passkey-kit 0.12.1 → 0.14.0

package/dist/kit/wallet-ops.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Wallet signer operations: build add/update/remove signer transactions, encode
+ * the SDK-side {@link SignerKey}/{@link SignerLimits} helpers into the contract's
+ * union types, and read a signer entry back from the ledger.
+ *
+ * `getSigner` reads the flat top-level `SignerKey → SignerVal` entry directly via
+ * RPC (temporary durability before persistent, per the contract's lookup
+ * invariant). This doubles as `connectWallet`'s ownership check (#601 F7): a
+ * keyId that resolves to a live signer entry proves the wallet actually knows
+ * that passkey. When the contract's `get_signer` view lands (A3) this can move
+ * onto the view; the ledger read is equivalent and works today.
+ *
+ * @packageDocumentation
+ */
+import { type Server } from "@stellar/stellar-sdk/rpc";
+import type { AssembledTransaction, Result, Spec as ContractSpec } from "@stellar/stellar-sdk/contract";
+import { Client as PasskeyClient, type SignerKey as SDKSignerKey, type SignerLimits as SDKSignerLimits, type SignerVal } from "passkey-kit-sdk";
+import { SignerStore, type SignerKey, type SignerLimits } from "../types.js";
+/**
+ * The result of a signer-write / upgrade transaction. The reworked contract's
+ * admin functions are typed `Result<void>` (they return `Ok(())` or a typed
+ * contract error), so the AssembledTransaction is generic over that.
+ */
+export type WalletTx = AssembledTransaction<Result<void>>;
+/** Which write the builder targets. */
+type SignerFn = "add_signer" | "update_signer";
+/** Encode a SDK-side {@link SignerKey} helper into the contract's union. */
+export declare function toContractSignerKey({ key, value }: SignerKey): SDKSignerKey;
+/** Encode SDK-side {@link SignerLimits} into the contract's `SignerLimits`. */
+export declare function toContractSignerLimits(limits: SignerLimits): SDKSignerLimits;
+/** Shared deps for building signer-write transactions. */
+export interface WalletWriteDeps {
+    wallet: PasskeyClient;
+    timeoutInSeconds: number;
+}
+export declare function buildSecp256r1SignerTx(deps: WalletWriteDeps, fn: SignerFn, keyId: string | Uint8Array, publicKey: string | Uint8Array, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
+export declare function buildEd25519SignerTx(deps: WalletWriteDeps, fn: SignerFn, publicKey: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
+export declare function buildPolicySignerTx(deps: WalletWriteDeps, fn: SignerFn, policy: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
+export declare function buildRemoveSignerTx(deps: WalletWriteDeps, signerKey: SignerKey): Promise<WalletTx>;
+/** Build an `upgrade(new_wasm_hash)` transaction (renamed from update_contract_code). */
+export declare function buildUpgradeTx(deps: WalletWriteDeps, newWasmHash: Buffer | Uint8Array): Promise<WalletTx>;
+/**
+ * Read a signer entry from the ledger, or `null` if absent.
+ *
+ * Checks temporary durability before persistent (the contract's lookup order).
+ * A non-null result proves the wallet holds this signer — the basis of
+ * `connectWallet`'s ownership verification.
+ *
+ * `null` means a genuine not-found in BOTH durabilities. A transport error
+ * (RPC 429/5xx/timeout) is NOT swallowed — it propagates, so `connectWallet`
+ * never mistakes a flaky RPC for "the passkey is not a signer" and throws a
+ * misleading `WalletOwnershipError` for a valid credential.
+ */
+export declare function getSigner(deps: {
+    rpc: Server;
+    spec: ContractSpec;
+}, contractId: string, signerKey: SignerKey): Promise<SignerVal | null>;
+export {};
+//# sourceMappingURL=wallet-ops.d.ts.map

package/dist/kit/wallet-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-ops.d.ts","sourceRoot":"","sources":["../../src/kit/wallet-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EACV,oBAAoB,EACpB,MAAM,EACN,IAAI,IAAI,YAAY,EACrB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,MAAM,IAAI,aAAa,EAGvB,KAAK,SAAS,IAAI,YAAY,EAC9B,KAAK,YAAY,IAAI,eAAe,EACpC,KAAK,SAAS,EACf,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAI7E;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAO1D,uCAAuC;AACvC,KAAK,QAAQ,GAAG,YAAY,GAAG,eAAe,CAAC;AAE/C,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,SAAS,GAAG,YAAY,CAS3E;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,YAAY,GAAG,eAAe,CAa5E;AA6DD,0DAA0D;AAC1D,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,aAAa,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,MAAM,GAAG,UAAU,EAC1B,SAAS,EAAE,MAAM,GAAG,UAAU,EAC9B,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,WAAW,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,CAKnB;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,QAAQ,EACZ,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,WAAW,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,CAKnB;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,WAAW,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,CAKnB;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,QAAQ,CAAC,CAKnB;AAED,yFAAyF;AACzF,wBAAgB,cAAc,CAC5B,IAAI,EAAE,eAAe,EACrB,WAAW,EAAE,MAAM,GAAG,UAAU,GAC/B,OAAO,CAAC,QAAQ,CAAC,CAKnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,EACzC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAW3B"}

package/dist/kit/wallet-ops.js

@@ -0,0 +1,122 @@
+/**
+ * Wallet signer operations: build add/update/remove signer transactions, encode
+ * the SDK-side {@link SignerKey}/{@link SignerLimits} helpers into the contract's
+ * union types, and read a signer entry back from the ledger.
+ *
+ * `getSigner` reads the flat top-level `SignerKey → SignerVal` entry directly via
+ * RPC (temporary durability before persistent, per the contract's lookup
+ * invariant). This doubles as `connectWallet`'s ownership check (#601 F7): a
+ * keyId that resolves to a live signer entry proves the wallet actually knows
+ * that passkey. When the contract's `get_signer` view lands (A3) this can move
+ * onto the view; the ledger read is equivalent and works today.
+ *
+ * @packageDocumentation
+ */
+import { Keypair } from "@stellar/stellar-sdk";
+import { Durability } from "@stellar/stellar-sdk/rpc";
+import base64url from "../base64url.js";
+import { readContractData } from "../rpc-data.js";
+import { signerKeyToScVal, SIGNER_VAL_UDT } from "./auth-payload.js";
+/** Encode an optional expiration into the contract's `Option<u64>` timestamp. */
+function toSignerExpiration(expiration) {
+    return [expiration == null ? undefined : BigInt(expiration)];
+}
+/** Encode a SDK-side {@link SignerKey} helper into the contract's union. */
+export function toContractSignerKey({ key, value }) {
+    switch (key) {
+        case "Policy":
+            return { tag: "Policy", values: [value] };
+        case "Ed25519":
+            return { tag: "Ed25519", values: [Keypair.fromPublicKey(value).rawPublicKey()] };
+        case "Secp256r1":
+            return { tag: "Secp256r1", values: [base64url.toBuffer(value)] };
+    }
+}
+/** Encode SDK-side {@link SignerLimits} into the contract's `SignerLimits`. */
+export function toContractSignerLimits(limits) {
+    if (!limits) {
+        return [undefined];
+    }
+    const map = new Map();
+    for (const [contract, signerKeys] of limits.entries()) {
+        map.set(contract, signerKeys?.length ? signerKeys.map(toContractSignerKey) : undefined);
+    }
+    return [map];
+}
+function buildSecp256r1Signer(keyId, publicKey, limits, store, expiration) {
+    const keyIdBuffer = typeof keyId === "string" ? base64url.toBuffer(keyId) : Buffer.from(keyId);
+    const publicKeyBuffer = typeof publicKey === "string"
+        ? base64url.toBuffer(publicKey)
+        : Buffer.from(publicKey);
+    return {
+        tag: "Secp256r1",
+        values: [
+            keyIdBuffer,
+            publicKeyBuffer,
+            toSignerExpiration(expiration),
+            toContractSignerLimits(limits),
+            { tag: store, values: undefined },
+        ],
+    };
+}
+function buildEd25519Signer(publicKey, limits, store, expiration) {
+    return {
+        tag: "Ed25519",
+        values: [
+            Keypair.fromPublicKey(publicKey).rawPublicKey(),
+            toSignerExpiration(expiration),
+            toContractSignerLimits(limits),
+            { tag: store, values: undefined },
+        ],
+    };
+}
+function buildPolicySigner(policy, limits, store, expiration) {
+    return {
+        tag: "Policy",
+        values: [
+            policy,
+            toSignerExpiration(expiration),
+            toContractSignerLimits(limits),
+            { tag: store, values: undefined },
+        ],
+    };
+}
+export function buildSecp256r1SignerTx(deps, fn, keyId, publicKey, limits, store, expiration) {
+    return deps.wallet[fn]({ signer: buildSecp256r1Signer(keyId, publicKey, limits, store, expiration) }, { timeoutInSeconds: deps.timeoutInSeconds });
+}
+export function buildEd25519SignerTx(deps, fn, publicKey, limits, store, expiration) {
+    return deps.wallet[fn]({ signer: buildEd25519Signer(publicKey, limits, store, expiration) }, { timeoutInSeconds: deps.timeoutInSeconds });
+}
+export function buildPolicySignerTx(deps, fn, policy, limits, store, expiration) {
+    return deps.wallet[fn]({ signer: buildPolicySigner(policy, limits, store, expiration) }, { timeoutInSeconds: deps.timeoutInSeconds });
+}
+export function buildRemoveSignerTx(deps, signerKey) {
+    return deps.wallet.remove_signer({ signer_key: toContractSignerKey(signerKey) }, { timeoutInSeconds: deps.timeoutInSeconds });
+}
+/** Build an `upgrade(new_wasm_hash)` transaction (renamed from update_contract_code). */
+export function buildUpgradeTx(deps, newWasmHash) {
+    return deps.wallet.upgrade({ new_wasm_hash: Buffer.from(newWasmHash) }, { timeoutInSeconds: deps.timeoutInSeconds });
+}
+/**
+ * Read a signer entry from the ledger, or `null` if absent.
+ *
+ * Checks temporary durability before persistent (the contract's lookup order).
+ * A non-null result proves the wallet holds this signer — the basis of
+ * `connectWallet`'s ownership verification.
+ *
+ * `null` means a genuine not-found in BOTH durabilities. A transport error
+ * (RPC 429/5xx/timeout) is NOT swallowed — it propagates, so `connectWallet`
+ * never mistakes a flaky RPC for "the passkey is not a signer" and throws a
+ * misleading `WalletOwnershipError` for a valid credential.
+ */
+export async function getSigner(deps, contractId, signerKey) {
+    const scKey = signerKeyToScVal(deps.spec, toContractSignerKey(signerKey));
+    for (const durability of [Durability.Temporary, Durability.Persistent]) {
+        const scVal = await readContractData(deps.rpc, contractId, scKey, durability);
+        if (scVal) {
+            return deps.spec.scValToNative(scVal, SIGNER_VAL_UDT);
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=wallet-ops.js.map

package/dist/kit/wallet-ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-ops.js","sourceRoot":"","sources":["../../src/kit/wallet-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAe,MAAM,0BAA0B,CAAC;AAcnE,OAAO,SAAS,MAAM,iBAAiB,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AASrE,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,UAAmB;IAC7C,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;AAC/D,CAAC;AAKD,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAa;IAC3D,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC;QACnF,KAAK,WAAW;YACd,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IACrE,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CAAC,MAAoB;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsC,CAAC;IAC1D,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,GAAG,CAAC,GAAG,CACL,QAAQ,EACR,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAA0B,EAC1B,SAA8B,EAC9B,MAAoB,EACpB,KAAkB,EAClB,UAAmB;IAEnB,MAAM,WAAW,GACf,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,eAAe,GACnB,OAAO,SAAS,KAAK,QAAQ;QAC3B,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7B,OAAO;QACL,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE;YACN,WAAW;YACX,eAAe;YACf,kBAAkB,CAAC,UAAU,CAAC;YAC9B,sBAAsB,CAAC,MAAM,CAAC;YAC9B,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE;SAClC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,SAAiB,EACjB,MAAoB,EACpB,KAAkB,EAClB,UAAmB;IAEnB,OAAO;QACL,GAAG,EAAE,SAAS;QACd,MAAM,EAAE;YACN,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,YAAY,EAAE;YAC/C,kBAAkB,CAAC,UAAU,CAAC;YAC9B,sBAAsB,CAAC,MAAM,CAAC;YAC9B,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE;SAClC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAc,EACd,MAAoB,EACpB,KAAkB,EAClB,UAAmB;IAEnB,OAAO;QACL,GAAG,EAAE,QAAQ;QACb,MAAM,EAAE;YACN,MAAM;YACN,kBAAkB,CAAC,UAAU,CAAC;YAC9B,sBAAsB,CAAC,MAAM,CAAC;YAC9B,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE;SAClC;KACF,CAAC;AACJ,CAAC;AAQD,MAAM,UAAU,sBAAsB,CACpC,IAAqB,EACrB,EAAY,EACZ,KAA0B,EAC1B,SAA8B,EAC9B,MAAoB,EACpB,KAAkB,EAClB,UAAmB;IAEnB,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CACpB,EAAE,MAAM,EAAE,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EAC7E,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAqB,EACrB,EAAY,EACZ,SAAiB,EACjB,MAAoB,EACpB,KAAkB,EAClB,UAAmB;IAEnB,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CACpB,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EACpE,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,EAAY,EACZ,MAAc,EACd,MAAoB,EACpB,KAAkB,EAClB,UAAmB;IAEnB,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CACpB,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EAChE,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,SAAoB;IAEpB,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAC9B,EAAE,UAAU,EAAE,mBAAmB,CAAC,SAAS,CAAC,EAAE,EAC9C,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAC5C,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,cAAc,CAC5B,IAAqB,EACrB,WAAgC;IAEhC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAC3C,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAyC,EACzC,UAAkB,EAClB,SAAoB;IAEpB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;IAE1E,KAAK,MAAM,UAAU,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC9E,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,cAAc,CAAc,CAAC;QACrE,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/kit/webauthn-ops.d.ts

@@ -0,0 +1,55 @@
+/**
+ * WebAuthn ceremony operations: passkey registration and authentication.
+ *
+ * Pure functions over an injected WebAuthn implementation and RP config, so the
+ * ceremonies are unit-testable with a fake authenticator. The old kit hard-coded
+ * a static challenge (`"stellaristhebetterblockchain"`) and read `rpId` per
+ * call; here the challenge is random (see {@link generateChallenge}) and the RP
+ * config comes from the kit constructor.
+ *
+ * @packageDocumentation
+ */
+import type { AuthenticationResponseJSON, RegistrationResponseJSON, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON, AuthenticatorSelectionCriteria } from "@simplewebauthn/browser";
+/** The WebAuthn ceremony surface the kit depends on (overridable for tests). */
+export interface WebAuthnClient {
+    startRegistration(args: {
+        optionsJSON: PublicKeyCredentialCreationOptionsJSON;
+    }): Promise<RegistrationResponseJSON>;
+    startAuthentication(args: {
+        optionsJSON: PublicKeyCredentialRequestOptionsJSON;
+    }): Promise<AuthenticationResponseJSON>;
+}
+/** RP config + WebAuthn implementation for the ceremonies. */
+export interface WebAuthnDeps {
+    rpId?: string;
+    webAuthn: WebAuthnClient;
+}
+/** A freshly registered passkey. */
+export interface CreatedPasskey {
+    rawResponse: RegistrationResponseJSON;
+    /** Base64URL credential id. */
+    keyId: string;
+    /** Raw credential id bytes. */
+    keyIdBuffer: Buffer;
+    /** 65-byte uncompressed secp256r1 public key. */
+    publicKey: Uint8Array;
+}
+/**
+ * Run a WebAuthn registration ceremony and extract the passkey public key.
+ *
+ * `pubKeyCredParams` is ES256-only (the smart wallet verifies secp256r1).
+ */
+export declare function createPasskey(deps: WebAuthnDeps, appName: string, userName: string, authenticatorSelection?: AuthenticatorSelectionCriteria): Promise<CreatedPasskey>;
+/** A discoverable-credential authentication result. */
+export interface AuthenticatedPasskey {
+    keyId: string;
+    keyIdBuffer: Buffer;
+    rawResponse: AuthenticationResponseJSON;
+}
+/**
+ * Run a WebAuthn authentication ceremony against a discoverable credential (no
+ * `allowCredentials`), returning the selected credential id. Used by
+ * `connectWallet` to discover which passkey the user picked.
+ */
+export declare function authenticatePasskey(deps: WebAuthnDeps): Promise<AuthenticatedPasskey>;
+//# sourceMappingURL=webauthn-ops.d.ts.map

package/dist/kit/webauthn-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn-ops.d.ts","sourceRoot":"","sources":["../../src/kit/webauthn-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,sCAAsC,EACtC,qCAAqC,EACrC,8BAA8B,EAC/B,MAAM,yBAAyB,CAAC;AAMjC,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,iBAAiB,CAAC,IAAI,EAAE;QACtB,WAAW,EAAE,sCAAsC,CAAC;KACrD,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACtC,mBAAmB,CAAC,IAAI,EAAE;QACxB,WAAW,EAAE,qCAAqC,CAAC;KACpD,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACzC;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,wBAAwB,CAAC;IACtC,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,SAAS,EAAE,UAAU,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,sBAAsB,GAAE,8BAGvB,GACA,OAAO,CAAC,cAAc,CAAC,CAoCzB;AAED,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,0BAA0B,CAAC;CACzC;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,oBAAoB,CAAC,CAwB/B"}

package/dist/kit/webauthn-ops.js

@@ -0,0 +1,79 @@
+/**
+ * WebAuthn ceremony operations: passkey registration and authentication.
+ *
+ * Pure functions over an injected WebAuthn implementation and RP config, so the
+ * ceremonies are unit-testable with a fake authenticator. The old kit hard-coded
+ * a static challenge (`"stellaristhebetterblockchain"`) and read `rpId` per
+ * call; here the challenge is random (see {@link generateChallenge}) and the RP
+ * config comes from the kit constructor.
+ *
+ * @packageDocumentation
+ */
+import base64url from "../base64url.js";
+import { extractPublicKeyFromAttestation, generateChallenge } from "../utils.js";
+import { WEBAUTHN_TIMEOUT_MS } from "../constants.js";
+import { WebAuthnError, PasskeyKitErrorCode } from "../errors.js";
+/**
+ * Run a WebAuthn registration ceremony and extract the passkey public key.
+ *
+ * `pubKeyCredParams` is ES256-only (the smart wallet verifies secp256r1).
+ */
+export async function createPasskey(deps, appName, userName, authenticatorSelection = {
+    residentKey: "preferred",
+    userVerification: "preferred",
+}) {
+    const now = new Date();
+    const displayName = `${userName} — ${now.toLocaleString()}`;
+    const optionsJSON = {
+        challenge: generateChallenge(),
+        rp: { id: deps.rpId, name: appName },
+        user: {
+            id: generateChallenge(),
+            name: displayName,
+            displayName,
+        },
+        authenticatorSelection,
+        pubKeyCredParams: [{ alg: -7, type: "public-key" }],
+        timeout: WEBAUTHN_TIMEOUT_MS,
+    };
+    let rawResponse;
+    try {
+        rawResponse = await deps.webAuthn.startRegistration({ optionsJSON });
+    }
+    catch (err) {
+        throw new WebAuthnError("Passkey registration failed", PasskeyKitErrorCode.WEBAUTHN_REGISTRATION_FAILED, err instanceof Error ? err : undefined);
+    }
+    const publicKey = await extractPublicKeyFromAttestation(rawResponse.response);
+    return {
+        rawResponse,
+        keyId: rawResponse.id,
+        keyIdBuffer: base64url.toBuffer(rawResponse.id),
+        publicKey,
+    };
+}
+/**
+ * Run a WebAuthn authentication ceremony against a discoverable credential (no
+ * `allowCredentials`), returning the selected credential id. Used by
+ * `connectWallet` to discover which passkey the user picked.
+ */
+export async function authenticatePasskey(deps) {
+    const optionsJSON = {
+        challenge: generateChallenge(),
+        rpId: deps.rpId,
+        userVerification: "preferred",
+        timeout: WEBAUTHN_TIMEOUT_MS,
+    };
+    let rawResponse;
+    try {
+        rawResponse = await deps.webAuthn.startAuthentication({ optionsJSON });
+    }
+    catch (err) {
+        throw new WebAuthnError("Passkey authentication failed", PasskeyKitErrorCode.WEBAUTHN_AUTHENTICATION_FAILED, err instanceof Error ? err : undefined);
+    }
+    return {
+        keyId: rawResponse.id,
+        keyIdBuffer: base64url.toBuffer(rawResponse.id),
+        rawResponse,
+    };
+}
+//# sourceMappingURL=webauthn-ops.js.map

package/dist/kit/webauthn-ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn-ops.js","sourceRoot":"","sources":["../../src/kit/webauthn-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,+BAA+B,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AA6BlE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAkB,EAClB,OAAe,EACf,QAAgB,EAChB,yBAAyD;IACvD,WAAW,EAAE,WAAW;IACxB,gBAAgB,EAAE,WAAW;CAC9B;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,WAAW,GAAG,GAAG,QAAQ,MAAM,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;IAE5D,MAAM,WAAW,GAA2C;QAC1D,SAAS,EAAE,iBAAiB,EAAE;QAC9B,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;QACpC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB,EAAE;YACvB,IAAI,EAAE,WAAW;YACjB,WAAW;SACZ;QACD,sBAAsB;QACtB,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACnD,OAAO,EAAE,mBAAmB;KAC7B,CAAC;IAEF,IAAI,WAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CACrB,6BAA6B,EAC7B,mBAAmB,CAAC,4BAA4B,EAChD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CACvC,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAE9E,OAAO;QACL,WAAW;QACX,KAAK,EAAE,WAAW,CAAC,EAAE;QACrB,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,SAAS;KACV,CAAC;AACJ,CAAC;AASD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAkB;IAElB,MAAM,WAAW,GAA0C;QACzD,SAAS,EAAE,iBAAiB,EAAE;QAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,gBAAgB,EAAE,WAAW;QAC7B,OAAO,EAAE,mBAAmB;KAC7B,CAAC;IAEF,IAAI,WAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CACrB,+BAA+B,EAC/B,mBAAmB,CAAC,8BAA8B,EAClD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CACvC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,WAAW,CAAC,EAAE;QACrB,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/kit.d.ts

@@ -0,0 +1,132 @@
+/**
+ * `PasskeyKit` — the browser-side facade for creating and using smart-wallet
+ * accounts with WebAuthn passkeys.
+ *
+ * This is a ground-up rewrite of the old monolithic `kit.ts`. The signing
+ * pipeline, WebAuthn ceremonies, deploy path, and signer writes now live in
+ * dependency-injected managers ({@link CredentialManager}, {@link SignerManager},
+ * {@link SubmissionManager}) wired here with late-bound closures. All Protocol-27
+ * probe shims, dead commented experiments, and the legacy factory-address
+ * fallback are gone — the kit targets stellar-sdk >= 16 and the current wallet.
+ *
+ * @packageDocumentation
+ */
+import { xdr } from "@stellar/stellar-sdk";
+import { Server } from "@stellar/stellar-sdk/rpc";
+import { type AuthenticatorSelectionCriteria } from "@simplewebauthn/browser";
+import type { AssembledTransaction } from "@stellar/stellar-sdk/contract";
+import { Client as PasskeyClient } from "passkey-kit-sdk";
+import { SignerKey, SignerStore, type ConnectWalletResult, type CreateWalletResult, type SignerLimits, type StorageAdapter } from "./types.js";
+import { PasskeyEventEmitter } from "./events.js";
+import { type Signer } from "./signers.js";
+import type { WebAuthnClient } from "./kit/webauthn-ops.js";
+import type { CreatedPasskey } from "./kit/webauthn-ops.js";
+import type { SignOptions } from "./kit/tx-ops.js";
+import type { WalletTx } from "./kit/wallet-ops.js";
+/** Configuration for a {@link PasskeyKit} client. */
+export interface PasskeyKitConfig {
+    /** Stellar RPC URL. */
+    rpcUrl: string;
+    /** Network passphrase. */
+    networkPassphrase: string;
+    /** Smart-wallet WASM hash (hex) used to deploy new wallets. */
+    walletWasmHash: string;
+    /** WebAuthn Relying Party id (domain); defaults to the current origin. */
+    rpId?: string;
+    /**
+     * Secret key (`S…`) for the fee-paying deployer. Defaults to the canonical
+     * deterministic deployer (see {@link resolveDeployer}); overriding it changes
+     * derived wallet addresses.
+     */
+    deploySource?: string;
+    /** Transaction timeout, in seconds (default 30). */
+    timeoutInSeconds?: number;
+    /** Optional passkey-record storage adapter (see `passkey-kit/storage`). */
+    storage?: StorageAdapter;
+    /** Custom WebAuthn implementation (for testing). */
+    WebAuthn?: WebAuthnClient;
+}
+/** Options for {@link PasskeyKit.createKey}/{@link PasskeyKit.createWallet}. */
+export interface CreateOptions {
+    authenticatorSelection?: AuthenticatorSelectionCriteria;
+}
+/** Options for {@link PasskeyKit.connectWallet}. */
+export interface ConnectOptions {
+    /** A specific keyId to connect (skips the discovery ceremony). */
+    keyId?: string | Uint8Array;
+    /** Indexer-backed keyId → contract lookup, used when derivation misses. */
+    getContractId?: (keyId: string) => Promise<string | undefined>;
+    /**
+     * Also assert the wallet's on-chain WASM hash equals `walletWasmHash`.
+     * Off by default: an upgraded wallet legitimately runs a different hash.
+     */
+    verifyWasmHash?: boolean;
+}
+export declare class PasskeyKit {
+    readonly rpc: Server;
+    readonly rpcUrl: string;
+    readonly networkPassphrase: string;
+    readonly walletWasmHash: string;
+    readonly rpId?: string;
+    /** Lifecycle event emitter (walletCreated, walletConnected, …). */
+    readonly events: PasskeyEventEmitter;
+    private readonly timeoutInSeconds;
+    private readonly webAuthn;
+    private readonly credentialManager;
+    private readonly signerManager;
+    private readonly submissionManager;
+    /** The connected passkey's base64url keyId, if any. */
+    keyId: string | undefined;
+    /** The connected wallet client, if any. */
+    wallet: PasskeyClient | undefined;
+    constructor(config: PasskeyKitConfig);
+    /** The connected wallet's contract id, if any. */
+    get contractId(): string | undefined;
+    /** The fee-paying deployer's `G…` public key. */
+    get deployerPublicKey(): string;
+    private signerContext;
+    /** Run a passkey registration ceremony without deploying a wallet. */
+    createKey(appName: string, userName: string, options?: CreateOptions): Promise<CreatedPasskey>;
+    /**
+     * Register a passkey and deploy a smart wallet initialized with it as the
+     * first signer. Returns the signed deploy transaction (submit it via
+     * `PasskeyServer`).
+     */
+    createWallet(appName: string, userName: string, options?: CreateOptions): Promise<CreateWalletResult>;
+    /**
+     * Connect an existing wallet from a passkey.
+     *
+     * Resolves the wallet address by (1) deterministic derivation from the keyId,
+     * (2) local storage, then (3) an injected indexer lookup — and then VERIFIES
+     * ownership: the keyId must resolve to a live signer on the wallet (#601 F7).
+     * This closes the unverified reverse-lookup hole (#598 F3) at the SDK layer.
+     *
+     * @throws {WalletOwnershipError} If the keyId is not a signer on the wallet.
+     */
+    connectWallet(options?: ConnectOptions): Promise<ConnectWalletResult>;
+    private assertWalletWasmHash;
+    /** Disconnect the current wallet. */
+    disconnect(): void;
+    /** Sign a single auth entry (defaults to the connected passkey signer). */
+    signAuthEntry(entry: xdr.SorobanAuthorizationEntry, signer?: Signer, options?: SignOptions): Promise<xdr.SorobanAuthorizationEntry>;
+    /** Sign an assembled transaction's wallet auth entries. */
+    sign<T>(txn: AssembledTransaction<T>, signer?: Signer, options?: SignOptions): Promise<AssembledTransaction<T>>;
+    addSecp256r1(keyId: string | Uint8Array, publicKey: string | Uint8Array, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
+    /**
+     * Update a passkey signer's limits/storage/expiration. The public key is
+     * re-read from the ledger — never caller- or indexer-supplied.
+     */
+    updateSecp256r1(keyId: string | Uint8Array, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
+    addEd25519(publicKey: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
+    updateEd25519(publicKey: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
+    addPolicy(policy: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
+    updatePolicy(policy: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
+    remove(signerKey: SignerKey): Promise<WalletTx>;
+    /** Build an `upgrade(new_wasm_hash)` transaction for the connected wallet. */
+    upgrade(newWasmHash: Buffer | Uint8Array): Promise<WalletTx>;
+    /** Read a signer entry from the ledger (temporary before persistent). */
+    getSigner(signerKey: SignerKey): Promise<import("passkey-kit-sdk").SignerVal | null>;
+    /** Require a connected wallet, or throw. */
+    requireWallet(): PasskeyClient;
+}
+//# sourceMappingURL=kit.d.ts.map

package/dist/kit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kit.d.ts","sourceRoot":"","sources":["../src/kit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAIL,KAAK,8BAA8B,EACpC,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EACL,SAAS,EACT,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AAQpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAiB,KAAK,MAAM,EAAsB,MAAM,cAAc,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AASnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,0BAA0B;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,cAAc,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;CACzD;AAED,oDAAoD;AACpD,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAC5B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/D;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,qBAAa,UAAU;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,sBAA6B;IAE5C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAE1C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoB;IACtD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoB;IAEtD,uDAAuD;IACvD,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,2CAA2C;IAC3C,MAAM,EAAE,aAAa,GAAG,SAAS,CAAC;gBAEtB,MAAM,EAAE,gBAAgB;IA0DpC,kDAAkD;IAClD,IAAI,UAAU,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED,iDAAiD;IACjD,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED,OAAO,CAAC,aAAa;IAMrB,sEAAsE;IACtE,SAAS,CACP,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,cAAc,CAAC;IAQ1B;;;;OAIG;IACG,YAAY,CAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,kBAAkB,CAAC;IAoC9B;;;;;;;;;OASG;IACG,aAAa,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,mBAAmB,CAAC;YAsF7D,oBAAoB;IAyBlC,qCAAqC;IACrC,UAAU,IAAI,IAAI;IAWlB,2EAA2E;IAC3E,aAAa,CACX,KAAK,EAAE,GAAG,CAAC,yBAAyB,EACpC,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAIzC,2DAA2D;IAC3D,IAAI,CAAC,CAAC,EACJ,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC,EAC5B,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAMnC,YAAY,CACV,KAAK,EAAE,MAAM,GAAG,UAAU,EAC1B,SAAS,EAAE,MAAM,GAAG,UAAU,EAC9B,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,WAAW,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC;IAGpB;;;OAGG;IACH,eAAe,CACb,KAAK,EAAE,MAAM,GAAG,UAAU,EAC1B,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,WAAW,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC;IAGpB,UAAU,CACR,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,WAAW,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC;IAGpB,aAAa,CACX,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,WAAW,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC;IAGpB,SAAS,CACP,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,WAAW,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC;IAGpB,YAAY,CACV,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,WAAW,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC;IAGpB,MAAM,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAI/C,8EAA8E;IAC9E,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC;IAI5D,yEAAyE;IACzE,SAAS,CAAC,SAAS,EAAE,SAAS;IAI9B,4CAA4C;IAC5C,aAAa,IAAI,aAAa;CAM/B"}