@debridge-finance/borderless-validation-sdk 0.0.0-dev-dee2389 → 0.0.0-dev-58fb7d3

package/dist/esm/validations/evm-sign712-metamask.js

@@ -1,8 +1,5 @@
 import { ViolationCode, EvmActionKind, EvmActionOperation, } from "../types/index.js";
-import { isWhitelisted } from "../whitelists/types.js";
-import { DELEGATION_MANAGER_CONTRACTS } from "../whitelists/evm/index.js";
-import { addressEquals } from "../helpers/address.js";
-import { classifyCaveats, validateExactExecutionPresence, validateExactExecutionContent, validateTimestampEnforcerValue, } from "./evm-caveats.js";
+import { validateSign712DataPresent, validateSign712Domain, validateSign712Delegator, validateSign712Caveats, } from "./evm-sign712-shared.js";
 const SIGN712_METAMASK_ALLOWED_ACTIONS = [
     EvmActionOperation.Budget,
     EvmActionOperation.Wrap,
@@ -13,23 +10,28 @@ export function validateSign712MetaMaskActions(actions, basePath, realChainId, q
     const violations = [];
     for (let i = 0; i < actions.length; i++) {
         const action = actions[i];
-        if (action.type !== EvmActionKind.Sign712MetaMask)
+        if (action.type !== EvmActionKind.Sign712MetaMaskCaveats)
             continue;
         const actionPath = `${basePath}.requiredActions[${i}]`;
         const data = action.data;
-        // CRITICAL: `data` must be present and contain `domain` and `message`
-        if (!data || !data.domain || !data.message) {
-            violations.push({
-                code: ViolationCode.Sign712MetaMaskDomainNameNotDelegationManager,
-                message: `Sign712MetaMask data is missing domain or message`,
-                path: `${actionPath}.data`,
-                actual: data,
-            });
+        // CRITICAL: data structural presence — downstream content checks
+        // assume `data.domain` and `data.message` exist.
+        const presenceErrors = validateSign712DataPresent(data, actionPath);
+        if (presenceErrors.length > 0) {
+            violations.push(...presenceErrors);
             continue;
         }
-        violations.push(...validateSign712TransactionCalls(action, actionPath), ...validateSign712AllowedActions(action, actionPath), ...validateSign712Domain(data, actionPath, realChainId), ...validateSign712Delegator(data, actionPath, realChainId, quoteMode, srcChainAuthorityAddress));
+        violations.push(...validateSign712TransactionCalls(action, actionPath), ...validateSign712AllowedActions(action, actionPath), ...validateSign712Domain(data, actionPath, realChainId), 
+        // Delegator: in quote mode we cannot determine the trust source —
+        // skip the check entirely. In execution mode the helper compares
+        // against `srcChainAuthorityAddress` (which may itself be
+        // `undefined` as a defensive check — preserved by passing through).
+        ...(quoteMode
+            ? []
+            : validateSign712Delegator(data, actionPath, realChainId, srcChainAuthorityAddress, "srcChainAuthorityAddress")));
         const caveats = (data.message.caveats ?? []);
-        violations.push(...validateSign712MetaMaskCaveats(caveats, action, actionPath, realChainId, expirationTimestamp));
+        const txCalls = action.details?.transactionCalls ?? [];
+        violations.push(...validateSign712Caveats(caveats, action.actionId, txCalls, actionPath, realChainId, expirationTimestamp));
     }
     return violations;
 }
@@ -62,83 +64,4 @@ function validateSign712AllowedActions(action, actionPath) {
     }
     return violations;
 }
-// CRITICAL: domain.name must be "DelegationManager"
-// CRITICAL: domain.chainId must equal the real chainId
-// CRITICAL: domain.verifyingContract must be in the DelegationManager whitelist
-function validateSign712Domain(data, actionPath, realChainId) {
-    const violations = [];
-    if (data.domain.name !== "DelegationManager") {
-        violations.push({
-            code: ViolationCode.Sign712MetaMaskDomainNameNotDelegationManager,
-            message: `Sign712MetaMask domain.name must be "DelegationManager"`,
-            path: `${actionPath}.data.domain.name`,
-            expected: "DelegationManager",
-            actual: data.domain.name,
-        });
-    }
-    if (data.domain.chainId !== realChainId) {
-        violations.push({
-            code: ViolationCode.Sign712MetaMaskChainIdMismatch,
-            message: `Sign712MetaMask domain.chainId does not match the real chainId`,
-            path: `${actionPath}.data.domain.chainId`,
-            expected: realChainId,
-            actual: data.domain.chainId,
-        });
-    }
-    if (data.domain.verifyingContract === undefined ||
-        !isWhitelisted(DELEGATION_MANAGER_CONTRACTS, realChainId, data.domain.verifyingContract)) {
-        violations.push({
-            code: ViolationCode.Sign712MetaMaskVerifyingContractNotWhitelisted,
-            message: `Sign712MetaMask domain.verifyingContract is not whitelisted`,
-            path: `${actionPath}.data.domain.verifyingContract`,
-            actual: data.domain.verifyingContract,
-        });
-    }
-    return violations;
-}
-// LOW: in execution mode, message.delegator must match srcChainAuthorityAddress
-function validateSign712Delegator(data, actionPath, realChainId, quoteMode, srcChainAuthorityAddress) {
-    if (quoteMode)
-        return [];
-    const delegator = data.message.delegator;
-    if (srcChainAuthorityAddress === undefined ||
-        delegator === undefined ||
-        !addressEquals(realChainId, delegator, srcChainAuthorityAddress)) {
-        return [{
-                code: ViolationCode.Sign712MetaMaskDelegatorMismatch,
-                message: `Sign712MetaMask message.delegator must match srcChainAuthorityAddress`,
-                path: `${actionPath}.data.message.delegator`,
-                expected: srcChainAuthorityAddress,
-                actual: delegator,
-            }];
-    }
-    return [];
-}
-function validateSign712MetaMaskCaveats(caveats, action, actionPath, realChainId, expirationTimestamp) {
-    const violations = [];
-    const classified = classifyCaveats(caveats, action.actionId, actionPath, realChainId, violations);
-    const txCalls = action.details?.transactionCalls ?? [];
-    violations.push(...validateExactExecutionPresence(classified, txCalls, actionPath));
-    validateExactExecutionContent(classified, txCalls, actionPath, violations);
-    // CRITICAL: must have at least one IdEnforcer caveat (replay protection)
-    if (!classified.hasIdEnforcer) {
-        violations.push({
-            code: ViolationCode.Sign712MetaMaskMissingIdEnforcerCaveat,
-            message: `Sign712MetaMask must have an IdEnforcer caveat`,
-            path: `${actionPath}.data.message.caveats`,
-        });
-    }
-    // CRITICAL: must have exactly one TimestampEnforcer caveat
-    if (classified.timestampCount === 0) {
-        violations.push({
-            code: ViolationCode.Sign712MetaMaskMissingTimestampEnforcerCaveat,
-            message: `Sign712MetaMask must have a TimestampEnforcer caveat`,
-            path: `${actionPath}.data.message.caveats`,
-        });
-    }
-    if (classified.firstTimestamp) {
-        validateTimestampEnforcerValue(classified.firstTimestamp.caveat, expirationTimestamp, classified.firstTimestamp.index, actionPath, violations);
-    }
-    return violations;
-}
 //# sourceMappingURL=evm-sign712-metamask.js.map

package/dist/esm/validations/evm-sign712-metamask.js.map

@@ -1 +1 @@
-{"version":3,"file":"evm-sign712-metamask.js","sourceRoot":"","sources":["../../../src/validations/evm-sign712-metamask.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,aAAa,EAEb,aAAa,EACb,kBAAkB,GAGrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAEH,eAAe,EACf,8BAA8B,EAC9B,6BAA6B,EAC7B,8BAA8B,GACjC,MAAM,eAAe,CAAC;AAEvB,MAAM,gCAAgC,GAAkC;IACpE,kBAAkB,CAAC,MAAM;IACzB,kBAAkB,CAAC,IAAI;IACvB,kBAAkB,CAAC,IAAI;IACvB,kBAAkB,CAAC,eAAe;CACrC,CAAC;AAEF,MAAM,UAAU,8BAA8B,CAC1C,OAA4B,EAC5B,QAAgB,EAChB,WAAoB,EACpB,SAAkB,EAClB,mBAA2B,EAC3B,wBAAiC;IAEjC,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,eAAe;YAAE,SAAS;QAE5D,MAAM,UAAU,GAAG,GAAG,QAAQ,oBAAoB,CAAC,GAAG,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAkC,CAAC;QAEvD,sEAAsE;QACtE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACzC,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,6CAA6C;gBACjE,OAAO,EAAE,mDAAmD;gBAC5D,IAAI,EAAE,GAAG,UAAU,OAAO;gBAC1B,MAAM,EAAE,IAAI;aACf,CAAC,CAAC;YACH,SAAS;QACb,CAAC;QAED,UAAU,CAAC,IAAI,CACX,GAAG,+BAA+B,CAAC,MAAM,EAAE,UAAU,CAAC,EACtD,GAAG,6BAA6B,CAAC,MAAM,EAAE,UAAU,CAAC,EACpD,GAAG,qBAAqB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,EACvD,GAAG,wBAAwB,CACvB,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,wBAAwB,CACrE,CACJ,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAa,CAAC;QACzD,UAAU,CAAC,IAAI,CACX,GAAG,8BAA8B,CAC7B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,CAChE,CACJ,CAAC;IACN,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,4DAA4D;AAC5D,SAAS,+BAA+B,CACpC,MAAyB,EACzB,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,gBAAgB,IAAI,EAAE,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,oCAAoC;gBACxD,OAAO,EAAE,wDAAwD;gBACjE,IAAI,EAAE,GAAG,UAAU,2BAA2B;gBAC9C,MAAM,EAAE,OAAO;aAClB,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,6BAA6B,CAClC,MAAyB,EACzB,UAAkB;IAElB,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,gCAAgC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACjD,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,8BAA8B;gBAClD,OAAO,EAAE,2BAA2B,EAAE,kBAAkB;gBACxD,IAAI,EAAE,GAAG,UAAU,UAAU;gBAC7B,QAAQ,EAAE,gCAAgC;gBAC1C,MAAM,EAAE,MAAM,CAAC,OAAO;aACzB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,oDAAoD;AACpD,uDAAuD;AACvD,gFAAgF;AAChF,SAAS,qBAAqB,CAC1B,IAAoB,EACpB,UAAkB,EAClB,WAAoB;IAEpB,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAC3C,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,6CAA6C;YACjE,OAAO,EAAE,yDAAyD;YAClE,IAAI,EAAE,GAAG,UAAU,mBAAmB;YACtC,QAAQ,EAAE,mBAAmB;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;SAC3B,CAAC,CAAC;IACP,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,8BAA8B;YAClD,OAAO,EAAE,gEAAgE;YACzE,IAAI,EAAE,GAAG,UAAU,sBAAsB;YACzC,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SAC9B,CAAC,CAAC;IACP,CAAC;IAED,IACI,IAAI,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;QAC3C,CAAC,aAAa,CACV,4BAA4B,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAC3E,EACH,CAAC;QACC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,8CAA8C;YAClE,OAAO,EAAE,6DAA6D;YACtE,IAAI,EAAE,GAAG,UAAU,gCAAgC;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;SACxC,CAAC,CAAC;IACP,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,gFAAgF;AAChF,SAAS,wBAAwB,CAC7B,IAAoB,EACpB,UAAkB,EAClB,WAAoB,EACpB,SAAkB,EAClB,wBAAiC;IAEjC,IAAI,SAAS;QAAE,OAAO,EAAE,CAAC;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAA+B,CAAC;IAC/D,IACI,wBAAwB,KAAK,SAAS;QACtC,SAAS,KAAK,SAAS;QACvB,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,wBAAwB,CAAC,EAClE,CAAC;QACC,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,gCAAgC;gBACpD,OAAO,EAAE,uEAAuE;gBAChF,IAAI,EAAE,GAAG,UAAU,yBAAyB;gBAC5C,QAAQ,EAAE,wBAAwB;gBAClC,MAAM,EAAE,SAAS;aACpB,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,SAAS,8BAA8B,CACnC,OAAiB,EACjB,MAAyB,EACzB,UAAkB,EAClB,WAAoB,EACpB,mBAA2B;IAE3B,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,UAAU,GAAG,eAAe,CAC9B,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,CAChE,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,gBAAgB,IAAI,EAAE,CAAC;IAEvD,UAAU,CAAC,IAAI,CACX,GAAG,8BAA8B,CAC7B,UAAU,EAAE,OAAO,EAAE,UAAU,CAClC,CACJ,CAAC;IAEF,6BAA6B,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAE3E,yEAAyE;IACzE,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,sCAAsC;YAC1D,OAAO,EAAE,gDAAgD;YACzD,IAAI,EAAE,GAAG,UAAU,uBAAuB;SAC7C,CAAC,CAAC;IACP,CAAC;IAED,2DAA2D;IAC3D,IAAI,UAAU,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,6CAA6C;YACjE,OAAO,EAAE,sDAAsD;YAC/D,IAAI,EAAE,GAAG,UAAU,uBAAuB;SAC7C,CAAC,CAAC;IACP,CAAC;IAED,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;QAC5B,8BAA8B,CAC1B,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,mBAAmB,EACrD,UAAU,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAC1D,CAAC;IACN,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC"}
+{"version":3,"file":"evm-sign712-metamask.js","sourceRoot":"","sources":["../../../src/validations/evm-sign712-metamask.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,aAAa,EAEb,aAAa,EACb,kBAAkB,GAGrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACH,0BAA0B,EAC1B,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACzB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,gCAAgC,GAAkC;IACpE,kBAAkB,CAAC,MAAM;IACzB,kBAAkB,CAAC,IAAI;IACvB,kBAAkB,CAAC,IAAI;IACvB,kBAAkB,CAAC,eAAe;CACrC,CAAC;AAEF,MAAM,UAAU,8BAA8B,CAC1C,OAA4B,EAC5B,QAAgB,EAChB,WAAoB,EACpB,SAAkB,EAClB,mBAA2B,EAC3B,wBAAiC;IAEjC,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,sBAAsB;YAAE,SAAS;QAEnE,MAAM,UAAU,GAAG,GAAG,QAAQ,oBAAoB,CAAC,GAAG,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAkC,CAAC;QAEvD,iEAAiE;QACjE,iDAAiD;QACjD,MAAM,cAAc,GAAG,0BAA0B,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACpE,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;YACnC,SAAS;QACb,CAAC;QAED,UAAU,CAAC,IAAI,CACX,GAAG,+BAA+B,CAAC,MAAM,EAAE,UAAU,CAAC,EACtD,GAAG,6BAA6B,CAAC,MAAM,EAAE,UAAU,CAAC,EACpD,GAAG,qBAAqB,CAAC,IAAK,EAAE,UAAU,EAAE,WAAW,CAAC;QACxD,kEAAkE;QAClE,iEAAiE;QACjE,0DAA0D;QAC1D,oEAAoE;QACpE,GAAG,CAAC,SAAS;YACT,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,wBAAwB,CACtB,IAAK,EACL,UAAU,EACV,WAAW,EACX,wBAAwB,EACxB,0BAA0B,CAC7B,CAAC,CACT,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,IAAK,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAa,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,gBAAgB,IAAI,EAAE,CAAC;QACvD,UAAU,CAAC,IAAI,CACX,GAAG,sBAAsB,CACrB,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,CAClF,CACJ,CAAC;IACN,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,4DAA4D;AAC5D,SAAS,+BAA+B,CACpC,MAAyB,EACzB,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,gBAAgB,IAAI,EAAE,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,oCAAoC;gBACxD,OAAO,EAAE,wDAAwD;gBACjE,IAAI,EAAE,GAAG,UAAU,2BAA2B;gBAC9C,MAAM,EAAE,OAAO;aAClB,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,6BAA6B,CAClC,MAAyB,EACzB,UAAkB;IAElB,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,gCAAgC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACjD,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,8BAA8B;gBAClD,OAAO,EAAE,2BAA2B,EAAE,kBAAkB;gBACxD,IAAI,EAAE,GAAG,UAAU,UAAU;gBAC7B,QAAQ,EAAE,gCAAgC;gBAC1C,MAAM,EAAE,MAAM,CAAC,OAAO;aACzB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACtB,CAAC"}

package/dist/esm/validations/evm-sign712-shared.js

@@ -0,0 +1,110 @@
+import { ViolationCode, } from "../types/index.js";
+import { isWhitelisted } from "../whitelists/types.js";
+import { DELEGATION_MANAGER_CONTRACTS } from "../whitelists/evm/index.js";
+import { addressEquals } from "../helpers/address.js";
+import { classifyCaveats, validateExactExecutionPresence, validateExactExecutionContent, validateTimestampEnforcerValue, } from "./evm-caveats.js";
+// Shared content-validators for `Sign712MetaMaskCaveats` /
+// `Sign712MetaMaskCaveatsWithPlaceholders` payloads. Used both in intent-scope
+// and hook-scope.
+// CRITICAL: `data` must be present and contain `domain` and `message`. If this
+// fails, downstream content-validators must not run (they assume `data.domain`
+// and `data.message` exist).
+export function validateSign712DataPresent(data, actionPath) {
+    if (!data || !data.domain || !data.message) {
+        return [{
+                code: ViolationCode.Sign712MetaMaskDomainNameNotDelegationManager,
+                message: "Sign712MetaMask data is missing domain or message",
+                path: `${actionPath}.data`,
+                actual: data,
+            }];
+    }
+    return [];
+}
+// CRITICAL: domain.name must be "DelegationManager"
+// CRITICAL: domain.chainId must equal the real chainId
+// CRITICAL: domain.verifyingContract must be in the DelegationManager whitelist
+export function validateSign712Domain(data, actionPath, realChainId) {
+    const violations = [];
+    if (data.domain.name !== "DelegationManager") {
+        violations.push({
+            code: ViolationCode.Sign712MetaMaskDomainNameNotDelegationManager,
+            message: `Sign712MetaMask domain.name must be "DelegationManager"`,
+            path: `${actionPath}.data.domain.name`,
+            expected: "DelegationManager",
+            actual: data.domain.name,
+        });
+    }
+    if (data.domain.chainId !== realChainId) {
+        violations.push({
+            code: ViolationCode.Sign712MetaMaskChainIdMismatch,
+            message: `Sign712MetaMask domain.chainId does not match the real chainId`,
+            path: `${actionPath}.data.domain.chainId`,
+            expected: realChainId,
+            actual: data.domain.chainId,
+        });
+    }
+    if (data.domain.verifyingContract === undefined
+        || !isWhitelisted(DELEGATION_MANAGER_CONTRACTS, realChainId, data.domain.verifyingContract)) {
+        violations.push({
+            code: ViolationCode.Sign712MetaMaskVerifyingContractNotWhitelisted,
+            message: `Sign712MetaMask domain.verifyingContract is not whitelisted`,
+            path: `${actionPath}.data.domain.verifyingContract`,
+            actual: data.domain.verifyingContract,
+        });
+    }
+    return violations;
+}
+// CRITICAL: message.delegator must match the address that requested the
+// delegation. The trust source differs per scope (intent uses the trade's
+// `srcChainAuthorityAddress`, hook uses `hook.from`); the comparison itself is
+// shared. Caller passes `expectedDelegator = undefined` to record the violation
+// without an expected value.
+export function validateSign712Delegator(data, actionPath, realChainId, expectedDelegator, expectedSourceLabel) {
+    const delegator = data.message.delegator;
+    if (expectedDelegator === undefined
+        || delegator === undefined
+        || !addressEquals(realChainId, delegator, expectedDelegator)) {
+        return [{
+                code: ViolationCode.Sign712MetaMaskDelegatorMismatch,
+                message: `Sign712MetaMask message.delegator must match ${expectedSourceLabel}`,
+                path: `${actionPath}.data.message.delegator`,
+                expected: expectedDelegator,
+                actual: delegator,
+            }];
+    }
+    return [];
+}
+// CRITICAL: caveats must contain valid IdEnforcer (replay protection),
+// TimestampEnforcer (with correct beforeThreshold), and ExactExecution /
+// ExactExecutionBatch caveats whose content matches `transactionCalls[]`.
+export function validateSign712Caveats(caveats, actionId, transactionCalls, actionPath, realChainId, expirationTimestamp) {
+    const violations = [];
+    const classified = classifyCaveats(caveats, actionId, actionPath, realChainId, violations);
+    violations.push(...validateExactExecutionPresence(classified, transactionCalls, actionPath));
+    validateExactExecutionContent(classified, transactionCalls, actionPath, violations);
+    // CRITICAL: must have at least one IdEnforcer caveat (replay protection)
+    if (!classified.hasIdEnforcer) {
+        violations.push({
+            code: ViolationCode.Sign712MetaMaskMissingIdEnforcerCaveat,
+            message: "Sign712MetaMask must have an IdEnforcer caveat",
+            path: `${actionPath}.data.message.caveats`,
+        });
+    }
+    // CRITICAL: must have exactly one TimestampEnforcer caveat.
+    if (classified.timestampCount !== 1) {
+        violations.push({
+            code: classified.timestampCount === 0
+                ? ViolationCode.Sign712MetaMaskMissingTimestampEnforcerCaveat
+                : ViolationCode.Sign712MetaMaskDuplicateTimestampEnforcerCaveat,
+            message: "Sign712MetaMask must have exactly one TimestampEnforcer",
+            path: `${actionPath}.data.message.caveats`,
+            expected: 1,
+            actual: classified.timestampCount,
+        });
+    }
+    if (classified.firstTimestamp) {
+        validateTimestampEnforcerValue(classified.firstTimestamp.caveat, expirationTimestamp, classified.firstTimestamp.index, actionPath, violations);
+    }
+    return violations;
+}
+//# sourceMappingURL=evm-sign712-shared.js.map

package/dist/esm/validations/evm-sign712-shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evm-sign712-shared.js","sourceRoot":"","sources":["../../../src/validations/evm-sign712-shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,aAAa,GAIhB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAEH,eAAe,EACf,8BAA8B,EAC9B,6BAA6B,EAC7B,8BAA8B,GACjC,MAAM,eAAe,CAAC;AAEvB,2DAA2D;AAC3D,+EAA+E;AAC/E,kBAAkB;AAElB,+EAA+E;AAC/E,+EAA+E;AAC/E,6BAA6B;AAC7B,MAAM,UAAU,0BAA0B,CACtC,IAAgC,EAChC,UAAkB;IAElB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,6CAA6C;gBACjE,OAAO,EAAE,mDAAmD;gBAC5D,IAAI,EAAE,GAAG,UAAU,OAAO;gBAC1B,MAAM,EAAE,IAAI;aACf,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,oDAAoD;AACpD,uDAAuD;AACvD,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACjC,IAAoB,EACpB,UAAkB,EAClB,WAAoB;IAEpB,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAC3C,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,6CAA6C;YACjE,OAAO,EAAE,yDAAyD;YAClE,IAAI,EAAE,GAAG,UAAU,mBAAmB;YACtC,QAAQ,EAAE,mBAAmB;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;SAC3B,CAAC,CAAC;IACP,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,8BAA8B;YAClD,OAAO,EAAE,gEAAgE;YACzE,IAAI,EAAE,GAAG,UAAU,sBAAsB;YACzC,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SAC9B,CAAC,CAAC;IACP,CAAC;IAED,IACI,IAAI,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;WACxC,CAAC,aAAa,CACb,4BAA4B,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAC3E,EACH,CAAC;QACC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,8CAA8C;YAClE,OAAO,EAAE,6DAA6D;YACtE,IAAI,EAAE,GAAG,UAAU,gCAAgC;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;SACxC,CAAC,CAAC;IACP,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,wEAAwE;AACxE,0EAA0E;AAC1E,+EAA+E;AAC/E,gFAAgF;AAChF,6BAA6B;AAC7B,MAAM,UAAU,wBAAwB,CACpC,IAAoB,EACpB,UAAkB,EAClB,WAAoB,EACpB,iBAAqC,EACrC,mBAA2B;IAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAA+B,CAAC;IAC/D,IACI,iBAAiB,KAAK,SAAS;WAC5B,SAAS,KAAK,SAAS;WACvB,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,iBAAiB,CAAC,EAC9D,CAAC;QACC,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,gCAAgC;gBACpD,OAAO,EAAE,gDAAgD,mBAAmB,EAAE;gBAC9E,IAAI,EAAE,GAAG,UAAU,yBAAyB;gBAC5C,QAAQ,EAAE,iBAAiB;gBAC3B,MAAM,EAAE,SAAS;aACpB,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,MAAM,UAAU,sBAAsB,CAClC,OAAiB,EACjB,QAAgB,EAChB,gBAAsC,EACtC,UAAkB,EAClB,WAAoB,EACpB,mBAA2B;IAE3B,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,UAAU,GAAG,eAAe,CAC9B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,CACzD,CAAC;IAEF,UAAU,CAAC,IAAI,CACX,GAAG,8BAA8B,CAAC,UAAU,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAC9E,CAAC;IACF,6BAA6B,CAAC,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAEpF,yEAAyE;IACzE,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,sCAAsC;YAC1D,OAAO,EAAE,gDAAgD;YACzD,IAAI,EAAE,GAAG,UAAU,uBAAuB;SAC7C,CAAC,CAAC;IACP,CAAC;IAED,4DAA4D;IAC5D,IAAI,UAAU,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,UAAU,CAAC,cAAc,KAAK,CAAC;gBACjC,CAAC,CAAC,aAAa,CAAC,6CAA6C;gBAC7D,CAAC,CAAC,aAAa,CAAC,+CAA+C;YACnE,OAAO,EAAE,yDAAyD;YAClE,IAAI,EAAE,GAAG,UAAU,uBAAuB;YAC1C,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,UAAU,CAAC,cAAc;SACpC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;QAC5B,8BAA8B,CAC1B,UAAU,CAAC,cAAc,CAAC,MAAM,EAChC,mBAAmB,EACnB,UAAU,CAAC,cAAc,CAAC,KAAK,EAC/B,UAAU,EACV,UAAU,CACb,CAAC;IACN,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC"}

package/dist/esm/validations/evm-sign7702.js

@@ -4,6 +4,38 @@ import { EIP7702_DELEGATION_CONTRACTS } from "../whitelists/evm/index.js";
 // =============================================
 // Sign7702Authorization constraints
 // =============================================
+// CRITICAL: per-action checks for a `Sign7702Authorization` action.
+// Shared between intent-scope (`validateSign7702Actions`) and hook-scope
+// (`validateHookSign7702Binding`); both wrap this with their scope-specific
+// constraints (intent: position+duplicate; hook: type↔actions binding +
+// `validateHookDelegateOp` for position/count).
+export function validateSign7702Action(action, actionPath, realChainId) {
+    const violations = [];
+    // HIGH: actions[] must contain exactly one element — Delegate
+    const ops = action.actions;
+    if (ops.length !== 1 || ops[0] !== EvmActionOperation.Delegate) {
+        violations.push({
+            code: ViolationCode.Sign7702ActionsNotSingleDelegate,
+            message: `Sign7702Authorization actions must contain exactly [Delegate]`,
+            path: `${actionPath}.actions`,
+            expected: [EvmActionOperation.Delegate],
+            actual: action.actions,
+        });
+    }
+    // CRITICAL: data.contractAddress must be in the whitelist
+    const data = action.data;
+    const contractAddress = data?.contractAddress;
+    if (!contractAddress
+        || !isWhitelisted(EIP7702_DELEGATION_CONTRACTS, realChainId, contractAddress)) {
+        violations.push({
+            code: ViolationCode.Sign7702ContractAddressNotWhitelisted,
+            message: `Sign7702Authorization contractAddress is not in the whitelist`,
+            path: `${actionPath}.data.contractAddress`,
+            actual: contractAddress,
+        });
+    }
+    return violations;
+}
 export function validateSign7702Actions(actions, basePath, realChainId) {
     const violations = [];
     let sign7702Count = 0;
@@ -13,28 +45,7 @@ export function validateSign7702Actions(actions, basePath, realChainId) {
         if (action.type !== EvmActionKind.Sign7702Authorization)
             continue;
         const actionPath = `${basePath}.requiredActions[${i}]`;
-        // HIGH: actions[] must contain exactly one element — Delegate
-        if (action.actions.length !== 1 ||
-            action.actions[0] !== EvmActionOperation.Delegate) {
-            violations.push({
-                code: ViolationCode.Sign7702ActionsNotSingleDelegate,
-                message: `Sign7702Authorization actions must contain exactly [Delegate]`,
-                path: `${actionPath}.actions`,
-                expected: [EvmActionOperation.Delegate],
-                actual: action.actions,
-            });
-        }
-        // CRITICAL: data.contractAddress must be in the whitelist
-        const data = action.data;
-        const contractAddress = data?.contractAddress;
-        if (!contractAddress || !isWhitelisted(EIP7702_DELEGATION_CONTRACTS, realChainId, contractAddress)) {
-            violations.push({
-                code: ViolationCode.Sign7702ContractAddressNotWhitelisted,
-                message: `Sign7702Authorization contractAddress is not in the whitelist`,
-                path: `${actionPath}.data.contractAddress`,
-                actual: contractAddress,
-            });
-        }
+        violations.push(...validateSign7702Action(action, actionPath, realChainId));
         // HIGH: at most one Sign7702Authorization per intent
         // Note: only the first duplicate will be reported, subsequent ones will be ignored
         sign7702Count++;

package/dist/esm/validations/evm-sign7702.js.map

@@ -1 +1 @@
-{"version":3,"file":"evm-sign7702.js","sourceRoot":"","sources":["../../../src/validations/evm-sign7702.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,aAAa,EAEb,aAAa,EACb,kBAAkB,GAGrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAEjE,gDAAgD;AAChD,oCAAoC;AACpC,gDAAgD;AAEhD,MAAM,UAAU,uBAAuB,CACnC,OAA4B,EAC5B,QAAgB,EAChB,WAAoB;IAEpB,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,kBAAkB,GAAG,CAAC,CAAC,CAAC;IAE5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,qBAAqB;YAAE,SAAS;QAElE,MAAM,UAAU,GAAG,GAAG,QAAQ,oBAAoB,CAAC,GAAG,CAAC;QAEvD,8DAA8D;QAC9D,IACI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAC3B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,QAAQ,EACnD,CAAC;YACC,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,gCAAgC;gBACpD,OAAO,EAAE,+DAA+D;gBACxE,IAAI,EAAE,GAAG,UAAU,UAAU;gBAC7B,QAAQ,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC;gBACvC,MAAM,EAAE,MAAM,CAAC,OAAO;aACzB,CAAC,CAAC;QACP,CAAC;QAED,0DAA0D;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAgD,CAAC;QACrE,MAAM,eAAe,GAAG,IAAI,EAAE,eAAe,CAAC;QAC9C,IAAI,CAAC,eAAe,IAAI,CAAC,aAAa,CAAC,4BAA4B,EAAE,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;YACjG,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,qCAAqC;gBACzD,OAAO,EAAE,+DAA+D;gBACxE,IAAI,EAAE,GAAG,UAAU,uBAAuB;gBAC1C,MAAM,EAAE,eAAe;aAC1B,CAAC,CAAC;QACP,CAAC;QAED,qDAAqD;QACrD,mFAAmF;QACnF,aAAa,EAAE,CAAC;QAChB,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;YACtB,kBAAkB,GAAG,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;YAC7B,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,8BAA8B;gBAClD,OAAO,EAAE,kEAAkE,kBAAkB,QAAQ,CAAC,EAAE;gBACxG,IAAI,EAAE,GAAG,UAAU,OAAO;gBAC1B,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,aAAa;aACxB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC"}
+{"version":3,"file":"evm-sign7702.js","sourceRoot":"","sources":["../../../src/validations/evm-sign7702.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,aAAa,EAEb,aAAa,EACb,kBAAkB,GAIrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAEjE,gDAAgD;AAChD,oCAAoC;AACpC,gDAAgD;AAEhD,oEAAoE;AACpE,yEAAyE;AACzE,4EAA4E;AAC5E,wEAAwE;AACxE,gDAAgD;AAChD,MAAM,UAAU,sBAAsB,CAClC,MAA0E,EAC1E,UAAkB,EAClB,WAAoB;IAEpB,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,8DAA8D;IAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAmB,CAAC;IACvC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,QAAQ,EAAE,CAAC;QAC7D,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,gCAAgC;YACpD,OAAO,EAAE,+DAA+D;YACxE,IAAI,EAAE,GAAG,UAAU,UAAU;YAC7B,QAAQ,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC;YACvC,MAAM,EAAE,MAAM,CAAC,OAAO;SACzB,CAAC,CAAC;IACP,CAAC;IAED,0DAA0D;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAgD,CAAC;IACrE,MAAM,eAAe,GAAG,IAAI,EAAE,eAAe,CAAC;IAC9C,IACI,CAAC,eAAe;WACb,CAAC,aAAa,CAAC,4BAA4B,EAAE,WAAW,EAAE,eAAe,CAAC,EAC/E,CAAC;QACC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,qCAAqC;YACzD,OAAO,EAAE,+DAA+D;YACxE,IAAI,EAAE,GAAG,UAAU,uBAAuB;YAC1C,MAAM,EAAE,eAAe;SAC1B,CAAC,CAAC;IACP,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACnC,OAA4B,EAC5B,QAAgB,EAChB,WAAoB;IAEpB,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,kBAAkB,GAAG,CAAC,CAAC,CAAC;IAE5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,qBAAqB;YAAE,SAAS;QAElE,MAAM,UAAU,GAAG,GAAG,QAAQ,oBAAoB,CAAC,GAAG,CAAC;QACvD,UAAU,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;QAE5E,qDAAqD;QACrD,mFAAmF;QACnF,aAAa,EAAE,CAAC;QAChB,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;YACtB,kBAAkB,GAAG,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;YAC7B,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,8BAA8B;gBAClD,OAAO,EAAE,kEAAkE,kBAAkB,QAAQ,CAAC,EAAE;gBACxG,IAAI,EAAE,GAAG,UAAU,OAAO;gBAC1B,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,aAAa;aACxB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC"}