{"version":3,"sources":["../src/auth/index.ts","../src/auth/wallet.ts","../src/auth/oracle.ts","../src/auth/secret-encryption.ts"],"names":[],"mappings":";;;AAAA,IAAA,YAAA,GAAA;AAAA,QAAA,CAAA,YAAA,EAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,gBAAA,EAAA,MAAA,gBAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,UAAA,EAAA,MAAA,UAAA;AAAA,EAAA,eAAA,EAAA,MAAA,eAAA;AAAA,EAAA,mBAAA,EAAA,MAAA,mBAAA;AAAA,EAAA,sBAAA,EAAA,MAAA,sBAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,iBAAA,EAAA,MAAA,iBAAA;AAAA,EAAA,gBAAA,EAAA,MAAA,gBAAA;AAAA,EAAA,gBAAA,EAAA,MAAA,gBAAA;AAAA,EAAA,sBAAA,EAAA,MAAA,sBAAA;AAAA,EAAA,iBAAA,EAAA,MAAA,iBAAA;AAAA,EAAA,sBAAA,EAAA,MAAA;AAAA,CAAA,CAAA;;;ACUA,IAAM,iBAAA,GAAoB,EAAA;AAC1B,IAAM,qBAAA,GAAwB,KAAA;AAG9B,IAAM,wBAAA,GAA2B,4CAAA;AAGjC,IAAM,eAAA,GAAkB,4BAAA;AAoDjB,IAAM,aAAN,MAAiB;AAAA,EACd,QAAA,GAAmC,IAAA;AAAA,EACnC,KAAA,GAAqB;AAAA,IAC3B,SAAA,EAAW,KAAA;AAAA,IACX,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS,IAAA;AAAA,IACT,UAAA,EAAY;AAAA,GACd;AAAA,EACQ,cAAA;AAAA,EAER,WAAA,CAAY,iBAAyB,eAAA,EAAiB;AACpD,IAAA,IAAA,CAAK,cAAA,GAAiB,cAAA;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAQ,QAAA,EAAkD;AAE9D,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA,IAAY,IAAA,CAAK,iBAAA,EAAkB;AAEnD,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAGA,IAAA,MAAM,QAAA,GAAY,MAAM,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ;AAAA,MAC5C,MAAA,EAAQ;AAAA,KACT,CAAA;AAED,IAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AACtC,MAAA,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,OAAA,GAAU,QAAA,CAAS,CAAC,CAAA,CAAE,WAAA,EAAY;AAGxC,IAAA,MAAM,UAAA,GAAc,MAAM,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ;AAAA,MAC9C,MAAA,EAAQ;AAAA,KACT,CAAA;AACD,IAAA,MAAM,OAAA,GAAU,QAAA,CAAS,UAAA,EAAY,EAAE,CAAA;AAEvC,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,SAAA,EAAW,IAAA;AAAA,MACX,OAAA;AAAA,MACA,OAAA;AAAA,MACA,YAAY,OAAA,KAAY;AAAA,KAC1B;AAGA,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,CAAM,UAAA,EAAY;AAC1B,MAAA,MAAM,KAAK,gBAAA,EAAiB;AAAA,IAC9B;AAGA,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,eAAA,CAAgB,OAAO,CAAA;AAGlD,IAAA,IAAA,CAAK,mBAAA,EAAoB;AAEzB,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,UAAA,GAAmB;AACjB,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,SAAA,EAAW,KAAA;AAAA,MACX,OAAA,EAAS,IAAA;AAAA,MACT,OAAA,EAAS,IAAA;AAAA,MACT,UAAA,EAAY;AAAA,KACd;AACA,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA,EAKA,QAAA,GAAwB;AACtB,IAAA,OAAO,EAAE,GAAG,IAAA,CAAK,KAAA,EAAM;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA,EAKA,WAAA,GAAuB;AACrB,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,SAAA,IAAa,IAAA,CAAK,KAAA,CAAM,UAAA;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA,EAKA,UAAA,GAA4B;AAC1B,IAAA,OAAO,KAAK,KAAA,CAAM,OAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,gBAAA,GAAkC;AAC9C,IAAA,IAAI,CAAC,IAAA,CAAK,QAAA,EAAU,MAAM,IAAI,MAAM,aAAa,CAAA;AAEjD,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,SAAS,OAAA,CAAQ;AAAA,QAC1B,MAAA,EAAQ,4BAAA;AAAA,QACR,MAAA,EAAQ,CAAC,EAAE,OAAA,EAAS,uBAAuB;AAAA,OAC5C,CAAA;AAAA,IACH,SAAS,WAAA,EAAsB;AAE7B,MAAA,IAAK,WAAA,EAAmC,SAAS,IAAA,EAAM;AACrD,QAAA,MAAM,IAAA,CAAK,SAAS,OAAA,CAAQ;AAAA,UAC1B,MAAA,EAAQ,yBAAA;AAAA,UACR,MAAA,EAAQ;AAAA,YACN;AAAA,cACE,OAAA,EAAS,qBAAA;AAAA,cACT,SAAA,EAAW,UAAA;AAAA,cACX,cAAA,EAAgB;AAAA,gBACd,IAAA,EAAM,OAAA;AAAA,gBACN,MAAA,EAAQ,KAAA;AAAA,gBACR,QAAA,EAAU;AAAA,eACZ;AAAA,cACA,OAAA,EAAS,CAAC,6BAA6B,CAAA;AAAA,cACvC,iBAAA,EAAmB,CAAC,iCAAiC;AAAA;AACvD;AACF,SACD,CAAA;AAAA,MACH,CAAA,MAAO;AACL,QAAA,MAAM,WAAA;AAAA,MACR;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,MAAM,OAAA,GAAU,iBAAA;AACrB,IAAA,IAAA,CAAK,MAAM,UAAA,GAAa,IAAA;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,gBAAgB,OAAA,EAAuC;AAEnE,IAAA,MAAM,oBAAoB,MAAM,KAAA;AAAA,MAC9B,CAAA,EAAG,KAAK,cAAc,CAAA,eAAA,CAAA;AAAA,MACtB;AAAA,QACE,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,QAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,SAAS;AAAA;AAClC,KACF;AAEA,IAAA,IAAI,CAAC,kBAAkB,EAAA,EAAI;AACzB,MAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,IACvD;AAEA,IAAA,MAAM,EAAE,SAAA,EAAW,SAAA,EAAU,GAC1B,MAAM,kBAAkB,IAAA,EAAK;AAGhC,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,GAAO,SAAA,EAAW;AACjC,MAAA,MAAM,IAAI,MAAM,mBAAmB,CAAA;AAAA,IACrC;AAGA,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,WAAA,CAAY,SAAS,CAAA;AAGlD,IAAA,MAAM,iBAAiB,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,cAAc,CAAA,YAAA,CAAA,EAAgB;AAAA,MACvE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,OAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACD;AAAA,KACF,CAAA;AAED,IAAA,IAAI,CAAC,eAAe,EAAA,EAAI;AACtB,MAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,CAAe,IAAA,EAAK;AACxC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,KAAK,CAAA,CAAE,CAAA;AAAA,IACvD;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,cAAA,CAAe,IAAA,EAAK;AAE1C,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,MAAA,MAAM,IAAI,KAAA,CAAM,MAAA,CAAO,KAAA,IAAS,2BAA2B,CAAA;AAAA,IAC7D;AAEA,IAAA,OAAO,MAAA,CAAO,OAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,YAAY,OAAA,EAAkC;AAC1D,IAAA,IAAI,CAAC,IAAA,CAAK,QAAA,IAAY,CAAC,IAAA,CAAK,MAAM,OAAA,EAAS;AACzC,MAAA,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAAA,IACxC;AAEA,IAAA,MAAM,SAAA,GAAa,MAAM,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ;AAAA,MAC7C,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,CAAC,OAAA,EAAS,IAAA,CAAK,MAAM,OAAO;AAAA,KACrC,CAAA;AAED,IAAA,OAAO,SAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,iBAAA,GAA4C;AAClD,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,WAAY,MAAA,CACf,QAAA;AACH,IAAA,OAAO,QAAA,IAAY,IAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKQ,mBAAA,GAA4B;AAClC,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAEpB,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA,CAAG,iBAAA,EAAmB,CAAC,QAAA,KAAsB;AACzD,MAAA,MAAM,KAAA,GAAQ,QAAA;AACd,MAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,QAAA,IAAA,CAAK,UAAA,EAAW;AAAA,MAClB,CAAA,MAAO;AACL,QAAA,IAAA,CAAK,KAAA,CAAM,OAAA,GAAU,KAAA,CAAM,CAAC,EAAE,WAAA,EAAY;AAAA,MAC5C;AAAA,IACF,CAAC,CAAA;AAED,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA,CAAG,cAAA,EAAgB,CAAC,OAAA,KAAqB;AACrD,MAAA,MAAM,EAAA,GAAK,QAAA,CAAS,OAAA,EAAmB,EAAE,CAAA;AACzC,MAAA,IAAA,CAAK,MAAM,OAAA,GAAU,EAAA;AACrB,MAAA,IAAA,CAAK,KAAA,CAAM,aAAa,EAAA,KAAO,iBAAA;AAAA,IACjC,CAAC,CAAA;AAED,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA,CAAG,YAAA,EAAc,MAAM;AACnC,MAAA,IAAA,CAAK,UAAA,EAAW;AAAA,IAClB,CAAC,CAAA;AAAA,EACH;AACF;AAMA,eAAsB,eAAA,CACpB,UACA,OAAA,EAC4B;AAE5B,EAAA,MAAM,iBAAA,GAAoB,YAAA;AAC1B,EAAA,MAAM,gBAAgB,OAAA,CAAQ,KAAA,CAAM,CAAC,CAAA,CAAE,QAAA,CAAS,IAAI,GAAG,CAAA;AAEvD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,OAAA,CAAQ;AAAA,MACrC,MAAA,EAAQ,UAAA;AAAA,MACR,MAAA,EAAQ;AAAA,QACN;AAAA,UACE,EAAA,EAAI,wBAAA;AAAA,UACJ,MAAM,iBAAA,GAAoB;AAAA,SAC5B;AAAA,QACA;AAAA;AACF,KACD,CAAA;AAED,IAAA,MAAM,OAAA,GAAU,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA;AACnC,IAAA,IAAI,YAAY,CAAA,EAAG;AACjB,MAAA,OAAO,IAAA;AAAA,IACT;AAGA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,GAAA;AAAA,MACT,IAAA,EAAM,KAAA;AAAA,MACN,MAAA,EAAQ,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA,GAAI,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAAA;AAAA,MACvD,YAAA,EAAc,CAAC,WAAA,EAAa,aAAA,EAAe,WAAW;AAAA,KACxD;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAKO,SAAS,iBAAiB,cAAA,EAAqC;AACpE,EAAA,OAAO,IAAI,WAAW,cAAc,CAAA;AACtC;;;ACtPO,IAAM,eAAN,MAA6C;AAAA,EAC1C,MAAA;AAAA,EAER,YAAY,MAAA,EAAsB;AAChC,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACZ,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,OAAA,EAAS,OAAO,OAAA,IAAW,GAAA;AAAA,MAC3B,UAAA,EAAY,OAAO,UAAA,IAAc;AAAA,KACnC;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,OAAA,EAA6C;AAC9D,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,KAAA,CAAM,iBAAA,EAAmB;AAAA,MACnD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,SAAS;AAAA,KACjC,CAAA;AAED,IAAA,OAAO,QAAA;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,OAAA,EAAiD;AAC5D,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,KAAA,CAAM,cAAA,EAAgB;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,KAC7B,CAAA;AAED,IAAA,OAAO,QAAA;AAAA,EACT;AAAA,EAEA,MAAM,QAAQ,SAAA,EAA4C;AACxD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,KAAA,CAAM,eAAA,EAAiB;AAAA,MACjD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,WAAW;AAAA,KACnC,CAAA;AAED,IAAA,OAAO,QAAA;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,SAAA,EAAkC;AAC7C,IAAA,MAAM,IAAA,CAAK,MAAM,cAAA,EAAgB;AAAA,MAC/B,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,WAAW;AAAA,KACnC,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,gBAAA,CACJ,SAAA,EACA,SAAA,EACwB;AACxB,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,KAAA,CAAM,iBAAA,EAAmB;AAAA,MACnD,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,SAAA,EAAW,WAAW;AAAA,KAC9C,CAAA;AAED,IAAA,OAAO,QAAA;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,OAAA,EAA8C;AAC/D,IAAA,IAAI;AACF,MAAA,MAAM,WAAW,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,SAAA,EAAY,OAAO,CAAA,CAAA,EAAI;AAAA,QACvD,MAAA,EAAQ;AAAA,OACT,CAAA;AAED,MAAA,OAAO,QAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,KAAA,CAAM,IAAA,EAAc,OAAA,EAAwC;AACxE,IAAA,MAAM,MAAM,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,QAAQ,GAAG,IAAI,CAAA,CAAA;AAE1C,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,SAAA,GAAY,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,CAAK,OAAO,OAAO,CAAA;AAE1E,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,QAChC,GAAG,OAAA;AAAA,QACH,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,GAAG,OAAA,CAAQ;AAAA,SACb;AAAA,QACA,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAED,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,KAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,SAAS,MAAM,CAAA,GAAA,EAAM,KAAK,CAAA,CAAE,CAAA;AAAA,MACxE;AAEA,MAAA,OAAO,SAAS,IAAA,EAAK;AAAA,IACvB,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,SAAS,CAAA;AAAA,IACxB;AAAA,EACF;AACF;AAKO,IAAM,mBAAN,MAAiD;AAAA,EAC9C,QAAA,uBAAyC,GAAA,EAAI;AAAA,EAC7C,UAAA,uBAAiD,GAAA,EAAI;AAAA,EAE7D,MAAM,aAAa,OAAA,EAA6C;AAC9D,IAAA,MAAM,SAAA,GAA+B;AAAA,MACnC,SAAA,EAAW,CAAA;;AAAA,SAAA,EAAgE,OAAO;AAAA,WAAA,EAAgB,IAAA,CAAK,KAAK;AAAA,OAAA,EAAY,IAAA,CAAK,QAAO,CACjI,QAAA,CAAS,EAAE,CAAA,CACX,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA;AAAA,MACX,WAAW,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAA,GAAI,GAAA;AAAA;AAAA,MAC3C,KAAA,EAAO,KAAK,MAAA,EAAO,CAAE,SAAS,EAAE,CAAA,CAAE,MAAM,CAAC;AAAA,KAC3C;AAEA,IAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,OAAA,EAAS,SAAS,CAAA;AACtC,IAAA,OAAO,SAAA;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,OAAA,EAAiD;AAC5D,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,OAAO,CAAA;AAE3D,IAAA,IAAI,CAAC,eAAA,IAAmB,eAAA,CAAgB,SAAA,KAAc,QAAQ,SAAA,EAAW;AACvE,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AAAA,IACpD;AAEA,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,GAAO,gBAAgB,SAAA,EAAW;AACjD,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AAAA,IACpD;AAGA,IAAA,IAAI,CAAC,OAAA,CAAQ,SAAA,CAAU,UAAA,CAAW,IAAI,CAAA,EAAG;AACvC,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,0BAAA,EAA2B;AAAA,IAC3D;AAEA,IAAA,MAAM,SAAA,GAAY,CAAA,QAAA,EAAW,IAAA,CAAK,MAAA,EAAO,CAAE,SAAS,EAAE,CAAA,CAAE,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA;AAChE,IAAA,MAAM,OAAA,GAAuB;AAAA,MAC3B,KAAA,EAAO,CAAA,IAAA,EAAO,IAAA,CAAK,MAAA,EAAO,CAAE,SAAS,EAAE,CAAA,CAAE,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA;AAAA,MACjD,UAAU,OAAA,CAAQ,OAAA;AAAA,MAClB,YAAA,EAAc,CAAC,WAAA,EAAa,aAAA,EAAe,WAAW;AAAA,KACxD;AAEA,IAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,SAAA,EAAW,OAAO,CAAA;AACpC,IAAA,IAAA,CAAK,UAAA,CAAW,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA;AAEtC,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,IAAA;AAAA,MACP,KAAK,OAAA,CAAQ,KAAA;AAAA,MACb,OAAA;AAAA,MACA,WAAA,EAAa;AAAA,QACX,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM,CAAA;AAAA;AAAA,QACN,MAAA,EAAQ,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA,GAAI,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAAA,QACvD,cAAc,OAAA,CAAQ,YAAA;AAAA,QACtB,YAAA,EAAc;AAAA;AAChB,KACF;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,SAAA,EAA4C;AACxD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,SAAS,CAAA;AAE3C,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AAAA,IACpD;AAEA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,IAAA;AAAA,MACP,KAAK,OAAA,CAAQ,KAAA;AAAA,MACb;AAAA,KACF;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,SAAA,EAAkC;AAC7C,IAAA,IAAA,CAAK,QAAA,CAAS,OAAO,SAAS,CAAA;AAAA,EAChC;AAAA,EAEA,MAAM,gBAAA,CACJ,SAAA,EACA,SAAA,EACwB;AACxB,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,SAAS,CAAA;AAE3C,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,MAAM,mBAAmB,CAAA;AAAA,IACrC;AAEA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,CAAA,OAAA,EAAU,IAAA,CAAK,MAAA,EAAO,CAAE,SAAS,EAAE,CAAA,CAAE,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA;AAAA,MACpD,WAAW,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAA,GAAI,GAAA;AAAA;AAAA,MAC3C,gBAAA,EAAkB,SAAA;AAAA,MAClB,SAAA,EAAW;AAAA;AAAA,KACb;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,OAAA,EAA8C;AAE/D,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,GAAA;AAAA,MACT,IAAA,EAAM,CAAA;AAAA,MACN,MAAA,EAAQ,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA,GAAI,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAAA,MACvD,YAAA,EAAc,CAAC,WAAA,EAAa,aAAA,EAAe,WAAW,CAAA;AAAA,MACtD,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AACF;AAKO,SAAS,mBAAmB,MAAA,EAAsC;AACvE,EAAA,OAAO,IAAI,aAAa,MAAM,CAAA;AAChC;AAKO,SAAS,sBAAA,GAAyC;AACvD,EAAA,OAAO,IAAI,gBAAA,EAAiB;AAC9B;;;ACjQA,IAAM,eAAA,GAAkB,6BAAA;AAGxB,IAAM,sBAAA,GAAyB,CAAA,GAAI,EAAA,GAAK,EAAA,GAAK,EAAA;AAG7C,IAAI,eAAA,GAA2C,IAAA;AAC/C,IAAI,cAAA,GAAiB,CAAA;AAKrB,SAAS,gBAAgB,IAAA,EAAmC;AAC1D,EAAA,MAAM,KAAA,GACJ,OAAO,IAAA,KAAS,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,GAAI,IAAA;AAC9D,EAAA,MAAM,SAAS,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa,GAAG,KAAK,CAAC,CAAA;AACjD,EAAA,OAAO,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAA;AACxE;AAKA,SAAS,gBAAgB,GAAA,EAAyB;AAChD,EAAA,IAAI,MAAA,GAAS,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACrD,EAAA,OAAO,MAAA,CAAO,SAAS,CAAA,EAAG;AACxB,IAAA,MAAA,IAAU,GAAA;AAAA,EACZ;AACA,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,OAAO,UAAA,CAAW,KAAK,MAAA,EAAQ,CAAC,MAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAC,CAAA;AACvD;AAWA,eAAsB,kBACpB,eAAA,GAAkB,eAAA,EAClB,QAAA,GAAW,EAAA,GAAK,KAAK,GAAA,EACM;AAE3B,EAAA,IAAI,eAAA,IAAmB,IAAA,CAAK,GAAA,EAAI,GAAI,cAAA,EAAgB;AAClD,IAAA,OAAO,eAAA;AAAA,EACT;AAEA,EAAA,MAAM,WAAW,MAAM,KAAA;AAAA,IACrB,GAAG,eAAe,CAAA,gCAAA;AAAA,GACpB;AAEA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,QAAA,CAAS,MAAM,CAAA,CAAE,CAAA;AAAA,EACtE;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAQlC,EAAA,IAAI,KAAK,SAAA,EAAW,GAAA,KAAQ,QAAQ,IAAA,CAAK,SAAA,EAAW,QAAQ,OAAA,EAAS;AACnE,IAAA,MAAM,IAAI,MAAM,mDAAmD,CAAA;AAAA,EACrE;AAEA,EAAA,eAAA,GAAkB;AAAA,IAChB,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,WAAW,IAAA,CAAK,SAAA;AAAA,IAChB,WAAW,IAAA,CAAK,SAAA;AAAA,IAChB,QAAA,EAAU;AAAA,GACZ;AAGA,EAAA,cAAA,GAAiB,KAAK,GAAA,CAAI,IAAA,CAAK,KAAI,GAAI,QAAA,EAAU,KAAK,SAAS,CAAA;AAE/D,EAAA,OAAO,eAAA;AACT;AAKO,SAAS,mBAAA,GAA4B;AAC1C,EAAA,eAAA,GAAkB,IAAA;AAClB,EAAA,cAAA,GAAiB,CAAA;AACnB;AAmBA,eAAsB,gBAAA,CACpB,MAAA,EACA,QAAA,EACA,OAAA,GAAmC,EAAC,EACN;AAE9B,EAAA,MAAM,MAAA,GACJ,OAAA,CAAQ,YAAA,IACP,MAAM,iBAAA;AAAA,IACL,OAAA,CAAQ,eAAA;AAAA,IACR,OAAA,CAAQ;AAAA,GACV;AAGF,EAAA,IAAI,MAAA,CAAO,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,EAAG;AACjC,IAAA,mBAAA,EAAoB;AACpB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IACpC,KAAA;AAAA,IACA,MAAA,CAAO,SAAA;AAAA,IACP,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ;AAAA,IACpC,KAAA;AAAA,IACA;AAAC,GACH;AAGA,EAAA,MAAM,gBAAA,GAAmB,MAAM,MAAA,CAAO,MAAA,CAAO,WAAA;AAAA,IAC3C,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ;AAAA,IACpC,IAAA;AAAA;AAAA,IACA,CAAC,YAAY;AAAA,GACf;AAGA,EAAA,MAAM,YAAA,GAAe,MAAM,MAAA,CAAO,MAAA,CAAO,UAAA;AAAA,IACvC,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,SAAA,EAAU;AAAA,IAClC,gBAAA,CAAiB,UAAA;AAAA,IACjB;AAAA,GACF;AAGA,EAAA,MAAM,eAAA,GAAkB,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC1C,KAAA;AAAA,IACA,YAAA;AAAA,IACA,MAAA;AAAA,IACA,KAAA;AAAA,IACA,CAAC,cAAc,WAAW;AAAA,GAC5B;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IACjC;AAAA,MACE,IAAA,EAAM,MAAA;AAAA,MACN,IAAA,EAAM,SAAA;AAAA,MACN,IAAA,EAAM,IAAI,WAAA,EAAY,CAAE,OAAO,oBAAoB,CAAA;AAAA,MACnD,MAAM,IAAI,WAAA,GAAc,MAAA,CAAO,CAAA,SAAA,EAAY,QAAQ,CAAA,CAAE;AAAA,KACvD;AAAA,IACA,eAAA;AAAA,IACA,EAAE,IAAA,EAAM,SAAA,EAAW,MAAA,EAAQ,GAAA,EAAI;AAAA,IAC/B,KAAA;AAAA,IACA,CAAC,SAAS;AAAA,GACZ;AAGA,EAAA,MAAM,KAAK,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AACpD,EAAA,MAAM,SAAA,GAAY,IAAI,WAAA,EAAY,CAAE,OAAO,MAAM,CAAA;AAEjD,EAAA,MAAM,UAAA,GAAa,MAAM,MAAA,CAAO,MAAA,CAAO,OAAA;AAAA,IACrC,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAI,WAAW,GAAA,EAAI;AAAA,IACtC,MAAA;AAAA,IACA;AAAA,GACF;AAGA,EAAA,MAAM,kBAAA,GAAqB,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC7C,KAAA;AAAA,IACA,gBAAA,CAAiB;AAAA,GACnB;AAIA,EAAA,MAAM,SAAA,GAAY,IAAI,UAAA,CAAW,UAAU,CAAA;AAC3C,EAAA,MAAM,EAAA,GAAK,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AACjC,EAAA,MAAM,GAAA,GAAM,SAAA,CAAU,KAAA,CAAM,GAAG,CAAA;AAG/B,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,YAAA;AAAA,IACL,GAAA,EAAK,eAAA,CAAgB,IAAA,CAAK,SAAA,CAAU,kBAAkB,CAAC,CAAA;AAAA,IACvD,EAAA,EAAI,gBAAgB,EAAE,CAAA;AAAA,IACtB,EAAA,EAAI,gBAAgB,EAAE,CAAA;AAAA,IACtB,GAAA,EAAK,gBAAgB,GAAG,CAAA;AAAA,IACxB,UAAU,MAAA,CAAO,KAAA;AAAA,IACjB,QAAA;AAAA,IACA,KAAA,EAAO,OAAO,UAAA,EAAW;AAAA,IACzB,WAAA,EAAa,KAAK,GAAA;AAAI,GACxB;AACF;AA8BA,eAAsB,kBACpB,MAAA,EACA,MAAA,EACA,QAAA,EACA,OAAA,GAA8B,EAAC,EACd;AAEjB,EAAA,MAAM,oBAAoB,IAAA,CAAK,GAAA;AAAA,IAC7B,QAAQ,iBAAA,IAAqB,IAAA;AAAA,IAC7B;AAAA,GACF;AAGA,EAAA,MAAM,eAAA,GAAkB,MAAM,gBAAA,CAAiB,MAAA,EAAQ,QAAA,EAAU;AAAA,IAC/D,iBAAiB,OAAA,CAAQ,eAAA;AAAA,IACzB,cAAc,OAAA,CAAQ,YAAA;AAAA,IACtB,mBAAmB,OAAA,CAAQ;AAAA,GAC5B,CAAA;AAGD,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,GAAA,EAAK,MAAA;AAAA,IACL,GAAA,EAAK,eAAA;AAAA,IACL,GAAA,EAAK;AAAA,MACH;AAAA,QACE,GAAA,EAAK,cAAA;AAAA,QACL,IAAA,EAAM,CAAA,SAAA,EAAY,QAAQ,CAAA,MAAA,EAAS,MAAM,CAAA,CAAA;AAAA,QACzC,WAAA,EAAa;AAAA,UACX,GAAI,QAAQ,sBAAA,IAA0B;AAAA,YACpC,wBAAwB,OAAA,CAAQ;AAAA,WAClC;AAAA,UACA,GAAI,QAAQ,kBAAA,IAAsB;AAAA,YAChC,oBAAoB,OAAA,CAAQ;AAAA,WAC9B;AAAA,UACA,GAAI,OAAA,CAAQ,aAAA,EAAe,MAAA,IAAU;AAAA,YACnC,eAAe,OAAA,CAAQ;AAAA;AACzB;AACF;AACF,KACF;AAAA,IACA,KAAK,GAAA,GAAM,iBAAA;AAAA,IACX,GAAA,EAAK,GAAA;AAAA,IACL,KAAA,EAAO,OAAO,UAAA,EAAW;AAAA,IACzB,KAAA,EAAO,CAAC,eAAqD;AAAA,GAC/D;AAGA,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,GAAA,EAAK,OAAA;AAAA,IACL,GAAA,EAAK;AAAA,GACP;AAGA,EAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AACxD,EAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAI1D,EAAA,MAAM,aAAA,GAAgB,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA;AAIhD,EAAA,MAAM,SAAA,GAAY,MAAM,WAAA,CAAY,aAAA,EAAe,MAAM,CAAA;AAEzD,EAAA,OAAO,CAAA,EAAG,aAAa,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA;AACtC;AAaA,eAAe,WAAA,CAAY,SAAiB,MAAA,EAAiC;AAK3E,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAIhC,EAAA,MAAM,WAAA,GAAc,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IACtC,KAAA;AAAA,IACA,OAAA,CAAQ,MAAA,CAAO,CAAA,iBAAA,EAAoB,MAAM,CAAA,CAAE,CAAA;AAAA,IAC3C,MAAA;AAAA,IACA,KAAA;AAAA,IACA,CAAC,cAAc,WAAW;AAAA,GAC5B;AAEA,EAAA,MAAM,UAAA,GAAa,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IACrC;AAAA,MACE,IAAA,EAAM,MAAA;AAAA,MACN,IAAA,EAAM,SAAA;AAAA,MACN,IAAA,EAAM,OAAA,CAAQ,MAAA,CAAO,0BAA0B,CAAA;AAAA,MAC/C,IAAA,EAAM,OAAA,CAAQ,MAAA,CAAO,MAAM;AAAA,KAC7B;AAAA,IACA,WAAA;AAAA,IACA,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AAGA,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA;AAAA,IACpC,MAAA;AAAA,IACA,UAAA;AAAA,IACA,OAAA,CAAQ,OAAO,OAAO;AAAA,GACxB;AAEA,EAAA,OAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,SAAS,CAAC,CAAA;AAClD;AASO,SAAS,sBAAA,CACd,IAAA,EACA,QAAA,GAAW,CAAA,GAAI,KAAK,GAAA,EACX;AACT,EAAA,IAAI,IAAA,CAAK,GAAA,KAAQ,YAAA,EAAc,OAAO,KAAA;AACtC,EAAA,IAAI,CAAC,IAAA,CAAK,GAAA,IAAO,CAAC,IAAA,CAAK,EAAA,IAAM,CAAC,IAAA,CAAK,EAAA,IAAM,CAAC,IAAA,CAAK,GAAA,EAAK,OAAO,KAAA;AAC3D,EAAA,IAAI,CAAC,KAAK,QAAA,IAAY,CAAC,KAAK,QAAA,IAAY,CAAC,IAAA,CAAK,KAAA,EAAO,OAAO,KAAA;AAG5D,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,WAAA;AAC9B,EAAA,IAAI,GAAA,GAAM,CAAA,IAAK,GAAA,GAAM,QAAA,EAAU,OAAO,KAAA;AAEtC,EAAA,OAAO,IAAA;AACT;AAQO,SAAS,uBACd,WAAA,EAC4B;AAC5B,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,KAAA,CAAM,GAAG,CAAA;AACnC,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAE/B,IAAA,MAAM,UAAA,GAAa,MAAM,CAAC,CAAA;AAC1B,IAAA,MAAM,UAAU,IAAA,CAAK,KAAA;AAAA,MACnB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,eAAA,CAAgB,UAAU,CAAC;AAAA,KACtD;AAEA,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,OAAO,EAAC;AAC/C,IAAA,MAAM,aAAa,KAAA,CAAM,IAAA;AAAA,MACvB,CAAC,CAAA,KACC,CAAA,CAAE,QAAQ,YAAA,IAAgB,CAAA,CAAE,MAAM,CAAA,CAAE;AAAA,KACxC;AAEA,IAAA,OAAO,UAAA,IAAc,IAAA;AAAA,EACvB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;;;AH9ZO,IAAM,eAAN,MAA0C;AAAA,EACvC,OAAA,GAA8B,IAAA;AAAA,EAEtC,MAAM,UAAA,GAA0C;AAC9C,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,EACd;AAAA,EAEA,MAAM,MAAM,KAAA,EAA8B;AACxC,IAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,eAAA,CAAgB,KAAK,CAAA;AAErD,IAAA,IAAI,CAAC,aAAa,KAAA,EAAO;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,YAAA,CAAa,KAAK,CAAA,CAAE,CAAA;AAAA,IAChE;AAEA,IAAA,IAAA,CAAK,OAAA,GAAU;AAAA,MACb,KAAA;AAAA,MACA,QAAA,EAAU,aAAa,MAAA,IAAU,SAAA;AAAA,MACjC,YAAA,EAAc,YAAA,CAAa,YAAA,IAAgB;AAAC,KAC9C;AAAA,EACF;AAAA,EAEA,MAAM,MAAA,GAAwB;AAC5B,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,gBAAgB,KAAA,EAK3B;AACD,IAAA,IAAI;AACF,MAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,MAAA,GAAS,IAAA,EAAM;AACjC,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,4BAAA,EAA6B;AAAA,MAC7D;AAEA,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,MAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,sBAAA,EAAuB;AAAA,MACvD;AAEA,MAAA,MAAM,CAAC,SAAA,EAAW,UAAA,EAAY,YAAY,CAAA,GAAI,KAAA;AAC9C,MAAA,IAAI,CAAC,SAAA,IAAa,CAAC,UAAA,IAAc,CAAC,YAAA,EAAc;AAC9C,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,wBAAA,EAAyB;AAAA,MACzD;AAEA,MAAA,MAAM,aAAA,GAAgB,CAAC,GAAA,KAAgB;AACrC,QAAA,IAAI,MAAA,GAAS,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACrD,QAAA,OAAO,MAAA,CAAO,SAAS,CAAA,EAAG;AACxB,UAAA,MAAA,IAAU,GAAA;AAAA,QACZ;AACA,QAAA,IAAI,OAAO,IAAA,KAAS,WAAA,EAAa,OAAO,KAAK,MAAM,CAAA;AACnD,QAAA,OAAO,OAAO,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,MACxD,CAAA;AAEA,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,aAAA,CAAc,SAAS,CAAC,CAAA;AAClD,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,aAAA,CAAc,UAAU,CAAC,CAAA;AACpD,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAExC,MAAA,IACE,CAAC,MAAA,IACD,OAAO,MAAA,KAAW,QAAA,IACjB,OAAO,GAAA,KAAQ,OAAA,IAAW,MAAA,CAAO,GAAA,KAAQ,QAAA,EAC1C;AACA,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,6BAAA,EAA8B;AAAA,MAC9D;AAEA,MAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC3C,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,uBAAA,EAAwB;AAAA,MACxD;AAEA,MAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,YAAY,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,EAAG;AAC7D,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,sBAAA,EAAuB;AAAA,MACvD;AAEA,MAAA,IAAI,OAAA,CAAQ,GAAA,IAAO,OAAA,CAAQ,GAAA,GAAM,GAAA,EAAK;AACpC,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,eAAA,EAAgB;AAAA,MAChD;AAEA,MAAA,IAAI,OAAA,CAAQ,GAAA,IAAO,OAAA,CAAQ,GAAA,GAAM,GAAA,EAAK;AACpC,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,MACtD;AAEA,MAAA,MAAM,YAAA,GAAiC,MAAM,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,GAC3D,OAAA,CAAQ,MACT,EAAC;AACL,MAAA,IACE,YAAA,CAAa,IAAA;AAAA,QACX,CAAC,GAAA,KACC,CAAC,GAAA,IACD,OAAO,GAAA,KAAQ,QAAA,IACf,OAAO,GAAA,CAAI,IAAA,KAAS,QAAA,IACpB,OAAO,IAAI,GAAA,KAAQ;AAAA,OACvB,EACA;AACA,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,8BAAA,EAA+B;AAAA,MAC/D;AAEA,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,IAAA;AAAA,QACP,QAAQ,OAAA,CAAQ,GAAA;AAAA,QAChB,YAAA,EAAc,YAAA,CAAa,GAAA,CAAI,CAAC,GAAA,KAAQ,CAAA,EAAG,GAAA,CAAI,GAAG,CAAA,CAAA,EAAI,GAAA,CAAI,IAAI,CAAA,CAAE;AAAA,OAClE;AAAA,IACF,SAAS,CAAA,EAAG;AACV,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,IACtD;AAAA,EACF;AACF","file":"chunk-KTKIWU5O.mjs","sourcesContent":["/**\n * Edgework Auth Module\n *\n * Provides authentication and authorization services:\n * - Wallet-based auth (Optimism NFT licenses)\n * - UCAN-based auth (legacy)\n * - Oracle service for license validation\n */\n\n// Core types\nexport interface AuthSession {\n  token: string;\n  identity: string;\n  capabilities: string[];\n}\n\n// Wallet auth\nexport {\n  WalletAuth,\n  createWalletAuth,\n  checkLicenseNFT,\n  type EIP1193Provider,\n  type WalletState,\n  type LicenseNFT,\n} from './wallet';\n\n// Oracle service\nexport {\n  OracleClient,\n  MockOracleClient,\n  createOracleClient,\n  createMockOracleClient,\n  type IOracleService,\n  type OracleConfig,\n  type ChallengeRequest,\n  type ChallengeResponse,\n  type VerifyRequest,\n  type VerifyResponse,\n  type LicenseInfo,\n  type StreamingAuth,\n} from './oracle';\n\n// Zero-knowledge secret encryption for paid API delegation\nexport {\n  encryptApiSecret,\n  createPaidApiUCAN,\n  fetchCogPublicKey,\n  clearPublicKeyCache,\n  isValidEncryptedSecret,\n  extractEncryptedSecret,\n  type PaidApiProvider,\n  type CogPublicKeyInfo,\n  type EncryptedSecretFact,\n  type SecretEncryptionOptions,\n  type PaidApiUCANOptions,\n} from './secret-encryption';\n\nexport interface AuthService {\n  getSession(): Promise<AuthSession | null>;\n  login(token: string): Promise<void>;\n  logout(): Promise<void>;\n}\n\ntype UCANCapability = {\n  with: string;\n  can: string;\n};\n\n// Implementation note: ] implementation\nexport class EdgeworkAuth implements AuthService {\n  private session: AuthSession | null = null;\n\n  async getSession(): Promise<AuthSession | null> {\n    return this.session;\n  }\n\n  async login(token: string): Promise<void> {\n    const verification = await this.verifyUCANToken(token);\n\n    if (!verification.valid) {\n      throw new Error(`Authentication failed: ${verification.error}`);\n    }\n\n    this.session = {\n      token,\n      identity: verification.userId || 'unknown',\n      capabilities: verification.capabilities || [],\n    };\n  }\n\n  async logout(): Promise<void> {\n    this.session = null;\n  }\n\n  /**\n   * Verify UCAN token structure and core claims defensively.\n   */\n  private async verifyUCANToken(token: string): Promise<{\n    valid: boolean;\n    error?: string;\n    userId?: string;\n    capabilities?: string[];\n  }> {\n    try {\n      if (!token || token.length > 8192) {\n        return { valid: false, error: 'Token missing or too large' };\n      }\n\n      const parts = token.split('.');\n      if (parts.length !== 3) {\n        return { valid: false, error: 'Invalid token format' };\n      }\n\n      const [headerB64, payloadB64, signatureB64] = parts;\n      if (!headerB64 || !payloadB64 || !signatureB64) {\n        return { valid: false, error: 'Incomplete token parts' };\n      }\n\n      const sessionDecode = (str: string) => {\n        let base64 = str.replace(/-/g, '+').replace(/_/g, '/');\n        while (base64.length % 4) {\n          base64 += '=';\n        }\n        if (typeof atob !== 'undefined') return atob(base64);\n        return Buffer.from(base64, 'base64').toString('binary');\n      };\n\n      const header = JSON.parse(sessionDecode(headerB64));\n      const payload = JSON.parse(sessionDecode(payloadB64));\n      const now = Math.floor(Date.now() / 1000);\n\n      if (\n        !header ||\n        typeof header !== 'object' ||\n        (header.alg !== 'EdDSA' && header.alg !== 'ES256K')\n      ) {\n        return { valid: false, error: 'Unsupported token algorithm' };\n      }\n\n      if (!payload || typeof payload !== 'object') {\n        return { valid: false, error: 'Invalid token payload' };\n      }\n\n      if (typeof payload.iss !== 'string' || payload.iss.length < 3) {\n        return { valid: false, error: 'Invalid issuer claim' };\n      }\n\n      if (payload.exp && payload.exp < now) {\n        return { valid: false, error: 'Token expired' };\n      }\n\n      if (payload.nbf && payload.nbf > now) {\n        return { valid: false, error: 'Token not yet valid' };\n      }\n\n      const capabilities: UCANCapability[] = Array.isArray(payload.att)\n        ? (payload.att as UCANCapability[])\n        : [];\n      if (\n        capabilities.some(\n          (cap) =>\n            !cap ||\n            typeof cap !== 'object' ||\n            typeof cap.with !== 'string' ||\n            typeof cap.can !== 'string'\n        )\n      ) {\n        return { valid: false, error: 'Malformed capability entries' };\n      }\n\n      return {\n        valid: true,\n        userId: payload.iss,\n        capabilities: capabilities.map((cap) => `${cap.can}@${cap.with}`),\n      };\n    } catch (e) {\n      return { valid: false, error: 'Token decode failed' };\n    }\n  }\n}\n","/**\n * Wallet Authentication Module\n *\n * Handles wallet connection and license validation via Optimism NFT.\n * Works with any EIP-1193 compatible wallet (MetaMask, WalletConnect, etc.)\n */\n\nimport type { AuthSession } from './index';\n\n// Optimism Mainnet Chain ID\nconst OPTIMISM_CHAIN_ID = 10;\nconst OPTIMISM_CHAIN_ID_HEX = '0xa';\n\n// License NFT Contract Address on Optimism\nconst LICENSE_CONTRACT_ADDRESS = '0x0000000000000000000000000000000000000000'; // Placeholder - deploy contract for production\n\n// Oracle API endpoint\nconst ORACLE_ENDPOINT = 'https://oracle.edgework.ai';\n\n/**\n * EIP-1193 Provider interface (MetaMask, etc.)\n */\nexport interface EIP1193Provider {\n  request(args: { method: string; params?: unknown[] }): Promise<unknown>;\n  on(event: string, listener: (...args: unknown[]) => void): void;\n  removeListener(event: string, listener: (...args: unknown[]) => void): void;\n}\n\n/**\n * Wallet connection state\n */\nexport interface WalletState {\n  connected: boolean;\n  address: string | null;\n  chainId: number | null;\n  isOptimism: boolean;\n}\n\n/**\n * License NFT metadata\n */\nexport interface LicenseNFT {\n  tokenId: string;\n  tier: 'starter' | 'pro' | 'enterprise';\n  expiry: number;\n  capabilities: string[];\n}\n\n/**\n * Oracle challenge response\n */\ninterface ChallengeResponse {\n  challenge: string;\n  expiresAt: number;\n}\n\n/**\n * Oracle verification response\n */\ninterface VerifyResponse {\n  valid: boolean;\n  jwt: string;\n  session: AuthSession;\n  error?: string;\n}\n\n/**\n * Wallet Authentication Client\n */\nexport class WalletAuth {\n  private provider: EIP1193Provider | null = null;\n  private state: WalletState = {\n    connected: false,\n    address: null,\n    chainId: null,\n    isOptimism: false,\n  };\n  private oracleEndpoint: string;\n\n  constructor(oracleEndpoint: string = ORACLE_ENDPOINT) {\n    this.oracleEndpoint = oracleEndpoint;\n  }\n\n  /**\n   * Connect to wallet and validate license\n   */\n  async connect(provider?: EIP1193Provider): Promise<AuthSession> {\n    // Get provider from window if not provided\n    this.provider = provider || this.getWindowProvider();\n\n    if (!this.provider) {\n      throw new Error(\n        'No wallet provider found. Please install MetaMask or another Web3 wallet.'\n      );\n    }\n\n    // Request account access\n    const accounts = (await this.provider.request({\n      method: 'eth_requestAccounts',\n    })) as string[];\n\n    if (!accounts || accounts.length === 0) {\n      throw new Error('No accounts found. Please unlock your wallet.');\n    }\n\n    const address = accounts[0].toLowerCase();\n\n    // Get current chain\n    const chainIdHex = (await this.provider.request({\n      method: 'eth_chainId',\n    })) as string;\n    const chainId = parseInt(chainIdHex, 16);\n\n    this.state = {\n      connected: true,\n      address,\n      chainId,\n      isOptimism: chainId === OPTIMISM_CHAIN_ID,\n    };\n\n    // Switch to Optimism if needed\n    if (!this.state.isOptimism) {\n      await this.switchToOptimism();\n    }\n\n    // Validate license via oracle\n    const session = await this.validateLicense(address);\n\n    // Set up event listeners\n    this.setupEventListeners();\n\n    return session;\n  }\n\n  /**\n   * Disconnect wallet\n   */\n  disconnect(): void {\n    this.state = {\n      connected: false,\n      address: null,\n      chainId: null,\n      isOptimism: false,\n    };\n    this.provider = null;\n  }\n\n  /**\n   * Get current wallet state\n   */\n  getState(): WalletState {\n    return { ...this.state };\n  }\n\n  /**\n   * Check if connected\n   */\n  isConnected(): boolean {\n    return this.state.connected && this.state.isOptimism;\n  }\n\n  /**\n   * Get connected address\n   */\n  getAddress(): string | null {\n    return this.state.address;\n  }\n\n  /**\n   * Switch to Optimism network\n   */\n  private async switchToOptimism(): Promise<void> {\n    if (!this.provider) throw new Error('No provider');\n\n    try {\n      await this.provider.request({\n        method: 'wallet_switchEthereumChain',\n        params: [{ chainId: OPTIMISM_CHAIN_ID_HEX }],\n      });\n    } catch (switchError: unknown) {\n      // Chain not added, add it\n      if ((switchError as { code?: number })?.code === 4902) {\n        await this.provider.request({\n          method: 'wallet_addEthereumChain',\n          params: [\n            {\n              chainId: OPTIMISM_CHAIN_ID_HEX,\n              chainName: 'Optimism',\n              nativeCurrency: {\n                name: 'Ether',\n                symbol: 'ETH',\n                decimals: 18,\n              },\n              rpcUrls: ['https://mainnet.optimism.io'],\n              blockExplorerUrls: ['https://optimistic.etherscan.io'],\n            },\n          ],\n        });\n      } else {\n        throw switchError;\n      }\n    }\n\n    this.state.chainId = OPTIMISM_CHAIN_ID;\n    this.state.isOptimism = true;\n  }\n\n  /**\n   * Validate license via oracle\n   */\n  private async validateLicense(address: string): Promise<AuthSession> {\n    // Step 1: Get challenge from oracle\n    const challengeResponse = await fetch(\n      `${this.oracleEndpoint}/auth/challenge`,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ address }),\n      }\n    );\n\n    if (!challengeResponse.ok) {\n      throw new Error('Failed to get challenge from oracle');\n    }\n\n    const { challenge, expiresAt } =\n      (await challengeResponse.json()) as ChallengeResponse;\n\n    // Check expiry\n    if (Date.now() / 1000 > expiresAt) {\n      throw new Error('Challenge expired');\n    }\n\n    // Step 2: Sign the challenge\n    const signature = await this.signMessage(challenge);\n\n    // Step 3: Verify signature with oracle\n    const verifyResponse = await fetch(`${this.oracleEndpoint}/auth/verify`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        address,\n        challenge,\n        signature,\n      }),\n    });\n\n    if (!verifyResponse.ok) {\n      const error = await verifyResponse.text();\n      throw new Error(`License validation failed: ${error}`);\n    }\n\n    const result = (await verifyResponse.json()) as VerifyResponse;\n\n    if (!result.valid) {\n      throw new Error(result.error || 'License validation failed');\n    }\n\n    return result.session;\n  }\n\n  /**\n   * Sign a message with the connected wallet\n   */\n  private async signMessage(message: string): Promise<string> {\n    if (!this.provider || !this.state.address) {\n      throw new Error('Wallet not connected');\n    }\n\n    const signature = (await this.provider.request({\n      method: 'personal_sign',\n      params: [message, this.state.address],\n    })) as string;\n\n    return signature;\n  }\n\n  /**\n   * Get window.ethereum provider\n   */\n  private getWindowProvider(): EIP1193Provider | null {\n    if (typeof window === 'undefined') {\n      return null;\n    }\n\n    const provider = (window as Window & { ethereum?: EIP1193Provider })\n      .ethereum;\n    return provider ?? null;\n  }\n\n  /**\n   * Set up wallet event listeners\n   */\n  private setupEventListeners(): void {\n    if (!this.provider) return;\n\n    this.provider.on('accountsChanged', (accounts: unknown) => {\n      const accts = accounts as string[];\n      if (accts.length === 0) {\n        this.disconnect();\n      } else {\n        this.state.address = accts[0].toLowerCase();\n      }\n    });\n\n    this.provider.on('chainChanged', (chainId: unknown) => {\n      const id = parseInt(chainId as string, 16);\n      this.state.chainId = id;\n      this.state.isOptimism = id === OPTIMISM_CHAIN_ID;\n    });\n\n    this.provider.on('disconnect', () => {\n      this.disconnect();\n    });\n  }\n}\n\n/**\n * Check if a wallet has a valid license NFT\n * (Direct contract call without oracle, for display purposes)\n */\nexport async function checkLicenseNFT(\n  provider: EIP1193Provider,\n  address: string\n): Promise<LicenseNFT | null> {\n  // ERC-721 balanceOf selector\n  const balanceOfSelector = '0x70a08231';\n  const paddedAddress = address.slice(2).padStart(64, '0');\n\n  try {\n    const result = (await provider.request({\n      method: 'eth_call',\n      params: [\n        {\n          to: LICENSE_CONTRACT_ADDRESS,\n          data: balanceOfSelector + paddedAddress,\n        },\n        'latest',\n      ],\n    })) as string;\n\n    const balance = parseInt(result, 16);\n    if (balance === 0) {\n      return null;\n    }\n\n    // Would fetch actual NFT metadata here\n    return {\n      tokenId: '1',\n      tier: 'pro',\n      expiry: Math.floor(Date.now() / 1000) + 30 * 24 * 60 * 60, // 30 days\n      capabilities: ['inference', 'distributed', 'streaming'],\n    };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Create a new WalletAuth instance\n */\nexport function createWalletAuth(oracleEndpoint?: string): WalletAuth {\n  return new WalletAuth(oracleEndpoint);\n}\n","/**\n * Oracle Service Interface\n *\n * Defines the interface for the license validation oracle.\n * The oracle verifies wallet signatures and checks on-chain license NFTs.\n */\n\nimport type { AuthSession } from './index';\n\n/**\n * Oracle configuration\n */\nexport interface OracleConfig {\n  endpoint: string;\n  timeout?: number;\n  retryCount?: number;\n}\n\n/**\n * Challenge request\n */\nexport interface ChallengeRequest {\n  address: string;\n}\n\n/**\n * Challenge response from oracle\n */\nexport interface ChallengeResponse {\n  challenge: string;\n  expiresAt: number;\n  nonce: string;\n}\n\n/**\n * Verification request\n */\nexport interface VerifyRequest {\n  address: string;\n  challenge: string;\n  signature: string;\n  nonce: string;\n}\n\n/**\n * Verification response\n */\nexport interface VerifyResponse {\n  valid: boolean;\n  jwt?: string;\n  session?: AuthSession;\n  error?: string;\n  licenseInfo?: LicenseInfo;\n}\n\n/**\n * License information from on-chain\n */\nexport interface LicenseInfo {\n  tokenId: string;\n  tier: number;\n  expiry: number;\n  capabilities: string[];\n  transferable: boolean;\n}\n\n/**\n * Streaming authorization\n */\nexport interface StreamingAuth {\n  token: string;\n  expiresAt: number;\n  allowedFunctions: string[];\n  rateLimit: number;\n}\n\n/**\n * Oracle service interface\n */\nexport interface IOracleService {\n  /**\n   * Request a challenge for wallet signature\n   */\n  getChallenge(address: string): Promise<ChallengeResponse>;\n\n  /**\n   * Verify wallet signature and return session\n   */\n  verify(request: VerifyRequest): Promise<VerifyResponse>;\n\n  /**\n   * Refresh an existing session\n   */\n  refresh(sessionId: string): Promise<VerifyResponse>;\n\n  /**\n   * Revoke a session\n   */\n  revoke(sessionId: string): Promise<void>;\n\n  /**\n   * Get streaming authorization for CLI\n   */\n  getStreamingAuth(\n    sessionId: string,\n    functions: string[]\n  ): Promise<StreamingAuth>;\n\n  /**\n   * Check license status without full verification\n   */\n  checkLicense(address: string): Promise<LicenseInfo | null>;\n}\n\n/**\n * Oracle client implementation\n */\nexport class OracleClient implements IOracleService {\n  private config: Required<OracleConfig>;\n\n  constructor(config: OracleConfig) {\n    this.config = {\n      endpoint: config.endpoint,\n      timeout: config.timeout ?? 30000,\n      retryCount: config.retryCount ?? 3,\n    };\n  }\n\n  async getChallenge(address: string): Promise<ChallengeResponse> {\n    const response = await this.fetch('/auth/challenge', {\n      method: 'POST',\n      body: JSON.stringify({ address }),\n    });\n\n    return response as ChallengeResponse;\n  }\n\n  async verify(request: VerifyRequest): Promise<VerifyResponse> {\n    const response = await this.fetch('/auth/verify', {\n      method: 'POST',\n      body: JSON.stringify(request),\n    });\n\n    return response as VerifyResponse;\n  }\n\n  async refresh(sessionId: string): Promise<VerifyResponse> {\n    const response = await this.fetch('/auth/refresh', {\n      method: 'POST',\n      body: JSON.stringify({ sessionId }),\n    });\n\n    return response as VerifyResponse;\n  }\n\n  async revoke(sessionId: string): Promise<void> {\n    await this.fetch('/auth/revoke', {\n      method: 'POST',\n      body: JSON.stringify({ sessionId }),\n    });\n  }\n\n  async getStreamingAuth(\n    sessionId: string,\n    functions: string[]\n  ): Promise<StreamingAuth> {\n    const response = await this.fetch('/auth/streaming', {\n      method: 'POST',\n      body: JSON.stringify({ sessionId, functions }),\n    });\n\n    return response as StreamingAuth;\n  }\n\n  async checkLicense(address: string): Promise<LicenseInfo | null> {\n    try {\n      const response = await this.fetch(`/license/${address}`, {\n        method: 'GET',\n      });\n\n      return response as LicenseInfo;\n    } catch {\n      return null;\n    }\n  }\n\n  private async fetch(path: string, options: RequestInit): Promise<unknown> {\n    const url = `${this.config.endpoint}${path}`;\n\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);\n\n    try {\n      const response = await fetch(url, {\n        ...options,\n        headers: {\n          'Content-Type': 'application/json',\n          ...options.headers,\n        },\n        signal: controller.signal,\n      });\n\n      if (!response.ok) {\n        const error = await response.text();\n        throw new Error(`Oracle request failed: ${response.status} - ${error}`);\n      }\n\n      return response.json();\n    } finally {\n      clearTimeout(timeoutId);\n    }\n  }\n}\n\n/**\n * Mock oracle for testing\n */\nexport class MockOracleClient implements IOracleService {\n  private sessions: Map<string, AuthSession> = new Map();\n  private challenges: Map<string, ChallengeResponse> = new Map();\n\n  async getChallenge(address: string): Promise<ChallengeResponse> {\n    const challenge: ChallengeResponse = {\n      challenge: `Sign this message to authenticate with Edgework:\\n\\nAddress: ${address}\\nTimestamp: ${Date.now()}\\nNonce: ${Math.random()\n        .toString(36)\n        .slice(2)}`,\n      expiresAt: Math.floor(Date.now() / 1000) + 300, // 5 minutes\n      nonce: Math.random().toString(36).slice(2),\n    };\n\n    this.challenges.set(address, challenge);\n    return challenge;\n  }\n\n  async verify(request: VerifyRequest): Promise<VerifyResponse> {\n    const storedChallenge = this.challenges.get(request.address);\n\n    if (!storedChallenge || storedChallenge.challenge !== request.challenge) {\n      return { valid: false, error: 'Invalid challenge' };\n    }\n\n    if (Date.now() / 1000 > storedChallenge.expiresAt) {\n      return { valid: false, error: 'Challenge expired' };\n    }\n\n    // In mock, we don't verify the signature - just check format\n    if (!request.signature.startsWith('0x')) {\n      return { valid: false, error: 'Invalid signature format' };\n    }\n\n    const sessionId = `session_${Math.random().toString(36).slice(2)}`;\n    const session: AuthSession = {\n      token: `jwt_${Math.random().toString(36).slice(2)}`,\n      identity: request.address,\n      capabilities: ['inference', 'distributed', 'streaming'],\n    };\n\n    this.sessions.set(sessionId, session);\n    this.challenges.delete(request.address);\n\n    return {\n      valid: true,\n      jwt: session.token,\n      session,\n      licenseInfo: {\n        tokenId: '1',\n        tier: 2, // Pro\n        expiry: Math.floor(Date.now() / 1000) + 30 * 24 * 60 * 60,\n        capabilities: session.capabilities,\n        transferable: true,\n      },\n    };\n  }\n\n  async refresh(sessionId: string): Promise<VerifyResponse> {\n    const session = this.sessions.get(sessionId);\n\n    if (!session) {\n      return { valid: false, error: 'Session not found' };\n    }\n\n    return {\n      valid: true,\n      jwt: session.token,\n      session,\n    };\n  }\n\n  async revoke(sessionId: string): Promise<void> {\n    this.sessions.delete(sessionId);\n  }\n\n  async getStreamingAuth(\n    sessionId: string,\n    functions: string[]\n  ): Promise<StreamingAuth> {\n    const session = this.sessions.get(sessionId);\n\n    if (!session) {\n      throw new Error('Session not found');\n    }\n\n    return {\n      token: `stream_${Math.random().toString(36).slice(2)}`,\n      expiresAt: Math.floor(Date.now() / 1000) + 900, // 15 minutes\n      allowedFunctions: functions,\n      rateLimit: 100, // requests per minute\n    };\n  }\n\n  async checkLicense(address: string): Promise<LicenseInfo | null> {\n    // Mock: return a pro license for any address\n    return {\n      tokenId: '1',\n      tier: 2,\n      expiry: Math.floor(Date.now() / 1000) + 30 * 24 * 60 * 60,\n      capabilities: ['inference', 'distributed', 'streaming'],\n      transferable: true,\n    };\n  }\n}\n\n/**\n * Create an oracle client\n */\nexport function createOracleClient(config: OracleConfig): IOracleService {\n  return new OracleClient(config);\n}\n\n/**\n * Create a mock oracle client for testing\n */\nexport function createMockOracleClient(): IOracleService {\n  return new MockOracleClient();\n}\n","/**\n * Zero-Knowledge Secret Encryption for Edgework SDK\n *\n * Implements ECIES (Elliptic Curve Integrated Encryption Scheme) for\n * zero-knowledge API key handling. Users encrypt their API keys client-side\n * using Cog's public key - the platform never sees plaintext secrets.\n *\n * Encryption flow:\n * 1. Fetch Cog's P-256 public key from gateway\n * 2. Generate ephemeral ECDH key pair (forward secrecy)\n * 3. Derive shared secret via ECDH\n * 4. Derive AES-256 key from shared secret using HKDF\n * 5. Encrypt API key with AES-256-GCM\n * 6. Return encrypted blob for UCAN fct field\n *\n * @security Forward secrecy via ephemeral keys per encryption\n * @security Replay protection via nonce and timestamp\n * @security Time-boxed by UCAN expiration\n */\n\n/**\n * Supported paid API providers\n */\nexport type PaidApiProvider = 'openai' | 'anthropic' | 'gemini' | 'groq';\n\n/**\n * Cog public key information\n */\nexport interface CogPublicKeyInfo {\n  keyId: string;\n  publicKey: JsonWebKey;\n  expiresAt: number;\n  endpoint: string;\n}\n\n/**\n * Encrypted secret structure for UCAN fct field\n */\nexport interface EncryptedSecretFact {\n  alg: 'ECIES-P256';\n  epk: string;\n  ct: string;\n  iv: string;\n  tag: string;\n  cogKeyId: string;\n  provider: PaidApiProvider;\n  nonce: string;\n  encryptedAt: number;\n}\n\n/**\n * Options for secret encryption\n */\nexport interface SecretEncryptionOptions {\n  /** Mesh gateway endpoint (default: https://mesh.affectively.ai) */\n  gatewayEndpoint?: string;\n  /** Override public key (for testing) */\n  cogPublicKey?: CogPublicKeyInfo;\n  /** Cache TTL for public key in ms (default: 1 hour) */\n  publicKeyCacheTtl?: number;\n}\n\n/**\n * Options for creating a paid API UCAN\n */\nexport interface PaidApiUCANOptions extends SecretEncryptionOptions {\n  /** Expiration in seconds (default: 3600 = 1 hour, max: 604800 = 7 days) */\n  expirationSeconds?: number;\n  /** Maximum cost in cents per request */\n  maxCostCentsPerRequest?: number;\n  /** Maximum cost in cents per day */\n  maxCostCentsPerDay?: number;\n  /** Allowed models (empty = all allowed) */\n  allowedModels?: string[];\n}\n\n// Default gateway endpoint\nconst DEFAULT_GATEWAY = 'https://mesh.affectively.ai';\n\n// Maximum expiration (7 days in seconds)\nconst MAX_EXPIRATION_SECONDS = 7 * 24 * 60 * 60;\n\n// Public key cache\nlet cachedPublicKey: CogPublicKeyInfo | null = null;\nlet cacheExpiresAt = 0;\n\n/**\n * Base64url encode a string\n */\nfunction base64UrlEncode(data: Uint8Array | string): string {\n  const bytes =\n    typeof data === 'string' ? new TextEncoder().encode(data) : data;\n  const base64 = btoa(String.fromCharCode(...bytes));\n  return base64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n\n/**\n * Base64url decode a string\n */\nfunction base64UrlDecode(str: string): Uint8Array {\n  let base64 = str.replace(/-/g, '+').replace(/_/g, '/');\n  while (base64.length % 4) {\n    base64 += '=';\n  }\n  const binary = atob(base64);\n  return Uint8Array.from(binary, (c) => c.charCodeAt(0));\n}\n\n/**\n * Fetch Cog's public key from mesh gateway\n *\n * The public key is cached for 1 hour by default.\n *\n * @param gatewayEndpoint - Gateway URL\n * @param cacheTtl - Cache TTL in ms\n * @returns Cog's public key info\n */\nexport async function fetchCogPublicKey(\n  gatewayEndpoint = DEFAULT_GATEWAY,\n  cacheTtl = 60 * 60 * 1000 // 1 hour\n): Promise<CogPublicKeyInfo> {\n  // Return cached key if still valid\n  if (cachedPublicKey && Date.now() < cacheExpiresAt) {\n    return cachedPublicKey;\n  }\n\n  const response = await fetch(\n    `${gatewayEndpoint}/.well-known/cog-public-key.json`\n  );\n\n  if (!response.ok) {\n    throw new Error(`Failed to fetch Cog public key: ${response.status}`);\n  }\n\n  const data = (await response.json()) as {\n    keyId: string;\n    publicKey: JsonWebKey;\n    expiresAt: number;\n    algorithm: string;\n  };\n\n  // Validate key type\n  if (data.publicKey?.kty !== 'EC' || data.publicKey?.crv !== 'P-256') {\n    throw new Error('Invalid Cog public key format - expected EC P-256');\n  }\n\n  cachedPublicKey = {\n    keyId: data.keyId,\n    publicKey: data.publicKey,\n    expiresAt: data.expiresAt,\n    endpoint: gatewayEndpoint,\n  };\n\n  // Set cache expiration (use min of TTL and key expiration)\n  cacheExpiresAt = Math.min(Date.now() + cacheTtl, data.expiresAt);\n\n  return cachedPublicKey;\n}\n\n/**\n * Clear the cached public key (useful for testing or key rotation)\n */\nexport function clearPublicKeyCache(): void {\n  cachedPublicKey = null;\n  cacheExpiresAt = 0;\n}\n\n/**\n * Encrypt an API secret for zero-knowledge transmission\n *\n * Uses ECIES (Elliptic Curve Integrated Encryption Scheme):\n * 1. Generate ephemeral ECDH key pair\n * 2. Compute shared secret with Cog's public key\n * 3. Derive AES-256 key using HKDF\n * 4. Encrypt API key with AES-256-GCM\n *\n * @param apiKey - The API key to encrypt (plaintext)\n * @param provider - API provider (openai, anthropic, etc.)\n * @param options - Encryption options\n * @returns Encrypted secret fact for UCAN\n *\n * @security The apiKey parameter is used only for encryption and not stored\n * @security Ephemeral keys provide forward secrecy\n */\nexport async function encryptApiSecret(\n  apiKey: string,\n  provider: PaidApiProvider,\n  options: SecretEncryptionOptions = {}\n): Promise<EncryptedSecretFact> {\n  // 1. Get Cog's public key\n  const cogKey =\n    options.cogPublicKey ??\n    (await fetchCogPublicKey(\n      options.gatewayEndpoint,\n      options.publicKeyCacheTtl\n    ));\n\n  // Check if key has expired\n  if (cogKey.expiresAt < Date.now()) {\n    clearPublicKeyCache();\n    throw new Error(\n      'Cog public key has expired - please retry to fetch a new key'\n    );\n  }\n\n  // 2. Import Cog's public key for ECDH\n  const cogPubKey = await crypto.subtle.importKey(\n    'jwk',\n    cogKey.publicKey,\n    { name: 'ECDH', namedCurve: 'P-256' },\n    false,\n    []\n  );\n\n  // 3. Generate ephemeral key pair (for forward secrecy)\n  const ephemeralKeyPair = await crypto.subtle.generateKey(\n    { name: 'ECDH', namedCurve: 'P-256' },\n    true, // extractable for export\n    ['deriveBits']\n  );\n\n  // 4. Derive shared secret via ECDH\n  const sharedSecret = await crypto.subtle.deriveBits(\n    { name: 'ECDH', public: cogPubKey },\n    ephemeralKeyPair.privateKey,\n    256\n  );\n\n  // 5. Derive AES key using HKDF\n  const sharedSecretKey = await crypto.subtle.importKey(\n    'raw',\n    sharedSecret,\n    'HKDF',\n    false,\n    ['deriveBits', 'deriveKey']\n  );\n\n  const aesKey = await crypto.subtle.deriveKey(\n    {\n      name: 'HKDF',\n      hash: 'SHA-256',\n      salt: new TextEncoder().encode('edgework-secret-v1'),\n      info: new TextEncoder().encode(`paid-api:${provider}`),\n    },\n    sharedSecretKey,\n    { name: 'AES-GCM', length: 256 },\n    false,\n    ['encrypt']\n  );\n\n  // 6. Encrypt the API key with AES-256-GCM\n  const iv = crypto.getRandomValues(new Uint8Array(12));\n  const plaintext = new TextEncoder().encode(apiKey);\n\n  const ciphertext = await crypto.subtle.encrypt(\n    { name: 'AES-GCM', iv, tagLength: 128 },\n    aesKey,\n    plaintext\n  );\n\n  // 7. Export ephemeral public key as JWK\n  const ephemeralPubKeyJwk = await crypto.subtle.exportKey(\n    'jwk',\n    ephemeralKeyPair.publicKey\n  );\n\n  // 8. Separate ciphertext and authentication tag\n  // AES-GCM appends the tag to the ciphertext\n  const ctWithTag = new Uint8Array(ciphertext);\n  const ct = ctWithTag.slice(0, -16);\n  const tag = ctWithTag.slice(-16);\n\n  // 9. Build encrypted secret fact\n  return {\n    alg: 'ECIES-P256',\n    epk: base64UrlEncode(JSON.stringify(ephemeralPubKeyJwk)),\n    ct: base64UrlEncode(ct),\n    iv: base64UrlEncode(iv),\n    tag: base64UrlEncode(tag),\n    cogKeyId: cogKey.keyId,\n    provider,\n    nonce: crypto.randomUUID(),\n    encryptedAt: Date.now(),\n  };\n}\n\n/**\n * Create a UCAN token with an encrypted API secret\n *\n * This is the main function for zero-knowledge API delegation.\n * The resulting UCAN can be used to make paid API requests through\n * the paid-ai-proxy without exposing the API key.\n *\n * @param userId - User ID (issuer)\n * @param apiKey - The API key to encrypt and embed\n * @param provider - API provider\n * @param options - UCAN options\n * @returns UCAN token string (JWT-like format)\n *\n * @example\n * ```typescript\n * const ucan = await createPaidApiUCAN(\n *   'user-123',\n *   'sk-abc123...',  // Your OpenAI key (encrypted, never sent in plaintext)\n *   'openai',\n *   { expirationSeconds: 3600 }\n * );\n *\n * // Use in request\n * fetch('https://paid-ai-proxy.affectively.ai/v1/chat/completions', {\n *   headers: { 'Authorization': `Bearer ${ucan}` }\n * });\n * ```\n */\nexport async function createPaidApiUCAN(\n  userId: string,\n  apiKey: string,\n  provider: PaidApiProvider,\n  options: PaidApiUCANOptions = {}\n): Promise<string> {\n  // Validate and cap expiration\n  const expirationSeconds = Math.min(\n    options.expirationSeconds ?? 3600,\n    MAX_EXPIRATION_SECONDS\n  );\n\n  // Encrypt the secret\n  const encryptedSecret = await encryptApiSecret(apiKey, provider, {\n    gatewayEndpoint: options.gatewayEndpoint,\n    cogPublicKey: options.cogPublicKey,\n    publicKeyCacheTtl: options.publicKeyCacheTtl,\n  });\n\n  // Build UCAN payload\n  const now = Math.floor(Date.now() / 1000);\n  const payload = {\n    iss: userId,\n    aud: 'paid-ai-proxy',\n    att: [\n      {\n        can: 'paid-api:use',\n        with: `provider:${provider}:user:${userId}`,\n        constraints: {\n          ...(options.maxCostCentsPerRequest && {\n            maxCostCentsPerRequest: options.maxCostCentsPerRequest,\n          }),\n          ...(options.maxCostCentsPerDay && {\n            maxCostCentsPerDay: options.maxCostCentsPerDay,\n          }),\n          ...(options.allowedModels?.length && {\n            allowedModels: options.allowedModels,\n          }),\n        },\n      },\n    ],\n    exp: now + expirationSeconds,\n    nbf: now,\n    nonce: crypto.randomUUID(),\n    facts: [encryptedSecret as unknown as Record<string, unknown>],\n  };\n\n  // Build header\n  const header = {\n    alg: 'ES256',\n    typ: 'UCAN',\n  };\n\n  // Encode header and payload\n  const headerB64 = base64UrlEncode(JSON.stringify(header));\n  const payloadB64 = base64UrlEncode(JSON.stringify(payload));\n\n  // Current behavior: create unsigned token (signature will be added by auth service)\n  // Implementation note: , this would be signed with the user's key\n  const unsignedToken = `${headerB64}.${payloadB64}`;\n\n  // Sign with a placeholder (real implementation would use user's signing key)\n  // The mesh gateway will verify this signature\n  const signature = await signPayload(unsignedToken, userId);\n\n  return `${unsignedToken}.${signature}`;\n}\n\n/**\n * Sign a UCAN payload\n *\n * Note: In production, this uses the user's signing key from secure storage.\n * This implementation provides a placeholder that should be replaced with\n * proper key management integration.\n *\n * @param payload - The payload to sign\n * @param userId - User ID for key lookup\n * @returns Base64url-encoded signature\n */\nasync function signPayload(payload: string, userId: string): Promise<string> {\n  // Implementation note: get user's signing key from secure storage\n  // Current behavior: : derive a key from userId + environment secret\n  // This should be replaced with proper key management\n\n  const encoder = new TextEncoder();\n\n  // Get or generate signing key for user\n  // Implementation note: , this would come from secure key storage\n  const keyMaterial = await crypto.subtle.importKey(\n    'raw',\n    encoder.encode(`user-signing-key-${userId}`),\n    'HKDF',\n    false,\n    ['deriveBits', 'deriveKey']\n  );\n\n  const signingKey = await crypto.subtle.deriveKey(\n    {\n      name: 'HKDF',\n      hash: 'SHA-256',\n      salt: encoder.encode('edgework-ucan-signing-v1'),\n      info: encoder.encode(userId),\n    },\n    keyMaterial,\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign']\n  );\n\n  // Sign the payload\n  const signature = await crypto.subtle.sign(\n    'HMAC',\n    signingKey,\n    encoder.encode(payload)\n  );\n\n  return base64UrlEncode(new Uint8Array(signature));\n}\n\n/**\n * Check if an encrypted secret fact is valid (not expired, correct format)\n *\n * @param fact - The encrypted secret fact to validate\n * @param maxAgeMs - Maximum age in milliseconds (default: 5 minutes)\n * @returns true if valid\n */\nexport function isValidEncryptedSecret(\n  fact: EncryptedSecretFact,\n  maxAgeMs = 5 * 60 * 1000\n): boolean {\n  if (fact.alg !== 'ECIES-P256') return false;\n  if (!fact.epk || !fact.ct || !fact.iv || !fact.tag) return false;\n  if (!fact.cogKeyId || !fact.provider || !fact.nonce) return false;\n\n  // Check timestamp freshness\n  const age = Date.now() - fact.encryptedAt;\n  if (age < 0 || age > maxAgeMs) return false;\n\n  return true;\n}\n\n/**\n * Extract encrypted secret from a UCAN token\n *\n * @param tokenString - UCAN token string\n * @returns Encrypted secret fact or null if not found\n */\nexport function extractEncryptedSecret(\n  tokenString: string\n): EncryptedSecretFact | null {\n  try {\n    const parts = tokenString.split('.');\n    if (parts.length !== 3) return null;\n\n    const payloadB64 = parts[1];\n    const payload = JSON.parse(\n      new TextDecoder().decode(base64UrlDecode(payloadB64))\n    );\n\n    const facts = payload.facts || payload.fct || [];\n    const secretFact = facts.find(\n      (f: Record<string, unknown>) =>\n        f.alg === 'ECIES-P256' && f.ct && f.provider\n    );\n\n    return secretFact || null;\n  } catch {\n    return null;\n  }\n}\n"]}