@ftptech/canton-agent-wallet 0.1.14 → 0.1.16

package/dist/relay-signer.d.ts

@@ -29,5 +29,20 @@ export declare function makeRelaySigner(wallet: AgentWallet, opts?: {
      *  Without it, a relay-prepared tx that carries the DSO outside the root
      *  choice arg fails closed (the round-3 no-pin-fallback removal). */
     trustedDso?: string;
+    /** Optional spend ceiling: the MAX amount this signer will EVER sign for, in
+     *  the same unit the 402 quotes (compared against `input.amount`). When set,
+     *  the signer REFUSES to sign — fail closed, before any relay call — if the
+     *  to-be-signed amount exceeds it. This makes the spend breaker load-bearing
+     *  against an over-quoting (or MITM'd) merchant: the agent never signs a
+     *  charge larger than the caller authorized, no matter what the 402 returns.
+     *  Omitted → no ceiling (legacy behavior; the published MCP/pay path is
+     *  unaffected when unset). */
+    maxPaymentValue?: string;
+    /** Optional expected-payee pin: the ONLY recipient this signer will sign a
+     *  transfer to (compared against `input.receiver`). When set, the signer
+     *  REFUSES to sign — fail closed, before any relay call — if the 402's payTo
+     *  is anything else, defending against a MITM'd merchant that swaps `payTo`
+     *  to drain funds to an attacker. Omitted → no pin (legacy behavior). */
+    expectedPayTo?: string;
 }): CantonSigner;
 //# sourceMappingURL=relay-signer.d.ts.map

package/dist/relay-signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relay-signer.d.ts","sourceRoot":"","sources":["../src/relay-signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAKhE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IACJ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;yEAGqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;CAChB,GACL,YAAY,CA0Dd"}
+{"version":3,"file":"relay-signer.d.ts","sourceRoot":"","sources":["../src/relay-signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAKhE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IACJ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;yEAGqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;kCAO8B;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;6EAIyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;CACnB,GACL,YAAY,CAmMd"}

package/dist/relay-signer.js

@@ -1,5 +1,5 @@
 import { RelayClient } from "./relay-client.js";
-import { transfer, createTransferCommand } from "./tx.js";
+import { transfer, createTransferCommand, allocate, createSenderConsent } from "./tx.js";
 import { resolveHashBinding } from "./hash-binding.js";
 import { resolveTrustedDsoParty } from "./trusted-dso.js";
 export function makeRelaySigner(wallet, opts = {}) {
@@ -17,9 +17,41 @@ export function makeRelaySigner(wallet, opts = {}) {
     // auto-DSO then works for any mainnet payment no matter how the wallet was
     // created. Without a resolvable DSO, value-moving prepared bytes carrying it
     // outside the root choice arg are refused (fail-closed).
+    // Spend breaker — applied at the TOP of BOTH signer arms, fail-CLOSED, BEFORE
+    // any relay call. Refuses to sign a merchant-quoted amount above the caller's
+    // ceiling or to a payee the caller did not authorize. Both pins are OPTIONAL;
+    // unset means the corresponding check is skipped (legacy behavior preserved).
+    // The amount is compared as a Number in the SAME unit as `input.amount`,
+    // matching the existing balance fast-fail (`Number(bal.cc) < Number(amount)`).
+    const enforceSpendLimits = (to, amount) => {
+        if (opts.expectedPayTo !== undefined && to !== opts.expectedPayTo) {
+            throw new Error(`refusing to sign: payee ${to} does not match the expected payTo ` +
+                `${opts.expectedPayTo} (a merchant cannot redirect this payment)`);
+        }
+        if (opts.maxPaymentValue !== undefined) {
+            const want = Number(amount);
+            const cap = Number(opts.maxPaymentValue);
+            // A configured-but-broken ceiling must FAIL CLOSED, never silently disable
+            // the cap: `want > NaN` is always false, so a non-finite cap would wave
+            // every amount through. Refuse to sign instead.
+            if (!Number.isFinite(cap)) {
+                throw new Error(`refusing to sign: configured max payment value ` +
+                    `${JSON.stringify(opts.maxPaymentValue)} is not a finite number`);
+            }
+            if (!Number.isFinite(want)) {
+                throw new Error(`refusing to sign: payment amount ${JSON.stringify(amount)} is not a ` +
+                    `finite number`);
+            }
+            if (want > cap) {
+                throw new Error(`refusing to sign: payment amount ${amount} exceeds the max ` +
+                    `payment value ${opts.maxPaymentValue} (the merchant over-quoted)`);
+            }
+        }
+    };
     return {
         party: wallet.party,
         async signCip56Transfer(input) {
+            enforceSpendLimits(input.receiver, input.amount);
             const trustedDso = opts.trustedDso ?? resolveTrustedDsoParty(process.env, wallet.network);
             const updateId = await transfer(relay, wallet, {
                 receiver: input.receiver,
@@ -30,7 +62,101 @@ export function makeRelaySigner(wallet, opts = {}) {
             });
             return { payerParty: wallet.party, updateId, transferInstructionCid: null };
         },
+        async signAllocation(input) {
+            // Spend breaker FIRST (fail-closed, before any relay call), exactly like
+            // the other arms.
+            enforceSpendLimits(input.receiver, input.amount);
+            const trustedDso = opts.trustedDso ?? resolveTrustedDsoParty(process.env, wallet.network);
+            const r = await allocate(relay, wallet, {
+                receiver: input.receiver,
+                amount: input.amount,
+                executor: input.executor,
+                synchronizerId: input.synchronizerId,
+                allocateBeforeSeconds: input.allocateBeforeSeconds,
+                settleBeforeSeconds: input.settleBeforeSeconds,
+                ...(input.transferMeta ? { transferMeta: input.transferMeta } : {}),
+                hashBinding,
+                ...(trustedDso !== undefined ? { expectInstrumentAdmin: trustedDso } : {}),
+            });
+            return {
+                payerParty: r.payerParty,
+                allocationCid: r.allocationCid,
+                allocationInstructionCid: r.allocationInstructionCid,
+                updateId: r.updateId,
+            };
+        },
+        async signAllocationDirect(input) {
+            // Spend breaker FIRST (fail-closed, before any relay call), exactly like
+            // the other arms.
+            enforceSpendLimits(input.receiver, input.amount);
+            // Ensure the standing both-party DirectSettlementConsent {sender, merchant}
+            // exists (facilitator-alone mint off the two once-total consents). On the
+            // first DIRECT payment the agent's own SenderConsent may not be onboarded
+            // yet — `mintDirectConsent` then throws; create it ONCE and retry. If the
+            // retry still throws, the MERCHANT has not onboarded its MerchantConsent (the
+            // agent cannot create that on the merchant's behalf), so surface a clear,
+            // actionable error preserving the original relay error as `cause`.
+            let directConsentCid;
+            try {
+                const mint = await relay.mintDirectConsent({
+                    sender: wallet.party,
+                    merchant: input.receiver,
+                });
+                directConsentCid = mint.directConsentCid;
+            }
+            catch (firstErr) {
+                // The agent's own SenderConsent is the only standing consent it can mint.
+                // Create it once (verify-before-sign, the agent's own key) then retry.
+                await createSenderConsent(relay, wallet, {
+                    facilitator: input.executor,
+                    synchronizerId: input.synchronizerId,
+                    hashBinding,
+                });
+                try {
+                    const mint = await relay.mintDirectConsent({
+                        sender: wallet.party,
+                        merchant: input.receiver,
+                    });
+                    directConsentCid = mint.directConsentCid;
+                }
+                catch (retryErr) {
+                    // Still failing after the sender side is onboarded → the merchant has
+                    // not onboarded its MerchantConsent. The agent cannot pay direct to a
+                    // merchant that has not opted into the direct path.
+                    throw new Error(`cannot pay merchant ${input.receiver} via allocation-direct: it has ` +
+                        `not onboarded a MerchantConsent with this facilitator yet (the agent ` +
+                        `created its own SenderConsent but the both-party consent still cannot ` +
+                        `be minted). The merchant must run merchant-onboard once before it can ` +
+                        `receive direct payments.`, { cause: retryErr instanceof Error ? retryErr : firstErr });
+                }
+            }
+            const trustedDso = opts.trustedDso ?? resolveTrustedDsoParty(process.env, wallet.network);
+            // The on-ledger lock is IDENTICAL to the allocation-api arm (same
+            // AllocationFactory_Allocate, receiver = merchant, executor = facilitator);
+            // verify-before-sign in `allocate` re-checks every money-critical field.
+            const r = await allocate(relay, wallet, {
+                receiver: input.receiver,
+                amount: input.amount,
+                executor: input.executor,
+                synchronizerId: input.synchronizerId,
+                allocateBeforeSeconds: input.allocateBeforeSeconds,
+                settleBeforeSeconds: input.settleBeforeSeconds,
+                ...(input.transferMeta ? { transferMeta: input.transferMeta } : {}),
+                hashBinding,
+                ...(trustedDso !== undefined ? { expectInstrumentAdmin: trustedDso } : {}),
+            });
+            return {
+                payerParty: r.payerParty,
+                allocationCid: r.allocationCid,
+                allocationInstructionCid: r.allocationInstructionCid,
+                updateId: r.updateId,
+                directConsentCid,
+            };
+        },
         async signTransferCommand(input) {
+            // Spend breaker FIRST — before even the balance pre-check, so a refused
+            // amount/payee never touches the relay (no network, no info leak).
+            enforceSpendLimits(input.receiver, input.amount);
             // Fast-fail an underfunded wallet: without this, an unfunded agent's pay
             // loops the client re-pay retries (each settle just rejects "no inputs")
             // for ~30s and then returns an opaque "rejected" — surface a clear

package/dist/relay-signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"relay-signer.js","sourceRoot":"","sources":["../src/relay-signer.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAI1D,MAAM,UAAU,eAAe,CAC7B,MAAmB,EACnB,OAQI,EAAE;IAEN,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,6EAA6E;IAC7E,2DAA2D;IAC3D,+EAA+E;IAC/E,qCAAqC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;IAC7D,gFAAgF;IAChF,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,yDAAyD;IACzD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,CAAC,iBAAiB,CAAC,KAAK;YAC3B,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,IAAI,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;gBAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,WAAW;gBACX,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E,CAAC,CAAC;YACH,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;QAC9E,CAAC;QACD,KAAK,CAAC,mBAAmB,CAAC,KAAK;YAC7B,yEAAyE;YACzE,yEAAyE;YACzE,mEAAmE;YACnE,mEAAmE;YACnE,qEAAqE;YACrE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,yCAAyC,GAAG,CAAC,EAAE,sBAAsB;oBACnE,YAAY,KAAK,CAAC,MAAM,oDAAoD,CAC/E,CAAC;YACJ,CAAC;YACD,sEAAsE;YACtE,MAAM,UAAU,GACd,IAAI,CAAC,UAAU;gBACf,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YACvE,OAAO,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE;gBAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,WAAW;gBACX,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"relay-signer.js","sourceRoot":"","sources":["../src/relay-signer.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAI1D,MAAM,UAAU,eAAe,CAC7B,MAAmB,EACnB,OAuBI,EAAE;IAEN,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,6EAA6E;IAC7E,2DAA2D;IAC3D,+EAA+E;IAC/E,qCAAqC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;IAC7D,gFAAgF;IAChF,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,yDAAyD;IACzD,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,+EAA+E;IAC/E,MAAM,kBAAkB,GAAG,CAAC,EAAU,EAAE,MAAc,EAAQ,EAAE;QAC9D,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,2BAA2B,EAAE,qCAAqC;gBAChE,GAAG,IAAI,CAAC,aAAa,4CAA4C,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACzC,2EAA2E;YAC3E,wEAAwE;YACxE,gDAAgD;YAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,iDAAiD;oBAC/C,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,yBAAyB,CACnE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY;oBACpE,eAAe,CAClB,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,mBAAmB;oBAC3D,iBAAiB,IAAI,CAAC,eAAe,6BAA6B,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,CAAC,iBAAiB,CAAC,KAAK;YAC3B,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,IAAI,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;gBAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,WAAW;gBACX,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E,CAAC,CAAC;YACH,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;QAC9E,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,KAAK;YACxB,yEAAyE;YACzE,kBAAkB;YAClB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,IAAI,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;gBACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;gBAClD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,WAAW;gBACX,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E,CAAC,CAAC;YACH,OAAO;gBACL,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,wBAAwB,EAAE,CAAC,CAAC,wBAAwB;gBACpD,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,oBAAoB,CAAC,KAAK;YAC9B,yEAAyE;YACzE,kBAAkB;YAClB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACjD,4EAA4E;YAC5E,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,8EAA8E;YAC9E,0EAA0E;YAC1E,mEAAmE;YACnE,IAAI,gBAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC;oBACzC,MAAM,EAAE,MAAM,CAAC,KAAK;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAC;gBACH,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;YAC3C,CAAC;YAAC,OAAO,QAAQ,EAAE,CAAC;gBAClB,0EAA0E;gBAC1E,uEAAuE;gBACvE,MAAM,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE;oBACvC,WAAW,EAAE,KAAK,CAAC,QAAQ;oBAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,WAAW;iBACZ,CAAC,CAAC;gBACH,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC;wBACzC,MAAM,EAAE,MAAM,CAAC,KAAK;wBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;qBACzB,CAAC,CAAC;oBACH,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;gBAC3C,CAAC;gBAAC,OAAO,QAAQ,EAAE,CAAC;oBAClB,sEAAsE;oBACtE,sEAAsE;oBACtE,oDAAoD;oBACpD,MAAM,IAAI,KAAK,CACb,uBAAuB,KAAK,CAAC,QAAQ,iCAAiC;wBACpE,uEAAuE;wBACvE,wEAAwE;wBACxE,wEAAwE;wBACxE,0BAA0B,EAC5B,EAAE,KAAK,EAAE,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAC3D,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,IAAI,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACzE,kEAAkE;YAClE,4EAA4E;YAC5E,yEAAyE;YACzE,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;gBACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;gBAClD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,WAAW;gBACX,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E,CAAC,CAAC;YACH,OAAO;gBACL,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,wBAAwB,EAAE,CAAC,CAAC,wBAAwB;gBACpD,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,gBAAgB;aACjB,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,mBAAmB,CAAC,KAAK;YAC7B,wEAAwE;YACxE,mEAAmE;YACnE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACjD,yEAAyE;YACzE,yEAAyE;YACzE,mEAAmE;YACnE,mEAAmE;YACnE,qEAAqE;YACrE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,yCAAyC,GAAG,CAAC,EAAE,sBAAsB;oBACnE,YAAY,KAAK,CAAC,MAAM,oDAAoD,CAC/E,CAAC;YACJ,CAAC;YACD,sEAAsE;YACtE,MAAM,UAAU,GACd,IAAI,CAAC,UAAU;gBACf,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YACvE,OAAO,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE;gBAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,WAAW;gBACX,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/tx.d.ts

@@ -79,6 +79,110 @@ export declare function createTransferCommand(relay: RelayClient, wallet: AgentW
     nonce: number;
     createUpdateId: string;
 }>;
+/**
+ * allocation-api (CIP-56 DVP) — exercise `AllocationFactory_Allocate` to LOCK
+ * the agent's funds into an Allocation naming the facilitator as
+ * settlement.executor. The facilitator later submits Allocation_ExecuteTransfer
+ * (sponsored gas) to settle. The agent signs only the lock here (its own key;
+ * the choice's sole controller is transferLeg.sender = the agent) — no gas, no
+ * nonce, no merchant preapproval.
+ *
+ * Mirrors the cip56 `transfer` flow: resolve the allocation factory via the
+ * relay → build the allocate exercise → VERIFY-before-sign over the EXACT
+ * prepared bytes (pinning sender/receiver/amount/instrument + the executor +
+ * the deadline window) → sign locally → execute via relay → read back the
+ * created Allocation cid from THIS transaction's events.
+ *
+ * SECURITY: every money/escrow-critical field the verifier pins (sender == own
+ * party, receiver == merchant payTo, amount == required, instrument == intent,
+ * settlement.executor == facilitatorParty) is CALLER INTENT passed in `opts`,
+ * NOT taken from the relay's resolve response. The relay-resolved factory
+ * refs/admin/context are used only to BUILD the exercise; they widen nothing the
+ * agent will sign. The cid returned moves no funds on its own — the facilitator
+ * independently re-validates every field at /verify + /settle, and only the
+ * executor (+ baked-in sender/receiver auth) can ever move the locked funds.
+ */
+export declare function allocate(relay: RelayClient, wallet: AgentWallet, opts: {
+    /** Merchant party id (PaymentRequirements.payTo). CALLER INTENT. */
+    receiver: string;
+    /** Daml Decimal amount string (PaymentRequirements.amount). CALLER INTENT. */
+    amount: string;
+    /** The facilitator party that MUST be settlement.executor
+     *  (extra.executor = extra.facilitatorParty). CALLER INTENT — pinned by
+     *  exact equality at the allocation's executor position. */
+    executor: string;
+    /** Synchronizer id (extra.synchronizerId). CALLER INTENT — pins the prepare's
+     *  synchronizer + the SIGNED Metadata.synchronizer_id. */
+    synchronizerId: string;
+    /** Relative allocateBefore deadline (extra.allocateBeforeSeconds). */
+    allocateBeforeSeconds: number;
+    /** Relative settleBefore deadline (extra.settleBeforeSeconds). MUST be
+     *  strictly greater than allocateBeforeSeconds. */
+    settleBeforeSeconds: number;
+    /** Instrument id the agent expects (default "Amulet"). CALLER INTENT. */
+    expectInstrumentId?: string;
+    /** Optional, independently-trusted instrument admin (DSO) to pin. */
+    expectInstrumentAdmin?: string;
+    /** x402 reconciliation metadata stamped into transferLeg.meta (paymentId,
+     *  resourceUrl, version, memo?). */
+    transferMeta?: Record<string, string>;
+    /** Hash-binding policy; defaults to fail-closed (see HashBindingOptions). */
+    hashBinding?: HashBindingOptions;
+}): Promise<{
+    payerParty: string;
+    /** The Allocation cid (the _Completed case — Amulet creates it synchronously). */
+    allocationCid: string | null;
+    /** The AllocationInstruction cid (the _Pending case). Track A rejects pending,
+     *  but the relay surfaces it so the facilitator can return the right error. */
+    allocationInstructionCid: string | null;
+    /** updateId of the AllocationFactory_Allocate exercise. */
+    updateId: string;
+}>;
+/**
+ * x402-direct "Design B" onboarding (SENDER side, ONCE-TOTAL). Create the standing
+ * `SenderConsent {sender = self, facilitator}` the facilitator later uses to MINT
+ * the both-party DirectSettlementConsent for ANY merchant it names. The choice's
+ * sole signatory is the SENDER = the agent, so the agent signs only its own create
+ * (its own key; no gas, no facilitator signature). Creating the consent MOVES NO
+ * FUNDS — it only durably captures the sender's one-time authorization.
+ *
+ * Mirrors the cip56/v1/allocate flows: build the create exercise → VERIFY-before-sign
+ * over the EXACT prepared bytes (pinning the created template + the consent's
+ * {sender == self, facilitator} principals + act_as == self, and the foreign-party
+ * backstop allowing ONLY {self, facilitator}) → sign locally → execute via the relay
+ * → return the create's updateId.
+ *
+ * SECURITY: every pinned field is CALLER INTENT passed in `opts`, never taken from
+ * the relay. A relay-substituted facilitator (which could later mint a both-party
+ * consent and settle the agent's allocations) is rejected by the [1] facilitator pin
+ * + the foreign-party backstop; a relay-injected value-moving exercise / extra leg /
+ * foreign submitter is rejected by the create-root invariant. The cid moves no funds
+ * on its own — the facilitator's later DirectSettlementConsent_Execute re-validates
+ * every term against the live allocation.
+ */
+export declare function createSenderConsent(relay: RelayClient, wallet: AgentWallet, opts: {
+    /** The facilitator party the consent grants (extra.facilitatorParty). CALLER
+     *  INTENT — pinned by exact equality at the consent's [1] facilitator position. */
+    facilitator: string;
+    /** Caller-intent synchronizer id to PREPARE on + pin the SIGNED
+     *  Metadata.synchronizer_id to. The consent lives on a specific synchronizer. */
+    synchronizerId: string;
+    /** Hash-binding policy; defaults to fail-closed (see HashBindingOptions). */
+    hashBinding?: HashBindingOptions;
+}): Promise<string>;
+/**
+ * x402-direct "Design B" onboarding (MERCHANT side, ONCE-TOTAL). Symmetric to
+ * `createSenderConsent`: create the standing `MerchantConsent {merchant = self,
+ * facilitator}` the facilitator later uses to MINT the both-party
+ * DirectSettlementConsent (MerchantConsent_Accept) from ANY sender it names. The
+ * choice's sole signatory is the MERCHANT = the agent. Creating the consent MOVES NO
+ * FUNDS. Same verify-before-sign guarantees as the sender side.
+ */
+export declare function createMerchantConsent(relay: RelayClient, wallet: AgentWallet, opts: {
+    facilitator: string;
+    synchronizerId: string;
+    hashBinding?: HashBindingOptions;
+}): Promise<string>;
 /**
  * Accept every pending incoming transfer (e.g. the agent's initial funding).
  *
@@ -99,4 +203,128 @@ export declare function claimAll(relay: RelayClient, wallet: AgentWallet, opts?:
     claimed: number;
     updateIds: string[];
 }>;
+/**
+ * Reclaim a locked allocation: exercise `Allocation_Withdraw` on the agent's own
+ * `AmuletAllocation`, returning its locked funds to the agent (Track B — "locked
+ * funds always recoverable"). The choice's sole controller is
+ * `allocation.transferLeg.sender` = the agent, and `Allocation_Withdraw` returns
+ * the funds to the sender BY CONSTRUCTION — there is no attacker-controllable
+ * destination in the choice argument.
+ *
+ * SECURITY: like every path, this is NOT exempt from verify-before-sign. A
+ * malicious relay could return a DIFFERENT choice that DOES move value to an
+ * attacker (Allocation_ExecuteTransfer / a TransferFactory_Transfer drain), a
+ * withdraw of a DIFFERENT allocation, an injected outbound transfer leg, or a
+ * foreign-party submission. We pass `kind: "allocation-withdraw"`, which
+ * structurally proves the prepared transaction is a single `Allocation_Withdraw`
+ * on EXACTLY `opts.allocationCid` (caller intent, REQUIRED contract-id pin),
+ * submitted by the agent (act_as == wallet.party), with NO foreign party
+ * anywhere — and binds the signed hash to those bytes (fail-closed by default,
+ * exactly like the accept/allocate paths). `opts.hashBinding` lets a programmatic
+ * caller supply a participant-conformant recompute; the CLI resolves it from the
+ * environment (default fail-closed).
+ *
+ * No caller-intent synchronizer is threaded (like the claim/accept path): the
+ * withdraw carries no caller-chosen domain — `prepareSignExecute` omits the
+ * synchronizerId arg.
+ */
+export declare function reclaimAllocation(relay: RelayClient, wallet: AgentWallet, opts: {
+    allocationCid: string;
+    hashBinding?: HashBindingOptions;
+    /** CALLER-INTENT reference parties for the lock-expiry withdraw: the
+     *  allocation executor / lock holder (facilitator) and the instrument admin
+     *  (DSO). Supply when the allocation was locked to a facilitator (Design A) so
+     *  the verify foreign-party backstop permits the AmuletRules/round/unlock refs
+     *  these two legitimately produce. Omit on the no-lock path. */
+    facilitator?: string;
+    instrumentAdmin?: string;
+    /** CALLER-INTENT allocation RECEIVER (the merchant). Supply for a "Design B"
+     *  DIRECT allocation, where the receiver is the MERCHANT (not the facilitator)
+     *  — the legitimate `Allocation_Withdraw` expire-lock choice-context then
+     *  references the merchant party, so the verify foreign-party backstop must
+     *  permit EXACTLY this caller-pinned party. Pass the allocation's known
+     *  receiver (never a relay-supplied value). Omit for "Design A" escrow, where
+     *  receiver == facilitator (already permitted) — behavior is then unchanged. */
+    receiver?: string;
+}): Promise<string>;
+/**
+ * x402-escrow "Design A" ACCEPT: the SENDER (the agent — an external party whose
+ * key the agent-wallet holds) exercises `X402EscrowOffer_Accept` on an
+ * `X402EscrowOffer` the facilitator created, to capture its one-time
+ * authorization. ACCEPTING MOVES NO FUNDS — it only archives the offer and creates
+ * the `X402Escrow` whose signatories are {facilitator, sender}; the facilitator
+ * later settles the locked allocation ALONE off the joint authority captured here.
+ * The choice's sole controller is the offer's `sender` = the agent, so the agent
+ * signs only its own accept (its own key; no gas, no merchant signature).
+ *
+ * Mirrors the reclaim (`reclaimAllocation` / `Allocation_Withdraw`) flow: build
+ * the exercise → VERIFY-before-sign over the EXACT prepared bytes → sign locally →
+ * execute via the relay → read back the created `X402Escrow` cid from THIS
+ * transaction's events (the agent is relay-only). The sender is an OBSERVER of the
+ * offer (not a stakeholder that has it in its ACS), so the offer contract is
+ * DISCLOSED via `opts.offerDisclosedContract` (the facilitator surfaces its
+ * created_event_blob).
+ *
+ * SECURITY: like every path, this is NOT exempt from verify-before-sign. A
+ * malicious relay could return a DIFFERENT, value-MOVING choice (an
+ * Allocation_ExecuteTransfer / TransferFactory_Transfer / CreateTransferCommand /
+ * Allocation_Withdraw drain), an accept of a DIFFERENT offer, an injected outbound
+ * transfer leg as a consequence, a relay-SUBSTITUTED facilitator (who could later
+ * settle the escrow to an attacker), or a foreign-party submission. We pass
+ * `kind: "escrow-accept"`, which structurally proves the prepared transaction is a
+ * single `X402EscrowOffer_Accept` on EXACTLY `opts.offerCid` (caller intent,
+ * REQUIRED contract-id pin), submitted by the agent (act_as == wallet.party),
+ * creating an escrow only among the caller-intended {sender, facilitator
+ * (+merchant/instrumentAdmin)} parties — and binds the signed hash to those bytes
+ * (fail-closed by default, exactly like the reclaim/accept paths). `opts.hashBinding`
+ * lets a programmatic caller supply a participant-conformant recompute; the CLI
+ * resolves it from the environment (default fail-closed).
+ *
+ * Returns `{ escrowCid, updateId }`. `escrowCid` is read back via the relay from
+ * the accept transaction's events; it is `null` if the relay could not resolve it
+ * within its poll budget (the cid moves no funds — the facilitator independently
+ * re-validates the escrow + allocation terms at settle).
+ */
+export declare function acceptEscrowOffer(relay: RelayClient, wallet: AgentWallet, opts: {
+    /** The `X402EscrowOffer` cid to accept. CALLER INTENT — REQUIRED contract-id
+     *  pin (the verify arm refuses an accept of any other contract). */
+    offerCid: string;
+    /** The offer's resolved templateId for the exercise target. The choice is
+     *  exercised THROUGH `#x402-escrow:X402Escrow:X402EscrowOffer` by default; pass
+     *  a concrete (package-id-qualified) templateId to override. */
+    offerTemplateId?: string;
+    /** The facilitator party (offer signatory; settles alone). CALLER INTENT —
+     *  pinned + added to the allowed-escrow-party set. REQUIRED. */
+    facilitator: string;
+    /** Optional merchant party recorded on the created escrow (reference-only).
+     *  Supply when the honest escrow names a distinct merchant so the backstop
+     *  allows it; omit when merchant collapses onto facilitator/sender. */
+    merchant?: string;
+    /** Optional instrument admin (DSO) recorded on the created escrow. */
+    instrumentAdmin?: string;
+    /** Optional Decimal amount the sender intends the escrow to settle. CALLER
+     *  INTENT — when supplied, the verify arm pins the created `X402Escrow`'s
+     *  recorded `amount` (a Numeric the party-leaf backstop cannot see) to it by
+     *  canonical equality, closing the amount-swap gap where a malicious/buggy
+     *  facilitator authored the offer with an inflated amount. Never taken from the
+     *  relay. Omit only when the caller has no intended amount to assert. */
+    amount?: string;
+    /** The sender is an OBSERVER of the offer, so disclose the offer contract.
+     *  Shape mirrors the v1 EPAR / allocation disclosed-contract envelope. */
+    offerDisclosedContract?: {
+        templateId: string;
+        contractId: string;
+        createdEventBlob: string;
+        synchronizerId: string;
+    };
+    /** Caller-intent synchronizer id to PREPARE on + pin the SIGNED
+     *  Metadata.synchronizer_id to. REQUIRED (the accept carries a caller-chosen
+     *  domain — the offer/escrow live on a specific synchronizer). */
+    synchronizerId: string;
+    /** Hash-binding policy; defaults to fail-closed (see HashBindingOptions). */
+    hashBinding?: HashBindingOptions;
+}): Promise<{
+    escrowCid: string | null;
+    updateId: string;
+}>;
 //# sourceMappingURL=tx.d.ts.map

package/dist/tx.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tx.d.ts","sourceRoot":"","sources":["../src/tx.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAKL,KAAK,kBAAkB,EAIxB,MAAM,sBAAsB,CAAC;AAiI9B;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;6DAEyD;IACzD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;6EAGyE;IACzE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC,GACA,OAAO,CAAC,MAAM,CAAC,CAkEjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE;IACJ,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf;gFAC4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB;oFACgF;IAChF,cAAc,EAAE,MAAM,CAAC;IACvB;iFAC6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;8EAM0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC,GACA,OAAO,CAAC;IAAE,kBAAkB,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAsHpG;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,kBAAkB,CAAA;CAAO,GAC9C,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA8BnD"}
+{"version":3,"file":"tx.d.ts","sourceRoot":"","sources":["../src/tx.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EASL,KAAK,kBAAkB,EAQxB,MAAM,sBAAsB,CAAC;AAqM9B;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;6DAEyD;IACzD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;6EAGyE;IACzE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC,GACA,OAAO,CAAC,MAAM,CAAC,CAkEjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE;IACJ,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf;gFAC4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB;oFACgF;IAChF,cAAc,EAAE,MAAM,CAAC;IACvB;iFAC6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;8EAM0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC,GACA,OAAO,CAAC;IAAE,kBAAkB,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAsHpG;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE;IACJ,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf;;gEAE4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB;8DAC0D;IAC1D,cAAc,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,qBAAqB,EAAE,MAAM,CAAC;IAC9B;uDACmD;IACnD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yEAAyE;IACzE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qEAAqE;IACrE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;wCACoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,6EAA6E;IAC7E,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC,GACA,OAAO,CAAC;IACT,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;mFAC+E;IAC/E,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC,CA0GD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE;IACJ;uFACmF;IACnF,WAAW,EAAE,MAAM,CAAC;IACpB;qFACiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC,GACA,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE;IACJ,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC,GACA,OAAO,CAAC,MAAM,CAAC,CAUjB;AA+CD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,kBAAkB,CAAA;CAAO,GAC9C,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA8BnD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE;IACJ,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;oEAIgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;oFAMgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,OAAO,CAAC,MAAM,CAAC,CAyCjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE;IACJ;wEACoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB;;oEAEgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;oEACgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB;;2EAEuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;6EAKyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;8EAC0E;IAC1E,sBAAsB,CAAC,EAAE;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,gBAAgB,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;sEAEkE;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC,GACA,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAqEzD"}