@usearete/automations 0.0.0-stage → 0.44.1

package/dist/privy.js

@@ -0,0 +1,614 @@
+import '@usearete/sdk';
+import { base64, base58 } from '@scure/base';
+
+function encodeBase58(bytes) {
+    return base58.encode(bytes);
+}
+/** The bytes of a padded base64 string, or `null` when it is not base64. */
+function decodeBase64(text) {
+    try {
+        return base64.decode(text);
+    }
+    catch {
+        return null;
+    }
+}
+
+/**
+ * Instructions that hand control of the signer's funds to someone else
+ * without moving a balance.
+ *
+ * The policy's caps measure balance changes, and some instructions change no
+ * balance yet give the funds away: a token delegation (`approve`), a new
+ * owner or authority (`setAuthority`, System `assign`), or lamports leaving
+ * an account the signer controls that is not the signer's own (a nonce or
+ * stake withdrawal). This module names those instructions in the System, SPL
+ * Token, Token-2022, upgradeable loader and stake programs when the signer
+ * takes part in them (signs, or is one of their accounts).
+ *
+ * Top-level instructions are read from the wire bytes. Inner (CPI)
+ * instructions are read from a simulation when the RPC returns them.
+ *
+ * A token account closed to an account other than the signer is not refused;
+ * its lamports count as SOL leaving the signer.
+ */
+/** Programs that own SPL token accounts. */
+const TOKEN_PROGRAMS = [
+    'TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA',
+    'TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb',
+];
+const SYSTEM_PROGRAM = '11111111111111111111111111111111';
+const UPGRADEABLE_LOADER = 'BPFLoaderUpgradeab1e11111111111111111111111';
+const STAKE_PROGRAM = 'Stake11111111111111111111111111111111111111';
+/** Wrapped SOL mints (SPL Token and Token-2022). */
+const NATIVE_MINTS = [
+    'So11111111111111111111111111111111111111112',
+    '9pan9bMn5HatX4EJdBwg9VgCa7Uz5HL8N1m5D3NdXejP',
+];
+function isTokenProgram(program) {
+    return TOKEN_PROGRAMS.includes(program);
+}
+const TOKEN_NAMES = {
+    0: 'initializeMint',
+    1: 'initializeAccount',
+    2: 'initializeMultisig',
+    3: 'transfer',
+    4: 'approve',
+    5: 'revoke',
+    6: 'setAuthority',
+    7: 'mintTo',
+    8: 'burn',
+    9: 'closeAccount',
+    10: 'freezeAccount',
+    11: 'thawAccount',
+    12: 'transferChecked',
+    13: 'approveChecked',
+    14: 'mintToChecked',
+    15: 'burnChecked',
+    16: 'initializeAccount2',
+    17: 'syncNative',
+    18: 'initializeAccount3',
+    19: 'initializeMultisig2',
+    20: 'initializeMint2',
+    21: 'getAccountDataSize',
+    22: 'initializeImmutableOwner',
+    23: 'amountToUiAmount',
+    24: 'uiAmountToAmount',
+    25: 'initializeMintCloseAuthority',
+    29: 'reallocate',
+    31: 'createNativeMint',
+    38: 'withdrawExcessLamports',
+};
+const SYSTEM_NAMES = [
+    'createAccount',
+    'assign',
+    'transfer',
+    'createAccountWithSeed',
+    'advanceNonce',
+    'withdrawFromNonce',
+    'initializeNonce',
+    'authorizeNonce',
+    'allocate',
+    'allocateWithSeed',
+    'assignWithSeed',
+    'transferWithSeed',
+    'upgradeNonce',
+];
+const STAKE_NAMES = [
+    'initialize',
+    'authorize',
+    'delegate',
+    'split',
+    'withdraw',
+    'deactivate',
+    'setLockup',
+    'merge',
+    'authorizeWithSeed',
+    'initializeChecked',
+    'authorizeChecked',
+    'authorizeCheckedWithSeed',
+    'setLockupChecked',
+    'getMinimumDelegation',
+    'deactivateDelinquent',
+    'redelegate',
+];
+function tokenName(data) {
+    const tag = data[0];
+    if (tag === undefined)
+        return 'emptyInstruction';
+    if (tag === 26 && data[1] === 1)
+        return 'transferCheckedWithFee';
+    return TOKEN_NAMES[tag] ?? `tokenInstruction${tag}`;
+}
+function u32Tag(data) {
+    if (data.length < 4)
+        return undefined;
+    return (data[0] | (data[1] << 8) | (data[2] << 16) | (data[3] << 24)) >>> 0;
+}
+function taggedName(data, names, fallback) {
+    const tag = u32Tag(data);
+    if (tag === undefined)
+        return 'emptyInstruction';
+    return names[tag] ?? `${fallback}${tag}`;
+}
+/** The instruction's name, for the programs this module checks. */
+function instructionName(program, data) {
+    if (isTokenProgram(program))
+        return tokenName(data);
+    if (program === SYSTEM_PROGRAM)
+        return taggedName(data, SYSTEM_NAMES, 'systemInstruction');
+    if (program === STAKE_PROGRAM)
+        return taggedName(data, STAKE_NAMES, 'stakeInstruction');
+    if (program === UPGRADEABLE_LOADER) {
+        const tag = u32Tag(data);
+        return tag === undefined ? 'emptyInstruction' : `upgradeableLoaderInstruction${tag}`;
+    }
+    return null;
+}
+
+/**
+ * Consent: what a user signs to let automations run steps for their wallet.
+ *
+ * The proof is a human-readable, domain-bound message in the style of
+ * Sign-In-With-Solana. It is built from the grant's fields, so the backend
+ * rebuilds it from the fields it is given and checks the wallet's signature
+ * over that, rather than parsing a message. Raising a limit or changing a
+ * setting needs a new signature; revoking does not.
+ *
+ * The signature is an accountability and anti-bug record. It does not
+ * protect against a compromised backend; the wallet provider's policy and
+ * the protocol's on-chain rules do.
+ */
+/** The asset key for SOL (wrapped SOL included), in lamports. */
+const SOL = 'SOL';
+
+class TransactionDecodeError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'TransactionDecodeError';
+    }
+}
+/** The version byte of a v1 transaction, which leads its wire bytes. */
+const V1_PREFIX = 0x81;
+/** Configuration mask bits a v1 message may set; each adds one 4-byte value. */
+const V1_KNOWN_CONFIG_BITS = 0b11111;
+class Reader {
+    bytes;
+    at;
+    constructor(bytes, at = 0) {
+        this.bytes = bytes;
+        this.at = at;
+    }
+    compactU16() {
+        let value = 0;
+        for (let index = 0; index < 3; index++) {
+            const byte = this.bytes[this.at];
+            if (byte === undefined)
+                throw new TransactionDecodeError('truncated transaction');
+            this.at += 1;
+            value |= (byte & 0x7f) << (7 * index);
+            if ((byte & 0x80) === 0)
+                return value;
+        }
+        throw new TransactionDecodeError('invalid compact-u16 length');
+    }
+    take(length) {
+        if (this.at + length > this.bytes.length) {
+            throw new TransactionDecodeError('truncated transaction');
+        }
+        const slice = this.bytes.subarray(this.at, this.at + length);
+        this.at += length;
+        return slice;
+    }
+    byte() {
+        return this.take(1)[0];
+    }
+}
+function writableIndexes(keyCount, required, readonlySigned, readonlyUnsigned) {
+    if (required > keyCount || readonlySigned > required || readonlyUnsigned > keyCount - required) {
+        throw new TransactionDecodeError('invalid message header');
+    }
+    const out = [];
+    for (let index = 0; index < keyCount; index++) {
+        const writable = index < required ? index < required - readonlySigned : index < keyCount - readonlyUnsigned;
+        if (writable)
+            out.push(index);
+    }
+    return out;
+}
+/** Decode a legacy, v0 or v1 wire transaction. */
+function decodeTransaction(bytes) {
+    if (bytes[0] === V1_PREFIX)
+        return decodeV1(bytes);
+    const reader = new Reader(bytes);
+    const signatureCount = reader.compactU16();
+    const signatureOffset = reader.at;
+    const signatures = [];
+    for (let index = 0; index < signatureCount; index++) {
+        signatures.push(reader.take(64));
+    }
+    const messageStart = reader.at;
+    const first = bytes[reader.at];
+    if (first === undefined)
+        throw new TransactionDecodeError('truncated message');
+    let version = null;
+    if ((first & 0x80) !== 0) {
+        reader.at += 1;
+        if ((first & 0x7f) !== 0)
+            throw new TransactionDecodeError('unsupported transaction version');
+        version = 0;
+    }
+    const header = reader.take(3);
+    const [required, readonlySigned, readonlyUnsigned] = [header[0], header[1], header[2]];
+    const keyCount = reader.compactU16();
+    const staticKeys = [];
+    for (let index = 0; index < keyCount; index++) {
+        staticKeys.push(encodeBase58(reader.take(32)));
+    }
+    const writableStatic = writableIndexes(keyCount, required, readonlySigned, readonlyUnsigned);
+    reader.take(32); // recent blockhash
+    const instructionCount = reader.compactU16();
+    const instructionPrograms = [];
+    const instructions = [];
+    for (let index = 0; index < instructionCount; index++) {
+        const programIndex = reader.byte();
+        const accounts = reader.take(reader.compactU16());
+        const data = reader.take(reader.compactU16());
+        instructions.push({ programIndex, accounts: [...accounts], data: data.slice() });
+        const program = staticKeys[programIndex];
+        if (program === undefined) {
+            throw new TransactionDecodeError("an instruction's program is not a static key");
+        }
+        instructionPrograms.push(program);
+    }
+    const lookups = [];
+    if (version !== null) {
+        const count = reader.compactU16();
+        for (let index = 0; index < count; index++) {
+            const table = encodeBase58(reader.take(32));
+            const writable = [...reader.take(reader.compactU16())];
+            const readonly = [...reader.take(reader.compactU16())];
+            lookups.push({ table, writable, readonly });
+        }
+    }
+    return {
+        version,
+        signatures,
+        signatureOffset,
+        message: { start: messageStart, end: bytes.length },
+        requiredSignatures: required,
+        staticKeys,
+        writableStatic,
+        instructionPrograms,
+        instructions,
+        lookups,
+    };
+}
+/** A v1 transaction: the version byte and message, then one signature per required signer. */
+function decodeV1(bytes) {
+    const reader = new Reader(bytes, 1);
+    const header = reader.take(3);
+    const [required, readonlySigned, readonlyUnsigned] = [header[0], header[1], header[2]];
+    const maskBytes = reader.take(4);
+    const mask = (maskBytes[0] | (maskBytes[1] << 8) | (maskBytes[2] << 16) | (maskBytes[3] << 24)) >>> 0;
+    if ((mask & ~V1_KNOWN_CONFIG_BITS) >>> 0 !== 0) {
+        throw new TransactionDecodeError('unsupported v1 transaction configuration');
+    }
+    reader.take(32); // lifetime specifier
+    const instructionCount = reader.byte();
+    const keyCount = reader.byte();
+    const staticKeys = [];
+    for (let index = 0; index < keyCount; index++) {
+        staticKeys.push(encodeBase58(reader.take(32)));
+    }
+    reader.take(popcount(mask) * 4);
+    const headers = reader.take(instructionCount * 4).slice();
+    const instructionPrograms = [];
+    const instructions = [];
+    for (let offset = 0; offset < headers.length; offset += 4) {
+        const programIndex = headers[offset];
+        const accountCount = headers[offset + 1];
+        const dataLength = headers[offset + 2] | (headers[offset + 3] << 8);
+        const accounts = reader.take(accountCount);
+        const data = reader.take(dataLength);
+        instructions.push({ programIndex, accounts: [...accounts], data: data.slice() });
+        const program = staticKeys[programIndex];
+        if (program === undefined) {
+            throw new TransactionDecodeError("an instruction's program is not an address");
+        }
+        instructionPrograms.push(program);
+    }
+    const messageEnd = reader.at;
+    const signatures = [];
+    for (let index = 0; index < required; index++) {
+        signatures.push(reader.take(64));
+    }
+    if (reader.at !== bytes.length) {
+        throw new TransactionDecodeError('trailing bytes after the transaction');
+    }
+    return {
+        version: 1,
+        signatures,
+        signatureOffset: messageEnd,
+        message: { start: 0, end: messageEnd },
+        requiredSignatures: required,
+        staticKeys,
+        writableStatic: writableIndexes(keyCount, required, readonlySigned, readonlyUnsigned),
+        instructionPrograms,
+        instructions,
+        lookups: [],
+    };
+}
+function popcount(value) {
+    let count = 0;
+    for (let bits = value >>> 0; bits !== 0; bits >>>= 1)
+        count += bits & 1;
+    return count;
+}
+
+/**
+ * What a signer may sign for a user: the static policy.
+ *
+ * The rules, their names and the refusal shape match the Arete MCP server's
+ * local signer, and both implementations run the shared vectors in
+ * `test-vectors/signer-policy/`. The caps hold per transaction, measured by
+ * simulating the exact prepared bytes. Wrapped SOL counts against
+ * `maxSolPerTransaction`, as do the lamports of a token account closed to
+ * someone else. Instructions that hand control of the signer's funds to
+ * someone else (token approvals, authority changes, System assignments) are
+ * always refused, and so is any transaction whose effect on the signer
+ * could not be simulated.
+ */
+/**
+ * Programs the transaction compiler adds around a step's own instructions
+ * (compute budget, memo, fee transfers, token accounts and wrapped SOL).
+ * They are always allowed; what they move is bounded by the SOL and token
+ * caps.
+ */
+const RUNTIME_PROGRAMS = [
+    'ComputeBudget111111111111111111111111111111',
+    'MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr',
+    'Memo1UhkJRfHyvLMcVucJwxXeuD728EqVDDwQDxFMNo',
+    '11111111111111111111111111111111',
+    'ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL',
+    'TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA',
+    'TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb',
+];
+
+/**
+ * Thrown by a signer that declines to sign, for example because the wallet
+ * provider's own policy refused the transaction. The job ends `refused`
+ * with this rule instead of being retried.
+ */
+const REFUSAL_BRAND = Symbol.for('@usearete/automations/SignerRefusal');
+class SignerRefusal extends Error {
+    rule;
+    /** Recognised across entry points: each bundle has its own copy of this class. */
+    [REFUSAL_BRAND] = true;
+    constructor(message, rule = 'provider_policy') {
+        super(message);
+        this.name = 'SignerRefusal';
+        this.rule = rule;
+    }
+}
+
+/**
+ * A signer over Privy server wallets, and the Privy policy that bounds it.
+ *
+ * The signer asks Privy to sign (never to sign and send) each prepared
+ * transaction, authorized by your app's authorization key. The runtime
+ * checks the returned bytes against the intent, as for any signer.
+ *
+ * The provider policy is the bound that holds if the backend running
+ * automations is compromised, because Privy enforces it in its enclave.
+ * Privy's Solana policies see top-level instructions only, so they bound
+ * which programs a wallet may call and when, and the amounts of direct
+ * transfers, but not what a protocol program moves by CPI.
+ * `privyPolicyFor` returns the rules it could not express alongside the
+ * policy; see docs/privy-policy-expressiveness.md.
+ */
+/**
+ * The System and Token instructions a policy from `privyPolicyFor` allows.
+ * Privy's Solana policies cannot express the others (for example Token
+ * `syncNative`, which wrapping SOL needs), so its default deny refuses them.
+ */
+const PRIVY_ALLOWED_INSTRUCTIONS = {
+    system: ['transfer'],
+    token: ['transferChecked', 'closeAccount', 'initializeAccount3'],
+};
+/** The first top-level instruction a `privyPolicyFor` policy would refuse, or `null`. */
+function unsupportedInstruction(transactionBase64) {
+    const bytes = decodeBase64(transactionBase64);
+    if (!bytes)
+        return null;
+    const decoded = decodeTransaction(bytes);
+    for (const instruction of decoded.instructions) {
+        const program = decoded.staticKeys[instruction.programIndex];
+        if (program === undefined)
+            continue;
+        const isSystem = program === SYSTEM_PROGRAM;
+        const isToken = TOKEN_PROGRAMS.includes(program);
+        if (!isSystem && !isToken)
+            continue;
+        const name = instructionName(program, instruction.data) ?? 'unknown';
+        const allowed = PRIVY_ALLOWED_INSTRUCTIONS[isSystem ? 'system' : 'token'];
+        if (!allowed.includes(name))
+            return `${isSystem ? 'System' : 'Token'} \`${name}\``;
+    }
+    return null;
+}
+/** Whether an error from Privy is its policy refusing, rather than a fault to retry. */
+function isPolicyRefusal(error) {
+    const status = error?.status;
+    const message = String(error?.message ?? '');
+    return status === 403 || /polic(y|ies)/i.test(message);
+}
+/** A {@link ProtocolSigner} over Privy server wallets. */
+function privySigner(options) {
+    const { privy, walletIdFor, authorizationPrivateKey } = options;
+    if (!authorizationPrivateKey)
+        throw new TypeError('privySigner needs an authorization private key');
+    const walletId = async (wallet) => {
+        const id = await walletIdFor(wallet);
+        if (!id)
+            throw new SignerRefusal(`no Privy server access to ${wallet}`, 'signer_unavailable');
+        return id;
+    };
+    return {
+        kind: 'privy',
+        supportedTransactionFormats: options.transactionFormats ?? ['v0'],
+        async canSign(wallet) {
+            return (await walletIdFor(wallet)) !== null;
+        },
+        async delegationStatus(wallet) {
+            const id = await walletIdFor(wallet);
+            if (!id)
+                return { delegated: false, providerPolicy: false, detail: 'no Privy wallet with server access' };
+            const get = privy.wallets().get;
+            if (!get)
+                return { delegated: true, providerPolicy: false, detail: 'the Privy client cannot read wallet policies' };
+            const details = await get.call(privy.wallets(), id);
+            return { delegated: true, providerPolicy: (details.policy_ids?.length ?? 0) > 0 };
+        },
+        async signTransactions({ wallet, transactions }) {
+            if (options.refuseUnsupported !== false) {
+                for (const transaction of transactions) {
+                    const unsupported = unsupportedInstruction(transaction.transactionBase64);
+                    if (unsupported) {
+                        throw new SignerRefusal(`transaction ${transaction.index} has a top-level ${unsupported} instruction, which Privy policies cannot allow; this step cannot be signed through Privy`);
+                    }
+                }
+            }
+            const id = await walletId(wallet);
+            const signed = [];
+            for (const transaction of transactions) {
+                let result;
+                try {
+                    result = await privy.wallets().solana().signTransaction(id, {
+                        transaction: transaction.transactionBase64,
+                        authorization_context: { authorization_private_keys: [authorizationPrivateKey] },
+                    });
+                }
+                catch (error) {
+                    if (isPolicyRefusal(error)) {
+                        throw new SignerRefusal(`Privy refused to sign transaction ${transaction.index}: ${String(error.message)}`);
+                    }
+                    throw error;
+                }
+                const bytes = result.signedTransaction ?? result.signed_transaction;
+                if (typeof bytes !== 'string')
+                    throw new Error('Privy returned no signed transaction');
+                signed.push(bytes);
+            }
+            return signed;
+        },
+    };
+}
+const CHECKED_BY_INSTRUCTION = new Set([SYSTEM_PROGRAM, ...TOKEN_PROGRAMS]);
+/** The most values Privy's `in` operator accepts. */
+const PRIVY_IN_LIMIT = 100;
+function minimum(...values) {
+    return values.reduce((low, value) => (value === undefined ? low : low === undefined || value < low ? value : low), undefined);
+}
+/**
+ * The Privy policy for a wallet's consent under a signing policy, and the
+ * rules Privy cannot enforce (which the runtime still enforces, but which a
+ * compromised backend could skip).
+ *
+ * Every rule is for `signTransaction` only and holds until the consent
+ * expires. Programs from `policy.programs` (plus compute budget, memo and
+ * associated token account programs) are allowed. System transfers and
+ * token `TransferChecked` are allowed up to the smaller of the policy's and
+ * the consent's per-run caps, per instruction (wrapped SOL up to the SOL
+ * cap, as it counts as SOL); token accounts may be
+ * closed only to the wallet itself. Everything else is denied, including
+ * key export.
+ */
+function privyPolicyFor(policy, consent, options = {}) {
+    if (policy.programs === null) {
+        throw new TypeError('privyPolicyFor needs a programs allow-list: without one, Privy would have to allow every program');
+    }
+    const expires = String(Math.floor(consent.expiresAt / 1000));
+    const until = {
+        field_source: 'system',
+        field: 'current_unix_timestamp',
+        operator: 'lt',
+        value: expires,
+    };
+    const rule = (name, conditions) => ({
+        name,
+        method: 'signTransaction',
+        conditions: [...conditions, until],
+        action: 'ALLOW',
+    });
+    const programs = [...new Set([...RUNTIME_PROGRAMS, ...policy.programs])].filter((program) => !CHECKED_BY_INSTRUCTION.has(program));
+    const perRun = consent.limits.perExecution;
+    // A consent without a SOL limit lets no SOL leave, as the consent check reads it.
+    const solCap = minimum(policy.maxLamportsPerTransaction, perRun[SOL] === undefined ? 0n : BigInt(perRun[SOL]));
+    const rules = [
+        { name: 'Never export the key', method: 'exportPrivateKey', conditions: [], action: 'DENY' },
+        // Privy's `in` takes at most 100 values: one rule per hundred programs.
+        ...Array.from({ length: Math.ceil(programs.length / PRIVY_IN_LIMIT) }, (_, chunk) => rule(chunk === 0 ? 'Programs the steps may call' : `Programs the steps may call (${chunk + 1})`, [
+            {
+                field_source: 'solana_program_instruction',
+                field: 'programId',
+                operator: 'in',
+                value: programs.slice(chunk * PRIVY_IN_LIMIT, (chunk + 1) * PRIVY_IN_LIMIT),
+            },
+        ])),
+        rule('SOL transfers up to the per-run cap', [
+            { field_source: 'solana_system_program_instruction', field: 'instructionName', operator: 'eq', value: 'Transfer' },
+            { field_source: 'solana_system_program_instruction', field: 'Transfer.lamports', operator: 'lte', value: String(solCap ?? 0n) },
+        ]),
+        // Wrapped SOL counts as SOL everywhere else, so its transfers share the SOL cap.
+        ...NATIVE_MINTS.map((mint) => rule(`Wrapped SOL (${mint}) transfers up to the per-run cap`, [
+            { field_source: 'solana_token_program_instruction', field: 'instructionName', operator: 'eq', value: 'TransferChecked' },
+            { field_source: 'solana_token_program_instruction', field: 'TransferChecked.mint', operator: 'eq', value: mint },
+            { field_source: 'solana_token_program_instruction', field: 'TransferChecked.amount', operator: 'lte', value: String(solCap ?? 0n) },
+        ])),
+        rule('Token accounts closed back to the wallet', [
+            { field_source: 'solana_token_program_instruction', field: 'instructionName', operator: 'eq', value: 'CloseAccount' },
+            { field_source: 'solana_token_program_instruction', field: 'CloseAccount.destination', operator: 'eq', value: consent.wallet },
+        ]),
+        rule('Token accounts opened for the wallet', [
+            { field_source: 'solana_token_program_instruction', field: 'instructionName', operator: 'eq', value: 'InitializeAccount3' },
+        ]),
+    ];
+    const mints = new Set([...(policy.maxTokenAmounts?.keys() ?? []), ...Object.keys(perRun).filter((key) => key !== SOL)]);
+    for (const mint of [...mints].sort()) {
+        // Covered by the wrapped SOL rules above.
+        if (NATIVE_MINTS.includes(mint))
+            continue;
+        const cap = minimum(policy.maxTokenAmounts?.get(mint), perRun[mint] === undefined ? undefined : BigInt(perRun[mint]));
+        // A mint missing from either side may not leave: the stricter side wins.
+        if (cap === undefined || !policy.maxTokenAmounts?.has(mint) || perRun[mint] === undefined)
+            continue;
+        rules.push(rule(`Transfers of ${mint} up to the per-run cap`, [
+            { field_source: 'solana_token_program_instruction', field: 'instructionName', operator: 'eq', value: 'TransferChecked' },
+            { field_source: 'solana_token_program_instruction', field: 'TransferChecked.mint', operator: 'eq', value: mint },
+            { field_source: 'solana_token_program_instruction', field: 'TransferChecked.amount', operator: 'lte', value: cap.toString() },
+        ]));
+    }
+    const unenforced = [
+        'deployments and clusters: Privy does not know which deployment or cluster a transaction is for',
+        'totals: the transfer caps apply to each instruction, so several capped transfers in one transaction or run can add up to more than maxSolPerTransaction, maxTokenAmounts or the consent per-run limits',
+        'amounts a protocol program moves by CPI: Privy checks top-level instructions only, so maxSolPerTransaction, maxTokenAmounts and the consent per-run limits bind direct transfers only',
+        'authority refusals in inner instructions (approvals or authority changes a program makes by CPI)',
+        'transactions whose effect cannot be simulated: Privy policies do not read simulations',
+        'consent per-window limits: Privy has no cumulative limits on Solana',
+        'wrapped SOL a protocol program spends by CPI, and lamports of token accounts closed by CPI',
+        'steps with other top-level System or Token instructions (for example creating an account or syncNative to wrap SOL): Privy refuses them, and privySigner refuses them before asking',
+    ];
+    return {
+        policy: {
+            version: '1.0',
+            name: options.name ?? `Arete automations for ${consent.wallet}`.slice(0, 50),
+            chain_type: 'solana',
+            rules,
+        },
+        unenforced,
+    };
+}
+
+export { PRIVY_ALLOWED_INSTRUCTIONS, privyPolicyFor, privySigner };
+//# sourceMappingURL=privy.js.map

package/dist/privy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privy.js","sources":["../src/policy/encoding.ts","../src/policy/authority.ts","../src/consent/consent.ts","../src/policy/decode.ts","../src/policy/policy.ts","../src/signer/signer.ts","../src/privy/privy.ts"],"sourcesContent":[null,null,null,null,null,null,null],"names":[],"mappings":";;;AAEM,SAAU,YAAY,CAAC,KAAiB,EAAA;AAC5C,IAAA,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAeD;AACM,SAAU,YAAY,CAAC,IAAY,EAAA;AACvC,IAAA,IAAI;AACF,QAAA,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;KAC5B;AAAC,IAAA,MAAM;AACN,QAAA,OAAO,IAAI,CAAC;KACb;AACH;;AC1BA;;;;;;;;;;;;;;;;;AAiBG;AAKH;AACO,MAAM,cAAc,GAAG;IAC5B,6CAA6C;IAC7C,6CAA6C;CACrC,CAAC;AACJ,MAAM,cAAc,GAAG,kCAAkC,CAAC;AAC1D,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AACzE,MAAM,aAAa,GAAG,6CAA6C,CAAC;AAC3E;AACO,MAAM,YAAY,GAAG;IAC1B,6CAA6C;IAC7C,8CAA8C;CACtC,CAAC;AA2EL,SAAU,cAAc,CAAC,OAAe,EAAA;AAC5C,IAAA,OAAQ,cAAoC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACjE,CAAC;AAMD,MAAM,WAAW,GAA2B;AAC1C,IAAA,CAAC,EAAE,gBAAgB;AACnB,IAAA,CAAC,EAAE,mBAAmB;AACtB,IAAA,CAAC,EAAE,oBAAoB;AACvB,IAAA,CAAC,EAAE,UAAU;AACb,IAAA,CAAC,EAAE,SAAS;AACZ,IAAA,CAAC,EAAE,QAAQ;AACX,IAAA,CAAC,EAAE,cAAc;AACjB,IAAA,CAAC,EAAE,QAAQ;AACX,IAAA,CAAC,EAAE,MAAM;AACT,IAAA,CAAC,EAAE,cAAc;AACjB,IAAA,EAAE,EAAE,eAAe;AACnB,IAAA,EAAE,EAAE,aAAa;AACjB,IAAA,EAAE,EAAE,iBAAiB;AACrB,IAAA,EAAE,EAAE,gBAAgB;AACpB,IAAA,EAAE,EAAE,eAAe;AACnB,IAAA,EAAE,EAAE,aAAa;AACjB,IAAA,EAAE,EAAE,oBAAoB;AACxB,IAAA,EAAE,EAAE,YAAY;AAChB,IAAA,EAAE,EAAE,oBAAoB;AACxB,IAAA,EAAE,EAAE,qBAAqB;AACzB,IAAA,EAAE,EAAE,iBAAiB;AACrB,IAAA,EAAE,EAAE,oBAAoB;AACxB,IAAA,EAAE,EAAE,0BAA0B;AAC9B,IAAA,EAAE,EAAE,kBAAkB;AACtB,IAAA,EAAE,EAAE,kBAAkB;AACtB,IAAA,EAAE,EAAE,8BAA8B;AAClC,IAAA,EAAE,EAAE,YAAY;AAChB,IAAA,EAAE,EAAE,kBAAkB;AACtB,IAAA,EAAE,EAAE,wBAAwB;CAC7B,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,eAAe;IACf,QAAQ;IACR,UAAU;IACV,uBAAuB;IACvB,cAAc;IACd,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,UAAU;IACV,kBAAkB;IAClB,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;CACf,CAAC;AAEF,MAAM,WAAW,GAAG;IAClB,YAAY;IACZ,WAAW;IACX,UAAU;IACV,OAAO;IACP,UAAU;IACV,YAAY;IACZ,WAAW;IACX,OAAO;IACP,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,0BAA0B;IAC1B,kBAAkB;IAClB,sBAAsB;IACtB,sBAAsB;IACtB,YAAY;CACb,CAAC;AAEF,SAAS,SAAS,CAAC,IAAgB,EAAA;AACjC,IAAA,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,GAAG,KAAK,SAAS;AAAE,QAAA,OAAO,kBAAkB,CAAC;IACjD,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAAE,QAAA,OAAO,wBAAwB,CAAC;IACjE,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAmB,gBAAA,EAAA,GAAG,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,MAAM,CAAC,IAAgB,EAAA;AAC9B,IAAA,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;AAAE,QAAA,OAAO,SAAS,CAAC;AACtC,IAAA,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,UAAU,CAAC,IAAgB,EAAE,KAAwB,EAAE,QAAgB,EAAA;AAC9E,IAAA,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,GAAG,KAAK,SAAS;AAAE,QAAA,OAAO,kBAAkB,CAAC;IACjD,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAA,EAAG,GAAG,CAAA,CAAE,CAAC;AAC3C,CAAC;AAED;AACgB,SAAA,eAAe,CAAC,OAAe,EAAE,IAAgB,EAAA;IAC/D,IAAI,cAAc,CAAC,OAAO,CAAC;AAAE,QAAA,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,cAAc;QAAE,OAAO,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC;IAC3F,IAAI,OAAO,KAAK,aAAa;QAAE,OAAO,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;AACxF,IAAA,IAAI,OAAO,KAAK,kBAAkB,EAAE;AAClC,QAAA,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;AACzB,QAAA,OAAO,GAAG,KAAK,SAAS,GAAG,kBAAkB,GAAG,CAA+B,4BAAA,EAAA,GAAG,EAAE,CAAC;KACtF;AACD,IAAA,OAAO,IAAI,CAAC;AACd;;ACpNA;;;;;;;;;;;;AAYG;AAUH;AACO,MAAM,GAAG,GAAG,KAAK;;ACalB,MAAO,sBAAuB,SAAQ,KAAK,CAAA;AAC/C,IAAA,WAAA,CAAY,OAAe,EAAA;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;AACf,QAAA,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;KACtC;AACF,CAAA;AAED;AACA,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB;AACA,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAErC,MAAM,MAAM,CAAA;AAIC,IAAA,KAAA,CAAA;AAHX,IAAA,EAAE,CAAS;AAEX,IAAA,WAAA,CACW,KAAiB,EAC1B,EAAE,GAAG,CAAC,EAAA;QADG,IAAK,CAAA,KAAA,GAAL,KAAK,CAAY;AAG1B,QAAA,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;KACd;IAED,UAAU,GAAA;QACR,IAAI,KAAK,GAAG,CAAC,CAAC;AACd,QAAA,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,IAAI,KAAK,SAAS;AAAE,gBAAA,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,CAAC,CAAC;AAClF,YAAA,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AACb,YAAA,KAAK,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC;AACtC,YAAA,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC;AAAE,gBAAA,OAAO,KAAK,CAAC;SACvC;AACD,QAAA,MAAM,IAAI,sBAAsB,CAAC,4BAA4B,CAAC,CAAC;KAChE;AAED,IAAA,IAAI,CAAC,MAAc,EAAA;AACjB,QAAA,IAAI,IAAI,CAAC,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;AACxC,YAAA,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,CAAC,CAAC;SAC3D;AACD,QAAA,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;AAC7D,QAAA,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC;AAClB,QAAA,OAAO,KAAK,CAAC;KACd;IAED,IAAI,GAAA;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;KACzB;AACF,CAAA;AAED,SAAS,eAAe,CACtB,QAAgB,EAChB,QAAgB,EAChB,cAAsB,EACtB,gBAAwB,EAAA;AAExB,IAAA,IAAI,QAAQ,GAAG,QAAQ,IAAI,cAAc,GAAG,QAAQ,IAAI,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,EAAE;AAC9F,QAAA,MAAM,IAAI,sBAAsB,CAAC,wBAAwB,CAAC,CAAC;KAC5D;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;AACzB,IAAA,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC7C,MAAM,QAAQ,GACZ,KAAK,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,cAAc,GAAG,KAAK,GAAG,QAAQ,GAAG,gBAAgB,CAAC;AAC7F,QAAA,IAAI,QAAQ;AAAE,YAAA,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;KAC/B;AACD,IAAA,OAAO,GAAG,CAAC;AACb,CAAC;AAED;AACM,SAAU,iBAAiB,CAAC,KAAiB,EAAA;AACjD,IAAA,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;AAAE,QAAA,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnD,IAAA,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;AACjC,IAAA,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;AAC3C,IAAA,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC;IAClC,MAAM,UAAU,GAAiB,EAAE,CAAC;AACpC,IAAA,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,cAAc,EAAE,KAAK,EAAE,EAAE;QACnD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;KAClC;AACD,IAAA,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS;AAAE,QAAA,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;IAC/E,IAAI,OAAO,GAAa,IAAI,CAAC;IAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,EAAE;AACxB,QAAA,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AACf,QAAA,IAAI,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC;AAAE,YAAA,MAAM,IAAI,sBAAsB,CAAC,iCAAiC,CAAC,CAAC;QAC9F,OAAO,GAAG,CAAC,CAAC;KACb;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;AAC1F,IAAA,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACrC,MAAM,UAAU,GAAa,EAAE,CAAC;AAChC,IAAA,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE;AAC7C,QAAA,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;KAChD;AACD,IAAA,MAAM,cAAc,GAAG,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;AAC7F,IAAA,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChB,IAAA,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7C,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,MAAM,YAAY,GAA0B,EAAE,CAAC;AAC/C,IAAA,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,gBAAgB,EAAE,KAAK,EAAE,EAAE;AACrD,QAAA,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9C,YAAY,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,QAAA,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;AACzC,QAAA,IAAI,OAAO,KAAK,SAAS,EAAE;AACzB,YAAA,MAAM,IAAI,sBAAsB,CAAC,8CAA8C,CAAC,CAAC;SAClF;AACD,QAAA,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KACnC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;AAC7B,IAAA,IAAI,OAAO,KAAK,IAAI,EAAE;AACpB,QAAA,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;AAClC,QAAA,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,EAAE,EAAE;YAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5C,YAAA,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AACvD,YAAA,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;SAC7C;KACF;IACD,OAAO;QACL,OAAO;QACP,UAAU;QACV,eAAe;QACf,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE;AACnD,QAAA,kBAAkB,EAAE,QAAQ;QAC5B,UAAU;QACV,cAAc;QACd,mBAAmB;QACnB,YAAY;QACZ,OAAO;KACR,CAAC;AACJ,CAAC;AAED;AACA,SAAS,QAAQ,CAAC,KAAiB,EAAA;IACjC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjC,IAAA,MAAM,IAAI,GACR,CAAC,SAAS,CAAC,CAAC,CAAE,IAAI,SAAS,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;IAC/F,IAAI,CAAC,IAAI,GAAG,CAAC,oBAAoB,MAAM,CAAC,KAAK,CAAC,EAAE;AAC9C,QAAA,MAAM,IAAI,sBAAsB,CAAC,0CAA0C,CAAC,CAAC;KAC9E;AACD,IAAA,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChB,IAAA,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;AACvC,IAAA,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;AAChC,IAAA,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE;AAC7C,QAAA,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;KAChD;IACD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAChC,IAAA,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAC1D,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,MAAM,YAAY,GAA0B,EAAE,CAAC;AAC/C,IAAA,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE;AACzD,QAAA,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAE,CAAC;QACtC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;AAC1C,QAAA,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,YAAY,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,QAAA,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;AACzC,QAAA,IAAI,OAAO,KAAK,SAAS,EAAE;AACzB,YAAA,MAAM,IAAI,sBAAsB,CAAC,4CAA4C,CAAC,CAAC;SAChF;AACD,QAAA,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KACnC;AACD,IAAA,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAiB,EAAE,CAAC;AACpC,IAAA,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC7C,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;KAClC;IACD,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM,EAAE;AAC9B,QAAA,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;KAC1E;IACD,OAAO;AACL,QAAA,OAAO,EAAE,CAAC;QACV,UAAU;AACV,QAAA,eAAe,EAAE,UAAU;QAC3B,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE;AACtC,QAAA,kBAAkB,EAAE,QAAQ;QAC5B,UAAU;QACV,cAAc,EAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,CAAC;QACrF,mBAAmB;QACnB,YAAY;AACZ,QAAA,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAA;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;AACd,IAAA,KAAK,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,EAAE,IAAI,MAAM,CAAC;AAAE,QAAA,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC;AACxE,IAAA,OAAO,KAAK,CAAC;AACf;;ACrOA;;;;;;;;;;;;AAYG;AA2BH;;;;;AAKG;AACI,MAAM,gBAAgB,GAAG;IAC9B,6CAA6C;IAC7C,6CAA6C;IAC7C,6CAA6C;IAC7C,kCAAkC;IAClC,8CAA8C;IAC9C,6CAA6C;IAC7C,6CAA6C;CACrC;;ACCV;;;;AAIG;AACH,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAElE,MAAO,aAAc,SAAQ,KAAK,CAAA;AAC7B,IAAA,IAAI,CAA2C;;AAE/C,IAAA,CAAC,aAAa,IAAI,IAAI,CAAC;IAEhC,WAAY,CAAA,OAAe,EAAE,IAAA,GAAiD,iBAAiB,EAAA;QAC7F,KAAK,CAAC,OAAO,CAAC,CAAC;AACf,QAAA,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;AAC5B,QAAA,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;KAClB;AACF;;ACvED;;;;;;;;;;;;;;AAcG;AAkDH;;;;AAIG;AACU,MAAA,0BAA0B,GAA4D;IACjG,MAAM,EAAE,CAAC,UAAU,CAAC;AACpB,IAAA,KAAK,EAAE,CAAC,iBAAiB,EAAE,cAAc,EAAE,oBAAoB,CAAC;EAChE;AAEF;AACA,SAAS,sBAAsB,CAAC,iBAAyB,EAAA;AACvD,IAAA,MAAM,KAAK,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAC9C,IAAA,IAAI,CAAC,KAAK;AAAE,QAAA,OAAO,IAAI,CAAC;AACxB,IAAA,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;AACzC,IAAA,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE;QAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;AACpC,QAAA,MAAM,QAAQ,GAAG,OAAO,KAAK,cAAc,CAAC;QAC5C,MAAM,OAAO,GAAI,cAAoC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACxE,QAAA,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO;YAAE,SAAS;AACpC,QAAA,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;AACrE,QAAA,MAAM,OAAO,GAAG,0BAA0B,CAAC,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC;AAC1E,QAAA,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;AAAE,YAAA,OAAO,CAAG,EAAA,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAM,GAAA,EAAA,IAAI,IAAI,CAAC;KACpF;AACD,IAAA,OAAO,IAAI,CAAC;AACd,CAAC;AAED;AACA,SAAS,eAAe,CAAC,KAAc,EAAA;AACrC,IAAA,MAAM,MAAM,GAAI,KAAqC,EAAE,MAAM,CAAC;IAC9D,MAAM,OAAO,GAAG,MAAM,CAAE,KAAsC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IAC/E,OAAO,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC;AAED;AACM,SAAU,WAAW,CAAC,OAA2B,EAAA;IACrD,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,uBAAuB,EAAE,GAAG,OAAO,CAAC;AAChE,IAAA,IAAI,CAAC,uBAAuB;AAAE,QAAA,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;AACpG,IAAA,MAAM,QAAQ,GAAG,OAAO,MAAc,KAAI;AACxC,QAAA,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;AACrC,QAAA,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,aAAa,CAAC,CAAA,0BAAA,EAA6B,MAAM,CAAE,CAAA,EAAE,oBAAoB,CAAC,CAAC;AAC9F,QAAA,OAAO,EAAE,CAAC;AACZ,KAAC,CAAC;IACF,OAAO;AACL,QAAA,IAAI,EAAE,OAAO;AACb,QAAA,2BAA2B,EAAE,OAAO,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC;QACjE,MAAM,OAAO,CAAC,MAAM,EAAA;YAClB,OAAO,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC;SAC7C;QACD,MAAM,gBAAgB,CAAC,MAAM,EAAA;AAC3B,YAAA,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;AACrC,YAAA,IAAI,CAAC,EAAE;AAAE,gBAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;YAC1G,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC;AAChC,YAAA,IAAI,CAAC,GAAG;AAAE,gBAAA,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;AACpH,YAAA,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AACpD,YAAA,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACnF;AACD,QAAA,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,YAAY,EAAyB,EAAA;AACpE,YAAA,IAAI,OAAO,CAAC,iBAAiB,KAAK,KAAK,EAAE;AACvC,gBAAA,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE;oBACtC,MAAM,WAAW,GAAG,sBAAsB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;oBAC1E,IAAI,WAAW,EAAE;wBACf,MAAM,IAAI,aAAa,CACrB,CAAe,YAAA,EAAA,WAAW,CAAC,KAAK,CAAoB,iBAAA,EAAA,WAAW,CAA2F,yFAAA,CAAA,CAC3J,CAAC;qBACH;iBACF;aACF;AACD,YAAA,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,MAAM,GAAa,EAAE,CAAC;AAC5B,YAAA,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE;AACtC,gBAAA,IAAI,MAAmE,CAAC;AACxE,gBAAA,IAAI;AACF,oBAAA,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE;wBAC1D,WAAW,EAAE,WAAW,CAAC,iBAAiB;AAC1C,wBAAA,qBAAqB,EAAE,EAAE,0BAA0B,EAAE,CAAC,uBAAuB,CAAC,EAAE;AACjF,qBAAA,CAAC,CAAC;iBACJ;gBAAC,OAAO,KAAK,EAAE;AACd,oBAAA,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE;AAC1B,wBAAA,MAAM,IAAI,aAAa,CAAC,CAAqC,kCAAA,EAAA,WAAW,CAAC,KAAK,CAAA,EAAA,EAAK,MAAM,CAAE,KAAe,CAAC,OAAO,CAAC,CAAA,CAAE,CAAC,CAAC;qBACxH;AACD,oBAAA,MAAM,KAAK,CAAC;iBACb;gBACD,MAAM,KAAK,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,kBAAkB,CAAC;gBACpE,IAAI,OAAO,KAAK,KAAK,QAAQ;AAAE,oBAAA,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;AACvF,gBAAA,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aACpB;AACD,YAAA,OAAO,MAAM,CAAC;SACf;KACF,CAAC;AACJ,CAAC;AA2BD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAS,CAAC,cAAc,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;AACpF;AACA,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,SAAS,OAAO,CAAC,GAAG,MAAiC,EAAA;AACnD,IAAA,OAAO,MAAM,CAAC,MAAM,CAAqB,CAAC,GAAG,EAAE,KAAK,MAAM,KAAK,KAAK,SAAS,GAAG,GAAG,GAAG,GAAG,KAAK,SAAS,IAAI,KAAK,GAAG,GAAG,GAAG,KAAK,GAAG,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;AACpJ,CAAC;AAED;;;;;;;;;;;;;AAaG;AACG,SAAU,cAAc,CAC5B,MAAoB,EACpB,OAAkF,EAClF,UAAsC,EAAE,EAAA;AAExC,IAAA,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE;AAC5B,QAAA,MAAM,IAAI,SAAS,CACjB,kGAAkG,CACnG,CAAC;KACH;AACD,IAAA,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC;AAC7D,IAAA,MAAM,KAAK,GAAyB;AAClC,QAAA,YAAY,EAAE,QAAQ;AACtB,QAAA,KAAK,EAAE,wBAAwB;AAC/B,QAAA,QAAQ,EAAE,IAAI;AACd,QAAA,KAAK,EAAE,OAAO;KACf,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,UAAkC,MAAuB;QACnF,IAAI;AACJ,QAAA,MAAM,EAAE,iBAAiB;AACzB,QAAA,UAAU,EAAE,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC;AAClC,QAAA,MAAM,EAAE,OAAO;AAChB,KAAA,CAAC,CAAC;AACH,IAAA,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,gBAAgB,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACnI,IAAA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;;AAE3C,IAAA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,yBAAyB,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/G,IAAA,MAAM,KAAK,GAAsB;AAC/B,QAAA,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,kBAAkB,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;;AAE5F,QAAA,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,KAC9E,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,6BAA6B,GAAG,CAAA,6BAAA,EAAgC,KAAK,GAAG,CAAC,GAAG,EAAE;AAC/F,YAAA;AACE,gBAAA,YAAY,EAAE,4BAA4B;AAC1C,gBAAA,KAAK,EAAE,WAAW;AAClB,gBAAA,QAAQ,EAAE,IAAI;AACd,gBAAA,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,cAAc,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,cAAc,CAAC;AAC5E,aAAA;AACF,SAAA,CAAC,CACH;QACD,IAAI,CAAC,qCAAqC,EAAE;AAC1C,YAAA,EAAE,YAAY,EAAE,mCAAmC,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE;YAClH,EAAE,YAAY,EAAE,mCAAmC,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;SAChI,CAAC;;AAEF,QAAA,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,KACvB,IAAI,CAAC,CAAgB,aAAA,EAAA,IAAI,mCAAmC,EAAE;AAC5D,YAAA,EAAE,YAAY,EAAE,kCAAkC,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE;AACxH,YAAA,EAAE,YAAY,EAAE,kCAAkC,EAAE,KAAK,EAAE,sBAAsB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;YAChH,EAAE,YAAY,EAAE,kCAAkC,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;AACpI,SAAA,CAAC,CACH;QACD,IAAI,CAAC,0CAA0C,EAAE;AAC/C,YAAA,EAAE,YAAY,EAAE,kCAAkC,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE;AACrH,YAAA,EAAE,YAAY,EAAE,kCAAkC,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE;SAC/H,CAAC;QACF,IAAI,CAAC,sCAAsC,EAAE;AAC3C,YAAA,EAAE,YAAY,EAAE,kCAAkC,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,oBAAoB,EAAE;SAC5H,CAAC;KACH,CAAC;AACF,IAAA,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACxH,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;;AAEpC,QAAA,IAAK,YAAkC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;AACjE,QAAA,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;AAEtH,QAAA,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QACpG,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,CAAgB,aAAA,EAAA,IAAI,wBAAwB,EAAE;AACjD,YAAA,EAAE,YAAY,EAAE,kCAAkC,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE;AACxH,YAAA,EAAE,YAAY,EAAE,kCAAkC,EAAE,KAAK,EAAE,sBAAsB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;AAChH,YAAA,EAAE,YAAY,EAAE,kCAAkC,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE;AAC9H,SAAA,CAAC,CACH,CAAC;KACH;AACD,IAAA,MAAM,UAAU,GAAG;QACjB,gGAAgG;QAChG,wMAAwM;QACxM,uLAAuL;QACvL,kGAAkG;QAClG,uFAAuF;QACvF,qEAAqE;QACrE,4FAA4F;QAC5F,qLAAqL;KACtL,CAAC;IACF,OAAO;AACL,QAAA,MAAM,EAAE;AACN,YAAA,OAAO,EAAE,KAAK;AACd,YAAA,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,yBAAyB,OAAO,CAAC,MAAM,CAAA,CAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAC5E,YAAA,UAAU,EAAE,QAAQ;YACpB,KAAK;AACN,SAAA;QACD,UAAU;KACX,CAAC;AACJ;;;;"}