWasm);\n\n        // Fetch nonce and block hash for relayer\n        const { nextNonce, blockHash } = await this.fetchTxContext(this.config.relayerAccountId, this.relayerPublicKey);\n\n        // Sign with relayer private key using WASM\n        const signed = await this.signWithPrivateKey({\n          nearPrivateKey: this.config.relayerPrivateKey,\n          signerAccountId: this.config.relayerAccountId,\n          receiverId: request.accountId,\n          nonce: nextNonce,\n          blockHash: blockHash,\n          actions\n        });\n\n        // Broadcast transaction via MinimalNearClient using a strongly typed SignedTransaction\n        const result = await this.nearClient.sendTransaction(signed);\n\n        this.logger.info(`Account creation completed: ${result.transaction.hash}`);\n        const nearAmount = (Number(BigInt(initialBalance)) / 1e24).toFixed(6);\n        return {\n          success: true,\n          transactionHash: result.transaction.hash,\n          accountId: request.accountId,\n          message: `Account ${request.accountId} created with ${nearAmount} NEAR initial balance`\n        };\n\n      } catch (error: any) {\n        this.logger.error(`Account creation failed for ${request.accountId}:`, error);\n        const msg = errorMessage(error) || 'Unknown account creation error';\n        return {\n          success: false,\n          error: msg,\n          message: `Failed to create account ${request.accountId}: ${msg}`\n        };\n      }\n    }, `create account ${request.accountId}`);\n  }\n\n  /**\n   * Create account and register user with WebAuthn in a single atomic transaction\n   */\n  async createAccountAndRegisterUser(request: CreateAccountAndRegisterRequest): Promise<CreateAccountAndRegisterResult> {\n    await this._ensureSignerAndRelayerAccount();\n\n    return this.queueTransaction(async () => {\n      try {\n        if (!isValidAccountId(request.new_account_id)) {\n          throw new Error(`Invalid account ID format: ${request.new_account_id}`);\n        }\n\n        // Check if account already exists\n        this.logger.info(`Checking if account ${request.new_account_id} already exists...`);\n        const accountExists = await this.checkAccountExists(request.new_account_id);\n        if (accountExists) {\n          throw new Error(`Account ${request.new_account_id} already exists. Cannot create duplicate account.`);\n        }\n        this.logger.info(`Account ${request.new_account_id} is available for atomic creation and registration`);\n        this.logger.info(`Registering account: ${request.new_account_id}`);\n        this.logger.info(`Contract: ${this.config.webAuthnContractId}`);\n\n        // Prepare contract arguments\n        const contractArgs = {\n          new_account_id: request.new_account_id,\n          new_public_key: request.new_public_key,\n          vrf_data: request.vrf_data,\n          webauthn_registration: request.webauthn_registration,\n          deterministic_vrf_public_key: request.deterministic_vrf_public_key,\n          authenticator_options: request.authenticator_options,\n        };\n\n        // Build single FunctionCall action\n        const actions: ActionArgsWasm[] = [\n          {\n            action_type: ActionType.FunctionCall,\n            method_name: 'create_account_and_register_user',\n            args: JSON.stringify(contractArgs),\n            gas: String(this.config.createAccountAndRegisterGas),\n            deposit: String(this.config.accountInitialBalance)\n          }\n        ];\n        actions.forEach(validateActionArgsWasm);\n\n        const { nextNonce, blockHash } = await this.fetchTxContext(this.config.relayerAccountId, this.relayerPublicKey);\n        const signed = await this.signWithPrivateKey({\n          nearPrivateKey: this.config.relayerPrivateKey,\n          signerAccountId: this.config.relayerAccountId,\n          receiverId: this.config.webAuthnContractId,\n          nonce: nextNonce,\n          blockHash,\n          actions\n        });\n        const result = await this.nearClient.sendTransaction(signed);\n\n        // Parse contract execution results to detect failures\n        const contractError = parseContractExecutionError(result, request.new_account_id);\n        if (contractError) {\n          this.logger.error(`Contract execution failed for ${request.new_account_id}:`, contractError);\n          throw new Error(contractError);\n        }\n\n        this.logger.info(`Registration completed: ${result.transaction.hash}`);\n        return {\n          success: true,\n          transactionHash: result.transaction.hash,\n          message: `Account ${request.new_account_id} created and registered successfully`,\n          contractResult: result,\n        };\n\n      } catch (error: any) {\n        this.logger.error(`Atomic registration failed for ${request.new_account_id}:`, error);\n        const msg = errorMessage(error) || 'Unknown atomic registration error';\n        return {\n          success: false,\n          error: msg,\n          message: `Failed to create and register account ${request.new_account_id}: ${msg}`\n        };\n      }\n    }, `atomic create and register ${request.new_account_id}`);\n  }\n\n  /**\n   * Verify authentication response and issue JWT (VIEW call)\n   * Calls the web3authn contract's verify_authentication_response method via view\n   * and issues a JWT or session credential upon successful verification\n   */\n  async verifyAuthenticationResponse(\n    request: VerifyAuthenticationRequest\n  ): Promise<VerifyAuthenticationResponse> {\n    try {\n      await this._ensureSignerAndRelayerAccount();\n\n      const intentDigest32 = request?.vrf_data?.intent_digest_32;\n      if (!Array.isArray(intentDigest32) || intentDigest32.length !== 32) {\n        return {\n          success: false,\n          verified: false,\n          code: 'invalid_intent_digest',\n          message: 'Missing or invalid vrf_data.intent_digest_32 (expected 32 bytes)',\n        };\n      }\n      const sessionPolicyDigest32 = (request?.vrf_data as { session_policy_digest_32?: unknown })?.session_policy_digest_32;\n      if (sessionPolicyDigest32 !== undefined) {\n        if (!Array.isArray(sessionPolicyDigest32) || sessionPolicyDigest32.length !== 32) {\n          return {\n            success: false,\n            verified: false,\n            code: 'invalid_session_policy_digest',\n            message: 'Invalid vrf_data.session_policy_digest_32 (expected 32 bytes when present)',\n          };\n        }\n      }\n\n      const args = {\n        vrf_data: request.vrf_data,\n        webauthn_authentication: request.webauthn_authentication,\n      };\n\n      // Perform a VIEW function call (no gas) and parse the contract response\n      const contractResponse = await this.nearClient.view<typeof args, unknown>({\n        account: this.config.webAuthnContractId,\n        method: 'verify_authentication_response',\n        args\n      });\n\n      const verified = isObject(contractResponse) && contractResponse.verified === true;\n      if (!verified) {\n        return {\n          success: false,\n          verified: false,\n          code: 'not_verified',\n          message: 'Authentication verification failed',\n          contractResponse,\n        };\n      }\n\n      return {\n        success: true,\n        verified: true,\n        sessionCredential: {\n          userId: request.vrf_data.user_id,\n          issuedAt: new Date().toISOString(),\n          expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString(),\n        },\n        contractResponse,\n      };\n    } catch (error: any) {\n      return {\n        success: false,\n        verified: false,\n        code: 'internal',\n        message: error?.message || 'Verification failed',\n      };\n    }\n  }\n\n  /**\n   * Fetch Related Origin Requests (ROR) allowed origins from a NEAR view method.\n   * Defaults: contractId = webAuthnContractId, method = 'get_allowed_origins', args = {}.\n   * Returns a sanitized, deduplicated list of absolute origins.\n   */\n  public async getRorOrigins(opts?: { contractId?: string; method?: string; args?: unknown }): Promise<string[]> {\n    const contractId = toOptionalTrimmedString(opts?.contractId) || this.config.webAuthnContractId.trim();\n    const method = toOptionalTrimmedString(opts?.method) || 'get_allowed_origins';\n    const args = opts?.args ?? {};\n\n    try {\n      const result = await this.nearClient.view<unknown, unknown>({ account: contractId, method, args });\n      let list: unknown[] = [];\n      if (Array.isArray(result)) {\n        list = result;\n      } else if (isObject(result) && Array.isArray(result.origins)) {\n        list = result.origins;\n      }\n      const out = new Set<string>();\n      for (const item of list) {\n        const norm = toRorOriginOrNull(item);\n        if (norm) out.add(norm);\n      }\n      return Array.from(out);\n    } catch (e) {\n      this.logger.warn('[AuthService] getRorOrigins failed:', e);\n      return [];\n    }\n  }\n\n  /**\n   * Account existence helper used by registration flows.\n   */\n  async checkAccountExists(accountId: string): Promise<boolean> {\n    await this._ensureSignerAndRelayerAccount();\n    const isNotFound = (m: string) => /does not exist|UNKNOWN_ACCOUNT|unknown\\s+account/i.test(m);\n    const isRetryable = (m: string) => /server error|internal|temporar|timeout|too many requests|429|empty response|rpc request failed/i.test(m);\n    const attempts = 3;\n    let lastErr: Error | null = null;\n    for (let i = 1; i <= attempts; i++) {\n      try {\n        const view = await this.nearClient.viewAccount(accountId);\n        return !!view;\n      } catch (error: unknown) {\n        const err = toError(error);\n        lastErr = err;\n        const msg = err.message;\n        const details = (err as { details?: unknown }).details;\n        let detailsBlob = '';\n        if (details) {\n          try {\n            detailsBlob = typeof details === 'string' ? details : JSON.stringify(details);\n          } catch {\n            detailsBlob = '';\n          }\n        }\n        const combined = `${msg}\\n${detailsBlob}`;\n        if (isNotFound(combined)) return false;\n        if (isRetryable(msg) && i < attempts) {\n          const backoff = 150 * Math.pow(2, i - 1);\n          await new Promise((r) => setTimeout(r, backoff));\n          continue;\n        }\n        // As a safety valve for flaky RPCs, treat persistent retryable errors as not-found\n        if (isRetryable(msg)) {\n          this.logger.warn(`[AuthService] Assuming account '${accountId}' not found after retryable RPC errors:`, msg);\n          return false;\n        }\n        this.logger.error(`Error checking account existence for ${accountId}:`, err);\n        throw err;\n      }\n    }\n    throw lastErr || new Error('Unknown error');\n  }\n\n  /**\n   * ===== Delegate actions & transaction execution =====\n   *\n   * Flows that build and submit on-chain transactions, including NEP-461\n   * SignedDelegate meta-transactions.\n   */\n\n  /**\n   * Execute a NEP-461 SignedDelegate by wrapping it in an outer transaction\n   * from the relayer account. This method is intended to be called by\n   * example relayers (Node/Cloudflare) once a SignedDelegate has been\n   * produced by the signer worker and returned to the application.\n   *\n   * Notes:\n   * - Signature and hash computation are performed by the signer worker.\n   *   This method focuses on expiry/policy enforcement and meta-tx submission.\n   * - Nonce/replay protection is left to the integrator; see docs for guidance.\n   */\n  async executeSignedDelegate(input: {\n    hash: string;\n    signedDelegate: SignedDelegate;\n    policy?: DelegateActionPolicy;\n  }): Promise<ExecuteSignedDelegateResult> {\n    await this._ensureSignerAndRelayerAccount();\n\n    if (!input?.hash || !input?.signedDelegate) {\n      return {\n        ok: false,\n        code: 'invalid_delegate_request',\n        error: 'hash and signedDelegate are required',\n      };\n    }\n\n    const senderId = input.signedDelegate?.delegateAction?.senderId ?? 'unknown-sender';\n\n    return this.queueTransaction(\n      () => executeSignedDelegateWithRelayer({\n        nearClient: this.nearClient,\n        relayerAccountId: this.config.relayerAccountId,\n        relayerPublicKey: this.relayerPublicKey,\n        relayerPrivateKey: this.config.relayerPrivateKey,\n        hash: input.hash,\n        signedDelegate: input.signedDelegate,\n        signWithPrivateKey: (args) => this.signWithPrivateKey(args),\n      }),\n      `execute signed delegate for ${senderId}`,\n    );\n  }\n\n  // === Internal helpers for signing & RPC ===\n  private async fetchTxContext(accountId: string, publicKey: string): Promise<{ nextNonce: string; blockHash: string }> {\n    // Access key (if missing, assume nonce=0)\n    let nonce = 0n;\n    try {\n      const ak = await this.nearClient.viewAccessKey(accountId, publicKey);\n      nonce = BigInt(ak?.nonce ?? 0);\n    } catch {\n      nonce = 0n;\n    }\n    // Block\n    const block = await this.nearClient.viewBlock({ finality: 'final' });\n    const txBlockHash = block.header.hash;\n    const nextNonce = (nonce + 1n).toString();\n    return { nextNonce, blockHash: txBlockHash };\n  }\n\n  private async signWithPrivateKey(input: {\n    nearPrivateKey: string;\n    signerAccountId: string;\n    receiverId: string;\n    nonce: string;\n    blockHash: string;\n    actions: ActionArgsWasm[];\n  }): Promise<SignedTransaction> {\n    await this.ensureSignerWasm();\n    const message = {\n      type: WorkerRequestType.SignTransactionWithKeyPair,\n      payload: {\n        nearPrivateKey: input.nearPrivateKey,\n        signerAccountId: input.signerAccountId,\n        receiverId: input.receiverId,\n        nonce: input.nonce,\n        blockHash: input.blockHash,\n        actions: input.actions\n      }\n    };\n    // uses wasm signer worker's SignTransactionWithKeyPair action,\n    // which doesn't require VRF worker session\n    let response: unknown;\n    try {\n      response = await handle_signer_message(message);\n    } catch (e: unknown) {\n      const msg = errorMessage(e);\n      // Log payload for debugging (redacting private key)\n      this.logger.error('Signer WASM rejected message:', {\n        error: msg,\n        payload: JSON.stringify(message, (key, value) =>\n          key === 'nearPrivateKey' ? '[REDACTED]' : value\n        )\n      });\n\n      // This specific error is intentionally redacted inside the WASM worker.\n      // When it occurs in production, it's commonly due to a JS/WASM version mismatch\n      // (the JS message schema changed but an old worker wasm is still deployed).\n      if (msg.includes('Invalid payload for SIGN_TRANSACTION_WITH_KEYPAIR')) {\n        throw new Error(\n          `Signer WASM rejected SIGN_TRANSACTION_WITH_KEYPAIR payload: ${msg}. Rebuild + redeploy the relayer so the bundled \\`wasm_signer_worker.js\\` and \\`wasm_signer_worker_bg.wasm\\` come from the same build.`,\n        );\n      }\n      throw (e instanceof Error ? e : new Error(msg || 'Signing failed'));\n    }\n    const {\n      transaction,\n      signature,\n      borshBytes\n    } = extractFirstSignedTransactionFromWorkerResponse(response);\n\n    return new SignedTransaction({\n      transaction: transaction,\n      signature: signature,\n      borsh_bytes: borshBytes,\n    });\n  }\n\n  /**\n   * Framework-agnostic: handle verify-authentication request\n   * Converts a generic ServerRequest to ServerResponse using this service\n   */\n  async handleVerifyAuthenticationResponse(request: VerifyAuthenticationRequest): Promise<VerifyAuthenticationResponse> {\n    return this.verifyAuthenticationResponse(request);\n  }\n\n  /**\n   * ZK-email recovery helper (stub).\n   * Intended to call the global ZkEmailVerifier and per-user recovery contract\n   * once zk-email proofs and public inputs are wired through.\n   */\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  async recoverAccountFromZkEmailVerifier(_request: {\n    accountId: string;\n    proof: unknown;\n    publicInputs: unknown;\n  }): Promise<{\n    success: boolean;\n    transactionHash?: string;\n    message?: string;\n    error?: string;\n  }> {\n    return {\n      success: false,\n      error: 'recoverAccountFromZkEmailVerifier is not yet implemented',\n      message: 'recoverAccountFromZkEmailVerifier is not yet implemented',\n    };\n  }\n\n  /**\n   * Express-style middleware factory for verify-authentication\n   */\n  verifyAuthenticationMiddleware() {\n    return async (req: any, res: any) => {\n      try {\n        if (!req?.body) {\n          res.status(400).json({ error: 'Request body is required' });\n          return;\n        }\n        const body: VerifyAuthenticationRequest = req.body;\n        if (!body.vrf_data || !body.webauthn_authentication) {\n          res.status(400).json({ code: 'invalid_body', message: 'vrf_data and webauthn_authentication are required' });\n          return;\n        }\n        const result = await this.verifyAuthenticationResponse(body);\n        const status = result.success ? 200 : 400;\n        if (status !== 200) {\n          res.status(status).json({ code: 'not_verified', message: result.message || 'Authentication verification failed' });\n        } else {\n          res.status(status).json(result);\n        }\n      } catch (error: any) {\n        this.logger.error('Error in verify authentication middleware:', error);\n        res.status(500).json({ code: 'internal', message: error?.message || 'Internal server error' });\n      }\n    };\n  }\n\n  /**\n   * Queue transactions to prevent nonce conflicts\n   */\n  private async queueTransaction<T>(operation: () => Promise<T>, description: string): Promise<T> {\n    this.queueStats.pending++;\n    this.logger.debug(`[AuthService] Queueing: ${description} (pending: ${this.queueStats.pending})`);\n\n    this.transactionQueue = this.transactionQueue\n      .then(async () => {\n        try {\n          this.logger.debug(`[AuthService] Executing: ${description}`);\n          const result = await operation();\n          this.queueStats.completed++;\n          this.queueStats.pending--;\n          this.logger.debug(`[AuthService] Completed: ${description} (pending: ${this.queueStats.pending})`);\n          return result;\n        } catch (error: any) {\n          this.queueStats.failed++;\n          this.queueStats.pending--;\n          this.logger.error(\n            `[AuthService] Failed: ${description} (failed: ${this.queueStats.failed}):`,\n            errorMessage(error) || 'unknown error',\n          );\n          throw error;\n        }\n      })\n      .catch((error) => {\n        throw error;\n      });\n\n    return this.transactionQueue;\n  }\n}\n\ninterface WorkerSignedTransactionPayload {\n  transaction: WasmTransaction;\n  signature: WasmSignature;\n  borshBytes?: number[];\n  borsh_bytes?: number[];\n}\n\nfunction extractFirstSignedTransactionFromWorkerResponse(response: any): {\n  transaction: WasmTransaction;\n  signature: WasmSignature;\n  borshBytes: number[];\n} {\n  const res = (typeof response === 'string' ? JSON.parse(response) : response) as {\n    type?: WorkerResponseType;\n    payload?: { signedTransactions?: WorkerSignedTransactionPayload[]; error?: string };\n  } | undefined;\n\n  if (res?.type !== WorkerResponseType.SignTransactionWithKeyPairSuccess) {\n    const errMsg = res?.payload?.error || 'Signing failed';\n    throw new Error(errMsg);\n  }\n\n  const payload = res?.payload;\n  const signedTxs = (payload?.signedTransactions ?? []) as WorkerSignedTransactionPayload[];\n  if (!Array.isArray(signedTxs) || signedTxs.length === 0) {\n    throw new Error('No signed transaction returned');\n  }\n  const first = signedTxs[0];\n  const borshBytes = first?.borshBytes ?? first?.borsh_bytes;\n  if (!Array.isArray(borshBytes)) {\n    throw new Error('Missing borsh bytes');\n  }\n  return {\n    transaction: first.transaction,\n    signature: first.signature,\n    borshBytes,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA4CA,SAAS,SAAS,GAA0C;AAC1D,QAAO,CAAC,CAAC,KAAK,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ;;AAQxD,MAAM,wBAAwB;AAE9B,MAAM,4BAA4B;AAElC,SAAS,kBAAkB,QAAiC;CAC1D,MAAM,QAAQ,CAAC,uBAAuB;CACtC,MAAMA,WAAkB;CACxB,MAAM;AAEN,MAAK,MAAM,QAAQ,MACjB,KAAI;AACF,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM;AAC9B,WAAS,KAAK,IAAI,IAAI,MAAM;UACrB,KAAK;AACZ,SAAO,KAAK,wDAAwD,KAAK,KAAK;;AAIlF,KAAI,CAAC,SAAS,OACZ,OAAM,IAAI,MAAM;AAGlB,QAAO;;AAGT,SAAS,gCAAgC,KAA4D;AACnG,KAAI,CAAC,IAAK,QAAO;CAEjB,MAAM,WAAWC,yCAAwB,IAAI;CAC7C,MAAM,YAAYC,iDAAgC,IAAI;CAEtD,MAAM,yBAAyB;AAC7B,MAAI,UAAU,IAAK,QAAO;AAC1B,SAAO,QAAQC,2CAAwB,IAAI;;CAG7C,MAAM,eAAe;AACnB,MAAI,UAAU,KAAK;AACjB,OAAI,IAAI,SAAS,qBAAsB,QAAO;AAC9C,OAAI,IAAI,SAAS,YAAa,QAAO;AACrC,UAAO;;EAET,MAAM,aAAaA,2CAAwB,IAAI;EAC/C,MAAM,eAAeA,2CAAwB,IAAI;EACjD,MAAM,WAAWA,2CAAwB,IAAI;AAC7C,SAAQ,cAAc,eAAgB,YAAa,WAAW,UAAU;;CAG1E,MAAM,QAAQ;EAAC;EAAgC,YAAY;EAAY,aAAa;EAAa,SAAS;;AAC1G,KAAI,gBAAiB,OAAM,KAAK;AAChC,QAAO,MAAM,KAAK;;;;;;AAOpB,IAAa,cAAb,MAAyB;CACvB,AAAQ;CACR,AAAQ,gBAAgB;CACxB,AAAQ;CACR,AAAQ,mBAA2B;CACnC,AAAQ,kBAAkB;CAC1B,AAAiB;CACjB,AAAQ,qCAAqC;CAC7C,AAAQ,0BAA8D;CAGtE,AAAQ,mBAAiC,QAAQ;CACjD,AAAQ,aAAa;EAAE,SAAS;EAAG,WAAW;EAAG,QAAQ;;CAGzD,AAAgB,gBAAsC;CAEtD,AAAgB,gBAA6C;CAE7D,YAAY,QAAgC;AAC1C,OAAK,SAASC,uCAAwB;AACtC,OAAK,SAASC,4BAAa,KAAK,OAAO;EACvC,MAAM,sBAAsB,KAAK,OAAO,QAAQ,uBAAuB,IAAI;AAC3E,OAAK,gBAAgB,IAAIC,oCAAc,KAAK,OAAO,QAAQ,sBAAsB;AACjF,OAAK,aAAa,IAAIC,qCAAkB,KAAK,OAAO;AACpD,OAAK,gBAAgB,IAAIC,mCAAqB;GAC5C,kBAAkB,KAAK,OAAO;GAC9B,mBAAmB,KAAK,OAAO;GAC/B,WAAW,KAAK,OAAO;GACvB,2BAA2BC,wDAAiC;GAC5D,YAAY,KAAK;GACjB,QAAQ,KAAK,OAAO;GACpB,qCAAqC,KAAK;GAC1C,mBAAsB,IAAsB,UAAkB,KAAK,iBAAiB,IAAI;GACxF,iBAAiB,WAAmB,cAAsB,KAAK,eAAe,WAAW;GACzF,qBAAqB,UAAU,KAAK,mBAAmB;GACvD,2BAA2B,KAAK;GAChC,eAAe,KAAK,OAAO;;AAK7B,OAAK,OAAO,KAAK;;mBAEF,KAAK,OAAO,UAAU;oBACrB,KAAK,OAAO,WAAW;0BACjB,KAAK,OAAO,iBAAiB;4BAC3B,KAAK,OAAO,mBAAmB;+BAC5B,KAAK,OAAO,sBAAsB,IAAIC,gCAAkB,KAAK,OAAO,uBAAuB;qCACrF,KAAK,OAAO,4BAA4B,IAAIC,8BAAgB,KAAK,OAAO,6BAA6B;MACpI,KAAK,OAAO,SACR,oBAAoB,KAAK,OAAO,OAAO,cAAc,MAAM,GAAG,IAAI,8BAA8B,KAAK,OAAO,OAAO,gBAAgB,MAAM,GAAG,IAAI,8BAA8B,KAAK,OAAO,OAAO,gBAAgB,MAAM,GAAG,IAAI,OAC9N,2BACH;QACC,gCAAgC,KAAK,OAAO,0BAA0B;MACxE,KAAK,OAAO,eAAe,UACvB,oBAAoB,KAAK,OAAO,cAAc,YAC9C,kCACH;;;CAIL,MAAM,oBAAuE;AAC3E,QAAM,KAAK;AACX,SAAO;GACL,WAAW,KAAK,OAAO;GACvB,WAAW,KAAK;;;CAIpB,MAAM,kBAAkB,WAA2C;AACjE,QAAM,KAAK;AACX,SAAO,KAAK,WAAW,kBAAkB;;;;;;CAO3C,6BAAiE;AAC/D,MAAI,KAAK,mCAAoC,QAAO,KAAK;AACzD,OAAK,qCAAqC;AAE1C,MAAI,CAAC,KAAK,OAAO,0BAA0B;AACzC,QAAK,0BAA0B;AAC/B,UAAO;;AAGT,OAAK,0BAA0BC,oEAA8B;GAC3D,aAAa;GACb,0BAA0B,KAAK,OAAO;GACtC,QAAQ,KAAK;GACb,QAAQ,KAAK;;AAEf,SAAO,KAAK;;CAGd,wBAAgC;AAC9B,SAAO,KAAK,OAAO;;CAGrB,MAAM,SAAS,QAAgB,iBAAyD;AACtF,QAAM,KAAK;AACX,SAAO,KAAK,WAAW,SAAS,QAAQ;;;;;;CAO1C,MAAc,mCAAkD;AAC9D,MAAI,CAAC,KAAK,OAAO,QAAQ,aACvB;EAGF,MAAM,EAAE,gCAAgC,2CAAM;AAC9C,8BAA4B,KAAK,OAAO,OAAO;;CAGjD,MAAc,iCAAgD;AAC5D,MAAI,KAAK,cACP;AAIF,MAAI,KAAK,OAAO,UAAU,KAAK,eAAe;AAC5C,SAAM,KAAK;AACX,SAAM,KAAK,cAAc;;AAI3B,MAAI;AACF,QAAK,mBAAmBC,gDAA+B,KAAK,OAAO;WAC5D,GAAG;AACV,QAAK,OAAO,KAAK;AACjB,QAAK,mBAAmB;;AAI1B,QAAM,KAAK;AACX,OAAK,gBAAgB;;CAGvB,MAAc,mBAAkC;AAC9C,MAAI,KAAK,gBAAiB;EAC1B,MAAM,WAAW,KAAK,OAAO,YAAY;AACzC,MAAI,SACF,KAAI;GACF,MAAM,eAAe,MAAM,KAAK,0BAA0B;AAC1D,uEAAqB,EAAE,gBAAgB;AACvC,QAAK,kBAAkB;AACvB;WACO,GAAG;AACV,QAAK,OAAO,MAAM,2DAA2D;AAC7E,SAAM;;EAIV,IAAIC;AACJ,MAAI;AACF,gBAAa,kBAAkB,KAAK;WAC7B,KAAK;AACZ,QAAK,OAAO,MAAM,uCAAuC;AACzD,SAAM;;AAGR,MAAI;AACF,OAAI,KAAK,qBAAqB;AAC5B,UAAM,KAAK,sBAAsB;AACjC,SAAK,kBAAkB;AACvB;;GAGF,IAAIC,YAAqB;AACzB,QAAK,MAAM,aAAa,WACtB,KAAI;AACF,wEAAqB,EAAE,gBAAgB;AACvC,SAAK,kBAAkB;AACvB;YACO,KAAK;AACZ,gBAAY;AACZ,SAAK,OAAO,KAAK,yCAAyC,UAAU,WAAW;;AAInF,SAAM,6BAAa,IAAI,MAAM;WACtB,GAAG;AACV,QAAK,OAAO,MAAM,qCAAqC;AACvD,SAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO;;;CAIpD,AAAQ,oBAA6B;EAEnC,MAAM,aAAc,WAAyE;EAC7F,MAAM,SAAS,QAAQ,YAAY,UAAU;EAE7C,MAAM,gBAAiB,WAAsD;EAC7E,MAAM,MAAO,WAAkE;EAC/E,MAAM,qBAAqB,OAAO,kBAAkB,eAC9C,OAAO,KAAK,cAAc,YAAY,IAAI,UAAU,SAAS;AACnE,SAAO,UAAU,CAAC;;CAGpB,MAAc,0BAA0B,UAAwD;EAC9F,MAAM,YAAY,OAAO,aAAa,aAClC,MAAO,aACP,MAAM;AAEV,MAAI,CAAC,UACH,OAAM,IAAI,MAAM;AAGlB,SAAO;;;;;;CAOT,MAAc,sBAAsB,YAAkC;EACpE,MAAM,EAAE,kBAAkB,MAAM,OAAO;EACvC,MAAM,EAAE,aAAa,MAAM,OAAO;AAGlC,OAAK,MAAM,OAAO,WAChB,KAAI;GACF,MAAM,WAAW,cAAc;GAC/B,MAAM,QAAQ,MAAM,SAAS;GAE7B,MAAM,KAAK,IAAI,YAAY,MAAM;AACjC,OAAI,WAAW,IAAI,IAAI;GACvB,MAAMC,WAAS,MAAM,YAAY,QAAQ;AACzC,uEAAqB,EAAE,gBAAgBA;AACvC;UACM;AAIV,OAAK,MAAM,OAAO,WAChB,KAAI;GACF,MAAM,WAAW,cAAc;AAC/B,uEAAqB,EAAE,gBAAgB;AACvC;UACM;AAGV,QAAM,IAAI,MAAM;;;;;;;;;;;CAalB,MAAM,cAAc,SAAiE;AACnF,QAAM,KAAK;AAEX,SAAO,KAAK,iBAAiB,YAAY;AACvC,OAAI;AACF,QAAI,CAACC,oCAAiB,QAAQ,WAC5B,OAAM,IAAI,MAAM,8BAA8B,QAAQ;AAIxD,SAAK,OAAO,KAAK,uBAAuB,QAAQ,UAAU;IAC1D,MAAM,gBAAgB,MAAM,KAAK,mBAAmB,QAAQ;AAC5D,QAAI,cACF,OAAM,IAAI,MAAM,WAAW,QAAQ,UAAU;AAE/C,SAAK,OAAO,KAAK,WAAW,QAAQ,UAAU;IAE9C,MAAM,iBAAiB,KAAK,OAAO;AAEnC,SAAK,OAAO,KAAK,qBAAqB,QAAQ;AAC9C,SAAK,OAAO,KAAK,oBAAoB,eAAe;IAGpD,MAAMC,UAA4B;KAChC,EAAE,aAAaC,2BAAW;KAC1B;MAAE,aAAaA,2BAAW;MAAU,SAAS,OAAO;;KACpD;MACE,aAAaA,2BAAW;MACxB,YAAY,QAAQ;MACpB,YAAY,KAAK,UAAU;OACzB,OAAO;OACP,YAAY,EAAE,YAAY;;;;AAKhC,YAAQ,QAAQC;IAGhB,MAAM,EAAE,WAAW,cAAc,MAAM,KAAK,eAAe,KAAK,OAAO,kBAAkB,KAAK;IAG9F,MAAM,SAAS,MAAM,KAAK,mBAAmB;KAC3C,gBAAgB,KAAK,OAAO;KAC5B,iBAAiB,KAAK,OAAO;KAC7B,YAAY,QAAQ;KACpB,OAAO;KACI;KACX;;IAIF,MAAM,SAAS,MAAM,KAAK,WAAW,gBAAgB;AAErD,SAAK,OAAO,KAAK,+BAA+B,OAAO,YAAY;IACnE,MAAM,cAAc,OAAO,OAAO,mBAAmB,MAAM,QAAQ;AACnE,WAAO;KACL,SAAS;KACT,iBAAiB,OAAO,YAAY;KACpC,WAAW,QAAQ;KACnB,SAAS,WAAW,QAAQ,UAAU,gBAAgB,WAAW;;YAG5DC,OAAY;AACnB,SAAK,OAAO,MAAM,+BAA+B,QAAQ,UAAU,IAAI;IACvE,MAAM,MAAMC,4BAAa,UAAU;AACnC,WAAO;KACL,SAAS;KACT,OAAO;KACP,SAAS,4BAA4B,QAAQ,UAAU,IAAI;;;KAG9D,kBAAkB,QAAQ;;;;;CAM/B,MAAM,6BAA6B,SAAmF;AACpH,QAAM,KAAK;AAEX,SAAO,KAAK,iBAAiB,YAAY;AACvC,OAAI;AACF,QAAI,CAACL,oCAAiB,QAAQ,gBAC5B,OAAM,IAAI,MAAM,8BAA8B,QAAQ;AAIxD,SAAK,OAAO,KAAK,uBAAuB,QAAQ,eAAe;IAC/D,MAAM,gBAAgB,MAAM,KAAK,mBAAmB,QAAQ;AAC5D,QAAI,cACF,OAAM,IAAI,MAAM,WAAW,QAAQ,eAAe;AAEpD,SAAK,OAAO,KAAK,WAAW,QAAQ,eAAe;AACnD,SAAK,OAAO,KAAK,wBAAwB,QAAQ;AACjD,SAAK,OAAO,KAAK,aAAa,KAAK,OAAO;IAG1C,MAAM,eAAe;KACnB,gBAAgB,QAAQ;KACxB,gBAAgB,QAAQ;KACxB,UAAU,QAAQ;KAClB,uBAAuB,QAAQ;KAC/B,8BAA8B,QAAQ;KACtC,uBAAuB,QAAQ;;IAIjC,MAAMC,UAA4B,CAChC;KACE,aAAaC,2BAAW;KACxB,aAAa;KACb,MAAM,KAAK,UAAU;KACrB,KAAK,OAAO,KAAK,OAAO;KACxB,SAAS,OAAO,KAAK,OAAO;;AAGhC,YAAQ,QAAQC;IAEhB,MAAM,EAAE,WAAW,cAAc,MAAM,KAAK,eAAe,KAAK,OAAO,kBAAkB,KAAK;IAC9F,MAAM,SAAS,MAAM,KAAK,mBAAmB;KAC3C,gBAAgB,KAAK,OAAO;KAC5B,iBAAiB,KAAK,OAAO;KAC7B,YAAY,KAAK,OAAO;KACxB,OAAO;KACP;KACA;;IAEF,MAAM,SAAS,MAAM,KAAK,WAAW,gBAAgB;IAGrD,MAAM,gBAAgBG,6CAA4B,QAAQ,QAAQ;AAClE,QAAI,eAAe;AACjB,UAAK,OAAO,MAAM,iCAAiC,QAAQ,eAAe,IAAI;AAC9E,WAAM,IAAI,MAAM;;AAGlB,SAAK,OAAO,KAAK,2BAA2B,OAAO,YAAY;AAC/D,WAAO;KACL,SAAS;KACT,iBAAiB,OAAO,YAAY;KACpC,SAAS,WAAW,QAAQ,eAAe;KAC3C,gBAAgB;;YAGXF,OAAY;AACnB,SAAK,OAAO,MAAM,kCAAkC,QAAQ,eAAe,IAAI;IAC/E,MAAM,MAAMC,4BAAa,UAAU;AACnC,WAAO;KACL,SAAS;KACT,OAAO;KACP,SAAS,yCAAyC,QAAQ,eAAe,IAAI;;;KAGhF,8BAA8B,QAAQ;;;;;;;CAQ3C,MAAM,6BACJ,SACuC;AACvC,MAAI;AACF,SAAM,KAAK;GAEX,MAAM,iBAAiB,SAAS,UAAU;AAC1C,OAAI,CAAC,MAAM,QAAQ,mBAAmB,eAAe,WAAW,GAC9D,QAAO;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,SAAS;;GAGb,MAAM,yBAAyB,SAAS,WAAqD;AAC7F,OAAI,0BAA0B,QAC5B;QAAI,CAAC,MAAM,QAAQ,0BAA0B,sBAAsB,WAAW,GAC5E,QAAO;KACL,SAAS;KACT,UAAU;KACV,MAAM;KACN,SAAS;;;GAKf,MAAM,OAAO;IACX,UAAU,QAAQ;IAClB,yBAAyB,QAAQ;;GAInC,MAAM,mBAAmB,MAAM,KAAK,WAAW,KAA2B;IACxE,SAAS,KAAK,OAAO;IACrB,QAAQ;IACR;;GAGF,MAAM,WAAW,SAAS,qBAAqB,iBAAiB,aAAa;AAC7E,OAAI,CAAC,SACH,QAAO;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,SAAS;IACT;;AAIJ,UAAO;IACL,SAAS;IACT,UAAU;IACV,mBAAmB;KACjB,QAAQ,QAAQ,SAAS;KACzB,2BAAU,IAAI,QAAO;KACrB,WAAW,IAAI,KAAK,KAAK,QAAQ,OAAU,KAAK,KAAM;;IAExD;;WAEKD,OAAY;AACnB,UAAO;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,SAAS,OAAO,WAAW;;;;;;;;;CAUjC,MAAa,cAAc,MAAoF;EAC7G,MAAM,aAAalB,2CAAwB,MAAM,eAAe,KAAK,OAAO,mBAAmB;EAC/F,MAAM,SAASA,2CAAwB,MAAM,WAAW;EACxD,MAAM,OAAO,MAAM,QAAQ;AAE3B,MAAI;GACF,MAAM,SAAS,MAAM,KAAK,WAAW,KAAuB;IAAE,SAAS;IAAY;IAAQ;;GAC3F,IAAIqB,OAAkB;AACtB,OAAI,MAAM,QAAQ,QAChB,QAAO;YACE,SAAS,WAAW,MAAM,QAAQ,OAAO,SAClD,QAAO,OAAO;GAEhB,MAAM,sBAAM,IAAI;AAChB,QAAK,MAAM,QAAQ,MAAM;IACvB,MAAM,OAAOC,qCAAkB;AAC/B,QAAI,KAAM,KAAI,IAAI;;AAEpB,UAAO,MAAM,KAAK;WACX,GAAG;AACV,QAAK,OAAO,KAAK,uCAAuC;AACxD,UAAO;;;;;;CAOX,MAAM,mBAAmB,WAAqC;AAC5D,QAAM,KAAK;EACX,MAAM,cAAc,MAAc,oDAAoD,KAAK;EAC3F,MAAM,eAAe,MAAc,kGAAkG,KAAK;EAC1I,MAAM,WAAW;EACjB,IAAIC,UAAwB;AAC5B,OAAK,IAAI,IAAI,GAAG,KAAK,UAAU,IAC7B,KAAI;GACF,MAAM,OAAO,MAAM,KAAK,WAAW,YAAY;AAC/C,UAAO,CAAC,CAAC;WACFC,OAAgB;GACvB,MAAM,MAAMC,uBAAQ;AACpB,aAAU;GACV,MAAM,MAAM,IAAI;GAChB,MAAM,UAAW,IAA8B;GAC/C,IAAI,cAAc;AAClB,OAAI,QACF,KAAI;AACF,kBAAc,OAAO,YAAY,WAAW,UAAU,KAAK,UAAU;WAC/D;AACN,kBAAc;;GAGlB,MAAM,WAAW,GAAG,IAAI,IAAI;AAC5B,OAAI,WAAW,UAAW,QAAO;AACjC,OAAI,YAAY,QAAQ,IAAI,UAAU;IACpC,MAAM,UAAU,MAAM,KAAK,IAAI,GAAG,IAAI;AACtC,UAAM,IAAI,SAAS,MAAM,WAAW,GAAG;AACvC;;AAGF,OAAI,YAAY,MAAM;AACpB,SAAK,OAAO,KAAK,mCAAmC,UAAU,0CAA0C;AACxG,WAAO;;AAET,QAAK,OAAO,MAAM,wCAAwC,UAAU,IAAI;AACxE,SAAM;;AAGV,QAAM,2BAAW,IAAI,MAAM;;;;;;;;;;;;;;;;;;;CAqB7B,MAAM,sBAAsB,OAIa;AACvC,QAAM,KAAK;AAEX,MAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,eAC1B,QAAO;GACL,IAAI;GACJ,MAAM;GACN,OAAO;;EAIX,MAAM,WAAW,MAAM,gBAAgB,gBAAgB,YAAY;AAEnE,SAAO,KAAK,uBACJC,iDAAiC;GACrC,YAAY,KAAK;GACjB,kBAAkB,KAAK,OAAO;GAC9B,kBAAkB,KAAK;GACvB,mBAAmB,KAAK,OAAO;GAC/B,MAAM,MAAM;GACZ,gBAAgB,MAAM;GACtB,qBAAqB,SAAS,KAAK,mBAAmB;MAExD,+BAA+B;;CAKnC,MAAc,eAAe,WAAmB,WAAsE;EAEpH,IAAI,QAAQ;AACZ,MAAI;GACF,MAAM,KAAK,MAAM,KAAK,WAAW,cAAc,WAAW;AAC1D,WAAQ,OAAO,IAAI,SAAS;UACtB;AACN,WAAQ;;EAGV,MAAM,QAAQ,MAAM,KAAK,WAAW,UAAU,EAAE,UAAU;EAC1D,MAAM,cAAc,MAAM,OAAO;EACjC,MAAM,aAAa,QAAQ,IAAI;AAC/B,SAAO;GAAE;GAAW,WAAW;;;CAGjC,MAAc,mBAAmB,OAOF;AAC7B,QAAM,KAAK;EACX,MAAM,UAAU;GACd,MAAMC,mEAAkB;GACxB,SAAS;IACP,gBAAgB,MAAM;IACtB,iBAAiB,MAAM;IACvB,YAAY,MAAM;IAClB,OAAO,MAAM;IACb,WAAW,MAAM;IACjB,SAAS,MAAM;;;EAKnB,IAAIC;AACJ,MAAI;AACF,cAAW,kFAA4B;WAChCC,GAAY;GACnB,MAAM,MAAMV,4BAAa;AAEzB,QAAK,OAAO,MAAM,iCAAiC;IACjD,OAAO;IACP,SAAS,KAAK,UAAU,UAAU,KAAK,UACrC,QAAQ,mBAAmB,eAAe;;AAO9C,OAAI,IAAI,SAAS,qDACf,OAAM,IAAI,MACR,+DAA+D,IAAI;AAGvE,SAAO,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO;;EAEnD,MAAM,EACJ,aACA,WACA,eACE,gDAAgD;AAEpD,SAAO,IAAIW,qCAAkB;GACd;GACF;GACX,aAAa;;;;;;;CAQjB,MAAM,mCAAmC,SAA6E;AACpH,SAAO,KAAK,6BAA6B;;;;;;;CAS3C,MAAM,kCAAkC,UASrC;AACD,SAAO;GACL,SAAS;GACT,OAAO;GACP,SAAS;;;;;;CAOb,iCAAiC;AAC/B,SAAO,OAAO,KAAU,QAAa;AACnC,OAAI;AACF,QAAI,CAAC,KAAK,MAAM;AACd,SAAI,OAAO,KAAK,KAAK,EAAE,OAAO;AAC9B;;IAEF,MAAMC,OAAoC,IAAI;AAC9C,QAAI,CAAC,KAAK,YAAY,CAAC,KAAK,yBAAyB;AACnD,SAAI,OAAO,KAAK,KAAK;MAAE,MAAM;MAAgB,SAAS;;AACtD;;IAEF,MAAM,SAAS,MAAM,KAAK,6BAA6B;IACvD,MAAM,SAAS,OAAO,UAAU,MAAM;AACtC,QAAI,WAAW,IACb,KAAI,OAAO,QAAQ,KAAK;KAAE,MAAM;KAAgB,SAAS,OAAO,WAAW;;QAE3E,KAAI,OAAO,QAAQ,KAAK;YAEnBb,OAAY;AACnB,SAAK,OAAO,MAAM,8CAA8C;AAChE,QAAI,OAAO,KAAK,KAAK;KAAE,MAAM;KAAY,SAAS,OAAO,WAAW;;;;;;;;CAQ1E,MAAc,iBAAoB,WAA6B,aAAiC;AAC9F,OAAK,WAAW;AAChB,OAAK,OAAO,MAAM,2BAA2B,YAAY,aAAa,KAAK,WAAW,QAAQ;AAE9F,OAAK,mBAAmB,KAAK,iBAC1B,KAAK,YAAY;AAChB,OAAI;AACF,SAAK,OAAO,MAAM,4BAA4B;IAC9C,MAAM,SAAS,MAAM;AACrB,SAAK,WAAW;AAChB,SAAK,WAAW;AAChB,SAAK,OAAO,MAAM,4BAA4B,YAAY,aAAa,KAAK,WAAW,QAAQ;AAC/F,WAAO;YACAA,OAAY;AACnB,SAAK,WAAW;AAChB,SAAK,WAAW;AAChB,SAAK,OAAO,MACV,yBAAyB,YAAY,YAAY,KAAK,WAAW,OAAO,KACxEC,4BAAa,UAAU;AAEzB,UAAM;;KAGT,OAAO,UAAU;AAChB,SAAM;;AAGV,SAAO,KAAK;;;AAWhB,SAAS,gDAAgD,UAIvD;CACA,MAAM,MAAO,OAAO,aAAa,WAAW,KAAK,MAAM,YAAY;AAKnE,KAAI,KAAK,SAASa,oEAAmB,mCAAmC;EACtE,MAAM,SAAS,KAAK,SAAS,SAAS;AACtC,QAAM,IAAI,MAAM;;CAGlB,MAAM,UAAU,KAAK;CACrB,MAAM,YAAa,SAAS,sBAAsB;AAClD,KAAI,CAAC,MAAM,QAAQ,cAAc,UAAU,WAAW,EACpD,OAAM,IAAI,MAAM;CAElB,MAAM,QAAQ,UAAU;CACxB,MAAM,aAAa,OAAO,cAAc,OAAO;AAC/C,KAAI,CAAC,MAAM,QAAQ,YACjB,OAAM,IAAI,MAAM;AAElB,QAAO;EACL,aAAa,MAAM;EACnB,WAAW,MAAM;EACjB"}