@tatchi-xyz/sdk 0.21.0 → 0.31.0

package/dist/esm/react/src/core/WalletIframe/client/IframeTransport.js

@@ -0,0 +1,362 @@
+import { isObject } from "../../../utils/validation.js";
+import { serializeAuthenticationCredentialWithPRF, serializeRegistrationCredentialWithPRF } from "../../WebAuthnManager/credentialsHelpers.js";
+import { WebAuthnBridgeMessage } from "../../WebAuthnManager/WebAuthnFallbacks/safari-fallbacks.js";
+import { ensureOverlayBase } from "./overlay-styles.js";
+
+//#region src/core/WalletIframe/client/IframeTransport.ts
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const WILDCARD_CONNECT_ATTEMPTS = 6;
+const IframeMessage = {
+	Connect: "CONNECT",
+	Ready: "READY",
+	HostBooted: "SERVICE_HOST_BOOTED",
+	HostDebugOrigin: "SERVICE_HOST_DEBUG_ORIGIN",
+	HostLog: "SERVICE_HOST_LOG"
+};
+var IframeTransport = class {
+	opts;
+	iframeEl = null;
+	serviceBooted = false;
+	connectInFlight = null;
+	walletServiceUrl;
+	walletOrigin;
+	testOptions;
+	debug = false;
+	onWindowMessage = (e) => {
+		const data = e.data;
+		if (!isObject(data)) return;
+		const type = data.type;
+		if (type === IframeMessage.HostDebugOrigin) {
+			if (this.debug) console.debug("[IframeTransport][host-origin]", {
+				origin: data.origin,
+				href: data.href,
+				eventOrigin: e.origin
+			});
+			return;
+		}
+		if (e.origin !== this.walletOrigin) return;
+		if (type === IframeMessage.HostBooted) {
+			this.serviceBooted = true;
+			return;
+		}
+		if (type === IframeMessage.HostLog) {
+			if (this.debug) console.debug("[IframeTransport][wallet-log]", data.payload);
+			return;
+		}
+		if (type === WebAuthnBridgeMessage.Create || type === WebAuthnBridgeMessage.Get) this.performWebAuthnBridge(type, data, e);
+	};
+	constructor(options) {
+		this.opts = {
+			servicePath: "/wallet-service",
+			connectTimeoutMs: 8e3,
+			debug: false,
+			...options
+		};
+		try {
+			this.walletServiceUrl = new URL(this.opts.servicePath, this.opts.walletOrigin);
+		} catch (err) {
+			throw new Error(`[IframeTransport] Invalid wallet origin (${options.walletOrigin}) or servicePath (${options.servicePath || "/wallet-service"})`);
+		}
+		this.walletOrigin = this.walletServiceUrl.origin;
+		this.testOptions = {
+			routerId: options.testOptions?.routerId,
+			ownerTag: options.testOptions?.ownerTag
+		};
+		this.debug = !!this.opts.debug;
+		if (typeof window !== "undefined") window.addEventListener("message", this.onWindowMessage);
+	}
+	/** Returns the underlying iframe element if it exists. */
+	getIframeEl() {
+		return this.iframeEl;
+	}
+	/** Remove global listeners created by this transport instance. */
+	dispose() {
+		if (typeof window !== "undefined") window.removeEventListener("message", this.onWindowMessage);
+	}
+	isDevHost() {
+		if (typeof window === "undefined") return false;
+		const env = globalThis?.process?.env?.NODE_ENV;
+		if (env && env !== "production") return true;
+		const h = window.location.hostname || "";
+		return /localhost|127\.(?:0|[1-9]\d?)\.(?:0|[1-9]\d?)\.(?:0|[1-9]\d?)|\.local(?:host)?$/i.test(h);
+	}
+	isOverlayForOrigin(el) {
+		const dsOrigin = el.dataset?.w3aOrigin;
+		if (dsOrigin) return dsOrigin === this.walletOrigin;
+		try {
+			return new URL(el.src).origin === this.walletOrigin;
+		} catch {
+			return false;
+		}
+	}
+	/**
+	* Guardrail: prevent multiple overlay iframes accumulating when apps accidentally
+	* create more than one WalletIframeRouter/TatchiPasskey instance.
+	*/
+	removeExistingOverlaysForOrigin() {
+		if (typeof document === "undefined") return;
+		const existing = Array.from(document.querySelectorAll("iframe.w3a-wallet-overlay"));
+		const matches = existing.filter((el) => this.isOverlayForOrigin(el));
+		if (!matches.length) return;
+		if (this.isDevHost()) {
+			const routerIds = matches.map((el) => el.dataset?.w3aRouterId).filter((v) => typeof v === "string" && v.length > 0);
+			console.warn(`[IframeTransport] Found existing wallet overlay iframe(s) for ${this.walletOrigin}. This usually indicates multiple SDK instances. Removing old iframe(s) to avoid duplicates.`, {
+				count: matches.length,
+				routerIds
+			});
+		}
+		for (const el of matches) try {
+			el.remove();
+		} catch {}
+	}
+	/** Ensure the iframe element exists and is appended to the DOM. Idempotent. */
+	ensureIframeMounted() {
+		if (this.iframeEl) return this.iframeEl;
+		this.removeExistingOverlaysForOrigin();
+		const iframe = document.createElement("iframe");
+		iframe.classList.add("w3a-wallet-overlay", "is-hidden");
+		try {
+			ensureOverlayBase(iframe);
+		} catch {}
+		iframe.setAttribute("width", "0");
+		iframe.setAttribute("height", "0");
+		iframe.setAttribute("aria-hidden", "true");
+		iframe.setAttribute("tabindex", "-1");
+		iframe.setAttribute("loading", "eager");
+		iframe.setAttribute("fetchpriority", "high");
+		iframe.dataset.w3aRouterId = this.testOptions?.routerId || "";
+		if (this.testOptions?.ownerTag) iframe.dataset.w3aOwner = this.testOptions.ownerTag;
+		iframe.dataset.w3aOrigin = this.walletOrigin;
+		try {
+			iframe.setAttribute("allow", this.buildAllowAttr(this.walletOrigin));
+		} catch {
+			iframe.setAttribute("allow", "publickey-credentials-get 'self'; publickey-credentials-create 'self'; clipboard-read; clipboard-write");
+		}
+		iframe._svc_loaded = false;
+		iframe.addEventListener("load", () => {
+			iframe._svc_loaded = true;
+		}, { once: true });
+		const src = this.walletServiceUrl.toString();
+		console.debug("[IframeTransport] mount: external origin", src);
+		iframe.src = src;
+		document.body.appendChild(iframe);
+		console.debug("[IframeTransport] mount: iframe appended");
+		this.iframeEl = iframe;
+		return iframe;
+	}
+	/**
+	* Connect to the wallet iframe using a MessageChannel handshake.
+	* - Repeatedly posts {type:'CONNECT'} with a fresh port until a 'READY' message arrives
+	* - Times out after connectTimeoutMs
+	* - Deduplicates concurrent calls and returns the same MessagePort promise
+	*/
+	async connect() {
+		if (this.connectInFlight) return this.connectInFlight;
+		this.connectInFlight = (async () => {
+			const iframe = this.ensureIframeMounted();
+			await this.waitForLoad(iframe);
+			const bootWaitMs = Math.min(this.opts.connectTimeoutMs / 12, 300);
+			await this.waitForBootHint(bootWaitMs);
+			return this.handshake(iframe);
+		})();
+		try {
+			return await this.connectInFlight;
+		} finally {
+			this.connectInFlight = null;
+		}
+	}
+	async waitForBootHint(timeoutMs) {
+		if (this.serviceBooted || timeoutMs <= 0) return;
+		const start = Date.now();
+		while (!this.serviceBooted && Date.now() - start < timeoutMs) await sleep(50);
+	}
+	async handshake(iframe) {
+		let resolved = false;
+		let attempt = 0;
+		let warnedNullOrigin = false;
+		const start = Date.now();
+		const overallTimeout = this.opts.connectTimeoutMs;
+		return await new Promise((resolve, reject) => {
+			const tick = () => {
+				if (resolved) return;
+				const elapsed = Date.now() - start;
+				if (elapsed >= overallTimeout) {
+					resolved = true;
+					console.debug("[IframeTransport] handshake timeout after %d ms", elapsed);
+					return reject(/* @__PURE__ */ new Error("Wallet iframe READY timeout"));
+				}
+				attempt += 1;
+				const channel = new MessageChannel();
+				const port1 = channel.port1;
+				const port2 = channel.port2;
+				const cleanup = () => {
+					try {
+						port1.onmessage = null;
+					} catch {}
+				};
+				port1.onmessage = (e) => {
+					const data = e.data;
+					if (data.type === IframeMessage.Ready) {
+						resolved = true;
+						cleanup();
+						port1.start?.();
+						return resolve(port1);
+					}
+				};
+				try {
+					port1.start?.();
+				} catch {}
+				const cw = iframe.contentWindow;
+				if (!cw) {
+					resolved = true;
+					cleanup();
+					return reject(/* @__PURE__ */ new Error("Wallet iframe window missing"));
+				}
+				const targetOrigin = this.getConnectTargetOrigin(attempt);
+				({warnedNullOrigin} = this.postConnectMessage(cw, { type: IframeMessage.Connect }, port2, targetOrigin, warnedNullOrigin, elapsed, attempt));
+				const interval = attempt < 10 ? 200 : attempt < 20 ? 400 : 800;
+				setTimeout(() => {
+					if (!resolved) tick();
+				}, interval);
+			};
+			tick();
+		});
+	}
+	getConnectTargetOrigin(attempt) {
+		if (this.serviceBooted) return this.walletOrigin;
+		if (attempt <= WILDCARD_CONNECT_ATTEMPTS) return "*";
+		return this.walletOrigin;
+	}
+	postConnectMessage(cw, data, port2, targetOrigin, warnedNullOrigin, elapsed, attempt) {
+		try {
+			cw.postMessage(data, targetOrigin, [port2]);
+			return { warnedNullOrigin };
+		} catch (e) {
+			const message = e instanceof Error ? e.message ?? String(e) : String(e);
+			if (!warnedNullOrigin && message.includes("'null'")) {
+				warnedNullOrigin = true;
+				console.warn("[IframeTransport] CONNECT blocked; iframe origin appears to be null. Check that %s is reachable and responds with Cross-Origin-Resource-Policy: cross-origin.", this.walletServiceUrl.toString());
+			}
+			try {
+				cw.postMessage(data, "*", [port2]);
+			} catch {}
+			console.debug("[IframeTransport] CONNECT attempt %d threw after %d ms; retrying.", attempt, elapsed);
+			return { warnedNullOrigin };
+		}
+	}
+	/** Guard against posting to the iframe before it has fired load. */
+	async waitForLoad(iframe) {
+		if (iframe._svc_loaded) return;
+		await new Promise((resolve) => {
+			let done = false;
+			const finish = () => {
+				if (done) return;
+				done = true;
+				resolve();
+			};
+			const timeout = window.setTimeout(() => {
+				if (!done && this.debug) console.debug("[IframeTransport] waitForLoad did not observe load event within 150ms; continuing");
+				finish();
+			}, 150);
+			iframe.addEventListener("load", () => {
+				clearTimeout(timeout);
+				finish();
+			}, { once: true });
+		});
+	}
+	buildAllowAttr(walletOrigin) {
+		return `publickey-credentials-get 'self' ${walletOrigin}; publickey-credentials-create 'self' ${walletOrigin}; clipboard-read; clipboard-write`;
+	}
+	formatBridgeError(err) {
+		return err instanceof Error ? err.message : String(err);
+	}
+	postBridgeResult(source, type, requestId, ok, payload) {
+		source?.postMessage({
+			type,
+			requestId,
+			ok,
+			...payload
+		}, "*");
+	}
+	performWebAuthnBridge(kind, raw, e) {
+		if (kind === WebAuthnBridgeMessage.Create) {
+			this.handleWebAuthnCreate(raw, e);
+			return;
+		}
+		this.handleWebAuthnGet(raw, e);
+	}
+	async handleWebAuthnCreate(req, e) {
+		const requestId = req?.requestId || "";
+		if (!isObject(req?.publicKey)) {
+			this.postBridgeResult(e.source, WebAuthnBridgeMessage.CreateResult, requestId, false, { error: "publicKey options required" });
+			return;
+		}
+		if (!navigator.credentials?.create) {
+			this.postBridgeResult(e.source, WebAuthnBridgeMessage.CreateResult, requestId, false, { error: "WebAuthn create not available" });
+			return;
+		}
+		try {
+			const src = req.publicKey;
+			const rpName = src.rp?.name || "WebAuthn";
+			const rpId = src.rp?.id || window.location.hostname;
+			const pub = {
+				...src,
+				rp: {
+					name: rpName,
+					id: rpId
+				}
+			};
+			const cred = await navigator.credentials.create({ publicKey: pub });
+			const serialized = serializeRegistrationCredentialWithPRF({
+				credential: cred,
+				firstPrfOutput: true,
+				secondPrfOutput: true
+			});
+			this.postBridgeResult(e.source, WebAuthnBridgeMessage.CreateResult, requestId, true, { credential: serialized });
+		} catch (err) {
+			const message = this.formatBridgeError(err);
+			console.warn("[IframeTransport][bridge] CREATE failed", {
+				requestId,
+				err: message
+			});
+			this.postBridgeResult(e.source, WebAuthnBridgeMessage.CreateResult, requestId, false, { error: message });
+		}
+	}
+	async handleWebAuthnGet(req, e) {
+		const requestId = req?.requestId || "";
+		if (!isObject(req?.publicKey)) {
+			this.postBridgeResult(e.source, WebAuthnBridgeMessage.GetResult, requestId, false, { error: "publicKey options required" });
+			return;
+		}
+		if (!navigator.credentials?.get) {
+			this.postBridgeResult(e.source, WebAuthnBridgeMessage.GetResult, requestId, false, { error: "WebAuthn get not available" });
+			return;
+		}
+		try {
+			const src = req.publicKey;
+			const rpId = src.rpId || window.location.hostname;
+			const pub = {
+				...src,
+				rpId
+			};
+			const cred = await navigator.credentials.get({ publicKey: pub });
+			const serialized = serializeAuthenticationCredentialWithPRF({
+				credential: cred,
+				firstPrfOutput: true,
+				secondPrfOutput: true
+			});
+			this.postBridgeResult(e.source, WebAuthnBridgeMessage.GetResult, requestId, true, { credential: serialized });
+		} catch (err) {
+			const message = this.formatBridgeError(err);
+			console.warn("[IframeTransport][bridge] GET failed", {
+				requestId,
+				err: message
+			});
+			this.postBridgeResult(e.source, WebAuthnBridgeMessage.GetResult, requestId, false, { error: message });
+		}
+	}
+};
+
+//#endregion
+export { IframeTransport };
+//# sourceMappingURL=IframeTransport.js.map

package/dist/esm/react/src/core/WalletIframe/client/IframeTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IframeTransport.js","names":["pub: PublicKeyCredentialCreationOptions","pub: PublicKeyCredentialRequestOptions"],"sources":["../../../../../../../src/core/WalletIframe/client/IframeTransport.ts"],"sourcesContent":["/**\n * IframeTransport - Client-Side Communication Layer\n *\n * This module handles the low-level iframe management and connection establishment.\n * It encapsulates all the complex browser-specific logic for safely creating and\n * connecting to the wallet service iframe.\n *\n * Key Responsibilities:\n * - Iframe Creation: Creates and mounts the iframe element with proper security attributes\n * - Security Hardening: Sets appropriate allow/sandbox attributes for WebAuthn and clipboard access\n * - Load Event Handling: Waits for iframe load to avoid postMessage races\n * - Connection Handshake: Performs robust CONNECT → READY handshake using MessageChannel\n * - Boot Latency Handling: Manages cross-origin boot delays with SERVICE_HOST_BOOTED hints\n * - Connection Deduplication: Prevents multiple concurrent connection attempts\n * - Error Handling: Provides clear error messages for connection failures\n *\n * Security Model:\n * - Uses explicit allow attributes for WebAuthn and clipboard permissions\n * - Avoids sandboxing for cross-origin deployments (prevents MessagePort transfer issues)\n * - Validates wallet origin URLs to prevent security issues\n * - Uses MessageChannel for secure, bidirectional communication\n *\n * Browser Compatibility:\n * - Handles various browser quirks around iframe loading and MessagePort transfer\n * - Provides fallback behavior for different browser implementations\n * - Manages timing issues with cross-origin iframe boot sequences\n */\n\nimport type { ChildToParentEnvelope } from '../shared/messages';\nimport { isObject } from '@/utils/validation';\nimport { serializeRegistrationCredentialWithPRF, serializeAuthenticationCredentialWithPRF } from '../../WebAuthnManager/credentialsHelpers';\nimport { ensureOverlayBase } from './overlay-styles';\nimport { WebAuthnBridgeMessage } from '../../WebAuthnManager/WebAuthnFallbacks';\n\nconst sleep = (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms));\nconst WILDCARD_CONNECT_ATTEMPTS = 6;\n\n// Message constants (typed string literals, tree‑shake friendly)\nexport const IframeMessage = {\n  Connect: 'CONNECT',\n  Ready: 'READY',\n  HostBooted: 'SERVICE_HOST_BOOTED',\n  HostDebugOrigin: 'SERVICE_HOST_DEBUG_ORIGIN',\n  HostLog: 'SERVICE_HOST_LOG',\n} as const;\n\n// Bridge request payloads\ntype CreateReq = { requestId?: string; publicKey?: PublicKeyCredentialCreationOptions };\ntype GetReq = { requestId?: string; publicKey?: PublicKeyCredentialRequestOptions };\n\nexport interface IframeTransportOptions {\n  walletOrigin: string;     // e.g., https://wallet.example.com\n  servicePath?: string;      // default '/wallet-service'\n  connectTimeoutMs?: number; // total budget for handshake retries\n  debug?: boolean;           // enable verbose transport logging\n  testOptions?: {\n    routerId?: string;         // identity tag for the iframe element\n    ownerTag?: string;         // e.g., 'app' | 'tests'\n  };\n}\n\nexport class IframeTransport {\n  private readonly opts: Required<IframeTransportOptions>;\n  private iframeEl: HTMLIFrameElement | null = null;\n  private serviceBooted = false; // set when wallet host sends SERVICE_HOST_BOOTED (best-effort only)\n  private connectInFlight: Promise<MessagePort> | null = null;\n  private readonly walletServiceUrl: URL;\n  private readonly walletOrigin: string;\n  private readonly testOptions: { routerId?: string; ownerTag?: string };\n  private debug = false;\n  private readonly onWindowMessage = (e: MessageEvent): void => {\n    const data = e.data as unknown;\n    if (!isObject(data)) return;\n    const type = (data as { type?: unknown }).type;\n    if (type === IframeMessage.HostDebugOrigin) {\n      if (this.debug) {\n        console.debug('[IframeTransport][host-origin]', {\n          origin: (data as { origin?: unknown }).origin,\n          href: (data as { href?: unknown }).href,\n          eventOrigin: e.origin,\n        });\n      }\n      return;\n    }\n    if (e.origin !== this.walletOrigin) return;\n    if (type === IframeMessage.HostBooted) {\n      this.serviceBooted = true;\n      return;\n    }\n    if (type === IframeMessage.HostLog) {\n      if (this.debug) {\n        console.debug('[IframeTransport][wallet-log]', (data as { payload?: unknown }).payload);\n      }\n      return;\n    }\n    if (type === WebAuthnBridgeMessage.Create || type === WebAuthnBridgeMessage.Get) {\n      this.performWebAuthnBridge(type as typeof WebAuthnBridgeMessage.Create | typeof WebAuthnBridgeMessage.Get, data, e);\n    }\n  };\n\n  constructor(options: IframeTransportOptions) {\n    this.opts = {\n      servicePath: '/wallet-service',\n      connectTimeoutMs: 8000,\n      debug: false,\n      ...options,\n    } as Required<IframeTransportOptions>;\n\n    try {\n      this.walletServiceUrl = new URL(this.opts.servicePath, this.opts.walletOrigin);\n    } catch (err) {\n      throw new Error(`[IframeTransport] Invalid wallet origin (${options.walletOrigin}) or servicePath (${options.servicePath || '/wallet-service'})`);\n    }\n    this.walletOrigin = this.walletServiceUrl.origin;\n    this.testOptions = {\n      routerId: options.testOptions?.routerId,\n      ownerTag: options.testOptions?.ownerTag,\n    };\n    this.debug = !!this.opts.debug;\n\n    // Listen for a best-effort boot hint from the wallet host. Not required for correctness,\n    // but helps reduce redundant CONNECT posts while the host script is still booting.\n    if (typeof window !== 'undefined') {\n      window.addEventListener('message', this.onWindowMessage);\n    }\n  }\n\n  /** Returns the underlying iframe element if it exists. */\n  getIframeEl(): HTMLIFrameElement | null { return this.iframeEl; }\n\n  /** Remove global listeners created by this transport instance. */\n  dispose(): void {\n    if (typeof window !== 'undefined') {\n      window.removeEventListener('message', this.onWindowMessage);\n    }\n  }\n\n  private isDevHost(): boolean {\n    if (typeof window === 'undefined') return false;\n    const env = (globalThis as { process?: { env?: Record<string, string | undefined> } })?.process?.env?.NODE_ENV;\n    if (env && env !== 'production') return true;\n    const h = window.location.hostname || '';\n    return /localhost|127\\.(?:0|[1-9]\\d?)\\.(?:0|[1-9]\\d?)\\.(?:0|[1-9]\\d?)|\\.local(?:host)?$/i.test(h);\n  }\n\n  private isOverlayForOrigin(el: HTMLIFrameElement): boolean {\n    const dsOrigin = (el as { dataset?: { w3aOrigin?: string } }).dataset?.w3aOrigin;\n    if (dsOrigin) return dsOrigin === this.walletOrigin;\n    try {\n      return new URL(el.src).origin === this.walletOrigin;\n    } catch {\n      return false;\n    }\n  }\n\n  /**\n   * Guardrail: prevent multiple overlay iframes accumulating when apps accidentally\n   * create more than one WalletIframeRouter/TatchiPasskey instance.\n   */\n  private removeExistingOverlaysForOrigin(): void {\n    if (typeof document === 'undefined') return;\n    const existing = Array.from(document.querySelectorAll('iframe.w3a-wallet-overlay')) as HTMLIFrameElement[];\n    const matches = existing.filter((el) => this.isOverlayForOrigin(el));\n    if (!matches.length) return;\n\n    if (this.isDevHost()) {\n      const routerIds = matches\n        .map((el) => (el as { dataset?: { w3aRouterId?: string } }).dataset?.w3aRouterId)\n        .filter((v): v is string => typeof v === 'string' && v.length > 0);\n      console.warn(\n        `[IframeTransport] Found existing wallet overlay iframe(s) for ${this.walletOrigin}. This usually indicates multiple SDK instances. Removing old iframe(s) to avoid duplicates.`,\n        { count: matches.length, routerIds }\n      );\n    }\n\n    for (const el of matches) {\n      try { el.remove(); } catch {}\n    }\n  }\n\n  /** Ensure the iframe element exists and is appended to the DOM. Idempotent. */\n  ensureIframeMounted(): HTMLIFrameElement {\n    if (this.iframeEl) {\n      return this.iframeEl;\n    }\n\n    this.removeExistingOverlaysForOrigin();\n\n    const iframe = document.createElement('iframe');\n    // Hidden by default via CSS classes; higher layers toggle state using overlay-styles.\n    iframe.classList.add('w3a-wallet-overlay', 'is-hidden');\n    // Ensure the base overlay stylesheet is installed early so computed styles\n    // (opacity/pointer-events) reflect the hidden state immediately after mount.\n    try { ensureOverlayBase(iframe); } catch {}\n    // Ensure no initial footprint even before stylesheet attaches\n    iframe.setAttribute('width', '0');\n    iframe.setAttribute('height', '0');\n    iframe.setAttribute('aria-hidden', 'true');\n    iframe.setAttribute('tabindex', '-1');\n    // Hint higher priority fetch for the iframe document on supporting browsers\n    iframe.setAttribute('loading', 'eager');\n    iframe.setAttribute('fetchpriority', 'high');\n\n    iframe.dataset.w3aRouterId = this.testOptions?.routerId || '';\n    if (this.testOptions?.ownerTag) iframe.dataset.w3aOwner = this.testOptions.ownerTag;\n    iframe.dataset.w3aOrigin = this.walletOrigin;\n\n    // Delegate WebAuthn + clipboard capabilities to the wallet origin frame\n    try {\n      iframe.setAttribute('allow', this.buildAllowAttr(this.walletOrigin));\n    } catch {\n      iframe.setAttribute('allow', \"publickey-credentials-get 'self'; publickey-credentials-create 'self'; clipboard-read; clipboard-write\");\n    }\n\n    // Track load state to guard against races where we post before content is listening\n    iframe._svc_loaded = false;\n    iframe.addEventListener('load', () => { iframe._svc_loaded = true; }, { once: true });\n\n    const src = this.walletServiceUrl.toString();\n    console.debug('[IframeTransport] mount: external origin', src);\n    iframe.src = src;\n\n    document.body.appendChild(iframe);\n    console.debug('[IframeTransport] mount: iframe appended');\n    this.iframeEl = iframe;\n    return iframe;\n  }\n\n  /**\n   * Connect to the wallet iframe using a MessageChannel handshake.\n   * - Repeatedly posts {type:'CONNECT'} with a fresh port until a 'READY' message arrives\n   * - Times out after connectTimeoutMs\n   * - Deduplicates concurrent calls and returns the same MessagePort promise\n   */\n  async connect(): Promise<MessagePort> {\n    if (this.connectInFlight) return this.connectInFlight;\n    this.connectInFlight = (async () => {\n      const iframe = this.ensureIframeMounted();\n\n      // Ensure load fired at least once so the host script can attach listeners\n      await this.waitForLoad(iframe);\n\n      // For cross-origin pages, give the host only a very brief moment to boot its script\n      // Keep this low to avoid adding noticeable latency to the first CONNECT attempt.\n      // The handshake will continue retrying regardless, so a shorter wait improves TTFB.\n      const bootWaitMs = Math.min(this.opts.connectTimeoutMs / 12, 300);\n      await this.waitForBootHint(bootWaitMs);\n\n      return this.handshake(iframe);\n    })();\n\n    try {\n      return await this.connectInFlight;\n    } finally {\n      this.connectInFlight = null;\n    }\n  }\n\n  private async waitForBootHint(timeoutMs: number): Promise<void> {\n    if (this.serviceBooted || timeoutMs <= 0) return;\n    const start = Date.now();\n    while (!this.serviceBooted && (Date.now() - start) < timeoutMs) {\n      await sleep(50);\n    }\n  }\n\n  private async handshake(iframe: HTMLIFrameElement): Promise<MessagePort> {\n    let resolved = false;\n    let attempt = 0;\n    let warnedNullOrigin = false;\n    const start = Date.now();\n    const overallTimeout = this.opts.connectTimeoutMs;\n\n    return await new Promise<MessagePort>((resolve, reject) => {\n      const tick = () => {\n        if (resolved) return;\n        const elapsed = Date.now() - start;\n        if (elapsed >= overallTimeout) {\n          resolved = true;\n          console.debug('[IframeTransport] handshake timeout after %d ms', elapsed);\n          return reject(new Error('Wallet iframe READY timeout'));\n        }\n\n        attempt += 1;\n        const channel = new MessageChannel();\n        const port1 = channel.port1;\n        const port2 = channel.port2;\n        const cleanup = () => { try { port1.onmessage = null; } catch {} };\n\n        port1.onmessage = (e: MessageEvent<ChildToParentEnvelope>) => {\n          const data = e.data;\n          if (data.type === IframeMessage.Ready) {\n            resolved = true;\n            cleanup();\n            port1.start?.();\n            return resolve(port1);\n          }\n        };\n\n        // Ensure the receiving side is actively listening before we post the CONNECT\n        try { port1.start?.(); } catch {}\n\n        const cw = iframe.contentWindow;\n        if (!cw) {\n          resolved = true;\n          cleanup();\n          return reject(new Error('Wallet iframe window missing'));\n        }\n        // Use strict origin once the host is booted; allow a short wildcard window\n        // to tolerate opaque/unstable origins and dev mismatches until READY arrives.\n        const targetOrigin = this.getConnectTargetOrigin(attempt);\n        ({ warnedNullOrigin } = this.postConnectMessage(\n          cw,\n          { type: IframeMessage.Connect },\n          port2,\n          targetOrigin,\n          warnedNullOrigin,\n          elapsed,\n          attempt,\n        ));\n\n        // Schedule next tick if not resolved yet (light backoff to reduce spam)\n        const interval = attempt < 10 ? 200 : attempt < 20 ? 400 : 800;\n        setTimeout(() => { if (!resolved) tick(); }, interval);\n      };\n\n      tick();\n    });\n  }\n\n  private getConnectTargetOrigin(attempt: number): string {\n    if (this.serviceBooted) return this.walletOrigin;\n    if (attempt <= WILDCARD_CONNECT_ATTEMPTS) return '*';\n    return this.walletOrigin;\n  }\n\n  private postConnectMessage(\n    cw: Window,\n    data: unknown,\n    port2: MessagePort,\n    targetOrigin: string,\n    warnedNullOrigin: boolean,\n    elapsed: number,\n    attempt: number,\n  ): { warnedNullOrigin: boolean } {\n    try {\n      cw.postMessage(data, targetOrigin, [port2]);\n      return { warnedNullOrigin };\n    } catch (e) {\n      const message = e instanceof Error ? e.message ?? String(e) : String(e);\n      if (!warnedNullOrigin && message.includes(\"'null'\")) {\n        warnedNullOrigin = true;\n        console.warn('[IframeTransport] CONNECT blocked; iframe origin appears to be null. Check that %s is reachable and responds with Cross-Origin-Resource-Policy: cross-origin.', this.walletServiceUrl.toString());\n      }\n      // Attempt wildcard fallback and continue retries\n      try { cw.postMessage(data, '*', [port2]); } catch {}\n      console.debug('[IframeTransport] CONNECT attempt %d threw after %d ms; retrying.', attempt, elapsed);\n      return { warnedNullOrigin };\n    }\n  }\n\n  /** Guard against posting to the iframe before it has fired load. */\n  private async waitForLoad(iframe: HTMLIFrameElement): Promise<void> {\n    if (iframe._svc_loaded) return;\n    await new Promise<void>((resolve) => {\n      let done = false;\n      const finish = () => {\n        if (done) return;\n        done = true;\n        resolve();\n      };\n      const timeout = window.setTimeout(() => {\n        if (!done && this.debug) {\n          console.debug('[IframeTransport] waitForLoad did not observe load event within 150ms; continuing');\n        }\n        finish();\n      }, 150);\n      iframe.addEventListener('load', () => {\n        clearTimeout(timeout);\n        finish();\n      }, { once: true });\n    });\n  }\n\n  private buildAllowAttr(walletOrigin: string): string {\n    return `publickey-credentials-get 'self' ${walletOrigin}; publickey-credentials-create 'self' ${walletOrigin}; clipboard-read; clipboard-write`;\n  }\n\n  private formatBridgeError(err: unknown): string {\n    return err instanceof Error ? err.message : String(err);\n  }\n\n  private postBridgeResult(\n    source: WindowProxy | null,\n    type: 'WALLET_WEBAUTHN_CREATE_RESULT' | 'WALLET_WEBAUTHN_GET_RESULT',\n    requestId: string,\n    ok: boolean,\n    payload: { credential?: unknown; error?: string },\n  ): void {\n    // Reply directly to the requesting window; wildcard target avoids transient\n    // 'null' origin warnings during early navigation while remaining safe since\n    // we already validated the sender's origin before bridging.\n    source?.postMessage({ type, requestId, ok, ...payload }, '*');\n  }\n\n  private performWebAuthnBridge(\n    kind: typeof WebAuthnBridgeMessage.Create | typeof WebAuthnBridgeMessage.Get,\n    raw: unknown,\n    e: MessageEvent,\n  ): void {\n    if (kind === WebAuthnBridgeMessage.Create) {\n      void this.handleWebAuthnCreate(raw as CreateReq, e);\n      return;\n    }\n    // kind === 'WALLET_WEBAUTHN_GET'\n    void this.handleWebAuthnGet(raw as GetReq, e);\n  }\n\n  private async handleWebAuthnCreate(req: CreateReq, e: MessageEvent): Promise<void> {\n    const requestId = req?.requestId || '';\n    if (!isObject(req?.publicKey)) {\n      this.postBridgeResult(e.source as WindowProxy | null, WebAuthnBridgeMessage.CreateResult, requestId, false, { error: 'publicKey options required' });\n      return;\n    }\n    if (!navigator.credentials?.create) {\n      this.postBridgeResult(e.source as WindowProxy | null, WebAuthnBridgeMessage.CreateResult, requestId, false, { error: 'WebAuthn create not available' });\n      return;\n    }\n    try {\n      const src = req.publicKey as PublicKeyCredentialCreationOptions;\n      const rpName = src.rp?.name || 'WebAuthn';\n      const rpId = src.rp?.id || window.location.hostname;\n      const pub: PublicKeyCredentialCreationOptions = { ...src, rp: { name: rpName, id: rpId } };\n      const cred = await navigator.credentials.create({ publicKey: pub }) as PublicKeyCredential;\n      const serialized = serializeRegistrationCredentialWithPRF({ credential: cred, firstPrfOutput: true, secondPrfOutput: true });\n      this.postBridgeResult(e.source as WindowProxy | null, WebAuthnBridgeMessage.CreateResult, requestId, true, { credential: serialized });\n    } catch (err) {\n      const message = this.formatBridgeError(err);\n      console.warn('[IframeTransport][bridge] CREATE failed', { requestId, err: message });\n      this.postBridgeResult(e.source as WindowProxy | null, WebAuthnBridgeMessage.CreateResult, requestId, false, { error: message });\n    }\n  }\n\n  private async handleWebAuthnGet(req: GetReq, e: MessageEvent): Promise<void> {\n    const requestId = req?.requestId || '';\n    if (!isObject(req?.publicKey)) {\n      this.postBridgeResult(e.source as WindowProxy | null, WebAuthnBridgeMessage.GetResult, requestId, false, { error: 'publicKey options required' });\n      return;\n    }\n    if (!navigator.credentials?.get) {\n      this.postBridgeResult(e.source as WindowProxy | null, WebAuthnBridgeMessage.GetResult, requestId, false, { error: 'WebAuthn get not available' });\n      return;\n    }\n    try {\n      const src = req.publicKey as PublicKeyCredentialRequestOptions;\n      const rpId = src.rpId || window.location.hostname;\n      const pub: PublicKeyCredentialRequestOptions = { ...src, rpId };\n      const cred = await navigator.credentials.get({ publicKey: pub }) as PublicKeyCredential;\n      const serialized = serializeAuthenticationCredentialWithPRF({ credential: cred, firstPrfOutput: true, secondPrfOutput: true });\n      this.postBridgeResult(e.source as WindowProxy | null, WebAuthnBridgeMessage.GetResult, requestId, true, { credential: serialized });\n    } catch (err) {\n      const message = this.formatBridgeError(err);\n      console.warn('[IframeTransport][bridge] GET failed', { requestId, err: message });\n      this.postBridgeResult(e.source as WindowProxy | null, WebAuthnBridgeMessage.GetResult, requestId, false, { error: message });\n    }\n  }\n}\n"],"mappings":";;;;;;AAkCA,MAAM,SAAS,OAA8B,IAAI,SAAS,YAAY,WAAW,SAAS;AAC1F,MAAM,4BAA4B;AAGlC,MAAa,gBAAgB;CAC3B,SAAS;CACT,OAAO;CACP,YAAY;CACZ,iBAAiB;CACjB,SAAS;;AAkBX,IAAa,kBAAb,MAA6B;CAC3B,AAAiB;CACjB,AAAQ,WAAqC;CAC7C,AAAQ,gBAAgB;CACxB,AAAQ,kBAA+C;CACvD,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAQ,QAAQ;CAChB,AAAiB,mBAAmB,MAA0B;EAC5D,MAAM,OAAO,EAAE;AACf,MAAI,CAAC,SAAS,MAAO;EACrB,MAAM,OAAQ,KAA4B;AAC1C,MAAI,SAAS,cAAc,iBAAiB;AAC1C,OAAI,KAAK,MACP,SAAQ,MAAM,kCAAkC;IAC9C,QAAS,KAA8B;IACvC,MAAO,KAA4B;IACnC,aAAa,EAAE;;AAGnB;;AAEF,MAAI,EAAE,WAAW,KAAK,aAAc;AACpC,MAAI,SAAS,cAAc,YAAY;AACrC,QAAK,gBAAgB;AACrB;;AAEF,MAAI,SAAS,cAAc,SAAS;AAClC,OAAI,KAAK,MACP,SAAQ,MAAM,iCAAkC,KAA+B;AAEjF;;AAEF,MAAI,SAAS,sBAAsB,UAAU,SAAS,sBAAsB,IAC1E,MAAK,sBAAsB,MAAgF,MAAM;;CAIrH,YAAY,SAAiC;AAC3C,OAAK,OAAO;GACV,aAAa;GACb,kBAAkB;GAClB,OAAO;GACP,GAAG;;AAGL,MAAI;AACF,QAAK,mBAAmB,IAAI,IAAI,KAAK,KAAK,aAAa,KAAK,KAAK;WAC1D,KAAK;AACZ,SAAM,IAAI,MAAM,4CAA4C,QAAQ,aAAa,oBAAoB,QAAQ,eAAe,kBAAkB;;AAEhJ,OAAK,eAAe,KAAK,iBAAiB;AAC1C,OAAK,cAAc;GACjB,UAAU,QAAQ,aAAa;GAC/B,UAAU,QAAQ,aAAa;;AAEjC,OAAK,QAAQ,CAAC,CAAC,KAAK,KAAK;AAIzB,MAAI,OAAO,WAAW,YACpB,QAAO,iBAAiB,WAAW,KAAK;;;CAK5C,cAAwC;AAAE,SAAO,KAAK;;;CAGtD,UAAgB;AACd,MAAI,OAAO,WAAW,YACpB,QAAO,oBAAoB,WAAW,KAAK;;CAI/C,AAAQ,YAAqB;AAC3B,MAAI,OAAO,WAAW,YAAa,QAAO;EAC1C,MAAM,MAAO,YAA2E,SAAS,KAAK;AACtG,MAAI,OAAO,QAAQ,aAAc,QAAO;EACxC,MAAM,IAAI,OAAO,SAAS,YAAY;AACtC,SAAO,mFAAmF,KAAK;;CAGjG,AAAQ,mBAAmB,IAAgC;EACzD,MAAM,WAAY,GAA4C,SAAS;AACvE,MAAI,SAAU,QAAO,aAAa,KAAK;AACvC,MAAI;AACF,UAAO,IAAI,IAAI,GAAG,KAAK,WAAW,KAAK;UACjC;AACN,UAAO;;;;;;;CAQX,AAAQ,kCAAwC;AAC9C,MAAI,OAAO,aAAa,YAAa;EACrC,MAAM,WAAW,MAAM,KAAK,SAAS,iBAAiB;EACtD,MAAM,UAAU,SAAS,QAAQ,OAAO,KAAK,mBAAmB;AAChE,MAAI,CAAC,QAAQ,OAAQ;AAErB,MAAI,KAAK,aAAa;GACpB,MAAM,YAAY,QACf,KAAK,OAAQ,GAA8C,SAAS,aACpE,QAAQ,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS;AAClE,WAAQ,KACN,iEAAiE,KAAK,aAAa,+FACnF;IAAE,OAAO,QAAQ;IAAQ;;;AAI7B,OAAK,MAAM,MAAM,QACf,KAAI;AAAE,MAAG;UAAkB;;;CAK/B,sBAAyC;AACvC,MAAI,KAAK,SACP,QAAO,KAAK;AAGd,OAAK;EAEL,MAAM,SAAS,SAAS,cAAc;AAEtC,SAAO,UAAU,IAAI,sBAAsB;AAG3C,MAAI;AAAE,qBAAkB;UAAiB;AAEzC,SAAO,aAAa,SAAS;AAC7B,SAAO,aAAa,UAAU;AAC9B,SAAO,aAAa,eAAe;AACnC,SAAO,aAAa,YAAY;AAEhC,SAAO,aAAa,WAAW;AAC/B,SAAO,aAAa,iBAAiB;AAErC,SAAO,QAAQ,cAAc,KAAK,aAAa,YAAY;AAC3D,MAAI,KAAK,aAAa,SAAU,QAAO,QAAQ,WAAW,KAAK,YAAY;AAC3E,SAAO,QAAQ,YAAY,KAAK;AAGhC,MAAI;AACF,UAAO,aAAa,SAAS,KAAK,eAAe,KAAK;UAChD;AACN,UAAO,aAAa,SAAS;;AAI/B,SAAO,cAAc;AACrB,SAAO,iBAAiB,cAAc;AAAE,UAAO,cAAc;KAAS,EAAE,MAAM;EAE9E,MAAM,MAAM,KAAK,iBAAiB;AAClC,UAAQ,MAAM,4CAA4C;AAC1D,SAAO,MAAM;AAEb,WAAS,KAAK,YAAY;AAC1B,UAAQ,MAAM;AACd,OAAK,WAAW;AAChB,SAAO;;;;;;;;CAST,MAAM,UAAgC;AACpC,MAAI,KAAK,gBAAiB,QAAO,KAAK;AACtC,OAAK,mBAAmB,YAAY;GAClC,MAAM,SAAS,KAAK;AAGpB,SAAM,KAAK,YAAY;GAKvB,MAAM,aAAa,KAAK,IAAI,KAAK,KAAK,mBAAmB,IAAI;AAC7D,SAAM,KAAK,gBAAgB;AAE3B,UAAO,KAAK,UAAU;;AAGxB,MAAI;AACF,UAAO,MAAM,KAAK;YACV;AACR,QAAK,kBAAkB;;;CAI3B,MAAc,gBAAgB,WAAkC;AAC9D,MAAI,KAAK,iBAAiB,aAAa,EAAG;EAC1C,MAAM,QAAQ,KAAK;AACnB,SAAO,CAAC,KAAK,iBAAkB,KAAK,QAAQ,QAAS,UACnD,OAAM,MAAM;;CAIhB,MAAc,UAAU,QAAiD;EACvE,IAAI,WAAW;EACf,IAAI,UAAU;EACd,IAAI,mBAAmB;EACvB,MAAM,QAAQ,KAAK;EACnB,MAAM,iBAAiB,KAAK,KAAK;AAEjC,SAAO,MAAM,IAAI,SAAsB,SAAS,WAAW;GACzD,MAAM,aAAa;AACjB,QAAI,SAAU;IACd,MAAM,UAAU,KAAK,QAAQ;AAC7B,QAAI,WAAW,gBAAgB;AAC7B,gBAAW;AACX,aAAQ,MAAM,mDAAmD;AACjE,YAAO,uBAAO,IAAI,MAAM;;AAG1B,eAAW;IACX,MAAM,UAAU,IAAI;IACpB,MAAM,QAAQ,QAAQ;IACtB,MAAM,QAAQ,QAAQ;IACtB,MAAM,gBAAgB;AAAE,SAAI;AAAE,YAAM,YAAY;aAAc;;AAE9D,UAAM,aAAa,MAA2C;KAC5D,MAAM,OAAO,EAAE;AACf,SAAI,KAAK,SAAS,cAAc,OAAO;AACrC,iBAAW;AACX;AACA,YAAM;AACN,aAAO,QAAQ;;;AAKnB,QAAI;AAAE,WAAM;YAAmB;IAE/B,MAAM,KAAK,OAAO;AAClB,QAAI,CAAC,IAAI;AACP,gBAAW;AACX;AACA,YAAO,uBAAO,IAAI,MAAM;;IAI1B,MAAM,eAAe,KAAK,uBAAuB;AACjD,KAAC,CAAE,oBAAqB,KAAK,mBAC3B,IACA,EAAE,MAAM,cAAc,WACtB,OACA,cACA,kBACA,SACA;IAIF,MAAM,WAAW,UAAU,KAAK,MAAM,UAAU,KAAK,MAAM;AAC3D,qBAAiB;AAAE,SAAI,CAAC,SAAU;OAAW;;AAG/C;;;CAIJ,AAAQ,uBAAuB,SAAyB;AACtD,MAAI,KAAK,cAAe,QAAO,KAAK;AACpC,MAAI,WAAW,0BAA2B,QAAO;AACjD,SAAO,KAAK;;CAGd,AAAQ,mBACN,IACA,MACA,OACA,cACA,kBACA,SACA,SAC+B;AAC/B,MAAI;AACF,MAAG,YAAY,MAAM,cAAc,CAAC;AACpC,UAAO,EAAE;WACF,GAAG;GACV,MAAM,UAAU,aAAa,QAAQ,EAAE,WAAW,OAAO,KAAK,OAAO;AACrE,OAAI,CAAC,oBAAoB,QAAQ,SAAS,WAAW;AACnD,uBAAmB;AACnB,YAAQ,KAAK,iKAAiK,KAAK,iBAAiB;;AAGtM,OAAI;AAAE,OAAG,YAAY,MAAM,KAAK,CAAC;WAAiB;AAClD,WAAQ,MAAM,qEAAqE,SAAS;AAC5F,UAAO,EAAE;;;;CAKb,MAAc,YAAY,QAA0C;AAClE,MAAI,OAAO,YAAa;AACxB,QAAM,IAAI,SAAe,YAAY;GACnC,IAAI,OAAO;GACX,MAAM,eAAe;AACnB,QAAI,KAAM;AACV,WAAO;AACP;;GAEF,MAAM,UAAU,OAAO,iBAAiB;AACtC,QAAI,CAAC,QAAQ,KAAK,MAChB,SAAQ,MAAM;AAEhB;MACC;AACH,UAAO,iBAAiB,cAAc;AACpC,iBAAa;AACb;MACC,EAAE,MAAM;;;CAIf,AAAQ,eAAe,cAA8B;AACnD,SAAO,oCAAoC,aAAa,wCAAwC,aAAa;;CAG/G,AAAQ,kBAAkB,KAAsB;AAC9C,SAAO,eAAe,QAAQ,IAAI,UAAU,OAAO;;CAGrD,AAAQ,iBACN,QACA,MACA,WACA,IACA,SACM;AAIN,UAAQ,YAAY;GAAE;GAAM;GAAW;GAAI,GAAG;KAAW;;CAG3D,AAAQ,sBACN,MACA,KACA,GACM;AACN,MAAI,SAAS,sBAAsB,QAAQ;AACzC,GAAK,KAAK,qBAAqB,KAAkB;AACjD;;AAGF,EAAK,KAAK,kBAAkB,KAAe;;CAG7C,MAAc,qBAAqB,KAAgB,GAAgC;EACjF,MAAM,YAAY,KAAK,aAAa;AACpC,MAAI,CAAC,SAAS,KAAK,YAAY;AAC7B,QAAK,iBAAiB,EAAE,QAA8B,sBAAsB,cAAc,WAAW,OAAO,EAAE,OAAO;AACrH;;AAEF,MAAI,CAAC,UAAU,aAAa,QAAQ;AAClC,QAAK,iBAAiB,EAAE,QAA8B,sBAAsB,cAAc,WAAW,OAAO,EAAE,OAAO;AACrH;;AAEF,MAAI;GACF,MAAM,MAAM,IAAI;GAChB,MAAM,SAAS,IAAI,IAAI,QAAQ;GAC/B,MAAM,OAAO,IAAI,IAAI,MAAM,OAAO,SAAS;GAC3C,MAAMA,MAA0C;IAAE,GAAG;IAAK,IAAI;KAAE,MAAM;KAAQ,IAAI;;;GAClF,MAAM,OAAO,MAAM,UAAU,YAAY,OAAO,EAAE,WAAW;GAC7D,MAAM,aAAa,uCAAuC;IAAE,YAAY;IAAM,gBAAgB;IAAM,iBAAiB;;AACrH,QAAK,iBAAiB,EAAE,QAA8B,sBAAsB,cAAc,WAAW,MAAM,EAAE,YAAY;WAClH,KAAK;GACZ,MAAM,UAAU,KAAK,kBAAkB;AACvC,WAAQ,KAAK,2CAA2C;IAAE;IAAW,KAAK;;AAC1E,QAAK,iBAAiB,EAAE,QAA8B,sBAAsB,cAAc,WAAW,OAAO,EAAE,OAAO;;;CAIzH,MAAc,kBAAkB,KAAa,GAAgC;EAC3E,MAAM,YAAY,KAAK,aAAa;AACpC,MAAI,CAAC,SAAS,KAAK,YAAY;AAC7B,QAAK,iBAAiB,EAAE,QAA8B,sBAAsB,WAAW,WAAW,OAAO,EAAE,OAAO;AAClH;;AAEF,MAAI,CAAC,UAAU,aAAa,KAAK;AAC/B,QAAK,iBAAiB,EAAE,QAA8B,sBAAsB,WAAW,WAAW,OAAO,EAAE,OAAO;AAClH;;AAEF,MAAI;GACF,MAAM,MAAM,IAAI;GAChB,MAAM,OAAO,IAAI,QAAQ,OAAO,SAAS;GACzC,MAAMC,MAAyC;IAAE,GAAG;IAAK;;GACzD,MAAM,OAAO,MAAM,UAAU,YAAY,IAAI,EAAE,WAAW;GAC1D,MAAM,aAAa,yCAAyC;IAAE,YAAY;IAAM,gBAAgB;IAAM,iBAAiB;;AACvH,QAAK,iBAAiB,EAAE,QAA8B,sBAAsB,WAAW,WAAW,MAAM,EAAE,YAAY;WAC/G,KAAK;GACZ,MAAM,UAAU,KAAK,kBAAkB;AACvC,WAAQ,KAAK,wCAAwC;IAAE;IAAW,KAAK;;AACvE,QAAK,iBAAiB,EAAE,QAA8B,sBAAsB,WAAW,WAAW,OAAO,EAAE,OAAO"}

package/dist/esm/react/src/core/WalletIframe/client/on-events-progress-bus.js

@@ -0,0 +1,207 @@
+import { ActionPhase, DeviceLinkingPhase, EmailRecoveryPhase, LoginPhase, RegistrationPhase, SyncAccountPhase } from "../../types/sdkSentEvents.js";
+
+//#region src/core/WalletIframe/client/on-events-progress-bus.ts
+const SHOW_PHASES = new Set([
+	ActionPhase.STEP_2_USER_CONFIRMATION,
+	ActionPhase.STEP_2_USER_CONFIRMATION,
+	ActionPhase.STEP_3_WEBAUTHN_AUTHENTICATION,
+	ActionPhase.STEP_3_WEBAUTHN_AUTHENTICATION,
+	RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,
+	EmailRecoveryPhase.STEP_2_TOUCH_ID_REGISTRATION,
+	DeviceLinkingPhase.STEP_3_AUTHORIZATION,
+	DeviceLinkingPhase.STEP_6_REGISTRATION,
+	SyncAccountPhase.STEP_2_WEBAUTHN_AUTHENTICATION,
+	LoginPhase.STEP_2_WEBAUTHN_ASSERTION
+]);
+const HIDE_PHASES = new Set([
+	ActionPhase.STEP_4_AUTHENTICATION_COMPLETE,
+	ActionPhase.STEP_5_TRANSACTION_SIGNING_PROGRESS,
+	ActionPhase.STEP_6_TRANSACTION_SIGNING_COMPLETE,
+	ActionPhase.STEP_7_BROADCASTING,
+	ActionPhase.STEP_8_ACTION_COMPLETE,
+	DeviceLinkingPhase.STEP_7_LINKING_COMPLETE,
+	DeviceLinkingPhase.REGISTRATION_ERROR,
+	DeviceLinkingPhase.LOGIN_ERROR,
+	DeviceLinkingPhase.DEVICE_LINKING_ERROR,
+	RegistrationPhase.STEP_5_CONTRACT_REGISTRATION,
+	RegistrationPhase.STEP_8_REGISTRATION_COMPLETE,
+	RegistrationPhase.REGISTRATION_ERROR,
+	LoginPhase.STEP_3_VRF_UNLOCK,
+	LoginPhase.STEP_4_LOGIN_COMPLETE,
+	LoginPhase.LOGIN_ERROR,
+	SyncAccountPhase.STEP_4_AUTHENTICATOR_SAVED,
+	SyncAccountPhase.STEP_5_SYNC_ACCOUNT_COMPLETE,
+	SyncAccountPhase.ERROR,
+	EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,
+	EmailRecoveryPhase.STEP_6_COMPLETE,
+	EmailRecoveryPhase.ERROR
+]);
+var OnEventsProgressBus = class {
+	subs = /* @__PURE__ */ new Map();
+	logger;
+	overlay;
+	heuristic;
+	overlayDemands = /* @__PURE__ */ new Map();
+	constructor(overlay, heuristic, logger) {
+		this.overlay = overlay;
+		this.heuristic = heuristic;
+		this.logger = logger;
+	}
+	/**
+	* Register a subscriber for a requestId.
+	* Initializes demand tracking to 'none' (neutral) until phases arrive.
+	*/
+	register({ requestId, onProgress, sticky = false }) {
+		this.subs.set(requestId, {
+			onProgress,
+			sticky,
+			stats: {
+				count: 0,
+				lastPhase: null,
+				lastAt: null
+			}
+		});
+		this.overlayDemands.set(requestId, "none");
+		this.log("register", {
+			requestId,
+			sticky
+		});
+	}
+	/**
+	* Unregister a subscriber and clear its overlay demand.
+	* If no remaining requests demand 'show', the overlay is hidden.
+	*/
+	unregister(requestId) {
+		if (this.subs.delete(requestId)) this.log("unregister", { requestId });
+		this.overlayDemands.delete(requestId);
+		if (!this.wantsVisible()) try {
+			this.overlay.hide();
+		} catch {}
+	}
+	/**
+	* Remove all subscribers and demands; overlay demand set is cleared.
+	*/
+	clearAll() {
+		this.subs.clear();
+		this.overlayDemands.clear();
+		this.log("clearAll");
+	}
+	isSticky(requestId) {
+		const sub = this.subs.get(requestId);
+		return !!sub?.sticky;
+	}
+	/**
+	* Dispatch a progress payload to a request's subscriber and update
+	* the aggregate overlay demand based on the phase heuristic.
+	*/
+	dispatch({ requestId, payload }) {
+		const phase = String((payload || {}).phase || "");
+		const action = this.heuristic(payload);
+		this.overlayDemands.set(requestId, action);
+		if (action === "show") try {
+			this.overlay.show();
+		} catch {}
+		else if (action === "hide") {
+			if (!this.wantsVisible()) try {
+				this.overlay.hide();
+			} catch {}
+		}
+		const sub = this.subs.get(requestId);
+		if (sub) {
+			this.bumpStats(sub, phase);
+			try {
+				sub.onProgress?.(payload);
+			} catch {}
+			this.log("dispatch", {
+				requestId,
+				phase,
+				sticky: sub.sticky
+			});
+			return true;
+		}
+		const sticky = this.findSticky(requestId);
+		if (sticky) {
+			this.bumpStats(sticky, phase);
+			try {
+				sticky.onProgress?.(payload);
+			} catch {}
+			this.log("dispatch-sticky", {
+				requestId,
+				phase
+			});
+			return true;
+		}
+		this.log("dispatch-miss", {
+			requestId,
+			phase
+		});
+		return false;
+	}
+	getStats(requestId) {
+		const sub = this.subs.get(requestId);
+		return sub ? sub.stats : null;
+	}
+	/**
+	* Returns true if any tracked request currently demands the overlay be visible.
+	* Useful for higher layers (router) to avoid premature hides on completion/timeout.
+	*/
+	wantsVisible() {
+		for (const v of this.overlayDemands.values()) if (v === "show") return true;
+		return false;
+	}
+	findSticky(requestId) {
+		const sub = this.subs.get(requestId);
+		if (sub && sub.sticky) return sub;
+		return null;
+	}
+	bumpStats(sub, phase) {
+		sub.stats.count += 1;
+		sub.stats.lastPhase = phase || null;
+		sub.stats.lastAt = Date.now();
+	}
+	log(msg, data) {
+		try {
+			this.logger?.(msg, data);
+		} catch {}
+	}
+};
+/**
+* defaultPhaseHeuristics
+*
+* Decides when to expand or contract the invisible wallet iframe overlay
+* based on incoming progress events (phases). Returning:
+*  - 'show' → expands the iframe to a full-screen, invisible layer that captures
+*             user activation (e.g., TouchID / WebAuthn prompts) and pointer events.
+*  - 'hide' → immediately contracts the iframe back to 0×0 so it no longer blocks clicks.
+*  - 'none' → no change.
+*
+* Important UX constraint: the overlay covers the entire viewport and is
+* intentionally invisible. While expanded, it will intercept clicks and can
+* block interactions with the app. Therefore, we must minimize the time it is
+* expanded and only show it during the brief windows where user activation is
+* required (e.g., when the TouchID prompt is about to appear or the modal is
+* mounting and needs focus/activation in the iframe context). As soon as
+* activation completes (e.g., authentication-complete), we hide it again.
+*
+* If new phases are introduced that require user activation, add them to
+* SHOW_PHASES; if phases become non-interactive post-activation, add them to
+* HIDE_PHASES. The goal is to keep the overlay up for the minimum possible time.
+*/
+const defaultPhaseHeuristics = (payload) => {
+	try {
+		const phase = String((payload || {}).phase || "");
+		if (!phase) return "none";
+		if (SHOW_PHASES.has(phase)) return "show";
+		if (HIDE_PHASES.has(phase)) return "hide";
+		const raw = phase.toLowerCase();
+		if (raw === "user-confirmation-complete") return "hide";
+		if (raw === "cancelled") return "hide";
+		return "none";
+	} catch {
+		return "none";
+	}
+};
+
+//#endregion
+export { OnEventsProgressBus, defaultPhaseHeuristics };
+//# sourceMappingURL=on-events-progress-bus.js.map

package/dist/esm/react/src/core/WalletIframe/client/on-events-progress-bus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"on-events-progress-bus.js","names":["DelegateActionPhase","defaultPhaseHeuristics: PhaseHeuristics"],"sources":["../../../../../../../src/core/WalletIframe/client/on-events-progress-bus.ts"],"sourcesContent":["/**\n * OnEventsProgressBus - Client-Side Communication Layer\n *\n * Manages progress event routing and overlay visibility *intents* for the wallet\n * iframe. It never manipulates the iframe directly; instead it calls the\n * injected OverlayController interface (show/hide), and WalletIframeRouter\n * owns the concrete OverlayController that knows how to display the iframe.\n *\n * Key Responsibilities:\n * - Progress Routing: Dispatches typed progress payloads to per-request subscribers\n * - Overlay Intents: Applies SHOW/HIDE based on phase heuristics, leaving actual\n *   DOM/CSS work to WalletIframeRouter + OverlayController\n * - Concurrent Aggregation: Tracks overlay demand per requestId and only hides\n *   when no request still requires SHOW (multi-request safe)\n * - Sticky Subscriptions: Supports long-running subscriptions that persist after completion\n * - Phase Heuristics: Pluggable logic to map phases → 'show' | 'hide' | 'none'\n * - Event Statistics: Tracks counts/timestamps for debugging\n */\n\nimport type { ProgressPayload as MessageProgressPayload } from '../shared/messages';\nimport {\n  ActionPhase,\n  DeviceLinkingPhase,\n  SyncAccountPhase,\n  RegistrationPhase,\n  LoginPhase,\n  EmailRecoveryPhase,\n  DelegateActionPhase,\n} from '../../types/sdkSentEvents';\n\n// Phases that should temporarily SHOW the overlay (to capture activation)\n// IMPORTANT: STEP_2_USER_CONFIRMATION must remain in this list. Without it,\n// modal confirmation with behavior: 'requireClick' will never be visible in\n// iframe mode, because the wallet iframe is still 0×0 when the modal mounts.\nconst SHOW_PHASES = new Set<string>([\n  // Gate overlay to moments of imminent activation only.\n  // Show early during user confirmation so the modal inside the wallet iframe is visible\n  // and can capture the required click when behavior === 'requireClick'.\n  ActionPhase.STEP_2_USER_CONFIRMATION,\n  DelegateActionPhase.STEP_2_USER_CONFIRMATION,\n  ActionPhase.STEP_3_WEBAUTHN_AUTHENTICATION,\n  DelegateActionPhase.STEP_3_WEBAUTHN_AUTHENTICATION,\n  // Registration requires a WebAuthn create() ceremony at step 1\n  RegistrationPhase.STEP_1_WEBAUTHN_VERIFICATION,\n  // Email recovery: TouchID registration uses WebAuthn create()\n  EmailRecoveryPhase.STEP_2_TOUCH_ID_REGISTRATION,\n  // Device1: TouchID authorization (host needs overlay to capture activation)\n  DeviceLinkingPhase.STEP_3_AUTHORIZATION,\n  // Device2: Registration inside wallet host (collects passkey via ModalTxConfirmer)\n  // Show overlay so the wallet iframe is visible and focused for WebAuthn\n  DeviceLinkingPhase.STEP_6_REGISTRATION,\n  SyncAccountPhase.STEP_2_WEBAUTHN_AUTHENTICATION,\n  LoginPhase.STEP_2_WEBAUTHN_ASSERTION,\n]);\n\n// Phases that should HIDE the overlay asap (post-activation, non-interactive)\nconst HIDE_PHASES = new Set<string>([\n  ActionPhase.STEP_4_AUTHENTICATION_COMPLETE,\n  ActionPhase.STEP_5_TRANSACTION_SIGNING_PROGRESS,\n  ActionPhase.STEP_6_TRANSACTION_SIGNING_COMPLETE,\n  ActionPhase.STEP_7_BROADCASTING,\n  ActionPhase.STEP_8_ACTION_COMPLETE,\n  // Device linking: hide when the flow has finished or errored\n  DeviceLinkingPhase.STEP_7_LINKING_COMPLETE,\n  DeviceLinkingPhase.REGISTRATION_ERROR,\n  DeviceLinkingPhase.LOGIN_ERROR,\n  DeviceLinkingPhase.DEVICE_LINKING_ERROR,\n  // Registration: hide once contract work starts or flow completes/errors\n  RegistrationPhase.STEP_5_CONTRACT_REGISTRATION,\n  RegistrationPhase.STEP_8_REGISTRATION_COMPLETE,\n  RegistrationPhase.REGISTRATION_ERROR,\n  // Login: hide after assertion leads to VRF unlock or completion/errors\n  LoginPhase.STEP_3_VRF_UNLOCK,\n  LoginPhase.STEP_4_LOGIN_COMPLETE,\n  LoginPhase.LOGIN_ERROR,\n  // Account sync: hide after authentication completes or on completion/errors\n  SyncAccountPhase.STEP_4_AUTHENTICATOR_SAVED,\n  SyncAccountPhase.STEP_5_SYNC_ACCOUNT_COMPLETE,\n  SyncAccountPhase.ERROR,\n  // Email recovery: hide after finalization/complete or on error\n  EmailRecoveryPhase.STEP_5_FINALIZING_REGISTRATION,\n  EmailRecoveryPhase.STEP_6_COMPLETE,\n  EmailRecoveryPhase.ERROR,\n]);\n\nexport type ProgressPayload = MessageProgressPayload;\n\n// Minimal overlay control interface used by ProgressBus.\n// Implemented by WalletIframeRouter via an adapter object that calls\n// into the concrete OverlayToggler (fullscreen/anchored) as needed.\nexport interface OverlayToggler {\n  show: () => void;\n  hide: () => void;\n}\n\nexport type PhaseHeuristics = (payload: ProgressPayload) => 'show' | 'hide' | 'none';\n\nexport interface ProgressSubscriber {\n  onProgress?: (payload: ProgressPayload) => void;\n  sticky: boolean;\n  stats: { count: number; lastPhase: string | null; lastAt: number | null };\n}\n\nexport class OnEventsProgressBus {\n  private subs = new Map<string, ProgressSubscriber>();\n  private logger?: (msg: string, data?: Record<string, unknown>) => void;\n  private overlay: OverlayToggler;\n  private heuristic: PhaseHeuristics;\n  // Track the most recent overlay intent per requestId so that we can\n  // aggregate visibility across concurrent requests. If any request's\n  // latest intent is 'show', we keep the overlay visible.\n  private overlayDemands = new Map<string, 'show' | 'hide' | 'none'>();\n\n  constructor(overlay: OverlayToggler, heuristic: PhaseHeuristics, logger?: (msg: string, data?: Record<string, unknown>) => void) {\n    this.overlay = overlay;\n    this.heuristic = heuristic;\n    this.logger = logger;\n  }\n\n  /**\n   * Register a subscriber for a requestId.\n   * Initializes demand tracking to 'none' (neutral) until phases arrive.\n   */\n  register({ requestId, onProgress, sticky = false }: {\n    requestId: string,\n    sticky: boolean,\n    onProgress?: (p: ProgressPayload) => void,\n  }): void {\n    this.subs.set(requestId, {\n      onProgress,\n      sticky,\n      stats: { count: 0, lastPhase: null, lastAt: null }\n    });\n    // Initialize demand tracking for this request as neutral\n    this.overlayDemands.set(requestId, 'none');\n    this.log('register', { requestId, sticky });\n  }\n\n  /**\n   * Unregister a subscriber and clear its overlay demand.\n   * If no remaining requests demand 'show', the overlay is hidden.\n   */\n  unregister(requestId: string): void {\n    if (this.subs.delete(requestId)) this.log('unregister', { requestId });\n    // Remove any overlay demand for this request\n    this.overlayDemands.delete(requestId);\n    // If no remaining requests demand 'show', we can safely hide\n    if (!this.wantsVisible()) {\n      try { this.overlay.hide(); } catch {}\n    }\n  }\n\n  /**\n   * Remove all subscribers and demands; overlay demand set is cleared.\n   */\n  clearAll(): void {\n    this.subs.clear();\n    this.overlayDemands.clear();\n    this.log('clearAll');\n  }\n\n  isSticky(requestId: string): boolean {\n    const sub = this.subs.get(requestId);\n    return !!sub?.sticky;\n  }\n\n  /**\n   * Dispatch a progress payload to a request's subscriber and update\n   * the aggregate overlay demand based on the phase heuristic.\n   */\n  dispatch({ requestId, payload }: {\n    requestId: string,\n    payload: ProgressPayload\n  }): boolean {\n\n    const phase = String((payload || {}).phase || '');\n    const action = this.heuristic(payload);\n\n    // Update the latest demand for this request\n    this.overlayDemands.set(requestId, action);\n\n    // Apply aggregated overlay visibility:\n    // - If any request currently demands 'show', ensure overlay is visible\n    // - Only hide when no outstanding 'show' demands remain\n    if (action === 'show') {\n      try { this.overlay.show(); } catch {}\n    } else if (action === 'hide') {\n      if (!this.wantsVisible()) {\n        try { this.overlay.hide(); } catch {}\n      }\n    }\n\n    const sub = this.subs.get(requestId);\n    if (sub) {\n      this.bumpStats(sub, phase);\n      try { sub.onProgress?.(payload); } catch {}\n      this.log('dispatch', { requestId, phase, sticky: sub.sticky });\n      return true;\n    }\n\n    // Deliver to sticky-only subscriber if present (e.g., flow finished but status updates continue)\n    const sticky = this.findSticky(requestId);\n    if (sticky) {\n      this.bumpStats(sticky, phase);\n      try { sticky.onProgress?.(payload); } catch {}\n      this.log('dispatch-sticky', { requestId, phase });\n      return true;\n    }\n    this.log('dispatch-miss', { requestId, phase });\n    return false;\n  }\n\n  getStats(requestId: string): {\n    count: number;\n    lastPhase: string | null;\n    lastAt: number | null\n  } | null {\n    const sub = this.subs.get(requestId);\n    return sub ? sub.stats : null;\n  }\n\n  /**\n   * Returns true if any tracked request currently demands the overlay be visible.\n   * Useful for higher layers (router) to avoid premature hides on completion/timeout.\n   */\n  wantsVisible(): boolean {\n    for (const v of this.overlayDemands.values()) {\n      if (v === 'show') return true;\n    }\n    return false;\n  }\n\n  private findSticky(requestId: string): ProgressSubscriber | null {\n    const sub = this.subs.get(requestId);\n    if (sub && sub.sticky) return sub;\n    // sticky subscribers are keyed by the same requestId in this design\n    return null;\n  }\n\n  private bumpStats(sub: ProgressSubscriber, phase: string) {\n    sub.stats.count += 1;\n    sub.stats.lastPhase = phase || null;\n    sub.stats.lastAt = Date.now();\n  }\n\n  private log(msg: string, data?: Record<string, unknown>) {\n    try { this.logger?.(msg, data); } catch {}\n  }\n}\n\n// Default phase heuristic used by the client\n/**\n * defaultPhaseHeuristics\n *\n * Decides when to expand or contract the invisible wallet iframe overlay\n * based on incoming progress events (phases). Returning:\n *  - 'show' → expands the iframe to a full-screen, invisible layer that captures\n *             user activation (e.g., TouchID / WebAuthn prompts) and pointer events.\n *  - 'hide' → immediately contracts the iframe back to 0×0 so it no longer blocks clicks.\n *  - 'none' → no change.\n *\n * Important UX constraint: the overlay covers the entire viewport and is\n * intentionally invisible. While expanded, it will intercept clicks and can\n * block interactions with the app. Therefore, we must minimize the time it is\n * expanded and only show it during the brief windows where user activation is\n * required (e.g., when the TouchID prompt is about to appear or the modal is\n * mounting and needs focus/activation in the iframe context). As soon as\n * activation completes (e.g., authentication-complete), we hide it again.\n *\n * If new phases are introduced that require user activation, add them to\n * SHOW_PHASES; if phases become non-interactive post-activation, add them to\n * HIDE_PHASES. The goal is to keep the overlay up for the minimum possible time.\n */\nexport const defaultPhaseHeuristics: PhaseHeuristics = (payload: ProgressPayload) => {\n  try {\n    const phase = String((payload || {}).phase || '');\n    if (!phase) return 'none';\n\n    // Step 1: Check if this phase requires showing the overlay for user activation\n    if (SHOW_PHASES.has(phase)) return 'show';\n\n    // Step 2: Check if this phase indicates we should hide the overlay (post-activation)\n    if (HIDE_PHASES.has(phase)) return 'hide';\n\n    // Step 3: Handle legacy/custom completion markers\n    const raw = phase.toLowerCase();\n    if (raw === 'user-confirmation-complete') return 'hide';\n\n    // Step 4: Extra hardening - hide overlay on explicit cancellation\n    if (raw === 'cancelled') return 'hide';\n\n    // Step 5: Default to no change for unknown phases\n    return 'none';\n  } catch { return 'none'; }\n};\n"],"mappings":";;;AAkCA,MAAM,cAAc,IAAI,IAAY;CAIlC,YAAY;CACZA,YAAoB;CACpB,YAAY;CACZA,YAAoB;CAEpB,kBAAkB;CAElB,mBAAmB;CAEnB,mBAAmB;CAGnB,mBAAmB;CACnB,iBAAiB;CACjB,WAAW;;AAIb,MAAM,cAAc,IAAI,IAAY;CAClC,YAAY;CACZ,YAAY;CACZ,YAAY;CACZ,YAAY;CACZ,YAAY;CAEZ,mBAAmB;CACnB,mBAAmB;CACnB,mBAAmB;CACnB,mBAAmB;CAEnB,kBAAkB;CAClB,kBAAkB;CAClB,kBAAkB;CAElB,WAAW;CACX,WAAW;CACX,WAAW;CAEX,iBAAiB;CACjB,iBAAiB;CACjB,iBAAiB;CAEjB,mBAAmB;CACnB,mBAAmB;CACnB,mBAAmB;;AAqBrB,IAAa,sBAAb,MAAiC;CAC/B,AAAQ,uBAAO,IAAI;CACnB,AAAQ;CACR,AAAQ;CACR,AAAQ;CAIR,AAAQ,iCAAiB,IAAI;CAE7B,YAAY,SAAyB,WAA4B,QAAgE;AAC/H,OAAK,UAAU;AACf,OAAK,YAAY;AACjB,OAAK,SAAS;;;;;;CAOhB,SAAS,EAAE,WAAW,YAAY,SAAS,SAIlC;AACP,OAAK,KAAK,IAAI,WAAW;GACvB;GACA;GACA,OAAO;IAAE,OAAO;IAAG,WAAW;IAAM,QAAQ;;;AAG9C,OAAK,eAAe,IAAI,WAAW;AACnC,OAAK,IAAI,YAAY;GAAE;GAAW;;;;;;;CAOpC,WAAW,WAAyB;AAClC,MAAI,KAAK,KAAK,OAAO,WAAY,MAAK,IAAI,cAAc,EAAE;AAE1D,OAAK,eAAe,OAAO;AAE3B,MAAI,CAAC,KAAK,eACR,KAAI;AAAE,QAAK,QAAQ;UAAgB;;;;;CAOvC,WAAiB;AACf,OAAK,KAAK;AACV,OAAK,eAAe;AACpB,OAAK,IAAI;;CAGX,SAAS,WAA4B;EACnC,MAAM,MAAM,KAAK,KAAK,IAAI;AAC1B,SAAO,CAAC,CAAC,KAAK;;;;;;CAOhB,SAAS,EAAE,WAAW,WAGV;EAEV,MAAM,QAAQ,QAAQ,WAAW,IAAI,SAAS;EAC9C,MAAM,SAAS,KAAK,UAAU;AAG9B,OAAK,eAAe,IAAI,WAAW;AAKnC,MAAI,WAAW,OACb,KAAI;AAAE,QAAK,QAAQ;UAAgB;WAC1B,WAAW,QACpB;OAAI,CAAC,KAAK,eACR,KAAI;AAAE,SAAK,QAAQ;WAAgB;;EAIvC,MAAM,MAAM,KAAK,KAAK,IAAI;AAC1B,MAAI,KAAK;AACP,QAAK,UAAU,KAAK;AACpB,OAAI;AAAE,QAAI,aAAa;WAAkB;AACzC,QAAK,IAAI,YAAY;IAAE;IAAW;IAAO,QAAQ,IAAI;;AACrD,UAAO;;EAIT,MAAM,SAAS,KAAK,WAAW;AAC/B,MAAI,QAAQ;AACV,QAAK,UAAU,QAAQ;AACvB,OAAI;AAAE,WAAO,aAAa;WAAkB;AAC5C,QAAK,IAAI,mBAAmB;IAAE;IAAW;;AACzC,UAAO;;AAET,OAAK,IAAI,iBAAiB;GAAE;GAAW;;AACvC,SAAO;;CAGT,SAAS,WAIA;EACP,MAAM,MAAM,KAAK,KAAK,IAAI;AAC1B,SAAO,MAAM,IAAI,QAAQ;;;;;;CAO3B,eAAwB;AACtB,OAAK,MAAM,KAAK,KAAK,eAAe,SAClC,KAAI,MAAM,OAAQ,QAAO;AAE3B,SAAO;;CAGT,AAAQ,WAAW,WAA8C;EAC/D,MAAM,MAAM,KAAK,KAAK,IAAI;AAC1B,MAAI,OAAO,IAAI,OAAQ,QAAO;AAE9B,SAAO;;CAGT,AAAQ,UAAU,KAAyB,OAAe;AACxD,MAAI,MAAM,SAAS;AACnB,MAAI,MAAM,YAAY,SAAS;AAC/B,MAAI,MAAM,SAAS,KAAK;;CAG1B,AAAQ,IAAI,KAAa,MAAgC;AACvD,MAAI;AAAE,QAAK,SAAS,KAAK;UAAe;;;;;;;;;;;;;;;;;;;;;;;;;AA2B5C,MAAaC,0BAA2C,YAA6B;AACnF,KAAI;EACF,MAAM,QAAQ,QAAQ,WAAW,IAAI,SAAS;AAC9C,MAAI,CAAC,MAAO,QAAO;AAGnB,MAAI,YAAY,IAAI,OAAQ,QAAO;AAGnC,MAAI,YAAY,IAAI,OAAQ,QAAO;EAGnC,MAAM,MAAM,MAAM;AAClB,MAAI,QAAQ,6BAA8B,QAAO;AAGjD,MAAI,QAAQ,YAAa,QAAO;AAGhC,SAAO;SACD;AAAE,SAAO"}