{"version":3,"sources":["../../src/core/crypto/keyless.ts"],"sourcesContent":["// Copyright © Endless\n// Copyright © Aptos Foundation\n// SPDX-License-Identifier: Apache-2.0\n\nimport { JwtPayload, jwtDecode } from \"jwt-decode\";\nimport { sha3_256 as sha3Hash } from \"@noble/hashes/sha3\";\nimport { AccountPublicKey, PublicKey } from \"./publicKey\";\nimport { Signature } from \"./signature\";\nimport { Deserializer, Serializable, Serializer } from \"../../bcs\";\nimport { Hex } from \"../hex\";\nimport {\n  HexInput,\n  EphemeralCertificateVariant,\n  AnyPublicKeyVariant,\n  SigningScheme,\n  LedgerVersionArg,\n  MoveResource,\n} from \"../../types\";\nimport { EphemeralPublicKey, EphemeralSignature } from \"./ephemeral\";\nimport { bigIntToBytesLE, bytesToBigIntLE, hashStrToField, poseidonHash } from \"./poseidon\";\nimport { AuthenticationKey } from \"../authenticationKey\";\nimport { Proof } from \"./proof\";\nimport { Ed25519PublicKey, Ed25519Signature } from \"./ed25519\";\nimport { Groth16VerificationKeyResponse, KeylessConfigurationResponse } from \"../../types/keyless\";\nimport { EndlessConfig } from \"../../api/endlessConfig\";\nimport { getEndlessFullNode } from \"../../client\";\nimport { memoizeAsync } from \"../../utils/memoize\";\nimport { AccountAddress } from \"../accountAddress\";\n\nexport const EPK_HORIZON_SECS = 10000000;\nexport const MAX_AUD_VAL_BYTES = 120;\nexport const MAX_UID_KEY_BYTES = 30;\nexport const MAX_UID_VAL_BYTES = 330;\nexport const MAX_ISS_VAL_BYTES = 120;\nexport const MAX_EXTRA_FIELD_BYTES = 350;\nexport const MAX_JWT_HEADER_B64_BYTES = 300;\nexport const MAX_COMMITED_EPK_BYTES = 93;\n\n/**\n * Represents the KeylessPublicKey public key\n *\n * KeylessPublicKey authentication key is represented in the SDK as `AnyPublicKey`.\n */\nexport class KeylessPublicKey extends AccountPublicKey {\n  /**\n   * The number of bytes that `idCommitment` should be\n   */\n  static readonly ID_COMMITMENT_LENGTH: number = 32;\n\n  /**\n   * The value of the 'iss' claim on the JWT which identifies the OIDC provider.\n   */\n  readonly iss: string;\n\n  /**\n   * A value representing a cryptographic commitment to a user identity.\n   *\n   * It is calculated from the aud, uidKey, uidVal, pepper.\n   */\n  readonly idCommitment: Uint8Array;\n\n  constructor(iss: string, idCommitment: HexInput) {\n    super();\n    const idcBytes = Hex.fromHexInput(idCommitment).toUint8Array();\n    if (idcBytes.length !== KeylessPublicKey.ID_COMMITMENT_LENGTH) {\n      throw new Error(`Id Commitment length in bytes should be ${KeylessPublicKey.ID_COMMITMENT_LENGTH}`);\n    }\n    this.iss = iss;\n    this.idCommitment = idcBytes;\n  }\n\n  /**\n   * Get the authentication key for the keyless public key\n   *\n   * @returns AuthenticationKey\n   */\n  authKey(): AuthenticationKey {\n    const serializer = new Serializer();\n    serializer.serializeU32AsUleb128(AnyPublicKeyVariant.Keyless);\n    serializer.serializeFixedBytes(this.bcsToBytes());\n    return AuthenticationKey.fromSchemeAndBytes({\n      scheme: SigningScheme.SingleKey,\n      input: serializer.toUint8Array(),\n    });\n  }\n\n  /**\n   * Get the public key in bytes (Uint8Array).\n   *\n   * @returns Uint8Array representation of the public key\n   */\n  toUint8Array(): Uint8Array {\n    return this.bcsToBytes();\n  }\n\n  /**\n   * Get the public key as a hex string with the 0x prefix.\n   *\n   * @returns string representation of the public key\n   */\n  toString(): string {\n    return Hex.fromHexInput(this.toUint8Array()).toString();\n  }\n\n  /**\n   * Verifies a signed data with a public key\n   *\n   * @param args.message message\n   * @param args.signature The signature\n   * @returns true if the signature is valid\n   */\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars, class-methods-use-this\n  verifySignature(args: { message: HexInput; signature: KeylessSignature }): boolean {\n    throw new Error(\"Not yet implemented\");\n  }\n\n  serialize(serializer: Serializer): void {\n    serializer.serializeStr(this.iss);\n    serializer.serializeBytes(this.idCommitment);\n  }\n\n  static deserialize(deserializer: Deserializer): KeylessPublicKey {\n    const iss = deserializer.deserializeStr();\n    const addressSeed = deserializer.deserializeBytes();\n    return new KeylessPublicKey(iss, addressSeed);\n  }\n\n  static load(deserializer: Deserializer): KeylessPublicKey {\n    const iss = deserializer.deserializeStr();\n    const addressSeed = deserializer.deserializeBytes();\n    return new KeylessPublicKey(iss, addressSeed);\n  }\n\n  static isPublicKey(publicKey: PublicKey): publicKey is KeylessPublicKey {\n    return publicKey instanceof KeylessPublicKey;\n  }\n\n  /**\n   * Creates a KeylessPublicKey from the JWT components plus pepper\n   *\n   * @param args.iss the iss of the identity\n   * @param args.uidKey the key to use to get the uidVal in the JWT token\n   * @param args.uidVal the value of the uidKey in the JWT token\n   * @param args.aud the client ID of the application\n   * @param args.pepper The pepper used to maintain privacy of the account\n   * @returns KeylessPublicKey\n   */\n  static create(args: {\n    iss: string;\n    uidKey: string;\n    uidVal: string;\n    aud: string;\n    pepper: HexInput;\n  }): KeylessPublicKey {\n    computeIdCommitment(args);\n    return new KeylessPublicKey(args.iss, computeIdCommitment(args));\n  }\n\n  static fromJwtAndPepper(args: { jwt: string; pepper: HexInput; uidKey?: string }): KeylessPublicKey {\n    const { jwt, pepper, uidKey = \"sub\" } = args;\n    const jwtPayload = jwtDecode<JwtPayload & { [key: string]: string }>(jwt);\n    const iss = jwtPayload.iss!;\n    if (typeof jwtPayload.aud !== \"string\") {\n      throw new Error(\"aud was not found or an array of values\");\n    }\n    const aud = jwtPayload.aud!;\n    const uidVal = jwtPayload[uidKey];\n    return KeylessPublicKey.create({ iss, uidKey, uidVal, aud, pepper });\n  }\n\n  static isInstance(publicKey: PublicKey) {\n    return (\n      \"iss\" in publicKey &&\n      typeof publicKey.iss === \"string\" &&\n      \"idCommitment\" in publicKey &&\n      publicKey.idCommitment instanceof Uint8Array\n    );\n  }\n}\n\nfunction computeIdCommitment(args: { uidKey: string; uidVal: string; aud: string; pepper: HexInput }): Uint8Array {\n  const { uidKey, uidVal, aud, pepper } = args;\n\n  const fields = [\n    bytesToBigIntLE(Hex.fromHexInput(pepper).toUint8Array()),\n    hashStrToField(aud, MAX_AUD_VAL_BYTES),\n    hashStrToField(uidVal, MAX_UID_VAL_BYTES),\n    hashStrToField(uidKey, MAX_UID_KEY_BYTES),\n  ];\n\n  return bigIntToBytesLE(poseidonHash(fields), KeylessPublicKey.ID_COMMITMENT_LENGTH);\n}\n\n/**\n * A signature of a message signed via Keyless Accounnt that uses proofs or the jwt token to authenticate.\n */\nexport class KeylessSignature extends Signature {\n  /**\n   * The inner signature ZeroKnowledgeSigniature or OpenIdSignature\n   */\n  readonly ephemeralCertificate: EphemeralCertificate;\n\n  /**\n   * The jwt header in the token used to create the proof/signature.  In json string representation.\n   */\n  readonly jwtHeader: string;\n\n  /**\n   * The expiry timestamp in seconds of the EphemeralKeyPair used to sign\n   */\n  readonly expiryDateSecs: number;\n\n  /**\n   * The ephemeral public key used to verify the signature\n   */\n  readonly ephemeralPublicKey: EphemeralPublicKey;\n\n  /**\n   * The signature resulting from signing with the private key of the EphemeralKeyPair\n   */\n  readonly ephemeralSignature: EphemeralSignature;\n\n  constructor(args: {\n    jwtHeader: string;\n    ephemeralCertificate: EphemeralCertificate;\n    expiryDateSecs: number;\n    ephemeralPublicKey: EphemeralPublicKey;\n    ephemeralSignature: EphemeralSignature;\n  }) {\n    super();\n    const { jwtHeader, ephemeralCertificate, expiryDateSecs, ephemeralPublicKey, ephemeralSignature } = args;\n    this.jwtHeader = jwtHeader;\n    this.ephemeralCertificate = ephemeralCertificate;\n    this.expiryDateSecs = expiryDateSecs;\n    this.ephemeralPublicKey = ephemeralPublicKey;\n    this.ephemeralSignature = ephemeralSignature;\n  }\n\n  /**\n   * Get the signature in bytes (Uint8Array).\n   *\n   * @returns Uint8Array representation of the signature\n   */\n  toUint8Array(): Uint8Array {\n    return this.bcsToBytes();\n  }\n\n  serialize(serializer: Serializer): void {\n    this.ephemeralCertificate.serialize(serializer);\n    serializer.serializeStr(this.jwtHeader);\n    serializer.serializeU64(this.expiryDateSecs);\n    this.ephemeralPublicKey.serialize(serializer);\n    this.ephemeralSignature.serialize(serializer);\n  }\n\n  static deserialize(deserializer: Deserializer): KeylessSignature {\n    const ephemeralCertificate = EphemeralCertificate.deserialize(deserializer);\n    const jwtHeader = deserializer.deserializeStr();\n    const expiryDateSecs = deserializer.deserializeU64();\n    const ephemeralPublicKey = EphemeralPublicKey.deserialize(deserializer);\n    const ephemeralSignature = EphemeralSignature.deserialize(deserializer);\n    return new KeylessSignature({\n      jwtHeader,\n      expiryDateSecs: Number(expiryDateSecs),\n      ephemeralCertificate,\n      ephemeralPublicKey,\n      ephemeralSignature,\n    });\n  }\n\n  static getSimulationSignature(): KeylessSignature {\n    return new KeylessSignature({\n      jwtHeader: \"{}\",\n      ephemeralCertificate: new EphemeralCertificate(\n        new ZeroKnowledgeSig({\n          proof: new Groth16Zkp({ a: new Uint8Array(32), b: new Uint8Array(64), c: new Uint8Array(32) }),\n          nonMalleabilitySignature: new EphemeralSignature(new Ed25519Signature(new Uint8Array(64))),\n          expHorizonSecs: 0,\n        }),\n        EphemeralCertificateVariant.ZkProof,\n      ),\n      expiryDateSecs: 0,\n      ephemeralPublicKey: new EphemeralPublicKey(new Ed25519PublicKey(new Uint8Array(32))),\n      ephemeralSignature: new EphemeralSignature(new Ed25519Signature(new Uint8Array(64))),\n    });\n  }\n\n  static isSignature(signature: Signature): signature is KeylessSignature {\n    return signature instanceof KeylessSignature;\n  }\n}\n\n/**\n * A container for a signature that is a ZeroKnowledgeSig.  Can be expanded to support OpenIdSignature.\n */\nexport class EphemeralCertificate extends Signature {\n  public readonly signature: Signature;\n\n  /**\n   * Index of the underlying enum variant\n   */\n  private readonly variant: EphemeralCertificateVariant;\n\n  constructor(signature: Signature, variant: EphemeralCertificateVariant) {\n    super();\n    this.signature = signature;\n    this.variant = variant;\n  }\n\n  /**\n   * Get the public key in bytes (Uint8Array).\n   *\n   * @returns Uint8Array representation of the public key\n   */\n  toUint8Array(): Uint8Array {\n    return this.signature.toUint8Array();\n  }\n\n  serialize(serializer: Serializer): void {\n    serializer.serializeU32AsUleb128(this.variant);\n    this.signature.serialize(serializer);\n  }\n\n  static deserialize(deserializer: Deserializer): EphemeralCertificate {\n    const variant = deserializer.deserializeUleb128AsU32();\n    switch (variant) {\n      case EphemeralCertificateVariant.ZkProof:\n        return new EphemeralCertificate(ZeroKnowledgeSig.deserialize(deserializer), variant);\n      default:\n        throw new Error(`Unknown variant index for EphemeralCertificate: ${variant}`);\n    }\n  }\n}\n\nclass G1Bytes extends Serializable {\n  data: Uint8Array;\n\n  constructor(data: HexInput) {\n    super();\n    this.data = Hex.fromHexInput(data).toUint8Array();\n    if (this.data.length !== 32) {\n      throw new Error(\"Input needs to be 32 bytes\");\n    }\n  }\n\n  serialize(serializer: Serializer): void {\n    serializer.serializeFixedBytes(this.data);\n  }\n\n  static deserialize(deserializer: Deserializer): G1Bytes {\n    const bytes = deserializer.deserializeFixedBytes(32);\n    return new G1Bytes(bytes);\n  }\n}\n\nclass G2Bytes extends Serializable {\n  data: Uint8Array;\n\n  constructor(data: HexInput) {\n    super();\n    this.data = Hex.fromHexInput(data).toUint8Array();\n    if (this.data.length !== 64) {\n      throw new Error(\"Input needs to be 64 bytes\");\n    }\n  }\n\n  serialize(serializer: Serializer): void {\n    serializer.serializeFixedBytes(this.data);\n  }\n\n  static deserialize(deserializer: Deserializer): G2Bytes {\n    const bytes = deserializer.deserializeFixedBytes(64);\n    return new G2Bytes(bytes);\n  }\n}\n\n/**\n * A representation of a Groth16 proof.  The points are the compressed serialization of affine reprentation of the proof.\n */\nexport class Groth16Zkp extends Proof {\n  /**\n   * The bytes of G1 proof point a\n   */\n  a: G1Bytes;\n\n  /**\n   * The bytes of G2 proof point b\n   */\n  b: G2Bytes;\n\n  /**\n   * The bytes of G1 proof point c\n   */\n  c: G1Bytes;\n\n  constructor(args: { a: HexInput; b: HexInput; c: HexInput }) {\n    super();\n    const { a, b, c } = args;\n    this.a = new G1Bytes(a);\n    this.b = new G2Bytes(b);\n    this.c = new G1Bytes(c);\n  }\n\n  serialize(serializer: Serializer): void {\n    this.a.serialize(serializer);\n    this.b.serialize(serializer);\n    this.c.serialize(serializer);\n  }\n\n  static deserialize(deserializer: Deserializer): Groth16Zkp {\n    const a = G1Bytes.deserialize(deserializer).bcsToBytes();\n    const b = G2Bytes.deserialize(deserializer).bcsToBytes();\n    const c = G1Bytes.deserialize(deserializer).bcsToBytes();\n    return new Groth16Zkp({ a, b, c });\n  }\n\n  hash(): Uint8Array {\n    const hash = sha3Hash.create();\n\n    hash.update(\"ENDLESS::Groth16Zkp\");\n\n    const prefix = hash.digest();\n\n    const body = this.bcsToBytes();\n\n    const mergedArray = new Uint8Array(prefix.length + body.length);\n    mergedArray.set(prefix);\n    mergedArray.set(body, prefix.length);\n\n    return mergedArray;\n  }\n}\n\n/**\n * The signature representation of a proof\n */\nexport class ZeroKnowledgeSig extends Signature {\n  /**\n   * The proof\n   */\n  readonly proof: Proof;\n\n  readonly nonMalleabilitySignature: EphemeralSignature;\n\n  /**\n   * The max lifespan of the proof\n   */\n  readonly expHorizonSecs: number;\n\n  /**\n   * A key value pair on the JWT token that can be specified on the signature which would reveal the value on chain.\n   * Can be used to assert identity or other attributes.\n   */\n  readonly extraField?: string;\n\n  /**\n   * The 'aud' value of the recovery service which is set when recovering an account.\n   */\n  readonly overrideAudVal?: string;\n\n  /**\n   * The training wheels signature\n   */\n  readonly trainingWheelsSignature?: EphemeralSignature;\n\n  constructor(args: {\n    proof: Proof;\n    nonMalleabilitySignature: EphemeralSignature;\n    expHorizonSecs: number;\n    extraField?: string;\n    overrideAudVal?: string;\n    trainingWheelsSignature?: EphemeralSignature;\n  }) {\n    super();\n    const { proof, expHorizonSecs, trainingWheelsSignature, extraField, overrideAudVal } = args;\n    this.proof = proof;\n    this.nonMalleabilitySignature = args.nonMalleabilitySignature;\n    this.expHorizonSecs = expHorizonSecs;\n    this.trainingWheelsSignature = trainingWheelsSignature;\n    this.extraField = extraField;\n    this.overrideAudVal = overrideAudVal;\n  }\n\n  /**\n   * Get the signature in bytes (Uint8Array).\n   *\n   * @returns Uint8Array representation of the signature\n   */\n  toUint8Array(): Uint8Array {\n    return this.bcsToBytes();\n  }\n\n  /**\n   * Return a ZeroKnowledgeSig object from its bcs serialization in bytes.\n   *\n   * @returns ZeroKnowledgeSig\n   */\n  static fromBytes(bytes: Uint8Array): ZeroKnowledgeSig {\n    return ZeroKnowledgeSig.deserialize(new Deserializer(bytes));\n  }\n\n  serialize(serializer: Serializer): void {\n    this.proof.serialize(serializer);\n    this.nonMalleabilitySignature.serialize(serializer);\n    serializer.serializeU64(this.expHorizonSecs);\n    serializer.serializeOptionStr(this.extraField);\n    serializer.serializeOptionStr(this.overrideAudVal);\n    serializer.serializeOption(this.trainingWheelsSignature);\n  }\n\n  static deserialize(deserializer: Deserializer): ZeroKnowledgeSig {\n    const proof = Groth16Zkp.deserialize(deserializer);\n    const nonMalleabilitySignature = EphemeralSignature.deserialize(deserializer);\n    const expHorizonSecs = Number(deserializer.deserializeU64());\n    const extraField = deserializer.deserializeOptionStr();\n    const overrideAudVal = deserializer.deserializeOptionStr();\n    const trainingWheelsSignature = deserializer.deserializeOption(EphemeralSignature);\n    return new ZeroKnowledgeSig({ proof, nonMalleabilitySignature, expHorizonSecs, trainingWheelsSignature, extraField, overrideAudVal });\n  }\n}\n\n/**\n * A class which represents the on-chain configuration for how Keyless accounts work\n */\nexport class KeylessConfiguration {\n  /**\n   * The verification key used to verify Groth16 proofs on chain\n   */\n  readonly verficationKey: Groth16VerificationKey;\n\n  /**\n   * The maximum lifespan of an ephemeral key pair.  This is configured on chain.\n   */\n  readonly maxExpHorizonSecs: number;\n\n  constructor(verficationKey: Groth16VerificationKey, maxExpHorizonSecs: number) {\n    this.verficationKey = verficationKey;\n    this.maxExpHorizonSecs = maxExpHorizonSecs;\n  }\n\n  static create(res: Groth16VerificationKeyResponse, maxExpHorizonSecs: number): KeylessConfiguration {\n    return new KeylessConfiguration(\n      new Groth16VerificationKey({\n        alphaG1: res.alpha_g1,\n        betaG2: res.beta_g2,\n        deltaG2: res.delta_g2,\n        gammaAbcG1: res.gamma_abc_g1,\n        gammaG2: res.gamma_g2,\n      }),\n      maxExpHorizonSecs,\n    );\n  }\n}\n\n/**\n * A representation of the verification key stored on chain used to verify Groth16 proofs\n */\nclass Groth16VerificationKey {\n  // The docstrings below are borrowed from ark-groth16\n\n  /**\n   * The `alpha * G`, where `G` is the generator of G1\n   */\n  readonly alphaG1: G1Bytes;\n\n  /**\n   * The `alpha * H`, where `H` is the generator of G2\n   */\n  readonly betaG2: G2Bytes;\n\n  /**\n   * The `delta * H`, where `H` is the generator of G2\n   */\n  readonly deltaG2: G2Bytes;\n\n  /**\n   * The `gamma^{-1} * (beta * a_i + alpha * b_i + c_i) * H`, where H is the generator of G1\n   */\n  readonly gammaAbcG1: G1Bytes[];\n\n  /**\n   * The `gamma * H`, where `H` is the generator of G2\n   */\n  readonly gammaG2: G2Bytes;\n\n  constructor(args: {\n    alphaG1: HexInput;\n    betaG2: HexInput;\n    deltaG2: HexInput;\n    gammaAbcG1: [HexInput, HexInput];\n    gammaG2: HexInput;\n  }) {\n    const { alphaG1, betaG2, deltaG2, gammaAbcG1, gammaG2 } = args;\n    this.alphaG1 = new G1Bytes(alphaG1);\n    this.betaG2 = new G2Bytes(betaG2);\n    this.deltaG2 = new G2Bytes(deltaG2);\n    this.gammaAbcG1 = [new G1Bytes(gammaAbcG1[0]), new G1Bytes(gammaAbcG1[1])];\n    this.gammaG2 = new G2Bytes(gammaG2);\n  }\n\n  static fromGroth16VerificationKeyResponse(res: Groth16VerificationKeyResponse): Groth16VerificationKey {\n    return new Groth16VerificationKey({\n      alphaG1: res.alpha_g1,\n      betaG2: res.beta_g2,\n      deltaG2: res.delta_g2,\n      gammaAbcG1: res.gamma_abc_g1,\n      gammaG2: res.gamma_g2,\n    });\n  }\n}\n\n/**\n * Gets the parameters of how Keyless Accounts are configured on chain including the verifying key and the max expiry horizon\n *\n * @param args.options.ledgerVersion The ledger version to query, if not provided it will get the latest version\n * @returns KeylessConfiguration\n */\nexport async function getKeylessConfig(args: {\n  endlessConfig: EndlessConfig;\n  options?: LedgerVersionArg;\n}): Promise<KeylessConfiguration> {\n  const { endlessConfig } = args;\n  return memoizeAsync(\n    async () => {\n      const config = await getKeylessConfigurationResource(args);\n      const vk = await getGroth16VerificationKeyResource(args);\n      return KeylessConfiguration.create(vk, Number(config.max_exp_horizon_secs));\n    },\n    `keyless-configuration-${endlessConfig.network}`,\n    1000 * 60 * 5, // 5 minutes\n  )();\n}\n\n/**\n * Gets the KeylessConfiguration set on chain\n *\n * @param args.options.ledgerVersion The ledger version to query, if not provided it will get the latest version\n * @returns KeylessConfigurationResponse\n */\nasync function getKeylessConfigurationResource(args: {\n  endlessConfig: EndlessConfig;\n  options?: LedgerVersionArg;\n}): Promise<KeylessConfigurationResponse> {\n  const { endlessConfig, options } = args;\n  const resourceType = \"0x1::openid_account::Configuration\";\n  const { data } = await getEndlessFullNode<{}, MoveResource<KeylessConfigurationResponse>>({\n    endlessConfig,\n    originMethod: \"getKeylessConfigurationResource\",\n    path: `accounts/${AccountAddress.from(\"0x1\").toString()}/resource/${resourceType}`,\n    params: { ledger_version: options?.ledgerVersion },\n  });\n\n  return data.data;\n}\n\n/**\n * Gets the Groth16VerificationKey set on chain\n *\n * @param args.options.ledgerVersion The ledger version to query, if not provided it will get the latest version\n * @returns Groth16VerificationKeyResponse\n */\nasync function getGroth16VerificationKeyResource(args: {\n  endlessConfig: EndlessConfig;\n  options?: LedgerVersionArg;\n}): Promise<Groth16VerificationKeyResponse> {\n  const { endlessConfig, options } = args;\n  const resourceType = \"0x1::openid_account::Groth16VerificationKey\";\n  const { data } = await getEndlessFullNode<{}, MoveResource<Groth16VerificationKeyResponse>>({\n    endlessConfig,\n    originMethod: \"getGroth16VerificationKeyResource\",\n    path: `accounts/${AccountAddress.from(\"0x1\").toString()}/resource/${resourceType}`,\n    params: { ledger_version: options?.ledgerVersion },\n  });\n\n  return data.data;\n}\n"],"mappings":"0jBAIA,OAAqB,aAAAA,MAAiB,aACtC,OAAS,YAAYC,MAAgB,qBAwB9B,IAAMC,GAAmB,IACnBC,EAAoB,IACpBC,EAAoB,GACpBC,EAAoB,IACpBC,GAAoB,IACpBC,GAAwB,IACxBC,GAA2B,IAC3BC,GAAyB,GAOzBC,EAAN,MAAMA,UAAyBC,CAAiB,CAkBrD,YAAYC,EAAaC,EAAwB,CAC/C,MAAM,EACN,IAAMC,EAAWC,EAAI,aAAaF,CAAY,EAAE,aAAa,EAC7D,GAAIC,EAAS,SAAWJ,EAAiB,qBACvC,MAAM,IAAI,MAAM,2CAA2CA,EAAiB,oBAAoB,EAAE,EAEpG,KAAK,IAAME,EACX,KAAK,aAAeE,CACtB,CAOA,SAA6B,CAC3B,IAAME,EAAa,IAAIC,EACvB,OAAAD,EAAW,uBAAiD,EAC5DA,EAAW,oBAAoB,KAAK,WAAW,CAAC,EACzCE,EAAkB,mBAAmB,CAC1C,SACA,MAAOF,EAAW,aAAa,CACjC,CAAC,CACH,CAOA,cAA2B,CACzB,OAAO,KAAK,WAAW,CACzB,CAOA,UAAmB,CACjB,OAAOD,EAAI,aAAa,KAAK,aAAa,CAAC,EAAE,SAAS,CACxD,CAUA,gBAAgBI,EAAmE,CACjF,MAAM,IAAI,MAAM,qBAAqB,CACvC,CAEA,UAAUH,EAA8B,CACtCA,EAAW,aAAa,KAAK,GAAG,EAChCA,EAAW,eAAe,KAAK,YAAY,CAC7C,CAEA,OAAO,YAAYI,EAA8C,CAC/D,IAAMR,EAAMQ,EAAa,eAAe,EAClCC,EAAcD,EAAa,iBAAiB,EAClD,OAAO,IAAIV,EAAiBE,EAAKS,CAAW,CAC9C,CAEA,OAAO,KAAKD,EAA8C,CACxD,IAAMR,EAAMQ,EAAa,eAAe,EAClCC,EAAcD,EAAa,iBAAiB,EAClD,OAAO,IAAIV,EAAiBE,EAAKS,CAAW,CAC9C,CAEA,OAAO,YAAYC,EAAqD,CACtE,OAAOA,aAAqBZ,CAC9B,CAYA,OAAO,OAAOS,EAMO,CACnB,OAAAI,EAAoBJ,CAAI,EACjB,IAAIT,EAAiBS,EAAK,IAAKI,EAAoBJ,CAAI,CAAC,CACjE,CAEA,OAAO,iBAAiBA,EAA4E,CAClG,GAAM,CAAE,IAAAK,EAAK,OAAAC,EAAQ,OAAAC,EAAS,KAAM,EAAIP,EAClCQ,EAAaC,EAAkDJ,CAAG,EAClEZ,EAAMe,EAAW,IACvB,GAAI,OAAOA,EAAW,KAAQ,SAC5B,MAAM,IAAI,MAAM,yCAAyC,EAE3D,IAAME,EAAMF,EAAW,IACjBG,EAASH,EAAWD,CAAM,EAChC,OAAOhB,EAAiB,OAAO,CAAE,IAAAE,EAAK,OAAAc,EAAQ,OAAAI,EAAQ,IAAAD,EAAK,OAAAJ,CAAO,CAAC,CACrE,CAEA,OAAO,WAAWH,EAAsB,CACtC,MACE,QAASA,GACT,OAAOA,EAAU,KAAQ,UACzB,iBAAkBA,GAClBA,EAAU,wBAAwB,UAEtC,CACF,EAvIaZ,EAIK,qBAA+B,GAJ1C,IAAMqB,EAANrB,EAyIP,SAASa,EAAoBJ,EAAqF,CAChH,GAAM,CAAE,OAAAO,EAAQ,OAAAI,EAAQ,IAAAD,EAAK,OAAAJ,CAAO,EAAIN,EAElCa,EAAS,CACbC,EAAgBlB,EAAI,aAAaU,CAAM,EAAE,aAAa,CAAC,EACvDS,EAAeL,EAAK1B,CAAiB,EACrC+B,EAAeJ,EAAQzB,CAAiB,EACxC6B,EAAeR,EAAQtB,CAAiB,CAC1C,EAEA,OAAO+B,EAAgBC,EAAaJ,CAAM,EAAGD,EAAiB,oBAAoB,CACpF,CAKO,IAAMM,EAAN,MAAMC,UAAyBC,CAAU,CA0B9C,YAAYpB,EAMT,CACD,MAAM,EACN,GAAM,CAAE,UAAAqB,EAAW,qBAAAC,EAAsB,eAAAC,EAAgB,mBAAAC,EAAoB,mBAAAC,CAAmB,EAAIzB,EACpG,KAAK,UAAYqB,EACjB,KAAK,qBAAuBC,EAC5B,KAAK,eAAiBC,EACtB,KAAK,mBAAqBC,EAC1B,KAAK,mBAAqBC,CAC5B,CAOA,cAA2B,CACzB,OAAO,KAAK,WAAW,CACzB,CAEA,UAAU5B,EAA8B,CACtC,KAAK,qBAAqB,UAAUA,CAAU,EAC9CA,EAAW,aAAa,KAAK,SAAS,EACtCA,EAAW,aAAa,KAAK,cAAc,EAC3C,KAAK,mBAAmB,UAAUA,CAAU,EAC5C,KAAK,mBAAmB,UAAUA,CAAU,CAC9C,CAEA,OAAO,YAAYI,EAA8C,CAC/D,IAAMqB,EAAuBI,EAAqB,YAAYzB,CAAY,EACpEoB,EAAYpB,EAAa,eAAe,EACxCsB,EAAiBtB,EAAa,eAAe,EAC7CuB,EAAqBG,EAAmB,YAAY1B,CAAY,EAChEwB,EAAqBG,EAAmB,YAAY3B,CAAY,EACtE,OAAO,IAAIkB,EAAiB,CAC1B,UAAAE,EACA,eAAgB,OAAOE,CAAc,EACrC,qBAAAD,EACA,mBAAAE,EACA,mBAAAC,CACF,CAAC,CACH,CAEA,OAAO,wBAA2C,CAChD,OAAO,IAAIN,EAAiB,CAC1B,UAAW,KACX,qBAAsB,IAAIO,EACxB,IAAIG,EAAiB,CACnB,MAAO,IAAIC,EAAW,CAAE,EAAG,IAAI,WAAW,EAAE,EAAG,EAAG,IAAI,WAAW,EAAE,EAAG,EAAG,IAAI,WAAW,EAAE,CAAE,CAAC,EAC7F,yBAA0B,IAAIF,EAAmB,IAAIG,EAAiB,IAAI,WAAW,EAAE,CAAC,CAAC,EACzF,eAAgB,CAClB,CAAC,GAEH,EACA,eAAgB,EAChB,mBAAoB,IAAIJ,EAAmB,IAAIK,EAAiB,IAAI,WAAW,EAAE,CAAC,CAAC,EACnF,mBAAoB,IAAIJ,EAAmB,IAAIG,EAAiB,IAAI,WAAW,EAAE,CAAC,CAAC,CACrF,CAAC,CACH,CAEA,OAAO,YAAYE,EAAqD,CACtE,OAAOA,aAAqBd,CAC9B,CACF,EAKaO,EAAN,MAAMQ,UAA6Bd,CAAU,CAQlD,YAAYa,EAAsBE,EAAsC,CACtE,MAAM,EACN,KAAK,UAAYF,EACjB,KAAK,QAAUE,CACjB,CAOA,cAA2B,CACzB,OAAO,KAAK,UAAU,aAAa,CACrC,CAEA,UAAUtC,EAA8B,CACtCA,EAAW,sBAAsB,KAAK,OAAO,EAC7C,KAAK,UAAU,UAAUA,CAAU,CACrC,CAEA,OAAO,YAAYI,EAAkD,CACnE,IAAMkC,EAAUlC,EAAa,wBAAwB,EACrD,OAAQkC,EAAS,CACf,OACE,OAAO,IAAID,EAAqBL,EAAiB,YAAY5B,CAAY,EAAGkC,CAAO,EACrF,QACE,MAAM,IAAI,MAAM,mDAAmDA,CAAO,EAAE,CAChF,CACF,CACF,EAEMC,EAAN,MAAMC,UAAgBC,CAAa,CAGjC,YAAYC,EAAgB,CAG1B,GAFA,MAAM,EACN,KAAK,KAAO3C,EAAI,aAAa2C,CAAI,EAAE,aAAa,EAC5C,KAAK,KAAK,SAAW,GACvB,MAAM,IAAI,MAAM,4BAA4B,CAEhD,CAEA,UAAU1C,EAA8B,CACtCA,EAAW,oBAAoB,KAAK,IAAI,CAC1C,CAEA,OAAO,YAAYI,EAAqC,CACtD,IAAMuC,EAAQvC,EAAa,sBAAsB,EAAE,EACnD,OAAO,IAAIoC,EAAQG,CAAK,CAC1B,CACF,EAEMC,EAAN,MAAMC,UAAgBJ,CAAa,CAGjC,YAAYC,EAAgB,CAG1B,GAFA,MAAM,EACN,KAAK,KAAO3C,EAAI,aAAa2C,CAAI,EAAE,aAAa,EAC5C,KAAK,KAAK,SAAW,GACvB,MAAM,IAAI,MAAM,4BAA4B,CAEhD,CAEA,UAAU1C,EAA8B,CACtCA,EAAW,oBAAoB,KAAK,IAAI,CAC1C,CAEA,OAAO,YAAYI,EAAqC,CACtD,IAAMuC,EAAQvC,EAAa,sBAAsB,EAAE,EACnD,OAAO,IAAIyC,EAAQF,CAAK,CAC1B,CACF,EAKaV,EAAN,MAAMa,UAAmBC,CAAM,CAgBpC,YAAY5C,EAAiD,CAC3D,MAAM,EACN,GAAM,CAAE,EAAA6C,EAAG,EAAAC,EAAG,EAAAC,CAAE,EAAI/C,EACpB,KAAK,EAAI,IAAIoC,EAAQS,CAAC,EACtB,KAAK,EAAI,IAAIJ,EAAQK,CAAC,EACtB,KAAK,EAAI,IAAIV,EAAQW,CAAC,CACxB,CAEA,UAAUlD,EAA8B,CACtC,KAAK,EAAE,UAAUA,CAAU,EAC3B,KAAK,EAAE,UAAUA,CAAU,EAC3B,KAAK,EAAE,UAAUA,CAAU,CAC7B,CAEA,OAAO,YAAYI,EAAwC,CACzD,IAAM4C,EAAIT,EAAQ,YAAYnC,CAAY,EAAE,WAAW,EACjD6C,EAAIL,EAAQ,YAAYxC,CAAY,EAAE,WAAW,EACjD8C,EAAIX,EAAQ,YAAYnC,CAAY,EAAE,WAAW,EACvD,OAAO,IAAI0C,EAAW,CAAE,EAAAE,EAAG,EAAAC,EAAG,EAAAC,CAAE,CAAC,CACnC,CAEA,MAAmB,CACjB,IAAMC,EAAOC,EAAS,OAAO,EAE7BD,EAAK,OAAO,qBAAqB,EAEjC,IAAME,EAASF,EAAK,OAAO,EAErBG,EAAO,KAAK,WAAW,EAEvBC,EAAc,IAAI,WAAWF,EAAO,OAASC,EAAK,MAAM,EAC9D,OAAAC,EAAY,IAAIF,CAAM,EACtBE,EAAY,IAAID,EAAMD,EAAO,MAAM,EAE5BE,CACT,CACF,EAKavB,EAAN,MAAMwB,UAAyBjC,CAAU,CA6B9C,YAAYpB,EAOT,CACD,MAAM,EACN,GAAM,CAAE,MAAAsD,EAAO,eAAAC,EAAgB,wBAAAC,EAAyB,WAAAC,EAAY,eAAAC,CAAe,EAAI1D,EACvF,KAAK,MAAQsD,EACb,KAAK,yBAA2BtD,EAAK,yBACrC,KAAK,eAAiBuD,EACtB,KAAK,wBAA0BC,EAC/B,KAAK,WAAaC,EAClB,KAAK,eAAiBC,CACxB,CAOA,cAA2B,CACzB,OAAO,KAAK,WAAW,CACzB,CAOA,OAAO,UAAUlB,EAAqC,CACpD,OAAOa,EAAiB,YAAY,IAAIM,EAAanB,CAAK,CAAC,CAC7D,CAEA,UAAU3C,EAA8B,CACtC,KAAK,MAAM,UAAUA,CAAU,EAC/B,KAAK,yBAAyB,UAAUA,CAAU,EAClDA,EAAW,aAAa,KAAK,cAAc,EAC3CA,EAAW,mBAAmB,KAAK,UAAU,EAC7CA,EAAW,mBAAmB,KAAK,cAAc,EACjDA,EAAW,gBAAgB,KAAK,uBAAuB,CACzD,CAEA,OAAO,YAAYI,EAA8C,CAC/D,IAAMqD,EAAQxB,EAAW,YAAY7B,CAAY,EAC3C2D,EAA2BhC,EAAmB,YAAY3B,CAAY,EACtEsD,EAAiB,OAAOtD,EAAa,eAAe,CAAC,EACrDwD,EAAaxD,EAAa,qBAAqB,EAC/CyD,EAAiBzD,EAAa,qBAAqB,EACnDuD,EAA0BvD,EAAa,kBAAkB2B,CAAkB,EACjF,OAAO,IAAIyB,EAAiB,CAAE,MAAAC,EAAO,yBAAAM,EAA0B,eAAAL,EAAgB,wBAAAC,EAAyB,WAAAC,EAAY,eAAAC,CAAe,CAAC,CACtI,CACF,EAKaG,EAAN,MAAMC,CAAqB,CAWhC,YAAYC,EAAwCC,EAA2B,CAC7E,KAAK,eAAiBD,EACtB,KAAK,kBAAoBC,CAC3B,CAEA,OAAO,OAAOC,EAAqCD,EAAiD,CAClG,OAAO,IAAIF,EACT,IAAII,EAAuB,CACzB,QAASD,EAAI,SACb,OAAQA,EAAI,QACZ,QAASA,EAAI,SACb,WAAYA,EAAI,aAChB,QAASA,EAAI,QACf,CAAC,EACDD,CACF,CACF,CACF,EAKME,EAAN,MAAMC,CAAuB,CA4B3B,YAAYnE,EAMT,CACD,GAAM,CAAE,QAAAoE,EAAS,OAAAC,EAAQ,QAAAC,EAAS,WAAAC,EAAY,QAAAC,CAAQ,EAAIxE,EAC1D,KAAK,QAAU,IAAIoC,EAAQgC,CAAO,EAClC,KAAK,OAAS,IAAI3B,EAAQ4B,CAAM,EAChC,KAAK,QAAU,IAAI5B,EAAQ6B,CAAO,EAClC,KAAK,WAAa,CAAC,IAAIlC,EAAQmC,EAAW,CAAC,CAAC,EAAG,IAAInC,EAAQmC,EAAW,CAAC,CAAC,CAAC,EACzE,KAAK,QAAU,IAAI9B,EAAQ+B,CAAO,CACpC,CAEA,OAAO,mCAAmCP,EAA6D,CACrG,OAAO,IAAIE,EAAuB,CAChC,QAASF,EAAI,SACb,OAAQA,EAAI,QACZ,QAASA,EAAI,SACb,WAAYA,EAAI,aAChB,QAASA,EAAI,QACf,CAAC,CACH,CACF,EAQA,eAAsBQ,GAAiBzE,EAGL,CAChC,GAAM,CAAE,cAAA0E,CAAc,EAAI1E,EAC1B,OAAO2E,EACL,SAAY,CACV,IAAMC,EAAS,MAAMC,EAAgC7E,CAAI,EACnD8E,EAAK,MAAMC,EAAkC/E,CAAI,EACvD,OAAO6D,EAAqB,OAAOiB,EAAI,OAAOF,EAAO,oBAAoB,CAAC,CAC5E,EACA,yBAAyBF,EAAc,OAAO,GAC9C,IAAO,GAAK,CACd,EAAE,CACJ,CAQA,eAAeG,EAAgC7E,EAGL,CACxC,GAAM,CAAE,cAAA0E,EAAe,QAAAM,CAAQ,EAAIhF,EAC7BiF,EAAe,qCACf,CAAE,KAAA1C,CAAK,EAAI,MAAM2C,EAAmE,CACxF,cAAAR,EACA,aAAc,kCACd,KAAM,YAAYS,EAAe,KAAK,KAAK,EAAE,SAAS,CAAC,aAAaF,CAAY,GAChF,OAAQ,CAAE,eAAgBD,GAAS,aAAc,CACnD,CAAC,EAED,OAAOzC,EAAK,IACd,CAQA,eAAewC,EAAkC/E,EAGL,CAC1C,GAAM,CAAE,cAAA0E,EAAe,QAAAM,CAAQ,EAAIhF,EAC7BiF,EAAe,8CACf,CAAE,KAAA1C,CAAK,EAAI,MAAM2C,EAAqE,CAC1F,cAAAR,EACA,aAAc,oCACd,KAAM,YAAYS,EAAe,KAAK,KAAK,EAAE,SAAS,CAAC,aAAaF,CAAY,GAChF,OAAQ,CAAE,eAAgBD,GAAS,aAAc,CACnD,CAAC,EAED,OAAOzC,EAAK,IACd","names":["jwtDecode","sha3Hash","EPK_HORIZON_SECS","MAX_AUD_VAL_BYTES","MAX_UID_KEY_BYTES","MAX_UID_VAL_BYTES","MAX_ISS_VAL_BYTES","MAX_EXTRA_FIELD_BYTES","MAX_JWT_HEADER_B64_BYTES","MAX_COMMITED_EPK_BYTES","_KeylessPublicKey","AccountPublicKey","iss","idCommitment","idcBytes","Hex","serializer","Serializer","AuthenticationKey","args","deserializer","addressSeed","publicKey","computeIdCommitment","jwt","pepper","uidKey","jwtPayload","jwtDecode","aud","uidVal","KeylessPublicKey","fields","bytesToBigIntLE","hashStrToField","bigIntToBytesLE","poseidonHash","KeylessSignature","_KeylessSignature","Signature","jwtHeader","ephemeralCertificate","expiryDateSecs","ephemeralPublicKey","ephemeralSignature","EphemeralCertificate","EphemeralPublicKey","EphemeralSignature","ZeroKnowledgeSig","Groth16Zkp","Ed25519Signature","Ed25519PublicKey","signature","_EphemeralCertificate","variant","G1Bytes","_G1Bytes","Serializable","data","bytes","G2Bytes","_G2Bytes","_Groth16Zkp","Proof","a","b","c","hash","sha3Hash","prefix","body","mergedArray","_ZeroKnowledgeSig","proof","expHorizonSecs","trainingWheelsSignature","extraField","overrideAudVal","Deserializer","nonMalleabilitySignature","KeylessConfiguration","_KeylessConfiguration","verficationKey","maxExpHorizonSecs","res","Groth16VerificationKey","_Groth16VerificationKey","alphaG1","betaG2","deltaG2","gammaAbcG1","gammaG2","getKeylessConfig","endlessConfig","memoizeAsync","config","getKeylessConfigurationResource","vk","getGroth16VerificationKeyResource","options","resourceType","getEndlessFullNode","AccountAddress"]}