@tatchi-xyz/sdk 0.21.0 → 0.31.0

package/dist/esm/server/core/ThresholdService/validation.js

@@ -0,0 +1,544 @@
+import { ensureEd25519Prefix, toOptionalString, toTrimmedString } from "../../sdk/src/utils/validation.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../sdk/src/utils/digests.js";
+import { THRESHOLD_ED25519_2P_PARTICIPANT_IDS } from "../../sdk/src/core/defaultConfigs.js";
+import { normalizeThresholdEd25519ParticipantIds } from "../../sdk/src/threshold/participants.js";
+
+//#region src/server/core/ThresholdService/validation.ts
+function isObject(v) {
+	return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function isValidNumber(v) {
+	return typeof v === "number" && Number.isFinite(v);
+}
+function toPrefixWithColon(prefix, defaultPrefix) {
+	const p = toOptionalString(prefix);
+	if (!p) return defaultPrefix;
+	return p.endsWith(":") ? p : `${p}:`;
+}
+function toThresholdEd25519KeyPrefix(prefix) {
+	return toPrefixWithColon(prefix, "w3a:threshold-ed25519:key:");
+}
+function toThresholdEd25519SessionPrefix(prefix) {
+	return toPrefixWithColon(prefix, "w3a:threshold-ed25519:sess:");
+}
+function toThresholdEd25519AuthPrefix(prefix) {
+	return toPrefixWithColon(prefix, "w3a:threshold-ed25519:auth:");
+}
+function parseThresholdEd25519KeyRecord(raw) {
+	if (!isObject(raw)) return null;
+	const publicKey = toOptionalString(raw.publicKey);
+	const relayerSigningShareB64u = toOptionalString(raw.relayerSigningShareB64u);
+	const relayerVerifyingShareB64u = toOptionalString(raw.relayerVerifyingShareB64u);
+	if (!publicKey || !relayerSigningShareB64u || !relayerVerifyingShareB64u) return null;
+	return {
+		publicKey,
+		relayerSigningShareB64u,
+		relayerVerifyingShareB64u
+	};
+}
+function parseThresholdEd25519Commitments(raw) {
+	if (!isObject(raw)) return null;
+	const hiding = toOptionalString(raw.hiding);
+	const binding = toOptionalString(raw.binding);
+	if (!hiding || !binding) return null;
+	return {
+		hiding,
+		binding
+	};
+}
+function parseThresholdEd25519CommitmentsById(raw) {
+	if (!isObject(raw)) return null;
+	const out = {};
+	for (const [k, v] of Object.entries(raw)) {
+		const key = toTrimmedString(k);
+		if (!key) return null;
+		const commitments = parseThresholdEd25519Commitments(v);
+		if (!commitments) return null;
+		out[key] = commitments;
+	}
+	return Object.keys(out).length ? out : null;
+}
+function parseThresholdEd25519MpcSessionRecord(raw) {
+	if (!isObject(raw)) return null;
+	const expiresAtMs = raw.expiresAtMs;
+	const relayerKeyId = toOptionalString(raw.relayerKeyId);
+	const purpose = toOptionalString(raw.purpose);
+	const intentDigestB64u = toOptionalString(raw.intentDigestB64u);
+	const signingDigestB64u = toOptionalString(raw.signingDigestB64u);
+	const userId = toOptionalString(raw.userId);
+	const rpId = toOptionalString(raw.rpId);
+	const clientVerifyingShareB64u = toOptionalString(raw.clientVerifyingShareB64u);
+	const participantIds = normalizeThresholdEd25519ParticipantIds(raw.participantIds) || [...THRESHOLD_ED25519_2P_PARTICIPANT_IDS];
+	if (!isValidNumber(expiresAtMs)) return null;
+	if (!relayerKeyId || !purpose || !intentDigestB64u || !signingDigestB64u || !userId || !rpId || !clientVerifyingShareB64u) return null;
+	return {
+		expiresAtMs,
+		relayerKeyId,
+		purpose,
+		intentDigestB64u,
+		signingDigestB64u,
+		userId,
+		rpId,
+		clientVerifyingShareB64u,
+		participantIds
+	};
+}
+function parseThresholdEd25519SigningSessionRecord(raw) {
+	if (!isObject(raw)) return null;
+	const expiresAtMs = raw.expiresAtMs;
+	const mpcSessionId = toOptionalString(raw.mpcSessionId);
+	const relayerKeyId = toOptionalString(raw.relayerKeyId);
+	const signingDigestB64u = toOptionalString(raw.signingDigestB64u);
+	const userId = toOptionalString(raw.userId);
+	const rpId = toOptionalString(raw.rpId);
+	const clientVerifyingShareB64u = toOptionalString(raw.clientVerifyingShareB64u);
+	const commitmentsById = parseThresholdEd25519CommitmentsById(raw.commitmentsById);
+	const relayerSigningShareB64u = toOptionalString(raw.relayerSigningShareB64u);
+	const relayerNoncesB64u = toOptionalString(raw.relayerNoncesB64u);
+	const participantIds = normalizeThresholdEd25519ParticipantIds(raw.participantIds) || [...THRESHOLD_ED25519_2P_PARTICIPANT_IDS];
+	if (!isValidNumber(expiresAtMs)) return null;
+	if (!mpcSessionId || !relayerKeyId || !signingDigestB64u || !userId || !rpId || !clientVerifyingShareB64u || !commitmentsById || !relayerNoncesB64u) return null;
+	return {
+		expiresAtMs,
+		mpcSessionId,
+		relayerKeyId,
+		signingDigestB64u,
+		userId,
+		rpId,
+		clientVerifyingShareB64u,
+		commitmentsById,
+		...relayerSigningShareB64u ? { relayerSigningShareB64u } : {},
+		relayerNoncesB64u,
+		participantIds
+	};
+}
+function parseThresholdEd25519StringById(raw) {
+	if (!isObject(raw)) return null;
+	const out = {};
+	for (const [k, v] of Object.entries(raw)) {
+		const key = toTrimmedString(k);
+		const value = toOptionalString(v);
+		if (!key || !value) return null;
+		out[key] = value;
+	}
+	return Object.keys(out).length ? out : null;
+}
+function parseThresholdEd25519CoordinatorSigningSessionRecord(raw) {
+	if (!isObject(raw)) return null;
+	const expiresAtMs = raw.expiresAtMs;
+	const mpcSessionId = toOptionalString(raw.mpcSessionId);
+	const relayerKeyId = toOptionalString(raw.relayerKeyId);
+	const signingDigestB64u = toOptionalString(raw.signingDigestB64u);
+	const userId = toOptionalString(raw.userId);
+	const rpId = toOptionalString(raw.rpId);
+	const clientVerifyingShareB64u = toOptionalString(raw.clientVerifyingShareB64u);
+	const commitmentsById = parseThresholdEd25519CommitmentsById(raw.commitmentsById);
+	const participantIds = normalizeThresholdEd25519ParticipantIds(raw.participantIds) || [...THRESHOLD_ED25519_2P_PARTICIPANT_IDS];
+	const relayerVerifyingSharesById = parseThresholdEd25519StringById(raw.relayerVerifyingSharesById);
+	if (!isValidNumber(expiresAtMs)) return null;
+	if (!mpcSessionId || !relayerKeyId || !signingDigestB64u || !userId || !rpId || !clientVerifyingShareB64u || !commitmentsById || !relayerVerifyingSharesById) return null;
+	const mode = toOptionalString(raw.mode);
+	if (mode !== "cosigner") return null;
+	const groupPublicKey = toOptionalString(raw.groupPublicKey);
+	const cosignerIds = normalizeThresholdEd25519ParticipantIds(raw.cosignerIds);
+	const cosignerRelayerUrlsById = parseThresholdEd25519StringById(raw.cosignerRelayerUrlsById);
+	const cosignerCoordinatorGrantsById = parseThresholdEd25519StringById(raw.cosignerCoordinatorGrantsById);
+	if (!groupPublicKey || !cosignerIds || !cosignerRelayerUrlsById || !cosignerCoordinatorGrantsById) return null;
+	return {
+		mode: "cosigner",
+		expiresAtMs,
+		mpcSessionId,
+		relayerKeyId,
+		signingDigestB64u,
+		userId,
+		rpId,
+		clientVerifyingShareB64u,
+		commitmentsById,
+		participantIds,
+		groupPublicKey,
+		cosignerIds,
+		cosignerRelayerUrlsById,
+		cosignerCoordinatorGrantsById,
+		relayerVerifyingSharesById
+	};
+}
+function parseThresholdEd25519AuthSessionRecord(raw) {
+	if (!isObject(raw)) return null;
+	const expiresAtMs = raw.expiresAtMs;
+	const relayerKeyId = toOptionalString(raw.relayerKeyId);
+	const userId = toOptionalString(raw.userId);
+	const rpId = toOptionalString(raw.rpId);
+	const participantIds = normalizeThresholdEd25519ParticipantIds(raw.participantIds) || [...THRESHOLD_ED25519_2P_PARTICIPANT_IDS];
+	if (!isValidNumber(expiresAtMs)) return null;
+	if (!relayerKeyId || !userId || !rpId) return null;
+	return {
+		expiresAtMs,
+		relayerKeyId,
+		userId,
+		rpId,
+		participantIds
+	};
+}
+function normalizeByteArray32(input) {
+	if (input instanceof Uint8Array) return input.length === 32 ? input : null;
+	if (!Array.isArray(input) || input.length !== 32) return null;
+	const out = new Uint8Array(32);
+	for (let i = 0; i < 32; i++) {
+		const v = Number(input[i]);
+		if (!Number.isFinite(v) || v < 0 || v > 255) return null;
+		out[i] = v;
+	}
+	return out;
+}
+function bytesEqual32(a, b) {
+	if (a.length !== 32 || b.length !== 32) return false;
+	for (let i = 0; i < 32; i++) if (a[i] !== b[i]) return false;
+	return true;
+}
+function toNearPublicKeyStr(v) {
+	return ensureEd25519Prefix(toOptionalString(v));
+}
+function normalizeActionForIntentDigest(a) {
+	if (!isObject(a)) return { action_type: "" };
+	const actionType = toOptionalString(a.action_type);
+	switch (actionType) {
+		case "FunctionCall": return {
+			action_type: actionType,
+			args: toOptionalString(a.args),
+			deposit: toOptionalString(a.deposit),
+			gas: toOptionalString(a.gas),
+			method_name: toOptionalString(a.method_name)
+		};
+		case "Transfer": return {
+			action_type: actionType,
+			deposit: toOptionalString(a.deposit)
+		};
+		case "Stake": return {
+			action_type: actionType,
+			stake: toOptionalString(a.stake),
+			public_key: toOptionalString(a.public_key)
+		};
+		case "AddKey": return {
+			action_type: actionType,
+			public_key: toOptionalString(a.public_key),
+			access_key: toOptionalString(a.access_key)
+		};
+		case "DeleteKey": return {
+			action_type: actionType,
+			public_key: toOptionalString(a.public_key)
+		};
+		case "DeleteAccount": return {
+			action_type: actionType,
+			beneficiary_id: toOptionalString(a.beneficiary_id)
+		};
+		case "DeployContract": return {
+			action_type: actionType,
+			code: Array.isArray(a.code) ? a.code : []
+		};
+		case "DeployGlobalContract": return {
+			action_type: actionType,
+			code: Array.isArray(a.code) ? a.code : [],
+			deploy_mode: toOptionalString(a.deploy_mode)
+		};
+		case "UseGlobalContract": return {
+			action_type: actionType,
+			account_id: toOptionalString(a.account_id) || void 0,
+			code_hash: toOptionalString(a.code_hash) || void 0
+		};
+		case "CreateAccount":
+		case "SignedDelegate":
+		default: return { action_type: actionType };
+	}
+}
+function extractAuthorizeSigningPublicKey(purpose, signingPayload) {
+	if (!isObject(signingPayload)) return "";
+	if (purpose === "near_tx") {
+		const ctx = isObject(signingPayload.transactionContext) ? signingPayload.transactionContext : null;
+		return toNearPublicKeyStr(ctx?.nearPublicKeyStr);
+	}
+	if (purpose === "nep461_delegate") {
+		const delegate = isObject(signingPayload.delegate) ? signingPayload.delegate : null;
+		return toNearPublicKeyStr(delegate?.publicKey);
+	}
+	return "";
+}
+async function ensureRelayerKeyIsActiveAccessKey(input) {
+	const nearAccountId = toOptionalString(input.nearAccountId);
+	const relayerPublicKey = toNearPublicKeyStr(input.relayerPublicKey);
+	const expectedSigningPublicKey = toNearPublicKeyStr(input.expectedSigningPublicKey);
+	if (!nearAccountId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "nearAccountId is required"
+	};
+	if (!relayerPublicKey) return {
+		ok: false,
+		code: "internal",
+		message: "Missing relayer public key for relayerKeyId"
+	};
+	if (expectedSigningPublicKey && expectedSigningPublicKey !== relayerPublicKey) return {
+		ok: false,
+		code: "unauthorized",
+		message: "relayerKeyId does not match signingPayload public key"
+	};
+	try {
+		const list = await input.viewAccessKeyList(nearAccountId);
+		const keys = list.keys || [];
+		const found = keys.some((k) => toNearPublicKeyStr(k.public_key) === relayerPublicKey);
+		if (!found) return {
+			ok: false,
+			code: "unauthorized",
+			message: "relayerKeyId public key is not an active access key for nearAccountId"
+		};
+		return { ok: true };
+	} catch (e) {
+		const msg = String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to query NEAR access keys");
+		return {
+			ok: false,
+			code: "internal",
+			message: `Failed to verify access key scope: ${msg}`
+		};
+	}
+}
+async function verifyThresholdEd25519AuthorizeSigningPayload(input) {
+	const purpose = input.purpose;
+	const signingPayload = input.signingPayload;
+	if (!isObject(signingPayload)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signingPayload (object) is required for threshold authorization"
+	};
+	const kind = toOptionalString(signingPayload.kind);
+	const expectedKind = purpose;
+	if (kind && kind !== expectedKind) return {
+		ok: false,
+		code: "invalid_body",
+		message: `signingPayload.kind must match purpose (${expectedKind})`
+	};
+	let intentDigest32Computed;
+	try {
+		if (purpose === "near_tx") {
+			const payload = signingPayload;
+			const txs = payload.txSigningRequests;
+			if (!Array.isArray(txs) || !txs.length) throw new Error("signingPayload.txSigningRequests is required");
+			const nearAccountId = toOptionalString(txs[0]?.nearAccountId);
+			if (!nearAccountId) throw new Error("txSigningRequests[0].nearAccountId is required");
+			for (const tx of txs) if (toOptionalString(tx?.nearAccountId) !== nearAccountId) throw new Error("All txSigningRequests[].nearAccountId must match");
+			if (nearAccountId !== input.userId) throw new Error("txSigningRequests[].nearAccountId must match vrf_data.user_id");
+			const txInputs = txs.map((tx) => ({
+				receiverId: toOptionalString(tx?.receiverId),
+				actions: Array.isArray(tx?.actions) ? tx.actions.map((a) => normalizeActionForIntentDigest(a)) : []
+			}));
+			const json = alphabetizeStringify(txInputs);
+			intentDigest32Computed = await sha256BytesUtf8(json);
+		} else if (purpose === "nep461_delegate") {
+			const payload = signingPayload;
+			const d = payload.delegate;
+			if (!isObject(d)) throw new Error("signingPayload.delegate is required");
+			const senderId = toOptionalString(d.senderId);
+			if (!senderId) throw new Error("delegate.senderId is required");
+			if (senderId !== input.userId) throw new Error("delegate.senderId must match vrf_data.user_id");
+			const txInputs = [{
+				receiverId: toOptionalString(d.receiverId),
+				actions: Array.isArray(d.actions) ? d.actions.map((a) => normalizeActionForIntentDigest(a)) : []
+			}];
+			const json = alphabetizeStringify(txInputs);
+			intentDigest32Computed = await sha256BytesUtf8(json);
+		} else if (purpose === "nep413") {
+			const payload = signingPayload;
+			const nearAccountId = toOptionalString(payload.nearAccountId);
+			if (!nearAccountId) throw new Error("signingPayload.nearAccountId is required");
+			if (nearAccountId !== input.userId) throw new Error("signingPayload.nearAccountId must match vrf_data.user_id");
+			const recipient = toOptionalString(payload.recipient);
+			const message = toOptionalString(payload.message);
+			const json = alphabetizeStringify({
+				kind: "nep413",
+				nearAccountId,
+				recipient,
+				message
+			});
+			intentDigest32Computed = await sha256BytesUtf8(json);
+		} else throw new Error(`Unsupported purpose: ${purpose}`);
+	} catch (e) {
+		const msg = String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to recompute intent digest");
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: msg
+		};
+	}
+	if (intentDigest32Computed.length !== 32) return {
+		ok: false,
+		code: "internal",
+		message: `Computed intent digest is not 32 bytes (got ${intentDigest32Computed.length})`
+	};
+	if (!bytesEqual32(intentDigest32Computed, input.intentDigest32)) return {
+		ok: false,
+		code: "intent_digest_mismatch",
+		message: "signingPayload does not match vrf_data.intent_digest_32"
+	};
+	let signingDigest32Computed;
+	try {
+		await input.ensureSignerWasm();
+		signingDigest32Computed = (() => {
+			if (purpose === "near_tx") {
+				const digestsUnknown = input.computeNearTxSigningDigests(signingPayload);
+				if (!Array.isArray(digestsUnknown)) throw new Error("near_tx digest recomputation failed");
+				return digestsUnknown.map((d, i) => {
+					const bytes = normalizeByteArray32(d);
+					if (!bytes) throw new Error(`near_tx digest[${i}] is not 32 bytes`);
+					return bytes;
+				});
+			}
+			if (purpose === "nep461_delegate") {
+				const digestUnknown = input.computeDelegateSigningDigest(signingPayload);
+				const bytes = normalizeByteArray32(digestUnknown);
+				if (!bytes) throw new Error("nep461_delegate digest is not 32 bytes");
+				return [bytes];
+			}
+			if (purpose === "nep413") {
+				const digestUnknown = input.computeNep413SigningDigest(signingPayload);
+				const bytes = normalizeByteArray32(digestUnknown);
+				if (!bytes) throw new Error("nep413 digest is not 32 bytes");
+				return [bytes];
+			}
+			throw new Error(`Unsupported purpose: ${purpose}`);
+		})();
+	} catch (e) {
+		const msg = String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to recompute signing digest");
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: msg
+		};
+	}
+	const match = signingDigest32Computed.some((d) => bytesEqual32(d, input.signingDigest32));
+	if (!match) return {
+		ok: false,
+		code: "signing_digest_mismatch",
+		message: "signingPayload does not match signing_digest_32"
+	};
+	return { ok: true };
+}
+async function verifyThresholdEd25519AuthorizeSigningPayloadSigningDigestOnly(input) {
+	const purpose = input.purpose;
+	const signingPayload = input.signingPayload;
+	if (!isObject(signingPayload)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signingPayload (object) is required for threshold authorization"
+	};
+	const kind = toOptionalString(signingPayload.kind);
+	const expectedKind = purpose;
+	if (kind && kind !== expectedKind) return {
+		ok: false,
+		code: "invalid_body",
+		message: `signingPayload.kind must match purpose (${expectedKind})`
+	};
+	let intentDigest32Computed;
+	try {
+		if (purpose === "near_tx") {
+			const payload = signingPayload;
+			const txs = payload.txSigningRequests;
+			if (!Array.isArray(txs) || !txs.length) throw new Error("signingPayload.txSigningRequests is required");
+			const nearAccountId = toOptionalString(txs[0]?.nearAccountId);
+			if (!nearAccountId) throw new Error("txSigningRequests[0].nearAccountId is required");
+			for (const tx of txs) if (toOptionalString(tx?.nearAccountId) !== nearAccountId) throw new Error("All txSigningRequests[].nearAccountId must match");
+			if (nearAccountId !== input.userId) throw new Error("txSigningRequests[].nearAccountId must match session user");
+			const txInputs = txs.map((tx) => ({
+				receiverId: toOptionalString(tx?.receiverId),
+				actions: Array.isArray(tx?.actions) ? tx.actions.map((a) => normalizeActionForIntentDigest(a)) : []
+			}));
+			const json = alphabetizeStringify(txInputs);
+			intentDigest32Computed = await sha256BytesUtf8(json);
+		} else if (purpose === "nep461_delegate") {
+			const payload = signingPayload;
+			const d = payload.delegate;
+			if (!isObject(d)) throw new Error("signingPayload.delegate is required");
+			const senderId = toOptionalString(d.senderId);
+			if (!senderId) throw new Error("delegate.senderId is required");
+			if (senderId !== input.userId) throw new Error("delegate.senderId must match session user");
+			const txInputs = [{
+				receiverId: toOptionalString(d.receiverId),
+				actions: Array.isArray(d.actions) ? d.actions.map((a) => normalizeActionForIntentDigest(a)) : []
+			}];
+			const json = alphabetizeStringify(txInputs);
+			intentDigest32Computed = await sha256BytesUtf8(json);
+		} else if (purpose === "nep413") {
+			const payload = signingPayload;
+			const nearAccountId = toOptionalString(payload.nearAccountId);
+			if (!nearAccountId) throw new Error("signingPayload.nearAccountId is required");
+			if (nearAccountId !== input.userId) throw new Error("signingPayload.nearAccountId must match session user");
+			const recipient = toOptionalString(payload.recipient);
+			const message = toOptionalString(payload.message);
+			const json = alphabetizeStringify({
+				kind: "nep413",
+				nearAccountId,
+				recipient,
+				message
+			});
+			intentDigest32Computed = await sha256BytesUtf8(json);
+		} else throw new Error(`Unsupported purpose: ${purpose}`);
+	} catch (e) {
+		const msg = String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to recompute intent digest");
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: msg
+		};
+	}
+	if (intentDigest32Computed.length !== 32) return {
+		ok: false,
+		code: "internal",
+		message: `Computed intent digest is not 32 bytes (got ${intentDigest32Computed.length})`
+	};
+	let signingDigest32Computed;
+	try {
+		await input.ensureSignerWasm();
+		signingDigest32Computed = (() => {
+			if (purpose === "near_tx") {
+				const digestsUnknown = input.computeNearTxSigningDigests(signingPayload);
+				if (!Array.isArray(digestsUnknown)) throw new Error("near_tx digest recomputation failed");
+				return digestsUnknown.map((d, i) => {
+					const bytes = normalizeByteArray32(d);
+					if (!bytes) throw new Error(`near_tx digest[${i}] is not 32 bytes`);
+					return bytes;
+				});
+			}
+			if (purpose === "nep461_delegate") {
+				const digestUnknown = input.computeDelegateSigningDigest(signingPayload);
+				const bytes = normalizeByteArray32(digestUnknown);
+				if (!bytes) throw new Error("nep461_delegate digest is not 32 bytes");
+				return [bytes];
+			}
+			if (purpose === "nep413") {
+				const digestUnknown = input.computeNep413SigningDigest(signingPayload);
+				const bytes = normalizeByteArray32(digestUnknown);
+				if (!bytes) throw new Error("nep413 digest is not 32 bytes");
+				return [bytes];
+			}
+			throw new Error(`Unsupported purpose: ${purpose}`);
+		})();
+	} catch (e) {
+		const msg = String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to recompute signing digest");
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: msg
+		};
+	}
+	const match = signingDigest32Computed.some((d) => bytesEqual32(d, input.signingDigest32));
+	if (!match) return {
+		ok: false,
+		code: "signing_digest_mismatch",
+		message: "signingPayload does not match signing_digest_32"
+	};
+	return {
+		ok: true,
+		intentDigest32: intentDigest32Computed
+	};
+}
+
+//#endregion
+export { bytesEqual32, ensureRelayerKeyIsActiveAccessKey, extractAuthorizeSigningPublicKey, isObject, normalizeByteArray32, parseThresholdEd25519AuthSessionRecord, parseThresholdEd25519CoordinatorSigningSessionRecord, parseThresholdEd25519KeyRecord, parseThresholdEd25519MpcSessionRecord, parseThresholdEd25519SigningSessionRecord, toThresholdEd25519AuthPrefix, toThresholdEd25519KeyPrefix, toThresholdEd25519SessionPrefix, verifyThresholdEd25519AuthorizeSigningPayload, verifyThresholdEd25519AuthorizeSigningPayloadSigningDigestOnly };
+//# sourceMappingURL=validation.js.map

package/dist/esm/server/core/ThresholdService/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","names":["out: ParsedThresholdEd25519CommitmentsById","out: ParsedThresholdEd25519StringById","e: unknown","intentDigest32Computed: Uint8Array","signingDigest32Computed: Uint8Array[]","digestsUnknown: unknown","digestUnknown: unknown"],"sources":["../../../../../src/server/core/ThresholdService/validation.ts"],"sourcesContent":["import type { AccessKeyList } from '../../../core/NearClient';\nimport { alphabetizeStringify, sha256BytesUtf8 } from '../../../utils/digests';\nimport { ensureEd25519Prefix, toOptionalString, toTrimmedString } from '../../../utils/validation';\nimport {\n  THRESHOLD_ED25519_2P_PARTICIPANT_IDS,\n  normalizeThresholdEd25519ParticipantIds,\n} from '../../../threshold/participants';\n\nexport type ThresholdValidationOk = { ok: true };\nexport type ThresholdValidationErr = { ok: false; code: string; message: string };\nexport type ThresholdValidationResult = ThresholdValidationOk | ThresholdValidationErr;\n\nexport function isObject(v: unknown): v is Record<string, unknown> {\n  return !!v && typeof v === 'object' && !Array.isArray(v);\n}\n\nexport function isValidNumber(v: unknown): v is number {\n  return typeof v === 'number' && Number.isFinite(v);\n}\n\nexport function toPrefixWithColon(prefix: unknown, defaultPrefix: string): string {\n  const p = toOptionalString(prefix);\n  if (!p) return defaultPrefix;\n  return p.endsWith(':') ? p : `${p}:`;\n}\n\nexport function toThresholdEd25519KeyPrefix(prefix: unknown): string {\n  return toPrefixWithColon(prefix, 'w3a:threshold-ed25519:key:');\n}\n\nexport function toThresholdEd25519SessionPrefix(prefix: unknown): string {\n  return toPrefixWithColon(prefix, 'w3a:threshold-ed25519:sess:');\n}\n\nexport function toThresholdEd25519AuthPrefix(prefix: unknown): string {\n  return toPrefixWithColon(prefix, 'w3a:threshold-ed25519:auth:');\n}\n\nexport type ParsedThresholdEd25519KeyRecord = {\n  publicKey: string;\n  relayerSigningShareB64u: string;\n  relayerVerifyingShareB64u: string;\n};\n\nexport function parseThresholdEd25519KeyRecord(raw: unknown): ParsedThresholdEd25519KeyRecord | null {\n  if (!isObject(raw)) return null;\n  const publicKey = toOptionalString(raw.publicKey);\n  const relayerSigningShareB64u = toOptionalString(raw.relayerSigningShareB64u);\n  const relayerVerifyingShareB64u = toOptionalString(raw.relayerVerifyingShareB64u);\n  if (!publicKey || !relayerSigningShareB64u || !relayerVerifyingShareB64u) return null;\n  return { publicKey, relayerSigningShareB64u, relayerVerifyingShareB64u };\n}\n\nexport type ParsedThresholdEd25519Commitments = { hiding: string; binding: string };\n\nexport function parseThresholdEd25519Commitments(raw: unknown): ParsedThresholdEd25519Commitments | null {\n  if (!isObject(raw)) return null;\n  const hiding = toOptionalString(raw.hiding);\n  const binding = toOptionalString(raw.binding);\n  if (!hiding || !binding) return null;\n  return { hiding, binding };\n}\n\nexport type ParsedThresholdEd25519CommitmentsById = Record<string, ParsedThresholdEd25519Commitments>;\n\nexport function parseThresholdEd25519CommitmentsById(raw: unknown): ParsedThresholdEd25519CommitmentsById | null {\n  if (!isObject(raw)) return null;\n  const out: ParsedThresholdEd25519CommitmentsById = {};\n  for (const [k, v] of Object.entries(raw)) {\n    const key = toTrimmedString(k);\n    if (!key) return null;\n    const commitments = parseThresholdEd25519Commitments(v);\n    if (!commitments) return null;\n    out[key] = commitments;\n  }\n  return Object.keys(out).length ? out : null;\n}\n\nexport type ParsedThresholdEd25519MpcSessionRecord = {\n  expiresAtMs: number;\n  relayerKeyId: string;\n  purpose: string;\n  intentDigestB64u: string;\n  signingDigestB64u: string;\n  userId: string;\n  rpId: string;\n  clientVerifyingShareB64u: string;\n  participantIds: number[];\n};\n\nexport function parseThresholdEd25519MpcSessionRecord(raw: unknown): ParsedThresholdEd25519MpcSessionRecord | null {\n  if (!isObject(raw)) return null;\n  const expiresAtMs = raw.expiresAtMs;\n  const relayerKeyId = toOptionalString(raw.relayerKeyId);\n  const purpose = toOptionalString(raw.purpose);\n  const intentDigestB64u = toOptionalString(raw.intentDigestB64u);\n  const signingDigestB64u = toOptionalString(raw.signingDigestB64u);\n  const userId = toOptionalString(raw.userId);\n  const rpId = toOptionalString(raw.rpId);\n  const clientVerifyingShareB64u = toOptionalString(raw.clientVerifyingShareB64u);\n  const participantIds = normalizeThresholdEd25519ParticipantIds(raw.participantIds)\n    || [...THRESHOLD_ED25519_2P_PARTICIPANT_IDS];\n  if (!isValidNumber(expiresAtMs)) return null;\n  if (\n    !relayerKeyId ||\n    !purpose ||\n    !intentDigestB64u ||\n    !signingDigestB64u ||\n    !userId ||\n    !rpId ||\n    !clientVerifyingShareB64u\n  ) return null;\n  return {\n    expiresAtMs,\n    relayerKeyId,\n    purpose,\n    intentDigestB64u,\n    signingDigestB64u,\n    userId,\n    rpId,\n    clientVerifyingShareB64u,\n    participantIds,\n  };\n}\n\nexport type ParsedThresholdEd25519SigningSessionRecord = {\n  expiresAtMs: number;\n  mpcSessionId: string;\n  relayerKeyId: string;\n  signingDigestB64u: string;\n  userId: string;\n  rpId: string;\n  clientVerifyingShareB64u: string;\n  commitmentsById: ParsedThresholdEd25519CommitmentsById;\n  relayerSigningShareB64u?: string;\n  relayerNoncesB64u: string;\n  participantIds: number[];\n};\n\nexport function parseThresholdEd25519SigningSessionRecord(raw: unknown): ParsedThresholdEd25519SigningSessionRecord | null {\n  if (!isObject(raw)) return null;\n  const expiresAtMs = raw.expiresAtMs;\n  const mpcSessionId = toOptionalString(raw.mpcSessionId);\n  const relayerKeyId = toOptionalString(raw.relayerKeyId);\n  const signingDigestB64u = toOptionalString(raw.signingDigestB64u);\n  const userId = toOptionalString(raw.userId);\n  const rpId = toOptionalString(raw.rpId);\n  const clientVerifyingShareB64u = toOptionalString(raw.clientVerifyingShareB64u);\n  const commitmentsById = parseThresholdEd25519CommitmentsById(raw.commitmentsById);\n  const relayerSigningShareB64u = toOptionalString(raw.relayerSigningShareB64u);\n  const relayerNoncesB64u = toOptionalString(raw.relayerNoncesB64u);\n  const participantIds =\n    normalizeThresholdEd25519ParticipantIds(raw.participantIds)\n    || [...THRESHOLD_ED25519_2P_PARTICIPANT_IDS];\n  if (!isValidNumber(expiresAtMs)) return null;\n  if (\n    !mpcSessionId ||\n    !relayerKeyId ||\n    !signingDigestB64u ||\n    !userId ||\n    !rpId ||\n    !clientVerifyingShareB64u ||\n    !commitmentsById ||\n    !relayerNoncesB64u\n  ) {\n    return null;\n  }\n  return {\n    expiresAtMs,\n    mpcSessionId,\n    relayerKeyId,\n    signingDigestB64u,\n    userId,\n    rpId,\n    clientVerifyingShareB64u,\n    commitmentsById,\n    ...(relayerSigningShareB64u ? { relayerSigningShareB64u } : {}),\n    relayerNoncesB64u,\n    participantIds,\n  };\n}\n\nexport type ParsedThresholdEd25519StringById = Record<string, string>;\n\nexport function parseThresholdEd25519StringById(raw: unknown): ParsedThresholdEd25519StringById | null {\n  if (!isObject(raw)) return null;\n  const out: ParsedThresholdEd25519StringById = {};\n  for (const [k, v] of Object.entries(raw)) {\n    const key = toTrimmedString(k);\n    const value = toOptionalString(v);\n    if (!key || !value) return null;\n    out[key] = value;\n  }\n  return Object.keys(out).length ? out : null;\n}\n\nexport type ParsedThresholdEd25519CoordinatorSigningSessionRecord =\n  {\n    mode: 'cosigner';\n    expiresAtMs: number;\n    mpcSessionId: string;\n    relayerKeyId: string;\n    signingDigestB64u: string;\n    userId: string;\n    rpId: string;\n    clientVerifyingShareB64u: string;\n    commitmentsById: ParsedThresholdEd25519CommitmentsById;\n    participantIds: number[];\n    groupPublicKey: string;\n    cosignerIds: number[];\n    cosignerRelayerUrlsById: ParsedThresholdEd25519StringById;\n    cosignerCoordinatorGrantsById: ParsedThresholdEd25519StringById;\n    relayerVerifyingSharesById: ParsedThresholdEd25519StringById;\n  };\n\nexport function parseThresholdEd25519CoordinatorSigningSessionRecord(raw: unknown): ParsedThresholdEd25519CoordinatorSigningSessionRecord | null {\n  if (!isObject(raw)) return null;\n  const expiresAtMs = raw.expiresAtMs;\n  const mpcSessionId = toOptionalString(raw.mpcSessionId);\n  const relayerKeyId = toOptionalString(raw.relayerKeyId);\n  const signingDigestB64u = toOptionalString(raw.signingDigestB64u);\n  const userId = toOptionalString(raw.userId);\n  const rpId = toOptionalString(raw.rpId);\n  const clientVerifyingShareB64u = toOptionalString(raw.clientVerifyingShareB64u);\n  const commitmentsById = parseThresholdEd25519CommitmentsById(raw.commitmentsById);\n  const participantIds =\n    normalizeThresholdEd25519ParticipantIds(raw.participantIds)\n    || [...THRESHOLD_ED25519_2P_PARTICIPANT_IDS];\n  const relayerVerifyingSharesById = parseThresholdEd25519StringById(raw.relayerVerifyingSharesById);\n\n  if (!isValidNumber(expiresAtMs)) return null;\n  if (\n    !mpcSessionId ||\n    !relayerKeyId ||\n    !signingDigestB64u ||\n    !userId ||\n    !rpId ||\n    !clientVerifyingShareB64u ||\n    !commitmentsById ||\n    !relayerVerifyingSharesById\n  ) {\n    return null;\n  }\n\n  const mode = toOptionalString(raw.mode);\n  if (mode !== 'cosigner') return null;\n\n  const groupPublicKey = toOptionalString(raw.groupPublicKey);\n  const cosignerIds = normalizeThresholdEd25519ParticipantIds(raw.cosignerIds);\n  const cosignerRelayerUrlsById = parseThresholdEd25519StringById(raw.cosignerRelayerUrlsById);\n  const cosignerCoordinatorGrantsById = parseThresholdEd25519StringById(raw.cosignerCoordinatorGrantsById);\n  if (!groupPublicKey || !cosignerIds || !cosignerRelayerUrlsById || !cosignerCoordinatorGrantsById) return null;\n  return {\n    mode: 'cosigner',\n    expiresAtMs,\n    mpcSessionId,\n    relayerKeyId,\n    signingDigestB64u,\n    userId,\n    rpId,\n    clientVerifyingShareB64u,\n    commitmentsById,\n    participantIds,\n    groupPublicKey,\n    cosignerIds,\n    cosignerRelayerUrlsById,\n    cosignerCoordinatorGrantsById,\n    relayerVerifyingSharesById,\n  };\n}\n\nexport type ParsedThresholdEd25519AuthSessionRecord = {\n  expiresAtMs: number;\n  relayerKeyId: string;\n  userId: string;\n  rpId: string;\n  participantIds: number[];\n};\n\nexport function parseThresholdEd25519AuthSessionRecord(raw: unknown): ParsedThresholdEd25519AuthSessionRecord | null {\n  if (!isObject(raw)) return null;\n  const expiresAtMs = raw.expiresAtMs;\n  const relayerKeyId = toOptionalString(raw.relayerKeyId);\n  const userId = toOptionalString(raw.userId);\n  const rpId = toOptionalString(raw.rpId);\n  const participantIds =\n    normalizeThresholdEd25519ParticipantIds(raw.participantIds)\n    || [...THRESHOLD_ED25519_2P_PARTICIPANT_IDS];\n  if (!isValidNumber(expiresAtMs)) return null;\n  if (!relayerKeyId || !userId || !rpId) return null;\n  return { expiresAtMs, relayerKeyId, userId, rpId, participantIds };\n}\n\nexport type ThresholdEd25519SessionClaims = {\n  sub: string;\n  kind: 'threshold_ed25519_session_v1';\n  sessionId: string;\n  relayerKeyId: string;\n  rpId: string;\n};\n\nexport function parseThresholdEd25519SessionClaims(raw: unknown): ThresholdEd25519SessionClaims | null {\n  if (!isObject(raw)) return null;\n  const kind = toOptionalString(raw.kind);\n  if (kind !== 'threshold_ed25519_session_v1') return null;\n  const sub = toOptionalString(raw.sub);\n  const sessionId = toOptionalString(raw.sessionId);\n  const relayerKeyId = toOptionalString(raw.relayerKeyId);\n  const rpId = toOptionalString(raw.rpId);\n  if (!sub || !sessionId || !relayerKeyId || !rpId) return null;\n  return { sub, kind, sessionId, relayerKeyId, rpId };\n}\n\nexport function normalizeByteArray32(input: unknown): Uint8Array | null {\n  if (input instanceof Uint8Array) {\n    return input.length === 32 ? input : null;\n  }\n  if (!Array.isArray(input) || input.length !== 32) return null;\n  const out = new Uint8Array(32);\n  for (let i = 0; i < 32; i++) {\n    const v = Number(input[i]);\n    if (!Number.isFinite(v) || v < 0 || v > 255) return null;\n    out[i] = v;\n  }\n  return out;\n}\n\nexport function bytesEqual32(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== 32 || b.length !== 32) return false;\n  for (let i = 0; i < 32; i++) {\n    if (a[i] !== b[i]) return false;\n  }\n  return true;\n}\n\nexport function toNearPublicKeyStr(v: unknown): string {\n  return ensureEd25519Prefix(toOptionalString(v));\n}\n\nexport function normalizeActionForIntentDigest(a: unknown): Record<string, unknown> {\n  if (!isObject(a)) return { action_type: '' };\n  const actionType = toOptionalString(a.action_type);\n  switch (actionType) {\n    case 'FunctionCall':\n      return {\n        action_type: actionType,\n        args: toOptionalString(a.args),\n        deposit: toOptionalString(a.deposit),\n        gas: toOptionalString(a.gas),\n        method_name: toOptionalString(a.method_name),\n      };\n    case 'Transfer':\n      return { action_type: actionType, deposit: toOptionalString(a.deposit) };\n    case 'Stake':\n      return { action_type: actionType, stake: toOptionalString(a.stake), public_key: toOptionalString(a.public_key) };\n    case 'AddKey':\n      return { action_type: actionType, public_key: toOptionalString(a.public_key), access_key: toOptionalString(a.access_key) };\n    case 'DeleteKey':\n      return { action_type: actionType, public_key: toOptionalString(a.public_key) };\n    case 'DeleteAccount':\n      return { action_type: actionType, beneficiary_id: toOptionalString(a.beneficiary_id) };\n    case 'DeployContract':\n      return { action_type: actionType, code: Array.isArray(a.code) ? a.code : [] };\n    case 'DeployGlobalContract':\n      return {\n        action_type: actionType,\n        code: Array.isArray(a.code) ? a.code : [],\n        deploy_mode: toOptionalString(a.deploy_mode),\n      };\n    case 'UseGlobalContract':\n      return {\n        action_type: actionType,\n        account_id: toOptionalString(a.account_id) || undefined,\n        code_hash: toOptionalString(a.code_hash) || undefined,\n      };\n    case 'CreateAccount':\n    case 'SignedDelegate':\n    default:\n      return { action_type: actionType };\n  }\n}\n\nexport function extractAuthorizeSigningPublicKey(purpose: string, signingPayload: unknown): string {\n  if (!isObject(signingPayload)) return '';\n  if (purpose === 'near_tx') {\n    const ctx = isObject(signingPayload.transactionContext) ? signingPayload.transactionContext : null;\n    return toNearPublicKeyStr(ctx?.nearPublicKeyStr);\n  }\n  if (purpose === 'nep461_delegate') {\n    const delegate = isObject(signingPayload.delegate) ? signingPayload.delegate : null;\n    return toNearPublicKeyStr(delegate?.publicKey);\n  }\n  return '';\n}\n\nexport async function ensureRelayerKeyIsActiveAccessKey(input: {\n  nearAccountId: unknown;\n  relayerPublicKey: unknown;\n  expectedSigningPublicKey?: unknown;\n  viewAccessKeyList: (accountId: string) => Promise<AccessKeyList>;\n}): Promise<ThresholdValidationResult> {\n  const nearAccountId = toOptionalString(input.nearAccountId);\n  const relayerPublicKey = toNearPublicKeyStr(input.relayerPublicKey);\n  const expectedSigningPublicKey = toNearPublicKeyStr(input.expectedSigningPublicKey);\n  if (!nearAccountId) return { ok: false, code: 'invalid_body', message: 'nearAccountId is required' };\n  if (!relayerPublicKey) return { ok: false, code: 'internal', message: 'Missing relayer public key for relayerKeyId' };\n\n  if (expectedSigningPublicKey && expectedSigningPublicKey !== relayerPublicKey) {\n    return { ok: false, code: 'unauthorized', message: 'relayerKeyId does not match signingPayload public key' };\n  }\n\n  try {\n    const list = await input.viewAccessKeyList(nearAccountId);\n    const keys = list.keys || [];\n    const found = keys.some((k) => toNearPublicKeyStr(k.public_key) === relayerPublicKey);\n    if (!found) {\n      return { ok: false, code: 'unauthorized', message: 'relayerKeyId public key is not an active access key for nearAccountId' };\n    }\n    return { ok: true };\n  } catch (e: unknown) {\n    const msg = String((e && typeof e === 'object' && 'message' in e) ? (e as { message?: unknown }).message : e || 'Failed to query NEAR access keys');\n    return { ok: false, code: 'internal', message: `Failed to verify access key scope: ${msg}` };\n  }\n}\n\ntype NearTxAuthorizeSigningPayload = {\n  kind?: string;\n  txSigningRequests: Array<{\n    nearAccountId: string;\n    receiverId: string;\n    actions: unknown[];\n  }>;\n  transactionContext: {\n    nearPublicKeyStr: string;\n    nextNonce: string;\n    txBlockHash: string;\n    txBlockHeight?: string;\n  };\n};\n\ntype Nep461DelegateAuthorizeSigningPayload = {\n  kind?: string;\n  delegate: {\n    senderId: string;\n    receiverId: string;\n    actions: unknown[];\n    nonce: string;\n    maxBlockHeight: string;\n    publicKey: string;\n  };\n};\n\ntype Nep413AuthorizeSigningPayload = {\n  kind?: string;\n  nearAccountId: string;\n  message: string;\n  recipient: string;\n  nonce: string;\n  state?: string;\n};\n\nexport async function verifyThresholdEd25519AuthorizeSigningPayload(input: {\n  purpose: string;\n  signingPayload: unknown;\n  signingDigest32: Uint8Array;\n  intentDigest32: Uint8Array;\n  userId: string;\n  ensureSignerWasm: () => Promise<void>;\n  computeNearTxSigningDigests: (payload: unknown) => unknown;\n  computeDelegateSigningDigest: (payload: unknown) => unknown;\n  computeNep413SigningDigest: (payload: unknown) => unknown;\n}): Promise<ThresholdValidationResult> {\n  const purpose = input.purpose;\n  const signingPayload = input.signingPayload;\n  if (!isObject(signingPayload)) {\n    return { ok: false, code: 'invalid_body', message: 'signingPayload (object) is required for threshold authorization' };\n  }\n\n  const kind = toOptionalString(signingPayload.kind);\n  const expectedKind = purpose;\n  if (kind && kind !== expectedKind) {\n    return { ok: false, code: 'invalid_body', message: `signingPayload.kind must match purpose (${expectedKind})` };\n  }\n\n  // 1) Recompute intent_digest_32 from signingPayload and compare to VRF-bound digest.\n  let intentDigest32Computed: Uint8Array;\n  try {\n    if (purpose === 'near_tx') {\n      const payload = signingPayload as Partial<NearTxAuthorizeSigningPayload>;\n      const txs = payload.txSigningRequests;\n      if (!Array.isArray(txs) || !txs.length) throw new Error('signingPayload.txSigningRequests is required');\n      const nearAccountId = toOptionalString(txs[0]?.nearAccountId);\n      if (!nearAccountId) throw new Error('txSigningRequests[0].nearAccountId is required');\n      for (const tx of txs) {\n        if (toOptionalString(tx?.nearAccountId) !== nearAccountId) {\n          throw new Error('All txSigningRequests[].nearAccountId must match');\n        }\n      }\n      if (nearAccountId !== input.userId) throw new Error('txSigningRequests[].nearAccountId must match vrf_data.user_id');\n      const txInputs = txs.map((tx) => ({\n        receiverId: toOptionalString(tx?.receiverId),\n        actions: Array.isArray(tx?.actions) ? tx.actions.map((a) => normalizeActionForIntentDigest(a)) : [],\n      }));\n      const json = alphabetizeStringify(txInputs);\n      intentDigest32Computed = await sha256BytesUtf8(json);\n    } else if (purpose === 'nep461_delegate') {\n      const payload = signingPayload as Partial<Nep461DelegateAuthorizeSigningPayload>;\n      const d = payload.delegate;\n      if (!isObject(d)) throw new Error('signingPayload.delegate is required');\n      const senderId = toOptionalString(d.senderId);\n      if (!senderId) throw new Error('delegate.senderId is required');\n      if (senderId !== input.userId) throw new Error('delegate.senderId must match vrf_data.user_id');\n      const txInputs = [{\n        receiverId: toOptionalString(d.receiverId),\n        actions: Array.isArray(d.actions) ? d.actions.map((a) => normalizeActionForIntentDigest(a)) : [],\n      }];\n      const json = alphabetizeStringify(txInputs);\n      intentDigest32Computed = await sha256BytesUtf8(json);\n    } else if (purpose === 'nep413') {\n      const payload = signingPayload as Partial<Nep413AuthorizeSigningPayload>;\n      const nearAccountId = toOptionalString(payload.nearAccountId);\n      if (!nearAccountId) throw new Error('signingPayload.nearAccountId is required');\n      if (nearAccountId !== input.userId) throw new Error('signingPayload.nearAccountId must match vrf_data.user_id');\n      const recipient = toOptionalString(payload.recipient);\n      const message = toOptionalString(payload.message);\n      const json = alphabetizeStringify({ kind: 'nep413', nearAccountId, recipient, message });\n      intentDigest32Computed = await sha256BytesUtf8(json);\n    } else {\n      throw new Error(`Unsupported purpose: ${purpose}`);\n    }\n  } catch (e: unknown) {\n    const msg = String((e && typeof e === 'object' && 'message' in e) ? (e as { message?: unknown }).message : e || 'Failed to recompute intent digest');\n    return { ok: false, code: 'invalid_body', message: msg };\n  }\n\n  if (intentDigest32Computed.length !== 32) {\n    return { ok: false, code: 'internal', message: `Computed intent digest is not 32 bytes (got ${intentDigest32Computed.length})` };\n  }\n  if (!bytesEqual32(intentDigest32Computed, input.intentDigest32)) {\n    return { ok: false, code: 'intent_digest_mismatch', message: 'signingPayload does not match vrf_data.intent_digest_32' };\n  }\n\n  // 2) Recompute signing_digest_32 from signingPayload and compare to requested signing digest.\n  let signingDigest32Computed: Uint8Array[];\n  try {\n    await input.ensureSignerWasm();\n    signingDigest32Computed = (() => {\n      if (purpose === 'near_tx') {\n        const digestsUnknown: unknown = input.computeNearTxSigningDigests(signingPayload);\n        if (!Array.isArray(digestsUnknown)) throw new Error('near_tx digest recomputation failed');\n        return digestsUnknown.map((d, i) => {\n          const bytes = normalizeByteArray32(d);\n          if (!bytes) throw new Error(`near_tx digest[${i}] is not 32 bytes`);\n          return bytes;\n        });\n      }\n      if (purpose === 'nep461_delegate') {\n        const digestUnknown: unknown = input.computeDelegateSigningDigest(signingPayload);\n        const bytes = normalizeByteArray32(digestUnknown);\n        if (!bytes) throw new Error('nep461_delegate digest is not 32 bytes');\n        return [bytes];\n      }\n      if (purpose === 'nep413') {\n        const digestUnknown: unknown = input.computeNep413SigningDigest(signingPayload);\n        const bytes = normalizeByteArray32(digestUnknown);\n        if (!bytes) throw new Error('nep413 digest is not 32 bytes');\n        return [bytes];\n      }\n      throw new Error(`Unsupported purpose: ${purpose}`);\n    })();\n  } catch (e: unknown) {\n    const msg = String((e && typeof e === 'object' && 'message' in e) ? (e as { message?: unknown }).message : e || 'Failed to recompute signing digest');\n    return { ok: false, code: 'invalid_body', message: msg };\n  }\n\n  const match = signingDigest32Computed.some((d) => bytesEqual32(d, input.signingDigest32));\n  if (!match) {\n    return { ok: false, code: 'signing_digest_mismatch', message: 'signingPayload does not match signing_digest_32' };\n  }\n\n  return { ok: true };\n}\n\nexport type ThresholdAuthorizeSigningDigestOnlyOk = { ok: true; intentDigest32: Uint8Array };\nexport type ThresholdAuthorizeSigningDigestOnlyResult = ThresholdAuthorizeSigningDigestOnlyOk | ThresholdValidationErr;\n\nexport async function verifyThresholdEd25519AuthorizeSigningPayloadSigningDigestOnly(input: {\n  purpose: string;\n  signingPayload: unknown;\n  signingDigest32: Uint8Array;\n  userId: string;\n  ensureSignerWasm: () => Promise<void>;\n  computeNearTxSigningDigests: (payload: unknown) => unknown;\n  computeDelegateSigningDigest: (payload: unknown) => unknown;\n  computeNep413SigningDigest: (payload: unknown) => unknown;\n}): Promise<ThresholdAuthorizeSigningDigestOnlyResult> {\n  const purpose = input.purpose;\n  const signingPayload = input.signingPayload;\n  if (!isObject(signingPayload)) {\n    return { ok: false, code: 'invalid_body', message: 'signingPayload (object) is required for threshold authorization' };\n  }\n\n  const kind = toOptionalString(signingPayload.kind);\n  const expectedKind = purpose;\n  if (kind && kind !== expectedKind) {\n    return { ok: false, code: 'invalid_body', message: `signingPayload.kind must match purpose (${expectedKind})` };\n  }\n\n  // 1) Recompute intent_digest_32 from signingPayload (not VRF-bound in session mode).\n  let intentDigest32Computed: Uint8Array;\n  try {\n    if (purpose === 'near_tx') {\n      const payload = signingPayload as Partial<NearTxAuthorizeSigningPayload>;\n      const txs = payload.txSigningRequests;\n      if (!Array.isArray(txs) || !txs.length) throw new Error('signingPayload.txSigningRequests is required');\n      const nearAccountId = toOptionalString(txs[0]?.nearAccountId);\n      if (!nearAccountId) throw new Error('txSigningRequests[0].nearAccountId is required');\n      for (const tx of txs) {\n        if (toOptionalString(tx?.nearAccountId) !== nearAccountId) {\n          throw new Error('All txSigningRequests[].nearAccountId must match');\n        }\n      }\n      if (nearAccountId !== input.userId) throw new Error('txSigningRequests[].nearAccountId must match session user');\n      const txInputs = txs.map((tx) => ({\n        receiverId: toOptionalString(tx?.receiverId),\n        actions: Array.isArray(tx?.actions) ? tx.actions.map((a) => normalizeActionForIntentDigest(a)) : [],\n      }));\n      const json = alphabetizeStringify(txInputs);\n      intentDigest32Computed = await sha256BytesUtf8(json);\n    } else if (purpose === 'nep461_delegate') {\n      const payload = signingPayload as Partial<Nep461DelegateAuthorizeSigningPayload>;\n      const d = payload.delegate;\n      if (!isObject(d)) throw new Error('signingPayload.delegate is required');\n      const senderId = toOptionalString(d.senderId);\n      if (!senderId) throw new Error('delegate.senderId is required');\n      if (senderId !== input.userId) throw new Error('delegate.senderId must match session user');\n      const txInputs = [{\n        receiverId: toOptionalString(d.receiverId),\n        actions: Array.isArray(d.actions) ? d.actions.map((a) => normalizeActionForIntentDigest(a)) : [],\n      }];\n      const json = alphabetizeStringify(txInputs);\n      intentDigest32Computed = await sha256BytesUtf8(json);\n    } else if (purpose === 'nep413') {\n      const payload = signingPayload as Partial<Nep413AuthorizeSigningPayload>;\n      const nearAccountId = toOptionalString(payload.nearAccountId);\n      if (!nearAccountId) throw new Error('signingPayload.nearAccountId is required');\n      if (nearAccountId !== input.userId) throw new Error('signingPayload.nearAccountId must match session user');\n      const recipient = toOptionalString(payload.recipient);\n      const message = toOptionalString(payload.message);\n      const json = alphabetizeStringify({ kind: 'nep413', nearAccountId, recipient, message });\n      intentDigest32Computed = await sha256BytesUtf8(json);\n    } else {\n      throw new Error(`Unsupported purpose: ${purpose}`);\n    }\n  } catch (e: unknown) {\n    const msg = String((e && typeof e === 'object' && 'message' in e) ? (e as { message?: unknown }).message : e || 'Failed to recompute intent digest');\n    return { ok: false, code: 'invalid_body', message: msg };\n  }\n\n  if (intentDigest32Computed.length !== 32) {\n    return { ok: false, code: 'internal', message: `Computed intent digest is not 32 bytes (got ${intentDigest32Computed.length})` };\n  }\n\n  // 2) Recompute signing_digest_32 from signingPayload and compare to requested signing digest.\n  let signingDigest32Computed: Uint8Array[];\n  try {\n    await input.ensureSignerWasm();\n    signingDigest32Computed = (() => {\n      if (purpose === 'near_tx') {\n        const digestsUnknown: unknown = input.computeNearTxSigningDigests(signingPayload);\n        if (!Array.isArray(digestsUnknown)) throw new Error('near_tx digest recomputation failed');\n        return digestsUnknown.map((d, i) => {\n          const bytes = normalizeByteArray32(d);\n          if (!bytes) throw new Error(`near_tx digest[${i}] is not 32 bytes`);\n          return bytes;\n        });\n      }\n      if (purpose === 'nep461_delegate') {\n        const digestUnknown: unknown = input.computeDelegateSigningDigest(signingPayload);\n        const bytes = normalizeByteArray32(digestUnknown);\n        if (!bytes) throw new Error('nep461_delegate digest is not 32 bytes');\n        return [bytes];\n      }\n      if (purpose === 'nep413') {\n        const digestUnknown: unknown = input.computeNep413SigningDigest(signingPayload);\n        const bytes = normalizeByteArray32(digestUnknown);\n        if (!bytes) throw new Error('nep413 digest is not 32 bytes');\n        return [bytes];\n      }\n      throw new Error(`Unsupported purpose: ${purpose}`);\n    })();\n  } catch (e: unknown) {\n    const msg = String((e && typeof e === 'object' && 'message' in e) ? (e as { message?: unknown }).message : e || 'Failed to recompute signing digest');\n    return { ok: false, code: 'invalid_body', message: msg };\n  }\n\n  const match = signingDigest32Computed.some((d) => bytesEqual32(d, input.signingDigest32));\n  if (!match) {\n    return { ok: false, code: 'signing_digest_mismatch', message: 'signingPayload does not match signing_digest_32' };\n  }\n\n  return { ok: true, intentDigest32: intentDigest32Computed };\n}\n"],"mappings":";;;;;;AAYA,SAAgB,SAAS,GAA0C;AACjE,QAAO,CAAC,CAAC,KAAK,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ;;AAGxD,SAAgB,cAAc,GAAyB;AACrD,QAAO,OAAO,MAAM,YAAY,OAAO,SAAS;;AAGlD,SAAgB,kBAAkB,QAAiB,eAA+B;CAChF,MAAM,IAAI,iBAAiB;AAC3B,KAAI,CAAC,EAAG,QAAO;AACf,QAAO,EAAE,SAAS,OAAO,IAAI,GAAG,EAAE;;AAGpC,SAAgB,4BAA4B,QAAyB;AACnE,QAAO,kBAAkB,QAAQ;;AAGnC,SAAgB,gCAAgC,QAAyB;AACvE,QAAO,kBAAkB,QAAQ;;AAGnC,SAAgB,6BAA6B,QAAyB;AACpE,QAAO,kBAAkB,QAAQ;;AASnC,SAAgB,+BAA+B,KAAsD;AACnG,KAAI,CAAC,SAAS,KAAM,QAAO;CAC3B,MAAM,YAAY,iBAAiB,IAAI;CACvC,MAAM,0BAA0B,iBAAiB,IAAI;CACrD,MAAM,4BAA4B,iBAAiB,IAAI;AACvD,KAAI,CAAC,aAAa,CAAC,2BAA2B,CAAC,0BAA2B,QAAO;AACjF,QAAO;EAAE;EAAW;EAAyB;;;AAK/C,SAAgB,iCAAiC,KAAwD;AACvG,KAAI,CAAC,SAAS,KAAM,QAAO;CAC3B,MAAM,SAAS,iBAAiB,IAAI;CACpC,MAAM,UAAU,iBAAiB,IAAI;AACrC,KAAI,CAAC,UAAU,CAAC,QAAS,QAAO;AAChC,QAAO;EAAE;EAAQ;;;AAKnB,SAAgB,qCAAqC,KAA4D;AAC/G,KAAI,CAAC,SAAS,KAAM,QAAO;CAC3B,MAAMA,MAA6C;AACnD,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM;EACxC,MAAM,MAAM,gBAAgB;AAC5B,MAAI,CAAC,IAAK,QAAO;EACjB,MAAM,cAAc,iCAAiC;AACrD,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI,OAAO;;AAEb,QAAO,OAAO,KAAK,KAAK,SAAS,MAAM;;AAezC,SAAgB,sCAAsC,KAA6D;AACjH,KAAI,CAAC,SAAS,KAAM,QAAO;CAC3B,MAAM,cAAc,IAAI;CACxB,MAAM,eAAe,iBAAiB,IAAI;CAC1C,MAAM,UAAU,iBAAiB,IAAI;CACrC,MAAM,mBAAmB,iBAAiB,IAAI;CAC9C,MAAM,oBAAoB,iBAAiB,IAAI;CAC/C,MAAM,SAAS,iBAAiB,IAAI;CACpC,MAAM,OAAO,iBAAiB,IAAI;CAClC,MAAM,2BAA2B,iBAAiB,IAAI;CACtD,MAAM,iBAAiB,wCAAwC,IAAI,mBAC9D,CAAC,GAAG;AACT,KAAI,CAAC,cAAc,aAAc,QAAO;AACxC,KACE,CAAC,gBACD,CAAC,WACD,CAAC,oBACD,CAAC,qBACD,CAAC,UACD,CAAC,QACD,CAAC,yBACD,QAAO;AACT,QAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;AAkBJ,SAAgB,0CAA0C,KAAiE;AACzH,KAAI,CAAC,SAAS,KAAM,QAAO;CAC3B,MAAM,cAAc,IAAI;CACxB,MAAM,eAAe,iBAAiB,IAAI;CAC1C,MAAM,eAAe,iBAAiB,IAAI;CAC1C,MAAM,oBAAoB,iBAAiB,IAAI;CAC/C,MAAM,SAAS,iBAAiB,IAAI;CACpC,MAAM,OAAO,iBAAiB,IAAI;CAClC,MAAM,2BAA2B,iBAAiB,IAAI;CACtD,MAAM,kBAAkB,qCAAqC,IAAI;CACjE,MAAM,0BAA0B,iBAAiB,IAAI;CACrD,MAAM,oBAAoB,iBAAiB,IAAI;CAC/C,MAAM,iBACJ,wCAAwC,IAAI,mBACzC,CAAC,GAAG;AACT,KAAI,CAAC,cAAc,aAAc,QAAO;AACxC,KACE,CAAC,gBACD,CAAC,gBACD,CAAC,qBACD,CAAC,UACD,CAAC,QACD,CAAC,4BACD,CAAC,mBACD,CAAC,kBAED,QAAO;AAET,QAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,GAAI,0BAA0B,EAAE,4BAA4B;EAC5D;EACA;;;AAMJ,SAAgB,gCAAgC,KAAuD;AACrG,KAAI,CAAC,SAAS,KAAM,QAAO;CAC3B,MAAMC,MAAwC;AAC9C,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM;EACxC,MAAM,MAAM,gBAAgB;EAC5B,MAAM,QAAQ,iBAAiB;AAC/B,MAAI,CAAC,OAAO,CAAC,MAAO,QAAO;AAC3B,MAAI,OAAO;;AAEb,QAAO,OAAO,KAAK,KAAK,SAAS,MAAM;;AAsBzC,SAAgB,qDAAqD,KAA4E;AAC/I,KAAI,CAAC,SAAS,KAAM,QAAO;CAC3B,MAAM,cAAc,IAAI;CACxB,MAAM,eAAe,iBAAiB,IAAI;CAC1C,MAAM,eAAe,iBAAiB,IAAI;CAC1C,MAAM,oBAAoB,iBAAiB,IAAI;CAC/C,MAAM,SAAS,iBAAiB,IAAI;CACpC,MAAM,OAAO,iBAAiB,IAAI;CAClC,MAAM,2BAA2B,iBAAiB,IAAI;CACtD,MAAM,kBAAkB,qCAAqC,IAAI;CACjE,MAAM,iBACJ,wCAAwC,IAAI,mBACzC,CAAC,GAAG;CACT,MAAM,6BAA6B,gCAAgC,IAAI;AAEvE,KAAI,CAAC,cAAc,aAAc,QAAO;AACxC,KACE,CAAC,gBACD,CAAC,gBACD,CAAC,qBACD,CAAC,UACD,CAAC,QACD,CAAC,4BACD,CAAC,mBACD,CAAC,2BAED,QAAO;CAGT,MAAM,OAAO,iBAAiB,IAAI;AAClC,KAAI,SAAS,WAAY,QAAO;CAEhC,MAAM,iBAAiB,iBAAiB,IAAI;CAC5C,MAAM,cAAc,wCAAwC,IAAI;CAChE,MAAM,0BAA0B,gCAAgC,IAAI;CACpE,MAAM,gCAAgC,gCAAgC,IAAI;AAC1E,KAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,2BAA2B,CAAC,8BAA+B,QAAO;AAC1G,QAAO;EACL,MAAM;EACN;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;AAYJ,SAAgB,uCAAuC,KAA8D;AACnH,KAAI,CAAC,SAAS,KAAM,QAAO;CAC3B,MAAM,cAAc,IAAI;CACxB,MAAM,eAAe,iBAAiB,IAAI;CAC1C,MAAM,SAAS,iBAAiB,IAAI;CACpC,MAAM,OAAO,iBAAiB,IAAI;CAClC,MAAM,iBACJ,wCAAwC,IAAI,mBACzC,CAAC,GAAG;AACT,KAAI,CAAC,cAAc,aAAc,QAAO;AACxC,KAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,KAAM,QAAO;AAC9C,QAAO;EAAE;EAAa;EAAc;EAAQ;EAAM;;;AAuBpD,SAAgB,qBAAqB,OAAmC;AACtE,KAAI,iBAAiB,WACnB,QAAO,MAAM,WAAW,KAAK,QAAQ;AAEvC,KAAI,CAAC,MAAM,QAAQ,UAAU,MAAM,WAAW,GAAI,QAAO;CACzD,MAAM,MAAM,IAAI,WAAW;AAC3B,MAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;EAC3B,MAAM,IAAI,OAAO,MAAM;AACvB,MAAI,CAAC,OAAO,SAAS,MAAM,IAAI,KAAK,IAAI,IAAK,QAAO;AACpD,MAAI,KAAK;;AAEX,QAAO;;AAGT,SAAgB,aAAa,GAAe,GAAwB;AAClE,KAAI,EAAE,WAAW,MAAM,EAAE,WAAW,GAAI,QAAO;AAC/C,MAAK,IAAI,IAAI,GAAG,IAAI,IAAI,IACtB,KAAI,EAAE,OAAO,EAAE,GAAI,QAAO;AAE5B,QAAO;;AAGT,SAAgB,mBAAmB,GAAoB;AACrD,QAAO,oBAAoB,iBAAiB;;AAG9C,SAAgB,+BAA+B,GAAqC;AAClF,KAAI,CAAC,SAAS,GAAI,QAAO,EAAE,aAAa;CACxC,MAAM,aAAa,iBAAiB,EAAE;AACtC,SAAQ,YAAR;EACE,KAAK,eACH,QAAO;GACL,aAAa;GACb,MAAM,iBAAiB,EAAE;GACzB,SAAS,iBAAiB,EAAE;GAC5B,KAAK,iBAAiB,EAAE;GACxB,aAAa,iBAAiB,EAAE;;EAEpC,KAAK,WACH,QAAO;GAAE,aAAa;GAAY,SAAS,iBAAiB,EAAE;;EAChE,KAAK,QACH,QAAO;GAAE,aAAa;GAAY,OAAO,iBAAiB,EAAE;GAAQ,YAAY,iBAAiB,EAAE;;EACrG,KAAK,SACH,QAAO;GAAE,aAAa;GAAY,YAAY,iBAAiB,EAAE;GAAa,YAAY,iBAAiB,EAAE;;EAC/G,KAAK,YACH,QAAO;GAAE,aAAa;GAAY,YAAY,iBAAiB,EAAE;;EACnE,KAAK,gBACH,QAAO;GAAE,aAAa;GAAY,gBAAgB,iBAAiB,EAAE;;EACvE,KAAK,iBACH,QAAO;GAAE,aAAa;GAAY,MAAM,MAAM,QAAQ,EAAE,QAAQ,EAAE,OAAO;;EAC3E,KAAK,uBACH,QAAO;GACL,aAAa;GACb,MAAM,MAAM,QAAQ,EAAE,QAAQ,EAAE,OAAO;GACvC,aAAa,iBAAiB,EAAE;;EAEpC,KAAK,oBACH,QAAO;GACL,aAAa;GACb,YAAY,iBAAiB,EAAE,eAAe;GAC9C,WAAW,iBAAiB,EAAE,cAAc;;EAEhD,KAAK;EACL,KAAK;EACL,QACE,QAAO,EAAE,aAAa;;;AAI5B,SAAgB,iCAAiC,SAAiB,gBAAiC;AACjG,KAAI,CAAC,SAAS,gBAAiB,QAAO;AACtC,KAAI,YAAY,WAAW;EACzB,MAAM,MAAM,SAAS,eAAe,sBAAsB,eAAe,qBAAqB;AAC9F,SAAO,mBAAmB,KAAK;;AAEjC,KAAI,YAAY,mBAAmB;EACjC,MAAM,WAAW,SAAS,eAAe,YAAY,eAAe,WAAW;AAC/E,SAAO,mBAAmB,UAAU;;AAEtC,QAAO;;AAGT,eAAsB,kCAAkC,OAKjB;CACrC,MAAM,gBAAgB,iBAAiB,MAAM;CAC7C,MAAM,mBAAmB,mBAAmB,MAAM;CAClD,MAAM,2BAA2B,mBAAmB,MAAM;AAC1D,KAAI,CAAC,cAAe,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;AACvE,KAAI,CAAC,iBAAkB,QAAO;EAAE,IAAI;EAAO,MAAM;EAAY,SAAS;;AAEtE,KAAI,4BAA4B,6BAA6B,iBAC3D,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;AAGrD,KAAI;EACF,MAAM,OAAO,MAAM,MAAM,kBAAkB;EAC3C,MAAM,OAAO,KAAK,QAAQ;EAC1B,MAAM,QAAQ,KAAK,MAAM,MAAM,mBAAmB,EAAE,gBAAgB;AACpE,MAAI,CAAC,MACH,QAAO;GAAE,IAAI;GAAO,MAAM;GAAgB,SAAS;;AAErD,SAAO,EAAE,IAAI;UACNC,GAAY;EACnB,MAAM,MAAM,OAAQ,KAAK,OAAO,MAAM,YAAY,aAAa,IAAM,EAA4B,UAAU,KAAK;AAChH,SAAO;GAAE,IAAI;GAAO,MAAM;GAAY,SAAS,sCAAsC;;;;AAwCzF,eAAsB,8CAA8C,OAU7B;CACrC,MAAM,UAAU,MAAM;CACtB,MAAM,iBAAiB,MAAM;AAC7B,KAAI,CAAC,SAAS,gBACZ,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;CAGrD,MAAM,OAAO,iBAAiB,eAAe;CAC7C,MAAM,eAAe;AACrB,KAAI,QAAQ,SAAS,aACnB,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS,2CAA2C,aAAa;;CAI7G,IAAIC;AACJ,KAAI;AACF,MAAI,YAAY,WAAW;GACzB,MAAM,UAAU;GAChB,MAAM,MAAM,QAAQ;AACpB,OAAI,CAAC,MAAM,QAAQ,QAAQ,CAAC,IAAI,OAAQ,OAAM,IAAI,MAAM;GACxD,MAAM,gBAAgB,iBAAiB,IAAI,IAAI;AAC/C,OAAI,CAAC,cAAe,OAAM,IAAI,MAAM;AACpC,QAAK,MAAM,MAAM,IACf,KAAI,iBAAiB,IAAI,mBAAmB,cAC1C,OAAM,IAAI,MAAM;AAGpB,OAAI,kBAAkB,MAAM,OAAQ,OAAM,IAAI,MAAM;GACpD,MAAM,WAAW,IAAI,KAAK,QAAQ;IAChC,YAAY,iBAAiB,IAAI;IACjC,SAAS,MAAM,QAAQ,IAAI,WAAW,GAAG,QAAQ,KAAK,MAAM,+BAA+B,MAAM;;GAEnG,MAAM,OAAO,qBAAqB;AAClC,4BAAyB,MAAM,gBAAgB;aACtC,YAAY,mBAAmB;GACxC,MAAM,UAAU;GAChB,MAAM,IAAI,QAAQ;AAClB,OAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM;GAClC,MAAM,WAAW,iBAAiB,EAAE;AACpC,OAAI,CAAC,SAAU,OAAM,IAAI,MAAM;AAC/B,OAAI,aAAa,MAAM,OAAQ,OAAM,IAAI,MAAM;GAC/C,MAAM,WAAW,CAAC;IAChB,YAAY,iBAAiB,EAAE;IAC/B,SAAS,MAAM,QAAQ,EAAE,WAAW,EAAE,QAAQ,KAAK,MAAM,+BAA+B,MAAM;;GAEhG,MAAM,OAAO,qBAAqB;AAClC,4BAAyB,MAAM,gBAAgB;aACtC,YAAY,UAAU;GAC/B,MAAM,UAAU;GAChB,MAAM,gBAAgB,iBAAiB,QAAQ;AAC/C,OAAI,CAAC,cAAe,OAAM,IAAI,MAAM;AACpC,OAAI,kBAAkB,MAAM,OAAQ,OAAM,IAAI,MAAM;GACpD,MAAM,YAAY,iBAAiB,QAAQ;GAC3C,MAAM,UAAU,iBAAiB,QAAQ;GACzC,MAAM,OAAO,qBAAqB;IAAE,MAAM;IAAU;IAAe;IAAW;;AAC9E,4BAAyB,MAAM,gBAAgB;QAE/C,OAAM,IAAI,MAAM,wBAAwB;UAEnCD,GAAY;EACnB,MAAM,MAAM,OAAQ,KAAK,OAAO,MAAM,YAAY,aAAa,IAAM,EAA4B,UAAU,KAAK;AAChH,SAAO;GAAE,IAAI;GAAO,MAAM;GAAgB,SAAS;;;AAGrD,KAAI,uBAAuB,WAAW,GACpC,QAAO;EAAE,IAAI;EAAO,MAAM;EAAY,SAAS,+CAA+C,uBAAuB,OAAO;;AAE9H,KAAI,CAAC,aAAa,wBAAwB,MAAM,gBAC9C,QAAO;EAAE,IAAI;EAAO,MAAM;EAA0B,SAAS;;CAI/D,IAAIE;AACJ,KAAI;AACF,QAAM,MAAM;AACZ,mCAAiC;AAC/B,OAAI,YAAY,WAAW;IACzB,MAAMC,iBAA0B,MAAM,4BAA4B;AAClE,QAAI,CAAC,MAAM,QAAQ,gBAAiB,OAAM,IAAI,MAAM;AACpD,WAAO,eAAe,KAAK,GAAG,MAAM;KAClC,MAAM,QAAQ,qBAAqB;AACnC,SAAI,CAAC,MAAO,OAAM,IAAI,MAAM,kBAAkB,EAAE;AAChD,YAAO;;;AAGX,OAAI,YAAY,mBAAmB;IACjC,MAAMC,gBAAyB,MAAM,6BAA6B;IAClE,MAAM,QAAQ,qBAAqB;AACnC,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM;AAC5B,WAAO,CAAC;;AAEV,OAAI,YAAY,UAAU;IACxB,MAAMA,gBAAyB,MAAM,2BAA2B;IAChE,MAAM,QAAQ,qBAAqB;AACnC,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM;AAC5B,WAAO,CAAC;;AAEV,SAAM,IAAI,MAAM,wBAAwB;;UAEnCJ,GAAY;EACnB,MAAM,MAAM,OAAQ,KAAK,OAAO,MAAM,YAAY,aAAa,IAAM,EAA4B,UAAU,KAAK;AAChH,SAAO;GAAE,IAAI;GAAO,MAAM;GAAgB,SAAS;;;CAGrD,MAAM,QAAQ,wBAAwB,MAAM,MAAM,aAAa,GAAG,MAAM;AACxE,KAAI,CAAC,MACH,QAAO;EAAE,IAAI;EAAO,MAAM;EAA2B,SAAS;;AAGhE,QAAO,EAAE,IAAI;;AAMf,eAAsB,+DAA+D,OAS9B;CACrD,MAAM,UAAU,MAAM;CACtB,MAAM,iBAAiB,MAAM;AAC7B,KAAI,CAAC,SAAS,gBACZ,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;CAGrD,MAAM,OAAO,iBAAiB,eAAe;CAC7C,MAAM,eAAe;AACrB,KAAI,QAAQ,SAAS,aACnB,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS,2CAA2C,aAAa;;CAI7G,IAAIC;AACJ,KAAI;AACF,MAAI,YAAY,WAAW;GACzB,MAAM,UAAU;GAChB,MAAM,MAAM,QAAQ;AACpB,OAAI,CAAC,MAAM,QAAQ,QAAQ,CAAC,IAAI,OAAQ,OAAM,IAAI,MAAM;GACxD,MAAM,gBAAgB,iBAAiB,IAAI,IAAI;AAC/C,OAAI,CAAC,cAAe,OAAM,IAAI,MAAM;AACpC,QAAK,MAAM,MAAM,IACf,KAAI,iBAAiB,IAAI,mBAAmB,cAC1C,OAAM,IAAI,MAAM;AAGpB,OAAI,kBAAkB,MAAM,OAAQ,OAAM,IAAI,MAAM;GACpD,MAAM,WAAW,IAAI,KAAK,QAAQ;IAChC,YAAY,iBAAiB,IAAI;IACjC,SAAS,MAAM,QAAQ,IAAI,WAAW,GAAG,QAAQ,KAAK,MAAM,+BAA+B,MAAM;;GAEnG,MAAM,OAAO,qBAAqB;AAClC,4BAAyB,MAAM,gBAAgB;aACtC,YAAY,mBAAmB;GACxC,MAAM,UAAU;GAChB,MAAM,IAAI,QAAQ;AAClB,OAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM;GAClC,MAAM,WAAW,iBAAiB,EAAE;AACpC,OAAI,CAAC,SAAU,OAAM,IAAI,MAAM;AAC/B,OAAI,aAAa,MAAM,OAAQ,OAAM,IAAI,MAAM;GAC/C,MAAM,WAAW,CAAC;IAChB,YAAY,iBAAiB,EAAE;IAC/B,SAAS,MAAM,QAAQ,EAAE,WAAW,EAAE,QAAQ,KAAK,MAAM,+BAA+B,MAAM;;GAEhG,MAAM,OAAO,qBAAqB;AAClC,4BAAyB,MAAM,gBAAgB;aACtC,YAAY,UAAU;GAC/B,MAAM,UAAU;GAChB,MAAM,gBAAgB,iBAAiB,QAAQ;AAC/C,OAAI,CAAC,cAAe,OAAM,IAAI,MAAM;AACpC,OAAI,kBAAkB,MAAM,OAAQ,OAAM,IAAI,MAAM;GACpD,MAAM,YAAY,iBAAiB,QAAQ;GAC3C,MAAM,UAAU,iBAAiB,QAAQ;GACzC,MAAM,OAAO,qBAAqB;IAAE,MAAM;IAAU;IAAe;IAAW;;AAC9E,4BAAyB,MAAM,gBAAgB;QAE/C,OAAM,IAAI,MAAM,wBAAwB;UAEnCD,GAAY;EACnB,MAAM,MAAM,OAAQ,KAAK,OAAO,MAAM,YAAY,aAAa,IAAM,EAA4B,UAAU,KAAK;AAChH,SAAO;GAAE,IAAI;GAAO,MAAM;GAAgB,SAAS;;;AAGrD,KAAI,uBAAuB,WAAW,GACpC,QAAO;EAAE,IAAI;EAAO,MAAM;EAAY,SAAS,+CAA+C,uBAAuB,OAAO;;CAI9H,IAAIE;AACJ,KAAI;AACF,QAAM,MAAM;AACZ,mCAAiC;AAC/B,OAAI,YAAY,WAAW;IACzB,MAAMC,iBAA0B,MAAM,4BAA4B;AAClE,QAAI,CAAC,MAAM,QAAQ,gBAAiB,OAAM,IAAI,MAAM;AACpD,WAAO,eAAe,KAAK,GAAG,MAAM;KAClC,MAAM,QAAQ,qBAAqB;AACnC,SAAI,CAAC,MAAO,OAAM,IAAI,MAAM,kBAAkB,EAAE;AAChD,YAAO;;;AAGX,OAAI,YAAY,mBAAmB;IACjC,MAAMC,gBAAyB,MAAM,6BAA6B;IAClE,MAAM,QAAQ,qBAAqB;AACnC,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM;AAC5B,WAAO,CAAC;;AAEV,OAAI,YAAY,UAAU;IACxB,MAAMA,gBAAyB,MAAM,2BAA2B;IAChE,MAAM,QAAQ,qBAAqB;AACnC,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM;AAC5B,WAAO,CAAC;;AAEV,SAAM,IAAI,MAAM,wBAAwB;;UAEnCJ,GAAY;EACnB,MAAM,MAAM,OAAQ,KAAK,OAAO,MAAM,YAAY,aAAa,IAAM,EAA4B,UAAU,KAAK;AAChH,SAAO;GAAE,IAAI;GAAO,MAAM;GAAgB,SAAS;;;CAGrD,MAAM,QAAQ,wBAAwB,MAAM,MAAM,aAAa,GAAG,MAAM;AACxE,KAAI,CAAC,MACH,QAAO;EAAE,IAAI;EAAO,MAAM;EAA2B,SAAS;;AAGhE,QAAO;EAAE,IAAI;EAAM,gBAAgB"}