@rhinestone/sdk 1.13.3 → 1.14.0

package/dist/src/modules/validators/smart-sessions/swap/rules.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pinValue = pinValue;
+exports.pinWord = pinWord;
+exports.pin = pin;
+exports.cumulativeCap = cumulativeCap;
+exports.swapAction = swapAction;
+/**
+ * Shared rule builders for swap-venue scoping.
+ *
+ * Venue modules describe *what* to pin; these turn that into policy rules with
+ * the security-relevant details (cumulative accumulation, zero native value)
+ * decided in exactly one place.
+ */
+/**
+ * Pin a calldata word to an exact numeric value.
+ *
+ * Used for ABI *shape* words — array pointers, lengths, element offsets. Pinning
+ * those is what makes pinning anything inside a dynamic tail sound: without
+ * them a caller can re-lay-out the encoding so a fixed offset lands on a
+ * different word, and the rule silently validates the wrong bytes.
+ */
+function pinValue(calldataOffset, referenceValue) {
+    return { condition: 'equal', calldataOffset, referenceValue };
+}
+/** Pin a calldata word to an exact 32-byte value. */
+function pinWord(calldataOffset, referenceValue) {
+    return { condition: 'equal', calldataOffset, referenceValue };
+}
+/** Pin a calldata word to an exact address. */
+function pin(calldataOffset, referenceValue) {
+    return { condition: 'equal', calldataOffset, referenceValue };
+}
+/**
+ * Cap a swap's own sell amount, cumulatively across every call.
+ *
+ * `usageLimit` is what makes this cumulative: it sets `isLimited` + `usage.limit`
+ * on-chain, so the policy accumulates the observed value and reverts once the
+ * running total would exceed the cap.
+ *
+ * A bare comparison would be per-call, which is not enough. A reusable session
+ * could then run N swaps of `cap` each, and any allowance that already existed
+ * before the session was created is spent without the approve's spending-limit
+ * ever observing it.
+ */
+function cumulativeCap(calldataOffset, cap) {
+    return {
+        condition: 'lessThanOrEqual',
+        calldataOffset,
+        referenceValue: cap,
+        usageLimit: cap,
+    };
+}
+/**
+ * Wrap rules into the action's policy.
+ *
+ * `valueLimitPerUse: 0n` because the approve cap only bounds ERC-20 pulls —
+ * without it, a payable swap selector could still carry arbitrary native value
+ * through the router.
+ */
+/** Every rule must hold, as a right-folded AND over the expression tree. */
+function allOf(rules) {
+    return rules
+        .map((rule) => ({ type: 'rule', rule }))
+        .reduceRight((right, left) => ({ type: 'and', left, right }));
+}
+/**
+ * Wrap rules into the action's policy.
+ *
+ * `valueLimitPerUse: 0n` because the approve cap only bounds ERC-20 pulls —
+ * without it, a payable swap selector could still carry arbitrary native value
+ * through the router.
+ *
+ * UniversalActionPolicy while the rules fit its fixed 16-slot array, which is
+ * every venue except a fully-pinned wrapped route — those pin the shape words,
+ * both call targets, the approve and the nested exec, and run past 16. ArgPolicy
+ * takes a dynamic rule list, so it carries the overflow rather than forcing a
+ * pin to be dropped. Preferring the simpler policy keeps the common case on the
+ * contract it has always used.
+ */
+const UNIVERSAL_ACTION_MAX_RULES = 16;
+function swapAction(target, selector, rules, 
+/**
+ * Mutually exclusive rule sets, at least one of which must hold — used when
+ * several venues authorise the SAME call but pin its tail to different
+ * aggregators. One on-chain action id cannot carry two policies, and dropping
+ * the pins to share it would authorise a tail neither venue named, so the
+ * alternatives become an OR instead.
+ */
+alternatives = []) {
+    const usable = alternatives.filter((set) => set.length > 0);
+    const policy = usable.length > 0
+        ? {
+            type: 'arg-policy',
+            valueLimitPerUse: 0n,
+            expression: {
+                type: 'and',
+                left: allOf(rules),
+                right: usable
+                    .map(allOf)
+                    .reduce((left, right) => ({ type: 'or', left, right })),
+            },
+        }
+        : rules.length <= UNIVERSAL_ACTION_MAX_RULES
+            ? {
+                type: 'universal-action',
+                valueLimitPerUse: 0n,
+                rules: rules,
+            }
+            : { type: 'arg-policy', valueLimitPerUse: 0n, expression: allOf(rules) };
+    return { target, selector, policies: [policy] };
+}

package/dist/src/modules/validators/smart-sessions/swap/scope.d.ts

@@ -0,0 +1,18 @@
+import { type Chain } from 'viem';
+import type { FyndVenue, RhinestoneSwapVenue, ScopedAction, Session, SwapScope, SwapVenue, ZeroExVenue } from '../../../../types';
+import { type FyndChainId } from './fynd';
+import { type ZeroExChainId } from './zero-ex';
+export type SwapVenueFor<TChainId extends number> = number extends TChainId ? SwapVenue : RhinestoneSwapVenue | (TChainId extends ZeroExChainId ? ZeroExVenue : never) | (TChainId extends FyndChainId ? FyndVenue : never);
+export type SwapScopeFor<TChainId extends number> = Omit<SwapScope, 'via'> & {
+    readonly via?: readonly SwapVenueFor<TChainId>[];
+};
+export interface ResolvedSwapScope {
+    readonly actions: ScopedAction[];
+}
+/** Preserve the session chain literal so unavailable venues fail at compile time. */
+export declare function toSession<const TChain extends Chain>(session: Omit<Session, 'chain' | 'swap'> & {
+    readonly chain: TChain;
+    readonly swap: SwapScopeFor<TChain['id']>;
+}): Session;
+export declare function resolveSwapScope(scope: SwapScope, chainId: number, environment?: 'production' | 'development'): ResolvedSwapScope;
+//# sourceMappingURL=scope.d.ts.map

package/dist/src/modules/validators/smart-sessions/swap/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../../../../modules/validators/smart-sessions/swap/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,KAAK,EAAsB,MAAM,MAAM,CAAA;AACnE,OAAO,KAAK,EAEV,SAAS,EAET,mBAAmB,EAEnB,YAAY,EACZ,OAAO,EACP,SAAS,EACT,SAAS,EAET,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,KAAK,WAAW,EAAa,MAAM,QAAQ,CAAA;AAIpD,OAAO,EAAe,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAE3D,MAAM,MAAM,YAAY,CAAC,QAAQ,SAAS,MAAM,IAAI,MAAM,SAAS,QAAQ,GACvE,SAAS,GAEL,mBAAmB,GACnB,CAAC,QAAQ,SAAS,aAAa,GAAG,WAAW,GAAG,KAAK,CAAC,GACtD,CAAC,QAAQ,SAAS,WAAW,GAAG,SAAS,GAAG,KAAK,CAAC,CAAA;AAE1D,MAAM,MAAM,YAAY,CAAC,QAAQ,SAAS,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG;IAC3E,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAA;CACjD,CAAA;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,CAAA;CACjC;AAED,qFAAqF;AACrF,wBAAgB,SAAS,CAAC,KAAK,CAAC,MAAM,SAAS,KAAK,EAClD,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,GAAG;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CAC1C,GACA,OAAO,CAET;AA8CD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,MAAM,EACf,WAAW,GAAE,YAAY,GAAG,aAA4B,GACvD,iBAAiB,CA2EnB"}

package/dist/src/modules/validators/smart-sessions/swap/scope.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toSession = toSession;
+exports.resolveSwapScope = resolveSwapScope;
+const viem_1 = require("viem");
+const fynd_1 = require("./fynd");
+const rhinestone_1 = require("./rhinestone");
+const rules_1 = require("./rules");
+const zero_ex_1 = require("./zero-ex");
+/** Preserve the session chain literal so unavailable venues fail at compile time. */
+function toSession(session) {
+    return session;
+}
+const APPROVE_SELECTOR = (0, viem_1.toFunctionSelector)('approve(address,uint256)');
+function orRules(rules) {
+    return rules
+        .map((rule) => ({ type: 'rule', rule }))
+        .reduceRight((right, left) => ({ type: 'or', left, right }));
+}
+function approveAction(scope, scopings) {
+    const spenders = [
+        ...new Set(scopings.flatMap((scoping) => scoping.approveSpenders.map((spender) => spender.toLowerCase()))),
+    ].map((spender) => spender);
+    const rules = spenders.map((spender) => (0, rules_1.pin)(0n, spender));
+    const spenderPolicy = rules.length === 1
+        ? {
+            type: 'universal-action',
+            valueLimitPerUse: 0n,
+            rules: [rules[0]],
+        }
+        : {
+            type: 'arg-policy',
+            valueLimitPerUse: 0n,
+            expression: orRules(rules),
+        };
+    const policies = [spenderPolicy];
+    if (scope.sell.maxTotal !== undefined) {
+        policies.push({
+            type: 'spending-limits',
+            limits: [{ token: scope.sell.token, amount: scope.sell.maxTotal }],
+        });
+    }
+    return { target: scope.sell.token, selector: APPROVE_SELECTOR, policies };
+}
+function resolveSwapScope(scope, chainId, environment = 'production') {
+    const via = scope.via ?? [(0, rhinestone_1.rhinestoneSwap)()];
+    if (via.length === 0) {
+        throw new Error('swap.via must list at least one venue — an empty list would authorise nothing');
+    }
+    if (scope.sell.token.toLowerCase() === scope.buy.token.toLowerCase()) {
+        throw new Error(`swap.sell.token and swap.buy.token are the same address (${scope.sell.token})`);
+    }
+    const contextFor = (venue) => ({
+        chainId,
+        environment,
+        sellToken: scope.sell.token,
+        buyToken: scope.buy.token,
+        recipient: scope.to,
+        cap: venue.maxSpend ?? scope.sell.maxTotal,
+    });
+    const routes = new Set(via.flatMap((venue) => venue.id === 'fynd'
+        ? ['fynd']
+        : venue.id === '0x'
+            ? ['zeroEx']
+            : []));
+    const anyAggregatorAllowed = via.some((venue) => venue.id === 'rhinestone');
+    const sharedRoute = routes.size === 1 && !anyAggregatorAllowed ? [...routes][0] : undefined;
+    const sharedRoutes = routes.size > 1 && !anyAggregatorAllowed ? [...routes] : undefined;
+    const zeroExSettler = via.flatMap((venue) => venue.id === '0x' && venue.settler !== undefined ? [venue.settler] : [])[0];
+    const wrappedVenue = () => {
+        const settler = zeroExSettler ? { settler: zeroExSettler } : {};
+        if (sharedRoutes) {
+            return { id: 'rhinestone', routes: sharedRoutes, ...settler };
+        }
+        if (sharedRoute) {
+            return {
+                id: 'rhinestone',
+                route: sharedRoute,
+                ...(sharedRoute === 'zeroEx' ? settler : {}),
+            };
+        }
+        return { id: 'rhinestone' };
+    };
+    const scopings = via.map((venue) => {
+        const context = contextFor(venue);
+        if (venue.id === 'rhinestone')
+            return (0, rhinestone_1.scopeRhinestone)(venue, context);
+        const parts = [
+            venue.id === 'fynd' ? (0, fynd_1.scopeFynd)(context) : (0, zero_ex_1.scopeZeroEx)(venue, context),
+            (0, rhinestone_1.scopeRhinestone)(wrappedVenue(), context),
+        ];
+        return {
+            approveSpenders: parts.flatMap((part) => [...part.approveSpenders]),
+            actions: parts.flatMap((part) => [...part.actions]),
+        };
+    });
+    return {
+        actions: [
+            approveAction(scope, scopings),
+            ...dedupeActions(scopings.flatMap((scoping) => [...scoping.actions])),
+        ],
+    };
+}
+function dedupeActions(actions) {
+    const byKey = new Map();
+    for (const action of actions) {
+        const key = `${action.target.toLowerCase()}|${action.selector.toLowerCase()}`;
+        const existing = byKey.get(key);
+        if (!existing) {
+            byKey.set(key, action);
+            continue;
+        }
+        if (JSON.stringify(existing, replaceBigInt) !==
+            JSON.stringify(action, replaceBigInt)) {
+            throw new Error(`Conflicting swap actions for ${action.target} ${action.selector}: ` +
+                'two venues authorise the same call with different policies. Give ' +
+                'them the same cap, or list only one.');
+        }
+    }
+    return [...byKey.values()];
+}
+function replaceBigInt(_key, value) {
+    return typeof value === 'bigint' ? value.toString() : value;
+}

package/dist/src/modules/validators/smart-sessions/swap/zero-ex.d.ts

@@ -0,0 +1,143 @@
+import { type Address } from 'viem';
+import type { ZeroExVenue } from '../../../../types';
+import type { VenueContext, VenueScoping } from './rules';
+/**
+ * 0x — Swap API v2, AllowanceHolder flow.
+ *
+ * Two calls per swap:
+ *   1. `approve(AllowanceHolder, amount)` on the sell token
+ *   2. `AllowanceHolder.exec(operator, token, amount, target, data)` — pulls the
+ *      approved sell token and forwards `data` to the Settler.
+ *
+ * The split matters for scoping. `token` and `amount` are consumed by the
+ * AllowanceHolder itself, so pinning them is meaningful no matter what `target`
+ * is. `operator` and `target` decide who receives the pulled funds, and nothing
+ * on-chain requires them to be a Settler — leave them free and a compromised
+ * session key names its own contract.
+ */
+/** Permanent across chains — 0x never rotates this. Verified deployed on Plasma. */
+export declare const ZEROX_ALLOWANCE_HOLDER: Address;
+/** Chains where 0x is an enabled quoter with a whitelisted Settler. */
+export declare const ZEROX_CHAIN_IDS: readonly [1, 10, 56, 130, 137, 143, 146, 999, 4663, 8453, 9745, 42161, 43114, 57073];
+export type ZeroExChainId = (typeof ZEROX_CHAIN_IDS)[number];
+export declare const allowanceHolderAbi: readonly [{
+    readonly type: "function";
+    readonly name: "exec";
+    readonly stateMutability: "payable";
+    readonly inputs: readonly [{
+        readonly name: "operator";
+        readonly type: "address";
+    }, {
+        readonly name: "token";
+        readonly type: "address";
+    }, {
+        readonly name: "amount";
+        readonly type: "uint256";
+    }, {
+        readonly name: "target";
+        readonly type: "address";
+    }, {
+        readonly name: "data";
+        readonly type: "bytes";
+    }];
+    readonly outputs: readonly [{
+        readonly name: "result";
+        readonly type: "bytes";
+    }];
+}];
+export declare const ALLOWANCE_HOLDER_EXEC_SELECTOR: `0x${string}`;
+/**
+ * 0x's Settler registry — an ERC-721 whose token owner IS the current Settler
+ * for that feature slot. Slot 2 is the taker-submitted Settler used by ordinary
+ * swaps.
+ *
+ * 0x redeploys the Settler every few weeks and moves the token, so there is no
+ * safe constant to bundle: any address baked into a release is correct only
+ * until the next rotation. Resolve with {@link resolveZeroExSettler} and pin the
+ * result, or use `anySettler` to trade the pin for longevity.
+ */
+export declare const ZEROX_SETTLER_REGISTRY: Address;
+export declare const ZEROX_SETTLER_FEATURE_ID = 2n;
+export declare const zeroExSettlerRegistryAbi: readonly [{
+    readonly type: "function";
+    readonly name: "ownerOf";
+    readonly stateMutability: "view";
+    readonly inputs: readonly [{
+        readonly name: "tokenId";
+        readonly type: "uint256";
+    }];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "address";
+    }];
+}];
+/** Minimal structural client — avoids coupling this module to a viem client type. */
+interface SettlerRegistryReader {
+    readContract(args: {
+        address: Address;
+        abi: typeof zeroExSettlerRegistryAbi;
+        functionName: 'ownerOf';
+        args: readonly [bigint];
+    }): Promise<Address>;
+}
+/**
+ * Read 0x's current Settler for this chain from the on-chain registry.
+ *
+ * Pin the result at session-enable time; do NOT re-resolve per swap. A session
+ * that looked the address up at use time would follow 0x's registry wherever it
+ * points, so a compromise of 0x's upgrade multisig could redirect every live
+ * session's approved funds. Pinned, the worst case of a rotation is that the
+ * session stops working until it is re-enabled.
+ *
+ * @param client - Any viem public client for the target chain.
+ */
+export declare function resolveZeroExSettler(client: SettlerRegistryReader): Promise<Address>;
+/**
+ * Pin 0x's Settler to a specific address.
+ *
+ * Pinning the inner `buyToken` / `recipient` is not a substitute for pinning
+ * `target`: those bytes only mean what their names say when the callee is
+ * genuinely a Settler.
+ */
+export interface ZeroExPinnedOptions {
+    /** The Settler to pin. Get the current one with {@link resolveZeroExSettler}. */
+    settler: Address;
+    anySettler?: never;
+    maxSpend?: never;
+}
+/**
+ * Leave 0x's Settler unpinned so the session survives 0x's rotations.
+ *
+ * A deliberate security downgrade, which is why `maxSpend` is mandatory here:
+ * with `target` free, a compromised session key can redirect the AllowanceHolder
+ * pull to its own contract, and `maxSpend` is then the ONLY bound on what it
+ * takes. The blast radius becomes exactly `maxSpend`, never the account's whole
+ * balance.
+ *
+ * Prefer {@link ZeroExPinnedOptions} unless the session must outlive 0x's
+ * upgrade cadence (roughly every few weeks).
+ */
+export interface ZeroExAnySettlerOptions {
+    anySettler: true;
+    /** Cumulative cap on sell-token spend across every swap in this session. */
+    maxSpend: bigint;
+    settler?: never;
+}
+/**
+ * Scope a session to 0x swaps, in whichever shape the orchestrator produces.
+ *
+ * Authorises BOTH the direct `AllowanceHolder.exec` call and the
+ * Swapper-wrapped one, and there is no way to narrow that. Whether a swap is
+ * wrapped is decided by `ENABLE_SWAPPER`, the account type, and whether the
+ * Swapper resolves on the chain — state that is read when the intent executes,
+ * not when the session is signed. Authorising one shape is how a session ends
+ * up rejecting the swap it was created for.
+ *
+ * Takes either a pinned `settler` or `anySettler` + `maxSpend`. There is
+ * deliberately no zero-argument form: a bundled Settler constant would be stale
+ * within weeks of the release that shipped it.
+ */
+export declare function zeroEx(options: ZeroExPinnedOptions | ZeroExAnySettlerOptions): ZeroExVenue;
+export declare function scopeZeroEx(venue: ZeroExVenue, ctx: VenueContext): VenueScoping;
+export {};
+//# sourceMappingURL=zero-ex.d.ts.map

package/dist/src/modules/validators/smart-sessions/swap/zero-ex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zero-ex.d.ts","sourceRoot":"","sources":["../../../../../../modules/validators/smart-sessions/swap/zero-ex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,OAAO,EAAsB,MAAM,MAAM,CAAA;AACjE,OAAO,KAAK,EAEV,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAE1B,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAGzD;;;;;;;;;;;;;GAaG;AAEH,oFAAoF;AACpF,eAAO,MAAM,sBAAsB,EAAE,OACS,CAAA;AAE9C,uEAAuE;AACvE,eAAO,MAAM,eAAe,sFAElB,CAAA;AAEV,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAA;AAE5D,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;EAcP,CAAA;AAExB,eAAO,MAAM,8BAA8B,eAE1C,CAAA;AAiCD;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,OACS,CAAA;AAE9C,eAAO,MAAM,wBAAwB,KAAK,CAAA;AAE1C,eAAO,MAAM,wBAAwB;;;;;;;;;;;;EAQb,CAAA;AAExB,qFAAqF;AACrF,UAAU,qBAAqB;IAC7B,YAAY,CAAC,IAAI,EAAE;QACjB,OAAO,EAAE,OAAO,CAAA;QAChB,GAAG,EAAE,OAAO,wBAAwB,CAAA;QACpC,YAAY,EAAE,SAAS,CAAA;QACvB,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;KACxB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,iFAAiF;IACjF,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,EAAE,KAAK,CAAA;CACjB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,IAAI,CAAA;IAChB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,KAAK,CAAA;CAChB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,MAAM,CACpB,OAAO,EAAE,mBAAmB,GAAG,uBAAuB,GACrD,WAAW,CAOb;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE,WAAW,EAClB,GAAG,EAAE,YAAY,GAChB,YAAY,CAsCd"}

package/dist/src/modules/validators/smart-sessions/swap/zero-ex.js

@@ -0,0 +1,170 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.zeroExSettlerRegistryAbi = exports.ZEROX_SETTLER_FEATURE_ID = exports.ZEROX_SETTLER_REGISTRY = exports.ALLOWANCE_HOLDER_EXEC_SELECTOR = exports.allowanceHolderAbi = exports.ZEROX_CHAIN_IDS = exports.ZEROX_ALLOWANCE_HOLDER = void 0;
+exports.resolveZeroExSettler = resolveZeroExSettler;
+exports.zeroEx = zeroEx;
+exports.scopeZeroEx = scopeZeroEx;
+const viem_1 = require("viem");
+const abi_1 = require("./abi");
+const rules_1 = require("./rules");
+/**
+ * 0x — Swap API v2, AllowanceHolder flow.
+ *
+ * Two calls per swap:
+ *   1. `approve(AllowanceHolder, amount)` on the sell token
+ *   2. `AllowanceHolder.exec(operator, token, amount, target, data)` — pulls the
+ *      approved sell token and forwards `data` to the Settler.
+ *
+ * The split matters for scoping. `token` and `amount` are consumed by the
+ * AllowanceHolder itself, so pinning them is meaningful no matter what `target`
+ * is. `operator` and `target` decide who receives the pulled funds, and nothing
+ * on-chain requires them to be a Settler — leave them free and a compromised
+ * session key names its own contract.
+ */
+/** Permanent across chains — 0x never rotates this. Verified deployed on Plasma. */
+exports.ZEROX_ALLOWANCE_HOLDER = '0x0000000000001fF3684f28c67538d4D072C22734';
+/** Chains where 0x is an enabled quoter with a whitelisted Settler. */
+exports.ZEROX_CHAIN_IDS = [
+    1, 10, 56, 130, 137, 143, 146, 999, 4663, 8453, 9745, 42161, 43114, 57073,
+];
+exports.allowanceHolderAbi = [
+    {
+        type: 'function',
+        name: 'exec',
+        stateMutability: 'payable',
+        inputs: [
+            { name: 'operator', type: 'address' },
+            { name: 'token', type: 'address' },
+            { name: 'amount', type: 'uint256' },
+            { name: 'target', type: 'address' },
+            { name: 'data', type: 'bytes' },
+        ],
+        outputs: [{ name: 'result', type: 'bytes' }],
+    },
+];
+exports.ALLOWANCE_HOLDER_EXEC_SELECTOR = (0, viem_1.toFunctionSelector)(exports.allowanceHolderAbi[0]);
+/** exec's own head offsets, derived from the ABI. */
+const EXEC = (0, abi_1.namedParamOffsets)(exports.allowanceHolderAbi, 'exec');
+/**
+ * Offsets of the Settler's slippage fields, measured in EXEC's calldata.
+ *
+ * These cannot come from an ABI: they live inside `exec.data`, which is opaque
+ * `bytes` as far as exec's own signature is concerned. They are stable anyway
+ * because the Settler's
+ * `execute((recipient, buyToken, minAmountOut) slippage, bytes[] actions, bytes32)`
+ * places the fixed-size slippage struct BEFORE the variable-length `actions`.
+ *
+ * Derivation: exec's `data` content begins at 192 (five head words + the length
+ * word), +4 for the inner selector = 196 for `recipient`, +32 = 228 for
+ * `buyToken`. Re-derive against a live 0x exec if 0x revs the Settler ABI.
+ */
+/**
+ * `exec`'s `data` head word, and the canonical tail it must point at.
+ *
+ * The Settler offsets below are derived from `data` starting at 192, which only
+ * holds while this pointer says 160. Unpinned, a session key can aim `data`
+ * elsewhere and leave matching decoy words at 196/228 for the policy to read
+ * while the Settler decodes a different recipient. `rhinestone.ts` pins the
+ * equivalent `calls[]` shape words for the same reason.
+ */
+const EXEC_DATA_POINTER_OFFSET = 128n;
+const EXEC_DATA_POINTER = 160n;
+const SETTLER_RECIPIENT_OFFSET = 196n;
+const SETTLER_BUY_TOKEN_OFFSET = 228n;
+/**
+ * 0x's Settler registry — an ERC-721 whose token owner IS the current Settler
+ * for that feature slot. Slot 2 is the taker-submitted Settler used by ordinary
+ * swaps.
+ *
+ * 0x redeploys the Settler every few weeks and moves the token, so there is no
+ * safe constant to bundle: any address baked into a release is correct only
+ * until the next rotation. Resolve with {@link resolveZeroExSettler} and pin the
+ * result, or use `anySettler` to trade the pin for longevity.
+ */
+exports.ZEROX_SETTLER_REGISTRY = '0x00000000000004533Fe15556B1E086BB1A72cEae';
+exports.ZEROX_SETTLER_FEATURE_ID = 2n;
+exports.zeroExSettlerRegistryAbi = [
+    {
+        type: 'function',
+        name: 'ownerOf',
+        stateMutability: 'view',
+        inputs: [{ name: 'tokenId', type: 'uint256' }],
+        outputs: [{ name: '', type: 'address' }],
+    },
+];
+/**
+ * Read 0x's current Settler for this chain from the on-chain registry.
+ *
+ * Pin the result at session-enable time; do NOT re-resolve per swap. A session
+ * that looked the address up at use time would follow 0x's registry wherever it
+ * points, so a compromise of 0x's upgrade multisig could redirect every live
+ * session's approved funds. Pinned, the worst case of a rotation is that the
+ * session stops working until it is re-enabled.
+ *
+ * @param client - Any viem public client for the target chain.
+ */
+async function resolveZeroExSettler(client) {
+    return client.readContract({
+        address: exports.ZEROX_SETTLER_REGISTRY,
+        abi: exports.zeroExSettlerRegistryAbi,
+        functionName: 'ownerOf',
+        args: [exports.ZEROX_SETTLER_FEATURE_ID],
+    });
+}
+/**
+ * Scope a session to 0x swaps, in whichever shape the orchestrator produces.
+ *
+ * Authorises BOTH the direct `AllowanceHolder.exec` call and the
+ * Swapper-wrapped one, and there is no way to narrow that. Whether a swap is
+ * wrapped is decided by `ENABLE_SWAPPER`, the account type, and whether the
+ * Swapper resolves on the chain — state that is read when the intent executes,
+ * not when the session is signed. Authorising one shape is how a session ends
+ * up rejecting the swap it was created for.
+ *
+ * Takes either a pinned `settler` or `anySettler` + `maxSpend`. There is
+ * deliberately no zero-argument form: a bundled Settler constant would be stale
+ * within weeks of the release that shipped it.
+ */
+function zeroEx(options) {
+    return {
+        id: '0x',
+        ...(options.settler !== undefined ? { settler: options.settler } : {}),
+        ...(options.anySettler ? { anySettler: true } : {}),
+        ...(options.maxSpend !== undefined ? { maxSpend: options.maxSpend } : {}),
+    };
+}
+function scopeZeroEx(venue, ctx) {
+    // The union type rejects this at compile time, but a plain-JS caller or an
+    // `as any` reaches here with neither, and the rules below would then pin only
+    // the sell token — an unbounded AllowanceHolder path.
+    if (venue.settler === undefined && !venue.anySettler) {
+        throw new Error('zeroEx() requires either a pinned settler or anySettler + maxSpend: ' +
+            'with neither, nothing bounds the operator, target or amount');
+    }
+    if (venue.anySettler && ctx.cap === undefined) {
+        throw new Error('zeroEx({ anySettler: true }) requires maxSpend: with the Settler ' +
+            'unpinned it is the only bound on what a compromised session key can pull');
+    }
+    // Pinned from the scope, never from venue options — the sell token is a
+    // scope-level guarantee and must not depend on the caller restating it.
+    const rules = [
+        (0, rules_1.pin)(EXEC.token, ctx.sellToken),
+    ];
+    if (venue.settler !== undefined) {
+        rules.push((0, rules_1.pin)(EXEC.operator, venue.settler));
+        rules.push((0, rules_1.pin)(EXEC.target, venue.settler));
+        // Before any offset inside `exec.data` can be trusted.
+        rules.push((0, rules_1.pinValue)(EXEC_DATA_POINTER_OFFSET, EXEC_DATA_POINTER));
+        rules.push((0, rules_1.pin)(SETTLER_BUY_TOKEN_OFFSET, ctx.buyToken));
+        rules.push((0, rules_1.pin)(SETTLER_RECIPIENT_OFFSET, ctx.recipient));
+    }
+    if (ctx.cap !== undefined) {
+        rules.push((0, rules_1.cumulativeCap)(EXEC.amount, ctx.cap));
+    }
+    return {
+        approveSpenders: [exports.ZEROX_ALLOWANCE_HOLDER],
+        actions: [
+            (0, rules_1.swapAction)(exports.ZEROX_ALLOWANCE_HOLDER, exports.ALLOWANCE_HOLDER_EXEC_SELECTOR, rules),
+        ],
+    };
+}

package/dist/src/modules/validators/smart-sessions.d.ts

@@ -1,7 +1,11 @@
 import { type Address, type Hex, type TypedDataDefinition } from 'viem';
-import type { Policy, ProviderConfig, RhinestoneAccountConfig, RhinestoneConfig, Session, SessionEnableData } from '../../types';
+import type { FyndVenue, Policy, ProviderConfig, RhinestoneAccountConfig, RhinestoneConfig, RhinestoneSwapVenue, Session, SessionEnableData, SwapScope, SwapVenue, ZeroExVenue } from '../../types';
 import { type Module } from '../common';
 import { SMART_SESSION_EMISSARY_ADDRESS, SMART_SESSION_EMISSARY_ADDRESS_DEV } from './core';
+import { fynd } from './smart-sessions/swap/fynd';
+import { rhinestoneSwap } from './smart-sessions/swap/rhinestone';
+import { type SwapScopeFor, type SwapVenueFor, toSession } from './smart-sessions/swap/scope';
+import { resolveZeroExSettler, type ZeroExAnySettlerOptions, type ZeroExPinnedOptions, zeroEx } from './smart-sessions/swap/zero-ex';
 interface SessionData {
     sessionValidator: Address;
     sessionValidatorInitData: Hex;
@@ -170,6 +174,7 @@ declare const SPENDING_LIMITS_POLICY_ADDRESS: Address;
 declare const TIME_FRAME_POLICY_ADDRESS: Address;
 declare const SUDO_POLICY_ADDRESS: Address;
 declare const UNIVERSAL_ACTION_POLICY_ADDRESS: Address;
+declare const ARG_POLICY_ADDRESS: Address;
 declare const USAGE_LIMIT_POLICY_ADDRESS: Address;
 declare const VALUE_LIMIT_POLICY_ADDRESS: Address;
 declare const INTENT_EXECUTION_POLICY_ADDRESS: Address;
@@ -179,6 +184,7 @@ interface ResolvedSessionSignerSet {
     enableData?: SessionEnableData;
     verifyExecutions: boolean;
     claimPolicyData?: Hex;
+    useDevContracts?: boolean;
 }
 declare function packSignature(signers: ResolvedSessionSignerSet, validatorSignature: Hex): Hex;
 declare function getSessionDetails(account: Address, sessions: Session[], provider: ProviderConfig | undefined, useDevContracts?: boolean): Promise<SessionDetails>;
@@ -204,6 +210,6 @@ declare function getSmartSessionValidator(config: RhinestoneConfig): Module | nu
  * simulates verifyExecution with the mock emissary to estimate gas before the user signs.
  */
 declare function buildMockSignature(session: Session, useDevContracts?: boolean, chainCount?: number, targetChainId?: number): Hex;
-export { SMART_SESSION_EMISSARY_ADDRESS, SMART_SESSION_EMISSARY_ADDRESS_DEV, SMART_SESSIONS_FALLBACK_TARGET_FLAG, SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG, SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG_PERMITTED_TO_CALL_SMARTSESSION, DUMMY_PRECLAIMOP_TARGET, DUMMY_PRECLAIMOP_SELECTOR, SPENDING_LIMITS_POLICY_ADDRESS, TIME_FRAME_POLICY_ADDRESS, SUDO_POLICY_ADDRESS, UNIVERSAL_ACTION_POLICY_ADDRESS, USAGE_LIMIT_POLICY_ADDRESS, VALUE_LIMIT_POLICY_ADDRESS, INTENT_EXECUTION_POLICY_ADDRESS, packSignature, getSessionData, getPolicyData, getEnableSessionCall, getPermissionId, getSmartSessionValidator, getSessionDetails, isSessionEnabled, signEnableSession, buildMockSignature, };
-export type { ChainSession, ChainDigest, ResolvedSessionSignerSet, SessionData, SmartSessionModeType, SessionDetails, };
+export { SMART_SESSION_EMISSARY_ADDRESS, SMART_SESSION_EMISSARY_ADDRESS_DEV, SMART_SESSIONS_FALLBACK_TARGET_FLAG, SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG, SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG_PERMITTED_TO_CALL_SMARTSESSION, DUMMY_PRECLAIMOP_TARGET, DUMMY_PRECLAIMOP_SELECTOR, SPENDING_LIMITS_POLICY_ADDRESS, TIME_FRAME_POLICY_ADDRESS, SUDO_POLICY_ADDRESS, UNIVERSAL_ACTION_POLICY_ADDRESS, ARG_POLICY_ADDRESS, USAGE_LIMIT_POLICY_ADDRESS, VALUE_LIMIT_POLICY_ADDRESS, INTENT_EXECUTION_POLICY_ADDRESS, packSignature, getSessionData, getPolicyData, getEnableSessionCall, getPermissionId, getSmartSessionValidator, getSessionDetails, isSessionEnabled, signEnableSession, buildMockSignature, fynd, resolveZeroExSettler, rhinestoneSwap, toSession, zeroEx, };
+export type { ChainSession, ChainDigest, FyndVenue, ResolvedSessionSignerSet, RhinestoneSwapVenue, SessionData, SmartSessionModeType, SessionDetails, SwapScope, SwapScopeFor, SwapVenue, SwapVenueFor, ZeroExAnySettlerOptions, ZeroExPinnedOptions, ZeroExVenue, };
 //# sourceMappingURL=smart-sessions.d.ts.map

package/dist/src/modules/validators/smart-sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"smart-sessions.d.ts","sourceRoot":"","sources":["../../../../modules/validators/smart-sessions.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,OAAO,EAMZ,KAAK,GAAG,EAOR,KAAK,mBAAmB,EAKzB,MAAM,MAAM,CAAA;AAab,OAAO,KAAK,EAEV,MAAM,EACN,cAAc,EACd,uBAAuB,EACvB,gBAAgB,EAChB,OAAO,EACP,iBAAiB,EAElB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,WAAW,CAAA;AACjE,OAAO,EAIL,8BAA8B,EAC9B,kCAAkC,EACnC,MAAM,QAAQ,CAAA;AAYf,UAAU,WAAW;IACnB,gBAAgB,EAAE,OAAO,CAAA;IACzB,wBAAwB,EAAE,GAAG,CAAA;IAC7B,IAAI,EAAE,GAAG,CAAA;IACT,eAAe,EAAE;QACf,qBAAqB,EAAE,SAAS,qBAAqB,EAAE,CAAA;QACvD,eAAe,EAAE,SAAS,aAAa,EAAE,CAAA;KAC1C,CAAA;IACD,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;IAC9B,aAAa,EAAE,SAAS,UAAU,EAAE,CAAA;CACrC;AAED,UAAU,aAAa;IACrB,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,GAAG,CAAA;CACd;AAED,UAAU,qBAAqB;IAC7B,kBAAkB,EAAE,GAAG,CAAA;IACvB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED,UAAU,UAAU;IAClB,oBAAoB,EAAE,GAAG,CAAA;IACzB,YAAY,EAAE,OAAO,CAAA;IACrB,cAAc,EAAE,SAAS,UAAU,EAAE,CAAA;CACtC;AAED,UAAU,UAAU;IAClB,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,GAAG,CAAA;CACd;AAaD,KAAK,oBAAoB,GACrB,OAAO,sBAAsB,GAC7B,OAAO,yBAAyB,CAAA;AAEpC,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,GAAG,CAAA;CACnB;AAED,UAAU,iBAAiB;IACzB,mBAAmB,EAAE,OAAO,CAAA;IAC5B,iBAAiB,EAAE,OAAO,CAAA;IAC1B,0BAA0B,EAAE,OAAO,CAAA;IACnC,sBAAsB,EAAE,OAAO,CAAA;IAC/B,cAAc,EAAE,SAAS,UAAU,EAAE,CAAA;IACrC,eAAe,EAAE,WAAW,CAAA;IAC5B,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;CAC/B;AAED,UAAU,aAAa;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,iBAAiB,CAAA;IAC9B,gBAAgB,EAAE,OAAO,CAAA;IACzB,wBAAwB,EAAE,GAAG,CAAA;IAC7B,IAAI,EAAE,GAAG,CAAA;IACT,YAAY,EAAE,OAAO,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,UAAU,YAAY;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,aAAa,CAAA;CACvB;AAED,UAAU,WAAW;IACnB,qBAAqB,EAAE,SAAS,cAAc,EAAE,CAAA;IAChD,eAAe,EAAE,SAAS,UAAU,EAAE,CAAA;CACvC;AAED,UAAU,cAAc;IACtB,kBAAkB,EAAE,GAAG,CAAA;IACvB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAC/B;AAED,UAAU,cAAc;IACtB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,iBAAiB,EAAE,WAAW,EAAE,CAAA;IAChC,IAAI,EAAE,mBAAmB,CAAC,OAAO,KAAK,EAAE,mBAAmB,CAAC,CAAA;CAC7D;AAED,QAAA,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CD,CAAA;AAEV,QAAA,MAAM,sBAAsB,SAAS,CAAA;AACrC,QAAA,MAAM,yBAAyB,SAAS,CAAA;AAExC,QAAA,MAAM,mCAAmC,EAAE,OACG,CAAA;AAC9C,QAAA,MAAM,4CAA4C,EAAE,GAAkB,CAAA;AACtE,QAAA,MAAM,2EAA2E,EAAE,GACrE,CAAA;AAOd,QAAA,MAAM,uBAAuB,EAAE,OACe,CAAA;AAC9C,QAAA,MAAM,yBAAyB,EAAE,GAAkB,CAAA;AAEnD,QAAA,MAAM,8BAA8B,EAAE,OACQ,CAAA;AAC9C,QAAA,MAAM,yBAAyB,EAAE,OACa,CAAA;AAC9C,QAAA,MAAM,mBAAmB,EAAE,OACmB,CAAA;AAC9C,QAAA,MAAM,+BAA+B,EAAE,OACO,CAAA;AAC9C,QAAA,MAAM,0BAA0B,EAAE,OACY,CAAA;AAC9C,QAAA,MAAM,0BAA0B,EAAE,OACY,CAAA;AAC9C,QAAA,MAAM,+BAA+B,EAAE,OACO,CAAA;AAY9C,UAAU,wBAAwB;IAChC,IAAI,EAAE,sBAAsB,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,gBAAgB,EAAE,OAAO,CAAA;IACzB,eAAe,CAAC,EAAE,GAAG,CAAA;CACtB;AAED,iBAAS,aAAa,CACpB,OAAO,EAAE,wBAAwB,EACjC,kBAAkB,EAAE,GAAG,GACtB,GAAG,CA4JL;AAED,iBAAe,iBAAiB,CAC9B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,OAAO,EAAE,EACnB,QAAQ,EAAE,cAAc,GAAG,SAAS,EACpC,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,CAAC,cAAc,CAAC,CAiDzB;AAED,iBAAe,gBAAgB,CAC7B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,GAAG,SAAS,EACpC,OAAO,EAAE,OAAO,EAChB,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED,iBAAe,iBAAiB,CAC9B,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,GAAG,CAAC,CA0Bd;AAwED,iBAAe,oBAAoB,CACjC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,sBAAsB,EAAE,GAAG,EAC3B,iBAAiB,EAAE;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,GAAG,CAAA;CACnB,EAAE,EACH,oBAAoB,EAAE,MAAM,EAC5B,eAAe,CAAC,EAAE,OAAO;;;GA8B1B;AAED,iBAAS,cAAc,CACrB,OAAO,EAAE,OAAO,EAChB,eAAe,CAAC,EAAE,OAAO,GACxB,WAAW,CAmGb;AAED,iBAAS,eAAe,CAAC,OAAO,EAAE,OAAO,iBAyBxC;AAED,iBAAS,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,OAAO,GAAG,UAAU,CA2K5E;AAED,iBAAS,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAezE;AAQD;;;;;;;GAOG;AACH,iBAAS,kBAAkB,CACzB,OAAO,EAAE,OAAO,EAChB,eAAe,CAAC,EAAE,OAAO,EACzB,UAAU,GAAE,MAAU,EACtB,aAAa,CAAC,EAAE,MAAM,GACrB,GAAG,CAgCL;AASD,OAAO,EACL,8BAA8B,EAC9B,kCAAkC,EAClC,mCAAmC,EACnC,4CAA4C,EAC5C,2EAA2E,EAC3E,uBAAuB,EACvB,yBAAyB,EACzB,8BAA8B,EAC9B,yBAAyB,EACzB,mBAAmB,EACnB,+BAA+B,EAC/B,0BAA0B,EAC1B,0BAA0B,EAC1B,+BAA+B,EAC/B,aAAa,EACb,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,CAAA;AACD,YAAY,EACV,YAAY,EACZ,WAAW,EACX,wBAAwB,EACxB,WAAW,EACX,oBAAoB,EACpB,cAAc,GACf,CAAA"}
+{"version":3,"file":"smart-sessions.d.ts","sourceRoot":"","sources":["../../../../modules/validators/smart-sessions.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,OAAO,EAMZ,KAAK,GAAG,EAOR,KAAK,mBAAmB,EAKzB,MAAM,MAAM,CAAA;AAab,OAAO,KAAK,EAGV,SAAS,EACT,MAAM,EACN,cAAc,EACd,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,OAAO,EACP,iBAAiB,EACjB,SAAS,EACT,SAAS,EAET,WAAW,EACZ,MAAM,aAAa,CAAA;AAEpB,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,WAAW,CAAA;AACjE,OAAO,EAIL,8BAA8B,EAC9B,kCAAkC,EACnC,MAAM,QAAQ,CAAA;AAKf,OAAO,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,SAAS,EACV,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,MAAM,EACP,MAAM,+BAA+B,CAAA;AAQtC,UAAU,WAAW;IACnB,gBAAgB,EAAE,OAAO,CAAA;IACzB,wBAAwB,EAAE,GAAG,CAAA;IAC7B,IAAI,EAAE,GAAG,CAAA;IACT,eAAe,EAAE;QACf,qBAAqB,EAAE,SAAS,qBAAqB,EAAE,CAAA;QACvD,eAAe,EAAE,SAAS,aAAa,EAAE,CAAA;KAC1C,CAAA;IACD,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;IAC9B,aAAa,EAAE,SAAS,UAAU,EAAE,CAAA;CACrC;AAED,UAAU,aAAa;IACrB,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,GAAG,CAAA;CACd;AAED,UAAU,qBAAqB;IAC7B,kBAAkB,EAAE,GAAG,CAAA;IACvB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED,UAAU,UAAU;IAClB,oBAAoB,EAAE,GAAG,CAAA;IACzB,YAAY,EAAE,OAAO,CAAA;IACrB,cAAc,EAAE,SAAS,UAAU,EAAE,CAAA;CACtC;AAED,UAAU,UAAU;IAClB,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,GAAG,CAAA;CACd;AAaD,KAAK,oBAAoB,GACrB,OAAO,sBAAsB,GAC7B,OAAO,yBAAyB,CAAA;AAEpC,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,GAAG,CAAA;CACnB;AAED,UAAU,iBAAiB;IACzB,mBAAmB,EAAE,OAAO,CAAA;IAC5B,iBAAiB,EAAE,OAAO,CAAA;IAC1B,0BAA0B,EAAE,OAAO,CAAA;IACnC,sBAAsB,EAAE,OAAO,CAAA;IAC/B,cAAc,EAAE,SAAS,UAAU,EAAE,CAAA;IACrC,eAAe,EAAE,WAAW,CAAA;IAC5B,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;CAC/B;AAED,UAAU,aAAa;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,iBAAiB,CAAA;IAC9B,gBAAgB,EAAE,OAAO,CAAA;IACzB,wBAAwB,EAAE,GAAG,CAAA;IAC7B,IAAI,EAAE,GAAG,CAAA;IACT,YAAY,EAAE,OAAO,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,UAAU,YAAY;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,aAAa,CAAA;CACvB;AAED,UAAU,WAAW;IACnB,qBAAqB,EAAE,SAAS,cAAc,EAAE,CAAA;IAChD,eAAe,EAAE,SAAS,UAAU,EAAE,CAAA;CACvC;AAED,UAAU,cAAc;IACtB,kBAAkB,EAAE,GAAG,CAAA;IACvB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAC/B;AAED,UAAU,cAAc;IACtB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,iBAAiB,EAAE,WAAW,EAAE,CAAA;IAChC,IAAI,EAAE,mBAAmB,CAAC,OAAO,KAAK,EAAE,mBAAmB,CAAC,CAAA;CAC7D;AAED,QAAA,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CD,CAAA;AAEV,QAAA,MAAM,sBAAsB,SAAS,CAAA;AACrC,QAAA,MAAM,yBAAyB,SAAS,CAAA;AAExC,QAAA,MAAM,mCAAmC,EAAE,OACG,CAAA;AAC9C,QAAA,MAAM,4CAA4C,EAAE,GAAkB,CAAA;AACtE,QAAA,MAAM,2EAA2E,EAAE,GACrE,CAAA;AAOd,QAAA,MAAM,uBAAuB,EAAE,OACe,CAAA;AAC9C,QAAA,MAAM,yBAAyB,EAAE,GAAkB,CAAA;AAEnD,QAAA,MAAM,8BAA8B,EAAE,OACQ,CAAA;AAC9C,QAAA,MAAM,yBAAyB,EAAE,OACa,CAAA;AAC9C,QAAA,MAAM,mBAAmB,EAAE,OACmB,CAAA;AAC9C,QAAA,MAAM,+BAA+B,EAAE,OACO,CAAA;AAC9C,QAAA,MAAM,kBAAkB,EAAE,OAAsD,CAAA;AAChF,QAAA,MAAM,0BAA0B,EAAE,OACY,CAAA;AAC9C,QAAA,MAAM,0BAA0B,EAAE,OACY,CAAA;AAC9C,QAAA,MAAM,+BAA+B,EAAE,OACO,CAAA;AAY9C,UAAU,wBAAwB;IAChC,IAAI,EAAE,sBAAsB,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,gBAAgB,EAAE,OAAO,CAAA;IACzB,eAAe,CAAC,EAAE,GAAG,CAAA;IACrB,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,iBAAS,aAAa,CACpB,OAAO,EAAE,wBAAwB,EACjC,kBAAkB,EAAE,GAAG,GACtB,GAAG,CA4JL;AAED,iBAAe,iBAAiB,CAC9B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,OAAO,EAAE,EACnB,QAAQ,EAAE,cAAc,GAAG,SAAS,EACpC,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,CAAC,cAAc,CAAC,CAiDzB;AAED,iBAAe,gBAAgB,CAC7B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,GAAG,SAAS,EACpC,OAAO,EAAE,OAAO,EAChB,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED,iBAAe,iBAAiB,CAC9B,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,GAAG,CAAC,CA0Bd;AAwED,iBAAe,oBAAoB,CACjC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,sBAAsB,EAAE,GAAG,EAC3B,iBAAiB,EAAE;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,GAAG,CAAA;CACnB,EAAE,EACH,oBAAoB,EAAE,MAAM,EAC5B,eAAe,CAAC,EAAE,OAAO;;;GA8B1B;AAED,iBAAS,cAAc,CACrB,OAAO,EAAE,OAAO,EAChB,eAAe,CAAC,EAAE,OAAO,GACxB,WAAW,CAqIb;AAkDD,iBAAS,eAAe,CAAC,OAAO,EAAE,OAAO,iBAyBxC;AAiED,iBAAS,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,OAAO,GAAG,UAAU,CA+L5E;AAED,iBAAS,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAezE;AAQD;;;;;;;GAOG;AACH,iBAAS,kBAAkB,CACzB,OAAO,EAAE,OAAO,EAChB,eAAe,CAAC,EAAE,OAAO,EACzB,UAAU,GAAE,MAAU,EACtB,aAAa,CAAC,EAAE,MAAM,GACrB,GAAG,CAiCL;AASD,OAAO,EACL,8BAA8B,EAC9B,kCAAkC,EAClC,mCAAmC,EACnC,4CAA4C,EAC5C,2EAA2E,EAC3E,uBAAuB,EACvB,yBAAyB,EACzB,8BAA8B,EAC9B,yBAAyB,EACzB,mBAAmB,EACnB,+BAA+B,EAC/B,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC1B,+BAA+B,EAC/B,aAAa,EACb,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,IAAI,EACJ,oBAAoB,EACpB,cAAc,EACd,SAAS,EACT,MAAM,GACP,CAAA;AAED,YAAY,EACV,YAAY,EACZ,WAAW,EACX,SAAS,EACT,wBAAwB,EACxB,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,SAAS,EACT,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,uBAAuB,EACvB,mBAAmB,EACnB,WAAW,GACZ,CAAA"}