@debridge-finance/borderless-validation-sdk 0.0.0-dev-dee2389

package/dist/esm/validations/evm-permit.js

@@ -0,0 +1,221 @@
+import { ViolationCode, EvmActionKind, EvmActionOperation, ApprovalMode, } from "../types/index.js";
+import { isWhitelisted } from "../whitelists/types.js";
+import { resolveWrappedTokenAddress } from "../helpers/evm-token.js";
+import { getTokenPermitMetadata } from "../graylists/evm/token-permit-metadata.js";
+import { addressEquals, normalizeAddress } from "../helpers/address.js";
+// =============================================
+// Permit (EIP-2612) constraints
+// =============================================
+export function validatePermitActions(actions, basePath, request, response, realChainId, quoteMode, trades, srcChainAuthorityAddress, envConfig) {
+    const violations = [];
+    for (let i = 0; i < actions.length; i++) {
+        const action = actions[i];
+        if (action.type !== EvmActionKind.Permit)
+            continue;
+        const actionPath = `${basePath}.requiredActions[${i}]`;
+        const data = action.data;
+        // CRITICAL: Permit only allowed with approvalMode === 'permit'
+        violations.push(...validatePermitApprovalMode(request, actionPath));
+        // HIGH: actions[] must contain exactly [Budget]
+        violations.push(...validatePermitActionsList(action, actionPath));
+        violations.push(...validatePermitPrimaryType(data, actionPath), ...validatePermitDomain(data, actionPath, realChainId, trades), ...validatePermitMessage(data, actionPath, response, realChainId, quoteMode, srcChainAuthorityAddress, envConfig), ...validatePermitDetails(action, data, actionPath, realChainId));
+    }
+    return violations;
+}
+// CRITICAL: Permit only allowed with approvalMode === 'permit'
+function validatePermitApprovalMode(request, actionPath) {
+    if (request.approvalMode !== ApprovalMode.Permit) {
+        return [{
+                code: ViolationCode.PermitForbiddenWithoutPermitMode,
+                message: `Permit action requires approvalMode="${ApprovalMode.Permit}"`,
+                path: `${actionPath}.type`,
+                expected: ApprovalMode.Permit,
+                actual: request.approvalMode,
+            }];
+    }
+    return [];
+}
+// HIGH: actions[] must contain exactly [Budget]
+function validatePermitActionsList(action, actionPath) {
+    if (action.actions.length !== 1 ||
+        action.actions[0] !== EvmActionOperation.Budget) {
+        return [{
+                code: ViolationCode.PermitActionsNotSingleBudget,
+                message: `Permit actions must contain exactly [Budget]`,
+                path: `${actionPath}.actions`,
+                expected: [EvmActionOperation.Budget],
+                actual: action.actions,
+            }];
+    }
+    return [];
+}
+// CRITICAL: primaryType must be "Permit"
+function validatePermitPrimaryType(data, actionPath) {
+    if (data.primaryType !== "Permit") {
+        return [{
+                code: ViolationCode.PermitPrimaryTypeInvalid,
+                message: `Permit primaryType must be "Permit"`,
+                path: `${actionPath}.data.primaryType`,
+                expected: "Permit",
+                actual: data.primaryType,
+            }];
+    }
+    return [];
+}
+// CRITICAL: domain.chainId = real chainId
+// CRITICAL: domain.verifyingContract = token address (or WETH for native)
+// LOW: domain.name/version checked against graylist for known tokens
+function validatePermitDomain(data, actionPath, realChainId, trades) {
+    const violations = [];
+    // CRITICAL: domain.chainId must equal real chainId
+    if (data.domain.chainId !== realChainId) {
+        violations.push({
+            code: ViolationCode.PermitChainIdMismatch,
+            message: `Permit domain.chainId does not match the real chainId`,
+            path: `${actionPath}.data.domain.chainId`,
+            expected: realChainId,
+            actual: data.domain.chainId,
+        });
+    }
+    // CRITICAL: domain.verifyingContract must be a token from request trades
+    const expectedTokens = getExpectedTokenAddresses(trades, realChainId);
+    if (data.domain.verifyingContract === undefined ||
+        !expectedTokens.some(t => addressEquals(realChainId, t, data.domain.verifyingContract))) {
+        violations.push({
+            code: ViolationCode.PermitVerifyingContractMismatch,
+            message: `Permit domain.verifyingContract must correspond to a srcChainTokenIn from request trades`,
+            path: `${actionPath}.data.domain.verifyingContract`,
+            expected: expectedTokens,
+            actual: data.domain.verifyingContract,
+        });
+    }
+    // LOW: check domain.name/version for known tokens (graylist)
+    if (data.domain.verifyingContract !== undefined) {
+        const metadata = getTokenPermitMetadata(realChainId, data.domain.verifyingContract);
+        if (metadata) {
+            if (data.domain.name !== metadata.name) {
+                violations.push({
+                    code: ViolationCode.PermitDomainNameMismatch,
+                    message: `Permit domain.name does not match known token metadata`,
+                    path: `${actionPath}.data.domain.name`,
+                    expected: metadata.name,
+                    actual: data.domain.name,
+                });
+            }
+            if (data.domain.version !== undefined &&
+                data.domain.version !== metadata.version) {
+                violations.push({
+                    code: ViolationCode.PermitDomainVersionMismatch,
+                    message: `Permit domain.version does not match known token metadata`,
+                    path: `${actionPath}.data.domain.version`,
+                    expected: metadata.version,
+                    actual: data.domain.version,
+                });
+            }
+        }
+    }
+    return violations;
+}
+// CRITICAL: message.owner = srcChainAuthorityAddress (execution mode)
+// CRITICAL: message.spender = AllowanceHolder or preHook address
+function validatePermitMessage(data, actionPath, response, realChainId, quoteMode, srcChainAuthorityAddress, envConfig) {
+    const violations = [];
+    const msg = data.message;
+    // CRITICAL: owner must match srcChainAuthorityAddress in execution mode
+    if (!quoteMode) {
+        const owner = msg.owner;
+        if (srcChainAuthorityAddress === undefined ||
+            owner === undefined ||
+            !addressEquals(realChainId, owner, srcChainAuthorityAddress)) {
+            violations.push({
+                code: ViolationCode.PermitOwnerMismatch,
+                message: `Permit message.owner must match srcChainAuthorityAddress`,
+                path: `${actionPath}.data.message.owner`,
+                expected: srcChainAuthorityAddress,
+                actual: owner,
+            });
+        }
+    }
+    // CRITICAL: spender must be AllowanceHolder or preHook address
+    const spender = msg.spender;
+    if (spender === undefined) {
+        violations.push({
+            code: ViolationCode.PermitSpenderMissing,
+            message: `Permit message.spender is missing`,
+            path: `${actionPath}.data.message.spender`,
+            actual: undefined,
+        });
+    }
+    else if (!isAllowedSpender(spender, response, realChainId, envConfig)) {
+        violations.push({
+            code: ViolationCode.PermitSpenderNotAllowed,
+            message: `Permit message.spender is not an allowed address`,
+            path: `${actionPath}.data.message.spender`,
+            actual: spender,
+        });
+    }
+    return violations;
+}
+// CRITICAL: details must match message fields
+function validatePermitDetails(action, data, actionPath, realChainId) {
+    const details = action.details;
+    if (!details) {
+        return [{
+                code: ViolationCode.PermitDetailsMissing,
+                message: `Permit action must have details`,
+                path: `${actionPath}.details`,
+                actual: undefined,
+            }];
+    }
+    const violations = [];
+    const spender = data.message.spender;
+    // CRITICAL: details.allowanceHolder must match message.spender
+    if (details.allowanceHolder === undefined ||
+        spender === undefined ||
+        !addressEquals(realChainId, details.allowanceHolder, spender)) {
+        violations.push({
+            code: ViolationCode.PermitDetailsAllowanceHolderMismatch,
+            message: `Permit details.allowanceHolder must match message.spender`,
+            path: `${actionPath}.details.allowanceHolder`,
+            expected: spender,
+            actual: details.allowanceHolder,
+        });
+    }
+    // CRITICAL: details.tokenAddress must match domain.verifyingContract
+    if (details.tokenAddress === undefined ||
+        data.domain.verifyingContract === undefined ||
+        !addressEquals(realChainId, details.tokenAddress, data.domain.verifyingContract)) {
+        violations.push({
+            code: ViolationCode.PermitDetailsTokenAddressMismatch,
+            message: `Permit details.tokenAddress must match domain.verifyingContract`,
+            path: `${actionPath}.details.tokenAddress`,
+            expected: data.domain.verifyingContract,
+            actual: details.tokenAddress,
+        });
+    }
+    return violations;
+}
+// Collects all expected token addresses from trades (resolved for native)
+function getExpectedTokenAddresses(trades, realChainId) {
+    const tokens = new Set();
+    for (const trade of trades) {
+        const resolved = resolveWrappedTokenAddress(trade.srcChainTokenIn, realChainId);
+        if (resolved)
+            tokens.add(normalizeAddress(realChainId, resolved));
+    }
+    return Array.from(tokens);
+}
+function isAllowedSpender(spender, response, realChainId, envConfig) {
+    // Check AllowanceHolder whitelist
+    if (isWhitelisted(envConfig.allowanceHolderContracts, realChainId, spender)) {
+        return true;
+    }
+    // Check preHook addresses
+    for (const hookPayload of response.preHooks) {
+        if (hookPayload.hook.to && addressEquals(realChainId, hookPayload.hook.to, spender)) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=evm-permit.js.map

package/dist/esm/validations/evm-permit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evm-permit.js","sourceRoot":"","sources":["../../../src/validations/evm-permit.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,aAAa,EAIb,aAAa,EACb,kBAAkB,EAElB,YAAY,GAGf,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAqB,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAErE,gDAAgD;AAChD,gCAAgC;AAChC,gDAAgD;AAEhD,MAAM,UAAU,qBAAqB,CACjC,OAA4B,EAC5B,QAAgB,EAChB,OAA8B,EAC9B,QAAgC,EAChC,WAAoB,EACpB,SAAkB,EAClB,MAAsB,EACtB,wBAA4C,EAC5C,SAA4B;IAE5B,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM;YAAE,SAAS;QAEnD,MAAM,UAAU,GAAG,GAAG,QAAQ,oBAAoB,CAAC,GAAG,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAsB,CAAC;QAE3C,+DAA+D;QAC/D,UAAU,CAAC,IAAI,CACX,GAAG,0BAA0B,CAAC,OAAO,EAAE,UAAU,CAAC,CACrD,CAAC;QAEF,gDAAgD;QAChD,UAAU,CAAC,IAAI,CACX,GAAG,yBAAyB,CAAC,MAAM,EAAE,UAAU,CAAC,CACnD,CAAC;QAEF,UAAU,CAAC,IAAI,CACX,GAAG,yBAAyB,CAAC,IAAI,EAAE,UAAU,CAAC,EAC9C,GAAG,oBAAoB,CACnB,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CACxC,EACD,GAAG,qBAAqB,CACpB,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,wBAAwB,EAAE,SAAS,CAC1F,EACD,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CAClE,CAAC;IACN,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,+DAA+D;AAC/D,SAAS,0BAA0B,CAC/B,OAA8B,EAC9B,UAAkB;IAElB,IAAI,OAAO,CAAC,YAAY,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QAC/C,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,gCAAgC;gBACpD,OAAO,EAAE,wCAAwC,YAAY,CAAC,MAAM,GAAG;gBACvE,IAAI,EAAE,GAAG,UAAU,OAAO;gBAC1B,QAAQ,EAAE,YAAY,CAAC,MAAM;gBAC7B,MAAM,EAAE,OAAO,CAAC,YAAY;aAC/B,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,gDAAgD;AAChD,SAAS,yBAAyB,CAC9B,MAAyB,EACzB,UAAkB;IAElB,IACI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAC3B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,MAAM,EACjD,CAAC;QACC,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,4BAA4B;gBAChD,OAAO,EAAE,8CAA8C;gBACvD,IAAI,EAAE,GAAG,UAAU,UAAU;gBAC7B,QAAQ,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;gBACrC,MAAM,EAAE,MAAM,CAAC,OAAO;aACzB,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,yCAAyC;AACzC,SAAS,yBAAyB,CAC9B,IAAoB,EACpB,UAAkB;IAElB,IAAI,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,wBAAwB;gBAC5C,OAAO,EAAE,qCAAqC;gBAC9C,IAAI,EAAE,GAAG,UAAU,mBAAmB;gBACtC,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,IAAI,CAAC,WAAW;aAC3B,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,0CAA0C;AAC1C,0EAA0E;AAC1E,qEAAqE;AACrE,SAAS,oBAAoB,CACzB,IAAoB,EACpB,UAAkB,EAClB,WAAoB,EACpB,MAAsB;IAEtB,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,mDAAmD;IACnD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,qBAAqB;YACzC,OAAO,EAAE,uDAAuD;YAChE,IAAI,EAAE,GAAG,UAAU,sBAAsB;YACzC,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SAC9B,CAAC,CAAC;IACP,CAAC;IAED,yEAAyE;IACzE,MAAM,cAAc,GAAG,yBAAyB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtE,IACI,IAAI,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;QAC3C,CAAC,cAAc,CAAC,IAAI,CAChB,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAkB,CAAC,CACrE,EACH,CAAC;QACC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,+BAA+B;YACnD,OAAO,EAAE,0FAA0F;YACnG,IAAI,EAAE,GAAG,UAAU,gCAAgC;YACnD,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;SACxC,CAAC,CAAC;IACP,CAAC;IAED,6DAA6D;IAC7D,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,sBAAsB,CACnC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAC7C,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACrC,UAAU,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,aAAa,CAAC,wBAAwB;oBAC5C,OAAO,EAAE,wDAAwD;oBACjE,IAAI,EAAE,GAAG,UAAU,mBAAmB;oBACtC,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;iBAC3B,CAAC,CAAC;YACP,CAAC;YACD,IACI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS;gBACjC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,EAC1C,CAAC;gBACC,UAAU,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,aAAa,CAAC,2BAA2B;oBAC/C,OAAO,EAAE,2DAA2D;oBACpE,IAAI,EAAE,GAAG,UAAU,sBAAsB;oBACzC,QAAQ,EAAE,QAAQ,CAAC,OAAO;oBAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACP,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,sEAAsE;AACtE,iEAAiE;AACjE,SAAS,qBAAqB,CAC1B,IAAoB,EACpB,UAAkB,EAClB,QAAgC,EAChC,WAAoB,EACpB,SAAkB,EAClB,wBAA4C,EAC5C,SAA4B;IAE5B,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC;IAEzB,wEAAwE;IACxE,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,CAAC,KAA2B,CAAC;QAC9C,IACI,wBAAwB,KAAK,SAAS;YACtC,KAAK,KAAK,SAAS;YACnB,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,wBAAwB,CAAC,EAC9D,CAAC;YACC,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,mBAAmB;gBACvC,OAAO,EAAE,0DAA0D;gBACnE,IAAI,EAAE,GAAG,UAAU,qBAAqB;gBACxC,QAAQ,EAAE,wBAAwB;gBAClC,MAAM,EAAE,KAAK;aAChB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,MAAM,OAAO,GAAG,GAAG,CAAC,OAA6B,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACxB,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,oBAAoB;YACxC,OAAO,EAAE,mCAAmC;YAC5C,IAAI,EAAE,GAAG,UAAU,uBAAuB;YAC1C,MAAM,EAAE,SAAS;SACpB,CAAC,CAAC;IACP,CAAC;SAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;QACtE,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,uBAAuB;YAC3C,OAAO,EAAE,kDAAkD;YAC3D,IAAI,EAAE,GAAG,UAAU,uBAAuB;YAC1C,MAAM,EAAE,OAAO;SAClB,CAAC,CAAC;IACP,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,8CAA8C;AAC9C,SAAS,qBAAqB,CAC1B,MAAyB,EACzB,IAAoB,EACpB,UAAkB,EAClB,WAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,oBAAoB;gBACxC,OAAO,EAAE,iCAAiC;gBAC1C,IAAI,EAAE,GAAG,UAAU,UAAU;gBAC7B,MAAM,EAAE,SAAS;aACpB,CAAC,CAAC;IACP,CAAC;IAED,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAA6B,CAAC;IAE3D,+DAA+D;IAC/D,IACI,OAAO,CAAC,eAAe,KAAK,SAAS;QACrC,OAAO,KAAK,SAAS;QACrB,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,EAC/D,CAAC;QACC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,oCAAoC;YACxD,OAAO,EAAE,2DAA2D;YACpE,IAAI,EAAE,GAAG,UAAU,0BAA0B;YAC7C,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,OAAO,CAAC,eAAe;SAClC,CAAC,CAAC;IACP,CAAC;IAED,qEAAqE;IACrE,IACI,OAAO,CAAC,YAAY,KAAK,SAAS;QAClC,IAAI,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;QAC3C,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAClF,CAAC;QACC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,iCAAiC;YACrD,OAAO,EAAE,iEAAiE;YAC1E,IAAI,EAAE,GAAG,UAAU,uBAAuB;YAC1C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;YACvC,MAAM,EAAE,OAAO,CAAC,YAAY;SAC/B,CAAC,CAAC;IACP,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,0EAA0E;AAC1E,SAAS,yBAAyB,CAC9B,MAAsB,EACtB,WAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,0BAA0B,CACvC,KAAK,CAAC,eAAe,EAAE,WAAW,CACrC,CAAC;QACF,IAAI,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,gBAAgB,CACrB,OAAe,EACf,QAAgC,EAChC,WAAoB,EACpB,SAA4B;IAE5B,kCAAkC;IAClC,IAAI,aAAa,CAAC,SAAS,CAAC,wBAAwB,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,0BAA0B;IAC1B,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC1C,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC"}

package/dist/esm/validations/evm-permit2.js

@@ -0,0 +1,358 @@
+import { ViolationCode, EvmActionKind, EvmActionOperation, ApprovalMode, } from "../types/index.js";
+import { isWhitelisted } from "../whitelists/types.js";
+import { PERMIT2_CONTRACTS } from "../whitelists/evm/index.js";
+import { maxUint160 } from "viem";
+import { resolveWrappedTokenAddress } from "../helpers/evm-token.js";
+import { addressEquals, normalizeAddress } from "../helpers/address.js";
+// =============================================
+// Permit2 (Uniswap AllowanceTransfer) constraints
+// =============================================
+const EXPECTED_TYPES = {
+    EIP712Domain: [
+        { name: "name", type: "string" },
+        { name: "chainId", type: "uint256" },
+        { name: "verifyingContract", type: "address" },
+    ],
+    PermitSingle: [
+        { name: "details", type: "PermitDetails" },
+        { name: "spender", type: "address" },
+        { name: "sigDeadline", type: "uint256" },
+    ],
+    PermitDetails: [
+        { name: "token", type: "address" },
+        { name: "amount", type: "uint160" },
+        { name: "expiration", type: "uint48" },
+        { name: "nonce", type: "uint48" },
+    ],
+};
+export function validatePermit2Actions(actions, basePath, request, response, realChainId, trades, envConfig) {
+    const violations = [];
+    for (let i = 0; i < actions.length; i++) {
+        const action = actions[i];
+        if (action.type !== EvmActionKind.Permit2)
+            continue;
+        const actionPath = `${basePath}.requiredActions[${i}]`;
+        const data = action.data;
+        // CRITICAL: only allowed with approvalMode === 'permit'
+        violations.push(...validatePermit2ApprovalMode(request, actionPath));
+        // HIGH: actions[] must contain exactly [Budget]
+        violations.push(...validatePermit2ActionsList(action, actionPath));
+        violations.push(...validatePermit2PrimaryType(data, actionPath), ...validatePermit2Domain(data, actionPath, realChainId), ...validatePermit2Types(data, actionPath), ...validatePermit2Message(data, actionPath, request, response, realChainId, trades, envConfig), ...validatePermit2Details(action, data, actionPath, realChainId));
+    }
+    return violations;
+}
+// CRITICAL: only allowed with approvalMode === 'permit'
+function validatePermit2ApprovalMode(request, actionPath) {
+    if (request.approvalMode !== ApprovalMode.Permit) {
+        return [{
+                code: ViolationCode.Permit2ForbiddenWithoutPermitMode,
+                message: `Permit2 action requires approvalMode="${ApprovalMode.Permit}"`,
+                path: `${actionPath}.type`,
+                expected: ApprovalMode.Permit,
+                actual: request.approvalMode,
+            }];
+    }
+    return [];
+}
+// HIGH: actions[] must contain exactly [Budget]
+function validatePermit2ActionsList(action, actionPath) {
+    if (action.actions.length !== 1 ||
+        action.actions[0] !== EvmActionOperation.Budget) {
+        return [{
+                code: ViolationCode.Permit2ActionsNotSingleBudget,
+                message: `Permit2 actions must contain exactly [Budget]`,
+                path: `${actionPath}.actions`,
+                expected: [EvmActionOperation.Budget],
+                actual: action.actions,
+            }];
+    }
+    return [];
+}
+// CRITICAL: primaryType must be "PermitSingle"
+function validatePermit2PrimaryType(data, actionPath) {
+    if (data.primaryType !== "PermitSingle") {
+        return [{
+                code: ViolationCode.Permit2PrimaryTypeInvalid,
+                message: `Permit2 primaryType must be "PermitSingle"`,
+                path: `${actionPath}.data.primaryType`,
+                expected: "PermitSingle",
+                actual: data.primaryType,
+            }];
+    }
+    return [];
+}
+// CRITICAL: domain.chainId = real chainId
+// CRITICAL: domain.verifyingContract = Permit2 whitelist
+// CRITICAL: domain must NOT have version
+function validatePermit2Domain(data, actionPath, realChainId) {
+    const violations = [];
+    // CRITICAL: domain must NOT have version
+    if (data.domain.version !== undefined) {
+        violations.push({
+            code: ViolationCode.Permit2DomainHasVersion,
+            message: `Permit2 domain must not have version`,
+            path: `${actionPath}.data.domain.version`,
+            actual: data.domain.version,
+        });
+    }
+    // CRITICAL: domain.chainId must equal real chainId
+    if (data.domain.chainId !== realChainId) {
+        violations.push({
+            code: ViolationCode.Permit2ChainIdMismatch,
+            message: `Permit2 domain.chainId does not match the real chainId`,
+            path: `${actionPath}.data.domain.chainId`,
+            expected: realChainId,
+            actual: data.domain.chainId,
+        });
+    }
+    // CRITICAL: domain.verifyingContract = Permit2 whitelist
+    if (data.domain.verifyingContract === undefined ||
+        !isWhitelisted(PERMIT2_CONTRACTS, realChainId, data.domain.verifyingContract)) {
+        violations.push({
+            code: ViolationCode.Permit2VerifyingContractNotWhitelisted,
+            message: `Permit2 domain.verifyingContract is not whitelisted`,
+            path: `${actionPath}.data.domain.verifyingContract`,
+            actual: data.domain.verifyingContract,
+        });
+    }
+    return violations;
+}
+// CRITICAL: types must match the expected Permit2 EIP712 structure
+function validatePermit2Types(data, actionPath) {
+    const types = data.types;
+    const expectedKeys = Object.keys(EXPECTED_TYPES).sort();
+    const actualKeys = Object.keys(types).sort();
+    if (actualKeys.length !== expectedKeys.length ||
+        !actualKeys.every((k, i) => k === expectedKeys[i]) ||
+        !allFieldsMatch(types)) {
+        return [{
+                code: ViolationCode.Permit2TypesInvalid,
+                message: `Permit2 types must match the expected EIP712 structure`,
+                path: `${actionPath}.data.types`,
+                expected: EXPECTED_TYPES,
+                actual: types,
+            }];
+    }
+    return [];
+}
+function allFieldsMatch(types) {
+    for (const [key, expectedFields] of Object.entries(EXPECTED_TYPES)) {
+        const actualFields = types[key];
+        if (!actualFields)
+            return false;
+        if (actualFields.length !== expectedFields.length)
+            return false;
+        for (let i = 0; i < expectedFields.length; i++) {
+            if (actualFields[i].name !== expectedFields[i].name ||
+                actualFields[i].type !== expectedFields[i].type) {
+                return false;
+            }
+        }
+    }
+    return true;
+}
+// CRITICAL: message.details must exist with token, amount, expiration
+// CRITICAL: message.spender must be allowed
+function validatePermit2Message(data, actionPath, request, response, realChainId, trades, envConfig) {
+    const violations = [];
+    const msg = data.message;
+    const details = msg.details;
+    if (!details) {
+        violations.push({
+            code: ViolationCode.Permit2MessageDetailsMissing,
+            message: `Permit2 message.details is missing`,
+            path: `${actionPath}.data.message.details`,
+            actual: undefined,
+        });
+    }
+    else {
+        violations.push(...validatePermit2Token(details.token, actionPath, realChainId, trades), ...validatePermit2Amount(details.amount, actionPath), ...validatePermit2Expiration(details.expiration, actionPath, request));
+    }
+    violations.push(...validatePermit2Spender(msg.spender, actionPath, response, realChainId, envConfig));
+    return violations;
+}
+// CRITICAL: message.details.token = token from request trades
+function validatePermit2Token(token, actionPath, realChainId, trades) {
+    if (token === undefined) {
+        return [{
+                code: ViolationCode.Permit2TokenMismatch,
+                message: `Permit2 message.details.token is missing`,
+                path: `${actionPath}.data.message.details.token`,
+                actual: undefined,
+            }];
+    }
+    const expectedTokens = getExpectedTokenAddresses(trades, realChainId);
+    if (!expectedTokens.some(t => addressEquals(realChainId, t, token))) {
+        return [{
+                code: ViolationCode.Permit2TokenMismatch,
+                message: `Permit2 message.details.token must correspond to a srcChainTokenIn`,
+                path: `${actionPath}.data.message.details.token`,
+                expected: expectedTokens,
+                actual: token,
+            }];
+    }
+    return [];
+}
+// CRITICAL: message.details.amount = maxUint160
+function validatePermit2Amount(amount, actionPath) {
+    if (amount === undefined) {
+        return [{
+                code: ViolationCode.Permit2AmountNotMaxUint160,
+                message: `Permit2 message.details.amount is missing`,
+                path: `${actionPath}.data.message.details.amount`,
+                expected: maxUint160.toString(),
+                actual: undefined,
+            }];
+    }
+    try {
+        if (BigInt(amount) !== maxUint160) {
+            return [{
+                    code: ViolationCode.Permit2AmountNotMaxUint160,
+                    message: `Permit2 message.details.amount must be maxUint160`,
+                    path: `${actionPath}.data.message.details.amount`,
+                    expected: maxUint160.toString(),
+                    actual: amount,
+                }];
+        }
+    }
+    catch {
+        return [{
+                code: ViolationCode.Permit2AmountNotMaxUint160,
+                message: `Permit2 message.details.amount is not a valid number`,
+                path: `${actionPath}.data.message.details.amount`,
+                expected: maxUint160.toString(),
+                actual: amount,
+            }];
+    }
+    return [];
+}
+// CRITICAL: message.details.expiration = expirationTimestamp
+function validatePermit2Expiration(expiration, actionPath, request) {
+    if (expiration === undefined) {
+        return [{
+                code: ViolationCode.Permit2ExpirationMismatch,
+                message: `Permit2 message.details.expiration is missing`,
+                path: `${actionPath}.data.message.details.expiration`,
+                expected: request.expirationTimestamp,
+                actual: undefined,
+            }];
+    }
+    try {
+        if (BigInt(expiration) !== BigInt(request.expirationTimestamp)) {
+            return [{
+                    code: ViolationCode.Permit2ExpirationMismatch,
+                    message: `Permit2 message.details.expiration must match request.expirationTimestamp`,
+                    path: `${actionPath}.data.message.details.expiration`,
+                    expected: request.expirationTimestamp,
+                    actual: expiration,
+                }];
+        }
+    }
+    catch {
+        return [{
+                code: ViolationCode.Permit2ExpirationMismatch,
+                message: `Permit2 message.details.expiration is not a valid number`,
+                path: `${actionPath}.data.message.details.expiration`,
+                expected: request.expirationTimestamp,
+                actual: expiration,
+            }];
+    }
+    return [];
+}
+// CRITICAL: spender must be allowed AllowanceHolder or preHook address
+function validatePermit2Spender(spender, actionPath, response, realChainId, envConfig) {
+    if (spender === undefined) {
+        return [{
+                code: ViolationCode.Permit2SpenderMissing,
+                message: `Permit2 message.spender is missing`,
+                path: `${actionPath}.data.message.spender`,
+                actual: undefined,
+            }];
+    }
+    if (!isAllowedPermit2Spender(spender, response, realChainId, envConfig)) {
+        return [{
+                code: ViolationCode.Permit2SpenderNotAllowed,
+                message: `Permit2 message.spender is not an allowed address`,
+                path: `${actionPath}.data.message.spender`,
+                actual: spender,
+            }];
+    }
+    return [];
+}
+// CRITICAL: details must match message fields
+function validatePermit2Details(action, data, actionPath, realChainId) {
+    const details = action.details;
+    if (!details) {
+        return [{
+                code: ViolationCode.Permit2DetailsMissing,
+                message: `Permit2 action must have details`,
+                path: `${actionPath}.details`,
+                actual: undefined,
+            }];
+    }
+    const violations = [];
+    const spender = data.message.spender;
+    const msgDetails = data.message.details;
+    // CRITICAL: details.allowanceHolder = message.spender
+    if (details.allowanceHolder === undefined ||
+        spender === undefined ||
+        !addressEquals(realChainId, details.allowanceHolder, spender)) {
+        violations.push({
+            code: ViolationCode.Permit2DetailsAllowanceHolderMismatch,
+            message: `Permit2 details.allowanceHolder must match message.spender`,
+            path: `${actionPath}.details.allowanceHolder`,
+            expected: spender,
+            actual: details.allowanceHolder,
+        });
+    }
+    // CRITICAL: details.tokenAddress = message.details.token
+    const msgToken = msgDetails?.token;
+    if (details.tokenAddress === undefined ||
+        msgToken === undefined ||
+        !addressEquals(realChainId, details.tokenAddress, msgToken)) {
+        violations.push({
+            code: ViolationCode.Permit2DetailsTokenAddressMismatch,
+            message: `Permit2 details.tokenAddress must match message.details.token`,
+            path: `${actionPath}.details.tokenAddress`,
+            expected: msgToken,
+            actual: details.tokenAddress,
+        });
+    }
+    // CRITICAL: details.permit2Contract = domain.verifyingContract
+    if (details.permit2Contract === undefined ||
+        data.domain.verifyingContract === undefined ||
+        !addressEquals(realChainId, details.permit2Contract, data.domain.verifyingContract)) {
+        violations.push({
+            code: ViolationCode.Permit2DetailsPermit2ContractMismatch,
+            message: `Permit2 details.permit2Contract must match domain.verifyingContract`,
+            path: `${actionPath}.details.permit2Contract`,
+            expected: data.domain.verifyingContract,
+            actual: details.permit2Contract,
+        });
+    }
+    return violations;
+}
+// Collects all expected token addresses from trades (resolved for native)
+function getExpectedTokenAddresses(trades, realChainId) {
+    const tokens = new Set();
+    for (const trade of trades) {
+        const resolved = resolveWrappedTokenAddress(trade.srcChainTokenIn, realChainId);
+        if (resolved)
+            tokens.add(normalizeAddress(realChainId, resolved));
+    }
+    return Array.from(tokens);
+}
+function isAllowedPermit2Spender(spender, response, realChainId, envConfig) {
+    // Check AllowanceHolder whitelist
+    if (isWhitelisted(envConfig.allowanceHolderContracts, realChainId, spender)) {
+        return true;
+    }
+    // Check preHook addresses
+    for (const hookPayload of response.preHooks) {
+        if (hookPayload.hook.to && addressEquals(realChainId, hookPayload.hook.to, spender)) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=evm-permit2.js.map

package/dist/esm/validations/evm-permit2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evm-permit2.js","sourceRoot":"","sources":["../../../src/validations/evm-permit2.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,aAAa,EAIb,aAAa,EACb,kBAAkB,EAElB,YAAY,GAGf,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAqB,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAClC,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAErE,gDAAgD;AAChD,kDAAkD;AAClD,gDAAgD;AAEhD,MAAM,cAAc,GAAG;IACnB,YAAY,EAAE;QACV,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;QAChC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;QACpC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE;KACjD;IACD,YAAY,EAAE;QACV,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE;QAC1C,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;QACpC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;KAC3C;IACD,aAAa,EAAE;QACX,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;QAClC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;QACnC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE;QACtC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;KACpC;CACJ,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAClC,OAA4B,EAC5B,QAAgB,EAChB,OAA8B,EAC9B,QAAgC,EAChC,WAAoB,EACpB,MAAsB,EACtB,SAA4B;IAE5B,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,OAAO;YAAE,SAAS;QAEpD,MAAM,UAAU,GAAG,GAAG,QAAQ,oBAAoB,CAAC,GAAG,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAsB,CAAC;QAE3C,wDAAwD;QACxD,UAAU,CAAC,IAAI,CACX,GAAG,2BAA2B,CAAC,OAAO,EAAE,UAAU,CAAC,CACtD,CAAC;QAEF,gDAAgD;QAChD,UAAU,CAAC,IAAI,CACX,GAAG,0BAA0B,CAAC,MAAM,EAAE,UAAU,CAAC,CACpD,CAAC;QAEF,UAAU,CAAC,IAAI,CACX,GAAG,0BAA0B,CAAC,IAAI,EAAE,UAAU,CAAC,EAC/C,GAAG,qBAAqB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,EACvD,GAAG,oBAAoB,CAAC,IAAI,EAAE,UAAU,CAAC,EACzC,GAAG,sBAAsB,CACrB,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CACtE,EACD,GAAG,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CACnE,CAAC;IACN,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,wDAAwD;AACxD,SAAS,2BAA2B,CAChC,OAA8B,EAC9B,UAAkB;IAElB,IAAI,OAAO,CAAC,YAAY,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QAC/C,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,iCAAiC;gBACrD,OAAO,EAAE,yCAAyC,YAAY,CAAC,MAAM,GAAG;gBACxE,IAAI,EAAE,GAAG,UAAU,OAAO;gBAC1B,QAAQ,EAAE,YAAY,CAAC,MAAM;gBAC7B,MAAM,EAAE,OAAO,CAAC,YAAY;aAC/B,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,gDAAgD;AAChD,SAAS,0BAA0B,CAC/B,MAAyB,EACzB,UAAkB;IAElB,IACI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAC3B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,MAAM,EACjD,CAAC;QACC,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,6BAA6B;gBACjD,OAAO,EAAE,+CAA+C;gBACxD,IAAI,EAAE,GAAG,UAAU,UAAU;gBAC7B,QAAQ,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;gBACrC,MAAM,EAAE,MAAM,CAAC,OAAO;aACzB,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAID,+CAA+C;AAC/C,SAAS,0BAA0B,CAC/B,IAAoB,EACpB,UAAkB;IAElB,IAAI,IAAI,CAAC,WAAW,KAAK,cAAc,EAAE,CAAC;QACtC,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,yBAAyB;gBAC7C,OAAO,EAAE,4CAA4C;gBACrD,IAAI,EAAE,GAAG,UAAU,mBAAmB;gBACtC,QAAQ,EAAE,cAAc;gBACxB,MAAM,EAAE,IAAI,CAAC,WAAW;aAC3B,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,0CAA0C;AAC1C,yDAAyD;AACzD,yCAAyC;AACzC,SAAS,qBAAqB,CAC1B,IAAoB,EACpB,UAAkB,EAClB,WAAoB;IAEpB,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,yCAAyC;IACzC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACpC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,uBAAuB;YAC3C,OAAO,EAAE,sCAAsC;YAC/C,IAAI,EAAE,GAAG,UAAU,sBAAsB;YACzC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SAC9B,CAAC,CAAC;IACP,CAAC;IAED,mDAAmD;IACnD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,sBAAsB;YAC1C,OAAO,EAAE,wDAAwD;YACjE,IAAI,EAAE,GAAG,UAAU,sBAAsB;YACzC,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SAC9B,CAAC,CAAC;IACP,CAAC;IAED,yDAAyD;IACzD,IACI,IAAI,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;QAC3C,CAAC,aAAa,CACV,iBAAiB,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAChE,EACH,CAAC;QACC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,sCAAsC;YAC1D,OAAO,EAAE,qDAAqD;YAC9D,IAAI,EAAE,GAAG,UAAU,gCAAgC;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;SACxC,CAAC,CAAC;IACP,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,mEAAmE;AACnE,SAAS,oBAAoB,CACzB,IAAoB,EACpB,UAAkB;IAElB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAE7C,IACI,UAAU,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;QACzC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC,cAAc,CAAC,KAAK,CAAC,EACxB,CAAC;QACC,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,mBAAmB;gBACvC,OAAO,EAAE,wDAAwD;gBACjE,IAAI,EAAE,GAAG,UAAU,aAAa;gBAChC,QAAQ,EAAE,cAAc;gBACxB,MAAM,EAAE,KAAK;aAChB,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CACnB,KAAuD;IAEvD,KAAK,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QACjE,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,IACI,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC/C,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EACjD,CAAC;gBACC,OAAO,KAAK,CAAC;YACjB,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,sEAAsE;AACtE,4CAA4C;AAC5C,SAAS,sBAAsB,CAC3B,IAAoB,EACpB,UAAkB,EAClB,OAA8B,EAC9B,QAAgC,EAChC,WAAoB,EACpB,MAAsB,EACtB,SAA4B;IAE5B,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC;IACzB,MAAM,OAAO,GAAG,GAAG,CAAC,OAKP,CAAC;IAEd,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,4BAA4B;YAChD,OAAO,EAAE,oCAAoC;YAC7C,IAAI,EAAE,GAAG,UAAU,uBAAuB;YAC1C,MAAM,EAAE,SAAS;SACpB,CAAC,CAAC;IACP,CAAC;SAAM,CAAC;QACJ,UAAU,CAAC,IAAI,CACX,GAAG,oBAAoB,CACnB,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CACjD,EACD,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,EACpD,GAAG,yBAAyB,CACxB,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAC1C,CACJ,CAAC;IACN,CAAC;IAED,UAAU,CAAC,IAAI,CACX,GAAG,sBAAsB,CACrB,GAAG,CAAC,OAA6B,EACjC,UAAU,EACV,QAAQ,EACR,WAAW,EACX,SAAS,CACZ,CACJ,CAAC;IAEF,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,8DAA8D;AAC9D,SAAS,oBAAoB,CACzB,KAAyB,EACzB,UAAkB,EAClB,WAAoB,EACpB,MAAsB;IAEtB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,oBAAoB;gBACxC,OAAO,EAAE,0CAA0C;gBACnD,IAAI,EAAE,GAAG,UAAU,6BAA6B;gBAChD,MAAM,EAAE,SAAS;aACpB,CAAC,CAAC;IACP,CAAC;IAED,MAAM,cAAc,GAAG,yBAAyB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,oBAAoB;gBACxC,OAAO,EAAE,oEAAoE;gBAC7E,IAAI,EAAE,GAAG,UAAU,6BAA6B;gBAChD,QAAQ,EAAE,cAAc;gBACxB,MAAM,EAAE,KAAK;aAChB,CAAC,CAAC;IACP,CAAC;IAED,OAAO,EAAE,CAAC;AACd,CAAC;AAED,gDAAgD;AAChD,SAAS,qBAAqB,CAC1B,MAA0B,EAC1B,UAAkB;IAElB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,0BAA0B;gBAC9C,OAAO,EAAE,2CAA2C;gBACpD,IAAI,EAAE,GAAG,UAAU,8BAA8B;gBACjD,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE;gBAC/B,MAAM,EAAE,SAAS;aACpB,CAAC,CAAC;IACP,CAAC;IAED,IAAI,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC;oBACJ,IAAI,EAAE,aAAa,CAAC,0BAA0B;oBAC9C,OAAO,EAAE,mDAAmD;oBAC5D,IAAI,EAAE,GAAG,UAAU,8BAA8B;oBACjD,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE;oBAC/B,MAAM,EAAE,MAAM;iBACjB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,0BAA0B;gBAC9C,OAAO,EAAE,sDAAsD;gBAC/D,IAAI,EAAE,GAAG,UAAU,8BAA8B;gBACjD,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE;gBAC/B,MAAM,EAAE,MAAM;aACjB,CAAC,CAAC;IACP,CAAC;IAED,OAAO,EAAE,CAAC;AACd,CAAC;AAED,6DAA6D;AAC7D,SAAS,yBAAyB,CAC9B,UAA8B,EAC9B,UAAkB,EAClB,OAA8B;IAE9B,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,yBAAyB;gBAC7C,OAAO,EAAE,+CAA+C;gBACxD,IAAI,EAAE,GAAG,UAAU,kCAAkC;gBACrD,QAAQ,EAAE,OAAO,CAAC,mBAAmB;gBACrC,MAAM,EAAE,SAAS;aACpB,CAAC,CAAC;IACP,CAAC;IAED,IAAI,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC7D,OAAO,CAAC;oBACJ,IAAI,EAAE,aAAa,CAAC,yBAAyB;oBAC7C,OAAO,EAAE,2EAA2E;oBACpF,IAAI,EAAE,GAAG,UAAU,kCAAkC;oBACrD,QAAQ,EAAE,OAAO,CAAC,mBAAmB;oBACrC,MAAM,EAAE,UAAU;iBACrB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,yBAAyB;gBAC7C,OAAO,EAAE,0DAA0D;gBACnE,IAAI,EAAE,GAAG,UAAU,kCAAkC;gBACrD,QAAQ,EAAE,OAAO,CAAC,mBAAmB;gBACrC,MAAM,EAAE,UAAU;aACrB,CAAC,CAAC;IACP,CAAC;IAED,OAAO,EAAE,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,SAAS,sBAAsB,CAC3B,OAA2B,EAC3B,UAAkB,EAClB,QAAgC,EAChC,WAAoB,EACpB,SAA4B;IAE5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,qBAAqB;gBACzC,OAAO,EAAE,oCAAoC;gBAC7C,IAAI,EAAE,GAAG,UAAU,uBAAuB;gBAC1C,MAAM,EAAE,SAAS;aACpB,CAAC,CAAC;IACP,CAAC;IAED,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,wBAAwB;gBAC5C,OAAO,EAAE,mDAAmD;gBAC5D,IAAI,EAAE,GAAG,UAAU,uBAAuB;gBAC1C,MAAM,EAAE,OAAO;aAClB,CAAC,CAAC;IACP,CAAC;IAED,OAAO,EAAE,CAAC;AACd,CAAC;AAED,8CAA8C;AAC9C,SAAS,sBAAsB,CAC3B,MAAyB,EACzB,IAAoB,EACpB,UAAkB,EAClB,WAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,qBAAqB;gBACzC,OAAO,EAAE,kCAAkC;gBAC3C,IAAI,EAAE,GAAG,UAAU,UAAU;gBAC7B,MAAM,EAAE,SAAS;aACpB,CAAC,CAAC;IACP,CAAC;IAED,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAA6B,CAAC;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAyC,CAAC;IAE1E,sDAAsD;IACtD,IACI,OAAO,CAAC,eAAe,KAAK,SAAS;QACrC,OAAO,KAAK,SAAS;QACrB,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,EAC/D,CAAC;QACC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,qCAAqC;YACzD,OAAO,EAAE,4DAA4D;YACrE,IAAI,EAAE,GAAG,UAAU,0BAA0B;YAC7C,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,OAAO,CAAC,eAAe;SAClC,CAAC,CAAC;IACP,CAAC;IAED,yDAAyD;IACzD,MAAM,QAAQ,GAAG,UAAU,EAAE,KAAK,CAAC;IACnC,IACI,OAAO,CAAC,YAAY,KAAK,SAAS;QAClC,QAAQ,KAAK,SAAS;QACtB,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,EAC7D,CAAC;QACC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,kCAAkC;YACtD,OAAO,EAAE,+DAA+D;YACxE,IAAI,EAAE,GAAG,UAAU,uBAAuB;YAC1C,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,OAAO,CAAC,YAAY;SAC/B,CAAC,CAAC;IACP,CAAC;IAED,+DAA+D;IAC/D,IACI,OAAO,CAAC,eAAe,KAAK,SAAS;QACrC,IAAI,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;QAC3C,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,EACrF,CAAC;QACC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,qCAAqC;YACzD,OAAO,EAAE,qEAAqE;YAC9E,IAAI,EAAE,GAAG,UAAU,0BAA0B;YAC7C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;YACvC,MAAM,EAAE,OAAO,CAAC,eAAe;SAClC,CAAC,CAAC;IACP,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,0EAA0E;AAC1E,SAAS,yBAAyB,CAC9B,MAAsB,EACtB,WAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,0BAA0B,CACvC,KAAK,CAAC,eAAe,EAAE,WAAW,CACrC,CAAC;QACF,IAAI,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,uBAAuB,CAC5B,OAAe,EACf,QAAgC,EAChC,WAAoB,EACpB,SAA4B;IAE5B,kCAAkC;IAClC,IAAI,aAAa,CAAC,SAAS,CAAC,wBAAwB,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,0BAA0B;IAC1B,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC1C,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC"}