@agirails/sdk 2.0.1-beta → 2.0.2

package/dist/protocol/ProofGenerator.js

@@ -3,38 +3,98 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ProofGenerator = void 0;
 const ethers_1 = require("ethers");
 const eip712_1 = require("../types/eip712");
+/**
+ * Default URL validation config - SECURE by default
+ */
+const DEFAULT_URL_CONFIG = {
+    allowedProtocols: ['https:'],
+    allowLocalhost: false,
+    maxSize: 10 * 1024 * 1024, // 10MB
+    timeout: 30000, // 30 seconds
+    blockedHosts: [
+        'metadata.google.internal',
+        '169.254.169.254', // AWS/GCP metadata
+        'metadata.aws.internal',
+        'localhost',
+        '127.0.0.1',
+        '0.0.0.0',
+        '[::1]',
+    ],
+};
+/**
+ * ProofGenerator - Content hashing and delivery proofs
+ * Reference: Yellow Paper §11.4.1
+ *
+ * SECURITY FIX (MEDIUM-2): Now includes URL validation for SSRF prevention
+ */
 class ProofGenerator {
+    /**
+     * Create ProofGenerator with optional URL validation config
+     *
+     * @param urlConfig - URL validation configuration for hashFromUrl()
+     */
+    constructor(urlConfig) {
+        this.urlConfig = {
+            ...DEFAULT_URL_CONFIG,
+            ...urlConfig,
+        };
+        // If localhost is explicitly allowed, remove from blocked hosts
+        if (urlConfig?.allowLocalhost) {
+            this.urlConfig.blockedHosts = this.urlConfig.blockedHosts.filter((h) => !['localhost', '127.0.0.1', '0.0.0.0', '[::1]'].includes(h));
+        }
+    }
+    /**
+     * Hash deliverable content
+     * Uses Keccak256 per Yellow Paper §11.4.1
+     */
     hashContent(content) {
         const buffer = typeof content === 'string' ? (0, ethers_1.toUtf8Bytes)(content) : content;
         return (0, ethers_1.keccak256)(buffer);
     }
+    /**
+     * Generate delivery proof (AIP-4)
+     * Reference: Yellow Paper §8.2
+     * Complete schema with type field for AIP compliance
+     * Computed fields (size, mimeType) cannot be overwritten
+     */
     generateDeliveryProof(params) {
         const { txId, deliverable, deliveryUrl, metadata = {} } = params;
         const contentHash = this.hashContent(deliverable);
         const size = typeof deliverable === 'string'
             ? Buffer.from(deliverable).length
             : deliverable.length;
+        // Spread user metadata first, then enforce computed fields
+        // This prevents users from spoofing size/mimeType
         const { size: _ignoredSize, mimeType: _ignoredMimeType, ...userMetadata } = metadata;
         return {
-            type: 'delivery.proof',
+            type: 'delivery.proof', // Required per AIP-4
             txId,
             contentHash,
             timestamp: Date.now(),
-            deliveryUrl,
+            deliveryUrl, // Optional: IPFS/Arweave link
             metadata: {
-                ...userMetadata,
-                size,
-                mimeType: metadata.mimeType || 'application/octet-stream'
+                ...userMetadata, // User-supplied fields (excluding reserved)
+                size, // Enforced: computed from deliverable
+                mimeType: metadata.mimeType || 'application/octet-stream' // Enforced with fallback
             }
         };
     }
+    /**
+     * Convert a generated delivery proof into typed EIP-712 data
+     */
     toDeliveryProofTypedData(proof) {
         return (0, eip712_1.deliveryProofDataFromProof)(proof);
     }
+    /**
+     * Encode proof for on-chain submission
+     */
     encodeProof(proof) {
         const abiCoder = ethers_1.AbiCoder.defaultAbiCoder();
         return abiCoder.encode(['bytes32', 'bytes32', 'uint256'], [proof.txId, proof.contentHash, proof.timestamp]);
     }
+    /**
+     * Decode proof from on-chain data
+     */
     decodeProof(proofData) {
         const abiCoder = ethers_1.AbiCoder.defaultAbiCoder();
         const [txId, contentHash, timestamp] = abiCoder.decode(['bytes32', 'bytes32', 'uint256'], proofData);
@@ -44,21 +104,146 @@ class ProofGenerator {
             timestamp: Number(timestamp)
         };
     }
+    /**
+     * Verify deliverable matches expected hash
+     */
     verifyDeliverable(deliverable, expectedHash) {
         const actualHash = this.hashContent(deliverable);
         return actualHash.toLowerCase() === expectedHash.toLowerCase();
     }
+    /**
+     * Generate content hash from URL (for IPFS/Arweave)
+     *
+     * SECURITY FIX (MEDIUM-2): Now includes:
+     * - Protocol validation (HTTPS only by default)
+     * - Hostname blocklist (prevents SSRF to internal services)
+     * - Size limits (prevents DoS via large responses)
+     * - Request timeout
+     *
+     * @param url - URL to fetch content from
+     * @returns Keccak256 hash of content
+     * @throws Error if URL is blocked, too large, or fetch fails
+     */
     async hashFromUrl(url) {
+        // SECURITY FIX (MEDIUM-2): Validate URL before fetching
+        this.validateUrl(url);
+        // In browser/Node.js environment with fetch
         try {
-            const response = await fetch(url);
-            const arrayBuffer = await response.arrayBuffer();
-            const buffer = Buffer.from(arrayBuffer);
-            return this.hashContent(buffer);
+            // Create AbortController for timeout
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), this.urlConfig.timeout);
+            try {
+                const response = await fetch(url, {
+                    signal: controller.signal,
+                    // Prevent following redirects to blocked hosts
+                    redirect: 'follow',
+                });
+                clearTimeout(timeoutId);
+                if (!response.ok) {
+                    throw new Error(`HTTP error: ${response.status} ${response.statusText}`);
+                }
+                // SECURITY FIX (MEDIUM-2): Check Content-Length header first
+                const contentLength = response.headers.get('content-length');
+                if (contentLength) {
+                    const size = parseInt(contentLength, 10);
+                    if (size > this.urlConfig.maxSize) {
+                        throw new Error(`Content too large: ${size} bytes exceeds maximum of ${this.urlConfig.maxSize} bytes`);
+                    }
+                }
+                // SECURITY FIX (MEDIUM-2): Read response with size limit
+                const chunks = [];
+                let totalSize = 0;
+                const reader = response.body?.getReader();
+                if (!reader) {
+                    throw new Error('Response body is not readable');
+                }
+                while (true) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    totalSize += value.length;
+                    // Check size limit during streaming
+                    if (totalSize > this.urlConfig.maxSize) {
+                        reader.cancel();
+                        throw new Error(`Content too large: ${totalSize}+ bytes exceeds maximum of ${this.urlConfig.maxSize} bytes`);
+                    }
+                    chunks.push(value);
+                }
+                // Concatenate chunks
+                const buffer = Buffer.concat(chunks.map(c => Buffer.from(c)));
+                return this.hashContent(buffer);
+            }
+            finally {
+                clearTimeout(timeoutId);
+            }
         }
         catch (error) {
+            if (error instanceof Error && error.name === 'AbortError') {
+                throw new Error(`Request timed out after ${this.urlConfig.timeout}ms for ${url}`);
+            }
             throw new Error(`Failed to fetch content from ${url}: ${error}`);
         }
     }
+    /**
+     * SECURITY FIX (MEDIUM-2): Validate URL against security rules
+     *
+     * @param url - URL to validate
+     * @throws Error if URL is not allowed
+     */
+    validateUrl(url) {
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            throw new Error(`Invalid URL: ${url}`);
+        }
+        // Check protocol
+        if (!this.urlConfig.allowedProtocols.includes(parsed.protocol)) {
+            throw new Error(`URL protocol "${parsed.protocol}" not allowed. ` +
+                `Allowed protocols: ${this.urlConfig.allowedProtocols.join(', ')}`);
+        }
+        // Check blocked hosts
+        const hostname = parsed.hostname.toLowerCase();
+        if (this.urlConfig.blockedHosts.includes(hostname)) {
+            throw new Error(`URL hostname "${hostname}" is blocked for security reasons. ` +
+                `This prevents SSRF attacks to internal services.`);
+        }
+        // Check for private IP ranges (additional SSRF protection)
+        if (this.isPrivateIP(hostname)) {
+            throw new Error(`URL hostname "${hostname}" resolves to a private IP address. ` +
+                `This is blocked for security reasons (SSRF prevention).`);
+        }
+    }
+    /**
+     * Check if hostname is a private IP address
+     *
+     * @param hostname - Hostname to check
+     * @returns true if hostname is a private IP
+     */
+    isPrivateIP(hostname) {
+        // IPv4 private ranges
+        const ipv4PrivateRanges = [
+            /^10\./, // 10.0.0.0 - 10.255.255.255
+            /^172\.(1[6-9]|2[0-9]|3[0-1])\./, // 172.16.0.0 - 172.31.255.255
+            /^192\.168\./, // 192.168.0.0 - 192.168.255.255
+            /^127\./, // 127.0.0.0 - 127.255.255.255 (loopback)
+            /^169\.254\./, // 169.254.0.0 - 169.254.255.255 (link-local)
+            /^0\./, // 0.0.0.0/8
+        ];
+        for (const range of ipv4PrivateRanges) {
+            if (range.test(hostname)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Get the URL validation config (for testing/inspection)
+     */
+    getUrlConfig() {
+        return { ...this.urlConfig };
+    }
 }
 exports.ProofGenerator = ProofGenerator;
 //# sourceMappingURL=ProofGenerator.js.map

package/dist/protocol/ProofGenerator.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProofGenerator.js","sourceRoot":"","sources":["../../src/protocol/ProofGenerator.ts"],"names":[],"mappings":";;;AAAA,mCAAqE;AAErE,4CAAgF;AAMhF,MAAa,cAAc;IAKzB,WAAW,CAAC,OAAwB;QAClC,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAE5E,OAAO,IAAA,kBAAS,EAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAQD,qBAAqB,CAAC,MAKrB;QACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC;QAEjE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,IAAI,GACR,OAAO,WAAW,KAAK,QAAQ;YAC7B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM;YACjC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;QAIzB,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,CAAC;QAErF,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,IAAI;YACJ,WAAW;YACX,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,WAAW;YACX,QAAQ,EAAE;gBACR,GAAG,YAAY;gBACf,IAAI;gBACJ,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,0BAA0B;aAC1D;SACF,CAAC;IACJ,CAAC;IAKD,wBAAwB,CAAC,KAAoB;QAC3C,OAAO,IAAA,mCAA0B,EAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAKD,WAAW,CAAC,KAAoB;QAC9B,MAAM,QAAQ,GAAG,iBAAQ,CAAC,eAAe,EAAE,CAAC;QAC5C,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,EACjC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CACjD,CAAC;IACJ,CAAC;IAKD,WAAW,CAAC,SAAoB;QAK9B,MAAM,QAAQ,GAAG,iBAAQ,CAAC,eAAe,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,MAAM,CACpD,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,EACjC,SAAS,CACV,CAAC;QAEF,OAAO;YACL,IAAI;YACJ,WAAW;YACX,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;SAC7B,CAAC;IACJ,CAAC;IAKD,iBAAiB,CAAC,WAA4B,EAAE,YAAoB;QAClE,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,WAAW,EAAE,CAAC;IACjE,CAAC;IAKD,KAAK,CAAC,WAAW,CAAC,GAAW;QAE3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;CACF;AA9GD,wCA8GC"}
+{"version":3,"file":"ProofGenerator.js","sourceRoot":"","sources":["../../src/protocol/ProofGenerator.ts"],"names":[],"mappings":";;;AAAA,mCAAqE;AAErE,4CAAgF;AAiChF;;GAEG;AACH,MAAM,kBAAkB,GAAkC;IACxD,gBAAgB,EAAE,CAAC,QAAQ,CAAC;IAC5B,cAAc,EAAE,KAAK;IACrB,OAAO,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;IAClC,OAAO,EAAE,KAAK,EAAE,aAAa;IAC7B,YAAY,EAAE;QACZ,0BAA0B;QAC1B,iBAAiB,EAAE,mBAAmB;QACtC,uBAAuB;QACvB,WAAW;QACX,WAAW;QACX,SAAS;QACT,OAAO;KACR;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAa,cAAc;IAGzB;;;;OAIG;IACH,YAAY,SAA+B;QACzC,IAAI,CAAC,SAAS,GAAG;YACf,GAAG,kBAAkB;YACrB,GAAG,SAAS;SACb,CAAC;QAEF,gEAAgE;QAChE,IAAI,SAAS,EAAE,cAAc,EAAE,CAAC;YAC9B,IAAI,CAAC,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAC9D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CACnE,CAAC;QACJ,CAAC;IACH,CAAC;IACD;;;OAGG;IACH,WAAW,CAAC,OAAwB;QAClC,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAE5E,OAAO,IAAA,kBAAS,EAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACH,qBAAqB,CAAC,MAKrB;QACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC;QAEjE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,IAAI,GACR,OAAO,WAAW,KAAK,QAAQ;YAC7B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM;YACjC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;QAEzB,2DAA2D;QAC3D,kDAAkD;QAClD,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,CAAC;QAErF,OAAO;YACL,IAAI,EAAE,gBAAgB,EAAE,qBAAqB;YAC7C,IAAI;YACJ,WAAW;YACX,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,WAAW,EAAE,8BAA8B;YAC3C,QAAQ,EAAE;gBACR,GAAG,YAAY,EAAE,4CAA4C;gBAC7D,IAAI,EAAE,sCAAsC;gBAC5C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,0BAA0B,CAAC,yBAAyB;aACpF;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,wBAAwB,CAAC,KAAoB;QAC3C,OAAO,IAAA,mCAA0B,EAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAoB;QAC9B,MAAM,QAAQ,GAAG,iBAAQ,CAAC,eAAe,EAAE,CAAC;QAC5C,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,EACjC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CACjD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,SAAoB;QAK9B,MAAM,QAAQ,GAAG,iBAAQ,CAAC,eAAe,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,MAAM,CACpD,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,EACjC,SAAS,CACV,CAAC;QAEF,OAAO;YACL,IAAI;YACJ,WAAW;YACX,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;SAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,WAA4B,EAAE,YAAoB;QAClE,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,WAAW,EAAE,CAAC;IACjE,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,WAAW,CAAC,GAAW;QAC3B,wDAAwD;QACxD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAEtB,4CAA4C;QAC5C,IAAI,CAAC;YACH,qCAAqC;YACrC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAE/E,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBAChC,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,+CAA+C;oBAC/C,QAAQ,EAAE,QAAQ;iBACnB,CAAC,CAAC;gBAEH,YAAY,CAAC,SAAS,CAAC,CAAC;gBAExB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC3E,CAAC;gBAED,6DAA6D;gBAC7D,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBAC7D,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;oBACzC,IAAI,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;wBAClC,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,6BAA6B,IAAI,CAAC,SAAS,CAAC,OAAO,QAAQ,CACtF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,yDAAyD;gBACzD,MAAM,MAAM,GAAiB,EAAE,CAAC;gBAChC,IAAI,SAAS,GAAG,CAAC,CAAC;gBAClB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;gBAE1C,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBACnD,CAAC;gBAED,OAAO,IAAI,EAAE,CAAC;oBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAE5C,IAAI,IAAI;wBAAE,MAAM;oBAEhB,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;oBAE1B,oCAAoC;oBACpC,IAAI,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;wBACvC,MAAM,CAAC,MAAM,EAAE,CAAC;wBAChB,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,8BAA8B,IAAI,CAAC,SAAS,CAAC,OAAO,QAAQ,CAC5F,CAAC;oBACJ,CAAC;oBAED,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;gBAED,qBAAqB;gBACrB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9D,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAClC,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,OAAO,UAAU,GAAG,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,MAAW,CAAC;QAEhB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,iBAAiB;QACjB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,iBAAiB,MAAM,CAAC,QAAQ,iBAAiB;gBACjD,sBAAsB,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnE,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,iBAAiB,QAAQ,qCAAqC;gBAC9D,kDAAkD,CACnD,CAAC;QACJ,CAAC;QAED,2DAA2D;QAC3D,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,iBAAiB,QAAQ,sCAAsC;gBAC/D,yDAAyD,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,WAAW,CAAC,QAAgB;QAClC,sBAAsB;QACtB,MAAM,iBAAiB,GAAG;YACxB,OAAO,EAAW,4BAA4B;YAC9C,gCAAgC,EAAE,8BAA8B;YAChE,aAAa,EAAK,gCAAgC;YAClD,QAAQ,EAAU,yCAAyC;YAC3D,aAAa,EAAK,6CAA6C;YAC/D,MAAM,EAAY,YAAY;SAC/B,CAAC;QAEF,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAC/B,CAAC;CACF;AArRD,wCAqRC"}

package/dist/protocol/QuoteBuilder.d.ts

@@ -1,2 +1,10 @@
+/**
+ * QuoteBuilder - AIP-2 Price Quote Construction
+ *
+ * This module re-exports the full QuoteBuilder implementation from builders/
+ * Reference: AIP-2 §6.1
+ *
+ * @deprecated Import from builders/QuoteBuilder directly
+ */
 export { QuoteBuilder, QuoteMessage, QuoteParams, AIP2QuoteTypes } from '../builders/QuoteBuilder';
 //# sourceMappingURL=QuoteBuilder.d.ts.map

package/dist/protocol/QuoteBuilder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"QuoteBuilder.d.ts","sourceRoot":"","sources":["../../src/protocol/QuoteBuilder.ts"],"names":[],"mappings":"AASA,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,cAAc,EACf,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"QuoteBuilder.d.ts","sourceRoot":"","sources":["../../src/protocol/QuoteBuilder.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,cAAc,EACf,MAAM,0BAA0B,CAAC"}

package/dist/protocol/QuoteBuilder.js

@@ -1,4 +1,12 @@
 "use strict";
+/**
+ * QuoteBuilder - AIP-2 Price Quote Construction
+ *
+ * This module re-exports the full QuoteBuilder implementation from builders/
+ * Reference: AIP-2 §6.1
+ *
+ * @deprecated Import from builders/QuoteBuilder directly
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AIP2QuoteTypes = exports.QuoteBuilder = void 0;
 var QuoteBuilder_1 = require("../builders/QuoteBuilder");

package/dist/protocol/QuoteBuilder.js.map

@@ -1 +1 @@
-{"version":3,"file":"QuoteBuilder.js","sourceRoot":"","sources":["../../src/protocol/QuoteBuilder.ts"],"names":[],"mappings":";;;AASA,yDAKkC;AAJhC,4GAAA,YAAY,OAAA;AAGZ,8GAAA,cAAc,OAAA"}
+{"version":3,"file":"QuoteBuilder.js","sourceRoot":"","sources":["../../src/protocol/QuoteBuilder.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,yDAKkC;AAJhC,4GAAA,YAAY,OAAA;AAGZ,8GAAA,cAAc,OAAA"}

package/dist/runtime/BlockchainRuntime.d.ts

@@ -0,0 +1,360 @@
+/**
+ * BlockchainRuntime - Real blockchain implementation of ACTP protocol
+ *
+ * Implements IACTPRuntime interface using actual smart contracts deployed
+ * on Base Sepolia (testnet) or Base Mainnet (production).
+ *
+ * Features:
+ * - Real blockchain transactions via ethers.js
+ * - ACTPKernel smart contract integration
+ * - EscrowVault contract integration
+ * - EIP-712 message signing support
+ * - Event monitoring and indexing
+ * - Gas optimization
+ *
+ * @module runtime/BlockchainRuntime
+ */
+import { Signer, JsonRpcProvider } from 'ethers';
+import { ACTPKernel } from '../protocol/ACTPKernel';
+import { EscrowVault } from '../protocol/EscrowVault';
+import { EventMonitor } from '../protocol/EventMonitor';
+import { MessageSigner } from '../protocol/MessageSigner';
+import { EASHelper, EASConfig } from '../protocol/EASHelper';
+import { NetworkConfig } from '../config/networks';
+import { IACTPRuntime, CreateTransactionParams } from './IACTPRuntime';
+import { MockTransaction, TransactionState } from './types/MockState';
+import { IUsedAttestationTracker } from '../utils/UsedAttestationTracker';
+import { IReceivedNonceTracker } from '../utils/ReceivedNonceTracker';
+/**
+ * Configuration for BlockchainRuntime
+ */
+export interface BlockchainRuntimeConfig {
+    /** Network to connect to */
+    network: 'base-sepolia' | 'base-mainnet';
+    /** Ethers signer for transaction signing */
+    signer: Signer;
+    /** Ethers provider for blockchain queries */
+    provider: JsonRpcProvider;
+    /** Optional contract address overrides */
+    contracts?: {
+        actpKernel?: string;
+        escrowVault?: string;
+        usdc?: string;
+        eas?: string;
+    };
+    /** Optional gas settings */
+    gasSettings?: {
+        maxFeePerGas?: bigint;
+        maxPriorityFeePerGas?: bigint;
+    };
+    /** EAS (Ethereum Attestation Service) configuration for delivery proof verification */
+    easConfig?: EASConfig;
+    /**
+     * SECURITY FIX (CRITICAL-2): Require attestation verification before escrow release
+     * When true, releaseEscrow() will require a valid EAS attestation
+     * Default: false for backward compatibility, SHOULD be true in production
+     */
+    requireAttestation?: boolean;
+    /**
+     * State directory for persistent attestation tracking
+     * If provided, attestation replay protection will survive restarts
+     */
+    stateDirectory?: string;
+}
+/**
+ * BlockchainRuntime - Production blockchain implementation
+ *
+ * Bridges the IACTPRuntime interface to actual smart contracts.
+ * Provides seamless migration path from MockRuntime to production.
+ *
+ * @example
+ * ```typescript
+ * const provider = new ethers.JsonRpcProvider(rpcUrl);
+ * const signer = new ethers.Wallet(privateKey, provider);
+ *
+ * const runtime = new BlockchainRuntime({
+ *   network: 'base-sepolia',
+ *   signer,
+ *   provider
+ * });
+ *
+ * // Now use with adapters
+ * const adapter = new BeginnerAdapter(runtime, requesterAddress);
+ * await adapter.createJob({...});
+ * ```
+ */
+export declare class BlockchainRuntime implements IACTPRuntime {
+    private readonly kernel;
+    private readonly escrow;
+    private readonly events;
+    private messageSigner;
+    private easHelper;
+    private readonly attestationTracker;
+    private readonly requireAttestation;
+    private readonly nonceTracker;
+    private readonly networkConfig;
+    private readonly provider;
+    private readonly signer;
+    private readonly easConfig?;
+    private reconnectAttempts;
+    private readonly maxReconnectAttempts;
+    private readonly baseReconnectDelay;
+    private lastConnectionCheck;
+    private readonly connectionCheckInterval;
+    /**
+     * Create new BlockchainRuntime instance
+     *
+     * @param config - Runtime configuration
+     */
+    constructor(config: BlockchainRuntimeConfig);
+    /**
+     * Initialize async components (must be called after construction)
+     *
+     * CRITICAL: This method MUST be called before using the runtime.
+     * It initializes the MessageSigner with proper EIP-712 domain and
+     * optionally the EASHelper for attestation verification.
+     *
+     * SECURITY FIX (CHAINID-VALIDATION): Validates that the connected network
+     * matches the expected network configuration to prevent cross-chain attacks.
+     *
+     * @example
+     * ```typescript
+     * const runtime = new BlockchainRuntime(config);
+     * await runtime.initialize();
+     * ```
+     */
+    initialize(): Promise<void>;
+    /**
+     * Check if runtime has been initialized
+     * @returns true if initialize() has been called
+     */
+    isInitialized(): boolean;
+    /**
+     * Require initialization before use
+     *
+     * SECURITY FIX (M-4): Enforces initialize() call before operations
+     * @throws Error if initialize() has not been called
+     */
+    private requireInitialized;
+    /**
+     * Ensure provider connection is healthy with automatic reconnection
+     *
+     * SECURITY FIX (HIGH-3): Implements exponential backoff reconnection
+     * to handle transient network failures gracefully.
+     *
+     * SECURITY FIX (H-4): Converted from recursive to iterative loop
+     * to prevent stack overflow on prolonged network failures.
+     *
+     * @throws Error if connection cannot be established after max attempts
+     */
+    private ensureConnected;
+    /**
+     * Get provider connection status
+     *
+     * SECURITY FIX (HIGH-3): Monitoring method for connection health
+     *
+     * @returns Connection status information
+     */
+    getConnectionStatus(): {
+        isHealthy: boolean;
+        reconnectAttempts: number;
+        maxReconnectAttempts: number;
+        lastCheckTimestamp: number;
+    };
+    /**
+     * Creates a new transaction on-chain
+     *
+     * @param params - Transaction creation parameters
+     * @returns Promise resolving to transaction ID (bytes32 hex string)
+     */
+    createTransaction(params: CreateTransactionParams): Promise<string>;
+    /**
+     * Links escrow to a transaction and locks funds
+     *
+     * SIMPLIFICATION (ESCROW-ID): Uses txId as escrowId.
+     * Per ACTP standard, escrowId = txId simplifies tracking and eliminates
+     * the need for separate escrowId→txId mapping.
+     *
+     * @param txId - Transaction ID
+     * @param amount - Amount to lock (must match transaction amount)
+     * @returns Promise resolving to escrow ID (same as txId)
+     */
+    linkEscrow(txId: string, amount: string): Promise<string>;
+    /**
+     * Transitions a transaction to a new state
+     *
+     * SECURITY FIX (PROOF-PARAM): Added optional proof parameter for DELIVERED state.
+     * The kernel contract uses proof data for dispute window configuration and
+     * delivery verification. Without proof, default dispute window applies.
+     *
+     * @param txId - Transaction ID
+     * @param newState - Target state
+     * @param proof - Optional proof data (hex string, e.g., ABI-encoded delivery proof)
+     */
+    transitionState(txId: string, newState: TransactionState, proof?: string): Promise<void>;
+    /**
+     * Gets a transaction by ID
+     *
+     * @param txId - Transaction ID
+     * @returns Promise resolving to transaction or null if not found
+     */
+    getTransaction(txId: string): Promise<MockTransaction | null>;
+    /**
+     * Gets all transactions
+     *
+     * @returns Promise resolving to array of all transactions
+     */
+    getAllTransactions(): Promise<MockTransaction[]>;
+    /**
+     * Releases escrow funds to provider by settling the transaction
+     *
+     * SECURITY FIX (CRITICAL-2): This method now validates:
+     * 1. Transaction state is DELIVERED
+     * 2. Dispute window has elapsed
+     * 3. EAS attestation is valid (if requireAttestation is true)
+     *
+     * SECURITY FIX (SETTLEMENT-FLOW): Uses transitionState(SETTLED) instead of
+     * direct releaseEscrow() call. Per ACTPKernel.sol, settlement via state transition
+     * automatically handles escrow release through _releaseEscrow() internal call.
+     * This ensures proper state machine progression and event emission.
+     *
+     * SIMPLIFICATION (ESCROW-ID): Uses escrowId = txId standard.
+     * The on-chain contract uses txId as the escrow identifier, so we simply
+     * treat escrowId and txId as equivalent (no complex parsing needed).
+     *
+     * @param escrowId - Escrow ID (equivalent to txId in ACTP standard)
+     * @param attestationUID - Optional EAS attestation UID for verification
+     * @throws Error if transaction not found, not in DELIVERED state, or attestation invalid
+     */
+    releaseEscrow(escrowId: string, attestationUID?: string): Promise<void>;
+    /**
+     * Gets escrow balance
+     *
+     * MEDIUM: Returns the locked balance for a transaction from the escrow vault.
+     * Queries the EscrowVault contract for the actual balance.
+     *
+     * @param escrowId - Escrow ID or transaction ID
+     * @returns Promise resolving to balance as string (in USDC wei)
+     */
+    getEscrowBalance(escrowId: string): Promise<string>;
+    /**
+     * Time interface (uses real blockchain time)
+     */
+    readonly time: {
+        /**
+         * Get current blockchain timestamp
+         */
+        now: () => number;
+    };
+    /**
+     * Get the current signer address
+     */
+    getAddress(): Promise<string>;
+    /**
+     * Get current block number
+     */
+    getBlockNumber(): Promise<number>;
+    /**
+     * Get network configuration
+     */
+    getNetworkConfig(): NetworkConfig;
+    /**
+     * Get ACTPKernel instance (for advanced usage)
+     */
+    getKernel(): ACTPKernel;
+    /**
+     * Get EscrowVault instance (for advanced usage)
+     */
+    getEscrow(): EscrowVault;
+    /**
+     * Get EventMonitor instance (for advanced usage)
+     */
+    getEvents(): EventMonitor;
+    /**
+     * Get MessageSigner instance (for advanced usage)
+     *
+     * @throws Error if initialize() has not been called
+     */
+    getMessageSigner(): MessageSigner;
+    /**
+     * Get EASHelper instance (for attestation operations)
+     *
+     * @throws Error if EAS config not provided or initialize() not called
+     */
+    getEASHelper(): EASHelper;
+    /**
+     * Get attestation tracker instance
+     */
+    getAttestationTracker(): IUsedAttestationTracker;
+    /**
+     * Get nonce tracker instance (for monitoring/debugging)
+     *
+     * SECURITY FIX (MEDIUM-9): Exposed for monitoring nonce replay protection
+     */
+    getNonceTracker(): IReceivedNonceTracker;
+    /**
+     * Check if attestation verification is required
+     */
+    isAttestationRequired(): boolean;
+    /**
+     * Validate and normalize service hash for on-chain storage
+     *
+     * SECURITY FIX (CRITICAL): ACTPKernel expects bytes32 serviceHash.
+     * This method validates format and hashes raw strings if needed.
+     *
+     * @param serviceDescription - Service hash or description string
+     * @returns Valid bytes32 hash
+     */
+    private validateServiceHash;
+    /**
+     * Estimate gas for createTransaction operation
+     *
+     * SECURITY FIX (M-2): Pre-transaction gas estimation helps:
+     * - Prevent failed transactions due to insufficient gas
+     * - Allow users to make informed decisions about costs
+     * - Catch potential issues before spending gas
+     *
+     * @param params - Transaction parameters
+     * @returns Estimated gas limit and cost in wei
+     */
+    estimateCreateTransactionGas(params: CreateTransactionParams): Promise<{
+        gasLimit: bigint;
+        gasCostWei: bigint;
+        gasCostGwei: string;
+    }>;
+    /**
+     * Estimate gas for linkEscrow operation
+     *
+     * @param txId - Transaction ID
+     * @returns Estimated gas limit and cost
+     */
+    estimateLinkEscrowGas(txId: string): Promise<{
+        gasLimit: bigint;
+        gasCostWei: bigint;
+        gasCostGwei: string;
+    }>;
+    /**
+     * Estimate gas for state transition
+     *
+     * @param txId - Transaction ID
+     * @param newState - Target state
+     * @returns Estimated gas limit and cost
+     */
+    estimateTransitionGas(txId: string, newState: string): Promise<{
+        gasLimit: bigint;
+        gasCostWei: bigint;
+        gasCostGwei: string;
+    }>;
+    /**
+     * Get current gas price information
+     *
+     * @returns Current gas price data
+     */
+    getGasPrice(): Promise<{
+        gasPrice: bigint;
+        gasPriceGwei: string;
+        maxFeePerGas?: bigint;
+        maxPriorityFeePerGas?: bigint;
+    }>;
+}
+//# sourceMappingURL=BlockchainRuntime.d.ts.map

package/dist/runtime/BlockchainRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BlockchainRuntime.d.ts","sourceRoot":"","sources":["../../src/runtime/BlockchainRuntime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAU,MAAM,EAAE,eAAe,EAA0B,MAAM,QAAQ,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAc,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGtE,OAAO,EAAE,uBAAuB,EAAgC,MAAM,iCAAiC,CAAC;AACxG,OAAO,EAAE,qBAAqB,EAA8B,MAAM,+BAA+B,CAAC;AAElG;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,4BAA4B;IAC5B,OAAO,EAAE,cAAc,GAAG,cAAc,CAAC;IACzC,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,QAAQ,EAAE,eAAe,CAAC;IAC1B,0CAA0C;IAC1C,SAAS,CAAC,EAAE;QACV,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IACF,4BAA4B;IAC5B,WAAW,CAAC,EAAE;QACZ,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,uFAAuF;IACvF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,iBAAkB,YAAW,YAAY;IACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IAEtC,OAAO,CAAC,aAAa,CAA8B;IAEnD,OAAO,CAAC,SAAS,CAA0B;IAE3C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA0B;IAE7D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAU;IAE7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwB;IACrD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAY;IAGvC,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAK;IAC1C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAQ;IAC3C,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IAEjD;;;;OAIG;gBACS,MAAM,EAAE,uBAAuB;IA8D3C;;;;;;;;;;;;;;;OAeG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAgEjC;;;OAGG;IACH,aAAa,IAAI,OAAO;IAIxB;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;;;;;;;;;OAUG;YACW,eAAe;IA4C7B;;;;;;OAMG;IACH,mBAAmB,IAAI;QACrB,SAAS,EAAE,OAAO,CAAC;QACnB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,kBAAkB,EAAE,MAAM,CAAC;KAC5B;IASD;;;;;OAKG;IACG,iBAAiB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;IAsCzE;;;;;;;;;;OAUG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuC/D;;;;;;;;;;OAUG;IACG,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B9F;;;;;OAKG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAqDnE;;;;OAIG;IACG,kBAAkB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAStD;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2G7E;;;;;;;;OAQG;IACG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA+BzD;;OAEG;IACH,SAAgB,IAAI;QAClB;;WAEG;mBACM,MAAM;MAGf;IAMF;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAInC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAIvC;;OAEG;IACH,gBAAgB,IAAI,aAAa;IAIjC;;OAEG;IACH,SAAS,IAAI,UAAU;IAIvB;;OAEG;IACH,SAAS,IAAI,WAAW;IAIxB;;OAEG;IACH,SAAS,IAAI,YAAY;IAIzB;;;;OAIG;IACH,gBAAgB,IAAI,aAAa;IAUjC;;;;OAIG;IACH,YAAY,IAAI,SAAS;IASzB;;OAEG;IACH,qBAAqB,IAAI,uBAAuB;IAIhD;;;;OAIG;IACH,eAAe,IAAI,qBAAqB;IAIxC;;OAEG;IACH,qBAAqB,IAAI,OAAO;IAIhC;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;IA0B3B;;;;;;;;;;OAUG;IACG,4BAA4B,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC;QAC3E,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAmBF;;;;;OAKG;IACG,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QACjD,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAiBF;;;;;;OAMG;IACG,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACnE,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAiBF;;;;OAIG;IACG,WAAW,IAAI,OAAO,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;CAUH"}