@thru/passkey 0.2.27 → 0.2.28

package/src/sign.ts

@@ -30,6 +30,8 @@ import {
   closePopup,
 } from './popup';
 
+const WEB_AUTHN_FOCUS_RETRY_DELAYS_MS = [150, 300];
+
 /**
  * Sign a challenge with an existing passkey (by credential ID).
  */
@@ -66,6 +68,7 @@ export async function signWithStoredPasskey(
   }
 
   const allowPopupFallback = options.allowPopupFallback ?? true;
+  const allowDiscoverableFallback = options.allowDiscoverableFallback ?? true;
   const preopenedPopup = allowPopupFallback
     ? maybePreopenPopup('get', openPasskeyPopupWindow)
     : null;
@@ -75,6 +78,11 @@ export async function signWithStoredPasskey(
   const storedPasskey = preferredPasskey;
   const canUsePopup = allowPopupFallback && isInIframe();
 
+  if (!allowDiscoverableFallback && !storedPasskey) {
+    closePopup(preopenedPopup);
+    throw new Error('No stored passkey available for this wallet');
+  }
+
   if (options.preferDiscoverable) {
     closePopup(preopenedPopup);
     return signWithDiscoverableStoredPasskey(
@@ -103,7 +111,7 @@ export async function signWithStoredPasskey(
           passkey: storedPasskey,
         };
       } catch (error) {
-        if (!shouldFallbackToDiscoverable(error)) {
+        if (!allowDiscoverableFallback || !shouldFallbackToDiscoverable(error)) {
           throw error;
         }
         return signWithDiscoverableStoredPasskey(
@@ -275,9 +283,7 @@ async function signWithPasskeyAssertion(
     ];
   }
 
-  const assertion = (await navigator.credentials.get({
-    publicKey: getOptions,
-  })) as PublicKeyCredential | null;
+  const assertion = await getPasskeyAssertionWithFocusRetry(getOptions);
 
   if (!assertion) {
     throw new Error('Passkey authentication was cancelled');
@@ -311,6 +317,48 @@ async function signWithPasskeyAssertion(
   };
 }
 
+async function getPasskeyAssertionWithFocusRetry(
+  publicKey: PublicKeyCredentialRequestOptions
+): Promise<PublicKeyCredential | null> {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      return (await navigator.credentials.get({
+        publicKey,
+      })) as PublicKeyCredential | null;
+    } catch (error) {
+      const retryDelayMs = WEB_AUTHN_FOCUS_RETRY_DELAYS_MS[attempt];
+      if (retryDelayMs === undefined || !isDocumentNotFocusedError(error)) {
+        throw error;
+      }
+      await waitForFocusRetry(retryDelayMs);
+    }
+  }
+}
+
+function isDocumentNotFocusedError(error: unknown): boolean {
+  const name =
+    error && typeof error === 'object' && 'name' in error
+      ? String((error as { name?: unknown }).name)
+      : '';
+  const message =
+    error && typeof error === 'object' && 'message' in error
+      ? String((error as { message?: unknown }).message)
+      : '';
+  const normalized = `${name} ${message}`.toLowerCase();
+  return normalized.includes('document is not focused');
+}
+
+function waitForFocusRetry(delayMs: number): Promise<void> {
+  return new Promise((resolve) => {
+    const finish = () => setTimeout(resolve, delayMs);
+    if (typeof requestAnimationFrame !== 'function') {
+      finish();
+      return;
+    }
+    requestAnimationFrame(() => requestAnimationFrame(finish));
+  });
+}
+
 async function signWithPasskeyViaPopup(
   credentialId: string,
   challenge: Uint8Array,

package/src/types.ts

@@ -42,6 +42,7 @@ export interface PasskeyPopupContext {
   appUrl?: string;
   origin?: string;
   imageUrl?: string;
+  preferStoredPasskey?: boolean;
 }
 
 /**
@@ -49,6 +50,7 @@ export interface PasskeyPopupContext {
  */
 export interface PasskeyStoredSigningOptions {
   allowPopupFallback?: boolean;
+  allowDiscoverableFallback?: boolean;
   /** Prefer an RP-scoped discoverable credential prompt over a stored
    * credential-id lookup. Native WebViews can show misleading
    * app-level "no passkey" UI when allowCredentials is stale, while a

package/dist/chunk-KASTJBBY.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/auth/add-device.ts"],"sourcesContent":["/* Add-passkey-to-account transaction builder, lifted from\n   `web/wallet-auth-manager/app/page.tsx` (`runValidateThen`,\n   `handleSubmitAddPasskey`) so the wallet's `/embedded` post-connect\n   step can reuse the exact same flow.\n\n   Builds the on-chain transaction:\n     VALIDATE(existingAuthority -> ADD_AUTHORITY(newPasskey))\n     or VALIDATE(existingAuthority -> multicall[ADD_AUTHORITY, REGISTER_CREDENTIAL])\n   asks the caller's existing passkey to sign the challenge, then asks\n   the caller's wallet signer to sign the assembled transaction, sends\n   it, and returns the result. */\n\nimport {\n  type Authority,\n  buildAccountContext,\n  createValidateChallenge,\n  createCredentialLookupSeed,\n  decodeAddress,\n  deriveWalletAddress,\n  encodeAddAuthorityInstruction,\n  encodeRegisterCredentialInstruction,\n  encodeValidateInstruction,\n  parseWalletAuthorities,\n  type ParsedAuthority,\n  type WalletSigner,\n} from \"@thru/programs/passkey-manager\";\nimport {\n  MULTICALL_PROGRAM_PUBKEY,\n  buildMulticallInstruction,\n} from \"@thru/programs/multicall\";\n\n/** Minimal shape required from a passkey signer. Both web's\n    `signWithDiscoverablePasskey`/`signWithPasskey` and mobile's\n    counterparts conform. */\nexport interface PasskeyChallengeSigner {\n  signChallenge: (challenge: Uint8Array) => Promise<{\n    signatureR: Uint8Array;\n    signatureS: Uint8Array;\n    authenticatorData: Uint8Array;\n    clientDataJSON: Uint8Array;\n  }>;\n}\n\n/** Minimal shape required from a Thru chain client. Loosely-typed\n    because @thru/sdk's DTS emit is currently broken in this\n    repo. The caller passes the real Thru and we narrow operationally. */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport type AnyThruClient = any;\n\nexport interface AddDeviceParams {\n  /** Loosely-typed Thru chain client (`@thru/sdk/client`). */\n  thru: AnyThruClient;\n  /** Wallet (the on-chain WalletAccount) to attach the passkey to. */\n  walletAddress: string;\n  /** Index of the existing authority that approves this change. Must\n      currently be a passkey authority. */\n  authIdx: number;\n  /** New passkey to attach. tag = 1 (passkey). */\n  newAuthority: Authority;\n  /** Optional credential-lookup registration so the new passkey is\n      discoverable on subsequent sign-ins. */\n  credentialId?: Uint8Array;\n  walletName?: string;\n  /** Existing-passkey challenge signer (web or mobile). */\n  passkey: PasskeyChallengeSigner;\n  /** Wallet transaction signer that returns base64(signed bytes). */\n  walletSigner: WalletSigner;\n  /** Passkey program address (base58). */\n  programAddress: string;\n  /** Sign-and-send executor (lifted from passkey-transaction.ts in the\n      wallet-auth-manager - wallet apps own this because it depends on\n      the `Thru` client's transaction builder). */\n  executor: TxExecutor;\n  /** Optional status callback so UIs can show progress. */\n  onStatus?: (message: string) => void;\n}\n\nexport interface TxExecutorParams {\n  thru: AnyThruClient;\n  walletSigner: WalletSigner;\n  instructionData: Uint8Array;\n  readWriteAddresses: string[];\n  readOnlyAddresses: string[];\n  label: string;\n}\n\nexport interface TxExecutorResult {\n  signature: string;\n  /** Loosely-typed because @thru/sdk types aren't available. */\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  execution: any;\n}\n\nexport type TxExecutor = (\n  params: TxExecutorParams,\n) => Promise<TxExecutorResult>;\n\nexport interface AddDeviceResult extends TxExecutorResult {\n  /** The new passkey's authority index after the transaction lands. */\n  newAuthorityIdx: number;\n}\n\n/**\n * Run VALIDATE + ADD_AUTHORITY [+ REGISTER_CREDENTIAL] to attach a new\n * passkey to an on-chain WalletAccount.\n */\nexport async function addDeviceToAccount(\n  params: AddDeviceParams,\n): Promise<AddDeviceResult> {\n  const status = params.onStatus ?? (() => {});\n\n  const walletAccount = await params.thru.accounts.get(params.walletAddress);\n  const walletData: Uint8Array | undefined = walletAccount?.data?.data;\n  if (!walletData) {\n    throw new Error(\"Wallet account data missing\");\n  }\n\n  const parsed = parseWalletAuthorities(walletData);\n  const authorizing: ParsedAuthority | undefined =\n    parsed.authorities[params.authIdx];\n  if (!authorizing) {\n    throw new Error(\"Authorization index out of bounds\");\n  }\n  if (authorizing.kind !== \"passkey\") {\n    throw new Error(\n      \"addDeviceToAccount currently requires a passkey authority for VALIDATE\",\n    );\n  }\n\n  /* The new authority will land at the next free slot. */\n  const newAuthorityIdx = parsed.authorities.length;\n\n  let readWriteAccounts: Uint8Array[] = [];\n  let lookupSeed: Uint8Array | undefined;\n  let lookupAddressBytes: Uint8Array | undefined;\n  let lookupProof: Uint8Array | undefined;\n\n  if (params.credentialId) {\n    lookupSeed = await createCredentialLookupSeed(params.credentialId);\n    lookupAddressBytes = await deriveWalletAddress(\n      lookupSeed,\n      params.programAddress,\n    );\n\n    status(\"Fetching state proof for credential lookup...\");\n    const proofResult = await params.thru.proofs.generate({\n      proofType: 1 /* StateProofType.CREATING */,\n      address: lookupAddressBytes,\n    });\n    lookupProof = proofResult.proof;\n    readWriteAccounts = [lookupAddressBytes];\n  }\n\n  const ctx = buildAccountContext({\n    walletAddress: params.walletAddress,\n    readWriteAccounts,\n    readOnlyAccounts: params.credentialId ? [MULTICALL_PROGRAM_PUBKEY] : [],\n    programAddress: params.programAddress,\n  });\n\n  const passkeyProgramPubkey = decodeAddress(params.programAddress);\n  const addAuthorityInstruction = encodeAddAuthorityInstruction({\n    walletAccountIdx: ctx.walletAccountIdx,\n    authority: params.newAuthority,\n  });\n\n  let targetProgramIdx = ctx.getAccountIndex(passkeyProgramPubkey);\n  let targetInstructionData = addAuthorityInstruction;\n\n  if (params.credentialId) {\n    if (!lookupSeed || !lookupAddressBytes || !lookupProof) {\n      throw new Error(\"Credential lookup proof data missing\");\n    }\n\n    const registerCredentialInstruction = encodeRegisterCredentialInstruction({\n      walletAccountIdx: ctx.walletAccountIdx,\n      lookupAccountIdx: ctx.getAccountIndex(lookupAddressBytes),\n      seed: lookupSeed,\n      stateProof: lookupProof,\n    });\n\n    targetProgramIdx = ctx.getAccountIndex(MULTICALL_PROGRAM_PUBKEY);\n    targetInstructionData = buildMulticallInstruction([\n      {\n        programIdx: ctx.getAccountIndex(passkeyProgramPubkey),\n        instructionData: addAuthorityInstruction,\n      },\n      {\n        programIdx: ctx.getAccountIndex(passkeyProgramPubkey),\n        instructionData: registerCredentialInstruction,\n      },\n    ]);\n  }\n\n  /* Build the VALIDATE challenge over the target CPI and ask the caller's passkey to sign. */\n  const challenge = await createValidateChallenge(\n    parsed.nonce,\n    ctx.accountAddresses,\n    ctx.walletAccountIdx,\n    params.authIdx,\n    {\n      programIdx: targetProgramIdx,\n      instructionData: targetInstructionData,\n    },\n  );\n\n  status(\"Waiting for passkey approval...\");\n  const signature = await params.passkey.signChallenge(challenge);\n\n  const validateInstruction = encodeValidateInstruction({\n    walletAccountIdx: ctx.walletAccountIdx,\n    authIdx: params.authIdx,\n    targetInstruction: {\n      programIdx: targetProgramIdx,\n      instructionData: targetInstructionData,\n    },\n    signatureR: signature.signatureR,\n    signatureS: signature.signatureS,\n    authenticatorData: signature.authenticatorData,\n    clientDataJSON: signature.clientDataJSON,\n  });\n\n  status(\"Sending transaction...\");\n  const result = await params.executor({\n    thru: params.thru,\n    walletSigner: params.walletSigner,\n    instructionData: validateInstruction,\n    readWriteAddresses: ctx.readWriteAddresses,\n    readOnlyAddresses: ctx.readOnlyAddresses,\n    label: params.credentialId\n      ? \"VALIDATE -> MULTICALL(ADD_AUTHORITY, REGISTER_CREDENTIAL)\"\n      : \"VALIDATE -> ADD_AUTHORITY\",\n  });\n\n  return { ...result, newAuthorityIdx };\n}\n"],"mappings":";AAYA;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AA6EP,eAAsB,mBACpB,QAC0B;AAC1B,QAAM,SAAS,OAAO,aAAa,MAAM;AAAA,EAAC;AAE1C,QAAM,gBAAgB,MAAM,OAAO,KAAK,SAAS,IAAI,OAAO,aAAa;AACzE,QAAM,aAAqC,eAAe,MAAM;AAChE,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,6BAA6B;AAAA,EAC/C;AAEA,QAAM,SAAS,uBAAuB,UAAU;AAChD,QAAM,cACJ,OAAO,YAAY,OAAO,OAAO;AACnC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AACA,MAAI,YAAY,SAAS,WAAW;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,QAAM,kBAAkB,OAAO,YAAY;AAE3C,MAAI,oBAAkC,CAAC;AACvC,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,MAAI,OAAO,cAAc;AACvB,iBAAa,MAAM,2BAA2B,OAAO,YAAY;AACjE,yBAAqB,MAAM;AAAA,MACzB;AAAA,MACA,OAAO;AAAA,IACT;AAEA,WAAO,+CAA+C;AACtD,UAAM,cAAc,MAAM,OAAO,KAAK,OAAO,SAAS;AAAA,MACpD,WAAW;AAAA,MACX,SAAS;AAAA,IACX,CAAC;AACD,kBAAc,YAAY;AAC1B,wBAAoB,CAAC,kBAAkB;AAAA,EACzC;AAEA,QAAM,MAAM,oBAAoB;AAAA,IAC9B,eAAe,OAAO;AAAA,IACtB;AAAA,IACA,kBAAkB,OAAO,eAAe,CAAC,wBAAwB,IAAI,CAAC;AAAA,IACtE,gBAAgB,OAAO;AAAA,EACzB,CAAC;AAED,QAAM,uBAAuB,cAAc,OAAO,cAAc;AAChE,QAAM,0BAA0B,8BAA8B;AAAA,IAC5D,kBAAkB,IAAI;AAAA,IACtB,WAAW,OAAO;AAAA,EACpB,CAAC;AAED,MAAI,mBAAmB,IAAI,gBAAgB,oBAAoB;AAC/D,MAAI,wBAAwB;AAE5B,MAAI,OAAO,cAAc;AACvB,QAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,aAAa;AACtD,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AAEA,UAAM,gCAAgC,oCAAoC;AAAA,MACxE,kBAAkB,IAAI;AAAA,MACtB,kBAAkB,IAAI,gBAAgB,kBAAkB;AAAA,MACxD,MAAM;AAAA,MACN,YAAY;AAAA,IACd,CAAC;AAED,uBAAmB,IAAI,gBAAgB,wBAAwB;AAC/D,4BAAwB,0BAA0B;AAAA,MAChD;AAAA,QACE,YAAY,IAAI,gBAAgB,oBAAoB;AAAA,QACpD,iBAAiB;AAAA,MACnB;AAAA,MACA;AAAA,QACE,YAAY,IAAI,gBAAgB,oBAAoB;AAAA,QACpD,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AAAA,EACH;AAGA,QAAM,YAAY,MAAM;AAAA,IACtB,OAAO;AAAA,IACP,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ,OAAO;AAAA,IACP;AAAA,MACE,YAAY;AAAA,MACZ,iBAAiB;AAAA,IACnB;AAAA,EACF;AAEA,SAAO,iCAAiC;AACxC,QAAM,YAAY,MAAM,OAAO,QAAQ,cAAc,SAAS;AAE9D,QAAM,sBAAsB,0BAA0B;AAAA,IACpD,kBAAkB,IAAI;AAAA,IACtB,SAAS,OAAO;AAAA,IAChB,mBAAmB;AAAA,MACjB,YAAY;AAAA,MACZ,iBAAiB;AAAA,IACnB;AAAA,IACA,YAAY,UAAU;AAAA,IACtB,YAAY,UAAU;AAAA,IACtB,mBAAmB,UAAU;AAAA,IAC7B,gBAAgB,UAAU;AAAA,EAC5B,CAAC;AAED,SAAO,wBAAwB;AAC/B,QAAM,SAAS,MAAM,OAAO,SAAS;AAAA,IACnC,MAAM,OAAO;AAAA,IACb,cAAc,OAAO;AAAA,IACrB,iBAAiB;AAAA,IACjB,oBAAoB,IAAI;AAAA,IACxB,mBAAmB,IAAI;AAAA,IACvB,OAAO,OAAO,eACV,8DACA;AAAA,EACN,CAAC;AAED,SAAO,EAAE,GAAG,QAAQ,gBAAgB;AACtC;","names":[]}

package/dist/chunk-TW7HANJM.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/register.ts","../src/capabilities.ts","../src/label.ts","../src/sign.ts","../src/web.ts"],"sourcesContent":["import type {\n  PasskeyRegistrationOptions,\n  PasskeyRegistrationResult,\n  PasskeyPopupRegistrationResult,\n} from './types';\nimport { arrayBufferToBase64Url, bytesToHex } from '@thru/programs/passkey-manager';\nimport {\n  isWebAuthnSupported,\n  getPasskeyPromptMode,\n  maybePreopenPopup,\n  shouldFallbackToPopup,\n  type PasskeyPromptAction,\n} from './capabilities';\nimport { requestPasskeyPopup, openPasskeyPopupWindow, closePopup } from './popup';\n\n/**\n * Register a new passkey for a profile.\n */\nexport async function registerPasskey(\n  alias: string,\n  userId: string,\n  rpId: string,\n  options: PasskeyRegistrationOptions = {}\n): Promise<PasskeyRegistrationResult> {\n  if (!isWebAuthnSupported()) {\n    throw new Error('WebAuthn is not supported in this browser');\n  }\n\n  return runWithPromptMode(\n    'create',\n    () => registerPasskeyInline(alias, userId, rpId),\n    (preopenedPopup) => registerPasskeyViaPopup(alias, userId, rpId, preopenedPopup),\n    options\n  );\n}\n\nasync function runWithPromptMode<T>(\n  action: PasskeyPromptAction,\n  inlineFn: () => Promise<T>,\n  popupFn: (preopenedPopup?: Window | null) => Promise<T>,\n  options: PasskeyRegistrationOptions = {}\n): Promise<T> {\n  const allowPopupFallback = options.allowPopupFallback ?? true;\n  const preopenedPopup = allowPopupFallback ? maybePreopenPopup(action, openPasskeyPopupWindow) : null;\n  const promptMode = allowPopupFallback ? await getPasskeyPromptMode(action) : 'inline';\n  if (promptMode === 'popup') {\n    return popupFn(preopenedPopup);\n  }\n\n  closePopup(preopenedPopup);\n\n  try {\n    return await inlineFn();\n  } catch (error) {\n    if (allowPopupFallback && shouldFallbackToPopup(error)) {\n      return popupFn();\n    }\n    throw error;\n  }\n}\n\nasync function registerPasskeyInline(\n  alias: string,\n  userId: string,\n  rpId: string\n): Promise<PasskeyRegistrationResult> {\n  const rpName = 'Thru Wallet';\n\n  const userIdBytes = new TextEncoder().encode(userId);\n  const userIdBuffer = userIdBytes.slice(0, 64);\n\n  const challenge = crypto.getRandomValues(new Uint8Array(32));\n\n  const createOptions: PublicKeyCredentialCreationOptions = {\n    challenge,\n    rp: {\n      id: rpId,\n      name: rpName,\n    },\n    user: {\n      id: userIdBuffer,\n      name: alias,\n      displayName: alias,\n    },\n    pubKeyCredParams: [\n      { type: 'public-key', alg: -7 },\n    ],\n    authenticatorSelection: {\n      authenticatorAttachment: 'platform',\n      userVerification: 'required',\n      residentKey: 'required',\n      requireResidentKey: true,\n    },\n    attestation: 'none',\n    timeout: 60000,\n  };\n\n  const credential = (await navigator.credentials.create({\n    publicKey: createOptions,\n  })) as PublicKeyCredential | null;\n\n  if (!credential) {\n    throw new Error('Passkey registration was cancelled');\n  }\n\n  const response = credential.response as AuthenticatorAttestationResponse;\n  const { x, y } = extractP256PublicKey(response);\n  const authenticatorAttachment =\n    (\n      credential as PublicKeyCredential & {\n        authenticatorAttachment?: AuthenticatorAttachment | null;\n      }\n    ).authenticatorAttachment ?? null;\n\n  return {\n    credentialId: arrayBufferToBase64Url(credential.rawId),\n    publicKeyX: bytesToHex(x),\n    publicKeyY: bytesToHex(y),\n    rpId,\n    authenticatorAttachment,\n  };\n}\n\nasync function registerPasskeyViaPopup(\n  alias: string,\n  userId: string,\n  rpId: string,\n  preopenedPopup?: Window | null\n): Promise<PasskeyRegistrationResult> {\n  const result = await requestPasskeyPopup<PasskeyPopupRegistrationResult>(\n    'create',\n    { alias, userId, rpId },\n    preopenedPopup\n  );\n  return result;\n}\n\n// Key extraction helpers\n\nfunction extractP256PublicKey(\n  response: AuthenticatorAttestationResponse\n): { x: Uint8Array; y: Uint8Array } {\n  if (typeof response.getPublicKey === 'function') {\n    const spkiKey = response.getPublicKey();\n    if (spkiKey) {\n      return extractFromSpki(new Uint8Array(spkiKey));\n    }\n  }\n\n  if (typeof response.getAuthenticatorData === 'function') {\n    const authData = new Uint8Array(response.getAuthenticatorData());\n    return extractFromAuthenticatorData(authData);\n  }\n\n  throw new Error('Unable to extract public key: browser does not support required WebAuthn methods');\n}\n\nfunction extractFromSpki(spki: Uint8Array): { x: Uint8Array; y: Uint8Array } {\n  const pointStart = spki.length - 65;\n\n  if (spki[pointStart] !== 0x04) {\n    throw new Error('Invalid SPKI format: expected uncompressed point');\n  }\n\n  const x = spki.slice(pointStart + 1, pointStart + 33);\n  const y = spki.slice(pointStart + 33, pointStart + 65);\n\n  if (x.length !== 32 || y.length !== 32) {\n    throw new Error('Invalid SPKI format: incorrect coordinate length');\n  }\n\n  return { x, y };\n}\n\nfunction extractFromAuthenticatorData(authData: Uint8Array): { x: Uint8Array; y: Uint8Array } {\n  const rpIdHashLength = 32;\n  const flagsLength = 1;\n  const counterLength = 4;\n  const offset = rpIdHashLength + flagsLength + counterLength;\n  const aaguidLength = 16;\n  const credIdLenOffset = offset + aaguidLength;\n  const credIdLength = (authData[credIdLenOffset] << 8) | authData[credIdLenOffset + 1];\n  const coseKeyOffset = credIdLenOffset + 2 + credIdLength;\n  const coseKey = authData.slice(coseKeyOffset);\n\n  return extractFromCoseKey(coseKey);\n}\n\nfunction extractFromCoseKey(coseKey: Uint8Array): { x: Uint8Array; y: Uint8Array } {\n  const mapStart = coseKey[0];\n  if (mapStart !== 0xa5 && mapStart !== 0xa4) {\n    throw new Error('Invalid COSE key format');\n  }\n\n  let offset = 1;\n  let x: Uint8Array | null = null;\n  let y: Uint8Array | null = null;\n\n  while (offset < coseKey.length) {\n    const key = coseKey[offset++];\n    const valueType = coseKey[offset++];\n\n    if (key === 0x21) {\n      const length = valueType & 0x1f;\n      x = coseKey.slice(offset, offset + length);\n      offset += length;\n      continue;\n    }\n\n    if (key === 0x22) {\n      const length = valueType & 0x1f;\n      y = coseKey.slice(offset, offset + length);\n      offset += length;\n      continue;\n    }\n\n    if (valueType >= 0x40 && valueType <= 0x5f) {\n      const length = valueType & 0x1f;\n      offset += length;\n      continue;\n    }\n\n    if (valueType === 0x01 || valueType === 0x02 || valueType === 0x03) {\n      continue;\n    }\n\n    if (valueType >= 0x18 && valueType <= 0x1b) {\n      const size = 1 << (valueType - 0x18);\n      offset += size;\n      continue;\n    }\n  }\n\n  if (!x || !y) {\n    throw new Error('Failed to extract P-256 public key from COSE data');\n  }\n\n  if (x.length !== 32 || y.length !== 32) {\n    throw new Error('Invalid COSE key: incorrect coordinate length');\n  }\n\n  return { x, y };\n}\n","import type { PasskeyClientCapabilities } from './types';\n\nconst globalProcess = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process;\nconst DEBUG = globalProcess?.env?.NEXT_PUBLIC_PASSKEY_DEBUG === '1';\n\nlet cachedClientCapabilities: PasskeyClientCapabilities | null | undefined;\nlet clientCapabilitiesPromise: Promise<PasskeyClientCapabilities | null> | null = null;\n\nexport function isWebAuthnSupported(): boolean {\n  const supported =\n    typeof window !== 'undefined' &&\n    typeof window.PublicKeyCredential !== 'undefined' &&\n    typeof navigator.credentials !== 'undefined';\n\n  if (DEBUG) {\n    console.log('[Passkey] WebAuthn support check:', {\n      window: typeof window !== 'undefined',\n      PublicKeyCredential:\n        typeof window !== 'undefined' && typeof window.PublicKeyCredential !== 'undefined',\n      credentials:\n        typeof window !== 'undefined' &&\n        typeof navigator !== 'undefined' &&\n        typeof navigator.credentials !== 'undefined',\n      supported,\n    });\n  }\n\n  return supported;\n}\n\nasync function fetchPasskeyClientCapabilities(): Promise<PasskeyClientCapabilities | null> {\n  if (typeof window === 'undefined' || typeof window.PublicKeyCredential === 'undefined') {\n    return null;\n  }\n\n  const getClientCapabilities = (window.PublicKeyCredential as {\n    getClientCapabilities?: () => Promise<PasskeyClientCapabilities>;\n  }).getClientCapabilities;\n\n  if (typeof getClientCapabilities !== 'function') {\n    return null;\n  }\n\n  try {\n    const capabilities = await getClientCapabilities.call(window.PublicKeyCredential);\n    if (DEBUG) {\n      console.log('[Passkey] WebAuthn client capabilities:', capabilities);\n    }\n    return capabilities ?? null;\n  } catch (error) {\n    if (DEBUG) {\n      console.warn('[Passkey] Failed to read client capabilities:', error);\n    }\n    return null;\n  }\n}\n\nexport function preloadPasskeyClientCapabilities(): void {\n  if (cachedClientCapabilities !== undefined || clientCapabilitiesPromise) {\n    return;\n  }\n\n  clientCapabilitiesPromise = fetchPasskeyClientCapabilities().then((capabilities) => {\n    cachedClientCapabilities = capabilities;\n    return capabilities;\n  });\n}\n\nexport async function getPasskeyClientCapabilities(): Promise<PasskeyClientCapabilities | null> {\n  if (cachedClientCapabilities !== undefined) {\n    return cachedClientCapabilities;\n  }\n\n  if (!clientCapabilitiesPromise) {\n    preloadPasskeyClientCapabilities();\n  }\n\n  if (!clientCapabilitiesPromise) {\n    cachedClientCapabilities = null;\n    return null;\n  }\n\n  const capabilities = await clientCapabilitiesPromise;\n  cachedClientCapabilities = capabilities;\n  return capabilities;\n}\n\nexport function getCachedPasskeyClientCapabilities(): PasskeyClientCapabilities | null | undefined {\n  return cachedClientCapabilities;\n}\n\nexport function isInIframe(): boolean {\n  if (typeof window === 'undefined') {\n    return false;\n  }\n  try {\n    return window.self !== window.top;\n  } catch {\n    return true;\n  }\n}\n\nexport type PasskeyPromptAction = 'get' | 'create';\n\nexport async function shouldUsePasskeyPopup(action: PasskeyPromptAction): Promise<boolean> {\n  if (!isInIframe()) {\n    return false;\n  }\n  const mode = await getPasskeyPromptMode(action);\n  return mode === 'popup';\n}\n\ntype PasskeyPromptMode = 'inline' | 'popup';\n\nfunction getPermissionsPolicyAllowsFeature(feature: string): boolean | null {\n  if (typeof document === 'undefined') {\n    return null;\n  }\n\n  const policy = (document as { permissionsPolicy?: { allowsFeature?: (name: string) => boolean } })\n    .permissionsPolicy;\n  const featurePolicy = (document as { featurePolicy?: { allowsFeature?: (name: string) => boolean } })\n    .featurePolicy;\n  const allowsFeature = policy?.allowsFeature || featurePolicy?.allowsFeature;\n\n  if (typeof allowsFeature !== 'function') {\n    return null;\n  }\n\n  try {\n    return allowsFeature(feature);\n  } catch {\n    return null;\n  }\n}\n\nfunction getCachedPromptMode(action: PasskeyPromptAction): PasskeyPromptMode | 'unknown' {\n  if (!isInIframe()) {\n    return 'inline';\n  }\n\n  if (cachedClientCapabilities === undefined && !clientCapabilitiesPromise) {\n    preloadPasskeyClientCapabilities();\n  }\n\n  const feature =\n    action === 'create' ? 'publickey-credentials-create' : 'publickey-credentials-get';\n  const policyAllows = getPermissionsPolicyAllowsFeature(feature);\n  const capabilities = getCachedPasskeyClientCapabilities();\n  const supportsInline =\n    capabilities?.passkeyPlatformAuthenticator === true ||\n    capabilities?.userVerifyingPlatformAuthenticator === true;\n\n  if (policyAllows === false) {\n    return 'popup';\n  }\n\n  if (capabilities === undefined) {\n    return 'unknown';\n  }\n\n  if (!supportsInline) {\n    return 'popup';\n  }\n\n  return 'inline';\n}\n\nexport async function getPasskeyPromptMode(action: PasskeyPromptAction): Promise<PasskeyPromptMode> {\n  if (!isInIframe()) {\n    return 'inline';\n  }\n\n  const feature =\n    action === 'create' ? 'publickey-credentials-create' : 'publickey-credentials-get';\n  const policyAllows = getPermissionsPolicyAllowsFeature(feature);\n  const capabilities = await getPasskeyClientCapabilities();\n  const supportsInline =\n    capabilities?.passkeyPlatformAuthenticator === true ||\n    capabilities?.userVerifyingPlatformAuthenticator === true;\n\n  if (DEBUG) {\n    console.log('[Passkey] Prompt mode check:', {\n      action,\n      policyAllows,\n      supportsInline,\n      capabilities,\n    });\n  }\n\n  if (!supportsInline) {\n    return 'popup';\n  }\n\n  if (policyAllows === false) {\n    return 'popup';\n  }\n\n  return 'inline';\n}\n\nexport function maybePreopenPopup(action: PasskeyPromptAction, openPopupFn: () => Window): Window | null {\n  const cachedMode = getCachedPromptMode(action);\n  if (cachedMode !== 'popup') {\n    return null;\n  }\n\n  try {\n    return openPopupFn();\n  } catch {\n    return null;\n  }\n}\n\nexport function shouldFallbackToPopup(error: unknown): boolean {\n  if (!isInIframe()) {\n    return false;\n  }\n\n  const name =\n    error && typeof error === 'object' && 'name' in error ? String((error as { name?: unknown }).name) : '';\n  const message =\n    error && typeof error === 'object' && 'message' in error\n      ? String((error as { message?: unknown }).message)\n      : '';\n  const normalized = `${name} ${message}`.toLowerCase();\n\n  if (\n    normalized.includes('cancel') ||\n    normalized.includes('canceled') ||\n    normalized.includes('cancelled') ||\n    normalized.includes('user canceled') ||\n    normalized.includes('user cancelled') ||\n    normalized.includes('aborted')\n  ) {\n    return false;\n  }\n\n  if (normalized.includes('securityerror')) {\n    return true;\n  }\n\n  if (normalized.includes('notallowederror')) {\n    if (\n      normalized.includes('permission') ||\n      normalized.includes('policy') ||\n      normalized.includes('iframe') ||\n      normalized.includes('frame')\n    ) {\n      return true;\n    }\n  }\n\n  return false;\n}\n","const DEFAULT_LABEL = 'Thru Wallet passkey';\n\nexport interface DistinctPasskeyLabelOptions {\n  existingLabels?: Iterable<string | null | undefined>;\n  maxAttempts?: number;\n  suffixFactory?: () => string;\n}\n\nexport function createDistinctPasskeyLabel(\n  baseLabel: string,\n  _options: DistinctPasskeyLabelOptions = {}\n): string {\n  return baseLabel.trim() || DEFAULT_LABEL;\n}\n","import type {\n  PasskeySigningResult,\n  PasskeyStoredSigningResult,\n  PasskeyDiscoverableSigningResult,\n  PasskeyMetadata,\n  PasskeyPopupContext,\n  PasskeyPopupSigningResult,\n  PasskeyPopupStoredSigningResult,\n  PasskeyStoredSigningOptions,\n} from './types';\nimport {\n  arrayBufferToBase64Url,\n  base64UrlToArrayBuffer,\n  bytesToBase64Url,\n  base64UrlToBytes,\n  parseDerSignature,\n  normalizeLowS,\n} from '@thru/programs/passkey-manager';\nimport {\n  isWebAuthnSupported,\n  getPasskeyPromptMode,\n  isInIframe,\n  maybePreopenPopup,\n  shouldFallbackToPopup,\n  type PasskeyPromptAction,\n} from './capabilities';\nimport {\n  requestPasskeyPopup,\n  openPasskeyPopupWindow,\n  closePopup,\n} from './popup';\n\n/**\n * Sign a challenge with an existing passkey (by credential ID).\n */\nexport async function signWithPasskey(\n  credentialId: string,\n  challenge: Uint8Array,\n  rpId: string\n): Promise<PasskeySigningResult> {\n  if (!isWebAuthnSupported()) {\n    throw new Error('WebAuthn is not supported in this browser');\n  }\n\n  return runWithPromptMode(\n    'get',\n    () => signWithPasskeyInline(credentialId, challenge, rpId),\n    (preopenedPopup) =>\n      signWithPasskeyViaPopup(credentialId, challenge, rpId, preopenedPopup)\n  );\n}\n\n/**\n * Sign with stored passkey (for embedded/popup contexts).\n */\nexport async function signWithStoredPasskey(\n  challenge: Uint8Array,\n  rpId: string,\n  preferredPasskey: PasskeyMetadata | null,\n  allPasskeys: PasskeyMetadata[],\n  context?: PasskeyPopupContext,\n  options: PasskeyStoredSigningOptions = {}\n): Promise<PasskeyStoredSigningResult> {\n  if (!isWebAuthnSupported()) {\n    throw new Error('WebAuthn is not supported in this browser');\n  }\n\n  const allowPopupFallback = options.allowPopupFallback ?? true;\n  const preopenedPopup = allowPopupFallback\n    ? maybePreopenPopup('get', openPasskeyPopupWindow)\n    : null;\n  const promptMode = allowPopupFallback\n    ? await getPasskeyPromptMode('get')\n    : 'inline';\n  const storedPasskey = preferredPasskey;\n  const canUsePopup = allowPopupFallback && isInIframe();\n\n  if (options.preferDiscoverable) {\n    closePopup(preopenedPopup);\n    return signWithDiscoverableStoredPasskey(\n      challenge,\n      storedPasskey?.rpId ?? rpId,\n      allPasskeys\n    );\n  }\n\n  if (promptMode === 'popup' || (canUsePopup && !storedPasskey)) {\n    return requestStoredPasskeyPopup(challenge, preopenedPopup, context);\n  }\n\n  closePopup(preopenedPopup);\n\n  try {\n    if (storedPasskey) {\n      try {\n        const result = await signWithPasskeyInline(\n          storedPasskey.credentialId,\n          challenge,\n          storedPasskey.rpId\n        );\n        return {\n          ...result,\n          passkey: storedPasskey,\n        };\n      } catch (error) {\n        if (!shouldFallbackToDiscoverable(error)) {\n          throw error;\n        }\n        return signWithDiscoverableStoredPasskey(\n          challenge,\n          storedPasskey.rpId,\n          allPasskeys\n        );\n      }\n    }\n\n    return signWithDiscoverableStoredPasskey(challenge, rpId, allPasskeys);\n  } catch (error) {\n    if (canUsePopup && shouldFallbackToPopup(error)) {\n      return requestStoredPasskeyPopup(challenge, undefined, context);\n    }\n\n    throw error;\n  }\n}\n\nasync function signWithDiscoverableStoredPasskey(\n  challenge: Uint8Array,\n  rpId: string,\n  allPasskeys: PasskeyMetadata[]\n): Promise<PasskeyStoredSigningResult> {\n  const discoverable = await signWithDiscoverablePasskey(challenge, rpId);\n  const matchingPasskey =\n    allPasskeys.find((p) => p.credentialId === discoverable.credentialId) ??\n    null;\n  const now = new Date().toISOString();\n  const passkey = matchingPasskey ?? {\n    credentialId: discoverable.credentialId,\n    publicKeyX: '',\n    publicKeyY: '',\n    rpId: discoverable.rpId,\n    createdAt: now,\n    lastUsedAt: now,\n  };\n\n  return {\n    signature: discoverable.signature,\n    authenticatorData: discoverable.authenticatorData,\n    clientDataJSON: discoverable.clientDataJSON,\n    signatureR: discoverable.signatureR,\n    signatureS: discoverable.signatureS,\n    authenticatorAttachment: discoverable.authenticatorAttachment,\n    passkey,\n  };\n}\n\nfunction shouldFallbackToDiscoverable(error: unknown): boolean {\n  const name =\n    error && typeof error === 'object' && 'name' in error\n      ? String((error as { name?: unknown }).name)\n      : '';\n  const message =\n    error && typeof error === 'object' && 'message' in error\n      ? String((error as { message?: unknown }).message)\n      : '';\n  const normalized = `${name} ${message}`.toLowerCase();\n\n  if (\n    normalized.includes('user rejected') ||\n    normalized.includes('user canceled') ||\n    normalized.includes('user cancelled')\n  ) {\n    return false;\n  }\n\n  return (\n    normalized.includes('notallowederror') ||\n    normalized.includes('invalidstateerror') ||\n    normalized.includes('notfounderror') ||\n    normalized.includes('not found') ||\n    normalized.includes('no passkey') ||\n    normalized.includes('no credential') ||\n    normalized.includes('saved for this app')\n  );\n}\n\n/**\n * Sign with a discoverable passkey (no credential ID - browser prompts user to select).\n */\nexport async function signWithDiscoverablePasskey(\n  challenge: Uint8Array,\n  rpId: string\n): Promise<PasskeyDiscoverableSigningResult> {\n  if (!isWebAuthnSupported()) {\n    throw new Error('WebAuthn is not supported in this browser');\n  }\n\n  const resolvedRpId = rpId;\n  const result = await signWithPasskeyAssertion(challenge, resolvedRpId);\n\n  return {\n    signature: result.signature,\n    authenticatorData: result.authenticatorData,\n    clientDataJSON: result.clientDataJSON,\n    signatureR: result.signatureR,\n    signatureS: result.signatureS,\n    credentialId: result.credentialId,\n    rpId: resolvedRpId,\n    authenticatorAttachment: result.authenticatorAttachment,\n  };\n}\n\n// Internal helpers\n\nasync function runWithPromptMode<T>(\n  action: PasskeyPromptAction,\n  inlineFn: () => Promise<T>,\n  popupFn: (preopenedPopup?: Window | null) => Promise<T>\n): Promise<T> {\n  const preopenedPopup = maybePreopenPopup(action, openPasskeyPopupWindow);\n  const promptMode = await getPasskeyPromptMode(action);\n  if (promptMode === 'popup') {\n    return popupFn(preopenedPopup);\n  }\n\n  closePopup(preopenedPopup);\n\n  try {\n    return await inlineFn();\n  } catch (error) {\n    if (shouldFallbackToPopup(error)) {\n      return popupFn();\n    }\n    throw error;\n  }\n}\n\nasync function signWithPasskeyInline(\n  credentialId: string,\n  challenge: Uint8Array,\n  rpId: string\n): Promise<PasskeySigningResult> {\n  const result = await signWithPasskeyAssertion(challenge, rpId, credentialId);\n  return {\n    signature: result.signature,\n    authenticatorData: result.authenticatorData,\n    clientDataJSON: result.clientDataJSON,\n    signatureR: result.signatureR,\n    signatureS: result.signatureS,\n    authenticatorAttachment: result.authenticatorAttachment,\n  };\n}\n\nasync function signWithPasskeyAssertion(\n  challenge: Uint8Array,\n  rpId: string,\n  credentialId?: string\n): Promise<PasskeySigningResult & { credentialId: string }> {\n  const challengeBytes = new Uint8Array(challenge);\n  const getOptions: PublicKeyCredentialRequestOptions = {\n    challenge: challengeBytes,\n    rpId,\n    userVerification: 'required',\n    timeout: 60000,\n  };\n\n  if (credentialId) {\n    const credentialIdBuffer = base64UrlToArrayBuffer(credentialId);\n    getOptions.allowCredentials = [\n      {\n        type: 'public-key',\n        id: credentialIdBuffer,\n        transports: ['internal', 'hybrid', 'usb', 'ble', 'nfc'],\n      },\n    ];\n  }\n\n  const assertion = (await navigator.credentials.get({\n    publicKey: getOptions,\n  })) as PublicKeyCredential | null;\n\n  if (!assertion) {\n    throw new Error('Passkey authentication was cancelled');\n  }\n\n  const response = assertion.response as AuthenticatorAssertionResponse;\n\n  const signature = new Uint8Array(response.signature);\n  let { r, s } = parseDerSignature(signature);\n  s = normalizeLowS(s);\n\n  /* `authenticatorAttachment` distinguishes a same-device passkey\n     ('platform') from a cross-device one signed via QR / hybrid\n     transport ('cross-platform'). Drives the wallet's add-device\n     prompt. Browsers may report null. */\n  const rawAttachment =\n    (\n      assertion as PublicKeyCredential & {\n        authenticatorAttachment?: AuthenticatorAttachment | null;\n      }\n    ).authenticatorAttachment ?? null;\n\n  return {\n    signature: new Uint8Array([...r, ...s]),\n    authenticatorData: new Uint8Array(response.authenticatorData),\n    clientDataJSON: new Uint8Array(response.clientDataJSON),\n    signatureR: r,\n    signatureS: s,\n    credentialId: arrayBufferToBase64Url(assertion.rawId),\n    authenticatorAttachment: rawAttachment,\n  };\n}\n\nasync function signWithPasskeyViaPopup(\n  credentialId: string,\n  challenge: Uint8Array,\n  rpId: string,\n  preopenedPopup?: Window | null\n): Promise<PasskeySigningResult> {\n  const result = await requestPasskeyPopup<PasskeyPopupSigningResult>(\n    'get',\n    {\n      credentialId,\n      challengeBase64Url: bytesToBase64Url(challenge),\n      rpId,\n    },\n    preopenedPopup\n  );\n\n  return decodePopupSigningResult(result);\n}\n\nasync function requestStoredPasskeyPopup(\n  challenge: Uint8Array,\n  preopenedPopup?: Window | null,\n  context?: PasskeyPopupContext\n): Promise<PasskeyStoredSigningResult> {\n  const result = await requestPasskeyPopup<PasskeyPopupStoredSigningResult>(\n    'getStored',\n    {\n      challengeBase64Url: bytesToBase64Url(challenge),\n      context,\n    },\n    preopenedPopup\n  );\n  return decodePopupStoredSigningResult(result);\n}\n\nfunction decodePopupSigningResult(\n  result: PasskeyPopupSigningResult\n): PasskeySigningResult {\n  return {\n    signature: base64UrlToBytes(result.signatureBase64Url),\n    authenticatorData: base64UrlToBytes(result.authenticatorDataBase64Url),\n    clientDataJSON: base64UrlToBytes(result.clientDataJSONBase64Url),\n    signatureR: base64UrlToBytes(result.signatureRBase64Url),\n    signatureS: base64UrlToBytes(result.signatureSBase64Url),\n    authenticatorAttachment: result.authenticatorAttachment ?? null,\n  };\n}\n\nfunction decodePopupStoredSigningResult(\n  result: PasskeyPopupStoredSigningResult\n): PasskeyStoredSigningResult {\n  return {\n    ...decodePopupSigningResult(result),\n    passkey: result.passkey,\n    accounts: result.accounts,\n  };\n}\n","export type {\n  PasskeyRegistrationResult,\n  PasskeySigningResult,\n  PasskeyDiscoverableSigningResult,\n  PasskeyStoredSigningResult,\n  PasskeyMetadata,\n  PasskeyClientCapabilities,\n  PasskeyPopupContext,\n  PasskeyPopupAccount,\n  PasskeyStoredSigningOptions,\n  PasskeyRegistrationOptions,\n} from './types';\n\nexport { registerPasskey } from './register';\nexport { createDistinctPasskeyLabel } from './label';\nexport type { DistinctPasskeyLabelOptions } from './label';\n\nexport {\n  signWithPasskey,\n  signWithStoredPasskey,\n  signWithDiscoverablePasskey,\n} from './sign';\n\nexport {\n  parseDerSignature,\n  normalizeLowS,\n  normalizeSignatureComponent,\n  P256_N,\n  P256_HALF_N,\n  bytesToBigIntBE,\n  bigIntToBytesBE,\n} from '@thru/programs/passkey-manager';\n\nexport {\n  isWebAuthnSupported,\n  preloadPasskeyClientCapabilities,\n  getPasskeyClientCapabilities,\n  getCachedPasskeyClientCapabilities,\n  shouldUsePasskeyPopup,\n  isInIframe,\n  type PasskeyPromptAction,\n} from './capabilities';\n\nexport {\n  arrayBufferToBase64Url,\n  base64UrlToArrayBuffer,\n  bytesToBase64,\n  bytesToBase64Url,\n  base64UrlToBytes,\n  bytesToHex,\n  hexToBytes,\n  bytesEqual,\n  compareBytes,\n  uniqueAccounts,\n} from '@thru/programs/passkey-manager';\n"],"mappings":";;;;;;;AAKA,SAAS,wBAAwB,kBAAkB;;;ACHnD,IAAM,gBAAiB,WAA0E;AACjG,IAAM,QAAQ,eAAe,KAAK,8BAA8B;AAEhE,IAAI;AACJ,IAAI,4BAA8E;AAE3E,SAAS,sBAA+B;AAC7C,QAAM,YACJ,OAAO,WAAW,eAClB,OAAO,OAAO,wBAAwB,eACtC,OAAO,UAAU,gBAAgB;AAEnC,MAAI,OAAO;AACT,YAAQ,IAAI,qCAAqC;AAAA,MAC/C,QAAQ,OAAO,WAAW;AAAA,MAC1B,qBACE,OAAO,WAAW,eAAe,OAAO,OAAO,wBAAwB;AAAA,MACzE,aACE,OAAO,WAAW,eAClB,OAAO,cAAc,eACrB,OAAO,UAAU,gBAAgB;AAAA,MACnC;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEA,eAAe,iCAA4E;AACzF,MAAI,OAAO,WAAW,eAAe,OAAO,OAAO,wBAAwB,aAAa;AACtF,WAAO;AAAA,EACT;AAEA,QAAM,wBAAyB,OAAO,oBAEnC;AAEH,MAAI,OAAO,0BAA0B,YAAY;AAC/C,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,eAAe,MAAM,sBAAsB,KAAK,OAAO,mBAAmB;AAChF,QAAI,OAAO;AACT,cAAQ,IAAI,2CAA2C,YAAY;AAAA,IACrE;AACA,WAAO,gBAAgB;AAAA,EACzB,SAAS,OAAO;AACd,QAAI,OAAO;AACT,cAAQ,KAAK,iDAAiD,KAAK;AAAA,IACrE;AACA,WAAO;AAAA,EACT;AACF;AAEO,SAAS,mCAAyC;AACvD,MAAI,6BAA6B,UAAa,2BAA2B;AACvE;AAAA,EACF;AAEA,8BAA4B,+BAA+B,EAAE,KAAK,CAAC,iBAAiB;AAClF,+BAA2B;AAC3B,WAAO;AAAA,EACT,CAAC;AACH;AAEA,eAAsB,+BAA0E;AAC9F,MAAI,6BAA6B,QAAW;AAC1C,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,2BAA2B;AAC9B,qCAAiC;AAAA,EACnC;AAEA,MAAI,CAAC,2BAA2B;AAC9B,+BAA2B;AAC3B,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,MAAM;AAC3B,6BAA2B;AAC3B,SAAO;AACT;AAEO,SAAS,qCAAmF;AACjG,SAAO;AACT;AAEO,SAAS,aAAsB;AACpC,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,OAAO,SAAS,OAAO;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,eAAsB,sBAAsB,QAA+C;AACzF,MAAI,CAAC,WAAW,GAAG;AACjB,WAAO;AAAA,EACT;AACA,QAAM,OAAO,MAAM,qBAAqB,MAAM;AAC9C,SAAO,SAAS;AAClB;AAIA,SAAS,kCAAkC,SAAiC;AAC1E,MAAI,OAAO,aAAa,aAAa;AACnC,WAAO;AAAA,EACT;AAEA,QAAM,SAAU,SACb;AACH,QAAM,gBAAiB,SACpB;AACH,QAAM,gBAAgB,QAAQ,iBAAiB,eAAe;AAE9D,MAAI,OAAO,kBAAkB,YAAY;AACvC,WAAO;AAAA,EACT;AAEA,MAAI;AACF,WAAO,cAAc,OAAO;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,QAA4D;AACvF,MAAI,CAAC,WAAW,GAAG;AACjB,WAAO;AAAA,EACT;AAEA,MAAI,6BAA6B,UAAa,CAAC,2BAA2B;AACxE,qCAAiC;AAAA,EACnC;AAEA,QAAM,UACJ,WAAW,WAAW,iCAAiC;AACzD,QAAM,eAAe,kCAAkC,OAAO;AAC9D,QAAM,eAAe,mCAAmC;AACxD,QAAM,iBACJ,cAAc,iCAAiC,QAC/C,cAAc,uCAAuC;AAEvD,MAAI,iBAAiB,OAAO;AAC1B,WAAO;AAAA,EACT;AAEA,MAAI,iBAAiB,QAAW;AAC9B,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,eAAsB,qBAAqB,QAAyD;AAClG,MAAI,CAAC,WAAW,GAAG;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,UACJ,WAAW,WAAW,iCAAiC;AACzD,QAAM,eAAe,kCAAkC,OAAO;AAC9D,QAAM,eAAe,MAAM,6BAA6B;AACxD,QAAM,iBACJ,cAAc,iCAAiC,QAC/C,cAAc,uCAAuC;AAEvD,MAAI,OAAO;AACT,YAAQ,IAAI,gCAAgC;AAAA,MAC1C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,EACT;AAEA,MAAI,iBAAiB,OAAO;AAC1B,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEO,SAAS,kBAAkB,QAA6B,aAA0C;AACvG,QAAM,aAAa,oBAAoB,MAAM;AAC7C,MAAI,eAAe,SAAS;AAC1B,WAAO;AAAA,EACT;AAEA,MAAI;AACF,WAAO,YAAY;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,sBAAsB,OAAyB;AAC7D,MAAI,CAAC,WAAW,GAAG;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,OACJ,SAAS,OAAO,UAAU,YAAY,UAAU,QAAQ,OAAQ,MAA6B,IAAI,IAAI;AACvG,QAAM,UACJ,SAAS,OAAO,UAAU,YAAY,aAAa,QAC/C,OAAQ,MAAgC,OAAO,IAC/C;AACN,QAAM,aAAa,GAAG,IAAI,IAAI,OAAO,GAAG,YAAY;AAEpD,MACE,WAAW,SAAS,QAAQ,KAC5B,WAAW,SAAS,UAAU,KAC9B,WAAW,SAAS,WAAW,KAC/B,WAAW,SAAS,eAAe,KACnC,WAAW,SAAS,gBAAgB,KACpC,WAAW,SAAS,SAAS,GAC7B;AACA,WAAO;AAAA,EACT;AAEA,MAAI,WAAW,SAAS,eAAe,GAAG;AACxC,WAAO;AAAA,EACT;AAEA,MAAI,WAAW,SAAS,iBAAiB,GAAG;AAC1C,QACE,WAAW,SAAS,YAAY,KAChC,WAAW,SAAS,QAAQ,KAC5B,WAAW,SAAS,QAAQ,KAC5B,WAAW,SAAS,OAAO,GAC3B;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;;;AD5OA,eAAsB,gBACpB,OACA,QACA,MACA,UAAsC,CAAC,GACH;AACpC,MAAI,CAAC,oBAAoB,GAAG;AAC1B,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,SAAO;AAAA,IACL;AAAA,IACA,MAAM,sBAAsB,OAAO,QAAQ,IAAI;AAAA,IAC/C,CAAC,mBAAmB,wBAAwB,OAAO,QAAQ,MAAM,cAAc;AAAA,IAC/E;AAAA,EACF;AACF;AAEA,eAAe,kBACb,QACA,UACA,SACA,UAAsC,CAAC,GAC3B;AACZ,QAAM,qBAAqB,QAAQ,sBAAsB;AACzD,QAAM,iBAAiB,qBAAqB,kBAAkB,QAAQ,sBAAsB,IAAI;AAChG,QAAM,aAAa,qBAAqB,MAAM,qBAAqB,MAAM,IAAI;AAC7E,MAAI,eAAe,SAAS;AAC1B,WAAO,QAAQ,cAAc;AAAA,EAC/B;AAEA,aAAW,cAAc;AAEzB,MAAI;AACF,WAAO,MAAM,SAAS;AAAA,EACxB,SAAS,OAAO;AACd,QAAI,sBAAsB,sBAAsB,KAAK,GAAG;AACtD,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAe,sBACb,OACA,QACA,MACoC;AACpC,QAAM,SAAS;AAEf,QAAM,cAAc,IAAI,YAAY,EAAE,OAAO,MAAM;AACnD,QAAM,eAAe,YAAY,MAAM,GAAG,EAAE;AAE5C,QAAM,YAAY,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAE3D,QAAM,gBAAoD;AAAA,IACxD;AAAA,IACA,IAAI;AAAA,MACF,IAAI;AAAA,MACJ,MAAM;AAAA,IACR;AAAA,IACA,MAAM;AAAA,MACJ,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,aAAa;AAAA,IACf;AAAA,IACA,kBAAkB;AAAA,MAChB,EAAE,MAAM,cAAc,KAAK,GAAG;AAAA,IAChC;AAAA,IACA,wBAAwB;AAAA,MACtB,yBAAyB;AAAA,MACzB,kBAAkB;AAAA,MAClB,aAAa;AAAA,MACb,oBAAoB;AAAA,IACtB;AAAA,IACA,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAEA,QAAM,aAAc,MAAM,UAAU,YAAY,OAAO;AAAA,IACrD,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AAEA,QAAM,WAAW,WAAW;AAC5B,QAAM,EAAE,GAAG,EAAE,IAAI,qBAAqB,QAAQ;AAC9C,QAAM,0BAEF,WAGA,2BAA2B;AAE/B,SAAO;AAAA,IACL,cAAc,uBAAuB,WAAW,KAAK;AAAA,IACrD,YAAY,WAAW,CAAC;AAAA,IACxB,YAAY,WAAW,CAAC;AAAA,IACxB;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,wBACb,OACA,QACA,MACA,gBACoC;AACpC,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,OAAO,QAAQ,KAAK;AAAA,IACtB;AAAA,EACF;AACA,SAAO;AACT;AAIA,SAAS,qBACP,UACkC;AAClC,MAAI,OAAO,SAAS,iBAAiB,YAAY;AAC/C,UAAM,UAAU,SAAS,aAAa;AACtC,QAAI,SAAS;AACX,aAAO,gBAAgB,IAAI,WAAW,OAAO,CAAC;AAAA,IAChD;AAAA,EACF;AAEA,MAAI,OAAO,SAAS,yBAAyB,YAAY;AACvD,UAAM,WAAW,IAAI,WAAW,SAAS,qBAAqB,CAAC;AAC/D,WAAO,6BAA6B,QAAQ;AAAA,EAC9C;AAEA,QAAM,IAAI,MAAM,kFAAkF;AACpG;AAEA,SAAS,gBAAgB,MAAoD;AAC3E,QAAM,aAAa,KAAK,SAAS;AAEjC,MAAI,KAAK,UAAU,MAAM,GAAM;AAC7B,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AAEA,QAAM,IAAI,KAAK,MAAM,aAAa,GAAG,aAAa,EAAE;AACpD,QAAM,IAAI,KAAK,MAAM,aAAa,IAAI,aAAa,EAAE;AAErD,MAAI,EAAE,WAAW,MAAM,EAAE,WAAW,IAAI;AACtC,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AAEA,SAAO,EAAE,GAAG,EAAE;AAChB;AAEA,SAAS,6BAA6B,UAAwD;AAC5F,QAAM,iBAAiB;AACvB,QAAM,cAAc;AACpB,QAAM,gBAAgB;AACtB,QAAM,SAAS,iBAAiB,cAAc;AAC9C,QAAM,eAAe;AACrB,QAAM,kBAAkB,SAAS;AACjC,QAAM,eAAgB,SAAS,eAAe,KAAK,IAAK,SAAS,kBAAkB,CAAC;AACpF,QAAM,gBAAgB,kBAAkB,IAAI;AAC5C,QAAM,UAAU,SAAS,MAAM,aAAa;AAE5C,SAAO,mBAAmB,OAAO;AACnC;AAEA,SAAS,mBAAmB,SAAuD;AACjF,QAAM,WAAW,QAAQ,CAAC;AAC1B,MAAI,aAAa,OAAQ,aAAa,KAAM;AAC1C,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAEA,MAAI,SAAS;AACb,MAAI,IAAuB;AAC3B,MAAI,IAAuB;AAE3B,SAAO,SAAS,QAAQ,QAAQ;AAC9B,UAAM,MAAM,QAAQ,QAAQ;AAC5B,UAAM,YAAY,QAAQ,QAAQ;AAElC,QAAI,QAAQ,IAAM;AAChB,YAAM,SAAS,YAAY;AAC3B,UAAI,QAAQ,MAAM,QAAQ,SAAS,MAAM;AACzC,gBAAU;AACV;AAAA,IACF;AAEA,QAAI,QAAQ,IAAM;AAChB,YAAM,SAAS,YAAY;AAC3B,UAAI,QAAQ,MAAM,QAAQ,SAAS,MAAM;AACzC,gBAAU;AACV;AAAA,IACF;AAEA,QAAI,aAAa,MAAQ,aAAa,IAAM;AAC1C,YAAM,SAAS,YAAY;AAC3B,gBAAU;AACV;AAAA,IACF;AAEA,QAAI,cAAc,KAAQ,cAAc,KAAQ,cAAc,GAAM;AAClE;AAAA,IACF;AAEA,QAAI,aAAa,MAAQ,aAAa,IAAM;AAC1C,YAAM,OAAO,KAAM,YAAY;AAC/B,gBAAU;AACV;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,KAAK,CAAC,GAAG;AACZ,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AAEA,MAAI,EAAE,WAAW,MAAM,EAAE,WAAW,IAAI;AACtC,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAEA,SAAO,EAAE,GAAG,EAAE;AAChB;;;AElPA,IAAM,gBAAgB;AAQf,SAAS,2BACd,WACA,WAAwC,CAAC,GACjC;AACR,SAAO,UAAU,KAAK,KAAK;AAC7B;;;ACHA;AAAA,EACE,0BAAAA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAkBP,eAAsB,gBACpB,cACA,WACA,MAC+B;AAC/B,MAAI,CAAC,oBAAoB,GAAG;AAC1B,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,SAAOC;AAAA,IACL;AAAA,IACA,MAAM,sBAAsB,cAAc,WAAW,IAAI;AAAA,IACzD,CAAC,mBACC,wBAAwB,cAAc,WAAW,MAAM,cAAc;AAAA,EACzE;AACF;AAKA,eAAsB,sBACpB,WACA,MACA,kBACA,aACA,SACA,UAAuC,CAAC,GACH;AACrC,MAAI,CAAC,oBAAoB,GAAG;AAC1B,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,QAAM,qBAAqB,QAAQ,sBAAsB;AACzD,QAAM,iBAAiB,qBACnB,kBAAkB,OAAO,sBAAsB,IAC/C;AACJ,QAAM,aAAa,qBACf,MAAM,qBAAqB,KAAK,IAChC;AACJ,QAAM,gBAAgB;AACtB,QAAM,cAAc,sBAAsB,WAAW;AAErD,MAAI,QAAQ,oBAAoB;AAC9B,eAAW,cAAc;AACzB,WAAO;AAAA,MACL;AAAA,MACA,eAAe,QAAQ;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AAEA,MAAI,eAAe,WAAY,eAAe,CAAC,eAAgB;AAC7D,WAAO,0BAA0B,WAAW,gBAAgB,OAAO;AAAA,EACrE;AAEA,aAAW,cAAc;AAEzB,MAAI;AACF,QAAI,eAAe;AACjB,UAAI;AACF,cAAM,SAAS,MAAM;AAAA,UACnB,cAAc;AAAA,UACd;AAAA,UACA,cAAc;AAAA,QAChB;AACA,eAAO;AAAA,UACL,GAAG;AAAA,UACH,SAAS;AAAA,QACX;AAAA,MACF,SAAS,OAAO;AACd,YAAI,CAAC,6BAA6B,KAAK,GAAG;AACxC,gBAAM;AAAA,QACR;AACA,eAAO;AAAA,UACL;AAAA,UACA,cAAc;AAAA,UACd;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,kCAAkC,WAAW,MAAM,WAAW;AAAA,EACvE,SAAS,OAAO;AACd,QAAI,eAAe,sBAAsB,KAAK,GAAG;AAC/C,aAAO,0BAA0B,WAAW,QAAW,OAAO;AAAA,IAChE;AAEA,UAAM;AAAA,EACR;AACF;AAEA,eAAe,kCACb,WACA,MACA,aACqC;AACrC,QAAM,eAAe,MAAM,4BAA4B,WAAW,IAAI;AACtE,QAAM,kBACJ,YAAY,KAAK,CAAC,MAAM,EAAE,iBAAiB,aAAa,YAAY,KACpE;AACF,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAM,UAAU,mBAAmB;AAAA,IACjC,cAAc,aAAa;AAAA,IAC3B,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,MAAM,aAAa;AAAA,IACnB,WAAW;AAAA,IACX,YAAY;AAAA,EACd;AAEA,SAAO;AAAA,IACL,WAAW,aAAa;AAAA,IACxB,mBAAmB,aAAa;AAAA,IAChC,gBAAgB,aAAa;AAAA,IAC7B,YAAY,aAAa;AAAA,IACzB,YAAY,aAAa;AAAA,IACzB,yBAAyB,aAAa;AAAA,IACtC;AAAA,EACF;AACF;AAEA,SAAS,6BAA6B,OAAyB;AAC7D,QAAM,OACJ,SAAS,OAAO,UAAU,YAAY,UAAU,QAC5C,OAAQ,MAA6B,IAAI,IACzC;AACN,QAAM,UACJ,SAAS,OAAO,UAAU,YAAY,aAAa,QAC/C,OAAQ,MAAgC,OAAO,IAC/C;AACN,QAAM,aAAa,GAAG,IAAI,IAAI,OAAO,GAAG,YAAY;AAEpD,MACE,WAAW,SAAS,eAAe,KACnC,WAAW,SAAS,eAAe,KACnC,WAAW,SAAS,gBAAgB,GACpC;AACA,WAAO;AAAA,EACT;AAEA,SACE,WAAW,SAAS,iBAAiB,KACrC,WAAW,SAAS,mBAAmB,KACvC,WAAW,SAAS,eAAe,KACnC,WAAW,SAAS,WAAW,KAC/B,WAAW,SAAS,YAAY,KAChC,WAAW,SAAS,eAAe,KACnC,WAAW,SAAS,oBAAoB;AAE5C;AAKA,eAAsB,4BACpB,WACA,MAC2C;AAC3C,MAAI,CAAC,oBAAoB,GAAG;AAC1B,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,QAAM,eAAe;AACrB,QAAM,SAAS,MAAM,yBAAyB,WAAW,YAAY;AAErE,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,mBAAmB,OAAO;AAAA,IAC1B,gBAAgB,OAAO;AAAA,IACvB,YAAY,OAAO;AAAA,IACnB,YAAY,OAAO;AAAA,IACnB,cAAc,OAAO;AAAA,IACrB,MAAM;AAAA,IACN,yBAAyB,OAAO;AAAA,EAClC;AACF;AAIA,eAAeA,mBACb,QACA,UACA,SACY;AACZ,QAAM,iBAAiB,kBAAkB,QAAQ,sBAAsB;AACvE,QAAM,aAAa,MAAM,qBAAqB,MAAM;AACpD,MAAI,eAAe,SAAS;AAC1B,WAAO,QAAQ,cAAc;AAAA,EAC/B;AAEA,aAAW,cAAc;AAEzB,MAAI;AACF,WAAO,MAAM,SAAS;AAAA,EACxB,SAAS,OAAO;AACd,QAAI,sBAAsB,KAAK,GAAG;AAChC,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAe,sBACb,cACA,WACA,MAC+B;AAC/B,QAAM,SAAS,MAAM,yBAAyB,WAAW,MAAM,YAAY;AAC3E,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,mBAAmB,OAAO;AAAA,IAC1B,gBAAgB,OAAO;AAAA,IACvB,YAAY,OAAO;AAAA,IACnB,YAAY,OAAO;AAAA,IACnB,yBAAyB,OAAO;AAAA,EAClC;AACF;AAEA,eAAe,yBACb,WACA,MACA,cAC0D;AAC1D,QAAM,iBAAiB,IAAI,WAAW,SAAS;AAC/C,QAAM,aAAgD;AAAA,IACpD,WAAW;AAAA,IACX;AAAA,IACA,kBAAkB;AAAA,IAClB,SAAS;AAAA,EACX;AAEA,MAAI,cAAc;AAChB,UAAM,qBAAqB,uBAAuB,YAAY;AAC9D,eAAW,mBAAmB;AAAA,MAC5B;AAAA,QACE,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,YAAY,CAAC,YAAY,UAAU,OAAO,OAAO,KAAK;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAa,MAAM,UAAU,YAAY,IAAI;AAAA,IACjD,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AAEA,QAAM,WAAW,UAAU;AAE3B,QAAM,YAAY,IAAI,WAAW,SAAS,SAAS;AACnD,MAAI,EAAE,GAAG,EAAE,IAAI,kBAAkB,SAAS;AAC1C,MAAI,cAAc,CAAC;AAMnB,QAAM,gBAEF,UAGA,2BAA2B;AAE/B,SAAO;AAAA,IACL,WAAW,IAAI,WAAW,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;AAAA,IACtC,mBAAmB,IAAI,WAAW,SAAS,iBAAiB;AAAA,IAC5D,gBAAgB,IAAI,WAAW,SAAS,cAAc;AAAA,IACtD,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,cAAcC,wBAAuB,UAAU,KAAK;AAAA,IACpD,yBAAyB;AAAA,EAC3B;AACF;AAEA,eAAe,wBACb,cACA,WACA,MACA,gBAC+B;AAC/B,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,MACE;AAAA,MACA,oBAAoB,iBAAiB,SAAS;AAAA,MAC9C;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAEA,SAAO,yBAAyB,MAAM;AACxC;AAEA,eAAe,0BACb,WACA,gBACA,SACqC;AACrC,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,MACE,oBAAoB,iBAAiB,SAAS;AAAA,MAC9C;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,SAAO,+BAA+B,MAAM;AAC9C;AAEA,SAAS,yBACP,QACsB;AACtB,SAAO;AAAA,IACL,WAAW,iBAAiB,OAAO,kBAAkB;AAAA,IACrD,mBAAmB,iBAAiB,OAAO,0BAA0B;AAAA,IACrE,gBAAgB,iBAAiB,OAAO,uBAAuB;AAAA,IAC/D,YAAY,iBAAiB,OAAO,mBAAmB;AAAA,IACvD,YAAY,iBAAiB,OAAO,mBAAmB;AAAA,IACvD,yBAAyB,OAAO,2BAA2B;AAAA,EAC7D;AACF;AAEA,SAAS,+BACP,QAC4B;AAC5B,SAAO;AAAA,IACL,GAAG,yBAAyB,MAAM;AAAA,IAClC,SAAS,OAAO;AAAA,IAChB,UAAU,OAAO;AAAA,EACnB;AACF;;;AC1VA;AAAA,EACE,qBAAAC;AAAA,EACA,iBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAYP;AAAA,EACE,0BAAAC;AAAA,EACA,0BAAAC;AAAA,EACA;AAAA,EACA,oBAAAC;AAAA,EACA,oBAAAC;AAAA,EACA,cAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;","names":["arrayBufferToBase64Url","runWithPromptMode","arrayBufferToBase64Url","parseDerSignature","normalizeLowS","arrayBufferToBase64Url","base64UrlToArrayBuffer","bytesToBase64Url","base64UrlToBytes","bytesToHex"]}