@tatchi-xyz/sdk 0.21.0 → 0.31.0

package/dist/cjs/react/sdk/src/core/TatchiPasskey/signNEP413.js

@@ -1,89 +0,0 @@
-const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.js');
-const require_sdkSentEvents = require('../types/sdkSentEvents.js');
-
-//#region src/core/TatchiPasskey/signNEP413.ts
-require_sdkSentEvents.init_sdkSentEvents();
-/**
-* Sign a NEP-413 message using the user's passkey-derived private key
-*
-* This function implements the NEP-413 standard for off-chain message signing:
-* - Creates a payload with message, recipient, nonce, and state
-* - Serializes using Borsh
-* - Adds NEP-413 prefix (2^31 + 413)
-* - Hashes with SHA-256
-* - Signs with Ed25519
-* - Returns base64-encoded signature
-*
-* @param context - TatchiPasskey context
-* @param nearAccountId - NEAR account ID to sign with
-* @param params - NEP-413 signing parameters
-* @param options - Action options for event handling
-* @returns Promise resolving to signing result
-*/
-async function signNEP413Message(args) {
-	const { context, nearAccountId, params, options } = args;
-	const confirmerText = options?.confirmerText;
-	const confirmationConfigOverride = options?.confirmationConfig;
-	const { nearClient, webAuthnManager } = context;
-	try {
-		options?.onEvent?.({
-			step: 1,
-			phase: require_sdkSentEvents.ActionPhase.STEP_1_PREPARATION,
-			status: require_sdkSentEvents.ActionStatus.PROGRESS,
-			message: "Preparing NEP-413 message signing"
-		});
-		const [vrfStatus, userData] = await Promise.all([webAuthnManager.checkVrfStatus(), webAuthnManager.getLastUser()]);
-		if (!vrfStatus.active) throw new Error("User not authenticated. Please login first.");
-		if (!userData || !userData.clientNearPublicKey) throw new Error(`User data not found for ${nearAccountId}`);
-		const { nextNonce, txBlockHash, txBlockHeight } = await context.webAuthnManager.getNonceManager().getNonceBlockHashAndHeight(nearClient);
-		options?.onEvent?.({
-			step: 5,
-			phase: require_sdkSentEvents.ActionPhase.STEP_5_TRANSACTION_SIGNING_PROGRESS,
-			status: require_sdkSentEvents.ActionStatus.PROGRESS,
-			message: "Signing NEP-413 message"
-		});
-		const result = await context.webAuthnManager.signNEP413Message({
-			message: params.message,
-			recipient: params.recipient,
-			nonce: nextNonce,
-			state: params.state || null,
-			accountId: nearAccountId,
-			title: confirmerText?.title,
-			body: confirmerText?.body,
-			confirmationConfigOverride
-		});
-		if (result.success) {
-			options?.onEvent?.({
-				step: 8,
-				phase: require_sdkSentEvents.ActionPhase.STEP_8_ACTION_COMPLETE,
-				status: require_sdkSentEvents.ActionStatus.SUCCESS,
-				message: "NEP-413 message signed successfully"
-			});
-			return {
-				success: true,
-				accountId: result.accountId,
-				publicKey: result.publicKey,
-				signature: result.signature,
-				state: result.state
-			};
-		} else throw new Error(`NEP-413 signing failed: ${result.error || "Unknown error"}`);
-	} catch (error) {
-		const errorMessage = error instanceof Error ? error.message : "Unknown error";
-		options?.onEvent?.({
-			step: 0,
-			phase: "action-error",
-			status: "error",
-			message: `NEP-413 signing failed: ${errorMessage}`,
-			error: errorMessage
-		});
-		options?.onError?.(error instanceof Error ? error : new Error(errorMessage));
-		return {
-			success: false,
-			error: errorMessage
-		};
-	}
-}
-
-//#endregion
-exports.signNEP413Message = signNEP413Message;
-//# sourceMappingURL=signNEP413.js.map

package/dist/cjs/react/sdk/src/core/TatchiPasskey/signNEP413.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signNEP413.js","names":["ActionPhase","ActionStatus"],"sources":["../../../../../../../src/core/TatchiPasskey/signNEP413.ts"],"sourcesContent":["import type { PasskeyManagerContext } from './index';\nimport type { SignNEP413HooksOptions } from '../types/sdkSentEvents';\nimport { ActionPhase, ActionStatus } from '../types/sdkSentEvents';\nimport type { AccountId } from '../types/accountIds';\n\n/**\n * NEP-413 message signing parameters\n */\nexport interface SignNEP413MessageParams {\n  /** The message to sign */\n  message: string;\n  /** The recipient identifier */\n  recipient: string;\n  /** Optional state parameter */\n  state?: string;\n}\n\n/**\n * NEP-413 message signing result\n */\nexport interface SignNEP413MessageResult {\n  /** Success status */\n  success: boolean;\n  /** NEAR account ID that signed the message */\n  accountId?: string;\n  /** Base58-encoded public key */\n  publicKey?: string;\n  /** Base64-encoded signature */\n  signature?: string;\n  /** Optional state parameter */\n  state?: string;\n  /** Error message if signing failed */\n  error?: string;\n}\n\n/**\n * Sign a NEP-413 message using the user's passkey-derived private key\n *\n * This function implements the NEP-413 standard for off-chain message signing:\n * - Creates a payload with message, recipient, nonce, and state\n * - Serializes using Borsh\n * - Adds NEP-413 prefix (2^31 + 413)\n * - Hashes with SHA-256\n * - Signs with Ed25519\n * - Returns base64-encoded signature\n *\n * @param context - TatchiPasskey context\n * @param nearAccountId - NEAR account ID to sign with\n * @param params - NEP-413 signing parameters\n * @param options - Action options for event handling\n * @returns Promise resolving to signing result\n */\nexport async function signNEP413Message(args: {\n  context: PasskeyManagerContext,\n  nearAccountId: AccountId,\n  params: SignNEP413MessageParams,\n  options?: SignNEP413HooksOptions\n}): Promise<SignNEP413MessageResult> {\n\n  const { context, nearAccountId, params, options } = args;\n  const confirmerText = options?.confirmerText;\n  const confirmationConfigOverride = options?.confirmationConfig;\n  const { nearClient, webAuthnManager } = context;\n\n  try {\n    // Emit preparation event\n    options?.onEvent?.({\n      step: 1,\n      phase: ActionPhase.STEP_1_PREPARATION,\n      status: ActionStatus.PROGRESS,\n      message: 'Preparing NEP-413 message signing'\n    });\n\n    // Get user data and VRF status for NEP-413 signing\n    const [vrfStatus, userData] = await Promise.all([\n      webAuthnManager.checkVrfStatus(),\n      webAuthnManager.getLastUser(),\n    ]);\n    // Check VRF status to ensure user is authenticated\n    if (!vrfStatus.active) {\n      throw new Error('User not authenticated. Please login first.');\n    }\n    if (!userData || !userData.clientNearPublicKey) {\n      throw new Error(`User data not found for ${nearAccountId}`);\n    }\n\n    // Generate a nonce + block context for NEP-413 signing\n    const {\n      nextNonce,\n      txBlockHash,\n      txBlockHeight\n    } = await context.webAuthnManager.getNonceManager().getNonceBlockHashAndHeight(nearClient);\n\n    // Emit signing progress event\n    options?.onEvent?.({\n      step: 5,\n      phase: ActionPhase.STEP_5_TRANSACTION_SIGNING_PROGRESS,\n      status: ActionStatus.PROGRESS,\n      message: 'Signing NEP-413 message'\n    });\n\n    // Send to WebAuthnManager for signing.\n    // Note: NEP-413 now uses VRF-driven confirmTxFlow inside WebAuthnManager/SignerWorkerManager;\n    // this call will trigger its own confirmation + WebAuthn authentication as needed.\n    const result = await context.webAuthnManager.signNEP413Message({\n      message: params.message,\n      recipient: params.recipient,\n      nonce: nextNonce,\n      state: params.state || null,\n      accountId: nearAccountId,\n      title: confirmerText?.title,\n      body: confirmerText?.body,\n      confirmationConfigOverride,\n    });\n\n    if (result.success) {\n      // Emit completion event\n      options?.onEvent?.({\n        step: 8,\n        phase: ActionPhase.STEP_8_ACTION_COMPLETE,\n        status: ActionStatus.SUCCESS,\n        message: 'NEP-413 message signed successfully'\n      });\n\n      return {\n        success: true,\n        accountId: result.accountId,\n        publicKey: result.publicKey,\n        signature: result.signature,\n        state: result.state\n      };\n    } else {\n      throw new Error(`NEP-413 signing failed: ${result.error || 'Unknown error'}`);\n    }\n\n  } catch (error) {\n    const errorMessage = error instanceof Error ? error.message : 'Unknown error';\n\n    // Emit error event\n    options?.onEvent?.({\n      step: 0,\n      phase: 'action-error' as any,\n      status: 'error' as any,\n      message: `NEP-413 signing failed: ${errorMessage}`,\n      error: errorMessage\n    });\n\n    options?.onError?.(error instanceof Error ? error : new Error(errorMessage));\n\n    return {\n      success: false,\n      error: errorMessage\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAoDA,eAAsB,kBAAkB,MAKH;CAEnC,MAAM,EAAE,SAAS,eAAe,QAAQ,YAAY;CACpD,MAAM,gBAAgB,SAAS;CAC/B,MAAM,6BAA6B,SAAS;CAC5C,MAAM,EAAE,YAAY,oBAAoB;AAExC,KAAI;AAEF,WAAS,UAAU;GACjB,MAAM;GACN,OAAOA,kCAAY;GACnB,QAAQC,mCAAa;GACrB,SAAS;;EAIX,MAAM,CAAC,WAAW,YAAY,MAAM,QAAQ,IAAI,CAC9C,gBAAgB,kBAChB,gBAAgB;AAGlB,MAAI,CAAC,UAAU,OACb,OAAM,IAAI,MAAM;AAElB,MAAI,CAAC,YAAY,CAAC,SAAS,oBACzB,OAAM,IAAI,MAAM,2BAA2B;EAI7C,MAAM,EACJ,WACA,aACA,kBACE,MAAM,QAAQ,gBAAgB,kBAAkB,2BAA2B;AAG/E,WAAS,UAAU;GACjB,MAAM;GACN,OAAOD,kCAAY;GACnB,QAAQC,mCAAa;GACrB,SAAS;;EAMX,MAAM,SAAS,MAAM,QAAQ,gBAAgB,kBAAkB;GAC7D,SAAS,OAAO;GAChB,WAAW,OAAO;GAClB,OAAO;GACP,OAAO,OAAO,SAAS;GACvB,WAAW;GACX,OAAO,eAAe;GACtB,MAAM,eAAe;GACrB;;AAGF,MAAI,OAAO,SAAS;AAElB,YAAS,UAAU;IACjB,MAAM;IACN,OAAOD,kCAAY;IACnB,QAAQC,mCAAa;IACrB,SAAS;;AAGX,UAAO;IACL,SAAS;IACT,WAAW,OAAO;IAClB,WAAW,OAAO;IAClB,WAAW,OAAO;IAClB,OAAO,OAAO;;QAGhB,OAAM,IAAI,MAAM,2BAA2B,OAAO,SAAS;UAGtD,OAAO;EACd,MAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU;AAG9D,WAAS,UAAU;GACjB,MAAM;GACN,OAAO;GACP,QAAQ;GACR,SAAS,2BAA2B;GACpC,OAAO;;AAGT,WAAS,UAAU,iBAAiB,QAAQ,QAAQ,IAAI,MAAM;AAE9D,SAAO;GACL,SAAS;GACT,OAAO"}

package/dist/cjs/react/sdk/src/core/WalletIframe/client/IframeTransport.js

@@ -1,330 +0,0 @@
-const require_rolldown_runtime = require('../../../../../_virtual/rolldown_runtime.js');
-const require_validation = require('../validation.js');
-const require_credentialsHelpers = require('../../WebAuthnManager/credentialsHelpers.js');
-const require_safari_fallbacks = require('../../WebAuthnManager/WebAuthnFallbacks/safari-fallbacks.js');
-const require_index = require('../../WebAuthnManager/WebAuthnFallbacks/index.js');
-const require_overlay_styles = require('./overlay-styles.js');
-
-//#region src/core/WalletIframe/client/IframeTransport.ts
-require_validation.init_validation();
-require_credentialsHelpers.init_credentialsHelpers();
-require_index.init_WebAuthnFallbacks();
-const IframeMessage = {
-	Connect: "CONNECT",
-	Ready: "READY",
-	HostBooted: "SERVICE_HOST_BOOTED",
-	HostDebugOrigin: "SERVICE_HOST_DEBUG_ORIGIN",
-	HostLog: "SERVICE_HOST_LOG"
-};
-var IframeTransport = class {
-	opts;
-	iframeEl = null;
-	serviceBooted = false;
-	connectInFlight = null;
-	walletServiceUrl;
-	walletOrigin;
-	testOptions;
-	constructor(options) {
-		this.opts = {
-			servicePath: "/wallet-service",
-			connectTimeoutMs: 8e3,
-			...options
-		};
-		try {
-			this.walletServiceUrl = new URL(this.opts.servicePath, this.opts.walletOrigin);
-		} catch (err) {
-			throw new Error(`[IframeTransport] Invalid wallet origin (${options.walletOrigin}) or servicePath (${options.servicePath || "/wallet-service"})`);
-		}
-		this.walletOrigin = this.walletServiceUrl.origin;
-		this.testOptions = {
-			routerId: options.testOptions?.routerId,
-			ownerTag: options.testOptions?.ownerTag
-		};
-		try {
-			window.addEventListener("message", (e) => {
-				const data = e.data;
-				if (!require_validation.isObject(data)) return;
-				const type = data.type;
-				if (type === IframeMessage.HostBooted && e.origin === this.walletOrigin) {
-					this.serviceBooted = true;
-					return;
-				}
-				if (type === IframeMessage.HostDebugOrigin) {}
-				if (type === IframeMessage.HostLog) console.debug("[IframeTransport][wallet-log]", data.payload);
-				if (e.origin === this.walletOrigin) {
-					if (type === require_safari_fallbacks.WebAuthnBridgeMessage.Create || type === require_safari_fallbacks.WebAuthnBridgeMessage.Get) {
-						this.performWebAuthnBridge(type, data, e);
-						return;
-					}
-				}
-			});
-		} catch {}
-	}
-	/** Returns the underlying iframe element if it exists. */
-	getIframeEl() {
-		return this.iframeEl;
-	}
-	/**
-	* Guardrail: prevent multiple overlay iframes accumulating when apps accidentally
-	* create more than one WalletIframeRouter/TatchiPasskey instance.
-	*/
-	removeExistingOverlaysForOrigin() {
-		try {
-			const isDev = (() => {
-				const env = globalThis?.process?.env?.NODE_ENV;
-				if (env && env !== "production") return true;
-				const h = window.location.hostname || "";
-				if (/localhost|127\.(?:0|[1-9]\d?)\.(?:0|[1-9]\d?)\.(?:0|[1-9]\d?)|\.local(?:host)?$/i.test(h)) return true;
-				return false;
-			})();
-			const existing = Array.from(document.querySelectorAll("iframe.w3a-wallet-overlay"));
-			const matches = existing.filter((el) => {
-				const dsOrigin = el?.dataset?.w3aOrigin;
-				if (dsOrigin) return dsOrigin === this.walletOrigin;
-				try {
-					return new URL(el.src).origin === this.walletOrigin;
-				} catch {
-					return false;
-				}
-			});
-			if (!matches.length) return;
-			if (isDev) {
-				const routerIds = matches.map((el) => el?.dataset?.w3aRouterId).filter((v) => typeof v === "string" && v.length > 0);
-				console.warn(`[IframeTransport] Found existing wallet overlay iframe(s) for ${this.walletOrigin}. This usually indicates multiple SDK instances. Removing old iframe(s) to avoid duplicates.`, {
-					count: matches.length,
-					routerIds
-				});
-			}
-			for (const el of matches) try {
-				el.remove();
-			} catch {}
-		} catch {}
-	}
-	/** Ensure the iframe element exists and is appended to the DOM. Idempotent. */
-	ensureIframeMounted() {
-		if (this.iframeEl) return this.iframeEl;
-		this.removeExistingOverlaysForOrigin();
-		const iframe = document.createElement("iframe");
-		iframe.classList.add("w3a-wallet-overlay", "is-hidden");
-		try {
-			require_overlay_styles.ensureOverlayBase(iframe);
-		} catch {}
-		iframe.setAttribute("width", "0");
-		iframe.setAttribute("height", "0");
-		iframe.setAttribute("aria-hidden", "true");
-		iframe.setAttribute("tabindex", "-1");
-		iframe.setAttribute("loading", "eager");
-		iframe.setAttribute("fetchpriority", "high");
-		iframe.dataset.w3aRouterId = this.testOptions?.routerId || "";
-		if (this.testOptions?.ownerTag) iframe.dataset.w3aOwner = this.testOptions.ownerTag;
-		iframe.dataset.w3aOrigin = this.walletOrigin;
-		try {
-			iframe.setAttribute("allow", this.buildAllowAttr(this.walletOrigin));
-		} catch {
-			iframe.setAttribute("allow", "publickey-credentials-get 'self'; publickey-credentials-create 'self'; clipboard-read; clipboard-write");
-		}
-		iframe._svc_loaded = false;
-		iframe.addEventListener("load", () => {
-			iframe._svc_loaded = true;
-		}, { once: true });
-		const src = this.walletServiceUrl.toString();
-		console.debug("[IframeTransport] mount: external origin", src);
-		iframe.src = src;
-		document.body.appendChild(iframe);
-		console.debug("[IframeTransport] mount: iframe appended");
-		this.iframeEl = iframe;
-		return iframe;
-	}
-	/**
-	* Connect to the wallet iframe using a MessageChannel handshake.
-	* - Repeatedly posts {type:'CONNECT'} with a fresh port until a 'READY' message arrives
-	* - Times out after connectTimeoutMs
-	* - Deduplicates concurrent calls and returns the same MessagePort promise
-	*/
-	async connect() {
-		if (this.connectInFlight) return this.connectInFlight;
-		this.connectInFlight = (async () => {
-			const iframe = this.ensureIframeMounted();
-			await this.waitForLoad(iframe);
-			const bootWaitMs = Math.min(this.opts.connectTimeoutMs / 12, 300);
-			const startBoot = Date.now();
-			while (!this.serviceBooted && Date.now() - startBoot < bootWaitMs) await new Promise((r) => setTimeout(r, 50));
-			let resolved = false;
-			let attempt = 0;
-			let warnedNullOrigin = false;
-			const start = Date.now();
-			const overallTimeout = this.opts.connectTimeoutMs;
-			const port = await new Promise((resolve, reject) => {
-				const tick = () => {
-					if (resolved) return;
-					const elapsed = Date.now() - start;
-					if (elapsed >= overallTimeout) {
-						console.debug("[IframeTransport] handshake timeout after %d ms", elapsed);
-						return reject(/* @__PURE__ */ new Error("Wallet iframe READY timeout"));
-					}
-					attempt += 1;
-					const channel = new MessageChannel();
-					const port1 = channel.port1;
-					const port2 = channel.port2;
-					const cleanup = () => {
-						try {
-							port1.onmessage = null;
-						} catch {}
-					};
-					port1.onmessage = (e) => {
-						const data = e.data;
-						if (data.type === IframeMessage.Ready) {
-							resolved = true;
-							cleanup();
-							port1.start?.();
-							return resolve(port1);
-						}
-					};
-					try {
-						port1.start?.();
-					} catch {}
-					const cw = iframe.contentWindow;
-					if (!cw) {
-						cleanup();
-						return reject(/* @__PURE__ */ new Error("Wallet iframe window missing"));
-					}
-					const targetOrigin = this.serviceBooted ? this.walletOrigin : "*";
-					({warnedNullOrigin} = this.postConnectMessage(cw, { type: IframeMessage.Connect }, port2, targetOrigin, warnedNullOrigin, elapsed, attempt));
-					const interval = attempt < 10 ? 200 : attempt < 20 ? 400 : 800;
-					setTimeout(() => {
-						if (!resolved) tick();
-					}, interval);
-				};
-				tick();
-			});
-			return port;
-		})();
-		try {
-			return await this.connectInFlight;
-		} finally {
-			this.connectInFlight = null;
-		}
-	}
-	postConnectMessage(cw, data, port2, targetOrigin, warnedNullOrigin, elapsed, attempt) {
-		try {
-			cw.postMessage(data, targetOrigin, [port2]);
-			return { warnedNullOrigin };
-		} catch (e) {
-			const message = e instanceof Error ? e.message ?? String(e) : String(e);
-			if (!warnedNullOrigin && message.includes("'null'")) {
-				warnedNullOrigin = true;
-				console.warn("[IframeTransport] CONNECT blocked; iframe origin appears to be null. Check that %s is reachable and responds with Cross-Origin-Resource-Policy: cross-origin.", this.walletServiceUrl.toString());
-			}
-			try {
-				cw.postMessage(data, "*", [port2]);
-			} catch {}
-			console.debug("[IframeTransport] CONNECT attempt %d threw after %d ms; retrying.", attempt, elapsed);
-			return { warnedNullOrigin };
-		}
-	}
-	/** Guard against posting to the iframe before it has fired load. */
-	async waitForLoad(iframe) {
-		if (iframe._svc_loaded) return;
-		await new Promise((resolve) => {
-			try {
-				let timeout;
-				iframe.addEventListener?.("load", () => {
-					if (typeof timeout === "number") clearTimeout(timeout);
-					resolve();
-				}, { once: true });
-				timeout = window.setTimeout(() => {
-					console.debug("[IframeTransport] waitForLoad did not observe load event within 150ms; continuing");
-					resolve();
-				}, 150);
-			} catch {
-				resolve();
-			}
-		});
-	}
-	buildAllowAttr(walletOrigin) {
-		return `publickey-credentials-get 'self' ${walletOrigin}; publickey-credentials-create 'self' ${walletOrigin}; clipboard-read; clipboard-write`;
-	}
-	postBridgeResult(source, type, requestId, ok, payload) {
-		source?.postMessage({
-			type,
-			requestId,
-			ok,
-			...payload
-		}, "*");
-	}
-	performWebAuthnBridge(kind, raw, e) {
-		if (kind === require_safari_fallbacks.WebAuthnBridgeMessage.Create) {
-			this.handleWebAuthnCreate(raw, e);
-			return;
-		}
-		this.handleWebAuthnGet(raw, e);
-	}
-	async handleWebAuthnCreate(req, e) {
-		const requestId = req?.requestId || "";
-		try {
-			const src = req?.publicKey || {};
-			const rpName = src.rp?.name || "WebAuthn";
-			const rpId = src.rp?.id || window.location.hostname;
-			const pub = {
-				...src,
-				rp: {
-					name: rpName,
-					id: rpId
-				}
-			};
-			console.debug("[IframeTransport][bridge] CREATE received", {
-				requestId,
-				from: e.origin,
-				rpId: pub.rp?.id
-			});
-			const cred = await navigator.credentials.create({ publicKey: pub });
-			const serialized = require_credentialsHelpers.serializeRegistrationCredentialWithPRF({
-				credential: cred,
-				firstPrfOutput: true,
-				secondPrfOutput: true
-			});
-			this.postBridgeResult(e.source, require_safari_fallbacks.WebAuthnBridgeMessage.CreateResult, requestId, true, { credential: serialized });
-			console.debug("[IframeTransport][bridge] CREATE ok", { requestId });
-		} catch (err) {
-			console.warn("[IframeTransport][bridge] CREATE failed", {
-				requestId,
-				err: String(err?.message || err)
-			});
-			this.postBridgeResult(e.source, require_safari_fallbacks.WebAuthnBridgeMessage.CreateResult, requestId, false, { error: String(err?.message || err) });
-		}
-	}
-	async handleWebAuthnGet(req, e) {
-		const requestId = req?.requestId || "";
-		try {
-			const src = req?.publicKey || {};
-			const rpId = src.rpId || window.location.hostname;
-			const pub = {
-				...src,
-				rpId
-			};
-			console.debug("[IframeTransport][bridge] GET received", {
-				requestId,
-				from: e.origin,
-				rpId: pub.rpId
-			});
-			const cred = await navigator.credentials.get({ publicKey: pub });
-			const serialized = require_credentialsHelpers.serializeAuthenticationCredentialWithPRF({
-				credential: cred,
-				firstPrfOutput: true,
-				secondPrfOutput: true
-			});
-			this.postBridgeResult(e.source, require_safari_fallbacks.WebAuthnBridgeMessage.GetResult, requestId, true, { credential: serialized });
-			console.debug("[IframeTransport][bridge] GET ok", { requestId });
-		} catch (err) {
-			console.warn("[IframeTransport][bridge] GET failed", {
-				requestId,
-				err: String(err?.message || err)
-			});
-			this.postBridgeResult(e.source, require_safari_fallbacks.WebAuthnBridgeMessage.GetResult, requestId, false, { error: String(err?.message || err) });
-		}
-	}
-};
-
-//#endregion
-exports.IframeTransport = IframeTransport;
-//# sourceMappingURL=IframeTransport.js.map

package/dist/cjs/react/sdk/src/core/WalletIframe/client/IframeTransport.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"IframeTransport.js","names":["isObject","WebAuthnBridgeMessage","timeout: number | undefined","pub: PublicKeyCredentialCreationOptions","serializeRegistrationCredentialWithPRF","pub: PublicKeyCredentialRequestOptions","serializeAuthenticationCredentialWithPRF"],"sources":["../../../../../../../../src/core/WalletIframe/client/IframeTransport.ts"],"sourcesContent":["/**\n * IframeTransport - Client-Side Communication Layer\n *\n * This module handles the low-level iframe management and connection establishment.\n * It encapsulates all the complex browser-specific logic for safely creating and\n * connecting to the wallet service iframe.\n *\n * Key Responsibilities:\n * - Iframe Creation: Creates and mounts the iframe element with proper security attributes\n * - Security Hardening: Sets appropriate allow/sandbox attributes for WebAuthn and clipboard access\n * - Load Event Handling: Waits for iframe load to avoid postMessage races\n * - Connection Handshake: Performs robust CONNECT → READY handshake using MessageChannel\n * - Boot Latency Handling: Manages cross-origin boot delays with SERVICE_HOST_BOOTED hints\n * - Connection Deduplication: Prevents multiple concurrent connection attempts\n * - Error Handling: Provides clear error messages for connection failures\n *\n * Security Model:\n * - Uses explicit allow attributes for WebAuthn and clipboard permissions\n * - Avoids sandboxing for cross-origin deployments (prevents MessagePort transfer issues)\n * - Validates wallet origin URLs to prevent security issues\n * - Uses MessageChannel for secure, bidirectional communication\n *\n * Browser Compatibility:\n * - Handles various browser quirks around iframe loading and MessagePort transfer\n * - Provides fallback behavior for different browser implementations\n * - Manages timing issues with cross-origin iframe boot sequences\n */\n\nimport type { ChildToParentEnvelope } from '../shared/messages';\nimport { isObject } from '../validation';\nimport { serializeRegistrationCredentialWithPRF, serializeAuthenticationCredentialWithPRF } from '../../WebAuthnManager/credentialsHelpers';\nimport { ensureOverlayBase } from './overlay-styles';\nimport { WebAuthnBridgeMessage } from '../../WebAuthnManager/WebAuthnFallbacks';\n\n// Message constants (typed string literals, tree‑shake friendly)\nexport const IframeMessage = {\n  Connect: 'CONNECT',\n  Ready: 'READY',\n  HostBooted: 'SERVICE_HOST_BOOTED',\n  HostDebugOrigin: 'SERVICE_HOST_DEBUG_ORIGIN',\n  HostLog: 'SERVICE_HOST_LOG',\n} as const;\n\n// Bridge request payloads\ntype CreateReq = { requestId?: string; publicKey?: PublicKeyCredentialCreationOptions };\ntype GetReq = { requestId?: string; publicKey?: PublicKeyCredentialRequestOptions };\n\nexport interface IframeTransportOptions {\n  walletOrigin: string;     // e.g., https://wallet.example.com\n  servicePath?: string;      // default '/wallet-service'\n  connectTimeoutMs?: number; // total budget for handshake retries\n  testOptions?: {\n    routerId?: string;         // identity tag for the iframe element\n    ownerTag?: string;         // e.g., 'app' | 'tests'\n  };\n}\n\nexport class IframeTransport {\n  private readonly opts: Required<IframeTransportOptions>;\n  private iframeEl: HTMLIFrameElement | null = null;\n  private serviceBooted = false; // set when wallet host sends SERVICE_HOST_BOOTED (best-effort only)\n  private connectInFlight: Promise<MessagePort> | null = null;\n  private readonly walletServiceUrl: URL;\n  private readonly walletOrigin: string;\n  private readonly testOptions: { routerId?: string; ownerTag?: string };\n\n  constructor(options: IframeTransportOptions) {\n    this.opts = {\n      servicePath: '/wallet-service',\n      connectTimeoutMs: 8000,\n      ...options,\n    } as Required<IframeTransportOptions>;\n\n    try {\n      this.walletServiceUrl = new URL(this.opts.servicePath, this.opts.walletOrigin);\n    } catch (err) {\n      throw new Error(`[IframeTransport] Invalid wallet origin (${options.walletOrigin}) or servicePath (${options.servicePath || '/wallet-service'})`);\n    }\n    this.walletOrigin = this.walletServiceUrl.origin;\n    this.testOptions = {\n      routerId: options.testOptions?.routerId,\n      ownerTag: options.testOptions?.ownerTag,\n    };\n\n    // Listen for a best-effort boot hint from the wallet host. Not required for correctness,\n    // but helps reduce redundant CONNECT posts while the host script is still booting.\n    try {\n      window.addEventListener('message', (e) => {\n        const data = e.data as unknown;\n        if (!isObject(data)) return;\n        const type = (data as { type?: unknown }).type;\n        if (type === IframeMessage.HostBooted && e.origin === this.walletOrigin) {\n          this.serviceBooted = true;\n          return;\n        }\n        if (type === IframeMessage.HostDebugOrigin) {\n        }\n        if (type === IframeMessage.HostLog) {\n          // Only surface wallet logs when debug is enabled\n          console.debug('[IframeTransport][wallet-log]', (data as { payload?: unknown }).payload);\n        }\n        // Parent‑performed WebAuthn bridge for Safari cross‑origin scenarios.\n        // Only accept requests originating from the wallet iframe origin.\n        if (e.origin === this.walletOrigin) {\n          if (type === WebAuthnBridgeMessage.Create || type === WebAuthnBridgeMessage.Get) {\n            // Delegate to common bridge handler\n            this.performWebAuthnBridge(type as typeof WebAuthnBridgeMessage.Create | typeof WebAuthnBridgeMessage.Get, data, e);\n            return;\n          }\n        }\n      });\n    } catch {}\n  }\n\n  /** Returns the underlying iframe element if it exists. */\n  getIframeEl(): HTMLIFrameElement | null { return this.iframeEl; }\n\n  /**\n   * Guardrail: prevent multiple overlay iframes accumulating when apps accidentally\n   * create more than one WalletIframeRouter/TatchiPasskey instance.\n   */\n  private removeExistingOverlaysForOrigin(): void {\n    try {\n      const isDev = (() => {\n        const env = (globalThis as any)?.process?.env?.NODE_ENV;\n        if (env && env !== 'production') return true;\n        const h = window.location.hostname || '';\n        if (/localhost|127\\.(?:0|[1-9]\\d?)\\.(?:0|[1-9]\\d?)\\.(?:0|[1-9]\\d?)|\\.local(?:host)?$/i.test(h)) return true;\n        return false;\n      })();\n\n      const existing = Array.from(document.querySelectorAll('iframe.w3a-wallet-overlay')) as HTMLIFrameElement[];\n      const matches = existing.filter((el) => {\n        const dsOrigin = (el as any)?.dataset?.w3aOrigin as string | undefined;\n        if (dsOrigin) return dsOrigin === this.walletOrigin;\n        try { return new URL(el.src).origin === this.walletOrigin; } catch { return false; }\n      });\n\n      if (!matches.length) return;\n\n      if (isDev) {\n        const routerIds = matches\n          .map((el) => (el as any)?.dataset?.w3aRouterId)\n          .filter((v): v is string => typeof v === 'string' && v.length > 0);\n        console.warn(\n          `[IframeTransport] Found existing wallet overlay iframe(s) for ${this.walletOrigin}. This usually indicates multiple SDK instances. Removing old iframe(s) to avoid duplicates.`,\n          { count: matches.length, routerIds }\n        );\n      }\n\n      for (const el of matches) {\n        try { el.remove(); } catch {}\n      }\n    } catch {}\n  }\n\n  /** Ensure the iframe element exists and is appended to the DOM. Idempotent. */\n  ensureIframeMounted(): HTMLIFrameElement {\n    if (this.iframeEl) {\n      return this.iframeEl;\n    }\n\n    this.removeExistingOverlaysForOrigin();\n\n    const iframe = document.createElement('iframe');\n    // Hidden by default via CSS classes; higher layers toggle state using overlay-styles.\n    iframe.classList.add('w3a-wallet-overlay', 'is-hidden');\n    // Ensure the base overlay stylesheet is installed early so computed styles\n    // (opacity/pointer-events) reflect the hidden state immediately after mount.\n    try { ensureOverlayBase(iframe); } catch {}\n    // Ensure no initial footprint even before stylesheet attaches\n    iframe.setAttribute('width', '0');\n    iframe.setAttribute('height', '0');\n    iframe.setAttribute('aria-hidden', 'true');\n    iframe.setAttribute('tabindex', '-1');\n    // Hint higher priority fetch for the iframe document on supporting browsers\n    iframe.setAttribute('loading', 'eager');\n    iframe.setAttribute('fetchpriority', 'high');\n\n    iframe.dataset.w3aRouterId = this.testOptions?.routerId || '';\n    if (this.testOptions?.ownerTag) iframe.dataset.w3aOwner = this.testOptions.ownerTag;\n    iframe.dataset.w3aOrigin = this.walletOrigin;\n\n    // Delegate WebAuthn + clipboard capabilities to the wallet origin frame\n    try {\n      iframe.setAttribute('allow', this.buildAllowAttr(this.walletOrigin));\n    } catch {\n      iframe.setAttribute('allow', \"publickey-credentials-get 'self'; publickey-credentials-create 'self'; clipboard-read; clipboard-write\");\n    }\n\n    // Track load state to guard against races where we post before content is listening\n    iframe._svc_loaded = false;\n    iframe.addEventListener('load', () => { iframe._svc_loaded = true; }, { once: true });\n\n    const src = this.walletServiceUrl.toString();\n    console.debug('[IframeTransport] mount: external origin', src);\n    iframe.src = src;\n\n    document.body.appendChild(iframe);\n    console.debug('[IframeTransport] mount: iframe appended');\n    this.iframeEl = iframe;\n    return iframe;\n  }\n\n  /**\n   * Connect to the wallet iframe using a MessageChannel handshake.\n   * - Repeatedly posts {type:'CONNECT'} with a fresh port until a 'READY' message arrives\n   * - Times out after connectTimeoutMs\n   * - Deduplicates concurrent calls and returns the same MessagePort promise\n   */\n  async connect(): Promise<MessagePort> {\n    if (this.connectInFlight) return this.connectInFlight;\n    this.connectInFlight = (async () => {\n      const iframe = this.ensureIframeMounted();\n\n      // Ensure load fired at least once so the host script can attach listeners\n      await this.waitForLoad(iframe);\n\n      // For cross-origin pages, give the host only a very brief moment to boot its script\n      // Keep this low to avoid adding noticeable latency to the first CONNECT attempt.\n      // The handshake will continue retrying regardless, so a shorter wait improves TTFB.\n      const bootWaitMs = Math.min(this.opts.connectTimeoutMs / 12, 300);\n      const startBoot = Date.now();\n      while (!this.serviceBooted && (Date.now() - startBoot) < bootWaitMs) {\n        await new Promise(r => setTimeout(r, 50));\n      }\n\n      let resolved = false;\n      let attempt = 0;\n      let warnedNullOrigin = false;\n      const start = Date.now();\n      const overallTimeout = this.opts.connectTimeoutMs;\n\n      const port = await new Promise<MessagePort>((resolve, reject) => {\n        const tick = () => {\n          if (resolved) return;\n          const elapsed = Date.now() - start;\n          if (elapsed >= overallTimeout) {\n            console.debug('[IframeTransport] handshake timeout after %d ms', elapsed);\n            return reject(new Error('Wallet iframe READY timeout'));\n          }\n\n          attempt += 1;\n          const channel = new MessageChannel();\n          const port1 = channel.port1;\n          const port2 = channel.port2;\n          const cleanup = () => { try { port1.onmessage = null; } catch {} };\n\n          port1.onmessage = (e: MessageEvent<ChildToParentEnvelope>) => {\n            const data = e.data;\n            if (data.type === IframeMessage.Ready) {\n              resolved = true;\n              cleanup();\n              port1.start?.();\n              return resolve(port1);\n            }\n          };\n\n          // Ensure the receiving side is actively listening before we post the CONNECT\n          try { port1.start?.(); } catch {}\n\n          const cw = iframe.contentWindow;\n          if (!cw) {\n            cleanup();\n            return reject(new Error('Wallet iframe window missing'));\n          }\n          // Explicitly target the wallet origin so Chromium delivers the MessagePort\n          // transfer across origins. Using '*' can silently drop the transferable\n          // port in stricter environments, preventing the host from ever adopting it.\n          //\n          // However, some dev setups (e.g., mDNS/.local + reverse proxy ports) can\n          // result in the iframe document resolving to a slightly different serialized\n          // origin (e.g., host without the expected port). In those cases, the strict\n          // target will never deliver. As a pragmatic fallback for development, we\n          // periodically attempt with '*' so the wallet host can adopt the port and\n          // reply with READY. Subsequent communication uses MessagePort, not window.postMessage.\n          // Try strict origin first, but fall back to '*' more frequently in dev to\n          // avoid stalls when local origins serialize differently (e.g., iOS + mDNS).\n          // Using '*' here only affects this CONNECT; subsequent traffic uses MessagePort.\n          //\n          // Prefer wildcard target until we have observed SERVICE_HOST_BOOTED,\n          // which indicates the iframe has a stable, non-opaque origin and is\n          // ready to adopt a MessagePort. This avoids noisy 'null' origin\n          // warnings while still allowing strict-origin delivery as soon as\n          // the host is booted.\n          const targetOrigin = this.serviceBooted ? this.walletOrigin : '*';\n          ({ warnedNullOrigin } = this.postConnectMessage(\n            cw,\n            { type: IframeMessage.Connect },\n            port2,\n            targetOrigin,\n            warnedNullOrigin,\n            elapsed,\n            attempt,\n          ));\n\n          // Schedule next tick if not resolved yet (light backoff to reduce spam)\n          const interval = attempt < 10 ? 200 : attempt < 20 ? 400 : 800;\n          setTimeout(() => { if (!resolved) tick(); }, interval);\n        };\n\n        tick();\n      });\n\n      return port;\n    })();\n\n    try {\n      return await this.connectInFlight;\n    } finally {\n      this.connectInFlight = null;\n    }\n  }\n\n  private postConnectMessage(\n    cw: Window,\n    data: unknown,\n    port2: MessagePort,\n    targetOrigin: string,\n    warnedNullOrigin: boolean,\n    elapsed: number,\n    attempt: number,\n  ): { warnedNullOrigin: boolean } {\n    try {\n      cw.postMessage(data, targetOrigin, [port2]);\n      return { warnedNullOrigin };\n    } catch (e) {\n      const message = e instanceof Error ? e.message ?? String(e) : String(e);\n      if (!warnedNullOrigin && message.includes(\"'null'\")) {\n        warnedNullOrigin = true;\n        console.warn('[IframeTransport] CONNECT blocked; iframe origin appears to be null. Check that %s is reachable and responds with Cross-Origin-Resource-Policy: cross-origin.', this.walletServiceUrl.toString());\n      }\n      // Attempt wildcard fallback and continue retries\n      try { cw.postMessage(data, '*', [port2]); } catch {}\n      console.debug('[IframeTransport] CONNECT attempt %d threw after %d ms; retrying.', attempt, elapsed);\n      return { warnedNullOrigin };\n    }\n  }\n\n  /** Guard against posting to the iframe before it has fired load. */\n  private async waitForLoad(iframe: HTMLIFrameElement): Promise<void> {\n    if (iframe._svc_loaded) return;\n    await new Promise<void>((resolve) => {\n      try {\n        let timeout: number | undefined;\n        iframe.addEventListener?.('load', () => {\n          if (typeof timeout === 'number') {\n            clearTimeout(timeout);\n          }\n          resolve();\n        }, { once: true });\n        // Safety net: resolve shortly even if load listener fails to attach\n        timeout = window.setTimeout(() => {\n          console.debug('[IframeTransport] waitForLoad did not observe load event within 150ms; continuing');\n          resolve();\n        }, 150);\n      } catch {\n        resolve();\n      }\n    });\n  }\n\n  private buildAllowAttr(walletOrigin: string): string {\n    return `publickey-credentials-get 'self' ${walletOrigin}; publickey-credentials-create 'self' ${walletOrigin}; clipboard-read; clipboard-write`;\n  }\n\n  private postBridgeResult(\n    source: WindowProxy | null,\n    type: 'WALLET_WEBAUTHN_CREATE_RESULT' | 'WALLET_WEBAUTHN_GET_RESULT',\n    requestId: string,\n    ok: boolean,\n    payload: { credential?: unknown; error?: string },\n  ): void {\n    // Reply directly to the requesting window; wildcard target avoids transient\n    // 'null' origin warnings during early navigation while remaining safe since\n    // we already validated the sender's origin before bridging.\n    source?.postMessage({ type, requestId, ok, ...payload }, '*');\n  }\n\n  private performWebAuthnBridge(\n    kind: typeof WebAuthnBridgeMessage.Create | typeof WebAuthnBridgeMessage.Get,\n    raw: unknown,\n    e: MessageEvent,\n  ): void {\n    if (kind === WebAuthnBridgeMessage.Create) {\n      void this.handleWebAuthnCreate(raw as CreateReq, e);\n      return;\n    }\n    // kind === 'WALLET_WEBAUTHN_GET'\n    void this.handleWebAuthnGet(raw as GetReq, e);\n  }\n\n  private async handleWebAuthnCreate(req: CreateReq, e: MessageEvent): Promise<void> {\n    const requestId = req?.requestId || '';\n    try {\n      const src = req?.publicKey || ({} as PublicKeyCredentialCreationOptions);\n      const rpName = src.rp?.name || 'WebAuthn';\n      const rpId = src.rp?.id || window.location.hostname;\n      const pub: PublicKeyCredentialCreationOptions = { ...src, rp: { name: rpName, id: rpId } };\n      console.debug('[IframeTransport][bridge] CREATE received', { requestId, from: e.origin, rpId: pub.rp?.id });\n      const cred = await navigator.credentials.create({ publicKey: pub }) as PublicKeyCredential;\n      const serialized = serializeRegistrationCredentialWithPRF({ credential: cred, firstPrfOutput: true, secondPrfOutput: true });\n      this.postBridgeResult(e.source as WindowProxy | null, WebAuthnBridgeMessage.CreateResult, requestId, true, { credential: serialized });\n      console.debug('[IframeTransport][bridge] CREATE ok', { requestId });\n    } catch (err) {\n      console.warn('[IframeTransport][bridge] CREATE failed', { requestId, err: String((err as Error)?.message || err) });\n      this.postBridgeResult(e.source as WindowProxy | null, WebAuthnBridgeMessage.CreateResult, requestId, false, { error: String((err as Error)?.message || err) });\n    }\n  }\n\n  private async handleWebAuthnGet(req: GetReq, e: MessageEvent): Promise<void> {\n    const requestId = req?.requestId || '';\n    try {\n      const src = req?.publicKey || ({} as PublicKeyCredentialRequestOptions);\n      const rpId = src.rpId || window.location.hostname;\n      const pub: PublicKeyCredentialRequestOptions = { ...src, rpId };\n      console.debug('[IframeTransport][bridge] GET received', { requestId, from: e.origin, rpId: pub.rpId });\n      const cred = await navigator.credentials.get({ publicKey: pub }) as PublicKeyCredential;\n      const serialized = serializeAuthenticationCredentialWithPRF({ credential: cred, firstPrfOutput: true, secondPrfOutput: true });\n      this.postBridgeResult(e.source as WindowProxy | null, WebAuthnBridgeMessage.GetResult, requestId, true, { credential: serialized });\n      console.debug('[IframeTransport][bridge] GET ok', { requestId });\n    } catch (err) {\n      console.warn('[IframeTransport][bridge] GET failed', { requestId, err: String((err as Error)?.message || err) });\n      this.postBridgeResult(e.source as WindowProxy | null, WebAuthnBridgeMessage.GetResult, requestId, false, { error: String((err as Error)?.message || err) });\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;AAmCA,MAAa,gBAAgB;CAC3B,SAAS;CACT,OAAO;CACP,YAAY;CACZ,iBAAiB;CACjB,SAAS;;AAiBX,IAAa,kBAAb,MAA6B;CAC3B,AAAiB;CACjB,AAAQ,WAAqC;CAC7C,AAAQ,gBAAgB;CACxB,AAAQ,kBAA+C;CACvD,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAEjB,YAAY,SAAiC;AAC3C,OAAK,OAAO;GACV,aAAa;GACb,kBAAkB;GAClB,GAAG;;AAGL,MAAI;AACF,QAAK,mBAAmB,IAAI,IAAI,KAAK,KAAK,aAAa,KAAK,KAAK;WAC1D,KAAK;AACZ,SAAM,IAAI,MAAM,4CAA4C,QAAQ,aAAa,oBAAoB,QAAQ,eAAe,kBAAkB;;AAEhJ,OAAK,eAAe,KAAK,iBAAiB;AAC1C,OAAK,cAAc;GACjB,UAAU,QAAQ,aAAa;GAC/B,UAAU,QAAQ,aAAa;;AAKjC,MAAI;AACF,UAAO,iBAAiB,YAAY,MAAM;IACxC,MAAM,OAAO,EAAE;AACf,QAAI,CAACA,4BAAS,MAAO;IACrB,MAAM,OAAQ,KAA4B;AAC1C,QAAI,SAAS,cAAc,cAAc,EAAE,WAAW,KAAK,cAAc;AACvE,UAAK,gBAAgB;AACrB;;AAEF,QAAI,SAAS,cAAc,iBAAiB;AAE5C,QAAI,SAAS,cAAc,QAEzB,SAAQ,MAAM,iCAAkC,KAA+B;AAIjF,QAAI,EAAE,WAAW,KAAK,cACpB;SAAI,SAASC,+CAAsB,UAAU,SAASA,+CAAsB,KAAK;AAE/E,WAAK,sBAAsB,MAAgF,MAAM;AACjH;;;;UAIA;;;CAIV,cAAwC;AAAE,SAAO,KAAK;;;;;;CAMtD,AAAQ,kCAAwC;AAC9C,MAAI;GACF,MAAM,eAAe;IACnB,MAAM,MAAO,YAAoB,SAAS,KAAK;AAC/C,QAAI,OAAO,QAAQ,aAAc,QAAO;IACxC,MAAM,IAAI,OAAO,SAAS,YAAY;AACtC,QAAI,mFAAmF,KAAK,GAAI,QAAO;AACvG,WAAO;;GAGT,MAAM,WAAW,MAAM,KAAK,SAAS,iBAAiB;GACtD,MAAM,UAAU,SAAS,QAAQ,OAAO;IACtC,MAAM,WAAY,IAAY,SAAS;AACvC,QAAI,SAAU,QAAO,aAAa,KAAK;AACvC,QAAI;AAAE,YAAO,IAAI,IAAI,GAAG,KAAK,WAAW,KAAK;YAAsB;AAAE,YAAO;;;AAG9E,OAAI,CAAC,QAAQ,OAAQ;AAErB,OAAI,OAAO;IACT,MAAM,YAAY,QACf,KAAK,OAAQ,IAAY,SAAS,aAClC,QAAQ,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS;AAClE,YAAQ,KACN,iEAAiE,KAAK,aAAa,+FACnF;KAAE,OAAO,QAAQ;KAAQ;;;AAI7B,QAAK,MAAM,MAAM,QACf,KAAI;AAAE,OAAG;WAAkB;UAEvB;;;CAIV,sBAAyC;AACvC,MAAI,KAAK,SACP,QAAO,KAAK;AAGd,OAAK;EAEL,MAAM,SAAS,SAAS,cAAc;AAEtC,SAAO,UAAU,IAAI,sBAAsB;AAG3C,MAAI;AAAE,4CAAkB;UAAiB;AAEzC,SAAO,aAAa,SAAS;AAC7B,SAAO,aAAa,UAAU;AAC9B,SAAO,aAAa,eAAe;AACnC,SAAO,aAAa,YAAY;AAEhC,SAAO,aAAa,WAAW;AAC/B,SAAO,aAAa,iBAAiB;AAErC,SAAO,QAAQ,cAAc,KAAK,aAAa,YAAY;AAC3D,MAAI,KAAK,aAAa,SAAU,QAAO,QAAQ,WAAW,KAAK,YAAY;AAC3E,SAAO,QAAQ,YAAY,KAAK;AAGhC,MAAI;AACF,UAAO,aAAa,SAAS,KAAK,eAAe,KAAK;UAChD;AACN,UAAO,aAAa,SAAS;;AAI/B,SAAO,cAAc;AACrB,SAAO,iBAAiB,cAAc;AAAE,UAAO,cAAc;KAAS,EAAE,MAAM;EAE9E,MAAM,MAAM,KAAK,iBAAiB;AAClC,UAAQ,MAAM,4CAA4C;AAC1D,SAAO,MAAM;AAEb,WAAS,KAAK,YAAY;AAC1B,UAAQ,MAAM;AACd,OAAK,WAAW;AAChB,SAAO;;;;;;;;CAST,MAAM,UAAgC;AACpC,MAAI,KAAK,gBAAiB,QAAO,KAAK;AACtC,OAAK,mBAAmB,YAAY;GAClC,MAAM,SAAS,KAAK;AAGpB,SAAM,KAAK,YAAY;GAKvB,MAAM,aAAa,KAAK,IAAI,KAAK,KAAK,mBAAmB,IAAI;GAC7D,MAAM,YAAY,KAAK;AACvB,UAAO,CAAC,KAAK,iBAAkB,KAAK,QAAQ,YAAa,WACvD,OAAM,IAAI,SAAQ,MAAK,WAAW,GAAG;GAGvC,IAAI,WAAW;GACf,IAAI,UAAU;GACd,IAAI,mBAAmB;GACvB,MAAM,QAAQ,KAAK;GACnB,MAAM,iBAAiB,KAAK,KAAK;GAEjC,MAAM,OAAO,MAAM,IAAI,SAAsB,SAAS,WAAW;IAC/D,MAAM,aAAa;AACjB,SAAI,SAAU;KACd,MAAM,UAAU,KAAK,QAAQ;AAC7B,SAAI,WAAW,gBAAgB;AAC7B,cAAQ,MAAM,mDAAmD;AACjE,aAAO,uBAAO,IAAI,MAAM;;AAG1B,gBAAW;KACX,MAAM,UAAU,IAAI;KACpB,MAAM,QAAQ,QAAQ;KACtB,MAAM,QAAQ,QAAQ;KACtB,MAAM,gBAAgB;AAAE,UAAI;AAAE,aAAM,YAAY;cAAc;;AAE9D,WAAM,aAAa,MAA2C;MAC5D,MAAM,OAAO,EAAE;AACf,UAAI,KAAK,SAAS,cAAc,OAAO;AACrC,kBAAW;AACX;AACA,aAAM;AACN,cAAO,QAAQ;;;AAKnB,SAAI;AAAE,YAAM;aAAmB;KAE/B,MAAM,KAAK,OAAO;AAClB,SAAI,CAAC,IAAI;AACP;AACA,aAAO,uBAAO,IAAI,MAAM;;KAqB1B,MAAM,eAAe,KAAK,gBAAgB,KAAK,eAAe;AAC9D,MAAC,CAAE,oBAAqB,KAAK,mBAC3B,IACA,EAAE,MAAM,cAAc,WACtB,OACA,cACA,kBACA,SACA;KAIF,MAAM,WAAW,UAAU,KAAK,MAAM,UAAU,KAAK,MAAM;AAC3D,sBAAiB;AAAE,UAAI,CAAC,SAAU;QAAW;;AAG/C;;AAGF,UAAO;;AAGT,MAAI;AACF,UAAO,MAAM,KAAK;YACV;AACR,QAAK,kBAAkB;;;CAI3B,AAAQ,mBACN,IACA,MACA,OACA,cACA,kBACA,SACA,SAC+B;AAC/B,MAAI;AACF,MAAG,YAAY,MAAM,cAAc,CAAC;AACpC,UAAO,EAAE;WACF,GAAG;GACV,MAAM,UAAU,aAAa,QAAQ,EAAE,WAAW,OAAO,KAAK,OAAO;AACrE,OAAI,CAAC,oBAAoB,QAAQ,SAAS,WAAW;AACnD,uBAAmB;AACnB,YAAQ,KAAK,iKAAiK,KAAK,iBAAiB;;AAGtM,OAAI;AAAE,OAAG,YAAY,MAAM,KAAK,CAAC;WAAiB;AAClD,WAAQ,MAAM,qEAAqE,SAAS;AAC5F,UAAO,EAAE;;;;CAKb,MAAc,YAAY,QAA0C;AAClE,MAAI,OAAO,YAAa;AACxB,QAAM,IAAI,SAAe,YAAY;AACnC,OAAI;IACF,IAAIC;AACJ,WAAO,mBAAmB,cAAc;AACtC,SAAI,OAAO,YAAY,SACrB,cAAa;AAEf;OACC,EAAE,MAAM;AAEX,cAAU,OAAO,iBAAiB;AAChC,aAAQ,MAAM;AACd;OACC;WACG;AACN;;;;CAKN,AAAQ,eAAe,cAA8B;AACnD,SAAO,oCAAoC,aAAa,wCAAwC,aAAa;;CAG/G,AAAQ,iBACN,QACA,MACA,WACA,IACA,SACM;AAIN,UAAQ,YAAY;GAAE;GAAM;GAAW;GAAI,GAAG;KAAW;;CAG3D,AAAQ,sBACN,MACA,KACA,GACM;AACN,MAAI,SAASD,+CAAsB,QAAQ;AACzC,GAAK,KAAK,qBAAqB,KAAkB;AACjD;;AAGF,EAAK,KAAK,kBAAkB,KAAe;;CAG7C,MAAc,qBAAqB,KAAgB,GAAgC;EACjF,MAAM,YAAY,KAAK,aAAa;AACpC,MAAI;GACF,MAAM,MAAM,KAAK,aAAc;GAC/B,MAAM,SAAS,IAAI,IAAI,QAAQ;GAC/B,MAAM,OAAO,IAAI,IAAI,MAAM,OAAO,SAAS;GAC3C,MAAME,MAA0C;IAAE,GAAG;IAAK,IAAI;KAAE,MAAM;KAAQ,IAAI;;;AAClF,WAAQ,MAAM,6CAA6C;IAAE;IAAW,MAAM,EAAE;IAAQ,MAAM,IAAI,IAAI;;GACtG,MAAM,OAAO,MAAM,UAAU,YAAY,OAAO,EAAE,WAAW;GAC7D,MAAM,aAAaC,kEAAuC;IAAE,YAAY;IAAM,gBAAgB;IAAM,iBAAiB;;AACrH,QAAK,iBAAiB,EAAE,QAA8BH,+CAAsB,cAAc,WAAW,MAAM,EAAE,YAAY;AACzH,WAAQ,MAAM,uCAAuC,EAAE;WAChD,KAAK;AACZ,WAAQ,KAAK,2CAA2C;IAAE;IAAW,KAAK,OAAQ,KAAe,WAAW;;AAC5G,QAAK,iBAAiB,EAAE,QAA8BA,+CAAsB,cAAc,WAAW,OAAO,EAAE,OAAO,OAAQ,KAAe,WAAW;;;CAI3J,MAAc,kBAAkB,KAAa,GAAgC;EAC3E,MAAM,YAAY,KAAK,aAAa;AACpC,MAAI;GACF,MAAM,MAAM,KAAK,aAAc;GAC/B,MAAM,OAAO,IAAI,QAAQ,OAAO,SAAS;GACzC,MAAMI,MAAyC;IAAE,GAAG;IAAK;;AACzD,WAAQ,MAAM,0CAA0C;IAAE;IAAW,MAAM,EAAE;IAAQ,MAAM,IAAI;;GAC/F,MAAM,OAAO,MAAM,UAAU,YAAY,IAAI,EAAE,WAAW;GAC1D,MAAM,aAAaC,oEAAyC;IAAE,YAAY;IAAM,gBAAgB;IAAM,iBAAiB;;AACvH,QAAK,iBAAiB,EAAE,QAA8BL,+CAAsB,WAAW,WAAW,MAAM,EAAE,YAAY;AACtH,WAAQ,MAAM,oCAAoC,EAAE;WAC7C,KAAK;AACZ,WAAQ,KAAK,wCAAwC;IAAE;IAAW,KAAK,OAAQ,KAAe,WAAW;;AACzG,QAAK,iBAAiB,EAAE,QAA8BA,+CAAsB,WAAW,WAAW,OAAO,EAAE,OAAO,OAAQ,KAAe,WAAW"}