@tatchi-xyz/sdk 0.21.0 → 0.31.1

package/dist/cjs/server/core/AuthService.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthService.js","names":["resolved: URL[]","createAuthServiceConfig","normalizeLogger","ShamirService","MinimalNearClient","EmailRecoveryService","DEFAULT_EMAIL_RECOVERY_CONTRACTS","formatYoctoToNear","formatGasToTGas","parseNearSecretKey","toPublicKeyString","candidates: URL[]","lastError: unknown","module","actions: ActionArgsWasm[]","ActionType","validateActionArgsWasm","error: any","parseContractExecutionError","list: string[]","lastErr: any","executeSignedDelegateWithRelayer","WorkerRequestType","SignedTransaction","body: VerifyAuthenticationRequest","WorkerResponseType"],"sources":["../../../../src/server/core/AuthService.ts"],"sourcesContent":["import { ActionType, type ActionArgsWasm, validateActionArgsWasm } from '../../core/types/actions';\nimport { MinimalNearClient, SignedTransaction } from '../../core/NearClient';\nimport { parseNearSecretKey, toPublicKeyString } from '../../core/nearCrypto';\nimport { createAuthServiceConfig } from './config';\nimport { formatGasToTGas, formatYoctoToNear } from './utils';\nimport { parseContractExecutionError } from './errors';\n\nimport initSignerWasm, {\n  handle_signer_message,\n  WorkerRequestType,\n  WorkerResponseType,\n  type InitInput,\n  type WasmTransaction,\n  type WasmSignature,\n} from '../../wasm_signer_worker/pkg/wasm_signer_worker.js';\n\nimport type {\n  AuthServiceConfig,\n  AuthServiceConfigInput,\n  AccountCreationRequest,\n  AccountCreationResult,\n  CreateAccountAndRegisterRequest,\n  CreateAccountAndRegisterResult,\n  VerifyAuthenticationRequest,\n  VerifyAuthenticationResponse,\n  SignerWasmModuleSupplier,\n} from './types';\n\nimport { DEFAULT_EMAIL_RECOVERY_CONTRACTS } from '../../core/defaultConfigs';\nimport { EmailRecoveryService } from '../email-recovery';\nimport { ShamirService } from './ShamirService';\nimport { SignedDelegate } from '../../core/types/delegate';\nimport {\n  type ExecuteSignedDelegateResult,\n  executeSignedDelegateWithRelayer,\n  type DelegateActionPolicy,\n} from '../delegateAction';\nimport { normalizeLogger, type NormalizedLogger } from './logger';\n\n// =============================\n// WASM URL CONSTANTS + HELPERS\n// =============================\n\n// Primary location (preserveModules output)\nconst SIGNER_WASM_MAIN_PATH = '../../wasm_signer_worker/pkg/wasm_signer_worker_bg.wasm';\n// Fallback location (dist/workers copy step)\nconst SIGNER_WASM_FALLBACK_PATH = '../../../workers/wasm_signer_worker_bg.wasm';\n\nfunction getSignerWasmUrls(logger: NormalizedLogger): URL[] {\n  const paths = [SIGNER_WASM_MAIN_PATH, SIGNER_WASM_FALLBACK_PATH];\n  const resolved: URL[] = [];\n  const baseUrl = import.meta.url;\n\n  for (const path of paths) {\n    try {\n      if (!baseUrl) throw new Error('import.meta.url is undefined');\n      resolved.push(new URL(path, baseUrl));\n    } catch (err) {\n      logger.warn(`Failed to resolve signer WASM relative URL for path \"${path}\":`, err);\n    }\n  }\n\n  if (!resolved.length) {\n    throw new Error('Unable to resolve signer WASM location from import.meta.url. Provide AuthServiceConfig.signerWasm.moduleOrPath in this runtime.');\n  }\n\n  return resolved;\n}\n\n/**\n * Framework-agnostic NEAR account service\n * Core business logic for account creation and registration operations\n */\nexport class AuthService {\n  private config: AuthServiceConfig;\n  private isInitialized = false;\n  private nearClient: MinimalNearClient;\n  private relayerPublicKey: string = '';\n  private signerWasmReady = false;\n  private readonly logger: NormalizedLogger;\n\n  // Transaction queue to prevent nonce conflicts\n  private transactionQueue: Promise<any> = Promise.resolve();\n  private queueStats = { pending: 0, completed: 0, failed: 0 };\n\n  // Shamir 3-pass key management (delegated to ShamirService)\n  public readonly shamirService: ShamirService | null = null;\n  // DKIM/TEE email recovery logic (delegated to EmailRecoveryService)\n  public readonly emailRecovery: EmailRecoveryService | null = null;\n\n  constructor(config: AuthServiceConfigInput) {\n    this.config = createAuthServiceConfig(config);\n    this.logger = normalizeLogger(this.config.logger);\n    const graceFileCandidate = (this.config.shamir?.graceShamirKeysFile || '').trim();\n    this.shamirService = new ShamirService(this.config.shamir, graceFileCandidate || 'grace-keys.json');\n    this.nearClient = new MinimalNearClient(this.config.nearRpcUrl);\n    this.emailRecovery = new EmailRecoveryService({\n      relayerAccountId: this.config.relayerAccountId,\n      relayerPrivateKey: this.config.relayerPrivateKey,\n      networkId: this.config.networkId,\n      emailDkimVerifierContract: DEFAULT_EMAIL_RECOVERY_CONTRACTS.emailDkimVerifierContract,\n      nearClient: this.nearClient,\n      logger: this.config.logger,\n      ensureSignerAndRelayerAccount: () => this._ensureSignerAndRelayerAccount(),\n      queueTransaction: <T>(fn: () => Promise<T>, label: string) => this.queueTransaction(fn, label),\n      fetchTxContext: (accountId: string, publicKey: string) => this.fetchTxContext(accountId, publicKey),\n      signWithPrivateKey: (input) => this.signWithPrivateKey(input),\n      getRelayerPublicKey: () => this.relayerPublicKey,\n      zkEmailProver: this.config.zkEmailProver,\n    });\n\n    // Log effective configuration at construction time so operators can\n    // verify wiring immediately when the service is created.\n    this.logger.info(`\n    AuthService initialized with:\n    • networkId: ${this.config.networkId}\n    • nearRpcUrl: ${this.config.nearRpcUrl}\n    • relayerAccountId: ${this.config.relayerAccountId}\n    • webAuthnContractId: ${this.config.webAuthnContractId}\n    • accountInitialBalance: ${this.config.accountInitialBalance} (${formatYoctoToNear(this.config.accountInitialBalance)} NEAR)\n    • createAccountAndRegisterGas: ${this.config.createAccountAndRegisterGas} (${formatGasToTGas(this.config.createAccountAndRegisterGas)})\n    ${\n      this.config.shamir\n        ? `• shamir_p_b64u: ${this.config.shamir.shamir_p_b64u.slice(0, 10)}...\\n    • shamir_e_s_b64u: ${this.config.shamir.shamir_e_s_b64u.slice(0, 10)}...\\n    • shamir_d_s_b64u: ${this.config.shamir.shamir_d_s_b64u.slice(0, 10)}...`\n        : '• shamir: not configured'\n    }\n    ${\n      this.config.zkEmailProver?.baseUrl\n        ? `• zkEmailProver: ${this.config.zkEmailProver.baseUrl}`\n        : `• zkEmailProver: not configured`\n    }\n    `);\n  }\n\n  async getRelayerAccount(): Promise<{ accountId: string; publicKey: string }> {\n    await this._ensureSignerAndRelayerAccount();\n    return {\n      accountId: this.config.relayerAccountId,\n      publicKey: this.relayerPublicKey\n    };\n  }\n\n  /**\n   * Configure Shamir WASM module override for serverless environments\n   * Required for Cloudflare Workers where import.meta.url doesn't work\n   */\n  private async configureShamirWasmForServerless(): Promise<void> {\n    if (!this.config.shamir?.moduleOrPath) {\n      return;\n    }\n\n    const { setShamirWasmModuleOverride } = await import('./shamirWorker.js');\n    setShamirWasmModuleOverride(this.config.shamir.moduleOrPath);\n  }\n\n  private async _ensureSignerAndRelayerAccount(): Promise<void> {\n    if (this.isInitialized) {\n      return;\n    }\n\n    // Initialize Shamir 3-pass via ShamirService (if configured)\n    if (this.config.shamir && this.shamirService) {\n      await this.configureShamirWasmForServerless();\n      await this.shamirService.ensureReady();\n    }\n\n    // Derive public key from configured relayer private key\n    try {\n      const { seed, pub } = parseNearSecretKey(this.config.relayerPrivateKey);\n      this.relayerPublicKey = toPublicKeyString(pub);\n    } catch (e) {\n      this.logger.warn('Failed to derive public key from relayerPrivateKey; ensure it is in ed25519:<base58> format');\n      this.relayerPublicKey = '';\n    }\n\n    // Prepare signer WASM for transaction building/signing\n    await this.ensureSignerWasm();\n    this.isInitialized = true;\n  }\n\n  private async ensureSignerWasm(): Promise<void> {\n    if (this.signerWasmReady) return;\n    const override = this.config.signerWasm?.moduleOrPath;\n    if (override) {\n      try {\n        const moduleOrPath = await this.resolveSignerWasmOverride(override);\n        await initSignerWasm({ module_or_path: moduleOrPath as InitInput });\n        this.signerWasmReady = true;\n        return;\n      } catch (e) {\n        this.logger.error('Failed to initialize signer WASM via provided override:', e);\n        throw e;\n      }\n    }\n\n    let candidates: URL[];\n    try {\n      candidates = getSignerWasmUrls(this.logger);\n    } catch (err) {\n      this.logger.error('Failed to resolve signer WASM URLs:', err);\n      throw err;\n    }\n\n    try {\n      if (this.isNodeEnvironment()) {\n        await this.initSignerWasmForNode(candidates);\n        this.signerWasmReady = true;\n        return;\n      }\n\n      let lastError: unknown = null;\n      for (const candidate of candidates) {\n        try {\n          await initSignerWasm({ module_or_path: candidate as InitInput });\n          this.signerWasmReady = true;\n          return;\n        } catch (err) {\n          lastError = err;\n          this.logger.warn(`Failed to initialize signer WASM from ${candidate.toString()}, trying next candidate...`);\n        }\n      }\n\n      throw lastError ?? new Error('Unable to initialize signer WASM from any candidate URL');\n    } catch (e) {\n      this.logger.error('Failed to initialize signer WASM:', e);\n      throw e instanceof Error ? e : new Error(String(e));\n    }\n  }\n\n  private isNodeEnvironment(): boolean {\n    // Detect true Node.js, not Cloudflare Workers with nodejs_compat polyfills.\n    const isNode = Boolean((globalThis as any).process?.versions?.node);\n    // Cloudflare Workers expose WebSocketPair and may polyfill process.\n    const isCloudflareWorker = typeof (globalThis as any).WebSocketPair !== 'undefined'\n      || (typeof navigator !== 'undefined' && (navigator as any).userAgent?.includes?.('Cloudflare-Workers'));\n    return isNode && !isCloudflareWorker;\n  }\n\n  private async resolveSignerWasmOverride(override: SignerWasmModuleSupplier): Promise<InitInput> {\n    const candidate = typeof override === 'function'\n      ? await (override as () => InitInput | Promise<InitInput>)()\n      : await override;\n\n    if (!candidate) {\n      throw new Error('Signer WASM override resolved to an empty value');\n    }\n\n    return candidate;\n  }\n\n  /**\n   * Initialize signer WASM in Node by loading the wasm file from disk.\n   * Tries multiple candidate locations and falls back to path-based init if needed.\n   */\n  private async initSignerWasmForNode(candidates: URL[]): Promise<void> {\n    const { fileURLToPath } = await import('node:url');\n    const { readFile } = await import('node:fs/promises');\n\n    // 1) Try reading and compiling bytes\n    for (const url of candidates) {\n      try {\n        const filePath = fileURLToPath(url);\n        const bytes = await readFile(filePath);\n        // Ensure we pass an ArrayBuffer, not a Node Buffer (type mismatch)\n        const u8 = bytes instanceof Uint8Array ? new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength) : new Uint8Array(bytes as any);\n        const ab = u8.buffer.slice(u8.byteOffset, u8.byteOffset + u8.byteLength);\n        const module = await WebAssembly.compile(ab as ArrayBuffer);\n        await initSignerWasm({ module_or_path: module as any });\n        return;\n      } catch {} // throw at end of function\n    }\n\n    // 2) Fallback: pass file path directly (supported in some environments)\n    for (const url of candidates) {\n      try {\n        const filePath = fileURLToPath(url);\n        await initSignerWasm({ module_or_path: filePath as any });\n        return;\n      } catch {} // throw at end of function\n    }\n\n    throw new Error('[AuthService] Failed to initialize signer WASM from filesystem candidates');\n  }\n\n  /**\n   * ===== Registration & authentication =====\n   *\n   * Helpers for creating accounts, registering WebAuthn credentials,\n   * and verifying authentication responses.\n   */\n\n  /**\n   * Create a new account with the specified balance\n   */\n  async createAccount(request: AccountCreationRequest): Promise<AccountCreationResult> {\n    await this._ensureSignerAndRelayerAccount();\n\n    return this.queueTransaction(async () => {\n      try {\n        if (!this.isValidAccountId(request.accountId)) {\n          throw new Error(`Invalid account ID format: ${request.accountId}`);\n        }\n\n        // Check if account already exists\n        this.logger.info(`Checking if account ${request.accountId} already exists...`);\n        const accountExists = await this.checkAccountExists(request.accountId);\n        if (accountExists) {\n          throw new Error(`Account ${request.accountId} already exists. Cannot create duplicate account.`);\n        }\n        this.logger.info(`Account ${request.accountId} is available for creation`);\n\n        const initialBalance = this.config.accountInitialBalance;\n\n        this.logger.info(`Creating account: ${request.accountId}`);\n        this.logger.info(`Initial balance: ${initialBalance} yoctoNEAR`);\n\n        // Build actions for CreateAccount + Transfer + AddKey(FullAccess)\n        const actions: ActionArgsWasm[] = [\n          { action_type: ActionType.CreateAccount },\n          { action_type: ActionType.Transfer, deposit: initialBalance },\n          {\n            action_type: ActionType.AddKey,\n            public_key: request.publicKey,\n            access_key: JSON.stringify({\n              nonce: 0,\n              permission: { FullAccess: {} },\n            }),\n          }\n        ];\n\n        actions.forEach(validateActionArgsWasm);\n\n        // Fetch nonce and block hash for relayer\n        const { nextNonce, blockHash } = await this.fetchTxContext(this.config.relayerAccountId, this.relayerPublicKey);\n\n        // Sign with relayer private key using WASM\n        const signed = await this.signWithPrivateKey({\n          nearPrivateKey: this.config.relayerPrivateKey,\n          signerAccountId: this.config.relayerAccountId,\n          receiverId: request.accountId,\n          nonce: nextNonce,\n          blockHash: blockHash,\n          actions\n        });\n\n        // Broadcast transaction via MinimalNearClient using a strongly typed SignedTransaction\n        const result = await this.nearClient.sendTransaction(signed);\n\n        this.logger.info(`Account creation completed: ${result.transaction.hash}`);\n        const nearAmount = (Number(BigInt(initialBalance)) / 1e24).toFixed(6);\n        return {\n          success: true,\n          transactionHash: result.transaction.hash,\n          accountId: request.accountId,\n          message: `Account ${request.accountId} created with ${nearAmount} NEAR initial balance`\n        };\n\n      } catch (error: any) {\n        this.logger.error(`Account creation failed for ${request.accountId}:`, error);\n        return {\n          success: false,\n          error: error.message || 'Unknown account creation error',\n          message: `Failed to create account ${request.accountId}: ${error.message}`\n        };\n      }\n    }, `create account ${request.accountId}`);\n  }\n\n  /**\n   * Create account and register user with WebAuthn in a single atomic transaction\n   */\n  async createAccountAndRegisterUser(request: CreateAccountAndRegisterRequest): Promise<CreateAccountAndRegisterResult> {\n    await this._ensureSignerAndRelayerAccount();\n\n    return this.queueTransaction(async () => {\n      try {\n        if (!this.isValidAccountId(request.new_account_id)) {\n          throw new Error(`Invalid account ID format: ${request.new_account_id}`);\n        }\n\n        // Check if account already exists\n        this.logger.info(`Checking if account ${request.new_account_id} already exists...`);\n        const accountExists = await this.checkAccountExists(request.new_account_id);\n        if (accountExists) {\n          throw new Error(`Account ${request.new_account_id} already exists. Cannot create duplicate account.`);\n        }\n        this.logger.info(`Account ${request.new_account_id} is available for atomic creation and registration`);\n        this.logger.info(`Registering account: ${request.new_account_id}`);\n        this.logger.info(`Contract: ${this.config.webAuthnContractId}`);\n\n        // Prepare contract arguments\n        const contractArgs = {\n          new_account_id: request.new_account_id,\n          new_public_key: request.new_public_key,\n          vrf_data: request.vrf_data,\n          webauthn_registration: request.webauthn_registration,\n          deterministic_vrf_public_key: request.deterministic_vrf_public_key,\n          authenticator_options: request.authenticator_options,\n        };\n\n        // Build single FunctionCall action\n        const actions: ActionArgsWasm[] = [\n          {\n            action_type: ActionType.FunctionCall,\n            method_name: 'create_account_and_register_user',\n            args: JSON.stringify(contractArgs),\n            gas: this.config.createAccountAndRegisterGas,\n            deposit: this.config.accountInitialBalance\n          }\n        ];\n        actions.forEach(validateActionArgsWasm);\n\n        const { nextNonce, blockHash } = await this.fetchTxContext(this.config.relayerAccountId, this.relayerPublicKey);\n        const signed = await this.signWithPrivateKey({\n          nearPrivateKey: this.config.relayerPrivateKey,\n          signerAccountId: this.config.relayerAccountId,\n          receiverId: this.config.webAuthnContractId,\n          nonce: nextNonce,\n          blockHash,\n          actions\n        });\n        const result = await this.nearClient.sendTransaction(signed);\n\n        // Parse contract execution results to detect failures\n        const contractError = parseContractExecutionError(result, request.new_account_id);\n        if (contractError) {\n          this.logger.error(`Contract execution failed for ${request.new_account_id}:`, contractError);\n          throw new Error(contractError);\n        }\n\n        this.logger.info(`Registration completed: ${result.transaction.hash}`);\n        return {\n          success: true,\n          transactionHash: result.transaction.hash,\n          message: `Account ${request.new_account_id} created and registered successfully`,\n          contractResult: result,\n        };\n\n      } catch (error: any) {\n        this.logger.error(`Atomic registration failed for ${request.new_account_id}:`, error);\n        return {\n          success: false,\n          error: error.message || 'Unknown atomic registration error',\n          message: `Failed to create and register account ${request.new_account_id}: ${error.message}`\n        };\n      }\n    }, `atomic create and register ${request.new_account_id}`);\n  }\n\n  /**\n   * Verify authentication response and issue JWT (VIEW call)\n   * Calls the web3authn contract's verify_authentication_response method via view\n   * and issues a JWT or session credential upon successful verification\n   */\n  async verifyAuthenticationResponse(\n    request: VerifyAuthenticationRequest\n  ): Promise<VerifyAuthenticationResponse> {\n    try {\n      await this._ensureSignerAndRelayerAccount();\n\n      const args = {\n        vrf_data: request.vrf_data,\n        webauthn_authentication: request.webauthn_authentication,\n      };\n\n      // Perform a VIEW function call (no gas) and parse the contract response\n      const contractResponse = await this.nearClient.view<typeof args, any>({\n        account: this.config.webAuthnContractId,\n        method: 'verify_authentication_response',\n        args\n      });\n\n      const verified = Boolean((contractResponse && (contractResponse.verified === true)));\n      if (!verified) {\n        return {\n          success: false,\n          verified: false,\n          code: 'not_verified',\n          message: 'Authentication verification failed',\n          contractResponse,\n        };\n      }\n\n      return {\n        success: true,\n        verified: true,\n        sessionCredential: {\n          userId: request.vrf_data.user_id,\n          issuedAt: new Date().toISOString(),\n          expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString(),\n        },\n        contractResponse,\n      };\n    } catch (error: any) {\n      return {\n        success: false,\n        verified: false,\n        code: 'internal',\n        message: error?.message || 'Verification failed',\n      };\n    }\n  }\n\n  /**\n   * Fetch Related Origin Requests (ROR) allowed origins from a NEAR view method.\n   * Defaults: contractId = webAuthnContractId, method = 'get_allowed_origins', args = {}.\n   * Returns a sanitized, deduplicated list of absolute origins.\n   */\n  public async getRorOrigins(opts?: { contractId?: string; method?: string; args?: any }): Promise<string[]> {\n    const contractId = (opts?.contractId || this.config.webAuthnContractId).trim();\n    const method = (opts?.method || 'get_allowed_origins').trim();\n    const args = opts?.args ?? {};\n\n    const isValidOrigin = (s: unknown): string | null => {\n      if (typeof s !== 'string' || !s) return null;\n      try {\n        const u = new URL(s.trim());\n        const scheme = u.protocol;\n        const host = u.hostname.toLowerCase();\n        const port = u.port ? `:${u.port}` : '';\n        if (scheme !== 'https:' && !(scheme === 'http:' && host === 'localhost')) return null;\n        if ((u.pathname && u.pathname !== '/') || u.search || u.hash) return null;\n        return `${scheme}//${host}${port}`;\n      } catch { return null; }\n    };\n\n    try {\n      const result = await this.nearClient.view<{ } , unknown>({ account: contractId, method, args });\n      let list: string[] = [];\n      if (Array.isArray(result)) {\n        list = result as string[];\n      } else if (result && typeof result === 'object' && Array.isArray((result as any).origins)) {\n        list = (result as any).origins as string[];\n      }\n      const out = new Set<string>();\n      for (const item of list) {\n        const norm = isValidOrigin(item);\n        if (norm) out.add(norm);\n      }\n      return Array.from(out);\n    } catch (e) {\n      this.logger.warn('[AuthService] getRorOrigins failed:', e);\n      return [];\n    }\n  }\n\n  private isValidAccountId(accountId: string): boolean {\n    if (!accountId || accountId.length < 2 || accountId.length > 64) {\n      return false;\n    }\n    const validPattern = /^[a-z0-9_.-]+$/;\n    return validPattern.test(accountId);\n  }\n\n  /**\n   * Account existence helper used by registration flows.\n   */\n  async checkAccountExists(accountId: string): Promise<boolean> {\n    await this._ensureSignerAndRelayerAccount();\n    const isNotFound = (m: string) => /does not exist|UNKNOWN_ACCOUNT|unknown\\s+account/i.test(m);\n    const isRetryable = (m: string) => /server error|internal|temporar|timeout|too many requests|429|empty response|rpc request failed/i.test(m);\n    const attempts = 3;\n    let lastErr: any = null;\n    for (let i = 1; i <= attempts; i++) {\n      try {\n        const view = await this.nearClient.viewAccount(accountId);\n        return !!view;\n      } catch (error: any) {\n        lastErr = error;\n        const msg = String(error?.message || '');\n        // Some providers embed the useful string only inside a nested JSON `details` object.\n        // Normalize both message and details (if available) into one searchable blob.\n        const detailsBlob = (() => {\n          try {\n            const d = (error && typeof error === 'object' && 'details' in error) ? (error as any).details : undefined;\n            if (!d) return '';\n            return typeof d === 'string' ? d : JSON.stringify(d);\n          } catch { return ''; }\n        })();\n        const combined = `${msg}\\n${detailsBlob}`;\n        if (isNotFound(combined)) return false;\n        if (isRetryable(msg) && i < attempts) {\n          const backoff = 150 * Math.pow(2, i - 1);\n          await new Promise((r) => setTimeout(r, backoff));\n          continue;\n        }\n        // As a safety valve for flaky RPCs, treat persistent retryable errors as not-found\n        if (isRetryable(msg)) {\n          this.logger.warn(`[AuthService] Assuming account '${accountId}' not found after retryable RPC errors:`, msg);\n          return false;\n        }\n        this.logger.error(`Error checking account existence for ${accountId}:`, error);\n        throw error;\n      }\n    }\n    throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));\n  }\n\n  /**\n   * ===== Delegate actions & transaction execution =====\n   *\n   * Flows that build and submit on-chain transactions, including NEP-461\n   * SignedDelegate meta-transactions.\n   */\n\n  /**\n   * Execute a NEP-461 SignedDelegate by wrapping it in an outer transaction\n   * from the relayer account. This method is intended to be called by\n   * example relayers (Node/Cloudflare) once a SignedDelegate has been\n   * produced by the signer worker and returned to the application.\n   *\n   * Notes:\n   * - Signature and hash computation are performed by the signer worker.\n   *   This method focuses on expiry/policy enforcement and meta-tx submission.\n   * - Nonce/replay protection is left to the integrator; see docs for guidance.\n   */\n  async executeSignedDelegate(input: {\n    hash: string;\n    signedDelegate: SignedDelegate;\n    policy?: DelegateActionPolicy;\n  }): Promise<ExecuteSignedDelegateResult> {\n    await this._ensureSignerAndRelayerAccount();\n\n    if (!input?.hash || !input?.signedDelegate) {\n      return {\n        ok: false,\n        code: 'invalid_delegate_request',\n        error: 'hash and signedDelegate are required',\n      };\n    }\n\n    const senderId = input.signedDelegate?.delegateAction?.senderId ?? 'unknown-sender';\n\n    return this.queueTransaction(\n      () => executeSignedDelegateWithRelayer({\n        nearClient: this.nearClient,\n        relayerAccountId: this.config.relayerAccountId,\n        relayerPublicKey: this.relayerPublicKey,\n        relayerPrivateKey: this.config.relayerPrivateKey,\n        hash: input.hash,\n        signedDelegate: input.signedDelegate,\n        signWithPrivateKey: (args) => this.signWithPrivateKey(args),\n      }),\n      `execute signed delegate for ${senderId}`,\n    );\n  }\n\n  // === Internal helpers for signing & RPC ===\n  private async fetchTxContext(accountId: string, publicKey: string): Promise<{ nextNonce: string; blockHash: string }> {\n    // Access key (if missing, assume nonce=0)\n    let nonce = 0n;\n    try {\n      const ak = await this.nearClient.viewAccessKey(accountId, publicKey);\n      nonce = BigInt(ak?.nonce ?? 0);\n    } catch {\n      nonce = 0n;\n    }\n    // Block\n    const block = await this.nearClient.viewBlock({ finality: 'final' });\n    const txBlockHash = block.header.hash;\n    const nextNonce = (nonce + 1n).toString();\n    return { nextNonce, blockHash: txBlockHash };\n  }\n\n  private async signWithPrivateKey(input: {\n    nearPrivateKey: string;\n    signerAccountId: string;\n    receiverId: string;\n    nonce: string;\n    blockHash: string;\n    actions: ActionArgsWasm[];\n  }): Promise<SignedTransaction> {\n    await this.ensureSignerWasm();\n    const message = {\n      type: WorkerRequestType.SignTransactionWithKeyPair,\n      payload: {\n        nearPrivateKey: input.nearPrivateKey,\n        signerAccountId: input.signerAccountId,\n        receiverId: input.receiverId,\n        nonce: input.nonce,\n        blockHash: input.blockHash,\n        actions: input.actions\n      }\n    };\n    // uses wasm signer worker's SignTransactionWithKeyPair action,\n    // which doesn't require VRF worker session\n    const response = await handle_signer_message(message);\n    const {\n      transaction,\n      signature,\n      borshBytes\n    } = extractFirstSignedTransactionFromWorkerResponse(response);\n\n    return new SignedTransaction({\n      transaction: transaction,\n      signature: signature,\n      borsh_bytes: borshBytes,\n    });\n  }\n\n  /**\n   * Framework-agnostic: handle verify-authentication request\n   * Converts a generic ServerRequest to ServerResponse using this service\n   */\n  async handleVerifyAuthenticationResponse(request: VerifyAuthenticationRequest): Promise<VerifyAuthenticationResponse> {\n    return this.verifyAuthenticationResponse(request);\n  }\n\n  /**\n   * ZK-email recovery helper (stub).\n   * Intended to call the global ZkEmailVerifier and per-user recovery contract\n   * once zk-email proofs and public inputs are wired through.\n   */\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  async recoverAccountFromZkEmailVerifier(_request: {\n    accountId: string;\n    proof: unknown;\n    publicInputs: unknown;\n  }): Promise<{\n    success: boolean;\n    transactionHash?: string;\n    message?: string;\n    error?: string;\n  }> {\n    return {\n      success: false,\n      error: 'recoverAccountFromZkEmailVerifier is not yet implemented',\n      message: 'recoverAccountFromZkEmailVerifier is not yet implemented',\n    };\n  }\n\n  /**\n   * Express-style middleware factory for verify-authentication\n   */\n  verifyAuthenticationMiddleware() {\n    return async (req: any, res: any) => {\n      try {\n        if (!req?.body) {\n          res.status(400).json({ error: 'Request body is required' });\n          return;\n        }\n        const body: VerifyAuthenticationRequest = req.body;\n        if (!body.vrf_data || !body.webauthn_authentication) {\n          res.status(400).json({ code: 'invalid_body', message: 'vrf_data and webauthn_authentication are required' });\n          return;\n        }\n        const result = await this.verifyAuthenticationResponse(body);\n        const status = result.success ? 200 : 400;\n        if (status !== 200) {\n          res.status(status).json({ code: 'not_verified', message: result.message || 'Authentication verification failed' });\n        } else {\n          res.status(status).json(result);\n        }\n      } catch (error: any) {\n        this.logger.error('Error in verify authentication middleware:', error);\n        res.status(500).json({ code: 'internal', message: error?.message || 'Internal server error' });\n      }\n    };\n  }\n\n  /**\n   * Queue transactions to prevent nonce conflicts\n   */\n  private async queueTransaction<T>(operation: () => Promise<T>, description: string): Promise<T> {\n    this.queueStats.pending++;\n    this.logger.debug(`[AuthService] Queueing: ${description} (pending: ${this.queueStats.pending})`);\n\n    this.transactionQueue = this.transactionQueue\n      .then(async () => {\n        try {\n          this.logger.debug(`[AuthService] Executing: ${description}`);\n          const result = await operation();\n          this.queueStats.completed++;\n          this.queueStats.pending--;\n          this.logger.debug(`[AuthService] Completed: ${description} (pending: ${this.queueStats.pending})`);\n          return result;\n        } catch (error: any) {\n          this.queueStats.failed++;\n          this.queueStats.pending--;\n          this.logger.error(`[AuthService] Failed: ${description} (failed: ${this.queueStats.failed}):`, error?.message);\n          throw error;\n        }\n      })\n      .catch((error) => {\n        throw error;\n      });\n\n    return this.transactionQueue;\n  }\n}\n\ninterface WorkerSignedTransactionPayload {\n  transaction: WasmTransaction;\n  signature: WasmSignature;\n  borshBytes?: number[];\n  borsh_bytes?: number[];\n}\n\nfunction extractFirstSignedTransactionFromWorkerResponse(response: any): {\n  transaction: WasmTransaction;\n  signature: WasmSignature;\n  borshBytes: number[];\n} {\n  const res = (typeof response === 'string' ? JSON.parse(response) : response) as {\n    type?: WorkerResponseType;\n    payload?: { signedTransactions?: WorkerSignedTransactionPayload[]; error?: string };\n  } | undefined;\n\n  if (res?.type !== WorkerResponseType.SignTransactionWithKeyPairSuccess) {\n    const errMsg = res?.payload?.error || 'Signing failed';\n    throw new Error(errMsg);\n  }\n\n  const payload = res?.payload;\n  const signedTxs = (payload?.signedTransactions ?? []) as WorkerSignedTransactionPayload[];\n  if (!Array.isArray(signedTxs) || signedTxs.length === 0) {\n    throw new Error('No signed transaction returned');\n  }\n  const first = signedTxs[0];\n  const borshBytes = first?.borshBytes ?? first?.borsh_bytes;\n  if (!Array.isArray(borshBytes)) {\n    throw new Error('Missing borsh bytes');\n  }\n  return {\n    transaction: first.transaction,\n    signature: first.signature,\n    borshBytes,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA4CA,MAAM,wBAAwB;AAE9B,MAAM,4BAA4B;AAElC,SAAS,kBAAkB,QAAiC;CAC1D,MAAM,QAAQ,CAAC,uBAAuB;CACtC,MAAMA,WAAkB;CACxB,MAAM;AAEN,MAAK,MAAM,QAAQ,MACjB,KAAI;AACF,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM;AAC9B,WAAS,KAAK,IAAI,IAAI,MAAM;UACrB,KAAK;AACZ,SAAO,KAAK,wDAAwD,KAAK,KAAK;;AAIlF,KAAI,CAAC,SAAS,OACZ,OAAM,IAAI,MAAM;AAGlB,QAAO;;;;;;AAOT,IAAa,cAAb,MAAyB;CACvB,AAAQ;CACR,AAAQ,gBAAgB;CACxB,AAAQ;CACR,AAAQ,mBAA2B;CACnC,AAAQ,kBAAkB;CAC1B,AAAiB;CAGjB,AAAQ,mBAAiC,QAAQ;CACjD,AAAQ,aAAa;EAAE,SAAS;EAAG,WAAW;EAAG,QAAQ;;CAGzD,AAAgB,gBAAsC;CAEtD,AAAgB,gBAA6C;CAE7D,YAAY,QAAgC;AAC1C,OAAK,SAASC,uCAAwB;AACtC,OAAK,SAASC,+BAAgB,KAAK,OAAO;EAC1C,MAAM,sBAAsB,KAAK,OAAO,QAAQ,uBAAuB,IAAI;AAC3E,OAAK,gBAAgB,IAAIC,oCAAc,KAAK,OAAO,QAAQ,sBAAsB;AACjF,OAAK,aAAa,IAAIC,qCAAkB,KAAK,OAAO;AACpD,OAAK,gBAAgB,IAAIC,mCAAqB;GAC5C,kBAAkB,KAAK,OAAO;GAC9B,mBAAmB,KAAK,OAAO;GAC/B,WAAW,KAAK,OAAO;GACvB,2BAA2BC,wDAAiC;GAC5D,YAAY,KAAK;GACjB,QAAQ,KAAK,OAAO;GACpB,qCAAqC,KAAK;GAC1C,mBAAsB,IAAsB,UAAkB,KAAK,iBAAiB,IAAI;GACxF,iBAAiB,WAAmB,cAAsB,KAAK,eAAe,WAAW;GACzF,qBAAqB,UAAU,KAAK,mBAAmB;GACvD,2BAA2B,KAAK;GAChC,eAAe,KAAK,OAAO;;AAK7B,OAAK,OAAO,KAAK;;mBAEF,KAAK,OAAO,UAAU;oBACrB,KAAK,OAAO,WAAW;0BACjB,KAAK,OAAO,iBAAiB;4BAC3B,KAAK,OAAO,mBAAmB;+BAC5B,KAAK,OAAO,sBAAsB,IAAIC,gCAAkB,KAAK,OAAO,uBAAuB;qCACrF,KAAK,OAAO,4BAA4B,IAAIC,8BAAgB,KAAK,OAAO,6BAA6B;MAEpI,KAAK,OAAO,SACR,oBAAoB,KAAK,OAAO,OAAO,cAAc,MAAM,GAAG,IAAI,8BAA8B,KAAK,OAAO,OAAO,gBAAgB,MAAM,GAAG,IAAI,8BAA8B,KAAK,OAAO,OAAO,gBAAgB,MAAM,GAAG,IAAI,OAC9N,2BACL;MAEC,KAAK,OAAO,eAAe,UACvB,oBAAoB,KAAK,OAAO,cAAc,YAC9C,kCACL;;;CAIH,MAAM,oBAAuE;AAC3E,QAAM,KAAK;AACX,SAAO;GACL,WAAW,KAAK,OAAO;GACvB,WAAW,KAAK;;;;;;;CAQpB,MAAc,mCAAkD;AAC9D,MAAI,CAAC,KAAK,OAAO,QAAQ,aACvB;EAGF,MAAM,EAAE,gCAAgC,2CAAM;AAC9C,8BAA4B,KAAK,OAAO,OAAO;;CAGjD,MAAc,iCAAgD;AAC5D,MAAI,KAAK,cACP;AAIF,MAAI,KAAK,OAAO,UAAU,KAAK,eAAe;AAC5C,SAAM,KAAK;AACX,SAAM,KAAK,cAAc;;AAI3B,MAAI;GACF,MAAM,EAAE,MAAM,QAAQC,sCAAmB,KAAK,OAAO;AACrD,QAAK,mBAAmBC,qCAAkB;WACnC,GAAG;AACV,QAAK,OAAO,KAAK;AACjB,QAAK,mBAAmB;;AAI1B,QAAM,KAAK;AACX,OAAK,gBAAgB;;CAGvB,MAAc,mBAAkC;AAC9C,MAAI,KAAK,gBAAiB;EAC1B,MAAM,WAAW,KAAK,OAAO,YAAY;AACzC,MAAI,SACF,KAAI;GACF,MAAM,eAAe,MAAM,KAAK,0BAA0B;AAC1D,uEAAqB,EAAE,gBAAgB;AACvC,QAAK,kBAAkB;AACvB;WACO,GAAG;AACV,QAAK,OAAO,MAAM,2DAA2D;AAC7E,SAAM;;EAIV,IAAIC;AACJ,MAAI;AACF,gBAAa,kBAAkB,KAAK;WAC7B,KAAK;AACZ,QAAK,OAAO,MAAM,uCAAuC;AACzD,SAAM;;AAGR,MAAI;AACF,OAAI,KAAK,qBAAqB;AAC5B,UAAM,KAAK,sBAAsB;AACjC,SAAK,kBAAkB;AACvB;;GAGF,IAAIC,YAAqB;AACzB,QAAK,MAAM,aAAa,WACtB,KAAI;AACF,wEAAqB,EAAE,gBAAgB;AACvC,SAAK,kBAAkB;AACvB;YACO,KAAK;AACZ,gBAAY;AACZ,SAAK,OAAO,KAAK,yCAAyC,UAAU,WAAW;;AAInF,SAAM,6BAAa,IAAI,MAAM;WACtB,GAAG;AACV,QAAK,OAAO,MAAM,qCAAqC;AACvD,SAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO;;;CAIpD,AAAQ,oBAA6B;EAEnC,MAAM,SAAS,QAAS,WAAmB,SAAS,UAAU;EAE9D,MAAM,qBAAqB,OAAQ,WAAmB,kBAAkB,eAClE,OAAO,cAAc,eAAgB,UAAkB,WAAW,WAAW;AACnF,SAAO,UAAU,CAAC;;CAGpB,MAAc,0BAA0B,UAAwD;EAC9F,MAAM,YAAY,OAAO,aAAa,aAClC,MAAO,aACP,MAAM;AAEV,MAAI,CAAC,UACH,OAAM,IAAI,MAAM;AAGlB,SAAO;;;;;;CAOT,MAAc,sBAAsB,YAAkC;EACpE,MAAM,EAAE,kBAAkB,MAAM,OAAO;EACvC,MAAM,EAAE,aAAa,MAAM,OAAO;AAGlC,OAAK,MAAM,OAAO,WAChB,KAAI;GACF,MAAM,WAAW,cAAc;GAC/B,MAAM,QAAQ,MAAM,SAAS;GAE7B,MAAM,KAAK,iBAAiB,aAAa,IAAI,WAAW,MAAM,QAAQ,MAAM,YAAY,MAAM,cAAc,IAAI,WAAW;GAC3H,MAAM,KAAK,GAAG,OAAO,MAAM,GAAG,YAAY,GAAG,aAAa,GAAG;GAC7D,MAAMC,WAAS,MAAM,YAAY,QAAQ;AACzC,uEAAqB,EAAE,gBAAgBA;AACvC;UACM;AAIV,OAAK,MAAM,OAAO,WAChB,KAAI;GACF,MAAM,WAAW,cAAc;AAC/B,uEAAqB,EAAE,gBAAgB;AACvC;UACM;AAGV,QAAM,IAAI,MAAM;;;;;;;;;;;CAalB,MAAM,cAAc,SAAiE;AACnF,QAAM,KAAK;AAEX,SAAO,KAAK,iBAAiB,YAAY;AACvC,OAAI;AACF,QAAI,CAAC,KAAK,iBAAiB,QAAQ,WACjC,OAAM,IAAI,MAAM,8BAA8B,QAAQ;AAIxD,SAAK,OAAO,KAAK,uBAAuB,QAAQ,UAAU;IAC1D,MAAM,gBAAgB,MAAM,KAAK,mBAAmB,QAAQ;AAC5D,QAAI,cACF,OAAM,IAAI,MAAM,WAAW,QAAQ,UAAU;AAE/C,SAAK,OAAO,KAAK,WAAW,QAAQ,UAAU;IAE9C,MAAM,iBAAiB,KAAK,OAAO;AAEnC,SAAK,OAAO,KAAK,qBAAqB,QAAQ;AAC9C,SAAK,OAAO,KAAK,oBAAoB,eAAe;IAGpD,MAAMC,UAA4B;KAChC,EAAE,aAAaC,2BAAW;KAC1B;MAAE,aAAaA,2BAAW;MAAU,SAAS;;KAC7C;MACE,aAAaA,2BAAW;MACxB,YAAY,QAAQ;MACpB,YAAY,KAAK,UAAU;OACzB,OAAO;OACP,YAAY,EAAE,YAAY;;;;AAKhC,YAAQ,QAAQC;IAGhB,MAAM,EAAE,WAAW,cAAc,MAAM,KAAK,eAAe,KAAK,OAAO,kBAAkB,KAAK;IAG9F,MAAM,SAAS,MAAM,KAAK,mBAAmB;KAC3C,gBAAgB,KAAK,OAAO;KAC5B,iBAAiB,KAAK,OAAO;KAC7B,YAAY,QAAQ;KACpB,OAAO;KACI;KACX;;IAIF,MAAM,SAAS,MAAM,KAAK,WAAW,gBAAgB;AAErD,SAAK,OAAO,KAAK,+BAA+B,OAAO,YAAY;IACnE,MAAM,cAAc,OAAO,OAAO,mBAAmB,MAAM,QAAQ;AACnE,WAAO;KACL,SAAS;KACT,iBAAiB,OAAO,YAAY;KACpC,WAAW,QAAQ;KACnB,SAAS,WAAW,QAAQ,UAAU,gBAAgB,WAAW;;YAG5DC,OAAY;AACnB,SAAK,OAAO,MAAM,+BAA+B,QAAQ,UAAU,IAAI;AACvE,WAAO;KACL,SAAS;KACT,OAAO,MAAM,WAAW;KACxB,SAAS,4BAA4B,QAAQ,UAAU,IAAI,MAAM;;;KAGpE,kBAAkB,QAAQ;;;;;CAM/B,MAAM,6BAA6B,SAAmF;AACpH,QAAM,KAAK;AAEX,SAAO,KAAK,iBAAiB,YAAY;AACvC,OAAI;AACF,QAAI,CAAC,KAAK,iBAAiB,QAAQ,gBACjC,OAAM,IAAI,MAAM,8BAA8B,QAAQ;AAIxD,SAAK,OAAO,KAAK,uBAAuB,QAAQ,eAAe;IAC/D,MAAM,gBAAgB,MAAM,KAAK,mBAAmB,QAAQ;AAC5D,QAAI,cACF,OAAM,IAAI,MAAM,WAAW,QAAQ,eAAe;AAEpD,SAAK,OAAO,KAAK,WAAW,QAAQ,eAAe;AACnD,SAAK,OAAO,KAAK,wBAAwB,QAAQ;AACjD,SAAK,OAAO,KAAK,aAAa,KAAK,OAAO;IAG1C,MAAM,eAAe;KACnB,gBAAgB,QAAQ;KACxB,gBAAgB,QAAQ;KACxB,UAAU,QAAQ;KAClB,uBAAuB,QAAQ;KAC/B,8BAA8B,QAAQ;KACtC,uBAAuB,QAAQ;;IAIjC,MAAMH,UAA4B,CAChC;KACE,aAAaC,2BAAW;KACxB,aAAa;KACb,MAAM,KAAK,UAAU;KACrB,KAAK,KAAK,OAAO;KACjB,SAAS,KAAK,OAAO;;AAGzB,YAAQ,QAAQC;IAEhB,MAAM,EAAE,WAAW,cAAc,MAAM,KAAK,eAAe,KAAK,OAAO,kBAAkB,KAAK;IAC9F,MAAM,SAAS,MAAM,KAAK,mBAAmB;KAC3C,gBAAgB,KAAK,OAAO;KAC5B,iBAAiB,KAAK,OAAO;KAC7B,YAAY,KAAK,OAAO;KACxB,OAAO;KACP;KACA;;IAEF,MAAM,SAAS,MAAM,KAAK,WAAW,gBAAgB;IAGrD,MAAM,gBAAgBE,2CAA4B,QAAQ,QAAQ;AAClE,QAAI,eAAe;AACjB,UAAK,OAAO,MAAM,iCAAiC,QAAQ,eAAe,IAAI;AAC9E,WAAM,IAAI,MAAM;;AAGlB,SAAK,OAAO,KAAK,2BAA2B,OAAO,YAAY;AAC/D,WAAO;KACL,SAAS;KACT,iBAAiB,OAAO,YAAY;KACpC,SAAS,WAAW,QAAQ,eAAe;KAC3C,gBAAgB;;YAGXD,OAAY;AACnB,SAAK,OAAO,MAAM,kCAAkC,QAAQ,eAAe,IAAI;AAC/E,WAAO;KACL,SAAS;KACT,OAAO,MAAM,WAAW;KACxB,SAAS,yCAAyC,QAAQ,eAAe,IAAI,MAAM;;;KAGtF,8BAA8B,QAAQ;;;;;;;CAQ3C,MAAM,6BACJ,SACuC;AACvC,MAAI;AACF,SAAM,KAAK;GAEX,MAAM,OAAO;IACX,UAAU,QAAQ;IAClB,yBAAyB,QAAQ;;GAInC,MAAM,mBAAmB,MAAM,KAAK,WAAW,KAAuB;IACpE,SAAS,KAAK,OAAO;IACrB,QAAQ;IACR;;GAGF,MAAM,WAAW,QAAS,oBAAqB,iBAAiB,aAAa;AAC7E,OAAI,CAAC,SACH,QAAO;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,SAAS;IACT;;AAIJ,UAAO;IACL,SAAS;IACT,UAAU;IACV,mBAAmB;KACjB,QAAQ,QAAQ,SAAS;KACzB,2BAAU,IAAI,QAAO;KACrB,WAAW,IAAI,KAAK,KAAK,QAAQ,OAAU,KAAK,KAAM;;IAExD;;WAEKA,OAAY;AACnB,UAAO;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,SAAS,OAAO,WAAW;;;;;;;;;CAUjC,MAAa,cAAc,MAAgF;EACzG,MAAM,cAAc,MAAM,cAAc,KAAK,OAAO,oBAAoB;EACxE,MAAM,UAAU,MAAM,UAAU,uBAAuB;EACvD,MAAM,OAAO,MAAM,QAAQ;EAE3B,MAAM,iBAAiB,MAA8B;AACnD,OAAI,OAAO,MAAM,YAAY,CAAC,EAAG,QAAO;AACxC,OAAI;IACF,MAAM,IAAI,IAAI,IAAI,EAAE;IACpB,MAAM,SAAS,EAAE;IACjB,MAAM,OAAO,EAAE,SAAS;IACxB,MAAM,OAAO,EAAE,OAAO,IAAI,EAAE,SAAS;AACrC,QAAI,WAAW,YAAY,EAAE,WAAW,WAAW,SAAS,aAAc,QAAO;AACjF,QAAK,EAAE,YAAY,EAAE,aAAa,OAAQ,EAAE,UAAU,EAAE,KAAM,QAAO;AACrE,WAAO,GAAG,OAAO,IAAI,OAAO;WACtB;AAAE,WAAO;;;AAGnB,MAAI;GACF,MAAM,SAAS,MAAM,KAAK,WAAW,KAAoB;IAAE,SAAS;IAAY;IAAQ;;GACxF,IAAIE,OAAiB;AACrB,OAAI,MAAM,QAAQ,QAChB,QAAO;YACE,UAAU,OAAO,WAAW,YAAY,MAAM,QAAS,OAAe,SAC/E,QAAQ,OAAe;GAEzB,MAAM,sBAAM,IAAI;AAChB,QAAK,MAAM,QAAQ,MAAM;IACvB,MAAM,OAAO,cAAc;AAC3B,QAAI,KAAM,KAAI,IAAI;;AAEpB,UAAO,MAAM,KAAK;WACX,GAAG;AACV,QAAK,OAAO,KAAK,uCAAuC;AACxD,UAAO;;;CAIX,AAAQ,iBAAiB,WAA4B;AACnD,MAAI,CAAC,aAAa,UAAU,SAAS,KAAK,UAAU,SAAS,GAC3D,QAAO;EAET,MAAM,eAAe;AACrB,SAAO,aAAa,KAAK;;;;;CAM3B,MAAM,mBAAmB,WAAqC;AAC5D,QAAM,KAAK;EACX,MAAM,cAAc,MAAc,oDAAoD,KAAK;EAC3F,MAAM,eAAe,MAAc,kGAAkG,KAAK;EAC1I,MAAM,WAAW;EACjB,IAAIC,UAAe;AACnB,OAAK,IAAI,IAAI,GAAG,KAAK,UAAU,IAC7B,KAAI;GACF,MAAM,OAAO,MAAM,KAAK,WAAW,YAAY;AAC/C,UAAO,CAAC,CAAC;WACFH,OAAY;AACnB,aAAU;GACV,MAAM,MAAM,OAAO,OAAO,WAAW;GAGrC,MAAM,qBAAqB;AACzB,QAAI;KACF,MAAM,IAAK,SAAS,OAAO,UAAU,YAAY,aAAa,QAAU,MAAc,UAAU;AAChG,SAAI,CAAC,EAAG,QAAO;AACf,YAAO,OAAO,MAAM,WAAW,IAAI,KAAK,UAAU;YAC5C;AAAE,YAAO;;;GAEnB,MAAM,WAAW,GAAG,IAAI,IAAI;AAC5B,OAAI,WAAW,UAAW,QAAO;AACjC,OAAI,YAAY,QAAQ,IAAI,UAAU;IACpC,MAAM,UAAU,MAAM,KAAK,IAAI,GAAG,IAAI;AACtC,UAAM,IAAI,SAAS,MAAM,WAAW,GAAG;AACvC;;AAGF,OAAI,YAAY,MAAM;AACpB,SAAK,OAAO,KAAK,mCAAmC,UAAU,0CAA0C;AACxG,WAAO;;AAET,QAAK,OAAO,MAAM,wCAAwC,UAAU,IAAI;AACxE,SAAM;;AAGV,QAAM,mBAAmB,QAAQ,UAAU,IAAI,MAAM,OAAO;;;;;;;;;;;;;;;;;;;CAqB9D,MAAM,sBAAsB,OAIa;AACvC,QAAM,KAAK;AAEX,MAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,eAC1B,QAAO;GACL,IAAI;GACJ,MAAM;GACN,OAAO;;EAIX,MAAM,WAAW,MAAM,gBAAgB,gBAAgB,YAAY;AAEnE,SAAO,KAAK,uBACJI,iDAAiC;GACrC,YAAY,KAAK;GACjB,kBAAkB,KAAK,OAAO;GAC9B,kBAAkB,KAAK;GACvB,mBAAmB,KAAK,OAAO;GAC/B,MAAM,MAAM;GACZ,gBAAgB,MAAM;GACtB,qBAAqB,SAAS,KAAK,mBAAmB;MAExD,+BAA+B;;CAKnC,MAAc,eAAe,WAAmB,WAAsE;EAEpH,IAAI,QAAQ;AACZ,MAAI;GACF,MAAM,KAAK,MAAM,KAAK,WAAW,cAAc,WAAW;AAC1D,WAAQ,OAAO,IAAI,SAAS;UACtB;AACN,WAAQ;;EAGV,MAAM,QAAQ,MAAM,KAAK,WAAW,UAAU,EAAE,UAAU;EAC1D,MAAM,cAAc,MAAM,OAAO;EACjC,MAAM,aAAa,QAAQ,IAAI;AAC/B,SAAO;GAAE;GAAW,WAAW;;;CAGjC,MAAc,mBAAmB,OAOF;AAC7B,QAAM,KAAK;EACX,MAAM,UAAU;GACd,MAAMC,mEAAkB;GACxB,SAAS;IACP,gBAAgB,MAAM;IACtB,iBAAiB,MAAM;IACvB,YAAY,MAAM;IAClB,OAAO,MAAM;IACb,WAAW,MAAM;IACjB,SAAS,MAAM;;;EAKnB,MAAM,WAAW,kFAA4B;EAC7C,MAAM,EACJ,aACA,WACA,eACE,gDAAgD;AAEpD,SAAO,IAAIC,qCAAkB;GACd;GACF;GACX,aAAa;;;;;;;CAQjB,MAAM,mCAAmC,SAA6E;AACpH,SAAO,KAAK,6BAA6B;;;;;;;CAS3C,MAAM,kCAAkC,UASrC;AACD,SAAO;GACL,SAAS;GACT,OAAO;GACP,SAAS;;;;;;CAOb,iCAAiC;AAC/B,SAAO,OAAO,KAAU,QAAa;AACnC,OAAI;AACF,QAAI,CAAC,KAAK,MAAM;AACd,SAAI,OAAO,KAAK,KAAK,EAAE,OAAO;AAC9B;;IAEF,MAAMC,OAAoC,IAAI;AAC9C,QAAI,CAAC,KAAK,YAAY,CAAC,KAAK,yBAAyB;AACnD,SAAI,OAAO,KAAK,KAAK;MAAE,MAAM;MAAgB,SAAS;;AACtD;;IAEF,MAAM,SAAS,MAAM,KAAK,6BAA6B;IACvD,MAAM,SAAS,OAAO,UAAU,MAAM;AACtC,QAAI,WAAW,IACb,KAAI,OAAO,QAAQ,KAAK;KAAE,MAAM;KAAgB,SAAS,OAAO,WAAW;;QAE3E,KAAI,OAAO,QAAQ,KAAK;YAEnBP,OAAY;AACnB,SAAK,OAAO,MAAM,8CAA8C;AAChE,QAAI,OAAO,KAAK,KAAK;KAAE,MAAM;KAAY,SAAS,OAAO,WAAW;;;;;;;;CAQ1E,MAAc,iBAAoB,WAA6B,aAAiC;AAC9F,OAAK,WAAW;AAChB,OAAK,OAAO,MAAM,2BAA2B,YAAY,aAAa,KAAK,WAAW,QAAQ;AAE9F,OAAK,mBAAmB,KAAK,iBAC1B,KAAK,YAAY;AAChB,OAAI;AACF,SAAK,OAAO,MAAM,4BAA4B;IAC9C,MAAM,SAAS,MAAM;AACrB,SAAK,WAAW;AAChB,SAAK,WAAW;AAChB,SAAK,OAAO,MAAM,4BAA4B,YAAY,aAAa,KAAK,WAAW,QAAQ;AAC/F,WAAO;YACAA,OAAY;AACnB,SAAK,WAAW;AAChB,SAAK,WAAW;AAChB,SAAK,OAAO,MAAM,yBAAyB,YAAY,YAAY,KAAK,WAAW,OAAO,KAAK,OAAO;AACtG,UAAM;;KAGT,OAAO,UAAU;AAChB,SAAM;;AAGV,SAAO,KAAK;;;AAWhB,SAAS,gDAAgD,UAIvD;CACA,MAAM,MAAO,OAAO,aAAa,WAAW,KAAK,MAAM,YAAY;AAKnE,KAAI,KAAK,SAASQ,oEAAmB,mCAAmC;EACtE,MAAM,SAAS,KAAK,SAAS,SAAS;AACtC,QAAM,IAAI,MAAM;;CAGlB,MAAM,UAAU,KAAK;CACrB,MAAM,YAAa,SAAS,sBAAsB;AAClD,KAAI,CAAC,MAAM,QAAQ,cAAc,UAAU,WAAW,EACpD,OAAM,IAAI,MAAM;CAElB,MAAM,QAAQ,UAAU;CACxB,MAAM,aAAa,OAAO,cAAc,OAAO;AAC/C,KAAI,CAAC,MAAM,QAAQ,YACjB,OAAM,IAAI,MAAM;AAElB,QAAO;EACL,aAAa,MAAM;EACnB,WAAW,MAAM;EACjB"}
+{"version":3,"file":"AuthService.js","names":["base64UrlDecode","errorMessage","out: number[]","toOptionalTrimmedString","base: Record<string, unknown>","resolved: URL[]","coerceThresholdNodeRole","coerceThresholdEd25519ShareMode","createAuthServiceConfig","coerceLogger","ShamirService","MinimalNearClient","EmailRecoveryService","DEFAULT_EMAIL_RECOVERY_CONTRACTS","formatYoctoToNear","formatGasToTGas","createThresholdSigningService","toPublicKeyStringFromSecretKey","candidates: URL[]","lastError: unknown","module","isValidAccountId","actions: ActionArgsWasm[]","ActionType","validateActionArgsWasm","error: any","parseContractExecutionError","list: unknown[]","toRorOriginOrNull","lastErr: Error | null","error: unknown","toError","executeSignedDelegateWithRelayer","WorkerRequestType","response: unknown","e: unknown","SignedTransaction","body: VerifyAuthenticationRequest","WorkerResponseType"],"sources":["../../../../src/server/core/AuthService.ts"],"sourcesContent":["import { ActionType, type ActionArgsWasm, validateActionArgsWasm } from '../../core/types/actions';\nimport { MinimalNearClient, SignedTransaction, type AccessKeyList } from '../../core/NearClient';\nimport type { FinalExecutionOutcome } from '@near-js/types';\nimport { toPublicKeyStringFromSecretKey } from './nearKeys';\nimport { createAuthServiceConfig } from './config';\nimport { formatGasToTGas, formatYoctoToNear } from './utils';\nimport { parseContractExecutionError } from './errors';\nimport { isValidAccountId, toOptionalTrimmedString, toRorOriginOrNull } from '../../utils/validation';\nimport { coerceThresholdEd25519ShareMode, coerceThresholdNodeRole } from './ThresholdService/config';\nimport type { ThresholdSigningService as ThresholdSigningServiceType } from './ThresholdService';\nimport { createThresholdSigningService } from './ThresholdService';\nimport initSignerWasm, {\n  handle_signer_message,\n  WorkerRequestType,\n  WorkerResponseType,\n  type InitInput,\n  type WasmTransaction,\n  type WasmSignature,\n} from '../../wasm_signer_worker/pkg/wasm_signer_worker.js';\n\nimport type {\n  AuthServiceConfig,\n  AuthServiceConfigInput,\n  AccountCreationRequest,\n  AccountCreationResult,\n  CreateAccountAndRegisterRequest,\n  CreateAccountAndRegisterResult,\n  VerifyAuthenticationRequest,\n  VerifyAuthenticationResponse,\n  SignerWasmModuleSupplier,\n} from './types';\n\nimport { DEFAULT_EMAIL_RECOVERY_CONTRACTS } from '../../core/defaultConfigs';\nimport { EmailRecoveryService } from '../email-recovery';\nimport { ShamirService } from './ShamirService';\nimport { SignedDelegate } from '../../core/types/delegate';\nimport {\n  type ExecuteSignedDelegateResult,\n  executeSignedDelegateWithRelayer,\n  type DelegateActionPolicy,\n} from '../delegateAction';\nimport { coerceLogger, type NormalizedLogger } from './logger';\nimport { errorMessage, toError } from '../../utils/errors';\nimport { base64UrlDecode } from '../../utils/encoders';\n\nfunction isObject(v: unknown): v is Record<string, unknown> {\n  return !!v && typeof v === 'object' && !Array.isArray(v);\n}\n\nfunction normalizeU8ArrayLike(input: unknown, fieldName: string): number[] {\n  if (input instanceof Uint8Array) return Array.from(input);\n  if (typeof input === 'string') {\n    try {\n      return Array.from(base64UrlDecode(input));\n    } catch (err) {\n      throw new Error(`Invalid ${fieldName}: expected base64url string (${errorMessage(err) || 'decode failed'})`);\n    }\n  }\n  if (Array.isArray(input)) {\n    const out: number[] = [];\n    for (const v of input) {\n      const n = Number(v);\n      if (!Number.isFinite(n) || n < 0 || n > 255) {\n        throw new Error(`Invalid ${fieldName}: expected byte array (0..255)`);\n      }\n      out.push(Math.floor(n));\n    }\n    return out;\n  }\n  throw new Error(`Invalid ${fieldName}: expected number[] or base64url string`);\n}\n\nfunction normalizeContractVrfDataForContract(input: unknown): Record<string, unknown> {\n  if (!isObject(input)) throw new Error('Missing or invalid vrf_data');\n  const user_id = toOptionalTrimmedString(input.user_id);\n  const rp_id = toOptionalTrimmedString(input.rp_id);\n  const block_height_raw = input.block_height;\n  const block_height = typeof block_height_raw === 'number'\n    ? block_height_raw\n    : Number(block_height_raw);\n\n  if (!user_id) throw new Error('Missing vrf_data.user_id');\n  if (!rp_id) throw new Error('Missing vrf_data.rp_id');\n  if (!Number.isFinite(block_height) || block_height <= 0) throw new Error('Invalid vrf_data.block_height');\n\n  const base: Record<string, unknown> = {\n    vrf_input_data: normalizeU8ArrayLike(input.vrf_input_data, 'vrf_data.vrf_input_data'),\n    vrf_output: normalizeU8ArrayLike(input.vrf_output, 'vrf_data.vrf_output'),\n    vrf_proof: normalizeU8ArrayLike(input.vrf_proof, 'vrf_data.vrf_proof'),\n    public_key: normalizeU8ArrayLike(input.public_key, 'vrf_data.public_key'),\n    user_id,\n    rp_id,\n    block_height,\n    block_hash: normalizeU8ArrayLike(input.block_hash, 'vrf_data.block_hash'),\n    intent_digest_32: normalizeU8ArrayLike(input.intent_digest_32, 'vrf_data.intent_digest_32'),\n  };\n\n  if (Object.prototype.hasOwnProperty.call(input, 'session_policy_digest_32')) {\n    const v = input.session_policy_digest_32;\n    if (v != null) {\n      base.session_policy_digest_32 = normalizeU8ArrayLike(v, 'vrf_data.session_policy_digest_32');\n    }\n  }\n\n  return base;\n}\n\n// =============================\n// WASM URL CONSTANTS + HELPERS\n// =============================\n\n// Primary location (preserveModules output)\nconst SIGNER_WASM_MAIN_PATH = '../../wasm_signer_worker/pkg/wasm_signer_worker_bg.wasm';\n// Fallback location (dist/workers copy step)\nconst SIGNER_WASM_FALLBACK_PATH = '../../../workers/wasm_signer_worker_bg.wasm';\n\nfunction getSignerWasmUrls(logger: NormalizedLogger): URL[] {\n  const paths = [SIGNER_WASM_MAIN_PATH, SIGNER_WASM_FALLBACK_PATH];\n  const resolved: URL[] = [];\n  const baseUrl = import.meta.url;\n\n  for (const path of paths) {\n    try {\n      if (!baseUrl) throw new Error('import.meta.url is undefined');\n      resolved.push(new URL(path, baseUrl));\n    } catch (err) {\n      logger.warn(`Failed to resolve signer WASM relative URL for path \"${path}\":`, err);\n    }\n  }\n\n  if (!resolved.length) {\n    throw new Error('Unable to resolve signer WASM location from import.meta.url. Provide AuthServiceConfig.signerWasm.moduleOrPath in this runtime.');\n  }\n\n  return resolved;\n}\n\nfunction summarizeThresholdEd25519Config(cfg: AuthServiceConfig['thresholdEd25519KeyStore']): string {\n  if (!cfg) return 'thresholdEd25519: not configured';\n\n  const nodeRole = coerceThresholdNodeRole(cfg.THRESHOLD_NODE_ROLE);\n  const shareMode = coerceThresholdEd25519ShareMode(cfg.THRESHOLD_ED25519_SHARE_MODE);\n\n  const masterSecretSet = (() => {\n    if ('kind' in cfg) return false;\n    return Boolean(toOptionalTrimmedString(cfg.THRESHOLD_ED25519_MASTER_SECRET_B64U));\n  })();\n\n  const store = (() => {\n    if ('kind' in cfg) {\n      if (cfg.kind === 'upstash-redis-rest') return 'upstash';\n      if (cfg.kind === 'redis-tcp') return 'redis';\n      return 'in-memory';\n    }\n    const upstashUrl = toOptionalTrimmedString(cfg.UPSTASH_REDIS_REST_URL);\n    const upstashToken = toOptionalTrimmedString(cfg.UPSTASH_REDIS_REST_TOKEN);\n    const redisUrl = toOptionalTrimmedString(cfg.REDIS_URL);\n    return (upstashUrl || upstashToken) ? 'upstash' : (redisUrl ? 'redis' : 'in-memory');\n  })();\n\n  const parts = [`thresholdEd25519: configured`, `nodeRole=${nodeRole}`, `shareMode=${shareMode}`, `store=${store}`];\n  if (masterSecretSet) parts.push('masterSecret=set');\n  return parts.join(' ');\n}\n\n/**\n * Framework-agnostic NEAR account service\n * Core business logic for account creation and registration operations\n */\nexport class AuthService {\n  private config: AuthServiceConfig;\n  private isInitialized = false;\n  private nearClient: MinimalNearClient;\n  private relayerPublicKey: string = '';\n  private signerWasmReady = false;\n  private readonly logger: NormalizedLogger;\n  private thresholdSigningServiceInitialized = false;\n  private thresholdSigningService: ThresholdSigningServiceType | null = null;\n\n  // Transaction queue to prevent nonce conflicts\n  private transactionQueue: Promise<any> = Promise.resolve();\n  private queueStats = { pending: 0, completed: 0, failed: 0 };\n\n  // Shamir 3-pass key management (delegated to ShamirService)\n  public readonly shamirService: ShamirService | null = null;\n  // DKIM/TEE email recovery logic (delegated to EmailRecoveryService)\n  public readonly emailRecovery: EmailRecoveryService | null = null;\n\n  constructor(config: AuthServiceConfigInput) {\n    this.config = createAuthServiceConfig(config);\n    this.logger = coerceLogger(this.config.logger);\n    const graceFileCandidate = (this.config.shamir?.graceShamirKeysFile || '').trim();\n    this.shamirService = new ShamirService(this.config.shamir, graceFileCandidate || 'grace-keys.json');\n    this.nearClient = new MinimalNearClient(this.config.nearRpcUrl);\n    this.emailRecovery = new EmailRecoveryService({\n      relayerAccountId: this.config.relayerAccountId,\n      relayerPrivateKey: this.config.relayerPrivateKey,\n      networkId: this.config.networkId,\n      emailDkimVerifierContract: DEFAULT_EMAIL_RECOVERY_CONTRACTS.emailDkimVerifierContract,\n      nearClient: this.nearClient,\n      logger: this.config.logger,\n      ensureSignerAndRelayerAccount: () => this._ensureSignerAndRelayerAccount(),\n      queueTransaction: <T>(fn: () => Promise<T>, label: string) => this.queueTransaction(fn, label),\n      fetchTxContext: (accountId: string, publicKey: string) => this.fetchTxContext(accountId, publicKey),\n      signWithPrivateKey: (input) => this.signWithPrivateKey(input),\n      getRelayerPublicKey: () => this.relayerPublicKey,\n      zkEmailProver: this.config.zkEmailProver,\n    });\n\n    // Log effective configuration at construction time so operators can\n    // verify wiring immediately when the service is created.\n    this.logger.info(`\n    AuthService initialized with:\n    • networkId: ${this.config.networkId}\n    • nearRpcUrl: ${this.config.nearRpcUrl}\n    • relayerAccountId: ${this.config.relayerAccountId}\n    • webAuthnContractId: ${this.config.webAuthnContractId}\n    • accountInitialBalance: ${this.config.accountInitialBalance} (${formatYoctoToNear(this.config.accountInitialBalance)} NEAR)\n    • createAccountAndRegisterGas: ${this.config.createAccountAndRegisterGas} (${formatGasToTGas(this.config.createAccountAndRegisterGas)})\n    ${this.config.shamir\n        ? `• shamir_p_b64u: ${this.config.shamir.shamir_p_b64u.slice(0, 10)}...\\n    • shamir_e_s_b64u: ${this.config.shamir.shamir_e_s_b64u.slice(0, 10)}...\\n    • shamir_d_s_b64u: ${this.config.shamir.shamir_d_s_b64u.slice(0, 10)}...`\n        : '• shamir: not configured'\n      }\n    • ${summarizeThresholdEd25519Config(this.config.thresholdEd25519KeyStore)}\n    ${this.config.zkEmailProver?.baseUrl\n        ? `• zkEmailProver: ${this.config.zkEmailProver.baseUrl}`\n        : `• zkEmailProver: not configured`\n      }\n    `);\n  }\n\n  async getRelayerAccount(): Promise<{ accountId: string; publicKey: string }> {\n    await this._ensureSignerAndRelayerAccount();\n    return {\n      accountId: this.config.relayerAccountId,\n      publicKey: this.relayerPublicKey\n    };\n  }\n\n  async viewAccessKeyList(accountId: string): Promise<AccessKeyList> {\n    await this._ensureSignerAndRelayerAccount();\n    return this.nearClient.viewAccessKeyList(accountId);\n  }\n\n  /**\n   * Lazily constructs the threshold signing service when `thresholdEd25519KeyStore` is configured.\n   * Routers may call this to auto-enable `/threshold-ed25519/*` endpoints.\n   */\n  getThresholdSigningService(): ThresholdSigningServiceType | null {\n    if (this.thresholdSigningServiceInitialized) return this.thresholdSigningService;\n    this.thresholdSigningServiceInitialized = true;\n\n    if (!this.config.thresholdEd25519KeyStore) {\n      this.thresholdSigningService = null;\n      return null;\n    }\n\n    this.thresholdSigningService = createThresholdSigningService({\n      authService: this,\n      thresholdEd25519KeyStore: this.config.thresholdEd25519KeyStore,\n      logger: this.logger,\n      isNode: this.isNodeEnvironment(),\n    });\n    return this.thresholdSigningService;\n  }\n\n  getWebAuthnContractId(): string {\n    return this.config.webAuthnContractId;\n  }\n\n  async txStatus(txHash: string, senderAccountId: string): Promise<FinalExecutionOutcome> {\n    await this._ensureSignerAndRelayerAccount();\n    return this.nearClient.txStatus(txHash, senderAccountId);\n  }\n\n  /**\n   * Configure Shamir WASM module override for serverless environments\n   * Required for Cloudflare Workers where import.meta.url doesn't work\n   */\n  private async configureShamirWasmForServerless(): Promise<void> {\n    if (!this.config.shamir?.moduleOrPath) {\n      return;\n    }\n\n    const { setShamirWasmModuleOverride } = await import('./shamirWorker.js');\n    setShamirWasmModuleOverride(this.config.shamir.moduleOrPath);\n  }\n\n  private async _ensureSignerAndRelayerAccount(): Promise<void> {\n    if (this.isInitialized) {\n      return;\n    }\n\n    // Initialize Shamir 3-pass via ShamirService (if configured)\n    if (this.config.shamir && this.shamirService) {\n      await this.configureShamirWasmForServerless();\n      await this.shamirService.ensureReady();\n    }\n\n    // Derive public key from configured relayer private key\n    try {\n      this.relayerPublicKey = toPublicKeyStringFromSecretKey(this.config.relayerPrivateKey);\n    } catch (e) {\n      this.logger.warn('Failed to derive public key from relayerPrivateKey; ensure it is in ed25519:<base58> format');\n      this.relayerPublicKey = '';\n    }\n\n    // Prepare signer WASM for transaction building/signing\n    await this.ensureSignerWasm();\n    this.isInitialized = true;\n  }\n\n  private async ensureSignerWasm(): Promise<void> {\n    if (this.signerWasmReady) return;\n    const override = this.config.signerWasm?.moduleOrPath;\n    if (override) {\n      try {\n        const moduleOrPath = await this.resolveSignerWasmOverride(override);\n        await initSignerWasm({ module_or_path: moduleOrPath as InitInput });\n        this.signerWasmReady = true;\n        return;\n      } catch (e) {\n        this.logger.error('Failed to initialize signer WASM via provided override:', e);\n        throw e;\n      }\n    }\n\n    let candidates: URL[];\n    try {\n      candidates = getSignerWasmUrls(this.logger);\n    } catch (err) {\n      this.logger.error('Failed to resolve signer WASM URLs:', err);\n      throw err;\n    }\n\n    try {\n      if (this.isNodeEnvironment()) {\n        await this.initSignerWasmForNode(candidates);\n        this.signerWasmReady = true;\n        return;\n      }\n\n      let lastError: unknown = null;\n      for (const candidate of candidates) {\n        try {\n          await initSignerWasm({ module_or_path: candidate as InitInput });\n          this.signerWasmReady = true;\n          return;\n        } catch (err) {\n          lastError = err;\n          this.logger.warn(`Failed to initialize signer WASM from ${candidate.toString()}, trying next candidate...`);\n        }\n      }\n\n      throw lastError ?? new Error('Unable to initialize signer WASM from any candidate URL');\n    } catch (e) {\n      this.logger.error('Failed to initialize signer WASM:', e);\n      throw e instanceof Error ? e : new Error(String(e));\n    }\n  }\n\n  private isNodeEnvironment(): boolean {\n    // Detect true Node.js, not Cloudflare Workers with nodejs_compat polyfills.\n    const processObj = (globalThis as unknown as { process?: { versions?: { node?: string } } }).process;\n    const isNode = Boolean(processObj?.versions?.node);\n    // Cloudflare Workers expose WebSocketPair and may polyfill process.\n    const webSocketPair = (globalThis as unknown as { WebSocketPair?: unknown }).WebSocketPair;\n    const nav = (globalThis as unknown as { navigator?: { userAgent?: unknown } }).navigator;\n    const isCloudflareWorker = typeof webSocketPair !== 'undefined'\n      || (typeof nav?.userAgent === 'string' && nav.userAgent.includes('Cloudflare-Workers'));\n    return isNode && !isCloudflareWorker;\n  }\n\n  private async resolveSignerWasmOverride(override: SignerWasmModuleSupplier): Promise<InitInput> {\n    const candidate = typeof override === 'function'\n      ? await (override as () => InitInput | Promise<InitInput>)()\n      : await override;\n\n    if (!candidate) {\n      throw new Error('Signer WASM override resolved to an empty value');\n    }\n\n    return candidate;\n  }\n\n  /**\n   * Initialize signer WASM in Node by loading the wasm file from disk.\n   * Tries multiple candidate locations and falls back to path-based init if needed.\n   */\n  private async initSignerWasmForNode(candidates: URL[]): Promise<void> {\n    const { fileURLToPath } = await import('node:url');\n    const { readFile } = await import('node:fs/promises');\n\n    // 1) Try reading and compiling bytes\n    for (const url of candidates) {\n      try {\n        const filePath = fileURLToPath(url);\n        const bytes = await readFile(filePath);\n        // Ensure we pass an ArrayBuffer (not Buffer / SharedArrayBuffer) for WebAssembly.compile\n        const ab = new ArrayBuffer(bytes.byteLength);\n        new Uint8Array(ab).set(bytes);\n        const module = await WebAssembly.compile(ab);\n        await initSignerWasm({ module_or_path: module });\n        return;\n      } catch { } // throw at end of function\n    }\n\n    // 2) Fallback: pass file path directly (supported in some environments)\n    for (const url of candidates) {\n      try {\n        const filePath = fileURLToPath(url);\n        await initSignerWasm({ module_or_path: filePath as unknown as InitInput });\n        return;\n      } catch { } // throw at end of function\n    }\n\n    throw new Error('[AuthService] Failed to initialize signer WASM from filesystem candidates');\n  }\n\n  /**\n   * ===== Registration & authentication =====\n   *\n   * Helpers for creating accounts, registering WebAuthn credentials,\n   * and verifying authentication responses.\n   */\n\n  /**\n   * Create a new account with the specified balance\n   */\n  async createAccount(request: AccountCreationRequest): Promise<AccountCreationResult> {\n    await this._ensureSignerAndRelayerAccount();\n\n    return this.queueTransaction(async () => {\n      try {\n        if (!isValidAccountId(request.accountId)) {\n          throw new Error(`Invalid account ID format: ${request.accountId}`);\n        }\n\n        // Check if account already exists\n        this.logger.info(`Checking if account ${request.accountId} already exists...`);\n        const accountExists = await this.checkAccountExists(request.accountId);\n        if (accountExists) {\n          throw new Error(`Account ${request.accountId} already exists. Cannot create duplicate account.`);\n        }\n        this.logger.info(`Account ${request.accountId} is available for creation`);\n\n        const initialBalance = this.config.accountInitialBalance;\n\n        this.logger.info(`Creating account: ${request.accountId}`);\n        this.logger.info(`Initial balance: ${initialBalance} yoctoNEAR`);\n\n        // Build actions for CreateAccount + Transfer + AddKey(FullAccess)\n        const actions: ActionArgsWasm[] = [\n          { action_type: ActionType.CreateAccount },\n          { action_type: ActionType.Transfer, deposit: String(initialBalance) },\n          {\n            action_type: ActionType.AddKey,\n            public_key: request.publicKey,\n            access_key: JSON.stringify({\n              nonce: 0,\n              permission: { FullAccess: {} },\n            }),\n          }\n        ];\n\n        actions.forEach(validateActionArgsWasm);\n\n        // Fetch nonce and block hash for relayer\n        const { nextNonce, blockHash } = await this.fetchTxContext(this.config.relayerAccountId, this.relayerPublicKey);\n\n        // Sign with relayer private key using WASM\n        const signed = await this.signWithPrivateKey({\n          nearPrivateKey: this.config.relayerPrivateKey,\n          signerAccountId: this.config.relayerAccountId,\n          receiverId: request.accountId,\n          nonce: nextNonce,\n          blockHash: blockHash,\n          actions\n        });\n\n        // Broadcast transaction via MinimalNearClient using a strongly typed SignedTransaction\n        const result = await this.nearClient.sendTransaction(signed);\n\n        this.logger.info(`Account creation completed: ${result.transaction.hash}`);\n        const nearAmount = (Number(BigInt(initialBalance)) / 1e24).toFixed(6);\n        return {\n          success: true,\n          transactionHash: result.transaction.hash,\n          accountId: request.accountId,\n          message: `Account ${request.accountId} created with ${nearAmount} NEAR initial balance`\n        };\n\n      } catch (error: any) {\n        this.logger.error(`Account creation failed for ${request.accountId}:`, error);\n        const msg = errorMessage(error) || 'Unknown account creation error';\n        return {\n          success: false,\n          error: msg,\n          message: `Failed to create account ${request.accountId}: ${msg}`\n        };\n      }\n    }, `create account ${request.accountId}`);\n  }\n\n  /**\n   * Create account and register user with WebAuthn in a single atomic transaction\n   */\n  async createAccountAndRegisterUser(request: CreateAccountAndRegisterRequest): Promise<CreateAccountAndRegisterResult> {\n    await this._ensureSignerAndRelayerAccount();\n\n    return this.queueTransaction(async () => {\n      try {\n        if (!isValidAccountId(request.new_account_id)) {\n          throw new Error(`Invalid account ID format: ${request.new_account_id}`);\n        }\n\n        this.logger.info(`Registering account: ${request.new_account_id}`);\n        this.logger.info(`Contract: ${this.config.webAuthnContractId}`);\n\n        const vrf_data = normalizeContractVrfDataForContract((request as unknown as { vrf_data?: unknown }).vrf_data);\n        const deterministic_vrf_public_key = normalizeU8ArrayLike(\n          (request as unknown as { deterministic_vrf_public_key?: unknown }).deterministic_vrf_public_key,\n          'deterministic_vrf_public_key',\n        );\n\n        // Prepare contract arguments\n        const contractArgs = {\n          new_account_id: request.new_account_id,\n          new_public_key: request.new_public_key,\n          vrf_data,\n          webauthn_registration: request.webauthn_registration,\n          deterministic_vrf_public_key,\n          authenticator_options: request.authenticator_options,\n        };\n\n        // Build single FunctionCall action\n        const actions: ActionArgsWasm[] = [\n          {\n            action_type: ActionType.FunctionCall,\n            method_name: 'create_account_and_register_user',\n            args: JSON.stringify(contractArgs),\n            gas: String(this.config.createAccountAndRegisterGas),\n            deposit: String(this.config.accountInitialBalance)\n          }\n        ];\n        actions.forEach(validateActionArgsWasm);\n\n        const { nextNonce, blockHash } = await this.fetchTxContext(this.config.relayerAccountId, this.relayerPublicKey);\n        const signed = await this.signWithPrivateKey({\n          nearPrivateKey: this.config.relayerPrivateKey,\n          signerAccountId: this.config.relayerAccountId,\n          receiverId: this.config.webAuthnContractId,\n          nonce: nextNonce,\n          blockHash,\n          actions\n        });\n        const result = await this.nearClient.sendTransaction(signed);\n\n        // Parse contract execution results to detect failures\n        const contractError = parseContractExecutionError(result, request.new_account_id);\n        if (contractError) {\n          this.logger.error(`Contract execution failed for ${request.new_account_id}:`, contractError);\n          throw new Error(contractError);\n        }\n\n        this.logger.info(`Registration completed: ${result.transaction.hash}`);\n        return {\n          success: true,\n          transactionHash: result.transaction.hash,\n          message: `Account ${request.new_account_id} created and registered successfully`,\n          contractResult: result,\n        };\n\n      } catch (error: any) {\n        this.logger.error(`Atomic registration failed for ${request.new_account_id}:`, error);\n        const msg = errorMessage(error) || 'Unknown atomic registration error';\n        return {\n          success: false,\n          error: msg,\n          message: `Failed to create and register account ${request.new_account_id}: ${msg}`\n        };\n      }\n    }, `atomic create and register ${request.new_account_id}`);\n  }\n\n  /**\n   * Verify authentication response and issue JWT (VIEW call)\n   * Calls the web3authn contract's verify_authentication_response method via view\n   * and issues a JWT or session credential upon successful verification\n   */\n  async verifyAuthenticationResponse(\n    request: VerifyAuthenticationRequest\n  ): Promise<VerifyAuthenticationResponse> {\n    try {\n      await this._ensureSignerAndRelayerAccount();\n\n      const intentDigest32 = request?.vrf_data?.intent_digest_32;\n      if (!Array.isArray(intentDigest32) || intentDigest32.length !== 32) {\n        return {\n          success: false,\n          verified: false,\n          code: 'invalid_intent_digest',\n          message: 'Missing or invalid vrf_data.intent_digest_32 (expected 32 bytes)',\n        };\n      }\n      const sessionPolicyDigest32 = (request?.vrf_data as { session_policy_digest_32?: unknown })?.session_policy_digest_32;\n      if (sessionPolicyDigest32 !== undefined) {\n        if (!Array.isArray(sessionPolicyDigest32) || sessionPolicyDigest32.length !== 32) {\n          return {\n            success: false,\n            verified: false,\n            code: 'invalid_session_policy_digest',\n            message: 'Invalid vrf_data.session_policy_digest_32 (expected 32 bytes when present)',\n          };\n        }\n      }\n\n      const args = {\n        vrf_data: request.vrf_data,\n        webauthn_authentication: request.webauthn_authentication,\n      };\n\n      // Perform a VIEW function call (no gas) and parse the contract response\n      const contractResponse = await this.nearClient.view<typeof args, unknown>({\n        account: this.config.webAuthnContractId,\n        method: 'verify_authentication_response',\n        args\n      });\n\n      const verified = isObject(contractResponse) && contractResponse.verified === true;\n      if (!verified) {\n        return {\n          success: false,\n          verified: false,\n          code: 'not_verified',\n          message: 'Authentication verification failed',\n          contractResponse,\n        };\n      }\n\n      return {\n        success: true,\n        verified: true,\n        sessionCredential: {\n          userId: request.vrf_data.user_id,\n          issuedAt: new Date().toISOString(),\n          expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString(),\n        },\n        contractResponse,\n      };\n    } catch (error: any) {\n      return {\n        success: false,\n        verified: false,\n        code: 'internal',\n        message: error?.message || 'Verification failed',\n      };\n    }\n  }\n\n  /**\n   * Fetch Related Origin Requests (ROR) allowed origins from a NEAR view method.\n   * Defaults: contractId = webAuthnContractId, method = 'get_allowed_origins', args = {}.\n   * Returns a sanitized, deduplicated list of absolute origins.\n   */\n  public async getRorOrigins(opts?: { contractId?: string; method?: string; args?: unknown }): Promise<string[]> {\n    const contractId = toOptionalTrimmedString(opts?.contractId) || this.config.webAuthnContractId.trim();\n    const method = toOptionalTrimmedString(opts?.method) || 'get_allowed_origins';\n    const args = opts?.args ?? {};\n\n    try {\n      const result = await this.nearClient.view<unknown, unknown>({ account: contractId, method, args });\n      let list: unknown[] = [];\n      if (Array.isArray(result)) {\n        list = result;\n      } else if (isObject(result) && Array.isArray(result.origins)) {\n        list = result.origins;\n      }\n      const out = new Set<string>();\n      for (const item of list) {\n        const norm = toRorOriginOrNull(item);\n        if (norm) out.add(norm);\n      }\n      return Array.from(out);\n    } catch (e) {\n      this.logger.warn('[AuthService] getRorOrigins failed:', e);\n      return [];\n    }\n  }\n\n  /**\n   * Account existence helper used by registration flows.\n   */\n  async checkAccountExists(accountId: string): Promise<boolean> {\n    await this._ensureSignerAndRelayerAccount();\n    const isNotFound = (m: string) => /does not exist|UNKNOWN_ACCOUNT|unknown\\s+account/i.test(m);\n    const isRetryable = (m: string) => /server error|internal|temporar|timeout|too many requests|429|empty response|rpc request failed/i.test(m);\n    const attempts = 3;\n    let lastErr: Error | null = null;\n    for (let i = 1; i <= attempts; i++) {\n      try {\n        const view = await this.nearClient.viewAccount(accountId);\n        return !!view;\n      } catch (error: unknown) {\n        const err = toError(error);\n        lastErr = err;\n        const msg = err.message;\n        const details = (err as { details?: unknown }).details;\n        let detailsBlob = '';\n        if (details) {\n          try {\n            detailsBlob = typeof details === 'string' ? details : JSON.stringify(details);\n          } catch {\n            detailsBlob = '';\n          }\n        }\n        const combined = `${msg}\\n${detailsBlob}`;\n        if (isNotFound(combined)) return false;\n        if (isRetryable(msg) && i < attempts) {\n          const backoff = 150 * Math.pow(2, i - 1);\n          await new Promise((r) => setTimeout(r, backoff));\n          continue;\n        }\n        // As a safety valve for flaky RPCs, treat persistent retryable errors as not-found\n        if (isRetryable(msg)) {\n          this.logger.warn(`[AuthService] Assuming account '${accountId}' not found after retryable RPC errors:`, msg);\n          return false;\n        }\n        this.logger.error(`Error checking account existence for ${accountId}:`, err);\n        throw err;\n      }\n    }\n    throw lastErr || new Error('Unknown error');\n  }\n\n  /**\n   * ===== Delegate actions & transaction execution =====\n   *\n   * Flows that build and submit on-chain transactions, including NEP-461\n   * SignedDelegate meta-transactions.\n   */\n\n  /**\n   * Execute a NEP-461 SignedDelegate by wrapping it in an outer transaction\n   * from the relayer account. This method is intended to be called by\n   * example relayers (Node/Cloudflare) once a SignedDelegate has been\n   * produced by the signer worker and returned to the application.\n   *\n   * Notes:\n   * - Signature and hash computation are performed by the signer worker.\n   *   This method focuses on expiry/policy enforcement and meta-tx submission.\n   * - Nonce/replay protection is left to the integrator; see docs for guidance.\n   */\n  async executeSignedDelegate(input: {\n    hash: string;\n    signedDelegate: SignedDelegate;\n    policy?: DelegateActionPolicy;\n  }): Promise<ExecuteSignedDelegateResult> {\n    await this._ensureSignerAndRelayerAccount();\n\n    if (!input?.hash || !input?.signedDelegate) {\n      return {\n        ok: false,\n        code: 'invalid_delegate_request',\n        error: 'hash and signedDelegate are required',\n      };\n    }\n\n    const senderId = input.signedDelegate?.delegateAction?.senderId ?? 'unknown-sender';\n\n    return this.queueTransaction(\n      () => executeSignedDelegateWithRelayer({\n        nearClient: this.nearClient,\n        relayerAccountId: this.config.relayerAccountId,\n        relayerPublicKey: this.relayerPublicKey,\n        relayerPrivateKey: this.config.relayerPrivateKey,\n        hash: input.hash,\n        signedDelegate: input.signedDelegate,\n        signWithPrivateKey: (args) => this.signWithPrivateKey(args),\n      }),\n      `execute signed delegate for ${senderId}`,\n    );\n  }\n\n  // === Internal helpers for signing & RPC ===\n  private async fetchTxContext(accountId: string, publicKey: string): Promise<{ nextNonce: string; blockHash: string }> {\n    // Access key (if missing, assume nonce=0)\n    let nonce = 0n;\n    try {\n      const ak = await this.nearClient.viewAccessKey(accountId, publicKey);\n      nonce = BigInt(ak?.nonce ?? 0);\n    } catch {\n      nonce = 0n;\n    }\n    // Block\n    const block = await this.nearClient.viewBlock({ finality: 'final' });\n    const txBlockHash = block.header.hash;\n    const nextNonce = (nonce + 1n).toString();\n    return { nextNonce, blockHash: txBlockHash };\n  }\n\n  private async signWithPrivateKey(input: {\n    nearPrivateKey: string;\n    signerAccountId: string;\n    receiverId: string;\n    nonce: string;\n    blockHash: string;\n    actions: ActionArgsWasm[];\n  }): Promise<SignedTransaction> {\n    await this.ensureSignerWasm();\n    const message = {\n      type: WorkerRequestType.SignTransactionWithKeyPair,\n      payload: {\n        nearPrivateKey: input.nearPrivateKey,\n        signerAccountId: input.signerAccountId,\n        receiverId: input.receiverId,\n        nonce: input.nonce,\n        blockHash: input.blockHash,\n        actions: input.actions\n      }\n    };\n    // uses wasm signer worker's SignTransactionWithKeyPair action,\n    // which doesn't require VRF worker session\n    let response: unknown;\n    try {\n      response = await handle_signer_message(message);\n    } catch (e: unknown) {\n      const msg = errorMessage(e);\n      // Log payload for debugging (redacting private key)\n      this.logger.error('Signer WASM rejected message:', {\n        error: msg,\n        payload: JSON.stringify(message, (key, value) =>\n          key === 'nearPrivateKey' ? '[REDACTED]' : value\n        )\n      });\n\n      // This specific error is intentionally redacted inside the WASM worker.\n      // When it occurs in production, it's commonly due to a JS/WASM version mismatch\n      // (the JS message schema changed but an old worker wasm is still deployed).\n      if (msg.includes('Invalid payload for SIGN_TRANSACTION_WITH_KEYPAIR')) {\n        throw new Error(\n          `Signer WASM rejected SIGN_TRANSACTION_WITH_KEYPAIR payload: ${msg}. Rebuild + redeploy the relayer so the bundled \\`wasm_signer_worker.js\\` and \\`wasm_signer_worker_bg.wasm\\` come from the same build.`,\n        );\n      }\n      throw (e instanceof Error ? e : new Error(msg || 'Signing failed'));\n    }\n    const {\n      transaction,\n      signature,\n      borshBytes\n    } = extractFirstSignedTransactionFromWorkerResponse(response);\n\n    return new SignedTransaction({\n      transaction: transaction,\n      signature: signature,\n      borsh_bytes: borshBytes,\n    });\n  }\n\n  /**\n   * Framework-agnostic: handle verify-authentication request\n   * Converts a generic ServerRequest to ServerResponse using this service\n   */\n  async handleVerifyAuthenticationResponse(request: VerifyAuthenticationRequest): Promise<VerifyAuthenticationResponse> {\n    return this.verifyAuthenticationResponse(request);\n  }\n\n  /**\n   * ZK-email recovery helper (stub).\n   * Intended to call the global ZkEmailVerifier and per-user recovery contract\n   * once zk-email proofs and public inputs are wired through.\n   */\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  async recoverAccountFromZkEmailVerifier(_request: {\n    accountId: string;\n    proof: unknown;\n    publicInputs: unknown;\n  }): Promise<{\n    success: boolean;\n    transactionHash?: string;\n    message?: string;\n    error?: string;\n  }> {\n    return {\n      success: false,\n      error: 'recoverAccountFromZkEmailVerifier is not yet implemented',\n      message: 'recoverAccountFromZkEmailVerifier is not yet implemented',\n    };\n  }\n\n  /**\n   * Express-style middleware factory for verify-authentication\n   */\n  verifyAuthenticationMiddleware() {\n    return async (req: any, res: any) => {\n      try {\n        if (!req?.body) {\n          res.status(400).json({ error: 'Request body is required' });\n          return;\n        }\n        const body: VerifyAuthenticationRequest = req.body;\n        if (!body.vrf_data || !body.webauthn_authentication) {\n          res.status(400).json({ code: 'invalid_body', message: 'vrf_data and webauthn_authentication are required' });\n          return;\n        }\n        const result = await this.verifyAuthenticationResponse(body);\n        const status = result.success ? 200 : 400;\n        if (status !== 200) {\n          res.status(status).json({ code: 'not_verified', message: result.message || 'Authentication verification failed' });\n        } else {\n          res.status(status).json(result);\n        }\n      } catch (error: any) {\n        this.logger.error('Error in verify authentication middleware:', error);\n        res.status(500).json({ code: 'internal', message: error?.message || 'Internal server error' });\n      }\n    };\n  }\n\n  /**\n   * Queue transactions to prevent nonce conflicts\n   */\n  private async queueTransaction<T>(operation: () => Promise<T>, description: string): Promise<T> {\n    this.queueStats.pending++;\n    this.logger.debug(`[AuthService] Queueing: ${description} (pending: ${this.queueStats.pending})`);\n\n    this.transactionQueue = this.transactionQueue\n      .then(async () => {\n        try {\n          this.logger.debug(`[AuthService] Executing: ${description}`);\n          const result = await operation();\n          this.queueStats.completed++;\n          this.queueStats.pending--;\n          this.logger.debug(`[AuthService] Completed: ${description} (pending: ${this.queueStats.pending})`);\n          return result;\n        } catch (error: any) {\n          this.queueStats.failed++;\n          this.queueStats.pending--;\n          this.logger.error(\n            `[AuthService] Failed: ${description} (failed: ${this.queueStats.failed}):`,\n            errorMessage(error) || 'unknown error',\n          );\n          throw error;\n        }\n      })\n      .catch((error) => {\n        throw error;\n      });\n\n    return this.transactionQueue;\n  }\n}\n\ninterface WorkerSignedTransactionPayload {\n  transaction: WasmTransaction;\n  signature: WasmSignature;\n  borshBytes?: number[];\n  borsh_bytes?: number[];\n}\n\nfunction extractFirstSignedTransactionFromWorkerResponse(response: any): {\n  transaction: WasmTransaction;\n  signature: WasmSignature;\n  borshBytes: number[];\n} {\n  const res = (typeof response === 'string' ? JSON.parse(response) : response) as {\n    type?: WorkerResponseType;\n    payload?: { signedTransactions?: WorkerSignedTransactionPayload[]; error?: string };\n  } | undefined;\n\n  if (res?.type !== WorkerResponseType.SignTransactionWithKeyPairSuccess) {\n    const errMsg = res?.payload?.error || 'Signing failed';\n    throw new Error(errMsg);\n  }\n\n  const payload = res?.payload;\n  const signedTxs = (payload?.signedTransactions ?? []) as WorkerSignedTransactionPayload[];\n  if (!Array.isArray(signedTxs) || signedTxs.length === 0) {\n    throw new Error('No signed transaction returned');\n  }\n  const first = signedTxs[0];\n  const borshBytes = first?.borshBytes ?? first?.borsh_bytes;\n  if (!Array.isArray(borshBytes)) {\n    throw new Error('Missing borsh bytes');\n  }\n  return {\n    transaction: first.transaction,\n    signature: first.signature,\n    borshBytes,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA6CA,SAAS,SAAS,GAA0C;AAC1D,QAAO,CAAC,CAAC,KAAK,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ;;AAGxD,SAAS,qBAAqB,OAAgB,WAA6B;AACzE,KAAI,iBAAiB,WAAY,QAAO,MAAM,KAAK;AACnD,KAAI,OAAO,UAAU,SACnB,KAAI;AACF,SAAO,MAAM,KAAKA,+BAAgB;UAC3B,KAAK;AACZ,QAAM,IAAI,MAAM,WAAW,UAAU,+BAA+BC,4BAAa,QAAQ,gBAAgB;;AAG7G,KAAI,MAAM,QAAQ,QAAQ;EACxB,MAAMC,MAAgB;AACtB,OAAK,MAAM,KAAK,OAAO;GACrB,MAAM,IAAI,OAAO;AACjB,OAAI,CAAC,OAAO,SAAS,MAAM,IAAI,KAAK,IAAI,IACtC,OAAM,IAAI,MAAM,WAAW,UAAU;AAEvC,OAAI,KAAK,KAAK,MAAM;;AAEtB,SAAO;;AAET,OAAM,IAAI,MAAM,WAAW,UAAU;;AAGvC,SAAS,oCAAoC,OAAyC;AACpF,KAAI,CAAC,SAAS,OAAQ,OAAM,IAAI,MAAM;CACtC,MAAM,UAAUC,2CAAwB,MAAM;CAC9C,MAAM,QAAQA,2CAAwB,MAAM;CAC5C,MAAM,mBAAmB,MAAM;CAC/B,MAAM,eAAe,OAAO,qBAAqB,WAC7C,mBACA,OAAO;AAEX,KAAI,CAAC,QAAS,OAAM,IAAI,MAAM;AAC9B,KAAI,CAAC,MAAO,OAAM,IAAI,MAAM;AAC5B,KAAI,CAAC,OAAO,SAAS,iBAAiB,gBAAgB,EAAG,OAAM,IAAI,MAAM;CAEzE,MAAMC,OAAgC;EACpC,gBAAgB,qBAAqB,MAAM,gBAAgB;EAC3D,YAAY,qBAAqB,MAAM,YAAY;EACnD,WAAW,qBAAqB,MAAM,WAAW;EACjD,YAAY,qBAAqB,MAAM,YAAY;EACnD;EACA;EACA;EACA,YAAY,qBAAqB,MAAM,YAAY;EACnD,kBAAkB,qBAAqB,MAAM,kBAAkB;;AAGjE,KAAI,OAAO,UAAU,eAAe,KAAK,OAAO,6BAA6B;EAC3E,MAAM,IAAI,MAAM;AAChB,MAAI,KAAK,KACP,MAAK,2BAA2B,qBAAqB,GAAG;;AAI5D,QAAO;;AAQT,MAAM,wBAAwB;AAE9B,MAAM,4BAA4B;AAElC,SAAS,kBAAkB,QAAiC;CAC1D,MAAM,QAAQ,CAAC,uBAAuB;CACtC,MAAMC,WAAkB;CACxB,MAAM;AAEN,MAAK,MAAM,QAAQ,MACjB,KAAI;AACF,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM;AAC9B,WAAS,KAAK,IAAI,IAAI,MAAM;UACrB,KAAK;AACZ,SAAO,KAAK,wDAAwD,KAAK,KAAK;;AAIlF,KAAI,CAAC,SAAS,OACZ,OAAM,IAAI,MAAM;AAGlB,QAAO;;AAGT,SAAS,gCAAgC,KAA4D;AACnG,KAAI,CAAC,IAAK,QAAO;CAEjB,MAAM,WAAWC,yCAAwB,IAAI;CAC7C,MAAM,YAAYC,iDAAgC,IAAI;CAEtD,MAAM,yBAAyB;AAC7B,MAAI,UAAU,IAAK,QAAO;AAC1B,SAAO,QAAQJ,2CAAwB,IAAI;;CAG7C,MAAM,eAAe;AACnB,MAAI,UAAU,KAAK;AACjB,OAAI,IAAI,SAAS,qBAAsB,QAAO;AAC9C,OAAI,IAAI,SAAS,YAAa,QAAO;AACrC,UAAO;;EAET,MAAM,aAAaA,2CAAwB,IAAI;EAC/C,MAAM,eAAeA,2CAAwB,IAAI;EACjD,MAAM,WAAWA,2CAAwB,IAAI;AAC7C,SAAQ,cAAc,eAAgB,YAAa,WAAW,UAAU;;CAG1E,MAAM,QAAQ;EAAC;EAAgC,YAAY;EAAY,aAAa;EAAa,SAAS;;AAC1G,KAAI,gBAAiB,OAAM,KAAK;AAChC,QAAO,MAAM,KAAK;;;;;;AAOpB,IAAa,cAAb,MAAyB;CACvB,AAAQ;CACR,AAAQ,gBAAgB;CACxB,AAAQ;CACR,AAAQ,mBAA2B;CACnC,AAAQ,kBAAkB;CAC1B,AAAiB;CACjB,AAAQ,qCAAqC;CAC7C,AAAQ,0BAA8D;CAGtE,AAAQ,mBAAiC,QAAQ;CACjD,AAAQ,aAAa;EAAE,SAAS;EAAG,WAAW;EAAG,QAAQ;;CAGzD,AAAgB,gBAAsC;CAEtD,AAAgB,gBAA6C;CAE7D,YAAY,QAAgC;AAC1C,OAAK,SAASK,uCAAwB;AACtC,OAAK,SAASC,4BAAa,KAAK,OAAO;EACvC,MAAM,sBAAsB,KAAK,OAAO,QAAQ,uBAAuB,IAAI;AAC3E,OAAK,gBAAgB,IAAIC,oCAAc,KAAK,OAAO,QAAQ,sBAAsB;AACjF,OAAK,aAAa,IAAIC,qCAAkB,KAAK,OAAO;AACpD,OAAK,gBAAgB,IAAIC,mCAAqB;GAC5C,kBAAkB,KAAK,OAAO;GAC9B,mBAAmB,KAAK,OAAO;GAC/B,WAAW,KAAK,OAAO;GACvB,2BAA2BC,wDAAiC;GAC5D,YAAY,KAAK;GACjB,QAAQ,KAAK,OAAO;GACpB,qCAAqC,KAAK;GAC1C,mBAAsB,IAAsB,UAAkB,KAAK,iBAAiB,IAAI;GACxF,iBAAiB,WAAmB,cAAsB,KAAK,eAAe,WAAW;GACzF,qBAAqB,UAAU,KAAK,mBAAmB;GACvD,2BAA2B,KAAK;GAChC,eAAe,KAAK,OAAO;;AAK7B,OAAK,OAAO,KAAK;;mBAEF,KAAK,OAAO,UAAU;oBACrB,KAAK,OAAO,WAAW;0BACjB,KAAK,OAAO,iBAAiB;4BAC3B,KAAK,OAAO,mBAAmB;+BAC5B,KAAK,OAAO,sBAAsB,IAAIC,gCAAkB,KAAK,OAAO,uBAAuB;qCACrF,KAAK,OAAO,4BAA4B,IAAIC,8BAAgB,KAAK,OAAO,6BAA6B;MACpI,KAAK,OAAO,SACR,oBAAoB,KAAK,OAAO,OAAO,cAAc,MAAM,GAAG,IAAI,8BAA8B,KAAK,OAAO,OAAO,gBAAgB,MAAM,GAAG,IAAI,8BAA8B,KAAK,OAAO,OAAO,gBAAgB,MAAM,GAAG,IAAI,OAC9N,2BACH;QACC,gCAAgC,KAAK,OAAO,0BAA0B;MACxE,KAAK,OAAO,eAAe,UACvB,oBAAoB,KAAK,OAAO,cAAc,YAC9C,kCACH;;;CAIL,MAAM,oBAAuE;AAC3E,QAAM,KAAK;AACX,SAAO;GACL,WAAW,KAAK,OAAO;GACvB,WAAW,KAAK;;;CAIpB,MAAM,kBAAkB,WAA2C;AACjE,QAAM,KAAK;AACX,SAAO,KAAK,WAAW,kBAAkB;;;;;;CAO3C,6BAAiE;AAC/D,MAAI,KAAK,mCAAoC,QAAO,KAAK;AACzD,OAAK,qCAAqC;AAE1C,MAAI,CAAC,KAAK,OAAO,0BAA0B;AACzC,QAAK,0BAA0B;AAC/B,UAAO;;AAGT,OAAK,0BAA0BC,oEAA8B;GAC3D,aAAa;GACb,0BAA0B,KAAK,OAAO;GACtC,QAAQ,KAAK;GACb,QAAQ,KAAK;;AAEf,SAAO,KAAK;;CAGd,wBAAgC;AAC9B,SAAO,KAAK,OAAO;;CAGrB,MAAM,SAAS,QAAgB,iBAAyD;AACtF,QAAM,KAAK;AACX,SAAO,KAAK,WAAW,SAAS,QAAQ;;;;;;CAO1C,MAAc,mCAAkD;AAC9D,MAAI,CAAC,KAAK,OAAO,QAAQ,aACvB;EAGF,MAAM,EAAE,gCAAgC,2CAAM;AAC9C,8BAA4B,KAAK,OAAO,OAAO;;CAGjD,MAAc,iCAAgD;AAC5D,MAAI,KAAK,cACP;AAIF,MAAI,KAAK,OAAO,UAAU,KAAK,eAAe;AAC5C,SAAM,KAAK;AACX,SAAM,KAAK,cAAc;;AAI3B,MAAI;AACF,QAAK,mBAAmBC,gDAA+B,KAAK,OAAO;WAC5D,GAAG;AACV,QAAK,OAAO,KAAK;AACjB,QAAK,mBAAmB;;AAI1B,QAAM,KAAK;AACX,OAAK,gBAAgB;;CAGvB,MAAc,mBAAkC;AAC9C,MAAI,KAAK,gBAAiB;EAC1B,MAAM,WAAW,KAAK,OAAO,YAAY;AACzC,MAAI,SACF,KAAI;GACF,MAAM,eAAe,MAAM,KAAK,0BAA0B;AAC1D,uEAAqB,EAAE,gBAAgB;AACvC,QAAK,kBAAkB;AACvB;WACO,GAAG;AACV,QAAK,OAAO,MAAM,2DAA2D;AAC7E,SAAM;;EAIV,IAAIC;AACJ,MAAI;AACF,gBAAa,kBAAkB,KAAK;WAC7B,KAAK;AACZ,QAAK,OAAO,MAAM,uCAAuC;AACzD,SAAM;;AAGR,MAAI;AACF,OAAI,KAAK,qBAAqB;AAC5B,UAAM,KAAK,sBAAsB;AACjC,SAAK,kBAAkB;AACvB;;GAGF,IAAIC,YAAqB;AACzB,QAAK,MAAM,aAAa,WACtB,KAAI;AACF,wEAAqB,EAAE,gBAAgB;AACvC,SAAK,kBAAkB;AACvB;YACO,KAAK;AACZ,gBAAY;AACZ,SAAK,OAAO,KAAK,yCAAyC,UAAU,WAAW;;AAInF,SAAM,6BAAa,IAAI,MAAM;WACtB,GAAG;AACV,QAAK,OAAO,MAAM,qCAAqC;AACvD,SAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO;;;CAIpD,AAAQ,oBAA6B;EAEnC,MAAM,aAAc,WAAyE;EAC7F,MAAM,SAAS,QAAQ,YAAY,UAAU;EAE7C,MAAM,gBAAiB,WAAsD;EAC7E,MAAM,MAAO,WAAkE;EAC/E,MAAM,qBAAqB,OAAO,kBAAkB,eAC9C,OAAO,KAAK,cAAc,YAAY,IAAI,UAAU,SAAS;AACnE,SAAO,UAAU,CAAC;;CAGpB,MAAc,0BAA0B,UAAwD;EAC9F,MAAM,YAAY,OAAO,aAAa,aAClC,MAAO,aACP,MAAM;AAEV,MAAI,CAAC,UACH,OAAM,IAAI,MAAM;AAGlB,SAAO;;;;;;CAOT,MAAc,sBAAsB,YAAkC;EACpE,MAAM,EAAE,kBAAkB,MAAM,OAAO;EACvC,MAAM,EAAE,aAAa,MAAM,OAAO;AAGlC,OAAK,MAAM,OAAO,WAChB,KAAI;GACF,MAAM,WAAW,cAAc;GAC/B,MAAM,QAAQ,MAAM,SAAS;GAE7B,MAAM,KAAK,IAAI,YAAY,MAAM;AACjC,OAAI,WAAW,IAAI,IAAI;GACvB,MAAMC,WAAS,MAAM,YAAY,QAAQ;AACzC,uEAAqB,EAAE,gBAAgBA;AACvC;UACM;AAIV,OAAK,MAAM,OAAO,WAChB,KAAI;GACF,MAAM,WAAW,cAAc;AAC/B,uEAAqB,EAAE,gBAAgB;AACvC;UACM;AAGV,QAAM,IAAI,MAAM;;;;;;;;;;;CAalB,MAAM,cAAc,SAAiE;AACnF,QAAM,KAAK;AAEX,SAAO,KAAK,iBAAiB,YAAY;AACvC,OAAI;AACF,QAAI,CAACC,oCAAiB,QAAQ,WAC5B,OAAM,IAAI,MAAM,8BAA8B,QAAQ;AAIxD,SAAK,OAAO,KAAK,uBAAuB,QAAQ,UAAU;IAC1D,MAAM,gBAAgB,MAAM,KAAK,mBAAmB,QAAQ;AAC5D,QAAI,cACF,OAAM,IAAI,MAAM,WAAW,QAAQ,UAAU;AAE/C,SAAK,OAAO,KAAK,WAAW,QAAQ,UAAU;IAE9C,MAAM,iBAAiB,KAAK,OAAO;AAEnC,SAAK,OAAO,KAAK,qBAAqB,QAAQ;AAC9C,SAAK,OAAO,KAAK,oBAAoB,eAAe;IAGpD,MAAMC,UAA4B;KAChC,EAAE,aAAaC,2BAAW;KAC1B;MAAE,aAAaA,2BAAW;MAAU,SAAS,OAAO;;KACpD;MACE,aAAaA,2BAAW;MACxB,YAAY,QAAQ;MACpB,YAAY,KAAK,UAAU;OACzB,OAAO;OACP,YAAY,EAAE,YAAY;;;;AAKhC,YAAQ,QAAQC;IAGhB,MAAM,EAAE,WAAW,cAAc,MAAM,KAAK,eAAe,KAAK,OAAO,kBAAkB,KAAK;IAG9F,MAAM,SAAS,MAAM,KAAK,mBAAmB;KAC3C,gBAAgB,KAAK,OAAO;KAC5B,iBAAiB,KAAK,OAAO;KAC7B,YAAY,QAAQ;KACpB,OAAO;KACI;KACX;;IAIF,MAAM,SAAS,MAAM,KAAK,WAAW,gBAAgB;AAErD,SAAK,OAAO,KAAK,+BAA+B,OAAO,YAAY;IACnE,MAAM,cAAc,OAAO,OAAO,mBAAmB,MAAM,QAAQ;AACnE,WAAO;KACL,SAAS;KACT,iBAAiB,OAAO,YAAY;KACpC,WAAW,QAAQ;KACnB,SAAS,WAAW,QAAQ,UAAU,gBAAgB,WAAW;;YAG5DC,OAAY;AACnB,SAAK,OAAO,MAAM,+BAA+B,QAAQ,UAAU,IAAI;IACvE,MAAM,MAAMxB,4BAAa,UAAU;AACnC,WAAO;KACL,SAAS;KACT,OAAO;KACP,SAAS,4BAA4B,QAAQ,UAAU,IAAI;;;KAG9D,kBAAkB,QAAQ;;;;;CAM/B,MAAM,6BAA6B,SAAmF;AACpH,QAAM,KAAK;AAEX,SAAO,KAAK,iBAAiB,YAAY;AACvC,OAAI;AACF,QAAI,CAACoB,oCAAiB,QAAQ,gBAC5B,OAAM,IAAI,MAAM,8BAA8B,QAAQ;AAGxD,SAAK,OAAO,KAAK,wBAAwB,QAAQ;AACjD,SAAK,OAAO,KAAK,aAAa,KAAK,OAAO;IAE1C,MAAM,WAAW,oCAAqC,QAA8C;IACpG,MAAM,+BAA+B,qBAClC,QAAkE,8BACnE;IAIF,MAAM,eAAe;KACnB,gBAAgB,QAAQ;KACxB,gBAAgB,QAAQ;KACxB;KACA,uBAAuB,QAAQ;KAC/B;KACA,uBAAuB,QAAQ;;IAIjC,MAAMC,UAA4B,CAChC;KACE,aAAaC,2BAAW;KACxB,aAAa;KACb,MAAM,KAAK,UAAU;KACrB,KAAK,OAAO,KAAK,OAAO;KACxB,SAAS,OAAO,KAAK,OAAO;;AAGhC,YAAQ,QAAQC;IAEhB,MAAM,EAAE,WAAW,cAAc,MAAM,KAAK,eAAe,KAAK,OAAO,kBAAkB,KAAK;IAC9F,MAAM,SAAS,MAAM,KAAK,mBAAmB;KAC3C,gBAAgB,KAAK,OAAO;KAC5B,iBAAiB,KAAK,OAAO;KAC7B,YAAY,KAAK,OAAO;KACxB,OAAO;KACP;KACA;;IAEF,MAAM,SAAS,MAAM,KAAK,WAAW,gBAAgB;IAGrD,MAAM,gBAAgBE,6CAA4B,QAAQ,QAAQ;AAClE,QAAI,eAAe;AACjB,UAAK,OAAO,MAAM,iCAAiC,QAAQ,eAAe,IAAI;AAC9E,WAAM,IAAI,MAAM;;AAGlB,SAAK,OAAO,KAAK,2BAA2B,OAAO,YAAY;AAC/D,WAAO;KACL,SAAS;KACT,iBAAiB,OAAO,YAAY;KACpC,SAAS,WAAW,QAAQ,eAAe;KAC3C,gBAAgB;;YAGXD,OAAY;AACnB,SAAK,OAAO,MAAM,kCAAkC,QAAQ,eAAe,IAAI;IAC/E,MAAM,MAAMxB,4BAAa,UAAU;AACnC,WAAO;KACL,SAAS;KACT,OAAO;KACP,SAAS,yCAAyC,QAAQ,eAAe,IAAI;;;KAGhF,8BAA8B,QAAQ;;;;;;;CAQ3C,MAAM,6BACJ,SACuC;AACvC,MAAI;AACF,SAAM,KAAK;GAEX,MAAM,iBAAiB,SAAS,UAAU;AAC1C,OAAI,CAAC,MAAM,QAAQ,mBAAmB,eAAe,WAAW,GAC9D,QAAO;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,SAAS;;GAGb,MAAM,yBAAyB,SAAS,WAAqD;AAC7F,OAAI,0BAA0B,QAC5B;QAAI,CAAC,MAAM,QAAQ,0BAA0B,sBAAsB,WAAW,GAC5E,QAAO;KACL,SAAS;KACT,UAAU;KACV,MAAM;KACN,SAAS;;;GAKf,MAAM,OAAO;IACX,UAAU,QAAQ;IAClB,yBAAyB,QAAQ;;GAInC,MAAM,mBAAmB,MAAM,KAAK,WAAW,KAA2B;IACxE,SAAS,KAAK,OAAO;IACrB,QAAQ;IACR;;GAGF,MAAM,WAAW,SAAS,qBAAqB,iBAAiB,aAAa;AAC7E,OAAI,CAAC,SACH,QAAO;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,SAAS;IACT;;AAIJ,UAAO;IACL,SAAS;IACT,UAAU;IACV,mBAAmB;KACjB,QAAQ,QAAQ,SAAS;KACzB,2BAAU,IAAI,QAAO;KACrB,WAAW,IAAI,KAAK,KAAK,QAAQ,OAAU,KAAK,KAAM;;IAExD;;WAEKwB,OAAY;AACnB,UAAO;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,SAAS,OAAO,WAAW;;;;;;;;;CAUjC,MAAa,cAAc,MAAoF;EAC7G,MAAM,aAAatB,2CAAwB,MAAM,eAAe,KAAK,OAAO,mBAAmB;EAC/F,MAAM,SAASA,2CAAwB,MAAM,WAAW;EACxD,MAAM,OAAO,MAAM,QAAQ;AAE3B,MAAI;GACF,MAAM,SAAS,MAAM,KAAK,WAAW,KAAuB;IAAE,SAAS;IAAY;IAAQ;;GAC3F,IAAIwB,OAAkB;AACtB,OAAI,MAAM,QAAQ,QAChB,QAAO;YACE,SAAS,WAAW,MAAM,QAAQ,OAAO,SAClD,QAAO,OAAO;GAEhB,MAAM,sBAAM,IAAI;AAChB,QAAK,MAAM,QAAQ,MAAM;IACvB,MAAM,OAAOC,qCAAkB;AAC/B,QAAI,KAAM,KAAI,IAAI;;AAEpB,UAAO,MAAM,KAAK;WACX,GAAG;AACV,QAAK,OAAO,KAAK,uCAAuC;AACxD,UAAO;;;;;;CAOX,MAAM,mBAAmB,WAAqC;AAC5D,QAAM,KAAK;EACX,MAAM,cAAc,MAAc,oDAAoD,KAAK;EAC3F,MAAM,eAAe,MAAc,kGAAkG,KAAK;EAC1I,MAAM,WAAW;EACjB,IAAIC,UAAwB;AAC5B,OAAK,IAAI,IAAI,GAAG,KAAK,UAAU,IAC7B,KAAI;GACF,MAAM,OAAO,MAAM,KAAK,WAAW,YAAY;AAC/C,UAAO,CAAC,CAAC;WACFC,OAAgB;GACvB,MAAM,MAAMC,uBAAQ;AACpB,aAAU;GACV,MAAM,MAAM,IAAI;GAChB,MAAM,UAAW,IAA8B;GAC/C,IAAI,cAAc;AAClB,OAAI,QACF,KAAI;AACF,kBAAc,OAAO,YAAY,WAAW,UAAU,KAAK,UAAU;WAC/D;AACN,kBAAc;;GAGlB,MAAM,WAAW,GAAG,IAAI,IAAI;AAC5B,OAAI,WAAW,UAAW,QAAO;AACjC,OAAI,YAAY,QAAQ,IAAI,UAAU;IACpC,MAAM,UAAU,MAAM,KAAK,IAAI,GAAG,IAAI;AACtC,UAAM,IAAI,SAAS,MAAM,WAAW,GAAG;AACvC;;AAGF,OAAI,YAAY,MAAM;AACpB,SAAK,OAAO,KAAK,mCAAmC,UAAU,0CAA0C;AACxG,WAAO;;AAET,QAAK,OAAO,MAAM,wCAAwC,UAAU,IAAI;AACxE,SAAM;;AAGV,QAAM,2BAAW,IAAI,MAAM;;;;;;;;;;;;;;;;;;;CAqB7B,MAAM,sBAAsB,OAIa;AACvC,QAAM,KAAK;AAEX,MAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,eAC1B,QAAO;GACL,IAAI;GACJ,MAAM;GACN,OAAO;;EAIX,MAAM,WAAW,MAAM,gBAAgB,gBAAgB,YAAY;AAEnE,SAAO,KAAK,uBACJC,iDAAiC;GACrC,YAAY,KAAK;GACjB,kBAAkB,KAAK,OAAO;GAC9B,kBAAkB,KAAK;GACvB,mBAAmB,KAAK,OAAO;GAC/B,MAAM,MAAM;GACZ,gBAAgB,MAAM;GACtB,qBAAqB,SAAS,KAAK,mBAAmB;MAExD,+BAA+B;;CAKnC,MAAc,eAAe,WAAmB,WAAsE;EAEpH,IAAI,QAAQ;AACZ,MAAI;GACF,MAAM,KAAK,MAAM,KAAK,WAAW,cAAc,WAAW;AAC1D,WAAQ,OAAO,IAAI,SAAS;UACtB;AACN,WAAQ;;EAGV,MAAM,QAAQ,MAAM,KAAK,WAAW,UAAU,EAAE,UAAU;EAC1D,MAAM,cAAc,MAAM,OAAO;EACjC,MAAM,aAAa,QAAQ,IAAI;AAC/B,SAAO;GAAE;GAAW,WAAW;;;CAGjC,MAAc,mBAAmB,OAOF;AAC7B,QAAM,KAAK;EACX,MAAM,UAAU;GACd,MAAMC,mEAAkB;GACxB,SAAS;IACP,gBAAgB,MAAM;IACtB,iBAAiB,MAAM;IACvB,YAAY,MAAM;IAClB,OAAO,MAAM;IACb,WAAW,MAAM;IACjB,SAAS,MAAM;;;EAKnB,IAAIC;AACJ,MAAI;AACF,cAAW,kFAA4B;WAChCC,GAAY;GACnB,MAAM,MAAMlC,4BAAa;AAEzB,QAAK,OAAO,MAAM,iCAAiC;IACjD,OAAO;IACP,SAAS,KAAK,UAAU,UAAU,KAAK,UACrC,QAAQ,mBAAmB,eAAe;;AAO9C,OAAI,IAAI,SAAS,qDACf,OAAM,IAAI,MACR,+DAA+D,IAAI;AAGvE,SAAO,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO;;EAEnD,MAAM,EACJ,aACA,WACA,eACE,gDAAgD;AAEpD,SAAO,IAAImC,qCAAkB;GACd;GACF;GACX,aAAa;;;;;;;CAQjB,MAAM,mCAAmC,SAA6E;AACpH,SAAO,KAAK,6BAA6B;;;;;;;CAS3C,MAAM,kCAAkC,UASrC;AACD,SAAO;GACL,SAAS;GACT,OAAO;GACP,SAAS;;;;;;CAOb,iCAAiC;AAC/B,SAAO,OAAO,KAAU,QAAa;AACnC,OAAI;AACF,QAAI,CAAC,KAAK,MAAM;AACd,SAAI,OAAO,KAAK,KAAK,EAAE,OAAO;AAC9B;;IAEF,MAAMC,OAAoC,IAAI;AAC9C,QAAI,CAAC,KAAK,YAAY,CAAC,KAAK,yBAAyB;AACnD,SAAI,OAAO,KAAK,KAAK;MAAE,MAAM;MAAgB,SAAS;;AACtD;;IAEF,MAAM,SAAS,MAAM,KAAK,6BAA6B;IACvD,MAAM,SAAS,OAAO,UAAU,MAAM;AACtC,QAAI,WAAW,IACb,KAAI,OAAO,QAAQ,KAAK;KAAE,MAAM;KAAgB,SAAS,OAAO,WAAW;;QAE3E,KAAI,OAAO,QAAQ,KAAK;YAEnBZ,OAAY;AACnB,SAAK,OAAO,MAAM,8CAA8C;AAChE,QAAI,OAAO,KAAK,KAAK;KAAE,MAAM;KAAY,SAAS,OAAO,WAAW;;;;;;;;CAQ1E,MAAc,iBAAoB,WAA6B,aAAiC;AAC9F,OAAK,WAAW;AAChB,OAAK,OAAO,MAAM,2BAA2B,YAAY,aAAa,KAAK,WAAW,QAAQ;AAE9F,OAAK,mBAAmB,KAAK,iBAC1B,KAAK,YAAY;AAChB,OAAI;AACF,SAAK,OAAO,MAAM,4BAA4B;IAC9C,MAAM,SAAS,MAAM;AACrB,SAAK,WAAW;AAChB,SAAK,WAAW;AAChB,SAAK,OAAO,MAAM,4BAA4B,YAAY,aAAa,KAAK,WAAW,QAAQ;AAC/F,WAAO;YACAA,OAAY;AACnB,SAAK,WAAW;AAChB,SAAK,WAAW;AAChB,SAAK,OAAO,MACV,yBAAyB,YAAY,YAAY,KAAK,WAAW,OAAO,KACxExB,4BAAa,UAAU;AAEzB,UAAM;;KAGT,OAAO,UAAU;AAChB,SAAM;;AAGV,SAAO,KAAK;;;AAWhB,SAAS,gDAAgD,UAIvD;CACA,MAAM,MAAO,OAAO,aAAa,WAAW,KAAK,MAAM,YAAY;AAKnE,KAAI,KAAK,SAASqC,oEAAmB,mCAAmC;EACtE,MAAM,SAAS,KAAK,SAAS,SAAS;AACtC,QAAM,IAAI,MAAM;;CAGlB,MAAM,UAAU,KAAK;CACrB,MAAM,YAAa,SAAS,sBAAsB;AAClD,KAAI,CAAC,MAAM,QAAQ,cAAc,UAAU,WAAW,EACpD,OAAM,IAAI,MAAM;CAElB,MAAM,QAAQ,UAAU;CACxB,MAAM,aAAa,OAAO,cAAc,OAAO;AAC/C,KAAI,CAAC,MAAM,QAAQ,YACjB,OAAM,IAAI,MAAM;AAElB,QAAO;EACL,aAAa,MAAM;EACnB,WAAW,MAAM;EACjB"}

package/dist/cjs/server/core/SessionService.js.map

@@ -1 +1 @@
-{"version":3,"file":"SessionService.js","names":["token: string | null","payload: any","e: any"],"sources":["../../../../src/server/core/SessionService.ts"],"sourcesContent":["\nexport interface SessionConfig {\n  jwt?: {\n    /** Required: JWT signing hook; return a complete token */\n    signToken?: (input: { header: Record<string, unknown>; payload: Record<string, unknown> }) => Promise<string> | string;\n    /** Required: JWT verification hook */\n    verifyToken?: (token: string) => Promise<{ valid: boolean; payload?: any }> | { valid: boolean; payload?: any };\n    /** Optional: sliding refresh window (seconds) to allow /session/refresh before exp, default 900 (15 min) */\n    refreshWindowSec?: number;\n    /** Optional: build additional claims to include in the payload */\n    buildClaims?: (input: { sub: string; context?: Record<string, unknown> }) => Promise<Record<string, unknown> | void> | Record<string, unknown> | void;\n  };\n  cookie?: {\n    /** Cookie name. Default: 'w3a_session' */\n    name?: string;\n    /** Optional override: build Set-Cookie header for a new token */\n    buildSetHeader?: (token: string) => string;\n    /** Optional override: build Set-Cookie header that clears the cookie */\n    buildClearHeader?: () => string;\n    /** Optional override: extract token from headers (Authorization/Cookie) */\n    extractToken?: (headers: Record<string, string | string[] | undefined>, cookieName: string) => string | null;\n  };\n}\n\nexport class SessionService<TClaims = any> {\n  private cfg: NonNullable<SessionConfig>;\n\n  constructor(cfg: NonNullable<SessionConfig>) {\n    this.cfg = cfg || ({} as any);\n  }\n\n  getCookieName(): string {\n    return this.cfg?.cookie?.name || 'w3a_session';\n  }\n\n  buildSetCookie(token: string): string {\n    if (this.cfg?.cookie?.buildSetHeader) return this.cfg.cookie.buildSetHeader(token);\n    const name = this.getCookieName();\n    const cookieParts = [`${name}=${token}`];\n    const path = '/';\n    const httpOnly = true;\n    const secure = true; // default secure\n    const sameSite = 'Lax';\n    const maxAge = 24 * 3600; // 1 day default\n    cookieParts.push(`Path=${path}`);\n    if (httpOnly) cookieParts.push('HttpOnly');\n    if (secure) cookieParts.push('Secure');\n    if (sameSite) cookieParts.push(`SameSite=${sameSite}`);\n    if (maxAge) {\n      cookieParts.push(`Max-Age=${maxAge}`);\n      const expires = new Date(Date.now() + (maxAge * 1000)).toUTCString();\n      cookieParts.push(`Expires=${expires}`);\n    }\n    return cookieParts.join('; ');\n  }\n\n  buildClearCookie(): string {\n    if (this.cfg?.cookie?.buildClearHeader) return this.cfg.cookie.buildClearHeader();\n    const name = this.getCookieName();\n    const path = '/';\n    const secure = true;\n    const httpOnly = true;\n    const parts = [\n      `${name}=`,\n      `Path=${path}`,\n      'Max-Age=0',\n      'Expires=Thu, 01 Jan 1970 00:00:00 GMT'\n    ];\n    if (httpOnly) parts.push('HttpOnly');\n    if (secure) parts.push('Secure');\n    const sameSite = 'Lax';\n    if (sameSite) parts.push(`SameSite=${sameSite}`);\n    return parts.join('; ');\n  }\n\n  /** Sign a JWT with configured algorithm. Adds iat/exp and copies iss/aud. */\n  async signJwt(sub: string, extraClaims?: Record<string, unknown>): Promise<string> {\n    const jwt = this.cfg?.jwt || {};\n    const built = await Promise.resolve(jwt.buildClaims?.({ sub, context: extraClaims })) || {};\n    const payload = { sub, ...(extraClaims || {}), ...(built || {}) } as Record<string, unknown>;\n    if (typeof jwt.signToken === 'function') {\n      // Full override of signing: user supplies the complete token\n      const token = await Promise.resolve(jwt.signToken({ header: { typ: 'JWT' }, payload } as any));\n      return token;\n    }\n    throw new Error('SessionService: No JWT signing hook or provider configured');\n  }\n\n  /** Verify signature and expiration. Returns payload on success. */\n  async verifyJwt(token: string): Promise<{ valid: boolean; payload?: any }> {\n    const verify = this.cfg?.jwt?.verifyToken;\n    if (typeof verify !== 'function') return { valid: false };\n    return await Promise.resolve(verify(token));\n  }\n\n  parse(headers: Record<string, string | string[] | undefined>): Promise<{ ok: boolean; claims?: TClaims } | { ok: false }>{\n    const authHeader = (headers['authorization'] || headers['Authorization']) as string | undefined;\n    let token: string | null = null;\n    if (authHeader && /^Bearer\\s+/.test(authHeader)) token = authHeader.replace(/^Bearer\\s+/i, '').trim();\n    const cookieHeader = (headers['cookie'] || headers['Cookie']) as string | undefined;\n    if (!token && cookieHeader) {\n      const name = this.getCookieName();\n      for (const part of cookieHeader.split(';')) {\n        const [k, v] = part.split('=');\n        if (k && k.trim() === name) { token = (v || '').trim(); break; }\n      }\n    }\n    if (!token) return Promise.resolve({ ok: false });\n    return this.verifyJwt(token).then(v => v.valid ? { ok: true, claims: v.payload as TClaims } : { ok: false });\n  }\n\n  // === token helpers ===\n  extractTokenFromHeaders(headers: Record<string, string | string[] | undefined>): string | null {\n    if (this.cfg?.cookie?.extractToken) return this.cfg.cookie.extractToken(headers, this.getCookieName());\n    const authHeader = (headers['authorization'] || headers['Authorization']) as string | undefined;\n    if (authHeader && /^Bearer\\s+/.test(authHeader)) return authHeader.replace(/^Bearer\\s+/i, '').trim();\n    const cookieHeader = (headers['cookie'] || headers['Cookie']) as string | undefined;\n    if (cookieHeader) {\n      const name = this.getCookieName();\n      for (const part of cookieHeader.split(';')) {\n        const [k, v] = part.split('=');\n        if (k && k.trim() === name) return (v || '').trim();\n      }\n    }\n    return null;\n  }\n\n  async refresh(headers: Record<string, string | string[] | undefined>): Promise<{ ok: boolean; jwt?: string; code?: string; message?: string }>{\n    try {\n      const token = this.extractTokenFromHeaders(headers);\n      if (!token) return { ok: false, code: 'unauthorized', message: 'No session token' };\n      const v = await this.verifyJwt(token);\n      if (!v.valid) return { ok: false, code: 'unauthorized', message: 'Invalid token' };\n      const payload: any = v.payload || {};\n      if (!this.isWithinRefreshWindow(payload)) return { ok: false, code: 'not_eligible', message: 'Not within refresh window' };\n      const sub = String(payload.sub || '');\n      if (!sub) return { ok: false, code: 'invalid_claims', message: 'Missing sub claim' };\n      const next = await this.signJwt(sub);\n      return { ok: true, jwt: next };\n    } catch (e: any) {\n      return { ok: false, code: 'internal', message: e?.message || 'Refresh failed' };\n    }\n  }\n\n  nowSeconds(): number { return Math.floor(Date.now() / 1000); }\n\n  private isWithinRefreshWindow(payload: any): boolean {\n    try {\n      const now = this.nowSeconds();\n      const exp = Number(payload?.exp || 0);\n      if (!exp || now >= exp) return false; // no refresh if already expired\n      const windowSec = Number(this.cfg?.jwt?.refreshWindowSec || 15 * 60);\n      return (exp - now) <= windowSec;\n    } catch { return false; }\n  }\n}\n\n/*\n * Utility: parse comma-separated list of origins into a normalized unique list\n * - canonicalizes to protocol + host + optional port\n * - lowercases host, strips path/query/hash, trims spaces/trailing slashes\n */\nexport function parseCsvList(input?: string): string[] {\n  const out = new Set<string>();\n  for (const raw of String(input || '').split(',')) {\n    const s = raw.trim();\n    if (!s) continue;\n    try {\n      const u = new URL(s);\n      const host = u.hostname.toLowerCase();\n      const port = u.port ? `:${u.port}` : '';\n      const proto = u.protocol === 'http:' || u.protocol === 'https:' ? u.protocol : 'https:';\n      out.add(`${proto}//${host}${port}`);\n    } catch {\n      const stripped = s.replace(/\\/$/, '');\n      if (stripped) out.add(stripped);\n    }\n  }\n  return Array.from(out);\n}\n\n/*\n * Utility: merge multiple CSV lists of origins and return normalized list or '*'\n */\nexport function buildCorsOrigins(...inputs: Array<string | undefined>): string[] | '*' {\n  const merged = new Set<string>();\n  for (const input of inputs) {\n    for (const origin of parseCsvList(input)) merged.add(origin);\n  }\n  const list = Array.from(merged);\n  return list.length > 0 ? list : '*';\n}\n"],"mappings":";;AAwBA,IAAa,iBAAb,MAA2C;CACzC,AAAQ;CAER,YAAY,KAAiC;AAC3C,OAAK,MAAM,OAAQ;;CAGrB,gBAAwB;AACtB,SAAO,KAAK,KAAK,QAAQ,QAAQ;;CAGnC,eAAe,OAAuB;AACpC,MAAI,KAAK,KAAK,QAAQ,eAAgB,QAAO,KAAK,IAAI,OAAO,eAAe;EAC5E,MAAM,OAAO,KAAK;EAClB,MAAM,cAAc,CAAC,GAAG,KAAK,GAAG;EAChC,MAAM,OAAO;EAGb,MAAM,WAAW;EACjB,MAAM,SAAS,KAAK;AACpB,cAAY,KAAK,QAAQ;AACX,cAAY,KAAK;AACnB,cAAY,KAAK;AACf,cAAY,KAAK,YAAY;EAC/B;AACV,eAAY,KAAK,WAAW;GAC5B,MAAM,UAAU,IAAI,KAAK,KAAK,QAAS,SAAS,KAAO;AACvD,eAAY,KAAK,WAAW;;AAE9B,SAAO,YAAY,KAAK;;CAG1B,mBAA2B;AACzB,MAAI,KAAK,KAAK,QAAQ,iBAAkB,QAAO,KAAK,IAAI,OAAO;EAC/D,MAAM,OAAO,KAAK;EAClB,MAAM,OAAO;EAGb,MAAM,QAAQ;GACZ,GAAG,KAAK;GACR,QAAQ;GACR;GACA;;AAEY,QAAM,KAAK;AACb,QAAM,KAAK;EACvB,MAAM,WAAW;AACH,QAAM,KAAK,YAAY;AACrC,SAAO,MAAM,KAAK;;;CAIpB,MAAM,QAAQ,KAAa,aAAwD;EACjF,MAAM,MAAM,KAAK,KAAK,OAAO;EAC7B,MAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,cAAc;GAAE;GAAK,SAAS;SAAmB;EACzF,MAAM,UAAU;GAAE;GAAK,GAAI,eAAe;GAAK,GAAI,SAAS;;AAC5D,MAAI,OAAO,IAAI,cAAc,YAAY;GAEvC,MAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,UAAU;IAAE,QAAQ,EAAE,KAAK;IAAS;;AAC5E,UAAO;;AAET,QAAM,IAAI,MAAM;;;CAIlB,MAAM,UAAU,OAA2D;EACzE,MAAM,SAAS,KAAK,KAAK,KAAK;AAC9B,MAAI,OAAO,WAAW,WAAY,QAAO,EAAE,OAAO;AAClD,SAAO,MAAM,QAAQ,QAAQ,OAAO;;CAGtC,MAAM,SAAmH;EACvH,MAAM,aAAc,QAAQ,oBAAoB,QAAQ;EACxD,IAAIA,QAAuB;AAC3B,MAAI,cAAc,aAAa,KAAK,YAAa,SAAQ,WAAW,QAAQ,eAAe,IAAI;EAC/F,MAAM,eAAgB,QAAQ,aAAa,QAAQ;AACnD,MAAI,CAAC,SAAS,cAAc;GAC1B,MAAM,OAAO,KAAK;AAClB,QAAK,MAAM,QAAQ,aAAa,MAAM,MAAM;IAC1C,MAAM,CAAC,GAAG,KAAK,KAAK,MAAM;AAC1B,QAAI,KAAK,EAAE,WAAW,MAAM;AAAE,cAAS,KAAK,IAAI;AAAQ;;;;AAG5D,MAAI,CAAC,MAAO,QAAO,QAAQ,QAAQ,EAAE,IAAI;AACzC,SAAO,KAAK,UAAU,OAAO,MAAK,MAAK,EAAE,QAAQ;GAAE,IAAI;GAAM,QAAQ,EAAE;MAAuB,EAAE,IAAI;;CAItG,wBAAwB,SAAuE;AAC7F,MAAI,KAAK,KAAK,QAAQ,aAAc,QAAO,KAAK,IAAI,OAAO,aAAa,SAAS,KAAK;EACtF,MAAM,aAAc,QAAQ,oBAAoB,QAAQ;AACxD,MAAI,cAAc,aAAa,KAAK,YAAa,QAAO,WAAW,QAAQ,eAAe,IAAI;EAC9F,MAAM,eAAgB,QAAQ,aAAa,QAAQ;AACnD,MAAI,cAAc;GAChB,MAAM,OAAO,KAAK;AAClB,QAAK,MAAM,QAAQ,aAAa,MAAM,MAAM;IAC1C,MAAM,CAAC,GAAG,KAAK,KAAK,MAAM;AAC1B,QAAI,KAAK,EAAE,WAAW,KAAM,SAAQ,KAAK,IAAI;;;AAGjD,SAAO;;CAGT,MAAM,QAAQ,SAAgI;AAC5I,MAAI;GACF,MAAM,QAAQ,KAAK,wBAAwB;AAC3C,OAAI,CAAC,MAAO,QAAO;IAAE,IAAI;IAAO,MAAM;IAAgB,SAAS;;GAC/D,MAAM,IAAI,MAAM,KAAK,UAAU;AAC/B,OAAI,CAAC,EAAE,MAAO,QAAO;IAAE,IAAI;IAAO,MAAM;IAAgB,SAAS;;GACjE,MAAMC,UAAe,EAAE,WAAW;AAClC,OAAI,CAAC,KAAK,sBAAsB,SAAU,QAAO;IAAE,IAAI;IAAO,MAAM;IAAgB,SAAS;;GAC7F,MAAM,MAAM,OAAO,QAAQ,OAAO;AAClC,OAAI,CAAC,IAAK,QAAO;IAAE,IAAI;IAAO,MAAM;IAAkB,SAAS;;GAC/D,MAAM,OAAO,MAAM,KAAK,QAAQ;AAChC,UAAO;IAAE,IAAI;IAAM,KAAK;;WACjBC,GAAQ;AACf,UAAO;IAAE,IAAI;IAAO,MAAM;IAAY,SAAS,GAAG,WAAW;;;;CAIjE,aAAqB;AAAE,SAAO,KAAK,MAAM,KAAK,QAAQ;;CAEtD,AAAQ,sBAAsB,SAAuB;AACnD,MAAI;GACF,MAAM,MAAM,KAAK;GACjB,MAAM,MAAM,OAAO,SAAS,OAAO;AACnC,OAAI,CAAC,OAAO,OAAO,IAAK,QAAO;GAC/B,MAAM,YAAY,OAAO,KAAK,KAAK,KAAK,oBAAoB;AAC5D,UAAQ,MAAM,OAAQ;UAChB;AAAE,UAAO;;;;AASrB,SAAgB,aAAa,OAA0B;CACrD,MAAM,sBAAM,IAAI;AAChB,MAAK,MAAM,OAAO,OAAO,SAAS,IAAI,MAAM,MAAM;EAChD,MAAM,IAAI,IAAI;AACd,MAAI,CAAC,EAAG;AACR,MAAI;GACF,MAAM,IAAI,IAAI,IAAI;GAClB,MAAM,OAAO,EAAE,SAAS;GACxB,MAAM,OAAO,EAAE,OAAO,IAAI,EAAE,SAAS;GACrC,MAAM,QAAQ,EAAE,aAAa,WAAW,EAAE,aAAa,WAAW,EAAE,WAAW;AAC/E,OAAI,IAAI,GAAG,MAAM,IAAI,OAAO;UACtB;GACN,MAAM,WAAW,EAAE,QAAQ,OAAO;AAClC,OAAI,SAAU,KAAI,IAAI;;;AAG1B,QAAO,MAAM,KAAK;;AAMpB,SAAgB,iBAAiB,GAAG,QAAmD;CACrF,MAAM,yBAAS,IAAI;AACnB,MAAK,MAAM,SAAS,OAClB,MAAK,MAAM,UAAU,aAAa,OAAQ,QAAO,IAAI;CAEvD,MAAM,OAAO,MAAM,KAAK;AACxB,QAAO,KAAK,SAAS,IAAI,OAAO"}
+{"version":3,"file":"SessionService.js","names":["token: string | null","payload: any","e: any"],"sources":["../../../../src/server/core/SessionService.ts"],"sourcesContent":["\nexport interface SessionConfig {\n  jwt?: {\n    /** Required: JWT signing hook; return a complete token */\n    signToken?: (input: { header: Record<string, unknown>; payload: Record<string, unknown> }) => Promise<string> | string;\n    /** Required: JWT verification hook */\n    verifyToken?: (token: string) => Promise<{ valid: boolean; payload?: any }> | { valid: boolean; payload?: any };\n    /** Optional: sliding refresh window (seconds) to allow /session/refresh before exp, default 900 (15 min) */\n    refreshWindowSec?: number;\n    /** Optional: build additional claims to include in the payload */\n    buildClaims?: (input: { sub: string; context?: Record<string, unknown> }) => Promise<Record<string, unknown> | void> | Record<string, unknown> | void;\n  };\n  cookie?: {\n    /** Cookie name. Default: 'w3a_session' */\n    name?: string;\n    /** Optional override: build Set-Cookie header for a new token */\n    buildSetHeader?: (token: string) => string;\n    /** Optional override: build Set-Cookie header that clears the cookie */\n    buildClearHeader?: () => string;\n    /** Optional override: extract token from headers (Authorization/Cookie) */\n    extractToken?: (headers: Record<string, string | string[] | undefined>, cookieName: string) => string | null;\n  };\n}\n\nexport class SessionService<TClaims extends Record<string, unknown> = Record<string, unknown>> {\n  private cfg: NonNullable<SessionConfig>;\n\n  constructor(cfg: NonNullable<SessionConfig>) {\n    this.cfg = cfg || ({} as any);\n  }\n\n  getCookieName(): string {\n    return this.cfg?.cookie?.name || 'w3a_session';\n  }\n\n  buildSetCookie(token: string): string {\n    if (this.cfg?.cookie?.buildSetHeader) return this.cfg.cookie.buildSetHeader(token);\n    const name = this.getCookieName();\n    const cookieParts = [`${name}=${token}`];\n    const path = '/';\n    const httpOnly = true;\n    const secure = true; // default secure\n    const sameSite = 'Lax';\n    const maxAge = 24 * 3600; // 1 day default\n    cookieParts.push(`Path=${path}`);\n    if (httpOnly) cookieParts.push('HttpOnly');\n    if (secure) cookieParts.push('Secure');\n    if (sameSite) cookieParts.push(`SameSite=${sameSite}`);\n    if (maxAge) {\n      cookieParts.push(`Max-Age=${maxAge}`);\n      const expires = new Date(Date.now() + (maxAge * 1000)).toUTCString();\n      cookieParts.push(`Expires=${expires}`);\n    }\n    return cookieParts.join('; ');\n  }\n\n  buildClearCookie(): string {\n    if (this.cfg?.cookie?.buildClearHeader) return this.cfg.cookie.buildClearHeader();\n    const name = this.getCookieName();\n    const path = '/';\n    const secure = true;\n    const httpOnly = true;\n    const parts = [\n      `${name}=`,\n      `Path=${path}`,\n      'Max-Age=0',\n      'Expires=Thu, 01 Jan 1970 00:00:00 GMT'\n    ];\n    if (httpOnly) parts.push('HttpOnly');\n    if (secure) parts.push('Secure');\n    const sameSite = 'Lax';\n    if (sameSite) parts.push(`SameSite=${sameSite}`);\n    return parts.join('; ');\n  }\n\n  /** Sign a JWT with configured algorithm. Adds iat/exp and copies iss/aud. */\n  async signJwt(sub: string, extraClaims?: Record<string, unknown>): Promise<string> {\n    const jwt = this.cfg?.jwt || {};\n    const built = await Promise.resolve(jwt.buildClaims?.({ sub, context: extraClaims })) || {};\n    const payload = { sub, ...(extraClaims || {}), ...(built || {}) } as Record<string, unknown>;\n    if (typeof jwt.signToken === 'function') {\n      // Full override of signing: user supplies the complete token\n      const token = await Promise.resolve(jwt.signToken({ header: { typ: 'JWT' }, payload } as any));\n      return token;\n    }\n    throw new Error('SessionService: No JWT signing hook or provider configured');\n  }\n\n  /** Verify signature and expiration. Returns payload on success. */\n  async verifyJwt(token: string): Promise<{ valid: boolean; payload?: any }> {\n    const verify = this.cfg?.jwt?.verifyToken;\n    if (typeof verify !== 'function') return { valid: false };\n    return await Promise.resolve(verify(token));\n  }\n\n  parse(\n    headers: Record<string, string | string[] | undefined>\n  ): Promise<{ ok: true; claims: TClaims } | { ok: false }> {\n    const authHeader = (headers['authorization'] || headers['Authorization']) as string | undefined;\n    let token: string | null = null;\n    if (authHeader && /^Bearer\\s+/.test(authHeader)) token = authHeader.replace(/^Bearer\\s+/i, '').trim();\n    const cookieHeader = (headers['cookie'] || headers['Cookie']) as string | undefined;\n    if (!token && cookieHeader) {\n      const name = this.getCookieName();\n      for (const part of cookieHeader.split(';')) {\n        const [k, v] = part.split('=');\n        if (k && k.trim() === name) { token = (v || '').trim(); break; }\n      }\n    }\n    if (!token) return Promise.resolve({ ok: false });\n    return this.verifyJwt(token).then(v =>\n      v.valid\n        ? { ok: true, claims: v.payload as TClaims }\n        : { ok: false }\n    );\n  }\n\n  // === token helpers ===\n  extractTokenFromHeaders(headers: Record<string, string | string[] | undefined>): string | null {\n    if (this.cfg?.cookie?.extractToken) return this.cfg.cookie.extractToken(headers, this.getCookieName());\n    const authHeader = (headers['authorization'] || headers['Authorization']) as string | undefined;\n    if (authHeader && /^Bearer\\s+/.test(authHeader)) return authHeader.replace(/^Bearer\\s+/i, '').trim();\n    const cookieHeader = (headers['cookie'] || headers['Cookie']) as string | undefined;\n    if (cookieHeader) {\n      const name = this.getCookieName();\n      for (const part of cookieHeader.split(';')) {\n        const [k, v] = part.split('=');\n        if (k && k.trim() === name) return (v || '').trim();\n      }\n    }\n    return null;\n  }\n\n  async refresh(headers: Record<string, string | string[] | undefined>): Promise<{ ok: boolean; jwt?: string; code?: string; message?: string }>{\n    try {\n      const token = this.extractTokenFromHeaders(headers);\n      if (!token) return { ok: false, code: 'unauthorized', message: 'No session token' };\n      const v = await this.verifyJwt(token);\n      if (!v.valid) return { ok: false, code: 'unauthorized', message: 'Invalid token' };\n      const payload: any = v.payload || {};\n      if (!this.isWithinRefreshWindow(payload)) return { ok: false, code: 'not_eligible', message: 'Not within refresh window' };\n      const sub = String(payload.sub || '');\n      if (!sub) return { ok: false, code: 'invalid_claims', message: 'Missing sub claim' };\n      const next = await this.signJwt(sub);\n      return { ok: true, jwt: next };\n    } catch (e: any) {\n      return { ok: false, code: 'internal', message: e?.message || 'Refresh failed' };\n    }\n  }\n\n  nowSeconds(): number { return Math.floor(Date.now() / 1000); }\n\n  private isWithinRefreshWindow(payload: any): boolean {\n    try {\n      const now = this.nowSeconds();\n      const exp = Number(payload?.exp || 0);\n      if (!exp || now >= exp) return false; // no refresh if already expired\n      const windowSec = Number(this.cfg?.jwt?.refreshWindowSec || 15 * 60);\n      return (exp - now) <= windowSec;\n    } catch { return false; }\n  }\n}\n\n/*\n * Utility: parse comma-separated list of origins into a normalized unique list\n * - canonicalizes to protocol + host + optional port\n * - lowercases host, strips path/query/hash, trims spaces/trailing slashes\n */\nexport function parseCsvList(input?: string): string[] {\n  const out = new Set<string>();\n  for (const raw of String(input || '').split(',')) {\n    const s = raw.trim();\n    if (!s) continue;\n    try {\n      const u = new URL(s);\n      const host = u.hostname.toLowerCase();\n      const port = u.port ? `:${u.port}` : '';\n      const proto = u.protocol === 'http:' || u.protocol === 'https:' ? u.protocol : 'https:';\n      out.add(`${proto}//${host}${port}`);\n    } catch {\n      const stripped = s.replace(/\\/$/, '');\n      if (stripped) out.add(stripped);\n    }\n  }\n  return Array.from(out);\n}\n\n/*\n * Utility: merge multiple CSV lists of origins and return normalized list or '*'\n */\nexport function buildCorsOrigins(...inputs: Array<string | undefined>): string[] | '*' {\n  const merged = new Set<string>();\n  for (const input of inputs) {\n    for (const origin of parseCsvList(input)) merged.add(origin);\n  }\n  const list = Array.from(merged);\n  return list.length > 0 ? list : '*';\n}\n"],"mappings":";;AAwBA,IAAa,iBAAb,MAA+F;CAC7F,AAAQ;CAER,YAAY,KAAiC;AAC3C,OAAK,MAAM,OAAQ;;CAGrB,gBAAwB;AACtB,SAAO,KAAK,KAAK,QAAQ,QAAQ;;CAGnC,eAAe,OAAuB;AACpC,MAAI,KAAK,KAAK,QAAQ,eAAgB,QAAO,KAAK,IAAI,OAAO,eAAe;EAC5E,MAAM,OAAO,KAAK;EAClB,MAAM,cAAc,CAAC,GAAG,KAAK,GAAG;EAChC,MAAM,OAAO;EAGb,MAAM,WAAW;EACjB,MAAM,SAAS,KAAK;AACpB,cAAY,KAAK,QAAQ;AACX,cAAY,KAAK;AACnB,cAAY,KAAK;AACf,cAAY,KAAK,YAAY;EAC/B;AACV,eAAY,KAAK,WAAW;GAC5B,MAAM,UAAU,IAAI,KAAK,KAAK,QAAS,SAAS,KAAO;AACvD,eAAY,KAAK,WAAW;;AAE9B,SAAO,YAAY,KAAK;;CAG1B,mBAA2B;AACzB,MAAI,KAAK,KAAK,QAAQ,iBAAkB,QAAO,KAAK,IAAI,OAAO;EAC/D,MAAM,OAAO,KAAK;EAClB,MAAM,OAAO;EAGb,MAAM,QAAQ;GACZ,GAAG,KAAK;GACR,QAAQ;GACR;GACA;;AAEY,QAAM,KAAK;AACb,QAAM,KAAK;EACvB,MAAM,WAAW;AACH,QAAM,KAAK,YAAY;AACrC,SAAO,MAAM,KAAK;;;CAIpB,MAAM,QAAQ,KAAa,aAAwD;EACjF,MAAM,MAAM,KAAK,KAAK,OAAO;EAC7B,MAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,cAAc;GAAE;GAAK,SAAS;SAAmB;EACzF,MAAM,UAAU;GAAE;GAAK,GAAI,eAAe;GAAK,GAAI,SAAS;;AAC5D,MAAI,OAAO,IAAI,cAAc,YAAY;GAEvC,MAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,UAAU;IAAE,QAAQ,EAAE,KAAK;IAAS;;AAC5E,UAAO;;AAET,QAAM,IAAI,MAAM;;;CAIlB,MAAM,UAAU,OAA2D;EACzE,MAAM,SAAS,KAAK,KAAK,KAAK;AAC9B,MAAI,OAAO,WAAW,WAAY,QAAO,EAAE,OAAO;AAClD,SAAO,MAAM,QAAQ,QAAQ,OAAO;;CAGtC,MACE,SACwD;EACxD,MAAM,aAAc,QAAQ,oBAAoB,QAAQ;EACxD,IAAIA,QAAuB;AAC3B,MAAI,cAAc,aAAa,KAAK,YAAa,SAAQ,WAAW,QAAQ,eAAe,IAAI;EAC/F,MAAM,eAAgB,QAAQ,aAAa,QAAQ;AACnD,MAAI,CAAC,SAAS,cAAc;GAC1B,MAAM,OAAO,KAAK;AAClB,QAAK,MAAM,QAAQ,aAAa,MAAM,MAAM;IAC1C,MAAM,CAAC,GAAG,KAAK,KAAK,MAAM;AAC1B,QAAI,KAAK,EAAE,WAAW,MAAM;AAAE,cAAS,KAAK,IAAI;AAAQ;;;;AAG5D,MAAI,CAAC,MAAO,QAAO,QAAQ,QAAQ,EAAE,IAAI;AACzC,SAAO,KAAK,UAAU,OAAO,MAAK,MAChC,EAAE,QACE;GAAE,IAAI;GAAM,QAAQ,EAAE;MACtB,EAAE,IAAI;;CAKd,wBAAwB,SAAuE;AAC7F,MAAI,KAAK,KAAK,QAAQ,aAAc,QAAO,KAAK,IAAI,OAAO,aAAa,SAAS,KAAK;EACtF,MAAM,aAAc,QAAQ,oBAAoB,QAAQ;AACxD,MAAI,cAAc,aAAa,KAAK,YAAa,QAAO,WAAW,QAAQ,eAAe,IAAI;EAC9F,MAAM,eAAgB,QAAQ,aAAa,QAAQ;AACnD,MAAI,cAAc;GAChB,MAAM,OAAO,KAAK;AAClB,QAAK,MAAM,QAAQ,aAAa,MAAM,MAAM;IAC1C,MAAM,CAAC,GAAG,KAAK,KAAK,MAAM;AAC1B,QAAI,KAAK,EAAE,WAAW,KAAM,SAAQ,KAAK,IAAI;;;AAGjD,SAAO;;CAGT,MAAM,QAAQ,SAAgI;AAC5I,MAAI;GACF,MAAM,QAAQ,KAAK,wBAAwB;AAC3C,OAAI,CAAC,MAAO,QAAO;IAAE,IAAI;IAAO,MAAM;IAAgB,SAAS;;GAC/D,MAAM,IAAI,MAAM,KAAK,UAAU;AAC/B,OAAI,CAAC,EAAE,MAAO,QAAO;IAAE,IAAI;IAAO,MAAM;IAAgB,SAAS;;GACjE,MAAMC,UAAe,EAAE,WAAW;AAClC,OAAI,CAAC,KAAK,sBAAsB,SAAU,QAAO;IAAE,IAAI;IAAO,MAAM;IAAgB,SAAS;;GAC7F,MAAM,MAAM,OAAO,QAAQ,OAAO;AAClC,OAAI,CAAC,IAAK,QAAO;IAAE,IAAI;IAAO,MAAM;IAAkB,SAAS;;GAC/D,MAAM,OAAO,MAAM,KAAK,QAAQ;AAChC,UAAO;IAAE,IAAI;IAAM,KAAK;;WACjBC,GAAQ;AACf,UAAO;IAAE,IAAI;IAAO,MAAM;IAAY,SAAS,GAAG,WAAW;;;;CAIjE,aAAqB;AAAE,SAAO,KAAK,MAAM,KAAK,QAAQ;;CAEtD,AAAQ,sBAAsB,SAAuB;AACnD,MAAI;GACF,MAAM,MAAM,KAAK;GACjB,MAAM,MAAM,OAAO,SAAS,OAAO;AACnC,OAAI,CAAC,OAAO,OAAO,IAAK,QAAO;GAC/B,MAAM,YAAY,OAAO,KAAK,KAAK,KAAK,oBAAoB;AAC5D,UAAQ,MAAM,OAAQ;UAChB;AAAE,UAAO;;;;AASrB,SAAgB,aAAa,OAA0B;CACrD,MAAM,sBAAM,IAAI;AAChB,MAAK,MAAM,OAAO,OAAO,SAAS,IAAI,MAAM,MAAM;EAChD,MAAM,IAAI,IAAI;AACd,MAAI,CAAC,EAAG;AACR,MAAI;GACF,MAAM,IAAI,IAAI,IAAI;GAClB,MAAM,OAAO,EAAE,SAAS;GACxB,MAAM,OAAO,EAAE,OAAO,IAAI,EAAE,SAAS;GACrC,MAAM,QAAQ,EAAE,aAAa,WAAW,EAAE,aAAa,WAAW,EAAE,WAAW;AAC/E,OAAI,IAAI,GAAG,MAAM,IAAI,OAAO;UACtB;GACN,MAAM,WAAW,EAAE,QAAQ,OAAO;AAClC,OAAI,SAAU,KAAI,IAAI;;;AAG1B,QAAO,MAAM,KAAK;;AAMpB,SAAgB,iBAAiB,GAAG,QAAmD;CACrF,MAAM,yBAAS,IAAI;AACnB,MAAK,MAAM,SAAS,OAClB,MAAK,MAAM,UAAU,aAAa,OAAQ,QAAO,IAAI;CAEvD,MAAM,OAAO,MAAM,KAAK;AACxB,QAAO,KAAK,SAAS,IAAI,OAAO"}

package/dist/cjs/server/core/ShamirService.js

@@ -1,4 +1,4 @@
-const require_validation = require('../sdk/src/core/WalletIframe/validation.js');
+const require_validation = require('../sdk/src/utils/validation.js');
 const require_shamirWorker = require('./shamirWorker.js');
 
 //#region src/server/core/ShamirService.ts

package/dist/cjs/server/core/ShamirService.js.map

@@ -1 +1 @@
-{"version":3,"file":"ShamirService.js","names":["Shamir3PassUtils","specs: GraceKeySpec[]","normalized: GraceKeySpec[]","error: any","isString","keyId: string | null","e: any"],"sources":["../../../../src/server/core/ShamirService.ts"],"sourcesContent":["import type {\n  AuthServiceConfig,\n  ShamirApplyServerLockRequest,\n  ShamirApplyServerLockResponse,\n  ShamirRemoveServerLockRequest,\n  ShamirRemoveServerLockResponse,\n} from './types';\nimport { isString } from '../../core/WalletIframe/validation';\nimport { Shamir3PassUtils, setShamirWasmModuleOverride } from './shamirWorker';\n\ntype ShamirConfig = AuthServiceConfig['shamir'];\n\ntype GraceKeySpec = { e_s_b64u: string; d_s_b64u: string };\n\nexport class ShamirService {\n  private config: ShamirConfig | undefined;\n  private graceKeysFilePath: string | null;\n\n  private shamir3pass: Shamir3PassUtils | null = null;\n  private graceKeys: Map<string, Shamir3PassUtils> = new Map();\n  private graceKeySpecs: Map<string, GraceKeySpec> = new Map();\n  private graceKeysLoaded = false;\n  private graceKeysLoadPromise: Promise<void> | null = null;\n\n  constructor(config: ShamirConfig | undefined, graceKeysFilePath: string | null) {\n    this.config = config;\n    const graceFileCandidate = (this.config?.graceShamirKeysFile || '').trim();\n    this.graceKeysFilePath = graceKeysFilePath || graceFileCandidate || 'grace-keys.json';\n  }\n\n  hasShamir(): boolean {\n    return Boolean(this.config && this.shamir3pass);\n  }\n\n  getShamirConfig(): ShamirConfig | undefined {\n    return this.config;\n  }\n\n  getCurrentShamirKeyId(): string | null {\n    return this.shamir3pass?.getCurrentKeyId?.() || null;\n  }\n\n  getGraceKeyIds(): string[] {\n    return Array.from(this.graceKeys.keys());\n  }\n\n  hasGraceKey(keyId: string): boolean {\n    return this.graceKeys.has(keyId);\n  }\n\n  async ensureReady(): Promise<boolean> {\n    if (!this.config) {\n      return false;\n    }\n    if (this.shamir3pass) {\n      return true;\n    }\n\n    try {\n      // Configure WASM override when provided (e.g. Cloudflare Workers).\n      // This ensures Shamir endpoints like /vrf/apply-server-lock work\n      // even when AuthService._ensureSignerAndRelayerAccount has not run.\n      if (this.config.moduleOrPath) {\n        try {\n          setShamirWasmModuleOverride(this.config.moduleOrPath);\n        } catch (error) {\n          console.warn('[ShamirService] Failed to configure Shamir WASM override:', error);\n        }\n      }\n\n      this.shamir3pass = new Shamir3PassUtils({\n        p_b64u: this.config.shamir_p_b64u,\n        e_s_b64u: this.config.shamir_e_s_b64u,\n        d_s_b64u: this.config.shamir_d_s_b64u,\n      });\n      try {\n        await this.shamir3pass.initialize();\n      } catch {\n        // Initialization failures are logged by Shamir3PassUtils; treat as non-fatal\n      }\n      await this.ensureGraceKeysLoaded();\n    } catch (err) {\n      console.error('Failed to initialize Shamir 3-pass:', err);\n    }\n\n    return this.hasShamir();\n  }\n\n  async ensureGraceKeysLoaded(): Promise<void> {\n    if (this.graceKeysLoaded) {\n      return;\n    }\n    if (this.graceKeysLoadPromise) {\n      await this.graceKeysLoadPromise;\n      return;\n    }\n\n    this.graceKeysLoadPromise = (async () => {\n      const specs: GraceKeySpec[] = [];\n\n      const fileSpecs = await this.loadGraceKeysFromFile();\n      if (fileSpecs.length) {\n        specs.push(...fileSpecs);\n      }\n\n      if (Array.isArray(this.config?.graceShamirKeys) && this.config!.graceShamirKeys!.length) {\n        specs.push(...(this.config!.graceShamirKeys as any));\n      }\n\n      if (specs.length) {\n        for (const spec of specs) {\n          await this.addGraceKeyInternal(spec, { persist: false, skipIfExists: true });\n        }\n      }\n\n      this.graceKeysLoaded = true;\n      this.syncGraceKeySpecsToConfig();\n    })();\n\n    try {\n      await this.graceKeysLoadPromise;\n    } finally {\n      this.graceKeysLoadPromise = null;\n      this.graceKeysLoaded = true;\n    }\n  }\n\n  private async loadGraceKeysFromFile(): Promise<GraceKeySpec[]> {\n    if (!this.isNodeEnvironment()) {\n      return [];\n    }\n    const filePath = this.graceKeysFilePath?.trim();\n    if (!filePath) {\n      return [];\n    }\n\n    try {\n      const { readFile } = await import('node:fs/promises');\n      const raw = await readFile(filePath, 'utf8');\n      const parsed = JSON.parse(raw);\n      if (!Array.isArray(parsed)) {\n        console.warn(`[ShamirService] Grace keys file ${filePath} is not an array; ignoring contents`);\n        return [];\n      }\n      const normalized: GraceKeySpec[] = [];\n      for (const entry of parsed) {\n        if (!entry || typeof entry !== 'object') continue;\n        const e = (entry as any).e_s_b64u;\n        const d = (entry as any).d_s_b64u;\n        if (typeof e === 'string' && e && typeof d === 'string' && d) {\n          normalized.push({ e_s_b64u: e, d_s_b64u: d });\n        }\n      }\n      return normalized;\n    } catch (error: any) {\n      if (error?.code !== 'ENOENT') {\n        console.warn(`[ShamirService] Failed to read grace keys file ${filePath}:`, error);\n      }\n      return [];\n    }\n  }\n\n  private syncGraceKeySpecsToConfig(): void {\n    if (!this.config) return;\n\n    if (this.graceKeySpecs.size === 0) {\n      this.config.graceShamirKeys = undefined;\n      return;\n    }\n\n    this.config.graceShamirKeys = Array.from(this.graceKeySpecs.values()).map((spec) => ({\n      e_s_b64u: spec.e_s_b64u,\n      d_s_b64u: spec.d_s_b64u,\n    }));\n  }\n\n  private async persistGraceKeysToDisk(): Promise<void> {\n    if (!this.isNodeEnvironment()) {\n      return;\n    }\n    const filePath = this.graceKeysFilePath?.trim();\n    if (!filePath) {\n      return;\n    }\n    const entries = Array.from(this.graceKeySpecs.entries()).map(([keyId, spec]) => ({\n      keyId,\n      e_s_b64u: spec.e_s_b64u,\n      d_s_b64u: spec.d_s_b64u,\n    }));\n    try {\n      const { writeFile } = await import('node:fs/promises');\n      const serialized = JSON.stringify(entries, null, 2);\n      await writeFile(filePath, `${serialized}\\n`, 'utf8');\n    } catch (error) {\n      console.warn(`[ShamirService] Failed to persist grace keys to ${filePath}:`, error);\n    }\n  }\n\n  async addGraceKeyInternal(\n    spec: { e_s_b64u: string; d_s_b64u: string },\n    opts?: { persist?: boolean; skipIfExists?: boolean }\n  ): Promise<{ keyId: string } | null> {\n    await this.ensureGraceKeysLoaded();\n\n    const e = spec?.e_s_b64u;\n    const d = spec?.d_s_b64u;\n    if (!isString(e) || !e || !isString(d) || !d) {\n      return null;\n    }\n\n    const p_b64u = this.config?.shamir_p_b64u;\n    if (!p_b64u) {\n      console.warn('[ShamirService] Missing Shamir p_b64u; cannot add grace key');\n      return null;\n    }\n    const util = new Shamir3PassUtils({\n      p_b64u,\n      e_s_b64u: e,\n      d_s_b64u: d,\n    });\n\n    let keyId = util.getCurrentKeyId();\n    if (!keyId) {\n      try {\n        await util.initialize();\n        keyId = util.getCurrentKeyId();\n      } catch (error) {\n        console.warn('[ShamirService] Failed to initialize grace Shamir key (skipped):', error);\n        return null;\n      }\n    }\n\n    if (!keyId) {\n      return null;\n    }\n\n    if (opts?.skipIfExists && this.graceKeys.has(keyId)) {\n      return { keyId };\n    }\n\n    if (!this.graceKeys.has(keyId)) {\n      this.graceKeys.set(keyId, util);\n    }\n    if (!this.graceKeySpecs.has(keyId)) {\n      this.graceKeySpecs.set(keyId, { e_s_b64u: e, d_s_b64u: d });\n    }\n\n    this.syncGraceKeySpecsToConfig();\n\n    if (opts?.persist !== false) {\n      await this.persistGraceKeysToDisk();\n    }\n\n    return { keyId };\n  }\n\n  async removeGraceKeyInternal(\n    keyId: string,\n    opts?: { persist?: boolean }\n  ): Promise<boolean> {\n    await this.ensureGraceKeysLoaded();\n    if (!isString(keyId) || !keyId) {\n      return false;\n    }\n    const removedUtil = this.graceKeys.delete(keyId);\n    const removedSpec = this.graceKeySpecs.delete(keyId);\n    if (!removedUtil && !removedSpec) {\n      return false;\n    }\n    this.syncGraceKeySpecsToConfig();\n    if (opts?.persist !== false) {\n      await this.persistGraceKeysToDisk();\n    }\n    return true;\n  }\n\n  async applyServerLock(kek_c_b64u: string): Promise<ShamirApplyServerLockResponse> {\n    if (!this.shamir3pass) throw new Error('Shamir3Pass not initialized');\n    return this.shamir3pass.applyServerLock({ kek_c_b64u } as ShamirApplyServerLockRequest);\n  }\n\n  async removeServerLock(kek_cs_b64u: string): Promise<ShamirRemoveServerLockResponse> {\n    if (!this.shamir3pass) throw new Error('Shamir3Pass not initialized');\n    return this.shamir3pass.removeServerLock({ kek_cs_b64u } as ShamirRemoveServerLockRequest);\n  }\n\n  async generateShamirServerKeypair(): Promise<{ e_s_b64u: string; d_s_b64u: string; keyId: string | null }> {\n    if (!this.shamir3pass) throw new Error('Shamir3Pass not initialized');\n\n    const { e_s_b64u, d_s_b64u } = await this.shamir3pass.generateServerKeypair();\n    const p_b64u = this.config?.shamir_p_b64u;\n    if (!p_b64u) throw new Error('Shamir not configured');\n    const util = new Shamir3PassUtils({\n      p_b64u,\n      e_s_b64u,\n      d_s_b64u,\n    });\n    let keyId: string | null = null;\n    try {\n      keyId = util.getCurrentKeyId();\n      if (!keyId) {\n        await util.initialize();\n        keyId = util.getCurrentKeyId();\n      }\n    } catch (error) {\n      console.warn('[ShamirService] Failed to derive keyId for generated Shamir keypair:', error);\n    }\n\n    return { e_s_b64u, d_s_b64u, keyId };\n  }\n\n  async rotateShamirServerKeypair(options?: {\n    keepCurrentInGrace?: boolean;\n    persistGraceToDisk?: boolean;\n  }): Promise<{\n    newKeypair: { e_s_b64u: string; d_s_b64u: string };\n    newKeyId: string | null;\n    previousKeyId: string | null;\n    graceKeyIds: string[];\n  }> {\n    await this.ensureGraceKeysLoaded();\n    if (!this.shamir3pass) throw new Error('Shamir3Pass not initialized');\n    if (!this.config) throw new Error('Shamir not configured');\n\n    const keepCurrentInGrace = options?.keepCurrentInGrace !== false;\n    const persistGrace = options?.persistGraceToDisk !== false;\n\n    const previousKeyId = this.shamir3pass.getCurrentKeyId();\n    const previousKeypair = {\n      e_s_b64u: this.config.shamir_e_s_b64u,\n      d_s_b64u: this.config.shamir_d_s_b64u,\n    };\n\n    const { e_s_b64u: newE, d_s_b64u: newD } = await this.shamir3pass.generateServerKeypair();\n    const newUtil = new Shamir3PassUtils({\n      p_b64u: this.config.shamir_p_b64u,\n      e_s_b64u: newE,\n      d_s_b64u: newD,\n    });\n\n    await newUtil.initialize();\n\n    this.shamir3pass = newUtil;\n    this.config.shamir_e_s_b64u = newE;\n    this.config.shamir_d_s_b64u = newD;\n\n    const newKeyId = newUtil.getCurrentKeyId();\n\n    if (\n      keepCurrentInGrace\n      && previousKeyId\n      && isString(previousKeypair.e_s_b64u)\n      && isString(previousKeypair.d_s_b64u)\n    ) {\n      await this.addGraceKeyInternal(previousKeypair, { persist: persistGrace, skipIfExists: true });\n    } else if (persistGrace) {\n      await this.persistGraceKeysToDisk();\n    }\n\n    return {\n      newKeypair: { e_s_b64u: newE, d_s_b64u: newD },\n      newKeyId,\n      previousKeyId,\n      graceKeyIds: Array.from(this.graceKeys.keys()),\n    };\n  }\n\n  async handleRotateShamirKeypair(request: { keepOldInGrace?: boolean }): Promise<{\n    status: number;\n    headers: Record<string, string>;\n    body: string;\n  }> {\n    try {\n      const keepOldInGrace = request?.keepOldInGrace !== false;\n      const result = await this.rotateShamirServerKeypair({ keepCurrentInGrace: keepOldInGrace });\n      return {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(result),\n      };\n    } catch (e: any) {\n      return {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ error: 'internal', details: e?.message }),\n      };\n    }\n  }\n\n  async removeGraceServerLockWithKey(\n    keyId: string,\n    request: ShamirRemoveServerLockRequest,\n  ): Promise<ShamirRemoveServerLockResponse> {\n    const util = this.graceKeys.get(keyId)!;\n    return util.removeServerLock(request);\n  }\n\n  private isNodeEnvironment(): boolean {\n    const isNode = Boolean((globalThis as any).process?.versions?.node);\n    const isCloudflareWorker = typeof (globalThis as any).WebSocketPair !== 'undefined'\n      || (typeof navigator !== 'undefined' && (navigator as any).userAgent?.includes?.('Cloudflare-Workers'));\n    return isNode && !isCloudflareWorker;\n  }\n}\n"],"mappings":";;;;AAcA,IAAa,gBAAb,MAA2B;CACzB,AAAQ;CACR,AAAQ;CAER,AAAQ,cAAuC;CAC/C,AAAQ,4BAA2C,IAAI;CACvD,AAAQ,gCAA2C,IAAI;CACvD,AAAQ,kBAAkB;CAC1B,AAAQ,uBAA6C;CAErD,YAAY,QAAkC,mBAAkC;AAC9E,OAAK,SAAS;EACd,MAAM,sBAAsB,KAAK,QAAQ,uBAAuB,IAAI;AACpE,OAAK,oBAAoB,qBAAqB,sBAAsB;;CAGtE,YAAqB;AACnB,SAAO,QAAQ,KAAK,UAAU,KAAK;;CAGrC,kBAA4C;AAC1C,SAAO,KAAK;;CAGd,wBAAuC;AACrC,SAAO,KAAK,aAAa,uBAAuB;;CAGlD,iBAA2B;AACzB,SAAO,MAAM,KAAK,KAAK,UAAU;;CAGnC,YAAY,OAAwB;AAClC,SAAO,KAAK,UAAU,IAAI;;CAG5B,MAAM,cAAgC;AACpC,MAAI,CAAC,KAAK,OACR,QAAO;AAET,MAAI,KAAK,YACP,QAAO;AAGT,MAAI;AAIF,OAAI,KAAK,OAAO,aACd,KAAI;AACF,qDAA4B,KAAK,OAAO;YACjC,OAAO;AACd,YAAQ,KAAK,6DAA6D;;AAI9E,QAAK,cAAc,IAAIA,sCAAiB;IACtC,QAAQ,KAAK,OAAO;IACpB,UAAU,KAAK,OAAO;IACtB,UAAU,KAAK,OAAO;;AAExB,OAAI;AACF,UAAM,KAAK,YAAY;WACjB;AAGR,SAAM,KAAK;WACJ,KAAK;AACZ,WAAQ,MAAM,uCAAuC;;AAGvD,SAAO,KAAK;;CAGd,MAAM,wBAAuC;AAC3C,MAAI,KAAK,gBACP;AAEF,MAAI,KAAK,sBAAsB;AAC7B,SAAM,KAAK;AACX;;AAGF,OAAK,wBAAwB,YAAY;GACvC,MAAMC,QAAwB;GAE9B,MAAM,YAAY,MAAM,KAAK;AAC7B,OAAI,UAAU,OACZ,OAAM,KAAK,GAAG;AAGhB,OAAI,MAAM,QAAQ,KAAK,QAAQ,oBAAoB,KAAK,OAAQ,gBAAiB,OAC/E,OAAM,KAAK,GAAI,KAAK,OAAQ;AAG9B,OAAI,MAAM,OACR,MAAK,MAAM,QAAQ,MACjB,OAAM,KAAK,oBAAoB,MAAM;IAAE,SAAS;IAAO,cAAc;;AAIzE,QAAK,kBAAkB;AACvB,QAAK;;AAGP,MAAI;AACF,SAAM,KAAK;YACH;AACR,QAAK,uBAAuB;AAC5B,QAAK,kBAAkB;;;CAI3B,MAAc,wBAAiD;AAC7D,MAAI,CAAC,KAAK,oBACR,QAAO;EAET,MAAM,WAAW,KAAK,mBAAmB;AACzC,MAAI,CAAC,SACH,QAAO;AAGT,MAAI;GACF,MAAM,EAAE,aAAa,MAAM,OAAO;GAClC,MAAM,MAAM,MAAM,SAAS,UAAU;GACrC,MAAM,SAAS,KAAK,MAAM;AAC1B,OAAI,CAAC,MAAM,QAAQ,SAAS;AAC1B,YAAQ,KAAK,mCAAmC,SAAS;AACzD,WAAO;;GAET,MAAMC,aAA6B;AACnC,QAAK,MAAM,SAAS,QAAQ;AAC1B,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU;IACzC,MAAM,IAAK,MAAc;IACzB,MAAM,IAAK,MAAc;AACzB,QAAI,OAAO,MAAM,YAAY,KAAK,OAAO,MAAM,YAAY,EACzD,YAAW,KAAK;KAAE,UAAU;KAAG,UAAU;;;AAG7C,UAAO;WACAC,OAAY;AACnB,OAAI,OAAO,SAAS,SAClB,SAAQ,KAAK,kDAAkD,SAAS,IAAI;AAE9E,UAAO;;;CAIX,AAAQ,4BAAkC;AACxC,MAAI,CAAC,KAAK,OAAQ;AAElB,MAAI,KAAK,cAAc,SAAS,GAAG;AACjC,QAAK,OAAO,kBAAkB;AAC9B;;AAGF,OAAK,OAAO,kBAAkB,MAAM,KAAK,KAAK,cAAc,UAAU,KAAK,UAAU;GACnF,UAAU,KAAK;GACf,UAAU,KAAK;;;CAInB,MAAc,yBAAwC;AACpD,MAAI,CAAC,KAAK,oBACR;EAEF,MAAM,WAAW,KAAK,mBAAmB;AACzC,MAAI,CAAC,SACH;EAEF,MAAM,UAAU,MAAM,KAAK,KAAK,cAAc,WAAW,KAAK,CAAC,OAAO,WAAW;GAC/E;GACA,UAAU,KAAK;GACf,UAAU,KAAK;;AAEjB,MAAI;GACF,MAAM,EAAE,cAAc,MAAM,OAAO;GACnC,MAAM,aAAa,KAAK,UAAU,SAAS,MAAM;AACjD,SAAM,UAAU,UAAU,GAAG,WAAW,KAAK;WACtC,OAAO;AACd,WAAQ,KAAK,mDAAmD,SAAS,IAAI;;;CAIjF,MAAM,oBACJ,MACA,MACmC;AACnC,QAAM,KAAK;EAEX,MAAM,IAAI,MAAM;EAChB,MAAM,IAAI,MAAM;AAChB,MAAI,CAACC,4BAAS,MAAM,CAAC,KAAK,CAACA,4BAAS,MAAM,CAAC,EACzC,QAAO;EAGT,MAAM,SAAS,KAAK,QAAQ;AAC5B,MAAI,CAAC,QAAQ;AACX,WAAQ,KAAK;AACb,UAAO;;EAET,MAAM,OAAO,IAAIJ,sCAAiB;GAChC;GACA,UAAU;GACV,UAAU;;EAGZ,IAAI,QAAQ,KAAK;AACjB,MAAI,CAAC,MACH,KAAI;AACF,SAAM,KAAK;AACX,WAAQ,KAAK;WACN,OAAO;AACd,WAAQ,KAAK,oEAAoE;AACjF,UAAO;;AAIX,MAAI,CAAC,MACH,QAAO;AAGT,MAAI,MAAM,gBAAgB,KAAK,UAAU,IAAI,OAC3C,QAAO,EAAE;AAGX,MAAI,CAAC,KAAK,UAAU,IAAI,OACtB,MAAK,UAAU,IAAI,OAAO;AAE5B,MAAI,CAAC,KAAK,cAAc,IAAI,OAC1B,MAAK,cAAc,IAAI,OAAO;GAAE,UAAU;GAAG,UAAU;;AAGzD,OAAK;AAEL,MAAI,MAAM,YAAY,MACpB,OAAM,KAAK;AAGb,SAAO,EAAE;;CAGX,MAAM,uBACJ,OACA,MACkB;AAClB,QAAM,KAAK;AACX,MAAI,CAACI,4BAAS,UAAU,CAAC,MACvB,QAAO;EAET,MAAM,cAAc,KAAK,UAAU,OAAO;EAC1C,MAAM,cAAc,KAAK,cAAc,OAAO;AAC9C,MAAI,CAAC,eAAe,CAAC,YACnB,QAAO;AAET,OAAK;AACL,MAAI,MAAM,YAAY,MACpB,OAAM,KAAK;AAEb,SAAO;;CAGT,MAAM,gBAAgB,YAA4D;AAChF,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM;AACvC,SAAO,KAAK,YAAY,gBAAgB,EAAE;;CAG5C,MAAM,iBAAiB,aAA8D;AACnF,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM;AACvC,SAAO,KAAK,YAAY,iBAAiB,EAAE;;CAG7C,MAAM,8BAAqG;AACzG,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM;EAEvC,MAAM,EAAE,UAAU,aAAa,MAAM,KAAK,YAAY;EACtD,MAAM,SAAS,KAAK,QAAQ;AAC5B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM;EAC7B,MAAM,OAAO,IAAIJ,sCAAiB;GAChC;GACA;GACA;;EAEF,IAAIK,QAAuB;AAC3B,MAAI;AACF,WAAQ,KAAK;AACb,OAAI,CAAC,OAAO;AACV,UAAM,KAAK;AACX,YAAQ,KAAK;;WAER,OAAO;AACd,WAAQ,KAAK,wEAAwE;;AAGvF,SAAO;GAAE;GAAU;GAAU;;;CAG/B,MAAM,0BAA0B,SAQ7B;AACD,QAAM,KAAK;AACX,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM;AACvC,MAAI,CAAC,KAAK,OAAQ,OAAM,IAAI,MAAM;EAElC,MAAM,qBAAqB,SAAS,uBAAuB;EAC3D,MAAM,eAAe,SAAS,uBAAuB;EAErD,MAAM,gBAAgB,KAAK,YAAY;EACvC,MAAM,kBAAkB;GACtB,UAAU,KAAK,OAAO;GACtB,UAAU,KAAK,OAAO;;EAGxB,MAAM,EAAE,UAAU,MAAM,UAAU,SAAS,MAAM,KAAK,YAAY;EAClE,MAAM,UAAU,IAAIL,sCAAiB;GACnC,QAAQ,KAAK,OAAO;GACpB,UAAU;GACV,UAAU;;AAGZ,QAAM,QAAQ;AAEd,OAAK,cAAc;AACnB,OAAK,OAAO,kBAAkB;AAC9B,OAAK,OAAO,kBAAkB;EAE9B,MAAM,WAAW,QAAQ;AAEzB,MACE,sBACG,iBACAI,4BAAS,gBAAgB,aACzBA,4BAAS,gBAAgB,UAE5B,OAAM,KAAK,oBAAoB,iBAAiB;GAAE,SAAS;GAAc,cAAc;;WAC9E,aACT,OAAM,KAAK;AAGb,SAAO;GACL,YAAY;IAAE,UAAU;IAAM,UAAU;;GACxC;GACA;GACA,aAAa,MAAM,KAAK,KAAK,UAAU;;;CAI3C,MAAM,0BAA0B,SAI7B;AACD,MAAI;GACF,MAAM,iBAAiB,SAAS,mBAAmB;GACnD,MAAM,SAAS,MAAM,KAAK,0BAA0B,EAAE,oBAAoB;AAC1E,UAAO;IACL,QAAQ;IACR,SAAS,EAAE,gBAAgB;IAC3B,MAAM,KAAK,UAAU;;WAEhBE,GAAQ;AACf,UAAO;IACL,QAAQ;IACR,SAAS,EAAE,gBAAgB;IAC3B,MAAM,KAAK,UAAU;KAAE,OAAO;KAAY,SAAS,GAAG;;;;;CAK5D,MAAM,6BACJ,OACA,SACyC;EACzC,MAAM,OAAO,KAAK,UAAU,IAAI;AAChC,SAAO,KAAK,iBAAiB;;CAG/B,AAAQ,oBAA6B;EACnC,MAAM,SAAS,QAAS,WAAmB,SAAS,UAAU;EAC9D,MAAM,qBAAqB,OAAQ,WAAmB,kBAAkB,eAClE,OAAO,cAAc,eAAgB,UAAkB,WAAW,WAAW;AACnF,SAAO,UAAU,CAAC"}
+{"version":3,"file":"ShamirService.js","names":["Shamir3PassUtils","specs: GraceKeySpec[]","normalized: GraceKeySpec[]","error: any","isString","keyId: string | null","e: any"],"sources":["../../../../src/server/core/ShamirService.ts"],"sourcesContent":["import type {\n  AuthServiceConfig,\n  ShamirApplyServerLockRequest,\n  ShamirApplyServerLockResponse,\n  ShamirRemoveServerLockRequest,\n  ShamirRemoveServerLockResponse,\n} from './types';\nimport { isString } from '@/utils/validation';\nimport { Shamir3PassUtils, setShamirWasmModuleOverride } from './shamirWorker';\n\ntype ShamirConfig = AuthServiceConfig['shamir'];\n\ntype GraceKeySpec = { e_s_b64u: string; d_s_b64u: string };\n\nexport class ShamirService {\n  private config: ShamirConfig | undefined;\n  private graceKeysFilePath: string | null;\n\n  private shamir3pass: Shamir3PassUtils | null = null;\n  private graceKeys: Map<string, Shamir3PassUtils> = new Map();\n  private graceKeySpecs: Map<string, GraceKeySpec> = new Map();\n  private graceKeysLoaded = false;\n  private graceKeysLoadPromise: Promise<void> | null = null;\n\n  constructor(config: ShamirConfig | undefined, graceKeysFilePath: string | null) {\n    this.config = config;\n    const graceFileCandidate = (this.config?.graceShamirKeysFile || '').trim();\n    this.graceKeysFilePath = graceKeysFilePath || graceFileCandidate || 'grace-keys.json';\n  }\n\n  hasShamir(): boolean {\n    return Boolean(this.config && this.shamir3pass);\n  }\n\n  getShamirConfig(): ShamirConfig | undefined {\n    return this.config;\n  }\n\n  getCurrentShamirKeyId(): string | null {\n    return this.shamir3pass?.getCurrentKeyId?.() || null;\n  }\n\n  getGraceKeyIds(): string[] {\n    return Array.from(this.graceKeys.keys());\n  }\n\n  hasGraceKey(keyId: string): boolean {\n    return this.graceKeys.has(keyId);\n  }\n\n  async ensureReady(): Promise<boolean> {\n    if (!this.config) {\n      return false;\n    }\n    if (this.shamir3pass) {\n      return true;\n    }\n\n    try {\n      // Configure WASM override when provided (e.g. Cloudflare Workers).\n      // This ensures Shamir endpoints like /vrf/apply-server-lock work\n      // even when AuthService._ensureSignerAndRelayerAccount has not run.\n      if (this.config.moduleOrPath) {\n        try {\n          setShamirWasmModuleOverride(this.config.moduleOrPath);\n        } catch (error) {\n          console.warn('[ShamirService] Failed to configure Shamir WASM override:', error);\n        }\n      }\n\n      this.shamir3pass = new Shamir3PassUtils({\n        p_b64u: this.config.shamir_p_b64u,\n        e_s_b64u: this.config.shamir_e_s_b64u,\n        d_s_b64u: this.config.shamir_d_s_b64u,\n      });\n      try {\n        await this.shamir3pass.initialize();\n      } catch {\n        // Initialization failures are logged by Shamir3PassUtils; treat as non-fatal\n      }\n      await this.ensureGraceKeysLoaded();\n    } catch (err) {\n      console.error('Failed to initialize Shamir 3-pass:', err);\n    }\n\n    return this.hasShamir();\n  }\n\n  async ensureGraceKeysLoaded(): Promise<void> {\n    if (this.graceKeysLoaded) {\n      return;\n    }\n    if (this.graceKeysLoadPromise) {\n      await this.graceKeysLoadPromise;\n      return;\n    }\n\n    this.graceKeysLoadPromise = (async () => {\n      const specs: GraceKeySpec[] = [];\n\n      const fileSpecs = await this.loadGraceKeysFromFile();\n      if (fileSpecs.length) {\n        specs.push(...fileSpecs);\n      }\n\n      if (Array.isArray(this.config?.graceShamirKeys) && this.config!.graceShamirKeys!.length) {\n        specs.push(...(this.config!.graceShamirKeys as any));\n      }\n\n      if (specs.length) {\n        for (const spec of specs) {\n          await this.addGraceKeyInternal(spec, { persist: false, skipIfExists: true });\n        }\n      }\n\n      this.graceKeysLoaded = true;\n      this.syncGraceKeySpecsToConfig();\n    })();\n\n    try {\n      await this.graceKeysLoadPromise;\n    } finally {\n      this.graceKeysLoadPromise = null;\n      this.graceKeysLoaded = true;\n    }\n  }\n\n  private async loadGraceKeysFromFile(): Promise<GraceKeySpec[]> {\n    if (!this.isNodeEnvironment()) {\n      return [];\n    }\n    const filePath = this.graceKeysFilePath?.trim();\n    if (!filePath) {\n      return [];\n    }\n\n    try {\n      const { readFile } = await import('node:fs/promises');\n      const raw = await readFile(filePath, 'utf8');\n      const parsed = JSON.parse(raw);\n      if (!Array.isArray(parsed)) {\n        console.warn(`[ShamirService] Grace keys file ${filePath} is not an array; ignoring contents`);\n        return [];\n      }\n      const normalized: GraceKeySpec[] = [];\n      for (const entry of parsed) {\n        if (!entry || typeof entry !== 'object') continue;\n        const e = (entry as any).e_s_b64u;\n        const d = (entry as any).d_s_b64u;\n        if (typeof e === 'string' && e && typeof d === 'string' && d) {\n          normalized.push({ e_s_b64u: e, d_s_b64u: d });\n        }\n      }\n      return normalized;\n    } catch (error: any) {\n      if (error?.code !== 'ENOENT') {\n        console.warn(`[ShamirService] Failed to read grace keys file ${filePath}:`, error);\n      }\n      return [];\n    }\n  }\n\n  private syncGraceKeySpecsToConfig(): void {\n    if (!this.config) return;\n\n    if (this.graceKeySpecs.size === 0) {\n      this.config.graceShamirKeys = undefined;\n      return;\n    }\n\n    this.config.graceShamirKeys = Array.from(this.graceKeySpecs.values()).map((spec) => ({\n      e_s_b64u: spec.e_s_b64u,\n      d_s_b64u: spec.d_s_b64u,\n    }));\n  }\n\n  private async persistGraceKeysToDisk(): Promise<void> {\n    if (!this.isNodeEnvironment()) {\n      return;\n    }\n    const filePath = this.graceKeysFilePath?.trim();\n    if (!filePath) {\n      return;\n    }\n    const entries = Array.from(this.graceKeySpecs.entries()).map(([keyId, spec]) => ({\n      keyId,\n      e_s_b64u: spec.e_s_b64u,\n      d_s_b64u: spec.d_s_b64u,\n    }));\n    try {\n      const { writeFile } = await import('node:fs/promises');\n      const serialized = JSON.stringify(entries, null, 2);\n      await writeFile(filePath, `${serialized}\\n`, 'utf8');\n    } catch (error) {\n      console.warn(`[ShamirService] Failed to persist grace keys to ${filePath}:`, error);\n    }\n  }\n\n  async addGraceKeyInternal(\n    spec: { e_s_b64u: string; d_s_b64u: string },\n    opts?: { persist?: boolean; skipIfExists?: boolean }\n  ): Promise<{ keyId: string } | null> {\n    await this.ensureGraceKeysLoaded();\n\n    const e = spec?.e_s_b64u;\n    const d = spec?.d_s_b64u;\n    if (!isString(e) || !e || !isString(d) || !d) {\n      return null;\n    }\n\n    const p_b64u = this.config?.shamir_p_b64u;\n    if (!p_b64u) {\n      console.warn('[ShamirService] Missing Shamir p_b64u; cannot add grace key');\n      return null;\n    }\n    const util = new Shamir3PassUtils({\n      p_b64u,\n      e_s_b64u: e,\n      d_s_b64u: d,\n    });\n\n    let keyId = util.getCurrentKeyId();\n    if (!keyId) {\n      try {\n        await util.initialize();\n        keyId = util.getCurrentKeyId();\n      } catch (error) {\n        console.warn('[ShamirService] Failed to initialize grace Shamir key (skipped):', error);\n        return null;\n      }\n    }\n\n    if (!keyId) {\n      return null;\n    }\n\n    if (opts?.skipIfExists && this.graceKeys.has(keyId)) {\n      return { keyId };\n    }\n\n    if (!this.graceKeys.has(keyId)) {\n      this.graceKeys.set(keyId, util);\n    }\n    if (!this.graceKeySpecs.has(keyId)) {\n      this.graceKeySpecs.set(keyId, { e_s_b64u: e, d_s_b64u: d });\n    }\n\n    this.syncGraceKeySpecsToConfig();\n\n    if (opts?.persist !== false) {\n      await this.persistGraceKeysToDisk();\n    }\n\n    return { keyId };\n  }\n\n  async removeGraceKeyInternal(\n    keyId: string,\n    opts?: { persist?: boolean }\n  ): Promise<boolean> {\n    await this.ensureGraceKeysLoaded();\n    if (!isString(keyId) || !keyId) {\n      return false;\n    }\n    const removedUtil = this.graceKeys.delete(keyId);\n    const removedSpec = this.graceKeySpecs.delete(keyId);\n    if (!removedUtil && !removedSpec) {\n      return false;\n    }\n    this.syncGraceKeySpecsToConfig();\n    if (opts?.persist !== false) {\n      await this.persistGraceKeysToDisk();\n    }\n    return true;\n  }\n\n  async applyServerLock(kek_c_b64u: string): Promise<ShamirApplyServerLockResponse> {\n    if (!this.shamir3pass) throw new Error('Shamir3Pass not initialized');\n    return this.shamir3pass.applyServerLock({ kek_c_b64u } as ShamirApplyServerLockRequest);\n  }\n\n  async removeServerLock(kek_cs_b64u: string): Promise<ShamirRemoveServerLockResponse> {\n    if (!this.shamir3pass) throw new Error('Shamir3Pass not initialized');\n    return this.shamir3pass.removeServerLock({ kek_cs_b64u } as ShamirRemoveServerLockRequest);\n  }\n\n  async generateShamirServerKeypair(): Promise<{ e_s_b64u: string; d_s_b64u: string; keyId: string | null }> {\n    if (!this.shamir3pass) throw new Error('Shamir3Pass not initialized');\n\n    const { e_s_b64u, d_s_b64u } = await this.shamir3pass.generateServerKeypair();\n    const p_b64u = this.config?.shamir_p_b64u;\n    if (!p_b64u) throw new Error('Shamir not configured');\n    const util = new Shamir3PassUtils({\n      p_b64u,\n      e_s_b64u,\n      d_s_b64u,\n    });\n    let keyId: string | null = null;\n    try {\n      keyId = util.getCurrentKeyId();\n      if (!keyId) {\n        await util.initialize();\n        keyId = util.getCurrentKeyId();\n      }\n    } catch (error) {\n      console.warn('[ShamirService] Failed to derive keyId for generated Shamir keypair:', error);\n    }\n\n    return { e_s_b64u, d_s_b64u, keyId };\n  }\n\n  async rotateShamirServerKeypair(options?: {\n    keepCurrentInGrace?: boolean;\n    persistGraceToDisk?: boolean;\n  }): Promise<{\n    newKeypair: { e_s_b64u: string; d_s_b64u: string };\n    newKeyId: string | null;\n    previousKeyId: string | null;\n    graceKeyIds: string[];\n  }> {\n    await this.ensureGraceKeysLoaded();\n    if (!this.shamir3pass) throw new Error('Shamir3Pass not initialized');\n    if (!this.config) throw new Error('Shamir not configured');\n\n    const keepCurrentInGrace = options?.keepCurrentInGrace !== false;\n    const persistGrace = options?.persistGraceToDisk !== false;\n\n    const previousKeyId = this.shamir3pass.getCurrentKeyId();\n    const previousKeypair = {\n      e_s_b64u: this.config.shamir_e_s_b64u,\n      d_s_b64u: this.config.shamir_d_s_b64u,\n    };\n\n    const { e_s_b64u: newE, d_s_b64u: newD } = await this.shamir3pass.generateServerKeypair();\n    const newUtil = new Shamir3PassUtils({\n      p_b64u: this.config.shamir_p_b64u,\n      e_s_b64u: newE,\n      d_s_b64u: newD,\n    });\n\n    await newUtil.initialize();\n\n    this.shamir3pass = newUtil;\n    this.config.shamir_e_s_b64u = newE;\n    this.config.shamir_d_s_b64u = newD;\n\n    const newKeyId = newUtil.getCurrentKeyId();\n\n    if (\n      keepCurrentInGrace\n      && previousKeyId\n      && isString(previousKeypair.e_s_b64u)\n      && isString(previousKeypair.d_s_b64u)\n    ) {\n      await this.addGraceKeyInternal(previousKeypair, { persist: persistGrace, skipIfExists: true });\n    } else if (persistGrace) {\n      await this.persistGraceKeysToDisk();\n    }\n\n    return {\n      newKeypair: { e_s_b64u: newE, d_s_b64u: newD },\n      newKeyId,\n      previousKeyId,\n      graceKeyIds: Array.from(this.graceKeys.keys()),\n    };\n  }\n\n  async handleRotateShamirKeypair(request: { keepOldInGrace?: boolean }): Promise<{\n    status: number;\n    headers: Record<string, string>;\n    body: string;\n  }> {\n    try {\n      const keepOldInGrace = request?.keepOldInGrace !== false;\n      const result = await this.rotateShamirServerKeypair({ keepCurrentInGrace: keepOldInGrace });\n      return {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(result),\n      };\n    } catch (e: any) {\n      return {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ error: 'internal', details: e?.message }),\n      };\n    }\n  }\n\n  async removeGraceServerLockWithKey(\n    keyId: string,\n    request: ShamirRemoveServerLockRequest,\n  ): Promise<ShamirRemoveServerLockResponse> {\n    const util = this.graceKeys.get(keyId)!;\n    return util.removeServerLock(request);\n  }\n\n  private isNodeEnvironment(): boolean {\n    const isNode = Boolean((globalThis as any).process?.versions?.node);\n    const isCloudflareWorker = typeof (globalThis as any).WebSocketPair !== 'undefined'\n      || (typeof navigator !== 'undefined' && (navigator as any).userAgent?.includes?.('Cloudflare-Workers'));\n    return isNode && !isCloudflareWorker;\n  }\n}\n"],"mappings":";;;;AAcA,IAAa,gBAAb,MAA2B;CACzB,AAAQ;CACR,AAAQ;CAER,AAAQ,cAAuC;CAC/C,AAAQ,4BAA2C,IAAI;CACvD,AAAQ,gCAA2C,IAAI;CACvD,AAAQ,kBAAkB;CAC1B,AAAQ,uBAA6C;CAErD,YAAY,QAAkC,mBAAkC;AAC9E,OAAK,SAAS;EACd,MAAM,sBAAsB,KAAK,QAAQ,uBAAuB,IAAI;AACpE,OAAK,oBAAoB,qBAAqB,sBAAsB;;CAGtE,YAAqB;AACnB,SAAO,QAAQ,KAAK,UAAU,KAAK;;CAGrC,kBAA4C;AAC1C,SAAO,KAAK;;CAGd,wBAAuC;AACrC,SAAO,KAAK,aAAa,uBAAuB;;CAGlD,iBAA2B;AACzB,SAAO,MAAM,KAAK,KAAK,UAAU;;CAGnC,YAAY,OAAwB;AAClC,SAAO,KAAK,UAAU,IAAI;;CAG5B,MAAM,cAAgC;AACpC,MAAI,CAAC,KAAK,OACR,QAAO;AAET,MAAI,KAAK,YACP,QAAO;AAGT,MAAI;AAIF,OAAI,KAAK,OAAO,aACd,KAAI;AACF,qDAA4B,KAAK,OAAO;YACjC,OAAO;AACd,YAAQ,KAAK,6DAA6D;;AAI9E,QAAK,cAAc,IAAIA,sCAAiB;IACtC,QAAQ,KAAK,OAAO;IACpB,UAAU,KAAK,OAAO;IACtB,UAAU,KAAK,OAAO;;AAExB,OAAI;AACF,UAAM,KAAK,YAAY;WACjB;AAGR,SAAM,KAAK;WACJ,KAAK;AACZ,WAAQ,MAAM,uCAAuC;;AAGvD,SAAO,KAAK;;CAGd,MAAM,wBAAuC;AAC3C,MAAI,KAAK,gBACP;AAEF,MAAI,KAAK,sBAAsB;AAC7B,SAAM,KAAK;AACX;;AAGF,OAAK,wBAAwB,YAAY;GACvC,MAAMC,QAAwB;GAE9B,MAAM,YAAY,MAAM,KAAK;AAC7B,OAAI,UAAU,OACZ,OAAM,KAAK,GAAG;AAGhB,OAAI,MAAM,QAAQ,KAAK,QAAQ,oBAAoB,KAAK,OAAQ,gBAAiB,OAC/E,OAAM,KAAK,GAAI,KAAK,OAAQ;AAG9B,OAAI,MAAM,OACR,MAAK,MAAM,QAAQ,MACjB,OAAM,KAAK,oBAAoB,MAAM;IAAE,SAAS;IAAO,cAAc;;AAIzE,QAAK,kBAAkB;AACvB,QAAK;;AAGP,MAAI;AACF,SAAM,KAAK;YACH;AACR,QAAK,uBAAuB;AAC5B,QAAK,kBAAkB;;;CAI3B,MAAc,wBAAiD;AAC7D,MAAI,CAAC,KAAK,oBACR,QAAO;EAET,MAAM,WAAW,KAAK,mBAAmB;AACzC,MAAI,CAAC,SACH,QAAO;AAGT,MAAI;GACF,MAAM,EAAE,aAAa,MAAM,OAAO;GAClC,MAAM,MAAM,MAAM,SAAS,UAAU;GACrC,MAAM,SAAS,KAAK,MAAM;AAC1B,OAAI,CAAC,MAAM,QAAQ,SAAS;AAC1B,YAAQ,KAAK,mCAAmC,SAAS;AACzD,WAAO;;GAET,MAAMC,aAA6B;AACnC,QAAK,MAAM,SAAS,QAAQ;AAC1B,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU;IACzC,MAAM,IAAK,MAAc;IACzB,MAAM,IAAK,MAAc;AACzB,QAAI,OAAO,MAAM,YAAY,KAAK,OAAO,MAAM,YAAY,EACzD,YAAW,KAAK;KAAE,UAAU;KAAG,UAAU;;;AAG7C,UAAO;WACAC,OAAY;AACnB,OAAI,OAAO,SAAS,SAClB,SAAQ,KAAK,kDAAkD,SAAS,IAAI;AAE9E,UAAO;;;CAIX,AAAQ,4BAAkC;AACxC,MAAI,CAAC,KAAK,OAAQ;AAElB,MAAI,KAAK,cAAc,SAAS,GAAG;AACjC,QAAK,OAAO,kBAAkB;AAC9B;;AAGF,OAAK,OAAO,kBAAkB,MAAM,KAAK,KAAK,cAAc,UAAU,KAAK,UAAU;GACnF,UAAU,KAAK;GACf,UAAU,KAAK;;;CAInB,MAAc,yBAAwC;AACpD,MAAI,CAAC,KAAK,oBACR;EAEF,MAAM,WAAW,KAAK,mBAAmB;AACzC,MAAI,CAAC,SACH;EAEF,MAAM,UAAU,MAAM,KAAK,KAAK,cAAc,WAAW,KAAK,CAAC,OAAO,WAAW;GAC/E;GACA,UAAU,KAAK;GACf,UAAU,KAAK;;AAEjB,MAAI;GACF,MAAM,EAAE,cAAc,MAAM,OAAO;GACnC,MAAM,aAAa,KAAK,UAAU,SAAS,MAAM;AACjD,SAAM,UAAU,UAAU,GAAG,WAAW,KAAK;WACtC,OAAO;AACd,WAAQ,KAAK,mDAAmD,SAAS,IAAI;;;CAIjF,MAAM,oBACJ,MACA,MACmC;AACnC,QAAM,KAAK;EAEX,MAAM,IAAI,MAAM;EAChB,MAAM,IAAI,MAAM;AAChB,MAAI,CAACC,4BAAS,MAAM,CAAC,KAAK,CAACA,4BAAS,MAAM,CAAC,EACzC,QAAO;EAGT,MAAM,SAAS,KAAK,QAAQ;AAC5B,MAAI,CAAC,QAAQ;AACX,WAAQ,KAAK;AACb,UAAO;;EAET,MAAM,OAAO,IAAIJ,sCAAiB;GAChC;GACA,UAAU;GACV,UAAU;;EAGZ,IAAI,QAAQ,KAAK;AACjB,MAAI,CAAC,MACH,KAAI;AACF,SAAM,KAAK;AACX,WAAQ,KAAK;WACN,OAAO;AACd,WAAQ,KAAK,oEAAoE;AACjF,UAAO;;AAIX,MAAI,CAAC,MACH,QAAO;AAGT,MAAI,MAAM,gBAAgB,KAAK,UAAU,IAAI,OAC3C,QAAO,EAAE;AAGX,MAAI,CAAC,KAAK,UAAU,IAAI,OACtB,MAAK,UAAU,IAAI,OAAO;AAE5B,MAAI,CAAC,KAAK,cAAc,IAAI,OAC1B,MAAK,cAAc,IAAI,OAAO;GAAE,UAAU;GAAG,UAAU;;AAGzD,OAAK;AAEL,MAAI,MAAM,YAAY,MACpB,OAAM,KAAK;AAGb,SAAO,EAAE;;CAGX,MAAM,uBACJ,OACA,MACkB;AAClB,QAAM,KAAK;AACX,MAAI,CAACI,4BAAS,UAAU,CAAC,MACvB,QAAO;EAET,MAAM,cAAc,KAAK,UAAU,OAAO;EAC1C,MAAM,cAAc,KAAK,cAAc,OAAO;AAC9C,MAAI,CAAC,eAAe,CAAC,YACnB,QAAO;AAET,OAAK;AACL,MAAI,MAAM,YAAY,MACpB,OAAM,KAAK;AAEb,SAAO;;CAGT,MAAM,gBAAgB,YAA4D;AAChF,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM;AACvC,SAAO,KAAK,YAAY,gBAAgB,EAAE;;CAG5C,MAAM,iBAAiB,aAA8D;AACnF,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM;AACvC,SAAO,KAAK,YAAY,iBAAiB,EAAE;;CAG7C,MAAM,8BAAqG;AACzG,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM;EAEvC,MAAM,EAAE,UAAU,aAAa,MAAM,KAAK,YAAY;EACtD,MAAM,SAAS,KAAK,QAAQ;AAC5B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM;EAC7B,MAAM,OAAO,IAAIJ,sCAAiB;GAChC;GACA;GACA;;EAEF,IAAIK,QAAuB;AAC3B,MAAI;AACF,WAAQ,KAAK;AACb,OAAI,CAAC,OAAO;AACV,UAAM,KAAK;AACX,YAAQ,KAAK;;WAER,OAAO;AACd,WAAQ,KAAK,wEAAwE;;AAGvF,SAAO;GAAE;GAAU;GAAU;;;CAG/B,MAAM,0BAA0B,SAQ7B;AACD,QAAM,KAAK;AACX,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM;AACvC,MAAI,CAAC,KAAK,OAAQ,OAAM,IAAI,MAAM;EAElC,MAAM,qBAAqB,SAAS,uBAAuB;EAC3D,MAAM,eAAe,SAAS,uBAAuB;EAErD,MAAM,gBAAgB,KAAK,YAAY;EACvC,MAAM,kBAAkB;GACtB,UAAU,KAAK,OAAO;GACtB,UAAU,KAAK,OAAO;;EAGxB,MAAM,EAAE,UAAU,MAAM,UAAU,SAAS,MAAM,KAAK,YAAY;EAClE,MAAM,UAAU,IAAIL,sCAAiB;GACnC,QAAQ,KAAK,OAAO;GACpB,UAAU;GACV,UAAU;;AAGZ,QAAM,QAAQ;AAEd,OAAK,cAAc;AACnB,OAAK,OAAO,kBAAkB;AAC9B,OAAK,OAAO,kBAAkB;EAE9B,MAAM,WAAW,QAAQ;AAEzB,MACE,sBACG,iBACAI,4BAAS,gBAAgB,aACzBA,4BAAS,gBAAgB,UAE5B,OAAM,KAAK,oBAAoB,iBAAiB;GAAE,SAAS;GAAc,cAAc;;WAC9E,aACT,OAAM,KAAK;AAGb,SAAO;GACL,YAAY;IAAE,UAAU;IAAM,UAAU;;GACxC;GACA;GACA,aAAa,MAAM,KAAK,KAAK,UAAU;;;CAI3C,MAAM,0BAA0B,SAI7B;AACD,MAAI;GACF,MAAM,iBAAiB,SAAS,mBAAmB;GACnD,MAAM,SAAS,MAAM,KAAK,0BAA0B,EAAE,oBAAoB;AAC1E,UAAO;IACL,QAAQ;IACR,SAAS,EAAE,gBAAgB;IAC3B,MAAM,KAAK,UAAU;;WAEhBE,GAAQ;AACf,UAAO;IACL,QAAQ;IACR,SAAS,EAAE,gBAAgB;IAC3B,MAAM,KAAK,UAAU;KAAE,OAAO;KAAY,SAAS,GAAG;;;;;CAK5D,MAAM,6BACJ,OACA,SACyC;EACzC,MAAM,OAAO,KAAK,UAAU,IAAI;AAChC,SAAO,KAAK,iBAAiB;;CAG/B,AAAQ,oBAA6B;EACnC,MAAM,SAAS,QAAS,WAAmB,SAAS,UAAU;EAC9D,MAAM,qBAAqB,OAAQ,WAAmB,kBAAkB,eAClE,OAAO,cAAc,eAAgB,UAAkB,WAAW,WAAW;AACnF,SAAO,UAAU,CAAC"}