tenzro-wallet 0.1.0

package/dist/identity/provisioning-http-adapter.d.ts

@@ -0,0 +1,81 @@
+/**
+ * ProvisioningHttpAdapter — fetch-based driver against a Tenzro RPC node's
+ * `/wallet/new/*` endpoints. Implements `ProvisioningPort`; mirrors
+ * `PairingHttpAdapter` and `ShareEnvelopeHttpAdapter` for shape.
+ *
+ * Wire shape per DESIGN.md §4.3.2:
+ *
+ *   POST /wallet/new/start
+ *     body  = { kind }
+ *     reply = { session_id, challenge_b64, user_handle_b64,
+ *               user_display_name }
+ *
+ *   POST /wallet/new/finalize
+ *     body  = { session_id,
+ *               enrolment: { credential_id, attestation_object,
+ *                            client_data_json } }
+ *     reply = { identity, threshold: { k, n },
+ *               wrapped_share: { credential_id, wrapped_share_b64,
+ *                                alg, salt_b64 } }
+ *
+ *   POST /wallet/new/confirm  → 204
+ *   POST /wallet/new/cancel   → 204 (idempotent)
+ *
+ * Bytes on the wire are standard base64 (RFC 4648 §4) — same convention
+ * the FROST + Canton + ShareEnvelope adapters use. The `_b64` suffix is
+ * load-bearing.
+ *
+ * The `/wallet/new/*` endpoints are pre-auth: provisioning runs before
+ * the user has any session, and the new device's consent is asserted by
+ * the WebAuthn attestation embedded in `finalize`. So no `Authorization`
+ * header is threaded through. The optional `headers` callback exists for
+ * hosts that still want to attach `X-Trace-Id` or rate-limit tokens.
+ *
+ * Browser-clean: `fetch` only.
+ */
+import type { TdipIdentity, TdipKind } from '../types/identity.js';
+import type { PasskeyEnrolment, ProvisioningPort, WalletThresholdRecord, WrappedDeviceShare } from './wallet-new.js';
+export interface ProvisioningHttpConfig {
+    /** Base URL of the Tenzro RPC node, e.g. `https://rpc.tenzro.network`. */
+    readonly baseUrl: string;
+    /** Optional `fetch` override for tests. */
+    readonly fetch?: typeof fetch;
+    /**
+     * Per-request headers. Optional — the routes are pre-auth, but a host
+     * may still want to attach `X-Trace-Id` or similar.
+     */
+    readonly headers?: () => Promise<Record<string, string>> | Record<string, string>;
+}
+export declare class ProvisioningHttpError extends Error {
+    readonly status: number;
+    readonly url: string;
+    readonly body: string;
+    constructor(status: number, url: string, body: string);
+}
+export declare class ProvisioningHttpAdapter implements ProvisioningPort {
+    #private;
+    constructor(cfg: ProvisioningHttpConfig);
+    start(req: {
+        readonly kind: TdipKind;
+    }): Promise<{
+        readonly sessionId: string;
+        readonly challenge: Uint8Array;
+        readonly userHandle: Uint8Array;
+        readonly userDisplayName: string;
+    }>;
+    finalize(req: {
+        readonly sessionId: string;
+        readonly enrolment: PasskeyEnrolment;
+    }): Promise<{
+        readonly identity: TdipIdentity;
+        readonly threshold: WalletThresholdRecord;
+        readonly wrappedShare: WrappedDeviceShare;
+    }>;
+    confirm(req: {
+        readonly sessionId: string;
+    }): Promise<void>;
+    cancel(req: {
+        readonly sessionId: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=provisioning-http-adapter.d.ts.map

package/dist/identity/provisioning-http-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning-http-adapter.d.ts","sourceRoot":"","sources":["../../src/identity/provisioning-http-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,sBAAsB;IACrC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnF;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAFZ,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM;CASxB;AAsBD,qBAAa,uBAAwB,YAAW,gBAAgB;;gBAGlD,GAAG,EAAE,sBAAsB;IAIjC,KAAK,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC;QACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;QAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;QAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;KAClC,CAAC;IAUI,QAAQ,CAAC,GAAG,EAAE;QAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;KACtC,GAAG,OAAO,CAAC;QACV,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;QAC1C,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;KAC3C,CAAC;IAqBI,OAAO,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3D,MAAM,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAsBjE"}

package/dist/identity/provisioning-http-adapter.js

@@ -0,0 +1,114 @@
+/**
+ * ProvisioningHttpAdapter — fetch-based driver against a Tenzro RPC node's
+ * `/wallet/new/*` endpoints. Implements `ProvisioningPort`; mirrors
+ * `PairingHttpAdapter` and `ShareEnvelopeHttpAdapter` for shape.
+ *
+ * Wire shape per DESIGN.md §4.3.2:
+ *
+ *   POST /wallet/new/start
+ *     body  = { kind }
+ *     reply = { session_id, challenge_b64, user_handle_b64,
+ *               user_display_name }
+ *
+ *   POST /wallet/new/finalize
+ *     body  = { session_id,
+ *               enrolment: { credential_id, attestation_object,
+ *                            client_data_json } }
+ *     reply = { identity, threshold: { k, n },
+ *               wrapped_share: { credential_id, wrapped_share_b64,
+ *                                alg, salt_b64 } }
+ *
+ *   POST /wallet/new/confirm  → 204
+ *   POST /wallet/new/cancel   → 204 (idempotent)
+ *
+ * Bytes on the wire are standard base64 (RFC 4648 §4) — same convention
+ * the FROST + Canton + ShareEnvelope adapters use. The `_b64` suffix is
+ * load-bearing.
+ *
+ * The `/wallet/new/*` endpoints are pre-auth: provisioning runs before
+ * the user has any session, and the new device's consent is asserted by
+ * the WebAuthn attestation embedded in `finalize`. So no `Authorization`
+ * header is threaded through. The optional `headers` callback exists for
+ * hosts that still want to attach `X-Trace-Id` or rate-limit tokens.
+ *
+ * Browser-clean: `fetch` only.
+ */
+export class ProvisioningHttpError extends Error {
+    status;
+    url;
+    body;
+    constructor(status, url, body) {
+        super(`provisioning http ${status} on ${url}: ${body.length > 200 ? body.slice(0, 200) + '…' : body}`);
+        this.status = status;
+        this.url = url;
+        this.body = body;
+        this.name = 'ProvisioningHttpError';
+    }
+}
+export class ProvisioningHttpAdapter {
+    #cfg;
+    constructor(cfg) {
+        this.#cfg = cfg;
+    }
+    async start(req) {
+        const raw = await this.#post('/wallet/new/start', { kind: req.kind });
+        return {
+            sessionId: raw.session_id,
+            challenge: b64ToBytes(raw.challenge_b64),
+            userHandle: b64ToBytes(raw.user_handle_b64),
+            userDisplayName: raw.user_display_name,
+        };
+    }
+    async finalize(req) {
+        const raw = await this.#post('/wallet/new/finalize', {
+            session_id: req.sessionId,
+            enrolment: {
+                credential_id: req.enrolment.credentialId,
+                attestation_object: req.enrolment.attestationObject,
+                client_data_json: req.enrolment.clientDataJson,
+            },
+        });
+        return {
+            identity: raw.identity,
+            threshold: raw.threshold,
+            wrappedShare: {
+                credentialId: raw.wrapped_share.credential_id,
+                wrappedShare: b64ToBytes(raw.wrapped_share.wrapped_share_b64),
+                alg: raw.wrapped_share.alg,
+                salt: b64ToBytes(raw.wrapped_share.salt_b64),
+            },
+        };
+    }
+    async confirm(req) {
+        await this.#post('/wallet/new/confirm', { session_id: req.sessionId });
+    }
+    async cancel(req) {
+        await this.#post('/wallet/new/cancel', { session_id: req.sessionId });
+    }
+    // --- internals ---
+    async #post(path, body) {
+        const f = this.#cfg.fetch ?? globalThis.fetch;
+        const url = this.#cfg.baseUrl.replace(/\/+$/, '') + path;
+        const extra = (await this.#cfg.headers?.()) ?? {};
+        const res = await f(url, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', ...extra },
+            body: JSON.stringify(body),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => '');
+            throw new ProvisioningHttpError(res.status, url, text);
+        }
+        if (res.status === 204)
+            return undefined;
+        return (await res.json());
+    }
+}
+function b64ToBytes(b64) {
+    const bin = atob(b64);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+//# sourceMappingURL=provisioning-http-adapter.js.map

package/dist/identity/provisioning-http-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning-http-adapter.js","sourceRoot":"","sources":["../../src/identity/provisioning-http-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAsBH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAEnC;IACA;IACA;IAHX,YACW,MAAc,EACd,GAAW,EACX,IAAY;QAErB,KAAK,CACH,qBAAqB,MAAM,OAAO,GAAG,KACnC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IACjD,EAAE,CACH,CAAC;QARO,WAAM,GAAN,MAAM,CAAQ;QACd,QAAG,GAAH,GAAG,CAAQ;QACX,SAAI,GAAJ,IAAI,CAAQ;QAOrB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAsBD,MAAM,OAAO,uBAAuB;IACzB,IAAI,CAAyB;IAEtC,YAAY,GAA2B;QACrC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAgC;QAM1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAW,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC;YACxC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC;YAC3C,eAAe,EAAE,GAAG,CAAC,iBAAiB;SACvC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAGd;QAKC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAc,sBAAsB,EAAE;YAChE,UAAU,EAAE,GAAG,CAAC,SAAS;YACzB,SAAS,EAAE;gBACT,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,YAAY;gBACzC,kBAAkB,EAAE,GAAG,CAAC,SAAS,CAAC,iBAAiB;gBACnD,gBAAgB,EAAE,GAAG,CAAC,SAAS,CAAC,cAAc;aAC/C;SACF,CAAC,CAAC;QACH,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,YAAY,EAAE;gBACZ,YAAY,EAAE,GAAG,CAAC,aAAa,CAAC,aAAa;gBAC7C,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,iBAAiB,CAAC;gBAC7D,GAAG,EAAE,GAAG,CAAC,aAAa,CAAC,GAAG;gBAC1B,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC;aAC7C;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAmC;QAC/C,MAAM,IAAI,CAAC,KAAK,CAAU,qBAAqB,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAmC;QAC9C,MAAM,IAAI,CAAC,KAAK,CAAU,oBAAoB,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,oBAAoB;IAEpB,KAAK,CAAC,KAAK,CAAO,IAAY,EAAE,IAAa;QAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;QACzD,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,KAAK,EAAE;YACzD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAiB,CAAC;QACjD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAS,CAAC;IACpC,CAAC;CACF;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/identity/recovery-http-adapter.d.ts

@@ -0,0 +1,83 @@
+/**
+ * RecoveryHttpAdapter — fetch-based driver against a Tenzro RPC node's
+ * `/wallet/recover/*` endpoints. Implements `RecoveryPort`; mirrors
+ * `ProvisioningHttpAdapter` for shape.
+ *
+ * Wire shape per DESIGN.md §4.3.5:
+ *
+ *   POST /wallet/recover/start
+ *     body  = { did, proof, force_rotate? }
+ *       proof discriminator: { kind: 'email-otp', otp }
+ *                          | { kind: 'social',
+ *                              delegate_signatures: [{
+ *                                delegate_did, signature_b64
+ *                              }] }
+ *                          | { kind: 'tenzro-id-kyc', proof_token }
+ *     reply = { session_id, challenge_b64, user_handle_b64,
+ *               user_display_name }
+ *
+ *   POST /wallet/recover/finalize
+ *     body  = { session_id,
+ *               enrolment: { credential_id, attestation_object,
+ *                            client_data_json } }
+ *     reply = { identity, threshold: { k, n },
+ *               wrapped_share: { credential_id, wrapped_share_b64,
+ *                                alg, salt_b64 } }
+ *
+ *   POST /wallet/recover/confirm  → 204
+ *   POST /wallet/recover/cancel   → 204 (idempotent)
+ *
+ * Pre-auth: the recovery proof in `start` and the WebAuthn attestation
+ * in `finalize` are what the node verifies. No `Authorization` header.
+ *
+ * Browser-clean: `fetch` only.
+ */
+import type { TdipDid, TdipIdentity } from '../types/identity.js';
+import type { PasskeyEnrolment, WalletThresholdRecord, WrappedDeviceShare } from './wallet-new.js';
+import type { RecoveryPort, RecoveryProof } from './wallet-recover.js';
+export interface RecoveryHttpConfig {
+    /** Base URL of the Tenzro RPC node, e.g. `https://rpc.tenzro.network`. */
+    readonly baseUrl: string;
+    /** Optional `fetch` override for tests. */
+    readonly fetch?: typeof fetch;
+    /**
+     * Per-request headers. Optional — pre-auth routes; included for
+     * `X-Trace-Id` or rate-limit tokens.
+     */
+    readonly headers?: () => Promise<Record<string, string>> | Record<string, string>;
+}
+export declare class RecoveryHttpError extends Error {
+    readonly status: number;
+    readonly url: string;
+    readonly body: string;
+    constructor(status: number, url: string, body: string);
+}
+export declare class RecoveryHttpAdapter implements RecoveryPort {
+    #private;
+    constructor(cfg: RecoveryHttpConfig);
+    start(req: {
+        readonly did: TdipDid;
+        readonly proof: RecoveryProof;
+        readonly forceRotate?: boolean;
+    }): Promise<{
+        readonly sessionId: string;
+        readonly challenge: Uint8Array;
+        readonly userHandle: Uint8Array;
+        readonly userDisplayName: string;
+    }>;
+    finalize(req: {
+        readonly sessionId: string;
+        readonly enrolment: PasskeyEnrolment;
+    }): Promise<{
+        readonly identity: TdipIdentity;
+        readonly threshold: WalletThresholdRecord;
+        readonly wrappedShare: WrappedDeviceShare;
+    }>;
+    confirm(req: {
+        readonly sessionId: string;
+    }): Promise<void>;
+    cancel(req: {
+        readonly sessionId: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=recovery-http-adapter.d.ts.map

package/dist/identity/recovery-http-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-http-adapter.d.ts","sourceRoot":"","sources":["../../src/identity/recovery-http-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACnG,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEvE,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnF;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAExC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAFZ,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM;CAOxB;AAsBD,qBAAa,mBAAoB,YAAW,YAAY;;gBAG1C,GAAG,EAAE,kBAAkB;IAI7B,KAAK,CAAC,GAAG,EAAE;QACf,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;QAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;KAChC,GAAG,OAAO,CAAC;QACV,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;QAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;QAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;KAClC,CAAC;IAcI,QAAQ,CAAC,GAAG,EAAE;QAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;KACtC,GAAG,OAAO,CAAC;QACV,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;QAC1C,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;KAC3C,CAAC;IAqBI,OAAO,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3D,MAAM,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAsBjE"}

package/dist/identity/recovery-http-adapter.js

@@ -0,0 +1,139 @@
+/**
+ * RecoveryHttpAdapter — fetch-based driver against a Tenzro RPC node's
+ * `/wallet/recover/*` endpoints. Implements `RecoveryPort`; mirrors
+ * `ProvisioningHttpAdapter` for shape.
+ *
+ * Wire shape per DESIGN.md §4.3.5:
+ *
+ *   POST /wallet/recover/start
+ *     body  = { did, proof, force_rotate? }
+ *       proof discriminator: { kind: 'email-otp', otp }
+ *                          | { kind: 'social',
+ *                              delegate_signatures: [{
+ *                                delegate_did, signature_b64
+ *                              }] }
+ *                          | { kind: 'tenzro-id-kyc', proof_token }
+ *     reply = { session_id, challenge_b64, user_handle_b64,
+ *               user_display_name }
+ *
+ *   POST /wallet/recover/finalize
+ *     body  = { session_id,
+ *               enrolment: { credential_id, attestation_object,
+ *                            client_data_json } }
+ *     reply = { identity, threshold: { k, n },
+ *               wrapped_share: { credential_id, wrapped_share_b64,
+ *                                alg, salt_b64 } }
+ *
+ *   POST /wallet/recover/confirm  → 204
+ *   POST /wallet/recover/cancel   → 204 (idempotent)
+ *
+ * Pre-auth: the recovery proof in `start` and the WebAuthn attestation
+ * in `finalize` are what the node verifies. No `Authorization` header.
+ *
+ * Browser-clean: `fetch` only.
+ */
+export class RecoveryHttpError extends Error {
+    status;
+    url;
+    body;
+    constructor(status, url, body) {
+        super(`recovery http ${status} on ${url}: ${body.length > 200 ? body.slice(0, 200) + '…' : body}`);
+        this.status = status;
+        this.url = url;
+        this.body = body;
+        this.name = 'RecoveryHttpError';
+    }
+}
+export class RecoveryHttpAdapter {
+    #cfg;
+    constructor(cfg) {
+        this.#cfg = cfg;
+    }
+    async start(req) {
+        const raw = await this.#post('/wallet/recover/start', {
+            did: req.did,
+            proof: encodeProof(req.proof),
+            ...(req.forceRotate !== undefined ? { force_rotate: req.forceRotate } : {}),
+        });
+        return {
+            sessionId: raw.session_id,
+            challenge: b64ToBytes(raw.challenge_b64),
+            userHandle: b64ToBytes(raw.user_handle_b64),
+            userDisplayName: raw.user_display_name,
+        };
+    }
+    async finalize(req) {
+        const raw = await this.#post('/wallet/recover/finalize', {
+            session_id: req.sessionId,
+            enrolment: {
+                credential_id: req.enrolment.credentialId,
+                attestation_object: req.enrolment.attestationObject,
+                client_data_json: req.enrolment.clientDataJson,
+            },
+        });
+        return {
+            identity: raw.identity,
+            threshold: raw.threshold,
+            wrappedShare: {
+                credentialId: raw.wrapped_share.credential_id,
+                wrappedShare: b64ToBytes(raw.wrapped_share.wrapped_share_b64),
+                alg: raw.wrapped_share.alg,
+                salt: b64ToBytes(raw.wrapped_share.salt_b64),
+            },
+        };
+    }
+    async confirm(req) {
+        await this.#post('/wallet/recover/confirm', { session_id: req.sessionId });
+    }
+    async cancel(req) {
+        await this.#post('/wallet/recover/cancel', { session_id: req.sessionId });
+    }
+    // --- internals ---
+    async #post(path, body) {
+        const f = this.#cfg.fetch ?? globalThis.fetch;
+        const url = this.#cfg.baseUrl.replace(/\/+$/, '') + path;
+        const extra = (await this.#cfg.headers?.()) ?? {};
+        const res = await f(url, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', ...extra },
+            body: JSON.stringify(body),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => '');
+            throw new RecoveryHttpError(res.status, url, text);
+        }
+        if (res.status === 204)
+            return undefined;
+        return (await res.json());
+    }
+}
+function encodeProof(proof) {
+    switch (proof.kind) {
+        case 'email-otp':
+            return { kind: 'email-otp', otp: proof.otp };
+        case 'social':
+            return {
+                kind: 'social',
+                delegate_signatures: proof.delegateSignatures.map((d) => ({
+                    delegate_did: d.delegateDid,
+                    signature_b64: bytesToB64(d.signature),
+                })),
+            };
+        case 'tenzro-id-kyc':
+            return { kind: 'tenzro-id-kyc', proof_token: proof.proofToken };
+    }
+}
+function b64ToBytes(b64) {
+    const bin = atob(b64);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+function bytesToB64(bytes) {
+    let bin = '';
+    for (let i = 0; i < bytes.length; i++)
+        bin += String.fromCharCode(bytes[i]);
+    return btoa(bin);
+}
+//# sourceMappingURL=recovery-http-adapter.js.map

package/dist/identity/recovery-http-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-http-adapter.js","sourceRoot":"","sources":["../../src/identity/recovery-http-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAkBH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAE/B;IACA;IACA;IAHX,YACW,MAAc,EACd,GAAW,EACX,IAAY;QAErB,KAAK,CACH,iBAAiB,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAC5F,CAAC;QANO,WAAM,GAAN,MAAM,CAAQ;QACd,QAAG,GAAH,GAAG,CAAQ;QACX,SAAI,GAAJ,IAAI,CAAQ;QAKrB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAsBD,MAAM,OAAO,mBAAmB;IACrB,IAAI,CAAqB;IAElC,YAAY,GAAuB;QACjC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAIX;QAMC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAW,uBAAuB,EAAE;YAC9D,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC;YAC7B,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5E,CAAC,CAAC;QACH,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC;YACxC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC;YAC3C,eAAe,EAAE,GAAG,CAAC,iBAAiB;SACvC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAGd;QAKC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAc,0BAA0B,EAAE;YACpE,UAAU,EAAE,GAAG,CAAC,SAAS;YACzB,SAAS,EAAE;gBACT,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,YAAY;gBACzC,kBAAkB,EAAE,GAAG,CAAC,SAAS,CAAC,iBAAiB;gBACnD,gBAAgB,EAAE,GAAG,CAAC,SAAS,CAAC,cAAc;aAC/C;SACF,CAAC,CAAC;QACH,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,YAAY,EAAE;gBACZ,YAAY,EAAE,GAAG,CAAC,aAAa,CAAC,aAAa;gBAC7C,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,iBAAiB,CAAC;gBAC7D,GAAG,EAAE,GAAG,CAAC,aAAa,CAAC,GAAG;gBAC1B,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC;aAC7C;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAmC;QAC/C,MAAM,IAAI,CAAC,KAAK,CAAU,yBAAyB,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAmC;QAC9C,MAAM,IAAI,CAAC,KAAK,CAAU,wBAAwB,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,oBAAoB;IAEpB,KAAK,CAAC,KAAK,CAAO,IAAY,EAAE,IAAa;QAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;QACzD,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,KAAK,EAAE;YACzD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAiB,CAAC;QACjD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAS,CAAC;IACpC,CAAC;CACF;AAED,SAAS,WAAW,CAAC,KAAoB;IACvC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QAC/C,KAAK,QAAQ;YACX,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,mBAAmB,EAAE,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxD,YAAY,EAAE,CAAC,CAAC,WAAW;oBAC3B,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;iBACvC,CAAC,CAAC;aACJ,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;IACpE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC"}

package/dist/identity/wallet-new.d.ts

@@ -0,0 +1,132 @@
+/**
+ * `walletNew()` — passkey-quorum provisioning flow per DESIGN.md §4.3.2.
+ *
+ * Replaces M1's deterministic `provisionIdentity()` (which mocks shares
+ * locally) with the M5 network-governed ceremony. The kernel orchestrates;
+ * Tenzro's `/wallet/new/*` endpoints + the host's WebAuthn glue do the
+ * heavy lifting.
+ *
+ * Steps mapped to DESIGN.md §4.3.2:
+ *
+ *   1. Host opens an onboarding page; the kernel is invoked from that page.
+ *   2. Host runs `navigator.credentials.create` via `PasskeyEnroller`,
+ *      yielding a fresh passkey credential bound to the Tenzro relying-party.
+ *   3. Kernel calls `ProvisioningPort.start({credentialId, attestation, kind})`.
+ *      The node-TEE runs DKG, returns the new DID + per-surface public keys
+ *      + the wrapped device share + AEAD metadata.
+ *   4. Kernel hands the wrapped share to `ShareStore.put(...)` so the host
+ *      can persist it under the platform's secure storage (IndexedDB, OS
+ *      keychain, largeBlob, …). The unwrap key never enters JS memory.
+ *   5. Kernel calls `ProvisioningPort.confirm({did, sessionId})` so the
+ *      node-TEE finalises the topology record (DID Document, threshold,
+ *      verificationMethods).
+ *   6. Kernel returns the resulting `TdipIdentity` and the credential id
+ *      bound to the device share, so subsequent signing flows can pass
+ *      it into `PasskeyShareUnwrapper`.
+ *
+ * Errors abort cleanly: if `confirm` fails, the kernel calls
+ * `ProvisioningPort.cancel(sessionId)` so the node drops the half-built
+ * record and the wrapped share, and re-throws the original error. The
+ * host is responsible for surfacing the failure to the user.
+ *
+ * Browser-clean: no Node-specific globals.
+ */
+import type { TdipIdentity, TdipKind } from '../types/identity.js';
+export type WalletThresholdRecord = {
+    readonly k: number;
+    readonly n: number;
+};
+/**
+ * Wrapped device-share envelope handed back by the node at provisioning.
+ * Bytes are decoded already (the HTTP layer does base64 ↔ Uint8Array).
+ *
+ * `alg`/`salt` are surfaced so the same share envelope can later flow
+ * through `ShareEnvelopePort.fetchEnvelope()` on subsequent unwraps —
+ * the node treats provisioning as a "first envelope" and re-uses the
+ * same wrapping at sign time.
+ */
+export interface WrappedDeviceShare {
+    readonly credentialId: string;
+    readonly wrappedShare: Uint8Array;
+    readonly alg: string;
+    readonly salt: Uint8Array;
+}
+export interface PasskeyEnrolment {
+    readonly credentialId: string;
+    /** WebAuthn attestation object, base64url. Forwarded verbatim to node. */
+    readonly attestationObject: string;
+    /** WebAuthn clientDataJSON, base64url. */
+    readonly clientDataJson: string;
+}
+/**
+ * Browser passkey *create* (not *get*). Wraps `navigator.credentials.create`
+ * with the wallet's relying-party id and a node-issued challenge.
+ */
+export interface PasskeyEnroller {
+    enroll(opts: {
+        readonly challenge: Uint8Array;
+        readonly userId: Uint8Array;
+        readonly userDisplayName: string;
+    }): Promise<PasskeyEnrolment>;
+}
+/**
+ * Server transport for `/wallet/new/*`. Tenzro implements; kernel consumes.
+ *
+ *   POST /wallet/new/start    → { session_id, challenge_b64,
+ *                                 user_handle_b64 }
+ *   POST /wallet/new/finalize → { did, identity, threshold,
+ *                                 wrapped_share }   // see WrappedDeviceShare
+ *   POST /wallet/new/confirm  → 204                  // identity persisted
+ *   POST /wallet/new/cancel   → 204                  // idempotent abort
+ */
+export interface ProvisioningPort {
+    start(req: {
+        readonly kind: TdipKind;
+    }): Promise<{
+        readonly sessionId: string;
+        readonly challenge: Uint8Array;
+        readonly userHandle: Uint8Array;
+        readonly userDisplayName: string;
+    }>;
+    finalize(req: {
+        readonly sessionId: string;
+        readonly enrolment: PasskeyEnrolment;
+    }): Promise<{
+        readonly identity: TdipIdentity;
+        readonly threshold: WalletThresholdRecord;
+        readonly wrappedShare: WrappedDeviceShare;
+    }>;
+    confirm(req: {
+        readonly sessionId: string;
+    }): Promise<void>;
+    cancel(req: {
+        readonly sessionId: string;
+    }): Promise<void>;
+}
+/**
+ * Where the host persists the wrapped device share. The kernel never
+ * reads from this directly at sign time — that's `ShareEnvelopePort`'s
+ * job — but the host needs a hook to put the freshly-wrapped share into
+ * its persistence layer at provision time, in case the node doesn't
+ * also keep an envelope copy (deployment configurable).
+ */
+export interface DeviceShareStore {
+    put(req: {
+        readonly did: string;
+        readonly share: WrappedDeviceShare;
+    }): Promise<void>;
+}
+export interface WalletNewOptions {
+    readonly kind?: TdipKind;
+    readonly enroller: PasskeyEnroller;
+    readonly provisioning: ProvisioningPort;
+    /** Optional: persist locally too, in addition to whatever the node keeps. */
+    readonly shareStore?: DeviceShareStore;
+}
+export interface WalletNewResult {
+    readonly identity: TdipIdentity;
+    readonly threshold: WalletThresholdRecord;
+    readonly credentialId: string;
+}
+export declare function walletNew(opts: WalletNewOptions): Promise<WalletNewResult>;
+//# sourceMappingURL=wallet-new.d.ts.map

package/dist/identity/wallet-new.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-new.d.ts","sourceRoot":"","sources":["../../src/identity/wallet-new.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEnE,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,0EAA0E;IAC1E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,IAAI,EAAE;QACX,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;QAC/B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;QAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;KAClC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC;QAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;QAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;QAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;KACtC,GAAG,OAAO,CAAC;QACV,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;QAC1C,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;KAC3C,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,GAAG,EAAE;QACP,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;KACpC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;CACxC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAoDhF"}