@daski/x402-scheme 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `@daski/x402-scheme` — the composite Exact-EVM client plugin, and the
+ * policy validator both this package and `@daski/pay` sign through.
+ *
+ * The rule that shapes the whole surface: the server proposes, this package
+ * validates against its own expectations and recomputes, the wallet signs,
+ * and the gateway never sees the key. There is no exported "just sign this"
+ * function, and there never will be.
+ */
+export { parseOrderBinding, type OrderBinding, type OrderBindingV1, type OrderBindingV2, } from "./binding.js";
+export { canonicalHash, canonicalJson } from "./canonical.js";
+export { AUTHORIZATION_FIELDS, isClosedTransferWithAuthorizationTypes, TRANSFER_WITH_AUTHORIZATION_PRIMARY_TYPE, TRANSFER_WITH_AUTHORIZATION_TYPES, transferWithAuthorizationTypedData, type Eip712Domain, type TransferAuthorization, type TypedDataRequest, } from "./eip712.js";
+export { PolicyRefusal, refuse, type PolicyCheck, type PolicyRefusalDetail, } from "./errors.js";
+export { DASKI_ORDER_BINDING, DASKI_SIGN_REQUEST, issuedPaymentIdentifier, PAYMENT_IDENTIFIER, PAYMENT_IDENTIFIER_PATTERN, paymentEchoExtensions, withPaymentIdentifier, } from "./extensions.js";
+export { LIFECYCLE_CLOCK_SKEW_SECONDS, MAX_LIFECYCLE_LIFETIME_SECONDS, ORDER_ACTION_TYPES, orderActionResourceUri, orderActionTypedData, validateOrderActionChallenge, validateWalletActionChallenge, WALLET_ACTION_TYPES, walletActionTypedData, type OrderAction, type OrderActionAuthorization, type OrderActionChallenge, type OrderActionExpectations, type WalletActionChallenge, type WalletActionExpectations, } from "./lifecycle.js";
+export { bindingFromExtensions, DEFAULT_MAX_AUTHORIZATION_LIFETIME_SECONDS, DEFAULT_MAX_BACKDATE_SECONDS, DEFAULT_MIN_AUTHORIZATION_LIFETIME_SECONDS, formatUsdc, parseUsdcToAtomic, USDC_DECIMALS, validatePurchaseAuthorization, type PolicyConfig, type PurchaseExpectations, type SessionLedger, type SplitterEvidence, type SplitterResolver, type ValidatedPurchase, } from "./policy.js";
+export { deriveBindingNonce, RECIPE_NONCE_DOMAIN_V1, RECIPE_NONCE_DOMAIN_V2, recipeNonce, recipeNonceV2, type RecipeNonceV1Input, type RecipeNonceV2Input, type RecipePaymentFacts, } from "./recipe.js";
+export { registerDaskiExactEvmScheme, type RegisterOptions, type X402ClientLike } from "./register.js";
+export { DaskiExactEvmScheme, type DaskiExactEvmSchemeOptions, type PaymentPayloadContextLike, type PaymentPayloadResultLike, type PaymentRequirementsLike, type PurchaseContextResolver, type SchemeNetworkClientLike, } from "./scheme.js";
+export { parseSignRequest, proposedNonce, type ParsedSignRequest } from "./signRequest.js";
+export { toClientEvmSigner, type SignerAdapter, type SignerDescription, } from "./signer.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EACL,oBAAoB,EACpB,sCAAsC,EACtC,wCAAwC,EACxC,iCAAiC,EACjC,kCAAkC,EAClC,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,aAAa,EACb,MAAM,EACN,KAAK,WAAW,EAChB,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,0BAA0B,EAC1B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,GAC9B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,qBAAqB,EACrB,0CAA0C,EAC1C,4BAA4B,EAC5B,0CAA0C,EAC1C,UAAU,EACV,iBAAiB,EACjB,aAAa,EACb,6BAA6B,EAC7B,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,WAAW,EACX,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,2BAA2B,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAEvG,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE3F,OAAO,EACL,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,22 @@
+/**
+ * `@daski/x402-scheme` — the composite Exact-EVM client plugin, and the
+ * policy validator both this package and `@daski/pay` sign through.
+ *
+ * The rule that shapes the whole surface: the server proposes, this package
+ * validates against its own expectations and recomputes, the wallet signs,
+ * and the gateway never sees the key. There is no exported "just sign this"
+ * function, and there never will be.
+ */
+export { parseOrderBinding, } from "./binding.js";
+export { canonicalHash, canonicalJson } from "./canonical.js";
+export { AUTHORIZATION_FIELDS, isClosedTransferWithAuthorizationTypes, TRANSFER_WITH_AUTHORIZATION_PRIMARY_TYPE, TRANSFER_WITH_AUTHORIZATION_TYPES, transferWithAuthorizationTypedData, } from "./eip712.js";
+export { PolicyRefusal, refuse, } from "./errors.js";
+export { DASKI_ORDER_BINDING, DASKI_SIGN_REQUEST, issuedPaymentIdentifier, PAYMENT_IDENTIFIER, PAYMENT_IDENTIFIER_PATTERN, paymentEchoExtensions, withPaymentIdentifier, } from "./extensions.js";
+export { LIFECYCLE_CLOCK_SKEW_SECONDS, MAX_LIFECYCLE_LIFETIME_SECONDS, ORDER_ACTION_TYPES, orderActionResourceUri, orderActionTypedData, validateOrderActionChallenge, validateWalletActionChallenge, WALLET_ACTION_TYPES, walletActionTypedData, } from "./lifecycle.js";
+export { bindingFromExtensions, DEFAULT_MAX_AUTHORIZATION_LIFETIME_SECONDS, DEFAULT_MAX_BACKDATE_SECONDS, DEFAULT_MIN_AUTHORIZATION_LIFETIME_SECONDS, formatUsdc, parseUsdcToAtomic, USDC_DECIMALS, validatePurchaseAuthorization, } from "./policy.js";
+export { deriveBindingNonce, RECIPE_NONCE_DOMAIN_V1, RECIPE_NONCE_DOMAIN_V2, recipeNonce, recipeNonceV2, } from "./recipe.js";
+export { registerDaskiExactEvmScheme } from "./register.js";
+export { DaskiExactEvmScheme, } from "./scheme.js";
+export { parseSignRequest, proposedNonce } from "./signRequest.js";
+export { toClientEvmSigner, } from "./signer.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,iBAAiB,GAIlB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EACL,oBAAoB,EACpB,sCAAsC,EACtC,wCAAwC,EACxC,iCAAiC,EACjC,kCAAkC,GAInC,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,aAAa,EACb,MAAM,GAGP,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,0BAA0B,EAC1B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,EACnB,qBAAqB,GAOtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,qBAAqB,EACrB,0CAA0C,EAC1C,4BAA4B,EAC5B,0CAA0C,EAC1C,UAAU,EACV,iBAAiB,EACjB,aAAa,EACb,6BAA6B,GAO9B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,WAAW,EACX,aAAa,GAId,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,2BAA2B,EAA6C,MAAM,eAAe,CAAC;AAEvG,OAAO,EACL,mBAAmB,GAOpB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAA0B,MAAM,kBAAkB,CAAC;AAE3F,OAAO,EACL,iBAAiB,GAGlB,MAAM,aAAa,CAAC"}

package/dist/lifecycle.d.ts

@@ -0,0 +1,177 @@
+/**
+ * §4.1 check 8 — the lifecycle variant of the policy validator.
+ *
+ * Order actions and wallet queries are authorized with their own EIP-712
+ * families. They move no money, but they do move *authority*, so they get the
+ * same treatment: closed type sets, an orderId that matches the order we
+ * meant to touch, method and URI hash inputs recomputed from what the CLI is
+ * actually about to call, and a short expiry.
+ *
+ * Because the gateway derives the challenge's `absoluteResourceUri` and
+ * `requestHash` deterministically, the bridge recomputes both rather than
+ * accepting them. A challenge that hashes a different request than the one we
+ * are about to send is a challenge for someone else's call.
+ */
+import { type Address, type Hex } from "viem";
+import type { TypedDataRequest } from "./eip712.js";
+/** Order lifecycle actions, as the gateway names them. */
+export type OrderAction = "status" | "input" | "cancel" | "artifact" | "support" | "confirmation" | "revoke-confirmation";
+/** The closed 9-field order-action family. */
+export declare const ORDER_ACTION_TYPES: {
+    readonly OrderActionAuthorizationV1: readonly [{
+        readonly name: "orderIdHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "actionHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "methodHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "absoluteResourceUriHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "requestHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "audienceHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "nonce";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "issuedAt";
+        readonly type: "uint64";
+    }, {
+        readonly name: "validBefore";
+        readonly type: "uint64";
+    }];
+};
+/** The closed 17-field wallet-action family, used by payer-scoped queries. */
+export declare const WALLET_ACTION_TYPES: {
+    readonly WalletActionAuthorizationV1: readonly [{
+        readonly name: "payer";
+        readonly type: "address";
+    }, {
+        readonly name: "providerAgentId";
+        readonly type: "uint256";
+    }, {
+        readonly name: "serviceId";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "providerControlProfileHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "servicingAdmissionHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "actionCatalogHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "actionCatalogSchemaHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "actionDefinitionHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "actionCatalogEpoch";
+        readonly type: "uint64";
+    }, {
+        readonly name: "actionHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "methodHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "absoluteResourceUriHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "requestHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "audienceHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "nonce";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "issuedAt";
+        readonly type: "uint64";
+    }, {
+        readonly name: "validBefore";
+        readonly type: "uint64";
+    }];
+};
+/** The longest lifecycle authorization this bridge will sign. */
+export declare const MAX_LIFECYCLE_LIFETIME_SECONDS = 300;
+/** Tolerance for a gateway clock running slightly ahead of ours. */
+export declare const LIFECYCLE_CLOCK_SKEW_SECONDS = 30;
+export interface OrderActionChallenge {
+    orderId: string;
+    action: OrderAction;
+    method: "POST";
+    absoluteResourceUri: string;
+    requestHash: Hex;
+    nonce: Hex;
+    issuedAt: number;
+    validBefore: number;
+}
+export interface OrderActionAuthorization extends OrderActionChallenge {
+    signature: Hex;
+}
+/** What the CLI is about to do, stated before the challenge is read. */
+export interface OrderActionExpectations {
+    /** The handle the CLI resolved from its own order store. */
+    orderHandle: string;
+    /** The action the CLI is performing. */
+    action: OrderAction;
+    /** The gateway base URL from the active profile. */
+    gatewayUrl: string;
+    /** The exact request body the CLI will send. */
+    request: Record<string, unknown>;
+    nowSeconds?: number;
+}
+/**
+ * The URI the gateway derives for an order action. Recomputing it is what
+ * turns "the server said this URI" into "this URI is the one we would call".
+ */
+export declare function orderActionResourceUri(gatewayUrl: string, orderHandle: string, action: OrderAction): string;
+/** Parses and validates an order-action challenge against §4.1 check 8. */
+export declare function validateOrderActionChallenge(value: unknown, expectations: OrderActionExpectations): OrderActionChallenge;
+/**
+ * The typed-data payload for a validated order-action challenge. Every hash
+ * input is computed here from the validated challenge — the signer is handed
+ * a message this package built, not one the gateway sent.
+ */
+export declare function orderActionTypedData(challenge: OrderActionChallenge, chainId: number, audience: string): TypedDataRequest;
+export interface WalletActionExpectations {
+    /** The payer whose history is being read. */
+    payer: Address;
+    /** The wallet action, e.g. `list-orders`. */
+    action: string;
+    /** The gateway audience for the active profile. */
+    audience: string;
+    /** The exact request body the CLI will send. */
+    request: Record<string, unknown>;
+    /** True only for provider-scoped asset actions. */
+    requireProviderBinding: boolean;
+    nowSeconds?: number;
+}
+export interface WalletActionChallenge {
+    domain: {
+        name: string;
+        version: string;
+        chainId: number;
+    };
+    primaryType: "WalletActionAuthorizationV1";
+    message: Record<string, unknown>;
+}
+/**
+ * Validates a wallet-action challenge: closed 17-field message, our payer,
+ * our audience, our action, a short window, and — for the unbound variant —
+ * proof that every provider slot really is zeroed.
+ */
+export declare function validateWalletActionChallenge(value: unknown, chainId: number, expectations: WalletActionExpectations): WalletActionChallenge;
+/** The typed-data payload for a validated wallet-action challenge. */
+export declare function walletActionTypedData(challenge: WalletActionChallenge): TypedDataRequest;
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../src/lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAsC,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAGlF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAKpD,0DAA0D;AAC1D,MAAM,MAAM,WAAW,GACnB,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GACtD,cAAc,GAAG,qBAAqB,CAAC;AAE3C,8CAA8C;AAC9C,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYrB,CAAC;AAEX,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoBtB,CAAC;AAUX,iEAAiE;AACjE,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAClD,oEAAoE;AACpE,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAE/C,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,GAAG,CAAC;IACjB,KAAK,EAAE,GAAG,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,wBAAyB,SAAQ,oBAAoB;IACpE,SAAS,EAAE,GAAG,CAAC;CAChB;AAED,wEAAwE;AACxE,MAAM,WAAW,uBAAuB;IACtC,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,MAAM,EAAE,WAAW,CAAC;IACpB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,WAAW,GAClB,MAAM,CAGR;AAED,2EAA2E;AAC3E,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,uBAAuB,GACpC,oBAAoB,CAuGtB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,oBAAoB,EAC/B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,gBAAgB,CAiBlB;AAED,MAAM,WAAW,wBAAwB;IACvC,6CAA6C;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,mDAAmD;IACnD,sBAAsB,EAAE,OAAO,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,WAAW,EAAE,6BAA6B,CAAC;IAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,wBAAwB,GACrC,qBAAqB,CAmHvB;AAED,sEAAsE;AACtE,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,qBAAqB,GAAG,gBAAgB,CAcxF"}

package/dist/lifecycle.js

@@ -0,0 +1,345 @@
+/**
+ * §4.1 check 8 — the lifecycle variant of the policy validator.
+ *
+ * Order actions and wallet queries are authorized with their own EIP-712
+ * families. They move no money, but they do move *authority*, so they get the
+ * same treatment: closed type sets, an orderId that matches the order we
+ * meant to touch, method and URI hash inputs recomputed from what the CLI is
+ * actually about to call, and a short expiry.
+ *
+ * Because the gateway derives the challenge's `absoluteResourceUri` and
+ * `requestHash` deterministically, the bridge recomputes both rather than
+ * accepting them. A challenge that hashes a different request than the one we
+ * are about to send is a challenge for someone else's call.
+ */
+import { getAddress, keccak256, stringToHex } from "viem";
+import { canonicalHash } from "./canonical.js";
+import { refuse } from "./errors.js";
+const DOC = "https://github.com/daski-io/buyer/blob/main/docs/policy.md#lifecycle";
+const HEX32 = /^0x[0-9a-fA-F]{64}$/;
+/** The closed 9-field order-action family. */
+export const ORDER_ACTION_TYPES = {
+    OrderActionAuthorizationV1: [
+        { name: "orderIdHash", type: "bytes32" },
+        { name: "actionHash", type: "bytes32" },
+        { name: "methodHash", type: "bytes32" },
+        { name: "absoluteResourceUriHash", type: "bytes32" },
+        { name: "requestHash", type: "bytes32" },
+        { name: "audienceHash", type: "bytes32" },
+        { name: "nonce", type: "bytes32" },
+        { name: "issuedAt", type: "uint64" },
+        { name: "validBefore", type: "uint64" },
+    ],
+};
+/** The closed 17-field wallet-action family, used by payer-scoped queries. */
+export const WALLET_ACTION_TYPES = {
+    WalletActionAuthorizationV1: [
+        { name: "payer", type: "address" },
+        { name: "providerAgentId", type: "uint256" },
+        { name: "serviceId", type: "bytes32" },
+        { name: "providerControlProfileHash", type: "bytes32" },
+        { name: "servicingAdmissionHash", type: "bytes32" },
+        { name: "actionCatalogHash", type: "bytes32" },
+        { name: "actionCatalogSchemaHash", type: "bytes32" },
+        { name: "actionDefinitionHash", type: "bytes32" },
+        { name: "actionCatalogEpoch", type: "uint64" },
+        { name: "actionHash", type: "bytes32" },
+        { name: "methodHash", type: "bytes32" },
+        { name: "absoluteResourceUriHash", type: "bytes32" },
+        { name: "requestHash", type: "bytes32" },
+        { name: "audienceHash", type: "bytes32" },
+        { name: "nonce", type: "bytes32" },
+        { name: "issuedAt", type: "uint64" },
+        { name: "validBefore", type: "uint64" },
+    ],
+};
+const ORDER_CHALLENGE_FIELDS = [
+    "orderId", "action", "method", "absoluteResourceUri", "requestHash",
+    "nonce", "issuedAt", "validBefore",
+];
+const WALLET_MESSAGE_FIELDS = WALLET_ACTION_TYPES.WalletActionAuthorizationV1
+    .map((field) => field.name);
+/** The longest lifecycle authorization this bridge will sign. */
+export const MAX_LIFECYCLE_LIFETIME_SECONDS = 300;
+/** Tolerance for a gateway clock running slightly ahead of ours. */
+export const LIFECYCLE_CLOCK_SKEW_SECONDS = 30;
+/**
+ * The URI the gateway derives for an order action. Recomputing it is what
+ * turns "the server said this URI" into "this URI is the one we would call".
+ */
+export function orderActionResourceUri(gatewayUrl, orderHandle, action) {
+    const base = gatewayUrl.replace(/\/$/, "");
+    return `${base}/orders/${encodeURIComponent(orderHandle)}/actions/${action}`;
+}
+/** Parses and validates an order-action challenge against §4.1 check 8. */
+export function validateOrderActionChallenge(value, expectations) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_LIFECYCLE_CHALLENGE_NOT_AN_OBJECT",
+            expected: "an order-action challenge object",
+            actual: Array.isArray(value) ? "an array" : typeof value,
+            remediation: `Retry the lifecycle call; see ${DOC}`,
+        });
+    }
+    const challenge = value;
+    const keys = Object.keys(challenge).sort();
+    if (keys.join(",") !== [...ORDER_CHALLENGE_FIELDS].sort().join(",")) {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_LIFECYCLE_CHALLENGE_OPEN_SHAPE",
+            expected: `exactly [${[...ORDER_CHALLENGE_FIELDS].sort().join(", ")}]`,
+            actual: `[${keys.join(", ")}]`,
+            remediation: `Upgrade @daski/x402-scheme; see ${DOC}`,
+        });
+    }
+    if (typeof challenge.orderId !== "string" || challenge.orderId.length === 0 ||
+        typeof challenge.absoluteResourceUri !== "string" ||
+        !HEX32.test(String(challenge.requestHash)) || !HEX32.test(String(challenge.nonce)) ||
+        !Number.isSafeInteger(challenge.issuedAt) || !Number.isSafeInteger(challenge.validBefore)) {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_LIFECYCLE_CHALLENGE_MALFORMED",
+            expected: "well-formed orderId, URI, hashes and timestamps",
+            actual: "one or more fields are malformed",
+            remediation: `Retry the lifecycle call; see ${DOC}`,
+        });
+    }
+    if (challenge.method !== "POST") {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_LIFECYCLE_METHOD_UNEXPECTED",
+            expected: "method POST",
+            actual: `method ${String(challenge.method)}`,
+            remediation: `See ${DOC}`,
+        });
+    }
+    if (challenge.action !== expectations.action) {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_LIFECYCLE_ACTION_MISMATCH",
+            expected: `action ${expectations.action}`,
+            actual: `action ${String(challenge.action)}`,
+            remediation: "The challenge authorizes a different action than the one requested. " +
+                `Do not sign it; see ${DOC}`,
+        });
+    }
+    // The URI is derived, not declared: recompute and require equality. This is
+    // the check that stops a challenge from pointing our signature at another
+    // order or another host.
+    const expectedUri = orderActionResourceUri(expectations.gatewayUrl, expectations.orderHandle, expectations.action);
+    if (challenge.absoluteResourceUri !== expectedUri) {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_LIFECYCLE_URI_MISMATCH",
+            expected: expectedUri,
+            actual: challenge.absoluteResourceUri,
+            remediation: "The challenge binds a resource URI we did not ask to call — a " +
+                `different order, action, or host. Do not sign it; see ${DOC}`,
+        });
+    }
+    if (!/^https:\/\//.test(challenge.absoluteResourceUri)) {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_LIFECYCLE_URI_NOT_HTTPS",
+            expected: "an https:// resource URI",
+            actual: challenge.absoluteResourceUri,
+            remediation: `See ${DOC}`,
+        });
+    }
+    // Likewise the request hash: recompute it over the body we are about to send.
+    const expectedRequestHash = canonicalHash(expectations.request);
+    if (String(challenge.requestHash).toLowerCase() !== expectedRequestHash.toLowerCase()) {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_LIFECYCLE_REQUEST_HASH_MISMATCH",
+            expected: `requestHash ${expectedRequestHash} (recomputed from the outgoing request)`,
+            actual: `requestHash ${String(challenge.requestHash)}`,
+            remediation: "The challenge commits to a different request body than the one we " +
+                `are about to send. Do not sign it; see ${DOC}`,
+        });
+    }
+    assertShortLived(Number(challenge.issuedAt), Number(challenge.validBefore), expectations.nowSeconds);
+    return challenge;
+}
+/**
+ * The typed-data payload for a validated order-action challenge. Every hash
+ * input is computed here from the validated challenge — the signer is handed
+ * a message this package built, not one the gateway sent.
+ */
+export function orderActionTypedData(challenge, chainId, audience) {
+    return {
+        domain: { name: "DaskiStandardOrder", version: "1", chainId },
+        types: ORDER_ACTION_TYPES,
+        primaryType: "OrderActionAuthorizationV1",
+        message: {
+            orderIdHash: keccak256(stringToHex(challenge.orderId)),
+            actionHash: keccak256(stringToHex(challenge.action)),
+            methodHash: keccak256(stringToHex(challenge.method)),
+            absoluteResourceUriHash: keccak256(stringToHex(challenge.absoluteResourceUri)),
+            requestHash: challenge.requestHash,
+            audienceHash: keccak256(stringToHex(audience)),
+            nonce: challenge.nonce,
+            issuedAt: BigInt(challenge.issuedAt),
+            validBefore: BigInt(challenge.validBefore),
+        },
+    };
+}
+/**
+ * Validates a wallet-action challenge: closed 17-field message, our payer,
+ * our audience, our action, a short window, and — for the unbound variant —
+ * proof that every provider slot really is zeroed.
+ */
+export function validateWalletActionChallenge(value, chainId, expectations) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_WALLET_CHALLENGE_NOT_AN_OBJECT",
+            expected: "a wallet-action challenge object",
+            actual: Array.isArray(value) ? "an array" : typeof value,
+            remediation: `Retry the query; see ${DOC}`,
+        });
+    }
+    const challenge = value;
+    assertExactKeys(challenge, ["domain", "primaryType", "message"], "wallet challenge");
+    const domain = challenge.domain;
+    assertExactKeys(domain, ["name", "version", "chainId"], "wallet challenge domain");
+    const message = challenge.message;
+    assertExactKeys(message, WALLET_MESSAGE_FIELDS, "wallet challenge message");
+    if (domain.name !== "DaskiStandardWallet" || domain.version !== "1" ||
+        domain.chainId !== chainId) {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_WALLET_DOMAIN_MISMATCH",
+            expected: `DaskiStandardWallet v1 on chain ${chainId}`,
+            actual: `${String(domain.name)} v${String(domain.version)} on chain ${String(domain.chainId)}`,
+            remediation: `See ${DOC}`,
+        });
+    }
+    if (challenge.primaryType !== "WalletActionAuthorizationV1") {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_WALLET_PRIMARY_TYPE_MISMATCH",
+            expected: "WalletActionAuthorizationV1",
+            actual: String(challenge.primaryType),
+            remediation: `See ${DOC}`,
+        });
+    }
+    if (getAddress(String(message.payer)) !== getAddress(expectations.payer)) {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_WALLET_PAYER_MISMATCH",
+            expected: `payer ${getAddress(expectations.payer)}`,
+            actual: `payer ${String(message.payer)}`,
+            remediation: `See ${DOC}`,
+        });
+    }
+    const expectedAction = keccak256(stringToHex(expectations.action));
+    if (String(message.actionHash).toLowerCase() !== expectedAction.toLowerCase()) {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_WALLET_ACTION_MISMATCH",
+            expected: `actionHash for "${expectations.action}"`,
+            actual: `actionHash ${String(message.actionHash)}`,
+            remediation: `See ${DOC}`,
+        });
+    }
+    const expectedAudience = keccak256(stringToHex(expectations.audience));
+    if (String(message.audienceHash).toLowerCase() !== expectedAudience.toLowerCase()) {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_WALLET_AUDIENCE_MISMATCH",
+            expected: `audienceHash for ${expectations.audience}`,
+            actual: `audienceHash ${String(message.audienceHash)}`,
+            remediation: "A signature bound to another audience could be replayed there. " +
+                `Do not sign it; see ${DOC}`,
+        });
+    }
+    const expectedRequestHash = canonicalHash(expectations.request);
+    if (String(message.requestHash).toLowerCase() !== expectedRequestHash.toLowerCase()) {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_WALLET_REQUEST_HASH_MISMATCH",
+            expected: `requestHash ${expectedRequestHash} (recomputed from the outgoing request)`,
+            actual: `requestHash ${String(message.requestHash)}`,
+            remediation: `See ${DOC}`,
+        });
+    }
+    const zero = `0x${"00".repeat(32)}`;
+    const providerSlots = [
+        "serviceId", "providerControlProfileHash", "servicingAdmissionHash",
+        "actionCatalogHash", "actionCatalogSchemaHash", "actionDefinitionHash",
+    ];
+    if (expectations.requireProviderBinding) {
+        if (String(message.providerAgentId) === "0" || message.serviceId === zero) {
+            refuse({
+                check: "lifecycle-binding",
+                code: "DASKI_WALLET_PROVIDER_BINDING_MISSING",
+                expected: "a provider-bound wallet challenge",
+                actual: "provider slots are zeroed",
+                remediation: `See ${DOC}`,
+            });
+        }
+    }
+    else if (String(message.providerAgentId) !== "0" ||
+        providerSlots.some((slot) => message[slot] !== zero) ||
+        Number(message.actionCatalogEpoch) !== 0) {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_WALLET_UNEXPECTED_PROVIDER_BINDING",
+            expected: "an unbound wallet challenge with zeroed provider slots",
+            actual: "the challenge binds a provider we did not name",
+            remediation: "This would authorize a provider-scoped action under cover of a " +
+                `wallet query. Do not sign it; see ${DOC}`,
+        });
+    }
+    assertShortLived(Number(message.issuedAt), Number(message.validBefore), expectations.nowSeconds);
+    return challenge;
+}
+/** The typed-data payload for a validated wallet-action challenge. */
+export function walletActionTypedData(challenge) {
+    const message = challenge.message;
+    return {
+        domain: challenge.domain,
+        types: WALLET_ACTION_TYPES,
+        primaryType: "WalletActionAuthorizationV1",
+        message: {
+            ...message,
+            providerAgentId: BigInt(String(message.providerAgentId)),
+            actionCatalogEpoch: BigInt(String(message.actionCatalogEpoch)),
+            issuedAt: BigInt(String(message.issuedAt)),
+            validBefore: BigInt(String(message.validBefore)),
+        },
+    };
+}
+function assertShortLived(issuedAt, validBefore, nowSeconds) {
+    const now = nowSeconds ?? Math.floor(Date.now() / 1_000);
+    if (issuedAt > now + LIFECYCLE_CLOCK_SKEW_SECONDS ||
+        validBefore <= now ||
+        validBefore <= issuedAt ||
+        validBefore - issuedAt > MAX_LIFECYCLE_LIFETIME_SECONDS) {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_LIFECYCLE_WINDOW_INVALID",
+            expected: `issuedAt within ${LIFECYCLE_CLOCK_SKEW_SECONDS}s of now and a lifetime ` +
+                `in (0, ${MAX_LIFECYCLE_LIFETIME_SECONDS}]s`,
+            actual: `issuedAt=${issuedAt} validBefore=${validBefore} now=${now}`,
+            remediation: "Expired, future-dated, or long-lived lifecycle challenges are refused. " +
+                `Check the local clock, then retry; see ${DOC}`,
+        });
+    }
+}
+function assertExactKeys(value, fields, label) {
+    const actual = Object.keys(value).sort();
+    const expected = [...fields].sort();
+    if (actual.join(",") !== expected.join(",")) {
+        refuse({
+            check: "lifecycle-binding",
+            code: "DASKI_LIFECYCLE_OPEN_SHAPE",
+            expected: `${label} to be exactly [${expected.join(", ")}]`,
+            actual: `[${actual.join(", ")}]`,
+            remediation: `Upgrade @daski/x402-scheme; see ${DOC}`,
+        });
+    }
+}
+//# sourceMappingURL=lifecycle.js.map

package/dist/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../src/lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAA0B,MAAM,MAAM,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,MAAM,GAAG,GAAG,sEAAsE,CAAC;AACnF,MAAM,KAAK,GAAG,qBAAqB,CAAC;AAOpC,8CAA8C;AAC9C,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,0BAA0B,EAAE;QAC1B,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;QACxC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;QACvC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;QACvC,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,SAAS,EAAE;QACpD,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;QACxC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE;QACzC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;QAClC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE;QACpC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE;KACxC;CACO,CAAC;AAEX,8EAA8E;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,2BAA2B,EAAE;QAC3B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;QAClC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE;QAC5C,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;QACtC,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,SAAS,EAAE;QACvD,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,SAAS,EAAE;QACnD,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE;QAC9C,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,SAAS,EAAE;QACpD,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,EAAE;QACjD,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC9C,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;QACvC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;QACvC,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,SAAS,EAAE;QACpD,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;QACxC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE;QACzC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;QAClC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE;QACpC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE;KACxC;CACO,CAAC;AAEX,MAAM,sBAAsB,GAAG;IAC7B,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,qBAAqB,EAAE,aAAa;IACnE,OAAO,EAAE,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEX,MAAM,qBAAqB,GAAG,mBAAmB,CAAC,2BAA2B;KAC1E,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAE9B,iEAAiE;AACjE,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAClD,oEAAoE;AACpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AA8B/C;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,WAAmB,EACnB,MAAmB;IAEnB,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,GAAG,IAAI,WAAW,kBAAkB,CAAC,WAAW,CAAC,YAAY,MAAM,EAAE,CAAC;AAC/E,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,4BAA4B,CAC1C,KAAc,EACd,YAAqC;IAErC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,yCAAyC;YAC/C,QAAQ,EAAE,kCAAkC;YAC5C,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,KAAK;YACxD,WAAW,EAAE,iCAAiC,GAAG,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,sBAAsB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,sCAAsC;YAC5C,QAAQ,EAAE,YAAY,CAAC,GAAG,sBAAsB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACtE,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC9B,WAAW,EAAE,mCAAmC,GAAG,EAAE;SACtD,CAAC,CAAC;IACL,CAAC;IACD,IACE,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QACvE,OAAO,SAAS,CAAC,mBAAmB,KAAK,QAAQ;QACjD,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAClF,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,CAAC,EACzF,CAAC;QACD,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,qCAAqC;YAC3C,QAAQ,EAAE,iDAAiD;YAC3D,MAAM,EAAE,kCAAkC;YAC1C,WAAW,EAAE,iCAAiC,GAAG,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAChC,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,mCAAmC;YACzC,QAAQ,EAAE,aAAa;YACvB,MAAM,EAAE,UAAU,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;YAC5C,WAAW,EAAE,OAAO,GAAG,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QAC7C,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,iCAAiC;YACvC,QAAQ,EAAE,UAAU,YAAY,CAAC,MAAM,EAAE;YACzC,MAAM,EAAE,UAAU,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;YAC5C,WAAW,EACT,sEAAsE;gBACtE,uBAAuB,GAAG,EAAE;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,yBAAyB;IACzB,MAAM,WAAW,GAAG,sBAAsB,CACxC,YAAY,CAAC,UAAU,EACvB,YAAY,CAAC,WAAW,EACxB,YAAY,CAAC,MAAM,CACpB,CAAC;IACF,IAAI,SAAS,CAAC,mBAAmB,KAAK,WAAW,EAAE,CAAC;QAClD,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,8BAA8B;YACpC,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,SAAS,CAAC,mBAAmB;YACrC,WAAW,EACT,gEAAgE;gBAChE,yDAAyD,GAAG,EAAE;SACjE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,0BAA0B;YACpC,MAAM,EAAE,SAAS,CAAC,mBAAmB;YACrC,WAAW,EAAE,OAAO,GAAG,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,MAAM,mBAAmB,GAAG,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,KAAK,mBAAmB,CAAC,WAAW,EAAE,EAAE,CAAC;QACtF,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,uCAAuC;YAC7C,QAAQ,EAAE,eAAe,mBAAmB,yCAAyC;YACrF,MAAM,EAAE,eAAe,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;YACtD,WAAW,EACT,oEAAoE;gBACpE,0CAA0C,GAAG,EAAE;SAClD,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,EACxE,YAAY,CAAC,UAAU,CAAC,CAAC;IAE3B,OAAO,SAA4C,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAA+B,EAC/B,OAAe,EACf,QAAgB;IAEhB,OAAO;QACL,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAW;QACtE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,4BAA4B;QACzC,OAAO,EAAE;YACP,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACtD,UAAU,EAAE,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACpD,UAAU,EAAE,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACpD,uBAAuB,EAAE,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;YAC9E,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,YAAY,EAAE,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC9C,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;YACpC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC;SAC3C;KACF,CAAC;AACJ,CAAC;AAsBD;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,KAAc,EACd,OAAe,EACf,YAAsC;IAEtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,sCAAsC;YAC5C,QAAQ,EAAE,kCAAkC;YAC5C,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,KAAK;YACxD,WAAW,EAAE,wBAAwB,GAAG,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,eAAe,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,SAAS,CAAC,MAAiC,CAAC;IAC3D,eAAe,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,SAAS,CAAC,OAAkC,CAAC;IAC7D,eAAe,CAAC,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,CAAC,CAAC;IAE5E,IACE,MAAM,CAAC,IAAI,KAAK,qBAAqB,IAAI,MAAM,CAAC,OAAO,KAAK,GAAG;QAC/D,MAAM,CAAC,OAAO,KAAK,OAAO,EAC1B,CAAC;QACD,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,8BAA8B;YACpC,QAAQ,EAAE,mCAAmC,OAAO,EAAE;YACtD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;YAC9F,WAAW,EAAE,OAAO,GAAG,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,KAAK,6BAA6B,EAAE,CAAC;QAC5D,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,oCAAoC;YAC1C,QAAQ,EAAE,6BAA6B;YACvC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC;YACrC,WAAW,EAAE,OAAO,GAAG,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,6BAA6B;YACnC,QAAQ,EAAE,SAAS,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE;YACnD,MAAM,EAAE,SAAS,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;YACxC,WAAW,EAAE,OAAO,GAAG,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,cAAc,GAAG,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9E,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,8BAA8B;YACpC,QAAQ,EAAE,mBAAmB,YAAY,CAAC,MAAM,GAAG;YACnD,MAAM,EAAE,cAAc,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;YAClD,WAAW,EAAE,OAAO,GAAG,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,gBAAgB,GAAG,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,WAAW,EAAE,EAAE,CAAC;QAClF,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,gCAAgC;YACtC,QAAQ,EAAE,oBAAoB,YAAY,CAAC,QAAQ,EAAE;YACrD,MAAM,EAAE,gBAAgB,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;YACtD,WAAW,EACT,iEAAiE;gBACjE,uBAAuB,GAAG,EAAE;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,mBAAmB,GAAG,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,KAAK,mBAAmB,CAAC,WAAW,EAAE,EAAE,CAAC;QACpF,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,oCAAoC;YAC1C,QAAQ,EAAE,eAAe,mBAAmB,yCAAyC;YACrF,MAAM,EAAE,eAAe,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE;YACpD,WAAW,EAAE,OAAO,GAAG,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IACpC,MAAM,aAAa,GAAG;QACpB,WAAW,EAAE,4BAA4B,EAAE,wBAAwB;QACnE,mBAAmB,EAAE,yBAAyB,EAAE,sBAAsB;KAC9D,CAAC;IACX,IAAI,YAAY,CAAC,sBAAsB,EAAE,CAAC;QACxC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC1E,MAAM,CAAC;gBACL,KAAK,EAAE,mBAAmB;gBAC1B,IAAI,EAAE,uCAAuC;gBAC7C,QAAQ,EAAE,mCAAmC;gBAC7C,MAAM,EAAE,2BAA2B;gBACnC,WAAW,EAAE,OAAO,GAAG,EAAE;aAC1B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IACL,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,GAAG;QACvC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,EACxC,CAAC;QACD,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,0CAA0C;YAChD,QAAQ,EAAE,wDAAwD;YAClE,MAAM,EAAE,gDAAgD;YACxD,WAAW,EACT,iEAAiE;gBACjE,qCAAqC,GAAG,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EACpE,YAAY,CAAC,UAAU,CAAC,CAAC;IAE3B,OAAO,SAA6C,CAAC;AACvD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,qBAAqB,CAAC,SAAgC;IACpE,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;IAClC,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,MAAe;QACjC,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,6BAA6B;QAC1C,OAAO,EAAE;YACP,GAAG,OAAO;YACV,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACxD,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;YAC9D,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC1C,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;SACjD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,WAAmB,EAAE,UAAmB;IAClF,MAAM,GAAG,GAAG,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;IACzD,IACE,QAAQ,GAAG,GAAG,GAAG,4BAA4B;QAC7C,WAAW,IAAI,GAAG;QAClB,WAAW,IAAI,QAAQ;QACvB,WAAW,GAAG,QAAQ,GAAG,8BAA8B,EACvD,CAAC;QACD,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,gCAAgC;YACtC,QAAQ,EACN,mBAAmB,4BAA4B,0BAA0B;gBACzE,UAAU,8BAA8B,IAAI;YAC9C,MAAM,EAAE,YAAY,QAAQ,gBAAgB,WAAW,QAAQ,GAAG,EAAE;YACpE,WAAW,EACT,yEAAyE;gBACzE,0CAA0C,GAAG,EAAE;SAClD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,KAA8B,EAC9B,MAAyB,EACzB,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,4BAA4B;YAClC,QAAQ,EAAE,GAAG,KAAK,mBAAmB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC3D,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAChC,WAAW,EAAE,mCAAmC,GAAG,EAAE;SACtD,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}