@azeth/sdk 0.2.0

package/dist/payments/x402.js

@@ -0,0 +1,620 @@
+import { getAddress, toHex, encodeAbiParameters, } from 'viem';
+import { AzethError, formatTokenAmount, TOKENS } from '@azeth/common';
+import { withRetry } from '../utils/retry.js';
+import { createSIWxPayload, encodeSIWxHeader, } from '@x402/extensions/sign-in-with-x';
+/** USDC Transfer(address,address,uint256) event signature — keccak256('Transfer(address,address,uint256)') */
+const TRANSFER_EVENT_TOPIC = '0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef';
+/** Verify that a settlement receipt contains a USDC Transfer event matching expectations.
+ *
+ *  Decodes Transfer event logs from the receipt and checks:
+ *  - Transfer emitted from the expected USDC contract address
+ *  - Recipient (`to`) matches the expected payTo address
+ *  - Amount (`value`) >= the expected payment amount
+ *
+ *  @returns true if a matching Transfer event was found, false otherwise
+ */
+export function verifySettlementReceipt(receipt, expectedPayTo, expectedAsset, expectedAmount) {
+    const payToLower = expectedPayTo.toLowerCase();
+    const assetLower = expectedAsset.toLowerCase();
+    for (const log of receipt.logs) {
+        // Must be from the expected USDC contract
+        if (log.address.toLowerCase() !== assetLower)
+            continue;
+        if (log.topics.length < 3)
+            continue;
+        // topics[0] = Transfer event signature
+        if (log.topics[0] !== TRANSFER_EVENT_TOPIC)
+            continue;
+        // topics[2] = indexed `to` address (left-padded to 32 bytes)
+        const toAddress = `0x${log.topics[2].slice(26)}`.toLowerCase();
+        if (toAddress !== payToLower)
+            continue;
+        // data = uint256 value
+        const value = BigInt(log.data);
+        if (value >= expectedAmount)
+            return true;
+    }
+    return false;
+}
+/** Known USDC contract addresses per chain ID, used to validate x402 payment assets.
+ *  EIP-712 domain name differs between chains: mainnet uses "USD Coin", Sepolia uses "USDC". */
+const KNOWN_USDC = {
+    8453: { address: TOKENS.base.USDC.toLowerCase(), name: 'USD Coin', version: '2' },
+    84532: { address: TOKENS.baseSepolia.USDC.toLowerCase(), name: 'USDC', version: '2' },
+};
+/** Default maximum payment amount: 10 USDC (6 decimals) */
+const DEFAULT_MAX_AMOUNT = 10000000n;
+/** Maximum allowed validBefore window in seconds.
+ *  HIGH-6 fix: Increased from 60 to 300 seconds. The 60s cap was too aggressive —
+ *  during chain congestion, the server may need >60s to settle the ERC-3009 authorization.
+ *  If settlement fails due to expiry, the client gets free service. 300s matches the x402
+ *  spec default and is safe because each authorization is amount-locked and nonce-unique.
+ *
+ *  MEDIUM-3 (Audit): Trade-off — a 300s window means a captured (but unsettled) authorization
+ *  remains valid for up to 5 minutes. This is acceptable because: (1) each authorization is
+ *  nonce-unique so it can only be settled once, (2) the amount is exact (no over-authorization),
+ *  and (3) reducing the window increases settlement failures during congestion, which gives
+ *  the client free service (worse outcome for the server). */
+const MAX_VALID_BEFORE_SECONDS = 300;
+/** Fetch a URL, automatically paying x402 requirements
+ *
+ *  Flow:
+ *  1. Make initial request
+ *  2. If 402 returned, parse payment requirements from X-Payment-Required header
+ *  3. If SIWx extension present and smartAccount provided, attempt identity proof
+ *  4. If SIWx grants access, return (no payment needed)
+ *  5. If smartAccountTransfer callback provided, pay via smart account UserOp
+ *     (guardian guardrails enforced on-chain). Throws on failure — NO EOA fallback.
+ *  6. Otherwise (no smart account), sign ERC-3009 transferWithAuthorization from EOA
+ *  7. Retry with payment proof header
+ *
+ *  SECURITY: When a smart account is configured (smartAccountTransfer + smartAccount),
+ *  the EOA payment path is unreachable. This prevents guardian guardrail bypass.
+ */
+export async function fetch402(publicClient, walletClient, account, url, options) {
+    const method = options?.method ?? 'GET';
+    const headers = new Headers(options?.headers);
+    // MEDIUM-8 fix: Add 30-second timeout to prevent indefinite hangs from slow/malicious servers
+    const fetchTimeout = 30_000;
+    // Initial request (retryable -- idempotent read)
+    let response;
+    try {
+        response = await withRetry(() => fetch(url, {
+            method,
+            headers,
+            body: options?.body,
+            signal: AbortSignal.timeout(fetchTimeout),
+        }));
+    }
+    catch (err) {
+        if (err instanceof AzethError)
+            throw err;
+        throw new AzethError(err instanceof Error ? err.message : 'Failed to reach service', 'NETWORK_ERROR', { originalError: err instanceof Error ? err.name : undefined, url });
+    }
+    if (response.status !== 402) {
+        return { response, paymentMade: false, settlementVerified: false, paymentMethod: 'none' };
+    }
+    // Parse 402 payment requirement — v2 header first, fall back to v1
+    const requirementHeader = response.headers.get('PAYMENT-REQUIRED') ?? response.headers.get('X-Payment-Required');
+    if (!requirementHeader) {
+        return { response, paymentMade: false, settlementVerified: false, paymentMethod: 'none' };
+    }
+    let requirement;
+    // v2: preserve the original accept object and resource for echo-back in payment proof
+    let v2Accept;
+    try {
+        // x402v2 base64-encodes the PAYMENT-REQUIRED header; v1 sends raw JSON.
+        // Try base64 decode first, fall back to raw JSON for v1 compatibility.
+        let jsonStr;
+        try {
+            jsonStr = atob(requirementHeader);
+            if (!jsonStr.startsWith('{') && !jsonStr.startsWith('['))
+                throw new Error('not base64 JSON');
+        }
+        catch {
+            jsonStr = requirementHeader;
+        }
+        const parsed = JSON.parse(jsonStr);
+        // Normalize x402 v2 envelope to flat v1 requirement shape.
+        // v2 wraps payment options in an `accepts` array; v1 uses flat fields.
+        if (parsed.accepts && Array.isArray(parsed.accepts) && parsed.accepts.length > 0) {
+            const accept = parsed.accepts[0];
+            const resource = parsed.resource ?? {};
+            // Preserve the EXACT original accept object for v2 echo-back.
+            // The server uses deepEqual to match accepted against its requirements.
+            v2Accept = accept;
+            requirement = {
+                scheme: accept.scheme ?? 'exact',
+                network: accept.network ?? '',
+                maxAmountRequired: accept.amount ?? '0',
+                resource: resource.url ?? '',
+                description: resource.description ?? '',
+                mimeType: resource.mimeType ?? 'application/json',
+                payTo: accept.payTo,
+                maxTimeoutSeconds: accept.maxTimeoutSeconds ?? 300,
+                asset: accept.asset,
+                extra: accept.extra,
+            };
+            // Preserve extensions and resource on the requirement for downstream use
+            requirement.extensions = parsed.extensions;
+            requirement.__resource = resource;
+        }
+        else {
+            requirement = parsed;
+        }
+    }
+    catch {
+        throw new AzethError('Failed to parse X-Payment-Required header', 'PAYMENT_FAILED', { header: requirementHeader });
+    }
+    // ── SIWx identity attempt ──────────────────────────────────────────
+    // Before paying, check if the server supports SIWx and we have a smart account.
+    // If the server recognizes our wallet (via agreement or prior payment session),
+    // access is granted without payment.
+    const extensions = requirement.extensions;
+    const siwxExt = extensions?.['sign-in-with-x'];
+    if (siwxExt?.info && siwxExt?.supportedChains?.length && options?.smartAccount) {
+        const siwxResult = await attemptSIWx(walletClient, options.smartAccount, url, method, options, siwxExt, fetchTimeout);
+        if (siwxResult)
+            return siwxResult;
+        // SIWx didn't grant access — fall through to ERC-3009 payment
+    }
+    // ── Smart account payment path ────────────────────────────────────
+    // When smartAccountTransfer callback is provided, the payment goes through the
+    // smart account via UserOp with transferWithAuthorization. This enforces guardian
+    // guardrails (spending limits, token whitelist) on-chain.
+    //
+    // SECURITY: When a smart account is configured, we MUST NOT fall back to the
+    // EOA ERC-3009 path. Doing so would bypass guardian guardrails entirely.
+    // If the smart account payment fails, the error must propagate.
+    if (options?.smartAccountTransfer && options?.smartAccount) {
+        const saResult = await attemptSmartAccountPayment(publicClient, walletClient, account, url, method, options, requirement, v2Accept, fetchTimeout);
+        if (saResult)
+            return saResult;
+        // attemptSmartAccountPayment returned null without throwing — this means a
+        // non-critical validation issue (e.g., missing EIP-712 domain params in the
+        // 402 response). Throw rather than silently falling back to EOA.
+        throw new AzethError('Smart account payment failed: the x402 server response is missing required fields for smart account settlement. '
+            + 'Refusing to fall back to EOA payment (would bypass guardian guardrails).', 'PAYMENT_FAILED', { smartAccount: options.smartAccount, url });
+    }
+    // ── ERC-3009 payment flow ──────────────────────────────────────────
+    // Follows the official @x402/evm exact scheme approach for v2 payments.
+    // Resolve amount from the v2 `amount` field (v1 used `maxAmountRequired`)
+    const amountStr = requirement.amount ?? requirement.maxAmountRequired;
+    let amount;
+    try {
+        amount = BigInt(amountStr);
+    }
+    catch {
+        throw new AzethError('Invalid payment amount in X-Payment-Required header', 'PAYMENT_FAILED', { field: 'amount' });
+    }
+    // H-1 fix: Reject negative or zero payment amounts
+    if (amount <= 0n) {
+        throw new AzethError('Payment amount must be positive', 'PAYMENT_FAILED', { field: 'amount' });
+    }
+    // Check budget (default cap: 10 USDC if not specified)
+    const effectiveMaxAmount = options?.maxAmount ?? DEFAULT_MAX_AMOUNT;
+    if (amount > effectiveMaxAmount) {
+        const requiredFmt = formatTokenAmount(amount, 6, 2);
+        const maxFmt = formatTokenAmount(effectiveMaxAmount, 6, 2);
+        throw new AzethError(`Payment of ${requiredFmt} USDC exceeds maximum of ${maxFmt} USDC`, 'BUDGET_EXCEEDED', { required: `${requiredFmt} USDC`, max: `${maxFmt} USDC` });
+    }
+    // Validate payTo is a valid Ethereum address
+    const payTo = requirement.payTo;
+    if (!/^0x[0-9a-fA-F]{40}$/.test(payTo)) {
+        throw new AzethError('Invalid payment recipient address', 'INVALID_INPUT', { field: 'payTo' });
+    }
+    // Validate asset is a known USDC address for this chain (H-3: prevent arbitrary asset injection)
+    const chainId = publicClient.chain?.id ?? 8453;
+    const knownToken = KNOWN_USDC[chainId];
+    if (!knownToken) {
+        throw new AzethError(`Unsupported chain ID ${chainId} for x402 payments`, 'PAYMENT_FAILED', { chainId });
+    }
+    const assetAddress = requirement.asset.toLowerCase();
+    if (assetAddress !== knownToken.address) {
+        throw new AzethError('Payment asset is not a recognized USDC address for this chain', 'PAYMENT_FAILED', { asset: requirement.asset, expectedAsset: knownToken.address, chainId });
+    }
+    // Validate server provides EIP-712 domain params in requirements.extra
+    const extra = requirement.extra;
+    if (!extra?.name || !extra?.version) {
+        throw new AzethError('Server did not provide EIP-712 domain parameters (name, version) in payment requirements', 'PAYMENT_FAILED', { field: 'extra' });
+    }
+    // Build ERC-3009 authorization following the official @x402/evm exact scheme.
+    // Uses viem's toHex for nonce (matches official createNonce()),
+    // getAddress for EIP-55 checksumming, and (now-600) for validAfter.
+    const nonce = toHex(crypto.getRandomValues(new Uint8Array(32)));
+    const now = Math.floor(Date.now() / 1000);
+    const maxValidBefore = now + MAX_VALID_BEFORE_SECONDS;
+    const requestedValidBefore = now + (requirement.maxTimeoutSeconds || 300);
+    const authorization = {
+        from: getAddress(account),
+        to: getAddress(payTo),
+        value: amountStr,
+        validAfter: (now - 600).toString(),
+        validBefore: Math.min(requestedValidBefore, maxValidBefore).toString(),
+        nonce,
+    };
+    // EIP-712 domain — use server-provided name/version from requirements.extra,
+    // with caller override as escape hatch (M-7).
+    const domainOverride = options?.usdcDomain;
+    const domain = {
+        name: domainOverride?.name ?? extra.name,
+        version: domainOverride?.version ?? extra.version,
+        chainId,
+        verifyingContract: getAddress(requirement.asset),
+    };
+    const types = {
+        TransferWithAuthorization: [
+            { name: 'from', type: 'address' },
+            { name: 'to', type: 'address' },
+            { name: 'value', type: 'uint256' },
+            { name: 'validAfter', type: 'uint256' },
+            { name: 'validBefore', type: 'uint256' },
+            { name: 'nonce', type: 'bytes32' },
+        ],
+    };
+    // Sign the typed data using the SAME values as the authorization payload.
+    // The facilitator verifies by reconstructing the hash from the payload,
+    // so the message must be derived from the authorization fields.
+    let signature;
+    try {
+        signature = await walletClient.signTypedData({
+            domain,
+            types,
+            primaryType: 'TransferWithAuthorization',
+            message: {
+                from: getAddress(authorization.from),
+                to: getAddress(authorization.to),
+                value: BigInt(authorization.value),
+                validAfter: BigInt(authorization.validAfter),
+                validBefore: BigInt(authorization.validBefore),
+                nonce: authorization.nonce,
+            },
+        });
+    }
+    catch (err) {
+        if (err instanceof AzethError)
+            throw err;
+        throw new AzethError(err instanceof Error ? err.message : 'Failed to sign payment authorization', 'PAYMENT_FAILED', { originalError: err instanceof Error ? err.name : undefined });
+    }
+    // Build v2 payment proof following the official @x402/core client pattern.
+    // - accepted: echoes back the EXACT server requirement object (deepEqual match required)
+    // - resource: echoed from the 402 response (optional but included for completeness)
+    // - payload: { authorization, signature } per the EVM exact scheme
+    const parsedResource = requirement.__resource;
+    const paymentProof = {
+        x402Version: 2,
+        accepted: v2Accept ?? requirement,
+        payload: {
+            authorization,
+            signature,
+        },
+    };
+    if (parsedResource) {
+        paymentProof.resource = parsedResource;
+    }
+    // Submit with payment proof — M-3: Do NOT use withRetry here.
+    // The paid request carries a signed ERC-3009 authorization that the server will settle on-chain.
+    // Retrying could cause duplicate settlement attempts, wasting gas or confusing error reporting.
+    const retryHeaders = new Headers(options?.headers);
+    // CRITICAL-2 fix: Use cross-platform btoa() instead of Node.js Buffer
+    const encodedProof = btoa(JSON.stringify(paymentProof));
+    retryHeaders.set('PAYMENT-SIGNATURE', encodedProof);
+    const startTime = Date.now();
+    try {
+        response = await fetch(url, {
+            method,
+            headers: retryHeaders,
+            body: options?.body,
+            signal: AbortSignal.timeout(fetchTimeout),
+        });
+    }
+    catch (err) {
+        if (err instanceof AzethError)
+            throw err;
+        throw new AzethError(err instanceof Error ? err.message : 'Failed to submit payment to service', 'NETWORK_ERROR', { originalError: err instanceof Error ? err.name : undefined, url });
+    }
+    const responseTimeMs = Date.now() - startTime;
+    // If response is still 402 after payment, the payment was not accepted.
+    // Decode the rejection reason from PAYMENT-REQUIRED header for diagnostics.
+    if (response.status === 402) {
+        let rejectionReason;
+        const rejectionHeader = response.headers.get('PAYMENT-REQUIRED') ?? response.headers.get('payment-required');
+        if (rejectionHeader) {
+            try {
+                let rejJson;
+                try {
+                    rejJson = atob(rejectionHeader);
+                }
+                catch {
+                    rejJson = rejectionHeader;
+                }
+                const rejParsed = JSON.parse(rejJson);
+                rejectionReason = rejParsed.error;
+            }
+            catch { /* ignore parse failures */ }
+        }
+        throw new AzethError(rejectionReason
+            ? `Payment rejected: ${rejectionReason}`
+            : 'Payment was not accepted by service', 'PAYMENT_FAILED', { url, amount: amount.toString(), responseTimeMs, rejectionReason });
+    }
+    // H-4: Verify on-chain settlement if server provides tx hash
+    // V2: Parse PAYMENT-RESPONSE header first, fall back to X-Payment-Tx
+    let settlementVerified = false;
+    let txHash;
+    const paymentResponseHeader = response.headers.get('PAYMENT-RESPONSE');
+    let txHashHeader = null;
+    if (paymentResponseHeader) {
+        try {
+            // x402v2 base64-encodes the PAYMENT-RESPONSE header; v1 sends raw JSON.
+            let responseJsonStr;
+            try {
+                responseJsonStr = atob(paymentResponseHeader);
+                if (!responseJsonStr.startsWith('{'))
+                    throw new Error('not base64 JSON');
+            }
+            catch {
+                responseJsonStr = paymentResponseHeader;
+            }
+            const paymentResponse = JSON.parse(responseJsonStr);
+            if (paymentResponse.transaction && /^0x[0-9a-fA-F]{64}$/.test(paymentResponse.transaction)) {
+                txHashHeader = paymentResponse.transaction;
+            }
+        }
+        catch {
+            // Fall through to X-Payment-Tx
+        }
+    }
+    if (!txHashHeader) {
+        txHashHeader = response.headers.get('X-Payment-Tx');
+    }
+    const strict = options?.strictSettlement === true;
+    if (txHashHeader && /^0x[0-9a-fA-F]{64}$/.test(txHashHeader)) {
+        txHash = txHashHeader;
+        try {
+            const receipt = await publicClient.getTransactionReceipt({ hash: txHash });
+            if (receipt.status === 'success') {
+                // Verify Transfer event matches expected payment parameters
+                if (verifySettlementReceipt(receipt, payTo, requirement.asset, amount)) {
+                    settlementVerified = true;
+                }
+                else if (strict) {
+                    throw new AzethError('Settlement receipt missing matching USDC Transfer event', 'PAYMENT_FAILED', { txHash, expectedPayTo: payTo, expectedAsset: requirement.asset, expectedAmount: amount.toString() });
+                }
+                // Non-strict: receipt succeeded but no matching Transfer — advisory only
+            }
+            else if (strict) {
+                throw new AzethError('Settlement transaction reverted', 'PAYMENT_FAILED', { txHash, receiptStatus: receipt.status });
+            }
+        }
+        catch (err) {
+            if (err instanceof AzethError)
+                throw err;
+            // Receipt fetch failed (RPC timeout, tx not mined, etc.)
+            if (strict) {
+                throw new AzethError('Failed to verify settlement transaction', 'PAYMENT_FAILED', { txHash, detail: err instanceof Error ? err.message : 'Receipt fetch failed' });
+            }
+            // Non-strict: advisory only — don't fail the request
+        }
+    }
+    else if (strict) {
+        throw new AzethError('Server did not return X-Payment-Tx settlement header', 'PAYMENT_FAILED', { detail: 'strictSettlement requires the server to return a valid X-Payment-Tx header' });
+    }
+    return {
+        response,
+        paymentMade: true,
+        settlementVerified,
+        amount,
+        txHash,
+        responseTimeMs,
+        paymentMethod: 'x402',
+    };
+}
+/** Attempt SIWx identity proof to get access without payment.
+ *
+ *  Creates a SIWE message signed by the EOA but with the smart account as the address,
+ *  so the server can look up agreements/sessions by smart account address.
+ *  The server verifies via EIP-1271 (smart account's isValidSignature recognizes EOA owner).
+ *
+ *  @returns Fetch402Result if access was granted, null if SIWx failed (fall through to payment)
+ */
+async function attemptSIWx(walletClient, smartAccount, url, method, options, siwxExt, fetchTimeout) {
+    try {
+        // Select the first EVM chain from supportedChains
+        const evmChain = siwxExt.supportedChains.find(c => c.chainId.startsWith('eip155:'));
+        if (!evmChain)
+            return null;
+        // Build CompleteSIWxInfo: merge server info with selected chain
+        const completeSIWxInfo = {
+            ...siwxExt.info,
+            chainId: evmChain.chainId,
+            type: evmChain.type,
+            signatureScheme: evmChain.signatureScheme,
+        };
+        // Create EVMSigner adapter: EOA signs but smart account address is used in SIWE message.
+        // The server verifies via EIP-1271: smart account's isValidSignature() recognizes the EOA owner.
+        const siwxSigner = {
+            signMessage: (args) => walletClient.signMessage({ message: args.message }),
+            account: { address: smartAccount },
+        };
+        // Create signed payload and encode header
+        const payload = await createSIWxPayload(completeSIWxInfo, siwxSigner);
+        const headerValue = encodeSIWxHeader(payload);
+        // Retry request with SIWx identity header
+        const siwxHeaders = new Headers(options?.headers);
+        siwxHeaders.set('SIGN-IN-WITH-X', headerValue);
+        const siwxResponse = await fetch(url, {
+            method,
+            headers: siwxHeaders,
+            body: options?.body,
+            signal: AbortSignal.timeout(fetchTimeout),
+        });
+        // If NOT 402, SIWx succeeded — access granted without payment
+        if (siwxResponse.status !== 402) {
+            return {
+                response: siwxResponse,
+                paymentMade: false,
+                settlementVerified: false,
+                paymentMethod: 'session',
+            };
+        }
+        // Still 402 — server didn't recognize us, fall through to payment
+        return null;
+    }
+    catch {
+        // SIWx attempt failed (signing error, network error, etc.) — non-fatal
+        return null;
+    }
+}
+/** Attempt payment via smart account UserOp with transferWithAuthorization.
+ *
+ *  Signs ERC-3009 typed data with `from` = smartAccount (not EOA), then ABI-encodes
+ *  transferWithAuthorization(bytes variant, 0xcf092995) and calls the smartAccountTransfer
+ *  callback to submit it as a UserOp. The smart account's GuardianModule validates the
+ *  UserOp against spending limits, and USDC verifies the EOA signature via ERC-1271.
+ *
+ *  SECURITY: Errors are propagated, NOT swallowed. The caller must not fall back to
+ *  EOA payment when this function throws — doing so would bypass guardian guardrails.
+ *
+ *  @returns Fetch402Result if payment succeeded, null only for non-critical validation
+ *  issues (e.g., missing EIP-712 domain params in the 402 response)
+ *  @throws AzethError for all operational failures (bundler rejection, UserOp failure, etc.)
+ */
+async function attemptSmartAccountPayment(publicClient, walletClient, eoaAccount, url, method, options, requirement, v2Accept, fetchTimeout) {
+    try {
+        const smartAccount = options.smartAccount;
+        const smartAccountTransfer = options.smartAccountTransfer;
+        // Resolve amount
+        const amountStr = requirement.amount ?? requirement.maxAmountRequired;
+        let amount;
+        try {
+            amount = BigInt(amountStr);
+        }
+        catch {
+            return null; // Let standard flow handle the error
+        }
+        if (amount <= 0n)
+            return null;
+        // Budget check
+        const effectiveMaxAmount = options.maxAmount ?? DEFAULT_MAX_AMOUNT;
+        if (amount > effectiveMaxAmount) {
+            const requiredFmt = formatTokenAmount(amount, 6, 2);
+            const maxFmt = formatTokenAmount(effectiveMaxAmount, 6, 2);
+            throw new AzethError(`Payment of ${requiredFmt} USDC exceeds maximum of ${maxFmt} USDC`, 'BUDGET_EXCEEDED', { required: `${requiredFmt} USDC`, max: `${maxFmt} USDC` });
+        }
+        // Validate payTo
+        const payTo = requirement.payTo;
+        if (!/^0x[0-9a-fA-F]{40}$/.test(payTo))
+            return null;
+        // Validate asset
+        const chainId = publicClient.chain?.id ?? 8453;
+        const knownToken = KNOWN_USDC[chainId];
+        if (!knownToken)
+            return null;
+        const assetAddress = requirement.asset.toLowerCase();
+        if (assetAddress !== knownToken.address)
+            return null;
+        // Validate EIP-712 domain params
+        const extra = requirement.extra;
+        if (!extra?.name || !extra?.version)
+            return null;
+        // Build ERC-3009 authorization with from = smartAccount
+        const nonce = toHex(crypto.getRandomValues(new Uint8Array(32)));
+        const now = Math.floor(Date.now() / 1000);
+        const maxValidBefore = now + MAX_VALID_BEFORE_SECONDS;
+        const requestedValidBefore = now + (requirement.maxTimeoutSeconds || 300);
+        const validAfter = BigInt(now - 600);
+        const validBefore = BigInt(Math.min(requestedValidBefore, maxValidBefore));
+        const domainOverride = options.usdcDomain;
+        const domain = {
+            name: domainOverride?.name ?? extra.name,
+            version: domainOverride?.version ?? extra.version,
+            chainId,
+            verifyingContract: getAddress(requirement.asset),
+        };
+        const types = {
+            TransferWithAuthorization: [
+                { name: 'from', type: 'address' },
+                { name: 'to', type: 'address' },
+                { name: 'value', type: 'uint256' },
+                { name: 'validAfter', type: 'uint256' },
+                { name: 'validBefore', type: 'uint256' },
+                { name: 'nonce', type: 'bytes32' },
+            ],
+        };
+        // EOA signs ERC-3009 typed data with from = smartAccount
+        const signature = await walletClient.signTypedData({
+            domain,
+            types,
+            primaryType: 'TransferWithAuthorization',
+            message: {
+                from: getAddress(smartAccount),
+                to: getAddress(payTo),
+                value: amount,
+                validAfter,
+                validBefore,
+                nonce: nonce,
+            },
+        });
+        // ABI-encode transferWithAuthorization(address,address,uint256,uint256,uint256,bytes32,bytes)
+        // Selector 0xcf092995 — the `bytes` signature variant that supports ERC-1271
+        const encodedArgs = encodeAbiParameters([
+            { type: 'address' }, // from
+            { type: 'address' }, // to
+            { type: 'uint256' }, // value
+            { type: 'uint256' }, // validAfter
+            { type: 'uint256' }, // validBefore
+            { type: 'bytes32' }, // nonce
+            { type: 'bytes' }, // signature
+        ], [
+            getAddress(smartAccount),
+            getAddress(payTo),
+            amount,
+            validAfter,
+            validBefore,
+            nonce,
+            signature,
+        ]);
+        const calldata = `0xcf092995${encodedArgs.slice(2)}`;
+        // Submit via UserOp — the SmartAccountClient builds and signs the UserOp,
+        // the bundler submits it, and the GuardianModule enforces spending limits.
+        const txHash = await smartAccountTransfer({
+            usdcAddress: getAddress(requirement.asset),
+            payTo: getAddress(payTo),
+            amount,
+            calldata,
+        });
+        // Retry request with pre-settled proof headers
+        const retryHeaders = new Headers(options.headers);
+        retryHeaders.set('X-Payment-Tx', txHash);
+        retryHeaders.set('X-Payment-From', smartAccount);
+        const startTime = Date.now();
+        const response = await fetch(url, {
+            method,
+            headers: retryHeaders,
+            body: options.body,
+            signal: AbortSignal.timeout(fetchTimeout),
+        });
+        const responseTimeMs = Date.now() - startTime;
+        return {
+            response,
+            paymentMade: true,
+            settlementVerified: true, // We settled it ourselves via UserOp
+            amount,
+            txHash,
+            responseTimeMs,
+            paymentMethod: 'smart-account',
+        };
+    }
+    catch (err) {
+        // SECURITY: All errors must propagate — falling back to EOA would bypass
+        // guardian guardrails. The caller (fetch402) should never silently degrade
+        // from smart account to EOA payment.
+        if (err instanceof AzethError)
+            throw err;
+        // Include full error for debugging (truncate at 2000 chars to avoid overflow)
+        const rawMsg = err instanceof Error ? err.message : String(err);
+        const fullMsg = rawMsg.slice(0, 2000);
+        throw new AzethError(`Smart account x402 payment failed: ${fullMsg}`, 'PAYMENT_FAILED', { smartAccount: options.smartAccount, operation: 'smart_account_x402' });
+    }
+}
+//# sourceMappingURL=x402.js.map

package/dist/payments/x402.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"x402.js","sourceRoot":"","sources":["../../src/payments/x402.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,UAAU,EACV,KAAK,EACL,mBAAmB,GACpB,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAA+B,MAAM,EAAE,MAAM,eAAe,CAAC;AACnG,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GAIjB,MAAM,iCAAiC,CAAC;AAEzC,8GAA8G;AAC9G,MAAM,oBAAoB,GAAG,oEAAoE,CAAC;AAElG;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAkG,EAClG,aAAqB,EACrB,aAAqB,EACrB,cAAsB;IAEtB,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC;IAE/C,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,0CAA0C;QAC1C,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,UAAU;YAAE,SAAS;QACvD,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAEpC,uCAAuC;QACvC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,oBAAoB;YAAE,SAAS;QAErD,6DAA6D;QAC7D,MAAM,SAAS,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QAChE,IAAI,SAAS,KAAK,UAAU;YAAE,SAAS;QAEvC,uBAAuB;QACvB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,IAAI,cAAc;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;gGACgG;AAChG,MAAM,UAAU,GAAuE;IACrF,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE;IACjF,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE;CACtF,CAAC;AAEF,2DAA2D;AAC3D,MAAM,kBAAkB,GAAG,SAAW,CAAC;AAEvC;;;;;;;;;;8DAU8D;AAC9D,MAAM,wBAAwB,GAAG,GAAG,CAAC;AA0DrC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,YAA4C,EAC5C,YAAqD,EACrD,OAAsB,EACtB,GAAW,EACX,OAAyB;IAEzB,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,KAAK,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE9C,8FAA8F;IAC9F,MAAM,YAAY,GAAG,MAAM,CAAC;IAE5B,iDAAiD;IACjD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1C,MAAM;YACN,OAAO;YACP,IAAI,EAAE,OAAO,EAAE,IAAI;YACnB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC;SAC1C,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,UAAU;YAAE,MAAM,GAAG,CAAC;QACzC,MAAM,IAAI,UAAU,CAClB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,EAC9D,eAAe,EACf,EAAE,aAAa,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CACpE,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAC5F,CAAC;IAED,mEAAmE;IACnE,MAAM,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACjH,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAC5F,CAAC;IAED,IAAI,WAAmC,CAAC;IACxC,sFAAsF;IACtF,IAAI,QAA6C,CAAC;IAClD,IAAI,CAAC;QACH,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,iBAAiB,CAAC;QAC9B,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,2DAA2D;QAC3D,uEAAuE;QACvE,IAAI,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;YACvC,8DAA8D;YAC9D,wEAAwE;YACxE,QAAQ,GAAG,MAAM,CAAC;YAClB,WAAW,GAAG;gBACZ,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,OAAO;gBAChC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;gBAC7B,iBAAiB,EAAE,MAAM,CAAC,MAAM,IAAI,GAAG;gBACvC,QAAQ,EAAE,QAAQ,CAAC,GAAG,IAAI,EAAE;gBAC5B,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;gBACvC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,kBAAkB;gBACjD,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,GAAG;gBAClD,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;aACM,CAAC;YAC5B,yEAAyE;YACxE,WAAkD,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;YAClF,WAAkD,CAAC,UAAU,GAAG,QAAQ,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,MAAM,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAClB,2CAA2C,EAC3C,gBAAgB,EAChB,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAC9B,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,gFAAgF;IAChF,gFAAgF;IAChF,qCAAqC;IACrC,MAAM,UAAU,GAAI,WAAkD,CAAC,UAC5B,CAAC;IAC5C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAE/C,IAAI,OAAO,EAAE,IAAI,IAAI,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;QAC/E,MAAM,UAAU,GAAG,MAAM,WAAW,CAClC,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAChF,CAAC;QACF,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAClC,8DAA8D;IAChE,CAAC;IAED,qEAAqE;IACrE,+EAA+E;IAC/E,kFAAkF;IAClF,0DAA0D;IAC1D,EAAE;IACF,6EAA6E;IAC7E,yEAAyE;IACzE,gEAAgE;IAChE,IAAI,OAAO,EAAE,oBAAoB,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,CAC/F,CAAC;QACF,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,2EAA2E;QAC3E,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,IAAI,UAAU,CAClB,kHAAkH;cAChH,0EAA0E,EAC5E,gBAAgB,EAChB,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IAExE,0EAA0E;IAC1E,MAAM,SAAS,GAAI,WAAiD,CAAC,MAAM,IAAI,WAAW,CAAC,iBAAiB,CAAC;IAC7G,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAClB,qDAAqD,EACrD,gBAAgB,EAChB,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,UAAU,CAClB,iCAAiC,EACjC,gBAAgB,EAChB,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;IACJ,CAAC;IAED,uDAAuD;IACvD,MAAM,kBAAkB,GAAG,OAAO,EAAE,SAAS,IAAI,kBAAkB,CAAC;IACpE,IAAI,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,iBAAiB,CAAC,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,UAAU,CAClB,cAAc,WAAW,4BAA4B,MAAM,OAAO,EAClE,iBAAiB,EACjB,EAAE,QAAQ,EAAE,GAAG,WAAW,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,OAAO,EAAE,CAC3D,CAAC;IACJ,CAAC;IAED,6CAA6C;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;IAChC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,UAAU,CAAC,mCAAmC,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,iGAAiG;IACjG,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,CAAC;IAC/C,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,UAAU,CAClB,wBAAwB,OAAO,oBAAoB,EACnD,gBAAgB,EAChB,EAAE,OAAO,EAAE,CACZ,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAI,WAAW,CAAC,KAAgB,CAAC,WAAW,EAAE,CAAC;IACjE,IAAI,YAAY,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAClB,+DAA+D,EAC/D,gBAAgB,EAChB,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,KAAK,GAAG,WAAW,CAAC,KAA2C,CAAC;IACtE,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,UAAU,CAClB,0FAA0F,EAC1F,gBAAgB,EAChB,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,gEAAgE;IAChE,oEAAoE;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAG,GAAG,GAAG,wBAAwB,CAAC;IACtD,MAAM,oBAAoB,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,iBAAiB,IAAI,GAAG,CAAC,CAAC;IAE1E,MAAM,aAAa,GAAG;QACpB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;QACzB,EAAE,EAAE,UAAU,CAAC,KAAsB,CAAC;QACtC,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE;QAClC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE;QACtE,KAAK;KACN,CAAC;IAEF,6EAA6E;IAC7E,8CAA8C;IAC9C,MAAM,cAAc,GAAG,OAAO,EAAE,UAAU,CAAC;IAC3C,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,cAAc,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI;QACxC,OAAO,EAAE,cAAc,EAAE,OAAO,IAAI,KAAK,CAAC,OAAO;QACjD,OAAO;QACP,iBAAiB,EAAE,UAAU,CAAC,WAAW,CAAC,KAAsB,CAAC;KAClE,CAAC;IAEF,MAAM,KAAK,GAAG;QACZ,yBAAyB,EAAE;YACzB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;YAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;YAClC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;YACvC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;YACxC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;SACnC;KACO,CAAC;IAEX,0EAA0E;IAC1E,wEAAwE;IACxE,gEAAgE;IAChE,IAAI,SAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC;YAC3C,MAAM;YACN,KAAK;YACL,WAAW,EAAE,2BAA2B;YACxC,OAAO,EAAE;gBACP,IAAI,EAAE,UAAU,CAAC,aAAa,CAAC,IAAqB,CAAC;gBACrD,EAAE,EAAE,UAAU,CAAC,aAAa,CAAC,EAAmB,CAAC;gBACjD,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;gBAClC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;gBAC5C,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;gBAC9C,KAAK,EAAE,aAAa,CAAC,KAAsB;aAC5C;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,UAAU;YAAE,MAAM,GAAG,CAAC;QACzC,MAAM,IAAI,UAAU,CAClB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,sCAAsC,EAC3E,gBAAgB,EAChB,EAAE,aAAa,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAC/D,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,yFAAyF;IACzF,oFAAoF;IACpF,mEAAmE;IACnE,MAAM,cAAc,GAAI,WAAkD,CAAC,UAAU,CAAC;IACtF,MAAM,YAAY,GAA4B;QAC5C,WAAW,EAAE,CAAC;QACd,QAAQ,EAAE,QAAQ,IAAI,WAAW;QACjC,OAAO,EAAE;YACP,aAAa;YACb,SAAS;SACV;KACF,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,YAAY,CAAC,QAAQ,GAAG,cAAc,CAAC;IACzC,CAAC;IAED,8DAA8D;IAC9D,iGAAiG;IACjG,gGAAgG;IAChG,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,sEAAsE;IACtE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;IACxD,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;IAEpD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM;YACN,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,OAAO,EAAE,IAAI;YACnB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,UAAU;YAAE,MAAM,GAAG,CAAC;QACzC,MAAM,IAAI,UAAU,CAClB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qCAAqC,EAC1E,eAAe,EACf,EAAE,aAAa,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAE9C,wEAAwE;IACxE,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,IAAI,eAAmC,CAAC;QACxC,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC7G,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,GAAG,eAAe,CAAC;gBAAC,CAAC;gBAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACtC,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,UAAU,CAClB,eAAe;YACb,CAAC,CAAC,qBAAqB,eAAe,EAAE;YACxC,CAAC,CAAC,qCAAqC,EACzC,gBAAgB,EAChB,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE,CACpE,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,qEAAqE;IACrE,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,MAAiC,CAAC;IAEtC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACvE,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,qBAAqB,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,wEAAwE;YACxE,IAAI,eAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,eAAe,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBAC9C,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC3E,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe,GAAG,qBAAqB,CAAC;YAC1C,CAAC;YACD,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACpD,IAAI,eAAe,CAAC,WAAW,IAAI,qBAAqB,CAAC,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC3F,YAAY,GAAG,eAAe,CAAC,WAAW,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;IACH,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAElD,IAAI,YAAY,IAAI,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7D,MAAM,GAAG,YAA6B,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,4DAA4D;gBAC5D,IAAI,uBAAuB,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,KAAe,EAAE,MAAM,CAAC,EAAE,CAAC;oBACjF,kBAAkB,GAAG,IAAI,CAAC;gBAC5B,CAAC;qBAAM,IAAI,MAAM,EAAE,CAAC;oBAClB,MAAM,IAAI,UAAU,CAClB,yDAAyD,EACzD,gBAAgB,EAChB,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CACtG,CAAC;gBACJ,CAAC;gBACD,yEAAyE;YAC3E,CAAC;iBAAM,IAAI,MAAM,EAAE,CAAC;gBAClB,MAAM,IAAI,UAAU,CAClB,iCAAiC,EACjC,gBAAgB,EAChB,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,CAC1C,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,GAAG,YAAY,UAAU;gBAAE,MAAM,GAAG,CAAC;YACzC,yDAAyD;YACzD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,IAAI,UAAU,CAClB,yCAAyC,EACzC,gBAAgB,EAChB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAChF,CAAC;YACJ,CAAC;YACD,qDAAqD;QACvD,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,MAAM,IAAI,UAAU,CAClB,sDAAsD,EACtD,gBAAgB,EAChB,EAAE,MAAM,EAAE,4EAA4E,EAAE,CACzF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QACR,WAAW,EAAE,IAAI;QACjB,kBAAkB;QAClB,MAAM;QACN,MAAM;QACN,cAAc;QACd,aAAa,EAAE,MAAM;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,WAAW,CACxB,YAAqD,EACrD,YAA2B,EAC3B,GAAW,EACX,MAAc,EACd,OAAoC,EACpC,OAAsB,EACtB,YAAoB;IAEpB,IAAI,CAAC;QACH,kDAAkD;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,gEAAgE;QAChE,MAAM,gBAAgB,GAAqB;YACzC,GAAG,OAAO,CAAC,IAAI;YACf,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,eAAe,EAAE,QAAQ,CAAC,eAAe;SAC1C,CAAC;QAEF,yFAAyF;QACzF,iGAAiG;QACjG,MAAM,UAAU,GAAc;YAC5B,WAAW,EAAE,CAAC,IAAyB,EAAE,EAAE,CACzC,YAAY,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE;SACnC,CAAC;QAEF,0CAA0C;QAC1C,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;QACtE,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAE9C,0CAA0C;QAC1C,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,WAAW,CAAC,GAAG,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAE/C,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACpC,MAAM;YACN,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,OAAO,EAAE,IAAI;YACnB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC;SAC1C,CAAC,CAAC;QAEH,8DAA8D;QAC9D,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAChC,OAAO;gBACL,QAAQ,EAAE,YAAY;gBACtB,WAAW,EAAE,KAAK;gBAClB,kBAAkB,EAAE,KAAK;gBACzB,aAAa,EAAE,SAAS;aACzB,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,0BAA0B,CACvC,YAA4C,EAC5C,YAAqD,EACrD,UAAyB,EACzB,GAAW,EACX,MAAc,EACd,OAAwB,EACxB,WAAmC,EACnC,QAA6C,EAC7C,YAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,OAAO,CAAC,YAAa,CAAC;QAC3C,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAqB,CAAC;QAE3D,iBAAiB;QACjB,MAAM,SAAS,GAAI,WAAiD,CAAC,MAAM,IAAI,WAAW,CAAC,iBAAiB,CAAC;QAC7G,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,qCAAqC;QACpD,CAAC;QAED,IAAI,MAAM,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAE9B,eAAe;QACf,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACnE,IAAI,MAAM,GAAG,kBAAkB,EAAE,CAAC;YAChC,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,iBAAiB,CAAC,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3D,MAAM,IAAI,UAAU,CAClB,cAAc,WAAW,4BAA4B,MAAM,OAAO,EAClE,iBAAiB,EACjB,EAAE,QAAQ,EAAE,GAAG,WAAW,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,OAAO,EAAE,CAC3D,CAAC;QACJ,CAAC;QAED,iBAAiB;QACjB,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpD,iBAAiB;QACjB,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,CAAC;QAC/C,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,YAAY,GAAI,WAAW,CAAC,KAAgB,CAAC,WAAW,EAAE,CAAC;QACjE,IAAI,YAAY,KAAK,UAAU,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAErD,iCAAiC;QACjC,MAAM,KAAK,GAAG,WAAW,CAAC,KAA2C,CAAC;QACtE,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO;YAAE,OAAO,IAAI,CAAC;QAEjD,wDAAwD;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAG,GAAG,GAAG,wBAAwB,CAAC;QACtD,MAAM,oBAAoB,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,iBAAiB,IAAI,GAAG,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC,CAAC;QAE3E,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC;QAC1C,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,cAAc,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI;YACxC,OAAO,EAAE,cAAc,EAAE,OAAO,IAAI,KAAK,CAAC,OAAO;YACjD,OAAO;YACP,iBAAiB,EAAE,UAAU,CAAC,WAAW,CAAC,KAAsB,CAAC;SAClE,CAAC;QAEF,MAAM,KAAK,GAAG;YACZ,yBAAyB,EAAE;gBACzB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;gBACjC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;gBAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;gBAClC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;gBACvC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;gBACxC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;aACnC;SACO,CAAC;QAEX,yDAAyD;QACzD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC;YACjD,MAAM;YACN,KAAK;YACL,WAAW,EAAE,2BAA2B;YACxC,OAAO,EAAE;gBACP,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC;gBAC9B,EAAE,EAAE,UAAU,CAAC,KAAsB,CAAC;gBACtC,KAAK,EAAE,MAAM;gBACb,UAAU;gBACV,WAAW;gBACX,KAAK,EAAE,KAAsB;aAC9B;SACF,CAAC,CAAC;QAEH,8FAA8F;QAC9F,6EAA6E;QAC7E,MAAM,WAAW,GAAG,mBAAmB,CACrC;YACE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAG,OAAO;YAC7B,EAAE,IAAI,EAAE,SAAS,EAAE,EAAG,KAAK;YAC3B,EAAE,IAAI,EAAE,SAAS,EAAE,EAAG,QAAQ;YAC9B,EAAE,IAAI,EAAE,SAAS,EAAE,EAAG,aAAa;YACnC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAG,cAAc;YACpC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAG,QAAQ;YAC9B,EAAE,IAAI,EAAE,OAAO,EAAE,EAAK,YAAY;SACnC,EACD;YACE,UAAU,CAAC,YAAY,CAAC;YACxB,UAAU,CAAC,KAAsB,CAAC;YAClC,MAAM;YACN,UAAU;YACV,WAAW;YACX,KAAsB;YACtB,SAAS;SACV,CACF,CAAC;QACF,MAAM,QAAQ,GAAG,aAAa,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAmB,CAAC;QAEtE,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;YACxC,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,KAAsB,CAAC;YAC3D,KAAK,EAAE,UAAU,CAAC,KAAsB,CAAC;YACzC,MAAM;YACN,QAAQ;SACT,CAAC,CAAC;QAEH,+CAA+C;QAC/C,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACzC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAEjD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM;YACN,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE9C,OAAO;YACL,QAAQ;YACR,WAAW,EAAE,IAAI;YACjB,kBAAkB,EAAE,IAAI,EAAE,qCAAqC;YAC/D,MAAM;YACN,MAAM;YACN,cAAc;YACd,aAAa,EAAE,eAAe;SAC/B,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,yEAAyE;QACzE,2EAA2E;QAC3E,qCAAqC;QACrC,IAAI,GAAG,YAAY,UAAU;YAAE,MAAM,GAAG,CAAC;QAEzC,8EAA8E;QAC9E,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAEtC,MAAM,IAAI,UAAU,CAClB,sCAAsC,OAAO,EAAE,EAC/C,gBAAgB,EAChB,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC"}